@vercel/factory 0.0.14 → 0.0.16

package/dist/connectors/slack.mjs

@@ -1,5 +1,6 @@
-import { t as communicationEventSchema } from "../communication-Kd9nU5RP.mjs";
-import "./index.mjs";
+import { repositorySlugSchema } from "../schema/repository.mjs";
+import { communicationEventSchema } from "../schema/communication.mjs";
+import { createSlackApprovals } from "./slack-approvals.mjs";
 import { createHash } from "node:crypto";
 //#region src/connectors/slack.ts
 const slackOutcomeLabels = {
@@ -7,6 +8,7 @@ const slackOutcomeLabels = {
 	started: "Work started",
 	succeeded: "Work completed",
 	failed: "Work failed",
+	cancelled: "Work cancelled",
 	needs_human: "Human action required",
 	question: "Question requires an answer",
 	digest: "Factory digest",
@@ -21,6 +23,8 @@ const slackDetailFields = [
 	"summary",
 	"question",
 	"requestedAction",
+	"reference",
+	"answerLocation",
 	"reason",
 	"url"
 ];
@@ -29,7 +33,8 @@ const slackTextLimit = 12e3;
 const slackOwnerOutcomes = /* @__PURE__ */ new Set([
 	"digest",
 	"budget_warning",
-	"budget_exhausted"
+	"budget_exhausted",
+	"needs_human"
 ]);
 function escapeSlackText(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
@@ -43,21 +48,6 @@ function slackLink(url, label) {
 		return null;
 	}
 }
-/** Resolve an explicit pull-request reference after the repository has been selected. */
-function selectSlackPullRequest(text, repositorySlug) {
-	const escapedSlug = repositorySlug.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-	const references = [...text.matchAll(new RegExp(`https://github\\.com/${escapedSlug}/pull/(\\d+)`, "giu")), ...text.matchAll(/\b(?:pr|pull\s+request)\s*#?\s*(\d+)\b/giu)].flatMap((match) => {
-		const value = Number(match[1]);
-		return Number.isSafeInteger(value) && value > 0 ? [value] : [];
-	});
-	const distinct = [...new Set(references)];
-	if (distinct.length === 0) return { status: "none" };
-	if (distinct.length > 1) return { status: "ambiguous" };
-	return {
-		status: "selected",
-		pullRequestNumber: distinct[0]
-	};
-}
 /** Parse Eve's Slack continuation token into its channel and thread target. */
 function parseSlackReplyAddress(address) {
 	const separator = address.indexOf(":");
@@ -93,8 +83,9 @@ function renderSlackCommunicationEvent(input) {
 		if (!Array.isArray(value)) return [];
 		return value.flatMap((item) => typeof item === "string" && item.trim() !== "" ? [`• ${escapeSlackText(item.trim())}`] : []);
 	});
+	const hasContent = detailLines.length > 0 || lists.length > 0;
 	const text = [
-		headline,
+		...event.outcome === "succeeded" && hasContent ? [] : [headline],
 		...detailLines,
 		...lists.length === 0 ? [] : [lists.join("\n")]
 	].join("\n\n");
@@ -129,6 +120,7 @@ function createSlackCommunicationAdapter(options) {
 				text: render(event),
 				target
 			});
+			await options.onDelivered?.(event);
 		}
 	});
 }
@@ -137,7 +129,7 @@ function normalizeSlackMessage(event) {
 	return {
 		source: "slack",
 		deliveryId: `${event.teamId}:${event.channelId}:${event.messageTs}`,
-		repositorySlugs: [event.repositorySlugs[0].toLowerCase(), ...event.repositorySlugs.slice(1).map((slug) => slug.toLowerCase())],
+		repositorySlugs: [repositorySlugSchema.parse(event.repositorySlugs[0].toLowerCase()), ...event.repositorySlugs.slice(1).map((slug) => repositorySlugSchema.parse(slug.toLowerCase()))],
 		replyTo: {
 			channel: "slack",
 			address: event.replyAddress
@@ -153,71 +145,7 @@ function normalizeSlackMessage(event) {
 		payload: event.payload
 	};
 }
-function escapedPattern(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function isDelimitedTextMentioned(text, value) {
-	return new RegExp(`(^|[^a-z0-9._/-])${escapedPattern(value)}($|[^a-z0-9._/-])`, "i").test(text);
-}
-function isRepositoryReferenceMentioned(text, slug) {
-	if (isDelimitedTextMentioned(text, slug)) return true;
-	return new RegExp(`https?://github\\.com/${escapedPattern(slug)}(?:\\.git)?/?(?=$|[\\s?#|>)\\],.!])`, "i").test(text);
-}
-function repositoryName(slug) {
-	return slug.slice(slug.lastIndexOf("/") + 1);
-}
-function resolveSlackRepositoryMentions(text, repositories) {
-	const normalized = [...new Set(repositories.map((slug) => slug.toLowerCase()))];
-	const entries = normalized.map((slug) => ({
-		slug,
-		name: repositoryName(slug)
-	}));
-	const counts = /* @__PURE__ */ new Map();
-	for (const { name } of entries) counts.set(name, (counts.get(name) ?? 0) + 1);
-	const mentionedNames = new Set([...counts.keys()].filter((name) => isDelimitedTextMentioned(text, name)));
-	const matches = new Set(entries.flatMap(({ slug, name }) => isRepositoryReferenceMentioned(text, slug) || counts.get(name) === 1 && mentionedNames.has(name) ? [slug] : []));
-	const ambiguous = new Set(entries.flatMap(({ slug, name }) => counts.get(name) !== 1 && mentionedNames.has(name) ? [slug] : []));
-	return {
-		repositories: normalized,
-		matches: normalized.filter((slug) => matches.has(slug)),
-		ambiguous: normalized.filter((slug) => ambiguous.has(slug)),
-		candidates: normalized.filter((slug) => matches.has(slug) || ambiguous.has(slug))
-	};
-}
-/** Select every named configured repository, preserving configuration order. */
-function selectSlackRepositories(text, repositories) {
-	const mentions = resolveSlackRepositoryMentions(text, repositories);
-	if (mentions.repositories.length === 1) return {
-		status: "selected",
-		repositorySlugs: [mentions.repositories[0]]
-	};
-	if (mentions.ambiguous.length > 0) return { status: "required" };
-	return mentions.matches.length === 0 ? { status: "required" } : {
-		status: "selected",
-		repositorySlugs: [mentions.matches[0], ...mentions.matches.slice(1)]
-	};
-}
-/**
-* Select the only configured repository, or match a full slug, unique short
-* name, or GitHub repository URL when a Slack surface fronts multiple repositories.
-*/
-function selectSlackRepository(text, repositories) {
-	const mentions = resolveSlackRepositoryMentions(text, repositories);
-	if (mentions.repositories.length === 1) return {
-		status: "selected",
-		repositorySlug: mentions.repositories[0]
-	};
-	if (mentions.candidates.length === 1) return {
-		status: "selected",
-		repositorySlug: mentions.candidates[0]
-	};
-	if (mentions.candidates.length > 1) return {
-		status: "ambiguous",
-		repositorySlugs: mentions.candidates
-	};
-	return { status: "required" };
-}
 //#endregion
-export { createSlackCommunicationAdapter, normalizeSlackMessage, parseSlackReplyAddress, renderSlackCommunicationEvent, selectSlackPullRequest, selectSlackRepositories, selectSlackRepository };
+export { createSlackApprovals, createSlackCommunicationAdapter, normalizeSlackMessage, parseSlackReplyAddress, renderSlackCommunicationEvent };
 
 //# sourceMappingURL=slack.mjs.map

package/dist/connectors/slack.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"slack.mjs","names":[],"sources":["../../src/connectors/slack.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  communicationEventSchema,\n  type CommunicationAdapter,\n  type CommunicationEvent,\n  type CommunicationOutcome,\n  type NormalizedSignal,\n} from \"./index\";\n\nconst slackOutcomeLabels: Record<CommunicationOutcome, string> = {\n  accepted: \"Request accepted\",\n  started: \"Work started\",\n  succeeded: \"Work completed\",\n  failed: \"Work failed\",\n  needs_human: \"Human action required\",\n  question: \"Question requires an answer\",\n  digest: \"Factory digest\",\n  rolled_back: \"Change rolled back\",\n  budget_warning: \"Factory budget warning\",\n  budget_exhausted: \"Factory budget exhausted\",\n  message: \"Factory update\",\n};\n\nconst slackDetailFields = [\"title\", \"message\", \"summary\", \"question\", \"requestedAction\", \"reason\", \"url\"] as const;\nconst slackListFields = [\"items\", \"options\"] as const;\nconst slackTextLimit = 12_000;\nconst slackOwnerOutcomes = new Set<CommunicationOutcome>([\n  \"digest\",\n  \"budget_warning\",\n  \"budget_exhausted\",\n]);\n\nfunction escapeSlackText(value: string): string {\n  return value.replaceAll(\"&\", \"&amp;\").replaceAll(\"<\", \"&lt;\").replaceAll(\">\", \"&gt;\");\n}\n\nfunction slackLink(url: string, label: string): string | null {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return null;\n    return `<${escapeSlackText(parsed.toString())}|${escapeSlackText(label)}>`;\n  } catch {\n    return null;\n  }\n}\n\nexport interface SlackCommunicationDelivery {\n  eventId: string;\n  clientMessageId: string;\n  text: string;\n  target:\n    | { type: \"owner\" }\n    | { type: \"thread\"; channelId: string; threadTs: string };\n}\n\nexport interface SlackCommunicationAdapter extends CommunicationAdapter {\n  readonly channel: \"slack\";\n  render(event: CommunicationEvent): string;\n}\n\nexport interface SlackCommunicationAdapterOptions {\n  send(delivery: SlackCommunicationDelivery): Promise<void>;\n  render?: (event: CommunicationEvent) => string;\n}\n\nexport interface SlackReplyTarget {\n  channelId: string;\n  threadTs: string;\n}\n\nexport type SlackPullRequestSelection =\n  | { status: \"none\" }\n  | { status: \"ambiguous\" }\n  | { status: \"selected\"; pullRequestNumber: number };\n\n/** Resolve an explicit pull-request reference after the repository has been selected. */\nexport function selectSlackPullRequest(\n  text: string,\n  repositorySlug: string,\n): SlackPullRequestSelection {\n  const escapedSlug = repositorySlug.replace(/[.*+?^${}()|[\\]\\\\]/gu, \"\\\\$&\");\n  const references = [\n    ...text.matchAll(new RegExp(`https://github\\\\.com/${escapedSlug}/pull/(\\\\d+)`, \"giu\")),\n    ...text.matchAll(/\\b(?:pr|pull\\s+request)\\s*#?\\s*(\\d+)\\b/giu),\n  ].flatMap((match) => {\n    const value = Number(match[1]);\n    return Number.isSafeInteger(value) && value > 0 ? [value] : [];\n  });\n  const distinct = [...new Set(references)];\n  if (distinct.length === 0) return { status: \"none\" };\n  if (distinct.length > 1) return { status: \"ambiguous\" };\n  return { status: \"selected\", pullRequestNumber: distinct[0]! };\n}\n\n/** Parse Eve's Slack continuation token into its channel and thread target. */\nexport function parseSlackReplyAddress(address: string): SlackReplyTarget {\n  const separator = address.indexOf(\":\");\n  const channelId = address.slice(0, separator);\n  const threadTs = address.slice(separator + 1);\n  if (separator <= 0 || !/^[A-Z][A-Z0-9]+$/.test(channelId) || !/^\\d+\\.\\d+$/.test(threadTs)) {\n    throw new Error(`Invalid Slack reply address: ${address}.`);\n  }\n  return { channelId, threadTs };\n}\n\n/** Render a provider-neutral communication event as Slack mrkdwn. */\nexport function renderSlackCommunicationEvent(input: CommunicationEvent): string {\n  const event = communicationEventSchema.parse(input);\n  const headline = `*${slackOutcomeLabels[event.outcome]}*`;\n  const details = new Map(slackDetailFields.flatMap((field) => {\n    const value = event.data[field];\n    return typeof value === \"string\" && value.trim() !== \"\" ? [[field, value.trim()] as const] : [];\n  }));\n  const primaryField = ([\"title\", \"question\", \"requestedAction\"] as const)\n    .find((field) => details.has(field));\n  const primary = primaryField === undefined ? undefined : details.get(primaryField);\n  const url = details.get(\"url\");\n  const linkedPrimary = primary !== undefined && url !== undefined ? slackLink(url, primary) : null;\n  if (primaryField !== undefined) details.delete(primaryField);\n  if (linkedPrimary !== null) details.delete(\"url\");\n\n  const detailLines = [...new Set([\n    ...(linkedPrimary !== null ? [linkedPrimary] : primary === undefined ? [] : [escapeSlackText(primary)]),\n    ...[...details.values()].map(escapeSlackText),\n  ])];\n  const lists = slackListFields.flatMap((field) => {\n    const value = event.data[field];\n    if (!Array.isArray(value)) return [];\n    return value.flatMap((item) =>\n      typeof item === \"string\" && item.trim() !== \"\" ? [`• ${escapeSlackText(item.trim())}`] : []\n    );\n  });\n  const text = [headline, ...detailLines, ...(lists.length === 0 ? [] : [lists.join(\"\\n\")])]\n    .join(\"\\n\\n\");\n  return text.length <= slackTextLimit ? text : `${text.slice(0, slackTextLimit - 1)}…`;\n}\n\nfunction slackClientMessageId(eventId: string): string {\n  const digest = createHash(\"sha256\").update(eventId).digest(\"hex\").slice(0, 32);\n  return [\n    digest.slice(0, 8),\n    digest.slice(8, 12),\n    digest.slice(12, 16),\n    digest.slice(16, 20),\n    digest.slice(20),\n  ].join(\"-\");\n}\n\n/** Bind Slack rendering and delivery to the channel-neutral communication contract. */\nexport function createSlackCommunicationAdapter(\n  options: SlackCommunicationAdapterOptions,\n): SlackCommunicationAdapter {\n  const render = options.render ?? renderSlackCommunicationEvent;\n  return Object.freeze({\n    channel: \"slack\" as const,\n    render,\n    async deliver(input: CommunicationEvent): Promise<void> {\n      const event = communicationEventSchema.parse(input);\n      if (event.replyTo.channel !== \"slack\") {\n        throw new Error(`Slack communication adapter cannot deliver to ${event.replyTo.channel}.`);\n      }\n      const target = slackOwnerOutcomes.has(event.outcome)\n        ? { type: \"owner\" as const }\n        : { type: \"thread\" as const, ...parseSlackReplyAddress(event.replyTo.address) };\n      await options.send({\n        eventId: event.eventId,\n        clientMessageId: slackClientMessageId(event.eventId),\n        text: render(event),\n        target,\n      });\n    },\n  });\n}\n\nexport interface SlackMessageEvent {\n  teamId: string;\n  channelId: string;\n  messageTs: string;\n  threadTs: string;\n  actorId: string;\n  text: string;\n  replyAddress: string;\n  repositorySlugs: readonly [string, ...string[]];\n  payload: unknown;\n}\n\nexport interface SlackMessageSignal extends NormalizedSignal<\"slack\"> {\n  repositorySlugs: readonly [string, ...string[]];\n  message: {\n    teamId: string;\n    channelId: string;\n    messageTs: string;\n    threadTs: string;\n    actorId: string;\n    text: string;\n  };\n}\n\n/** Normalize an Eve-verified Slack message after the caller resolves its repositories. */\nexport function normalizeSlackMessage(event: SlackMessageEvent): SlackMessageSignal {\n  return {\n    source: \"slack\",\n    deliveryId: `${event.teamId}:${event.channelId}:${event.messageTs}`,\n    repositorySlugs: [\n      event.repositorySlugs[0].toLowerCase(),\n      ...event.repositorySlugs.slice(1).map((slug) => slug.toLowerCase()),\n    ],\n    replyTo: { channel: \"slack\", address: event.replyAddress },\n    message: {\n      teamId: event.teamId,\n      channelId: event.channelId,\n      messageTs: event.messageTs,\n      threadTs: event.threadTs,\n      actorId: event.actorId,\n      text: event.text,\n    },\n    payload: event.payload,\n  };\n}\n\nexport type SlackRepositorySelection =\n  | { status: \"selected\"; repositorySlug: string }\n  | { status: \"required\" }\n  | { status: \"ambiguous\"; repositorySlugs: readonly string[] };\n\nexport type SlackRepositoriesSelection =\n  | { status: \"selected\"; repositorySlugs: readonly [string, ...string[]] }\n  | { status: \"required\" };\n\nfunction escapedPattern(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\nfunction isDelimitedTextMentioned(text: string, value: string): boolean {\n  return new RegExp(\n    `(^|[^a-z0-9._/-])${escapedPattern(value)}($|[^a-z0-9._/-])`,\n    \"i\",\n  ).test(text);\n}\n\nfunction isRepositoryReferenceMentioned(text: string, slug: string): boolean {\n  if (isDelimitedTextMentioned(text, slug)) return true;\n  return new RegExp(\n    `https?://github\\\\.com/${escapedPattern(slug)}(?:\\\\.git)?/?(?=$|[\\\\s?#|>)\\\\],.!])`,\n    \"i\",\n  ).test(text);\n}\n\nfunction repositoryName(slug: string): string {\n  return slug.slice(slug.lastIndexOf(\"/\") + 1);\n}\n\ninterface SlackRepositoryMentions {\n  repositories: readonly string[];\n  matches: readonly string[];\n  ambiguous: readonly string[];\n  candidates: readonly string[];\n}\n\nfunction resolveSlackRepositoryMentions(\n  text: string,\n  repositories: readonly string[],\n): SlackRepositoryMentions {\n  const normalized = [...new Set(repositories.map((slug) => slug.toLowerCase()))];\n  const entries = normalized.map((slug) => ({ slug, name: repositoryName(slug) }));\n  const counts = new Map<string, number>();\n  for (const { name } of entries) {\n    counts.set(name, (counts.get(name) ?? 0) + 1);\n  }\n  const mentionedNames = new Set(\n    [...counts.keys()].filter((name) => isDelimitedTextMentioned(text, name)),\n  );\n  const matches = new Set(entries.flatMap(({ slug, name }) =>\n    isRepositoryReferenceMentioned(text, slug) || (\n      counts.get(name) === 1 && mentionedNames.has(name)\n    )\n      ? [slug]\n      : []\n  ));\n  const ambiguous = new Set(entries.flatMap(({ slug, name }) =>\n    counts.get(name) !== 1 && mentionedNames.has(name) ? [slug] : []\n  ));\n\n  return {\n    repositories: normalized,\n    matches: normalized.filter((slug) => matches.has(slug)),\n    ambiguous: normalized.filter((slug) => ambiguous.has(slug)),\n    candidates: normalized.filter((slug) => matches.has(slug) || ambiguous.has(slug)),\n  };\n}\n\n/** Select every named configured repository, preserving configuration order. */\nexport function selectSlackRepositories(\n  text: string,\n  repositories: readonly string[],\n): SlackRepositoriesSelection {\n  const mentions = resolveSlackRepositoryMentions(text, repositories);\n  if (mentions.repositories.length === 1) {\n    return { status: \"selected\", repositorySlugs: [mentions.repositories[0]!] };\n  }\n  if (mentions.ambiguous.length > 0) return { status: \"required\" };\n  return mentions.matches.length === 0\n    ? { status: \"required\" }\n    : {\n        status: \"selected\",\n        repositorySlugs: [mentions.matches[0]!, ...mentions.matches.slice(1)],\n      };\n}\n\n/**\n * Select the only configured repository, or match a full slug, unique short\n * name, or GitHub repository URL when a Slack surface fronts multiple repositories.\n */\nexport function selectSlackRepository(\n  text: string,\n  repositories: readonly string[],\n): SlackRepositorySelection {\n  const mentions = resolveSlackRepositoryMentions(text, repositories);\n  if (mentions.repositories.length === 1) {\n    return { status: \"selected\", repositorySlug: mentions.repositories[0]! };\n  }\n  if (mentions.candidates.length === 1) {\n    return { status: \"selected\", repositorySlug: mentions.candidates[0]! };\n  }\n  if (mentions.candidates.length > 1) {\n    return { status: \"ambiguous\", repositorySlugs: mentions.candidates };\n  }\n  return { status: \"required\" };\n}\n"],"mappings":";;;;AASA,MAAM,qBAA2D;CAC/D,UAAU;CACV,SAAS;CACT,WAAW;CACX,QAAQ;CACR,aAAa;CACb,UAAU;CACV,QAAQ;CACR,aAAa;CACb,gBAAgB;CAChB,kBAAkB;CAClB,SAAS;AACX;AAEA,MAAM,oBAAoB;CAAC;CAAS;CAAW;CAAW;CAAY;CAAmB;CAAU;AAAK;AACxG,MAAM,kBAAkB,CAAC,SAAS,SAAS;AAC3C,MAAM,iBAAiB;AACvB,MAAM,qCAAqB,IAAI,IAA0B;CACvD;CACA;CACA;AACF,CAAC;AAED,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,MAAM,WAAW,KAAK,OAAO,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,MAAM;AACtF;AAEA,SAAS,UAAU,KAAa,OAA8B;CAC5D,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS,OAAO;EACxE,OAAO,IAAI,gBAAgB,OAAO,SAAS,CAAC,EAAE,GAAG,gBAAgB,KAAK,EAAE;CAC1E,QAAQ;EACN,OAAO;CACT;AACF;;AAgCA,SAAgB,uBACd,MACA,gBAC2B;CAC3B,MAAM,cAAc,eAAe,QAAQ,wBAAwB,MAAM;CACzE,MAAM,aAAa,CACjB,GAAG,KAAK,SAAS,IAAI,OAAO,wBAAwB,YAAY,eAAe,KAAK,CAAC,GACrF,GAAG,KAAK,SAAS,2CAA2C,CAC9D,CAAC,CAAC,SAAS,UAAU;EACnB,MAAM,QAAQ,OAAO,MAAM,EAAE;EAC7B,OAAO,OAAO,cAAc,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;CAC/D,CAAC;CACD,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC;CACxC,IAAI,SAAS,WAAW,GAAG,OAAO,EAAE,QAAQ,OAAO;CACnD,IAAI,SAAS,SAAS,GAAG,OAAO,EAAE,QAAQ,YAAY;CACtD,OAAO;EAAE,QAAQ;EAAY,mBAAmB,SAAS;CAAI;AAC/D;;AAGA,SAAgB,uBAAuB,SAAmC;CACxE,MAAM,YAAY,QAAQ,QAAQ,GAAG;CACrC,MAAM,YAAY,QAAQ,MAAM,GAAG,SAAS;CAC5C,MAAM,WAAW,QAAQ,MAAM,YAAY,CAAC;CAC5C,IAAI,aAAa,KAAK,CAAC,mBAAmB,KAAK,SAAS,KAAK,CAAC,aAAa,KAAK,QAAQ,GACtF,MAAM,IAAI,MAAM,gCAAgC,QAAQ,EAAE;CAE5D,OAAO;EAAE;EAAW;CAAS;AAC/B;;AAGA,SAAgB,8BAA8B,OAAmC;CAC/E,MAAM,QAAQ,yBAAyB,MAAM,KAAK;CAClD,MAAM,WAAW,IAAI,mBAAmB,MAAM,SAAS;CACvD,MAAM,UAAU,IAAI,IAAI,kBAAkB,SAAS,UAAU;EAC3D,MAAM,QAAQ,MAAM,KAAK;EACzB,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KAAK,CAAC,CAAC,OAAO,MAAM,KAAK,CAAC,CAAU,IAAI,CAAC;CAChG,CAAC,CAAC;CACF,MAAM,eAAgB;EAAC;EAAS;EAAY;CAAiB,CAAC,CAC3D,MAAM,UAAU,QAAQ,IAAI,KAAK,CAAC;CACrC,MAAM,UAAU,iBAAiB,KAAA,IAAY,KAAA,IAAY,QAAQ,IAAI,YAAY;CACjF,MAAM,MAAM,QAAQ,IAAI,KAAK;CAC7B,MAAM,gBAAgB,YAAY,KAAA,KAAa,QAAQ,KAAA,IAAY,UAAU,KAAK,OAAO,IAAI;CAC7F,IAAI,iBAAiB,KAAA,GAAW,QAAQ,OAAO,YAAY;CAC3D,IAAI,kBAAkB,MAAM,QAAQ,OAAO,KAAK;CAEhD,MAAM,cAAc,CAAC,mBAAG,IAAI,IAAI,CAC9B,GAAI,kBAAkB,OAAO,CAAC,aAAa,IAAI,YAAY,KAAA,IAAY,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,GACrG,GAAG,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,IAAI,eAAe,CAC9C,CAAC,CAAC;CACF,MAAM,QAAQ,gBAAgB,SAAS,UAAU;EAC/C,MAAM,QAAQ,MAAM,KAAK;EACzB,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,CAAC;EACnC,OAAO,MAAM,SAAS,SACpB,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,KAAK,CAAC,KAAK,gBAAgB,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,CAC5F;CACF,CAAC;CACD,MAAM,OAAO;EAAC;EAAU,GAAG;EAAa,GAAI,MAAM,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;CAAE,CAAC,CACvF,KAAK,MAAM;CACd,OAAO,KAAK,UAAU,iBAAiB,OAAO,GAAG,KAAK,MAAM,GAAG,KAAkB,EAAE;AACrF;AAEA,SAAS,qBAAqB,SAAyB;CACrD,MAAM,SAAS,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;CAC7E,OAAO;EACL,OAAO,MAAM,GAAG,CAAC;EACjB,OAAO,MAAM,GAAG,EAAE;EAClB,OAAO,MAAM,IAAI,EAAE;EACnB,OAAO,MAAM,IAAI,EAAE;EACnB,OAAO,MAAM,EAAE;CACjB,CAAC,CAAC,KAAK,GAAG;AACZ;;AAGA,SAAgB,gCACd,SAC2B;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,OAAO,OAAO,OAAO;EACnB,SAAS;EACT;EACA,MAAM,QAAQ,OAA0C;GACtD,MAAM,QAAQ,yBAAyB,MAAM,KAAK;GAClD,IAAI,MAAM,QAAQ,YAAY,SAC5B,MAAM,IAAI,MAAM,iDAAiD,MAAM,QAAQ,QAAQ,EAAE;GAE3F,MAAM,SAAS,mBAAmB,IAAI,MAAM,OAAO,IAC/C,EAAE,MAAM,QAAiB,IACzB;IAAE,MAAM;IAAmB,GAAG,uBAAuB,MAAM,QAAQ,OAAO;GAAE;GAChF,MAAM,QAAQ,KAAK;IACjB,SAAS,MAAM;IACf,iBAAiB,qBAAqB,MAAM,OAAO;IACnD,MAAM,OAAO,KAAK;IAClB;GACF,CAAC;EACH;CACF,CAAC;AACH;;AA2BA,SAAgB,sBAAsB,OAA8C;CAClF,OAAO;EACL,QAAQ;EACR,YAAY,GAAG,MAAM,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM;EACxD,iBAAiB,CACf,MAAM,gBAAgB,EAAE,CAAC,YAAY,GACrC,GAAG,MAAM,gBAAgB,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,KAAK,YAAY,CAAC,CACpE;EACA,SAAS;GAAE,SAAS;GAAS,SAAS,MAAM;EAAa;EACzD,SAAS;GACP,QAAQ,MAAM;GACd,WAAW,MAAM;GACjB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,SAAS,MAAM;GACf,MAAM,MAAM;EACd;EACA,SAAS,MAAM;CACjB;AACF;AAWA,SAAS,eAAe,OAAuB;CAC7C,OAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEA,SAAS,yBAAyB,MAAc,OAAwB;CACtE,OAAO,IAAI,OACT,oBAAoB,eAAe,KAAK,EAAE,oBAC1C,GACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAS,+BAA+B,MAAc,MAAuB;CAC3E,IAAI,yBAAyB,MAAM,IAAI,GAAG,OAAO;CACjD,OAAO,IAAI,OACT,yBAAyB,eAAe,IAAI,EAAE,sCAC9C,GACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAS,eAAe,MAAsB;CAC5C,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;AAC7C;AASA,SAAS,+BACP,MACA,cACyB;CACzB,MAAM,aAAa,CAAC,GAAG,IAAI,IAAI,aAAa,KAAK,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC;CAC9E,MAAM,UAAU,WAAW,KAAK,UAAU;EAAE;EAAM,MAAM,eAAe,IAAI;CAAE,EAAE;CAC/E,MAAM,yBAAS,IAAI,IAAoB;CACvC,KAAK,MAAM,EAAE,UAAU,SACrB,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,KAAK,KAAK,CAAC;CAE9C,MAAM,iBAAiB,IAAI,IACzB,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,SAAS,yBAAyB,MAAM,IAAI,CAAC,CAC1E;CACA,MAAM,UAAU,IAAI,IAAI,QAAQ,SAAS,EAAE,MAAM,WAC/C,+BAA+B,MAAM,IAAI,KACvC,OAAO,IAAI,IAAI,MAAM,KAAK,eAAe,IAAI,IAAI,IAE/C,CAAC,IAAI,IACL,CAAC,CACP,CAAC;CACD,MAAM,YAAY,IAAI,IAAI,QAAQ,SAAS,EAAE,MAAM,WACjD,OAAO,IAAI,IAAI,MAAM,KAAK,eAAe,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CACjE,CAAC;CAED,OAAO;EACL,cAAc;EACd,SAAS,WAAW,QAAQ,SAAS,QAAQ,IAAI,IAAI,CAAC;EACtD,WAAW,WAAW,QAAQ,SAAS,UAAU,IAAI,IAAI,CAAC;EAC1D,YAAY,WAAW,QAAQ,SAAS,QAAQ,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC;CAClF;AACF;;AAGA,SAAgB,wBACd,MACA,cAC4B;CAC5B,MAAM,WAAW,+BAA+B,MAAM,YAAY;CAClE,IAAI,SAAS,aAAa,WAAW,GACnC,OAAO;EAAE,QAAQ;EAAY,iBAAiB,CAAC,SAAS,aAAa,EAAG;CAAE;CAE5E,IAAI,SAAS,UAAU,SAAS,GAAG,OAAO,EAAE,QAAQ,WAAW;CAC/D,OAAO,SAAS,QAAQ,WAAW,IAC/B,EAAE,QAAQ,WAAW,IACrB;EACE,QAAQ;EACR,iBAAiB,CAAC,SAAS,QAAQ,IAAK,GAAG,SAAS,QAAQ,MAAM,CAAC,CAAC;CACtE;AACN;;;;;AAMA,SAAgB,sBACd,MACA,cAC0B;CAC1B,MAAM,WAAW,+BAA+B,MAAM,YAAY;CAClE,IAAI,SAAS,aAAa,WAAW,GACnC,OAAO;EAAE,QAAQ;EAAY,gBAAgB,SAAS,aAAa;CAAI;CAEzE,IAAI,SAAS,WAAW,WAAW,GACjC,OAAO;EAAE,QAAQ;EAAY,gBAAgB,SAAS,WAAW;CAAI;CAEvE,IAAI,SAAS,WAAW,SAAS,GAC/B,OAAO;EAAE,QAAQ;EAAa,iBAAiB,SAAS;CAAW;CAErE,OAAO,EAAE,QAAQ,WAAW;AAC9B"}
+{"version":3,"file":"slack.mjs","names":[],"sources":["../../src/connectors/slack.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { MaybePromise } from \"../schema/common\";\nimport { repositorySlugSchema, type RepositorySlug } from \"../schema/repository\";\nexport {\n  createSlackApprovals,\n  type SlackApprovals,\n  type SlackApprovalsOptions,\n  type SlackApprovalsStores,\n} from \"./slack-approvals\";\nimport {\n  communicationEventSchema,\n  type CommunicationAdapter,\n  type CommunicationEvent,\n  type CommunicationOutcome,\n  type NormalizedSignal,\n} from \"./index\";\n\nconst slackOutcomeLabels: Record<CommunicationOutcome, string> = {\n  accepted: \"Request accepted\",\n  started: \"Work started\",\n  succeeded: \"Work completed\",\n  failed: \"Work failed\",\n  cancelled: \"Work cancelled\",\n  needs_human: \"Human action required\",\n  question: \"Question requires an answer\",\n  digest: \"Factory digest\",\n  rolled_back: \"Change rolled back\",\n  budget_warning: \"Factory budget warning\",\n  budget_exhausted: \"Factory budget exhausted\",\n  message: \"Factory update\",\n};\n\nconst slackDetailFields = [\n  \"title\",\n  \"message\",\n  \"summary\",\n  \"question\",\n  \"requestedAction\",\n  \"reference\",\n  \"answerLocation\",\n  \"reason\",\n  \"url\",\n] as const;\nconst slackListFields = [\"items\", \"options\"] as const;\nconst slackTextLimit = 12_000;\nconst slackOwnerOutcomes = new Set<CommunicationOutcome>([\n  \"digest\",\n  \"budget_warning\",\n  \"budget_exhausted\",\n  \"needs_human\",\n]);\n\nfunction escapeSlackText(value: string): string {\n  return value.replaceAll(\"&\", \"&amp;\").replaceAll(\"<\", \"&lt;\").replaceAll(\">\", \"&gt;\");\n}\n\nfunction slackLink(url: string, label: string): string | null {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return null;\n    return `<${escapeSlackText(parsed.toString())}|${escapeSlackText(label)}>`;\n  } catch {\n    return null;\n  }\n}\n\n/** Fully rendered Slack delivery with a stable idempotency key and resolved destination. */\nexport interface SlackCommunicationDelivery {\n  eventId: string;\n  clientMessageId: string;\n  text: string;\n  target: { type: \"owner\" } | { type: \"thread\"; channelId: string; threadTs: string };\n}\n\n/** Slack-specific communication adapter with an inspectable mrkdwn renderer. */\nexport interface SlackCommunicationAdapter extends CommunicationAdapter {\n  readonly channel: \"slack\";\n  render(event: CommunicationEvent): string;\n}\n\n/** Configures Slack rendering, provider delivery, and durable delivery projection. */\nexport interface SlackCommunicationAdapterOptions {\n  send(delivery: SlackCommunicationDelivery): Promise<void>;\n  render?: (event: CommunicationEvent) => string;\n  /**\n   * Runs once send() resolves without throwing, i.e. once Slack has\n   * confirmed delivery. Errors propagate so the outbox retries with the same\n   * client message ID until both the send and its durable projection succeed.\n   */\n  onDelivered?: (event: CommunicationEvent) => MaybePromise<void>;\n}\n\n/** The channel and thread extracted from a Slack reply address. */\nexport interface SlackReplyTarget {\n  channelId: string;\n  threadTs: string;\n}\n\n/** Parse Eve's Slack continuation token into its channel and thread target. */\nexport function parseSlackReplyAddress(address: string): SlackReplyTarget {\n  const separator = address.indexOf(\":\");\n  const channelId = address.slice(0, separator);\n  const threadTs = address.slice(separator + 1);\n  if (separator <= 0 || !/^[A-Z][A-Z0-9]+$/.test(channelId) || !/^\\d+\\.\\d+$/.test(threadTs)) {\n    throw new Error(`Invalid Slack reply address: ${address}.`);\n  }\n  return { channelId, threadTs };\n}\n\n/** Render a provider-neutral communication event as Slack mrkdwn. */\nexport function renderSlackCommunicationEvent(input: CommunicationEvent): string {\n  const event = communicationEventSchema.parse(input);\n  const headline = `*${slackOutcomeLabels[event.outcome]}*`;\n  const details = new Map(\n    slackDetailFields.flatMap((field) => {\n      const value = event.data[field];\n      return typeof value === \"string\" && value.trim() !== \"\"\n        ? [[field, value.trim()] as const]\n        : [];\n    }),\n  );\n  const primaryField = ([\"title\", \"question\", \"requestedAction\"] as const).find((field) =>\n    details.has(field),\n  );\n  const primary = primaryField === undefined ? undefined : details.get(primaryField);\n  const url = details.get(\"url\");\n  const linkedPrimary = primary !== undefined && url !== undefined ? slackLink(url, primary) : null;\n  if (primaryField !== undefined) details.delete(primaryField);\n  if (linkedPrimary !== null) details.delete(\"url\");\n\n  const detailLines = [\n    ...new Set([\n      ...(linkedPrimary !== null\n        ? [linkedPrimary]\n        : primary === undefined\n          ? []\n          : [escapeSlackText(primary)]),\n      ...[...details.values()].map(escapeSlackText),\n    ]),\n  ];\n  const lists = slackListFields.flatMap((field) => {\n    const value = event.data[field];\n    if (!Array.isArray(value)) return [];\n    return value.flatMap((item) =>\n      typeof item === \"string\" && item.trim() !== \"\" ? [`• ${escapeSlackText(item.trim())}`] : [],\n    );\n  });\n  // Success messages lead directly with the result; the generic outcome\n  // headline is redundant once the work is done and the summary says it all.\n  // When a succeeded event carries no other content, fall back to the\n  // shared status-label mapping so the message is never blank and stays\n  // consistent with how every other outcome renders.\n  const hasContent = detailLines.length > 0 || lists.length > 0;\n  const headlineLines = event.outcome === \"succeeded\" && hasContent ? [] : [headline];\n  const text = [\n    ...headlineLines,\n    ...detailLines,\n    ...(lists.length === 0 ? [] : [lists.join(\"\\n\")]),\n  ].join(\"\\n\\n\");\n  return text.length <= slackTextLimit ? text : `${text.slice(0, slackTextLimit - 1)}…`;\n}\n\nfunction slackClientMessageId(eventId: string): string {\n  const digest = createHash(\"sha256\").update(eventId).digest(\"hex\").slice(0, 32);\n  return [\n    digest.slice(0, 8),\n    digest.slice(8, 12),\n    digest.slice(12, 16),\n    digest.slice(16, 20),\n    digest.slice(20),\n  ].join(\"-\");\n}\n\n/** Bind Slack rendering and delivery to the channel-neutral communication contract. */\nexport function createSlackCommunicationAdapter(\n  options: SlackCommunicationAdapterOptions,\n): SlackCommunicationAdapter {\n  const render = options.render ?? renderSlackCommunicationEvent;\n  return Object.freeze({\n    channel: \"slack\" as const,\n    render,\n    async deliver(input: CommunicationEvent): Promise<void> {\n      const event = communicationEventSchema.parse(input);\n      if (event.replyTo.channel !== \"slack\") {\n        throw new Error(`Slack communication adapter cannot deliver to ${event.replyTo.channel}.`);\n      }\n      const target = slackOwnerOutcomes.has(event.outcome)\n        ? { type: \"owner\" as const }\n        : { type: \"thread\" as const, ...parseSlackReplyAddress(event.replyTo.address) };\n      await options.send({\n        eventId: event.eventId,\n        clientMessageId: slackClientMessageId(event.eventId),\n        text: render(event),\n        target,\n      });\n      await options.onDelivered?.(event);\n    },\n  });\n}\n\n/** Authenticated Slack message metadata after repository and reply context resolution. */\nexport interface SlackMessageEvent {\n  readonly teamId: string;\n  readonly channelId: string;\n  readonly messageTs: string;\n  readonly threadTs: string;\n  readonly actorId: string;\n  readonly text: string;\n  readonly replyAddress: string;\n  readonly repositorySlugs: readonly [RepositorySlug, ...RepositorySlug[]];\n  readonly payload: unknown;\n}\n\n/** A normalized Slack signal with the authenticated message and repository scope retained. */\nexport interface SlackMessageSignal extends NormalizedSignal<\"slack\"> {\n  readonly repositorySlugs: readonly [RepositorySlug, ...RepositorySlug[]];\n  readonly message: {\n    readonly teamId: string;\n    readonly channelId: string;\n    readonly messageTs: string;\n    readonly threadTs: string;\n    readonly actorId: string;\n    readonly text: string;\n  };\n}\n\n/** Normalize an Eve-verified Slack message after the caller resolves its repositories. */\nexport function normalizeSlackMessage(event: SlackMessageEvent): SlackMessageSignal {\n  return {\n    source: \"slack\",\n    deliveryId: `${event.teamId}:${event.channelId}:${event.messageTs}`,\n    repositorySlugs: [\n      repositorySlugSchema.parse(event.repositorySlugs[0].toLowerCase()),\n      ...event.repositorySlugs\n        .slice(1)\n        .map((slug) => repositorySlugSchema.parse(slug.toLowerCase())),\n    ],\n    replyTo: { channel: \"slack\", address: event.replyAddress },\n    message: {\n      teamId: event.teamId,\n      channelId: event.channelId,\n      messageTs: event.messageTs,\n      threadTs: event.threadTs,\n      actorId: event.actorId,\n      text: event.text,\n    },\n    payload: event.payload,\n  };\n}\n"],"mappings":";;;;;AAiBA,MAAM,qBAA2D;CAC/D,UAAU;CACV,SAAS;CACT,WAAW;CACX,QAAQ;CACR,WAAW;CACX,aAAa;CACb,UAAU;CACV,QAAQ;CACR,aAAa;CACb,gBAAgB;CAChB,kBAAkB;CAClB,SAAS;AACX;AAEA,MAAM,oBAAoB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAM,kBAAkB,CAAC,SAAS,SAAS;AAC3C,MAAM,iBAAiB;AACvB,MAAM,qCAAqB,IAAI,IAA0B;CACvD;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,gBAAgB,OAAuB;CAC9C,OAAO,MAAM,WAAW,KAAK,OAAO,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,WAAW,KAAK,MAAM;AACtF;AAEA,SAAS,UAAU,KAAa,OAA8B;CAC5D,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS,OAAO;EACxE,OAAO,IAAI,gBAAgB,OAAO,SAAS,CAAC,EAAE,GAAG,gBAAgB,KAAK,EAAE;CAC1E,QAAQ;EACN,OAAO;CACT;AACF;;AAmCA,SAAgB,uBAAuB,SAAmC;CACxE,MAAM,YAAY,QAAQ,QAAQ,GAAG;CACrC,MAAM,YAAY,QAAQ,MAAM,GAAG,SAAS;CAC5C,MAAM,WAAW,QAAQ,MAAM,YAAY,CAAC;CAC5C,IAAI,aAAa,KAAK,CAAC,mBAAmB,KAAK,SAAS,KAAK,CAAC,aAAa,KAAK,QAAQ,GACtF,MAAM,IAAI,MAAM,gCAAgC,QAAQ,EAAE;CAE5D,OAAO;EAAE;EAAW;CAAS;AAC/B;;AAGA,SAAgB,8BAA8B,OAAmC;CAC/E,MAAM,QAAQ,yBAAyB,MAAM,KAAK;CAClD,MAAM,WAAW,IAAI,mBAAmB,MAAM,SAAS;CACvD,MAAM,UAAU,IAAI,IAClB,kBAAkB,SAAS,UAAU;EACnC,MAAM,QAAQ,MAAM,KAAK;EACzB,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,KACjD,CAAC,CAAC,OAAO,MAAM,KAAK,CAAC,CAAU,IAC/B,CAAC;CACP,CAAC,CACH;CACA,MAAM,eAAgB;EAAC;EAAS;EAAY;CAAiB,CAAC,CAAW,MAAM,UAC7E,QAAQ,IAAI,KAAK,CACnB;CACA,MAAM,UAAU,iBAAiB,KAAA,IAAY,KAAA,IAAY,QAAQ,IAAI,YAAY;CACjF,MAAM,MAAM,QAAQ,IAAI,KAAK;CAC7B,MAAM,gBAAgB,YAAY,KAAA,KAAa,QAAQ,KAAA,IAAY,UAAU,KAAK,OAAO,IAAI;CAC7F,IAAI,iBAAiB,KAAA,GAAW,QAAQ,OAAO,YAAY;CAC3D,IAAI,kBAAkB,MAAM,QAAQ,OAAO,KAAK;CAEhD,MAAM,cAAc,CAClB,mBAAG,IAAI,IAAI,CACT,GAAI,kBAAkB,OAClB,CAAC,aAAa,IACd,YAAY,KAAA,IACV,CAAC,IACD,CAAC,gBAAgB,OAAO,CAAC,GAC/B,GAAG,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,IAAI,eAAe,CAC9C,CAAC,CACH;CACA,MAAM,QAAQ,gBAAgB,SAAS,UAAU;EAC/C,MAAM,QAAQ,MAAM,KAAK;EACzB,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,CAAC;EACnC,OAAO,MAAM,SAAS,SACpB,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,KAAK,CAAC,KAAK,gBAAgB,KAAK,KAAK,CAAC,GAAG,IAAI,CAAC,CAC5F;CACF,CAAC;CAMD,MAAM,aAAa,YAAY,SAAS,KAAK,MAAM,SAAS;CAE5D,MAAM,OAAO;EACX,GAFoB,MAAM,YAAY,eAAe,aAAa,CAAC,IAAI,CAAC,QAAQ;EAGhF,GAAG;EACH,GAAI,MAAM,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;CACjD,CAAC,CAAC,KAAK,MAAM;CACb,OAAO,KAAK,UAAU,iBAAiB,OAAO,GAAG,KAAK,MAAM,GAAG,KAAkB,EAAE;AACrF;AAEA,SAAS,qBAAqB,SAAyB;CACrD,MAAM,SAAS,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;CAC7E,OAAO;EACL,OAAO,MAAM,GAAG,CAAC;EACjB,OAAO,MAAM,GAAG,EAAE;EAClB,OAAO,MAAM,IAAI,EAAE;EACnB,OAAO,MAAM,IAAI,EAAE;EACnB,OAAO,MAAM,EAAE;CACjB,CAAC,CAAC,KAAK,GAAG;AACZ;;AAGA,SAAgB,gCACd,SAC2B;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,OAAO,OAAO,OAAO;EACnB,SAAS;EACT;EACA,MAAM,QAAQ,OAA0C;GACtD,MAAM,QAAQ,yBAAyB,MAAM,KAAK;GAClD,IAAI,MAAM,QAAQ,YAAY,SAC5B,MAAM,IAAI,MAAM,iDAAiD,MAAM,QAAQ,QAAQ,EAAE;GAE3F,MAAM,SAAS,mBAAmB,IAAI,MAAM,OAAO,IAC/C,EAAE,MAAM,QAAiB,IACzB;IAAE,MAAM;IAAmB,GAAG,uBAAuB,MAAM,QAAQ,OAAO;GAAE;GAChF,MAAM,QAAQ,KAAK;IACjB,SAAS,MAAM;IACf,iBAAiB,qBAAqB,MAAM,OAAO;IACnD,MAAM,OAAO,KAAK;IAClB;GACF,CAAC;GACD,MAAM,QAAQ,cAAc,KAAK;EACnC;CACF,CAAC;AACH;;AA6BA,SAAgB,sBAAsB,OAA8C;CAClF,OAAO;EACL,QAAQ;EACR,YAAY,GAAG,MAAM,OAAO,GAAG,MAAM,UAAU,GAAG,MAAM;EACxD,iBAAiB,CACf,qBAAqB,MAAM,MAAM,gBAAgB,EAAE,CAAC,YAAY,CAAC,GACjE,GAAG,MAAM,gBACN,MAAM,CAAC,CAAC,CACR,KAAK,SAAS,qBAAqB,MAAM,KAAK,YAAY,CAAC,CAAC,CACjE;EACA,SAAS;GAAE,SAAS;GAAS,SAAS,MAAM;EAAa;EACzD,SAAS;GACP,QAAQ,MAAM;GACd,WAAW,MAAM;GACjB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,SAAS,MAAM;GACf,MAAM,MAAM;EACd;EACA,SAAS,MAAM;CACjB;AACF"}

package/dist/deepsec/eve-tool.d.mts

@@ -0,0 +1,110 @@
+import { TaskId } from "../schema/id.mjs";
+import { MillisecondClock } from "../schema/common.mjs";
+import { FactoryStores } from "../store/engine.mjs";
+import { CommandSandbox, CommandSandboxRunResult } from "../sandbox/command.mjs";
+import { Finding } from "../schema/finding.mjs";
+import { AdmitFindingOptions } from "../finding-remediation/admission.mjs";
+import { z } from "zod";
+import { ToolContext, ToolDefinition } from "eve/tools";
+//#region src/deepsec/eve-tool.d.ts
+/** Repository, receipt, Signal, and Task capabilities required by the Deepsec scan tool. */
+type DeepsecScanToolStores = Pick<FactoryStores, "receipts" | "repositories" | "signals" | "tasks">;
+/** Deepsec investigation backend selected for one scan. */
+type DeepsecAgent = "claude" | "codex" | "pi";
+/** Reasoning effort accepted by Deepsec's investigation agent. */
+type DeepsecThinkingLevel = "minimal" | "low" | "medium" | "high" | "xhigh";
+/** Validates the repository and optional candidate-file cap supplied to the Deepsec tool. */
+declare const deepsecScanInputSchema: z.ZodObject<{
+  repositoryId: z.ZodType<`repo_${string}`, string, z.core.$ZodTypeInternals<`repo_${string}`, string>>;
+  limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/** Repository and optional candidate-file cap supplied to one Deepsec scan. */
+type DeepsecScanInput = z.infer<typeof deepsecScanInputSchema>;
+/** Configures credential isolation, execution limits, and finding admission for a deepsec scan. */
+interface DeepsecScanToolOptions<S extends CommandSandbox = CommandSandbox> extends AdmitFindingOptions {
+  /** Factory capabilities used to report scan phases and admit findings. */
+  stores: DeepsecScanToolStores;
+  /**
+   * Runs one shell command with the model credential deepsec's gateway route
+   * expects, and removes it again before resolving. Supplied by the app, which
+   * owns where the credential comes from: on Vercel it is the deployment's own
+   * OIDC identity (VERCEL_OIDC_TOKEN), so nothing has to be configured.
+   */
+  withModelCredential: (input: DeepsecCredentialCommandInput<S>) => Promise<DeepsecCommandResult>;
+  /** deepsec agent backend: claude, codex, or pi. */
+  agent?: DeepsecAgent;
+  /** Model deepsec's investigation agent uses, through the AI Gateway (e.g. claude-sonnet-4-6). */
+  model?: string;
+  /** Reasoning effort for the investigation: minimal, low, medium, high, or xhigh. */
+  thinkingLevel?: DeepsecThinkingLevel;
+  /** Parallel investigation batches. */
+  concurrency?: number;
+  /** deepsec version to install. */
+  version?: string;
+  /** Millisecond clock used for receipt elapsed-time reporting. */
+  now?: MillisecondClock;
+  /** Repository checkout inside the sandbox. Defaults to `repo`. */
+  repoPath?: string;
+  /** deepsec workspace inside the sandbox. Defaults to `deepsec`. */
+  workspacePath?: string;
+  /** Shell run before every deepsec command, e.g. to put a Node 24 on PATH. */
+  commandPrefix?: string;
+  /**
+   * Candidate files investigated per run. deepsec keeps state, so successive
+   * scans continue where the last one stopped; the cap keeps one run inside
+   * the deployment's time limit on large repositories. Defaults to 40.
+   */
+  filesPerRun?: number;
+}
+/** Sandbox and trusted command that may temporarily receive a model credential. */
+interface DeepsecCredentialCommandInput<S extends CommandSandbox = CommandSandbox> {
+  sandbox: S;
+  command: string;
+}
+/** Captured output from one Deepsec sandbox command. */
+type DeepsecCommandResult = CommandSandboxRunResult;
+/** Machine-readable reason a Deepsec scan did not produce findings. */
+type DeepsecScanFailureCode = "repository_not_found" | "scan_failed" | "process_failed" | "invalid_export_json" | "invalid_export_shape";
+/** Bounded Deepsec refusal with a human-readable reason code payload. */
+interface DeepsecScanFailure {
+  scanned: false;
+  code: DeepsecScanFailureCode;
+  reason: string;
+}
+/** One normalized Deepsec finding and its admission outcome. */
+type DeepsecScanFinding = Pick<Finding, "title" | "priority" | "path" | "line"> & ({
+  duplicate: true;
+  taskId?: never;
+  approval?: never;
+} | {
+  duplicate?: never;
+  taskId: TaskId;
+  approval: "required" | "not_required";
+});
+/** Counts and bounded finding summaries returned after a completed Deepsec scan. */
+interface DeepsecScanSuccess {
+  scanned: true;
+  tool: "deepsec";
+  found: number;
+  recorded: number;
+  duplicates: number;
+  awaitingApproval: number;
+  findings: readonly DeepsecScanFinding[];
+}
+/** Discriminated result returned by the optional Deepsec scanner tool. */
+type DeepsecScanResult = DeepsecScanFailure | DeepsecScanSuccess;
+/** Eve tool that runs one bounded Deepsec scan and admits its findings. */
+interface DeepsecScanTool extends ToolDefinition<DeepsecScanInput, DeepsecScanResult> {
+  execute(input: DeepsecScanInput, ctx: ToolContext): Promise<DeepsecScanResult>;
+}
+/**
+ * Runs deepsec (vercel-labs/deepsec) against the sandbox checkout and records
+ * what it finds through the same path as record_finding, so every deepsec
+ * finding becomes a fix task subject to the approval policy. Trusted code
+ * owns the command sequence and the credential; the agent chooses when to
+ * scan and reports the outcome.
+ */
+declare function createDeepsecScanTool<S extends CommandSandbox>(input: DeepsecScanToolOptions<S>): DeepsecScanTool;
+//#endregion
+export { DeepsecAgent, DeepsecCommandResult, DeepsecCredentialCommandInput, DeepsecScanFailure, DeepsecScanFailureCode, DeepsecScanFinding, DeepsecScanInput, DeepsecScanResult, DeepsecScanSuccess, DeepsecScanTool, DeepsecScanToolOptions, DeepsecScanToolStores, DeepsecThinkingLevel, createDeepsecScanTool, deepsecScanInputSchema };
+//# sourceMappingURL=eve-tool.d.mts.map

package/dist/deepsec/eve-tool.mjs

@@ -0,0 +1,166 @@
+import { repositoryIdSchema } from "../schema/id.mjs";
+import { optionalTaskIdForSession } from "../eve/task-session.mjs";
+import { deepsecExportSchema, findingFromDeepsec } from "./finding.mjs";
+import { admitFinding } from "../finding-remediation/admission.mjs";
+import { z } from "zod";
+import { defineTool } from "eve/tools";
+//#region src/deepsec/eve-tool.ts
+/** Validates the repository and optional candidate-file cap supplied to the Deepsec tool. */
+const deepsecScanInputSchema = z.object({
+	repositoryId: repositoryIdSchema,
+	limit: z.number().int().min(1).max(500).optional().describe("Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).")
+});
+const findingsPath = "/tmp/deepsec-findings.json";
+/** Parse "N file(s) with candidates" out of deepsec scan output; null when absent. */
+function candidateCount(output) {
+	const match = /(\d+)\s+file\(s\) with candidates/u.exec(output);
+	return match?.[1] === void 0 ? null : Number(match[1]);
+}
+/** The last few meaningful lines of a command's output, ANSI stripped, for a receipt. */
+function tail(output, lines = 4) {
+	return output.replaceAll(/\u001b\[[0-9;]*m/gu, "").split("\n").map((line) => line.trim()).filter((line) => line !== "").slice(-lines).join(" | ").slice(0, 600);
+}
+/**
+* Runs deepsec (vercel-labs/deepsec) against the sandbox checkout and records
+* what it finds through the same path as record_finding, so every deepsec
+* finding becomes a fix task subject to the approval policy. Trusted code
+* owns the command sequence and the credential; the agent chooses when to
+* scan and reports the outcome.
+*/
+function createDeepsecScanTool(input) {
+	const { stores, ...options } = input;
+	const repoPath = options.repoPath ?? "repo";
+	const workspace = options.workspacePath ?? "deepsec";
+	const version = options.version ?? "2.3.8";
+	const agent = options.agent ?? "claude";
+	const model = options.model ?? "claude-sonnet-4-6";
+	const thinkingLevel = options.thinkingLevel ?? "medium";
+	const concurrency = options.concurrency ?? 4;
+	const prefix = options.commandPrefix === void 0 ? [] : [options.commandPrefix];
+	const filesPerRun = options.filesPerRun ?? 40;
+	const now = options.now ?? Date.now;
+	return defineTool({
+		description: "Run deepsec, the AI-powered vulnerability scanner, over the repository checkout and record every finding it reports as a fix task. Takes minutes. Call once per scan; then summarize the result.",
+		inputSchema: deepsecScanInputSchema,
+		async execute({ repositoryId, limit }, ctx) {
+			const repository = await stores.repositories.get(repositoryId);
+			if (repository === null) return {
+				scanned: false,
+				code: "repository_not_found",
+				reason: `repository ${repositoryId} does not exist`
+			};
+			const sandbox = await ctx.getSandbox();
+			const projectId = repository.slug.replace(/[^a-z0-9]+/gu, "-");
+			const startedAt = now();
+			const phase = async (state, reason) => {
+				await stores.receipts.append({
+					repositoryIds: [repositoryId],
+					kind: "deepsec",
+					state,
+					phase: "security_scan",
+					reason: `${reason} (${Math.round((now() - startedAt) / 1e3)}s in)`
+				});
+			};
+			await phase("started", `deepsec ${version} on ${repository.slug}, ${agent}/${model}`);
+			const prepare = await sandbox.run({ command: [
+				...prefix,
+				"set -e",
+				`if [ ! -f ${workspace}/deepsec.config.ts ]; then`,
+				`  npx -y deepsec@${version} init ./${workspace} ./${repoPath} --id ${projectId} --scaffold-only --headless --yes --skip-install`,
+				`  (cd ${workspace} && npm install --no-audit --no-fund --loglevel=error)`,
+				"fi",
+				`cd ${workspace}`,
+				`./node_modules/.bin/deepsec scan --project-id ${projectId}`
+			].join("\n") });
+			if (typeof prepare.exitCode === "number" && prepare.exitCode !== 0) {
+				const detail = (prepare.stderr ?? prepare.stdout).trim().slice(-1500);
+				await phase("failed", `scan phase failed: ${detail.slice(-300)}`);
+				return {
+					scanned: false,
+					code: "scan_failed",
+					reason: `deepsec scan failed: ${detail}`
+				};
+			}
+			const candidates = candidateCount(prepare.stdout);
+			await phase("scanned", `${candidates === null ? "scan output" : `${candidates} files with candidates`}: ${tail(`${prepare.stdout}\n${prepare.stderr ?? ""}`)}`);
+			const investigate = await options.withModelCredential({
+				sandbox,
+				command: [
+					...prefix,
+					"set -e",
+					`cd ${workspace}`,
+					`./node_modules/.bin/deepsec process --project-id ${projectId} --agent ${agent} --model ${model} --thinking-level ${thinkingLevel} --concurrency ${concurrency} --limit ${limit ?? filesPerRun}`,
+					`./node_modules/.bin/deepsec export --project-id ${projectId} --format json --out ${findingsPath}`
+				].join("\n")
+			});
+			if (typeof investigate.exitCode === "number" && investigate.exitCode !== 0) {
+				const detail = (investigate.stderr ?? investigate.stdout).trim().slice(-1500);
+				await phase("failed", `process phase failed: ${detail.slice(-300)}`);
+				return {
+					scanned: false,
+					code: "process_failed",
+					reason: `deepsec process failed: ${detail}`
+				};
+			}
+			const exported = await sandbox.run({ command: `cat ${findingsPath}` });
+			let parsed;
+			try {
+				parsed = JSON.parse(exported.stdout);
+			} catch {
+				return {
+					scanned: false,
+					code: "invalid_export_json",
+					reason: "deepsec export was not valid JSON"
+				};
+			}
+			const raw = deepsecExportSchema.safeParse(parsed);
+			if (!raw.success) return {
+				scanned: false,
+				code: "invalid_export_shape",
+				reason: `deepsec export had an unexpected shape: ${raw.error.issues[0]?.message ?? "unknown"}`
+			};
+			const results = [];
+			const taskId = optionalTaskIdForSession(ctx.session.auth.initiator);
+			const scan = taskId === null ? null : await stores.tasks.get(taskId);
+			const root = scan && scan.rootTaskId !== scan.id ? await stores.tasks.get(scan.rootTaskId) : scan;
+			const replyTo = scan?.replyTo.channel === "slack" && scan.repositoryIds.includes(repositoryId) ? scan.replyTo : options.replyTo;
+			for (const entry of raw.data) {
+				const finding = findingFromDeepsec(entry);
+				results.push({
+					finding,
+					result: await admitFinding(stores, {
+						repositoryId,
+						finding,
+						...options,
+						replyTo,
+						operator: scan?.repositoryIds.includes(repositoryId) === true ? scan.origin.operator ?? root?.origin.operator : options.operator
+					})
+				});
+			}
+			const recorded = results.filter(({ result }) => result.recorded);
+			await phase("completed", `${results.length} findings, ${recorded.length} new. process output: ${tail(`${investigate.stdout}\n${investigate.stderr ?? ""}`, 6)}`);
+			return {
+				scanned: true,
+				tool: "deepsec",
+				found: results.length,
+				recorded: recorded.length,
+				duplicates: results.length - recorded.length,
+				awaitingApproval: recorded.filter(({ result }) => result.recorded && result.approval === "required").length,
+				findings: results.map(({ finding, result }) => ({
+					title: finding.title,
+					priority: finding.priority,
+					path: finding.path,
+					line: finding.line,
+					...result.recorded ? {
+						taskId: result.taskId,
+						approval: result.approval
+					} : { duplicate: true }
+				}))
+			};
+		}
+	});
+}
+//#endregion
+export { createDeepsecScanTool, deepsecScanInputSchema };
+
+//# sourceMappingURL=eve-tool.mjs.map

package/dist/deepsec/eve-tool.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"eve-tool.mjs","names":[],"sources":["../../src/deepsec/eve-tool.ts"],"sourcesContent":["import { defineTool, type ToolContext, type ToolDefinition } from \"eve/tools\";\nimport { z } from \"zod\";\nimport { deepsecExportSchema, findingFromDeepsec } from \"./finding\";\nimport {\n  admitFinding,\n  type AdmitFindingOptions,\n  type AdmitFindingResult,\n} from \"../finding-remediation/admission\";\nimport type { Finding } from \"../schema/finding\";\nimport type { MillisecondClock } from \"../schema/common\";\nimport { repositoryIdSchema, type TaskId } from \"../schema/id\";\nimport type { FactoryStores } from \"../store/engine\";\nimport { optionalTaskIdForSession } from \"../eve/task-session\";\nimport type { CommandSandbox, CommandSandboxRunResult } from \"../sandbox/command\";\n\n/** Repository, receipt, Signal, and Task capabilities required by the Deepsec scan tool. */\nexport type DeepsecScanToolStores = Pick<\n  FactoryStores,\n  \"receipts\" | \"repositories\" | \"signals\" | \"tasks\"\n>;\n\n/** Deepsec investigation backend selected for one scan. */\nexport type DeepsecAgent = \"claude\" | \"codex\" | \"pi\";\n\n/** Reasoning effort accepted by Deepsec's investigation agent. */\nexport type DeepsecThinkingLevel = \"minimal\" | \"low\" | \"medium\" | \"high\" | \"xhigh\";\n\n/** Validates the repository and optional candidate-file cap supplied to the Deepsec tool. */\nexport const deepsecScanInputSchema = z.object({\n  repositoryId: repositoryIdSchema,\n  limit: z\n    .number()\n    .int()\n    .min(1)\n    .max(500)\n    .optional()\n    .describe(\n      \"Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).\",\n    ),\n});\n\n/** Repository and optional candidate-file cap supplied to one Deepsec scan. */\nexport type DeepsecScanInput = z.infer<typeof deepsecScanInputSchema>;\n\n/** Configures credential isolation, execution limits, and finding admission for a deepsec scan. */\nexport interface DeepsecScanToolOptions<\n  S extends CommandSandbox = CommandSandbox,\n> extends AdmitFindingOptions {\n  /** Factory capabilities used to report scan phases and admit findings. */\n  stores: DeepsecScanToolStores;\n  /**\n   * Runs one shell command with the model credential deepsec's gateway route\n   * expects, and removes it again before resolving. Supplied by the app, which\n   * owns where the credential comes from: on Vercel it is the deployment's own\n   * OIDC identity (VERCEL_OIDC_TOKEN), so nothing has to be configured.\n   */\n  withModelCredential: (input: DeepsecCredentialCommandInput<S>) => Promise<DeepsecCommandResult>;\n  /** deepsec agent backend: claude, codex, or pi. */\n  agent?: DeepsecAgent;\n  /** Model deepsec's investigation agent uses, through the AI Gateway (e.g. claude-sonnet-4-6). */\n  model?: string;\n  /** Reasoning effort for the investigation: minimal, low, medium, high, or xhigh. */\n  thinkingLevel?: DeepsecThinkingLevel;\n  /** Parallel investigation batches. */\n  concurrency?: number;\n  /** deepsec version to install. */\n  version?: string;\n  /** Millisecond clock used for receipt elapsed-time reporting. */\n  now?: MillisecondClock;\n  /** Repository checkout inside the sandbox. Defaults to `repo`. */\n  repoPath?: string;\n  /** deepsec workspace inside the sandbox. Defaults to `deepsec`. */\n  workspacePath?: string;\n  /** Shell run before every deepsec command, e.g. to put a Node 24 on PATH. */\n  commandPrefix?: string;\n  /**\n   * Candidate files investigated per run. deepsec keeps state, so successive\n   * scans continue where the last one stopped; the cap keeps one run inside\n   * the deployment's time limit on large repositories. Defaults to 40.\n   */\n  filesPerRun?: number;\n}\n\n/** Sandbox and trusted command that may temporarily receive a model credential. */\nexport interface DeepsecCredentialCommandInput<S extends CommandSandbox = CommandSandbox> {\n  sandbox: S;\n  command: string;\n}\n\n/** Captured output from one Deepsec sandbox command. */\nexport type DeepsecCommandResult = CommandSandboxRunResult;\n\n/** Machine-readable reason a Deepsec scan did not produce findings. */\nexport type DeepsecScanFailureCode =\n  | \"repository_not_found\"\n  | \"scan_failed\"\n  | \"process_failed\"\n  | \"invalid_export_json\"\n  | \"invalid_export_shape\";\n\n/** Bounded Deepsec refusal with a human-readable reason code payload. */\nexport interface DeepsecScanFailure {\n  scanned: false;\n  code: DeepsecScanFailureCode;\n  reason: string;\n}\n\n/** One normalized Deepsec finding and its admission outcome. */\nexport type DeepsecScanFinding = Pick<Finding, \"title\" | \"priority\" | \"path\" | \"line\"> &\n  (\n    | { duplicate: true; taskId?: never; approval?: never }\n    | { duplicate?: never; taskId: TaskId; approval: \"required\" | \"not_required\" }\n  );\n\n/** Counts and bounded finding summaries returned after a completed Deepsec scan. */\nexport interface DeepsecScanSuccess {\n  scanned: true;\n  tool: \"deepsec\";\n  found: number;\n  recorded: number;\n  duplicates: number;\n  awaitingApproval: number;\n  findings: readonly DeepsecScanFinding[];\n}\n\n/** Discriminated result returned by the optional Deepsec scanner tool. */\nexport type DeepsecScanResult = DeepsecScanFailure | DeepsecScanSuccess;\n\n/** Eve tool that runs one bounded Deepsec scan and admits its findings. */\nexport interface DeepsecScanTool extends ToolDefinition<DeepsecScanInput, DeepsecScanResult> {\n  execute(input: DeepsecScanInput, ctx: ToolContext): Promise<DeepsecScanResult>;\n}\n\nconst findingsPath = \"/tmp/deepsec-findings.json\";\n\n/** Parse \"N file(s) with candidates\" out of deepsec scan output; null when absent. */\nfunction candidateCount(output: string): number | null {\n  const match = /(\\d+)\\s+file\\(s\\) with candidates/u.exec(output);\n  return match?.[1] === undefined ? null : Number(match[1]);\n}\n\n/** The last few meaningful lines of a command's output, ANSI stripped, for a receipt. */\nfunction tail(output: string, lines = 4): string {\n  // oxlint-disable-next-line no-control-regex -- stripping terminal colour codes\n  const ansi = /\\u001b\\[[0-9;]*m/gu;\n  return output\n    .replaceAll(ansi, \"\")\n    .split(\"\\n\")\n    .map((line) => line.trim())\n    .filter((line) => line !== \"\")\n    .slice(-lines)\n    .join(\" | \")\n    .slice(0, 600);\n}\n\n/**\n * Runs deepsec (vercel-labs/deepsec) against the sandbox checkout and records\n * what it finds through the same path as record_finding, so every deepsec\n * finding becomes a fix task subject to the approval policy. Trusted code\n * owns the command sequence and the credential; the agent chooses when to\n * scan and reports the outcome.\n */\nexport function createDeepsecScanTool<S extends CommandSandbox>(\n  input: DeepsecScanToolOptions<S>,\n): DeepsecScanTool {\n  const { stores, ...options } = input;\n  const repoPath = options.repoPath ?? \"repo\";\n  const workspace = options.workspacePath ?? \"deepsec\";\n  const version = options.version ?? \"2.3.8\";\n  const agent = options.agent ?? \"claude\";\n  const model = options.model ?? \"claude-sonnet-4-6\";\n  const thinkingLevel = options.thinkingLevel ?? \"medium\";\n  const concurrency = options.concurrency ?? 4;\n  const prefix = options.commandPrefix === undefined ? [] : [options.commandPrefix];\n  const filesPerRun = options.filesPerRun ?? 40;\n  const now = options.now ?? Date.now;\n\n  return defineTool({\n    description:\n      \"Run deepsec, the AI-powered vulnerability scanner, over the repository checkout and record every finding it reports as a fix task. Takes minutes. Call once per scan; then summarize the result.\",\n    inputSchema: deepsecScanInputSchema,\n    async execute({ repositoryId, limit }, ctx): Promise<DeepsecScanResult> {\n      const repository = await stores.repositories.get(repositoryId);\n      if (repository === null) {\n        return {\n          scanned: false as const,\n          code: \"repository_not_found\",\n          reason: `repository ${repositoryId} does not exist`,\n        };\n      }\n      const sandbox = (await ctx.getSandbox()) as unknown as S;\n      const projectId = repository.slug.replace(/[^a-z0-9]+/gu, \"-\");\n      const startedAt = now();\n\n      // One receipt per phase, so the ledger answers \"where is the scan\" while\n      // deepsec runs and shows what each phase cost afterwards.\n      const phase = async (state: string, reason: string): Promise<void> => {\n        await stores.receipts.append({\n          repositoryIds: [repositoryId],\n          kind: \"deepsec\",\n          state,\n          phase: \"security_scan\",\n          reason: `${reason} (${Math.round((now() - startedAt) / 1000)}s in)`,\n        });\n      };\n      await phase(\"started\", `deepsec ${version} on ${repository.slug}, ${agent}/${model}`);\n\n      // Workspace: scaffolded once per sandbox, installed from npm. deepsec\n      // needs Node 24; the sandbox bootstrap is expected to provide it.\n      const prepare = await sandbox.run({\n        command: [\n          ...prefix,\n          \"set -e\",\n          `if [ ! -f ${workspace}/deepsec.config.ts ]; then`,\n          `  npx -y deepsec@${version} init ./${workspace} ./${repoPath} --id ${projectId} --scaffold-only --headless --yes --skip-install`,\n          `  (cd ${workspace} && npm install --no-audit --no-fund --loglevel=error)`,\n          \"fi\",\n          // deepsec resolves deepsec.config.ts from the current directory, so\n          // every deepsec command runs inside the workspace. No --root: it is a\n          // one-off override that skips the project's file records, leaving\n          // `process` with nothing to investigate.\n          `cd ${workspace}`,\n          `./node_modules/.bin/deepsec scan --project-id ${projectId}`,\n        ].join(\"\\n\"),\n      });\n      if (typeof prepare.exitCode === \"number\" && prepare.exitCode !== 0) {\n        const detail = (prepare.stderr ?? prepare.stdout).trim().slice(-1500);\n        await phase(\"failed\", `scan phase failed: ${detail.slice(-300)}`);\n        return {\n          scanned: false as const,\n          code: \"scan_failed\",\n          reason: `deepsec scan failed: ${detail}`,\n        };\n      }\n      const candidates = candidateCount(prepare.stdout);\n      await phase(\n        \"scanned\",\n        `${candidates === null ? \"scan output\" : `${candidates} files with candidates`}: ${tail(`${prepare.stdout}\\n${prepare.stderr ?? \"\"}`)}`,\n      );\n\n      // Investigation talks to the model through the AI Gateway (deepsec's\n      // default route); this is the only step that needs a credential.\n      const investigate = await options.withModelCredential({\n        sandbox,\n        command: [\n          ...prefix,\n          \"set -e\",\n          `cd ${workspace}`,\n          `./node_modules/.bin/deepsec process --project-id ${projectId} --agent ${agent} --model ${model} --thinking-level ${thinkingLevel} --concurrency ${concurrency} --limit ${limit ?? filesPerRun}`,\n          `./node_modules/.bin/deepsec export --project-id ${projectId} --format json --out ${findingsPath}`,\n        ].join(\"\\n\"),\n      });\n      if (typeof investigate.exitCode === \"number\" && investigate.exitCode !== 0) {\n        const detail = (investigate.stderr ?? investigate.stdout).trim().slice(-1500);\n        await phase(\"failed\", `process phase failed: ${detail.slice(-300)}`);\n        return {\n          scanned: false as const,\n          code: \"process_failed\",\n          reason: `deepsec process failed: ${detail}`,\n        };\n      }\n\n      const exported = await sandbox.run({ command: `cat ${findingsPath}` });\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(exported.stdout);\n      } catch {\n        return {\n          scanned: false as const,\n          code: \"invalid_export_json\",\n          reason: \"deepsec export was not valid JSON\",\n        };\n      }\n      const raw = deepsecExportSchema.safeParse(parsed);\n      if (!raw.success) {\n        return {\n          scanned: false as const,\n          code: \"invalid_export_shape\",\n          reason: `deepsec export had an unexpected shape: ${raw.error.issues[0]?.message ?? \"unknown\"}`,\n        };\n      }\n\n      const results: { finding: Finding; result: AdmitFindingResult }[] = [];\n      const taskId = optionalTaskIdForSession(ctx.session.auth.initiator);\n      const scan = taskId === null ? null : await stores.tasks.get(taskId);\n      const root =\n        scan && scan.rootTaskId !== scan.id ? await stores.tasks.get(scan.rootTaskId) : scan;\n      const replyTo =\n        scan?.replyTo.channel === \"slack\" && scan.repositoryIds.includes(repositoryId)\n          ? scan.replyTo\n          : options.replyTo;\n      for (const entry of raw.data) {\n        const finding = findingFromDeepsec(entry);\n        results.push({\n          finding,\n          result: await admitFinding(stores, {\n            repositoryId,\n            finding,\n            ...options,\n            replyTo,\n            operator:\n              scan?.repositoryIds.includes(repositoryId) === true\n                ? (scan.origin.operator ?? root?.origin.operator)\n                : options.operator,\n          }),\n        });\n      }\n      const recorded = results.filter(({ result }) => result.recorded);\n      await phase(\n        \"completed\",\n        `${results.length} findings, ${recorded.length} new. process output: ${tail(`${investigate.stdout}\\n${investigate.stderr ?? \"\"}`, 6)}`,\n      );\n      return {\n        scanned: true as const,\n        tool: \"deepsec\",\n        found: results.length,\n        recorded: recorded.length,\n        duplicates: results.length - recorded.length,\n        awaitingApproval: recorded.filter(\n          ({ result }) => result.recorded && result.approval === \"required\",\n        ).length,\n        findings: results.map(({ finding, result }) => ({\n          title: finding.title,\n          priority: finding.priority,\n          path: finding.path,\n          line: finding.line,\n          ...(result.recorded\n            ? { taskId: result.taskId, approval: result.approval }\n            : { duplicate: true }),\n        })),\n      };\n    },\n  });\n}\n"],"mappings":";;;;;;;;AA4BA,MAAa,yBAAyB,EAAE,OAAO;CAC7C,cAAc;CACd,OAAO,EACJ,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,SAAS,CAAC,CACV,SACC,oGACF;AACJ,CAAC;AA8FD,MAAM,eAAe;;AAGrB,SAAS,eAAe,QAA+B;CACrD,MAAM,QAAQ,qCAAqC,KAAK,MAAM;CAC9D,OAAO,QAAQ,OAAO,KAAA,IAAY,OAAO,OAAO,MAAM,EAAE;AAC1D;;AAGA,SAAS,KAAK,QAAgB,QAAQ,GAAW;CAG/C,OAAO,OACJ,WAAW,sBAAM,EAAE,CAAC,CACpB,MAAM,IAAI,CAAC,CACX,KAAK,SAAS,KAAK,KAAK,CAAC,CAAC,CAC1B,QAAQ,SAAS,SAAS,EAAE,CAAC,CAC7B,MAAM,CAAC,KAAK,CAAC,CACb,KAAK,KAAK,CAAC,CACX,MAAM,GAAG,GAAG;AACjB;;;;;;;;AASA,SAAgB,sBACd,OACiB;CACjB,MAAM,EAAE,QAAQ,GAAG,YAAY;CAC/B,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,YAAY,QAAQ,iBAAiB;CAC3C,MAAM,UAAU,QAAQ,WAAW;CACnC,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,SAAS,QAAQ,kBAAkB,KAAA,IAAY,CAAC,IAAI,CAAC,QAAQ,aAAa;CAChF,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,MAAM,QAAQ,OAAO,KAAK;CAEhC,OAAO,WAAW;EAChB,aACE;EACF,aAAa;EACb,MAAM,QAAQ,EAAE,cAAc,SAAS,KAAiC;GACtE,MAAM,aAAa,MAAM,OAAO,aAAa,IAAI,YAAY;GAC7D,IAAI,eAAe,MACjB,OAAO;IACL,SAAS;IACT,MAAM;IACN,QAAQ,cAAc,aAAa;GACrC;GAEF,MAAM,UAAW,MAAM,IAAI,WAAW;GACtC,MAAM,YAAY,WAAW,KAAK,QAAQ,gBAAgB,GAAG;GAC7D,MAAM,YAAY,IAAI;GAItB,MAAM,QAAQ,OAAO,OAAe,WAAkC;IACpE,MAAM,OAAO,SAAS,OAAO;KAC3B,eAAe,CAAC,YAAY;KAC5B,MAAM;KACN;KACA,OAAO;KACP,QAAQ,GAAG,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,aAAa,GAAI,EAAE;IAC/D,CAAC;GACH;GACA,MAAM,MAAM,WAAW,WAAW,QAAQ,MAAM,WAAW,KAAK,IAAI,MAAM,GAAG,OAAO;GAIpF,MAAM,UAAU,MAAM,QAAQ,IAAI,EAChC,SAAS;IACP,GAAG;IACH;IACA,aAAa,UAAU;IACvB,oBAAoB,QAAQ,UAAU,UAAU,KAAK,SAAS,QAAQ,UAAU;IAChF,SAAS,UAAU;IACnB;IAKA,MAAM;IACN,iDAAiD;GACnD,CAAC,CAAC,KAAK,IAAI,EACb,CAAC;GACD,IAAI,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa,GAAG;IAClE,MAAM,UAAU,QAAQ,UAAU,QAAQ,OAAA,CAAQ,KAAK,CAAC,CAAC,MAAM,KAAK;IACpE,MAAM,MAAM,UAAU,sBAAsB,OAAO,MAAM,IAAI,GAAG;IAChE,OAAO;KACL,SAAS;KACT,MAAM;KACN,QAAQ,wBAAwB;IAClC;GACF;GACA,MAAM,aAAa,eAAe,QAAQ,MAAM;GAChD,MAAM,MACJ,WACA,GAAG,eAAe,OAAO,gBAAgB,GAAG,WAAW,wBAAwB,IAAI,KAAK,GAAG,QAAQ,OAAO,IAAI,QAAQ,UAAU,IAAI,GACtI;GAIA,MAAM,cAAc,MAAM,QAAQ,oBAAoB;IACpD;IACA,SAAS;KACP,GAAG;KACH;KACA,MAAM;KACN,oDAAoD,UAAU,WAAW,MAAM,WAAW,MAAM,oBAAoB,cAAc,iBAAiB,YAAY,WAAW,SAAS;KACnL,mDAAmD,UAAU,uBAAuB;IACtF,CAAC,CAAC,KAAK,IAAI;GACb,CAAC;GACD,IAAI,OAAO,YAAY,aAAa,YAAY,YAAY,aAAa,GAAG;IAC1E,MAAM,UAAU,YAAY,UAAU,YAAY,OAAA,CAAQ,KAAK,CAAC,CAAC,MAAM,KAAK;IAC5E,MAAM,MAAM,UAAU,yBAAyB,OAAO,MAAM,IAAI,GAAG;IACnE,OAAO;KACL,SAAS;KACT,MAAM;KACN,QAAQ,2BAA2B;IACrC;GACF;GAEA,MAAM,WAAW,MAAM,QAAQ,IAAI,EAAE,SAAS,OAAO,eAAe,CAAC;GACrE,IAAI;GACJ,IAAI;IACF,SAAS,KAAK,MAAM,SAAS,MAAM;GACrC,QAAQ;IACN,OAAO;KACL,SAAS;KACT,MAAM;KACN,QAAQ;IACV;GACF;GACA,MAAM,MAAM,oBAAoB,UAAU,MAAM;GAChD,IAAI,CAAC,IAAI,SACP,OAAO;IACL,SAAS;IACT,MAAM;IACN,QAAQ,2CAA2C,IAAI,MAAM,OAAO,EAAE,EAAE,WAAW;GACrF;GAGF,MAAM,UAA8D,CAAC;GACrE,MAAM,SAAS,yBAAyB,IAAI,QAAQ,KAAK,SAAS;GAClE,MAAM,OAAO,WAAW,OAAO,OAAO,MAAM,OAAO,MAAM,IAAI,MAAM;GACnE,MAAM,OACJ,QAAQ,KAAK,eAAe,KAAK,KAAK,MAAM,OAAO,MAAM,IAAI,KAAK,UAAU,IAAI;GAClF,MAAM,UACJ,MAAM,QAAQ,YAAY,WAAW,KAAK,cAAc,SAAS,YAAY,IACzE,KAAK,UACL,QAAQ;GACd,KAAK,MAAM,SAAS,IAAI,MAAM;IAC5B,MAAM,UAAU,mBAAmB,KAAK;IACxC,QAAQ,KAAK;KACX;KACA,QAAQ,MAAM,aAAa,QAAQ;MACjC;MACA;MACA,GAAG;MACH;MACA,UACE,MAAM,cAAc,SAAS,YAAY,MAAM,OAC1C,KAAK,OAAO,YAAY,MAAM,OAAO,WACtC,QAAQ;KAChB,CAAC;IACH,CAAC;GACH;GACA,MAAM,WAAW,QAAQ,QAAQ,EAAE,aAAa,OAAO,QAAQ;GAC/D,MAAM,MACJ,aACA,GAAG,QAAQ,OAAO,aAAa,SAAS,OAAO,wBAAwB,KAAK,GAAG,YAAY,OAAO,IAAI,YAAY,UAAU,MAAM,CAAC,GACrI;GACA,OAAO;IACL,SAAS;IACT,MAAM;IACN,OAAO,QAAQ;IACf,UAAU,SAAS;IACnB,YAAY,QAAQ,SAAS,SAAS;IACtC,kBAAkB,SAAS,QACxB,EAAE,aAAa,OAAO,YAAY,OAAO,aAAa,UACzD,CAAC,CAAC;IACF,UAAU,QAAQ,KAAK,EAAE,SAAS,cAAc;KAC9C,OAAO,QAAQ;KACf,UAAU,QAAQ;KAClB,MAAM,QAAQ;KACd,MAAM,QAAQ;KACd,GAAI,OAAO,WACP;MAAE,QAAQ,OAAO;MAAQ,UAAU,OAAO;KAAS,IACnD,EAAE,WAAW,KAAK;IACxB,EAAE;GACJ;EACF;CACF,CAAC;AACH"}

package/dist/deepsec/finding.d.mts

@@ -0,0 +1,84 @@
+import { Finding } from "../schema/finding.mjs";
+import { z } from "zod";
+//#region src/deepsec/finding.d.ts
+/** Deepsec's exported finding shape, as far as Factory depends on it. */
+declare const deepsecFindingSchema: z.ZodReadonly<z.ZodObject<{
+  title: z.ZodString;
+  description: z.ZodString;
+  severity: z.ZodString;
+  metadata: z.ZodOptional<z.ZodObject<{
+    filePath: z.ZodOptional<z.ZodString>;
+    lineNumbers: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodNumber>>>;
+    vulnSlug: z.ZodOptional<z.ZodString>;
+    confidence: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+  }, z.core.$loose>>;
+}, z.core.$loose>>;
+/** Deepsec export document accepted by the optional scanner adapter. */
+declare const deepsecExportSchema: z.ZodUnion<readonly [z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+  title: z.ZodString;
+  description: z.ZodString;
+  severity: z.ZodString;
+  metadata: z.ZodOptional<z.ZodObject<{
+    filePath: z.ZodOptional<z.ZodString>;
+    lineNumbers: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodNumber>>>;
+    vulnSlug: z.ZodOptional<z.ZodString>;
+    confidence: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+  }, z.core.$loose>>;
+}, z.core.$loose>>>>, z.ZodPipe<z.ZodObject<{
+  findings: z.ZodReadonly<z.ZodArray<z.ZodReadonly<z.ZodObject<{
+    title: z.ZodString;
+    description: z.ZodString;
+    severity: z.ZodString;
+    metadata: z.ZodOptional<z.ZodObject<{
+      filePath: z.ZodOptional<z.ZodString>;
+      lineNumbers: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodNumber>>>;
+      vulnSlug: z.ZodOptional<z.ZodString>;
+      confidence: z.ZodOptional<z.ZodString>;
+      runId: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+  }, z.core.$loose>>>>;
+}, z.core.$loose>, z.ZodTransform<readonly Readonly<{
+  [x: string]: unknown;
+  title: string;
+  description: string;
+  severity: string;
+  metadata?: {
+    [x: string]: unknown;
+    filePath?: string | undefined;
+    lineNumbers?: readonly number[] | undefined;
+    vulnSlug?: string | undefined;
+    confidence?: string | undefined;
+    runId?: string | undefined;
+  } | undefined;
+}>[], {
+  [x: string]: unknown;
+  findings: readonly Readonly<{
+    [x: string]: unknown;
+    title: string;
+    description: string;
+    severity: string;
+    metadata?: {
+      [x: string]: unknown;
+      filePath?: string | undefined;
+      lineNumbers?: readonly number[] | undefined;
+      vulnSlug?: string | undefined;
+      confidence?: string | undefined;
+      runId?: string | undefined;
+    } | undefined;
+  }>[];
+}>>]>;
+/** Provider payload accepted for one Deepsec finding before normalization. */
+type DeepsecFindingInput = z.input<typeof deepsecFindingSchema>;
+/** Parsed Deepsec finding payload used by the normalization adapter. */
+type DeepsecFinding = z.output<typeof deepsecFindingSchema>;
+/** Provider export document accepted before its wrapper is normalized. */
+type DeepsecExportInput = z.input<typeof deepsecExportSchema>;
+/** Parsed list of Deepsec findings produced by the export schema. */
+type DeepsecExport = z.output<typeof deepsecExportSchema>;
+/** Validate and convert one Deepsec finding into Factory's normalized Finding contract. */
+declare function findingFromDeepsec(input: DeepsecFindingInput): Finding;
+//#endregion
+export { DeepsecExport, DeepsecExportInput, DeepsecFinding, DeepsecFindingInput, deepsecExportSchema, deepsecFindingSchema, findingFromDeepsec };
+//# sourceMappingURL=finding.d.mts.map