p-dev-harness 0.3.0 → 0.4.0

package/gui/.next/server/chunks/120.js

@@ -1,81 +0,0 @@
-"use strict";exports.id=120,exports.ids=[120],exports.modules={19965:(a,b,c)=>{c.d(b,{vb:()=>o,writeConfigLocal:()=>p});var d=c(51455),e=c(48161),f=c(76760),g=c.n(f),h=c(29281),i=c(12884),j=c(50615),k=c(84998);async function l(a){try{return await (0,d.access)(a),!0}catch{return!1}}async function m(a){let b=await (0,d.mkdtemp)(g().join((0,e.tmpdir)(),"harness-setup-config-")),c=g().join(b,"config.local.json");try{await (0,d.writeFile)(c,a,"utf8"),await (0,h.Z9)(c)}finally{await (0,d.rm)(b,{recursive:!0,force:!0})}}async function n(a){if(!await l(a.configExample))throw Error(`Missing source file: ${a.configExample}`);let b=await (0,d.readFile)(a.configExample,"utf8");return b.endsWith("\n")?b:`${b}
-`}async function o(a){let{paths:b,force:c=!1,mode:e="apply"}=a,f=k.bm,g=await l(b.configLocal);if(g&&!c)return{actionId:"scaffold-config-local",outcome:"skipped",targetPath:b.configLocal,permission:i.P.localFileWrite,reason:"already exists",logMessage:`skipped ${f} (already exists)`};let h=await n(b);return"dry-run"===e?{actionId:"scaffold-config-local",outcome:g?"wouldChange":"preview",targetPath:b.configLocal,content:h,permission:i.P.localFileWrite,reason:g?"would overwrite with --force":"would create",logMessage:g?`would overwrite ${f}`:`would create ${f}`}:(await (0,d.writeFile)(b.configLocal,h,"utf8"),{actionId:"scaffold-config-local",outcome:"changed",targetPath:b.configLocal,content:h,permission:i.P.localFileWrite,reason:g?"overwrote existing file":"created new file",logMessage:`${g?"overwrote":"created"} ${f}`})}async function p(a){let{paths:b,force:c=!1,mode:e="apply"}=a,f=k.bm,g=await l(b.configLocal);if(g&&!c)return{actionId:"write-config-local",outcome:"skipped",targetPath:b.configLocal,permission:i.P.localFileWrite,reason:"already exists",logMessage:`skipped ${f} (already exists)`};let h=function(a){if(a.content)return a.content.endsWith("\n")?a.content:`${a.content}
-`;if(a.input)return(0,j.rb)(a.input);throw Error("writeConfigLocal requires content or structured input")}(a);return(await m(h),"dry-run"===e)?{actionId:"write-config-local",outcome:g?"wouldChange":"preview",targetPath:b.configLocal,content:h,permission:i.P.localFileWrite,reason:g?"would overwrite with --force":"would create",logMessage:g?`would overwrite ${f}`:`would create ${f}`}:(await (0,d.writeFile)(b.configLocal,h,"utf8"),{actionId:"write-config-local",outcome:"changed",targetPath:b.configLocal,content:h,permission:i.P.localFileWrite,reason:g?"overwrote existing file":"created new file",logMessage:`${g?"overwrote":"created"} ${f}`})}},50615:(a,b,c)=>{c.d(b,{BR:()=>h,RB:()=>j,rb:()=>i});var d=c(96105),e=c(29281),f=c(71512);let g={eligibleStatuses:{planning:["Ready for Planning"],implementation:["Ready for Build"],handoff:["PR Open"],revision:["Needs Revision"],merge:["Ready to Merge"]},transitionalStatuses:{planningInProgress:"Planning",buildingInProgress:"Building",prOpen:"PR Open",pmReview:"PM Review",blocked:"Blocked",readyForBuild:"Ready for Build",needsRevision:"Needs Revision",revisingInProgress:"Revising",readyToMerge:"Ready to Merge",mergingInProgress:"Merging",mergedToDev:"Merged to Dev",mergedDeployed:"Merged / Deployed"}};function h(a){let b=a.modelId??f.Sk,c=[...new Set(a.repos.map(a=>a.targetRepo))],h=d.k.parse({version:1,agentProvider:{id:"cursor",model:{id:b}},defaultModel:{id:b},linear:{teamKey:a.linearTeamKey??"TEAM",...g},planning:{timeoutSeconds:1800},implementation:{timeoutSeconds:3600,branchPrefix:"cursor"},handoff:{allowPmReviewWithoutPreview:!0,previewRequiredForSuccess:!1},revision:{timeoutSeconds:3600},merge:{mergeMethod:"squash",deleteBranchAfterMerge:!1,allowPendingChecks:!1,allowUnknownChecks:!1,allowNeutralChecks:!0,deploymentRequiredForSuccess:!1,deploymentPollTimeoutSeconds:300,deploymentPollIntervalSeconds:15,checkPollTimeoutSeconds:120},preview:{pollTimeoutSeconds:300,pollIntervalSeconds:15},repos:a.repos.map(a=>({id:a.id,linearProjects:a.linearProjects,linearTeams:a.linearTeams,targetRepo:a.targetRepo,baseBranch:a.baseBranch??"dev",productionBranch:a.productionBranch??"main",previewProvider:a.previewProvider??"vercel",integrationPreviewUrl:a.integrationPreviewUrl,productionUrl:a.productionUrl,integrationSuccessStatus:a.integrationSuccessStatus??"Merged to Dev",productionSuccessStatus:a.productionSuccessStatus??"Merged / Deployed",validation:a.validationCommands?{commands:a.validationCommands}:{commands:["npm run lint","npm run build"]}})),allowedTargetRepos:c});return(0,e.g1)(h),h}function i(a){var b;return b=h(a),`${JSON.stringify(b,null,2)}
-`}function j(){return h({repos:[{id:"target-app",linearProjects:["Example Target App"],targetRepo:"https://github.com/owner/example-target-app",baseBranch:"dev",productionBranch:"main",previewProvider:"vercel",integrationSuccessStatus:"Merged to Dev",productionSuccessStatus:"Merged / Deployed",productionUrl:"https://www.example.com",integrationPreviewUrl:"https://staging.example.com",validationCommands:["npm run lint","npm run build"]}]})}},60120:(a,b,c)=>{c.d(b,{pA:()=>dX,ix:()=>dT,kd:()=>dy,$X:()=>dK,R6:()=>dw,n3:()=>dA,R7:()=>dO,BP:()=>dB,g1:()=>dR,VP:()=>dG,xQ:()=>dH,Ig:()=>dV,W8:()=>dt,CP:()=>du,al:()=>ds,XV:()=>dL,F$:()=>dM,bT:()=>dI,oO:()=>dP,b1:()=>dW,K7:()=>dS,A5:()=>dx,LV:()=>dJ,HV:()=>dv,j3:()=>dz,hp:()=>dN,u4:()=>dU});var d=c(77598),e=c(83954),f=c(51455),g=c(12884),h=c(87285),i=c(19965),j=c(57362),k=c(84998);async function l(a){try{return await (0,f.access)(a),!0}catch{return!1}}function m(a,b=[]){return(0,j.qs)(a,b)}async function n(a){if(!await l(a.envExample))throw Error(`Missing source file: ${a.envExample}`);return(0,f.readFile)(a.envExample,"utf8")}async function o(a){let{paths:b,force:c=!1,mode:d="apply"}=a,e=k.gr,h=await l(b.envLocal);if(h&&!c)return m({actionId:"scaffold-env-local",outcome:"skipped",targetPath:b.envLocal,permission:g.P.localFileWrite,reason:"already exists",logMessage:`skipped ${e} (already exists)`});let i=await n(b);return"dry-run"===d?m({actionId:"scaffold-env-local",outcome:h?"wouldChange":"preview",targetPath:b.envLocal,content:i,permission:g.P.localFileWrite,reason:h?"would overwrite with --force":"would create",logMessage:h?`would overwrite ${e}`:`would create ${e}`}):(await (0,f.copyFile)(b.envExample,b.envLocal),m({actionId:"scaffold-env-local",outcome:"changed",targetPath:b.envLocal,content:i,permission:g.P.localFileWrite,reason:h?"overwrote existing file":"created new file",logMessage:`${h?"overwrote":"created"} ${e}`}))}async function p(a){let{paths:b,force:c=!1,mode:d="apply"}=a,e=k.gr,h=await l(b.envLocal),i=(0,j.B8)(a.input);if(h&&!c)return m({actionId:"write-env-local",outcome:"skipped",targetPath:b.envLocal,permission:g.P.localFileWrite,reason:"already exists",logMessage:`skipped ${e} (already exists)`});let n=a.content??function(a){let b=a?.harnessConfigPath??k.it,c=a?.linearApiKey??"",d=a?.cursorApiKey??"",e=a?.githubToken??"";return`# Operator local setup — generated by harness setup core
-# Do not commit .env.local (gitignored).
-
-# --- Local private harness config (local only) ---
-# Points at your structured target-repo config file.
-# Edit .harness/config.local.json after init; keep this path unchanged.
-HARNESS_CONFIG_PATH=${b}
-
-# --- GitHub Actions only (cloud runs) — do NOT put in .env.local ---
-# HARNESS_CONFIG_JSON_B64 replaces the whole harness config for that run.
-# It is NOT an overlay with committed harness.config.json.
-# Base64-encode your full .harness/config.local.json and set it as a
-# GitHub Actions secret on the harness repo. Include every repo you want
-# the harness to manage in repos[] and allowedTargetRepos[].
-
-# --- Live automation API keys (local CLI) ---
-# Fill these in .env.local for local doctor and harness runs.
-LINEAR_API_KEY=${c}
-CURSOR_API_KEY=${d}
-
-# Local CLI name for GitHub API access (doctor merge profile, handoff, merge).
-# In GitHub Actions the secret is named HARNESS_GITHUB_TOKEN (workflow maps it
-# to runtime GITHUB_TOKEN). Do not use HARNESS_GITHUB_TOKEN in .env.local.
-GITHUB_TOKEN=${e}
-`}(a.input);return"dry-run"===d?m({actionId:"write-env-local",outcome:h?"wouldChange":"preview",targetPath:b.envLocal,content:n,permission:g.P.localFileWrite,reason:h?"would overwrite with --force":"would create",logMessage:h?`would overwrite ${e}`:`would create ${e}`},i):(await (0,f.writeFile)(b.envLocal,n,"utf8"),m({actionId:"write-env-local",outcome:"changed",targetPath:b.envLocal,content:n,permission:g.P.localFileWrite,reason:h?"overwrote existing file":"created new file",logMessage:`${h?"overwrote":"created"} ${e}`},i))}var q=c(29281),r=c(71512),s=c(58885),t=c(84783),u=c(50615);let v="https://github.com/owner/example-target-app",w="target-app",x="Example Target App",y=new Set(["TEAM","WES"]),z=["staging.example.com","www.example.com","example.com"];function A(a){if(!a?.trim())return;let b=a.split(/[,\n]/).map(a=>a.trim()).filter(Boolean);return b.length>0?b:void 0}function B(a){return{id:a.id.trim(),targetRepo:a.targetRepo.trim(),linearProjects:A(a.linearProjects),linearTeams:A(a.linearTeams),baseBranch:a.baseBranch?.trim()||void 0,productionBranch:a.productionBranch?.trim()||void 0,previewProvider:a.previewProvider?.trim()||void 0,integrationPreviewUrl:a.integrationPreviewUrl?.trim()||void 0,productionUrl:a.productionUrl?.trim()||void 0,integrationSuccessStatus:a.integrationSuccessStatus?.trim()||void 0,productionSuccessStatus:a.productionSuccessStatus?.trim()||void 0,validationCommands:function(a){if(!a?.trim())return;let b=a.split("\n").map(a=>a.trim()).filter(Boolean);return b.length>0?b:void 0}(a.validationCommands)}}function C(a){if(!a.repos.length)throw Error("At least one target repo is required");return{repos:a.repos.map(B),linearTeamKey:a.linearTeamKey?.trim()||void 0,modelId:a.modelId?.trim()||void 0}}function D(){return{repos:[{id:"",targetRepo:""}]}}function E(a){if(!a?.trim())return!1;let b=a.trim();return b===v||b===w||b===x||"TEAM"===b||"WES"===b||z.some(a=>b.includes(a))||b.includes("owner/example-target-app")}async function F(a){let b=(0,k.ym)(a);try{return await (0,f.access)(b.configLocal),!0}catch{return!1}}async function G(a){let b=a?.cwd,c=(0,k.ym)(b),d=await F(b);b&&((0,s.N)(b),d&&!process.env.HARNESS_CONFIG_PATH?.trim()&&(process.env.HARNESS_CONFIG_PATH=c.configLocal));try{let a=(0,t.m)({baseDir:b}),c=await (0,q.rL)({baseDir:b});if("default-file"===a.kind||(e=c.config,0!==e.repos.length&&e.repos.every(a=>{let b=a.targetRepo===v||a.targetRepo.includes("owner/example-target-app"),c=a.id===w,d=a.linearProjects?.some(a=>a===x),e=[a.integrationPreviewUrl,a.productionUrl].some(a=>a&&z.some(b=>a.includes(b)));return b||c||d||e}))||"HARNESS_CONFIG_PATH"===a.kind&&!d)return D();var e,f,g=(f=c.config,{linearTeamKey:f.linear?.teamKey,modelId:f.agentProvider?.model?.id??f.defaultModel?.id??r.Sk,repos:f.repos.map(a=>({id:a.id,targetRepo:a.targetRepo,linearProjects:a.linearProjects?.join(", "),linearTeams:a.linearTeams?.join(", "),baseBranch:a.baseBranch,productionBranch:a.productionBranch,previewProvider:a.previewProvider,integrationPreviewUrl:a.integrationPreviewUrl,productionUrl:a.productionUrl,integrationSuccessStatus:a.integrationSuccessStatus,productionSuccessStatus:a.productionSuccessStatus,validationCommands:a.validation?.commands?.join("\n")}))});let h=g.repos[0];if(!h)return D();let i={...h,id:E(h.id)?"":h.id,targetRepo:E(h.targetRepo)?"":h.targetRepo,linearProjects:E(h.linearProjects)?void 0:h.linearProjects,linearTeams:E(h.linearTeams)?void 0:h.linearTeams,integrationPreviewUrl:E(h.integrationPreviewUrl)?void 0:h.integrationPreviewUrl,productionUrl:E(h.productionUrl)?void 0:h.productionUrl};return{linearTeamKey:g.linearTeamKey&&!y.has(g.linearTeamKey)?g.linearTeamKey:void 0,modelId:g.modelId,repos:[i]}}catch{return D()}}let H=g.P.localFileWrite.scope;function I(a){if(!a)return"";let b=0;for(let c=0;c<a.length;c+=1)b=(b+a.charCodeAt(c))%0x3b9aca07;return`${a.length}:${b}`}function J(a){return{harnessConfigPath:a.harnessConfigPath,githubDispatchRepository:a.githubDispatchRepository,linearApiKey:a.linearApiKey,cursorApiKey:a.cursorApiKey,githubToken:a.githubToken,vercelToken:a.vercelToken}}async function K(a){let[b,c]=await Promise.all([(0,h.X_)(a.envLocal),(0,h.X_)(a.configLocal)]);return{envLocalPath:a.envLocal,configLocalPath:a.configLocal,envLocalHash:b,configLocalHash:c}}function L(a){return{harnessConfigPath:a.harnessConfigPath?.trim()??"",githubDispatchRepository:a.githubDispatchRepository?.trim()??"",linearApiKeyToken:I(a.linearApiKey?.trim()??""),cursorApiKeyToken:I(a.cursorApiKey?.trim()??""),githubTokenToken:I(a.githubToken?.trim()??""),vercelTokenToken:I(a.vercelToken?.trim()??""),preserveLinear:!a.linearApiKey?.trim(),preserveCursor:!a.cursorApiKey?.trim(),preserveGithub:!a.githubToken?.trim(),preserveVercel:!a.vercelToken?.trim()}}function M(a,b,c){return JSON.stringify({cwd:c??process.cwd(),paths:{envLocal:b.envLocalPath,configLocal:b.configLocalPath},baselines:{envLocalHash:b.envLocalHash,configLocalHash:b.configLocalHash},env:L(a.env),config:C(a.config)})}async function N(a){let b=await (0,h.Hn)(a),{access:d}=await Promise.resolve().then(c.t.bind(c,51455,23)),e=!1;try{await d(a.configLocal),e=!0}catch{e=!1}return{envExists:!!b,configExists:e,envAction:b?"update":"create",configAction:e?"update":"create"}}async function O(a,b){let c=await (0,h.Hn)(a),d=await (0,h.ed)(a),e=(0,h._b)(c,b),f=(0,h.HF)(d,e),g=[...(0,h.Ol)(e),...(0,j.B8)(b)];return{mergedEnv:e,envContent:f,knownSecrets:g}}async function P(a){var b;let c=(0,k.ym)(a.cwd),d=J(a.env),{mergedEnv:e,envContent:f,knownSecrets:i}=await O(c,d),l=(0,j.qs)({actionId:"write-env-local",outcome:"preview",targetPath:c.envLocal,content:f,permission:g.P.localFileWrite,reason:f?"would update merged env":"would create env"},i),m=await K(c);return{fingerprint:(b=a.env,JSON.stringify({cwd:a.cwd??process.cwd(),paths:{envLocal:m.envLocalPath,configLocal:m.configLocalPath},baselines:{envLocalHash:m.envLocalHash,configLocalHash:m.configLocalHash},env:L(b)})),envPreview:(0,h.W)(f),envKeyPresence:(0,h.lL)(e),envResult:l}}async function Q(a){if(!a.confirmed)throw Error("Local file writes require explicit confirmation");let b=await P({cwd:a.cwd,env:a.env});if(a.fingerprint!==b.fingerprint)throw Error("Preview fingerprint is stale. Regenerate preview before applying.");let c=(0,k.ym)(a.cwd),d=J(a.env),{envContent:e,knownSecrets:f}=await O(c,d);if((0,h.W)(e)!==b.envPreview)throw Error("Preview fingerprint is stale. Regenerate preview before applying.");return{envResult:(0,j.qs)(await p({paths:c,mode:"apply",content:e,force:!0}),f)}}async function R(a){var b,c;let d,e,f=(0,k.ym)(a.cwd),l=J(a.payload.env),{mergedEnv:m,envContent:n,knownSecrets:o}=await O(f,l),p="";try{p=function(a){let b=C(a);return{config:(0,u.BR)(b),json:(0,u.rb)(b)}}(a.payload.config).json,e=await (0,i.writeConfigLocal)({paths:f,mode:"dry-run",content:p,force:!0})}catch(a){d=a instanceof Error?a.message:String(a),p="",e={actionId:"write-config-local",outcome:"preview",targetPath:f.configLocal,permission:g.P.localFileWrite,reason:(b=d,(0,j.h4)(b,o))}}let q=(0,j.qs)({actionId:"write-env-local",outcome:"preview",targetPath:f.envLocal,content:n,permission:g.P.localFileWrite,reason:n?"would update merged env":"would create env"},o),r=await N(f),s=await K(f);return{fingerprint:M(a.payload,s,a.cwd),plan:r,envPreview:(0,h.W)(n),configPreview:p,envKeyPresence:(0,h.lL)(m),envResult:q,configResult:(0,j.qs)(e,o),validationError:d?(c=d,(0,j.h4)(c,o)):void 0}}async function S(a){if(!a.confirmed)throw Error("Local file writes require explicit confirmation");let b=(0,k.ym)(a.cwd),c=await K(b),d=M(a.payload,c,a.cwd);if(a.fingerprint!==d)throw Error("Preview fingerprint is stale. Regenerate preview before applying.");let e=await R({cwd:a.cwd,payload:a.payload});if(e.validationError)throw Error(e.validationError);if(e.envResult.permission.scope!==H||e.configResult.permission.scope!==H)throw Error("Only local-file-write actions are allowed in Milestone 4");let g=J(a.payload.env),{envContent:l,knownSecrets:m}=await O(b,g);if((0,h.W)(l)!==e.envPreview)throw Error("Preview fingerprint is stale. Regenerate preview before applying.");await (0,f.mkdir)(b.harnessDir,{recursive:!0});let n=(0,j.qs)(await p({paths:b,mode:"apply",content:l,force:!0}),m);return{envResult:n,configResult:(0,j.qs)(await (0,i.writeConfigLocal)({paths:b,mode:"apply",content:e.configPreview,force:!0}),m),plan:await N(b)}}async function T(a){let b=(0,k.ym)(a.cwd),c=await (0,h.Hn)(b),d=void 0!==a.githubDispatchRepositoryId?String(a.githubDispatchRepositoryId):void 0,e=(0,h._b)(c,{githubDispatchRepository:a.githubDispatchRepository.trim(),githubDispatchRepositoryId:d}),f=c?.values.GITHUB_DISPATCH_REPOSITORY?.trim()===a.githubDispatchRepository.trim(),i=void 0===d||c?.values.GITHUB_DISPATCH_REPOSITORY_ID?.trim()===d;if(f&&i)return{actionId:"write-env-local",outcome:"skipped",targetPath:b.envLocal,permission:g.P.localFileWrite,reason:"GITHUB_DISPATCH_REPOSITORY already persisted."};let j=await (0,h.ed)(b);return p({paths:b,mode:"apply",content:(0,h.HF)(j,e),force:!0})}var U=c(84107),V=c(4631);let W=["Ready for Planning","Ready for Build","PR Open","Needs Revision","Ready to Merge"];W.map(a=>a.toLowerCase());let X=[{name:"Backlog",category:"backlog",role:"transitional",creatable:!0},{name:"Ready for Planning",category:"unstarted",role:"dispatch-trigger",creatable:!0},{name:"Planning",category:"started",role:"transitional",creatable:!0},{name:"Ready for Build",category:"unstarted",role:"dispatch-trigger",creatable:!0},{name:"Building",category:"started",role:"transitional",creatable:!0},{name:"PR Open",category:"started",role:"dispatch-trigger",creatable:!0},{name:"PM Review",category:"started",role:"transitional",creatable:!0},{name:"Engineering Review",category:"started",role:"human-gate",creatable:!0},{name:"Needs Revision",category:"unstarted",role:"dispatch-trigger",creatable:!0},{name:"Revising",category:"started",role:"transitional",creatable:!0},{name:"Ready to Merge",category:"started",role:"dispatch-trigger",creatable:!0},{name:"Merging",category:"started",role:"transitional",creatable:!0},{name:"Merged to Dev",category:"completed",role:"transitional",creatable:!0},{name:"Merged / Deployed",category:"completed",role:"transitional",creatable:!0},{name:"Blocked",category:"started",role:"terminal",creatable:!0},{name:"Canceled",category:"canceled",role:"terminal",creatable:!0},{name:"Duplicate",category:"canceled",role:"system-managed",creatable:!1}];function Y(){return X.filter(a=>a.creatable)}function Z(a){let b=a.trim().toLowerCase();return X.find(a=>a.name.toLowerCase()===b)}var $=c(75365);let _=[{group:"configuration",match:a=>a.includes("harness config")||a.includes("allowedTargetRepos")||a.includes("harness.config.json")},{group:"filesystem",match:a=>a.includes("runs/ directory writable")},{group:"linear",match:a=>a.startsWith("LINEAR_API_KEY")},{group:"cursor",match:a=>a.startsWith("CURSOR_API_KEY")||a.startsWith("Cursor models.list")||a.startsWith("Cursor repositories.list")},{group:"github",match:a=>a.startsWith("GITHUB_TOKEN")||a.includes("base branch exists")||a.includes("PR head-branch write")}];function aa(a){return a?.trim()||V.o}function ab(a){let b=aa(a?.harnessRepo);return{summary:`Manual GitHub Actions secret setup for ${b}.`,steps:[`Open GitHub repository settings for ${b}.`,"Navigate to Settings → Secrets and variables → Actions.","Create or update these secret names: HARNESS_CONFIG_JSON_B64, LINEAR_API_KEY, CURSOR_API_KEY, HARNESS_GITHUB_TOKEN.","Set HARNESS_CONFIG_JSON_B64 from the base64-encoded full private harness config.","Set LINEAR_API_KEY, CURSOR_API_KEY, and HARNESS_GITHUB_TOKEN from your operator credentials.","Never print secret values in logs, docs, PR comments, or generated setup previews."]}}let ac={scaffoldEnvLocal:{id:"scaffold-env-local",label:"Scaffold .env.local",description:"Create or update local environment file from committed example",permission:g.P.localFileWrite},scaffoldConfigLocal:{id:"scaffold-config-local",label:"Scaffold .harness/config.local.json",description:"Create or update private harness config from committed example",permission:g.P.localFileWrite},generateHarnessConfigB64Instructions:{id:"generate-harness-config-b64-instructions",label:"Generate HARNESS_CONFIG_JSON_B64 instructions",description:"Produce manual copy-paste steps for GitHub Actions config secret",permission:g.P.readOnly},generateGitHubSecretInstructions:{id:"generate-github-secret-instructions",label:"Generate GitHub Actions secret instructions",description:"Produce manual copy-paste steps for harness repo secrets",permission:g.P.readOnly},applyHarnessSecrets:{id:V.PN.applyHarnessSecrets.id,label:V.PN.applyHarnessSecrets.label,description:V.PN.applyHarnessSecrets.description,permission:V.PN.applyHarnessSecrets.permission},futureSetGitHubSecrets:{id:V.PN.applyHarnessSecrets.id,label:V.PN.applyHarnessSecrets.label,description:V.PN.applyHarnessSecrets.description,permission:V.PN.applyHarnessSecrets.permission},previewHarnessSecrets:{id:V.PN.previewHarnessSecrets.id,label:V.PN.previewHarnessSecrets.label,description:V.PN.previewHarnessSecrets.description,permission:V.PN.previewHarnessSecrets.permission},previewTargetWorkflowPr:{id:V.PN.previewTargetWorkflowPr.id,label:V.PN.previewTargetWorkflowPr.label,description:V.PN.previewTargetWorkflowPr.description,permission:V.PN.previewTargetWorkflowPr.permission},applyTargetWorkflowPr:{id:V.PN.applyTargetWorkflowPr.id,label:V.PN.applyTargetWorkflowPr.label,description:V.PN.applyTargetWorkflowPr.description,permission:V.PN.applyTargetWorkflowPr.permission}};async function ad(a){let b=(0,k.ym)(a?.cwd),c=a?.force??!1,d=a?.mode??"apply",e=[],g=[];"apply"===d&&await (0,f.mkdir)(b.harnessDir,{recursive:!0});let h=await o({paths:b,force:c,mode:d});e.push(h),h.logMessage&&g.push(h.logMessage);let j=await (0,i.vb)({paths:b,force:c,mode:d});return e.push(j),j.logMessage&&g.push(j.logMessage),{results:e,logMessages:g}}var ae=c(14745);async function af(a){try{return await (0,f.access)(a),!0}catch{return!1}}async function ag(a){let b={LINEAR_API_KEY:!1,CURSOR_API_KEY:!1,GITHUB_TOKEN:!1,VERCEL_TOKEN:!1,HARNESS_CONFIG_PATH:!1};try{for(let c of(await (0,f.readFile)(a,"utf8")).split("\n")){let a=c.trim();if(!a||a.startsWith("#"))continue;let d=a.indexOf("=");if(-1===d)continue;let e=a.slice(0,d).trim(),f=a.slice(d+1).trim();e in b&&f.length>0&&(b[e]=!0)}}catch{}return b}function ah(a){return{repoCount:a.repos.length,repos:a.repos.map(a=>({id:a.id,targetRepo:a.targetRepo,baseBranch:a.baseBranch,productionBranch:a.productionBranch,previewProvider:a.previewProvider,linearProjects:a.linearProjects})),linearTeamKey:a.linear?.teamKey,allowedTargetRepos:a.allowedTargetRepos,closureValid:function(a){try{return(0,q.g1)(a),!0}catch{return!1}}(a),model:(0,ae.M)(a)}}async function ai(a){let b=(0,k.ym)(a?.cwd),c=a?.envLocalExists??await af(b.envLocal),d=a?.configLocalExists??await af(b.configLocal),e=[];if(a?.configParseError?e.push({label:"harness config valid",ok:!1,detail:a.configParseError}):a?.config?(e.push({label:"harness config valid",ok:!0,detail:"resolved for local GUI summary"}),e.push({label:"allowedTargetRepos covers all repo mappings",ok:!0})):e.push({label:"harness config valid",ok:!1,detail:"config could not be resolved"}),e.push({label:".env.local present",ok:c,detail:c?b.envLocal:"run npm run harness:operator:init"}),e.push({label:".harness/config.local.json present",ok:d,detail:d?b.configLocal:"run npm run harness:operator:init"}),a?.config){let b=(0,ae.M)(a.config);e.push({label:"Cursor model policy resolved",ok:!0,detail:`${b.resolvedModelId} (${b.source})`})}return e.push({label:"LINEAR_API_KEY set",ok:!1,skipped:!0,detail:"remote provider checks are CLI-only in Milestone 3"}),e.push({label:"CURSOR_API_KEY set",ok:!1,skipped:!0,detail:"remote provider checks are CLI-only in Milestone 3"}),e.push({label:"GITHUB_TOKEN set",ok:!1,skipped:!0,detail:"remote provider checks are CLI-only in Milestone 3"}),e}let aj=new Set(["HARNESS_CONFIG_JSON_B64","HARNESS_CONFIG_JSON"]);function ak(a,b,c){return{kind:a.kind,label:aj.has(a.kind)?a.kind:a.label,resolved:b,parseError:c}}async function al(a){let b,c=a?.cwd??process.cwd();(0,e.Re)(c);let d=(0,k.ym)(c),f=await af(d.envLocal),g=await af(d.configLocal),h=await ag(d.envLocal),l=null,m=(0,t.m)({baseDir:c}),n=ak(m,!1);try{let a=await (0,q.rL)({baseDir:c});l=a.config,n=ak(a.source,!0)}catch(a){n=ak(m,!1,b=a instanceof Error?a.message:String(a))}let o=await ad({cwd:c,mode:"dry-run"}),r=await p({paths:d,mode:"dry-run",input:{}}),s=await (0,i.writeConfigLocal)({paths:d,mode:"dry-run",input:{repos:[{id:"target-app",linearProjects:["Example Target App"],targetRepo:"https://github.com/owner/example-target-app"}]}}),v=(0,u.RB)(),w=await (0,U.z8)({cwd:c}),x=(0,U.OW)(w),y=await ai({cwd:c,config:l,configParseError:b,envLocalExists:f,configLocalExists:g}),z=function(a){let b=new Map;for(let c of a){let a=_.find(a=>a.match(c.label))?.group??"configuration",d=b.get(a)??[];d.push(c),b.set(a,d)}return["configuration","filesystem","linear","cursor","github"].filter(a=>b.has(a)).map(a=>({group:a,checks:b.get(a)??[]}))}(y),A=!!l&&!b,B=A&&g&&("HARNESS_CONFIG_PATH"===n.kind||"cli-config"===n.kind),C=f&&g;return function(a,b=[]){let c=a=>(0,j.h4)((0,j.QJ)(a),b);return{...a,scaffoldPreviews:a.scaffoldPreviews.map(a=>(0,j.qs)(a,b)),instructionPreviews:a.instructionPreviews.map(a=>(0,j.qs)(a,b)),generatedPreviews:{envLocal:a.generatedPreviews.envLocal?c(a.generatedPreviews.envLocal):void 0,configLocal:a.generatedPreviews.configLocal},missingSteps:a.missingSteps.map(a=>({...a,detail:c(a.detail)})),doctor:{...a.doctor,checks:a.doctor.checks.map(a=>({...a,detail:a.detail?c(a.detail):void 0})),groups:a.doctor.groups.map(a=>({...a,checks:a.checks.map(a=>({...a,detail:a.detail?c(a.detail):void 0}))}))}}}({overview:{readyForLocalDoctor:A&&C,configResolved:A,operatorConfigResolved:B,localFilesPresent:C},localFiles:[{label:".env.local",path:d.envLocal,exists:f},{label:".harness/config.local.json",path:d.configLocal,exists:g},{label:".env.example",path:d.envExample,exists:await af(d.envExample)},{label:".harness/config.example.json",path:d.configExample,exists:await af(d.configExample)}],configSource:{...n,parseError:b,resolved:A},configSummary:l?ah(l):ah(v),envKeyPresence:h,scaffoldPreviews:o.results,instructionPreviews:[function(a){let b=function(a){let b=a?.configPath??".harness/config.local.json",c=`base64 < ${b} | tr -d '\\n'`;return{summary:"Encode the full private harness config for the HARNESS_CONFIG_JSON_B64 GitHub Actions secret.",command:c,steps:["Maintain the full private harness config locally at .harness/config.local.json.","Ensure every managed repo appears in both repos[] and allowedTargetRepos[].",`Run: ${c}`,"Copy the single-line output into the harness repo GitHub Actions secret HARNESS_CONFIG_JSON_B64.","Do not commit the encoded value or private config to the public harness repo."]}}(a);return{actionId:ac.generateHarnessConfigB64Instructions.id,outcome:"preview",permission:ac.generateHarnessConfigB64Instructions.permission,manualInstructions:b.steps,content:b.command,reason:b.summary}}({configPath:".harness/config.local.json"}),function(a){let b=ab(a);return{actionId:ac.generateGitHubSecretInstructions.id,outcome:"preview",permission:ac.generateGitHubSecretInstructions.permission,manualInstructions:b.steps,reason:b.summary}}({harnessRepo:x})],generatedPreviews:{envLocal:r.content,configLocal:s.content??JSON.stringify(v,null,2)},missingSteps:function(a){let b=[];return a.envExists||b.push({id:"missing-env-local",label:"Create .env.local",detail:"Run npm run harness:operator:init to scaffold local env files."}),a.configExists||b.push({id:"missing-config-local",label:"Create .harness/config.local.json",detail:"Run npm run harness:operator:init, then edit your target repo mapping."}),a.configParseError?b.push({id:"config-parse-error",label:"Fix harness config parse errors",detail:a.configParseError}):a.configResolved||b.push({id:"config-unresolved",label:"Point harness config resolution at your private config",detail:"Set HARNESS_CONFIG_PATH in .env.local to .harness/config.local.json."}),a.envKeyPresence.HARNESS_CONFIG_PATH||b.push({id:"missing-harness-config-path",label:"Set HARNESS_CONFIG_PATH",detail:"Keep HARNESS_CONFIG_PATH=.harness/config.local.json in .env.local."}),a.envKeyPresence.LINEAR_API_KEY||b.push({id:"missing-linear-key",label:"Add LINEAR_API_KEY for live doctor and harness runs",detail:"Fill LINEAR_API_KEY in .env.local when ready for live validation."}),a.envKeyPresence.CURSOR_API_KEY||b.push({id:"missing-cursor-key",label:"Add CURSOR_API_KEY for live cloud agent phases",detail:"Fill CURSOR_API_KEY in .env.local when ready for live validation."}),a.envKeyPresence.GITHUB_TOKEN||b.push({id:"missing-github-token",label:"Add GITHUB_TOKEN for handoff and merge checks",detail:"Fill GITHUB_TOKEN in .env.local when ready for live validation."}),a.envKeyPresence.VERCEL_TOKEN||b.push({id:"missing-vercel-token",label:"Add VERCEL_TOKEN for Vercel bridge setup",detail:"Fill VERCEL_TOKEN in .env.local for Configure-time Vercel inspection."}),b}({envExists:f,configExists:g,configResolved:A,configParseError:b,envKeyPresence:h}),doctor:{checks:y,groups:z,failed:y.some(a=>!a.ok&&!a.skipped),remoteChecksNote:"Live Linear, GitHub, and Cursor doctor checks remain CLI-only in Milestone 3. Run npm run harness:doctor for full validation."},deferredActions:[]},function(){let a=[],b=process.env.HARNESS_CONFIG_JSON?.trim();b&&a.push(b);let c=process.env.HARNESS_CONFIG_JSON_B64?.trim();if(c){a.push(c);try{a.push(Buffer.from(c,"base64").toString("utf8"))}catch{}}return a}())}var am=c(92116),an=c(67470),ao=c(11900),ap=c(16589);function aq(a){return a.explicitReplacement?"payload":a.envPresent?"enriched-local":"absent"}async function ar(a){let b=(0,k.ym)(a.cwd),c=await (0,h.X_)(b.envLocal),d=a.operatorInput?.credentialInputSources??{linearApiKey:"absent",cursorApiKey:"absent",harnessGithubToken:"absent"};return{linearApiKey:d.linearApiKey,cursorApiKey:d.cursorApiKey,harnessGithubToken:d.harnessGithubToken,explicitCredentialReplacements:[...a.operatorInput?.explicitCredentialReplacements??[]].sort(),envLocalCredentialBaseline:c}}async function as(a){let b=(0,k.ym)(a),c=await (0,f.readFile)(b.configLocal);JSON.parse(c.toString("utf8"));let e=(0,d.createHash)("sha256").update(c).digest("hex");return{bytes:c,hash:e}}function at(a){return a.toString("base64")}async function au(a){let b,c=await (0,U.z8)({cwd:a.cwd,manualRepo:a.manualHarnessDispatchRepo}),d=!1,e="";try{let b=await as(a.cwd);d=!0,e=b.hash}catch(a){b=a instanceof Error?a.message:String(a)}let f=function(a){let b=new Map((a.secretStatuses??[]).map(a=>[a.name,a.status])),c=[];for(let e of V.LY){var d;if("HARNESS_CONFIG_JSON_B64"===e){if(!a.configLocalExists){c.push({name:e,action:"skip",source:"missing-input"});continue}c.push({name:e,action:"present"===b.get(e)?"update":"create",source:"generated-config-b64"});continue}let f="present"===b.get(e),g=function(a,b){let c=a?.credentialInputSources;if(c){if("LINEAR_API_KEY"===b)return"absent"!==c.linearApiKey;if("CURSOR_API_KEY"===b)return"absent"!==c.cursorApiKey;if("HARNESS_GITHUB_TOKEN"===b)return"absent"!==c.harnessGithubToken}return!!("LINEAR_API_KEY"===b?a?.linearApiKey:"CURSOR_API_KEY"===b?a?.cursorApiKey:"HARNESS_GITHUB_TOKEN"===b?a?.githubToken:void 0)?.trim()}(a.operatorInput,e),h=(d=a.operatorInput,d?.explicitCredentialReplacements?.includes(e)??!1);if(f&&!h){c.push({name:e,action:"skip",source:"preserve-existing"});continue}if(g){c.push({name:e,action:f?"update":"create",source:"operator-input"});continue}c.push({name:e,action:"skip",source:"missing-input"})}return c}({operatorInput:a.operatorInput,configLocalExists:d,secretStatuses:a.secretStatuses});return{harnessDispatchRepo:c,configLocalExists:d,configLocalHash:e,secretWritePlan:f,validationError:b}}async function av(a){var b;let c=await au(a),d=(0,U.OW)(c.harnessDispatchRepo),e=ab({harnessRepo:d}).steps,f=await ar(a),g=JSON.stringify({actionId:(b={actionId:V.PN.previewHarnessSecrets.id,permissionScope:V.PN.previewHarnessSecrets.permission.scope,harnessDispatchRepo:d,harnessDispatchRepoSource:c.harnessDispatchRepo.source,secretWritePlan:c.secretWritePlan,credentialInputContext:f,configLocalHash:c.configLocalHash}).actionId,permissionScope:b.permissionScope,harnessDispatchRepo:b.harnessDispatchRepo,harnessDispatchRepoSource:b.harnessDispatchRepoSource,secretWritePlan:b.secretWritePlan.map(a=>({name:a.name,action:a.action,source:a.source})),credentialInputContext:{linearApiKey:b.credentialInputContext.linearApiKey,cursorApiKey:b.credentialInputContext.cursorApiKey,harnessGithubToken:b.credentialInputContext.harnessGithubToken,explicitCredentialReplacements:[...b.credentialInputContext.explicitCredentialReplacements].sort(),envLocalCredentialBaseline:b.credentialInputContext.envLocalCredentialBaseline},configLocalHash:b.configLocalHash??""});return{harnessDispatchRepo:c.harnessDispatchRepo,configLocalHash:c.configLocalHash,secretWritePlan:c.secretWritePlan,fingerprint:g,previewSummary:function(a){let b=(0,U.OW)(a.harnessDispatchRepo),c=a.secretWritePlan.filter(a=>"skip"!==a.action).map(a=>a.name);return 0===c.length?`No harness repo Actions secrets would be written for ${b}.`:`Would write harness repo Actions secrets for ${b}: ${c.join(", ")}. Secret values are never shown in previews.`}({harnessDispatchRepo:c.harnessDispatchRepo,secretWritePlan:c.secretWritePlan}),manualInstructions:e,validationError:c.validationError}}function aw(a){let b=(0,ap.wL)(a);return b?`${b.owner}/${b.repo}`:null}async function ax(a){let b=(0,k.ym)(a.cwd),c=await (0,h.Hn)(b),d=[],e=a.payload.linearApiKey?.trim();e?d.push("LINEAR_API_KEY"):e=c?.values.LINEAR_API_KEY?.trim()||void 0;let f=a.payload.cursorApiKey?.trim();f?d.push("CURSOR_API_KEY"):f=c?.values.CURSOR_API_KEY?.trim()||void 0;let g=a.payload.harnessGithubToken?.trim();return g?d.push("HARNESS_GITHUB_TOKEN"):g=c?.values.GITHUB_TOKEN?.trim()||void 0,{linearApiKey:e,cursorApiKey:f,githubToken:g,explicitCredentialReplacements:d.length>0?d:void 0,credentialInputSources:{linearApiKey:aq({explicitReplacement:d.includes("LINEAR_API_KEY"),envPresent:c?.presence.LINEAR_API_KEY??!1}),cursorApiKey:aq({explicitReplacement:d.includes("CURSOR_API_KEY"),envPresent:c?.presence.CURSOR_API_KEY??!1}),harnessGithubToken:aq({explicitReplacement:d.includes("HARNESS_GITHUB_TOKEN"),envPresent:c?.presence.GITHUB_TOKEN??!1})}}}async function ay(a){let b=a?.cwd,c=(0,k.ym)(b),d=await (0,h.Hn)(c),e={},f=[];try{let{bytes:a}=await as(b);e.HARNESS_CONFIG_JSON_B64=at(a)}catch{f.push("HARNESS_CONFIG_JSON_B64")}let g=d?.values.LINEAR_API_KEY?.trim();g?e.LINEAR_API_KEY=g:f.push("LINEAR_API_KEY");let i=d?.values.CURSOR_API_KEY?.trim();i?e.CURSOR_API_KEY=i:f.push("CURSOR_API_KEY");let j=d?.values.GITHUB_TOKEN?.trim();return j?e.HARNESS_GITHUB_TOKEN=j:f.push("HARNESS_GITHUB_TOKEN"),{values:e,missing:f}}function az(a){return`harness/setup-production-sync-${a}`}function aA(){return"Install harness production sync workflow"}function aB(a){return`Install the harness production sync workflow via Product Development Harness setup.
-
-- Repo config id: ${a.repoConfigId}
-- Production branch watched: ${a.productionBranch}
-- Harness dispatch repo: ${a.harnessDispatchRepo}
-
-This workflow dispatches \`production_promoted\` to the harness repo after production branch pushes.
-It does not run harness planning, implementation, handoff, revision, or merge phases.
-
-Required target repo secret: \`HARNESS_DISPATCH_TOKEN\` (dispatch-only PAT scoped to the harness repo).`}function aC(a){return(0,d.createHash)("sha256").update(a).digest("hex")}function aD(a,b){return a?aC(a)===aC(b)?"present":"differs":"missing"}function aE(a){var b,c,e;let f=function(a){let b=aw(a.targetRepo);if(!b)return{plan:{repoConfigId:a.repoConfigId,targetRepoSlug:"<invalid-target-repo>",harnessDispatchRepo:(0,U.OW)(a.harnessDispatchRepo),productionBranch:a.productionBranch,workflowPath:V.CH,branchName:az(a.repoConfigId),prTitle:aA(),prBody:aB({repoConfigId:a.repoConfigId,productionBranch:a.productionBranch,harnessDispatchRepo:(0,U.OW)(a.harnessDispatchRepo)}),workflowStatus:"unknown",directProductionBranchWrite:!1},workflowContent:"",validationError:`Invalid target repo URL: ${a.targetRepo}`};let c=(0,U.OW)(a.harnessDispatchRepo),d=function(a){var b;let c=(b=a.harnessDispatchRepo,`https://api.github.com/repos/${b}/dispatches`);return`name: Trigger harness production sync
-
-on:
-  push:
-    branches: [${a.productionBranch}]
-
-permissions:
-  contents: read
-
-jobs:
-  dispatch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dispatch production_promoted to harness
-        env:
-          HARNESS_DISPATCH_TOKEN: \${{ secrets.HARNESS_DISPATCH_TOKEN }}
-        run: |
-          curl -fsS -X POST \\
-            -H "Authorization: Bearer \${HARNESS_DISPATCH_TOKEN}" \\
-            -H "Accept: application/vnd.github+json" \\
-            -H "X-GitHub-Api-Version: 2022-11-28" \\
-            ${c} \\
-            -d "$(jq -n \\
-              --arg repo ${a.repoConfigId} \\
-              --arg branch ${a.productionBranch} \\
-              --arg source ${a.targetRepoSlug} \\
-              --arg after "\${{ github.sha }}" \\
-              --arg ref "\${{ github.ref }}" \\
-              --arg run_id "\${{ github.run_id }}" \\
-              --arg received "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \\
-              '{event_type:"production_promoted", client_payload:{repo:$repo, productionBranch:$branch, sourceRepo:$source, after:$after, ref:$ref, githubRunId:$run_id, receivedAt:$received}}')"
-`}({harnessDispatchRepo:c,repoConfigId:a.repoConfigId,targetRepoSlug:b,productionBranch:a.productionBranch});return{plan:{repoConfigId:a.repoConfigId,targetRepoSlug:b,harnessDispatchRepo:c,productionBranch:a.productionBranch,workflowPath:V.CH,branchName:az(a.repoConfigId),prTitle:aA(),prBody:aB({repoConfigId:a.repoConfigId,productionBranch:a.productionBranch,harnessDispatchRepo:c}),workflowStatus:a.workflowStatus??"unknown",directProductionBranchWrite:!1},workflowContent:d}}(a),g=function(a){let b=aa(a?.harnessRepo),c=a?.repoConfigId??"target-app",d=a?.targetRepoSlug??"owner/example-target-app",e=a?.productionBranch??"main";return{summary:"Manual target repo workflow install for production promotion dispatch.",steps:["In the example target repo, create .github/workflows/trigger-harness-production-sync.yml.",`Set the harness dispatch URL to https://api.github.com/repos/${b}/dispatches.`,`Set payload repo to the private config repos[].id value (${c}).`,`Set payload sourceRepo to the target repo slug (${d}).`,`Restrict the workflow to production branch pushes (${e}).`,"Store HARNESS_DISPATCH_TOKEN in the target repo only; do not place merge-capable tokens in Vercel.","Preferred first behavior: open a PR with the workflow file instead of direct push."]}}({harnessRepo:f.plan.harnessDispatchRepo,repoConfigId:f.plan.repoConfigId,targetRepoSlug:f.plan.targetRepoSlug,productionBranch:f.plan.productionBranch}).steps,h=(c=JSON.stringify({actionId:(b={actionId:V.PN.previewTargetWorkflowPr.id,permissionScope:V.PN.previewTargetWorkflowPr.permission.scope,repoConfigId:f.plan.repoConfigId,targetRepoSlug:f.plan.targetRepoSlug,harnessDispatchRepo:f.plan.harnessDispatchRepo,productionBranch:f.plan.productionBranch,workflowPath:f.plan.workflowPath,branchName:f.plan.branchName,workflowContentHash:aC(f.workflowContent),productionBranchSha:a.productionBranchSha}).actionId,permissionScope:b.permissionScope,repoConfigId:b.repoConfigId,targetRepoSlug:b.targetRepoSlug,harnessDispatchRepo:b.harnessDispatchRepo,productionBranch:b.productionBranch,workflowPath:b.workflowPath,branchName:b.branchName,workflowContentHash:b.workflowContentHash,productionBranchSha:b.productionBranchSha??""}),(0,d.createHash)("sha256").update(c).digest("hex").slice(0,16));return{plan:f.plan,workflowContent:f.workflowContent,workflowPreviewSummary:(e=f.plan,`Workflow path: ${e.workflowPath}
-Install branch: ${e.branchName}
-PR base branch: ${e.productionBranch}
-Harness dispatch repo: ${e.harnessDispatchRepo}
-Workflow status: ${e.workflowStatus}
-Direct production branch write: never`),fingerprint:h,manualInstructions:g,validationError:f.validationError}}function aF(a){if(a instanceof an.OS){if(401===a.status)return"github_auth_failure";if(409===a.status)return"pr_already_merged";if(405===a.status){let b=a.message.toLowerCase();if(b.includes("already been merged")||b.includes("already merged"))return"pr_already_merged"}}return"github_merge_failure"}function aG(a){let b=(a.message??(a.error instanceof Error?a.error.message:String(a.error))).toLowerCase();if(a.error instanceof an.OS){if(401===a.error.status||403===a.error.status)return b.includes("review")||b.includes("approval")||b.includes("required reviewers")?{category:"review-required",waiting:!1,message:"GitHub requires human review before this workflow install PR can merge."}:{category:"permission-denied",waiting:!1,message:"The setup token does not have permission to merge this workflow install PR."};if(405===a.error.status&&"pr_already_merged"===aF(a.error))return{category:"merge-api-failure",waiting:!1,message:"Workflow install PR was already merged."};if(409===a.error.status)return{category:"merge-conflict",waiting:!1,message:"The workflow install PR has merge conflicts that require manual resolution."};if(422===a.error.status){if(b.includes("merge queue")||b.includes("queued for merge"))return{category:"merge-queue-required",waiting:!1,message:"This repository requires merge queue handling that onboarding does not support automatically."};if(b.includes("head sha")||b.includes("expected head"))return{category:"mergeability-pending",waiting:!0,message:"The workflow install PR head changed during finalization. Revalidating before merge."};if(b.includes("required status")||b.includes("not mergeable")||b.includes("checks"))return{category:"checks-pending",waiting:!0,message:"GitHub is still waiting for required checks on the workflow install PR."};if(b.includes("review"))return{category:"review-required",waiting:!1,message:"GitHub requires human review before this workflow install PR can merge."}}}let c=a.mergeableState?.toLowerCase()??"";return"dirty"===c?{category:"merge-conflict",waiting:!1,message:"The workflow install PR has merge conflicts that require manual resolution."}:"behind"===c?{category:"branch-behind",waiting:!0,message:"The workflow install branch is behind the production branch."}:"blocked"===c?{category:"review-required",waiting:!1,message:"Branch protection or review rules are blocking automatic merge of the workflow install PR."}:{category:"merge-api-failure",waiting:!1,message:"GitHub rejected the workflow install PR merge request."}}function aH(a){switch(a){case"checks-pending":return"Waiting for GitHub checks on the workflow install PR.";case"checks-failing":return"Required checks failed on the workflow install PR.";case"mergeability-pending":return"GitHub is still computing mergeability for the workflow install PR.";case"branch-behind":return"Updating the workflow install branch to match production.";case"review-required":return"Human review is required before the workflow install PR can merge.";case"permission-denied":return"The setup token cannot merge the workflow install PR.";case"merge-conflict":return"The workflow install PR has merge conflicts.";case"unexpected-pr-content":return"The workflow install PR contains unexpected changes.";case"merge-queue-required":return"This repository requires merge queue handling.";case"merge-api-failure":return"GitHub rejected the workflow install merge request.";case"verification-failed":return"The workflow was merged but production verification has not succeeded yet.";default:return"Workflow install finalization is blocked."}}let aI=new Map;function aJ(a,b){return`${a}:${b}`}function aK(a){return{repoConfigId:a.input.repoConfigId,targetRepo:a.input.targetRepo,targetRepoSlug:a.targetRepoSlug,productionBranch:a.input.productionBranch,branchName:a.branchName,lifecycle:a.lifecycle,blockedCategory:a.blockedCategory,message:a.message,prUrl:a.prUrl,prNumber:a.prNumber,validatedHeadSha:a.validatedHeadSha,workflowStatus:a.workflowStatus,canRetry:a.canRetry??!1,requiresGitHubIntervention:a.requiresGitHubIntervention??!1,advancedThisRequest:a.advancedThisRequest??!0,lockContended:!1}}class aL{constructor(a={}){this.state=a,this.calls=[],this.encryptedWrites=[],this.mutableWorkflowContent=a.existingWorkflowContent}advanceTargetWorkflowFinalization(a){this.calls.push({method:"advanceTargetWorkflowFinalization",args:[a]});let b=this.state.harnessDispatchRepo??{resolved:!0,repo:"owner/harness-repo",source:"explicit-config"},c=aE({repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,harnessDispatchRepo:b});return function(a){let b=aw(a.finalizeInput.targetRepo);if(!b)return aK({input:a.finalizeInput,targetRepoSlug:"<invalid>",branchName:az(a.finalizeInput.repoConfigId),lifecycle:"blocked",workflowStatus:"unknown",message:"Invalid target repo URL.",blockedCategory:"unexpected-pr-content",requiresGitHubIntervention:!0});let c=a.finalizeInput.branchName??az(a.finalizeInput.repoConfigId),d=a.scenario??{},e=function(a){let b=aI.get(a);if(b)return b;let c={checksPollCount:0,verificationPollCount:0,mergeAttempts:0,branchUpdateAttempts:0};return aI.set(a,c),c}(aJ(b,a.finalizeInput.repoConfigId)),f=a.existingWorkflowContent,g="unknown";if("present"==(g=null==f?"missing":f===a.intendedWorkflowContent?"present":"differs"))return aI.delete(aJ(b,a.finalizeInput.repoConfigId)),aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"complete",workflowStatus:"present",message:"Workflow installed on the production branch."});let h=a.finalizeInput.prUrl??d.prUrl??`https://github.com/${b}/pull/${d.prNumber??1}`,i=d.prNumber??1,j=d.headSha??"mock-head-sha";if(d.unexpectedExtraFile||d.workflowContentMismatch)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("unexpected-pr-content"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"unexpected-pr-content",requiresGitHubIntervention:!0});if(d.alreadyMerged){e.verificationPollCount+=1;let f=d.verificationLagSteps??0;return e.verificationPollCount>f?(a.onProductionWorkflowUpdate?.(a.intendedWorkflowContent),aI.delete(aJ(b,a.finalizeInput.repoConfigId)),aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"complete",workflowStatus:"present",message:"Workflow installed on the production branch.",prUrl:h,prNumber:i})):aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"verifying",workflowStatus:g,message:"Verifying workflow on the production branch.",prUrl:h,prNumber:i,canRetry:!0})}if("failing"===d.checks)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("checks-failing"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"checks-failing",requiresGitHubIntervention:!0});if("pending"===d.checks&&(e.checksPollCount+=1,e.checksPollCount<2))return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"waiting-for-checks",workflowStatus:g,message:aH("checks-pending"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"checks-pending"});if("unknown"===d.mergeableState)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"waiting-for-checks",workflowStatus:g,message:aH("mergeability-pending"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"mergeability-pending"});if("behind"===d.mergeableState){if(0===e.branchUpdateAttempts)return e.branchUpdateAttempts+=1,aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"updating-branch",workflowStatus:g,message:aH("branch-behind"),prUrl:h,prNumber:i,validatedHeadSha:j});d.mergeableState="clean"}if("dirty"===d.mergeableState)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("merge-conflict"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"merge-conflict",requiresGitHubIntervention:!0});if("blocked"===d.mergeableState)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("review-required"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"review-required",requiresGitHubIntervention:!0});e.lastValidatedHeadSha=j;let k=d.headShaChangesAfterValidation?"changed-head-sha":j;if(0===e.mergeAttempts){if(e.mergeAttempts+=1,"permission-denied"===d.mergeResult)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("permission-denied"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"permission-denied",requiresGitHubIntervention:!0});if("review-required"===d.mergeResult)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("review-required"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"review-required",requiresGitHubIntervention:!0});if("conflict"===d.mergeResult)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("merge-conflict"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"merge-conflict",requiresGitHubIntervention:!0});if(d.headShaChangesAfterValidation&&k!==j)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"waiting-for-checks",workflowStatus:g,message:aH("mergeability-pending"),prUrl:h,prNumber:i,validatedHeadSha:k,blockedCategory:"mergeability-pending"});e.verificationPollCount+=1;let f=d.verificationLagSteps??0;if(e.verificationPollCount>f){let e=d.productionWorkflowAfterMerge??a.intendedWorkflowContent;return(a.onProductionWorkflowUpdate?.(e),e===a.intendedWorkflowContent)?(aI.delete(aJ(b,a.finalizeInput.repoConfigId)),aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"complete",workflowStatus:"present",message:"Workflow installed on the production branch.",prUrl:h,prNumber:i,validatedHeadSha:j})):aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:"differs",message:aH("verification-failed"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"verification-failed",canRetry:!0,requiresGitHubIntervention:!0})}return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"verifying",workflowStatus:g,message:"Verifying workflow on the production branch.",prUrl:h,prNumber:i,validatedHeadSha:j,canRetry:!0})}return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"merging",workflowStatus:g,message:"Waiting for workflow install PR merge to complete.",prUrl:h,prNumber:i,validatedHeadSha:j,advancedThisRequest:!1})}({finalizeInput:a,intendedWorkflowContent:c.workflowContent,existingWorkflowContent:this.mutableWorkflowContent,scenario:this.state.finalizationScenario,onProductionWorkflowUpdate:a=>{this.mutableWorkflowContent=a}})}setExistingWorkflowContent(a){this.mutableWorkflowContent=a}async checkHarnessRepoAccess(a){return this.calls.push({method:"checkHarnessRepoAccess",args:[a]}),this.state.harnessRepoAccess??"unknown"}async listHarnessSecretStatuses(a){return this.calls.push({method:"listHarnessSecretStatuses",args:[a]}),V.LY.map(a=>({name:a,status:this.state.harnessSecretStatuses?.[a]??"unknown"}))}async checkTargetWorkflowStatus(a){this.calls.push({method:"checkTargetWorkflowStatus",args:[a]});let b=this.mutableWorkflowContent??this.state.existingWorkflowContent,c="unknown";return c=null==b?"missing":b===a.intendedWorkflowContent?"present":"differs",{repoAccess:this.state.targetRepoAccess??"unknown",workflowStatus:c,productionBranchSha:this.state.productionBranchSha}}async writeHarnessSecrets(a,b){for(let c of(this.calls.push({method:"writeHarnessSecrets",args:[a,b.map(a=>a.name)]}),b))this.encryptedWrites.push({harnessDispatchRepo:a,secretName:c.name,encryptedValue:`encrypted:${c.value.length}`});return this.state.writeHarnessSecretsResult??b.map(a=>({name:a.name,status:this.state.harnessSecretStatuses?.[a.name]==="present"?"updated":"created"}))}async applyTargetWorkflowPr(a){if(this.calls.push({method:"applyTargetWorkflowPr",args:[{...a,workflowContent:`<redacted:${a.workflowContent.length}>`}]}),a.branchName===a.productionBranch)throw Error("Direct production branch writes are not allowed");return this.state.applyTargetWorkflowResult?this.state.applyTargetWorkflowResult:this.state.existingWorkflowContent===a.workflowContent?{outcome:"already-installed",branchName:a.branchName,directProductionBranchWrite:!1}:{outcome:this.state.existingOpenPrUrl?"pr-updated":"pr-created",branchName:a.branchName,prUrl:this.state.existingOpenPrUrl??`https://github.com/${a.targetRepoSlug}/pull/1`,directProductionBranchWrite:!1}}}function aM(a){return 401===a||403===a||404===a?"denied":"unknown"}var aN=c(1913);function aO(a){let[b,c]=a.split("/");if(!b||!c)throw Error(`Invalid GitHub repo slug: ${a}`);return{owner:b,repo:c}}function aP(a,b,c){let d=(0,am.M)(b),e=function(a){let b=a.trim();if(!b.startsWith("{"))return null;try{let a=JSON.parse(b);return"string"==typeof a.message?a:null}catch{return null}}(d),f=e?.message??d;return 403===a&&/workflow/i.test(f)&&(/scope/i.test(f)||/OAuth App/i.test(f))?aN.aR:c?.workflowFileOperation&&404===a&&"Not Found"===f&&e?.documentation_url?.includes("create-or-update-file-contents")===!0?`${aN.aR} (GitHub returned HTTP ${a}: Not Found.)`:e?.message?`GitHub API ${a}: ${e.message}`:d&&!d.startsWith("{")?`GitHub API ${a}: ${d}`:`GitHub API ${a}: request failed`}function aQ(a){return a instanceof an.OS?aP(a.status,a.message):a instanceof Error?(0,am.M)(a.message):(0,am.M)(String(a))}class aR{constructor(a){this.client=a instanceof an.jh?a:new an.jh(a)}async checkHarnessRepoAccess(a){try{let{owner:b,repo:c}=aO(a),d=await this.client.getRepository(b,c);if(d.permissions?.admin===!0||d.permissions?.maintain===!0)return"available";return"denied"}catch(a){if(a instanceof an.OS)return aM(a.status);return"unknown"}}async listHarnessSecretStatuses(a){try{let{owner:b,repo:c}=aO(a),d=await this.client.listActionsSecrets(b,c);return function(a,b){let c=new Set(a);return b.map(a=>({name:a,status:c.has(a)?"present":"missing"}))}(d.secrets.map(a=>a.name),V.LY)}catch(a){if(a instanceof an.OS&&(401===a.status||403===a.status||404===a.status))return V.LY.map(a=>({name:a,status:"unknown"}));throw Error(aQ(a))}}async writeHarnessSecrets(a,b){let{owner:c,repo:d}=aO(a),e=await this.client.getActionsPublicKey(c,d),f=new Set((await this.listHarnessSecretStatuses(a)).filter(a=>"present"===a.status).map(a=>a.name)),g=[];for(let a of b){let b=function(a,b){let c=Buffer.from(a,"utf8"),d=Buffer.from(b,"base64"),e=(0,ao.od)(c,d);return Buffer.from(e).toString("base64")}(a.value,e.key);await this.client.upsertActionsSecret(c,d,a.name,b,e.key_id),g.push({name:a.name,status:f.has(a.name)?"updated":"created"})}return g}async checkTargetWorkflowStatus(a){try{let{owner:b,repo:c}=aO(a.targetRepoSlug),d=await this.client.getRepository(b,c),e=d.permissions?.push===!0||d.permissions?.admin===!0?"available":"denied",f=(await this.client.getBranchRef(b,c,a.productionBranch)).object.sha,g=await this.client.getRepositoryContent(b,c,a.workflowPath,a.productionBranch),h=g?this.client.decodeRepositoryContent(g):null,i=aD(h,a.intendedWorkflowContent);return{repoAccess:e,workflowStatus:i,productionBranchSha:f}}catch(a){if(a instanceof an.OS){if(404===a.status)return{repoAccess:"denied",workflowStatus:"unknown"};return{repoAccess:aM(a.status),workflowStatus:"unknown"}}throw Error(aQ(a))}}async applyTargetWorkflowPr(a){if(a.branchName===a.productionBranch)throw Error("Direct production branch writes are not allowed");let{owner:b,repo:c}=aO(a.targetRepoSlug),d=await this.client.getRepositoryContent(b,c,a.workflowPath,a.productionBranch);if(d&&aC(this.client.decodeRepositoryContent(d))===aC(a.workflowContent))return{outcome:"already-installed",branchName:a.branchName,directProductionBranchWrite:!1};let e=(await this.client.getBranchRef(b,c,a.productionBranch)).object.sha,f=!0;try{await this.client.getBranchRef(b,c,a.branchName)}catch(a){if(a instanceof an.OS&&404===a.status)f=!1;else throw a}f||await this.client.createGitRef(b,c,a.branchName,e);let g=await this.client.getRepositoryContent(b,c,a.workflowPath,a.branchName),h=g?.sha,i=g?this.client.decodeRepositoryContent(g):null;if(i&&aC(i)===aC(a.workflowContent)){let b=await this.findOpenInstallPullRequest(a);return{outcome:b?"pr-updated":"branch-updated",branchName:a.branchName,prUrl:b?.html_url,directProductionBranchWrite:!1}}await this.client.createOrUpdateRepositoryFile({owner:b,repo:c,path:a.workflowPath,branch:a.branchName,message:a.prTitle,content:a.workflowContent,sha:h});let j=await this.findOpenInstallPullRequest(a);if(j)return{outcome:"pr-updated",branchName:a.branchName,prUrl:j.html_url,directProductionBranchWrite:!1};let k=await this.client.createPullRequest({owner:b,repo:c,title:a.prTitle,head:a.branchName,base:a.productionBranch,body:a.prBody});return{outcome:"pr-created",branchName:a.branchName,prUrl:k.html_url,directProductionBranchWrite:!1}}async findOpenInstallPullRequest(a){let{owner:b,repo:c}=aO(a.targetRepoSlug);return(await this.client.listPullRequests(b,c,{state:"open",base:a.productionBranch,head:`${b}:${a.branchName}`}))[0]}}function aS(a){return new aR({token:a})}class aT{constructor(a){this.client=a instanceof an.jh?a:new an.jh(a)}mapRepositoryToMetadata(a,b,c){if("number"!=typeof c.id||!Number.isInteger(c.id)||c.id<=0)throw Error(`GitHub repository metadata for ${a}/${b} is missing a valid numeric repository ID.`);return{repositoryId:c.id,owner:a,repo:b,private:!0===c.private,visibility:c.visibility??(c.private?"private":"public"),isTemplate:!0===c.is_template,defaultBranch:c.default_branch??"main",permissions:{admin:c.permissions?.admin===!0,maintain:c.permissions?.maintain===!0,push:c.permissions?.push===!0}}}async resolveAuthenticatedUser(){let a=await this.client.getAuthenticatedUser();return{id:a.id,login:a.login}}async inspectTokenCapabilities(){let a=await this.client.inspectAuthenticatedUser(),b=(0,aN.dI)(a.tokenType,a.oauthScopes),c="classic"===b&&0===a.oauthScopes.length;return{login:a.login,tokenType:b,hasRepoScope:(0,aN.YN)(a.oauthScopes),hasWorkflowScope:(0,aN.Rd)(a.oauthScopes),scopeAmbiguous:c}}async getRepositoryMetadata(a,b){try{let c=await this.client.getRepository(a,b);return this.mapRepositoryToMetadata(a,b,c)}catch(a){if(a instanceof an.OS&&404===a.status)return null;throw Error(aQ(a))}}async getRepositoryMetadataById(a){try{let b=await this.client.getRepositoryById(a),c=b.full_name;if(!c||!c.includes("/"))throw Error(`GitHub repository ID ${a} returned invalid full_name metadata.`);let[d,e]=c.split("/");if(!d||!e)throw Error(`GitHub repository ID ${a} returned invalid full_name metadata.`);return this.mapRepositoryToMetadata(d,e,b)}catch(a){if(a instanceof an.OS&&404===a.status)return null;throw Error(aQ(a))}}async getRepositoryDefaultBranchHead(a,b,c){return(await this.client.getBranchRef(a,b,c)).object.sha}async readRepositoryFileContent(a,b,c,d){let e=await this.client.getRepositoryContent(a,b,c,d);return e?this.client.decodeRepositoryContent(e):null}async createRepositoryFromTemplate(a){try{let b=await this.client.createRepositoryFromTemplate({templateOwner:a.templateOwner,templateRepo:a.templateRepo,owner:a.owner,name:a.name,description:a.description,private:a.private,includeAllBranches:a.includeAllBranches});return{repositoryId:b.id,fullName:b.full_name,defaultBranch:b.default_branch}}catch(a){throw Error(aQ(a))}}async writeRepositoryFile(a){try{return await this.client.createOrUpdateRepositoryFile({owner:a.owner,repo:a.repo,path:a.path,branch:a.branch,message:a.message,content:a.content,sha:a.sha})}catch(a){throw Error(aQ(a))}}}var aU=c(73024),aV=c(76760),aW=c.n(aV),aX=c(73136);function aY(a=process.env){return"packaged"===function(a=process.env){let b=a.P_DEV_RUNTIME_MODE?.trim().toLowerCase();return"packaged"===b?"packaged":"source"===b||"development"===b?"source":null}(a)}let aZ="P_DEV_PACKAGE_VERSION",a$=/^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/;function a_(a=process.env,b="file:///Users/weston/Code/agentic-product-development-harness/src/p-dev/package-version.ts"){if(aY(a)){var c=a[aZ];let b=c?.trim();if(!b)throw Error(`${aZ} is required in packaged p-dev runtime.`);if(!a$.test(b))throw Error(`${aZ} must be a valid package version string.`);return b}return function(a="file:///Users/weston/Code/agentic-product-development-harness/src/p-dev/package-version.ts"){let b=aW().resolve(aW().dirname((0,aX.fileURLToPath)(a)),"../../package.json"),c=JSON.parse((0,aU.readFileSync)(b,"utf8"));return c.version?.trim()||"0.0.0"}(b)}let a0="weston-uribe",a1="p-dev-harness-template",a2=`${a0}/${a1}`,a3="p-dev-harness",a4=".harness/p-dev-template.json",a5=".harness/p-dev-managed-repo.json",a6="p-dev-harness-template",a7="p-dev",a8="harness-template",a9="harness-workspace";function ba(a){let b;try{b=JSON.parse(a)}catch{return{ok:!1,reason:"Template identity JSON is malformed."}}if(!b||"object"!=typeof b)return{ok:!1,reason:"Template identity JSON is malformed."};let c=b,d=c.schemaVersion,e=c.product,f=c.role,g=c.templateIdentity,h=c.templateVersion,i=c.compatibilityVersion,j=c.templateContentId;if(1!==d)return{ok:!1,reason:`Unsupported template schema version ${String(d)}.`};if(e!==a7)return{ok:!1,reason:`Unexpected template product ${String(e)}.`};if(f!==a8)return{ok:!1,reason:`Unexpected template role ${String(f)}.`};if(g!==a6)return{ok:!1,reason:`Unexpected template identity ${String(g)}.`};if(1!==h)return{ok:!1,reason:`Unsupported template version ${String(h)}.`};if(1!==i)return{ok:!1,reason:`Incompatible template compatibility version ${String(i)}.`};if("string"!=typeof j||!j.trim())return{ok:!1,reason:"Template identity is missing templateContentId."};let k=c.source&&"object"==typeof c.source?c.source:void 0;return{ok:!0,identity:{schemaVersion:1,product:a7,role:a8,templateIdentity:a6,templateVersion:1,compatibilityVersion:1,templateContentId:j.trim(),source:k}}}let bb="preview";function bc(a){return a.trim().toLowerCase()}function bd(a){let b=a.trim(),c=b.indexOf("/");if(-1===c)return b.toLowerCase();let d=b.slice(0,c),e=b.slice(c+1);return`${d.trim().toLowerCase()}/${e.trim().toLowerCase()}`}function be(a){var b;return{operationId:a.operationId,authenticatedUserId:a.user.id,authenticatedLogin:bc(a.user.login),destination:bd(a.destination),templateOwner:a0,templateRepo:a1,templateDefaultBranch:a.templateDefaultBranch.trim(),templateHeadSha:a.templateHeadSha.trim(),templateIdentityFingerprint:JSON.stringify({schemaVersion:(b=a.templateIdentity).schemaVersion,product:b.product,role:b.role,templateIdentity:b.templateIdentity,templateVersion:b.templateVersion,compatibilityVersion:b.compatibilityVersion,templateContentId:b.templateContentId}),templateContentId:a.templateIdentity.templateContentId.trim(),classification:a.classification,envBaseline:bd(a.envBaseline||""),pDevVersion:a.pDevVersion.trim(),resumedFromPending:a.resumedFromPending,creationPreviewFingerprint:a.creationPreviewFingerprint}}function bf(a,b,c){let d=a[b];return"string"==typeof d&&d.trim()?{ok:!0,value:d.trim()}:{ok:!1,reason:`Managed marker is missing ${c}.`}}function bg(a,b,c){let d=a[b];return"number"==typeof d&&Number.isFinite(d)?{ok:!0,value:d}:{ok:!1,reason:`Managed marker is missing ${c}.`}}function bh(a){let b,c;try{b=JSON.parse(a)}catch{return{ok:!1,reason:"Managed marker JSON is malformed."}}if(!b||"object"!=typeof b)return{ok:!1,reason:"Managed marker JSON is malformed."};let d=b;if(1!==d.schemaVersion)return{ok:!1,reason:`Unsupported managed marker schema version ${String(d.schemaVersion)}.`};if(d.product!==a7)return{ok:!1,reason:`Unexpected managed marker product ${String(d.product)}.`};if(d.role!==a9)return{ok:!1,reason:`Unexpected managed marker role ${String(d.role)}.`};if("p-dev"!==d.managedBy)return{ok:!1,reason:`Unexpected managedBy value ${String(d.managedBy)}.`};let e=bf(d,"repository","a valid repository slug");if(!e.ok)return{ok:!1,reason:e.reason};if(!e.value.includes("/"))return{ok:!1,reason:"Managed marker is missing a valid repository slug."};let f=bg(d,"markerVersion","markerVersion");if(!f.ok)return{ok:!1,reason:f.reason};if(1!==f.value&&2!==f.value)return{ok:!1,reason:`Unsupported managed marker version ${String(f.value)}.`};if(2===f.value){let a=bg(d,"repositoryId","repositoryId");if(!a.ok)return{ok:!1,reason:a.reason};if(!Number.isInteger(a.value)||a.value<=0)return{ok:!1,reason:"Managed marker repositoryId must be a positive integer."};c=a.value}else if(void 0!==d.repositoryId){let a=bg(d,"repositoryId","repositoryId");if(!a.ok)return{ok:!1,reason:a.reason};c=a.value}let g=d.createdFromTemplate;if(!g||"object"!=typeof g)return{ok:!1,reason:"Managed marker is missing createdFromTemplate metadata."};let h=bf(g,"templateRepository","createdFromTemplate.templateRepository");if(!h.ok)return{ok:!1,reason:h.reason};if(h.value!==a2)return{ok:!1,reason:`Unexpected template repository ${h.value}.`};let i=bf(g,"defaultBranch","createdFromTemplate.defaultBranch");if(!i.ok)return{ok:!1,reason:i.reason};let j=bf(g,"templateIdentity","createdFromTemplate.templateIdentity");if(!j.ok)return{ok:!1,reason:j.reason};if(j.value!==a6)return{ok:!1,reason:`Unexpected template identity ${j.value}.`};let k=bg(g,"templateVersion","createdFromTemplate.templateVersion");if(!k.ok)return{ok:!1,reason:k.reason};if(1!==k.value)return{ok:!1,reason:`Unsupported template version ${String(k.value)}.`};let l=bg(g,"compatibilityVersion","createdFromTemplate.compatibilityVersion");if(!l.ok)return{ok:!1,reason:l.reason};if(1!==l.value)return{ok:!1,reason:`Incompatible managed marker compatibility version ${String(l.value)}.`};let m=bf(g,"templateContentId","createdFromTemplate.templateContentId");if(!m.ok)return{ok:!1,reason:m.reason};let n=bf(g,"sourceHeadSha","createdFromTemplate.sourceHeadSha");return n.ok?{ok:!0,marker:{schemaVersion:1,product:a7,role:a9,managedBy:"p-dev",repository:e.value,repositoryId:c,markerVersion:f.value,operationId:"string"==typeof d.operationId?d.operationId:void 0,createdByGithubUserId:"number"==typeof d.createdByGithubUserId?d.createdByGithubUserId:void 0,createdByLogin:"string"==typeof d.createdByLogin?d.createdByLogin:void 0,pDevVersion:"string"==typeof d.pDevVersion?d.pDevVersion:void 0,createdFromTemplate:{templateRepository:h.value,defaultBranch:i.value,templateIdentity:j.value,templateVersion:k.value,compatibilityVersion:l.value,templateContentId:m.value,sourceHeadSha:n.value}}}:{ok:!1,reason:n.reason}}function bi(a,b,c){if(a.markerVersion<2||void 0===a.repositoryId||!Number.isInteger(a.repositoryId)||a.repositoryId<=0)return{ok:!1,reason:"Managed marker is missing a stable repository ID. Use advanced recovery to reconnect this workspace."};if(c&&c.repositoryId!==a.repositoryId)return{ok:!1,reason:`Managed marker repository ID does not match GitHub metadata for ${b}.`};if(a.repository!==b){if(c&&a.repositoryId===c.repositoryId){let[c]=a.repository.split("/"),[d]=b.split("/");if(c&&d&&c===d)return{ok:!0,renamedFrom:a.repository}}return{ok:!1,reason:`Managed marker repository mismatch for ${b}.`}}return a.createdFromTemplate.templateRepository!==a2?{ok:!1,reason:`Managed marker template repository must be ${a2}.`}:a.createdFromTemplate.templateIdentity!==a6?{ok:!1,reason:`Unexpected managed marker template identity ${a.createdFromTemplate.templateIdentity}.`}:1!==a.createdFromTemplate.templateVersion?{ok:!1,reason:`Unsupported managed marker template version ${a.createdFromTemplate.templateVersion}.`}:1!==a.createdFromTemplate.compatibilityVersion?{ok:!1,reason:`Incompatible managed marker compatibility version ${a.createdFromTemplate.compatibilityVersion}.`}:{ok:!0}}let bj=new Map;async function bk(a,b){let c,d=bj.get(a)??Promise.resolve(),e=new Promise(a=>{c=a}),f=d.then(()=>e);bj.set(a,f),await d;try{return await b()}finally{c(),bj.get(a)===f&&bj.delete(a)}}function bl(a){let b=(0,k.ym)(a);return aW().join(b.harnessDir,"p-dev-harness-provisioning.pending.json")}async function bm(a){try{let b=await (0,f.readFile)(bl(a),"utf8"),c=JSON.parse(b);if("string"!=typeof c.operationId||"number"!=typeof c.authenticatedUserId||"string"!=typeof c.previewFingerprint)return null;return c}catch{return null}}async function bn(a,b){let c=bl(b);await (0,f.mkdir)(aW().dirname(c),{recursive:!0});let d=`${c}.${process.pid}.${Date.now()}.tmp`;await (0,f.writeFile)(d,`${JSON.stringify(a,null,2)}
-`,"utf8"),await (0,f.rename)(d,c)}async function bo(a){try{await (0,f.rm)(bl(a),{force:!0})}catch{}}function bp(a,b){return void 0!==b.operationId&&a.operationId!==b.operationId?{ok:!1,reason:"Pending provisioning operation ID does not match."}:a.authenticatedUserId!==b.authenticatedUserId?{ok:!1,reason:"Pending provisioning authenticated user ID does not match."}:a.authenticatedLogin!==b.authenticatedLogin?{ok:!1,reason:"Pending provisioning authenticated login does not match."}:a.targetOwner!==b.targetOwner?{ok:!1,reason:"Pending provisioning target owner does not match."}:a.targetRepo!==b.targetRepo?{ok:!1,reason:"Pending provisioning target repository does not match."}:a.templateOwner!==b.templateOwner?{ok:!1,reason:"Pending provisioning template owner does not match."}:a.templateRepo!==b.templateRepo?{ok:!1,reason:"Pending provisioning template repository does not match."}:a.templateIdentity!==b.templateIdentity?{ok:!1,reason:"Pending provisioning template identity does not match."}:a.templateVersion!==b.templateVersion?{ok:!1,reason:"Pending provisioning template version does not match."}:a.compatibilityVersion!==b.compatibilityVersion?{ok:!1,reason:"Pending provisioning compatibility version does not match."}:a.templateContentId!==b.templateContentId?{ok:!1,reason:"Pending provisioning template content ID does not match."}:a.templateDefaultBranch!==b.templateDefaultBranch?{ok:!1,reason:"Pending provisioning template default branch does not match."}:a.templateHeadSha!==b.templateHeadSha?{ok:!1,reason:"Pending provisioning template HEAD SHA does not match."}:void 0!==b.previewFingerprint&&a.previewFingerprint!==b.previewFingerprint?{ok:!1,reason:"Pending provisioning creation fingerprint does not match."}:{ok:!0}}function bq(a){return{operationId:a.operationId,authenticatedUserId:a.authenticatedUserId,authenticatedLogin:a.authenticatedLogin,targetOwner:a.targetOwner,targetRepo:a.targetRepo,templateOwner:a0,templateRepo:a1,templateIdentity:a.templateIdentity,templateVersion:a.templateVersion,compatibilityVersion:a.compatibilityVersion,templateContentId:a.templateContentId,templateDefaultBranch:a.templateDefaultBranch,templateHeadSha:a.templateHeadSha,previewFingerprint:a.previewFingerprint}}function br(a){return JSON.stringify(a)}function bs(a){return`${a}/${a3}`}function bt(a){let b=a?.values.GITHUB_DISPATCH_REPOSITORY_ID?.trim();if(!b)return null;let c=Number(b);return!Number.isInteger(c)||c<=0?null:c}async function bu(a){if(a.requestedOperationId){let b=await bm(a.cwd);return b&&b.operationId!==a.requestedOperationId?{ok:!1,state:"concurrent-request-recovered",message:"Another provisioning operation is already in progress for this workspace."}:{ok:!0,operationId:a.requestedOperationId,resumedFromPending:!!b,creationPreviewFingerprint:b?.previewFingerprint??null,pending:b}}let b=await bm(a.cwd);if(!b)return{ok:!0,operationId:(0,d.randomUUID)(),resumedFromPending:!1,creationPreviewFingerprint:null,pending:null};let c=bp(b,bq({authenticatedUserId:a.user.id,authenticatedLogin:a.user.login,targetOwner:a.user.login,targetRepo:a3,templateIdentity:a.templatePreview.identity.identity.templateIdentity,templateVersion:a.templatePreview.identity.identity.templateVersion,compatibilityVersion:a.templatePreview.identity.identity.compatibilityVersion,templateContentId:a.templatePreview.identity.identity.templateContentId,templateDefaultBranch:a.templatePreview.defaultBranch,templateHeadSha:a.templatePreview.headSha}));return c.ok?{ok:!0,operationId:b.operationId,resumedFromPending:!0,creationPreviewFingerprint:b.previewFingerprint,pending:b}:{ok:!1,state:"same-name-unmanaged-collision",message:c.reason}}async function bv(a){let b=await a.getRepositoryMetadata(a0,a1);if(!b||!b.isTemplate)return{ok:!1,state:"template-unavailable",message:"The approved p-dev harness template is missing or not marked as a GitHub template."};let c=await a.getRepositoryDefaultBranchHead(a0,a1,b.defaultBranch),d=await a.readRepositoryFileContent(a0,a1,a4,c);if(!d)return{ok:!1,state:"template-identity-missing",message:"Template identity file is missing from the approved template."};let e=ba(d);return e.ok?{ok:!0,defaultBranch:b.defaultBranch,headSha:c,identityRaw:d,identity:e}:{ok:!1,state:"template-identity-invalid",message:e.reason}}async function bw(a,b,c){if("weston-uribe/agentic-product-development-harness"===b)return{ok:!1,state:"explicit-packaged-repo-legacy-source",message:"Saved harness repo points at the public source repo. Use advanced recovery to adopt a private managed workspace."};let d=bd(b),e=null;if(c){if(!(e=await a.getRepositoryMetadataById(c)))return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repository ID ${c} is missing or inaccessible.`};if(d=bd(`${e.owner}/${e.repo}`),bd(b)!==d&&c!==e.repositoryId)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${b} does not match repository ID ${c}.`}}else{let{owner:b,repo:c}=aO(d);e=await a.getRepositoryMetadata(b,c)}if(!e)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${b} is missing or inaccessible.`};if(c&&e.repositoryId!==c)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repository ID does not match GitHub metadata for ${d}.`};if(!e.private||"private"!==e.visibility)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${d} must be private in packaged mode.`};if(!e.permissions.admin)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${d} requires admin access.`};let f=await a.readRepositoryFileContent(e.owner,e.repo,a5,e.defaultBranch);if(!f)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${d} is missing a compatible managed marker.`};let g=bh(f);if(!g.ok)return{ok:!1,state:"explicit-packaged-repo-invalid",message:g.reason};let h=bi(g.marker,d,{repositoryId:e.repositoryId});return h.ok?{ok:!0,repoSlug:d,repositoryId:e.repositoryId,marker:g}:{ok:!1,state:"explicit-packaged-repo-invalid",message:h.reason}}async function bx(a,b,c,d){let e=bs(b.login),{owner:f,repo:g}=aO(e),h=await a.getRepositoryMetadata(f,g);if(!h)return{kind:"absent"};if(!h.private||"private"!==h.visibility)return{kind:"public-collision"};if(!h.permissions.admin)return{kind:"unmanaged-collision"};let i=await a.readRepositoryFileContent(f,g,a5,h.defaultBranch);if(i){let a=bh(i);if(!a.ok)return{kind:"malformed-marker",reason:a.reason};let b=bi(a.marker,e,{repositoryId:h.repositoryId});return b.ok?{kind:"valid-managed",repoSlug:e,repositoryId:h.repositoryId}:{kind:"malformed-marker",reason:b.reason}}let j=await a.readRepositoryFileContent(f,g,a4,h.defaultBranch);if(j){let a=ba(j);if(!a.ok)return{kind:"malformed-marker",reason:`Generated repository template identity is invalid: ${a.reason}`};let e=await bm(c);if(e&&d){var k;let c=bp(e,bq({authenticatedUserId:b.id,authenticatedLogin:b.login,targetOwner:b.login,targetRepo:a3,templateIdentity:d.identity.identity.templateIdentity,templateVersion:d.identity.identity.templateVersion,compatibilityVersion:d.identity.identity.compatibilityVersion,templateContentId:d.identity.identity.templateContentId,templateDefaultBranch:d.defaultBranch,templateHeadSha:d.headSha}));if(c.ok&&(k=a.identity,e.templateIdentity===k.templateIdentity&&e.templateVersion===k.templateVersion&&e.compatibilityVersion===k.compatibilityVersion&&e.templateContentId===k.templateContentId))return{kind:"template-only-with-pending"};if(!c.ok)return{kind:"unmanaged-collision"}}return{kind:"template-only-without-pending"}}return{kind:"unmanaged-collision"}}async function by(a,b,c){let{owner:d,repo:e}=aO(b),{timeoutMs:f,initialDelayMs:g,maxDelayMs:h}={timeoutMs:Number(process.env.HARNESS_PROVISIONING_POLL_TIMEOUT_MS??6e4),initialDelayMs:Number(process.env.HARNESS_PROVISIONING_POLL_INITIAL_DELAY_MS??1e3),maxDelayMs:Number(process.env.HARNESS_PROVISIONING_POLL_MAX_DELAY_MS??8e3)},i=Date.now(),j=g;for(;Date.now()-i<f;){let b=await a.getRepositoryMetadata(d,e);if(b?.private&&b.permissions.admin){let f=await a.readRepositoryFileContent(d,e,a4,b.defaultBranch);if(f){let a=ba(f);if(a.ok&&a.identity.templateContentId===c)return{ok:!0,defaultBranch:b.defaultBranch,repositoryId:b.repositoryId,identity:a}}}await function(a){return new Promise(b=>setTimeout(b,a))}(j),j=Math.min(2*j,h)}return{ok:!1,timedOut:!0,message:"Timed out waiting for the generated harness workspace to become ready. Retry Step 1 Continue."}}async function bz(a,b){let{owner:c,repo:d}=aO(b.repoSlug),e=await a.getRepositoryMetadata(c,d);if(!e)return{ok:!1,message:`Generated harness workspace ${b.repoSlug} is not accessible for marker finalization.`};if(e.repositoryId!==b.repositoryId)return{ok:!1,message:`Generated harness workspace repository ID mismatch for ${b.repoSlug}.`};let f=function(a){if(!Number.isInteger(a.repositoryId)||a.repositoryId<=0)throw Error("Managed marker requires a positive integer repositoryId.");return{schemaVersion:1,product:a7,role:a9,managedBy:"p-dev",repository:a.repository,repositoryId:a.repositoryId,markerVersion:2,operationId:a.operationId,createdByGithubUserId:a.createdByGithubUserId,createdByLogin:a.createdByLogin,pDevVersion:a.pDevVersion,createdFromTemplate:{templateRepository:a2,defaultBranch:a.defaultBranch,templateIdentity:a.templateIdentity.templateIdentity,templateVersion:a.templateIdentity.templateVersion,compatibilityVersion:a.templateIdentity.compatibilityVersion,templateContentId:a.templateIdentity.templateContentId,sourceHeadSha:a.sourceHeadSha}}}({repository:b.repoSlug,repositoryId:b.repositoryId,templateIdentity:b.templateIdentity.identity,defaultBranch:b.defaultBranch,sourceHeadSha:b.templateHeadSha,operationId:b.operationId,createdByGithubUserId:b.user.id,createdByLogin:b.user.login,pDevVersion:b.pDevVersion}),g=await a.readRepositoryFileContent(c,d,a5,b.defaultBranch);if(g){var h,i;let a=bh(g);return a.ok?(h=a.marker,h.repository===f.repository&&h.repositoryId===f.repositoryId&&h.operationId===f.operationId&&h.createdFromTemplate.templateIdentity===f.createdFromTemplate.templateIdentity&&h.createdFromTemplate.compatibilityVersion===f.createdFromTemplate.compatibilityVersion&&h.createdFromTemplate.templateContentId===f.createdFromTemplate.templateContentId&&h.createdFromTemplate.sourceHeadSha===f.createdFromTemplate.sourceHeadSha||(i=a.marker,bi(i,b.repoSlug,{repositoryId:b.repositoryId}).ok))?{ok:!0}:{ok:!1,message:"Existing managed marker belongs to a different operation or repository."}:{ok:!1,message:a.reason}}try{await a.writeRepositoryFile({owner:c,repo:d,path:a5,branch:b.defaultBranch,message:"Initialize p-dev managed harness workspace marker",content:`${JSON.stringify(f,null,2)}
-`})}catch(a){return{ok:!1,message:a instanceof Error?a.message:"Failed to write managed harness workspace marker."}}return{ok:!0}}async function bA(a){let b=aY()?"packaged":process.env.P_DEV_RUNTIME_MODE?.trim()?"source":"unknown",c=(0,k.ym)(a.cwd),d=await (0,h.Hn)(c),e=d?.values.GITHUB_DISPATCH_REPOSITORY?.trim(),f=await bm(a.cwd),g={runtimeMode:b,harnessDispatchRepo:e??null,authenticatedLogin:null,verifiedSavedRepo:!1,connectedAutomatically:!1};if(!aY())return{...g,eligible:!1,state:"source"===b?"skipped-source-mode":"skipped-not-packaged",message:"source"===b?"Source mode does not auto-provision a harness workspace.":"Packaged runtime mode is not active.",recoverable:!1};if(f)return{...g,eligible:!0,state:"repo-created-pending-verification",message:"Harness workspace provisioning is incomplete. Retry Step 1 Continue to resume.",recoverable:!0};if(!e)return{...g,eligible:!0,state:"repo-absent",message:"Packaged workspace provisioning has not completed yet.",recoverable:!0};if(!a.provider)return{...g,eligible:!0,state:"explicit-repo-present",message:`Saved harness workspace ${e} requires server validation.`,recoverable:!0};let i=await a.provider.inspectTokenCapabilities(),j=await bw(a.provider,e,bt(d));if(!j.ok)return{...g,eligible:!0,state:j.state,authenticatedLogin:i.login,message:j.message,recoverable:!0};let l=e===bs(i.login)||e===bs(j.marker.marker.createdByLogin??"");return{...g,eligible:!0,state:"verified-and-persisted",harnessDispatchRepo:e,authenticatedLogin:i.login,message:`Connected to validated harness workspace ${e}.`,recoverable:!1,verifiedSavedRepo:!0,connectedAutomatically:l&&!!j.marker.marker.operationId}}async function bB(a){var b,c;if(!aY())return{state:"skipped-not-packaged",fingerprint:br({action:"preview",skipped:!0}),operationId:a.operationId??(0,d.randomUUID)(),creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:null,authenticatedLogin:null,templateOwner:a0,templateRepo:a1,templateDefaultBranch:"main",templateHeadSha:"",templateContentId:null,message:"Packaged runtime mode is not active.",recoverable:!1,willCreateRepository:!1,tokenCapabilities:{tokenType:"unknown",hasRepoScope:!1,hasWorkflowScope:!1,scopeAmbiguous:!0}};let e=(0,k.ym)(a.cwd),f=await (0,h.Hn)(e),g=f?.values.GITHUB_DISPATCH_REPOSITORY?.trim(),i=a_(),j=await a.provider.inspectTokenCapabilities(),l={login:j.login,tokenType:j.tokenType,oauthScopes:[],hasRepoScope:j.hasRepoScope,hasWorkflowScope:j.hasWorkflowScope},m=(0,aN.Z6)({...l,oauthScopes:j.scopeAmbiguous||"classic"!==j.tokenType?[]:[...j.hasRepoScope?["repo"]:[],...j.hasWorkflowScope?["workflow"]:[]]});if(j.scopeAmbiguous){let b=a.operationId??(0,d.randomUUID)();return{state:"token-scope-ambiguous",fingerprint:br({action:"preview",operationId:b}),operationId:b,creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:g??null,authenticatedLogin:j.login,templateOwner:a0,templateRepo:a1,templateDefaultBranch:"main",templateHeadSha:"",templateContentId:null,message:m.ok?"Token scope metadata is ambiguous.":m.message,recoverable:!0,willCreateRepository:!1,tokenCapabilities:{tokenType:j.tokenType,hasRepoScope:j.hasRepoScope,hasWorkflowScope:j.hasWorkflowScope,scopeAmbiguous:j.scopeAmbiguous}}}if(!m.ok){let b="fine-grained"===j.tokenType?"token-unsupported":"unknown"===j.tokenType?"token-scope-ambiguous":"token-insufficient",c=a.operationId??(0,d.randomUUID)();return{state:b,fingerprint:br({action:"preview",operationId:c}),operationId:c,creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:g??null,authenticatedLogin:j.login,templateOwner:a0,templateRepo:a1,templateDefaultBranch:"main",templateHeadSha:"",templateContentId:null,message:m.message,recoverable:!0,willCreateRepository:!1,tokenCapabilities:{tokenType:j.tokenType,hasRepoScope:j.hasRepoScope,hasWorkflowScope:j.hasWorkflowScope,scopeAmbiguous:j.scopeAmbiguous}}}let n=await a.provider.resolveAuthenticatedUser();if(g){let b=a.operationId??(0,d.randomUUID)(),c=await bw(a.provider,g,bt(f)),e=br({action:"preview",operationId:b,authenticatedLogin:n.login,explicitRepo:g,pDevVersion:i});return c.ok?{state:"explicit-repo-present",fingerprint:e,operationId:b,creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:g,authenticatedLogin:n.login,templateOwner:a0,templateRepo:a1,templateDefaultBranch:"main",templateHeadSha:"",templateContentId:c.marker.marker.createdFromTemplate.templateContentId,message:`Reconnecting to saved harness workspace ${g}.`,recoverable:!1,willCreateRepository:!1,tokenCapabilities:{tokenType:j.tokenType,hasRepoScope:j.hasRepoScope,hasWorkflowScope:j.hasWorkflowScope,scopeAmbiguous:j.scopeAmbiguous}}:{state:c.state,fingerprint:e,operationId:b,creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:g,authenticatedLogin:n.login,templateOwner:a0,templateRepo:a1,templateDefaultBranch:"main",templateHeadSha:"",templateContentId:null,message:c.message,recoverable:!0,willCreateRepository:!1,tokenCapabilities:{tokenType:j.tokenType,hasRepoScope:j.hasRepoScope,hasWorkflowScope:j.hasWorkflowScope,scopeAmbiguous:j.scopeAmbiguous}}}let o=await bv(a.provider);if(!o.ok){let b=a.operationId??(0,d.randomUUID)();return{state:o.state,fingerprint:br({action:"preview",operationId:b}),operationId:b,creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:null,authenticatedLogin:n.login,templateOwner:a0,templateRepo:a1,templateDefaultBranch:"main",templateHeadSha:"",templateContentId:null,message:o.message,recoverable:!1,willCreateRepository:!1,tokenCapabilities:{tokenType:j.tokenType,hasRepoScope:j.hasRepoScope,hasWorkflowScope:j.hasWorkflowScope,scopeAmbiguous:j.scopeAmbiguous}}}let p=await bu({cwd:a.cwd,requestedOperationId:a.operationId,user:n,templatePreview:o});if(!p.ok)return{state:p.state,fingerprint:br({action:"preview",conflict:p.message}),operationId:a.operationId??(0,d.randomUUID)(),creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:null,authenticatedLogin:n.login,templateOwner:a0,templateRepo:a1,templateDefaultBranch:o.defaultBranch,templateHeadSha:o.headSha,templateContentId:o.identity.identity.templateContentId,message:p.message,recoverable:!0,willCreateRepository:!1,tokenCapabilities:{tokenType:j.tokenType,hasRepoScope:j.hasRepoScope,hasWorkflowScope:j.hasWorkflowScope,scopeAmbiguous:j.scopeAmbiguous}};let{operationId:q,resumedFromPending:r,creationPreviewFingerprint:s}=p,t=bs(n.login),u=await bx(a.provider,n,a.cwd,o),v="template-preview-ready",w=`p-dev will create or reconnect ${t} as your private harness workspace.`,x=!1;switch(u.kind){case"absent":v="repo-absent",x=!0,w=`p-dev will create private harness workspace ${t} from the approved template.`;break;case"valid-managed":v="valid-existing-managed-repo",w=`Reconnecting to existing managed harness workspace ${t}.`;break;case"public-collision":v="same-name-public-collision",w=`${t} exists but is not private. p-dev will not change it automatically.`;break;case"unmanaged-collision":v="same-name-unmanaged-collision",w=`${t} exists without a compatible managed marker.`;break;case"malformed-marker":v="same-name-malformed-marker",w=u.reason;break;case"template-only-without-pending":v="same-name-template-only-without-pending",w=`${t} looks like an unmanaged generated repo.`;break;case"template-only-with-pending":v="same-name-template-only-with-pending",w=`Resuming marker finalization for ${t}.`}let y=(b={operationId:q,user:n,destination:t,templatePreview:o,classification:u.kind,envBaseline:f?.values.GITHUB_DISPATCH_REPOSITORY??"",pDevVersion:i,resumedFromPending:r,creationPreviewFingerprint:s},JSON.stringify({action:bb,operationId:(c=be({operationId:b.operationId,user:b.user,destination:b.destination,templateDefaultBranch:b.templatePreview.defaultBranch,templateHeadSha:b.templatePreview.headSha,templateIdentity:b.templatePreview.identity.identity,classification:b.classification,envBaseline:b.envBaseline,pDevVersion:b.pDevVersion,resumedFromPending:b.resumedFromPending,creationPreviewFingerprint:b.creationPreviewFingerprint})).operationId,authenticatedUserId:c.authenticatedUserId,authenticatedLogin:c.authenticatedLogin,destination:c.destination,templateOwner:c.templateOwner,templateRepo:c.templateRepo,templateDefaultBranch:c.templateDefaultBranch,templateHeadSha:c.templateHeadSha,templateIdentityFingerprint:c.templateIdentityFingerprint,templateContentId:c.templateContentId,classification:c.classification,envBaseline:c.envBaseline,pDevVersion:c.pDevVersion,resumedFromPending:c.resumedFromPending,creationPreviewFingerprint:c.creationPreviewFingerprint}));return{state:v,fingerprint:y,operationId:q,creationPreviewFingerprint:s,resumedFromPending:r,harnessDispatchRepo:"valid-managed"===u.kind?t:null,authenticatedLogin:n.login,templateOwner:a0,templateRepo:a1,templateDefaultBranch:o.defaultBranch,templateHeadSha:o.headSha,templateContentId:o.identity.identity.templateContentId,message:w,recoverable:"repo-absent"===v||"valid-existing-managed-repo"===v||"same-name-template-only-with-pending"===v,willCreateRepository:x,tokenCapabilities:{tokenType:j.tokenType,hasRepoScope:j.hasRepoScope,hasWorkflowScope:j.hasWorkflowScope,scopeAmbiguous:j.scopeAmbiguous}}}async function bC(a){return bk((0,k.ym)(a.cwd).cwd,async()=>bD(a))}async function bD(a){let b=await bB({cwd:a.cwd,provider:a.provider,operationId:a.operationId});if(!a.confirmed)return{state:b.state,harnessDispatchRepo:b.harnessDispatchRepo,message:"Confirmation is required before provisioning.",recoverable:!0,persisted:!1};if(b.fingerprint!==a.fingerprint)return{state:"template-preview-stale",harnessDispatchRepo:b.harnessDispatchRepo,message:"Provisioning preview is stale. Retry Step 1 Continue.",recoverable:!0,persisted:!1};if("skipped-not-packaged"===b.state||"token-unsupported"===b.state||"token-insufficient"===b.state||"token-scope-ambiguous"===b.state||"template-unavailable"===b.state||"template-identity-missing"===b.state||"template-identity-invalid"===b.state||"template-incompatible"===b.state||"same-name-public-collision"===b.state||"same-name-unmanaged-collision"===b.state||"same-name-malformed-marker"===b.state||"same-name-template-only-without-pending"===b.state||"explicit-packaged-repo-invalid"===b.state||"explicit-packaged-repo-legacy-source"===b.state)return{state:b.state,harnessDispatchRepo:b.harnessDispatchRepo,message:b.message,recoverable:b.recoverable,persisted:!1};let c=await a.provider.resolveAuthenticatedUser(),d=a_(),e=(0,k.ym)(a.cwd),f=await (0,h.Hn)(e),g=f?.values.GITHUB_DISPATCH_REPOSITORY?.trim(),i=g??bs(c.login);if(g){let b=await bw(a.provider,g,bt(f));if(!b.ok)return{state:b.state,harnessDispatchRepo:g,message:b.message,recoverable:!0,persisted:!1};let c=await T({cwd:a.cwd,githubDispatchRepository:b.repoSlug,githubDispatchRepositoryId:b.repositoryId});return"changed"!==c.outcome&&"skipped"!==c.outcome?{state:"created-but-persistence-failed",harnessDispatchRepo:b.repoSlug,message:c.reason??"Failed to persist GITHUB_DISPATCH_REPOSITORY.",recoverable:!0,persisted:!1}:(await bo(a.cwd),{state:"verified-and-persisted",harnessDispatchRepo:b.repoSlug,message:`Connected to saved harness workspace ${b.repoSlug}.`,recoverable:!1,persisted:!0})}let j=await bv(a.provider);if(!j.ok)return{state:j.state,harnessDispatchRepo:null,message:j.message,recoverable:!1,persisted:!1};let l=await bx(a.provider,c,a.cwd,j),m=be({operationId:a.operationId,user:c,destination:bs(c.login),templateDefaultBranch:j.defaultBranch,templateHeadSha:j.headSha,templateIdentity:j.identity.identity,classification:l.kind,envBaseline:f?.values.GITHUB_DISPATCH_REPOSITORY??"",pDevVersion:d,resumedFromPending:b.resumedFromPending,creationPreviewFingerprint:b.creationPreviewFingerprint}),n=function(a){let b=function(a){let b;try{b=JSON.parse(a)}catch{return null}if(!b||"object"!=typeof b)return null;let c=b;return c.action===bb&&"string"==typeof c.operationId&&c.operationId.trim()&&"number"==typeof c.authenticatedUserId&&Number.isFinite(c.authenticatedUserId)&&"string"==typeof c.authenticatedLogin&&c.authenticatedLogin.trim()&&"string"==typeof c.destination&&c.templateOwner===a0&&c.templateRepo===a1&&"string"==typeof c.templateDefaultBranch&&"string"==typeof c.templateHeadSha&&"string"==typeof c.templateIdentityFingerprint&&"string"==typeof c.templateContentId&&"string"==typeof c.classification&&"string"==typeof c.envBaseline&&"string"==typeof c.pDevVersion&&"boolean"==typeof c.resumedFromPending&&(null===c.creationPreviewFingerprint||"string"==typeof c.creationPreviewFingerprint)?{operationId:c.operationId.trim(),authenticatedUserId:c.authenticatedUserId,authenticatedLogin:bc(c.authenticatedLogin),destination:bd(c.destination),templateOwner:a0,templateRepo:a1,templateDefaultBranch:c.templateDefaultBranch.trim(),templateHeadSha:c.templateHeadSha.trim(),templateIdentityFingerprint:c.templateIdentityFingerprint,templateContentId:c.templateContentId.trim(),classification:c.classification,envBaseline:bd(c.envBaseline),pDevVersion:c.pDevVersion.trim(),resumedFromPending:c.resumedFromPending,creationPreviewFingerprint:null===c.creationPreviewFingerprint?null:String(c.creationPreviewFingerprint)}:null}(a.submittedFingerprint);if(!b)return{ok:!1,mismatchedField:"operationId",message:"Provisioning preview fingerprint is invalid. Retry Step 1 Continue."};var c=a.currentContext;for(let[a,d,e]of[["operationId",b.operationId,c.operationId],["authenticatedUserId",b.authenticatedUserId,c.authenticatedUserId],["authenticatedLogin",b.authenticatedLogin,c.authenticatedLogin],["destination",b.destination,c.destination],["templateOwner",b.templateOwner,c.templateOwner],["templateRepo",b.templateRepo,c.templateRepo],["templateDefaultBranch",b.templateDefaultBranch,c.templateDefaultBranch],["templateHeadSha",b.templateHeadSha,c.templateHeadSha],["templateIdentityFingerprint",b.templateIdentityFingerprint,c.templateIdentityFingerprint],["templateContentId",b.templateContentId,c.templateContentId],["classification",b.classification,c.classification],["envBaseline",b.envBaseline,c.envBaseline],["pDevVersion",b.pDevVersion,c.pDevVersion],["resumedFromPending",b.resumedFromPending,c.resumedFromPending],["creationPreviewFingerprint",b.creationPreviewFingerprint,c.creationPreviewFingerprint]]){let b=d!==e?{ok:!1,mismatchedField:a,message:`Provisioning preview is stale (${a} changed). Retry Step 1 Continue.`}:null;if(b)return b}return{ok:!0}}({submittedFingerprint:a.fingerprint,currentContext:m});if(!n.ok)return{state:"template-preview-stale",harnessDispatchRepo:null,message:n.message,recoverable:!0,persisted:!1};let o="valid-managed"===l.kind?l.repositoryId:void 0,p=await bm(a.cwd);if(b.resumedFromPending){if(!p||!b.creationPreviewFingerprint)return{state:"same-name-template-only-without-pending",harnessDispatchRepo:bs(c.login),message:"Matching local pending provisioning evidence is required to resume.",recoverable:!0,persisted:!1};let d=bp(p,bq({operationId:a.operationId,authenticatedUserId:c.id,authenticatedLogin:c.login,targetOwner:c.login,targetRepo:a3,templateIdentity:j.identity.identity.templateIdentity,templateVersion:j.identity.identity.templateVersion,compatibilityVersion:j.identity.identity.compatibilityVersion,templateContentId:j.identity.identity.templateContentId,templateDefaultBranch:j.defaultBranch,templateHeadSha:j.headSha,previewFingerprint:b.creationPreviewFingerprint}));if(!d.ok)return{state:"same-name-unmanaged-collision",harnessDispatchRepo:bs(c.login),message:d.reason,recoverable:!0,persisted:!1}}else if(p&&"valid-existing-managed-repo"!==b.state&&"valid-managed"!==l.kind)return{state:"concurrent-request-recovered",harnessDispatchRepo:null,message:"Another provisioning operation is already in progress for this workspace.",recoverable:!0,persisted:!1};if("valid-managed"===l.kind)i=l.repoSlug;else if("absent"!==l.kind||b.resumedFromPending)if("template-only-with-pending"!==l.kind)return{state:b.state,harnessDispatchRepo:b.harnessDispatchRepo,message:b.message,recoverable:b.recoverable,persisted:!1};else i=bs(c.login);else{let d=b.creationPreviewFingerprint??a.fingerprint;await bn({operationId:a.operationId,authenticatedUserId:c.id,authenticatedLogin:c.login,targetOwner:c.login,targetRepo:a3,templateOwner:a0,templateRepo:a1,templateIdentity:j.identity.identity.templateIdentity,templateVersion:j.identity.identity.templateVersion,compatibilityVersion:j.identity.identity.compatibilityVersion,templateContentId:j.identity.identity.templateContentId,templateDefaultBranch:j.defaultBranch,templateHeadSha:j.headSha,previewFingerprint:d,startedAt:new Date().toISOString()},a.cwd);try{let b=await a.provider.createRepositoryFromTemplate({templateOwner:a0,templateRepo:a1,owner:c.login,name:a3,description:"Private p-dev Product Development Harness workspace",private:!0,includeAllBranches:!1});i=b.fullName,o=b.repositoryId}catch(d){let b=await bx(a.provider,c,a.cwd,j);if("valid-managed"===b.kind||"template-only-with-pending"===b.kind)i=bs(c.login);else{if(!(d instanceof an.OS)||422!==d.status)return{state:"api-timeout-unknown",harnessDispatchRepo:bs(c.login),message:d instanceof Error?d.message:"Repository creation failed unexpectedly.",recoverable:!0,persisted:!1};if("absent"===(await bx(a.provider,c,a.cwd,j)).kind)return{state:"api-timeout-unknown",harnessDispatchRepo:bs(c.login),message:"Repository creation returned an ambiguous result. Retry Step 1 Continue.",recoverable:!0,persisted:!1};i=bs(c.login)}}}let q=await by(a.provider,i,j.identity.identity.templateContentId);if(!q.ok)return{state:q.timedOut?"api-timeout-unknown":"repo-created-pending-verification",harnessDispatchRepo:i,message:q.message,recoverable:!0,persisted:!1};let r=o??q.repositoryId;if(void 0!==o&&o!==q.repositoryId)return{state:"repo-created-pending-verification",harnessDispatchRepo:i,message:`Generated harness workspace repository ID mismatch for ${i}.`,recoverable:!0,persisted:!1};let s=await bz(a.provider,{repoSlug:i,repositoryId:r,defaultBranch:q.defaultBranch,templateIdentity:q.identity,templateHeadSha:p?.templateHeadSha??j.headSha,operationId:a.operationId,user:c,pDevVersion:d});if(!s.ok)return{state:"marker-write-pending",harnessDispatchRepo:i,message:s.message,recoverable:!0,persisted:!1};let t=await T({cwd:a.cwd,githubDispatchRepository:i,githubDispatchRepositoryId:r});return"changed"!==t.outcome&&"skipped"!==t.outcome?{state:"created-but-persistence-failed",harnessDispatchRepo:i,message:t.reason??"Failed to persist GITHUB_DISPATCH_REPOSITORY.",recoverable:!0,persisted:!1}:(await bo(a.cwd),{state:"verified-and-persisted",harnessDispatchRepo:i,message:`Private harness workspace ${i} is connected.`,recoverable:!1,persisted:!0})}function bE(a,b){return(0,j.h4)(a,b)}async function bF(a){let b=[],c=[],d=(0,j.Gn)(a.operatorInput);for(let e of a.secretWritePlan){if("skip"===e.action){c.push(e.name);continue}if("HARNESS_CONFIG_JSON_B64"===e.name){let{bytes:c}=await as(a.cwd),f=at(c);d.push(f),b.push({name:e.name,value:f});continue}let f="LINEAR_API_KEY"===e.name?a.operatorInput?.linearApiKey:"CURSOR_API_KEY"===e.name?a.operatorInput?.cursorApiKey:a.operatorInput?.githubToken;if(!f?.trim()){c.push(e.name);continue}b.push({name:e.name,value:f.trim()})}return{requests:b,skippedSecretNames:c,knownSecrets:d}}async function bG(a){let b,c=await (0,U.z8)({cwd:a.cwd,manualRepo:a.manualHarnessDispatchRepo}),d=(0,U.OW)(c),e="unknown";a.provider&&c.resolved&&(e=await a.provider.checkHarnessRepoAccess(d),b=await a.provider.listHarnessSecretStatuses(d));let f=await av({cwd:a.cwd,operatorInput:a.operatorInput,manualHarnessDispatchRepo:a.manualHarnessDispatchRepo,secretStatuses:b,repoAccess:e}),g=(0,j.Gn)(a.operatorInput),h=f.manualInstructions.map(a=>bE(a,g));return{actionId:V.PN.previewHarnessSecrets.id,harnessDispatchRepo:d,harnessDispatchRepoResolved:c.resolved,harnessDispatchRepoSource:c.source,repoAccess:e,secretStatuses:b??f.secretWritePlan.map(a=>({name:a.name,status:"unknown"})),secretWritePlan:f.secretWritePlan,secretKeyNames:f.secretWritePlan.filter(a=>"skip"!==a.action).map(a=>a.name),fingerprint:f.fingerprint,permission:V.PN.previewHarnessSecrets.permission,manualInstructions:h,validationError:f.validationError?bE(f.validationError,g):void 0}}async function bH(a){(0,V.L6)(a.confirmed),(0,V.xp)(V.PN.applyHarnessSecrets.permission.scope,g.P.remoteSecretWrite.scope);let b=await bG(a);if((0,V.Me)(a.fingerprint,b.fingerprint),b.validationError)throw Error(b.validationError);if(!a.provider)throw Error("GitHub token is required for remote harness secret writes");if(!b.harnessDispatchRepoResolved)throw Error("Harness dispatch repo must be resolved before applying secrets");let{requests:c,skippedSecretNames:d,knownSecrets:e}=await bF({cwd:a.cwd,operatorInput:a.operatorInput,secretWritePlan:b.secretWritePlan});if(0===c.length)throw Error("No harness repo Actions secrets are ready to write");try{let f=await a.provider.writeHarnessSecrets(b.harnessDispatchRepo,c),g={actionId:V.PN.applyHarnessSecrets.id,harnessDispatchRepo:b.harnessDispatchRepo,writtenSecrets:f,skippedSecretNames:d,fingerprint:b.fingerprint,permission:V.PN.applyHarnessSecrets.permission},h=JSON.stringify(g);for(let a of e)if(h.includes(a))throw Error("Remote apply result leaked secret material");return g}catch(a){throw Error(aQ(a))}}async function bI(a){let b,c=await (0,U.z8)({cwd:a.cwd,manualRepo:a.manualHarnessDispatchRepo}),d=aE({repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,harnessDispatchRepo:c}),e=d.plan.workflowStatus,f="unknown";if(a.provider&&"<invalid-target-repo>"!==d.plan.targetRepoSlug){let c=await a.provider.checkTargetWorkflowStatus({targetRepoSlug:d.plan.targetRepoSlug,workflowPath:d.plan.workflowPath,intendedWorkflowContent:d.workflowContent,productionBranch:a.productionBranch});e=c.workflowStatus,f=c.repoAccess,b=c.productionBranchSha}let g=aE({repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,harnessDispatchRepo:c,workflowStatus:e,productionBranchSha:b});return{actionId:V.PN.previewTargetWorkflowPr.id,plan:g.plan,repoAccess:f,workflowPreviewSummary:g.workflowPreviewSummary,fingerprint:g.fingerprint,permission:V.PN.previewTargetWorkflowPr.permission,manualInstructions:g.manualInstructions,validationError:g.validationError}}async function bJ(a){(0,V.L6)(a.confirmed),(0,V.xp)(V.PN.applyTargetWorkflowPr.permission.scope,g.P.remoteRepoWrite.scope);let b=await bI(a);if((0,V.Me)(a.fingerprint,b.fingerprint),b.validationError)throw Error(b.validationError);if(!1!==b.plan.directProductionBranchWrite)throw Error("Direct production branch writes are not allowed");if(!a.provider)throw Error("GitHub token is required for target workflow PR install");try{let c=await a.provider.applyTargetWorkflowPr({targetRepoSlug:b.plan.targetRepoSlug,productionBranch:b.plan.productionBranch,branchName:b.plan.branchName,workflowPath:b.plan.workflowPath,workflowContent:(await aE({repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,harnessDispatchRepo:await (0,U.z8)({cwd:a.cwd,manualRepo:a.manualHarnessDispatchRepo}),workflowStatus:b.plan.workflowStatus})).workflowContent,prTitle:b.plan.prTitle,prBody:b.plan.prBody});return{actionId:V.PN.applyTargetWorkflowPr.id,harnessDispatchRepo:b.plan.harnessDispatchRepo,repoConfigId:b.plan.repoConfigId,outcome:c.outcome,branchName:c.branchName,prUrl:c.prUrl,directProductionBranchWrite:!1,fingerprint:b.fingerprint,permission:V.PN.applyTargetWorkflowPr.permission}}catch(a){throw Error(function(a){if(a instanceof an.OS){let b=aP(a.status,a.message,{workflowFileOperation:!0});return b===aN.aR||b.startsWith(`${aN.aR} `)?`${aN.ge}${b}`:b}return aQ(a)}(a))}}async function bK(a){let b=(0,k.ym)(a?.cwd),c=await (0,h.Hn)(b);return c?.values.GITHUB_TOKEN?.trim()||void 0}function bL(a){return!!a?.trim()}var bM=c(34185);let bN=/pdh-smoke-harness-/i,bO=/pdh-smoke-target-/i;function bP(a){return bO.test(a.trim())}async function bQ(a){let b,c,d=a?.cwd,e=await bK({cwd:d}),f=await (0,U.z8)({cwd:d,manualRepo:a?.manualHarnessDispatchRepo}),g=(0,U.OW)(f),h="unknown",i=[];a?.provider&&f.resolved?(h=await a.provider.checkHarnessRepoAccess(g),i=await a.provider.listHarnessSecretStatuses(g)):i=(await av({cwd:d,manualHarnessDispatchRepo:a?.manualHarnessDispatchRepo})).secretWritePlan.map(a=>({name:a.name,status:"unknown"}));let j=[];try{let e=await (0,q.rL)({baseDir:d});for(let d of(b=e.config.repos.map(a=>({id:a.id,targetRepo:a.targetRepo})),c=e.config.allowedTargetRepos,e.config.repos)){let b=aE({repoConfigId:d.id,targetRepo:d.targetRepo,productionBranch:d.productionBranch??"main",harnessDispatchRepo:f}),c="unknown",e=b.plan.workflowStatus;if(a?.provider&&"<invalid-target-repo>"!==b.plan.targetRepoSlug){let d=await a.provider.checkTargetWorkflowStatus({targetRepoSlug:b.plan.targetRepoSlug,workflowPath:b.plan.workflowPath,intendedWorkflowContent:b.workflowContent,productionBranch:b.plan.productionBranch});c=d.repoAccess,e=d.workflowStatus}j.push({repoConfigId:d.id,targetRepo:d.targetRepo,productionBranch:d.productionBranch??"main",repoAccess:c,workflowStatus:e,harnessDispatchRepo:g})}}catch{}let k=function(a){let b=function(a){var b;let c=[];a.harnessDispatchRepo&&(b=a.harnessDispatchRepo,bN.test(b.trim()))&&c.push({kind:"harness-dispatch",value:a.harnessDispatchRepo,source:"GITHUB_DISPATCH_REPOSITORY"});let d=a.configSummary?.repos??a.targetRepos?.map(a=>({id:a.id,targetRepo:a.targetRepo,baseBranch:"main",productionBranch:"main"}))??[],e=a.configSummary?.allowedTargetRepos??a.allowedTargetRepos??[];for(let a of d)bP(a.targetRepo)&&c.push({kind:"target-repo",value:a.targetRepo,source:`repos[].targetRepo (${a.id})`});for(let a of e)bP(a)&&c.push({kind:"allowed-target-repo",value:a,source:"allowedTargetRepos[]"});return c}(a),c=a.gitRemoteOriginUrl?(0,bM.e)(a.gitRemoteOriginUrl)??void 0:void 0,d=b.find(a=>"harness-dispatch"===a.kind)?.value,e=[...new Set(b.filter(a=>"target-repo"===a.kind||"allowed-target-repo"===a.kind).map(a=>a.value))];return{hasStaleConfig:b.length>0,findings:b,staleHarnessDispatchRepo:d,staleTargetRepos:e,suggestedHarnessDispatchRepo:c}}({harnessDispatchRepo:g,gitRemoteOriginUrl:await (0,U.vE)(d),targetRepos:b,allowedTargetRepos:c});return{githubTokenConfigured:!!e,harnessDispatchRepo:g,harnessDispatchRepoResolved:f.resolved,harnessDispatchRepoSource:f.source,harnessRepoAccess:h,harnessSecretStatuses:i,targetRepos:j,staleSmokeDiagnostics:k}}let bR=new Set(["failure","cancelled","timed_out","action_required"]),bS=new Set(["neutral","skipped","success"]);var bT=c(73928);function bU(a){let b=a.state.toLowerCase(),c=null,d="completed";return"success"===b?c="success":"pending"===b?(c=null,d="queued"):c="failure"===b||"error"===b?"failure":b,{name:a.context,status:d,conclusion:c,detailsUrl:a.target_url}}async function bV(a,b,c){let d=await bW(a,b,c);if(d.merged)return d;if("open"!==d.state)throw Error(`pr_closed: PR ${d.url} is closed but not merged`);return d}async function bW(a,b,c){let d;if(!(0,bT.rc)(b.repoUrl,c))throw Error(`wrong_target_repo: PR repo ${b.repoUrl} does not match expected ${c}`);try{d=await a.getPullRequest(b.owner,b.repo,b.pullNumber)}catch(a){throw a instanceof an.OS&&a.status,a}let e=[];d.merged||(e=await a.getPullRequestFiles(b.owner,b.repo,b.pullNumber));let f=d.head.sha,g=null,h=[];try{h=(g=(await a.getCheckRunsForRef(b.owner,b.repo,f)).check_runs??[]).map(a=>({name:a.name,status:a.status,conclusion:a.conclusion,detailsUrl:a.details_url}))}catch{g=null,h=[]}if(0===h.length)try{let c=await a.getCombinedStatusForRef(b.owner,b.repo,f);h=function(a){if(a.statuses.length>0)return a.statuses.map(bU);let b=a.state.toLowerCase();return"pending"===b?[{name:"combined-status",status:"queued",conclusion:null,detailsUrl:null}]:[{name:"combined-status",status:"completed",conclusion:"success"===b?"success":"failure",detailsUrl:null}]}(c)}catch{}let i=(await a.getIssueComments(b.owner,b.repo,b.pullNumber)).map(a=>({author:a.user?.login??"unknown",body:a.body,createdAt:a.created_at})),j=e.map(a=>({path:a.filename,status:a.status}));return{title:d.title,url:d.html_url,branch:d.head.ref,headSha:d.head.sha,baseBranch:d.base.ref,state:d.state,merged:d.merged,isDraft:!0===d.draft,mergeable:d.mergeable??null,mergeableState:d.mergeable_state??null,rebaseable:d.rebaseable??null,mergeCommitSha:d.merge_commit_sha,mergedAt:d.merged_at,repoUrl:b.repoUrl,changedFiles:j,checks:h,checkSummary:function(a){if(0===a.length)return"No GitHub check runs reported for the PR head commit.";let b=a.filter(a=>"success"===a.conclusion).length,c=a.filter(a=>"failure"===a.conclusion||"cancelled"===a.conclusion).length,d=a.filter(a=>"completed"!==a.status||null===a.conclusion).length,e=[`- Passed: ${b}`,`- Failed: ${c}`,`- Pending/unknown: ${d}`];for(let b of a.filter(a=>"failure"===a.conclusion).slice(0,5))e.push(`- Failed check: ${b.name}${b.detailsUrl?` (${b.detailsUrl})`:""}`);return e.join("\n")}(h),comments:i,rawChecks:g}}function bX(a){let b=a.trim().match(/^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/(\d+)\/?$/);if(!b)return null;let c=b[1],d=b[2];return{owner:c,repo:d,pullNumber:Number.parseInt(b[3],10),repoUrl:`https://github.com/${c}/${d}`}}let bY=new Set,bZ=new Map;async function b$(a,b){if(bY.has(a)){var c;let b=bZ.get(a);if(b)return{result:b,lockContended:!0};await (c=a,bY.has(c)?new Promise(a=>{let b=b_.get(c)??[];b.push(a),b_.set(c,b)}):Promise.resolve());let d=bZ.get(a);if(d)return{result:d,lockContended:!0}}bY.add(a);try{let c=await b();return"object"==typeof c&&null!==c&&"lifecycle"in c&&(bZ.set(a,c),"complete"===c.lifecycle&&bZ.delete(a)),{result:c,lockContended:!1}}finally{bY.delete(a),function(a){let b=b_.get(a)??[];for(let c of(b_.delete(a),b))c()}(a)}}let b_=new Map,b0=new Map;function b1(a,b){return`${a}:${b}`}function b2(a){return{repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,targetRepoSlug:a.targetRepoSlug,productionBranch:a.productionBranch,branchName:a.branchName,lifecycle:"blocked",blockedCategory:a.category,message:a.customMessage??aH(a.category),prUrl:a.prUrl,prNumber:a.prNumber,validatedHeadSha:a.validatedHeadSha,workflowStatus:a.workflowStatus,canRetry:"verification-failed"===a.category,requiresGitHubIntervention:!["checks-pending","mergeability-pending","branch-behind","verification-failed"].includes(a.category),advancedThisRequest:a.advancedThisRequest,lockContended:a.lockContended}}function b3(a){return{repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,targetRepoSlug:a.targetRepoSlug,productionBranch:a.productionBranch,branchName:a.branchName,lifecycle:a.lifecycle,blockedCategory:a.blockedCategory,message:a.message,prUrl:a.prUrl,prNumber:a.prNumber,validatedHeadSha:a.validatedHeadSha,workflowStatus:a.workflowStatus,canRetry:a.canRetry??!1,requiresGitHubIntervention:a.requiresGitHubIntervention??!1,advancedThisRequest:a.advancedThisRequest,lockContended:a.lockContended}}function b4(a){return b0.delete(b1(a.targetRepoSlug,a.repoConfigId)),b3({...a,lifecycle:"complete",workflowStatus:"present",message:"Workflow installed on the production branch.",advancedThisRequest:a.advancedThisRequest,lockContended:a.lockContended})}async function b5(a,b,c,d){let[e,f]=b.split("/"),g=await a.getRepositoryContent(e,f,c,d);return g?a.decodeRepositoryContent(g):null}async function b6(a,b){let[c,d]=b.targetRepoSlug.split("/"),e=(await a.listPullRequests(c,d,{state:"open",base:b.productionBranch,head:`${c}:${b.branchName}`}))[0];return e?{number:e.number,html_url:e.html_url,headSha:e.head.sha}:null}async function b7(a){var b,c;let d,e,{input:f,provider:g,client:h,lockContended:i=!1}=a,j=aw(f.targetRepo);if(!j)return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:"<invalid>",productionBranch:f.productionBranch,branchName:az(f.repoConfigId),category:"unexpected-pr-content",workflowStatus:"unknown",advancedThisRequest:!0,lockContended:i,customMessage:`Invalid target repo URL: ${f.targetRepo}`});let k=f.branchName??az(f.repoConfigId),l=await (0,U.z8)({cwd:a.cwd,manualRepo:f.manualHarnessDispatchRepo}),m=aE({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,productionBranch:f.productionBranch,harnessDispatchRepo:l}).workflowContent,n=(0,U.OW)(l),o=await g.checkTargetWorkflowStatus({targetRepoSlug:j,workflowPath:V.CH,intendedWorkflowContent:m,productionBranch:f.productionBranch});if("present"===o.workflowStatus)return b4({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,advancedThisRequest:!0,lockContended:i});let p=b0.get(b1(j,f.repoConfigId))??{},s=f.prUrl;if(s){let a=bX(s);a&&(d=a.pullNumber)}if(!s){let a=await b6(h,{targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k});a&&(s=a.html_url,d=a.number,e=a.headSha)}if(!s||!d)return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,advancedThisRequest:!0,lockContended:i,customMessage:"No open workflow install PR was found for the deterministic install branch."});let t=bX(s);if(!t)return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,advancedThisRequest:!0,lockContended:i});let u=await bV(h,t,f.targetRepo);if(u.merged){let a=await g.checkTargetWorkflowStatus({targetRepoSlug:j,workflowPath:V.CH,intendedWorkflowContent:m,productionBranch:f.productionBranch});return"present"===a.workflowStatus?b4({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i}):(p.verificationStartedAt??=Date.now(),Date.now()-p.verificationStartedAt>6e4)?(b0.set(b1(j,f.repoConfigId),p),b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"verification-failed",workflowStatus:a.workflowStatus,prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i})):(b0.set(b1(j,f.repoConfigId),p),b3({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"verifying",workflowStatus:a.workflowStatus,message:"Verifying workflow on the production branch.",prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i}))}if(u.branch!==k)return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i});try{(0,ap.$H)({prUrl:s,actualBaseBranch:u.baseBranch,expectedBaseBranch:f.productionBranch})}catch{return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i})}if(u.isDraft&&(await h.markPullRequestReadyForReview(t.owner,t.repo,t.pullNumber),u=await bV(h,t,f.targetRepo)),p.lastValidatedHeadSha=e=u.headSha,b=u.changedFiles,c=V.CH,1!==b.length||b[0]?.path!==c)return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});if("present"!==aD(await b5(h,j,V.CH,u.headSha),m))return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:"Workflow install PR content does not match the harness-generated workflow."});if(!m.includes(n)||!m.includes(`--arg repo ${f.repoConfigId}`))return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});let v=await (0,q.rL)({baseDir:a.cwd}),w=v.config.merge?.mergeMethod??r.nm,x=function(a,b){let c=b.merge?.allowPendingChecks??r.dM,d=b.merge?.allowUnknownChecks??r.Sf,e=b.merge?.allowNeutralChecks??r.R;if(0===a.length)return d?{decision:"allow",classification:null,reason:"No check runs reported; proceeding per allowUnknownChecks",warnings:["No GitHub check runs reported for the PR head commit"]}:{decision:"block",classification:"checks_unknown",reason:"No GitHub check runs reported for the PR head commit",warnings:[]};let f=a.filter(a=>null!==a.conclusion&&bR.has(a.conclusion));if(f.length>0)return{decision:"block",classification:"checks_failing",reason:`Failing checks: ${f.map(a=>a.name).join(", ")}`,warnings:[]};let g=a.filter(a=>"completed"!==a.status||null===a.conclusion);if(g.length>0)return c?{decision:"allow",classification:null,reason:"Pending checks present; proceeding per allowPendingChecks",warnings:g.map(a=>`Pending check: ${a.name}`)}:{decision:"block",classification:"checks_pending",reason:`Pending checks: ${g.map(a=>a.name).join(", ")}`,warnings:[]};let h=a.filter(a=>null!==a.conclusion&&!bS.has(a.conclusion));return h.length>0&&!e?{decision:"block",classification:"checks_unknown",reason:`Unrecognized check conclusions: ${h.map(a=>`${a.name}=${a.conclusion}`).join(", ")}`,warnings:[]}:{decision:"allow",classification:null,reason:"Checks policy passed",warnings:[]}}(u.checks,v.config);if("block"===x.decision)return"checks_failing"===x.classification?b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"checks-failing",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:(0,am.M)(x.reason)}):(p.checksPendingSince??=Date.now(),Date.now()-p.checksPendingSince>12e4)?(b0.set(b1(j,f.repoConfigId),p),b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"checks-pending",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:"Timed out waiting for GitHub checks on the workflow install PR."})):(b0.set(b1(j,f.repoConfigId),p),b3({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"waiting-for-checks",workflowStatus:o.workflowStatus,message:"Waiting for GitHub checks on the workflow install PR.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,blockedCategory:"checks-pending"}));let y=u.mergeableState?.toLowerCase()??null;if("unknown"===y||null===u.mergeable)return b0.set(b1(j,f.repoConfigId),p),b3({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"waiting-for-checks",workflowStatus:o.workflowStatus,message:"Waiting for GitHub mergeability on the workflow install PR.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,blockedCategory:"mergeability-pending"});if("behind"===y){if(p.branchUpdateAttemptedForHeadSha!==e)try{return await h.updatePullRequestBranch(t.owner,t.repo,t.pullNumber,{expectedHeadSha:e}),p.branchUpdateAttemptedForHeadSha=e,b0.set(b1(j,f.repoConfigId),p),b3({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"updating-branch",workflowStatus:o.workflowStatus,message:"Updating the workflow install branch.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i})}catch(b){let a=aG({error:b});return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:a.category,workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:a.message})}return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"branch-behind",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i})}if("dirty"===y||"blocked"===y)return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"blocked"===y?"review-required":"merge-conflict",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});if(!1===u.mergeable)return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"merge-conflict",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});if(p.mergeAttemptedForHeadSha===e)return b0.set(b1(j,f.repoConfigId),p),b3({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"merging",workflowStatus:o.workflowStatus,message:"Waiting for workflow install PR merge to complete.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!1,lockContended:i});try{await h.mergePullRequest(t.owner,t.repo,t.pullNumber,{mergeMethod:w,commitTitle:aA(),expectedHeadSha:e}),p.mergeAttemptedForHeadSha=e,p.verificationStartedAt=Date.now(),b0.set(b1(j,f.repoConfigId),p)}catch(a){if("pr_already_merged"===aF(a))p.verificationStartedAt??=Date.now(),b0.set(b1(j,f.repoConfigId),p);else{let b=aG({error:a,mergeableState:u.mergeableState,message:a instanceof Error?a.message:String(a)});if(b.waiting)return b0.set(b1(j,f.repoConfigId),p),b3({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"checks-pending"===b.category?"waiting-for-checks":"merging",workflowStatus:o.workflowStatus,message:b.message,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,blockedCategory:b.category});if(a instanceof an.OS&&"github_auth_failure"===aF(a))return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"permission-denied",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});return b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:b.category,workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:b.message})}}let z=await g.checkTargetWorkflowStatus({targetRepoSlug:j,workflowPath:V.CH,intendedWorkflowContent:m,productionBranch:f.productionBranch});return"present"===z.workflowStatus?b4({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i}):(p.verificationStartedAt??=Date.now(),Date.now()-p.verificationStartedAt>6e4)?(b0.set(b1(j,f.repoConfigId),p),b2({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"verification-failed",workflowStatus:z.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:"Workflow install PR merged, but production verification timed out."})):(b0.set(b1(j,f.repoConfigId),p),b3({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"verifying",workflowStatus:z.workflowStatus,message:"Verifying workflow on the production branch.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,canRetry:!0}))}async function b8(a){var b,c;let d=(b=aw(a.input.targetRepo)??a.input.targetRepo,c=a.input.repoConfigId,`${b}:${c}`),{result:e,lockContended:f}=await b$(d,async()=>b7({cwd:a.cwd,input:a.input,provider:a.provider,client:a.client,lockContended:!1}));return{...e,lockContended:f||e.lockContended}}let b9=aW().join(".harness","control-plane-setup.json");function ca(a){let b=(0,k.ym)(a);return aW().join(b.cwd,b9)}async function cb(a){let b=ca(a);try{await (0,f.access)(b);let a=await (0,f.readFile)(b,"utf8"),c=JSON.parse(a);if(1!==c.version)return null;return c}catch{return null}}async function cc(a,b){let c=(0,k.ym)(b);await (0,f.mkdir)(c.harnessDir,{recursive:!0}),await (0,f.writeFile)(ca(b),`${JSON.stringify(a,null,2)}
-`,"utf8")}async function cd(a,b){let c=await cb(b)??{version:1},d={...c,...a,version:1,linear:a.linear??c.linear,vercel:a.vercel??c.vercel};return await cc(d,b),d}async function ce(a,b){return{state:await cb(a),linearTeamKeyFromConfig:b?.configSummary?.linearTeamKey}}var cf=c(96105),cg=c(35966);function ch(a){return new cg.LinearClient({apiKey:a.trim()})}async function ci(a){for(;a.pageInfo?.hasNextPage;)await a.fetchNext();return a.nodes??[]}async function cj(a){try{return((await a.teams()).nodes??[]).map(a=>a.id)}catch{return[]}}async function ck(a){let b=await a.teams();return(await ci(b)).map(a=>({id:a.id,key:a.key??"",name:a.name??""}))}async function cl(a){let b=await a.projects();return Promise.all((await ci(b)).map(async a=>({id:a.id,name:a.name??"",teamIds:await cj(a)})))}async function cm(a,b){let c=await a.workflowStates({filter:{team:{id:{eq:b}}}});return(await ci(c)).map(a=>({id:a.id,name:a.name??"",type:a.type??""}))}async function cn(a){let b=await a.webhooks();return(await ci(b)).map(a=>({id:a.id,url:a.url??"",enabled:a.enabled??!1,resourceTypes:a.resourceTypes??[],teamId:a.teamId??void 0,secret:a.secret??void 0}))}async function co(a,b){let c=await a.createTeam({name:b.name,key:b.key,description:b.description}),d=await c.team;if(!d)throw Error("Linear team creation did not return a team");return{id:d.id,key:d.key??b.key,name:d.name??b.name}}async function cp(a,b){let c=await a.createProject({name:b.name,teamIds:b.teamIds,description:b.description}),d=await c.project;if(!d)throw Error("Linear project creation did not return a project");return{id:d.id,name:d.name??b.name,teamIds:b.teamIds}}async function cq(a,b){let c=await a.createWorkflowState({teamId:b.teamId,name:b.name,type:b.type,color:b.color??"#9CA3AF"}),d=await c.workflowState;if(!d)throw Error("Linear workflow state creation did not return a state");return{id:d.id,name:d.name??b.name,type:d.type??b.type}}async function cr(a,b){let c=await a.createWebhook({url:b.url,label:b.label??"Harness webhook bridge",resourceTypes:["Issue"],teamId:b.teamId,allPublicTeams:!b.teamId||void 0,...b.secret?{secret:b.secret}:{}}),d=await c.webhook;if(!d)throw Error("Linear webhook creation did not return a webhook");let e="string"==typeof d.secret?d.secret??void 0:b.secret;return{id:d.id,url:d.url??b.url,enabled:d.enabled??!0,resourceTypes:d.resourceTypes??["Issue"],teamId:d.teamId??b.teamId,secret:e}}async function cs(a,b){let c=await a.updateWebhook(b.webhookId,{url:b.url,label:b.label??"Harness webhook bridge",resourceTypes:["Issue"],secret:b.secret,enabled:!0}),d=await c.webhook;if(!d)throw Error("Linear webhook update did not return a webhook");return{id:d.id,url:d.url??b.url,enabled:d.enabled??!0,resourceTypes:d.resourceTypes??["Issue"],teamId:d.teamId??void 0,secret:d.secret??b.secret}}function ct(){return{teamCreate:!0,projectCreate:!0,workflowStateCreate:!0,webhookCreate:!0,webhookList:!0}}function cu(a){var b=a?.trim()??"";if(!b)return"";let c=0;for(let a=0;a<b.length;a+=1)c=(c+b.charCodeAt(a))%0x3b9aca07;return`${b.length}:${c}`}let cv={preview:{id:"preview-linear-setup",permission:g.P.remoteRead},apply:{id:"apply-linear-setup",permission:g.P.linearWrite}};function cw(a){return(0,d.createHash)("sha256").update(JSON.stringify(a)).digest("hex").slice(0,16)}function cx(a){return a.trim().toLowerCase()}function cy(a){let b=new Map(a.map(a=>[cx(a.name),a]));return Y().map(a=>{let c=b.get(cx(a.name)),d=!!c,e="skip";return d||(e=a.creatable?"create":"manual"),{name:a.name,category:a.category,role:a.role,present:d,existingType:c?.type,action:e,creatable:a.creatable}})}function cz(a,b){let c=b.teamKey.trim().toLowerCase(),d=cx(b.teamName);return a.find(a=>a.key.trim().toLowerCase()===c)??a.find(a=>cx(a.name)===d)}function cA(a,b){let c=cx(b.projectName);return a.find(a=>cx(a.name)===c&&(!b.teamId||0===a.teamIds.length||a.teamIds.includes(b.teamId)))}async function cB(a){let b,c,d=ct(),e=[],f=[];if(!a.linearApiKey.trim())return{actionId:cv.preview.id,capabilities:d,teams:[],projects:[],workflowStates:[],dispatchTriggerStatuses:W,missingStatuses:Y().filter(a=>a.creatable).map(a=>a.name),createActions:[],manualSteps:["Add LINEAR_API_KEY in Step 1 before previewing Linear setup."],fingerprint:cw({invalid:"missing-linear-key"}),permission:cv.preview.permission,validationError:"LINEAR_API_KEY is required for Linear setup preview."};let g=ch(a.linearApiKey),h=await ck(g),i=await cl(g);if("existing"===a.team.mode){if(!(b=h.find(b=>b.id===a.team.teamId))&&a.team.teamId)return{actionId:cv.preview.id,capabilities:d,teams:h,projects:i,workflowStates:[],dispatchTriggerStatuses:W,missingStatuses:[],createActions:[],manualSteps:[],fingerprint:cw({invalid:"team-not-found"}),permission:cv.preview.permission,validationError:"Selected Linear team was not found."}}else if(a.team.teamName&&a.team.teamKey){let c=cz(h,{teamKey:a.team.teamKey,teamName:a.team.teamName});c?b=c:(f.push({kind:"team",name:`${a.team.teamName} (${a.team.teamKey})`}),b={id:"pending-team",key:a.team.teamKey,name:a.team.teamName})}if("existing"===a.project.mode)c=i.find(b=>b.id===a.project.projectId);else if(a.project.projectName&&b){let d=cA(i,{projectName:a.project.projectName,teamId:"pending-team"===b.id?void 0:b.id});d?c=d:(f.push({kind:"project",name:a.project.projectName}),c={id:"pending-project",name:a.project.projectName,teamIds:"pending-team"===b.id?[]:[b.id]})}let j=[];if(b&&"pending-team"!==b.id)for(let a of j=cy(await cm(g,b.id)))"create"===a.action&&f.push({kind:"workflow-state",name:a.name}),"manual"===a.action&&e.push(`${a.name} is Linear-managed and must be verified manually in the workspace.`),a.present&&a.existingType&&Z(a.name)?.category!==a.existingType&&e.push(`${a.name} exists but uses category ${a.existingType}; harness expects ${Z(a.name)?.category}. Rename manually if needed.`);else if(b)for(let a of j=Y().map(a=>({name:a.name,category:a.category,role:a.role,present:!1,action:a.creatable?"create":"manual",creatable:a.creatable})))"create"===a.action&&f.push({kind:"workflow-state",name:a.name});let k=j.filter(a=>!a.present&&a.creatable).map(a=>a.name),l=cw({actionId:cv.preview.id,team:a.team,project:a.project,workflowStates:j.map(a=>({name:a.name,action:a.action})),linearApiKeyToken:cu(a.linearApiKey)});return{actionId:cv.preview.id,capabilities:d,teams:h,projects:i,selectedTeam:b,selectedProject:c,workflowStates:j,dispatchTriggerStatuses:W,missingStatuses:k,createActions:f,manualSteps:e,fingerprint:l,permission:cv.preview.permission}}async function cC(a){let b=ch(a.linearApiKey),c=await cn(b),d=a.webhookUrl.trim().replace(/\/$/,""),e=c.find(b=>{let c=b.url.trim().replace(/\/$/,"");return(!a.teamId||b.teamId===a.teamId)&&c===d&&b.enabled&&b.resourceTypes.includes("Issue")}),f=[];return e||(f.push(`Create a Linear Issue webhook pointing at ${a.webhookUrl}.`),f.push("Copy the webhook signing secret into Vercel production env var LINEAR_WEBHOOK_SECRET.")),{webhooks:c,matchingWebhook:e,manualSteps:f}}async function cD(a){let b=(0,k.ym)(a.cwd);try{await (0,f.access)(b.configLocal)}catch{return!1}let d=await (0,f.readFile)(b.configLocal,"utf8"),e=cf.k.parse(JSON.parse(d)),g=cf.k.parse({...e,linear:{...e.linear,teamKey:a.teamKey},repos:e.repos.map((b,c)=>0===c?{...b,linearProjects:[a.projectName],linearTeams:[a.teamKey]}:b)}),{writeConfigLocal:h}=await Promise.resolve().then(c.bind(c,19965));return await h({paths:b,content:`${JSON.stringify(g,null,2)}
-`,force:!0}),!0}async function cE(a){let{client:b,teamId:c,created:d,skipped:e}=a,f=async()=>{for(let a of cy(await cm(b,c))){if("create"!==a.action){a.present&&e.push(`status:${a.name}`);continue}let f=Z(a.name);if(f)try{await cq(b,{teamId:c,name:a.name,type:f.category}),d.push(`status:${a.name}`)}catch(d){if(!function(a){let b=a instanceof Error?a.message:"string"==typeof a?a:"";return/duplicate workflow state/i.test(b)}(d)||!(await cm(b,c)).find(b=>cx(b.name)===cx(a.name)))throw d;e.push(`status:${a.name}`)}}};return await f(),cy(await cm(b,c)).every(a=>a.present||!a.creatable)}async function cF(a){let b,c;(0,V.L6)(a.confirmed),(0,V.xp)(cv.apply.permission.scope,g.P.linearWrite.scope);let d=await cB(a.plan);if((0,V.Me)(a.fingerprint,d.fingerprint),d.validationError)throw Error(d.validationError);let e=ch(a.plan.linearApiKey),f=[],h=[];if("create"===a.plan.team.mode){if(!a.plan.team.teamName||!a.plan.team.teamKey)throw Error("New Linear team requires name and key.");let c=cz(await ck(e),{teamKey:a.plan.team.teamKey,teamName:a.plan.team.teamName});c?(b=c,h.push(`team:${b.key}`)):(b=await co(e,{name:a.plan.team.teamName,key:a.plan.team.teamKey}),f.push(`team:${b.key}`))}else{let a=d.selectedTeam;if(!a)throw Error("Selected Linear team is required for apply.");b=a,h.push(`team:${b.key}`)}if("create"===a.plan.project.mode){if(!a.plan.project.projectName)throw Error("New Linear project requires a name.");let d=cA(await cl(e),{projectName:a.plan.project.projectName,teamId:b.id});d?(c=d,h.push(`project:${c.name}`)):(c=await cp(e,{name:a.plan.project.projectName,teamIds:[b.id],description:a.plan.project.description}),f.push(`project:${c.name}`))}else{let a=d.selectedProject;if(!a)throw Error("Selected Linear project is required for apply.");c=a,h.push(`project:${c.name}`)}let i=await cE({client:e,teamId:b.id,created:f,skipped:h}),j={teamMode:a.plan.team.mode,teamId:b.id,teamKey:b.key,teamName:b.name,projectMode:a.plan.project.mode,projectId:c.id,projectName:c.name,statusCoverageComplete:i,appliedFingerprint:d.fingerprint,appliedAt:new Date().toISOString()};await cd({linear:j},a.cwd);let k=await cD({cwd:a.cwd,teamKey:b.key,projectName:c.name});return{actionId:cv.apply.id,team:b,project:c,created:f,skipped:h,statusCoverageComplete:i,verified:!!(b.id&&c.id&&i),fingerprint:d.fingerprint,permission:cv.apply.permission,configUpdated:k}}async function cG(a){let b=(0,k.ym)(a),c=await (0,h.Hn)(b),d=await cb(a);return{capabilities:ct(),controlPlane:d,workspace:function(a){let b=a.state?.linear;return{configured:!!b?.teamKey,teamKey:b?.teamKey,projectName:b?.projectName,statusCoverageComplete:!!(b?.statusCoverageComplete||b?.manualComplete),requiredStatusCount:X.map(a=>a.name).length}}({state:d}),dispatchTriggerStatuses:W,linearApiKeyConfigured:!!c?.presence.LINEAR_API_KEY}}function cH(){return(0,d.randomBytes)(32).toString("hex")}function cI(a){return a.trim().replace(/\/$/,"")}function cJ(a){let b=cI(a.webhookUrl);return a.webhooks.find(c=>{let d=cI(c.url);return(!a.linearTeamId||c.teamId===a.linearTeamId)&&d===b&&c.enabled&&c.resourceTypes.includes("Issue")})}async function cK(a){let b=a.operatorSecret?.trim();if(b)return{secret:b,source:"operator",manualSteps:[]};if(!a.linearApiKey?.trim())return{source:"generated",manualSteps:["Add LINEAR_API_KEY in Step 1 before automated Linear webhook setup can run.","A webhook signing secret will be generated during apply and shown once if manual copy is required."]};let c=ch(a.linearApiKey),d=cJ({webhooks:await cn(c),webhookUrl:a.webhookUrl,linearTeamId:a.linearTeamId});if(d){let a=d.secret?.trim();return a?{secret:a,source:"reused-readable",matchingWebhook:{...d,secret:void 0},manualSteps:["A matching Linear Issue webhook exists. Apply will reuse its known signing secret for verification."]}:{source:"unreadable",matchingWebhook:{...d,secret:void 0},manualSteps:["A matching Linear Issue webhook exists, but its signing secret cannot be read from the Linear API.","Update the Linear webhook signing secret manually to match Vercel LINEAR_WEBHOOK_SECRET, then retry verification.","Apply will not rotate the webhook repeatedly while the secret remains unreadable."]}}return{secret:cH(),source:"generated",manualSteps:["Apply will create a Linear Issue webhook and write the signing secret to Vercel."]}}async function cL(a){if(!a.linearApiKey?.trim())return{mode:"manual-copy",manualSteps:["Add LINEAR_API_KEY in Step 1 before automated Linear webhook setup can run.","A webhook signing secret will be generated during apply and shown once if manual copy is required."]};let b=await cC({linearApiKey:a.linearApiKey,webhookUrl:a.webhookUrl,teamId:a.linearTeamId});return b.matchingWebhook?b.matchingWebhook.secret?.trim()?{mode:"automated",matchingWebhook:b.matchingWebhook,willGenerateOnApply:!1,manualSteps:["A matching Linear Issue webhook already exists. Apply will reuse its known signing secret for verification."]}:{mode:"existing-unverified",matchingWebhook:b.matchingWebhook,willGenerateOnApply:!0,manualSteps:["A matching Linear Issue webhook already exists, but its signing secret cannot be recovered.","Apply will attempt to rotate the existing webhook secret automatically once. If that fails, copy the generated secret into Linear manually."]}:{mode:"automated",willGenerateOnApply:!0,manualSteps:["Apply will create a Linear Issue webhook and write the signing secret to Vercel."]}}async function cM(a){let b=cI(a.previousWebhookUrl),c=cI(a.canonicalWebhookUrl);if(!b||!c||b===c)return{attempted:!1,reconciled:!1,canonicalWebhookExists:!1,matchingPreviousWebhookFound:!1,manualSteps:[]};let d=ch(a.linearApiKey),e=await cn(d),f=cJ({webhooks:e,webhookUrl:b,linearTeamId:a.linearTeamId}),g=cJ({webhooks:e,webhookUrl:c,linearTeamId:a.linearTeamId});if(!f)return{attempted:!0,reconciled:!1,previousWebhookUrl:b,canonicalWebhookExists:!!g,matchingPreviousWebhookFound:!1,manualSteps:["No matching Linear Issue webhook was found at the previously stored webhook URL.","Create or update the Linear webhook manually to point at the canonical production URL, then retry verification."]};if(g)return g.id===f.id?{attempted:!0,reconciled:!0,previousWebhookId:f.id,previousWebhookUrl:b,canonicalWebhookExists:!0,matchingPreviousWebhookFound:!0,manualSteps:[]}:{attempted:!0,reconciled:!1,previousWebhookId:f.id,previousWebhookUrl:b,canonicalWebhookExists:!0,matchingPreviousWebhookFound:!0,manualSteps:["A separate Linear Issue webhook already exists at the canonical production URL.","Consolidate webhook configuration manually before retrying verification."]};try{return await cs(d,{webhookId:f.id,url:c,secret:a.secret.trim()}),{attempted:!0,reconciled:!0,previousWebhookId:f.id,previousWebhookUrl:b,canonicalWebhookExists:!1,matchingPreviousWebhookFound:!0,manualSteps:[]}}catch{return{attempted:!0,reconciled:!1,previousWebhookId:f.id,previousWebhookUrl:b,canonicalWebhookExists:!1,matchingPreviousWebhookFound:!0,manualSteps:["Could not update the existing Linear Issue webhook to the canonical production URL automatically.","Update the Linear webhook URL manually to match the canonical production URL, then retry verification."]}}}async function cN(a){let b=a.mutatePolicy??"setup",c=ch(a.linearApiKey),d=cJ({webhooks:await cn(c),webhookUrl:a.webhookUrl,linearTeamId:a.linearTeamId});if(d){let e=d.secret?.trim();if(e===a.secret.trim())return{webhook:{...d,secret:void 0},secret:a.secret,mode:"automated",manualSteps:[]};if("verify-only"===b)return e?{webhook:{...d,secret:void 0},secret:e,mode:"automated",manualSteps:[]}:{webhook:{...d,secret:void 0},secret:a.secret,mode:"existing-unverified",manualSteps:["Matching Linear webhook exists, but its signing secret cannot be read from the Linear API.","Update the Linear webhook signing secret manually to match Vercel LINEAR_WEBHOOK_SECRET, then retry verification."]};try{return{webhook:{...await cs(c,{webhookId:d.id,url:a.webhookUrl,secret:a.secret}),secret:void 0},secret:a.secret,mode:"automated",manualSteps:[]}}catch{return{webhook:{...d,secret:void 0},secret:a.secret,mode:"existing-unverified",manualSteps:["Matching Linear webhook exists, but its signing secret could not be rotated automatically.","Copy the generated webhook secret into the Linear webhook signing secret field, then retry verification."]}}}if("verify-only"===b||"verify-reconcile-url"===b)return{secret:a.secret,mode:"manual-copy",manualSteps:[`Create a Linear Issue webhook pointing at ${a.webhookUrl}.`,"Retry verification after the webhook exists and its signing secret matches Vercel."]};try{let b=await cr(c,{url:a.webhookUrl,teamId:a.linearTeamId,label:"Harness webhook bridge",secret:a.secret});if(b.secret)return{webhook:{...b,secret:void 0},secret:b.secret,mode:"automated",manualSteps:[]};return{webhook:{...b,secret:void 0},secret:a.secret,mode:"manual-copy",manualSteps:["Linear webhook was created, but the signing secret was not returned by the API.","Copy the generated secret into the Linear webhook signing secret field."]}}catch{return{secret:a.secret,mode:"manual-copy",manualSteps:[`Create a Linear Issue webhook pointing at ${a.webhookUrl}.`,"Copy the generated webhook secret into Linear and confirm when complete."]}}}var cO=c(74590);async function cP(a){var b;let c=a.nowMs??Date.now(),e=function(a){try{let b=new URL(a);return{webhookHost:b.host,webhookPath:b.pathname}}catch{return{}}}(a.webhookUrl),f=JSON.stringify({action:"create",type:"Comment",webhookTimestamp:c,data:{id:"harness-setup-probe"}}),g=(b=a.secret,(0,d.createHmac)("sha256",b).update(f).digest("hex")),h=a.fetchImpl??fetch;try{let b=await h(a.webhookUrl,{method:"POST",headers:{"Content-Type":"application/json","linear-signature":g,"linear-timestamp":String(c),"linear-event":"Comment","linear-delivery":`harness-setup-probe-${c}`},body:f,redirect:"manual"});if(function(a){if(302!==a.status&&307!==a.status&&308!==a.status)return!1;let b=a.headers.get("location")??"";return/vercel\.com\/sso-api/i.test(b)}(b))return{passed:!1,statusCode:b.status,result:"protection_redirect",reason:"Vercel Deployment Protection redirected the webhook endpoint. Disable protection for /api/linear-webhook or allow public access before verifying the bridge.",probedAt:new Date(c).toISOString(),...e};let d=null;try{d=await b.json()}catch{return{passed:!1,statusCode:b.status,result:"error",reason:"Webhook endpoint did not return JSON.",probedAt:new Date(c).toISOString(),...e}}if(401===b.status)return{passed:!1,statusCode:b.status,result:"auth_failed",reason:d.error??"invalid_signature",probedAt:new Date(c).toISOString(),...e};if(404===b.status)return{passed:!1,statusCode:b.status,result:"unreachable",reason:"Webhook route was not found on the production deployment.",probedAt:new Date(c).toISOString(),...e};if(200===b.status&&!1===d.accepted&&"string"==typeof d.reason)return{passed:!0,statusCode:b.status,result:"accepted_ignored",reason:d.reason,probedAt:new Date(c).toISOString(),...e};return{passed:!1,statusCode:b.status,result:"error",reason:"Signed probe was not authentication-accepted and business-ignored.",probedAt:new Date(c).toISOString(),...e}}catch{return{passed:!1,result:"unreachable",reason:"Webhook endpoint could not be reached for signed probe verification.",probedAt:new Date(c).toISOString(),...e}}}function cQ(a){return!a.passed&&"auth_failed"===a.result&&"invalid_signature"===a.reason}async function cR(a){let b=a.listDeployments??cO.bM,c=(await b(a.vercelToken,a.projectId,a.teamId,{state:"READY",limit:5})).find(a=>(0,cO.oN)(a));return c?.id}async function cS(a){let b=a.listDeployments??cO.bM,c=a.triggerRedeploy??cO.b1,d=a.sourceDeploymentId?.trim()??await cR({vercelToken:a.vercelToken,projectId:a.projectId,teamId:a.teamId,listDeployments:b});if(!d)return{status:"no_source_deployment",message:"No READY production deployment was found to redeploy. Deploy the project in Vercel before applying settings."};try{let b=await c(a.vercelToken,{projectName:a.projectName,sourceDeploymentId:d,teamId:a.teamId});return{status:"triggered",sourceDeploymentId:d,newDeploymentId:b.id,state:b.state,readyState:b.readyState,message:"Production redeploy triggered. Waiting for Vercel deployment READY."}}catch(a){return{status:"failed",sourceDeploymentId:d,message:a instanceof Error?a.message:"Vercel production redeploy request failed."}}}async function cT(a){let b=a.getDeployment??cO.V9,c=await b(a.vercelToken,a.newDeploymentId,a.teamId);return(0,cO.oN)(c)?{status:"ready",sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,state:c.state,readyState:c.readyState,message:"Production redeploy completed and deployment is READY."}:!function(a){let b=a.readyState??a.state;return"ERROR"===b||"CANCELED"===b}(c)?Date.now()>Date.parse(a.deadlineAt)?{status:"timeout",sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,state:c.state,readyState:c.readyState,message:"Production redeploy did not reach READY before the timeout. Retry verification after Vercel finishes building."}:{status:"building",sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,state:c.state,readyState:c.readyState,message:"Waiting for Vercel deployment READY…"}:{status:"failed",sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,state:c.state,readyState:c.readyState,message:`Production redeploy failed with state ${c.readyState??c.state}.`}}let cU="LINEAR_WEBHOOK_SECRET";async function cV(a){let b=a.secret.trim();if(!b)return!1;let c=(0,k.ym)(a.cwd),d=await (0,h.ed)(c);if((d?(0,h.Um)(d).values[cU]?.trim():void 0)&&!0!==a.overwriteExisting)return!1;let e=function(a,b){if(null===a)return`# Operator local setup — harness Step 3 generated secret
-# Do not commit .env.local (gitignored).
-
-${cU}=${b}
-`;let c=a.split("\n"),d=[],e=!1;for(let a of c){let c=a.trim();if(!c||c.startsWith("#")){d.push(a);continue}let f=c.indexOf("=");if(-1===f){d.push(a);continue}if(c.slice(0,f).trim()===cU){e=!0,d.push(`${cU}=${b}`);continue}d.push(a)}e||(d.length>0&&""!==d[d.length-1]&&d.push(""),d.push("# --- Harness Step 3 generated secret ---"),d.push(`${cU}=${b}`));let f=d.join("\n");return a.endsWith("\n")&&!f.endsWith("\n")&&(f+="\n"),f}(d,b);return await (0,f.writeFile)(c.envLocal,e,"utf8"),!0}let cW={preview:{id:"preview-vercel-bridge",permission:g.P.remoteRead},apply:{id:"apply-vercel-bridge",permission:g.P.remoteSecretWrite}};function cX(a){return(0,d.createHash)("sha256").update(JSON.stringify(a)).digest("hex").slice(0,16)}function cY(a){return{actionId:cW.preview.id,teamId:a.teamId,teamMode:a.teamMode,teamSlug:a.teamSlug,projectId:a.projectId,projectMode:a.projectMode,projectName:a.projectName,envWritePlan:a.envWritePlan.map(a=>({key:a.key,action:a.action,source:a.source,existingType:a.existingType,desiredType:a.desiredType})),linearWebhookSecretToken:a.willGenerateLinearWebhookSecret?"generate-on-apply":cu(a.linearWebhookSecretFromEnv),githubDispatchTokenToken:cu(a.githubDispatchTokenFromEnv??a.derivedGithubDispatchToken),harnessTeamKey:a.harnessTeamKey??a.derivedHarnessTeamKey??"",vercelTokenToken:cu(a.vercelToken)}}function cZ(a){return a.projectJustCreated?{message:`Project "${a.projectName}" was created in Vercel, but it has no production deployment yet.`,nextSteps:["Deploy or connect the project in Vercel so it has a production URL.","Return here, select the project under Use existing project, and apply again."]}:{message:`Project "${a.projectName}" exists in Vercel but has no production deployment yet.`,nextSteps:["Deploy the project in Vercel before applying settings.","After deployment completes, preview and apply again."]}}function c$(a){let b=a.team?.mode??"existing",c=a.project?.mode??"existing";return{...a,teamId:"existing"===b?a.team?.teamId??a.teamId:a.teamId,projectId:"existing"===c?a.project?.projectId??a.projectId:a.projectId,projectName:"create"===c?a.project?.projectName??a.projectName:a.projectName,team:a.team??{mode:"existing",teamId:a.teamId},project:a.project??{mode:"existing",projectId:a.projectId,projectName:a.projectName}}}async function c_(a){let b,c,d=c$(a);if(!d.vercelToken.trim())return{actionId:cW.preview.id,teams:[],projects:[],deploymentStatus:"missing",endpointReachable:!1,envWritePlan:[],requiredEnvPresence:{LINEAR_WEBHOOK_SECRET:"missing",GITHUB_DISPATCH_TOKEN:"missing",HARNESS_TEAM_KEY:"missing"},linearWebhookVerified:!1,readiness:(0,$.s5)({}),manualSteps:["Add VERCEL_TOKEN in Step 1 before configuring Vercel settings."],fingerprint:cX({invalid:"missing-vercel-token"}),permission:cW.preview.permission,validationError:"VERCEL_TOKEN is required for Vercel settings preview."};let e=function(a){let b=c$(a);if(b.team?.mode==="create"){if(!b.team.teamSlug?.trim())return"New Vercel team requires a team slug."}else b.teamId||b.team?.teamId;if(b.project?.mode==="create"){if(!b.project.projectName?.trim())return"New Vercel project requires a project name."}else if(!b.projectId?.trim())return"Vercel project is required."}(d);if(e)return{actionId:cW.preview.id,teams:[],projects:[],deploymentStatus:"missing",endpointReachable:!1,envWritePlan:[],requiredEnvPresence:{LINEAR_WEBHOOK_SECRET:"missing",GITHUB_DISPATCH_TOKEN:"missing",HARNESS_TEAM_KEY:"missing"},linearWebhookVerified:!1,readiness:(0,$.s5)({}),manualSteps:[e],fingerprint:cX({invalid:"invalid-selection"}),permission:cW.preview.permission,validationError:e};let f=await (0,cO.dk)(d.vercelToken),g=d.team?.mode==="create"?(0,cO.wH)(f,d.team.teamSlug??"")?.id:d.teamId?.trim()?d.teamId:void 0,h=await (0,cO.Eb)(d.vercelToken,g),i=d.project?.mode==="existing"?h.find(a=>a.id===d.projectId)??h.find(a=>a.id===d.project?.projectId):(0,cO.MA)(h,d.project?.projectName??"");if(i||d.project?.mode!=="create"||(i=void 0),!i){let a=d.project?.mode==="create"?[`Project "${d.project?.projectName}" will be created during apply if it does not already exist.`]:["Select or enter the Vercel project for automation and preview checks."];return{actionId:cW.preview.id,teams:f,projects:h,deploymentStatus:d.project?.mode==="create"?"project-will-be-created":"missing",endpointReachable:!1,envWritePlan:[],requiredEnvPresence:{LINEAR_WEBHOOK_SECRET:"missing",GITHUB_DISPATCH_TOKEN:"missing",HARNESS_TEAM_KEY:"missing"},linearWebhookVerified:!1,readiness:(0,$.s5)({}),manualSteps:a,fingerprint:cX({invalid:"missing-project",teamId:g,teamMode:d.team?.mode,teamSlug:d.team?.teamSlug,projectMode:d.project?.mode,projectName:d.project?.projectName}),permission:cW.preview.permission,validationError:d.project?.mode==="create"?void 0:"Vercel project is required."}}let j=await (0,cO.dQ)({vercelToken:d.vercelToken,projectId:i.id,teamId:g,preferredDeploymentId:d.preferredProductionDeploymentId}),k=j?.productionUrl,l=j?.webhookUrl,m=l?"ready":"missing",n=l?void 0:cZ({projectName:i.name,projectJustCreated:d.project?.mode==="create"}),o=l?await (0,cO._i)(l):{reachable:!1},p=await (0,cO.A3)(d.vercelToken,i.id,g),q=new Map(p.map(a=>[a.key,a])),r=(0,cO.FR)(p),s=!1,t=[];if(d.team?.mode!=="create"||g||t.push(`Team "${d.team.teamSlug}" will be created during apply if it does not already exist.`),d.linearApiKey&&l){let a=await cC({linearApiKey:d.linearApiKey,webhookUrl:l,teamId:d.linearTeamId});b=(c=await cL({linearApiKey:d.linearApiKey,webhookUrl:l,linearTeamId:d.linearTeamId})).mode,s=!1,"existing-unverified"===c.mode&&(s=!1),t.push(...a.manualSteps,...c.manualSteps)}else l?t.push("After Vercel env vars are configured, create or verify the Linear Issue webhook."):t.push(n?.message??"No production deployment was found for the selected Vercel project yet. Deploy the project before automation checks can pass.",...n?.nextSteps??[]),b="manual-copy";let u=d.willGenerateLinearWebhookSecret??c?.willGenerateOnApply??!d.envInput?.LINEAR_WEBHOOK_SECRET?.trim(),v=function(a){let b=[],c=new Set(a.existingEnvByKey.keys()),d=b=>{let d=a.envInput?.[b]?.trim();return d?{value:d,source:"operator-input"}:"HARNESS_TEAM_KEY"===b&&a.derivedHarnessTeamKey?.trim()?{value:a.derivedHarnessTeamKey.trim(),source:"derived"}:"GITHUB_DISPATCH_TOKEN"===b&&a.derivedGithubDispatchToken?.trim()?{value:a.derivedGithubDispatchToken.trim(),source:"derived"}:"LINEAR_WEBHOOK_SECRET"===b&&a.willGenerateLinearWebhookSecret?{value:"<generated-on-apply>",source:"generated"}:c.has(b)?{value:void 0,source:"preserve-existing"}:{value:void 0,source:"missing-input"}};for(let e of $.P$){let f=d(e),g=a.existingEnvByKey.get(e),h=(0,cO.iQ)(e);if("preserve-existing"===f.source){b.push({key:e,action:"skip",source:"preserve-existing",existingType:g?.type,desiredType:h});continue}if("missing-input"===f.source||!f.value){b.push({key:e,action:"skip",source:"missing-input",desiredType:h});continue}b.push({key:e,action:c.has(e)?"update":"create",source:f.source,existingType:g?.type,desiredType:g?.type??h})}for(let d of $.ck){let e=a.envInput?.[d]?.trim()??$.vC[d],f=a.existingEnvByKey.get(d),g=(0,cO.iQ)(d);if(!e){b.push({key:d,action:"skip",source:"missing-input",desiredType:g});continue}if(c.has(d)){b.push({key:d,action:"skip",source:"preserve-existing",existingType:f?.type,desiredType:g});continue}b.push({key:d,action:"create",source:a.envInput?.[d]?.trim()?"operator-input":"default",desiredType:g})}return b}({existingEnvByKey:q,envInput:d.envInput,derivedHarnessTeamKey:d.derivedHarnessTeamKey,derivedGithubDispatchToken:d.derivedGithubDispatchToken,willGenerateLinearWebhookSecret:u}),w=d.envInput?.GITHUB_DISPATCH_TOKEN?.trim()?"operator-input":d.derivedGithubDispatchToken?.trim()?"saved-github-token":"missing",x=(0,$.s5)({projectId:i.id,productionUrl:k,webhookUrl:l,endpointReachable:o.reachable,requiredEnvPresence:r,linearWebhookVerified:s,signedProbeVerified:!1,deploymentRedeployRequired:!1}),y=cX(cY({teamId:g,teamMode:d.team?.mode,teamSlug:d.team?.teamSlug,projectId:i.id,projectMode:d.project?.mode,projectName:d.project?.projectName,envWritePlan:v,willGenerateLinearWebhookSecret:u,linearWebhookSecretFromEnv:d.envInput?.LINEAR_WEBHOOK_SECRET,githubDispatchTokenFromEnv:d.envInput?.GITHUB_DISPATCH_TOKEN,derivedGithubDispatchToken:d.derivedGithubDispatchToken,harnessTeamKey:d.envInput?.HARNESS_TEAM_KEY,derivedHarnessTeamKey:d.derivedHarnessTeamKey,vercelToken:d.vercelToken}));return{actionId:cW.preview.id,teams:f,projects:h,selectedProject:i,productionUrl:k,webhookUrl:l,productionUrlSource:j?.source,canonicalDeploymentId:j?.deploymentId,deploymentStatus:m,deploymentRequired:n,endpointReachable:o.reachable,endpointStatusCode:o.statusCode,envWritePlan:v,requiredEnvPresence:r,linearWebhookVerified:s,signedProbeVerified:!1,deploymentRedeployRequired:!1,linearWebhookSecretMode:b,githubDispatchSource:w,readiness:x,manualSteps:t,fingerprint:y,permission:cW.preview.permission}}let c0=/LINEAR_WEBHOOK_SECRET|GITHUB_TOKEN|LINEAR_API_KEY|VERCEL_TOKEN|GITHUB_DISPATCH_TOKEN|linear-signature|signature/i;function c1(a){return c0.test(a)?"[redacted]":a}function c2(a){console.log(`[setup:vercel-bridge] ${JSON.stringify(function(a){let b={event:"vercel_bridge_setup",...a};return a.setupBlockedMessage&&(b.setupBlockedMessage=c1(a.setupBlockedMessage)),a.setupBlockedNextSteps&&(b.setupBlockedNextSteps=a.setupBlockedNextSteps.map(a=>c1(a))),a.message&&(b.message=c1(a.message)),b}(a))}`)}async function c3(a){let b=c$(a.plan);if(b.team?.mode!=="create"){let c=b.teamId?.trim()?b.teamId:void 0,d=await (0,cO.dk)(b.vercelToken),e=c?d.find(a=>a.id===c):void 0;return e?(a.reused.push(`team:${e.slug}`),{teamId:e.id,teamName:e.name,team:{id:e.id,name:e.name,outcome:"reused"}}):{teamId:c}}let c=b.team.teamSlug?.trim();if(!c)throw Error("New Vercel team requires a team slug.");let d=await (0,cO.dk)(b.vercelToken),e=(0,cO.wH)(d,c);if(e)return a.reused.push(`team:${e.slug}`),{teamId:e.id,teamName:e.name,team:{id:e.id,name:e.name,outcome:"reused"}};let f=await (0,cO.ln)(b.vercelToken,{slug:c,name:b.team.teamName});return a.created.push(`team:${f.slug}`),{teamId:f.id,teamName:f.name,team:{id:f.id,name:f.name,outcome:"created"}}}async function c4(a){let b=c$(a.plan),c=await (0,cO.Eb)(b.vercelToken,a.teamId);if(b.project?.mode==="existing"){let d=b.projectId??b.project.projectId,e=c.find(a=>a.id===d);if(!e)throw Error("Selected Vercel project is required for apply.");return a.reused.push(`project:${e.name}`),{project:e,projectResult:{id:e.id,name:e.name,outcome:"reused"}}}let d=b.project?.projectName?.trim();if(!d)throw Error("New Vercel project requires a project name.");let e=(0,cO.MA)(c,d);if(e)return a.reused.push(`project:${e.name}`),{project:e,projectResult:{id:e.id,name:e.name,outcome:"reused"}};let f=await (0,cO.P4)(b.vercelToken,{name:d,teamId:a.teamId});return a.created.push(`project:${f.name}`),{project:f,projectResult:{id:f.id,name:f.name,outcome:"created"}}}function c5(){return{message:"No READY production deployment was found to redeploy after env var changes.",nextSteps:["Deploy the project in Vercel so it has a production deployment.","Return here and apply Vercel settings again."]}}async function c6(a){var b,c,e;let f=[{phase:"writing_env_vars",status:a.baseResult.writtenEnvKeys.length>0?"completed":"failed",message:"Writing Vercel env vars…"},{phase:"verifying_webhook",status:"failed",message:"Initial signed probe failed due to stale deployment."}],g=a.baseResult.writtenEnvKeys.length>0,h=a.signedProbe;if(!g||!cQ(h))return{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!1,productionRedeployStatus:"not_triggered",orchestrationSteps:f.slice(0,1)};let i=await cb(a.applyInput.cwd),j=i?.vercel?.redeployVerification??a.priorSelection.redeployVerification;if(j?.newDeploymentId&&j.fingerprint===a.fingerprint&&!["verified","verify_failed","failed","timeout","no_source_deployment"].includes(j.status))return f.push({phase:"redeploying_production",status:"completed",message:"Redeploying production so new env vars take effect…"}),{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!0,productionRedeployStatus:"building"===j.status?"building":"triggered",setupPending:!0,pollActionId:j.actionId,orchestrationSteps:f};let k=await cR({vercelToken:a.vercelToken,projectId:a.projectId,teamId:a.teamId});if(!((b={writtenEnvKeys:a.baseResult.writtenEnvKeys,signedProbe:h,sourceDeploymentId:k}).writtenEnvKeys.length>0&&cQ(b.signedProbe)&&b.sourceDeploymentId?.trim()))return k?{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!1,productionRedeployStatus:"not_triggered",orchestrationSteps:f.slice(0,1)}:{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!1,productionRedeployStatus:"no_source_deployment",setupBlocked:c5(),orchestrationSteps:f};let l=await cS({vercelToken:a.vercelToken,projectId:a.projectId,projectName:a.projectName,teamId:a.teamId,sourceDeploymentId:k});if("triggered"!==l.status||!l.newDeploymentId){f.push({phase:"redeploying_production",status:"failed",message:l.message??"Redeploying production so new env vars take effect…"});let b="no_source_deployment"===l.status?c5():{message:(c=l.status,e=l.message,"timeout"===c?e??"Automatic production redeploy timed out before READY. Redeploy production in Vercel, then use Retry verification.":"failed"===c?e??"Automatic production redeploy failed. Redeploy production in Vercel, then use Retry verification.":"Redeploy production in Vercel, then use Retry verification (this will not rotate secrets or rewrite env vars)."),nextSteps:["Redeploy production in Vercel manually if needed.","Use Retry verification without rewriting env vars or rotating secrets."]};return c2({phase:"blocked",actionId:cW.apply.id,pollStatus:l.status,projectId:a.projectId,fingerprint:a.fingerprint,setupBlockedMessage:b.message,setupBlockedNextSteps:b.nextSteps}),{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!1,productionRedeployStatus:l.status,setupBlocked:b,orchestrationSteps:f}}let m=function(a){let b=new Date().toISOString();return{actionId:`vercel-redeploy-${(0,d.randomUUID)()}`,projectId:a.projectId,projectName:a.projectName,teamId:a.teamId,webhookUrl:a.webhookUrl,fingerprint:a.fingerprint,fingerprintInputs:a.fingerprintInputs,candidateSecretSource:a.candidateSecretSource,sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,status:"triggered",startedAt:b,updatedAt:b,deadlineAt:new Date(Date.now()+3e5).toISOString(),verifyAttempted:!1,message:a.message??"Production redeploy triggered. Waiting for Vercel deployment READY.",writtenEnvKeys:a.writtenEnvKeys,skippedEnvKeys:a.skippedEnvKeys}}({projectId:a.projectId,projectName:a.projectName,teamId:a.teamId,webhookUrl:a.webhookUrl,fingerprint:a.fingerprint,fingerprintInputs:a.fingerprintInputs,candidateSecretSource:a.baseResult.candidateSecretSource,sourceDeploymentId:l.sourceDeploymentId,newDeploymentId:l.newDeploymentId,message:l.message,writtenEnvKeys:a.baseResult.writtenEnvKeys,skippedEnvKeys:a.baseResult.skippedEnvKeys});return await cd({vercel:{...a.priorSelection,redeployVerification:m}},a.applyInput.cwd),c2({phase:"redeploy_trigger",actionId:m.actionId,pollStatus:"triggered",projectId:a.projectId,projectName:a.projectName,teamId:a.teamId,fingerprint:a.fingerprint,candidateSecretSource:a.baseResult.candidateSecretSource}),f.push({phase:"redeploying_production",status:"completed",message:"Redeploying production so new env vars take effect…"}),{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!0,productionRedeployStatus:"triggered",setupPending:!0,pollActionId:m.actionId,orchestrationSteps:f}}async function c7(a){var b;let c;(0,V.L6)(a.confirmed),(0,V.xp)(cW.apply.permission.scope,g.P.remoteSecretWrite.scope);let e=c$(a.plan);c2({phase:"apply_start",actionId:cW.apply.id,verifyOnly:!0===a.verifyOnly,fingerprint:a.fingerprint,projectId:e.projectId,projectName:e.projectName,teamId:e.teamId});let f=await c_(e);if((0,V.Me)(a.fingerprint,f.fingerprint),f.validationError)throw Error(f.validationError);let h=[],i=[],k=await c3({plan:e,created:h,reused:i}),l=await c4({plan:{...e,teamId:k.teamId,projectId:e.project?.mode==="existing"?e.projectId??e.project?.projectId:void 0},teamId:k.teamId,created:h,reused:i}),m={...e,teamId:k.teamId,projectId:l.project.id,projectName:l.project.name,team:{mode:"existing",teamId:k.teamId??""},project:{mode:"existing",projectId:l.project.id,projectName:l.project.name}},n=await c_(m);if(n.validationError)throw Error(n.validationError);if(!n.selectedProject)throw Error("Vercel project must be selected before apply.");if(!n.webhookUrl){let a="created"===l.projectResult.outcome,b=cZ({projectName:n.selectedProject.name,projectJustCreated:a});return{actionId:cW.apply.id,status:"deployment-required",projectId:n.selectedProject.id,projectName:n.selectedProject.name,team:k.team,project:l.projectResult,writtenEnvKeys:[],skippedEnvKeys:[],linearWebhookSetup:{mode:"manual-copy",manualSteps:b.nextSteps},deploymentRequired:{...b,projectJustCreated:a},verified:!1,signedProbeVerified:!1,deploymentRedeployRequired:!1,fingerprint:n.fingerprint,permission:cW.apply.permission}}let o=await cb(a.cwd),p=!!(o?.vercel?.redeployVerification?.newDeploymentId&&"verified"!==o.vercel.redeployVerification.status&&"verify_failed"!==o.vercel.redeployVerification.status&&"failed"!==o.vercel.redeployVerification.status&&"timeout"!==o.vercel.redeployVerification.status&&"no_source_deployment"!==o.vercel.redeployVerification.status),q=!0===a.verifyOnly||!!(!p&&o?.vercel?.deploymentRedeployRequired&&o.vercel.projectId===n.selectedProject.id&&o.vercel.appliedFingerprint===n.fingerprint),r=o?.vercel?.webhookUrl?.trim(),s=n.webhookUrl?.trim(),t=!!(q&&r&&s&&r!==s),u=await cK({linearApiKey:e.linearApiKey,webhookUrl:n.webhookUrl,linearTeamId:e.linearTeamId,operatorSecret:e.envInput?.LINEAR_WEBHOOK_SECRET}),v=e.verificationLinearWebhookSecret?.trim(),w=!!(v&&(q||e.preserveGeneratedWebhookSecretFingerprint)),x=u.secret;w?x=v:x?.trim()||"generated"!==u.source||(x=cH()),"unreadable"!==u.source||q||x?.trim()||(x=cH()),!q&&x?.trim()&&!w&&("generated"===u.source||"unreadable"===u.source)&&await cV({cwd:a.cwd,secret:x});let y={mode:"manual-copy",manualSteps:u.manualSteps,manualCopySecret:void 0};if(t&&x?.trim()&&w&&e.linearApiKey?.trim()&&(c=await cM({linearApiKey:e.linearApiKey,linearTeamId:e.linearTeamId,previousWebhookUrl:r,canonicalWebhookUrl:s,secret:x}),c2({phase:"linear_webhook_url_reconcile",actionId:cW.apply.id,verifyOnly:!0===a.verifyOnly,projectId:n.selectedProject.id,fingerprint:n.fingerprint,webhookUrlDrift:!0,reconciliationAttempted:c.attempted,reconciliationSucceeded:c.reconciled,matchingPreviousWebhookFound:c.matchingPreviousWebhookFound,canonicalWebhookExists:c.canonicalWebhookExists})),"unreadable"===u.source&&q)y={mode:"existing-unverified",manualSteps:u.manualSteps,manualCopySecret:void 0};else if(c?.attempted&&!c.reconciled)y={mode:"existing-unverified",manualSteps:c.manualSteps,manualCopySecret:void 0};else if(x?.trim())if(e.linearApiKey?.trim()){let a=await cN({linearApiKey:e.linearApiKey,webhookUrl:n.webhookUrl,linearTeamId:e.linearTeamId,secret:x,mutatePolicy:q?"verify-only":"setup"});y={mode:a.mode,manualSteps:a.manualSteps,manualCopySecret:"automated"===a.mode?void 0:a.secret},w||(x=a.secret)}else y={mode:"manual-copy",manualSteps:["Add LINEAR_API_KEY in Step 1 before automated Linear webhook setup can run.","Copy the generated webhook secret into Linear when prompted."],manualCopySecret:x};else y={mode:"manual-copy",manualSteps:u.manualSteps,manualCopySecret:void 0};let z=(0,j.Gn)({linearApiKey:e.linearApiKey,githubToken:e.envInput?.GITHUB_DISPATCH_TOKEN??e.derivedGithubDispatchToken});x?.trim()&&z.push(x),e.envInput?.GITHUB_DISPATCH_TOKEN&&z.push(e.envInput.GITHUB_DISPATCH_TOKEN),e.derivedGithubDispatchToken&&z.push(e.derivedGithubDispatchToken);let A=new Map((await (0,cO.A3)(e.vercelToken,n.selectedProject.id,k.teamId)).map(a=>[a.key,a])),B=!q&&!!x?.trim(),C=[],D=[];for(let a of n.envWritePlan){if("skip"===a.action||"LINEAR_WEBHOOK_SECRET"===a.key&&!B){D.push(a.key);continue}let b=function(a){let b=a.envInput?.[a.key]?.trim();return b||("HARNESS_TEAM_KEY"===a.key&&a.derivedHarnessTeamKey?.trim()?a.derivedHarnessTeamKey.trim():"GITHUB_DISPATCH_TOKEN"===a.key&&a.derivedGithubDispatchToken?.trim()?a.derivedGithubDispatchToken.trim():"LINEAR_WEBHOOK_SECRET"===a.key&&a.generatedLinearWebhookSecret?.trim()?a.generatedLinearWebhookSecret.trim():a.key in $.vC?$.vC[a.key]:void 0)}({key:a.key,envInput:e.envInput,derivedHarnessTeamKey:e.derivedHarnessTeamKey,derivedGithubDispatchToken:e.derivedGithubDispatchToken,generatedLinearWebhookSecret:x});if(!b?.trim()){D.push(a.key);continue}let c=A.get(a.key);try{await (0,cO.wI)(e.vercelToken,{projectId:n.selectedProject.id,teamId:k.teamId,key:a.key,value:b.trim(),existingEnv:c})}catch(a){throw a instanceof cO.c9,a}C.push(a.key)}if(B&&!C.includes("LINEAR_WEBHOOK_SECRET")&&x?.trim()){let a=A.get("LINEAR_WEBHOOK_SECRET");await (0,cO.wI)(e.vercelToken,{projectId:n.selectedProject.id,teamId:k.teamId,key:"LINEAR_WEBHOOK_SECRET",value:x,existingEnv:a}),C.push("LINEAR_WEBHOOK_SECRET")}let E=await (0,cO.A3)(e.vercelToken,n.selectedProject.id,k.teamId),F=(0,cO.FR)(E),G=!1;if(e.linearApiKey?.trim()){let a=await cC({linearApiKey:e.linearApiKey,webhookUrl:n.webhookUrl,teamId:e.linearTeamId});G="automated"===y.mode&&!!a.matchingWebhook}let H=(b={projectId:n.selectedProject.id,linearTeamId:e.linearTeamId,productionUrl:n.productionUrl,webhookUrl:n.webhookUrl,envWritePlan:n.envWritePlan,candidateSecretToken:cu(x)},(0,d.createHash)("sha256").update(JSON.stringify({projectId:b.projectId??"",linearTeamId:b.linearTeamId??"",productionUrl:b.productionUrl??"",webhookUrl:b.webhookUrl??"",envWritePlan:(b.envWritePlan??[]).map(a=>({key:a.key,action:a.action,source:a.source})),candidateSecretToken:b.candidateSecretToken??""})).digest("hex").slice(0,16)),I=x?.trim()?await cP({webhookUrl:n.webhookUrl,secret:x}):{passed:!1,result:"error",reason:"missing_candidate_secret",probedAt:new Date().toISOString()},J=I.passed,K=C.length>0&&!J;c2({phase:"signed_probe",actionId:cW.apply.id,verifyOnly:!0===a.verifyOnly,projectId:n.selectedProject.id,projectName:n.selectedProject.name,teamId:k.teamId,fingerprint:n.fingerprint,candidateSecretSource:u.source,hasLocalWebhookSecret:!!(e.verificationLinearWebhookSecret?.trim()||e.envInput?.LINEAR_WEBHOOK_SECRET?.trim()),envWritePlan:n.envWritePlan.map(a=>({key:a.key,action:a.action,source:a.source})),signedProbeResult:I.result,signedProbeReason:I.reason,signedProbeStatusCode:I.statusCode});let L=$.P$.every(a=>"present"===F[a])&&n.endpointReachable&&G&&J&&!K,M={teamId:k.teamId,teamName:k.teamName,projectId:n.selectedProject.id,projectName:n.selectedProject.name,productionUrl:n.productionUrl??"",webhookUrl:n.webhookUrl??"",endpointReachable:n.endpointReachable,envVarPresence:F,linearWebhookVerified:G,signedProbeVerified:J,signedProbe:I,verificationFingerprint:H,deploymentRedeployRequired:K,appliedFingerprint:n.fingerprint,appliedAt:new Date().toISOString(),manualComplete:a.manualComplete};await cd({vercel:M},a.cwd);let N=JSON.stringify({actionId:cW.apply.id,writtenEnvKeys:C,skippedEnvKeys:D,linearWebhookSetup:{mode:y.mode,manualSteps:y.manualSteps},signedProbeVerified:J,verified:L});for(let a of z)if(N.includes(a))throw Error("Vercel bridge apply result leaked secret material");let O={actionId:cW.apply.id,status:"applied",projectId:n.selectedProject.id,projectName:n.selectedProject.name,team:k.team,project:l.projectResult,writtenEnvKeys:C,skippedEnvKeys:D,linearWebhookSetup:y,signedProbeVerified:J,signedProbeReason:I.reason,signedProbe:I,deploymentRedeployRequired:K,verificationRetry:q,candidateSecretSource:u.source,verified:L,fingerprint:n.fingerprint,permission:cW.apply.permission,envVarsWritten:C.length>0,productionRedeployTriggered:!1,productionRedeployStatus:"not_triggered"};return a.verifyOnly||q||!K||O.verified?(c2({phase:"apply_complete",actionId:cW.apply.id,verifyOnly:!0===a.verifyOnly,projectId:n.selectedProject.id,projectName:n.selectedProject.name,teamId:k.teamId,fingerprint:n.fingerprint,signedProbeResult:I.result,signedProbeReason:I.reason,pollStatus:O.verified?"verified":void 0}),O):(c2({phase:"redeploy_trigger",actionId:cW.apply.id,projectId:n.selectedProject.id,projectName:n.selectedProject.name,teamId:k.teamId,fingerprint:n.fingerprint,candidateSecretSource:u.source,signedProbeResult:I.result,signedProbeReason:I.reason}),c6({applyInput:a,baseResult:O,signedProbe:I,vercelToken:e.vercelToken,projectId:n.selectedProject.id,projectName:n.selectedProject.name,teamId:k.teamId,webhookUrl:n.webhookUrl??"",fingerprint:n.fingerprint,fingerprintInputs:cY({teamId:k.teamId,teamMode:m.team?.mode,teamSlug:m.team?.teamSlug,projectId:n.selectedProject.id,projectMode:m.project?.mode,projectName:m.project?.projectName,envWritePlan:n.envWritePlan,willGenerateLinearWebhookSecret:m.willGenerateLinearWebhookSecret??!m.envInput?.LINEAR_WEBHOOK_SECRET?.trim(),linearWebhookSecretFromEnv:m.envInput?.LINEAR_WEBHOOK_SECRET,githubDispatchTokenFromEnv:m.envInput?.GITHUB_DISPATCH_TOKEN,derivedGithubDispatchToken:m.derivedGithubDispatchToken,harnessTeamKey:m.envInput?.HARNESS_TEAM_KEY,derivedHarnessTeamKey:m.derivedHarnessTeamKey,vercelToken:e.vercelToken}),priorSelection:M}))}var c8=c(39058);async function c9(a){let b=a.githubToken?.trim();if(!b)return{eligible:!1,source:"manual-required",message:"Add GITHUB_TOKEN in Step 1 or provide a dispatch token manually in Step 3."};let c=await (0,U.z8)({cwd:a.cwd});if(!c.resolved||!c.repo)return{eligible:!1,source:"manual-required",message:"Could not resolve the harness dispatch repository. Set GITHUB_DISPATCH_REPOSITORY or verify git remote origin."};let[d,e]=c.repo.split("/");if(!d||!e)return{eligible:!1,source:"manual-required",repository:c.repo,message:"Harness dispatch repository slug is invalid."};try{await (0,c8._u)(b);let a=new an.jh({token:b}),f=await a.getRepository(d,e);if(f.permissions?.push!==!0&&f.permissions?.admin!==!0&&f.permissions?.maintain!==!0)return{eligible:!1,source:"manual-required",repository:c.repo,message:`Saved GITHUB_TOKEN cannot write repository contents for ${c.repo}. repository_dispatch requires Contents write access.`};return{eligible:!0,source:"saved-github-token",repository:c.repo,message:`Saved GITHUB_TOKEN can dispatch to ${c.repo}.`}}catch(b){let a=b instanceof an.OS?`GitHub rejected dispatch token eligibility check (${b.status}).`:b instanceof Error?b.message:"GitHub dispatch token eligibility check failed.";return{eligible:!1,source:"manual-required",repository:c.repo,message:a}}}function da(a){return{message:`Cannot resume redeploy verification because ${a} is missing from saved setup.`,nextSteps:["Return to Step 1 and save the required token in .env.local.","Then use Apply Vercel Settings again to restart verification."]}}async function db(a){let b=a.state.vercel;if(!b)return{ok:!1,setupBlocked:da("saved Vercel selection")};let c=await (0,c8.tl)({cwd:a.cwd,key:"VERCEL_TOKEN"})??"";if(!c.trim())return{ok:!1,setupBlocked:da("VERCEL_TOKEN")};let d=await (0,c8.tl)({cwd:a.cwd,key:"LINEAR_API_KEY"}),e=await (0,c8.tl)({cwd:a.cwd,key:"GITHUB_TOKEN"}),f=await c9({githubToken:e,cwd:a.cwd}),g=a.pending.teamId??b.teamId,h=a.pending.projectId,i=a.pending.projectName,j=await (0,c8.tl)({cwd:a.cwd,key:"LINEAR_WEBHOOK_SECRET"}),k="generated"===a.pending.candidateSecretSource||"unreadable"===a.pending.candidateSecretSource||!!j?.trim();return{ok:!0,plan:c$({vercelToken:c,linearApiKey:d,teamId:g,projectId:h,projectName:i,preferredProductionDeploymentId:a.pending.newDeploymentId,team:{mode:"existing",teamId:g??""},project:{mode:"existing",projectId:h,projectName:i},linearTeamId:a.state.linear?.teamId,derivedHarnessTeamKey:a.state.linear?.teamKey,derivedGithubDispatchToken:f.eligible&&e?e:void 0,willGenerateLinearWebhookSecret:!!k||!j?.trim(),verificationLinearWebhookSecret:j,preserveGeneratedWebhookSecretFingerprint:k}),vercelToken:c}}async function dc(a){let b=await db(a);if(!b.ok)return b;let c=await c_(b.plan);return c.fingerprint!==a.pending.fingerprint?(c2({phase:"poll_reconstruct",actionId:a.pending.actionId,expectedFingerprint:a.pending.fingerprint,reconstructedFingerprint:c.fingerprint,fingerprintMatch:!1,projectId:a.pending.projectId,projectName:a.pending.projectName,teamId:a.pending.teamId}),{ok:!1,setupBlocked:{message:"Persisted Step 3 setup context no longer matches the in-progress redeploy verification.",nextSteps:["Use Apply Vercel Settings again to regenerate preview and restart verification.","If the problem persists, confirm team and project selections match the original apply."]}}):{ok:!0,plan:b.plan,vercelToken:b.vercelToken}}let dd=new Set,de=new Set(["failed","timeout","no_source_deployment","verify_failed","verified"]);function df(a){let b=a.pending??a.vercel.redeployVerification,c=a.retryApply,d=!!b,e=b?function(a){switch(a){case"triggered":return"triggered";case"building":return"building";case"ready":case"verified":case"verify_failed":return"ready";case"failed":return"failed";case"timeout":return"timeout";case"no_source_deployment":return"no_source_deployment";default:return"not_triggered"}}(b.status):"not_triggered",f=a.setupBlocked??(b?.blockedMessage?{message:b.blockedMessage,nextSteps:b.blockedNextSteps??[]}:void 0),h=a.vercel.signedProbe,i=c?.signedProbe,j=c?.signedProbeVerified??a.vercel.signedProbeVerified??!1;return{actionId:b?.actionId??"vercel-bridge-apply",status:"applied",projectId:a.vercel.projectId,projectName:a.vercel.projectName,writtenEnvKeys:a.pending?.writtenEnvKeys??[],skippedEnvKeys:a.pending?.skippedEnvKeys??[],linearWebhookSetup:c?.linearWebhookSetup??{mode:"automated",manualSteps:[]},signedProbeVerified:j,signedProbeReason:c?.signedProbeReason??h?.reason,signedProbe:i??h,deploymentRedeployRequired:a.vercel.deploymentRedeployRequired??!1,verificationRetry:c?.verificationRetry,verified:c?.verified??j,fingerprint:b?.fingerprint??a.vercel.appliedFingerprint??"",permission:c?.permission??g.P.remoteSecretWrite,envVarsWritten:!0,signedProbeInitialResult:h,signedProbeRetryResult:i,productionRedeployTriggered:d,productionRedeployStatus:e,setupBlocked:f,setupPending:!!b&&!de.has(b.status),pollActionId:b?.actionId,orchestrationSteps:function(a){let b=[{phase:"writing_env_vars",status:"completed",message:"Writing Vercel env vars…"}];return a.pending&&("no_source_deployment"===a.pending.status?b.push({phase:"redeploying_production",status:"failed",message:a.pending.message??"No READY production deployment was found to redeploy after env var changes."}):(b.push({phase:"redeploying_production",status:"failed"===a.pending.status||"timeout"===a.pending.status?"failed":("verified"===a.pending.status||"ready"===a.pending.status||a.pending.status,"completed"),message:"building"===a.pending.status||"triggered"===a.pending.status?"Waiting for Vercel deployment READY…":"Redeploying production so new env vars take effect…"}),("verify_failed"===a.pending.status||"verified"===a.pending.status||a.apply?.verificationRetry)&&b.push({phase:"verifying_webhook",status:"verified"===a.pending.status||a.apply?.signedProbeVerified?"completed":"failed",message:"Retrying signed webhook verification…"}))),b}({pending:b,apply:c})}}async function dg(a){var b,c;let d=(b=a.pending.actionId,c=a.cwd,`${c??"default"}:${b}`);if(dd.has(d))return null;dd.add(d);let e=await cb(a.cwd),f=e?.vercel?.redeployVerification;if(!f||f.actionId!==a.pending.actionId||f.verifyAttempted)return dd.delete(d),null;let g={...f,verifyAttempted:!0,updatedAt:new Date().toISOString(),status:"ready"};return await cd({vercel:{...e.vercel,redeployVerification:g}},a.cwd),g}async function dh(a){let b=await cb(a.cwd);if(!b?.vercel)return;let c=new Date().toISOString(),d={...a.pending,status:a.status,updatedAt:c,completedAt:c,message:a.message??a.pending.message,blockedMessage:a.setupBlocked?.message,blockedNextSteps:a.setupBlocked?.nextSteps};await cd({vercel:{...b.vercel,...a.vercelPatch,redeployVerification:a.clearPending?void 0:d}},a.cwd)}async function di(a){let b=await cb(a.cwd),c=b?.vercel,d=c?.redeployVerification;if(!c||!d)throw Error("No pending Vercel redeploy verification is in progress.");if(a.actionId&&d.actionId!==a.actionId)throw Error("Pending Vercel redeploy verification action was not found.");if(de.has(d.status))return c2({phase:"poll",actionId:d.actionId,pollStatus:d.status,verifyAttempted:d.verifyAttempted,projectId:d.projectId,projectName:d.projectName,teamId:d.teamId,fingerprint:d.fingerprint,setupBlockedMessage:d.blockedMessage}),df({vercel:c,pending:d,setupBlocked:d.blockedMessage?{message:d.blockedMessage,nextSteps:d.blockedNextSteps??[]}:void 0});if(!d.newDeploymentId)throw Error("Pending Vercel redeploy verification is missing deployment id.");let e=await dc({cwd:a.cwd,state:b,pending:d});if(!e.ok){c2({phase:"blocked",actionId:d.actionId,pollStatus:"verify_failed",setupBlockedMessage:e.setupBlocked.message,setupBlockedNextSteps:e.setupBlocked.nextSteps,projectId:d.projectId,fingerprint:d.fingerprint});let b={...d,status:"verify_failed",updatedAt:new Date().toISOString(),completedAt:new Date().toISOString(),message:e.setupBlocked.message,blockedMessage:e.setupBlocked.message,blockedNextSteps:e.setupBlocked.nextSteps};return await cd({vercel:{...c,redeployVerification:b}},a.cwd),df({vercel:{...c,redeployVerification:b},pending:b,setupBlocked:e.setupBlocked})}let f=await cT({vercelToken:e.vercelToken,newDeploymentId:d.newDeploymentId,teamId:d.teamId,sourceDeploymentId:d.sourceDeploymentId,deadlineAt:d.deadlineAt});if("failed"===f.status||"timeout"===f.status){var g,h;let b={message:(g=f.status,h=f.message,"timeout"===g?h??"Automatic production redeploy timed out before READY. Redeploy production in Vercel, then use Retry verification.":"failed"===g?h??"Automatic production redeploy failed. Redeploy production in Vercel, then use Retry verification.":"Redeploy production in Vercel, then use Retry verification (this will not rotate secrets or rewrite env vars)."),nextSteps:["Redeploy production in Vercel manually if needed.","Use Retry verification without rewriting env vars or rotating secrets."]};c2({phase:"blocked",actionId:d.actionId,pollStatus:f.status,setupBlockedMessage:b.message,setupBlockedNextSteps:b.nextSteps,projectId:d.projectId,fingerprint:d.fingerprint});let e={...d,status:f.status,updatedAt:new Date().toISOString(),completedAt:new Date().toISOString(),message:f.message,blockedMessage:b.message,blockedNextSteps:b.nextSteps};return await cd({vercel:{...c,redeployVerification:e}},a.cwd),df({vercel:{...c,redeployVerification:e},pending:e,setupBlocked:b})}if("building"===f.status||"triggered"===f.status){c2({phase:"poll",actionId:d.actionId,pollStatus:f.status,verifyAttempted:d.verifyAttempted,projectId:d.projectId,fingerprint:d.fingerprint});let b={...d,status:"building",updatedAt:new Date().toISOString(),message:f.message};return await cd({vercel:{...c,redeployVerification:b}},a.cwd),df({vercel:{...c,redeployVerification:b},pending:b})}if("ready"!==f.status||d.verifyAttempted)return df({vercel:c,pending:d});let i=await dg({cwd:a.cwd,pending:d});if(!i){let b=await cb(a.cwd);return df({vercel:b.vercel,pending:b.vercel.redeployVerification})}c2({phase:"verify_retry",actionId:i.actionId,pollStatus:"ready",verifyAttempted:!0,verifyOnly:!0,projectId:i.projectId,fingerprint:i.fingerprint,candidateSecretSource:i.candidateSecretSource});let j=await c7({plan:e.plan,confirmed:!0,fingerprint:d.fingerprint,verifyOnly:!0,cwd:a.cwd});if(j.signedProbeVerified&&j.verified){c2({phase:"signed_probe",actionId:i.actionId,pollStatus:"verified",signedProbeResult:j.signedProbe?.result,signedProbeReason:j.signedProbeReason,signedProbeStatusCode:j.signedProbe?.statusCode,fingerprint:i.fingerprint});let b=await cb(a.cwd);return await dh({cwd:a.cwd,pending:i,status:"verified",message:"Signed webhook verification passed after production redeploy.",clearPending:!0,vercelPatch:{productionUrl:b?.vercel?.productionUrl,webhookUrl:b?.vercel?.webhookUrl,signedProbeVerified:!0,signedProbe:j.signedProbe,deploymentRedeployRequired:!1}}),df({vercel:(await cb(a.cwd)).vercel,pending:{...i,status:"verified",completedAt:new Date().toISOString()},retryApply:j})}let k=function(a){let b=a?.retryReason?.trim()?` (${a.retryReason})`:"";return{message:`Production redeploy completed, but signed webhook delivery verification still failed${b}.`,nextSteps:["Use Retry verification without rewriting env vars or rotating secrets.","If verification still fails, confirm the Linear webhook signing secret matches Vercel production."]}}({retryReason:j.signedProbeReason});c2({phase:"blocked",actionId:i.actionId,pollStatus:"verify_failed",signedProbeResult:j.signedProbe?.result,signedProbeReason:j.signedProbeReason,signedProbeStatusCode:j.signedProbe?.statusCode,setupBlockedMessage:k.message,setupBlockedNextSteps:k.nextSteps,fingerprint:i.fingerprint});let l=await cb(a.cwd);await dh({cwd:a.cwd,pending:i,status:"verify_failed",message:k.message,setupBlocked:k,vercelPatch:{productionUrl:l?.vercel?.productionUrl,webhookUrl:l?.vercel?.webhookUrl,signedProbeVerified:!1,signedProbe:j.signedProbe,deploymentRedeployRequired:!0}});let m=await cb(a.cwd);return df({vercel:m.vercel,pending:m.vercel.redeployVerification,retryApply:{...j,verificationRetry:!0},setupBlocked:k})}async function dj(a){let b=(0,k.ym)(a),c=await (0,h.Hn)(b),d=await cb(a),e=d?.vercel,f=(0,$.s5)({projectId:e?.projectId,productionUrl:e?.productionUrl,webhookUrl:e?.webhookUrl,endpointReachable:e?.endpointReachable,requiredEnvPresence:e?.envVarPresence,linearWebhookVerified:e?.linearWebhookVerified,signedProbeVerified:e?.signedProbeVerified,deploymentRedeployRequired:e?.deploymentRedeployRequired,manualComplete:e?.manualComplete});return{controlPlane:d,vercelTokenConfigured:!!c?.presence.VERCEL_TOKEN,linearApiKeyConfigured:!!c?.presence.LINEAR_API_KEY,readiness:f,linearTeamKey:d?.linear?.teamKey}}function dk(a){return a.map(a=>({id:a.id,name:a.name,accountId:a.accountId}))}function dl(a,b){return b&&a.some(a=>a.id===b)?b:1===a.length?a[0]?.id:void 0}async function dm(a){let b=await cb(a.cwd),c=b?.linear?.teamKey,d=await c9({githubToken:a.githubToken,cwd:a.cwd}),e={teamCreate:!0,projectCreate:!0};if(!a.vercelToken.trim())return{scopes:[],projects:[],harnessTeamKey:c,githubDispatch:d,capabilities:e,loadError:"VERCEL_TOKEN is required to load Vercel bridge options."};try{var f;let g=(f=await (0,cO.dk)(a.vercelToken),[{id:"",label:"Personal account (no team)",kind:"personal"},...f.map(a=>({id:a.id,label:`${a.name} (${a.slug})`,kind:"team"}))]),h=b?.vercel?.teamId??"",i=void 0!==a.teamId?a.teamId??"":h,j=g.some(a=>a.id===i)?i:dl(g,h),k=j&&j.length>0?j:void 0,l=dk(await (0,cO.Eb)(a.vercelToken,k)),m=dl(l,b?.vercel?.projectId);return{scopes:g,projects:l,selectedScopeId:j,selectedProjectId:m,harnessTeamKey:c,githubDispatch:d,capabilities:e}}catch(a){return{scopes:[],projects:[],harnessTeamKey:c,githubDispatch:d,capabilities:e,loadError:a instanceof Error?a.message:"Failed to load Vercel bridge options."}}}async function dn(a){return dk(await (0,cO.Eb)(a.vercelToken,a.teamId?.trim()?a.teamId:void 0))}function dp(){return(0,e.Vq)()}async function dq(){let a=function(a=process.env){return!function(a=process.env){return"true"===a.VITEST||"test"===a.NODE_ENV}()||a.HARNESS_VITEST_REMOTE_SETUP_MOCK,null}();if(a)return a;let b=await bK({cwd:dp()});if(bL(b))return aS(b)}async function dr(a){let b=dp(),c=function(a){let b=[];return a.linearApiKey?.trim()&&b.push("LINEAR_API_KEY"),a.cursorApiKey?.trim()&&b.push("CURSOR_API_KEY"),a.harnessGithubToken?.trim()&&b.push("HARNESS_GITHUB_TOKEN"),{linearApiKey:a.linearApiKey,cursorApiKey:a.cursorApiKey,githubToken:a.harnessGithubToken,explicitCredentialReplacements:b.length>0?b:void 0}}(a),d=await ax({cwd:b,payload:a});return{linearApiKey:c.linearApiKey?.trim()||d.linearApiKey,cursorApiKey:c.cursorApiKey?.trim()||d.cursorApiKey,githubToken:c.githubToken?.trim()||d.githubToken,explicitCredentialReplacements:c.explicitCredentialReplacements,credentialInputSources:d.credentialInputSources}}async function ds(){return al({cwd:dp()})}async function dt(){return bQ({cwd:dp(),provider:await dq()})}async function du(){let a=dp(),b=(0,k.ym)(a),c=await (0,h.Hn)(b),d=await G({cwd:a}),e=await (0,U.vE)(a),f=e?(0,U.e8)(e)??void 0:void 0;return{env:{harnessConfigPath:c?.values.HARNESS_CONFIG_PATH??".harness/config.local.json",githubDispatchRepository:c?.values.GITHUB_DISPATCH_REPOSITORY??"",suggestedHarnessDispatchRepo:f,secretPresence:{LINEAR_API_KEY:c?.presence.LINEAR_API_KEY??!1,CURSOR_API_KEY:c?.presence.CURSOR_API_KEY??!1,GITHUB_TOKEN:c?.presence.GITHUB_TOKEN??!1,VERCEL_TOKEN:c?.presence.VERCEL_TOKEN??!1}},config:d}}async function dv(a){return R({cwd:dp(),payload:a})}async function dw(a){let b=dp();return{apply:await S({cwd:b,payload:a.payload,confirmed:a.confirmed,fingerprint:a.fingerprint}),summary:await al({cwd:b})}}async function dx(a){let b=await dr(a),c=(0,j.Gn)(b);return function(a,b=[]){return{...a,manualInstructions:a.manualInstructions.map(a=>bE(a,b)),validationError:a.validationError?bE(a.validationError,b):void 0}}(await bG({cwd:dp(),operatorInput:b,manualHarnessDispatchRepo:a.manualHarnessDispatchRepo,provider:await dq()}),c)}async function dy(a){let b=dp(),c=await dr(a.payload),d=await bH({cwd:b,operatorInput:c,manualHarnessDispatchRepo:a.payload.manualHarnessDispatchRepo,confirmed:a.confirmed,fingerprint:a.fingerprint,provider:await dq()}),[e,f]=await Promise.all([dt(),ds()]),g=await ce(b,f),h=function(a){var b;let c=a.remoteSummary,d=c?(0,V.fm)(c.harnessSecretStatuses):void 0;return{path:"automatic",applyFingerprint:a.applyResult.fingerprint,configStateFingerprint:JSON.stringify(function(a){let b=a.setupSummary.configSummary;return{configResolved:a.setupSummary.overview.configResolved,operatorConfigResolved:a.setupSummary.overview.operatorConfigResolved,linearTeamKeyFromConfig:a.controlPlaneContext?.linearTeamKeyFromConfig??null,linearTeamKeyFromControlPlane:a.controlPlaneContext?.state?.linear?.teamKey??null,repoIds:(b?.repos??[]).map(a=>a.id).sort((a,b)=>a.localeCompare(b)),repoTargets:(b?.repos??[]).map(a=>({id:a.id,targetRepo:a.targetRepo})).sort((a,b)=>a.id.localeCompare(b.id)),allowedTargetRepos:[...b?.allowedTargetRepos??[]].sort((a,b)=>a.localeCompare(b))}}({setupSummary:a.setupSummary,controlPlaneContext:a.controlPlaneContext})),harnessConfigJsonB64Written:!!(b=a.applyResult)&&b.writtenSecrets.some(a=>"HARNESS_CONFIG_JSON_B64"===a.name&&("created"===a.status||"updated"===a.status)),harnessDispatchRepo:c?.harnessDispatchRepo??a.applyResult.harnessDispatchRepo,harnessDispatchRepoResolved:c?.harnessDispatchRepoResolved,harnessDispatchRepoSource:c?.harnessDispatchRepoSource,harnessRepoAccess:c?.harnessRepoAccess,postApplyVerificationReady:c?function(a){let b=(0,V.fm)(a.harnessSecretStatuses);return a.harnessDispatchRepoResolved&&"denied"!==a.harnessRepoAccess&&b.allPresent}(c):void 0,secretPresence:d?{allPresent:d.allPresent,missing:d.missing,unknown:d.unknown}:void 0}}({applyResult:d,setupSummary:f,controlPlaneContext:g,remoteSummary:e});return{apply:d,summary:e,evidence:h}}async function dz(a){return bI({cwd:dp(),repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,manualHarnessDispatchRepo:a.manualHarnessDispatchRepo,provider:await dq()})}async function dA(a){let b,c=await dq(),d=await bJ({cwd:dp(),repoConfigId:a.payload.repoConfigId,targetRepo:a.payload.targetRepo,productionBranch:a.payload.productionBranch,manualHarnessDispatchRepo:a.payload.manualHarnessDispatchRepo,confirmed:a.confirmed,fingerprint:a.fingerprint,provider:c});return c&&"already-installed"!==d.outcome&&("pr-created"===d.outcome||"pr-updated"===d.outcome||"branch-updated"===d.outcome)&&(b=await dC({provider:c,input:{repoConfigId:a.payload.repoConfigId,targetRepo:a.payload.targetRepo,productionBranch:a.payload.productionBranch,manualHarnessDispatchRepo:a.payload.manualHarnessDispatchRepo,prUrl:d.prUrl,branchName:d.branchName}})),{apply:d,summary:await dt(),finalization:b}}async function dB(a){let b=await dq();if(!b)throw Error("GitHub token is required for target workflow finalization");return{finalization:await dC({provider:b,input:{repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,manualHarnessDispatchRepo:a.manualHarnessDispatchRepo,prUrl:a.prUrl,branchName:a.branchName}}),summary:await dt()}}async function dC(a){if(a.provider instanceof aL)return a.provider.advanceTargetWorkflowFinalization(a.input);let b=dp(),c=await bK({cwd:b});if(!bL(c))throw Error("GitHub token is required for target workflow finalization");let d=new an.jh({token:c});return b8({cwd:b,input:a.input,provider:a.provider,client:d})}async function dD(a){return(0,c8.tl)({cwd:a,key:"LINEAR_API_KEY"})}async function dE(a){return(0,c8.tl)({cwd:a,key:"VERCEL_TOKEN"})}async function dF(a,b){let c=b.vercelToken??await dE(a)??"",d=b.linearApiKey??await dD(a),e=await (0,c8.tl)({cwd:a,key:"GITHUB_TOKEN"}),f=await cb(a),g=await c9({githubToken:e,cwd:a}),h=await (0,c8.tl)({cwd:a,key:"LINEAR_WEBHOOK_SECRET"}),i=!!b.envInput?.LINEAR_WEBHOOK_SECRET?.trim(),j=!!h?.trim(),k=!i&&j;return{...b,vercelToken:c,linearApiKey:d,linearTeamId:b.linearTeamId??f?.linear?.teamId,derivedHarnessTeamKey:b.derivedHarnessTeamKey??f?.linear?.teamKey,derivedGithubDispatchToken:b.envInput?.GITHUB_DISPATCH_TOKEN?.trim()||!g.eligible?void 0:e,willGenerateLinearWebhookSecret:!!k||(b.willGenerateLinearWebhookSecret??!i),verificationLinearWebhookSecret:b.verificationLinearWebhookSecret??h,preserveGeneratedWebhookSecretFingerprint:b.preserveGeneratedWebhookSecretFingerprint??k}}async function dG(){return cG(dp())}async function dH(){let a=dp(),b=await dD(a);if(!b?.trim())throw Error("LINEAR_API_KEY is required to load Linear workspace options.");let c=ch(b),[d,e]=await Promise.all([ck(c),cl(c)]);return{teams:d,projects:e}}async function dI(){return dj(dp())}async function dJ(a){let b=dp(),c=a.linearApiKey??await dD(b)??"";return cB({...a,linearApiKey:c})}async function dK(a){let b=dp(),c=a.plan.linearApiKey??await dD(b)??"";return{apply:await cF({plan:{...a.plan,linearApiKey:c},confirmed:a.confirmed,fingerprint:a.fingerprint,cwd:b}),summary:await cG(b)}}async function dL(a){let b=dp();return dm({vercelToken:await dE(b)??"",githubToken:await (0,c8.tl)({cwd:b,key:"GITHUB_TOKEN"}),cwd:b,teamId:a?.teamId})}async function dM(a){let b=dp();return dn({vercelToken:await dE(b)??"",teamId:a})}async function dN(a){let b=dp();return c_(await dF(b,a))}async function dO(a){let b=dp(),c=await dF(b,a.plan);return{apply:await c7({plan:c,confirmed:a.confirmed,fingerprint:a.fingerprint,manualComplete:a.manualComplete,verifyOnly:a.verifyOnly,cwd:b}),summary:await dj(b)}}async function dP(a){let b=dp();return{apply:await di({actionId:a.actionId,cwd:b}),summary:await dj(b)}}async function dQ(){let a=function(a=process.env){return!function(a=process.env){return"true"===a.VITEST||"test"===a.NODE_ENV}()||a.HARNESS_VITEST_PROVISIONING_MOCK,null}();if(a)return a;let b=await bK({cwd:dp()});if(bL(b))return new aT({token:b})}async function dR(){let a=await dQ();return bA({cwd:dp(),provider:a})}async function dS(a){let b=await dQ();return b?bB({cwd:dp(),provider:b,operationId:a?.operationId}):{state:"token-unavailable",fingerprint:JSON.stringify({action:"preview",tokenUnavailable:!0}),operationId:a?.operationId??(0,d.randomUUID)(),creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:null,authenticatedLogin:null,templateOwner:"weston-uribe",templateRepo:"p-dev-harness-template",templateDefaultBranch:"main",templateHeadSha:"",templateContentId:null,message:"GITHUB_TOKEN is required before provisioning a harness workspace.",recoverable:!0,willCreateRepository:!1,tokenCapabilities:{tokenType:"unknown",hasRepoScope:!1,hasWorkflowScope:!1,scopeAmbiguous:!0}}}async function dT(a){let b=await dQ();if(!b)throw Error("GITHUB_TOKEN is required before provisioning a harness workspace.");let c=await bB({cwd:dp(),provider:b,operationId:a.operationId});return{apply:await bC({cwd:dp(),provider:b,confirmed:a.confirmed,fingerprint:a.fingerprint,operationId:a.operationId}),summary:await al({cwd:dp()}),provisioning:c}}async function dU(a){let b=dp(),c=(0,U.e8)(a.harnessDispatchRepo.trim());if(!c)return{status:"failed",repoSlug:a.harnessDispatchRepo.trim(),message:"Enter a valid GitHub repo slug or URL (owner/repo)."};let d=a.githubToken?.trim()||await bK({cwd:b});if(!d)return{status:"failed",repoSlug:c,message:"GITHUB_TOKEN is required to verify harness repo access. Add it in Step 1 first."};let e=aS(d),f=await e.checkHarnessRepoAccess(c);return"available"===f?{status:"connected",repoSlug:c,message:`Connected to ${c}.`,limitation:"This check confirms GitHub access only. Saving still happens when you create or update local setup files."}:"denied"===f?{status:"failed",repoSlug:c,message:`GitHub denied access to ${c}.`,limitation:"Confirm this is the harness repo you intend to use and that your GitHub token has admin or maintain access."}:{status:"unknown",repoSlug:c,message:`Harness repo access for ${c} could not be verified yet.`,limitation:"Retry after saving GITHUB_TOKEN in Step 1."}}async function dV(){return ay({cwd:dp()})}async function dW(a){return P({cwd:dp(),env:a})}async function dX(a){let b=dp();return await Q({cwd:b,env:a.env,confirmed:a.confirmed,fingerprint:a.fingerprint}),{summary:await al({cwd:b})}}}};