@vercel/factory 0.0.14 → 0.0.15

package/dist/github-publication.d.mts

@@ -0,0 +1,198 @@
+import { TaskId } from "./schema/id.mjs";
+import { RepositorySlug } from "./schema/repository.mjs";
+import { AgentSessionId } from "./schema/session.mjs";
+import { GitHubGitTransport, GitTransferSandbox } from "./github-transfer.mjs";
+//#region src/github-publication.d.ts
+/** Minimal sandbox command boundary required by Git checkout and publication helpers. */
+interface SandboxGit {
+  run(options: SandboxGitCommandInput): PromiseLike<SandboxGitCommandResult>;
+}
+/** Shell command submitted through the minimal Git sandbox boundary. */
+interface SandboxGitCommandInput {
+  command: string;
+}
+/** Captured output and optional exit status from a sandbox Git command. */
+interface SandboxGitCommandResult {
+  stdout: string;
+  stderr?: string;
+  exitCode?: number;
+}
+/** Bounds applied while translating committed workspace changes into GitHub tree entries. */
+interface GitHubPublicationLimits {
+  maxChangedFiles?: number;
+  maxFileBytes?: number;
+}
+/** Repository-scoped credentials and transport for the GitHub publication client. */
+interface GitHubPublicationClientOptions {
+  repository: RepositorySlug;
+  token: string;
+  fetch?: typeof globalThis.fetch;
+}
+/** Pull-request snapshot used to reconcile idempotent publication effects. */
+interface GitHubPublicationPullRequest {
+  pullRequestNumber: number;
+  pullRequestUrl: string;
+  nodeId: string;
+  title: string;
+  body: string | null;
+  state: "open" | "closed";
+  draft: boolean;
+  head: {
+    branch: string;
+    sha: string;
+    repository: RepositorySlug | null;
+  };
+}
+/** Git Data and pull-request operations needed by supplied publication workflows. */
+interface GitHubPublicationClient {
+  commit(input: ReadGitHubCommitInput): Promise<GitHubCommit>;
+  branchHead(input: ReadGitHubBranchHeadInput): Promise<string | null>;
+  createTree(input: CreateGitHubTreeInput): Promise<string>;
+  createCommit(input: CreateGitHubCommitInput): Promise<string>;
+  createBranch(input: CreateGitHubBranchInput): Promise<void>;
+  updateBranch(input: UpdateGitHubBranchInput): Promise<void>;
+  createPullRequest(input: CreateGitHubPublicationPullRequestInput): Promise<CreatedGitHubPublicationPullRequest>;
+  pullRequest(input: ReadGitHubPullRequestInput): Promise<GitHubPublicationPullRequest>;
+  pullRequests(input: ListGitHubPublicationPullRequestsInput): Promise<readonly GitHubPublicationPullRequest[]>;
+  markReady(input: MarkGitHubPullRequestReadyInput): Promise<void>;
+}
+/** Exact commit requested from GitHub's Git Data API. */
+interface ReadGitHubCommitInput {
+  sha: string;
+}
+/** Tree and parents recorded for one GitHub commit. */
+interface GitHubCommit {
+  treeSha: string;
+  parentShas: readonly string[];
+}
+/** Exact branch whose current GitHub head should be read. */
+interface ReadGitHubBranchHeadInput {
+  branch: string;
+}
+/** Base tree and exclusive file operations used to create a GitHub tree. */
+interface CreateGitHubTreeInput {
+  baseTreeSha: string;
+  entries: readonly GitHubTreeEntry[];
+}
+/** Commit content and parent identities used to create a GitHub commit. */
+interface CreateGitHubCommitInput {
+  message: string;
+  treeSha: string;
+  parentShas: readonly string[];
+}
+/** Branch and commit identity used to create a GitHub branch. */
+interface CreateGitHubBranchInput {
+  branch: string;
+  sha: string;
+}
+/** Branch update and force policy used to move a GitHub branch. */
+interface UpdateGitHubBranchInput extends CreateGitHubBranchInput {
+  force: boolean;
+}
+/** Provider-owned pull-request number to read. */
+interface ReadGitHubPullRequestInput {
+  pullRequestNumber: number;
+}
+/** Provider GraphQL node identity of a draft pull request to mark ready. */
+interface MarkGitHubPullRequestReadyInput {
+  nodeId: string;
+}
+/** Pull-request presentation and branch inputs used during GitHub publication. */
+interface CreateGitHubPublicationPullRequestInput {
+  title: string;
+  body: string;
+  head: string;
+  base: string;
+  draft: boolean;
+}
+/** Provider identity and draft state returned after creating a pull request. */
+interface CreatedGitHubPublicationPullRequest {
+  pullRequestNumber: number;
+  pullRequestUrl: string;
+  draft: boolean;
+}
+/** State and optional exact head filter used to list publication pull requests. */
+interface ListGitHubPublicationPullRequestsInput {
+  state: "open" | "all";
+  head?: string;
+}
+/** GitHub publication failure that preserves the provider HTTP status. */
+declare class GitHubPublicationApiError extends Error {
+  readonly status: number;
+  constructor(status: number, message: string);
+}
+interface GitHubTreeEntryBase {
+  path: string;
+  mode: "100644" | "100755";
+  type: "blob";
+}
+/** File content uploaded through GitHub's Git Data API. */
+interface GitHubTreeUpsert extends GitHubTreeEntryBase {
+  content: string;
+  sha?: never;
+}
+/** Existing file removed through GitHub's Git Data API. */
+interface GitHubTreeDeletion extends GitHubTreeEntryBase {
+  sha: null;
+  content?: never;
+}
+/** Exclusive bounded file upsert or deletion accepted by GitHub's Git Data API. */
+type GitHubTreeEntry = GitHubTreeUpsert | GitHubTreeDeletion;
+/** Committed workspace delta represented against a specific base commit. */
+interface CommittedGitChange {
+  base: string;
+  tree: readonly GitHubTreeEntry[];
+  changedFiles: number;
+}
+/** Sandbox, repository, and bounds for reading a committed workspace delta. */
+interface ReadCommittedGitChangeInput extends GitHubPublicationLimits {
+  sandbox: SandboxGit;
+  repositorySlug: RepositorySlug;
+  baseRef?: string;
+  allowEmpty?: boolean;
+}
+/** Common dependencies for an authorized repository checkout. */
+interface CheckoutGitHubRepositoryBaseInput {
+  sandbox: GitTransferSandbox;
+  repositorySlug: RepositorySlug;
+  transport: GitHubGitTransport;
+}
+/** Authorized repository checkout with recovery options that require a branch to resume. */
+type CheckoutGitHubRepositoryInput = CheckoutGitHubRepositoryBaseInput & ({
+  resumeBranch?: never;
+  rememberPublishedHead?: never;
+} | {
+  /** Resume this remote branch when it exists after refreshing the default branch. */
+  resumeBranch: string;
+  /** Remember the resumed remote head for later publication reconciliation. */
+  rememberPublishedHead?: true;
+});
+/** Refusal raised when an existing sandbox checkout points at another repository. */
+declare class GitHubCheckoutConflictError extends Error {
+  readonly existingOrigin: string;
+  readonly expectedOrigin: string;
+  constructor(existingOrigin: string, expectedOrigin: string);
+}
+/** GitHub Git Data and pull-request operations used by publication workflows. */
+declare function createGitHubPublicationClient(options: GitHubPublicationClientOptions): GitHubPublicationClient;
+/** Derive the deterministic publication branch owned by a durable Task. */
+declare function factoryTaskBranch(taskId: TaskId): string;
+/** Derive the deterministic publication branch owned by an operator session. */
+declare function factorySessionBranch(sessionId: AgentSessionId): string;
+/** Check whether a Git reference is safe to interpolate into supplied Git commands. */
+declare function isSafeGitRef(ref: string): boolean;
+/** Clone or refresh one authorized GitHub repository without retaining credentials. */
+declare function checkoutGitHubRepository(input: CheckoutGitHubRepositoryInput): Promise<void>;
+/** Sandbox and argument vector for one Git command in a repository checkout. */
+interface RunSandboxGitInput {
+  sandbox: SandboxGit;
+  args: readonly string[];
+  repositoryPath?: string;
+}
+/** Run a Git argument vector in a sandbox repository and reject nonzero exits. */
+declare function runSandboxGit(input: RunSandboxGitInput): Promise<string>;
+/** Read committed sandbox changes as a bounded GitHub Git Data API tree. */
+declare function readCommittedGitChange(input: ReadCommittedGitChangeInput): Promise<CommittedGitChange>;
+//#endregion
+export { CheckoutGitHubRepositoryInput, CommittedGitChange, CreateGitHubBranchInput, CreateGitHubCommitInput, CreateGitHubPublicationPullRequestInput, CreateGitHubTreeInput, CreatedGitHubPublicationPullRequest, GitHubCheckoutConflictError, GitHubCommit, GitHubPublicationApiError, GitHubPublicationClient, GitHubPublicationClientOptions, GitHubPublicationLimits, GitHubPublicationPullRequest, GitHubTreeDeletion, GitHubTreeEntry, GitHubTreeUpsert, ListGitHubPublicationPullRequestsInput, MarkGitHubPullRequestReadyInput, ReadCommittedGitChangeInput, ReadGitHubBranchHeadInput, ReadGitHubCommitInput, ReadGitHubPullRequestInput, RunSandboxGitInput, SandboxGit, SandboxGitCommandInput, SandboxGitCommandResult, UpdateGitHubBranchInput, checkoutGitHubRepository, createGitHubPublicationClient, factorySessionBranch, factoryTaskBranch, isSafeGitRef, readCommittedGitChange, runSandboxGit };
+//# sourceMappingURL=github-publication.d.mts.map

package/dist/github-publication.mjs

@@ -0,0 +1,429 @@
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { agentSessionIdSchema } from "./schema/session.mjs";
+import { quoteShellArgument, runSandboxCommand, withSandboxGitBundle } from "./github-transfer.mjs";
+import { z } from "zod";
+//#region src/github-publication.ts
+/** GitHub publication failure that preserves the provider HTTP status. */
+var GitHubPublicationApiError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(`GitHub API request failed (${status}): ${message}`);
+		this.status = status;
+		this.name = "GitHubPublicationApiError";
+	}
+};
+/** Refusal raised when an existing sandbox checkout points at another repository. */
+var GitHubCheckoutConflictError = class extends Error {
+	existingOrigin;
+	expectedOrigin;
+	constructor(existingOrigin, expectedOrigin) {
+		super(`sandbox checkout ${existingOrigin} does not match ${expectedOrigin}`);
+		this.existingOrigin = existingOrigin;
+		this.expectedOrigin = expectedOrigin;
+		this.name = "GitHubCheckoutConflictError";
+	}
+};
+const safePathPattern = /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u;
+const safeRefPattern = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/u;
+const allowedModes = /* @__PURE__ */ new Set(["100644", "100755"]);
+const gitHubApiUrl = "https://api.github.com";
+const shaSchema = z.string().min(1);
+const pullRequestSchema = z.object({
+	number: z.number().int().positive(),
+	html_url: z.url(),
+	node_id: z.string().min(1),
+	title: z.string(),
+	body: z.string().nullable(),
+	state: z.enum(["open", "closed"]),
+	draft: z.boolean(),
+	head: z.object({
+		ref: z.string().min(1),
+		sha: shaSchema,
+		repo: z.object({ full_name: z.string().min(1) }).nullable()
+	})
+});
+/** GitHub Git Data and pull-request operations used by publication workflows. */
+function createGitHubPublicationClient(options) {
+	const repository = repositorySlugSchema.parse(options.repository.toLowerCase());
+	const request = async (path, init = {}) => {
+		let response;
+		try {
+			response = await (options.fetch ?? globalThis.fetch)(`${gitHubApiUrl}/repos/${repository}${path}`, {
+				...init,
+				headers: {
+					Accept: "application/vnd.github+json",
+					Authorization: `Bearer ${options.token}`,
+					"Content-Type": "application/json",
+					"X-GitHub-Api-Version": "2022-11-28",
+					...init.headers
+				}
+			});
+		} catch (error) {
+			throw new Error("GitHub API request failed", { cause: error });
+		}
+		const body = await response.json().catch(() => null);
+		if (!response.ok) {
+			const parsed = z.object({ message: z.string() }).safeParse(body);
+			throw new GitHubPublicationApiError(response.status, parsed.success ? parsed.data.message : response.statusText);
+		}
+		return body;
+	};
+	const graphql = async (query, variables) => {
+		let response;
+		try {
+			response = await (options.fetch ?? globalThis.fetch)(`${gitHubApiUrl}/graphql`, {
+				method: "POST",
+				headers: {
+					Accept: "application/vnd.github+json",
+					Authorization: `Bearer ${options.token}`,
+					"Content-Type": "application/json",
+					"X-GitHub-Api-Version": "2022-11-28"
+				},
+				body: JSON.stringify({
+					query,
+					variables
+				})
+			});
+		} catch (error) {
+			throw new Error("GitHub GraphQL request failed", { cause: error });
+		}
+		const body = await response.json().catch(() => null);
+		const parsed = z.object({ errors: z.array(z.object({ message: z.string() })).optional() }).safeParse(body);
+		if (!response.ok || parsed.success && parsed.data.errors?.length) throw new GitHubPublicationApiError(response.status, parsed.success && parsed.data.errors?.[0] !== void 0 ? parsed.data.errors[0].message : response.statusText);
+	};
+	const parsePullRequest = (value) => {
+		const pull = pullRequestSchema.parse(value);
+		return {
+			pullRequestNumber: pull.number,
+			pullRequestUrl: pull.html_url,
+			nodeId: pull.node_id,
+			title: pull.title,
+			body: pull.body,
+			state: pull.state,
+			draft: pull.draft,
+			head: {
+				branch: pull.head.ref,
+				sha: pull.head.sha,
+				repository: pull.head.repo === null ? null : repositorySlugSchema.parse(pull.head.repo.full_name.toLowerCase())
+			}
+		};
+	};
+	const branchPath = (branch) => {
+		if (!isSafeGitRef(branch)) throw new Error(`refusing to use unsafe branch name: ${branch}`);
+		return branch;
+	};
+	return {
+		async commit(input) {
+			const commit = z.object({
+				tree: z.object({ sha: shaSchema }),
+				parents: z.array(z.object({ sha: shaSchema }))
+			}).parse(await request(`/git/commits/${encodeURIComponent(input.sha)}`));
+			return {
+				treeSha: commit.tree.sha,
+				parentShas: commit.parents.map((parent) => parent.sha)
+			};
+		},
+		async branchHead(input) {
+			try {
+				return z.object({ object: z.object({ sha: shaSchema }) }).parse(await request(`/git/ref/heads/${branchPath(input.branch)}`)).object.sha;
+			} catch (error) {
+				if (error instanceof GitHubPublicationApiError && error.status === 404) return null;
+				throw error;
+			}
+		},
+		async createTree(input) {
+			return z.object({ sha: shaSchema }).parse(await request("/git/trees", {
+				method: "POST",
+				body: JSON.stringify({
+					base_tree: input.baseTreeSha,
+					tree: input.entries
+				})
+			})).sha;
+		},
+		async createCommit(input) {
+			return z.object({ sha: shaSchema }).parse(await request("/git/commits", {
+				method: "POST",
+				body: JSON.stringify({
+					message: input.message,
+					tree: input.treeSha,
+					parents: input.parentShas
+				})
+			})).sha;
+		},
+		async createBranch(input) {
+			await request("/git/refs", {
+				method: "POST",
+				body: JSON.stringify({
+					ref: `refs/heads/${branchPath(input.branch)}`,
+					sha: input.sha
+				})
+			});
+		},
+		async updateBranch(input) {
+			await request(`/git/refs/heads/${branchPath(input.branch)}`, {
+				method: "PATCH",
+				body: JSON.stringify({
+					sha: input.sha,
+					force: input.force
+				})
+			});
+		},
+		async createPullRequest(input) {
+			const pull = z.object({
+				number: z.number().int().positive(),
+				html_url: z.url(),
+				draft: z.boolean()
+			}).parse(await request("/pulls", {
+				method: "POST",
+				body: JSON.stringify(input)
+			}));
+			return {
+				pullRequestNumber: pull.number,
+				pullRequestUrl: pull.html_url,
+				draft: pull.draft
+			};
+		},
+		async pullRequest(input) {
+			return parsePullRequest(await request(`/pulls/${input.pullRequestNumber}`));
+		},
+		async pullRequests(input) {
+			const query = new URLSearchParams({
+				state: input.state,
+				per_page: "100"
+			});
+			if (input.head !== void 0) query.set("head", input.head);
+			return z.array(pullRequestSchema).parse(await request(`/pulls?${query.toString()}`)).map(parsePullRequest);
+		},
+		async markReady(input) {
+			await graphql("mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { clientMutationId } }", { id: input.nodeId });
+		}
+	};
+}
+/** Derive the deterministic publication branch owned by a durable Task. */
+function factoryTaskBranch(taskId) {
+	return `factory/${taskId}`;
+}
+/** Derive the deterministic publication branch owned by an operator session. */
+function factorySessionBranch(sessionId) {
+	return `factory/${agentSessionIdSchema.parse(sessionId)}`;
+}
+/** Check whether a Git reference is safe to interpolate into supplied Git commands. */
+function isSafeGitRef(ref) {
+	return safeRefPattern.test(ref) && !ref.includes("..");
+}
+/** Clone or refresh one authorized GitHub repository without retaining credentials. */
+async function checkoutGitHubRepository(input) {
+	const slug = repositorySlugSchema.parse(input.repositorySlug.toLowerCase());
+	const expectedOrigin = `https://github.com/${slug}.git`;
+	const checkout = await input.sandbox.run({ command: "test -d repo/.git" });
+	const existingOrigin = checkout.exitCode === void 0 || checkout.exitCode === 0 ? (await runSandboxCommand(input.sandbox, [
+		"git",
+		"-C",
+		"repo",
+		"remote",
+		"get-url",
+		"origin"
+	])).trim() : "";
+	if (existingOrigin !== "" && existingOrigin.toLowerCase() !== expectedOrigin) throw new GitHubCheckoutConflictError(existingOrigin, expectedOrigin);
+	const resume = input.resumeBranch;
+	if (resume !== void 0 && !isSafeGitRef(resume)) throw new Error(`refusing to resume unsafe branch name: ${resume}`);
+	const bundle = await input.transport.fetch({
+		repository: slug,
+		refs: []
+	});
+	await withSandboxGitBundle({
+		sandbox: input.sandbox,
+		bundle,
+		async use(path) {
+			if (existingOrigin === "") {
+				await runSandboxCommand(input.sandbox, [
+					"git",
+					"clone",
+					path,
+					"repo"
+				]);
+				await runSandboxCommand(input.sandbox, [
+					"git",
+					"-C",
+					"repo",
+					"remote",
+					"set-url",
+					"origin",
+					expectedOrigin
+				]);
+				await runSandboxCommand(input.sandbox, [
+					"git",
+					"-C",
+					"repo",
+					"config",
+					"user.name",
+					"factory"
+				]);
+				await runSandboxCommand(input.sandbox, [
+					"git",
+					"-C",
+					"repo",
+					"config",
+					"user.email",
+					"factory@localhost"
+				]);
+			} else {
+				await runSandboxCommand(input.sandbox, [
+					"git",
+					"-C",
+					"repo",
+					"fetch",
+					path,
+					"+refs/heads/*:refs/remotes/origin/*"
+				]);
+				await runSandboxCommand(input.sandbox, [
+					"git",
+					"-C",
+					"repo",
+					"reset",
+					"--hard",
+					"origin/HEAD"
+				]);
+			}
+			if (resume === void 0) return;
+			if ((await input.sandbox.run({ command: [
+				"git",
+				"-C",
+				"repo",
+				"show-ref",
+				"--verify",
+				"--quiet",
+				`refs/remotes/origin/${resume}`
+			].map(quoteShellArgument).join(" ") })).exitCode !== 0) return;
+			await runSandboxCommand(input.sandbox, [
+				"git",
+				"-C",
+				"repo",
+				"checkout",
+				"-B",
+				resume,
+				`refs/remotes/origin/${resume}`
+			]);
+			if (input.rememberPublishedHead === true) {
+				const head = (await runSandboxCommand(input.sandbox, [
+					"git",
+					"-C",
+					"repo",
+					"rev-parse",
+					"HEAD"
+				])).trim();
+				await runSandboxCommand(input.sandbox, [
+					"git",
+					"-C",
+					"repo",
+					"config",
+					"factory.publishedHead",
+					head
+				]);
+			}
+		}
+	});
+}
+/** Run a Git argument vector in a sandbox repository and reject nonzero exits. */
+function runSandboxGit(input) {
+	return runSandboxCommand(input.sandbox, [
+		"git",
+		"-C",
+		input.repositoryPath ?? "repo",
+		...input.args
+	]);
+}
+/** Read committed sandbox changes as a bounded GitHub Git Data API tree. */
+async function readCommittedGitChange(input) {
+	const repositorySlug = repositorySlugSchema.parse(input.repositorySlug.toLowerCase());
+	const baseRef = input.baseRef ?? "origin/HEAD";
+	if (!isSafeGitRef(baseRef)) throw new Error(`refusing to read unsafe base ref: ${baseRef}`);
+	const maxChangedFiles = input.maxChangedFiles ?? 25;
+	const maxFileBytes = input.maxFileBytes ?? 2e5;
+	if (!Number.isSafeInteger(maxChangedFiles) || maxChangedFiles < 1) throw new Error("maxChangedFiles must be a positive integer");
+	if (!Number.isSafeInteger(maxFileBytes) || maxFileBytes < 1) throw new Error("maxFileBytes must be a positive integer");
+	if ((await runSandboxGit({
+		sandbox: input.sandbox,
+		args: [
+			"remote",
+			"get-url",
+			"origin"
+		]
+	})).trim() !== `https://github.com/${repositorySlug}.git`) throw new Error(`sandbox checkout does not match task repository ${repositorySlug}`);
+	const head = (await runSandboxGit({
+		sandbox: input.sandbox,
+		args: ["rev-parse", "HEAD"]
+	})).trim();
+	const base = (await runSandboxGit({
+		sandbox: input.sandbox,
+		args: ["rev-parse", baseRef]
+	})).trim();
+	if (head === base && input.allowEmpty !== true) throw new Error("no local commits to publish; commit your changes in the repo first");
+	const nameStatus = (await runSandboxGit({
+		sandbox: input.sandbox,
+		args: [
+			"diff",
+			"--name-status",
+			base,
+			head
+		]
+	})).trim();
+	const upserts = [];
+	const deletions = [];
+	for (const line of nameStatus.split("\n").filter(Boolean)) {
+		const fields = line.split("	");
+		const status = fields[0] ?? "";
+		if (status === "A" || status === "M" || status === "T") upserts.push(requireSafePath(fields[1]));
+		else if (status === "D") deletions.push(requireSafePath(fields[1]));
+		else if (status.startsWith("R") || status.startsWith("C")) {
+			if (status.startsWith("R")) deletions.push(requireSafePath(fields[1]));
+			upserts.push(requireSafePath(fields[2]));
+		} else throw new Error(`unsupported change status "${status}" in ${line}`);
+	}
+	const changedFiles = upserts.length + deletions.length;
+	if (changedFiles === 0 && input.allowEmpty !== true) throw new Error("the local commits contain no file changes");
+	if (changedFiles > maxChangedFiles) throw new Error(`too many changed files (${changedFiles} > ${maxChangedFiles})`);
+	const tree = [];
+	for (const path of upserts) {
+		const mode = (await runSandboxGit({
+			sandbox: input.sandbox,
+			args: [
+				"ls-tree",
+				head,
+				"--",
+				path
+			]
+		})).trim().split(" ")[0];
+		if (mode === void 0 || !allowedModes.has(mode)) throw new Error(`unsupported file mode ${mode || "(none)"} for ${path}`);
+		const content = await runSandboxGit({
+			sandbox: input.sandbox,
+			args: ["show", `${head}:${path}`]
+		});
+		if (Buffer.byteLength(content, "utf8") > maxFileBytes) throw new Error(`${path} exceeds the ${maxFileBytes} byte publication limit`);
+		tree.push({
+			path,
+			mode,
+			type: "blob",
+			content
+		});
+	}
+	for (const path of deletions) tree.push({
+		path,
+		mode: "100644",
+		type: "blob",
+		sha: null
+	});
+	return {
+		base,
+		tree,
+		changedFiles
+	};
+}
+function requireSafePath(path) {
+	if (path === void 0 || path === "" || !safePathPattern.test(path) || path.includes("..")) throw new Error(`refusing to publish unsafe path: ${path ?? "(missing)"}`);
+	return path;
+}
+//#endregion
+export { GitHubCheckoutConflictError, GitHubPublicationApiError, checkoutGitHubRepository, createGitHubPublicationClient, factorySessionBranch, factoryTaskBranch, isSafeGitRef, readCommittedGitChange, runSandboxGit };
+
+//# sourceMappingURL=github-publication.mjs.map