@papillon6814/pi-gh 0.0.0-stage → 0.2.0

package/dist/src/core/issue-labels.js

@@ -0,0 +1,52 @@
+import { createPreview } from './approval.js';
+import { GhClient, repositoryLabels, requireLabels, parseIssue, readIssue, repositoryIdentity } from './labels-github.js';
+import { sha } from './labels-approval.js';
+import { renderIssue } from './render.js';
+import { maskDecodedSecrets } from './secrets.js';
+import { record, parseJson } from './data.js';
+export async function createIssuePreview(issue, options = {}, client) {
+    const base = createPreview(issue);
+    if (!issue.draft.labels?.length || base.sensitive)
+        return base;
+    const gh = client ?? new GhClient(issue.draft.repo, options);
+    const repository = await repositoryIdentity(gh);
+    const labels = requireLabels(await repositoryLabels(gh), issue.draft.labels);
+    const masked = maskDecodedSecrets({ repository, labels });
+    const state = masked.value;
+    return { ...base, repository: state.repository, labels: state.labels.map(l => l.name), labelState: state.labels, digest: sha(JSON.stringify({ version: 1, host: 'github.com', issueDigest: base.digest, repository, labels })), sensitive: base.sensitive || masked.sensitive };
+}
+export async function submitLabelledIssue(issue, digest, options = {}) {
+    const client = new GhClient(issue.draft.repo, options);
+    let preview;
+    try {
+        preview = await createIssuePreview(issue, options, client);
+    }
+    catch {
+        return { status: 'rejected', problems: [{ code: 'LABEL_PREFLIGHT', path: 'labels', message: 'Cannot confirm requested labels. No Issue created.' }] };
+    }
+    if (preview.sensitive)
+        return { status: 'rejected', problems: [{ code: 'SENSITIVE', path: 'labels', message: 'Remove secret candidates before submission.' }] };
+    if (preview.digest !== digest)
+        return { status: 'rejected', problems: [{ code: 'APPROVAL_MISMATCH', path: '', message: 'Input or labels changed; preview and approve again.' }] };
+    const fixed = renderIssue(issue);
+    const result = await client.request('POST', 'issues', { title: fixed.title, body: fixed.body, labels: preview.labels });
+    if (result.status === 'not-started')
+        return { status: 'not-started', message: 'Issue creation process did not start.' };
+    const uncertain = { status: 'unknown', message: 'Issue creation outcome is uncertain. Check GitHub manually before retrying.' };
+    if (result.status !== 'ok')
+        return uncertain;
+    try {
+        const raw = parseJson(Buffer.from(result.stdout));
+        const created = parseIssue(raw, fixed.repo);
+        if (!record(raw) || raw.title !== fixed.title || raw.body !== fixed.body || created.identity.kind !== 'issue')
+            return uncertain;
+        const current = await readIssue(client, created.identity.number);
+        const confirmed = await client.read('issues/' + created.identity.number);
+        if (current.identity.id !== created.identity.id || current.identity.node_id !== created.identity.node_id || JSON.stringify(current.labels) !== JSON.stringify(preview.labelState) || !record(confirmed) || confirmed.title !== fixed.title || confirmed.body !== fixed.body)
+            return { ...uncertain, candidateUrl: created.identity.url };
+        return { status: 'created', url: created.identity.url };
+    }
+    catch {
+        return uncertain;
+    }
+}

package/dist/src/core/labels-apply.d.ts

@@ -0,0 +1,12 @@
+import type { CapturedInput, ValidationProblem } from './types.js';
+import type { GhOptions } from './gh-process.js';
+export type LabelOutcome = {
+    status: 'applied' | 'noop';
+} | {
+    status: 'rejected';
+    problems: ValidationProblem[];
+} | {
+    status: 'not-started' | 'unknown';
+    message: string;
+};
+export declare function applyLabelChange(input: CapturedInput, digest: string, options?: GhOptions): Promise<LabelOutcome>;

package/dist/src/core/labels-apply.js

@@ -0,0 +1,73 @@
+import { DataError, fail } from './data.js';
+import { validateLabelChange } from './labels-input.js';
+import { previewLabelChange } from './labels-approval.js';
+import { GhClient, repositoryLabels, readIssue } from './labels-github.js';
+import { maskSecrets, maskDecodedSecrets } from './secrets.js';
+export async function applyLabelChange(input, digest, options = {}) {
+    let started = false;
+    try {
+        if (!/^[a-f0-9]{64}$/.test(digest))
+            fail('APPROVAL_MISMATCH', '', 'A valid approval digest is required.');
+        const change = validateLabelChange(input);
+        if (maskDecodedSecrets(change).sensitive || maskSecrets(input.bytes.toString('utf8')).sensitive)
+            fail('SENSITIVE', '', 'Remove secret candidates before applying.');
+        const client = new GhClient(change.repo, options);
+        const preview = await previewLabelChange(input, options, client);
+        if (preview.sensitive)
+            fail('SENSITIVE', '', 'Remove secret candidates before applying.');
+        if (preview.digest !== digest)
+            fail('APPROVAL_MISMATCH', '', 'Input or GitHub state changed; preview and approve again.');
+        if (preview.noop)
+            return { status: 'noop' };
+        let suffix, method, payload;
+        if (change.operation === 'issue-labels') {
+            suffix = 'issues/' + change.issue;
+            method = 'PATCH';
+            payload = { labels: preview.after.map(l => l.name) };
+        }
+        else if (change.operation === 'label-create') {
+            suffix = 'labels';
+            method = 'POST';
+            payload = { name: change.name, color: change.color, description: change.description ?? '' };
+        }
+        else {
+            suffix = 'labels/' + encodeURIComponent(preview.before.name);
+            if (change.operation === 'label-delete') {
+                method = 'DELETE';
+            }
+            else {
+                method = 'PATCH';
+                payload = { ...(change.newName === undefined ? {} : { new_name: change.newName }), ...(change.color === undefined ? {} : { color: change.color }), ...(change.description === undefined ? {} : { description: change.description }) };
+            }
+        }
+        const result = await client.request(method, suffix, payload);
+        if (result.status === 'not-started')
+            return { status: 'not-started', message: 'Change process did not start.' };
+        started = true;
+        if (result.status !== 'ok')
+            throw new Error('Uncertain write');
+        if (change.operation === 'issue-labels') {
+            const current = await readIssue(client, change.issue);
+            if (JSON.stringify(current.identity) !== JSON.stringify(preview.issue) || JSON.stringify(current.labels) !== JSON.stringify(preview.after))
+                throw new Error('Unconfirmed issue labels');
+        }
+        else {
+            const all = await repositoryLabels(client), expected = preview.after, before = preview.before;
+            if (!expected) {
+                if (all.some(l => l.id === before.id || l.name.toLowerCase() === before.name.toLowerCase()))
+                    throw new Error('Unconfirmed deletion');
+            }
+            else {
+                const current = all.find(l => l.name === expected.name);
+                if (!current || current.color !== expected.color || current.description !== expected.description || (before && (current.id !== before.id || current.node_id !== before.node_id)))
+                    throw new Error('Unconfirmed label');
+            }
+        }
+        return { status: 'applied' };
+    }
+    catch (e) {
+        if (started)
+            return { status: 'unknown', message: 'Change outcome is uncertain. Check GitHub manually before retrying.' };
+        return { status: 'rejected', problems: [e instanceof DataError ? { code: e.code, path: e.field, message: e.message } : { code: 'LABEL_FAILED', path: '', message: 'Could not confirm label change. No changes performed.' }] };
+    }
+}

package/dist/src/core/labels-approval.d.ts

@@ -0,0 +1,10 @@
+import { GhClient, type LabelState } from './labels-github.js';
+import type { CapturedInput } from './types.js';
+import type { GhOptions } from './gh-process.js';
+export type LabelPreview = LabelState & {
+    digest: string;
+    sensitive: boolean;
+    noop: boolean;
+};
+export declare const sha: (value: string | Buffer) => string;
+export declare function previewLabelChange(input: CapturedInput, options?: GhOptions, client?: GhClient): Promise<LabelPreview>;

package/dist/src/core/labels-approval.js

@@ -0,0 +1,12 @@
+import { createHash } from 'node:crypto';
+import { validateLabelChange } from './labels-input.js';
+import { GhClient, captureLabelState } from './labels-github.js';
+import { maskSecrets, maskDecodedSecrets } from './secrets.js';
+export const sha = (value) => createHash('sha256').update(value).digest('hex');
+export async function previewLabelChange(input, options = {}, client) {
+    const change = validateLabelChange(input);
+    const state = await captureLabelState(change, client ?? new GhClient(change.repo, options));
+    const digest = sha(JSON.stringify({ version: 1, host: 'github.com', path: input.path, input: sha(input.bytes), state }));
+    const masked = maskDecodedSecrets(state);
+    return { ...masked.value, digest, sensitive: masked.sensitive || maskDecodedSecrets(change).sensitive || maskSecrets(input.bytes.toString('utf8')).sensitive, noop: JSON.stringify(state.before) === JSON.stringify(state.after) };
+}

package/dist/src/core/labels-github.d.ts

@@ -0,0 +1,54 @@
+import { type GhOptions, type GhResult } from './gh-process.js';
+import { type LabelChange } from './labels-input.js';
+export type Label = {
+    id: number;
+    node_id: string;
+    name: string;
+    color: string;
+    description: string;
+};
+export type Affected = {
+    id: number;
+    node_id: string;
+    number: number;
+    url: string;
+    kind: 'issue' | 'pull-request';
+};
+export type Repository = {
+    id: number;
+    node_id: string;
+    full_name: string;
+};
+export declare function repositoryIdentity(client: GhClient): Promise<Repository>;
+export type LabelState = {
+    repository: Repository;
+    repo: string;
+    operation: LabelChange['operation'];
+    issue?: Affected;
+    before: Label | Label[] | null;
+    after: Label | Label[] | null;
+    affected: Affected[];
+};
+export declare class GhClient {
+    readonly repo: string;
+    private readonly options;
+    private readonly expires;
+    constructor(repo: string, options?: GhOptions);
+    endpoint(suffix: string): string;
+    request(method: 'GET' | 'POST' | 'PATCH' | 'DELETE', suffix: string, payload?: unknown): Promise<GhResult>;
+    read(suffix: string): Promise<unknown>;
+    list(suffix: string): Promise<unknown[]>;
+}
+export declare function parseLabel(v: unknown): Label;
+export declare const sortLabels: (labels: Label[]) => Label[];
+export declare function repositoryLabels(client: GhClient): Promise<Label[]>;
+export declare function requireLabels(all: Label[], names: string[]): Label[];
+export declare function parseIssue(v: unknown, repo: string): {
+    identity: Affected;
+    labels: Label[];
+};
+export declare function readIssue(client: GhClient, number: number): Promise<{
+    identity: Affected;
+    labels: Label[];
+}>;
+export declare function captureLabelState(change: LabelChange, client: GhClient): Promise<LabelState>;

package/dist/src/core/labels-github.js

@@ -0,0 +1,114 @@
+import { fail, record, nonblank, parseJson } from './data.js';
+import { runGh } from './gh-process.js';
+import { labelKey, validateLabelName, validateRepo } from './labels-input.js';
+export async function repositoryIdentity(client) {
+    const value = await client.read('');
+    if (!record(value) || !Number.isSafeInteger(value.id) || value.id < 1 || !nonblank(value.node_id) || typeof value.full_name !== 'string' || value.full_name.toLowerCase() !== client.repo.toLowerCase() || typeof value.html_url !== 'string' || value.html_url.toLowerCase() !== ('https://github.com/' + client.repo).toLowerCase())
+        fail('GITHUB_REPOSITORY', '', 'Cannot confirm the requested repository identity.');
+    return { id: value.id, node_id: value.node_id, full_name: value.full_name };
+}
+export class GhClient {
+    repo;
+    options;
+    expires = Date.now() + 60000;
+    constructor(repo, options = {}) {
+        this.repo = repo;
+        this.options = options;
+        validateRepo(repo);
+    }
+    endpoint(suffix) { return 'repos/' + this.repo + (suffix ? '/' + suffix : ''); }
+    async request(method, suffix, payload) {
+        const remaining = Math.min(this.options.timeoutMs ?? 60000, this.expires - Date.now());
+        if (remaining <= 0)
+            return { status: 'not-started', stdout: '' };
+        const args = ['api', '--hostname=github.com', '--method', method, this.endpoint(suffix), '-H', 'Accept: application/vnd.github+json', '-H', 'X-GitHub-Api-Version: 2022-11-28', ...(payload === undefined ? [] : ['--input', '-'])];
+        return runGh(args, payload === undefined ? '' : JSON.stringify(payload), { ...this.options, timeoutMs: remaining });
+    }
+    async read(suffix) {
+        const r = await this.request('GET', suffix);
+        if (r.status !== 'ok')
+            fail('GITHUB_READ', '', 'Cannot confirm GitHub state. No changes performed.');
+        try {
+            return parseJson(Buffer.from(r.stdout));
+        }
+        catch {
+            fail('GITHUB_RESPONSE', '', 'Invalid GitHub response.');
+        }
+    }
+    async list(suffix) {
+        const result = [];
+        let bytes = 0;
+        for (let page = 1; page <= 100; page++) {
+            const value = await this.read(suffix + (suffix.includes('?') ? '&' : '?') + 'per_page=100&page=' + page);
+            if (!Array.isArray(value) || value.length > 100)
+                fail('GITHUB_RESPONSE', '', 'Expected a paginated array.');
+            bytes += Buffer.byteLength(JSON.stringify(value));
+            if (bytes > 1048576)
+                fail('GITHUB_LIMIT', '', 'Complete listing exceeds 1 MiB. Narrow the repository or inspect manually.');
+            result.push(...value);
+            if (value.length < 100)
+                return result;
+        }
+        fail('GITHUB_LIMIT', '', 'Incomplete listing: more than 100 pages.');
+    }
+}
+export function parseLabel(v) {
+    if (!record(v) || !Number.isSafeInteger(v.id) || v.id < 1 || !nonblank(v.node_id) || typeof v.color !== 'string' || !/^[a-fA-F0-9]{6}$/.test(v.color) || (v.description !== null && typeof v.description !== 'string'))
+        fail('GITHUB_RESPONSE', '', 'Invalid label.');
+    validateLabelName(v.name);
+    return { id: v.id, node_id: v.node_id, name: v.name, color: v.color.toLowerCase(), description: v.description ?? '' };
+}
+export const sortLabels = (labels) => labels.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : a.id - b.id);
+export async function repositoryLabels(client) {
+    const labels = (await client.list('labels')).map(parseLabel);
+    if (new Set(labels.map(l => labelKey(l.name))).size !== labels.length || new Set(labels.map(l => l.id)).size !== labels.length)
+        fail('GITHUB_RESPONSE', '', 'Duplicate labels in listing.');
+    return sortLabels(labels);
+}
+export function requireLabels(all, names) {
+    return sortLabels(names.map(n => { const l = all.find(x => labelKey(x.name) === labelKey(n)); if (!l)
+        fail('LABEL_MISSING', '', 'Requested label does not exist. Create it separately.'); return l; }));
+}
+export function parseIssue(v, repo) {
+    if (!record(v) || !Number.isSafeInteger(v.id) || v.id < 1 || !nonblank(v.node_id) || !Number.isSafeInteger(v.number) || v.number < 1 || !Array.isArray(v.labels) || typeof v.html_url !== 'string')
+        fail('GITHUB_RESPONSE', '', 'Invalid Issue response.');
+    const kind = v.pull_request === undefined ? 'issue' : 'pull-request';
+    const expected = 'https://github.com/' + repo + '/' + (kind === 'issue' ? 'issues' : 'pull') + '/' + v.number;
+    if (v.html_url.toLowerCase() !== expected.toLowerCase())
+        fail('GITHUB_RESPONSE', '', 'Unexpected Issue URL.');
+    const labels = v.labels.map(parseLabel);
+    if (new Set(labels.map(l => l.id)).size !== labels.length || new Set(labels.map(l => labelKey(l.name))).size !== labels.length)
+        fail('GITHUB_RESPONSE', '', 'Duplicate Issue labels.');
+    return { identity: { id: v.id, node_id: v.node_id, number: v.number, url: v.html_url, kind }, labels: sortLabels(labels) };
+}
+export async function readIssue(client, number) {
+    const issue = parseIssue(await client.read('issues/' + number), client.repo);
+    if (issue.identity.number !== number || issue.identity.kind !== 'issue')
+        fail('LABEL_ISSUE', '', 'Target must be an Issue, not a pull request.');
+    return issue;
+}
+export async function captureLabelState(change, client) {
+    const repository = await repositoryIdentity(client);
+    const all = await repositoryLabels(client);
+    if (change.operation === 'issue-labels') {
+        const issue = await readIssue(client, change.issue);
+        const add = requireLabels(all, change.add ?? []), remove = requireLabels(all, change.remove ?? []);
+        const after = sortLabels([...issue.labels.filter(l => !remove.some(r => r.id === l.id)), ...add.filter(l => !issue.labels.some(x => x.id === l.id))]);
+        return { repository, repo: change.repo, operation: change.operation, issue: issue.identity, before: issue.labels, after, affected: [] };
+    }
+    const before = all.find(l => labelKey(l.name) === labelKey(change.name)) ?? null;
+    if (change.operation === 'label-create') {
+        if (before)
+            fail('LABEL_EXISTS', '', 'Label already exists; use an explicit edit.');
+        return { repository, repo: change.repo, operation: change.operation, before: null, after: { id: 0, node_id: '', name: change.name, color: change.color.toLowerCase(), description: change.description ?? '' }, affected: [] };
+    }
+    if (!before)
+        fail('LABEL_MISSING', '', 'Requested label does not exist.');
+    if (change.operation === 'label-edit' && change.newName && all.some(l => labelKey(l.name) === labelKey(change.newName) && l.id !== before.id))
+        fail('LABEL_EXISTS', '', 'New name collides with an existing label.');
+    const affected = (await client.list('issues?state=all&sort=created&direction=asc')).map(v => parseIssue(v, change.repo)).filter(i => i.labels.some(l => l.id === before.id)).map(i => i.identity).sort((a, b) => a.number - b.number);
+    if (new Set(affected.map(i => i.id)).size !== affected.length)
+        fail('GITHUB_RESPONSE', '', 'Duplicate Issues in impact listing.');
+    const after = change.operation === 'label-delete' ? null : { ...before, name: change.newName ?? before.name, color: change.color?.toLowerCase() ?? before.color, description: change.description ?? before.description };
+    return { repository, repo: change.repo, operation: change.operation, before, after, affected };
+}

package/dist/src/core/labels-input.d.ts

@@ -0,0 +1,31 @@
+import type { CapturedInput } from './types.js';
+type Base = {
+    version: 1;
+    repo: string;
+};
+export type LabelChange = Base & ({
+    operation: 'issue-labels';
+    issue: number;
+    add?: string[];
+    remove?: string[];
+} | {
+    operation: 'label-create';
+    name: string;
+    color: string;
+    description?: string;
+} | {
+    operation: 'label-edit';
+    name: string;
+    newName?: string;
+    color?: string;
+    description?: string;
+} | {
+    operation: 'label-delete';
+    name: string;
+});
+export declare function labelKey(name: string): string;
+export declare function validateRepo(value: unknown): asserts value is string;
+export declare function validateLabelName(value: unknown): asserts value is string;
+export declare function validateLabelNames(value: unknown): string[];
+export declare function validateLabelChange(input: CapturedInput): LabelChange;
+export {};

package/dist/src/core/labels-input.js

@@ -0,0 +1,58 @@
+import { fail, keys, record, parseJson, nonblank } from './data.js';
+export function labelKey(name) { return name.toLowerCase(); }
+export function validateRepo(value) {
+    if (typeof value !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9-]{0,99}\/[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,99}$/.test(value) || value.endsWith('/.') || value.endsWith('/..'))
+        fail('LABEL_REPO', 'repo', 'Expected OWNER/REPO.');
+}
+export function validateLabelName(value) {
+    if (!nonblank(value) || value === '.' || value === '..' || /[\u0000-\u001f\u007f]/.test(value) || Array.from(value).length > 50)
+        fail('LABEL_NAME', 'labels', 'Expected a nonblank label name up to 50 characters without control characters.');
+}
+export function validateLabelNames(value) {
+    if (!Array.isArray(value) || value.length > 100)
+        fail('LABEL_LIST', 'labels', 'Expected at most 100 label names.');
+    const seen = new Set();
+    for (const name of value) {
+        validateLabelName(name);
+        const key = labelKey(name);
+        if (seen.has(key))
+            fail('LABEL_DUPLICATE', 'labels', 'Duplicate label name.');
+        seen.add(key);
+    }
+    return value;
+}
+export function validateLabelChange(input) {
+    const v = parseJson(input.bytes);
+    if (!record(v) || v.version !== 1)
+        fail('LABEL_INPUT', '', 'Expected version 1 label change.');
+    validateRepo(v.repo);
+    const allowed = {
+        'issue-labels': ['issue', 'add', 'remove'], 'label-create': ['name', 'color', 'description'],
+        'label-edit': ['name', 'newName', 'color', 'description'], 'label-delete': ['name']
+    };
+    if (typeof v.operation !== 'string' || !Object.hasOwn(allowed, v.operation))
+        fail('LABEL_OPERATION', 'operation', 'Unknown label operation.');
+    keys(v, ['version', 'repo', 'operation', ...allowed[v.operation]], 'change');
+    if (v.operation === 'issue-labels') {
+        if (!Number.isSafeInteger(v.issue) || v.issue < 1)
+            fail('LABEL_ISSUE', 'issue', 'Expected a positive Issue number.');
+        const add = v.add === undefined ? [] : validateLabelNames(v.add), remove = v.remove === undefined ? [] : validateLabelNames(v.remove);
+        if (!add.length && !remove.length)
+            fail('LABEL_EMPTY', '', 'No label changes requested.');
+        if (add.some(x => remove.some(y => labelKey(x) === labelKey(y))))
+            fail('LABEL_CONFLICT', '', 'Cannot add and remove the same label.');
+    }
+    else {
+        validateLabelName(v.name);
+        if (v.newName !== undefined)
+            validateLabelName(v.newName);
+        if (v.operation === 'label-create' || v.color !== undefined)
+            if (typeof v.color !== 'string' || !/^[0-9a-fA-F]{6}$/.test(v.color))
+                fail('LABEL_COLOR', 'color', 'Expected a six-digit hexadecimal color.');
+        if (v.description !== undefined && (typeof v.description !== 'string' || /[\u0000-\u001f\u007f]/.test(v.description) || Array.from(v.description).length > 100))
+            fail('LABEL_DESCRIPTION', 'description', 'Expected a single-line description up to 100 characters.');
+        if (v.operation === 'label-edit' && v.newName === undefined && v.color === undefined && v.description === undefined)
+            fail('LABEL_EMPTY', '', 'No label changes requested.');
+    }
+    return v;
+}

package/dist/src/core/render.d.ts

@@ -0,0 +1,6 @@
+import type { ValidatedIssue } from './types.js';
+export declare function renderIssue(issue: ValidatedIssue): {
+    repo: string;
+    title: string;
+    body: string;
+};

package/dist/src/core/render.js

@@ -0,0 +1,21 @@
+export function renderIssue(issue) {
+    const { draft: d, bundle: { template: t } } = issue;
+    const blocks = [];
+    if (d.parentIssue !== undefined)
+        blocks.push('## 親Issue\n\nhttps://github.com/' + d.repo + '/issues/' + d.parentIssue);
+    for (const f of t.fields) {
+        const v = d.fields[f.id];
+        if (v === undefined)
+            continue;
+        let content;
+        if (f.type === 'criteria')
+            content = v.map(c => '- [ ] ' + c.id + ': ' + c.requirement + '\n  - 検証: ' + c.verification + '\n  - 期待結果: ' + c.expectedResult).join('\n');
+        else if (Array.isArray(v))
+            content = v.map(s => '- ' + s).join('\n');
+        else
+            content = v;
+        blocks.push('## ' + f.label + '\n\n' + content);
+    }
+    blocks.push('## 担当モデル\n\n' + t.agents.map(name => { const a = d.agents[name]; return '- ' + name + ': `' + a.model + '` / `' + a.thinking + '`\n  - 選定理由: ' + a.reason + (a.upperTierApproval ? '\n  - 上位利用承認: ' + a.upperTierApproval : ''); }).join('\n'));
+    return { repo: d.repo, title: d.title, body: (blocks.join('\n\n') + '\n').replace(/\r\n?/g, '\n') };
+}

package/dist/src/core/secrets.d.ts

@@ -0,0 +1,9 @@
+export declare function maskSecrets(value: string): {
+    text: string;
+    sensitive: boolean;
+};
+/** Inspect decoded JSON values before serialization so escaping cannot hide a candidate. */
+export declare function maskDecodedSecrets<T>(value: T): {
+    value: T;
+    sensitive: boolean;
+};

package/dist/src/core/secrets.js

@@ -0,0 +1,35 @@
+const patterns = [
+    /\b(?:sk_live_[a-zA-Z0-9_-]{8,}|sk-[a-zA-Z0-9_-]{16,}|(?:gh[pousr]_[a-zA-Z0-9]{16,}|github_pat_[a-zA-Z0-9_]{20,})|xox[baprs]-[a-zA-Z0-9-]{8,})\b/g,
+    /\bBearer\s+[a-zA-Z0-9._~+\/-]{12,}=*/gi,
+    /\b(?:api[_-]?key|access[_-]?token|refresh[_-]?token|password|client[_-]?secret|authorization)\s*["']?\s*[:=]\s*["']?(?!\s*(?:\$|<|placeholder|example|changeme|your[_-]))[a-zA-Z0-9_./+=:-]{8,}/gi
+];
+export function maskSecrets(value) {
+    let text = value, sensitive = false;
+    for (const pattern of patterns) {
+        pattern.lastIndex = 0;
+        text = text.replace(pattern, () => { sensitive = true; return '[REDACTED]'; });
+    }
+    return { text, sensitive };
+}
+/** Inspect decoded JSON values before serialization so escaping cannot hide a candidate. */
+export function maskDecodedSecrets(value) {
+    let sensitive = false;
+    const mask = (text) => {
+        const result = maskSecrets(text);
+        sensitive ||= result.sensitive;
+        return result.text;
+    };
+    const visit = (item) => {
+        if (typeof item === 'string')
+            return mask(item);
+        if (Array.isArray(item))
+            return item.map(visit);
+        if (item !== null && typeof item === 'object')
+            return Object.fromEntries(Object.entries(item).map(([key, child]) => [mask(key), visit(child)]));
+        if (item === null || item === undefined || typeof item === 'number' || typeof item === 'boolean')
+            return item;
+        throw new TypeError('Secret inspection expects decoded data.');
+    };
+    const masked = visit(value);
+    return { value: masked, sensitive };
+}

package/dist/src/core/submit.d.ts

@@ -0,0 +1,3 @@
+import { type GhOptions } from './gh-process.js';
+import type { SubmitOutcome, ValidatedIssue } from './types.js';
+export declare function submitIssue(issue: ValidatedIssue, approvedDigest: string, options?: GhOptions): Promise<SubmitOutcome>;

package/dist/src/core/submit.js

@@ -0,0 +1,37 @@
+import { runGh } from './gh-process.js';
+import { createPreview } from './approval.js';
+import { renderIssue } from './render.js';
+import { validateDraft } from './draft.js';
+import { submitLabelledIssue } from './issue-labels.js';
+export async function submitIssue(issue, approvedDigest, options = {}) {
+    const checked = validateDraft(issue.draftInput, issue.bundle);
+    if (!checked.issue)
+        return { status: 'rejected', problems: checked.problems };
+    const preview = createPreview(checked.issue);
+    if (preview.sensitive)
+        return { status: 'rejected', problems: [{ code: 'SENSITIVE', path: '', message: 'Secret candidates must be removed before submission.' }] };
+    if (!/^[a-f0-9]{64}$/.test(approvedDigest))
+        return { status: 'rejected', problems: [{ code: 'APPROVAL_MISMATCH', path: '', message: 'Approval does not match the current content.' }] };
+    if (checked.issue.draft.labels?.length)
+        return submitLabelledIssue(checked.issue, approvedDigest, options);
+    if (preview.digest !== approvedDigest)
+        return { status: 'rejected', problems: [{ code: 'APPROVAL_MISMATCH', path: '', message: 'Approval does not match the current content.' }] };
+    const fixed = renderIssue(checked.issue);
+    const result = await runGh(['issue', 'create', '--repo=github.com/' + fixed.repo, '--title=' + fixed.title, '--body-file', '-'], fixed.body, options);
+    if (result.status === 'not-started')
+        return { status: 'not-started', message: 'Unable to start gh or invalid process limits.' };
+    const urls = result.stdout.trim().split(/\s+/).filter(v => v.startsWith('https://github.com/'));
+    let url;
+    if (urls.length === 1) {
+        try {
+            const u = new URL(urls[0]);
+            const parts = u.pathname.split('/');
+            if (u.origin === 'https://github.com' && !u.search && !u.hash && parts.length === 5 && (parts[1] + '/' + parts[2]).toLowerCase() === fixed.repo.toLowerCase() && parts[3] === 'issues' && /^[1-9][0-9]*$/.test(parts[4]))
+                url = u.href;
+        }
+        catch { /* Invalid URL is uncertain. */ }
+    }
+    if (result.status === 'ok' && url)
+        return { status: 'created', url };
+    return { status: 'unknown', message: 'Submission outcome is uncertain. Check GitHub manually before retrying.', ...(url ? { candidateUrl: url } : {}) };
+}

package/dist/src/core/template.d.ts

@@ -0,0 +1,2 @@
+import type { TemplateBundle } from './types.js';
+export declare function loadTemplate(file: string): Promise<TemplateBundle>;

package/dist/src/core/template.js

@@ -0,0 +1,80 @@
+import { dirname, resolve, isAbsolute } from 'node:path';
+import { capture, parseYaml, record, keys, nonblank, validId, fail } from './data.js';
+const thinking = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'];
+const fieldKeys = ['id', 'label', 'type', 'required', 'description', 'options', 'minLength', 'maxLength', 'minItems', 'maxItems'];
+function field(value) {
+    if (!record(value))
+        fail('FIELD_TYPE', 'fields', 'Field must be an object.');
+    keys(value, fieldKeys, 'fields');
+    if (!validId(value.id) || !nonblank(value.label) || (typeof value.type !== 'string' || !['string', 'text', 'string-list', 'criteria'].includes(value.type)) || typeof value.required !== 'boolean')
+        fail('FIELD_INVALID', 'fields', 'Invalid field definition.');
+    if (value.description !== undefined && !nonblank(value.description))
+        fail('FIELD_INVALID', 'fields', 'Description must be nonblank.');
+    for (const k of ['minLength', 'maxLength', 'minItems', 'maxItems'])
+        if (value[k] !== undefined && (!Number.isSafeInteger(value[k]) || value[k] < 0 || value[k] > 1048576))
+            fail('FIELD_BOUND', 'fields', 'Invalid bound.');
+    if (value.minLength !== undefined && value.maxLength !== undefined && value.minLength > value.maxLength)
+        fail('FIELD_BOUND', 'fields', 'Invalid length range.');
+    if (value.minItems !== undefined && value.maxItems !== undefined && value.minItems > value.maxItems)
+        fail('FIELD_BOUND', 'fields', 'Invalid item range.');
+    const list = ['string-list', 'criteria'].includes(value.type);
+    if (!list && (value.minItems !== undefined || value.maxItems !== undefined))
+        fail('FIELD_BOUND', 'fields', 'Item bounds require a list.');
+    if (value.type === 'criteria' && (value.options !== undefined || value.minLength !== undefined || value.maxLength !== undefined))
+        fail('FIELD_BOUND', 'fields', 'Criteria use item bounds only.');
+    if (value.options !== undefined && (!Array.isArray(value.options) || !value.options.length || !value.options.every(nonblank) || new Set(value.options).size !== value.options.length))
+        fail('FIELD_OPTIONS', 'fields', 'Invalid options.');
+    return value;
+}
+function definition(value) {
+    if (!record(value))
+        fail('TEMPLATE_INVALID', '', 'Template must be an object.');
+    keys(value, ['version', 'id', 'name', 'description', 'kind', 'fields', 'agents', 'modelPolicy'], 'template');
+    if (value.version !== 1 || !validId(value.id) || !nonblank(value.name) || !nonblank(value.description) || (typeof value.kind !== 'string' || !['parent', 'task'].includes(value.kind)) || !nonblank(value.modelPolicy))
+        fail('TEMPLATE_INVALID', '', 'Invalid template metadata.');
+    if (!Array.isArray(value.fields) || !value.fields.length)
+        fail('TEMPLATE_FIELDS', 'fields', 'At least one field is required.');
+    const fields = value.fields.map(field);
+    if (new Set(fields.map(f => f.id)).size !== fields.length)
+        fail('FIELD_DUPLICATE', 'fields', 'Duplicate field IDs.');
+    if (!Array.isArray(value.agents) || !value.agents.length || !value.agents.every(validId) || new Set(value.agents).size !== value.agents.length)
+        fail('TEMPLATE_AGENTS', 'agents', 'Invalid agent list.');
+    return { ...value, fields };
+}
+function policy(value) {
+    if (!record(value))
+        fail('POLICY_INVALID', '', 'Policy must be an object.');
+    keys(value, ['version', 'agents'], 'policy');
+    if (value.version !== 1 || !record(value.agents) || !Object.keys(value.agents).length)
+        fail('POLICY_INVALID', 'agents', 'Invalid model policy.');
+    for (const [agent, profiles] of Object.entries(value.agents)) {
+        if (!validId(agent) || !Array.isArray(profiles) || !profiles.length)
+            fail('POLICY_AGENT', 'agents', 'Invalid agent profiles.');
+        const seen = new Set();
+        for (const p of profiles) {
+            if (!record(p))
+                fail('POLICY_PROFILE', 'agents', 'Profile must be an object.');
+            keys(p, ['model', 'thinking', 'tier'], 'agents');
+            if (!nonblank(p.model) || !/^[^\s/]+\/[^\s]+$/.test(p.model) || typeof p.thinking !== 'string' || !thinking.includes(p.thinking) || typeof p.tier !== 'string' || !['basic', 'upper'].includes(p.tier))
+                fail('POLICY_PROFILE', 'agents', 'Invalid profile.');
+            const key = JSON.stringify([p.model, p.thinking]);
+            if (seen.has(key))
+                fail('POLICY_DUPLICATE', 'agents', 'Duplicate profile.');
+            seen.add(key);
+        }
+    }
+    return value;
+}
+export async function loadTemplate(file) {
+    const input = await capture(file);
+    const t = definition(parseYaml(input.bytes));
+    const root = dirname(input.path);
+    if (isAbsolute(t.modelPolicy) || t.modelPolicy.includes('://') || t.modelPolicy.startsWith('~'))
+        fail('POLICY_PATH', '', 'Policy must be a local relative path.');
+    const policyInput = await capture(resolve(root, t.modelPolicy), root);
+    const p = policy(parseYaml(policyInput.bytes));
+    for (const agent of t.agents)
+        if (!Object.hasOwn(p.agents, agent))
+            fail('POLICY_MISSING', 'agents', 'Template agent has no policy.');
+    return { template: t, policy: p, inputs: [input, policyInput] };
+}