@vercel/factory 0.0.14 → 0.0.16

package/dist/vercel-git.mjs

@@ -0,0 +1,344 @@
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { withSandboxGitBundle } from "./github-transfer.mjs";
+import { isSafeGitRef } from "./github-publication.mjs";
+import { randomUUID } from "node:crypto";
+import { Readable } from "node:stream";
+//#region src/vercel-git.ts
+const gitOidPattern = /^[a-f0-9]{40}$/u;
+const absentGitOid = "0".repeat(40);
+const managedGitTimeoutMs = 18e4;
+async function createManagedSandbox(input) {
+	const { Sandbox } = await import("@vercel/sandbox");
+	return Sandbox.create({ ...input });
+}
+function publicationBase(input) {
+	if (!isSafeGitRef(input.branch) || !gitOidPattern.test(input.head) || !gitOidPattern.test(input.expectedHead) || (input.expectedHead === absentGitOid ? input.baseHead === void 0 || !gitOidPattern.test(input.baseHead) : input.baseHead !== void 0)) throw new Error("Invalid Git publication target");
+	return input.expectedHead === absentGitOid ? input.baseHead : input.expectedHead;
+}
+async function trustedCommand(sandbox, input) {
+	const result = await sandbox.runCommand({
+		...input,
+		timeoutMs: 12e4
+	});
+	if (result.exitCode !== 0) throw new Error(`Trusted Git operation failed (${result.exitCode})`);
+	return (await result.stdout()).trim();
+}
+function bundleTransferSandbox(sandbox) {
+	return {
+		async run({ command }) {
+			const result = await sandbox.runCommand({
+				cmd: "sh",
+				args: ["-c", command]
+			});
+			return {
+				exitCode: result.exitCode,
+				stdout: await result.stdout()
+			};
+		},
+		async writeBinaryFile({ path, content }) {
+			await sandbox.writeFiles([{
+				path,
+				content: Buffer.from(content.buffer, content.byteOffset, content.byteLength)
+			}]);
+		}
+	};
+}
+async function consumeSandboxBundle(sandbox, path, use) {
+	const size = await sandbox.runCommand({
+		cmd: "stat",
+		args: [
+			"-c",
+			"%s",
+			path
+		]
+	});
+	const byteLength = Number(await size.stdout());
+	if (size.exitCode !== 0 || !Number.isSafeInteger(byteLength) || byteLength < 1 || byteLength > 314572800) throw new Error("Git bundle exceeds transfer limit");
+	const source = await sandbox.readFile({ path });
+	if (!source) throw new Error("Git bundle was not created");
+	const readable = source instanceof Readable ? source : new Readable({ highWaterMark: 65536 }).wrap(source);
+	const iterator = readable[Symbol.asyncIterator]();
+	const stream = new ReadableStream({
+		async pull(controller) {
+			const { done, value } = await iterator.next();
+			if (done) controller.close();
+			else controller.enqueue(value);
+		},
+		async cancel() {
+			await iterator.return?.();
+		}
+	}, { highWaterMark: 0 });
+	try {
+		await use({ stream });
+	} finally {
+		readable.destroy();
+		if (!stream.locked) await stream.cancel();
+	}
+}
+function credentialPolicy(repository, token) {
+	return { allow: { "github.com": [{
+		match: { path: { startsWith: `/${repository}.git/` } },
+		transform: [{ headers: { authorization: `Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}` } }]
+	}] } };
+}
+/** Transfer Git objects through fresh trusted sandboxes; credentials never reach an agent sandbox. */
+function createVercelGitHubGitTransport(options) {
+	async function isolated(repository, use) {
+		const slug = repositorySlugSchema.parse(repository.toLowerCase());
+		const sandbox = options.createSandbox ? await options.createSandbox() : await (await import("@vercel/sandbox")).Sandbox.create({
+			runtime: "node24",
+			timeout: 18e4,
+			networkPolicy: "deny-all"
+		});
+		async function git(...args) {
+			const result = await sandbox.runCommand({
+				cmd: "/usr/bin/env",
+				args: [
+					"-i",
+					"PATH=/usr/bin:/bin",
+					"HOME=/tmp",
+					"GIT_CONFIG_NOSYSTEM=1",
+					"GIT_CONFIG_GLOBAL=/dev/null",
+					"GIT_TERMINAL_PROMPT=0",
+					"git",
+					"-c",
+					"core.hooksPath=/dev/null",
+					"-c",
+					"credential.helper=",
+					"-c",
+					"protocol.ext.allow=never",
+					"-c",
+					"protocol.file.allow=always",
+					"-c",
+					"http.followRedirects=false",
+					...args
+				],
+				timeoutMs: 12e4
+			});
+			if (result.exitCode !== 0) throw new Error(`Trusted Git operation failed (${result.exitCode})`);
+			return (await result.stdout()).trim();
+		}
+		try {
+			await sandbox.updateNetworkPolicy("deny-all");
+			return await use(sandbox, git, slug);
+		} finally {
+			try {
+				await sandbox.updateNetworkPolicy("deny-all");
+			} finally {
+				await sandbox.stop();
+			}
+		}
+	}
+	return {
+		async fetch(input, use) {
+			if (input.refs.some((ref) => !ref.startsWith("refs/") || !isSafeGitRef(ref))) throw new Error("Invalid Git fetch ref");
+			return isolated(input.repository, async (sandbox, git, slug) => {
+				await sandbox.updateNetworkPolicy(credentialPolicy(slug, await options.token({
+					repository: slug,
+					access: "read"
+				})));
+				await git("clone", "--bare", "--no-hardlinks", `https://github.com/${slug}.git`, "/tmp/transfer.git");
+				if (input.refs.length) await git("-C", "/tmp/transfer.git", "fetch", "--no-tags", "origin", ...input.refs.map((ref) => `+${ref}:${ref}`));
+				await sandbox.updateNetworkPolicy("deny-all");
+				await git("-C", "/tmp/transfer.git", "bundle", "create", "/tmp/transfer.bundle", "--all");
+				await consumeSandboxBundle(sandbox, "/tmp/transfer.bundle", use);
+			});
+		},
+		async push(input) {
+			try {
+				const baseHead = publicationBase(input);
+				return await isolated(input.repository, async (sandbox, git, slug) => {
+					await git("init", "--bare", "/tmp/transfer.git");
+					return await withSandboxGitBundle({
+						sandbox: bundleTransferSandbox(sandbox),
+						bundle: input.bundle,
+						async use(path) {
+							await git("-C", "/tmp/transfer.git", "bundle", "verify", path);
+							await git("-C", "/tmp/transfer.git", "fetch", path, "HEAD:refs/heads/candidate");
+							if (await git("-C", "/tmp/transfer.git", "rev-parse", "refs/heads/candidate") !== input.head) throw new Error("Git bundle head does not match publication target");
+							await git("-C", "/tmp/transfer.git", "merge-base", "--is-ancestor", baseHead, "refs/heads/candidate");
+							await sandbox.updateNetworkPolicy(credentialPolicy(slug, await options.token({
+								repository: slug,
+								access: "write"
+							})));
+							await input.authorize();
+							await git("-C", "/tmp/transfer.git", "push", `--force-with-lease=refs/heads/${input.branch}:${input.expectedHead}`, `https://github.com/${slug}.git`, `${input.head}:refs/heads/${input.branch}`);
+							return input.head;
+						}
+					});
+				});
+			} finally {
+				if (!input.bundle.stream.locked) await input.bundle.stream.cancel();
+			}
+		}
+	};
+}
+/** Use fresh Vercel-managed trusted Sandboxes for Git reads and signed publication. */
+function createVercelManagedGitHubGitTransport(options) {
+	const createSandbox = options.createSandbox ?? createManagedSandbox;
+	const createInput = (repository, access) => ({
+		source: {
+			type: "git",
+			url: `https://github.com/${repository}.git`
+		},
+		__source_credentials: true,
+		__commitAs: options.commitIdentity,
+		networkPolicy: { allow: access === "read" ? ["github.com"] : ["github.com", "api.github.com"] },
+		persistent: false,
+		resources: { vcpus: 6 },
+		runtime: "node24",
+		timeout: managedGitTimeoutMs
+	});
+	return {
+		async fetch(input, use) {
+			if (input.refs.some((ref) => !ref.startsWith("refs/") || !isSafeGitRef(ref))) throw new Error("Invalid Git fetch ref");
+			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
+			const sandbox = await createSandbox(createInput(repository, "read"));
+			const repositoryPath = sandbox.cwd;
+			try {
+				await trustedCommand(sandbox, {
+					cmd: "/usr/bin/git",
+					args: [
+						"clone",
+						"--bare",
+						"--no-local",
+						repositoryPath,
+						"/tmp/transfer.git"
+					]
+				});
+				if (input.refs.length > 0) await trustedCommand(sandbox, {
+					cmd: "git",
+					args: [
+						"-C",
+						"/tmp/transfer.git",
+						"fetch",
+						"--no-tags",
+						`https://github.com/${repository}.git`,
+						...input.refs.map((ref) => `+${ref}:${ref}`)
+					]
+				});
+				await trustedCommand(sandbox, {
+					cmd: "/usr/bin/git",
+					args: [
+						"-C",
+						"/tmp/transfer.git",
+						"bundle",
+						"create",
+						"/tmp/transfer.bundle",
+						"--all"
+					]
+				});
+				await consumeSandboxBundle(sandbox, "/tmp/transfer.bundle", use);
+			} finally {
+				await sandbox.stop();
+			}
+		},
+		async push(input) {
+			try {
+				const baseHead = publicationBase(input);
+				if (input.expectedHead === absentGitOid) throw new Error("Vercel-managed signed publication requires an existing remote branch");
+				const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
+				const sandbox = await createSandbox(createInput(repository, "write"));
+				const repositoryPath = sandbox.cwd;
+				try {
+					const hooksPath = `/tmp/factory-hooks-${randomUUID()}`;
+					await trustedCommand(sandbox, {
+						cmd: "mkdir",
+						args: [
+							"-m",
+							"700",
+							hooksPath
+						]
+					});
+					await trustedCommand(sandbox, {
+						cmd: "/usr/bin/git",
+						args: [
+							"config",
+							"core.hooksPath",
+							hooksPath
+						],
+						cwd: repositoryPath
+					});
+					await withSandboxGitBundle({
+						sandbox: bundleTransferSandbox(sandbox),
+						bundle: input.bundle,
+						async use(path) {
+							await trustedCommand(sandbox, {
+								cmd: "/usr/bin/git",
+								args: [
+									"bundle",
+									"verify",
+									path
+								],
+								cwd: repositoryPath
+							});
+							await trustedCommand(sandbox, {
+								cmd: "/usr/bin/git",
+								args: [
+									"fetch",
+									"--no-tags",
+									path,
+									`${input.head}:refs/factory/candidate`
+								],
+								cwd: repositoryPath
+							});
+							if (await trustedCommand(sandbox, {
+								cmd: "/usr/bin/git",
+								args: ["rev-parse", "refs/factory/candidate"],
+								cwd: repositoryPath
+							}) !== input.head) throw new Error("Git bundle head does not match publication target");
+							await trustedCommand(sandbox, {
+								cmd: "/usr/bin/git",
+								args: [
+									"merge-base",
+									"--is-ancestor",
+									baseHead,
+									"refs/factory/candidate"
+								],
+								cwd: repositoryPath
+							});
+							await trustedCommand(sandbox, {
+								cmd: "/usr/bin/git",
+								args: [
+									"checkout",
+									"-B",
+									input.branch,
+									"refs/factory/candidate"
+								],
+								cwd: repositoryPath
+							});
+							await input.authorize();
+							await trustedCommand(sandbox, {
+								cmd: "/usr/bin/env",
+								args: [
+									`VERCEL_GIT_EXPECTED_REMOTE_OID=${input.expectedHead}`,
+									...input.baseHead === void 0 ? [] : [`VERCEL_GIT_BASE_OID=${input.baseHead}`],
+									"git",
+									"push",
+									"origin",
+									input.branch
+								],
+								cwd: repositoryPath
+							});
+						}
+					});
+					const signedHead = await trustedCommand(sandbox, {
+						cmd: "/usr/bin/git",
+						args: ["rev-parse", "HEAD"],
+						cwd: repositoryPath
+					});
+					if (!gitOidPattern.test(signedHead)) throw new Error("Managed signed push returned an invalid Git head");
+					return signedHead;
+				} finally {
+					await sandbox.stop();
+				}
+			} finally {
+				if (!input.bundle.stream.locked) await input.bundle.stream.cancel();
+			}
+		}
+	};
+}
+//#endregion
+export { createVercelGitHubGitTransport, createVercelManagedGitHubGitTransport };
+
+//# sourceMappingURL=vercel-git.mjs.map

package/dist/vercel-git.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-git.mjs","names":[],"sources":["../src/vercel-git.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { Readable } from \"node:stream\";\nimport type { Sandbox, NetworkPolicy } from \"@vercel/sandbox\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport { isSafeGitRef } from \"./github-publication\";\nimport {\n  maxGitBundleBytes,\n  withSandboxGitBundle,\n  type GitHubGitTransport,\n  type GitHubRepositoryBundle,\n} from \"./github-transfer\";\n\ntype TrustedGitSandbox = Pick<\n  Sandbox,\n  \"cwd\" | \"runCommand\" | \"writeFiles\" | \"readFile\" | \"updateNetworkPolicy\" | \"stop\"\n>;\n\n/** Exact creation request for a fresh Vercel-managed trusted Git publication Sandbox. */\nexport interface VercelManagedGitHubSandboxCreateInput {\n  source: {\n    type: \"git\";\n    url: string;\n  };\n  __source_credentials: true;\n  __commitAs: {\n    name: string;\n    email: string;\n  };\n  networkPolicy: NetworkPolicy;\n  persistent: false;\n  resources: { vcpus: 6 };\n  runtime: \"node24\";\n  timeout: number;\n}\n\nconst gitOidPattern = /^[a-f0-9]{40}$/u;\nconst absentGitOid = \"0\".repeat(40);\nconst managedGitTimeoutMs = 180_000;\n\n/** Repository and access level used to mint one trusted Git transport token. */\nexport interface VercelGitHubTokenInput {\n  repository: RepositorySlug;\n  access: \"read\" | \"write\";\n}\n\n/** Configures fresh trusted sandboxes and repository-scoped Git tokens. */\nexport interface VercelGitHubGitTransportOptions {\n  /** Reads must mint contents:read credentials; writes are confined to the supplied repository. */\n  token(input: VercelGitHubTokenInput): Promise<string>;\n  /** Creates a fresh sandbox, without a snapshot, repository, or running agent. */\n  createSandbox?: () => Promise<TrustedGitSandbox>;\n}\n\n/** Configures Vercel-managed Git reads and signed publication. */\nexport interface VercelManagedGitHubGitTransportOptions {\n  /** Attribution metadata supplied for managed signed commits. */\n  commitIdentity: { name: string; email: string };\n  /** Creates one unnamed Sandbox from the exact managed credential request. */\n  createSandbox?: (input: VercelManagedGitHubSandboxCreateInput) => Promise<TrustedGitSandbox>;\n}\n\nasync function createManagedSandbox(\n  input: VercelManagedGitHubSandboxCreateInput,\n): Promise<TrustedGitSandbox> {\n  const { Sandbox } = await import(\"@vercel/sandbox\");\n  return Sandbox.create({ ...input });\n}\n\nfunction publicationBase(input: {\n  branch: string;\n  head: string;\n  expectedHead: string;\n  baseHead?: string;\n}): string {\n  if (\n    !isSafeGitRef(input.branch) ||\n    !gitOidPattern.test(input.head) ||\n    !gitOidPattern.test(input.expectedHead) ||\n    (input.expectedHead === absentGitOid\n      ? input.baseHead === undefined || !gitOidPattern.test(input.baseHead)\n      : input.baseHead !== undefined)\n  ) {\n    throw new Error(\"Invalid Git publication target\");\n  }\n  return input.expectedHead === absentGitOid ? input.baseHead! : input.expectedHead;\n}\n\nasync function trustedCommand(\n  sandbox: TrustedGitSandbox,\n  input: { cmd: string; args: string[]; cwd?: string },\n): Promise<string> {\n  const result = await sandbox.runCommand({ ...input, timeoutMs: 120_000 });\n  if (result.exitCode !== 0) throw new Error(`Trusted Git operation failed (${result.exitCode})`);\n  return (await result.stdout()).trim();\n}\n\nfunction bundleTransferSandbox(sandbox: TrustedGitSandbox) {\n  return {\n    async run({ command }: { command: string }) {\n      const result = await sandbox.runCommand({ cmd: \"sh\", args: [\"-c\", command] });\n      return { exitCode: result.exitCode, stdout: await result.stdout() };\n    },\n    async writeBinaryFile({ path, content }: { path: string; content: Uint8Array }) {\n      await sandbox.writeFiles([\n        {\n          path,\n          content: Buffer.from(content.buffer, content.byteOffset, content.byteLength),\n        },\n      ]);\n    },\n  };\n}\n\nasync function consumeSandboxBundle(\n  sandbox: TrustedGitSandbox,\n  path: string,\n  use: (bundle: GitHubRepositoryBundle) => Promise<void>,\n): Promise<void> {\n  const size = await sandbox.runCommand({ cmd: \"stat\", args: [\"-c\", \"%s\", path] });\n  const byteLength = Number(await size.stdout());\n  if (\n    size.exitCode !== 0 ||\n    !Number.isSafeInteger(byteLength) ||\n    byteLength < 1 ||\n    byteLength > maxGitBundleBytes\n  ) {\n    throw new Error(\"Git bundle exceeds transfer limit\");\n  }\n  const source = await sandbox.readFile({ path });\n  if (!source) throw new Error(\"Git bundle was not created\");\n  const readable =\n    source instanceof Readable ? source : new Readable({ highWaterMark: 64 * 1024 }).wrap(source);\n  const iterator = readable[Symbol.asyncIterator]();\n  const stream = new ReadableStream<Uint8Array>(\n    {\n      async pull(controller) {\n        const { done, value } = await iterator.next();\n        if (done) controller.close();\n        else controller.enqueue(value);\n      },\n      async cancel() {\n        await iterator.return?.();\n      },\n    },\n    { highWaterMark: 0 },\n  );\n  try {\n    await use({ stream });\n  } finally {\n    readable.destroy();\n    if (!stream.locked) await stream.cancel();\n  }\n}\n\nfunction credentialPolicy(repository: RepositorySlug, token: string): NetworkPolicy {\n  return {\n    allow: {\n      \"github.com\": [\n        {\n          match: { path: { startsWith: `/${repository}.git/` } },\n          transform: [\n            {\n              headers: {\n                authorization: `Basic ${Buffer.from(`x-access-token:${token}`).toString(\"base64\")}`,\n              },\n            },\n          ],\n        },\n      ],\n    },\n  };\n}\n\n/** Transfer Git objects through fresh trusted sandboxes; credentials never reach an agent sandbox. */\nexport function createVercelGitHubGitTransport(\n  options: VercelGitHubGitTransportOptions,\n): GitHubGitTransport {\n  async function isolated<T>(\n    repository: RepositorySlug,\n    use: (\n      sandbox: Awaited<ReturnType<NonNullable<VercelGitHubGitTransportOptions[\"createSandbox\"]>>>,\n      git: (...args: string[]) => Promise<string>,\n      repository: RepositorySlug,\n    ) => Promise<T>,\n  ): Promise<T> {\n    const slug = repositorySlugSchema.parse(repository.toLowerCase());\n    const sandbox = options.createSandbox\n      ? await options.createSandbox()\n      : await (\n          await import(\"@vercel/sandbox\")\n        ).Sandbox.create({ runtime: \"node24\", timeout: 180_000, networkPolicy: \"deny-all\" });\n    async function git(...args: string[]): Promise<string> {\n      const result = await sandbox.runCommand({\n        cmd: \"/usr/bin/env\",\n        args: [\n          \"-i\",\n          \"PATH=/usr/bin:/bin\",\n          \"HOME=/tmp\",\n          \"GIT_CONFIG_NOSYSTEM=1\",\n          \"GIT_CONFIG_GLOBAL=/dev/null\",\n          \"GIT_TERMINAL_PROMPT=0\",\n          \"git\",\n          \"-c\",\n          \"core.hooksPath=/dev/null\",\n          \"-c\",\n          \"credential.helper=\",\n          \"-c\",\n          \"protocol.ext.allow=never\",\n          \"-c\",\n          \"protocol.file.allow=always\",\n          \"-c\",\n          \"http.followRedirects=false\",\n          ...args,\n        ],\n        timeoutMs: 120_000,\n      });\n      if (result.exitCode !== 0)\n        throw new Error(`Trusted Git operation failed (${result.exitCode})`);\n      return (await result.stdout()).trim();\n    }\n    try {\n      await sandbox.updateNetworkPolicy(\"deny-all\");\n      return await use(sandbox, git, slug);\n    } finally {\n      try {\n        await sandbox.updateNetworkPolicy(\"deny-all\");\n      } finally {\n        await sandbox.stop();\n      }\n    }\n  }\n  return {\n    async fetch(input, use) {\n      if (input.refs.some((ref) => !ref.startsWith(\"refs/\") || !isSafeGitRef(ref)))\n        throw new Error(\"Invalid Git fetch ref\");\n      return isolated(input.repository, async (sandbox, git, slug) => {\n        await sandbox.updateNetworkPolicy(\n          credentialPolicy(slug, await options.token({ repository: slug, access: \"read\" })),\n        );\n        await git(\n          \"clone\",\n          \"--bare\",\n          \"--no-hardlinks\",\n          `https://github.com/${slug}.git`,\n          \"/tmp/transfer.git\",\n        );\n        if (input.refs.length)\n          await git(\n            \"-C\",\n            \"/tmp/transfer.git\",\n            \"fetch\",\n            \"--no-tags\",\n            \"origin\",\n            ...input.refs.map((ref) => `+${ref}:${ref}`),\n          );\n        await sandbox.updateNetworkPolicy(\"deny-all\");\n        await git(\"-C\", \"/tmp/transfer.git\", \"bundle\", \"create\", \"/tmp/transfer.bundle\", \"--all\");\n        await consumeSandboxBundle(sandbox, \"/tmp/transfer.bundle\", use);\n      });\n    },\n    async push(input) {\n      try {\n        const baseHead = publicationBase(input);\n        return await isolated(input.repository, async (sandbox, git, slug) => {\n          await git(\"init\", \"--bare\", \"/tmp/transfer.git\");\n          return await withSandboxGitBundle({\n            sandbox: bundleTransferSandbox(sandbox),\n            bundle: input.bundle,\n            async use(path) {\n              await git(\"-C\", \"/tmp/transfer.git\", \"bundle\", \"verify\", path);\n              await git(\"-C\", \"/tmp/transfer.git\", \"fetch\", path, \"HEAD:refs/heads/candidate\");\n              if (\n                (await git(\"-C\", \"/tmp/transfer.git\", \"rev-parse\", \"refs/heads/candidate\")) !==\n                input.head\n              )\n                throw new Error(\"Git bundle head does not match publication target\");\n              await git(\n                \"-C\",\n                \"/tmp/transfer.git\",\n                \"merge-base\",\n                \"--is-ancestor\",\n                baseHead,\n                \"refs/heads/candidate\",\n              );\n              await sandbox.updateNetworkPolicy(\n                credentialPolicy(slug, await options.token({ repository: slug, access: \"write\" })),\n              );\n              await input.authorize();\n              await git(\n                \"-C\",\n                \"/tmp/transfer.git\",\n                \"push\",\n                `--force-with-lease=refs/heads/${input.branch}:${input.expectedHead}`,\n                `https://github.com/${slug}.git`,\n                `${input.head}:refs/heads/${input.branch}`,\n              );\n              return input.head;\n            },\n          });\n        });\n      } finally {\n        if (!input.bundle.stream.locked) await input.bundle.stream.cancel();\n      }\n    },\n  };\n}\n\n/** Use fresh Vercel-managed trusted Sandboxes for Git reads and signed publication. */\nexport function createVercelManagedGitHubGitTransport(\n  options: VercelManagedGitHubGitTransportOptions,\n): GitHubGitTransport {\n  const createSandbox = options.createSandbox ?? createManagedSandbox;\n  const createInput = (\n    repository: RepositorySlug,\n    access: \"read\" | \"write\",\n  ): VercelManagedGitHubSandboxCreateInput => ({\n    source: {\n      type: \"git\",\n      url: `https://github.com/${repository}.git`,\n    },\n    __source_credentials: true,\n    __commitAs: options.commitIdentity,\n    networkPolicy: { allow: access === \"read\" ? [\"github.com\"] : [\"github.com\", \"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: managedGitTimeoutMs,\n  });\n  return {\n    async fetch(input, use) {\n      if (input.refs.some((ref) => !ref.startsWith(\"refs/\") || !isSafeGitRef(ref))) {\n        throw new Error(\"Invalid Git fetch ref\");\n      }\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      const sandbox = await createSandbox(createInput(repository, \"read\"));\n      const repositoryPath = sandbox.cwd;\n      try {\n        await trustedCommand(sandbox, {\n          cmd: \"/usr/bin/git\",\n          args: [\"clone\", \"--bare\", \"--no-local\", repositoryPath, \"/tmp/transfer.git\"],\n        });\n        if (input.refs.length > 0) {\n          await trustedCommand(sandbox, {\n            cmd: \"git\",\n            args: [\n              \"-C\",\n              \"/tmp/transfer.git\",\n              \"fetch\",\n              \"--no-tags\",\n              `https://github.com/${repository}.git`,\n              ...input.refs.map((ref) => `+${ref}:${ref}`),\n            ],\n          });\n        }\n        await trustedCommand(sandbox, {\n          cmd: \"/usr/bin/git\",\n          args: [\"-C\", \"/tmp/transfer.git\", \"bundle\", \"create\", \"/tmp/transfer.bundle\", \"--all\"],\n        });\n        await consumeSandboxBundle(sandbox, \"/tmp/transfer.bundle\", use);\n      } finally {\n        await sandbox.stop();\n      }\n    },\n    async push(input) {\n      try {\n        const baseHead = publicationBase(input);\n        if (input.expectedHead === absentGitOid) {\n          throw new Error(\"Vercel-managed signed publication requires an existing remote branch\");\n        }\n        const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n        const sandbox = await createSandbox(createInput(repository, \"write\"));\n        const repositoryPath = sandbox.cwd;\n        try {\n          const hooksPath = `/tmp/factory-hooks-${randomUUID()}`;\n          await trustedCommand(sandbox, { cmd: \"mkdir\", args: [\"-m\", \"700\", hooksPath] });\n          await trustedCommand(sandbox, {\n            cmd: \"/usr/bin/git\",\n            args: [\"config\", \"core.hooksPath\", hooksPath],\n            cwd: repositoryPath,\n          });\n          await withSandboxGitBundle({\n            sandbox: bundleTransferSandbox(sandbox),\n            bundle: input.bundle,\n            async use(path) {\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/git\",\n                args: [\"bundle\", \"verify\", path],\n                cwd: repositoryPath,\n              });\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/git\",\n                args: [\"fetch\", \"--no-tags\", path, `${input.head}:refs/factory/candidate`],\n                cwd: repositoryPath,\n              });\n              if (\n                (await trustedCommand(sandbox, {\n                  cmd: \"/usr/bin/git\",\n                  args: [\"rev-parse\", \"refs/factory/candidate\"],\n                  cwd: repositoryPath,\n                })) !== input.head\n              ) {\n                throw new Error(\"Git bundle head does not match publication target\");\n              }\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/git\",\n                args: [\"merge-base\", \"--is-ancestor\", baseHead, \"refs/factory/candidate\"],\n                cwd: repositoryPath,\n              });\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/git\",\n                args: [\"checkout\", \"-B\", input.branch, \"refs/factory/candidate\"],\n                cwd: repositoryPath,\n              });\n              await input.authorize();\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/env\",\n                args: [\n                  `VERCEL_GIT_EXPECTED_REMOTE_OID=${input.expectedHead}`,\n                  ...(input.baseHead === undefined\n                    ? []\n                    : [`VERCEL_GIT_BASE_OID=${input.baseHead}`]),\n                  \"git\",\n                  \"push\",\n                  \"origin\",\n                  input.branch,\n                ],\n                cwd: repositoryPath,\n              });\n            },\n          });\n          const signedHead = await trustedCommand(sandbox, {\n            cmd: \"/usr/bin/git\",\n            args: [\"rev-parse\", \"HEAD\"],\n            cwd: repositoryPath,\n          });\n          if (!gitOidPattern.test(signedHead)) {\n            throw new Error(\"Managed signed push returned an invalid Git head\");\n          }\n          return signedHead;\n        } finally {\n          await sandbox.stop();\n        }\n      } finally {\n        if (!input.bundle.stream.locked) await input.bundle.stream.cancel();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;AAmCA,MAAM,gBAAgB;AACtB,MAAM,eAAe,IAAI,OAAO,EAAE;AAClC,MAAM,sBAAsB;AAwB5B,eAAe,qBACb,OAC4B;CAC5B,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,OAAO,QAAQ,OAAO,EAAE,GAAG,MAAM,CAAC;AACpC;AAEA,SAAS,gBAAgB,OAKd;CACT,IACE,CAAC,aAAa,MAAM,MAAM,KAC1B,CAAC,cAAc,KAAK,MAAM,IAAI,KAC9B,CAAC,cAAc,KAAK,MAAM,YAAY,MACrC,MAAM,iBAAiB,eACpB,MAAM,aAAa,KAAA,KAAa,CAAC,cAAc,KAAK,MAAM,QAAQ,IAClE,MAAM,aAAa,KAAA,IAEvB,MAAM,IAAI,MAAM,gCAAgC;CAElD,OAAO,MAAM,iBAAiB,eAAe,MAAM,WAAY,MAAM;AACvE;AAEA,eAAe,eACb,SACA,OACiB;CACjB,MAAM,SAAS,MAAM,QAAQ,WAAW;EAAE,GAAG;EAAO,WAAW;CAAQ,CAAC;CACxE,IAAI,OAAO,aAAa,GAAG,MAAM,IAAI,MAAM,iCAAiC,OAAO,SAAS,EAAE;CAC9F,QAAQ,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;AACtC;AAEA,SAAS,sBAAsB,SAA4B;CACzD,OAAO;EACL,MAAM,IAAI,EAAE,WAAgC;GAC1C,MAAM,SAAS,MAAM,QAAQ,WAAW;IAAE,KAAK;IAAM,MAAM,CAAC,MAAM,OAAO;GAAE,CAAC;GAC5E,OAAO;IAAE,UAAU,OAAO;IAAU,QAAQ,MAAM,OAAO,OAAO;GAAE;EACpE;EACA,MAAM,gBAAgB,EAAE,MAAM,WAAkD;GAC9E,MAAM,QAAQ,WAAW,CACvB;IACE;IACA,SAAS,OAAO,KAAK,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU;GAC7E,CACF,CAAC;EACH;CACF;AACF;AAEA,eAAe,qBACb,SACA,MACA,KACe;CACf,MAAM,OAAO,MAAM,QAAQ,WAAW;EAAE,KAAK;EAAQ,MAAM;GAAC;GAAM;GAAM;EAAI;CAAE,CAAC;CAC/E,MAAM,aAAa,OAAO,MAAM,KAAK,OAAO,CAAC;CAC7C,IACE,KAAK,aAAa,KAClB,CAAC,OAAO,cAAc,UAAU,KAChC,aAAa,KACb,aAAA,WAEA,MAAM,IAAI,MAAM,mCAAmC;CAErD,MAAM,SAAS,MAAM,QAAQ,SAAS,EAAE,KAAK,CAAC;CAC9C,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,4BAA4B;CACzD,MAAM,WACJ,kBAAkB,WAAW,SAAS,IAAI,SAAS,EAAE,eAAe,MAAU,CAAC,CAAC,CAAC,KAAK,MAAM;CAC9F,MAAM,WAAW,SAAS,OAAO,cAAc,CAAC;CAChD,MAAM,SAAS,IAAI,eACjB;EACE,MAAM,KAAK,YAAY;GACrB,MAAM,EAAE,MAAM,UAAU,MAAM,SAAS,KAAK;GAC5C,IAAI,MAAM,WAAW,MAAM;QACtB,WAAW,QAAQ,KAAK;EAC/B;EACA,MAAM,SAAS;GACb,MAAM,SAAS,SAAS;EAC1B;CACF,GACA,EAAE,eAAe,EAAE,CACrB;CACA,IAAI;EACF,MAAM,IAAI,EAAE,OAAO,CAAC;CACtB,UAAU;EACR,SAAS,QAAQ;EACjB,IAAI,CAAC,OAAO,QAAQ,MAAM,OAAO,OAAO;CAC1C;AACF;AAEA,SAAS,iBAAiB,YAA4B,OAA8B;CAClF,OAAO,EACL,OAAO,EACL,cAAc,CACZ;EACE,OAAO,EAAE,MAAM,EAAE,YAAY,IAAI,WAAW,OAAO,EAAE;EACrD,WAAW,CACT,EACE,SAAS,EACP,eAAe,SAAS,OAAO,KAAK,kBAAkB,OAAO,CAAC,CAAC,SAAS,QAAQ,IAClF,EACF,CACF;CACF,CACF,EACF,EACF;AACF;;AAGA,SAAgB,+BACd,SACoB;CACpB,eAAe,SACb,YACA,KAKY;EACZ,MAAM,OAAO,qBAAqB,MAAM,WAAW,YAAY,CAAC;EAChE,MAAM,UAAU,QAAQ,gBACpB,MAAM,QAAQ,cAAc,IAC5B,OACE,MAAM,OAAO,mBAAA,CACb,QAAQ,OAAO;GAAE,SAAS;GAAU,SAAS;GAAS,eAAe;EAAW,CAAC;EACvF,eAAe,IAAI,GAAG,MAAiC;GACrD,MAAM,SAAS,MAAM,QAAQ,WAAW;IACtC,KAAK;IACL,MAAM;KACJ;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA,GAAG;IACL;IACA,WAAW;GACb,CAAC;GACD,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,iCAAiC,OAAO,SAAS,EAAE;GACrE,QAAQ,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;EACtC;EACA,IAAI;GACF,MAAM,QAAQ,oBAAoB,UAAU;GAC5C,OAAO,MAAM,IAAI,SAAS,KAAK,IAAI;EACrC,UAAU;GACR,IAAI;IACF,MAAM,QAAQ,oBAAoB,UAAU;GAC9C,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;CACF;CACA,OAAO;EACL,MAAM,MAAM,OAAO,KAAK;GACtB,IAAI,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,aAAa,GAAG,CAAC,GACzE,MAAM,IAAI,MAAM,uBAAuB;GACzC,OAAO,SAAS,MAAM,YAAY,OAAO,SAAS,KAAK,SAAS;IAC9D,MAAM,QAAQ,oBACZ,iBAAiB,MAAM,MAAM,QAAQ,MAAM;KAAE,YAAY;KAAM,QAAQ;IAAO,CAAC,CAAC,CAClF;IACA,MAAM,IACJ,SACA,UACA,kBACA,sBAAsB,KAAK,OAC3B,mBACF;IACA,IAAI,MAAM,KAAK,QACb,MAAM,IACJ,MACA,qBACA,SACA,aACA,UACA,GAAG,MAAM,KAAK,KAAK,QAAQ,IAAI,IAAI,GAAG,KAAK,CAC7C;IACF,MAAM,QAAQ,oBAAoB,UAAU;IAC5C,MAAM,IAAI,MAAM,qBAAqB,UAAU,UAAU,wBAAwB,OAAO;IACxF,MAAM,qBAAqB,SAAS,wBAAwB,GAAG;GACjE,CAAC;EACH;EACA,MAAM,KAAK,OAAO;GAChB,IAAI;IACF,MAAM,WAAW,gBAAgB,KAAK;IACtC,OAAO,MAAM,SAAS,MAAM,YAAY,OAAO,SAAS,KAAK,SAAS;KACpE,MAAM,IAAI,QAAQ,UAAU,mBAAmB;KAC/C,OAAO,MAAM,qBAAqB;MAChC,SAAS,sBAAsB,OAAO;MACtC,QAAQ,MAAM;MACd,MAAM,IAAI,MAAM;OACd,MAAM,IAAI,MAAM,qBAAqB,UAAU,UAAU,IAAI;OAC7D,MAAM,IAAI,MAAM,qBAAqB,SAAS,MAAM,2BAA2B;OAC/E,IACG,MAAM,IAAI,MAAM,qBAAqB,aAAa,sBAAsB,MACzE,MAAM,MAEN,MAAM,IAAI,MAAM,mDAAmD;OACrE,MAAM,IACJ,MACA,qBACA,cACA,iBACA,UACA,sBACF;OACA,MAAM,QAAQ,oBACZ,iBAAiB,MAAM,MAAM,QAAQ,MAAM;QAAE,YAAY;QAAM,QAAQ;OAAQ,CAAC,CAAC,CACnF;OACA,MAAM,MAAM,UAAU;OACtB,MAAM,IACJ,MACA,qBACA,QACA,iCAAiC,MAAM,OAAO,GAAG,MAAM,gBACvD,sBAAsB,KAAK,OAC3B,GAAG,MAAM,KAAK,cAAc,MAAM,QACpC;OACA,OAAO,MAAM;MACf;KACF,CAAC;IACH,CAAC;GACH,UAAU;IACR,IAAI,CAAC,MAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,OAAO,OAAO,OAAO;GACpE;EACF;CACF;AACF;;AAGA,SAAgB,sCACd,SACoB;CACpB,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,MAAM,eACJ,YACA,YAC2C;EAC3C,QAAQ;GACN,MAAM;GACN,KAAK,sBAAsB,WAAW;EACxC;EACA,sBAAsB;EACtB,YAAY,QAAQ;EACpB,eAAe,EAAE,OAAO,WAAW,SAAS,CAAC,YAAY,IAAI,CAAC,cAAc,gBAAgB,EAAE;EAC9F,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;CACA,OAAO;EACL,MAAM,MAAM,OAAO,KAAK;GACtB,IAAI,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,aAAa,GAAG,CAAC,GACzE,MAAM,IAAI,MAAM,uBAAuB;GAEzC,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,MAAM,UAAU,MAAM,cAAc,YAAY,YAAY,MAAM,CAAC;GACnE,MAAM,iBAAiB,QAAQ;GAC/B,IAAI;IACF,MAAM,eAAe,SAAS;KAC5B,KAAK;KACL,MAAM;MAAC;MAAS;MAAU;MAAc;MAAgB;KAAmB;IAC7E,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,GACtB,MAAM,eAAe,SAAS;KAC5B,KAAK;KACL,MAAM;MACJ;MACA;MACA;MACA;MACA,sBAAsB,WAAW;MACjC,GAAG,MAAM,KAAK,KAAK,QAAQ,IAAI,IAAI,GAAG,KAAK;KAC7C;IACF,CAAC;IAEH,MAAM,eAAe,SAAS;KAC5B,KAAK;KACL,MAAM;MAAC;MAAM;MAAqB;MAAU;MAAU;MAAwB;KAAO;IACvF,CAAC;IACD,MAAM,qBAAqB,SAAS,wBAAwB,GAAG;GACjE,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;EACA,MAAM,KAAK,OAAO;GAChB,IAAI;IACF,MAAM,WAAW,gBAAgB,KAAK;IACtC,IAAI,MAAM,iBAAiB,cACzB,MAAM,IAAI,MAAM,sEAAsE;IAExF,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;IAC5E,MAAM,UAAU,MAAM,cAAc,YAAY,YAAY,OAAO,CAAC;IACpE,MAAM,iBAAiB,QAAQ;IAC/B,IAAI;KACF,MAAM,YAAY,sBAAsB,WAAW;KACnD,MAAM,eAAe,SAAS;MAAE,KAAK;MAAS,MAAM;OAAC;OAAM;OAAO;MAAS;KAAE,CAAC;KAC9E,MAAM,eAAe,SAAS;MAC5B,KAAK;MACL,MAAM;OAAC;OAAU;OAAkB;MAAS;MAC5C,KAAK;KACP,CAAC;KACD,MAAM,qBAAqB;MACzB,SAAS,sBAAsB,OAAO;MACtC,QAAQ,MAAM;MACd,MAAM,IAAI,MAAM;OACd,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SAAC;SAAU;SAAU;QAAI;QAC/B,KAAK;OACP,CAAC;OACD,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SAAC;SAAS;SAAa;SAAM,GAAG,MAAM,KAAK;QAAwB;QACzE,KAAK;OACP,CAAC;OACD,IACG,MAAM,eAAe,SAAS;QAC7B,KAAK;QACL,MAAM,CAAC,aAAa,wBAAwB;QAC5C,KAAK;OACP,CAAC,MAAO,MAAM,MAEd,MAAM,IAAI,MAAM,mDAAmD;OAErE,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SAAC;SAAc;SAAiB;SAAU;QAAwB;QACxE,KAAK;OACP,CAAC;OACD,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SAAC;SAAY;SAAM,MAAM;SAAQ;QAAwB;QAC/D,KAAK;OACP,CAAC;OACD,MAAM,MAAM,UAAU;OACtB,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SACJ,kCAAkC,MAAM;SACxC,GAAI,MAAM,aAAa,KAAA,IACnB,CAAC,IACD,CAAC,uBAAuB,MAAM,UAAU;SAC5C;SACA;SACA;SACA,MAAM;QACR;QACA,KAAK;OACP,CAAC;MACH;KACF,CAAC;KACD,MAAM,aAAa,MAAM,eAAe,SAAS;MAC/C,KAAK;MACL,MAAM,CAAC,aAAa,MAAM;MAC1B,KAAK;KACP,CAAC;KACD,IAAI,CAAC,cAAc,KAAK,UAAU,GAChC,MAAM,IAAI,MAAM,kDAAkD;KAEpE,OAAO;IACT,UAAU;KACR,MAAM,QAAQ,KAAK;IACrB;GACF,UAAU;IACR,IAAI,CAAC,MAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,OAAO,OAAO,OAAO;GACpE;EACF;CACF;AACF"}

package/dist/vercel-github-api.d.mts

@@ -0,0 +1,103 @@
+import { RepositorySlug } from "./schema/repository.mjs";
+import { GitHubTreeEntry } from "./github-publication.mjs";
+import { NetworkPolicy, Sandbox } from "@vercel/sandbox";
+//#region src/vercel-github-api.d.ts
+type TrustedGitHubApiSandbox = Pick<Sandbox, "runCommand" | "stop">;
+/** GitHub API actions supported by Vercel-managed Sandbox credentials. */
+type VercelManagedGitHubApiAction = "github:issues:read" | "github:pull-request:create";
+/** Exact creation request for one Vercel-managed GitHub API operation. */
+interface VercelManagedGitHubApiSandboxCreateInput {
+  source?: {
+    type: "git";
+    url: string;
+  };
+  __source_credentials?: true;
+  __commitAs?: {
+    name: string;
+    email: string;
+  };
+  __credentials: {
+    github: [{
+      repositories: [RepositorySlug];
+      actions: [VercelManagedGitHubApiAction];
+    }];
+  };
+  networkPolicy: NetworkPolicy;
+  persistent: false;
+  resources: {
+    vcpus: 6;
+  };
+  runtime: "node24";
+  timeout: 60_000 | 180_000;
+}
+/** Configures fresh trusted Sandboxes for brokered GitHub API requests. */
+interface VercelManagedGitHubApiOptions {
+  /** Attribution metadata supplied when managed publication creates a signed commit. */
+  commitIdentity?: {
+    name: string;
+    email: string;
+  };
+  createSandbox?: (input: VercelManagedGitHubApiSandboxCreateInput) => Promise<TrustedGitHubApiSandbox>;
+}
+/** Authorized request to read one exact GitHub issue. */
+interface VercelManagedGitHubIssueInput {
+  repository: RepositorySlug;
+  issueNumber: number;
+  authorize(): Promise<void>;
+}
+/** Issue fields returned by a Vercel-managed GitHub API request. */
+interface VercelManagedGitHubIssue {
+  title: string;
+  body: string | null;
+  url: string;
+  pullRequest: boolean;
+}
+/** Authorized request to create one draft or ready GitHub pull request. */
+interface VercelManagedGitHubPullRequestInput {
+  repository: RepositorySlug;
+  title: string;
+  body: string;
+  head: string;
+  base: string;
+  draft: boolean;
+  authorize(): Promise<void>;
+}
+/** Pull-request identity returned by a Vercel-managed GitHub API request. */
+interface VercelManagedGitHubPullRequest {
+  pullRequestNumber: number;
+  pullRequestUrl: string;
+  draft: boolean;
+}
+/** Git Data and pull-request inputs for one idempotent managed publication. */
+interface VercelManagedGitHubPublicationInput {
+  repository: RepositorySlug;
+  baseCommit: string;
+  tree: readonly GitHubTreeEntry[];
+  commitMessage: string;
+  branch: string;
+  title: string;
+  body: string;
+  baseBranch: string;
+  draft: boolean;
+  authorize(): Promise<void>;
+}
+/** Commit and pull-request identities returned after managed publication. */
+interface VercelManagedGitHubPublication extends VercelManagedGitHubPullRequest {
+  commitSha: string;
+}
+/** Repository-scoped brokered GitHub API operations supplied by Vercel Sandbox. */
+interface VercelManagedGitHubApi {
+  readIssue(input: VercelManagedGitHubIssueInput): Promise<VercelManagedGitHubIssue>;
+  createPullRequest(input: VercelManagedGitHubPullRequestInput): Promise<VercelManagedGitHubPullRequest>;
+  publishPullRequest(input: VercelManagedGitHubPublicationInput): Promise<VercelManagedGitHubPublication>;
+}
+/** GitHub API failure returned through the managed credential Sandbox. */
+declare class VercelManagedGitHubApiError extends Error {
+  readonly status: number;
+  constructor(status: number, message: string);
+}
+/** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */
+declare function createVercelManagedGitHubApi(options?: VercelManagedGitHubApiOptions): VercelManagedGitHubApi;
+//#endregion
+export { VercelManagedGitHubApi, VercelManagedGitHubApiAction, VercelManagedGitHubApiError, VercelManagedGitHubApiOptions, VercelManagedGitHubApiSandboxCreateInput, VercelManagedGitHubIssue, VercelManagedGitHubIssueInput, VercelManagedGitHubPublication, VercelManagedGitHubPublicationInput, VercelManagedGitHubPullRequest, VercelManagedGitHubPullRequestInput, createVercelManagedGitHubApi };
+//# sourceMappingURL=vercel-github-api.d.mts.map