@svp-labs/talos 0.0.0 → 0.1.1

package/dist/github/artifacts.js

@@ -0,0 +1,203 @@
+import { crc32, inflateRawSync } from 'node:zlib';
+import { listRunArtifacts } from './actions.js';
+import { GitHubError } from './api.js';
+import { EngineError } from '../core/check.js';
+const API = 'https://api.github.com';
+const MAX_ARCHIVE = 100 * 1024 * 1024;
+/** The largest file read out of an artifact: a verdict or a report, never a build. */
+const MAX_MEMBER = 32 * 1024 * 1024;
+export function downloader(token, options = {}) {
+    const baseUrl = options.baseUrl ?? API;
+    const doFetch = options.fetch ?? fetch;
+    return async (path) => {
+        const url = path.startsWith('https://') ? path : `${baseUrl}/${path.replace(/^\//, '')}`;
+        if (!url.startsWith(`${baseUrl}/`))
+            throw new GitHubError('GET artifact: not an API URL', 0);
+        const first = await doFetch(url, {
+            redirect: 'manual',
+            headers: {
+                authorization: `Bearer ${token}`,
+                accept: 'application/vnd.github+json',
+                'x-github-api-version': '2022-11-28',
+                'user-agent': 'svp-labs-talos',
+            },
+        });
+        const location = first.headers.get('location');
+        // The archive sits behind a short-lived signed URL on a storage host, which must never see
+        // the API token, so the redirect is followed by hand and without headers.
+        const response = first.status >= 300 && first.status < 400 && location !== null
+            ? await doFetch(location)
+            : first;
+        if (!response.ok)
+            throw new GitHubError(`GET ${path}: ${response.status}`, response.status);
+        return new Uint8Array(await response.arrayBuffer());
+    };
+}
+/*
+ * Just enough of the zip format to read one file of a workflow artifact with no program outside
+ * Node: the end of central directory record, the central directory, one local header, stored and
+ * deflated data. Sizes and checksums come from the central directory, since
+ * `actions/upload-artifact` streams its entries and leaves the local headers' at zero.
+ */
+const END_OF_DIRECTORY = 0x06_05_4b_50;
+const ZIP64_LOCATOR = 0x07_06_4b_50;
+const DIRECTORY_ENTRY = 0x02_01_4b_50;
+const LOCAL_HEADER = 0x04_03_4b_50;
+const END_SIZE = 22;
+const LOCATOR_SIZE = 20;
+const ENTRY_SIZE = 46;
+const LOCAL_SIZE = 30;
+const MAX_COMMENT = 0xff_ff;
+/** What a 16- or 32-bit field holds when the real value is in a zip64 record. */
+const ZIP64_COUNT = 0xff_ff;
+const ZIP64_SIZE = 0xff_ff_ff_ff;
+/** General purpose flags: bit 0, encrypted; bit 6, strongly encrypted. */
+const ENCRYPTED = 0x00_41;
+const STORED = 0;
+const DEFLATED = 8;
+function refuse(why) {
+    throw new EngineError(`unreadable artifact: ${why}`);
+}
+/** Where the end of central directory record starts: the last one whose comment ends the file. */
+function endRecord(zip) {
+    const last = zip.length - END_SIZE;
+    for (let at = last; at >= Math.max(0, last - MAX_COMMENT); at -= 1) {
+        if (zip.readUInt32LE(at) === END_OF_DIRECTORY &&
+            at + END_SIZE + zip.readUInt16LE(at + 20) === zip.length) {
+            return at;
+        }
+    }
+    return refuse('not a zip archive');
+}
+function directoryOf(zip) {
+    if (zip.length < END_SIZE)
+        refuse('not a zip archive');
+    const end = endRecord(zip);
+    const count = zip.readUInt16LE(end + 10);
+    const size = zip.readUInt32LE(end + 12);
+    const start = zip.readUInt32LE(end + 16);
+    const zip64 = end >= LOCATOR_SIZE && zip.readUInt32LE(end - LOCATOR_SIZE) === ZIP64_LOCATOR;
+    if (zip64 || count === ZIP64_COUNT || size === ZIP64_SIZE || start === ZIP64_SIZE) {
+        refuse('a zip64 archive');
+    }
+    // This disk's number and the central directory's, both 16 bits, read as one.
+    if (zip.readUInt32LE(end + 4) !== 0 || zip.readUInt16LE(end + 8) !== count) {
+        refuse('an archive split across disks');
+    }
+    if (start + size > end)
+        refuse('the central directory lies outside the archive');
+    return { start, end: start + size, count };
+}
+/** A name that could write outside a directory: absolute, with a drive, `..` or a NUL in it. */
+function hostile(name) {
+    return (name === '' ||
+        name.includes('\0') ||
+        /^(?:[/\\]|[a-z]:)/i.test(name) ||
+        name.split(/[/\\]/).includes('..'));
+}
+function memberAt(zip, at, directory) {
+    if (at + ENTRY_SIZE > directory.end || zip.readUInt32LE(at) !== DIRECTORY_ENTRY) {
+        refuse('a damaged central directory');
+    }
+    const nameEnd = at + ENTRY_SIZE + zip.readUInt16LE(at + 28);
+    const next = nameEnd + zip.readUInt16LE(at + 30) + zip.readUInt16LE(at + 32);
+    if (next > directory.end)
+        refuse('a damaged central directory');
+    const name = zip.toString('utf8', at + ENTRY_SIZE, nameEnd);
+    if (hostile(name))
+        refuse('a file named with an absolute path or ..');
+    const member = {
+        name,
+        flags: zip.readUInt16LE(at + 8),
+        method: zip.readUInt16LE(at + 10),
+        crc: zip.readUInt32LE(at + 16),
+        packed: zip.readUInt32LE(at + 20),
+        size: zip.readUInt32LE(at + 24),
+        local: zip.readUInt32LE(at + 42),
+    };
+    return [member, next];
+}
+/** Every file the central directory lists; one hostile name refuses the whole archive. */
+function members(zip) {
+    const directory = directoryOf(zip);
+    const listed = [];
+    let at = directory.start;
+    for (let index = 0; index < directory.count; index += 1) {
+        const [member, next] = memberAt(zip, at, directory);
+        listed.push(member);
+        at = next;
+    }
+    return { listed, directory };
+}
+/** The member's data as stored, checked against its own entry before anything is inflated. */
+function packedData(zip, member, directory, maxBytes) {
+    const { name } = member;
+    if ((member.flags & ENCRYPTED) !== 0)
+        refuse(`${name} is encrypted`);
+    if ([member.packed, member.size, member.local].includes(ZIP64_SIZE))
+        refuse(`${name} is zip64`);
+    if (member.size > maxBytes)
+        refuse(`${name} is larger than ${maxBytes} bytes`);
+    if (member.method !== STORED && member.method !== DEFLATED) {
+        refuse(`${name} is compressed with method ${member.method}`);
+    }
+    const local = member.local;
+    if (local + LOCAL_SIZE > directory.start || zip.readUInt32LE(local) !== LOCAL_HEADER) {
+        refuse(`${name} has a damaged local header`);
+    }
+    const start = local + LOCAL_SIZE + zip.readUInt16LE(local + 26) + zip.readUInt16LE(local + 28);
+    if (start + member.packed > directory.start)
+        refuse(`${name} is truncated`);
+    return zip.subarray(start, start + member.packed);
+}
+function unpacked(data, member) {
+    if (member.method === STORED)
+        return data;
+    try {
+        // A member that inflates past the size its entry gives is refused before it is all in memory.
+        return inflateRawSync(data, { maxOutputLength: Math.max(1, member.size) });
+    }
+    catch {
+        return refuse(`${member.name} does not inflate to its ${member.size} bytes`);
+    }
+}
+/**
+ * One file of a zip archive as text, read in-process; `undefined` when the archive lacks it.
+ * An archive Talos can't read safely (damaged, encrypted, zip64, another compression method, a
+ * file over `maxBytes`, a name with `..` or an absolute path) throws an `EngineError`.
+ */
+export function extractFile(archive, file, maxBytes = MAX_MEMBER) {
+    if (hostile(file) || !/^\w[\w./-]*$/.test(file)) {
+        throw new TypeError(`not a plain file name inside an archive: ${file}`);
+    }
+    const zip = Buffer.from(archive.buffer, archive.byteOffset, archive.byteLength);
+    const { listed, directory } = members(zip);
+    const member = listed.find((candidate) => candidate.name === file);
+    if (member === undefined)
+        return undefined;
+    const data = unpacked(packedData(zip, member, directory, maxBytes), member);
+    if (data.length !== member.size || crc32(data) !== member.crc) {
+        refuse(`${file} fails its checksum`);
+    }
+    return data.toString('utf8');
+}
+function tooLarge(name) {
+    return new GitHubError(`artifact ${name} is over ${MAX_ARCHIVE} bytes`, 413);
+}
+/**
+ * A file from a workflow run's artifact, read in memory; `undefined` when the run has no such
+ * artifact, it expired, or it lacks the file. An archive it can't read throws an `EngineError`.
+ */
+export async function readArtifactFile(gh, download, wanted) {
+    const artifacts = await listRunArtifacts(gh, wanted.repo, wanted.runId);
+    const artifact = artifacts.find((a) => a.name === wanted.artifact && !a.expired);
+    if (artifact === undefined)
+        return undefined;
+    if (artifact.size_in_bytes > MAX_ARCHIVE)
+        throw tooLarge(artifact.name);
+    const archive = await download(`repos/${wanted.repo}/actions/artifacts/${artifact.id}/zip`);
+    if (archive.byteLength > MAX_ARCHIVE)
+        throw tooLarge(artifact.name);
+    return extractFile(archive, wanted.file);
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/github/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../src/github/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAe,WAAW,EAAsB,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAK/C,MAAM,GAAG,GAAG,wBAAwB,CAAC;AACrC,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACtC,sFAAsF;AACtF,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpC,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,UAAyB,EAAE;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;QACzF,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC/B,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,6BAA6B;gBACrC,sBAAsB,EAAE,YAAY;gBACpC,YAAY,EAAE,gBAAgB;aAC/B;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,2FAA2F;QAC3F,0EAA0E;QAC1E,MAAM,QAAQ,GACZ,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,KAAK,IAAI;YAC5D,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;YACzB,CAAC,CAAC,KAAK,CAAC;QACZ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5F,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AAEH,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,iFAAiF;AACjF,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,0EAA0E;AAC1E,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAcnB,SAAS,MAAM,CAAC,GAAW;IACzB,MAAM,IAAI,WAAW,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,kGAAkG;AAClG,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;IACnC,KAAK,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;QACnE,IACE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,gBAAgB;YACzC,EAAE,GAAG,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,EACxD,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ;QAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,YAAY,CAAC,KAAK,aAAa,CAAC;IAC5F,IAAI,KAAK,IAAI,KAAK,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QAClF,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5B,CAAC;IACD,6EAA6E;IAC7E,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC3E,MAAM,CAAC,+BAA+B,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,KAAK,GAAG,IAAI,GAAG,GAAG;QAAE,MAAM,CAAC,gDAAgD,CAAC,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,gGAAgG;AAChG,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,CACL,IAAI,KAAK,EAAE;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,EAAU,EAAE,SAAoB;IAC7D,IAAI,EAAE,GAAG,UAAU,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,eAAe,EAAE,CAAC;QAChF,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG;QAAE,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,0CAA0C,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG;QACb,IAAI;QACJ,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;QACjC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;QACjC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;QAC/B,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC;KACjC,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,0FAA0F;AAC1F,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,EAAE,GAAG,IAAI,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,SAAoB,EAAE,QAAgB;IACrF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAChG,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ;QAAE,MAAM,CAAC,GAAG,IAAI,mBAAmB,QAAQ,QAAQ,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,IAAI,8BAA8B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,KAAK,GAAG,UAAU,GAAG,SAAS,CAAC,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,CAAC;QACrF,MAAM,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAC/F,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,KAAK;QAAE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,8FAA8F;QAC9F,OAAO,cAAc,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,4BAA4B,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,IAAY,EACZ,WAAmB,UAAU;IAE7B,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,WAAW,CAAC,YAAY,IAAI,YAAY,WAAW,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC/E,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,QAAkB,EAClB,MAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,QAAQ,CAAC,aAAa,GAAG,WAAW;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,MAAM,CAAC,IAAI,sBAAsB,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,UAAU,GAAG,WAAW;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpE,OAAO,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/github/checks.js

@@ -0,0 +1,86 @@
+import { z } from 'zod';
+/** What a check run and a workflow job both report about running. */
+export const runFields = {
+    status: z.string(),
+    conclusion: z.string().nullable(),
+    started_at: z.string().nullable().optional(),
+    completed_at: z.string().nullable().optional(),
+};
+const checkRunSchema = z.object({
+    id: z.number().int(),
+    name: z.string(),
+    head_sha: z.string(),
+    ...runFields,
+    details_url: z.string().nullable().optional(),
+    external_id: z.string().nullable().optional(),
+    app: z.object({ id: z.number().int(), slug: z.string().optional() }).nullable().optional(),
+});
+/** The latest check runs on a commit (or branch or tag), optionally by name and App. */
+export async function listCheckRuns(gh, repo, ref, filter = {}) {
+    const query = new URLSearchParams({ filter: 'latest' });
+    if (filter.name !== undefined)
+        query.set('check_name', filter.name);
+    const raw = await gh.paginate(`repos/${repo}/commits/${encodeURIComponent(ref)}/check-runs?${query.toString()}`, 'check_runs');
+    const runs = z.array(checkRunSchema).parse(raw);
+    const app = filter.app?.replace(/\[bot\]$/, '');
+    return app === undefined ? runs : runs.filter((run) => run.app?.slug === app);
+}
+const MAX_ANNOTATIONS = 50;
+const MAX_TEXT = 65_535;
+function limited(text) {
+    return text.length <= MAX_TEXT ? text : `${text.slice(0, MAX_TEXT - 1)}…`;
+}
+function defined(fields) {
+    return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
+}
+function body(fields) {
+    const { output } = fields;
+    return defined({
+        status: fields.status,
+        conclusion: fields.conclusion,
+        completed_at: fields.conclusion === undefined
+            ? undefined
+            : (fields.completedAt ?? new Date()).toISOString(),
+        details_url: fields.detailsUrl,
+        external_id: fields.externalId,
+        output: output === undefined
+            ? undefined
+            : defined({
+                title: output.title,
+                summary: limited(output.summary),
+                text: output.text === undefined ? undefined : limited(output.text),
+                annotations: output.annotations?.slice(0, MAX_ANNOTATIONS),
+            }),
+    });
+}
+/** Creates a check run on `headSha`; needs `checks: write`, which only an App token has. */
+export async function createCheckRun(gh, repo, run) {
+    const raw = await gh.request('POST', `repos/${repo}/check-runs`, {
+        body: { name: run.name, head_sha: run.headSha, ...body(run) },
+    });
+    return checkRunSchema.parse(raw);
+}
+export async function updateCheckRun(gh, repo, id, fields) {
+    const raw = await gh.request('PATCH', `repos/${repo}/check-runs/${id}`, {
+        body: body(fields),
+    });
+    return checkRunSchema.parse(raw);
+}
+const GREEN = new Set(['success', 'neutral', 'skipped']);
+const RED = new Set(['failure', 'cancelled', 'timed_out', 'action_required', 'startup_failure']);
+/**
+ * One state for a set of runs (REST's lower case or GraphQL's upper case): red when any failed,
+ * else pending while any is unfinished, green when all passed, unknown when there are none or a
+ * conclusion says nothing (`stale`).
+ */
+export function stateOf(runs) {
+    if (runs.length === 0)
+        return 'unknown';
+    const conclusions = runs.map((run) => run.conclusion?.toLowerCase() ?? null);
+    if (conclusions.some((c) => c !== null && RED.has(c)))
+        return 'red';
+    if (runs.some((run) => run.status.toLowerCase() !== 'completed'))
+        return 'pending';
+    return conclusions.every((c) => c !== null && GREEN.has(c)) ? 'green' : 'unknown';
+}
+//# sourceMappingURL=checks.js.map

package/dist/github/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/github/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,qEAAqE;AACrE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC/C,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,GAAG,SAAS;IACZ,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3F,CAAC,CAAC;AAWH,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,IAAY,EACZ,GAAW,EACX,SAAyB,EAAE;IAE3B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC3B,SAAS,IAAI,YAAY,kBAAkB,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,QAAQ,EAAE,EAAE,EACjF,YAAY,CACb,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK,GAAG,CAAC,CAAC;AAChF,CAAC;AAgCD,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,MAA+B;IAC9C,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,IAAI,CAAC,MAAsB;IAClC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,OAAO,OAAO,CAAC;QACb,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EACV,MAAM,CAAC,UAAU,KAAK,SAAS;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACtD,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,MAAM,EACJ,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC;gBACN,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;aAC3D,CAAC;KACT,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,IAAY,EACZ,GAAyE;IAEzE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,MAAM,EAAE,SAAS,IAAI,aAAa,EAAE;QACxE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;KAC9D,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,IAAY,EACZ,EAAU,EACV,MAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,OAAO,EAAE,SAAS,IAAI,eAAe,EAAE,EAAE,EAAE;QAC/E,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;KACnB,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAKD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEjG;;;;GAIG;AACH,MAAM,UAAU,OAAO,CACrB,IAAgF;IAEhF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,CAAC;IAC7E,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC"}

package/dist/github/contents.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import { GitHubError } from './api.js';
+const fileSchema = z.object({
+    type: z.literal('file'),
+    encoding: z.string(),
+    content: z.string(),
+    sha: z.string(),
+});
+const blobSchema = z.object({ encoding: z.literal('base64'), content: z.string() });
+function encodePath(path) {
+    return path
+        .split('/')
+        .filter((part) => part !== '')
+        .map(encodeURIComponent)
+        .join('/');
+}
+function decode(base64) {
+    return Buffer.from(base64.replaceAll('\n', ''), 'base64').toString('utf8');
+}
+/**
+ * A file's text at a ref (branch, tag or commit SHA) through the contents API, or `undefined`
+ * when the path doesn't exist there.
+ */
+export async function readFileAt(gh, repo, path, ref) {
+    const url = `repos/${repo}/contents/${encodePath(path)}?ref=${encodeURIComponent(ref)}`;
+    const raw = await gh.request('GET', url, { allowMissing: true });
+    if (raw === undefined)
+        return undefined;
+    const parsed = fileSchema.safeParse(raw);
+    if (!parsed.success)
+        throw new GitHubError(`GET contents of ${path} at ${ref}: not a file`, 200);
+    if (parsed.data.encoding === 'base64')
+        return decode(parsed.data.content);
+    // Files over 1 MB come without content; the blob API serves them up to 100 MB.
+    const blob = blobSchema.parse(await gh.request('GET', `repos/${repo}/git/blobs/${parsed.data.sha}`));
+    return decode(blob.content);
+}
+//# sourceMappingURL=contents.js.map

package/dist/github/contents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contents.js","sourceRoot":"","sources":["../../src/github/contents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAe,WAAW,EAAE,MAAM,UAAU,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEpF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC7B,GAAG,CAAC,kBAAkB,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,IAAY,EACZ,IAAY,EACZ,GAAW;IAEX,MAAM,GAAG,GAAG,SAAS,IAAI,aAAa,UAAU,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;IACxF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,mBAAmB,IAAI,OAAO,GAAG,cAAc,EAAE,GAAG,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,+EAA+E;IAC/E,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAC3B,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,IAAI,cAAc,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAC/E,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/github/gate-runs.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+/** Where the gate's workflow lives: only a run of this file can speak for the gate. */
+const GATE_PATH = '.github/workflows/gate.yml';
+/**
+ * Whether a run's workflow file is Talos's gate. A repository, or a PR, can add a workflow of its
+ * own that runs on the same events and uploads an artifact called `talos-verdict`, so neither the
+ * event nor the artifact's name says a run was the gate: the file's repository does.
+ */
+export function isGateFile(file, talosRepo) {
+    if (file === null)
+        return false;
+    const repository = file.repositoryName.toLowerCase().replace(/^https:\/\/github\.com\//, '');
+    return repository === talosRepo.toLowerCase() && file.path === GATE_PATH;
+}
+const listSchema = z.object({
+    workflow_runs: z.array(z.object({
+        id: z.number().int(),
+        node_id: z.string(),
+        created_at: z.string(),
+        head_branch: z.string().nullable(),
+    })),
+});
+const FILES_QUERY = `
+query TalosRunFiles($ids: [ID!]!) {
+  nodes(ids: $ids) {
+    ... on WorkflowRun { databaseId file { path repositoryName } }
+  }
+}`;
+const filesSchema = z.object({
+    nodes: z.array(z
+        .object({
+        databaseId: z.number().int().optional(),
+        file: z.object({ path: z.string(), repositoryName: z.string() }).nullable().optional(),
+    })
+        .nullable()),
+});
+/**
+ * The gate's runs in the merge queue since `since`, newest first, at most a hundred. Only the
+ * merge queue runs code that review has passed, and only the gate's own file speaks for it.
+ */
+export async function queueGateRuns(gh, repo, at) {
+    const created = encodeURIComponent(`>=${at.since.toISOString().slice(0, 10)}`);
+    const query = `event=merge_group&created=${created}&per_page=100`;
+    const runs = listSchema
+        .parse(await gh.request('GET', `repos/${repo}/actions/runs?${query}`))
+        .workflow_runs.filter((r) => Date.parse(r.created_at) >= at.since.getTime());
+    if (runs.length === 0)
+        return [];
+    const ids = runs.map((r) => r.node_id);
+    const files = filesSchema.parse(await gh.graphql(FILES_QUERY, { ids }));
+    const gate = new Set(files.nodes.flatMap((node) => node?.databaseId !== undefined && isGateFile(node.file ?? null, at.talosRepo)
+        ? [node.databaseId]
+        : []));
+    return runs
+        .filter((r) => gate.has(r.id))
+        .map((r) => ({ id: r.id, headBranch: r.head_branch ?? '', createdAt: r.created_at }))
+        .sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+}
+//# sourceMappingURL=gate-runs.js.map

package/dist/github/gate-runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-runs.js","sourceRoot":"","sources":["../../src/github/gate-runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,uFAAuF;AACvF,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAuE,EACvE,SAAiB;IAEjB,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,UAAU,KAAK,SAAS,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,KAAK,CACpB,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG;;;;;EAKlB,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CACZ,CAAC;SACE,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACvF,CAAC;SACD,QAAQ,EAAE,CACd;CACF,CAAC,CAAC;AASH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,IAAY,EACZ,EAAwD;IAExD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,6BAA6B,OAAO,eAAe,CAAC;IAClE,MAAM,IAAI,GAAG,UAAU;SACpB,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,IAAI,iBAAiB,KAAK,EAAE,CAAC,CAAC;SAC9E,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAU,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC;QAC3E,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QACnB,CAAC,CAAC,EAAE,CACP,CACF,CAAC;IACF,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;SACpF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/github/identities.js

@@ -0,0 +1,29 @@
+function bot(slug) {
+    return `${slug}[bot]`;
+}
+/** An unset organisation variable reaches a workflow as an empty string. */
+function setting(value, fallback) {
+    return value === undefined || value === '' ? fallback : value;
+}
+export function identities(env) {
+    const org = setting(env.TALOS_ORG, 'SVP-Labs');
+    return {
+        owner: setting(env.TALOS_OWNER, 'SvenPGH'),
+        thea: bot(setting(env.TALOS_THEA_APP, 'thea-svp')),
+        reviewer: bot(setting(env.TALOS_REVIEWER_APP, 'talos-reviewer')),
+        release: bot(setting(env.TALOS_RELEASE_APP, 'talos-release')),
+        org,
+        talosRepo: `${org}/Talos`,
+    };
+}
+export const DEPENDABOT = 'dependabot[bot]';
+/**
+ * Whether two logins name the same account. GitHub matches logins without case, in CODEOWNERS
+ * too, so a configured identity written in another case than the API returns is still that one.
+ */
+export function sameLogin(a, b) {
+    if (a === undefined || b === undefined)
+        return false;
+    return a.toLowerCase() === b.toLowerCase();
+}
+//# sourceMappingURL=identities.js.map

package/dist/github/identities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identities.js","sourceRoot":"","sources":["../../src/github/identities.ts"],"names":[],"mappings":"AAmBA,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,GAAG,IAAI,OAAO,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,SAAS,OAAO,CAAC,KAAyB,EAAE,QAAgB;IAC1D,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAiD;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/C,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;QAC1C,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAClD,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;QAChE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;QAC7D,GAAG;QACH,SAAS,EAAE,GAAG,GAAG,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,CAAqB,EAAE,CAAqB;IACpE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC"}

package/dist/github/org-variables.js

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import { GitHubError } from './api.js';
+import { identities } from './identities.js';
+/** The organisation variables the caller workflow passes as identities, which a local run reads. */
+const VARIABLES = ['TALOS_OWNER', 'TALOS_THEA_APP', 'TALOS_REVIEWER_APP', 'TALOS_RELEASE_APP'];
+const variableSchema = z.object({ name: z.string(), value: z.string() });
+/**
+ * One organisation Actions variable, as the owner's token reads it; `undefined` when the
+ * organisation has none of that name, and a refusal tells `warn` which default stands in.
+ */
+async function orgVariable(gh, org, name, warn) {
+    try {
+        const path = `orgs/${encodeURIComponent(org)}/actions/variables/${name}`;
+        return variableSchema.parse(await gh.request('GET', path)).value;
+    }
+    catch (error) {
+        if (!(error instanceof GitHubError))
+            throw error;
+        if (error.status !== 404) {
+            warn(`could not read ${org}'s variable ${name} (${String(error.status)}), so its default ` +
+                `stands in: set ${name} to choose, or run \`gh auth refresh -s admin:org\``);
+        }
+        return undefined;
+    }
+}
+/**
+ * The identities an owner's command runs as. In a workflow they come from the organisation's
+ * variables through the environment; locally, each one the environment leaves unset is read from
+ * those variables, so the owner's terminal names the same Apps as the jobs. The environment wins.
+ */
+export async function ownerIdentities(gh, env, warn) {
+    const { org } = identities(env);
+    const read = await Promise.all(VARIABLES.map(async (name) => {
+        const own = env[name];
+        if (own !== undefined && own !== '')
+            return [name, own];
+        return [name, await orgVariable(gh, org, name, warn)];
+    }));
+    return identities({ ...env, ...Object.fromEntries(read) });
+}
+//# sourceMappingURL=org-variables.js.map

package/dist/github/org-variables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-variables.js","sourceRoot":"","sources":["../../src/github/org-variables.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAe,WAAW,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,UAAU,EAAmB,MAAM,iBAAiB,CAAC;AAI9D,oGAAoG;AACpG,MAAM,SAAS,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;AAE/F,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzE;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,GAAW,EACX,IAAY,EACZ,IAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,kBAAkB,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QACzE,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACzB,IAAI,CACF,kBAAkB,GAAG,eAAe,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB;gBACnF,kBAAkB,IAAI,qDAAqD,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAU,EACV,GAAQ,EACR,IAA4B;IAE5B,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAU,CAAC;QACjE,OAAO,CAAC,IAAI,EAAE,MAAM,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAU,CAAC;IACjE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,UAAU,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC7D,CAAC"}

package/dist/github/pulls.js

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+const pullSchema = z.object({
+    number: z.number().int(),
+    title: z.string(),
+    body: z.string().nullable().optional(),
+    state: z.string(),
+    merged_at: z.string().nullable().optional(),
+    html_url: z.string(),
+    user: z.object({ login: z.string() }).nullable().optional(),
+    base: z.object({ ref: z.string() }),
+});
+/**
+ * The pull requests a commit belongs to: for a commit on the default branch, the one that
+ * merged it.
+ */
+export async function pullsForCommit(gh, repo, sha) {
+    const raw = await gh.request('GET', `repos/${repo}/commits/${sha}/pulls`);
+    return z
+        .array(pullSchema)
+        .parse(raw)
+        .map((pull) => ({
+        number: pull.number,
+        title: pull.title,
+        body: pull.body ?? '',
+        state: pull.state,
+        mergedAt: pull.merged_at ?? null,
+        url: pull.html_url,
+        author: pull.user?.login ?? null,
+        base: pull.base.ref,
+    }));
+}
+//# sourceMappingURL=pulls.js.map

package/dist/github/pulls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pulls.js","sourceRoot":"","sources":["../../src/github/pulls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACpC,CAAC,CAAC;AAcH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,IAAY,EACZ,GAAW;IAEX,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,SAAS,IAAI,YAAY,GAAG,QAAQ,CAAC,CAAC;IACnF,OAAO,CAAC;SACL,KAAK,CAAC,UAAU,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QAChC,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI;QAChC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;KACpB,CAAC,CAAC,CAAC;AACR,CAAC"}

package/dist/github/remote.js

@@ -0,0 +1,26 @@
+import { repoFromRemote } from './api.js';
+const NAME = /^[\w.-]+\/[\w.-]+$/;
+/** Whether `text` is an `owner/name` GitHub accepts. */
+export function isRepoName(text) {
+    return NAME.test(text);
+}
+/**
+ * The GitHub repository a command acts on: `GITHUB_REPOSITORY` in Actions, else the `origin`
+ * remote of the clone at `cwd`; `undefined` when neither names one.
+ */
+export async function currentRepository(env, cwd, exec) {
+    const fromEnv = env.GITHUB_REPOSITORY;
+    if (fromEnv !== undefined && isRepoName(fromEnv))
+        return fromEnv;
+    try {
+        const result = await exec('git', ['remote', 'get-url', 'origin'], { cwd, timeoutMs: 10_000 });
+        if (result.code !== 0)
+            return undefined;
+        const repo = repoFromRemote(result.stdout);
+        return repo !== undefined && isRepoName(repo) ? repo : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=remote.js.map

package/dist/github/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/github/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,IAAI,GAAG,oBAAoB,CAAC;AAElC,wDAAwD;AACxD,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAiD,EACjD,GAAW,EACX,IAAU;IAEV,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9F,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/github/repos.js

@@ -0,0 +1,64 @@
+import { z } from 'zod';
+const propertyValue = z.union([z.string(), z.array(z.string()), z.null()]);
+/** `GET repos/{repo}/properties/values`: each custom property's value on a repository. */
+export const propertyValuesSchema = z.array(z.object({ property_name: z.string(), value: propertyValue }));
+const repositorySchema = z.object({
+    id: z.number().int(),
+    full_name: z.string(),
+    default_branch: z.string().optional(),
+    archived: z.boolean().default(false),
+    private: z.boolean().default(false),
+    custom_properties: z.record(z.string(), propertyValue).optional(),
+});
+function toRepository(raw) {
+    return {
+        id: raw.id,
+        fullName: raw.full_name,
+        defaultBranch: raw.default_branch ?? 'main',
+        archived: raw.archived,
+        private: raw.private,
+        properties: raw.custom_properties ?? {},
+    };
+}
+export async function getRepository(gh, repo) {
+    return toRepository(repositorySchema.parse(await gh.request('GET', `repos/${repo}`)));
+}
+/** Every repository of `org` the token can see, archived ones included. */
+export async function listOrgRepositories(gh, org) {
+    const raw = await gh.paginate(`orgs/${encodeURIComponent(org)}/repos?type=all`);
+    return z.array(repositorySchema).parse(raw).map(toRepository);
+}
+/** The repositories an App installation token reaches (`GET /installation/repositories`). */
+export async function listInstallationRepositories(gh) {
+    const raw = await gh.paginate('installation/repositories', 'repositories');
+    return z.array(repositorySchema).parse(raw).map(toRepository);
+}
+const propertyRowSchema = z.object({
+    repository_id: z.number().int(),
+    repository_full_name: z.string(),
+    properties: propertyValuesSchema,
+});
+/**
+ * The organisation's repositories with their custom property values
+ * (`GET /orgs/{org}/properties/values`), narrowed by `query`, a repository search such as
+ * `is:private`. An organisation permission (Custom properties, read) is enough, so a token that
+ * reaches no repository can list them.
+ */
+export async function listPropertyValues(gh, org, query) {
+    const search = query === undefined ? '' : `?repository_query=${encodeURIComponent(query)}`;
+    const raw = await gh.paginate(`orgs/${encodeURIComponent(org)}/properties/values${search}`);
+    return z
+        .array(propertyRowSchema)
+        .parse(raw)
+        .map((row) => ({
+        id: row.repository_id,
+        fullName: row.repository_full_name,
+        properties: Object.fromEntries(row.properties.map((p) => [p.property_name, p.value])),
+    }));
+}
+/** A single-valued custom property, or `undefined` when it is unset or multi-valued. */
+export function propertyOf(repository, name) {
+    const value = repository.properties[name];
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+//# sourceMappingURL=repos.js.map