oh-my-super-agent 0.1.0

package/dist/src/github/dispatch-eligibility.js

@@ -0,0 +1,94 @@
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { readLiveDeliveryAuthorization } from "../live/contact-journal.js";
+import { createStableId } from "../runtime/stable-id.js";
+import { isRecord, readJsonFileNoFollow } from "../utils/fs.js";
+export function assertCurrentGithubDispatchEligibility(options) {
+    const prefix = "github:label=";
+    if (!options.queueScope.startsWith(prefix) || options.queueScope.length === prefix.length) {
+        throw new Error("dispatch goal queue scope is not a GitHub label scope");
+    }
+    const requiredLabel = options.queueScope.slice(prefix.length);
+    const content = options.content;
+    if (content.source !== "github"
+        || content.repository === null
+        || content.issue_node_id === null
+        || content.url === null
+        || !content.labels.includes(requiredLabel))
+        throw new Error("dispatch ticket is outside the goal queue scope");
+    const authorization = readLiveDeliveryAuthorization(options.stateRoot);
+    if (!authorization
+        || authorization.repository !== content.repository.toLowerCase()
+        || (options.conductorSessionId !== undefined
+            && authorization.conductor_session_id !== options.conductorSessionId))
+        throw new Error("dispatch ticket belongs to another authorized repository");
+    const sourceIdSha256 = sha256Text(content.issue_node_id);
+    const observationKey = createStableId("github-obs", content.repository, "issue", sourceIdSha256);
+    const candidates = options.outbox.listEvents().filter((event) => (event.event_kind === "github-observed" && event.source_id === observationKey));
+    if (candidates.length === 0)
+        throw new Error("dispatch lacks a current GitHub issue observation");
+    const highestGeneration = Math.max(...candidates.map((event) => event.source_version));
+    const generation = candidates.filter((event) => event.source_version === highestGeneration);
+    const latestObservedAt = generation.map((event) => event.occurred_at).sort().at(-1);
+    const latest = generation.filter((event) => event.occurred_at === latestObservedAt);
+    if (latest.length !== 1)
+        throw new Error("dispatch GitHub issue observation is ambiguous");
+    const event = latest[0];
+    const payload = event.payload;
+    if (payload.observation_key !== observationKey
+        || payload.observation_kind !== "issue"
+        || payload.repository !== content.repository
+        || payload.source_id_sha256 !== sourceIdSha256
+        || payload.presence_generation !== event.source_version
+        || payload.observed_at !== event.occurred_at
+        || payload.change !== "present"
+        || typeof payload.payload_sha256 !== "string"
+        || !/^[a-f0-9]{64}$/u.test(payload.payload_sha256)
+        || payload.snapshot_file !== `${payload.payload_sha256}.json`)
+        throw new Error("dispatch GitHub issue observation binding changed");
+    const snapshot = readJsonFileNoFollow(join(options.stateRoot, "github-snapshots", payload.snapshot_file), 1024 * 1024);
+    if (!isRecord(snapshot)
+        || sha256Canonical(snapshot) !== payload.payload_sha256
+        || payload.source_version_sha256 !== sha256Text(String(snapshot.updated_at))
+        || Object.keys(snapshot).sort().join("\0") !== [
+            "body",
+            "issue_node_id",
+            "labels",
+            "number",
+            "state",
+            "title",
+            "updated_at",
+            "url",
+        ].join("\0")
+        || !Number.isSafeInteger(snapshot.number)
+        || Number(snapshot.number) < 1
+        || snapshot.issue_node_id !== content.issue_node_id
+        || snapshot.state !== "OPEN"
+        || snapshot.title !== content.title
+        || snapshot.body !== content.body
+        || !Array.isArray(snapshot.labels)
+        || !isDeepStrictEqual(snapshot.labels, content.labels)
+        || !snapshot.labels.includes("oms:ready")
+        || !snapshot.labels.includes(requiredLabel)
+        || snapshot.url !== content.url
+        || snapshot.updated_at !== content.updated_at)
+        throw new Error("dispatch GitHub issue is no longer current and eligible");
+}
+function sha256Canonical(value) {
+    return createHash("sha256").update(canonicalJson(value), "utf8").digest("hex");
+}
+function sha256Text(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function canonicalJson(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (!isRecord(value))
+        throw new Error("GitHub dispatch eligibility contains a non-JSON value");
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}
+//# sourceMappingURL=dispatch-eligibility.js.map

package/dist/src/github/dispatch-eligibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-eligibility.js","sourceRoot":"","sources":["../../../src/github/dispatch-eligibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,MAAM,UAAU,sCAAsC,CAAC,OAMtD;IACC,MAAM,MAAM,GAAG,eAAe,CAAC;IAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IACE,OAAO,CAAC,MAAM,KAAK,QAAQ;WACxB,OAAO,CAAC,UAAU,KAAK,IAAI;WAC3B,OAAO,CAAC,aAAa,KAAK,IAAI;WAC9B,OAAO,CAAC,GAAG,KAAK,IAAI;WACpB,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAErE,MAAM,aAAa,GAAG,6BAA6B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE,IACE,CAAC,aAAa;WACX,aAAa,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;WAC7D,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;eACvC,aAAa,CAAC,oBAAoB,KAAK,OAAO,CAAC,kBAAkB,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAE9E,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IACjG,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC/D,KAAK,CAAC,UAAU,KAAK,iBAAiB,IAAI,KAAK,CAAC,SAAS,KAAK,cAAc,CAC7E,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAClG,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,iBAAiB,CAAC,CAAC;IAC5F,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,gBAAgB,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IACE,OAAO,CAAC,eAAe,KAAK,cAAc;WACvC,OAAO,CAAC,gBAAgB,KAAK,OAAO;WACpC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;WACzC,OAAO,CAAC,gBAAgB,KAAK,cAAc;WAC3C,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC,cAAc;WACpD,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;WACzC,OAAO,CAAC,MAAM,KAAK,SAAS;WAC5B,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;WAC1C,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;WAC/C,OAAO,CAAC,aAAa,KAAK,GAAG,OAAO,CAAC,cAAc,OAAO;QAC7D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,oBAAoB,CACnC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,EAClE,IAAI,GAAG,IAAI,CACZ,CAAC;IACF,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC;WAChB,eAAe,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,cAAc;WACpD,OAAO,CAAC,qBAAqB,KAAK,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;WACzE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAC7C,MAAM;YACN,eAAe;YACf,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,OAAO;YACP,YAAY;YACZ,KAAK;SACN,CAAC,IAAI,CAAC,IAAI,CAAC;WACT,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;WACtC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;WAC3B,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;WAChD,QAAQ,CAAC,KAAK,KAAK,MAAM;WACzB,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;WAChC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;WAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;WAC/B,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;WACnD,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;WACtC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;WACxC,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;WAC5B,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QAC7C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3G,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC/F,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACxH,CAAC"}

package/dist/src/github/projector.d.ts

@@ -0,0 +1,23 @@
+import { type ConductorNotificationStore } from "../conductor/notifications.js";
+import { type RuntimeEventBus } from "../events/bus.js";
+import { type OutboxProcessor } from "../outbox/processor.js";
+import { type OutboxStore } from "../outbox/store.js";
+import { type TicketMaterializer } from "../tickets/materializer.js";
+import type { GithubSyncBatch } from "./types.js";
+export declare const GITHUB_EVENT_PROJECTOR = "github-event-projector";
+export interface GithubProjectionResult {
+    readonly event_ids: readonly string[];
+    readonly notification_id: string | null;
+    readonly notification_ids: readonly string[];
+}
+export declare function projectGithubSyncBatch(options: {
+    batch: GithubSyncBatch;
+    processedAt: string;
+    packageRoot: string;
+    snapshotsRoot: string;
+    bus: RuntimeEventBus;
+    processor: OutboxProcessor;
+    outbox: OutboxStore;
+    notifications: ConductorNotificationStore;
+    ticketMaterializer?: TicketMaterializer;
+}): Promise<GithubProjectionResult>;

package/dist/src/github/projector.js

@@ -0,0 +1,181 @@
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { assertConductorNotificationStore, } from "../conductor/notifications.js";
+import { assertRuntimeEventBus } from "../events/bus.js";
+import { assertOutboxProcessor } from "../outbox/processor.js";
+import { assertOutboxStore } from "../outbox/store.js";
+import { canonicalTimestamp } from "../queue/model.js";
+import { assertSchema, loadJsonSchema } from "../runtime/schema.js";
+import { createStableId } from "../runtime/stable-id.js";
+import { assertTicketMaterializer } from "../tickets/materializer.js";
+import { deriveGitHubTicketIdentity } from "../tickets/store.js";
+import { lstatIfExists, readJsonFileNoFollow, validateExistingDirectory, writeJsonAtomicNoReplace, } from "../utils/fs.js";
+export const GITHUB_EVENT_PROJECTOR = "github-event-projector";
+const MAX_NOTIFICATION_EVENTS = 1_000;
+export async function projectGithubSyncBatch(options) {
+    assertRuntimeEventBus(options.bus);
+    assertOutboxProcessor(options.processor);
+    assertOutboxStore(options.outbox);
+    assertConductorNotificationStore(options.notifications);
+    if (options.ticketMaterializer !== undefined)
+        assertTicketMaterializer(options.ticketMaterializer);
+    const snapshotsRoot = validateExistingDirectory(options.snapshotsRoot, "GitHub snapshot root");
+    const processedAt = canonicalTimestamp(options.processedAt, "GitHub projection timestamp");
+    const observationSchema = loadJsonSchema(join(options.packageRoot, "schemas", "github-observation.schema.json"));
+    const eventIds = [];
+    const existingEvents = new Map();
+    for (const event of options.outbox.listEvents().filter((candidate) => candidate.event_kind === "github-observed")) {
+        const key = githubEventIdentity(event.source_id, event.source_version, event.dedupe_key);
+        if (existingEvents.has(key))
+            throw new Error("GitHub observation identity is ambiguous in the outbox");
+        existingEvents.set(key, event.event_id);
+    }
+    for (const observation of [...options.batch.observations]
+        .sort((left, right) => left.observation_key.localeCompare(right.observation_key))) {
+        assertSchema(observation, observationSchema, "GitHub observation before projection");
+        const snapshotFile = persistSnapshot(snapshotsRoot, observation);
+        const identity = {
+            sourceId: observation.observation_key,
+            sourceVersion: observation.presence_generation,
+            dedupeKey: createStableId("github-dedupe", observation.change, String(observation.presence_generation), observation.payload_sha256),
+            occurredAt: observation.observed_at,
+        };
+        const payload = {
+            observation_key: observation.observation_key,
+            observation_kind: observation.kind,
+            repository: observation.repository,
+            source_id_sha256: observation.source_id_sha256,
+            source_version_sha256: sha256(observation.source_version),
+            change: observation.change,
+            presence_generation: observation.presence_generation,
+            observed_at: observation.observed_at,
+            payload_sha256: observation.payload_sha256,
+            snapshot_file: snapshotFile,
+        };
+        const identityKey = githubEventIdentity(identity.sourceId, identity.sourceVersion, identity.dedupeKey);
+        const existingEventId = existingEvents.get(identityKey);
+        const published = existingEventId
+            ? { status: "replayed", event: options.bus.read(existingEventId, "github-observed") }
+            : options.bus.publish("github-observed", identity, payload);
+        existingEvents.set(identityKey, published.event.event_id);
+        for (const field of [
+            "observation_key",
+            "observation_kind",
+            "repository",
+            "source_id_sha256",
+            "source_version_sha256",
+            "change",
+            "presence_generation",
+            "payload_sha256",
+            "snapshot_file",
+        ]) {
+            if (published.event.payload[field] !== payload[field]) {
+                throw new Error(`GitHub observation replay changed ${field}`);
+            }
+        }
+        await options.processor.processOne({
+            eventId: published.event.event_id,
+            consumerId: GITHUB_EVENT_PROJECTOR,
+            processedAt,
+        }, () => {
+            assertStoredSnapshot(snapshotsRoot, published.event.payload.payload_sha256);
+            return {
+                action: "github-observation-projected",
+                observation_key: observation.observation_key,
+                observation_kind: observation.kind,
+                snapshot_file: snapshotFile,
+            };
+        });
+        materializeReadyIssue(observation, options.ticketMaterializer);
+        eventIds.push(published.event.event_id);
+    }
+    const notificationIds = [];
+    for (let index = 0; index < eventIds.length; index += MAX_NOTIFICATION_EVENTS) {
+        const notification = options.notifications.assignProjected({
+            eventIds: eventIds.slice(index, index + MAX_NOTIFICATION_EVENTS),
+            projectorId: GITHUB_EVENT_PROJECTOR,
+            createdAt: processedAt,
+        });
+        if (notification.record && !notificationIds.includes(notification.record.record_id)) {
+            notificationIds.push(notification.record.record_id);
+        }
+    }
+    return Object.freeze({
+        event_ids: Object.freeze(eventIds),
+        notification_id: notificationIds[0] ?? null,
+        notification_ids: Object.freeze(notificationIds),
+    });
+}
+function materializeReadyIssue(observation, materializer) {
+    if (!materializer || observation.kind !== "issue" || observation.change !== "present")
+        return undefined;
+    const snapshot = observation.snapshot;
+    if (snapshot.state !== "OPEN" || !Array.isArray(snapshot.labels) || !snapshot.labels.includes("oms:ready"))
+        return undefined;
+    if (typeof snapshot.issue_node_id !== "string"
+        || typeof snapshot.title !== "string"
+        || typeof snapshot.body !== "string"
+        || !snapshot.labels.every((label) => typeof label === "string")
+        || typeof snapshot.url !== "string"
+        || typeof snapshot.updated_at !== "string") {
+        throw new Error("ready GitHub issue snapshot is invalid");
+    }
+    const input = {
+        repository: observation.repository,
+        issue_node_id: snapshot.issue_node_id,
+        title: snapshot.title,
+        body: snapshot.body,
+        labels: [...snapshot.labels],
+        url: snapshot.url,
+        updated_at: snapshot.updated_at,
+    };
+    const ticketId = deriveGitHubTicketIdentity(input).ticket_id;
+    const existing = materializer.readIfExists(ticketId);
+    if (!existing || existing.state === "pending")
+        materializer.syncGitHub(input);
+    return ticketId;
+}
+function persistSnapshot(root, observation) {
+    const digest = sha256(canonicalJson(observation.snapshot));
+    if (digest !== observation.payload_sha256)
+        throw new Error("GitHub observation snapshot digest mismatch");
+    const fileName = `${digest}.json`;
+    const path = join(root, fileName);
+    const existing = lstatIfExists(path);
+    if (!existing) {
+        try {
+            writeJsonAtomicNoReplace(path, observation.snapshot);
+        }
+        catch (error) {
+            if (!lstatIfExists(path))
+                throw error;
+        }
+    }
+    assertStoredSnapshot(root, digest);
+    return fileName;
+}
+function assertStoredSnapshot(root, digest) {
+    if (!/^[a-f0-9]{64}$/u.test(digest))
+        throw new Error("invalid GitHub snapshot digest");
+    const value = readJsonFileNoFollow(join(root, `${digest}.json`), 1024 * 1024);
+    if (sha256(canonicalJson(value)) !== digest)
+        throw new Error("stored GitHub snapshot digest mismatch");
+}
+function canonicalJson(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (typeof value !== "object" || value === null)
+        throw new Error("GitHub snapshot is not JSON data");
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+}
+function sha256(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function githubEventIdentity(sourceId, sourceVersion, dedupeKey) {
+    return `${sourceId}\0${sourceVersion}\0${dedupeKey}`;
+}
+//# sourceMappingURL=projector.js.map

package/dist/src/github/projector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projector.js","sourceRoot":"","sources":["../../../src/github/projector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,gCAAgC,GAEjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAwB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAwB,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAoB,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAA2B,MAAM,4BAA4B,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAQ/D,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAU5C;IACC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,gCAAgC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS;QAAE,wBAAwB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnG,MAAM,aAAa,GAAG,yBAAyB,CAAC,OAAO,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;IAC/F,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;IAC3F,MAAM,iBAAiB,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACjH,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,iBAAiB,CAAC,EAAE,CAAC;QAClH,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzF,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACvG,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;SACtD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACpF,YAAY,CAAC,WAAW,EAAE,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,eAAe,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG;YACf,QAAQ,EAAE,WAAW,CAAC,eAAe;YACrC,aAAa,EAAE,WAAW,CAAC,mBAAmB;YAC9C,SAAS,EAAE,cAAc,CACvB,eAAe,EACf,WAAW,CAAC,MAAM,EAClB,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,EACvC,WAAW,CAAC,cAAc,CAC3B;YACD,UAAU,EAAE,WAAW,CAAC,WAAW;SAC3B,CAAC;QACX,MAAM,OAAO,GAAG;YACd,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,gBAAgB,EAAE,WAAW,CAAC,IAAI;YAClC,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,qBAAqB,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC;YACzD,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,aAAa,EAAE,YAAY;SACnB,CAAC;QACX,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvG,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,eAAe;YAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE;YAC9F,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9D,cAAc,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI;YAClB,iBAAiB;YACjB,kBAAkB;YAClB,YAAY;YACZ,kBAAkB;YAClB,uBAAuB;YACvB,QAAQ;YACR,qBAAqB;YACrB,gBAAgB;YAChB,eAAe;SACP,EAAE,CAAC;YACX,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;YACjC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ;YACjC,UAAU,EAAE,sBAAsB;YAClC,WAAW;SACZ,EAAE,GAAG,EAAE;YACN,oBAAoB,CAAC,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,cAAwB,CAAC,CAAC;YACtF,OAAO;gBACL,MAAM,EAAE,8BAA8B;gBACtC,eAAe,EAAE,WAAW,CAAC,eAAe;gBAC5C,gBAAgB,EAAE,WAAW,CAAC,IAAI;gBAClC,aAAa,EAAE,YAAY;aAC5B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,uBAAuB,EAAE,CAAC;QAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC;YACzD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,uBAAuB,CAAC;YAChE,WAAW,EAAE,sBAAsB;YACnC,SAAS,EAAE,WAAW;SACvB,CAAC,CAAC;QACH,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACpF,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;KACjD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAA8B,EAC9B,YAA4C;IAE5C,IAAI,CAAC,YAAY,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxG,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;IACtC,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7H,IACE,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ;WACvC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;WAClC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;WACjC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;WAC5D,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;WAChC,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC5B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;IACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;QAAE,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,WAA8B;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,WAAW,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC1G,MAAM,QAAQ,GAAG,GAAG,MAAM,OAAO,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC;YACH,wBAAwB,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAAE,MAAM,KAAK,CAAC;QACxC,CAAC;IACH,CAAC;IACD,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,MAAc;IACxD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3G,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1H,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,aAAqB,EAAE,SAAiB;IACrF,OAAO,GAAG,QAAQ,KAAK,aAAa,KAAK,SAAS,EAAE,CAAC;AACvD,CAAC"}

package/dist/src/github/review.d.ts

@@ -0,0 +1,39 @@
+import { type ProcessRunner } from "../providers/process.js";
+import { runSecretScan } from "../security/secret-scan.js";
+import type { ResultGateProgress } from "../verification/result-gate.js";
+import { createRuntimeWorkerAuthorities } from "../workers/runtime.js";
+export declare const OMS_REVIEW_REQUIRED_CHECK = "OMS deterministic verification";
+export type ReviewDeliveryState = "planned" | "push-pending" | "pushed" | "pr-pending" | "awaiting-check" | "ready" | "blocked";
+export interface ReviewProofReference {
+    readonly proof_id: string;
+    readonly sha256: string;
+    readonly file_name: string;
+}
+export interface ReviewDeliveryProgress {
+    readonly status: "working" | "waiting" | "ready" | "blocked";
+    readonly delivery_id: string;
+    readonly state: ReviewDeliveryState;
+    readonly ticket_id: string;
+    readonly branch: string;
+    readonly pull_request_number: number | null;
+    readonly proof: ReviewProofReference | null;
+    readonly reason: string | null;
+}
+export interface ReviewDeliveryService {
+    advance(dispatchId: string, result: ResultGateProgress): ReviewDeliveryProgress | null;
+}
+export type ReviewSecretScanner = (options: Parameters<typeof runSecretScan>[0]) => ReturnType<typeof runSecretScan>;
+type RuntimeAuthorities = ReturnType<typeof createRuntimeWorkerAuthorities>;
+export declare function createReviewDeliveryService(options: {
+    readonly packageRoot: string;
+    readonly configRoot?: string;
+    readonly workspaceRoot: string;
+    readonly stateRoot: string;
+    readonly requiredCheckName: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly clock?: () => string;
+    readonly runtime?: RuntimeAuthorities;
+    readonly runner?: ProcessRunner;
+    readonly secretScanner?: ReviewSecretScanner;
+}): ReviewDeliveryService;
+export {};