@paysdoc/devplatform 1.0.0

package/dist/providers/github/githubIssueTracker.js

@@ -0,0 +1,209 @@
+/**
+ * GitHub implementation of the IssueTracker provider interface.
+ *
+ * Binds `createGhRepoApi(ctx)` once at construction, over a `GitContext` the
+ * caller already holds — the adapter constructs no context, resolves no
+ * token, and reads no environment. Every method reproduces the command,
+ * parse, error policy and log line of its absorbed legacy free function
+ * (`adws/github/issueApi.ts` / `issueListApi.ts` / `labelManager.ts` /
+ * `projectBoardApi.ts`) exactly, logging through the injected `Logger` port.
+ * The HITL Slack notification and the `adw:*` label catalogue are ADW
+ * behaviours re-homed as the optional `onStatusMoved`/`resolveLabelDefinition`
+ * seams — the library itself never learns about Slack or about ADW's colours.
+ */
+import { consoleLogger } from '../../git/index.js';
+import { validateRepoIdentifier } from '../types.js';
+import { createGhRepoApi } from './ghRepoApi.js';
+import { assertContextBoundTo } from './contextBinding.js';
+import { parseGitHubIssue, parseIssueState, parseIssueTitle, parseIssueCommentsRest, parseIssueLabelNames, parseCreatedIssueNumber, parseFirstIssueNumber, parseIssueSummaries, parseIssueListEntries, } from './ghIssueParsers.js';
+import { mapGitHubIssueToIssue, mapIssueCommentSummaryToIssueComment } from './mappers.js';
+function isLabelNotFoundError(error) {
+    return /not found/i.test(String(error));
+}
+function defaultLabelDefinition(label) {
+    return { name: label, color: 'ededed', description: '' };
+}
+/**
+ * IssueTracker implementation for GitHub Issues, bound to a specific
+ * repository and `GitContext` at construction time.
+ */
+export class GitHubIssueTracker {
+    repoId;
+    gh;
+    logger;
+    onStatusMoved;
+    resolveLabelDefinition;
+    constructor(ctx, repoId, deps = {}) {
+        this.repoId = repoId;
+        validateRepoIdentifier(repoId);
+        assertContextBoundTo(ctx, repoId, 'createGitHubIssueTracker');
+        this.gh = createGhRepoApi(ctx);
+        this.logger = deps.logger ?? consoleLogger;
+        this.onStatusMoved = deps.onStatusMoved;
+        this.resolveLabelDefinition = deps.resolveLabelDefinition ?? defaultLabelDefinition;
+    }
+    async fetchIssue(issueNumber) {
+        try {
+            return mapGitHubIssueToIssue(parseGitHubIssue(this.gh.fetchIssue(issueNumber)));
+        }
+        catch (error) {
+            throw new Error(`Failed to fetch issue #${issueNumber}: ${error}`);
+        }
+    }
+    commentOnIssue(issueNumber, body) {
+        try {
+            this.gh.commentOnIssue(issueNumber, body);
+            this.logger(`Commented on issue #${issueNumber}`, 'success');
+        }
+        catch (error) {
+            this.logger(`Failed to comment on issue: ${error}`, 'error');
+        }
+    }
+    deleteComment(commentId) {
+        const id = Number(commentId);
+        try {
+            this.gh.deleteIssueComment(id);
+            this.logger(`Deleted comment ${id}`, 'success');
+        }
+        catch (error) {
+            throw new Error(`Failed to delete comment ${id}: ${error}`);
+        }
+    }
+    getIssueState(issueNumber) {
+        try {
+            return parseIssueState(this.gh.issueState(issueNumber));
+        }
+        catch (error) {
+            this.logger(`Failed to get issue state for #${issueNumber}: ${error}`, 'error');
+            throw error;
+        }
+    }
+    async closeIssue(issueNumber, comment) {
+        try {
+            const state = this.getIssueState(issueNumber);
+            if (state === 'CLOSED') {
+                this.logger(`Issue #${issueNumber} is already closed, skipping`, 'info');
+                return false;
+            }
+            if (comment) {
+                this.commentOnIssue(issueNumber, comment);
+            }
+            this.gh.closeIssue(issueNumber);
+            this.logger(`Closed issue #${issueNumber}`, 'success');
+            return true;
+        }
+        catch (error) {
+            this.logger(`Failed to close issue #${issueNumber}: ${error}`, 'error');
+            return false;
+        }
+    }
+    fetchComments(issueNumber) {
+        try {
+            return parseIssueCommentsRest(this.gh.fetchIssueComments(issueNumber)).map(mapIssueCommentSummaryToIssueComment);
+        }
+        catch (error) {
+            throw new Error(`Failed to fetch comments for issue #${issueNumber}: ${error}`);
+        }
+    }
+    async moveToStatus(issueNumber, status) {
+        try {
+            const moved = this.gh.moveIssueToStatus(issueNumber, status);
+            if (moved) {
+                await this.onStatusMoved?.(issueNumber, status);
+            }
+            return moved;
+        }
+        catch (error) {
+            this.logger(`Failed to move issue #${issueNumber} to "${status}": ${error}`, 'error');
+            return false;
+        }
+    }
+    fetchLabels(issueNumber) {
+        try {
+            return parseIssueLabelNames(this.gh.issueLabels(issueNumber));
+        }
+        catch (error) {
+            this.logger(`fetchIssueLabels: failed to fetch labels on issue #${issueNumber}: ${error}`, 'warn');
+            return [];
+        }
+    }
+    addLabel(issueNumber, labelName) {
+        try {
+            this.gh.addIssueLabel(issueNumber, labelName);
+            this.logger(`Added label "${labelName}" to issue #${issueNumber}`, 'success');
+        }
+        catch (error) {
+            this.logger(`Failed to add label "${labelName}" to issue #${issueNumber}: ${error}`, 'error');
+        }
+    }
+    applyLabel(issueNumber, labelName) {
+        try {
+            this.gh.applyLabel(issueNumber, labelName);
+            return;
+        }
+        catch (error) {
+            if (!isLabelNotFoundError(error)) {
+                this.logger(`applyLabel: unexpected error adding label "${labelName}" to issue #${issueNumber}: ${error}`, 'error');
+                throw error;
+            }
+        }
+        this.logger(`applyLabel: label "${labelName}" not found on repo, lazy-creating`, 'warn');
+        const def = this.resolveLabelDefinition(labelName);
+        this.gh.createLabel(def.name, def.color, def.description);
+        this.gh.applyLabel(issueNumber, labelName);
+    }
+    ensureLabel(name, color, description) {
+        this.gh.createLabel(name, color, description);
+    }
+    createIssue(title, body) {
+        const issueNumber = parseCreatedIssueNumber(this.gh.createIssue(title, body));
+        this.logger(`Created issue #${issueNumber}: ${title}`, 'success');
+        return issueNumber;
+    }
+    updateIssueBody(issueNumber, body) {
+        try {
+            this.gh.updateIssueBody(issueNumber, body);
+            this.logger(`Updated body of issue #${issueNumber}`, 'success');
+        }
+        catch (error) {
+            this.logger(`Failed to update body of issue #${issueNumber}: ${error}`, 'error');
+            throw error;
+        }
+    }
+    searchOpenIssues(search, limit) {
+        try {
+            return parseIssueSummaries(this.gh.listOpenIssues({ fields: ['number', 'title'], search, limit }));
+        }
+        catch {
+            return [];
+        }
+    }
+    findOpenUpgradeIssue() {
+        try {
+            return parseFirstIssueNumber(this.gh.findOpenUpgradeIssue());
+        }
+        catch {
+            return null;
+        }
+    }
+    listIssues(query) {
+        return parseIssueListEntries(this.gh.listOpenIssues(query));
+    }
+    getIssueTitle(issueNumber) {
+        try {
+            return parseIssueTitle(this.gh.issueTitle(issueNumber));
+        }
+        catch {
+            return '(unknown)';
+        }
+    }
+}
+/**
+ * Factory function to create a GitHub IssueTracker provider, bound to the
+ * given `GitContext` and repository. Refuses a context bound to a different
+ * owner/repo than `repoId`.
+ */
+export function createGitHubIssueTracker(ctx, repoId, deps = {}) {
+    return new GitHubIssueTracker(ctx, repoId, deps);
+}
+//# sourceMappingURL=githubIssueTracker.js.map

package/dist/providers/github/githubIssueTracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubIssueTracker.js","sourceRoot":"","sources":["../../../src/providers/github/githubIssueTracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAgC,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAe,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,eAAe,EAAkB,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,oCAAoC,EAAE,MAAM,cAAc,CAAC;AAqB3F,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAMiB;IAL7B,EAAE,CAAY;IACd,MAAM,CAAS;IACf,aAAa,CAAsE;IACnF,sBAAsB,CAA2C;IAElF,YAAY,GAAe,EAAmB,MAAsB,EAAE,OAA+B,EAAE;QAAzD,WAAM,GAAN,MAAM,CAAgB;QAClE,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC/B,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,0BAA0B,CAAC,CAAC;QAC9D,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,IAAI,CAAC;YACH,OAAO,qBAAqB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,WAAW,KAAK,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,cAAc,CAAC,WAAmB,EAAE,IAAY;QAC9C,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,uBAAuB,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,+BAA+B,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,KAAK,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,aAAa,CAAC,WAAmB;QAC/B,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,kCAAkC,WAAW,KAAK,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAChF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,WAAmB,EAAE,OAAgB;QACpD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,UAAU,WAAW,8BAA8B,EAAE,MAAM,CAAC,CAAC;gBACzE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,iBAAiB,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,0BAA0B,WAAW,KAAK,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,aAAa,CAAC,WAAmB;QAC/B,IAAI,CAAC;YACH,OAAO,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACnH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,uCAAuC,WAAW,KAAK,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,MAAmB;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,yBAAyB,WAAW,QAAQ,MAAM,MAAM,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YACtF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,WAAW,CAAC,WAAmB;QAC7B,IAAI,CAAC;YACH,OAAO,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,sDAAsD,WAAW,KAAK,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;YACnG,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,WAAmB,EAAE,SAAiB;QAC7C,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,gBAAgB,SAAS,eAAe,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,wBAAwB,SAAS,eAAe,WAAW,KAAK,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,UAAU,CAAC,WAAmB,EAAE,SAAiB;QAC/C,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,8CAA8C,SAAS,eAAe,WAAW,KAAK,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;gBACpH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,sBAAsB,SAAS,oCAAoC,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,WAAmB;QAC1D,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,IAAY;QACrC,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,kBAAkB,WAAW,KAAK,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAClE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,eAAe,CAAC,WAAmB,EAAE,IAAY;QAC/C,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,0BAA0B,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,mCAAmC,WAAW,KAAK,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YACjF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,KAAa;QAC5C,IAAI,CAAC;YACH,OAAO,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,oBAAoB;QAClB,IAAI,CAAC;YACH,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,UAAU,CAAC,KAAqB;QAC9B,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,aAAa,CAAC,WAAmB;QAC/B,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAe,EAAE,MAAsB,EAAE,OAA+B,EAAE;IACjH,OAAO,IAAI,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC"}

package/dist/providers/github/githubTokenProvider.d.ts

@@ -0,0 +1,41 @@
+/**
+ * TokenProvider port — GitHub implementation.
+ *
+ * Lives in the GitHub forge adapter (#792). It owns the resolution order
+ * (App installation token → PAT → `gh auth token`) and the
+ * PAT-versus-installation-token decision, so the core does not: the core
+ * only ever declares a forge-neutral {@link CredentialPurpose}.
+ *
+ * All sources are injected — this file reads no environment variable — and
+ * wraps, rather than replaces, the existing pure {@link resolveContextToken}.
+ */
+import type { TokenProvider } from '../../git/types.js';
+export interface GitHubTokenProviderInput {
+    /** Candidate in the resolution order, after the App mint. */
+    pat?: string | undefined;
+    /**
+     * Credential served to `'alternateIdentity'` requests. Absent (or
+     * whitespace-only) → falls back to the resolved token, preserving
+     * `runGraphQLInput`'s documented graceful fallback.
+     */
+    alternateIdentityPat?: string | undefined;
+    isAppConfigured: () => boolean;
+    /** Must throw loudly if the App is not installed on owner/repo (foreign identity). */
+    mintInstallationToken: (owner: string, repo: string) => string;
+    /** Returns `gh auth token` output, or empty string when gh is not configured. */
+    ghAuthToken: () => string;
+}
+/**
+ * Builds the port's GitHub implementation. Holds no memo of any kind — every
+ * call re-enters `resolveContextToken`. The only caching on this path is
+ * `appAuth.ts`'s expiry-aware installation-token cache, which lives inside
+ * the credential source (where the PRD wants it), not here.
+ */
+export declare function createGitHubTokenProvider(input: GitHubTokenProviderInput): TokenProvider;
+/**
+ * A TokenProvider that serves a fixed credential — `alternateIdentityPat`
+ * (when given) for `'alternateIdentity'` requests, `token` otherwise. For
+ * tests and fixtures; production boundaries use {@link createGitHubTokenProvider}.
+ */
+export declare function createLiteralTokenProvider(token: string, alternateIdentityPat?: string): TokenProvider;
+//# sourceMappingURL=githubTokenProvider.d.ts.map

package/dist/providers/github/githubTokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubTokenProvider.d.ts","sourceRoot":"","sources":["../../../src/providers/github/githubTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAqB,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAE3E,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,sFAAsF;IACtF,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/D,iFAAiF;IACjF,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,wBAAwB,GAAG,aAAa,CAmBxF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,aAAa,CAMtG"}

package/dist/providers/github/githubTokenProvider.js

@@ -0,0 +1,51 @@
+/**
+ * TokenProvider port — GitHub implementation.
+ *
+ * Lives in the GitHub forge adapter (#792). It owns the resolution order
+ * (App installation token → PAT → `gh auth token`) and the
+ * PAT-versus-installation-token decision, so the core does not: the core
+ * only ever declares a forge-neutral {@link CredentialPurpose}.
+ *
+ * All sources are injected — this file reads no environment variable — and
+ * wraps, rather than replaces, the existing pure {@link resolveContextToken}.
+ */
+import { resolveContextToken } from './tokenResolver.js';
+/**
+ * Builds the port's GitHub implementation. Holds no memo of any kind — every
+ * call re-enters `resolveContextToken`. The only caching on this path is
+ * `appAuth.ts`'s expiry-aware installation-token cache, which lives inside
+ * the credential source (where the PRD wants it), not here.
+ */
+export function createGitHubTokenProvider(input) {
+    return {
+        credentialEnv(request) {
+            const { owner, repo, purpose } = request;
+            if (purpose === 'alternateIdentity' && input.alternateIdentityPat?.trim()) {
+                return { GH_TOKEN: input.alternateIdentityPat };
+            }
+            return {
+                GH_TOKEN: resolveContextToken({
+                    owner,
+                    repo,
+                    pat: input.pat,
+                    isAppConfigured: input.isAppConfigured,
+                    mintInstallationToken: input.mintInstallationToken,
+                    ghAuthToken: input.ghAuthToken,
+                }),
+            };
+        },
+    };
+}
+/**
+ * A TokenProvider that serves a fixed credential — `alternateIdentityPat`
+ * (when given) for `'alternateIdentity'` requests, `token` otherwise. For
+ * tests and fixtures; production boundaries use {@link createGitHubTokenProvider}.
+ */
+export function createLiteralTokenProvider(token, alternateIdentityPat) {
+    return {
+        credentialEnv({ purpose }) {
+            return { GH_TOKEN: (purpose === 'alternateIdentity' && alternateIdentityPat) ? alternateIdentityPat : token };
+        },
+    };
+}
+//# sourceMappingURL=githubTokenProvider.js.map

package/dist/providers/github/githubTokenProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubTokenProvider.js","sourceRoot":"","sources":["../../../src/providers/github/githubTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAmBzD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA+B;IACvE,OAAO;QACL,aAAa,CAAC,OAA0B;YACtC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;YACzC,IAAI,OAAO,KAAK,mBAAmB,IAAI,KAAK,CAAC,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC1E,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAClD,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,mBAAmB,CAAC;oBAC5B,KAAK;oBACL,IAAI;oBACJ,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,eAAe,EAAE,KAAK,CAAC,eAAe;oBACtC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;oBAClD,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,CAAC;aACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,oBAA6B;IACrF,OAAO;QACL,aAAa,CAAC,EAAE,OAAO,EAAqB;YAC1C,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,KAAK,mBAAmB,IAAI,oBAAoB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAChH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/providers/github/index.d.ts

@@ -0,0 +1,10 @@
+export { createGitHubIssueTracker, GitHubIssueTracker } from './githubIssueTracker.js';
+export type { GitHubIssueTrackerDeps, GitHubLabelDefinition } from './githubIssueTracker.js';
+export { createGitHubCodeHost, GitHubCodeHost } from './githubCodeHost.js';
+export type { GitHubCodeHostDeps } from './githubCodeHost.js';
+export { createGitHubBoardManager } from './githubBoardManager.js';
+export type { GitHubBoardManagerDeps } from './githubBoardManager.js';
+export type { GitHubUser, GitHubLabel, GitHubMilestone, GitHubComment, GitHubIssueListItem, GitHubIssue, IssueCommentSummary, } from './domain/issue.js';
+export type { PRReviewComment, PRDetails, PRListItem, RawPR } from './domain/pullRequest.js';
+export * from './mappers.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/github/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/github/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACvF,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC3E,YAAY,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,YAAY,EACV,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EACvD,mBAAmB,EAAE,WAAW,EAAE,mBAAmB,GACtD,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC7F,cAAc,cAAc,CAAC"}

package/dist/providers/github/index.js

@@ -0,0 +1,5 @@
+export { createGitHubIssueTracker, GitHubIssueTracker } from './githubIssueTracker.js';
+export { createGitHubCodeHost, GitHubCodeHost } from './githubCodeHost.js';
+export { createGitHubBoardManager } from './githubBoardManager.js';
+export * from './mappers.js';
+//# sourceMappingURL=index.js.map

package/dist/providers/github/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/providers/github/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEvF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAOnE,cAAc,cAAc,CAAC"}

package/dist/providers/github/mappers.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Pure mapper functions that convert between GitHub-specific types and
+ * platform-agnostic provider types.
+ * All functions are pure — no side effects, no imports of global state.
+ */
+import type { GitHubIssue, GitHubComment, IssueCommentSummary } from './domain/issue.js';
+import type { PRDetails, PRReviewComment, PRListItem, RawPR } from './domain/pullRequest.js';
+import type { Issue, IssueComment, PullRequest, PullRequestSummary, ReviewComment } from '../types.js';
+/**
+ * Maps a GitHubComment to a platform-agnostic IssueComment.
+ */
+export declare function mapGitHubCommentToIssueComment(comment: GitHubComment): IssueComment;
+/**
+ * Maps a GitHubIssue to a platform-agnostic Issue.
+ */
+export declare function mapGitHubIssueToIssue(issue: GitHubIssue): Issue;
+/**
+ * Maps an IssueCommentSummary (REST API format) to a platform-agnostic IssueComment.
+ */
+export declare function mapIssueCommentSummaryToIssueComment(comment: IssueCommentSummary): IssueComment;
+/**
+ * Maps a GitHub PRDetails object to a platform-agnostic PullRequest.
+ */
+export declare function mapPRDetailsToPullRequest(pr: PRDetails): PullRequest;
+/**
+ * Maps a GitHub PRReviewComment to a platform-agnostic ReviewComment.
+ */
+export declare function mapPRReviewCommentToReviewComment(comment: PRReviewComment): ReviewComment;
+/**
+ * Maps a GitHub PRListItem to a platform-agnostic PullRequest.
+ * PRListItem carries only number and headBranch, so remaining fields are empty strings.
+ * The listing op returns open PRs only, so `state` is always `'OPEN'`.
+ */
+export declare function mapPRListItemToPullRequest(item: PRListItem): PullRequest;
+/**
+ * Maps a RawPR (from `defaultFindPRByBranch`) to a platform-agnostic PullRequestSummary.
+ * Flattens `labels?: {name}[]` to `string[]`, defaulting a missing field to `[]`.
+ */
+export declare function mapRawPRToSummary(pr: RawPR): PullRequestSummary;
+//# sourceMappingURL=mappers.d.ts.map

package/dist/providers/github/mappers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mappers.d.ts","sourceRoot":"","sources":["../../../src/providers/github/mappers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIvG;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAOnF;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAW/D;AAED;;GAEG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAO/F;AAID;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,SAAS,GAAG,WAAW,CAWpE;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,eAAe,GAAG,aAAa,CAUzF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAUxE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,KAAK,GAAG,kBAAkB,CAQ/D"}

package/dist/providers/github/mappers.js

@@ -0,0 +1,103 @@
+/**
+ * Pure mapper functions that convert between GitHub-specific types and
+ * platform-agnostic provider types.
+ * All functions are pure — no side effects, no imports of global state.
+ */
+// ── IssueTracker mappers ──────────────────────────────────────────────
+/**
+ * Maps a GitHubComment to a platform-agnostic IssueComment.
+ */
+export function mapGitHubCommentToIssueComment(comment) {
+    return {
+        id: comment.id,
+        body: comment.body,
+        author: comment.author.login,
+        createdAt: comment.createdAt,
+    };
+}
+/**
+ * Maps a GitHubIssue to a platform-agnostic Issue.
+ */
+export function mapGitHubIssueToIssue(issue) {
+    return {
+        id: issue.number.toString(),
+        number: issue.number,
+        title: issue.title,
+        body: issue.body,
+        state: issue.state,
+        author: issue.author.login,
+        labels: issue.labels.map((l) => l.name),
+        comments: issue.comments.map(mapGitHubCommentToIssueComment),
+    };
+}
+/**
+ * Maps an IssueCommentSummary (REST API format) to a platform-agnostic IssueComment.
+ */
+export function mapIssueCommentSummaryToIssueComment(comment) {
+    return {
+        id: comment.id.toString(),
+        body: comment.body,
+        author: comment.authorLogin,
+        createdAt: comment.createdAt,
+    };
+}
+// ── CodeHost mappers ──────────────────────────────────────────────────
+/**
+ * Maps a GitHub PRDetails object to a platform-agnostic PullRequest.
+ */
+export function mapPRDetailsToPullRequest(pr) {
+    return {
+        number: pr.number,
+        title: pr.title,
+        body: pr.body,
+        sourceBranch: pr.headBranch,
+        targetBranch: pr.baseBranch,
+        url: pr.url,
+        linkedIssueNumber: pr.issueNumber ?? undefined,
+        state: pr.state,
+    };
+}
+/**
+ * Maps a GitHub PRReviewComment to a platform-agnostic ReviewComment.
+ */
+export function mapPRReviewCommentToReviewComment(comment) {
+    return {
+        id: String(comment.id),
+        body: comment.body,
+        author: comment.author.login,
+        createdAt: comment.createdAt,
+        path: comment.path || undefined,
+        line: comment.line ?? undefined,
+        isBot: comment.author.isBot,
+    };
+}
+/**
+ * Maps a GitHub PRListItem to a platform-agnostic PullRequest.
+ * PRListItem carries only number and headBranch, so remaining fields are empty strings.
+ * The listing op returns open PRs only, so `state` is always `'OPEN'`.
+ */
+export function mapPRListItemToPullRequest(item) {
+    return {
+        number: item.number,
+        title: '',
+        body: '',
+        sourceBranch: item.headBranch,
+        targetBranch: '',
+        url: '',
+        state: 'OPEN',
+    };
+}
+/**
+ * Maps a RawPR (from `defaultFindPRByBranch`) to a platform-agnostic PullRequestSummary.
+ * Flattens `labels?: {name}[]` to `string[]`, defaulting a missing field to `[]`.
+ */
+export function mapRawPRToSummary(pr) {
+    return {
+        number: pr.number,
+        state: pr.state,
+        sourceBranch: pr.headRefName,
+        targetBranch: pr.baseRefName,
+        labels: (pr.labels ?? []).map((l) => l.name),
+    };
+}
+//# sourceMappingURL=mappers.js.map

package/dist/providers/github/mappers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mappers.js","sourceRoot":"","sources":["../../../src/providers/github/mappers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,yEAAyE;AAEzE;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAsB;IACnE,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACtD,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA4B;IAC/E,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE;QACzB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,WAAW;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,yEAAyE;AAEzE;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,EAAa;IACrD,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,YAAY,EAAE,EAAE,CAAC,UAAU;QAC3B,YAAY,EAAE,EAAE,CAAC,UAAU;QAC3B,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,iBAAiB,EAAE,EAAE,CAAC,WAAW,IAAI,SAAS;QAC9C,KAAK,EAAE,EAAE,CAAC,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAwB;IACxE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,SAAS;QAC/B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAgB;IACzD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,EAAE;QACT,IAAI,EAAE,EAAE;QACR,YAAY,EAAE,IAAI,CAAC,UAAU;QAC7B,YAAY,EAAE,EAAE;QAChB,GAAG,EAAE,EAAE;QACP,KAAK,EAAE,MAAM;KACd,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAS;IACzC,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,YAAY,EAAE,EAAE,CAAC,WAAW;QAC5B,YAAY,EAAE,EAAE,CAAC,WAAW;QAC5B,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/providers/github/tokenResolver.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Veracious token resolver — absorbed into the gitContext package (issue #700).
+ *
+ * Single canonical token resolution replacing the two prior resolvers
+ * (`resolveToken` in gitContextFactory.ts, `resolveLaunchToken` in
+ * launchGitContext.ts). Both fell through to process.env.GH_TOKEN — the
+ * GH_TOKEN-bleed vector responsible for ~13 "wrong repo" incidents. This
+ * resolver never reads process.env.GH_TOKEN as a token source (PRD story 2).
+ *
+ * All I/O is injected for hermetic testing.
+ */
+export interface ResolveContextTokenInput {
+    owner: string;
+    repo: string;
+    pat?: string | undefined;
+    isAppConfigured: () => boolean;
+    /** Must throw loudly if the App is not installed on owner/repo (foreign identity). */
+    mintInstallationToken: (owner: string, repo: string) => string;
+    /** Returns `gh auth token` output, or empty string when gh is not configured. */
+    ghAuthToken: () => string;
+}
+/**
+ * Resolves a GitHub token bound to the specified owner/repo.
+ *
+ * Resolution order (guard-clause style):
+ *   1. App configured → return mint bound to owner/repo; propagate any throw
+ *      loudly (foreign/uninstalled identity = hard error, never substitute ambient)
+ *   2. PAT set → return PAT
+ *   3. `gh auth token` non-empty → return it
+ *   4. Throw "no veracious token" — never fall back to process.env.GH_TOKEN
+ *
+ * process.env.GH_TOKEN is NEVER read here. The ambient-global fallthrough was
+ * the root cause of the GH_TOKEN-bleed class (vestmatic #143/#181/#187). Any
+ * token returned here is provably bound to the given owner/repo.
+ */
+export declare function resolveContextToken(input: ResolveContextTokenInput): string;
+//# sourceMappingURL=tokenResolver.d.ts.map

package/dist/providers/github/tokenResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenResolver.d.ts","sourceRoot":"","sources":["../../../src/providers/github/tokenResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,sFAAsF;IACtF,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/D,iFAAiF;IACjF,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,MAAM,CAe3E"}

package/dist/providers/github/tokenResolver.js

@@ -0,0 +1,43 @@
+/**
+ * Veracious token resolver — absorbed into the gitContext package (issue #700).
+ *
+ * Single canonical token resolution replacing the two prior resolvers
+ * (`resolveToken` in gitContextFactory.ts, `resolveLaunchToken` in
+ * launchGitContext.ts). Both fell through to process.env.GH_TOKEN — the
+ * GH_TOKEN-bleed vector responsible for ~13 "wrong repo" incidents. This
+ * resolver never reads process.env.GH_TOKEN as a token source (PRD story 2).
+ *
+ * All I/O is injected for hermetic testing.
+ */
+// ---------------------------------------------------------------------------
+// Resolver
+// ---------------------------------------------------------------------------
+/**
+ * Resolves a GitHub token bound to the specified owner/repo.
+ *
+ * Resolution order (guard-clause style):
+ *   1. App configured → return mint bound to owner/repo; propagate any throw
+ *      loudly (foreign/uninstalled identity = hard error, never substitute ambient)
+ *   2. PAT set → return PAT
+ *   3. `gh auth token` non-empty → return it
+ *   4. Throw "no veracious token" — never fall back to process.env.GH_TOKEN
+ *
+ * process.env.GH_TOKEN is NEVER read here. The ambient-global fallthrough was
+ * the root cause of the GH_TOKEN-bleed class (vestmatic #143/#181/#187). Any
+ * token returned here is provably bound to the given owner/repo.
+ */
+export function resolveContextToken(input) {
+    const { owner, repo, pat, isAppConfigured, mintInstallationToken, ghAuthToken } = input;
+    if (isAppConfigured()) {
+        // Propagate loudly — foreign/uninstalled identity must fail at construction,
+        // not silently adopt a wrong-repo ambient token.
+        return mintInstallationToken(owner, repo);
+    }
+    if (pat?.trim())
+        return pat;
+    const t = ghAuthToken();
+    if (t.trim())
+        return t;
+    throw new Error(`resolveContextToken: no veracious token for ${owner}/${repo}`);
+}
+//# sourceMappingURL=tokenResolver.js.map

package/dist/providers/github/tokenResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenResolver.js","sourceRoot":"","sources":["../../../src/providers/github/tokenResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,6EAA6E;QAC7E,iDAAiD;QACjD,OAAO,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAE5B,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,IAAI,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,CAAC;IAEvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC"}

package/dist/providers/gitlab/gitlabApiClient.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Low-level GitLab REST API v4 client using synchronous HTTP calls.
+ * Uses spawnSync with curl to match the synchronous CodeHost interface contract.
+ *
+ * Configuration is INJECTED (#818) — never read from the environment. Logs via the
+ * `Logger` port (adws/gitContext/types.ts), defaulting to `consoleLogger`.
+ * `runCurl` is the hermetic transport test seam; production uses a real curl.
+ */
+import type { Logger } from '../../git/types.js';
+import type { GitLabProject, GitLabMergeRequest, GitLabNote, GitLabDiscussion, GitLabCreateMRPayload } from './gitlabTypes.js';
+/** The injected configuration `createGitLabCodeHost` takes (#818): the personal access token (api scope) and the instance origin, e.g. `https://gitlab.com`. Never read from the environment inside the adapter. */
+export interface GitLabConfig {
+    readonly token: string;
+    readonly instanceUrl: string;
+}
+/** The result shape `spawnSync` satisfies structurally — the hermetic transport seam. */
+export type CurlResult = {
+    readonly status: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly error?: Error;
+};
+/** Runs curl with the given argv, returning its result. Production default spawns a real curl; tests inject a recorder. */
+export type CurlRunner = (args: readonly string[]) => CurlResult;
+/** Deps idiom: both optional so a consumer that injects nothing gets `consoleLogger` and a real `curl`. */
+export interface GitLabApiClientDeps {
+    readonly logger?: Logger;
+    readonly runCurl?: CurlRunner;
+}
+export declare class GitLabApiClient {
+    private readonly instanceUrl;
+    private readonly token;
+    private readonly logger;
+    private readonly runCurl;
+    constructor(config: GitLabConfig, deps?: GitLabApiClientDeps);
+    private request;
+    private encodePath;
+    getProject(projectPath: string): GitLabProject;
+    createMergeRequest(projectPath: string, payload: GitLabCreateMRPayload): GitLabMergeRequest;
+    getMergeRequest(projectPath: string, mrIid: number): GitLabMergeRequest;
+    createNote(projectPath: string, mrIid: number, body: string): GitLabNote;
+    listDiscussions(projectPath: string, mrIid: number): readonly GitLabDiscussion[];
+    listMergeRequests(projectPath: string, state?: string): readonly GitLabMergeRequest[];
+}
+//# sourceMappingURL=gitlabApiClient.d.ts.map

package/dist/providers/gitlab/gitlabApiClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlabApiClient.d.ts","sourceRoot":"","sources":["../../../src/providers/gitlab/gitlabApiClient.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAE1B,oNAAoN;AACpN,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,yFAAyF;AACzF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,2HAA2H;AAC3H,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,UAAU,CAAC;AAEjE,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;CAC/B;AAQD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;gBAEzB,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,mBAAwB;IAOhE,OAAO,CAAC,OAAO;IAwDf,OAAO,CAAC,UAAU;IAIlB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa;IAI9C,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,kBAAkB;IAQ3F,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB;IAOvE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU;IAQxE,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,gBAAgB,EAAE;IAOhF,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,kBAAkB,EAAE;CAOtF"}