@paysdoc/devplatform 1.0.0 → 1.2.0

package/README.md

@@ -17,30 +17,47 @@ The package ships three entry points:
 
 ```ts
 import { BoardStatus, type Issue, type RepoContext } from '@paysdoc/devplatform';         // forge ports + domain model
-import { forgeProviders } from '@paysdoc/devplatform/providers';                          // adapter assembly + GitHub/GitLab/Jira adapters
+import { forgeProviders, createForgeCredentials } from '@paysdoc/devplatform/providers';  // adapter assembly + GitHub/GitLab/Jira adapters
 import { GitContext, consoleLogger } from '@paysdoc/devplatform/git';                     // forge-neutral git/worktree core
 ```
 
+A launch boundary obtains its `TokenProvider` and bootstrap `GitIdentity` from the forge name
+alone, then hands both straight to `GitContext` — no GitHub- or GitLab-named import required:
+
+```ts
+import { Platform } from '@paysdoc/devplatform';
+
+const { tokenProvider, gitIdentity } = createForgeCredentials({
+  forge: { codeHost: 'github', issueTracker: 'github' },
+  identity: { owner: 'acme', repo: 'webapp', platform: Platform.GitHub },
+  deps: { github: { appConfig: null, pat: process.env.GH_TOKEN } },
+});
+const gitContext = new GitContext({ owner: 'acme', repo: 'webapp', selfHost: false, gitIdentity, tokenProvider, frameworkRepoRoot, targetReposDir });
+```
+
 ## What it does
 
 - **Forge-neutral git executor** — `GitContext.exec()` is the single spawn site, env merge, cwd resolution, and ENOENT rewrap for every git command; no forge semantics leak into it.
 - **Identity-bound context construction** — a `GitContext` is built from a mandatory owner/repo/selfHost/tokenProvider/gitIdentity; incomplete identity fails at construction rather than at first use.
 - **Worktree lifecycle management** — create/ensure, list, remove, probe (health: `healthy`/`locked`/`prunable`/`missing`), and reset (takeover) operations for git worktrees under `.worktrees/`.
-- **Branch, commit, and remote operations** — branch creation/switching, commits, and remote push/fetch helpers layered on the shared executor.
+- **Branch, commit, and remote operations** — branch creation/switching, commits, and remote push/fetch helpers layered on the shared executor; `commitOps`, `branchOps`, and `isLeaseRejection` ship from `@paysdoc/devplatform/git` since issue #11, for a consumer that wants to drive them directly.
 - **Working-directory guard** — turns a spawn ENOENT caused by a missing cwd into a diagnostic naming the path and repo identity, keyed off the OS-independent error `code`.
 - **Distributed-lock claim primitives** — detached-worktree add/remove, empty-commit nonce marking, and a never-forced push used to implement an atomic winner/loser election (e.g. for upgrade claims).
 - **Process cleanup** — kills processes still running inside a worktree directory before it is removed.
 - **Pluggable credential and logging ports** — `TokenProvider` (credential-purpose-scoped) and `Logger` ports let a consumer supply auth and logging without the core depending on either.
 - **Bootstrap-only git reads** — a narrow, structurally-exempt set of pre-context reads (origin remote URL, env/git-config identity) for use before a full `GitContext` exists.
 - **Forge-neutral provider interfaces** — `IssueTracker`, `CodeHost`, and `BoardManager` ports abstract issue tracking, PR/code hosting, and project boards across platforms.
+- **Workspace validation helpers** — `validateWorkingDirectory` and `parseOwnerRepoFromUrl` ship from `@paysdoc/devplatform/providers` for cross-adapter cwd/remote-URL checks shared by GitHub, GitLab, and Jira.
 - **`forgeProviders()` assembly function** — binds one `RepoIdentifier` to a full provider triple, validating identity, token provider shape, and context binding before constructing any adapter; rejects unknown or wrong-port forge names via `UnknownForgeError`.
-- **GitHub adapter** — issue tracker, code host, and Projects V2 board manager built on the `gh` CLI, including issue/PR read and write operations, label management, GitHub App authentication, and token resolution.
+- **`createForgeCredentials()` forge-keyed credential factory** — resolves a `TokenProvider` and a bootstrap `GitIdentity` from `forge.codeHost` alone, the way `forgeProviders()` resolves the tracker/code-host/board: GitHub dispatches through the App-installation-token → PAT → `gh auth token` chain plus the App-bot identity; GitLab serves its configured token for both credential purposes plus an environment/git-config identity; an unknown code host is refused via `UnknownForgeError` before any credential seam is touched. `createLiteralTokenProvider` — a fixed-string `TokenProvider` for tests and fixtures — ships from `@paysdoc/devplatform/git` (re-exported from the GitHub adapter for backwards compatibility).
+- **GitHub adapter** — issue tracker, code host, and Projects V2 board manager built on the `gh` CLI, including issue/PR read and write operations, label management, GitHub App authentication, and token resolution. Since issue #11, its credential/identity helpers (`createGitHubTokenProvider`, `resolveBootstrapGitIdentity`, `resolveContextToken`, `ghAuthToken`, `isGitHubAppConfigured`, `getInstallationToken`) and the bound `createGhRepoApi` view ship from `@paysdoc/devplatform/providers` too, for a consumer switching over with no behaviour change — `createForgeCredentials` remains the recommended, forge-neutral route that composes exactly those functions.
 - **GitLab adapter** — code host implementation backed by a `curl`-based API client with injected configuration (no environment reads).
 - **Jira adapter** — issue tracker backed by the Jira REST API v3, including Markdown ↔ Atlassian Document Format (ADF) conversion.
 - **Board status model** — a canonical, ordered set of board columns (`Blocked`/`Todo`/`In Progress`/`Review`/`Done`) with colors and descriptions shared across board-capable adapters.
 - **Injected configuration everywhere** — GitLab, Jira, and GitHub App adapters take configuration as constructor arguments; none reads `process.env` or files directly, keeping the library embeddable in any host.
 - **Compiled ESM + type declarations** — `bun run build` emits `dist/**/*.js` and `dist/**/*.d.ts` via `tsc`, with a three-entry-point `exports` map (`.`, `./providers`, `./git`) and a `files` allow-list so `npm pack` ships only `dist/`, `README.md`, and `LICENSE`.
-- **CI type-check, git/gh guard, unit-test, and package gate** — GitHub Actions runs `bun install`, `bun run typecheck`, `bun run lint:git-guard`, and `bun run test:unit` on every PR and push to `main`, plus a second job that builds, packs, and smoke-tests the tarball under both Node and Bun.
+- **Cucumber/Gherkin BDD suite** — `bun run test:e2e` runs `cucumber-js` over per-issue `.feature` files under `features/per-issue/`, backed by step definitions and a shared Cucumber world/support layer, with promoted, reusable phrases tracked in `features/regression/vocabulary.md`. A `@packaging` subset packs the real tarball into a clean consumer and proves a name resolves both at runtime and in the emitted `.d.ts`.
+- **CI type-check, git/gh guard, unit-test, BDD, and package gate** — GitHub Actions runs `bun install`, `bun run typecheck`, `bun run lint:git-guard`, `bun run test:unit`, and the hermetic (`not @packaging`) BDD scenarios on every PR and push to `main`, plus a second job that builds, packs, smoke-tests the tarball under both Node and Bun, and runs the `@packaging` BDD scenarios against it.
 - **Automated releases via semantic-release** — a `Release` GitHub Actions job runs semantic-release on every push to `main`, using a commit parser that accepts an optional `<agent-name>: ` prefix before the conventional type (`build-agent: feat: …` → minor, `review-patch-agent: fix: …` → patch, `plan-orchestrator: chore: …` → no release), a PR `release-dry-run` job that prints the computed next version before merge, and npm OIDC trusted publishing with an `NPM_TOKEN` fallback.
 - **Git/gh CI guard** — an AST-based check (`bun run lint:git-guard`, `scripts/checkGitGhGuard.ts` + `scripts/guard/`) that fails CI on a direct `git`/`gh` shell-out outside `src/git/` and `src/providers/github/` (the two structurally-exempt packages), or on ad-hoc provider/`GitContext` construction anywhere outside the one-entry `src/providers/forgeProviders.ts` allowlist.
 - **Claude Code agent guardrails** — a hooked `.claude/settings.json` and `.claude/hooks/*` scripts (pre/post-tool-use, notification, stop, subagent-stop) constrain and observe agent tool use in this repo.
@@ -48,11 +65,18 @@ import { GitContext, consoleLogger } from '@paysdoc/devplatform/git';
 ## Setup
 
 1. Install dependencies: `bun install`
-2. Copy the environment template and fill in your own values: `cp .env.sample .env`
-3. Type-check: `bun run typecheck`
-4. Run the unit test suite: `bun run test:unit`
+2. Type-check: `bun run typecheck`
+3. Run the unit test suite: `bun run test:unit`
+4. Run the BDD scenario suite: `bun run test:e2e`
 5. Build: `bun run build`
 
+This package takes all forge configuration (tokens, App credentials, GitLab/Jira settings) as
+constructor arguments from the consumer — it reads no `.env` file and no `process.env` value as
+its primary configuration path. There is no root `.env.sample` to copy for using the library
+itself; the optional `GIT_AUTHOR_*`/`GITHUB_APP_*` environment fallbacks used only by the
+bootstrap-identity readers are documented in `app_docs/git-worktree-core.md` and
+`app_docs/github-provider.md`.
+
 ## Releasing
 
 Releases are computed by [semantic-release](https://semantic-release.gitbook.io/) from commit messages on
@@ -77,6 +101,31 @@ back to an `NPM_TOKEN` secret if one is present. The release baseline is the `v1
 of the first manually published version; the release workflow hard-fails if that tag is not reachable, so it
 can never recompute or republish `1.0.0`.
 
+The npm trusted publisher for `@paysdoc/devplatform` must be linked to this exact GitHub Actions workflow
+(owner `paysdoc`, repository `devplatform`, workflow filename `release.yml`, no environment) **and must have
+the direct `npm publish` action allowed**. npm creates a new trusted publisher with `npm stage publish`
+permission only; direct publishing is a separate tick under the publisher's "Allowed actions" that is off by
+default. Without it the OIDC token exchange succeeds, provenance is signed, and the publish `PUT` itself is
+then denied with `403 … OIDC permission denied for this action`. Fix it on npmjs.com, or from an
+authenticated, 2FA-enabled npm CLI (11.15+):
+
+```
+npm trust list @paysdoc/devplatform
+npm trust github @paysdoc/devplatform --file release.yml --repo paysdoc/devplatform --allow-publish --allow-stage-publish
+```
+
+Do not reach for `NPM_TOKEN` to work around this: npm is removing direct publishing via bypass-2FA tokens in
+January 2027, and a stage-only token cannot serve `@semantic-release/npm`, which runs plain `npm publish` and
+has no staged-publishing mode. The package's Publishing access setting may be "Require two-factor
+authentication and disallow tokens" — that only restricts classic tokens, trusted publishers keep working.
+
+semantic-release pushes the git tag *before* it publishes, so a run that fails at `npm publish` leaves an
+orphan tag that a re-run will not republish (no new commits exist after the tag) and reports "no relevant
+changes". Delete the orphan tag and any GitHub release it created, then trigger the workflow again — never
+delete `v1.0.0`. After a successful publish, the registry metadata shows the new version within a couple of
+minutes but the tarball itself can 404 for several minutes more; that is npm replication lag, not a failed
+release.
+
 ## Domain glossary
 
 See [UBIQUITOUS_LANGUAGE.md](./UBIQUITOUS_LANGUAGE.md) for the canonical terms used across this codebase (identity, forge, provider, worktree, etc.).
@@ -91,30 +140,42 @@ See [UBIQUITOUS_LANGUAGE.md](./UBIQUITOUS_LANGUAGE.md) for the canonical terms u
   hooks/                      Claude Code lifecycle hooks (pre/post-tool-use, notification, stop, subagent-stop)
   skills/                     Agent skills (TDD, PRD authoring, architecture review, ubiquitous language, ...)
   settings.json                Agent permission/guardrail configuration
+bun.lock                      Bun lockfile
 .github/
   workflows/ci.yml             Typecheck + git/gh guard + unit test CI gate, build/pack/smoke-test package gate, and a PR-only release-dry-run job
   workflows/release.yml        Release automation: semantic-release on push to main (v1.0.0 baseline guard, OIDC + NPM_TOKEN fallback)
   adw.yml                      ADW guardrails toggle (outside .adw/, survives regeneration)
 app_docs/                    Per-module documentation owned by conditional_docs.md routing (ADW-generated)
 UBIQUITOUS_LANGUAGE.md       Canonical domain glossary
-features/regression/vocabulary.md   Regression test vocabulary
-specs/                        Per-issue implementation plans (ADW-generated)
+LICENSE                      Package license
+package.json                 Package manifest: entry-point exports map, files allow-list, scripts
+cucumber.js                  Cucumber/BDD runner configuration (loads tsx, points at features/)
+features/
+  per-issue/                  Per-issue Gherkin feature files (e.g. feature-9.feature), tagged @adw-<issue>
+  regression/vocabulary.md    Regression test vocabulary (promoted, reusable Given/When/Then phrases)
+  step_definitions/           Cucumber step definitions wiring Gherkin steps to the library's public surface
+  support/                    Shared Cucumber world/support code (packagedConsumer helper, world.ts)
+logs/<session-id>/           Claude Code hook session logs (chat, pre/post-tool-use, stop transcripts)
+specs/                        Per-issue implementation plans (ADW-generated), plus specs/patch/ for patch plans
 release.config.js             semantic-release configuration: agent-prefix-aware commit parser, branches, plugin list
 scripts/
-  smokePackage.ts             Builds, packs, and smoke-tests the tarball under Node + Bun (`bun run smoke:package`)
+  smokePackage.ts             Builds, packs, and smoke-tests the tarball under Node + Bun via a table-driven dynamic-import key check (`bun run smoke:package`)
   releaseDryRun.ts             Runs `semantic-release --dry-run` and prints the computed next version (`bun run release:dry-run`)
   checkGitGhGuard.ts          CI git/gh guard entry point (`bun run lint:git-guard`) — dev-only, excluded from dist/
   guard/                      Guard rule modules: shell-out exempt-package set, construction allowlist, stdout report
 src/
   index.ts                    Root entry point ("."): forge ports + domain model only
   __tests__/                  Import-graph, package-exports, and release-config contract tests
-  git/                        Forge-neutral git/worktree core (GitContext, worktree ops, bootstrap identity, process cleanup) — entry point "./git"
+  git/                        Forge-neutral git/worktree core (GitContext, worktree ops, bootstrap identity, process cleanup) — entry point "./git"; also re-exports commitOps/branchOps/isLeaseRejection since issue #11
+    literalTokenProvider.ts    Fixed-string TokenProvider for tests/fixtures (re-exported from the GitHub adapter)
   providers/                  Forge provider ports and adapters — entry point "./providers"
-    github/                   GitHub adapter (issue tracker, code host, board manager, App auth, gh CLI commands)
-    gitlab/                   GitLab adapter (API client, code host, type mappers)
+    github/                   GitHub adapter (issue tracker, code host, board manager, App auth, gh CLI commands); its credential/identity helpers and createGhRepoApi are re-exported on this barrel since issue #11
+    gitlab/                   GitLab adapter (API client, code host, type mappers, adapter-internal token provider + bootstrap identity)
     jira/                     Jira adapter (API client, issue tracker, ADF converter)
     forgeProviders.ts          Provider assembly function
+    forgeCredentials.ts        Forge-keyed credential factory (TokenProvider + bootstrap GitIdentity)
     types.ts                   Platform-agnostic provider interfaces
+    workspaceValidation.ts     Cross-adapter cwd/remote-URL validation helpers
 dist/                        Build output (gitignored) — emitted by `bun run build`
 tsconfig.json                 TypeScript strict-mode configuration (NodeNext modules/resolution)
 tsconfig.build.json            Build config: extends tsconfig.json, emits dist/**/*.js + dist/**/*.d.ts

package/dist/git/branchOps.d.ts

@@ -1,7 +1,9 @@
 /**
- * Package-private branch operation orchestration for GitContext.
- * Each function takes an injected runner (cmd, cwd) => string so GitContext
- * methods stay thin and this module is testable without a real context.
+ * Branch operation orchestration for GitContext. Exported from the `./git`
+ * entry point since issue #11. Each function takes an injected
+ * `(cmd, cwd) => string` runner so GitContext methods stay thin and this
+ * module is testable without a real context; the `PROTECTED_BRANCHES` guard
+ * is unchanged and stays off the public surface.
  */
 export declare const PROTECTED_BRANCHES: readonly ["main", "master", "develop"];
 type Runner = (command: string, cwd: string) => string;

package/dist/git/branchOps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branchOps.d.ts","sourceRoot":"","sources":["../../src/git/branchOps.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,kBAAkB,wCAAyC,CAAC;AAEzE,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;AAMvD,iBAAS,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,iBAAS,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAY3F;AAED,iBAAS,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAWpF;AAED,iBAAS,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ5E;AAED,iBAAS,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;GAGG;AACH,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAYzD;AAED,eAAO,MAAM,SAAS;;;;;;;CAOrB,CAAC"}
+{"version":3,"file":"branchOps.d.ts","sourceRoot":"","sources":["../../src/git/branchOps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,kBAAkB,wCAAyC,CAAC;AAEzE,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;AAMvD,iBAAS,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,iBAAS,4BAA4B,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAY3F;AAED,iBAAS,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAWpF;AAED,iBAAS,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ5E;AAED,iBAAS,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ7E;AAED;;;GAGG;AACH,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAYzD;AAED,eAAO,MAAM,SAAS;;;;;;;CAOrB,CAAC"}

package/dist/git/branchOps.js

@@ -1,7 +1,9 @@
 /**
- * Package-private branch operation orchestration for GitContext.
- * Each function takes an injected runner (cmd, cwd) => string so GitContext
- * methods stay thin and this module is testable without a real context.
+ * Branch operation orchestration for GitContext. Exported from the `./git`
+ * entry point since issue #11. Each function takes an injected
+ * `(cmd, cwd) => string` runner so GitContext methods stay thin and this
+ * module is testable without a real context; the `PROTECTED_BRANCHES` guard
+ * is unchanged and stays off the public surface.
  */
 export const PROTECTED_BRANCHES = ['main', 'master', 'develop'];
 function isProtected(branch) {

package/dist/git/branchOps.js.map

@@ -1 +1 @@
-{"version":3,"file":"branchOps.js","sourceRoot":"","sources":["../../src/git/branchOps.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAIzE,SAAS,WAAW,CAAC,MAAc;IACjC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,GAAW;IAChD,OAAO,GAAG,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAW,EAAE,aAAqB,EAAE,GAAW;IACnF,IAAI,CAAC;QACH,GAAG,CAAC,qBAAqB,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACd,gEAAgE;QAChE,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,qBAAqB,aAAa,aAAa,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACd,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,aAAqB,EAAE,GAAW;IAC5E,IAAI,CAAC;QACH,GAAG,CAAC,qBAAqB,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,KAAK,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,4BAA4B,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,aAAa,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,MAAc,EAAE,GAAW;IACjE,IAAI,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,CAAC,kBAAkB,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAE,MAAc,EAAE,GAAW;IAClE,IAAI,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,CAAC,6BAA6B,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,GAAW;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,gBAAgB;IAChB,4BAA4B;IAC5B,qBAAqB;IACrB,iBAAiB;IACjB,kBAAkB;IAClB,aAAa;CACd,CAAC"}
+{"version":3,"file":"branchOps.js","sourceRoot":"","sources":["../../src/git/branchOps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAIzE,SAAS,WAAW,CAAC,MAAc;IACjC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,GAAW;IAChD,OAAO,GAAG,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAW,EAAE,aAAqB,EAAE,GAAW;IACnF,IAAI,CAAC;QACH,GAAG,CAAC,qBAAqB,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACd,gEAAgE;QAChE,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,qBAAqB,aAAa,aAAa,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACd,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,aAAqB,EAAE,GAAW;IAC5E,IAAI,CAAC;QACH,GAAG,CAAC,qBAAqB,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,KAAK,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,4BAA4B,aAAa,GAAG,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,aAAa,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,MAAc,EAAE,GAAW;IACjE,IAAI,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,CAAC,kBAAkB,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAE,MAAc,EAAE,GAAW;IAClE,IAAI,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,CAAC,6BAA6B,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,GAAW;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,MAAM;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,gBAAgB;IAChB,4BAA4B;IAC5B,qBAAqB;IACrB,iBAAiB;IACjB,kBAAkB;IAClB,aAAa;CACd,CAAC"}

package/dist/git/commitOps.d.ts

@@ -1,5 +1,9 @@
 /**
- * Package-private commit/push operation orchestration for GitContext.
+ * Commit/push operation orchestration for GitContext. Exported from the
+ * `./git` entry point since issue #11 — alongside `isLeaseRejection` — so ADW's
+ * regression steps can drive it directly with their own runner. Every function
+ * still takes an injected `(command, cwd) => string` runner; nothing here
+ * spawns a process itself.
  */
 type Runner = (command: string, cwd: string) => string;
 export declare function isLeaseRejection(error: unknown): boolean;

package/dist/git/commitOps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commitOps.d.ts","sourceRoot":"","sources":["../../src/git/commitOps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;AAIvD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMxD;AAkDD,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAOtH;AAED;;;;;GAKG;AACH,iBAAS,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ1G;AAED;;;;;GAKG;AACH,iBAAS,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQvG;AAED,iBAAS,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAclE;AAED,iBAAS,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,iBAAS,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,eAAO,MAAM,SAAS;;;;;;;CAOrB,CAAC"}
+{"version":3,"file":"commitOps.d.ts","sourceRoot":"","sources":["../../src/git/commitOps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;AAIvD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMxD;AAkDD,iBAAS,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,OAAO,CAOtH;AAED;;;;;GAKG;AACH,iBAAS,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ1G;AAED;;;;;GAKG;AACH,iBAAS,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQvG;AAED,iBAAS,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAclE;AAED,iBAAS,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,iBAAS,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,eAAO,MAAM,SAAS;;;;;;;CAOrB,CAAC"}

package/dist/git/commitOps.js

@@ -1,5 +1,9 @@
 /**
- * Package-private commit/push operation orchestration for GitContext.
+ * Commit/push operation orchestration for GitContext. Exported from the
+ * `./git` entry point since issue #11 — alongside `isLeaseRejection` — so ADW's
+ * regression steps can drive it directly with their own runner. Every function
+ * still takes an injected `(command, cwd) => string` runner; nothing here
+ * spawns a process itself.
  */
 export function isLeaseRejection(error) {
     const e = error;

package/dist/git/commitOps.js.map

@@ -1 +1 @@
-{"version":3,"file":"commitOps.js","sourceRoot":"","sources":["../../src/git/commitOps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,CAAC,GAAG,KAAkB,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SACxC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,KAAc;IACvD,MAAM,CAAC,GAAG,KAAkB,CAAC;IAC7B,OAAO,CACL,8CAA8C,MAAM,0BAA0B;QAC9E,6EAA6E;QAC7E,mCAAmC;QACnC,8CAA8C,MAAM,sBAAsB;QAC1E,sEAAsE,MAAM,IAAI;QAChF,mBAAmB,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,YAAgC;IACtD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,GAAW,EAAE,KAAwB;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,GAAW,EAAE,GAAW,EAAE,YAAgC;IACzF,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACzD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,GAAW,EAAE,IAA2C;IAC3G,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,GAAG,CAAC,yBAAyB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,GAAG,CAAC,aAAa,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAChC,GAAG,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,KAAwB,EAAE,OAAe,EAAE,GAAW;IAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,iCAAiC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,6BAA6B,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,GAAG,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,KAAwB,EAAE,OAAe,EAAE,GAAW;IAC5F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,cAAc,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,6BAA6B,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,GAAG,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,GAAW;IAC1D,IAAI,CAAC;QACH,GAAG,CAAC,qBAAqB,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,8DAA8D,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,GAAW;IAC/C,OAAO,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,GAAW;IACrD,OAAO,GAAG,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,aAAa;IACb,oBAAoB;IACpB,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,qBAAqB;CACtB,CAAC"}
+{"version":3,"file":"commitOps.js","sourceRoot":"","sources":["../../src/git/commitOps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,CAAC,GAAG,KAAkB,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;SACxC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,KAAc;IACvD,MAAM,CAAC,GAAG,KAAkB,CAAC;IAC7B,OAAO,CACL,8CAA8C,MAAM,0BAA0B;QAC9E,6EAA6E;QAC7E,mCAAmC;QACnC,8CAA8C,MAAM,sBAAsB;QAC1E,sEAAsE,MAAM,IAAI;QAChF,mBAAmB,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,EAAE,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,YAAgC;IACtD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,GAAW,EAAE,KAAwB;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,GAAW,EAAE,GAAW,EAAE,YAAgC;IACzF,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACzD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,GAAW,EAAE,IAA2C;IAC3G,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,GAAG,CAAC,yBAAyB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,GAAG,CAAC,aAAa,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAChC,GAAG,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAW,EAAE,KAAwB,EAAE,OAAe,EAAE,GAAW;IAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,iCAAiC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,6BAA6B,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,GAAG,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,KAAwB,EAAE,OAAe,EAAE,GAAW;IAC5F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,cAAc,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,6BAA6B,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,GAAG,CAAC,kBAAkB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,GAAW;IAC1D,IAAI,CAAC;QACH,GAAG,CAAC,qBAAqB,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,IAAI,CAAC;QACH,GAAG,CAAC,8DAA8D,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,GAAW;IAC/C,OAAO,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,GAAW;IACrD,OAAO,GAAG,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,aAAa;IACb,oBAAoB;IACpB,iBAAiB;IACjB,UAAU;IACV,eAAe;IACf,qBAAqB;CACtB,CAAC"}

package/dist/git/index.d.ts

@@ -8,19 +8,29 @@
  * a forge adapter built on this package implements instead of the core
  * holding a credential — and the `Logger` port (`Logger`/`LogLevel`,
  * defaulting to `consoleLogger`), so the package carries no dependency on
- * the host application's logger. The GitHub implementation of the
- * TokenProvider port (`createGitHubTokenProvider`), the gh command-string
- * builders, GitHub App authentication, token resolution, GitHub remote-URL
- * parsing, bot-identity derivation, clone-URL construction and
- * `gh auth token` all live in the GitHub forge adapter
- * (`adws/providers/github/`, #792/#793), not here.
+ * the host application's logger. Also exports `createLiteralTokenProvider`,
+ * a fixed-string TokenProvider for tests and fixtures — the one
+ * implementation that lives here rather than in a forge adapter, since it
+ * carries no forge logic. Every *production* TokenProvider implementation
+ * (`createGitHubTokenProvider`), the gh command-string builders, GitHub App
+ * authentication, token resolution, GitHub remote-URL parsing, bot-identity
+ * derivation and clone-URL construction all live in the GitHub forge adapter
+ * (`src/providers/github/`, #792/#793) and, since issue #11, are themselves
+ * re-exported from that adapter's `./index.ts` — reachable from this package's
+ * consumers via `@paysdoc/devplatform/providers` — rather than deep-import
+ * only. The forge-keyed `createForgeCredentials` factory
+ * (`src/providers/forgeCredentials.ts`, issue #9) remains the recommended,
+ * forge-neutral way to obtain a production TokenProvider without naming a
+ * forge. This git core still never imports from `src/providers/`.
  *
  * Also exports the worktree lifecycle op namespaces (create/remove/query/
- * probe/reset) and the distributed-lock `claimOps`, alongside the
- * `repoWorkspace` workspace ops — the full forge-neutral git/worktree
- * surface this package ships (issue #1). None of it imports from
- * `src/providers/`; that boundary is enforced by a committed import-graph
- * test.
+ * probe/reset), the distributed-lock `claimOps`, the commit/push and branch
+ * orchestration namespaces (`commitOps`, `isLeaseRejection`, `branchOps` —
+ * exported since issue #11, git-core: runner-injected orchestration with no
+ * forge vocabulary), alongside the `repoWorkspace` workspace ops — the full
+ * forge-neutral git/worktree surface this package ships (issue #1). None of
+ * it imports from `src/providers/`; that boundary is enforced by a committed
+ * import-graph test.
  *
  * Bootstrap exceptions (issue #700, narrowed by #793): the functions below
  * are the ONLY legitimate pre-context git reads in the codebase — generic
@@ -32,8 +42,11 @@
 export { GitContext } from './gitContext.js';
 export type { GitIdentity, GitContextOptions, ExecFn, GitContextDeps, FsDeps, ExecWorkingDirectory, ExecOptions, TokenProvider, CredentialPurpose, CredentialRequest, Logger, LogLevel, } from './types.js';
 export { consoleLogger } from './consoleLogger.js';
+export { createLiteralTokenProvider } from './literalTokenProvider.js';
 export { killProcessesInDirectory } from './processCleanup.js';
 export { claimOps } from './claimOps.js';
+export { commitOps, isLeaseRejection } from './commitOps.js';
+export { branchOps } from './branchOps.js';
 export { worktreeCreateOps } from './worktreeCreateOps.js';
 export { worktreeRemoveOps } from './worktreeRemoveOps.js';
 export { worktreeQueryOps } from './worktreeQueryOps.js';

package/dist/git/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/git/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EACV,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EACjG,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,GACtE,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC3H,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/git/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,YAAY,EACV,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EACjG,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,GACtE,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC3H,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/git/index.js

@@ -8,19 +8,29 @@
  * a forge adapter built on this package implements instead of the core
  * holding a credential — and the `Logger` port (`Logger`/`LogLevel`,
  * defaulting to `consoleLogger`), so the package carries no dependency on
- * the host application's logger. The GitHub implementation of the
- * TokenProvider port (`createGitHubTokenProvider`), the gh command-string
- * builders, GitHub App authentication, token resolution, GitHub remote-URL
- * parsing, bot-identity derivation, clone-URL construction and
- * `gh auth token` all live in the GitHub forge adapter
- * (`adws/providers/github/`, #792/#793), not here.
+ * the host application's logger. Also exports `createLiteralTokenProvider`,
+ * a fixed-string TokenProvider for tests and fixtures — the one
+ * implementation that lives here rather than in a forge adapter, since it
+ * carries no forge logic. Every *production* TokenProvider implementation
+ * (`createGitHubTokenProvider`), the gh command-string builders, GitHub App
+ * authentication, token resolution, GitHub remote-URL parsing, bot-identity
+ * derivation and clone-URL construction all live in the GitHub forge adapter
+ * (`src/providers/github/`, #792/#793) and, since issue #11, are themselves
+ * re-exported from that adapter's `./index.ts` — reachable from this package's
+ * consumers via `@paysdoc/devplatform/providers` — rather than deep-import
+ * only. The forge-keyed `createForgeCredentials` factory
+ * (`src/providers/forgeCredentials.ts`, issue #9) remains the recommended,
+ * forge-neutral way to obtain a production TokenProvider without naming a
+ * forge. This git core still never imports from `src/providers/`.
  *
  * Also exports the worktree lifecycle op namespaces (create/remove/query/
- * probe/reset) and the distributed-lock `claimOps`, alongside the
- * `repoWorkspace` workspace ops — the full forge-neutral git/worktree
- * surface this package ships (issue #1). None of it imports from
- * `src/providers/`; that boundary is enforced by a committed import-graph
- * test.
+ * probe/reset), the distributed-lock `claimOps`, the commit/push and branch
+ * orchestration namespaces (`commitOps`, `isLeaseRejection`, `branchOps` —
+ * exported since issue #11, git-core: runner-injected orchestration with no
+ * forge vocabulary), alongside the `repoWorkspace` workspace ops — the full
+ * forge-neutral git/worktree surface this package ships (issue #1). None of
+ * it imports from `src/providers/`; that boundary is enforced by a committed
+ * import-graph test.
  *
  * Bootstrap exceptions (issue #700, narrowed by #793): the functions below
  * are the ONLY legitimate pre-context git reads in the codebase — generic
@@ -31,8 +41,11 @@
  */
 export { GitContext } from './gitContext.js';
 export { consoleLogger } from './consoleLogger.js';
+export { createLiteralTokenProvider } from './literalTokenProvider.js';
 export { killProcessesInDirectory } from './processCleanup.js';
 export { claimOps } from './claimOps.js';
+export { commitOps, isLeaseRejection } from './commitOps.js';
+export { branchOps } from './branchOps.js';
 export { worktreeCreateOps } from './worktreeCreateOps.js';
 export { worktreeRemoveOps } from './worktreeRemoveOps.js';
 export { worktreeQueryOps } from './worktreeQueryOps.js';

package/dist/git/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/git/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAK7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKzD,0FAA0F;AAC1F,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE3H,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/git/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAK7C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAKzD,0FAA0F;AAC1F,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE3H,OAAO,EACL,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,mBAAmB,GACpB,MAAM,oBAAoB,CAAC"}

package/dist/git/literalTokenProvider.d.ts

@@ -0,0 +1,26 @@
+/**
+ * A fixed-string TokenProvider — for tests and fixtures, never a production
+ * credential source (production boundaries build a provider through
+ * `createForgeCredentials`, `src/providers/forgeCredentials.ts`).
+ *
+ * Lives in the git core rather than an adapter: it carries no forge *logic* —
+ * no resolution order, no App/PAT/CLI chain — only a literal echo, and the
+ * core's own tests need it (six suites under `src/git/__tests__/` construct a
+ * `GitContext` and need some `TokenProvider`). `src/providers/github/githubTokenProvider.ts`
+ * re-exports this same function so no import outside `src/git/__tests__/` had
+ * to move.
+ *
+ * The overlay key stays `GH_TOKEN` — a relocation, not a behaviour change:
+ * every fixture in this repository and in ADW asserts that key. Per
+ * `./types.js`'s `TokenProvider` docblock, a production provider keeps the
+ * credential variable's *name* on the adapter side of the port; this fixture
+ * is the one deliberate, documented exception, grandfathered in by the shape
+ * every existing test already depends on.
+ */
+import type { TokenProvider } from './types.js';
+/**
+ * A TokenProvider that serves a fixed credential — `alternateIdentityPat`
+ * (when given) for `'alternateIdentity'` requests, `token` otherwise.
+ */
+export declare function createLiteralTokenProvider(token: string, alternateIdentityPat?: string): TokenProvider;
+//# sourceMappingURL=literalTokenProvider.d.ts.map

package/dist/git/literalTokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"literalTokenProvider.d.ts","sourceRoot":"","sources":["../../src/git/literalTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,YAAY,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,aAAa,CAMtG"}

package/dist/git/literalTokenProvider.js

@@ -0,0 +1,12 @@
+/**
+ * A TokenProvider that serves a fixed credential — `alternateIdentityPat`
+ * (when given) for `'alternateIdentity'` requests, `token` otherwise.
+ */
+export function createLiteralTokenProvider(token, alternateIdentityPat) {
+    return {
+        credentialEnv({ purpose }) {
+            return { GH_TOKEN: (purpose === 'alternateIdentity' && alternateIdentityPat) ? alternateIdentityPat : token };
+        },
+    };
+}
+//# sourceMappingURL=literalTokenProvider.js.map

package/dist/git/literalTokenProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"literalTokenProvider.js","sourceRoot":"","sources":["../../src/git/literalTokenProvider.ts"],"names":[],"mappings":"AAqBA;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,oBAA6B;IACrF,OAAO;QACL,aAAa,CAAC,EAAE,OAAO,EAAqB;YAC1C,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,KAAK,mBAAmB,IAAI,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAChH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/providers/forgeCredentials.d.ts

@@ -0,0 +1,74 @@
+/**
+ * createForgeCredentials() — the forge-keyed credential factory (issue #9),
+ * a sibling of `forgeProviders()`. Resolves a `TokenProvider` and a
+ * bootstrap `GitIdentity` from a forge name alone, dispatching on
+ * `forge.codeHost` the same way `forgeProviders()` dispatches for the
+ * tracker, code host and board — the consumer never names GitHub or GitLab.
+ *
+ * Since issue #11, the GitHub barrel also re-exports the GitHub-named helpers
+ * that build these values (`createGitHubTokenProvider`, `resolveContextToken`,
+ * `getInstallationToken`, `isGitHubAppConfigured`, `resolveBootstrapGitIdentity`,
+ * `ghAuthToken`) so ADW's launch boundary can switch over to the published
+ * package with no behaviour change. This factory remains the forge-neutral,
+ * recommended route — it composes exactly those functions — and still
+ * re-exports only the `GitHubAppConfig`/`AppAuthDeps` *types*: the GitHub
+ * barrel must not re-export them too, or `src/providers/index.ts`'s `export *`
+ * over both barrels would collide (TS2308).
+ *
+ * Side-effect contract: construction never resolves a token — the returned
+ * `TokenProvider` resolves per `credentialEnv` call, unmemoised, exactly as
+ * `createGitHubTokenProvider`/`createGitLabTokenProvider` do on their own
+ * (the only cache on the path is `appAuth.ts`'s expiry-aware
+ * installation-token cache). Construction DOES perform the bootstrap
+ * identity reads (environment, then `git config` when needed) eagerly,
+ * exactly as `resolveBootstrapGitIdentity`/`resolveGitLabBootstrapGitIdentity`
+ * do today.
+ */
+import type { GitIdentity, TokenProvider } from '../git/types.js';
+import type { GitConfigIdentityDeps } from '../git/bootstrapIdentity.js';
+import { type RepoIdentifier } from './types.js';
+import { type ForgeSelection } from './forgeProviders.js';
+import type { GitHubAppConfig, AppAuthDeps } from './github/appAuth.js';
+import type { GitLabConfig } from './gitlab/gitlabApiClient.js';
+export type { GitHubAppConfig, AppAuthDeps };
+/** What the launch boundary currently injects by hand for the GitHub branch. */
+export interface GitHubCredentialDeps {
+    /** Already resolved from the environment by the caller — never re-read here. */
+    readonly appConfig: GitHubAppConfig | null;
+    readonly pat?: string;
+    readonly alternateIdentityPat?: string;
+    /** Test seam; production default is the adapter's `gh auth token` reader. */
+    readonly ghAuthToken?: () => string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly exec?: GitConfigIdentityDeps['exec'];
+    /** The `runCurl`/`apiBaseUrl` transport seam of `getInstallationToken`; production default is real curl against `api.github.com`. */
+    readonly appAuth?: AppAuthDeps;
+}
+/** Mirrors `ForgeProviderDeps`: forge-neutral seams at the top, one per-forge bag each. */
+export interface ForgeCredentialDeps {
+    /** Forge-neutral bootstrap-identity seam, applies to whichever code host is selected. Overridden by `github.env` when both are given. */
+    readonly env?: NodeJS.ProcessEnv;
+    /** Forge-neutral bootstrap-identity seam. Overridden by `github.exec` when both are given. */
+    readonly exec?: GitConfigIdentityDeps['exec'];
+    readonly github?: GitHubCredentialDeps;
+    /** Required when `forge.codeHost === 'gitlab'`. */
+    readonly gitlab?: GitLabConfig;
+}
+export interface ForgeCredentialsOptions {
+    readonly forge: ForgeSelection;
+    readonly identity: RepoIdentifier;
+    readonly deps?: ForgeCredentialDeps;
+}
+export type ForgeCredentials = Readonly<{
+    tokenProvider: TokenProvider;
+    gitIdentity: GitIdentity;
+}>;
+/**
+ * Builds the one `{ tokenProvider, gitIdentity }` pair for `identity`. Guard
+ * clauses run in `forgeProviders()`'s order — identity, then the code host
+ * — entirely before any credential source is touched, so a refusal never
+ * partially resolves a token. Only the code host is validated; the tracker
+ * selection is irrelevant to credentials.
+ */
+export declare function createForgeCredentials(options: ForgeCredentialsOptions): ForgeCredentials;
+//# sourceMappingURL=forgeCredentials.d.ts.map

package/dist/providers/forgeCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forgeCredentials.d.ts","sourceRoot":"","sources":["../../src/providers/forgeCredentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,YAAY,CAAC;AACzE,OAAO,EAAwD,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIhH,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAM7C,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9C,qIAAqI;IACrI,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;CAChC;AAED,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,yIAAyI;IACzI,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC,CAAC;AA2CH;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,CAczF"}