@vercel/factory 0.0.14 → 0.0.16

package/dist/github.mjs

@@ -1,27 +1,136 @@
-import { z } from "zod";
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { mintGitHubAppInstallationToken } from "./github-app.mjs";
+import { GitHubCheckoutConflictError, GitHubPublicationApiError, checkoutGitHubRepository, createGitHubPublicationClient, factorySessionBranch, factoryTaskBranch, isSafeGitRef, readCommittedGitChange, runSandboxGit } from "./github-publication.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
 //#region src/github.ts
 const gitHubApiUrl = "https://api.github.com";
-const repositorySlugPattern = /^[^/\s]+\/[^/\s]+$/;
+const gitHubRepositorySlugSchema = z.string().min(1).transform((value) => value.toLowerCase()).pipe(repositorySlugSchema);
+const factoryReviewCommentEventSchema = z.looseObject({
+	action: z.literal("created"),
+	comment: z.looseObject({
+		id: z.number().int().positive(),
+		body: z.string(),
+		html_url: z.url(),
+		in_reply_to_id: z.number().int().positive().nullish()
+	}),
+	pull_request: z.looseObject({
+		number: z.number().int().positive(),
+		html_url: z.url(),
+		user: z.looseObject({ login: z.string().min(1) })
+	}),
+	repository: z.looseObject({ full_name: gitHubRepositorySlugSchema })
+});
+const factoryQuestionReplyEventSchema = z.looseObject({
+	action: z.literal("created"),
+	comment: z.looseObject({
+		body: z.string(),
+		html_url: z.url(),
+		id: z.number().int().positive()
+	}),
+	issue: z.looseObject({
+		number: z.number().int().positive(),
+		pull_request: z.unknown().optional()
+	}),
+	repository: z.looseObject({ full_name: gitHubRepositorySlugSchema }),
+	sender: z.looseObject({
+		login: z.string().min(1),
+		type: z.string().min(1)
+	})
+});
+const defaultReviewMentions = ["factory"];
+const defaultQuestionMentions = [
+	"agent-factory",
+	"agent-factory[bot]",
+	"factory"
+];
+function stripMention(body, mentions) {
+	const trimmed = body.trimStart();
+	for (const mention of mentions) {
+		const prefix = `@${mention.trim()}`;
+		if (prefix === "@" || trimmed.slice(0, prefix.length).toLowerCase() !== prefix.toLowerCase()) continue;
+		const remainder = trimmed.slice(prefix.length);
+		if (!/^[\s,:-]/u.test(remainder)) continue;
+		return remainder.replace(/^[\s,:-]*/u, "").trim();
+	}
+	return null;
+}
+/** Select the one configured repository consistently identified by a provider delivery. */
+function configuredEventRepositorySlug(input) {
+	const { configuredSlugs, eventSlugs } = input;
+	const distinctEventSlugs = [...new Set(eventSlugs.filter((slug) => slug !== null))];
+	const eventSlug = distinctEventSlugs[0];
+	return distinctEventSlugs.length === 1 && eventSlug !== void 0 && configuredSlugs.includes(eventSlug) ? eventSlug : null;
+}
+/** Normalize addressed inline comments or opt-in reply candidates; callers must authenticate them. */
+function normalizeFactoryReviewComment(input) {
+	if (input.event !== "pull_request_review_comment") return null;
+	const parsed = factoryReviewCommentEventSchema.safeParse(input.payload);
+	if (!parsed.success || stripMention(parsed.data.comment.body, input.mentions ?? defaultReviewMentions) === null && !(input.includeReplies && parsed.data.comment.in_reply_to_id != null)) return null;
+	return {
+		repositorySlug: parsed.data.repository.full_name,
+		pullRequestNumber: parsed.data.pull_request.number,
+		pullRequestUrl: parsed.data.pull_request.html_url,
+		pullRequestAuthor: parsed.data.pull_request.user.login,
+		commentId: parsed.data.comment.id,
+		commentUrl: parsed.data.comment.html_url
+	};
+}
+/**
+* Strip the Factory mention from an issue comment body, returning null when the
+* comment does not address Factory. Exported so a caller reconciling a delivery
+* against GitHub's own copy of the comment applies the same rule the normalizer
+* applied to the payload.
+*/
+function stripFactoryQuestionMention(body, options = {}) {
+	return stripMention(body, options.mentions ?? defaultQuestionMentions);
+}
+/** Normalize a mentioned issue comment that can answer a persisted Factory QuestionTask. */
+function normalizeFactoryQuestionReply(input) {
+	if (input.event !== "issue_comment") return null;
+	const parsed = factoryQuestionReplyEventSchema.safeParse(input.payload);
+	if (!parsed.success || parsed.data.sender.type.toLowerCase() === "bot") return null;
+	const answer = stripMention(parsed.data.comment.body, input.mentions ?? defaultQuestionMentions);
+	if (answer === null || answer === "") return null;
+	if (parsed.data.issue.pull_request !== void 0) return null;
+	const repositorySlug = parsed.data.repository.full_name;
+	return {
+		repositorySlug,
+		replyAddress: `${repositorySlug}#${parsed.data.issue.number}`,
+		author: parsed.data.sender.login,
+		answer,
+		commentId: parsed.data.comment.id,
+		issueNumber: parsed.data.issue.number,
+		commentUrl: parsed.data.comment.html_url
+	};
+}
 const pullRequestSchema = z.object({
 	number: z.number().int().positive(),
 	html_url: z.url()
 });
 const readablePullRequestSchema = pullRequestSchema.extend({
 	state: z.enum(["open", "closed"]),
-	user: z.object({ login: z.string().min(1) })
+	user: z.object({
+		login: z.string().min(1),
+		type: z.string().optional()
+	})
 });
 const pullRequestHeadSchema = z.object({ head: z.object({
 	ref: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._/-]*$/).refine((value) => !value.includes("..")),
 	sha: z.string().regex(/^[0-9a-f]{40}$/),
-	repo: z.object({ full_name: z.string().min(1) })
+	repo: z.object({ full_name: gitHubRepositorySlugSchema })
 }) });
 const reviewCommentSchema = z.object({
 	id: z.number().int().positive(),
 	body: z.string(),
 	html_url: z.url(),
-	user: z.object({ login: z.string().min(1) }),
-	in_reply_to_id: z.number().int().positive().nullish()
+	pull_request_url: z.url(),
+	user: z.object({
+		login: z.string().min(1),
+		type: z.string().optional()
+	}).nullable(),
+	in_reply_to_id: z.number().int().positive().nullish(),
+	pull_request_review_id: z.number().int().positive().nullish()
 });
 const submittedReviewSchema = z.object({
 	id: z.number().int().positive(),
@@ -39,7 +148,7 @@ const issueCommentSchema = z.object({
 			"User",
 			"Organization"
 		])
-	})
+	}).nullable()
 });
 const checkRunSchema = z.object({
 	id: z.number().int().positive(),
@@ -77,7 +186,7 @@ const pullRequestCandidateSchema = z.object({
 	user: z.object({ type: z.string().min(1) }),
 	head: z.object({
 		ref: z.string().min(1),
-		repo: z.object({ full_name: z.string().min(1) })
+		repo: z.object({ full_name: gitHubRepositorySlugSchema })
 	})
 });
 const openPullRequestsSchema = z.array(pullRequestCandidateSchema);
@@ -91,6 +200,14 @@ const pullRequestDetailSchema = pullRequestCandidateSchema.extend({
 		sha: z.string().min(1)
 	})
 });
+const openPullRequestSummarySchema = z.object({
+	number: z.number().int().positive(),
+	html_url: z.url(),
+	title: z.string().min(1),
+	user: z.object({ login: z.string().min(1) }),
+	head: z.object({ ref: z.string().min(1) }),
+	draft: z.boolean()
+});
 const collaboratorPermissionSchema = z.object({ permission: z.enum([
 	"admin",
 	"maintain",
@@ -104,14 +221,37 @@ const writePermissions = /* @__PURE__ */ new Set([
 	"maintain",
 	"write"
 ]);
+/** Refusal raised when an inline review-comment author lacks repository write access. */
 var GitHubReviewCommentAuthorError = class extends Error {
 	author;
 	constructor(author) {
-		super(`GitHub user ${author} does not have write access to the repository`);
+		super(author === null ? "GitHub review comment has no author to verify for repository write access" : `GitHub user ${author} does not have write access to the repository`);
 		this.name = "GitHubReviewCommentAuthorError";
 		this.author = author;
 	}
 };
+/**
+* The pull request advanced past the commit a review or fix was prepared
+* against. Callers that reviewed a task keyed to a specific commit (for
+* example `record_post_review`) can use `expectedSha`/`actualSha` to resolve
+* the task as superseded instead of leaving it running for the stall
+* watchdog to eventually -- and misleadingly -- report as "stalled".
+*/
+var StalePullRequestHeadError = class extends Error {
+	expectedSha;
+	actualSha;
+	constructor(expectedSha, actualSha) {
+		super(`pull request changed after review: expected ${expectedSha}, found ${actualSha}`);
+		this.name = "StalePullRequestHeadError";
+		this.expectedSha = expectedSha;
+		this.actualSha = actualSha;
+	}
+};
+/** Whether a GitHub user may make repository-scoped Factory decisions. */
+async function hasGitHubRepositoryWriteAccess(input) {
+	const { permission } = collaboratorPermissionSchema.parse(await gitHubRequest(input, `/collaborators/${encodeURIComponent(input.author)}/permission`));
+	return writePermissions.has(permission);
+}
 /** Create a pull request from an existing head branch. */
 async function createPullRequest(input) {
 	const pull = pullRequestSchema.parse(await gitHubRequest(input, "/pulls", {
@@ -125,14 +265,13 @@ async function createPullRequest(input) {
 		})
 	}));
 	return {
-		prNumber: pull.number,
-		prUrl: pull.html_url
+		pullRequestNumber: pull.number,
+		pullRequestUrl: pull.html_url
 	};
 }
 /** Create a check run for one commit. Requires a GitHub App token with checks:write. */
 async function createCheckRun(input) {
-	if (input.status === "completed" && input.conclusion === void 0) throw new Error("completed check runs require a conclusion");
-	if (input.status !== "completed" && input.conclusion !== void 0) throw new Error("creating a check run with a conclusion requires completed status");
+	assertCheckRunFields(input);
 	return parseCheckRun(await gitHubRequest(input, "/check-runs", {
 		method: "POST",
 		body: JSON.stringify({
@@ -144,7 +283,7 @@ async function createCheckRun(input) {
 }
 /** Update a check run previously created by the authenticated GitHub App. */
 async function updateCheckRun(input) {
-	if (input.status !== void 0 && input.status !== "completed" && input.conclusion !== void 0) throw new Error("a check run conclusion conflicts with an incomplete status");
+	assertCheckRunFields(input);
 	return parseCheckRun(await gitHubRequest(input, `/check-runs/${positiveInteger(input.checkRunId, "checkRunId")}`, {
 		method: "PATCH",
 		body: JSON.stringify({
@@ -168,6 +307,51 @@ async function listPullRequestComments(input) {
 		if (response.length < 100) return comments;
 	}
 }
+/** Read a page of all PR discussion types without treating any author's text as authorization. */
+async function listPullRequestDiscussion(input) {
+	const page = z.number().int().positive().parse(input.page ?? 1);
+	const number = positiveInteger(input.pullRequestNumber, "pullRequestNumber");
+	const query = `per_page=50&page=${page}`;
+	const [comments, reviewComments, reviews] = await Promise.all([
+		gitHubRequest(input, `/issues/${number}/comments?${query}`).then((value) => z.array(issueCommentSchema).max(50).parse(value).map(parseIssueComment)),
+		gitHubRequest(input, `/pulls/${number}/comments?${query}`).then((value) => z.array(reviewCommentSchema.extend({
+			pull_request_review_id: z.number().int().positive().nullable(),
+			path: z.string().min(1),
+			line: z.number().int().positive().nullish()
+		})).max(50).parse(value).map((entry) => {
+			const comment = parseReviewComment(entry);
+			assertReviewCommentPullRequest(input, comment);
+			return {
+				...comment,
+				reviewId: entry.pull_request_review_id,
+				path: entry.path,
+				line: entry.line ?? null
+			};
+		})),
+		gitHubRequest(input, `/pulls/${number}/reviews?${query}`).then((value) => z.array(submittedReviewSchema.extend({
+			user: z.object({ login: z.string().min(1) }).nullable(),
+			body: z.string(),
+			commit_id: z.string().regex(/^[0-9a-f]{40}$/).nullable()
+		})).max(50).parse(value).map((review) => ({
+			id: review.id,
+			url: review.html_url,
+			state: review.state,
+			author: review.user?.login ?? null,
+			body: review.body,
+			commitId: review.commit_id
+		})))
+	]);
+	return {
+		comments,
+		reviewComments,
+		reviews,
+		nextPage: [
+			comments,
+			reviewComments,
+			reviews
+		].some((entries) => entries.length === 50) ? page + 1 : null
+	};
+}
 /** Add one issue-style comment to a pull request conversation. */
 async function createPullRequestComment(input) {
 	return parseIssueComment(await gitHubRequest(input, `/issues/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/comments`, {
@@ -182,37 +366,75 @@ async function updatePullRequestComment(input) {
 		body: JSON.stringify({ body: input.body })
 	}));
 }
+const readIssueCommentSchema = issueCommentSchema.extend({ issue_url: z.string().min(1) });
+/**
+* Read one issue comment from GitHub. A delivery authenticated as a workload
+* rather than by body signature can name any author and any text, so the
+* comment it refers to has to be read back before either is believed.
+*/
+async function readIssueComment(input) {
+	const comment = readIssueCommentSchema.parse(await gitHubRequest(input, `/issues/comments/${positiveInteger(input.commentId, "commentId")}`));
+	const issueNumber = Number(comment.issue_url.split("/").pop());
+	if (!Number.isSafeInteger(issueNumber) || issueNumber < 1) throw new Error("GitHub returned an issue comment without a usable issue reference.");
+	return {
+		id: comment.id,
+		url: comment.html_url,
+		author: comment.user?.login ?? null,
+		authorType: comment.user?.type ?? null,
+		body: comment.body,
+		issueNumber
+	};
+}
 /** Read one inline review comment after applying the author policy, which requires write access by default. */
 async function readReviewComment(input) {
 	const comment = parseReviewComment(await gitHubRequest(input, `/pulls/comments/${positiveInteger(input.commentId, "commentId")}`));
+	assertReviewCommentPullRequest(input, comment);
 	await assertReviewCommentAuthor(input, comment.author);
 	return comment;
 }
 /** Reply to an inline review comment after applying the author policy, which requires write access by default. */
 async function answerReviewComment(input) {
-	await readReviewComment(input);
-	return parseReviewComment(await gitHubRequest(input, `/pulls/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/comments/${positiveInteger(input.commentId, "commentId")}/replies`, {
+	const comment = await readReviewComment(input);
+	const rootId = comment.inReplyToId ?? comment.id;
+	if (rootId !== comment.id) await readReviewComment({
+		...input,
+		commentId: rootId,
+		authorPolicy: "any"
+	});
+	const reply = parseReviewComment(await gitHubRequest(input, `/pulls/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/comments/${positiveInteger(rootId, "commentId")}/replies`, {
 		method: "POST",
 		body: JSON.stringify({ body: input.body })
 	}));
+	assertReviewCommentPullRequest(input, reply);
+	return reply;
 }
 /** Submit a summary and optional inline comments against a reviewed pull request commit. */
 async function submitPullRequestReview(input) {
 	const commitId = z.string().regex(/^[0-9a-f]{40}$/).parse(input.commitId);
+	const comments = (input.comments ?? []).map((comment) => {
+		const line = positiveInteger(comment.line, "comment line");
+		const startLine = comment.startLine === void 0 ? void 0 : positiveInteger(comment.startLine, "comment startLine");
+		if (startLine !== void 0 && startLine >= line) throw new Error("comment startLine must precede line; omit it for a single-line finding");
+		return {
+			path: comment.path,
+			line,
+			side: "RIGHT",
+			...startLine === void 0 ? {} : {
+				start_line: startLine,
+				start_side: "RIGHT"
+			},
+			body: comment.body
+		};
+	});
 	const head = await readPullRequestHead(input);
-	if (head.sha !== commitId) throw new Error(`pull request changed after review: expected ${commitId}, found ${head.sha}`);
+	if (head.sha !== commitId) throw new StalePullRequestHeadError(commitId, head.sha);
 	const review = submittedReviewSchema.parse(await gitHubRequest(input, `/pulls/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/reviews`, {
 		method: "POST",
 		body: JSON.stringify({
 			commit_id: commitId,
 			event: input.event,
 			body: input.body,
-			comments: (input.comments ?? []).map((comment) => ({
-				path: comment.path,
-				line: positiveInteger(comment.line, "comment line"),
-				side: "RIGHT",
-				body: comment.body
-			}))
+			comments
 		})
 	}));
 	return {
@@ -227,16 +449,31 @@ async function readPullRequestHead(input) {
 	return {
 		branch: pull.head.ref,
 		sha: pull.head.sha,
-		repository: pull.head.repo.full_name.toLowerCase()
+		repository: pull.head.repo.full_name
 	};
 }
 /** Read the provider-owned identity and lifecycle of one pull request. */
 async function readPullRequest(input) {
 	const pull = readablePullRequestSchema.parse(await gitHubRequest(input, `/pulls/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}`));
 	return {
-		number: pull.number,
-		url: pull.html_url,
+		pullRequestNumber: pull.number,
+		pullRequestUrl: pull.html_url,
 		author: pull.user.login,
+		authorType: pull.user.type,
+		state: pull.state
+	};
+}
+/** Close an open pull request without merging it. */
+async function closePullRequest(input) {
+	const pull = readablePullRequestSchema.parse(await gitHubRequest(input, `/pulls/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}`, {
+		method: "PATCH",
+		body: JSON.stringify({ state: "closed" })
+	}));
+	return {
+		pullRequestNumber: pull.number,
+		pullRequestUrl: pull.html_url,
+		author: pull.user.login,
+		authorType: pull.user.type,
 		state: pull.state
 	};
 }
@@ -247,8 +484,8 @@ async function listConflictedPullRequests(input) {
 	for (const candidate of candidates) {
 		const pull = pullRequestDetailSchema.parse(await gitHubRequest(input, `/pulls/${candidate.number}`));
 		if (pull.mergeable === false || pull.mergeable_state === "dirty") conflicted.push({
-			prNumber: pull.number,
-			prUrl: pull.html_url,
+			pullRequestNumber: pull.number,
+			pullRequestUrl: pull.html_url,
 			headBranch: pull.head.ref,
 			headSha: pull.head.sha,
 			baseBranch: pull.base.ref,
@@ -257,6 +494,44 @@ async function listConflictedPullRequests(input) {
 	}
 	return conflicted;
 }
+/** List open pull requests in a repository, newest first, to check for existing work before triage. */
+async function listOpenPullRequests(input) {
+	return z.array(openPullRequestSummarySchema).parse(await gitHubRequest(input, `/pulls?state=open&per_page=100&sort=created&direction=desc`)).map((pull) => ({
+		prNumber: pull.number,
+		prUrl: pull.html_url,
+		title: pull.title,
+		author: pull.user.login,
+		headBranch: pull.head.ref,
+		draft: pull.draft
+	}));
+}
+/** Ensure a repository label exists, including when another publisher creates it concurrently. */
+async function ensureGitHubLabel(input) {
+	const label = z.object({
+		name: z.string().trim().min(1).max(50),
+		color: z.string().regex(/^[a-fA-F0-9]{6}$/u),
+		description: z.string().max(100)
+	}).parse(input);
+	const path = `/labels/${encodeURIComponent(label.name)}`;
+	const read = async () => {
+		if (z.object({ name: z.string() }).parse(await gitHubRequest(input, path)).name.toLowerCase() !== label.name.toLowerCase()) throw new Error("GitHub returned a different repository label");
+	};
+	try {
+		await read();
+		return;
+	} catch (error) {
+		if (!(error instanceof GitHubRequestError) || error.status !== 404) throw error;
+	}
+	try {
+		await gitHubRequest(input, "/labels", {
+			method: "POST",
+			body: JSON.stringify(label)
+		});
+	} catch (error) {
+		if (!(error instanceof GitHubRequestError) || error.status !== 422) throw error;
+		await read();
+	}
+}
 /** Add one label to a pull request. */
 async function addLabel(input) {
 	return parseLabels(await gitHubRequest(input, `/issues/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/labels`, {
@@ -268,9 +543,16 @@ async function addLabel(input) {
 async function removeLabel(input) {
 	return parseLabels(await gitHubRequest(input, `/issues/${positiveInteger(input.pullRequestNumber, "pullRequestNumber")}/labels/${encodeURIComponent(input.label)}`, { method: "DELETE" }));
 }
+var GitHubRequestError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(`GitHub API request failed (${status}): ${message}`);
+		this.status = status;
+	}
+};
 async function gitHubRequest(input, path, init = {}) {
-	if (!repositorySlugPattern.test(input.repository)) throw new Error(`invalid GitHub repository slug: ${input.repository}`);
-	const response = await (input.fetch ?? globalThis.fetch)(`${gitHubApiUrl}/repos/${input.repository}${path}`, {
+	const repository = repositorySlugSchema.parse(input.repository);
+	const response = await (input.fetch ?? globalThis.fetch)(`${gitHubApiUrl}/repos/${repository}${path}`, {
 		...init,
 		headers: {
 			Accept: "application/vnd.github+json",
@@ -283,28 +565,37 @@ async function gitHubRequest(input, path, init = {}) {
 	const body = await response.json();
 	if (!response.ok) {
 		const message = z.object({ message: z.string() }).safeParse(body);
-		throw new Error(`GitHub API request failed (${response.status}): ${message.success ? message.data.message : response.statusText}`);
+		throw new GitHubRequestError(response.status, message.success ? message.data.message : response.statusText);
 	}
 	return body;
 }
 function parseReviewComment(value) {
 	const comment = reviewCommentSchema.parse(value);
+	const pullRequestMatch = /\/pulls\/([1-9]\d*)\/?$/.exec(new URL(comment.pull_request_url).pathname);
+	if (pullRequestMatch?.[1] === void 0) throw new Error("GitHub review comment has an invalid pull request URL");
 	return {
 		id: comment.id,
+		pullRequestNumber: positiveInteger(Number(pullRequestMatch[1]), "pullRequestNumber"),
 		body: comment.body,
 		url: comment.html_url,
-		author: comment.user.login,
-		inReplyToId: comment.in_reply_to_id ?? null
+		author: comment.user?.login ?? null,
+		authorType: comment.user?.type ?? null,
+		inReplyToId: comment.in_reply_to_id ?? null,
+		reviewId: comment.pull_request_review_id ?? null
 	};
 }
+function assertReviewCommentPullRequest(input, comment) {
+	const expected = positiveInteger(input.pullRequestNumber, "pullRequestNumber");
+	if (comment.pullRequestNumber !== expected) throw new Error(`GitHub review comment ${comment.id} does not belong to pull request ${expected}`);
+}
 function parseIssueComment(value) {
 	const comment = issueCommentSchema.parse(value);
 	return {
 		id: comment.id,
 		body: comment.body,
 		url: comment.html_url,
-		author: comment.user.login,
-		authorType: comment.user.type
+		author: comment.user?.login ?? null,
+		authorType: comment.user?.type ?? null
 	};
 }
 function parseLabels(value) {
@@ -336,6 +627,14 @@ function checkRunFields(input) {
 		...input.output === void 0 ? {} : { output: checkRunOutput(input.output) }
 	};
 }
+function assertCheckRunFields(input) {
+	if (input.status === "completed") {
+		if (input.conclusion === void 0) throw new Error("completed check runs require a conclusion");
+		return;
+	}
+	if (input.conclusion !== void 0) throw new Error("a check run conclusion requires completed status");
+	if (input.completedAt !== void 0) throw new Error("a check run completion time requires completed status");
+}
 function checkRunOutput(output) {
 	return {
 		title: output.title,
@@ -356,8 +655,10 @@ function checkRunOutput(output) {
 }
 async function assertReviewCommentAuthor(input, author) {
 	if (input.authorPolicy === "any") return;
-	const { permission } = collaboratorPermissionSchema.parse(await gitHubRequest(input, `/collaborators/${encodeURIComponent(author)}/permission`));
-	if (!writePermissions.has(permission)) throw new GitHubReviewCommentAuthorError(author);
+	if (author === null || !await hasGitHubRepositoryWriteAccess({
+		...input,
+		author
+	})) throw new GitHubReviewCommentAuthorError(author);
 }
 function positiveInteger(value, name) {
 	if (!Number.isInteger(value) || value < 1) throw new Error(`${name} must be a positive integer`);
@@ -383,7 +684,7 @@ const pushEventSchema = z.looseObject({
 	ref: z.string().min(1),
 	repository: z.looseObject({
 		default_branch: z.string().min(1),
-		full_name: z.string().min(1)
+		full_name: gitHubRepositorySlugSchema
 	})
 });
 /** Normalize a push to a repository's default branch for deterministic reconciliation. */
@@ -394,7 +695,7 @@ function normalizeGitHubDefaultBranchPush(options) {
 	return {
 		source: "github_default_branch_push",
 		deliveryId: options.deliveryId,
-		repositorySlug: parsed.data.repository.full_name.toLowerCase(),
+		repositorySlug: parsed.data.repository.full_name,
 		defaultBranch: parsed.data.repository.default_branch
 	};
 }
@@ -408,14 +709,14 @@ const pullRequestEventSchema = z.looseObject({
 		head: z.looseObject({
 			sha: z.string().regex(/^[0-9a-f]{40}$/),
 			ref: z.string().min(1),
-			repo: z.looseObject({ full_name: z.string().min(1) })
+			repo: z.looseObject({ full_name: gitHubRepositorySlugSchema })
 		}),
 		base: z.looseObject({
 			sha: z.string().regex(/^[0-9a-f]{40}$/),
 			ref: z.string().min(1)
 		})
 	}),
-	repository: z.looseObject({ full_name: z.string().min(1) }),
+	repository: z.looseObject({ full_name: gitHubRepositorySlugSchema }),
 	sender: z.looseObject({ login: z.string().min(1) })
 });
 const reviewablePullRequestActions = /* @__PURE__ */ new Set([
@@ -430,7 +731,7 @@ function normalizeGitHubPullRequest(options) {
 	const parsed = pullRequestEventSchema.safeParse(options.payload);
 	if (!parsed.success || !reviewablePullRequestActions.has(parsed.data.action)) return null;
 	if (parsed.data.pull_request.draft && parsed.data.action !== "ready_for_review") return null;
-	const slug = parsed.data.repository.full_name.toLowerCase();
+	const slug = parsed.data.repository.full_name;
 	const pull = parsed.data.pull_request;
 	return {
 		source: "github_pr",
@@ -441,13 +742,13 @@ function normalizeGitHubPullRequest(options) {
 			address: `${slug}/pull/${parsed.data.number}`
 		},
 		pullRequest: {
-			number: parsed.data.number,
-			url: pull.html_url,
+			pullRequestNumber: parsed.data.number,
+			pullRequestUrl: pull.html_url,
 			author: pull.user.login,
 			draft: pull.draft,
 			headSha: pull.head.sha,
 			headBranch: pull.head.ref,
-			headRepositorySlug: pull.head.repo.full_name.toLowerCase(),
+			headRepositorySlug: pull.head.repo.full_name,
 			baseSha: pull.base.sha,
 			baseBranch: pull.base.ref,
 			sender: parsed.data.sender.login
@@ -462,7 +763,7 @@ const issueEventSchema = z.looseObject({
 		title: z.string(),
 		body: z.string().nullable()
 	}),
-	repository: z.looseObject({ full_name: z.string().min(1) })
+	repository: z.looseObject({ full_name: gitHubRepositorySlugSchema })
 });
 const failedWorkflowConclusions = /* @__PURE__ */ new Set([
 	"action_required",
@@ -475,14 +776,14 @@ const workflowRunEventSchema = z.looseObject({
 	action: z.string(),
 	repository: z.looseObject({
 		default_branch: z.string().min(1),
-		full_name: z.string().min(1)
+		full_name: gitHubRepositorySlugSchema
 	}),
 	workflow_run: z.looseObject({
 		id: z.number().int().min(1),
 		name: z.string().min(1),
 		event: z.string().min(1),
 		head_branch: z.string().min(1).nullable(),
-		head_repository: z.looseObject({ full_name: z.string().min(1) }).nullable(),
+		head_repository: z.looseObject({ full_name: gitHubRepositorySlugSchema }).nullable(),
 		head_sha: z.string().min(1),
 		html_url: z.url(),
 		conclusion: z.string().nullable(),
@@ -498,7 +799,7 @@ function normalizeGitHubIssueOpened(options) {
 	if (options.event !== "issues") return null;
 	const parsed = issueEventSchema.safeParse(options.payload);
 	if (!parsed.success || parsed.data.action !== "opened") return null;
-	const slug = parsed.data.repository.full_name.toLowerCase();
+	const slug = parsed.data.repository.full_name;
 	const { number, title, body } = parsed.data.issue;
 	return {
 		source: "github_issue",
@@ -525,7 +826,7 @@ const pullRequestClosedSchema = z.looseObject({
 		merged_by: z.looseObject({ login: z.string().min(1) }).nullable().optional(),
 		merge_commit_sha: z.string().regex(/^[0-9a-f]{40}$/).nullable().optional()
 	}),
-	repository: z.looseObject({ full_name: z.string().min(1) }),
+	repository: z.looseObject({ full_name: gitHubRepositorySlugSchema }),
 	sender: z.looseObject({ login: z.string().min(1) })
 });
 /**
@@ -542,9 +843,9 @@ function normalizeGitHubPullRequestClosed(options) {
 	return {
 		source: "github_pull_request_closed",
 		deliveryId: options.deliveryId,
-		repositorySlug: parsed.data.repository.full_name.toLowerCase(),
-		prNumber: pr.number,
-		prUrl: pr.html_url,
+		repositorySlug: parsed.data.repository.full_name,
+		pullRequestNumber: pr.number,
+		pullRequestUrl: pr.html_url,
 		merged: pr.merged,
 		mergeCommitSha: pr.merged ? pr.merge_commit_sha ?? null : null,
 		decidedBy: pr.merged ? pr.merged_by?.login ?? sender : sender
@@ -558,7 +859,7 @@ function normalizeGitHubWorkflowRunFailure(options) {
 	const run = parsed.data.workflow_run;
 	const conclusion = run.conclusion;
 	if (conclusion === null || !failedWorkflowConclusions.has(conclusion)) return null;
-	const slug = parsed.data.repository.full_name.toLowerCase();
+	const slug = parsed.data.repository.full_name;
 	return {
 		source: "github_ci_failure",
 		deliveryId: options.deliveryId,
@@ -573,7 +874,7 @@ function normalizeGitHubWorkflowRunFailure(options) {
 			name: run.name,
 			trigger: run.event,
 			branch: run.head_branch,
-			headRepositorySlug: run.head_repository?.full_name.toLowerCase() ?? null,
+			headRepositorySlug: run.head_repository?.full_name ?? null,
 			headSha: run.head_sha,
 			url: run.html_url,
 			conclusion,
@@ -583,6 +884,6 @@ function normalizeGitHubWorkflowRunFailure(options) {
 	};
 }
 //#endregion
-export { GitHubReviewCommentAuthorError, addLabel, answerReviewComment, createCheckRun, createPullRequest, createPullRequestComment, listCheckRunsForRef, listConflictedPullRequests, listPullRequestComments, normalizeGitHubDefaultBranchPush, normalizeGitHubIssueOpened, normalizeGitHubPullRequest, normalizeGitHubPullRequestClosed, normalizeGitHubWorkflowRunFailure, readPullRequest, readPullRequestHead, readReviewComment, removeLabel, submitPullRequestReview, updateCheckRun, updatePullRequestComment, verifyGitHubSignature };
+export { GitHubCheckoutConflictError, GitHubPublicationApiError, GitHubReviewCommentAuthorError, StalePullRequestHeadError, addLabel, answerReviewComment, checkoutGitHubRepository, closePullRequest, configuredEventRepositorySlug, createCheckRun, createGitHubPublicationClient, createPullRequest, createPullRequestComment, ensureGitHubLabel, factorySessionBranch, factoryTaskBranch, hasGitHubRepositoryWriteAccess, isSafeGitRef, listCheckRunsForRef, listConflictedPullRequests, listOpenPullRequests, listPullRequestComments, listPullRequestDiscussion, mintGitHubAppInstallationToken, normalizeFactoryQuestionReply, normalizeFactoryReviewComment, normalizeGitHubDefaultBranchPush, normalizeGitHubIssueOpened, normalizeGitHubPullRequest, normalizeGitHubPullRequestClosed, normalizeGitHubWorkflowRunFailure, readCommittedGitChange, readIssueComment, readPullRequest, readPullRequestHead, readReviewComment, removeLabel, runSandboxGit, stripFactoryQuestionMention, submitPullRequestReview, updateCheckRun, updatePullRequestComment, verifyGitHubSignature };
 
 //# sourceMappingURL=github.mjs.map