dorfl 0.0.0 → 0.1.0

package/dist/install-ci-core.d.ts

@@ -0,0 +1,446 @@
+/**
+ * The provider-agnostic CORE of the `install-ci` scaffolder (prd `runner-in-ci`,
+ * task `install-ci-core-and-github-adapter`; US #7/#10). `install-ci` is a
+ * human-run, one-time SCAFFOLDER (mirrors whitesmith's `src/providers/github-ci.ts`):
+ * it writes `.github/**` + a composite setup action + secrets so autonomous work
+ * can run headless in CI. The running CI job NEVER edits `.github/workflows/**`
+ * (US #9 — that boundary is enforced by the per-capability workflow tasks; the
+ * core stays agnostic to it).
+ *
+ * This module is the PROVIDER-AGNOSTIC half: the config model (`ProviderEntry` /
+ * `AuthMode` / `CIConfigFile`), the `models.json` builder, the secret-orchestration
+ * LOGIC (which secrets, dedup, prompt-or-take-from-config), the `--export-config`
+ * (+ `--include-secrets`) round-trip, the composite-setup-action + OAuth-refresh-
+ * script generators, the `--fake` snapshot mechanism (write to `.fake/` instead of
+ * `.github/`), and the capability-emitter REGISTRY seam. It imports NOTHING
+ * GitHub-specific: the thin GitHub adapter (`github-ci.ts`) plugs into the
+ * {@link CIProviderContext} seam, so a second provider could slot in WITHOUT
+ * touching this core.
+ *
+ * Reuses whitesmith's PATTERNS (the wizard prompts, the `models.json` shape, the
+ * config load/export, the `--fake` mechanism, the secret dedup) but NOT its label
+ * state-machine or issue lifecycle (out of scope). The auth/config shape carries
+ * NO CI-specific policy field: per ADR `ci-config-policy-and-gate-family`, CI
+ * policy is the SAME engine gate family resolved via the generated workflow's
+ * `DORFL_*` env block, NOT a new config knob minted here.
+ */
+import type { HarnessAdapter } from './config.js';
+/**
+ * The two auth modes, mirroring whitesmith:
+ *   - `models-json` (DEFAULT): one GitHub secret per provider API key; the harness
+ *     `models.json` is generated inline and references the env var names. No
+ *     OAuth-refresh machinery, no `GH_PAT` — the conservative default.
+ *   - `auth-json`: a single `PI_AUTH_JSON` secret + a `GH_PAT` for OAuth-token
+ *     refresh + an OAuth-refresh script (the `pi-mono#2743` workaround, the SINGLE
+ *     CI→repo mutation in the whole design). The known SHARP EDGE; default AWAY
+ *     from it.
+ */
+export type AuthMode = 'auth-json' | 'models-json';
+/**
+ * Where the composite setup action gets the `dorfl` CLI from:
+ *   - `registry` (default): `npm install -g dorfl` — the published CLI,
+ *     for every CONSUMER repo;
+ *   - `workspace`: build the CLI from the checked-out source (`pnpm install` +
+ *     `pnpm -r build`) and link it onto PATH, for the SELF-HOSTING dorfl
+ *     monorepo (which is not published under that npm name, so `registry` would
+ *     die with `dorfl: command not found`). Auto-detected when generating
+ *     inside the monorepo (see `installCI`), overridable by an explicit flag/config.
+ */
+export type InstallSource = 'registry' | 'workspace';
+/** A configured AI provider (the harness `models.json` shape this emits). */
+export interface ProviderEntry {
+    /** Provider name (`anthropic` / `openai` / a custom name). */
+    name: string;
+    /** Optional custom base URL (overrides the built-in default). */
+    baseUrl?: string;
+    /** API type for a custom provider (`anthropic-messages` / `openai-completions`). */
+    api?: string;
+    /** The GitHub-secret / env var name the API key is read from at runtime. */
+    apiKeyEnvVar: string;
+    /** The model ids exposed for this provider. */
+    models: {
+        id: string;
+    }[];
+    /** OpenAI-compat capability flags for a custom provider. */
+    compat?: Record<string, boolean>;
+    /** True for the built-in providers (`anthropic` / `openai`). */
+    builtin: boolean;
+}
+/**
+ * Serializable CI configuration: the non-interactive `--config <file>` INPUT and
+ * the `--export-config` OUTPUT. The wizard gathers exactly this; the config-file
+ * path reproduces the wizard's output byte-for-byte from it. When
+ * `--include-secrets` is used, `secrets` maps env var names to their actual API
+ * key values (set via the provider seam's `setSecret` on install).
+ */
+export interface CIConfigFile {
+    /** The auth mode (`models-json` default). */
+    authMode: AuthMode;
+    /** The configured providers (empty for `auth-json` mode). */
+    providers: ProviderEntry[];
+    /** The default provider name. */
+    defaultProvider: string;
+    /** The default model id. */
+    defaultModel: string;
+    /** Which harness the composite setup action installs (`pi` default). */
+    harness?: HarnessAdapter;
+    /** Where to get the CLI from (`registry` default; `workspace` builds from source). */
+    installSource?: InstallSource;
+    /**
+     * Cap on CONCURRENT advance-lifecycle matrix legs (the `max-parallel` of the
+     * propose/merge matrices). Each leg spawns a FULL agent session (build + Gate-2
+     * review), so an unbounded fan-out over a large item set exhausts the model
+     * provider's API rate limit (429s that strand legs as transient-infra stuck) and
+     * thrashes the arbiter-main CAS. Default {@link DEFAULT_MAX_PARALLEL}. Must be a
+     * positive integer.
+     */
+    maxParallel?: number;
+    /** API key values keyed by env var name. Only present with `--include-secrets`. */
+    secrets?: Record<string, string>;
+    /**
+     * The project-setup escape hatch (prd `install-ci-project-provisioning`,
+     * task `install-ci-project-setup-hook`): a PROVIDER-NAMESPACED, OPAQUE,
+     * NATIVE-SYNTAX pass-through map. The key is a provider id (today only
+     * `github`); the value is the user's own project-toolchain snippet in that
+     * provider's NATIVE syntax (for GitHub: a string of Actions step YAML —
+     * `uses:` marketplace actions, `run:` steps). The CORE never parses or
+     * normalizes the snippet (only validates the outer map shape); the active
+     * provider's adapter splices it VERBATIM and FIRST into the generated
+     * composite setup action, before dorfl-install + AI-auth (US #10 of
+     * `install-ci-project-provisioning`). Absent/empty ⇒ the generated
+     * composite action is BYTE-IDENTICAL to today. Round-trips through
+     * `--config` / `--export-config` like every existing knob. Deliberately
+     * NOT a portable cross-provider step-DSL — each adapter consumes its OWN
+     * native shape (ADR `install-ci-project-provisioning-native-passthrough`).
+     */
+    projectSetup?: Record<string, unknown>;
+}
+/**
+ * The fully-resolved config the generators consume (the wizard / config-file path
+ * both produce one of these). Distinct from {@link CIConfigFile} only in that
+ * `authMode` + `harness` are guaranteed present and `secrets` is dropped (secrets
+ * are orchestrated separately, never written into a generated artifact).
+ */
+export interface ResolvedCIConfig {
+    authMode: AuthMode;
+    providers: ProviderEntry[];
+    defaultProvider: string;
+    defaultModel: string;
+    harness: HarnessAdapter;
+    installSource: InstallSource;
+    /** See {@link CIConfigFile.projectSetup}. */
+    projectSetup?: Record<string, unknown>;
+    /** See {@link CIConfigFile.maxParallel}. Always resolved (default applied). */
+    maxParallel: number;
+}
+/** The default harness the composite setup action installs. */
+export declare const DEFAULT_HARNESS: HarnessAdapter;
+/**
+ * The default {@link CIConfigFile.maxParallel}: cap the advance-lifecycle fan-out
+ * at 4 concurrent legs. A full agent session per leg, so this keeps the loop
+ * draining steadily rather than stampeding the model-provider rate limit + the
+ * arbiter CAS. Tunable via `install-ci --max-parallel <n>` / the config file.
+ */
+export declare const DEFAULT_MAX_PARALLEL = 4;
+/** The default install source: the published CLI via `npm install -g`. */
+export declare const DEFAULT_INSTALL_SOURCE: InstallSource;
+/**
+ * The thin CI-provider seam (whitesmith's proven `GitHubCIContext` shape,
+ * generalised so a second provider could slot in without touching the core). A
+ * provider supplies: where it is (`repo`), whether its CLI is usable
+ * (`ghAvailable` for GitHub), and how to set a secret (`setSecret`). Tests STUB
+ * this entirely — `setSecret` records to memory, `ghAvailable=false`, `repo` a
+ * fixture — so no network, no real `gh`, no real GitHub repo detection is touched.
+ *
+ * The historical GitHub name {@link GitHubCIContext} is kept as an alias so the
+ * whitesmith vocabulary the task adopts reads literally.
+ */
+export interface CIProviderContext {
+    /** The target repo's working directory (where `.github/` / `.fake/` is written). */
+    workDir: string;
+    /**
+     * Stable id for THIS provider adapter (today only `github`). Used by the
+     * orchestrator to pick the active provider's payload out of
+     * {@link CIConfigFile.projectSetup} (the provider-namespaced opaque
+     * pass-through). Optional so a provider that never participates in the
+     * project-setup hook can omit it; the orchestrator then renders no
+     * fragment and the composite action is unchanged.
+     */
+    readonly providerId?: string;
+    /** The `owner/repo` slug, or `undefined` when not (yet) known. */
+    repo: string | undefined;
+    /** Whether the provider's CLI (`gh`) is available + authenticated. */
+    ghAvailable: boolean;
+    /** Record/set a secret on the provider. Tests record to memory. */
+    setSecret(name: string, value: string): Promise<void>;
+    /**
+     * OPTIONALLY set a provider repo-setting (capability-F residue: GitHub's
+     * `delete_branch_on_merge`). Absent on a provider that has no such setting.
+     * Stubbed in tests; never silently toggled (the wizard prompts).
+     */
+    setRepoSetting?(name: string, value: boolean): Promise<void>;
+    /**
+     * OPTIONALLY report whether the configured credential has REPO-ADMIN scope
+     * on the provider (→ can set branch protection / rulesets). Used by the
+     * Tier-1 branch-protection step (prd `land-time-reverify-and-parallel-
+     * merge-ceiling`, Story 11) to pick `auto-configure` vs `print fallback`.
+     * `true` ⇒ admin, `false` ⇒ explicitly NOT admin, `undefined` ⇒ unknown
+     * (treated as non-admin: never silently attempt a call that would 403).
+     * Absent on a provider that has no concept of admin scope.
+     */
+    getRepoAdminScope?(): Promise<boolean | undefined>;
+    /**
+     * OPTIONALLY configure Tier-1 branch protection on `branch` per `spec`. The
+     * spec body (`BranchProtectionSpec` in `install-ci-branch-protection.ts`) is
+     * a structural type — typed as `unknown` here to keep this core seam free of
+     * the branch-protection module's import. Absent on a non-GitHub provider.
+     * Throws on failure (caller catches + logs).
+     */
+    setBranchProtection?(branch: string, spec: unknown): Promise<void>;
+    /**
+     * OPTIONALLY render the user's project-setup payload (the value of
+     * {@link CIConfigFile.projectSetup}[providerId]) to the NATIVE-SYNTAX
+     * fragment the composite setup action splices in FIRST (before
+     * setup-node, dorfl-install, and AI-auth). The adapter owns the LIGHT
+     * structural sanity check (for GitHub: list-of-mapping-shaped steps) and
+     * the indentation that makes the fragment splice cleanly into the
+     * composite action's `steps:` body. The returned string is treated as
+     * OPAQUE by the core — bytes-in == bytes-out, modulo the indentation the
+     * adapter applies. Throws on a malformed payload (caller surfaces). An
+     * adapter that never participates in this hook omits the method; an
+     * `undefined`/missing payload short-circuits to no fragment.
+     */
+    renderProjectSetup?(payload: unknown): string;
+}
+/** Whitesmith's name for {@link CIProviderContext} (the seam this task adopts). */
+export type GitHubCIContext = CIProviderContext;
+/**
+ * One file/artifact a capability emitter produces (a workflow YAML, etc.). `path`
+ * is repo-relative (under the output base — `.github/` or `.fake/`).
+ */
+export interface EmittedFile {
+    /** Path relative to the output base (e.g. `workflows/advance-lifecycle.yml`). */
+    path: string;
+    /** The file's full text content. */
+    content: string;
+}
+/**
+ * A capability emitter: a per-capability module that, given the resolved config,
+ * returns the workflow file(s) for its capability. The sibling capability
+ * tasks (advance-lifecycle, intake, close-job) each ADD one of these
+ * as a NEW self-registering module — NOT an edit to a shared central
+ * list/switch — so they stay file-orthogonal and mergeable in parallel
+ * (WORK-CONTRACT task-quality / `to-task` §3).
+ */
+export interface CapabilityEmitter {
+    /** A stable id for the capability (e.g. `advance-lifecycle`). */
+    id: string;
+    /** Human-readable label for the wizard's capability selection. */
+    label: string;
+    /** Emit this capability's workflow file(s) for the resolved config. */
+    emit(config: ResolvedCIConfig): EmittedFile[];
+}
+/**
+ * Register a capability emitter. Idempotent per id (re-registering the same id
+ * replaces it — module import is idempotent). Called at import time by each
+ * capability module under `install-ci-capabilities/`.
+ */
+export declare function registerCapability(emitter: CapabilityEmitter): void;
+/** The currently-registered capabilities (in registration order). */
+export declare function registeredCapabilities(): CapabilityEmitter[];
+/** Reset the registry (tests; never used in production). */
+export declare function clearCapabilityRegistry(): void;
+/**
+ * Locate the `install-ci-capabilities/` directory next to this module — the
+ * DIRECTORY of self-registering capability emitters. Resolved relative to this
+ * source file so it works from both `src/` (tsx) and `dist/` (the built CLI).
+ * `override` short-circuits for tests / unusual layouts.
+ */
+export declare function resolveCapabilitiesDir(override?: string): string;
+/**
+ * Discover + import every capability module under `install-ci-capabilities/`,
+ * each of which self-registers via {@link registerCapability} at import time.
+ * This is the file-orthogonality mechanism: a new capability is a NEW file in
+ * that directory, picked up here WITHOUT editing any shared list/switch. Returns
+ * the registry after loading. `dir` overrides the directory (tests).
+ */
+export declare function loadCapabilityRegistry(dir?: string): Promise<CapabilityEmitter[]>;
+/**
+ * Build the harness `models.json` object from the providers. Built-in providers
+ * (`anthropic`/`openai`) get `{apiKey: <ENV_VAR>}` (the harness resolves the env
+ * var at runtime); a custom provider carries its `baseUrl`/`api`/`models`/`compat`.
+ * Mirrors whitesmith's `buildModelsJson`.
+ */
+export declare function buildModelsJson(providers: ProviderEntry[]): {
+    providers: Record<string, unknown>;
+};
+/**
+ * The DEDUPLICATED set of secret env-var names the config requires, in first-seen
+ * order. For `models-json` mode it is one per distinct provider `apiKeyEnvVar`;
+ * for `auth-json` mode it is the fixed `PI_AUTH_JSON` + `GH_PAT` pair (the sharp
+ * edge). This is the pure secret-orchestration LOGIC the adapter's setter
+ * consumes — which secrets, deduped — separated from any provider I/O.
+ */
+export declare function requiredSecretNames(config: ResolvedCIConfig): string[];
+/**
+ * The GitHub secret the propose/merge CI legs read as `GH_TOKEN` to open PRs
+ * under a CHOSEN identity (a PAT / App token). It is the PR-IDENTITY token, a
+ * distinct purpose from `auth-json` mode's `GH_PAT` (which exists only to rotate
+ * the OAuth `PI_AUTH_JSON` secret). The generated workflows reference it as
+ * `${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}` so it is
+ * OPTIONAL: unset ⇒ the legs fall back to the built-in `GITHUB_TOKEN` (PRs are
+ * `github-actions[bot]` and do not trigger downstream `on: pull_request`
+ * workflows); set ⇒ PRs carry the token's identity and DO trigger them.
+ */
+export declare const PR_IDENTITY_SECRET_NAME = "DORFL_GH_TOKEN";
+/**
+ * The DEDUPLICATED set of OPTIONAL secret env-var names install-ci offers but
+ * never requires. Today that is the single PR-identity token
+ * ({@link PR_IDENTITY_SECRET_NAME}). Kept separate from {@link requiredSecretNames}
+ * so "required" stays honestly required (an empty required key still SKIPS, but
+ * these are offered as explicitly optional and are never part of the required
+ * set the export/validation paths reason about). De-duped against the required
+ * names so a token already required (it never is today) is not offered twice.
+ */
+export declare function optionalSecretNames(config: ResolvedCIConfig): string[];
+/**
+ * The `with:` block (YAML fragment, leading newline included) the AGENT-RUNNING CI
+ * jobs append to their `uses: ./.github/actions/dorfl-setup` line to pass
+ * the configured provider API key secret(s) to the setup action ONCE — the action
+ * forwards them to `$GITHUB_ENV` so `pi` can authenticate. Indented to attach
+ * under a `      - uses: ...` step line (8 spaces for `with:`, 10 for each
+ * entry). Each entry maps the action input (named identically to the secret) to
+ * `${{ secrets.<NAME> }}`.
+ *
+ * Empty string when there are no provider keys (auth-json mode, or no providers),
+ * so the `uses:` line is emitted bare and unchanged. This is the SINGLE place the
+ * provider→`with:` shape lives, shared by every capability workflow generator, so
+ * no template re-derives it.
+ */
+export declare function providerSecretsWithBlock(config: ResolvedCIConfig): string;
+/** The outcome of orchestrating one secret through the provider seam. */
+export interface SecretSetResult {
+    /** The secret env-var name. */
+    name: string;
+    /** `set` (recorded on the provider) / `skipped` (no value) / `failed`. */
+    status: 'set' | 'skipped' | 'failed';
+    /** The failure detail when `status === 'failed'`. */
+    error?: string;
+}
+/**
+ * Orchestrate the required secrets through the provider seam: for each
+ * DEDUPLICATED required name, take its value from `knownSecrets` (the
+ * config-file/`--include-secrets` path) when present, else from `prompt` (the
+ * interactive path), then record it via `ctx.setSecret`. An empty value is
+ * SKIPPED (never set blank); a `setSecret` rejection is reported as `failed`
+ * without aborting the rest. Mirrors whitesmith's `setOrPromptSecrets` dedup +
+ * prompt-or-take logic, but provider-agnostic (the seam is `ctx.setSecret`).
+ *
+ * NO real secret is touched in `--fake` mode / tests: the caller passes a STUB
+ * `ctx` whose `setSecret` records to memory. This function never reads/writes a
+ * real secrets store, `~`, or git config.
+ */
+export declare function orchestrateSecrets(options: {
+    ctx: CIProviderContext;
+    config: ResolvedCIConfig;
+    /** Known secret values (config-file `secrets` / `--include-secrets`). */
+    knownSecrets?: Record<string, string>;
+    /** Prompt for a missing REQUIRED secret value (interactive path). Tests stub it. */
+    prompt?: (name: string) => Promise<string>;
+    /**
+     * Prompt for a missing OPTIONAL secret value ({@link optionalSecretNames}) — the
+     * PR-identity token. Distinct from {@link orchestrateSecrets.prompt} so the UI can
+     * phrase it as optional (empty ⇒ cleanly skipped, the documented zero-config
+     * fallback). Omitted ⇒ optional secrets are taken ONLY from `knownSecrets`
+     * (never prompted), so the non-interactive/config-file path is unchanged.
+     */
+    optionalPrompt?: (name: string) => Promise<string>;
+}): Promise<SecretSetResult[]>;
+/** Raised for a malformed `--config <file>`. */
+export declare class CIConfigError extends Error {
+}
+/**
+ * Load + validate a `--config <file>`: the non-interactive path that skips all
+ * prompts. The loaded config reproduces the wizard's output byte-for-byte. A
+ * missing/empty required field is a loud {@link CIConfigError} (never a silent
+ * default), because a config file is a deliberate reproduction artifact.
+ */
+export declare function loadCIConfigFile(filePath: string): CIConfigFile;
+/** Resolve a loaded/gathered {@link CIConfigFile} into a {@link ResolvedCIConfig}. */
+export declare function resolveCIConfig(file: CIConfigFile): ResolvedCIConfig;
+/**
+ * Serialise a config to the `--export-config` JSON text (stable 2-space indent +
+ * trailing newline, exactly the shape {@link loadCIConfigFile} reads back). When
+ * `secrets` is supplied (the `--include-secrets` path) it is included; otherwise
+ * the `secrets` field is omitted entirely (never an empty object).
+ */
+export declare function exportCIConfig(config: ResolvedCIConfig, secrets?: Record<string, string>): string;
+/**
+ * Generate the shared COMPOSITE SETUP ACTION (`dorfl-setup`): installs
+ * Node + `dorfl` + the configured harness, configures git identity, and
+ * configures AI-provider auth. Written to
+ * `<base>/actions/dorfl-setup/action.yml` so a workflow can
+ * `uses: ./.github/actions/dorfl-setup`. The advance-loop seed template
+ * already references this exact action name + path (`docs/ci/README.md`).
+ *
+ * The auth step branches on the mode: `models-json` writes a generated
+ * `~/.pi/agent/models.json` inline (the conservative default) AND exports each
+ * configured provider's API key from a same-named ACTION INPUT to `$GITHUB_ENV`,
+ * so the agent step (`pi`) can resolve the env var `models.json` references; the
+ * workflow passes the secrets ONCE via `with:` on the `uses:` line (no
+ * per-step / per-capability provider enumeration). `auth-json` writes
+ * `~/.pi/agent/auth.json` from `$PI_AUTH_JSON` + runs the OAuth-refresh script
+ * (the sharp edge). Deterministic: the same config produces byte-identical output.
+ */
+export declare function generateSetupAction(config: ResolvedCIConfig, 
+/**
+ * OPTIONAL provider-rendered project-setup steps fragment, already indented
+ * to splice into the composite action's `steps:` body (4-space indent on
+ * the `- ` list-item lines). The CORE treats this as OPAQUE: bytes-in ==
+ * bytes-out (modulo the indentation the adapter already applied). When
+ * absent/empty, the generated action is BYTE-IDENTICAL to the no-hook
+ * baseline (the load-bearing absent-⇒-identical contract).
+ */
+projectSetupSteps?: string): string;
+/**
+ * The OAuth-refresh script emitted ONLY in `auth-json` mode (whitesmith's
+ * `pi-mono#2743` workaround): refreshes the Anthropic OAuth token in
+ * `~/.pi/agent/auth.json` before the agent runs, then writes the rotated token
+ * BACK via `gh secret set PI_AUTH_JSON` (the single CI→repo mutation, needing a
+ * `GH_PAT`). This is the documented SHARP EDGE; `models-json` mode avoids it.
+ */
+export declare const REFRESH_OAUTH_SCRIPT = "#!/usr/bin/env node\n/**\n * Refresh OAuth tokens in the agent's auth.json before it runs.\n *\n * Workaround for https://github.com/badlogic/pi-mono/issues/2743.\n * After refreshing, updates the PI_AUTH_JSON GitHub secret so the next run has\n * the latest rotated refresh token (requires GH_PAT with repo scope). This is the\n * known SHARP EDGE of auth-json mode; models-json mode avoids it entirely.\n *\n * Remove this script once the upstream fix is released.\n */\nimport { readFileSync, writeFileSync, chmodSync } from \"fs\";\nimport { join } from \"path\";\nimport { execSync } from \"child_process\";\n\nconst ANTHROPIC_CLIENT_ID = \"9d1c250a-e61b-44d9-88ed-5944d1962f5e\";\nconst ANTHROPIC_TOKEN_URL = \"https://platform.claude.com/v1/oauth/token\";\n\nconst authPath = join(process.env.HOME, \".pi\", \"agent\", \"auth.json\");\nconst auth = JSON.parse(readFileSync(authPath, \"utf-8\"));\nconst cred = auth.anthropic;\n\nif (!cred || cred.type !== \"oauth\") {\n  console.log(\"No OAuth credentials for anthropic, skipping refresh\");\n  process.exit(0);\n}\n\nif (Date.now() < cred.expires) {\n  console.log(\"Token still valid until\", new Date(cred.expires).toISOString());\n  process.exit(0);\n}\n\nconsole.log(\n  \"Token expired at\",\n  new Date(cred.expires).toISOString(),\n  \"- refreshing...\"\n);\n\nconst response = await fetch(ANTHROPIC_TOKEN_URL, {\n  method: \"POST\",\n  headers: {\n    \"Content-Type\": \"application/x-www-form-urlencoded\",\n    Accept: \"application/json\",\n  },\n  body: new URLSearchParams({\n    grant_type: \"refresh_token\",\n    client_id: ANTHROPIC_CLIENT_ID,\n    refresh_token: cred.refresh,\n  }).toString(),\n  signal: AbortSignal.timeout(30_000),\n});\n\nconst data = await response.json();\n\nif (!response.ok) {\n  console.error(\"Refresh failed:\", response.status, JSON.stringify(data));\n  process.exit(1);\n}\n\nauth.anthropic = {\n  type: \"oauth\",\n  refresh: data.refresh_token,\n  access: data.access_token,\n  expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n};\n\nwriteFileSync(authPath, JSON.stringify(auth, null, 2));\nchmodSync(authPath, 0o600);\nconsole.log(\n  \"Token refreshed, new expiry:\",\n  new Date(auth.anthropic.expires).toISOString()\n);\n\n// Update the GitHub secret so the next run has the latest refresh token.\nconst repo = process.env.GITHUB_REPOSITORY;\nconst token = process.env.GH_PAT;\nif (repo && token) {\n  try {\n    execSync(`gh secret set PI_AUTH_JSON --repo \"${repo}\"`, {\n      input: JSON.stringify(auth),\n      env: { ...process.env, GH_TOKEN: token },\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n    console.log(\"PI_AUTH_JSON secret updated\");\n  } catch (err) {\n    console.warn(\"Failed to update secret (non-fatal):\", err.stderr?.toString() || err.message);\n  }\n} else {\n  console.log(\"Skipping secret update (no GH_PAT or GITHUB_REPOSITORY)\");\n}\n";
+/**
+ * The setup ARTIFACTS this task generates: the composite setup action + (in
+ * `auth-json` mode) the OAuth-refresh script, plus any selected capabilities'
+ * workflow files. This task emits NO capability workflow itself (those are the
+ * sibling tasks); `capabilities` defaults to none.
+ */
+export declare function buildSetupArtifacts(config: ResolvedCIConfig, capabilities?: CapabilityEmitter[], 
+/**
+ * OPTIONAL bag of provider-rendered fragments to splice into the generated
+ * artifacts. `projectSetupSteps`: see {@link generateSetupAction}. Threaded
+ * here so the orchestrator (`installCI`) can pre-render via the active
+ * provider seam and keep this core function provider-agnostic.
+ */
+options?: {
+    projectSetupSteps?: string;
+}): EmittedFile[];
+/**
+ * The output base directory name: `.fake` in `--fake` snapshot mode (a scratch
+ * dir, NEVER `.github/`), else `.github`. The `--fake` mechanism: write to a
+ * `.fake/` scratch dir, never the real `.github/`, and set NO real secret — so
+ * the produced files are snapshot-asserted with no side effects on the repo.
+ */
+export declare function outputBaseName(fake: boolean): string;
+/**
+ * Write the artifacts under `<workDir>/<base>/` (base = `.fake` when `fake`, else
+ * `.github`). Returns the repo-relative paths actually written. Pure filesystem
+ * I/O — no secrets, no git. Creates parent dirs as needed.
+ */
+export declare function writeArtifacts(options: {
+    workDir: string;
+    fake: boolean;
+    files: EmittedFile[];
+}): string[];
+//# sourceMappingURL=install-ci-core.d.ts.map

package/dist/install-ci-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-ci-core.d.ts","sourceRoot":"","sources":["../src/install-ci-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,aAAa,CAAC;AAIhD;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,aAAa,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAErD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,6CAA6C;IAC7C,QAAQ,EAAE,QAAQ,CAAC;IACnB,6DAA6D;IAC7D,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,iCAAiC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,sFAAsF;IACtF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,aAAa,CAAC;IAC7B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,+DAA+D;AAC/D,eAAO,MAAM,eAAe,EAAE,cAAqB,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,EAAE,aAA0B,CAAC;AAIhE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kEAAkE;IAClE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,mEAAmE;IACnE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD;;;;OAIG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;CAC9C;AAED,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAIhD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC3B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,EAAE,CAAC;CAC9C;AAWD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAEnE;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,IAAI,iBAAiB,EAAE,CAE5D;AAED,4DAA4D;AAC5D,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAiB9B;AASD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG;IAC5D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAmBA;AAID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAYtE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAGtE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAUzE;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;IACrC,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IACjD,GAAG,EAAE,iBAAiB,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oFAAoF;IACpF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAoC7B;AAID,gDAAgD;AAChD,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAE3C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAiE/D;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,gBAAgB,CAWpE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAqBR;AAoCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,gBAAgB;AACxB;;;;;;;GAOG;AACH,iBAAiB,CAAC,EAAE,MAAM,GACxB,MAAM,CAqNR;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,+1FA2FhC,CAAC;AAIF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,gBAAgB,EACxB,YAAY,GAAE,iBAAiB,EAAO;AACtC;;;;;GAKG;AACH,OAAO,CAAC,EAAE;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAC,GACpC,WAAW,EAAE,CAiBf;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,WAAW,EAAE,CAAC;CACrB,GAAG,MAAM,EAAE,CAUX"}