@vercel/factory 0.0.13 → 0.0.15

package/dist/connectors/slack.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"slack.mjs","names":[],"sources":["../../src/connectors/slack.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  communicationEventSchema,\n  type CommunicationAdapter,\n  type CommunicationEvent,\n  type CommunicationOutcome,\n  type NormalizedSignal,\n} from \"./index\";\n\nconst slackOutcomeLabels: Record<CommunicationOutcome, string> = {\n  accepted: \"Request accepted\",\n  started: \"Work started\",\n  succeeded: \"Work completed\",\n  failed: \"Work failed\",\n  needs_human: \"Human action required\",\n  question: \"Question requires an answer\",\n  digest: \"Factory digest\",\n  rolled_back: \"Change rolled back\",\n  budget_warning: \"Factory budget warning\",\n  budget_exhausted: \"Factory budget exhausted\",\n  message: \"Factory update\",\n};\n\nconst slackDetailFields = [\"title\", \"message\", \"summary\", \"question\", \"requestedAction\", \"reason\", \"url\"] as const;\nconst slackListFields = [\"items\", \"options\"] as const;\nconst slackTextLimit = 12_000;\nconst slackOwnerOutcomes = new Set<CommunicationOutcome>([\n  \"digest\",\n  \"budget_warning\",\n  \"budget_exhausted\",\n]);\n\nfunction escapeSlackText(value: string): string {\n  return value.replaceAll(\"&\", \"&amp;\").replaceAll(\"<\", \"&lt;\").replaceAll(\">\", \"&gt;\");\n}\n\nfunction slackLink(url: string, label: string): string | null {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return null;\n    return `<${escapeSlackText(parsed.toString())}|${escapeSlackText(label)}>`;\n  } catch {\n    return null;\n  }\n}\n\nexport interface SlackCommunicationDelivery {\n  eventId: string;\n  clientMessageId: string;\n  text: string;\n  target:\n    | { type: \"owner\" }\n    | { type: \"thread\"; channelId: string; threadTs: string };\n}\n\nexport interface SlackCommunicationAdapter extends CommunicationAdapter {\n  readonly channel: \"slack\";\n  render(event: CommunicationEvent): string;\n}\n\nexport interface SlackCommunicationAdapterOptions {\n  send(delivery: SlackCommunicationDelivery): Promise<void>;\n  render?: (event: CommunicationEvent) => string;\n}\n\nexport interface SlackReplyTarget {\n  channelId: string;\n  threadTs: string;\n}\n\n/** Parse Eve's Slack continuation token into its channel and thread target. */\nexport function parseSlackReplyAddress(address: string): SlackReplyTarget {\n  const separator = address.indexOf(\":\");\n  const channelId = address.slice(0, separator);\n  const threadTs = address.slice(separator + 1);\n  if (separator <= 0 || !/^[A-Z][A-Z0-9]+$/.test(channelId) || !/^\\d+\\.\\d+$/.test(threadTs)) {\n    throw new Error(`Invalid Slack reply address: ${address}.`);\n  }\n  return { channelId, threadTs };\n}\n\n/** Render a provider-neutral communication event as Slack mrkdwn. */\nexport function renderSlackCommunicationEvent(input: CommunicationEvent): string {\n  const event = communicationEventSchema.parse(input);\n  const headline = `*${slackOutcomeLabels[event.outcome]}*`;\n  const details = new Map(slackDetailFields.flatMap((field) => {\n    const value = event.data[field];\n    return typeof value === \"string\" && value.trim() !== \"\" ? [[field, value.trim()] as const] : [];\n  }));\n  const primaryField = ([\"title\", \"question\", \"requestedAction\"] as const)\n    .find((field) => details.has(field));\n  const primary = primaryField === undefined ? undefined : details.get(primaryField);\n  const url = details.get(\"url\");\n  const linkedPrimary = primary !== undefined && url !== undefined ? slackLink(url, primary) : null;\n  if (primaryField !== undefined) details.delete(primaryField);\n  if (linkedPrimary !== null) details.delete(\"url\");\n\n  const detailLines = [...new Set([\n    ...(linkedPrimary !== null ? [linkedPrimary] : primary === undefined ? [] : [escapeSlackText(primary)]),\n    ...[...details.values()].map(escapeSlackText),\n  ])];\n  const lists = slackListFields.flatMap((field) => {\n    const value = event.data[field];\n    if (!Array.isArray(value)) return [];\n    return value.flatMap((item) =>\n      typeof item === \"string\" && item.trim() !== \"\" ? [`• ${escapeSlackText(item.trim())}`] : []\n    );\n  });\n  const text = [headline, ...detailLines, ...(lists.length === 0 ? [] : [lists.join(\"\\n\")])]\n    .join(\"\\n\\n\");\n  return text.length <= slackTextLimit ? text : `${text.slice(0, slackTextLimit - 1)}…`;\n}\n\nfunction slackClientMessageId(eventId: string): string {\n  const digest = createHash(\"sha256\").update(eventId).digest(\"hex\").slice(0, 32);\n  return [\n    digest.slice(0, 8),\n    digest.slice(8, 12),\n    digest.slice(12, 16),\n    digest.slice(16, 20),\n    digest.slice(20),\n  ].join(\"-\");\n}\n\n/** Bind Slack rendering and delivery to the channel-neutral communication contract. */\nexport function createSlackCommunicationAdapter(\n  options: SlackCommunicationAdapterOptions,\n): SlackCommunicationAdapter {\n  const render = options.render ?? renderSlackCommunicationEvent;\n  return Object.freeze({\n    channel: \"slack\" as const,\n    render,\n    async deliver(input: CommunicationEvent): Promise<void> {\n      const event = communicationEventSchema.parse(input);\n      if (event.replyTo.channel !== \"slack\") {\n        throw new Error(`Slack communication adapter cannot deliver to ${event.replyTo.channel}.`);\n      }\n      const target = slackOwnerOutcomes.has(event.outcome)\n        ? { type: \"owner\" as const }\n        : { type: \"thread\" as const, ...parseSlackReplyAddress(event.replyTo.address) };\n      await options.send({\n        eventId: event.eventId,\n        clientMessageId: slackClientMessageId(event.eventId),\n        text: render(event),\n        target,\n      });\n    },\n  });\n}\n\nexport interface SlackMessageEvent {\n  teamId: string;\n  channelId: string;\n  messageTs: string;\n  threadTs: string;\n  actorId: string;\n  text: string;\n  replyAddress: string;\n  repositorySlugs: readonly [string, ...string[]];\n  payload: unknown;\n}\n\nexport interface SlackMessageSignal extends NormalizedSignal<\"slack\"> {\n  repositorySlugs: readonly [string, ...string[]];\n  message: {\n    teamId: string;\n    channelId: string;\n    messageTs: string;\n    threadTs: string;\n    actorId: string;\n    text: string;\n  };\n}\n\n/** Normalize an Eve-verified Slack message after the caller resolves its repositories. */\nexport function normalizeSlackMessage(event: SlackMessageEvent): SlackMessageSignal {\n  return {\n    source: \"slack\",\n    deliveryId: `${event.teamId}:${event.channelId}:${event.messageTs}`,\n    repositorySlugs: [\n      event.repositorySlugs[0].toLowerCase(),\n      ...event.repositorySlugs.slice(1).map((slug) => slug.toLowerCase()),\n    ],\n    replyTo: { channel: \"slack\", address: event.replyAddress },\n    message: {\n      teamId: event.teamId,\n      channelId: event.channelId,\n      messageTs: event.messageTs,\n      threadTs: event.threadTs,\n      actorId: event.actorId,\n      text: event.text,\n    },\n    payload: event.payload,\n  };\n}\n\nexport type SlackRepositorySelection =\n  | { status: \"selected\"; repositorySlug: string }\n  | { status: \"required\" }\n  | { status: \"ambiguous\"; repositorySlugs: readonly string[] };\n\nexport type SlackRepositoriesSelection =\n  | { status: \"selected\"; repositorySlugs: readonly [string, ...string[]] }\n  | { status: \"required\" };\n\nfunction escapedPattern(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\nfunction isDelimitedTextMentioned(text: string, value: string): boolean {\n  return new RegExp(\n    `(^|[^a-z0-9._/-])${escapedPattern(value)}($|[^a-z0-9._/-])`,\n    \"i\",\n  ).test(text);\n}\n\nfunction isRepositoryReferenceMentioned(text: string, slug: string): boolean {\n  if (isDelimitedTextMentioned(text, slug)) return true;\n  return new RegExp(\n    `https?://github\\\\.com/${escapedPattern(slug)}(?:\\\\.git)?/?(?=$|[\\\\s?#|>)\\\\],.!])`,\n    \"i\",\n  ).test(text);\n}\n\nfunction repositoryName(slug: string): string {\n  return slug.slice(slug.lastIndexOf(\"/\") + 1);\n}\n\ninterface SlackRepositoryMentions {\n  repositories: readonly string[];\n  matches: readonly string[];\n  ambiguous: readonly string[];\n  candidates: readonly string[];\n}\n\nfunction resolveSlackRepositoryMentions(\n  text: string,\n  repositories: readonly string[],\n): SlackRepositoryMentions {\n  const normalized = [...new Set(repositories.map((slug) => slug.toLowerCase()))];\n  const entries = normalized.map((slug) => ({ slug, name: repositoryName(slug) }));\n  const counts = new Map<string, number>();\n  for (const { name } of entries) {\n    counts.set(name, (counts.get(name) ?? 0) + 1);\n  }\n  const mentionedNames = new Set(\n    [...counts.keys()].filter((name) => isDelimitedTextMentioned(text, name)),\n  );\n  const matches = new Set(entries.flatMap(({ slug, name }) =>\n    isRepositoryReferenceMentioned(text, slug) || (\n      counts.get(name) === 1 && mentionedNames.has(name)\n    )\n      ? [slug]\n      : []\n  ));\n  const ambiguous = new Set(entries.flatMap(({ slug, name }) =>\n    counts.get(name) !== 1 && mentionedNames.has(name) ? [slug] : []\n  ));\n\n  return {\n    repositories: normalized,\n    matches: normalized.filter((slug) => matches.has(slug)),\n    ambiguous: normalized.filter((slug) => ambiguous.has(slug)),\n    candidates: normalized.filter((slug) => matches.has(slug) || ambiguous.has(slug)),\n  };\n}\n\n/** Select every named configured repository, preserving configuration order. */\nexport function selectSlackRepositories(\n  text: string,\n  repositories: readonly string[],\n): SlackRepositoriesSelection {\n  const mentions = resolveSlackRepositoryMentions(text, repositories);\n  if (mentions.repositories.length === 1) {\n    return { status: \"selected\", repositorySlugs: [mentions.repositories[0]!] };\n  }\n  if (mentions.ambiguous.length > 0) return { status: \"required\" };\n  return mentions.matches.length === 0\n    ? { status: \"required\" }\n    : {\n        status: \"selected\",\n        repositorySlugs: [mentions.matches[0]!, ...mentions.matches.slice(1)],\n      };\n}\n\n/**\n * Select the only configured repository, or match a full slug, unique short\n * name, or GitHub repository URL when a Slack surface fronts multiple repositories.\n */\nexport function selectSlackRepository(\n  text: string,\n  repositories: readonly string[],\n): SlackRepositorySelection {\n  const mentions = resolveSlackRepositoryMentions(text, repositories);\n  if (mentions.repositories.length === 1) {\n    return { status: \"selected\", repositorySlug: mentions.repositories[0]! };\n  }\n  if (mentions.candidates.length === 1) {\n    return { status: \"selected\", repositorySlug: mentions.candidates[0]! };\n  }\n  if (mentions.candidates.length > 1) {\n    return { status: \"ambiguous\", repositorySlugs: mentions.candidates };\n  }\n  return { status: \"required\" };\n}\n"],"mappings":";;;AASA,MAAM,qBAA2D;CAC/D,UAAU;CACV,SAAS;CACT,WAAW;CACX,QAAQ;CACR,aAAa;CACb,UAAU;CACV,QAAQ;CACR,aAAa;CACb,gBAAgB;CAChB,kBAAkB;CAClB,SAAS;AACX;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAW;CAAW;CAAY;CAAmB;CAAU;AAAK;AACxG,MAAM,kBAAkB,CAAC,SAAS,SAAS;AAC3C,MAAM,iBAAiB;AACvB,MAAM,qCAAqB,IAAI,IAA0B;CACvD;CACA;CACA;AACF,CAAC;AAED,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,MAAM,WAAW,KAAK,OAAO,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,MAAM;AACtF;AAEA,SAAS,UAAU,KAAa,OAA8B;CAC5D,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS,OAAO;EACxE,OAAO,IAAI,gBAAgB,OAAO,SAAS,CAAC,EAAE,GAAG,gBAAgB,KAAK,EAAE;CAC1E,QAAQ;EACN,OAAO;CACT;AACF;;AA2BA,SAAgB,uBAAuB,SAAmC;CACxE,MAAM,YAAY,QAAQ,QAAQ,GAAG;CACrC,MAAM,YAAY,QAAQ,MAAM,GAAG,SAAS;CAC5C,MAAM,WAAW,QAAQ,MAAM,YAAY,CAAC;CAC5C,IAAI,aAAa,KAAK,CAAC,mBAAmB,KAAK,SAAS,KAAK,CAAC,aAAa,KAAK,QAAQ,GACtF,MAAM,IAAI,MAAM,gCAAgC,QAAQ,EAAE;CAE5D,OAAO;EAAE;EAAW;CAAS;AAC/B;;AAGA,SAAgB,8BAA8B,OAAmC;CAC/E,MAAM,QAAQ,yBAAyB,MAAM,KAAK;CAClD,MAAM,WAAW,IAAI,mBAAmB,MAAM,SAAS;CACvD,MAAM,UAAU,IAAI,IAAI,kBAAkB,SAAS,UAAU;EAC3D,MAAM,QAAQ,MAAM,KAAK;EACzB,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,MAAM,KAAK,CAAC,CAAU,IAAI,CAAC;CAChG,CAAC,CAAC;CACF,MAAM,eAAgB;EAAC;EAAS;EAAY;CAAiB,CAAC,CAC3D,MAAM,UAAU,QAAQ,IAAI,KAAK,CAAC;CACrC,MAAM,UAAU,iBAAiB,KAAA,IAAY,KAAA,IAAY,QAAQ,IAAI,YAAY;CACjF,MAAM,MAAM,QAAQ,IAAI,KAAK;CAC7B,MAAM,gBAAgB,YAAY,KAAA,KAAa,QAAQ,KAAA,IAAY,UAAU,KAAK,OAAO,IAAI;CAC7F,IAAI,iBAAiB,KAAA,GAAW,QAAQ,OAAO,YAAY;CAC3D,IAAI,kBAAkB,MAAM,QAAQ,OAAO,KAAK;CAEhD,MAAM,cAAc,CAAC,mBAAG,IAAI,IAAI,CAC9B,GAAI,kBAAkB,OAAO,CAAC,aAAa,IAAI,YAAY,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,GACrG,GAAG,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,IAAI,eAAe,CAC9C,CAAC,CAAC;CACF,MAAM,QAAQ,gBAAgB,SAAS,UAAU;EAC/C,MAAM,QAAQ,MAAM,KAAK;EACzB,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,CAAC;EACnC,OAAO,MAAM,SAAS,SACpB,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,KAAK,CAAC,KAAK,gBAAgB,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,CAC5F;CACF,CAAC;CACD,MAAM,OAAO;EAAC;EAAU,GAAG;EAAa,GAAI,MAAM,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;CAAE,CAAC,CACvF,KAAK,MAAM;CACd,OAAO,KAAK,UAAU,iBAAiB,OAAO,GAAG,KAAK,MAAM,GAAG,KAAkB,EAAE;AACrF;AAEA,SAAS,qBAAqB,SAAyB;CACrD,MAAM,SAAS,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;CAC7E,OAAO;EACL,OAAO,MAAM,GAAG,CAAC;EACjB,OAAO,MAAM,GAAG,EAAE;EAClB,OAAO,MAAM,IAAI,EAAE;EACnB,OAAO,MAAM,IAAI,EAAE;EACnB,OAAO,MAAM,EAAE;CACjB,CAAC,CAAC,KAAK,GAAG;AACZ;;AAGA,SAAgB,gCACd,SAC2B;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,OAAO,OAAO,OAAO;EACnB,SAAS;EACT;EACA,MAAM,QAAQ,OAA0C;GACtD,MAAM,QAAQ,yBAAyB,MAAM,KAAK;GAClD,IAAI,MAAM,QAAQ,YAAY,SAC5B,MAAM,IAAI,MAAM,iDAAiD,MAAM,QAAQ,QAAQ,EAAE;GAE3F,MAAM,SAAS,mBAAmB,IAAI,MAAM,OAAO,IAC/C,EAAE,MAAM,QAAiB,IACzB;IAAE,MAAM;IAAmB,GAAG,uBAAuB,MAAM,QAAQ,OAAO;GAAE;GAChF,MAAM,QAAQ,KAAK;IACjB,SAAS,MAAM;IACf,iBAAiB,qBAAqB,MAAM,OAAO;IACnD,MAAM,OAAO,KAAK;IAClB;GACF,CAAC;EACH;CACF,CAAC;AACH;;AA2BA,SAAgB,sBAAsB,OAA8C;CAClF,OAAO;EACL,QAAQ;EACR,YAAY,GAAG,MAAM,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM;EACxD,iBAAiB,CACf,MAAM,gBAAgB,EAAE,CAAC,YAAY,GACrC,GAAG,MAAM,gBAAgB,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,KAAK,YAAY,CAAC,CACpE;EACA,SAAS;GAAE,SAAS;GAAS,SAAS,MAAM;EAAa;EACzD,SAAS;GACP,QAAQ,MAAM;GACd,WAAW,MAAM;GACjB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,SAAS,MAAM;GACf,MAAM,MAAM;EACd;EACA,SAAS,MAAM;CACjB;AACF;AAWA,SAAS,eAAe,OAAuB;CAC7C,OAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEA,SAAS,yBAAyB,MAAc,OAAwB;CACtE,OAAO,IAAI,OACT,oBAAoB,eAAe,KAAK,EAAE,oBAC1C,GACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAS,+BAA+B,MAAc,MAAuB;CAC3E,IAAI,yBAAyB,MAAM,IAAI,GAAG,OAAO;CACjD,OAAO,IAAI,OACT,yBAAyB,eAAe,IAAI,EAAE,sCAC9C,GACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAS,eAAe,MAAsB;CAC5C,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;AAC7C;AASA,SAAS,+BACP,MACA,cACyB;CACzB,MAAM,aAAa,CAAC,GAAG,IAAI,IAAI,aAAa,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC;CAC9E,MAAM,UAAU,WAAW,KAAK,UAAU;EAAE;EAAM,MAAM,eAAe,IAAI;CAAE,EAAE;CAC/E,MAAM,yBAAS,IAAI,IAAoB;CACvC,KAAK,MAAM,EAAE,UAAU,SACrB,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,KAAK,KAAK,CAAC;CAE9C,MAAM,iBAAiB,IAAI,IACzB,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,SAAS,yBAAyB,MAAM,IAAI,CAAC,CAC1E;CACA,MAAM,UAAU,IAAI,IAAI,QAAQ,SAAS,EAAE,MAAM,WAC/C,+BAA+B,MAAM,IAAI,KACvC,OAAO,IAAI,IAAI,MAAM,KAAK,eAAe,IAAI,IAAI,IAE/C,CAAC,IAAI,IACL,CAAC,CACP,CAAC;CACD,MAAM,YAAY,IAAI,IAAI,QAAQ,SAAS,EAAE,MAAM,WACjD,OAAO,IAAI,IAAI,MAAM,KAAK,eAAe,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CACjE,CAAC;CAED,OAAO;EACL,cAAc;EACd,SAAS,WAAW,QAAQ,SAAS,QAAQ,IAAI,IAAI,CAAC;EACtD,WAAW,WAAW,QAAQ,SAAS,UAAU,IAAI,IAAI,CAAC;EAC1D,YAAY,WAAW,QAAQ,SAAS,QAAQ,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC;CAClF;AACF;;AAGA,SAAgB,wBACd,MACA,cAC4B;CAC5B,MAAM,WAAW,+BAA+B,MAAM,YAAY;CAClE,IAAI,SAAS,aAAa,WAAW,GACnC,OAAO;EAAE,QAAQ;EAAY,iBAAiB,CAAC,SAAS,aAAa,EAAG;CAAE;CAE5E,IAAI,SAAS,UAAU,SAAS,GAAG,OAAO,EAAE,QAAQ,WAAW;CAC/D,OAAO,SAAS,QAAQ,WAAW,IAC/B,EAAE,QAAQ,WAAW,IACrB;EACE,QAAQ;EACR,iBAAiB,CAAC,SAAS,QAAQ,IAAK,GAAG,SAAS,QAAQ,MAAM,CAAC,CAAC;CACtE;AACN;;;;;AAMA,SAAgB,sBACd,MACA,cAC0B;CAC1B,MAAM,WAAW,+BAA+B,MAAM,YAAY;CAClE,IAAI,SAAS,aAAa,WAAW,GACnC,OAAO;EAAE,QAAQ;EAAY,gBAAgB,SAAS,aAAa;CAAI;CAEzE,IAAI,SAAS,WAAW,WAAW,GACjC,OAAO;EAAE,QAAQ;EAAY,gBAAgB,SAAS,WAAW;CAAI;CAEvE,IAAI,SAAS,WAAW,SAAS,GAC/B,OAAO;EAAE,QAAQ;EAAa,iBAAiB,SAAS;CAAW;CAErE,OAAO,EAAE,QAAQ,WAAW;AAC9B"}
+{"version":3,"file":"slack.mjs","names":[],"sources":["../../src/connectors/slack.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { MaybePromise } from \"../schema/common\";\nimport { repositorySlugSchema, type RepositorySlug } from \"../schema/repository\";\nexport {\n  createSlackApprovals,\n  type SlackApprovals,\n  type SlackApprovalsOptions,\n  type SlackApprovalsStores,\n} from \"./slack-approvals\";\nimport {\n  communicationEventSchema,\n  type CommunicationAdapter,\n  type CommunicationEvent,\n  type CommunicationOutcome,\n  type NormalizedSignal,\n} from \"./index\";\n\nconst slackOutcomeLabels: Record<CommunicationOutcome, string> = {\n  accepted: \"Request accepted\",\n  started: \"Work started\",\n  succeeded: \"Work completed\",\n  failed: \"Work failed\",\n  cancelled: \"Work cancelled\",\n  needs_human: \"Human action required\",\n  question: \"Question requires an answer\",\n  digest: \"Factory digest\",\n  rolled_back: \"Change rolled back\",\n  budget_warning: \"Factory budget warning\",\n  budget_exhausted: \"Factory budget exhausted\",\n  message: \"Factory update\",\n};\n\nconst slackDetailFields = [\n  \"title\",\n  \"message\",\n  \"summary\",\n  \"question\",\n  \"requestedAction\",\n  \"reference\",\n  \"answerLocation\",\n  \"reason\",\n  \"url\",\n] as const;\nconst slackListFields = [\"items\", \"options\"] as const;\nconst slackTextLimit = 12_000;\nconst slackOwnerOutcomes = new Set<CommunicationOutcome>([\n  \"digest\",\n  \"budget_warning\",\n  \"budget_exhausted\",\n  \"needs_human\",\n]);\n\nfunction escapeSlackText(value: string): string {\n  return value.replaceAll(\"&\", \"&amp;\").replaceAll(\"<\", \"&lt;\").replaceAll(\">\", \"&gt;\");\n}\n\nfunction slackLink(url: string, label: string): string | null {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return null;\n    return `<${escapeSlackText(parsed.toString())}|${escapeSlackText(label)}>`;\n  } catch {\n    return null;\n  }\n}\n\n/** Fully rendered Slack delivery with a stable idempotency key and resolved destination. */\nexport interface SlackCommunicationDelivery {\n  eventId: string;\n  clientMessageId: string;\n  text: string;\n  target: { type: \"owner\" } | { type: \"thread\"; channelId: string; threadTs: string };\n}\n\n/** Slack-specific communication adapter with an inspectable mrkdwn renderer. */\nexport interface SlackCommunicationAdapter extends CommunicationAdapter {\n  readonly channel: \"slack\";\n  render(event: CommunicationEvent): string;\n}\n\n/** Configures Slack rendering, provider delivery, and durable delivery projection. */\nexport interface SlackCommunicationAdapterOptions {\n  send(delivery: SlackCommunicationDelivery): Promise<void>;\n  render?: (event: CommunicationEvent) => string;\n  /**\n   * Runs once send() resolves without throwing, i.e. once Slack has\n   * confirmed delivery. Errors propagate so the outbox retries with the same\n   * client message ID until both the send and its durable projection succeed.\n   */\n  onDelivered?: (event: CommunicationEvent) => MaybePromise<void>;\n}\n\n/** The channel and thread extracted from a Slack reply address. */\nexport interface SlackReplyTarget {\n  channelId: string;\n  threadTs: string;\n}\n\n/** Parse Eve's Slack continuation token into its channel and thread target. */\nexport function parseSlackReplyAddress(address: string): SlackReplyTarget {\n  const separator = address.indexOf(\":\");\n  const channelId = address.slice(0, separator);\n  const threadTs = address.slice(separator + 1);\n  if (separator <= 0 || !/^[A-Z][A-Z0-9]+$/.test(channelId) || !/^\\d+\\.\\d+$/.test(threadTs)) {\n    throw new Error(`Invalid Slack reply address: ${address}.`);\n  }\n  return { channelId, threadTs };\n}\n\n/** Render a provider-neutral communication event as Slack mrkdwn. */\nexport function renderSlackCommunicationEvent(input: CommunicationEvent): string {\n  const event = communicationEventSchema.parse(input);\n  const headline = `*${slackOutcomeLabels[event.outcome]}*`;\n  const details = new Map(\n    slackDetailFields.flatMap((field) => {\n      const value = event.data[field];\n      return typeof value === \"string\" && value.trim() !== \"\"\n        ? [[field, value.trim()] as const]\n        : [];\n    }),\n  );\n  const primaryField = ([\"title\", \"question\", \"requestedAction\"] as const).find((field) =>\n    details.has(field),\n  );\n  const primary = primaryField === undefined ? undefined : details.get(primaryField);\n  const url = details.get(\"url\");\n  const linkedPrimary = primary !== undefined && url !== undefined ? slackLink(url, primary) : null;\n  if (primaryField !== undefined) details.delete(primaryField);\n  if (linkedPrimary !== null) details.delete(\"url\");\n\n  const detailLines = [\n    ...new Set([\n      ...(linkedPrimary !== null\n        ? [linkedPrimary]\n        : primary === undefined\n          ? []\n          : [escapeSlackText(primary)]),\n      ...[...details.values()].map(escapeSlackText),\n    ]),\n  ];\n  const lists = slackListFields.flatMap((field) => {\n    const value = event.data[field];\n    if (!Array.isArray(value)) return [];\n    return value.flatMap((item) =>\n      typeof item === \"string\" && item.trim() !== \"\" ? [`• ${escapeSlackText(item.trim())}`] : [],\n    );\n  });\n  // Success messages lead directly with the result; the generic outcome\n  // headline is redundant once the work is done and the summary says it all.\n  // When a succeeded event carries no other content, fall back to the\n  // shared status-label mapping so the message is never blank and stays\n  // consistent with how every other outcome renders.\n  const hasContent = detailLines.length > 0 || lists.length > 0;\n  const headlineLines = event.outcome === \"succeeded\" && hasContent ? [] : [headline];\n  const text = [\n    ...headlineLines,\n    ...detailLines,\n    ...(lists.length === 0 ? [] : [lists.join(\"\\n\")]),\n  ].join(\"\\n\\n\");\n  return text.length <= slackTextLimit ? text : `${text.slice(0, slackTextLimit - 1)}…`;\n}\n\nfunction slackClientMessageId(eventId: string): string {\n  const digest = createHash(\"sha256\").update(eventId).digest(\"hex\").slice(0, 32);\n  return [\n    digest.slice(0, 8),\n    digest.slice(8, 12),\n    digest.slice(12, 16),\n    digest.slice(16, 20),\n    digest.slice(20),\n  ].join(\"-\");\n}\n\n/** Bind Slack rendering and delivery to the channel-neutral communication contract. */\nexport function createSlackCommunicationAdapter(\n  options: SlackCommunicationAdapterOptions,\n): SlackCommunicationAdapter {\n  const render = options.render ?? renderSlackCommunicationEvent;\n  return Object.freeze({\n    channel: \"slack\" as const,\n    render,\n    async deliver(input: CommunicationEvent): Promise<void> {\n      const event = communicationEventSchema.parse(input);\n      if (event.replyTo.channel !== \"slack\") {\n        throw new Error(`Slack communication adapter cannot deliver to ${event.replyTo.channel}.`);\n      }\n      const target = slackOwnerOutcomes.has(event.outcome)\n        ? { type: \"owner\" as const }\n        : { type: \"thread\" as const, ...parseSlackReplyAddress(event.replyTo.address) };\n      await options.send({\n        eventId: event.eventId,\n        clientMessageId: slackClientMessageId(event.eventId),\n        text: render(event),\n        target,\n      });\n      await options.onDelivered?.(event);\n    },\n  });\n}\n\n/** Authenticated Slack message metadata after repository and reply context resolution. */\nexport interface SlackMessageEvent {\n  readonly teamId: string;\n  readonly channelId: string;\n  readonly messageTs: string;\n  readonly threadTs: string;\n  readonly actorId: string;\n  readonly text: string;\n  readonly replyAddress: string;\n  readonly repositorySlugs: readonly [RepositorySlug, ...RepositorySlug[]];\n  readonly payload: unknown;\n}\n\n/** A normalized Slack signal with the authenticated message and repository scope retained. */\nexport interface SlackMessageSignal extends NormalizedSignal<\"slack\"> {\n  readonly repositorySlugs: readonly [RepositorySlug, ...RepositorySlug[]];\n  readonly message: {\n    readonly teamId: string;\n    readonly channelId: string;\n    readonly messageTs: string;\n    readonly threadTs: string;\n    readonly actorId: string;\n    readonly text: string;\n  };\n}\n\n/** Normalize an Eve-verified Slack message after the caller resolves its repositories. */\nexport function normalizeSlackMessage(event: SlackMessageEvent): SlackMessageSignal {\n  return {\n    source: \"slack\",\n    deliveryId: `${event.teamId}:${event.channelId}:${event.messageTs}`,\n    repositorySlugs: [\n      repositorySlugSchema.parse(event.repositorySlugs[0].toLowerCase()),\n      ...event.repositorySlugs\n        .slice(1)\n        .map((slug) => repositorySlugSchema.parse(slug.toLowerCase())),\n    ],\n    replyTo: { channel: \"slack\", address: event.replyAddress },\n    message: {\n      teamId: event.teamId,\n      channelId: event.channelId,\n      messageTs: event.messageTs,\n      threadTs: event.threadTs,\n      actorId: event.actorId,\n      text: event.text,\n    },\n    payload: event.payload,\n  };\n}\n"],"mappings":";;;;;AAiBA,MAAM,qBAA2D;CAC/D,UAAU;CACV,SAAS;CACT,WAAW;CACX,QAAQ;CACR,WAAW;CACX,aAAa;CACb,UAAU;CACV,QAAQ;CACR,aAAa;CACb,gBAAgB;CAChB,kBAAkB;CAClB,SAAS;AACX;AAEA,MAAM,oBAAoB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAM,kBAAkB,CAAC,SAAS,SAAS;AAC3C,MAAM,iBAAiB;AACvB,MAAM,qCAAqB,IAAI,IAA0B;CACvD;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,MAAM,WAAW,KAAK,OAAO,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,MAAM;AACtF;AAEA,SAAS,UAAU,KAAa,OAA8B;CAC5D,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS,OAAO;EACxE,OAAO,IAAI,gBAAgB,OAAO,SAAS,CAAC,EAAE,GAAG,gBAAgB,KAAK,EAAE;CAC1E,QAAQ;EACN,OAAO;CACT;AACF;;AAmCA,SAAgB,uBAAuB,SAAmC;CACxE,MAAM,YAAY,QAAQ,QAAQ,GAAG;CACrC,MAAM,YAAY,QAAQ,MAAM,GAAG,SAAS;CAC5C,MAAM,WAAW,QAAQ,MAAM,YAAY,CAAC;CAC5C,IAAI,aAAa,KAAK,CAAC,mBAAmB,KAAK,SAAS,KAAK,CAAC,aAAa,KAAK,QAAQ,GACtF,MAAM,IAAI,MAAM,gCAAgC,QAAQ,EAAE;CAE5D,OAAO;EAAE;EAAW;CAAS;AAC/B;;AAGA,SAAgB,8BAA8B,OAAmC;CAC/E,MAAM,QAAQ,yBAAyB,MAAM,KAAK;CAClD,MAAM,WAAW,IAAI,mBAAmB,MAAM,SAAS;CACvD,MAAM,UAAU,IAAI,IAClB,kBAAkB,SAAS,UAAU;EACnC,MAAM,QAAQ,MAAM,KAAK;EACzB,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KACjD,CAAC,CAAC,OAAO,MAAM,KAAK,CAAC,CAAU,IAC/B,CAAC;CACP,CAAC,CACH;CACA,MAAM,eAAgB;EAAC;EAAS;EAAY;CAAiB,CAAC,CAAW,MAAM,UAC7E,QAAQ,IAAI,KAAK,CACnB;CACA,MAAM,UAAU,iBAAiB,KAAA,IAAY,KAAA,IAAY,QAAQ,IAAI,YAAY;CACjF,MAAM,MAAM,QAAQ,IAAI,KAAK;CAC7B,MAAM,gBAAgB,YAAY,KAAA,KAAa,QAAQ,KAAA,IAAY,UAAU,KAAK,OAAO,IAAI;CAC7F,IAAI,iBAAiB,KAAA,GAAW,QAAQ,OAAO,YAAY;CAC3D,IAAI,kBAAkB,MAAM,QAAQ,OAAO,KAAK;CAEhD,MAAM,cAAc,CAClB,mBAAG,IAAI,IAAI,CACT,GAAI,kBAAkB,OAClB,CAAC,aAAa,IACd,YAAY,KAAA,IACV,CAAC,IACD,CAAC,gBAAgB,OAAO,CAAC,GAC/B,GAAG,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,IAAI,eAAe,CAC9C,CAAC,CACH;CACA,MAAM,QAAQ,gBAAgB,SAAS,UAAU;EAC/C,MAAM,QAAQ,MAAM,KAAK;EACzB,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,CAAC;EACnC,OAAO,MAAM,SAAS,SACpB,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,KAAK,CAAC,KAAK,gBAAgB,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,CAC5F;CACF,CAAC;CAMD,MAAM,aAAa,YAAY,SAAS,KAAK,MAAM,SAAS;CAE5D,MAAM,OAAO;EACX,GAFoB,MAAM,YAAY,eAAe,aAAa,CAAC,IAAI,CAAC,QAAQ;EAGhF,GAAG;EACH,GAAI,MAAM,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;CACjD,CAAC,CAAC,KAAK,MAAM;CACb,OAAO,KAAK,UAAU,iBAAiB,OAAO,GAAG,KAAK,MAAM,GAAG,KAAkB,EAAE;AACrF;AAEA,SAAS,qBAAqB,SAAyB;CACrD,MAAM,SAAS,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;CAC7E,OAAO;EACL,OAAO,MAAM,GAAG,CAAC;EACjB,OAAO,MAAM,GAAG,EAAE;EAClB,OAAO,MAAM,IAAI,EAAE;EACnB,OAAO,MAAM,IAAI,EAAE;EACnB,OAAO,MAAM,EAAE;CACjB,CAAC,CAAC,KAAK,GAAG;AACZ;;AAGA,SAAgB,gCACd,SAC2B;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,OAAO,OAAO,OAAO;EACnB,SAAS;EACT;EACA,MAAM,QAAQ,OAA0C;GACtD,MAAM,QAAQ,yBAAyB,MAAM,KAAK;GAClD,IAAI,MAAM,QAAQ,YAAY,SAC5B,MAAM,IAAI,MAAM,iDAAiD,MAAM,QAAQ,QAAQ,EAAE;GAE3F,MAAM,SAAS,mBAAmB,IAAI,MAAM,OAAO,IAC/C,EAAE,MAAM,QAAiB,IACzB;IAAE,MAAM;IAAmB,GAAG,uBAAuB,MAAM,QAAQ,OAAO;GAAE;GAChF,MAAM,QAAQ,KAAK;IACjB,SAAS,MAAM;IACf,iBAAiB,qBAAqB,MAAM,OAAO;IACnD,MAAM,OAAO,KAAK;IAClB;GACF,CAAC;GACD,MAAM,QAAQ,cAAc,KAAK;EACnC;CACF,CAAC;AACH;;AA6BA,SAAgB,sBAAsB,OAA8C;CAClF,OAAO;EACL,QAAQ;EACR,YAAY,GAAG,MAAM,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM;EACxD,iBAAiB,CACf,qBAAqB,MAAM,MAAM,gBAAgB,EAAE,CAAC,YAAY,CAAC,GACjE,GAAG,MAAM,gBACN,MAAM,CAAC,CAAC,CACR,KAAK,SAAS,qBAAqB,MAAM,KAAK,YAAY,CAAC,CAAC,CACjE;EACA,SAAS;GAAE,SAAS;GAAS,SAAS,MAAM;EAAa;EACzD,SAAS;GACP,QAAQ,MAAM;GACd,WAAW,MAAM;GACjB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,SAAS,MAAM;GACf,MAAM,MAAM;EACd;EACA,SAAS,MAAM;CACjB;AACF"}

package/dist/deepsec/eve-tool.d.mts

@@ -0,0 +1,110 @@
+import { TaskId } from "../schema/id.mjs";
+import { MillisecondClock } from "../schema/common.mjs";
+import { FactoryStores } from "../store/engine.mjs";
+import { CommandSandbox, CommandSandboxRunResult } from "../sandbox/command.mjs";
+import { Finding } from "../schema/finding.mjs";
+import { AdmitFindingOptions } from "../finding-remediation/admission.mjs";
+import { z } from "zod";
+import { ToolContext, ToolDefinition } from "eve/tools";
+//#region src/deepsec/eve-tool.d.ts
+/** Repository, receipt, Signal, and Task capabilities required by the Deepsec scan tool. */
+type DeepsecScanToolStores = Pick<FactoryStores, "receipts" | "repositories" | "signals" | "tasks">;
+/** Deepsec investigation backend selected for one scan. */
+type DeepsecAgent = "claude" | "codex" | "pi";
+/** Reasoning effort accepted by Deepsec's investigation agent. */
+type DeepsecThinkingLevel = "minimal" | "low" | "medium" | "high" | "xhigh";
+/** Validates the repository and optional candidate-file cap supplied to the Deepsec tool. */
+declare const deepsecScanInputSchema: z.ZodObject<{
+  repositoryId: z.ZodType<`repo_${string}`, string, z.core.$ZodTypeInternals<`repo_${string}`, string>>;
+  limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/** Repository and optional candidate-file cap supplied to one Deepsec scan. */
+type DeepsecScanInput = z.infer<typeof deepsecScanInputSchema>;
+/** Configures credential isolation, execution limits, and finding admission for a deepsec scan. */
+interface DeepsecScanToolOptions<S extends CommandSandbox = CommandSandbox> extends AdmitFindingOptions {
+  /** Factory capabilities used to report scan phases and admit findings. */
+  stores: DeepsecScanToolStores;
+  /**
+   * Runs one shell command with the model credential deepsec's gateway route
+   * expects, and removes it again before resolving. Supplied by the app, which
+   * owns where the credential comes from: on Vercel it is the deployment's own
+   * OIDC identity (VERCEL_OIDC_TOKEN), so nothing has to be configured.
+   */
+  withModelCredential: (input: DeepsecCredentialCommandInput<S>) => Promise<DeepsecCommandResult>;
+  /** deepsec agent backend: claude, codex, or pi. */
+  agent?: DeepsecAgent;
+  /** Model deepsec's investigation agent uses, through the AI Gateway (e.g. claude-sonnet-4-6). */
+  model?: string;
+  /** Reasoning effort for the investigation: minimal, low, medium, high, or xhigh. */
+  thinkingLevel?: DeepsecThinkingLevel;
+  /** Parallel investigation batches. */
+  concurrency?: number;
+  /** deepsec version to install. */
+  version?: string;
+  /** Millisecond clock used for receipt elapsed-time reporting. */
+  now?: MillisecondClock;
+  /** Repository checkout inside the sandbox. Defaults to `repo`. */
+  repoPath?: string;
+  /** deepsec workspace inside the sandbox. Defaults to `deepsec`. */
+  workspacePath?: string;
+  /** Shell run before every deepsec command, e.g. to put a Node 24 on PATH. */
+  commandPrefix?: string;
+  /**
+   * Candidate files investigated per run. deepsec keeps state, so successive
+   * scans continue where the last one stopped; the cap keeps one run inside
+   * the deployment's time limit on large repositories. Defaults to 40.
+   */
+  filesPerRun?: number;
+}
+/** Sandbox and trusted command that may temporarily receive a model credential. */
+interface DeepsecCredentialCommandInput<S extends CommandSandbox = CommandSandbox> {
+  sandbox: S;
+  command: string;
+}
+/** Captured output from one Deepsec sandbox command. */
+type DeepsecCommandResult = CommandSandboxRunResult;
+/** Machine-readable reason a Deepsec scan did not produce findings. */
+type DeepsecScanFailureCode = "repository_not_found" | "scan_failed" | "process_failed" | "invalid_export_json" | "invalid_export_shape";
+/** Bounded Deepsec refusal with a human-readable reason code payload. */
+interface DeepsecScanFailure {
+  scanned: false;
+  code: DeepsecScanFailureCode;
+  reason: string;
+}
+/** One normalized Deepsec finding and its admission outcome. */
+type DeepsecScanFinding = Pick<Finding, "title" | "priority" | "path" | "line"> & ({
+  duplicate: true;
+  taskId?: never;
+  approval?: never;
+} | {
+  duplicate?: never;
+  taskId: TaskId;
+  approval: "required" | "not_required";
+});
+/** Counts and bounded finding summaries returned after a completed Deepsec scan. */
+interface DeepsecScanSuccess {
+  scanned: true;
+  tool: "deepsec";
+  found: number;
+  recorded: number;
+  duplicates: number;
+  awaitingApproval: number;
+  findings: readonly DeepsecScanFinding[];
+}
+/** Discriminated result returned by the optional Deepsec scanner tool. */
+type DeepsecScanResult = DeepsecScanFailure | DeepsecScanSuccess;
+/** Eve tool that runs one bounded Deepsec scan and admits its findings. */
+interface DeepsecScanTool extends ToolDefinition<DeepsecScanInput, DeepsecScanResult> {
+  execute(input: DeepsecScanInput, ctx: ToolContext): Promise<DeepsecScanResult>;
+}
+/**
+ * Runs deepsec (vercel-labs/deepsec) against the sandbox checkout and records
+ * what it finds through the same path as record_finding, so every deepsec
+ * finding becomes a fix task subject to the approval policy. Trusted code
+ * owns the command sequence and the credential; the agent chooses when to
+ * scan and reports the outcome.
+ */
+declare function createDeepsecScanTool<S extends CommandSandbox>(input: DeepsecScanToolOptions<S>): DeepsecScanTool;
+//#endregion
+export { DeepsecAgent, DeepsecCommandResult, DeepsecCredentialCommandInput, DeepsecScanFailure, DeepsecScanFailureCode, DeepsecScanFinding, DeepsecScanInput, DeepsecScanResult, DeepsecScanSuccess, DeepsecScanTool, DeepsecScanToolOptions, DeepsecScanToolStores, DeepsecThinkingLevel, createDeepsecScanTool, deepsecScanInputSchema };
+//# sourceMappingURL=eve-tool.d.mts.map

package/dist/deepsec/eve-tool.mjs

@@ -0,0 +1,164 @@
+import { repositoryIdSchema } from "../schema/id.mjs";
+import { optionalTaskIdForSession } from "../eve/task-session.mjs";
+import { deepsecExportSchema, findingFromDeepsec } from "./finding.mjs";
+import { admitFinding } from "../finding-remediation/admission.mjs";
+import { z } from "zod";
+import { defineTool } from "eve/tools";
+//#region src/deepsec/eve-tool.ts
+/** Validates the repository and optional candidate-file cap supplied to the Deepsec tool. */
+const deepsecScanInputSchema = z.object({
+	repositoryId: repositoryIdSchema,
+	limit: z.number().int().min(1).max(500).optional().describe("Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).")
+});
+const findingsPath = "/tmp/deepsec-findings.json";
+/** Parse "N file(s) with candidates" out of deepsec scan output; null when absent. */
+function candidateCount(output) {
+	const match = /(\d+)\s+file\(s\) with candidates/u.exec(output);
+	return match?.[1] === void 0 ? null : Number(match[1]);
+}
+/** The last few meaningful lines of a command's output, ANSI stripped, for a receipt. */
+function tail(output, lines = 4) {
+	return output.replaceAll(/\u001b\[[0-9;]*m/gu, "").split("\n").map((line) => line.trim()).filter((line) => line !== "").slice(-lines).join(" | ").slice(0, 600);
+}
+/**
+* Runs deepsec (vercel-labs/deepsec) against the sandbox checkout and records
+* what it finds through the same path as record_finding, so every deepsec
+* finding becomes a fix task subject to the approval policy. Trusted code
+* owns the command sequence and the credential; the agent chooses when to
+* scan and reports the outcome.
+*/
+function createDeepsecScanTool(input) {
+	const { stores, ...options } = input;
+	const repoPath = options.repoPath ?? "repo";
+	const workspace = options.workspacePath ?? "deepsec";
+	const version = options.version ?? "2.3.8";
+	const agent = options.agent ?? "claude";
+	const model = options.model ?? "claude-sonnet-4-6";
+	const thinkingLevel = options.thinkingLevel ?? "medium";
+	const concurrency = options.concurrency ?? 4;
+	const prefix = options.commandPrefix === void 0 ? [] : [options.commandPrefix];
+	const filesPerRun = options.filesPerRun ?? 40;
+	const now = options.now ?? Date.now;
+	return defineTool({
+		description: "Run deepsec, the AI-powered vulnerability scanner, over the repository checkout and record every finding it reports as a fix task. Takes minutes. Call once per scan; then summarize the result.",
+		inputSchema: deepsecScanInputSchema,
+		async execute({ repositoryId, limit }, ctx) {
+			const repository = await stores.repositories.get(repositoryId);
+			if (repository === null) return {
+				scanned: false,
+				code: "repository_not_found",
+				reason: `repository ${repositoryId} does not exist`
+			};
+			const sandbox = await ctx.getSandbox();
+			const projectId = repository.slug.replace(/[^a-z0-9]+/gu, "-");
+			const startedAt = now();
+			const phase = async (state, reason) => {
+				await stores.receipts.append({
+					repositoryIds: [repositoryId],
+					kind: "deepsec",
+					state,
+					phase: "security_scan",
+					reason: `${reason} (${Math.round((now() - startedAt) / 1e3)}s in)`
+				});
+			};
+			await phase("started", `deepsec ${version} on ${repository.slug}, ${agent}/${model}`);
+			const prepare = await sandbox.run({ command: [
+				...prefix,
+				"set -e",
+				`if [ ! -f ${workspace}/deepsec.config.ts ]; then`,
+				`  npx -y deepsec@${version} init ./${workspace} ./${repoPath} --id ${projectId} --scaffold-only --headless --yes --skip-install`,
+				`  (cd ${workspace} && npm install --no-audit --no-fund --loglevel=error)`,
+				"fi",
+				`cd ${workspace}`,
+				`./node_modules/.bin/deepsec scan --project-id ${projectId}`
+			].join("\n") });
+			if (typeof prepare.exitCode === "number" && prepare.exitCode !== 0) {
+				const detail = (prepare.stderr ?? prepare.stdout).trim().slice(-1500);
+				await phase("failed", `scan phase failed: ${detail.slice(-300)}`);
+				return {
+					scanned: false,
+					code: "scan_failed",
+					reason: `deepsec scan failed: ${detail}`
+				};
+			}
+			const candidates = candidateCount(prepare.stdout);
+			await phase("scanned", `${candidates === null ? "scan output" : `${candidates} files with candidates`}: ${tail(`${prepare.stdout}\n${prepare.stderr ?? ""}`)}`);
+			const investigate = await options.withModelCredential({
+				sandbox,
+				command: [
+					...prefix,
+					"set -e",
+					`cd ${workspace}`,
+					`./node_modules/.bin/deepsec process --project-id ${projectId} --agent ${agent} --model ${model} --thinking-level ${thinkingLevel} --concurrency ${concurrency} --limit ${limit ?? filesPerRun}`,
+					`./node_modules/.bin/deepsec export --project-id ${projectId} --format json --out ${findingsPath}`
+				].join("\n")
+			});
+			if (typeof investigate.exitCode === "number" && investigate.exitCode !== 0) {
+				const detail = (investigate.stderr ?? investigate.stdout).trim().slice(-1500);
+				await phase("failed", `process phase failed: ${detail.slice(-300)}`);
+				return {
+					scanned: false,
+					code: "process_failed",
+					reason: `deepsec process failed: ${detail}`
+				};
+			}
+			const exported = await sandbox.run({ command: `cat ${findingsPath}` });
+			let parsed;
+			try {
+				parsed = JSON.parse(exported.stdout);
+			} catch {
+				return {
+					scanned: false,
+					code: "invalid_export_json",
+					reason: "deepsec export was not valid JSON"
+				};
+			}
+			const raw = deepsecExportSchema.safeParse(parsed);
+			if (!raw.success) return {
+				scanned: false,
+				code: "invalid_export_shape",
+				reason: `deepsec export had an unexpected shape: ${raw.error.issues[0]?.message ?? "unknown"}`
+			};
+			const results = [];
+			const taskId = optionalTaskIdForSession(ctx.session.auth.initiator);
+			const scan = taskId === null ? null : await stores.tasks.get(taskId);
+			const replyTo = scan?.replyTo.channel === "slack" && scan.repositoryIds.includes(repositoryId) ? scan.replyTo : options.replyTo;
+			for (const entry of raw.data) {
+				const finding = findingFromDeepsec(entry);
+				results.push({
+					finding,
+					result: await admitFinding(stores, {
+						repositoryId,
+						finding,
+						...options,
+						replyTo
+					})
+				});
+			}
+			const recorded = results.filter(({ result }) => result.recorded);
+			await phase("completed", `${results.length} findings, ${recorded.length} new. process output: ${tail(`${investigate.stdout}\n${investigate.stderr ?? ""}`, 6)}`);
+			return {
+				scanned: true,
+				tool: "deepsec",
+				found: results.length,
+				recorded: recorded.length,
+				duplicates: results.length - recorded.length,
+				awaitingApproval: recorded.filter(({ result }) => result.recorded && result.approval === "required").length,
+				findings: results.map(({ finding, result }) => ({
+					title: finding.title,
+					priority: finding.priority,
+					path: finding.path,
+					line: finding.line,
+					...result.recorded ? {
+						taskId: result.taskId,
+						approval: result.approval
+					} : { duplicate: true }
+				}))
+			};
+		}
+	});
+}
+//#endregion
+export { createDeepsecScanTool, deepsecScanInputSchema };
+
+//# sourceMappingURL=eve-tool.mjs.map

package/dist/deepsec/eve-tool.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-tool.mjs","names":[],"sources":["../../src/deepsec/eve-tool.ts"],"sourcesContent":["import { defineTool, type ToolContext, type ToolDefinition } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { deepsecExportSchema, findingFromDeepsec } from \"./finding\";\nimport {\n  admitFinding,\n  type AdmitFindingOptions,\n  type AdmitFindingResult,\n} from \"../finding-remediation/admission\";\nimport type { Finding } from \"../schema/finding\";\nimport type { MillisecondClock } from \"../schema/common\";\nimport { repositoryIdSchema, type TaskId } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\nimport { optionalTaskIdForSession } from \"../eve/task-session\";\nimport type { CommandSandbox, CommandSandboxRunResult } from \"../sandbox/command\";\n\n/** Repository, receipt, Signal, and Task capabilities required by the Deepsec scan tool. */\nexport type DeepsecScanToolStores = Pick<\n  FactoryStores,\n  \"receipts\" | \"repositories\" | \"signals\" | \"tasks\"\n>;\n\n/** Deepsec investigation backend selected for one scan. */\nexport type DeepsecAgent = \"claude\" | \"codex\" | \"pi\";\n\n/** Reasoning effort accepted by Deepsec's investigation agent. */\nexport type DeepsecThinkingLevel = \"minimal\" | \"low\" | \"medium\" | \"high\" | \"xhigh\";\n\n/** Validates the repository and optional candidate-file cap supplied to the Deepsec tool. */\nexport const deepsecScanInputSchema = z.object({\n  repositoryId: repositoryIdSchema,\n  limit: z\n    .number()\n    .int()\n    .min(1)\n    .max(500)\n    .optional()\n    .describe(\n      \"Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).\",\n    ),\n});\n\n/** Repository and optional candidate-file cap supplied to one Deepsec scan. */\nexport type DeepsecScanInput = z.infer<typeof deepsecScanInputSchema>;\n\n/** Configures credential isolation, execution limits, and finding admission for a deepsec scan. */\nexport interface DeepsecScanToolOptions<\n  S extends CommandSandbox = CommandSandbox,\n> extends AdmitFindingOptions {\n  /** Factory capabilities used to report scan phases and admit findings. */\n  stores: DeepsecScanToolStores;\n  /**\n   * Runs one shell command with the model credential deepsec's gateway route\n   * expects, and removes it again before resolving. Supplied by the app, which\n   * owns where the credential comes from: on Vercel it is the deployment's own\n   * OIDC identity (VERCEL_OIDC_TOKEN), so nothing has to be configured.\n   */\n  withModelCredential: (input: DeepsecCredentialCommandInput<S>) => Promise<DeepsecCommandResult>;\n  /** deepsec agent backend: claude, codex, or pi. */\n  agent?: DeepsecAgent;\n  /** Model deepsec's investigation agent uses, through the AI Gateway (e.g. claude-sonnet-4-6). */\n  model?: string;\n  /** Reasoning effort for the investigation: minimal, low, medium, high, or xhigh. */\n  thinkingLevel?: DeepsecThinkingLevel;\n  /** Parallel investigation batches. */\n  concurrency?: number;\n  /** deepsec version to install. */\n  version?: string;\n  /** Millisecond clock used for receipt elapsed-time reporting. */\n  now?: MillisecondClock;\n  /** Repository checkout inside the sandbox. Defaults to `repo`. */\n  repoPath?: string;\n  /** deepsec workspace inside the sandbox. Defaults to `deepsec`. */\n  workspacePath?: string;\n  /** Shell run before every deepsec command, e.g. to put a Node 24 on PATH. */\n  commandPrefix?: string;\n  /**\n   * Candidate files investigated per run. deepsec keeps state, so successive\n   * scans continue where the last one stopped; the cap keeps one run inside\n   * the deployment's time limit on large repositories. Defaults to 40.\n   */\n  filesPerRun?: number;\n}\n\n/** Sandbox and trusted command that may temporarily receive a model credential. */\nexport interface DeepsecCredentialCommandInput<S extends CommandSandbox = CommandSandbox> {\n  sandbox: S;\n  command: string;\n}\n\n/** Captured output from one Deepsec sandbox command. */\nexport type DeepsecCommandResult = CommandSandboxRunResult;\n\n/** Machine-readable reason a Deepsec scan did not produce findings. */\nexport type DeepsecScanFailureCode =\n  | \"repository_not_found\"\n  | \"scan_failed\"\n  | \"process_failed\"\n  | \"invalid_export_json\"\n  | \"invalid_export_shape\";\n\n/** Bounded Deepsec refusal with a human-readable reason code payload. */\nexport interface DeepsecScanFailure {\n  scanned: false;\n  code: DeepsecScanFailureCode;\n  reason: string;\n}\n\n/** One normalized Deepsec finding and its admission outcome. */\nexport type DeepsecScanFinding = Pick<Finding, \"title\" | \"priority\" | \"path\" | \"line\"> &\n  (\n    | { duplicate: true; taskId?: never; approval?: never }\n    | { duplicate?: never; taskId: TaskId; approval: \"required\" | \"not_required\" }\n  );\n\n/** Counts and bounded finding summaries returned after a completed Deepsec scan. */\nexport interface DeepsecScanSuccess {\n  scanned: true;\n  tool: \"deepsec\";\n  found: number;\n  recorded: number;\n  duplicates: number;\n  awaitingApproval: number;\n  findings: readonly DeepsecScanFinding[];\n}\n\n/** Discriminated result returned by the optional Deepsec scanner tool. */\nexport type DeepsecScanResult = DeepsecScanFailure | DeepsecScanSuccess;\n\n/** Eve tool that runs one bounded Deepsec scan and admits its findings. */\nexport interface DeepsecScanTool extends ToolDefinition<DeepsecScanInput, DeepsecScanResult> {\n  execute(input: DeepsecScanInput, ctx: ToolContext): Promise<DeepsecScanResult>;\n}\n\nconst findingsPath = \"/tmp/deepsec-findings.json\";\n\n/** Parse \"N file(s) with candidates\" out of deepsec scan output; null when absent. */\nfunction candidateCount(output: string): number | null {\n  const match = /(\\d+)\\s+file\\(s\\) with candidates/u.exec(output);\n  return match?.[1] === undefined ? null : Number(match[1]);\n}\n\n/** The last few meaningful lines of a command's output, ANSI stripped, for a receipt. */\nfunction tail(output: string, lines = 4): string {\n  // oxlint-disable-next-line no-control-regex -- stripping terminal colour codes\n  const ansi = /\\u001b\\[[0-9;]*m/gu;\n  return output\n    .replaceAll(ansi, \"\")\n    .split(\"\\n\")\n    .map((line) => line.trim())\n    .filter((line) => line !== \"\")\n    .slice(-lines)\n    .join(\" | \")\n    .slice(0, 600);\n}\n\n/**\n * Runs deepsec (vercel-labs/deepsec) against the sandbox checkout and records\n * what it finds through the same path as record_finding, so every deepsec\n * finding becomes a fix task subject to the approval policy. Trusted code\n * owns the command sequence and the credential; the agent chooses when to\n * scan and reports the outcome.\n */\nexport function createDeepsecScanTool<S extends CommandSandbox>(\n  input: DeepsecScanToolOptions<S>,\n): DeepsecScanTool {\n  const { stores, ...options } = input;\n  const repoPath = options.repoPath ?? \"repo\";\n  const workspace = options.workspacePath ?? \"deepsec\";\n  const version = options.version ?? \"2.3.8\";\n  const agent = options.agent ?? \"claude\";\n  const model = options.model ?? \"claude-sonnet-4-6\";\n  const thinkingLevel = options.thinkingLevel ?? \"medium\";\n  const concurrency = options.concurrency ?? 4;\n  const prefix = options.commandPrefix === undefined ? [] : [options.commandPrefix];\n  const filesPerRun = options.filesPerRun ?? 40;\n  const now = options.now ?? Date.now;\n\n  return defineTool({\n    description:\n      \"Run deepsec, the AI-powered vulnerability scanner, over the repository checkout and record every finding it reports as a fix task. Takes minutes. Call once per scan; then summarize the result.\",\n    inputSchema: deepsecScanInputSchema,\n    async execute({ repositoryId, limit }, ctx): Promise<DeepsecScanResult> {\n      const repository = await stores.repositories.get(repositoryId);\n      if (repository === null) {\n        return {\n          scanned: false as const,\n          code: \"repository_not_found\",\n          reason: `repository ${repositoryId} does not exist`,\n        };\n      }\n      const sandbox = (await ctx.getSandbox()) as unknown as S;\n      const projectId = repository.slug.replace(/[^a-z0-9]+/gu, \"-\");\n      const startedAt = now();\n\n      // One receipt per phase, so the ledger answers \"where is the scan\" while\n      // deepsec runs and shows what each phase cost afterwards.\n      const phase = async (state: string, reason: string): Promise<void> => {\n        await stores.receipts.append({\n          repositoryIds: [repositoryId],\n          kind: \"deepsec\",\n          state,\n          phase: \"security_scan\",\n          reason: `${reason} (${Math.round((now() - startedAt) / 1000)}s in)`,\n        });\n      };\n      await phase(\"started\", `deepsec ${version} on ${repository.slug}, ${agent}/${model}`);\n\n      // Workspace: scaffolded once per sandbox, installed from npm. deepsec\n      // needs Node 24; the sandbox bootstrap is expected to provide it.\n      const prepare = await sandbox.run({\n        command: [\n          ...prefix,\n          \"set -e\",\n          `if [ ! -f ${workspace}/deepsec.config.ts ]; then`,\n          `  npx -y deepsec@${version} init ./${workspace} ./${repoPath} --id ${projectId} --scaffold-only --headless --yes --skip-install`,\n          `  (cd ${workspace} && npm install --no-audit --no-fund --loglevel=error)`,\n          \"fi\",\n          // deepsec resolves deepsec.config.ts from the current directory, so\n          // every deepsec command runs inside the workspace. No --root: it is a\n          // one-off override that skips the project's file records, leaving\n          // `process` with nothing to investigate.\n          `cd ${workspace}`,\n          `./node_modules/.bin/deepsec scan --project-id ${projectId}`,\n        ].join(\"\\n\"),\n      });\n      if (typeof prepare.exitCode === \"number\" && prepare.exitCode !== 0) {\n        const detail = (prepare.stderr ?? prepare.stdout).trim().slice(-1500);\n        await phase(\"failed\", `scan phase failed: ${detail.slice(-300)}`);\n        return {\n          scanned: false as const,\n          code: \"scan_failed\",\n          reason: `deepsec scan failed: ${detail}`,\n        };\n      }\n      const candidates = candidateCount(prepare.stdout);\n      await phase(\n        \"scanned\",\n        `${candidates === null ? \"scan output\" : `${candidates} files with candidates`}: ${tail(`${prepare.stdout}\\n${prepare.stderr ?? \"\"}`)}`,\n      );\n\n      // Investigation talks to the model through the AI Gateway (deepsec's\n      // default route); this is the only step that needs a credential.\n      const investigate = await options.withModelCredential({\n        sandbox,\n        command: [\n          ...prefix,\n          \"set -e\",\n          `cd ${workspace}`,\n          `./node_modules/.bin/deepsec process --project-id ${projectId} --agent ${agent} --model ${model} --thinking-level ${thinkingLevel} --concurrency ${concurrency} --limit ${limit ?? filesPerRun}`,\n          `./node_modules/.bin/deepsec export --project-id ${projectId} --format json --out ${findingsPath}`,\n        ].join(\"\\n\"),\n      });\n      if (typeof investigate.exitCode === \"number\" && investigate.exitCode !== 0) {\n        const detail = (investigate.stderr ?? investigate.stdout).trim().slice(-1500);\n        await phase(\"failed\", `process phase failed: ${detail.slice(-300)}`);\n        return {\n          scanned: false as const,\n          code: \"process_failed\",\n          reason: `deepsec process failed: ${detail}`,\n        };\n      }\n\n      const exported = await sandbox.run({ command: `cat ${findingsPath}` });\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(exported.stdout);\n      } catch {\n        return {\n          scanned: false as const,\n          code: \"invalid_export_json\",\n          reason: \"deepsec export was not valid JSON\",\n        };\n      }\n      const raw = deepsecExportSchema.safeParse(parsed);\n      if (!raw.success) {\n        return {\n          scanned: false as const,\n          code: \"invalid_export_shape\",\n          reason: `deepsec export had an unexpected shape: ${raw.error.issues[0]?.message ?? \"unknown\"}`,\n        };\n      }\n\n      const results: { finding: Finding; result: AdmitFindingResult }[] = [];\n      const taskId = optionalTaskIdForSession(ctx.session.auth.initiator);\n      const scan = taskId === null ? null : await stores.tasks.get(taskId);\n      const replyTo =\n        scan?.replyTo.channel === \"slack\" && scan.repositoryIds.includes(repositoryId)\n          ? scan.replyTo\n          : options.replyTo;\n      for (const entry of raw.data) {\n        const finding = findingFromDeepsec(entry);\n        results.push({\n          finding,\n          result: await admitFinding(stores, {\n            repositoryId,\n            finding,\n            ...options,\n            replyTo,\n          }),\n        });\n      }\n      const recorded = results.filter(({ result }) => result.recorded);\n      await phase(\n        \"completed\",\n        `${results.length} findings, ${recorded.length} new. process output: ${tail(`${investigate.stdout}\\n${investigate.stderr ?? \"\"}`, 6)}`,\n      );\n      return {\n        scanned: true as const,\n        tool: \"deepsec\",\n        found: results.length,\n        recorded: recorded.length,\n        duplicates: results.length - recorded.length,\n        awaitingApproval: recorded.filter(\n          ({ result }) => result.recorded && result.approval === \"required\",\n        ).length,\n        findings: results.map(({ finding, result }) => ({\n          title: finding.title,\n          priority: finding.priority,\n          path: finding.path,\n          line: finding.line,\n          ...(result.recorded\n            ? { taskId: result.taskId, approval: result.approval }\n            : { duplicate: true }),\n        })),\n      };\n    },\n  });\n}\n"],"mappings":";;;;;;;;AA4BA,MAAa,yBAAyB,EAAE,OAAO;CAC7C,cAAc;CACd,OAAO,EACJ,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,SAAS,CAAC,CACV,SACC,oGACF;AACJ,CAAC;AA8FD,MAAM,eAAe;;AAGrB,SAAS,eAAe,QAA+B;CACrD,MAAM,QAAQ,qCAAqC,KAAK,MAAM;CAC9D,OAAO,QAAQ,OAAO,KAAA,IAAY,OAAO,OAAO,MAAM,EAAE;AAC1D;;AAGA,SAAS,KAAK,QAAgB,QAAQ,GAAW;CAG/C,OAAO,OACJ,WAAW,sBAAM,EAAE,CAAC,CACpB,MAAM,IAAI,CAAC,CACX,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QAAQ,SAAS,SAAS,EAAE,CAAC,CAC7B,MAAM,CAAC,KAAK,CAAC,CACb,KAAK,KAAK,CAAC,CACX,MAAM,GAAG,GAAG;AACjB;;;;;;;;AASA,SAAgB,sBACd,OACiB;CACjB,MAAM,EAAE,QAAQ,GAAG,YAAY;CAC/B,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,YAAY,QAAQ,iBAAiB;CAC3C,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,SAAS,QAAQ,kBAAkB,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ,aAAa;CAChF,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,MAAM,QAAQ,OAAO,KAAK;CAEhC,OAAO,WAAW;EAChB,aACE;EACF,aAAa;EACb,MAAM,QAAQ,EAAE,cAAc,SAAS,KAAiC;GACtE,MAAM,aAAa,MAAM,OAAO,aAAa,IAAI,YAAY;GAC7D,IAAI,eAAe,MACjB,OAAO;IACL,SAAS;IACT,MAAM;IACN,QAAQ,cAAc,aAAa;GACrC;GAEF,MAAM,UAAW,MAAM,IAAI,WAAW;GACtC,MAAM,YAAY,WAAW,KAAK,QAAQ,gBAAgB,GAAG;GAC7D,MAAM,YAAY,IAAI;GAItB,MAAM,QAAQ,OAAO,OAAe,WAAkC;IACpE,MAAM,OAAO,SAAS,OAAO;KAC3B,eAAe,CAAC,YAAY;KAC5B,MAAM;KACN;KACA,OAAO;KACP,QAAQ,GAAG,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,aAAa,GAAI,EAAE;IAC/D,CAAC;GACH;GACA,MAAM,MAAM,WAAW,WAAW,QAAQ,MAAM,WAAW,KAAK,IAAI,MAAM,GAAG,OAAO;GAIpF,MAAM,UAAU,MAAM,QAAQ,IAAI,EAChC,SAAS;IACP,GAAG;IACH;IACA,aAAa,UAAU;IACvB,oBAAoB,QAAQ,UAAU,UAAU,KAAK,SAAS,QAAQ,UAAU;IAChF,SAAS,UAAU;IACnB;IAKA,MAAM;IACN,iDAAiD;GACnD,CAAC,CAAC,KAAK,IAAI,EACb,CAAC;GACD,IAAI,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa,GAAG;IAClE,MAAM,UAAU,QAAQ,UAAU,QAAQ,OAAA,CAAQ,KAAK,CAAC,CAAC,MAAM,KAAK;IACpE,MAAM,MAAM,UAAU,sBAAsB,OAAO,MAAM,IAAI,GAAG;IAChE,OAAO;KACL,SAAS;KACT,MAAM;KACN,QAAQ,wBAAwB;IAClC;GACF;GACA,MAAM,aAAa,eAAe,QAAQ,MAAM;GAChD,MAAM,MACJ,WACA,GAAG,eAAe,OAAO,gBAAgB,GAAG,WAAW,wBAAwB,IAAI,KAAK,GAAG,QAAQ,OAAO,IAAI,QAAQ,UAAU,IAAI,GACtI;GAIA,MAAM,cAAc,MAAM,QAAQ,oBAAoB;IACpD;IACA,SAAS;KACP,GAAG;KACH;KACA,MAAM;KACN,oDAAoD,UAAU,WAAW,MAAM,WAAW,MAAM,oBAAoB,cAAc,iBAAiB,YAAY,WAAW,SAAS;KACnL,mDAAmD,UAAU,uBAAuB;IACtF,CAAC,CAAC,KAAK,IAAI;GACb,CAAC;GACD,IAAI,OAAO,YAAY,aAAa,YAAY,YAAY,aAAa,GAAG;IAC1E,MAAM,UAAU,YAAY,UAAU,YAAY,OAAA,CAAQ,KAAK,CAAC,CAAC,MAAM,KAAK;IAC5E,MAAM,MAAM,UAAU,yBAAyB,OAAO,MAAM,IAAI,GAAG;IACnE,OAAO;KACL,SAAS;KACT,MAAM;KACN,QAAQ,2BAA2B;IACrC;GACF;GAEA,MAAM,WAAW,MAAM,QAAQ,IAAI,EAAE,SAAS,OAAO,eAAe,CAAC;GACrE,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,SAAS,MAAM;GACrC,QAAQ;IACN,OAAO;KACL,SAAS;KACT,MAAM;KACN,QAAQ;IACV;GACF;GACA,MAAM,MAAM,oBAAoB,UAAU,MAAM;GAChD,IAAI,CAAC,IAAI,SACP,OAAO;IACL,SAAS;IACT,MAAM;IACN,QAAQ,2CAA2C,IAAI,MAAM,OAAO,EAAE,EAAE,WAAW;GACrF;GAGF,MAAM,UAA8D,CAAC;GACrE,MAAM,SAAS,yBAAyB,IAAI,QAAQ,KAAK,SAAS;GAClE,MAAM,OAAO,WAAW,OAAO,OAAO,MAAM,OAAO,MAAM,IAAI,MAAM;GACnE,MAAM,UACJ,MAAM,QAAQ,YAAY,WAAW,KAAK,cAAc,SAAS,YAAY,IACzE,KAAK,UACL,QAAQ;GACd,KAAK,MAAM,SAAS,IAAI,MAAM;IAC5B,MAAM,UAAU,mBAAmB,KAAK;IACxC,QAAQ,KAAK;KACX;KACA,QAAQ,MAAM,aAAa,QAAQ;MACjC;MACA;MACA,GAAG;MACH;KACF,CAAC;IACH,CAAC;GACH;GACA,MAAM,WAAW,QAAQ,QAAQ,EAAE,aAAa,OAAO,QAAQ;GAC/D,MAAM,MACJ,aACA,GAAG,QAAQ,OAAO,aAAa,SAAS,OAAO,wBAAwB,KAAK,GAAG,YAAY,OAAO,IAAI,YAAY,UAAU,MAAM,CAAC,GACrI;GACA,OAAO;IACL,SAAS;IACT,MAAM;IACN,OAAO,QAAQ;IACf,UAAU,SAAS;IACnB,YAAY,QAAQ,SAAS,SAAS;IACtC,kBAAkB,SAAS,QACxB,EAAE,aAAa,OAAO,YAAY,OAAO,aAAa,UACzD,CAAC,CAAC;IACF,UAAU,QAAQ,KAAK,EAAE,SAAS,cAAc;KAC9C,OAAO,QAAQ;KACf,UAAU,QAAQ;KAClB,MAAM,QAAQ;KACd,MAAM,QAAQ;KACd,GAAI,OAAO,WACP;MAAE,QAAQ,OAAO;MAAQ,UAAU,OAAO;KAAS,IACnD,EAAE,WAAW,KAAK;IACxB,EAAE;GACJ;EACF;CACF,CAAC;AACH"}

package/dist/deepsec/finding.d.mts

@@ -0,0 +1,84 @@
+import { Finding } from "../schema/finding.mjs";
+import { z } from "zod";
+//#region src/deepsec/finding.d.ts
+/** Deepsec's exported finding shape, as far as Factory depends on it. */
+declare const deepsecFindingSchema: z.ZodReadonly<z.ZodObject<{
+  title: z.ZodString;
+  description: z.ZodString;
+  severity: z.ZodString;
+  metadata: z.ZodOptional<z.ZodObject<{
+    filePath: z.ZodOptional<z.ZodString>;
+    lineNumbers: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodNumber>>>;
+    vulnSlug: z.ZodOptional<z.ZodString>;
+    confidence: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+  }, z.core.$loose>>;
+}, z.core.$loose>>;
+/** Deepsec export document accepted by the optional scanner adapter. */
+declare const deepsecExportSchema: z.ZodUnion<readonly [z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+  title: z.ZodString;
+  description: z.ZodString;
+  severity: z.ZodString;
+  metadata: z.ZodOptional<z.ZodObject<{
+    filePath: z.ZodOptional<z.ZodString>;
+    lineNumbers: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodNumber>>>;
+    vulnSlug: z.ZodOptional<z.ZodString>;
+    confidence: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+  }, z.core.$loose>>;
+}, z.core.$loose>>>>, z.ZodPipe<z.ZodObject<{
+  findings: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+    title: z.ZodString;
+    description: z.ZodString;
+    severity: z.ZodString;
+    metadata: z.ZodOptional<z.ZodObject<{
+      filePath: z.ZodOptional<z.ZodString>;
+      lineNumbers: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodNumber>>>;
+      vulnSlug: z.ZodOptional<z.ZodString>;
+      confidence: z.ZodOptional<z.ZodString>;
+      runId: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+  }, z.core.$loose>>>>;
+}, z.core.$loose>, z.ZodTransform<readonly Readonly<{
+  [x: string]: unknown;
+  title: string;
+  description: string;
+  severity: string;
+  metadata?: {
+    [x: string]: unknown;
+    filePath?: string | undefined;
+    lineNumbers?: readonly number[] | undefined;
+    vulnSlug?: string | undefined;
+    confidence?: string | undefined;
+    runId?: string | undefined;
+  } | undefined;
+}>[], {
+  [x: string]: unknown;
+  findings: readonly Readonly<{
+    [x: string]: unknown;
+    title: string;
+    description: string;
+    severity: string;
+    metadata?: {
+      [x: string]: unknown;
+      filePath?: string | undefined;
+      lineNumbers?: readonly number[] | undefined;
+      vulnSlug?: string | undefined;
+      confidence?: string | undefined;
+      runId?: string | undefined;
+    } | undefined;
+  }>[];
+}>>]>;
+/** Provider payload accepted for one Deepsec finding before normalization. */
+type DeepsecFindingInput = z.input<typeof deepsecFindingSchema>;
+/** Parsed Deepsec finding payload used by the normalization adapter. */
+type DeepsecFinding = z.output<typeof deepsecFindingSchema>;
+/** Provider export document accepted before its wrapper is normalized. */
+type DeepsecExportInput = z.input<typeof deepsecExportSchema>;
+/** Parsed list of Deepsec findings produced by the export schema. */
+type DeepsecExport = z.output<typeof deepsecExportSchema>;
+/** Validate and convert one Deepsec finding into Factory's normalized Finding contract. */
+declare function findingFromDeepsec(input: DeepsecFindingInput): Finding;
+//#endregion
+export { DeepsecExport, DeepsecExportInput, DeepsecFinding, DeepsecFindingInput, deepsecExportSchema, deepsecFindingSchema, findingFromDeepsec };
+//# sourceMappingURL=finding.d.mts.map

package/dist/deepsec/finding.mjs

@@ -0,0 +1,56 @@
+import { findingSchema } from "../schema/finding.mjs";
+import { z } from "zod";
+//#region src/deepsec/finding.ts
+/** Deepsec's exported finding shape, as far as Factory depends on it. */
+const deepsecFindingSchema = z.looseObject({
+	title: z.string().min(1),
+	description: z.string().min(1),
+	severity: z.string().min(1),
+	metadata: z.looseObject({
+		filePath: z.string().min(1).optional(),
+		lineNumbers: z.array(z.number().int().min(1)).readonly().optional(),
+		vulnSlug: z.string().min(1).optional(),
+		confidence: z.string().optional(),
+		runId: z.string().optional()
+	}).optional()
+}).readonly();
+const deepsecFindingsSchema = z.array(deepsecFindingSchema).readonly();
+/** Deepsec export document accepted by the optional scanner adapter. */
+const deepsecExportSchema = z.union([deepsecFindingsSchema, z.looseObject({ findings: deepsecFindingsSchema }).transform((value) => value.findings)]);
+const priorityBySeverity = {
+	CRITICAL: "P0",
+	HIGH: "P1",
+	MEDIUM: "P2",
+	HIGH_BUG: "P2",
+	BUG: "P3",
+	LOW: "P3"
+};
+/** Validate and convert one Deepsec finding into Factory's normalized Finding contract. */
+function findingFromDeepsec(input) {
+	const raw = deepsecFindingSchema.parse(input);
+	const meta = raw.metadata ?? {};
+	const confidence = (meta.confidence ?? "").toLowerCase();
+	const line = meta.lineNumbers?.[0];
+	const endLine = meta.lineNumbers === void 0 ? void 0 : Math.max(...meta.lineNumbers);
+	return findingSchema.parse({
+		title: raw.title.replace(/^\[[A-Z_]+\]\s*/u, "").slice(0, 200),
+		body: raw.description.slice(0, 8e3),
+		...meta.filePath === void 0 ? {} : { path: meta.filePath.slice(0, 500) },
+		...line === void 0 ? {} : { line },
+		...endLine === void 0 || endLine === line ? {} : { endLine },
+		priority: priorityBySeverity[raw.severity.toUpperCase()] ?? "P3",
+		category: "security",
+		verification: {
+			level: confidence === "high" ? "supported" : "unverified",
+			method: "static_analysis",
+			summary: `deepsec ${meta.vulnSlug ?? "finding"} with ${confidence || "unknown"} confidence${meta.runId === void 0 ? "" : ` (run ${meta.runId})`}.`,
+			limitations: "AI-assisted static analysis of the checkout; not reproduced at runtime."
+		},
+		tool: "deepsec",
+		...meta.vulnSlug === void 0 ? {} : { ruleId: meta.vulnSlug }
+	});
+}
+//#endregion
+export { deepsecExportSchema, deepsecFindingSchema, findingFromDeepsec };
+
+//# sourceMappingURL=finding.mjs.map

package/dist/deepsec/finding.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.mjs","names":[],"sources":["../../src/deepsec/finding.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { findingSchema, type Finding, type FindingPriority } from \"../schema/finding\";\n\n/** Deepsec's exported finding shape, as far as Factory depends on it. */\nexport const deepsecFindingSchema = z\n  .looseObject({\n    title: z.string().min(1),\n    description: z.string().min(1),\n    severity: z.string().min(1),\n    metadata: z\n      .looseObject({\n        filePath: z.string().min(1).optional(),\n        lineNumbers: z.array(z.number().int().min(1)).readonly().optional(),\n        vulnSlug: z.string().min(1).optional(),\n        confidence: z.string().optional(),\n        runId: z.string().optional(),\n      })\n      .optional(),\n  })\n  .readonly();\n\nconst deepsecFindingsSchema = z.array(deepsecFindingSchema).readonly();\n\n/** Deepsec export document accepted by the optional scanner adapter. */\nexport const deepsecExportSchema = z.union([\n  deepsecFindingsSchema,\n  z.looseObject({ findings: deepsecFindingsSchema }).transform((value) => value.findings),\n]);\n\n/** Provider payload accepted for one Deepsec finding before normalization. */\nexport type DeepsecFindingInput = z.input<typeof deepsecFindingSchema>;\n\n/** Parsed Deepsec finding payload used by the normalization adapter. */\nexport type DeepsecFinding = z.output<typeof deepsecFindingSchema>;\n\n/** Provider export document accepted before its wrapper is normalized. */\nexport type DeepsecExportInput = z.input<typeof deepsecExportSchema>;\n\n/** Parsed list of Deepsec findings produced by the export schema. */\nexport type DeepsecExport = z.output<typeof deepsecExportSchema>;\n\nconst priorityBySeverity: Record<string, FindingPriority> = {\n  CRITICAL: \"P0\",\n  HIGH: \"P1\",\n  MEDIUM: \"P2\",\n  HIGH_BUG: \"P2\",\n  BUG: \"P3\",\n  LOW: \"P3\",\n};\n\n/** Validate and convert one Deepsec finding into Factory's normalized Finding contract. */\nexport function findingFromDeepsec(input: DeepsecFindingInput): Finding {\n  const raw = deepsecFindingSchema.parse(input);\n  const meta = raw.metadata ?? {};\n  const confidence = (meta.confidence ?? \"\").toLowerCase();\n  const line = meta.lineNumbers?.[0];\n  const endLine = meta.lineNumbers === undefined ? undefined : Math.max(...meta.lineNumbers);\n  return findingSchema.parse({\n    title: raw.title.replace(/^\\[[A-Z_]+\\]\\s*/u, \"\").slice(0, 200),\n    body: raw.description.slice(0, 8000),\n    ...(meta.filePath === undefined ? {} : { path: meta.filePath.slice(0, 500) }),\n    ...(line === undefined ? {} : { line }),\n    ...(endLine === undefined || endLine === line ? {} : { endLine }),\n    priority: priorityBySeverity[raw.severity.toUpperCase()] ?? \"P3\",\n    category: \"security\",\n    verification: {\n      level: confidence === \"high\" ? \"supported\" : \"unverified\",\n      method: \"static_analysis\",\n      summary: `deepsec ${meta.vulnSlug ?? \"finding\"} with ${confidence || \"unknown\"} confidence${meta.runId === undefined ? \"\" : ` (run ${meta.runId})`}.`,\n      limitations: \"AI-assisted static analysis of the checkout; not reproduced at runtime.\",\n    },\n    tool: \"deepsec\",\n    ...(meta.vulnSlug === undefined ? {} : { ruleId: meta.vulnSlug }),\n  });\n}\n"],"mappings":";;;;AAIA,MAAa,uBAAuB,EACjC,YAAY;CACX,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC7B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,UAAU,EACP,YAAY;EACX,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;EACrC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EAClE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;EACrC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;EAChC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,CAAC,CAAC,CACD,SAAS;AACd,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,wBAAwB,EAAE,MAAM,oBAAoB,CAAC,CAAC,SAAS;;AAGrE,MAAa,sBAAsB,EAAE,MAAM,CACzC,uBACA,EAAE,YAAY,EAAE,UAAU,sBAAsB,CAAC,CAAC,CAAC,WAAW,UAAU,MAAM,QAAQ,CACxF,CAAC;AAcD,MAAM,qBAAsD;CAC1D,UAAU;CACV,MAAM;CACN,QAAQ;CACR,UAAU;CACV,KAAK;CACL,KAAK;AACP;;AAGA,SAAgB,mBAAmB,OAAqC;CACtE,MAAM,MAAM,qBAAqB,MAAM,KAAK;CAC5C,MAAM,OAAO,IAAI,YAAY,CAAC;CAC9B,MAAM,cAAc,KAAK,cAAc,GAAA,CAAI,YAAY;CACvD,MAAM,OAAO,KAAK,cAAc;CAChC,MAAM,UAAU,KAAK,gBAAgB,KAAA,IAAY,KAAA,IAAY,KAAK,IAAI,GAAG,KAAK,WAAW;CACzF,OAAO,cAAc,MAAM;EACzB,OAAO,IAAI,MAAM,QAAQ,oBAAoB,EAAE,CAAC,CAAC,MAAM,GAAG,GAAG;EAC7D,MAAM,IAAI,YAAY,MAAM,GAAG,GAAI;EACnC,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,GAAG,GAAG,EAAE;EAC3E,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;EACrC,GAAI,YAAY,KAAA,KAAa,YAAY,OAAO,CAAC,IAAI,EAAE,QAAQ;EAC/D,UAAU,mBAAmB,IAAI,SAAS,YAAY,MAAM;EAC5D,UAAU;EACV,cAAc;GACZ,OAAO,eAAe,SAAS,cAAc;GAC7C,QAAQ;GACR,SAAS,WAAW,KAAK,YAAY,UAAU,QAAQ,cAAc,UAAU,aAAa,KAAK,UAAU,KAAA,IAAY,KAAK,SAAS,KAAK,MAAM,GAAG;GACnJ,aAAa;EACf;EACA,MAAM;EACN,GAAI,KAAK,aAAa,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,KAAK,SAAS;CACjE,CAAC;AACH"}

package/dist/deepsec.d.mts

@@ -0,0 +1,3 @@
+import { DeepsecExport, DeepsecExportInput, DeepsecFinding, DeepsecFindingInput, deepsecExportSchema, deepsecFindingSchema, findingFromDeepsec } from "./deepsec/finding.mjs";
+import { DeepsecAgent, DeepsecCommandResult, DeepsecCredentialCommandInput, DeepsecScanFailure, DeepsecScanFailureCode, DeepsecScanFinding, DeepsecScanInput, DeepsecScanResult, DeepsecScanSuccess, DeepsecScanTool, DeepsecScanToolOptions, DeepsecScanToolStores, DeepsecThinkingLevel, createDeepsecScanTool, deepsecScanInputSchema } from "./deepsec/eve-tool.mjs";
+export { type DeepsecAgent, type DeepsecCommandResult, type DeepsecCredentialCommandInput, type DeepsecExport, type DeepsecExportInput, type DeepsecFinding, type DeepsecFindingInput, type DeepsecScanFailure, type DeepsecScanFailureCode, type DeepsecScanFinding, type DeepsecScanInput, type DeepsecScanResult, type DeepsecScanSuccess, type DeepsecScanTool, type DeepsecScanToolOptions, type DeepsecScanToolStores, type DeepsecThinkingLevel, createDeepsecScanTool, deepsecExportSchema, deepsecFindingSchema, deepsecScanInputSchema, findingFromDeepsec };

package/dist/delivery-metrics/metrics.d.mts

@@ -0,0 +1,93 @@
+import { Signal } from "../schema/signal.mjs";
+import { Task } from "../schema/task.mjs";
+import { TaskGraph } from "../schema/task-graph.mjs";
+import { Change, ChangeLevel } from "../schema/change.mjs";
+import { Receipt } from "../schema/receipt.mjs";
+//#region src/delivery-metrics/metrics.d.ts
+/**
+ * The derived review bucket from the default risk x confidence table. Derived
+ * at read time, never stored; "blocked" is a bucket, not a change state.
+ */
+type ChangeReviewBucket = "stamp" | "review" | "blocked";
+/** Risk and confidence inputs used to derive a human-review bucket. */
+interface ChangeReviewFactors {
+  risk: ChangeLevel;
+  confidence: ChangeLevel;
+}
+/** Derives the default human-review bucket from a change's risk and confidence. */
+declare function changeReviewBucket(input: ChangeReviewFactors): ChangeReviewBucket;
+/** Validated ledger rows used to derive Factory metrics and health. */
+interface DeliveryLedgerRows {
+  changes: readonly Change[];
+  signals: readonly Signal[];
+  receipts: readonly Receipt[];
+  tasks: readonly Task[];
+  /** Validated graph snapshots keyed by rootTaskId. Missing snapshots make health yellow, never runnable. */
+  graphs?: ReadonlyMap<string, TaskGraph>;
+}
+/** Options controlling ledger metric evaluation. */
+interface ComputeLedgerMetricsOptions {
+  /** Evaluation time; defaults to the current time. */
+  now?: Date;
+  /** Days a landed change must hold without a rollback. Default 7. */
+  holdDays?: number;
+}
+/** Product metrics derived deterministically from ledger rows. */
+interface DeliveryMetrics {
+  /**
+   * Changes a human merged that reached deployed (rolled_out for high risk)
+   * and did not roll back within the hold window. Includes provisional ones.
+   */
+  landed: number;
+  /** Landed changes still inside the hold window; the number may drop. */
+  provisional: number;
+  /** landed / (landed + rolled back + closed after ready). Null when nothing decided. */
+  stickRate: number | null;
+  /**
+   * Not computable from ledger rows: needs a record of human commits pushed
+   * to the pull request after ready, which nothing writes today.
+   */
+  stampedClean: null;
+  /** Median ms from the ready receipt to the merged receipt, per review bucket. */
+  humanTimeMs: {
+    stamp: number | null;
+    review: number | null;
+  };
+  /** Sum of settled task cost over landed changes / landed. Null until budgets settle. */
+  costPerLandedUsd: number | null;
+  /** Signals triage turned away plus changes closed in verification. */
+  filtered: number;
+}
+/**
+ * The six product metrics from ledger rows alone. One rule governs them: a
+ * change counts only after a human merged it and it stayed. Activity that
+ * never landed is not a result. Compute over rows already filtered to the
+ * period and repositories you are reporting on.
+ */
+declare function computeLedgerMetrics(rows: DeliveryLedgerRows, options?: ComputeLedgerMetricsOptions): DeliveryMetrics;
+/** Overall repository health severity derived from operational evidence. */
+type RepositoryHealthColor = "green" | "yellow" | "red";
+/** Options controlling repository health evaluation. */
+interface ComputeRepositoryHealthOptions {
+  now?: Date;
+  /** Open-change cap from factory configuration; omitted disables that check. */
+  maxOpenChanges?: number;
+  /** Minutes an eligible executable task may remain queued before health turns yellow. Default 5. */
+  maxQueuedMinutes?: number;
+}
+/** Explainable repository health derived from ledger and graph state. */
+interface RepositoryHealth {
+  readonly color: RepositoryHealthColor;
+  /** Every rule that fired, so the color is explainable from rows. */
+  readonly reasons: readonly string[];
+}
+/**
+ * Green, yellow, or red from rows, never from a model. Budget threshold and
+ * onboarding rules are not evaluated here yet: budget notices live on the
+ * budgets collection (not in these rows), and onboarding investigations are
+ * not recorded.
+ */
+declare function computeRepositoryHealth(rows: DeliveryLedgerRows, options?: ComputeRepositoryHealthOptions): RepositoryHealth;
+//#endregion
+export { ChangeReviewBucket, ChangeReviewFactors, ComputeLedgerMetricsOptions, ComputeRepositoryHealthOptions, DeliveryLedgerRows, DeliveryMetrics, RepositoryHealth, RepositoryHealthColor, changeReviewBucket, computeLedgerMetrics, computeRepositoryHealth };
+//# sourceMappingURL=metrics.d.mts.map