@vercel/factory 0.0.13 → 0.0.15

package/dist/task-protocols.d.mts

@@ -0,0 +1,80 @@
+import { JsonValue } from "./schema/work.mjs";
+import "./workflows.mjs";
+import { TaskMessageProtocol, TaskMessageProtocols } from "./schema/task-message.mjs";
+import "./tasks.mjs";
+import { z } from "zod";
+//#region src/task-protocols.d.ts
+/** Validates bounded instructions and explicit context for the supplied assignment protocol. */
+declare const assignmentPayloadSchema: z.ZodObject<{
+  instructions: z.ZodString;
+  context: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+}, z.core.$strict>;
+/** Validates a bounded outcome, evidence, and concerns for the supplied handoff protocol. */
+declare const handoffPayloadSchema: z.ZodObject<{
+  outcome: z.ZodEnum<{
+    failed: "failed";
+    completed: "completed";
+    needs_input: "needs_input";
+  }>;
+  summary: z.ZodString;
+  output: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+  artifacts: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+    kind: z.ZodString;
+    ref: z.ZodString;
+  }, z.core.$strict>>>;
+  concerns: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+  deviations: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** Validated assignment instructions and optional bounded context. */
+type AssignmentPayload = z.infer<typeof assignmentPayloadSchema>;
+/** Validated handoff outcome, evidence, concerns, and deviations. */
+type HandoffPayload = z.infer<typeof handoffPayloadSchema>;
+/** Standard exact `assignment@1` protocol definition. */
+declare const assignmentTaskMessageProtocol: Readonly<TaskMessageProtocol<z.ZodObject<{
+  instructions: z.ZodString;
+  context: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+}, z.core.$strict>, "assignment", 1>>;
+/** Standard exact `handoff@1` protocol definition. */
+declare const handoffTaskMessageProtocol: Readonly<TaskMessageProtocol<z.ZodObject<{
+  outcome: z.ZodEnum<{
+    failed: "failed";
+    completed: "completed";
+    needs_input: "needs_input";
+  }>;
+  summary: z.ZodString;
+  output: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+  artifacts: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+    kind: z.ZodString;
+    ref: z.ZodString;
+  }, z.core.$strict>>>;
+  concerns: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+  deviations: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>, "handoff", 1>>;
+/** Replaceable protocol definitions, not mandatory message vocabulary. */
+declare const standardTaskMessageProtocols: readonly (Readonly<TaskMessageProtocol<z.ZodObject<{
+  instructions: z.ZodString;
+  context: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+}, z.core.$strict>, "assignment", 1>> | Readonly<TaskMessageProtocol<z.ZodObject<{
+  outcome: z.ZodEnum<{
+    failed: "failed";
+    completed: "completed";
+    needs_input: "needs_input";
+  }>;
+  summary: z.ZodString;
+  output: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+  artifacts: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+    kind: z.ZodString;
+    ref: z.ZodString;
+  }, z.core.$strict>>>;
+  concerns: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+  deviations: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>, "handoff", 1>>)[];
+/** One of the supplied standard Task-message protocol definitions. */
+type StandardTaskMessageProtocol = (typeof standardTaskMessageProtocols)[number];
+/** Registry type containing the supplied standard Task-message protocols. */
+type DefaultTaskMessageProtocols = TaskMessageProtocols<StandardTaskMessageProtocol>;
+/** Creates a registry containing the supplied `assignment@1` and `handoff@1` protocols. */
+declare function createDefaultTaskMessageProtocols(): DefaultTaskMessageProtocols;
+//#endregion
+export { AssignmentPayload, DefaultTaskMessageProtocols, HandoffPayload, StandardTaskMessageProtocol, assignmentPayloadSchema, assignmentTaskMessageProtocol, createDefaultTaskMessageProtocols, handoffPayloadSchema, handoffTaskMessageProtocol, standardTaskMessageProtocols };
+//# sourceMappingURL=task-protocols.d.mts.map

package/dist/task-protocols.mjs

@@ -0,0 +1,47 @@
+import { jsonValueSchema } from "./schema/work.mjs";
+import { defineTaskMessageProtocol, defineTaskMessageProtocols } from "./schema/task-message.mjs";
+import { z } from "zod";
+//#region src/task-protocols.ts
+/** Validates bounded instructions and explicit context for the supplied assignment protocol. */
+const assignmentPayloadSchema = z.strictObject({
+	instructions: z.string().min(1).max(16e3).describe("Bounded instructions for the recipient's delegated scope."),
+	context: jsonValueSchema.optional().describe("Optional explicit context; not implicit access to another Task's data.")
+});
+/** Validates a bounded outcome, evidence, and concerns for the supplied handoff protocol. */
+const handoffPayloadSchema = z.strictObject({
+	outcome: z.enum([
+		"completed",
+		"failed",
+		"needs_input"
+	]).describe("Reported outcome; a message never changes Task lifecycle by itself."),
+	summary: z.string().min(1).max(8e3).describe("Summary of work and its result."),
+	output: jsonValueSchema.optional().describe("Bounded result; the receiving workflow validates the required output contract."),
+	artifacts: z.array(z.strictObject({
+		kind: z.string().min(1).max(64).describe("Application-defined artifact kind."),
+		ref: z.string().min(1).max(2048).describe("Opaque artifact reference; receiving this reference grants no read authority.")
+	})).max(32).readonly().describe("References to evidence and large outputs; not embedded artifact contents."),
+	concerns: z.array(z.string().min(1).max(2048)).max(32).readonly().describe("Findings or concerns requiring the scope owner's attention."),
+	deviations: z.array(z.string().min(1).max(2048)).max(32).readonly().describe("Departures from the assignment or expected approach.")
+});
+/** Standard exact `assignment@1` protocol definition. */
+const assignmentTaskMessageProtocol = defineTaskMessageProtocol({
+	id: "assignment",
+	version: 1,
+	payload: assignmentPayloadSchema
+});
+/** Standard exact `handoff@1` protocol definition. */
+const handoffTaskMessageProtocol = defineTaskMessageProtocol({
+	id: "handoff",
+	version: 1,
+	payload: handoffPayloadSchema
+});
+/** Replaceable protocol definitions, not mandatory message vocabulary. */
+const standardTaskMessageProtocols = Object.freeze([assignmentTaskMessageProtocol, handoffTaskMessageProtocol]);
+/** Creates a registry containing the supplied `assignment@1` and `handoff@1` protocols. */
+function createDefaultTaskMessageProtocols() {
+	return defineTaskMessageProtocols(standardTaskMessageProtocols);
+}
+//#endregion
+export { assignmentPayloadSchema, assignmentTaskMessageProtocol, createDefaultTaskMessageProtocols, handoffPayloadSchema, handoffTaskMessageProtocol, standardTaskMessageProtocols };
+
+//# sourceMappingURL=task-protocols.mjs.map

package/dist/task-protocols.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-protocols.mjs","names":[],"sources":["../src/task-protocols.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  defineTaskMessageProtocol,\n  defineTaskMessageProtocols,\n  type TaskMessageProtocols,\n} from \"./schema/task-message\";\nimport { jsonValueSchema } from \"./schema/work\";\n\n/** Validates bounded instructions and explicit context for the supplied assignment protocol. */\nexport const assignmentPayloadSchema = z.strictObject({\n  instructions: z\n    .string()\n    .min(1)\n    .max(16_000)\n    .describe(\"Bounded instructions for the recipient's delegated scope.\"),\n  context: jsonValueSchema\n    .optional()\n    .describe(\"Optional explicit context; not implicit access to another Task's data.\"),\n});\n\n/** Validates a bounded outcome, evidence, and concerns for the supplied handoff protocol. */\nexport const handoffPayloadSchema = z.strictObject({\n  outcome: z\n    .enum([\"completed\", \"failed\", \"needs_input\"])\n    .describe(\"Reported outcome; a message never changes Task lifecycle by itself.\"),\n  summary: z.string().min(1).max(8000).describe(\"Summary of work and its result.\"),\n  output: jsonValueSchema\n    .optional()\n    .describe(\"Bounded result; the receiving workflow validates the required output contract.\"),\n  artifacts: z\n    .array(\n      z.strictObject({\n        kind: z.string().min(1).max(64).describe(\"Application-defined artifact kind.\"),\n        ref: z\n          .string()\n          .min(1)\n          .max(2048)\n          .describe(\n            \"Opaque artifact reference; receiving this reference grants no read authority.\",\n          ),\n      }),\n    )\n    .max(32)\n    .readonly()\n    .describe(\"References to evidence and large outputs; not embedded artifact contents.\"),\n  concerns: z\n    .array(z.string().min(1).max(2048))\n    .max(32)\n    .readonly()\n    .describe(\"Findings or concerns requiring the scope owner's attention.\"),\n  deviations: z\n    .array(z.string().min(1).max(2048))\n    .max(32)\n    .readonly()\n    .describe(\"Departures from the assignment or expected approach.\"),\n});\n\n/** Validated assignment instructions and optional bounded context. */\nexport type AssignmentPayload = z.infer<typeof assignmentPayloadSchema>;\n/** Validated handoff outcome, evidence, concerns, and deviations. */\nexport type HandoffPayload = z.infer<typeof handoffPayloadSchema>;\n\n/** Standard exact `assignment@1` protocol definition. */\nexport const assignmentTaskMessageProtocol = defineTaskMessageProtocol({\n  id: \"assignment\",\n  version: 1,\n  payload: assignmentPayloadSchema,\n});\n\n/** Standard exact `handoff@1` protocol definition. */\nexport const handoffTaskMessageProtocol = defineTaskMessageProtocol({\n  id: \"handoff\",\n  version: 1,\n  payload: handoffPayloadSchema,\n});\n\n/** Replaceable protocol definitions, not mandatory message vocabulary. */\nexport const standardTaskMessageProtocols = Object.freeze([\n  assignmentTaskMessageProtocol,\n  handoffTaskMessageProtocol,\n]);\n\n/** One of the supplied standard Task-message protocol definitions. */\nexport type StandardTaskMessageProtocol = (typeof standardTaskMessageProtocols)[number];\n/** Registry type containing the supplied standard Task-message protocols. */\nexport type DefaultTaskMessageProtocols = TaskMessageProtocols<StandardTaskMessageProtocol>;\n\n/** Creates a registry containing the supplied `assignment@1` and `handoff@1` protocols. */\nexport function createDefaultTaskMessageProtocols(): DefaultTaskMessageProtocols {\n  return defineTaskMessageProtocols(standardTaskMessageProtocols);\n}\n"],"mappings":";;;;;AASA,MAAa,0BAA0B,EAAE,aAAa;CACpD,cAAc,EACX,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAM,CAAC,CACX,SAAS,2DAA2D;CACvE,SAAS,gBACN,SAAS,CAAC,CACV,SAAS,wEAAwE;AACtF,CAAC;;AAGD,MAAa,uBAAuB,EAAE,aAAa;CACjD,SAAS,EACN,KAAK;EAAC;EAAa;EAAU;CAAa,CAAC,CAAC,CAC5C,SAAS,qEAAqE;CACjF,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,iCAAiC;CAC/E,QAAQ,gBACL,SAAS,CAAC,CACV,SAAS,gFAAgF;CAC5F,WAAW,EACR,MACC,EAAE,aAAa;EACb,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,oCAAoC;EAC7E,KAAK,EACF,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAI,CAAC,CACT,SACC,+EACF;CACJ,CAAC,CACH,CAAC,CACA,IAAI,EAAE,CAAC,CACP,SAAS,CAAC,CACV,SAAS,2EAA2E;CACvF,UAAU,EACP,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAClC,IAAI,EAAE,CAAC,CACP,SAAS,CAAC,CACV,SAAS,6DAA6D;CACzE,YAAY,EACT,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAClC,IAAI,EAAE,CAAC,CACP,SAAS,CAAC,CACV,SAAS,sDAAsD;AACpE,CAAC;;AAQD,MAAa,gCAAgC,0BAA0B;CACrE,IAAI;CACJ,SAAS;CACT,SAAS;AACX,CAAC;;AAGD,MAAa,6BAA6B,0BAA0B;CAClE,IAAI;CACJ,SAAS;CACT,SAAS;AACX,CAAC;;AAGD,MAAa,+BAA+B,OAAO,OAAO,CACxD,+BACA,0BACF,CAAC;;AAQD,SAAgB,oCAAiE;CAC/E,OAAO,2BAA2B,4BAA4B;AAChE"}

package/dist/tasks.d.mts

@@ -0,0 +1,17 @@
+import { ApprovalPolicy, ApprovalPriority, ApprovalRule, ApprovalSubject, allowByDefaultApprovalPolicy, approvalPolicySchema, approvalPrioritySchema, approvalRuleSchema, requiresApproval } from "./approval.mjs";
+import { AnswerId, TaskId, answerIdSchema, taskIdSchema } from "./schema/id.mjs";
+import { ExecutionReference, MessageWaitingTask, NeedsHumanTask, SucceededTask, Task, TaskApproval, TaskKind, TaskOrigin, TaskQuestion, TaskState, TaskUsage, executionReferenceSchema, harnessSchema, isMessageWaitingTask, isNeedsHumanTask, isSucceededTask, standardTaskKinds, taskApprovalSchema, taskExecutionRepositoryIdsSchema, taskKindSchema, taskOriginSchema, taskQuestionSchema, taskSchema, taskStateSchema, taskUsageSchema } from "./schema/task.mjs";
+import { MAX_TASK_INBOX_PENDING, SendTaskMessageInput, TaskInbox, TaskMessage, TaskMessageClaim, TaskMessageDiscard, TaskMessageForProtocol, TaskMessageId, TaskMessageOperationId, TaskMessagePrincipal, TaskMessageProcessing, TaskMessageProtocol, TaskMessageProtocolBinding, TaskMessageProtocolBindingInput, TaskMessageProtocolInput, TaskMessageProtocolInputPayload, TaskMessageProtocolStoredPayload, TaskMessageProtocols, defineTaskMessageProtocol, defineTaskMessageProtocols, parseTaskMessageProtocolBinding, sendTaskMessageInputSchema, taskInboxSchema, taskMessageClaimSchema, taskMessageDiscardSchema, taskMessageIdSchema, taskMessageInput, taskMessageOperationIdSchema, taskMessagePrincipalSchema, taskMessageProcessingSchema, taskMessageProtocolBindingSchema, taskMessageProtocolSchema, taskMessageReservationSchema, taskMessageSchema } from "./schema/task-message.mjs";
+import { AssertTaskMessageClaimInput, ClaimTaskMessageInput, ClaimTaskMessageResult, CompleteTaskMessageInput, CreateTaskMessageStoreOptions, DiscardTaskMessageInput, TaskMessageAction, TaskMessageAuthorizationError, TaskMessageAuthorizationInput, TaskMessageAuthorize, TaskMessageConflictError, TaskMessageEffectKeyInput, TaskMessageError, TaskMessageLeaseError, TaskMessageLookupInput, TaskMessageRecipientInput, TaskMessageSendInput, TaskMessageSourceFenceError, TaskMessageStore, createTaskMessageStore, taskBoundMessagePolicy } from "./store/task-messages.mjs";
+import { MAX_TASK_GRAPH_DEPENDENCIES, MAX_TASK_GRAPH_NODES, TaskGraph, TaskGraphNode, taskGraphAdmissionSchema, taskGraphDependenciesSchema, taskGraphNodeSchema, taskGraphSchema } from "./schema/task-graph.mjs";
+import { AdmitTaskGraphInput, AssertTaskAdmissionInput, CreateTaskGraphStoreOptions, SetTaskGraphDependenciesInput, TaskGraphConflictError, TaskGraphNodeRef, TaskGraphStore, assertTaskAdmission, createTaskGraphStore } from "./store/task-graphs.mjs";
+import { TaskEffect, TaskEffectKey, TaskEffectReference, taskEffectKeySchema, taskEffectReferenceSchema, taskEffectSchema } from "./schema/task-effect.mjs";
+import { CreateTaskEffectStoreOptions, RecordTaskEffectInput, ResolveTaskEffectInput, TaskEffectLookupInput, TaskEffectStore, createTaskEffectStore } from "./store/task-effects.mjs";
+import { CompleteTaskWorkInput, CompleteWorkflowTaskWorkInput, CreateTaskWorkStoreOptions, ResumeTaskWorkInput, TaskWorkStore, TaskWorkStores, TaskWorkUsage, WaitForTaskMessagesInput, createTaskWorkStore } from "./store/task-work.mjs";
+import { AnswerEvent, answerEventSchema } from "./schema/answer.mjs";
+import { AgentSessionBinding, AnswerEventConflictError, AnswerQuestionInput, AnswerQuestionResult, ApprovalDecision, ApprovalError, CreateTaskInput, RejectionDecision, RootTaskOrigin, TaskPatch, TaskTransitionArguments, TaskTransitionOptions } from "./store/engine.mjs";
+import { ApprovalAccess, ApprovalAccessDecisionInput, ApprovalAccessError, ApprovalAccessOptions, ApprovalAccessStores, createApprovalAccess } from "./approval-access.mjs";
+import { taskInitialState, taskTransitions } from "./schema/transitions.mjs";
+import { ProcessTaskMessageOptions, ProcessTaskMessageResult, TaskMessageProcessingStores, processTaskMessage, readTaskMessageDecision } from "./task-message-processing.mjs";
+import { AssignmentPayload, DefaultTaskMessageProtocols, HandoffPayload, StandardTaskMessageProtocol, assignmentPayloadSchema, assignmentTaskMessageProtocol, createDefaultTaskMessageProtocols, handoffPayloadSchema, handoffTaskMessageProtocol, standardTaskMessageProtocols } from "./task-protocols.mjs";
+export { type AdmitTaskGraphInput, type AgentSessionBinding, type AnswerEvent, AnswerEventConflictError, type AnswerId, type AnswerQuestionInput, type AnswerQuestionResult, type ApprovalAccess, type ApprovalAccessDecisionInput, ApprovalAccessError, type ApprovalAccessOptions, type ApprovalAccessStores, type ApprovalDecision, ApprovalError, type ApprovalPolicy, type ApprovalPriority, type ApprovalRule, type ApprovalSubject, type AssertTaskAdmissionInput, type AssertTaskMessageClaimInput, type AssignmentPayload, type ClaimTaskMessageInput, type ClaimTaskMessageResult, type CompleteTaskMessageInput, type CompleteTaskWorkInput, type CompleteWorkflowTaskWorkInput, type CreateTaskEffectStoreOptions, type CreateTaskGraphStoreOptions, type CreateTaskInput, type CreateTaskMessageStoreOptions, type CreateTaskWorkStoreOptions, type DefaultTaskMessageProtocols, type DiscardTaskMessageInput, type ExecutionReference, type HandoffPayload, MAX_TASK_GRAPH_DEPENDENCIES, MAX_TASK_GRAPH_NODES, MAX_TASK_INBOX_PENDING, type MessageWaitingTask, type NeedsHumanTask, type ProcessTaskMessageOptions, type ProcessTaskMessageResult, type RecordTaskEffectInput, type RejectionDecision, type ResolveTaskEffectInput, type ResumeTaskWorkInput, type RootTaskOrigin, type SendTaskMessageInput, type SetTaskGraphDependenciesInput, type StandardTaskMessageProtocol, type SucceededTask, type Task, type TaskApproval, type TaskEffect, type TaskEffectKey, type TaskEffectLookupInput, type TaskEffectReference, type TaskEffectStore, type TaskGraph, TaskGraphConflictError, type TaskGraphNode, type TaskGraphNodeRef, type TaskGraphStore, type TaskId, type TaskInbox, type TaskKind, type TaskMessage, type TaskMessageAction, TaskMessageAuthorizationError, type TaskMessageAuthorizationInput, type TaskMessageAuthorize, type TaskMessageClaim, TaskMessageConflictError, type TaskMessageDiscard, type TaskMessageEffectKeyInput, TaskMessageError, type TaskMessageForProtocol, type TaskMessageId, TaskMessageLeaseError, type TaskMessageLookupInput, type TaskMessageOperationId, type TaskMessagePrincipal, type TaskMessageProcessing, type TaskMessageProcessingStores, type TaskMessageProtocol, type TaskMessageProtocolBinding, type TaskMessageProtocolBindingInput, type TaskMessageProtocolInput, type TaskMessageProtocolInputPayload, type TaskMessageProtocolStoredPayload, type TaskMessageProtocols, type TaskMessageRecipientInput, type TaskMessageSendInput, TaskMessageSourceFenceError, type TaskMessageStore, type TaskOrigin, type TaskPatch, type TaskQuestion, type TaskState, type TaskTransitionArguments, type TaskTransitionOptions, type TaskUsage, type TaskWorkStore, type TaskWorkStores, type TaskWorkUsage, type WaitForTaskMessagesInput, allowByDefaultApprovalPolicy, answerEventSchema, answerIdSchema, approvalPolicySchema, approvalPrioritySchema, approvalRuleSchema, assertTaskAdmission, assignmentPayloadSchema, assignmentTaskMessageProtocol, createApprovalAccess, createDefaultTaskMessageProtocols, createTaskEffectStore, createTaskGraphStore, createTaskMessageStore, createTaskWorkStore, defineTaskMessageProtocol, defineTaskMessageProtocols, executionReferenceSchema, handoffPayloadSchema, handoffTaskMessageProtocol, harnessSchema, isMessageWaitingTask, isNeedsHumanTask, isSucceededTask, parseTaskMessageProtocolBinding, processTaskMessage, readTaskMessageDecision, requiresApproval, sendTaskMessageInputSchema, standardTaskKinds, standardTaskMessageProtocols, taskApprovalSchema, taskBoundMessagePolicy, taskEffectKeySchema, taskEffectReferenceSchema, taskEffectSchema, taskExecutionRepositoryIdsSchema, taskGraphAdmissionSchema, taskGraphDependenciesSchema, taskGraphNodeSchema, taskGraphSchema, taskIdSchema, taskInboxSchema, taskInitialState, taskKindSchema, taskMessageClaimSchema, taskMessageDiscardSchema, taskMessageIdSchema, taskMessageInput, taskMessageOperationIdSchema, taskMessagePrincipalSchema, taskMessageProcessingSchema, taskMessageProtocolBindingSchema, taskMessageProtocolSchema, taskMessageReservationSchema, taskMessageSchema, taskOriginSchema, taskQuestionSchema, taskSchema, taskStateSchema, taskTransitions, taskUsageSchema };

package/dist/tasks.mjs

@@ -0,0 +1,17 @@
+import { answerIdSchema, taskIdSchema } from "./schema/id.mjs";
+import { allowByDefaultApprovalPolicy, approvalPolicySchema, approvalPrioritySchema, approvalRuleSchema, requiresApproval } from "./approval.mjs";
+import { executionReferenceSchema, harnessSchema, isMessageWaitingTask, isNeedsHumanTask, isSucceededTask, standardTaskKinds, taskApprovalSchema, taskExecutionRepositoryIdsSchema, taskKindSchema, taskOriginSchema, taskQuestionSchema, taskSchema, taskStateSchema, taskUsageSchema } from "./schema/task.mjs";
+import { taskInitialState, taskTransitions } from "./schema/transitions.mjs";
+import { ApprovalAccessError, createApprovalAccess } from "./approval-access.mjs";
+import { answerEventSchema } from "./schema/answer.mjs";
+import { MAX_TASK_GRAPH_DEPENDENCIES, MAX_TASK_GRAPH_NODES, taskGraphAdmissionSchema, taskGraphDependenciesSchema, taskGraphNodeSchema, taskGraphSchema } from "./schema/task-graph.mjs";
+import { MAX_TASK_INBOX_PENDING, defineTaskMessageProtocol, defineTaskMessageProtocols, parseTaskMessageProtocolBinding, sendTaskMessageInputSchema, taskInboxSchema, taskMessageClaimSchema, taskMessageDiscardSchema, taskMessageIdSchema, taskMessageInput, taskMessageOperationIdSchema, taskMessagePrincipalSchema, taskMessageProcessingSchema, taskMessageProtocolBindingSchema, taskMessageProtocolSchema, taskMessageReservationSchema, taskMessageSchema } from "./schema/task-message.mjs";
+import { taskEffectKeySchema, taskEffectReferenceSchema, taskEffectSchema } from "./schema/task-effect.mjs";
+import { TaskGraphConflictError, assertTaskAdmission, createTaskGraphStore } from "./store/task-graphs.mjs";
+import { TaskMessageAuthorizationError, TaskMessageConflictError, TaskMessageError, TaskMessageLeaseError, TaskMessageSourceFenceError, createTaskMessageStore, taskBoundMessagePolicy } from "./store/task-messages.mjs";
+import { createTaskWorkStore } from "./store/task-work.mjs";
+import { createTaskEffectStore } from "./store/task-effects.mjs";
+import { processTaskMessage, readTaskMessageDecision } from "./task-message-processing.mjs";
+import { assignmentPayloadSchema, assignmentTaskMessageProtocol, createDefaultTaskMessageProtocols, handoffPayloadSchema, handoffTaskMessageProtocol, standardTaskMessageProtocols } from "./task-protocols.mjs";
+import { AnswerEventConflictError, ApprovalError } from "./store/engine.mjs";
+export { AnswerEventConflictError, ApprovalAccessError, ApprovalError, MAX_TASK_GRAPH_DEPENDENCIES, MAX_TASK_GRAPH_NODES, MAX_TASK_INBOX_PENDING, TaskGraphConflictError, TaskMessageAuthorizationError, TaskMessageConflictError, TaskMessageError, TaskMessageLeaseError, TaskMessageSourceFenceError, allowByDefaultApprovalPolicy, answerEventSchema, answerIdSchema, approvalPolicySchema, approvalPrioritySchema, approvalRuleSchema, assertTaskAdmission, assignmentPayloadSchema, assignmentTaskMessageProtocol, createApprovalAccess, createDefaultTaskMessageProtocols, createTaskEffectStore, createTaskGraphStore, createTaskMessageStore, createTaskWorkStore, defineTaskMessageProtocol, defineTaskMessageProtocols, executionReferenceSchema, handoffPayloadSchema, handoffTaskMessageProtocol, harnessSchema, isMessageWaitingTask, isNeedsHumanTask, isSucceededTask, parseTaskMessageProtocolBinding, processTaskMessage, readTaskMessageDecision, requiresApproval, sendTaskMessageInputSchema, standardTaskKinds, standardTaskMessageProtocols, taskApprovalSchema, taskBoundMessagePolicy, taskEffectKeySchema, taskEffectReferenceSchema, taskEffectSchema, taskExecutionRepositoryIdsSchema, taskGraphAdmissionSchema, taskGraphDependenciesSchema, taskGraphNodeSchema, taskGraphSchema, taskIdSchema, taskInboxSchema, taskInitialState, taskKindSchema, taskMessageClaimSchema, taskMessageDiscardSchema, taskMessageIdSchema, taskMessageInput, taskMessageOperationIdSchema, taskMessagePrincipalSchema, taskMessageProcessingSchema, taskMessageProtocolBindingSchema, taskMessageProtocolSchema, taskMessageReservationSchema, taskMessageSchema, taskOriginSchema, taskQuestionSchema, taskSchema, taskStateSchema, taskTransitions, taskUsageSchema };

package/dist/vercel-git.d.mts

@@ -0,0 +1,21 @@
+import { RepositorySlug } from "./schema/repository.mjs";
+import { GitHubGitTransport } from "./github-transfer.mjs";
+import { Sandbox } from "@vercel/sandbox";
+//#region src/vercel-git.d.ts
+/** Repository and access level used to mint one trusted Git transport token. */
+interface VercelGitHubTokenInput {
+  repository: RepositorySlug;
+  access: "read" | "write";
+}
+/** Configures fresh trusted sandboxes and repository-scoped Git tokens. */
+interface VercelGitHubGitTransportOptions {
+  /** Reads must mint contents:read credentials; writes are confined to the supplied repository. */
+  token(input: VercelGitHubTokenInput): Promise<string>;
+  /** Creates a fresh sandbox, without a snapshot, repository, or running agent. */
+  createSandbox?: () => Promise<Pick<Sandbox, "runCommand" | "writeFiles" | "readFileToBuffer" | "updateNetworkPolicy" | "stop">>;
+}
+/** Transfer Git objects through fresh trusted sandboxes; credentials never reach an agent sandbox. */
+declare function createVercelGitHubGitTransport(options: VercelGitHubGitTransportOptions): GitHubGitTransport;
+//#endregion
+export { VercelGitHubGitTransportOptions, VercelGitHubTokenInput, createVercelGitHubGitTransport };
+//# sourceMappingURL=vercel-git.d.mts.map

package/dist/vercel-git.mjs

@@ -0,0 +1,112 @@
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { validateGitBundle } from "./github-transfer.mjs";
+import { isSafeGitRef } from "./github-publication.mjs";
+//#region src/vercel-git.ts
+function credentialPolicy(repository, token) {
+	return { allow: { "github.com": [{
+		match: { path: { startsWith: `/${repository}.git/` } },
+		transform: [{ headers: { authorization: `Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}` } }]
+	}] } };
+}
+/** Transfer Git objects through fresh trusted sandboxes; credentials never reach an agent sandbox. */
+function createVercelGitHubGitTransport(options) {
+	async function isolated(repository, use) {
+		const slug = repositorySlugSchema.parse(repository.toLowerCase());
+		const sandbox = options.createSandbox ? await options.createSandbox() : await (await import("@vercel/sandbox")).Sandbox.create({
+			runtime: "node24",
+			timeout: 18e4,
+			networkPolicy: "deny-all"
+		});
+		async function git(...args) {
+			const result = await sandbox.runCommand({
+				cmd: "/usr/bin/env",
+				args: [
+					"-i",
+					"PATH=/usr/bin:/bin",
+					"HOME=/tmp",
+					"GIT_CONFIG_NOSYSTEM=1",
+					"GIT_CONFIG_GLOBAL=/dev/null",
+					"GIT_TERMINAL_PROMPT=0",
+					"git",
+					"-c",
+					"core.hooksPath=/dev/null",
+					"-c",
+					"credential.helper=",
+					"-c",
+					"protocol.ext.allow=never",
+					"-c",
+					"protocol.file.allow=always",
+					"-c",
+					"http.followRedirects=false",
+					...args
+				],
+				timeoutMs: 12e4
+			});
+			if (result.exitCode !== 0) throw new Error(`Trusted Git operation failed (${result.exitCode})`);
+			return (await result.stdout()).trim();
+		}
+		try {
+			await sandbox.updateNetworkPolicy("deny-all");
+			return await use(sandbox, git, slug);
+		} finally {
+			try {
+				await sandbox.updateNetworkPolicy("deny-all");
+			} finally {
+				await sandbox.stop();
+			}
+		}
+	}
+	return {
+		async fetch(input) {
+			if (input.refs.some((ref) => !ref.startsWith("refs/") || !isSafeGitRef(ref))) throw new Error("Invalid Git fetch ref");
+			return isolated(input.repository, async (sandbox, git, slug) => {
+				await sandbox.updateNetworkPolicy(credentialPolicy(slug, await options.token({
+					repository: slug,
+					access: "read"
+				})));
+				await git("clone", "--bare", "--no-hardlinks", `https://github.com/${slug}.git`, "/tmp/transfer.git");
+				if (input.refs.length) await git("-C", "/tmp/transfer.git", "fetch", "--no-tags", "origin", ...input.refs.map((ref) => `+${ref}:${ref}`));
+				await sandbox.updateNetworkPolicy("deny-all");
+				await git("-C", "/tmp/transfer.git", "bundle", "create", "/tmp/transfer.bundle", "--all");
+				const size = await sandbox.runCommand({
+					cmd: "stat",
+					args: [
+						"-c",
+						"%s",
+						"/tmp/transfer.bundle"
+					]
+				});
+				const byteLength = Number(await size.stdout());
+				if (size.exitCode !== 0 || !Number.isSafeInteger(byteLength) || byteLength < 1 || byteLength > 52428800) throw new Error("Git bundle exceeds transfer limit");
+				const data = await sandbox.readFileToBuffer({ path: "/tmp/transfer.bundle" });
+				if (!data || data.length > 52428800) throw new Error("Invalid Git bundle size");
+				const bundle = { base64: data.toString("base64") };
+				validateGitBundle(bundle);
+				return bundle;
+			});
+		},
+		async push(input) {
+			if (!isSafeGitRef(input.branch) || !/^[a-f0-9]{40}$/.test(input.head) || !/^[a-f0-9]{40}$/.test(input.expectedHead)) throw new Error("Invalid Git publication target");
+			const bundle = validateGitBundle(input.bundle);
+			await isolated(input.repository, async (sandbox, git, slug) => {
+				await git("init", "--bare", "/tmp/transfer.git");
+				await sandbox.writeFiles([{
+					path: "/tmp/transfer.bundle",
+					content: bundle
+				}]);
+				await git("-C", "/tmp/transfer.git", "bundle", "verify", "/tmp/transfer.bundle");
+				await git("-C", "/tmp/transfer.git", "fetch", "/tmp/transfer.bundle", "HEAD:refs/heads/candidate");
+				if (await git("-C", "/tmp/transfer.git", "rev-parse", "refs/heads/candidate") !== input.head) throw new Error("Git bundle head does not match publication target");
+				await sandbox.updateNetworkPolicy(credentialPolicy(slug, await options.token({
+					repository: slug,
+					access: "write"
+				})));
+				await git("-C", "/tmp/transfer.git", "push", `--force-with-lease=refs/heads/${input.branch}:${input.expectedHead}`, `https://github.com/${slug}.git`, `${input.head}:refs/heads/${input.branch}`);
+			});
+		}
+	};
+}
+//#endregion
+export { createVercelGitHubGitTransport };
+
+//# sourceMappingURL=vercel-git.mjs.map

package/dist/vercel-git.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-git.mjs","names":[],"sources":["../src/vercel-git.ts"],"sourcesContent":["import type { Sandbox, NetworkPolicy } from \"@vercel/sandbox\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport { isSafeGitRef } from \"./github-publication\";\nimport { maxGitBundleBytes, validateGitBundle, type GitHubGitTransport } from \"./github-transfer\";\n\n/** Repository and access level used to mint one trusted Git transport token. */\nexport interface VercelGitHubTokenInput {\n  repository: RepositorySlug;\n  access: \"read\" | \"write\";\n}\n\n/** Configures fresh trusted sandboxes and repository-scoped Git tokens. */\nexport interface VercelGitHubGitTransportOptions {\n  /** Reads must mint contents:read credentials; writes are confined to the supplied repository. */\n  token(input: VercelGitHubTokenInput): Promise<string>;\n  /** Creates a fresh sandbox, without a snapshot, repository, or running agent. */\n  createSandbox?: () => Promise<\n    Pick<Sandbox, \"runCommand\" | \"writeFiles\" | \"readFileToBuffer\" | \"updateNetworkPolicy\" | \"stop\">\n  >;\n}\n\nfunction credentialPolicy(repository: RepositorySlug, token: string): NetworkPolicy {\n  return {\n    allow: {\n      \"github.com\": [\n        {\n          match: { path: { startsWith: `/${repository}.git/` } },\n          transform: [\n            {\n              headers: {\n                authorization: `Basic ${Buffer.from(`x-access-token:${token}`).toString(\"base64\")}`,\n              },\n            },\n          ],\n        },\n      ],\n    },\n  };\n}\n\n/** Transfer Git objects through fresh trusted sandboxes; credentials never reach an agent sandbox. */\nexport function createVercelGitHubGitTransport(\n  options: VercelGitHubGitTransportOptions,\n): GitHubGitTransport {\n  async function isolated<T>(\n    repository: RepositorySlug,\n    use: (\n      sandbox: Awaited<ReturnType<NonNullable<VercelGitHubGitTransportOptions[\"createSandbox\"]>>>,\n      git: (...args: string[]) => Promise<string>,\n      repository: RepositorySlug,\n    ) => Promise<T>,\n  ): Promise<T> {\n    const slug = repositorySlugSchema.parse(repository.toLowerCase());\n    const sandbox = options.createSandbox\n      ? await options.createSandbox()\n      : await (\n          await import(\"@vercel/sandbox\")\n        ).Sandbox.create({ runtime: \"node24\", timeout: 180_000, networkPolicy: \"deny-all\" });\n    async function git(...args: string[]): Promise<string> {\n      const result = await sandbox.runCommand({\n        cmd: \"/usr/bin/env\",\n        args: [\n          \"-i\",\n          \"PATH=/usr/bin:/bin\",\n          \"HOME=/tmp\",\n          \"GIT_CONFIG_NOSYSTEM=1\",\n          \"GIT_CONFIG_GLOBAL=/dev/null\",\n          \"GIT_TERMINAL_PROMPT=0\",\n          \"git\",\n          \"-c\",\n          \"core.hooksPath=/dev/null\",\n          \"-c\",\n          \"credential.helper=\",\n          \"-c\",\n          \"protocol.ext.allow=never\",\n          \"-c\",\n          \"protocol.file.allow=always\",\n          \"-c\",\n          \"http.followRedirects=false\",\n          ...args,\n        ],\n        timeoutMs: 120_000,\n      });\n      if (result.exitCode !== 0)\n        throw new Error(`Trusted Git operation failed (${result.exitCode})`);\n      return (await result.stdout()).trim();\n    }\n    try {\n      await sandbox.updateNetworkPolicy(\"deny-all\");\n      return await use(sandbox, git, slug);\n    } finally {\n      try {\n        await sandbox.updateNetworkPolicy(\"deny-all\");\n      } finally {\n        await sandbox.stop();\n      }\n    }\n  }\n  return {\n    async fetch(input) {\n      if (input.refs.some((ref) => !ref.startsWith(\"refs/\") || !isSafeGitRef(ref)))\n        throw new Error(\"Invalid Git fetch ref\");\n      return isolated(input.repository, async (sandbox, git, slug) => {\n        await sandbox.updateNetworkPolicy(\n          credentialPolicy(slug, await options.token({ repository: slug, access: \"read\" })),\n        );\n        await git(\n          \"clone\",\n          \"--bare\",\n          \"--no-hardlinks\",\n          `https://github.com/${slug}.git`,\n          \"/tmp/transfer.git\",\n        );\n        if (input.refs.length)\n          await git(\n            \"-C\",\n            \"/tmp/transfer.git\",\n            \"fetch\",\n            \"--no-tags\",\n            \"origin\",\n            ...input.refs.map((ref) => `+${ref}:${ref}`),\n          );\n        await sandbox.updateNetworkPolicy(\"deny-all\");\n        await git(\"-C\", \"/tmp/transfer.git\", \"bundle\", \"create\", \"/tmp/transfer.bundle\", \"--all\");\n        const size = await sandbox.runCommand({\n          cmd: \"stat\",\n          args: [\"-c\", \"%s\", \"/tmp/transfer.bundle\"],\n        });\n        const byteLength = Number(await size.stdout());\n        if (\n          size.exitCode !== 0 ||\n          !Number.isSafeInteger(byteLength) ||\n          byteLength < 1 ||\n          byteLength > maxGitBundleBytes\n        )\n          throw new Error(\"Git bundle exceeds transfer limit\");\n        const data = await sandbox.readFileToBuffer({ path: \"/tmp/transfer.bundle\" });\n        if (!data || data.length > maxGitBundleBytes) throw new Error(\"Invalid Git bundle size\");\n        const bundle = { base64: data.toString(\"base64\") };\n        validateGitBundle(bundle);\n        return bundle;\n      });\n    },\n    async push(input) {\n      if (\n        !isSafeGitRef(input.branch) ||\n        !/^[a-f0-9]{40}$/.test(input.head) ||\n        !/^[a-f0-9]{40}$/.test(input.expectedHead)\n      )\n        throw new Error(\"Invalid Git publication target\");\n      const bundle = validateGitBundle(input.bundle);\n      await isolated(input.repository, async (sandbox, git, slug) => {\n        await git(\"init\", \"--bare\", \"/tmp/transfer.git\");\n        await sandbox.writeFiles([{ path: \"/tmp/transfer.bundle\", content: bundle }]);\n        await git(\"-C\", \"/tmp/transfer.git\", \"bundle\", \"verify\", \"/tmp/transfer.bundle\");\n        await git(\n          \"-C\",\n          \"/tmp/transfer.git\",\n          \"fetch\",\n          \"/tmp/transfer.bundle\",\n          \"HEAD:refs/heads/candidate\",\n        );\n        if (\n          (await git(\"-C\", \"/tmp/transfer.git\", \"rev-parse\", \"refs/heads/candidate\")) !== input.head\n        )\n          throw new Error(\"Git bundle head does not match publication target\");\n        await sandbox.updateNetworkPolicy(\n          credentialPolicy(slug, await options.token({ repository: slug, access: \"write\" })),\n        );\n        await git(\n          \"-C\",\n          \"/tmp/transfer.git\",\n          \"push\",\n          `--force-with-lease=refs/heads/${input.branch}:${input.expectedHead}`,\n          `https://github.com/${slug}.git`,\n          `${input.head}:refs/heads/${input.branch}`,\n        );\n      });\n    },\n  };\n}\n"],"mappings":";;;;AAqBA,SAAS,iBAAiB,YAA4B,OAA8B;CAClF,OAAO,EACL,OAAO,EACL,cAAc,CACZ;EACE,OAAO,EAAE,MAAM,EAAE,YAAY,IAAI,WAAW,OAAO,EAAE;EACrD,WAAW,CACT,EACE,SAAS,EACP,eAAe,SAAS,OAAO,KAAK,kBAAkB,OAAO,CAAC,CAAC,SAAS,QAAQ,IAClF,EACF,CACF;CACF,CACF,EACF,EACF;AACF;;AAGA,SAAgB,+BACd,SACoB;CACpB,eAAe,SACb,YACA,KAKY;EACZ,MAAM,OAAO,qBAAqB,MAAM,WAAW,YAAY,CAAC;EAChE,MAAM,UAAU,QAAQ,gBACpB,MAAM,QAAQ,cAAc,IAC5B,OACE,MAAM,OAAO,mBAAA,CACb,QAAQ,OAAO;GAAE,SAAS;GAAU,SAAS;GAAS,eAAe;EAAW,CAAC;EACvF,eAAe,IAAI,GAAG,MAAiC;GACrD,MAAM,SAAS,MAAM,QAAQ,WAAW;IACtC,KAAK;IACL,MAAM;KACJ;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA,GAAG;IACL;IACA,WAAW;GACb,CAAC;GACD,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,iCAAiC,OAAO,SAAS,EAAE;GACrE,QAAQ,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;EACtC;EACA,IAAI;GACF,MAAM,QAAQ,oBAAoB,UAAU;GAC5C,OAAO,MAAM,IAAI,SAAS,KAAK,IAAI;EACrC,UAAU;GACR,IAAI;IACF,MAAM,QAAQ,oBAAoB,UAAU;GAC9C,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;CACF;CACA,OAAO;EACL,MAAM,MAAM,OAAO;GACjB,IAAI,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,aAAa,GAAG,CAAC,GACzE,MAAM,IAAI,MAAM,uBAAuB;GACzC,OAAO,SAAS,MAAM,YAAY,OAAO,SAAS,KAAK,SAAS;IAC9D,MAAM,QAAQ,oBACZ,iBAAiB,MAAM,MAAM,QAAQ,MAAM;KAAE,YAAY;KAAM,QAAQ;IAAO,CAAC,CAAC,CAClF;IACA,MAAM,IACJ,SACA,UACA,kBACA,sBAAsB,KAAK,OAC3B,mBACF;IACA,IAAI,MAAM,KAAK,QACb,MAAM,IACJ,MACA,qBACA,SACA,aACA,UACA,GAAG,MAAM,KAAK,KAAK,QAAQ,IAAI,IAAI,GAAG,KAAK,CAC7C;IACF,MAAM,QAAQ,oBAAoB,UAAU;IAC5C,MAAM,IAAI,MAAM,qBAAqB,UAAU,UAAU,wBAAwB,OAAO;IACxF,MAAM,OAAO,MAAM,QAAQ,WAAW;KACpC,KAAK;KACL,MAAM;MAAC;MAAM;MAAM;KAAsB;IAC3C,CAAC;IACD,MAAM,aAAa,OAAO,MAAM,KAAK,OAAO,CAAC;IAC7C,IACE,KAAK,aAAa,KAClB,CAAC,OAAO,cAAc,UAAU,KAChC,aAAa,KACb,aAAA,UAEA,MAAM,IAAI,MAAM,mCAAmC;IACrD,MAAM,OAAO,MAAM,QAAQ,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;IAC5E,IAAI,CAAC,QAAQ,KAAK,SAAA,UAA4B,MAAM,IAAI,MAAM,yBAAyB;IACvF,MAAM,SAAS,EAAE,QAAQ,KAAK,SAAS,QAAQ,EAAE;IACjD,kBAAkB,MAAM;IACxB,OAAO;GACT,CAAC;EACH;EACA,MAAM,KAAK,OAAO;GAChB,IACE,CAAC,aAAa,MAAM,MAAM,KAC1B,CAAC,iBAAiB,KAAK,MAAM,IAAI,KACjC,CAAC,iBAAiB,KAAK,MAAM,YAAY,GAEzC,MAAM,IAAI,MAAM,gCAAgC;GAClD,MAAM,SAAS,kBAAkB,MAAM,MAAM;GAC7C,MAAM,SAAS,MAAM,YAAY,OAAO,SAAS,KAAK,SAAS;IAC7D,MAAM,IAAI,QAAQ,UAAU,mBAAmB;IAC/C,MAAM,QAAQ,WAAW,CAAC;KAAE,MAAM;KAAwB,SAAS;IAAO,CAAC,CAAC;IAC5E,MAAM,IAAI,MAAM,qBAAqB,UAAU,UAAU,sBAAsB;IAC/E,MAAM,IACJ,MACA,qBACA,SACA,wBACA,2BACF;IACA,IACG,MAAM,IAAI,MAAM,qBAAqB,aAAa,sBAAsB,MAAO,MAAM,MAEtF,MAAM,IAAI,MAAM,mDAAmD;IACrE,MAAM,QAAQ,oBACZ,iBAAiB,MAAM,MAAM,QAAQ,MAAM;KAAE,YAAY;KAAM,QAAQ;IAAQ,CAAC,CAAC,CACnF;IACA,MAAM,IACJ,MACA,qBACA,QACA,iCAAiC,MAAM,OAAO,GAAG,MAAM,gBACvD,sBAAsB,KAAK,OAC3B,GAAG,MAAM,KAAK,cAAc,MAAM,QACpC;GACF,CAAC;EACH;CACF;AACF"}

package/dist/vercel.d.mts

@@ -1,4 +1,32 @@
+import { RepositorySlug } from "./schema/repository.mjs";
+import { WorkNotification, WorkNotifications } from "./store/work-notifications.mjs";
+import { VercelGitHubGitTransportOptions, VercelGitHubTokenInput, createVercelGitHubGitTransport } from "./vercel-git.mjs";
 //#region src/vercel.d.ts
+/** Provider delivery settings applied to one Vercel Queue message. */
+interface VercelQueueSendOptions {
+  region: string;
+  retentionSeconds: number;
+  idempotencyKey: string;
+  delaySeconds: number;
+}
+/** Injectable Vercel Queue send operation for one validated Factory work notification. */
+type VercelQueueSend = (topic: string, message: WorkNotification, options: VercelQueueSendOptions) => Promise<unknown>;
+/** Configures Vercel Queue transport, failure reporting, retention, and runtime guards. */
+interface VercelWorkQueueOptions {
+  send: VercelQueueSend;
+  onError(error: unknown, event: WorkNotification): void;
+  topic?: string;
+  region?: string;
+  retentionSeconds?: number;
+  environment?: Readonly<Record<string, string | undefined>>;
+}
+/** Publishes graph wakeups and exposes the hosted-runtime notification adapter. */
+interface VercelWorkQueue {
+  publish(event: WorkNotification, delaySeconds?: number): Promise<void>;
+  hostedNotifications(): WorkNotifications | undefined;
+}
+/** Configure graph wakeups over Vercel Queues without granting queue messages execution authority. */
+declare function createVercelWorkQueue(options: VercelWorkQueueOptions): VercelWorkQueue;
 /**
  * Verify a Vercel webhook signature (the x-vercel-signature header): an
  * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or
@@ -9,6 +37,7 @@ declare function verifyVercelSignature(options: {
   payload: string;
   signature: string | null;
 }): boolean;
+/** A normalized production deployment observation with optional Git commit identity. */
 interface VercelProductionDeployment {
   source: "vercel_production_deployment";
   deliveryId: string;
@@ -17,7 +46,7 @@ interface VercelProductionDeployment {
   deploymentUrl: string;
   projectId: string;
   /** owner/name from the deployment's git metadata; null for non-git deployments. */
-  repositorySlug: string | null;
+  repositorySlug: RepositorySlug | null;
   /** Commit the deployment was built from; null for non-git deployments. */
   commitSha: string | null;
 }
@@ -27,6 +56,8 @@ interface VercelProductionDeployment {
  * production. Returns null for other events and non-production targets.
  */
 declare function normalizeVercelProductionDeployment(payload: unknown): VercelProductionDeployment | null;
+/** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */
+declare function authenticateVercelUserToken(request: Request, fetcher?: typeof fetch): Promise<string | null>;
 //#endregion
-export { VercelProductionDeployment, normalizeVercelProductionDeployment, verifyVercelSignature };
+export { type VercelGitHubGitTransportOptions, type VercelGitHubTokenInput, VercelProductionDeployment, VercelQueueSend, VercelQueueSendOptions, VercelWorkQueue, VercelWorkQueueOptions, authenticateVercelUserToken, createVercelGitHubGitTransport, createVercelWorkQueue, normalizeVercelProductionDeployment, verifyVercelSignature };
 //# sourceMappingURL=vercel.d.mts.map

package/dist/vercel.mjs

@@ -1,6 +1,35 @@
-import { z } from "zod";
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { workNotificationSchema } from "./store/work-notifications.mjs";
+import { createVercelGitHubGitTransport } from "./vercel-git.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
 //#region src/vercel.ts
+/** Configure graph wakeups over Vercel Queues without granting queue messages execution authority. */
+function createVercelWorkQueue(options) {
+	const environment = options.environment ?? process.env;
+	const topic = options.topic ?? "factory-work";
+	const region = options.region ?? "iad1";
+	const retentionSeconds = options.retentionSeconds ?? 604800;
+	const hosted = () => environment.VERCEL === "1" && environment.FACTORY_LOCAL_TEST !== "1";
+	const publish = async (event, delaySeconds = 0) => {
+		if (!hosted()) throw new Error("Vercel work queues require a hosted, non-fixture runtime");
+		const message = workNotificationSchema.parse(event);
+		await options.send(topic, message, {
+			region,
+			retentionSeconds,
+			idempotencyKey: message.key,
+			delaySeconds
+		});
+	};
+	const notifications = {
+		publish,
+		onError: options.onError
+	};
+	return Object.freeze({
+		publish,
+		hostedNotifications: () => hosted() ? notifications : void 0
+	});
+}
 /**
 * Verify a Vercel webhook signature (the x-vercel-signature header): an
 * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or
@@ -45,6 +74,7 @@ function normalizeVercelProductionDeployment(payload) {
 	const meta = event.deployment.meta;
 	const org = meta?.githubCommitOrg ?? meta?.githubOrg;
 	const repo = meta?.githubCommitRepo ?? meta?.githubRepo;
+	const repositorySlug = org === void 0 || repo === void 0 ? null : repositorySlugSchema.safeParse(`${org}/${repo}`.toLowerCase()).data ?? null;
 	return {
 		source: "vercel_production_deployment",
 		deliveryId: parsed.data.id,
@@ -52,11 +82,26 @@ function normalizeVercelProductionDeployment(payload) {
 		deploymentId: event.deployment.id,
 		deploymentUrl: event.deployment.url,
 		projectId: event.project.id,
-		repositorySlug: org !== void 0 && repo !== void 0 ? `${org}/${repo}`.toLowerCase() : null,
+		repositorySlug,
 		commitSha: meta?.githubCommitSha ?? null
 	};
 }
+/** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */
+async function authenticateVercelUserToken(request, fetcher = fetch) {
+	const authorization = request.headers.get("authorization");
+	if (!authorization?.match(/^Bearer \S+$/u)) return null;
+	const response = await fetcher("https://api.vercel.com/v2/user", {
+		headers: { authorization },
+		cache: "no-store",
+		redirect: "error",
+		signal: AbortSignal.timeout(1e4)
+	});
+	if (response.status === 401 || response.status === 403) return null;
+	if (!response.ok) throw new Error(`Vercel identity lookup failed (${response.status})`);
+	const result = z.object({ user: z.object({ id: z.string().min(1) }) }).safeParse(await response.json());
+	return result.success ? `vercel:${result.data.user.id}` : null;
+}
 //#endregion
-export { normalizeVercelProductionDeployment, verifyVercelSignature };
+export { authenticateVercelUserToken, createVercelGitHubGitTransport, createVercelWorkQueue, normalizeVercelProductionDeployment, verifyVercelSignature };
 
 //# sourceMappingURL=vercel.mjs.map

package/dist/vercel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.mjs","names":[],"sources":["../src/vercel.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * Verify a Vercel webhook signature (the x-vercel-signature header): an\n * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or\n * malformed signatures instead of throwing.\n */\nexport function verifyVercelSignature(options: {\n  secret: string;\n  payload: string;\n  signature: string | null;\n}): boolean {\n  const { secret, payload, signature } = options;\n  if (signature === null || !/^[0-9a-f]{40}$/.test(signature)) {\n    return false;\n  }\n  const expected = createHmac(\"sha1\", secret).update(payload).digest(\"hex\");\n  return timingSafeEqual(Buffer.from(signature, \"hex\"), Buffer.from(expected, \"hex\"));\n}\n\nconst observedDeploymentEvents = new Set([\"deployment.succeeded\", \"deployment.promoted\"]);\n\nconst deploymentEventSchema = z.looseObject({\n  id: z.string().min(1),\n  type: z.string(),\n  payload: z.looseObject({\n    target: z.string().nullable().optional(),\n    project: z.looseObject({ id: z.string().min(1) }),\n    deployment: z.looseObject({\n      id: z.string().min(1),\n      url: z.string().min(1),\n      meta: z\n        .looseObject({\n          githubCommitSha: z.string().optional(),\n          githubCommitOrg: z.string().optional(),\n          githubCommitRepo: z.string().optional(),\n          githubOrg: z.string().optional(),\n          githubRepo: z.string().optional(),\n        })\n        .optional(),\n    }),\n  }),\n});\n\nexport interface VercelProductionDeployment {\n  source: \"vercel_production_deployment\";\n  deliveryId: string;\n  eventType: string;\n  deploymentId: string;\n  deploymentUrl: string;\n  projectId: string;\n  /** owner/name from the deployment's git metadata; null for non-git deployments. */\n  repositorySlug: string | null;\n  /** Commit the deployment was built from; null for non-git deployments. */\n  commitSha: string | null;\n}\n\n/**\n * Normalize a deployment.succeeded or deployment.promoted webhook for a\n * production deployment so the factory can observe a merge reaching\n * production. Returns null for other events and non-production targets.\n */\nexport function normalizeVercelProductionDeployment(\n  payload: unknown,\n): VercelProductionDeployment | null {\n  const parsed = deploymentEventSchema.safeParse(payload);\n  if (!parsed.success || !observedDeploymentEvents.has(parsed.data.type)) {\n    return null;\n  }\n  const event = parsed.data.payload;\n  if (event.target !== \"production\") {\n    return null;\n  }\n  const meta = event.deployment.meta;\n  const org = meta?.githubCommitOrg ?? meta?.githubOrg;\n  const repo = meta?.githubCommitRepo ?? meta?.githubRepo;\n  return {\n    source: \"vercel_production_deployment\",\n    deliveryId: parsed.data.id,\n    eventType: parsed.data.type,\n    deploymentId: event.deployment.id,\n    deploymentUrl: event.deployment.url,\n    projectId: event.project.id,\n    repositorySlug:\n      org !== undefined && repo !== undefined ? `${org}/${repo}`.toLowerCase() : null,\n    commitSha: meta?.githubCommitSha ?? null,\n  };\n}\n"],"mappings":";;;;;;;;AAQA,SAAgB,sBAAsB,SAI1B;CACV,MAAM,EAAE,QAAQ,SAAS,cAAc;CACvC,IAAI,cAAc,QAAQ,CAAC,iBAAiB,KAAK,SAAS,GACxD,OAAO;CAET,MAAM,WAAW,WAAW,QAAQ,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CACxE,OAAO,gBAAgB,OAAO,KAAK,WAAW,KAAK,GAAG,OAAO,KAAK,UAAU,KAAK,CAAC;AACpF;AAEA,MAAM,2CAA2B,IAAI,IAAI,CAAC,wBAAwB,qBAAqB,CAAC;AAExF,MAAM,wBAAwB,EAAE,YAAY;CAC1C,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,YAAY;EACrB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACvC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;EAChD,YAAY,EAAE,YAAY;GACxB,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACrB,MAAM,EACH,YAAY;IACX,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;IACtC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;IAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;GAClC,CAAC,CAAC,CACD,SAAS;EACd,CAAC;CACH,CAAC;AACH,CAAC;;;;;;AAoBD,SAAgB,oCACd,SACmC;CACnC,MAAM,SAAS,sBAAsB,UAAU,OAAO;CACtD,IAAI,CAAC,OAAO,WAAW,CAAC,yBAAyB,IAAI,OAAO,KAAK,IAAI,GACnE,OAAO;CAET,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,WAAW,cACnB,OAAO;CAET,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,MAAM,MAAM,mBAAmB,MAAM;CAC3C,MAAM,OAAO,MAAM,oBAAoB,MAAM;CAC7C,OAAO;EACL,QAAQ;EACR,YAAY,OAAO,KAAK;EACxB,WAAW,OAAO,KAAK;EACvB,cAAc,MAAM,WAAW;EAC/B,eAAe,MAAM,WAAW;EAChC,WAAW,MAAM,QAAQ;EACzB,gBACE,QAAQ,KAAA,KAAa,SAAS,KAAA,IAAY,GAAG,IAAI,GAAG,OAAO,YAAY,IAAI;EAC7E,WAAW,MAAM,mBAAmB;CACtC;AACF"}
+{"version":3,"file":"vercel.mjs","names":[],"sources":["../src/vercel.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport {\n  workNotificationSchema,\n  type WorkNotification,\n  type WorkNotifications,\n} from \"./store/work-notifications\";\n\n/** Provider delivery settings applied to one Vercel Queue message. */\nexport interface VercelQueueSendOptions {\n  region: string;\n  retentionSeconds: number;\n  idempotencyKey: string;\n  delaySeconds: number;\n}\n\n/** Injectable Vercel Queue send operation for one validated Factory work notification. */\nexport type VercelQueueSend = (\n  topic: string,\n  message: WorkNotification,\n  options: VercelQueueSendOptions,\n) => Promise<unknown>;\n\n/** Configures Vercel Queue transport, failure reporting, retention, and runtime guards. */\nexport interface VercelWorkQueueOptions {\n  send: VercelQueueSend;\n  onError(error: unknown, event: WorkNotification): void;\n  topic?: string;\n  region?: string;\n  retentionSeconds?: number;\n  environment?: Readonly<Record<string, string | undefined>>;\n}\n\n/** Publishes graph wakeups and exposes the hosted-runtime notification adapter. */\nexport interface VercelWorkQueue {\n  publish(event: WorkNotification, delaySeconds?: number): Promise<void>;\n  hostedNotifications(): WorkNotifications | undefined;\n}\n\nexport {\n  createVercelGitHubGitTransport,\n  type VercelGitHubGitTransportOptions,\n  type VercelGitHubTokenInput,\n} from \"./vercel-git\";\n\n/** Configure graph wakeups over Vercel Queues without granting queue messages execution authority. */\nexport function createVercelWorkQueue(options: VercelWorkQueueOptions): VercelWorkQueue {\n  const environment = options.environment ?? process.env;\n  const topic = options.topic ?? \"factory-work\";\n  const region = options.region ?? \"iad1\";\n  const retentionSeconds = options.retentionSeconds ?? 604_800;\n  const hosted = () => environment.VERCEL === \"1\" && environment.FACTORY_LOCAL_TEST !== \"1\";\n  const publish = async (event: WorkNotification, delaySeconds = 0): Promise<void> => {\n    if (!hosted()) throw new Error(\"Vercel work queues require a hosted, non-fixture runtime\");\n    const message = workNotificationSchema.parse(event);\n    await options.send(topic, message, {\n      region,\n      retentionSeconds,\n      idempotencyKey: message.key,\n      delaySeconds,\n    });\n  };\n  const notifications: WorkNotifications = { publish, onError: options.onError };\n  return Object.freeze({\n    publish,\n    hostedNotifications: () => (hosted() ? notifications : undefined),\n  });\n}\n\n/**\n * Verify a Vercel webhook signature (the x-vercel-signature header): an\n * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or\n * malformed signatures instead of throwing.\n */\nexport function verifyVercelSignature(options: {\n  secret: string;\n  payload: string;\n  signature: string | null;\n}): boolean {\n  const { secret, payload, signature } = options;\n  if (signature === null || !/^[0-9a-f]{40}$/.test(signature)) {\n    return false;\n  }\n  const expected = createHmac(\"sha1\", secret).update(payload).digest(\"hex\");\n  return timingSafeEqual(Buffer.from(signature, \"hex\"), Buffer.from(expected, \"hex\"));\n}\n\nconst observedDeploymentEvents = new Set([\"deployment.succeeded\", \"deployment.promoted\"]);\n\nconst deploymentEventSchema = z.looseObject({\n  id: z.string().min(1),\n  type: z.string(),\n  payload: z.looseObject({\n    target: z.string().nullable().optional(),\n    project: z.looseObject({ id: z.string().min(1) }),\n    deployment: z.looseObject({\n      id: z.string().min(1),\n      url: z.string().min(1),\n      meta: z\n        .looseObject({\n          githubCommitSha: z.string().optional(),\n          githubCommitOrg: z.string().optional(),\n          githubCommitRepo: z.string().optional(),\n          githubOrg: z.string().optional(),\n          githubRepo: z.string().optional(),\n        })\n        .optional(),\n    }),\n  }),\n});\n\n/** A normalized production deployment observation with optional Git commit identity. */\nexport interface VercelProductionDeployment {\n  source: \"vercel_production_deployment\";\n  deliveryId: string;\n  eventType: string;\n  deploymentId: string;\n  deploymentUrl: string;\n  projectId: string;\n  /** owner/name from the deployment's git metadata; null for non-git deployments. */\n  repositorySlug: RepositorySlug | null;\n  /** Commit the deployment was built from; null for non-git deployments. */\n  commitSha: string | null;\n}\n\n/**\n * Normalize a deployment.succeeded or deployment.promoted webhook for a\n * production deployment so the factory can observe a merge reaching\n * production. Returns null for other events and non-production targets.\n */\nexport function normalizeVercelProductionDeployment(\n  payload: unknown,\n): VercelProductionDeployment | null {\n  const parsed = deploymentEventSchema.safeParse(payload);\n  if (!parsed.success || !observedDeploymentEvents.has(parsed.data.type)) {\n    return null;\n  }\n  const event = parsed.data.payload;\n  if (event.target !== \"production\") {\n    return null;\n  }\n  const meta = event.deployment.meta;\n  const org = meta?.githubCommitOrg ?? meta?.githubOrg;\n  const repo = meta?.githubCommitRepo ?? meta?.githubRepo;\n  const repositorySlug =\n    org === undefined || repo === undefined\n      ? null\n      : (repositorySlugSchema.safeParse(`${org}/${repo}`.toLowerCase()).data ?? null);\n  return {\n    source: \"vercel_production_deployment\",\n    deliveryId: parsed.data.id,\n    eventType: parsed.data.type,\n    deploymentId: event.deployment.id,\n    deploymentUrl: event.deployment.url,\n    projectId: event.project.id,\n    repositorySlug,\n    commitSha: meta?.githubCommitSha ?? null,\n  };\n}\n\n/** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */\nexport async function authenticateVercelUserToken(\n  request: Request,\n  fetcher: typeof fetch = fetch,\n): Promise<string | null> {\n  const authorization = request.headers.get(\"authorization\");\n  if (!authorization?.match(/^Bearer \\S+$/u)) return null;\n  const response = await fetcher(\"https://api.vercel.com/v2/user\", {\n    headers: { authorization },\n    cache: \"no-store\",\n    redirect: \"error\",\n    signal: AbortSignal.timeout(10_000),\n  });\n  if (response.status === 401 || response.status === 403) return null;\n  if (!response.ok) throw new Error(`Vercel identity lookup failed (${response.status})`);\n  const result = z\n    .object({ user: z.object({ id: z.string().min(1) }) })\n    .safeParse(await response.json());\n  return result.success ? `vercel:${result.data.user.id}` : null;\n}\n"],"mappings":";;;;;;;AA+CA,SAAgB,sBAAsB,SAAkD;CACtF,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,eAAe,YAAY,WAAW,OAAO,YAAY,uBAAuB;CACtF,MAAM,UAAU,OAAO,OAAyB,eAAe,MAAqB;EAClF,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,0DAA0D;EACzF,MAAM,UAAU,uBAAuB,MAAM,KAAK;EAClD,MAAM,QAAQ,KAAK,OAAO,SAAS;GACjC;GACA;GACA,gBAAgB,QAAQ;GACxB;EACF,CAAC;CACH;CACA,MAAM,gBAAmC;EAAE;EAAS,SAAS,QAAQ;CAAQ;CAC7E,OAAO,OAAO,OAAO;EACnB;EACA,2BAA4B,OAAO,IAAI,gBAAgB,KAAA;CACzD,CAAC;AACH;;;;;;AAOA,SAAgB,sBAAsB,SAI1B;CACV,MAAM,EAAE,QAAQ,SAAS,cAAc;CACvC,IAAI,cAAc,QAAQ,CAAC,iBAAiB,KAAK,SAAS,GACxD,OAAO;CAET,MAAM,WAAW,WAAW,QAAQ,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CACxE,OAAO,gBAAgB,OAAO,KAAK,WAAW,KAAK,GAAG,OAAO,KAAK,UAAU,KAAK,CAAC;AACpF;AAEA,MAAM,2CAA2B,IAAI,IAAI,CAAC,wBAAwB,qBAAqB,CAAC;AAExF,MAAM,wBAAwB,EAAE,YAAY;CAC1C,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,YAAY;EACrB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACvC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;EAChD,YAAY,EAAE,YAAY;GACxB,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACrB,MAAM,EACH,YAAY;IACX,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;IACtC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;IAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;GAClC,CAAC,CAAC,CACD,SAAS;EACd,CAAC;CACH,CAAC;AACH,CAAC;;;;;;AAqBD,SAAgB,oCACd,SACmC;CACnC,MAAM,SAAS,sBAAsB,UAAU,OAAO;CACtD,IAAI,CAAC,OAAO,WAAW,CAAC,yBAAyB,IAAI,OAAO,KAAK,IAAI,GACnE,OAAO;CAET,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,WAAW,cACnB,OAAO;CAET,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,MAAM,MAAM,mBAAmB,MAAM;CAC3C,MAAM,OAAO,MAAM,oBAAoB,MAAM;CAC7C,MAAM,iBACJ,QAAQ,KAAA,KAAa,SAAS,KAAA,IAC1B,OACC,qBAAqB,UAAU,GAAG,IAAI,GAAG,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ;CAC9E,OAAO;EACL,QAAQ;EACR,YAAY,OAAO,KAAK;EACxB,WAAW,OAAO,KAAK;EACvB,cAAc,MAAM,WAAW;EAC/B,eAAe,MAAM,WAAW;EAChC,WAAW,MAAM,QAAQ;EACzB;EACA,WAAW,MAAM,mBAAmB;CACtC;AACF;;AAGA,eAAsB,4BACpB,SACA,UAAwB,OACA;CACxB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;CACzD,IAAI,CAAC,eAAe,MAAM,eAAe,GAAG,OAAO;CACnD,MAAM,WAAW,MAAM,QAAQ,kCAAkC;EAC/D,SAAS,EAAE,cAAc;EACzB,OAAO;EACP,UAAU;EACV,QAAQ,YAAY,QAAQ,GAAM;CACpC,CAAC;CACD,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK,OAAO;CAC/D,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kCAAkC,SAAS,OAAO,EAAE;CACtF,MAAM,SAAS,EACZ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACrD,UAAU,MAAM,SAAS,KAAK,CAAC;CAClC,OAAO,OAAO,UAAU,UAAU,OAAO,KAAK,KAAK,OAAO;AAC5D"}

package/dist/work-triage/eve-tool.d.mts

@@ -0,0 +1,29 @@
+import { RepositoryId } from "../schema/id.mjs";
+import { FactoryStores } from "../store/engine.mjs";
+import { ExistingWorkLookupOptions, ExistingWorkLookupResult } from "./find-existing-work.mjs";
+import { ToolContext, ToolDefinition } from "eve/tools";
+//#region src/work-triage/eve-tool.d.ts
+/** Change, repository, and Task capabilities required by the existing-work tool. */
+type FindExistingWorkToolStores = Pick<FactoryStores, "changes" | "repositories" | "tasks">;
+/** Stores and provider lookup used to construct the existing-work tool. */
+interface FindExistingWorkToolOptions extends ExistingWorkLookupOptions {
+  stores: FindExistingWorkToolStores;
+}
+/** Repository selected for a read-only existing-work lookup. */
+interface FindExistingWorkToolInput {
+  repositoryId: RepositoryId;
+}
+/** Eve tool that checks a repository for overlapping open work. */
+interface FindExistingWorkTool extends ToolDefinition<FindExistingWorkToolInput, ExistingWorkLookupResult> {
+  execute(input: FindExistingWorkToolInput, ctx: ToolContext): Promise<ExistingWorkLookupResult>;
+}
+/**
+ * Read-only triage helper: before delegating new work or accepting a signal,
+ * check whether an open pull request, a recorded Change, or an in-flight
+ * Task already covers the same repository, so Foreman does not duplicate
+ * work that is already underway.
+ */
+declare function createFindExistingWorkTool(input: FindExistingWorkToolOptions): FindExistingWorkTool;
+//#endregion
+export { FindExistingWorkTool, FindExistingWorkToolInput, FindExistingWorkToolOptions, FindExistingWorkToolStores, createFindExistingWorkTool };
+//# sourceMappingURL=eve-tool.d.mts.map

package/dist/work-triage/eve-tool.mjs

@@ -0,0 +1,32 @@
+import { repositoryIdSchema } from "../schema/id.mjs";
+import { repositoryIdsForSession } from "../eve/task-session.mjs";
+import { findExistingWork } from "./find-existing-work.mjs";
+import { z } from "zod";
+import { defineTool } from "eve/tools";
+//#region src/work-triage/eve-tool.ts
+/**
+* Read-only triage helper: before delegating new work or accepting a signal,
+* check whether an open pull request, a recorded Change, or an in-flight
+* Task already covers the same repository, so Foreman does not duplicate
+* work that is already underway.
+*/
+function createFindExistingWorkTool(input) {
+	const { stores, ...options } = input;
+	return defineTool({
+		description: "Check whether an open pull request, a recorded change, or an in-flight task already covers a repository's pending work. Call this before delegating new work or deciding a signal as accepted, so Factory does not duplicate work already underway. Read-only.",
+		inputSchema: z.object({ repositoryId: repositoryIdSchema.describe("Repository the pending signal or request is about.") }),
+		async execute({ repositoryId }, ctx) {
+			const binding = repositoryIdsForSession(ctx.session.auth.initiator);
+			if (binding !== null && !binding.includes(repositoryId)) throw new Error(`Repository ${repositoryId} is outside the connector-authenticated context.`);
+			return findExistingWork({
+				stores,
+				repositoryId,
+				...options
+			});
+		}
+	});
+}
+//#endregion
+export { createFindExistingWorkTool };
+
+//# sourceMappingURL=eve-tool.mjs.map

package/dist/work-triage/eve-tool.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-tool.mjs","names":[],"sources":["../../src/work-triage/eve-tool.ts"],"sourcesContent":["import { defineTool, type ToolContext, type ToolDefinition } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { repositoryIdSchema, type RepositoryId } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\nimport {\n  findExistingWork,\n  type ExistingWorkLookupOptions,\n  type ExistingWorkLookupResult,\n} from \"./find-existing-work\";\nimport { repositoryIdsForSession } from \"../eve/task-session\";\n\n/** Change, repository, and Task capabilities required by the existing-work tool. */\nexport type FindExistingWorkToolStores = Pick<FactoryStores, \"changes\" | \"repositories\" | \"tasks\">;\n\n/** Stores and provider lookup used to construct the existing-work tool. */\nexport interface FindExistingWorkToolOptions extends ExistingWorkLookupOptions {\n  stores: FindExistingWorkToolStores;\n}\n\n/** Repository selected for a read-only existing-work lookup. */\nexport interface FindExistingWorkToolInput {\n  repositoryId: RepositoryId;\n}\n\n/** Eve tool that checks a repository for overlapping open work. */\nexport interface FindExistingWorkTool extends ToolDefinition<\n  FindExistingWorkToolInput,\n  ExistingWorkLookupResult\n> {\n  execute(input: FindExistingWorkToolInput, ctx: ToolContext): Promise<ExistingWorkLookupResult>;\n}\n\n/**\n * Read-only triage helper: before delegating new work or accepting a signal,\n * check whether an open pull request, a recorded Change, or an in-flight\n * Task already covers the same repository, so Foreman does not duplicate\n * work that is already underway.\n */\nexport function createFindExistingWorkTool(\n  input: FindExistingWorkToolOptions,\n): FindExistingWorkTool {\n  const { stores, ...options } = input;\n  return defineTool({\n    description:\n      \"Check whether an open pull request, a recorded change, or an in-flight task already \" +\n      \"covers a repository's pending work. Call this before delegating new work or deciding a \" +\n      \"signal as accepted, so Factory does not duplicate work already underway. Read-only.\",\n    inputSchema: z.object({\n      repositoryId: repositoryIdSchema.describe(\n        \"Repository the pending signal or request is about.\",\n      ),\n    }),\n    async execute({ repositoryId }, ctx): Promise<ExistingWorkLookupResult> {\n      // The connector binding is an authorization envelope: a steered\n      // conversation must not read another repository's in-flight work.\n      const binding = repositoryIdsForSession(ctx.session.auth.initiator);\n      if (binding !== null && !binding.includes(repositoryId)) {\n        throw new Error(\n          `Repository ${repositoryId} is outside the connector-authenticated context.`,\n        );\n      }\n      return findExistingWork({ stores, repositoryId, ...options });\n    },\n  });\n}\n"],"mappings":";;;;;;;;;;;;AAsCA,SAAgB,2BACd,OACsB;CACtB,MAAM,EAAE,QAAQ,GAAG,YAAY;CAC/B,OAAO,WAAW;EAChB,aACE;EAGF,aAAa,EAAE,OAAO,EACpB,cAAc,mBAAmB,SAC/B,oDACF,EACF,CAAC;EACD,MAAM,QAAQ,EAAE,gBAAgB,KAAwC;GAGtE,MAAM,UAAU,wBAAwB,IAAI,QAAQ,KAAK,SAAS;GAClE,IAAI,YAAY,QAAQ,CAAC,QAAQ,SAAS,YAAY,GACpD,MAAM,IAAI,MACR,cAAc,aAAa,iDAC7B;GAEF,OAAO,iBAAiB;IAAE;IAAQ;IAAc,GAAG;GAAQ,CAAC;EAC9D;CACF,CAAC;AACH"}