dorfl 0.14.2 → 0.15.0

package/dist/install-ci-actions-pr-creation.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The "Allow GitHub Actions to create and approve pull requests" STEP for
+ * `install-ci` (task `install-ci-enables-actions-pr-creation`). A new GitHub
+ * repository has this setting OFF (`GET repos/<r>/actions/permissions/workflow`
+ * answers `can_approve_pull_request_reviews: false`), and with it off GitHub
+ * refuses every pull request the generated workflows try to open with the
+ * ambient `GITHUB_TOKEN`, so propose mode silently opens no PR. dorfl's own
+ * repository has it on, which is why this was only found in a fresh sandbox.
+ *
+ * BEHAVIOUR (mirrors the Tier-1 branch-protection step,
+ * `install-ci-branch-protection.ts`: auto-when-admin, instruct-otherwise):
+ *
+ *   - READ the setting ({@link CIProviderContext.getActionsWorkflowPermissions}).
+ *     Already on: leave it alone and say so.
+ *   - Off (or unreadable) and the credential is repo-admin-scoped: SET it
+ *     ({@link CIProviderContext.setActionsWorkflowPermissions}) with
+ *     `can_approve_pull_request_reviews: true`, carrying the
+ *     `default_workflow_permissions` value that was read so the GITHUB_TOKEN's
+ *     default scope is preserved, never widened or narrowed.
+ *   - Not admin (or unknown): never call the API; print the exact `gh api`
+ *     command and the settings page instead. A rejected PUT is `failed` and
+ *     prints the same command to retry by hand.
+ *   - `--fake`: report what would be checked, call nothing.
+ *
+ * Never throws: a failure is reported in the result and the log, so install-ci's
+ * later steps still run.
+ */
+import type { ActionsWorkflowPermissions, CIProviderContext } from './install-ci-core.js';
+export type { ActionsWorkflowPermissions };
+/**
+ * The exact `gh api` command a user runs to turn the setting on by hand. When
+ * the current `default_workflow_permissions` is known it is passed back
+ * unchanged; when it is not, the field is omitted, which leaves it as it is on
+ * GitHub (both PUT fields are optional). Pure string, no I/O.
+ */
+export declare function formatManualActionsPrCreationCommand(repo: string, defaultWorkflowPermissions?: string): string;
+/** Options for {@link installCIActionsPrCreationStep}. */
+export interface ActionsPrCreationStepOptions {
+    /** The CI-provider seam (GitHub adapter in production; stub in tests). */
+    ctx: CIProviderContext;
+    /** Snapshot mode: never call the live API. */
+    fake?: boolean;
+    /** Sink for human-facing progress lines. */
+    log: (line: string) => void;
+}
+/** The outcome of one actions-PR-creation step run. */
+export interface ActionsPrCreationStepResult {
+    /**
+     * - `already-enabled`: the setting was on; nothing was changed;
+     * - `set`: it was off (or unreadable), admin scope, the PUT succeeded;
+     * - `failed`: admin scope, the PUT was rejected (detail in `error`);
+     * - `instructed`: not admin (or unknown), the manual command was printed;
+     * - `skipped-no-repo`: the provider context has no `repo` known;
+     * - `skipped-no-seam`: the provider does not implement the seam;
+     * - `skipped-fake`: `--fake` snapshot mode (no real API touched).
+     */
+    status: 'already-enabled' | 'set' | 'failed' | 'instructed' | 'skipped-no-repo' | 'skipped-no-seam' | 'skipped-fake';
+    /** The permissions read before any change (`undefined` when unreadable). */
+    before?: ActionsWorkflowPermissions;
+    /** The detected admin-scope verdict (`true`/`false`/`undefined`=unknown). */
+    adminScope?: boolean;
+    /** The failure detail when `status === 'failed'`. */
+    error?: string;
+}
+/**
+ * Check, and when off and permitted, enable the repository setting that lets
+ * GitHub Actions create pull requests (see the module header).
+ */
+export declare function installCIActionsPrCreationStep(options: ActionsPrCreationStepOptions): Promise<ActionsPrCreationStepResult>;
+//# sourceMappingURL=install-ci-actions-pr-creation.d.ts.map

package/dist/install-ci-actions-pr-creation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-ci-actions-pr-creation.d.ts","sourceRoot":"","sources":["../src/install-ci-actions-pr-creation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACX,0BAA0B,EAC1B,iBAAiB,EACjB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAC,0BAA0B,EAAC,CAAC;AAEzC;;;;;GAKG;AACH,wBAAgB,oCAAoC,CACnD,IAAI,EAAE,MAAM,EACZ,0BAA0B,CAAC,EAAE,MAAM,GACjC,MAAM,CASR;AAED,0DAA0D;AAC1D,MAAM,WAAW,4BAA4B;IAC5C,0EAA0E;IAC1E,GAAG,EAAE,iBAAiB,CAAC;IACvB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,4CAA4C;IAC5C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC3C;;;;;;;;OAQG;IACH,MAAM,EACH,iBAAiB,GACjB,KAAK,GACL,QAAQ,GACR,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,cAAc,CAAC;IAClB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,0BAA0B,CAAC;IACpC,6EAA6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAID;;;GAGG;AACH,wBAAsB,8BAA8B,CACnD,OAAO,EAAE,4BAA4B,GACnC,OAAO,CAAC,2BAA2B,CAAC,CAqFtC"}

package/dist/install-ci-actions-pr-creation.js

@@ -0,0 +1,106 @@
+/**
+ * The "Allow GitHub Actions to create and approve pull requests" STEP for
+ * `install-ci` (task `install-ci-enables-actions-pr-creation`). A new GitHub
+ * repository has this setting OFF (`GET repos/<r>/actions/permissions/workflow`
+ * answers `can_approve_pull_request_reviews: false`), and with it off GitHub
+ * refuses every pull request the generated workflows try to open with the
+ * ambient `GITHUB_TOKEN`, so propose mode silently opens no PR. dorfl's own
+ * repository has it on, which is why this was only found in a fresh sandbox.
+ *
+ * BEHAVIOUR (mirrors the Tier-1 branch-protection step,
+ * `install-ci-branch-protection.ts`: auto-when-admin, instruct-otherwise):
+ *
+ *   - READ the setting ({@link CIProviderContext.getActionsWorkflowPermissions}).
+ *     Already on: leave it alone and say so.
+ *   - Off (or unreadable) and the credential is repo-admin-scoped: SET it
+ *     ({@link CIProviderContext.setActionsWorkflowPermissions}) with
+ *     `can_approve_pull_request_reviews: true`, carrying the
+ *     `default_workflow_permissions` value that was read so the GITHUB_TOKEN's
+ *     default scope is preserved, never widened or narrowed.
+ *   - Not admin (or unknown): never call the API; print the exact `gh api`
+ *     command and the settings page instead. A rejected PUT is `failed` and
+ *     prints the same command to retry by hand.
+ *   - `--fake`: report what would be checked, call nothing.
+ *
+ * Never throws: a failure is reported in the result and the log, so install-ci's
+ * later steps still run.
+ */
+/**
+ * The exact `gh api` command a user runs to turn the setting on by hand. When
+ * the current `default_workflow_permissions` is known it is passed back
+ * unchanged; when it is not, the field is omitted, which leaves it as it is on
+ * GitHub (both PUT fields are optional). Pure string, no I/O.
+ */
+export function formatManualActionsPrCreationCommand(repo, defaultWorkflowPermissions) {
+    const keep = defaultWorkflowPermissions !== undefined
+        ? ` -f default_workflow_permissions=${defaultWorkflowPermissions}`
+        : '';
+    return (`gh api -X PUT repos/${repo}/actions/permissions/workflow ` +
+        `-F can_approve_pull_request_reviews=true${keep}`);
+}
+const LABEL = 'actions PR creation';
+/**
+ * Check, and when off and permitted, enable the repository setting that lets
+ * GitHub Actions create pull requests (see the module header).
+ */
+export async function installCIActionsPrCreationStep(options) {
+    const { ctx, log, fake } = options;
+    if (fake) {
+        log(`${LABEL}: skipped (--fake; would check that "Allow GitHub Actions to create and approve pull requests" is on, and enable it if not)`);
+        return { status: 'skipped-fake' };
+    }
+    if (!ctx.getActionsWorkflowPermissions ||
+        !ctx.setActionsWorkflowPermissions) {
+        log(`${LABEL}: skipped (provider does not implement the seam, non-GitHub host).`);
+        return { status: 'skipped-no-seam' };
+    }
+    if (!ctx.repo) {
+        log(`${LABEL}: skipped (repo unknown, pass --repo to enable).`);
+        return { status: 'skipped-no-repo' };
+    }
+    const repo = ctx.repo;
+    const before = await ctx
+        .getActionsWorkflowPermissions()
+        .catch(() => undefined);
+    if (before?.canApprovePullRequestReviews === true) {
+        log(`${LABEL}: "Allow GitHub Actions to create and approve pull requests" is already on for ${repo}.`);
+        return { status: 'already-enabled', before };
+    }
+    const keep = before?.defaultWorkflowPermissions;
+    const adminScope = ctx.getRepoAdminScope
+        ? await ctx.getRepoAdminScope().catch(() => undefined)
+        : undefined;
+    if (adminScope !== true) {
+        log(before === undefined
+            ? `${LABEL}: could not read "Allow GitHub Actions to create and approve pull requests" for ${repo}, and no admin-scoped credential was detected.`
+            : `${LABEL}: "Allow GitHub Actions to create and approve pull requests" is OFF for ${repo}, and no admin-scoped credential was detected.`);
+        log('  With it off, propose mode opens no pull request (GitHub refuses PRs created with GITHUB_TOKEN).');
+        log('  install-ci will NOT call the GitHub API. Run this yourself (admin token required):');
+        log(`    ${formatManualActionsPrCreationCommand(repo, keep)}`);
+        log(`  Manual UI fallback: https://github.com/${repo}/settings/actions ` +
+            '→ "Workflow permissions" → tick "Allow GitHub Actions to create and approve pull requests" → Save.');
+        return { status: 'instructed', before, adminScope };
+    }
+    try {
+        // Carry the default scope through unchanged; when it could not be read,
+        // omit it so GitHub keeps whatever it is.
+        await ctx.setActionsWorkflowPermissions({
+            canApprovePullRequestReviews: true,
+            ...(keep !== undefined ? { defaultWorkflowPermissions: keep } : {}),
+        });
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        log(`${LABEL}: FAILED (${error})`);
+        log('  With it off, propose mode opens no pull request (GitHub refuses PRs created with GITHUB_TOKEN).');
+        log(`  Retry by hand (admin token required):\n` +
+            `    ${formatManualActionsPrCreationCommand(repo, keep)}`);
+        return { status: 'failed', before, adminScope, error };
+    }
+    log(`${LABEL}: enabled "Allow GitHub Actions to create and approve pull requests" on ${repo}` +
+        (keep !== undefined
+            ? ` (default_workflow_permissions kept as ${keep}).`
+            : '.'));
+    return { status: 'set', before, adminScope };
+}
+//# sourceMappingURL=install-ci-actions-pr-creation.js.map

package/dist/install-ci-actions-pr-creation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-ci-actions-pr-creation.js","sourceRoot":"","sources":["../src/install-ci-actions-pr-creation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AASH;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CACnD,IAAY,EACZ,0BAAmC;IAEnC,MAAM,IAAI,GACT,0BAA0B,KAAK,SAAS;QACvC,CAAC,CAAC,oCAAoC,0BAA0B,EAAE;QAClE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CACN,uBAAuB,IAAI,gCAAgC;QAC3D,2CAA2C,IAAI,EAAE,CACjD,CAAC;AACH,CAAC;AAuCD,MAAM,KAAK,GAAG,qBAAqB,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CACnD,OAAqC;IAErC,MAAM,EAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAC,GAAG,OAAO,CAAC;IAEjC,IAAI,IAAI,EAAE,CAAC;QACV,GAAG,CACF,GAAG,KAAK,6HAA6H,CACrI,CAAC;QACF,OAAO,EAAC,MAAM,EAAE,cAAc,EAAC,CAAC;IACjC,CAAC;IACD,IACC,CAAC,GAAG,CAAC,6BAA6B;QAClC,CAAC,GAAG,CAAC,6BAA6B,EACjC,CAAC;QACF,GAAG,CACF,GAAG,KAAK,oEAAoE,CAC5E,CAAC;QACF,OAAO,EAAC,MAAM,EAAE,iBAAiB,EAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACf,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;QAChE,OAAO,EAAC,MAAM,EAAE,iBAAiB,EAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAEtB,MAAM,MAAM,GAAG,MAAM,GAAG;SACtB,6BAA6B,EAAE;SAC/B,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzB,IAAI,MAAM,EAAE,4BAA4B,KAAK,IAAI,EAAE,CAAC;QACnD,GAAG,CACF,GAAG,KAAK,kFAAkF,IAAI,GAAG,CACjG,CAAC;QACF,OAAO,EAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAC,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,0BAA0B,CAAC;IAChD,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB;QACvC,CAAC,CAAC,MAAM,GAAG,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;QACtD,CAAC,CAAC,SAAS,CAAC;IAEb,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CACF,MAAM,KAAK,SAAS;YACnB,CAAC,CAAC,GAAG,KAAK,mFAAmF,IAAI,gDAAgD;YACjJ,CAAC,CAAC,GAAG,KAAK,2EAA2E,IAAI,gDAAgD,CAC1I,CAAC;QACF,GAAG,CACF,mGAAmG,CACnG,CAAC;QACF,GAAG,CACF,sFAAsF,CACtF,CAAC;QACF,GAAG,CAAC,OAAO,oCAAoC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,GAAG,CACF,4CAA4C,IAAI,oBAAoB;YACnE,oGAAoG,CACrG,CAAC;QACF,OAAO,EAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC;QACJ,wEAAwE;QACxE,0CAA0C;QAC1C,MAAM,GAAG,CAAC,6BAA6B,CAAC;YACvC,4BAA4B,EAAE,IAAI;YAClC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAC,0BAA0B,EAAE,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,KAAK,aAAa,KAAK,GAAG,CAAC,CAAC;QACnC,GAAG,CACF,mGAAmG,CACnG,CAAC;QACF,GAAG,CACF,2CAA2C;YAC1C,OAAO,oCAAoC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAC1D,CAAC;QACF,OAAO,EAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAC,CAAC;IACtD,CAAC;IACD,GAAG,CACF,GAAG,KAAK,2EAA2E,IAAI,EAAE;QACxF,CAAC,IAAI,KAAK,SAAS;YAClB,CAAC,CAAC,0CAA0C,IAAI,IAAI;YACpD,CAAC,CAAC,GAAG,CAAC,CACR,CAAC;IACF,OAAO,EAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAC,CAAC;AAC5C,CAAC"}

package/dist/install-ci-capabilities/dorfl-item.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The SPLIT CI ITEM capability emitter (spec `ci-agent-job-without-write-token`,
+ * task `ci-split-generate-workflows`). A SELF-REGISTERING module (see
+ * `example-noop.ts`): it emits `dorfl-item.yml` (the lock, agent and apply jobs
+ * of ONE item) and `dorfl-item-dispatch.yml` (the per-item dispatch wrapper the
+ * advance tick starts), which the advance-lifecycle and intake workflows call.
+ *
+ * The workflow text lives in `dorfl-item-template.ts`; this file is the thin
+ * registry-wiring shim.
+ */
+export {};
+//# sourceMappingURL=dorfl-item.d.ts.map

package/dist/install-ci-capabilities/dorfl-item.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dorfl-item.d.ts","sourceRoot":"","sources":["../../src/install-ci-capabilities/dorfl-item.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/install-ci-capabilities/dorfl-item.js

@@ -0,0 +1,26 @@
+/**
+ * The SPLIT CI ITEM capability emitter (spec `ci-agent-job-without-write-token`,
+ * task `ci-split-generate-workflows`). A SELF-REGISTERING module (see
+ * `example-noop.ts`): it emits `dorfl-item.yml` (the lock, agent and apply jobs
+ * of ONE item) and `dorfl-item-dispatch.yml` (the per-item dispatch wrapper the
+ * advance tick starts), which the advance-lifecycle and intake workflows call.
+ *
+ * The workflow text lives in `dorfl-item-template.ts`; this file is the thin
+ * registry-wiring shim.
+ */
+import { registerCapability } from '../install-ci-core.js';
+import { ITEM_DISPATCH_WORKFLOW_PATH, ITEM_WORKFLOW_PATH, generateItemDispatchWorkflow, generateItemWorkflow, } from '../dorfl-item-template.js';
+registerCapability({
+    id: 'dorfl-item',
+    label: 'Run each CI item as lock, agent and apply jobs (the per-item workflow the advance tick and intake call)',
+    emit(config) {
+        return [
+            { path: ITEM_WORKFLOW_PATH, content: generateItemWorkflow(config) },
+            {
+                path: ITEM_DISPATCH_WORKFLOW_PATH,
+                content: generateItemDispatchWorkflow(config),
+            },
+        ];
+    },
+});
+//# sourceMappingURL=dorfl-item.js.map

package/dist/install-ci-capabilities/dorfl-item.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dorfl-item.js","sourceRoot":"","sources":["../../src/install-ci-capabilities/dorfl-item.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAC,kBAAkB,EAAC,MAAM,uBAAuB,CAAC;AACzD,OAAO,EACN,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,oBAAoB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,kBAAkB,CAAC;IAClB,EAAE,EAAE,YAAY;IAChB,KAAK,EACJ,yGAAyG;IAC1G,IAAI,CAAC,MAAM;QACV,OAAO;YACN,EAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAC;YACjE;gBACC,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,4BAA4B,CAAC,MAAM,CAAC;aAC7C;SACD,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}

package/dist/install-ci-core.d.ts

@@ -10,8 +10,7 @@
  * This module is the PROVIDER-AGNOSTIC half: the config model (`ProviderEntry` /
  * `AuthMode` / `CIConfigFile`), the `models.json` builder, the secret-orchestration
  * LOGIC (which secrets, dedup, prompt-or-take-from-config), the `--export-config`
- * (+ `--include-secrets`) round-trip, the composite-setup-action + OAuth-refresh-
- * script generators, the `--fake` snapshot mechanism (write to `.fake/` instead of
+ * (+ `--include-secrets`) round-trip, the composite-setup-action generators, the `--fake` snapshot mechanism (write to `.fake/` instead of
  * `.github/`), and the capability-emitter REGISTRY seam. It imports NOTHING
  * GitHub-specific: the thin GitHub adapter (`github-ci.ts`) plugs into the
  * {@link CIProviderContext} seam, so a second provider could slot in WITHOUT
@@ -26,16 +25,26 @@
  */
 import type { HarnessAdapter } from './config.js';
 /**
- * The two auth modes, mirroring whitesmith:
- *   - `models-json` (DEFAULT): one GitHub secret per provider API key; the harness
- *     `models.json` is generated inline and references the env var names. No
- *     OAuth-refresh machinery, no `GH_PAT` — the conservative default.
- *   - `auth-json`: a single `PI_AUTH_JSON` secret + a `GH_PAT` for OAuth-token
- *     refresh + an OAuth-refresh script (the `pi-mono#2743` workaround, the SINGLE
- *     CI→repo mutation in the whole design). The known SHARP EDGE; default AWAY
- *     from it.
+ * The auth mode. `models-json` is the ONLY mode: one GitHub secret per provider
+ * API key; the harness `models.json` is generated inline and references the env
+ * vars (`$NAME`). Credential rotation (e.g. OAuth) is NOT done in CI: point a
+ * provider's `baseUrl` at a proxy that rotates credentials outside GitHub.
+ *
+ * The former `auth-json` mode (a `PI_AUTH_JSON` secret + an OAuth-refresh
+ * script that wrote the rotated token back with a write-capable `GH_PAT`) was
+ * REMOVED: its refresh needed a write token in the agent job, which ADR
+ * `ci-agent-job-holds-no-write-token` forbids, and without the refresh the
+ * OAuth token expires within hours. A config still naming it is refused by
+ * {@link loadCIConfigFile} with {@link AUTH_JSON_REMOVED_MESSAGE}. The type
+ * (and the `authMode` config key) is kept so existing `models-json` configs
+ * still parse and export unchanged.
+ */
+export type AuthMode = 'models-json';
+/**
+ * The refusal a config naming the removed `auth-json` mode gets: it says the
+ * mode is gone and names the replacement (`models-json` + a proxy `baseUrl`).
  */
-export type AuthMode = 'auth-json' | 'models-json';
+export declare const AUTH_JSON_REMOVED_MESSAGE: string;
 /**
  * Where the composite setup action gets the `dorfl` CLI from:
  *   - `registry` (default): `npm install -g dorfl` — the published CLI,
@@ -76,7 +85,7 @@ export interface ProviderEntry {
 export interface CIConfigFile {
     /** The auth mode (`models-json` default). */
     authMode: AuthMode;
-    /** The configured providers (empty for `auth-json` mode). */
+    /** The configured providers (non-empty). */
     providers: ProviderEntry[];
     /** The default provider name. */
     defaultProvider: string;
@@ -172,6 +181,19 @@ export declare const DEFAULT_HARNESS: HarnessAdapter;
 export declare const DEFAULT_MAX_PARALLEL = 2;
 /** The default install source: the published CLI via `npm install -g`. */
 export declare const DEFAULT_INSTALL_SOURCE: InstallSource;
+/**
+ * A repository's GitHub Actions workflow permissions, as
+ * `GET /repos/{owner}/{repo}/actions/permissions/workflow` answers them (the
+ * same two fields the PUT accepts). `defaultWorkflowPermissions` is `read` or
+ * `write` on GitHub; typed as a string so an unexpected value is carried
+ * through untouched rather than rewritten.
+ */
+export interface ActionsWorkflowPermissions {
+    /** The GITHUB_TOKEN's default scope (`read` / `write`); preserved on set. */
+    defaultWorkflowPermissions: string;
+    /** "Allow GitHub Actions to create and approve pull requests". */
+    canApprovePullRequestReviews: boolean;
+}
 /**
  * The thin CI-provider seam (whitesmith's proven `GitHubCIContext` shape,
  * generalised so a second provider could slot in without touching the core). A
@@ -252,6 +274,21 @@ export interface CIProviderContext {
      * GitHub provider. Throws on failure (caller catches + logs).
      */
     setBranchRuleset?(ruleset: unknown): Promise<void>;
+    /**
+     * OPTIONALLY read the repo's Actions workflow permissions (GitHub:
+     * `GET /repos/{owner}/{repo}/actions/permissions/workflow`), whose
+     * `can_approve_pull_request_reviews` is the "Allow GitHub Actions to create
+     * and approve pull requests" setting propose mode needs. Returns `undefined`
+     * when the read fails. Absent on a provider with no such setting.
+     */
+    getActionsWorkflowPermissions?(): Promise<ActionsWorkflowPermissions | undefined>;
+    /**
+     * OPTIONALLY set the repo's Actions workflow permissions (GitHub:
+     * `PUT /repos/{owner}/{repo}/actions/permissions/workflow`). A field left
+     * `undefined` is not sent, so GitHub keeps its current value. Throws on
+     * failure (caller catches + logs). Absent on a provider with no such setting.
+     */
+    setActionsWorkflowPermissions?(permissions: Partial<ActionsWorkflowPermissions>): Promise<void>;
     /**
      * OPTIONALLY render the user's project-setup payload (the value of
      * {@link CIConfigFile.projectSetup}[providerId]) to the NATIVE-SYNTAX
@@ -322,30 +359,41 @@ export declare function resolveCapabilitiesDir(override?: string): string;
 export declare function loadCapabilityRegistry(dir?: string): Promise<CapabilityEmitter[]>;
 /**
  * Build the harness `models.json` object from the providers. Built-in providers
- * (`anthropic`/`openai`) get `{apiKey: <ENV_VAR>}` (the harness resolves the env
- * var at runtime); a custom provider carries its `baseUrl`/`api`/`models`/`compat`.
+ * (`anthropic`/`openai`) get `{apiKey: "$<ENV_VAR>"}` (the harness resolves the
+ * env var at runtime); a custom provider carries its `baseUrl`/`api`/`models`/`compat`.
  * Mirrors whitesmith's `buildModelsJson`.
+ *
+ * The `apiKey` is an env-var REFERENCE (see {@link modelsJsonEnvRef}), never the
+ * bare env-var name: pi treats a bare value as a LITERAL key.
  */
 export declare function buildModelsJson(providers: ProviderEntry[]): {
     providers: Record<string, unknown>;
 };
+/**
+ * The `models.json` config value that makes the pi harness read `envVarName`
+ * from the environment: `"$NAME"`. The pinned harness
+ * (`@earendil-works/pi-coding-agent`, `dist/core/resolve-config-value.js`)
+ * resolves a config value as a shell command when it starts with `!`, as an env
+ * var when it is `$NAME` / `${NAME}`, and as a LITERAL otherwise. Writing the bare
+ * name therefore sent the string `ANTHROPIC_API_KEY` as the token (`401
+ * Unauthorized` on every CI launch).
+ */
+export declare function modelsJsonEnvRef(envVarName: string): string;
 /**
  * The DEDUPLICATED set of secret env-var names the config requires, in first-seen
- * order. For `models-json` mode it is one per distinct provider `apiKeyEnvVar`;
- * for `auth-json` mode it is the fixed `PI_AUTH_JSON` + `GH_PAT` pair (the sharp
- * edge). This is the pure secret-orchestration LOGIC the adapter's setter
+ * order: one per distinct provider `apiKeyEnvVar`. This is the pure secret-orchestration LOGIC the adapter's setter
  * consumes — which secrets, deduped — separated from any provider I/O.
  */
 export declare function requiredSecretNames(config: ResolvedCIConfig): string[];
 /**
  * The GitHub secret the propose/merge CI legs read as `GH_TOKEN` to open PRs
- * under a CHOSEN identity (a PAT / App token). It is the PR-IDENTITY token, a
- * distinct purpose from `auth-json` mode's `GH_PAT` (which exists only to rotate
- * the OAuth `PI_AUTH_JSON` secret). The generated workflows reference it as
+ * under a CHOSEN identity (a PAT / App token). The generated workflows reference it as
  * `${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}` so it is
  * OPTIONAL: unset ⇒ the legs fall back to the built-in `GITHUB_TOKEN` (PRs are
- * `github-actions[bot]` and do not trigger downstream `on: pull_request`
- * workflows); set ⇒ PRs carry the token's identity and DO trigger them.
+ * `github-actions[bot]`, and GitHub holds their `on: pull_request` runs in
+ * `action_required` until someone approves them); set ⇒ PRs carry the token's
+ * identity and trigger those workflows on their own. `intake.yml` never passes
+ * it, so intake PRs always need the approval (`docs/ci/README.md`).
  */
 export declare const PR_IDENTITY_SECRET_NAME = "DORFL_GH_TOKEN";
 /**
@@ -367,12 +415,20 @@ export declare function optionalSecretNames(config: ResolvedCIConfig): string[];
  * entry). Each entry maps the action input (named identically to the secret) to
  * `${{ secrets.<NAME> }}`.
  *
- * Empty string when there are no provider keys (auth-json mode, or no providers),
+ * Empty string when there are no provider keys (no providers),
  * so the `uses:` line is emitted bare and unchanged. This is the SINGLE place the
  * provider→`with:` shape lives, shared by every capability workflow generator, so
  * no template re-derives it.
  */
 export declare function providerSecretsWithBlock(config: ResolvedCIConfig): string;
+/**
+ * The provider API key secrets the AGENT-running jobs forward to the setup
+ * action: one per distinct provider key (the same set as
+ * {@link requiredSecretNames}). The split item workflow declares exactly these (plus
+ * {@link PR_IDENTITY_SECRET_NAME}) as its `workflow_call` secrets, and hands
+ * them to its agent job only.
+ */
+export declare function providerSecretNames(config: ResolvedCIConfig): string[];
 /** The outcome of orchestrating one secret through the provider seam. */
 export interface SecretSetResult {
     /** The secret env-var name. */
@@ -460,6 +516,42 @@ export declare const PI_HARNESS_PACKAGE = "@earendil-works/pi-coding-agent";
  * `node-version: '22'` satisfies (setup-node resolves the latest 22.x).
  */
 export declare const PI_HARNESS_VERSION = "0.80.6";
+/**
+ * The `pi` packages the harness LOADS besides itself, each pinned to an exact
+ * version that is known to load with {@link PI_HARNESS_VERSION}.
+ *
+ * `pi-coding-agent` declares its sibling packages with a caret range
+ * (`@earendil-works/pi-ai: ^0.80.6`), which on a `0.x` version floats within
+ * the minor. `pi-ai@0.80.10` removed the `getOAuthApiKey` export that
+ * `pi-coding-agent@0.80.6` imports, so a resolver that honours the caret kills
+ * `pi` on start. npm happens to be protected by the `npm-shrinkwrap.json` the
+ * package publishes; pnpm ignores that file and was broken. Pinning the family
+ * explicitly (as npm `overrides`, see {@link piHarnessManifest}) makes the
+ * install reproducible whatever the resolver.
+ *
+ * The set is `pi-coding-agent`'s own `@earendil-works/*` dependencies plus
+ * theirs (`npm view @earendil-works/pi-coding-agent@<v> dependencies`,
+ * recursively): at 0.80.6 that is pi-ai, pi-agent-core (which depends on pi-ai)
+ * and pi-tui. Re-derive it on every {@link PI_HARNESS_VERSION} bump: a newer
+ * harness may add a package (0.87 adds `@earendil-works/chord`).
+ */
+export declare const PI_HARNESS_PINNED_DEPENDENCIES: Readonly<Record<string, string>>;
+/**
+ * The throwaway `package.json` the setup action installs the harness from: the
+ * harness at {@link PI_HARNESS_VERSION} as the only dependency, and every pi
+ * package it loads forced to its exact pin through npm `overrides`.
+ *
+ * A project-local install (not `npm install -g`) because `overrides` only apply
+ * to the ROOT project, and a global install makes each package its own root. The
+ * same file is used in `registry` and `workspace` mode: pnpm 11 also isolates
+ * every global package, so listing the pins next to the harness in
+ * `pnpm add -g` would not constrain the harness's own tree either.
+ */
+export declare function piHarnessManifest(): {
+    private: true;
+    dependencies: Record<string, string>;
+    overrides: Record<string, string>;
+};
 /**
  * The version of THIS dorfl package, read at runtime from its own
  * `package.json` (the single source changesets bumps on release). The composite
@@ -480,14 +572,11 @@ export declare function dorflPackageVersion(): string;
  * `uses: ./.github/actions/dorfl-setup`. The advance-loop seed template
  * already references this exact action name + path (`docs/ci/README.md`).
  *
- * The auth step branches on the mode: `models-json` writes a generated
- * `~/.pi/agent/models.json` inline (the conservative default) AND exports each
+ * The auth step writes a generated `~/.pi/agent/models.json` inline AND exports each
  * configured provider's API key from a same-named ACTION INPUT to `$GITHUB_ENV`,
  * so the agent step (`pi`) can resolve the env var `models.json` references; the
  * workflow passes the secrets ONCE via `with:` on the `uses:` line (no
- * per-step / per-capability provider enumeration). `auth-json` writes
- * `~/.pi/agent/auth.json` from `$PI_AUTH_JSON` + runs the OAuth-refresh script
- * (the sharp edge). Deterministic: the same config produces byte-identical output.
+ * per-step / per-capability provider enumeration). Deterministic: the same config produces byte-identical output.
  */
 export declare function generateSetupAction(config: ResolvedCIConfig, 
 /**
@@ -499,17 +588,39 @@ export declare function generateSetupAction(config: ResolvedCIConfig,
  * baseline (the load-bearing absent-⇒-identical contract).
  */
 projectSetupSteps?: string): string;
-/**
- * The OAuth-refresh script emitted ONLY in `auth-json` mode (whitesmith's
- * `pi-mono#2743` workaround): refreshes the Anthropic OAuth token in
- * `~/.pi/agent/auth.json` before the agent runs, then writes the rotated token
- * BACK via `gh secret set PI_AUTH_JSON` (the single CI→repo mutation, needing a
- * `GH_PAT`). This is the documented SHARP EDGE; `models-json` mode avoids it.
+/** The local path a workflow step `uses:` for the agent-role setup action. */
+export declare const SETUP_ACTION_USES = "./.github/actions/dorfl-setup";
+/** The local path a workflow step `uses:` for the writer-role setup action. */
+export declare const WRITER_SETUP_ACTION_USES = "./.github/actions/dorfl-setup-writer";
+/**
+ * Generate the WRITER-ROLE composite setup action (`dorfl-setup-writer`, spec
+ * `ci-agent-job-without-write-token` §9, ADR
+ * `ci-agent-job-holds-no-write-token`; task `ci-split-generate-workflows`).
+ *
+ * The jobs that hold a write token and run no agent (the split item
+ * workflow's lock and apply jobs, `reap-merged-branches`, `close-job`, and the
+ * read-only `enumerate`) install Node and dorfl ONLY: no harness, no provider
+ * key, no `models.json`, no project-setup hook, no install of the project's
+ * dependencies, and no Actions cache. In `registry` mode the dorfl install runs
+ * from `$RUNNER_TEMP`, outside the checkout, with `--ignore-scripts`, so a
+ * repository `.npmrc` cannot redirect the registry and no install script runs.
+ *
+ * In `workspace` mode (dorfl's own repository) dorfl is built from source
+ * (decision 8): the tree of `source-ref` (default the checkout's `HEAD`) is
+ * exported with `git archive` into `$RUNNER_TEMP` and built there with
+ * `--ignore-scripts`. In merge mode that is code an earlier agent landed on
+ * `main`, which is the trust merge mode already implies.
+ *
+ * It is a SIBLING action rather than a `role` input on `dorfl-setup`: the
+ * project-setup hook is an opaque fragment spliced first into `dorfl-setup`
+ * (ADR `install-ci-project-provisioning-native-passthrough`), and a composite
+ * action cannot skip an opaque block of steps by input. `dorfl-setup` stays the
+ * agent role, byte for byte.
  */
-export declare const REFRESH_OAUTH_SCRIPT = "#!/usr/bin/env node\n/**\n * Refresh OAuth tokens in the agent's auth.json before it runs.\n *\n * Workaround for https://github.com/badlogic/pi-mono/issues/2743.\n * After refreshing, updates the PI_AUTH_JSON GitHub secret so the next run has\n * the latest rotated refresh token (requires GH_PAT with repo scope). This is the\n * known SHARP EDGE of auth-json mode; models-json mode avoids it entirely.\n *\n * Remove this script once the upstream fix is released.\n */\nimport { readFileSync, writeFileSync, chmodSync } from \"fs\";\nimport { join } from \"path\";\nimport { execSync } from \"child_process\";\n\nconst ANTHROPIC_CLIENT_ID = \"9d1c250a-e61b-44d9-88ed-5944d1962f5e\";\nconst ANTHROPIC_TOKEN_URL = \"https://platform.claude.com/v1/oauth/token\";\n\nconst authPath = join(process.env.HOME, \".pi\", \"agent\", \"auth.json\");\nconst auth = JSON.parse(readFileSync(authPath, \"utf-8\"));\nconst cred = auth.anthropic;\n\nif (!cred || cred.type !== \"oauth\") {\n  console.log(\"No OAuth credentials for anthropic, skipping refresh\");\n  process.exit(0);\n}\n\nif (Date.now() < cred.expires) {\n  console.log(\"Token still valid until\", new Date(cred.expires).toISOString());\n  process.exit(0);\n}\n\nconsole.log(\n  \"Token expired at\",\n  new Date(cred.expires).toISOString(),\n  \"- refreshing...\"\n);\n\nconst response = await fetch(ANTHROPIC_TOKEN_URL, {\n  method: \"POST\",\n  headers: {\n    \"Content-Type\": \"application/x-www-form-urlencoded\",\n    Accept: \"application/json\",\n  },\n  body: new URLSearchParams({\n    grant_type: \"refresh_token\",\n    client_id: ANTHROPIC_CLIENT_ID,\n    refresh_token: cred.refresh,\n  }).toString(),\n  signal: AbortSignal.timeout(30_000),\n});\n\nconst data = await response.json();\n\nif (!response.ok) {\n  console.error(\"Refresh failed:\", response.status, JSON.stringify(data));\n  process.exit(1);\n}\n\nauth.anthropic = {\n  type: \"oauth\",\n  refresh: data.refresh_token,\n  access: data.access_token,\n  expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,\n};\n\nwriteFileSync(authPath, JSON.stringify(auth, null, 2));\nchmodSync(authPath, 0o600);\nconsole.log(\n  \"Token refreshed, new expiry:\",\n  new Date(auth.anthropic.expires).toISOString()\n);\n\n// Update the GitHub secret so the next run has the latest refresh token.\nconst repo = process.env.GITHUB_REPOSITORY;\nconst token = process.env.GH_PAT;\nif (repo && token) {\n  try {\n    execSync(`gh secret set PI_AUTH_JSON --repo \"${repo}\"`, {\n      input: JSON.stringify(auth),\n      env: { ...process.env, GH_TOKEN: token },\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n    console.log(\"PI_AUTH_JSON secret updated\");\n  } catch (err) {\n    console.warn(\"Failed to update secret (non-fatal):\", err.stderr?.toString() || err.message);\n  }\n} else {\n  console.log(\"Skipping secret update (no GH_PAT or GITHUB_REPOSITORY)\");\n}\n";
+export declare function generateWriterSetupAction(config: ResolvedCIConfig): string;
 /**
- * The setup ARTIFACTS this task generates: the composite setup action + (in
- * `auth-json` mode) the OAuth-refresh script, plus any selected capabilities'
+ * The setup ARTIFACTS this task generates: the composite setup actions, plus
+ * any selected capabilities'
  * workflow files. This task emits NO capability workflow itself (those are the
  * sibling tasks); `capabilities` defaults to none.
  */
@@ -534,6 +645,13 @@ export declare function outputBaseName(fake: boolean): string;
  * Write the artifacts under `<workDir>/<base>/` (base = `.fake` when `fake`, else
  * `.github`). Returns the repo-relative paths actually written. Pure filesystem
  * I/O — no secrets, no git. Creates parent dirs as needed.
+ *
+ * PIN PRESERVATION. Before writing a YAML artifact, any `uses:` of an action the
+ * repository's EXISTING `.github/<path>` already pins to a full commit SHA keeps
+ * that reference and its trailing comment (see {@link preserveExistingPins}),
+ * so a Dependabot bump survives regeneration and a pin is never swapped for a
+ * tag. The existing file is always read from `.github/`, also in `--fake` mode,
+ * so the `.fake/` preview shows what a real run would write.
  */
 export declare function writeArtifacts(options: {
     workDir: string;

package/dist/install-ci-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-ci-core.d.ts","sourceRoot":"","sources":["../src/install-ci-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,aAAa,CAAC;AAIhD;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,aAAa,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAErD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,6CAA6C;IAC7C,QAAQ,EAAE,QAAQ,CAAC;IACnB,6DAA6D;IAC7D,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,iCAAiC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,sFAAsF;IACtF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,aAAa,CAAC;IAC7B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/D,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAG3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAC9C,OAAO,CAET;AAED,+DAA+D;AAC/D,eAAO,MAAM,eAAe,EAAE,cAAqB,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,EAAE,aAA0B,CAAC;AAIhE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kEAAkE;IAClE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,mEAAmE;IACnE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD;;;;OAIG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD;;;;;OAKG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;;OAQG;IACH,gBAAgB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;CAC9C;AAED,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAIhD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC3B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,EAAE,CAAC;CAC9C;AAWD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAEnE;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,IAAI,iBAAiB,EAAE,CAE5D;AAED,4DAA4D;AAC5D,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAiB9B;AASD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG;IAC5D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAmBA;AAID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAYtE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAGtE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAUzE;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;IACrC,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IACjD,GAAG,EAAE,iBAAiB,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oFAAoF;IACpF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAoC7B;AAID,gDAAgD;AAChD,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAE3C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAiE/D;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,gBAAgB,CAWpE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAqBR;AAaD;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,oCAAoC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAwB5C;AA6BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,gBAAgB;AACxB;;;;;;;GAOG;AACH,iBAAiB,CAAC,EAAE,MAAM,GACxB,MAAM,CAwMR;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,+1FA2FhC,CAAC;AAIF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,gBAAgB,EACxB,YAAY,GAAE,iBAAiB,EAAO;AACtC;;;;;GAKG;AACH,OAAO,CAAC,EAAE;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAC,GACpC,WAAW,EAAE,CAiBf;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,WAAW,EAAE,CAAC;CACrB,GAAG,MAAM,EAAE,CAUX"}
+{"version":3,"file":"install-ci-core.d.ts","sourceRoot":"","sources":["../src/install-ci-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAWH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,aAAa,CAAC;AAShD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,aAAa,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,yBAAyB,QAIa,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAErD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,MAAM,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC5B,6CAA6C;IAC7C,QAAQ,EAAE,QAAQ,CAAC;IACnB,4CAA4C;IAC5C,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,iCAAiC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,sFAAsF;IACtF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,aAAa,CAAC;IAC7B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/D,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAG3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,GAC9C,OAAO,CAET;AAED,+DAA+D;AAC/D,eAAO,MAAM,eAAe,EAAE,cAAqB,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB,EAAE,aAA0B,CAAC;AAIhE;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IAC1C,6EAA6E;IAC7E,0BAA0B,EAAE,MAAM,CAAC;IACnC,kEAAkE;IAClE,4BAA4B,EAAE,OAAO,CAAC;CACtC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IACjC,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kEAAkE;IAClE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,mEAAmE;IACnE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD;;;;OAIG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D;;;;;;;;OAQG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;;;;;;;;OAQG;IACH,gBAAgB,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD;;;;;OAKG;IACH,iBAAiB,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;;OAQG;IACH,gBAAgB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD;;;;;;OAMG;IACH,6BAA6B,CAAC,IAAI,OAAO,CACxC,0BAA0B,GAAG,SAAS,CACtC,CAAC;IACF;;;;;OAKG;IACH,6BAA6B,CAAC,CAC7B,WAAW,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;CAC9C;AAED,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAIhD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC3B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IACjC,iEAAiE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,EAAE,CAAC;CAC9C;AAWD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAEnE;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,IAAI,iBAAiB,EAAE,CAE5D;AAED,4DAA4D;AAC5D,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC3C,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAiB9B;AASD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG;IAC5D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAqBA;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAStE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAExD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAGtE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CASzE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAEtE;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;IACrC,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IACjD,GAAG,EAAE,iBAAiB,CAAC;IACvB,MAAM,EAAE,gBAAgB,CAAC;IACzB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,oFAAoF;IACpF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAoC7B;AAID,gDAAgD;AAChD,qBAAa,aAAc,SAAQ,KAAK;CAAG;AAE3C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAoE/D;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,gBAAgB,CAWpE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAqBR;AAaD;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,oCAAoC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1E,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,IAAI;IACpC,OAAO,EAAE,IAAI,CAAC;IACd,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAMA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAwB5C;AAgDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,gBAAgB;AACxB;;;;;;;GAOG;AACH,iBAAiB,CAAC,EAAE,MAAM,GACxB,MAAM,CAiLR;AAED,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,kCAAkC,CAAC;AAEjE,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,yCAAyC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAoF1E;AAID;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,gBAAgB,EACxB,YAAY,GAAE,iBAAiB,EAAO;AACtC;;;;;GAKG;AACH,OAAO,CAAC,EAAE;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAC,GACpC,WAAW,EAAE,CAef;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,WAAW,EAAE,CAAC;CACrB,GAAG,MAAM,EAAE,CAiBX"}