@vercel/factory 0.0.11 → 0.0.13

package/dist/approval-CwhTP1XB.mjs

@@ -0,0 +1,269 @@
+import { a as repositoryIdsSchema, d as schemaVersionSchema, f as usdSchema, i as repositoryIdSchema, l as isoDateTimeSchema, o as signalIdSchema, p as vocabularySchema, s as taskIdSchema, t as changeIdSchema, u as replyToSchema } from "./id-DwCihQr4.mjs";
+import { z } from "zod";
+import { createHash } from "node:crypto";
+//#region src/schema/task.ts
+/**
+* Kinds the standard loop understands. Any vocabulary value is valid; the
+* kind-scoped rules below apply only to these standard kinds.
+*/
+const standardTaskKinds = [
+	"coordination",
+	"code_change",
+	"verification",
+	"investigation",
+	"question"
+];
+const taskKindSchema = vocabularySchema.describe("What kind of work this is, e.g. code_change, question, or a registered custom kind.");
+const taskStateSchema = z.enum([
+	"queued",
+	"running",
+	"stalled",
+	"verifying",
+	"succeeded",
+	"failed",
+	"needs_human",
+	"cancelled"
+]).describe("Lifecycle state. Transitions are fixed; see taskTransitions.");
+const taskApprovalSchema = z.enum([
+	"required",
+	"granted",
+	"denied"
+]).describe("Human approval status. Absent means no approval is needed. Stamped required at creation by policy; granted or denied by an operator.");
+const taskExecutionRepositoryIdsSchema = z.tuple([repositoryIdSchema]).describe("The one repository used to execute a task.");
+const coordinationRepositoryIdsSchema = z.tuple([repositoryIdSchema, repositoryIdSchema]).rest(repositoryIdSchema).refine((repositoryIds) => new Set(repositoryIds).size === repositoryIds.length, { message: "Coordination tasks require distinct repositories." }).describe("The distinct repositories coordinated by a non-executable parent task.");
+const taskOriginSchema = z.strictObject({
+	signalId: signalIdSchema.optional().describe("Signal that led to this task."),
+	parentTaskId: taskIdSchema.optional().describe("Parent task that planned this child."),
+	operator: z.string().min(1).optional().describe("Human operator who requested it.")
+}).refine((origin) => origin.signalId !== void 0 || origin.parentTaskId !== void 0 || origin.operator !== void 0, { message: "origin requires a signalId, parentTaskId, or operator" });
+const harnessSchema = z.string().min(1).describe("Coding harness running inside the execution environment, e.g. claude-code or codex.");
+/**
+* The provider's handle on the current attempt's execution. Opaque to the
+* lifecycle: Factory records it so the execution can be inspected or
+* cancelled, never to mirror the provider's own state machine.
+*/
+const executionReferenceSchema = z.strictObject({
+	provider: z.string().min(1).describe("Execution provider, e.g. eve."),
+	sessionId: z.string().min(1).describe("Provider-side session running this attempt."),
+	environmentId: z.string().min(1).optional().describe("Provider-side execution environment."),
+	harness: harnessSchema.optional(),
+	traceId: z.string().min(1).optional().describe("Provider-side trace for this execution.")
+});
+const tokenCountSchema = z.number().int().nonnegative();
+const taskUsageSchema = z.strictObject({
+	costUsd: usdSchema.describe("AI Gateway cost summed over recorded steps."),
+	inputTokens: tokenCountSchema,
+	outputTokens: tokenCountSchema,
+	cacheReadTokens: tokenCountSchema,
+	cacheWriteTokens: tokenCountSchema,
+	steps: z.record(z.string().min(1), tokenCountSchema).describe("Highest recorded stepIndex per turnId; steps at or below it are already counted.")
+});
+const taskQuestionSchema = z.strictObject({
+	text: z.string().min(1).describe("The input or action requested from a human before work can resume."),
+	options: z.array(z.string().min(1)).describe("Suggested replies; free-text is also allowed."),
+	answer: z.string().min(1).optional(),
+	answeredBy: z.string().min(1).optional().describe("Authenticated operator who answered.")
+});
+const taskSchema = z.strictObject({
+	schemaVersion: schemaVersionSchema,
+	id: taskIdSchema,
+	repositoryIds: repositoryIdsSchema.describe("Repositories the task concerns."),
+	kind: taskKindSchema,
+	area: z.string().min(1).optional().describe("Investigation area, e.g. onboarding or security. Investigation tasks only."),
+	state: taskStateSchema,
+	approval: taskApprovalSchema.optional(),
+	origin: taskOriginSchema,
+	dependsOn: z.array(taskIdSchema).min(1).optional().describe("Sibling tasks that must produce a change before this one may run."),
+	replyTo: replyToSchema,
+	attempt: z.number().int().min(1).describe("Execution attempt, starting at 1; bumps on retry."),
+	execution: executionReferenceSchema.optional().describe("Execution of the current attempt, recorded at dispatch and replaced on retry."),
+	lastProgressAt: isoDateTimeSchema.optional().describe("Last time the execution demonstrably advanced: dispatch, or a completed model step."),
+	stalledAt: isoDateTimeSchema.optional().describe("When the reconciler marked the task stalled."),
+	stalledReason: z.string().min(1).optional().describe("Why the task was marked stalled."),
+	reservedUsd: usdSchema.optional().describe("Budget reserved before dispatch."),
+	reservedAt: isoDateTimeSchema.optional().describe("When the reservation was stamped; attributes spend to a budget month."),
+	usage: taskUsageSchema.optional().describe("Measured model usage, accumulated per step by recordUsage and settled into settledUsd."),
+	settledUsd: usdSchema.optional().describe("Measured cost settled after execution. A task settles once; re-execution cost is not separately metered (see the unresolved multi-attempt accounting decision)."),
+	question: taskQuestionSchema.optional(),
+	changeId: changeIdSchema.optional().describe("Change produced or verified by this task."),
+	reportRef: z.string().min(1).optional().describe("Reference to the report artifact an investigation produced."),
+	createdAt: isoDateTimeSchema,
+	updatedAt: isoDateTimeSchema
+}).superRefine((task, ctx) => {
+	if (task.kind === "coordination" && !coordinationRepositoryIdsSchema.safeParse(task.repositoryIds).success) ctx.addIssue({
+		code: "custom",
+		path: ["repositoryIds"],
+		message: "coordination tasks require at least two distinct repositories"
+	});
+	if ((task.kind === "code_change" || task.kind === "verification") && task.repositoryIds.length !== 1) ctx.addIssue({
+		code: "custom",
+		path: ["repositoryIds"],
+		message: `${task.kind} tasks require exactly one repository`
+	});
+	if (task.area !== void 0 && task.kind !== "investigation") ctx.addIssue({
+		code: "custom",
+		path: ["area"],
+		message: "area is only valid on investigation tasks"
+	});
+	if (task.kind === "question") {
+		if (task.question === void 0) ctx.addIssue({
+			code: "custom",
+			path: ["question"],
+			message: "question tasks require a question"
+		});
+	} else if (task.question !== void 0) ctx.addIssue({
+		code: "custom",
+		path: ["question"],
+		message: "question is only valid on question tasks"
+	});
+	if (task.state !== "stalled" && (task.stalledAt !== void 0 || task.stalledReason !== void 0)) ctx.addIssue({
+		code: "custom",
+		path: ["stalledAt"],
+		message: "stalledAt and stalledReason are only valid while the task is stalled"
+	});
+	if ((task.kind === "question" || task.kind === "coordination") && task.execution !== void 0) ctx.addIssue({
+		code: "custom",
+		path: ["execution"],
+		message: `${task.kind} tasks never execute`
+	});
+	if (task.changeId !== void 0 && task.kind !== "code_change" && task.kind !== "verification") ctx.addIssue({
+		code: "custom",
+		path: ["changeId"],
+		message: "changeId is only valid on code_change or verification tasks"
+	});
+	if (task.reportRef !== void 0 && task.kind !== "investigation") ctx.addIssue({
+		code: "custom",
+		path: ["reportRef"],
+		message: "reportRef is only valid on investigation tasks"
+	});
+});
+//#endregion
+//#region src/schema/finding.ts
+const findingPrioritySchema = z.enum([
+	"P0",
+	"P1",
+	"P2",
+	"P3"
+]).describe("Urgency of a finding: P0 is drop-everything, P3 is nice-to-have.");
+const findingCategorySchema = z.enum([
+	"security",
+	"correctness",
+	"reliability",
+	"performance",
+	"compatibility",
+	"accessibility",
+	"documentation",
+	"maintainability",
+	"testing",
+	"usability"
+]);
+const findingVerificationLevelSchema = z.enum([
+	"unverified",
+	"supported",
+	"confirmed"
+]).describe("How sure the reporter is: unverified = suspected from reading; supported = evidence points to it; confirmed = demonstrated.");
+const findingVerificationMethodSchema = z.enum([
+	"code_inspection",
+	"static_analysis",
+	"manual_reproduction",
+	"unit_test",
+	"integration_test",
+	"e2e_test",
+	"runtime_observation",
+	"documentation"
+]);
+/**
+* What was done to check the finding. Forces a reporter to distinguish "I
+* think this is a problem" from "I demonstrated it", which is the axis a human
+* approving fixes cares about most.
+*/
+const findingVerificationSchema = z.strictObject({
+	level: findingVerificationLevelSchema,
+	method: findingVerificationMethodSchema,
+	summary: z.string().min(1).max(2e3).describe("What was checked and what it showed."),
+	limitations: z.string().min(1).max(2e3).optional().describe("What could not be checked.")
+});
+/** A single problem found in a repository, as a scanner or agent reports it. */
+const findingSchema = z.strictObject({
+	title: z.string().min(1).max(200),
+	body: z.string().min(1).max(8e3).describe("The problem, its impact, and how to fix it. Markdown."),
+	path: z.string().min(1).max(500).optional().describe("Repository-relative file path."),
+	line: z.number().int().min(1).optional(),
+	endLine: z.number().int().min(1).optional(),
+	priority: findingPrioritySchema,
+	category: findingCategorySchema,
+	verification: findingVerificationSchema,
+	tool: z.string().min(1).max(100).optional().describe("Scanner that produced it, e.g. deepsec."),
+	ruleId: z.string().min(1).max(200).optional().describe("Scanner rule or check id, when there is one.")
+});
+/**
+* Stable identity of a finding across scans, used as the signal's delivery id
+* so re-reporting is a no-op instead of a second task. A scanner finding is
+* the same problem when the same tool reports the same rule on the same file;
+* its title is model-written prose and changes between runs, so it is left
+* out. Without a rule id the title is all there is, normalised.
+*/
+function findingFingerprint(repositoryId, finding) {
+	const parts = finding.tool !== void 0 && finding.ruleId !== void 0 && finding.path !== void 0 ? [
+		repositoryId,
+		finding.tool,
+		finding.ruleId,
+		finding.path
+	] : [
+		repositoryId,
+		finding.tool ?? "",
+		finding.ruleId ?? "",
+		finding.path ?? "",
+		finding.title.trim().toLowerCase().replaceAll(/\s+/gu, " ")
+	];
+	return createHash("sha256").update(parts.join(" ")).digest("hex").slice(0, 32);
+}
+//#endregion
+//#region src/approval.ts
+/**
+* One approval rule. Every listed field must match for the rule to apply;
+* absent fields match anything. Rules are evaluated first-match.
+*/
+const approvalRuleSchema = z.strictObject({
+	source: vocabularySchema.optional().describe("Signal source, e.g. security_scan or github_issue."),
+	kind: vocabularySchema.optional().describe("Task kind, e.g. code_change."),
+	priority: z.array(findingPrioritySchema).min(1).optional().describe("Finding priorities the rule applies to."),
+	require: z.boolean().describe("Whether matching tasks wait for a human before dispatch.")
+});
+const approvalPolicySchema = z.array(approvalRuleSchema).describe("First-match rules deciding which tasks need a human before they run.");
+/**
+* The default: fixes for security findings wait for a human; everything else
+* runs as it always has. Handoffs between agents (verification) never wait,
+* because a human already approved the work they continue.
+*/
+const defaultApprovalPolicy = [
+	{
+		kind: "verification",
+		require: false
+	},
+	{
+		source: "security_scan",
+		require: true
+	},
+	{ require: false }
+];
+/**
+* Decide at task-creation time whether a task needs approval. Pure: the answer
+* is stamped on the task and never re-evaluated, so a later policy change
+* cannot silently release work a human was expecting to see.
+*/
+function requiresApproval(policy, subject) {
+	for (const rule of policy) {
+		if (rule.source !== void 0 && rule.source !== subject.source) continue;
+		if (rule.kind !== void 0 && rule.kind !== subject.kind) continue;
+		if (rule.priority !== void 0) {
+			if (subject.priority === void 0 || !rule.priority.includes(subject.priority)) continue;
+		}
+		return rule.require;
+	}
+	return false;
+}
+//#endregion
+export { taskUsageSchema as C, taskStateSchema as S, taskExecutionRepositoryIdsSchema as _, findingCategorySchema as a, taskQuestionSchema as b, findingSchema as c, findingVerificationSchema as d, coordinationRepositoryIdsSchema as f, taskApprovalSchema as g, standardTaskKinds as h, requiresApproval as i, findingVerificationLevelSchema as l, harnessSchema as m, approvalRuleSchema as n, findingFingerprint as o, executionReferenceSchema as p, defaultApprovalPolicy as r, findingPrioritySchema as s, approvalPolicySchema as t, findingVerificationMethodSchema as u, taskKindSchema as v, taskSchema as x, taskOriginSchema as y };
+
+//# sourceMappingURL=approval-CwhTP1XB.mjs.map

package/dist/approval-CwhTP1XB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-CwhTP1XB.mjs","names":[],"sources":["../src/schema/task.ts","../src/schema/finding.ts","../src/approval.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  isoDateTimeSchema,\n  replyToSchema,\n  schemaVersionSchema,\n  usdSchema,\n  vocabularySchema,\n} from \"./common\";\nimport {\n  changeIdSchema,\n  repositoryIdSchema,\n  repositoryIdsSchema,\n  signalIdSchema,\n  taskIdSchema,\n} from \"./id\";\n\n/**\n * Kinds the standard loop understands. Any vocabulary value is valid; the\n * kind-scoped rules below apply only to these standard kinds.\n */\nexport const standardTaskKinds = [\n  \"coordination\",\n  \"code_change\",\n  \"verification\",\n  \"investigation\",\n  \"question\",\n] as const;\n\nexport const taskKindSchema = vocabularySchema.describe(\n  \"What kind of work this is, e.g. code_change, question, or a registered custom kind.\",\n);\n\nexport const taskStateSchema = z\n  .enum([\"queued\", \"running\", \"stalled\", \"verifying\", \"succeeded\", \"failed\", \"needs_human\", \"cancelled\"])\n  .describe(\"Lifecycle state. Transitions are fixed; see taskTransitions.\");\n\nexport const taskApprovalSchema = z\n  .enum([\"required\", \"granted\", \"denied\"])\n  .describe(\n    \"Human approval status. Absent means no approval is needed. Stamped required at creation by policy; granted or denied by an operator.\",\n  );\n\nexport const taskExecutionRepositoryIdsSchema = z\n  .tuple([repositoryIdSchema])\n  .describe(\"The one repository used to execute a task.\");\n\nexport const coordinationRepositoryIdsSchema = z\n  .tuple([repositoryIdSchema, repositoryIdSchema])\n  .rest(repositoryIdSchema)\n  .refine((repositoryIds) => new Set(repositoryIds).size === repositoryIds.length, {\n    message: \"Coordination tasks require distinct repositories.\",\n  })\n  .describe(\"The distinct repositories coordinated by a non-executable parent task.\");\n\nexport const taskOriginSchema = z\n  .strictObject({\n    signalId: signalIdSchema.optional().describe(\"Signal that led to this task.\"),\n    parentTaskId: taskIdSchema.optional().describe(\"Parent task that planned this child.\"),\n    operator: z.string().min(1).optional().describe(\"Human operator who requested it.\"),\n  })\n  .refine(\n    (origin) =>\n      origin.signalId !== undefined ||\n      origin.parentTaskId !== undefined ||\n      origin.operator !== undefined,\n    { message: \"origin requires a signalId, parentTaskId, or operator\" },\n  );\n\nexport const harnessSchema = z\n  .string()\n  .min(1)\n  .describe(\"Coding harness running inside the execution environment, e.g. claude-code or codex.\");\n\n/**\n * The provider's handle on the current attempt's execution. Opaque to the\n * lifecycle: Factory records it so the execution can be inspected or\n * cancelled, never to mirror the provider's own state machine.\n */\nexport const executionReferenceSchema = z.strictObject({\n  provider: z.string().min(1).describe(\"Execution provider, e.g. eve.\"),\n  sessionId: z.string().min(1).describe(\"Provider-side session running this attempt.\"),\n  environmentId: z.string().min(1).optional().describe(\"Provider-side execution environment.\"),\n  harness: harnessSchema.optional(),\n  traceId: z.string().min(1).optional().describe(\"Provider-side trace for this execution.\"),\n});\n\nconst tokenCountSchema = z.number().int().nonnegative();\n\nexport const taskUsageSchema = z.strictObject({\n  costUsd: usdSchema.describe(\"AI Gateway cost summed over recorded steps.\"),\n  inputTokens: tokenCountSchema,\n  outputTokens: tokenCountSchema,\n  cacheReadTokens: tokenCountSchema,\n  cacheWriteTokens: tokenCountSchema,\n  steps: z\n    .record(z.string().min(1), tokenCountSchema)\n    .describe(\"Highest recorded stepIndex per turnId; steps at or below it are already counted.\"),\n});\n\nexport const taskQuestionSchema = z.strictObject({\n  text: z.string().min(1).describe(\"The input or action requested from a human before work can resume.\"),\n  options: z.array(z.string().min(1)).describe(\"Suggested replies; free-text is also allowed.\"),\n  answer: z.string().min(1).optional(),\n  answeredBy: z.string().min(1).optional().describe(\"Authenticated operator who answered.\"),\n});\n\nexport const taskSchema = z\n  .strictObject({\n    schemaVersion: schemaVersionSchema,\n    id: taskIdSchema,\n    repositoryIds: repositoryIdsSchema.describe(\"Repositories the task concerns.\"),\n    kind: taskKindSchema,\n    area: z\n      .string()\n      .min(1)\n      .optional()\n      .describe(\"Investigation area, e.g. onboarding or security. Investigation tasks only.\"),\n    state: taskStateSchema,\n    approval: taskApprovalSchema.optional(),\n    origin: taskOriginSchema,\n    dependsOn: z\n      .array(taskIdSchema)\n      .min(1)\n      .optional()\n      .describe(\"Sibling tasks that must produce a change before this one may run.\"),\n    replyTo: replyToSchema,\n    attempt: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Execution attempt, starting at 1; bumps on retry.\"),\n    execution: executionReferenceSchema\n      .optional()\n      .describe(\"Execution of the current attempt, recorded at dispatch and replaced on retry.\"),\n    lastProgressAt: isoDateTimeSchema\n      .optional()\n      .describe(\"Last time the execution demonstrably advanced: dispatch, or a completed model step.\"),\n    stalledAt: isoDateTimeSchema.optional().describe(\"When the reconciler marked the task stalled.\"),\n    stalledReason: z.string().min(1).optional().describe(\"Why the task was marked stalled.\"),\n    reservedUsd: usdSchema.optional().describe(\"Budget reserved before dispatch.\"),\n    reservedAt: isoDateTimeSchema\n      .optional()\n      .describe(\"When the reservation was stamped; attributes spend to a budget month.\"),\n    usage: taskUsageSchema\n      .optional()\n      .describe(\"Measured model usage, accumulated per step by recordUsage and settled into settledUsd.\"),\n    settledUsd: usdSchema\n      .optional()\n      .describe(\n        \"Measured cost settled after execution. A task settles once; re-execution cost is not separately metered (see the unresolved multi-attempt accounting decision).\",\n      ),\n    question: taskQuestionSchema.optional(),\n    changeId: changeIdSchema.optional().describe(\"Change produced or verified by this task.\"),\n    reportRef: z\n      .string()\n      .min(1)\n      .optional()\n      .describe(\"Reference to the report artifact an investigation produced.\"),\n    createdAt: isoDateTimeSchema,\n    updatedAt: isoDateTimeSchema,\n  })\n  .superRefine((task, ctx) => {\n    if (\n      task.kind === \"coordination\" &&\n      !coordinationRepositoryIdsSchema.safeParse(task.repositoryIds).success\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"repositoryIds\"],\n        message: \"coordination tasks require at least two distinct repositories\",\n      });\n    }\n    if (\n      (task.kind === \"code_change\" || task.kind === \"verification\") &&\n      task.repositoryIds.length !== 1\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"repositoryIds\"],\n        message: `${task.kind} tasks require exactly one repository`,\n      });\n    }\n    if (task.area !== undefined && task.kind !== \"investigation\") {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"area\"],\n        message: \"area is only valid on investigation tasks\",\n      });\n    }\n    if (task.kind === \"question\") {\n      if (task.question === undefined) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"question\"],\n          message: \"question tasks require a question\",\n        });\n      }\n    } else if (task.question !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"question\"],\n        message: \"question is only valid on question tasks\",\n      });\n    }\n    if (task.state !== \"stalled\" && (task.stalledAt !== undefined || task.stalledReason !== undefined)) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"stalledAt\"],\n        message: \"stalledAt and stalledReason are only valid while the task is stalled\",\n      });\n    }\n    if (\n      (task.kind === \"question\" || task.kind === \"coordination\") &&\n      task.execution !== undefined\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"execution\"],\n        message: `${task.kind} tasks never execute`,\n      });\n    }\n    if (\n      task.changeId !== undefined &&\n      task.kind !== \"code_change\" &&\n      task.kind !== \"verification\"\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"changeId\"],\n        message: \"changeId is only valid on code_change or verification tasks\",\n      });\n    }\n    if (task.reportRef !== undefined && task.kind !== \"investigation\") {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"reportRef\"],\n        message: \"reportRef is only valid on investigation tasks\",\n      });\n    }\n  });\n\nexport type TaskApproval = z.infer<typeof taskApprovalSchema>;\nexport type TaskKind = z.infer<typeof taskKindSchema>;\nexport type TaskState = z.infer<typeof taskStateSchema>;\nexport type TaskUsage = z.infer<typeof taskUsageSchema>;\nexport type ExecutionReference = z.infer<typeof executionReferenceSchema>;\nexport type Task = z.infer<typeof taskSchema>;\n","import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\nexport const findingPrioritySchema = z\n  .enum([\"P0\", \"P1\", \"P2\", \"P3\"])\n  .describe(\"Urgency of a finding: P0 is drop-everything, P3 is nice-to-have.\");\n\nexport const findingCategorySchema = z.enum([\n  \"security\",\n  \"correctness\",\n  \"reliability\",\n  \"performance\",\n  \"compatibility\",\n  \"accessibility\",\n  \"documentation\",\n  \"maintainability\",\n  \"testing\",\n  \"usability\",\n]);\n\nexport const findingVerificationLevelSchema = z\n  .enum([\"unverified\", \"supported\", \"confirmed\"])\n  .describe(\n    \"How sure the reporter is: unverified = suspected from reading; supported = evidence points to it; confirmed = demonstrated.\",\n  );\n\nexport const findingVerificationMethodSchema = z.enum([\n  \"code_inspection\",\n  \"static_analysis\",\n  \"manual_reproduction\",\n  \"unit_test\",\n  \"integration_test\",\n  \"e2e_test\",\n  \"runtime_observation\",\n  \"documentation\",\n]);\n\n/**\n * What was done to check the finding. Forces a reporter to distinguish \"I\n * think this is a problem\" from \"I demonstrated it\", which is the axis a human\n * approving fixes cares about most.\n */\nexport const findingVerificationSchema = z.strictObject({\n  level: findingVerificationLevelSchema,\n  method: findingVerificationMethodSchema,\n  summary: z.string().min(1).max(2000).describe(\"What was checked and what it showed.\"),\n  limitations: z.string().min(1).max(2000).optional().describe(\"What could not be checked.\"),\n});\n\n/** A single problem found in a repository, as a scanner or agent reports it. */\nexport const findingSchema = z.strictObject({\n  title: z.string().min(1).max(200),\n  body: z.string().min(1).max(8000).describe(\"The problem, its impact, and how to fix it. Markdown.\"),\n  path: z.string().min(1).max(500).optional().describe(\"Repository-relative file path.\"),\n  line: z.number().int().min(1).optional(),\n  endLine: z.number().int().min(1).optional(),\n  priority: findingPrioritySchema,\n  category: findingCategorySchema,\n  verification: findingVerificationSchema,\n  tool: z.string().min(1).max(100).optional().describe(\"Scanner that produced it, e.g. deepsec.\"),\n  ruleId: z.string().min(1).max(200).optional().describe(\"Scanner rule or check id, when there is one.\"),\n});\n\nexport type FindingPriority = z.infer<typeof findingPrioritySchema>;\nexport type FindingCategory = z.infer<typeof findingCategorySchema>;\nexport type FindingVerification = z.infer<typeof findingVerificationSchema>;\nexport type Finding = z.infer<typeof findingSchema>;\n\n/**\n * Stable identity of a finding across scans, used as the signal's delivery id\n * so re-reporting is a no-op instead of a second task. A scanner finding is\n * the same problem when the same tool reports the same rule on the same file;\n * its title is model-written prose and changes between runs, so it is left\n * out. Without a rule id the title is all there is, normalised.\n */\nexport function findingFingerprint(repositoryId: string, finding: Finding): string {\n  const parts =\n    finding.tool !== undefined && finding.ruleId !== undefined && finding.path !== undefined\n      ? [repositoryId, finding.tool, finding.ruleId, finding.path]\n      : [\n          repositoryId,\n          finding.tool ?? \"\",\n          finding.ruleId ?? \"\",\n          finding.path ?? \"\",\n          finding.title.trim().toLowerCase().replaceAll(/\\s+/gu, \" \"),\n        ];\n  return createHash(\"sha256\").update(parts.join(\" \")).digest(\"hex\").slice(0, 32);\n}\n","import { z } from \"zod\";\nimport { vocabularySchema } from \"./schema/common\";\nimport { findingPrioritySchema, type FindingPriority } from \"./schema/finding\";\n\n/**\n * One approval rule. Every listed field must match for the rule to apply;\n * absent fields match anything. Rules are evaluated first-match.\n */\nexport const approvalRuleSchema = z.strictObject({\n  source: vocabularySchema.optional().describe(\"Signal source, e.g. security_scan or github_issue.\"),\n  kind: vocabularySchema.optional().describe(\"Task kind, e.g. code_change.\"),\n  priority: z\n    .array(findingPrioritySchema)\n    .min(1)\n    .optional()\n    .describe(\"Finding priorities the rule applies to.\"),\n  require: z.boolean().describe(\"Whether matching tasks wait for a human before dispatch.\"),\n});\n\nexport const approvalPolicySchema = z\n  .array(approvalRuleSchema)\n  .describe(\"First-match rules deciding which tasks need a human before they run.\");\n\nexport type ApprovalRule = z.infer<typeof approvalRuleSchema>;\nexport type ApprovalPolicy = z.infer<typeof approvalPolicySchema>;\n\n/**\n * The default: fixes for security findings wait for a human; everything else\n * runs as it always has. Handoffs between agents (verification) never wait,\n * because a human already approved the work they continue.\n */\nexport const defaultApprovalPolicy: ApprovalPolicy = [\n  { kind: \"verification\", require: false },\n  { source: \"security_scan\", require: true },\n  { require: false },\n];\n\nexport interface ApprovalSubject {\n  source?: string;\n  kind: string;\n  priority?: FindingPriority;\n}\n\n/**\n * Decide at task-creation time whether a task needs approval. Pure: the answer\n * is stamped on the task and never re-evaluated, so a later policy change\n * cannot silently release work a human was expecting to see.\n */\nexport function requiresApproval(policy: ApprovalPolicy, subject: ApprovalSubject): boolean {\n  for (const rule of policy) {\n    if (rule.source !== undefined && rule.source !== subject.source) continue;\n    if (rule.kind !== undefined && rule.kind !== subject.kind) continue;\n    if (rule.priority !== undefined) {\n      if (subject.priority === undefined || !rule.priority.includes(subject.priority)) continue;\n    }\n    return rule.require;\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;AAoBA,MAAa,oBAAoB;CAC/B;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,iBAAiB,iBAAiB,SAC7C,qFACF;AAEA,MAAa,kBAAkB,EAC5B,KAAK;CAAC;CAAU;CAAW;CAAW;CAAa;CAAa;CAAU;CAAe;AAAW,CAAC,CAAC,CACtG,SAAS,8DAA8D;AAE1E,MAAa,qBAAqB,EAC/B,KAAK;CAAC;CAAY;CAAW;AAAQ,CAAC,CAAC,CACvC,SACC,sIACF;AAEF,MAAa,mCAAmC,EAC7C,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAC3B,SAAS,4CAA4C;AAExD,MAAa,kCAAkC,EAC5C,MAAM,CAAC,oBAAoB,kBAAkB,CAAC,CAAC,CAC/C,KAAK,kBAAkB,CAAC,CACxB,QAAQ,kBAAkB,IAAI,IAAI,aAAa,CAAC,CAAC,SAAS,cAAc,QAAQ,EAC/E,SAAS,oDACX,CAAC,CAAC,CACD,SAAS,wEAAwE;AAEpF,MAAa,mBAAmB,EAC7B,aAAa;CACZ,UAAU,eAAe,SAAS,CAAC,CAAC,SAAS,+BAA+B;CAC5E,cAAc,aAAa,SAAS,CAAC,CAAC,SAAS,sCAAsC;CACrF,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kCAAkC;AACpF,CAAC,CAAC,CACD,QACE,WACC,OAAO,aAAa,KAAA,KACpB,OAAO,iBAAiB,KAAA,KACxB,OAAO,aAAa,KAAA,GACtB,EAAE,SAAS,wDAAwD,CACrE;AAEF,MAAa,gBAAgB,EAC1B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SAAS,qFAAqF;;;;;;AAOjG,MAAa,2BAA2B,EAAE,aAAa;CACrD,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,+BAA+B;CACpE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,6CAA6C;CACnF,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,sCAAsC;CAC3F,SAAS,cAAc,SAAS;CAChC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,yCAAyC;AAC1F,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;AAEtD,MAAa,kBAAkB,EAAE,aAAa;CAC5C,SAAS,UAAU,SAAS,6CAA6C;CACzE,aAAa;CACb,cAAc;CACd,iBAAiB;CACjB,kBAAkB;CAClB,OAAO,EACJ,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAC3C,SAAS,kFAAkF;AAChG,CAAC;AAED,MAAa,qBAAqB,EAAE,aAAa;CAC/C,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,oEAAoE;CACrG,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,+CAA+C;CAC5F,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACnC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,sCAAsC;AAC1F,CAAC;AAED,MAAa,aAAa,EACvB,aAAa;CACZ,eAAe;CACf,IAAI;CACJ,eAAe,oBAAoB,SAAS,iCAAiC;CAC7E,MAAM;CACN,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,4EAA4E;CACxF,OAAO;CACP,UAAU,mBAAmB,SAAS;CACtC,QAAQ;CACR,WAAW,EACR,MAAM,YAAY,CAAC,CACnB,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,mEAAmE;CAC/E,SAAS;CACT,SAAS,EACN,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,mDAAmD;CAC/D,WAAW,yBACR,SAAS,CAAC,CACV,SAAS,+EAA+E;CAC3F,gBAAgB,kBACb,SAAS,CAAC,CACV,SAAS,qFAAqF;CACjG,WAAW,kBAAkB,SAAS,CAAC,CAAC,SAAS,8CAA8C;CAC/F,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,kCAAkC;CACvF,aAAa,UAAU,SAAS,CAAC,CAAC,SAAS,kCAAkC;CAC7E,YAAY,kBACT,SAAS,CAAC,CACV,SAAS,uEAAuE;CACnF,OAAO,gBACJ,SAAS,CAAC,CACV,SAAS,wFAAwF;CACpG,YAAY,UACT,SAAS,CAAC,CACV,SACC,iKACF;CACF,UAAU,mBAAmB,SAAS;CACtC,UAAU,eAAe,SAAS,CAAC,CAAC,SAAS,2CAA2C;CACxF,WAAW,EACR,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,6DAA6D;CACzE,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,aAAa,MAAM,QAAQ;CAC1B,IACE,KAAK,SAAS,kBACd,CAAC,gCAAgC,UAAU,KAAK,aAAa,CAAC,CAAC,SAE/D,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,eAAe;EACtB,SAAS;CACX,CAAC;CAEH,KACG,KAAK,SAAS,iBAAiB,KAAK,SAAS,mBAC9C,KAAK,cAAc,WAAW,GAE9B,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,eAAe;EACtB,SAAS,GAAG,KAAK,KAAK;CACxB,CAAC;CAEH,IAAI,KAAK,SAAS,KAAA,KAAa,KAAK,SAAS,iBAC3C,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,MAAM;EACb,SAAS;CACX,CAAC;CAEH,IAAI,KAAK,SAAS,YACZ;MAAA,KAAK,aAAa,KAAA,GACpB,IAAI,SAAS;GACX,MAAM;GACN,MAAM,CAAC,UAAU;GACjB,SAAS;EACX,CAAC;CAAA,OAEE,IAAI,KAAK,aAAa,KAAA,GAC3B,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,UAAU;EACjB,SAAS;CACX,CAAC;CAEH,IAAI,KAAK,UAAU,cAAc,KAAK,cAAc,KAAA,KAAa,KAAK,kBAAkB,KAAA,IACtF,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,WAAW;EAClB,SAAS;CACX,CAAC;CAEH,KACG,KAAK,SAAS,cAAc,KAAK,SAAS,mBAC3C,KAAK,cAAc,KAAA,GAEnB,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,WAAW;EAClB,SAAS,GAAG,KAAK,KAAK;CACxB,CAAC;CAEH,IACE,KAAK,aAAa,KAAA,KAClB,KAAK,SAAS,iBACd,KAAK,SAAS,gBAEd,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,UAAU;EACjB,SAAS;CACX,CAAC;CAEH,IAAI,KAAK,cAAc,KAAA,KAAa,KAAK,SAAS,iBAChD,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,WAAW;EAClB,SAAS;CACX,CAAC;AAEL,CAAC;;;AC5OH,MAAa,wBAAwB,EAClC,KAAK;CAAC;CAAM;CAAM;CAAM;AAAI,CAAC,CAAC,CAC9B,SAAS,kEAAkE;AAE9E,MAAa,wBAAwB,EAAE,KAAK;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,iCAAiC,EAC3C,KAAK;CAAC;CAAc;CAAa;AAAW,CAAC,CAAC,CAC9C,SACC,6HACF;AAEF,MAAa,kCAAkC,EAAE,KAAK;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,MAAa,4BAA4B,EAAE,aAAa;CACtD,OAAO;CACP,QAAQ;CACR,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,sCAAsC;CACpF,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,4BAA4B;AAC3F,CAAC;;AAGD,MAAa,gBAAgB,EAAE,aAAa;CAC1C,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAChC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,uDAAuD;CAClG,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,gCAAgC;CACrF,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACvC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAC1C,UAAU;CACV,UAAU;CACV,cAAc;CACd,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,yCAAyC;CAC9F,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8CAA8C;AACvG,CAAC;;;;;;;;AAcD,SAAgB,mBAAmB,cAAsB,SAA0B;CACjF,MAAM,QACJ,QAAQ,SAAS,KAAA,KAAa,QAAQ,WAAW,KAAA,KAAa,QAAQ,SAAS,KAAA,IAC3E;EAAC;EAAc,QAAQ;EAAM,QAAQ;EAAQ,QAAQ;CAAI,IACzD;EACE;EACA,QAAQ,QAAQ;EAChB,QAAQ,UAAU;EAClB,QAAQ,QAAQ;EAChB,QAAQ,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,WAAW,SAAS,GAAG;CAC5D;CACN,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AAC/E;;;;;;;AC/EA,MAAa,qBAAqB,EAAE,aAAa;CAC/C,QAAQ,iBAAiB,SAAS,CAAC,CAAC,SAAS,oDAAoD;CACjG,MAAM,iBAAiB,SAAS,CAAC,CAAC,SAAS,8BAA8B;CACzE,UAAU,EACP,MAAM,qBAAqB,CAAC,CAC5B,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,yCAAyC;CACrD,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,0DAA0D;AAC1F,CAAC;AAED,MAAa,uBAAuB,EACjC,MAAM,kBAAkB,CAAC,CACzB,SAAS,sEAAsE;;;;;;AAUlF,MAAa,wBAAwC;CACnD;EAAE,MAAM;EAAgB,SAAS;CAAM;CACvC;EAAE,QAAQ;EAAiB,SAAS;CAAK;CACzC,EAAE,SAAS,MAAM;AACnB;;;;;;AAaA,SAAgB,iBAAiB,QAAwB,SAAmC;CAC1F,KAAK,MAAM,QAAQ,QAAQ;EACzB,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,WAAW,QAAQ,QAAQ;EACjE,IAAI,KAAK,SAAS,KAAA,KAAa,KAAK,SAAS,QAAQ,MAAM;EAC3D,IAAI,KAAK,aAAa,KAAA,GAChB;OAAA,QAAQ,aAAa,KAAA,KAAa,CAAC,KAAK,SAAS,SAAS,QAAQ,QAAQ,GAAG;EAAA;EAEnF,OAAO,KAAK;CACd;CACA,OAAO;AACT"}

package/dist/blob/index.d.mts

@@ -1,4 +1,4 @@
-import { i as StoreDriver } from "../driver-CrZsy7sm.mjs";
+import { i as StoreDriver } from "../driver-BJutB0PE.mjs";
 //#region src/blob/index.d.ts
 interface BlobObject {
   body: string;

package/dist/build-factory.d.mts

@@ -1,4 +1,4 @@
-import { n as FactoryConfigInput } from "./factory-config-Bu4mklm9.mjs";
+import { r as FactoryConfigInput } from "./factory-config-D2yU3G0c.mjs";
 import { EveNextConfig, EveNextConfigFunction, EveNextConfigInput } from "eve/next";
 //#region src/build-factory.d.ts
 interface FactoryArgs<TConfig extends EveNextConfig = EveNextConfig> {

package/dist/build-factory.mjs

@@ -1,4 +1,4 @@
-import { t as defineFactory } from "./factory-config-ifd3JxiU.mjs";
+import { n as defineFactory } from "./factory-config-BJcjsPKl.mjs";
 import { readdirSync } from "node:fs";
 import path from "node:path";
 //#region src/build-factory.ts