@vercel/factory 0.0.14 → 0.0.16

package/dist/pull-requests/github-publisher.d.mts

@@ -0,0 +1,67 @@
+import { TaskId } from "../schema/id.mjs";
+import { Repository, RepositorySlug } from "../schema/repository.mjs";
+import { Change } from "../schema/change.mjs";
+import { FactoryStores } from "../store/engine.mjs";
+import { OpenPullRequestInput, PublishedPullRequest, PullRequestPublicationGateInput, PullRequestPublicationGateResult, PullRequestPublicationOwner, PushCheckpointInput, TaskPullRequest } from "./contracts.mjs";
+import { CommittedGitChange, CreatedGitHubPublicationPullRequest, GitHubPublicationClient, GitHubPublicationClientOptions, SandboxGit } from "../github-publication.mjs";
+//#region src/pull-requests/github-publisher.d.ts
+/** Repository credential and client factories required by software publication. */
+interface GitHubPullRequestPublisherOptions {
+  tokenForRepository(repositorySlug: RepositorySlug): Promise<string>;
+  fetch?: typeof globalThis.fetch;
+  createClient?: (options: GitHubPublicationClientOptions) => GitHubPublicationClient;
+  /** Publishes the initial commit, branch, and pull request through an application credential boundary. */
+  publishPullRequest?: (input: {
+    repository: RepositorySlug;
+    baseCommit: string;
+    tree: CommittedGitChange["tree"];
+    commitMessage: string;
+    branch: string;
+    title: string;
+    body: string;
+    baseBranch: string;
+    draft: boolean;
+  }) => Promise<CreatedGitHubPublicationPullRequest & {
+    commitSha: string;
+  }>;
+}
+/** Task- and session-aware operations for idempotent GitHub pull-request publication. */
+interface GitHubPullRequestPublisher {
+  requireTaskPullRequest(input: RequireTaskPullRequestInput): Promise<TaskPullRequest>;
+  openPullRequest(input: PublishGitHubPullRequestInput): Promise<PublishedPullRequest>;
+  pushCheckpoint(input: PushGitHubCheckpointInput): Promise<PublishedPullRequest>;
+}
+/** Repository and Task whose owned pull request must already exist. */
+interface RequireTaskPullRequestInput {
+  repository: Repository;
+  taskId: TaskId;
+}
+/** Sandbox checkout and publication request used to open a GitHub pull request. */
+interface PublishGitHubPullRequestInput {
+  sandbox: SandboxGit;
+  repository: Repository;
+  owner: PullRequestPublicationOwner;
+  pullRequest: OpenPullRequestInput;
+}
+/** Sandbox checkout and optional linked Change used to publish a checkpoint. */
+interface PushGitHubCheckpointInput {
+  sandbox: SandboxGit;
+  repository: Repository;
+  owner: PullRequestPublicationOwner;
+  checkpoint: PushCheckpointInput;
+  linkedChange?: Pick<Change, "prNumber" | "prUrl">;
+}
+/** Supplied software workflow for safe Task- and session-owned GitHub publication. */
+declare function createGitHubPullRequestPublisher(options: GitHubPullRequestPublisherOptions): GitHubPullRequestPublisher;
+/** Store and repository lookup dependencies for the pull-request publication gate. */
+interface GitHubPullRequestPublicationGateOptions extends GitHubPullRequestPublisherOptions {
+  stores: Pick<FactoryStores, "tasks" | "changes">;
+  repositoryForTask(taskId: TaskId): Promise<Repository>;
+}
+/** Validates that one pull request belongs to its exact GitHub Task and Change context. */
+type GitHubPullRequestPublicationGate = (input: PullRequestPublicationGateInput) => Promise<PullRequestPublicationGateResult>;
+/** Fail-closed gate for the pull request a supplied code-change workflow records. */
+declare function createGitHubPullRequestPublicationGate(options: GitHubPullRequestPublicationGateOptions): GitHubPullRequestPublicationGate;
+//#endregion
+export { GitHubPullRequestPublicationGate, GitHubPullRequestPublicationGateOptions, GitHubPullRequestPublisher, GitHubPullRequestPublisherOptions, PublishGitHubPullRequestInput, PushGitHubCheckpointInput, RequireTaskPullRequestInput, createGitHubPullRequestPublicationGate, createGitHubPullRequestPublisher };
+//# sourceMappingURL=github-publisher.d.mts.map

package/dist/pull-requests/github-publisher.mjs

@@ -0,0 +1,405 @@
+import { redactedErrorMessage } from "../errors.mjs";
+import { GitHubPublicationApiError, createGitHubPublicationClient, factorySessionBranch, factoryTaskBranch, isSafeGitRef, readCommittedGitChange, runSandboxGit } from "../github-publication.mjs";
+//#region src/pull-requests/github-publisher.ts
+async function clientForRepository(options, repository) {
+	const token = await options.tokenForRepository(repository.slug);
+	return (options.createClient ?? createGitHubPublicationClient)({
+		repository: repository.slug,
+		token,
+		fetch: options.fetch
+	});
+}
+function repositoryOwner(repository) {
+	const owner = repository.slug.split("/")[0];
+	if (owner === void 0 || owner === "") throw new Error(`invalid repository slug: ${repository.slug}`);
+	return owner;
+}
+async function findOpenPullRequest(client, repository, taskId) {
+	const branch = factoryTaskBranch(taskId);
+	const pull = (await client.pullRequests({
+		state: "open",
+		head: `${repositoryOwner(repository)}:${branch}`
+	})).find((candidate) => candidate.head.repository === repository.slug);
+	if (pull === void 0) throw new Error(`no open pull request on ${branch}; call open_pull_request first`);
+	return {
+		...pull,
+		branch
+	};
+}
+async function findLinkedPullRequest(client, repository, change) {
+	const pull = await client.pullRequest({ pullRequestNumber: change.prNumber });
+	const branch = pull.head.branch;
+	if (pull.state !== "open" || pull.pullRequestUrl !== change.prUrl || pull.head.repository !== repository.slug || !isSafeGitRef(branch)) throw new Error(`Change pull request #${change.prNumber} is not an open same-repository branch`);
+	return {
+		...pull,
+		branch
+	};
+}
+async function createCommit(client, change, message, parent = change.base) {
+	const baseCommit = await client.commit({ sha: change.base });
+	const tree = await client.createTree({
+		baseTreeSha: baseCommit.treeSha,
+		entries: change.tree
+	});
+	return client.createCommit({
+		message,
+		treeSha: tree,
+		parentShas: [parent]
+	});
+}
+async function sessionPullRequest(client, repository, branch) {
+	const pull = (await client.pullRequests({
+		state: "all",
+		head: `${repositoryOwner(repository)}:${branch}`
+	})).find((candidate) => candidate.head.branch === branch && candidate.head.repository === repository.slug);
+	if (pull !== void 0 && pull.state !== "open") throw new Error("This session's pull request is merged or closed. Start a new session for a new pull request.");
+	return pull;
+}
+async function sessionHead(sandbox) {
+	const result = await sandbox.run({ command: "git -C repo config --get factory.publishedHead" });
+	if (result.exitCode === 1) return "";
+	if (result.exitCode !== void 0 && result.exitCode !== 0) throw new Error("Could not read the session's published head.");
+	return result.stdout.trim();
+}
+async function rememberSessionHead(sandbox, sha) {
+	if (!/^[0-9a-f]{40}$/u.test(sha)) throw new Error("GitHub returned an invalid commit SHA.");
+	await runSandboxGit({
+		sandbox,
+		args: [
+			"config",
+			"factory.publishedHead",
+			sha
+		]
+	});
+}
+async function assertSessionCheckout(sandbox, repository) {
+	if ((await runSandboxGit({
+		sandbox,
+		args: [
+			"remote",
+			"get-url",
+			"origin"
+		]
+	})).trim() !== `https://github.com/${repository.slug}.git`) throw new Error(`sandbox checkout does not match session repository ${repository.slug}`);
+	if ((await runSandboxGit({
+		sandbox,
+		args: ["status", "--porcelain"]
+	})).trim() !== "") throw new Error("Commit your changes before publishing the pull request.");
+}
+async function acceptSessionHead(sandbox, client, sha) {
+	const expected = await sessionHead(sandbox);
+	const commit = await client.commit({ sha });
+	const unchanged = commit.treeSha === (await runSandboxGit({
+		sandbox,
+		args: ["rev-parse", "HEAD^{tree}"]
+	})).trim();
+	const recovered = unchanged && (expected === "" || commit.parentShas.includes(expected));
+	if (expected !== sha && !recovered) throw new Error("The session PR changed since checkout or publication. Refusing to overwrite newer commits; reload its checkout before continuing.");
+	await rememberSessionHead(sandbox, sha);
+	return unchanged;
+}
+function sessionPublication(pull, branch, changedFiles = 0) {
+	return {
+		prNumber: pull.pullRequestNumber,
+		prUrl: pull.pullRequestUrl,
+		branch,
+		changedFiles,
+		draft: pull.draft
+	};
+}
+/** Supplied software workflow for safe Task- and session-owned GitHub publication. */
+function createGitHubPullRequestPublisher(options) {
+	async function requireTaskPullRequest(input) {
+		const pull = await findOpenPullRequest(await clientForRepository(options, input.repository), input.repository, input.taskId);
+		return {
+			prNumber: pull.pullRequestNumber,
+			prUrl: pull.pullRequestUrl,
+			branch: pull.branch
+		};
+	}
+	async function openSessionPullRequest(sandbox, repository, sessionId, input) {
+		const branch = factorySessionBranch(sessionId);
+		await assertSessionCheckout(sandbox, repository);
+		if (options.publishPullRequest !== void 0) {
+			const change = await readCommittedGitChange({
+				sandbox,
+				repositorySlug: repository.slug
+			});
+			const published = await options.publishPullRequest({
+				repository: repository.slug,
+				baseCommit: change.base,
+				tree: change.tree,
+				commitMessage: change.commitMessage,
+				branch,
+				title: input.title,
+				body: input.body,
+				baseBranch: repository.defaultBranch,
+				draft: true
+			});
+			await rememberSessionHead(sandbox, published.commitSha);
+			return {
+				prNumber: published.pullRequestNumber,
+				prUrl: published.pullRequestUrl,
+				branch,
+				changedFiles: change.changedFiles,
+				draft: published.draft
+			};
+		}
+		const client = await clientForRepository(options, repository);
+		const existing = await sessionPullRequest(client, repository, branch);
+		if (existing !== void 0) {
+			await acceptSessionHead(sandbox, client, existing.head.sha);
+			return sessionPublication(existing, branch);
+		}
+		let sha = await client.branchHead({ branch });
+		let changedFiles = 0;
+		if (sha === null) {
+			const change = await readCommittedGitChange({
+				sandbox,
+				repositorySlug: repository.slug
+			});
+			changedFiles = change.changedFiles;
+			sha = await createCommit(client, change, `${input.title}\n\n${input.body}`);
+			try {
+				await client.createBranch({
+					branch,
+					sha
+				});
+			} catch (error) {
+				if (await client.branchHead({ branch }) !== sha) throw error;
+			}
+			await rememberSessionHead(sandbox, sha);
+		} else await acceptSessionHead(sandbox, client, sha);
+		try {
+			const pull = await client.createPullRequest({
+				title: input.title,
+				body: input.body,
+				head: branch,
+				base: repository.defaultBranch,
+				draft: true
+			});
+			return {
+				prNumber: pull.pullRequestNumber,
+				prUrl: pull.pullRequestUrl,
+				branch,
+				changedFiles,
+				draft: pull.draft
+			};
+		} catch (error) {
+			const created = await sessionPullRequest(client, repository, branch);
+			if (created === void 0) throw error;
+			return sessionPublication(created, branch, changedFiles);
+		}
+	}
+	async function openPullRequest(input) {
+		if (typeof input.owner !== "string") return openSessionPullRequest(input.sandbox, input.repository, input.owner.sessionId, input.pullRequest);
+		const change = await readCommittedGitChange({
+			sandbox: input.sandbox,
+			repositorySlug: input.repository.slug
+		});
+		if (options.publishPullRequest !== void 0) {
+			const branch = factoryTaskBranch(input.owner);
+			const published = await options.publishPullRequest({
+				repository: input.repository.slug,
+				baseCommit: change.base,
+				tree: change.tree,
+				commitMessage: change.commitMessage,
+				branch,
+				title: input.pullRequest.title,
+				body: input.pullRequest.body,
+				baseBranch: input.repository.defaultBranch,
+				draft: true
+			});
+			return {
+				prNumber: published.pullRequestNumber,
+				prUrl: published.pullRequestUrl,
+				branch,
+				changedFiles: change.changedFiles,
+				draft: published.draft
+			};
+		}
+		const client = await clientForRepository(options, input.repository);
+		const branch = factoryTaskBranch(input.owner);
+		const existing = (await client.pullRequests({
+			state: "all",
+			head: `${repositoryOwner(input.repository)}:${branch}`
+		})).find((pull) => pull.head.branch === branch && pull.head.repository === input.repository.slug);
+		if (existing !== void 0) {
+			if (existing.state !== "open") throw new Error("This Task's pull request is merged or closed. Start new work for a new pull request.");
+			return {
+				prNumber: existing.pullRequestNumber,
+				prUrl: existing.pullRequestUrl,
+				branch,
+				changedFiles: 0,
+				draft: existing.draft
+			};
+		}
+		const sha = await createCommit(client, change, `${input.pullRequest.title}\n\n${input.pullRequest.body}`);
+		await client.createBranch({
+			branch,
+			sha
+		});
+		const pull = await client.createPullRequest({
+			title: input.pullRequest.title,
+			body: input.pullRequest.body,
+			head: branch,
+			base: input.repository.defaultBranch,
+			draft: true
+		});
+		return {
+			prNumber: pull.pullRequestNumber,
+			prUrl: pull.pullRequestUrl,
+			branch,
+			changedFiles: change.changedFiles,
+			draft: pull.draft
+		};
+	}
+	async function pushSessionCheckpoint(sandbox, repository, sessionId, input) {
+		const branch = factorySessionBranch(sessionId);
+		await assertSessionCheckout(sandbox, repository);
+		const client = await clientForRepository(options, repository);
+		const pull = await sessionPullRequest(client, repository, branch);
+		if (pull === void 0) throw new Error(`no open pull request on ${branch}; call open_pull_request first`);
+		const unchanged = await acceptSessionHead(sandbox, client, pull.head.sha);
+		let changedFiles = 0;
+		if (!unchanged) {
+			const change = await readCommittedGitChange({
+				sandbox,
+				repositorySlug: repository.slug,
+				allowEmpty: true
+			});
+			changedFiles = change.changedFiles;
+			const sha = await createCommit(client, change, `${pull.title}\n\n${pull.body ?? ""}`, pull.head.sha);
+			await client.updateBranch({
+				branch,
+				sha,
+				force: false
+			});
+			await rememberSessionHead(sandbox, sha);
+		}
+		const published = sessionPublication(pull, branch, changedFiles);
+		if (input.ready && published.draft) {
+			await client.markReady({ nodeId: pull.nodeId });
+			published.draft = false;
+		}
+		return published;
+	}
+	async function pushCheckpoint(input) {
+		if (typeof input.owner !== "string") return pushSessionCheckpoint(input.sandbox, input.repository, input.owner.sessionId, input.checkpoint);
+		const client = await clientForRepository(options, input.repository);
+		const pull = input.linkedChange === void 0 ? await findOpenPullRequest(client, input.repository, input.owner) : await findLinkedPullRequest(client, input.repository, input.linkedChange);
+		const change = await readCommittedGitChange({
+			sandbox: input.sandbox,
+			repositorySlug: input.repository.slug,
+			baseRef: input.linkedChange === void 0 ? "origin/HEAD" : `refs/remotes/origin/pr-${input.linkedChange.prNumber}`
+		});
+		if (input.linkedChange !== void 0 && change.base !== pull.head.sha) throw new Error(`pull request #${input.linkedChange.prNumber} changed since it was fetched; fetch it again`);
+		const sha = await createCommit(client, change, `${pull.title}\n\n${pull.body ?? ""}`);
+		await client.updateBranch({
+			branch: pull.branch,
+			sha,
+			force: input.linkedChange === void 0
+		});
+		let draft = pull.draft;
+		if (input.checkpoint.ready && draft) {
+			await client.markReady({ nodeId: pull.nodeId });
+			draft = false;
+		}
+		return {
+			prNumber: pull.pullRequestNumber,
+			prUrl: pull.pullRequestUrl,
+			branch: pull.branch,
+			changedFiles: change.changedFiles,
+			draft
+		};
+	}
+	return Object.freeze({
+		requireTaskPullRequest,
+		openPullRequest,
+		pushCheckpoint
+	});
+}
+/** Fail-closed gate for the pull request a supplied code-change workflow records. */
+function createGitHubPullRequestPublicationGate(options) {
+	return async (input) => {
+		let repository;
+		let linkedChange;
+		try {
+			repository = await options.repositoryForTask(input.taskId);
+			if (repository.id !== input.repositoryId) return {
+				ok: false,
+				code: "repository_mismatch",
+				reason: "repositoryId does not match the task repository"
+			};
+			const task = await options.stores.tasks.get(input.taskId);
+			if (task === null) return {
+				ok: false,
+				code: "task_not_found",
+				reason: `task ${input.taskId} does not exist`
+			};
+			linkedChange = task.changeId === void 0 ? null : await options.stores.changes.get(task.changeId);
+			if (task.changeId !== void 0 && linkedChange === null) return {
+				ok: false,
+				code: "change_not_found",
+				reason: `change ${task.changeId} does not exist`
+			};
+			if (linkedChange !== null && (linkedChange.repositoryId !== repository.id || linkedChange.prNumber !== input.prNumber || linkedChange.prUrl !== input.prUrl)) return {
+				ok: false,
+				code: "linked_change_mismatch",
+				reason: "pull request does not match the Change linked to this task"
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "repository_lookup_failed",
+				reason: redactedErrorMessage(error)
+			};
+		}
+		let client;
+		try {
+			client = await clientForRepository(options, repository);
+		} catch (error) {
+			return {
+				ok: false,
+				code: "authentication_failed",
+				reason: `could not authenticate to GitHub: ${redactedErrorMessage(error)}`
+			};
+		}
+		let pull;
+		try {
+			pull = await client.pullRequest({ pullRequestNumber: input.prNumber });
+		} catch (error) {
+			return {
+				ok: false,
+				code: error instanceof GitHubPublicationApiError && error.status === 404 ? "pull_request_not_found" : "pull_request_lookup_failed",
+				reason: error instanceof GitHubPublicationApiError && error.status === 404 ? `pull request #${input.prNumber} does not exist on ${repository.slug}` : `could not verify pull request #${input.prNumber} on ${repository.slug}`
+			};
+		}
+		if (pull.pullRequestUrl !== input.prUrl) return {
+			ok: false,
+			code: "pull_request_url_mismatch",
+			reason: `prUrl does not match pull request #${input.prNumber} on ${repository.slug}`
+		};
+		if (pull.state !== "open") return {
+			ok: false,
+			code: "pull_request_closed",
+			reason: `pull request #${input.prNumber} is not open`
+		};
+		const branch = factoryTaskBranch(input.taskId);
+		if (pull.head.repository !== repository.slug || linkedChange === null && pull.head.branch !== branch) return {
+			ok: false,
+			code: "pull_request_branch_mismatch",
+			reason: linkedChange === null ? `pull request #${input.prNumber} is not on this task's branch ${branch}` : `pull request #${input.prNumber} is not a same-repository branch`
+		};
+		if (pull.draft) return {
+			ok: false,
+			code: "pull_request_draft",
+			reason: `pull request #${input.prNumber} is still a draft; call push_checkpoint with ready: true first`
+		};
+		return { ok: true };
+	};
+}
+//#endregion
+export { createGitHubPullRequestPublicationGate, createGitHubPullRequestPublisher };
+
+//# sourceMappingURL=github-publisher.mjs.map

package/dist/pull-requests/github-publisher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-publisher.mjs","names":[],"sources":["../../src/pull-requests/github-publisher.ts"],"sourcesContent":["import { redactedErrorMessage } from \"../errors\";\nimport {\n  createGitHubPublicationClient,\n  factorySessionBranch,\n  factoryTaskBranch,\n  GitHubPublicationApiError,\n  isSafeGitRef,\n  readCommittedGitChange,\n  runSandboxGit,\n  type CommittedGitChange,\n  type CreatedGitHubPublicationPullRequest,\n  type GitHubPublicationClient,\n  type GitHubPublicationClientOptions,\n  type GitHubPublicationPullRequest,\n  type SandboxGit,\n} from \"../github-publication\";\nimport type { Change } from \"../schema/change\";\nimport type { TaskId } from \"../schema/id\";\nimport type { Repository, RepositorySlug } from \"../schema/repository\";\nimport type { AgentSessionId } from \"../schema/session\";\nimport type { FactoryStores } from \"../store/engine\";\nimport type {\n  OpenPullRequestInput,\n  PublishedPullRequest,\n  PullRequestPublicationGateInput,\n  PullRequestPublicationGateResult,\n  PullRequestPublicationOwner,\n  PushCheckpointInput,\n  TaskPullRequest,\n} from \"./contracts\";\n\n/** Repository credential and client factories required by software publication. */\nexport interface GitHubPullRequestPublisherOptions {\n  tokenForRepository(repositorySlug: RepositorySlug): Promise<string>;\n  fetch?: typeof globalThis.fetch;\n  createClient?: (options: GitHubPublicationClientOptions) => GitHubPublicationClient;\n  /** Publishes the initial commit, branch, and pull request through an application credential boundary. */\n  publishPullRequest?: (input: {\n    repository: RepositorySlug;\n    baseCommit: string;\n    tree: CommittedGitChange[\"tree\"];\n    commitMessage: string;\n    branch: string;\n    title: string;\n    body: string;\n    baseBranch: string;\n    draft: boolean;\n  }) => Promise<CreatedGitHubPublicationPullRequest & { commitSha: string }>;\n}\n\n/** Task- and session-aware operations for idempotent GitHub pull-request publication. */\nexport interface GitHubPullRequestPublisher {\n  requireTaskPullRequest(input: RequireTaskPullRequestInput): Promise<TaskPullRequest>;\n  openPullRequest(input: PublishGitHubPullRequestInput): Promise<PublishedPullRequest>;\n  pushCheckpoint(input: PushGitHubCheckpointInput): Promise<PublishedPullRequest>;\n}\n\n/** Repository and Task whose owned pull request must already exist. */\nexport interface RequireTaskPullRequestInput {\n  repository: Repository;\n  taskId: TaskId;\n}\n\n/** Sandbox checkout and publication request used to open a GitHub pull request. */\nexport interface PublishGitHubPullRequestInput {\n  sandbox: SandboxGit;\n  repository: Repository;\n  owner: PullRequestPublicationOwner;\n  pullRequest: OpenPullRequestInput;\n}\n\n/** Sandbox checkout and optional linked Change used to publish a checkpoint. */\nexport interface PushGitHubCheckpointInput {\n  sandbox: SandboxGit;\n  repository: Repository;\n  owner: PullRequestPublicationOwner;\n  checkpoint: PushCheckpointInput;\n  linkedChange?: Pick<Change, \"prNumber\" | \"prUrl\">;\n}\n\nasync function clientForRepository(\n  options: GitHubPullRequestPublisherOptions,\n  repository: Repository,\n): Promise<GitHubPublicationClient> {\n  const token = await options.tokenForRepository(repository.slug);\n  return (options.createClient ?? createGitHubPublicationClient)({\n    repository: repository.slug,\n    token,\n    fetch: options.fetch,\n  });\n}\n\nfunction repositoryOwner(repository: Repository): string {\n  const owner = repository.slug.split(\"/\")[0];\n  if (owner === undefined || owner === \"\") {\n    throw new Error(`invalid repository slug: ${repository.slug}`);\n  }\n  return owner;\n}\n\nasync function findOpenPullRequest(\n  client: GitHubPublicationClient,\n  repository: Repository,\n  taskId: TaskId,\n): Promise<GitHubPublicationPullRequest & { branch: string }> {\n  const branch = factoryTaskBranch(taskId);\n  const open = await client.pullRequests({\n    state: \"open\",\n    head: `${repositoryOwner(repository)}:${branch}`,\n  });\n  const pull = open.find((candidate) => candidate.head.repository === repository.slug);\n  if (pull === undefined) {\n    throw new Error(`no open pull request on ${branch}; call open_pull_request first`);\n  }\n  return { ...pull, branch };\n}\n\nasync function findLinkedPullRequest(\n  client: GitHubPublicationClient,\n  repository: Repository,\n  change: Pick<Change, \"prNumber\" | \"prUrl\">,\n): Promise<GitHubPublicationPullRequest & { branch: string }> {\n  const pull = await client.pullRequest({ pullRequestNumber: change.prNumber });\n  const branch = pull.head.branch;\n  if (\n    pull.state !== \"open\" ||\n    pull.pullRequestUrl !== change.prUrl ||\n    pull.head.repository !== repository.slug ||\n    !isSafeGitRef(branch)\n  ) {\n    throw new Error(\n      `Change pull request #${change.prNumber} is not an open same-repository branch`,\n    );\n  }\n  return { ...pull, branch };\n}\n\nasync function createCommit(\n  client: GitHubPublicationClient,\n  change: CommittedGitChange,\n  message: string,\n  parent = change.base,\n): Promise<string> {\n  const baseCommit = await client.commit({ sha: change.base });\n  const tree = await client.createTree({ baseTreeSha: baseCommit.treeSha, entries: change.tree });\n  return client.createCommit({ message, treeSha: tree, parentShas: [parent] });\n}\n\nasync function sessionPullRequest(\n  client: GitHubPublicationClient,\n  repository: Repository,\n  branch: string,\n): Promise<GitHubPublicationPullRequest | undefined> {\n  const pulls = await client.pullRequests({\n    state: \"all\",\n    head: `${repositoryOwner(repository)}:${branch}`,\n  });\n  const pull = pulls.find(\n    (candidate) =>\n      candidate.head.branch === branch && candidate.head.repository === repository.slug,\n  );\n  if (pull !== undefined && pull.state !== \"open\") {\n    throw new Error(\n      \"This session's pull request is merged or closed. Start a new session for a new pull request.\",\n    );\n  }\n  return pull;\n}\n\nasync function sessionHead(sandbox: SandboxGit): Promise<string> {\n  const result = await sandbox.run({ command: \"git -C repo config --get factory.publishedHead\" });\n  if (result.exitCode === 1) return \"\";\n  if (result.exitCode !== undefined && result.exitCode !== 0) {\n    throw new Error(\"Could not read the session's published head.\");\n  }\n  return result.stdout.trim();\n}\n\nasync function rememberSessionHead(sandbox: SandboxGit, sha: string): Promise<void> {\n  if (!/^[0-9a-f]{40}$/u.test(sha)) throw new Error(\"GitHub returned an invalid commit SHA.\");\n  await runSandboxGit({ sandbox, args: [\"config\", \"factory.publishedHead\", sha] });\n}\n\nasync function assertSessionCheckout(sandbox: SandboxGit, repository: Repository): Promise<void> {\n  if (\n    (await runSandboxGit({ sandbox, args: [\"remote\", \"get-url\", \"origin\"] })).trim() !==\n    `https://github.com/${repository.slug}.git`\n  ) {\n    throw new Error(`sandbox checkout does not match session repository ${repository.slug}`);\n  }\n  if ((await runSandboxGit({ sandbox, args: [\"status\", \"--porcelain\"] })).trim() !== \"\") {\n    throw new Error(\"Commit your changes before publishing the pull request.\");\n  }\n}\n\nasync function acceptSessionHead(\n  sandbox: SandboxGit,\n  client: GitHubPublicationClient,\n  sha: string,\n): Promise<boolean> {\n  const expected = await sessionHead(sandbox);\n  const commit = await client.commit({ sha });\n  const unchanged =\n    commit.treeSha ===\n    (await runSandboxGit({ sandbox, args: [\"rev-parse\", \"HEAD^{tree}\"] })).trim();\n  const recovered = unchanged && (expected === \"\" || commit.parentShas.includes(expected));\n  if (expected !== sha && !recovered) {\n    throw new Error(\n      \"The session PR changed since checkout or publication. Refusing to overwrite newer commits; reload its checkout before continuing.\",\n    );\n  }\n  await rememberSessionHead(sandbox, sha);\n  return unchanged;\n}\n\nfunction sessionPublication(\n  pull: Pick<GitHubPublicationPullRequest, \"pullRequestNumber\" | \"pullRequestUrl\" | \"draft\">,\n  branch: string,\n  changedFiles = 0,\n): PublishedPullRequest {\n  return {\n    prNumber: pull.pullRequestNumber,\n    prUrl: pull.pullRequestUrl,\n    branch,\n    changedFiles,\n    draft: pull.draft,\n  };\n}\n\n/** Supplied software workflow for safe Task- and session-owned GitHub publication. */\nexport function createGitHubPullRequestPublisher(\n  options: GitHubPullRequestPublisherOptions,\n): GitHubPullRequestPublisher {\n  async function requireTaskPullRequest(\n    input: RequireTaskPullRequestInput,\n  ): Promise<TaskPullRequest> {\n    const client = await clientForRepository(options, input.repository);\n    const pull = await findOpenPullRequest(client, input.repository, input.taskId);\n    return {\n      prNumber: pull.pullRequestNumber,\n      prUrl: pull.pullRequestUrl,\n      branch: pull.branch,\n    };\n  }\n\n  async function openSessionPullRequest(\n    sandbox: SandboxGit,\n    repository: Repository,\n    sessionId: AgentSessionId,\n    input: OpenPullRequestInput,\n  ): Promise<PublishedPullRequest> {\n    const branch = factorySessionBranch(sessionId);\n    await assertSessionCheckout(sandbox, repository);\n    if (options.publishPullRequest !== undefined) {\n      const change = await readCommittedGitChange({ sandbox, repositorySlug: repository.slug });\n      const published = await options.publishPullRequest({\n        repository: repository.slug,\n        baseCommit: change.base,\n        tree: change.tree,\n        commitMessage: change.commitMessage,\n        branch,\n        title: input.title,\n        body: input.body,\n        baseBranch: repository.defaultBranch,\n        draft: true,\n      });\n      await rememberSessionHead(sandbox, published.commitSha);\n      return {\n        prNumber: published.pullRequestNumber,\n        prUrl: published.pullRequestUrl,\n        branch,\n        changedFiles: change.changedFiles,\n        draft: published.draft,\n      };\n    }\n    const client = await clientForRepository(options, repository);\n    const existing = await sessionPullRequest(client, repository, branch);\n    if (existing !== undefined) {\n      await acceptSessionHead(sandbox, client, existing.head.sha);\n      return sessionPublication(existing, branch);\n    }\n\n    let sha = await client.branchHead({ branch });\n    let changedFiles = 0;\n    if (sha === null) {\n      const change = await readCommittedGitChange({ sandbox, repositorySlug: repository.slug });\n      changedFiles = change.changedFiles;\n      sha = await createCommit(client, change, `${input.title}\\n\\n${input.body}`);\n      try {\n        await client.createBranch({ branch, sha });\n      } catch (error) {\n        if ((await client.branchHead({ branch })) !== sha) throw error;\n      }\n      await rememberSessionHead(sandbox, sha);\n    } else {\n      await acceptSessionHead(sandbox, client, sha);\n    }\n    try {\n      const pull = await client.createPullRequest({\n        title: input.title,\n        body: input.body,\n        head: branch,\n        base: repository.defaultBranch,\n        draft: true,\n      });\n      return {\n        prNumber: pull.pullRequestNumber,\n        prUrl: pull.pullRequestUrl,\n        branch,\n        changedFiles,\n        draft: pull.draft,\n      };\n    } catch (error) {\n      const created = await sessionPullRequest(client, repository, branch);\n      if (created === undefined) throw error;\n      return sessionPublication(created, branch, changedFiles);\n    }\n  }\n\n  async function openPullRequest(\n    input: PublishGitHubPullRequestInput,\n  ): Promise<PublishedPullRequest> {\n    if (typeof input.owner !== \"string\") {\n      return openSessionPullRequest(\n        input.sandbox,\n        input.repository,\n        input.owner.sessionId,\n        input.pullRequest,\n      );\n    }\n    const change = await readCommittedGitChange({\n      sandbox: input.sandbox,\n      repositorySlug: input.repository.slug,\n    });\n    if (options.publishPullRequest !== undefined) {\n      const branch = factoryTaskBranch(input.owner);\n      const published = await options.publishPullRequest({\n        repository: input.repository.slug,\n        baseCommit: change.base,\n        tree: change.tree,\n        commitMessage: change.commitMessage,\n        branch,\n        title: input.pullRequest.title,\n        body: input.pullRequest.body,\n        baseBranch: input.repository.defaultBranch,\n        draft: true,\n      });\n      return {\n        prNumber: published.pullRequestNumber,\n        prUrl: published.pullRequestUrl,\n        branch,\n        changedFiles: change.changedFiles,\n        draft: published.draft,\n      };\n    }\n    const client = await clientForRepository(options, input.repository);\n    const branch = factoryTaskBranch(input.owner);\n    const existing = (\n      await client.pullRequests({\n        state: \"all\",\n        head: `${repositoryOwner(input.repository)}:${branch}`,\n      })\n    ).find((pull) => pull.head.branch === branch && pull.head.repository === input.repository.slug);\n    if (existing !== undefined) {\n      if (existing.state !== \"open\")\n        throw new Error(\n          \"This Task's pull request is merged or closed. Start new work for a new pull request.\",\n        );\n      return {\n        prNumber: existing.pullRequestNumber,\n        prUrl: existing.pullRequestUrl,\n        branch,\n        changedFiles: 0,\n        draft: existing.draft,\n      };\n    }\n    const sha = await createCommit(\n      client,\n      change,\n      `${input.pullRequest.title}\\n\\n${input.pullRequest.body}`,\n    );\n    await client.createBranch({ branch, sha });\n    const pull = await client.createPullRequest({\n      title: input.pullRequest.title,\n      body: input.pullRequest.body,\n      head: branch,\n      base: input.repository.defaultBranch,\n      draft: true,\n    });\n    return {\n      prNumber: pull.pullRequestNumber,\n      prUrl: pull.pullRequestUrl,\n      branch,\n      changedFiles: change.changedFiles,\n      draft: pull.draft,\n    };\n  }\n\n  async function pushSessionCheckpoint(\n    sandbox: SandboxGit,\n    repository: Repository,\n    sessionId: AgentSessionId,\n    input: PushCheckpointInput,\n  ): Promise<PublishedPullRequest> {\n    const branch = factorySessionBranch(sessionId);\n    await assertSessionCheckout(sandbox, repository);\n    const client = await clientForRepository(options, repository);\n    const pull = await sessionPullRequest(client, repository, branch);\n    if (pull === undefined) {\n      throw new Error(`no open pull request on ${branch}; call open_pull_request first`);\n    }\n    const unchanged = await acceptSessionHead(sandbox, client, pull.head.sha);\n    let changedFiles = 0;\n    if (!unchanged) {\n      const change = await readCommittedGitChange({\n        sandbox,\n        repositorySlug: repository.slug,\n        allowEmpty: true,\n      });\n      changedFiles = change.changedFiles;\n      const sha = await createCommit(\n        client,\n        change,\n        `${pull.title}\\n\\n${pull.body ?? \"\"}`,\n        pull.head.sha,\n      );\n      await client.updateBranch({ branch, sha, force: false });\n      await rememberSessionHead(sandbox, sha);\n    }\n    const published = sessionPublication(pull, branch, changedFiles);\n    if (input.ready && published.draft) {\n      await client.markReady({ nodeId: pull.nodeId });\n      published.draft = false;\n    }\n    return published;\n  }\n\n  async function pushCheckpoint(input: PushGitHubCheckpointInput): Promise<PublishedPullRequest> {\n    if (typeof input.owner !== \"string\") {\n      return pushSessionCheckpoint(\n        input.sandbox,\n        input.repository,\n        input.owner.sessionId,\n        input.checkpoint,\n      );\n    }\n    const client = await clientForRepository(options, input.repository);\n    const pull =\n      input.linkedChange === undefined\n        ? await findOpenPullRequest(client, input.repository, input.owner)\n        : await findLinkedPullRequest(client, input.repository, input.linkedChange);\n    const change = await readCommittedGitChange({\n      sandbox: input.sandbox,\n      repositorySlug: input.repository.slug,\n      baseRef:\n        input.linkedChange === undefined\n          ? \"origin/HEAD\"\n          : `refs/remotes/origin/pr-${input.linkedChange.prNumber}`,\n    });\n    if (input.linkedChange !== undefined && change.base !== pull.head.sha) {\n      throw new Error(\n        `pull request #${input.linkedChange.prNumber} changed since it was fetched; fetch it again`,\n      );\n    }\n    const sha = await createCommit(client, change, `${pull.title}\\n\\n${pull.body ?? \"\"}`);\n    await client.updateBranch({\n      branch: pull.branch,\n      sha,\n      force: input.linkedChange === undefined,\n    });\n    let draft = pull.draft;\n    if (input.checkpoint.ready && draft) {\n      await client.markReady({ nodeId: pull.nodeId });\n      draft = false;\n    }\n    return {\n      prNumber: pull.pullRequestNumber,\n      prUrl: pull.pullRequestUrl,\n      branch: pull.branch,\n      changedFiles: change.changedFiles,\n      draft,\n    };\n  }\n\n  return Object.freeze({ requireTaskPullRequest, openPullRequest, pushCheckpoint });\n}\n\n/** Store and repository lookup dependencies for the pull-request publication gate. */\nexport interface GitHubPullRequestPublicationGateOptions extends GitHubPullRequestPublisherOptions {\n  stores: Pick<FactoryStores, \"tasks\" | \"changes\">;\n  repositoryForTask(taskId: TaskId): Promise<Repository>;\n}\n\n/** Validates that one pull request belongs to its exact GitHub Task and Change context. */\nexport type GitHubPullRequestPublicationGate = (\n  input: PullRequestPublicationGateInput,\n) => Promise<PullRequestPublicationGateResult>;\n\n/** Fail-closed gate for the pull request a supplied code-change workflow records. */\nexport function createGitHubPullRequestPublicationGate(\n  options: GitHubPullRequestPublicationGateOptions,\n): GitHubPullRequestPublicationGate {\n  return async (\n    input: PullRequestPublicationGateInput,\n  ): Promise<PullRequestPublicationGateResult> => {\n    let repository: Repository;\n    let linkedChange: Awaited<ReturnType<FactoryStores[\"changes\"][\"get\"]>>;\n    try {\n      repository = await options.repositoryForTask(input.taskId);\n      if (repository.id !== input.repositoryId) {\n        return {\n          ok: false,\n          code: \"repository_mismatch\",\n          reason: \"repositoryId does not match the task repository\",\n        };\n      }\n      const task = await options.stores.tasks.get(input.taskId);\n      if (task === null) {\n        return {\n          ok: false,\n          code: \"task_not_found\",\n          reason: `task ${input.taskId} does not exist`,\n        };\n      }\n      linkedChange =\n        task.changeId === undefined ? null : await options.stores.changes.get(task.changeId);\n      if (task.changeId !== undefined && linkedChange === null) {\n        return {\n          ok: false,\n          code: \"change_not_found\",\n          reason: `change ${task.changeId} does not exist`,\n        };\n      }\n      if (\n        linkedChange !== null &&\n        (linkedChange.repositoryId !== repository.id ||\n          linkedChange.prNumber !== input.prNumber ||\n          linkedChange.prUrl !== input.prUrl)\n      ) {\n        return {\n          ok: false,\n          code: \"linked_change_mismatch\",\n          reason: \"pull request does not match the Change linked to this task\",\n        };\n      }\n    } catch (error) {\n      return {\n        ok: false,\n        code: \"repository_lookup_failed\",\n        reason: redactedErrorMessage(error),\n      };\n    }\n\n    let client: GitHubPublicationClient;\n    try {\n      client = await clientForRepository(options, repository);\n    } catch (error) {\n      return {\n        ok: false,\n        code: \"authentication_failed\",\n        reason: `could not authenticate to GitHub: ${redactedErrorMessage(error)}`,\n      };\n    }\n\n    let pull: GitHubPublicationPullRequest;\n    try {\n      pull = await client.pullRequest({ pullRequestNumber: input.prNumber });\n    } catch (error) {\n      return {\n        ok: false,\n        code:\n          error instanceof GitHubPublicationApiError && error.status === 404\n            ? \"pull_request_not_found\"\n            : \"pull_request_lookup_failed\",\n        reason:\n          error instanceof GitHubPublicationApiError && error.status === 404\n            ? `pull request #${input.prNumber} does not exist on ${repository.slug}`\n            : `could not verify pull request #${input.prNumber} on ${repository.slug}`,\n      };\n    }\n    if (pull.pullRequestUrl !== input.prUrl) {\n      return {\n        ok: false,\n        code: \"pull_request_url_mismatch\",\n        reason: `prUrl does not match pull request #${input.prNumber} on ${repository.slug}`,\n      };\n    }\n    if (pull.state !== \"open\") {\n      return {\n        ok: false,\n        code: \"pull_request_closed\",\n        reason: `pull request #${input.prNumber} is not open`,\n      };\n    }\n    const branch = factoryTaskBranch(input.taskId);\n    if (\n      pull.head.repository !== repository.slug ||\n      (linkedChange === null && pull.head.branch !== branch)\n    ) {\n      return {\n        ok: false,\n        code: \"pull_request_branch_mismatch\",\n        reason:\n          linkedChange === null\n            ? `pull request #${input.prNumber} is not on this task's branch ${branch}`\n            : `pull request #${input.prNumber} is not a same-repository branch`,\n      };\n    }\n    if (pull.draft) {\n      return {\n        ok: false,\n        code: \"pull_request_draft\",\n        reason: `pull request #${input.prNumber} is still a draft; call push_checkpoint with ready: true first`,\n      };\n    }\n    return { ok: true };\n  };\n}\n"],"mappings":";;;AAgFA,eAAe,oBACb,SACA,YACkC;CAClC,MAAM,QAAQ,MAAM,QAAQ,mBAAmB,WAAW,IAAI;CAC9D,QAAQ,QAAQ,gBAAgB,8BAAA,CAA+B;EAC7D,YAAY,WAAW;EACvB;EACA,OAAO,QAAQ;CACjB,CAAC;AACH;AAEA,SAAS,gBAAgB,YAAgC;CACvD,MAAM,QAAQ,WAAW,KAAK,MAAM,GAAG,CAAC,CAAC;CACzC,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,MAAM,IAAI,MAAM,4BAA4B,WAAW,MAAM;CAE/D,OAAO;AACT;AAEA,eAAe,oBACb,QACA,YACA,QAC4D;CAC5D,MAAM,SAAS,kBAAkB,MAAM;CAKvC,MAAM,QAAO,MAJM,OAAO,aAAa;EACrC,OAAO;EACP,MAAM,GAAG,gBAAgB,UAAU,EAAE,GAAG;CAC1C,CAAC,EAAA,CACiB,MAAM,cAAc,UAAU,KAAK,eAAe,WAAW,IAAI;CACnF,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,2BAA2B,OAAO,+BAA+B;CAEnF,OAAO;EAAE,GAAG;EAAM;CAAO;AAC3B;AAEA,eAAe,sBACb,QACA,YACA,QAC4D;CAC5D,MAAM,OAAO,MAAM,OAAO,YAAY,EAAE,mBAAmB,OAAO,SAAS,CAAC;CAC5E,MAAM,SAAS,KAAK,KAAK;CACzB,IACE,KAAK,UAAU,UACf,KAAK,mBAAmB,OAAO,SAC/B,KAAK,KAAK,eAAe,WAAW,QACpC,CAAC,aAAa,MAAM,GAEpB,MAAM,IAAI,MACR,wBAAwB,OAAO,SAAS,uCAC1C;CAEF,OAAO;EAAE,GAAG;EAAM;CAAO;AAC3B;AAEA,eAAe,aACb,QACA,QACA,SACA,SAAS,OAAO,MACC;CACjB,MAAM,aAAa,MAAM,OAAO,OAAO,EAAE,KAAK,OAAO,KAAK,CAAC;CAC3D,MAAM,OAAO,MAAM,OAAO,WAAW;EAAE,aAAa,WAAW;EAAS,SAAS,OAAO;CAAK,CAAC;CAC9F,OAAO,OAAO,aAAa;EAAE;EAAS,SAAS;EAAM,YAAY,CAAC,MAAM;CAAE,CAAC;AAC7E;AAEA,eAAe,mBACb,QACA,YACA,QACmD;CAKnD,MAAM,QAAO,MAJO,OAAO,aAAa;EACtC,OAAO;EACP,MAAM,GAAG,gBAAgB,UAAU,EAAE,GAAG;CAC1C,CAAC,EAAA,CACkB,MAChB,cACC,UAAU,KAAK,WAAW,UAAU,UAAU,KAAK,eAAe,WAAW,IACjF;CACA,IAAI,SAAS,KAAA,KAAa,KAAK,UAAU,QACvC,MAAM,IAAI,MACR,8FACF;CAEF,OAAO;AACT;AAEA,eAAe,YAAY,SAAsC;CAC/D,MAAM,SAAS,MAAM,QAAQ,IAAI,EAAE,SAAS,iDAAiD,CAAC;CAC9F,IAAI,OAAO,aAAa,GAAG,OAAO;CAClC,IAAI,OAAO,aAAa,KAAA,KAAa,OAAO,aAAa,GACvD,MAAM,IAAI,MAAM,8CAA8C;CAEhE,OAAO,OAAO,OAAO,KAAK;AAC5B;AAEA,eAAe,oBAAoB,SAAqB,KAA4B;CAClF,IAAI,CAAC,kBAAkB,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC1F,MAAM,cAAc;EAAE;EAAS,MAAM;GAAC;GAAU;GAAyB;EAAG;CAAE,CAAC;AACjF;AAEA,eAAe,sBAAsB,SAAqB,YAAuC;CAC/F,KACG,MAAM,cAAc;EAAE;EAAS,MAAM;GAAC;GAAU;GAAW;EAAQ;CAAE,CAAC,EAAA,CAAG,KAAK,MAC/E,sBAAsB,WAAW,KAAK,OAEtC,MAAM,IAAI,MAAM,sDAAsD,WAAW,MAAM;CAEzF,KAAK,MAAM,cAAc;EAAE;EAAS,MAAM,CAAC,UAAU,aAAa;CAAE,CAAC,EAAA,CAAG,KAAK,MAAM,IACjF,MAAM,IAAI,MAAM,yDAAyD;AAE7E;AAEA,eAAe,kBACb,SACA,QACA,KACkB;CAClB,MAAM,WAAW,MAAM,YAAY,OAAO;CAC1C,MAAM,SAAS,MAAM,OAAO,OAAO,EAAE,IAAI,CAAC;CAC1C,MAAM,YACJ,OAAO,aACN,MAAM,cAAc;EAAE;EAAS,MAAM,CAAC,aAAa,aAAa;CAAE,CAAC,EAAA,CAAG,KAAK;CAC9E,MAAM,YAAY,cAAc,aAAa,MAAM,OAAO,WAAW,SAAS,QAAQ;CACtF,IAAI,aAAa,OAAO,CAAC,WACvB,MAAM,IAAI,MACR,mIACF;CAEF,MAAM,oBAAoB,SAAS,GAAG;CACtC,OAAO;AACT;AAEA,SAAS,mBACP,MACA,QACA,eAAe,GACO;CACtB,OAAO;EACL,UAAU,KAAK;EACf,OAAO,KAAK;EACZ;EACA;EACA,OAAO,KAAK;CACd;AACF;;AAGA,SAAgB,iCACd,SAC4B;CAC5B,eAAe,uBACb,OAC0B;EAE1B,MAAM,OAAO,MAAM,oBAAoB,MADlB,oBAAoB,SAAS,MAAM,UAAU,GACnB,MAAM,YAAY,MAAM,MAAM;EAC7E,OAAO;GACL,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,QAAQ,KAAK;EACf;CACF;CAEA,eAAe,uBACb,SACA,YACA,WACA,OAC+B;EAC/B,MAAM,SAAS,qBAAqB,SAAS;EAC7C,MAAM,sBAAsB,SAAS,UAAU;EAC/C,IAAI,QAAQ,uBAAuB,KAAA,GAAW;GAC5C,MAAM,SAAS,MAAM,uBAAuB;IAAE;IAAS,gBAAgB,WAAW;GAAK,CAAC;GACxF,MAAM,YAAY,MAAM,QAAQ,mBAAmB;IACjD,YAAY,WAAW;IACvB,YAAY,OAAO;IACnB,MAAM,OAAO;IACb,eAAe,OAAO;IACtB;IACA,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,YAAY,WAAW;IACvB,OAAO;GACT,CAAC;GACD,MAAM,oBAAoB,SAAS,UAAU,SAAS;GACtD,OAAO;IACL,UAAU,UAAU;IACpB,OAAO,UAAU;IACjB;IACA,cAAc,OAAO;IACrB,OAAO,UAAU;GACnB;EACF;EACA,MAAM,SAAS,MAAM,oBAAoB,SAAS,UAAU;EAC5D,MAAM,WAAW,MAAM,mBAAmB,QAAQ,YAAY,MAAM;EACpE,IAAI,aAAa,KAAA,GAAW;GAC1B,MAAM,kBAAkB,SAAS,QAAQ,SAAS,KAAK,GAAG;GAC1D,OAAO,mBAAmB,UAAU,MAAM;EAC5C;EAEA,IAAI,MAAM,MAAM,OAAO,WAAW,EAAE,OAAO,CAAC;EAC5C,IAAI,eAAe;EACnB,IAAI,QAAQ,MAAM;GAChB,MAAM,SAAS,MAAM,uBAAuB;IAAE;IAAS,gBAAgB,WAAW;GAAK,CAAC;GACxF,eAAe,OAAO;GACtB,MAAM,MAAM,aAAa,QAAQ,QAAQ,GAAG,MAAM,MAAM,MAAM,MAAM,MAAM;GAC1E,IAAI;IACF,MAAM,OAAO,aAAa;KAAE;KAAQ;IAAI,CAAC;GAC3C,SAAS,OAAO;IACd,IAAK,MAAM,OAAO,WAAW,EAAE,OAAO,CAAC,MAAO,KAAK,MAAM;GAC3D;GACA,MAAM,oBAAoB,SAAS,GAAG;EACxC,OACE,MAAM,kBAAkB,SAAS,QAAQ,GAAG;EAE9C,IAAI;GACF,MAAM,OAAO,MAAM,OAAO,kBAAkB;IAC1C,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,MAAM;IACN,MAAM,WAAW;IACjB,OAAO;GACT,CAAC;GACD,OAAO;IACL,UAAU,KAAK;IACf,OAAO,KAAK;IACZ;IACA;IACA,OAAO,KAAK;GACd;EACF,SAAS,OAAO;GACd,MAAM,UAAU,MAAM,mBAAmB,QAAQ,YAAY,MAAM;GACnE,IAAI,YAAY,KAAA,GAAW,MAAM;GACjC,OAAO,mBAAmB,SAAS,QAAQ,YAAY;EACzD;CACF;CAEA,eAAe,gBACb,OAC+B;EAC/B,IAAI,OAAO,MAAM,UAAU,UACzB,OAAO,uBACL,MAAM,SACN,MAAM,YACN,MAAM,MAAM,WACZ,MAAM,WACR;EAEF,MAAM,SAAS,MAAM,uBAAuB;GAC1C,SAAS,MAAM;GACf,gBAAgB,MAAM,WAAW;EACnC,CAAC;EACD,IAAI,QAAQ,uBAAuB,KAAA,GAAW;GAC5C,MAAM,SAAS,kBAAkB,MAAM,KAAK;GAC5C,MAAM,YAAY,MAAM,QAAQ,mBAAmB;IACjD,YAAY,MAAM,WAAW;IAC7B,YAAY,OAAO;IACnB,MAAM,OAAO;IACb,eAAe,OAAO;IACtB;IACA,OAAO,MAAM,YAAY;IACzB,MAAM,MAAM,YAAY;IACxB,YAAY,MAAM,WAAW;IAC7B,OAAO;GACT,CAAC;GACD,OAAO;IACL,UAAU,UAAU;IACpB,OAAO,UAAU;IACjB;IACA,cAAc,OAAO;IACrB,OAAO,UAAU;GACnB;EACF;EACA,MAAM,SAAS,MAAM,oBAAoB,SAAS,MAAM,UAAU;EAClE,MAAM,SAAS,kBAAkB,MAAM,KAAK;EAC5C,MAAM,YACJ,MAAM,OAAO,aAAa;GACxB,OAAO;GACP,MAAM,GAAG,gBAAgB,MAAM,UAAU,EAAE,GAAG;EAChD,CAAC,EAAA,CACD,MAAM,SAAS,KAAK,KAAK,WAAW,UAAU,KAAK,KAAK,eAAe,MAAM,WAAW,IAAI;EAC9F,IAAI,aAAa,KAAA,GAAW;GAC1B,IAAI,SAAS,UAAU,QACrB,MAAM,IAAI,MACR,sFACF;GACF,OAAO;IACL,UAAU,SAAS;IACnB,OAAO,SAAS;IAChB;IACA,cAAc;IACd,OAAO,SAAS;GAClB;EACF;EACA,MAAM,MAAM,MAAM,aAChB,QACA,QACA,GAAG,MAAM,YAAY,MAAM,MAAM,MAAM,YAAY,MACrD;EACA,MAAM,OAAO,aAAa;GAAE;GAAQ;EAAI,CAAC;EACzC,MAAM,OAAO,MAAM,OAAO,kBAAkB;GAC1C,OAAO,MAAM,YAAY;GACzB,MAAM,MAAM,YAAY;GACxB,MAAM;GACN,MAAM,MAAM,WAAW;GACvB,OAAO;EACT,CAAC;EACD,OAAO;GACL,UAAU,KAAK;GACf,OAAO,KAAK;GACZ;GACA,cAAc,OAAO;GACrB,OAAO,KAAK;EACd;CACF;CAEA,eAAe,sBACb,SACA,YACA,WACA,OAC+B;EAC/B,MAAM,SAAS,qBAAqB,SAAS;EAC7C,MAAM,sBAAsB,SAAS,UAAU;EAC/C,MAAM,SAAS,MAAM,oBAAoB,SAAS,UAAU;EAC5D,MAAM,OAAO,MAAM,mBAAmB,QAAQ,YAAY,MAAM;EAChE,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,2BAA2B,OAAO,+BAA+B;EAEnF,MAAM,YAAY,MAAM,kBAAkB,SAAS,QAAQ,KAAK,KAAK,GAAG;EACxE,IAAI,eAAe;EACnB,IAAI,CAAC,WAAW;GACd,MAAM,SAAS,MAAM,uBAAuB;IAC1C;IACA,gBAAgB,WAAW;IAC3B,YAAY;GACd,CAAC;GACD,eAAe,OAAO;GACtB,MAAM,MAAM,MAAM,aAChB,QACA,QACA,GAAG,KAAK,MAAM,MAAM,KAAK,QAAQ,MACjC,KAAK,KAAK,GACZ;GACA,MAAM,OAAO,aAAa;IAAE;IAAQ;IAAK,OAAO;GAAM,CAAC;GACvD,MAAM,oBAAoB,SAAS,GAAG;EACxC;EACA,MAAM,YAAY,mBAAmB,MAAM,QAAQ,YAAY;EAC/D,IAAI,MAAM,SAAS,UAAU,OAAO;GAClC,MAAM,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,CAAC;GAC9C,UAAU,QAAQ;EACpB;EACA,OAAO;CACT;CAEA,eAAe,eAAe,OAAiE;EAC7F,IAAI,OAAO,MAAM,UAAU,UACzB,OAAO,sBACL,MAAM,SACN,MAAM,YACN,MAAM,MAAM,WACZ,MAAM,UACR;EAEF,MAAM,SAAS,MAAM,oBAAoB,SAAS,MAAM,UAAU;EAClE,MAAM,OACJ,MAAM,iBAAiB,KAAA,IACnB,MAAM,oBAAoB,QAAQ,MAAM,YAAY,MAAM,KAAK,IAC/D,MAAM,sBAAsB,QAAQ,MAAM,YAAY,MAAM,YAAY;EAC9E,MAAM,SAAS,MAAM,uBAAuB;GAC1C,SAAS,MAAM;GACf,gBAAgB,MAAM,WAAW;GACjC,SACE,MAAM,iBAAiB,KAAA,IACnB,gBACA,0BAA0B,MAAM,aAAa;EACrD,CAAC;EACD,IAAI,MAAM,iBAAiB,KAAA,KAAa,OAAO,SAAS,KAAK,KAAK,KAChE,MAAM,IAAI,MACR,iBAAiB,MAAM,aAAa,SAAS,8CAC/C;EAEF,MAAM,MAAM,MAAM,aAAa,QAAQ,QAAQ,GAAG,KAAK,MAAM,MAAM,KAAK,QAAQ,IAAI;EACpF,MAAM,OAAO,aAAa;GACxB,QAAQ,KAAK;GACb;GACA,OAAO,MAAM,iBAAiB,KAAA;EAChC,CAAC;EACD,IAAI,QAAQ,KAAK;EACjB,IAAI,MAAM,WAAW,SAAS,OAAO;GACnC,MAAM,OAAO,UAAU,EAAE,QAAQ,KAAK,OAAO,CAAC;GAC9C,QAAQ;EACV;EACA,OAAO;GACL,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,QAAQ,KAAK;GACb,cAAc,OAAO;GACrB;EACF;CACF;CAEA,OAAO,OAAO,OAAO;EAAE;EAAwB;EAAiB;CAAe,CAAC;AAClF;;AAcA,SAAgB,uCACd,SACkC;CAClC,OAAO,OACL,UAC8C;EAC9C,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,aAAa,MAAM,QAAQ,kBAAkB,MAAM,MAAM;GACzD,IAAI,WAAW,OAAO,MAAM,cAC1B,OAAO;IACL,IAAI;IACJ,MAAM;IACN,QAAQ;GACV;GAEF,MAAM,OAAO,MAAM,QAAQ,OAAO,MAAM,IAAI,MAAM,MAAM;GACxD,IAAI,SAAS,MACX,OAAO;IACL,IAAI;IACJ,MAAM;IACN,QAAQ,QAAQ,MAAM,OAAO;GAC/B;GAEF,eACE,KAAK,aAAa,KAAA,IAAY,OAAO,MAAM,QAAQ,OAAO,QAAQ,IAAI,KAAK,QAAQ;GACrF,IAAI,KAAK,aAAa,KAAA,KAAa,iBAAiB,MAClD,OAAO;IACL,IAAI;IACJ,MAAM;IACN,QAAQ,UAAU,KAAK,SAAS;GAClC;GAEF,IACE,iBAAiB,SAChB,aAAa,iBAAiB,WAAW,MACxC,aAAa,aAAa,MAAM,YAChC,aAAa,UAAU,MAAM,QAE/B,OAAO;IACL,IAAI;IACJ,MAAM;IACN,QAAQ;GACV;EAEJ,SAAS,OAAO;GACd,OAAO;IACL,IAAI;IACJ,MAAM;IACN,QAAQ,qBAAqB,KAAK;GACpC;EACF;EAEA,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,oBAAoB,SAAS,UAAU;EACxD,SAAS,OAAO;GACd,OAAO;IACL,IAAI;IACJ,MAAM;IACN,QAAQ,qCAAqC,qBAAqB,KAAK;GACzE;EACF;EAEA,IAAI;EACJ,IAAI;GACF,OAAO,MAAM,OAAO,YAAY,EAAE,mBAAmB,MAAM,SAAS,CAAC;EACvE,SAAS,OAAO;GACd,OAAO;IACL,IAAI;IACJ,MACE,iBAAiB,6BAA6B,MAAM,WAAW,MAC3D,2BACA;IACN,QACE,iBAAiB,6BAA6B,MAAM,WAAW,MAC3D,iBAAiB,MAAM,SAAS,qBAAqB,WAAW,SAChE,kCAAkC,MAAM,SAAS,MAAM,WAAW;GAC1E;EACF;EACA,IAAI,KAAK,mBAAmB,MAAM,OAChC,OAAO;GACL,IAAI;GACJ,MAAM;GACN,QAAQ,sCAAsC,MAAM,SAAS,MAAM,WAAW;EAChF;EAEF,IAAI,KAAK,UAAU,QACjB,OAAO;GACL,IAAI;GACJ,MAAM;GACN,QAAQ,iBAAiB,MAAM,SAAS;EAC1C;EAEF,MAAM,SAAS,kBAAkB,MAAM,MAAM;EAC7C,IACE,KAAK,KAAK,eAAe,WAAW,QACnC,iBAAiB,QAAQ,KAAK,KAAK,WAAW,QAE/C,OAAO;GACL,IAAI;GACJ,MAAM;GACN,QACE,iBAAiB,OACb,iBAAiB,MAAM,SAAS,gCAAgC,WAChE,iBAAiB,MAAM,SAAS;EACxC;EAEF,IAAI,KAAK,OACP,OAAO;GACL,IAAI;GACJ,MAAM;GACN,QAAQ,iBAAiB,MAAM,SAAS;EAC1C;EAEF,OAAO,EAAE,IAAI,KAAK;CACpB;AACF"}

package/dist/pull-requests.d.mts

@@ -0,0 +1,6 @@
+/// <reference types="node" />
+import { OpenPullRequest, OpenPullRequestInput, PublishedPullRequest, PullRequestLabelAction, PullRequestLabelResult, PullRequestPublicationGateFailure, PullRequestPublicationGateFailureCode, PullRequestPublicationGateInput, PullRequestPublicationGateResult, PullRequestPublicationGateSuccess, PullRequestPublicationOwner, PushCheckpointInput, TaskPullRequest } from "./pull-requests/contracts.mjs";
+import { GitHubFetchPullRequestFailure, GitHubFetchPullRequestFailureCode, GitHubFetchPullRequestInput, GitHubFetchPullRequestResult, GitHubFetchPullRequestSuccess, GitHubFetchPullRequestTool, GitHubFetchPullRequestToolOptions, GitHubFetchPullRequestToolStores, createGitHubFetchPullRequestTool, gitHubFetchPullRequestInputSchema } from "./pull-requests/eve-fetch.mjs";
+import { MergeConflictPayload, mergeConflictPayloadSchema } from "./merge-resolution/contracts.mjs";
+import { GitHubFetchMergeConflictInput, GitHubFetchMergeConflictResult, GitHubMergeConflictTools, GitHubMergeConflictToolsOptions, GitHubMergeConflictToolsStores, GitHubPublishMergeResolutionInput, GitHubPublishMergeResolutionResult, createGitHubMergeConflictTools } from "./merge-resolution/eve-tools.mjs";
+export { type GitHubFetchMergeConflictInput, type GitHubFetchMergeConflictResult, type GitHubFetchPullRequestFailure, type GitHubFetchPullRequestFailureCode, type GitHubFetchPullRequestInput, type GitHubFetchPullRequestResult, type GitHubFetchPullRequestSuccess, type GitHubFetchPullRequestTool, type GitHubFetchPullRequestToolOptions, type GitHubFetchPullRequestToolStores, type GitHubMergeConflictTools, type GitHubMergeConflictToolsOptions, type GitHubMergeConflictToolsStores, type GitHubPublishMergeResolutionInput, type GitHubPublishMergeResolutionResult, type MergeConflictPayload, type OpenPullRequest, type OpenPullRequestInput, type PublishedPullRequest, type PullRequestLabelAction, type PullRequestLabelResult, type PullRequestPublicationGateFailure, type PullRequestPublicationGateFailureCode, type PullRequestPublicationGateInput, type PullRequestPublicationGateResult, type PullRequestPublicationGateSuccess, type PullRequestPublicationOwner, type PushCheckpointInput, type TaskPullRequest, createGitHubFetchPullRequestTool, createGitHubMergeConflictTools, gitHubFetchPullRequestInputSchema, mergeConflictPayloadSchema };

package/dist/pull-requests.mjs

@@ -0,0 +1,4 @@
+import { createGitHubFetchPullRequestTool, gitHubFetchPullRequestInputSchema } from "./pull-requests/eve-fetch.mjs";
+import { mergeConflictPayloadSchema } from "./merge-resolution/contracts.mjs";
+import { createGitHubMergeConflictTools } from "./merge-resolution/eve-tools.mjs";
+export { createGitHubFetchPullRequestTool, createGitHubMergeConflictTools, gitHubFetchPullRequestInputSchema, mergeConflictPayloadSchema };

package/dist/receipts.d.mts

@@ -0,0 +1,4 @@
+import { ReceiptId, receiptIdSchema } from "./schema/id.mjs";
+import { Cost, Receipt, ReceiptDelivery, ReceiptKind, ReceiptPhase, ReceiptState, StandardReceiptKind, StandardReceiptPhase, StandardReceiptState, costSchema, receiptDeliverySchema, receiptKindSchema, receiptPhaseSchema, receiptSchema, receiptStateSchema, standardReceiptKinds, standardReceiptPhases, standardReceiptStates } from "./schema/receipt.mjs";
+import { AppendReceiptInput } from "./store/engine.mjs";
+export { type AppendReceiptInput, type Cost, type Receipt, type ReceiptDelivery, type ReceiptId, type ReceiptKind, type ReceiptPhase, type ReceiptState, type StandardReceiptKind, type StandardReceiptPhase, type StandardReceiptState, costSchema, receiptDeliverySchema, receiptIdSchema, receiptKindSchema, receiptPhaseSchema, receiptSchema, receiptStateSchema, standardReceiptKinds, standardReceiptPhases, standardReceiptStates };

package/dist/receipts.mjs

@@ -0,0 +1,3 @@
+import { receiptIdSchema } from "./schema/id.mjs";
+import { costSchema, receiptDeliverySchema, receiptKindSchema, receiptPhaseSchema, receiptSchema, receiptStateSchema, standardReceiptKinds, standardReceiptPhases, standardReceiptStates } from "./schema/receipt.mjs";
+export { costSchema, receiptDeliverySchema, receiptIdSchema, receiptKindSchema, receiptPhaseSchema, receiptSchema, receiptStateSchema, standardReceiptKinds, standardReceiptPhases, standardReceiptStates };

package/dist/repositories.d.mts

@@ -0,0 +1,18 @@
+import { RepositoryId } from "./schema/id.mjs";
+import { Repository, RepositorySlug } from "./schema/repository.mjs";
+import { FactoryStores } from "./store/engine.mjs";
+//#region src/repositories.d.ts
+/** Derives a stable repository ID from a validated canonical repository slug. */
+declare function repositoryIdForSlug(slug: RepositorySlug): RepositoryId;
+/** Repository metadata and configured allowlist used to admit or refresh one repository. */
+interface EnsureConfiguredRepositoryInput {
+  readonly slug: RepositorySlug;
+  readonly configuredSlugs: readonly RepositorySlug[];
+  readonly defaultBranch: string;
+  readonly dependsOn: readonly RepositorySlug[];
+}
+/** Admits or refreshes a repository only when its slug is explicitly configured. */
+declare function ensureConfiguredRepository(stores: Pick<FactoryStores, "repositories">, input: EnsureConfiguredRepositoryInput): Promise<Repository>;
+//#endregion
+export { EnsureConfiguredRepositoryInput, ensureConfiguredRepository, repositoryIdForSlug };
+//# sourceMappingURL=repositories.d.mts.map

package/dist/repositories.mjs

@@ -0,0 +1,33 @@
+import "./schema/common.mjs";
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { createHash } from "node:crypto";
+//#region src/repositories.ts
+/** Derives a stable repository ID from a validated canonical repository slug. */
+function repositoryIdForSlug(slug) {
+	const canonical = repositorySlugSchema.parse(slug.toLowerCase());
+	return `repo_${createHash("sha256").update(canonical).digest("hex").slice(0, 32)}`;
+}
+/** Admits or refreshes a repository only when its slug is explicitly configured. */
+async function ensureConfiguredRepository(stores, input) {
+	const slug = repositorySlugSchema.parse(input.slug.toLowerCase());
+	if (!input.configuredSlugs.map((configured) => repositorySlugSchema.parse(configured.toLowerCase())).includes(slug)) throw new Error(`Repository ${slug} is not configured for this factory.`);
+	const id = repositoryIdForSlug(slug);
+	const dependsOn = input.dependsOn.map((dependency) => repositorySlugSchema.parse(dependency.toLowerCase()));
+	const existing = await stores.repositories.get(id);
+	if (existing !== null && existing.defaultBranch === input.defaultBranch && existing.dependsOn.length === dependsOn.length && existing.dependsOn.every((dependency, index) => dependency === dependsOn[index])) return existing;
+	return stores.repositories.put({
+		...existing ?? {
+			schemaVersion: 1,
+			id,
+			slug,
+			enabled: true,
+			connectedAt: (/* @__PURE__ */ new Date()).toISOString()
+		},
+		defaultBranch: input.defaultBranch,
+		dependsOn
+	});
+}
+//#endregion
+export { ensureConfiguredRepository, repositoryIdForSlug };
+
+//# sourceMappingURL=repositories.mjs.map

package/dist/repositories.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"repositories.mjs","names":[],"sources":["../src/repositories.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { SCHEMA_VERSION } from \"./schema/common\";\nimport { repositorySlugSchema, type Repository, type RepositorySlug } from \"./schema/repository\";\nimport type { RepositoryId } from \"./schema/id\";\nimport type { FactoryStores } from \"./store/engine\";\n\n/** Derives a stable repository ID from a validated canonical repository slug. */\nexport function repositoryIdForSlug(slug: RepositorySlug): RepositoryId {\n  const canonical = repositorySlugSchema.parse(slug.toLowerCase());\n  return `repo_${createHash(\"sha256\").update(canonical).digest(\"hex\").slice(0, 32)}`;\n}\n\n/** Repository metadata and configured allowlist used to admit or refresh one repository. */\nexport interface EnsureConfiguredRepositoryInput {\n  readonly slug: RepositorySlug;\n  readonly configuredSlugs: readonly RepositorySlug[];\n  readonly defaultBranch: string;\n  readonly dependsOn: readonly RepositorySlug[];\n}\n\n/** Admits or refreshes a repository only when its slug is explicitly configured. */\nexport async function ensureConfiguredRepository(\n  stores: Pick<FactoryStores, \"repositories\">,\n  input: EnsureConfiguredRepositoryInput,\n): Promise<Repository> {\n  const slug = repositorySlugSchema.parse(input.slug.toLowerCase());\n  const configuredSlugs = input.configuredSlugs.map((configured) =>\n    repositorySlugSchema.parse(configured.toLowerCase()),\n  );\n  if (!configuredSlugs.includes(slug)) {\n    throw new Error(`Repository ${slug} is not configured for this factory.`);\n  }\n  const id = repositoryIdForSlug(slug);\n  const dependsOn = input.dependsOn.map((dependency) =>\n    repositorySlugSchema.parse(dependency.toLowerCase()),\n  );\n  const existing = await stores.repositories.get(id);\n  if (\n    existing !== null &&\n    existing.defaultBranch === input.defaultBranch &&\n    existing.dependsOn.length === dependsOn.length &&\n    existing.dependsOn.every((dependency, index) => dependency === dependsOn[index])\n  ) {\n    return existing;\n  }\n  return stores.repositories.put({\n    ...(existing ?? {\n      schemaVersion: SCHEMA_VERSION,\n      id,\n      slug,\n      enabled: true,\n      connectedAt: new Date().toISOString(),\n    }),\n    defaultBranch: input.defaultBranch,\n    dependsOn,\n  });\n}\n"],"mappings":";;;;;AAOA,SAAgB,oBAAoB,MAAoC;CACtE,MAAM,YAAY,qBAAqB,MAAM,KAAK,YAAY,CAAC;CAC/D,OAAO,QAAQ,WAAW,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AACjF;;AAWA,eAAsB,2BACpB,QACA,OACqB;CACrB,MAAM,OAAO,qBAAqB,MAAM,MAAM,KAAK,YAAY,CAAC;CAIhE,IAAI,CAHoB,MAAM,gBAAgB,KAAK,eACjD,qBAAqB,MAAM,WAAW,YAAY,CAAC,CAElC,CAAC,CAAC,SAAS,IAAI,GAChC,MAAM,IAAI,MAAM,cAAc,KAAK,qCAAqC;CAE1E,MAAM,KAAK,oBAAoB,IAAI;CACnC,MAAM,YAAY,MAAM,UAAU,KAAK,eACrC,qBAAqB,MAAM,WAAW,YAAY,CAAC,CACrD;CACA,MAAM,WAAW,MAAM,OAAO,aAAa,IAAI,EAAE;CACjD,IACE,aAAa,QACb,SAAS,kBAAkB,MAAM,iBACjC,SAAS,UAAU,WAAW,UAAU,UACxC,SAAS,UAAU,OAAO,YAAY,UAAU,eAAe,UAAU,MAAM,GAE/E,OAAO;CAET,OAAO,OAAO,aAAa,IAAI;EAC7B,GAAI,YAAY;GACd,eAAA;GACA;GACA;GACA,SAAS;GACT,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;EACtC;EACA,eAAe,MAAM;EACrB;CACF,CAAC;AACH"}

package/dist/sandbox/command.d.mts

@@ -0,0 +1,18 @@
+//#region src/sandbox/command.d.ts
+/** Shell command accepted by the minimal sandbox command boundary. */
+interface CommandSandboxRunInput {
+  command: string;
+}
+/** Captured output and optional exit status returned by a sandbox command. */
+interface CommandSandboxRunResult {
+  stdout: string;
+  stderr?: string;
+  exitCode?: number;
+}
+/** Minimal sandbox contract for running a command and reading its result. */
+interface CommandSandbox {
+  run(options: CommandSandboxRunInput): PromiseLike<CommandSandboxRunResult>;
+}
+//#endregion
+export { CommandSandbox, CommandSandboxRunInput, CommandSandboxRunResult };
+//# sourceMappingURL=command.d.mts.map