p-dev-harness 0.3.0

package/dist/setup/remote-actions.d.ts

@@ -0,0 +1,136 @@
+import type { SetupPermission, SetupPermissionScope } from "./permission-model.js";
+export declare const HARNESS_ACTIONS_SECRET_NAMES: readonly ["HARNESS_CONFIG_JSON_B64", "LINEAR_API_KEY", "CURSOR_API_KEY", "HARNESS_GITHUB_TOKEN"];
+export type HarnessActionsSecretName = (typeof HARNESS_ACTIONS_SECRET_NAMES)[number];
+export declare const MANUAL_HARNESS_DISPATCH_REPO_PLACEHOLDER = "<harness-dispatch-repo>";
+export declare function evaluateHarnessSecretPresence(statuses: HarnessSecretStatusEntry[]): {
+    allPresent: boolean;
+    missing: HarnessActionsSecretName[];
+    unknown: HarnessActionsSecretName[];
+};
+export declare const TARGET_WORKFLOW_PATH = ".github/workflows/trigger-harness-production-sync.yml";
+export type RemoteSetupStatus = "present" | "missing" | "unknown";
+export type RemoteWorkflowStatus = "present" | "missing" | "differs" | "unknown";
+export type RemoteAccessStatus = "available" | "denied" | "unknown";
+export interface RemoteSetupActionDescriptor {
+    id: string;
+    label: string;
+    description: string;
+    permission: SetupPermission;
+}
+export declare const REMOTE_SETUP_ACTIONS: {
+    readonly previewHarnessSecrets: {
+        readonly id: "preview-harness-secrets";
+        readonly label: "Preview harness repo Actions secrets";
+        readonly description: "Dry-run preview of harness repo GitHub Actions secret writes after confirmation";
+        readonly permission: {
+            readonly scope: "remote-read";
+            readonly confirmation: "standard";
+            readonly manualAlternative: true;
+        };
+    };
+    readonly applyHarnessSecrets: {
+        readonly id: "apply-harness-secrets";
+        readonly label: "Apply harness repo Actions secrets";
+        readonly description: "Write harness repo GitHub Actions secrets after explicit confirmation";
+        readonly permission: {
+            readonly scope: "remote-secret-write";
+            readonly confirmation: "strong";
+            readonly manualAlternative: true;
+        };
+    };
+    readonly previewTargetWorkflowPr: {
+        readonly id: "preview-target-workflow-pr";
+        readonly label: "Preview target repo workflow PR";
+        readonly description: "Dry-run preview of target repo production sync workflow branch and PR install";
+        readonly permission: {
+            readonly scope: "remote-read";
+            readonly confirmation: "standard";
+            readonly manualAlternative: true;
+        };
+    };
+    readonly applyTargetWorkflowPr: {
+        readonly id: "apply-target-workflow-pr";
+        readonly label: "Apply target repo workflow PR";
+        readonly description: "Create or update a target repo branch and PR for the production sync workflow";
+        readonly permission: {
+            readonly scope: "remote-repo-write";
+            readonly confirmation: "strong";
+            readonly manualAlternative: true;
+        };
+    };
+};
+export interface HarnessSecretStatusEntry {
+    name: HarnessActionsSecretName;
+    status: RemoteSetupStatus;
+}
+export interface HarnessSecretWritePlanEntry {
+    name: HarnessActionsSecretName;
+    action: "create" | "update" | "skip";
+    source: "generated-config-b64" | "operator-input" | "preserve-existing" | "missing-input";
+}
+export interface RemoteHarnessSecretPreview {
+    actionId: string;
+    harnessDispatchRepo: string;
+    harnessDispatchRepoResolved: boolean;
+    harnessDispatchRepoSource: string;
+    repoAccess: RemoteAccessStatus;
+    secretStatuses: HarnessSecretStatusEntry[];
+    secretWritePlan: HarnessSecretWritePlanEntry[];
+    secretKeyNames: HarnessActionsSecretName[];
+    fingerprint: string;
+    permission: SetupPermission;
+    manualInstructions: string[];
+    validationError?: string;
+}
+export interface TargetWorkflowPrPlan {
+    repoConfigId: string;
+    targetRepoSlug: string;
+    harnessDispatchRepo: string;
+    productionBranch: string;
+    workflowPath: string;
+    branchName: string;
+    prTitle: string;
+    prBody: string;
+    workflowStatus: RemoteWorkflowStatus;
+    directProductionBranchWrite: false;
+}
+export interface RemoteTargetWorkflowPreview {
+    actionId: string;
+    plan: TargetWorkflowPrPlan;
+    repoAccess: RemoteAccessStatus;
+    workflowPreviewSummary: string;
+    fingerprint: string;
+    permission: SetupPermission;
+    manualInstructions: string[];
+    validationError?: string;
+}
+export interface RemoteHarnessSecretApplyResult {
+    actionId: string;
+    harnessDispatchRepo: string;
+    writtenSecrets: Array<{
+        name: HarnessActionsSecretName;
+        status: "created" | "updated";
+    }>;
+    skippedSecretNames: HarnessActionsSecretName[];
+    fingerprint: string;
+    permission: SetupPermission;
+}
+export interface RemoteHarnessSecretManualCopyValues {
+    values: Partial<Record<HarnessActionsSecretName, string>>;
+    missing: HarnessActionsSecretName[];
+}
+export interface RemoteTargetWorkflowApplyResult {
+    actionId: string;
+    harnessDispatchRepo: string;
+    repoConfigId: string;
+    outcome: "already-installed" | "pr-created" | "pr-updated" | "branch-updated";
+    branchName: string;
+    prUrl?: string;
+    directProductionBranchWrite: false;
+    fingerprint: string;
+    permission: SetupPermission;
+}
+export declare function assertRemoteSetupPermissionScope(actual: SetupPermissionScope, expected: SetupPermissionScope): void;
+export declare function assertRemoteSetupConfirmed(confirmed: boolean): void;
+export declare function assertRemoteSetupFingerprint(provided: string, expected: string): void;
+//# sourceMappingURL=remote-actions.d.ts.map

package/dist/setup/remote-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-actions.d.ts","sourceRoot":"","sources":["../../src/setup/remote-actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAGnF,eAAO,MAAM,4BAA4B,kGAK/B,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAClC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhD,eAAO,MAAM,wCAAwC,4BAC1B,CAAC;AAE5B,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,wBAAwB,EAAE,GACnC;IACD,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC,CAsBA;AAED,eAAO,MAAM,oBAAoB,0DACwB,CAAC;AAE1D,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,oBAAoB,GAC5B,SAAS,GACT,SAAS,GACT,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6B+B,CAAC;AAEjE,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,MAAM,EACF,sBAAsB,GACtB,gBAAgB,GAChB,mBAAmB,GACnB,eAAe,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,2BAA2B,EAAE,OAAO,CAAC;IACrC,yBAAyB,EAAE,MAAM,CAAC;IAClC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,cAAc,EAAE,wBAAwB,EAAE,CAAC;IAC3C,eAAe,EAAE,2BAA2B,EAAE,CAAC;IAC/C,cAAc,EAAE,wBAAwB,EAAE,CAAC;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,oBAAoB,CAAC;IACrC,2BAA2B,EAAE,KAAK,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;IAC5B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,KAAK,CAAC;QACpB,IAAI,EAAE,wBAAwB,CAAC;QAC/B,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;KAC/B,CAAC,CAAC;IACH,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EACH,mBAAmB,GACnB,YAAY,GACZ,YAAY,GACZ,gBAAgB,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B,EAAE,KAAK,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,eAAe,CAAC;CAC7B;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,oBAAoB,GAC7B,IAAI,CAMN;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAInE;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,IAAI,CASN"}

package/dist/setup/remote-actions.js

@@ -0,0 +1,75 @@
+import { SETUP_PERMISSIONS } from "./permission-model.js";
+export const HARNESS_ACTIONS_SECRET_NAMES = [
+    "HARNESS_CONFIG_JSON_B64",
+    "LINEAR_API_KEY",
+    "CURSOR_API_KEY",
+    "HARNESS_GITHUB_TOKEN",
+];
+export const MANUAL_HARNESS_DISPATCH_REPO_PLACEHOLDER = "<harness-dispatch-repo>";
+export function evaluateHarnessSecretPresence(statuses) {
+    const statusByName = new Map(statuses.map((entry) => [entry.name, entry.status]));
+    const missing = [];
+    const unknown = [];
+    for (const name of HARNESS_ACTIONS_SECRET_NAMES) {
+        const status = statusByName.get(name);
+        if (status === "present") {
+            continue;
+        }
+        if (status === "unknown") {
+            unknown.push(name);
+            continue;
+        }
+        missing.push(name);
+    }
+    return {
+        allPresent: missing.length === 0 && unknown.length === 0,
+        missing,
+        unknown,
+    };
+}
+export const TARGET_WORKFLOW_PATH = ".github/workflows/trigger-harness-production-sync.yml";
+export const REMOTE_SETUP_ACTIONS = {
+    previewHarnessSecrets: {
+        id: "preview-harness-secrets",
+        label: "Preview harness repo Actions secrets",
+        description: "Dry-run preview of harness repo GitHub Actions secret writes after confirmation",
+        permission: SETUP_PERMISSIONS.remoteRead,
+    },
+    applyHarnessSecrets: {
+        id: "apply-harness-secrets",
+        label: "Apply harness repo Actions secrets",
+        description: "Write harness repo GitHub Actions secrets after explicit confirmation",
+        permission: SETUP_PERMISSIONS.remoteSecretWrite,
+    },
+    previewTargetWorkflowPr: {
+        id: "preview-target-workflow-pr",
+        label: "Preview target repo workflow PR",
+        description: "Dry-run preview of target repo production sync workflow branch and PR install",
+        permission: SETUP_PERMISSIONS.remoteRead,
+    },
+    applyTargetWorkflowPr: {
+        id: "apply-target-workflow-pr",
+        label: "Apply target repo workflow PR",
+        description: "Create or update a target repo branch and PR for the production sync workflow",
+        permission: SETUP_PERMISSIONS.remoteRepoWrite,
+    },
+};
+export function assertRemoteSetupPermissionScope(actual, expected) {
+    if (actual !== expected) {
+        throw new Error(`Remote setup action requires permission scope "${expected}", received "${actual}"`);
+    }
+}
+export function assertRemoteSetupConfirmed(confirmed) {
+    if (!confirmed) {
+        throw new Error("Remote setup writes require explicit confirmation");
+    }
+}
+export function assertRemoteSetupFingerprint(provided, expected) {
+    if (!provided) {
+        throw new Error("Preview fingerprint is required");
+    }
+    if (provided !== expected) {
+        throw new Error("Preview fingerprint is stale. Regenerate preview before applying.");
+    }
+}
+//# sourceMappingURL=remote-actions.js.map

package/dist/setup/remote-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-actions.js","sourceRoot":"","sources":["../../src/setup/remote-actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,yBAAyB;IACzB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;CACd,CAAC;AAKX,MAAM,CAAC,MAAM,wCAAwC,GACnD,yBAAyB,CAAC;AAE5B,MAAM,UAAU,6BAA6B,CAC3C,QAAoC;IAMpC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,MAAM,OAAO,GAA+B,EAAE,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,4BAA4B,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QACxD,OAAO;QACP,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uDAAuD,CAAC;AAmB1D,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,qBAAqB,EAAE;QACrB,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EACT,iFAAiF;QACnF,UAAU,EAAE,iBAAiB,CAAC,UAAU;KACzC;IACD,mBAAmB,EAAE;QACnB,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,uEAAuE;QACzE,UAAU,EAAE,iBAAiB,CAAC,iBAAiB;KAChD;IACD,uBAAuB,EAAE;QACvB,EAAE,EAAE,4BAA4B;QAChC,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,+EAA+E;QACjF,UAAU,EAAE,iBAAiB,CAAC,UAAU;KACzC;IACD,qBAAqB,EAAE;QACrB,EAAE,EAAE,0BAA0B;QAC9B,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,+EAA+E;QACjF,UAAU,EAAE,iBAAiB,CAAC,eAAe;KAC9C;CAC6D,CAAC;AAyFjE,MAAM,UAAU,gCAAgC,CAC9C,MAA4B,EAC5B,QAA8B;IAE9B,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,kDAAkD,QAAQ,gBAAgB,MAAM,GAAG,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,SAAkB;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,QAAgB;IAEhB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/setup/remote-apply-actions.d.ts

@@ -0,0 +1,32 @@
+import type { GitHubRemoteSetupProvider } from "./github-remote-provider.js";
+import { type HarnessSecretOperatorInput } from "./harness-secret-setup.js";
+import { type RemoteHarnessSecretApplyResult, type RemoteHarnessSecretPreview, type RemoteTargetWorkflowApplyResult, type RemoteTargetWorkflowPreview } from "./remote-actions.js";
+export interface RemoteHarnessSecretPreviewOptions {
+    cwd?: string;
+    operatorInput?: HarnessSecretOperatorInput;
+    manualHarnessDispatchRepo?: string;
+    provider?: GitHubRemoteSetupProvider;
+}
+export interface RemoteHarnessSecretApplyOptions extends RemoteHarnessSecretPreviewOptions {
+    confirmed: boolean;
+    fingerprint: string;
+}
+export interface RemoteTargetWorkflowPreviewOptions {
+    cwd?: string;
+    repoConfigId: string;
+    targetRepo: string;
+    productionBranch: string;
+    manualHarnessDispatchRepo?: string;
+    provider?: GitHubRemoteSetupProvider;
+}
+export interface RemoteTargetWorkflowApplyOptions extends RemoteTargetWorkflowPreviewOptions {
+    confirmed: boolean;
+    fingerprint: string;
+}
+export declare function previewRemoteHarnessSecrets(options: RemoteHarnessSecretPreviewOptions): Promise<RemoteHarnessSecretPreview>;
+export declare function applyRemoteHarnessSecrets(options: RemoteHarnessSecretApplyOptions): Promise<RemoteHarnessSecretApplyResult>;
+export declare function previewRemoteTargetWorkflow(options: RemoteTargetWorkflowPreviewOptions): Promise<RemoteTargetWorkflowPreview>;
+export declare function applyRemoteTargetWorkflow(options: RemoteTargetWorkflowApplyOptions): Promise<RemoteTargetWorkflowApplyResult>;
+export declare function sanitizeRemoteHarnessSecretPreview(preview: RemoteHarnessSecretPreview, knownSecrets?: readonly string[]): RemoteHarnessSecretPreview;
+export declare function toSanitizedRemoteSetupActionResult(preview: RemoteHarnessSecretPreview, knownSecrets?: readonly string[]): import("./setup-actions.js").SetupActionResult;
+//# sourceMappingURL=remote-apply-actions.d.ts.map

package/dist/setup/remote-apply-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-apply-actions.d.ts","sourceRoot":"","sources":["../../src/setup/remote-apply-actions.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,yBAAyB,EAE1B,MAAM,6BAA6B,CAAC;AASrC,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAQL,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,2BAA2B,EACjC,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,iCAAiC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,0BAA0B,CAAC;IAC3C,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC;AAED,MAAM,WAAW,+BACf,SAAQ,iCAAiC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC;AAED,MAAM,WAAW,gCACf,SAAQ,kCAAkC;IAC1C,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAsDD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC,CAuDrC;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,8BAA8B,CAAC,CA2DzC;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,2BAA2B,CAAC,CAmDtC;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,+BAA+B,CAAC,CA0D1C;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,0BAA0B,EACnC,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,0BAA0B,CAU5B;AAED,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,0BAA0B,EACnC,YAAY,GAAE,SAAS,MAAM,EAAO,kDAcrC"}

package/dist/setup/remote-apply-actions.js

@@ -0,0 +1,242 @@
+import { collectRemoteSecretInputs, redactKnownSecretValues, sanitizeSetupActionResult, } from "./redact-secrets.js";
+import { sanitizeGitHubSetupError, sanitizeGitHubWorkflowSetupError, } from "./github-remote-setup-live.js";
+import { formatHarnessDispatchRepo, resolveHarnessDispatchRepo, } from "./harness-dispatch-repo.js";
+import { generateHarnessConfigJsonB64, previewHarnessSecretSetup, readValidatedConfigLocalBytes, } from "./harness-secret-setup.js";
+import { REMOTE_SETUP_ACTIONS, assertRemoteSetupConfirmed, assertRemoteSetupFingerprint, assertRemoteSetupPermissionScope, } from "./remote-actions.js";
+import { previewTargetWorkflowSetup } from "./target-workflow-setup.js";
+import { SETUP_PERMISSIONS } from "./permission-model.js";
+function sanitizeRemotePreviewText(text, secrets) {
+    return redactKnownSecretValues(text, secrets);
+}
+async function buildHarnessSecretWriteRequests(input) {
+    const requests = [];
+    const skippedSecretNames = [];
+    const knownSecrets = collectRemoteSecretInputs(input.operatorInput);
+    for (const entry of input.secretWritePlan) {
+        if (entry.action === "skip") {
+            skippedSecretNames.push(entry.name);
+            continue;
+        }
+        if (entry.name === "HARNESS_CONFIG_JSON_B64") {
+            const { bytes } = await readValidatedConfigLocalBytes(input.cwd);
+            const encoded = generateHarnessConfigJsonB64(bytes);
+            knownSecrets.push(encoded);
+            requests.push({ name: entry.name, value: encoded });
+            continue;
+        }
+        const operatorValue = entry.name === "LINEAR_API_KEY"
+            ? input.operatorInput?.linearApiKey
+            : entry.name === "CURSOR_API_KEY"
+                ? input.operatorInput?.cursorApiKey
+                : input.operatorInput?.githubToken;
+        if (!operatorValue?.trim()) {
+            skippedSecretNames.push(entry.name);
+            continue;
+        }
+        requests.push({ name: entry.name, value: operatorValue.trim() });
+    }
+    return { requests, skippedSecretNames, knownSecrets };
+}
+export async function previewRemoteHarnessSecrets(options) {
+    const harnessDispatchRepo = await resolveHarnessDispatchRepo({
+        cwd: options.cwd,
+        manualRepo: options.manualHarnessDispatchRepo,
+    });
+    const harnessDispatchRepoSlug = formatHarnessDispatchRepo(harnessDispatchRepo);
+    let repoAccess = "unknown";
+    let secretStatuses = undefined;
+    if (options.provider && harnessDispatchRepo.resolved) {
+        repoAccess = await options.provider.checkHarnessRepoAccess(harnessDispatchRepoSlug);
+        secretStatuses = await options.provider.listHarnessSecretStatuses(harnessDispatchRepoSlug);
+    }
+    const preview = await previewHarnessSecretSetup({
+        cwd: options.cwd,
+        operatorInput: options.operatorInput,
+        manualHarnessDispatchRepo: options.manualHarnessDispatchRepo,
+        secretStatuses,
+        repoAccess,
+    });
+    const knownSecrets = collectRemoteSecretInputs(options.operatorInput);
+    const manualInstructions = preview.manualInstructions.map((step) => sanitizeRemotePreviewText(step, knownSecrets));
+    return {
+        actionId: REMOTE_SETUP_ACTIONS.previewHarnessSecrets.id,
+        harnessDispatchRepo: harnessDispatchRepoSlug,
+        harnessDispatchRepoResolved: harnessDispatchRepo.resolved,
+        harnessDispatchRepoSource: harnessDispatchRepo.source,
+        repoAccess,
+        secretStatuses: secretStatuses ??
+            preview.secretWritePlan.map((entry) => ({
+                name: entry.name,
+                status: "unknown",
+            })),
+        secretWritePlan: preview.secretWritePlan,
+        secretKeyNames: preview.secretWritePlan
+            .filter((entry) => entry.action !== "skip")
+            .map((entry) => entry.name),
+        fingerprint: preview.fingerprint,
+        permission: REMOTE_SETUP_ACTIONS.previewHarnessSecrets.permission,
+        manualInstructions,
+        validationError: preview.validationError
+            ? sanitizeRemotePreviewText(preview.validationError, knownSecrets)
+            : undefined,
+    };
+}
+export async function applyRemoteHarnessSecrets(options) {
+    assertRemoteSetupConfirmed(options.confirmed);
+    assertRemoteSetupPermissionScope(REMOTE_SETUP_ACTIONS.applyHarnessSecrets.permission.scope, SETUP_PERMISSIONS.remoteSecretWrite.scope);
+    const preview = await previewRemoteHarnessSecrets(options);
+    assertRemoteSetupFingerprint(options.fingerprint, preview.fingerprint);
+    if (preview.validationError) {
+        throw new Error(preview.validationError);
+    }
+    if (!options.provider) {
+        throw new Error("GitHub token is required for remote harness secret writes");
+    }
+    if (!preview.harnessDispatchRepoResolved) {
+        throw new Error("Harness dispatch repo must be resolved before applying secrets");
+    }
+    const { requests, skippedSecretNames, knownSecrets } = await buildHarnessSecretWriteRequests({
+        cwd: options.cwd,
+        operatorInput: options.operatorInput,
+        secretWritePlan: preview.secretWritePlan,
+    });
+    if (requests.length === 0) {
+        throw new Error("No harness repo Actions secrets are ready to write");
+    }
+    try {
+        const writtenSecrets = await options.provider.writeHarnessSecrets(preview.harnessDispatchRepo, requests);
+        const result = {
+            actionId: REMOTE_SETUP_ACTIONS.applyHarnessSecrets.id,
+            harnessDispatchRepo: preview.harnessDispatchRepo,
+            writtenSecrets,
+            skippedSecretNames,
+            fingerprint: preview.fingerprint,
+            permission: REMOTE_SETUP_ACTIONS.applyHarnessSecrets.permission,
+        };
+        const serialized = JSON.stringify(result);
+        for (const secret of knownSecrets) {
+            if (serialized.includes(secret)) {
+                throw new Error("Remote apply result leaked secret material");
+            }
+        }
+        return result;
+    }
+    catch (error) {
+        throw new Error(sanitizeGitHubSetupError(error));
+    }
+}
+export async function previewRemoteTargetWorkflow(options) {
+    const harnessDispatchRepo = await resolveHarnessDispatchRepo({
+        cwd: options.cwd,
+        manualRepo: options.manualHarnessDispatchRepo,
+    });
+    const initialPreview = previewTargetWorkflowSetup({
+        repoConfigId: options.repoConfigId,
+        targetRepo: options.targetRepo,
+        productionBranch: options.productionBranch,
+        harnessDispatchRepo,
+    });
+    let workflowStatus = initialPreview.plan.workflowStatus;
+    let repoAccess = "unknown";
+    let productionBranchSha;
+    if (options.provider &&
+        initialPreview.plan.targetRepoSlug !== "<invalid-target-repo>") {
+        const status = await options.provider.checkTargetWorkflowStatus({
+            targetRepoSlug: initialPreview.plan.targetRepoSlug,
+            workflowPath: initialPreview.plan.workflowPath,
+            intendedWorkflowContent: initialPreview.workflowContent,
+            productionBranch: options.productionBranch,
+        });
+        workflowStatus = status.workflowStatus;
+        repoAccess = status.repoAccess;
+        productionBranchSha = status.productionBranchSha;
+    }
+    const preview = previewTargetWorkflowSetup({
+        repoConfigId: options.repoConfigId,
+        targetRepo: options.targetRepo,
+        productionBranch: options.productionBranch,
+        harnessDispatchRepo,
+        workflowStatus,
+        productionBranchSha,
+    });
+    return {
+        actionId: REMOTE_SETUP_ACTIONS.previewTargetWorkflowPr.id,
+        plan: preview.plan,
+        repoAccess,
+        workflowPreviewSummary: preview.workflowPreviewSummary,
+        fingerprint: preview.fingerprint,
+        permission: REMOTE_SETUP_ACTIONS.previewTargetWorkflowPr.permission,
+        manualInstructions: preview.manualInstructions,
+        validationError: preview.validationError,
+    };
+}
+export async function applyRemoteTargetWorkflow(options) {
+    assertRemoteSetupConfirmed(options.confirmed);
+    assertRemoteSetupPermissionScope(REMOTE_SETUP_ACTIONS.applyTargetWorkflowPr.permission.scope, SETUP_PERMISSIONS.remoteRepoWrite.scope);
+    const preview = await previewRemoteTargetWorkflow(options);
+    assertRemoteSetupFingerprint(options.fingerprint, preview.fingerprint);
+    if (preview.validationError) {
+        throw new Error(preview.validationError);
+    }
+    if (preview.plan.directProductionBranchWrite !== false) {
+        throw new Error("Direct production branch writes are not allowed");
+    }
+    if (!options.provider) {
+        throw new Error("GitHub token is required for target workflow PR install");
+    }
+    try {
+        const applyResult = await options.provider.applyTargetWorkflowPr({
+            targetRepoSlug: preview.plan.targetRepoSlug,
+            productionBranch: preview.plan.productionBranch,
+            branchName: preview.plan.branchName,
+            workflowPath: preview.plan.workflowPath,
+            workflowContent: (await previewTargetWorkflowSetup({
+                repoConfigId: options.repoConfigId,
+                targetRepo: options.targetRepo,
+                productionBranch: options.productionBranch,
+                harnessDispatchRepo: await resolveHarnessDispatchRepo({
+                    cwd: options.cwd,
+                    manualRepo: options.manualHarnessDispatchRepo,
+                }),
+                workflowStatus: preview.plan.workflowStatus,
+            })).workflowContent,
+            prTitle: preview.plan.prTitle,
+            prBody: preview.plan.prBody,
+        });
+        return {
+            actionId: REMOTE_SETUP_ACTIONS.applyTargetWorkflowPr.id,
+            harnessDispatchRepo: preview.plan.harnessDispatchRepo,
+            repoConfigId: preview.plan.repoConfigId,
+            outcome: applyResult.outcome,
+            branchName: applyResult.branchName,
+            prUrl: applyResult.prUrl,
+            directProductionBranchWrite: false,
+            fingerprint: preview.fingerprint,
+            permission: REMOTE_SETUP_ACTIONS.applyTargetWorkflowPr.permission,
+        };
+    }
+    catch (error) {
+        throw new Error(sanitizeGitHubWorkflowSetupError(error));
+    }
+}
+export function sanitizeRemoteHarnessSecretPreview(preview, knownSecrets = []) {
+    return {
+        ...preview,
+        manualInstructions: preview.manualInstructions.map((step) => sanitizeRemotePreviewText(step, knownSecrets)),
+        validationError: preview.validationError
+            ? sanitizeRemotePreviewText(preview.validationError, knownSecrets)
+            : undefined,
+    };
+}
+export function toSanitizedRemoteSetupActionResult(preview, knownSecrets = []) {
+    return sanitizeSetupActionResult({
+        actionId: preview.actionId,
+        outcome: "preview",
+        permission: preview.permission,
+        reason: preview.secretKeyNames.length
+            ? `Would write secret keys: ${preview.secretKeyNames.join(", ")}`
+            : "No harness repo secrets would be written",
+        manualInstructions: preview.manualInstructions,
+    }, knownSecrets);
+}
+//# sourceMappingURL=remote-apply-actions.js.map

package/dist/setup/remote-apply-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-apply-actions.js","sourceRoot":"","sources":["../../src/setup/remote-apply-actions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,6BAA6B,GAE9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,EAC5B,gCAAgC,GAQjC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AA8B1D,SAAS,yBAAyB,CAChC,IAAY,EACZ,OAA0B;IAE1B,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAI9C;IAKC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAA+B,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACpD,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GACjB,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAC7B,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,YAAY;YACnC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB;gBAC/B,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,YAAY;gBACnC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,WAAW,CAAC;QAEzC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3B,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA0C;IAE1C,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,OAAO,CAAC,yBAAyB;KAC9C,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,CAAC;IAE/E,IAAI,UAAU,GAAuB,SAAS,CAAC;IAC/C,IAAI,cAAc,GAAG,SAAS,CAAC;IAE/B,IAAI,OAAO,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QACrD,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CACxD,uBAAuB,CACxB,CAAC;QACF,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAC/D,uBAAuB,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;QAC5D,cAAc;QACd,UAAU;KACX,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjE,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAC9C,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EAAE;QACvD,mBAAmB,EAAE,uBAAuB;QAC5C,2BAA2B,EAAE,mBAAmB,CAAC,QAAQ;QACzD,yBAAyB,EAAE,mBAAmB,CAAC,MAAM;QACrD,UAAU;QACV,cAAc,EACZ,cAAc;YACd,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACtC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,SAAkB;aAC3B,CAAC,CAAC;QACL,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,cAAc,EAAE,OAAO,CAAC,eAAe;aACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;aAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,UAAU;QACjE,kBAAkB;QAClB,eAAe,EAAE,OAAO,CAAC,eAAe;YACtC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC;YAClE,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAwC;IAExC,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,gCAAgC,CAC9B,oBAAoB,CAAC,mBAAmB,CAAC,UAAU,CAAC,KAAK,EACzD,iBAAiB,CAAC,iBAAiB,CAAC,KAAK,CAC1C,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3D,4BAA4B,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvE,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,2BAA2B,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAClD,MAAM,+BAA+B,CAAC;QACpC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEL,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAC/D,OAAO,CAAC,mBAAmB,EAC3B,QAAQ,CACT,CAAC;QAEF,MAAM,MAAM,GAAmC;YAC7C,QAAQ,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,EAAE;YACrD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,cAAc;YACd,kBAAkB;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,oBAAoB,CAAC,mBAAmB,CAAC,UAAU;SAChE,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA2C;IAE3C,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,OAAO,CAAC,yBAAyB;KAC9C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,0BAA0B,CAAC;QAChD,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,mBAAmB;KACpB,CAAC,CAAC;IAEH,IAAI,cAAc,GAAG,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC;IACxD,IAAI,UAAU,GAAuB,SAAS,CAAC;IAC/C,IAAI,mBAAuC,CAAC;IAE5C,IACE,OAAO,CAAC,QAAQ;QAChB,cAAc,CAAC,IAAI,CAAC,cAAc,KAAK,uBAAuB,EAC9D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YAC9D,cAAc,EAAE,cAAc,CAAC,IAAI,CAAC,cAAc;YAClD,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,YAAY;YAC9C,uBAAuB,EAAE,cAAc,CAAC,eAAe;YACvD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QACH,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAC/B,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACnD,CAAC;IAED,MAAM,OAAO,GAAG,0BAA0B,CAAC;QACzC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,mBAAmB;QACnB,cAAc;QACd,mBAAmB;KACpB,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,EAAE;QACzD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU;QACV,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,oBAAoB,CAAC,uBAAuB,CAAC,UAAU;QACnE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAyC;IAEzC,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,gCAAgC,CAC9B,oBAAoB,CAAC,qBAAqB,CAAC,UAAU,CAAC,KAAK,EAC3D,iBAAiB,CAAC,eAAe,CAAC,KAAK,CACxC,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC3D,4BAA4B,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvE,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,CAAC,2BAA2B,KAAK,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC/D,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;YAC3C,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB;YAC/C,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;YACnC,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;YACvC,eAAe,EAAE,CACf,MAAM,0BAA0B,CAAC;gBAC/B,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;oBACpD,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,UAAU,EAAE,OAAO,CAAC,yBAAyB;iBAC9C,CAAC;gBACF,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;aAC5C,CAAC,CACH,CAAC,eAAe;YACjB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;YAC7B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;SAC5B,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,EAAE;YACvD,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB;YACrD,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;YACvC,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,2BAA2B,EAAE,KAAK;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,UAAU,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,UAAU;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAAmC,EACnC,eAAkC,EAAE;IAEpC,OAAO;QACL,GAAG,OAAO;QACV,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1D,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAC9C;QACD,eAAe,EAAE,OAAO,CAAC,eAAe;YACtC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC;YAClE,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAAmC,EACnC,eAAkC,EAAE;IAEpC,OAAO,yBAAyB,CAC9B;QACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,MAAM;YACnC,CAAC,CAAC,4BAA4B,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACjE,CAAC,CAAC,0CAA0C;QAC9C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;KAC/C,EACD,YAAY,CACb,CAAC;AACJ,CAAC"}

package/dist/setup/remote-preview-fingerprint.d.ts

@@ -0,0 +1,15 @@
+import type { SetupPermissionScope } from "./permission-model.js";
+export interface TargetWorkflowFingerprintInput {
+    actionId: string;
+    permissionScope: SetupPermissionScope;
+    repoConfigId: string;
+    targetRepoSlug: string;
+    harnessDispatchRepo: string;
+    productionBranch: string;
+    workflowPath: string;
+    branchName: string;
+    workflowContentHash: string;
+    productionBranchSha?: string;
+}
+export declare function computeTargetWorkflowFingerprint(input: TargetWorkflowFingerprintInput): string;
+//# sourceMappingURL=remote-preview-fingerprint.d.ts.map

package/dist/setup/remote-preview-fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-preview-fingerprint.d.ts","sourceRoot":"","sources":["../../src/setup/remote-preview-fingerprint.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAMlE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,oBAAoB,CAAC;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,8BAA8B,GACpC,MAAM,CAcR"}

package/dist/setup/remote-preview-fingerprint.js

@@ -0,0 +1,20 @@
+import { createHash } from "node:crypto";
+function hashValue(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+export function computeTargetWorkflowFingerprint(input) {
+    const normalized = {
+        actionId: input.actionId,
+        permissionScope: input.permissionScope,
+        repoConfigId: input.repoConfigId,
+        targetRepoSlug: input.targetRepoSlug,
+        harnessDispatchRepo: input.harnessDispatchRepo,
+        productionBranch: input.productionBranch,
+        workflowPath: input.workflowPath,
+        branchName: input.branchName,
+        workflowContentHash: input.workflowContentHash,
+        productionBranchSha: input.productionBranchSha ?? "",
+    };
+    return hashValue(JSON.stringify(normalized));
+}
+//# sourceMappingURL=remote-preview-fingerprint.js.map

package/dist/setup/remote-preview-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-preview-fingerprint.js","sourceRoot":"","sources":["../../src/setup/remote-preview-fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAeD,MAAM,UAAU,gCAAgC,CAC9C,KAAqC;IAErC,MAAM,UAAU,GAAG;QACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;KACrD,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/setup/remote-setup-summary.d.ts

@@ -0,0 +1,28 @@
+import type { GitHubRemoteSetupProvider } from "./github-remote-provider.js";
+import { type HarnessSecretStatusEntry, type RemoteAccessStatus, type RemoteWorkflowStatus } from "./remote-actions.js";
+export { evaluateHarnessSecretPresence } from "./remote-actions.js";
+import { type StaleSmokeDiagnostics } from "./stale-smoke-repo.js";
+export interface RemoteSetupRepoSummary {
+    repoConfigId: string;
+    targetRepo: string;
+    productionBranch: string;
+    repoAccess: RemoteAccessStatus;
+    workflowStatus: RemoteWorkflowStatus;
+    harnessDispatchRepo: string;
+}
+export interface RemoteSetupSummary {
+    githubTokenConfigured: boolean;
+    harnessDispatchRepo: string;
+    harnessDispatchRepoResolved: boolean;
+    harnessDispatchRepoSource: string;
+    harnessRepoAccess: RemoteAccessStatus;
+    harnessSecretStatuses: HarnessSecretStatusEntry[];
+    targetRepos: RemoteSetupRepoSummary[];
+    staleSmokeDiagnostics: StaleSmokeDiagnostics;
+}
+export declare function buildRemoteSetupSummary(options?: {
+    cwd?: string;
+    manualHarnessDispatchRepo?: string;
+    provider?: GitHubRemoteSetupProvider;
+}): Promise<RemoteSetupSummary>;
+//# sourceMappingURL=remote-setup-summary.d.ts.map

package/dist/setup/remote-setup-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-setup-summary.d.ts","sourceRoot":"","sources":["../../src/setup/remote-setup-summary.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,cAAc,EAAE,oBAAoB,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,2BAA2B,EAAE,OAAO,CAAC;IACrC,yBAAyB,EAAE,MAAM,CAAC;IAClC,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,qBAAqB,EAAE,wBAAwB,EAAE,CAAC;IAClD,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACtC,qBAAqB,EAAE,qBAAqB,CAAC;CAC9C;AAED,wBAAsB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgG9B"}