looply-cli 0.5.7 → 0.5.9

package/dist/branch-delivery.js

@@ -0,0 +1,659 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_CHECKS_GRACE_MS = exports.CHECKS_PATIENCE_MS = exports.BRANCH_DELIVERIES_FILE = void 0;
+exports.nodeDeliveryGit = nodeDeliveryGit;
+exports.makeDeployPush = makeDeployPush;
+exports.fileDeliveryStore = fileDeliveryStore;
+exports.memoryDeliveryStore = memoryDeliveryStore;
+exports.findGoalBranch = findGoalBranch;
+exports.stackedOn = stackedOn;
+exports.pullTitle = pullTitle;
+exports.pullBody = pullBody;
+exports.deliverBranch = deliverBranch;
+exports.decideChecks = decideChecks;
+exports.advanceDeliveries = advanceDeliveries;
+exports.makeReleaseRunner = makeReleaseRunner;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const delivery_rules_1 = require("./delivery-rules");
+const git_driver_1 = require("./git-driver");
+const integrator_1 = require("./integrator");
+const run_base_1 = require("./run-base");
+function nodeDeliveryGit(cwd, configuredBase, rawExec = (0, git_driver_1.nodeGitExec)(cwd)) {
+    /**
+     * NO SIGN-IN WINDOW, EVER. The network verbs here (push, ls-remote) reach the
+     * person's credential helper — Git Credential Manager on Windows — which opens
+     * a sign-in dialog when its token has lapsed. A daemon has nobody to answer it
+     * and the owner must never see a window pop up; `GIT_TERMINAL_PROMPT=0` only
+     * covers the terminal. So every call says `credential.interactive=never`, and a
+     * lapsed credential is a failed push with git's own words instead.
+     */
+    const exec = (args) => rawExec(['-c', 'credential.interactive=never', ...args]);
+    const driver = new git_driver_1.GitDriver(exec);
+    const out = async (args) => exec(args);
+    return {
+        async remoteUrl() {
+            const r = await out(['remote', 'get-url', delivery_rules_1.DELIVERY_REMOTE]);
+            const url = r.stdout.trim();
+            return r.code === 0 && url !== '' ? url : null;
+        },
+        runBranches: () => driver.listBranches(integrator_1.RUN_BRANCH_PREFIX),
+        isAncestor: (a, b) => driver.isAncestor(a, b).catch(() => false),
+        async baseRef() {
+            const r = await (0, run_base_1.resolveBaseBranch)(driver, configuredBase).catch(() => null);
+            return r?.ref ?? null;
+        },
+        async inBase(sha, base) {
+            const name = (0, delivery_rules_1.shortBranch)(base);
+            for (const ref of [`refs/remotes/${delivery_rules_1.DELIVERY_REMOTE}/${name}`, base]) {
+                if ((await driver.refExists(ref).catch(() => false)) && (await driver.isAncestor(sha, ref).catch(() => false)))
+                    return true;
+            }
+            return false;
+        },
+        async remoteSha(branch) {
+            return driver.remoteRef(delivery_rules_1.DELIVERY_REMOTE, `refs/heads/${branch}`);
+        },
+        async remoteRunBranches() {
+            const r = await out(['ls-remote', '--heads', delivery_rules_1.DELIVERY_REMOTE, `refs/heads/${integrator_1.RUN_BRANCH_PREFIX}*`]);
+            const names = new Set();
+            if (r.code !== 0)
+                return names;
+            for (const line of r.stdout.split(/\r?\n/)) {
+                const ref = line.trim().split(/\s+/)[1];
+                if (ref?.startsWith('refs/heads/'))
+                    names.add(ref.slice('refs/heads/'.length));
+            }
+            return names;
+        },
+        async push(argv) {
+            // 🔴 THE LAST LOOK, at the one place that runs it.
+            const unsafe = (0, delivery_rules_1.unsafePushArgv)(argv);
+            if (unsafe !== null)
+                return { ok: false, because: `refused before git ran: ${unsafe}` };
+            const r = await out([...argv]);
+            if (r.code === 0)
+                return { ok: true };
+            return { ok: false, because: (0, delivery_rules_1.redactUrl)(`${r.stderr}\n${r.stdout}`.trim()).slice(0, 400) || `git push exited ${r.code}` };
+        },
+    };
+}
+/**
+ * THE `push` DEPLOY: the merged commit to the configured remote's branch.
+ *
+ * Fetches origin's base branch first so the merge commit is here, and refuses
+ * unless that commit IS on origin's base — only merged work is ever deployed.
+ * The argv is checked against the configured remote and branch just before git
+ * runs (`unsafeDeployPushArgv`): never forced, never another remote, never a delete.
+ */
+function makeDeployPush(cwd, rawExec = (0, git_driver_1.nodeGitExec)(cwd)) {
+    const exec = (args) => rawExec(['-c', 'credential.interactive=never', ...args]);
+    return async (remote, branch, sha, base) => {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(base) || base.includes('..'))
+            return { ok: false, because: `"${base}" is not a base branch name` };
+        const url = await exec(['remote', 'get-url', remote]);
+        if (url.code !== 0 || url.stdout.trim() === '')
+            return { ok: false, because: `this repository has no remote named ${remote}` };
+        const fetched = await exec(['fetch', '--quiet', delivery_rules_1.DELIVERY_REMOTE, base]);
+        if (fetched.code !== 0)
+            return { ok: false, because: `could not fetch origin ${base}: ${(0, delivery_rules_1.redactUrl)(fetched.stderr.trim()).slice(0, 300)}` };
+        const onBase = await exec(['merge-base', '--is-ancestor', sha, `refs/remotes/${delivery_rules_1.DELIVERY_REMOTE}/${base}`]);
+        if (onBase.code !== 0)
+            return { ok: false, because: `${sha.slice(0, 12)} is not on origin's ${base}; only merged work is deployed` };
+        const argv = (0, delivery_rules_1.deployPushArgv)(remote, branch, sha);
+        const unsafe = (0, delivery_rules_1.unsafeDeployPushArgv)(argv, { remote, branch });
+        if (unsafe !== null)
+            return { ok: false, because: `refused before git ran: ${unsafe}` };
+        const r = await exec(argv);
+        if (r.code === 0)
+            return { ok: true };
+        return { ok: false, because: (0, delivery_rules_1.redactUrl)(`${r.stderr}
+${r.stdout}`.trim()).slice(0, 400) || `git push exited ${r.code}` };
+    };
+}
+/* ────────────────────────────────────────────────────────────── store ── */
+exports.BRANCH_DELIVERIES_FILE = 'branch-deliveries.json';
+function fileDeliveryStore(stateDir) {
+    const path = (0, node_path_1.join)(stateDir, exports.BRANCH_DELIVERIES_FILE);
+    const read = () => {
+        try {
+            const raw = JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+            return raw.entries && typeof raw.entries === 'object' ? raw.entries : {};
+        }
+        catch {
+            return {};
+        }
+    };
+    return {
+        get: (goalId) => read()[goalId] ?? null,
+        all: () => Object.values(read()),
+        put(entry) {
+            const entries = read();
+            entries[entry.goalId] = entry;
+            (0, node_fs_1.mkdirSync)(stateDir, { recursive: true });
+            const tmp = `${path}.${process.pid}.tmp`;
+            (0, node_fs_1.writeFileSync)(tmp, `${JSON.stringify({ schema: 1, entries }, null, 2)}\n`, 'utf8');
+            (0, node_fs_1.renameSync)(tmp, path);
+        },
+    };
+}
+function memoryDeliveryStore() {
+    const m = new Map();
+    return { get: (g) => m.get(g) ?? null, all: () => [...m.values()], put: (e) => void m.set(e.goalId, { ...e }) };
+}
+/* ─────────────────────────────────────────────────────── which branch ── */
+/**
+ * The goal's own run branch that holds `sha`, or null.
+ *
+ * In order: the lane-claims DELIVERY record for this goal at this sha (the run
+ * that delivered wrote it on the branch it cut); the branch named for the run id
+ * (`looply/run-<stamp>-<last 8 of the id>`); the newest run branch whose tip IS
+ * the sha. Whatever is chosen must exist and contain the sha.
+ */
+async function findGoalBranch(git, input, branches) {
+    const byName = new Map(branches.map((b) => [b.name, b]));
+    const holds = async (b) => b !== undefined && (b.sha === input.sha || (await git.isAncestor(input.sha, b.sha)));
+    const mine = input.claims.filter((r) => r.goalId === input.goalId);
+    const delivered = mine.filter((r) => r.kind === 'delivery' && r.commitSha === input.sha);
+    for (const r of [...delivered].reverse())
+        if (await holds(byName.get(r.branch)))
+            return byName.get(r.branch);
+    if (input.runId !== null && input.runId.length >= 8) {
+        const suffix = `-${input.runId.slice(-8)}`;
+        const named = branches.find((b) => b.name.endsWith(suffix));
+        if (await holds(named))
+            return named;
+    }
+    const atTip = branches.filter((b) => b.sha === input.sha).sort((a, b) => b.name.localeCompare(a.name));
+    if (atTip[0] !== undefined)
+        return atTip[0];
+    for (const r of [...mine].reverse())
+        if (await holds(byName.get(r.branch)))
+            return byName.get(r.branch);
+    return null;
+}
+/** Which goal a run branch belongs to, from the lane claims; undefined when nothing says. */
+function goalOfBranch(claims, branch) {
+    for (let i = claims.length - 1; i >= 0; i--)
+        if (claims[i].branch === branch)
+            return claims[i].goalId;
+    return undefined;
+}
+/**
+ * THE OTHER, UNMERGED GOAL'S BRANCH THIS ONE IS BUILT ON — or null.
+ *
+ * A candidate is another `looply/run-*` branch whose tip this branch contains and
+ * the base does not, and which is ANOTHER goal's work: the lane claims name a
+ * different goal, or it is on origin (only a delivered goal's branch is pushed).
+ * A branch of this goal's own earlier runs is not a dependency — it is this
+ * goal's own history. The nearest candidate wins: the one no other contains.
+ */
+async function stackedOn(git, input) {
+    const candidates = [];
+    for (const b of input.branches) {
+        if (b.name === input.branch || b.sha === input.tip)
+            continue;
+        const owner = goalOfBranch(input.claims, b.name);
+        if (owner === input.goalId)
+            continue;
+        if (owner === undefined && !input.onOrigin.has(b.name))
+            continue;
+        if (!(await git.isAncestor(b.sha, input.tip)))
+            continue;
+        if (input.base !== null && (await git.inBase(b.sha, input.base)))
+            continue;
+        candidates.push(b);
+    }
+    const nearest = [];
+    for (const c of candidates) {
+        let inner = false;
+        for (const d of candidates) {
+            if (d !== c && d.sha !== c.sha && (await git.isAncestor(c.sha, d.sha))) {
+                inner = true;
+                break;
+            }
+        }
+        if (!inner)
+            nearest.push(c);
+    }
+    // Prefer one origin has (a pull request can target it), then the newest.
+    nearest.sort((a, b) => Number(input.onOrigin.has(b.name)) - Number(input.onOrigin.has(a.name)) || b.name.localeCompare(a.name));
+    const pick = nearest[0];
+    if (pick === undefined)
+        return null;
+    return { branch: pick.name, onOrigin: input.onOrigin.has(pick.name), goalId: goalOfBranch(input.claims, pick.name) };
+}
+function reportOf(e) {
+    return {
+        state: e.state,
+        branch: e.branch,
+        base: e.base,
+        pullRequestUrl: e.pullRequestUrl,
+        mode: e.mode,
+        note: e.note,
+        dependsOn: e.dependsOn,
+        mergeSha: e.mergeSha ?? null,
+        deploy: e.deploy ?? null,
+    };
+}
+async function save(deps, e) {
+    deps.store.put(e);
+    const report = reportOf(e);
+    try {
+        await deps.record(e.goalId, report);
+    }
+    catch (err) {
+        deps.log(`deliver : could not record ${e.goalId}'s delivery on the server (${err.message})`);
+    }
+    return report;
+}
+function pullTitle(goalText) {
+    const first = goalText.split(/\r?\n/).map((l) => l.trim()).find((l) => l !== '') ?? 'finished goal';
+    const clipped = first.length > 72 ? `${first.slice(0, 71).trimEnd()}…` : first;
+    return `Looply: ${clipped}`;
+}
+function pullBody(input) {
+    const quoted = input.goalText.trim().slice(0, 3000).split(/\r?\n/).map((l) => `> ${l}`).join('\n');
+    const checks = Object.entries(input.checks ?? {}).map(([k, v]) => `${k} ${v}`).join(', ');
+    const lines = [
+        'Looply finished this goal and opened this pull request for review.',
+        '',
+        quoted,
+        '',
+        `- Branch: \`${input.branch}\` at ${input.sha.slice(0, 12)}`,
+        ...(checks === '' ? [] : [`- Checks Looply ran before keeping the work: ${checks}`]),
+        `- Goal: ${input.goalId}`,
+        `- Delivery: \`${input.mode}\` — ${input.mode === 'pr'
+            ? 'a person reviews and merges.'
+            : input.mode === 'merge'
+                ? 'Looply merges this once the required CI checks are green.'
+                : "Looply merges this once the required CI checks are green, then runs the project's declared release step."}`,
+    ];
+    if (input.stacked !== null) {
+        lines.push('');
+        if (input.stacked.onOrigin) {
+            const ref = input.stackedPull ? `#${input.stackedPull.number} (\`${input.stacked.branch}\`)` : `\`${input.stacked.branch}\``;
+            lines.push(`⚠️ This builds on ${ref}${input.stacked.goalId ? ` — goal ${input.stacked.goalId}` : ''}, which is not merged yet. Merge that first; this pull request targets it so its diff shows only this goal's work.`);
+        }
+        else {
+            lines.push(`⚠️ This builds on \`${input.stacked.branch}\`${input.stacked.goalId ? ` (goal ${input.stacked.goalId})` : ''}, which is not merged and not on GitHub, so this pull request also contains that branch's commits. Review or merge that work first.`);
+        }
+    }
+    return lines.join('\n');
+}
+/**
+ * Push a satisfied goal's branch and open its pull request. Idempotent: a goal
+ * already delivered at this sha is re-recorded, not pushed again; an existing
+ * pull request for the branch is found, not duplicated. Never throws.
+ */
+async function deliverBranch(deps, input) {
+    if (input.mode === 'off')
+        return null;
+    try {
+        return await deliverOnce(deps, input);
+    }
+    catch (e) {
+        deps.log(`deliver : ${input.goalId}: ${e.message}`);
+        return null;
+    }
+}
+async function deliverOnce(deps, input) {
+    const at = new Date(deps.now()).toISOString();
+    const prior = deps.store.get(input.goalId);
+    const blank = (branch) => ({
+        goalId: input.goalId,
+        goalText: input.goalText,
+        branch,
+        sha: input.sha,
+        owner: null,
+        repo: null,
+        pullNumber: null,
+        pullRequestUrl: null,
+        base: null,
+        projectBase: null,
+        mode: input.mode,
+        state: 'not-pushed',
+        note: null,
+        dependsOn: null,
+        openedAt: at,
+        updatedAt: at,
+    });
+    const notPushed = (branch, note) => {
+        deps.log(`deliver : ${input.goalId}: not pushed — ${note}`);
+        return save(deps, { ...blank(branch), note });
+    };
+    const branches = await deps.git.runBranches();
+    const found = input.branch !== undefined
+        ? (branches.find((b) => b.name === input.branch) ?? null)
+        : await findGoalBranch(deps.git, input, branches);
+    if (found === null) {
+        return notPushed(input.branch ?? '', input.branch !== undefined
+            ? `there is no local branch ${input.branch} (only ${integrator_1.RUN_BRANCH_PREFIX}* branches are delivered)`
+            : `no ${integrator_1.RUN_BRANCH_PREFIX}* branch on this machine holds commit ${input.sha.slice(0, 12)}`);
+    }
+    const branch = found.name;
+    const tip = found.sha;
+    // Already done at this tip: say it again (the server may have missed it), do nothing else.
+    if (prior !== null && prior.branch === branch && prior.sha === tip && prior.pullRequestUrl !== null) {
+        return save(deps, { ...prior, updatedAt: at });
+    }
+    const remoteUrl = await deps.git.remoteUrl();
+    const base = await deps.git.baseRef();
+    const gh = remoteUrl === null ? null : (0, delivery_rules_1.githubRepoOf)(remoteUrl);
+    const client = gh === null ? null : await deps.github(gh.owner, gh.repo);
+    const api = client?.api ?? null;
+    // GitHub's own word on protection, when it will give it, joins the rules.
+    const protectedBranches = [...(input.protectedBranches ?? [])];
+    if (api !== null && (await api.branchProtected(branch)) === true)
+        protectedBranches.push(branch);
+    const refused = (0, delivery_rules_1.pushRefusal)({ remote: delivery_rules_1.DELIVERY_REMOTE, remoteUrl, branch, base, protectedBranches });
+    if (refused !== null)
+        return notPushed(branch, refused);
+    // Never forced: origin's copy must be absent, this tip, or something this tip contains.
+    const theirs = await deps.git.remoteSha(branch);
+    if (theirs !== null && theirs !== tip && !(await deps.git.isAncestor(theirs, tip))) {
+        return notPushed(branch, `origin already has ${branch} at ${theirs.slice(0, 12)}, which this branch does not contain; Looply never force-pushes`);
+    }
+    if (theirs !== tip) {
+        const pushed = await deps.git.push((0, delivery_rules_1.deliveryPushArgv)(branch, tip));
+        if (!pushed.ok)
+            return notPushed(branch, `git push to origin failed: ${pushed.because}`);
+        deps.log(`deliver : pushed ${branch} (${tip.slice(0, 12)}) to origin`);
+    }
+    const onOrigin = await deps.git.remoteRunBranches().catch(() => new Set());
+    onOrigin.add(branch);
+    const stack = await stackedOn(deps.git, { branch, tip, goalId: input.goalId, base, claims: input.claims, branches, onOrigin });
+    const projectBase = base === null ? null : (0, delivery_rules_1.shortBranch)(base);
+    const entry = {
+        ...blank(branch),
+        sha: tip,
+        owner: gh?.owner ?? null,
+        repo: gh?.repo ?? null,
+        projectBase,
+        dependsOn: stack?.branch ?? null,
+        state: 'pushed',
+    };
+    if (gh === null) {
+        return save(deps, { ...entry, note: `pushed to origin (${remoteUrl === null ? 'no URL' : (0, delivery_rules_1.redactUrl)(remoteUrl)}); origin is not on github.com, so no pull request was opened` });
+    }
+    if (api === null) {
+        const because = client !== null && client.api === null ? client.because : 'no GitHub credentials';
+        return save(deps, { ...entry, note: `pushed ${branch} to origin, but no pull request could be opened: ${because}` });
+    }
+    /**
+     * A FIX-UP: this goal depends on the goal it stacks on, and that goal's pull request
+     * failed its checks (AutoRyn sent the failure back to Looply). This branch holds that
+     * work plus the fix, so it goes straight to the base and REPLACES the red one.
+     */
+    const repairs = stack !== null && stack.goalId !== undefined && (input.dependsOn ?? []).includes(stack.goalId)
+        ? deps.store.get(stack.goalId)
+        : null;
+    const replacing = repairs !== null && repairs.pullNumber !== null && repairs.state === 'checks-failed' ? repairs : null;
+    const prBase = replacing === null && stack !== null && stack.onOrigin ? stack.branch : projectBase;
+    if (prBase === null) {
+        return save(deps, { ...entry, note: `pushed ${branch} to origin, but no pull request was opened: the project's base branch could not be found (set run.base_branch)` });
+    }
+    let pull = await api.findPull(branch);
+    if (pull === null || (pull.state === 'closed' && !pull.merged)) {
+        const stackedPull = stack !== null && stack.onOrigin ? await api.findPull(stack.branch).catch(() => null) : null;
+        try {
+            pull = await api.createPull({
+                title: pullTitle(input.goalText),
+                head: branch,
+                base: prBase,
+                body: pullBody({ goalId: input.goalId, goalText: input.goalText, branch, sha: tip, ...(input.checks ? { checks: input.checks } : {}), mode: input.mode, stacked: stack, stackedPull }),
+            });
+            deps.log(`deliver : opened ${pull.url} (${branch} → ${prBase})`);
+            if (replacing !== null) {
+                await api.closePull(replacing.pullNumber, `Replaced by ${pull.url}, which contains this work and its fix.`).catch(() => undefined);
+                await save(deps, { ...replacing, done: true, note: `replaced by ${pull.url}`, updatedAt: at });
+            }
+        }
+        catch (e) {
+            return save(deps, { ...entry, note: `pushed ${branch} to origin, but GitHub refused the pull request: ${e.message}` });
+        }
+    }
+    const state = pull.merged ? 'merged' : input.mode === 'pr' ? 'pr-open' : 'waiting-checks';
+    const note = stack === null
+        ? null
+        : replacing !== null
+            ? `replaces ${replacing.pullRequestUrl} (its checks failed); contains that work and the fix`
+            : stack.onOrigin
+                ? `builds on ${stack.branch}, which is not merged yet; the pull request targets it`
+                : `builds on ${stack.branch}${stack.goalId ? ` (goal ${stack.goalId})` : ''}, which is not merged or pushed; the pull request also contains its commits`;
+    return save(deps, {
+        ...entry,
+        pullNumber: pull.number,
+        pullRequestUrl: pull.url,
+        base: pull.base || prBase,
+        state,
+        note,
+    });
+}
+/* ─────────────────────────────────────────────── merge, then deploy ── */
+/** How long `merge` waits for checks before handing the pull request to a person. */
+exports.CHECKS_PATIENCE_MS = 24 * 60 * 60_000;
+/** How long a pull request with NO checks at all is given for CI to show up. */
+exports.NO_CHECKS_GRACE_MS = 15 * 60_000;
+/**
+ * ARE THE REQUIRED CHECKS GREEN?
+ *
+ * When the base branch's protection names required checks, each must report
+ * success. When it names none, or cannot be read, EVERY check on the head must be
+ * green — and there must be at least one: a pull request with no CI at all is
+ * never merged automatically, because "nothing failed" is not "it passed".
+ */
+function decideChecks(required, checks) {
+    const failed = checks.filter((c) => c.state === 'failure').map((c) => c.name);
+    if (required !== null && required.length > 0) {
+        const byName = new Map(checks.map((c) => [c.name, c.state]));
+        const redRequired = required.filter((n) => byName.get(n) === 'failure');
+        if (redRequired.length > 0)
+            return { kind: 'red', failed: redRequired };
+        const waiting = required.filter((n) => byName.get(n) !== 'success');
+        return waiting.length > 0 ? { kind: 'pending', waiting } : { kind: 'green' };
+    }
+    if (checks.length === 0)
+        return { kind: 'none' };
+    if (failed.length > 0)
+        return { kind: 'red', failed };
+    const waiting = checks.filter((c) => c.state === 'pending').map((c) => c.name);
+    return waiting.length > 0 ? { kind: 'pending', waiting } : { kind: 'green' };
+}
+/** States a pass may move on. `pr-open` and `checks-failed` move only on a person's approval. */
+const ADVANCING = ['waiting-checks', 'merged', 'pr-open', 'checks-failed'];
+const APPROVABLE = ['pr-open', 'waiting-checks', 'checks-failed'];
+/**
+ * One pass over every delivered pull request still waiting on Looply:
+ *
+ *   - a person's "Approve and ship" turns an open pull request into one Looply merges;
+ *   - a pull request Looply merges (`merge`/`deploy`, or approved) is merged at the head it
+ *     checked, only on green required checks — an approved one also when there is no CI at all,
+ *     a red one never;
+ *   - a merged one is deployed by the project's configured deploy step (`deploy`, or approved).
+ *
+ * Each step is recorded on the goal, which is what puts an audit line on the ticket. Never throws.
+ */
+async function advanceDeliveries(deps) {
+    for (const e of deps.store.all()) {
+        if (e.done === true || !ADVANCING.includes(e.state))
+            continue;
+        try {
+            await advanceOne(deps, e);
+        }
+        catch (err) {
+            deps.log(`deliver : ${e.goalId}: ${err.message}`);
+        }
+    }
+}
+async function advanceOne(deps, e) {
+    const now = deps.now();
+    const at = new Date(now).toISOString();
+    const mode = deps.mode();
+    // A person's approval, read from the goal mirror.
+    if (!e.approvedAt && APPROVABLE.includes(e.state) && e.pullNumber !== null) {
+        const approved = deps.shipRequested(e.goalId);
+        if (approved !== null) {
+            e = { ...e, approvedAt: approved, state: 'waiting-checks', note: 'approved to ship by a person; merging once the checks allow', updatedAt: at };
+            await save(deps, e);
+        }
+    }
+    const approved = !!e.approvedAt;
+    const wantsMerge = approved || mode === 'merge' || mode === 'deploy';
+    const wantsDeploy = approved || mode === 'deploy';
+    if (e.state === 'pr-open' || e.state === 'checks-failed')
+        return;
+    if (e.state === 'waiting-checks' && !wantsMerge) {
+        await save(deps, { ...e, mode, state: 'pr-open', note: `delivery is now "${mode}", so Looply will not merge it; a person merges`, updatedAt: at });
+        return;
+    }
+    if (e.state === 'merged' && (!wantsDeploy || e.deploy))
+        return;
+    if (e.owner === null || e.repo === null || e.pullNumber === null)
+        return;
+    const client = await deps.github(e.owner, e.repo);
+    if (client.api === null)
+        return; // no credentials right now: try again next pass
+    const api = client.api;
+    if (e.state === 'waiting-checks') {
+        const pull = await api.getPull(e.pullNumber);
+        if (pull.merged) {
+            e = { ...e, state: 'merged', note: 'merged by a person', updatedAt: at };
+            await save(deps, e);
+        }
+        else if (pull.state === 'closed') {
+            await save(deps, { ...e, state: 'pr-open', done: true, note: 'the pull request was closed without merging; Looply leaves it', updatedAt: at });
+            return;
+        }
+        else {
+            // Stacked: it may merge only into the base branch, once what it builds on has merged there.
+            if (e.projectBase !== null && pull.base !== e.projectBase) {
+                const dep = await api.findPull(pull.base).catch(() => null);
+                const depGone = !(await api.branchExists(pull.base).catch(() => true));
+                if ((dep !== null && dep.merged) || depGone) {
+                    await api.setBase(pull.number, e.projectBase);
+                    await save(deps, { ...e, base: e.projectBase, note: `${pull.base} merged; retargeted to ${e.projectBase}`, updatedAt: at });
+                }
+                else if (e.note === null || !e.note.startsWith('waiting for')) {
+                    await save(deps, { ...e, note: `waiting for ${pull.base} to merge first`, updatedAt: at });
+                }
+                return;
+            }
+            const verdict = decideChecks(await api.requiredChecks(pull.base), await api.checksFor(pull.headSha));
+            const age = now - Date.parse(e.approvedAt ?? e.openedAt);
+            if (verdict.kind === 'red') {
+                await save(deps, { ...e, state: 'checks-failed', note: `not merged: ${verdict.failed.join(', ')} failed`, updatedAt: at });
+                return;
+            }
+            // No CI at all: an automatic merge waits a little, then hands it to a person; a person's approval is the check.
+            if (verdict.kind === 'none' && !approved) {
+                if (age < exports.NO_CHECKS_GRACE_MS)
+                    return;
+                await save(deps, { ...e, state: 'pr-open', note: 'not merged: no CI checks report on this pull request, so a person merges it', updatedAt: at });
+                return;
+            }
+            if (verdict.kind === 'pending') {
+                if (age > exports.CHECKS_PATIENCE_MS) {
+                    await save(deps, { ...e, state: 'pr-open', note: `not merged: still waiting for ${verdict.waiting.join(', ')} after a day; a person merges`, updatedAt: at });
+                }
+                return;
+            }
+            const merged = await api.merge(pull.number, pull.headSha, pullTitle(e.goalText));
+            if (!merged.merged) {
+                await save(deps, { ...e, state: 'checks-failed', note: `checks allow it but GitHub would not merge: ${merged.message}`, updatedAt: at });
+                return;
+            }
+            deps.log(`deliver : merged ${e.pullRequestUrl} into ${pull.base}`);
+            e = { ...e, state: 'merged', mergeSha: merged.sha ?? null, note: null, updatedAt: at };
+            await save(deps, e);
+        }
+    }
+    if (e.state !== 'merged' || !wantsDeploy || e.deploy)
+        return;
+    await save(deps, await deployMerged(deps, e, mode));
+}
+/** Run the configured deploy step for a merged pull request, and say what happened. */
+async function deployMerged(deps, e, mode) {
+    const at = new Date(deps.now()).toISOString();
+    const base = e.projectBase ?? '';
+    // Absent: under `deploy` with a declared release step, run it (the setting before deploy kinds existed).
+    const cfg = deps.deploy() ?? (mode === 'deploy' && deps.release() !== null ? { kind: 'run' } : { kind: 'none' });
+    const done = (ok, detail, state) => ({
+        ...e,
+        state,
+        done: true,
+        deploy: { kind: cfg.kind, ok, detail: detail.slice(0, 600) },
+        note: ok ? null : detail.slice(0, 600),
+        updatedAt: at,
+    });
+    if (cfg.kind === 'none')
+        return done(true, 'merged; nothing is configured to deploy', 'merged');
+    if (cfg.kind === 'merge-deploys')
+        return done(true, `merged into ${base}, which deploys it${e.mergeSha ? ` (${e.mergeSha.slice(0, 12)})` : ''}`, 'deployed');
+    if (cfg.kind === 'push') {
+        if (!e.mergeSha)
+            return done(false, 'merged, but GitHub did not say which commit the merge made, so nothing was pushed to deploy', 'deploy-failed');
+        deps.log(`deliver : deploying ${e.mergeSha.slice(0, 12)} to ${cfg.remote} ${cfg.branch}`);
+        const r = await deps.deployPush(cfg.remote, cfg.branch, e.mergeSha, base);
+        return r.ok
+            ? done(true, `pushed ${e.mergeSha.slice(0, 12)} to ${cfg.branch} on ${cfg.remote}`, 'deployed')
+            : done(false, `pushing to ${cfg.remote} ${cfg.branch} failed: ${r.because}`, 'deploy-failed');
+    }
+    const command = deps.release();
+    if (command === null)
+        return done(false, 'merged; not deployed — no release step is declared (deliver.release in .looply/config.yaml)', 'deploy-failed');
+    deps.log(`deliver : running the declared release step for ${e.goalId}`);
+    const r = await deps.runRelease(command, {
+        LOOPLY_GOAL_ID: e.goalId,
+        LOOPLY_BRANCH: e.branch,
+        LOOPLY_BASE_BRANCH: base,
+        LOOPLY_MERGED_SHA: e.mergeSha ?? '',
+        LOOPLY_PULL_REQUEST_URL: e.pullRequestUrl ?? '',
+    });
+    return r.code === 0
+        ? done(true, 'the declared release step finished', 'deployed')
+        : done(false, `the release step exited ${r.code}: ${r.tail.slice(-300)}`, 'deploy-failed');
+}
+/**
+ * Run the project's declared release step in the project folder, hidden, bounded
+ * to 30 minutes, its output appended to `.looply/state/run-logs/release.log`.
+ */
+function makeReleaseRunner(projectDir, stateDir) {
+    return (command, env) => new Promise((resolve) => {
+        const logDir = (0, node_path_1.join)(stateDir, 'run-logs');
+        const logPath = (0, node_path_1.join)(logDir, 'release.log');
+        const lines = [];
+        const note = (s) => {
+            lines.push(s);
+            try {
+                (0, node_fs_1.mkdirSync)(logDir, { recursive: true });
+                (0, node_fs_1.appendFileSync)(logPath, s, 'utf8');
+            }
+            catch {
+                /* the log is a convenience */
+            }
+        };
+        note(`\n=== ${new Date().toISOString()} ${command}\n`);
+        let child;
+        try {
+            child = (0, node_child_process_1.spawn)(command, { cwd: projectDir, shell: true, env: { ...process.env, ...env }, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+        }
+        catch (e) {
+            resolve({ code: -1, tail: e.message });
+            return;
+        }
+        const timer = setTimeout(() => child.kill(), 30 * 60_000);
+        child.stdout?.on('data', (d) => note(d.toString('utf8')));
+        child.stderr?.on('data', (d) => note(d.toString('utf8')));
+        child.on('error', (e) => {
+            clearTimeout(timer);
+            resolve({ code: -1, tail: e.message });
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            resolve({ code: code ?? -1, tail: lines.join('').slice(-2000) });
+        });
+    });
+}
+//# sourceMappingURL=branch-delivery.js.map