GitHub REST API compatibility: releases, statuses, deployments, git data, search, files (#19)

* Add tables, events and a topics column for GitHub-compatible extras

Releases and assets, commit statuses, deployments and environments,
reactions and issue events live in each repo's SQLite. Topics live on
the D1 repos row (migration 0003). New event types: release, status,
deployment, deployment_status and repository_dispatch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Add repo modules for releases, statuses, deployments, git data and search

Release notes generation, zip and tar.gz archives, issue and repository
search query parsing, labels, reactions, issue events, and the git data
API (blobs, trees, commits, tags and contents writes).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Wire releases, statuses and environments into RepoDO, PRs and jobs

Commit statuses count as checks for mergeability, required checks and
the merge queue. Issue updates record timeline events. Jobs with an
environment create deployments and get the environment's secrets and
variables. Webhooks deliver the new events.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Make the REST API GitHub-compatible

GitHub JSON shapes (node_id, url, html_url, user objects, label
objects), Link pagination and GitHub error bodies across /api/v3.
New routes: releases and asset uploads and downloads, commit statuses,
check runs and suites, the git data API, issue and PR sub-resources,
reactions, issue events and timelines, deployments and environments,
search, topics, dispatches, run attempts and logs, archives and
rate_limit. Diffinery-only fields stay for the CLI, MCP and web UI.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Add MCP tools for releases

list_releases, get_release, create_release, update_release,
upload_release_asset (up to 25 MB) and generate_release_notes, with the
same permission checks as the REST API.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Add release pages and show commit statuses in the web UI

A releases list, a page per tag with assets and source archives, and a
new/edit form with a Kumo tag picker, target branch, pre-release and
latest checkboxes and file uploads. The repository home links the
latest release and shows topics. PR merge boxes, PR checks tabs and
commit pages list commit statuses with their target URLs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Use numeric comment and review ids in GitHub JSON

Comments and reviews keep their internal ids, but the REST API now
reports the row id as `id` (and as pull_request_review_id and
in_reply_to_id), like GitHub. Routes accept either form, so the CLI and
existing links keep working. Raw contents and blobs come back as
text/plain, which Octokit reads as text.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Test the GitHub-compatible API with Octokit, plus unit tests

An end-to-end test drives the real @octokit/rest client through
contents, the git data API, commit statuses with required checks,
pull request review comments, releases with asset uploads and
downloads, the release web form, archives, issue labels, reactions,
locks, events and pagination, search, topics, deployments and
environments, dispatches and variables. Unit tests cover release
notes, search query parsing and the zip and tar writers.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Document the GitHub-compatible REST API

List what works, how workflows react to releases, dispatches and
environments, and what isn't supported yet (GraphQL, sealed-box
secrets, environment protection rules, forks, team reviewers, code
and commit search).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Renumber the topics migration to 0004

0003 is the container registry's migration on main.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Renumber the topics migration to 0005

0004 is the email migration on main.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Keep the topics migration at 0004

The lead reserved 0005 for another team. Wrangler orders migrations by file
name and records them by name, so 0004_repo_topics.sql applies after
0004_email.sql.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Limit search to repositories the caller can read, and bound its cost

Search candidates now go through callerFor, pending and disabled accounts and
agents of inactive owners see nothing, and disabled accounts lose their
sessions. Each repository returns only numbers and sort keys; the page is
fetched afterwards. Queries are capped at 256 characters, 50 repositories
and 2,000 comments for in:comments.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Decide required checks by their trusted reporter

A required check fails if any counted report fails. Diffinery Actions is the
authority for its check names, branch protection can bind a check to a
reporter with requiredCheckSources, and statuses or check runs from agents
never count. Only the creator of a check run can update it, and Actions
check runs can't be changed over REST. Check runs get numeric ids.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Keep environments and their secrets away from agents and pull requests

Only human admins change or delete environments and branch policies.
Environment secrets never go to refs/pull runs, and go to agent runs only
when the environment allows protected branches only. The first secret
limits an environment without rules to protected branches, and tags pushed
by agents never match tag patterns.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Refuse unsafe tree names and bound tree walks, archives and their memory

Every write path refuses ., .., .git in any spelling (.GIT, .git., git~1,
HFS-ignorable characters), backslashes and NUL. Archives and languages walk
at most 100,000 entries, counting reused subtrees each time. Archives stream
through the compressor into R2 (multipart for big ones), hold at most 24 MB
of files, refuse more than 65,535 zip entries with a clear error, and each
repository builds at most 20 per hour.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Bound upload bodies before buffering them

Asset uploads without a Content-Length are counted as they stream to R2 and
stop at 100 MB, the real Workers request limit. Web forms check
Content-Length against a per-route cap before parsing (10 MB, or the release
form's 101 MB) and refuse bodies without one. Form and MCP uploads stream
instead of copying.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Harden release asset imports and clean up orphaned asset bytes

Imports copy staged objects from repos/<id>/import/ instead of adopting any
key, download only from GitHub's hosts (or IMPORT_GHE_HOST), drop every
credential header when a redirect leaves the original host, and stream with
a byte limit. Asset deletes only touch keys under the repository's release
prefix, and abandoned uploads lose their bytes. Draft release events no
longer reach readers' live pages.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Respect locks in review comments and reactions; restrict review dismissal

Locked conversations refuse review comments, replies and reactions from
people without triage access. Dismissing a review takes maintain access,
and never the pull request's author or an agent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Make archived repositories read-only and fix GitHub API details

Compat routes refuse every change to an archived repository. Path pieces
are decoded once (a label named 50% works) and malformed escapes return 400.
User and repository ids are numbers. private: false makes a repository
public. A deployment without required_contexts needs every context to pass.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Test the security fixes end to end and document them

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

* Number the topics migration 0007 so it doesn't share 0004 with email

0005 and 0006 are taken by the avatars and importer branches.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AizKXSsengXZRegJxRATkL

---------

Co-authored-by: Claude <noreply@anthropic.com>

Canberk Demirci authored 13 days ago· GitHub committed 13 days agosigned1 parent ec41a5acommit 7800b99ac577ad8ca3929c1717105045b38ab185Browse files

61 files changed+8715−245

Files (61)

README.md+102−1
apps/diffinery/migrations/0007_repo_topics.sql+2−0
apps/diffinery/package.json+4−2
apps/diffinery/src/app.ts+14−1
apps/diffinery/src/auth/sessions.ts+1−1
apps/diffinery/src/env.ts+2−0
apps/diffinery/src/http/api.ts+358−189
apps/diffinery/src/http/common.ts+3−2
apps/diffinery/src/http/compat.ts+40−0
apps/diffinery/src/http/deployments.ts+239−0
apps/diffinery/src/http/files.ts+132−0
apps/diffinery/src/http/gh.ts+753−0
apps/diffinery/src/http/ghctx.ts+137−0
apps/diffinery/src/http/gitdata.ts+193−0
apps/diffinery/src/http/issues.ts+335−0
apps/diffinery/src/http/misc.ts+146−0
apps/diffinery/src/http/releases.ts+110−0
apps/diffinery/src/http/search.ts+134−0
apps/diffinery/src/http/statuses.ts+137−0
apps/diffinery/src/lib/archive.ts+209−0
apps/diffinery/src/lib/directory.ts+13−0
apps/diffinery/src/lib/import-hosts.ts+18−0
apps/diffinery/src/lib/r2-sink.ts+83−0
apps/diffinery/src/lib/search-query.ts+227−0
apps/diffinery/src/lib/tree-names.ts+37−0
apps/diffinery/src/mcp/releases.ts+175−0
apps/diffinery/src/mcp/server.ts+3−1
apps/diffinery/src/repo/RepoDO.ts+358−3
apps/diffinery/src/repo/actions.ts+17−2
apps/diffinery/src/repo/collab.ts+95−12
apps/diffinery/src/repo/deployments.ts+512−0
apps/diffinery/src/repo/extra-triggers.ts+29−0
apps/diffinery/src/repo/gitdata.ts+614−0
apps/diffinery/src/repo/queue.ts+13−13
apps/diffinery/src/repo/release-notes.ts+82−0
apps/diffinery/src/repo/releases.ts+713−0
apps/diffinery/src/repo/required.ts+49−0
apps/diffinery/src/repo/schema.ts+53−0
apps/diffinery/src/repo/search.ts+117−0
apps/diffinery/src/repo/social.ts+471−0
apps/diffinery/src/repo/statuses.ts+154−0
apps/diffinery/src/repo/types.ts+2−0
apps/diffinery/src/web/checks.tsx+23−0
apps/diffinery/src/web/code.tsx+7−3
apps/diffinery/src/web/collab.tsx+5−10
apps/diffinery/src/web/csrf.ts+20−3
apps/diffinery/src/web/releases.tsx+478−0
apps/diffinery/src/web/routes.tsx+2−0
apps/diffinery/src/web/ui.tsx+2−2
apps/diffinery/test/e2e/e2e.test.mjs+291−0
apps/diffinery/test/e2e/security.test.mjs+301−0
apps/diffinery/test/unit/archive-stream.test.ts+33−0
apps/diffinery/test/unit/archive.test.ts+105−0
apps/diffinery/test/unit/environment-secrets.test.ts+24−0
apps/diffinery/test/unit/r2-sink.test.ts+102−0
apps/diffinery/test/unit/release-notes.test.ts+87−0
apps/diffinery/test/unit/required.test.ts+50−0
apps/diffinery/test/unit/search-query.test.ts+112−0
apps/diffinery/test/unit/tree-names.test.ts+31−0
packages/shared/src/events.ts+2−0
pnpm-lock.yaml+154−0

modifiedREADME.md+102−1View file

addedapps/diffinery/migrations/0007_repo_topics.sql+2−0View file

modifiedapps/diffinery/package.json+4−2View file

modifiedapps/diffinery/src/app.ts+14−1View file

modifiedapps/diffinery/src/auth/sessions.ts+1−1View file

modifiedapps/diffinery/src/env.ts+2−0View file

modifiedapps/diffinery/src/http/api.ts+358−189View file

modifiedapps/diffinery/src/http/common.ts+3−2View file

addedapps/diffinery/src/http/compat.ts+40−0View file

addedapps/diffinery/src/http/deployments.ts+239−0View file

addedapps/diffinery/src/http/files.ts+132−0View file

addedapps/diffinery/src/http/gh.ts+753−0View file

addedapps/diffinery/src/http/ghctx.ts+137−0View file

addedapps/diffinery/src/http/gitdata.ts+193−0View file

addedapps/diffinery/src/http/issues.ts+335−0View file

addedapps/diffinery/src/http/misc.ts+146−0View file

addedapps/diffinery/src/http/releases.ts+110−0View file

addedapps/diffinery/src/http/search.ts+134−0View file

addedapps/diffinery/src/http/statuses.ts+137−0View file

addedapps/diffinery/src/lib/archive.ts+209−0View file

modifiedapps/diffinery/src/lib/directory.ts+13−0View file

addedapps/diffinery/src/lib/import-hosts.ts+18−0View file

addedapps/diffinery/src/lib/r2-sink.ts+83−0View file

addedapps/diffinery/src/lib/search-query.ts+227−0View file

addedapps/diffinery/src/lib/tree-names.ts+37−0View file

addedapps/diffinery/src/mcp/releases.ts+175−0View file

modifiedapps/diffinery/src/mcp/server.ts+3−1View file

modifiedapps/diffinery/src/repo/RepoDO.ts+358−3View file

modifiedapps/diffinery/src/repo/actions.ts+17−2View file

modifiedapps/diffinery/src/repo/collab.ts+95−12View file

addedapps/diffinery/src/repo/deployments.ts+512−0View file

addedapps/diffinery/src/repo/extra-triggers.ts+29−0View file

addedapps/diffinery/src/repo/gitdata.ts+614−0View file

modifiedapps/diffinery/src/repo/queue.ts+13−13View file

addedapps/diffinery/src/repo/release-notes.ts+82−0View file

addedapps/diffinery/src/repo/releases.ts+713−0View file

addedapps/diffinery/src/repo/required.ts+49−0View file

modifiedapps/diffinery/src/repo/schema.ts+53−0View file

addedapps/diffinery/src/repo/search.ts+117−0View file

addedapps/diffinery/src/repo/social.ts+471−0View file

addedapps/diffinery/src/repo/statuses.ts+154−0View file

modifiedapps/diffinery/src/repo/types.ts+2−0View file

addedapps/diffinery/src/web/checks.tsx+23−0View file

modifiedapps/diffinery/src/web/code.tsx+7−3View file

modifiedapps/diffinery/src/web/collab.tsx+5−10View file

modifiedapps/diffinery/src/web/csrf.ts+20−3View file

addedapps/diffinery/src/web/releases.tsx+478−0View file

modifiedapps/diffinery/src/web/routes.tsx+2−0View file

modifiedapps/diffinery/src/web/ui.tsx+2−2View file

modifiedapps/diffinery/test/e2e/e2e.test.mjs+291−0View file

addedapps/diffinery/test/e2e/security.test.mjs+301−0View file

addedapps/diffinery/test/unit/archive-stream.test.ts+33−0View file

addedapps/diffinery/test/unit/archive.test.ts+105−0View file

addedapps/diffinery/test/unit/environment-secrets.test.ts+24−0View file

addedapps/diffinery/test/unit/r2-sink.test.ts+102−0View file

addedapps/diffinery/test/unit/release-notes.test.ts+87−0View file

addedapps/diffinery/test/unit/required.test.ts+50−0View file

addedapps/diffinery/test/unit/search-query.test.ts+112−0View file

addedapps/diffinery/test/unit/tree-names.test.ts+31−0View file

modifiedpackages/shared/src/events.ts+2−0View file

modifiedpnpm-lock.yaml+154−0View file

		@@ -166,7 +166,8 @@
166	166	Tools include `get_file`, `list_tree`, `commit_files` (no git client needed),
167	167	`create_branch`, `create_pull_request` (with an `intent` for reviewers),
168	168	`review_pull_request`, `merge_pull_request` (policy-guarded), issues,
169		-`list_workflow_runs` and `get_job_logs`, `rerun_workflow`, and
	169	+`list_workflow_runs` and `get_job_logs`, `rerun_workflow`, releases
	170	+(`create_release`, `upload_release_asset`, `generate_release_notes`), and
170	171	`sandbox_create`/`sandbox_exec` for running builds and tests.
171	172
172	173	Agent guardrails apply everywhere: git, REST, MCP and the web UI.
		@@ -177,6 +178,10 @@
177	178	- A pull request opened by an agent needs at least one human approval, and
178	179	approvals from agents don't count toward it.
179	180	- Agents can't change branch protection or read or set secrets.
	181	+- Agents can't change or delete environments or their branch policies, and
	182	+ can't dismiss reviews.
	183	+- Commit statuses and check runs that agents report never satisfy a required
	184	+ check.
180	185
181	186	## Workflows
182	187
		@@ -250,6 +255,99 @@
250	255	`deepen-not` / partial clone filters. A job that uses an unsupported feature fails
251	256	with a clear message instead of misbehaving.
252	257
	258	+## REST API
	259	+
	260	+The API lives at `/api/v3`, with the same paths, JSON shapes and errors as
	261	+GitHub's REST API. Point a client at it and it works:
	262	+
	263	+```js
	264	+const octokit = new Octokit({ auth: token, baseUrl: "https://diffinery.example.com/api/v3" });
	265	+```
	266	+
	267	+Responses carry `node_id`, `url`, `html_url`, full user objects and label
	268	+objects. Lists take `per_page` and `page` and send a `Link` header, so
	269	+`octokit.paginate` works. Errors have `message` and `documentation_url`.
	270	+Responses also keep a few Diffinery fields (such as `merge_blockers` on pull
	271	+requests) for the CLI, MCP and web UI.
	272	+
	273	+What works:
	274	+
	275	+- Repositories: get, create, update, delete, topics, languages,
	276	+ collaborators, branches, tags, readme, contents (GET, and PUT and DELETE
	277	+ with `sha`; a stale `sha` returns 409), compare, commits, `merges`,
	278	+ `dispatches`, and `zipball`/`tarball` archives. `private: false` makes a
	279	+ repository public.
	280	+- Archives: `zipball` and `tarball` are built on demand and cached in R2.
	281	+ The cache can be evicted at any time; the archive is then built again. An
	282	+ archive holds at most 24 MB of files and 100,000 tree entries. A zip holds
	283	+ at most 65,535 files; use the tarball for more. Each repository can build
	284	+ 20 new archives per hour. Clone bigger repositories with git.
	285	+- Git data: blobs, trees (with `base_tree` and `recursive`), commits,
	286	+ annotated tags, `git/ref`, `git/refs` and `git/matching-refs`.
	287	+- Releases: list, get by id or tag, latest, create (the tag is created
	288	+ if missing), update, delete, `generate-notes` (honours
	289	+ `.github/release.yml`), `make_latest`, and drafts (visible to writers only).
	290	+ Upload assets to the release's `upload_url`. Download them from
	291	+ `browser_download_url`, or from the asset URL with
	292	+ `Accept: application/octet-stream`. Bytes live in R2. An asset can be up to
	293	+ 100 MB, the largest request body Workers accept.
	294	+- Commit statuses: create, list and the combined status. A status counts
	295	+ as a check, so a branch protection's required checks can name a status
	296	+ context.
	297	+- Required checks: when Diffinery Actions reports a check, it alone
	298	+ decides that check. To have a required check decided by someone else, bind
	299	+ it in branch protection, for example
	300	+ `"requiredCheckSources": { "ci/external": "ci-bot" }`. A required check
	301	+ fails if any counted report of it fails. Only the reporter that created a
	302	+ check run can update it, and Actions check runs can't be changed over REST.
	303	+- Checks: check runs (create, update, get, annotations) and check suites.
	304	+- Issues and pull requests: labels, assignees, lock and unlock,
	305	+ comments (by issue and repository-wide), reactions (issues, comments, review
	306	+ comments and releases), events and the timeline, reviews, review comments
	307	+ and replies, review dismissal, requested reviewers, `update-branch`, merge,
	308	+ `commits/{sha}/pulls`, and list filters (`head`, `base`, `sort`,
	309	+ `direction`, `labels`, `assignee`, `since`). Pull requests report
	310	+ `mergeable`, `mergeable_state` and `rebaseable`. Comment, review, check
	311	+ run, user and repository ids are numbers, as on GitHub. Locked
	312	+ conversations refuse comments, review comments and reactions from people
	313	+ without triage access. Dismissing a review takes maintain access, and the
	314	+ pull request's author can't do it.
	315	+- Archived repositories are read-only through the API, for everyone.
	316	+- Tree entry names: every write refuses `.`, `..`, `.git` (in any case,
	317	+ and spellings like `.git.` or `git~1`), and names with `\` or NUL.
	318	+- Deployments and environments: deployments, deployment statuses,
	319	+ environments, deployment branch policies, and environment secrets and
	320	+ variables. A deployment without `required_contexts` needs every context on
	321	+ the commit to have passed, as on GitHub; send `[]` to skip that. An
	322	+ environment with no branch policy gets "protected branches only" when its
	323	+ first secret is added. Environment secrets never go to `refs/pull/*` runs.
	324	+ Runs started by agents only get them when the environment allows protected
	325	+ branches only. Tags pushed by agents never match an environment's tag
	326	+ patterns.
	327	+- Actions: runs, run attempts, jobs, logs (a zip per run), artifacts,
	328	+ workflows, secrets and variables.
	329	+- Search: `/search/issues` (`repo:`, `is:`, `label:`, `author:`,
	330	+ `assignee:`, `no:`, `head:`, `base:`, `in:`, date ranges and `sort:`) and
	331	+ `/search/repositories` (`user:`, `org:`, `topic:`, `is:public`,
	332	+ `archived:`). Search only covers repositories you can read. A query
	333	+ can be up to 256 characters, and one search looks at up to 50 repositories.
	334	+- `/rate_limit`. Diffinery doesn't rate-limit the API, so it reports a
	335	+ generous budget.
	336	+
	337	+Workflows can react to these too. A published release triggers `on: release`,
	338	+a `POST /dispatches` triggers `on: repository_dispatch`, and webhooks get
	339	+`release`, `status`, `deployment` and `deployment_status` events. A job with
	340	+`environment:` creates a deployment, gets that environment's secrets and
	341	+variables, and is refused if the environment's branch policy doesn't allow
	342	+the ref. As on GitHub, events caused by `GITHUB_TOKEN` don't start new
	343	+workflow runs, except `repository_dispatch`.
	344	+
	345	+Not supported yet: GraphQL (`/api/graphql`), setting secrets with a
	346	+sealed-box `encrypted_value` (send `value` instead), environment protection
	347	+rules (required reviewers, wait timers), forks, team reviewers, and code and
	348	+commit search. Search qualifiers for stars, forks and languages are accepted
	349	+but ignored.
	350	+
253	351	## Developing
254	352
255	353	```sh
		@@ -275,6 +373,9 @@
275	373	8. In Chromium with a virtual authenticator, joins from an invite with a new
276	374	passkey, adds and removes passkeys, signs out and in, and uses an admin
277	375	sign-in link.
	376	+9. Drives the REST API with the real `@octokit/rest` client: contents, git
	377	+ data, statuses as required checks, releases with asset uploads and
	378	+ downloads, issues, reactions, pagination, search and deployments.
278	379
279	380	Team preferences for product and design decisions are in
280	381	[docs/PREFERENCES.md](docs/PREFERENCES.md).

		@@ -13,6 +13,8 @@
13	13	import { runner } from "./http/runner.js";
14	14	import { api, wellKnown } from "./http/api.js";
15	15	import { mailApi } from "./mail/api.js";
	16	+import { files } from "./http/files.js";
	17	+import { nodeId, numericId } from "./http/gh.js";
16	18	import { mcp } from "./mcp/server.js";
17	19	import { registry } from "./registry/http.js";
18	20	import { packagesApi } from "./registry/api.js";
		@@ -71,6 +73,7 @@
71	73	app.route("/", registry);
72	74	app.route("/", packagesApi);
73	75	app.route("/", api);
	76	+app.route("/", files);
74	77	app.route("/", mcp);
75	78
76	79	// Live updates: authorise in the Worker, then hand the WebSocket to the repository's Durable Object.
		@@ -105,11 +108,16 @@
105	108	pull_request_review: "pull_request_review",
106	109	workflow_run: "workflow_run",
107	110	workflow_dispatch: "workflow_dispatch",
	111	+ release: "release",
	112	+ status: "status",
	113	+ deployment: "deployment",
	114	+ deployment_status: "deployment_status",
	115	+ repository_dispatch: "repository_dispatch",
108	116	audit: "audit",
109	117	};
110	118
111	119	function webhookPayload(env: Env, ev: Exclude<DiffineryEvent, { type: "audit" }>) {
112		- const repository = { id: ev.repoId, name: ev.repo, full_name: `${ev.owner}/${ev.repo}`, owner: { login: ev.owner }, html_url: `${env.PUBLIC_URL}/${ev.owner}/${ev.repo}`, clone_url: `${env.PUBLIC_URL}/${ev.owner}/${ev.repo}.git` };
	120	+ const repository = { id: numericId(ev.repoId), node_id: nodeId("Repository", ev.repoId), name: ev.repo, full_name: `${ev.owner}/${ev.repo}`, owner: { login: ev.owner }, html_url: `${env.PUBLIC_URL}/${ev.owner}/${ev.repo}`, clone_url: `${env.PUBLIC_URL}/${ev.owner}/${ev.repo}.git` };
113	121	const sender = { id: ev.actor.id, login: ev.actor.login, type: ev.actor.kind === "agent" ? "Bot" : ev.actor.kind === "system" ? "Bot" : "User", on_behalf_of: ev.actor.onBehalfOf };
114	122	const { type: _t, repoId: _r, owner: _o, repo: _n, actor: _a, ...rest } = ev;
115	123	const action = "action" in ev ? (ev.action === "merged" ? "closed" : ev.action) : undefined;
		@@ -118,6 +126,11 @@
118	126	extra.pull_request = { number: ev.number, html_url: `${env.PUBLIC_URL}/${ev.owner}/${ev.repo}/pull/${ev.number}`, head: { ref: ev.headRef, sha: ev.headSha }, base: { ref: ev.baseRef }, merged: ev.action === "merged" };
119	127	}
120	128	if (ev.type === "issues" \|\| ev.type === "issue_comment") extra.issue = { number: ev.number, html_url: `${env.PUBLIC_URL}/${ev.owner}/${ev.repo}/issues/${ev.number}` };
	129	+ // GitHub-shaped events (release, status, deployment, ...) carry their payload ready-made.
	130	+ if ("payload" in ev) {
	131	+ const { payload, at: _at, ...head } = rest as typeof rest & { payload: Record<string, unknown>; at: string };
	132	+ return { ...head, ...payload, action, repository, sender };
	133	+ }
121	134	return { ...rest, action, repository, sender, ...extra };
122	135	}
123	136

		@@ -78,7 +78,7 @@
78	78	const row = await this.db.prepare("SELECT * FROM sessions WHERE id = ?").bind(await sha256(token)).first<SessionRow>();
79	79	if (!row \|\| row.expires_at < now()) return null;
80	80	const account = await this.db.prepare("SELECT * FROM accounts WHERE id = ?").bind(row.account_id).first<Account>();
81		- if (!account \|\| account.kind !== "user") return null;
	81	+ if (!account \|\| account.kind !== "user" \|\| account.status === "disabled") return null;
82	82	if (Date.now() - Date.parse(row.last_seen_at) > 86400_000) {
83	83	await this.db.prepare("UPDATE sessions SET last_seen_at = ?, expires_at = ? WHERE id = ?").bind(now(), days(SESSION_DAYS), row.id).run();
84	84	}

		@@ -1,6 +1,7 @@
1	1	import type { Env } from "../env.js";
2	2	import type { Repo } from "../lib/directory.js";
3	3	import { HttpError } from "../lib/util.js";
	4	+import { GITHUB_DOCS } from "./gh.js";
4	5	import { callerFor, type AppContext } from "../auth/principal.js";
5	6	import { atLeast, type Caller, type Role } from "../repo/types.js";
6	7
		@@ -24,12 +25,12 @@
24	25	if (e instanceof HttpError) {
25	26	const headers: Record<string, string> = { "content-type": "application/json" };
26	27	if (e.status === 401) headers["www-authenticate"] = 'Basic realm="Diffinery", charset="UTF-8"';
27		- return new Response(JSON.stringify({ message: e.detail, ...e.extra }), { status: e.status, headers });
	28	+ return new Response(JSON.stringify({ message: e.detail, documentation_url: GITHUB_DOCS, ...e.extra }), { status: e.status, headers });
28	29	}
29	30	// Errors thrown inside Durable Objects arrive as plain Errors; recover HttpError-like status when present.
30	31	const msg = (e as Error)?.message ?? String(e);
31	32	const remote = /^(\d{3}):/.exec(msg);
32		- if (remote) return new Response(JSON.stringify({ message: msg.slice(5) }), { status: Number(remote[1]), headers: { "content-type": "application/json" } });
	33	+ if (remote) return new Response(JSON.stringify({ message: msg.slice(5), documentation_url: GITHUB_DOCS }), { status: Number(remote[1]), headers: { "content-type": "application/json" } });
33	34	console.error(e);
34	35	return new Response(JSON.stringify({ message: "internal error" }), { status: 500, headers: { "content-type": "application/json" } });
35	36	}

		@@ -1,0 +1,40 @@
	1	+import { Hono } from "hono";
	2	+import type { Env } from "../env.js";
	3	+import type { AppVars } from "../auth/principal.js";
	4	+import { deployments } from "./deployments.js";
	5	+import { gitdata } from "./gitdata.js";
	6	+import { issues } from "./issues.js";
	7	+import { misc } from "./misc.js";
	8	+import { releases } from "./releases.js";
	9	+import { search } from "./search.js";
	10	+import { statuses } from "./statuses.js";
	11	+
	12	+/**
	13	+ * GitHub-compatible REST endpoints beyond the core in ./api.ts, so Octokit,
	14	+ * `gh api`, actions/github-script and marketplace actions work unchanged.
	15	+ * Mounted at the top of the /api/v3 app.
	16	+ */
	17	+export const compat = new Hono<{ Bindings: Env; Variables: AppVars }>();
	18	+
	19	+// Headers GitHub clients look at: API version and media type, and a (generous, unmetered) rate limit.
	20	+compat.use("*", async (c, next) => {
	21	+ await next();
	22	+ const h = c.res.headers;
	23	+ h.set("x-github-media-type", "github.v3; format=json");
	24	+ h.set("x-github-api-version-selected", "2022-11-28");
	25	+ if (!h.has("x-ratelimit-limit")) {
	26	+ h.set("x-ratelimit-limit", "15000");
	27	+ h.set("x-ratelimit-remaining", "15000");
	28	+ h.set("x-ratelimit-used", "0");
	29	+ h.set("x-ratelimit-reset", String(Math.floor(Date.now() / 1000) + 3600));
	30	+ h.set("x-ratelimit-resource", "core");
	31	+ }
	32	+});
	33	+
	34	+compat.route("/", releases);
	35	+compat.route("/", statuses);
	36	+compat.route("/", gitdata);
	37	+compat.route("/", issues);
	38	+compat.route("/", deployments);
	39	+compat.route("/", search);
	40	+compat.route("/", misc);

		@@ -1,0 +1,2 @@
	1	+-- Repository topics (GitHub's `topics`), shown in repository JSON and searchable with `topic:`.
	2	+ALTER TABLE repos ADD COLUMN topics TEXT NOT NULL DEFAULT '[]';

		@@ -9,7 +9,7 @@
9	9	"typecheck": "tsc --noEmit && tsc --noEmit -p islands",
10	10	"test": "vitest run --passWithNoTests --exclude 'test/e2e/**'",
11	11	"cf-typegen": "wrangler types",
12		- "e2e": "node --test --test-concurrency=1 --test-timeout=600000 test/e2e/e2e.test.mjs test/e2e/passkeys.test.mjs test/e2e/registry.test.mjs test/e2e/email.test.mjs",
	12	+ "e2e": "node --test --test-concurrency=1 --test-timeout=600000 test/e2e/e2e.test.mjs test/e2e/passkeys.test.mjs test/e2e/registry.test.mjs test/e2e/email.test.mjs test/e2e/security.test.mjs",
13	13	"db:migrate:local": "wrangler d1 migrations apply diffinery-dev --local -e dev",
14	14	"build": "node islands/build.mjs",
15	15	"predev": "node islands/build.mjs"
		@@ -20,12 +20,14 @@
20	20	"@diffinery/shared": "workspace:*",
21	21	"@diffinery/workflow-yaml": "workspace:*",
22	22	"@simplewebauthn/server": "14.0.3",
23		- "hono": "^4.13.0"
	23	+ "hono": "^4.13.0",
	24	+ "yaml": "^2.9.1"
24	25	},
25	26	"devDependencies": {
26	27	"@cloudflare/kumo": "2.14.0",
27	28	"@cloudflare/vitest-pool-workers": "^0.23.0",
28	29	"@cloudflare/workers-types": "^5.20261012.1",
	30	+ "@octokit/rest": "22.0.1",
29	31	"@phosphor-icons/react": "2.1.10",
30	32	"@types/react": "19.2.2",
31	33	"@types/react-dom": "19.2.2",

		@@ -35,4 +35,6 @@
35	35	OIDC_PRIVATE_KEY?: string;
36	36	/** Secret: optional GitHub token used by the importer. */
37	37	GITHUB_IMPORT_TOKEN?: string;
	38	+ /** Optional GitHub Enterprise host (e.g. github.example.com) the importer may download release assets from. */
	39	+ IMPORT_GHE_HOST?: string;
38	40	}

		@@ -1,0 +1,239 @@
	1	+import { Hono } from "hono";
	2	+import type { Env } from "../env.js";
	3	+import type { AppContext, AppVars } from "../auth/principal.js";
	4	+import { HttpError } from "../lib/util.js";
	5	+import { parsePayload, type Deployment, type DeploymentStatus, type Environment } from "../repo/deployments.js";
	6	+import type { Caller } from "../repo/types.js";
	7	+import { baseOf, ghUser, isoSeconds, nodeId, pageOf, paginate, repoApi, repoHtml, setLinks } from "./gh.js";
	8	+import { intParam, jsonBody, loadTarget, repoParams } from "./ghctx.js";
	9	+
	10	+/** Deployments, deployment statuses and environments, with environment secrets and variables (GitHub REST). */
	11	+export const deployments = new Hono<{ Bindings: Env; Variables: AppVars }>();
	12	+
	13	+const R = "/repos/:owner/:repo";
	14	+const load = (c: AppContext, min: "read" \| "write" \| "admin" = "read") => loadTarget(c, min);
	15	+const api = (c: AppContext) => repoApi(baseOf(c), repoParams(c).owner, repoParams(c).repo);
	16	+const envName = (c: AppContext) => (c.req.param("env") ?? "");
	17	+
	18	+function deploymentJson(c: AppContext, d: Deployment): Record<string, unknown> {
	19	+ const url = `${api(c)}/deployments/${d.id}`;
	20	+ return {
	21	+ url,
	22	+ id: d.id,
	23	+ node_id: nodeId("Deployment", `${repoParams(c).owner}/${repoParams(c).repo}/${d.id}`),
	24	+ sha: d.sha,
	25	+ ref: d.ref,
	26	+ task: d.task,
	27	+ payload: parsePayload(d.payload),
	28	+ original_environment: d.originalEnvironment,
	29	+ environment: d.environment,
	30	+ description: d.description,
	31	+ creator: ghUser(baseOf(c), d.creator),
	32	+ created_at: isoSeconds(d.createdAt),
	33	+ updated_at: isoSeconds(d.updatedAt),
	34	+ statuses_url: `${url}/statuses`,
	35	+ repository_url: api(c),
	36	+ transient_environment: d.transient,
	37	+ production_environment: d.production,
	38	+ performed_via_github_app: null,
	39	+ };
	40	+}
	41	+
	42	+function statusJson(c: AppContext, s: DeploymentStatus) {
	43	+ const dep = `${api(c)}/deployments/${s.deploymentId}`;
	44	+ return {
	45	+ url: `${dep}/statuses/${s.id}`,
	46	+ id: s.id,
	47	+ node_id: nodeId("DeploymentStatus", `${repoParams(c).owner}/${repoParams(c).repo}/${s.id}`),
	48	+ state: s.state,
	49	+ creator: ghUser(baseOf(c), s.creator),
	50	+ description: s.description,
	51	+ environment: s.environment,
	52	+ target_url: s.logUrl,
	53	+ log_url: s.logUrl,
	54	+ environment_url: s.environmentUrl,
	55	+ created_at: isoSeconds(s.createdAt),
	56	+ updated_at: isoSeconds(s.createdAt),
	57	+ deployment_url: dep,
	58	+ repository_url: api(c),
	59	+ performed_via_github_app: null,
	60	+ };
	61	+}
	62	+
	63	+function environmentJson(c: AppContext, e: Environment) {
	64	+ const name = encodeURIComponent(e.name);
	65	+ return {
	66	+ id: e.id,
	67	+ node_id: nodeId("Environment", `${repoParams(c).owner}/${repoParams(c).repo}/${e.id}`),
	68	+ name: e.name,
	69	+ url: `${api(c)}/environments/${name}`,
	70	+ html_url: `${repoHtml(baseOf(c), repoParams(c).owner, repoParams(c).repo)}/deployments/activity_log?environments_filter=${name}`,
	71	+ created_at: isoSeconds(e.createdAt),
	72	+ updated_at: isoSeconds(e.updatedAt),
	73	+ can_admins_bypass: true,
	74	+ protection_rules: e.policy ? [{ id: e.id, node_id: nodeId("BranchPolicy", e.id), type: "branch_policy" }] : [],
	75	+ deployment_branch_policy: e.policy ? { protected_branches: e.policy.protected_branches, custom_branch_policies: e.policy.custom_branch_policies } : null,
	76	+ };
	77	+}
	78	+
	79	+/** Environment secrets and settings are sensitive: changes go to the audit log. */
	80	+function audit(c: AppContext, caller: Caller, action: string, detail: Record<string, unknown>) {
	81	+ c.executionCtx.waitUntil(c.get("dir").audit({ actorId: caller.id, actorLogin: caller.login, onBehalfOf: caller.onBehalfOf, action, target: `${repoParams(c).owner}/${repoParams(c).repo}`, detail }));
	82	+}
	83	+
	84	+// ---------------------------------------------------------------- deployments
	85	+
	86	+deployments.get(`${R}/deployments`, async (c) => {
	87	+ const { stub } = await load(c);
	88	+ const p = pageOf(c);
	89	+ const q = (k: string) => c.req.query(k) \|\| undefined;
	90	+ const res = await stub.deployments({ sha: q("sha"), ref: q("ref"), task: q("task"), environment: q("environment"), limit: p.perPage, offset: p.offset });
	91	+ setLinks(c, p, res.total);
	92	+ return c.json(res.items.map((d) => deploymentJson(c, d)));
	93	+});
	94	+deployments.post(`${R}/deployments`, async (c) => {
	95	+ const { stub, caller } = await load(c, "write");
	96	+ const b = await jsonBody<{ ref?: string; task?: string; auto_merge?: boolean; required_contexts?: unknown; payload?: unknown; environment?: string; description?: string \| null; transient_environment?: boolean; production_environment?: boolean }>(c);
	97	+ if (b.required_contexts !== undefined && b.required_contexts !== null && (!Array.isArray(b.required_contexts) \|\| b.required_contexts.length > 100 \|\| b.required_contexts.some((x) => typeof x !== "string"))) {
	98	+ throw new HttpError(422, "required_contexts must be an array of strings", { errors: [{ resource: "Deployment", code: "invalid", field: "required_contexts" }] });
	99	+ }
	100	+ const required = Array.isArray(b.required_contexts) ? (b.required_contexts as string[]) : undefined;
	101	+ const d = await stub.createDeployment({ ref: b.ref, task: b.task, payload: b.payload, environment: b.environment, description: b.description, transient_environment: b.transient_environment, production_environment: b.production_environment, required_contexts: required }, caller);
	102	+ return c.json(deploymentJson(c, d), 201);
	103	+});
	104	+deployments.get(`${R}/deployments/:id`, async (c) => {
	105	+ const { stub } = await load(c);
	106	+ return c.json(deploymentJson(c, await stub.deployment(intParam(c, "id"))));
	107	+});
	108	+deployments.delete(`${R}/deployments/:id`, async (c) => {
	109	+ const { stub, caller } = await load(c, "write");
	110	+ await stub.deleteDeployment(intParam(c, "id"), caller);
	111	+ return c.body(null, 204);
	112	+});
	113	+deployments.get(`${R}/deployments/:id/statuses`, async (c) => {
	114	+ const { stub } = await load(c);
	115	+ return c.json(paginate(c, (await stub.deploymentStatuses(intParam(c, "id"))).map((s) => statusJson(c, s))));
	116	+});
	117	+deployments.post(`${R}/deployments/:id/statuses`, async (c) => {
	118	+ const { stub, caller } = await load(c, "write");
	119	+ const b = await jsonBody<{ state?: string; target_url?: string; log_url?: string; description?: string; environment?: string; environment_url?: string; auto_inactive?: boolean }>(c);
	120	+ return c.json(statusJson(c, await stub.createDeploymentStatus(intParam(c, "id"), b, caller)), 201);
	121	+});
	122	+deployments.get(`${R}/deployments/:id/statuses/:status`, async (c) => {
	123	+ const { stub } = await load(c);
	124	+ return c.json(statusJson(c, await stub.deploymentStatus(intParam(c, "id"), intParam(c, "status"))));
	125	+});
	126	+
	127	+// ---------------------------------------------------------------- environments
	128	+
	129	+deployments.get(`${R}/environments`, async (c) => {
	130	+ const { stub } = await load(c);
	131	+ const all = await stub.environments();
	132	+ return c.json({ total_count: all.length, environments: paginate(c, all).map((e) => environmentJson(c, e)) });
	133	+});
	134	+deployments.get(`${R}/environments/:env`, async (c) => {
	135	+ const { stub } = await load(c);
	136	+ return c.json(environmentJson(c, await stub.environment(envName(c))));
	137	+});
	138	+deployments.put(`${R}/environments/:env`, async (c) => {
	139	+ const { stub, caller } = await load(c, "admin");
	140	+ const b = await jsonBody<{ wait_timer?: number; reviewers?: unknown[] \| null; deployment_branch_policy?: { protected_branches?: boolean; custom_branch_policies?: boolean } \| null; prevent_self_review?: boolean }>(c, true);
	141	+ const e = await stub.upsertEnvironment(envName(c), b, caller);
	142	+ audit(c, caller, "environment.update", { environment: e.name, deployment_branch_policy: b.deployment_branch_policy ?? null });
	143	+ return c.json(environmentJson(c, e));
	144	+});
	145	+deployments.delete(`${R}/environments/:env`, async (c) => {
	146	+ const { stub, caller } = await load(c, "admin");
	147	+ await stub.deleteEnvironment(envName(c), caller);
	148	+ audit(c, caller, "environment.delete", { environment: envName(c) });
	149	+ return c.body(null, 204);
	150	+});
	151	+deployments.get(`${R}/environments/:env/deployment-branch-policies`, async (c) => {
	152	+ const { stub } = await load(c);
	153	+ const e = await stub.environment(envName(c));
	154	+ const list = e.policy?.patterns ?? [];
	155	+ return c.json({ total_count: list.length, branch_policies: paginate(c, list).map((p) => ({ ...p, node_id: nodeId("BranchPolicy", `${e.id}/${p.id}`) })) });
	156	+});
	157	+deployments.post(`${R}/environments/:env/deployment-branch-policies`, async (c) => {
	158	+ const { stub, caller } = await load(c, "admin");
	159	+ const b = await jsonBody<{ name?: string; type?: string }>(c);
	160	+ const p = await stub.addEnvironmentBranchPattern(envName(c), b, caller);
	161	+ audit(c, caller, "environment.branch_policy.create", { environment: envName(c), pattern: p.name, type: p.type });
	162	+ return c.json({ ...p, node_id: nodeId("BranchPolicy", p.id) });
	163	+});
	164	+deployments.delete(`${R}/environments/:env/deployment-branch-policies/:id`, async (c) => {
	165	+ const { stub, caller } = await load(c, "admin");
	166	+ await stub.removeEnvironmentBranchPattern(envName(c), intParam(c, "id"), caller);
	167	+ audit(c, caller, "environment.branch_policy.delete", { environment: envName(c), id: intParam(c, "id") });
	168	+ return c.body(null, 204);
	169	+});
	170	+
	171	+// ---------------------------------------------------------------- environment secrets (names only, never values) and variables
	172	+
	173	+deployments.get(`${R}/environments/:env/secrets`, async (c) => {
	174	+ const { stub } = await load(c, "admin");
	175	+ const list = await stub.environmentSecretNames(envName(c));
	176	+ return c.json({ total_count: list.length, secrets: paginate(c, list).map((s) => ({ name: s.name, created_at: isoSeconds(s.updatedAt), updated_at: isoSeconds(s.updatedAt) })) });
	177	+});
	178	+deployments.get(`${R}/environments/:env/secrets/:name`, async (c) => {
	179	+ const { stub } = await load(c, "admin");
	180	+ const s = (await stub.environmentSecretNames(envName(c))).find((x) => x.name === c.req.param("name").toUpperCase());
	181	+ if (!s) throw new HttpError(404, "Not Found");
	182	+ return c.json({ name: s.name, created_at: isoSeconds(s.updatedAt), updated_at: isoSeconds(s.updatedAt) });
	183	+});
	184	+deployments.put(`${R}/environments/:env/secrets/:name`, async (c) => {
	185	+ const { stub, caller } = await load(c, "admin");
	186	+ if (caller.kind === "agent") throw new HttpError(403, "agents cannot manage secrets");
	187	+ const b = await jsonBody<{ value?: string; encrypted_value?: string }>(c);
	188	+ if (typeof b.value !== "string" && typeof b.encrypted_value === "string") throw new HttpError(422, "encrypted_value (sealed box) is not supported yet: send the secret as `value` over HTTPS; it is encrypted at rest");
	189	+ if (typeof b.value !== "string") throw new HttpError(422, "value is required (send it over HTTPS; it is encrypted at rest)");
	190	+ const existed = (await stub.environmentSecretNames(envName(c))).some((x) => x.name === c.req.param("name").toUpperCase());
	191	+ await stub.setEnvironmentSecret(envName(c), c.req.param("name"), b.value, caller);
	192	+ audit(c, caller, "environment.secret.set", { environment: envName(c), name: c.req.param("name").toUpperCase() });
	193	+ return c.body(null, existed ? 204 : 201);
	194	+});
	195	+deployments.delete(`${R}/environments/:env/secrets/:name`, async (c) => {
	196	+ const { stub, caller } = await load(c, "admin");
	197	+ if (caller.kind === "agent") throw new HttpError(403, "agents cannot manage secrets");
	198	+ await stub.deleteEnvironmentSecret(envName(c), c.req.param("name"), caller);
	199	+ audit(c, caller, "environment.secret.delete", { environment: envName(c), name: c.req.param("name").toUpperCase() });
	200	+ return c.body(null, 204);
	201	+});
	202	+
	203	+const variableJson = (v: { name: string; value: string; createdAt: string; updatedAt: string }) => ({ name: v.name, value: v.value, created_at: isoSeconds(v.createdAt), updated_at: isoSeconds(v.updatedAt) });
	204	+
	205	+deployments.get(`${R}/environments/:env/variables`, async (c) => {
	206	+ const { stub } = await load(c, "write");
	207	+ const list = await stub.environmentVariables(envName(c));
	208	+ return c.json({ total_count: list.length, variables: paginate(c, list, 10).map(variableJson) });
	209	+});
	210	+deployments.get(`${R}/environments/:env/variables/:name`, async (c) => {
	211	+ const { stub } = await load(c, "write");
	212	+ const v = (await stub.environmentVariables(envName(c))).find((x) => x.name === c.req.param("name").toUpperCase());
	213	+ if (!v) throw new HttpError(404, "Not Found");
	214	+ return c.json(variableJson(v));
	215	+});
	216	+deployments.post(`${R}/environments/:env/variables`, async (c) => {
	217	+ const { stub, caller } = await load(c, "admin");
	218	+ const b = await jsonBody<{ name?: string; value?: string }>(c);
	219	+ if (typeof b.name !== "string" \|\| typeof b.value !== "string") throw new HttpError(422, "name and value are required");
	220	+ if ((await stub.environmentVariables(envName(c))).some((x) => x.name === b.name!.toUpperCase())) throw new HttpError(409, "Already exists - Variable already exists");
	221	+ await stub.setEnvironmentVariable(envName(c), b.name, b.value, caller);
	222	+ return c.json({}, 201);
	223	+});
	224	+deployments.patch(`${R}/environments/:env/variables/:name`, async (c) => {
	225	+ const { stub, caller } = await load(c, "admin");
	226	+ const b = await jsonBody<{ name?: string; value?: string }>(c);
	227	+ const name = c.req.param("name");
	228	+ const current = (await stub.environmentVariables(envName(c))).find((x) => x.name === name.toUpperCase());
	229	+ if (!current) throw new HttpError(404, "Not Found");
	230	+ const next = typeof b.name === "string" && b.name ? b.name : name;
	231	+ await stub.setEnvironmentVariable(envName(c), next, typeof b.value === "string" ? b.value : current.value, caller);
	232	+ if (next.toUpperCase() !== name.toUpperCase()) await stub.setEnvironmentVariable(envName(c), name, null, caller);
	233	+ return c.body(null, 204);
	234	+});
	235	+deployments.delete(`${R}/environments/:env/variables/:name`, async (c) => {
	236	+ const { stub, caller } = await load(c, "admin");
	237	+ await stub.setEnvironmentVariable(envName(c), c.req.param("name"), null, caller);
	238	+ return c.body(null, 204);
	239	+});

		@@ -1,0 +1,132 @@
	1	+import { Hono } from "hono";
	2	+import type { Env } from "../env.js";
	3	+import type { AppContext, AppVars } from "../auth/principal.js";
	4	+import { HttpError } from "../lib/util.js";
	5	+import type { Caller } from "../repo/types.js";
	6	+import { R2Sink } from "../lib/r2-sink.js";
	7	+import { baseOf, ghAsset } from "./gh.js";
	8	+import { decodePath, intParam, loadTarget, repoParams, type Stub } from "./ghctx.js";
	9	+
	10	+/**
	11	+ * Byte routes outside /api/v3, at the paths GitHub clients expect:
	12	+ * release asset uploads (`upload_url`), browser downloads of release assets
	13	+ * and source archives, and avatars for the `avatar_url` in user objects.
	14	+ */
	15	+export const files = new Hono<{ Bindings: Env; Variables: AppVars }>();
	16	+
	17	+/** Workers accept request bodies up to 100 MB, so that is the real limit for an asset. */
	18	+export const MAX_ASSET_BYTES = 100 * 1024 * 1024;
	19	+const TOO_LARGE = "release assets are limited to 100 MB";
	20	+
	21	+/** Store an asset's bytes in R2 and record it. Streams either way; without a length, bytes are counted and the upload stops at the limit. */
	22	+export async function storeAsset(
	23	+ env: Env,
	24	+ stub: Stub,
	25	+ releaseId: number,
	26	+ meta: { name: string; label?: string; contentType?: string },
	27	+ data: { stream: ReadableStream<Uint8Array>; length: number \| null },
	28	+ caller: Caller,
	29	+) {
	30	+ if (data.length !== null && data.length > MAX_ASSET_BYTES) throw new HttpError(413, TOO_LARGE);
	31	+ const { id, r2Key } = await stub.startReleaseAsset(releaseId, meta, caller);
	32	+ try {
	33	+ let size: number;
	34	+ if (data.length !== null) {
	35	+ const fixed = new FixedLengthStream(data.length);
	36	+ await Promise.all([data.stream.pipeTo(fixed.writable), env.BUCKET.put(r2Key, fixed.readable, { httpMetadata: { contentType: meta.contentType } })]);
	37	+ size = data.length;
	38	+ } else {
	39	+ const sink = new R2Sink(env.BUCKET, r2Key, meta.contentType ?? "application/octet-stream", MAX_ASSET_BYTES, TOO_LARGE);
	40	+ const reader = data.stream.getReader();
	41	+ try {
	42	+ for (;;) {
	43	+ const { done, value } = await reader.read();
	44	+ if (done) break;
	45	+ await sink.write(value);
	46	+ }
	47	+ size = await sink.close();
	48	+ } catch (e) {
	49	+ await reader.cancel().catch(() => undefined);
	50	+ await sink.abort();
	51	+ throw e;
	52	+ }
	53	+ }
	54	+ return await stub.finishReleaseAsset(id, size);
	55	+ } catch (e) {
	56	+ await stub.abortReleaseAsset(id);
	57	+ await env.BUCKET.delete(r2Key).catch(() => undefined);
	58	+ throw e;
	59	+ }
	60	+}
	61	+
	62	+/** Serve stored bytes as a download that browsers never render inline. */
	63	+export async function serveDownload(c: AppContext, key: string, name: string, contentType: string): Promise<Response> {
	64	+ const obj = await c.env.BUCKET.get(key);
	65	+ if (!obj) throw new HttpError(404, "Not Found");
	66	+ return new Response(obj.body, {
	67	+ headers: {
	68	+ "content-type": contentType \|\| "application/octet-stream",
	69	+ "content-length": String(obj.size),
	70	+ "content-disposition": `attachment; filename="${name.replace(/[^\w.+@~-]+/g, "_")}"; filename*=UTF-8''${encodeURIComponent(name)}`,
	71	+ "content-security-policy": "sandbox",
	72	+ "x-content-type-options": "nosniff",
	73	+ etag: obj.httpEtag,
	74	+ },
	75	+ });
	76	+}
	77	+
	78	+// POST {upload_url}?name=...&label=...: the raw request body is the file (Octokit's uploadReleaseAsset, `gh release upload`).
	79	+files.post("/api/uploads/repos/:owner/:repo/releases/:id/assets", async (c) => {
	80	+ const { stub, caller, repo } = await loadTarget(c, "write");
	81	+ const name = c.req.query("name");
	82	+ if (!name) throw new HttpError(422, "the name query parameter is required", { errors: [{ resource: "ReleaseAsset", code: "missing_field", field: "name" }] });
	83	+ const body = c.req.raw.body;
	84	+ if (!body) throw new HttpError(422, "the request body is the asset's content");
	85	+ const len = c.req.header("content-length");
	86	+ const length = len !== undefined && /^\d+$/.test(len) ? Number(len) : null;
	87	+ const asset = await storeAsset(c.env, stub, intParam(c, "id"), { name, label: c.req.query("label") ?? undefined, contentType: c.req.header("content-type") }, { stream: body, length }, caller);
	88	+ const release = await stub.getRelease(intParam(c, "id"), caller);
	89	+ return c.json(ghAsset(baseOf(c), repo.owner_login, repo.name, release.tagName, asset), 201);
	90	+});
	91	+
	92	+// Browser download of a release asset: /<owner>/<repo>/releases/download/<tag>/<name> (tags may contain slashes).
	93	+files.get("/:owner/:repo/releases/download/*", async (c) => {
	94	+ const { stub, caller } = await loadTarget(c);
	95	+ const rest = c.req.path.split("/releases/download/")[1] ?? "";
	96	+ const cut = rest.lastIndexOf("/");
	97	+ if (cut <= 0) throw new HttpError(404, "Not Found");
	98	+ const tag = decodePath(rest.slice(0, cut));
	99	+ const name = decodePath(rest.slice(cut + 1));
	100	+ const d = await stub.releaseDownload({ tag, name }, caller);
	101	+ return serveDownload(c, d.r2Key, d.name, d.contentType);
	102	+});
	103	+
	104	+/** A source archive of `ref` (built once per commit and kept in R2). */
	105	+export async function archiveResponse(c: AppContext, stub: Stub, owner: string, repo: string, ref: string, format: "zip" \| "tar.gz"): Promise<Response> {
	106	+ const sha = await stub.resolve(ref \|\| "HEAD");
	107	+ if (!sha) throw new HttpError(404, "Not Found");
	108	+ let key = await stub.archiveKey(sha, format);
	109	+ if (!(await c.env.BUCKET.head(key))) key = (await stub.buildArchive(sha, format)).key;
	110	+ return serveDownload(c, key, `${owner}-${repo}-${sha.slice(0, 7)}.${format}`, format === "zip" ? "application/zip" : "application/gzip");
	111	+}
	112	+
	113	+// /<owner>/<repo>/archive/<ref>.zip and .tar.gz (also refs/heads/<branch>.zip, like GitHub's archive links).
	114	+files.get("/:owner/:repo/archive/*", async (c) => {
	115	+ const { stub, repo } = await loadTarget(c);
	116	+ const spec = decodePath(c.req.path.split("/archive/")[1] ?? "");
	117	+ const m = /^(.+)\.(zip\|tar\.gz)$/.exec(spec);
	118	+ if (!m) throw new HttpError(404, "Not Found");
	119	+ return archiveResponse(c, stub, repo.owner_login, repo.name, m[1]!, m[2] as "zip" \| "tar.gz");
	120	+});
	121	+
	122	+// Letter avatars for `avatar_url`: a coloured square with the login's first letter.
	123	+files.get("/api/avatars/:login", (c) => {
	124	+ const login = c.req.param("login").slice(0, 100);
	125	+ let hash = 0;
	126	+ for (const ch of login) hash = (hash * 31 + ch.charCodeAt(0)) >>> 0;
	127	+ const hue = hash % 360;
	128	+ const letter = (login.match(/[A-Za-z0-9]/)?.[0] ?? "?").toUpperCase();
	129	+ const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="96" height="96" viewBox="0 0 96 96"><rect width="96" height="96" rx="12" fill="hsl(${hue} 55% 45%)"/><text x="48" y="64" font-family="system-ui, sans-serif" font-size="48" font-weight="600" text-anchor="middle" fill="#fff">${letter}</text></svg>`;
	130	+ return c.body(svg, 200, { "content-type": "image/svg+xml", "cache-control": "public, max-age=86400", "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'" });
	131	+});
	132	+

		@@ -1,0 +1,137 @@
	1	+/**
	2	+ * Request-scoped helpers around ./gh.ts: they fetch what the GitHub JSON
	3	+ * builders need (label rows, reactions, people, branch heads) from the
	4	+ * repository Durable Object and the directory in as few calls as possible.
	5	+ */
	6	+import type { AppContext } from "../auth/principal.js";
	7	+import type { Repo } from "../lib/directory.js";
	8	+import { HttpError } from "../lib/util.js";
	9	+import type { Caller, Role } from "../repo/types.js";
	10	+import { loadRepo, type repoStub } from "./common.js";
	11	+import { baseOf, ghIssue, ghPull, ghRepo, type IssueCtx, type IssueLike, type Who } from "./gh.js";
	12	+
	13	+export type Stub = ReturnType<typeof repoStub>;
	14	+
	15	+/**
	16	+ * loadRepo for the `:owner/:repo` in the path. Archived repositories are
	17	+ * read-only for everyone (comments, reactions and settings included), so any
	18	+ * request that isn't a read is refused, whatever role the route needs.
	19	+ */
	20	+export async function loadTarget(c: AppContext, min: Role = "read"): Promise<Awaited<ReturnType<typeof loadRepo>>> {
	21	+ const l = await loadRepo(c, c.req.param("owner") ?? "", c.req.param("repo") ?? "", min);
	22	+ if (l.repo.archived && !["GET", "HEAD", "OPTIONS"].includes(c.req.method)) throw new HttpError(403, "repository is archived (read-only)");
	23	+ return l;
	24	+}
	25	+
	26	+export const repoOut = (c: AppContext, r: Repo, role?: Role \| null) => ghRepo(baseOf(c), r, role);
	27	+
	28	+export const ownerOf = (r: Repo): Who => ({ id: r.owner_id, login: r.owner_login, kind: r.owner_kind });
	29	+
	30	+/** Accounts for a set of logins (assignees, reviewers), so user objects carry real ids and types. */
	31	+export async function peopleFor(c: AppContext, logins: Iterable<string>): Promise<Map<string, Who>> {
	32	+ const out = new Map<string, Who>();
	33	+ const dir = c.get("dir");
	34	+ for (const login of new Set([...logins].map((l) => l.toLowerCase()))) {
	35	+ if (out.size >= 50) break;
	36	+ const a = await dir.accountByLogin(login).catch(() => null);
	37	+ if (a) out.set(login, { id: a.id, login: a.login, kind: a.kind });
	38	+ }
	39	+ return out;
	40	+}
	41	+
	42	+/** Everything ghIssue/ghPull need for `issues`, plus reaction counts for extra `subjects` (comments). */
	43	+export async function issueCtx(c: AppContext, repo: Repo, stub: Stub, issues: IssueLike[], subjects: string[] = []): Promise<IssueCtx> {
	44	+ const extras = await stub.issueExtras(
	45	+ issues.map((i) => i.number),
	46	+ subjects,
	47	+ );
	48	+ const logins = issues.flatMap((i) => [...i.assignees, ...(i.pull?.requestedReviewers ?? []), ...(i.pull?.mergedBy ? [i.pull.mergedBy] : [])]);
	49	+ return {
	50	+ base: baseOf(c),
	51	+ owner: repo.owner_login,
	52	+ repo: repo.name,
	53	+ repoId: repo.id,
	54	+ labels: new Map(extras.labels.map((l) => [l.name, l])),
	55	+ people: await peopleFor(c, logins),
	56	+ reactions: extras.reactions,
	57	+ lockReasons: extras.lockReasons,
	58	+ };
	59	+}
	60	+
	61	+export async function issuesOut(c: AppContext, repo: Repo, stub: Stub, issues: IssueLike[]) {
	62	+ const x = await issueCtx(c, repo, stub, issues);
	63	+ return issues.map((i) => ghIssue(x, i));
	64	+}
	65	+
	66	+export async function pullsOut(c: AppContext, repo: Repo, stub: Stub, issues: IssueLike[]) {
	67	+ const x = await issueCtx(c, repo, stub, issues);
	68	+ const heads = new Map((await stub.branches()).map((b) => [b.name, b.sha]));
	69	+ const repoJson = ghRepo(x.base, repo);
	70	+ return issues.map((i) => ghPull(x, i, repoJson, ownerOf(repo), heads.get(i.pull!.base) ?? null));
	71	+}
	72	+
	73	+// ---------------------------------------------------------------- small request helpers for the route files
	74	+
	75	+export async function jsonBody<T>(c: AppContext, optional = false): Promise<T> {
	76	+ const text = await c.req.text();
	77	+ if (!text.trim() && optional) return {} as T;
	78	+ try {
	79	+ const v = JSON.parse(text) as unknown;
	80	+ if (!v \|\| typeof v !== "object") throw new Error("not an object");
	81	+ return v as T;
	82	+ } catch {
	83	+ throw new HttpError(400, "Problems parsing JSON");
	84	+ }
	85	+}
	86	+
	87	+/**
	88	+ * Decode one piece of the request path. Hono leaves `%25` (and other reserved
	89	+ * escapes) in c.req.path, so this is the only decoding a path piece needs;
	90	+ * route params from c.req.param() are already decoded and must not go through it.
	91	+ */
	92	+export function decodePath(raw: string): string {
	93	+ try {
	94	+ return decodeURIComponent(raw);
	95	+ } catch {
	96	+ throw new HttpError(400, "malformed percent-encoding in the URL");
	97	+ }
	98	+}
	99	+
	100	+export const repoParams = (c: AppContext) => ({ owner: c.req.param("owner")!, repo: c.req.param("repo")! });
	101	+
	102	+export function intParam(c: AppContext, name: string): number {
	103	+ const n = Number(c.req.param(name));
	104	+ if (!Number.isSafeInteger(n) \|\| n < 1) throw new HttpError(404, "Not Found");
	105	+ return n;
	106	+}
	107	+
	108	+/** GitHub's mergeable_state for Diffinery's mergeability state. */
	109	+export const mergeableState = (s: string): string => (s === "conflicting" ? "dirty" : s === "merged" \|\| s === "closed" ? "unknown" : s);
	110	+
	111	+/** A single pull request with mergeability (GitHub fields plus Diffinery's merge_blockers, approvals and checks). */
	112	+export async function pullDetail(c: AppContext, repo: Repo, stub: Stub, number: number, caller: Caller) {
	113	+ const { issue, comments } = await stub.issue(number);
	114	+ if (issue.kind !== "pull") throw new HttpError(404, "not a pull request");
	115	+ const [pull] = await pullsOut(c, repo, stub, [issue]);
	116	+ const m = await stub.mergeability(number, caller);
	117	+ const open = issue.state === "open";
	118	+ const commits = open \|\| issue.pull!.merged ? (await stub.pullCommits(number)).length : 0;
	119	+ const files = await stub.pullFiles(number).catch(() => null);
	120	+ return {
	121	+ ...pull!,
	122	+ mergeable: open ? m.conflicts.length === 0 : null,
	123	+ mergeable_state: mergeableState(m.state),
	124	+ rebaseable: open ? m.conflicts.length === 0 && m.mergeBase === (await stub.resolve(issue.pull!.base)) : null,
	125	+ review_comments: comments.filter((x) => x.reviewId).length,
	126	+ commits,
	127	+ additions: files?.additions ?? 0,
	128	+ deletions: files?.deletions ?? 0,
	129	+ changed_files: files?.totalFiles ?? 0,
	130	+ // Diffinery: why the pull request can't be merged yet, and what it is waiting for.
	131	+ merge_blockers: m.blockers,
	132	+ approvals: m.approvals,
	133	+ required_approvals: m.requiredApprovals,
	134	+ checks: m.checks,
	135	+ merge_queue: m.mergeQueue,
	136	+ };
	137	+}

		@@ -1,0 +1,193 @@
	1	+import { Hono } from "hono";
	2	+import type { Env } from "../env.js";
	3	+import type { AppContext, AppVars } from "../auth/principal.js";
	4	+import { HttpError, b64, fromB64 } from "../lib/util.js";
	5	+import type { SigInput, TreeInput } from "../repo/gitdata.js";
	6	+import { loadRepo } from "./common.js";
	7	+import { archiveResponse } from "./files.js";
	8	+import { baseOf, encPath, ghCommit, ghGitCommit, ghRef, nodeId, paginate, repoApi, repoHtml, sigJson } from "./gh.js";
	9	+import { jsonBody, loadTarget, repoParams } from "./ghctx.js";
	10	+
	11	+/**
	12	+ * Git data API (blobs, trees, commits, annotated tags, refs) and the
	13	+ * repository extras next to it: README, merges, languages and archives.
	14	+ */
	15	+export const gitdata = new Hono<{ Bindings: Env; Variables: AppVars }>();
	16	+
	17	+const R = "/repos/:owner/:repo";
	18	+const api = (c: AppContext) => repoApi(baseOf(c), repoParams(c).owner, repoParams(c).repo);
	19	+const wantsRaw = (c: AppContext) => /application\/vnd\.github(\.v3)?\.raw/.test(c.req.header("accept") ?? "");
	20	+const base64Lines = (bytes: Uint8Array) => b64(bytes).replace(/(.{60})/g, "$1\n");
	21	+
	22	+// ---------------------------------------------------------------- blobs
	23	+
	24	+gitdata.post(`${R}/git/blobs`, async (c) => {
	25	+ const { stub, caller } = await loadTarget(c, "write");
	26	+ const b = await jsonBody<{ content?: string; encoding?: string }>(c);
	27	+ if (typeof b.content !== "string") throw new HttpError(422, "content is required", { errors: [{ resource: "Blob", code: "missing_field", field: "content" }] });
	28	+ const encoding = (b.encoding ?? "utf-8").toLowerCase();
	29	+ let bytes: Uint8Array;
	30	+ if (encoding === "base64") {
	31	+ try {
	32	+ bytes = fromB64(b.content.replace(/\s+/g, ""));
	33	+ } catch {
	34	+ throw new HttpError(422, "content is not valid Base64", { errors: [{ resource: "Blob", code: "invalid", field: "content" }] });
	35	+ }
	36	+ } else if (encoding === "utf-8" \|\| encoding === "utf8") bytes = new TextEncoder().encode(b.content);
	37	+ else throw new HttpError(422, "encoding must be utf-8 or base64", { errors: [{ resource: "Blob", code: "invalid", field: "encoding" }] });
	38	+ const blob = await stub.createBlob(bytes, caller);
	39	+ return c.json({ url: `${api(c)}/git/blobs/${blob.sha}`, sha: blob.sha }, 201);
	40	+});
	41	+
	42	+gitdata.get(`${R}/git/blobs/:sha`, async (c) => {
	43	+ const { stub } = await loadTarget(c);
	44	+ const blob = await stub.getBlob(c.req.param("sha"));
	45	+ if (wantsRaw(c)) return new Response(blob.content, { headers: { "content-type": "text/plain; charset=utf-8", "content-security-policy": "sandbox", "x-content-type-options": "nosniff" } });
	46	+ return c.json({ sha: blob.sha, node_id: nodeId("Blob", blob.sha), size: blob.size, url: `${api(c)}/git/blobs/${blob.sha}`, content: base64Lines(blob.content), encoding: "base64" });
	47	+});
	48	+
	49	+// ---------------------------------------------------------------- trees
	50	+
	51	+type Tree = { sha: string; tree: Array<{ path: string; mode: string; type: string; sha: string; size?: number }>; truncated: boolean };
	52	+const treeJson = (c: AppContext, t: Tree) => ({
	53	+ sha: t.sha,
	54	+ url: `${api(c)}/git/trees/${t.sha}`,
	55	+ tree: t.tree.map((e) => ({ ...e, url: `${api(c)}/git/${e.type === "tree" ? "trees" : e.type === "blob" ? "blobs" : "commits"}/${e.sha}` })),
	56	+ truncated: t.truncated,
	57	+});
	58	+
	59	+gitdata.post(`${R}/git/trees`, async (c) => {
	60	+ const { stub, caller } = await loadTarget(c, "write");
	61	+ const b = await jsonBody<{ base_tree?: string; tree?: TreeInput[] }>(c);
	62	+ if (!Array.isArray(b.tree)) throw new HttpError(422, "tree is required", { errors: [{ resource: "Tree", code: "missing_field", field: "tree" }] });
	63	+ if (b.tree.length > 10_000) throw new HttpError(422, "a tree request can change at most 10000 entries");
	64	+ const sha = await stub.createTree(typeof b.base_tree === "string" ? b.base_tree : undefined, b.tree, caller);
	65	+ return c.json(treeJson(c, await stub.getTree(sha, false)), 201);
	66	+});
	67	+
	68	+gitdata.get(`${R}/git/trees/:sha{.+}`, async (c) => {
	69	+ const { stub } = await loadTarget(c);
	70	+ const recursive = !!c.req.query("recursive") && c.req.query("recursive") !== "0" && c.req.query("recursive") !== "false";
	71	+ return c.json(treeJson(c, await stub.getTree(c.req.param("sha"), recursive)));
	72	+});
	73	+
	74	+// ---------------------------------------------------------------- commits
	75	+
	76	+gitdata.post(`${R}/git/commits`, async (c) => {
	77	+ const { stub, caller, repo } = await loadTarget(c, "write");
	78	+ const b = await jsonBody<{ message?: string; tree?: string; parents?: string[]; author?: SigInput; committer?: SigInput; signature?: string }>(c);
	79	+ const commit = await stub.createGitCommit(b, caller);
	80	+ return c.json(ghGitCommit(baseOf(c), repo.owner_login, repo.name, commit), 201);
	81	+});
	82	+
	83	+gitdata.get(`${R}/git/commits/:sha`, async (c) => {
	84	+ const { stub, repo } = await loadTarget(c);
	85	+ return c.json(ghGitCommit(baseOf(c), repo.owner_login, repo.name, await stub.gitCommit(c.req.param("sha"))));
	86	+});
	87	+
	88	+// ---------------------------------------------------------------- annotated tags
	89	+
	90	+type Tag = Awaited<ReturnType<Awaited<ReturnType<typeof loadRepo>>["stub"]["gitTag"]>>;
	91	+const tagJson = (c: AppContext, t: Tag) => ({
	92	+ node_id: nodeId("Tag", t.sha),
	93	+ tag: t.tag,
	94	+ sha: t.sha,
	95	+ url: `${api(c)}/git/tags/${t.sha}`,
	96	+ message: t.message,
	97	+ tagger: t.tagger ? sigJson(t.tagger) : null,
	98	+ object: { type: t.object.type, sha: t.object.sha, url: `${api(c)}/git/${t.object.type}s/${t.object.sha}` },
	99	+ verification: { verified: false, reason: "unsigned", signature: null, payload: null, verified_at: null },
	100	+});
	101	+
	102	+gitdata.post(`${R}/git/tags`, async (c) => {
	103	+ const { stub, caller } = await loadTarget(c, "write");
	104	+ const b = await jsonBody<{ tag?: string; message?: string; object?: string; type?: string; tagger?: SigInput }>(c);
	105	+ return c.json(tagJson(c, await stub.createGitTag(b, caller)), 201);
	106	+});
	107	+
	108	+gitdata.get(`${R}/git/tags/:sha`, async (c) => {
	109	+ const { stub } = await loadTarget(c);
	110	+ return c.json(tagJson(c, await stub.gitTag(c.req.param("sha"))));
	111	+});
	112	+
	113	+// ---------------------------------------------------------------- refs (single, matching, all)
	114	+
	115	+gitdata.get(`${R}/git/ref/:ref{.+}`, async (c) => {
	116	+ const { stub, repo } = await loadTarget(c);
	117	+ const name = `refs/${c.req.param("ref")}`;
	118	+ const r = (await stub.refsWithTypes(name)).find((x) => x.ref === name);
	119	+ if (!r) throw new HttpError(404, "Not Found");
	120	+ return c.json(ghRef(baseOf(c), repo.owner_login, repo.name, r));
	121	+});
	122	+
	123	+gitdata.get(`${R}/git/matching-refs/:ref{.*}`, async (c) => {
	124	+ const { stub, repo } = await loadTarget(c);
	125	+ const prefix = `refs/${(c.req.param("ref") ?? "")}`;
	126	+ const list = (await stub.refsWithTypes(prefix)).filter((r) => !r.ref.startsWith("refs/pull/") \|\| prefix.startsWith("refs/pull/"));
	127	+ return c.json(paginate(c, list.map((r) => ghRef(baseOf(c), repo.owner_login, repo.name, r)), 100));
	128	+});
	129	+
	130	+gitdata.get(`${R}/git/refs`, async (c) => {
	131	+ const { stub, repo } = await loadTarget(c);
	132	+ const list = (await stub.refsWithTypes("refs/")).filter((r) => !r.ref.startsWith("refs/pull/"));
	133	+ return c.json(paginate(c, list.map((r) => ghRef(baseOf(c), repo.owner_login, repo.name, r)), 100));
	134	+});
	135	+
	136	+// ---------------------------------------------------------------- README
	137	+
	138	+async function readme(c: AppContext) {
	139	+ const { stub, repo } = await loadTarget(c);
	140	+ const ref = c.req.query("ref") \|\| repo.default_branch;
	141	+ const dir = (c.req.param("dir") ?? "").replace(/^\/+\|\/+$/g, "");
	142	+ const r = await stub.readme(ref, dir);
	143	+ if (!r) throw new HttpError(404, "Not Found");
	144	+ if (wantsRaw(c)) return new Response(r.content, { headers: { "content-type": "text/plain; charset=utf-8", "x-content-type-options": "nosniff", "content-security-policy": "sandbox" } });
	145	+ const html = repoHtml(baseOf(c), repo.owner_login, repo.name);
	146	+ const self = `${api(c)}/contents/${encPath(r.path)}?ref=${encodeURIComponent(ref)}`;
	147	+ const git = `${api(c)}/git/blobs/${r.sha}`;
	148	+ const htmlUrl = `${html}/blob/${encPath(ref)}/${encPath(r.path)}`;
	149	+ return c.json({
	150	+ type: "file",
	151	+ encoding: "base64",
	152	+ size: r.size,
	153	+ name: r.path.split("/").pop(),
	154	+ path: r.path,
	155	+ content: base64Lines(r.content),
	156	+ sha: r.sha,
	157	+ url: self,
	158	+ git_url: git,
	159	+ html_url: htmlUrl,
	160	+ download_url: `${html}/raw/${encPath(ref)}/${encPath(r.path)}`,
	161	+ _links: { self, git, html: htmlUrl },
	162	+ });
	163	+}
	164	+gitdata.get(`${R}/readme`, readme);
	165	+gitdata.get(`${R}/readme/:dir{.+}`, readme);
	166	+
	167	+// ---------------------------------------------------------------- merges, languages, archives
	168	+
	169	+gitdata.post(`${R}/merges`, async (c) => {
	170	+ const { stub, caller, repo } = await loadTarget(c, "write");
	171	+ const b = await jsonBody<{ base?: string; head?: string; commit_message?: string }>(c);
	172	+ if (typeof b.base !== "string" \|\| typeof b.head !== "string") throw new HttpError(422, "base and head are required", { errors: [{ resource: "Merge", code: "missing_field", field: typeof b.base !== "string" ? "base" : "head" }] });
	173	+ const commit = await stub.mergeBranches(b, caller);
	174	+ if (!commit) return c.body(null, 204);
	175	+ return c.json(ghCommit(baseOf(c), repo.owner_login, repo.name, commit), 201);
	176	+});
	177	+
	178	+gitdata.get(`${R}/languages`, async (c) => {
	179	+ const { stub } = await loadTarget(c);
	180	+ return c.json(await stub.languages());
	181	+});
	182	+
	183	+for (const [path, format] of [
	184	+ ["zipball", "zip"],
	185	+ ["tarball", "tar.gz"],
	186	+] as const) {
	187	+ const handler = async (c: AppContext) => {
	188	+ const { stub, repo } = await loadTarget(c);
	189	+ return archiveResponse(c, stub, repo.owner_login, repo.name, (c.req.param("ref") ?? "") \|\| repo.default_branch, format);
	190	+ };
	191	+ gitdata.get(`${R}/${path}`, handler);
	192	+ gitdata.get(`${R}/${path}/:ref{.+}`, handler);
	193	+}

		@@ -1,0 +1,335 @@
	1	+import { Hono } from "hono";
	2	+import type { Env } from "../env.js";
	3	+import type { AppContext, AppVars } from "../auth/principal.js";
	4	+import type { Repo } from "../lib/directory.js";
	5	+import { HttpError } from "../lib/util.js";
	6	+import type { IssueEvent, Reaction } from "../repo/social.js";
	7	+import { baseOf, ghComment, ghIssue, ghLabel, ghReview, ghReviewComment, ghUser, isoSeconds, nodeId, pageOf, paginate, repoApi, setLinks, type IssueCtx } from "./gh.js";
	8	+import { intParam, issueCtx, jsonBody, loadTarget, pullsOut, repoParams, type Stub } from "./ghctx.js";
	9	+
	10	+/**
	11	+ * Issue and pull request sub-resources bots and workflows use: labels and
	12	+ * assignees on one issue, single and repository-wide comments, locking,
	13	+ * reactions, events and timelines, review comment replies, dismissing reviews,
	14	+ * removing requested reviewers and updating a pull request's branch.
	15	+ */
	16	+export const issues = new Hono<{ Bindings: Env; Variables: AppVars }>();
	17	+
	18	+const R = "/repos/:owner/:repo";
	19	+const load = (c: AppContext, min: "read" \| "triage" \| "write" = "read") => loadTarget(c, min);
	20	+const labelJson = (c: AppContext, repo: Repo, l: { id?: number; name: string; color?: string; description?: string }) => ghLabel(baseOf(c), repo.owner_login, repo.name, l);
	21	+const names = (v: unknown): string[] => {
	22	+ const list = Array.isArray(v) ? v : v && typeof v === "object" && Array.isArray((v as { labels?: unknown }).labels) ? (v as { labels: unknown[] }).labels : null;
	23	+ if (!list) throw new HttpError(422, "labels must be an array of names", { errors: [{ resource: "Label", code: "invalid", field: "labels" }] });
	24	+ return list.map((l) => (typeof l === "string" ? l : String((l as { name?: unknown })?.name ?? ""))).filter(Boolean);
	25	+};
	26	+
	27	+// ---------------------------------------------------------------- labels
	28	+
	29	+issues.get(`${R}/labels/:name`, async (c) => {
	30	+ const { stub, repo } = await load(c);
	31	+ return c.json(labelJson(c, repo, await stub.label(c.req.param("name"))));
	32	+});
	33	+issues.patch(`${R}/labels/:name`, async (c) => {
	34	+ const { stub, caller, repo } = await load(c, "triage");
	35	+ const b = await jsonBody<{ new_name?: string; color?: string; description?: string }>(c);
	36	+ return c.json(labelJson(c, repo, await stub.updateLabel(c.req.param("name"), b, caller)));
	37	+});
	38	+issues.delete(`${R}/labels/:name`, async (c) => {
	39	+ const { stub, caller } = await load(c, "triage");
	40	+ await stub.deleteLabel(c.req.param("name"), caller);
	41	+ return c.body(null, 204);
	42	+});
	43	+
	44	+issues.get(`${R}/issues/:number/labels`, async (c) => {
	45	+ const { stub, repo } = await load(c);
	46	+ return c.json(paginate(c, (await stub.issueLabels(intParam(c, "number"))).map((l) => labelJson(c, repo, l))));
	47	+});
	48	+issues.post(`${R}/issues/:number/labels`, async (c) => {
	49	+ const { stub, caller, repo } = await load(c, "triage");
	50	+ const list = await stub.addIssueLabels(intParam(c, "number"), names(await jsonBody(c)), caller);
	51	+ return c.json(list.map((l) => labelJson(c, repo, l)));
	52	+});
	53	+issues.put(`${R}/issues/:number/labels`, async (c) => {
	54	+ const { stub, caller, repo } = await load(c, "triage");
	55	+ const list = await stub.setIssueLabels(intParam(c, "number"), names(await jsonBody(c, true)), caller);
	56	+ return c.json(list.map((l) => labelJson(c, repo, l)));
	57	+});
	58	+issues.delete(`${R}/issues/:number/labels`, async (c) => {
	59	+ const { stub, caller } = await load(c, "triage");
	60	+ await stub.setIssueLabels(intParam(c, "number"), [], caller);
	61	+ return c.body(null, 204);
	62	+});
	63	+issues.delete(`${R}/issues/:number/labels/:name`, async (c) => {
	64	+ const { stub, caller, repo } = await load(c, "triage");
	65	+ const list = await stub.removeIssueLabel(intParam(c, "number"), c.req.param("name"), caller);
	66	+ return c.json(list.map((l) => labelJson(c, repo, l)));
	67	+});
	68	+
	69	+// ---------------------------------------------------------------- assignees and locking
	70	+
	71	+const oneIssue = async (c: AppContext, repo: Repo, stub: Stub, n: number) => {
	72	+ const { issue } = await stub.issue(n);
	73	+ return ghIssue(await issueCtx(c, repo, stub, [issue]), issue);
	74	+};
	75	+
	76	+issues.post(`${R}/issues/:number/assignees`, async (c) => {
	77	+ const { stub, caller, repo } = await load(c, "triage");
	78	+ const n = intParam(c, "number");
	79	+ const b = await jsonBody<{ assignees?: unknown }>(c);
	80	+ await stub.assignIssue(n, Array.isArray(b.assignees) ? b.assignees.map(String) : [], true, caller);
	81	+ return c.json(await oneIssue(c, repo, stub, n), 201);
	82	+});
	83	+issues.delete(`${R}/issues/:number/assignees`, async (c) => {
	84	+ const { stub, caller, repo } = await load(c, "triage");
	85	+ const n = intParam(c, "number");
	86	+ const b = await jsonBody<{ assignees?: unknown }>(c, true);
	87	+ await stub.assignIssue(n, Array.isArray(b.assignees) ? b.assignees.map(String) : [], false, caller);
	88	+ return c.json(await oneIssue(c, repo, stub, n));
	89	+});
	90	+issues.get(`${R}/assignees`, async (c) => {
	91	+ const { repo } = await load(c);
	92	+ const people = (await c.get("dir").collaborators(repo.id)).filter((x) => x.role !== "read").map((x) => ghUser(baseOf(c), x.account));
	93	+ const owner = ghUser(baseOf(c), { id: repo.owner_id, login: repo.owner_login, kind: repo.owner_kind });
	94	+ return c.json(paginate(c, repo.owner_kind === "org" \|\| people.some((p) => p?.login === owner?.login) ? people : [owner, ...people]));
	95	+});
	96	+issues.get(`${R}/assignees/:login`, async (c) => {
	97	+ const { repo } = await load(c);
	98	+ const login = c.req.param("login").toLowerCase();
	99	+ if (login === repo.owner_login.toLowerCase()) return c.body(null, 204);
	100	+ const ok = (await c.get("dir").collaborators(repo.id)).some((x) => x.account.login.toLowerCase() === login && x.role !== "read");
	101	+ if (!ok) throw new HttpError(404, "Not Found");
	102	+ return c.body(null, 204);
	103	+});
	104	+
	105	+issues.put(`${R}/issues/:number/lock`, async (c) => {
	106	+ const { stub, caller } = await load(c, "triage");
	107	+ const b = await jsonBody<{ lock_reason?: string }>(c, true);
	108	+ await stub.lockIssue(intParam(c, "number"), b.lock_reason ?? null, caller);
	109	+ return c.body(null, 204);
	110	+});
	111	+issues.delete(`${R}/issues/:number/lock`, async (c) => {
	112	+ const { stub, caller } = await load(c, "triage");
	113	+ await stub.unlockIssue(intParam(c, "number"), caller);
	114	+ return c.body(null, 204);
	115	+});
	116	+
	117	+// ---------------------------------------------------------------- comments (repository-wide and single)
	118	+
	119	+issues.get(`${R}/issues/comments`, async (c) => {
	120	+ const { stub, repo } = await load(c);
	121	+ const p = pageOf(c);
	122	+ const res = await stub.repoComments({ review: false, since: c.req.query("since"), sort: c.req.query("sort"), direction: c.req.query("direction"), limit: p.perPage, offset: p.offset });
	123	+ setLinks(c, p, res.total);
	124	+ const x = await issueCtx(c, repo, stub, [], res.items.map((i) => `comment:${i.comment.id}`));
	125	+ return c.json(res.items.map((i) => ghComment(x, i.number, i.isPull, i.comment)));
	126	+});
	127	+issues.get(`${R}/issues/comments/:id`, async (c) => {
	128	+ const { stub, repo } = await load(c);
	129	+ const found = await stub.comment(c.req.param("id"));
	130	+ return c.json(ghComment(await issueCtx(c, repo, stub, [], [`comment:${found.comment.id}`]), found.number, found.isPull, found.comment));
	131	+});
	132	+issues.delete(`${R}/issues/comments/:id`, async (c) => {
	133	+ const { stub, caller } = await load(c);
	134	+ await stub.deleteComment(c.req.param("id"), false, caller);
	135	+ return c.body(null, 204);
	136	+});
	137	+
	138	+// ---------------------------------------------------------------- pull request review comments
	139	+
	140	+issues.get(`${R}/pulls/comments`, async (c) => {
	141	+ const { stub, repo } = await load(c);
	142	+ const p = pageOf(c);
	143	+ const res = await stub.repoComments({ review: true, since: c.req.query("since"), sort: c.req.query("sort"), direction: c.req.query("direction"), limit: p.perPage, offset: p.offset });
	144	+ setLinks(c, p, res.total);
	145	+ const x = await issueCtx(c, repo, stub, [], res.items.map((i) => `review_comment:${i.comment.id}`));
	146	+ return c.json(res.items.map((i) => ghReviewComment(x, i.number, i.comment)));
	147	+});
	148	+issues.get(`${R}/pulls/comments/:id`, async (c) => {
	149	+ const { stub, repo } = await load(c);
	150	+ const found = await stub.comment(c.req.param("id"), true);
	151	+ return c.json(ghReviewComment(await issueCtx(c, repo, stub, [], [`review_comment:${found.comment.id}`]), found.number, found.comment));
	152	+});
	153	+issues.patch(`${R}/pulls/comments/:id`, async (c) => {
	154	+ const { stub, caller, repo } = await load(c);
	155	+ const b = await jsonBody<{ body?: string }>(c);
	156	+ if (typeof b.body !== "string" \|\| !b.body.trim()) throw new HttpError(422, "body is required", { errors: [{ resource: "PullRequestReviewComment", code: "missing_field", field: "body" }] });
	157	+ await stub.comment(c.req.param("id"), true);
	158	+ await stub.editComment(c.req.param("id"), b.body, caller);
	159	+ const found = await stub.comment(c.req.param("id"), true);
	160	+ return c.json(ghReviewComment(await issueCtx(c, repo, stub, []), found.number, found.comment));
	161	+});
	162	+issues.delete(`${R}/pulls/comments/:id`, async (c) => {
	163	+ const { stub, caller } = await load(c);
	164	+ await stub.deleteComment(c.req.param("id"), true, caller);
	165	+ return c.body(null, 204);
	166	+});
	167	+issues.post(`${R}/pulls/:number/comments`, async (c) => {
	168	+ const { stub, caller, repo } = await load(c);
	169	+ const n = intParam(c, "number");
	170	+ const b = await jsonBody<{ body?: string; commit_id?: string; path?: string; line?: number; position?: number; side?: "LEFT" \| "RIGHT"; in_reply_to?: string \| number }>(c);
	171	+ const cm = await stub.createReviewComment(n, { ...b, in_reply_to: b.in_reply_to === undefined ? undefined : String(b.in_reply_to) }, caller);
	172	+ return c.json(ghReviewComment(await issueCtx(c, repo, stub, []), n, cm), 201);
	173	+});
	174	+issues.post(`${R}/pulls/:number/comments/:id/replies`, async (c) => {
	175	+ const { stub, caller, repo } = await load(c);
	176	+ const n = intParam(c, "number");
	177	+ const b = await jsonBody<{ body?: string }>(c);
	178	+ const cm = await stub.createReviewComment(n, { body: b.body, in_reply_to: c.req.param("id") }, caller);
	179	+ return c.json(ghReviewComment(await issueCtx(c, repo, stub, []), n, cm), 201);
	180	+});
	181	+
	182	+// ---------------------------------------------------------------- reviews and reviewers
	183	+
	184	+issues.get(`${R}/pulls/:number/reviews/:id`, async (c) => {
	185	+ const { stub, repo } = await load(c);
	186	+ const n = intParam(c, "number");
	187	+ return c.json(ghReview(await issueCtx(c, repo, stub, []), n, await stub.review(n, c.req.param("id"))));
	188	+});
	189	+issues.put(`${R}/pulls/:number/reviews/:id/dismissals`, async (c) => {
	190	+ const { stub, caller, repo } = await load(c, "write");
	191	+ const n = intParam(c, "number");
	192	+ const b = await jsonBody<{ message?: string; event?: string }>(c);
	193	+ if (typeof b.message !== "string" \|\| !b.message.trim()) throw new HttpError(422, "message is required", { errors: [{ resource: "PullRequestReview", code: "missing_field", field: "message" }] });
	194	+ return c.json(ghReview(await issueCtx(c, repo, stub, []), n, await stub.dismissReview(n, c.req.param("id"), b.message, caller)));
	195	+});
	196	+issues.get(`${R}/pulls/:number/requested_reviewers`, async (c) => {
	197	+ const { stub, repo } = await load(c);
	198	+ const { issue } = await stub.issue(intParam(c, "number"));
	199	+ if (!issue.pull) throw new HttpError(404, "Not Found");
	200	+ const [pull] = await pullsOut(c, repo, stub, [issue]);
	201	+ return c.json({ users: pull!.requested_reviewers, teams: [] });
	202	+});
	203	+issues.delete(`${R}/pulls/:number/requested_reviewers`, async (c) => {
	204	+ const { stub, caller, repo } = await load(c);
	205	+ const n = intParam(c, "number");
	206	+ const b = await jsonBody<{ reviewers?: unknown }>(c, true);
	207	+ await stub.removeReviewers(n, Array.isArray(b.reviewers) ? b.reviewers.map(String) : [], caller);
	208	+ return c.json((await pullsOut(c, repo, stub, [(await stub.issue(n)).issue]))[0]);
	209	+});
	210	+issues.put(`${R}/pulls/:number/update-branch`, async (c) => {
	211	+ const { stub, caller } = await load(c, "write");
	212	+ const n = intParam(c, "number");
	213	+ const b = await jsonBody<{ expected_head_sha?: string }>(c, true);
	214	+ await stub.updatePullBranch(n, b.expected_head_sha, caller);
	215	+ return c.json({ message: "Updating pull request branch.", url: `${repoApi(baseOf(c), repoParams(c).owner, repoParams(c).repo)}/pulls/${n}` }, 202);
	216	+});
	217	+issues.get(`${R}/commits/:sha/pulls`, async (c) => {
	218	+ const { stub, repo } = await load(c);
	219	+ const sha = await stub.resolve(c.req.param("sha"));
	220	+ if (!sha) throw new HttpError(422, `No commit found for SHA: ${c.req.param("sha")}`);
	221	+ const numbers = paginate(c, await stub.pullsForCommit(sha));
	222	+ const list = [];
	223	+ for (const n of numbers) list.push((await stub.issue(n)).issue);
	224	+ return c.json(await pullsOut(c, repo, stub, list));
	225	+});
	226	+
	227	+// ---------------------------------------------------------------- reactions
	228	+
	229	+function reactionJson(c: AppContext, r: Reaction) {
	230	+ return { id: r.id, node_id: nodeId("Reaction", r.id), user: ghUser(baseOf(c), r.user), content: r.content, created_at: isoSeconds(r.createdAt) };
	231	+}
	232	+
	233	+type Loaded = Awaited<ReturnType<typeof load>>;
	234	+
	235	+/** Reaction routes for one kind of subject; `subject` maps the path to `issue:N`, `comment:ID`, ... and `visible` checks the caller may see it. */
	236	+function reactionRoutes(path: string, subject: (c: AppContext) => string, visible?: (c: AppContext, r: Loaded) => Promise<unknown>) {
	237	+ const open = async (c: AppContext) => {
	238	+ const r = await load(c);
	239	+ if (visible) await visible(c, r);
	240	+ return r;
	241	+ };
	242	+ issues.get(`${R}/${path}/reactions`, async (c) => {
	243	+ const { stub } = await open(c);
	244	+ return c.json(paginate(c, (await stub.reactions(subject(c), c.req.query("content") \|\| undefined)).map((r) => reactionJson(c, r))));
	245	+ });
	246	+ issues.post(`${R}/${path}/reactions`, async (c) => {
	247	+ const { stub, caller } = await open(c);
	248	+ const b = await jsonBody<{ content?: string }>(c);
	249	+ const r = await stub.react(subject(c), String(b.content ?? ""), caller);
	250	+ return c.json(reactionJson(c, r.reaction), r.created ? 201 : 200);
	251	+ });
	252	+ issues.delete(`${R}/${path}/reactions/:reaction`, async (c) => {
	253	+ const { stub, caller } = await open(c);
	254	+ await stub.unreact(subject(c), intParam(c, "reaction"), caller);
	255	+ return c.body(null, 204);
	256	+ });
	257	+}
	258	+reactionRoutes("issues/comments/:id", (c) => `comment:${c.req.param("id")}`);
	259	+reactionRoutes("pulls/comments/:id", (c) => `review_comment:${c.req.param("id")}`);
	260	+reactionRoutes("issues/:number", (c) => `issue:${intParam(c, "number")}`);
	261	+// Draft releases are hidden from readers, and so are their reactions.
	262	+reactionRoutes("releases/:id", (c) => `release:${intParam(c, "id")}`, (c, r) => r.stub.getRelease(intParam(c, "id"), r.caller));
	263	+
	264	+// ---------------------------------------------------------------- events and timeline
	265	+
	266	+function eventJson(x: IssueCtx, e: IssueEvent, withIssue?: ReturnType<typeof ghIssue>): Record<string, unknown> {
	267	+ const api = repoApi(x.base, x.owner, x.repo);
	268	+ const d = JSON.parse(e.detail) as Record<string, unknown>;
	269	+ const commit = typeof d.commit_id === "string" ? d.commit_id : null;
	270	+ const person = (login: unknown) => (typeof login === "string" ? ghUser(x.base, x.people?.get(login.toLowerCase()) ?? { id: login, login }) : undefined);
	271	+ return {
	272	+ id: e.id,
	273	+ node_id: nodeId("IssueEvent", `${x.repoId}/${e.id}`),
	274	+ url: `${api}/issues/events/${e.id}`,
	275	+ actor: ghUser(x.base, e.actor),
	276	+ event: e.event,
	277	+ commit_id: commit,
	278	+ commit_url: commit ? `${api}/commits/${commit}` : null,
	279	+ created_at: isoSeconds(e.createdAt),
	280	+ performed_via_github_app: null,
	281	+ ...(d.label ? { label: d.label } : {}),
	282	+ ...(d.assignee ? { assignee: person(d.assignee), assigner: ghUser(x.base, e.actor) } : {}),
	283	+ ...(d.rename ? { rename: d.rename } : {}),
	284	+ ...("lock_reason" in d ? { lock_reason: d.lock_reason ?? null } : {}),
	285	+ ...(d.requested_reviewer ? { requested_reviewer: person(d.requested_reviewer), review_requester: ghUser(x.base, e.actor) } : {}),
	286	+ ...(d.dismissed_review ? { dismissed_review: d.dismissed_review } : {}),
	287	+ ...(d.state_reason ? { state_reason: d.state_reason } : {}),
	288	+ ...(withIssue ? { issue: withIssue } : {}),
	289	+ };
	290	+}
	291	+
	292	+issues.get(`${R}/issues/events`, async (c) => {
	293	+ const { stub, repo } = await load(c);
	294	+ const p = pageOf(c);
	295	+ const res = await stub.repoIssueEvents(p.perPage, p.offset);
	296	+ setLinks(c, p, res.total);
	297	+ const numbers = [...new Set(res.items.map((e) => e.number))];
	298	+ const list = [];
	299	+ for (const n of numbers) list.push((await stub.issue(n)).issue);
	300	+ const x = await issueCtx(c, repo, stub, list);
	301	+ const byNumber = new Map(list.map((i) => [i.number, ghIssue(x, i)]));
	302	+ return c.json(res.items.map((e) => eventJson(x, e, byNumber.get(e.number))));
	303	+});
	304	+issues.get(`${R}/issues/events/:id`, async (c) => {
	305	+ const { stub, repo } = await load(c);
	306	+ const e = await stub.issueEvent(intParam(c, "id"));
	307	+ const { issue } = await stub.issue(e.number);
	308	+ const x = await issueCtx(c, repo, stub, [issue]);
	309	+ return c.json(eventJson(x, e, ghIssue(x, issue)));
	310	+});
	311	+issues.get(`${R}/issues/:number/events`, async (c) => {
	312	+ const { stub, repo } = await load(c);
	313	+ const x = await issueCtx(c, repo, stub, []);
	314	+ return c.json(paginate(c, (await stub.issueEvents(intParam(c, "number"))).map((e) => eventJson(x, e))));
	315	+});
	316	+issues.get(`${R}/issues/:number/timeline`, async (c) => {
	317	+ const { stub, repo } = await load(c);
	318	+ const n = intParam(c, "number");
	319	+ const { issue } = await stub.issue(n);
	320	+ const items = await stub.issueTimeline(n);
	321	+ const x = await issueCtx(c, repo, stub, [], items.flatMap((i) => (i.kind === "comment" ? [`comment:${i.comment.id}`] : [])));
	322	+ const isPull = issue.kind === "pull";
	323	+ return c.json(
	324	+ paginate(
	325	+ c,
	326	+ items.map((i) =>
	327	+ i.kind === "event"
	328	+ ? eventJson(x, i)
	329	+ : i.kind === "comment"
	330	+ ? { event: "commented", actor: ghUser(x.base, i.comment.author), ...ghComment(x, n, isPull, i.comment) }
	331	+ : { event: "reviewed", actor: ghUser(x.base, i.review.author), ...ghReview(x, n, i.review), state: i.review.state.toLowerCase() },
	332	+ ),
	333	+ ),
	334	+ );
	335	+});

		@@ -1,0 +1,146 @@
	1	+import { Hono } from "hono";
	2	+import type { Env } from "../env.js";
	3	+import type { AppContext, AppVars } from "../auth/principal.js";
	4	+import { HttpError } from "../lib/util.js";
	5	+import { baseOf, ghRun, isoSeconds, nodeId, repoApi, repoHtml } from "./gh.js";
	6	+import { intParam, jsonBody, loadTarget, repoParams } from "./ghctx.js";
	7	+
	8	+/**
	9	+ * Smaller GitHub endpoints scripts and actions call: rate limits, topics,
	10	+ * repository_dispatch, workflow details, run attempts and log archives, and
	11	+ * the POST/PATCH/GET forms of repository variables.
	12	+ */
	13	+export const misc = new Hono<{ Bindings: Env; Variables: AppVars }>();
	14	+
	15	+const R = "/repos/:owner/:repo";
	16	+const load = (c: AppContext, min: "read" \| "write" \| "admin" = "read") => loadTarget(c, min);
	17	+
	18	+// Diffinery doesn't meter API calls; report a generous, constant budget so clients that check it carry on.
	19	+const LIMIT = 15_000;
	20	+misc.get("/rate_limit", (c) => {
	21	+ const reset = Math.floor(Date.now() / 1000) + 3600;
	22	+ const r = (limit: number) => ({ limit, used: 0, remaining: limit, reset });
	23	+ return c.json({ resources: { core: r(LIMIT), search: r(1000), graphql: r(LIMIT), integration_manifest: r(LIMIT), code_search: r(1000), actions_runner_registration: r(LIMIT) }, rate: r(LIMIT) });
	24	+});
	25	+
	26	+// ---------------------------------------------------------------- topics
	27	+
	28	+misc.get(`${R}/topics`, async (c) => {
	29	+ const { repo } = await load(c);
	30	+ let names: string[] = [];
	31	+ try {
	32	+ names = JSON.parse(repo.topics ?? "[]");
	33	+ } catch {
	34	+ names = [];
	35	+ }
	36	+ return c.json({ names });
	37	+});
	38	+misc.put(`${R}/topics`, async (c) => {
	39	+ const { repo, caller } = await load(c, "admin");
	40	+ const b = await jsonBody<{ names?: unknown }>(c);
	41	+ if (!Array.isArray(b.names)) throw new HttpError(422, "names must be an array", { errors: [{ resource: "Repository", code: "invalid", field: "names" }] });
	42	+ const names = [...new Set(b.names.map((n) => String(n).trim().toLowerCase()).filter(Boolean))];
	43	+ const bad = names.find((n) => !/^[a-z0-9][a-z0-9-]{0,49}$/.test(n));
	44	+ if (bad) throw new HttpError(422, `${bad} is not a valid topic. Topics must start with a lowercase letter or number, consist of 50 characters or less, and can include hyphens.`, { errors: [{ resource: "Repository", code: "invalid", field: "names" }] });
	45	+ if (names.length > 20) throw new HttpError(422, "a repository can have at most 20 topics");
	46	+ await c.get("dir").setTopics(repo.id, names);
	47	+ c.executionCtx.waitUntil(c.get("dir").audit({ actorId: caller.id, actorLogin: caller.login, onBehalfOf: caller.onBehalfOf, action: "repo.topics", target: `${repo.owner_login}/${repo.name}`, detail: { names } }));
	48	+ return c.json({ names });
	49	+});
	50	+
	51	+// ---------------------------------------------------------------- repository_dispatch
	52	+
	53	+misc.post(`${R}/dispatches`, async (c) => {
	54	+ const { stub, caller } = await load(c, "write");
	55	+ const b = await jsonBody<{ event_type?: string; client_payload?: unknown }>(c);
	56	+ if (typeof b.event_type !== "string" \|\| !b.event_type \|\| b.event_type.length > 100) throw new HttpError(422, "event_type is required (at most 100 characters)", { errors: [{ resource: "Repository", code: "invalid", field: "event_type" }] });
	57	+ const payload = b.client_payload ?? {};
	58	+ if (typeof payload !== "object" \|\| Array.isArray(payload)) throw new HttpError(422, "client_payload must be an object");
	59	+ if (Object.keys(payload).length > 10) throw new HttpError(422, "client_payload can have at most 10 top-level properties");
	60	+ if (JSON.stringify(payload).length > 64 * 1024) throw new HttpError(422, "client_payload is too large");
	61	+ await stub.repositoryDispatch(b.event_type, payload as Record<string, unknown>, caller);
	62	+ return c.body(null, 204);
	63	+});
	64	+
	65	+// ---------------------------------------------------------------- workflows
	66	+
	67	+async function findWorkflow(c: AppContext) {
	68	+ const { stub } = await load(c);
	69	+ const id = (c.req.param("workflow") ?? "");
	70	+ const wf = (await stub.workflows()).find((w) => w.path === id \|\| w.path.endsWith(`/${id}`));
	71	+ if (!wf) throw new HttpError(404, "Not Found");
	72	+ return { stub, wf };
	73	+}
	74	+
	75	+misc.get(`${R}/actions/workflows/:workflow`, async (c) => {
	76	+ const { wf } = await findWorkflow(c);
	77	+ const b = baseOf(c);
	78	+ const { owner, repo } = repoParams(c);
	79	+ const now = isoSeconds(new Date().toISOString());
	80	+ return c.json({
	81	+ id: wf.path,
	82	+ node_id: nodeId("Workflow", `${owner}/${repo}/${wf.path}`),
	83	+ name: wf.name,
	84	+ path: wf.path,
	85	+ state: wf.errors.length ? "invalid" : "active",
	86	+ created_at: now,
	87	+ updated_at: now,
	88	+ url: `${repoApi(b, owner, repo)}/actions/workflows/${encodeURIComponent(wf.path)}`,
	89	+ html_url: `${repoHtml(b, owner, repo)}/blob/HEAD/${wf.path}`,
	90	+ badge_url: `${repoHtml(b, owner, repo)}/workflows/${encodeURIComponent(wf.name)}/badge.svg`,
	91	+ errors: wf.errors,
	92	+ triggers: wf.triggers,
	93	+ });
	94	+});
	95	+
	96	+misc.get(`${R}/actions/workflows/:workflow/runs`, async (c) => {
	97	+ const { stub, wf } = await findWorkflow(c);
	98	+ const perPage = Math.min(Math.max(Number(c.req.query("per_page")) \|\| 30, 1), 100);
	99	+ const page = Math.max(Number(c.req.query("page")) \|\| 1, 1);
	100	+ const res = await stub.runs({ workflow: wf.path, branch: c.req.query("branch"), status: c.req.query("status"), event: c.req.query("event"), sha: c.req.query("head_sha"), limit: perPage, offset: (page - 1) * perPage });
	101	+ return c.json({ total_count: res.total, workflow_runs: res.runs.map((r) => ghRun(baseOf(c), repoParams(c).owner, repoParams(c).repo, r)) });
	102	+});
	103	+
	104	+// ---------------------------------------------------------------- runs: attempts and logs
	105	+
	106	+misc.get(`${R}/actions/runs/:id/attempts/:attempt`, async (c) => {
	107	+ const { stub } = await load(c);
	108	+ const id = await stub.runAttemptId(c.req.param("id"), intParam(c, "attempt"));
	109	+ return c.json(ghRun(baseOf(c), repoParams(c).owner, repoParams(c).repo, await stub.run(id)));
	110	+});
	111	+
	112	+misc.get(`${R}/actions/runs/:id/logs`, async (c) => {
	113	+ const { stub } = await load(c);
	114	+ const zip = await stub.runLogsZip(c.req.param("id"));
	115	+ return new Response(zip, { headers: { "content-type": "application/zip", "content-disposition": `attachment; filename="logs_${c.req.param("id").replace(/[^\w-]/g, "")}.zip"` } });
	116	+});
	117	+
	118	+// ---------------------------------------------------------------- repository variables (GitHub's POST/GET/PATCH forms)
	119	+
	120	+misc.get(`${R}/actions/variables/:name`, async (c) => {
	121	+ const { stub } = await load(c, "write");
	122	+ const name = c.req.param("name").toUpperCase();
	123	+ const vars = await stub.variables();
	124	+ if (!(name in vars)) throw new HttpError(404, "Not Found");
	125	+ return c.json({ name, value: vars[name], created_at: null, updated_at: null });
	126	+});
	127	+misc.post(`${R}/actions/variables`, async (c) => {
	128	+ const { stub } = await load(c, "admin");
	129	+ const b = await jsonBody<{ name?: string; value?: string }>(c);
	130	+ if (typeof b.name !== "string" \|\| typeof b.value !== "string") throw new HttpError(422, "name and value are required", { errors: [{ resource: "ActionsVariable", code: "missing_field", field: typeof b.name !== "string" ? "name" : "value" }] });
	131	+ if (b.name.toUpperCase() in (await stub.variables())) throw new HttpError(409, "Already exists - Variable already exists");
	132	+ await stub.setVariable(b.name, b.value);
	133	+ return c.json({}, 201);
	134	+});
	135	+misc.patch(`${R}/actions/variables/:name`, async (c) => {
	136	+ const { stub } = await load(c, "admin");
	137	+ const name = c.req.param("name");
	138	+ const vars = await stub.variables();
	139	+ if (!(name.toUpperCase() in vars)) throw new HttpError(404, "Not Found");
	140	+ const b = await jsonBody<{ name?: string; value?: string }>(c);
	141	+ const next = typeof b.name === "string" && b.name ? b.name : name;
	142	+ await stub.setVariable(next, typeof b.value === "string" ? b.value : vars[name.toUpperCase()]!);
	143	+ if (next.toUpperCase() !== name.toUpperCase()) await stub.setVariable(name.toUpperCase(), null);
	144	+ return c.body(null, 204);
	145	+});
	146	+

		@@ -1,0 +1,110 @@
	1	+import { Hono } from "hono";
	2	+import type { Env } from "../env.js";
	3	+import type { AppContext, AppVars } from "../auth/principal.js";
	4	+import type { Repo } from "../lib/directory.js";
	5	+import { HttpError } from "../lib/util.js";
	6	+import type { Release } from "../repo/releases.js";
	7	+import { serveDownload } from "./files.js";
	8	+import { baseOf, ghAsset, ghRelease, pageOf, paginate, setLinks } from "./gh.js";
	9	+import { intParam, jsonBody, loadTarget, repoParams, type Stub } from "./ghctx.js";
	10	+
	11	+/** Releases and release assets (GitHub REST: /repos/{owner}/{repo}/releases). */
	12	+export const releases = new Hono<{ Bindings: Env; Variables: AppVars }>();
	13	+
	14	+type ReleaseBody = { tag_name?: string; target_commitish?: string; name?: string \| null; body?: string \| null; draft?: boolean; prerelease?: boolean; make_latest?: "true" \| "false" \| "legacy" \| boolean; generate_release_notes?: boolean; discussion_category_name?: string };
	15	+
	16	+const R = "/repos/:owner/:repo/releases";
	17	+
	18	+async function out(c: AppContext, repo: Repo, stub: Stub, list: Release[]) {
	19	+ const counts = (await stub.issueExtras([], list.map((r) => `release:${r.id}`))).reactions;
	20	+ return list.map((r) => ghRelease(baseOf(c), repo.owner_login, repo.name, r, counts[`release:${r.id}`]));
	21	+}
	22	+
	23	+function input(b: ReleaseBody): ReleaseBody {
	24	+ for (const k of ["tag_name", "target_commitish"] as const) if (b[k] !== undefined && typeof b[k] !== "string") throw new HttpError(422, `${k} must be a string`, { errors: [{ resource: "Release", code: "invalid", field: k }] });
	25	+ if (b.body !== undefined && b.body !== null && typeof b.body !== "string") throw new HttpError(422, "body must be a string", { errors: [{ resource: "Release", code: "invalid", field: "body" }] });
	26	+ if (typeof b.body === "string" && b.body.length > 125_000) throw new HttpError(422, "body is too long (maximum is 125000 characters)", { errors: [{ resource: "Release", code: "custom", field: "body" }] });
	27	+ return { tag_name: b.tag_name, target_commitish: b.target_commitish, name: b.name, body: b.body, draft: b.draft === undefined ? undefined : !!b.draft, prerelease: b.prerelease === undefined ? undefined : !!b.prerelease, make_latest: b.make_latest, generate_release_notes: !!b.generate_release_notes };
	28	+}
	29	+
	30	+releases.get(R, async (c) => {
	31	+ const { stub, caller, repo } = await loadTarget(c);
	32	+ const p = pageOf(c);
	33	+ const res = await stub.listReleases({ limit: p.perPage, offset: p.offset }, caller);
	34	+ setLinks(c, p, res.total);
	35	+ return c.json(await out(c, repo, stub, res.items));
	36	+});
	37	+
	38	+releases.post(R, async (c) => {
	39	+ const { stub, caller, repo } = await loadTarget(c, "write");
	40	+ const rel = await stub.createRelease(input(await jsonBody<ReleaseBody>(c)), caller);
	41	+ return c.json((await out(c, repo, stub, [rel]))[0], 201);
	42	+});
	43	+
	44	+releases.get(`${R}/latest`, async (c) => {
	45	+ const { stub, repo } = await loadTarget(c);
	46	+ return c.json((await out(c, repo, stub, [await stub.latestRelease()]))[0]);
	47	+});
	48	+
	49	+releases.get(`${R}/tags/:tag{.+}`, async (c) => {
	50	+ const { stub, caller, repo } = await loadTarget(c);
	51	+ return c.json((await out(c, repo, stub, [await stub.releaseByTag(c.req.param("tag"), caller)]))[0]);
	52	+});
	53	+
	54	+releases.post(`${R}/generate-notes`, async (c) => {
	55	+ const { stub } = await loadTarget(c, "write");
	56	+ const b = await jsonBody<{ tag_name?: string; target_commitish?: string; previous_tag_name?: string; configuration_file_path?: string }>(c);
	57	+ if (typeof b.tag_name !== "string" \|\| !b.tag_name) throw new HttpError(422, "tag_name is required", { errors: [{ resource: "Release", code: "missing_field", field: "tag_name" }] });
	58	+ return c.json(await stub.generateReleaseNotes({ tag_name: b.tag_name, target_commitish: b.target_commitish, previous_tag_name: b.previous_tag_name, configuration_file_path: b.configuration_file_path }));
	59	+});
	60	+
	61	+// One asset: JSON, or the bytes with `Accept: application/octet-stream` (Octokit, `gh release download`).
	62	+releases.get(`${R}/assets/:id`, async (c) => {
	63	+ const { stub, caller, repo } = await loadTarget(c);
	64	+ const id = intParam(c, "id");
	65	+ if ((c.req.header("accept") ?? "").includes("application/octet-stream")) {
	66	+ const d = await stub.releaseDownload({ assetId: id }, caller);
	67	+ return serveDownload(c, d.r2Key, d.name, d.contentType);
	68	+ }
	69	+ const asset = await stub.releaseAsset(id, caller);
	70	+ const rel = await stub.getRelease(asset.releaseId, caller);
	71	+ return c.json(ghAsset(baseOf(c), repo.owner_login, repo.name, rel.tagName, asset));
	72	+});
	73	+
	74	+releases.patch(`${R}/assets/:id`, async (c) => {
	75	+ const { stub, caller, repo } = await loadTarget(c, "write");
	76	+ const b = await jsonBody<{ name?: string; label?: string; state?: string }>(c);
	77	+ const asset = await stub.updateReleaseAsset(intParam(c, "id"), { name: typeof b.name === "string" ? b.name : undefined, label: typeof b.label === "string" ? b.label : undefined }, caller);
	78	+ const rel = await stub.getRelease(asset.releaseId, caller);
	79	+ return c.json(ghAsset(baseOf(c), repo.owner_login, repo.name, rel.tagName, asset));
	80	+});
	81	+
	82	+releases.delete(`${R}/assets/:id`, async (c) => {
	83	+ const { stub, caller } = await loadTarget(c, "write");
	84	+ await stub.deleteReleaseAsset(intParam(c, "id"), caller);
	85	+ return c.body(null, 204);
	86	+});
	87	+
	88	+releases.get(`${R}/:id`, async (c) => {
	89	+ const { stub, caller, repo } = await loadTarget(c);
	90	+ return c.json((await out(c, repo, stub, [await stub.getRelease(intParam(c, "id"), caller)]))[0]);
	91	+});
	92	+
	93	+releases.patch(`${R}/:id`, async (c) => {
	94	+ const { stub, caller, repo } = await loadTarget(c, "write");
	95	+ const rel = await stub.updateRelease(intParam(c, "id"), input(await jsonBody<ReleaseBody>(c)), caller);
	96	+ return c.json((await out(c, repo, stub, [rel]))[0]);
	97	+});
	98	+
	99	+releases.delete(`${R}/:id`, async (c) => {
	100	+ const { stub, caller } = await loadTarget(c, "write");
	101	+ await stub.deleteRelease(intParam(c, "id"), caller);
	102	+ return c.body(null, 204);
	103	+});
	104	+
	105	+releases.get(`${R}/:id/assets`, async (c) => {
	106	+ const { stub, caller, repo } = await loadTarget(c);
	107	+ const id = intParam(c, "id");
	108	+ const rel = await stub.getRelease(id, caller);
	109	+ return c.json(paginate(c, (await stub.releaseAssets(id, caller)).map((a) => ghAsset(baseOf(c), repo.owner_login, repo.name, rel.tagName, a))));
	110	+});

		@@ -1,0 +1,209 @@
	1	+/**
	2	+ * Minimal tar and zip writers for source archives (zipball/tarball) and run
	3	+ * log bundles. Entries are buffered, which is fine for the size limits used.
	4	+ */
	5	+
	6	+export type ArchiveEntry = { path: string; mode: string; content: Uint8Array } \| { path: string; dir: true };
	7	+
	8	+const enc = new TextEncoder();
	9	+
	10	+// ---------------------------------------------------------------- tar (ustar + pax for long names)
	11	+
	12	+function octal(n: number, width: number): string {
	13	+ return `${n.toString(8).padStart(width - 1, "0")}\0`;
	14	+}
	15	+
	16	+function tarHeader(name: string, size: number, mode: number, type: string, mtime: number, linkname = ""): Uint8Array {
	17	+ const h = new Uint8Array(512);
	18	+ const put = (s: string, off: number, len: number) => h.set(enc.encode(s).subarray(0, len), off);
	19	+ put(name, 0, 100);
	20	+ put(octal(mode, 8), 100, 8);
	21	+ put(octal(0, 8), 108, 8);
	22	+ put(octal(0, 8), 116, 8);
	23	+ put(octal(size, 12), 124, 12);
	24	+ put(octal(mtime, 12), 136, 12);
	25	+ put(" ", 148, 8);
	26	+ put(type, 156, 1);
	27	+ put(linkname, 157, 100);
	28	+ put("ustar\0", 257, 6);
	29	+ put("00", 263, 2);
	30	+ let sum = 0;
	31	+ for (const b of h) sum += b;
	32	+ put(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8);
	33	+ return h;
	34	+}
	35	+
	36	+function pad512(n: number): Uint8Array {
	37	+ return new Uint8Array((512 - (n % 512)) % 512);
	38	+}
	39	+

		@@ -1,0 +1,83 @@
	1	+import { HttpError } from "./util.js";
	2	+
	3	+/** R2 multipart parts must all be the same size (except the last) and at least 5 MiB. */
	4	+export const PART_SIZE = 8 * 1024 * 1024;
	5	+
	6	+type Bucket = Pick<R2Bucket, "put" \| "createMultipartUpload">;
	7	+
	8	+/**
	9	+ * Writes chunks to one R2 object with bounded memory: objects under one part
	10	+ * go up with a single put, larger ones as a multipart upload of equal parts.
	11	+ * Stops with a 413 once `limit` bytes have been written.
	12	+ */
	13	+export class R2Sink {
	14	+ private buf: Uint8Array[] = [];
	15	+ private buffered = 0;
	16	+ private total = 0;
	17	+ private upload: R2MultipartUpload \| null = null;
	18	+ private parts: R2UploadedPart[] = [];
	19	+
	20	+ constructor(
	21	+ private bucket: Bucket,
	22	+ private key: string,
	23	+ private contentType: string,
	24	+ private limit: number,
	25	+ private tooLarge = "the object is too large",
	26	+ ) {}
	27	+
	28	+ get size(): number {
	29	+ return this.total;
	30	+ }
	31	+
	32	+ async write(chunk: Uint8Array): Promise<void> {
	33	+ if (!chunk.length) return;
	34	+ this.total += chunk.length;
	35	+ if (this.total > this.limit) throw new HttpError(413, this.tooLarge);
	36	+ this.buf.push(chunk);
	37	+ this.buffered += chunk.length;
	38	+ while (this.buffered >= PART_SIZE) await this.flushPart(PART_SIZE);
	39	+ }

		@@ -1,0 +1,227 @@
	1	+/**
	2	+ * GitHub search query syntax (`repo:o/r is:pr is:open label:bug fix crash`),
	3	+ * parsed into filters for issue and repository search. Pure, so it is unit
	4	+ * tested on its own.
	5	+ */
	6	+
	7	+export type Range = { gt?: string; gte?: string; lt?: string; lte?: string };
	8	+
	9	+export type IssueQuery = {
	10	+ repos: string[];
	11	+ owners: string[];
	12	+ kind?: "issue" \| "pull";
	13	+ state?: "open" \| "closed";
	14	+ merged?: boolean;
	15	+ draft?: boolean;
	16	+ locked?: boolean;
	17	+ labels: string[];
	18	+ notLabels: string[];
	19	+ noLabel?: boolean;
	20	+ author?: string;
	21	+ notAuthor?: string;
	22	+ assignee?: string;
	23	+ noAssignee?: boolean;
	24	+ head?: string;
	25	+ base?: string;
	26	+ in: Array<"title" \| "body" \| "comments">;
	27	+ text: string[];
	28	+ created?: Range;
	29	+ updated?: Range;
	30	+ closed?: Range;
	31	+ sort?: { field: "created" \| "updated" \| "comments"; dir: "asc" \| "desc" };
	32	+};
	33	+
	34	+export type RepoQuery = {
	35	+ owners: string[];
	36	+ repos: string[];
	37	+ topics: string[];
	38	+ visibility?: "public" \| "private";
	39	+ archived?: boolean;

		@@ -1,4 +1,6 @@
1	1	import { DurableObject } from "cloudflare:workers";
	2	+import { normalizeCheckSources } from "./required.js";
	3	+import { unsafeTreePath } from "../lib/tree-names.js";
2	4	import {
3	5	EMPTY_TREE_OID,
4	6	ZERO_OID,
		@@ -39,9 +41,16 @@
39	41	import { HttpError, isValidRefName, now } from "../lib/util.js";
40	42	import { Actions } from "./actions.js";
41	43	import { Collab } from "./collab.js";
	44	+import { Deployments } from "./deployments.js";
	45	+import { triggerWorkflows } from "./extra-triggers.js";
	46	+import { GitData } from "./gitdata.js";
42	47	import { RepoObjectStore } from "./objects.js";
43	48	import { MergeQueue, QUEUE_BRANCH_PREFIX, normalizeMergeQueue } from "./queue.js";
	49	+import { Releases } from "./releases.js";
44	50	import { REPO_SCHEMA, migrateRepoSchema } from "./schema.js";
	51	+import { searchIssues } from "./search.js";
	52	+import { Social } from "./social.js";
	53	+import { Statuses } from "./statuses.js";
45	54	import { atLeast, globToRegExp, type Caller, type ProtectionRules, type RepoMeta } from "./types.js";
46	55
47	56	const MAX_PUSH_BYTES = 100 * 1024 * 1024;
		@@ -147,9 +156,10 @@
147	156	await this.queue.process();
148	157	}
149	158
150		- emit(event: DiffineryEvent): void {
	159	+ /** Queue an event (webhooks, notifications) and show it live to open pages; `live: false` skips the pages (e.g. draft releases, which readers can't see). */
	160	+ emit(event: DiffineryEvent, opts?: { live?: boolean }): void {
151	161	this.ctx.waitUntil(this.env.EVENTS.send(event).catch((e) => console.error("event send failed", e)));
152		- this.broadcast("repo", { kind: "event", event });
	162	+ if (opts?.live !== false) this.broadcast("repo", { kind: "event", event });
153	163	}
154	164
155	165	// ---------------------------------------------------------------- refs
		@@ -355,6 +365,7 @@
355	365	at,
356	366	};

		@@ -1,0 +1,134 @@
	1	+import { Hono } from "hono";
	2	+import type { Env } from "../env.js";
	3	+import { callerFor, type AppContext, type AppVars } from "../auth/principal.js";
	4	+import type { Repo } from "../lib/directory.js";
	5	+import { matchesText, parseIssueQuery, parseRepoQuery } from "../lib/search-query.js";
	6	+import { HttpError } from "../lib/util.js";
	7	+import type { Issue } from "../repo/collab.js";
	8	+import { repoStub } from "./common.js";
	9	+import { baseOf, ghIssue, ghRepo, pageOf, setLinks, topicsOf } from "./gh.js";
	10	+import { issueCtx } from "./ghctx.js";
	11	+
	12	+/** GET /search/issues and /search/repositories over the repositories the caller can read. */
	13	+export const search = new Hono<{ Bindings: Env; Variables: AppVars }>();
	14	+
	15	+/** Searches fan out to at most this many repositories; more sets `incomplete_results`. */
	16	+const MAX_REPOS = 50;
	17	+const MAX_RESULTS = 1000;
	18	+/** GitHub's limit on the length of a search query. */
	19	+const MAX_QUERY = 256;
	20	+/** Repository search checks access on at most this many candidates. */
	21	+const MAX_REPO_CANDIDATES = 300;
	22	+
	23	+/**
	24	+ * Repositories the caller might read: only active accounts (and agents whose
	25	+ * owner is active) get anything beyond public repositories, and every
	26	+ * candidate is checked again with callerFor, which applies roles, token
	27	+ * scopes and repository restrictions.
	28	+ */
	29	+async function candidates(c: AppContext): Promise<Repo[]> {
	30	+ const p = c.get("principal");
	31	+ const dir = c.get("dir");
	32	+ if (p.type === "account") {
	33	+ if (p.account.status !== "active") return [];
	34	+ return dir.reposVisibleTo(p.account);
	35	+ }
	36	+ if (p.type === "repo-token") {
	37	+ const r = await dir.repoById(p.repoId);
	38	+ return r ? [r] : [];
	39	+ }
	40	+ return dir.publicRepos(500);
	41	+}
	42	+
	43	+/** The first `limit` repositories (in order) the caller can actually read, and whether more were left unchecked. */
	44	+async function authorized(c: AppContext, repos: Repo[], limit: number): Promise<{ repos: Repo[]; incomplete: boolean }> {
	45	+ const out: Repo[] = [];
	46	+ for (let i = 0; i < repos.length; i++) {
	47	+ if (out.length >= limit) return { repos: out, incomplete: true };
	48	+ if (await callerFor(c, repos[i]!)) out.push(repos[i]!);
	49	+ }
	50	+ return { repos: out, incomplete: false };
	51	+}
	52	+
	53	+const fullName = (r: Repo) => `${r.owner_login}/${r.name}`.toLowerCase();
	54	+
	55	+function queryOf(c: AppContext): string {
	56	+ const raw = c.req.query("q") ?? "";
	57	+ if (!raw.trim()) throw new HttpError(422, "Validation Failed", { errors: [{ resource: "Search", field: "q", code: "missing" }] });
	58	+ if (raw.length > MAX_QUERY) throw new HttpError(422, `The search is longer than ${MAX_QUERY} characters.`, { errors: [{ resource: "Search", field: "q", code: "invalid" }] });
	59	+ return raw;
	60	+}
	61	+
	62	+search.get("/search/issues", async (c) => {
	63	+ const q = parseIssueQuery(queryOf(c), { sort: c.req.query("sort"), order: c.req.query("order") });
	64	+ const p = pageOf(c);
	65	+ if (p.offset >= MAX_RESULTS) throw new HttpError(422, "Only the first 1000 search results are available");
	66	+ let repos = await candidates(c);
	67	+ if (q.repos.length) {
	68	+ const want = new Set(q.repos.map((r) => r.toLowerCase()));
	69	+ repos = repos.filter((r) => want.has(fullName(r)));
	70	+ }
	71	+ if (q.owners.length) {
	72	+ const owners = new Set(q.owners.map((o) => o.toLowerCase()));
	73	+ repos = repos.filter((r) => owners.has(r.owner_login.toLowerCase()));
	74	+ }
	75	+ const allowed = await authorized(c, repos, MAX_REPOS);
	76	+ // Each repository returns at most `want` hits as (number, sort key); only the page is loaded afterwards.
	77	+ const want = Math.min(p.offset + p.perPage, MAX_RESULTS);
	78	+ const results = await Promise.all(allowed.repos.map(async (r) => ({ repo: r, ...(await repoStub(c.env, r.id).searchIssues(q, want)) })));
	79	+ const total = results.reduce((n, r) => n + r.total, 0);
	80	+ const sort = q.sort ?? { field: "created", dir: "desc" };
	81	+ const page = results
	82	+ .flatMap((r) => r.hits.map((h) => ({ repo: r.repo, number: h.number, key: h.key })))
	83	+ .sort((a, b) => {
	84	+ const d = a.key < b.key ? -1 : a.key > b.key ? 1 : 0;
	85	+ return (sort.dir === "asc" ? d : -d) \|\| (a.repo.id < b.repo.id ? -1 : a.repo.id > b.repo.id ? 1 : b.number - a.number);
	86	+ })
	87	+ .slice(p.offset, p.offset + p.perPage);
	88	+ const byRepo = new Map<string, { repo: Repo; numbers: number[] }>();
	89	+ for (const h of page) {
	90	+ const entry = byRepo.get(h.repo.id) ?? { repo: h.repo, numbers: [] };
	91	+ entry.numbers.push(h.number);
	92	+ byRepo.set(h.repo.id, entry);
	93	+ }
	94	+ const shaped = new Map<string, ReturnType<typeof ghIssue>>();
	95	+ for (const { repo, numbers } of byRepo.values()) {
	96	+ const stub = repoStub(c.env, repo.id);
	97	+ const issues = (await stub.issuesByNumber(numbers)) as unknown as Issue[];
	98	+ const x = await issueCtx(c, repo, stub, issues);
	99	+ for (const i of issues) shaped.set(`${repo.id}#${i.number}`, ghIssue(x, i));
	100	+ }
	101	+ setLinks(c, p, Math.min(total, MAX_RESULTS));
	102	+ const items = page.flatMap((h) => {
	103	+ const item = shaped.get(`${h.repo.id}#${h.number}`);
	104	+ return item ? [{ ...item, score: 1 }] : [];
	105	+ });
	106	+ return c.json({ total_count: total, incomplete_results: allowed.incomplete, items });
	107	+});
	108	+
	109	+search.get("/search/repositories", async (c) => {
	110	+ const q = parseRepoQuery(queryOf(c));
	111	+ const p = pageOf(c);
	112	+ const fields = q.in.length ? q.in : ["name", "description", "topics"];
	113	+ const owners = new Set(q.owners.map((o) => o.toLowerCase()));
	114	+ const names = new Set(q.repos.map((r) => r.toLowerCase()));
	115	+ const filtered = (await candidates(c)).filter((r) => {
	116	+ if (owners.size && !owners.has(r.owner_login.toLowerCase())) return false;
	117	+ if (names.size && !names.has(fullName(r))) return false;
	118	+ if (q.visibility && (q.visibility === "public") !== (r.visibility === "public")) return false;
	119	+ if (q.archived !== undefined && !!r.archived !== q.archived) return false;
	120	+ const topics = topicsOf(r);
	121	+ if (q.topics.some((t) => !topics.includes(t))) return false;
	122	+ const hay: string[] = [];
	123	+ if (fields.includes("name")) hay.push(r.name, fullName(r));
	124	+ if (fields.includes("description")) hay.push(r.description ?? "");
	125	+ if (fields.includes("topics")) hay.push(topics.join(" "));
	126	+ return matchesText(q.text, hay);
	127	+ });
	128	+ const allowed = await authorized(c, filtered, MAX_REPO_CANDIDATES);
	129	+ const hits = allowed.repos;
	130	+ const order = c.req.query("order") === "asc" ? 1 : -1;
	131	+ if (c.req.query("sort") === "updated") hits.sort((a, b) => ((a.pushed_at ?? a.updated_at) < (b.pushed_at ?? b.updated_at) ? -order : order));
	132	+ setLinks(c, p, hits.length);
	133	+ return c.json({ total_count: hits.length, incomplete_results: allowed.incomplete, items: hits.slice(p.offset, p.offset + p.perPage).map((r) => ({ ...ghRepo(baseOf(c), r), score: 1 })) });
	134	+});

		@@ -31,6 +31,8 @@
31	31	created_at: string;
32	32	updated_at: string;
33	33	pushed_at: string \| null;
	34	+ /** JSON array of topic names (GitHub's repository topics). */
	35	+ topics?: string;
34	36	}
35	37
36	38	export type TokenScope = "read" \| "write" \| "admin";
		@@ -163,6 +165,8 @@
163	165	const before = await this.account(id);
164	166	await this.db.prepare("UPDATE accounts SET status = ? WHERE id = ?").bind(status, id).run();
165	167	if (status === "disabled") await this.db.prepare("UPDATE tokens SET revoked_at = ? WHERE account_id = ? AND revoked_at IS NULL").bind(now(), id).run();
	168	+ // A disabled account's browser sessions end too.
	169	+ if (status === "disabled") await this.db.prepare("DELETE FROM sessions WHERE account_id = ?").bind(id).run();
166	170	// People hear when they are disabled or enabled again (not when an invite activates them).
167	171	if (before?.kind === "user" && before.status !== status && (status === "disabled" \|\| before.status === "disabled")) {
168	172	await enqueueMail(this.env, [{ kind: "account_status", data: { status: status === "disabled" ? "disabled" : "active" }, to: { accountId: id }, reason: "account", at: now() }]);
		@@ -317,6 +321,11 @@
317	321
318	322	/** Repositories an account can see. */
319	323	async reposVisibleTo(account: Account, ownerId?: string): Promise<Repo[]> {
	324	+ if (account.status !== "active") return [];
	325	+ if (account.kind === "agent") {
	326	+ const owner = account.owner_id ? await this.account(account.owner_id) : null;
	327	+ if (!owner \|\| owner.status !== "active") return [];
	328	+ }
320	329	const params: unknown[] = [];
321	330	let q = "SELECT r.*, a.login AS owner_login, a.kind AS owner_kind FROM repos r JOIN accounts a ON a.id = r.owner_id";
322	331	const subjectId = account.kind === "agent" ? account.owner_id! : account.id;
		@@ -377,6 +386,10 @@
377	386	await this.env.REPO.get(this.env.REPO.idFromName(repo.id)).destroy();
378	387	}
379	388
	389	+ async setTopics(repoId: string, topics: string[]): Promise<void> {
	390	+ await this.db.prepare("UPDATE repos SET topics = ?, updated_at = ? WHERE id = ?").bind(JSON.stringify(topics), now(), repoId).run();
	391	+ }
	392	+
380	393	async touchPushed(repoId: string): Promise<void> {
381	394	await this.db.prepare("UPDATE repos SET pushed_at = ?, updated_at = ? WHERE id = ?").bind(now(), now(), repoId).run();
382	395	}

		@@ -1,0 +1,18 @@
	1	+/** Hosts the importer downloads release assets from: GitHub's, plus an optional GitHub Enterprise host. */
	2	+const IMPORT_HOSTS = ["github.com", "api.github.com", "objects.githubusercontent.com", "release-assets.githubusercontent.com"];
	3	+
	4	+export function importHostAllowed(host: string, gheHost?: string): boolean {
	5	+ const h = host.toLowerCase().replace(/\.$/, "");
	6	+ const ghe = gheHost?.trim().toLowerCase();
	7	+ return IMPORT_HOSTS.includes(h) \|\| (!!ghe && h === ghe);
	8	+}
	9	+
	10	+/**
	11	+ * The headers to keep when a redirect leaves the original host: only plain
	12	+ * content negotiation. Authorization, cookies, tokens and anything else that
	13	+ * could carry a credential are dropped.
	14	+ */
	15	+export function withoutCredentials(headers: Record<string, string>): Record<string, string> {
	16	+ const keep = new Set(["accept", "accept-encoding", "accept-language", "user-agent", "x-github-api-version"]);
	17	+ return Object.fromEntries(Object.entries(headers).filter(([k]) => keep.has(k.toLowerCase())));
	18	+}

		@@ -1,0 +1,37 @@
	1	+/**
	2	+ * Tree entry names the server refuses to write (and leaves out of archives):
	3	+ * empty names, `.` and `..`, names with `/`, `\` or NUL, and anything a
	4	+ * checkout on Windows or macOS would treat as `.git` (`.GIT`, `.git.`,
	5	+ * `.git ` , `git~1`, `.g‌it`). Git's own fsck rejects the same names.
	6	+ */
	7	+
	8	+// Characters HFS+ ignores when comparing names (zero-width joiners, direction marks, BOM).
	9	+const HFS_IGNORABLE = /[‌-‏‪-‮⁪-⁯]/g;
	10	+
	11	+export function isDotGitName(name: string): boolean {
	12	+ const n = name.replace(HFS_IGNORABLE, "").toLowerCase().replace(/[. ]+$/, "");
	13	+ return n === ".git" \|\| n === "git~1";
	14	+}
	15	+
	16	+/** Why a single tree entry name is unsafe, or null when it is fine. */
	17	+export function unsafeTreeName(name: string): string \| null {
	18	+ if (!name) return "empty name";
	19	+ if (name === "." \|\| name === "..") return `'${name}' is not a valid name`;
	20	+ if (name.includes("/") \|\| name.includes("\\") \|\| name.includes("\0")) return "names can't contain '/', '\\' or NUL";
	21	+ if (isDotGitName(name)) return "'.git' is reserved";
	22	+ if (name.length > 255) return "name is too long";
	23	+ return null;
	24	+}
	25	+
	26	+/** Why a slash-separated path is unsafe to write, or null. */
	27	+export function unsafeTreePath(path: string): string \| null {
	28	+ if (path.includes("\\") \|\| path.includes("\0")) return "paths can't contain '\\' or NUL";
	29	+ const parts = path.split("/").filter((p) => p !== "");
	30	+ if (!parts.length) return "empty path";
	31	+ if (path.length > 4096) return "path is too long";
	32	+ for (const p of parts) {
	33	+ const why = unsafeTreeName(p);
	34	+ if (why) return why;
	35	+ }
	36	+ return null;
	37	+}

		@@ -1,0 +1,175 @@
	1	+import type { AppContext } from "../auth/principal.js";
	2	+import { HttpError, fromB64 } from "../lib/util.js";
	3	+import type { Release } from "../repo/releases.js";
	4	+import type { Role } from "../repo/types.js";
	5	+import { loadRepo } from "../http/common.js";
	6	+import { storeAsset } from "../http/files.js";
	7	+import { baseOf, repoHtml } from "../http/gh.js";
	8	+import type { Tool } from "./server.js";
	9	+
	10	+/**
	11	+ * MCP tools for releases: list, read, create, edit, upload assets and draft
	12	+ * notes. They run through the same permission checks as the REST API
	13	+ * (writers create and edit; drafts stay hidden from readers).
	14	+ */
	15	+
	16	+type Args = Record<string, unknown>;
	17	+
	18	+const MAX_MCP_ASSET_BYTES = 25 * 1024 * 1024;
	19	+
	20	+const str = (a: Args, k: string): string => {
	21	+ const v = a[k];
	22	+ if (typeof v !== "string" \|\| v === "") throw new HttpError(422, `${k} is required`);
	23	+ return v;
	24	+};
	25	+const optStr = (a: Args, k: string) => (typeof a[k] === "string" && a[k] !== "" ? (a[k] as string) : undefined);
	26	+const optBool = (a: Args, k: string) => {
	27	+ if (a[k] === undefined \|\| a[k] === null) return undefined;
	28	+ if (typeof a[k] !== "boolean") throw new HttpError(422, `${k} must be a boolean`);
	29	+ return a[k] as boolean;
	30	+};
	31	+const id = (a: Args, k: string) => {
	32	+ const n = Number(a[k]);
	33	+ if (!Number.isInteger(n) \|\| n < 1) throw new HttpError(422, `${k} must be a positive integer`);
	34	+ return n;
	35	+};
	36	+const repoOf = (c: AppContext, a: Args, min: Role = "read") => loadRepo(c, str(a, "owner"), str(a, "repo"), min);
	37	+const OWNER_REPO = {
	38	+ owner: { type: "string", description: "Repository owner (user or org login)" },
	39	+ repo: { type: "string", description: "Repository name" },
	40	+};
	41	+
	42	+function out(c: AppContext, a: Args, r: Release) {
	43	+ const html = `${repoHtml(baseOf(c), str(a, "owner"), str(a, "repo"))}/releases/tag/${encodeURIComponent(r.tagName)}`;
	44	+ return {
	45	+ id: r.id,
	46	+ tag_name: r.tagName,
	47	+ target_commitish: r.targetCommitish,
	48	+ name: r.name,
	49	+ body: r.body,
	50	+ draft: r.draft,
	51	+ prerelease: r.prerelease,
	52	+ latest: r.latest,
	53	+ author: r.author.login,
	54	+ created_at: r.createdAt,
	55	+ published_at: r.publishedAt,
	56	+ html_url: html,
	57	+ assets: r.assets.map((x) => ({ id: x.id, name: x.name, label: x.label, content_type: x.contentType, size: x.size, download_count: x.downloadCount, download_url: `${repoHtml(baseOf(c), str(a, "owner"), str(a, "repo"))}/releases/download/${encodeURIComponent(r.tagName)}/${encodeURIComponent(x.name)}` })),
	58	+ };
	59	+}
	60	+
	61	+const RELEASE_FIELDS = {
	62	+ name: { type: "string", description: "Release title" },
	63	+ body: { type: "string", description: "Release notes (Markdown)" },
	64	+ draft: { type: "boolean", description: "Keep it as a draft, visible to writers only" },
	65	+ prerelease: { type: "boolean" },
	66	+ make_latest: { type: "string", enum: ["true", "false", "legacy"], description: "Whether this becomes the latest release (default true)" },
	67	+};
	68	+
	69	+const makeLatest = (a: Args) => {
	70	+ const v = optStr(a, "make_latest");
	71	+ if (v === undefined) return undefined;
	72	+ if (v !== "true" && v !== "false" && v !== "legacy") throw new HttpError(422, "make_latest must be true, false or legacy");
	73	+ return v;
	74	+};
	75	+
	76	+export const RELEASE_TOOLS: Record<string, Tool> = {
	77	+ list_releases: {
	78	+ description: "List a repository's releases, newest first. Drafts are included only for writers.",
	79	+ input: { ...OWNER_REPO, limit: { type: "number", description: "At most this many (default 30, max 100)" } },
	80	+ required: ["owner", "repo"],
	81	+ readOnly: true,
	82	+ run: async (c, a) => {
	83	+ const { stub, caller } = await repoOf(c, a);
	84	+ const limit = Math.min(Math.max(Number(a.limit) \|\| 30, 1), 100);
	85	+ const res = await stub.listReleases({ limit, offset: 0 }, caller);
	86	+ return { total: res.total, releases: res.items.map((r) => out(c, a, r)) };
	87	+ },
	88	+ },
	89	+ get_release: {
	90	+ description: "Get a release by tag, by id, or the latest release when neither is given.",
	91	+ input: { ...OWNER_REPO, tag: { type: "string" }, id: { type: "number" } },
	92	+ required: ["owner", "repo"],
	93	+ readOnly: true,
	94	+ run: async (c, a) => {
	95	+ const { stub, caller } = await repoOf(c, a);
	96	+ const tag = optStr(a, "tag");
	97	+ const r = tag ? await stub.releaseByTag(tag, caller, true) : a.id !== undefined ? await stub.getRelease(id(a, "id"), caller) : await stub.latestRelease();
	98	+ return out(c, a, r);
	99	+ },
	100	+ },
	101	+ create_release: {
	102	+ description: "Create a release. Creates the tag at target_commitish (default branch by default) when it doesn't exist yet.",
	103	+ input: { ...OWNER_REPO, tag_name: { type: "string" }, target_commitish: { type: "string", description: "Branch or commit for a new tag" }, ...RELEASE_FIELDS, generate_release_notes: { type: "boolean", description: "Fill in notes from merged pull requests since the previous release" } },
	104	+ required: ["owner", "repo", "tag_name"],
	105	+ run: async (c, a) => {
	106	+ const { stub, caller } = await repoOf(c, a, "write");
	107	+ const r = await stub.createRelease(
	108	+ {
	109	+ tag_name: str(a, "tag_name"),
	110	+ target_commitish: optStr(a, "target_commitish"),
	111	+ name: optStr(a, "name"),
	112	+ body: optStr(a, "body"),
	113	+ draft: optBool(a, "draft"),
	114	+ prerelease: optBool(a, "prerelease"),
	115	+ make_latest: makeLatest(a),
	116	+ generate_release_notes: optBool(a, "generate_release_notes"),
	117	+ },
	118	+ caller,
	119	+ );
	120	+ return out(c, a, r);
	121	+ },
	122	+ },
	123	+ update_release: {
	124	+ description: "Edit a release: title, notes, tag, draft or prerelease state. Publishing a draft sends the release event.",
	125	+ input: { ...OWNER_REPO, id: { type: "number" }, tag_name: { type: "string" }, target_commitish: { type: "string" }, ...RELEASE_FIELDS },
	126	+ required: ["owner", "repo", "id"],
	127	+ run: async (c, a) => {
	128	+ const { stub, caller } = await repoOf(c, a, "write");
	129	+ const r = await stub.updateRelease(
	130	+ id(a, "id"),
	131	+ {
	132	+ tag_name: optStr(a, "tag_name"),
	133	+ target_commitish: optStr(a, "target_commitish"),
	134	+ name: typeof a.name === "string" ? a.name : undefined,
	135	+ body: typeof a.body === "string" ? a.body : undefined,
	136	+ draft: optBool(a, "draft"),
	137	+ prerelease: optBool(a, "prerelease"),
	138	+ make_latest: makeLatest(a),
	139	+ },
	140	+ caller,
	141	+ );
	142	+ return out(c, a, r);
	143	+ },
	144	+ },
	145	+ upload_release_asset: {
	146	+ description: "Attach a file (up to 25 MB) to a release. Pass text as content, or bytes as content_base64.",
	147	+ input: { ...OWNER_REPO, release_id: { type: "number" }, name: { type: "string", description: "File name" }, label: { type: "string" }, content_type: { type: "string" }, content: { type: "string" }, content_base64: { type: "string" } },
	148	+ required: ["owner", "repo", "release_id", "name"],
	149	+ run: async (c, a) => {
	150	+ const { stub, caller } = await repoOf(c, a, "write");
	151	+ const text = typeof a.content === "string" ? a.content : undefined;
	152	+ const b64 = optStr(a, "content_base64");
	153	+ if ((text === undefined) === (b64 === undefined)) throw new HttpError(422, "pass exactly one of content or content_base64");
	154	+ let bytes: Uint8Array;
	155	+ try {
	156	+ bytes = b64 !== undefined ? fromB64(b64) : new TextEncoder().encode(text);
	157	+ } catch {
	158	+ throw new HttpError(422, "content_base64 is not valid base64");
	159	+ }
	160	+ if (bytes.byteLength > MAX_MCP_ASSET_BYTES) throw new HttpError(413, "MCP uploads are limited to 25 MB; use the upload_url of the REST API for larger files");
	161	+ const asset = await storeAsset(c.env, stub, id(a, "release_id"), { name: str(a, "name"), label: optStr(a, "label"), contentType: optStr(a, "content_type") ?? (text !== undefined ? "text/plain" : "application/octet-stream") }, { stream: new Blob([bytes]).stream(), length: bytes.byteLength }, caller);
	162	+ return { id: asset.id, name: asset.name, size: asset.size, content_type: asset.contentType };
	163	+ },
	164	+ },
	165	+ generate_release_notes: {
	166	+ description: "Draft release notes for a tag from the pull requests merged since the previous release. Doesn't create anything.",
	167	+ input: { ...OWNER_REPO, tag_name: { type: "string" }, target_commitish: { type: "string" }, previous_tag_name: { type: "string" } },
	168	+ required: ["owner", "repo", "tag_name"],
	169	+ readOnly: true,
	170	+ run: async (c, a) => {
	171	+ const { stub } = await repoOf(c, a, "write");
	172	+ return await stub.generateReleaseNotes({ tag_name: str(a, "tag_name"), target_commitish: optStr(a, "target_commitish"), previous_tag_name: optStr(a, "previous_tag_name") });
	173	+ },
	174	+ },
	175	+};

		@@ -4,6 +4,7 @@
4	4	import { HttpError, b64, fromB64 } from "../lib/util.js";
5	5	import type { Role } from "../repo/types.js";
6	6	import { loadRepo } from "../http/common.js";
	7	+import { RELEASE_TOOLS } from "./releases.js";
7	8
8	9	/**
9	10	* Model Context Protocol server (Streamable HTTP transport, JSON responses).
		@@ -17,7 +18,7 @@
17	18	const PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
18	19
19	20	type Args = Record<string, unknown>;
20		-interface Tool {
	21	+export interface Tool {
21	22	description: string;
22	23	input: Record<string, { type: string; description?: string; items?: unknown; enum?: string[] }>;
23	24	required?: string[];
		@@ -369,6 +370,7 @@
369	370	return { closed: true };
370	371	},
371	372	},
	373	+ ...RELEASE_TOOLS,
372	374	};
373	375
374	376	async function sandboxCall(c: AppContext, a: Args, path: string, payload: unknown) {

		@@ -1061,11 +1061,25 @@
1061	1061	throw new HttpError(409, (e as Error).message);
1062	1062	}
1063	1063	const m = this.repo.meta;
	1064	+ // Deployment environment (`environment:`): its branch policy, secrets and variables, and a deployment record.
	1065	+ let environment: { secrets: Record<string, string>; vars: Record<string, string> } = { secrets: {}, vars: {} };
	1066	+ if (def.environment) {
	1067	+ try {
	1068	+ const ctx = { github: this.githubContext(run, short, ""), inputs: scope.inputs, vars: this.variables(), matrix: JSON.parse(job.matrix) };
	1069	+ const name = interpolate(def.environment.name, ctx);
	1070	+ const url = def.environment.url && !def.environment.url.includes("steps.") ? interpolate(def.environment.url, ctx) : undefined;
	1071	+ const logUrl = `${this.env.PUBLIC_URL}/${m.owner}/${m.name}/actions/runs/${run.id}/job/${jobId}`;
	1072	+ environment = await this.repo.deploys.jobStarted({ id: jobId, ref: run.ref, sha: run.sha, logUrl, actor: JSON.parse(run.actor) as Actor }, { name, url });
	1073	+ } catch (e) {
	1074	+ await this.completeJob(jobId, { conclusion: "failure", outputs: {}, failure: { message: (e as Error).message } });
	1075	+ throw new HttpError(409, (e as Error).message);
	1076	+ }
	1077	+ }
1064	1078	const t = now();
1065	1079	this.sql.exec("UPDATE jobs SET status = 'in_progress', started_at = ? WHERE id = ?", t, jobId);
1066	1080	this.repo.upsertCheck({ sha: run.head_sha ?? run.sha, name: this.checkName(run, job), status: "in_progress", runId: run.id, jobId, detailsUrl: `${this.env.PUBLIC_URL}/${m.owner}/${m.name}/actions/runs/${run.id}/job/${jobId}` });
1067	1081	this.repo.broadcast(`run:${run.id}`, { action: "job", jobId });
1068		- const secrets: Record<string, string> = { ...scope.secrets, GITHUB_TOKEN: token, DIFFINERY_TOKEN: token };
	1082	+ const secrets: Record<string, string> = { ...scope.secrets, ...environment.secrets, GITHUB_TOKEN: token, DIFFINERY_TOKEN: token };
1069	1083	const idToken = wf.permissions === "write-all" \|\| (typeof wf.permissions === "object" && wf.permissions["id-token"] === "write") \|\| (typeof def.permissions === "object" && def.permissions["id-token"] === "write") \|\| def.permissions === "write-all";
1070	1084	return {
1071	1085	runId: run.id,
		@@ -1083,7 +1097,7 @@
1083	1097	strategy: JSON.parse(job.strategy),
1084	1098	needs: await this.needsResults(run, exp, exp.needs.get(job.job_key) ?? [], parent),
1085	1099	inputs: scope.inputs,
1086		- vars: this.variables(),
	1100	+ vars: { ...this.variables(), ...environment.vars },
1087	1101	secrets,
1088	1102	outputs: def.outputs,
1089	1103	steps: def.steps.map((s) => ({ ...s, "timeout-minutes": s["timeout-minutes"] === undefined ? undefined : Number(s["timeout-minutes"]) })),
		@@ -1144,6 +1158,7 @@
1144	1158	t,
1145	1159	jobId,
1146	1160	);
	1161	+ this.repo.deploys.jobCompleted(jobId, conclusion);
1147	1162	const m = this.repo.meta;
1148	1163	this.repo.upsertCheck({
1149	1164	sha: run.head_sha ?? run.sha,

		@@ -4,6 +4,8 @@
4	4	import type { RepoDO } from "./RepoDO.js";
5	5	import { toInfo } from "./RepoDO.js";
6	6	import { atLeast, type Caller } from "./types.js";
	7	+import { COMMENT_SELECT } from "./social.js";
	8	+import { requiredCheck } from "./required.js";
7	9
8	10	export type IssueRow = {
9	11	number: number;
		@@ -51,6 +53,7 @@
51	53	updatedAt: string;
52	54	closedAt: string \| null;
53	55	comments: number;
	56	+ locked: boolean;
54	57	pull?: {
55	58	head: string;
56	59	headSha: string;
		@@ -78,6 +81,10 @@
78	81	commitId: string \| null;
79	82	inReplyTo: string \| null;
80	83	resolved: boolean;
	84	+ /** GitHub-style numeric ids: this comment's, its review's and its parent's. */
	85	+ seq?: number;
	86	+ reviewSeq?: number \| null;
	87	+ inReplyToSeq?: number \| null;
81	88	};
82	89
83	90	export type Review = {
		@@ -87,6 +94,8 @@
87	94	body: string;
88	95	commitId: string;
89	96	submittedAt: string;
	97	+ /** GitHub-style numeric id. */
	98	+ seq?: number;
90	99	};
91	100
92	101	export type Check = {
		@@ -102,6 +111,12 @@
102	111	app: string;
103	112	startedAt: string \| null;
104	113	completedAt: string \| null;
	114	+ /** Who reported it over the REST API (none for Diffinery Actions). */
	115	+ creatorId?: string \| null;
	116	+ creatorLogin?: string \| null;
	117	+ creatorKind?: string \| null;
	118	+ /** GitHub-style numeric id. */
	119	+ seq?: number \| null;
105	120	};
106	121
107	122	export type Mergeability = {
		@@ -160,6 +175,7 @@
160	175	updatedAt: r.updated_at,
161	176	closedAt: r.closed_at,
162	177	comments,
	178	+ locked: !!r.locked,
163	179	};
164	180	if (r.kind === "pull") {
165	181	const p = this.pullRow(r.number);
		@@ -181,7 +197,25 @@
181	197
182	198	// ---------------------------------------------------------------- issues
183	199
184		- list(opts: { kind?: "issue" \| "pull"; state?: "open" \| "closed" \| "all"; label?: string; author?: string; limit?: number; offset?: number; q?: string } = {}): { items: Issue[]; total: number } {
	200	+ list(
	201	+ opts: {
	202	+ kind?: "issue" \| "pull";
	203	+ state?: "open" \| "closed" \| "all";
	204	+ label?: string;
	205	+ author?: string;
	206	+ limit?: number;
	207	+ offset?: number;
	208	+ q?: string;
	209	+ // GitHub list filters (REST `issues` and `pulls` query parameters).
	210	+ labels?: string[];
	211	+ assignee?: string;
	212	+ since?: string;
	213	+ head?: string;
	214	+ base?: string;
	215	+ sort?: "created" \| "updated" \| "comments";
	216	+ direction?: "asc" \| "desc";
	217	+ } = {},
	218	+ ): { items: Issue[]; total: number } {
185	219	const where: string[] = [];
186	220	const args: unknown[] = [];
187	221	if (opts.kind) {
		@@ -204,16 +238,45 @@
204	238	where.push("(title LIKE ? OR body LIKE ?)");
205	239	args.push(`%${opts.q}%`, `%${opts.q}%`);
206	240	}
	241	+ for (const l of opts.labels ?? []) {
	242	+ where.push("EXISTS (SELECT 1 FROM json_each(labels) WHERE value = ?)");
	243	+ args.push(l);
	244	+ }
	245	+ if (opts.assignee === "none") where.push("assignees = '[]'");
	246	+ else if (opts.assignee === "*") where.push("assignees != '[]'");
	247	+ else if (opts.assignee) {
	248	+ where.push("EXISTS (SELECT 1 FROM json_each(assignees) WHERE lower(value) = lower(?))");
	249	+ args.push(opts.assignee);
	250	+ }
	251	+ if (opts.since) {
	252	+ where.push("updated_at >= ?");
	253	+ args.push(opts.since);
	254	+ }
	255	+ if (opts.head) {
	256	+ where.push("number IN (SELECT number FROM pulls WHERE head_ref = ?)");
	257	+ args.push(opts.head);
	258	+ }
	259	+ if (opts.base) {
	260	+ where.push("number IN (SELECT number FROM pulls WHERE base_ref = ?)");
	261	+ args.push(opts.base);
	262	+ }
207	263	const w = where.length ? `WHERE ${where.join(" AND ")}` : "";
	264	+ const dir = opts.direction === "asc" ? "ASC" : "DESC";
	265	+ const order =
	266	+ opts.sort === "updated"
	267	+ ? `updated_at ${dir}, number ${dir}`
	268	+ : opts.sort === "comments"
	269	+ ? `(SELECT count(*) FROM comments c WHERE c.number = issues.number AND c.review_id IS NULL) ${dir}, number ${dir}`
	270	+ : `number ${dir}`;
208	271	const total = this.sql.exec<{ n: number }>(`SELECT count(*) AS n FROM issues ${w}`, ...args).one().n;
209		- const rows = this.sql.exec<IssueRow>(`SELECT * FROM issues ${w} ORDER BY number DESC LIMIT ? OFFSET ?`, ...args, Math.min(opts.limit ?? 30, 100), opts.offset ?? 0).toArray();
	272	+ const rows = this.sql.exec<IssueRow>(`SELECT * FROM issues ${w} ORDER BY ${order} LIMIT ? OFFSET ?`, ...args, Math.min(opts.limit ?? 30, 100), opts.offset ?? 0).toArray();
210	273	return { items: rows.map((r) => this.toIssue(r)), total };
211	274	}
212	275
213	276	get(number: number): { issue: Issue; comments: Comment[]; reviews: Review[] } {
214	277	const issue = this.toIssue(this.row(number));
215	278	const comments = this.sql
216		- .exec<Record<string, SqlStorageValue>>("SELECT * FROM comments WHERE number = ? ORDER BY created_at", number)
	279	+ .exec<Record<string, SqlStorageValue>>(`SELECT ${COMMENT_SELECT} FROM comments c WHERE c.number = ? ORDER BY c.created_at`, number)
217	280	.toArray()
218	281	.map(
219	282	(c): Comment => ({
		@@ -229,6 +292,9 @@
229	292	commitId: (c.commit_id as string) ?? null,
230	293	inReplyTo: (c.in_reply_to as string) ?? null,
231	294	resolved: !!c.resolved,
	295	+ seq: c.seq as number,
	296	+ reviewSeq: (c.review_seq as number) ?? null,
	297	+ inReplyToSeq: (c.reply_seq as number) ?? null,
232	298	}),
233	299	);
234	300	const reviews = this.reviews(number);
		@@ -237,7 +303,7 @@
237	303
238	304	private reviews(number: number): Review[] {
239	305	return this.sql
240		- .exec<Record<string, string>>("SELECT * FROM reviews WHERE number = ? ORDER BY submitted_at", number)
	306	+ .exec<Record<string, string>>("SELECT rowid AS seq, * FROM reviews WHERE number = ? ORDER BY submitted_at", number)
241	307	.toArray()
242	308	.map((r) => ({
243	309	id: r.id!,
		@@ -246,6 +312,7 @@
246	312	body: r.body!,
247	313	commitId: r.commit_id!,
248	314	submittedAt: r.submitted_at!,
	315	+ seq: Number(r.seq),
249	316	}));
250	317	}
251	318
		@@ -291,6 +358,7 @@
291	358	state === "closed" ? (r.closed_at ?? t) : null,
292	359	number,
293	360	);
	361	+ this.repo.social.recordUpdate(r, patch, caller);
294	362	const m = this.repo.meta;
295	363	if (patch.state && patch.state !== r.state) {
296	364	const action = patch.state === "closed" ? "closed" : "reopened";
		@@ -328,6 +396,7 @@
328	396	}
329	397
330	398	editComment(id: string, body: string, caller: Caller): void {
	399	+ id = this.repo.social.commentKey(id);
331	400	const c = this.sql.exec<{ author_id: string }>("SELECT author_id FROM comments WHERE id = ?", id).toArray()[0];
332	401	if (!c) throw new HttpError(404, "comment not found");
333	402	if (c.author_id !== caller.id && !atLeast(caller.role, "maintain")) throw new HttpError(403, "permission denied");
		@@ -427,6 +496,7 @@
427	496	const m = this.repo.meta;
428	497	this.repo.emit({ type: "pull_request", action: "review_requested", repoId: m.repoId, owner: m.owner, repo: m.name, number, headRef: p.head_ref, headSha: p.head_sha, baseRef: p.base_ref, actor: actorOf(caller), at: now(), reviewers: added });
429	498	}
	499	+ for (const l of added) this.repo.social.record(number, "review_requested", caller, { requested_reviewer: l });
430	500	}
431	501
432	502	/** Called after a branch moves: refresh open pull requests whose head is that branch. */
		@@ -474,6 +544,7 @@
474	544	const r = this.row(number);
475	545	const p = this.pullRow(number);
476	546	if (r.state !== "open") throw new HttpError(422, "pull request is closed");
	547	+ if (r.locked && !atLeast(caller.role, "triage")) throw new HttpError(403, "conversation is locked");
477	548	if (input.event !== "COMMENT" && r.author_id === caller.id) throw new HttpError(422, "you cannot approve or request changes on your own pull request");
478	549	if (input.event !== "COMMENT" && !atLeast(caller.role, "write")) throw new HttpError(403, "write access is required to approve or request changes");
479	550	if (input.event === "COMMENT" && !input.body?.trim() && !input.comments?.length) throw new HttpError(422, "a comment review needs a body or line comments");
		@@ -544,17 +615,22 @@
544	615	app: c.app!,
545	616	startedAt: c.started_at ?? null,
546	617	completedAt: c.completed_at ?? null,
	618	+ creatorId: c.creator_id ?? null,
	619	+ creatorLogin: c.creator_login ?? null,
	620	+ creatorKind: c.creator_kind ?? null,
	621	+ seq: c.seq === null \|\| c.seq === undefined ? null : Number(c.seq),
547	622	}));
548	623	}
549	624
550	625	/** Create or update a check run, keyed by (sha, name, app). */
551		- upsertCheck(input: { sha: string; name: string; status: Check["status"]; conclusion?: string \| null; runId?: string; jobId?: string; detailsUrl?: string; output?: Check["output"]; app?: string }): Check {
	626	+ upsertCheck(input: { sha: string; name: string; status: Check["status"]; conclusion?: string \| null; runId?: string; jobId?: string; detailsUrl?: string; output?: Check["output"]; app?: string; creator?: { id: string; login: string; kind: string } }): Check {
552	627	const app = input.app ?? "diffinery-actions";
553		- const existing = this.sql.exec<{ id: string; started_at: string \| null }>("SELECT id, started_at FROM checks WHERE sha = ? AND name = ? AND app = ?", input.sha, input.name, app).toArray()[0];
	628	+ const existing = this.sql.exec<{ id: string; started_at: string \| null; seq: number \| null }>("SELECT id, started_at, seq FROM checks WHERE sha = ? AND name = ? AND app = ?", input.sha, input.name, app).toArray()[0];
554	629	const t = now();
555	630	const id = existing?.id ?? newId();
	631	+ const seq = existing?.seq ?? this.sql.exec<{ n: number }>("SELECT coalesce(max(seq), 0) + 1 AS n FROM checks").one().n;
556	632	this.sql.exec(
557		- "INSERT OR REPLACE INTO checks (id, sha, name, status, conclusion, run_id, job_id, details_url, output, app, started_at, completed_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
	633	+ "INSERT OR REPLACE INTO checks (id, sha, name, status, conclusion, run_id, job_id, details_url, output, app, started_at, completed_at, creator_id, creator_login, creator_kind, seq) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
558	634	id,
559	635	input.sha,
560	636	input.name,
		@@ -567,6 +643,10 @@
567	643	app,
568	644	existing?.started_at ?? (input.status !== "queued" ? t : null),
569	645	input.status === "completed" ? t : null,
	646	+ input.creator?.id ?? null,
	647	+ input.creator?.login ?? null,
	648	+ input.creator?.kind ?? null,
	649	+ seq,
570	650	);
571	651	for (const p of this.sql.exec<{ number: number }>("SELECT number FROM pulls WHERE head_sha = ?", input.sha).toArray()) this.repo.broadcast(`pr:${p.number}`, { action: "checks" });
572	652	if (input.status === "completed") {
		@@ -601,7 +681,8 @@
601	681	if (rv.state === "APPROVED" && rv.author.kind !== "agent" && (!rules.dismissStaleReviews \|\| rv.commitId === p.head_sha)) result.approvals++;
602	682	if (rv.state === "CHANGES_REQUESTED") result.changesRequested.push(rv.author.login);
603	683	}
604		- const checks = this.checks(p.head_sha);
	684	+ // Commit statuses count as checks too: a required check matches a status context.
	685	+ const checks = [...this.checks(p.head_sha), ...this.repo.statuses.asChecks(p.head_sha)];
605	686	result.checks = checks.map((c) => ({ name: c.name, state: c.status === "completed" ? (c.conclusion ?? "neutral") : c.status }));
606	687	if (r.author_kind === "agent" && result.requiredApprovals < 1) {
607	688	// Agent-authored changes always need one human approval unless a rule says otherwise.
		@@ -612,10 +693,10 @@
612	693	if (result.approvals < result.requiredApprovals) result.blockers.push(`needs ${result.requiredApprovals - result.approvals} more approving review(s)`);
613	694	if (result.changesRequested.length) result.blockers.push(`changes requested by ${result.changesRequested.join(", ")}`);
614	695	for (const name of rules.requiredChecks ?? []) {
615		- const c = checks.find((x) => x.name === name);
616		- if (!c) result.blockers.push(`required check '${name}' has not run`);
617		- else if (c.status !== "completed") result.blockers.push(`required check '${name}' is ${c.status}`);
618		- else if (c.conclusion !== "success" && c.conclusion !== "skipped" && c.conclusion !== "neutral") result.blockers.push(`required check '${name}' ${c.conclusion}`);
	696	+ const c = requiredCheck(name, checks, rules.requiredCheckSources?.[name]);
	697	+ if (c.state === "missing") result.blockers.push(`required check '${name}' has not run`);
	698	+ else if (c.state === "pending") result.blockers.push(`required check '${name}' is ${c.status}`);
	699	+ else if (c.state === "failure") result.blockers.push(`required check '${name}' ${c.conclusion}`);
619	700	}
620	701	if (rules.requireLinearHistory && mb !== baseSha) result.blockers.push("branch is behind its base; update it (linear history required)");
621	702	if (caller) {
		@@ -675,6 +756,8 @@
675	756	this.sql.exec("UPDATE pulls SET merged = 1, merged_at = ?, merged_by = ?, merge_commit = ? WHERE number = ?", t, caller.login, newSha, number);
676	757	if (this.repo.queue.isQueued(number)) this.repo.queue.schedule(p.base_ref);
677	758	this.sql.exec("UPDATE issues SET state = 'closed', state_reason = 'merged', closed_at = ?, updated_at = ? WHERE number = ?", t, t, number);
	759	+ this.repo.social.record(number, "merged", caller, { commit_id: newSha });
	760	+ this.repo.social.record(number, "closed", caller, { commit_id: newSha, state_reason: "merged" });
678	761	const meta = this.repo.meta;
679	762	this.repo.emit({ type: "pull_request", action: "merged", repoId: meta.repoId, owner: meta.owner, repo: meta.name, number, headRef: p.head_ref, headSha: p.head_sha, baseRef: p.base_ref, actor: actorOf(caller), at: t });
680	763	// A merge is a push to the base branch from the server's point of view.

		@@ -1,0 +1,29 @@
	1	+import { matchesTrigger } from "@diffinery/workflow-yaml";
	2	+import type { RepoDO } from "./RepoDO.js";
	3	+import type { Caller } from "./types.js";
	4	+
	5	+/**
	6	+ * Start the workflows that listen for an activity event other than push and
	7	+ * pull_request (`release`, `repository_dispatch`), reading the workflow files
	8	+ * at `sha`. `types:` filters match `action`. Like GitHub, events caused by a
	9	+ * job's own token (GITHUB_TOKEN) start no new runs, so workflows can't loop;
	10	+ * repository_dispatch is the exception, as on GitHub.
	11	+ */
	12	+export async function triggerWorkflows(
	13	+ repo: RepoDO,
	14	+ ev: { name: string; action?: string; ref: string; sha: string; payload: Record<string, unknown>; title: string },
	15	+ caller: Caller,
	16	+): Promise<number> {
	17	+ if (caller.kind === "system" && caller.id.startsWith("job:") && ev.name !== "repository_dispatch") return 0;
	18	+ let started = 0;
	19	+ try {
	20	+ for (const w of await repo.actions.loadWorkflows(ev.sha)) {
	21	+ if (!w.workflow \|\| !matchesTrigger(w.workflow, { name: ev.name, action: ev.action })) continue;
	22	+ await repo.actions.createRun(w.workflow, { event: ev.name, ref: ev.ref, sha: ev.sha, payload: ev.payload, caller, title: ev.title });
	23	+ started++;
	24	+ }
	25	+ } catch (e) {
	26	+ console.warn(`${ev.name} trigger failed`, e);
	27	+ }
	28	+ return started;
	29	+}

		@@ -1,4 +1,5 @@
1	1	import { ZERO_OID, mergeBase, mergeTrees, readCommit, serializeCommit } from "@diffinery/git-core";
	2	+import { requiredCheck } from "./required.js";
2	3	import type { Actor } from "@diffinery/shared";
3	4	import { HttpError, now } from "../lib/util.js";
4	5	import type { RepoDO } from "./RepoDO.js";
		@@ -115,8 +116,9 @@
115	116	const pos = (position.get(r.base_ref) ?? 0) + 1;
116	117	position.set(r.base_ref, pos);
117	118	const title = this.sql.exec<{ title: string }>("SELECT title FROM issues WHERE number = ?", r.number).toArray()[0]?.title ?? "";
118		- const required = this.repo.protectionFor(r.base_ref)?.requiredChecks ?? [];
119		- const checks = r.group_sha ? this.repo.collab.checks(r.group_sha) : [];
	119	+ const rules = this.repo.protectionFor(r.base_ref);
	120	+ const required = rules?.requiredChecks ?? [];
	121	+ const checks = r.group_sha ? this.repo.checksAndStatuses(r.group_sha) : [];
120	122	out.push({
121	123	number: r.number,
122	124	title,
		@@ -132,9 +134,9 @@
132	134	groupSha: r.group_sha,
133	135	parentSha: r.parent_sha,
134	136	builtAt: r.built_at,
135		- checks: (required.length ? required : checks.map((c) => c.name)).map((name) => {
136		- const c = checks.find((x) => x.name === name);
137		- return { name, state: !c ? "expected" : c.status === "completed" ? (c.conclusion ?? "neutral") : c.status };
	137	+ checks: (required.length ? required : [...new Set(checks.map((c) => c.name))]).map((name) => {
	138	+ const c = requiredCheck(name, checks, rules?.requiredCheckSources?.[name]);
	139	+ return { name, state: c.state === "missing" ? "expected" : c.state === "pending" ? (c.status ?? "queued") : (c.conclusion ?? "neutral") };
138	140	}),
139	141	});
140	142	}
		@@ -289,19 +291,17 @@
289	291
290	292	/** "pass", "pending", or why the group failed. */
291	293	private verdict(r: QueueRow, base: string, settings: MergeQueueSettings): string {
292		- const required = this.repo.protectionFor(base)?.requiredChecks ?? [];
293		- const checks = this.repo.collab.checks(r.group_sha!);
	294	+ const rules = this.repo.protectionFor(base);
	295	+ const required = rules?.requiredChecks ?? [];
	296	+ const checks = this.repo.checksAndStatuses(r.group_sha!);
294	297	for (const name of required) {
295		- const c = checks.find((x) => x.name === name);
296		- if (c?.status === "completed" && !OK.has(c.conclusion ?? "")) {
	298	+ const c = requiredCheck(name, checks, rules?.requiredCheckSources?.[name]);
	299	+ if (c.state === "failure") {
297	300	const what = c.conclusion === "timed_out" ? "timed out" : c.conclusion === "cancelled" ? "was cancelled" : c.conclusion === "action_required" ? "needs action" : "failed";
298	301	return `the required check '${name}' ${what} on its merge group`;
299	302	}
300	303	}
301		- const pending = required.filter((name) => {
302		- const c = checks.find((x) => x.name === name);
303		- return !c \|\| c.status !== "completed";
304		- });
	304	+ const pending = required.filter((name) => requiredCheck(name, checks, rules?.requiredCheckSources?.[name]).state !== "success");
305	305	if (!pending.length) return "pass";
306	306	const timeout = (settings.checkTimeoutMinutes ?? DEFAULT_TIMEOUT_MINUTES) * 60_000;
307	307	if (r.built_at && Date.parse(r.built_at) + timeout <= Date.now()) {

codician/diffinerypublic

GitHub REST API compatibility: releases, statuses, deployments, git data, search, files (#19)

		@@ -1,0 +1,82 @@
	1	+/**
	2	+ * Release notes like GitHub's "Generate release notes": merged pull requests
	3	+ * between two tags, grouped by the categories in `.github/release.yml`, then
	4	+ * first-time contributors and a full changelog link. Pure, so it is unit-tested.
	5	+ * https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
	6	+ */
	7	+import { parse } from "yaml";
	8	+
	9	+export interface NotesPull {
	10	+ number: number;
	11	+ title: string;
	12	+ author: string;
	13	+ labels: string[];
	14	+ url: string;
	15	+}
	16	+
	17	+export interface NotesCategory {
	18	+ title: string;
	19	+ labels: string[];
	20	+ exclude?: { labels?: string[]; authors?: string[] };
	21	+}
	22	+
	23	+export interface NotesConfig {
	24	+ exclude?: { labels?: string[]; authors?: string[] };
	25	+ categories?: NotesCategory[];
	26	+}
	27	+
	28	+const strings = (v: unknown): string[] \| undefined => (Array.isArray(v) ? v.map(String) : typeof v === "string" ? [v] : undefined);
	29	+
	30	+/** Parse `.github/release.yml`; returns an empty config for anything malformed. */
	31	+export function parseReleaseConfig(text: string): NotesConfig {
	32	+ let doc: unknown;
	33	+ try {
	34	+ doc = parse(text);
	35	+ } catch {
	36	+ return {};
	37	+ }
	38	+ const changelog = (doc as { changelog?: Record<string, unknown> } \| null)?.changelog;
	39	+ if (!changelog \|\| typeof changelog !== "object") return {};
	40	+ const ex = changelog.exclude as Record<string, unknown> \| undefined;
	41	+ const out: NotesConfig = {};
	42	+ if (ex && typeof ex === "object") out.exclude = { labels: strings(ex.labels), authors: strings(ex.authors) };
	43	+ if (Array.isArray(changelog.categories)) {
	44	+ out.categories = [];
	45	+ for (const raw of changelog.categories as Array<Record<string, unknown>>) {
	46	+ if (!raw \|\| typeof raw !== "object" \|\| typeof raw.title !== "string") continue;
	47	+ const cex = raw.exclude as Record<string, unknown> \| undefined;
	48	+ out.categories.push({ title: raw.title, labels: strings(raw.labels) ?? [], exclude: cex && typeof cex === "object" ? { labels: strings(cex.labels), authors: strings(cex.authors) } : undefined });
	49	+ }
	50	+ }
	51	+ return out;
	52	+}
	53	+
	54	+const hasAny = (labels: string[], wanted: string[] \| undefined) => !!wanted?.length && (wanted.includes("*") \|\| labels.some((l) => wanted.includes(l)));
	55	+const byAuthor = (author: string, authors: string[] \| undefined) => !!authors?.some((a) => a === "*" \|\| a.toLowerCase() === author.toLowerCase());
	56	+
	57	+const line = (p: NotesPull) => `* ${p.title} by @${p.author} in ${p.url}`;
	58	+
	59	+export function renderReleaseNotes(input: { pulls: NotesPull[]; newContributors: NotesPull[]; changelogUrl: string; config?: NotesConfig }): string {
	60	+ const cfg = input.config ?? {};
	61	+ const pulls = input.pulls.filter((p) => !hasAny(p.labels, cfg.exclude?.labels) && !byAuthor(p.author, cfg.exclude?.authors));
	62	+ const parts: string[] = [];
	63	+ if (pulls.length) {
	64	+ const sections: string[] = [];
	65	+ if (cfg.categories?.length) {
	66	+ const placed = new Set<number>();
	67	+ for (const cat of cfg.categories) {
	68	+ const items = pulls.filter((p) => !placed.has(p.number) && hasAny(p.labels, cat.labels) && !hasAny(p.labels, cat.exclude?.labels) && !byAuthor(p.author, cat.exclude?.authors));
	69	+ for (const p of items) placed.add(p.number);
	70	+ if (items.length) sections.push(`### ${cat.title}\n${items.map(line).join("\n")}`);
	71	+ }
	72	+ const other = pulls.filter((p) => !placed.has(p.number));
	73	+ if (other.length) sections.push(`### Other Changes\n${other.map(line).join("\n")}`);
	74	+ } else sections.push(pulls.map(line).join("\n"));
	75	+ parts.push(`## What's Changed\n${sections.join("\n\n")}`);
	76	+ }
	77	+ if (input.newContributors.length) {
	78	+ parts.push(`## New Contributors\n${input.newContributors.map((p) => `* @${p.author} made their first contribution in ${p.url}`).join("\n")}`);
	79	+ }
	80	+ parts.push(`Full Changelog: ${input.changelogUrl}`);
	81	+ return parts.join("\n\n");
	82	+}

		@@ -1,0 +1,49 @@
	1	+import { HttpError } from "../lib/util.js";
	2	+import type { Check } from "./collab.js";
	3	+
	4	+/** The app name of checks reported by Diffinery Actions. */
	5	+export const ACTIONS_APP = "diffinery-actions";
	6	+
	7	+const OK = new Set(["success", "skipped", "neutral"]);
	8	+
	9	+/** Who reported a check: "diffinery-actions", or the login that created a check run or commit status. */
	10	+export function sourceOf(c: Pick<Check, "app"> & { creatorLogin?: string \| null }): string {
	11	+ if (c.app === ACTIONS_APP) return ACTIONS_APP;
	12	+ return (c.creatorLogin ?? c.app).toLowerCase();
	13	+}
	14	+
	15	+export type RequiredState = { state: "success" \| "failure" \| "pending" \| "missing"; conclusion: string \| null; status: string \| null };
	16	+
	17	+/**
	18	+ * Whether a required check passes on a commit, given every check run and
	19	+ * commit status reported there. The rules stop a weaker reporter from
	20	+ * outvoting the real one:
	21	+ *
	22	+ * - With a bound source (`requiredCheckSources[name]`), only that reporter counts.
	23	+ * - Otherwise, when Diffinery Actions reported a check with that name, it is the authority.
	24	+ * - Reports from agents never satisfy a required check.
	25	+ * - Of what is left, any failure fails and anything unfinished is pending.
	26	+ */
	27	+export function requiredCheck(name: string, entries: Check[], source?: string): RequiredState {
	28	+ let named = entries.filter((e) => e.name === name);
	29	+ if (source) named = named.filter((e) => sourceOf(e) === source.toLowerCase());
	30	+ else if (named.some((e) => e.app === ACTIONS_APP)) named = named.filter((e) => e.app === ACTIONS_APP);
	31	+ named = named.filter((e) => e.creatorKind !== "agent");
	32	+ if (!named.length) return { state: "missing", conclusion: null, status: null };
	33	+ const failed = named.find((e) => e.status === "completed" && !OK.has(e.conclusion ?? ""));
	34	+ if (failed) return { state: "failure", conclusion: failed.conclusion ?? "failure", status: "completed" };
	35	+ const open = named.find((e) => e.status !== "completed");
	36	+ if (open) return { state: "pending", conclusion: null, status: open.status };
	37	+ return { state: "success", conclusion: named[0]!.conclusion ?? "success", status: "completed" };
	38	+}
	39	+
	40	+/** Validate a branch protection's `requiredCheckSources`: check name → reporter (a login, or "diffinery-actions"). */
	41	+export function normalizeCheckSources(v: unknown): Record<string, string> {
	42	+ if (!v \|\| typeof v !== "object" \|\| Array.isArray(v)) throw new HttpError(422, "requiredCheckSources must map check names to a reporter login or diffinery-actions");
	43	+ const out: Record<string, string> = {};
	44	+ for (const [k, s] of Object.entries(v as Record<string, unknown>)) {
	45	+ if (!k \|\| k.length > 255 \|\| typeof s !== "string" \|\| !/^[A-Za-z0-9][A-Za-z0-9._\[\]-]{0,99}$/.test(s)) throw new HttpError(422, `invalid source for required check '${k}'`);
	46	+ out[k] = s.toLowerCase();
	47	+ }
	48	+ return out;
	49	+}

		@@ -68,6 +68,54 @@
68	68	parent_sha TEXT, group_sha TEXT, group_ref TEXT, built_at TEXT
69	69	);
70	70	CREATE TABLE IF NOT EXISTS sandboxes (id TEXT PRIMARY KEY, secret TEXT NOT NULL, created_by TEXT NOT NULL, ref TEXT NOT NULL, created_at TEXT NOT NULL, status TEXT NOT NULL);
	71	+
	72	+-- GitHub-compatible extras (see ./releases.ts, ./statuses.ts, ./deployments.ts, ./social.ts).
	73	+CREATE TABLE IF NOT EXISTS releases (
	74	+ id INTEGER PRIMARY KEY AUTOINCREMENT, tag_name TEXT NOT NULL, target_commitish TEXT NOT NULL, name TEXT NOT NULL DEFAULT '',
	75	+ body TEXT NOT NULL DEFAULT '', draft INTEGER NOT NULL DEFAULT 0, prerelease INTEGER NOT NULL DEFAULT 0,
	76	+ author_id TEXT NOT NULL, author_login TEXT NOT NULL, author_kind TEXT NOT NULL DEFAULT 'user',
	77	+ created_at TEXT NOT NULL, published_at TEXT, updated_at TEXT NOT NULL
	78	+);
	79	+CREATE INDEX IF NOT EXISTS releases_tag ON releases(tag_name);
	80	+CREATE TABLE IF NOT EXISTS release_assets (
	81	+ id INTEGER PRIMARY KEY AUTOINCREMENT, release_id INTEGER NOT NULL, name TEXT NOT NULL, label TEXT NOT NULL DEFAULT '',
	82	+ content_type TEXT NOT NULL, size INTEGER NOT NULL DEFAULT 0, state TEXT NOT NULL DEFAULT 'starter', download_count INTEGER NOT NULL DEFAULT 0,
	83	+ uploader_id TEXT, uploader_login TEXT, uploader_kind TEXT, r2_key TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
	84	+ UNIQUE (release_id, name)
	85	+);
	86	+CREATE TABLE IF NOT EXISTS statuses (
	87	+ id INTEGER PRIMARY KEY AUTOINCREMENT, sha TEXT NOT NULL, state TEXT NOT NULL, context TEXT NOT NULL, description TEXT, target_url TEXT,
	88	+ creator_id TEXT NOT NULL, creator_login TEXT NOT NULL, creator_kind TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
	89	+);
	90	+CREATE INDEX IF NOT EXISTS statuses_sha ON statuses(sha, context);
	91	+CREATE TABLE IF NOT EXISTS deployments (
	92	+ id INTEGER PRIMARY KEY AUTOINCREMENT, sha TEXT NOT NULL, ref TEXT NOT NULL, task TEXT NOT NULL DEFAULT 'deploy', environment TEXT NOT NULL,
	93	+ original_environment TEXT NOT NULL, description TEXT, payload TEXT NOT NULL DEFAULT '{}', transient INTEGER NOT NULL DEFAULT 0,
	94	+ production INTEGER NOT NULL DEFAULT 0, creator_id TEXT NOT NULL, creator_login TEXT NOT NULL, creator_kind TEXT NOT NULL,
	95	+ job_id TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
	96	+);
	97	+CREATE INDEX IF NOT EXISTS deployments_env ON deployments(environment);
	98	+CREATE TABLE IF NOT EXISTS deployment_statuses (
	99	+ id INTEGER PRIMARY KEY AUTOINCREMENT, deployment_id INTEGER NOT NULL, state TEXT NOT NULL, description TEXT NOT NULL DEFAULT '',
	100	+ environment TEXT NOT NULL, environment_url TEXT NOT NULL DEFAULT '', log_url TEXT NOT NULL DEFAULT '',
	101	+ creator_id TEXT NOT NULL, creator_login TEXT NOT NULL, creator_kind TEXT NOT NULL, created_at TEXT NOT NULL
	102	+);
	103	+CREATE INDEX IF NOT EXISTS deployment_statuses_dep ON deployment_statuses(deployment_id);
	104	+CREATE TABLE IF NOT EXISTS environments (
	105	+ id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL UNIQUE COLLATE NOCASE, branch_policy TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
	106	+);
	107	+CREATE TABLE IF NOT EXISTS environment_secrets (environment TEXT NOT NULL COLLATE NOCASE, name TEXT NOT NULL, ciphertext TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY (environment, name));
	108	+CREATE TABLE IF NOT EXISTS environment_variables (environment TEXT NOT NULL COLLATE NOCASE, name TEXT NOT NULL, value TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY (environment, name));
	109	+CREATE TABLE IF NOT EXISTS reactions (
	110	+ id INTEGER PRIMARY KEY AUTOINCREMENT, subject TEXT NOT NULL, content TEXT NOT NULL, user_id TEXT NOT NULL, user_login TEXT NOT NULL,
	111	+ user_kind TEXT NOT NULL, created_at TEXT NOT NULL, UNIQUE (subject, content, user_id)
	112	+);
	113	+CREATE TABLE IF NOT EXISTS issue_events (
	114	+ id INTEGER PRIMARY KEY AUTOINCREMENT, number INTEGER NOT NULL, event TEXT NOT NULL, actor_id TEXT NOT NULL, actor_login TEXT NOT NULL,
	115	+ actor_kind TEXT NOT NULL, detail TEXT NOT NULL DEFAULT '{}', created_at TEXT NOT NULL
	116	+);
	117	+CREATE INDEX IF NOT EXISTS issue_events_number ON issue_events(number);
	118	+CREATE TABLE IF NOT EXISTS ref_actors (ref TEXT PRIMARY KEY, actor_id TEXT NOT NULL, actor_kind TEXT NOT NULL, updated_at TEXT NOT NULL);
71	119	`;
72	120
73	121	/** Columns added after a table was first created; added with ALTER TABLE when missing. */
		@@ -75,6 +123,11 @@
75	123	// The commit a run reports its checks on: the PR head for pull_request runs, whose
76	124	// GITHUB_SHA is the test merge commit. Null means the run's own sha.
77	125	["runs", "head_sha", "TEXT"],
	126	+ // Who created a check run over the REST API (null for Diffinery Actions), and GitHub's numeric id.
	127	+ ["checks", "creator_id", "TEXT"],
	128	+ ["checks", "creator_login", "TEXT"],
	129	+ ["checks", "creator_kind", "TEXT"],
	130	+ ["checks", "seq", "INTEGER"],
78	131	];
79	132
80	133	export function migrateRepoSchema(sql: SqlStorage): void {

		@@ -1,0 +1,117 @@
	1	+import { inRange, matchesText, type IssueQuery } from "../lib/search-query.js";
	2	+import type { RepoDO } from "./RepoDO.js";
	3	+
	4	+type Row = {
	5	+ number: number;
	6	+ kind: string;
	7	+ title: string;
	8	+ body: string;
	9	+ state: string;
	10	+ author_login: string;
	11	+ assignees: string;
	12	+ labels: string;
	13	+ created_at: string;
	14	+ updated_at: string;
	15	+ closed_at: string \| null;
	16	+ locked: number;
	17	+ head_ref: string \| null;
	18	+ base_ref: string \| null;
	19	+ draft: number \| null;
	20	+ merged: number \| null;
	21	+ comments: number;
	22	+};
	23	+
	24	+/** Rows scanned per repository, and comment bodies read for `in:comments`. */
	25	+const MAX_ROWS = 5000;
	26	+const MAX_COMMENT_ROWS = 2000;
	27	+
	28	+/** One hit: the issue number and the value it sorts by. The Worker merges hits across repositories. */
	29	+export type SearchHit = { number: number; key: string \| number };
	30	+
	31	+/**
	32	+ * Issue and pull request search within one repository. Returns only numbers
	33	+ * and sort keys (at most `limit`); the Worker merges the hits of every
	34	+ * repository the caller can read and then loads just the page it returns.
	35	+ */
	36	+export function searchIssues(repo: RepoDO, q: IssueQuery, limit: number): { hits: SearchHit[]; total: number } {
	37	+ const where: string[] = [];
	38	+ const args: unknown[] = [];
	39	+ if (q.kind) {
	40	+ where.push("i.kind = ?");
	41	+ args.push(q.kind);
	42	+ }
	43	+ if (q.state) {
	44	+ where.push("i.state = ?");
	45	+ args.push(q.state);
	46	+ }
	47	+ if (q.merged !== undefined) where.push(q.merged ? "p.merged = 1" : "coalesce(p.merged, 0) = 0");
	48	+ if (q.draft !== undefined) where.push(q.draft ? "p.draft = 1" : "coalesce(p.draft, 0) = 0");
	49	+ if (q.locked !== undefined) where.push(q.locked ? "i.locked = 1" : "i.locked = 0");
	50	+ if (q.author) {
	51	+ where.push("i.author_login = ? COLLATE NOCASE");
	52	+ args.push(q.author);
	53	+ }
	54	+ if (q.notAuthor) {
	55	+ where.push("i.author_login != ? COLLATE NOCASE");
	56	+ args.push(q.notAuthor);
	57	+ }
	58	+ if (q.head) {
	59	+ where.push("p.head_ref = ?");
	60	+ args.push(q.head);
	61	+ }
	62	+ if (q.base) {
	63	+ where.push("p.base_ref = ?");
	64	+ args.push(q.base);
	65	+ }
	66	+ for (const l of q.labels) {
	67	+ where.push("EXISTS (SELECT 1 FROM json_each(i.labels) WHERE lower(value) = lower(?))");
	68	+ args.push(l);
	69	+ }
	70	+ for (const l of q.notLabels) {
	71	+ where.push("NOT EXISTS (SELECT 1 FROM json_each(i.labels) WHERE lower(value) = lower(?))");
	72	+ args.push(l);
	73	+ }
	74	+ if (q.noLabel) where.push("i.labels = '[]'");
	75	+ if (q.noAssignee) where.push("i.assignees = '[]'");
	76	+ if (q.assignee) {
	77	+ where.push("EXISTS (SELECT 1 FROM json_each(i.assignees) WHERE lower(value) = lower(?))");
	78	+ args.push(q.assignee);
	79	+ }
	80	+ const w = where.length ? `WHERE ${where.join(" AND ")}` : "";
	81	+ const rows = repo.sql
	82	+ .exec<Row>(
	83	+ `SELECT i., p.head_ref, p.base_ref, p.draft, p.merged, (SELECT count() FROM comments c WHERE c.number = i.number AND c.review_id IS NULL) AS comments
	84	+ FROM issues i LEFT JOIN pulls p ON p.number = i.number ${w} ORDER BY i.number DESC LIMIT ?`,
	85	+ ...args,
	86	+ MAX_ROWS,
	87	+ )
	88	+ .toArray();
	89	+ const fields = q.in.length ? q.in : ["title", "body"];
	90	+ // in:comments reads a bounded number of the newest comment bodies, once, instead of a query per issue.
	91	+ const commentText = new Map<number, string[]>();
	92	+ if (fields.includes("comments") && q.text.length) {
	93	+ for (const c of repo.sql.exec<{ number: number; body: string }>("SELECT number, body FROM comments ORDER BY rowid DESC LIMIT ?", MAX_COMMENT_ROWS).toArray()) {
	94	+ const list = commentText.get(c.number) ?? [];
	95	+ list.push(c.body);
	96	+ commentText.set(c.number, list);
	97	+ }
	98	+ }
	99	+ const matched = rows.filter((r) => {
	100	+ if (!inRange(r.created_at, q.created) \|\| !inRange(r.updated_at, q.updated) \|\| !inRange(r.closed_at, q.closed)) return false;
	101	+ if (!q.text.length) return true;
	102	+ const hay: string[] = [];
	103	+ if (fields.includes("title")) hay.push(r.title);
	104	+ if (fields.includes("body")) hay.push(r.body);
	105	+ if (fields.includes("comments")) hay.push(...(commentText.get(r.number) ?? []));
	106	+ return matchesText(q.text, hay);
	107	+ });
	108	+ const sort = q.sort ?? { field: "created", dir: "desc" };
	109	+ const key = (r: Row) => (sort.field === "comments" ? r.comments : sort.field === "updated" ? r.updated_at : r.created_at);
	110	+ matched.sort((a, b) => {
	111	+ const x = key(a);
	112	+ const y = key(b);
	113	+ const c = x < y ? -1 : x > y ? 1 : b.number - a.number;
	114	+ return sort.dir === "asc" ? c : -c;
	115	+ });
	116	+ return { hits: matched.slice(0, Math.max(0, Math.min(limit, 1000))).map((r) => ({ number: r.number, key: key(r) })), total: matched.length };
	117	+}

		@@ -1,0 +1,154 @@
	1	+import { HttpError, now } from "../lib/util.js";
	2	+import type { Check } from "./collab.js";
	3	+import type { RepoDO } from "./RepoDO.js";
	4	+import { atLeast, type Caller } from "./types.js";
	5	+
	6	+export type StatusState = "error" \| "failure" \| "pending" \| "success";
	7	+const STATES = new Set<StatusState>(["error", "failure", "pending", "success"]);
	8	+
	9	+type StatusRow = {
	10	+ id: number;
	11	+ sha: string;
	12	+ state: StatusState;
	13	+ context: string;
	14	+ description: string \| null;
	15	+ target_url: string \| null;
	16	+ creator_id: string;
	17	+ creator_login: string;
	18	+ creator_kind: string;
	19	+ created_at: string;
	20	+ updated_at: string;
	21	+};
	22	+
	23	+export type CommitStatus = {
	24	+ id: number;
	25	+ sha: string;
	26	+ state: StatusState;
	27	+ context: string;
	28	+ description: string \| null;
	29	+ targetUrl: string \| null;
	30	+ creator: { id: string; login: string; kind: string };
	31	+ createdAt: string;
	32	+ updatedAt: string;
	33	+};
	34	+
	35	+const toStatus = (r: StatusRow): CommitStatus => ({
	36	+ id: r.id,
	37	+ sha: r.sha,
	38	+ state: r.state,
	39	+ context: r.context,
	40	+ description: r.description,
	41	+ targetUrl: r.target_url,
	42	+ creator: { id: r.creator_id, login: r.creator_login, kind: r.creator_kind },
	43	+ createdAt: r.created_at,
	44	+ updatedAt: r.updated_at,
	45	+});
	46	+
	47	+/** Combined state as GitHub computes it: any failure or error fails, any pending (or none) is pending. */
	48	+export function combineStates(states: StatusState[]): StatusState \| "pending" {
	49	+ if (states.some((s) => s === "error" \|\| s === "failure")) return "failure";
	50	+ if (!states.length \|\| states.some((s) => s === "pending")) return "pending";
	51	+ return "success";
	52	+}
	53	+
	54	+/**
	55	+ * Commit statuses (the older, simpler API next to check runs). External CI and
	56	+ * bots post them; they show with the checks on pull requests and commits, and
	57	+ * branch protection's required checks match a status `context` too.
	58	+ */
	59	+export class Statuses {
	60	+ constructor(private repo: RepoDO) {}
	61	+
	62	+ private get sql() {
	63	+ return this.repo.sql;
	64	+ }
	65	+
	66	+ async create(rev: string, input: { state?: string; target_url?: string \| null; description?: string \| null; context?: string }, caller: Caller): Promise<CommitStatus> {
	67	+ if (!atLeast(caller.role, "write")) throw new HttpError(403, "write access is required to create commit statuses");
	68	+ const sha = await this.repo.resolve(rev);
	69	+ if (!sha) throw new HttpError(422, `no commit found for SHA: ${rev}`, { errors: [{ resource: "Status", code: "invalid", field: "sha" }] });
	70	+ const state = input.state as StatusState;
	71	+ if (!STATES.has(state)) throw new HttpError(422, "state must be one of error, failure, pending, success", { errors: [{ resource: "Status", code: "invalid", field: "state" }] });
	72	+ const target = input.target_url \|\| null;
	73	+ if (target && !/^https?:\/\//i.test(target)) throw new HttpError(422, "target_url must be an http(s) URL", { errors: [{ resource: "Status", code: "invalid", field: "target_url" }] });
	74	+ const context = (input.context \|\| "default").slice(0, 255);
	75	+ if (this.sql.exec<{ n: number }>("SELECT count(*) AS n FROM statuses WHERE sha = ? AND context = ?", sha, context).one().n >= 1000) {
	76	+ throw new HttpError(422, "this SHA and context has reached the maximum number of statuses");
	77	+ }
	78	+ const t = now();
	79	+ this.sql.exec(
	80	+ "INSERT INTO statuses (sha, state, context, description, target_url, creator_id, creator_login, creator_kind, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
	81	+ sha,
	82	+ state,
	83	+ context,
	84	+ input.description ? input.description.slice(0, 1024) : null,
	85	+ target,
	86	+ caller.id,
	87	+ caller.login,
	88	+ caller.kind,
	89	+ t,
	90	+ t,
	91	+ );
	92	+ const status = toStatus(this.sql.exec<StatusRow>("SELECT * FROM statuses WHERE id = last_insert_rowid()").one());
	93	+ const m = this.repo.meta;
	94	+ this.repo.emit({
	95	+ type: "status",
	96	+ repoId: m.repoId,
	97	+ owner: m.owner,
	98	+ repo: m.name,
	99	+ payload: { id: status.id, sha, name: `${m.owner}/${m.name}`, state, context, description: status.description, target_url: target, commit: { sha }, created_at: t, updated_at: t },
	100	+ actor: { id: caller.id, login: caller.login, kind: caller.kind, onBehalfOf: caller.onBehalfOf },
	101	+ at: t,
	102	+ });
	103	+ for (const p of this.sql.exec<{ number: number }>("SELECT number FROM pulls WHERE head_sha = ?", sha).toArray()) this.repo.broadcast(`pr:${p.number}`, { action: "checks" });
	104	+ if (state !== "pending") {
	105	+ const queueBase = this.repo.queue.baseForGroup(sha);
	106	+ if (queueBase) this.repo.queue.schedule(queueBase);
	107	+ }
	108	+ return status;
	109	+ }
	110	+
	111	+ /** Every status for a commit, newest first. */
	112	+ list(sha: string): CommitStatus[] {
	113	+ return this.sql.exec<StatusRow>("SELECT * FROM statuses WHERE sha = ? ORDER BY id DESC", sha).toArray().map(toStatus);
	114	+ }
	115	+
	116	+ /** The latest status per context. */
	117	+ latest(sha: string): CommitStatus[] {
	118	+ return this.sql
	119	+ .exec<StatusRow>("SELECT s.* FROM statuses s WHERE s.sha = ? AND s.id = (SELECT max(id) FROM statuses x WHERE x.sha = s.sha AND x.context = s.context) ORDER BY s.context", sha)
	120	+ .toArray()
	121	+ .map(toStatus);
	122	+ }
	123	+
	124	+ combined(sha: string): { state: string; statuses: CommitStatus[] } {
	125	+ const statuses = this.latest(sha);
	126	+ return { state: combineStates(statuses.map((s) => s.state)), statuses };
	127	+ }
	128	+
	129	+ /** Latest statuses shaped like check runs, for the UI and merge requirements. */
	130	+ asChecks(sha: string): Check[] {
	131	+ // Newest per context and creator: one reporter's later status can't overwrite another's for required checks.
	132	+ const rows = this.sql
	133	+ .exec<StatusRow>("SELECT s.* FROM statuses s WHERE s.sha = ? AND s.id = (SELECT max(id) FROM statuses x WHERE x.sha = s.sha AND x.context = s.context AND x.creator_id = s.creator_id) ORDER BY s.context, s.id", sha)
	134	+ .toArray()
	135	+ .map(toStatus);
	136	+ return rows.map((s) => ({
	137	+ id: `status-${s.id}`,
	138	+ sha,
	139	+ name: s.context,
	140	+ status: s.state === "pending" ? "in_progress" : "completed",
	141	+ conclusion: s.state === "pending" ? null : s.state === "error" ? "failure" : s.state,
	142	+ runId: null,
	143	+ jobId: null,
	144	+ detailsUrl: s.targetUrl,
	145	+ output: s.description ? { title: s.description } : null,
	146	+ app: "status",
	147	+ startedAt: s.createdAt,
	148	+ completedAt: s.state === "pending" ? null : s.updatedAt,
	149	+ creatorId: s.creator.id,
	150	+ creatorLogin: s.creator.login,
	151	+ creatorKind: s.creator.kind,
	152	+ }));
	153	+ }
	154	+}

		@@ -24,6 +24,8 @@
24	24	requiredApprovals?: number;
25	25	dismissStaleReviews?: boolean;
26	26	requiredChecks?: string[];
	27	+ /** Bind a required check to one reporter: check name → login, or "diffinery-actions". */
	28	+ requiredCheckSources?: Record<string, string>;
27	29	allowForcePush?: boolean;
28	30	allowDeletion?: boolean;
29	31	requireLinearHistory?: boolean;

		@@ -1,0 +1,23 @@
	1	+/** @jsxImportSource hono/jsx */
	2	+import type { FC } from "hono/jsx";
	3	+import type { Check } from "../repo/collab.js";
	4	+
	5	+/**
	6	+ * A check's name, linked to its job for Diffinery checks, or to the
	7	+ * `target_url` / `details_url` an external CI reported (http(s) only).
	8	+ */
	9	+export const CheckName: FC<{ base: string; ch: Pick<Check, "name" \| "runId" \| "jobId"> & { detailsUrl?: string \| null }; class?: string }> = ({ base, ch, class: cls }) => {
	10	+ if (ch.runId)
	11	+ return (
	12	+ <a class={cls} href={`${base}/actions/runs/${ch.runId}${ch.jobId ? `/job/${ch.jobId}` : ""}`}>
	13	+ {ch.name}
	14	+ </a>
	15	+ );
	16	+ if (ch.detailsUrl && /^https?:\/\//i.test(ch.detailsUrl))
	17	+ return (
	18	+ <a class={cls} href={ch.detailsUrl} rel="noopener noreferrer nofollow" target="_blank">
	19	+ {ch.name}
	20	+ </a>
	21	+ );
	22	+ return <span class={cls}>{ch.name}</span>;
	23	+};

		@@ -8,6 +8,8 @@
8	8	import { ICONS } from "./assets.js";
9	9	import { KCheckbox, KRadio, KSelect } from "./kumo.js";
10	10	import { csrfToken, type FormData } from "./csrf.js";
	11	+import { CheckName } from "./checks.js";
	12	+import { ReleasesSection } from "./releases.js";
11	13	import {
12	14	CommitRow,
13	15	CopyButton,
		@@ -118,11 +120,12 @@
118	120	async function treePage(c: AppContext, l: Loaded, ref: string, path: string, root: boolean): Promise<Response> {
119	121	const { repo, caller, stub } = l;
120	122	const base = repoUrl(repo);
121		- const [tree, names, stats, last] = await Promise.all([
	123	+ const [tree, names, stats, last, releases] = await Promise.all([
122	124	stub.tree(ref, path),
123	125	refNames(stub),
124	126	root && !path ? stub.stats() : Promise.resolve(null),
125	127	!path ? stub.log(ref, { limit: 1 }).catch(() => []) : Promise.resolve([]),
	128	+ root && !path ? stub.releaseSummary(caller).catch(() => null) : Promise.resolve(null),
126	129	]);
127	130	const counts = stats ? { issues: stats.openIssues, pulls: stats.openPulls } : undefined;
128	131	if (!tree) {
		@@ -262,6 +265,7 @@
262	265	</dl>
263	266	) : null}
264	267	</section>
	268	+ <ReleasesSection base={base} summary={releases} canWrite={atLeast(caller.role, "write") && !repo.archived} topics={repo.topics} />
265	269	<section>
266	270	<h3>Shortcuts</h3>
267	271	<p class="small muted m0">
		@@ -847,7 +851,7 @@
847	851	const { repo, caller, stub } = l;
848	852	const base = repoUrl(repo);
849	853	const cm = await stub.commitWithDiff(prm(c, "sha"));
850		- const checks = await stub.checks(cm.sha).catch(() => []);
	854	+ const checks = await stub.checksAndStatuses(cm.sha).catch(() => []);
851	855	const [title, ...rest] = cm.message.split("\n");
852	856	const body = rest.join("\n").trim();
853	857	const files = cm.files as DiffFile[];
		@@ -889,7 +893,7 @@
889	893	{checks.map((ch) => (
890	894	<li>
891	895	<Status status={ch.status} conclusion={ch.conclusion} />
892		- {ch.runId ? <a href={`${base}/actions/runs/${ch.runId}${ch.jobId ? `/job/${ch.jobId}` : ""}`}>{ch.name}</a> : <span>{ch.name}</span>}
	896	+ <CheckName base={base} ch={ch} />
893	897	<span class="muted small">{ch.output?.title ?? ""}</span>
894	898	</li>
895	899	))}

		@@ -11,6 +11,7 @@
11	11	import { csrfToken } from "./csrf.js";
12	12	import { MailStore, type WatchLevel } from "../mail/prefs.js";
13	13	import { mentions } from "../mail/notify.js";
	14	+import { CheckName } from "./checks.js";
14	15	import {
15	16	Actor,
16	17	CommitRow,
		@@ -696,7 +697,7 @@
696	697	{showChecks.map((ch) => (
697	698	<li>
698	699	<Status status={ch.status} conclusion={ch.conclusion} />
699		- {ch.runId ? <a href={`${base}/actions/runs/${ch.runId}${ch.jobId ? `/job/${ch.jobId}` : ""}`}>{ch.name}</a> : <span>{ch.name}</span>}
	700	+ <CheckName base={base} ch={ch} />
700	701	<span class="muted small grow">{ch.output?.title && ch.output.title !== ch.conclusion ? ch.output.title : ""}</span>
701	702	<span class="muted small">{ch.startedAt ? duration(ch.startedAt, ch.completedAt) : ""}</span>
702	703	</li>
		@@ -961,7 +962,7 @@
961	962	);
962	963
963	964	if (tab === "conversation") {
964		- const [m, checks] = await Promise.all([i.state === "open" ? stub.mergeability(n, caller).catch(() => null) : Promise.resolve(null), stub.checks(i.pull.headSha).catch(() => [] as Check[])]);
	965	+ const [m, checks] = await Promise.all([i.state === "open" ? stub.mergeability(n, caller).catch(() => null) : Promise.resolve(null), stub.checksAndStatuses(i.pull.headSha).catch(() => [] as Check[])]);
965	966	return page(
966	967	<div class="grid">
967	968	<div>
		@@ -1007,7 +1008,7 @@
1007	1008	}
1008	1009
1009	1010	if (tab === "checks") {
1010		- const [checks, runs] = await Promise.all([stub.checks(i.pull.headSha).catch(() => [] as Check[]), stub.runs({ prNumber: n, limit: 30 }).catch(() => ({ runs: [], total: 0 }))]);
	1011	+ const [checks, runs] = await Promise.all([stub.checksAndStatuses(i.pull.headSha).catch(() => [] as Check[]), stub.runs({ prNumber: n, limit: 30 }).catch(() => ({ runs: [], total: 0 }))]);
1011	1012	return page(
1012	1013	<div data-fragment="checks">
1013	1014	<div class="box">
		@@ -1020,13 +1021,7 @@
1020	1021	<li>
1021	1022	<Status status={ch.status} conclusion={ch.conclusion} />
1022	1023	<div class="grow">
1023		- {ch.runId ? (
1024		- <a class="title" href={`${base}/actions/runs/${ch.runId}${ch.jobId ? `/job/${ch.jobId}` : ""}`}>
1025		- {ch.name}
1026		- </a>
1027		- ) : (
1028		- <span class="title">{ch.name}</span>
1029		- )}
	1024	+ <CheckName base={base} ch={ch} class="title" />
1030	1025	<div class="meta">
1031	1026	{ch.app} · {ch.status === "completed" ? (ch.conclusion ?? "neutral") : ch.status.replace("_", " ")}
1032	1027	{ch.output?.summary ? ` · ${ch.output.summary.slice(0, 200)}` : ""}

		@@ -37,8 +37,25 @@
37	37	keys(): string[];
38	38	}
39	39
	40	+/** Form bodies bigger than this are refused before they are read (routes taking files pass a larger cap). */
	41	+export const MAX_FORM_BYTES = 10 * 1024 * 1024;
	42	+
	43	+/**
	44	+ * Refuse a body over `maxBytes` before anything buffers it. Browsers always
	45	+ * send Content-Length with a form, so a body without one is refused too.
	46	+ */
	47	+export function checkFormSize(c: AppContext, maxBytes = MAX_FORM_BYTES): void {
	48	+ const len = c.req.header("content-length");
	49	+ if (len === undefined \|\| !/^\d+$/.test(len)) {
	50	+ if (c.req.raw.body === null) return;
	51	+ throw new HttpError(411, "send the form with a Content-Length header");
	52	+ }
	53	+ if (Number(len) > maxBytes) throw new HttpError(413, `the form is too large (the limit is ${Math.floor(maxBytes / 1024 / 1024)} MB)`);
	54	+}
	55	+
40	56	/** Parse an urlencoded/multipart form once per request (Hono caches the body). */
41		-export async function formData(c: AppContext): Promise<FormData> {
	57	+export async function formData(c: AppContext, maxBytes = MAX_FORM_BYTES): Promise<FormData> {
	58	+ checkFormSize(c, maxBytes);
42	59	const raw = (await c.req.parseBody({ all: true })) as Record<string, string \| File \| Array<string \| File>>;
43	60	const all = (name: string): string[] => {
44	61	const v = raw[name];
		@@ -57,7 +74,7 @@
57	74	}
58	75
59	76	/** Reject state-changing requests without a matching token (and cross-origin requests). */
60		-export async function verifyCsrf(c: AppContext): Promise<FormData> {
	77	+export async function verifyCsrf(c: AppContext, maxBytes = MAX_FORM_BYTES): Promise<FormData> {
61	78	const origin = c.req.header("origin");
62	79	if (origin && origin !== "null") {
63	80	const self = new URL(c.req.url).origin;
		@@ -66,7 +83,7 @@
66	83	}
67	84	const type = c.req.header("content-type") ?? "";
68	85	if (!/^(application\/x-www-form-urlencoded\|multipart\/form-data)/i.test(type)) throw new HttpError(415, "expected a form submission");
69		- const form = await formData(c);
	86	+ const form = await formData(c, maxBytes);
70	87	const cookie = getCookie(c, CSRF_COOKIE);
71	88	const sent = form.s(CSRF_FIELD);
72	89	if (!cookie \|\| !sent \|\| !safeEqual(cookie, sent)) throw new HttpError(403, "your session token expired or is missing; reload the page and try again");