@vercel/factory 0.0.14 → 0.0.16

package/dist/vercel-github-api.mjs

@@ -0,0 +1,363 @@
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { isSafeGitRef } from "./github-publication.mjs";
+import { z } from "zod";
+//#region src/vercel-github-api.ts
+/** GitHub API failure returned through the managed credential Sandbox. */
+var VercelManagedGitHubApiError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(`GitHub API request failed (${status}): ${message}`);
+		this.status = status;
+		this.name = "VercelManagedGitHubApiError";
+	}
+};
+const sandboxResponseSchema = z.object({
+	status: z.number().int().min(100).max(599),
+	body: z.unknown()
+});
+const issueSchema = z.object({
+	title: z.string(),
+	body: z.string().nullable(),
+	html_url: z.url(),
+	pull_request: z.unknown().optional()
+});
+const pullRequestSchema = z.object({
+	number: z.number().int().positive(),
+	html_url: z.url(),
+	draft: z.boolean()
+});
+const shaSchema = z.string().regex(/^[a-f0-9]{40}$/u);
+const commitSchema = z.object({
+	sha: shaSchema,
+	tree: z.object({ sha: shaSchema }),
+	parents: z.array(z.object({ sha: shaSchema }))
+});
+const treeSchema = z.object({ sha: shaSchema });
+const refSchema = z.object({ object: z.object({ sha: shaSchema }) });
+const publicationPullSchema = pullRequestSchema.extend({
+	state: z.enum(["open", "closed"]),
+	head: z.object({
+		ref: z.string(),
+		sha: shaSchema
+	})
+});
+const publicationPathSchema = z.string().min(1).max(1024).refine((path) => Buffer.byteLength(path, "utf8") <= 1024, { message: "Managed publication path exceeds byte limit" }).refine((path) => /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u.test(path) && !path.includes("..") && !path.includes("//") && !path.endsWith("/") && !path.split("/").some((part) => part === "."), { message: "Invalid managed publication path" });
+const publicationBranchSchema = z.string().min(1).max(256).refine((branch) => isSafeGitRef(branch) && branch.split("/").every((component) => component.length > 0 && !component.startsWith(".") && !component.endsWith(".") && !component.endsWith(".lock")), { message: "Invalid managed publication branch" });
+const publicationTextSchema = (maximum, field) => z.string().max(maximum).refine((value) => Buffer.byteLength(value, "utf8") <= maximum, { message: `Managed publication ${field} exceeds byte limit` });
+const publicationCommitMessageSchema = publicationTextSchema(65536, "commit message").min(1);
+const publicationTitleSchema = publicationTextSchema(256, "title").min(1);
+const publicationBodySchema = publicationTextSchema(65536, "body");
+const publicationBaseBranchSchema = z.string().min(1).max(256).refine((branch) => isSafeGitRef(branch), { message: "Invalid managed publication base branch" });
+const publicationContentSchema = z.string().max(2e5).refine((content) => Buffer.byteLength(content, "utf8") <= 2e5, { message: "Managed publication content exceeds byte limit" });
+const publicationTreeSchema = z.array(z.union([z.strictObject({
+	path: publicationPathSchema,
+	mode: z.enum(["100644", "100755"]),
+	type: z.literal("blob"),
+	content: publicationContentSchema
+}), z.strictObject({
+	path: publicationPathSchema,
+	mode: z.enum(["100644", "100755"]),
+	type: z.literal("blob"),
+	sha: z.null()
+})])).min(1).max(25).refine((entries) => new TextEncoder().encode(JSON.stringify({ tree: entries })).byteLength <= 1e6, "Managed publication tree exceeds transfer limit");
+const githubRequestScript = `
+const request = JSON.parse(process.argv[1]);
+const response = await fetch(request.url, {
+  method: request.method,
+  headers: {
+    accept: "application/vnd.github+json",
+    "content-type": "application/json",
+    "x-github-api-version": "2022-11-28",
+  },
+  body: request.body === undefined ? undefined : JSON.stringify(request.body),
+  redirect: "error",
+});
+const reader = response.body?.getReader();
+const chunks = [];
+let byteLength = 0;
+if (reader) {
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    byteLength += value.byteLength;
+    if (byteLength > 1_000_000) {
+      await reader.cancel();
+      throw new Error("GitHub API response exceeds transfer limit");
+    }
+    chunks.push(value);
+  }
+}
+const bytes = new Uint8Array(byteLength);
+let offset = 0;
+for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+const text = new TextDecoder().decode(bytes);
+let body = null;
+try { body = text === "" ? null : JSON.parse(text); } catch { body = { message: text }; }
+process.stdout.write(JSON.stringify({ status: response.status, body }));
+`;
+async function createManagedSandbox(input) {
+	const { Sandbox } = await import("@vercel/sandbox");
+	return Sandbox.create({ ...input });
+}
+function createInput(repository, action) {
+	return {
+		__credentials: { github: [{
+			repositories: [repository],
+			actions: [action]
+		}] },
+		networkPolicy: { allow: ["api.github.com"] },
+		persistent: false,
+		resources: { vcpus: 6 },
+		runtime: "node24",
+		timeout: 6e4
+	};
+}
+function createPublicationInput(repository, commitIdentity) {
+	return {
+		source: {
+			type: "git",
+			url: `https://github.com/${repository}.git`
+		},
+		__source_credentials: true,
+		__commitAs: commitIdentity,
+		__credentials: { github: [{
+			repositories: [repository],
+			actions: ["github:pull-request:create"]
+		}] },
+		networkPolicy: { allow: ["github.com", "api.github.com"] },
+		persistent: false,
+		resources: { vcpus: 6 },
+		runtime: "node24",
+		timeout: 18e4
+	};
+}
+async function request(createSandbox, input) {
+	const sandbox = await createSandbox(createInput(input.repository, input.action));
+	try {
+		await input.authorize();
+		const result = await sandbox.runCommand({
+			cmd: "node",
+			args: [
+				"--input-type=module",
+				"--eval",
+				githubRequestScript,
+				JSON.stringify({
+					method: input.method,
+					url: `https://api.github.com/repos/${input.repository}${input.path}`,
+					...input.body === void 0 ? {} : { body: input.body }
+				})
+			],
+			timeoutMs: 3e4
+		});
+		const stderr = (await result.stderr()).trim();
+		if (result.exitCode !== 0) throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);
+		const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));
+		if (response.status < 200 || response.status >= 300) {
+			const message = z.object({ message: z.string() }).safeParse(response.body);
+			throw new VercelManagedGitHubApiError(response.status, message.success ? message.data.message : "Unexpected response");
+		}
+		return response.body;
+	} finally {
+		await sandbox.stop();
+	}
+}
+async function sandboxRequest(sandbox, input) {
+	const result = await sandbox.runCommand({
+		cmd: "node",
+		args: [
+			"--input-type=module",
+			"--eval",
+			githubRequestScript,
+			JSON.stringify({
+				method: input.method,
+				url: `https://api.github.com/repos/${input.repository}${input.path}`,
+				...input.body === void 0 ? {} : { body: input.body }
+			})
+		],
+		timeoutMs: 3e4
+	});
+	const stderr = (await result.stderr()).trim();
+	if (result.exitCode !== 0) throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);
+	const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));
+	if (response.status < 200 || response.status >= 300) {
+		const message = z.object({ message: z.string() }).safeParse(response.body);
+		throw new VercelManagedGitHubApiError(response.status, message.success ? message.data.message : "Unexpected response");
+	}
+	return response.body;
+}
+/** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */
+function createVercelManagedGitHubApi(options = {}) {
+	const createSandbox = options.createSandbox ?? createManagedSandbox;
+	return {
+		async readIssue(input) {
+			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
+			if (!Number.isSafeInteger(input.issueNumber) || input.issueNumber < 1) throw new Error("Invalid GitHub issue number");
+			const issue = issueSchema.parse(await request(createSandbox, {
+				repository,
+				action: "github:issues:read",
+				method: "GET",
+				path: `/issues/${input.issueNumber}`,
+				authorize: input.authorize
+			}));
+			return {
+				title: issue.title,
+				body: issue.body,
+				url: issue.html_url,
+				pullRequest: issue.pull_request !== void 0
+			};
+		},
+		async createPullRequest(input) {
+			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
+			const head = publicationBranchSchema.parse(input.head);
+			const base = publicationBaseBranchSchema.parse(input.base);
+			const title = publicationTitleSchema.parse(input.title);
+			const body = publicationBodySchema.parse(input.body);
+			const pull = pullRequestSchema.parse(await request(createSandbox, {
+				repository,
+				action: "github:pull-request:create",
+				method: "POST",
+				path: "/pulls",
+				body: {
+					title,
+					body,
+					head,
+					base,
+					draft: input.draft
+				},
+				authorize: input.authorize
+			}));
+			return {
+				pullRequestNumber: pull.number,
+				pullRequestUrl: pull.html_url,
+				draft: pull.draft
+			};
+		},
+		async publishPullRequest(input) {
+			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
+			if (!options.commitIdentity) throw new Error("Managed publication requires commit identity");
+			if (!/^[a-f0-9]{40}$/u.test(input.baseCommit) || input.commitMessage.trim() === "") throw new Error("Invalid managed GitHub publication");
+			const publicationTree = publicationTreeSchema.parse(input.tree);
+			const branch = publicationBranchSchema.parse(input.branch);
+			const baseBranch = publicationBaseBranchSchema.parse(input.baseBranch);
+			const title = publicationTitleSchema.parse(input.title);
+			const body = publicationBodySchema.parse(input.body);
+			const commitMessage = publicationCommitMessageSchema.parse(`${input.commitMessage}\n\nCo-authored-by: ${options.commitIdentity.name} <${options.commitIdentity.email}>`);
+			const sandbox = await createSandbox(createPublicationInput(repository, options.commitIdentity));
+			try {
+				const authorizedRequest = async (request) => {
+					await input.authorize();
+					return sandboxRequest(sandbox, {
+						repository,
+						...request
+					});
+				};
+				const base = commitSchema.parse(await authorizedRequest({
+					method: "GET",
+					path: `/git/commits/${input.baseCommit}`
+				}));
+				const tree = treeSchema.parse(await authorizedRequest({
+					method: "POST",
+					path: "/git/trees",
+					body: {
+						base_tree: base.tree.sha,
+						tree: publicationTree
+					}
+				}));
+				const pullPath = `/pulls?${new URLSearchParams({
+					state: "all",
+					head: `${repository.split("/")[0]}:${branch}`,
+					per_page: "100"
+				})}`;
+				const pulls = async () => z.array(publicationPullSchema).parse(await authorizedRequest({
+					method: "GET",
+					path: pullPath
+				}));
+				const result = (pull, commitSha) => ({
+					commitSha,
+					pullRequestNumber: pull.number,
+					pullRequestUrl: pull.html_url,
+					draft: pull.draft
+				});
+				const refPath = `/git/ref/heads/${branch.split("/").map(encodeURIComponent).join("/")}`;
+				let existingRef;
+				try {
+					existingRef = refSchema.parse(await authorizedRequest({
+						method: "GET",
+						path: refPath
+					}));
+				} catch (error) {
+					if (!(error instanceof VercelManagedGitHubApiError) || error.status !== 404) throw error;
+					existingRef = null;
+				}
+				let commitSha = existingRef?.object.sha;
+				if (commitSha) {
+					const existingPull = (await pulls()).find((pull) => pull.head.ref === branch);
+					if (existingPull) {
+						if (existingPull.state !== "open") throw new Error("Managed publication pull request is closed");
+						const existingCommit = commitSchema.parse(await authorizedRequest({
+							method: "GET",
+							path: `/git/commits/${existingPull.head.sha}`
+						}));
+						if (existingCommit.tree.sha !== tree.sha || existingCommit.parents.length !== 1 || existingCommit.parents[0]?.sha !== input.baseCommit) throw new Error("Managed publication pull request contains different changes");
+						return result(existingPull, existingPull.head.sha);
+					}
+					const existingCommit = commitSchema.parse(await authorizedRequest({
+						method: "GET",
+						path: `/git/commits/${commitSha}`
+					}));
+					if (existingCommit.tree.sha !== tree.sha || existingCommit.parents.length !== 1 || existingCommit.parents[0]?.sha !== input.baseCommit) throw new Error("Managed publication branch contains different changes");
+				} else {
+					commitSha = commitSchema.parse(await authorizedRequest({
+						method: "POST",
+						path: "/git/commits",
+						body: {
+							message: commitMessage,
+							tree: tree.sha,
+							parents: [input.baseCommit]
+						}
+					})).sha;
+					try {
+						await authorizedRequest({
+							method: "POST",
+							path: "/git/refs",
+							body: {
+								ref: `refs/heads/${branch}`,
+								sha: commitSha
+							}
+						});
+					} catch (error) {
+						if (refSchema.parse(await authorizedRequest({
+							method: "GET",
+							path: refPath
+						})).object.sha !== commitSha) throw error;
+					}
+				}
+				let pull;
+				try {
+					pull = pullRequestSchema.parse(await authorizedRequest({
+						method: "POST",
+						path: "/pulls",
+						body: {
+							title,
+							body,
+							head: branch,
+							base: baseBranch,
+							draft: input.draft
+						}
+					}));
+				} catch (error) {
+					const reconciled = (await pulls()).find((candidate) => candidate.head.ref === branch);
+					if (!reconciled || reconciled.state !== "open" || reconciled.head.sha !== commitSha) throw error;
+					pull = reconciled;
+				}
+				return result(pull, commitSha);
+			} finally {
+				await sandbox.stop();
+			}
+		}
+	};
+}
+//#endregion
+export { VercelManagedGitHubApiError, createVercelManagedGitHubApi };
+
+//# sourceMappingURL=vercel-github-api.mjs.map

package/dist/vercel-github-api.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-github-api.mjs","names":[],"sources":["../src/vercel-github-api.ts"],"sourcesContent":["import type { Sandbox, NetworkPolicy } from \"@vercel/sandbox\";\nimport { z } from \"zod\";\nimport { isSafeGitRef, type GitHubTreeEntry } from \"./github-publication\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\n\ntype TrustedGitHubApiSandbox = Pick<Sandbox, \"runCommand\" | \"stop\">;\n\n/** GitHub API actions supported by Vercel-managed Sandbox credentials. */\nexport type VercelManagedGitHubApiAction = \"github:issues:read\" | \"github:pull-request:create\";\n\n/** Exact creation request for one Vercel-managed GitHub API operation. */\nexport interface VercelManagedGitHubApiSandboxCreateInput {\n  source?: {\n    type: \"git\";\n    url: string;\n  };\n  __source_credentials?: true;\n  __commitAs?: {\n    name: string;\n    email: string;\n  };\n  __credentials: {\n    github: [\n      {\n        repositories: [RepositorySlug];\n        actions: [VercelManagedGitHubApiAction];\n      },\n    ];\n  };\n  networkPolicy: NetworkPolicy;\n  persistent: false;\n  resources: { vcpus: 6 };\n  runtime: \"node24\";\n  timeout: 60_000 | 180_000;\n}\n\n/** Configures fresh trusted Sandboxes for brokered GitHub API requests. */\nexport interface VercelManagedGitHubApiOptions {\n  /** Attribution metadata supplied when managed publication creates a signed commit. */\n  commitIdentity?: { name: string; email: string };\n  createSandbox?: (\n    input: VercelManagedGitHubApiSandboxCreateInput,\n  ) => Promise<TrustedGitHubApiSandbox>;\n}\n\n/** Authorized request to read one exact GitHub issue. */\nexport interface VercelManagedGitHubIssueInput {\n  repository: RepositorySlug;\n  issueNumber: number;\n  authorize(): Promise<void>;\n}\n\n/** Issue fields returned by a Vercel-managed GitHub API request. */\nexport interface VercelManagedGitHubIssue {\n  title: string;\n  body: string | null;\n  url: string;\n  pullRequest: boolean;\n}\n\n/** Authorized request to create one draft or ready GitHub pull request. */\nexport interface VercelManagedGitHubPullRequestInput {\n  repository: RepositorySlug;\n  title: string;\n  body: string;\n  head: string;\n  base: string;\n  draft: boolean;\n  authorize(): Promise<void>;\n}\n\n/** Pull-request identity returned by a Vercel-managed GitHub API request. */\nexport interface VercelManagedGitHubPullRequest {\n  pullRequestNumber: number;\n  pullRequestUrl: string;\n  draft: boolean;\n}\n\n/** Git Data and pull-request inputs for one idempotent managed publication. */\nexport interface VercelManagedGitHubPublicationInput {\n  repository: RepositorySlug;\n  baseCommit: string;\n  tree: readonly GitHubTreeEntry[];\n  commitMessage: string;\n  branch: string;\n  title: string;\n  body: string;\n  baseBranch: string;\n  draft: boolean;\n  authorize(): Promise<void>;\n}\n\n/** Commit and pull-request identities returned after managed publication. */\nexport interface VercelManagedGitHubPublication extends VercelManagedGitHubPullRequest {\n  commitSha: string;\n}\n\n/** Repository-scoped brokered GitHub API operations supplied by Vercel Sandbox. */\nexport interface VercelManagedGitHubApi {\n  readIssue(input: VercelManagedGitHubIssueInput): Promise<VercelManagedGitHubIssue>;\n  createPullRequest(\n    input: VercelManagedGitHubPullRequestInput,\n  ): Promise<VercelManagedGitHubPullRequest>;\n  publishPullRequest(\n    input: VercelManagedGitHubPublicationInput,\n  ): Promise<VercelManagedGitHubPublication>;\n}\n\n/** GitHub API failure returned through the managed credential Sandbox. */\nexport class VercelManagedGitHubApiError extends Error {\n  constructor(\n    readonly status: number,\n    message: string,\n  ) {\n    super(`GitHub API request failed (${status}): ${message}`);\n    this.name = \"VercelManagedGitHubApiError\";\n  }\n}\n\nconst sandboxResponseSchema = z.object({\n  status: z.number().int().min(100).max(599),\n  body: z.unknown(),\n});\nconst issueSchema = z.object({\n  title: z.string(),\n  body: z.string().nullable(),\n  html_url: z.url(),\n  pull_request: z.unknown().optional(),\n});\nconst pullRequestSchema = z.object({\n  number: z.number().int().positive(),\n  html_url: z.url(),\n  draft: z.boolean(),\n});\nconst shaSchema = z.string().regex(/^[a-f0-9]{40}$/u);\nconst commitSchema = z.object({\n  sha: shaSchema,\n  tree: z.object({ sha: shaSchema }),\n  parents: z.array(z.object({ sha: shaSchema })),\n});\nconst treeSchema = z.object({ sha: shaSchema });\nconst refSchema = z.object({ object: z.object({ sha: shaSchema }) });\nconst publicationPullSchema = pullRequestSchema.extend({\n  state: z.enum([\"open\", \"closed\"]),\n  head: z.object({ ref: z.string(), sha: shaSchema }),\n});\nconst publicationPathSchema = z\n  .string()\n  .min(1)\n  .max(1_024)\n  .refine((path) => Buffer.byteLength(path, \"utf8\") <= 1_024, {\n    message: \"Managed publication path exceeds byte limit\",\n  })\n  .refine(\n    (path) =>\n      /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u.test(path) &&\n      !path.includes(\"..\") &&\n      !path.includes(\"//\") &&\n      !path.endsWith(\"/\") &&\n      !path.split(\"/\").some((part) => part === \".\"),\n    { message: \"Invalid managed publication path\" },\n  );\nconst publicationBranchSchema = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine(\n    (branch) =>\n      isSafeGitRef(branch) &&\n      branch\n        .split(\"/\")\n        .every(\n          (component) =>\n            component.length > 0 &&\n            !component.startsWith(\".\") &&\n            !component.endsWith(\".\") &&\n            !component.endsWith(\".lock\"),\n        ),\n    { message: \"Invalid managed publication branch\" },\n  );\nconst publicationTextSchema = (maximum: number, field: string) =>\n  z\n    .string()\n    .max(maximum)\n    .refine((value) => Buffer.byteLength(value, \"utf8\") <= maximum, {\n      message: `Managed publication ${field} exceeds byte limit`,\n    });\nconst publicationCommitMessageSchema = publicationTextSchema(65_536, \"commit message\").min(1);\nconst publicationTitleSchema = publicationTextSchema(256, \"title\").min(1);\nconst publicationBodySchema = publicationTextSchema(65_536, \"body\");\nconst publicationBaseBranchSchema = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine((branch) => isSafeGitRef(branch), {\n    message: \"Invalid managed publication base branch\",\n  });\nconst publicationContentSchema = z\n  .string()\n  .max(200_000)\n  .refine((content) => Buffer.byteLength(content, \"utf8\") <= 200_000, {\n    message: \"Managed publication content exceeds byte limit\",\n  });\nconst publicationTreeSchema = z\n  .array(\n    z.union([\n      z.strictObject({\n        path: publicationPathSchema,\n        mode: z.enum([\"100644\", \"100755\"]),\n        type: z.literal(\"blob\"),\n        content: publicationContentSchema,\n      }),\n      z.strictObject({\n        path: publicationPathSchema,\n        mode: z.enum([\"100644\", \"100755\"]),\n        type: z.literal(\"blob\"),\n        sha: z.null(),\n      }),\n    ]),\n  )\n  .min(1)\n  .max(25)\n  .refine(\n    (entries) =>\n      new TextEncoder().encode(JSON.stringify({ tree: entries })).byteLength <= 1_000_000,\n    \"Managed publication tree exceeds transfer limit\",\n  );\nconst githubRequestScript = `\nconst request = JSON.parse(process.argv[1]);\nconst response = await fetch(request.url, {\n  method: request.method,\n  headers: {\n    accept: \"application/vnd.github+json\",\n    \"content-type\": \"application/json\",\n    \"x-github-api-version\": \"2022-11-28\",\n  },\n  body: request.body === undefined ? undefined : JSON.stringify(request.body),\n  redirect: \"error\",\n});\nconst reader = response.body?.getReader();\nconst chunks = [];\nlet byteLength = 0;\nif (reader) {\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    byteLength += value.byteLength;\n    if (byteLength > 1_000_000) {\n      await reader.cancel();\n      throw new Error(\"GitHub API response exceeds transfer limit\");\n    }\n    chunks.push(value);\n  }\n}\nconst bytes = new Uint8Array(byteLength);\nlet offset = 0;\nfor (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }\nconst text = new TextDecoder().decode(bytes);\nlet body = null;\ntry { body = text === \"\" ? null : JSON.parse(text); } catch { body = { message: text }; }\nprocess.stdout.write(JSON.stringify({ status: response.status, body }));\n`;\n\nasync function createManagedSandbox(\n  input: VercelManagedGitHubApiSandboxCreateInput,\n): Promise<TrustedGitHubApiSandbox> {\n  const { Sandbox } = await import(\"@vercel/sandbox\");\n  return Sandbox.create({ ...input });\n}\n\nfunction createInput(\n  repository: RepositorySlug,\n  action: VercelManagedGitHubApiAction,\n): VercelManagedGitHubApiSandboxCreateInput {\n  return {\n    __credentials: { github: [{ repositories: [repository], actions: [action] }] },\n    networkPolicy: { allow: [\"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: 60_000,\n  };\n}\n\nfunction createPublicationInput(\n  repository: RepositorySlug,\n  commitIdentity: { name: string; email: string },\n): VercelManagedGitHubApiSandboxCreateInput {\n  return {\n    source: { type: \"git\", url: `https://github.com/${repository}.git` },\n    __source_credentials: true,\n    __commitAs: commitIdentity,\n    __credentials: {\n      github: [\n        {\n          repositories: [repository],\n          actions: [\"github:pull-request:create\"],\n        },\n      ],\n    },\n    networkPolicy: { allow: [\"github.com\", \"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: 180_000,\n  };\n}\n\nasync function request(\n  createSandbox: (\n    input: VercelManagedGitHubApiSandboxCreateInput,\n  ) => Promise<TrustedGitHubApiSandbox>,\n  input: {\n    repository: RepositorySlug;\n    action: VercelManagedGitHubApiAction;\n    method: \"GET\" | \"POST\";\n    path: string;\n    body?: unknown;\n    authorize(): Promise<void>;\n  },\n): Promise<unknown> {\n  const sandbox = await createSandbox(createInput(input.repository, input.action));\n  try {\n    await input.authorize();\n    const result = await sandbox.runCommand({\n      cmd: \"node\",\n      args: [\n        \"--input-type=module\",\n        \"--eval\",\n        githubRequestScript,\n        JSON.stringify({\n          method: input.method,\n          url: `https://api.github.com/repos/${input.repository}${input.path}`,\n          ...(input.body === undefined ? {} : { body: input.body }),\n        }),\n      ],\n      timeoutMs: 30_000,\n    });\n    const stderr = (await result.stderr()).trim();\n    if (result.exitCode !== 0) {\n      throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);\n    }\n    const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));\n    if (response.status < 200 || response.status >= 300) {\n      const message = z.object({ message: z.string() }).safeParse(response.body);\n      throw new VercelManagedGitHubApiError(\n        response.status,\n        message.success ? message.data.message : \"Unexpected response\",\n      );\n    }\n    return response.body;\n  } finally {\n    await sandbox.stop();\n  }\n}\n\nasync function sandboxRequest(\n  sandbox: TrustedGitHubApiSandbox,\n  input: {\n    repository: RepositorySlug;\n    method: \"GET\" | \"POST\";\n    path: string;\n    body?: unknown;\n  },\n): Promise<unknown> {\n  const result = await sandbox.runCommand({\n    cmd: \"node\",\n    args: [\n      \"--input-type=module\",\n      \"--eval\",\n      githubRequestScript,\n      JSON.stringify({\n        method: input.method,\n        url: `https://api.github.com/repos/${input.repository}${input.path}`,\n        ...(input.body === undefined ? {} : { body: input.body }),\n      }),\n    ],\n    timeoutMs: 30_000,\n  });\n  const stderr = (await result.stderr()).trim();\n  if (result.exitCode !== 0) {\n    throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);\n  }\n  const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));\n  if (response.status < 200 || response.status >= 300) {\n    const message = z.object({ message: z.string() }).safeParse(response.body);\n    throw new VercelManagedGitHubApiError(\n      response.status,\n      message.success ? message.data.message : \"Unexpected response\",\n    );\n  }\n  return response.body;\n}\n\n/** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */\nexport function createVercelManagedGitHubApi(\n  options: VercelManagedGitHubApiOptions = {},\n): VercelManagedGitHubApi {\n  const createSandbox = options.createSandbox ?? createManagedSandbox;\n  return {\n    async readIssue(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!Number.isSafeInteger(input.issueNumber) || input.issueNumber < 1) {\n        throw new Error(\"Invalid GitHub issue number\");\n      }\n      const issue = issueSchema.parse(\n        await request(createSandbox, {\n          repository,\n          action: \"github:issues:read\",\n          method: \"GET\",\n          path: `/issues/${input.issueNumber}`,\n          authorize: input.authorize,\n        }),\n      );\n      return {\n        title: issue.title,\n        body: issue.body,\n        url: issue.html_url,\n        pullRequest: issue.pull_request !== undefined,\n      };\n    },\n    async createPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      const head = publicationBranchSchema.parse(input.head);\n      const base = publicationBaseBranchSchema.parse(input.base);\n      const title = publicationTitleSchema.parse(input.title);\n      const body = publicationBodySchema.parse(input.body);\n      const pull = pullRequestSchema.parse(\n        await request(createSandbox, {\n          repository,\n          action: \"github:pull-request:create\",\n          method: \"POST\",\n          path: \"/pulls\",\n          body: {\n            title,\n            body,\n            head,\n            base,\n            draft: input.draft,\n          },\n          authorize: input.authorize,\n        }),\n      );\n      return {\n        pullRequestNumber: pull.number,\n        pullRequestUrl: pull.html_url,\n        draft: pull.draft,\n      };\n    },\n    async publishPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!options.commitIdentity) throw new Error(\"Managed publication requires commit identity\");\n      if (!/^[a-f0-9]{40}$/u.test(input.baseCommit) || input.commitMessage.trim() === \"\") {\n        throw new Error(\"Invalid managed GitHub publication\");\n      }\n      const publicationTree = publicationTreeSchema.parse(input.tree);\n      const branch = publicationBranchSchema.parse(input.branch);\n      const baseBranch = publicationBaseBranchSchema.parse(input.baseBranch);\n      const title = publicationTitleSchema.parse(input.title);\n      const body = publicationBodySchema.parse(input.body);\n      const commitMessage = publicationCommitMessageSchema.parse(\n        `${input.commitMessage}\\n\\nCo-authored-by: ${options.commitIdentity.name} <${options.commitIdentity.email}>`,\n      );\n      const sandbox = await createSandbox(\n        createPublicationInput(repository, options.commitIdentity),\n      );\n      try {\n        const authorizedRequest = async (\n          request: Omit<Parameters<typeof sandboxRequest>[1], \"repository\">,\n        ) => {\n          await input.authorize();\n          return sandboxRequest(sandbox, { repository, ...request });\n        };\n        const base = commitSchema.parse(\n          await authorizedRequest({\n            method: \"GET\",\n            path: `/git/commits/${input.baseCommit}`,\n          }),\n        );\n        const tree = treeSchema.parse(\n          await authorizedRequest({\n            method: \"POST\",\n            path: \"/git/trees\",\n            body: { base_tree: base.tree.sha, tree: publicationTree },\n          }),\n        );\n        const pullPath = `/pulls?${new URLSearchParams({\n          state: \"all\",\n          head: `${repository.split(\"/\")[0]}:${branch}`,\n          per_page: \"100\",\n        })}`;\n        const pulls = async () =>\n          z\n            .array(publicationPullSchema)\n            .parse(await authorizedRequest({ method: \"GET\", path: pullPath }));\n        const result = (pull: z.infer<typeof pullRequestSchema>, commitSha: string) => ({\n          commitSha,\n          pullRequestNumber: pull.number,\n          pullRequestUrl: pull.html_url,\n          draft: pull.draft,\n        });\n        const refPath = `/git/ref/heads/${branch.split(\"/\").map(encodeURIComponent).join(\"/\")}`;\n        let existingRef: z.infer<typeof refSchema> | null;\n        try {\n          existingRef = refSchema.parse(await authorizedRequest({ method: \"GET\", path: refPath }));\n        } catch (error) {\n          if (!(error instanceof VercelManagedGitHubApiError) || error.status !== 404) throw error;\n          existingRef = null;\n        }\n        let commitSha = existingRef?.object.sha;\n        if (commitSha) {\n          const existingPull = (await pulls()).find((pull) => pull.head.ref === branch);\n          if (existingPull) {\n            if (existingPull.state !== \"open\") {\n              throw new Error(\"Managed publication pull request is closed\");\n            }\n            const existingCommit = commitSchema.parse(\n              await authorizedRequest({\n                method: \"GET\",\n                path: `/git/commits/${existingPull.head.sha}`,\n              }),\n            );\n            if (\n              existingCommit.tree.sha !== tree.sha ||\n              existingCommit.parents.length !== 1 ||\n              existingCommit.parents[0]?.sha !== input.baseCommit\n            ) {\n              throw new Error(\"Managed publication pull request contains different changes\");\n            }\n            return result(existingPull, existingPull.head.sha);\n          }\n          const existingCommit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"GET\",\n              path: `/git/commits/${commitSha}`,\n            }),\n          );\n          if (\n            existingCommit.tree.sha !== tree.sha ||\n            existingCommit.parents.length !== 1 ||\n            existingCommit.parents[0]?.sha !== input.baseCommit\n          ) {\n            throw new Error(\"Managed publication branch contains different changes\");\n          }\n        } else {\n          const commit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/git/commits\",\n              body: {\n                message: commitMessage,\n                tree: tree.sha,\n                parents: [input.baseCommit],\n              },\n            }),\n          );\n          commitSha = commit.sha;\n          try {\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/git/refs\",\n              body: { ref: `refs/heads/${branch}`, sha: commitSha },\n            });\n          } catch (error) {\n            const reconciled = refSchema.parse(\n              await authorizedRequest({ method: \"GET\", path: refPath }),\n            );\n            if (reconciled.object.sha !== commitSha) throw error;\n          }\n        }\n        let pull: z.infer<typeof pullRequestSchema>;\n        try {\n          pull = pullRequestSchema.parse(\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/pulls\",\n              body: {\n                title,\n                body,\n                head: branch,\n                base: baseBranch,\n                draft: input.draft,\n              },\n            }),\n          );\n        } catch (error) {\n          const reconciled = (await pulls()).find((candidate) => candidate.head.ref === branch);\n          if (!reconciled || reconciled.state !== \"open\" || reconciled.head.sha !== commitSha) {\n            throw error;\n          }\n          pull = reconciled;\n        }\n        return result(pull, commitSha);\n      } finally {\n        await sandbox.stop();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AA6GA,IAAa,8BAAb,cAAiD,MAAM;CAE1C;CADX,YACE,QACA,SACA;EACA,MAAM,8BAA8B,OAAO,KAAK,SAAS;EAHhD,KAAA,SAAA;EAIT,KAAK,OAAO;CACd;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;CACrC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG;CACzC,MAAM,EAAE,QAAQ;AAClB,CAAC;AACD,MAAM,cAAc,EAAE,OAAO;CAC3B,OAAO,EAAE,OAAO;CAChB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,IAAI;CAChB,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;AACD,MAAM,oBAAoB,EAAE,OAAO;CACjC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,IAAI;CAChB,OAAO,EAAE,QAAQ;AACnB,CAAC;AACD,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,iBAAiB;AACpD,MAAM,eAAe,EAAE,OAAO;CAC5B,KAAK;CACL,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;CACjC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC;AAC/C,CAAC;AACD,MAAM,aAAa,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;AAC9C,MAAM,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC;AACnE,MAAM,wBAAwB,kBAAkB,OAAO;CACrD,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;CAChC,MAAM,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,KAAK;CAAU,CAAC;AACpD,CAAC;AACD,MAAM,wBAAwB,EAC3B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAK,CAAC,CACV,QAAQ,SAAS,OAAO,WAAW,MAAM,MAAM,KAAK,MAAO,EAC1D,SAAS,8CACX,CAAC,CAAC,CACD,QACE,SACC,kCAAkC,KAAK,IAAI,KAC3C,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,GAAG,GAC9C,EAAE,SAAS,mCAAmC,CAChD;AACF,MAAM,0BAA0B,EAC7B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QACE,WACC,aAAa,MAAM,KACnB,OACG,MAAM,GAAG,CAAC,CACV,OACE,cACC,UAAU,SAAS,KACnB,CAAC,UAAU,WAAW,GAAG,KACzB,CAAC,UAAU,SAAS,GAAG,KACvB,CAAC,UAAU,SAAS,OAAO,CAC/B,GACJ,EAAE,SAAS,qCAAqC,CAClD;AACF,MAAM,yBAAyB,SAAiB,UAC9C,EACG,OAAO,CAAC,CACR,IAAI,OAAO,CAAC,CACZ,QAAQ,UAAU,OAAO,WAAW,OAAO,MAAM,KAAK,SAAS,EAC9D,SAAS,uBAAuB,MAAM,qBACxC,CAAC;AACL,MAAM,iCAAiC,sBAAsB,OAAQ,gBAAgB,CAAC,CAAC,IAAI,CAAC;AAC5F,MAAM,yBAAyB,sBAAsB,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC;AACxE,MAAM,wBAAwB,sBAAsB,OAAQ,MAAM;AAClE,MAAM,8BAA8B,EACjC,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QAAQ,WAAW,aAAa,MAAM,GAAG,EACxC,SAAS,0CACX,CAAC;AACH,MAAM,2BAA2B,EAC9B,OAAO,CAAC,CACR,IAAI,GAAO,CAAC,CACZ,QAAQ,YAAY,OAAO,WAAW,SAAS,MAAM,KAAK,KAAS,EAClE,SAAS,iDACX,CAAC;AACH,MAAM,wBAAwB,EAC3B,MACC,EAAE,MAAM,CACN,EAAE,aAAa;CACb,MAAM;CACN,MAAM,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACjC,MAAM,EAAE,QAAQ,MAAM;CACtB,SAAS;AACX,CAAC,GACD,EAAE,aAAa;CACb,MAAM;CACN,MAAM,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACjC,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK,EAAE,KAAK;AACd,CAAC,CACH,CAAC,CACH,CAAC,CACA,IAAI,CAAC,CAAC,CACN,IAAI,EAAE,CAAC,CACP,QACE,YACC,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,KAC5E,iDACF;AACF,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoC5B,eAAe,qBACb,OACkC;CAClC,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,OAAO,QAAQ,OAAO,EAAE,GAAG,MAAM,CAAC;AACpC;AAEA,SAAS,YACP,YACA,QAC0C;CAC1C,OAAO;EACL,eAAe,EAAE,QAAQ,CAAC;GAAE,cAAc,CAAC,UAAU;GAAG,SAAS,CAAC,MAAM;EAAE,CAAC,EAAE;EAC7E,eAAe,EAAE,OAAO,CAAC,gBAAgB,EAAE;EAC3C,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;AACF;AAEA,SAAS,uBACP,YACA,gBAC0C;CAC1C,OAAO;EACL,QAAQ;GAAE,MAAM;GAAO,KAAK,sBAAsB,WAAW;EAAM;EACnE,sBAAsB;EACtB,YAAY;EACZ,eAAe,EACb,QAAQ,CACN;GACE,cAAc,CAAC,UAAU;GACzB,SAAS,CAAC,4BAA4B;EACxC,CACF,EACF;EACA,eAAe,EAAE,OAAO,CAAC,cAAc,gBAAgB,EAAE;EACzD,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;AACF;AAEA,eAAe,QACb,eAGA,OAQkB;CAClB,MAAM,UAAU,MAAM,cAAc,YAAY,MAAM,YAAY,MAAM,MAAM,CAAC;CAC/E,IAAI;EACF,MAAM,MAAM,UAAU;EACtB,MAAM,SAAS,MAAM,QAAQ,WAAW;GACtC,KAAK;GACL,MAAM;IACJ;IACA;IACA;IACA,KAAK,UAAU;KACb,QAAQ,MAAM;KACd,KAAK,gCAAgC,MAAM,aAAa,MAAM;KAC9D,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;IACzD,CAAC;GACH;GACA,WAAW;EACb,CAAC;EACD,MAAM,UAAU,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;EAC5C,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,wCAAwC,OAAO,SAAS,KAAK,QAAQ;EAEvF,MAAM,WAAW,sBAAsB,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC;EACvF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;GACnD,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,SAAS,IAAI;GACzE,MAAM,IAAI,4BACR,SAAS,QACT,QAAQ,UAAU,QAAQ,KAAK,UAAU,qBAC3C;EACF;EACA,OAAO,SAAS;CAClB,UAAU;EACR,MAAM,QAAQ,KAAK;CACrB;AACF;AAEA,eAAe,eACb,SACA,OAMkB;CAClB,MAAM,SAAS,MAAM,QAAQ,WAAW;EACtC,KAAK;EACL,MAAM;GACJ;GACA;GACA;GACA,KAAK,UAAU;IACb,QAAQ,MAAM;IACd,KAAK,gCAAgC,MAAM,aAAa,MAAM;IAC9D,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;GACzD,CAAC;EACH;EACA,WAAW;CACb,CAAC;CACD,MAAM,UAAU,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;CAC5C,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,wCAAwC,OAAO,SAAS,KAAK,QAAQ;CAEvF,MAAM,WAAW,sBAAsB,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC;CACvF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;EACnD,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,SAAS,IAAI;EACzE,MAAM,IAAI,4BACR,SAAS,QACT,QAAQ,UAAU,QAAQ,KAAK,UAAU,qBAC3C;CACF;CACA,OAAO,SAAS;AAClB;;AAGA,SAAgB,6BACd,UAAyC,CAAC,GAClB;CACxB,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,OAAO;EACL,MAAM,UAAU,OAAO;GACrB,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,cAAc,GAClE,MAAM,IAAI,MAAM,6BAA6B;GAE/C,MAAM,QAAQ,YAAY,MACxB,MAAM,QAAQ,eAAe;IAC3B;IACA,QAAQ;IACR,QAAQ;IACR,MAAM,WAAW,MAAM;IACvB,WAAW,MAAM;GACnB,CAAC,CACH;GACA,OAAO;IACL,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,KAAK,MAAM;IACX,aAAa,MAAM,iBAAiB,KAAA;GACtC;EACF;EACA,MAAM,kBAAkB,OAAO;GAC7B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,MAAM,OAAO,wBAAwB,MAAM,MAAM,IAAI;GACrD,MAAM,OAAO,4BAA4B,MAAM,MAAM,IAAI;GACzD,MAAM,QAAQ,uBAAuB,MAAM,MAAM,KAAK;GACtD,MAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI;GACnD,MAAM,OAAO,kBAAkB,MAC7B,MAAM,QAAQ,eAAe;IAC3B;IACA,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;KACJ;KACA;KACA;KACA;KACA,OAAO,MAAM;IACf;IACA,WAAW,MAAM;GACnB,CAAC,CACH;GACA,OAAO;IACL,mBAAmB,KAAK;IACxB,gBAAgB,KAAK;IACrB,OAAO,KAAK;GACd;EACF;EACA,MAAM,mBAAmB,OAAO;GAC9B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,QAAQ,gBAAgB,MAAM,IAAI,MAAM,8CAA8C;GAC3F,IAAI,CAAC,kBAAkB,KAAK,MAAM,UAAU,KAAK,MAAM,cAAc,KAAK,MAAM,IAC9E,MAAM,IAAI,MAAM,oCAAoC;GAEtD,MAAM,kBAAkB,sBAAsB,MAAM,MAAM,IAAI;GAC9D,MAAM,SAAS,wBAAwB,MAAM,MAAM,MAAM;GACzD,MAAM,aAAa,4BAA4B,MAAM,MAAM,UAAU;GACrE,MAAM,QAAQ,uBAAuB,MAAM,MAAM,KAAK;GACtD,MAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI;GACnD,MAAM,gBAAgB,+BAA+B,MACnD,GAAG,MAAM,cAAc,sBAAsB,QAAQ,eAAe,KAAK,IAAI,QAAQ,eAAe,MAAM,EAC5G;GACA,MAAM,UAAU,MAAM,cACpB,uBAAuB,YAAY,QAAQ,cAAc,CAC3D;GACA,IAAI;IACF,MAAM,oBAAoB,OACxB,YACG;KACH,MAAM,MAAM,UAAU;KACtB,OAAO,eAAe,SAAS;MAAE;MAAY,GAAG;KAAQ,CAAC;IAC3D;IACA,MAAM,OAAO,aAAa,MACxB,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM,gBAAgB,MAAM;IAC9B,CAAC,CACH;IACA,MAAM,OAAO,WAAW,MACtB,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM;KACN,MAAM;MAAE,WAAW,KAAK,KAAK;MAAK,MAAM;KAAgB;IAC1D,CAAC,CACH;IACA,MAAM,WAAW,UAAU,IAAI,gBAAgB;KAC7C,OAAO;KACP,MAAM,GAAG,WAAW,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG;KACrC,UAAU;IACZ,CAAC;IACD,MAAM,QAAQ,YACZ,EACG,MAAM,qBAAqB,CAAC,CAC5B,MAAM,MAAM,kBAAkB;KAAE,QAAQ;KAAO,MAAM;IAAS,CAAC,CAAC;IACrE,MAAM,UAAU,MAAyC,eAAuB;KAC9E;KACA,mBAAmB,KAAK;KACxB,gBAAgB,KAAK;KACrB,OAAO,KAAK;IACd;IACA,MAAM,UAAU,kBAAkB,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;IACpF,IAAI;IACJ,IAAI;KACF,cAAc,UAAU,MAAM,MAAM,kBAAkB;MAAE,QAAQ;MAAO,MAAM;KAAQ,CAAC,CAAC;IACzF,SAAS,OAAO;KACd,IAAI,EAAE,iBAAiB,gCAAgC,MAAM,WAAW,KAAK,MAAM;KACnF,cAAc;IAChB;IACA,IAAI,YAAY,aAAa,OAAO;IACpC,IAAI,WAAW;KACb,MAAM,gBAAgB,MAAM,MAAM,EAAA,CAAG,MAAM,SAAS,KAAK,KAAK,QAAQ,MAAM;KAC5E,IAAI,cAAc;MAChB,IAAI,aAAa,UAAU,QACzB,MAAM,IAAI,MAAM,4CAA4C;MAE9D,MAAM,iBAAiB,aAAa,MAClC,MAAM,kBAAkB;OACtB,QAAQ;OACR,MAAM,gBAAgB,aAAa,KAAK;MAC1C,CAAC,CACH;MACA,IACE,eAAe,KAAK,QAAQ,KAAK,OACjC,eAAe,QAAQ,WAAW,KAClC,eAAe,QAAQ,EAAE,EAAE,QAAQ,MAAM,YAEzC,MAAM,IAAI,MAAM,6DAA6D;MAE/E,OAAO,OAAO,cAAc,aAAa,KAAK,GAAG;KACnD;KACA,MAAM,iBAAiB,aAAa,MAClC,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM,gBAAgB;KACxB,CAAC,CACH;KACA,IACE,eAAe,KAAK,QAAQ,KAAK,OACjC,eAAe,QAAQ,WAAW,KAClC,eAAe,QAAQ,EAAE,EAAE,QAAQ,MAAM,YAEzC,MAAM,IAAI,MAAM,uDAAuD;IAE3E,OAAO;KAYL,YAXe,aAAa,MAC1B,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM;MACN,MAAM;OACJ,SAAS;OACT,MAAM,KAAK;OACX,SAAS,CAAC,MAAM,UAAU;MAC5B;KACF,CAAC,CAEc,CAAC,CAAC;KACnB,IAAI;MACF,MAAM,kBAAkB;OACtB,QAAQ;OACR,MAAM;OACN,MAAM;QAAE,KAAK,cAAc;QAAU,KAAK;OAAU;MACtD,CAAC;KACH,SAAS,OAAO;MAId,IAHmB,UAAU,MAC3B,MAAM,kBAAkB;OAAE,QAAQ;OAAO,MAAM;MAAQ,CAAC,CAE7C,CAAC,CAAC,OAAO,QAAQ,WAAW,MAAM;KACjD;IACF;IACA,IAAI;IACJ,IAAI;KACF,OAAO,kBAAkB,MACvB,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM;MACN,MAAM;OACJ;OACA;OACA,MAAM;OACN,MAAM;OACN,OAAO,MAAM;MACf;KACF,CAAC,CACH;IACF,SAAS,OAAO;KACd,MAAM,cAAc,MAAM,MAAM,EAAA,CAAG,MAAM,cAAc,UAAU,KAAK,QAAQ,MAAM;KACpF,IAAI,CAAC,cAAc,WAAW,UAAU,UAAU,WAAW,KAAK,QAAQ,WACxE,MAAM;KAER,OAAO;IACT;IACA,OAAO,OAAO,MAAM,SAAS;GAC/B,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;CACF;AACF"}

package/dist/vercel.d.mts

@@ -1,4 +1,33 @@
+import { RepositorySlug } from "./schema/repository.mjs";
+import { WorkNotification, WorkNotifications } from "./store/work-notifications.mjs";
+import { VercelManagedGitHubApi, VercelManagedGitHubApiAction, VercelManagedGitHubApiError, VercelManagedGitHubApiOptions, VercelManagedGitHubApiSandboxCreateInput, VercelManagedGitHubIssue, VercelManagedGitHubIssueInput, VercelManagedGitHubPublication, VercelManagedGitHubPublicationInput, VercelManagedGitHubPullRequest, VercelManagedGitHubPullRequestInput, createVercelManagedGitHubApi } from "./vercel-github-api.mjs";
+import { VercelGitHubGitTransportOptions, VercelGitHubTokenInput, VercelManagedGitHubGitTransportOptions, VercelManagedGitHubSandboxCreateInput, createVercelGitHubGitTransport, createVercelManagedGitHubGitTransport } from "./vercel-git.mjs";
 //#region src/vercel.d.ts
+/** Provider delivery settings applied to one Vercel Queue message. */
+interface VercelQueueSendOptions {
+  region: string;
+  retentionSeconds: number;
+  idempotencyKey: string;
+  delaySeconds: number;
+}
+/** Injectable Vercel Queue send operation for one validated Factory work notification. */
+type VercelQueueSend = (topic: string, message: WorkNotification, options: VercelQueueSendOptions) => Promise<unknown>;
+/** Configures Vercel Queue transport, failure reporting, retention, and runtime guards. */
+interface VercelWorkQueueOptions {
+  send: VercelQueueSend;
+  onError(error: unknown, event: WorkNotification): void;
+  topic?: string;
+  region?: string;
+  retentionSeconds?: number;
+  environment?: Readonly<Record<string, string | undefined>>;
+}
+/** Publishes graph wakeups and exposes the hosted-runtime notification adapter. */
+interface VercelWorkQueue {
+  publish(event: WorkNotification, delaySeconds?: number): Promise<void>;
+  hostedNotifications(): WorkNotifications | undefined;
+}
+/** Configure graph wakeups over Vercel Queues without granting queue messages execution authority. */
+declare function createVercelWorkQueue(options: VercelWorkQueueOptions): VercelWorkQueue;
 /**
  * Verify a Vercel webhook signature (the x-vercel-signature header): an
  * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or
@@ -9,6 +38,7 @@ declare function verifyVercelSignature(options: {
   payload: string;
   signature: string | null;
 }): boolean;
+/** A normalized production deployment observation with optional Git commit identity. */
 interface VercelProductionDeployment {
   source: "vercel_production_deployment";
   deliveryId: string;
@@ -17,7 +47,7 @@ interface VercelProductionDeployment {
   deploymentUrl: string;
   projectId: string;
   /** owner/name from the deployment's git metadata; null for non-git deployments. */
-  repositorySlug: string | null;
+  repositorySlug: RepositorySlug | null;
   /** Commit the deployment was built from; null for non-git deployments. */
   commitSha: string | null;
 }
@@ -27,6 +57,8 @@ interface VercelProductionDeployment {
  * production. Returns null for other events and non-production targets.
  */
 declare function normalizeVercelProductionDeployment(payload: unknown): VercelProductionDeployment | null;
+/** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */
+declare function authenticateVercelUserToken(request: Request, fetcher?: typeof fetch): Promise<string | null>;
 //#endregion
-export { VercelProductionDeployment, normalizeVercelProductionDeployment, verifyVercelSignature };
+export { type VercelGitHubGitTransportOptions, type VercelGitHubTokenInput, type VercelManagedGitHubApi, type VercelManagedGitHubApiAction, VercelManagedGitHubApiError, type VercelManagedGitHubApiOptions, type VercelManagedGitHubApiSandboxCreateInput, type VercelManagedGitHubGitTransportOptions, type VercelManagedGitHubIssue, type VercelManagedGitHubIssueInput, type VercelManagedGitHubPublication, type VercelManagedGitHubPublicationInput, type VercelManagedGitHubPullRequest, type VercelManagedGitHubPullRequestInput, type VercelManagedGitHubSandboxCreateInput, VercelProductionDeployment, VercelQueueSend, VercelQueueSendOptions, VercelWorkQueue, VercelWorkQueueOptions, authenticateVercelUserToken, createVercelGitHubGitTransport, createVercelManagedGitHubApi, createVercelManagedGitHubGitTransport, createVercelWorkQueue, normalizeVercelProductionDeployment, verifyVercelSignature };
 //# sourceMappingURL=vercel.d.mts.map

package/dist/vercel.mjs

@@ -1,6 +1,36 @@
-import { z } from "zod";
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { workNotificationSchema } from "./store/work-notifications.mjs";
+import { VercelManagedGitHubApiError, createVercelManagedGitHubApi } from "./vercel-github-api.mjs";
+import { createVercelGitHubGitTransport, createVercelManagedGitHubGitTransport } from "./vercel-git.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
 //#region src/vercel.ts
+/** Configure graph wakeups over Vercel Queues without granting queue messages execution authority. */
+function createVercelWorkQueue(options) {
+	const environment = options.environment ?? process.env;
+	const topic = options.topic ?? "factory-work";
+	const region = options.region ?? "iad1";
+	const retentionSeconds = options.retentionSeconds ?? 604800;
+	const hosted = () => environment.VERCEL === "1" && environment.FACTORY_LOCAL_TEST !== "1";
+	const publish = async (event, delaySeconds = 0) => {
+		if (!hosted()) throw new Error("Vercel work queues require a hosted, non-fixture runtime");
+		const message = workNotificationSchema.parse(event);
+		await options.send(topic, message, {
+			region,
+			retentionSeconds,
+			idempotencyKey: message.key,
+			delaySeconds
+		});
+	};
+	const notifications = {
+		publish,
+		onError: options.onError
+	};
+	return Object.freeze({
+		publish,
+		hostedNotifications: () => hosted() ? notifications : void 0
+	});
+}
 /**
 * Verify a Vercel webhook signature (the x-vercel-signature header): an
 * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or
@@ -45,6 +75,7 @@ function normalizeVercelProductionDeployment(payload) {
 	const meta = event.deployment.meta;
 	const org = meta?.githubCommitOrg ?? meta?.githubOrg;
 	const repo = meta?.githubCommitRepo ?? meta?.githubRepo;
+	const repositorySlug = org === void 0 || repo === void 0 ? null : repositorySlugSchema.safeParse(`${org}/${repo}`.toLowerCase()).data ?? null;
 	return {
 		source: "vercel_production_deployment",
 		deliveryId: parsed.data.id,
@@ -52,11 +83,26 @@ function normalizeVercelProductionDeployment(payload) {
 		deploymentId: event.deployment.id,
 		deploymentUrl: event.deployment.url,
 		projectId: event.project.id,
-		repositorySlug: org !== void 0 && repo !== void 0 ? `${org}/${repo}`.toLowerCase() : null,
+		repositorySlug,
 		commitSha: meta?.githubCommitSha ?? null
 	};
 }
+/** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */
+async function authenticateVercelUserToken(request, fetcher = fetch) {
+	const authorization = request.headers.get("authorization");
+	if (!authorization?.match(/^Bearer \S+$/u)) return null;
+	const response = await fetcher("https://api.vercel.com/v2/user", {
+		headers: { authorization },
+		cache: "no-store",
+		redirect: "error",
+		signal: AbortSignal.timeout(1e4)
+	});
+	if (response.status === 401 || response.status === 403) return null;
+	if (!response.ok) throw new Error(`Vercel identity lookup failed (${response.status})`);
+	const result = z.object({ user: z.object({ id: z.string().min(1) }) }).safeParse(await response.json());
+	return result.success ? `vercel:${result.data.user.id}` : null;
+}
 //#endregion
-export { normalizeVercelProductionDeployment, verifyVercelSignature };
+export { VercelManagedGitHubApiError, authenticateVercelUserToken, createVercelGitHubGitTransport, createVercelManagedGitHubApi, createVercelManagedGitHubGitTransport, createVercelWorkQueue, normalizeVercelProductionDeployment, verifyVercelSignature };
 
 //# sourceMappingURL=vercel.mjs.map

package/dist/vercel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.mjs","names":[],"sources":["../src/vercel.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * Verify a Vercel webhook signature (the x-vercel-signature header): an\n * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or\n * malformed signatures instead of throwing.\n */\nexport function verifyVercelSignature(options: {\n  secret: string;\n  payload: string;\n  signature: string | null;\n}): boolean {\n  const { secret, payload, signature } = options;\n  if (signature === null || !/^[0-9a-f]{40}$/.test(signature)) {\n    return false;\n  }\n  const expected = createHmac(\"sha1\", secret).update(payload).digest(\"hex\");\n  return timingSafeEqual(Buffer.from(signature, \"hex\"), Buffer.from(expected, \"hex\"));\n}\n\nconst observedDeploymentEvents = new Set([\"deployment.succeeded\", \"deployment.promoted\"]);\n\nconst deploymentEventSchema = z.looseObject({\n  id: z.string().min(1),\n  type: z.string(),\n  payload: z.looseObject({\n    target: z.string().nullable().optional(),\n    project: z.looseObject({ id: z.string().min(1) }),\n    deployment: z.looseObject({\n      id: z.string().min(1),\n      url: z.string().min(1),\n      meta: z\n        .looseObject({\n          githubCommitSha: z.string().optional(),\n          githubCommitOrg: z.string().optional(),\n          githubCommitRepo: z.string().optional(),\n          githubOrg: z.string().optional(),\n          githubRepo: z.string().optional(),\n        })\n        .optional(),\n    }),\n  }),\n});\n\nexport interface VercelProductionDeployment {\n  source: \"vercel_production_deployment\";\n  deliveryId: string;\n  eventType: string;\n  deploymentId: string;\n  deploymentUrl: string;\n  projectId: string;\n  /** owner/name from the deployment's git metadata; null for non-git deployments. */\n  repositorySlug: string | null;\n  /** Commit the deployment was built from; null for non-git deployments. */\n  commitSha: string | null;\n}\n\n/**\n * Normalize a deployment.succeeded or deployment.promoted webhook for a\n * production deployment so the factory can observe a merge reaching\n * production. Returns null for other events and non-production targets.\n */\nexport function normalizeVercelProductionDeployment(\n  payload: unknown,\n): VercelProductionDeployment | null {\n  const parsed = deploymentEventSchema.safeParse(payload);\n  if (!parsed.success || !observedDeploymentEvents.has(parsed.data.type)) {\n    return null;\n  }\n  const event = parsed.data.payload;\n  if (event.target !== \"production\") {\n    return null;\n  }\n  const meta = event.deployment.meta;\n  const org = meta?.githubCommitOrg ?? meta?.githubOrg;\n  const repo = meta?.githubCommitRepo ?? meta?.githubRepo;\n  return {\n    source: \"vercel_production_deployment\",\n    deliveryId: parsed.data.id,\n    eventType: parsed.data.type,\n    deploymentId: event.deployment.id,\n    deploymentUrl: event.deployment.url,\n    projectId: event.project.id,\n    repositorySlug:\n      org !== undefined && repo !== undefined ? `${org}/${repo}`.toLowerCase() : null,\n    commitSha: meta?.githubCommitSha ?? null,\n  };\n}\n"],"mappings":";;;;;;;;AAQA,SAAgB,sBAAsB,SAI1B;CACV,MAAM,EAAE,QAAQ,SAAS,cAAc;CACvC,IAAI,cAAc,QAAQ,CAAC,iBAAiB,KAAK,SAAS,GACxD,OAAO;CAET,MAAM,WAAW,WAAW,QAAQ,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CACxE,OAAO,gBAAgB,OAAO,KAAK,WAAW,KAAK,GAAG,OAAO,KAAK,UAAU,KAAK,CAAC;AACpF;AAEA,MAAM,2CAA2B,IAAI,IAAI,CAAC,wBAAwB,qBAAqB,CAAC;AAExF,MAAM,wBAAwB,EAAE,YAAY;CAC1C,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,YAAY;EACrB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACvC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;EAChD,YAAY,EAAE,YAAY;GACxB,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACrB,MAAM,EACH,YAAY;IACX,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;IACtC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;IAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;GAClC,CAAC,CAAC,CACD,SAAS;EACd,CAAC;CACH,CAAC;AACH,CAAC;;;;;;AAoBD,SAAgB,oCACd,SACmC;CACnC,MAAM,SAAS,sBAAsB,UAAU,OAAO;CACtD,IAAI,CAAC,OAAO,WAAW,CAAC,yBAAyB,IAAI,OAAO,KAAK,IAAI,GACnE,OAAO;CAET,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,WAAW,cACnB,OAAO;CAET,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,MAAM,MAAM,mBAAmB,MAAM;CAC3C,MAAM,OAAO,MAAM,oBAAoB,MAAM;CAC7C,OAAO;EACL,QAAQ;EACR,YAAY,OAAO,KAAK;EACxB,WAAW,OAAO,KAAK;EACvB,cAAc,MAAM,WAAW;EAC/B,eAAe,MAAM,WAAW;EAChC,WAAW,MAAM,QAAQ;EACzB,gBACE,QAAQ,KAAA,KAAa,SAAS,KAAA,IAAY,GAAG,IAAI,GAAG,OAAO,YAAY,IAAI;EAC7E,WAAW,MAAM,mBAAmB;CACtC;AACF"}
+{"version":3,"file":"vercel.mjs","names":[],"sources":["../src/vercel.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport {\n  workNotificationSchema,\n  type WorkNotification,\n  type WorkNotifications,\n} from \"./store/work-notifications\";\n\n/** Provider delivery settings applied to one Vercel Queue message. */\nexport interface VercelQueueSendOptions {\n  region: string;\n  retentionSeconds: number;\n  idempotencyKey: string;\n  delaySeconds: number;\n}\n\n/** Injectable Vercel Queue send operation for one validated Factory work notification. */\nexport type VercelQueueSend = (\n  topic: string,\n  message: WorkNotification,\n  options: VercelQueueSendOptions,\n) => Promise<unknown>;\n\n/** Configures Vercel Queue transport, failure reporting, retention, and runtime guards. */\nexport interface VercelWorkQueueOptions {\n  send: VercelQueueSend;\n  onError(error: unknown, event: WorkNotification): void;\n  topic?: string;\n  region?: string;\n  retentionSeconds?: number;\n  environment?: Readonly<Record<string, string | undefined>>;\n}\n\n/** Publishes graph wakeups and exposes the hosted-runtime notification adapter. */\nexport interface VercelWorkQueue {\n  publish(event: WorkNotification, delaySeconds?: number): Promise<void>;\n  hostedNotifications(): WorkNotifications | undefined;\n}\n\nexport {\n  createVercelManagedGitHubApi,\n  VercelManagedGitHubApiError,\n  type VercelManagedGitHubApi,\n  type VercelManagedGitHubApiAction,\n  type VercelManagedGitHubApiOptions,\n  type VercelManagedGitHubApiSandboxCreateInput,\n  type VercelManagedGitHubIssue,\n  type VercelManagedGitHubIssueInput,\n  type VercelManagedGitHubPullRequest,\n  type VercelManagedGitHubPullRequestInput,\n  type VercelManagedGitHubPublication,\n  type VercelManagedGitHubPublicationInput,\n} from \"./vercel-github-api\";\n\nexport {\n  createVercelGitHubGitTransport,\n  createVercelManagedGitHubGitTransport,\n  type VercelGitHubGitTransportOptions,\n  type VercelGitHubTokenInput,\n  type VercelManagedGitHubGitTransportOptions,\n  type VercelManagedGitHubSandboxCreateInput,\n} from \"./vercel-git\";\n\n/** Configure graph wakeups over Vercel Queues without granting queue messages execution authority. */\nexport function createVercelWorkQueue(options: VercelWorkQueueOptions): VercelWorkQueue {\n  const environment = options.environment ?? process.env;\n  const topic = options.topic ?? \"factory-work\";\n  const region = options.region ?? \"iad1\";\n  const retentionSeconds = options.retentionSeconds ?? 604_800;\n  const hosted = () => environment.VERCEL === \"1\" && environment.FACTORY_LOCAL_TEST !== \"1\";\n  const publish = async (event: WorkNotification, delaySeconds = 0): Promise<void> => {\n    if (!hosted()) throw new Error(\"Vercel work queues require a hosted, non-fixture runtime\");\n    const message = workNotificationSchema.parse(event);\n    await options.send(topic, message, {\n      region,\n      retentionSeconds,\n      idempotencyKey: message.key,\n      delaySeconds,\n    });\n  };\n  const notifications: WorkNotifications = { publish, onError: options.onError };\n  return Object.freeze({\n    publish,\n    hostedNotifications: () => (hosted() ? notifications : undefined),\n  });\n}\n\n/**\n * Verify a Vercel webhook signature (the x-vercel-signature header): an\n * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or\n * malformed signatures instead of throwing.\n */\nexport function verifyVercelSignature(options: {\n  secret: string;\n  payload: string;\n  signature: string | null;\n}): boolean {\n  const { secret, payload, signature } = options;\n  if (signature === null || !/^[0-9a-f]{40}$/.test(signature)) {\n    return false;\n  }\n  const expected = createHmac(\"sha1\", secret).update(payload).digest(\"hex\");\n  return timingSafeEqual(Buffer.from(signature, \"hex\"), Buffer.from(expected, \"hex\"));\n}\n\nconst observedDeploymentEvents = new Set([\"deployment.succeeded\", \"deployment.promoted\"]);\n\nconst deploymentEventSchema = z.looseObject({\n  id: z.string().min(1),\n  type: z.string(),\n  payload: z.looseObject({\n    target: z.string().nullable().optional(),\n    project: z.looseObject({ id: z.string().min(1) }),\n    deployment: z.looseObject({\n      id: z.string().min(1),\n      url: z.string().min(1),\n      meta: z\n        .looseObject({\n          githubCommitSha: z.string().optional(),\n          githubCommitOrg: z.string().optional(),\n          githubCommitRepo: z.string().optional(),\n          githubOrg: z.string().optional(),\n          githubRepo: z.string().optional(),\n        })\n        .optional(),\n    }),\n  }),\n});\n\n/** A normalized production deployment observation with optional Git commit identity. */\nexport interface VercelProductionDeployment {\n  source: \"vercel_production_deployment\";\n  deliveryId: string;\n  eventType: string;\n  deploymentId: string;\n  deploymentUrl: string;\n  projectId: string;\n  /** owner/name from the deployment's git metadata; null for non-git deployments. */\n  repositorySlug: RepositorySlug | null;\n  /** Commit the deployment was built from; null for non-git deployments. */\n  commitSha: string | null;\n}\n\n/**\n * Normalize a deployment.succeeded or deployment.promoted webhook for a\n * production deployment so the factory can observe a merge reaching\n * production. Returns null for other events and non-production targets.\n */\nexport function normalizeVercelProductionDeployment(\n  payload: unknown,\n): VercelProductionDeployment | null {\n  const parsed = deploymentEventSchema.safeParse(payload);\n  if (!parsed.success || !observedDeploymentEvents.has(parsed.data.type)) {\n    return null;\n  }\n  const event = parsed.data.payload;\n  if (event.target !== \"production\") {\n    return null;\n  }\n  const meta = event.deployment.meta;\n  const org = meta?.githubCommitOrg ?? meta?.githubOrg;\n  const repo = meta?.githubCommitRepo ?? meta?.githubRepo;\n  const repositorySlug =\n    org === undefined || repo === undefined\n      ? null\n      : (repositorySlugSchema.safeParse(`${org}/${repo}`.toLowerCase()).data ?? null);\n  return {\n    source: \"vercel_production_deployment\",\n    deliveryId: parsed.data.id,\n    eventType: parsed.data.type,\n    deploymentId: event.deployment.id,\n    deploymentUrl: event.deployment.url,\n    projectId: event.project.id,\n    repositorySlug,\n    commitSha: meta?.githubCommitSha ?? null,\n  };\n}\n\n/** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */\nexport async function authenticateVercelUserToken(\n  request: Request,\n  fetcher: typeof fetch = fetch,\n): Promise<string | null> {\n  const authorization = request.headers.get(\"authorization\");\n  if (!authorization?.match(/^Bearer \\S+$/u)) return null;\n  const response = await fetcher(\"https://api.vercel.com/v2/user\", {\n    headers: { authorization },\n    cache: \"no-store\",\n    redirect: \"error\",\n    signal: AbortSignal.timeout(10_000),\n  });\n  if (response.status === 401 || response.status === 403) return null;\n  if (!response.ok) throw new Error(`Vercel identity lookup failed (${response.status})`);\n  const result = z\n    .object({ user: z.object({ id: z.string().min(1) }) })\n    .safeParse(await response.json());\n  return result.success ? `vercel:${result.data.user.id}` : null;\n}\n"],"mappings":";;;;;;;;AAiEA,SAAgB,sBAAsB,SAAkD;CACtF,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,eAAe,YAAY,WAAW,OAAO,YAAY,uBAAuB;CACtF,MAAM,UAAU,OAAO,OAAyB,eAAe,MAAqB;EAClF,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,0DAA0D;EACzF,MAAM,UAAU,uBAAuB,MAAM,KAAK;EAClD,MAAM,QAAQ,KAAK,OAAO,SAAS;GACjC;GACA;GACA,gBAAgB,QAAQ;GACxB;EACF,CAAC;CACH;CACA,MAAM,gBAAmC;EAAE;EAAS,SAAS,QAAQ;CAAQ;CAC7E,OAAO,OAAO,OAAO;EACnB;EACA,2BAA4B,OAAO,IAAI,gBAAgB,KAAA;CACzD,CAAC;AACH;;;;;;AAOA,SAAgB,sBAAsB,SAI1B;CACV,MAAM,EAAE,QAAQ,SAAS,cAAc;CACvC,IAAI,cAAc,QAAQ,CAAC,iBAAiB,KAAK,SAAS,GACxD,OAAO;CAET,MAAM,WAAW,WAAW,QAAQ,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CACxE,OAAO,gBAAgB,OAAO,KAAK,WAAW,KAAK,GAAG,OAAO,KAAK,UAAU,KAAK,CAAC;AACpF;AAEA,MAAM,2CAA2B,IAAI,IAAI,CAAC,wBAAwB,qBAAqB,CAAC;AAExF,MAAM,wBAAwB,EAAE,YAAY;CAC1C,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,YAAY;EACrB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACvC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;EAChD,YAAY,EAAE,YAAY;GACxB,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACrB,MAAM,EACH,YAAY;IACX,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;IACtC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;IAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;GAClC,CAAC,CAAC,CACD,SAAS;EACd,CAAC;CACH,CAAC;AACH,CAAC;;;;;;AAqBD,SAAgB,oCACd,SACmC;CACnC,MAAM,SAAS,sBAAsB,UAAU,OAAO;CACtD,IAAI,CAAC,OAAO,WAAW,CAAC,yBAAyB,IAAI,OAAO,KAAK,IAAI,GACnE,OAAO;CAET,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,WAAW,cACnB,OAAO;CAET,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,MAAM,MAAM,mBAAmB,MAAM;CAC3C,MAAM,OAAO,MAAM,oBAAoB,MAAM;CAC7C,MAAM,iBACJ,QAAQ,KAAA,KAAa,SAAS,KAAA,IAC1B,OACC,qBAAqB,UAAU,GAAG,IAAI,GAAG,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ;CAC9E,OAAO;EACL,QAAQ;EACR,YAAY,OAAO,KAAK;EACxB,WAAW,OAAO,KAAK;EACvB,cAAc,MAAM,WAAW;EAC/B,eAAe,MAAM,WAAW;EAChC,WAAW,MAAM,QAAQ;EACzB;EACA,WAAW,MAAM,mBAAmB;CACtC;AACF;;AAGA,eAAsB,4BACpB,SACA,UAAwB,OACA;CACxB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;CACzD,IAAI,CAAC,eAAe,MAAM,eAAe,GAAG,OAAO;CACnD,MAAM,WAAW,MAAM,QAAQ,kCAAkC;EAC/D,SAAS,EAAE,cAAc;EACzB,OAAO;EACP,UAAU;EACV,QAAQ,YAAY,QAAQ,GAAM;CACpC,CAAC;CACD,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK,OAAO;CAC/D,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kCAAkC,SAAS,OAAO,EAAE;CACtF,MAAM,SAAS,EACZ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACrD,UAAU,MAAM,SAAS,KAAK,CAAC;CAClC,OAAO,OAAO,UAAU,UAAU,OAAO,KAAK,KAAK,OAAO;AAC5D"}

package/dist/work-triage/eve-tool.d.mts

@@ -0,0 +1,29 @@
+import { RepositoryId } from "../schema/id.mjs";
+import { FactoryStores } from "../store/engine.mjs";
+import { ExistingWorkLookupOptions, ExistingWorkLookupResult } from "./find-existing-work.mjs";
+import { ToolContext, ToolDefinition } from "eve/tools";
+//#region src/work-triage/eve-tool.d.ts
+/** Change, repository, and Task capabilities required by the existing-work tool. */
+type FindExistingWorkToolStores = Pick<FactoryStores, "changes" | "repositories" | "tasks">;
+/** Stores and provider lookup used to construct the existing-work tool. */
+interface FindExistingWorkToolOptions extends ExistingWorkLookupOptions {
+  stores: FindExistingWorkToolStores;
+}
+/** Repository selected for a read-only existing-work lookup. */
+interface FindExistingWorkToolInput {
+  repositoryId: RepositoryId;
+}
+/** Eve tool that checks a repository for overlapping open work. */
+interface FindExistingWorkTool extends ToolDefinition<FindExistingWorkToolInput, ExistingWorkLookupResult> {
+  execute(input: FindExistingWorkToolInput, ctx: ToolContext): Promise<ExistingWorkLookupResult>;
+}
+/**
+ * Read-only triage helper: before delegating new work or accepting a signal,
+ * check whether an open pull request, a recorded Change, or an in-flight
+ * Task already covers the same repository, so Foreman does not duplicate
+ * work that is already underway.
+ */
+declare function createFindExistingWorkTool(input: FindExistingWorkToolOptions): FindExistingWorkTool;
+//#endregion
+export { FindExistingWorkTool, FindExistingWorkToolInput, FindExistingWorkToolOptions, FindExistingWorkToolStores, createFindExistingWorkTool };
+//# sourceMappingURL=eve-tool.d.mts.map