@zhin.js/workroom 0.0.0 → 0.0.1

package/lib/workroom-runtime/github-exact-merge-gateway.js

@@ -0,0 +1,79 @@
+import { createToken } from '@zhin.js/plugin-runtime';
+import { digestCanonicalWorkroomValue as digest } from '../workroom/canonical-value.js';
+export const workroomExactMergeInspectorToken = createToken('zhin.agent.workroom-exact-merge-inspector', 'Read-only exact PR merge prerequisite inspector; no base CAS available');
+/**
+ * GitHub REST merge accepts a head SHA CAS, but no expected base SHA.
+ * https://docs.github.com/en/rest/pulls/pulls#merge-a-pull-request
+ * A read-before-write check cannot implement our exact-base authorization contract.
+ * This adapter intentionally exposes no PUT transport and always returns a blocker.
+ */
+export class GitHubExactMergeInspector {
+    options;
+    provider;
+    constructor(options) {
+        this.options = options;
+        if (!/^[\w.-]+\/[\w.-]+$/.test(options.repository) || !Number.isSafeInteger(options.repositoryId))
+            throw new Error('Invalid exact merge repository');
+        this.provider = Object.freeze({ id: `github-exact-merge:${options.repositoryId}`, digest: digest({ repository: options.repository, repositoryId: options.repositoryId, strategy: 'head-and-base-cas-required-v1' }) });
+    }
+    async #get(path, signal) {
+        const response = await (this.options.fetch ?? fetch)(`https://api.github.com/repos/${this.options.repository}${path}`, { method: 'GET', redirect: 'error', signal: AbortSignal.any([signal, AbortSignal.timeout(30_000)]), headers: { Accept: 'application/vnd.github+json', Authorization: `Bearer ${await this.options.token()}`, 'X-GitHub-Api-Version': '2022-11-28' } });
+        if (!response.ok)
+            throw new Error(`GitHub exact merge inspection returned ${response.status}`);
+        return await response.json();
+    }
+    async inspect(target, signal) {
+        if (target.repositoryId !== String(this.options.repositoryId) || !Number.isSafeInteger(target.pullNumber) || target.pullNumber < 1)
+            throw new Error('Exact merge repository or PR binding mismatch');
+        const pull = await this.#get(`/pulls/${target.pullNumber}`, signal);
+        const protection = await this.#get(`/branches/${encodeURIComponent(target.baseRef)}/protection`, signal);
+        const checks = await this.#get(`/commits/${target.headSha}/check-runs?per_page=100`, signal);
+        const blockers = ['github_exact_base_cas_unavailable'];
+        if (pull.number !== target.pullNumber || pull.head.repo.id !== this.options.repositoryId || pull.base.repo.id !== this.options.repositoryId)
+            blockers.push('pull_repository_mismatch');
+        if (pull.state !== 'open' || pull.draft || pull.merged)
+            blockers.push('pull_not_mergeable');
+        if (pull.head.sha !== target.headSha || pull.base.ref !== target.baseRef || pull.base.sha !== target.baseSha)
+            blockers.push('pull_head_or_base_changed');
+        if (digest(protection) !== target.protectionDigest)
+            blockers.push('branch_protection_changed');
+        if (checks.total_count > checks.check_runs.length)
+            blockers.push('required_checks_snapshot_incomplete');
+        if (digest(checks) !== target.checksDigest)
+            blockers.push('required_checks_snapshot_changed');
+        return { target, blockers, observedAt: (this.options.now ?? Date.now)() };
+    }
+}
+/** Routes through the existing Effect journal/blocker system; never silently weakens an exact-base Gate. */
+export class WorkroomExactMergeGateway {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async #blocked(state, signal) {
+        signal.throwIfAborted();
+        if (state.intent.operation.kind !== 'git_merge_pr')
+            throw new Error('Expected git_merge_pr');
+        const inspector = this.options.resolveInspector();
+        if (!inspector || inspector.provider.id !== state.intent.capability.ref || inspector.provider.digest !== state.intent.capability.digest)
+            throw new Error('Exact merge capability unavailable or changed');
+        const result = await inspector.inspect(state.intent.operation.parameters, signal);
+        if (digest(result.target) !== digest(state.intent.operation.parameters))
+            throw new Error('Exact merge inspection target drift');
+        // Even a misconfigured inspector cannot turn the known platform limitation into permission to write.
+        throw new Error(`Exact merge blocked: ${[...new Set(['github_exact_base_cas_unavailable', ...result.blockers])].join(', ')}`);
+    }
+    async prepare(state, signal) {
+        if (state.intent.operation.kind === 'git_merge_pr')
+            return this.#blocked(state, signal);
+        await this.options.fallback.prepare?.(state, signal);
+    }
+    execute(state, signal) {
+        return state.intent.operation.kind === 'git_merge_pr' ? this.#blocked(state, signal) : this.options.fallback.execute(state, signal);
+    }
+    reconcile(state, signal) {
+        // An externally merged PR cannot be attributed to an operation this adapter never submitted.
+        return state.intent.operation.kind === 'git_merge_pr' ? this.#blocked(state, signal) : this.options.fallback.reconcile(state, signal);
+    }
+}
+//# sourceMappingURL=github-exact-merge-gateway.js.map

package/lib/workroom-runtime/github-exact-merge-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-exact-merge-gateway.js","sourceRoot":"","sources":["../../src/workroom-runtime/github-exact-merge-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,4BAA4B,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAcxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,WAAW,CACzD,2CAA2C,EAAE,wEAAwE,CACtH,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IAEf;IADZ,QAAQ,CAA2C;IAC5D,YAAqB,OAAuI;QAAvI,YAAO,GAAP,OAAO,CAAgI;QAC1J,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACrJ,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,sBAAsB,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC,EAAE,CAAC,CAAC;IACzN,CAAC;IACD,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,MAAmB;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,gCAAgC,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,sBAAsB,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAC9W,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,MAA8B,EAAE,MAAmB;QAC/D,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrM,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAA4K,UAAU,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/O,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAA0B,aAAa,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAClI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAiD,YAAY,MAAM,CAAC,OAAO,0BAA0B,EAAE,MAAM,CAAC,CAAC;QAC7I,MAAM,QAAQ,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACvL,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACzJ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,gBAAgB;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC/F,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACxG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5E,CAAC;CACF;AAED,4GAA4G;AAC5G,MAAM,OAAO,yBAAyB;IACf;IAArB,YAAqB,OAA6H;QAA7H,YAAO,GAAP,OAAO,CAAsH;IAAG,CAAC;IACtJ,KAAK,CAAC,QAAQ,CAAC,KAA0B,EAAE,MAAmB;QAC5D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC1M,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAChI,qGAAqG;QACrG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,mCAAmC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAA0B,EAAE,MAAmB;QAC3D,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,KAA0B,EAAE,MAAmB;QACrD,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtI,CAAC;IACD,SAAS,CAAC,KAA0B,EAAE,MAAmB;QACvD,6FAA6F;QAC7F,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxI,CAAC;CACF"}

package/lib/workroom-runtime/github-workroom-capability.d.ts

@@ -0,0 +1,15 @@
+import { type GitWorkspaceCredentialPort } from '../workroom/git-workspace-gateway.js';
+import { type GitHubWorkspaceTransportOptions } from '../workroom/github-workspace-transport.js';
+import type { WorkroomGitHubCapabilityPort } from './workroom-effect-production.js';
+export interface GitHubWorkroomCapabilityOptions extends GitHubWorkspaceTransportOptions {
+    readonly credentials: GitWorkspaceCredentialPort;
+    /** Explicit logical identity when it differs from the transport provider identity. */
+    readonly binding?: Readonly<{
+        ref: string;
+        digest: string;
+    }>;
+    readonly now?: () => number;
+}
+/** Register the returned capability as a generation Resource; no process-global credentials/state. */
+export declare function createGitHubWorkroomCapability(options: GitHubWorkroomCapabilityOptions): WorkroomGitHubCapabilityPort;
+//# sourceMappingURL=github-workroom-capability.d.ts.map

package/lib/workroom-runtime/github-workroom-capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workroom-capability.d.ts","sourceRoot":"","sources":["../../src/workroom-runtime/github-workroom-capability.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAChH,OAAO,EAA4B,KAAK,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAC3H,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAEpF,MAAM,WAAW,+BAAgC,SAAQ,+BAA+B;IACtF,QAAQ,CAAC,WAAW,EAAE,0BAA0B,CAAC;IACjD,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,sGAAsG;AACtG,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,+BAA+B,GAAG,4BAA4B,CAsErH"}

package/lib/workroom-runtime/github-workroom-capability.js

@@ -0,0 +1,79 @@
+import { canonicalWorkroomJson, digestCanonicalWorkroomValue as digest } from '../workroom/canonical-value.js';
+import { createGitWorkspaceLease } from '../workroom/git-workspace-gateway.js';
+import { GitHubWorkspaceTransport } from '../workroom/github-workspace-transport.js';
+/** Register the returned capability as a generation Resource; no process-global credentials/state. */
+export function createGitHubWorkroomCapability(options) {
+    const transport = new GitHubWorkspaceTransport(options);
+    const now = options.now ?? Date.now;
+    const binding = Object.freeze(options.binding
+        ? { ref: options.binding.ref, digest: options.binding.digest }
+        : { ref: transport.provider.id, digest: transport.provider.digest });
+    if (typeof binding.ref !== 'string' || !binding.ref.trim() || binding.ref !== binding.ref.trim()
+        || !/^sha256:[a-f0-9]{64}$/u.test(binding.digest))
+        throw new Error('GitHub capability binding is invalid');
+    return Object.freeze({
+        binding,
+        provider: transport.provider,
+        credentials: options.credentials,
+        transport,
+        async reconcile({ generation, state, lease }, signal) {
+            signal.throwIfAborted();
+            const canonical = createGitWorkspaceLease(lease);
+            const operation = state.intent.operation;
+            if (canonicalWorkroomJson(state.intent.capability) !== canonicalWorkroomJson(binding)) {
+                throw new Error('GitHub reconciliation capability binding drift');
+            }
+            if (canonicalWorkroomJson(canonical) !== canonicalWorkroomJson(lease)
+                || !state.attempt || !state.authorization || !Number.isSafeInteger(generation) || generation < 1
+                || state.intent.projectId !== lease.projectId || state.intent.runId !== lease.runId
+                || state.intent.taskKey !== lease.taskKey || state.intent.taskRevision !== lease.taskRevision
+                || state.intent.target.ref !== lease.leaseRef || state.intent.target.digest !== lease.digest) {
+                throw new Error('GitHub reconciliation requires the exact authorized workspace lease and attempt');
+            }
+            if (operation.kind !== 'git_push' && operation.kind !== 'git_open_pr' && operation.kind !== 'git_cancel_remote') {
+                throw new Error('GitHub reconciliation operation is unsupported');
+            }
+            if (operation.parameters.repositoryId !== lease.repository.id
+                || (operation.kind === 'git_push' && operation.parameters.ref !== lease.attemptBranch)
+                || (operation.kind === 'git_open_pr' && (operation.parameters.headRef !== lease.attemptBranch
+                    || operation.parameters.baseRef !== lease.targetRef || lease.mode !== 'pull_request'))) {
+                throw new Error('GitHub reconciliation operation is outside the workspace lease');
+            }
+            // Querying after an expired lease is safe and required for recovery. Only fresh credentials are used.
+            const credential = await options.credentials.resolve({ generation, leaseDigest: lease.digest,
+                repositoryId: lease.repository.id, bindingRef: lease.repository.bindingRef,
+                bindingDigest: lease.repository.bindingDigest, operation: operation.kind }, signal);
+            signal.throwIfAborted();
+            if (!credential.credentialId || !credential.secret || !Number.isSafeInteger(credential.expiresAt)
+                || credential.expiresAt <= now())
+                throw new Error('GitHub reconciliation credential is invalid or expired');
+            const operationId = state.attempt.operationId;
+            const shared = { operationId, repositoryId: lease.repository.id };
+            let remoteRef;
+            let remoteDigest;
+            if (operation.kind === 'git_push') {
+                const receipt = await transport.queryPush({ ...shared, ref: lease.attemptBranch,
+                    headSha: operation.parameters.headSha, force: false, baseSha: lease.baseSha, pathScopes: lease.pathScopes,
+                    idempotencyKey: `git-push:${lease.digest}:${operationId}`,
+                }, credential, signal);
+                remoteRef = receipt?.externalReceiptRef;
+                remoteDigest = receipt?.externalReceiptDigest;
+            }
+            else if (operation.kind === 'git_open_pr') {
+                const receipt = await transport.queryPullRequest({ ...shared, headRef: lease.attemptBranch,
+                    baseRef: lease.targetRef, headSha: operation.parameters.headSha, baseSha: lease.baseSha, pathScopes: lease.pathScopes,
+                    idempotencyKey: `git-pr:${lease.digest}:${operationId}`,
+                }, credential, signal);
+                remoteRef = receipt?.prRef;
+                remoteDigest = receipt?.externalReceiptDigest;
+            }
+            const observedAt = now();
+            return Object.freeze({ outcome: remoteRef ? 'committed' : 'outcome_unknown', provider: transport.provider,
+                remoteRef: remoteRef ?? `github-observation:${digest({ operationId, repositoryId: lease.repository.id })}`,
+                remoteDigest: remoteDigest ?? digest({ operationId, observedAt, outcome: 'outcome_unknown' }),
+                observedAt, authenticatedBy: credential.credentialId,
+            });
+        },
+    });
+}
+//# sourceMappingURL=github-workroom-capability.js.map

package/lib/workroom-runtime/github-workroom-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-workroom-capability.js","sourceRoot":"","sources":["../../src/workroom-runtime/github-workroom-capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAmC,MAAM,sCAAsC,CAAC;AAChH,OAAO,EAAE,wBAAwB,EAAwC,MAAM,2CAA2C,CAAC;AAU3H,sGAAsG;AACtG,MAAM,UAAU,8BAA8B,CAAC,OAAwC;IACrF,MAAM,SAAS,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;QAC3C,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE;QAC9D,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;WAC3F,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7G,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS;QACT,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM;YAClD,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YACzC,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,qBAAqB,CAAC,SAAS,CAAC,KAAK,qBAAqB,CAAC,KAAK,CAAC;mBAChE,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;mBAC7F,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;mBAChF,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;mBAC1F,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC/F,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAChH,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,SAAS,CAAC,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,UAAU,CAAC,EAAE;mBACxD,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,KAAK,KAAK,CAAC,aAAa,CAAC;mBACnF,CAAC,SAAS,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,aAAa;uBACxF,SAAS,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,EAAE,CAAC;gBAC3F,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,sGAAsG;YACtG,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM;gBAC1F,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;gBAC1E,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACtF,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;mBAC5F,UAAU,CAAC,SAAS,IAAI,GAAG,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC9G,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;YAC9C,MAAM,MAAM,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YAClE,IAAI,SAA6B,CAAC;YAClC,IAAI,YAAgC,CAAC;YACrC,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa;oBAC7E,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;oBACzG,cAAc,EAAE,YAAY,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE;iBAC1D,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACvB,SAAS,GAAG,OAAO,EAAE,kBAAkB,CAAC;gBACxC,YAAY,GAAG,OAAO,EAAE,qBAAqB,CAAC;YAChD,CAAC;iBAAM,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa;oBACxF,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;oBACrH,cAAc,EAAE,UAAU,KAAK,CAAC,MAAM,IAAI,WAAW,EAAE;iBACxD,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACvB,SAAS,GAAG,OAAO,EAAE,KAAK,CAAC;gBAC3B,YAAY,GAAG,OAAO,EAAE,qBAAqB,CAAC;YAChD,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBACvG,SAAS,EAAE,SAAS,IAAI,sBAAsB,MAAM,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE;gBAC1G,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;gBAC7F,UAAU,EAAE,eAAe,EAAE,UAAU,CAAC,YAAY;aACrD,CAAC,CAAC;QACL,CAAC;KACqC,CAAC,CAAC;AAC5C,CAAC"}

package/lib/workroom-runtime/self-delivery-project-composition.d.ts

@@ -0,0 +1,25 @@
+import type { AssignmentExecutorPort } from '../workroom/assignment-executor.js';
+import type { WorkroomDeliveryProviderPort } from './workroom-delivery-gateway.js';
+import type { WorkroomCatalog } from '../workroom/catalog.js';
+import type { ProjectProfileRegistry } from '../workroom/profile-registry.js';
+import type { WorkroomKernel } from '../workroom/workroom-kernel.js';
+import type { KernelPlanAdmissionRunProfilePinWriter } from './workroom-run-profile-pin-authority.js';
+import { SelfDeliveryProject, type SelfDeliveryProjectPorts } from './self-delivery-project.js';
+/** Explicit trusted embedding configuration; never sourced from plugin configuration or model text. */
+export type SelfDeliveryHostConfiguration = Omit<SelfDeliveryProjectPorts, 'kernel'> & {
+    readonly codingExecutor?: AssignmentExecutorPort;
+    readonly deliveryProvider?: WorkroomDeliveryProviderPort;
+};
+/** Composition-root private writers are captured here and never published in a Resource. */
+export declare function createSelfDeliveryProjectForHost(input: {
+    directory: string;
+    configuration: SelfDeliveryHostConfiguration;
+    kernel: Pick<WorkroomKernel, 'admitWorkflowPlan' | 'readWorkflowPlanAdmission'>;
+    catalog: Pick<WorkroomCatalog, 'read'>;
+    profiles: Pick<ProjectProfileRegistry, 'read'>;
+    pins: Pick<KernelPlanAdmissionRunProfilePinWriter, 'afterPlanAdmission'>;
+    signal: AbortSignal;
+}): SelfDeliveryProject;
+/** Preserve standard execution for sibling projects and other stages. Never fall back for coding. */
+export declare function createSelfDeliveryAssignmentExecutor(configuration: SelfDeliveryHostConfiguration, fallback: AssignmentExecutorPort): AssignmentExecutorPort;
+//# sourceMappingURL=self-delivery-project-composition.d.ts.map

package/lib/workroom-runtime/self-delivery-project-composition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-delivery-project-composition.d.ts","sourceRoot":"","sources":["../../src/workroom-runtime/self-delivery-project-composition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEhG,uGAAuG;AACvG,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,QAAQ,CAAC,GAAG;IACrF,QAAQ,CAAC,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACjD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,4BAA4B,CAAC;CAC1D,CAAC;AAEF,4FAA4F;AAC5F,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,6BAA6B,CAAC;IAC7C,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,GAAG,2BAA2B,CAAC,CAAC;IAChF,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,EAAE,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,EAAE,IAAI,CAAC,sCAAsC,EAAE,oBAAoB,CAAC,CAAC;IACzE,MAAM,EAAE,WAAW,CAAC;CACrB,GAAG,mBAAmB,CAqDtB;AAED,qGAAqG;AACrG,wBAAgB,oCAAoC,CAAC,aAAa,EAAE,6BAA6B,EAAE,QAAQ,EAAE,sBAAsB,GAAG,sBAAsB,CAS3J"}

package/lib/workroom-runtime/self-delivery-project-composition.js

@@ -0,0 +1,85 @@
+import { digestWorkroomCatalogProjectBinding } from '../workroom/catalog-definition.js';
+import { SelfDeliveryProject } from './self-delivery-project.js';
+/** Composition-root private writers are captured here and never published in a Resource. */
+export function createSelfDeliveryProjectForHost(input) {
+    const config = input.configuration;
+    const installedBlockers = async () => {
+        const blockers = [...await config.readiness()];
+        if (!config.codingExecutor)
+            blockers.push('Coding Executor is not installed');
+        if (!config.deliveryProvider)
+            blockers.push('Delivery provider is not installed');
+        return blockers;
+    };
+    const authority = async () => {
+        input.signal.throwIfAborted();
+        const [catalog, profiles] = await Promise.all([input.catalog.read(), input.profiles.read(config.profile.projectId)]);
+        const definition = catalog.definitions[config.profile.projectId];
+        if (!definition || definition.enabled === false || definition.conversation?.kind !== 'repository'
+            || definition.conversation.id !== 'zhinjs/zhin')
+            throw new Error('Self-delivery Catalog repository binding is unavailable');
+        if (!profiles.active)
+            throw new Error('Self-delivery active Profile is unavailable');
+        return { catalog, profiles, definition };
+    };
+    return new SelfDeliveryProject(input.directory, {
+        ...config,
+        async authenticate(identity) {
+            const actor = await config.authenticate(identity);
+            const { definition } = await authority();
+            return actor && definition.sponsors?.includes(actor.principalId) ? actor : undefined;
+        },
+        async readiness() {
+            try {
+                await authority();
+            }
+            catch {
+                return ['Catalog repository binding or active Profile is unavailable'];
+            }
+            return installedBlockers();
+        },
+        kernel: {
+            readWorkflowPlanAdmission: operationId => input.kernel.readWorkflowPlanAdmission(operationId),
+            async admitWorkflowPlan(admission) {
+                const { catalog, profiles, definition } = await authority();
+                const pin = admission.plan.authority;
+                const existing = await input.kernel.readWorkflowPlanAdmission(admission.operationId);
+                if (!existing) {
+                    const blockers = await installedBlockers();
+                    if (blockers.length)
+                        throw new Error(`Self-delivery blocked: ${blockers.join('; ')}`);
+                }
+                if (!existing && (pin.projectRevision !== catalog.revision
+                    || pin.projectDigest !== digestWorkroomCatalogProjectBinding(definition)
+                    || pin.profileRevisionId !== profiles.active.revisionId
+                    || pin.profileDigest !== profiles.active.compiledDigest))
+                    throw new Error('Self-delivery planning authority is stale');
+                if (!definition.sponsors?.includes(admission.plan.tasks.find(task => task.key === 'release')?.approvalGate?.owner ?? ''))
+                    throw new Error('Self-delivery Sponsor authority was revoked');
+                input.signal.throwIfAborted();
+                const receipt = await input.kernel.admitWorkflowPlan(admission);
+                const profile = profiles.runPins[receipt.runId];
+                if (!profile)
+                    await input.pins.afterPlanAdmission({ operationId: admission.operationId,
+                        projectId: admission.projectId, plan: admission.plan, receipt }, input.signal);
+                else if (profile.profileRevisionId !== pin.profileRevisionId || profile.profileDigest !== pin.profileDigest)
+                    throw new Error('Self-delivery Run Profile pin drift');
+                return receipt;
+            },
+        },
+    });
+}
+/** Preserve standard execution for sibling projects and other stages. Never fall back for coding. */
+export function createSelfDeliveryAssignmentExecutor(configuration, fallback) {
+    return {
+        execute(envelope, signal) {
+            if (envelope.projectId !== configuration.profile.projectId || envelope.taskKey !== 'implement')
+                return fallback.execute(envelope, signal);
+            const executor = configuration.codingExecutor;
+            if (!executor)
+                throw new Error('Self-delivery Coding Executor is not installed');
+            return executor.execute(envelope, signal);
+        },
+    };
+}
+//# sourceMappingURL=self-delivery-project-composition.js.map

package/lib/workroom-runtime/self-delivery-project-composition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-delivery-project-composition.js","sourceRoot":"","sources":["../../src/workroom-runtime/self-delivery-project-composition.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAIxF,OAAO,EAAE,mBAAmB,EAAiC,MAAM,4BAA4B,CAAC;AAQhG,4FAA4F;AAC5F,MAAM,UAAU,gCAAgC,CAAC,KAQhD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;IACnC,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE;QACnC,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,QAAQ,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QAC3B,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrH,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,UAAU,CAAC,YAAY,EAAE,IAAI,KAAK,YAAY;eAC5F,UAAU,CAAC,YAAY,CAAC,EAAE,KAAK,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC9H,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC,CAAC;IACF,OAAO,IAAI,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE;QAC9C,GAAG,MAAM;QACT,KAAK,CAAC,YAAY,CAAC,QAAQ;YACzB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;YACzC,OAAO,KAAK,IAAI,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,CAAC;QACD,KAAK,CAAC,SAAS;YACb,IAAI,CAAC;gBAAC,MAAM,SAAS,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC;YAAC,CAAC;YAC5G,OAAO,iBAAiB,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,EAAE;YACN,yBAAyB,EAAE,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,WAAW,CAAC;YAC7F,KAAK,CAAC,iBAAiB,CAAC,SAAS;gBAC/B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;gBAC5D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBACrF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,QAAQ,GAAG,MAAM,iBAAiB,EAAE,CAAC;oBAC3C,IAAI,QAAQ,CAAC,MAAM;wBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,eAAe,KAAK,OAAO,CAAC,QAAQ;uBACrD,GAAG,CAAC,aAAa,KAAK,mCAAmC,CAAC,UAAU,CAAC;uBACrE,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,MAAO,CAAC,UAAU;uBACrD,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,MAAO,CAAC,cAAc,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC1H,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACzL,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAChD,IAAI,CAAC,OAAO;oBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW;wBACpF,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;qBAC5E,IAAI,OAAO,CAAC,iBAAiB,KAAK,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBACpK,OAAO,OAAO,CAAC;YACjB,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,oCAAoC,CAAC,aAA4C,EAAE,QAAgC;IACjI,OAAO;QACL,OAAO,CAAC,QAAQ,EAAE,MAAM;YACtB,IAAI,QAAQ,CAAC,SAAS,KAAK,aAAa,CAAC,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1I,MAAM,QAAQ,GAAG,aAAa,CAAC,cAAc,CAAC;YAC9C,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACjF,OAAO,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/workroom-runtime/self-delivery-project.d.ts

@@ -0,0 +1,65 @@
+import { type SoftwareDeliveryPlanInput } from '../workroom/software-delivery-plan.js';
+import type { WorkroomKernel } from '../workroom/workroom-kernel.js';
+/** Host-owned identity and policy. Never populate these from Issue text or comments. */
+export interface SelfDeliveryRepoProfile {
+    readonly repository: 'zhinjs/zhin';
+    readonly repositoryId: number;
+    readonly projectId: string;
+    readonly revision: string;
+    readonly sponsorPrincipalIds: readonly string[];
+}
+export interface SelfDeliveryIssue {
+    readonly repositoryId: number;
+    readonly number: number;
+    readonly id: number;
+    readonly title: string;
+    readonly body: string;
+    readonly updatedAt: string;
+    readonly state: 'open' | 'closed';
+}
+export interface SelfDeliveryProjectPorts {
+    readonly profile: SelfDeliveryRepoProfile;
+    readonly kernel: Pick<WorkroomKernel, 'admitWorkflowPlan' | 'readWorkflowPlanAdmission'>;
+    /** Must recheck current membership; caller-controlled strings are not authentication. */
+    authenticate(input: unknown): Promise<{
+        principalId: string;
+    } | undefined>;
+    readIssue(number: number): Promise<SelfDeliveryIssue>;
+    /** Trusted Catalog/Profile authority supplies roles, budgets and immutable policy pins. */
+    planInput(input: {
+        operationId: string;
+        issue: SelfDeliveryIssue;
+        principalId: string;
+    }): Promise<Omit<SoftwareDeliveryPlanInput, 'request' | 'acceptanceCriteria' | 'repositoryId'>>;
+    /** Performs live connection/permission and installed executor/provider checks. */
+    readiness(): Promise<readonly string[]>;
+}
+export declare const selfDeliveryProjectToken: import("@zhin.js/plugin-runtime").Token<SelfDeliveryProject>;
+/** Issue mapping only. Kernel Journal remains the sole Run/Task state authority. */
+export declare class SelfDeliveryProject {
+    #private;
+    constructor(directory: string, ports?: SelfDeliveryProjectPorts);
+    doctor(): Promise<{
+        configured: boolean;
+        ready: boolean;
+        blockers: readonly string[];
+    }>;
+    select(input: {
+        identity: unknown;
+        issueNumber: number;
+        acceptanceCriteria: readonly string[];
+    }): Promise<{
+        issueNumber: number;
+        issueDigest: string;
+        runId: string;
+        receiptRef: string;
+        planDigest: string;
+    }>;
+}
+/** Real read-only GitHub ingress. Redirects and PR-shaped Issues are refused. */
+export declare function createSelfDeliveryGitHubIssueReader(input: {
+    repositoryId: number;
+    token(): Promise<string>;
+    fetch?: typeof fetch;
+}): (number: number) => Promise<SelfDeliveryIssue>;
+//# sourceMappingURL=self-delivery-project.d.ts.map

package/lib/workroom-runtime/self-delivery-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-delivery-project.d.ts","sourceRoot":"","sources":["../../src/workroom-runtime/self-delivery-project.ts"],"names":[],"mappings":"AAKA,OAAO,EAA8B,KAAK,yBAAyB,EAAE,MAAM,uCAAuC,CAAC;AACnH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,wFAAwF;AACxF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AACD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AACD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,mBAAmB,GAAG,2BAA2B,CAAC,CAAC;IACzF,yFAAyF;IACzF,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAC3E,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtD,2FAA2F;IAC3F,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,SAAS,GAAG,oBAAoB,GAAG,cAAc,CAAC,CAAC,CAAC;IACtL,kFAAkF;IAClF,SAAS,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CACzC;AACD,eAAO,MAAM,wBAAwB,8DAAiE,CAAC;AAUvG,oFAAoF;AACpF,qBAAa,mBAAmB;;gBAGlB,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,wBAAwB;IAOzD,MAAM,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IASvF,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE;;;;;;;CAqDtG;AAkBD,iFAAiF;AACjF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtE,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAiBjD"}

package/lib/workroom-runtime/self-delivery-project.js

@@ -0,0 +1,140 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { DurableFileStore } from '../workroom/durable-file-store.js';
+import { createToken } from '@zhin.js/plugin-runtime';
+import { digestCanonicalWorkroomValue as digest } from '../workroom/canonical-value.js';
+import { createSoftwareDeliveryPlan } from '../workroom/software-delivery-plan.js';
+export const selfDeliveryProjectToken = createToken('zhin.self-delivery.project');
+/** Issue mapping only. Kernel Journal remains the sole Run/Task state authority. */
+export class SelfDeliveryProject {
+    #directory;
+    #ports;
+    constructor(directory, ports) {
+        this.#directory = directory;
+        this.#ports = ports;
+        if (ports && (ports.profile.repository !== 'zhinjs/zhin' || !Number.isSafeInteger(ports.profile.repositoryId)
+            || ports.profile.repositoryId <= 0 || !ports.profile.projectId.trim() || !ports.profile.revision.trim()
+            || !ports.profile.sponsorPrincipalIds.length))
+            throw new Error('Invalid self-delivery repository profile');
+    }
+    async doctor() {
+        if (!this.#ports)
+            return { configured: false, ready: false, blockers: ['Trusted project ports are not installed'] };
+        try {
+            const blockers = await this.#ports.readiness();
+            return { configured: true, ready: blockers.length === 0, blockers: [...blockers] };
+        }
+        catch {
+            return { configured: true, ready: false, blockers: ['Live readiness probe failed'] };
+        }
+    }
+    async select(input) {
+        const ports = this.#ports;
+        if (!ports)
+            throw new Error('Self-delivery project is not configured');
+        const identity = await ports.authenticate(input.identity);
+        if (!identity || !ports.profile.sponsorPrincipalIds.includes(identity.principalId))
+            throw new Error('Issue selection requires an authenticated project Sponsor');
+        if (!Number.isSafeInteger(input.issueNumber) || input.issueNumber <= 0)
+            throw new Error('Invalid Issue number');
+        const criteria = input.acceptanceCriteria.map(value => value.trim());
+        if (!criteria.length || criteria.some(value => !value) || criteria.length > 32 || criteria.some(value => value.length > 8192))
+            throw new Error('Explicit bounded acceptance criteria are required');
+        const operationId = `self-delivery:${ports.profile.repositoryId}:issue:${input.issueNumber}`;
+        const file = join(this.#directory, `${digest(operationId).slice(7)}.json`);
+        const store = new DurableFileStore(this.#directory);
+        await store.ensureDurableLeaf('Self-delivery Issue snapshots');
+        let selection = await readSelection(file);
+        if (!selection) {
+            const readiness = await this.doctor();
+            if (!readiness.ready)
+                throw new Error(`Self-delivery blocked: ${readiness.blockers.join('; ')}`);
+            const issue = await ports.readIssue(input.issueNumber);
+            if (issue.repositoryId !== ports.profile.repositoryId || issue.number !== input.issueNumber || issue.state !== 'open'
+                || !Number.isSafeInteger(issue.id) || issue.id <= 0 || !issue.title.trim() || issue.body.length > 262144)
+                throw new Error('Issue does not match the admitted repository scope');
+            const planInput = await ports.planInput({ operationId, issue, principalId: identity.principalId });
+            if (planInput.metadata.proposalId !== operationId || planInput.metadata.projectId !== ports.profile.projectId || planInput.sponsor.principalId !== identity.principalId)
+                throw new Error('Planning authority scope mismatch');
+            selection = { version: 1, profileDigest: digest(ports.profile), principalId: identity.principalId, issue, acceptanceCriteria: criteria, planInput };
+            // Validate before persisting. Exclusive creation makes concurrent selections converge.
+            planFor(selection);
+            selection = (await store.publishCreateOnly({ target: file,
+                content: JSON.stringify({ selection, digest: digest(selection) }), createdValue: selection,
+                onConflict: async () => {
+                    const existing = await readSelection(file);
+                    if (!existing)
+                        throw new Error('Issue selection disappeared');
+                    return existing;
+                },
+            })).value;
+        }
+        if (selection.profileDigest !== digest(ports.profile))
+            throw new Error('Persisted Issue profile changed; explicit migration is required');
+        if (selection.principalId !== identity.principalId)
+            throw new Error('Issue selection belongs to a different Sponsor');
+        if (digest(selection.acceptanceCriteria) !== digest(criteria))
+            throw new Error('Issue already selected with different criteria; use governed plan revision');
+        const plan = planFor(selection);
+        const requestDigest = digest(selection.issue);
+        const sourceEventRef = `github:zhinjs/zhin/issues/${selection.issue.number}@${requestDigest}`;
+        if (!await ports.kernel.readWorkflowPlanAdmission(operationId)) {
+            const readiness = await this.doctor();
+            if (!readiness.ready)
+                throw new Error(`Self-delivery blocked: ${readiness.blockers.join('; ')}`);
+        }
+        // Exact Kernel admission is idempotent even after a crash between Journal and response.
+        const currentIdentity = await ports.authenticate(input.identity);
+        if (!currentIdentity || currentIdentity.principalId !== identity.principalId
+            || !ports.profile.sponsorPrincipalIds.includes(currentIdentity.principalId))
+            throw new Error('Issue selection authority expired or was revoked');
+        const receipt = await ports.kernel.admitWorkflowPlan({ operationId, projectId: ports.profile.projectId,
+            title: selection.issue.title, sourceEventRef, sourceEventDigest: requestDigest,
+            orchestratorAgentDefinitionId: plan.authority.orchestratorAgentDefinitionId, plan });
+        return { issueNumber: selection.issue.number, issueDigest: requestDigest, runId: receipt.runId,
+            receiptRef: receipt.receiptRef, planDigest: plan.digest };
+    }
+}
+function planFor(selection) {
+    return createSoftwareDeliveryPlan({ ...selection.planInput, repositoryId: 'github:zhinjs/zhin',
+        request: { ref: `github:zhinjs/zhin/issues/${selection.issue.number}`, digest: digest(selection.issue) },
+        acceptanceCriteria: selection.acceptanceCriteria.map((text, index) => ({ ref: `issue:${selection.issue.id}:criterion:${index}`, digest: digest(text) })),
+    });
+}
+async function readSelection(file) {
+    try {
+        const record = JSON.parse(await readFile(file, 'utf8'));
+        if (record.selection?.version !== 1 || digest(record.selection) !== record.digest)
+            throw new Error('Corrupt Issue selection snapshot');
+        return record.selection;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+/** Real read-only GitHub ingress. Redirects and PR-shaped Issues are refused. */
+export function createSelfDeliveryGitHubIssueReader(input) {
+    return async (number) => {
+        if (!Number.isSafeInteger(number) || number <= 0)
+            throw new Error('Invalid Issue number');
+        const transport = input.fetch ?? fetch;
+        const headers = { authorization: `Bearer ${await input.token()}`, accept: 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28' };
+        const request = async (path) => {
+            const response = await transport(`https://api.github.com/repos/zhinjs/zhin${path}`, { headers, redirect: 'error', signal: AbortSignal.timeout(15000) });
+            if (!response.ok)
+                throw new Error(`GitHub Issue ingress failed (${response.status})`);
+            return response.json();
+        };
+        const repository = await request('');
+        if (repository.id !== input.repositoryId)
+            throw new Error('GitHub repository identity changed');
+        const issue = await request(`/issues/${number}`);
+        if (issue.pull_request)
+            throw new Error('Select an Issue, not a pull request');
+        return { repositoryId: repository.id, id: issue.id, number: issue.number, title: issue.title,
+            body: issue.body ?? '', updatedAt: issue.updated_at, state: issue.state };
+    };
+}
+//# sourceMappingURL=self-delivery-project.js.map

package/lib/workroom-runtime/self-delivery-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-delivery-project.js","sourceRoot":"","sources":["../../src/workroom-runtime/self-delivery-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,4BAA4B,IAAI,MAAM,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,0BAA0B,EAAkC,MAAM,uCAAuC,CAAC;AA+BnH,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAsB,4BAA4B,CAAC,CAAC;AAUvG,oFAAoF;AACpF,MAAM,OAAO,mBAAmB;IACrB,UAAU,CAAS;IACnB,MAAM,CAA4B;IAC3C,YAAY,SAAiB,EAAE,KAAgC;QAC7D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;eACxG,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;eACpG,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC/G,CAAC;IACD,KAAK,CAAC,MAAM;QACV,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,yCAAyC,CAAC,EAAE,CAAC;QACpH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAwF;QACnG,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACjK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChH,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACpM,MAAM,WAAW,GAAG,iBAAiB,KAAK,CAAC,OAAO,CAAC,YAAY,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC/D,IAAI,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjG,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM;mBAChH,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YAClL,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YACnG,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9N,SAAS,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YACpJ,uFAAuF;YACvF,OAAO,CAAC,SAAS,CAAC,CAAC;YACnB,SAAS,GAAG,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI;gBACvD,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS;gBAC1F,UAAU,EAAE,KAAK,IAAI,EAAE;oBACrB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;oBAC3C,IAAI,CAAC,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;oBAC9D,OAAO,QAAQ,CAAC;gBAClB,CAAC;aACF,CAAC,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,CAAC,aAAa,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QAC1I,IAAI,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACtH,IAAI,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC7J,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,6BAA6B,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QAC9F,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,wFAAwF;QACxF,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;eACvE,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,eAAe,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACnJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YACpG,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa;YAC9E,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;YAC5F,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;CACF;AACD,SAAS,OAAO,CAAC,SAAoB;IACnC,OAAO,0BAA0B,CAAC,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,oBAAoB;QAC5F,OAAO,EAAE,EAAE,GAAG,EAAE,6BAA6B,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QACxG,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,SAAS,CAAC,KAAK,CAAC,EAAE,cAAc,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KACzJ,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA6C,CAAC;QACpG,IAAI,MAAM,CAAC,SAAS,EAAE,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACvI,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mCAAmC,CAAC,KAEnD;IACC,OAAO,KAAK,EAAC,MAAM,EAAC,EAAE;QACpB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC;QAChJ,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;YACrC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,2CAA2C,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxJ,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACtF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,EAAE,CAAmB,CAAC;QACvD,IAAI,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,MAAM,EAAE,CAA6I,CAAC;QAC7L,IAAI,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC/E,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;YAC1F,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC9E,CAAC,CAAC;AACJ,CAAC"}

package/lib/workroom-runtime/workroom-acceptance-authority.d.ts

@@ -0,0 +1,5 @@
+import type { WorkroomAcceptanceAuthorityPort } from '../workroom/acceptance-control.js';
+export declare const workroomAcceptanceAuthorityToken: import("@zhin.js/plugin-runtime").Token<WorkroomAcceptanceAuthorityPort>;
+/** Resolve for every authorization so a turn never captures a retired generation authority. */
+export declare function createGenerationWorkroomAcceptanceAuthority(resolve: () => WorkroomAcceptanceAuthorityPort | undefined): WorkroomAcceptanceAuthorityPort;
+//# sourceMappingURL=workroom-acceptance-authority.d.ts.map

package/lib/workroom-runtime/workroom-acceptance-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-acceptance-authority.d.ts","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-acceptance-authority.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,+BAA+B,EAGhC,MAAM,mCAAmC,CAAC;AAE3C,eAAO,MAAM,gCAAgC,0EAG5C,CAAC;AAEF,+FAA+F;AAC/F,wBAAgB,2CAA2C,CACzD,OAAO,EAAE,MAAM,+BAA+B,GAAG,SAAS,GACzD,+BAA+B,CAUjC"}

package/lib/workroom-runtime/workroom-acceptance-authority.js

@@ -0,0 +1,14 @@
+import { createToken } from '@zhin.js/plugin-runtime';
+export const workroomAcceptanceAuthorityToken = createToken('zhin.agent.workroom-acceptance-authority', 'Generation-owned Workroom Reviewer and Sponsor acceptance authority');
+/** Resolve for every authorization so a turn never captures a retired generation authority. */
+export function createGenerationWorkroomAcceptanceAuthority(resolve) {
+    return Object.freeze({
+        async authorize(input) {
+            const current = resolve();
+            if (!current)
+                throw new Error('Workroom Acceptance Authority is not installed');
+            return await current.authorize(input);
+        },
+    });
+}
+//# sourceMappingURL=workroom-acceptance-authority.js.map

package/lib/workroom-runtime/workroom-acceptance-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workroom-acceptance-authority.js","sourceRoot":"","sources":["../../src/workroom-runtime/workroom-acceptance-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAOtD,MAAM,CAAC,MAAM,gCAAgC,GAAG,WAAW,CACzD,0CAA0C,EAC1C,qEAAqE,CACtE,CAAC;AAEF,+FAA+F;AAC/F,MAAM,UAAU,2CAA2C,CACzD,OAA0D;IAE1D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,SAAS,CACb,KAAqD;YAErD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAChF,OAAO,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}