import { IssuesTransport, Introspector, CredentialProbe, DeviceAuth, PortName, ScmTransport, GapPolicy, Logger, BaseScmAdapter, ScmManifest, CiTransport, BaseCiAdapter, CiManifest, CiStatusMaps, DeployTransport, BaseDeployAdapter, DeployManifest, DeployStatusMaps, IssuesProviderConfig, BaseIssuesAdapter, LinkMap, ProviderRoleMap, TypeMap, CapabilityManifest } from '@lonca/baron-core';
export { DeviceAuth, DeviceCodePrompt } from '@lonca/baron-core';
import { Octokit } from 'octokit';

/**
 * The GitHub provider id. Kept in its own leaf module (no imports) so the transport, introspector,
 * and scm modules can read it WITHOUT importing `index.ts` — `index.ts` re-exports those modules, so
 * referencing an `index.ts` const at their module top-level would hit a circular temporal-dead-zone
 * error under real ESM evaluation order.
 */
declare const GITHUB_PROVIDER = "github";

interface GithubTransportOptions {
    readonly owner: string;
    readonly repo: string;
    /** Fine-grained PAT or token. Read from env / secret-manager by the caller; never committed. */
    readonly token: string;
    /**
     * Integration branch to fork from and target PRs at when omitted; defaults to the repo default
     * branch. Only the scm transport reads it (the issues transport ignores it).
     */
    readonly baseBranch?: string | undefined;
}
/**
 * Live transport over the GitHub REST API (octokit). Baron's issue `id` is the per-repo issue
 * NUMBER (every REST path keys on `issue_number`); hierarchy is emulated by the core via labels, so
 * this transport never deals with parents. The role-bearing discriminator is a label, so writes
 * ECHO `target.label` back as the discriminator (a cold {@link getIssue} can only report open/closed
 * — recovering a mid-workflow role from labels would need the role map, which invariant #4 forbids
 * the transport from holding; this lossy cold read is the same documented debt as type-role reverse
 * resolution).
 */
declare function createGithubTransport(options: GithubTransportOptions): IssuesTransport;

/**
 * Live introspection over the GitHub REST API. GitHub's issue vocabulary is mostly fixed: states
 * are binary (open/closed) and workflow nuance rides on labels, so `stateKey` is 'label' and the
 * states are the two intrinsic terminals. Native issue TYPES are an org opt-in feature (often
 * disabled); when present they enrich `workItemTypes`, otherwise it collapses to a single 'issue'.
 * Board columns and iterations live in the separate Projects v2 GraphQL API and are omitted here.
 */
declare function createGithubIntrospector(options: GithubTransportOptions): Introspector;

/**
 * Live credential probe for GitHub. Reads are confirmed by performing them; writes are confirmed
 * WITHOUT performing them, by sending a request GitHub authorizes before it validates the body — a
 * permitted caller gets 422 (the body is bad), a forbidden one gets 403. Nothing is created either
 * way. This is the only way to answer "can this token write?" for a fine-grained PAT, which unlike
 * a classic token publishes no scope list.
 */
declare function createGithubCredentialProbe(options: GithubTransportOptions): CredentialProbe;

interface GithubDeviceAuthOptions {
    /**
     * The OAuth App or GitHub App client id. Public by design — the device flow has no client secret,
     * which is exactly why a CLI can use it without operating a server.
     */
    readonly clientId: string;
    /**
     * Scopes to request. Only meaningful for an OAuth App; a GitHub App grants the permissions it was
     * installed with and ignores this. `repo` is the narrowest single scope that covers issues,
     * contents and pull requests — broader than a fine-grained PAT, which is the honest trade for not
     * making the user assemble one.
     */
    readonly scope?: string;
    /** Injected for tests. Defaults to the global fetch. */
    readonly fetchImpl?: typeof fetch;
    /** Injected for tests so polling does not really wait. */
    readonly sleep?: (ms: number) => Promise<void>;
}
/**
 * Baron's own OAuth App, registered under the `loncadev` org.
 *
 * Shipping an id is what makes the device flow actually happen: without one it is never offered, and
 * every user has to register an app before they can avoid registering a token — one chore for
 * another. Every comparable CLI ships one (gh, VS Code, Docker), and it is safe to because the
 * device flow has NO client secret: the id is public by construction, and holding it lets an
 * attacker start a flow the victim still has to approve in their own browser.
 *
 * Tokens are per-user. Each person authorizes this app themselves, the token lands in their own
 * `.baron/credentials`, and it never reaches whoever registered the app. The corresponding
 * responsibility is real: the app appears in every user's authorized-applications list, and deleting
 * it drops everyone's token at once — which is why it lives in the org and not a personal account.
 *
 * `BARON_GITHUB_CLIENT_ID` overrides it; setting that to empty opts out of the offer entirely.
 */
declare const BARON_GITHUB_CLIENT_ID = "Ov23liWMo83LU7TGifWW";
/**
 * GitHub's device flow: the CLI asks for a code, the user approves it in a browser, and the token
 * comes back with the permissions the app declared. No client secret, so no server — which is what
 * makes it available to a local tool at all. `gh` works the same way.
 */
declare function createGithubDeviceAuth(options: GithubDeviceAuthOptions): DeviceAuth;

/**
 * The permission GitHub itself says the route needs. Fine-grained tokens get
 * `x-accepted-github-permissions` (`contents=write`); classic tokens get `x-accepted-oauth-scopes`
 * (`repo`). Reading it back beats hardcoding a route→permission table that drifts.
 */
declare function acceptedPermission(headers: Record<string, string | undefined>): string | undefined;
/**
 * The REST API version every request declares.
 *
 * Left unset, GitHub picks `2022-11-28` — which it deprecated on 2026-03-10 and will remove on
 * 2028-03-10, announcing it with a `Deprecation` header on every write. `@octokit/request` logs that
 * header verbatim, so a line about a scheduled removal printed above the line saying the run
 * succeeded, in output an agent parses and a new user reads.
 *
 * Pinning is the fix rather than muting the logger: it removes the cause instead of the symptom, and
 * it stops a future change of GitHub's default from silently changing how Baron reads a response.
 * The fields Baron reads (issue number/title/state/type/labels/assignee/body, PR
 * draft/state/merged/head) were checked against both versions before this moved.
 */
declare const GITHUB_API_VERSION = "2026-03-10";
/**
 * Build an Octokit for this adapter.
 *
 * With a `port`, permission refusals become an error a human can act on: GitHub answers a forbidden
 * write with "Resource not accessible by personal access token", which names neither the operation
 * nor the permission that would fix it — the message that made a failed `task-start` unreadable. The
 * route's required permission is in the response headers, so the fix is read back from GitHub rather
 * than hardcoded into a route table that would drift.
 *
 * Without one, refusals pass through raw. That is for the two callers that must classify a 403
 * themselves — the credential probe, whose entire job is telling 403 from 422, and introspection,
 * which treats an unreadable route as an absent feature.
 */
declare function createGithubOctokit(token: string, port?: PortName): Octokit;

/** GitHub supports draft PRs and PR discussion (PR-level issue comments). */
declare const githubScmManifest: ScmManifest;
declare function createGithubScmTransport(options: GithubTransportOptions): ScmTransport;
declare function defineGithubScmAdapter(transport: ScmTransport, gapPolicy?: GapPolicy, logger?: Logger): BaseScmAdapter;

/** GitHub Actions capabilities. A run's jobs are surfaced as stages in run detail. */
declare const githubCiManifest: CiManifest;
/**
 * GitHub Actions' fixed string enums → normalized RunStatus. A completed run is decided by its
 * `conclusion`; an in-flight run by its `status`. 'completed' is intentionally absent from the status
 * map so a finished run is always classified by its conclusion (which is null until then).
 */
declare const githubCiStatusMaps: CiStatusMaps;
/**
 * Live `ci` transport over the GitHub Actions REST API (octokit). Read-only in slice 1. Run logs are
 * a zip archive on GitHub, so `fetchLogs` tails the last job's plain-text log instead.
 */
declare function createGithubCiTransport(options: GithubTransportOptions): CiTransport;
declare function defineGithubCiAdapter(transport: CiTransport, gapPolicy?: GapPolicy, logger?: Logger): BaseCiAdapter;

/** GitHub Environments + Deployments. Read-only (no create) in this slice. */
declare const githubDeployManifest: DeployManifest;
/** GitHub deployment-status `state` strings → normalized DeployStatus (no separate result axis). */
declare const githubDeployStatusMaps: DeployStatusMaps;
declare function createGithubDeployTransport(options: GithubTransportOptions): DeployTransport;
declare function defineGithubDeployAdapter(transport: DeployTransport, gapPolicy?: GapPolicy, logger?: Logger): BaseDeployAdapter;

/**
 * GitHub Issues is deliberately flat: no native parent/child hierarchy (sub-issues exist but are
 * a separate primitive), and only binary open/closed states. Workflow states beyond that must be
 * emulated (Baron does this via labels). This is the divergent counterpart to Azure and the
 * reason the impedance layer earns its keep.
 */
declare const githubManifest: CapabilityManifest;
/** Example role map: mid-workflow roles ride on labels, `done` closes the issue. */
declare const exampleGithubRoleMap: ProviderRoleMap;
/**
 * GitHub has one issue type; every type role maps onto a plain issue. Every role — a hole here is
 * not "that role is unavailable", it is `issue.create` refusing a role the steering block still
 * advertises.
 */
declare const exampleGithubTypeMap: TypeMap;
/** GitHub has no native typed links; links are emulated/degraded per the gap policy, so this is empty. */
declare const exampleGithubLinkMap: LinkMap;
/**
 * Recommended gap policy for GitHub: emulate hierarchy and arbitrary states via labels, and drop
 * sprints with a warning. Installations may override; the point is the choice is explicit, not a
 * silent default baked into the adapter.
 */
declare const recommendedGithubGapPolicy: GapPolicy;
type GithubIssuesConfig = Omit<IssuesProviderConfig, 'provider'>;
declare function defineGithubIssuesAdapter(config: GithubIssuesConfig, transport: IssuesTransport, logger?: Logger): BaseIssuesAdapter;

export { BARON_GITHUB_CLIENT_ID, GITHUB_API_VERSION, GITHUB_PROVIDER, type GithubIssuesConfig, type GithubTransportOptions, acceptedPermission, createGithubCiTransport, createGithubCredentialProbe, createGithubDeployTransport, createGithubDeviceAuth, createGithubIntrospector, createGithubOctokit, createGithubScmTransport, createGithubTransport, defineGithubCiAdapter, defineGithubDeployAdapter, defineGithubIssuesAdapter, defineGithubScmAdapter, exampleGithubLinkMap, exampleGithubRoleMap, exampleGithubTypeMap, githubCiManifest, githubCiStatusMaps, githubDeployManifest, githubDeployStatusMaps, githubManifest, githubScmManifest, recommendedGithubGapPolicy };