p-dev-harness 0.3.1 → 0.4.0

package/gui/.next/server/chunks/647.js

@@ -1,82 +0,0 @@
-"use strict";exports.id=647,exports.ids=[647],exports.modules={4647:(a,b,c)=>{c.d(b,{pA:()=>er,ix:()=>en,kd:()=>d2,$X:()=>ee,R6:()=>d0,n3:()=>d4,R7:()=>ei,BP:()=>d5,g1:()=>el,VP:()=>ea,xQ:()=>eb,Ig:()=>ep,W8:()=>dZ,CP:()=>d$,al:()=>dY,XV:()=>ef,F$:()=>eg,bT:()=>ec,oO:()=>ej,b1:()=>eq,K7:()=>em,A5:()=>d1,LV:()=>ed,HV:()=>d_,j3:()=>d3,hp:()=>eh,u4:()=>eo});var d=c(77598),e=c(83954),f=c(51455),g=c(12884),h=c(87285),i=c(19965),j=c(57362),k=c(84998);async function l(a){try{return await (0,f.access)(a),!0}catch{return!1}}function m(a,b=[]){return(0,j.qs)(a,b)}async function n(a){if(!await l(a.envExample))throw Error(`Missing source file: ${a.envExample}`);return(0,f.readFile)(a.envExample,"utf8")}async function o(a){let{paths:b,force:c=!1,mode:d="apply"}=a,e=k.gr,h=await l(b.envLocal);if(h&&!c)return m({actionId:"scaffold-env-local",outcome:"skipped",targetPath:b.envLocal,permission:g.P.localFileWrite,reason:"already exists",logMessage:`skipped ${e} (already exists)`});let i=await n(b);return"dry-run"===d?m({actionId:"scaffold-env-local",outcome:h?"wouldChange":"preview",targetPath:b.envLocal,content:i,permission:g.P.localFileWrite,reason:h?"would overwrite with --force":"would create",logMessage:h?`would overwrite ${e}`:`would create ${e}`}):(await (0,f.copyFile)(b.envExample,b.envLocal),m({actionId:"scaffold-env-local",outcome:"changed",targetPath:b.envLocal,content:i,permission:g.P.localFileWrite,reason:h?"overwrote existing file":"created new file",logMessage:`${h?"overwrote":"created"} ${e}`}))}async function p(a){let{paths:b,force:c=!1,mode:d="apply"}=a,e=k.gr,h=await l(b.envLocal),i=(0,j.B8)(a.input);if(h&&!c)return m({actionId:"write-env-local",outcome:"skipped",targetPath:b.envLocal,permission:g.P.localFileWrite,reason:"already exists",logMessage:`skipped ${e} (already exists)`});let n=a.content??function(a){let b=a?.harnessConfigPath??k.it,c=a?.linearApiKey??"",d=a?.cursorApiKey??"",e=a?.githubToken??"";return`# Operator local setup — generated by harness setup core
-# Do not commit .env.local (gitignored).
-
-# --- Local private harness config (local only) ---
-# Points at your structured target-repo config file.
-# Edit .harness/config.local.json after init; keep this path unchanged.
-HARNESS_CONFIG_PATH=${b}
-
-# --- GitHub Actions only (cloud runs) — do NOT put in .env.local ---
-# HARNESS_CONFIG_JSON_B64 replaces the whole harness config for that run.
-# It is NOT an overlay with committed harness.config.json.
-# Base64-encode your full .harness/config.local.json and set it as a
-# GitHub Actions secret on the harness repo. Include every repo you want
-# the harness to manage in repos[] and allowedTargetRepos[].
-
-# --- Live automation API keys (local CLI) ---
-# Fill these in .env.local for local doctor and harness runs.
-LINEAR_API_KEY=${c}
-CURSOR_API_KEY=${d}
-
-# Local CLI name for GitHub API access (doctor merge profile, handoff, merge).
-# In GitHub Actions the secret is named HARNESS_GITHUB_TOKEN (workflow maps it
-# to runtime GITHUB_TOKEN). Do not use HARNESS_GITHUB_TOKEN in .env.local.
-GITHUB_TOKEN=${e}
-`}(a.input);return"dry-run"===d?m({actionId:"write-env-local",outcome:h?"wouldChange":"preview",targetPath:b.envLocal,content:n,permission:g.P.localFileWrite,reason:h?"would overwrite with --force":"would create",logMessage:h?`would overwrite ${e}`:`would create ${e}`},i):(await (0,f.writeFile)(b.envLocal,n,"utf8"),m({actionId:"write-env-local",outcome:"changed",targetPath:b.envLocal,content:n,permission:g.P.localFileWrite,reason:h?"overwrote existing file":"created new file",logMessage:`${h?"overwrote":"created"} ${e}`},i))}var q=c(29281),r=c(71512),s=c(58885),t=c(84783),u=c(50615);let v="https://github.com/owner/example-target-app",w="target-app",x="Example Target App",y=new Set(["TEAM","WES"]),z=["staging.example.com","www.example.com","example.com"];function A(a){if(!a?.trim())return;let b=a.split(/[,\n]/).map(a=>a.trim()).filter(Boolean);return b.length>0?b:void 0}function B(a){return{id:a.id.trim(),targetRepo:a.targetRepo.trim(),linearProjects:A(a.linearProjects),linearTeams:A(a.linearTeams),baseBranch:a.baseBranch?.trim()||void 0,productionBranch:a.productionBranch?.trim()||void 0,previewProvider:a.previewProvider?.trim()||void 0,integrationPreviewUrl:a.integrationPreviewUrl?.trim()||void 0,productionUrl:a.productionUrl?.trim()||void 0,integrationSuccessStatus:a.integrationSuccessStatus?.trim()||void 0,productionSuccessStatus:a.productionSuccessStatus?.trim()||void 0,validationCommands:function(a){if(!a?.trim())return;let b=a.split("\n").map(a=>a.trim()).filter(Boolean);return b.length>0?b:void 0}(a.validationCommands)}}function C(a){if(!a.repos.length)throw Error("At least one target repo is required");return{repos:a.repos.map(B),linearTeamKey:a.linearTeamKey?.trim()||void 0,modelId:a.modelId?.trim()||void 0}}function D(){return{repos:[{id:"",targetRepo:""}]}}function E(a){if(!a?.trim())return!1;let b=a.trim();return b===v||b===w||b===x||"TEAM"===b||"WES"===b||z.some(a=>b.includes(a))||b.includes("owner/example-target-app")}async function F(a){let b=(0,k.ym)(a);try{return await (0,f.access)(b.configLocal),!0}catch{return!1}}async function G(a){let b=a?.cwd,c=(0,k.ym)(b),d=await F(b);b&&((0,s.N)(b),d&&!process.env.HARNESS_CONFIG_PATH?.trim()&&(process.env.HARNESS_CONFIG_PATH=c.configLocal));try{let a=(0,t.m)({baseDir:b}),c=await (0,q.rL)({baseDir:b});if("default-file"===a.kind||(e=c.config,0!==e.repos.length&&e.repos.every(a=>{let b=a.targetRepo===v||a.targetRepo.includes("owner/example-target-app"),c=a.id===w,d=a.linearProjects?.some(a=>a===x),e=[a.integrationPreviewUrl,a.productionUrl].some(a=>a&&z.some(b=>a.includes(b)));return b||c||d||e}))||"HARNESS_CONFIG_PATH"===a.kind&&!d)return D();var e,f,g=(f=c.config,{linearTeamKey:f.linear?.teamKey,modelId:f.agentProvider?.model?.id??f.defaultModel?.id??r.Sk,repos:f.repos.map(a=>({id:a.id,targetRepo:a.targetRepo,linearProjects:a.linearProjects?.join(", "),linearTeams:a.linearTeams?.join(", "),baseBranch:a.baseBranch,productionBranch:a.productionBranch,previewProvider:a.previewProvider,integrationPreviewUrl:a.integrationPreviewUrl,productionUrl:a.productionUrl,integrationSuccessStatus:a.integrationSuccessStatus,productionSuccessStatus:a.productionSuccessStatus,validationCommands:a.validation?.commands?.join("\n")}))});let h=g.repos[0];if(!h)return D();let i={...h,id:E(h.id)?"":h.id,targetRepo:E(h.targetRepo)?"":h.targetRepo,linearProjects:E(h.linearProjects)?void 0:h.linearProjects,linearTeams:E(h.linearTeams)?void 0:h.linearTeams,integrationPreviewUrl:E(h.integrationPreviewUrl)?void 0:h.integrationPreviewUrl,productionUrl:E(h.productionUrl)?void 0:h.productionUrl};return{linearTeamKey:g.linearTeamKey&&!y.has(g.linearTeamKey)?g.linearTeamKey:void 0,modelId:g.modelId,repos:[i]}}catch{return D()}}let H=g.P.localFileWrite.scope;function I(a){if(!a)return"";let b=0;for(let c=0;c<a.length;c+=1)b=(b+a.charCodeAt(c))%0x3b9aca07;return`${a.length}:${b}`}function J(a){return{harnessConfigPath:a.harnessConfigPath,githubDispatchRepository:a.githubDispatchRepository,linearApiKey:a.linearApiKey,cursorApiKey:a.cursorApiKey,githubToken:a.githubToken,vercelToken:a.vercelToken}}async function K(a){let[b,c]=await Promise.all([(0,h.X_)(a.envLocal),(0,h.X_)(a.configLocal)]);return{envLocalPath:a.envLocal,configLocalPath:a.configLocal,envLocalHash:b,configLocalHash:c}}function L(a){return{harnessConfigPath:a.harnessConfigPath?.trim()??"",githubDispatchRepository:a.githubDispatchRepository?.trim()??"",linearApiKeyToken:I(a.linearApiKey?.trim()??""),cursorApiKeyToken:I(a.cursorApiKey?.trim()??""),githubTokenToken:I(a.githubToken?.trim()??""),vercelTokenToken:I(a.vercelToken?.trim()??""),preserveLinear:!a.linearApiKey?.trim(),preserveCursor:!a.cursorApiKey?.trim(),preserveGithub:!a.githubToken?.trim(),preserveVercel:!a.vercelToken?.trim()}}function M(a,b,c){return JSON.stringify({cwd:c??process.cwd(),paths:{envLocal:b.envLocalPath,configLocal:b.configLocalPath},baselines:{envLocalHash:b.envLocalHash,configLocalHash:b.configLocalHash},env:L(a.env),config:C(a.config)})}async function N(a){let b=await (0,h.Hn)(a),{access:d}=await Promise.resolve().then(c.t.bind(c,51455,23)),e=!1;try{await d(a.configLocal),e=!0}catch{e=!1}return{envExists:!!b,configExists:e,envAction:b?"update":"create",configAction:e?"update":"create"}}async function O(a,b){let c=await (0,h.Hn)(a),d=await (0,h.ed)(a),e=(0,h._b)(c,b),f=(0,h.HF)(d,e),g=[...(0,h.Ol)(e),...(0,j.B8)(b)];return{mergedEnv:e,envContent:f,knownSecrets:g}}async function P(a){var b;let c=(0,k.ym)(a.cwd),d=J(a.env),{mergedEnv:e,envContent:f,knownSecrets:i}=await O(c,d),l=(0,j.qs)({actionId:"write-env-local",outcome:"preview",targetPath:c.envLocal,content:f,permission:g.P.localFileWrite,reason:f?"would update merged env":"would create env"},i),m=await K(c);return{fingerprint:(b=a.env,JSON.stringify({cwd:a.cwd??process.cwd(),paths:{envLocal:m.envLocalPath,configLocal:m.configLocalPath},baselines:{envLocalHash:m.envLocalHash,configLocalHash:m.configLocalHash},env:L(b)})),envPreview:(0,h.W)(f),envKeyPresence:(0,h.lL)(e),envResult:l}}async function Q(a){if(!a.confirmed)throw Error("Local file writes require explicit confirmation");let b=await P({cwd:a.cwd,env:a.env});if(a.fingerprint!==b.fingerprint)throw Error("Preview fingerprint is stale. Regenerate preview before applying.");let c=(0,k.ym)(a.cwd),d=J(a.env),{envContent:e,knownSecrets:f}=await O(c,d);if((0,h.W)(e)!==b.envPreview)throw Error("Preview fingerprint is stale. Regenerate preview before applying.");return{envResult:(0,j.qs)(await p({paths:c,mode:"apply",content:e,force:!0}),f)}}async function R(a){var b,c;let d,e,f=(0,k.ym)(a.cwd),l=J(a.payload.env),{mergedEnv:m,envContent:n,knownSecrets:o}=await O(f,l),p="";try{p=function(a){let b=C(a);return{config:(0,u.BR)(b),json:(0,u.rb)(b)}}(a.payload.config).json,e=await (0,i.writeConfigLocal)({paths:f,mode:"dry-run",content:p,force:!0})}catch(a){d=a instanceof Error?a.message:String(a),p="",e={actionId:"write-config-local",outcome:"preview",targetPath:f.configLocal,permission:g.P.localFileWrite,reason:(b=d,(0,j.h4)(b,o))}}let q=(0,j.qs)({actionId:"write-env-local",outcome:"preview",targetPath:f.envLocal,content:n,permission:g.P.localFileWrite,reason:n?"would update merged env":"would create env"},o),r=await N(f),s=await K(f);return{fingerprint:M(a.payload,s,a.cwd),plan:r,envPreview:(0,h.W)(n),configPreview:p,envKeyPresence:(0,h.lL)(m),envResult:q,configResult:(0,j.qs)(e,o),validationError:d?(c=d,(0,j.h4)(c,o)):void 0}}async function S(a){if(!a.confirmed)throw Error("Local file writes require explicit confirmation");let b=(0,k.ym)(a.cwd),c=await K(b),d=M(a.payload,c,a.cwd);if(a.fingerprint!==d)throw Error("Preview fingerprint is stale. Regenerate preview before applying.");let e=await R({cwd:a.cwd,payload:a.payload});if(e.validationError)throw Error(e.validationError);if(e.envResult.permission.scope!==H||e.configResult.permission.scope!==H)throw Error("Only local-file-write actions are allowed in Milestone 4");let g=J(a.payload.env),{envContent:l,knownSecrets:m}=await O(b,g);if((0,h.W)(l)!==e.envPreview)throw Error("Preview fingerprint is stale. Regenerate preview before applying.");await (0,f.mkdir)(b.harnessDir,{recursive:!0});let n=(0,j.qs)(await p({paths:b,mode:"apply",content:l,force:!0}),m);return{envResult:n,configResult:(0,j.qs)(await (0,i.writeConfigLocal)({paths:b,mode:"apply",content:e.configPreview,force:!0}),m),plan:await N(b)}}async function T(a){let b=(0,k.ym)(a.cwd),c=await (0,h.Hn)(b),d=void 0!==a.githubDispatchRepositoryId?String(a.githubDispatchRepositoryId):void 0,e=(0,h._b)(c,{githubDispatchRepository:a.githubDispatchRepository.trim(),githubDispatchRepositoryId:d}),f=c?.values.GITHUB_DISPATCH_REPOSITORY?.trim()===a.githubDispatchRepository.trim(),i=void 0===d||c?.values.GITHUB_DISPATCH_REPOSITORY_ID?.trim()===d;if(f&&i)return{actionId:"write-env-local",outcome:"skipped",targetPath:b.envLocal,permission:g.P.localFileWrite,reason:"GITHUB_DISPATCH_REPOSITORY already persisted."};let j=await (0,h.ed)(b);return p({paths:b,mode:"apply",content:(0,h.HF)(j,e),force:!0})}var U=c(84107),V=c(4631);let W=["Ready for Planning","Ready for Build","PR Open","Needs Revision","Ready to Merge"];W.map(a=>a.toLowerCase());let X=[{name:"Backlog",category:"backlog",role:"transitional",creatable:!0},{name:"Ready for Planning",category:"unstarted",role:"dispatch-trigger",creatable:!0},{name:"Planning",category:"started",role:"transitional",creatable:!0},{name:"Ready for Build",category:"unstarted",role:"dispatch-trigger",creatable:!0},{name:"Building",category:"started",role:"transitional",creatable:!0},{name:"PR Open",category:"started",role:"dispatch-trigger",creatable:!0},{name:"PM Review",category:"started",role:"transitional",creatable:!0},{name:"Engineering Review",category:"started",role:"human-gate",creatable:!0},{name:"Needs Revision",category:"unstarted",role:"dispatch-trigger",creatable:!0},{name:"Revising",category:"started",role:"transitional",creatable:!0},{name:"Ready to Merge",category:"started",role:"dispatch-trigger",creatable:!0},{name:"Merging",category:"started",role:"transitional",creatable:!0},{name:"Merged to Dev",category:"completed",role:"transitional",creatable:!0},{name:"Merged / Deployed",category:"completed",role:"transitional",creatable:!0},{name:"Blocked",category:"started",role:"terminal",creatable:!0},{name:"Canceled",category:"canceled",role:"terminal",creatable:!0},{name:"Duplicate",category:"canceled",role:"system-managed",creatable:!1}];function Y(){return X.filter(a=>a.creatable)}function Z(a){let b=a.trim().toLowerCase();return X.find(a=>a.name.toLowerCase()===b)}var $=c(75365);let _=[{group:"configuration",match:a=>a.includes("harness config")||a.includes("allowedTargetRepos")||a.includes("harness.config.json")},{group:"filesystem",match:a=>a.includes("runs/ directory writable")},{group:"linear",match:a=>a.startsWith("LINEAR_API_KEY")},{group:"cursor",match:a=>a.startsWith("CURSOR_API_KEY")||a.startsWith("Cursor models.list")||a.startsWith("Cursor repositories.list")},{group:"github",match:a=>a.startsWith("GITHUB_TOKEN")||a.includes("base branch exists")||a.includes("PR head-branch write")}];function aa(a){return a?.trim()||V.o}function ab(a){let b=aa(a?.harnessRepo);return{summary:`Manual GitHub Actions secret setup for ${b}.`,steps:[`Open GitHub repository settings for ${b}.`,"Navigate to Settings → Secrets and variables → Actions.","Create or update these secret names: HARNESS_CONFIG_JSON_B64, LINEAR_API_KEY, CURSOR_API_KEY, HARNESS_GITHUB_TOKEN.","Set HARNESS_CONFIG_JSON_B64 from the base64-encoded full private harness config.","Set LINEAR_API_KEY, CURSOR_API_KEY, and HARNESS_GITHUB_TOKEN from your operator credentials.","Never print secret values in logs, docs, PR comments, or generated setup previews."]}}let ac={scaffoldEnvLocal:{id:"scaffold-env-local",label:"Scaffold .env.local",description:"Create or update local environment file from committed example",permission:g.P.localFileWrite},scaffoldConfigLocal:{id:"scaffold-config-local",label:"Scaffold .harness/config.local.json",description:"Create or update private harness config from committed example",permission:g.P.localFileWrite},generateHarnessConfigB64Instructions:{id:"generate-harness-config-b64-instructions",label:"Generate HARNESS_CONFIG_JSON_B64 instructions",description:"Produce manual copy-paste steps for GitHub Actions config secret",permission:g.P.readOnly},generateGitHubSecretInstructions:{id:"generate-github-secret-instructions",label:"Generate GitHub Actions secret instructions",description:"Produce manual copy-paste steps for harness repo secrets",permission:g.P.readOnly},applyHarnessSecrets:{id:V.PN.applyHarnessSecrets.id,label:V.PN.applyHarnessSecrets.label,description:V.PN.applyHarnessSecrets.description,permission:V.PN.applyHarnessSecrets.permission},futureSetGitHubSecrets:{id:V.PN.applyHarnessSecrets.id,label:V.PN.applyHarnessSecrets.label,description:V.PN.applyHarnessSecrets.description,permission:V.PN.applyHarnessSecrets.permission},previewHarnessSecrets:{id:V.PN.previewHarnessSecrets.id,label:V.PN.previewHarnessSecrets.label,description:V.PN.previewHarnessSecrets.description,permission:V.PN.previewHarnessSecrets.permission},previewTargetWorkflowPr:{id:V.PN.previewTargetWorkflowPr.id,label:V.PN.previewTargetWorkflowPr.label,description:V.PN.previewTargetWorkflowPr.description,permission:V.PN.previewTargetWorkflowPr.permission},applyTargetWorkflowPr:{id:V.PN.applyTargetWorkflowPr.id,label:V.PN.applyTargetWorkflowPr.label,description:V.PN.applyTargetWorkflowPr.description,permission:V.PN.applyTargetWorkflowPr.permission}};async function ad(a){let b=(0,k.ym)(a?.cwd),c=a?.force??!1,d=a?.mode??"apply",e=[],g=[];"apply"===d&&await (0,f.mkdir)(b.harnessDir,{recursive:!0});let h=await o({paths:b,force:c,mode:d});e.push(h),h.logMessage&&g.push(h.logMessage);let j=await (0,i.vb)({paths:b,force:c,mode:d});return e.push(j),j.logMessage&&g.push(j.logMessage),{results:e,logMessages:g}}var ae=c(14745);async function af(a){try{return await (0,f.access)(a),!0}catch{return!1}}async function ag(a){let b={LINEAR_API_KEY:!1,CURSOR_API_KEY:!1,GITHUB_TOKEN:!1,VERCEL_TOKEN:!1,HARNESS_CONFIG_PATH:!1};try{for(let c of(await (0,f.readFile)(a,"utf8")).split("\n")){let a=c.trim();if(!a||a.startsWith("#"))continue;let d=a.indexOf("=");if(-1===d)continue;let e=a.slice(0,d).trim(),f=a.slice(d+1).trim();e in b&&f.length>0&&(b[e]=!0)}}catch{}return b}function ah(a){return{repoCount:a.repos.length,repos:a.repos.map(a=>({id:a.id,targetRepo:a.targetRepo,baseBranch:a.baseBranch,productionBranch:a.productionBranch,previewProvider:a.previewProvider,linearProjects:a.linearProjects})),linearTeamKey:a.linear?.teamKey,allowedTargetRepos:a.allowedTargetRepos,closureValid:function(a){try{return(0,q.g1)(a),!0}catch{return!1}}(a),model:(0,ae.M)(a)}}async function ai(a){let b=(0,k.ym)(a?.cwd),c=a?.envLocalExists??await af(b.envLocal),d=a?.configLocalExists??await af(b.configLocal),e=[];if(a?.configParseError?e.push({label:"harness config valid",ok:!1,detail:a.configParseError}):a?.config?(e.push({label:"harness config valid",ok:!0,detail:"resolved for local GUI summary"}),e.push({label:"allowedTargetRepos covers all repo mappings",ok:!0})):e.push({label:"harness config valid",ok:!1,detail:"config could not be resolved"}),e.push({label:".env.local present",ok:c,detail:c?b.envLocal:"run npm run harness:operator:init"}),e.push({label:".harness/config.local.json present",ok:d,detail:d?b.configLocal:"run npm run harness:operator:init"}),a?.config){let b=(0,ae.M)(a.config);e.push({label:"Cursor model policy resolved",ok:!0,detail:`${b.resolvedModelId} (${b.source})`})}return e.push({label:"LINEAR_API_KEY set",ok:!1,skipped:!0,detail:"remote provider checks are CLI-only in Milestone 3"}),e.push({label:"CURSOR_API_KEY set",ok:!1,skipped:!0,detail:"remote provider checks are CLI-only in Milestone 3"}),e.push({label:"GITHUB_TOKEN set",ok:!1,skipped:!0,detail:"remote provider checks are CLI-only in Milestone 3"}),e}let aj=new Set(["HARNESS_CONFIG_JSON_B64","HARNESS_CONFIG_JSON"]);function ak(a,b,c){return{kind:a.kind,label:aj.has(a.kind)?a.kind:a.label,resolved:b,parseError:c}}async function al(a){let b,c=a?.cwd??process.cwd();(0,e.Re)(c);let d=(0,k.ym)(c),f=await af(d.envLocal),g=await af(d.configLocal),h=await ag(d.envLocal),l=null,m=(0,t.m)({baseDir:c}),n=ak(m,!1);try{let a=await (0,q.rL)({baseDir:c});l=a.config,n=ak(a.source,!0)}catch(a){n=ak(m,!1,b=a instanceof Error?a.message:String(a))}let o=await ad({cwd:c,mode:"dry-run"}),r=await p({paths:d,mode:"dry-run",input:{}}),s=await (0,i.writeConfigLocal)({paths:d,mode:"dry-run",input:{repos:[{id:"target-app",linearProjects:["Example Target App"],targetRepo:"https://github.com/owner/example-target-app"}]}}),v=(0,u.RB)(),w=await (0,U.z8)({cwd:c}),x=(0,U.OW)(w),y=await ai({cwd:c,config:l,configParseError:b,envLocalExists:f,configLocalExists:g}),z=function(a){let b=new Map;for(let c of a){let a=_.find(a=>a.match(c.label))?.group??"configuration",d=b.get(a)??[];d.push(c),b.set(a,d)}return["configuration","filesystem","linear","cursor","github"].filter(a=>b.has(a)).map(a=>({group:a,checks:b.get(a)??[]}))}(y),A=!!l&&!b,B=A&&g&&("HARNESS_CONFIG_PATH"===n.kind||"cli-config"===n.kind),C=f&&g;return function(a,b=[]){let c=a=>(0,j.h4)((0,j.QJ)(a),b);return{...a,scaffoldPreviews:a.scaffoldPreviews.map(a=>(0,j.qs)(a,b)),instructionPreviews:a.instructionPreviews.map(a=>(0,j.qs)(a,b)),generatedPreviews:{envLocal:a.generatedPreviews.envLocal?c(a.generatedPreviews.envLocal):void 0,configLocal:a.generatedPreviews.configLocal},missingSteps:a.missingSteps.map(a=>({...a,detail:c(a.detail)})),doctor:{...a.doctor,checks:a.doctor.checks.map(a=>({...a,detail:a.detail?c(a.detail):void 0})),groups:a.doctor.groups.map(a=>({...a,checks:a.checks.map(a=>({...a,detail:a.detail?c(a.detail):void 0}))}))}}}({overview:{readyForLocalDoctor:A&&C,configResolved:A,operatorConfigResolved:B,localFilesPresent:C},localFiles:[{label:".env.local",path:d.envLocal,exists:f},{label:".harness/config.local.json",path:d.configLocal,exists:g},{label:".env.example",path:d.envExample,exists:await af(d.envExample)},{label:".harness/config.example.json",path:d.configExample,exists:await af(d.configExample)}],configSource:{...n,parseError:b,resolved:A},configSummary:l?ah(l):ah(v),envKeyPresence:h,scaffoldPreviews:o.results,instructionPreviews:[function(a){let b=function(a){let b=a?.configPath??".harness/config.local.json",c=`base64 < ${b} | tr -d '\\n'`;return{summary:"Encode the full private harness config for the HARNESS_CONFIG_JSON_B64 GitHub Actions secret.",command:c,steps:["Maintain the full private harness config locally at .harness/config.local.json.","Ensure every managed repo appears in both repos[] and allowedTargetRepos[].",`Run: ${c}`,"Copy the single-line output into the harness repo GitHub Actions secret HARNESS_CONFIG_JSON_B64.","Do not commit the encoded value or private config to the public harness repo."]}}(a);return{actionId:ac.generateHarnessConfigB64Instructions.id,outcome:"preview",permission:ac.generateHarnessConfigB64Instructions.permission,manualInstructions:b.steps,content:b.command,reason:b.summary}}({configPath:".harness/config.local.json"}),function(a){let b=ab(a);return{actionId:ac.generateGitHubSecretInstructions.id,outcome:"preview",permission:ac.generateGitHubSecretInstructions.permission,manualInstructions:b.steps,reason:b.summary}}({harnessRepo:x})],generatedPreviews:{envLocal:r.content,configLocal:s.content??JSON.stringify(v,null,2)},missingSteps:function(a){let b=[];return a.envExists||b.push({id:"missing-env-local",label:"Create .env.local",detail:"Run npm run harness:operator:init to scaffold local env files."}),a.configExists||b.push({id:"missing-config-local",label:"Create .harness/config.local.json",detail:"Run npm run harness:operator:init, then edit your target repo mapping."}),a.configParseError?b.push({id:"config-parse-error",label:"Fix harness config parse errors",detail:a.configParseError}):a.configResolved||b.push({id:"config-unresolved",label:"Point harness config resolution at your private config",detail:"Set HARNESS_CONFIG_PATH in .env.local to .harness/config.local.json."}),a.envKeyPresence.HARNESS_CONFIG_PATH||b.push({id:"missing-harness-config-path",label:"Set HARNESS_CONFIG_PATH",detail:"Keep HARNESS_CONFIG_PATH=.harness/config.local.json in .env.local."}),a.envKeyPresence.LINEAR_API_KEY||b.push({id:"missing-linear-key",label:"Add LINEAR_API_KEY for live doctor and harness runs",detail:"Fill LINEAR_API_KEY in .env.local when ready for live validation."}),a.envKeyPresence.CURSOR_API_KEY||b.push({id:"missing-cursor-key",label:"Add CURSOR_API_KEY for live cloud agent phases",detail:"Fill CURSOR_API_KEY in .env.local when ready for live validation."}),a.envKeyPresence.GITHUB_TOKEN||b.push({id:"missing-github-token",label:"Add GITHUB_TOKEN for handoff and merge checks",detail:"Fill GITHUB_TOKEN in .env.local when ready for live validation."}),a.envKeyPresence.VERCEL_TOKEN||b.push({id:"missing-vercel-token",label:"Add VERCEL_TOKEN for Vercel bridge setup",detail:"Fill VERCEL_TOKEN in .env.local for Configure-time Vercel inspection."}),b}({envExists:f,configExists:g,configResolved:A,configParseError:b,envKeyPresence:h}),doctor:{checks:y,groups:z,failed:y.some(a=>!a.ok&&!a.skipped),remoteChecksNote:"Live Linear, GitHub, and Cursor doctor checks remain CLI-only in Milestone 3. Run npm run harness:doctor for full validation."},deferredActions:[]},function(){let a=[],b=process.env.HARNESS_CONFIG_JSON?.trim();b&&a.push(b);let c=process.env.HARNESS_CONFIG_JSON_B64?.trim();if(c){a.push(c);try{a.push(Buffer.from(c,"base64").toString("utf8"))}catch{}}return a}())}var am=c(92116),an=c(67470);let{seal:ao}=c(11900);var ap=c(16589);function aq(a){return a.explicitReplacement?"payload":a.envPresent?"enriched-local":"absent"}async function ar(a){let b=(0,k.ym)(a.cwd),c=await (0,h.X_)(b.envLocal),d=a.operatorInput?.credentialInputSources??{linearApiKey:"absent",cursorApiKey:"absent",harnessGithubToken:"absent"};return{linearApiKey:d.linearApiKey,cursorApiKey:d.cursorApiKey,harnessGithubToken:d.harnessGithubToken,explicitCredentialReplacements:[...a.operatorInput?.explicitCredentialReplacements??[]].sort(),envLocalCredentialBaseline:c}}async function as(a){let b=(0,k.ym)(a),c=await (0,f.readFile)(b.configLocal);JSON.parse(c.toString("utf8"));let e=(0,d.createHash)("sha256").update(c).digest("hex");return{bytes:c,hash:e}}function at(a){return a.toString("base64")}async function au(a){let b,c=await (0,U.z8)({cwd:a.cwd,manualRepo:a.manualHarnessDispatchRepo}),d=!1,e="";try{let b=await as(a.cwd);d=!0,e=b.hash}catch(a){b=a instanceof Error?a.message:String(a)}let f=function(a){let b=new Map((a.secretStatuses??[]).map(a=>[a.name,a.status])),c=[];for(let e of V.LY){var d;if("HARNESS_CONFIG_JSON_B64"===e){if(!a.configLocalExists){c.push({name:e,action:"skip",source:"missing-input"});continue}c.push({name:e,action:"present"===b.get(e)?"update":"create",source:"generated-config-b64"});continue}let f="present"===b.get(e),g=function(a,b){let c=a?.credentialInputSources;if(c){if("LINEAR_API_KEY"===b)return"absent"!==c.linearApiKey;if("CURSOR_API_KEY"===b)return"absent"!==c.cursorApiKey;if("HARNESS_GITHUB_TOKEN"===b)return"absent"!==c.harnessGithubToken}return!!("LINEAR_API_KEY"===b?a?.linearApiKey:"CURSOR_API_KEY"===b?a?.cursorApiKey:"HARNESS_GITHUB_TOKEN"===b?a?.githubToken:void 0)?.trim()}(a.operatorInput,e),h=(d=a.operatorInput,d?.explicitCredentialReplacements?.includes(e)??!1);if(f&&!h){c.push({name:e,action:"skip",source:"preserve-existing"});continue}if(g){c.push({name:e,action:f?"update":"create",source:"operator-input"});continue}c.push({name:e,action:"skip",source:"missing-input"})}return c}({operatorInput:a.operatorInput,configLocalExists:d,secretStatuses:a.secretStatuses});return{harnessDispatchRepo:c,configLocalExists:d,configLocalHash:e,secretWritePlan:f,validationError:b}}async function av(a){var b;let c=await au(a),d=(0,U.OW)(c.harnessDispatchRepo),e=ab({harnessRepo:d}).steps,f=await ar(a),g=JSON.stringify({actionId:(b={actionId:V.PN.previewHarnessSecrets.id,permissionScope:V.PN.previewHarnessSecrets.permission.scope,harnessDispatchRepo:d,harnessDispatchRepoSource:c.harnessDispatchRepo.source,secretWritePlan:c.secretWritePlan,credentialInputContext:f,configLocalHash:c.configLocalHash}).actionId,permissionScope:b.permissionScope,harnessDispatchRepo:b.harnessDispatchRepo,harnessDispatchRepoSource:b.harnessDispatchRepoSource,secretWritePlan:b.secretWritePlan.map(a=>({name:a.name,action:a.action,source:a.source})),credentialInputContext:{linearApiKey:b.credentialInputContext.linearApiKey,cursorApiKey:b.credentialInputContext.cursorApiKey,harnessGithubToken:b.credentialInputContext.harnessGithubToken,explicitCredentialReplacements:[...b.credentialInputContext.explicitCredentialReplacements].sort(),envLocalCredentialBaseline:b.credentialInputContext.envLocalCredentialBaseline},configLocalHash:b.configLocalHash??""});return{harnessDispatchRepo:c.harnessDispatchRepo,configLocalHash:c.configLocalHash,secretWritePlan:c.secretWritePlan,fingerprint:g,previewSummary:function(a){let b=(0,U.OW)(a.harnessDispatchRepo),c=a.secretWritePlan.filter(a=>"skip"!==a.action).map(a=>a.name);return 0===c.length?`No harness repo Actions secrets would be written for ${b}.`:`Would write harness repo Actions secrets for ${b}: ${c.join(", ")}. Secret values are never shown in previews.`}({harnessDispatchRepo:c.harnessDispatchRepo,secretWritePlan:c.secretWritePlan}),manualInstructions:e,validationError:c.validationError}}function aw(a){let b=(0,ap.wL)(a);return b?`${b.owner}/${b.repo}`:null}async function ax(a){let b=(0,k.ym)(a.cwd),c=await (0,h.Hn)(b),d=[],e=a.payload.linearApiKey?.trim();e?d.push("LINEAR_API_KEY"):e=c?.values.LINEAR_API_KEY?.trim()||void 0;let f=a.payload.cursorApiKey?.trim();f?d.push("CURSOR_API_KEY"):f=c?.values.CURSOR_API_KEY?.trim()||void 0;let g=a.payload.harnessGithubToken?.trim();return g?d.push("HARNESS_GITHUB_TOKEN"):g=c?.values.GITHUB_TOKEN?.trim()||void 0,{linearApiKey:e,cursorApiKey:f,githubToken:g,explicitCredentialReplacements:d.length>0?d:void 0,credentialInputSources:{linearApiKey:aq({explicitReplacement:d.includes("LINEAR_API_KEY"),envPresent:c?.presence.LINEAR_API_KEY??!1}),cursorApiKey:aq({explicitReplacement:d.includes("CURSOR_API_KEY"),envPresent:c?.presence.CURSOR_API_KEY??!1}),harnessGithubToken:aq({explicitReplacement:d.includes("HARNESS_GITHUB_TOKEN"),envPresent:c?.presence.GITHUB_TOKEN??!1})}}}async function ay(a){let b=a?.cwd,c=(0,k.ym)(b),d=await (0,h.Hn)(c),e={},f=[];try{let{bytes:a}=await as(b);e.HARNESS_CONFIG_JSON_B64=at(a)}catch{f.push("HARNESS_CONFIG_JSON_B64")}let g=d?.values.LINEAR_API_KEY?.trim();g?e.LINEAR_API_KEY=g:f.push("LINEAR_API_KEY");let i=d?.values.CURSOR_API_KEY?.trim();i?e.CURSOR_API_KEY=i:f.push("CURSOR_API_KEY");let j=d?.values.GITHUB_TOKEN?.trim();return j?e.HARNESS_GITHUB_TOKEN=j:f.push("HARNESS_GITHUB_TOKEN"),{values:e,missing:f}}function az(a){return`harness/setup-production-sync-${a}`}function aA(){return"Install harness production sync workflow"}function aB(a){return`Install the harness production sync workflow via Product Development Harness setup.
-
-- Repo config id: ${a.repoConfigId}
-- Production branch watched: ${a.productionBranch}
-- Harness dispatch repo: ${a.harnessDispatchRepo}
-
-This workflow dispatches \`production_promoted\` to the harness repo after production branch pushes.
-It does not run harness planning, implementation, handoff, revision, or merge phases.
-
-Required target repo secret: \`HARNESS_DISPATCH_TOKEN\` (dispatch-only PAT scoped to the harness repo).`}function aC(a){return(0,d.createHash)("sha256").update(a).digest("hex")}function aD(a,b){return a?aC(a)===aC(b)?"present":"differs":"missing"}function aE(a){var b,c,e;let f=function(a){let b=aw(a.targetRepo);if(!b)return{plan:{repoConfigId:a.repoConfigId,targetRepoSlug:"<invalid-target-repo>",harnessDispatchRepo:(0,U.OW)(a.harnessDispatchRepo),productionBranch:a.productionBranch,workflowPath:V.CH,branchName:az(a.repoConfigId),prTitle:aA(),prBody:aB({repoConfigId:a.repoConfigId,productionBranch:a.productionBranch,harnessDispatchRepo:(0,U.OW)(a.harnessDispatchRepo)}),workflowStatus:"unknown",directProductionBranchWrite:!1},workflowContent:"",validationError:`Invalid target repo URL: ${a.targetRepo}`};let c=(0,U.OW)(a.harnessDispatchRepo),d=function(a){var b;let c=(b=a.harnessDispatchRepo,`https://api.github.com/repos/${b}/dispatches`);return`name: Trigger harness production sync
-
-on:
-  push:
-    branches: [${a.productionBranch}]
-
-permissions:
-  contents: read
-
-jobs:
-  dispatch:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Dispatch production_promoted to harness
-        env:
-          HARNESS_DISPATCH_TOKEN: \${{ secrets.HARNESS_DISPATCH_TOKEN }}
-        run: |
-          curl -fsS -X POST \\
-            -H "Authorization: Bearer \${HARNESS_DISPATCH_TOKEN}" \\
-            -H "Accept: application/vnd.github+json" \\
-            -H "X-GitHub-Api-Version: 2022-11-28" \\
-            ${c} \\
-            -d "$(jq -n \\
-              --arg repo ${a.repoConfigId} \\
-              --arg branch ${a.productionBranch} \\
-              --arg source ${a.targetRepoSlug} \\
-              --arg after "\${{ github.sha }}" \\
-              --arg ref "\${{ github.ref }}" \\
-              --arg run_id "\${{ github.run_id }}" \\
-              --arg received "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \\
-              '{event_type:"production_promoted", client_payload:{repo:$repo, productionBranch:$branch, sourceRepo:$source, after:$after, ref:$ref, githubRunId:$run_id, receivedAt:$received}}')"
-`}({harnessDispatchRepo:c,repoConfigId:a.repoConfigId,targetRepoSlug:b,productionBranch:a.productionBranch});return{plan:{repoConfigId:a.repoConfigId,targetRepoSlug:b,harnessDispatchRepo:c,productionBranch:a.productionBranch,workflowPath:V.CH,branchName:az(a.repoConfigId),prTitle:aA(),prBody:aB({repoConfigId:a.repoConfigId,productionBranch:a.productionBranch,harnessDispatchRepo:c}),workflowStatus:a.workflowStatus??"unknown",directProductionBranchWrite:!1},workflowContent:d}}(a),g=function(a){let b=aa(a?.harnessRepo),c=a?.repoConfigId??"target-app",d=a?.targetRepoSlug??"owner/example-target-app",e=a?.productionBranch??"main";return{summary:"Manual target repo workflow install for production promotion dispatch.",steps:["In the example target repo, create .github/workflows/trigger-harness-production-sync.yml.",`Set the harness dispatch URL to https://api.github.com/repos/${b}/dispatches.`,`Set payload repo to the private config repos[].id value (${c}).`,`Set payload sourceRepo to the target repo slug (${d}).`,`Restrict the workflow to production branch pushes (${e}).`,"Store HARNESS_DISPATCH_TOKEN in the target repo only; do not place merge-capable tokens in Vercel.","Preferred first behavior: open a PR with the workflow file instead of direct push."]}}({harnessRepo:f.plan.harnessDispatchRepo,repoConfigId:f.plan.repoConfigId,targetRepoSlug:f.plan.targetRepoSlug,productionBranch:f.plan.productionBranch}).steps,h=(c=JSON.stringify({actionId:(b={actionId:V.PN.previewTargetWorkflowPr.id,permissionScope:V.PN.previewTargetWorkflowPr.permission.scope,repoConfigId:f.plan.repoConfigId,targetRepoSlug:f.plan.targetRepoSlug,harnessDispatchRepo:f.plan.harnessDispatchRepo,productionBranch:f.plan.productionBranch,workflowPath:f.plan.workflowPath,branchName:f.plan.branchName,workflowContentHash:aC(f.workflowContent),productionBranchSha:a.productionBranchSha}).actionId,permissionScope:b.permissionScope,repoConfigId:b.repoConfigId,targetRepoSlug:b.targetRepoSlug,harnessDispatchRepo:b.harnessDispatchRepo,productionBranch:b.productionBranch,workflowPath:b.workflowPath,branchName:b.branchName,workflowContentHash:b.workflowContentHash,productionBranchSha:b.productionBranchSha??""}),(0,d.createHash)("sha256").update(c).digest("hex").slice(0,16));return{plan:f.plan,workflowContent:f.workflowContent,workflowPreviewSummary:(e=f.plan,`Workflow path: ${e.workflowPath}
-Install branch: ${e.branchName}
-PR base branch: ${e.productionBranch}
-Harness dispatch repo: ${e.harnessDispatchRepo}
-Workflow status: ${e.workflowStatus}
-Direct production branch write: never`),fingerprint:h,manualInstructions:g,validationError:f.validationError}}function aF(a){if(a instanceof an.OS){if(401===a.status)return"github_auth_failure";if(409===a.status)return"pr_already_merged";if(405===a.status){let b=a.message.toLowerCase();if(b.includes("already been merged")||b.includes("already merged"))return"pr_already_merged"}}return"github_merge_failure"}function aG(a){let b=(a.message??(a.error instanceof Error?a.error.message:String(a.error))).toLowerCase();if(a.error instanceof an.OS){if(401===a.error.status||403===a.error.status)return b.includes("review")||b.includes("approval")||b.includes("required reviewers")?{category:"review-required",waiting:!1,message:"GitHub requires human review before this workflow install PR can merge."}:{category:"permission-denied",waiting:!1,message:"The setup token does not have permission to merge this workflow install PR."};if(405===a.error.status&&"pr_already_merged"===aF(a.error))return{category:"merge-api-failure",waiting:!1,message:"Workflow install PR was already merged."};if(409===a.error.status)return{category:"merge-conflict",waiting:!1,message:"The workflow install PR has merge conflicts that require manual resolution."};if(422===a.error.status){if(b.includes("merge queue")||b.includes("queued for merge"))return{category:"merge-queue-required",waiting:!1,message:"This repository requires merge queue handling that onboarding does not support automatically."};if(b.includes("head sha")||b.includes("expected head"))return{category:"mergeability-pending",waiting:!0,message:"The workflow install PR head changed during finalization. Revalidating before merge."};if(b.includes("required status")||b.includes("not mergeable")||b.includes("checks"))return{category:"checks-pending",waiting:!0,message:"GitHub is still waiting for required checks on the workflow install PR."};if(b.includes("review"))return{category:"review-required",waiting:!1,message:"GitHub requires human review before this workflow install PR can merge."}}}let c=a.mergeableState?.toLowerCase()??"";return"dirty"===c?{category:"merge-conflict",waiting:!1,message:"The workflow install PR has merge conflicts that require manual resolution."}:"behind"===c?{category:"branch-behind",waiting:!0,message:"The workflow install branch is behind the production branch."}:"blocked"===c?{category:"review-required",waiting:!1,message:"Branch protection or review rules are blocking automatic merge of the workflow install PR."}:{category:"merge-api-failure",waiting:!1,message:"GitHub rejected the workflow install PR merge request."}}function aH(a){switch(a){case"checks-pending":return"Waiting for GitHub checks on the workflow install PR.";case"checks-failing":return"Required checks failed on the workflow install PR.";case"mergeability-pending":return"GitHub is still computing mergeability for the workflow install PR.";case"branch-behind":return"Updating the workflow install branch to match production.";case"review-required":return"Human review is required before the workflow install PR can merge.";case"permission-denied":return"The setup token cannot merge the workflow install PR.";case"merge-conflict":return"The workflow install PR has merge conflicts.";case"unexpected-pr-content":return"The workflow install PR contains unexpected changes.";case"merge-queue-required":return"This repository requires merge queue handling.";case"merge-api-failure":return"GitHub rejected the workflow install merge request.";case"verification-failed":return"The workflow was merged but production verification has not succeeded yet.";default:return"Workflow install finalization is blocked."}}let aI=new Map;function aJ(a,b){return`${a}:${b}`}function aK(a){return{repoConfigId:a.input.repoConfigId,targetRepo:a.input.targetRepo,targetRepoSlug:a.targetRepoSlug,productionBranch:a.input.productionBranch,branchName:a.branchName,lifecycle:a.lifecycle,blockedCategory:a.blockedCategory,message:a.message,prUrl:a.prUrl,prNumber:a.prNumber,validatedHeadSha:a.validatedHeadSha,workflowStatus:a.workflowStatus,canRetry:a.canRetry??!1,requiresGitHubIntervention:a.requiresGitHubIntervention??!1,advancedThisRequest:a.advancedThisRequest??!0,lockContended:!1}}var aL=c(31421),aM=c(97631);class aN{constructor(a={}){this.state=a,this.calls=[],this.encryptedWrites=[],this.mutableWorkflowContent=a.existingWorkflowContent}advanceTargetWorkflowFinalization(a){this.calls.push({method:"advanceTargetWorkflowFinalization",args:[a]});let b=this.state.harnessDispatchRepo??{resolved:!0,repo:"owner/harness-repo",source:"explicit-config"},c=aE({repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,harnessDispatchRepo:b});return function(a){let b=aw(a.finalizeInput.targetRepo);if(!b)return aK({input:a.finalizeInput,targetRepoSlug:"<invalid>",branchName:az(a.finalizeInput.repoConfigId),lifecycle:"blocked",workflowStatus:"unknown",message:"Invalid target repo URL.",blockedCategory:"unexpected-pr-content",requiresGitHubIntervention:!0});let c=a.finalizeInput.branchName??az(a.finalizeInput.repoConfigId),d=a.scenario??{},e=function(a){let b=aI.get(a);if(b)return b;let c={checksPollCount:0,verificationPollCount:0,mergeAttempts:0,branchUpdateAttempts:0};return aI.set(a,c),c}(aJ(b,a.finalizeInput.repoConfigId)),f=a.existingWorkflowContent,g="unknown";if("present"==(g=null==f?"missing":f===a.intendedWorkflowContent?"present":"differs"))return aI.delete(aJ(b,a.finalizeInput.repoConfigId)),aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"complete",workflowStatus:"present",message:"Workflow installed on the production branch."});let h=a.finalizeInput.prUrl??d.prUrl??`https://github.com/${b}/pull/${d.prNumber??1}`,i=d.prNumber??1,j=d.headSha??"mock-head-sha";if(d.unexpectedExtraFile||d.workflowContentMismatch)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("unexpected-pr-content"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"unexpected-pr-content",requiresGitHubIntervention:!0});if(d.alreadyMerged){e.verificationPollCount+=1;let f=d.verificationLagSteps??0;return e.verificationPollCount>f?(a.onProductionWorkflowUpdate?.(a.intendedWorkflowContent),aI.delete(aJ(b,a.finalizeInput.repoConfigId)),aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"complete",workflowStatus:"present",message:"Workflow installed on the production branch.",prUrl:h,prNumber:i})):aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"verifying",workflowStatus:g,message:"Verifying workflow on the production branch.",prUrl:h,prNumber:i,canRetry:!0})}if("failing"===d.checks)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("checks-failing"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"checks-failing",requiresGitHubIntervention:!0});if("pending"===d.checks&&(e.checksPollCount+=1,e.checksPollCount<2))return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"waiting-for-checks",workflowStatus:g,message:aH("checks-pending"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"checks-pending"});if("unknown"===d.mergeableState)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"waiting-for-checks",workflowStatus:g,message:aH("mergeability-pending"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"mergeability-pending"});if("behind"===d.mergeableState){if(0===e.branchUpdateAttempts)return e.branchUpdateAttempts+=1,aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"updating-branch",workflowStatus:g,message:aH("branch-behind"),prUrl:h,prNumber:i,validatedHeadSha:j});d.mergeableState="clean"}if("dirty"===d.mergeableState)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("merge-conflict"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"merge-conflict",requiresGitHubIntervention:!0});if("blocked"===d.mergeableState)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("review-required"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"review-required",requiresGitHubIntervention:!0});e.lastValidatedHeadSha=j;let k=d.headShaChangesAfterValidation?"changed-head-sha":j;if(0===e.mergeAttempts){if(e.mergeAttempts+=1,"permission-denied"===d.mergeResult)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("permission-denied"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"permission-denied",requiresGitHubIntervention:!0});if("review-required"===d.mergeResult)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("review-required"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"review-required",requiresGitHubIntervention:!0});if("conflict"===d.mergeResult)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:g,message:aH("merge-conflict"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"merge-conflict",requiresGitHubIntervention:!0});if(d.headShaChangesAfterValidation&&k!==j)return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"waiting-for-checks",workflowStatus:g,message:aH("mergeability-pending"),prUrl:h,prNumber:i,validatedHeadSha:k,blockedCategory:"mergeability-pending"});e.verificationPollCount+=1;let f=d.verificationLagSteps??0;if(e.verificationPollCount>f){let e=d.productionWorkflowAfterMerge??a.intendedWorkflowContent;return(a.onProductionWorkflowUpdate?.(e),e===a.intendedWorkflowContent)?(aI.delete(aJ(b,a.finalizeInput.repoConfigId)),aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"complete",workflowStatus:"present",message:"Workflow installed on the production branch.",prUrl:h,prNumber:i,validatedHeadSha:j})):aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"blocked",workflowStatus:"differs",message:aH("verification-failed"),prUrl:h,prNumber:i,validatedHeadSha:j,blockedCategory:"verification-failed",canRetry:!0,requiresGitHubIntervention:!0})}return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"verifying",workflowStatus:g,message:"Verifying workflow on the production branch.",prUrl:h,prNumber:i,validatedHeadSha:j,canRetry:!0})}return aK({input:a.finalizeInput,targetRepoSlug:b,branchName:c,lifecycle:"merging",workflowStatus:g,message:"Waiting for workflow install PR merge to complete.",prUrl:h,prNumber:i,validatedHeadSha:j,advancedThisRequest:!1})}({finalizeInput:a,intendedWorkflowContent:c.workflowContent,existingWorkflowContent:this.mutableWorkflowContent,scenario:this.state.finalizationScenario,onProductionWorkflowUpdate:a=>{this.mutableWorkflowContent=a}})}setExistingWorkflowContent(a){this.mutableWorkflowContent=a}async checkHarnessRepoAccess(a){return this.calls.push({method:"checkHarnessRepoAccess",args:[a]}),this.state.harnessRepoAccess??"unknown"}async listHarnessSecretStatuses(a){return this.calls.push({method:"listHarnessSecretStatuses",args:[a]}),V.LY.map(a=>({name:a,status:this.state.harnessSecretStatuses?.[a]??"unknown"}))}async checkTargetWorkflowStatus(a){this.calls.push({method:"checkTargetWorkflowStatus",args:[a]});let b=this.mutableWorkflowContent??this.state.existingWorkflowContent,c="unknown";return c=null==b?"missing":b===a.intendedWorkflowContent?"present":"differs",{repoAccess:this.state.targetRepoAccess??"unknown",workflowStatus:c,productionBranchSha:this.state.productionBranchSha}}async writeHarnessSecrets(a,b){for(let c of(this.calls.push({method:"writeHarnessSecrets",args:[a,b.map(a=>a.name)]}),b))this.encryptedWrites.push({harnessDispatchRepo:a,secretName:c.name,encryptedValue:`encrypted:${c.value.length}`});return this.state.writeHarnessSecretsResult??b.map(a=>({name:a.name,status:this.state.harnessSecretStatuses?.[a.name]==="present"?"updated":"created"}))}async applyTargetWorkflowPr(a){if(this.calls.push({method:"applyTargetWorkflowPr",args:[{...a,workflowContent:`<redacted:${a.workflowContent.length}>`}]}),a.branchName===a.productionBranch)throw Error("Direct production branch writes are not allowed");return this.state.applyTargetWorkflowResult?this.state.applyTargetWorkflowResult:this.state.existingWorkflowContent===a.workflowContent?{outcome:"already-installed",branchName:a.branchName,directProductionBranchWrite:!1}:{outcome:this.state.existingOpenPrUrl?"pr-updated":"pr-created",branchName:a.branchName,prUrl:this.state.existingOpenPrUrl??`https://github.com/${a.targetRepoSlug}/pull/1`,directProductionBranchWrite:!1}}}function aO(a){return 401===a||403===a||404===a?"denied":"unknown"}var aP=c(1913);function aQ(a){let[b,c]=a.split("/");if(!b||!c)throw Error(`Invalid GitHub repo slug: ${a}`);return{owner:b,repo:c}}function aR(a,b,c){let d=(0,am.M)(b),e=function(a){let b=a.trim();if(!b.startsWith("{"))return null;try{let a=JSON.parse(b);return"string"==typeof a.message?a:null}catch{return null}}(d),f=e?.message??d;return 403===a&&/workflow/i.test(f)&&(/scope/i.test(f)||/OAuth App/i.test(f))?aP.aR:c?.workflowFileOperation&&404===a&&"Not Found"===f&&e?.documentation_url?.includes("create-or-update-file-contents")===!0?`${aP.aR} (GitHub returned HTTP ${a}: Not Found.)`:e?.message?`GitHub API ${a}: ${e.message}`:d&&!d.startsWith("{")?`GitHub API ${a}: ${d}`:`GitHub API ${a}: request failed`}function aS(a){return a instanceof an.OS?aR(a.status,a.message):a instanceof Error?(0,am.M)(a.message):(0,am.M)(String(a))}function aT(a){return a instanceof an.OS?new an.OS(a.status,aR(a.status,a.message),{retryAfterSeconds:a.retryAfterSeconds,rateLimitRemaining:a.rateLimitRemaining,rateLimitResetEpochSeconds:a.rateLimitResetEpochSeconds,requestId:a.requestId}):Error(aS(a))}class aU{constructor(a){this.client=a instanceof an.jh?a:new an.jh(a)}async checkHarnessRepoAccess(a){try{let{owner:b,repo:c}=aQ(a),d=await this.client.getRepository(b,c);if(d.permissions?.admin===!0||d.permissions?.maintain===!0)return"available";return"denied"}catch(a){if(a instanceof an.OS)return aO(a.status);return"unknown"}}async listHarnessSecretStatuses(a){try{let{owner:b,repo:c}=aQ(a),d=await this.client.listActionsSecrets(b,c);return function(a,b){let c=new Set(a);return b.map(a=>({name:a,status:c.has(a)?"present":"missing"}))}(d.secrets.map(a=>a.name),V.LY)}catch(a){if(a instanceof an.OS&&(401===a.status||403===a.status||404===a.status))return V.LY.map(a=>({name:a,status:"unknown"}));throw Error(aS(a))}}async writeHarnessSecrets(a,b){let{owner:c,repo:d}=aQ(a),e=await this.client.getActionsPublicKey(c,d),f=new Set((await this.listHarnessSecretStatuses(a)).filter(a=>"present"===a.status).map(a=>a.name)),g=[];for(let a of b){let b=function(a,b){let c=ao(Buffer.from(a,"utf8"),Buffer.from(b,"base64"));return Buffer.from(c).toString("base64")}(a.value,e.key);await this.client.upsertActionsSecret(c,d,a.name,b,e.key_id),g.push({name:a.name,status:f.has(a.name)?"updated":"created"})}return g}async checkTargetWorkflowStatus(a){try{let{owner:b,repo:c}=aQ(a.targetRepoSlug),d=await this.client.getRepository(b,c),e=d.permissions?.push===!0||d.permissions?.admin===!0?"available":"denied",f=(await this.client.getBranchRef(b,c,a.productionBranch)).object.sha,g=await this.client.getRepositoryContent(b,c,a.workflowPath,a.productionBranch),h=g?this.client.decodeRepositoryContent(g):null,i=aD(h,a.intendedWorkflowContent);return{repoAccess:e,workflowStatus:i,productionBranchSha:f}}catch(a){if(a instanceof an.OS){if(404===a.status)return{repoAccess:"denied",workflowStatus:"unknown"};return{repoAccess:aO(a.status),workflowStatus:"unknown"}}throw Error(aS(a))}}async applyTargetWorkflowPr(a){if(a.branchName===a.productionBranch)throw Error("Direct production branch writes are not allowed");let{owner:b,repo:c}=aQ(a.targetRepoSlug),d=await this.client.getRepositoryContent(b,c,a.workflowPath,a.productionBranch);if(d&&aC(this.client.decodeRepositoryContent(d))===aC(a.workflowContent))return{outcome:"already-installed",branchName:a.branchName,directProductionBranchWrite:!1};let e=(await this.client.getBranchRef(b,c,a.productionBranch)).object.sha,f=!0;try{await this.client.getBranchRef(b,c,a.branchName)}catch(a){if(a instanceof an.OS&&404===a.status)f=!1;else throw a}f||await this.client.createGitRef(b,c,a.branchName,e);let g=await this.client.getRepositoryContent(b,c,a.workflowPath,a.branchName),h=g?.sha,i=g?this.client.decodeRepositoryContent(g):null;if(i&&aC(i)===aC(a.workflowContent)){let b=await this.findOpenInstallPullRequest(a);return{outcome:b?"pr-updated":"branch-updated",branchName:a.branchName,prUrl:b?.html_url,directProductionBranchWrite:!1}}await this.client.createOrUpdateRepositoryFile({owner:b,repo:c,path:a.workflowPath,branch:a.branchName,message:a.prTitle,content:a.workflowContent,sha:h});let j=await this.findOpenInstallPullRequest(a);if(j)return{outcome:"pr-updated",branchName:a.branchName,prUrl:j.html_url,directProductionBranchWrite:!1};let k=await this.client.createPullRequest({owner:b,repo:c,title:a.prTitle,head:a.branchName,base:a.productionBranch,body:a.prBody});return{outcome:"pr-created",branchName:a.branchName,prUrl:k.html_url,directProductionBranchWrite:!1}}async findOpenInstallPullRequest(a){let{owner:b,repo:c}=aQ(a.targetRepoSlug);return(await this.client.listPullRequests(b,c,{state:"open",base:a.productionBranch,head:`${b}:${a.branchName}`}))[0]}}function aV(a){return new aU({token:a})}class aW{constructor(a){this.client=a instanceof an.jh?a:new an.jh(a)}mapRepositoryToMetadata(a,b,c){if("number"!=typeof c.id||!Number.isInteger(c.id)||c.id<=0)throw Error(`GitHub repository metadata for ${a}/${b} is missing a valid numeric repository ID.`);return{repositoryId:c.id,owner:a,repo:b,description:c.description??null,private:!0===c.private,visibility:c.visibility??(c.private?"private":"public"),isTemplate:!0===c.is_template,defaultBranch:c.default_branch??"main",permissions:{admin:c.permissions?.admin===!0,maintain:c.permissions?.maintain===!0,push:c.permissions?.push===!0}}}async resolveAuthenticatedUser(){let a=await this.client.getAuthenticatedUser();return{id:a.id,login:a.login}}async inspectTokenCapabilities(){let a=await this.client.inspectAuthenticatedUser(),b=(0,aP.dI)(a.tokenType,a.oauthScopes),c="classic"===b&&0===a.oauthScopes.length;return{login:a.login,tokenType:b,hasRepoScope:(0,aP.YN)(a.oauthScopes),hasWorkflowScope:(0,aP.Rd)(a.oauthScopes),scopeAmbiguous:c}}async getRepositoryMetadata(a,b){try{let c=await this.client.getRepository(a,b);return this.mapRepositoryToMetadata(a,b,c)}catch(a){if(a instanceof an.OS&&404===a.status)return null;throw aT(a)}}async getRepositoryMetadataById(a){try{let b=await this.client.getRepositoryById(a),c=b.full_name;if(!c||!c.includes("/"))throw Error(`GitHub repository ID ${a} returned invalid full_name metadata.`);let[d,e]=c.split("/");if(!d||!e)throw Error(`GitHub repository ID ${a} returned invalid full_name metadata.`);return this.mapRepositoryToMetadata(d,e,b)}catch(a){if(a instanceof an.OS&&404===a.status)return null;throw aT(a)}}async getRepositoryDefaultBranchHead(a,b,c){return(await this.client.getBranchRef(a,b,c)).object.sha}async readRepositoryFileContent(a,b,c,d){let e=await this.client.getRepositoryContent(a,b,c,d);return e?this.client.decodeRepositoryContent(e):null}async createRepositoryFromTemplate(a){try{let b=await this.client.createRepositoryFromTemplate({templateOwner:a.templateOwner,templateRepo:a.templateRepo,owner:a.owner,name:a.name,description:a.description,private:a.private,includeAllBranches:a.includeAllBranches});return{repositoryId:b.id,fullName:b.full_name,defaultBranch:b.default_branch}}catch(a){throw aT(a)}}async createUserRepository(a){try{let b=await this.client.createUserRepository({name:a.name,description:a.description,private:a.private,autoInit:a.autoInit});return{repositoryId:b.id,fullName:b.full_name,defaultBranch:b.default_branch}}catch(a){throw aT(a)}}async createGitBlob(a){try{return await this.client.createGitBlob(a)}catch(a){throw aT(a)}}async createGitTree(a){try{return{sha:(await this.client.createGitTree(a)).sha}}catch(a){throw aT(a)}}async createGitCommit(a){try{let b=await this.client.createGitCommit(a);return{sha:b.sha,tree:b.tree,parents:b.parents}}catch(a){throw aT(a)}}async getGitCommit(a,b,c){try{let d=await this.client.getGitCommit(a,b,c);return{sha:d.sha,tree:d.tree,parents:d.parents}}catch(a){throw aT(a)}}async getGitRef(a,b,c){try{let d=await this.client.getGitRef(a,b,c);return{ref:d.ref,object:{sha:d.object.sha}}}catch(a){throw aT(a)}}async updateGitRef(a){try{if(a.expectedSha){let b=await this.client.getGitRef(a.owner,a.repo,a.ref);if(b.object.sha===a.sha)return{ref:b.ref,object:{sha:a.sha}};if(b.object.sha!==a.expectedSha)throw Error(`Ref update rejected: expected parent HEAD ${a.expectedSha}, found ${b.object.sha}.`)}let b=await this.client.updateGitRef(a);return{ref:b.ref,object:{sha:b.object.sha}}}catch(a){throw aT(a)}}async updateUserRepositoryDescription(a){try{await this.client.updateUserRepository(a)}catch(a){throw aT(a)}}async writeRepositoryFile(a){try{return await this.client.createOrUpdateRepositoryFile({owner:a.owner,repo:a.repo,path:a.path,branch:a.branch,message:a.message,content:a.content,sha:a.sha})}catch(a){throw aT(a)}}}var aX=c(73024),aY=c(76760),aZ=c.n(aY),a$=c(73136);function a_(a=process.env){return"packaged"===function(a=process.env){let b=a.P_DEV_RUNTIME_MODE?.trim().toLowerCase();return"packaged"===b?"packaged":"source"===b||"development"===b?"source":null}(a)}let a0="P_DEV_PACKAGE_VERSION",a1=/^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/;function a2(a=process.env,b="file:///Users/weston/Code/agentic-product-development-harness/src/p-dev/package-version.ts"){if(a_(a)){var c=a[a0];let b=c?.trim();if(!b)throw Error(`${a0} is required in packaged p-dev runtime.`);if(!a1.test(b))throw Error(`${a0} must be a valid package version string.`);return b}return function(a="file:///Users/weston/Code/agentic-product-development-harness/src/p-dev/package-version.ts"){let b=aZ().resolve(aZ().dirname((0,a$.fileURLToPath)(a)),"../../package.json"),c=JSON.parse((0,aX.readFileSync)(b,"utf8"));return c.version?.trim()||"0.0.0"}(b)}var a3=c(7285);let a4="preview";function a5(a){return a.trim().toLowerCase()}function a6(a){let b=a.trim(),c=b.indexOf("/");if(-1===c)return b.toLowerCase();let d=b.slice(0,c),e=b.slice(c+1);return`${d.trim().toLowerCase()}/${e.trim().toLowerCase()}`}function a7(a){return{operationId:a.operationId,authenticatedUserId:a.user.id,authenticatedLogin:a5(a.user.login),destination:a6(a.destination),packageName:a.manifest.packageName,packageVersion:a.manifest.packageVersion,sourceRepository:a.manifest.sourceRepository,sourceCommit:a.manifest.sourceCommit,manifestSchemaVersion:a.manifest.schemaVersion,snapshotFingerprint:a.snapshotFingerprint,snapshotContentId:a.manifest.snapshotContentId.trim(),snapshotSha256:a.manifest.snapshotSha256,snapshotGitTreeSha1:a.manifest.gitRootTreeSha1,classification:a.classification,envBaseline:a6(a.envBaseline||""),pDevVersion:a.pDevVersion.trim(),resumedFromPending:a.resumedFromPending,creationPreviewFingerprint:a.creationPreviewFingerprint}}let a8="weston-uribe/p-dev-harness-template",a9="p-dev-harness",ba=".harness/p-dev-template.json",bb=".harness/p-dev-managed-repo.json",bc="p-dev-harness-template",bd="p-dev",be="harness-template",bf="harness-workspace";function bg(a){let b;try{b=JSON.parse(a)}catch{return{ok:!1,reason:"Template identity JSON is malformed."}}if(!b||"object"!=typeof b)return{ok:!1,reason:"Template identity JSON is malformed."};let c=b,d=c.schemaVersion,e=c.product,f=c.role,g=c.templateIdentity,h=c.templateVersion,i=c.compatibilityVersion,j=c.templateContentId;if(1!==d)return{ok:!1,reason:`Unsupported template schema version ${String(d)}.`};if(e!==bd)return{ok:!1,reason:`Unexpected template product ${String(e)}.`};if(f!==be)return{ok:!1,reason:`Unexpected template role ${String(f)}.`};if(g!==bc)return{ok:!1,reason:`Unexpected template identity ${String(g)}.`};if(1!==h)return{ok:!1,reason:`Unsupported template version ${String(h)}.`};if(1!==i)return{ok:!1,reason:`Incompatible template compatibility version ${String(i)}.`};if("string"!=typeof j||!j.trim())return{ok:!1,reason:"Template identity is missing templateContentId."};let k=c.source&&"object"==typeof c.source?c.source:void 0;return{ok:!0,identity:{schemaVersion:1,product:bd,role:be,templateIdentity:bc,templateVersion:1,compatibilityVersion:1,templateContentId:j.trim(),source:k}}}var bh=c(8334);function bi(a,b,c){let d=a[b];return"string"==typeof d&&d.trim()?{ok:!0,value:d.trim()}:{ok:!1,reason:`Managed marker is missing ${c}.`}}function bj(a,b,c){let d=a[b];return"number"==typeof d&&Number.isFinite(d)?{ok:!0,value:d}:{ok:!1,reason:`Managed marker is missing ${c}.`}}function bk(a){let b,c;try{b=JSON.parse(a)}catch{return{ok:!1,reason:"Managed marker JSON is malformed."}}if(!b||"object"!=typeof b)return{ok:!1,reason:"Managed marker JSON is malformed."};let d=b;if(1!==d.schemaVersion)return{ok:!1,reason:`Unsupported managed marker schema version ${String(d.schemaVersion)}.`};if(d.product!==bd)return{ok:!1,reason:`Unexpected managed marker product ${String(d.product)}.`};if(d.role!==bf)return{ok:!1,reason:`Unexpected managed marker role ${String(d.role)}.`};if("p-dev"!==d.managedBy)return{ok:!1,reason:`Unexpected managedBy value ${String(d.managedBy)}.`};let e=bi(d,"repository","a valid repository slug");if(!e.ok)return{ok:!1,reason:e.reason};if(!e.value.includes("/"))return{ok:!1,reason:"Managed marker is missing a valid repository slug."};let f=bj(d,"markerVersion","markerVersion");if(!f.ok)return{ok:!1,reason:f.reason};if(1!==f.value&&2!==f.value&&3!==f.value)return{ok:!1,reason:`Unsupported managed marker version ${String(f.value)}.`};if(2===f.value||3===f.value){let a=bj(d,"repositoryId","repositoryId");if(!a.ok)return{ok:!1,reason:a.reason};if(!Number.isInteger(a.value)||a.value<=0)return{ok:!1,reason:"Managed marker repositoryId must be a positive integer."};c=a.value}else if(void 0!==d.repositoryId){let a=bj(d,"repositoryId","repositoryId");if(!a.ok)return{ok:!1,reason:a.reason};c=a.value}let g=d.createdFromPackageSnapshot;if(3===f.value){if(!g||"object"!=typeof g)return{ok:!1,reason:"Managed marker is missing createdFromPackageSnapshot metadata."};let a=bi(g,"packageName","packageName");if(!a.ok)return{ok:!1,reason:a.reason};if(a.value!==a3.Au)return{ok:!1,reason:`Unexpected package name ${a.value}.`};let b=bi(g,"packageVersion","packageVersion");if(!b.ok)return{ok:!1,reason:b.reason};let h=bi(g,"sourceRepository","sourceRepository");if(!h.ok)return{ok:!1,reason:h.reason};if(h.value!==bh.Ig)return{ok:!1,reason:`Unexpected source repository ${h.value}.`};let i=bi(g,"sourceCommit","sourceCommit");if(!i.ok)return{ok:!1,reason:i.reason};let j=bj(g,"manifestSchemaVersion","manifestSchemaVersion");if(!j.ok)return{ok:!1,reason:j.reason};if(j.value!==bh.Al)return{ok:!1,reason:`Unsupported manifest schema version ${String(j.value)}.`};let k=bi(g,"snapshotContentId","snapshotContentId");if(!k.ok)return{ok:!1,reason:k.reason};let l=bi(g,"snapshotSha256","snapshotSha256");if(!l.ok)return{ok:!1,reason:l.reason};let m=bi(g,"snapshotGitTreeSha1","snapshotGitTreeSha1");if(!m.ok)return{ok:!1,reason:m.reason};let n=bi(g,"snapshotCommitSha","snapshotCommitSha");if(!n.ok)return{ok:!1,reason:n.reason};let o=bj(g,"generationFormatVersion","generationFormatVersion");return o.ok?o.value!==bh.Q$?{ok:!1,reason:`Unsupported generation format version ${String(o.value)}.`}:{ok:!0,marker:{schemaVersion:1,product:bd,role:bf,managedBy:"p-dev",repository:e.value,repositoryId:c,markerVersion:f.value,operationId:"string"==typeof d.operationId?d.operationId:void 0,createdByGithubUserId:"number"==typeof d.createdByGithubUserId?d.createdByGithubUserId:void 0,createdByLogin:"string"==typeof d.createdByLogin?d.createdByLogin:void 0,pDevVersion:"string"==typeof d.pDevVersion?d.pDevVersion:void 0,createdFromPackageSnapshot:{packageName:a.value,packageVersion:b.value,sourceRepository:h.value,sourceCommit:i.value,manifestSchemaVersion:j.value,snapshotContentId:k.value,snapshotSha256:l.value,snapshotGitTreeSha1:m.value,snapshotCommitSha:n.value,generationFormatVersion:o.value}}}:{ok:!1,reason:o.reason}}let h=d.createdFromTemplate;if(!h||"object"!=typeof h)return{ok:!1,reason:"Managed marker is missing createdFromTemplate metadata."};let i=bi(h,"templateRepository","createdFromTemplate.templateRepository");if(!i.ok)return{ok:!1,reason:i.reason};if(i.value!==a8)return{ok:!1,reason:`Unexpected template repository ${i.value}.`};let j=bi(h,"defaultBranch","createdFromTemplate.defaultBranch");if(!j.ok)return{ok:!1,reason:j.reason};let k=bi(h,"templateIdentity","createdFromTemplate.templateIdentity");if(!k.ok)return{ok:!1,reason:k.reason};if(k.value!==bc)return{ok:!1,reason:`Unexpected template identity ${k.value}.`};let l=bj(h,"templateVersion","createdFromTemplate.templateVersion");if(!l.ok)return{ok:!1,reason:l.reason};if(1!==l.value)return{ok:!1,reason:`Unsupported template version ${String(l.value)}.`};let m=bj(h,"compatibilityVersion","createdFromTemplate.compatibilityVersion");if(!m.ok)return{ok:!1,reason:m.reason};if(1!==m.value)return{ok:!1,reason:`Incompatible managed marker compatibility version ${String(m.value)}.`};let n=bi(h,"templateContentId","createdFromTemplate.templateContentId");if(!n.ok)return{ok:!1,reason:n.reason};let o=bi(h,"sourceHeadSha","createdFromTemplate.sourceHeadSha");return o.ok?{ok:!0,marker:{schemaVersion:1,product:bd,role:bf,managedBy:"p-dev",repository:e.value,repositoryId:c,markerVersion:f.value,operationId:"string"==typeof d.operationId?d.operationId:void 0,createdByGithubUserId:"number"==typeof d.createdByGithubUserId?d.createdByGithubUserId:void 0,createdByLogin:"string"==typeof d.createdByLogin?d.createdByLogin:void 0,pDevVersion:"string"==typeof d.pDevVersion?d.pDevVersion:void 0,createdFromTemplate:{templateRepository:i.value,defaultBranch:j.value,templateIdentity:k.value,templateVersion:l.value,compatibilityVersion:m.value,templateContentId:n.value,sourceHeadSha:o.value}}}:{ok:!1,reason:o.reason}}function bl(a,b,c){if(a.markerVersion<2||void 0===a.repositoryId||!Number.isInteger(a.repositoryId)||a.repositoryId<=0)return{ok:!1,reason:"Managed marker is missing a stable repository ID. Use advanced recovery to reconnect this workspace."};if(c&&c.repositoryId!==a.repositoryId)return{ok:!1,reason:`Managed marker repository ID does not match GitHub metadata for ${b}.`};if(a.repository!==b){if(c&&a.repositoryId===c.repositoryId){let[c]=a.repository.split("/"),[d]=b.split("/");if(c&&d&&c===d)return{ok:!0,renamedFrom:a.repository}}return{ok:!1,reason:`Managed marker repository mismatch for ${b}.`}}return a.createdFromPackageSnapshot?{ok:!0}:a.createdFromTemplate?a.createdFromTemplate.templateRepository!==a8?{ok:!1,reason:`Managed marker template repository must be ${a8}.`}:a.createdFromTemplate.templateIdentity!==bc?{ok:!1,reason:`Unexpected managed marker template identity ${a.createdFromTemplate.templateIdentity}.`}:1!==a.createdFromTemplate.templateVersion?{ok:!1,reason:`Unsupported managed marker template version ${a.createdFromTemplate.templateVersion}.`}:1!==a.createdFromTemplate.compatibilityVersion?{ok:!1,reason:`Incompatible managed marker compatibility version ${a.createdFromTemplate.compatibilityVersion}.`}:{ok:!0}:{ok:!1,reason:"Managed marker is missing workspace provenance metadata."}}let bm=new Map;async function bn(a,b){let c,d=bm.get(a)??Promise.resolve(),e=new Promise(a=>{c=a}),f=d.then(()=>e);bm.set(a,f),await d;try{return await b()}finally{c(),bm.get(a)===f&&bm.delete(a)}}function bo(a){let b=(0,k.ym)(a);return aZ().join(b.harnessDir,"p-dev-harness-provisioning.pending.json")}async function bp(a){try{let b=await (0,f.readFile)(bo(a),"utf8"),c=JSON.parse(b);if("string"!=typeof c.operationId||"number"!=typeof c.authenticatedUserId||"string"!=typeof c.previewFingerprint||"string"!=typeof c.snapshotContentId)return null;return c}catch{return null}}async function bq(a,b){let c=bo(b);await (0,f.mkdir)(aZ().dirname(c),{recursive:!0});let d=`${c}.${process.pid}.${Date.now()}.tmp`;await (0,f.writeFile)(d,`${JSON.stringify(a,null,2)}
-`,"utf8"),await (0,f.rename)(d,c)}async function br(a){try{await (0,f.rm)(bo(a),{force:!0})}catch{}}function bs(a,b){return void 0!==b.operationId&&a.operationId!==b.operationId?{ok:!1,reason:"Pending provisioning operation ID does not match."}:a.authenticatedUserId!==b.authenticatedUserId?{ok:!1,reason:"Pending provisioning authenticated user ID does not match."}:a.authenticatedLogin!==b.authenticatedLogin?{ok:!1,reason:"Pending provisioning authenticated login does not match."}:a.packageName!==b.packageName?{ok:!1,reason:"Pending provisioning package name does not match."}:a.packageVersion!==b.packageVersion?{ok:!1,reason:"Pending provisioning package version does not match."}:a.sourceRepository!==b.sourceRepository?{ok:!1,reason:"Pending provisioning source repository does not match."}:a.sourceCommit!==b.sourceCommit?{ok:!1,reason:"Pending provisioning source commit does not match."}:a.manifestSchemaVersion!==b.manifestSchemaVersion?{ok:!1,reason:"Pending provisioning manifest schema version does not match."}:a.snapshotContentId!==b.snapshotContentId?{ok:!1,reason:"Pending provisioning snapshot content ID does not match."}:a.snapshotSha256!==b.snapshotSha256?{ok:!1,reason:"Pending provisioning snapshot digest does not match."}:a.snapshotGitTreeSha1!==b.snapshotGitTreeSha1?{ok:!1,reason:"Pending provisioning snapshot tree SHA does not match."}:a.targetOwner!==b.targetOwner?{ok:!1,reason:"Pending provisioning target owner does not match."}:a.targetRepo!==b.targetRepo?{ok:!1,reason:"Pending provisioning target repository does not match."}:void 0!==b.previewFingerprint&&a.previewFingerprint!==b.previewFingerprint?{ok:!1,reason:"Pending provisioning creation fingerprint does not match."}:void 0!==b.defaultBranch&&void 0!==a.defaultBranch&&a.defaultBranch!==b.defaultBranch?{ok:!1,reason:"Pending provisioning default branch does not match."}:void 0!==a.repositoryId&&void 0===a.defaultBranch&&void 0!==b.defaultBranch?{ok:!1,reason:"Pending provisioning state is missing default branch."}:{ok:!0}}function bt(a,b){return"string"==typeof a&&a.includes(`[p-dev-provision:${b}]`)}function bu(a){return{name:"p-dev-harness",email:"p-dev-harness@users.noreply.github.com",date:new Date(Date.UTC(2020,0,1,0,0,(0,d.createHash)("sha256").update(a.operationId).update("\0").update(a.sourceCommit).digest().readUInt32BE(0)%31536e4)).toISOString()}}class bv extends Error{constructor(a,b,c){super(b),this.code=a,this.recoverable=c}}var bw=c(45599),bx=c(87509);(0,c(57975).promisify)(aL.execFile);var by=c(88414),bz=c(45191);async function bA(a){let b=(0,bx.L3)(a.snapshotRoot,a.path),c=await (0,f.readFile)(b),d=(0,bz.bo)(c);if(d!==a.expectedSha256)throw Error(`Workspace snapshot file ${a.path} failed integrity check (expected ${a.expectedSha256}, got ${d}).`);return c}class bB{constructor(a={}){this.pauseUntilMs=0,this.secondaryStrikeCount=0,this.now=a.now??(()=>Date.now()),this.sleep=a.sleep??(a=>new Promise(b=>setTimeout(b,a)))}get pauseDeadlineMs(){return this.pauseUntilMs}async waitBeforeMutation(){let a=this.pauseUntilMs-this.now();a>0&&await this.sleep(a)}recordRateLimitFailure(a){(403===a.status||429===a.status)&&(!(void 0!==a.retryAfterSeconds&&a.retryAfterSeconds>0||0===a.rateLimitRemaining&&void 0!==a.rateLimitResetEpochSeconds)||(0,bw.pe)(a.message))&&(this.secondaryStrikeCount+=1);let b=(0,bw.J6)({error:a,secondaryStrikeCount:this.secondaryStrikeCount,nowMs:this.now()});return this.pauseUntilMs=Math.max(this.pauseUntilMs,this.now()+b),b}}let bC=function(a=process.env.HARNESS_SNAPSHOT_UPLOAD_CONCURRENCY){if(void 0===a||""===a.trim())return 2;let b=a.trim();if(!/^\d+$/.test(b))throw Error("Invalid HARNESS_SNAPSHOT_UPLOAD_CONCURRENCY: must be an integer between 1 and 4.");let c=Number(b);if(c<1||c>4)throw Error("Invalid HARNESS_SNAPSHOT_UPLOAD_CONCURRENCY: must be between 1 and 4.");return c}(),bD=Number(process.env.HARNESS_SNAPSHOT_UPLOAD_RETRIES??3);function bE(a){return new Promise(b=>setTimeout(b,a))}function bF(a){return a instanceof an.OS&&(!!(0,bw.df)(a)||408===a.status||a.status>=500)}async function bG(a,b,c){let d=0;for(;;){await b.gate.waitBeforeMutation();try{return await a()}catch(a){if(d+=1,!(a instanceof an.OS))throw a;if((0,bw.df)(a)){let e=b.gate.recordRateLimitFailure(a);if(b.onRateLimitPause?.(Math.ceil(e/1e3),c),d>bD)throw a;continue}if(bF(a)&&d<=bD){let a=Math.min(8e3,250*2**(d-1));await bE(a+Math.floor(100*Math.random()));continue}throw a}}}async function bH(a,b,c){let d=Array(a.length),e=0,f=Array.from({length:Math.max(1,b)},async()=>{for(;;){let b=e;if(e+=1,b>=a.length)return;d[b]=await c(a[b],b)}});return await Promise.all(f),d}async function bI(a){let b=new Map,c=a.manifest.files;a.onProgress?.({phase:"snapshot-objects-uploading",uploadedBlobs:0,totalBlobs:c.length});let d=0;return await bH(c,bC,async e=>{let f=await bA({snapshotRoot:a.snapshotRoot,path:e.path,expectedSha256:e.sha256}),g=await bG(()=>a.provider.createGitBlob({owner:a.owner,repo:a.repo,content:f}),a.retryContext,"snapshot-objects-uploading");if(g.sha!==e.gitBlobSha1)throw Error(`Uploaded blob SHA mismatch for ${e.path} (expected ${e.gitBlobSha1}, got ${g.sha}).`);b.set(e.path,g.sha),d+=1,a.onProgress?.({phase:"snapshot-objects-uploading",uploadedBlobs:d,totalBlobs:c.length})}),b}async function bJ(a){let b=bu({operationId:a.operationId,sourceCommit:a.manifest.sourceCommit}),c=await bG(()=>a.provider.createGitTree({owner:a.owner,repo:a.repo,tree:a.manifest.files.map(b=>({path:b.path,mode:b.mode,type:"blob",sha:a.blobShaByPath.get(b.path)??b.gitBlobSha1}))}),a.retryContext,"snapshot-commit-created");if(c.sha!==a.manifest.gitRootTreeSha1)throw new bv("snapshot-tree-mismatch",`Snapshot tree SHA mismatch (expected ${a.manifest.gitRootTreeSha1}, got ${c.sha}).`,!1);return(await bG(()=>a.provider.createGitCommit({owner:a.owner,repo:a.repo,message:`Initialize p-dev harness workspace snapshot (${a.manifest.packageVersion})`,tree:c.sha,parents:[a.parentCommitSha],author:b,committer:b}),a.retryContext,"snapshot-commit-created")).sha}async function bK(a){let b=bu({operationId:a.operationId,sourceCommit:a.sourceCommit}),c=await bG(()=>a.provider.createGitBlob({owner:a.owner,repo:a.repo,content:Buffer.from(a.markerContent,"utf8")}),a.retryContext,"marker-pending"),d=await bG(()=>a.provider.createGitTree({owner:a.owner,repo:a.repo,baseTree:a.snapshotTreeSha,tree:[{path:bb,mode:"100644",type:"blob",sha:c.sha}]}),a.retryContext,"marker-pending");if(d.sha===a.snapshotTreeSha)throw new bv("marker-commit-failed","Marker tree must overlay the snapshot tree rather than replace it.",!1);let e=await bG(()=>a.provider.createGitCommit({owner:a.owner,repo:a.repo,message:"Initialize p-dev managed harness workspace marker",tree:d.sha,parents:[a.parentCommitSha],author:b,committer:b}),a.retryContext,"marker-pending").catch(a=>{throw new bv("marker-commit-failed",a instanceof Error?a.message:"Marker commit creation failed.",!0)});return(await a.provider.getGitRef(a.owner,a.repo,a.defaultBranch)).object.sha===e.sha||await bG(()=>a.provider.updateGitRef({owner:a.owner,repo:a.repo,ref:a.defaultBranch,sha:e.sha,force:!1,expectedSha:a.parentCommitSha}),a.retryContext,"marker-pending"),e.sha}async function bL(a){let b=await a.provider.getRepositoryMetadata(a.owner,a.repoName);if(!b||!b.private||!b.permissions.admin||b.owner!==a.owner||b.repo!==a.repoName||!bt(b.description,a.operationId))return null;let c=await a.provider.getRepositoryDefaultBranchHead(a.owner,a.repoName,b.defaultBranch);return{repositoryId:b.repositoryId,defaultBranch:b.defaultBranch,initializedCommitSha:c}}async function bM(a){let{attempts:b,initialDelayMs:c}={attempts:Number(process.env.HARNESS_SNAPSHOT_RECONCILE_ATTEMPTS??5),initialDelayMs:Number(process.env.HARNESS_SNAPSHOT_RECONCILE_DELAY_MS??500)};for(let d=0;d<b;d+=1){let e=await bL(a);if(e)return e;if(d<b-1){let a=c*2**d+Math.floor(100*Math.random());await bE(a)}}return null}async function bN(a){let b=await a.provider.getRepositoryMetadata(a.owner,a.repo);if(!b)throw new bv("description-finalization-failed","Destination repository is not accessible for description finalization.",!0);if(await a.provider.getRepositoryDefaultBranchHead(a.owner,a.repo,a.defaultBranch)!==a.markerCommitSha)throw new bv("description-finalization-failed","Marker commit is not at branch HEAD; refusing to finalize repository description.",!0);let c=b.description??"";if(c!==a.normalDescription){if(!bt(c,a.operationId))throw new bv("description-finalization-failed","Repository description does not match the expected operation ownership marker.",!1);try{await a.provider.updateUserRepositoryDescription({owner:a.owner,repo:a.repo,description:a.normalDescription})}catch(a){throw new bv("description-finalization-failed",a instanceof Error?a.message:"Description finalization failed.",!0)}}}async function bO(a){if(!a.pending.repositoryId)return{ok:!1,message:"Pending state is missing repository ID."};let b=await a.provider.getRepositoryMetadata(a.pending.targetOwner,a.pending.targetRepo);if(!b)return{ok:!1,message:"Pending destination repository no longer exists."};if(b.repositoryId!==a.pending.repositoryId)return{ok:!1,message:"Pending destination repository ID does not match remote repository."};if(b.owner!==a.pending.targetOwner||b.repo!==a.pending.targetRepo)return{ok:!1,message:"Pending destination repository slug does not match remote repository."};if(!b.private||!b.permissions.admin)return{ok:!1,message:"Pending destination repository is not private/admin-accessible."};if(a.pending.defaultBranch&&b.defaultBranch!==a.pending.defaultBranch)return{ok:!1,message:"Pending destination repository default branch does not match remote repository."};let c=a.pending.defaultBranch??b.defaultBranch,d=await a.provider.getRepositoryDefaultBranchHead(b.owner,b.repo,c);if(a.pending.markerCommitSha&&d!==a.pending.markerCommitSha&&a.pending.snapshotCommitSha&&d!==a.pending.snapshotCommitSha&&a.pending.initializedCommitSha&&d!==a.pending.initializedCommitSha)return{ok:!1,message:"Pending destination repository HEAD does not match recorded phase."};if(a.pending.snapshotCommitSha){let c=await a.provider.getGitCommit(b.owner,b.repo,a.pending.snapshotCommitSha);if(c.tree.sha!==a.manifest.gitRootTreeSha1)return{ok:!1,message:"Recorded snapshot commit tree does not match embedded manifest."};if(a.pending.initializedCommitSha&&c.parents[0]?.sha!==a.pending.initializedCommitSha)return{ok:!1,message:"Recorded snapshot commit parent does not match initialized commit."}}if(a.pending.markerCommitSha&&a.pending.snapshotCommitSha){let c=await a.provider.getGitCommit(b.owner,b.repo,a.pending.markerCommitSha);if(c.parents[0]?.sha!==a.pending.snapshotCommitSha)return{ok:!1,message:"Recorded marker commit parent does not match snapshot commit."}}return{ok:!0}}async function bP(a){var b,c,d;let e=a.user.login,{repo:f}=aQ(`${e}/${a.repoName}`),g=(b={onRateLimitPause:(b,c)=>{a.onProgress?.({phase:c,uploadedBlobs:a.pending?.snapshotCommitSha?a.manifest.fileCount:0,totalBlobs:a.manifest.fileCount,rateLimitPauseSeconds:b})}},{gate:new bB,onRateLimitPause:b?.onRateLimitPause});if(a.pending?.repositoryId){let b=await bO({provider:a.provider,pending:a.pending,manifest:a.manifest});if(!b.ok)return{ok:!1,message:b.message,recoverable:!1,code:"repository-identity-mismatch"}}let h=a.pending?.repositoryId,i=a.pending?.defaultBranch,j=a.pending?.initializedCommitSha;if(h&&j&&!i){let b=await a.provider.getRepositoryMetadata(e,f);b&&(i=b.defaultBranch)}if(!h||!j){let b,g=(c=a.description,d=a.operationId,`${c} [p-dev-provision:${d}]`);try{let c=await a.provider.createUserRepository({name:a.repoName,description:g,private:!0,autoInit:!0}),d=await a.provider.getGitRef(e,f,c.defaultBranch);b={repositoryId:c.repositoryId,defaultBranch:c.defaultBranch,initializedCommitSha:d.object.sha}}catch(c){if(bF(c)){let d=await bM({provider:a.provider,owner:e,repoName:a.repoName,operationId:a.operationId});if(d)b=d;else throw c}else if(c instanceof an.OS&&422===c.status){let c=await bM({provider:a.provider,owner:e,repoName:a.repoName,operationId:a.operationId});if(!c)return{ok:!1,message:"Repository creation returned an ambiguous result and no matching operation-owned repository was found.",recoverable:!0,code:"repository-create-ambiguous"};b=c}else throw c}h=b.repositoryId,i=b.defaultBranch,j=b.initializedCommitSha,await a.onCheckpoint?.({phase:"repository-created",repositoryId:h,defaultBranch:i,initializedCommitSha:j}),a.onProgress?.({phase:"repository-created",uploadedBlobs:0,totalBlobs:a.manifest.fileCount})}if(!i)return{ok:!1,message:"Provisioning state is missing the repository default branch.",recoverable:!1,code:"repository-identity-mismatch"};let k=i,l=a.pending?.snapshotCommitSha;if(!l){let b=await bI({provider:a.provider,owner:e,repo:f,snapshotRoot:a.snapshotRoot,manifest:a.manifest,retryContext:g,onProgress:a.onProgress});l=await bJ({provider:a.provider,owner:e,repo:f,manifest:a.manifest,parentCommitSha:j,operationId:a.operationId,blobShaByPath:b,retryContext:g}),(await a.provider.getGitRef(e,f,k)).object.sha!==l&&await bG(()=>a.provider.updateGitRef({owner:e,repo:f,ref:k,sha:l,force:!1,expectedSha:j}),g,"snapshot-commit-created"),await a.onCheckpoint?.({phase:"snapshot-commit-created",repositoryId:h,defaultBranch:k,initializedCommitSha:j,snapshotCommitSha:l,snapshotGitTreeSha1:a.manifest.gitRootTreeSha1}),a.onProgress?.({phase:"snapshot-commit-created",uploadedBlobs:a.manifest.fileCount,totalBlobs:a.manifest.fileCount})}let m=a.pending?.markerCommitSha;if(!m){let b=function(a){if(!Number.isInteger(a.repositoryId)||a.repositoryId<=0)throw Error("Managed marker requires a positive integer repositoryId.");return{schemaVersion:1,product:bd,role:bf,managedBy:"p-dev",repository:a.repository,repositoryId:a.repositoryId,markerVersion:3,operationId:a.operationId,createdByGithubUserId:a.createdByGithubUserId,createdByLogin:a.createdByLogin,pDevVersion:a.pDevVersion,createdFromPackageSnapshot:{packageName:a.manifest.packageName,packageVersion:a.manifest.packageVersion,sourceRepository:a.manifest.sourceRepository,sourceCommit:a.manifest.sourceCommit,manifestSchemaVersion:a.manifest.schemaVersion,snapshotContentId:a.manifest.snapshotContentId,snapshotSha256:a.manifest.snapshotSha256,snapshotGitTreeSha1:a.manifest.gitRootTreeSha1,snapshotCommitSha:a.snapshotCommitSha,generationFormatVersion:a.manifest.generation.version,defaultBranch:a.defaultBranch}}}({repository:`${e}/${a.repoName}`,repositoryId:h,manifest:a.manifest,snapshotCommitSha:l,operationId:a.operationId,createdByGithubUserId:a.user.id,createdByLogin:a.user.login,pDevVersion:a.packageVersion,defaultBranch:k});try{m=await bK({provider:a.provider,owner:e,repo:f,defaultBranch:k,parentCommitSha:l,snapshotTreeSha:a.manifest.gitRootTreeSha1,markerContent:`${JSON.stringify(b,null,2)}
-`,operationId:a.operationId,sourceCommit:a.manifest.sourceCommit,retryContext:g})}catch(a){if(a instanceof bv&&"marker-commit-failed"===a.code)return{ok:!1,message:a.message,recoverable:!0,code:a.code};throw a}await a.onCheckpoint?.({phase:"marker-pending",repositoryId:h,defaultBranch:k,initializedCommitSha:j,snapshotCommitSha:l,markerCommitSha:m,snapshotGitTreeSha1:a.manifest.gitRootTreeSha1}),a.onProgress?.({phase:"marker-pending",uploadedBlobs:a.manifest.fileCount,totalBlobs:a.manifest.fileCount})}try{await bN({provider:a.provider,owner:e,repo:f,operationId:a.operationId,normalDescription:a.description,markerCommitSha:m,defaultBranch:k})}catch(b){if(b instanceof bv&&"description-finalization-failed"===b.code)return await a.onCheckpoint?.({phase:"description-pending",repositoryId:h,defaultBranch:k,initializedCommitSha:j,snapshotCommitSha:l,markerCommitSha:m,snapshotGitTreeSha1:a.manifest.gitRootTreeSha1}),{ok:!1,message:b.message,recoverable:b.recoverable,code:b.code};throw b}return{ok:!0,fullName:`${e}/${a.repoName}`,repositoryId:h,defaultBranch:k,initializedCommitSha:j,snapshotCommitSha:l,markerCommitSha:m}}async function bQ(a){let{owner:b,repo:c}=aQ(a.repoSlug),d=await a.provider.getRepositoryMetadata(b,c);if(!d)return{ok:!1,message:`Harness workspace ${a.repoSlug} is not accessible.`};if(d.repositoryId!==a.repositoryId)return{ok:!1,message:`Harness workspace repository ID mismatch for ${a.repoSlug}.`};if(!d.private||!d.permissions.admin)return{ok:!1,message:`Harness workspace ${a.repoSlug} must be private and admin-accessible.`};let e=await a.provider.getRepositoryDefaultBranchHead(b,c,d.defaultBranch),f=await a.provider.readRepositoryFileContent(b,c,bb,e);if(!f)return{ok:!1,message:"Provisioned workspace is missing the managed marker at HEAD."};let g=bk(f);if(!g.ok)return{ok:!1,message:g.reason};if(!g.marker.createdFromPackageSnapshot)return{ok:!1,message:"Provisioned workspace marker is not snapshot-backed."};let h=g.marker.createdFromPackageSnapshot;if(h.snapshotContentId!==a.manifest.snapshotContentId||h.snapshotSha256!==a.manifest.snapshotSha256||h.snapshotGitTreeSha1!==a.manifest.gitRootTreeSha1||h.sourceCommit!==a.manifest.sourceCommit)return{ok:!1,message:"Provisioned workspace marker provenance does not match embedded manifest."};let i=await a.provider.getGitCommit(b,c,e),j=i.parents[0]?.sha;return j?(await a.provider.getGitCommit(b,c,j)).tree.sha!==a.manifest.gitRootTreeSha1?{ok:!1,message:"Snapshot commit tree does not match embedded manifest."}:await a.provider.readRepositoryFileContent(b,c,"README.md",e)?{ok:!0}:{ok:!1,message:"Provisioned workspace HEAD is missing README.md from the packaged snapshot."}:{ok:!1,message:"Marker commit is missing a parent snapshot commit."}}let bR=new Set(["100644","100755","120000"]);async function bS(a){let b=new Set;for(let c of a.manifest.files){let d,e=function(a){let b;try{b=(0,bx.b6)(a.path)}catch{return{ok:!1,reason:`Snapshot file path is not canonical: ${a.path}`}}return b!==a.path?{ok:!1,reason:`Snapshot file path is not canonical: ${a.path}`}:(0,bx.lw)(a.path)?{ok:!1,reason:`Forbidden snapshot path: ${a.path}`}:bR.has(a.mode)?"file"===a.type&&"100644"!==a.mode&&"100755"!==a.mode?{ok:!1,reason:`Snapshot file ${a.path} has invalid file mode ${a.mode}.`}:"symlink"===a.type&&"120000"!==a.mode?{ok:!1,reason:`Snapshot symlink ${a.path} must use mode 120000.`}:{ok:!0}:{ok:!1,reason:`Unsupported snapshot mode ${a.mode} for ${a.path}.`}}(c);if(!e.ok)return e;if(b.has(c.path))return{ok:!1,reason:`Duplicate snapshot path: ${c.path}`};b.add(c.path);try{d=await bA({snapshotRoot:a.snapshotRoot,path:c.path,expectedSha256:c.sha256})}catch(a){return{ok:!1,reason:a instanceof Error?a.message:`Snapshot file ${c.path} failed integrity validation.`}}if(d.byteLength!==c.size)return{ok:!1,reason:`Snapshot file ${c.path} size mismatch (expected ${c.size}, got ${d.byteLength}).`};if((0,bz.bo)(d)!==c.sha256)return{ok:!1,reason:`Snapshot file ${c.path} SHA-256 mismatch.`};if((0,aM.us)(d)!==c.gitBlobSha1)return{ok:!1,reason:`Snapshot file ${c.path} git blob SHA mismatch.`}}return(0,aM.dV)(a.manifest.files)!==a.manifest.gitRootTreeSha1?{ok:!1,reason:"Embedded snapshot root tree SHA does not match manifest files."}:(0,bz.dq)(a.manifest.files)!==a.manifest.snapshotSha256?{ok:!1,reason:"Embedded snapshot digest does not match manifest files."}:(0,bz.Aw)({packageVersion:a.manifest.packageVersion,sourceCommit:a.manifest.sourceCommit,snapshotSha256:a.manifest.snapshotSha256})!==a.manifest.snapshotContentId?{ok:!1,reason:"Embedded snapshot content ID does not match manifest inputs."}:{ok:!0}}async function bT(a="file:///Users/weston/Code/agentic-product-development-harness/src/setup/harness-workspace-snapshot-loader.ts"){let b,c,d;try{b=(0,a3.HF)(a)}catch(a){return{ok:!1,state:"snapshot-unavailable",message:a instanceof Error?a.message:"Could not resolve packaged workspace snapshot root."}}let e=(0,a3.ro)(b),g=aZ().join(e,"manifest.json");try{c=await (0,f.readFile)(g,"utf8")}catch{return{ok:!1,state:"snapshot-manifest-missing",message:"Embedded workspace snapshot manifest is missing from the package."}}let h=(0,by.parseWorkspaceSnapshotManifestJson)(c);if(!h.ok)return{ok:!1,state:"snapshot-manifest-invalid",message:h.reason};try{d=function(a){let b=aZ().join(a,"package.json"),c=JSON.parse((0,aX.readFileSync)(b,"utf8")),d=c.version?.trim();if(!d||!a1.test(d))throw Error(`Installed p-dev package is missing a valid version in ${b}.`);return d}(b)}catch(a){return{ok:!1,state:"snapshot-incompatible",message:a instanceof Error?a.message:"Packaged version metadata is invalid."}}if(h.manifest.packageVersion!==d)return{ok:!1,state:"snapshot-incompatible",message:`Embedded snapshot package version ${h.manifest.packageVersion} does not match installed package ${d}.`};let i=await bS({snapshotRoot:e,manifest:h.manifest});return i.ok?{ok:!0,packageRoot:b,snapshotRoot:e,packageVersion:d,manifest:h.manifest,fingerprint:(0,by.Nk)(h.manifest)}:{ok:!1,state:"snapshot-tampered",message:i.reason}}function bU(a){return JSON.stringify(a)}function bV(a){return`${a}/${a9}`}function bW(){return{packageName:"p-dev-harness",packageVersion:"",sourceRepository:"",sourceCommit:"",snapshotContentId:null,snapshotFingerprint:null,templateContentId:null}}function bX(a,b){if(!a)return bW();let c=a.manifest.snapshotContentId;return{packageName:a.manifest.packageName,packageVersion:a.manifest.packageVersion,sourceRepository:a.manifest.sourceRepository,sourceCommit:a.manifest.sourceCommit,snapshotContentId:c,snapshotFingerprint:a.fingerprint,templateContentId:b??c}}function bY(a){let b=a?.values.GITHUB_DISPATCH_REPOSITORY_ID?.trim();if(!b)return null;let c=Number(b);return!Number.isInteger(c)||c<=0?null:c}function bZ(a,b){var c;return{operationId:(c={operationId:b.operationId,authenticatedUserId:b.authenticatedUserId,authenticatedLogin:b.authenticatedLogin,targetOwner:b.targetOwner,targetRepo:b.targetRepo,packageName:a.manifest.packageName,packageVersion:a.manifest.packageVersion,sourceRepository:a.manifest.sourceRepository,sourceCommit:a.manifest.sourceCommit,manifestSchemaVersion:a.manifest.schemaVersion,snapshotContentId:a.manifest.snapshotContentId,snapshotSha256:a.manifest.snapshotSha256,snapshotGitTreeSha1:a.manifest.gitRootTreeSha1,previewFingerprint:b.previewFingerprint}).operationId,authenticatedUserId:c.authenticatedUserId,authenticatedLogin:c.authenticatedLogin,targetOwner:c.targetOwner,targetRepo:c.targetRepo,packageName:c.packageName??a3.Au,packageVersion:c.packageVersion,sourceRepository:c.sourceRepository??bh.Ig,sourceCommit:c.sourceCommit,manifestSchemaVersion:c.manifestSchemaVersion,snapshotContentId:c.snapshotContentId,snapshotSha256:c.snapshotSha256,snapshotGitTreeSha1:c.snapshotGitTreeSha1,previewFingerprint:c.previewFingerprint,defaultBranch:c.defaultBranch}}async function b$(a){let b=bZ(a.snapshotPreview,{authenticatedUserId:a.user.id,authenticatedLogin:a.user.login,targetOwner:a.user.login,targetRepo:a9});if(a.requestedOperationId){let b=await bp(a.cwd);return b&&b.operationId!==a.requestedOperationId?{ok:!1,state:"concurrent-request-recovered",message:"Another provisioning operation is already in progress for this workspace."}:{ok:!0,operationId:a.requestedOperationId,resumedFromPending:!!b,creationPreviewFingerprint:b?.previewFingerprint??null,pending:b}}let c=await bp(a.cwd);if(!c)return{ok:!0,operationId:(0,d.randomUUID)(),resumedFromPending:!1,creationPreviewFingerprint:null,pending:null};let e=bs(c,b);return e.ok?{ok:!0,operationId:c.operationId,resumedFromPending:!0,creationPreviewFingerprint:c.previewFingerprint,pending:c}:{ok:!1,state:"same-name-unmanaged-collision",message:e.reason}}async function b_(a,b,c){if("weston-uribe/agentic-product-development-harness"===b)return{ok:!1,state:"explicit-packaged-repo-legacy-source",message:"Saved harness repo points at the public source repo. Use advanced recovery to adopt a private managed workspace."};let d=a6(b),e=null;if(c){if(!(e=await a.getRepositoryMetadataById(c)))return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repository ID ${c} is missing or inaccessible.`};if(d=a6(`${e.owner}/${e.repo}`),a6(b)!==d&&c!==e.repositoryId)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${b} does not match repository ID ${c}.`}}else{let{owner:b,repo:c}=aQ(d);e=await a.getRepositoryMetadata(b,c)}if(!e)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${b} is missing or inaccessible.`};if(c&&e.repositoryId!==c)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repository ID does not match GitHub metadata for ${d}.`};if(!e.private||"private"!==e.visibility)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${d} must be private in packaged mode.`};if(!e.permissions.admin)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${d} requires admin access.`};let f=await a.readRepositoryFileContent(e.owner,e.repo,bb,e.defaultBranch);if(!f)return{ok:!1,state:"explicit-packaged-repo-invalid",message:`Saved harness repo ${d} is missing a compatible managed marker.`};let g=bk(f);if(!g.ok)return{ok:!1,state:"explicit-packaged-repo-invalid",message:g.reason};let h=bl(g.marker,d,{repositoryId:e.repositoryId});return h.ok?{ok:!0,repoSlug:d,repositoryId:e.repositoryId,marker:g}:{ok:!1,state:"explicit-packaged-repo-invalid",message:h.reason}}async function b0(a,b,c,d){let e=bV(b.login),{owner:f,repo:g}=aQ(e),h=await a.getRepositoryMetadata(f,g);if(!h)return{kind:"absent"};if(!h.private||"private"!==h.visibility)return{kind:"public-collision"};if(!h.permissions.admin)return{kind:"unmanaged-collision"};let i=await a.readRepositoryFileContent(f,g,bb,h.defaultBranch);if(i){let a=bk(i);if(!a.ok)return{kind:"malformed-marker",reason:a.reason};let b=bl(a.marker,e,{repositoryId:h.repositoryId});return b.ok?{kind:"valid-managed",repoSlug:e,repositoryId:h.repositoryId}:{kind:"malformed-marker",reason:b.reason}}let j=await bp(c);if(j&&d){let a=bs(j,bZ(d,{authenticatedUserId:b.id,authenticatedLogin:b.login,targetOwner:b.login,targetRepo:a9}));if(a.ok)return{kind:"snapshot-only-with-pending"};if(!a.ok)return{kind:"unmanaged-collision"}}let k=await a.readRepositoryFileContent(f,g,ba,h.defaultBranch);if(k){let a=bg(k);return a.ok?{kind:"snapshot-only-without-pending"}:{kind:"malformed-marker",reason:`Generated repository template identity is invalid: ${a.reason}`}}return{kind:"unmanaged-collision"}}function b1(a){let b=a.snapshotPreview.manifest;return{operationId:a.operationId,authenticatedUserId:a.user.id,authenticatedLogin:a.user.login,packageName:b.packageName,packageVersion:b.packageVersion,sourceRepository:b.sourceRepository,sourceCommit:b.sourceCommit,manifestSchemaVersion:b.schemaVersion,snapshotContentId:b.snapshotContentId,snapshotSha256:b.snapshotSha256,snapshotGitTreeSha1:b.gitRootTreeSha1,targetOwner:a.user.login,targetRepo:a9,previewFingerprint:a.previewFingerprint,startedAt:a.pending?.startedAt??new Date().toISOString(),phase:a.phase??a.pending?.phase,repositoryId:a.repositoryId??a.pending?.repositoryId,defaultBranch:a.defaultBranch??a.pending?.defaultBranch,initializedCommitSha:a.initializedCommitSha??a.pending?.initializedCommitSha,snapshotCommitSha:a.snapshotCommitSha??a.pending?.snapshotCommitSha,markerCommitSha:a.markerCommitSha??a.pending?.markerCommitSha}}async function b2(a,b){let{owner:c,repo:d}=aQ(b.repoSlug),e=await a.getRepositoryMetadata(c,d);if(!e)return{ok:!1,message:`Generated harness workspace ${b.repoSlug} is not accessible for marker finalization.`};if(e.repositoryId!==b.repositoryId)return{ok:!1,message:`Generated harness workspace repository ID mismatch for ${b.repoSlug}.`};let f=function(a){if(!Number.isInteger(a.repositoryId)||a.repositoryId<=0)throw Error("Managed marker requires a positive integer repositoryId.");return{schemaVersion:1,product:bd,role:bf,managedBy:"p-dev",repository:a.repository,repositoryId:a.repositoryId,markerVersion:2,operationId:a.operationId,createdByGithubUserId:a.createdByGithubUserId,createdByLogin:a.createdByLogin,pDevVersion:a.pDevVersion,createdFromTemplate:{templateRepository:a8,defaultBranch:a.defaultBranch,templateIdentity:a.templateIdentity.templateIdentity,templateVersion:a.templateIdentity.templateVersion,compatibilityVersion:a.templateIdentity.compatibilityVersion,templateContentId:a.templateIdentity.templateContentId,sourceHeadSha:a.sourceHeadSha}}}({repository:b.repoSlug,repositoryId:b.repositoryId,templateIdentity:b.templateIdentity.identity,defaultBranch:b.defaultBranch,sourceHeadSha:b.templateHeadSha,operationId:b.operationId,createdByGithubUserId:b.user.id,createdByLogin:b.user.login,pDevVersion:b.pDevVersion}),g=await a.readRepositoryFileContent(c,d,bb,b.defaultBranch);if(g){var h,i;let a=bk(g);return a.ok?(h=a.marker,(h.createdFromPackageSnapshot&&f.createdFromPackageSnapshot?h.repository===f.repository&&h.repositoryId===f.repositoryId&&h.operationId===f.operationId&&h.createdFromPackageSnapshot.snapshotContentId===f.createdFromPackageSnapshot.snapshotContentId&&h.createdFromPackageSnapshot.snapshotSha256===f.createdFromPackageSnapshot.snapshotSha256&&h.createdFromPackageSnapshot.snapshotCommitSha===f.createdFromPackageSnapshot.snapshotCommitSha:h.createdFromTemplate&&f.createdFromTemplate&&h.repository===f.repository&&h.repositoryId===f.repositoryId&&h.operationId===f.operationId&&h.createdFromTemplate.templateIdentity===f.createdFromTemplate.templateIdentity&&h.createdFromTemplate.compatibilityVersion===f.createdFromTemplate.compatibilityVersion&&h.createdFromTemplate.templateContentId===f.createdFromTemplate.templateContentId&&h.createdFromTemplate.sourceHeadSha===f.createdFromTemplate.sourceHeadSha)||(i=a.marker,bl(i,b.repoSlug,{repositoryId:b.repositoryId}).ok))?{ok:!0}:{ok:!1,message:"Existing managed marker belongs to a different operation or repository."}:{ok:!1,message:a.reason}}try{await a.writeRepositoryFile({owner:c,repo:d,path:bb,branch:b.defaultBranch,message:"Initialize p-dev managed harness workspace marker",content:`${JSON.stringify(f,null,2)}
-`})}catch(a){return{ok:!1,message:a instanceof Error?a.message:"Failed to write managed harness workspace marker."}}return{ok:!0}}async function b3(a,b){let{owner:c,repo:d}=aQ(b),e=await a.getRepositoryMetadata(c,d);if(!e)return{ok:!1,message:`Harness workspace ${b} is not accessible.`};let f=await a.readRepositoryFileContent(c,d,ba,e.defaultBranch);if(!f)return{ok:!1,message:"Legacy generated repository template identity is missing."};let g=bg(f);return g.ok?{ok:!0,defaultBranch:e.defaultBranch,repositoryId:e.repositoryId,identity:g}:{ok:!1,message:g.reason}}async function b4(a){let b=a_()?"packaged":process.env.P_DEV_RUNTIME_MODE?.trim()?"source":"unknown",c=(0,k.ym)(a.cwd),d=await (0,h.Hn)(c),e=d?.values.GITHUB_DISPATCH_REPOSITORY?.trim(),f=await bp(a.cwd),g={runtimeMode:b,harnessDispatchRepo:e??null,authenticatedLogin:null,verifiedSavedRepo:!1,connectedAutomatically:!1};if(!a_())return{...g,eligible:!1,state:"source"===b?"skipped-source-mode":"skipped-not-packaged",message:"source"===b?"Source mode does not auto-provision a harness workspace.":"Packaged runtime mode is not active.",recoverable:!1};if(f)return{...g,eligible:!0,state:"repo-created-pending-verification",message:"Harness workspace provisioning is incomplete. Retry Step 1 Continue to resume.",recoverable:!0};if(!e)return{...g,eligible:!0,state:"repo-absent",message:"Packaged workspace provisioning has not completed yet.",recoverable:!0};if(!a.provider)return{...g,eligible:!0,state:"explicit-repo-present",message:`Saved harness workspace ${e} requires server validation.`,recoverable:!0};let i=await a.provider.inspectTokenCapabilities(),j=await b_(a.provider,e,bY(d));if(!j.ok)return{...g,eligible:!0,state:j.state,authenticatedLogin:i.login,message:j.message,recoverable:!0};let l=e===bV(i.login)||e===bV(j.marker.marker.createdByLogin??"");return{...g,eligible:!0,state:"verified-and-persisted",harnessDispatchRepo:e,authenticatedLogin:i.login,message:`Connected to validated harness workspace ${e}.`,recoverable:!1,verifiedSavedRepo:!0,connectedAutomatically:l&&!!j.marker.marker.operationId}}async function b5(a){var b,c;let e={creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:null,authenticatedLogin:null,recoverable:!1,willCreateRepository:!1,tokenCapabilities:{tokenType:"unknown",hasRepoScope:!1,hasWorkflowScope:!1,scopeAmbiguous:!0}};if(!a_())return{state:"skipped-not-packaged",fingerprint:bU({action:"preview",skipped:!0}),operationId:a.operationId??(0,d.randomUUID)(),message:"Packaged runtime mode is not active.",...e,...bW()};let f=(0,k.ym)(a.cwd),g=await (0,h.Hn)(f),i=g?.values.GITHUB_DISPATCH_REPOSITORY?.trim(),j=a2(),l=await a.provider.inspectTokenCapabilities(),m={login:l.login,tokenType:l.tokenType,oauthScopes:[],hasRepoScope:l.hasRepoScope,hasWorkflowScope:l.hasWorkflowScope},n=(0,aP.Z6)({...m,oauthScopes:l.scopeAmbiguous||"classic"!==l.tokenType?[]:[...l.hasRepoScope?["repo"]:[],...l.hasWorkflowScope?["workflow"]:[]]});if(l.scopeAmbiguous){let b=a.operationId??(0,d.randomUUID)();return{state:"token-scope-ambiguous",fingerprint:bU({action:"preview",operationId:b}),operationId:b,message:n.ok?"Token scope metadata is ambiguous.":n.message,...e,recoverable:!0,harnessDispatchRepo:i??null,authenticatedLogin:l.login,...bW(),tokenCapabilities:{tokenType:l.tokenType,hasRepoScope:l.hasRepoScope,hasWorkflowScope:l.hasWorkflowScope,scopeAmbiguous:l.scopeAmbiguous}}}if(!n.ok){let b="fine-grained"===l.tokenType?"token-unsupported":"unknown"===l.tokenType?"token-scope-ambiguous":"token-insufficient",c=a.operationId??(0,d.randomUUID)();return{state:b,fingerprint:bU({action:"preview",operationId:c}),operationId:c,message:n.message,...e,recoverable:!0,harnessDispatchRepo:i??null,authenticatedLogin:l.login,...bW(),tokenCapabilities:{tokenType:l.tokenType,hasRepoScope:l.hasRepoScope,hasWorkflowScope:l.hasWorkflowScope,scopeAmbiguous:l.scopeAmbiguous}}}let o=await a.provider.resolveAuthenticatedUser();if(i){let b=a.operationId??(0,d.randomUUID)(),c=await b_(a.provider,i,bY(g)),f=bU({action:"preview",operationId:b,authenticatedLogin:o.login,explicitRepo:i,pDevVersion:j});if(!c.ok)return{state:c.state,fingerprint:f,operationId:b,message:c.message,...e,recoverable:!0,harnessDispatchRepo:i,authenticatedLogin:o.login,...bW(),tokenCapabilities:{tokenType:l.tokenType,hasRepoScope:l.hasRepoScope,hasWorkflowScope:l.hasWorkflowScope,scopeAmbiguous:l.scopeAmbiguous}};let h=c.marker.marker.createdFromTemplate?.templateContentId??null;return{state:"explicit-repo-present",fingerprint:f,operationId:b,message:`Reconnecting to saved harness workspace ${i}.`,...e,harnessDispatchRepo:i,authenticatedLogin:o.login,...bX(null,h),tokenCapabilities:{tokenType:l.tokenType,hasRepoScope:l.hasRepoScope,hasWorkflowScope:l.hasWorkflowScope,scopeAmbiguous:l.scopeAmbiguous}}}let p=await bT(a.moduleUrl??"file:///Users/weston/Code/agentic-product-development-harness/src/setup/harness-repo-provisioning.ts");if(!p.ok){let b=a.operationId??(0,d.randomUUID)();return{state:p.state,fingerprint:bU({action:"preview",operationId:b}),operationId:b,message:p.message,...e,authenticatedLogin:o.login,...bW(),tokenCapabilities:{tokenType:l.tokenType,hasRepoScope:l.hasRepoScope,hasWorkflowScope:l.hasWorkflowScope,scopeAmbiguous:l.scopeAmbiguous}}}let q=await b$({cwd:a.cwd,requestedOperationId:a.operationId,user:o,snapshotPreview:p});if(!q.ok)return{state:q.state,fingerprint:bU({action:"preview",conflict:q.message}),operationId:a.operationId??(0,d.randomUUID)(),message:q.message,...e,recoverable:!0,authenticatedLogin:o.login,...bX(p),tokenCapabilities:{tokenType:l.tokenType,hasRepoScope:l.hasRepoScope,hasWorkflowScope:l.hasWorkflowScope,scopeAmbiguous:l.scopeAmbiguous}};let{operationId:r,resumedFromPending:s,creationPreviewFingerprint:t}=q,u=bV(o.login),v=await b0(a.provider,o,a.cwd,p),w="snapshot-preview-ready",x=`p-dev will create or reconnect ${u} as your private harness workspace.`,y=!1;switch(v.kind){case"absent":w="repo-absent",y=!0,x=`p-dev will create private harness workspace ${u} from the packaged workspace snapshot.`;break;case"valid-managed":w="valid-existing-managed-repo",x=`Reconnecting to existing managed harness workspace ${u}.`;break;case"public-collision":w="same-name-public-collision",x=`${u} exists but is not private. p-dev will not change it automatically.`;break;case"unmanaged-collision":w="same-name-unmanaged-collision",x=`${u} exists without a compatible managed marker.`;break;case"malformed-marker":w="same-name-malformed-marker",x=v.reason;break;case"snapshot-only-without-pending":w="same-name-snapshot-only-without-pending",x=`${u} looks like an unmanaged generated repo.`;break;case"snapshot-only-with-pending":w="same-name-snapshot-only-with-pending",x=`Resuming snapshot provisioning for ${u}.`}let z=(b={operationId:r,user:o,destination:u,snapshotPreview:p,classification:v.kind,envBaseline:g?.values.GITHUB_DISPATCH_REPOSITORY??"",pDevVersion:j,resumedFromPending:s,creationPreviewFingerprint:t},JSON.stringify({action:a4,operationId:(c=a7({operationId:b.operationId,user:b.user,destination:b.destination,manifest:b.snapshotPreview.manifest,snapshotFingerprint:b.snapshotPreview.fingerprint,classification:b.classification,envBaseline:b.envBaseline,pDevVersion:b.pDevVersion,resumedFromPending:b.resumedFromPending,creationPreviewFingerprint:b.creationPreviewFingerprint})).operationId,authenticatedUserId:c.authenticatedUserId,authenticatedLogin:c.authenticatedLogin,destination:c.destination,packageName:c.packageName,packageVersion:c.packageVersion,sourceRepository:c.sourceRepository,sourceCommit:c.sourceCommit,manifestSchemaVersion:c.manifestSchemaVersion,snapshotFingerprint:c.snapshotFingerprint,snapshotContentId:c.snapshotContentId,snapshotSha256:c.snapshotSha256,snapshotGitTreeSha1:c.snapshotGitTreeSha1,classification:c.classification,envBaseline:c.envBaseline,pDevVersion:c.pDevVersion,resumedFromPending:c.resumedFromPending,creationPreviewFingerprint:c.creationPreviewFingerprint}));return{state:w,fingerprint:z,operationId:r,creationPreviewFingerprint:t,resumedFromPending:s,harnessDispatchRepo:"valid-managed"===v.kind?u:null,authenticatedLogin:o.login,message:x,recoverable:"repo-absent"===w||"valid-existing-managed-repo"===w||"same-name-snapshot-only-with-pending"===w,willCreateRepository:y,...bX(p),tokenCapabilities:{tokenType:l.tokenType,hasRepoScope:l.hasRepoScope,hasWorkflowScope:l.hasWorkflowScope,scopeAmbiguous:l.scopeAmbiguous}}}async function b6(a){return bn((0,k.ym)(a.cwd).cwd,async()=>b7(a))}async function b7(a){let b=await b5({cwd:a.cwd,provider:a.provider,operationId:a.operationId,moduleUrl:a.moduleUrl});if(!a.confirmed)return{state:b.state,harnessDispatchRepo:b.harnessDispatchRepo,message:"Confirmation is required before provisioning.",recoverable:!0,persisted:!1};if(b.fingerprint!==a.fingerprint)return{state:"snapshot-preview-stale",harnessDispatchRepo:b.harnessDispatchRepo,message:"Provisioning preview is stale. Retry Step 1 Continue.",recoverable:!0,persisted:!1};if("skipped-not-packaged"===b.state||"token-unsupported"===b.state||"token-insufficient"===b.state||"token-scope-ambiguous"===b.state||"snapshot-unavailable"===b.state||"snapshot-manifest-missing"===b.state||"snapshot-manifest-invalid"===b.state||"snapshot-incompatible"===b.state||"snapshot-tampered"===b.state||"same-name-public-collision"===b.state||"same-name-unmanaged-collision"===b.state||"same-name-malformed-marker"===b.state||"same-name-snapshot-only-without-pending"===b.state||"explicit-packaged-repo-invalid"===b.state||"explicit-packaged-repo-legacy-source"===b.state)return{state:b.state,harnessDispatchRepo:b.harnessDispatchRepo,message:b.message,recoverable:b.recoverable,persisted:!1};let c=await a.provider.resolveAuthenticatedUser(),d=a2(),e=(0,k.ym)(a.cwd),f=await (0,h.Hn)(e),g=f?.values.GITHUB_DISPATCH_REPOSITORY?.trim();if(g){let b=await b_(a.provider,g,bY(f));if(!b.ok)return{state:b.state,harnessDispatchRepo:g,message:b.message,recoverable:!0,persisted:!1};let c=await T({cwd:a.cwd,githubDispatchRepository:b.repoSlug,githubDispatchRepositoryId:b.repositoryId});return"changed"!==c.outcome&&"skipped"!==c.outcome?{state:"created-but-persistence-failed",harnessDispatchRepo:b.repoSlug,message:c.reason??"Failed to persist GITHUB_DISPATCH_REPOSITORY.",recoverable:!0,persisted:!1}:(await br(a.cwd),{state:"verified-and-persisted",harnessDispatchRepo:b.repoSlug,message:`Connected to saved harness workspace ${b.repoSlug}.`,recoverable:!1,persisted:!0})}let i=await bT(a.moduleUrl??"file:///Users/weston/Code/agentic-product-development-harness/src/setup/harness-repo-provisioning.ts");if(!i.ok)return{state:i.state,harnessDispatchRepo:null,message:i.message,recoverable:!1,persisted:!1};let j=await b0(a.provider,c,a.cwd,i),l=a7({operationId:a.operationId,user:c,destination:bV(c.login),manifest:i.manifest,snapshotFingerprint:i.fingerprint,classification:j.kind,envBaseline:f?.values.GITHUB_DISPATCH_REPOSITORY??"",pDevVersion:d,resumedFromPending:b.resumedFromPending,creationPreviewFingerprint:b.creationPreviewFingerprint}),m=function(a){let b=function(a){let b;try{b=JSON.parse(a)}catch{return null}if(!b||"object"!=typeof b)return null;let c=b;return c.action===a4&&"string"==typeof c.operationId&&c.operationId.trim()&&"number"==typeof c.authenticatedUserId&&Number.isFinite(c.authenticatedUserId)&&"string"==typeof c.authenticatedLogin&&c.authenticatedLogin.trim()&&"string"==typeof c.destination&&c.packageName===a3.Au&&"string"==typeof c.packageVersion&&"string"==typeof c.sourceRepository&&"string"==typeof c.sourceCommit&&"number"==typeof c.manifestSchemaVersion&&"string"==typeof c.snapshotFingerprint&&"string"==typeof c.snapshotContentId&&"string"==typeof c.snapshotSha256&&"string"==typeof c.snapshotGitTreeSha1&&"string"==typeof c.classification&&"string"==typeof c.envBaseline&&"string"==typeof c.pDevVersion&&"boolean"==typeof c.resumedFromPending&&(null===c.creationPreviewFingerprint||"string"==typeof c.creationPreviewFingerprint)?{operationId:c.operationId.trim(),authenticatedUserId:c.authenticatedUserId,authenticatedLogin:a5(c.authenticatedLogin),destination:a6(c.destination),packageName:a3.Au,packageVersion:String(c.packageVersion).trim(),sourceRepository:String(c.sourceRepository),sourceCommit:String(c.sourceCommit),manifestSchemaVersion:c.manifestSchemaVersion,snapshotFingerprint:String(c.snapshotFingerprint),snapshotContentId:String(c.snapshotContentId).trim(),snapshotSha256:String(c.snapshotSha256),snapshotGitTreeSha1:String(c.snapshotGitTreeSha1),classification:c.classification,envBaseline:a6(String(c.envBaseline)),pDevVersion:String(c.pDevVersion).trim(),resumedFromPending:c.resumedFromPending,creationPreviewFingerprint:null===c.creationPreviewFingerprint?null:String(c.creationPreviewFingerprint)}:null}(a.submittedFingerprint);if(!b)return{ok:!1,mismatchedField:"operationId",message:"Provisioning preview fingerprint is invalid. Retry Step 1 Continue."};var c=a.currentContext;for(let[a,d,e]of[["operationId",b.operationId,c.operationId],["authenticatedUserId",b.authenticatedUserId,c.authenticatedUserId],["authenticatedLogin",b.authenticatedLogin,c.authenticatedLogin],["destination",b.destination,c.destination],["packageName",b.packageName,c.packageName],["packageVersion",b.packageVersion,c.packageVersion],["sourceRepository",b.sourceRepository,c.sourceRepository],["sourceCommit",b.sourceCommit,c.sourceCommit],["manifestSchemaVersion",b.manifestSchemaVersion,c.manifestSchemaVersion],["snapshotFingerprint",b.snapshotFingerprint,c.snapshotFingerprint],["snapshotContentId",b.snapshotContentId,c.snapshotContentId],["snapshotSha256",b.snapshotSha256,c.snapshotSha256],["snapshotGitTreeSha1",b.snapshotGitTreeSha1,c.snapshotGitTreeSha1],["classification",b.classification,c.classification],["envBaseline",b.envBaseline,c.envBaseline],["pDevVersion",b.pDevVersion,c.pDevVersion],["resumedFromPending",b.resumedFromPending,c.resumedFromPending],["creationPreviewFingerprint",b.creationPreviewFingerprint,c.creationPreviewFingerprint]]){let b=d!==e?{ok:!1,mismatchedField:a,message:`Provisioning preview is stale (${a} changed). Retry Step 1 Continue.`}:null;if(b)return b}return{ok:!0}}({submittedFingerprint:a.fingerprint,currentContext:l});if(!m.ok)return{state:"snapshot-preview-stale",harnessDispatchRepo:null,message:m.message,recoverable:!0,persisted:!1};let n=bV(c.login),o="valid-managed"===j.kind?j.repositoryId:void 0,p=await bp(a.cwd);if(b.resumedFromPending){if(!p||!b.creationPreviewFingerprint)return{state:"same-name-snapshot-only-without-pending",harnessDispatchRepo:bV(c.login),message:"Matching local pending provisioning evidence is required to resume.",recoverable:!0,persisted:!1};let d=bs(p,bZ(i,{operationId:a.operationId,authenticatedUserId:c.id,authenticatedLogin:c.login,targetOwner:c.login,targetRepo:a9,previewFingerprint:b.creationPreviewFingerprint}));if(!d.ok)return{state:"same-name-unmanaged-collision",harnessDispatchRepo:bV(c.login),message:d.reason,recoverable:!0,persisted:!1}}else if(p&&"valid-existing-managed-repo"!==b.state&&"valid-managed"!==j.kind)return{state:"concurrent-request-recovered",harnessDispatchRepo:null,message:"Another provisioning operation is already in progress for this workspace.",recoverable:!0,persisted:!1};let q=b.creationPreviewFingerprint??a.fingerprint,r=p,s=!1;if("valid-managed"===j.kind)n=j.repoSlug;else{if("absent"!==j.kind&&"snapshot-only-with-pending"!==j.kind)return{state:b.state,harnessDispatchRepo:b.harnessDispatchRepo,message:b.message,recoverable:b.recoverable,persisted:!1};let e="snapshot-only-with-pending"===j.kind?await b3(a.provider,n):null;if("snapshot-only-with-pending"===j.kind&&e?.ok){let{owner:b,repo:f}=aQ(n),g=await a.provider.getRepositoryDefaultBranchHead(b,f,e.defaultBranch),h=await b2(a.provider,{repoSlug:n,repositoryId:e.repositoryId,defaultBranch:e.defaultBranch,templateIdentity:e.identity,templateHeadSha:g,operationId:a.operationId,user:c,pDevVersion:d});if(!h.ok)return{state:"marker-write-pending",harnessDispatchRepo:n,message:h.message,recoverable:!0,persisted:!1};o=e.repositoryId}else{let d;"absent"!==j.kind||b.resumedFromPending||(await bq(b1({operationId:a.operationId,user:c,snapshotPreview:i,previewFingerprint:q}),a.cwd),r=await bp(a.cwd));try{d=await bP({provider:a.provider,user:c,repoName:a9,description:"Private p-dev Product Development Harness workspace",snapshotRoot:i.snapshotRoot,manifest:i.manifest,packageVersion:i.packageVersion,operationId:a.operationId,pending:r,onCheckpoint:async b=>{await bq(b1({operationId:a.operationId,user:c,snapshotPreview:i,previewFingerprint:q,pending:r,phase:b.phase,repositoryId:b.repositoryId,defaultBranch:b.defaultBranch,initializedCommitSha:b.initializedCommitSha,snapshotCommitSha:b.snapshotCommitSha,markerCommitSha:b.markerCommitSha}),a.cwd),r=await bp(a.cwd)}})}catch(e){let b=e instanceof Error?e.message:"Repository provisioning failed unexpectedly.";if(e instanceof bv&&"marker-commit-failed"===e.code){let{owner:d,repo:e}=aQ(bV(c.login)),f=await a.provider.getRepositoryMetadata(d,e);if(f){let b=await a.provider.getRepositoryDefaultBranchHead(d,e,f.defaultBranch),g=r?.initializedCommitSha;try{let c=await a.provider.getGitCommit(d,e,b);g=c.parents[0]?.sha??g}catch{}await bq(b1({operationId:a.operationId,user:c,snapshotPreview:i,previewFingerprint:q,pending:r,phase:"marker-pending",repositoryId:f.repositoryId,initializedCommitSha:g,snapshotCommitSha:b}),a.cwd)}return{state:"marker-write-pending",harnessDispatchRepo:bV(c.login),message:b,recoverable:!0,persisted:!1}}let d=await b0(a.provider,c,a.cwd,i);if("valid-managed"===d.kind||"snapshot-only-with-pending"===d.kind)return{state:"repo-created-pending-verification",harnessDispatchRepo:bV(c.login),message:b,recoverable:!0,persisted:!1};if(!(e instanceof an.OS)||422!==e.status)return{state:"api-timeout-unknown",harnessDispatchRepo:bV(c.login),message:b,recoverable:!0,persisted:!1};if("absent"===(await b0(a.provider,c,a.cwd,i)).kind)return{state:"api-timeout-unknown",harnessDispatchRepo:bV(c.login),message:"Repository creation returned an ambiguous result. Retry Step 1 Continue.",recoverable:!0,persisted:!1};return{state:"repo-created-pending-verification",harnessDispatchRepo:bV(c.login),message:b,recoverable:!0,persisted:!1}}if(d){if(!d.ok)return{state:"marker-commit-failed"===d.code||"description-finalization-failed"===d.code||r?.phase==="marker-pending"||r?.phase==="description-pending"||r?.snapshotCommitSha?"marker-write-pending":d.recoverable?"repo-created-pending-verification":"api-timeout-unknown",harnessDispatchRepo:bV(c.login),message:d.message,recoverable:d.recoverable,persisted:!1};n=d.fullName,o=d.repositoryId,s=!0,await bq(b1({operationId:a.operationId,user:c,snapshotPreview:i,previewFingerprint:q,pending:r,phase:"persistence-pending",repositoryId:d.repositoryId,defaultBranch:d.defaultBranch,initializedCommitSha:d.initializedCommitSha,snapshotCommitSha:d.snapshotCommitSha,markerCommitSha:d.markerCommitSha}),a.cwd)}}}if(void 0===o){let{owner:b,repo:c}=aQ(n),d=await a.provider.getRepositoryMetadata(b,c);if(!d)return{state:"repo-created-pending-verification",harnessDispatchRepo:n,message:`Harness workspace ${n} is not accessible for verification.`,recoverable:!0,persisted:!1};o=d.repositoryId}if(s){let b=await bQ({provider:a.provider,repoSlug:n,repositoryId:o,manifest:i.manifest});if(!b.ok)return{state:"repo-created-pending-verification",harnessDispatchRepo:n,message:b.message,recoverable:!0,persisted:!1}}let t=await T({cwd:a.cwd,githubDispatchRepository:n,githubDispatchRepositoryId:o});return"changed"!==t.outcome&&"skipped"!==t.outcome?{state:"created-but-persistence-failed",harnessDispatchRepo:n,message:t.reason??"Failed to persist GITHUB_DISPATCH_REPOSITORY.",recoverable:!0,persisted:!1}:(await br(a.cwd),{state:"verified-and-persisted",harnessDispatchRepo:n,message:`Private harness workspace ${n} is connected.`,recoverable:!1,persisted:!0})}function b8(a,b){return(0,j.h4)(a,b)}async function b9(a){let b=[],c=[],d=(0,j.Gn)(a.operatorInput);for(let e of a.secretWritePlan){if("skip"===e.action){c.push(e.name);continue}if("HARNESS_CONFIG_JSON_B64"===e.name){let{bytes:c}=await as(a.cwd),f=at(c);d.push(f),b.push({name:e.name,value:f});continue}let f="LINEAR_API_KEY"===e.name?a.operatorInput?.linearApiKey:"CURSOR_API_KEY"===e.name?a.operatorInput?.cursorApiKey:a.operatorInput?.githubToken;if(!f?.trim()){c.push(e.name);continue}b.push({name:e.name,value:f.trim()})}return{requests:b,skippedSecretNames:c,knownSecrets:d}}async function ca(a){let b,c=await (0,U.z8)({cwd:a.cwd,manualRepo:a.manualHarnessDispatchRepo}),d=(0,U.OW)(c),e="unknown";a.provider&&c.resolved&&(e=await a.provider.checkHarnessRepoAccess(d),b=await a.provider.listHarnessSecretStatuses(d));let f=await av({cwd:a.cwd,operatorInput:a.operatorInput,manualHarnessDispatchRepo:a.manualHarnessDispatchRepo,secretStatuses:b,repoAccess:e}),g=(0,j.Gn)(a.operatorInput),h=f.manualInstructions.map(a=>b8(a,g));return{actionId:V.PN.previewHarnessSecrets.id,harnessDispatchRepo:d,harnessDispatchRepoResolved:c.resolved,harnessDispatchRepoSource:c.source,repoAccess:e,secretStatuses:b??f.secretWritePlan.map(a=>({name:a.name,status:"unknown"})),secretWritePlan:f.secretWritePlan,secretKeyNames:f.secretWritePlan.filter(a=>"skip"!==a.action).map(a=>a.name),fingerprint:f.fingerprint,permission:V.PN.previewHarnessSecrets.permission,manualInstructions:h,validationError:f.validationError?b8(f.validationError,g):void 0}}async function cb(a){(0,V.L6)(a.confirmed),(0,V.xp)(V.PN.applyHarnessSecrets.permission.scope,g.P.remoteSecretWrite.scope);let b=await ca(a);if((0,V.Me)(a.fingerprint,b.fingerprint),b.validationError)throw Error(b.validationError);if(!a.provider)throw Error("GitHub token is required for remote harness secret writes");if(!b.harnessDispatchRepoResolved)throw Error("Harness dispatch repo must be resolved before applying secrets");let{requests:c,skippedSecretNames:d,knownSecrets:e}=await b9({cwd:a.cwd,operatorInput:a.operatorInput,secretWritePlan:b.secretWritePlan});if(0===c.length)throw Error("No harness repo Actions secrets are ready to write");try{let f=await a.provider.writeHarnessSecrets(b.harnessDispatchRepo,c),g={actionId:V.PN.applyHarnessSecrets.id,harnessDispatchRepo:b.harnessDispatchRepo,writtenSecrets:f,skippedSecretNames:d,fingerprint:b.fingerprint,permission:V.PN.applyHarnessSecrets.permission},h=JSON.stringify(g);for(let a of e)if(h.includes(a))throw Error("Remote apply result leaked secret material");return g}catch(a){throw Error(aS(a))}}async function cc(a){let b,c=await (0,U.z8)({cwd:a.cwd,manualRepo:a.manualHarnessDispatchRepo}),d=aE({repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,harnessDispatchRepo:c}),e=d.plan.workflowStatus,f="unknown";if(a.provider&&"<invalid-target-repo>"!==d.plan.targetRepoSlug){let c=await a.provider.checkTargetWorkflowStatus({targetRepoSlug:d.plan.targetRepoSlug,workflowPath:d.plan.workflowPath,intendedWorkflowContent:d.workflowContent,productionBranch:a.productionBranch});e=c.workflowStatus,f=c.repoAccess,b=c.productionBranchSha}let g=aE({repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,harnessDispatchRepo:c,workflowStatus:e,productionBranchSha:b});return{actionId:V.PN.previewTargetWorkflowPr.id,plan:g.plan,repoAccess:f,workflowPreviewSummary:g.workflowPreviewSummary,fingerprint:g.fingerprint,permission:V.PN.previewTargetWorkflowPr.permission,manualInstructions:g.manualInstructions,validationError:g.validationError}}async function cd(a){(0,V.L6)(a.confirmed),(0,V.xp)(V.PN.applyTargetWorkflowPr.permission.scope,g.P.remoteRepoWrite.scope);let b=await cc(a);if((0,V.Me)(a.fingerprint,b.fingerprint),b.validationError)throw Error(b.validationError);if(!1!==b.plan.directProductionBranchWrite)throw Error("Direct production branch writes are not allowed");if(!a.provider)throw Error("GitHub token is required for target workflow PR install");try{let c=await a.provider.applyTargetWorkflowPr({targetRepoSlug:b.plan.targetRepoSlug,productionBranch:b.plan.productionBranch,branchName:b.plan.branchName,workflowPath:b.plan.workflowPath,workflowContent:(await aE({repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,harnessDispatchRepo:await (0,U.z8)({cwd:a.cwd,manualRepo:a.manualHarnessDispatchRepo}),workflowStatus:b.plan.workflowStatus})).workflowContent,prTitle:b.plan.prTitle,prBody:b.plan.prBody});return{actionId:V.PN.applyTargetWorkflowPr.id,harnessDispatchRepo:b.plan.harnessDispatchRepo,repoConfigId:b.plan.repoConfigId,outcome:c.outcome,branchName:c.branchName,prUrl:c.prUrl,directProductionBranchWrite:!1,fingerprint:b.fingerprint,permission:V.PN.applyTargetWorkflowPr.permission}}catch(a){throw Error(function(a){if(a instanceof an.OS){let b=aR(a.status,a.message,{workflowFileOperation:!0});return b===aP.aR||b.startsWith(`${aP.aR} `)?`${aP.ge}${b}`:b}return aS(a)}(a))}}async function ce(a){let b=(0,k.ym)(a?.cwd),c=await (0,h.Hn)(b);return c?.values.GITHUB_TOKEN?.trim()||void 0}function cf(a){return!!a?.trim()}var cg=c(34185);let ch=/pdh-smoke-harness-/i,ci=/pdh-smoke-target-/i;function cj(a){return ci.test(a.trim())}async function ck(a){let b,c,d=a?.cwd,e=await ce({cwd:d}),f=await (0,U.z8)({cwd:d,manualRepo:a?.manualHarnessDispatchRepo}),g=(0,U.OW)(f),h="unknown",i=[];a?.provider&&f.resolved?(h=await a.provider.checkHarnessRepoAccess(g),i=await a.provider.listHarnessSecretStatuses(g)):i=(await av({cwd:d,manualHarnessDispatchRepo:a?.manualHarnessDispatchRepo})).secretWritePlan.map(a=>({name:a.name,status:"unknown"}));let j=[];try{let e=await (0,q.rL)({baseDir:d});for(let d of(b=e.config.repos.map(a=>({id:a.id,targetRepo:a.targetRepo})),c=e.config.allowedTargetRepos,e.config.repos)){let b=aE({repoConfigId:d.id,targetRepo:d.targetRepo,productionBranch:d.productionBranch??"main",harnessDispatchRepo:f}),c="unknown",e=b.plan.workflowStatus;if(a?.provider&&"<invalid-target-repo>"!==b.plan.targetRepoSlug){let d=await a.provider.checkTargetWorkflowStatus({targetRepoSlug:b.plan.targetRepoSlug,workflowPath:b.plan.workflowPath,intendedWorkflowContent:b.workflowContent,productionBranch:b.plan.productionBranch});c=d.repoAccess,e=d.workflowStatus}j.push({repoConfigId:d.id,targetRepo:d.targetRepo,productionBranch:d.productionBranch??"main",repoAccess:c,workflowStatus:e,harnessDispatchRepo:g})}}catch{}let k=function(a){let b=function(a){var b;let c=[];a.harnessDispatchRepo&&(b=a.harnessDispatchRepo,ch.test(b.trim()))&&c.push({kind:"harness-dispatch",value:a.harnessDispatchRepo,source:"GITHUB_DISPATCH_REPOSITORY"});let d=a.configSummary?.repos??a.targetRepos?.map(a=>({id:a.id,targetRepo:a.targetRepo,baseBranch:"main",productionBranch:"main"}))??[],e=a.configSummary?.allowedTargetRepos??a.allowedTargetRepos??[];for(let a of d)cj(a.targetRepo)&&c.push({kind:"target-repo",value:a.targetRepo,source:`repos[].targetRepo (${a.id})`});for(let a of e)cj(a)&&c.push({kind:"allowed-target-repo",value:a,source:"allowedTargetRepos[]"});return c}(a),c=a.gitRemoteOriginUrl?(0,cg.e)(a.gitRemoteOriginUrl)??void 0:void 0,d=b.find(a=>"harness-dispatch"===a.kind)?.value,e=[...new Set(b.filter(a=>"target-repo"===a.kind||"allowed-target-repo"===a.kind).map(a=>a.value))];return{hasStaleConfig:b.length>0,findings:b,staleHarnessDispatchRepo:d,staleTargetRepos:e,suggestedHarnessDispatchRepo:c}}({harnessDispatchRepo:g,gitRemoteOriginUrl:await (0,U.vE)(d),targetRepos:b,allowedTargetRepos:c});return{githubTokenConfigured:!!e,harnessDispatchRepo:g,harnessDispatchRepoResolved:f.resolved,harnessDispatchRepoSource:f.source,harnessRepoAccess:h,harnessSecretStatuses:i,targetRepos:j,staleSmokeDiagnostics:k}}let cl=new Set(["failure","cancelled","timed_out","action_required"]),cm=new Set(["neutral","skipped","success"]);var cn=c(73928);function co(a){let b=a.state.toLowerCase(),c=null,d="completed";return"success"===b?c="success":"pending"===b?(c=null,d="queued"):c="failure"===b||"error"===b?"failure":b,{name:a.context,status:d,conclusion:c,detailsUrl:a.target_url}}async function cp(a,b,c){let d=await cq(a,b,c);if(d.merged)return d;if("open"!==d.state)throw Error(`pr_closed: PR ${d.url} is closed but not merged`);return d}async function cq(a,b,c){let d;if(!(0,cn.rc)(b.repoUrl,c))throw Error(`wrong_target_repo: PR repo ${b.repoUrl} does not match expected ${c}`);try{d=await a.getPullRequest(b.owner,b.repo,b.pullNumber)}catch(a){throw a instanceof an.OS&&a.status,a}let e=[];d.merged||(e=await a.getPullRequestFiles(b.owner,b.repo,b.pullNumber));let f=d.head.sha,g=null,h=[];try{h=(g=(await a.getCheckRunsForRef(b.owner,b.repo,f)).check_runs??[]).map(a=>({name:a.name,status:a.status,conclusion:a.conclusion,detailsUrl:a.details_url}))}catch{g=null,h=[]}if(0===h.length)try{let c=await a.getCombinedStatusForRef(b.owner,b.repo,f);h=function(a){if(a.statuses.length>0)return a.statuses.map(co);let b=a.state.toLowerCase();return"pending"===b?[{name:"combined-status",status:"queued",conclusion:null,detailsUrl:null}]:[{name:"combined-status",status:"completed",conclusion:"success"===b?"success":"failure",detailsUrl:null}]}(c)}catch{}let i=(await a.getIssueComments(b.owner,b.repo,b.pullNumber)).map(a=>({author:a.user?.login??"unknown",body:a.body,createdAt:a.created_at})),j=e.map(a=>({path:a.filename,status:a.status}));return{title:d.title,url:d.html_url,branch:d.head.ref,headSha:d.head.sha,baseBranch:d.base.ref,state:d.state,merged:d.merged,isDraft:!0===d.draft,mergeable:d.mergeable??null,mergeableState:d.mergeable_state??null,rebaseable:d.rebaseable??null,mergeCommitSha:d.merge_commit_sha,mergedAt:d.merged_at,repoUrl:b.repoUrl,changedFiles:j,checks:h,checkSummary:function(a){if(0===a.length)return"No GitHub check runs reported for the PR head commit.";let b=a.filter(a=>"success"===a.conclusion).length,c=a.filter(a=>"failure"===a.conclusion||"cancelled"===a.conclusion).length,d=a.filter(a=>"completed"!==a.status||null===a.conclusion).length,e=[`- Passed: ${b}`,`- Failed: ${c}`,`- Pending/unknown: ${d}`];for(let b of a.filter(a=>"failure"===a.conclusion).slice(0,5))e.push(`- Failed check: ${b.name}${b.detailsUrl?` (${b.detailsUrl})`:""}`);return e.join("\n")}(h),comments:i,rawChecks:g}}function cr(a){let b=a.trim().match(/^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/(\d+)\/?$/);if(!b)return null;let c=b[1],d=b[2];return{owner:c,repo:d,pullNumber:Number.parseInt(b[3],10),repoUrl:`https://github.com/${c}/${d}`}}let cs=new Set,ct=new Map;async function cu(a,b){if(cs.has(a)){var c;let b=ct.get(a);if(b)return{result:b,lockContended:!0};await (c=a,cs.has(c)?new Promise(a=>{let b=cv.get(c)??[];b.push(a),cv.set(c,b)}):Promise.resolve());let d=ct.get(a);if(d)return{result:d,lockContended:!0}}cs.add(a);try{let c=await b();return"object"==typeof c&&null!==c&&"lifecycle"in c&&(ct.set(a,c),"complete"===c.lifecycle&&ct.delete(a)),{result:c,lockContended:!1}}finally{cs.delete(a),function(a){let b=cv.get(a)??[];for(let c of(cv.delete(a),b))c()}(a)}}let cv=new Map,cw=new Map;function cx(a,b){return`${a}:${b}`}function cy(a){return{repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,targetRepoSlug:a.targetRepoSlug,productionBranch:a.productionBranch,branchName:a.branchName,lifecycle:"blocked",blockedCategory:a.category,message:a.customMessage??aH(a.category),prUrl:a.prUrl,prNumber:a.prNumber,validatedHeadSha:a.validatedHeadSha,workflowStatus:a.workflowStatus,canRetry:"verification-failed"===a.category,requiresGitHubIntervention:!["checks-pending","mergeability-pending","branch-behind","verification-failed"].includes(a.category),advancedThisRequest:a.advancedThisRequest,lockContended:a.lockContended}}function cz(a){return{repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,targetRepoSlug:a.targetRepoSlug,productionBranch:a.productionBranch,branchName:a.branchName,lifecycle:a.lifecycle,blockedCategory:a.blockedCategory,message:a.message,prUrl:a.prUrl,prNumber:a.prNumber,validatedHeadSha:a.validatedHeadSha,workflowStatus:a.workflowStatus,canRetry:a.canRetry??!1,requiresGitHubIntervention:a.requiresGitHubIntervention??!1,advancedThisRequest:a.advancedThisRequest,lockContended:a.lockContended}}function cA(a){return cw.delete(cx(a.targetRepoSlug,a.repoConfigId)),cz({...a,lifecycle:"complete",workflowStatus:"present",message:"Workflow installed on the production branch.",advancedThisRequest:a.advancedThisRequest,lockContended:a.lockContended})}async function cB(a,b,c,d){let[e,f]=b.split("/"),g=await a.getRepositoryContent(e,f,c,d);return g?a.decodeRepositoryContent(g):null}async function cC(a,b){let[c,d]=b.targetRepoSlug.split("/"),e=(await a.listPullRequests(c,d,{state:"open",base:b.productionBranch,head:`${c}:${b.branchName}`}))[0];return e?{number:e.number,html_url:e.html_url,headSha:e.head.sha}:null}async function cD(a){var b,c;let d,e,{input:f,provider:g,client:h,lockContended:i=!1}=a,j=aw(f.targetRepo);if(!j)return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:"<invalid>",productionBranch:f.productionBranch,branchName:az(f.repoConfigId),category:"unexpected-pr-content",workflowStatus:"unknown",advancedThisRequest:!0,lockContended:i,customMessage:`Invalid target repo URL: ${f.targetRepo}`});let k=f.branchName??az(f.repoConfigId),l=await (0,U.z8)({cwd:a.cwd,manualRepo:f.manualHarnessDispatchRepo}),m=aE({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,productionBranch:f.productionBranch,harnessDispatchRepo:l}).workflowContent,n=(0,U.OW)(l),o=await g.checkTargetWorkflowStatus({targetRepoSlug:j,workflowPath:V.CH,intendedWorkflowContent:m,productionBranch:f.productionBranch});if("present"===o.workflowStatus)return cA({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,advancedThisRequest:!0,lockContended:i});let p=cw.get(cx(j,f.repoConfigId))??{},s=f.prUrl;if(s){let a=cr(s);a&&(d=a.pullNumber)}if(!s){let a=await cC(h,{targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k});a&&(s=a.html_url,d=a.number,e=a.headSha)}if(!s||!d)return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,advancedThisRequest:!0,lockContended:i,customMessage:"No open workflow install PR was found for the deterministic install branch."});let t=cr(s);if(!t)return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,advancedThisRequest:!0,lockContended:i});let u=await cp(h,t,f.targetRepo);if(u.merged){let a=await g.checkTargetWorkflowStatus({targetRepoSlug:j,workflowPath:V.CH,intendedWorkflowContent:m,productionBranch:f.productionBranch});return"present"===a.workflowStatus?cA({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i}):(p.verificationStartedAt??=Date.now(),Date.now()-p.verificationStartedAt>6e4)?(cw.set(cx(j,f.repoConfigId),p),cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"verification-failed",workflowStatus:a.workflowStatus,prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i})):(cw.set(cx(j,f.repoConfigId),p),cz({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"verifying",workflowStatus:a.workflowStatus,message:"Verifying workflow on the production branch.",prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i}))}if(u.branch!==k)return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i});try{(0,ap.$H)({prUrl:s,actualBaseBranch:u.baseBranch,expectedBaseBranch:f.productionBranch})}catch{return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,advancedThisRequest:!0,lockContended:i})}if(u.isDraft&&(await h.markPullRequestReadyForReview(t.owner,t.repo,t.pullNumber),u=await cp(h,t,f.targetRepo)),p.lastValidatedHeadSha=e=u.headSha,b=u.changedFiles,c=V.CH,1!==b.length||b[0]?.path!==c)return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});if("present"!==aD(await cB(h,j,V.CH,u.headSha),m))return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:"Workflow install PR content does not match the harness-generated workflow."});if(!m.includes(n)||!m.includes(`--arg repo ${f.repoConfigId}`))return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"unexpected-pr-content",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});let v=await (0,q.rL)({baseDir:a.cwd}),w=v.config.merge?.mergeMethod??r.nm,x=function(a,b){let c=b.merge?.allowPendingChecks??r.dM,d=b.merge?.allowUnknownChecks??r.Sf,e=b.merge?.allowNeutralChecks??r.R;if(0===a.length)return d?{decision:"allow",classification:null,reason:"No check runs reported; proceeding per allowUnknownChecks",warnings:["No GitHub check runs reported for the PR head commit"]}:{decision:"block",classification:"checks_unknown",reason:"No GitHub check runs reported for the PR head commit",warnings:[]};let f=a.filter(a=>null!==a.conclusion&&cl.has(a.conclusion));if(f.length>0)return{decision:"block",classification:"checks_failing",reason:`Failing checks: ${f.map(a=>a.name).join(", ")}`,warnings:[]};let g=a.filter(a=>"completed"!==a.status||null===a.conclusion);if(g.length>0)return c?{decision:"allow",classification:null,reason:"Pending checks present; proceeding per allowPendingChecks",warnings:g.map(a=>`Pending check: ${a.name}`)}:{decision:"block",classification:"checks_pending",reason:`Pending checks: ${g.map(a=>a.name).join(", ")}`,warnings:[]};let h=a.filter(a=>null!==a.conclusion&&!cm.has(a.conclusion));return h.length>0&&!e?{decision:"block",classification:"checks_unknown",reason:`Unrecognized check conclusions: ${h.map(a=>`${a.name}=${a.conclusion}`).join(", ")}`,warnings:[]}:{decision:"allow",classification:null,reason:"Checks policy passed",warnings:[]}}(u.checks,v.config);if("block"===x.decision)return"checks_failing"===x.classification?cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"checks-failing",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:(0,am.M)(x.reason)}):(p.checksPendingSince??=Date.now(),Date.now()-p.checksPendingSince>12e4)?(cw.set(cx(j,f.repoConfigId),p),cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"checks-pending",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:"Timed out waiting for GitHub checks on the workflow install PR."})):(cw.set(cx(j,f.repoConfigId),p),cz({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"waiting-for-checks",workflowStatus:o.workflowStatus,message:"Waiting for GitHub checks on the workflow install PR.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,blockedCategory:"checks-pending"}));let y=u.mergeableState?.toLowerCase()??null;if("unknown"===y||null===u.mergeable)return cw.set(cx(j,f.repoConfigId),p),cz({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"waiting-for-checks",workflowStatus:o.workflowStatus,message:"Waiting for GitHub mergeability on the workflow install PR.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,blockedCategory:"mergeability-pending"});if("behind"===y){if(p.branchUpdateAttemptedForHeadSha!==e)try{return await h.updatePullRequestBranch(t.owner,t.repo,t.pullNumber,{expectedHeadSha:e}),p.branchUpdateAttemptedForHeadSha=e,cw.set(cx(j,f.repoConfigId),p),cz({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"updating-branch",workflowStatus:o.workflowStatus,message:"Updating the workflow install branch.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i})}catch(b){let a=aG({error:b});return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:a.category,workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:a.message})}return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"branch-behind",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i})}if("dirty"===y||"blocked"===y)return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"blocked"===y?"review-required":"merge-conflict",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});if(!1===u.mergeable)return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"merge-conflict",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});if(p.mergeAttemptedForHeadSha===e)return cw.set(cx(j,f.repoConfigId),p),cz({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"merging",workflowStatus:o.workflowStatus,message:"Waiting for workflow install PR merge to complete.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!1,lockContended:i});try{await h.mergePullRequest(t.owner,t.repo,t.pullNumber,{mergeMethod:w,commitTitle:aA(),expectedHeadSha:e}),p.mergeAttemptedForHeadSha=e,p.verificationStartedAt=Date.now(),cw.set(cx(j,f.repoConfigId),p)}catch(a){if("pr_already_merged"===aF(a))p.verificationStartedAt??=Date.now(),cw.set(cx(j,f.repoConfigId),p);else{let b=aG({error:a,mergeableState:u.mergeableState,message:a instanceof Error?a.message:String(a)});if(b.waiting)return cw.set(cx(j,f.repoConfigId),p),cz({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"checks-pending"===b.category?"waiting-for-checks":"merging",workflowStatus:o.workflowStatus,message:b.message,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,blockedCategory:b.category});if(a instanceof an.OS&&"github_auth_failure"===aF(a))return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"permission-denied",workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i});return cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:b.category,workflowStatus:o.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:b.message})}}let z=await g.checkTargetWorkflowStatus({targetRepoSlug:j,workflowPath:V.CH,intendedWorkflowContent:m,productionBranch:f.productionBranch});return"present"===z.workflowStatus?cA({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i}):(p.verificationStartedAt??=Date.now(),Date.now()-p.verificationStartedAt>6e4)?(cw.set(cx(j,f.repoConfigId),p),cy({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,category:"verification-failed",workflowStatus:z.workflowStatus,prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,customMessage:"Workflow install PR merged, but production verification timed out."})):(cw.set(cx(j,f.repoConfigId),p),cz({repoConfigId:f.repoConfigId,targetRepo:f.targetRepo,targetRepoSlug:j,productionBranch:f.productionBranch,branchName:k,lifecycle:"verifying",workflowStatus:z.workflowStatus,message:"Verifying workflow on the production branch.",prUrl:s,prNumber:d,validatedHeadSha:e,advancedThisRequest:!0,lockContended:i,canRetry:!0}))}async function cE(a){var b,c;let d=(b=aw(a.input.targetRepo)??a.input.targetRepo,c=a.input.repoConfigId,`${b}:${c}`),{result:e,lockContended:f}=await cu(d,async()=>cD({cwd:a.cwd,input:a.input,provider:a.provider,client:a.client,lockContended:!1}));return{...e,lockContended:f||e.lockContended}}let cF=aZ().join(".harness","control-plane-setup.json");function cG(a){let b=(0,k.ym)(a);return aZ().join(b.cwd,cF)}async function cH(a){let b=cG(a);try{await (0,f.access)(b);let a=await (0,f.readFile)(b,"utf8"),c=JSON.parse(a);if(1!==c.version)return null;return c}catch{return null}}async function cI(a,b){let c=(0,k.ym)(b);await (0,f.mkdir)(c.harnessDir,{recursive:!0}),await (0,f.writeFile)(cG(b),`${JSON.stringify(a,null,2)}
-`,"utf8")}async function cJ(a,b){let c=await cH(b)??{version:1},d={...c,...a,version:1,linear:a.linear??c.linear,vercel:a.vercel??c.vercel};return await cI(d,b),d}async function cK(a,b){return{state:await cH(a),linearTeamKeyFromConfig:b?.configSummary?.linearTeamKey}}var cL=c(96105),cM=c(35966);function cN(a){return new cM.LinearClient({apiKey:a.trim()})}async function cO(a){for(;a.pageInfo?.hasNextPage;)await a.fetchNext();return a.nodes??[]}async function cP(a){try{return((await a.teams()).nodes??[]).map(a=>a.id)}catch{return[]}}async function cQ(a){let b=await a.teams();return(await cO(b)).map(a=>({id:a.id,key:a.key??"",name:a.name??""}))}async function cR(a){let b=await a.projects();return Promise.all((await cO(b)).map(async a=>({id:a.id,name:a.name??"",teamIds:await cP(a)})))}async function cS(a,b){let c=await a.workflowStates({filter:{team:{id:{eq:b}}}});return(await cO(c)).map(a=>({id:a.id,name:a.name??"",type:a.type??""}))}async function cT(a){let b=await a.webhooks();return(await cO(b)).map(a=>({id:a.id,url:a.url??"",enabled:a.enabled??!1,resourceTypes:a.resourceTypes??[],teamId:a.teamId??void 0,secret:a.secret??void 0}))}async function cU(a,b){let c=await a.createTeam({name:b.name,key:b.key,description:b.description}),d=await c.team;if(!d)throw Error("Linear team creation did not return a team");return{id:d.id,key:d.key??b.key,name:d.name??b.name}}async function cV(a,b){let c=await a.createProject({name:b.name,teamIds:b.teamIds,description:b.description}),d=await c.project;if(!d)throw Error("Linear project creation did not return a project");return{id:d.id,name:d.name??b.name,teamIds:b.teamIds}}async function cW(a,b){let c=await a.createWorkflowState({teamId:b.teamId,name:b.name,type:b.type,color:b.color??"#9CA3AF"}),d=await c.workflowState;if(!d)throw Error("Linear workflow state creation did not return a state");return{id:d.id,name:d.name??b.name,type:d.type??b.type}}async function cX(a,b){let c=await a.createWebhook({url:b.url,label:b.label??"Harness webhook bridge",resourceTypes:["Issue"],teamId:b.teamId,allPublicTeams:!b.teamId||void 0,...b.secret?{secret:b.secret}:{}}),d=await c.webhook;if(!d)throw Error("Linear webhook creation did not return a webhook");let e="string"==typeof d.secret?d.secret??void 0:b.secret;return{id:d.id,url:d.url??b.url,enabled:d.enabled??!0,resourceTypes:d.resourceTypes??["Issue"],teamId:d.teamId??b.teamId,secret:e}}async function cY(a,b){let c=await a.updateWebhook(b.webhookId,{url:b.url,label:b.label??"Harness webhook bridge",resourceTypes:["Issue"],secret:b.secret,enabled:!0}),d=await c.webhook;if(!d)throw Error("Linear webhook update did not return a webhook");return{id:d.id,url:d.url??b.url,enabled:d.enabled??!0,resourceTypes:d.resourceTypes??["Issue"],teamId:d.teamId??void 0,secret:d.secret??b.secret}}function cZ(){return{teamCreate:!0,projectCreate:!0,workflowStateCreate:!0,webhookCreate:!0,webhookList:!0}}function c$(a){var b=a?.trim()??"";if(!b)return"";let c=0;for(let a=0;a<b.length;a+=1)c=(c+b.charCodeAt(a))%0x3b9aca07;return`${b.length}:${c}`}let c_={preview:{id:"preview-linear-setup",permission:g.P.remoteRead},apply:{id:"apply-linear-setup",permission:g.P.linearWrite}};function c0(a){return(0,d.createHash)("sha256").update(JSON.stringify(a)).digest("hex").slice(0,16)}function c1(a){return a.trim().toLowerCase()}function c2(a){let b=new Map(a.map(a=>[c1(a.name),a]));return Y().map(a=>{let c=b.get(c1(a.name)),d=!!c,e="skip";return d||(e=a.creatable?"create":"manual"),{name:a.name,category:a.category,role:a.role,present:d,existingType:c?.type,action:e,creatable:a.creatable}})}function c3(a,b){let c=b.teamKey.trim().toLowerCase(),d=c1(b.teamName);return a.find(a=>a.key.trim().toLowerCase()===c)??a.find(a=>c1(a.name)===d)}function c4(a,b){let c=c1(b.projectName);return a.find(a=>c1(a.name)===c&&(!b.teamId||0===a.teamIds.length||a.teamIds.includes(b.teamId)))}async function c5(a){let b,c,d=cZ(),e=[],f=[];if(!a.linearApiKey.trim())return{actionId:c_.preview.id,capabilities:d,teams:[],projects:[],workflowStates:[],dispatchTriggerStatuses:W,missingStatuses:Y().filter(a=>a.creatable).map(a=>a.name),createActions:[],manualSteps:["Add LINEAR_API_KEY in Step 1 before previewing Linear setup."],fingerprint:c0({invalid:"missing-linear-key"}),permission:c_.preview.permission,validationError:"LINEAR_API_KEY is required for Linear setup preview."};let g=cN(a.linearApiKey),h=await cQ(g),i=await cR(g);if("existing"===a.team.mode){if(!(b=h.find(b=>b.id===a.team.teamId))&&a.team.teamId)return{actionId:c_.preview.id,capabilities:d,teams:h,projects:i,workflowStates:[],dispatchTriggerStatuses:W,missingStatuses:[],createActions:[],manualSteps:[],fingerprint:c0({invalid:"team-not-found"}),permission:c_.preview.permission,validationError:"Selected Linear team was not found."}}else if(a.team.teamName&&a.team.teamKey){let c=c3(h,{teamKey:a.team.teamKey,teamName:a.team.teamName});c?b=c:(f.push({kind:"team",name:`${a.team.teamName} (${a.team.teamKey})`}),b={id:"pending-team",key:a.team.teamKey,name:a.team.teamName})}if("existing"===a.project.mode)c=i.find(b=>b.id===a.project.projectId);else if(a.project.projectName&&b){let d=c4(i,{projectName:a.project.projectName,teamId:"pending-team"===b.id?void 0:b.id});d?c=d:(f.push({kind:"project",name:a.project.projectName}),c={id:"pending-project",name:a.project.projectName,teamIds:"pending-team"===b.id?[]:[b.id]})}let j=[];if(b&&"pending-team"!==b.id)for(let a of j=c2(await cS(g,b.id)))"create"===a.action&&f.push({kind:"workflow-state",name:a.name}),"manual"===a.action&&e.push(`${a.name} is Linear-managed and must be verified manually in the workspace.`),a.present&&a.existingType&&Z(a.name)?.category!==a.existingType&&e.push(`${a.name} exists but uses category ${a.existingType}; harness expects ${Z(a.name)?.category}. Rename manually if needed.`);else if(b)for(let a of j=Y().map(a=>({name:a.name,category:a.category,role:a.role,present:!1,action:a.creatable?"create":"manual",creatable:a.creatable})))"create"===a.action&&f.push({kind:"workflow-state",name:a.name});let k=j.filter(a=>!a.present&&a.creatable).map(a=>a.name),l=c0({actionId:c_.preview.id,team:a.team,project:a.project,workflowStates:j.map(a=>({name:a.name,action:a.action})),linearApiKeyToken:c$(a.linearApiKey)});return{actionId:c_.preview.id,capabilities:d,teams:h,projects:i,selectedTeam:b,selectedProject:c,workflowStates:j,dispatchTriggerStatuses:W,missingStatuses:k,createActions:f,manualSteps:e,fingerprint:l,permission:c_.preview.permission}}async function c6(a){let b=cN(a.linearApiKey),c=await cT(b),d=a.webhookUrl.trim().replace(/\/$/,""),e=c.find(b=>{let c=b.url.trim().replace(/\/$/,"");return(!a.teamId||b.teamId===a.teamId)&&c===d&&b.enabled&&b.resourceTypes.includes("Issue")}),f=[];return e||(f.push(`Create a Linear Issue webhook pointing at ${a.webhookUrl}.`),f.push("Copy the webhook signing secret into Vercel production env var LINEAR_WEBHOOK_SECRET.")),{webhooks:c,matchingWebhook:e,manualSteps:f}}async function c7(a){let b=(0,k.ym)(a.cwd);try{await (0,f.access)(b.configLocal)}catch{return!1}let d=await (0,f.readFile)(b.configLocal,"utf8"),e=cL.k.parse(JSON.parse(d)),g=cL.k.parse({...e,linear:{...e.linear,teamKey:a.teamKey},repos:e.repos.map((b,c)=>0===c?{...b,linearProjects:[a.projectName],linearTeams:[a.teamKey]}:b)}),{writeConfigLocal:h}=await Promise.resolve().then(c.bind(c,19965));return await h({paths:b,content:`${JSON.stringify(g,null,2)}
-`,force:!0}),!0}async function c8(a){let{client:b,teamId:c,created:d,skipped:e}=a,f=async()=>{for(let a of c2(await cS(b,c))){if("create"!==a.action){a.present&&e.push(`status:${a.name}`);continue}let f=Z(a.name);if(f)try{await cW(b,{teamId:c,name:a.name,type:f.category}),d.push(`status:${a.name}`)}catch(d){if(!function(a){let b=a instanceof Error?a.message:"string"==typeof a?a:"";return/duplicate workflow state/i.test(b)}(d)||!(await cS(b,c)).find(b=>c1(b.name)===c1(a.name)))throw d;e.push(`status:${a.name}`)}}};return await f(),c2(await cS(b,c)).every(a=>a.present||!a.creatable)}async function c9(a){let b,c;(0,V.L6)(a.confirmed),(0,V.xp)(c_.apply.permission.scope,g.P.linearWrite.scope);let d=await c5(a.plan);if((0,V.Me)(a.fingerprint,d.fingerprint),d.validationError)throw Error(d.validationError);let e=cN(a.plan.linearApiKey),f=[],h=[];if("create"===a.plan.team.mode){if(!a.plan.team.teamName||!a.plan.team.teamKey)throw Error("New Linear team requires name and key.");let c=c3(await cQ(e),{teamKey:a.plan.team.teamKey,teamName:a.plan.team.teamName});c?(b=c,h.push(`team:${b.key}`)):(b=await cU(e,{name:a.plan.team.teamName,key:a.plan.team.teamKey}),f.push(`team:${b.key}`))}else{let a=d.selectedTeam;if(!a)throw Error("Selected Linear team is required for apply.");b=a,h.push(`team:${b.key}`)}if("create"===a.plan.project.mode){if(!a.plan.project.projectName)throw Error("New Linear project requires a name.");let d=c4(await cR(e),{projectName:a.plan.project.projectName,teamId:b.id});d?(c=d,h.push(`project:${c.name}`)):(c=await cV(e,{name:a.plan.project.projectName,teamIds:[b.id],description:a.plan.project.description}),f.push(`project:${c.name}`))}else{let a=d.selectedProject;if(!a)throw Error("Selected Linear project is required for apply.");c=a,h.push(`project:${c.name}`)}let i=await c8({client:e,teamId:b.id,created:f,skipped:h}),j={teamMode:a.plan.team.mode,teamId:b.id,teamKey:b.key,teamName:b.name,projectMode:a.plan.project.mode,projectId:c.id,projectName:c.name,statusCoverageComplete:i,appliedFingerprint:d.fingerprint,appliedAt:new Date().toISOString()};await cJ({linear:j},a.cwd);let k=await c7({cwd:a.cwd,teamKey:b.key,projectName:c.name});return{actionId:c_.apply.id,team:b,project:c,created:f,skipped:h,statusCoverageComplete:i,verified:!!(b.id&&c.id&&i),fingerprint:d.fingerprint,permission:c_.apply.permission,configUpdated:k}}async function da(a){let b=(0,k.ym)(a),c=await (0,h.Hn)(b),d=await cH(a);return{capabilities:cZ(),controlPlane:d,workspace:function(a){let b=a.state?.linear;return{configured:!!b?.teamKey,teamKey:b?.teamKey,projectName:b?.projectName,statusCoverageComplete:!!(b?.statusCoverageComplete||b?.manualComplete),requiredStatusCount:X.map(a=>a.name).length}}({state:d}),dispatchTriggerStatuses:W,linearApiKeyConfigured:!!c?.presence.LINEAR_API_KEY}}function db(){return(0,d.randomBytes)(32).toString("hex")}function dc(a){return a.trim().replace(/\/$/,"")}function dd(a){let b=dc(a.webhookUrl);return a.webhooks.find(c=>{let d=dc(c.url);return(!a.linearTeamId||c.teamId===a.linearTeamId)&&d===b&&c.enabled&&c.resourceTypes.includes("Issue")})}async function de(a){let b=a.operatorSecret?.trim();if(b)return{secret:b,source:"operator",manualSteps:[]};if(!a.linearApiKey?.trim())return{source:"generated",manualSteps:["Add LINEAR_API_KEY in Step 1 before automated Linear webhook setup can run.","A webhook signing secret will be generated during apply and shown once if manual copy is required."]};let c=cN(a.linearApiKey),d=dd({webhooks:await cT(c),webhookUrl:a.webhookUrl,linearTeamId:a.linearTeamId});if(d){let a=d.secret?.trim();return a?{secret:a,source:"reused-readable",matchingWebhook:{...d,secret:void 0},manualSteps:["A matching Linear Issue webhook exists. Apply will reuse its known signing secret for verification."]}:{source:"unreadable",matchingWebhook:{...d,secret:void 0},manualSteps:["A matching Linear Issue webhook exists, but its signing secret cannot be read from the Linear API.","Update the Linear webhook signing secret manually to match Vercel LINEAR_WEBHOOK_SECRET, then retry verification.","Apply will not rotate the webhook repeatedly while the secret remains unreadable."]}}return{secret:db(),source:"generated",manualSteps:["Apply will create a Linear Issue webhook and write the signing secret to Vercel."]}}async function df(a){if(!a.linearApiKey?.trim())return{mode:"manual-copy",manualSteps:["Add LINEAR_API_KEY in Step 1 before automated Linear webhook setup can run.","A webhook signing secret will be generated during apply and shown once if manual copy is required."]};let b=await c6({linearApiKey:a.linearApiKey,webhookUrl:a.webhookUrl,teamId:a.linearTeamId});return b.matchingWebhook?b.matchingWebhook.secret?.trim()?{mode:"automated",matchingWebhook:b.matchingWebhook,willGenerateOnApply:!1,manualSteps:["A matching Linear Issue webhook already exists. Apply will reuse its known signing secret for verification."]}:{mode:"existing-unverified",matchingWebhook:b.matchingWebhook,willGenerateOnApply:!0,manualSteps:["A matching Linear Issue webhook already exists, but its signing secret cannot be recovered.","Apply will attempt to rotate the existing webhook secret automatically once. If that fails, copy the generated secret into Linear manually."]}:{mode:"automated",willGenerateOnApply:!0,manualSteps:["Apply will create a Linear Issue webhook and write the signing secret to Vercel."]}}async function dg(a){let b=dc(a.previousWebhookUrl),c=dc(a.canonicalWebhookUrl);if(!b||!c||b===c)return{attempted:!1,reconciled:!1,canonicalWebhookExists:!1,matchingPreviousWebhookFound:!1,manualSteps:[]};let d=cN(a.linearApiKey),e=await cT(d),f=dd({webhooks:e,webhookUrl:b,linearTeamId:a.linearTeamId}),g=dd({webhooks:e,webhookUrl:c,linearTeamId:a.linearTeamId});if(!f)return{attempted:!0,reconciled:!1,previousWebhookUrl:b,canonicalWebhookExists:!!g,matchingPreviousWebhookFound:!1,manualSteps:["No matching Linear Issue webhook was found at the previously stored webhook URL.","Create or update the Linear webhook manually to point at the canonical production URL, then retry verification."]};if(g)return g.id===f.id?{attempted:!0,reconciled:!0,previousWebhookId:f.id,previousWebhookUrl:b,canonicalWebhookExists:!0,matchingPreviousWebhookFound:!0,manualSteps:[]}:{attempted:!0,reconciled:!1,previousWebhookId:f.id,previousWebhookUrl:b,canonicalWebhookExists:!0,matchingPreviousWebhookFound:!0,manualSteps:["A separate Linear Issue webhook already exists at the canonical production URL.","Consolidate webhook configuration manually before retrying verification."]};try{return await cY(d,{webhookId:f.id,url:c,secret:a.secret.trim()}),{attempted:!0,reconciled:!0,previousWebhookId:f.id,previousWebhookUrl:b,canonicalWebhookExists:!1,matchingPreviousWebhookFound:!0,manualSteps:[]}}catch{return{attempted:!0,reconciled:!1,previousWebhookId:f.id,previousWebhookUrl:b,canonicalWebhookExists:!1,matchingPreviousWebhookFound:!0,manualSteps:["Could not update the existing Linear Issue webhook to the canonical production URL automatically.","Update the Linear webhook URL manually to match the canonical production URL, then retry verification."]}}}async function dh(a){let b=a.mutatePolicy??"setup",c=cN(a.linearApiKey),d=dd({webhooks:await cT(c),webhookUrl:a.webhookUrl,linearTeamId:a.linearTeamId});if(d){let e=d.secret?.trim();if(e===a.secret.trim())return{webhook:{...d,secret:void 0},secret:a.secret,mode:"automated",manualSteps:[]};if("verify-only"===b)return e?{webhook:{...d,secret:void 0},secret:e,mode:"automated",manualSteps:[]}:{webhook:{...d,secret:void 0},secret:a.secret,mode:"existing-unverified",manualSteps:["Matching Linear webhook exists, but its signing secret cannot be read from the Linear API.","Update the Linear webhook signing secret manually to match Vercel LINEAR_WEBHOOK_SECRET, then retry verification."]};try{return{webhook:{...await cY(c,{webhookId:d.id,url:a.webhookUrl,secret:a.secret}),secret:void 0},secret:a.secret,mode:"automated",manualSteps:[]}}catch{return{webhook:{...d,secret:void 0},secret:a.secret,mode:"existing-unverified",manualSteps:["Matching Linear webhook exists, but its signing secret could not be rotated automatically.","Copy the generated webhook secret into the Linear webhook signing secret field, then retry verification."]}}}if("verify-only"===b||"verify-reconcile-url"===b)return{secret:a.secret,mode:"manual-copy",manualSteps:[`Create a Linear Issue webhook pointing at ${a.webhookUrl}.`,"Retry verification after the webhook exists and its signing secret matches Vercel."]};try{let b=await cX(c,{url:a.webhookUrl,teamId:a.linearTeamId,label:"Harness webhook bridge",secret:a.secret});if(b.secret)return{webhook:{...b,secret:void 0},secret:b.secret,mode:"automated",manualSteps:[]};return{webhook:{...b,secret:void 0},secret:a.secret,mode:"manual-copy",manualSteps:["Linear webhook was created, but the signing secret was not returned by the API.","Copy the generated secret into the Linear webhook signing secret field."]}}catch{return{secret:a.secret,mode:"manual-copy",manualSteps:[`Create a Linear Issue webhook pointing at ${a.webhookUrl}.`,"Copy the generated webhook secret into Linear and confirm when complete."]}}}var di=c(74590);async function dj(a){var b;let c=a.nowMs??Date.now(),e=function(a){try{let b=new URL(a);return{webhookHost:b.host,webhookPath:b.pathname}}catch{return{}}}(a.webhookUrl),f=JSON.stringify({action:"create",type:"Comment",webhookTimestamp:c,data:{id:"harness-setup-probe"}}),g=(b=a.secret,(0,d.createHmac)("sha256",b).update(f).digest("hex")),h=a.fetchImpl??fetch;try{let b=await h(a.webhookUrl,{method:"POST",headers:{"Content-Type":"application/json","linear-signature":g,"linear-timestamp":String(c),"linear-event":"Comment","linear-delivery":`harness-setup-probe-${c}`},body:f,redirect:"manual"});if(function(a){if(302!==a.status&&307!==a.status&&308!==a.status)return!1;let b=a.headers.get("location")??"";return/vercel\.com\/sso-api/i.test(b)}(b))return{passed:!1,statusCode:b.status,result:"protection_redirect",reason:"Vercel Deployment Protection redirected the webhook endpoint. Disable protection for /api/linear-webhook or allow public access before verifying the bridge.",probedAt:new Date(c).toISOString(),...e};let d=null;try{d=await b.json()}catch{return{passed:!1,statusCode:b.status,result:"error",reason:"Webhook endpoint did not return JSON.",probedAt:new Date(c).toISOString(),...e}}if(401===b.status)return{passed:!1,statusCode:b.status,result:"auth_failed",reason:d.error??"invalid_signature",probedAt:new Date(c).toISOString(),...e};if(404===b.status)return{passed:!1,statusCode:b.status,result:"unreachable",reason:"Webhook route was not found on the production deployment.",probedAt:new Date(c).toISOString(),...e};if(200===b.status&&!1===d.accepted&&"string"==typeof d.reason)return{passed:!0,statusCode:b.status,result:"accepted_ignored",reason:d.reason,probedAt:new Date(c).toISOString(),...e};return{passed:!1,statusCode:b.status,result:"error",reason:"Signed probe was not authentication-accepted and business-ignored.",probedAt:new Date(c).toISOString(),...e}}catch{return{passed:!1,result:"unreachable",reason:"Webhook endpoint could not be reached for signed probe verification.",probedAt:new Date(c).toISOString(),...e}}}function dk(a){return!a.passed&&"auth_failed"===a.result&&"invalid_signature"===a.reason}async function dl(a){let b=a.listDeployments??di.bM,c=(await b(a.vercelToken,a.projectId,a.teamId,{state:"READY",limit:5})).find(a=>(0,di.oN)(a));return c?.id}async function dm(a){let b=a.listDeployments??di.bM,c=a.triggerRedeploy??di.b1,d=a.sourceDeploymentId?.trim()??await dl({vercelToken:a.vercelToken,projectId:a.projectId,teamId:a.teamId,listDeployments:b});if(!d)return{status:"no_source_deployment",message:"No READY production deployment was found to redeploy. Deploy the project in Vercel before applying settings."};try{let b=await c(a.vercelToken,{projectName:a.projectName,sourceDeploymentId:d,teamId:a.teamId});return{status:"triggered",sourceDeploymentId:d,newDeploymentId:b.id,state:b.state,readyState:b.readyState,message:"Production redeploy triggered. Waiting for Vercel deployment READY."}}catch(a){return{status:"failed",sourceDeploymentId:d,message:a instanceof Error?a.message:"Vercel production redeploy request failed."}}}async function dn(a){let b=a.getDeployment??di.V9,c=await b(a.vercelToken,a.newDeploymentId,a.teamId);return(0,di.oN)(c)?{status:"ready",sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,state:c.state,readyState:c.readyState,message:"Production redeploy completed and deployment is READY."}:!function(a){let b=a.readyState??a.state;return"ERROR"===b||"CANCELED"===b}(c)?Date.now()>Date.parse(a.deadlineAt)?{status:"timeout",sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,state:c.state,readyState:c.readyState,message:"Production redeploy did not reach READY before the timeout. Retry verification after Vercel finishes building."}:{status:"building",sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,state:c.state,readyState:c.readyState,message:"Waiting for Vercel deployment READY…"}:{status:"failed",sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,state:c.state,readyState:c.readyState,message:`Production redeploy failed with state ${c.readyState??c.state}.`}}let dp="LINEAR_WEBHOOK_SECRET";async function dq(a){let b=a.secret.trim();if(!b)return!1;let c=(0,k.ym)(a.cwd),d=await (0,h.ed)(c);if((d?(0,h.Um)(d).values[dp]?.trim():void 0)&&!0!==a.overwriteExisting)return!1;let e=function(a,b){if(null===a)return`# Operator local setup — harness Step 3 generated secret
-# Do not commit .env.local (gitignored).
-
-${dp}=${b}
-`;let c=a.split("\n"),d=[],e=!1;for(let a of c){let c=a.trim();if(!c||c.startsWith("#")){d.push(a);continue}let f=c.indexOf("=");if(-1===f){d.push(a);continue}if(c.slice(0,f).trim()===dp){e=!0,d.push(`${dp}=${b}`);continue}d.push(a)}e||(d.length>0&&""!==d[d.length-1]&&d.push(""),d.push("# --- Harness Step 3 generated secret ---"),d.push(`${dp}=${b}`));let f=d.join("\n");return a.endsWith("\n")&&!f.endsWith("\n")&&(f+="\n"),f}(d,b);return await (0,f.writeFile)(c.envLocal,e,"utf8"),!0}let dr={preview:{id:"preview-vercel-bridge",permission:g.P.remoteRead},apply:{id:"apply-vercel-bridge",permission:g.P.remoteSecretWrite}};function ds(a){return(0,d.createHash)("sha256").update(JSON.stringify(a)).digest("hex").slice(0,16)}function dt(a){return{actionId:dr.preview.id,teamId:a.teamId,teamMode:a.teamMode,teamSlug:a.teamSlug,projectId:a.projectId,projectMode:a.projectMode,projectName:a.projectName,envWritePlan:a.envWritePlan.map(a=>({key:a.key,action:a.action,source:a.source,existingType:a.existingType,desiredType:a.desiredType})),linearWebhookSecretToken:a.willGenerateLinearWebhookSecret?"generate-on-apply":c$(a.linearWebhookSecretFromEnv),githubDispatchTokenToken:c$(a.githubDispatchTokenFromEnv??a.derivedGithubDispatchToken),harnessTeamKey:a.harnessTeamKey??a.derivedHarnessTeamKey??"",vercelTokenToken:c$(a.vercelToken)}}function du(a){return a.projectJustCreated?{message:`Project "${a.projectName}" was created in Vercel, but it has no production deployment yet.`,nextSteps:["Deploy or connect the project in Vercel so it has a production URL.","Return here, select the project under Use existing project, and apply again."]}:{message:`Project "${a.projectName}" exists in Vercel but has no production deployment yet.`,nextSteps:["Deploy the project in Vercel before applying settings.","After deployment completes, preview and apply again."]}}function dv(a){let b=a.team?.mode??"existing",c=a.project?.mode??"existing";return{...a,teamId:"existing"===b?a.team?.teamId??a.teamId:a.teamId,projectId:"existing"===c?a.project?.projectId??a.projectId:a.projectId,projectName:"create"===c?a.project?.projectName??a.projectName:a.projectName,team:a.team??{mode:"existing",teamId:a.teamId},project:a.project??{mode:"existing",projectId:a.projectId,projectName:a.projectName}}}async function dw(a){let b,c,d=dv(a);if(!d.vercelToken.trim())return{actionId:dr.preview.id,teams:[],projects:[],deploymentStatus:"missing",endpointReachable:!1,envWritePlan:[],requiredEnvPresence:{LINEAR_WEBHOOK_SECRET:"missing",GITHUB_DISPATCH_TOKEN:"missing",HARNESS_TEAM_KEY:"missing"},linearWebhookVerified:!1,readiness:(0,$.s5)({}),manualSteps:["Add VERCEL_TOKEN in Step 1 before configuring Vercel settings."],fingerprint:ds({invalid:"missing-vercel-token"}),permission:dr.preview.permission,validationError:"VERCEL_TOKEN is required for Vercel settings preview."};let e=function(a){let b=dv(a);if(b.team?.mode==="create"){if(!b.team.teamSlug?.trim())return"New Vercel team requires a team slug."}else b.teamId||b.team?.teamId;if(b.project?.mode==="create"){if(!b.project.projectName?.trim())return"New Vercel project requires a project name."}else if(!b.projectId?.trim())return"Vercel project is required."}(d);if(e)return{actionId:dr.preview.id,teams:[],projects:[],deploymentStatus:"missing",endpointReachable:!1,envWritePlan:[],requiredEnvPresence:{LINEAR_WEBHOOK_SECRET:"missing",GITHUB_DISPATCH_TOKEN:"missing",HARNESS_TEAM_KEY:"missing"},linearWebhookVerified:!1,readiness:(0,$.s5)({}),manualSteps:[e],fingerprint:ds({invalid:"invalid-selection"}),permission:dr.preview.permission,validationError:e};let f=await (0,di.dk)(d.vercelToken),g=d.team?.mode==="create"?(0,di.wH)(f,d.team.teamSlug??"")?.id:d.teamId?.trim()?d.teamId:void 0,h=await (0,di.Eb)(d.vercelToken,g),i=d.project?.mode==="existing"?h.find(a=>a.id===d.projectId)??h.find(a=>a.id===d.project?.projectId):(0,di.MA)(h,d.project?.projectName??"");if(i||d.project?.mode!=="create"||(i=void 0),!i){let a=d.project?.mode==="create"?[`Project "${d.project?.projectName}" will be created during apply if it does not already exist.`]:["Select or enter the Vercel project for automation and preview checks."];return{actionId:dr.preview.id,teams:f,projects:h,deploymentStatus:d.project?.mode==="create"?"project-will-be-created":"missing",endpointReachable:!1,envWritePlan:[],requiredEnvPresence:{LINEAR_WEBHOOK_SECRET:"missing",GITHUB_DISPATCH_TOKEN:"missing",HARNESS_TEAM_KEY:"missing"},linearWebhookVerified:!1,readiness:(0,$.s5)({}),manualSteps:a,fingerprint:ds({invalid:"missing-project",teamId:g,teamMode:d.team?.mode,teamSlug:d.team?.teamSlug,projectMode:d.project?.mode,projectName:d.project?.projectName}),permission:dr.preview.permission,validationError:d.project?.mode==="create"?void 0:"Vercel project is required."}}let j=await (0,di.dQ)({vercelToken:d.vercelToken,projectId:i.id,teamId:g,preferredDeploymentId:d.preferredProductionDeploymentId}),k=j?.productionUrl,l=j?.webhookUrl,m=l?"ready":"missing",n=l?void 0:du({projectName:i.name,projectJustCreated:d.project?.mode==="create"}),o=l?await (0,di._i)(l):{reachable:!1},p=await (0,di.A3)(d.vercelToken,i.id,g),q=new Map(p.map(a=>[a.key,a])),r=(0,di.FR)(p),s=!1,t=[];if(d.team?.mode!=="create"||g||t.push(`Team "${d.team.teamSlug}" will be created during apply if it does not already exist.`),d.linearApiKey&&l){let a=await c6({linearApiKey:d.linearApiKey,webhookUrl:l,teamId:d.linearTeamId});b=(c=await df({linearApiKey:d.linearApiKey,webhookUrl:l,linearTeamId:d.linearTeamId})).mode,s=!1,"existing-unverified"===c.mode&&(s=!1),t.push(...a.manualSteps,...c.manualSteps)}else l?t.push("After Vercel env vars are configured, create or verify the Linear Issue webhook."):t.push(n?.message??"No production deployment was found for the selected Vercel project yet. Deploy the project before automation checks can pass.",...n?.nextSteps??[]),b="manual-copy";let u=d.willGenerateLinearWebhookSecret??c?.willGenerateOnApply??!d.envInput?.LINEAR_WEBHOOK_SECRET?.trim(),v=function(a){let b=[],c=new Set(a.existingEnvByKey.keys()),d=b=>{let d=a.envInput?.[b]?.trim();return d?{value:d,source:"operator-input"}:"HARNESS_TEAM_KEY"===b&&a.derivedHarnessTeamKey?.trim()?{value:a.derivedHarnessTeamKey.trim(),source:"derived"}:"GITHUB_DISPATCH_TOKEN"===b&&a.derivedGithubDispatchToken?.trim()?{value:a.derivedGithubDispatchToken.trim(),source:"derived"}:"LINEAR_WEBHOOK_SECRET"===b&&a.willGenerateLinearWebhookSecret?{value:"<generated-on-apply>",source:"generated"}:c.has(b)?{value:void 0,source:"preserve-existing"}:{value:void 0,source:"missing-input"}};for(let e of $.P$){let f=d(e),g=a.existingEnvByKey.get(e),h=(0,di.iQ)(e);if("preserve-existing"===f.source){b.push({key:e,action:"skip",source:"preserve-existing",existingType:g?.type,desiredType:h});continue}if("missing-input"===f.source||!f.value){b.push({key:e,action:"skip",source:"missing-input",desiredType:h});continue}b.push({key:e,action:c.has(e)?"update":"create",source:f.source,existingType:g?.type,desiredType:g?.type??h})}for(let d of $.ck){let e=a.envInput?.[d]?.trim()??$.vC[d],f=a.existingEnvByKey.get(d),g=(0,di.iQ)(d);if(!e){b.push({key:d,action:"skip",source:"missing-input",desiredType:g});continue}if(c.has(d)){b.push({key:d,action:"skip",source:"preserve-existing",existingType:f?.type,desiredType:g});continue}b.push({key:d,action:"create",source:a.envInput?.[d]?.trim()?"operator-input":"default",desiredType:g})}return b}({existingEnvByKey:q,envInput:d.envInput,derivedHarnessTeamKey:d.derivedHarnessTeamKey,derivedGithubDispatchToken:d.derivedGithubDispatchToken,willGenerateLinearWebhookSecret:u}),w=d.envInput?.GITHUB_DISPATCH_TOKEN?.trim()?"operator-input":d.derivedGithubDispatchToken?.trim()?"saved-github-token":"missing",x=(0,$.s5)({projectId:i.id,productionUrl:k,webhookUrl:l,endpointReachable:o.reachable,requiredEnvPresence:r,linearWebhookVerified:s,signedProbeVerified:!1,deploymentRedeployRequired:!1}),y=ds(dt({teamId:g,teamMode:d.team?.mode,teamSlug:d.team?.teamSlug,projectId:i.id,projectMode:d.project?.mode,projectName:d.project?.projectName,envWritePlan:v,willGenerateLinearWebhookSecret:u,linearWebhookSecretFromEnv:d.envInput?.LINEAR_WEBHOOK_SECRET,githubDispatchTokenFromEnv:d.envInput?.GITHUB_DISPATCH_TOKEN,derivedGithubDispatchToken:d.derivedGithubDispatchToken,harnessTeamKey:d.envInput?.HARNESS_TEAM_KEY,derivedHarnessTeamKey:d.derivedHarnessTeamKey,vercelToken:d.vercelToken}));return{actionId:dr.preview.id,teams:f,projects:h,selectedProject:i,productionUrl:k,webhookUrl:l,productionUrlSource:j?.source,canonicalDeploymentId:j?.deploymentId,deploymentStatus:m,deploymentRequired:n,endpointReachable:o.reachable,endpointStatusCode:o.statusCode,envWritePlan:v,requiredEnvPresence:r,linearWebhookVerified:s,signedProbeVerified:!1,deploymentRedeployRequired:!1,linearWebhookSecretMode:b,githubDispatchSource:w,readiness:x,manualSteps:t,fingerprint:y,permission:dr.preview.permission}}let dx=/LINEAR_WEBHOOK_SECRET|GITHUB_TOKEN|LINEAR_API_KEY|VERCEL_TOKEN|GITHUB_DISPATCH_TOKEN|linear-signature|signature/i;function dy(a){return dx.test(a)?"[redacted]":a}function dz(a){console.log(`[setup:vercel-bridge] ${JSON.stringify(function(a){let b={event:"vercel_bridge_setup",...a};return a.setupBlockedMessage&&(b.setupBlockedMessage=dy(a.setupBlockedMessage)),a.setupBlockedNextSteps&&(b.setupBlockedNextSteps=a.setupBlockedNextSteps.map(a=>dy(a))),a.message&&(b.message=dy(a.message)),b}(a))}`)}async function dA(a){let b=dv(a.plan);if(b.team?.mode!=="create"){let c=b.teamId?.trim()?b.teamId:void 0,d=await (0,di.dk)(b.vercelToken),e=c?d.find(a=>a.id===c):void 0;return e?(a.reused.push(`team:${e.slug}`),{teamId:e.id,teamName:e.name,team:{id:e.id,name:e.name,outcome:"reused"}}):{teamId:c}}let c=b.team.teamSlug?.trim();if(!c)throw Error("New Vercel team requires a team slug.");let d=await (0,di.dk)(b.vercelToken),e=(0,di.wH)(d,c);if(e)return a.reused.push(`team:${e.slug}`),{teamId:e.id,teamName:e.name,team:{id:e.id,name:e.name,outcome:"reused"}};let f=await (0,di.ln)(b.vercelToken,{slug:c,name:b.team.teamName});return a.created.push(`team:${f.slug}`),{teamId:f.id,teamName:f.name,team:{id:f.id,name:f.name,outcome:"created"}}}async function dB(a){let b=dv(a.plan),c=await (0,di.Eb)(b.vercelToken,a.teamId);if(b.project?.mode==="existing"){let d=b.projectId??b.project.projectId,e=c.find(a=>a.id===d);if(!e)throw Error("Selected Vercel project is required for apply.");return a.reused.push(`project:${e.name}`),{project:e,projectResult:{id:e.id,name:e.name,outcome:"reused"}}}let d=b.project?.projectName?.trim();if(!d)throw Error("New Vercel project requires a project name.");let e=(0,di.MA)(c,d);if(e)return a.reused.push(`project:${e.name}`),{project:e,projectResult:{id:e.id,name:e.name,outcome:"reused"}};let f=await (0,di.P4)(b.vercelToken,{name:d,teamId:a.teamId});return a.created.push(`project:${f.name}`),{project:f,projectResult:{id:f.id,name:f.name,outcome:"created"}}}function dC(){return{message:"No READY production deployment was found to redeploy after env var changes.",nextSteps:["Deploy the project in Vercel so it has a production deployment.","Return here and apply Vercel settings again."]}}async function dD(a){var b,c,e;let f=[{phase:"writing_env_vars",status:a.baseResult.writtenEnvKeys.length>0?"completed":"failed",message:"Writing Vercel env vars…"},{phase:"verifying_webhook",status:"failed",message:"Initial signed probe failed due to stale deployment."}],g=a.baseResult.writtenEnvKeys.length>0,h=a.signedProbe;if(!g||!dk(h))return{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!1,productionRedeployStatus:"not_triggered",orchestrationSteps:f.slice(0,1)};let i=await cH(a.applyInput.cwd),j=i?.vercel?.redeployVerification??a.priorSelection.redeployVerification;if(j?.newDeploymentId&&j.fingerprint===a.fingerprint&&!["verified","verify_failed","failed","timeout","no_source_deployment"].includes(j.status))return f.push({phase:"redeploying_production",status:"completed",message:"Redeploying production so new env vars take effect…"}),{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!0,productionRedeployStatus:"building"===j.status?"building":"triggered",setupPending:!0,pollActionId:j.actionId,orchestrationSteps:f};let k=await dl({vercelToken:a.vercelToken,projectId:a.projectId,teamId:a.teamId});if(!((b={writtenEnvKeys:a.baseResult.writtenEnvKeys,signedProbe:h,sourceDeploymentId:k}).writtenEnvKeys.length>0&&dk(b.signedProbe)&&b.sourceDeploymentId?.trim()))return k?{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!1,productionRedeployStatus:"not_triggered",orchestrationSteps:f.slice(0,1)}:{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!1,productionRedeployStatus:"no_source_deployment",setupBlocked:dC(),orchestrationSteps:f};let l=await dm({vercelToken:a.vercelToken,projectId:a.projectId,projectName:a.projectName,teamId:a.teamId,sourceDeploymentId:k});if("triggered"!==l.status||!l.newDeploymentId){f.push({phase:"redeploying_production",status:"failed",message:l.message??"Redeploying production so new env vars take effect…"});let b="no_source_deployment"===l.status?dC():{message:(c=l.status,e=l.message,"timeout"===c?e??"Automatic production redeploy timed out before READY. Redeploy production in Vercel, then use Retry verification.":"failed"===c?e??"Automatic production redeploy failed. Redeploy production in Vercel, then use Retry verification.":"Redeploy production in Vercel, then use Retry verification (this will not rotate secrets or rewrite env vars)."),nextSteps:["Redeploy production in Vercel manually if needed.","Use Retry verification without rewriting env vars or rotating secrets."]};return dz({phase:"blocked",actionId:dr.apply.id,pollStatus:l.status,projectId:a.projectId,fingerprint:a.fingerprint,setupBlockedMessage:b.message,setupBlockedNextSteps:b.nextSteps}),{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!1,productionRedeployStatus:l.status,setupBlocked:b,orchestrationSteps:f}}let m=function(a){let b=new Date().toISOString();return{actionId:`vercel-redeploy-${(0,d.randomUUID)()}`,projectId:a.projectId,projectName:a.projectName,teamId:a.teamId,webhookUrl:a.webhookUrl,fingerprint:a.fingerprint,fingerprintInputs:a.fingerprintInputs,candidateSecretSource:a.candidateSecretSource,sourceDeploymentId:a.sourceDeploymentId,newDeploymentId:a.newDeploymentId,status:"triggered",startedAt:b,updatedAt:b,deadlineAt:new Date(Date.now()+3e5).toISOString(),verifyAttempted:!1,message:a.message??"Production redeploy triggered. Waiting for Vercel deployment READY.",writtenEnvKeys:a.writtenEnvKeys,skippedEnvKeys:a.skippedEnvKeys}}({projectId:a.projectId,projectName:a.projectName,teamId:a.teamId,webhookUrl:a.webhookUrl,fingerprint:a.fingerprint,fingerprintInputs:a.fingerprintInputs,candidateSecretSource:a.baseResult.candidateSecretSource,sourceDeploymentId:l.sourceDeploymentId,newDeploymentId:l.newDeploymentId,message:l.message,writtenEnvKeys:a.baseResult.writtenEnvKeys,skippedEnvKeys:a.baseResult.skippedEnvKeys});return await cJ({vercel:{...a.priorSelection,redeployVerification:m}},a.applyInput.cwd),dz({phase:"redeploy_trigger",actionId:m.actionId,pollStatus:"triggered",projectId:a.projectId,projectName:a.projectName,teamId:a.teamId,fingerprint:a.fingerprint,candidateSecretSource:a.baseResult.candidateSecretSource}),f.push({phase:"redeploying_production",status:"completed",message:"Redeploying production so new env vars take effect…"}),{...a.baseResult,envVarsWritten:g,signedProbeInitialResult:h,signedProbe:h,productionRedeployTriggered:!0,productionRedeployStatus:"triggered",setupPending:!0,pollActionId:m.actionId,orchestrationSteps:f}}async function dE(a){var b;let c;(0,V.L6)(a.confirmed),(0,V.xp)(dr.apply.permission.scope,g.P.remoteSecretWrite.scope);let e=dv(a.plan);dz({phase:"apply_start",actionId:dr.apply.id,verifyOnly:!0===a.verifyOnly,fingerprint:a.fingerprint,projectId:e.projectId,projectName:e.projectName,teamId:e.teamId});let f=await dw(e);if((0,V.Me)(a.fingerprint,f.fingerprint),f.validationError)throw Error(f.validationError);let h=[],i=[],k=await dA({plan:e,created:h,reused:i}),l=await dB({plan:{...e,teamId:k.teamId,projectId:e.project?.mode==="existing"?e.projectId??e.project?.projectId:void 0},teamId:k.teamId,created:h,reused:i}),m={...e,teamId:k.teamId,projectId:l.project.id,projectName:l.project.name,team:{mode:"existing",teamId:k.teamId??""},project:{mode:"existing",projectId:l.project.id,projectName:l.project.name}},n=await dw(m);if(n.validationError)throw Error(n.validationError);if(!n.selectedProject)throw Error("Vercel project must be selected before apply.");if(!n.webhookUrl){let a="created"===l.projectResult.outcome,b=du({projectName:n.selectedProject.name,projectJustCreated:a});return{actionId:dr.apply.id,status:"deployment-required",projectId:n.selectedProject.id,projectName:n.selectedProject.name,team:k.team,project:l.projectResult,writtenEnvKeys:[],skippedEnvKeys:[],linearWebhookSetup:{mode:"manual-copy",manualSteps:b.nextSteps},deploymentRequired:{...b,projectJustCreated:a},verified:!1,signedProbeVerified:!1,deploymentRedeployRequired:!1,fingerprint:n.fingerprint,permission:dr.apply.permission}}let o=await cH(a.cwd),p=!!(o?.vercel?.redeployVerification?.newDeploymentId&&"verified"!==o.vercel.redeployVerification.status&&"verify_failed"!==o.vercel.redeployVerification.status&&"failed"!==o.vercel.redeployVerification.status&&"timeout"!==o.vercel.redeployVerification.status&&"no_source_deployment"!==o.vercel.redeployVerification.status),q=!0===a.verifyOnly||!!(!p&&o?.vercel?.deploymentRedeployRequired&&o.vercel.projectId===n.selectedProject.id&&o.vercel.appliedFingerprint===n.fingerprint),r=o?.vercel?.webhookUrl?.trim(),s=n.webhookUrl?.trim(),t=!!(q&&r&&s&&r!==s),u=await de({linearApiKey:e.linearApiKey,webhookUrl:n.webhookUrl,linearTeamId:e.linearTeamId,operatorSecret:e.envInput?.LINEAR_WEBHOOK_SECRET}),v=e.verificationLinearWebhookSecret?.trim(),w=!!(v&&(q||e.preserveGeneratedWebhookSecretFingerprint)),x=u.secret;w?x=v:x?.trim()||"generated"!==u.source||(x=db()),"unreadable"!==u.source||q||x?.trim()||(x=db()),!q&&x?.trim()&&!w&&("generated"===u.source||"unreadable"===u.source)&&await dq({cwd:a.cwd,secret:x});let y={mode:"manual-copy",manualSteps:u.manualSteps,manualCopySecret:void 0};if(t&&x?.trim()&&w&&e.linearApiKey?.trim()&&(c=await dg({linearApiKey:e.linearApiKey,linearTeamId:e.linearTeamId,previousWebhookUrl:r,canonicalWebhookUrl:s,secret:x}),dz({phase:"linear_webhook_url_reconcile",actionId:dr.apply.id,verifyOnly:!0===a.verifyOnly,projectId:n.selectedProject.id,fingerprint:n.fingerprint,webhookUrlDrift:!0,reconciliationAttempted:c.attempted,reconciliationSucceeded:c.reconciled,matchingPreviousWebhookFound:c.matchingPreviousWebhookFound,canonicalWebhookExists:c.canonicalWebhookExists})),"unreadable"===u.source&&q)y={mode:"existing-unverified",manualSteps:u.manualSteps,manualCopySecret:void 0};else if(c?.attempted&&!c.reconciled)y={mode:"existing-unverified",manualSteps:c.manualSteps,manualCopySecret:void 0};else if(x?.trim())if(e.linearApiKey?.trim()){let a=await dh({linearApiKey:e.linearApiKey,webhookUrl:n.webhookUrl,linearTeamId:e.linearTeamId,secret:x,mutatePolicy:q?"verify-only":"setup"});y={mode:a.mode,manualSteps:a.manualSteps,manualCopySecret:"automated"===a.mode?void 0:a.secret},w||(x=a.secret)}else y={mode:"manual-copy",manualSteps:["Add LINEAR_API_KEY in Step 1 before automated Linear webhook setup can run.","Copy the generated webhook secret into Linear when prompted."],manualCopySecret:x};else y={mode:"manual-copy",manualSteps:u.manualSteps,manualCopySecret:void 0};let z=(0,j.Gn)({linearApiKey:e.linearApiKey,githubToken:e.envInput?.GITHUB_DISPATCH_TOKEN??e.derivedGithubDispatchToken});x?.trim()&&z.push(x),e.envInput?.GITHUB_DISPATCH_TOKEN&&z.push(e.envInput.GITHUB_DISPATCH_TOKEN),e.derivedGithubDispatchToken&&z.push(e.derivedGithubDispatchToken);let A=new Map((await (0,di.A3)(e.vercelToken,n.selectedProject.id,k.teamId)).map(a=>[a.key,a])),B=!q&&!!x?.trim(),C=[],D=[];for(let a of n.envWritePlan){if("skip"===a.action||"LINEAR_WEBHOOK_SECRET"===a.key&&!B){D.push(a.key);continue}let b=function(a){let b=a.envInput?.[a.key]?.trim();return b||("HARNESS_TEAM_KEY"===a.key&&a.derivedHarnessTeamKey?.trim()?a.derivedHarnessTeamKey.trim():"GITHUB_DISPATCH_TOKEN"===a.key&&a.derivedGithubDispatchToken?.trim()?a.derivedGithubDispatchToken.trim():"LINEAR_WEBHOOK_SECRET"===a.key&&a.generatedLinearWebhookSecret?.trim()?a.generatedLinearWebhookSecret.trim():a.key in $.vC?$.vC[a.key]:void 0)}({key:a.key,envInput:e.envInput,derivedHarnessTeamKey:e.derivedHarnessTeamKey,derivedGithubDispatchToken:e.derivedGithubDispatchToken,generatedLinearWebhookSecret:x});if(!b?.trim()){D.push(a.key);continue}let c=A.get(a.key);try{await (0,di.wI)(e.vercelToken,{projectId:n.selectedProject.id,teamId:k.teamId,key:a.key,value:b.trim(),existingEnv:c})}catch(a){throw a instanceof di.c9,a}C.push(a.key)}if(B&&!C.includes("LINEAR_WEBHOOK_SECRET")&&x?.trim()){let a=A.get("LINEAR_WEBHOOK_SECRET");await (0,di.wI)(e.vercelToken,{projectId:n.selectedProject.id,teamId:k.teamId,key:"LINEAR_WEBHOOK_SECRET",value:x,existingEnv:a}),C.push("LINEAR_WEBHOOK_SECRET")}let E=await (0,di.A3)(e.vercelToken,n.selectedProject.id,k.teamId),F=(0,di.FR)(E),G=!1;if(e.linearApiKey?.trim()){let a=await c6({linearApiKey:e.linearApiKey,webhookUrl:n.webhookUrl,teamId:e.linearTeamId});G="automated"===y.mode&&!!a.matchingWebhook}let H=(b={projectId:n.selectedProject.id,linearTeamId:e.linearTeamId,productionUrl:n.productionUrl,webhookUrl:n.webhookUrl,envWritePlan:n.envWritePlan,candidateSecretToken:c$(x)},(0,d.createHash)("sha256").update(JSON.stringify({projectId:b.projectId??"",linearTeamId:b.linearTeamId??"",productionUrl:b.productionUrl??"",webhookUrl:b.webhookUrl??"",envWritePlan:(b.envWritePlan??[]).map(a=>({key:a.key,action:a.action,source:a.source})),candidateSecretToken:b.candidateSecretToken??""})).digest("hex").slice(0,16)),I=x?.trim()?await dj({webhookUrl:n.webhookUrl,secret:x}):{passed:!1,result:"error",reason:"missing_candidate_secret",probedAt:new Date().toISOString()},J=I.passed,K=C.length>0&&!J;dz({phase:"signed_probe",actionId:dr.apply.id,verifyOnly:!0===a.verifyOnly,projectId:n.selectedProject.id,projectName:n.selectedProject.name,teamId:k.teamId,fingerprint:n.fingerprint,candidateSecretSource:u.source,hasLocalWebhookSecret:!!(e.verificationLinearWebhookSecret?.trim()||e.envInput?.LINEAR_WEBHOOK_SECRET?.trim()),envWritePlan:n.envWritePlan.map(a=>({key:a.key,action:a.action,source:a.source})),signedProbeResult:I.result,signedProbeReason:I.reason,signedProbeStatusCode:I.statusCode});let L=$.P$.every(a=>"present"===F[a])&&n.endpointReachable&&G&&J&&!K,M={teamId:k.teamId,teamName:k.teamName,projectId:n.selectedProject.id,projectName:n.selectedProject.name,productionUrl:n.productionUrl??"",webhookUrl:n.webhookUrl??"",endpointReachable:n.endpointReachable,envVarPresence:F,linearWebhookVerified:G,signedProbeVerified:J,signedProbe:I,verificationFingerprint:H,deploymentRedeployRequired:K,appliedFingerprint:n.fingerprint,appliedAt:new Date().toISOString(),manualComplete:a.manualComplete};await cJ({vercel:M},a.cwd);let N=JSON.stringify({actionId:dr.apply.id,writtenEnvKeys:C,skippedEnvKeys:D,linearWebhookSetup:{mode:y.mode,manualSteps:y.manualSteps},signedProbeVerified:J,verified:L});for(let a of z)if(N.includes(a))throw Error("Vercel bridge apply result leaked secret material");let O={actionId:dr.apply.id,status:"applied",projectId:n.selectedProject.id,projectName:n.selectedProject.name,team:k.team,project:l.projectResult,writtenEnvKeys:C,skippedEnvKeys:D,linearWebhookSetup:y,signedProbeVerified:J,signedProbeReason:I.reason,signedProbe:I,deploymentRedeployRequired:K,verificationRetry:q,candidateSecretSource:u.source,verified:L,fingerprint:n.fingerprint,permission:dr.apply.permission,envVarsWritten:C.length>0,productionRedeployTriggered:!1,productionRedeployStatus:"not_triggered"};return a.verifyOnly||q||!K||O.verified?(dz({phase:"apply_complete",actionId:dr.apply.id,verifyOnly:!0===a.verifyOnly,projectId:n.selectedProject.id,projectName:n.selectedProject.name,teamId:k.teamId,fingerprint:n.fingerprint,signedProbeResult:I.result,signedProbeReason:I.reason,pollStatus:O.verified?"verified":void 0}),O):(dz({phase:"redeploy_trigger",actionId:dr.apply.id,projectId:n.selectedProject.id,projectName:n.selectedProject.name,teamId:k.teamId,fingerprint:n.fingerprint,candidateSecretSource:u.source,signedProbeResult:I.result,signedProbeReason:I.reason}),dD({applyInput:a,baseResult:O,signedProbe:I,vercelToken:e.vercelToken,projectId:n.selectedProject.id,projectName:n.selectedProject.name,teamId:k.teamId,webhookUrl:n.webhookUrl??"",fingerprint:n.fingerprint,fingerprintInputs:dt({teamId:k.teamId,teamMode:m.team?.mode,teamSlug:m.team?.teamSlug,projectId:n.selectedProject.id,projectMode:m.project?.mode,projectName:m.project?.projectName,envWritePlan:n.envWritePlan,willGenerateLinearWebhookSecret:m.willGenerateLinearWebhookSecret??!m.envInput?.LINEAR_WEBHOOK_SECRET?.trim(),linearWebhookSecretFromEnv:m.envInput?.LINEAR_WEBHOOK_SECRET,githubDispatchTokenFromEnv:m.envInput?.GITHUB_DISPATCH_TOKEN,derivedGithubDispatchToken:m.derivedGithubDispatchToken,harnessTeamKey:m.envInput?.HARNESS_TEAM_KEY,derivedHarnessTeamKey:m.derivedHarnessTeamKey,vercelToken:e.vercelToken}),priorSelection:M}))}var dF=c(39058);async function dG(a){let b=a.githubToken?.trim();if(!b)return{eligible:!1,source:"manual-required",message:"Add GITHUB_TOKEN in Step 1 or provide a dispatch token manually in Step 3."};let c=await (0,U.z8)({cwd:a.cwd});if(!c.resolved||!c.repo)return{eligible:!1,source:"manual-required",message:"Could not resolve the harness dispatch repository. Set GITHUB_DISPATCH_REPOSITORY or verify git remote origin."};let[d,e]=c.repo.split("/");if(!d||!e)return{eligible:!1,source:"manual-required",repository:c.repo,message:"Harness dispatch repository slug is invalid."};try{await (0,dF._u)(b);let a=new an.jh({token:b}),f=await a.getRepository(d,e);if(f.permissions?.push!==!0&&f.permissions?.admin!==!0&&f.permissions?.maintain!==!0)return{eligible:!1,source:"manual-required",repository:c.repo,message:`Saved GITHUB_TOKEN cannot write repository contents for ${c.repo}. repository_dispatch requires Contents write access.`};return{eligible:!0,source:"saved-github-token",repository:c.repo,message:`Saved GITHUB_TOKEN can dispatch to ${c.repo}.`}}catch(b){let a=b instanceof an.OS?`GitHub rejected dispatch token eligibility check (${b.status}).`:b instanceof Error?b.message:"GitHub dispatch token eligibility check failed.";return{eligible:!1,source:"manual-required",repository:c.repo,message:a}}}function dH(a){return{message:`Cannot resume redeploy verification because ${a} is missing from saved setup.`,nextSteps:["Return to Step 1 and save the required token in .env.local.","Then use Apply Vercel Settings again to restart verification."]}}async function dI(a){let b=a.state.vercel;if(!b)return{ok:!1,setupBlocked:dH("saved Vercel selection")};let c=await (0,dF.tl)({cwd:a.cwd,key:"VERCEL_TOKEN"})??"";if(!c.trim())return{ok:!1,setupBlocked:dH("VERCEL_TOKEN")};let d=await (0,dF.tl)({cwd:a.cwd,key:"LINEAR_API_KEY"}),e=await (0,dF.tl)({cwd:a.cwd,key:"GITHUB_TOKEN"}),f=await dG({githubToken:e,cwd:a.cwd}),g=a.pending.teamId??b.teamId,h=a.pending.projectId,i=a.pending.projectName,j=await (0,dF.tl)({cwd:a.cwd,key:"LINEAR_WEBHOOK_SECRET"}),k="generated"===a.pending.candidateSecretSource||"unreadable"===a.pending.candidateSecretSource||!!j?.trim();return{ok:!0,plan:dv({vercelToken:c,linearApiKey:d,teamId:g,projectId:h,projectName:i,preferredProductionDeploymentId:a.pending.newDeploymentId,team:{mode:"existing",teamId:g??""},project:{mode:"existing",projectId:h,projectName:i},linearTeamId:a.state.linear?.teamId,derivedHarnessTeamKey:a.state.linear?.teamKey,derivedGithubDispatchToken:f.eligible&&e?e:void 0,willGenerateLinearWebhookSecret:!!k||!j?.trim(),verificationLinearWebhookSecret:j,preserveGeneratedWebhookSecretFingerprint:k}),vercelToken:c}}async function dJ(a){let b=await dI(a);if(!b.ok)return b;let c=await dw(b.plan);return c.fingerprint!==a.pending.fingerprint?(dz({phase:"poll_reconstruct",actionId:a.pending.actionId,expectedFingerprint:a.pending.fingerprint,reconstructedFingerprint:c.fingerprint,fingerprintMatch:!1,projectId:a.pending.projectId,projectName:a.pending.projectName,teamId:a.pending.teamId}),{ok:!1,setupBlocked:{message:"Persisted Step 3 setup context no longer matches the in-progress redeploy verification.",nextSteps:["Use Apply Vercel Settings again to regenerate preview and restart verification.","If the problem persists, confirm team and project selections match the original apply."]}}):{ok:!0,plan:b.plan,vercelToken:b.vercelToken}}let dK=new Set,dL=new Set(["failed","timeout","no_source_deployment","verify_failed","verified"]);function dM(a){let b=a.pending??a.vercel.redeployVerification,c=a.retryApply,d=!!b,e=b?function(a){switch(a){case"triggered":return"triggered";case"building":return"building";case"ready":case"verified":case"verify_failed":return"ready";case"failed":return"failed";case"timeout":return"timeout";case"no_source_deployment":return"no_source_deployment";default:return"not_triggered"}}(b.status):"not_triggered",f=a.setupBlocked??(b?.blockedMessage?{message:b.blockedMessage,nextSteps:b.blockedNextSteps??[]}:void 0),h=a.vercel.signedProbe,i=c?.signedProbe,j=c?.signedProbeVerified??a.vercel.signedProbeVerified??!1;return{actionId:b?.actionId??"vercel-bridge-apply",status:"applied",projectId:a.vercel.projectId,projectName:a.vercel.projectName,writtenEnvKeys:a.pending?.writtenEnvKeys??[],skippedEnvKeys:a.pending?.skippedEnvKeys??[],linearWebhookSetup:c?.linearWebhookSetup??{mode:"automated",manualSteps:[]},signedProbeVerified:j,signedProbeReason:c?.signedProbeReason??h?.reason,signedProbe:i??h,deploymentRedeployRequired:a.vercel.deploymentRedeployRequired??!1,verificationRetry:c?.verificationRetry,verified:c?.verified??j,fingerprint:b?.fingerprint??a.vercel.appliedFingerprint??"",permission:c?.permission??g.P.remoteSecretWrite,envVarsWritten:!0,signedProbeInitialResult:h,signedProbeRetryResult:i,productionRedeployTriggered:d,productionRedeployStatus:e,setupBlocked:f,setupPending:!!b&&!dL.has(b.status),pollActionId:b?.actionId,orchestrationSteps:function(a){let b=[{phase:"writing_env_vars",status:"completed",message:"Writing Vercel env vars…"}];return a.pending&&("no_source_deployment"===a.pending.status?b.push({phase:"redeploying_production",status:"failed",message:a.pending.message??"No READY production deployment was found to redeploy after env var changes."}):(b.push({phase:"redeploying_production",status:"failed"===a.pending.status||"timeout"===a.pending.status?"failed":("verified"===a.pending.status||"ready"===a.pending.status||a.pending.status,"completed"),message:"building"===a.pending.status||"triggered"===a.pending.status?"Waiting for Vercel deployment READY…":"Redeploying production so new env vars take effect…"}),("verify_failed"===a.pending.status||"verified"===a.pending.status||a.apply?.verificationRetry)&&b.push({phase:"verifying_webhook",status:"verified"===a.pending.status||a.apply?.signedProbeVerified?"completed":"failed",message:"Retrying signed webhook verification…"}))),b}({pending:b,apply:c})}}async function dN(a){var b,c;let d=(b=a.pending.actionId,c=a.cwd,`${c??"default"}:${b}`);if(dK.has(d))return null;dK.add(d);let e=await cH(a.cwd),f=e?.vercel?.redeployVerification;if(!f||f.actionId!==a.pending.actionId||f.verifyAttempted)return dK.delete(d),null;let g={...f,verifyAttempted:!0,updatedAt:new Date().toISOString(),status:"ready"};return await cJ({vercel:{...e.vercel,redeployVerification:g}},a.cwd),g}async function dO(a){let b=await cH(a.cwd);if(!b?.vercel)return;let c=new Date().toISOString(),d={...a.pending,status:a.status,updatedAt:c,completedAt:c,message:a.message??a.pending.message,blockedMessage:a.setupBlocked?.message,blockedNextSteps:a.setupBlocked?.nextSteps};await cJ({vercel:{...b.vercel,...a.vercelPatch,redeployVerification:a.clearPending?void 0:d}},a.cwd)}async function dP(a){let b=await cH(a.cwd),c=b?.vercel,d=c?.redeployVerification;if(!c||!d)throw Error("No pending Vercel redeploy verification is in progress.");if(a.actionId&&d.actionId!==a.actionId)throw Error("Pending Vercel redeploy verification action was not found.");if(dL.has(d.status))return dz({phase:"poll",actionId:d.actionId,pollStatus:d.status,verifyAttempted:d.verifyAttempted,projectId:d.projectId,projectName:d.projectName,teamId:d.teamId,fingerprint:d.fingerprint,setupBlockedMessage:d.blockedMessage}),dM({vercel:c,pending:d,setupBlocked:d.blockedMessage?{message:d.blockedMessage,nextSteps:d.blockedNextSteps??[]}:void 0});if(!d.newDeploymentId)throw Error("Pending Vercel redeploy verification is missing deployment id.");let e=await dJ({cwd:a.cwd,state:b,pending:d});if(!e.ok){dz({phase:"blocked",actionId:d.actionId,pollStatus:"verify_failed",setupBlockedMessage:e.setupBlocked.message,setupBlockedNextSteps:e.setupBlocked.nextSteps,projectId:d.projectId,fingerprint:d.fingerprint});let b={...d,status:"verify_failed",updatedAt:new Date().toISOString(),completedAt:new Date().toISOString(),message:e.setupBlocked.message,blockedMessage:e.setupBlocked.message,blockedNextSteps:e.setupBlocked.nextSteps};return await cJ({vercel:{...c,redeployVerification:b}},a.cwd),dM({vercel:{...c,redeployVerification:b},pending:b,setupBlocked:e.setupBlocked})}let f=await dn({vercelToken:e.vercelToken,newDeploymentId:d.newDeploymentId,teamId:d.teamId,sourceDeploymentId:d.sourceDeploymentId,deadlineAt:d.deadlineAt});if("failed"===f.status||"timeout"===f.status){var g,h;let b={message:(g=f.status,h=f.message,"timeout"===g?h??"Automatic production redeploy timed out before READY. Redeploy production in Vercel, then use Retry verification.":"failed"===g?h??"Automatic production redeploy failed. Redeploy production in Vercel, then use Retry verification.":"Redeploy production in Vercel, then use Retry verification (this will not rotate secrets or rewrite env vars)."),nextSteps:["Redeploy production in Vercel manually if needed.","Use Retry verification without rewriting env vars or rotating secrets."]};dz({phase:"blocked",actionId:d.actionId,pollStatus:f.status,setupBlockedMessage:b.message,setupBlockedNextSteps:b.nextSteps,projectId:d.projectId,fingerprint:d.fingerprint});let e={...d,status:f.status,updatedAt:new Date().toISOString(),completedAt:new Date().toISOString(),message:f.message,blockedMessage:b.message,blockedNextSteps:b.nextSteps};return await cJ({vercel:{...c,redeployVerification:e}},a.cwd),dM({vercel:{...c,redeployVerification:e},pending:e,setupBlocked:b})}if("building"===f.status||"triggered"===f.status){dz({phase:"poll",actionId:d.actionId,pollStatus:f.status,verifyAttempted:d.verifyAttempted,projectId:d.projectId,fingerprint:d.fingerprint});let b={...d,status:"building",updatedAt:new Date().toISOString(),message:f.message};return await cJ({vercel:{...c,redeployVerification:b}},a.cwd),dM({vercel:{...c,redeployVerification:b},pending:b})}if("ready"!==f.status||d.verifyAttempted)return dM({vercel:c,pending:d});let i=await dN({cwd:a.cwd,pending:d});if(!i){let b=await cH(a.cwd);return dM({vercel:b.vercel,pending:b.vercel.redeployVerification})}dz({phase:"verify_retry",actionId:i.actionId,pollStatus:"ready",verifyAttempted:!0,verifyOnly:!0,projectId:i.projectId,fingerprint:i.fingerprint,candidateSecretSource:i.candidateSecretSource});let j=await dE({plan:e.plan,confirmed:!0,fingerprint:d.fingerprint,verifyOnly:!0,cwd:a.cwd});if(j.signedProbeVerified&&j.verified){dz({phase:"signed_probe",actionId:i.actionId,pollStatus:"verified",signedProbeResult:j.signedProbe?.result,signedProbeReason:j.signedProbeReason,signedProbeStatusCode:j.signedProbe?.statusCode,fingerprint:i.fingerprint});let b=await cH(a.cwd);return await dO({cwd:a.cwd,pending:i,status:"verified",message:"Signed webhook verification passed after production redeploy.",clearPending:!0,vercelPatch:{productionUrl:b?.vercel?.productionUrl,webhookUrl:b?.vercel?.webhookUrl,signedProbeVerified:!0,signedProbe:j.signedProbe,deploymentRedeployRequired:!1}}),dM({vercel:(await cH(a.cwd)).vercel,pending:{...i,status:"verified",completedAt:new Date().toISOString()},retryApply:j})}let k=function(a){let b=a?.retryReason?.trim()?` (${a.retryReason})`:"";return{message:`Production redeploy completed, but signed webhook delivery verification still failed${b}.`,nextSteps:["Use Retry verification without rewriting env vars or rotating secrets.","If verification still fails, confirm the Linear webhook signing secret matches Vercel production."]}}({retryReason:j.signedProbeReason});dz({phase:"blocked",actionId:i.actionId,pollStatus:"verify_failed",signedProbeResult:j.signedProbe?.result,signedProbeReason:j.signedProbeReason,signedProbeStatusCode:j.signedProbe?.statusCode,setupBlockedMessage:k.message,setupBlockedNextSteps:k.nextSteps,fingerprint:i.fingerprint});let l=await cH(a.cwd);await dO({cwd:a.cwd,pending:i,status:"verify_failed",message:k.message,setupBlocked:k,vercelPatch:{productionUrl:l?.vercel?.productionUrl,webhookUrl:l?.vercel?.webhookUrl,signedProbeVerified:!1,signedProbe:j.signedProbe,deploymentRedeployRequired:!0}});let m=await cH(a.cwd);return dM({vercel:m.vercel,pending:m.vercel.redeployVerification,retryApply:{...j,verificationRetry:!0},setupBlocked:k})}async function dQ(a){let b=(0,k.ym)(a),c=await (0,h.Hn)(b),d=await cH(a),e=d?.vercel,f=(0,$.s5)({projectId:e?.projectId,productionUrl:e?.productionUrl,webhookUrl:e?.webhookUrl,endpointReachable:e?.endpointReachable,requiredEnvPresence:e?.envVarPresence,linearWebhookVerified:e?.linearWebhookVerified,signedProbeVerified:e?.signedProbeVerified,deploymentRedeployRequired:e?.deploymentRedeployRequired,manualComplete:e?.manualComplete});return{controlPlane:d,vercelTokenConfigured:!!c?.presence.VERCEL_TOKEN,linearApiKeyConfigured:!!c?.presence.LINEAR_API_KEY,readiness:f,linearTeamKey:d?.linear?.teamKey}}function dR(a){return a.map(a=>({id:a.id,name:a.name,accountId:a.accountId}))}function dS(a,b){return b&&a.some(a=>a.id===b)?b:1===a.length?a[0]?.id:void 0}async function dT(a){let b=await cH(a.cwd),c=b?.linear?.teamKey,d=await dG({githubToken:a.githubToken,cwd:a.cwd}),e={teamCreate:!0,projectCreate:!0};if(!a.vercelToken.trim())return{scopes:[],projects:[],harnessTeamKey:c,githubDispatch:d,capabilities:e,loadError:"VERCEL_TOKEN is required to load Vercel bridge options."};try{var f;let g=(f=await (0,di.dk)(a.vercelToken),[{id:"",label:"Personal account (no team)",kind:"personal"},...f.map(a=>({id:a.id,label:`${a.name} (${a.slug})`,kind:"team"}))]),h=b?.vercel?.teamId??"",i=void 0!==a.teamId?a.teamId??"":h,j=g.some(a=>a.id===i)?i:dS(g,h),k=j&&j.length>0?j:void 0,l=dR(await (0,di.Eb)(a.vercelToken,k)),m=dS(l,b?.vercel?.projectId);return{scopes:g,projects:l,selectedScopeId:j,selectedProjectId:m,harnessTeamKey:c,githubDispatch:d,capabilities:e}}catch(a){return{scopes:[],projects:[],harnessTeamKey:c,githubDispatch:d,capabilities:e,loadError:a instanceof Error?a.message:"Failed to load Vercel bridge options."}}}async function dU(a){return dR(await (0,di.Eb)(a.vercelToken,a.teamId?.trim()?a.teamId:void 0))}function dV(){return(0,e.Vq)()}async function dW(){let a=function(a=process.env){return!function(a=process.env){return"true"===a.VITEST||"test"===a.NODE_ENV}()||a.HARNESS_VITEST_REMOTE_SETUP_MOCK,null}();if(a)return a;let b=await ce({cwd:dV()});if(cf(b))return aV(b)}async function dX(a){let b=dV(),c=function(a){let b=[];return a.linearApiKey?.trim()&&b.push("LINEAR_API_KEY"),a.cursorApiKey?.trim()&&b.push("CURSOR_API_KEY"),a.harnessGithubToken?.trim()&&b.push("HARNESS_GITHUB_TOKEN"),{linearApiKey:a.linearApiKey,cursorApiKey:a.cursorApiKey,githubToken:a.harnessGithubToken,explicitCredentialReplacements:b.length>0?b:void 0}}(a),d=await ax({cwd:b,payload:a});return{linearApiKey:c.linearApiKey?.trim()||d.linearApiKey,cursorApiKey:c.cursorApiKey?.trim()||d.cursorApiKey,githubToken:c.githubToken?.trim()||d.githubToken,explicitCredentialReplacements:c.explicitCredentialReplacements,credentialInputSources:d.credentialInputSources}}async function dY(){return al({cwd:dV()})}async function dZ(){return ck({cwd:dV(),provider:await dW()})}async function d$(){let a=dV(),b=(0,k.ym)(a),c=await (0,h.Hn)(b),d=await G({cwd:a}),e=await (0,U.vE)(a),f=e?(0,U.e8)(e)??void 0:void 0;return{env:{harnessConfigPath:c?.values.HARNESS_CONFIG_PATH??".harness/config.local.json",githubDispatchRepository:c?.values.GITHUB_DISPATCH_REPOSITORY??"",suggestedHarnessDispatchRepo:f,secretPresence:{LINEAR_API_KEY:c?.presence.LINEAR_API_KEY??!1,CURSOR_API_KEY:c?.presence.CURSOR_API_KEY??!1,GITHUB_TOKEN:c?.presence.GITHUB_TOKEN??!1,VERCEL_TOKEN:c?.presence.VERCEL_TOKEN??!1}},config:d}}async function d_(a){return R({cwd:dV(),payload:a})}async function d0(a){let b=dV();return{apply:await S({cwd:b,payload:a.payload,confirmed:a.confirmed,fingerprint:a.fingerprint}),summary:await al({cwd:b})}}async function d1(a){let b=await dX(a),c=(0,j.Gn)(b);return function(a,b=[]){return{...a,manualInstructions:a.manualInstructions.map(a=>b8(a,b)),validationError:a.validationError?b8(a.validationError,b):void 0}}(await ca({cwd:dV(),operatorInput:b,manualHarnessDispatchRepo:a.manualHarnessDispatchRepo,provider:await dW()}),c)}async function d2(a){let b=dV(),c=await dX(a.payload),d=await cb({cwd:b,operatorInput:c,manualHarnessDispatchRepo:a.payload.manualHarnessDispatchRepo,confirmed:a.confirmed,fingerprint:a.fingerprint,provider:await dW()}),[e,f]=await Promise.all([dZ(),dY()]),g=await cK(b,f),h=function(a){var b;let c=a.remoteSummary,d=c?(0,V.fm)(c.harnessSecretStatuses):void 0;return{path:"automatic",applyFingerprint:a.applyResult.fingerprint,configStateFingerprint:JSON.stringify(function(a){let b=a.setupSummary.configSummary;return{configResolved:a.setupSummary.overview.configResolved,operatorConfigResolved:a.setupSummary.overview.operatorConfigResolved,linearTeamKeyFromConfig:a.controlPlaneContext?.linearTeamKeyFromConfig??null,linearTeamKeyFromControlPlane:a.controlPlaneContext?.state?.linear?.teamKey??null,repoIds:(b?.repos??[]).map(a=>a.id).sort((a,b)=>a.localeCompare(b)),repoTargets:(b?.repos??[]).map(a=>({id:a.id,targetRepo:a.targetRepo})).sort((a,b)=>a.id.localeCompare(b.id)),allowedTargetRepos:[...b?.allowedTargetRepos??[]].sort((a,b)=>a.localeCompare(b))}}({setupSummary:a.setupSummary,controlPlaneContext:a.controlPlaneContext})),harnessConfigJsonB64Written:!!(b=a.applyResult)&&b.writtenSecrets.some(a=>"HARNESS_CONFIG_JSON_B64"===a.name&&("created"===a.status||"updated"===a.status)),harnessDispatchRepo:c?.harnessDispatchRepo??a.applyResult.harnessDispatchRepo,harnessDispatchRepoResolved:c?.harnessDispatchRepoResolved,harnessDispatchRepoSource:c?.harnessDispatchRepoSource,harnessRepoAccess:c?.harnessRepoAccess,postApplyVerificationReady:c?function(a){let b=(0,V.fm)(a.harnessSecretStatuses);return a.harnessDispatchRepoResolved&&"denied"!==a.harnessRepoAccess&&b.allPresent}(c):void 0,secretPresence:d?{allPresent:d.allPresent,missing:d.missing,unknown:d.unknown}:void 0}}({applyResult:d,setupSummary:f,controlPlaneContext:g,remoteSummary:e});return{apply:d,summary:e,evidence:h}}async function d3(a){return cc({cwd:dV(),repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,manualHarnessDispatchRepo:a.manualHarnessDispatchRepo,provider:await dW()})}async function d4(a){let b,c=await dW(),d=await cd({cwd:dV(),repoConfigId:a.payload.repoConfigId,targetRepo:a.payload.targetRepo,productionBranch:a.payload.productionBranch,manualHarnessDispatchRepo:a.payload.manualHarnessDispatchRepo,confirmed:a.confirmed,fingerprint:a.fingerprint,provider:c});return c&&"already-installed"!==d.outcome&&("pr-created"===d.outcome||"pr-updated"===d.outcome||"branch-updated"===d.outcome)&&(b=await d6({provider:c,input:{repoConfigId:a.payload.repoConfigId,targetRepo:a.payload.targetRepo,productionBranch:a.payload.productionBranch,manualHarnessDispatchRepo:a.payload.manualHarnessDispatchRepo,prUrl:d.prUrl,branchName:d.branchName}})),{apply:d,summary:await dZ(),finalization:b}}async function d5(a){let b=await dW();if(!b)throw Error("GitHub token is required for target workflow finalization");return{finalization:await d6({provider:b,input:{repoConfigId:a.repoConfigId,targetRepo:a.targetRepo,productionBranch:a.productionBranch,manualHarnessDispatchRepo:a.manualHarnessDispatchRepo,prUrl:a.prUrl,branchName:a.branchName}}),summary:await dZ()}}async function d6(a){if(a.provider instanceof aN)return a.provider.advanceTargetWorkflowFinalization(a.input);let b=dV(),c=await ce({cwd:b});if(!cf(c))throw Error("GitHub token is required for target workflow finalization");let d=new an.jh({token:c});return cE({cwd:b,input:a.input,provider:a.provider,client:d})}async function d7(a){return(0,dF.tl)({cwd:a,key:"LINEAR_API_KEY"})}async function d8(a){return(0,dF.tl)({cwd:a,key:"VERCEL_TOKEN"})}async function d9(a,b){let c=b.vercelToken??await d8(a)??"",d=b.linearApiKey??await d7(a),e=await (0,dF.tl)({cwd:a,key:"GITHUB_TOKEN"}),f=await cH(a),g=await dG({githubToken:e,cwd:a}),h=await (0,dF.tl)({cwd:a,key:"LINEAR_WEBHOOK_SECRET"}),i=!!b.envInput?.LINEAR_WEBHOOK_SECRET?.trim(),j=!!h?.trim(),k=!i&&j;return{...b,vercelToken:c,linearApiKey:d,linearTeamId:b.linearTeamId??f?.linear?.teamId,derivedHarnessTeamKey:b.derivedHarnessTeamKey??f?.linear?.teamKey,derivedGithubDispatchToken:b.envInput?.GITHUB_DISPATCH_TOKEN?.trim()||!g.eligible?void 0:e,willGenerateLinearWebhookSecret:!!k||(b.willGenerateLinearWebhookSecret??!i),verificationLinearWebhookSecret:b.verificationLinearWebhookSecret??h,preserveGeneratedWebhookSecretFingerprint:b.preserveGeneratedWebhookSecretFingerprint??k}}async function ea(){return da(dV())}async function eb(){let a=dV(),b=await d7(a);if(!b?.trim())throw Error("LINEAR_API_KEY is required to load Linear workspace options.");let c=cN(b),[d,e]=await Promise.all([cQ(c),cR(c)]);return{teams:d,projects:e}}async function ec(){return dQ(dV())}async function ed(a){let b=dV(),c=a.linearApiKey??await d7(b)??"";return c5({...a,linearApiKey:c})}async function ee(a){let b=dV(),c=a.plan.linearApiKey??await d7(b)??"";return{apply:await c9({plan:{...a.plan,linearApiKey:c},confirmed:a.confirmed,fingerprint:a.fingerprint,cwd:b}),summary:await da(b)}}async function ef(a){let b=dV();return dT({vercelToken:await d8(b)??"",githubToken:await (0,dF.tl)({cwd:b,key:"GITHUB_TOKEN"}),cwd:b,teamId:a?.teamId})}async function eg(a){let b=dV();return dU({vercelToken:await d8(b)??"",teamId:a})}async function eh(a){let b=dV();return dw(await d9(b,a))}async function ei(a){let b=dV(),c=await d9(b,a.plan);return{apply:await dE({plan:c,confirmed:a.confirmed,fingerprint:a.fingerprint,manualComplete:a.manualComplete,verifyOnly:a.verifyOnly,cwd:b}),summary:await dQ(b)}}async function ej(a){let b=dV();return{apply:await dP({actionId:a.actionId,cwd:b}),summary:await dQ(b)}}async function ek(){let a=function(a=process.env){return!function(a=process.env){return"true"===a.VITEST||"test"===a.NODE_ENV}()||a.HARNESS_VITEST_PROVISIONING_MOCK,null}();if(a)return a;let b=await ce({cwd:dV()});if(cf(b))return new aW({token:b})}async function el(){let a=await ek();return b4({cwd:dV(),provider:a})}async function em(a){let b=await ek();return b?b5({cwd:dV(),provider:b,operationId:a?.operationId}):{state:"token-unavailable",fingerprint:JSON.stringify({action:"preview",tokenUnavailable:!0}),operationId:a?.operationId??(0,d.randomUUID)(),creationPreviewFingerprint:null,resumedFromPending:!1,harnessDispatchRepo:null,authenticatedLogin:null,packageName:"p-dev-harness",packageVersion:"",sourceRepository:"",sourceCommit:"",snapshotContentId:null,snapshotFingerprint:null,templateContentId:null,message:"GITHUB_TOKEN is required before provisioning a harness workspace.",recoverable:!0,willCreateRepository:!1,tokenCapabilities:{tokenType:"unknown",hasRepoScope:!1,hasWorkflowScope:!1,scopeAmbiguous:!0}}}async function en(a){let b=await ek();if(!b)throw Error("GITHUB_TOKEN is required before provisioning a harness workspace.");let c=await b5({cwd:dV(),provider:b,operationId:a.operationId});return{apply:await b6({cwd:dV(),provider:b,confirmed:a.confirmed,fingerprint:a.fingerprint,operationId:a.operationId}),summary:await al({cwd:dV()}),provisioning:c}}async function eo(a){let b=dV(),c=(0,U.e8)(a.harnessDispatchRepo.trim());if(!c)return{status:"failed",repoSlug:a.harnessDispatchRepo.trim(),message:"Enter a valid GitHub repo slug or URL (owner/repo)."};let d=a.githubToken?.trim()||await ce({cwd:b});if(!d)return{status:"failed",repoSlug:c,message:"GITHUB_TOKEN is required to verify harness repo access. Add it in Step 1 first."};let e=aV(d),f=await e.checkHarnessRepoAccess(c);return"available"===f?{status:"connected",repoSlug:c,message:`Connected to ${c}.`,limitation:"This check confirms GitHub access only. Saving still happens when you create or update local setup files."}:"denied"===f?{status:"failed",repoSlug:c,message:`GitHub denied access to ${c}.`,limitation:"Confirm this is the harness repo you intend to use and that your GitHub token has admin or maintain access."}:{status:"unknown",repoSlug:c,message:`Harness repo access for ${c} could not be verified yet.`,limitation:"Retry after saving GITHUB_TOKEN in Step 1."}}async function ep(){return ay({cwd:dV()})}async function eq(a){return P({cwd:dV(),env:a})}async function er(a){let b=dV();return await Q({cwd:b,env:a.env,confirmed:a.confirmed,fingerprint:a.fingerprint}),{summary:await al({cwd:b})}}},7285:(a,b,c)=>{c.d(b,{Au:()=>h,HF:()=>i,ro:()=>j});var d=c(73024),e=c(76760),f=c.n(e),g=c(73136);let h="p-dev-harness";function i(a){let b=f().resolve(f().dirname((0,g.fileURLToPath)(a)));for(;;){let a=f().join(b,"package.json");if((0,d.existsSync)(a))try{if(JSON.parse((0,d.readFileSync)(a,"utf8")).name===h)return b}catch{}let c=f().dirname(b);if(c===b)break;b=c}throw Error(`Could not resolve ${h} package root from ${a}.`)}function j(a){return f().join(a,"workspace-snapshot")}},8334:(a,b,c)=>{c.d(b,{Al:()=>d,Ig:()=>i,Q$:()=>h,bS:()=>e,i2:()=>f,ll:()=>g});let d=1,e="p-dev",f="workspace-snapshot",g="p-dev-workspace-snapshot",h=1,i="weston-uribe/agentic-product-development-harness"},19965:(a,b,c)=>{c.d(b,{vb:()=>o,writeConfigLocal:()=>p});var d=c(51455),e=c(48161),f=c(76760),g=c.n(f),h=c(29281),i=c(12884),j=c(50615),k=c(84998);async function l(a){try{return await (0,d.access)(a),!0}catch{return!1}}async function m(a){let b=await (0,d.mkdtemp)(g().join((0,e.tmpdir)(),"harness-setup-config-")),c=g().join(b,"config.local.json");try{await (0,d.writeFile)(c,a,"utf8"),await (0,h.Z9)(c)}finally{await (0,d.rm)(b,{recursive:!0,force:!0})}}async function n(a){if(!await l(a.configExample))throw Error(`Missing source file: ${a.configExample}`);let b=await (0,d.readFile)(a.configExample,"utf8");return b.endsWith("\n")?b:`${b}
-`}async function o(a){let{paths:b,force:c=!1,mode:e="apply"}=a,f=k.bm,g=await l(b.configLocal);if(g&&!c)return{actionId:"scaffold-config-local",outcome:"skipped",targetPath:b.configLocal,permission:i.P.localFileWrite,reason:"already exists",logMessage:`skipped ${f} (already exists)`};let h=await n(b);return"dry-run"===e?{actionId:"scaffold-config-local",outcome:g?"wouldChange":"preview",targetPath:b.configLocal,content:h,permission:i.P.localFileWrite,reason:g?"would overwrite with --force":"would create",logMessage:g?`would overwrite ${f}`:`would create ${f}`}:(await (0,d.writeFile)(b.configLocal,h,"utf8"),{actionId:"scaffold-config-local",outcome:"changed",targetPath:b.configLocal,content:h,permission:i.P.localFileWrite,reason:g?"overwrote existing file":"created new file",logMessage:`${g?"overwrote":"created"} ${f}`})}async function p(a){let{paths:b,force:c=!1,mode:e="apply"}=a,f=k.bm,g=await l(b.configLocal);if(g&&!c)return{actionId:"write-config-local",outcome:"skipped",targetPath:b.configLocal,permission:i.P.localFileWrite,reason:"already exists",logMessage:`skipped ${f} (already exists)`};let h=function(a){if(a.content)return a.content.endsWith("\n")?a.content:`${a.content}
-`;if(a.input)return(0,j.rb)(a.input);throw Error("writeConfigLocal requires content or structured input")}(a);return(await m(h),"dry-run"===e)?{actionId:"write-config-local",outcome:g?"wouldChange":"preview",targetPath:b.configLocal,content:h,permission:i.P.localFileWrite,reason:g?"would overwrite with --force":"would create",logMessage:g?`would overwrite ${f}`:`would create ${f}`}:(await (0,d.writeFile)(b.configLocal,h,"utf8"),{actionId:"write-config-local",outcome:"changed",targetPath:b.configLocal,content:h,permission:i.P.localFileWrite,reason:g?"overwrote existing file":"created new file",logMessage:`${g?"overwrote":"created"} ${f}`})}},45191:(a,b,c)=>{c.d(b,{Aw:()=>i,bo:()=>f,dV:()=>e.dV,dq:()=>h,lp:()=>g});var d=c(77598),e=c(97631);function f(a){return(0,d.createHash)("sha256").update(a).digest("hex")}function g(a){return[...a].sort((a,b)=>(0,e.XT)(a.path,b.path))}function h(a){let b=g(a),c=(0,d.createHash)("sha256");for(let a of b)c.update(a.path),c.update("\0"),c.update(a.mode),c.update("\0"),c.update(String(a.size)),c.update("\0"),c.update(a.sha256),c.update("\n");return c.digest("hex")}function i(a){return(0,d.createHash)("sha256").update(a.packageVersion).update("\0").update(a.sourceCommit).update("\0").update(a.snapshotSha256).digest("hex")}},50615:(a,b,c)=>{c.d(b,{BR:()=>h,RB:()=>j,rb:()=>i});var d=c(96105),e=c(29281),f=c(71512);let g={eligibleStatuses:{planning:["Ready for Planning"],implementation:["Ready for Build"],handoff:["PR Open"],revision:["Needs Revision"],merge:["Ready to Merge"]},transitionalStatuses:{planningInProgress:"Planning",buildingInProgress:"Building",prOpen:"PR Open",pmReview:"PM Review",blocked:"Blocked",readyForBuild:"Ready for Build",needsRevision:"Needs Revision",revisingInProgress:"Revising",readyToMerge:"Ready to Merge",mergingInProgress:"Merging",mergedToDev:"Merged to Dev",mergedDeployed:"Merged / Deployed"}};function h(a){let b=a.modelId??f.Sk,c=[...new Set(a.repos.map(a=>a.targetRepo))],h=d.k.parse({version:1,agentProvider:{id:"cursor",model:{id:b}},defaultModel:{id:b},linear:{teamKey:a.linearTeamKey??"TEAM",...g},planning:{timeoutSeconds:1800},implementation:{timeoutSeconds:3600,branchPrefix:"cursor"},handoff:{allowPmReviewWithoutPreview:!0,previewRequiredForSuccess:!1},revision:{timeoutSeconds:3600},merge:{mergeMethod:"squash",deleteBranchAfterMerge:!1,allowPendingChecks:!1,allowUnknownChecks:!1,allowNeutralChecks:!0,deploymentRequiredForSuccess:!1,deploymentPollTimeoutSeconds:300,deploymentPollIntervalSeconds:15,checkPollTimeoutSeconds:120},preview:{pollTimeoutSeconds:300,pollIntervalSeconds:15},repos:a.repos.map(a=>({id:a.id,linearProjects:a.linearProjects,linearTeams:a.linearTeams,targetRepo:a.targetRepo,baseBranch:a.baseBranch??"dev",productionBranch:a.productionBranch??"main",previewProvider:a.previewProvider??"vercel",integrationPreviewUrl:a.integrationPreviewUrl,productionUrl:a.productionUrl,integrationSuccessStatus:a.integrationSuccessStatus??"Merged to Dev",productionSuccessStatus:a.productionSuccessStatus??"Merged / Deployed",validation:a.validationCommands?{commands:a.validationCommands}:{commands:["npm run lint","npm run build"]}})),allowedTargetRepos:c});return(0,e.g1)(h),h}function i(a){var b;return b=h(a),`${JSON.stringify(b,null,2)}
-`}function j(){return h({repos:[{id:"target-app",linearProjects:["Example Target App"],targetRepo:"https://github.com/owner/example-target-app",baseBranch:"dev",productionBranch:"main",previewProvider:"vercel",integrationSuccessStatus:"Merged to Dev",productionSuccessStatus:"Merged / Deployed",productionUrl:"https://www.example.com",integrationPreviewUrl:"https://staging.example.com",validationCommands:["npm run lint","npm run build"]}]})}},87509:(a,b,c)=>{c.d(b,{L3:()=>k,b6:()=>i,lw:()=>j});var d=c(76760),e=c.n(d);let f=[".vercel/","runs/","node_modules/","dist/",".next/","packages/p-dev/bin/","packages/p-dev/dist/","packages/p-dev/gui/","packages/p-dev/templates/","packages/p-dev/workspace-snapshot/"],g=[".env",".env.local",".harness/config.local.json",".DS_Store"],h=[/^\.env\..+\.local$/,/^\.harness\/.*\.local\.json$/,/\.tgz$/,/^docs\/releases\/v0\.3\.1-provisioning-evidence\.md$/];function i(a){let b=a.replace(/\\/g,"/").replace(/^\.\//,"");if(!b||b.includes(".."))throw Error(`Invalid snapshot path: ${a}`);return b}function j(a){let b=i(a);if(g.includes(b))return!0;for(let a of f)if(b===a.slice(0,-1)||b.startsWith(a))return!0;for(let a of h)if(a.test(b))return!0;return!1}function k(a,b){let c=i(b),d=e().resolve(a,"files",c),f=e().resolve(a,"files");if(!d.startsWith(`${f}${e().sep}`)&&d!==f)throw Error(`Snapshot output path escapes files root: ${b}`);return d}[...f],[...g],h.map(a=>new RegExp(a))},88414:(a,b,c)=>{c.d(b,{Nk:()=>i,parseWorkspaceSnapshotManifestJson:()=>h});var d=c(8334),e=c(7285),f=c(87509),g=c(45191);function h(a){let b;try{b=JSON.parse(a)}catch{return{ok:!1,reason:"Workspace snapshot manifest JSON is malformed."}}if(!b||"object"!=typeof b)return{ok:!1,reason:"Workspace snapshot manifest JSON is malformed."};let c=b;if(c.schemaVersion!==d.Al)return{ok:!1,reason:`Unsupported workspace snapshot schema version ${String(c.schemaVersion)}.`};if(c.product!==d.bS)return{ok:!1,reason:`Unexpected workspace snapshot product ${String(c.product)}.`};if(c.role!==d.i2)return{ok:!1,reason:`Unexpected workspace snapshot role ${String(c.role)}.`};if(c.packageName!==e.Au)return{ok:!1,reason:`Unexpected workspace snapshot package name ${String(c.packageName)}.`};if("string"!=typeof c.packageVersion||!c.packageVersion.trim())return{ok:!1,reason:"Workspace snapshot manifest is missing packageVersion."};if(c.sourceRepository!==d.Ig)return{ok:!1,reason:`Unexpected workspace snapshot source repository ${String(c.sourceRepository)}.`};if("string"!=typeof c.sourceCommit||!/^[0-9a-f]{40}$/.test(c.sourceCommit))return{ok:!1,reason:"Workspace snapshot manifest is missing a valid sourceCommit."};if("string"!=typeof c.snapshotContentId||!/^[0-9a-f]{64}$/.test(c.snapshotContentId))return{ok:!1,reason:"Workspace snapshot manifest is missing snapshotContentId."};if("string"!=typeof c.snapshotSha256||!/^[0-9a-f]{64}$/.test(c.snapshotSha256))return{ok:!1,reason:"Workspace snapshot manifest is missing snapshotSha256."};if("string"!=typeof c.gitRootTreeSha1||!/^[0-9a-f]{40}$/.test(c.gitRootTreeSha1))return{ok:!1,reason:"Workspace snapshot manifest is missing gitRootTreeSha1."};if("number"!=typeof c.fileCount||!Number.isFinite(c.fileCount))return{ok:!1,reason:"Workspace snapshot manifest is missing fileCount."};if(!c.generation||"object"!=typeof c.generation)return{ok:!1,reason:"Workspace snapshot manifest is missing generation metadata."};let h=c.generation;if(h.format!==d.ll)return{ok:!1,reason:`Unsupported workspace snapshot generation format ${String(h.format)}.`};if(h.version!==d.Q$)return{ok:!1,reason:`Unsupported workspace snapshot generation version ${String(h.version)}.`};if("utf8-bytes"!==h.pathOrdering)return{ok:!1,reason:`Unsupported workspace snapshot path ordering ${String(h.pathOrdering)}.`};if("sha256"!==h.digestAlgorithm)return{ok:!1,reason:`Unsupported workspace snapshot digest algorithm ${String(h.digestAlgorithm)}.`};if(!Array.isArray(c.files))return{ok:!1,reason:"Workspace snapshot manifest is missing files."};let i=[],j=new Set;for(let a of c.files){let b;if(!a||"object"!=typeof a)return{ok:!1,reason:"Workspace snapshot manifest contains an invalid file entry."};if("string"!=typeof a.path||!a.path.trim())return{ok:!1,reason:"Workspace snapshot manifest contains a file without path."};if("file"!==a.type&&"symlink"!==a.type)return{ok:!1,reason:`Unsupported snapshot file type ${String(a.type)}.`};if("string"!=typeof a.mode||!a.mode.trim())return{ok:!1,reason:`Snapshot file ${a.path} is missing mode.`};if("number"!=typeof a.size||!Number.isFinite(a.size))return{ok:!1,reason:`Snapshot file ${a.path} is missing size.`};if("string"!=typeof a.sha256||!/^[0-9a-f]{64}$/.test(a.sha256))return{ok:!1,reason:`Snapshot file ${a.path} is missing sha256.`};if("string"!=typeof a.gitBlobSha1||!/^[0-9a-f]{40}$/.test(a.gitBlobSha1))return{ok:!1,reason:`Snapshot file ${a.path} is missing gitBlobSha1.`};try{b=(0,f.b6)(String(a.path))}catch{return{ok:!1,reason:`Snapshot file path is not canonical: ${String(a.path)}`}}if(b!==a.path)return{ok:!1,reason:`Snapshot file path is not canonical: ${String(a.path)}`};if(j.has(b))return{ok:!1,reason:`Duplicate snapshot path: ${b}`};if(j.add(b),(0,f.lw)(b))return{ok:!1,reason:`Forbidden snapshot path: ${b}`};let c={path:a.path,type:a.type,mode:a.mode,size:a.size,sha256:a.sha256,gitBlobSha1:a.gitBlobSha1};if("file"===c.type&&"100644"!==c.mode&&"100755"!==c.mode)return{ok:!1,reason:`Snapshot file ${c.path} has invalid file mode ${c.mode}.`};if("symlink"===c.type&&"120000"!==c.mode)return{ok:!1,reason:`Snapshot symlink ${c.path} must use mode 120000.`};if(!["100644","100755","120000"].includes(c.mode))return{ok:!1,reason:`Unsupported snapshot mode ${c.mode} for ${c.path}.`};i.push(c)}let k={schemaVersion:d.Al,product:d.bS,role:d.i2,packageName:e.Au,packageVersion:String(c.packageVersion).trim(),sourceRepository:d.Ig,sourceCommit:String(c.sourceCommit),snapshotContentId:String(c.snapshotContentId),snapshotSha256:String(c.snapshotSha256),gitRootTreeSha1:String(c.gitRootTreeSha1),fileCount:c.fileCount,generation:c.generation,files:(0,g.lp)(i)};if(k.fileCount!==k.files.length)return{ok:!1,reason:"Workspace snapshot manifest fileCount does not match files length."};let l=(0,g.dq)(k.files);if(k.snapshotSha256!==l)return{ok:!1,reason:"Workspace snapshot manifest snapshotSha256 does not match curated files."};let m=(0,g.Aw)({packageVersion:k.packageVersion,sourceCommit:k.sourceCommit,snapshotSha256:k.snapshotSha256});if(k.snapshotContentId!==m)return{ok:!1,reason:"Workspace snapshot manifest snapshotContentId does not match digest inputs."};let n=(0,g.dV)(k.files);return k.gitRootTreeSha1!==n?{ok:!1,reason:"Workspace snapshot manifest gitRootTreeSha1 does not match file tree."}:{ok:!0,manifest:k}}function i(a){return JSON.stringify({schemaVersion:a.schemaVersion,product:a.product,role:a.role,packageName:a.packageName,packageVersion:a.packageVersion,sourceRepository:a.sourceRepository,sourceCommit:a.sourceCommit,snapshotContentId:a.snapshotContentId,snapshotSha256:a.snapshotSha256,gitRootTreeSha1:a.gitRootTreeSha1,fileCount:a.fileCount})}},97631:(a,b,c)=>{c.d(b,{XT:()=>e,dV:()=>g,us:()=>f});var d=c(31421);function e(a,b){return Buffer.compare(Buffer.from(a,"utf8"),Buffer.from(b,"utf8"))}function f(a){let b=(0,d.spawnSync)("git",["hash-object","--stdin"],{input:a});if(0!==b.status)throw Error(`git hash-object failed: ${b.stderr?.toString("utf8")||"unknown error"}`);return b.stdout.toString("utf8").trim()}function g(a){let b=new Map;for(let c of a){let a=c.path.split("/"),d=a.pop();if(!d)throw Error(`Invalid snapshot file path: ${c.path}`);let e=a.join("/");b.has(e)||b.set(e,[]),b.get(e).push({name:d,mode:c.mode,sha1:c.gitBlobSha1})}let c=new Set(["",...b.keys()]);for(let a of b.keys()){let b=a.split("/").filter(Boolean);for(let a=0;a<b.length;a+=1)c.add(b.slice(0,a).join("/"))}let f=new Map;for(let a of[...c].sort((a,b)=>b.split("/").filter(Boolean).length-a.split("/").filter(Boolean).length)){let g=b.get(a)??[],h=[];for(let b of c){if(b===a||(b.includes("/")?b.slice(0,b.lastIndexOf("/")):"")!==a)continue;let c=a?b.slice(a.length+1):b;if(c.includes("/"))continue;let d=f.get(b);if(!d)throw Error(`Missing subtree SHA for ${b}`);h.push({mode:"040000",type:"tree",sha:d,name:c})}let i=new Set(h.map(a=>a.name));for(let a of g)i.has(a.name)||h.push({mode:a.mode,type:"blob",sha:a.sha1,name:a.name});f.set(a,function(a){let b=[...a].sort((a,b)=>e(a.name,b.name)),c=[];for(let a of b)c.push(Buffer.from(`${a.mode} ${a.type} ${a.sha}	${a.name}\0`,"utf8"));let f=(0,d.spawnSync)("git",["mktree","-z","--missing"],{input:Buffer.concat(c)});if(0!==f.status)throw Error(`git mktree failed: ${f.stderr?.toString("utf8")||f.stdout?.toString("utf8")||"unknown error"}`);return f.stdout.toString("utf8").trim()}(h))}let g=f.get("");if(!g)throw Error("Snapshot root tree SHA could not be computed.");return g}c(51455),c(48161),c(76760)}};