@wascartech/devbot 0.0.0-stage → 2.1.0

package/dist/platform/gitealike/base.js

@@ -0,0 +1,935 @@
+// Shared Gitea/ForgeJo driver. Implements every capability against the /api/v1
+// surface. ForgeJo and Gitea differ only in the platform id, webhook header
+// names, and OAuth endpoint paths (see forgejo.ts / gitea.ts).
+import { z } from "zod";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { config } from "../../config.js";
+import { log } from "../../logger.js";
+import { PlatformHttpError, UnsupportedError, tailFileContent } from "../types.js";
+import { gitExtraHeaderGitea } from "../git-auth.js";
+import { findGiteaAttachmentRefs, downloadGiteaAttachment, uploadGiteaAttachment } from "./attachments.js";
+import { GiteaActionJobSchema, GiteaActionRunSchema, GiteaBranchSchema, GiteaCollaboratorSchema, GiteaCommentSchema, GiteaCommitSchema, GiteaCompareSchema, GiteaContentSchema, GiteaIssueCommentPayloadSchema, GiteaIssuePayloadSchema, GiteaIssueSchema, GiteaLabelSchema, GiteaMilestoneSchema, GiteaPermissionsSchema, GiteaPullRequestPayloadSchema, GiteaPullRequestSchema, GiteaReleaseSchema, GiteaRepositorySchema, GiteaReviewCommentSchema, GiteaReviewSchema, GiteaTagSchema, GiteaUserSchema, GiteaWebhookSchema, GiteaWikiPageSchema, GiteaWorkflowRunPayloadSchema, } from "./schemas.js";
+import { giteaRequest, giteaRequestArray, giteaFetchRaw, giteaVoid, pageParams } from "./http.js";
+const BOT = { kind: "bot" };
+// ---- Mappers ---------------------------------------------------------------
+function splitFullName(fullName) {
+    const idx = fullName.indexOf("/");
+    if (idx === -1)
+        return { owner: "", repo: fullName };
+    return { owner: fullName.slice(0, idx), repo: fullName.slice(idx + 1) };
+}
+function mapRepo(r) {
+    return {
+        id: r.id,
+        path: r.full_name,
+        webUrl: r.html_url ?? "",
+        cloneUrl: r.clone_url || `${config.PLATFORM_URL.replace(/\/$/, "")}/${r.full_name}.git`,
+        defaultBranch: r.default_branch ?? null,
+    };
+}
+function mapWorkItemState(state) {
+    return state;
+}
+function mapUser(u) {
+    if (!u)
+        return undefined;
+    return { id: u.id, username: u.login, name: u.full_name || u.login };
+}
+function mapIssue(i) {
+    const assignees = i.assignees && i.assignees.length > 0 ? i.assignees : i.assignee ? [i.assignee] : [];
+    return {
+        id: i.id,
+        number: i.number,
+        title: i.title,
+        description: i.body ?? "",
+        state: mapWorkItemState(i.state),
+        webUrl: i.html_url ?? "",
+        ...(i.user ? { author: { id: i.user.id } } : {}),
+        ...(assignees.length > 0 ? { assignees: assignees.map((a) => ({ id: a.id })) } : {}),
+    };
+}
+function mapIssueSummary(i) {
+    const who = mapUser(i.user);
+    return {
+        id: i.id,
+        number: i.number,
+        title: i.title,
+        state: mapWorkItemState(i.state),
+        webUrl: i.html_url ?? "",
+        ...(i.body != null ? { description: i.body } : {}),
+        ...(i.labels ? { labels: i.labels.map((l) => l.name) } : {}),
+        ...(i.assignees
+            ? { assignees: i.assignees.map((a) => ({ id: a.id, username: a.login, name: a.full_name || a.login })) }
+            : {}),
+        ...(who ? { author: who } : {}),
+        ...(i.created_at ? { createdAt: i.created_at } : {}),
+        ...(i.due_date !== undefined ? { dueDate: i.due_date } : {}),
+    };
+}
+function mapComment(c) {
+    const who = mapUser(c.user);
+    return {
+        id: c.id,
+        body: c.body,
+        ...(who ? { author: who } : {}),
+        ...(c.created_at ? { createdAt: c.created_at } : {}),
+    };
+}
+function mapPrState(pr) {
+    if (pr.merged)
+        return "merged";
+    if (pr.state === "open")
+        return "open";
+    if (pr.state === "closed")
+        return "closed";
+    return pr.state;
+}
+function mapPr(pr) {
+    return {
+        id: pr.id,
+        number: pr.number,
+        title: pr.title,
+        state: mapPrState(pr),
+        sourceBranch: pr.head?.ref ?? "",
+        targetBranch: pr.base?.ref ?? "",
+        webUrl: pr.html_url ?? "",
+        ...(pr.draft !== undefined ? { draft: pr.draft } : {}),
+    };
+}
+function mapPrSummary(pr) {
+    const who = mapUser(pr.user);
+    return {
+        id: pr.id,
+        number: pr.number,
+        title: pr.title,
+        state: mapPrState(pr),
+        webUrl: pr.html_url ?? "",
+        ...(pr.body != null ? { description: pr.body } : {}),
+        ...(pr.head ? { sourceBranch: pr.head.ref } : {}),
+        ...(pr.base ? { targetBranch: pr.base.ref } : {}),
+        ...(who ? { author: who } : {}),
+        ...(pr.created_at ? { createdAt: pr.created_at } : {}),
+        ...(pr.updated_at ? { updatedAt: pr.updated_at } : {}),
+        ...(pr.merged_at !== undefined ? { mergedAt: pr.merged_at } : {}),
+        ...(pr.draft !== undefined ? { draft: pr.draft } : {}),
+    };
+}
+function mapCommit(c) {
+    const msg = c.commit?.message ?? "";
+    const [title, ...rest] = msg.split("\n");
+    return {
+        id: c.sha,
+        title: (title ?? "").trim(),
+        ...(rest.length ? { message: msg } : {}),
+        ...(c.commit?.author?.name ? { authorName: c.commit.author.name } : {}),
+        ...(c.commit?.author?.date ? { authoredDate: c.commit.author.date } : {}),
+        ...(c.html_url ? { webUrl: c.html_url } : {}),
+    };
+}
+function mapCompare(c) {
+    return {
+        commits: (c.commits ?? []).map((x) => {
+            const title = x.commit?.message ? x.commit.message.split("\n")[0]?.trim() : undefined;
+            return {
+                id: x.sha,
+                ...(title ? { title } : {}),
+                ...(x.commit?.author?.name ? { authorName: x.commit.author.name } : {}),
+                ...(x.commit?.author?.date ? { createdAt: x.commit.author.date } : {}),
+            };
+        }),
+        ...(c.files
+            ? {
+                diffs: c.files.map((f) => ({
+                    oldPath: f.filename,
+                    newPath: f.filename,
+                    ...(f.patch ? { diff: f.patch } : {}),
+                })),
+            }
+            : {}),
+    };
+}
+function normalizeRole(role, admin, push) {
+    const r = (role ?? "").toLowerCase();
+    if (r === "owner")
+        return "owner";
+    if (r === "admin" || admin)
+        return "admin";
+    if (r === "write" || r === "maintainer" || push)
+        return "write";
+    if (r === "read" || r === "reporter")
+        return "read";
+    return undefined;
+}
+// Derive the actor's normalized permission from a webhook payload. The forge
+// computes `repository.permissions` for the payload's permission holder (the
+// comment author / issue poster) and exposes it because it is that user's own
+// permission, so it is only meaningful when the event sender is also that holder
+// — otherwise the gate would attribute the wrong user's role to the actor.
+// `repository.owner` is checked first, and without needing the permissions block,
+// because the owner is knowable from the signed payload alone and a bot PAT can
+// never read it back through the admin-only permission endpoint.
+function permissionHint(repo, actor, holder) {
+    if (!actor || !holder || actor.id !== holder.id)
+        return undefined;
+    const ownerLogin = repo.owner?.login;
+    if (ownerLogin && ownerLogin.toLowerCase() === actor.username.toLowerCase())
+        return "owner";
+    if (!repo.permissions)
+        return undefined;
+    const p = repo.permissions;
+    if (p.admin)
+        return "admin";
+    if (p.push)
+        return "write";
+    if (p.pull)
+        return "read";
+    return "none";
+}
+// ---- Driver ----------------------------------------------------------------
+export function createGiteaLikePlatform(opts) {
+    const { platform, eventHeader, signatureHeader, deliveryHeader } = opts;
+    const apiBase = () => `${config.PLATFORM_URL.replace(/\/$/, "")}/api/v1`;
+    function repoPath(fullName) {
+        const { owner, repo } = splitFullName(fullName);
+        return `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+    }
+    // Numeric repo id -> full_name cache. The MCP + runner only carry ids.
+    const fullNameCache = new Map();
+    async function fullNameOf(repoId) {
+        const hit = fullNameCache.get(repoId);
+        if (hit)
+            return hit;
+        const repo = await giteaRequest(`/repositories/${repoId}`, { method: "GET" }, GiteaRepositorySchema, BOT);
+        fullNameCache.set(repoId, repo.full_name);
+        return repo.full_name;
+    }
+    // ---- Ingress -------------------------------------------------------------
+    const ingress = {
+        platform,
+        eventName(headers) {
+            const v = headers[eventHeader];
+            return Array.isArray(v) ? v[0] : v;
+        },
+        projectIdFromBody(body) {
+            const raw = body?.repository?.id;
+            return typeof raw === "number" ? raw : undefined;
+        },
+        deliveryId(headers) {
+            const v = headers[deliveryHeader];
+            return Array.isArray(v) ? v[0] : v;
+        },
+        verifySignature(secret, headers, rawBody) {
+            const v = headers[signatureHeader];
+            const sig = Array.isArray(v) ? v[0] : v;
+            if (!sig || !secret)
+                return false;
+            const digest = createHmac("sha256", secret).update(rawBody).digest("hex");
+            const got = Buffer.from(sig, "utf8");
+            const exp = Buffer.from(digest, "utf8");
+            if (got.length !== exp.length)
+                return false;
+            return timingSafeEqual(got, exp);
+        },
+        generateWebhookSecret() {
+            return randomBytes(32).toString("hex");
+        },
+        parseWebhook(headers, body) {
+            const event = this.eventName(headers);
+            if (event === "issue_comment") {
+                const p = GiteaIssueCommentPayloadSchema.safeParse(body);
+                if (!p.success)
+                    return null;
+                const d = p.data;
+                if (d.action !== "created")
+                    return null;
+                const actor = mapUser(d.sender);
+                const hint = permissionHint(d.repository, actor, d.comment.user);
+                return {
+                    kind: "comment",
+                    rawEvent: event,
+                    repo: mapRepo(d.repository),
+                    workItem: mapIssue(d.issue),
+                    actor,
+                    body: d.comment.body,
+                    commentId: d.comment.id,
+                    ...(hint ? { actorPermission: hint } : {}),
+                };
+            }
+            if (event === "issues") {
+                const p = GiteaIssuePayloadSchema.safeParse(body);
+                if (!p.success)
+                    return null;
+                const d = p.data;
+                if (d.action === "closed") {
+                    return {
+                        kind: "workitem-close",
+                        rawEvent: event,
+                        repo: mapRepo(d.repository),
+                        workItem: mapIssue(d.issue),
+                        actor: mapUser(d.sender),
+                    };
+                }
+                if (d.action === "opened" || d.action === "reopened") {
+                    const actor = mapUser(d.sender);
+                    const hint = permissionHint(d.repository, actor, d.issue.user);
+                    return {
+                        kind: "workitem-open",
+                        rawEvent: event,
+                        repo: mapRepo(d.repository),
+                        workItem: mapIssue(d.issue),
+                        actor,
+                        body: d.issue.body ?? "",
+                        ...(hint ? { actorPermission: hint } : {}),
+                    };
+                }
+                return null;
+            }
+            if (event === "pull_request") {
+                const p = GiteaPullRequestPayloadSchema.safeParse(body);
+                if (!p.success)
+                    return null;
+                const d = p.data;
+                return {
+                    kind: "other",
+                    rawEvent: event,
+                    repo: mapRepo(d.repository),
+                    actor: mapUser(d.sender),
+                    ...(d.pull_request.head?.ref ? { sourceBranch: d.pull_request.head.ref } : {}),
+                };
+            }
+            if (event === "workflow_run") {
+                const p = GiteaWorkflowRunPayloadSchema.safeParse(body);
+                if (!p.success)
+                    return null;
+                const d = p.data;
+                if (d.action !== "completed")
+                    return null;
+                const run = d.workflow_run;
+                // GitHub-compatible payloads use `conclusion`; older ForgeJo uses
+                // `status`. Only a run that actually failed is actionable.
+                const failed = run.conclusion === "failure" || (run.conclusion == null && run.status === "failure");
+                if (!failed)
+                    return null;
+                const prNumber = run.pull_requests?.find((pr) => pr.number !== undefined)?.number;
+                return {
+                    kind: "pipeline-failed",
+                    rawEvent: event,
+                    repo: mapRepo(d.repository),
+                    ...(run.head_branch ? { sourceBranch: run.head_branch } : {}),
+                    pipelineId: run.id,
+                    ...(run.head_sha ? { commitSha: run.head_sha } : {}),
+                    ...(prNumber !== undefined ? { changeRequestNumber: prNumber } : {}),
+                };
+            }
+            return null;
+        },
+    };
+    // ---- Work items ----------------------------------------------------------
+    const workItems = {
+        async postComment(repoId, number, body) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments`, { method: "POST", body: JSON.stringify({ body }) }, GiteaCommentSchema, BOT);
+            return mapComment(r);
+        },
+        // Gitea/ForgeJo issue comments are flat, so a thread reply degrades to a
+        // top-level comment (still posts in the issue's comment stream).
+        async replyInThread(repoId, number, _commentId, body) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments`, { method: "POST", body: JSON.stringify({ body }) }, GiteaCommentSchema, BOT);
+            return mapComment(r);
+        },
+        async postErrorReply(repoId, number, _triggeringCommentId, body) {
+            try {
+                await giteaRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments`, { method: "POST", body: JSON.stringify({ body }) }, GiteaCommentSchema, BOT);
+            }
+            catch (e) {
+                // Best-effort, matching GitLab's postErrorReply swallow-and-log.
+                void e;
+            }
+        },
+        async listComments(repoId, number) {
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments?${pageParams(undefined, 100)}`, { method: "GET" }, GiteaCommentSchema, BOT);
+            return rs.map(mapComment);
+        },
+        async getWorkItem(repoId, number) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}`, { method: "GET" }, GiteaIssueSchema, BOT);
+            return mapIssue(r);
+        },
+        async getWorkItemStateOrNull(repoId, number) {
+            try {
+                const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}`, { method: "GET" }, GiteaIssueSchema, BOT);
+                return mapWorkItemState(r.state) === "closed" ? "closed" : "open";
+            }
+            catch (e) {
+                if (e instanceof PlatformHttpError && e.status === 404)
+                    return null;
+                throw e;
+            }
+        },
+        async getMemberPermission(repoId, user) {
+            // Gitea exposes effective repo permission by username. Prefer the actor's
+            // username (webhook payloads carry it); fall back to a users-by-id lookup
+            // where the instance supports it, else deny.
+            const full = await fullNameOf(repoId);
+            const { owner, repo } = splitFullName(full);
+            let login = user.username;
+            if (!login) {
+                try {
+                    const u = await giteaRequest(`/users/${user.id}`, { method: "GET" }, GiteaUserSchema, BOT);
+                    login = u.login;
+                }
+                catch (e) {
+                    if (e instanceof PlatformHttpError && e.status === 404)
+                        return "none";
+                    throw e;
+                }
+            }
+            try {
+                const p = await giteaRequest(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/collaborators/${encodeURIComponent(login)}/permission`, { method: "GET" }, GiteaPermissionsSchema, BOT);
+                return normalizeRole(p.permission ?? p.role_name, p.can_admin, p.can_write) ?? "none";
+            }
+            catch (e) {
+                // The per-user permission endpoint is restricted to site admins, repo
+                // admins, and the user themselves (see ForgeJo/Gitea
+                // routers/api/v1/repo/collaborators.go). A bot PAT therefore gets 403
+                // for anyone else — a policy response, not an infra failure. Map it to
+                // "none" (like 404) so the trigger gate can honor minRole=none instead
+                // of failing closed on the misleading lookup-failure note. 5xx still
+                // throws (fail-closed).
+                if (e instanceof PlatformHttpError && (e.status === 404 || e.status === 403))
+                    return "none";
+                throw e;
+            }
+        },
+        async searchUsers(query, opts = {}) {
+            const q = query.trim();
+            if (q === "")
+                return [];
+            const limit = Math.min(Math.max(opts.perPage ?? 20, 1), 50);
+            const rs = await giteaRequestArray(`/users/search?q=${encodeURIComponent(q)}&limit=${limit}`, { method: "GET" }, GiteaUserSchema, BOT);
+            return rs.slice(0, limit).map((u) => ({ id: u.id, username: u.login, name: u.full_name || u.login }));
+        },
+        async resolveUser(username) {
+            // Gitea/ForgeJo expose /users/search?q=<login> (prefix/substring match).
+            // Filter to an exact, case-insensitive login match so "alice" never
+            // resolves to "alice-bot". An empty result is a null (not-found).
+            const target = username.trim().toLowerCase();
+            if (!target)
+                return null;
+            const rs = await giteaRequestArray(`/users/search?q=${encodeURIComponent(username.trim())}&limit=50`, { method: "GET" }, GiteaUserSchema, BOT);
+            const hit = rs.find((u) => u.login.toLowerCase() === target);
+            return hit ? { id: hit.id, username: hit.login, name: hit.full_name || hit.login } : null;
+        },
+        async listWorkItems(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.state)
+                params.set("state", o.state);
+            if (o.search)
+                params.set("q", o.search);
+            if (o.labels)
+                params.set("labels", o.labels);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/issues?${params.toString()}`, { method: "GET" }, GiteaIssueSchema, BOT);
+            return rs.filter((i) => !i.pull_request).map(mapIssueSummary);
+        },
+        async getWorkItemSummary(repoId, number) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}`, { method: "GET" }, GiteaIssueSchema, BOT);
+            return mapIssueSummary(r);
+        },
+        async listCommentsFull(repoId, number, o = {}) {
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GiteaCommentSchema, BOT);
+            return rs.map(mapComment);
+        },
+        async listLabels(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.search)
+                params.set("q", o.search);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/labels?${params.toString()}`, { method: "GET" }, GiteaLabelSchema, BOT);
+            return rs.map((l) => ({
+                id: l.id,
+                name: l.name,
+                ...(l.color ? { color: l.color } : {}),
+                ...(l.description !== undefined ? { description: l.description } : {}),
+            }));
+        },
+        async listMilestones(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.state)
+                params.set("state", o.state);
+            if (o.title)
+                params.set("name", o.title);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/milestones?${params.toString()}`, { method: "GET" }, GiteaMilestoneSchema, BOT);
+            return rs.map((m) => ({
+                id: m.id,
+                number: m.id,
+                title: m.title,
+                state: m.state,
+                ...(m.description !== undefined ? { description: m.description } : {}),
+                ...(m.due_on !== undefined ? { dueDate: m.due_on } : {}),
+                ...(m.html_url ? { webUrl: m.html_url } : {}),
+            }));
+        },
+    };
+    // ---- Change requests -----------------------------------------------------
+    const changeRequests = {
+        async list(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            // Neutral port states map 1:1 to Gitea/ForgeJo wire values (open/closed/all).
+            if (o.state)
+                params.set("state", o.state);
+            if (o.search)
+                params.set("q", o.search);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/pulls?${params.toString()}`, { method: "GET" }, GiteaPullRequestSchema, BOT);
+            const filtered = o.sourceBranch ? rs.filter((p) => (p.head?.ref ?? "") === o.sourceBranch) : rs;
+            return filtered.map(mapPrSummary);
+        },
+        async create(repoId, input) {
+            const full = await fullNameOf(repoId);
+            const { owner, repo } = splitFullName(full);
+            const r = await giteaRequest(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls`, {
+                method: "POST",
+                body: JSON.stringify({
+                    title: input.title,
+                    body: input.description,
+                    head: input.sourceBranch,
+                    base: input.targetBranch,
+                    ...(input.assignee ? { assignees: [input.assignee.username] } : {}),
+                }),
+            }, GiteaPullRequestSchema, BOT);
+            return mapPr(r);
+        },
+        async update(repoId, number, input) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/pulls/${number}`, { method: "PATCH", body: JSON.stringify({ title: input.title, body: input.description }) }, GiteaPullRequestSchema, BOT);
+            return mapPr(r);
+        },
+        async get(repoId, number) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/pulls/${number}`, { method: "GET" }, GiteaPullRequestSchema, BOT);
+            return mapPrSummary(r);
+        },
+        async listReviewDiscussions(repoId, number, o = {}) {
+            const full = await fullNameOf(repoId);
+            const reviews = await giteaRequestArray(`${repoPath(full)}/pulls/${number}/reviews?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GiteaReviewSchema, BOT).catch(() => []);
+            const comments = await giteaRequestArray(`${repoPath(full)}/pulls/${number}/reviews/0/comments?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GiteaReviewCommentSchema, BOT).catch(() => []);
+            const out = reviews.map((r) => ({
+                id: String(r.id),
+                individualNote: true,
+                notes: (r.comments ?? []).map((c) => ({
+                    id: c.id,
+                    body: c.body,
+                    ...(c.user ? { author: mapUser(c.user) } : {}),
+                    ...(c.created_at ? { createdAt: c.created_at } : {}),
+                    ...(c.path ? { position: { path: c.path, line: c.line } } : {}),
+                })),
+            }));
+            if (out.length === 0 && comments.length > 0) {
+                out.push({
+                    id: "reviews",
+                    individualNote: true,
+                    notes: comments.map((c) => ({
+                        id: c.id,
+                        body: c.body,
+                        ...(c.user ? { author: mapUser(c.user) } : {}),
+                        ...(c.created_at ? { createdAt: c.created_at } : {}),
+                        ...(c.path ? { position: { path: c.path, line: c.line } } : {}),
+                    })),
+                });
+            }
+            return out;
+        },
+        async listNotes(repoId, number, o = {}) {
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GiteaCommentSchema, BOT);
+            return rs.map(mapComment);
+        },
+    };
+    // ---- Repository ----------------------------------------------------------
+    async function defaultBranchOf(repoId) {
+        const repo = await giteaRequest(`/repositories/${repoId}`, { method: "GET" }, GiteaRepositorySchema, BOT);
+        return repo.default_branch ?? "main";
+    }
+    const repository = {
+        async getRepo(repoId) {
+            const repo = await giteaRequest(`/repositories/${repoId}`, { method: "GET" }, GiteaRepositorySchema, BOT);
+            // Heal the id -> full_name cache so a rename/transfer is picked up here
+            // and every later fullNameOf() call uses the new path.
+            fullNameCache.set(repoId, repo.full_name);
+            return mapRepo(repo);
+        },
+        async branchExists(repoId, branch) {
+            const full = await fullNameOf(repoId);
+            const res = await fetch(`${apiBase()}${repoPath(full)}/branches/${encodeURIComponent(branch)}`, {
+                headers: { Authorization: `token ${config.PLATFORM_TOKEN}` },
+            });
+            if (res.status === 404)
+                return false;
+            if (!res.ok)
+                throw new PlatformHttpError(res.status, `branchExists ${branch}`, await res.text());
+            return true;
+        },
+        async firstExistingBranch(repoId, branches) {
+            for (const b of branches) {
+                if (await repository.branchExists(repoId, b))
+                    return b;
+            }
+            return null;
+        },
+        async listBranches(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.search)
+                params.set("q", o.search);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/branches?${params.toString()}`, { method: "GET" }, GiteaBranchSchema, BOT);
+            return rs.map((b) => ({
+                name: b.name,
+                ...(b.protected !== undefined ? { protected: b.protected } : {}),
+            }));
+        },
+        async listTree(repoId, o = {}) {
+            const full = await fullNameOf(repoId);
+            const ref = o.ref ?? (await defaultBranchOf(repoId));
+            const sub = o.path ? `/${o.path.split("/").map(encodeURIComponent).join("/")}` : "";
+            const rs = await giteaRequestArray(`${repoPath(full)}/contents${sub}?ref=${encodeURIComponent(ref)}&${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GiteaContentSchema, BOT);
+            return rs.map((e) => ({
+                id: e.sha ?? "",
+                name: e.name,
+                type: e.type === "dir" ? "tree" : "blob",
+                path: e.path,
+            }));
+        },
+        async getFile(repoId, filePath, ref, maxBytes) {
+            const full = await fullNameOf(repoId);
+            const params = new URLSearchParams();
+            if (ref)
+                params.set("ref", ref);
+            const path = `${repoPath(full)}/raw/${filePath.split("/").map(encodeURIComponent).join("/")}${params.toString() ? `?${params.toString()}` : ""}`;
+            try {
+                const { bytes, contentType } = await giteaFetchRaw(path, BOT, maxBytes);
+                return { content: bytes.toString("utf8"), truncated: false, bytes: bytes.byteLength, contentType };
+            }
+            catch (e) {
+                if (e instanceof Error && e.name === "GiteaOversizedError") {
+                    return { content: "", truncated: true, bytes: maxBytes, contentType: "text/plain" };
+                }
+                throw e;
+            }
+        },
+        async listCommits(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.refName)
+                params.set("sha", o.refName);
+            if (o.path)
+                params.set("path", o.path);
+            if (o.since)
+                params.set("since", o.since);
+            if (o.until)
+                params.set("until", o.until);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/commits?${params.toString()}`, { method: "GET" }, GiteaCommitSchema, BOT);
+            return rs.map(mapCommit);
+        },
+        async getCommit(repoId, sha) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/git/commits/${encodeURIComponent(sha)}`, { method: "GET" }, GiteaCommitSchema, BOT);
+            return mapCommit(r);
+        },
+        async compare(repoId, from, to) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/compare/${encodeURIComponent(from)}...${encodeURIComponent(to)}`, { method: "GET" }, GiteaCompareSchema, BOT);
+            return mapCompare(r);
+        },
+        async listTags(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.search)
+                params.set("q", o.search);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/tags?${params.toString()}`, { method: "GET" }, GiteaTagSchema, BOT);
+            return rs.map((t) => ({
+                name: t.name,
+                ...(t.message !== undefined ? { message: t.message } : {}),
+                ...(t.commit?.sha ? { target: t.commit.sha } : {}),
+            }));
+        },
+        async listMembers(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            // Gitea/ForgeJo recent versions honor `q`; older versions ignore it, so
+            // keep the client-side filter below as the fallback.
+            if (o.search)
+                params.set("q", o.search);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/collaborators?${params.toString()}`, { method: "GET" }, GiteaCollaboratorSchema, BOT);
+            const filtered = o.search
+                ? rs.filter((c) => c.login.includes(o.search) || (c.full_name ?? "").includes(o.search))
+                : rs;
+            return filtered.map((c) => {
+                const perm = normalizeRole(c.role_name, c.permissions?.admin, c.permissions?.push);
+                return {
+                    id: c.id,
+                    username: c.login,
+                    name: c.full_name || c.login,
+                    ...(perm !== undefined ? { permission: perm } : {}),
+                };
+            });
+        },
+        async listReleases(repoId, o = {}) {
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/releases?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GiteaReleaseSchema, BOT);
+            return rs.map((r) => ({
+                tagName: r.tag_name,
+                ...(r.name ? { name: r.name } : {}),
+                ...(r.body != null ? { description: r.body } : {}),
+                ...(r.created_at ? { createdAt: r.created_at } : {}),
+                ...(r.published_at ? { releasedAt: r.published_at } : {}),
+                ...(r.author ? { author: mapUser(r.author) } : {}),
+            }));
+        },
+        async listWikiPages(repoId, o = {}) {
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/wiki/pages?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GiteaWikiPageSchema, BOT);
+            return rs.map((w) => ({
+                slug: w.slug,
+                title: w.title,
+                ...(w.updated_at ? { updatedAt: w.updated_at } : {}),
+            }));
+        },
+        async getWikiPage(repoId, slug) {
+            const w = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/wiki/page/${encodeURIComponent(slug)}`, { method: "GET" }, GiteaWikiPageSchema, BOT);
+            const content = w.content_base64 ? Buffer.from(w.content_base64, "base64").toString("utf8") : w.body;
+            return { slug: w.slug, title: w.title, ...(content ? { content } : {}) };
+        },
+        async searchProject(repoId, search, o = {}) {
+            // Only code search is available on Gitea/ForgeJo (instance-wide, scoped
+            // client-side to this repo's full_name). Any other neutral scope is a
+            // typed unsupported result rather than a silent wrong answer.
+            if (o.scope && o.scope !== "code") {
+                throw new UnsupportedError(`repository.searchProject(scope=${o.scope})`);
+            }
+            const full = await fullNameOf(repoId);
+            const params = new URLSearchParams({
+                q: search,
+                ...(o.page ? { page: String(o.page) } : {}),
+                limit: String(o.perPage ?? 50),
+            });
+            // `/repos/search` returns `{ ok, data: [...] }`, not a bare array.
+            const res = await giteaRequest(`/repos/search?${params.toString()}`, { method: "GET" }, z.object({ data: z.array(z.record(z.string(), z.unknown())).optional() }).passthrough(), BOT).catch(() => ({ data: [] }));
+            const hits = [];
+            for (const h of res.data ?? []) {
+                const repo = h.repository;
+                if (repo?.full_name && repo.full_name !== full)
+                    continue;
+                hits.push({
+                    ...(typeof h.id === "number" ? { id: h.id } : {}),
+                    ...(typeof h.name === "string" ? { title: h.name } : {}),
+                    ...(typeof h.path === "string" ? { path: h.path } : {}),
+                    ...(typeof h.content === "string" ? { data: h.content } : {}),
+                });
+            }
+            return hits;
+        },
+    };
+    // ---- CI (Actions) --------------------------------------------------------
+    const ci = {
+        async listPipelines(repoId, o = {}) {
+            if (o.scope)
+                throw new UnsupportedError(`ci.listPipelines(scope=${o.scope})`);
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.ref)
+                params.set("branch", o.ref);
+            if (o.status)
+                params.set("status", o.status);
+            if (o.username)
+                params.set("actor", o.username);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/actions/runs?${params.toString()}`, { method: "GET" }, GiteaActionRunSchema, BOT);
+            return rs.map(mapRun);
+        },
+        async getPipeline(repoId, pipelineId) {
+            const r = await giteaRequest(`${repoPath(await fullNameOf(repoId))}/actions/runs/${pipelineId}`, { method: "GET" }, GiteaActionRunSchema, BOT);
+            return mapRun(r);
+        },
+        async listPipelineJobs(repoId, pipelineId, o = {}) {
+            if (o.scope)
+                throw new UnsupportedError(`ci.listPipelineJobs(scope=${o.scope})`);
+            const rs = await giteaRequestArray(`${repoPath(await fullNameOf(repoId))}/actions/runs/${pipelineId}/jobs?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GiteaActionJobSchema, BOT);
+            const jobs = rs.map((j) => ({
+                id: j.id,
+                name: j.name,
+                status: j.status,
+                ...(j.html_url ? { webUrl: j.html_url } : {}),
+                ...(j.started_at !== undefined ? { startedAt: j.started_at } : {}),
+                ...(j.completed_at !== undefined ? { finishedAt: j.completed_at } : {}),
+            }));
+            // Neutral `outcome: "failed"` filters client-side: the Gitea/ForgeJo jobs
+            // endpoint has no failure scope (unlike GitLab).
+            return o.outcome === "failed" ? jobs.filter((j) => j.status === "failure") : jobs;
+        },
+        async getJobLog(repoId, jobId, maxBytes) {
+            const path = `${repoPath(await fullNameOf(repoId))}/actions/jobs/${jobId}/logs`;
+            const { bytes, contentType, totalBytes } = await giteaFetchRaw(path, BOT, maxBytes, "tail");
+            return tailFileContent(bytes, totalBytes, contentType || "text/plain", maxBytes);
+        },
+    };
+    // ---- Git auth ------------------------------------------------------------
+    const gitAuth = {
+        gitExtraHeader: () => gitExtraHeaderGitea(config.PLATFORM_TOKEN),
+        cloneUrl: (path) => `${config.PLATFORM_URL.replace(/\/$/, "")}/${path}.git`,
+    };
+    // ---- Attachments ---------------------------------------------------------
+    // Gitea/ForgeJo issue-comment attachments are markdown links to
+    // `/attachments/{uuid}`. The driver fetches the raw bytes for the agent.
+    const attachments = {
+        findRefs: (body) => findGiteaAttachmentRefs(body),
+        download: (_repoId, ref) => downloadGiteaAttachment(ref),
+        upload: async (repoId, number, file) => {
+            const { owner, repo } = splitFullName(await fullNameOf(repoId));
+            return uploadGiteaAttachment(owner, repo, number, file);
+        },
+    };
+    // ---- Onboarding ----------------------------------------------------------
+    const onboarding = {
+        authorizeUrl(state) {
+            const params = new URLSearchParams({
+                client_id: config.PLATFORM_OAUTH_CLIENT_ID,
+                redirect_uri: `${config.PUBLIC_URL}/oauth/callback`,
+                response_type: "code",
+                state,
+            });
+            return `${config.PLATFORM_URL.replace(/\/$/, "")}${opts.oauth.authorizePath}?${params.toString()}`;
+        },
+        async exchangeCode(code) {
+            const res = await fetch(`${config.PLATFORM_URL.replace(/\/$/, "")}${opts.oauth.tokenPath}`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    grant_type: "authorization_code",
+                    client_id: config.PLATFORM_OAUTH_CLIENT_ID,
+                    client_secret: config.PLATFORM_OAUTH_CLIENT_SECRET,
+                    code,
+                    redirect_uri: `${config.PUBLIC_URL}/oauth/callback`,
+                }),
+            });
+            if (!res.ok)
+                throw new PlatformHttpError(res.status, "oauth token", await res.text());
+            const parsed = z.object({ access_token: z.string().min(1) }).safeParse(await res.json());
+            if (!parsed.success)
+                throw new Error("oauth token schema mismatch");
+            return { accessToken: parsed.data.access_token };
+        },
+        async currentUser(accessToken) {
+            const u = await giteaRequest(opts.oauth.userPath, { method: "GET" }, GiteaUserSchema, { kind: "bearer", token: accessToken });
+            return { id: u.id, username: u.login };
+        },
+        async listProjects(accessToken, q) {
+            const out = [];
+            let page = 1;
+            const search = q?.trim() ? `&q=${encodeURIComponent(q.trim())}` : "";
+            for (;;) {
+                // Gitea/ForgeJo `/repos/search` returns an object `{ ok, data: [...] }`,
+                // not a bare array — so use giteaRequest (which parses a single JSON
+                // body) and read `.data`, rather than giteaRequestArray.
+                const res = await giteaRequest(`/repos/search?${pageParams(page, 50)}${search}`, { method: "GET" }, z.object({ data: z.array(GiteaRepositorySchema).optional() }).passthrough(), { kind: "bearer", token: accessToken });
+                const data = res.data ?? [];
+                if (data.length === 0)
+                    break;
+                for (const r of data)
+                    out.push({ id: r.id, path: r.full_name, webUrl: r.html_url ?? "" });
+                if (data.length < 50)
+                    break;
+                page += 1;
+            }
+            return out;
+        },
+        async addBot(accessToken, project) {
+            const { owner, repo } = splitFullName(project.path);
+            await giteaVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/collaborators/${encodeURIComponent(config.BOT_USERNAME)}`, { method: "PUT", body: JSON.stringify({ permission: "write" }) }, { kind: "bearer", token: accessToken }, { okStatuses: [409, 422] });
+        },
+        async removeBot(accessToken, project) {
+            const { owner, repo } = splitFullName(project.path);
+            await giteaVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/collaborators/${encodeURIComponent(config.BOT_USERNAME)}`, { method: "DELETE" }, { kind: "bearer", token: accessToken }, { okStatuses: [404] });
+        },
+        async findOrCreateWebhook(accessToken, project, url, secret) {
+            const { owner, repo } = splitFullName(project.path);
+            const base = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks`;
+            const hooks = await giteaRequestArray(base, { method: "GET" }, GiteaWebhookSchema, { kind: "bearer", token: accessToken });
+            const existing = hooks.find((h) => h.url === url);
+            if (existing)
+                return { id: existing.id, created: false };
+            const created = await giteaRequest(base, {
+                method: "POST",
+                body: JSON.stringify({
+                    type: opts.webhookType,
+                    active: true,
+                    events: ["issues", "issue_comment", "pull_request", "workflow_run"],
+                    // The secret is honored only at creation time: ForgeJo/Gitea's
+                    // PATCH (editHook) silently drops config.secret, so it must be
+                    // present here or deliveries carry an empty signature forever.
+                    config: { url, content_type: "json", secret },
+                }),
+            }, GiteaWebhookSchema, { kind: "bearer", token: accessToken });
+            return { id: created.id, created: true };
+        },
+        async setWebhookSecret(_accessToken, project, webhookId) {
+            // ForgeJo/Gitea's EditHook API ignores config.secret (verified in
+            // routers/api/v1/utils/hook.go editHook — it is neither read nor
+            // written), and the API never returns the stored secret, so the value
+            // cannot be rotated or repaired after creation. The secret is set at
+            // create time by findOrCreateWebhook; an already-onboarded hook with an
+            // empty secret must be fixed in the forge web UI (Settings -> Webhooks
+            // -> Secret) — see docs/platforms.md.
+            const { owner, repo } = splitFullName(project.path);
+            log.warn("gitea/forgejo cannot set a webhook secret after creation; ignoring", {
+                project: `${owner}/${repo}`,
+                webhookId,
+                hint: "recreate the hook or set the secret in the forge web UI",
+            });
+        },
+        async ensureCiFailureEvents(accessToken, project, webhookId) {
+            const { owner, repo } = splitFullName(project.path);
+            const base = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks`;
+            const hooks = await giteaRequestArray(base, { method: "GET" }, GiteaWebhookSchema, { kind: "bearer", token: accessToken });
+            const existing = hooks.find((h) => h.id === webhookId);
+            const current = existing?.events ?? ["issues", "issue_comment", "pull_request"];
+            if (current.includes("workflow_run"))
+                return;
+            // PATCH merges our event list; unlike the secret, event names are honored
+            // on edit. Preserve the hook's existing events and append workflow_run.
+            await giteaVoid(`${base}/${webhookId}`, {
+                method: "PATCH",
+                body: JSON.stringify({ events: [...new Set([...current, "workflow_run"])] }),
+            }, { kind: "bearer", token: accessToken });
+        },
+        async deleteWebhook(accessToken, project, webhookId) {
+            const { owner, repo } = splitFullName(project.path);
+            await giteaVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks/${webhookId}`, { method: "DELETE" }, { kind: "bearer", token: accessToken }, { okStatuses: [404] });
+        },
+        async testWebhook(accessToken, project, webhookId) {
+            const { owner, repo } = splitFullName(project.path);
+            try {
+                await giteaVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks/${webhookId}/tests`, { method: "POST" }, { kind: "bearer", token: accessToken });
+            }
+            catch {
+                // Test delivery is best-effort, matching GitLab's swallow.
+            }
+        },
+    };
+    // ---- Links -------------------------------------------------------------
+    const links = {
+        workItemUrl(projectPath, number) {
+            if (!projectPath || !Number.isInteger(number) || number <= 0)
+                return "";
+            return `${config.PLATFORM_URL.replace(/\/$/, "")}/${projectPath}/issues/${number}`;
+        },
+    };
+    return {
+        name: platform,
+        ingress,
+        workItems,
+        changeRequests,
+        repository,
+        ci,
+        gitAuth,
+        attachments,
+        onboarding,
+        links,
+    };
+}
+function mapRun(r) {
+    return {
+        id: r.id,
+        status: r.status,
+        ...(r.head_branch ? { ref: r.head_branch } : {}),
+        ...(r.head_sha ? { sha: r.head_sha } : {}),
+        ...(r.title ? { name: r.title } : {}),
+        ...(r.html_url ? { webUrl: r.html_url } : {}),
+        ...(r.created_at ? { createdAt: r.created_at } : {}),
+        ...(r.updated_at ? { updatedAt: r.updated_at } : {}),
+        ...(r.duration !== undefined ? { duration: r.duration } : {}),
+    };
+}
+//# sourceMappingURL=base.js.map