huddle60 0.0.0-stage → 0.1.1

package/dist/action.js

@@ -0,0 +1,1601 @@
+// src/entry/action.ts
+import { appendFile, readFile } from "node:fs/promises";
+
+// src/adapters/git-evidence.ts
+import { setTimeout as delay } from "node:timers/promises";
+
+// src/core/canonical.ts
+import { createHash } from "node:crypto";
+var CANONICAL_VERSION = 1;
+function normalizeText(value) {
+  return value.normalize("NFC").replace(/\r\n?/g, "\n").split("\n").map((line) => line.replace(/[ \t]+$/u, "")).join("\n").replace(/^\n+/u, "").replace(/\n+$/u, "");
+}
+function normalizeDeep(value, path) {
+  if (value === null) return null;
+  if (typeof value === "string") return normalizeText(value);
+  if (typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError(`Non-finite number at ${path}`);
+    return value;
+  }
+  if (Array.isArray(value))
+    return value.map((item, index) => normalizeDeep(item, `${path}[${index}]`));
+  if (typeof value === "object") {
+    const result = {};
+    for (const [key, item] of Object.entries(value)) {
+      if (item === void 0) continue;
+      result[key] = normalizeDeep(item, `${path}.${key}`);
+    }
+    return result;
+  }
+  throw new TypeError(`Unsupported value of type ${typeof value} at ${path}`);
+}
+function canonicalJson(value) {
+  return serialize(normalizeDeep(value, "$"));
+}
+function serialize(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(serialize).join(",")}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${serialize(value[key])}`).join(",")}}`;
+}
+function sha256(text) {
+  return `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`;
+}
+function contentHash(payload) {
+  const { contentHash: _ignored, ...rest } = payload;
+  return sha256(canonicalJson(rest));
+}
+function shortHash(hash, length = 12) {
+  return hash.replace(/^sha256:/u, "").slice(0, length);
+}
+
+// src/core/errors.ts
+var AiDlcError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "AiDlcError";
+    this.code = code;
+  }
+};
+function isAiDlcError(error) {
+  return error instanceof AiDlcError;
+}
+
+// src/adapters/github.ts
+import { createAppAuth } from "@octokit/auth-app";
+import { retry } from "@octokit/plugin-retry";
+import { Octokit } from "@octokit/rest";
+var RetryingOctokit = Octokit.plugin(retry);
+var USER_AGENT = "huddle60/0.1.0";
+var defaultLog = process.env.AI_DLC_DEBUG ? void 0 : {
+  debug: () => {
+  },
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+function octokitFromToken(token) {
+  return new RetryingOctokit({ auth: token, userAgent: USER_AGENT, log: defaultLog });
+}
+function isStatus(error, ...statuses) {
+  return typeof error === "object" && error !== null && statuses.includes(error.status ?? -1);
+}
+function toActor(user) {
+  return user ? { id: user.id, login: user.login, type: user.type } : { id: 0, login: "ghost", type: "User" };
+}
+function toIssue(raw) {
+  return {
+    id: raw.id,
+    nodeId: raw.node_id,
+    number: raw.number,
+    title: raw.title,
+    body: raw.body ?? "",
+    state: raw.state === "closed" ? "closed" : "open",
+    stateReason: raw.state_reason ?? null,
+    labels: raw.labels.map((label) => typeof label === "string" ? label : label.name ?? "").filter(Boolean),
+    author: toActor(raw.user),
+    isPullRequest: raw.pull_request !== void 0 && raw.pull_request !== null
+  };
+}
+async function connectRepository(octokit, owner, repo) {
+  const { data } = await octokit.rest.repos.get({ owner, repo });
+  return new OctokitGitHub(octokit, { owner, repo, repositoryId: data.id }, data.default_branch);
+}
+var OctokitGitHub = class {
+  constructor(octokit, repo, defaultBranch) {
+    this.octokit = octokit;
+    this.repo = repo;
+    this.defaultBranch = defaultBranch;
+  }
+  octokit;
+  repo;
+  defaultBranch;
+  projectIds = /* @__PURE__ */ new Map();
+  get base() {
+    return { owner: this.repo.owner, repo: this.repo.repo };
+  }
+  async getDefaultBranch() {
+    if (!this.defaultBranch) {
+      const { data } = await this.octokit.rest.repos.get(this.base);
+      this.defaultBranch = data.default_branch;
+    }
+    return this.defaultBranch;
+  }
+  async readFile(path, ref) {
+    try {
+      const { data } = await this.octokit.rest.repos.getContent({
+        ...this.base,
+        path,
+        ...ref ? { ref } : {}
+      });
+      if (Array.isArray(data) || data.type !== "file" || !("content" in data)) return null;
+      return Buffer.from(data.content, "base64").toString("utf8");
+    } catch (error) {
+      if (isStatus(error, 404)) return null;
+      throw error;
+    }
+  }
+  async getIssue(number) {
+    try {
+      const { data } = await this.octokit.rest.issues.get({ ...this.base, issue_number: number });
+      return toIssue(data);
+    } catch (error) {
+      if (isStatus(error, 404, 410))
+        throw new AiDlcError("E_GITHUB_API", `Issue #${number} was not found.`);
+      throw error;
+    }
+  }
+  async getComment(id) {
+    try {
+      const { data } = await this.octokit.rest.issues.getComment({ ...this.base, comment_id: id });
+      return { id: data.id, body: data.body ?? "", author: toActor(data.user) };
+    } catch (error) {
+      if (isStatus(error, 404)) return null;
+      throw error;
+    }
+  }
+  async createIssue(input) {
+    const { data } = await this.octokit.rest.issues.create({ ...this.base, ...input });
+    return toIssue(data);
+  }
+  async listIssuesWithLabel(label) {
+    const items = await this.octokit.paginate(this.octokit.rest.issues.listForRepo, {
+      ...this.base,
+      labels: label,
+      state: "all",
+      per_page: 100
+    });
+    return items.map(toIssue).filter((issue) => !issue.isPullRequest);
+  }
+  async addLabels(issueNumber, labels) {
+    await this.octokit.rest.issues.addLabels({ ...this.base, issue_number: issueNumber, labels });
+  }
+  async removeLabel(issueNumber, label) {
+    try {
+      await this.octokit.rest.issues.removeLabel({
+        ...this.base,
+        issue_number: issueNumber,
+        name: label
+      });
+    } catch (error) {
+      if (!isStatus(error, 404)) throw error;
+    }
+  }
+  async upsertComment(issueNumber, marker2, body) {
+    const comments = await this.octokit.paginate(this.octokit.rest.issues.listComments, {
+      ...this.base,
+      issue_number: issueNumber,
+      per_page: 100
+    });
+    const existing = comments.find(
+      (comment) => comment.user?.type === "Bot" && (comment.body ?? "").includes(marker2)
+    );
+    const text = body.includes(marker2) ? body : `${body}
+${marker2}`;
+    if (existing) {
+      await this.octokit.rest.issues.updateComment({
+        ...this.base,
+        comment_id: existing.id,
+        body: text
+      });
+    } else {
+      await this.octokit.rest.issues.createComment({
+        ...this.base,
+        issue_number: issueNumber,
+        body: text
+      });
+    }
+  }
+  async closeIssue(issueNumber, reason) {
+    await this.octokit.rest.issues.update({
+      ...this.base,
+      issue_number: issueNumber,
+      state: "closed",
+      state_reason: reason
+    });
+  }
+  async addSubIssue(parentNumber, childId) {
+    try {
+      await this.octokit.request("POST /repos/{owner}/{repo}/issues/{issue_number}/sub_issues", {
+        ...this.base,
+        issue_number: parentNumber,
+        sub_issue_id: childId
+      });
+      return "linked";
+    } catch (error) {
+      if (isStatus(error, 404)) return "unsupported";
+      throw error;
+    }
+  }
+  async projectId(owner, number) {
+    const key = `${owner}/${number}`;
+    const cached = this.projectIds.get(key);
+    if (cached) return cached;
+    const query = `query($owner: String!, $number: Int!) {
+      organization(login: $owner) { projectV2(number: $number) { id } }
+    }`;
+    let id;
+    try {
+      const result = await this.octokit.graphql(query, { owner, number });
+      id = result.organization?.projectV2?.id;
+    } catch {
+      const userQuery = `query($owner: String!, $number: Int!) { user(login: $owner) { projectV2(number: $number) { id } } }`;
+      const result = await this.octokit.graphql(userQuery, { owner, number });
+      id = result.user?.projectV2?.id;
+    }
+    if (!id)
+      throw new AiDlcError("E_GITHUB_API", `Project ${key} was not found or is not accessible.`);
+    this.projectIds.set(key, id);
+    return id;
+  }
+  async addToProject(project, contentNodeId) {
+    const projectId = await this.projectId(project.owner, project.number);
+    await this.octokit.graphql(
+      `mutation($projectId: ID!, $contentId: ID!) {
+        addProjectV2ItemById(input: { projectId: $projectId, contentId: $contentId }) { item { id } }
+      }`,
+      { projectId, contentId: contentNodeId }
+    );
+  }
+  async getPullRequest(number) {
+    const { data } = await this.octokit.rest.pulls.get({ ...this.base, pull_number: number });
+    return {
+      number: data.number,
+      body: data.body ?? "",
+      headSha: data.head.sha,
+      labels: data.labels.map((label) => label.name)
+    };
+  }
+  async listPullRequestFiles(number) {
+    const files = await this.octokit.paginate(this.octokit.rest.pulls.listFiles, {
+      ...this.base,
+      pull_number: number,
+      per_page: 100
+    });
+    return files.flatMap(
+      (file) => file.previous_filename ? [file.filename, file.previous_filename] : [file.filename]
+    );
+  }
+  async setCommitStatus(sha, status) {
+    await this.octokit.rest.repos.createCommitStatus({ ...this.base, sha, ...status });
+  }
+  async getWorkflowRun(runId) {
+    try {
+      const { data } = await this.octokit.rest.actions.getWorkflowRun({
+        ...this.base,
+        run_id: runId
+      });
+      return toRun(data);
+    } catch (error) {
+      if (isStatus(error, 404)) return null;
+      throw error;
+    }
+  }
+  async viewer() {
+    const { data } = await this.octokit.rest.users.getAuthenticated();
+    return { id: data.id, login: data.login, type: data.type };
+  }
+  async listOpenIssuesWithLabel(label) {
+    const items = await this.octokit.paginate(this.octokit.rest.issues.listForRepo, {
+      ...this.base,
+      labels: label,
+      state: "open",
+      per_page: 100
+    });
+    return items.map(toIssue).filter((issue) => !issue.isPullRequest);
+  }
+  async createComment(issueNumber, body) {
+    const { data } = await this.octokit.rest.issues.createComment({
+      ...this.base,
+      issue_number: issueNumber,
+      body
+    });
+    return { id: data.id, body: data.body ?? "", author: toActor(data.user) };
+  }
+  async findBotComment(issueNumber, marker2) {
+    const comments = await this.octokit.paginate(this.octokit.rest.issues.listComments, {
+      ...this.base,
+      issue_number: issueNumber,
+      per_page: 100
+    });
+    const found = comments.filter((comment) => comment.user?.type === "Bot" && (comment.body ?? "").includes(marker2)).at(-1);
+    return found ? { id: found.id, body: found.body ?? "", author: toActor(found.user) } : null;
+  }
+  async listSuccessfulRuns(workflowPath, branch, limit) {
+    try {
+      const { data } = await this.octokit.rest.actions.listWorkflowRuns({
+        ...this.base,
+        workflow_id: workflowPath.split("/").pop() ?? workflowPath,
+        branch,
+        event: "push",
+        status: "success",
+        per_page: limit
+      });
+      return data.workflow_runs.map(toRun);
+    } catch (error) {
+      if (isStatus(error, 404)) return [];
+      throw error;
+    }
+  }
+  async ensureLabel(label) {
+    try {
+      await this.octokit.rest.issues.createLabel({ ...this.base, ...label });
+      return "created";
+    } catch (error) {
+      if (isStatus(error, 422)) return "exists";
+      throw error;
+    }
+  }
+};
+function toRun(data) {
+  return {
+    id: data.id,
+    runAttempt: data.run_attempt ?? 1,
+    path: data.path.split("@")[0] ?? data.path,
+    event: data.event,
+    headBranch: data.head_branch,
+    headSha: data.head_sha,
+    status: data.status,
+    conclusion: data.conclusion,
+    repositoryId: data.repository.id
+  };
+}
+
+// src/adapters/git-evidence.ts
+var MAX_ATTEMPTS = 5;
+var GitBranchEvidenceStore = class {
+  constructor(octokit, owner, repo, branch) {
+    this.octokit = octokit;
+    this.owner = owner;
+    this.repo = repo;
+    this.branch = branch;
+  }
+  octokit;
+  owner;
+  repo;
+  branch;
+  get base() {
+    return { owner: this.owner, repo: this.repo };
+  }
+  async readAt(path, ref) {
+    try {
+      const { data } = await this.octokit.rest.repos.getContent({ ...this.base, path, ref });
+      if (Array.isArray(data) || data.type !== "file" || !("content" in data)) return null;
+      return JSON.parse(Buffer.from(data.content, "base64").toString("utf8"));
+    } catch (error) {
+      if (isStatus(error, 404)) return null;
+      throw error;
+    }
+  }
+  async read(path) {
+    return this.readAt(path, this.branch);
+  }
+  async list(prefix) {
+    const directory = prefix.replace(/\/+$/u, "");
+    try {
+      const { data } = await this.octokit.rest.repos.getContent({
+        ...this.base,
+        path: directory,
+        ref: this.branch
+      });
+      if (!Array.isArray(data)) return [];
+      return data.filter((entry) => entry.type === "file").map((entry) => entry.path).sort();
+    } catch (error) {
+      if (isStatus(error, 404)) return [];
+      throw error;
+    }
+  }
+  async write(path, value) {
+    const canonical = canonicalJson(value);
+    const content = `${JSON.stringify(JSON.parse(canonical), null, 2)}
+`;
+    for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt += 1) {
+      const head = await this.headCommit();
+      const existing = await this.readAt(path, head.sha);
+      if (existing !== null) {
+        if (canonicalJson(existing) === canonical) return "unchanged";
+        throw new AiDlcError(
+          "E_CONFLICT",
+          `Evidence already exists with different content at ${path}.`
+        );
+      }
+      const blob = await this.octokit.rest.git.createBlob({
+        ...this.base,
+        content,
+        encoding: "utf-8"
+      });
+      const tree = await this.octokit.rest.git.createTree({
+        ...this.base,
+        base_tree: head.treeSha,
+        tree: [{ path, mode: "100644", type: "blob", sha: blob.data.sha }]
+      });
+      const commit = await this.octokit.rest.git.createCommit({
+        ...this.base,
+        message: `huddle60: add ${path}`,
+        tree: tree.data.sha,
+        parents: [head.sha]
+      });
+      try {
+        await this.octokit.rest.git.updateRef({
+          ...this.base,
+          ref: `heads/${this.branch}`,
+          sha: commit.data.sha,
+          force: false
+        });
+        return "created";
+      } catch (error) {
+        if (!isStatus(error, 409, 422) || attempt === MAX_ATTEMPTS) throw error;
+        await delay(250 * 2 ** attempt);
+      }
+    }
+    throw new AiDlcError("E_GITHUB_API", `Could not write ${path} after ${MAX_ATTEMPTS} attempts.`);
+  }
+  async headCommit() {
+    try {
+      const ref = await this.octokit.rest.git.getRef({ ...this.base, ref: `heads/${this.branch}` });
+      const commit = await this.octokit.rest.git.getCommit({
+        ...this.base,
+        commit_sha: ref.data.object.sha
+      });
+      return { sha: commit.data.sha, treeSha: commit.data.tree.sha };
+    } catch (error) {
+      if (isStatus(error, 404)) {
+        throw new AiDlcError(
+          "E_GITHUB_API",
+          `Evidence branch \`${this.branch}\` does not exist. Run \`huddle60 init\`.`
+        );
+      }
+      throw error;
+    }
+  }
+  /** Creates the evidence branch as an orphan commit. Safe to call when it already exists. */
+  async initialize() {
+    try {
+      await this.octokit.rest.git.getRef({ ...this.base, ref: `heads/${this.branch}` });
+      return "exists";
+    } catch (error) {
+      if (!isStatus(error, 404)) throw error;
+    }
+    const readme = [
+      "# AI-DLC evidence",
+      "",
+      "Append-only baselines, decision receipts and revocations written by the AI-DLC GitHub App.",
+      "Do not edit or force-push this branch; protect it with a ruleset.",
+      ""
+    ].join("\n");
+    const blob = await this.octokit.rest.git.createBlob({
+      ...this.base,
+      content: readme,
+      encoding: "utf-8"
+    });
+    const tree = await this.octokit.rest.git.createTree({
+      ...this.base,
+      tree: [{ path: "README.md", mode: "100644", type: "blob", sha: blob.data.sha }]
+    });
+    const commit = await this.octokit.rest.git.createCommit({
+      ...this.base,
+      message: "huddle60: initialize evidence branch",
+      tree: tree.data.sha,
+      parents: []
+    });
+    await this.octokit.rest.git.createRef({
+      ...this.base,
+      ref: `refs/heads/${this.branch}`,
+      sha: commit.data.sha
+    });
+    return "created";
+  }
+};
+
+// src/adapters/memory.ts
+function createJsonLogger(base = {}) {
+  const write = (severity, message, fields) => {
+    const line = JSON.stringify({ severity, message, ...base, ...fields });
+    if (severity === "ERROR") process.stderr.write(`${line}
+`);
+    else process.stdout.write(`${line}
+`);
+  };
+  return {
+    info: (message, fields) => write("INFO", message, fields),
+    warn: (message, fields) => write("WARNING", message, fields),
+    error: (message, fields) => write("ERROR", message, fields)
+  };
+}
+
+// src/core/policy.ts
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+var Member = z.object({
+  id: z.number().int().positive(),
+  login: z.string().min(1)
+});
+var Lane = z.object({
+  requires_po_approval: z.boolean()
+});
+var PolicySchema = z.object({
+  version: z.literal(1),
+  roles: z.object({
+    po: z.array(Member).min(1),
+    dev: z.array(Member).default([]),
+    maintainer: z.array(Member).default([])
+  }),
+  project: z.object({
+    owner: z.string().min(1),
+    number: z.number().int().positive()
+  }).optional(),
+  lanes: z.object({
+    fast: Lane,
+    standard: Lane,
+    strict: Lane
+  }).default({
+    fast: { requires_po_approval: false },
+    standard: { requires_po_approval: true },
+    strict: { requires_po_approval: true }
+  }),
+  sensitive_paths: z.array(z.string().min(1)).default([]),
+  evidence: z.object({ branch: z.string().min(1).default("huddle60-evidence") }).default({ branch: "huddle60-evidence" }),
+  acceptance: z.object({ build_workflows: z.array(z.string().min(1)).min(1) }).default({ build_workflows: [".github/workflows/build.yml"] }),
+  planner: z.object({
+    max_nodes: z.number().int().min(1).max(200).default(60),
+    plan_ttl_days: z.number().int().min(1).max(90).default(30)
+  }).default({ max_nodes: 60, plan_ttl_days: 30 })
+}).superRefine((policy, ctx) => {
+  const bots = [...policy.roles.po, ...policy.roles.dev, ...policy.roles.maintainer].filter(
+    (member) => member.login.endsWith("[bot]")
+  );
+  for (const bot of bots) {
+    ctx.addIssue({ code: "custom", message: `Bot account ${bot.login} cannot hold a role` });
+  }
+});
+var POLICY_PATH = ".github/huddle60/policy.yml";
+var LEGACY_POLICY_PATH = ".github/ai-dlc/policy.yml";
+function parsePolicy(source) {
+  let raw;
+  try {
+    raw = parseYaml(source);
+  } catch (error) {
+    throw new AiDlcError("E_POLICY_INVALID", "Policy file is not valid YAML.", { cause: error });
+  }
+  const result = PolicySchema.safeParse(raw);
+  if (!result.success) {
+    throw new AiDlcError(
+      "E_POLICY_INVALID",
+      `Policy file is invalid:
+${z.prettifyError(result.error)}`
+    );
+  }
+  return result.data;
+}
+function hasRole(policy, userId, role) {
+  return policy.roles[role].some((member) => member.id === userId);
+}
+function matchesPath(pattern, path) {
+  let regex = "";
+  for (let index = 0; index < pattern.length; index += 1) {
+    const char = pattern[index];
+    if (char === "*") {
+      if (pattern[index + 1] === "*") {
+        regex += ".*";
+        index += 1;
+        if (pattern[index + 1] === "/") index += 1;
+      } else {
+        regex += "[^/]*";
+      }
+    } else if (char === "?") {
+      regex += "[^/]";
+    } else {
+      regex += char.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
+    }
+  }
+  return new RegExp(`^${regex}$`, "u").test(path);
+}
+function isSensitive(policy, path) {
+  return policy.sensitive_paths.some((pattern) => matchesPath(pattern, path));
+}
+
+// src/ports.ts
+var systemClock = { now: () => /* @__PURE__ */ new Date() };
+
+// src/core/issue-form.ts
+var NO_RESPONSE = "_No response_";
+function parseIssueForm(body) {
+  const sections = /* @__PURE__ */ new Map();
+  const lines = (body ?? "").replace(/\r\n?/gu, "\n").split("\n");
+  let current = null;
+  let buffer = [];
+  const flush = () => {
+    if (current === null) return;
+    const value = buffer.join("\n").trim();
+    sections.set(current, value === NO_RESPONSE ? "" : value);
+  };
+  for (const line of lines) {
+    const heading = /^###\s+(.+?)\s*$/u.exec(line);
+    if (heading) {
+      flush();
+      current = heading[1];
+      buffer = [];
+    } else if (current !== null) {
+      buffer.push(line);
+    }
+  }
+  flush();
+  return sections;
+}
+var CRITERION_LINE = /^-\s+((?:AC|EC)-\d{2,3}):\s+(.+)$/u;
+function parseCriteria(text) {
+  const criteria = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (line.length === 0) continue;
+    const match = CRITERION_LINE.exec(line);
+    if (!match) {
+      if (/^-\s+(AC|EC)/u.test(line)) {
+        throw new AiDlcError(
+          "E_FORM",
+          `Malformed criterion line: \`${line}\`. Use \`- AC-01: ...\`.`
+        );
+      }
+      continue;
+    }
+    const id = match[1];
+    if (seen.has(id)) throw new AiDlcError("E_FORM", `Duplicate criterion id \`${id}\`.`);
+    seen.add(id);
+    criteria.push({ id, text: match[2].trim() });
+  }
+  return criteria;
+}
+function parseIssueRefs(text) {
+  if (!text) return [];
+  const refs = /* @__PURE__ */ new Set();
+  for (const part of text.split(/[\s,]+/u)) {
+    if (part.length === 0) continue;
+    const match = /^#(\d+)$/u.exec(part);
+    if (!match) {
+      throw new AiDlcError("E_FORM", `Invalid issue reference \`${part}\`. Use \`#123\`.`);
+    }
+    refs.add(Number(match[1]));
+  }
+  return [...refs].sort((a, b) => a - b);
+}
+
+// src/core/vocabulary.ts
+var LABELS = {
+  request: "huddle60:request",
+  planDraft: "huddle60:plan-draft",
+  planCreated: "huddle60:plan-created",
+  planPartial: "huddle60:plan-partial",
+  fromPlan: "huddle60:from-plan",
+  stale: "huddle60:stale",
+  exempt: "huddle60:exempt",
+  epic: "type:epic",
+  story: "type:story",
+  task: "type:task"
+};
+var KIND_LABEL = {
+  epic: LABELS.epic,
+  story: LABELS.story,
+  task: LABELS.task
+};
+var SECTIONS = {
+  request: "Y\xEAu c\u1EA7u",
+  goal: "M\u1EE5c ti\xEAu v\xE0 ng\u01B0\u1EDDi d\xF9ng",
+  scope: "Ph\u1EA1m vi",
+  parent: "Issue cha",
+  blockedBy: "Blocked by",
+  epicCriteria: "Ti\xEAu ch\xED nghi\u1EC7m thu Epic",
+  storyCriteria: "Acceptance Criteria",
+  acRefs: "AC li\xEAn quan",
+  technicalRefs: "Tham chi\u1EBFu k\u1EF9 thu\u1EADt",
+  risks: "C\xE2u h\u1ECFi v\xE0 r\u1EE7i ro"
+};
+var REQUIREMENT_SECTIONS = {
+  epic: [
+    SECTIONS.goal,
+    SECTIONS.scope,
+    SECTIONS.epicCriteria,
+    SECTIONS.technicalRefs,
+    SECTIONS.risks
+  ],
+  story: [
+    SECTIONS.goal,
+    SECTIONS.scope,
+    SECTIONS.parent,
+    SECTIONS.blockedBy,
+    SECTIONS.storyCriteria,
+    SECTIONS.technicalRefs,
+    SECTIONS.risks
+  ],
+  task: [
+    SECTIONS.goal,
+    SECTIONS.scope,
+    SECTIONS.parent,
+    SECTIONS.blockedBy,
+    SECTIONS.acRefs,
+    SECTIONS.technicalRefs,
+    SECTIONS.risks
+  ]
+};
+var CRITERIA_SECTION = {
+  epic: SECTIONS.epicCriteria,
+  story: SECTIONS.storyCriteria,
+  task: null
+};
+function kindFromLabels(labels) {
+  const kinds = Object.keys(KIND_LABEL).filter(
+    (kind) => labels.includes(KIND_LABEL[kind])
+  );
+  return kinds.length === 1 ? kinds[0] : null;
+}
+
+// src/core/baseline.ts
+var BASELINE_SCHEMA_VERSION = 1;
+function hashedPart(snapshot) {
+  return {
+    schemaVersion: snapshot.schemaVersion,
+    canonicalVersion: snapshot.canonicalVersion,
+    kind: snapshot.kind,
+    source: snapshot.source,
+    requirements: snapshot.requirements,
+    parent: snapshot.parent,
+    blockedBy: snapshot.blockedBy,
+    acRefs: snapshot.acRefs
+  };
+}
+function buildBaseline(issue) {
+  const kind = kindFromLabels(issue.labels);
+  if (!kind) {
+    throw new AiDlcError(
+      "E_FORM",
+      "Issue needs exactly one of the labels type:epic, type:story or type:task."
+    );
+  }
+  const parsed = parseIssueForm(issue.body);
+  const sections = {};
+  for (const label of REQUIREMENT_SECTIONS[kind]) sections[label] = parsed.get(label) ?? "";
+  if (!sections[SECTIONS.goal]) {
+    throw new AiDlcError("E_FORM", `Section \`### ${SECTIONS.goal}\` is required.`);
+  }
+  const criteriaSection = CRITERIA_SECTION[kind];
+  const criteria = criteriaSection ? parseCriteria(sections[criteriaSection] ?? "") : [];
+  if (criteriaSection && criteria.length === 0) {
+    throw new AiDlcError(
+      "E_FORM",
+      `Section \`### ${criteriaSection}\` needs at least one criterion line.`
+    );
+  }
+  const expectedPrefix = kind === "epic" ? "EC-" : "AC-";
+  if (criteria.some((criterion) => !criterion.id.startsWith(expectedPrefix))) {
+    throw new AiDlcError("E_FORM", `${kind} criteria must use the ${expectedPrefix} prefix.`);
+  }
+  const parentRefs = parseIssueRefs(sections[SECTIONS.parent]);
+  if (parentRefs.length > 1) throw new AiDlcError("E_FORM", "Only one parent Issue is allowed.");
+  const acRefs = kind === "task" ? (sections[SECTIONS.acRefs] ?? "").split(/[\s,]+/u).filter((value) => value.length > 0).map((value) => {
+    if (!/^AC-\d{2,3}$/u.test(value))
+      throw new AiDlcError("E_FORM", `Invalid AC reference \`${value}\`.`);
+    return value;
+  }) : [];
+  const base = {
+    schemaVersion: BASELINE_SCHEMA_VERSION,
+    canonicalVersion: CANONICAL_VERSION,
+    kind,
+    source: {
+      repositoryId: issue.repositoryId,
+      issueNodeId: issue.issueNodeId,
+      issueNumber: issue.number
+    },
+    requirements: { title: issue.title, sections, criteria },
+    parent: parentRefs[0] ?? null,
+    blockedBy: parseIssueRefs(sections[SECTIONS.blockedBy]),
+    acRefs
+  };
+  const hash = contentHash(hashedPart(base));
+  return { ...base, baselineId: `bl-${issue.number}-${shortHash(hash)}`, contentHash: hash };
+}
+function verifySnapshot(snapshot) {
+  return contentHash(hashedPart(snapshot)) === snapshot.contentHash;
+}
+function baselinePath(repositoryId, issueNumber, baselineId) {
+  return `baselines/${repositoryId}/${issueNumber}/${baselineId}.json`;
+}
+
+// src/core/command.ts
+var COMMAND_PREFIX = "/huddle60";
+var LEGACY_COMMAND_PREFIX = "/ai-dlc";
+var COMMAND_SPECS = {
+  baseline: { required: [], optional: [], handler: "deterministic" },
+  approve: { required: ["baseline", "hash"], optional: [], handler: "deterministic" },
+  ready: { required: ["baseline", "hash", "lane"], optional: [], handler: "deterministic" },
+  accept: { required: ["baseline", "run", "commit"], optional: [], handler: "deterministic" },
+  revoke: { required: ["decision", "reason"], optional: [], handler: "deterministic" },
+  refine: { required: ["plan"], optional: [], handler: "planner" },
+  "create-plan": { required: ["plan", "hash"], optional: [], handler: "planner" },
+  "resume-plan": { required: ["plan"], optional: [], handler: "planner" }
+};
+function commandHandler(name) {
+  return COMMAND_SPECS[name].handler;
+}
+function tokenize(input) {
+  const tokens = [];
+  const pattern = /([a-z][a-z-]*)=(?:"((?:[^"\\]|\\.)*)"|(\S+))|(\S+)/gu;
+  for (const match of input.matchAll(pattern)) {
+    if (match[4] !== void 0) {
+      throw new AiDlcError("E_SYNTAX", `Unexpected token \`${match[4]}\`. Use key=value.`);
+    }
+    const value = match[2] !== void 0 ? match[2].replace(/\\(.)/gu, "$1") : match[3];
+    tokens.push(`${match[1]}=${value}`);
+  }
+  return tokens;
+}
+function parseCommand(body) {
+  const normalized = body.replace(/\r\n?/gu, "\n");
+  const [head = "", ...rest] = normalized.split("\n");
+  const line = head.trim();
+  let prefix = "";
+  if (line.startsWith(COMMAND_PREFIX)) {
+    prefix = COMMAND_PREFIX;
+  } else if (line.startsWith(LEGACY_COMMAND_PREFIX)) {
+    prefix = LEGACY_COMMAND_PREFIX;
+  } else {
+    throw new AiDlcError(
+      "E_SYNTAX",
+      `Commands must start with \`${COMMAND_PREFIX}\` on the first line.`
+    );
+  }
+  const remainder = line.slice(prefix.length).trim();
+  const [rawName = "", ...argParts] = remainder.split(/\s+/u);
+  if (!(rawName in COMMAND_SPECS)) {
+    throw new AiDlcError(
+      "E_SYNTAX",
+      `Unknown command \`${rawName || "(empty)"}\`. Known commands: ${Object.keys(COMMAND_SPECS).join(", ")}.`
+    );
+  }
+  const name = rawName;
+  const spec = COMMAND_SPECS[name];
+  const args = {};
+  for (const token of tokenize(argParts.join(" "))) {
+    const separator = token.indexOf("=");
+    const key = token.slice(0, separator);
+    const value = token.slice(separator + 1);
+    if (!spec.required.includes(key) && !spec.optional.includes(key)) {
+      throw new AiDlcError("E_SYNTAX", `Unknown argument \`${key}\` for \`${name}\`.`);
+    }
+    if (key in args) throw new AiDlcError("E_SYNTAX", `Duplicate argument \`${key}\`.`);
+    if (value.length === 0) throw new AiDlcError("E_SYNTAX", `Argument \`${key}\` is empty.`);
+    args[key] = value;
+  }
+  const missing = spec.required.filter((key) => !(key in args));
+  if (missing.length > 0) {
+    throw new AiDlcError("E_SYNTAX", `Missing argument(s) for \`${name}\`: ${missing.join(", ")}.`);
+  }
+  return { name, args, note: rest.join("\n").trim() };
+}
+
+// src/core/decision.ts
+var DECISION_SCHEMA_VERSION = 1;
+var REQUIRED_ROLE = {
+  approve: "po",
+  ready: "dev",
+  accept: "po"
+};
+function decisionId(kind, commentId) {
+  return `dec-${shortHash(sha256(`${kind}:${commentId}`), 16)}`;
+}
+function commentDigest(body) {
+  return sha256(body.replace(/\r\n?/gu, "\n"));
+}
+function decisionPath(repositoryId, issueNumber, id) {
+  return `decisions/${repositoryId}/${issueNumber}/${id}.json`;
+}
+function revocationPath(repositoryId, issueNumber, id) {
+  return `revocations/${repositoryId}/${issueNumber}/${id}.json`;
+}
+function evaluateReceipt(receipt, facts) {
+  const reasons = [];
+  if (facts.revoked) reasons.push("decision was revoked");
+  if (facts.currentCommentBody === null) reasons.push("source comment was deleted");
+  else if (commentDigest(facts.currentCommentBody) !== receipt.source.commentBodyDigest) {
+    reasons.push("source comment was edited");
+  }
+  if (!hasRole(facts.policy, receipt.actor.id, REQUIRED_ROLE[receipt.kind])) {
+    reasons.push(`actor no longer holds the ${REQUIRED_ROLE[receipt.kind]} role`);
+  }
+  if (facts.snapshotHash === null) reasons.push("baseline snapshot is missing or corrupt");
+  else if (facts.snapshotHash !== receipt.baselineHash) reasons.push("baseline hash mismatch");
+  if (receipt.kind === "accept" && facts.buildValid !== true)
+    reasons.push("accepted build is no longer valid");
+  return { valid: reasons.length === 0, reasons };
+}
+
+// src/core/pr-block.ts
+var PR_BLOCK_BEGIN = "<!-- huddle60:begin -->";
+var PR_BLOCK_END = "<!-- huddle60:end -->";
+var LEGACY_PR_BLOCK_BEGIN = "<!-- ai-dlc:begin -->";
+var LEGACY_PR_BLOCK_END = "<!-- ai-dlc:end -->";
+function parsePrBlock(body) {
+  const text = (body ?? "").replace(/\r\n?/gu, "\n");
+  let begin = text.indexOf(PR_BLOCK_BEGIN);
+  let beginMarker = PR_BLOCK_BEGIN;
+  let endMarker = PR_BLOCK_END;
+  if (begin === -1) {
+    begin = text.indexOf(LEGACY_PR_BLOCK_BEGIN);
+    if (begin !== -1) {
+      beginMarker = LEGACY_PR_BLOCK_BEGIN;
+      endMarker = LEGACY_PR_BLOCK_END;
+    }
+  }
+  if (begin === -1) return null;
+  if (text.indexOf(beginMarker, begin + 1) !== -1) {
+    throw new AiDlcError("E_PR_BLOCK", "PR body contains more than one huddle60 block.");
+  }
+  const end = text.indexOf(endMarker, begin);
+  if (end === -1) throw new AiDlcError("E_PR_BLOCK", "huddle60 block is not closed.");
+  const fields = /* @__PURE__ */ new Map();
+  for (const line of text.slice(begin + beginMarker.length, end).split("\n")) {
+    const match = /^(?:HUDDLE60|AI-DLC)-([A-Za-z]+):\s*(.*)$/iu.exec(line.trim());
+    if (match) fields.set(match[1].toLowerCase(), match[2].trim());
+  }
+  const issue = /^#(\d+)$/u.exec(fields.get("issue") ?? "");
+  const baselineId = fields.get("baseline") ?? "";
+  const hash = fields.get("hash") ?? "";
+  if (!issue)
+    throw new AiDlcError(
+      "E_PR_BLOCK",
+      "HUDDLE60-Issue must be `#<number>` in the same repository."
+    );
+  if (!/^bl-\d+-[0-9a-f]{12}$/u.test(baselineId))
+    throw new AiDlcError("E_PR_BLOCK", "HUDDLE60-Baseline is missing or invalid.");
+  if (!/^sha256:[0-9a-f]{64}$/u.test(hash))
+    throw new AiDlcError("E_PR_BLOCK", "HUDDLE60-Hash is missing or invalid.");
+  const acceptanceCriteria = (fields.get("ac") ?? "").split(/[\s,]+/u).filter((value) => value.length > 0);
+  for (const id of acceptanceCriteria) {
+    if (!/^AC-\d{2,3}$/u.test(id))
+      throw new AiDlcError("E_PR_BLOCK", `Invalid AC id \`${id}\` in HUDDLE60-AC.`);
+  }
+  return { issueNumber: Number(issue[1]), baselineId, hash, acceptanceCriteria };
+}
+function renderPrBlock(block) {
+  return [
+    PR_BLOCK_BEGIN,
+    `HUDDLE60-Issue: #${block.issueNumber}`,
+    `HUDDLE60-Baseline: ${block.baselineId}`,
+    `HUDDLE60-Hash: ${block.hash}`,
+    `HUDDLE60-AC: ${block.acceptanceCriteria.join(", ")}`,
+    PR_BLOCK_END
+  ].join("\n");
+}
+function closingReferences(body) {
+  const pattern = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+#(\d+)\b/giu;
+  return [...new Set([...(body ?? "").matchAll(pattern)].map((match) => Number(match[1])))];
+}
+
+// src/core/plan.ts
+import { z as z2 } from "zod";
+var LOCAL_ID = /^[a-z0-9][a-z0-9-]{0,47}$/u;
+var Text = (max) => z2.string().trim().min(1).max(max);
+var CriterionSchema = z2.object({
+  id: z2.string().regex(/^(AC|EC)-\d{2,3}$/u),
+  text: Text(500)
+});
+var NodeSchema = z2.object({
+  localId: z2.string().regex(LOCAL_ID),
+  kind: z2.enum(["epic", "story", "task"]),
+  parentLocalId: z2.string().regex(LOCAL_ID).nullable(),
+  title: Text(120),
+  goal: Text(1e3),
+  scope: z2.array(Text(300)).max(15),
+  outOfScope: z2.array(Text(300)).max(10),
+  criteria: z2.array(CriterionSchema).max(20),
+  acRefs: z2.array(z2.string().regex(/^AC-\d{2,3}$/u)).max(20),
+  blockedBy: z2.array(z2.string().regex(LOCAL_ID)).max(10),
+  riskNotes: z2.array(Text(300)).max(10)
+});
+var ModelPlanSchema = z2.object({
+  rootKind: z2.enum(["epic", "story"]),
+  summary: Text(1e3),
+  assumptions: z2.array(Text(300)).max(15),
+  openQuestions: z2.array(z2.object({ text: Text(300), blocking: z2.boolean() })).max(15),
+  nodes: z2.array(NodeSchema).min(1).max(200)
+});
+
+// src/core/render.ts
+function sanitize(text) {
+  return text.replace(/<!--/gu, "&lt;!--").replace(/</gu, "&lt;").replace(/(^|[^\w`])@(?=[\w-])/gu, "$1@\u200B").replace(/^\/(?:huddle60|ai-dlc)/gmu, "\\/huddle60");
+}
+function marker(name, value) {
+  return `<!-- huddle60:${name}:${value} -->`;
+}
+
+// src/workflow/service.ts
+var STATUS_CONTEXT = "huddle60/baseline";
+var LANES = ["fast", "standard", "strict"];
+var WorkflowService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  policyCache = null;
+  get repositoryId() {
+    return this.deps.github.repo.repositoryId;
+  }
+  async policy() {
+    if (this.policyCache) return this.policyCache;
+    const branch = await this.deps.github.getDefaultBranch();
+    let source = await this.deps.github.readFile(POLICY_PATH, branch);
+    if (source === null) {
+      source = await this.deps.github.readFile(LEGACY_POLICY_PATH, branch);
+    }
+    if (source === null)
+      throw new AiDlcError("E_POLICY_INVALID", `Missing ${POLICY_PATH} on ${branch}.`);
+    this.policyCache = parsePolicy(source);
+    return this.policyCache;
+  }
+  /** Entry point for `issue_comment` events on Issues. */
+  async handleComment(issueNumber, commentId, action) {
+    if (!this.deps.enabled) return;
+    if (action !== "created") {
+      await this.reportInvalidatedDecisions(issueNumber, commentId, action);
+      return;
+    }
+    const comment = await this.deps.github.getComment(commentId);
+    if (!comment || comment.author.type !== "User") return;
+    let command;
+    try {
+      command = parseCommand(comment.body);
+    } catch (error) {
+      if (isAiDlcError(error)) await this.reply(issueNumber, commentId, errorReply(error));
+      return;
+    }
+    if (commandHandler(command.name) !== "deterministic") return;
+    try {
+      const policy = await this.policy();
+      const issue = await this.deps.github.getIssue(issueNumber);
+      if (issue.isPullRequest)
+        throw new AiDlcError("E_SYNTAX", "AI-DLC commands are only accepted on Issues.");
+      const message = await this.runCommand(command, issue, comment, policy);
+      await this.reply(issueNumber, commentId, message);
+    } catch (error) {
+      if (!isAiDlcError(error)) throw error;
+      await this.reply(issueNumber, commentId, errorReply(error));
+    }
+  }
+  async reply(issueNumber, commentId, body) {
+    await this.deps.github.upsertComment(issueNumber, marker("reply", String(commentId)), body);
+  }
+  async runCommand(command, issue, comment, policy) {
+    const actor = comment.author;
+    switch (command.name) {
+      case "baseline":
+        this.requireRole(policy, actor.id, ["po", "dev"], "baseline");
+        return this.createBaseline(issue);
+      case "approve":
+      case "ready":
+      case "accept":
+        this.requireRole(policy, actor.id, [REQUIRED_ROLE[command.name]], command.name);
+        return this.recordDecision(command.name, command.args, issue, comment, policy);
+      case "revoke":
+        return this.revoke(command.args, issue, comment, policy);
+      default:
+        throw new AiDlcError(
+          "E_SYNTAX",
+          `\`${command.name}\` is handled by the planner, not this workflow.`
+        );
+    }
+  }
+  requireRole(policy, userId, roles, action) {
+    if (!roles.some((role) => hasRole(policy, userId, role))) {
+      throw new AiDlcError("E_ROLE", `\`${action}\` requires the ${roles.join(" or ")} role.`);
+    }
+  }
+  snapshotOf(issue) {
+    return buildBaseline({
+      repositoryId: this.repositoryId,
+      issueNodeId: issue.nodeId,
+      number: issue.number,
+      title: issue.title,
+      body: issue.body,
+      labels: issue.labels
+    });
+  }
+  async createBaseline(issue) {
+    const snapshot = this.snapshotOf(issue);
+    const result = await this.deps.evidence.write(
+      baselinePath(this.repositoryId, issue.number, snapshot.baselineId),
+      snapshot
+    );
+    const criteria = snapshot.requirements.criteria.map(
+      (criterion) => `- ${criterion.id}: ${sanitize(criterion.text)}`
+    );
+    return [
+      `**Baseline \`${snapshot.baselineId}\`** ${result === "created" ? "\u0111\xE3 \u0111\u01B0\u1EE3c t\u1EA1o" : "\u0111\xE3 t\u1ED3n t\u1EA1i v\u1EDBi c\xF9ng n\u1ED9i dung"}.`,
+      "",
+      `Hash: \`${snapshot.contentHash}\``,
+      ...criteria.length > 0 ? ["", "Ti\xEAu ch\xED:", ...criteria] : [],
+      "",
+      "PO duy\u1EC7t nghi\u1EC7p v\u1EE5:",
+      "```text",
+      `/huddle60 approve baseline=${snapshot.baselineId} hash=${snapshot.contentHash}`,
+      "```",
+      "DEV x\xE1c nh\u1EADn s\u1EB5n s\xE0ng (lane: fast | standard | strict):",
+      "```text",
+      `/huddle60 ready baseline=${snapshot.baselineId} hash=${snapshot.contentHash} lane=standard`,
+      "```"
+    ].join("\n");
+  }
+  async loadSnapshot(issueNumber, baselineId) {
+    if (!baselineId.startsWith(`bl-${issueNumber}-`)) {
+      throw new AiDlcError(
+        "E_BASELINE_NOT_FOUND",
+        `Baseline \`${baselineId}\` does not belong to #${issueNumber}.`
+      );
+    }
+    const snapshot = await this.deps.evidence.read(
+      baselinePath(this.repositoryId, issueNumber, baselineId)
+    );
+    if (!snapshot || !verifySnapshot(snapshot)) {
+      throw new AiDlcError(
+        "E_BASELINE_NOT_FOUND",
+        `Baseline \`${baselineId}\` is missing or corrupt.`
+      );
+    }
+    return snapshot;
+  }
+  /**
+   * Loads the snapshot for a decision. When it was never stored but the id and hash
+   * match the Issue's current content, it is stored now, so one command suffices.
+   */
+  async snapshotForDecision(issue, baselineId, hash) {
+    const stored = await this.deps.evidence.read(
+      baselinePath(this.repositoryId, issue.number, baselineId)
+    );
+    if (stored || hash === void 0) return this.loadSnapshot(issue.number, baselineId);
+    const current = this.snapshotOf(issue);
+    if (current.baselineId !== baselineId || current.contentHash !== hash) {
+      return this.loadSnapshot(issue.number, baselineId);
+    }
+    await this.deps.evidence.write(
+      baselinePath(this.repositoryId, issue.number, current.baselineId),
+      current
+    );
+    return current;
+  }
+  /** Throws when the Issue no longer matches the baseline it is being decided on. */
+  assertCurrent(issue, snapshot) {
+    if (this.snapshotOf(issue).contentHash !== snapshot.contentHash) {
+      throw new AiDlcError(
+        "E_STALE",
+        "The Issue changed after this baseline was created. Run `/huddle60 baseline` again and decide on the new baseline."
+      );
+    }
+  }
+  async recordDecision(kind, args, issue, comment, policy) {
+    const { github, evidence, clock } = this.deps;
+    const snapshot = kind === "accept" ? await this.loadSnapshot(issue.number, args.baseline) : await this.snapshotForDecision(issue, args.baseline, args.hash);
+    let lane = null;
+    let build = null;
+    if (kind === "approve" || kind === "ready") {
+      if (args.hash !== snapshot.contentHash) {
+        throw new AiDlcError(
+          "E_HASH_MISMATCH",
+          "The hash does not match the baseline. Copy it from the baseline reply."
+        );
+      }
+      this.assertCurrent(issue, snapshot);
+    }
+    if (kind === "ready") {
+      if (!LANES.includes(args.lane)) {
+        throw new AiDlcError("E_SYNTAX", `Lane must be one of ${LANES.join(", ")}.`);
+      }
+      lane = args.lane;
+      await this.assertApproved(snapshot, lane, policy);
+      const open = [];
+      for (const dependency of snapshot.blockedBy) {
+        const blocker = await github.getIssue(dependency);
+        if (blocker.state !== "closed" || blocker.stateReason !== "completed")
+          open.push(dependency);
+      }
+      if (open.length > 0) {
+        throw new AiDlcError(
+          "E_DEPENDENCY_OPEN",
+          `Blocked by unfinished Issue(s): ${open.map((n) => `#${n}`).join(", ")}.`
+        );
+      }
+    }
+    if (kind === "accept") {
+      if (snapshot.kind === "task") {
+        throw new AiDlcError(
+          "E_WRONG_KIND",
+          "PO accepts stories and epics. A task is done when its PR is merged and its story is accepted."
+        );
+      }
+      const ready = await this.findValidDecision(
+        issue.number,
+        snapshot.baselineId,
+        "ready",
+        policy
+      );
+      if (!ready)
+        throw new AiDlcError("E_NOT_READY", "There is no valid ready decision for this baseline.");
+      build = await this.verifyBuild(Number(args.run), args.commit, policy);
+    }
+    const receipt = {
+      schemaVersion: DECISION_SCHEMA_VERSION,
+      decisionId: decisionId(kind, comment.id),
+      kind,
+      issueNumber: issue.number,
+      baselineId: snapshot.baselineId,
+      baselineHash: snapshot.contentHash,
+      actor: { id: comment.author.id, login: comment.author.login },
+      source: { commentId: comment.id, commentBodyDigest: commentDigest(comment.body) },
+      lane,
+      build,
+      policyVersion: policy.version,
+      recordedAt: clock.now().toISOString()
+    };
+    await evidence.write(
+      decisionPath(this.repositoryId, issue.number, receipt.decisionId),
+      receipt
+    );
+    if (kind === "accept") {
+      await github.closeIssue(issue.number, "completed");
+      return `**\u0110\xE3 ghi nh\u1EADn nghi\u1EC7m thu** \`${receipt.decisionId}\` cho \`${snapshot.baselineId}\` tr\xEAn build ${build?.runId} (\`${build?.headSha.slice(0, 7)}\`). Issue \u0111\xE3 \u0111\u01B0\u1EE3c \u0111\xF3ng.`;
+    }
+    if (kind === "ready") {
+      const block = renderPrBlock({
+        issueNumber: issue.number,
+        baselineId: snapshot.baselineId,
+        hash: snapshot.contentHash,
+        acceptanceCriteria: snapshot.kind === "task" ? snapshot.acRefs : snapshot.requirements.criteria.map((c) => c.id)
+      });
+      return [
+        `**S\u1EB5n s\xE0ng tri\u1EC3n khai** \`${receipt.decisionId}\` (lane \`${lane}\`).`,
+        "",
+        "D\xE1n kh\u1ED1i sau v\xE0o m\xF4 t\u1EA3 Pull Request:",
+        "```text",
+        block,
+        "```"
+      ].join("\n");
+    }
+    return `**\u0110\xE3 duy\u1EC7t nghi\u1EC7p v\u1EE5** \`${receipt.decisionId}\` cho \`${snapshot.baselineId}\`. DEV c\xF3 th\u1EC3 x\xE1c nh\u1EADn \`ready\`.`;
+  }
+  async verifyBuild(runId, commit, policy) {
+    if (!Number.isSafeInteger(runId) || runId <= 0)
+      throw new AiDlcError("E_SYNTAX", "`run` must be a workflow run id.");
+    const problems = await this.buildProblems(runId, commit, policy);
+    if (problems.problems.length > 0 || !problems.run) {
+      throw new AiDlcError(
+        "E_BUILD_INVALID",
+        `Build cannot be accepted:
+- ${problems.problems.join("\n- ")}`
+      );
+    }
+    const { run } = problems;
+    return {
+      runId: run.id,
+      runAttempt: run.runAttempt,
+      workflowPath: run.path,
+      headSha: run.headSha
+    };
+  }
+  async buildProblems(runId, commit, policy) {
+    const run = await this.deps.github.getWorkflowRun(runId);
+    const problems = [];
+    if (!run) return { run: null, problems: [`Workflow run ${runId} was not found.`] };
+    const branch = await this.deps.github.getDefaultBranch();
+    if (run.repositoryId !== this.repositoryId) problems.push("run belongs to another repository");
+    if (!policy.acceptance.build_workflows.includes(run.path))
+      problems.push(`workflow \`${run.path}\` is not an acceptance workflow`);
+    if (run.event !== "push" || run.headBranch !== branch)
+      problems.push(`run must come from a push to \`${branch}\``);
+    if (run.headSha !== commit) problems.push("run commit does not match `commit`");
+    if (run.status !== "completed" || run.conclusion !== "success")
+      problems.push("run did not complete successfully");
+    return { run, problems };
+  }
+  async revoke(args, issue, comment, policy) {
+    const id = args.decision;
+    const receipt = await this.deps.evidence.read(
+      decisionPath(this.repositoryId, issue.number, id)
+    );
+    if (!receipt)
+      throw new AiDlcError(
+        "E_DECISION_NOT_FOUND",
+        `Decision \`${id}\` was not found on this Issue.`
+      );
+    const actorId = comment.author.id;
+    const allowed = receipt.actor.id === actorId || hasRole(policy, actorId, REQUIRED_ROLE[receipt.kind]);
+    if (!allowed)
+      throw new AiDlcError(
+        "E_ROLE",
+        "Only the author or a holder of the same role may revoke this decision."
+      );
+    const revocation = {
+      schemaVersion: 1,
+      decisionId: id,
+      actor: { id: actorId, login: comment.author.login },
+      reason: args.reason,
+      source: { commentId: comment.id },
+      recordedAt: this.deps.clock.now().toISOString()
+    };
+    const result = await this.deps.evidence.write(
+      revocationPath(this.repositoryId, issue.number, id),
+      revocation
+    );
+    return result === "created" ? `**\u0110\xE3 thu h\u1ED3i** \`${id}\`.` : `\`${id}\` \u0111\xE3 b\u1ECB thu h\u1ED3i tr\u01B0\u1EDBc \u0111\xF3.`;
+  }
+  async listDecisions(issueNumber) {
+    const paths = await this.deps.evidence.list(`decisions/${this.repositoryId}/${issueNumber}/`);
+    const receipts = [];
+    for (const path of paths) {
+      const receipt = await this.deps.evidence.read(path);
+      if (receipt) receipts.push(receipt);
+    }
+    return receipts;
+  }
+  async isValid(receipt, policy) {
+    const { evidence, github } = this.deps;
+    const revoked = await evidence.read(
+      revocationPath(this.repositoryId, receipt.issueNumber, receipt.decisionId)
+    ) !== null;
+    const comment = await github.getComment(receipt.source.commentId);
+    const snapshot = await evidence.read(
+      baselinePath(this.repositoryId, receipt.issueNumber, receipt.baselineId)
+    );
+    const snapshotHash = snapshot && verifySnapshot(snapshot) ? snapshot.contentHash : null;
+    let buildValid;
+    if (receipt.kind === "accept" && receipt.build) {
+      const { problems } = await this.buildProblems(
+        receipt.build.runId,
+        receipt.build.headSha,
+        policy
+      );
+      buildValid = problems.length === 0;
+    }
+    return evaluateReceipt(receipt, {
+      policy,
+      revoked,
+      currentCommentBody: comment ? comment.body : null,
+      snapshotHash,
+      ...buildValid === void 0 ? {} : { buildValid }
+    });
+  }
+  async findValidDecision(issueNumber, baselineId, kind, policy) {
+    for (const receipt of await this.listDecisions(issueNumber)) {
+      if (receipt.kind !== kind || receipt.baselineId !== baselineId) continue;
+      if ((await this.isValid(receipt, policy)).valid) return receipt;
+    }
+    return null;
+  }
+  async reportInvalidatedDecisions(issueNumber, commentId, action) {
+    const affected = (await this.listDecisions(issueNumber)).filter(
+      (receipt) => receipt.source.commentId === commentId
+    );
+    if (affected.length === 0) return;
+    await this.deps.github.upsertComment(
+      issueNumber,
+      marker("invalidated", String(commentId)),
+      `Comment quy\u1EBFt \u0111\u1ECBnh \u0111\xE3 b\u1ECB ${action === "deleted" ? "x\xF3a" : "s\u1EEDa"}; c\xE1c quy\u1EBFt \u0111\u1ECBnh sau kh\xF4ng c\xF2n hi\u1EC7u l\u1EF1c: ${affected.map((receipt) => `\`${receipt.decisionId}\` (${receipt.kind})`).join(", ")}.`
+    );
+  }
+  /** Evaluates the `ai-dlc/baseline` gate for a pull request and publishes a commit status. */
+  async checkPullRequest(prNumber) {
+    const pr = await this.deps.github.getPullRequest(prNumber);
+    const result = this.deps.enabled ? await this.evaluatePullRequest(prNumber).catch((error) => {
+      if (!isAiDlcError(error)) throw error;
+      return {
+        state: "failure",
+        description: `${error.code}: ${firstLine(error.message)}`,
+        details: [error.message]
+      };
+    }) : {
+      state: "pending",
+      description: "huddle60 is disabled by the operator",
+      details: []
+    };
+    await this.deps.github.setCommitStatus(pr.headSha, {
+      state: result.state,
+      context: STATUS_CONTEXT,
+      description: truncate(result.description, 140)
+    });
+    return result;
+  }
+  async evaluatePullRequest(prNumber) {
+    const { github } = this.deps;
+    const policy = await this.policy();
+    const pr = await github.getPullRequest(prNumber);
+    for (const reference of closingReferences(pr.body)) {
+      const referenced = await github.getIssue(reference).catch(() => null);
+      const kind = referenced ? kindFromLabels(referenced.labels) : null;
+      if (kind === "story" || kind === "epic") {
+        throw new AiDlcError(
+          "E_CLOSING_KEYWORD",
+          `Use \`Refs #${reference}\`; closing keywords would close the ${kind} without acceptance.`
+        );
+      }
+    }
+    if (pr.labels.includes(LABELS.exempt)) {
+      return { state: "success", description: "Exempt by maintainer label", details: [] };
+    }
+    const block = parsePrBlock(pr.body);
+    if (!block)
+      throw new AiDlcError(
+        "E_PR_BLOCK",
+        "PR body has no huddle60 block. Run the context CLI or use the ready reply."
+      );
+    const issue = await github.getIssue(block.issueNumber);
+    const snapshot = await this.loadSnapshot(issue.number, block.baselineId);
+    if (snapshot.contentHash !== block.hash)
+      throw new AiDlcError("E_HASH_MISMATCH", "HUDDLE60-Hash does not match the baseline.");
+    if (snapshot.kind === "epic")
+      throw new AiDlcError("E_PR_BLOCK", "A PR must reference a story or task, not an epic.");
+    this.assertCurrent(issue, snapshot);
+    const ready = await this.findValidDecision(issue.number, snapshot.baselineId, "ready", policy);
+    if (!ready || !ready.lane)
+      throw new AiDlcError(
+        "E_NOT_READY",
+        `#${issue.number} has no valid ready decision for this baseline.`
+      );
+    await this.assertApproved(snapshot, ready.lane, policy);
+    const allowedAc = new Set(
+      snapshot.kind === "task" ? snapshot.acRefs : snapshot.requirements.criteria.map((c) => c.id)
+    );
+    const unknown = block.acceptanceCriteria.filter((id) => !allowedAc.has(id));
+    if (unknown.length > 0)
+      throw new AiDlcError("E_PR_BLOCK", `Unknown AC for this baseline: ${unknown.join(", ")}.`);
+    if (snapshot.kind === "task" && snapshot.parent !== null)
+      await this.assertParentReady(snapshot.parent, policy);
+    if (ready.lane === "fast") {
+      const sensitive = (await github.listPullRequestFiles(prNumber)).filter(
+        (path) => isSensitive(policy, path)
+      );
+      if (sensitive.length > 0) {
+        throw new AiDlcError(
+          "E_SENSITIVE_PATH",
+          `Lane fast cannot change sensitive paths: ${sensitive.slice(0, 5).join(", ")}.`
+        );
+      }
+    }
+    return {
+      state: "success",
+      description: `${snapshot.baselineId} ready (${ready.lane})`,
+      details: []
+    };
+  }
+  /** PO approves stories; a task inherits the approval of its parent story's current content. */
+  async assertApproved(snapshot, lane, policy) {
+    if (!policy.lanes[lane].requires_po_approval) return;
+    if (snapshot.kind === "task") {
+      if (snapshot.parent === null) {
+        throw new AiDlcError("E_FORM", "A task needs a parent story in `### Issue cha`.");
+      }
+      if (!await this.parentDecision(snapshot.parent, "approve", policy)) {
+        throw new AiDlcError(
+          "E_NOT_APPROVED",
+          `Lane \`${lane}\` requires a valid PO approval of parent story #${snapshot.parent} for its current content.`
+        );
+      }
+      return;
+    }
+    if (!await this.findValidDecision(
+      snapshot.source.issueNumber,
+      snapshot.baselineId,
+      "approve",
+      policy
+    )) {
+      throw new AiDlcError(
+        "E_NOT_APPROVED",
+        `Lane \`${lane}\` requires a valid PO approval for this baseline.`
+      );
+    }
+  }
+  async parentDecision(parentNumber, kind, policy) {
+    const parent = await this.deps.github.getIssue(parentNumber);
+    if (kindFromLabels(parent.labels) !== "story") {
+      throw new AiDlcError("E_WRONG_KIND", `Parent #${parentNumber} of a task must be a story.`);
+    }
+    const current = this.snapshotOf(parent);
+    return this.findValidDecision(parentNumber, current.baselineId, kind, policy);
+  }
+  async assertParentReady(parentNumber, policy) {
+    if (!await this.parentDecision(parentNumber, "ready", policy)) {
+      throw new AiDlcError(
+        "E_NOT_READY",
+        `Parent story #${parentNumber} has no valid ready decision for its current content.`
+      );
+    }
+  }
+};
+function errorReply(error) {
+  return [`**huddle60: \`${error.code}\`**`, "", sanitize(error.message)].join("\n");
+}
+function firstLine(text) {
+  return text.split("\n")[0] ?? "";
+}
+function truncate(text, max) {
+  return text.length <= max ? text : `${text.slice(0, max - 1)}\u2026`;
+}
+
+// src/entry/action.ts
+async function main() {
+  const eventName = requireEnv("GITHUB_EVENT_NAME");
+  const payload = JSON.parse(await readFile(requireEnv("GITHUB_EVENT_PATH"), "utf8"));
+  const [owner, repo] = requireEnv("GITHUB_REPOSITORY").split("/");
+  const logger = createJsonLogger({ component: "huddle60-action", event: eventName });
+  const token = process.env.HUDDLE60_TOKEN || process.env.AI_DLC_TOKEN || requireEnv("HUDDLE60_TOKEN or AI_DLC_TOKEN");
+  const octokit = octokitFromToken(token);
+  const github = await connectRepository(octokit, owner, repo);
+  let policySource = await github.readFile(POLICY_PATH, await github.getDefaultBranch());
+  if (!policySource) {
+    policySource = await github.readFile(LEGACY_POLICY_PATH, await github.getDefaultBranch());
+  }
+  const branch = policySource ? parsePolicy(policySource).evidence.branch : "huddle60-evidence";
+  const workflow = new WorkflowService({
+    github,
+    evidence: new GitBranchEvidenceStore(octokit, owner, repo, branch),
+    clock: systemClock,
+    logger,
+    enabled: process.env.HUDDLE60_ENABLED !== "false" && process.env.AI_DLC_ENABLED !== "false"
+  });
+  if (eventName === "issue_comment") {
+    if (!payload.issue || payload.issue.pull_request || !payload.comment || payload.sender?.type === "Bot")
+      return;
+    const action = payload.action;
+    await workflow.handleComment(payload.issue.number, payload.comment.id, action);
+    return;
+  }
+  if (eventName === "pull_request_target" && payload.pull_request) {
+    const result = await workflow.checkPullRequest(payload.pull_request.number);
+    await summary([
+      `### huddle60/baseline: ${result.state}`,
+      "",
+      result.description,
+      ...result.details.map((line) => `> ${line}`)
+    ]);
+    return;
+  }
+  logger.info("event ignored");
+}
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) throw new Error(`Missing environment variable ${name}`);
+  return value;
+}
+async function summary(lines) {
+  const file = process.env.GITHUB_STEP_SUMMARY;
+  if (file) await appendFile(file, `${lines.join("\n")}
+`);
+}
+main().catch((error) => {
+  process.stderr.write(
+    `ai-dlc action failed: ${error instanceof Error ? error.stack : String(error)}
+`
+  );
+  process.exitCode = 1;
+});
+//# sourceMappingURL=action.js.map