iterate 0.2.6 → 0.3.0

package/dist/worker-ref-DZxPDmb_.mjs

@@ -0,0 +1,390 @@
+import { h as defineProcessorContract } from "./stream-processor-keepalive-DAQTP6m3.mjs";
+import "./processors.mjs";
+import { z } from "zod";
+//#region src/starter-apps/github-ai-linter/contract.ts
+/**
+* Keep the vocabulary flat. These names are also copied into the linter
+* agent's developer task, so changing one here deliberately breaks an old
+* prompt instead of leaving two almost-compatible protocols alive.
+*
+* The const assertion preserves exact event literals for contract typing. It
+* is safe because this object is static vocabulary and is never mutated.
+*/
+const githubAiLinterEventTypes = {
+	analysisRequested: "events.iterate.com/github-ai-linter/analysis-requested",
+	diagnosticReported: "events.iterate.com/github-ai-linter/diagnostic-reported",
+	diagnosticSuppressed: "events.iterate.com/github-ai-linter/diagnostic-suppressed",
+	analysisSettled: "events.iterate.com/github-ai-linter/analysis-settled",
+	reviewPublicationRequested: "events.iterate.com/github-ai-linter/review-publication-requested",
+	reviewPublicationSettled: "events.iterate.com/github-ai-linter/review-publication-settled"
+};
+const PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const StreamOffset = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const RuleName = z.string().regex(/^[a-z0-9-]+(?:\/[a-z0-9-]+)*$/);
+const GithubAiLinterRule = z.object({
+	files: z.array(z.string().min(1)).min(1),
+	invariant: z.string().min(1),
+	severity: z.enum(["error", "warning"]),
+	suggestions: z.enum(["allowed", "forbidden"]).default("allowed")
+});
+const GithubAiLinterAnalysisRequested = z.object({
+	appSlug: z.string().min(1),
+	baseSha: z.string().min(1),
+	connection: z.string().min(1),
+	headSha: z.string().min(1),
+	policyVersion: z.string().min(1),
+	promptVersion: z.string().min(1),
+	pullRequestNumber: PositiveSafeInteger,
+	repository: z.object({
+		id: PositiveSafeInteger,
+		owner: z.string().min(1),
+		repo: z.string().min(1)
+	}),
+	rules: z.record(RuleName, GithubAiLinterRule),
+	rulesCommit: z.string().min(1)
+});
+const SourceSpanSchema = z.object({
+	endColumn: PositiveSafeInteger.optional(),
+	endLine: PositiveSafeInteger,
+	startColumn: PositiveSafeInteger.optional(),
+	startLine: PositiveSafeInteger
+}).refine(({ endLine, startLine }) => endLine >= startLine, "a source span must end on or after its start line");
+const WholeLineSpanSchema = z.object({
+	endLine: PositiveSafeInteger,
+	startLine: PositiveSafeInteger
+}).refine(({ endLine, startLine }) => endLine >= startLine, "a source span must end on or after its start line");
+const GithubAiLinterDiagnostic = z.object({
+	/**
+	* Cross-analysis identity. Unlike the GitHub line, this should survive
+	* nearby edits: rule + filename + a short semantic anchor is the intended
+	* input. The prompt explicitly forbids line numbers and prose here.
+	*/
+	diagnosticKey: z.string().min(1).max(500),
+	filename: z.string().min(1).max(2e3),
+	fix: z.object({
+		content: z.string().max(5e4),
+		/**
+		* The first slice only publishes human-applied GitHub suggestions.
+		* A future `fix` kind may authorize an automated branch update, but it
+		* must be a separate explicit protocol: never reinterpret an archived
+		* suggestion as permission to mutate code.
+		*/
+		kind: z.literal("suggestion"),
+		span: WholeLineSpanSchema
+	}).optional(),
+	help: z.string().min(1).max(8e3).optional(),
+	/**
+	* Oxlint diagnostics can carry several labels. The first label is the
+	* primary one and supplies GitHub's inline location in this first version;
+	* later labels remain structured context for a richer renderer.
+	*/
+	labels: z.array(z.object({
+		message: z.string().min(1).max(4e3).optional(),
+		span: SourceSpanSchema
+	})).min(1).max(20),
+	message: z.string().min(1).max(8e3),
+	ruleName: RuleName,
+	severity: z.enum(["error", "warning"])
+});
+const GithubAiLinterDiagnosticReportedPayload = GithubAiLinterDiagnostic.extend({ analysisRequestOffset: StreamOffset });
+const GithubAiLinterDiagnosticSuppressedPayload = z.object({
+	analysisRequestOffset: StreamOffset,
+	diagnosticOffset: StreamOffset,
+	directive: z.enum([
+		"disable",
+		"disable-line",
+		"disable-next-line"
+	]),
+	filename: z.string().min(1).max(2e3),
+	line: PositiveSafeInteger,
+	reason: z.string().min(1).max(4e3)
+});
+const GithubAiLinterAssessment = z.object({
+	summary: z.string().min(1).max(2e4),
+	verdict: z.enum([
+		"approve",
+		"comment",
+		"request-changes"
+	])
+});
+const GithubAiLinterAnalysisResult = z.discriminatedUnion("status", [
+	z.object({
+		assessment: GithubAiLinterAssessment,
+		status: z.literal("succeeded")
+	}),
+	z.object({
+		reason: z.string().min(1).max(8e3),
+		status: z.literal("cancelled")
+	}),
+	z.object({
+		error: z.string().min(1).max(8e3),
+		status: z.literal("failed")
+	})
+]);
+const GithubAiLinterAnalysisSettledPayload = z.object({
+	analysisRequestOffset: StreamOffset,
+	result: GithubAiLinterAnalysisResult
+});
+const PublishedCheckRun = z.object({
+	id: PositiveSafeInteger,
+	url: z.string().url()
+});
+const GithubAiLinterPublicationResult = z.discriminatedUnion("status", [
+	z.object({
+		checkRun: PublishedCheckRun,
+		reason: z.string().min(1).max(8e3),
+		status: z.literal("skipped")
+	}),
+	z.object({
+		checkRun: PublishedCheckRun.optional(),
+		reviewId: PositiveSafeInteger,
+		reviewUrl: z.string().url(),
+		status: z.literal("succeeded")
+	}),
+	z.object({
+		reason: z.string().min(1).max(8e3),
+		status: z.literal("cancelled")
+	}),
+	z.object({
+		error: z.string().min(1).max(8e3),
+		status: z.literal("failed")
+	})
+]);
+const PublicationState = z.discriminatedUnion("status", [
+	z.object({ status: z.literal("not-requested") }),
+	z.object({ status: z.literal("requested") }),
+	...GithubAiLinterPublicationResult.options
+]);
+const ReducedDiagnostic = z.object({
+	classification: z.enum([
+		"new",
+		"persistent",
+		"reintroduced"
+	]).nullable(),
+	diagnostic: GithubAiLinterDiagnostic,
+	eventOffset: StreamOffset,
+	suppression: GithubAiLinterDiagnosticSuppressedPayload.nullable()
+});
+const AnalysisSummary = z.object({
+	analysisRequestOffset: StreamOffset,
+	baseSha: z.string().min(1),
+	diagnosticCount: z.number().int().nonnegative(),
+	headSha: z.string().min(1),
+	publication: PublicationState,
+	rulesCommit: z.string().min(1),
+	status: z.enum([
+		"running",
+		"succeeded",
+		"cancelled",
+		"failed"
+	]),
+	suppressedDiagnosticCount: z.number().int().nonnegative()
+});
+const MaterializedAnalysis = z.object({
+	analysisRequestOffset: StreamOffset,
+	assessment: GithubAiLinterAssessment,
+	diagnostics: z.array(ReducedDiagnostic),
+	request: GithubAiLinterAnalysisRequested,
+	resolvedDiagnostics: z.array(GithubAiLinterDiagnostic)
+});
+const ActiveAnalysis = z.object({
+	/**
+	* There is deliberately no wall-clock expiry in the first slice. New pushes
+	* cancel old work, while the Agent processor's autonomous-turn breaker
+	* explicitly fails an analysis which cannot finish within its configured
+	* budget. A future time limit should likewise be a typed processor-authored
+	* settlement event driven by a durable alarm, not an implicit timestamp
+	* check that silently changes reduced state.
+	*/
+	analysisRequestOffset: StreamOffset,
+	diagnostics: z.array(ReducedDiagnostic),
+	request: GithubAiLinterAnalysisRequested
+});
+const GithubAiLinterProcessorContract = defineProcessorContract({
+	slug: "github-ai-linter",
+	version: "0.4.0",
+	description: "Reduces one pull request's AI diagnostics and mechanically publishes its GitHub Check Run and optional advisory review.",
+	stateSchema: z.object({
+		/**
+		* These are intentionally lightweight headers, not copies of every prompt
+		* and diagnostic. The stream remains the canonical full history. If a PR
+		* eventually accumulates enough pushes for even these headers to matter,
+		* move cold headers to a paged read model rather than retaining full
+		* diagnostics in Durable Object state.
+		*/
+		analyses: z.array(AnalysisSummary).default([]),
+		currentAnalysis: ActiveAnalysis.nullable().default(null),
+		latestSuccessfulAnalysis: MaterializedAnalysis.nullable().default(null),
+		/**
+		* This small semantic-key index is what lets a later result distinguish
+		* "new" from "reintroduced." A production-scale rule engine should replace
+		* it with a compact/bounded index; the event history already contains the
+		* authoritative data needed to rebuild one.
+		*/
+		seenDiagnosticKeys: z.array(z.string()).default([])
+	}),
+	events: {
+		[githubAiLinterEventTypes.analysisRequested]: {
+			description: "Pins one pull-request head and immutable rules snapshot for analysis.",
+			payloadSchema: GithubAiLinterAnalysisRequested
+		},
+		[githubAiLinterEventTypes.diagnosticReported]: {
+			description: "One Oxlint-shaped diagnostic reported by the analysis agent.",
+			payloadSchema: GithubAiLinterDiagnosticReportedPayload
+		},
+		[githubAiLinterEventTypes.diagnosticSuppressed]: {
+			description: "Records that a source directive suppresses one reported diagnostic.",
+			payloadSchema: GithubAiLinterDiagnosticSuppressedPayload
+		},
+		[githubAiLinterEventTypes.analysisSettled]: {
+			description: "The sole terminal fact for an analysis request.",
+			payloadSchema: GithubAiLinterAnalysisSettledPayload
+		},
+		[githubAiLinterEventTypes.reviewPublicationRequested]: {
+			description: "Opens the durable obligation to publish one GitHub Check Run and, for findings, one immutable non-blocking review.",
+			payloadSchema: z.object({ analysisRequestOffset: StreamOffset })
+		},
+		[githubAiLinterEventTypes.reviewPublicationSettled]: {
+			description: "Records the terminal GitHub Check Run and review publication result.",
+			payloadSchema: z.object({
+				analysisRequestOffset: StreamOffset,
+				result: GithubAiLinterPublicationResult
+			})
+		}
+	},
+	processorDeps: [{ "events.iterate.com/agent/paused": {
+		description: "The generic Agent processor paused its autonomous turn loop.",
+		payloadSchema: z.object({
+			reason: z.string().optional(),
+			triggerOffset: StreamOffset.optional()
+		})
+	} }],
+	consumes: [...Object.values(githubAiLinterEventTypes), "events.iterate.com/agent/paused"],
+	emits: [
+		githubAiLinterEventTypes.analysisSettled,
+		githubAiLinterEventTypes.reviewPublicationRequested,
+		githubAiLinterEventTypes.reviewPublicationSettled
+	]
+});
+//#endregion
+//#region src/starter-apps/github-ai-linter/worker-ref.ts
+const configuredWorkerEntrypoint = "node_modules/iterate/dist/starter-apps/github-ai-linter/configured-worker.mjs";
+const REVIEW_BOT_SUBSCRIPTION_NAME = "review-bot";
+const REVIEW_BOT_RELEVANT_WEBHOOK_CONDITION = [
+	"(payload.delivery.name = \"pull_request\" and",
+	"(payload.body.action = \"opened\" or",
+	"payload.body.action = \"ready_for_review\" or",
+	"payload.body.action = \"synchronize\"))",
+	"or",
+	"((payload.delivery.name = \"issue_comment\" or",
+	"payload.delivery.name = \"pull_request_review\" or",
+	"payload.delivery.name = \"pull_request_review_comment\") and",
+	"$count(payload.associations.mentionedUsers) > 0)"
+].join(" ");
+/**
+* The review router only needs lifecycle deliveries and explicit mentions.
+* Filtering on the source stream keeps check/workflow webhook bursts out of
+* the hosted processor while the offset prefix preserves the restore cutoff.
+*/
+function reviewBotSubscriptionCondition(startAfterOffset) {
+	return `offset > ${startAfterOffset} and (${REVIEW_BOT_RELEVANT_WEBHOOK_CONDITION})`;
+}
+async function reviewBotSubscriptionEvent(sourceEvent, connection, config, startAfterOffset) {
+	return {
+		type: "events.iterate.com/stream/subscription-configured",
+		payload: {
+			name: REVIEW_BOT_SUBSCRIPTION_NAME,
+			filter: {
+				eventTypes: ["events.iterate.com/github/webhook-received"],
+				jsonataCondition: reviewBotSubscriptionCondition(startAfterOffset)
+			},
+			receiver: {
+				action: "wake-processor",
+				expression: [
+					"workers",
+					["get", await reviewBotAppRef(connection, config)],
+					"processor",
+					"wakeStreamProcessor"
+				]
+			}
+		},
+		idempotencyKey: `review-bot/subscription:${sourceEvent.path}:${sourceEvent.offset}`
+	};
+}
+async function pullRequestLinterSubscriptionEvent(input, config) {
+	return {
+		type: "events.iterate.com/stream/subscription-configured",
+		payload: {
+			name: "github-ai-linter",
+			filter: { eventTypes: GithubAiLinterProcessorContract.consumes },
+			receiver: {
+				action: "wake-processor",
+				expression: [
+					"workers",
+					["get", await pullRequestLinterAppRef(input, config)],
+					"processor",
+					"wakeStreamProcessor"
+				]
+			}
+		},
+		idempotencyKey: [
+			"github-ai-linter/subscription",
+			input.connection,
+			input.repositoryId,
+			input.pullRequestNumber,
+			`policy:${config.policyVersion}`,
+			"delivery:2",
+			`stream:${input.streamPath}`
+		].join(":")
+	};
+}
+async function reviewBotAppRef(connection, config) {
+	return dynamicWorkerRef({
+		className: "ReviewBotApp",
+		config,
+		durableWorkerKey: `github-ai-linter-review-bot-${await durableIdentity(connection)}`
+	});
+}
+async function pullRequestLinterAppRef(input, config) {
+	return dynamicWorkerRef({
+		className: "GithubAiLinterApp",
+		config,
+		durableWorkerKey: `app-gh-linter-${await durableIdentity([
+			input.connection,
+			String(input.repositoryId),
+			String(input.pullRequestNumber),
+			input.streamPath
+		].join("\0"))}`
+	});
+}
+function dynamicWorkerRef(input) {
+	return {
+		type: "stateful",
+		path: "/",
+		className: input.className,
+		durableWorkerKey: input.durableWorkerKey,
+		source: { createWorker: {
+			entryPoint: configuredWorkerEntrypoint,
+			files: {
+				type: "repo",
+				repoPath: "/repos/config",
+				include: ["package.json"]
+			},
+			minify: true,
+			virtualModules: { "iterate:github-ai-linter-config": `export default ${JSON.stringify(input.config)};` }
+		} }
+	};
+}
+/**
+* Dynamic-worker durable keys have a 63-character ceiling and connection
+* slugs are user-controlled. A truncated SHA-256 preserves stable identity
+* without leaking or squeezing arbitrary coordinates into that limit.
+*/
+async function durableIdentity(value) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+	return [...new Uint8Array(digest).slice(0, 16)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
+export { githubAiLinterEventTypes as a, GithubAiLinterProcessorContract as i, pullRequestLinterSubscriptionEvent as n, reviewBotSubscriptionEvent as r, REVIEW_BOT_SUBSCRIPTION_NAME as t };
+
+//# sourceMappingURL=worker-ref-DZxPDmb_.mjs.map

package/dist/worker-ref-DZxPDmb_.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-ref-DZxPDmb_.mjs","names":[],"sources":["../src/starter-apps/github-ai-linter/contract.ts","../src/starter-apps/github-ai-linter/worker-ref.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { defineProcessorContract } from \"../../processors/index.ts\";\n\n/**\n * Keep the vocabulary flat. These names are also copied into the linter\n * agent's developer task, so changing one here deliberately breaks an old\n * prompt instead of leaving two almost-compatible protocols alive.\n *\n * The const assertion preserves exact event literals for contract typing. It\n * is safe because this object is static vocabulary and is never mutated.\n */\nexport const githubAiLinterEventTypes = {\n  analysisRequested: \"events.iterate.com/github-ai-linter/analysis-requested\",\n  diagnosticReported: \"events.iterate.com/github-ai-linter/diagnostic-reported\",\n  diagnosticSuppressed: \"events.iterate.com/github-ai-linter/diagnostic-suppressed\",\n  analysisSettled: \"events.iterate.com/github-ai-linter/analysis-settled\",\n  reviewPublicationRequested: \"events.iterate.com/github-ai-linter/review-publication-requested\",\n  reviewPublicationSettled: \"events.iterate.com/github-ai-linter/review-publication-settled\",\n} as const;\n\nconst PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\n// Stream offset zero is the valid \"before the first event\" coordinate in the\n// processor APIs. Keeping it distinct from GitHub IDs and source lines avoids\n// accidentally rejecting a request simply because it was the stream's first\n// committed event.\nconst StreamOffset = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);\nconst RuleName = z.string().regex(/^[a-z0-9-]+(?:\\/[a-z0-9-]+)*$/);\n\nconst GithubAiLinterRule = z.object({\n  files: z.array(z.string().min(1)).min(1),\n  invariant: z.string().min(1),\n  severity: z.enum([\"error\", \"warning\"]),\n  suggestions: z.enum([\"allowed\", \"forbidden\"]).default(\"allowed\"),\n});\n\nexport const GithubAiLinterAnalysisRequested = z.object({\n  appSlug: z.string().min(1),\n  baseSha: z.string().min(1),\n  connection: z.string().min(1),\n  headSha: z.string().min(1),\n  policyVersion: z.string().min(1),\n  promptVersion: z.string().min(1),\n  pullRequestNumber: PositiveSafeInteger,\n  repository: z.object({\n    id: PositiveSafeInteger,\n    owner: z.string().min(1),\n    repo: z.string().min(1),\n  }),\n  rules: z.record(RuleName, GithubAiLinterRule),\n  rulesCommit: z.string().min(1),\n});\n\nconst SourceSpanSchema = z\n  .object({\n    endColumn: PositiveSafeInteger.optional(),\n    endLine: PositiveSafeInteger,\n    startColumn: PositiveSafeInteger.optional(),\n    startLine: PositiveSafeInteger,\n  })\n  .refine(\n    ({ endLine, startLine }) => endLine >= startLine,\n    \"a source span must end on or after its start line\",\n  );\nconst WholeLineSpanSchema = z\n  .object({\n    endLine: PositiveSafeInteger,\n    startLine: PositiveSafeInteger,\n  })\n  .refine(\n    ({ endLine, startLine }) => endLine >= startLine,\n    \"a source span must end on or after its start line\",\n  );\n\nconst GithubAiLinterDiagnostic = z.object({\n  /**\n   * Cross-analysis identity. Unlike the GitHub line, this should survive\n   * nearby edits: rule + filename + a short semantic anchor is the intended\n   * input. The prompt explicitly forbids line numbers and prose here.\n   */\n  diagnosticKey: z.string().min(1).max(500),\n  filename: z.string().min(1).max(2_000),\n  fix: z\n    .object({\n      content: z.string().max(50_000),\n      /**\n       * The first slice only publishes human-applied GitHub suggestions.\n       * A future `fix` kind may authorize an automated branch update, but it\n       * must be a separate explicit protocol: never reinterpret an archived\n       * suggestion as permission to mutate code.\n       */\n      kind: z.literal(\"suggestion\"),\n      span: WholeLineSpanSchema,\n    })\n    .optional(),\n  help: z.string().min(1).max(8_000).optional(),\n  /**\n   * Oxlint diagnostics can carry several labels. The first label is the\n   * primary one and supplies GitHub's inline location in this first version;\n   * later labels remain structured context for a richer renderer.\n   */\n  labels: z\n    .array(\n      z.object({\n        message: z.string().min(1).max(4_000).optional(),\n        span: SourceSpanSchema,\n      }),\n    )\n    .min(1)\n    .max(20),\n  message: z.string().min(1).max(8_000),\n  ruleName: RuleName,\n  severity: z.enum([\"error\", \"warning\"]),\n});\n\nconst GithubAiLinterDiagnosticReportedPayload = GithubAiLinterDiagnostic.extend({\n  analysisRequestOffset: StreamOffset,\n});\n\nconst GithubAiLinterDiagnosticSuppressedPayload = z.object({\n  analysisRequestOffset: StreamOffset,\n  diagnosticOffset: StreamOffset,\n  directive: z.enum([\"disable\", \"disable-line\", \"disable-next-line\"]),\n  filename: z.string().min(1).max(2_000),\n  line: PositiveSafeInteger,\n  reason: z.string().min(1).max(4_000),\n});\n\nconst GithubAiLinterAssessment = z.object({\n  summary: z.string().min(1).max(20_000),\n  verdict: z.enum([\"approve\", \"comment\", \"request-changes\"]),\n});\n\nconst GithubAiLinterAnalysisResult = z.discriminatedUnion(\"status\", [\n  z.object({\n    assessment: GithubAiLinterAssessment,\n    status: z.literal(\"succeeded\"),\n  }),\n  z.object({\n    reason: z.string().min(1).max(8_000),\n    status: z.literal(\"cancelled\"),\n  }),\n  z.object({\n    error: z.string().min(1).max(8_000),\n    status: z.literal(\"failed\"),\n  }),\n]);\n\nconst GithubAiLinterAnalysisSettledPayload = z.object({\n  analysisRequestOffset: StreamOffset,\n  result: GithubAiLinterAnalysisResult,\n});\n\nconst PublishedCheckRun = z.object({\n  id: PositiveSafeInteger,\n  url: z.string().url(),\n});\n\nexport const GithubAiLinterPublicationResult = z.discriminatedUnion(\"status\", [\n  z.object({\n    checkRun: PublishedCheckRun,\n    reason: z.string().min(1).max(8_000),\n    status: z.literal(\"skipped\"),\n  }),\n  z.object({\n    // Optional only for replay compatibility with successful publication\n    // events written before the linter began publishing Check Runs.\n    checkRun: PublishedCheckRun.optional(),\n    reviewId: PositiveSafeInteger,\n    reviewUrl: z.string().url(),\n    status: z.literal(\"succeeded\"),\n  }),\n  z.object({\n    reason: z.string().min(1).max(8_000),\n    status: z.literal(\"cancelled\"),\n  }),\n  z.object({\n    error: z.string().min(1).max(8_000),\n    status: z.literal(\"failed\"),\n  }),\n]);\n\nconst PublicationState = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"not-requested\") }),\n  z.object({ status: z.literal(\"requested\") }),\n  ...GithubAiLinterPublicationResult.options,\n]);\n\nconst ReducedDiagnostic = z.object({\n  classification: z.enum([\"new\", \"persistent\", \"reintroduced\"]).nullable(),\n  diagnostic: GithubAiLinterDiagnostic,\n  eventOffset: StreamOffset,\n  suppression: GithubAiLinterDiagnosticSuppressedPayload.nullable(),\n});\n\nconst AnalysisSummary = z.object({\n  analysisRequestOffset: StreamOffset,\n  baseSha: z.string().min(1),\n  diagnosticCount: z.number().int().nonnegative(),\n  headSha: z.string().min(1),\n  publication: PublicationState,\n  rulesCommit: z.string().min(1),\n  status: z.enum([\"running\", \"succeeded\", \"cancelled\", \"failed\"]),\n  suppressedDiagnosticCount: z.number().int().nonnegative(),\n});\n\nconst MaterializedAnalysis = z.object({\n  analysisRequestOffset: StreamOffset,\n  assessment: GithubAiLinterAssessment,\n  diagnostics: z.array(ReducedDiagnostic),\n  request: GithubAiLinterAnalysisRequested,\n  resolvedDiagnostics: z.array(GithubAiLinterDiagnostic),\n});\n\nconst ActiveAnalysis = z.object({\n  /**\n   * There is deliberately no wall-clock expiry in the first slice. New pushes\n   * cancel old work, while the Agent processor's autonomous-turn breaker\n   * explicitly fails an analysis which cannot finish within its configured\n   * budget. A future time limit should likewise be a typed processor-authored\n   * settlement event driven by a durable alarm, not an implicit timestamp\n   * check that silently changes reduced state.\n   */\n  analysisRequestOffset: StreamOffset,\n  diagnostics: z.array(ReducedDiagnostic),\n  request: GithubAiLinterAnalysisRequested,\n});\n\nexport const GithubAiLinterState = z.object({\n  /**\n   * These are intentionally lightweight headers, not copies of every prompt\n   * and diagnostic. The stream remains the canonical full history. If a PR\n   * eventually accumulates enough pushes for even these headers to matter,\n   * move cold headers to a paged read model rather than retaining full\n   * diagnostics in Durable Object state.\n   */\n  analyses: z.array(AnalysisSummary).default([]),\n  currentAnalysis: ActiveAnalysis.nullable().default(null),\n  latestSuccessfulAnalysis: MaterializedAnalysis.nullable().default(null),\n  /**\n   * This small semantic-key index is what lets a later result distinguish\n   * \"new\" from \"reintroduced.\" A production-scale rule engine should replace\n   * it with a compact/bounded index; the event history already contains the\n   * authoritative data needed to rebuild one.\n   */\n  seenDiagnosticKeys: z.array(z.string()).default([]),\n});\n\nexport const GithubAiLinterProcessorContract = defineProcessorContract({\n  slug: \"github-ai-linter\",\n  version: \"0.4.0\",\n  description:\n    \"Reduces one pull request's AI diagnostics and mechanically publishes its GitHub Check Run and optional advisory review.\",\n  stateSchema: GithubAiLinterState,\n  events: {\n    [githubAiLinterEventTypes.analysisRequested]: {\n      description: \"Pins one pull-request head and immutable rules snapshot for analysis.\",\n      payloadSchema: GithubAiLinterAnalysisRequested,\n    },\n    [githubAiLinterEventTypes.diagnosticReported]: {\n      description: \"One Oxlint-shaped diagnostic reported by the analysis agent.\",\n      payloadSchema: GithubAiLinterDiagnosticReportedPayload,\n    },\n    [githubAiLinterEventTypes.diagnosticSuppressed]: {\n      description: \"Records that a source directive suppresses one reported diagnostic.\",\n      payloadSchema: GithubAiLinterDiagnosticSuppressedPayload,\n    },\n    [githubAiLinterEventTypes.analysisSettled]: {\n      description: \"The sole terminal fact for an analysis request.\",\n      payloadSchema: GithubAiLinterAnalysisSettledPayload,\n    },\n    [githubAiLinterEventTypes.reviewPublicationRequested]: {\n      description:\n        \"Opens the durable obligation to publish one GitHub Check Run and, for findings, one immutable non-blocking review.\",\n      payloadSchema: z.object({ analysisRequestOffset: StreamOffset }),\n    },\n    [githubAiLinterEventTypes.reviewPublicationSettled]: {\n      description: \"Records the terminal GitHub Check Run and review publication result.\",\n      payloadSchema: z.object({\n        analysisRequestOffset: StreamOffset,\n        result: GithubAiLinterPublicationResult,\n      }),\n    },\n  },\n  // `agent/paused` is owned by the platform Agent contract. This userspace\n  // processor consumes it only to turn an exhausted analysis into a durable\n  // terminal fact instead of leaving it visibly `running`.\n  processorDeps: [\n    {\n      \"events.iterate.com/agent/paused\": {\n        description: \"The generic Agent processor paused its autonomous turn loop.\",\n        payloadSchema: z.object({\n          reason: z.string().optional(),\n          triggerOffset: StreamOffset.optional(),\n        }),\n      },\n    },\n  ],\n  consumes: [...Object.values(githubAiLinterEventTypes), \"events.iterate.com/agent/paused\"],\n  // `diagnostic-reported` and `diagnostic-suppressed` are declared above and\n  // consumed here, but are not processor emissions: the generic Agent appends\n  // them with its ordinary stream capability. This list is deliberately only\n  // the mechanical processor's own consequences.\n  emits: [\n    githubAiLinterEventTypes.analysisSettled,\n    githubAiLinterEventTypes.reviewPublicationRequested,\n    githubAiLinterEventTypes.reviewPublicationSettled,\n  ],\n});\n\nexport type GithubAiLinterProcessorContract = typeof GithubAiLinterProcessorContract;\nexport type GithubAiLinterState = z.infer<typeof GithubAiLinterState>;\nexport type GithubAiLinterAnalysisRequested = z.infer<typeof GithubAiLinterAnalysisRequested>;\nexport type GithubAiLinterPublicationResult = z.infer<typeof GithubAiLinterPublicationResult>;\n","import type { StatefulDynamicWorkerRef, StreamEvent, StreamEventInput } from \"../../sdk.ts\";\nimport { GithubAiLinterProcessorContract } from \"./contract.ts\";\nimport type { GithubAiLinterRuleSource } from \"./rules.ts\";\n\nexport type GithubAiLinterConfig = {\n  /**\n   * Operators bump this when rule selection or policy meaning changes. It is\n   * part of analysis identity, so an unchanged pull-request head is analysed\n   * again instead of colliding with an older task.\n   */\n  policyVersion: string;\n  rules: GithubAiLinterRuleSource;\n};\n\nconst configuredWorkerEntrypoint =\n  \"node_modules/iterate/dist/starter-apps/github-ai-linter/configured-worker.mjs\";\n\n// Subscription names are opaque, source-local identities under the\n// subscription-model redesign — the old `app-…#slug` placement-encoding\n// convention is dead. Plain contract-slug names read as\n// `subscriptions.get(\"review-bot\")`.\nexport const REVIEW_BOT_SUBSCRIPTION_NAME = \"review-bot\";\n\nconst REVIEW_BOT_RELEVANT_WEBHOOK_CONDITION = [\n  '(payload.delivery.name = \"pull_request\" and',\n  '(payload.body.action = \"opened\" or',\n  'payload.body.action = \"ready_for_review\" or',\n  'payload.body.action = \"synchronize\"))',\n  \"or\",\n  '((payload.delivery.name = \"issue_comment\" or',\n  'payload.delivery.name = \"pull_request_review\" or',\n  'payload.delivery.name = \"pull_request_review_comment\") and',\n  \"$count(payload.associations.mentionedUsers) > 0)\",\n].join(\" \");\n\n/**\n * The review router only needs lifecycle deliveries and explicit mentions.\n * Filtering on the source stream keeps check/workflow webhook bursts out of\n * the hosted processor while the offset prefix preserves the restore cutoff.\n */\nfunction reviewBotSubscriptionCondition(startAfterOffset: number) {\n  return `offset > ${startAfterOffset} and (${REVIEW_BOT_RELEVANT_WEBHOOK_CONDITION})`;\n}\n\nexport async function reviewBotSubscriptionEvent(\n  sourceEvent: StreamEvent,\n  connection: string,\n  config: GithubAiLinterConfig,\n  startAfterOffset: number,\n): Promise<StreamEventInput> {\n  return {\n    type: \"events.iterate.com/stream/subscription-configured\",\n    payload: {\n      name: REVIEW_BOT_SUBSCRIPTION_NAME,\n      // A restored connection stream can contain thousands of old webhooks.\n      // This cutoff gives a newly configured review bot future work only.\n      // Config refreshes preserve the original cutoff in index.ts.\n      filter: {\n        eventTypes: [\"events.iterate.com/github/webhook-received\"],\n        jsonataCondition: reviewBotSubscriptionCondition(startAfterOffset),\n      },\n      receiver: {\n        action: \"wake-processor\",\n        expression: [\n          \"workers\",\n          [\"get\", await reviewBotAppRef(connection, config)],\n          \"processor\",\n          \"wakeStreamProcessor\",\n        ],\n      },\n    },\n    idempotencyKey: `review-bot/subscription:${sourceEvent.path}:${sourceEvent.offset}`,\n  };\n}\n\nexport async function pullRequestLinterSubscriptionEvent(\n  input: {\n    connection: string;\n    pullRequestNumber: number;\n    repositoryId: number;\n    // A processor host permanently adopts its first stream coordinate. The\n    // path keeps two project-controlled repo aliases for the same GitHub PR\n    // from accidentally dialing the same Durable Object.\n    streamPath: string;\n  },\n  config: GithubAiLinterConfig,\n): Promise<StreamEventInput> {\n  return {\n    type: \"events.iterate.com/stream/subscription-configured\",\n    payload: {\n      name: \"github-ai-linter\",\n      // The processor contract is the one vocabulary authority. In particular,\n      // it includes `agent/paused`, which turns an exhausted review into its\n      // durable terminal analysis settlement.\n      filter: {\n        eventTypes: GithubAiLinterProcessorContract.consumes,\n      },\n      receiver: {\n        action: \"wake-processor\",\n        expression: [\n          \"workers\",\n          [\"get\", await pullRequestLinterAppRef(input, config)],\n          \"processor\",\n          \"wakeStreamProcessor\",\n        ],\n      },\n    },\n    // Every route coordinate which changes the worker ref is part of the key.\n    // Policy changes and delivery-shape changes have independent revisions:\n    // the latter prevents a persisted old filter from colliding with its\n    // replacement under same-key/different-body validation. `delivery:2` is\n    // the durable filter/receiver shape; bump it when either changes.\n    idempotencyKey: [\n      \"github-ai-linter/subscription\",\n      input.connection,\n      input.repositoryId,\n      input.pullRequestNumber,\n      `policy:${config.policyVersion}`,\n      \"delivery:2\",\n      `stream:${input.streamPath}`,\n    ].join(\":\"),\n  };\n}\n\nasync function reviewBotAppRef(\n  connection: string,\n  config: GithubAiLinterConfig,\n): Promise<StatefulDynamicWorkerRef> {\n  return dynamicWorkerRef({\n    className: \"ReviewBotApp\",\n    config,\n    durableWorkerKey: `github-ai-linter-review-bot-${await durableIdentity(connection)}`,\n  });\n}\n\nasync function pullRequestLinterAppRef(\n  input: {\n    connection: string;\n    pullRequestNumber: number;\n    repositoryId: number;\n    streamPath: string;\n  },\n  config: GithubAiLinterConfig,\n): Promise<StatefulDynamicWorkerRef> {\n  const identity = [\n    input.connection,\n    String(input.repositoryId),\n    String(input.pullRequestNumber),\n    input.streamPath,\n  ].join(\"\\0\");\n  return dynamicWorkerRef({\n    className: \"GithubAiLinterApp\",\n    config,\n    durableWorkerKey: `app-gh-linter-${await durableIdentity(identity)}`,\n  });\n}\n\nfunction dynamicWorkerRef(input: {\n  className: string;\n  config: GithubAiLinterConfig;\n  durableWorkerKey: string;\n}): StatefulDynamicWorkerRef {\n  return {\n    type: \"stateful\",\n    path: \"/\",\n    className: input.className,\n    durableWorkerKey: input.durableWorkerKey,\n    source: {\n      createWorker: {\n        entryPoint: configuredWorkerEntrypoint,\n        files: {\n          type: \"repo\",\n          repoPath: \"/repos/config\",\n          include: [\"package.json\"],\n        },\n        minify: true,\n        virtualModules: {\n          \"iterate:github-ai-linter-config\": `export default ${JSON.stringify(input.config)};`,\n        },\n      },\n    },\n  };\n}\n\n/**\n * Dynamic-worker durable keys have a 63-character ceiling and connection\n * slugs are user-controlled. A truncated SHA-256 preserves stable identity\n * without leaking or squeezing arbitrary coordinates into that limit.\n */\nasync function durableIdentity(value: string) {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value));\n  return [...new Uint8Array(digest).slice(0, 16)]\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n"],"mappings":";;;;;;;;;;;;AAWA,MAAa,2BAA2B;CACtC,mBAAmB;CACnB,oBAAoB;CACpB,sBAAsB;CACtB,iBAAiB;CACjB,4BAA4B;CAC5B,0BAA0B;AAC5B;AAEA,MAAM,sBAAsB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,gBAAgB;AAKnF,MAAM,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,OAAO,gBAAgB;AAC/E,MAAM,WAAW,EAAE,OAAO,CAAC,CAAC,MAAM,+BAA+B;AAEjE,MAAM,qBAAqB,EAAE,OAAO;CAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;CACvC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC3B,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC;CACrC,aAAa,EAAE,KAAK,CAAC,WAAW,WAAW,CAAC,CAAC,CAAC,QAAQ,SAAS;AACjE,CAAC;AAED,MAAa,kCAAkC,EAAE,OAAO;CACtD,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC/B,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC/B,mBAAmB;CACnB,YAAY,EAAE,OAAO;EACnB,IAAI;EACJ,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,CAAC;CACD,OAAO,EAAE,OAAO,UAAU,kBAAkB;CAC5C,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC;AAED,MAAM,mBAAmB,EACtB,OAAO;CACN,WAAW,oBAAoB,SAAS;CACxC,SAAS;CACT,aAAa,oBAAoB,SAAS;CAC1C,WAAW;AACb,CAAC,CAAC,CACD,QACE,EAAE,SAAS,gBAAgB,WAAW,WACvC,mDACF;AACF,MAAM,sBAAsB,EACzB,OAAO;CACN,SAAS;CACT,WAAW;AACb,CAAC,CAAC,CACD,QACE,EAAE,SAAS,gBAAgB,WAAW,WACvC,mDACF;AAEF,MAAM,2BAA2B,EAAE,OAAO;;;;;;CAMxC,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACxC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;CACrC,KAAK,EACF,OAAO;EACN,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,GAAM;;;;;;;EAO9B,MAAM,EAAE,QAAQ,YAAY;EAC5B,MAAM;CACR,CAAC,CAAC,CACD,SAAS;CACZ,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK,CAAC,CAAC,SAAS;;;;;;CAM5C,QAAQ,EACL,MACC,EAAE,OAAO;EACP,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK,CAAC,CAAC,SAAS;EAC/C,MAAM;CACR,CAAC,CACH,CAAC,CACA,IAAI,CAAC,CAAC,CACN,IAAI,EAAE;CACT,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;CACpC,UAAU;CACV,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,0CAA0C,yBAAyB,OAAO,EAC9E,uBAAuB,aACzB,CAAC;AAED,MAAM,4CAA4C,EAAE,OAAO;CACzD,uBAAuB;CACvB,kBAAkB;CAClB,WAAW,EAAE,KAAK;EAAC;EAAW;EAAgB;CAAmB,CAAC;CAClE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;CACrC,MAAM;CACN,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;AACrC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;CACxC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAM;CACrC,SAAS,EAAE,KAAK;EAAC;EAAW;EAAW;CAAiB,CAAC;AAC3D,CAAC;AAED,MAAM,+BAA+B,EAAE,mBAAmB,UAAU;CAClE,EAAE,OAAO;EACP,YAAY;EACZ,QAAQ,EAAE,QAAQ,WAAW;CAC/B,CAAC;CACD,EAAE,OAAO;EACP,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;EACnC,QAAQ,EAAE,QAAQ,WAAW;CAC/B,CAAC;CACD,EAAE,OAAO;EACP,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;EAClC,QAAQ,EAAE,QAAQ,QAAQ;CAC5B,CAAC;AACH,CAAC;AAED,MAAM,uCAAuC,EAAE,OAAO;CACpD,uBAAuB;CACvB,QAAQ;AACV,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;CACjC,IAAI;CACJ,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI;AACtB,CAAC;AAED,MAAa,kCAAkC,EAAE,mBAAmB,UAAU;CAC5E,EAAE,OAAO;EACP,UAAU;EACV,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;EACnC,QAAQ,EAAE,QAAQ,SAAS;CAC7B,CAAC;CACD,EAAE,OAAO;EAGP,UAAU,kBAAkB,SAAS;EACrC,UAAU;EACV,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI;EAC1B,QAAQ,EAAE,QAAQ,WAAW;CAC/B,CAAC;CACD,EAAE,OAAO;EACP,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;EACnC,QAAQ,EAAE,QAAQ,WAAW;CAC/B,CAAC;CACD,EAAE,OAAO;EACP,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAK;EAClC,QAAQ,EAAE,QAAQ,QAAQ;CAC5B,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,EAAE,mBAAmB,UAAU;CACtD,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,eAAe,EAAE,CAAC;CAC/C,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC;CAC3C,GAAG,gCAAgC;AACrC,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;CACjC,gBAAgB,EAAE,KAAK;EAAC;EAAO;EAAc;CAAc,CAAC,CAAC,CAAC,SAAS;CACvE,YAAY;CACZ,aAAa;CACb,aAAa,0CAA0C,SAAS;AAClE,CAAC;AAED,MAAM,kBAAkB,EAAE,OAAO;CAC/B,uBAAuB;CACvB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,iBAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CAC9C,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,aAAa;CACb,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC7B,QAAQ,EAAE,KAAK;EAAC;EAAW;EAAa;EAAa;CAAQ,CAAC;CAC9D,2BAA2B,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;AAC1D,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;CACpC,uBAAuB;CACvB,YAAY;CACZ,aAAa,EAAE,MAAM,iBAAiB;CACtC,SAAS;CACT,qBAAqB,EAAE,MAAM,wBAAwB;AACvD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;;;;;;;;;CAS9B,uBAAuB;CACvB,aAAa,EAAE,MAAM,iBAAiB;CACtC,SAAS;AACX,CAAC;AAsBD,MAAa,kCAAkC,wBAAwB;CACrE,MAAM;CACN,SAAS;CACT,aACE;CACF,aAzBiC,EAAE,OAAO;;;;;;;;EAQ1C,UAAU,EAAE,MAAM,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC;EAC7C,iBAAiB,eAAe,SAAS,CAAC,CAAC,QAAQ,IAAI;EACvD,0BAA0B,qBAAqB,SAAS,CAAC,CAAC,QAAQ,IAAI;;;;;;;EAOtE,oBAAoB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CACpD,CAOe;CACb,QAAQ;GACL,yBAAyB,oBAAoB;GAC5C,aAAa;GACb,eAAe;EACjB;GACC,yBAAyB,qBAAqB;GAC7C,aAAa;GACb,eAAe;EACjB;GACC,yBAAyB,uBAAuB;GAC/C,aAAa;GACb,eAAe;EACjB;GACC,yBAAyB,kBAAkB;GAC1C,aAAa;GACb,eAAe;EACjB;GACC,yBAAyB,6BAA6B;GACrD,aACE;GACF,eAAe,EAAE,OAAO,EAAE,uBAAuB,aAAa,CAAC;EACjE;GACC,yBAAyB,2BAA2B;GACnD,aAAa;GACb,eAAe,EAAE,OAAO;IACtB,uBAAuB;IACvB,QAAQ;GACV,CAAC;EACH;CACF;CAIA,eAAe,CACb,EACE,mCAAmC;EACjC,aAAa;EACb,eAAe,EAAE,OAAO;GACtB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;GAC5B,eAAe,aAAa,SAAS;EACvC,CAAC;CACH,EACF,CACF;CACA,UAAU,CAAC,GAAG,OAAO,OAAO,wBAAwB,GAAG,iCAAiC;CAKxF,OAAO;EACL,yBAAyB;EACzB,yBAAyB;EACzB,yBAAyB;CAC3B;AACF,CAAC;;;ACrSD,MAAM,6BACJ;AAMF,MAAa,+BAA+B;AAE5C,MAAM,wCAAwC;CAC5C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;;;;AAOV,SAAS,+BAA+B,kBAA0B;CAChE,OAAO,YAAY,iBAAiB,QAAQ,sCAAsC;AACpF;AAEA,eAAsB,2BACpB,aACA,YACA,QACA,kBAC2B;CAC3B,OAAO;EACL,MAAM;EACN,SAAS;GACP,MAAM;GAIN,QAAQ;IACN,YAAY,CAAC,4CAA4C;IACzD,kBAAkB,+BAA+B,gBAAgB;GACnE;GACA,UAAU;IACR,QAAQ;IACR,YAAY;KACV;KACA,CAAC,OAAO,MAAM,gBAAgB,YAAY,MAAM,CAAC;KACjD;KACA;IACF;GACF;EACF;EACA,gBAAgB,2BAA2B,YAAY,KAAK,GAAG,YAAY;CAC7E;AACF;AAEA,eAAsB,mCACpB,OASA,QAC2B;CAC3B,OAAO;EACL,MAAM;EACN,SAAS;GACP,MAAM;GAIN,QAAQ,EACN,YAAY,gCAAgC,SAC9C;GACA,UAAU;IACR,QAAQ;IACR,YAAY;KACV;KACA,CAAC,OAAO,MAAM,wBAAwB,OAAO,MAAM,CAAC;KACpD;KACA;IACF;GACF;EACF;EAMA,gBAAgB;GACd;GACA,MAAM;GACN,MAAM;GACN,MAAM;GACN,UAAU,OAAO;GACjB;GACA,UAAU,MAAM;EAClB,CAAC,CAAC,KAAK,GAAG;CACZ;AACF;AAEA,eAAe,gBACb,YACA,QACmC;CACnC,OAAO,iBAAiB;EACtB,WAAW;EACX;EACA,kBAAkB,+BAA+B,MAAM,gBAAgB,UAAU;CACnF,CAAC;AACH;AAEA,eAAe,wBACb,OAMA,QACmC;CAOnC,OAAO,iBAAiB;EACtB,WAAW;EACX;EACA,kBAAkB,iBAAiB,MAAM,gBAT1B;GACf,MAAM;GACN,OAAO,MAAM,YAAY;GACzB,OAAO,MAAM,iBAAiB;GAC9B,MAAM;EACR,CAAC,CAAC,KAAK,IAI2D,CAAC;CACnE,CAAC;AACH;AAEA,SAAS,iBAAiB,OAIG;CAC3B,OAAO;EACL,MAAM;EACN,MAAM;EACN,WAAW,MAAM;EACjB,kBAAkB,MAAM;EACxB,QAAQ,EACN,cAAc;GACZ,YAAY;GACZ,OAAO;IACL,MAAM;IACN,UAAU;IACV,SAAS,CAAC,cAAc;GAC1B;GACA,QAAQ;GACR,gBAAgB,EACd,mCAAmC,kBAAkB,KAAK,UAAU,MAAM,MAAM,EAAE,GACpF;EACF,EACF;CACF;AACF;;;;;;AAOA,eAAe,gBAAgB,OAAe;CAC5C,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC;CACpF,OAAO,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAC5C,KAAK,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CACjD,KAAK,EAAE;AACZ"}

package/menubar/Iterate.entitlements

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!--
+  Used only when building with a real SIGN_IDENTITY (see build-menubar-app.sh).
+  Local UserNotifications need no special entitlement — this is the hardened-
+  runtime baseline, and the place to add keys (e.g. aps-environment for remote
+  push, or app-sandbox) if this ever ships through the App Store / notarization.
+-->
+<plist version="1.0">
+<dict>
+</dict>
+</plist>