@vercel/factory 0.0.13 → 0.0.15

package/dist/schema/execution.d.mts

@@ -0,0 +1,101 @@
+import { TaskId } from "./id.mjs";
+import { Task } from "./task.mjs";
+import { z } from "zod";
+//#region src/schema/execution.d.ts
+/** Validates a durable evidence reference returned by an execution provider. */
+declare const executionArtifactSchema: z.ZodObject<{
+  kind: z.ZodEnum<{
+    patch: "patch";
+    report: "report";
+    log: "log";
+  }>;
+  ref: z.ZodString;
+}, z.core.$strict>;
+/** Validates a Task identity paired with its positive execution-attempt fence. */
+declare const taskAttemptRefSchema: z.ZodReadonly<z.ZodObject<{
+  taskId: z.ZodType<`task_${string}`, string, z.core.$ZodTypeInternals<`task_${string}`, string>>;
+  attempt: z.ZodNumber;
+}, z.core.$strict>>;
+/** Stable provider idempotency key derived from one exact Task attempt. */
+type ExecutionLaunchKey = `factory-task:${TaskId}:${number}`;
+/** Validates the stable provider idempotency key for one exact Task attempt. */
+declare const executionLaunchKeySchema: z.ZodType<ExecutionLaunchKey, string>;
+/** Validates the immutable, bounded coding request captured before provider execution. */
+declare const codingExecutionRequestSchema: z.ZodObject<{
+  repository: z.ZodObject<{
+    slug: z.ZodType<`${string}/${string}`, string, z.core.$ZodTypeInternals<`${string}/${string}`, string>>;
+    baseSha: z.ZodString;
+  }, z.core.$strict>;
+  harness: z.ZodEnum<{
+    "claude-code": "claude-code";
+    codex: "codex";
+    fx: "fx";
+    pi: "pi";
+  }>;
+  prompt: z.ZodString;
+  allowedConstructs: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+  environment: z.ZodObject<{
+    snapshotId: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodNumber;
+  }, z.core.$strict>;
+  limits: z.ZodObject<{
+    maxTokens: z.ZodOptional<z.ZodNumber>;
+    maxCostUsd: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>;
+  taskId: z.ZodType<`task_${string}`, string, z.core.$ZodTypeInternals<`task_${string}`, string>>;
+  attempt: z.ZodNumber;
+}, z.core.$strict>;
+declare const executionResultFieldsSchema: z.ZodObject<{
+  execution: z.ZodObject<{
+    provider: z.ZodString;
+    sessionId: z.ZodString;
+    environmentId: z.ZodOptional<z.ZodString>;
+    harness: z.ZodOptional<z.ZodString>;
+    traceId: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>;
+  artifacts: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+    kind: z.ZodEnum<{
+      patch: "patch";
+      report: "report";
+      log: "log";
+    }>;
+    ref: z.ZodString;
+  }, z.core.$strict>>>;
+  usage: z.ZodObject<{
+    inputTokens: z.ZodOptional<z.ZodNumber>;
+    outputTokens: z.ZodOptional<z.ZodNumber>;
+    computeMs: z.ZodNumber;
+    costUsd: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>;
+  reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type ExecutionResultFields = z.infer<typeof executionResultFieldsSchema>;
+/** Provider outcome, evidence references, and cumulative usage for one execution attempt. */
+type ExecutionResult = ExecutionResultFields & ({
+  status: "completed";
+  failureCode?: never;
+} | {
+  status: "needs_input";
+  failureCode?: never;
+} | {
+  status: "cancelled";
+  failureCode?: never;
+} | {
+  status: "failed";
+  failureCode?: "missing_output";
+});
+/** Validates a provider outcome and cumulative usage without inferring Task success. */
+declare const executionResultSchema: z.ZodType<ExecutionResult>;
+/** Task identity and attempt fence used by execution operations and launch keys. */
+type TaskAttemptRef = z.infer<typeof taskAttemptRefSchema>;
+/** Constructs and validates a Task identity with its positive execution-attempt fence. */
+declare function taskAttemptRef(taskId: TaskAttemptRef["taskId"], attempt: number): TaskAttemptRef;
+/** Converts a Task-shaped value into the canonical Task identity and attempt fence. */
+declare function taskAttemptRefFromTask(task: Pick<Task, "id" | "attempt">): TaskAttemptRef;
+/** Immutable repository, harness, capability, environment, and limit request for one coding Task attempt. */
+type CodingExecutionRequest = z.infer<typeof codingExecutionRequestSchema>;
+/** Durable evidence reference returned by an execution provider. */
+type ExecutionArtifact = z.infer<typeof executionArtifactSchema>;
+//#endregion
+export { CodingExecutionRequest, ExecutionArtifact, ExecutionLaunchKey, ExecutionResult, TaskAttemptRef, codingExecutionRequestSchema, executionArtifactSchema, executionLaunchKeySchema, executionResultSchema, taskAttemptRef, taskAttemptRefFromTask, taskAttemptRefSchema };
+//# sourceMappingURL=execution.d.mts.map

package/dist/schema/execution.mjs

@@ -0,0 +1,86 @@
+import { taskIdSchema } from "./id.mjs";
+import { usdSchema } from "./common.mjs";
+import { repositorySlugSchema } from "./repository.mjs";
+import { jsonValueSchema } from "./work.mjs";
+import { executionReferenceSchema } from "./task.mjs";
+import { z } from "zod";
+//#region src/schema/execution.ts
+/** Validates a durable evidence reference returned by an execution provider. */
+const executionArtifactSchema = z.strictObject({
+	kind: z.enum([
+		"patch",
+		"report",
+		"log"
+	]).describe("Evidence artifact type."),
+	ref: z.string().min(1).max(2048).describe("Durable artifact reference; grants no read authority.")
+});
+const artifacts = z.array(executionArtifactSchema).max(32).readonly().describe("Bounded durable evidence references.");
+/** Validates a Task ID and execution-attempt fence that must travel together. */
+const taskAttemptRefFields = {
+	taskId: taskIdSchema.describe("Task that owns the operation."),
+	attempt: z.number().int().positive().describe("Current Task execution attempt.")
+};
+/** Validates a Task identity paired with its positive execution-attempt fence. */
+const taskAttemptRefSchema = z.strictObject(taskAttemptRefFields).readonly();
+/** Validates the stable provider idempotency key for one exact Task attempt. */
+const executionLaunchKeySchema = z.string().regex(/^factory-task:task_[a-z0-9]{6,64}:[1-9]\d*$/u, "Expected factory-task:<task-id>:<positive-attempt>");
+/** Validates the immutable, bounded coding request captured before provider execution. */
+const codingExecutionRequestSchema = z.strictObject({
+	...taskAttemptRefFields,
+	repository: z.strictObject({
+		slug: repositorySlugSchema,
+		baseSha: z.string().regex(/^[0-9a-f]{40}$/).describe("Immutable source commit to check out.")
+	}).describe("Explicit repository and immutable starting code."),
+	harness: z.enum([
+		"claude-code",
+		"codex",
+		"fx",
+		"pi"
+	]).describe("Configured V1 coding harness."),
+	prompt: z.string().min(1).max(32e3).describe("Bounded instructions captured before launching."),
+	allowedConstructs: z.array(z.string().min(1).max(128)).max(64).readonly().describe("Only the capabilities granted by the workflow."),
+	environment: z.strictObject({
+		snapshotId: z.string().min(1).max(2048).optional().describe("Optional immutable environment snapshot."),
+		timeoutMs: z.number().int().positive().describe("Maximum execution duration in milliseconds.")
+	}).describe("Reproducible environment policy."),
+	limits: z.strictObject({
+		maxTokens: z.number().int().positive().optional().describe("Maximum tokens for this execution."),
+		maxCostUsd: usdSchema.optional().describe("Maximum execution spend.")
+	}).describe("Adapter-enforced execution limits.")
+}).refine((value) => jsonValueSchema.safeParse(value).success, "Execution request must fit bounded work JSON");
+const executionResultFieldsSchema = z.strictObject({
+	execution: executionReferenceSchema,
+	artifacts,
+	usage: z.strictObject({
+		inputTokens: z.number().int().nonnegative().optional().describe("Total input tokens for this attempt."),
+		outputTokens: z.number().int().nonnegative().optional().describe("Total output tokens for this attempt."),
+		computeMs: z.number().int().nonnegative().describe("Observed compute duration."),
+		costUsd: usdSchema.optional().describe("Observed attempt cost; absent means unknown, never free.")
+	}).describe("Cumulative usage for this attempt, recorded once."),
+	reason: z.string().min(1).max(2e3).optional().describe("Human-readable outcome explanation.")
+});
+/** Validates a provider outcome and cumulative usage without inferring Task success. */
+const executionResultSchema = z.discriminatedUnion("status", [
+	executionResultFieldsSchema.extend({ status: z.literal("completed").describe("The provider completed its bounded execution.") }),
+	executionResultFieldsSchema.extend({ status: z.literal("needs_input").describe("The provider requires additional input.") }),
+	executionResultFieldsSchema.extend({ status: z.literal("cancelled").describe("The execution was cancelled.") }),
+	executionResultFieldsSchema.extend({
+		status: z.literal("failed").describe("The execution failed."),
+		failureCode: z.literal("missing_output").optional().describe("Required output was absent. Workflow policy, not this code, authorizes replacement.")
+	})
+]).refine((value) => jsonValueSchema.safeParse(value).success, "Execution result must fit bounded work JSON");
+/** Constructs and validates a Task identity with its positive execution-attempt fence. */
+function taskAttemptRef(taskId, attempt) {
+	return taskAttemptRefSchema.parse({
+		taskId,
+		attempt
+	});
+}
+/** Converts a Task-shaped value into the canonical Task identity and attempt fence. */
+function taskAttemptRefFromTask(task) {
+	return taskAttemptRef(task.id, task.attempt);
+}
+//#endregion
+export { codingExecutionRequestSchema, executionArtifactSchema, executionLaunchKeySchema, executionResultSchema, taskAttemptRef, taskAttemptRefFromTask, taskAttemptRefSchema };
+
+//# sourceMappingURL=execution.mjs.map

package/dist/schema/execution.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.mjs","names":[],"sources":["../../src/schema/execution.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { usdSchema } from \"./common\";\nimport { taskIdSchema, type TaskId } from \"./id\";\nimport { repositorySlugSchema } from \"./repository\";\nimport { jsonValueSchema } from \"./work\";\n\nimport { executionReferenceSchema } from \"./task\";\n\n/** Validates a durable evidence reference returned by an execution provider. */\nexport const executionArtifactSchema = z.strictObject({\n  kind: z.enum([\"patch\", \"report\", \"log\"]).describe(\"Evidence artifact type.\"),\n  ref: z\n    .string()\n    .min(1)\n    .max(2048)\n    .describe(\"Durable artifact reference; grants no read authority.\"),\n});\nconst artifacts = z\n  .array(executionArtifactSchema)\n  .max(32)\n  .readonly()\n  .describe(\"Bounded durable evidence references.\");\n/** Validates a Task ID and execution-attempt fence that must travel together. */\nconst taskAttemptRefFields = {\n  taskId: taskIdSchema.describe(\"Task that owns the operation.\"),\n  attempt: z.number().int().positive().describe(\"Current Task execution attempt.\"),\n} as const;\n/** Validates a Task identity paired with its positive execution-attempt fence. */\nexport const taskAttemptRefSchema = z.strictObject(taskAttemptRefFields).readonly();\n\n/** Stable provider idempotency key derived from one exact Task attempt. */\nexport type ExecutionLaunchKey = `factory-task:${TaskId}:${number}`;\n/** Validates the stable provider idempotency key for one exact Task attempt. */\nexport const executionLaunchKeySchema = z\n  .string()\n  .regex(\n    /^factory-task:task_[a-z0-9]{6,64}:[1-9]\\d*$/u,\n    \"Expected factory-task:<task-id>:<positive-attempt>\",\n  ) as z.ZodType<ExecutionLaunchKey, string>;\n\n/** Validates the immutable, bounded coding request captured before provider execution. */\nexport const codingExecutionRequestSchema = z\n  .strictObject({\n    ...taskAttemptRefFields,\n    repository: z\n      .strictObject({\n        slug: repositorySlugSchema,\n        baseSha: z\n          .string()\n          .regex(/^[0-9a-f]{40}$/)\n          .describe(\"Immutable source commit to check out.\"),\n      })\n      .describe(\"Explicit repository and immutable starting code.\"),\n    harness: z.enum([\"claude-code\", \"codex\", \"fx\", \"pi\"]).describe(\"Configured V1 coding harness.\"),\n    prompt: z\n      .string()\n      .min(1)\n      .max(32_000)\n      .describe(\"Bounded instructions captured before launching.\"),\n    allowedConstructs: z\n      .array(z.string().min(1).max(128))\n      .max(64)\n      .readonly()\n      .describe(\"Only the capabilities granted by the workflow.\"),\n    environment: z\n      .strictObject({\n        snapshotId: z\n          .string()\n          .min(1)\n          .max(2048)\n          .optional()\n          .describe(\"Optional immutable environment snapshot.\"),\n        timeoutMs: z\n          .number()\n          .int()\n          .positive()\n          .describe(\"Maximum execution duration in milliseconds.\"),\n      })\n      .describe(\"Reproducible environment policy.\"),\n    limits: z\n      .strictObject({\n        maxTokens: z\n          .number()\n          .int()\n          .positive()\n          .optional()\n          .describe(\"Maximum tokens for this execution.\"),\n        maxCostUsd: usdSchema.optional().describe(\"Maximum execution spend.\"),\n      })\n      .describe(\"Adapter-enforced execution limits.\"),\n  })\n  .refine(\n    (value) => jsonValueSchema.safeParse(value).success,\n    \"Execution request must fit bounded work JSON\",\n  );\n\nconst executionResultFieldsSchema = z.strictObject({\n  execution: executionReferenceSchema,\n  artifacts,\n  usage: z\n    .strictObject({\n      inputTokens: z\n        .number()\n        .int()\n        .nonnegative()\n        .optional()\n        .describe(\"Total input tokens for this attempt.\"),\n      outputTokens: z\n        .number()\n        .int()\n        .nonnegative()\n        .optional()\n        .describe(\"Total output tokens for this attempt.\"),\n      computeMs: z.number().int().nonnegative().describe(\"Observed compute duration.\"),\n      costUsd: usdSchema\n        .optional()\n        .describe(\"Observed attempt cost; absent means unknown, never free.\"),\n    })\n    .describe(\"Cumulative usage for this attempt, recorded once.\"),\n  reason: z.string().min(1).max(2000).optional().describe(\"Human-readable outcome explanation.\"),\n});\n\ntype ExecutionResultFields = z.infer<typeof executionResultFieldsSchema>;\n\n/** Provider outcome, evidence references, and cumulative usage for one execution attempt. */\nexport type ExecutionResult = ExecutionResultFields &\n  (\n    | { status: \"completed\"; failureCode?: never }\n    | { status: \"needs_input\"; failureCode?: never }\n    | { status: \"cancelled\"; failureCode?: never }\n    | { status: \"failed\"; failureCode?: \"missing_output\" }\n  );\n\n/** Validates a provider outcome and cumulative usage without inferring Task success. */\nexport const executionResultSchema = z\n  .discriminatedUnion(\"status\", [\n    executionResultFieldsSchema.extend({\n      status: z.literal(\"completed\").describe(\"The provider completed its bounded execution.\"),\n    }),\n    executionResultFieldsSchema.extend({\n      status: z.literal(\"needs_input\").describe(\"The provider requires additional input.\"),\n    }),\n    executionResultFieldsSchema.extend({\n      status: z.literal(\"cancelled\").describe(\"The execution was cancelled.\"),\n    }),\n    executionResultFieldsSchema.extend({\n      status: z.literal(\"failed\").describe(\"The execution failed.\"),\n      failureCode: z\n        .literal(\"missing_output\")\n        .optional()\n        .describe(\n          \"Required output was absent. Workflow policy, not this code, authorizes replacement.\",\n        ),\n    }),\n  ])\n  .refine(\n    (value) => jsonValueSchema.safeParse(value).success,\n    \"Execution result must fit bounded work JSON\",\n  ) as z.ZodType<ExecutionResult>;\n\n/** Task identity and attempt fence used by execution operations and launch keys. */\nexport type TaskAttemptRef = z.infer<typeof taskAttemptRefSchema>;\n/** Constructs and validates a Task identity with its positive execution-attempt fence. */\nexport function taskAttemptRef(taskId: TaskAttemptRef[\"taskId\"], attempt: number): TaskAttemptRef {\n  return taskAttemptRefSchema.parse({ taskId, attempt });\n}\n/** Converts a Task-shaped value into the canonical Task identity and attempt fence. */\nexport function taskAttemptRefFromTask(\n  task: Pick<import(\"./task\").Task, \"id\" | \"attempt\">,\n): TaskAttemptRef {\n  return taskAttemptRef(task.id, task.attempt);\n}\n/** Immutable repository, harness, capability, environment, and limit request for one coding Task attempt. */\nexport type CodingExecutionRequest = z.infer<typeof codingExecutionRequestSchema>;\n/** Durable evidence reference returned by an execution provider. */\nexport type ExecutionArtifact = z.infer<typeof executionArtifactSchema>;\n"],"mappings":";;;;;;;;AASA,MAAa,0BAA0B,EAAE,aAAa;CACpD,MAAM,EAAE,KAAK;EAAC;EAAS;EAAU;CAAK,CAAC,CAAC,CAAC,SAAS,yBAAyB;CAC3E,KAAK,EACF,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAI,CAAC,CACT,SAAS,uDAAuD;AACrE,CAAC;AACD,MAAM,YAAY,EACf,MAAM,uBAAuB,CAAC,CAC9B,IAAI,EAAE,CAAC,CACP,SAAS,CAAC,CACV,SAAS,sCAAsC;;AAElD,MAAM,uBAAuB;CAC3B,QAAQ,aAAa,SAAS,+BAA+B;CAC7D,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,iCAAiC;AACjF;;AAEA,MAAa,uBAAuB,EAAE,aAAa,oBAAoB,CAAC,CAAC,SAAS;;AAKlF,MAAa,2BAA2B,EACrC,OAAO,CAAC,CACR,MACC,gDACA,oDACF;;AAGF,MAAa,+BAA+B,EACzC,aAAa;CACZ,GAAG;CACH,YAAY,EACT,aAAa;EACZ,MAAM;EACN,SAAS,EACN,OAAO,CAAC,CACR,MAAM,gBAAgB,CAAC,CACvB,SAAS,uCAAuC;CACrD,CAAC,CAAC,CACD,SAAS,kDAAkD;CAC9D,SAAS,EAAE,KAAK;EAAC;EAAe;EAAS;EAAM;CAAI,CAAC,CAAC,CAAC,SAAS,+BAA+B;CAC9F,QAAQ,EACL,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAM,CAAC,CACX,SAAS,iDAAiD;CAC7D,mBAAmB,EAChB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CACjC,IAAI,EAAE,CAAC,CACP,SAAS,CAAC,CACV,SAAS,gDAAgD;CAC5D,aAAa,EACV,aAAa;EACZ,YAAY,EACT,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAI,CAAC,CACT,SAAS,CAAC,CACV,SAAS,0CAA0C;EACtD,WAAW,EACR,OAAO,CAAC,CACR,IAAI,CAAC,CACL,SAAS,CAAC,CACV,SAAS,6CAA6C;CAC3D,CAAC,CAAC,CACD,SAAS,kCAAkC;CAC9C,QAAQ,EACL,aAAa;EACZ,WAAW,EACR,OAAO,CAAC,CACR,IAAI,CAAC,CACL,SAAS,CAAC,CACV,SAAS,CAAC,CACV,SAAS,oCAAoC;EAChD,YAAY,UAAU,SAAS,CAAC,CAAC,SAAS,0BAA0B;CACtE,CAAC,CAAC,CACD,SAAS,oCAAoC;AAClD,CAAC,CAAC,CACD,QACE,UAAU,gBAAgB,UAAU,KAAK,CAAC,CAAC,SAC5C,8CACF;AAEF,MAAM,8BAA8B,EAAE,aAAa;CACjD,WAAW;CACX;CACA,OAAO,EACJ,aAAa;EACZ,aAAa,EACV,OAAO,CAAC,CACR,IAAI,CAAC,CACL,YAAY,CAAC,CACb,SAAS,CAAC,CACV,SAAS,sCAAsC;EAClD,cAAc,EACX,OAAO,CAAC,CACR,IAAI,CAAC,CACL,YAAY,CAAC,CACb,SAAS,CAAC,CACV,SAAS,uCAAuC;EACnD,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,4BAA4B;EAC/E,SAAS,UACN,SAAS,CAAC,CACV,SAAS,0DAA0D;CACxE,CAAC,CAAC,CACD,SAAS,mDAAmD;CAC/D,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,qCAAqC;AAC/F,CAAC;;AAcD,MAAa,wBAAwB,EAClC,mBAAmB,UAAU;CAC5B,4BAA4B,OAAO,EACjC,QAAQ,EAAE,QAAQ,WAAW,CAAC,CAAC,SAAS,+CAA+C,EACzF,CAAC;CACD,4BAA4B,OAAO,EACjC,QAAQ,EAAE,QAAQ,aAAa,CAAC,CAAC,SAAS,yCAAyC,EACrF,CAAC;CACD,4BAA4B,OAAO,EACjC,QAAQ,EAAE,QAAQ,WAAW,CAAC,CAAC,SAAS,8BAA8B,EACxE,CAAC;CACD,4BAA4B,OAAO;EACjC,QAAQ,EAAE,QAAQ,QAAQ,CAAC,CAAC,SAAS,uBAAuB;EAC5D,aAAa,EACV,QAAQ,gBAAgB,CAAC,CACzB,SAAS,CAAC,CACV,SACC,qFACF;CACJ,CAAC;AACH,CAAC,CAAC,CACD,QACE,UAAU,gBAAgB,UAAU,KAAK,CAAC,CAAC,SAC5C,6CACF;;AAKF,SAAgB,eAAe,QAAkC,SAAiC;CAChG,OAAO,qBAAqB,MAAM;EAAE;EAAQ;CAAQ,CAAC;AACvD;;AAEA,SAAgB,uBACd,MACgB;CAChB,OAAO,eAAe,KAAK,IAAI,KAAK,OAAO;AAC7C"}

package/dist/schema/factory-config.d.mts

@@ -0,0 +1,95 @@
+import { RepositorySlug } from "./repository.mjs";
+import { TaskKind } from "./task.mjs";
+import { z } from "zod";
+//#region src/schema/factory-config.d.ts
+/** Validates one repository allowlist entry and its configured dependency ordering. */
+declare const factoryConfigRepositorySchema: z.ZodReadonly<z.ZodObject<{
+  slug: z.ZodType<`${string}/${string}`, string, z.core.$ZodTypeInternals<`${string}/${string}`, string>>;
+  defaultBranch: z.ZodDefault<z.ZodString>;
+  dependsOn: z.ZodDefault<z.ZodReadonly<z.ZodArray<z.ZodType<`${string}/${string}`, string, z.core.$ZodTypeInternals<`${string}/${string}`, string>>>>>;
+}, z.core.$strict>>;
+declare const githubConnectorSchema: z.ZodReadonly<z.ZodObject<{
+  owner: z.ZodString;
+  connector: z.ZodString;
+}, z.core.$strict>>;
+declare const slackConnectorSchema: z.ZodReadonly<z.ZodObject<{
+  connector: z.ZodString;
+  approvalChannel: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>>;
+/** Validates stall detection and replacement-attempt limits for running Tasks. */
+declare const executionPolicySchema: z.ZodReadonly<z.ZodObject<{
+  maxAttempts: z.ZodNumber;
+  stallMinutes: z.ZodNumber;
+  stallMinutesByKind: z.ZodDefault<z.ZodReadonly<z.ZodRecord<z.ZodType<TaskKind, unknown, z.core.$ZodTypeInternals<TaskKind, unknown>> & z.core.$partial, z.ZodNumber>>>;
+}, z.core.$strict>>;
+/** Stall detection and retry limits applied to running Tasks. */
+type ExecutionPolicy = z.infer<typeof executionPolicySchema>;
+/** Conservative default stall window and three-attempt execution policy. */
+declare const defaultExecutionPolicy: Readonly<{
+  maxAttempts: number;
+  stallMinutes: number;
+  stallMinutesByKind: Readonly<Partial<Record<TaskKind, number>>>;
+}>;
+/** Validates the repositories, operators, connectors, budget, and policies of a Factory. */
+declare const factoryConfigSchema: z.ZodReadonly<z.ZodObject<{
+  connectors: z.ZodDefault<z.ZodReadonly<z.ZodObject<{
+    github: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+      owner: z.ZodString;
+      connector: z.ZodString;
+    }, z.core.$strict>>>>;
+    slack: z.ZodDefault<z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+      connector: z.ZodString;
+      approvalChannel: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>>>;
+  }, z.core.$strict>>>;
+  repositories: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+    slug: z.ZodType<`${string}/${string}`, string, z.core.$ZodTypeInternals<`${string}/${string}`, string>>;
+    defaultBranch: z.ZodDefault<z.ZodString>;
+    dependsOn: z.ZodDefault<z.ZodReadonly<z.ZodArray<z.ZodType<`${string}/${string}`, string, z.core.$ZodTypeInternals<`${string}/${string}`, string>>>>>;
+  }, z.core.$strict>>>>;
+  operators: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+  approval: z.ZodDefault<z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+    source: z.ZodOptional<z.ZodString>;
+    kind: z.ZodOptional<z.ZodString>;
+    priority: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    require: z.ZodBoolean;
+  }, z.core.$strict>>>>>;
+  budget: z.ZodDefault<z.ZodReadonly<z.ZodObject<{
+    totalUsd: z.ZodNumber;
+    investigationUsd: z.ZodNumber;
+    perTaskReservationUsd: z.ZodNumber;
+    warningPercent: z.ZodNumber;
+    perRepositoryUsd: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodType<`${string}/${string}`, string, z.core.$ZodTypeInternals<`${string}/${string}`, string>>, z.ZodNumber>>>;
+  }, z.core.$strict>>>;
+  execution: z.ZodDefault<z.ZodReadonly<z.ZodObject<{
+    maxAttempts: z.ZodNumber;
+    stallMinutes: z.ZodNumber;
+    stallMinutesByKind: z.ZodDefault<z.ZodReadonly<z.ZodRecord<z.ZodType<TaskKind, unknown, z.core.$ZodTypeInternals<TaskKind, unknown>> & z.core.$partial, z.ZodNumber>>>;
+  }, z.core.$strict>>>;
+}, z.core.$strict>>;
+/** Fully resolved repository allowlist entry in a Factory configuration. */
+type FactoryConfigRepository = z.infer<typeof factoryConfigRepositorySchema>;
+/** Fully resolved and validated Factory configuration. */
+type FactoryConfig = z.infer<typeof factoryConfigSchema>;
+type FactoryConfigSchemaInput = z.input<typeof factoryConfigSchema>;
+type FactoryConfigConnectorsInput = Readonly<{
+  github: readonly Readonly<z.input<typeof githubConnectorSchema>>[];
+  slack?: readonly Readonly<z.input<typeof slackConnectorSchema>>[];
+}>;
+/** Repository allowlist entry accepted when defining a Factory, before defaults are applied. */
+type FactoryConfigRepositoryInput = Readonly<{
+  slug: RepositorySlug;
+  defaultBranch?: string;
+  dependsOn?: readonly RepositorySlug[];
+}>;
+/** Caller input accepted when defining a Factory, before schema defaults are applied. */
+type FactoryConfigInput = Readonly<Omit<FactoryConfigSchemaInput, "connectors" | "repositories" | "operators"> & {
+  connectors?: FactoryConfigConnectorsInput;
+  repositories: readonly FactoryConfigRepositoryInput[];
+  operators: readonly string[];
+}>;
+/** Validates a Factory configuration and applies its declared defaults. */
+declare function defineFactory(config: FactoryConfigInput): FactoryConfig;
+//#endregion
+export { ExecutionPolicy, FactoryConfig, FactoryConfigInput, FactoryConfigRepository, FactoryConfigRepositoryInput, defaultExecutionPolicy, defineFactory, executionPolicySchema, factoryConfigRepositorySchema, factoryConfigSchema };
+//# sourceMappingURL=factory-config.d.mts.map

package/dist/schema/factory-config.mjs

@@ -0,0 +1,60 @@
+import { repositorySlugSchema } from "./repository.mjs";
+import { budgetLimitsSchema } from "./budget.mjs";
+import { allowByDefaultApprovalPolicy, approvalPolicySchema } from "../approval.mjs";
+import { taskKindSchema } from "./task.mjs";
+import { z } from "zod";
+//#region src/schema/factory-config.ts
+/** Validates one repository allowlist entry and its configured dependency ordering. */
+const factoryConfigRepositorySchema = z.strictObject({
+	slug: repositorySlugSchema.describe("Repository this factory may work on."),
+	defaultBranch: z.string().min(1).default("main").describe("Branch changes land on, usually main."),
+	dependsOn: z.array(repositorySlugSchema).readonly().default([]).describe("Repositories that must land changes before this repository.")
+}).readonly();
+const githubConnectorSchema = z.strictObject({
+	owner: z.string().regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/).describe("GitHub user or organization that owns this connector installation."),
+	connector: z.string().regex(/^github\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/).describe("Vercel Connect UID installed for this GitHub owner.")
+}).readonly();
+const slackConnectorSchema = z.strictObject({
+	connector: z.string().regex(/^slack\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/).describe("Vercel Connect UID installed for this Slack app."),
+	approvalChannel: z.string().regex(/^[CDG][A-Z0-9]+$/u).optional().describe("Explicit Slack channel for approval proposals that have no originating Slack thread. Absent disables cross-channel approval notifications.")
+}).readonly();
+/** Validates stall detection and replacement-attempt limits for running Tasks. */
+const executionPolicySchema = z.strictObject({
+	maxAttempts: z.number().int().min(1).describe("Attempts a task may consume before a stall fails it for good."),
+	stallMinutes: z.number().int().min(1).describe("Minutes without progress before a running task is marked stalled."),
+	stallMinutesByKind: z.partialRecord(taskKindSchema, z.number().int().min(1)).readonly().default({}).describe("Per-kind stall windows for long single-step work, e.g. security_scan: 300.")
+}).readonly();
+/** Conservative default stall window and three-attempt execution policy. */
+const defaultExecutionPolicy = executionPolicySchema.parse({
+	maxAttempts: 3,
+	stallMinutes: 45,
+	stallMinutesByKind: {}
+});
+/** Validates the repositories, operators, connectors, budget, and policies of a Factory. */
+const factoryConfigSchema = z.strictObject({
+	connectors: z.strictObject({
+		github: z.array(githubConnectorSchema).readonly().refine((connectors) => new Set(connectors.map(({ owner }) => owner)).size === connectors.length, "GitHub connector owners must be unique."),
+		slack: z.array(slackConnectorSchema).max(1, "A factory may configure one Slack connector.").readonly().default([])
+	}).readonly().default({
+		github: [],
+		slack: []
+	}).describe("Provider connections available to this factory."),
+	repositories: z.array(factoryConfigRepositorySchema).min(1).readonly().describe("Repositories this factory is allowed to inspect and change."),
+	operators: z.array(z.string().min(1)).min(1).readonly().describe("Provider-qualified identities allowed to operate this factory."),
+	approval: approvalPolicySchema.default(allowByDefaultApprovalPolicy).describe("Which Tasks wait for a human before they run. First match wins."),
+	budget: budgetLimitsSchema.default({
+		totalUsd: 500,
+		investigationUsd: 100,
+		perTaskReservationUsd: 5,
+		warningPercent: 80
+	}).describe("Monthly spend limits. One non-disableable budget per factory per month."),
+	execution: executionPolicySchema.default(defaultExecutionPolicy).describe("Stall detection and retry limits for running tasks.")
+}).readonly();
+/** Validates a Factory configuration and applies its declared defaults. */
+function defineFactory(config) {
+	return factoryConfigSchema.parse(config);
+}
+//#endregion
+export { defaultExecutionPolicy, defineFactory, executionPolicySchema, factoryConfigRepositorySchema, factoryConfigSchema };
+
+//# sourceMappingURL=factory-config.mjs.map

package/dist/schema/factory-config.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory-config.mjs","names":[],"sources":["../../src/schema/factory-config.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { allowByDefaultApprovalPolicy, approvalPolicySchema } from \"../approval\";\nimport { budgetLimitsSchema } from \"./budget\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./repository\";\nimport { taskKindSchema } from \"./task\";\n\n/** Validates one repository allowlist entry and its configured dependency ordering. */\nexport const factoryConfigRepositorySchema = z\n  .strictObject({\n    slug: repositorySlugSchema.describe(\"Repository this factory may work on.\"),\n    defaultBranch: z\n      .string()\n      .min(1)\n      .default(\"main\")\n      .describe(\"Branch changes land on, usually main.\"),\n    dependsOn: z\n      .array(repositorySlugSchema)\n      .readonly()\n      .default([])\n      .describe(\"Repositories that must land changes before this repository.\"),\n  })\n  .readonly();\n\nconst githubConnectorSchema = z\n  .strictObject({\n    owner: z\n      .string()\n      .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"GitHub user or organization that owns this connector installation.\"),\n    connector: z\n      .string()\n      .regex(/^github\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this GitHub owner.\"),\n  })\n  .readonly();\n\nconst slackConnectorSchema = z\n  .strictObject({\n    connector: z\n      .string()\n      .regex(/^slack\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this Slack app.\"),\n    approvalChannel: z\n      .string()\n      .regex(/^[CDG][A-Z0-9]+$/u)\n      .optional()\n      .describe(\n        \"Explicit Slack channel for approval proposals that have no originating Slack thread. Absent disables cross-channel approval notifications.\",\n      ),\n  })\n  .readonly();\n\n/** Validates stall detection and replacement-attempt limits for running Tasks. */\nexport const executionPolicySchema = z\n  .strictObject({\n    maxAttempts: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Attempts a task may consume before a stall fails it for good.\"),\n    stallMinutes: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Minutes without progress before a running task is marked stalled.\"),\n    stallMinutesByKind: z\n      .partialRecord(taskKindSchema, z.number().int().min(1))\n      .readonly()\n      .default({})\n      .describe(\"Per-kind stall windows for long single-step work, e.g. security_scan: 300.\"),\n  })\n  .readonly();\n\n/** Stall detection and retry limits applied to running Tasks. */\nexport type ExecutionPolicy = z.infer<typeof executionPolicySchema>;\n\n/** Conservative default stall window and three-attempt execution policy. */\nexport const defaultExecutionPolicy = executionPolicySchema.parse({\n  maxAttempts: 3,\n  stallMinutes: 45,\n  stallMinutesByKind: {},\n});\n\n/** Validates the repositories, operators, connectors, budget, and policies of a Factory. */\nexport const factoryConfigSchema = z\n  .strictObject({\n    connectors: z\n      .strictObject({\n        github: z\n          .array(githubConnectorSchema)\n          .readonly()\n          .refine(\n            (connectors) =>\n              new Set(connectors.map(({ owner }) => owner)).size === connectors.length,\n            \"GitHub connector owners must be unique.\",\n          ),\n        slack: z\n          .array(slackConnectorSchema)\n          .max(1, \"A factory may configure one Slack connector.\")\n          .readonly()\n          .default([]),\n      })\n      .readonly()\n      .default({ github: [], slack: [] })\n      .describe(\"Provider connections available to this factory.\"),\n    repositories: z\n      .array(factoryConfigRepositorySchema)\n      .min(1)\n      .readonly()\n      .describe(\"Repositories this factory is allowed to inspect and change.\"),\n    operators: z\n      .array(z.string().min(1))\n      .min(1)\n      .readonly()\n      .describe(\"Provider-qualified identities allowed to operate this factory.\"),\n    approval: approvalPolicySchema\n      .default(allowByDefaultApprovalPolicy)\n      .describe(\"Which Tasks wait for a human before they run. First match wins.\"),\n    budget: budgetLimitsSchema\n      .default({\n        totalUsd: 500,\n        investigationUsd: 100,\n        perTaskReservationUsd: 5,\n        warningPercent: 80,\n      })\n      .describe(\"Monthly spend limits. One non-disableable budget per factory per month.\"),\n    execution: executionPolicySchema\n      .default(defaultExecutionPolicy)\n      .describe(\"Stall detection and retry limits for running tasks.\"),\n  })\n  .readonly();\n\n/** Fully resolved repository allowlist entry in a Factory configuration. */\nexport type FactoryConfigRepository = z.infer<typeof factoryConfigRepositorySchema>;\n\n/** Fully resolved and validated Factory configuration. */\nexport type FactoryConfig = z.infer<typeof factoryConfigSchema>;\ntype FactoryConfigSchemaInput = z.input<typeof factoryConfigSchema>;\ntype FactoryConfigConnectorsInput = Readonly<{\n  github: readonly Readonly<z.input<typeof githubConnectorSchema>>[];\n  slack?: readonly Readonly<z.input<typeof slackConnectorSchema>>[];\n}>;\n/** Repository allowlist entry accepted when defining a Factory, before defaults are applied. */\nexport type FactoryConfigRepositoryInput = Readonly<{\n  slug: RepositorySlug;\n  defaultBranch?: string;\n  dependsOn?: readonly RepositorySlug[];\n}>;\n/** Caller input accepted when defining a Factory, before schema defaults are applied. */\nexport type FactoryConfigInput = Readonly<\n  Omit<FactoryConfigSchemaInput, \"connectors\" | \"repositories\" | \"operators\"> & {\n    connectors?: FactoryConfigConnectorsInput;\n    repositories: readonly FactoryConfigRepositoryInput[];\n    operators: readonly string[];\n  }\n>;\n\n/** Validates a Factory configuration and applies its declared defaults. */\nexport function defineFactory(config: FactoryConfigInput): FactoryConfig {\n  return factoryConfigSchema.parse(config);\n}\n"],"mappings":";;;;;;;AAOA,MAAa,gCAAgC,EAC1C,aAAa;CACZ,MAAM,qBAAqB,SAAS,sCAAsC;CAC1E,eAAe,EACZ,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,MAAM,CAAC,CACf,SAAS,uCAAuC;CACnD,WAAW,EACR,MAAM,oBAAoB,CAAC,CAC3B,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,6DAA6D;AAC3E,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,wBAAwB,EAC3B,aAAa;CACZ,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,mCAAmC,CAAC,CAC1C,SAAS,oEAAoE;CAChF,WAAW,EACR,OAAO,CAAC,CACR,MAAM,2CAA2C,CAAC,CAClD,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,uBAAuB,EAC1B,aAAa;CACZ,WAAW,EACR,OAAO,CAAC,CACR,MAAM,0CAA0C,CAAC,CACjD,SAAS,kDAAkD;CAC9D,iBAAiB,EACd,OAAO,CAAC,CACR,MAAM,mBAAmB,CAAC,CAC1B,SAAS,CAAC,CACV,SACC,4IACF;AACJ,CAAC,CAAC,CACD,SAAS;;AAGZ,MAAa,wBAAwB,EAClC,aAAa;CACZ,aAAa,EACV,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,+DAA+D;CAC3E,cAAc,EACX,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,mEAAmE;CAC/E,oBAAoB,EACjB,cAAc,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,4EAA4E;AAC1F,CAAC,CAAC,CACD,SAAS;;AAMZ,MAAa,yBAAyB,sBAAsB,MAAM;CAChE,aAAa;CACb,cAAc;CACd,oBAAoB,CAAC;AACvB,CAAC;;AAGD,MAAa,sBAAsB,EAChC,aAAa;CACZ,YAAY,EACT,aAAa;EACZ,QAAQ,EACL,MAAM,qBAAqB,CAAC,CAC5B,SAAS,CAAC,CACV,QACE,eACC,IAAI,IAAI,WAAW,KAAK,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW,QACpE,yCACF;EACF,OAAO,EACJ,MAAM,oBAAoB,CAAC,CAC3B,IAAI,GAAG,8CAA8C,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC;CACf,CAAC,CAAC,CACD,SAAS,CAAC,CACV,QAAQ;EAAE,QAAQ,CAAC;EAAG,OAAO,CAAC;CAAE,CAAC,CAAC,CAClC,SAAS,iDAAiD;CAC7D,cAAc,EACX,MAAM,6BAA6B,CAAC,CACpC,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,6DAA6D;CACzE,WAAW,EACR,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACxB,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,gEAAgE;CAC5E,UAAU,qBACP,QAAQ,4BAA4B,CAAC,CACrC,SAAS,iEAAiE;CAC7E,QAAQ,mBACL,QAAQ;EACP,UAAU;EACV,kBAAkB;EAClB,uBAAuB;EACvB,gBAAgB;CAClB,CAAC,CAAC,CACD,SAAS,yEAAyE;CACrF,WAAW,sBACR,QAAQ,sBAAsB,CAAC,CAC/B,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,SAAS;;AA4BZ,SAAgB,cAAc,QAA2C;CACvE,OAAO,oBAAoB,MAAM,MAAM;AACzC"}

package/dist/schema/finding.d.mts

@@ -0,0 +1,125 @@
+import { z } from "zod";
+//#region src/schema/finding.d.ts
+/** Validates the operational urgency assigned to a repository finding. */
+declare const findingPrioritySchema: z.ZodEnum<{
+  P0: "P0";
+  P1: "P1";
+  P2: "P2";
+  P3: "P3";
+}>;
+/** Validates the engineering concern category assigned to a finding. */
+declare const findingCategorySchema: z.ZodEnum<{
+  security: "security";
+  correctness: "correctness";
+  reliability: "reliability";
+  performance: "performance";
+  compatibility: "compatibility";
+  accessibility: "accessibility";
+  documentation: "documentation";
+  maintainability: "maintainability";
+  testing: "testing";
+  usability: "usability";
+}>;
+/** Validates how strongly the available evidence supports a finding. */
+declare const findingVerificationLevelSchema: z.ZodEnum<{
+  unverified: "unverified";
+  supported: "supported";
+  confirmed: "confirmed";
+}>;
+/** Validates the method used to investigate or demonstrate a finding. */
+declare const findingVerificationMethodSchema: z.ZodEnum<{
+  documentation: "documentation";
+  code_inspection: "code_inspection";
+  static_analysis: "static_analysis";
+  manual_reproduction: "manual_reproduction";
+  unit_test: "unit_test";
+  integration_test: "integration_test";
+  e2e_test: "e2e_test";
+  runtime_observation: "runtime_observation";
+}>;
+/**
+ * What was done to check the finding. Forces a reporter to distinguish "I
+ * think this is a problem" from "I demonstrated it", which is the axis a human
+ * approving fixes cares about most.
+ */
+declare const findingVerificationSchema: z.ZodObject<{
+  level: z.ZodEnum<{
+    unverified: "unverified";
+    supported: "supported";
+    confirmed: "confirmed";
+  }>;
+  method: z.ZodEnum<{
+    documentation: "documentation";
+    code_inspection: "code_inspection";
+    static_analysis: "static_analysis";
+    manual_reproduction: "manual_reproduction";
+    unit_test: "unit_test";
+    integration_test: "integration_test";
+    e2e_test: "e2e_test";
+    runtime_observation: "runtime_observation";
+  }>;
+  summary: z.ZodString;
+  limitations: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** A single problem found in a repository, as a scanner or agent reports it. */
+declare const findingSchema: z.ZodObject<{
+  title: z.ZodString;
+  body: z.ZodString;
+  path: z.ZodOptional<z.ZodString>;
+  line: z.ZodOptional<z.ZodNumber>;
+  endLine: z.ZodOptional<z.ZodNumber>;
+  priority: z.ZodEnum<{
+    P0: "P0";
+    P1: "P1";
+    P2: "P2";
+    P3: "P3";
+  }>;
+  category: z.ZodEnum<{
+    security: "security";
+    correctness: "correctness";
+    reliability: "reliability";
+    performance: "performance";
+    compatibility: "compatibility";
+    accessibility: "accessibility";
+    documentation: "documentation";
+    maintainability: "maintainability";
+    testing: "testing";
+    usability: "usability";
+  }>;
+  verification: z.ZodObject<{
+    level: z.ZodEnum<{
+      unverified: "unverified";
+      supported: "supported";
+      confirmed: "confirmed";
+    }>;
+    method: z.ZodEnum<{
+      documentation: "documentation";
+      code_inspection: "code_inspection";
+      static_analysis: "static_analysis";
+      manual_reproduction: "manual_reproduction";
+      unit_test: "unit_test";
+      integration_test: "integration_test";
+      e2e_test: "e2e_test";
+      runtime_observation: "runtime_observation";
+    }>;
+    summary: z.ZodString;
+    limitations: z.ZodOptional<z.ZodString>;
+  }, z.core.$strict>;
+  tool: z.ZodOptional<z.ZodString>;
+  ruleId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Operational urgency of a repository finding, from P0 through P3. */
+type FindingPriority = z.infer<typeof findingPrioritySchema>;
+/** Engineering concern category used to group a repository finding. */
+type FindingCategory = z.infer<typeof findingCategorySchema>;
+/** Strength of evidence supporting a reported finding. */
+type FindingVerificationLevel = z.infer<typeof findingVerificationLevelSchema>;
+/** Investigation method used to support a reported finding. */
+type FindingVerificationMethod = z.infer<typeof findingVerificationMethodSchema>;
+/** Evidence level, method, and limitations recorded for a finding. */
+type FindingVerification = z.infer<typeof findingVerificationSchema>;
+/** Structured repository problem reported by a scanner or agent. */
+type Finding = z.infer<typeof findingSchema>;
+//#endregion
+export { Finding, FindingCategory, FindingPriority, FindingVerification, FindingVerificationLevel, FindingVerificationMethod, findingCategorySchema, findingPrioritySchema, findingSchema, findingVerificationLevelSchema, findingVerificationMethodSchema, findingVerificationSchema };
+//# sourceMappingURL=finding.d.mts.map

package/dist/schema/finding.mjs

@@ -0,0 +1,67 @@
+import { z } from "zod";
+//#region src/schema/finding.ts
+/** Validates the operational urgency assigned to a repository finding. */
+const findingPrioritySchema = z.enum([
+	"P0",
+	"P1",
+	"P2",
+	"P3"
+]).describe("Urgency of a finding: P0 is drop-everything, P3 is nice-to-have.");
+/** Validates the engineering concern category assigned to a finding. */
+const findingCategorySchema = z.enum([
+	"security",
+	"correctness",
+	"reliability",
+	"performance",
+	"compatibility",
+	"accessibility",
+	"documentation",
+	"maintainability",
+	"testing",
+	"usability"
+]);
+/** Validates how strongly the available evidence supports a finding. */
+const findingVerificationLevelSchema = z.enum([
+	"unverified",
+	"supported",
+	"confirmed"
+]).describe("How sure the reporter is: unverified = suspected from reading; supported = evidence points to it; confirmed = demonstrated.");
+/** Validates the method used to investigate or demonstrate a finding. */
+const findingVerificationMethodSchema = z.enum([
+	"code_inspection",
+	"static_analysis",
+	"manual_reproduction",
+	"unit_test",
+	"integration_test",
+	"e2e_test",
+	"runtime_observation",
+	"documentation"
+]);
+/**
+* What was done to check the finding. Forces a reporter to distinguish "I
+* think this is a problem" from "I demonstrated it", which is the axis a human
+* approving fixes cares about most.
+*/
+const findingVerificationSchema = z.strictObject({
+	level: findingVerificationLevelSchema,
+	method: findingVerificationMethodSchema,
+	summary: z.string().min(1).max(2e3).describe("What was checked and what it showed."),
+	limitations: z.string().min(1).max(2e3).optional().describe("What could not be checked.")
+});
+/** A single problem found in a repository, as a scanner or agent reports it. */
+const findingSchema = z.strictObject({
+	title: z.string().min(1).max(200),
+	body: z.string().min(1).max(8e3).describe("The problem, its impact, and how to fix it. Markdown."),
+	path: z.string().min(1).max(500).optional().describe("Repository-relative file path."),
+	line: z.number().int().min(1).optional(),
+	endLine: z.number().int().min(1).optional(),
+	priority: findingPrioritySchema,
+	category: findingCategorySchema,
+	verification: findingVerificationSchema,
+	tool: z.string().min(1).max(100).optional().describe("Scanner that produced it, e.g. deepsec."),
+	ruleId: z.string().min(1).max(200).optional().describe("Scanner rule or check id, when there is one.")
+});
+//#endregion
+export { findingCategorySchema, findingPrioritySchema, findingSchema, findingVerificationLevelSchema, findingVerificationMethodSchema, findingVerificationSchema };
+
+//# sourceMappingURL=finding.mjs.map

package/dist/schema/finding.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding.mjs","names":[],"sources":["../../src/schema/finding.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Validates the operational urgency assigned to a repository finding. */\nexport const findingPrioritySchema = z\n  .enum([\"P0\", \"P1\", \"P2\", \"P3\"])\n  .describe(\"Urgency of a finding: P0 is drop-everything, P3 is nice-to-have.\");\n\n/** Validates the engineering concern category assigned to a finding. */\nexport const findingCategorySchema = z.enum([\n  \"security\",\n  \"correctness\",\n  \"reliability\",\n  \"performance\",\n  \"compatibility\",\n  \"accessibility\",\n  \"documentation\",\n  \"maintainability\",\n  \"testing\",\n  \"usability\",\n]);\n\n/** Validates how strongly the available evidence supports a finding. */\nexport const findingVerificationLevelSchema = z\n  .enum([\"unverified\", \"supported\", \"confirmed\"])\n  .describe(\n    \"How sure the reporter is: unverified = suspected from reading; supported = evidence points to it; confirmed = demonstrated.\",\n  );\n\n/** Validates the method used to investigate or demonstrate a finding. */\nexport const findingVerificationMethodSchema = z.enum([\n  \"code_inspection\",\n  \"static_analysis\",\n  \"manual_reproduction\",\n  \"unit_test\",\n  \"integration_test\",\n  \"e2e_test\",\n  \"runtime_observation\",\n  \"documentation\",\n]);\n\n/**\n * What was done to check the finding. Forces a reporter to distinguish \"I\n * think this is a problem\" from \"I demonstrated it\", which is the axis a human\n * approving fixes cares about most.\n */\nexport const findingVerificationSchema = z.strictObject({\n  level: findingVerificationLevelSchema,\n  method: findingVerificationMethodSchema,\n  summary: z.string().min(1).max(2000).describe(\"What was checked and what it showed.\"),\n  limitations: z.string().min(1).max(2000).optional().describe(\"What could not be checked.\"),\n});\n\n/** A single problem found in a repository, as a scanner or agent reports it. */\nexport const findingSchema = z.strictObject({\n  title: z.string().min(1).max(200),\n  body: z\n    .string()\n    .min(1)\n    .max(8000)\n    .describe(\"The problem, its impact, and how to fix it. Markdown.\"),\n  path: z.string().min(1).max(500).optional().describe(\"Repository-relative file path.\"),\n  line: z.number().int().min(1).optional(),\n  endLine: z.number().int().min(1).optional(),\n  priority: findingPrioritySchema,\n  category: findingCategorySchema,\n  verification: findingVerificationSchema,\n  tool: z.string().min(1).max(100).optional().describe(\"Scanner that produced it, e.g. deepsec.\"),\n  ruleId: z\n    .string()\n    .min(1)\n    .max(200)\n    .optional()\n    .describe(\"Scanner rule or check id, when there is one.\"),\n});\n\n/** Operational urgency of a repository finding, from P0 through P3. */\nexport type FindingPriority = z.infer<typeof findingPrioritySchema>;\n/** Engineering concern category used to group a repository finding. */\nexport type FindingCategory = z.infer<typeof findingCategorySchema>;\n/** Strength of evidence supporting a reported finding. */\nexport type FindingVerificationLevel = z.infer<typeof findingVerificationLevelSchema>;\n/** Investigation method used to support a reported finding. */\nexport type FindingVerificationMethod = z.infer<typeof findingVerificationMethodSchema>;\n/** Evidence level, method, and limitations recorded for a finding. */\nexport type FindingVerification = z.infer<typeof findingVerificationSchema>;\n/** Structured repository problem reported by a scanner or agent. */\nexport type Finding = z.infer<typeof findingSchema>;\n"],"mappings":";;;AAGA,MAAa,wBAAwB,EAClC,KAAK;CAAC;CAAM;CAAM;CAAM;AAAI,CAAC,CAAC,CAC9B,SAAS,kEAAkE;;AAG9E,MAAa,wBAAwB,EAAE,KAAK;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;AAGD,MAAa,iCAAiC,EAC3C,KAAK;CAAC;CAAc;CAAa;AAAW,CAAC,CAAC,CAC9C,SACC,6HACF;;AAGF,MAAa,kCAAkC,EAAE,KAAK;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,MAAa,4BAA4B,EAAE,aAAa;CACtD,OAAO;CACP,QAAQ;CACR,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,sCAAsC;CACpF,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,4BAA4B;AAC3F,CAAC;;AAGD,MAAa,gBAAgB,EAAE,aAAa;CAC1C,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAChC,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAI,CAAC,CACT,SAAS,uDAAuD;CACnE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,gCAAgC;CACrF,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACvC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAC1C,UAAU;CACV,UAAU;CACV,cAAc;CACd,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,yCAAyC;CAC9F,QAAQ,EACL,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,SAAS,CAAC,CACV,SAAS,8CAA8C;AAC5D,CAAC"}

package/dist/schema/id.d.mts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+//#region src/schema/id.d.ts
+/** Validates a stable Factory identifier. */
+declare const factoryIdSchema: z.ZodType<`fac_${string}`, string, z.core.$ZodTypeInternals<`fac_${string}`, string>>;
+/** Validates a stable repository identifier. */
+declare const repositoryIdSchema: z.ZodType<`repo_${string}`, string, z.core.$ZodTypeInternals<`repo_${string}`, string>>;
+/** Validates a stable inbound Signal identifier. */
+declare const signalIdSchema: z.ZodType<`sig_${string}`, string, z.core.$ZodTypeInternals<`sig_${string}`, string>>;
+/** Validates a stable Task identifier. */
+declare const taskIdSchema: z.ZodType<`task_${string}`, string, z.core.$ZodTypeInternals<`task_${string}`, string>>;
+/** Validates a stable Change identifier. */
+declare const changeIdSchema: z.ZodType<`chg_${string}`, string, z.core.$ZodTypeInternals<`chg_${string}`, string>>;
+/** Validates a stable immutable Receipt identifier. */
+declare const receiptIdSchema: z.ZodType<`rcpt_${string}`, string, z.core.$ZodTypeInternals<`rcpt_${string}`, string>>;
+/** Validates a stable communication outbox identifier. */
+declare const outboxIdSchema: z.ZodType<`out_${string}`, string, z.core.$ZodTypeInternals<`out_${string}`, string>>;
+/** Validates a stable immutable answer-event identifier. */
+declare const answerIdSchema: z.ZodType<`ans_${string}`, string, z.core.$ZodTypeInternals<`ans_${string}`, string>>;
+/** Validates a nonempty repository scope expressed as repository identifiers. */
+declare const repositoryIdsSchema: z.ZodReadonly<z.ZodTuple<[z.ZodType<`repo_${string}`, string, z.core.$ZodTypeInternals<`repo_${string}`, string>>], z.ZodType<`repo_${string}`, string, z.core.$ZodTypeInternals<`repo_${string}`, string>>>>;
+/** Constructs a validated nonempty repository scope from typed identifiers. */
+declare function repositoryScope(first: RepositoryId, ...rest: readonly RepositoryId[]): RepositoryIds;
+/** Stable identifier for one configured Factory. */
+type FactoryId = z.infer<typeof factoryIdSchema>;
+/** Stable identifier for one configured repository. */
+type RepositoryId = z.infer<typeof repositoryIdSchema>;
+/** Nonempty ordered repository scope attached to one Task or event. */
+type RepositoryIds = z.infer<typeof repositoryIdsSchema>;
+/** Stable identifier for one normalized inbound Signal. */
+type SignalId = z.infer<typeof signalIdSchema>;
+/** Stable identifier for one durable unit of workflow work. */
+type TaskId = z.infer<typeof taskIdSchema>;
+/** Stable identifier for one human-visible pull-request Change. */
+type ChangeId = z.infer<typeof changeIdSchema>;
+/** Stable identifier for one immutable audit Receipt. */
+type ReceiptId = z.infer<typeof receiptIdSchema>;
+/** Stable identifier for one communication outbox event. */
+type OutboxId = z.infer<typeof outboxIdSchema>;
+/** Stable identifier for one immutable authenticated answer event. */
+type AnswerId = z.infer<typeof answerIdSchema>;
+//#endregion
+export { AnswerId, ChangeId, FactoryId, OutboxId, ReceiptId, RepositoryId, RepositoryIds, SignalId, TaskId, answerIdSchema, changeIdSchema, factoryIdSchema, outboxIdSchema, receiptIdSchema, repositoryIdSchema, repositoryIdsSchema, repositoryScope, signalIdSchema, taskIdSchema };
+//# sourceMappingURL=id.d.mts.map