@svp-labs/talos 0.0.0 → 0.1.0

package/dist/github/rulesets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesets.js","sourceRoot":"","sources":["../../src/github/rulesets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEtF,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;AAMtF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAU,SAAS,IAAI,iCAAiC,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,EAAU;IACnE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B,KAAK,EACL,SAAS,IAAI,aAAa,EAAE,wBAAwB,CACrD,CAAC;IACF,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,CAAC,KAAK;SACjB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;SAC3C,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/govern/commit.js

@@ -0,0 +1,31 @@
+import { z } from 'zod';
+const MUTATION = `mutation($input: CreateCommitOnBranchInput!) {
+  createCommitOnBranch(input: $input) { commit { oid } }
+}`;
+const resultSchema = z.object({
+    createCommitOnBranch: z.object({ commit: z.object({ oid: z.string() }) }),
+});
+/**
+ * One commit straight onto a branch, through GraphQL's `createCommitOnBranch`: GitHub signs it
+ * and records the token's user as author and committer, so a commit `talos govern` makes as the
+ * owner is the owner's, verified. Writing a workflow file this way needs the `workflow` scope.
+ */
+export async function commitFiles(gh, repo, changes) {
+    const [headline = '', ...rest] = changes.message.split('\n');
+    const body = rest.join('\n').trim();
+    const input = {
+        branch: { repositoryNameWithOwner: repo, branchName: changes.branch },
+        message: body === '' ? { headline } : { headline, body },
+        expectedHeadOid: changes.expectedHead,
+        fileChanges: {
+            additions: changes.additions.map((file) => ({
+                path: file.path,
+                contents: Buffer.from(file.contents, 'utf8').toString('base64'),
+            })),
+            deletions: changes.deletions.map((path) => ({ path })),
+        },
+    };
+    const data = await gh.graphql(MUTATION, { input });
+    return resultSchema.parse(data).createCommitOnBranch.commit.oid;
+}
+//# sourceMappingURL=commit.js.map

package/dist/govern/commit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commit.js","sourceRoot":"","sources":["../../src/govern/commit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,MAAM,QAAQ,GAAG;;EAEf,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;CAC1E,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,IAAY,EAAE,OAAoB;IAC9E,MAAM,CAAC,QAAQ,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG;QACZ,MAAM,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE;QACrE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;QACxD,eAAe,EAAE,OAAO,CAAC,YAAY;QACrC,WAAW,EAAE;YACX,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAChE,CAAC,CAAC;YACH,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;SACvD;KACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC;AAClE,CAAC"}

package/dist/govern/compare.js

@@ -0,0 +1,52 @@
+/**
+ * Whether what GitHub answers already says what Talos would send. GitHub's answers carry more
+ * than its requests (ids, links, defaults it filled in), so the comparison asks only that every
+ * value Talos sets is there; an empty value Talos sets (`[]`, `false`, `null`) also matches a key
+ * GitHub left out.
+ */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !isList(value);
+}
+function isList(value) {
+    return Array.isArray(value);
+}
+function isEmpty(value) {
+    return value === null || value === false || (isList(value) && value.length === 0);
+}
+function recordCovers(actual, desired) {
+    return Object.entries(desired).every(([key, value]) => key in actual ? covers(actual[key], value) : isEmpty(value));
+}
+/** Arrays match in any order: GitHub may return rules and actors in another order. */
+function arrayCovers(actual, desired) {
+    if (actual.length !== desired.length)
+        return false;
+    const free = [...actual];
+    for (const want of desired) {
+        const index = free.findIndex((have) => covers(have, want));
+        if (index === -1)
+            return false;
+        free.splice(index, 1);
+    }
+    return true;
+}
+export function covers(actual, desired) {
+    if (isList(desired))
+        return isList(actual) && arrayCovers(actual, desired);
+    if (isRecord(desired))
+        return isRecord(actual) && recordCovers(actual, desired);
+    return Object.is(actual, desired);
+}
+/** GitHub ignores the id of an `OrganizationAdmin` bypass actor, so its answer may differ. */
+function comparable(body) {
+    return {
+        ...body,
+        bypass_actors: body.bypass_actors.map((actor) => actor.actor_type === 'OrganizationAdmin'
+            ? { actor_type: actor.actor_type, bypass_mode: actor.bypass_mode }
+            : actor),
+    };
+}
+/** Whether a ruleset GitHub returned already is the one Talos would write. */
+export function rulesetMatches(actual, desired) {
+    return covers(actual, comparable(desired));
+}
+//# sourceMappingURL=compare.js.map

package/dist/govern/compare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compare.js","sourceRoot":"","sources":["../../src/govern/compare.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,MAA+B,EAAE,OAAgC;IACrF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACpD,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,WAAW,CAAC,MAA0B,EAAE,OAA2B;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAe,EAAE,OAAgB;IACtD,IAAI,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,IAAiB;IACnC,OAAO;QACL,GAAG,IAAI;QACP,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9C,KAAK,CAAC,UAAU,KAAK,mBAAmB;YACtC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YAClE,CAAC,CAAC,KAAK,CACV;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAe,EAAE,OAAoB;IAClE,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7C,CAAC"}

package/dist/govern/create.js

@@ -0,0 +1,97 @@
+import { parse } from 'yaml';
+import { z } from 'zod';
+import { GovernRefusal } from './plan.js';
+import { talosConfigSchema } from '../config/schema.js';
+import { GitHubError } from '../github/api.js';
+import { readFileAt } from '../github/contents.js';
+import { listOrgRepositories } from '../github/repos.js';
+/**
+ * `talos new`: the owner creates a repository in the organisation with their own login, under a
+ * ticket prefix no other repository uses, and governs it. No App may create repositories.
+ */
+const NAME = /^[A-Za-z0-9._-]{1,100}$/;
+export function nameProblem(name) {
+    if (!NAME.test(name) || name === '.' || name === '..' || name.endsWith('.git')) {
+        return `${name} is not a repository name GitHub takes (letters, digits, ".", "-", "_")`;
+    }
+    return undefined;
+}
+export function prefixProblem(prefix) {
+    const parsed = talosConfigSchema.shape.prefix.safeParse(prefix);
+    return parsed.success
+        ? undefined
+        : `--prefix ${prefix}: 1 to 6 capitals or digits, a capital first`;
+}
+/** The prefix a `talos.yml`, or Scaffold's `project.yml`, names; `undefined` when none. */
+export function prefixIn(text) {
+    if (text === undefined)
+        return undefined;
+    try {
+        const parsed = z.object({ prefix: z.string().min(1) }).safeParse(parse(text));
+        return parsed.success ? parsed.data.prefix : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Every prefix the organisation's repositories use, from their default branch. */
+export async function prefixesInUse(gh, org) {
+    const repositories = (await listOrgRepositories(gh, org)).filter((r) => !r.archived);
+    const found = await Promise.all(repositories.map(async (repository) => {
+        const at = repository.defaultBranch;
+        const prefix = prefixIn(await readFileAt(gh, repository.fullName, 'talos.yml', at)) ??
+            prefixIn(await readFileAt(gh, repository.fullName, 'project.yml', at));
+        return prefix === undefined ? [] : [{ repo: repository.fullName, prefix }];
+    }));
+    return found.flat();
+}
+/** The repository already using `prefix`, compared without case; `undefined` when it is free. */
+export function prefixHolder(uses, prefix) {
+    return uses.find((use) => use.prefix.toUpperCase() === prefix.toUpperCase())?.repo;
+}
+function scalar(text) {
+    return /^[A-Za-z][\w .-]*$/.test(text) && !/\s$/.test(text) ? text : JSON.stringify(text);
+}
+/**
+ * The `talos.yml` a new repository starts with: its name and prefix only, so the prefix is on
+ * record from the start; `talos adopt` fills in the rest.
+ */
+export function seedConfig(name, prefix) {
+    return `name: ${scalar(name)}\nprefix: ${prefix}\n`;
+}
+async function repositoryExists(gh, repo) {
+    return (await gh.request('GET', `repos/${repo}`, { allowMissing: true })) !== undefined;
+}
+/** Creates the repository with a first commit, so its default branch exists to commit to. */
+export async function createRepository(gh, org, name, visibility) {
+    const created = await gh.request('POST', `orgs/${encodeURIComponent(org)}/repos`, {
+        body: { name, private: visibility === 'private', auto_init: true },
+    });
+    z.object({ id: z.number().int() }).parse(created);
+}
+/**
+ * A repository just created may answer 404 or 409 for a moment while GitHub writes its first
+ * commit; this retries such answers a few times before giving up.
+ */
+export async function whenReady(attempt, sleep, tries = 5) {
+    try {
+        return await attempt();
+    }
+    catch (error) {
+        const settling = error instanceof GitHubError && (error.status === 404 || error.status === 409);
+        if (!settling || tries <= 1)
+            throw error;
+        await sleep(2000);
+        return whenReady(attempt, sleep, tries - 1);
+    }
+}
+/** Refuses a name already taken in the organisation, or a prefix another repository uses. */
+export async function checkNew(gh, org, name, prefix) {
+    if (await repositoryExists(gh, `${org}/${name}`)) {
+        throw new GovernRefusal(`${org}/${name} exists already`);
+    }
+    const holder = prefixHolder(await prefixesInUse(gh, org), prefix);
+    if (holder !== undefined)
+        throw new GovernRefusal(`prefix ${prefix} is in use by ${holder}`);
+}
+//# sourceMappingURL=create.js.map

package/dist/govern/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/govern/create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAe,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;GAGG;AAEH,MAAM,IAAI,GAAG,yBAAyB,CAAC;AAEvC,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,OAAO,GAAG,IAAI,yEAAyE,CAAC;IAC1F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,OAAO;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,MAAM,8CAA8C,CAAC;AACvE,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,QAAQ,CAAC,IAAwB;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAID,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAU,EAAE,GAAW;IACzD,MAAM,YAAY,GAAG,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACpC,MAAM,EAAE,GAAG,UAAU,CAAC,aAAa,CAAC;QACpC,MAAM,MAAM,GACV,QAAQ,CAAC,MAAM,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YACpE,QAAQ,CAAC,MAAM,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,YAAY,CAAC,IAA0B,EAAE,MAAc;IACrE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC;AACrF,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc;IACrD,OAAO,SAAS,MAAM,CAAC,IAAI,CAAC,aAAa,MAAM,IAAI,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAAU,EAAE,IAAY;IACtD,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;AACnG,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,GAAW,EACX,IAAY,EACZ,UAAgC;IAEhC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,MAAM,EAAE,QAAQ,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE;QACzF,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,KAAK,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;KACnE,CAAC,CAAC;IACH,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,OAAyB,EAAE,KAAY,EAAE,KAAK,GAAG,CAAC;IACnF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,KAAK,YAAY,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC;QACzC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,EAAU,EACV,GAAW,EACX,IAAY,EACZ,MAAc;IAEd,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,aAAa,CAAC,GAAG,GAAG,IAAI,IAAI,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,UAAU,MAAM,iBAAiB,MAAM,EAAE,CAAC,CAAC;AAC/F,CAAC"}

package/dist/govern/govern.js

@@ -0,0 +1,75 @@
+import { readFile } from 'node:fs/promises';
+import { z } from 'zod';
+import { stepsOutput } from './output.js';
+import { GovernRefusal, governPlan, targetChannel } from './plan.js';
+import { readRepoState } from './state.js';
+import { applySteps, planned, scopeHint } from './steps.js';
+import { loadTemplates } from './templates.js';
+import { sameLogin } from '../github/identities.js';
+import { assetsDir } from '../version/self.js';
+const GOVERN_SCHEMA = 'talos.govern/1';
+/** The caller, the CODEOWNERS template and the ruleset templates Talos ships. */
+export async function loadGovernAssets(dir = assetsDir()) {
+    const read = async (path) => {
+        try {
+            return await readFile(new URL(path, dir), 'utf8');
+        }
+        catch {
+            throw new Error(`this Talos ships no assets/${path}`);
+        }
+    };
+    const [caller, codeowners, templates] = await Promise.all([
+        read('workflows/talos.yml'),
+        read('codeowners'),
+        loadTemplates(dir),
+    ]);
+    return { caller, codeowners, templates };
+}
+const userSchema = z.object({ login: z.string() });
+/**
+ * `talos govern` runs as the owner, with their own login: every step needs administration rights
+ * no App holds, and the commit it makes must be the owner's.
+ */
+export async function assertOwner(gh, who) {
+    const user = await gh.request('GET', 'user').catch(() => undefined);
+    const login = userSchema.safeParse(user).data?.login;
+    if (!sameLogin(login, who.owner)) {
+        throw new GovernRefusal(`talos govern runs as the owner (${who.owner}) with their own login (gh auth login); ` +
+            `this token is ${login ?? 'not a user'}`);
+    }
+}
+/** Reads the repository, plans, and applies the plan unless it is a dry run. */
+export async function governRepository(options) {
+    await assertOwner(options.gh, options.who);
+    const seedPaths = Object.keys(options.seed ?? {});
+    const state = await readRepoState(options.gh, options.repo, options.who, {
+        extraPaths: seedPaths,
+    });
+    const request = {
+        owner: options.who.owner,
+        agents: options.agents,
+        channel: options.channel,
+        ...options.assets,
+        ...(options.seed === undefined ? {} : { seed: options.seed }),
+    };
+    const steps = governPlan(state, request);
+    const results = options.dryRun ? planned(steps) : await applySteps(options.gh, steps, scopeHint);
+    return {
+        schema: GOVERN_SCHEMA,
+        repo: options.repo,
+        channel: targetChannel(state, request),
+        dryRun: options.dryRun,
+        results,
+    };
+}
+/** The report as agents read it (`talos.govern/1`): capped, clipped, manual steps apart. */
+export function governJson(report) {
+    return {
+        schema: report.schema,
+        repo: report.repo,
+        channel: report.channel,
+        dryRun: report.dryRun,
+        ...stepsOutput(report.results),
+    };
+}
+//# sourceMappingURL=govern.js.map

package/dist/govern/govern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"govern.js","sourceRoot":"","sources":["../../src/govern/govern.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAsB,aAAa,EAAE,MAAM,WAAW,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAmB,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAmB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAIvC,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAW,SAAS,EAAE;IAC3D,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,IAAI,CAAC,qBAAqB,CAAC;QAC3B,IAAI,CAAC,YAAY,CAAC;QAClB,aAAa,CAAC,GAAG,CAAC;KACnB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEnD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,GAAe;IAC3D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC;IACrD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CACrB,mCAAmC,GAAG,CAAC,KAAK,0CAA0C;YACpF,iBAAiB,KAAK,IAAI,YAAY,EAAE,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAqBD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAsB;IAC3D,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE;QACvE,UAAU,EAAE,SAAS;KACtB,CAAC,CAAC;IACH,MAAM,OAAO,GAAkB;QAC7B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,OAAO,CAAC,MAAM;QACjB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC9D,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACjG,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,MAAoB;IAC7C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;KAC/B,CAAC;AACJ,CAAC"}

package/dist/govern/installations.js

@@ -0,0 +1,58 @@
+import { z } from 'zod';
+import { change, manual, ok } from './steps.js';
+import { GitHubError } from '../github/api.js';
+const ROLES = ['thea', 'reviewer', 'release'];
+export function appSlug(who, role) {
+    return who[role].replace(/\[bot\]$/, '');
+}
+const installationSchema = z.object({
+    id: z.number().int(),
+    app_slug: z.string(),
+    repository_selection: z.enum(['all', 'selected']),
+});
+async function orgInstallations(gh, org) {
+    const raw = await gh.paginate(`orgs/${encodeURIComponent(org)}/installations`, 'installations');
+    return z.array(installationSchema).parse(raw);
+}
+async function isMember(gh, installation, repositoryId) {
+    if (installation.repository_selection === 'all')
+        return true;
+    try {
+        const raw = await gh.paginate(`user/installations/${installation.id}/repositories`, 'repositories');
+        return z
+            .array(z.object({ id: z.number().int() }))
+            .parse(raw)
+            .some((repository) => repository.id === repositoryId);
+    }
+    catch (error) {
+        if (error instanceof GitHubError)
+            return undefined;
+        throw error;
+    }
+}
+export async function readInstallations(gh, who, repositoryId) {
+    const installations = await orgInstallations(gh, who.org);
+    return Promise.all(ROLES.map(async (role) => {
+        const slug = appSlug(who, role);
+        const installation = installations.find((i) => i.app_slug === slug);
+        const member = installation === undefined ? false : await isMember(gh, installation, repositoryId);
+        return { role, slug, installation, member };
+    }));
+}
+/** One step per App: already there, added, or installed on the org by hand first. */
+export function installationSteps(states, repositoryId) {
+    return states.map((state) => {
+        const id = `app:${state.slug}`;
+        if (state.installation === undefined) {
+            return manual(id, `install the ${state.slug} App on the organisation, then rerun`);
+        }
+        if (state.member === true)
+            return ok(id, `${state.slug} reaches the repository`);
+        return change(id, `add the repository to ${state.slug}'s installation`, {
+            kind: 'install',
+            installationId: state.installation.id,
+            repositoryId,
+        });
+    });
+}
+//# sourceMappingURL=installations.js.map

package/dist/govern/installations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations.js","sourceRoot":"","sources":["../../src/govern/installations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAa,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAe,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAc5D,MAAM,KAAK,GAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAElE,MAAM,UAAU,OAAO,CAAC,GAAe,EAAE,IAAa;IACpD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;CAClD,CAAC,CAAC;AAYH,KAAK,UAAU,gBAAgB,CAAC,EAAU,EAAE,GAAW;IACrD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC3B,QAAQ,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,EAC/C,eAAe,CAChB,CAAC;IACF,OAAO,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,EAAU,EACV,YAA0B,EAC1B,YAAoB;IAEpB,IAAI,YAAY,CAAC,oBAAoB,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC3B,sBAAsB,YAAY,CAAC,EAAE,eAAe,EACpD,cAAc,CACf,CAAC;QACF,OAAO,CAAC;aACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;aACzC,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW;YAAE,OAAO,SAAS,CAAC;QACnD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAU,EACV,GAAe,EACf,YAAoB;IAEpB,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACpE,MAAM,MAAM,GACV,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAC/B,MAAoC,EACpC,YAAoB;IAEpB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,EAAE,EAAE,eAAe,KAAK,CAAC,IAAI,sCAAsC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,yBAAyB,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,EAAE,EAAE,yBAAyB,KAAK,CAAC,IAAI,iBAAiB,EAAE;YACtE,IAAI,EAAE,SAAS;YACf,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YACrC,YAAY;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/govern/org.js

@@ -0,0 +1,136 @@
+import { z } from 'zod';
+import { covers } from './compare.js';
+import { appSlug } from './installations.js';
+import { GovernRefusal } from './plan.js';
+import { readRulesets } from './rulesets-api.js';
+import { change, manual, ok, rulesetStep } from './steps.js';
+import { channelRuleset, channelRulesetName, CHANNELS, channelsBranchRuleset, pinOf, } from './templates.js';
+/**
+ * The organisation's side of Talos: the two custom properties every governed repository carries,
+ * the three channel rulesets that run the gate, and the Talos repository's own three rulesets
+ * (only the owner tags a release; only `talos-release` writes the `channels` branch; nothing
+ * lands on `main` until the PR's own engine passed its checks and self-test).
+ */
+export const PROPERTY_DEFINITIONS = {
+    talos: {
+        value_type: 'single_select',
+        required: false,
+        allowed_values: [...CHANNELS],
+        values_editable_by: 'org_actors',
+        description: 'The Talos channel whose org ruleset runs the gate on this repository',
+    },
+    'talos-agents': {
+        value_type: 'true_false',
+        required: false,
+        values_editable_by: 'org_actors',
+        description: 'Whether Thea implements here and the reviewer adds its AI review',
+    },
+};
+const idSchema = z.object({ id: z.number().int() });
+const definitionsSchema = z.array(z.looseObject({ property_name: z.string() }));
+const tagsSchema = z.array(z.object({ name: z.string(), commit: z.object({ sha: z.string() }) }));
+const CHANNEL_NAMES = CHANNELS.map(channelRulesetName);
+export async function releasesOf(gh, talosRepo) {
+    const tags = tagsSchema.parse(await gh.paginate(`repos/${talosRepo}/tags`));
+    return tags.filter((t) => /^v\d/.test(t.name)).map((t) => ({ tag: t.name, sha: t.commit.sha }));
+}
+export async function channelRulesets(gh, org) {
+    return readRulesets(gh, { kind: 'org', org }, CHANNEL_NAMES);
+}
+export async function readOrgState(gh, who, templates) {
+    const org = encodeURIComponent(who.org);
+    const tagNames = [
+        templates.releaseTags.name,
+        templates.channelsBranch.name,
+        templates.selfTest.name,
+    ];
+    const [talos, reviewer, release, definitions, channels, talosRulesets, releases] = await Promise.all([
+        gh.request('GET', `repos/${who.talosRepo}`),
+        gh.request('GET', `apps/${appSlug(who, 'reviewer')}`),
+        gh.request('GET', `apps/${appSlug(who, 'release')}`),
+        gh.paginate(`orgs/${org}/properties/schema`),
+        channelRulesets(gh, who.org),
+        readRulesets(gh, { kind: 'repo', repo: who.talosRepo }, tagNames),
+        releasesOf(gh, who.talosRepo),
+    ]);
+    const state = {
+        org: who.org,
+        talosRepo: who.talosRepo,
+        ids: {
+            talosRepositoryId: idSchema.parse(talos).id,
+            reviewerAppId: idSchema.parse(reviewer).id,
+        },
+        releaseAppId: idSchema.parse(release).id,
+        definitions: Object.fromEntries(definitionsSchema.parse(definitions).map((d) => [d.property_name, d])),
+        channels,
+        talosRulesets,
+        releases,
+    };
+    return state;
+}
+function propertySteps(state) {
+    return Object.entries(PROPERTY_DEFINITIONS).map(([name, body]) => {
+        const id = `property:${name}`;
+        const current = state.definitions[name];
+        if (current !== undefined && covers(current, body))
+            return ok(id, `${name} is defined`);
+        const verb = current === undefined ? 'define' : 'update';
+        return change(id, `${verb} the ${name} property`, {
+            kind: 'define-property',
+            org: state.org,
+            name,
+            body,
+        });
+    });
+}
+/** Refuses a seed that isn't a release tag's commit: a pin only ever points at a release. */
+export function checkSeed(state, seed) {
+    if (seed === undefined)
+        return;
+    if (!state.releases.some((release) => release.sha === seed)) {
+        throw new GovernRefusal(`--seed ${seed} is not the commit of a v* tag on ${state.talosRepo}`);
+    }
+}
+function channelStep(state, templates, channel, seed) {
+    const name = channelRulesetName(channel);
+    const current = state.channels.find((ruleset) => ruleset.name === name);
+    const pin = (current === undefined ? undefined : pinOf(current.rules)) ?? seed;
+    if (pin === undefined) {
+        return manual(`ruleset:${name}`, `${name} needs a first pin: talos org init --seed <sha>`);
+    }
+    const scope = { kind: 'org', org: state.org };
+    return rulesetStep(scope, current, channelRuleset(templates.channel, channel, pin, state.ids));
+}
+/**
+ * What `talos org init` does: the properties first, which the channel rulesets target; then the
+ * three channel rulesets, each keeping the pin it has (pins move only through the release jobs)
+ * or taking the seed; then the Talos repository's own rulesets.
+ */
+export function orgPlan(state, templates, seed) {
+    checkSeed(state, seed);
+    const talos = { kind: 'repo', repo: state.talosRepo };
+    const find = (name) => state.talosRulesets.find((ruleset) => ruleset.name === name);
+    const channelsBranch = channelsBranchRuleset(templates.channelsBranch, state.releaseAppId);
+    return [
+        ...propertySteps(state),
+        ...CHANNELS.map((channel) => channelStep(state, templates, channel, seed)),
+        rulesetStep(talos, find(templates.releaseTags.name), templates.releaseTags),
+        rulesetStep(talos, find(channelsBranch.name), channelsBranch),
+        rulesetStep(talos, find(templates.selfTest.name), templates.selfTest),
+    ];
+}
+/** Each channel's pin, and the release tag it is. */
+export function pinsOf(channels, releases) {
+    return CHANNELS.map((channel) => {
+        const ruleset = channels.find((r) => r.name === channelRulesetName(channel));
+        const sha = ruleset === undefined ? undefined : pinOf(ruleset.rules);
+        const tag = releases.find((release) => release.sha === sha)?.tag;
+        return {
+            channel,
+            sha: sha ?? null,
+            tag: tag ?? null,
+            enforcement: ruleset?.enforcement ?? null,
+        };
+    });
+}
+//# sourceMappingURL=org.js.map

package/dist/govern/org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org.js","sourceRoot":"","sources":["../../src/govern/org.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAoB,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAa,MAAM,YAAY,CAAC;AACxE,OAAO,EAEL,cAAc,EACd,kBAAkB,EAClB,QAAQ,EACR,qBAAqB,EAErB,KAAK,GAEN,MAAM,gBAAgB,CAAC;AAIxB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsD;IACrF,KAAK,EAAE;QACL,UAAU,EAAE,eAAe;QAC3B,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,CAAC,GAAG,QAAQ,CAAC;QAC7B,kBAAkB,EAAE,YAAY;QAChC,WAAW,EAAE,sEAAsE;KACpF;IACD,cAAc,EAAE;QACd,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,KAAK;QACf,kBAAkB,EAAE,YAAY;QAChC,WAAW,EAAE,kEAAkE;KAChF;CACF,CAAC;AAeF,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACpD,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAElG,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,SAAiB;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAU,SAAS,SAAS,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAU,EAAE,GAAW;IAC3D,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,GAAe,EAAE,SAAoB;IAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG;QACf,SAAS,CAAC,WAAW,CAAC,IAAI;QAC1B,SAAS,CAAC,cAAc,CAAC,IAAI;QAC7B,SAAS,CAAC,QAAQ,CAAC,IAAI;KACxB,CAAC;IACF,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,GAC9E,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,GAAG,CAAC,SAAS,EAAE,CAAC;QACpD,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,QAAQ,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QAC9D,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,QAAQ,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7D,EAAE,CAAC,QAAQ,CAAU,QAAQ,GAAG,oBAAoB,CAAC;QACrD,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC;QAC5B,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC;QACjE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC;KAC9B,CAAC,CAAC;IACL,MAAM,KAAK,GAAa;QACtB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,EAAE;YACH,iBAAiB,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE;YAC3C,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE;SAC3C;QACD,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE;QACxC,WAAW,EAAE,MAAM,CAAC,WAAW,CAC7B,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CACtE;QACD,QAAQ;QACR,aAAa;QACb,QAAQ;KACT,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAe;IACpC,OAAO,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,YAAY,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzD,OAAO,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,QAAQ,IAAI,WAAW,EAAE;YAChD,IAAI,EAAE,iBAAiB;YACvB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,SAAS,CAAC,KAAe,EAAE,IAAwB;IACjE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,aAAa,CAAC,UAAU,IAAI,qCAAqC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAe,EAAE,SAAoB,EAAE,OAAgB,EAAE,IAAa;IACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/E,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,GAAG,IAAI,iDAAiD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAW,CAAC;IACvD,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,KAAe,EAAE,SAAoB,EAAE,IAAa;IAC1E,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAW,CAAC;IAC/D,MAAM,IAAI,GAAG,CAAC,IAAY,EAA2B,EAAE,CACrD,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3F,OAAO;QACL,GAAG,aAAa,CAAC,KAAK,CAAC;QACvB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1E,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC;QAC3E,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;QAC7D,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC;KACtE,CAAC;AACJ,CAAC;AASD,qDAAqD;AACrD,MAAM,UAAU,MAAM,CACpB,QAAgC,EAChC,QAA8B;IAE9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC;QACjE,OAAO;YACL,OAAO;YACP,GAAG,EAAE,GAAG,IAAI,IAAI;YAChB,GAAG,EAAE,GAAG,IAAI,IAAI;YAChB,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,IAAI;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/govern/output.js

@@ -0,0 +1,32 @@
+/** Agent-facing output stays small: lists cut at 20 with their total, messages at 200. */
+const MAX_LISTED = 20;
+const MAX_MESSAGE = 200;
+export function clip(text, max = MAX_MESSAGE) {
+    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+export function capped(items, max = MAX_LISTED) {
+    return { items: items.slice(0, max), total: items.length };
+}
+/** The results with each detail clipped, capped, plus the manual steps on their own. */
+export function stepsOutput(results) {
+    return {
+        ok: results.every((r) => r.status !== 'failed' && r.status !== 'skipped'),
+        steps: capped(results.map((r) => ({ ...r, detail: clip(r.detail) }))),
+        manual: capped(results.filter((r) => r.status === 'manual').map((r) => clip(r.detail))),
+    };
+}
+const MARK = {
+    ok: '✓',
+    changed: '+',
+    planned: '~',
+    manual: '!',
+    failed: '✗',
+    skipped: '-',
+};
+/** One line per step for a person: `+ ruleset:talos-merge-queue  create talos-merge-queue`. */
+export function stepsText(title, results) {
+    const width = Math.max(0, ...results.map((r) => r.id.length));
+    const lines = results.map((r) => `${MARK[r.status]} ${r.id.padEnd(width)}  ${r.detail}`);
+    return `${title}\n${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=output.js.map

package/dist/govern/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/govern/output.ts"],"names":[],"mappings":"AAEA,0FAA0F;AAC1F,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,GAAG,GAAG,WAAW;IAClD,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AAClE,CAAC;AAID,MAAM,UAAU,MAAM,CAAI,KAAmB,EAAE,GAAG,GAAG,UAAU;IAC7D,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,OAA8B;IAKxD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;QACzE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAmD;IAC3D,EAAE,EAAE,GAAG;IACP,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,GAAG;CACb,CAAC;AAEF,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAA8B;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,OAAO,GAAG,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC3C,CAAC"}