@vercel/factory 0.0.14 → 0.0.15

package/dist/workspace-snapshot.mjs

@@ -0,0 +1,80 @@
+import { z } from "zod";
+//#region src/workspace-snapshot.ts
+/** Validates the bounded committed-tree snapshot captured inside an execution workspace. */
+const workspaceSnapshotSchema = z.object({
+	truncated: z.boolean(),
+	files: z.array(z.object({
+		path: z.string(),
+		oldMode: z.string().nullable(),
+		newMode: z.string().nullable(),
+		oldSha: z.string().nullable(),
+		newSha: z.string().nullable(),
+		content: z.string().max(2e5).nullable(),
+		binary: z.boolean(),
+		omitted: z.boolean()
+	})).max(200).readonly()
+});
+/**
+* Captures a bounded committed-tree snapshot using only sandbox Node.js built-ins without
+* writing the checkout or Git index.
+*/
+const workspaceSnapshotScript = String.raw`
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const input = JSON.parse(fs.readFileSync(process.argv[1], 'utf8'));
+const root = input.root;
+const started = Date.now();
+const runGit = (args, encoding) => execFileSync('git', ['--no-optional-locks', '-c', 'core.fsmonitor=false', ...args], { cwd: root, timeout: 10000, maxBuffer: 16000000, encoding, env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' } });
+const git = (args) => runGit(args, 'utf8');
+const safe = (p) => p && !path.isAbsolute(p) && !p.split('/').some((v) => v === '..' || v === '.' || v.toLowerCase() === '.git' || !v);
+function tree(ref) {
+  const entries = new Map();
+  for (const line of git(['ls-tree', '-rz', '-r', '--long', '--full-tree', ref]).split('\0').filter(Boolean)) {
+    const match = /^(\d+) (\w+) ([a-f0-9]+)\s+(-|\d+)\t([\s\S]+)$/u.exec(line);
+    if (!match || !safe(match[5])) throw new Error('Invalid repository tree');
+    entries.set(match[5], { mode: match[1], type: match[2], sha: match[3], size: match[4] === '-' ? null : Number(match[4]) });
+  }
+  return entries;
+}
+function entryBytes(entry) {
+  if (!entry) return Buffer.alloc(0);
+  if (entry.type !== 'blob' || entry.size === null || entry.size > 200000) return null;
+  return runGit(['cat-file', 'blob', entry.sha], null);
+}
+function text(data) {
+  if (data === null) return { content: null, binary: false };
+  if (data.includes(0)) return { content: null, binary: true };
+  try { return { content: new TextDecoder('utf-8', { fatal: true }).decode(data), binary: false }; }
+  catch { return { content: null, binary: true }; }
+}
+try {
+  if (fs.realpathSync(root) !== root || !fs.lstatSync(path.join(root, '.git')).isDirectory()) throw new Error('Workspace checkout unavailable');
+  if (!/^[a-f0-9]{40,64}$/u.test(input.headSha) || git(['rev-parse', '--verify', input.headSha + '^{commit}']).trim() !== input.headSha) throw new Error('Invalid branch head');
+  const base = new Map(input.tree.map((file) => [file.path, file]));
+  const head = tree(input.headSha);
+  const paths = [...new Set([...base.keys(), ...head.keys()])].sort();
+  const files = [];
+  let truncated = false, bytes = 0;
+  for (const p of paths) {
+    if (!safe(p)) throw new Error('Invalid repository path');
+    if (Date.now() - started > 15000 || files.length >= 200) { truncated = true; break; }
+    const before = base.get(p);
+    const after = head.get(p);
+    if (before && after && before.sha === after.sha && before.mode === after.mode) continue;
+    const decoded = text(entryBytes(after));
+    if (decoded.content !== null) bytes += Buffer.byteLength(decoded.content);
+    const omitted = Boolean(after && decoded.content === null && !decoded.binary) || bytes > 2000000 || before?.mode === '160000' || after?.mode === '160000';
+    files.push({ path: p, oldMode: before?.mode ?? null, newMode: after?.mode ?? null, oldSha: before?.sha ?? null, newSha: after?.sha ?? null, content: omitted ? null : decoded.content, binary: decoded.binary, omitted });
+    if (bytes > 2000000) truncated = true;
+  }
+  process.stdout.write(JSON.stringify({ files, truncated }));
+} catch (error) {
+  process.stderr.write('Workspace inspection failed\n');
+  process.exitCode = 1;
+}
+`;
+//#endregion
+export { workspaceSnapshotSchema, workspaceSnapshotScript };
+
+//# sourceMappingURL=workspace-snapshot.mjs.map

package/dist/workspace-snapshot.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-snapshot.mjs","names":[],"sources":["../src/workspace-snapshot.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Validates the bounded committed-tree snapshot captured inside an execution workspace. */\nexport const workspaceSnapshotSchema = z.object({\n  truncated: z.boolean(),\n  files: z\n    .array(\n      z.object({\n        path: z.string(),\n        oldMode: z.string().nullable(),\n        newMode: z.string().nullable(),\n        oldSha: z.string().nullable(),\n        newSha: z.string().nullable(),\n        content: z.string().max(200_000).nullable(),\n        binary: z.boolean(),\n        omitted: z.boolean(),\n      }),\n    )\n    .max(200)\n    .readonly(),\n});\n\n/** A bounded committed-tree snapshot captured inside an execution workspace. */\nexport type WorkspaceSnapshot = z.infer<typeof workspaceSnapshotSchema>;\n\n/**\n * Captures a bounded committed-tree snapshot using only sandbox Node.js built-ins without\n * writing the checkout or Git index.\n */\nexport const workspaceSnapshotScript = String.raw`\nconst fs = require('node:fs');\nconst path = require('node:path');\nconst { execFileSync } = require('node:child_process');\nconst input = JSON.parse(fs.readFileSync(process.argv[1], 'utf8'));\nconst root = input.root;\nconst started = Date.now();\nconst runGit = (args, encoding) => execFileSync('git', ['--no-optional-locks', '-c', 'core.fsmonitor=false', ...args], { cwd: root, timeout: 10000, maxBuffer: 16000000, encoding, env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' } });\nconst git = (args) => runGit(args, 'utf8');\nconst safe = (p) => p && !path.isAbsolute(p) && !p.split('/').some((v) => v === '..' || v === '.' || v.toLowerCase() === '.git' || !v);\nfunction tree(ref) {\n  const entries = new Map();\n  for (const line of git(['ls-tree', '-rz', '-r', '--long', '--full-tree', ref]).split('\\0').filter(Boolean)) {\n    const match = /^(\\d+) (\\w+) ([a-f0-9]+)\\s+(-|\\d+)\\t([\\s\\S]+)$/u.exec(line);\n    if (!match || !safe(match[5])) throw new Error('Invalid repository tree');\n    entries.set(match[5], { mode: match[1], type: match[2], sha: match[3], size: match[4] === '-' ? null : Number(match[4]) });\n  }\n  return entries;\n}\nfunction entryBytes(entry) {\n  if (!entry) return Buffer.alloc(0);\n  if (entry.type !== 'blob' || entry.size === null || entry.size > 200000) return null;\n  return runGit(['cat-file', 'blob', entry.sha], null);\n}\nfunction text(data) {\n  if (data === null) return { content: null, binary: false };\n  if (data.includes(0)) return { content: null, binary: true };\n  try { return { content: new TextDecoder('utf-8', { fatal: true }).decode(data), binary: false }; }\n  catch { return { content: null, binary: true }; }\n}\ntry {\n  if (fs.realpathSync(root) !== root || !fs.lstatSync(path.join(root, '.git')).isDirectory()) throw new Error('Workspace checkout unavailable');\n  if (!/^[a-f0-9]{40,64}$/u.test(input.headSha) || git(['rev-parse', '--verify', input.headSha + '^{commit}']).trim() !== input.headSha) throw new Error('Invalid branch head');\n  const base = new Map(input.tree.map((file) => [file.path, file]));\n  const head = tree(input.headSha);\n  const paths = [...new Set([...base.keys(), ...head.keys()])].sort();\n  const files = [];\n  let truncated = false, bytes = 0;\n  for (const p of paths) {\n    if (!safe(p)) throw new Error('Invalid repository path');\n    if (Date.now() - started > 15000 || files.length >= 200) { truncated = true; break; }\n    const before = base.get(p);\n    const after = head.get(p);\n    if (before && after && before.sha === after.sha && before.mode === after.mode) continue;\n    const decoded = text(entryBytes(after));\n    if (decoded.content !== null) bytes += Buffer.byteLength(decoded.content);\n    const omitted = Boolean(after && decoded.content === null && !decoded.binary) || bytes > 2000000 || before?.mode === '160000' || after?.mode === '160000';\n    files.push({ path: p, oldMode: before?.mode ?? null, newMode: after?.mode ?? null, oldSha: before?.sha ?? null, newSha: after?.sha ?? null, content: omitted ? null : decoded.content, binary: decoded.binary, omitted });\n    if (bytes > 2000000) truncated = true;\n  }\n  process.stdout.write(JSON.stringify({ files, truncated }));\n} catch (error) {\n  process.stderr.write('Workspace inspection failed\\n');\n  process.exitCode = 1;\n}\n`;\n"],"mappings":";;;AAGA,MAAa,0BAA0B,EAAE,OAAO;CAC9C,WAAW,EAAE,QAAQ;CACrB,OAAO,EACJ,MACC,EAAE,OAAO;EACP,MAAM,EAAE,OAAO;EACf,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;EAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;EAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC5B,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,GAAO,CAAC,CAAC,SAAS;EAC1C,QAAQ,EAAE,QAAQ;EAClB,SAAS,EAAE,QAAQ;CACrB,CAAC,CACH,CAAC,CACA,IAAI,GAAG,CAAC,CACR,SAAS;AACd,CAAC;;;;;AASD,MAAa,0BAA0B,OAAO,GAAG"}

package/package.json

@@ -1,95 +1,180 @@
 {
   "name": "@vercel/factory",
-  "version": "0.0.14",
+  "version": "0.0.15",
   "description": "Schema, state machines, and kernel primitives for Agent Factory.",
+  "files": [
+    "dist"
+  ],
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.mts",
   "exports": {
-    "./api": {
-      "types": "./dist/api.d.mts",
-      "import": "./dist/api.mjs"
-    },
     ".": {
       "types": "./dist/index.d.mts",
       "import": "./dist/index.mjs",
       "default": "./dist/index.mjs"
     },
+    "./tasks": {
+      "types": "./dist/tasks.d.mts",
+      "import": "./dist/tasks.mjs"
+    },
+    "./workflows": {
+      "types": "./dist/workflows.d.mts",
+      "import": "./dist/workflows.mjs"
+    },
+    "./execution": {
+      "types": "./dist/execution-public.d.mts",
+      "import": "./dist/execution-public.mjs"
+    },
+    "./planning": {
+      "types": "./dist/planning/runtime.d.mts",
+      "import": "./dist/planning/runtime.mjs"
+    },
+    "./budgets": {
+      "types": "./dist/budgets.d.mts",
+      "import": "./dist/budgets.mjs"
+    },
+    "./signals": {
+      "types": "./dist/signals.d.mts",
+      "import": "./dist/signals.mjs"
+    },
+    "./receipts": {
+      "types": "./dist/receipts.d.mts",
+      "import": "./dist/receipts.mjs"
+    },
+    "./storage": {
+      "types": "./dist/storage.d.mts",
+      "import": "./dist/storage.mjs"
+    },
+    "./storage/blob": {
+      "types": "./dist/blob/index.d.mts",
+      "import": "./dist/blob/index.mjs"
+    },
+    "./storage/postgres": {
+      "types": "./dist/postgres/index.d.mts",
+      "import": "./dist/postgres/index.mjs"
+    },
+    "./communication": {
+      "types": "./dist/communication.d.mts",
+      "import": "./dist/communication.mjs"
+    },
+    "./integrations/deepsec": {
+      "types": "./dist/integrations/deepsec.d.mts",
+      "import": "./dist/integrations/deepsec.mjs"
+    },
+    "./integrations/github": {
+      "types": "./dist/integrations/github.d.mts",
+      "import": "./dist/integrations/github.mjs"
+    },
+    "./integrations/slack": {
+      "types": "./dist/integrations/slack.d.mts",
+      "import": "./dist/integrations/slack.mjs"
+    },
+    "./integrations/vercel": {
+      "types": "./dist/integrations/vercel.d.mts",
+      "import": "./dist/integrations/vercel.mjs"
+    },
+    "./client": {
+      "types": "./dist/client.d.mts",
+      "import": "./dist/client.mjs"
+    },
+    "./api": {
+      "types": "./dist/api.d.mts",
+      "import": "./dist/api.mjs"
+    },
     "./next": {
       "types": "./dist/build-factory.d.mts",
       "import": "./dist/build-factory.mjs",
       "default": "./dist/build-factory.mjs"
     },
-    "./postgres": {
-      "types": "./dist/postgres/index.d.mts",
-      "import": "./dist/postgres/index.mjs"
+    "./changes": {
+      "types": "./dist/changes.d.mts",
+      "import": "./dist/changes.mjs"
     },
-    "./blob": {
-      "types": "./dist/blob/index.d.mts",
-      "import": "./dist/blob/index.mjs"
+    "./findings": {
+      "types": "./dist/findings.d.mts",
+      "import": "./dist/findings.mjs"
+    },
+    "./code-review": {
+      "types": "./dist/code-review.d.mts",
+      "import": "./dist/code-review.mjs"
     },
-    "./eve": {
-      "types": "./dist/eve/index.d.mts",
-      "import": "./dist/eve/index.mjs"
+    "./pull-requests": {
+      "types": "./dist/pull-requests.d.mts",
+      "import": "./dist/pull-requests.mjs"
     },
-    "./github": {
-      "types": "./dist/github.d.mts",
-      "import": "./dist/github.mjs"
+    "./work-triage": {
+      "types": "./dist/work-triage.d.mts",
+      "import": "./dist/work-triage.mjs"
     },
-    "./connectors/slack": {
-      "types": "./dist/connectors/slack.d.mts",
-      "import": "./dist/connectors/slack.mjs"
+    "./delivery-metrics": {
+      "types": "./dist/delivery-metrics.d.mts",
+      "import": "./dist/delivery-metrics.mjs"
     },
-    "./vercel": {
-      "types": "./dist/vercel.d.mts",
-      "import": "./dist/vercel.mjs"
+    "./presets/software-development": {
+      "types": "./dist/presets/software-development.d.mts",
+      "import": "./dist/presets/software-development.mjs",
+      "default": "./dist/presets/software-development.mjs"
     },
-    "./connectors": {
-      "types": "./dist/connectors/index.d.mts",
-      "import": "./dist/connectors/index.mjs"
+    "./sandbox": {
+      "types": "./dist/sandbox/index.d.mts",
+      "import": "./dist/sandbox/index.mjs"
     },
     "./package.json": "./package.json"
   },
-  "files": [
-    "dist"
-  ],
-  "engines": {
-    "node": ">=22"
+  "dependencies": {
+    "diff": "8.0.2"
+  },
+  "devDependencies": {
+    "@ai-sdk/harness": "1.0.108",
+    "@ai-sdk/harness-claude-code": "1.0.112",
+    "@ai-sdk/sandbox-vercel": "1.0.108",
+    "@electric-sql/pglite": "^0.5.7",
+    "@types/node": "24.x",
+    "@vercel/blob": "^2.8.0",
+    "@vercel/sandbox": "2.10.0-beta.0",
+    "drizzle-orm": "^0.45.2",
+    "eve": "^0.46.1",
+    "tsdown": "^0.22.14",
+    "typescript": "5.9.3",
+    "vitest": "4.1.9",
+    "zod": "4.4.3"
   },
   "peerDependencies": {
+    "@ai-sdk/harness": "^1.0.0",
+    "@ai-sdk/sandbox-vercel": "^1.0.0",
     "@vercel/blob": "^2.6.0",
+    "@vercel/sandbox": ">=2.10.0-beta.0 <4",
     "drizzle-orm": "^0.45.0",
     "eve": "^0.46.0",
     "zod": "^4.4.3"
   },
   "peerDependenciesMeta": {
+    "@ai-sdk/harness": {
+      "optional": true
+    },
+    "@ai-sdk/sandbox-vercel": {
+      "optional": true
+    },
     "@vercel/blob": {
       "optional": true
     },
-    "drizzle-orm": {
+    "@vercel/sandbox": {
       "optional": true
     },
-    "eve": {
+    "drizzle-orm": {
       "optional": true
     }
   },
-  "devDependencies": {
-    "@electric-sql/pglite": "^0.5.7",
-    "@types/node": "24.x",
-    "@vercel/blob": "^2.8.0",
-    "drizzle-orm": "^0.45.2",
-    "eve": "^0.46.1",
-    "tsdown": "^0.22.14",
-    "typescript": "5.9.3",
-    "vitest": "4.1.9",
-    "zod": "4.4.3"
+  "engines": {
+    "node": ">=24"
   },
   "scripts": {
     "build": "tsdown",
     "clean": "rm -rf dist",
     "dead-exports": "knip --directory ../.. --workspace @vercel/factory --exports",
-    "lint": "eslint .",
+    "lint": "oxlint --config ../../.oxlintrc.json --max-warnings 0 .",
     "lint:logs": "node ../../scripts/check-structured-logging.mjs src",
     "test": "vitest run",
     "typecheck": "tsc"

package/dist/approval-JX2Px9IC.mjs

@@ -1,132 +0,0 @@
-import { h as vocabularySchema } from "./id-BLIkCVue.mjs";
-import { z } from "zod";
-import { createHash } from "node:crypto";
-//#region src/schema/finding.ts
-const findingPrioritySchema = z.enum([
-	"P0",
-	"P1",
-	"P2",
-	"P3"
-]).describe("Urgency of a finding: P0 is drop-everything, P3 is nice-to-have.");
-const findingCategorySchema = z.enum([
-	"security",
-	"correctness",
-	"reliability",
-	"performance",
-	"compatibility",
-	"accessibility",
-	"documentation",
-	"maintainability",
-	"testing",
-	"usability"
-]);
-const findingVerificationLevelSchema = z.enum([
-	"unverified",
-	"supported",
-	"confirmed"
-]).describe("How sure the reporter is: unverified = suspected from reading; supported = evidence points to it; confirmed = demonstrated.");
-const findingVerificationMethodSchema = z.enum([
-	"code_inspection",
-	"static_analysis",
-	"manual_reproduction",
-	"unit_test",
-	"integration_test",
-	"e2e_test",
-	"runtime_observation",
-	"documentation"
-]);
-/**
-* What was done to check the finding. Forces a reporter to distinguish "I
-* think this is a problem" from "I demonstrated it", which is the axis a human
-* approving fixes cares about most.
-*/
-const findingVerificationSchema = z.strictObject({
-	level: findingVerificationLevelSchema,
-	method: findingVerificationMethodSchema,
-	summary: z.string().min(1).max(2e3).describe("What was checked and what it showed."),
-	limitations: z.string().min(1).max(2e3).optional().describe("What could not be checked.")
-});
-/** A single problem found in a repository, as a scanner or agent reports it. */
-const findingSchema = z.strictObject({
-	title: z.string().min(1).max(200),
-	body: z.string().min(1).max(8e3).describe("The problem, its impact, and how to fix it. Markdown."),
-	path: z.string().min(1).max(500).optional().describe("Repository-relative file path."),
-	line: z.number().int().min(1).optional(),
-	endLine: z.number().int().min(1).optional(),
-	priority: findingPrioritySchema,
-	category: findingCategorySchema,
-	verification: findingVerificationSchema,
-	tool: z.string().min(1).max(100).optional().describe("Scanner that produced it, e.g. deepsec."),
-	ruleId: z.string().min(1).max(200).optional().describe("Scanner rule or check id, when there is one.")
-});
-/**
-* Stable identity of a finding across scans, used as the signal's delivery id
-* so re-reporting is a no-op instead of a second task. A scanner finding is
-* the same problem when the same tool reports the same rule on the same file;
-* its title is model-written prose and changes between runs, so it is left
-* out. Without a rule id the title is all there is, normalised.
-*/
-function findingFingerprint(repositoryId, finding) {
-	const parts = finding.tool !== void 0 && finding.ruleId !== void 0 && finding.path !== void 0 ? [
-		repositoryId,
-		finding.tool,
-		finding.ruleId,
-		finding.path
-	] : [
-		repositoryId,
-		finding.tool ?? "",
-		finding.ruleId ?? "",
-		finding.path ?? "",
-		finding.title.trim().toLowerCase().replaceAll(/\s+/gu, " ")
-	];
-	return createHash("sha256").update(parts.join(" ")).digest("hex").slice(0, 32);
-}
-//#endregion
-//#region src/approval.ts
-/**
-* One approval rule. Every listed field must match for the rule to apply;
-* absent fields match anything. Rules are evaluated first-match.
-*/
-const approvalRuleSchema = z.strictObject({
-	source: vocabularySchema.optional().describe("Signal source, e.g. security_scan or github_issue."),
-	kind: vocabularySchema.optional().describe("Task kind, e.g. code_change."),
-	priority: z.array(findingPrioritySchema).min(1).optional().describe("Finding priorities the rule applies to."),
-	require: z.boolean().describe("Whether matching tasks wait for a human before dispatch.")
-});
-const approvalPolicySchema = z.array(approvalRuleSchema).describe("First-match rules deciding which tasks need a human before they run.");
-/**
-* The default: fixes for security findings wait for a human; everything else
-* runs as it always has. Handoffs between agents (verification) never wait,
-* because a human already approved the work they continue.
-*/
-const defaultApprovalPolicy = [
-	{
-		kind: "verification",
-		require: false
-	},
-	{
-		source: "security_scan",
-		require: true
-	},
-	{ require: false }
-];
-/**
-* Decide at task-creation time whether a task needs approval. Pure: the answer
-* is stamped on the task and never re-evaluated, so a later policy change
-* cannot silently release work a human was expecting to see.
-*/
-function requiresApproval(policy, subject) {
-	for (const rule of policy) {
-		if (rule.source !== void 0 && rule.source !== subject.source) continue;
-		if (rule.kind !== void 0 && rule.kind !== subject.kind) continue;
-		if (rule.priority !== void 0) {
-			if (subject.priority === void 0 || !rule.priority.includes(subject.priority)) continue;
-		}
-		return rule.require;
-	}
-	return false;
-}
-//#endregion
-export { findingCategorySchema as a, findingSchema as c, findingVerificationSchema as d, requiresApproval as i, findingVerificationLevelSchema as l, approvalRuleSchema as n, findingFingerprint as o, defaultApprovalPolicy as r, findingPrioritySchema as s, approvalPolicySchema as t, findingVerificationMethodSchema as u };
-
-//# sourceMappingURL=approval-JX2Px9IC.mjs.map

package/dist/approval-JX2Px9IC.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval-JX2Px9IC.mjs","names":[],"sources":["../src/schema/finding.ts","../src/approval.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\nexport const findingPrioritySchema = z\n  .enum([\"P0\", \"P1\", \"P2\", \"P3\"])\n  .describe(\"Urgency of a finding: P0 is drop-everything, P3 is nice-to-have.\");\n\nexport const findingCategorySchema = z.enum([\n  \"security\",\n  \"correctness\",\n  \"reliability\",\n  \"performance\",\n  \"compatibility\",\n  \"accessibility\",\n  \"documentation\",\n  \"maintainability\",\n  \"testing\",\n  \"usability\",\n]);\n\nexport const findingVerificationLevelSchema = z\n  .enum([\"unverified\", \"supported\", \"confirmed\"])\n  .describe(\n    \"How sure the reporter is: unverified = suspected from reading; supported = evidence points to it; confirmed = demonstrated.\",\n  );\n\nexport const findingVerificationMethodSchema = z.enum([\n  \"code_inspection\",\n  \"static_analysis\",\n  \"manual_reproduction\",\n  \"unit_test\",\n  \"integration_test\",\n  \"e2e_test\",\n  \"runtime_observation\",\n  \"documentation\",\n]);\n\n/**\n * What was done to check the finding. Forces a reporter to distinguish \"I\n * think this is a problem\" from \"I demonstrated it\", which is the axis a human\n * approving fixes cares about most.\n */\nexport const findingVerificationSchema = z.strictObject({\n  level: findingVerificationLevelSchema,\n  method: findingVerificationMethodSchema,\n  summary: z.string().min(1).max(2000).describe(\"What was checked and what it showed.\"),\n  limitations: z.string().min(1).max(2000).optional().describe(\"What could not be checked.\"),\n});\n\n/** A single problem found in a repository, as a scanner or agent reports it. */\nexport const findingSchema = z.strictObject({\n  title: z.string().min(1).max(200),\n  body: z.string().min(1).max(8000).describe(\"The problem, its impact, and how to fix it. Markdown.\"),\n  path: z.string().min(1).max(500).optional().describe(\"Repository-relative file path.\"),\n  line: z.number().int().min(1).optional(),\n  endLine: z.number().int().min(1).optional(),\n  priority: findingPrioritySchema,\n  category: findingCategorySchema,\n  verification: findingVerificationSchema,\n  tool: z.string().min(1).max(100).optional().describe(\"Scanner that produced it, e.g. deepsec.\"),\n  ruleId: z.string().min(1).max(200).optional().describe(\"Scanner rule or check id, when there is one.\"),\n});\n\nexport type FindingPriority = z.infer<typeof findingPrioritySchema>;\nexport type FindingCategory = z.infer<typeof findingCategorySchema>;\nexport type FindingVerification = z.infer<typeof findingVerificationSchema>;\nexport type Finding = z.infer<typeof findingSchema>;\n\n/**\n * Stable identity of a finding across scans, used as the signal's delivery id\n * so re-reporting is a no-op instead of a second task. A scanner finding is\n * the same problem when the same tool reports the same rule on the same file;\n * its title is model-written prose and changes between runs, so it is left\n * out. Without a rule id the title is all there is, normalised.\n */\nexport function findingFingerprint(repositoryId: string, finding: Finding): string {\n  const parts =\n    finding.tool !== undefined && finding.ruleId !== undefined && finding.path !== undefined\n      ? [repositoryId, finding.tool, finding.ruleId, finding.path]\n      : [\n          repositoryId,\n          finding.tool ?? \"\",\n          finding.ruleId ?? \"\",\n          finding.path ?? \"\",\n          finding.title.trim().toLowerCase().replaceAll(/\\s+/gu, \" \"),\n        ];\n  return createHash(\"sha256\").update(parts.join(\" \")).digest(\"hex\").slice(0, 32);\n}\n","import { z } from \"zod\";\nimport { vocabularySchema } from \"./schema/common\";\nimport { findingPrioritySchema, type FindingPriority } from \"./schema/finding\";\n\n/**\n * One approval rule. Every listed field must match for the rule to apply;\n * absent fields match anything. Rules are evaluated first-match.\n */\nexport const approvalRuleSchema = z.strictObject({\n  source: vocabularySchema.optional().describe(\"Signal source, e.g. security_scan or github_issue.\"),\n  kind: vocabularySchema.optional().describe(\"Task kind, e.g. code_change.\"),\n  priority: z\n    .array(findingPrioritySchema)\n    .min(1)\n    .optional()\n    .describe(\"Finding priorities the rule applies to.\"),\n  require: z.boolean().describe(\"Whether matching tasks wait for a human before dispatch.\"),\n});\n\nexport const approvalPolicySchema = z\n  .array(approvalRuleSchema)\n  .describe(\"First-match rules deciding which tasks need a human before they run.\");\n\nexport type ApprovalRule = z.infer<typeof approvalRuleSchema>;\nexport type ApprovalPolicy = z.infer<typeof approvalPolicySchema>;\n\n/**\n * The default: fixes for security findings wait for a human; everything else\n * runs as it always has. Handoffs between agents (verification) never wait,\n * because a human already approved the work they continue.\n */\nexport const defaultApprovalPolicy: ApprovalPolicy = [\n  { kind: \"verification\", require: false },\n  { source: \"security_scan\", require: true },\n  { require: false },\n];\n\nexport interface ApprovalSubject {\n  source?: string;\n  kind: string;\n  priority?: FindingPriority;\n}\n\n/**\n * Decide at task-creation time whether a task needs approval. Pure: the answer\n * is stamped on the task and never re-evaluated, so a later policy change\n * cannot silently release work a human was expecting to see.\n */\nexport function requiresApproval(policy: ApprovalPolicy, subject: ApprovalSubject): boolean {\n  for (const rule of policy) {\n    if (rule.source !== undefined && rule.source !== subject.source) continue;\n    if (rule.kind !== undefined && rule.kind !== subject.kind) continue;\n    if (rule.priority !== undefined) {\n      if (subject.priority === undefined || !rule.priority.includes(subject.priority)) continue;\n    }\n    return rule.require;\n  }\n  return false;\n}\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,EAClC,KAAK;CAAC;CAAM;CAAM;CAAM;AAAI,CAAC,CAAC,CAC9B,SAAS,kEAAkE;AAE9E,MAAa,wBAAwB,EAAE,KAAK;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAa,iCAAiC,EAC3C,KAAK;CAAC;CAAc;CAAa;AAAW,CAAC,CAAC,CAC9C,SACC,6HACF;AAEF,MAAa,kCAAkC,EAAE,KAAK;CACpD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAOD,MAAa,4BAA4B,EAAE,aAAa;CACtD,OAAO;CACP,QAAQ;CACR,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,sCAAsC;CACpF,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,4BAA4B;AAC3F,CAAC;;AAGD,MAAa,gBAAgB,EAAE,aAAa;CAC1C,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAChC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAI,CAAC,CAAC,SAAS,uDAAuD;CAClG,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,gCAAgC;CACrF,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACvC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAC1C,UAAU;CACV,UAAU;CACV,cAAc;CACd,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,yCAAyC;CAC9F,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,8CAA8C;AACvG,CAAC;;;;;;;;AAcD,SAAgB,mBAAmB,cAAsB,SAA0B;CACjF,MAAM,QACJ,QAAQ,SAAS,KAAA,KAAa,QAAQ,WAAW,KAAA,KAAa,QAAQ,SAAS,KAAA,IAC3E;EAAC;EAAc,QAAQ;EAAM,QAAQ;EAAQ,QAAQ;CAAI,IACzD;EACE;EACA,QAAQ,QAAQ;EAChB,QAAQ,UAAU;EAClB,QAAQ,QAAQ;EAChB,QAAQ,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,WAAW,SAAS,GAAG;CAC5D;CACN,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AAC/E;;;;;;;AC/EA,MAAa,qBAAqB,EAAE,aAAa;CAC/C,QAAQ,iBAAiB,SAAS,CAAC,CAAC,SAAS,oDAAoD;CACjG,MAAM,iBAAiB,SAAS,CAAC,CAAC,SAAS,8BAA8B;CACzE,UAAU,EACP,MAAM,qBAAqB,CAAC,CAC5B,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,yCAAyC;CACrD,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,0DAA0D;AAC1F,CAAC;AAED,MAAa,uBAAuB,EACjC,MAAM,kBAAkB,CAAC,CACzB,SAAS,sEAAsE;;;;;;AAUlF,MAAa,wBAAwC;CACnD;EAAE,MAAM;EAAgB,SAAS;CAAM;CACvC;EAAE,QAAQ;EAAiB,SAAS;CAAK;CACzC,EAAE,SAAS,MAAM;AACnB;;;;;;AAaA,SAAgB,iBAAiB,QAAwB,SAAmC;CAC1F,KAAK,MAAM,QAAQ,QAAQ;EACzB,IAAI,KAAK,WAAW,KAAA,KAAa,KAAK,WAAW,QAAQ,QAAQ;EACjE,IAAI,KAAK,SAAS,KAAA,KAAa,KAAK,SAAS,QAAQ,MAAM;EAC3D,IAAI,KAAK,aAAa,KAAA,GAChB;OAAA,QAAQ,aAAa,KAAA,KAAa,CAAC,KAAK,SAAS,SAAS,QAAQ,QAAQ,GAAG;EAAA;EAEnF,OAAO,KAAK;CACd;CACA,OAAO;AACT"}

package/dist/budget-DzSiIA4t.mjs

@@ -1,42 +0,0 @@
-import { d as isoDateTimeSchema, m as usdSchema, o as repositoryIdSchema, p as schemaVersionSchema, r as factoryIdSchema } from "./id-BLIkCVue.mjs";
-import { z } from "zod";
-//#region src/schema/repository.ts
-const repositorySlugSchema = z.string().regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?\/[a-z0-9._-]+$/).describe("owner/name, lowercase, e.g. acme/web.");
-const repositorySchema = z.strictObject({
-	schemaVersion: schemaVersionSchema,
-	id: repositoryIdSchema,
-	slug: repositorySlugSchema,
-	defaultBranch: z.string().min(1).describe("Branch changes land on, usually main."),
-	enabled: z.boolean().describe("Whether the factory may work on this repository."),
-	dependsOn: z.array(repositorySlugSchema).describe("Slugs of repositories this one consumes, for multi-repo work ordering."),
-	devbox: z.strictObject({
-		projectId: z.string().min(1),
-		teamId: z.string().min(1),
-		snapshot: z.string().min(1).optional().describe("Prebuilt snapshot to boot from.")
-	}).optional().describe("Devbox execution config. Absent when this repository never uses devboxes."),
-	connectedAt: isoDateTimeSchema
-});
-//#endregion
-//#region src/schema/budget.ts
-const budgetMonthSchema = z.string().regex(/^\d{4}-(0[1-9]|1[0-2])$/);
-const budgetLimitsSchema = z.strictObject({
-	totalUsd: usdSchema,
-	investigationUsd: usdSchema,
-	perTaskReservationUsd: usdSchema,
-	warningPercent: z.number().int().min(1).max(100),
-	perRepositoryUsd: z.record(repositorySlugSchema, usdSchema).optional()
-});
-const budgetSchema = z.strictObject({
-	schemaVersion: schemaVersionSchema,
-	factoryId: factoryIdSchema,
-	month: budgetMonthSchema,
-	limits: budgetLimitsSchema,
-	notices: z.strictObject({
-		warningAt: isoDateTimeSchema.optional(),
-		exhaustedAt: isoDateTimeSchema.optional()
-	})
-});
-//#endregion
-export { repositorySlugSchema as a, repositorySchema as i, budgetMonthSchema as n, budgetSchema as r, budgetLimitsSchema as t };
-
-//# sourceMappingURL=budget-DzSiIA4t.mjs.map

package/dist/budget-DzSiIA4t.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"budget-DzSiIA4t.mjs","names":[],"sources":["../src/schema/repository.ts","../src/schema/budget.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { isoDateTimeSchema, schemaVersionSchema } from \"./common\";\nimport { repositoryIdSchema } from \"./id\";\n\nexport const repositorySlugSchema = z\n  .string()\n  .regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?\\/[a-z0-9._-]+$/)\n  .describe(\"owner/name, lowercase, e.g. acme/web.\");\n\nexport const repositorySchema = z.strictObject({\n  schemaVersion: schemaVersionSchema,\n  id: repositoryIdSchema,\n  slug: repositorySlugSchema,\n  defaultBranch: z.string().min(1).describe(\"Branch changes land on, usually main.\"),\n  enabled: z.boolean().describe(\"Whether the factory may work on this repository.\"),\n  dependsOn: z\n    .array(repositorySlugSchema)\n    .describe(\"Slugs of repositories this one consumes, for multi-repo work ordering.\"),\n  devbox: z\n    .strictObject({\n      projectId: z.string().min(1),\n      teamId: z.string().min(1),\n      snapshot: z.string().min(1).optional().describe(\"Prebuilt snapshot to boot from.\"),\n    })\n    .optional()\n    .describe(\"Devbox execution config. Absent when this repository never uses devboxes.\"),\n  connectedAt: isoDateTimeSchema,\n});\n\nexport type RepositorySlug = z.infer<typeof repositorySlugSchema>;\nexport type Repository = z.infer<typeof repositorySchema>;\n","import { z } from \"zod\";\nimport { isoDateTimeSchema, schemaVersionSchema, usdSchema } from \"./common\";\nimport { factoryIdSchema } from \"./id\";\nimport { repositorySlugSchema } from \"./repository\";\n\nexport const budgetMonthSchema = z.string().regex(/^\\d{4}-(0[1-9]|1[0-2])$/);\n\nexport const budgetLimitsSchema = z.strictObject({\n  totalUsd: usdSchema,\n  investigationUsd: usdSchema,\n  perTaskReservationUsd: usdSchema,\n  warningPercent: z.number().int().min(1).max(100),\n  perRepositoryUsd: z.record(repositorySlugSchema, usdSchema).optional(),\n});\n\nexport const budgetSchema = z.strictObject({\n  schemaVersion: schemaVersionSchema,\n  factoryId: factoryIdSchema,\n  month: budgetMonthSchema,\n  limits: budgetLimitsSchema,\n  notices: z.strictObject({\n    warningAt: isoDateTimeSchema.optional(),\n    exhaustedAt: isoDateTimeSchema.optional(),\n  }),\n});\n\nexport type BudgetLimits = z.infer<typeof budgetLimitsSchema>;\nexport type Budget = z.infer<typeof budgetSchema>;\n"],"mappings":";;;AAIA,MAAa,uBAAuB,EACjC,OAAO,CAAC,CACR,MAAM,+CAA+C,CAAC,CACtD,SAAS,uCAAuC;AAEnD,MAAa,mBAAmB,EAAE,aAAa;CAC7C,eAAe;CACf,IAAI;CACJ,MAAM;CACN,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,uCAAuC;CACjF,SAAS,EAAE,QAAQ,CAAC,CAAC,SAAS,kDAAkD;CAChF,WAAW,EACR,MAAM,oBAAoB,CAAC,CAC3B,SAAS,wEAAwE;CACpF,QAAQ,EACL,aAAa;EACZ,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC3B,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACxB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,iCAAiC;CACnF,CAAC,CAAC,CACD,SAAS,CAAC,CACV,SAAS,2EAA2E;CACvF,aAAa;AACf,CAAC;;;ACtBD,MAAa,oBAAoB,EAAE,OAAO,CAAC,CAAC,MAAM,yBAAyB;AAE3E,MAAa,qBAAqB,EAAE,aAAa;CAC/C,UAAU;CACV,kBAAkB;CAClB,uBAAuB;CACvB,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CAC/C,kBAAkB,EAAE,OAAO,sBAAsB,SAAS,CAAC,CAAC,SAAS;AACvE,CAAC;AAED,MAAa,eAAe,EAAE,aAAa;CACzC,eAAe;CACf,WAAW;CACX,OAAO;CACP,QAAQ;CACR,SAAS,EAAE,aAAa;EACtB,WAAW,kBAAkB,SAAS;EACtC,aAAa,kBAAkB,SAAS;CAC1C,CAAC;AACH,CAAC"}