@r_masseater/ops-harbor 0.1.1

package/dist/control-plane.js

@@ -0,0 +1,3573 @@
+#!/usr/bin/env bun
+// @bun
+var __require = import.meta.require;
+
+// ../../node_modules/.bun/valibot@1.3.1+8e24a2f921b8d7be/node_modules/valibot/dist/index.mjs
+var store$4;
+function getGlobalConfig(config$1) {
+  return {
+    lang: config$1?.lang ?? store$4?.lang,
+    message: config$1?.message,
+    abortEarly: config$1?.abortEarly ?? store$4?.abortEarly,
+    abortPipeEarly: config$1?.abortPipeEarly ?? store$4?.abortPipeEarly
+  };
+}
+var store$3;
+function getGlobalMessage(lang) {
+  return store$3?.get(lang);
+}
+var store$2;
+function getSchemaMessage(lang) {
+  return store$2?.get(lang);
+}
+var store$1;
+function getSpecificMessage(reference, lang) {
+  return store$1?.get(reference)?.get(lang);
+}
+function _stringify(input) {
+  const type = typeof input;
+  if (type === "string")
+    return `"${input}"`;
+  if (type === "number" || type === "bigint" || type === "boolean")
+    return `${input}`;
+  if (type === "object" || type === "function")
+    return (input && Object.getPrototypeOf(input)?.constructor?.name) ?? "null";
+  return type;
+}
+function _addIssue(context, label, dataset, config$1, other) {
+  const input = other && "input" in other ? other.input : dataset.value;
+  const expected = other?.expected ?? context.expects ?? null;
+  const received = other?.received ?? /* @__PURE__ */ _stringify(input);
+  const issue = {
+    kind: context.kind,
+    type: context.type,
+    input,
+    expected,
+    received,
+    message: `Invalid ${label}: ${expected ? `Expected ${expected} but r` : "R"}eceived ${received}`,
+    requirement: context.requirement,
+    path: other?.path,
+    issues: other?.issues,
+    lang: config$1.lang,
+    abortEarly: config$1.abortEarly,
+    abortPipeEarly: config$1.abortPipeEarly
+  };
+  const isSchema = context.kind === "schema";
+  const message$1 = other?.message ?? context.message ?? /* @__PURE__ */ getSpecificMessage(context.reference, issue.lang) ?? (isSchema ? /* @__PURE__ */ getSchemaMessage(issue.lang) : null) ?? config$1.message ?? /* @__PURE__ */ getGlobalMessage(issue.lang);
+  if (message$1 !== undefined)
+    issue.message = typeof message$1 === "function" ? message$1(issue) : message$1;
+  if (isSchema)
+    dataset.typed = false;
+  if (dataset.issues)
+    dataset.issues.push(issue);
+  else
+    dataset.issues = [issue];
+}
+function _getStandardProps(context) {
+  return {
+    version: 1,
+    vendor: "valibot",
+    validate(value$1) {
+      return context["~run"]({ value: value$1 }, /* @__PURE__ */ getGlobalConfig());
+    }
+  };
+}
+var ValiError = class extends Error {
+  constructor(issues) {
+    super(issues[0].message);
+    this.name = "ValiError";
+    this.issues = issues;
+  }
+};
+function integer(message$1) {
+  return {
+    kind: "validation",
+    type: "integer",
+    reference: integer,
+    async: false,
+    expects: null,
+    requirement: Number.isInteger,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.typed && !this.requirement(dataset.value))
+        _addIssue(this, "integer", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+function maxValue(requirement, message$1) {
+  return {
+    kind: "validation",
+    type: "max_value",
+    reference: maxValue,
+    async: false,
+    expects: `<=${requirement instanceof Date ? requirement.toJSON() : /* @__PURE__ */ _stringify(requirement)}`,
+    requirement,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.typed && !(dataset.value <= this.requirement))
+        _addIssue(this, "value", dataset, config$1, { received: dataset.value instanceof Date ? dataset.value.toJSON() : /* @__PURE__ */ _stringify(dataset.value) });
+      return dataset;
+    }
+  };
+}
+function minLength(requirement, message$1) {
+  return {
+    kind: "validation",
+    type: "min_length",
+    reference: minLength,
+    async: false,
+    expects: `>=${requirement}`,
+    requirement,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.typed && dataset.value.length < this.requirement)
+        _addIssue(this, "length", dataset, config$1, { received: `${dataset.value.length}` });
+      return dataset;
+    }
+  };
+}
+function minValue(requirement, message$1) {
+  return {
+    kind: "validation",
+    type: "min_value",
+    reference: minValue,
+    async: false,
+    expects: `>=${requirement instanceof Date ? requirement.toJSON() : /* @__PURE__ */ _stringify(requirement)}`,
+    requirement,
+    message: message$1,
+    "~run"(dataset, config$1) {
+      if (dataset.typed && !(dataset.value >= this.requirement))
+        _addIssue(this, "value", dataset, config$1, { received: dataset.value instanceof Date ? dataset.value.toJSON() : /* @__PURE__ */ _stringify(dataset.value) });
+      return dataset;
+    }
+  };
+}
+var _LruCache = class {
+  constructor(config$1) {
+    this.refCount = 0;
+    this.maxSize = config$1?.maxSize ?? 1000;
+    this.maxAge = config$1?.maxAge ?? Infinity;
+    this.hasMaxAge = isFinite(this.maxAge);
+  }
+  #stringify(input) {
+    const type = typeof input;
+    if (type === "string")
+      return `"${input}"`;
+    if (type === "number" || type === "boolean")
+      return `${input}`;
+    if (type === "bigint")
+      return `${input}n`;
+    if (type === "object" || type === "function") {
+      if (input) {
+        this.refIds ??= /* @__PURE__ */ new WeakMap;
+        let id = this.refIds.get(input);
+        if (!id) {
+          id = ++this.refCount;
+          this.refIds.set(input, id);
+        }
+        return `#${id}`;
+      }
+      return "null";
+    }
+    return type;
+  }
+  key(input, config$1 = {}) {
+    return `${this.#stringify(input)}|${this.#stringify(config$1.lang)}|${this.#stringify(config$1.message)}|${this.#stringify(config$1.abortEarly)}|${this.#stringify(config$1.abortPipeEarly)}`;
+  }
+  get(key) {
+    if (!this.store)
+      return;
+    const entry = this.store.get(key);
+    if (!entry)
+      return;
+    if (this.hasMaxAge && Date.now() - entry[1] > this.maxAge) {
+      this.store.delete(key);
+      return;
+    }
+    this.store.delete(key);
+    this.store.set(key, entry);
+    return entry[0];
+  }
+  set(key, value$1) {
+    this.store ??= /* @__PURE__ */ new Map;
+    this.store.delete(key);
+    const timestamp = this.hasMaxAge ? Date.now() : 0;
+    this.store.set(key, [value$1, timestamp]);
+    if (this.store.size > this.maxSize)
+      this.store.delete(this.store.keys().next().value);
+  }
+  clear() {
+    this.store?.clear();
+  }
+};
+function getFallback(schema, dataset, config$1) {
+  return typeof schema.fallback === "function" ? schema.fallback(dataset, config$1) : schema.fallback;
+}
+function getDefault(schema, dataset, config$1) {
+  return typeof schema.default === "function" ? schema.default(dataset, config$1) : schema.default;
+}
+function boolean(message$1) {
+  return {
+    kind: "schema",
+    type: "boolean",
+    reference: boolean,
+    expects: "boolean",
+    async: false,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (typeof dataset.value === "boolean")
+        dataset.typed = true;
+      else
+        _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+function number(message$1) {
+  return {
+    kind: "schema",
+    type: "number",
+    reference: number,
+    expects: "number",
+    async: false,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (typeof dataset.value === "number" && !isNaN(dataset.value))
+        dataset.typed = true;
+      else
+        _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+function object(entries$1, message$1) {
+  return {
+    kind: "schema",
+    type: "object",
+    reference: object,
+    expects: "Object",
+    async: false,
+    entries: entries$1,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      const input = dataset.value;
+      if (input && typeof input === "object") {
+        dataset.typed = true;
+        dataset.value = {};
+        for (const key in this.entries) {
+          const valueSchema = this.entries[key];
+          if (key in input || (valueSchema.type === "exact_optional" || valueSchema.type === "optional" || valueSchema.type === "nullish") && valueSchema.default !== undefined) {
+            const value$1 = key in input ? input[key] : /* @__PURE__ */ getDefault(valueSchema);
+            const valueDataset = valueSchema["~run"]({ value: value$1 }, config$1);
+            if (valueDataset.issues) {
+              const pathItem = {
+                type: "object",
+                origin: "value",
+                input,
+                key,
+                value: value$1
+              };
+              for (const issue of valueDataset.issues) {
+                if (issue.path)
+                  issue.path.unshift(pathItem);
+                else
+                  issue.path = [pathItem];
+                dataset.issues?.push(issue);
+              }
+              if (!dataset.issues)
+                dataset.issues = valueDataset.issues;
+              if (config$1.abortEarly) {
+                dataset.typed = false;
+                break;
+              }
+            }
+            if (!valueDataset.typed)
+              dataset.typed = false;
+            dataset.value[key] = valueDataset.value;
+          } else if (valueSchema.fallback !== undefined)
+            dataset.value[key] = /* @__PURE__ */ getFallback(valueSchema);
+          else if (valueSchema.type !== "exact_optional" && valueSchema.type !== "optional" && valueSchema.type !== "nullish") {
+            _addIssue(this, "key", dataset, config$1, {
+              input: undefined,
+              expected: `"${key}"`,
+              path: [{
+                type: "object",
+                origin: "key",
+                input,
+                key,
+                value: input[key]
+              }]
+            });
+            if (config$1.abortEarly)
+              break;
+          }
+        }
+      } else
+        _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+function optional(wrapped, default_) {
+  return {
+    kind: "schema",
+    type: "optional",
+    reference: optional,
+    expects: `(${wrapped.expects} | undefined)`,
+    async: false,
+    wrapped,
+    default: default_,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (dataset.value === undefined) {
+        if (this.default !== undefined)
+          dataset.value = /* @__PURE__ */ getDefault(this, dataset, config$1);
+        if (dataset.value === undefined) {
+          dataset.typed = true;
+          return dataset;
+        }
+      }
+      return this.wrapped["~run"](dataset, config$1);
+    }
+  };
+}
+function string(message$1) {
+  return {
+    kind: "schema",
+    type: "string",
+    reference: string,
+    expects: "string",
+    async: false,
+    message: message$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      if (typeof dataset.value === "string")
+        dataset.typed = true;
+      else
+        _addIssue(this, "type", dataset, config$1);
+      return dataset;
+    }
+  };
+}
+function parse(schema, input, config$1) {
+  const dataset = schema["~run"]({ value: input }, /* @__PURE__ */ getGlobalConfig(config$1));
+  if (dataset.issues)
+    throw new ValiError(dataset.issues);
+  return dataset.value;
+}
+function pipe(...pipe$1) {
+  return {
+    ...pipe$1[0],
+    pipe: pipe$1,
+    get "~standard"() {
+      return /* @__PURE__ */ _getStandardProps(this);
+    },
+    "~run"(dataset, config$1) {
+      for (const item of pipe$1)
+        if (item.kind !== "metadata") {
+          if (dataset.issues && (item.kind === "schema" || item.kind === "transformation")) {
+            dataset.typed = false;
+            break;
+          }
+          if (!dataset.issues || !config$1.abortEarly && !config$1.abortPipeEarly)
+            dataset = item["~run"](dataset, config$1);
+        }
+      return dataset;
+    }
+  };
+}
+
+// ../ops-harbor-control-plane/src/lib/config.ts
+import { randomBytes } from "crypto";
+import { existsSync, readFileSync } from "fs";
+import { mkdir, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var EnvSchema = object({
+  XDG_CONFIG_HOME: optional(pipe(string(), minLength(1))),
+  XDG_STATE_HOME: optional(pipe(string(), minLength(1)))
+});
+var StoredConfigSchema = object({
+  port: optional(pipe(number(), integer(), minValue(1), maxValue(65535))),
+  dbPath: optional(pipe(string(), minLength(1))),
+  githubAppId: optional(pipe(string(), minLength(1))),
+  githubPrivateKey: optional(pipe(string(), minLength(1))),
+  githubWebhookSecret: optional(pipe(string(), minLength(1))),
+  githubTunnelDisabled: optional(boolean()),
+  githubTunnelHost: optional(pipe(string(), minLength(1))),
+  internalApiToken: optional(pipe(string(), minLength(1))),
+  githubApiUrl: optional(pipe(string(), minLength(1))),
+  defaultAuthor: optional(pipe(string(), minLength(1)))
+});
+function readProcessEnv(env = process.env) {
+  return parse(EnvSchema, env);
+}
+function configPath(env) {
+  return join(env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "ops-harbor", "control-plane.json");
+}
+function normalizeStoredConfig(config) {
+  return {
+    ...config.port !== undefined ? { port: config.port } : {},
+    ...config.dbPath ? { dbPath: config.dbPath } : {},
+    ...config.githubAppId ? { githubAppId: config.githubAppId } : {},
+    ...config.githubPrivateKey ? { githubPrivateKey: config.githubPrivateKey } : {},
+    ...config.githubWebhookSecret ? { githubWebhookSecret: config.githubWebhookSecret } : {},
+    ...config.githubTunnelDisabled !== undefined ? { githubTunnelDisabled: config.githubTunnelDisabled } : {},
+    ...config.githubTunnelHost ? { githubTunnelHost: config.githubTunnelHost } : {},
+    ...config.internalApiToken ? { internalApiToken: config.internalApiToken } : {},
+    ...config.githubApiUrl ? { githubApiUrl: config.githubApiUrl } : {},
+    ...config.defaultAuthor ? { defaultAuthor: config.defaultAuthor } : {}
+  };
+}
+function loadStoredConfig(env = readProcessEnv()) {
+  const path = configPath(env);
+  if (!existsSync(path)) {
+    return {};
+  }
+  try {
+    return normalizeStoredConfig(parse(StoredConfigSchema, JSON.parse(readFileSync(path, "utf-8"))));
+  } catch {
+    return {};
+  }
+}
+function generateWebhookSecret() {
+  return randomBytes(32).toString("hex");
+}
+function shouldProvisionWebhookSecret(config) {
+  return Boolean(config.githubAppId && config.githubPrivateKey);
+}
+async function saveStoredConfig(config, env = readProcessEnv()) {
+  const current = loadStoredConfig(env);
+  const parsed = normalizeStoredConfig(parse(StoredConfigSchema, config));
+  const resolved = {
+    ...parsed,
+    ...shouldProvisionWebhookSecret(parsed) ? {
+      githubWebhookSecret: parsed.githubWebhookSecret ?? current.githubWebhookSecret ?? generateWebhookSecret()
+    } : {}
+  };
+  const path = configPath(env);
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify(resolved, null, 2)}
+`, {
+    encoding: "utf-8",
+    mode: 384
+  });
+  return resolved;
+}
+async function ensureStoredConfigSecrets(env = readProcessEnv()) {
+  const stored = loadStoredConfig(env);
+  if (!shouldProvisionWebhookSecret(stored) || stored.githubWebhookSecret) {
+    return stored;
+  }
+  return saveStoredConfig(stored, env);
+}
+function readConfig(env = readProcessEnv()) {
+  const stored = loadStoredConfig(env);
+  return {
+    port: stored.port ?? 4130,
+    dbPath: stored.dbPath ?? join(env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "ops-harbor", "control-plane.db"),
+    githubApiUrl: stored.githubApiUrl ?? "https://api.github.com",
+    githubTunnelDisabled: stored.githubTunnelDisabled ?? false,
+    ...stored.githubAppId ? { githubAppId: stored.githubAppId } : {},
+    ...stored.githubPrivateKey ? { githubPrivateKey: stored.githubPrivateKey } : {},
+    ...stored.githubWebhookSecret ? { githubWebhookSecret: stored.githubWebhookSecret } : {},
+    ...stored.githubTunnelHost ? { githubTunnelHost: stored.githubTunnelHost } : {},
+    ...stored.internalApiToken ? { internalApiToken: stored.internalApiToken } : {},
+    ...stored.defaultAuthor ? { defaultAuthor: stored.defaultAuthor } : {}
+  };
+}
+
+// ../../packages/ops-harbor-core/src/alerts.ts
+function inferCheckState(checks) {
+  if (checks.length === 0)
+    return "unknown";
+  let hasNeutral = false;
+  for (const check of checks) {
+    if (check.status !== "completed") {
+      return "pending";
+    }
+    const conclusion = (check.conclusion ?? "").toLowerCase();
+    if (["failure", "timed_out", "action_required", "cancelled"].includes(conclusion)) {
+      return "failure";
+    }
+    if (["neutral", "skipped"].includes(conclusion)) {
+      hasNeutral = true;
+    }
+  }
+  return hasNeutral ? "neutral" : "success";
+}
+function inferReviewState(reviews, reviewDecision) {
+  const normalizedDecision = (reviewDecision ?? "").toUpperCase();
+  if (normalizedDecision === "CHANGES_REQUESTED")
+    return "changes_requested";
+  if (normalizedDecision === "APPROVED")
+    return "approved";
+  const latest = reviews.toSorted((a, b) => b.submittedAt.localeCompare(a.submittedAt))[0];
+  return latest?.state ?? "none";
+}
+function inferMergeState(item) {
+  const state = item.mergeStateStatus.toUpperCase();
+  if (item.mergeable === "conflicting" || ["DIRTY", "CONFLICTING"].includes(state)) {
+    return "conflicting";
+  }
+  if (state === "BEHIND")
+    return "behind";
+  if (["BLOCKED", "DRAFT", "UNSTABLE"].includes(state))
+    return "blocked";
+  if (state === "CLEAN" || item.mergeable === "mergeable")
+    return "clean";
+  return "unknown";
+}
+function summarizeStatus(checks, reviews, item) {
+  const checkState = inferCheckState(checks);
+  const reviewState = inferReviewState(reviews, item.reviewDecision);
+  const mergeState = inferMergeState(item);
+  const overall = checkState === "unknown" && reviewState === "none" && mergeState === "unknown" ? "unknown" : checkState === "failure" || reviewState === "changes_requested" || mergeState !== "clean" && mergeState !== "unknown" ? "needs_attention" : checkState === "pending" ? "running" : "healthy";
+  return { overall, checkState, reviewState, mergeState };
+}
+function createAlert(type, severity, title, message, createdAt, source) {
+  return { type, severity, title, message, createdAt, source };
+}
+function deriveAlerts(item, recentEvents = []) {
+  const alerts = [];
+  const now = item.updatedAt;
+  if (item.statusSummary.checkState === "failure") {
+    alerts.push(createAlert("ci_failed", "critical", "CI failed", "One or more required checks failed on the latest head commit.", now, "state"));
+  }
+  if (item.statusSummary.mergeState === "conflicting") {
+    alerts.push(createAlert("conflicted", "critical", "Merge conflicts detected", `Branch ${item.headBranch} conflicts with ${item.baseBranch}.`, now, "state"));
+  }
+  if (item.statusSummary.mergeState === "behind") {
+    alerts.push(createAlert("base_behind", "warning", "Base branch moved ahead", `${item.headBranch} should be rebased or merged with ${item.baseBranch}.`, now, "state"));
+  }
+  if (item.statusSummary.reviewState === "changes_requested") {
+    alerts.push(createAlert("review_changes_requested", "critical", "Changes requested", "A reviewer requested follow-up changes on this work item.", now, "state"));
+  }
+  const reviewCommentEvent = recentEvents.filter((event) => event.type === "review_commented").toSorted((a, b) => b.createdAt.localeCompare(a.createdAt))[0];
+  if (reviewCommentEvent) {
+    alerts.push(createAlert("review_commented", "info", "Review comment received", reviewCommentEvent.message, reviewCommentEvent.createdAt, "event"));
+  }
+  const blockers = alerts.filter((alert) => alert.severity !== "info");
+  return { alerts, blockers };
+}
+function hasBlockingAlerts(item) {
+  return item.alerts.some((alert) => alert.severity !== "info");
+}
+// ../../packages/ops-harbor-core/src/db-helpers.ts
+function mapWorkItemsToAlertSummaries(workItems) {
+  return workItems.map((item) => ({
+    workItemId: item.id,
+    repository: item.repository,
+    number: item.number,
+    title: item.title,
+    url: item.url,
+    alerts: item.alerts,
+    updatedAt: item.updatedAt
+  }));
+}
+function buildActivityWhereClause(options, columnMap = {
+  workItemId: "work_item_id",
+  repository: "repository"
+}) {
+  const clauses = [];
+  const params = [];
+  if (options.workItemId) {
+    clauses.push(`${columnMap.workItemId} = ?`);
+    params.push(options.workItemId);
+  }
+  if (options.repository) {
+    clauses.push(`${columnMap.repository} = ?`);
+    params.push(options.repository);
+  }
+  const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
+  return { where, params };
+}
+// ../../packages/ops-harbor-core/src/filters.ts
+function filterWorkItems(items, filter) {
+  return items.filter((item) => {
+    if (filter.state && item.state !== filter.state)
+      return false;
+    if (filter.repository && item.repository !== filter.repository)
+      return false;
+    if (filter.hasBlocker !== undefined && hasBlockingAlerts(item) !== filter.hasBlocker) {
+      return false;
+    }
+    if (filter.updatedSince && item.updatedAt < filter.updatedSince)
+      return false;
+    return true;
+  });
+}
+function parseWorkItemFilterFromQuery(getParam) {
+  const filter = {};
+  const state = getParam("state");
+  if (state === "open" || state === "closed" || state === "merged") {
+    filter.state = state;
+  }
+  const repository = getParam("repository");
+  if (repository)
+    filter.repository = repository;
+  if (getParam("has_blocker") === "true") {
+    filter.hasBlocker = true;
+  } else if (getParam("has_blocker") === "false") {
+    filter.hasBlocker = false;
+  }
+  const updatedSince = getParam("updated_since");
+  if (updatedSince)
+    filter.updatedSince = updatedSince;
+  return filter;
+}
+// ../../packages/ops-harbor-core/src/prompt.ts
+var TRIGGER_INSTRUCTIONS = {
+  ci_failed: "Investigate the failing checks, implement the minimum safe fix, and rerun local validation.",
+  conflicted: "Resolve merge conflicts with the base branch while preserving branch intent.",
+  base_behind: "Update the branch with the latest base branch changes and resolve follow-up issues.",
+  review_commented: "Review the latest reviewer feedback, apply the requested follow-up if it is actionable, and summarize the changes.",
+  review_changes_requested: "Address the requested review changes, validate locally, and prepare the branch for another review."
+};
+function buildAutomationPrompt(workItem, trigger) {
+  return [
+    `Provider: ${workItem.provider}`,
+    `Repository: ${workItem.repository}`,
+    `Work item: #${workItem.number} ${workItem.title}`,
+    `URL: ${workItem.url}`,
+    `Base branch: ${workItem.baseBranch}`,
+    `Head branch: ${workItem.headBranch}`,
+    `Trigger: ${trigger}`,
+    "",
+    TRIGGER_INSTRUCTIONS[trigger]
+  ].join(`
+`);
+}
+// ../../packages/ops-harbor-core/src/port-finder.ts
+import { createServer } from "net";
+var MAX_PORT = 65535;
+async function findAvailablePort(startPort) {
+  for (let port = startPort;port <= MAX_PORT; port += 1) {
+    if (await isPortAvailable(port)) {
+      return port;
+    }
+  }
+  throw new Error(`No available port found between ${startPort} and ${MAX_PORT}`);
+}
+function isPortAvailable(port) {
+  return new Promise((resolve) => {
+    const server = createServer();
+    server.once("error", () => resolve(false));
+    server.once("listening", () => {
+      server.close(() => resolve(true));
+    });
+    server.listen(port, "127.0.0.1");
+  });
+}
+// ../../packages/ops-harbor-core/src/sqlite.ts
+import { createRequire } from "module";
+import { resolve } from "path";
+var requireFromModule = createRequire(import.meta.url);
+var requireFromWorkingDirectory = createRequire(resolve(process.cwd(), "package.json"));
+function openSqliteDatabase(filename) {
+  const db = typeof Bun !== "undefined" ? new (requireFromModule("bun:sqlite")).Database(filename) : new (requireFromWorkingDirectory("better-sqlite3"))(filename);
+  db.exec("PRAGMA journal_mode = WAL");
+  return db;
+}
+function parseJson(value, fallback) {
+  if (!value)
+    return fallback;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
+// ../ops-harbor-control-plane/src/lib/github.ts
+import { createHmac, createSign } from "crypto";
+var SEARCH_QUERY = `
+  query SearchPullRequests($query: String!, $first: Int!, $after: String) {
+    search(query: $query, type: ISSUE, first: $first, after: $after) {
+      pageInfo { hasNextPage endCursor }
+      nodes {
+        ... on PullRequest {
+          id
+          number
+          title
+          url
+          state
+          isDraft
+          mergeable
+          mergeStateStatus
+          reviewDecision
+          updatedAt
+          repository { nameWithOwner url }
+          author { login }
+          baseRefName
+          headRefName
+          headRefOid
+          latestReviews(first: 20) {
+            nodes {
+              id
+              state
+              body
+              submittedAt
+              url
+              author { login }
+            }
+          }
+          commits(last: 1) {
+            nodes {
+              commit {
+                statusCheckRollup {
+                  contexts(first: 50) {
+                    nodes {
+                      __typename
+                      ... on CheckRun {
+                        name
+                        status
+                        conclusion
+                        detailsUrl
+                        startedAt
+                        completedAt
+                      }
+                      ... on StatusContext {
+                        context
+                        state
+                        targetUrl
+                        createdAt
+                        description
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+var PULL_REQUEST_QUERY = `
+  query PullRequestDetails($owner: String!, $repo: String!, $number: Int!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequest(number: $number) {
+        id
+        number
+        title
+        url
+        state
+        isDraft
+        mergeable
+        mergeStateStatus
+        reviewDecision
+        updatedAt
+        repository { nameWithOwner url }
+        author { login }
+        baseRefName
+        headRefName
+        headRefOid
+        latestReviews(first: 20) {
+          nodes {
+            id
+            state
+            body
+            submittedAt
+            url
+            author { login }
+          }
+        }
+        commits(last: 1) {
+          nodes {
+            commit {
+              statusCheckRollup {
+                contexts(first: 50) {
+                  nodes {
+                    __typename
+                    ... on CheckRun {
+                      name
+                      status
+                      conclusion
+                      detailsUrl
+                      startedAt
+                      completedAt
+                    }
+                    ... on StatusContext {
+                      context
+                      state
+                      targetUrl
+                      createdAt
+                      description
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+function toBase64Url(value) {
+  return Buffer.from(value).toString("base64").replaceAll("=", "").replaceAll("+", "-").replaceAll("/", "_");
+}
+function createAppJwt(appId, privateKeyPem) {
+  const now = Math.floor(Date.now() / 1000);
+  const header = { alg: "RS256", typ: "JWT" };
+  const payload = {
+    iat: now - 60,
+    exp: now + 9 * 60,
+    iss: appId
+  };
+  const encoded = `${toBase64Url(JSON.stringify(header))}.${toBase64Url(JSON.stringify(payload))}`;
+  const signer = createSign("RSA-SHA256");
+  signer.update(encoded);
+  const signature = signer.sign(privateKeyPem);
+  return `${encoded}.${toBase64Url(signature)}`;
+}
+async function githubRequest(config, path, init, scope) {
+  const response = await fetch(`${config.githubApiUrl}${path}`, {
+    ...init,
+    headers: {
+      Accept: "application/vnd.github+json",
+      "User-Agent": "ops-harbor-control-plane",
+      ...init.headers
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`GitHub request failed (${scope}): ${response.status} ${response.statusText}`);
+  }
+  const data = await response.json();
+  return {
+    data,
+    rateLimit: {
+      remaining: Number.parseInt(response.headers.get("x-ratelimit-remaining") ?? "", 10),
+      resetAt: response.headers.get("x-ratelimit-reset") ? new Date(Number.parseInt(response.headers.get("x-ratelimit-reset") ?? "0", 10) * 1000).toISOString() : null
+    }
+  };
+}
+async function getAppAuthHeader(config) {
+  if (!config.githubAppId || !config.githubPrivateKey) {
+    throw new Error("GitHub App is not configured.");
+  }
+  return `Bearer ${createAppJwt(config.githubAppId, config.githubPrivateKey)}`;
+}
+function mergeRateLimitSnapshots(current, next) {
+  const remaining = current.remaining !== undefined && next.remaining !== undefined ? Math.min(current.remaining, next.remaining) : next.remaining ?? current.remaining;
+  const resetAt = next.resetAt ?? current.resetAt;
+  return {
+    ...remaining !== undefined ? { remaining } : {},
+    ...resetAt !== undefined ? { resetAt } : {}
+  };
+}
+async function listInstallations(config) {
+  const authHeader = await getAppAuthHeader(config);
+  const installations = [];
+  let rateLimit = {};
+  for (let page = 1;; page += 1) {
+    const { data, rateLimit: pageRateLimit } = await githubRequest(config, `/app/installations?per_page=100&page=${page}`, {
+      method: "GET",
+      headers: {
+        Authorization: authHeader
+      }
+    }, "app.installations");
+    const pageInstallations = Array.isArray(data) ? data : data.installations ?? [];
+    installations.push(...pageInstallations);
+    rateLimit = mergeRateLimitSnapshots(rateLimit, pageRateLimit);
+    if (pageInstallations.length < 100) {
+      break;
+    }
+  }
+  return { installations, rateLimit };
+}
+async function getGitHubAppWebhookConfig(config) {
+  const { data, rateLimit } = await githubRequest(config, "/app/hook/config", {
+    method: "GET",
+    headers: {
+      Authorization: await getAppAuthHeader(config)
+    }
+  }, "app.hook.config.get");
+  return {
+    config: {
+      url: data.url,
+      contentType: data.content_type ?? "json",
+      insecureSsl: data.insecure_ssl ?? "0"
+    },
+    rateLimit
+  };
+}
+async function updateGitHubAppWebhookConfig(config, update) {
+  const body = {
+    url: update.url
+  };
+  if (update.contentType) {
+    body.content_type = update.contentType;
+  }
+  if (update.insecureSsl) {
+    body.insecure_ssl = update.insecureSsl;
+  }
+  if (config.githubWebhookSecret) {
+    body.secret = config.githubWebhookSecret;
+  }
+  const { data, rateLimit } = await githubRequest(config, "/app/hook/config", {
+    method: "PATCH",
+    headers: {
+      Authorization: await getAppAuthHeader(config),
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(body)
+  }, "app.hook.config.update");
+  return {
+    config: {
+      url: data.url,
+      contentType: data.content_type ?? update.contentType ?? "json",
+      insecureSsl: data.insecure_ssl ?? update.insecureSsl ?? "0"
+    },
+    rateLimit
+  };
+}
+async function ensureGitHubAppWebhookUrl(config, webhookUrl) {
+  const current = await getGitHubAppWebhookConfig(config);
+  if (current.config.url === webhookUrl && current.config.contentType === "json" && !config.githubWebhookSecret) {
+    return {
+      config: current.config,
+      updated: false,
+      rateLimit: current.rateLimit
+    };
+  }
+  const next = await updateGitHubAppWebhookConfig(config, {
+    url: webhookUrl,
+    contentType: "json",
+    insecureSsl: current.config.insecureSsl
+  });
+  return {
+    config: next.config,
+    updated: true,
+    rateLimit: mergeRateLimitSnapshots(current.rateLimit, next.rateLimit)
+  };
+}
+async function createInstallationToken(config, installationId) {
+  const { data, rateLimit } = await githubRequest(config, `/app/installations/${installationId}/access_tokens`, {
+    method: "POST",
+    headers: {
+      Authorization: await getAppAuthHeader(config)
+    }
+  }, `installation.${installationId}.token`);
+  return { token: data.token, rateLimit };
+}
+async function graphql(config, installationId, query, variables) {
+  const { token } = await createInstallationToken(config, installationId);
+  const response = await fetch(`${config.githubApiUrl}/graphql`, {
+    method: "POST",
+    headers: {
+      Accept: "application/vnd.github+json",
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      "User-Agent": "ops-harbor-control-plane"
+    },
+    body: JSON.stringify({ query, variables })
+  });
+  if (!response.ok) {
+    throw new Error(`GitHub GraphQL request failed: ${response.status} ${response.statusText}`);
+  }
+  const json = await response.json();
+  if (json.errors?.length) {
+    throw new Error(json.errors.map((error) => error.message).join("; "));
+  }
+  if (!json.data) {
+    throw new Error("GitHub GraphQL response did not contain data.");
+  }
+  return {
+    data: json.data,
+    rateLimit: {
+      remaining: Number.parseInt(response.headers.get("x-ratelimit-remaining") ?? "", 10),
+      resetAt: response.headers.get("x-ratelimit-reset") ? new Date(Number.parseInt(response.headers.get("x-ratelimit-reset") ?? "0", 10) * 1000).toISOString() : null
+    }
+  };
+}
+function mapChecks(node) {
+  const contexts = node.commits.nodes[0]?.commit.statusCheckRollup?.contexts.nodes ?? [];
+  return contexts.map((context) => {
+    if (context.__typename === "CheckRun") {
+      return {
+        name: context.name,
+        status: context.status,
+        conclusion: context.conclusion,
+        url: context.detailsUrl ?? null,
+        startedAt: context.startedAt ?? null,
+        completedAt: context.completedAt ?? null
+      };
+    }
+    return {
+      name: context.context,
+      status: context.state === "PENDING" ? "pending" : "completed",
+      conclusion: context.state.toLowerCase(),
+      url: context.targetUrl ?? null,
+      startedAt: context.createdAt ?? null,
+      completedAt: context.createdAt ?? null
+    };
+  });
+}
+function mapReviews(node) {
+  return node.latestReviews.nodes.map((review) => ({
+    id: review.id,
+    state: review.state.toLowerCase(),
+    author: review.author?.login ?? "unknown",
+    submittedAt: review.submittedAt,
+    ...review.body ? { bodySnippet: review.body.slice(0, 240) } : {},
+    ...review.url ? { url: review.url } : {}
+  }));
+}
+function mapPullRequest(node, installationId) {
+  const checks = mapChecks(node);
+  const reviews = mapReviews(node);
+  const statusSummary = summarizeStatus(checks, reviews, {
+    mergeable: node.mergeable === "CONFLICTING" ? "conflicting" : node.mergeable === "MERGEABLE" ? "mergeable" : "unknown",
+    mergeStateStatus: node.mergeStateStatus,
+    reviewDecision: node.reviewDecision
+  });
+  return {
+    id: node.id,
+    provider: "github",
+    kind: "pull_request",
+    repository: node.repository.nameWithOwner,
+    number: node.number,
+    title: node.title,
+    url: node.url,
+    state: node.state.toLowerCase(),
+    author: node.author?.login ?? "unknown",
+    isDraft: node.isDraft,
+    headBranch: node.headRefName,
+    headSha: node.headRefOid,
+    baseBranch: node.baseRefName,
+    mergeable: node.mergeable === "CONFLICTING" ? "conflicting" : node.mergeable === "MERGEABLE" ? "mergeable" : "unknown",
+    mergeStateStatus: node.mergeStateStatus,
+    reviewDecision: node.reviewDecision,
+    statusSummary,
+    checks,
+    reviews,
+    alerts: [],
+    lastActivityAt: node.updatedAt,
+    updatedAt: node.updatedAt,
+    providerPayload: {
+      installationId,
+      repositoryUrl: node.repository.url
+    }
+  };
+}
+async function fetchOpenPullRequestsForAuthor(config, installationId, author, limit = 100) {
+  const items = [];
+  let cursor = null;
+  let lastRateLimit = {};
+  while (items.length < limit) {
+    const response = await graphql(config, installationId, SEARCH_QUERY, {
+      query: `is:pr is:open author:${author} archived:false`,
+      first: Math.min(50, limit - items.length),
+      after: cursor
+    });
+    const data = response.data;
+    lastRateLimit = response.rateLimit;
+    items.push(...data.search.nodes.map((node) => mapPullRequest(node, installationId)));
+    if (!data.search.pageInfo.hasNextPage)
+      break;
+    cursor = data.search.pageInfo.endCursor;
+  }
+  return { items, rateLimit: lastRateLimit };
+}
+async function hydratePullRequest(config, installationId, repository, number2) {
+  const [owner, repo] = repository.split("/");
+  if (!owner || !repo) {
+    throw new Error(`Invalid repository name: ${repository}`);
+  }
+  const { data, rateLimit } = await graphql(config, installationId, PULL_REQUEST_QUERY, { owner, repo, number: number2 });
+  return {
+    item: data.repository.pullRequest ? mapPullRequest(data.repository.pullRequest, installationId) : null,
+    rateLimit
+  };
+}
+function verifyWebhookSignature(secret, rawBody, signatureHeader) {
+  if (!signatureHeader?.startsWith("sha256="))
+    return false;
+  const expected = `sha256=${createHmac("sha256", secret).update(rawBody).digest("hex")}`;
+  return expected === signatureHeader;
+}
+
+// ../ops-harbor-control-plane/src/lib/tunnel.ts
+async function openTunnel(options) {
+  const module = await import("localtunnel");
+  const createTunnel = module.default;
+  if (!createTunnel) {
+    throw new Error("localtunnel did not expose a default factory.");
+  }
+  const tunnel = await createTunnel({
+    port: options.port,
+    ...options.localHost ? { local_host: options.localHost } : {},
+    ...options.host ? { host: options.host } : {}
+  });
+  return {
+    url: tunnel.url.replace(/\/$/, ""),
+    async close() {
+      await tunnel.close();
+    }
+  };
+}
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/compose.js
+var compose = (middleware, onError, onNotFound) => {
+  return (context, next) => {
+    let index = -1;
+    return dispatch(0);
+    async function dispatch(i) {
+      if (i <= index) {
+        throw new Error("next() called multiple times");
+      }
+      index = i;
+      let res;
+      let isError = false;
+      let handler;
+      if (middleware[i]) {
+        handler = middleware[i][0][0];
+        context.req.routeIndex = i;
+      } else {
+        handler = i === middleware.length && next || undefined;
+      }
+      if (handler) {
+        try {
+          res = await handler(context, () => dispatch(i + 1));
+        } catch (err) {
+          if (err instanceof Error && onError) {
+            context.error = err;
+            res = await onError(err, context);
+            isError = true;
+          } else {
+            throw err;
+          }
+        }
+      } else {
+        if (context.finalized === false && onNotFound) {
+          res = await onNotFound(context);
+        }
+      }
+      if (res && (context.finalized === false || isError)) {
+        context.res = res;
+      }
+      return context;
+    }
+  };
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/request/constants.js
+var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/utils/body.js
+var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
+  const { all = false, dot = false } = options;
+  const headers = request instanceof HonoRequest ? request.raw.headers : request.headers;
+  const contentType = headers.get("Content-Type");
+  if (contentType?.startsWith("multipart/form-data") || contentType?.startsWith("application/x-www-form-urlencoded")) {
+    return parseFormData(request, { all, dot });
+  }
+  return {};
+};
+async function parseFormData(request, options) {
+  const formData = await request.formData();
+  if (formData) {
+    return convertFormDataToBodyData(formData, options);
+  }
+  return {};
+}
+function convertFormDataToBodyData(formData, options) {
+  const form = /* @__PURE__ */ Object.create(null);
+  formData.forEach((value, key) => {
+    const shouldParseAllValues = options.all || key.endsWith("[]");
+    if (!shouldParseAllValues) {
+      form[key] = value;
+    } else {
+      handleParsingAllValues(form, key, value);
+    }
+  });
+  if (options.dot) {
+    Object.entries(form).forEach(([key, value]) => {
+      const shouldParseDotValues = key.includes(".");
+      if (shouldParseDotValues) {
+        handleParsingNestedValues(form, key, value);
+        delete form[key];
+      }
+    });
+  }
+  return form;
+}
+var handleParsingAllValues = (form, key, value) => {
+  if (form[key] !== undefined) {
+    if (Array.isArray(form[key])) {
+      form[key].push(value);
+    } else {
+      form[key] = [form[key], value];
+    }
+  } else {
+    if (!key.endsWith("[]")) {
+      form[key] = value;
+    } else {
+      form[key] = [value];
+    }
+  }
+};
+var handleParsingNestedValues = (form, key, value) => {
+  if (/(?:^|\.)__proto__\./.test(key)) {
+    return;
+  }
+  let nestedForm = form;
+  const keys = key.split(".");
+  keys.forEach((key2, index) => {
+    if (index === keys.length - 1) {
+      nestedForm[key2] = value;
+    } else {
+      if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        nestedForm[key2] = /* @__PURE__ */ Object.create(null);
+      }
+      nestedForm = nestedForm[key2];
+    }
+  });
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/utils/url.js
+var splitPath = (path) => {
+  const paths = path.split("/");
+  if (paths[0] === "") {
+    paths.shift();
+  }
+  return paths;
+};
+var splitRoutingPath = (routePath) => {
+  const { groups, path } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path);
+  return replaceGroupMarks(paths, groups);
+};
+var extractGroupsFromPath = (path) => {
+  const groups = [];
+  path = path.replace(/\{[^}]+\}/g, (match, index) => {
+    const mark = `@${index}`;
+    groups.push([mark, match]);
+    return mark;
+  });
+  return { groups, path };
+};
+var replaceGroupMarks = (paths, groups) => {
+  for (let i = groups.length - 1;i >= 0; i--) {
+    const [mark] = groups[i];
+    for (let j = paths.length - 1;j >= 0; j--) {
+      if (paths[j].includes(mark)) {
+        paths[j] = paths[j].replace(mark, groups[i][1]);
+        break;
+      }
+    }
+  }
+  return paths;
+};
+var patternCache = {};
+var getPattern = (label, next) => {
+  if (label === "*") {
+    return "*";
+  }
+  const match = label.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
+  if (match) {
+    const cacheKey = `${label}#${next}`;
+    if (!patternCache[cacheKey]) {
+      if (match[2]) {
+        patternCache[cacheKey] = next && next[0] !== ":" && next[0] !== "*" ? [cacheKey, match[1], new RegExp(`^${match[2]}(?=/${next})`)] : [label, match[1], new RegExp(`^${match[2]}$`)];
+      } else {
+        patternCache[cacheKey] = [label, match[1], true];
+      }
+    }
+    return patternCache[cacheKey];
+  }
+  return null;
+};
+var tryDecode = (str, decoder) => {
+  try {
+    return decoder(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decoder(match);
+      } catch {
+        return match;
+      }
+    });
+  }
+};
+var tryDecodeURI = (str) => tryDecode(str, decodeURI);
+var getPath = (request) => {
+  const url = request.url;
+  const start = url.indexOf("/", url.indexOf(":") + 4);
+  let i = start;
+  for (;i < url.length; i++) {
+    const charCode = url.charCodeAt(i);
+    if (charCode === 37) {
+      const queryIndex = url.indexOf("?", i);
+      const hashIndex = url.indexOf("#", i);
+      const end = queryIndex === -1 ? hashIndex === -1 ? undefined : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
+      const path = url.slice(start, end);
+      return tryDecodeURI(path.includes("%25") ? path.replace(/%25/g, "%2525") : path);
+    } else if (charCode === 63 || charCode === 35) {
+      break;
+    }
+  }
+  return url.slice(start, i);
+};
+var getPathNoStrict = (request) => {
+  const result = getPath(request);
+  return result.length > 1 && result.at(-1) === "/" ? result.slice(0, -1) : result;
+};
+var mergePath = (base, sub, ...rest) => {
+  if (rest.length) {
+    sub = mergePath(sub, ...rest);
+  }
+  return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
+};
+var checkOptionalParameter = (path) => {
+  if (path.charCodeAt(path.length - 1) !== 63 || !path.includes(":")) {
+    return null;
+  }
+  const segments = path.split("/");
+  const results = [];
+  let basePath = "";
+  segments.forEach((segment) => {
+    if (segment !== "" && !/\:/.test(segment)) {
+      basePath += "/" + segment;
+    } else if (/\:/.test(segment)) {
+      if (/\?/.test(segment)) {
+        if (results.length === 0 && basePath === "") {
+          results.push("/");
+        } else {
+          results.push(basePath);
+        }
+        const optionalSegment = segment.replace("?", "");
+        basePath += "/" + optionalSegment;
+        results.push(basePath);
+      } else {
+        basePath += "/" + segment;
+      }
+    }
+  });
+  return results.filter((v, i, a) => a.indexOf(v) === i);
+};
+var _decodeURI = (value) => {
+  if (!/[%+]/.test(value)) {
+    return value;
+  }
+  if (value.indexOf("+") !== -1) {
+    value = value.replace(/\+/g, " ");
+  }
+  return value.indexOf("%") !== -1 ? tryDecode(value, decodeURIComponent_) : value;
+};
+var _getQueryParam = (url, key, multiple) => {
+  let encoded;
+  if (!multiple && key && !/[%+]/.test(key)) {
+    let keyIndex2 = url.indexOf("?", 8);
+    if (keyIndex2 === -1) {
+      return;
+    }
+    if (!url.startsWith(key, keyIndex2 + 1)) {
+      keyIndex2 = url.indexOf(`&${key}`, keyIndex2 + 1);
+    }
+    while (keyIndex2 !== -1) {
+      const trailingKeyCode = url.charCodeAt(keyIndex2 + key.length + 1);
+      if (trailingKeyCode === 61) {
+        const valueIndex = keyIndex2 + key.length + 2;
+        const endIndex = url.indexOf("&", valueIndex);
+        return _decodeURI(url.slice(valueIndex, endIndex === -1 ? undefined : endIndex));
+      } else if (trailingKeyCode == 38 || isNaN(trailingKeyCode)) {
+        return "";
+      }
+      keyIndex2 = url.indexOf(`&${key}`, keyIndex2 + 1);
+    }
+    encoded = /[%+]/.test(url);
+    if (!encoded) {
+      return;
+    }
+  }
+  const results = {};
+  encoded ??= /[%+]/.test(url);
+  let keyIndex = url.indexOf("?", 8);
+  while (keyIndex !== -1) {
+    const nextKeyIndex = url.indexOf("&", keyIndex + 1);
+    let valueIndex = url.indexOf("=", keyIndex);
+    if (valueIndex > nextKeyIndex && nextKeyIndex !== -1) {
+      valueIndex = -1;
+    }
+    let name = url.slice(keyIndex + 1, valueIndex === -1 ? nextKeyIndex === -1 ? undefined : nextKeyIndex : valueIndex);
+    if (encoded) {
+      name = _decodeURI(name);
+    }
+    keyIndex = nextKeyIndex;
+    if (name === "") {
+      continue;
+    }
+    let value;
+    if (valueIndex === -1) {
+      value = "";
+    } else {
+      value = url.slice(valueIndex + 1, nextKeyIndex === -1 ? undefined : nextKeyIndex);
+      if (encoded) {
+        value = _decodeURI(value);
+      }
+    }
+    if (multiple) {
+      if (!(results[name] && Array.isArray(results[name]))) {
+        results[name] = [];
+      }
+      results[name].push(value);
+    } else {
+      results[name] ??= value;
+    }
+  }
+  return key ? results[key] : results;
+};
+var getQueryParam = _getQueryParam;
+var getQueryParams = (url, key) => {
+  return _getQueryParam(url, key, true);
+};
+var decodeURIComponent_ = decodeURIComponent;
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/request.js
+var tryDecodeURIComponent = (str) => tryDecode(str, decodeURIComponent_);
+var HonoRequest = class {
+  raw;
+  #validatedData;
+  #matchResult;
+  routeIndex = 0;
+  path;
+  bodyCache = {};
+  constructor(request, path = "/", matchResult = [[]]) {
+    this.raw = request;
+    this.path = path;
+    this.#matchResult = matchResult;
+    this.#validatedData = {};
+  }
+  param(key) {
+    return key ? this.#getDecodedParam(key) : this.#getAllDecodedParams();
+  }
+  #getDecodedParam(key) {
+    const paramKey = this.#matchResult[0][this.routeIndex][1][key];
+    const param = this.#getParamValue(paramKey);
+    return param && /\%/.test(param) ? tryDecodeURIComponent(param) : param;
+  }
+  #getAllDecodedParams() {
+    const decoded = {};
+    const keys = Object.keys(this.#matchResult[0][this.routeIndex][1]);
+    for (const key of keys) {
+      const value = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key]);
+      if (value !== undefined) {
+        decoded[key] = /\%/.test(value) ? tryDecodeURIComponent(value) : value;
+      }
+    }
+    return decoded;
+  }
+  #getParamValue(paramKey) {
+    return this.#matchResult[1] ? this.#matchResult[1][paramKey] : paramKey;
+  }
+  query(key) {
+    return getQueryParam(this.url, key);
+  }
+  queries(key) {
+    return getQueryParams(this.url, key);
+  }
+  header(name) {
+    if (name) {
+      return this.raw.headers.get(name) ?? undefined;
+    }
+    const headerData = {};
+    this.raw.headers.forEach((value, key) => {
+      headerData[key] = value;
+    });
+    return headerData;
+  }
+  async parseBody(options) {
+    return parseBody(this, options);
+  }
+  #cachedBody = (key) => {
+    const { bodyCache, raw } = this;
+    const cachedBody = bodyCache[key];
+    if (cachedBody) {
+      return cachedBody;
+    }
+    const anyCachedKey = Object.keys(bodyCache)[0];
+    if (anyCachedKey) {
+      return bodyCache[anyCachedKey].then((body) => {
+        if (anyCachedKey === "json") {
+          body = JSON.stringify(body);
+        }
+        return new Response(body)[key]();
+      });
+    }
+    return bodyCache[key] = raw[key]();
+  };
+  json() {
+    return this.#cachedBody("text").then((text) => JSON.parse(text));
+  }
+  text() {
+    return this.#cachedBody("text");
+  }
+  arrayBuffer() {
+    return this.#cachedBody("arrayBuffer");
+  }
+  blob() {
+    return this.#cachedBody("blob");
+  }
+  formData() {
+    return this.#cachedBody("formData");
+  }
+  addValidatedData(target, data) {
+    this.#validatedData[target] = data;
+  }
+  valid(target) {
+    return this.#validatedData[target];
+  }
+  get url() {
+    return this.raw.url;
+  }
+  get method() {
+    return this.raw.method;
+  }
+  get [GET_MATCH_RESULT]() {
+    return this.#matchResult;
+  }
+  get matchedRoutes() {
+    return this.#matchResult[0].map(([[, route]]) => route);
+  }
+  get routePath() {
+    return this.#matchResult[0].map(([[, route]]) => route)[this.routeIndex].path;
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/utils/html.js
+var HtmlEscapedCallbackPhase = {
+  Stringify: 1,
+  BeforeStream: 2,
+  Stream: 3
+};
+var raw = (value, callbacks) => {
+  const escapedString = new String(value);
+  escapedString.isEscaped = true;
+  escapedString.callbacks = callbacks;
+  return escapedString;
+};
+var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) => {
+  if (typeof str === "object" && !(str instanceof String)) {
+    if (!(str instanceof Promise)) {
+      str = str.toString();
+    }
+    if (str instanceof Promise) {
+      str = await str;
+    }
+  }
+  const callbacks = str.callbacks;
+  if (!callbacks?.length) {
+    return Promise.resolve(str);
+  }
+  if (buffer) {
+    buffer[0] += str;
+  } else {
+    buffer = [str];
+  }
+  const resStr = Promise.all(callbacks.map((c) => c({ phase, buffer, context }))).then((res) => Promise.all(res.filter(Boolean).map((str2) => resolveCallback(str2, phase, false, context, buffer))).then(() => buffer[0]));
+  if (preserveCallbacks) {
+    return raw(await resStr, callbacks);
+  } else {
+    return resStr;
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/context.js
+var TEXT_PLAIN = "text/plain; charset=UTF-8";
+var setDefaultContentType = (contentType, headers) => {
+  return {
+    "Content-Type": contentType,
+    ...headers
+  };
+};
+var createResponseInstance = (body, init) => new Response(body, init);
+var Context = class {
+  #rawRequest;
+  #req;
+  env = {};
+  #var;
+  finalized = false;
+  error;
+  #status;
+  #executionCtx;
+  #res;
+  #layout;
+  #renderer;
+  #notFoundHandler;
+  #preparedHeaders;
+  #matchResult;
+  #path;
+  constructor(req, options) {
+    this.#rawRequest = req;
+    if (options) {
+      this.#executionCtx = options.executionCtx;
+      this.env = options.env;
+      this.#notFoundHandler = options.notFoundHandler;
+      this.#path = options.path;
+      this.#matchResult = options.matchResult;
+    }
+  }
+  get req() {
+    this.#req ??= new HonoRequest(this.#rawRequest, this.#path, this.#matchResult);
+    return this.#req;
+  }
+  get event() {
+    if (this.#executionCtx && "respondWith" in this.#executionCtx) {
+      return this.#executionCtx;
+    } else {
+      throw Error("This context has no FetchEvent");
+    }
+  }
+  get executionCtx() {
+    if (this.#executionCtx) {
+      return this.#executionCtx;
+    } else {
+      throw Error("This context has no ExecutionContext");
+    }
+  }
+  get res() {
+    return this.#res ||= createResponseInstance(null, {
+      headers: this.#preparedHeaders ??= new Headers
+    });
+  }
+  set res(_res) {
+    if (this.#res && _res) {
+      _res = createResponseInstance(_res.body, _res);
+      for (const [k, v] of this.#res.headers.entries()) {
+        if (k === "content-type") {
+          continue;
+        }
+        if (k === "set-cookie") {
+          const cookies = this.#res.headers.getSetCookie();
+          _res.headers.delete("set-cookie");
+          for (const cookie of cookies) {
+            _res.headers.append("set-cookie", cookie);
+          }
+        } else {
+          _res.headers.set(k, v);
+        }
+      }
+    }
+    this.#res = _res;
+    this.finalized = true;
+  }
+  render = (...args) => {
+    this.#renderer ??= (content) => this.html(content);
+    return this.#renderer(...args);
+  };
+  setLayout = (layout) => this.#layout = layout;
+  getLayout = () => this.#layout;
+  setRenderer = (renderer) => {
+    this.#renderer = renderer;
+  };
+  header = (name, value, options) => {
+    if (this.finalized) {
+      this.#res = createResponseInstance(this.#res.body, this.#res);
+    }
+    const headers = this.#res ? this.#res.headers : this.#preparedHeaders ??= new Headers;
+    if (value === undefined) {
+      headers.delete(name);
+    } else if (options?.append) {
+      headers.append(name, value);
+    } else {
+      headers.set(name, value);
+    }
+  };
+  status = (status) => {
+    this.#status = status;
+  };
+  set = (key, value) => {
+    this.#var ??= /* @__PURE__ */ new Map;
+    this.#var.set(key, value);
+  };
+  get = (key) => {
+    return this.#var ? this.#var.get(key) : undefined;
+  };
+  get var() {
+    if (!this.#var) {
+      return {};
+    }
+    return Object.fromEntries(this.#var);
+  }
+  #newResponse(data, arg, headers) {
+    const responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders ?? new Headers;
+    if (typeof arg === "object" && "headers" in arg) {
+      const argHeaders = arg.headers instanceof Headers ? arg.headers : new Headers(arg.headers);
+      for (const [key, value] of argHeaders) {
+        if (key.toLowerCase() === "set-cookie") {
+          responseHeaders.append(key, value);
+        } else {
+          responseHeaders.set(key, value);
+        }
+      }
+    }
+    if (headers) {
+      for (const [k, v] of Object.entries(headers)) {
+        if (typeof v === "string") {
+          responseHeaders.set(k, v);
+        } else {
+          responseHeaders.delete(k);
+          for (const v2 of v) {
+            responseHeaders.append(k, v2);
+          }
+        }
+      }
+    }
+    const status = typeof arg === "number" ? arg : arg?.status ?? this.#status;
+    return createResponseInstance(data, { status, headers: responseHeaders });
+  }
+  newResponse = (...args) => this.#newResponse(...args);
+  body = (data, arg, headers) => this.#newResponse(data, arg, headers);
+  text = (text, arg, headers) => {
+    return !this.#preparedHeaders && !this.#status && !arg && !headers && !this.finalized ? new Response(text) : this.#newResponse(text, arg, setDefaultContentType(TEXT_PLAIN, headers));
+  };
+  json = (object2, arg, headers) => {
+    return this.#newResponse(JSON.stringify(object2), arg, setDefaultContentType("application/json", headers));
+  };
+  html = (html, arg, headers) => {
+    const res = (html2) => this.#newResponse(html2, arg, setDefaultContentType("text/html; charset=UTF-8", headers));
+    return typeof html === "object" ? resolveCallback(html, HtmlEscapedCallbackPhase.Stringify, false, {}).then(res) : res(html);
+  };
+  redirect = (location, status) => {
+    const locationString = String(location);
+    this.header("Location", !/[^\x00-\xFF]/.test(locationString) ? locationString : encodeURI(locationString));
+    return this.newResponse(null, status ?? 302);
+  };
+  notFound = () => {
+    this.#notFoundHandler ??= () => createResponseInstance();
+    return this.#notFoundHandler(this);
+  };
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router.js
+var METHOD_NAME_ALL = "ALL";
+var METHOD_NAME_ALL_LOWERCASE = "all";
+var METHODS = ["get", "post", "put", "delete", "options", "patch"];
+var MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is already built.";
+var UnsupportedPathError = class extends Error {
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/utils/constants.js
+var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/hono-base.js
+var notFoundHandler = (c) => {
+  return c.text("404 Not Found", 404);
+};
+var errorHandler = (err, c) => {
+  if ("getResponse" in err) {
+    const res = err.getResponse();
+    return c.newResponse(res.body, res);
+  }
+  console.error(err);
+  return c.text("Internal Server Error", 500);
+};
+var Hono = class _Hono {
+  get;
+  post;
+  put;
+  delete;
+  options;
+  patch;
+  all;
+  on;
+  use;
+  router;
+  getPath;
+  _basePath = "/";
+  #path = "/";
+  routes = [];
+  constructor(options = {}) {
+    const allMethods = [...METHODS, METHOD_NAME_ALL_LOWERCASE];
+    allMethods.forEach((method) => {
+      this[method] = (args1, ...args) => {
+        if (typeof args1 === "string") {
+          this.#path = args1;
+        } else {
+          this.#addRoute(method, this.#path, args1);
+        }
+        args.forEach((handler) => {
+          this.#addRoute(method, this.#path, handler);
+        });
+        return this;
+      };
+    });
+    this.on = (method, path, ...handlers) => {
+      for (const p of [path].flat()) {
+        this.#path = p;
+        for (const m of [method].flat()) {
+          handlers.map((handler) => {
+            this.#addRoute(m.toUpperCase(), this.#path, handler);
+          });
+        }
+      }
+      return this;
+    };
+    this.use = (arg1, ...handlers) => {
+      if (typeof arg1 === "string") {
+        this.#path = arg1;
+      } else {
+        this.#path = "*";
+        handlers.unshift(arg1);
+      }
+      handlers.forEach((handler) => {
+        this.#addRoute(METHOD_NAME_ALL, this.#path, handler);
+      });
+      return this;
+    };
+    const { strict, ...optionsWithoutStrict } = options;
+    Object.assign(this, optionsWithoutStrict);
+    this.getPath = strict ?? true ? options.getPath ?? getPath : getPathNoStrict;
+  }
+  #clone() {
+    const clone = new _Hono({
+      router: this.router,
+      getPath: this.getPath
+    });
+    clone.errorHandler = this.errorHandler;
+    clone.#notFoundHandler = this.#notFoundHandler;
+    clone.routes = this.routes;
+    return clone;
+  }
+  #notFoundHandler = notFoundHandler;
+  errorHandler = errorHandler;
+  route(path, app) {
+    const subApp = this.basePath(path);
+    app.routes.map((r) => {
+      let handler;
+      if (app.errorHandler === errorHandler) {
+        handler = r.handler;
+      } else {
+        handler = async (c, next) => (await compose([], app.errorHandler)(c, () => r.handler(c, next))).res;
+        handler[COMPOSED_HANDLER] = r.handler;
+      }
+      subApp.#addRoute(r.method, r.path, handler);
+    });
+    return this;
+  }
+  basePath(path) {
+    const subApp = this.#clone();
+    subApp._basePath = mergePath(this._basePath, path);
+    return subApp;
+  }
+  onError = (handler) => {
+    this.errorHandler = handler;
+    return this;
+  };
+  notFound = (handler) => {
+    this.#notFoundHandler = handler;
+    return this;
+  };
+  mount(path, applicationHandler, options) {
+    let replaceRequest;
+    let optionHandler;
+    if (options) {
+      if (typeof options === "function") {
+        optionHandler = options;
+      } else {
+        optionHandler = options.optionHandler;
+        if (options.replaceRequest === false) {
+          replaceRequest = (request) => request;
+        } else {
+          replaceRequest = options.replaceRequest;
+        }
+      }
+    }
+    const getOptions = optionHandler ? (c) => {
+      const options2 = optionHandler(c);
+      return Array.isArray(options2) ? options2 : [options2];
+    } : (c) => {
+      let executionContext = undefined;
+      try {
+        executionContext = c.executionCtx;
+      } catch {}
+      return [c.env, executionContext];
+    };
+    replaceRequest ||= (() => {
+      const mergedPath = mergePath(this._basePath, path);
+      const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
+      return (request) => {
+        const url = new URL(request.url);
+        url.pathname = url.pathname.slice(pathPrefixLength) || "/";
+        return new Request(url, request);
+      };
+    })();
+    const handler = async (c, next) => {
+      const res = await applicationHandler(replaceRequest(c.req.raw), ...getOptions(c));
+      if (res) {
+        return res;
+      }
+      await next();
+    };
+    this.#addRoute(METHOD_NAME_ALL, mergePath(path, "*"), handler);
+    return this;
+  }
+  #addRoute(method, path, handler) {
+    method = method.toUpperCase();
+    path = mergePath(this._basePath, path);
+    const r = { basePath: this._basePath, path, method, handler };
+    this.router.add(method, path, [handler, r]);
+    this.routes.push(r);
+  }
+  #handleError(err, c) {
+    if (err instanceof Error) {
+      return this.errorHandler(err, c);
+    }
+    throw err;
+  }
+  #dispatch(request, executionCtx, env, method) {
+    if (method === "HEAD") {
+      return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
+    }
+    const path = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path);
+    const c = new Context(request, {
+      path,
+      matchResult,
+      env,
+      executionCtx,
+      notFoundHandler: this.#notFoundHandler
+    });
+    if (matchResult[0].length === 1) {
+      let res;
+      try {
+        res = matchResult[0][0][0][0](c, async () => {
+          c.res = await this.#notFoundHandler(c);
+        });
+      } catch (err) {
+        return this.#handleError(err, c);
+      }
+      return res instanceof Promise ? res.then((resolved) => resolved || (c.finalized ? c.res : this.#notFoundHandler(c))).catch((err) => this.#handleError(err, c)) : res ?? this.#notFoundHandler(c);
+    }
+    const composed = compose(matchResult[0], this.errorHandler, this.#notFoundHandler);
+    return (async () => {
+      try {
+        const context = await composed(c);
+        if (!context.finalized) {
+          throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");
+        }
+        return context.res;
+      } catch (err) {
+        return this.#handleError(err, c);
+      }
+    })();
+  }
+  fetch = (request, ...rest) => {
+    return this.#dispatch(request, rest[1], rest[0], request.method);
+  };
+  request = (input, requestInit, Env, executionCtx) => {
+    if (input instanceof Request) {
+      return this.fetch(requestInit ? new Request(input, requestInit) : input, Env, executionCtx);
+    }
+    input = input.toString();
+    return this.fetch(new Request(/^https?:\/\//.test(input) ? input : `http://localhost${mergePath("/", input)}`, requestInit), Env, executionCtx);
+  };
+  fire = () => {
+    addEventListener("fetch", (event) => {
+      event.respondWith(this.#dispatch(event.request, event, undefined, event.request.method));
+    });
+  };
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router/reg-exp-router/matcher.js
+var emptyParam = [];
+function match(method, path) {
+  const matchers = this.buildAllMatchers();
+  const match2 = (method2, path2) => {
+    const matcher = matchers[method2] || matchers[METHOD_NAME_ALL];
+    const staticMatch = matcher[2][path2];
+    if (staticMatch) {
+      return staticMatch;
+    }
+    const match3 = path2.match(matcher[0]);
+    if (!match3) {
+      return [[], emptyParam];
+    }
+    const index = match3.indexOf("", 1);
+    return [matcher[1][index], match3];
+  };
+  this.match = match2;
+  return match2(method, path);
+}
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router/reg-exp-router/node.js
+var LABEL_REG_EXP_STR = "[^/]+";
+var ONLY_WILDCARD_REG_EXP_STR = ".*";
+var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
+var PATH_ERROR = /* @__PURE__ */ Symbol();
+var regExpMetaChars = new Set(".\\+*[^]$()");
+function compareKey(a, b) {
+  if (a.length === 1) {
+    return b.length === 1 ? a < b ? -1 : 1 : -1;
+  }
+  if (b.length === 1) {
+    return 1;
+  }
+  if (a === ONLY_WILDCARD_REG_EXP_STR || a === TAIL_WILDCARD_REG_EXP_STR) {
+    return 1;
+  } else if (b === ONLY_WILDCARD_REG_EXP_STR || b === TAIL_WILDCARD_REG_EXP_STR) {
+    return -1;
+  }
+  if (a === LABEL_REG_EXP_STR) {
+    return 1;
+  } else if (b === LABEL_REG_EXP_STR) {
+    return -1;
+  }
+  return a.length === b.length ? a < b ? -1 : 1 : b.length - a.length;
+}
+var Node = class _Node {
+  #index;
+  #varIndex;
+  #children = /* @__PURE__ */ Object.create(null);
+  insert(tokens, index, paramMap, context, pathErrorCheckOnly) {
+    if (tokens.length === 0) {
+      if (this.#index !== undefined) {
+        throw PATH_ERROR;
+      }
+      if (pathErrorCheckOnly) {
+        return;
+      }
+      this.#index = index;
+      return;
+    }
+    const [token, ...restTokens] = tokens;
+    const pattern = token === "*" ? restTokens.length === 0 ? ["", "", ONLY_WILDCARD_REG_EXP_STR] : ["", "", LABEL_REG_EXP_STR] : token === "/*" ? ["", "", TAIL_WILDCARD_REG_EXP_STR] : token.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
+    let node;
+    if (pattern) {
+      const name = pattern[1];
+      let regexpStr = pattern[2] || LABEL_REG_EXP_STR;
+      if (name && pattern[2]) {
+        if (regexpStr === ".*") {
+          throw PATH_ERROR;
+        }
+        regexpStr = regexpStr.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:");
+        if (/\((?!\?:)/.test(regexpStr)) {
+          throw PATH_ERROR;
+        }
+      }
+      node = this.#children[regexpStr];
+      if (!node) {
+        if (Object.keys(this.#children).some((k) => k !== ONLY_WILDCARD_REG_EXP_STR && k !== TAIL_WILDCARD_REG_EXP_STR)) {
+          throw PATH_ERROR;
+        }
+        if (pathErrorCheckOnly) {
+          return;
+        }
+        node = this.#children[regexpStr] = new _Node;
+        if (name !== "") {
+          node.#varIndex = context.varIndex++;
+        }
+      }
+      if (!pathErrorCheckOnly && name !== "") {
+        paramMap.push([name, node.#varIndex]);
+      }
+    } else {
+      node = this.#children[token];
+      if (!node) {
+        if (Object.keys(this.#children).some((k) => k.length > 1 && k !== ONLY_WILDCARD_REG_EXP_STR && k !== TAIL_WILDCARD_REG_EXP_STR)) {
+          throw PATH_ERROR;
+        }
+        if (pathErrorCheckOnly) {
+          return;
+        }
+        node = this.#children[token] = new _Node;
+      }
+    }
+    node.insert(restTokens, index, paramMap, context, pathErrorCheckOnly);
+  }
+  buildRegExpStr() {
+    const childKeys = Object.keys(this.#children).sort(compareKey);
+    const strList = childKeys.map((k) => {
+      const c = this.#children[k];
+      return (typeof c.#varIndex === "number" ? `(${k})@${c.#varIndex}` : regExpMetaChars.has(k) ? `\\${k}` : k) + c.buildRegExpStr();
+    });
+    if (typeof this.#index === "number") {
+      strList.unshift(`#${this.#index}`);
+    }
+    if (strList.length === 0) {
+      return "";
+    }
+    if (strList.length === 1) {
+      return strList[0];
+    }
+    return "(?:" + strList.join("|") + ")";
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router/reg-exp-router/trie.js
+var Trie = class {
+  #context = { varIndex: 0 };
+  #root = new Node;
+  insert(path, index, pathErrorCheckOnly) {
+    const paramAssoc = [];
+    const groups = [];
+    for (let i = 0;; ) {
+      let replaced = false;
+      path = path.replace(/\{[^}]+\}/g, (m) => {
+        const mark = `@\\${i}`;
+        groups[i] = [mark, m];
+        i++;
+        replaced = true;
+        return mark;
+      });
+      if (!replaced) {
+        break;
+      }
+    }
+    const tokens = path.match(/(?::[^\/]+)|(?:\/\*$)|./g) || [];
+    for (let i = groups.length - 1;i >= 0; i--) {
+      const [mark] = groups[i];
+      for (let j = tokens.length - 1;j >= 0; j--) {
+        if (tokens[j].indexOf(mark) !== -1) {
+          tokens[j] = tokens[j].replace(mark, groups[i][1]);
+          break;
+        }
+      }
+    }
+    this.#root.insert(tokens, index, paramAssoc, this.#context, pathErrorCheckOnly);
+    return paramAssoc;
+  }
+  buildRegExp() {
+    let regexp = this.#root.buildRegExpStr();
+    if (regexp === "") {
+      return [/^$/, [], []];
+    }
+    let captureIndex = 0;
+    const indexReplacementMap = [];
+    const paramReplacementMap = [];
+    regexp = regexp.replace(/#(\d+)|@(\d+)|\.\*\$/g, (_, handlerIndex, paramIndex) => {
+      if (handlerIndex !== undefined) {
+        indexReplacementMap[++captureIndex] = Number(handlerIndex);
+        return "$()";
+      }
+      if (paramIndex !== undefined) {
+        paramReplacementMap[Number(paramIndex)] = ++captureIndex;
+        return "";
+      }
+      return "";
+    });
+    return [new RegExp(`^${regexp}`), indexReplacementMap, paramReplacementMap];
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router/reg-exp-router/router.js
+var nullMatcher = [/^$/, [], /* @__PURE__ */ Object.create(null)];
+var wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
+function buildWildcardRegExp(path) {
+  return wildcardRegExpCache[path] ??= new RegExp(path === "*" ? "" : `^${path.replace(/\/\*$|([.\\+*[^\]$()])/g, (_, metaChar) => metaChar ? `\\${metaChar}` : "(?:|/.*)")}$`);
+}
+function clearWildcardRegExpCache() {
+  wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
+}
+function buildMatcherFromPreprocessedRoutes(routes) {
+  const trie = new Trie;
+  const handlerData = [];
+  if (routes.length === 0) {
+    return nullMatcher;
+  }
+  const routesWithStaticPathFlag = routes.map((route) => [!/\*|\/:/.test(route[0]), ...route]).sort(([isStaticA, pathA], [isStaticB, pathB]) => isStaticA ? 1 : isStaticB ? -1 : pathA.length - pathB.length);
+  const staticMap = /* @__PURE__ */ Object.create(null);
+  for (let i = 0, j = -1, len = routesWithStaticPathFlag.length;i < len; i++) {
+    const [pathErrorCheckOnly, path, handlers] = routesWithStaticPathFlag[i];
+    if (pathErrorCheckOnly) {
+      staticMap[path] = [handlers.map(([h]) => [h, /* @__PURE__ */ Object.create(null)]), emptyParam];
+    } else {
+      j++;
+    }
+    let paramAssoc;
+    try {
+      paramAssoc = trie.insert(path, j, pathErrorCheckOnly);
+    } catch (e) {
+      throw e === PATH_ERROR ? new UnsupportedPathError(path) : e;
+    }
+    if (pathErrorCheckOnly) {
+      continue;
+    }
+    handlerData[j] = handlers.map(([h, paramCount]) => {
+      const paramIndexMap = /* @__PURE__ */ Object.create(null);
+      paramCount -= 1;
+      for (;paramCount >= 0; paramCount--) {
+        const [key, value] = paramAssoc[paramCount];
+        paramIndexMap[key] = value;
+      }
+      return [h, paramIndexMap];
+    });
+  }
+  const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
+  for (let i = 0, len = handlerData.length;i < len; i++) {
+    for (let j = 0, len2 = handlerData[i].length;j < len2; j++) {
+      const map = handlerData[i][j]?.[1];
+      if (!map) {
+        continue;
+      }
+      const keys = Object.keys(map);
+      for (let k = 0, len3 = keys.length;k < len3; k++) {
+        map[keys[k]] = paramReplacementMap[map[keys[k]]];
+      }
+    }
+  }
+  const handlerMap = [];
+  for (const i in indexReplacementMap) {
+    handlerMap[i] = handlerData[indexReplacementMap[i]];
+  }
+  return [regexp, handlerMap, staticMap];
+}
+function findMiddleware(middleware, path) {
+  if (!middleware) {
+    return;
+  }
+  for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
+    if (buildWildcardRegExp(k).test(path)) {
+      return [...middleware[k]];
+    }
+  }
+  return;
+}
+var RegExpRouter = class {
+  name = "RegExpRouter";
+  #middleware;
+  #routes;
+  constructor() {
+    this.#middleware = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
+    this.#routes = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
+  }
+  add(method, path, handler) {
+    const middleware = this.#middleware;
+    const routes = this.#routes;
+    if (!middleware || !routes) {
+      throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
+    }
+    if (!middleware[method]) {
+      [middleware, routes].forEach((handlerMap) => {
+        handlerMap[method] = /* @__PURE__ */ Object.create(null);
+        Object.keys(handlerMap[METHOD_NAME_ALL]).forEach((p) => {
+          handlerMap[method][p] = [...handlerMap[METHOD_NAME_ALL][p]];
+        });
+      });
+    }
+    if (path === "/*") {
+      path = "*";
+    }
+    const paramCount = (path.match(/\/:/g) || []).length;
+    if (/\*$/.test(path)) {
+      const re = buildWildcardRegExp(path);
+      if (method === METHOD_NAME_ALL) {
+        Object.keys(middleware).forEach((m) => {
+          middleware[m][path] ||= findMiddleware(middleware[m], path) || findMiddleware(middleware[METHOD_NAME_ALL], path) || [];
+        });
+      } else {
+        middleware[method][path] ||= findMiddleware(middleware[method], path) || findMiddleware(middleware[METHOD_NAME_ALL], path) || [];
+      }
+      Object.keys(middleware).forEach((m) => {
+        if (method === METHOD_NAME_ALL || method === m) {
+          Object.keys(middleware[m]).forEach((p) => {
+            re.test(p) && middleware[m][p].push([handler, paramCount]);
+          });
+        }
+      });
+      Object.keys(routes).forEach((m) => {
+        if (method === METHOD_NAME_ALL || method === m) {
+          Object.keys(routes[m]).forEach((p) => re.test(p) && routes[m][p].push([handler, paramCount]));
+        }
+      });
+      return;
+    }
+    const paths = checkOptionalParameter(path) || [path];
+    for (let i = 0, len = paths.length;i < len; i++) {
+      const path2 = paths[i];
+      Object.keys(routes).forEach((m) => {
+        if (method === METHOD_NAME_ALL || method === m) {
+          routes[m][path2] ||= [
+            ...findMiddleware(middleware[m], path2) || findMiddleware(middleware[METHOD_NAME_ALL], path2) || []
+          ];
+          routes[m][path2].push([handler, paramCount - len + i + 1]);
+        }
+      });
+    }
+  }
+  match = match;
+  buildAllMatchers() {
+    const matchers = /* @__PURE__ */ Object.create(null);
+    Object.keys(this.#routes).concat(Object.keys(this.#middleware)).forEach((method) => {
+      matchers[method] ||= this.#buildMatcher(method);
+    });
+    this.#middleware = this.#routes = undefined;
+    clearWildcardRegExpCache();
+    return matchers;
+  }
+  #buildMatcher(method) {
+    const routes = [];
+    let hasOwnRoute = method === METHOD_NAME_ALL;
+    [this.#middleware, this.#routes].forEach((r) => {
+      const ownRoute = r[method] ? Object.keys(r[method]).map((path) => [path, r[method][path]]) : [];
+      if (ownRoute.length !== 0) {
+        hasOwnRoute ||= true;
+        routes.push(...ownRoute);
+      } else if (method !== METHOD_NAME_ALL) {
+        routes.push(...Object.keys(r[METHOD_NAME_ALL]).map((path) => [path, r[METHOD_NAME_ALL][path]]));
+      }
+    });
+    if (!hasOwnRoute) {
+      return null;
+    } else {
+      return buildMatcherFromPreprocessedRoutes(routes);
+    }
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
+var PreparedRegExpRouter = class {
+  name = "PreparedRegExpRouter";
+  #matchers;
+  #relocateMap;
+  constructor(matchers, relocateMap) {
+    this.#matchers = matchers;
+    this.#relocateMap = relocateMap;
+  }
+  #addWildcard(method, handlerData) {
+    const matcher = this.#matchers[method];
+    matcher[1].forEach((list) => list && list.push(handlerData));
+    Object.values(matcher[2]).forEach((list) => list[0].push(handlerData));
+  }
+  #addPath(method, path, handler, indexes, map) {
+    const matcher = this.#matchers[method];
+    if (!map) {
+      matcher[2][path][0].push([handler, {}]);
+    } else {
+      indexes.forEach((index) => {
+        if (typeof index === "number") {
+          matcher[1][index].push([handler, map]);
+        } else {
+          matcher[2][index || path][0].push([handler, map]);
+        }
+      });
+    }
+  }
+  add(method, path, handler) {
+    if (!this.#matchers[method]) {
+      const all = this.#matchers[METHOD_NAME_ALL];
+      const staticMap = {};
+      for (const key in all[2]) {
+        staticMap[key] = [all[2][key][0].slice(), emptyParam];
+      }
+      this.#matchers[method] = [
+        all[0],
+        all[1].map((list) => Array.isArray(list) ? list.slice() : 0),
+        staticMap
+      ];
+    }
+    if (path === "/*" || path === "*") {
+      const handlerData = [handler, {}];
+      if (method === METHOD_NAME_ALL) {
+        for (const m in this.#matchers) {
+          this.#addWildcard(m, handlerData);
+        }
+      } else {
+        this.#addWildcard(method, handlerData);
+      }
+      return;
+    }
+    const data = this.#relocateMap[path];
+    if (!data) {
+      throw new Error(`Path ${path} is not registered`);
+    }
+    for (const [indexes, map] of data) {
+      if (method === METHOD_NAME_ALL) {
+        for (const m in this.#matchers) {
+          this.#addPath(m, path, handler, indexes, map);
+        }
+      } else {
+        this.#addPath(method, path, handler, indexes, map);
+      }
+    }
+  }
+  buildAllMatchers() {
+    return this.#matchers;
+  }
+  match = match;
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router/smart-router/router.js
+var SmartRouter = class {
+  name = "SmartRouter";
+  #routers = [];
+  #routes = [];
+  constructor(init) {
+    this.#routers = init.routers;
+  }
+  add(method, path, handler) {
+    if (!this.#routes) {
+      throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
+    }
+    this.#routes.push([method, path, handler]);
+  }
+  match(method, path) {
+    if (!this.#routes) {
+      throw new Error("Fatal error");
+    }
+    const routers = this.#routers;
+    const routes = this.#routes;
+    const len = routers.length;
+    let i = 0;
+    let res;
+    for (;i < len; i++) {
+      const router = routers[i];
+      try {
+        for (let i2 = 0, len2 = routes.length;i2 < len2; i2++) {
+          router.add(...routes[i2]);
+        }
+        res = router.match(method, path);
+      } catch (e) {
+        if (e instanceof UnsupportedPathError) {
+          continue;
+        }
+        throw e;
+      }
+      this.match = router.match.bind(router);
+      this.#routers = [router];
+      this.#routes = undefined;
+      break;
+    }
+    if (i === len) {
+      throw new Error("Fatal error");
+    }
+    this.name = `SmartRouter + ${this.activeRouter.name}`;
+    return res;
+  }
+  get activeRouter() {
+    if (this.#routes || this.#routers.length !== 1) {
+      throw new Error("No active router has been determined yet.");
+    }
+    return this.#routers[0];
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router/trie-router/node.js
+var emptyParams = /* @__PURE__ */ Object.create(null);
+var hasChildren = (children) => {
+  for (const _ in children) {
+    return true;
+  }
+  return false;
+};
+var Node2 = class _Node2 {
+  #methods;
+  #children;
+  #patterns;
+  #order = 0;
+  #params = emptyParams;
+  constructor(method, handler, children) {
+    this.#children = children || /* @__PURE__ */ Object.create(null);
+    this.#methods = [];
+    if (method && handler) {
+      const m = /* @__PURE__ */ Object.create(null);
+      m[method] = { handler, possibleKeys: [], score: 0 };
+      this.#methods = [m];
+    }
+    this.#patterns = [];
+  }
+  insert(method, path, handler) {
+    this.#order = ++this.#order;
+    let curNode = this;
+    const parts = splitRoutingPath(path);
+    const possibleKeys = [];
+    for (let i = 0, len = parts.length;i < len; i++) {
+      const p = parts[i];
+      const nextP = parts[i + 1];
+      const pattern = getPattern(p, nextP);
+      const key = Array.isArray(pattern) ? pattern[0] : p;
+      if (key in curNode.#children) {
+        curNode = curNode.#children[key];
+        if (pattern) {
+          possibleKeys.push(pattern[1]);
+        }
+        continue;
+      }
+      curNode.#children[key] = new _Node2;
+      if (pattern) {
+        curNode.#patterns.push(pattern);
+        possibleKeys.push(pattern[1]);
+      }
+      curNode = curNode.#children[key];
+    }
+    curNode.#methods.push({
+      [method]: {
+        handler,
+        possibleKeys: possibleKeys.filter((v, i, a) => a.indexOf(v) === i),
+        score: this.#order
+      }
+    });
+    return curNode;
+  }
+  #pushHandlerSets(handlerSets, node, method, nodeParams, params) {
+    for (let i = 0, len = node.#methods.length;i < len; i++) {
+      const m = node.#methods[i];
+      const handlerSet = m[method] || m[METHOD_NAME_ALL];
+      const processedSet = {};
+      if (handlerSet !== undefined) {
+        handlerSet.params = /* @__PURE__ */ Object.create(null);
+        handlerSets.push(handlerSet);
+        if (nodeParams !== emptyParams || params && params !== emptyParams) {
+          for (let i2 = 0, len2 = handlerSet.possibleKeys.length;i2 < len2; i2++) {
+            const key = handlerSet.possibleKeys[i2];
+            const processed = processedSet[handlerSet.score];
+            handlerSet.params[key] = params?.[key] && !processed ? params[key] : nodeParams[key] ?? params?.[key];
+            processedSet[handlerSet.score] = true;
+          }
+        }
+      }
+    }
+  }
+  search(method, path) {
+    const handlerSets = [];
+    this.#params = emptyParams;
+    const curNode = this;
+    let curNodes = [curNode];
+    const parts = splitPath(path);
+    const curNodesQueue = [];
+    const len = parts.length;
+    let partOffsets = null;
+    for (let i = 0;i < len; i++) {
+      const part = parts[i];
+      const isLast = i === len - 1;
+      const tempNodes = [];
+      for (let j = 0, len2 = curNodes.length;j < len2; j++) {
+        const node = curNodes[j];
+        const nextNode = node.#children[part];
+        if (nextNode) {
+          nextNode.#params = node.#params;
+          if (isLast) {
+            if (nextNode.#children["*"]) {
+              this.#pushHandlerSets(handlerSets, nextNode.#children["*"], method, node.#params);
+            }
+            this.#pushHandlerSets(handlerSets, nextNode, method, node.#params);
+          } else {
+            tempNodes.push(nextNode);
+          }
+        }
+        for (let k = 0, len3 = node.#patterns.length;k < len3; k++) {
+          const pattern = node.#patterns[k];
+          const params = node.#params === emptyParams ? {} : { ...node.#params };
+          if (pattern === "*") {
+            const astNode = node.#children["*"];
+            if (astNode) {
+              this.#pushHandlerSets(handlerSets, astNode, method, node.#params);
+              astNode.#params = params;
+              tempNodes.push(astNode);
+            }
+            continue;
+          }
+          const [key, name, matcher] = pattern;
+          if (!part && !(matcher instanceof RegExp)) {
+            continue;
+          }
+          const child = node.#children[key];
+          if (matcher instanceof RegExp) {
+            if (partOffsets === null) {
+              partOffsets = new Array(len);
+              let offset = path[0] === "/" ? 1 : 0;
+              for (let p = 0;p < len; p++) {
+                partOffsets[p] = offset;
+                offset += parts[p].length + 1;
+              }
+            }
+            const restPathString = path.substring(partOffsets[i]);
+            const m = matcher.exec(restPathString);
+            if (m) {
+              params[name] = m[0];
+              this.#pushHandlerSets(handlerSets, child, method, node.#params, params);
+              if (hasChildren(child.#children)) {
+                child.#params = params;
+                const componentCount = m[0].match(/\//)?.length ?? 0;
+                const targetCurNodes = curNodesQueue[componentCount] ||= [];
+                targetCurNodes.push(child);
+              }
+              continue;
+            }
+          }
+          if (matcher === true || matcher.test(part)) {
+            params[name] = part;
+            if (isLast) {
+              this.#pushHandlerSets(handlerSets, child, method, params, node.#params);
+              if (child.#children["*"]) {
+                this.#pushHandlerSets(handlerSets, child.#children["*"], method, params, node.#params);
+              }
+            } else {
+              child.#params = params;
+              tempNodes.push(child);
+            }
+          }
+        }
+      }
+      const shifted = curNodesQueue.shift();
+      curNodes = shifted ? tempNodes.concat(shifted) : tempNodes;
+    }
+    if (handlerSets.length > 1) {
+      handlerSets.sort((a, b) => {
+        return a.score - b.score;
+      });
+    }
+    return [handlerSets.map(({ handler, params }) => [handler, params])];
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/router/trie-router/router.js
+var TrieRouter = class {
+  name = "TrieRouter";
+  #node;
+  constructor() {
+    this.#node = new Node2;
+  }
+  add(method, path, handler) {
+    const results = checkOptionalParameter(path);
+    if (results) {
+      for (let i = 0, len = results.length;i < len; i++) {
+        this.#node.insert(method, results[i], handler);
+      }
+      return;
+    }
+    this.#node.insert(method, path, handler);
+  }
+  match(method, path) {
+    return this.#node.search(method, path);
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/hono.js
+var Hono2 = class extends Hono {
+  constructor(options = {}) {
+    super(options);
+    this.router = options.router ?? new SmartRouter({
+      routers: [new RegExpRouter, new TrieRouter]
+    });
+  }
+};
+
+// ../../node_modules/.bun/hono@4.12.10/node_modules/hono/dist/middleware/cors/index.js
+var cors = (options) => {
+  const defaults = {
+    origin: "*",
+    allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"],
+    allowHeaders: [],
+    exposeHeaders: []
+  };
+  const opts = {
+    ...defaults,
+    ...options
+  };
+  const findAllowOrigin = ((optsOrigin) => {
+    if (typeof optsOrigin === "string") {
+      if (optsOrigin === "*") {
+        if (opts.credentials) {
+          return (origin) => origin || null;
+        }
+        return () => optsOrigin;
+      } else {
+        return (origin) => optsOrigin === origin ? origin : null;
+      }
+    } else if (typeof optsOrigin === "function") {
+      return optsOrigin;
+    } else {
+      return (origin) => optsOrigin.includes(origin) ? origin : null;
+    }
+  })(opts.origin);
+  const findAllowMethods = ((optsAllowMethods) => {
+    if (typeof optsAllowMethods === "function") {
+      return optsAllowMethods;
+    } else if (Array.isArray(optsAllowMethods)) {
+      return () => optsAllowMethods;
+    } else {
+      return () => [];
+    }
+  })(opts.allowMethods);
+  return async function cors2(c, next) {
+    function set(key, value) {
+      c.res.headers.set(key, value);
+    }
+    const allowOrigin = await findAllowOrigin(c.req.header("origin") || "", c);
+    if (allowOrigin) {
+      set("Access-Control-Allow-Origin", allowOrigin);
+    }
+    if (opts.credentials) {
+      set("Access-Control-Allow-Credentials", "true");
+    }
+    if (opts.exposeHeaders?.length) {
+      set("Access-Control-Expose-Headers", opts.exposeHeaders.join(","));
+    }
+    if (c.req.method === "OPTIONS") {
+      if (opts.origin !== "*" || opts.credentials) {
+        set("Vary", "Origin");
+      }
+      if (opts.maxAge != null) {
+        set("Access-Control-Max-Age", opts.maxAge.toString());
+      }
+      const allowMethods = await findAllowMethods(c.req.header("origin") || "", c);
+      if (allowMethods.length) {
+        set("Access-Control-Allow-Methods", allowMethods.join(","));
+      }
+      let headers = opts.allowHeaders;
+      if (!headers?.length) {
+        const requestHeaders = c.req.header("Access-Control-Request-Headers");
+        if (requestHeaders) {
+          headers = requestHeaders.split(/\s*,\s*/);
+        }
+      }
+      if (headers?.length) {
+        set("Access-Control-Allow-Headers", headers.join(","));
+        c.res.headers.append("Vary", "Access-Control-Request-Headers");
+      }
+      c.res.headers.delete("Content-Length");
+      c.res.headers.delete("Content-Type");
+      return new Response(null, {
+        headers: c.res.headers,
+        status: 204,
+        statusText: "No Content"
+      });
+    }
+    await next();
+    if (opts.origin !== "*" || opts.credentials) {
+      c.header("Vary", "Origin", { append: true });
+    }
+  };
+};
+
+// ../ops-harbor-control-plane/src/lib/db.ts
+import { mkdirSync } from "fs";
+import { dirname as dirname2 } from "path";
+function toIso(date = new Date) {
+  return date.toISOString();
+}
+function ensureColumn(db, table, column, definition) {
+  const columns = db.prepare(`PRAGMA table_info(${table})`).all().map((entry) => entry.name);
+  if (!columns.includes(column)) {
+    db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+  }
+}
+function assembleWorkItem(row, checks, reviews) {
+  return {
+    id: row.id,
+    provider: row.provider,
+    kind: row.kind,
+    repository: row.repository,
+    number: row.number,
+    title: row.title,
+    url: row.url,
+    state: row.state,
+    author: row.author,
+    isDraft: row.is_draft === 1,
+    headBranch: row.head_branch,
+    headSha: row.head_sha,
+    baseBranch: row.base_branch,
+    mergeable: row.mergeable,
+    mergeStateStatus: row.merge_state_status,
+    reviewDecision: row.review_decision,
+    statusSummary: parseJson(row.status_summary_json, {
+      overall: "unknown",
+      checkState: "unknown",
+      reviewState: "none",
+      mergeState: "unknown"
+    }),
+    alerts: parseJson(row.alerts_json, []),
+    checks,
+    reviews,
+    lastActivityAt: row.last_activity_at,
+    updatedAt: row.updated_at,
+    ...row.provider_payload_json ? { providerPayload: parseJson(row.provider_payload_json, {}) } : {}
+  };
+}
+function fromRow(row, db) {
+  const checks = db.prepare(`SELECT work_item_id, name, status, conclusion, url, started_at, completed_at
+       FROM work_item_checks
+       WHERE work_item_id = ?
+       ORDER BY rowid ASC`).all(row.id).map((check) => ({
+    name: check.name,
+    status: check.status,
+    conclusion: check.conclusion,
+    url: check.url,
+    startedAt: check.started_at,
+    completedAt: check.completed_at
+  }));
+  const reviews = db.prepare(`SELECT work_item_id, id, state, author, submitted_at, body_snippet, url
+       FROM work_item_reviews
+       WHERE work_item_id = ?
+       ORDER BY submitted_at DESC`).all(row.id).map((review) => {
+    const itemReview = {
+      id: review.id,
+      state: review.state,
+      author: review.author,
+      submittedAt: review.submitted_at
+    };
+    if (review.body_snippet) {
+      itemReview.bodySnippet = review.body_snippet;
+    }
+    if (review.url) {
+      itemReview.url = review.url;
+    }
+    return itemReview;
+  });
+  return assembleWorkItem(row, checks, reviews);
+}
+var CHUNK_SIZE = 500;
+function buildWorkItemsFromRows(db, rows) {
+  if (rows.length === 0)
+    return [];
+  const ids = rows.map((r) => r.id);
+  const allCheckRows = [];
+  const allReviewRows = [];
+  for (let i = 0;i < ids.length; i += CHUNK_SIZE) {
+    const chunk = ids.slice(i, i + CHUNK_SIZE);
+    const placeholders = chunk.map(() => "?").join(", ");
+    allCheckRows.push(...db.prepare(`SELECT work_item_id, name, status, conclusion, url, started_at, completed_at
+           FROM work_item_checks
+           WHERE work_item_id IN (${placeholders})
+           ORDER BY rowid ASC`).all(...chunk));
+    allReviewRows.push(...db.prepare(`SELECT work_item_id, id, state, author, submitted_at, body_snippet, url
+           FROM work_item_reviews
+           WHERE work_item_id IN (${placeholders})
+           ORDER BY submitted_at DESC`).all(...chunk));
+  }
+  const checksByItemId = new Map;
+  for (const check of allCheckRows) {
+    const list = checksByItemId.get(check.work_item_id) ?? [];
+    list.push({
+      name: check.name,
+      status: check.status,
+      conclusion: check.conclusion,
+      url: check.url,
+      startedAt: check.started_at,
+      completedAt: check.completed_at
+    });
+    checksByItemId.set(check.work_item_id, list);
+  }
+  const reviewsByItemId = new Map;
+  for (const review of allReviewRows) {
+    const list = reviewsByItemId.get(review.work_item_id) ?? [];
+    const itemReview = {
+      id: review.id,
+      state: review.state,
+      author: review.author,
+      submittedAt: review.submitted_at
+    };
+    if (review.body_snippet) {
+      itemReview.bodySnippet = review.body_snippet;
+    }
+    if (review.url) {
+      itemReview.url = review.url;
+    }
+    list.push(itemReview);
+    reviewsByItemId.set(review.work_item_id, list);
+  }
+  return rows.map((row) => assembleWorkItem(row, checksByItemId.get(row.id) ?? [], reviewsByItemId.get(row.id) ?? []));
+}
+function activityFromRow(row) {
+  return {
+    id: row.id,
+    repository: row.repository,
+    type: row.type,
+    title: row.title,
+    message: row.message,
+    createdAt: row.created_at,
+    ...row.work_item_id ? { workItemId: row.work_item_id } : {},
+    ...row.url ? { url: row.url } : {},
+    ...row.payload_json ? { payload: parseJson(row.payload_json, {}) } : {}
+  };
+}
+function jobFromRow(row) {
+  return {
+    id: row.id,
+    workItemId: row.work_item_id,
+    repository: row.repository,
+    triggerType: row.trigger_type,
+    status: row.status,
+    prompt: row.prompt,
+    leaseOwner: row.lease_owner,
+    leaseExpiresAt: row.lease_expires_at,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    resultSummary: row.result_summary
+  };
+}
+function openControlPlaneDb(dbPath) {
+  mkdirSync(dirname2(dbPath), { recursive: true });
+  const db = openSqliteDatabase(dbPath);
+  ensureSchema(db);
+  return db;
+}
+function ensureSchema(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS providers (
+      provider TEXT PRIMARY KEY,
+      settings_json TEXT,
+      created_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS installations (
+      installation_id INTEGER PRIMARY KEY,
+      provider TEXT NOT NULL,
+      account_login TEXT,
+      account_type TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS repositories (
+      repository TEXT PRIMARY KEY,
+      installation_id INTEGER,
+      url TEXT,
+      default_branch TEXT,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS work_items (
+      id TEXT PRIMARY KEY,
+      provider TEXT NOT NULL,
+      kind TEXT NOT NULL,
+      repository TEXT NOT NULL,
+      number INTEGER NOT NULL,
+      title TEXT NOT NULL,
+      url TEXT NOT NULL,
+      state TEXT NOT NULL,
+      author TEXT NOT NULL,
+      is_draft INTEGER NOT NULL,
+      head_branch TEXT NOT NULL,
+      head_sha TEXT NOT NULL,
+      base_branch TEXT NOT NULL,
+      mergeable TEXT NOT NULL,
+      merge_state_status TEXT NOT NULL,
+      review_decision TEXT,
+      status_summary_json TEXT NOT NULL,
+      alerts_json TEXT NOT NULL,
+      last_activity_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      provider_payload_json TEXT
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_work_items_repo_number
+      ON work_items(repository, number);
+
+    CREATE TABLE IF NOT EXISTS work_item_checks (
+      work_item_id TEXT NOT NULL,
+      name TEXT NOT NULL,
+      status TEXT NOT NULL,
+      conclusion TEXT,
+      url TEXT,
+      started_at TEXT,
+      completed_at TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_work_item_checks_work_item
+      ON work_item_checks(work_item_id);
+
+    CREATE TABLE IF NOT EXISTS work_item_reviews (
+      work_item_id TEXT NOT NULL,
+      id TEXT NOT NULL,
+      state TEXT NOT NULL,
+      author TEXT NOT NULL,
+      submitted_at TEXT NOT NULL,
+      body_snippet TEXT,
+      url TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_work_item_reviews_work_item
+      ON work_item_reviews(work_item_id);
+
+    CREATE TABLE IF NOT EXISTS work_item_events (
+      id TEXT PRIMARY KEY,
+      work_item_id TEXT,
+      repository TEXT NOT NULL,
+      type TEXT NOT NULL,
+      title TEXT NOT NULL,
+      message TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      url TEXT,
+      payload_json TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_work_item_events_lookup
+      ON work_item_events(work_item_id, created_at DESC);
+
+    CREATE TABLE IF NOT EXISTS automation_jobs (
+      id TEXT PRIMARY KEY,
+      work_item_id TEXT NOT NULL,
+      repository TEXT NOT NULL,
+      trigger_type TEXT NOT NULL,
+      status TEXT NOT NULL,
+      prompt TEXT NOT NULL,
+      lease_owner TEXT,
+      lease_expires_at TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      result_summary TEXT
+    );
+    CREATE INDEX IF NOT EXISTS idx_automation_jobs_status
+      ON automation_jobs(status, created_at);
+
+    CREATE TABLE IF NOT EXISTS webhook_deliveries (
+      delivery_id TEXT PRIMARY KEY,
+      event_name TEXT NOT NULL,
+      received_at TEXT NOT NULL,
+      payload_json TEXT NOT NULL,
+      processed_at TEXT
+    );
+
+    CREATE TABLE IF NOT EXISTS rate_limit_snapshots (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      provider TEXT NOT NULL,
+      scope TEXT NOT NULL,
+      remaining INTEGER,
+      reset_at TEXT,
+      recorded_at TEXT NOT NULL
+    );
+  `);
+  const now = toIso();
+  db.prepare(`INSERT OR IGNORE INTO providers (provider, settings_json, created_at) VALUES (?, ?, ?)`).run("github", "{}", now);
+  ensureColumn(db, "webhook_deliveries", "processed_at", "TEXT");
+}
+function isWebhookDeliveryProcessed(db, deliveryId) {
+  const row = db.prepare(`SELECT processed_at FROM webhook_deliveries WHERE delivery_id = ?`).get(deliveryId);
+  return row?.processed_at != null;
+}
+function recordWebhookDeliveryReceived(db, deliveryId, eventName, payload) {
+  db.prepare(`INSERT INTO webhook_deliveries (delivery_id, event_name, received_at, payload_json, processed_at)
+     VALUES (?, ?, ?, ?, NULL)
+     ON CONFLICT(delivery_id) DO UPDATE SET
+       event_name = excluded.event_name,
+       received_at = excluded.received_at,
+       payload_json = excluded.payload_json
+     WHERE webhook_deliveries.processed_at IS NULL`).run(deliveryId, eventName, toIso(), JSON.stringify(payload));
+}
+function markWebhookDeliveryProcessed(db, deliveryId) {
+  db.prepare(`UPDATE webhook_deliveries
+     SET processed_at = ?
+     WHERE delivery_id = ?`).run(toIso(), deliveryId);
+}
+function upsertInstallation(db, installationId, accountLogin, accountType) {
+  const now = toIso();
+  db.prepare(`INSERT INTO installations (installation_id, provider, account_login, account_type, created_at, updated_at)
+     VALUES (?, 'github', ?, ?, ?, ?)
+     ON CONFLICT(installation_id) DO UPDATE SET
+       account_login = excluded.account_login,
+       account_type = excluded.account_type,
+       updated_at = excluded.updated_at`).run(installationId, accountLogin ?? null, accountType ?? null, now, now);
+}
+function upsertRepository(db, repository, installationId, url, defaultBranch) {
+  db.prepare(`INSERT INTO repositories (repository, installation_id, url, default_branch, updated_at)
+     VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT(repository) DO UPDATE SET
+       installation_id = excluded.installation_id,
+       url = excluded.url,
+       default_branch = excluded.default_branch,
+       updated_at = excluded.updated_at`).run(repository, installationId, url, defaultBranch, toIso());
+}
+function upsertWorkItem(db, workItem) {
+  const tx = db.transaction(() => {
+    upsertRepository(db, workItem.repository, Number(workItem.providerPayload?.installationId ?? 0) || null, typeof workItem.providerPayload?.repositoryUrl === "string" ? workItem.providerPayload.repositoryUrl : workItem.url, workItem.baseBranch);
+    db.prepare(`INSERT INTO work_items (
+         id, provider, kind, repository, number, title, url, state, author, is_draft,
+         head_branch, head_sha, base_branch, mergeable, merge_state_status, review_decision,
+         status_summary_json, alerts_json, last_activity_at, updated_at, provider_payload_json
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET
+         title = excluded.title,
+         url = excluded.url,
+         state = excluded.state,
+         author = excluded.author,
+         is_draft = excluded.is_draft,
+         head_branch = excluded.head_branch,
+         head_sha = excluded.head_sha,
+         base_branch = excluded.base_branch,
+         mergeable = excluded.mergeable,
+         merge_state_status = excluded.merge_state_status,
+         review_decision = excluded.review_decision,
+         status_summary_json = excluded.status_summary_json,
+         alerts_json = excluded.alerts_json,
+         last_activity_at = excluded.last_activity_at,
+         updated_at = excluded.updated_at,
+         provider_payload_json = excluded.provider_payload_json`).run(workItem.id, workItem.provider, workItem.kind, workItem.repository, workItem.number, workItem.title, workItem.url, workItem.state, workItem.author, workItem.isDraft ? 1 : 0, workItem.headBranch, workItem.headSha, workItem.baseBranch, workItem.mergeable, workItem.mergeStateStatus, workItem.reviewDecision, JSON.stringify(workItem.statusSummary), JSON.stringify(workItem.alerts), workItem.lastActivityAt, workItem.updatedAt, JSON.stringify(workItem.providerPayload ?? {}));
+    db.prepare(`DELETE FROM work_item_checks WHERE work_item_id = ?`).run(workItem.id);
+    const insertCheckStmt = db.prepare(`INSERT INTO work_item_checks (
+         work_item_id, name, status, conclusion, url, started_at, completed_at
+       ) VALUES (?, ?, ?, ?, ?, ?, ?)`);
+    for (const check of workItem.checks) {
+      insertCheckStmt.run(workItem.id, check.name, check.status, check.conclusion, check.url ?? null, check.startedAt ?? null, check.completedAt ?? null);
+    }
+    db.prepare(`DELETE FROM work_item_reviews WHERE work_item_id = ?`).run(workItem.id);
+    const insertReviewStmt = db.prepare(`INSERT INTO work_item_reviews (
+         work_item_id, id, state, author, submitted_at, body_snippet, url
+       ) VALUES (?, ?, ?, ?, ?, ?, ?)`);
+    for (const review of workItem.reviews) {
+      insertReviewStmt.run(workItem.id, review.id, review.state, review.author, review.submittedAt, review.bodySnippet ?? null, review.url ?? null);
+    }
+  });
+  tx();
+}
+function insertActivityEvent(db, event) {
+  db.prepare(`INSERT OR REPLACE INTO work_item_events (
+       id, work_item_id, repository, type, title, message, created_at, url, payload_json
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.id, event.workItemId ?? null, event.repository, event.type, event.title, event.message, event.createdAt, event.url ?? null, JSON.stringify(event.payload ?? {}));
+}
+function listActivity(db, options = {}) {
+  const { where, params } = buildActivityWhereClause(options);
+  const limit = options.limit ?? 50;
+  const rows = db.prepare(`SELECT * FROM work_item_events ${where} ORDER BY created_at DESC LIMIT ?`).all(...params, limit);
+  return rows.map(activityFromRow);
+}
+function getWorkItem(db, id) {
+  const row = db.prepare(`SELECT * FROM work_items WHERE id = ?`).get(id);
+  return row ? fromRow(row, db) : null;
+}
+function listWorkItems(db, filter = {}) {
+  const clauses = [];
+  const params = [];
+  if (filter.state) {
+    clauses.push("state = ?");
+    params.push(filter.state);
+  }
+  if (filter.repository) {
+    clauses.push("repository = ?");
+    params.push(filter.repository);
+  }
+  if (filter.updatedSince) {
+    clauses.push("updated_at >= ?");
+    params.push(filter.updatedSince);
+  }
+  const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
+  const rows = db.prepare(`SELECT * FROM work_items ${where} ORDER BY updated_at DESC`).all(...params);
+  const items = buildWorkItemsFromRows(db, rows);
+  if (filter.hasBlocker !== undefined) {
+    return filterWorkItems(items, { hasBlocker: filter.hasBlocker });
+  }
+  return items;
+}
+function listAlerts(db) {
+  return mapWorkItemsToAlertSummaries(listWorkItems(db, { hasBlocker: true }));
+}
+function recordRateLimit(db, scope, snapshot) {
+  db.prepare(`INSERT INTO rate_limit_snapshots (provider, scope, remaining, reset_at, recorded_at)
+     VALUES ('github', ?, ?, ?, ?)`).run(scope, snapshot.remaining ?? null, snapshot.resetAt ?? null, toIso());
+}
+function hasRecentJob(db, workItemId, triggerType, createdAfter) {
+  const row = db.prepare(`SELECT status FROM automation_jobs
+       WHERE work_item_id = ? AND trigger_type = ? AND created_at >= ?
+       ORDER BY created_at DESC
+       LIMIT 1`).get(workItemId, triggerType, createdAfter);
+  return Boolean(row);
+}
+function enqueueJobsForAlerts(db, workItem) {
+  const queued = [];
+  const threshold = new Date(Date.now() - 4 * 60 * 60 * 1000).toISOString();
+  for (const alert of workItem.alerts) {
+    if (hasRecentJob(db, workItem.id, alert.type, threshold)) {
+      continue;
+    }
+    const now = toIso();
+    const job = {
+      id: `${workItem.id}:${alert.type}:${Date.now().toString(36)}`,
+      workItemId: workItem.id,
+      repository: workItem.repository,
+      triggerType: alert.type,
+      status: "pending",
+      prompt: buildAutomationPrompt(workItem, alert.type),
+      createdAt: now,
+      updatedAt: now
+    };
+    db.prepare(`INSERT INTO automation_jobs (
+         id, work_item_id, repository, trigger_type, status, prompt, created_at, updated_at
+       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(job.id, job.workItemId, job.repository, job.triggerType, job.status, job.prompt, job.createdAt, job.updatedAt);
+    queued.push(job);
+  }
+  return queued;
+}
+function leaseNextAutomationJob(db, leaseOwner, leaseTtlMs = 5 * 60 * 1000) {
+  const now = new Date;
+  const nowIso = now.toISOString();
+  const leasedAt = new Date(now.getTime() + leaseTtlMs).toISOString();
+  const leasedRow = db.transaction(() => {
+    const jobRow = db.prepare(`SELECT * FROM automation_jobs
+         WHERE status = 'pending'
+           OR (status = 'leased' AND (lease_expires_at IS NULL OR lease_expires_at < ?))
+         ORDER BY created_at ASC
+         LIMIT 1`).get(nowIso);
+    if (!jobRow)
+      return null;
+    const result = db.prepare(`UPDATE automation_jobs
+         SET status = 'leased', lease_owner = ?, lease_expires_at = ?, updated_at = ?
+         WHERE id = ?
+           AND (
+             status = 'pending'
+             OR (status = 'leased' AND (lease_expires_at IS NULL OR lease_expires_at < ?))
+           )`).run(leaseOwner, leasedAt, nowIso, jobRow.id, nowIso);
+    if (result.changes !== 1)
+      return null;
+    return db.prepare(`SELECT * FROM automation_jobs WHERE id = ?`).get(jobRow.id);
+  })();
+  if (!leasedRow)
+    return null;
+  const workItem = getWorkItem(db, leasedRow.work_item_id);
+  if (!workItem) {
+    return null;
+  }
+  return {
+    job: jobFromRow(leasedRow),
+    workItem
+  };
+}
+function completeAutomationJob(db, jobId, status, resultSummary) {
+  db.prepare(`UPDATE automation_jobs
+     SET status = ?, result_summary = ?, lease_owner = NULL, lease_expires_at = NULL, updated_at = ?
+     WHERE id = ?`).run(status, resultSummary ?? null, toIso(), jobId);
+}
+function listAutomationJobs(db, limit = 100) {
+  const rows = db.prepare(`SELECT * FROM automation_jobs ORDER BY updated_at DESC LIMIT ?`).all(limit);
+  return rows.map(jobFromRow);
+}
+
+// ../ops-harbor-control-plane/src/lib/sync.ts
+import { randomUUID } from "crypto";
+function createEvent(repository, options) {
+  return {
+    id: randomUUID(),
+    repository,
+    type: options.type,
+    title: options.title,
+    message: options.message,
+    ...options.workItemId ? { workItemId: options.workItemId } : {},
+    ...options.url ? { url: options.url } : {},
+    ...options.payload ? { payload: options.payload } : {},
+    createdAt: options.createdAt ?? new Date().toISOString()
+  };
+}
+function hasWorkItemChanged(existing, incoming) {
+  if (!existing)
+    return true;
+  return existing.updatedAt !== incoming.updatedAt || existing.headSha !== incoming.headSha;
+}
+async function saveHydratedWorkItem(db, item, event) {
+  const persistedEvent = event ? {
+    ...event,
+    workItemId: event.workItemId ?? item.id
+  } : undefined;
+  if (persistedEvent) {
+    insertActivityEvent(db, persistedEvent);
+  }
+  const recentEvents = listActivity(db, { workItemId: item.id, limit: 20 });
+  const snapshot = deriveAlerts(item, recentEvents);
+  const enriched = { ...item, alerts: snapshot.alerts };
+  upsertWorkItem(db, enriched);
+  enqueueJobsForAlerts(db, enriched);
+}
+async function syncAuthorWorkItems(db, config, author) {
+  const { installations, rateLimit } = await listInstallations(config);
+  recordRateLimit(db, "app.installations", rateLimit);
+  let synchronized = 0;
+  let changed = 0;
+  for (const installation of installations) {
+    upsertInstallation(db, installation.id, installation.account?.login, installation.account?.type);
+    const { items, rateLimit: searchRateLimit } = await fetchOpenPullRequestsForAuthor(config, installation.id, author);
+    recordRateLimit(db, `installation.${installation.id}.search`, searchRateLimit);
+    for (const item of items) {
+      const existing = getWorkItem(db, item.id);
+      const itemChanged = hasWorkItemChanged(existing, item);
+      const event = itemChanged ? createEvent(item.repository, {
+        workItemId: item.id,
+        type: "synchronized",
+        title: "Work item synchronized",
+        message: `Synchronized ${item.repository}#${item.number}.`,
+        url: item.url
+      }) : undefined;
+      await saveHydratedWorkItem(db, item, event);
+      synchronized++;
+      if (itemChanged)
+        changed++;
+    }
+  }
+  return { author, synchronized, changed, installations: installations.length };
+}
+function mapReviewStateToTrigger(state) {
+  if (state === "COMMENTED")
+    return "review_commented";
+  if (state === "CHANGES_REQUESTED")
+    return "review_changes_requested";
+  return null;
+}
+async function hydrateAndPersist(db, config, installationId, repository, number2, event) {
+  const { item, rateLimit } = await hydratePullRequest(config, installationId, repository, number2);
+  recordRateLimit(db, `installation.${installationId}.hydrate`, rateLimit);
+  if (!item)
+    return;
+  await saveHydratedWorkItem(db, item, event);
+}
+async function handleWebhookEvent(db, config, eventName, payload) {
+  const installationId = payload.installation?.id;
+  const repository = payload.repository?.full_name;
+  if (!installationId || !repository)
+    return;
+  upsertInstallation(db, installationId, payload.installation?.account?.login, payload.installation?.account?.type);
+  if (eventName === "pull_request") {
+    const number2 = payload.number ?? payload.pull_request?.number;
+    if (!number2)
+      return;
+    const event = createEvent(repository, {
+      type: "webhook_received",
+      title: `pull_request:${payload.action ?? "updated"}`,
+      message: `pull_request ${payload.action ?? "updated"} on ${repository}#${number2}`,
+      url: payload.pull_request?.html_url ?? null,
+      payload: {
+        action: payload.action
+      }
+    });
+    await hydrateAndPersist(db, config, installationId, repository, number2, event);
+    return;
+  }
+  if (eventName === "pull_request_review") {
+    const number2 = payload.pull_request?.number ?? payload.number;
+    if (!number2)
+      return;
+    const trigger = mapReviewStateToTrigger(payload.review?.state);
+    const event = trigger ? createEvent(repository, {
+      type: trigger,
+      title: trigger === "review_changes_requested" ? "Changes requested" : "Review comment received",
+      message: payload.review?.body?.slice(0, 240) || `Review ${payload.review?.state ?? "submitted"}`,
+      url: payload.review?.html_url ?? payload.pull_request?.html_url ?? null,
+      payload: {
+        reviewer: payload.review?.user?.login,
+        state: payload.review?.state
+      },
+      ...payload.review?.submitted_at ? { createdAt: payload.review.submitted_at } : {}
+    }) : undefined;
+    await hydrateAndPersist(db, config, installationId, repository, number2, event);
+    return;
+  }
+  if (eventName === "check_run") {
+    for (const pullRequest of payload.check_run?.pull_requests ?? []) {
+      if (!pullRequest.number)
+        continue;
+      await hydrateAndPersist(db, config, installationId, repository, pullRequest.number);
+    }
+    return;
+  }
+  if (eventName === "check_suite") {
+    for (const pullRequest of payload.check_suite?.pull_requests ?? []) {
+      if (!pullRequest.number)
+        continue;
+      await hydrateAndPersist(db, config, installationId, repository, pullRequest.number);
+    }
+  }
+}
+
+// ../ops-harbor-control-plane/src/server.ts
+function fallbackRuntimeStatus() {
+  return {
+    tunnelEnabled: false,
+    publicWebhookUrl: null,
+    publicWebhookBaseUrl: null,
+    webhookIngressPort: null
+  };
+}
+function redactStoredConfig(config) {
+  const { githubWebhookSecret: _githubWebhookSecret, ...rest } = config;
+  return rest;
+}
+function createControlPlaneApp({ config, db, getRuntimeStatus }) {
+  const app = new Hono2;
+  const webhookHandler = createGitHubWebhookHandler({ config, db });
+  app.use("/api/*", cors());
+  app.use("/api/admin/*", async (c, next) => {
+    if (config.internalApiToken && c.req.header("x-ops-harbor-token") !== config.internalApiToken) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    await next();
+  });
+  app.use("/api/internal/*", async (c, next) => {
+    if (config.internalApiToken && c.req.header("x-ops-harbor-token") !== config.internalApiToken) {
+      return c.json({ error: "unauthorized" }, 401);
+    }
+    await next();
+  });
+  app.get("/api/health", (c) => c.json({
+    ok: true,
+    provider: "github",
+    githubConfigured: Boolean(config.githubAppId && config.githubPrivateKey),
+    tunnel: getRuntimeStatus?.() ?? fallbackRuntimeStatus()
+  }));
+  app.get("/api/work-items", (c) => c.json(listWorkItems(db, parseWorkItemFilterFromQuery((key) => c.req.query(key)))));
+  app.get("/api/config", (c) => c.json(redactStoredConfig(loadStoredConfig())));
+  app.put("/api/config", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    if (!body) {
+      return c.json({ error: "invalid config payload" }, 400);
+    }
+    try {
+      return c.json(redactStoredConfig(await saveStoredConfig(body)));
+    } catch (error) {
+      return c.json({ error: error instanceof Error ? error.message : String(error) }, 400);
+    }
+  });
+  app.get("/api/work-items/:id", (c) => {
+    const item = getWorkItem(db, c.req.param("id"));
+    if (!item)
+      return c.json({ error: "work item not found" }, 404);
+    return c.json(item);
+  });
+  app.get("/api/activity", (c) => {
+    const workItemId = c.req.query("work_item_id");
+    const repository = c.req.query("repository");
+    return c.json(listActivity(db, {
+      ...workItemId ? { workItemId } : {},
+      ...repository ? { repository } : {},
+      limit: Number.parseInt(c.req.query("limit") ?? "100", 10)
+    }));
+  });
+  app.get("/api/alerts", (c) => c.json(listAlerts(db)));
+  app.get("/api/internal/jobs", (c) => c.json(listAutomationJobs(db, Number.parseInt(c.req.query("limit") ?? "100", 10))));
+  app.post("/api/admin/sync", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const author = body.author ?? config.defaultAuthor;
+    if (!author)
+      return c.json({ error: "author is required" }, 400);
+    try {
+      const result = await syncAuthorWorkItems(db, config, author);
+      return c.json(result);
+    } catch (error) {
+      return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+    }
+  });
+  app.post("/api/webhooks/github", webhookHandler);
+  app.post("/api/internal/jobs/lease", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const workerId = body.worker_id ?? "default-worker";
+    const leased = leaseNextAutomationJob(db, workerId);
+    return c.json(leased ?? { job: null, workItem: null });
+  });
+  app.post("/api/internal/jobs/:id/complete", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const status = body.status ?? "completed";
+    completeAutomationJob(db, c.req.param("id"), status, body.result_summary);
+    return c.json({ ok: true });
+  });
+  return app;
+}
+function createGitHubWebhookHandler({ config, db }) {
+  return async (c) => {
+    const rawBody = await c.req.text();
+    if (config.githubWebhookSecret) {
+      const valid = verifyWebhookSignature(config.githubWebhookSecret, rawBody, c.req.header("x-hub-signature-256") ?? null);
+      if (!valid)
+        return c.json({ error: "invalid webhook signature" }, 401);
+    }
+    const deliveryId = c.req.header("x-github-delivery") ?? crypto.randomUUID();
+    const eventName = c.req.header("x-github-event") ?? "unknown";
+    let payload;
+    try {
+      payload = JSON.parse(rawBody);
+    } catch {
+      return c.json({ error: "invalid JSON body" }, 400);
+    }
+    if (isWebhookDeliveryProcessed(db, deliveryId)) {
+      return c.json({ ok: true, deduplicated: true });
+    }
+    recordWebhookDeliveryReceived(db, deliveryId, eventName, payload);
+    try {
+      await handleWebhookEvent(db, config, eventName, payload);
+      markWebhookDeliveryProcessed(db, deliveryId);
+      return c.json({ ok: true });
+    } catch (error) {
+      return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
+    }
+  };
+}
+function createWebhookIngressApp({ config, db, getRuntimeStatus }) {
+  const app = new Hono2;
+  const webhookHandler = createGitHubWebhookHandler({ config, db });
+  app.get("/api/health", (c) => c.json({
+    ok: true,
+    ingress: "github-webhooks",
+    tunnel: getRuntimeStatus?.() ?? fallbackRuntimeStatus()
+  }));
+  app.post("/api/webhooks/github", webhookHandler);
+  return app;
+}
+function openControlPlaneApps(config, getRuntimeStatus) {
+  const db = openControlPlaneDb(config.dbPath);
+  return {
+    db,
+    controlPlaneApp: createControlPlaneApp({ config, db, getRuntimeStatus }),
+    webhookIngressApp: createWebhookIngressApp({ config, db, getRuntimeStatus })
+  };
+}
+
+// ../ops-harbor-control-plane/src/cli.ts
+function shouldStartGitHubWebhookTunnel(config) {
+  return Boolean(config.githubAppId && config.githubPrivateKey && !config.githubTunnelDisabled);
+}
+async function main() {
+  await ensureStoredConfigSecrets();
+  const config = readConfig();
+  const runtimeStatus = {
+    tunnelEnabled: false,
+    publicWebhookUrl: null,
+    publicWebhookBaseUrl: null,
+    webhookIngressPort: null
+  };
+  const { controlPlaneApp, webhookIngressApp } = openControlPlaneApps(config, () => runtimeStatus);
+  Bun.serve({
+    port: config.port,
+    hostname: "127.0.0.1",
+    fetch: controlPlaneApp.fetch
+  });
+  let tunnelSession = null;
+  if (shouldStartGitHubWebhookTunnel(config)) {
+    const webhookIngressPort = await findAvailablePort(config.port + 1);
+    runtimeStatus.webhookIngressPort = webhookIngressPort;
+    Bun.serve({
+      port: webhookIngressPort,
+      hostname: "127.0.0.1",
+      fetch: webhookIngressApp.fetch
+    });
+    tunnelSession = await openTunnel({
+      port: webhookIngressPort,
+      localHost: "127.0.0.1",
+      ...config.githubTunnelHost ? { host: config.githubTunnelHost } : {}
+    });
+    runtimeStatus.publicWebhookBaseUrl = tunnelSession.url;
+    runtimeStatus.publicWebhookUrl = new URL("/api/webhooks/github", tunnelSession.url).toString();
+    await ensureGitHubAppWebhookUrl(config, runtimeStatus.publicWebhookUrl);
+    runtimeStatus.tunnelEnabled = true;
+  }
+  if (tunnelSession) {
+    const shutdown = async () => {
+      await tunnelSession?.close().catch((error) => {
+        console.error("failed to close GitHub webhook tunnel", error);
+      });
+      process.exit(0);
+    };
+    process.once("SIGINT", () => void shutdown());
+    process.once("SIGTERM", () => void shutdown());
+  }
+  console.log(`
+\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
+\u2502  Ops Harbor Control Plane                   \u2502
+\u251C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524
+\u2502  Local:   http://127.0.0.1:${String(config.port).padEnd(5)}         \u2502
+\u2502  Webhook: ${String(runtimeStatus.publicWebhookUrl ?? "disabled").padEnd(29)} \u2502
+\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
+`);
+}
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});