@vercel/factory 0.0.15 → 0.0.16

package/dist/vercel.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.mjs","names":[],"sources":["../src/vercel.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport {\n  workNotificationSchema,\n  type WorkNotification,\n  type WorkNotifications,\n} from \"./store/work-notifications\";\n\n/** Provider delivery settings applied to one Vercel Queue message. */\nexport interface VercelQueueSendOptions {\n  region: string;\n  retentionSeconds: number;\n  idempotencyKey: string;\n  delaySeconds: number;\n}\n\n/** Injectable Vercel Queue send operation for one validated Factory work notification. */\nexport type VercelQueueSend = (\n  topic: string,\n  message: WorkNotification,\n  options: VercelQueueSendOptions,\n) => Promise<unknown>;\n\n/** Configures Vercel Queue transport, failure reporting, retention, and runtime guards. */\nexport interface VercelWorkQueueOptions {\n  send: VercelQueueSend;\n  onError(error: unknown, event: WorkNotification): void;\n  topic?: string;\n  region?: string;\n  retentionSeconds?: number;\n  environment?: Readonly<Record<string, string | undefined>>;\n}\n\n/** Publishes graph wakeups and exposes the hosted-runtime notification adapter. */\nexport interface VercelWorkQueue {\n  publish(event: WorkNotification, delaySeconds?: number): Promise<void>;\n  hostedNotifications(): WorkNotifications | undefined;\n}\n\nexport {\n  createVercelGitHubGitTransport,\n  type VercelGitHubGitTransportOptions,\n  type VercelGitHubTokenInput,\n} from \"./vercel-git\";\n\n/** Configure graph wakeups over Vercel Queues without granting queue messages execution authority. */\nexport function createVercelWorkQueue(options: VercelWorkQueueOptions): VercelWorkQueue {\n  const environment = options.environment ?? process.env;\n  const topic = options.topic ?? \"factory-work\";\n  const region = options.region ?? \"iad1\";\n  const retentionSeconds = options.retentionSeconds ?? 604_800;\n  const hosted = () => environment.VERCEL === \"1\" && environment.FACTORY_LOCAL_TEST !== \"1\";\n  const publish = async (event: WorkNotification, delaySeconds = 0): Promise<void> => {\n    if (!hosted()) throw new Error(\"Vercel work queues require a hosted, non-fixture runtime\");\n    const message = workNotificationSchema.parse(event);\n    await options.send(topic, message, {\n      region,\n      retentionSeconds,\n      idempotencyKey: message.key,\n      delaySeconds,\n    });\n  };\n  const notifications: WorkNotifications = { publish, onError: options.onError };\n  return Object.freeze({\n    publish,\n    hostedNotifications: () => (hosted() ? notifications : undefined),\n  });\n}\n\n/**\n * Verify a Vercel webhook signature (the x-vercel-signature header): an\n * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or\n * malformed signatures instead of throwing.\n */\nexport function verifyVercelSignature(options: {\n  secret: string;\n  payload: string;\n  signature: string | null;\n}): boolean {\n  const { secret, payload, signature } = options;\n  if (signature === null || !/^[0-9a-f]{40}$/.test(signature)) {\n    return false;\n  }\n  const expected = createHmac(\"sha1\", secret).update(payload).digest(\"hex\");\n  return timingSafeEqual(Buffer.from(signature, \"hex\"), Buffer.from(expected, \"hex\"));\n}\n\nconst observedDeploymentEvents = new Set([\"deployment.succeeded\", \"deployment.promoted\"]);\n\nconst deploymentEventSchema = z.looseObject({\n  id: z.string().min(1),\n  type: z.string(),\n  payload: z.looseObject({\n    target: z.string().nullable().optional(),\n    project: z.looseObject({ id: z.string().min(1) }),\n    deployment: z.looseObject({\n      id: z.string().min(1),\n      url: z.string().min(1),\n      meta: z\n        .looseObject({\n          githubCommitSha: z.string().optional(),\n          githubCommitOrg: z.string().optional(),\n          githubCommitRepo: z.string().optional(),\n          githubOrg: z.string().optional(),\n          githubRepo: z.string().optional(),\n        })\n        .optional(),\n    }),\n  }),\n});\n\n/** A normalized production deployment observation with optional Git commit identity. */\nexport interface VercelProductionDeployment {\n  source: \"vercel_production_deployment\";\n  deliveryId: string;\n  eventType: string;\n  deploymentId: string;\n  deploymentUrl: string;\n  projectId: string;\n  /** owner/name from the deployment's git metadata; null for non-git deployments. */\n  repositorySlug: RepositorySlug | null;\n  /** Commit the deployment was built from; null for non-git deployments. */\n  commitSha: string | null;\n}\n\n/**\n * Normalize a deployment.succeeded or deployment.promoted webhook for a\n * production deployment so the factory can observe a merge reaching\n * production. Returns null for other events and non-production targets.\n */\nexport function normalizeVercelProductionDeployment(\n  payload: unknown,\n): VercelProductionDeployment | null {\n  const parsed = deploymentEventSchema.safeParse(payload);\n  if (!parsed.success || !observedDeploymentEvents.has(parsed.data.type)) {\n    return null;\n  }\n  const event = parsed.data.payload;\n  if (event.target !== \"production\") {\n    return null;\n  }\n  const meta = event.deployment.meta;\n  const org = meta?.githubCommitOrg ?? meta?.githubOrg;\n  const repo = meta?.githubCommitRepo ?? meta?.githubRepo;\n  const repositorySlug =\n    org === undefined || repo === undefined\n      ? null\n      : (repositorySlugSchema.safeParse(`${org}/${repo}`.toLowerCase()).data ?? null);\n  return {\n    source: \"vercel_production_deployment\",\n    deliveryId: parsed.data.id,\n    eventType: parsed.data.type,\n    deploymentId: event.deployment.id,\n    deploymentUrl: event.deployment.url,\n    projectId: event.project.id,\n    repositorySlug,\n    commitSha: meta?.githubCommitSha ?? null,\n  };\n}\n\n/** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */\nexport async function authenticateVercelUserToken(\n  request: Request,\n  fetcher: typeof fetch = fetch,\n): Promise<string | null> {\n  const authorization = request.headers.get(\"authorization\");\n  if (!authorization?.match(/^Bearer \\S+$/u)) return null;\n  const response = await fetcher(\"https://api.vercel.com/v2/user\", {\n    headers: { authorization },\n    cache: \"no-store\",\n    redirect: \"error\",\n    signal: AbortSignal.timeout(10_000),\n  });\n  if (response.status === 401 || response.status === 403) return null;\n  if (!response.ok) throw new Error(`Vercel identity lookup failed (${response.status})`);\n  const result = z\n    .object({ user: z.object({ id: z.string().min(1) }) })\n    .safeParse(await response.json());\n  return result.success ? `vercel:${result.data.user.id}` : null;\n}\n"],"mappings":";;;;;;;AA+CA,SAAgB,sBAAsB,SAAkD;CACtF,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,eAAe,YAAY,WAAW,OAAO,YAAY,uBAAuB;CACtF,MAAM,UAAU,OAAO,OAAyB,eAAe,MAAqB;EAClF,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,0DAA0D;EACzF,MAAM,UAAU,uBAAuB,MAAM,KAAK;EAClD,MAAM,QAAQ,KAAK,OAAO,SAAS;GACjC;GACA;GACA,gBAAgB,QAAQ;GACxB;EACF,CAAC;CACH;CACA,MAAM,gBAAmC;EAAE;EAAS,SAAS,QAAQ;CAAQ;CAC7E,OAAO,OAAO,OAAO;EACnB;EACA,2BAA4B,OAAO,IAAI,gBAAgB,KAAA;CACzD,CAAC;AACH;;;;;;AAOA,SAAgB,sBAAsB,SAI1B;CACV,MAAM,EAAE,QAAQ,SAAS,cAAc;CACvC,IAAI,cAAc,QAAQ,CAAC,iBAAiB,KAAK,SAAS,GACxD,OAAO;CAET,MAAM,WAAW,WAAW,QAAQ,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CACxE,OAAO,gBAAgB,OAAO,KAAK,WAAW,KAAK,GAAG,OAAO,KAAK,UAAU,KAAK,CAAC;AACpF;AAEA,MAAM,2CAA2B,IAAI,IAAI,CAAC,wBAAwB,qBAAqB,CAAC;AAExF,MAAM,wBAAwB,EAAE,YAAY;CAC1C,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,YAAY;EACrB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACvC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;EAChD,YAAY,EAAE,YAAY;GACxB,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACrB,MAAM,EACH,YAAY;IACX,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;IACtC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;IAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;GAClC,CAAC,CAAC,CACD,SAAS;EACd,CAAC;CACH,CAAC;AACH,CAAC;;;;;;AAqBD,SAAgB,oCACd,SACmC;CACnC,MAAM,SAAS,sBAAsB,UAAU,OAAO;CACtD,IAAI,CAAC,OAAO,WAAW,CAAC,yBAAyB,IAAI,OAAO,KAAK,IAAI,GACnE,OAAO;CAET,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,WAAW,cACnB,OAAO;CAET,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,MAAM,MAAM,mBAAmB,MAAM;CAC3C,MAAM,OAAO,MAAM,oBAAoB,MAAM;CAC7C,MAAM,iBACJ,QAAQ,KAAA,KAAa,SAAS,KAAA,IAC1B,OACC,qBAAqB,UAAU,GAAG,IAAI,GAAG,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ;CAC9E,OAAO;EACL,QAAQ;EACR,YAAY,OAAO,KAAK;EACxB,WAAW,OAAO,KAAK;EACvB,cAAc,MAAM,WAAW;EAC/B,eAAe,MAAM,WAAW;EAChC,WAAW,MAAM,QAAQ;EACzB;EACA,WAAW,MAAM,mBAAmB;CACtC;AACF;;AAGA,eAAsB,4BACpB,SACA,UAAwB,OACA;CACxB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;CACzD,IAAI,CAAC,eAAe,MAAM,eAAe,GAAG,OAAO;CACnD,MAAM,WAAW,MAAM,QAAQ,kCAAkC;EAC/D,SAAS,EAAE,cAAc;EACzB,OAAO;EACP,UAAU;EACV,QAAQ,YAAY,QAAQ,GAAM;CACpC,CAAC;CACD,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK,OAAO;CAC/D,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kCAAkC,SAAS,OAAO,EAAE;CACtF,MAAM,SAAS,EACZ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACrD,UAAU,MAAM,SAAS,KAAK,CAAC;CAClC,OAAO,OAAO,UAAU,UAAU,OAAO,KAAK,KAAK,OAAO;AAC5D"}
+{"version":3,"file":"vercel.mjs","names":[],"sources":["../src/vercel.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport {\n  workNotificationSchema,\n  type WorkNotification,\n  type WorkNotifications,\n} from \"./store/work-notifications\";\n\n/** Provider delivery settings applied to one Vercel Queue message. */\nexport interface VercelQueueSendOptions {\n  region: string;\n  retentionSeconds: number;\n  idempotencyKey: string;\n  delaySeconds: number;\n}\n\n/** Injectable Vercel Queue send operation for one validated Factory work notification. */\nexport type VercelQueueSend = (\n  topic: string,\n  message: WorkNotification,\n  options: VercelQueueSendOptions,\n) => Promise<unknown>;\n\n/** Configures Vercel Queue transport, failure reporting, retention, and runtime guards. */\nexport interface VercelWorkQueueOptions {\n  send: VercelQueueSend;\n  onError(error: unknown, event: WorkNotification): void;\n  topic?: string;\n  region?: string;\n  retentionSeconds?: number;\n  environment?: Readonly<Record<string, string | undefined>>;\n}\n\n/** Publishes graph wakeups and exposes the hosted-runtime notification adapter. */\nexport interface VercelWorkQueue {\n  publish(event: WorkNotification, delaySeconds?: number): Promise<void>;\n  hostedNotifications(): WorkNotifications | undefined;\n}\n\nexport {\n  createVercelManagedGitHubApi,\n  VercelManagedGitHubApiError,\n  type VercelManagedGitHubApi,\n  type VercelManagedGitHubApiAction,\n  type VercelManagedGitHubApiOptions,\n  type VercelManagedGitHubApiSandboxCreateInput,\n  type VercelManagedGitHubIssue,\n  type VercelManagedGitHubIssueInput,\n  type VercelManagedGitHubPullRequest,\n  type VercelManagedGitHubPullRequestInput,\n  type VercelManagedGitHubPublication,\n  type VercelManagedGitHubPublicationInput,\n} from \"./vercel-github-api\";\n\nexport {\n  createVercelGitHubGitTransport,\n  createVercelManagedGitHubGitTransport,\n  type VercelGitHubGitTransportOptions,\n  type VercelGitHubTokenInput,\n  type VercelManagedGitHubGitTransportOptions,\n  type VercelManagedGitHubSandboxCreateInput,\n} from \"./vercel-git\";\n\n/** Configure graph wakeups over Vercel Queues without granting queue messages execution authority. */\nexport function createVercelWorkQueue(options: VercelWorkQueueOptions): VercelWorkQueue {\n  const environment = options.environment ?? process.env;\n  const topic = options.topic ?? \"factory-work\";\n  const region = options.region ?? \"iad1\";\n  const retentionSeconds = options.retentionSeconds ?? 604_800;\n  const hosted = () => environment.VERCEL === \"1\" && environment.FACTORY_LOCAL_TEST !== \"1\";\n  const publish = async (event: WorkNotification, delaySeconds = 0): Promise<void> => {\n    if (!hosted()) throw new Error(\"Vercel work queues require a hosted, non-fixture runtime\");\n    const message = workNotificationSchema.parse(event);\n    await options.send(topic, message, {\n      region,\n      retentionSeconds,\n      idempotencyKey: message.key,\n      delaySeconds,\n    });\n  };\n  const notifications: WorkNotifications = { publish, onError: options.onError };\n  return Object.freeze({\n    publish,\n    hostedNotifications: () => (hosted() ? notifications : undefined),\n  });\n}\n\n/**\n * Verify a Vercel webhook signature (the x-vercel-signature header): an\n * HMAC-SHA1 hex digest of the raw request body. Returns false for missing or\n * malformed signatures instead of throwing.\n */\nexport function verifyVercelSignature(options: {\n  secret: string;\n  payload: string;\n  signature: string | null;\n}): boolean {\n  const { secret, payload, signature } = options;\n  if (signature === null || !/^[0-9a-f]{40}$/.test(signature)) {\n    return false;\n  }\n  const expected = createHmac(\"sha1\", secret).update(payload).digest(\"hex\");\n  return timingSafeEqual(Buffer.from(signature, \"hex\"), Buffer.from(expected, \"hex\"));\n}\n\nconst observedDeploymentEvents = new Set([\"deployment.succeeded\", \"deployment.promoted\"]);\n\nconst deploymentEventSchema = z.looseObject({\n  id: z.string().min(1),\n  type: z.string(),\n  payload: z.looseObject({\n    target: z.string().nullable().optional(),\n    project: z.looseObject({ id: z.string().min(1) }),\n    deployment: z.looseObject({\n      id: z.string().min(1),\n      url: z.string().min(1),\n      meta: z\n        .looseObject({\n          githubCommitSha: z.string().optional(),\n          githubCommitOrg: z.string().optional(),\n          githubCommitRepo: z.string().optional(),\n          githubOrg: z.string().optional(),\n          githubRepo: z.string().optional(),\n        })\n        .optional(),\n    }),\n  }),\n});\n\n/** A normalized production deployment observation with optional Git commit identity. */\nexport interface VercelProductionDeployment {\n  source: \"vercel_production_deployment\";\n  deliveryId: string;\n  eventType: string;\n  deploymentId: string;\n  deploymentUrl: string;\n  projectId: string;\n  /** owner/name from the deployment's git metadata; null for non-git deployments. */\n  repositorySlug: RepositorySlug | null;\n  /** Commit the deployment was built from; null for non-git deployments. */\n  commitSha: string | null;\n}\n\n/**\n * Normalize a deployment.succeeded or deployment.promoted webhook for a\n * production deployment so the factory can observe a merge reaching\n * production. Returns null for other events and non-production targets.\n */\nexport function normalizeVercelProductionDeployment(\n  payload: unknown,\n): VercelProductionDeployment | null {\n  const parsed = deploymentEventSchema.safeParse(payload);\n  if (!parsed.success || !observedDeploymentEvents.has(parsed.data.type)) {\n    return null;\n  }\n  const event = parsed.data.payload;\n  if (event.target !== \"production\") {\n    return null;\n  }\n  const meta = event.deployment.meta;\n  const org = meta?.githubCommitOrg ?? meta?.githubOrg;\n  const repo = meta?.githubCommitRepo ?? meta?.githubRepo;\n  const repositorySlug =\n    org === undefined || repo === undefined\n      ? null\n      : (repositorySlugSchema.safeParse(`${org}/${repo}`.toLowerCase()).data ?? null);\n  return {\n    source: \"vercel_production_deployment\",\n    deliveryId: parsed.data.id,\n    eventType: parsed.data.type,\n    deploymentId: event.deployment.id,\n    deploymentUrl: event.deployment.url,\n    projectId: event.project.id,\n    repositorySlug,\n    commitSha: meta?.githubCommitSha ?? null,\n  };\n}\n\n/** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */\nexport async function authenticateVercelUserToken(\n  request: Request,\n  fetcher: typeof fetch = fetch,\n): Promise<string | null> {\n  const authorization = request.headers.get(\"authorization\");\n  if (!authorization?.match(/^Bearer \\S+$/u)) return null;\n  const response = await fetcher(\"https://api.vercel.com/v2/user\", {\n    headers: { authorization },\n    cache: \"no-store\",\n    redirect: \"error\",\n    signal: AbortSignal.timeout(10_000),\n  });\n  if (response.status === 401 || response.status === 403) return null;\n  if (!response.ok) throw new Error(`Vercel identity lookup failed (${response.status})`);\n  const result = z\n    .object({ user: z.object({ id: z.string().min(1) }) })\n    .safeParse(await response.json());\n  return result.success ? `vercel:${result.data.user.id}` : null;\n}\n"],"mappings":";;;;;;;;AAiEA,SAAgB,sBAAsB,SAAkD;CACtF,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,MAAM,QAAQ,QAAQ,SAAS;CAC/B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,mBAAmB,QAAQ,oBAAoB;CACrD,MAAM,eAAe,YAAY,WAAW,OAAO,YAAY,uBAAuB;CACtF,MAAM,UAAU,OAAO,OAAyB,eAAe,MAAqB;EAClF,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,0DAA0D;EACzF,MAAM,UAAU,uBAAuB,MAAM,KAAK;EAClD,MAAM,QAAQ,KAAK,OAAO,SAAS;GACjC;GACA;GACA,gBAAgB,QAAQ;GACxB;EACF,CAAC;CACH;CACA,MAAM,gBAAmC;EAAE;EAAS,SAAS,QAAQ;CAAQ;CAC7E,OAAO,OAAO,OAAO;EACnB;EACA,2BAA4B,OAAO,IAAI,gBAAgB,KAAA;CACzD,CAAC;AACH;;;;;;AAOA,SAAgB,sBAAsB,SAI1B;CACV,MAAM,EAAE,QAAQ,SAAS,cAAc;CACvC,IAAI,cAAc,QAAQ,CAAC,iBAAiB,KAAK,SAAS,GACxD,OAAO;CAET,MAAM,WAAW,WAAW,QAAQ,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CACxE,OAAO,gBAAgB,OAAO,KAAK,WAAW,KAAK,GAAG,OAAO,KAAK,UAAU,KAAK,CAAC;AACpF;AAEA,MAAM,2CAA2B,IAAI,IAAI,CAAC,wBAAwB,qBAAqB,CAAC;AAExF,MAAM,wBAAwB,EAAE,YAAY;CAC1C,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,YAAY;EACrB,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACvC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;EAChD,YAAY,EAAE,YAAY;GACxB,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACpB,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GACrB,MAAM,EACH,YAAY;IACX,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,iBAAiB,EAAE,OAAO,CAAC,CAAC,SAAS;IACrC,kBAAkB,EAAE,OAAO,CAAC,CAAC,SAAS;IACtC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;IAC/B,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS;GAClC,CAAC,CAAC,CACD,SAAS;EACd,CAAC;CACH,CAAC;AACH,CAAC;;;;;;AAqBD,SAAgB,oCACd,SACmC;CACnC,MAAM,SAAS,sBAAsB,UAAU,OAAO;CACtD,IAAI,CAAC,OAAO,WAAW,CAAC,yBAAyB,IAAI,OAAO,KAAK,IAAI,GACnE,OAAO;CAET,MAAM,QAAQ,OAAO,KAAK;CAC1B,IAAI,MAAM,WAAW,cACnB,OAAO;CAET,MAAM,OAAO,MAAM,WAAW;CAC9B,MAAM,MAAM,MAAM,mBAAmB,MAAM;CAC3C,MAAM,OAAO,MAAM,oBAAoB,MAAM;CAC7C,MAAM,iBACJ,QAAQ,KAAA,KAAa,SAAS,KAAA,IAC1B,OACC,qBAAqB,UAAU,GAAG,IAAI,GAAG,OAAO,YAAY,CAAC,CAAC,CAAC,QAAQ;CAC9E,OAAO;EACL,QAAQ;EACR,YAAY,OAAO,KAAK;EACxB,WAAW,OAAO,KAAK;EACvB,cAAc,MAAM,WAAW;EAC/B,eAAe,MAAM,WAAW;EAChC,WAAW,MAAM,QAAQ;EACzB;EACA,WAAW,MAAM,mBAAmB;CACtC;AACF;;AAGA,eAAsB,4BACpB,SACA,UAAwB,OACA;CACxB,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,eAAe;CACzD,IAAI,CAAC,eAAe,MAAM,eAAe,GAAG,OAAO;CACnD,MAAM,WAAW,MAAM,QAAQ,kCAAkC;EAC/D,SAAS,EAAE,cAAc;EACzB,OAAO;EACP,UAAU;EACV,QAAQ,YAAY,QAAQ,GAAM;CACpC,CAAC;CACD,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KAAK,OAAO;CAC/D,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kCAAkC,SAAS,OAAO,EAAE;CACtF,MAAM,SAAS,EACZ,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CACrD,UAAU,MAAM,SAAS,KAAK,CAAC;CAClC,OAAO,OAAO,UAAU,UAAU,OAAO,KAAK,KAAK,OAAO;AAC5D"}

package/dist/work-triage.d.mts

@@ -1,3 +1,4 @@
+/// <reference types="node" />
 import { ExistingWorkLookupOptions, ExistingWorkLookupResult, FindExistingWorkInput, findExistingWork } from "./work-triage/find-existing-work.mjs";
 import { FindExistingWorkTool, FindExistingWorkToolInput, FindExistingWorkToolOptions, FindExistingWorkToolStores, createFindExistingWorkTool } from "./work-triage/eve-tool.mjs";
 export { type ExistingWorkLookupOptions, type ExistingWorkLookupResult, type FindExistingWorkInput, type FindExistingWorkTool, type FindExistingWorkToolInput, type FindExistingWorkToolOptions, type FindExistingWorkToolStores, createFindExistingWorkTool, findExistingWork };

package/dist/workflows.d.mts

@@ -7,13 +7,23 @@ import { z } from "zod";
 declare const defaultTaskWorkflow: Readonly<WorkflowDefinition<z.ZodCustom<JsonValue, JsonValue>, z.ZodCustom<JsonValue, JsonValue>, "task", 1>>;
 /** Caller input accepted when defining one exact workflow contract. */
 interface WorkflowDefinitionInput<Input extends z.ZodType = z.ZodType, Output extends z.ZodType = z.ZodType, Id extends string = string, Version extends number = number> {
+  /** Stable lowercase workflow identifier persisted on every Task. */
   readonly id: Id;
+  /** Positive exact version; callers and recovery never select an implicit latest version. */
   readonly version: Version;
+  /** Schema that validates caller input and supplies its static input type. */
   readonly input: Input;
+  /** Schema that validates successful completion and supplies its static output type. */
   readonly output: Output;
-  /** Required when input transformation changes the stored shape; must preserve canonical JSON. */
+  /**
+   * Canonical persisted-input schema required when `input` transforms its value. It must validate
+   * without changing the stored JSON shape.
+   */
   readonly storedInput?: z.ZodType<NoInfer<z.output<Input>>>;
-  /** Required when output transformation changes the stored shape; must preserve canonical JSON. */
+  /**
+   * Canonical persisted-output schema required when `output` transforms its value. It must
+   * validate without changing the stored JSON shape.
+   */
   readonly storedOutput?: z.ZodType<NoInfer<z.output<Output>>>;
 }
 /** Exact-version workflow contract with a typed binding for constructing work. */
@@ -32,16 +42,104 @@ type WorkflowForBinding<Definition extends WorkflowDefinition, Binding extends W
 } ? Definition : never : never;
 /** Immutable registry that validates data against exact workflow versions. */
 interface WorkflowRegistry<Definition extends WorkflowDefinition = WorkflowDefinition> {
+  /** Immutable exact-version definitions in registration order. */
   readonly definitions: readonly Readonly<Definition>[];
+  /**
+   * Resolves one exact binding, throwing with the registered alternatives when it is unknown.
+   *
+   * @param binding - Exact workflow ID and version.
+   * @returns The matching immutable workflow definition.
+   */
   resolve<const Binding extends WorkflowBinding>(binding: Binding): Readonly<WorkflowForBinding<Definition, Binding>>;
+  /**
+   * Validates caller input through the selected workflow and returns bounded canonical JSON.
+   *
+   * @param binding - Exact workflow ID and version.
+   * @param value - Untrusted caller input to validate and transform.
+   * @returns Validated bounded JSON produced by the input schema.
+   */
   validateInput(binding: WorkflowBinding, value: unknown): JsonValue;
+  /**
+   * Validates candidate completion output through the selected workflow.
+   *
+   * @param binding - Exact workflow ID and version.
+   * @param value - Untrusted candidate output to validate and transform.
+   * @returns Validated bounded JSON produced by the output schema.
+   */
   validateOutput(binding: WorkflowBinding, value: unknown): JsonValue;
+  /**
+   * Validates persisted input without permitting a schema transform to change its JSON shape.
+   *
+   * @param binding - Exact workflow ID and version stored on the Task.
+   * @param value - Canonical persisted JSON to validate.
+   * @returns A cloned validated value equal to the persisted JSON.
+   */
   validateStoredInput(binding: WorkflowBinding, value: unknown): JsonValue;
+  /**
+   * Validates persisted output without permitting a schema transform to change its JSON shape.
+   *
+   * @param binding - Exact workflow ID and version stored on the Task.
+   * @param value - Canonical persisted JSON to validate.
+   * @returns A cloned validated value equal to the persisted JSON.
+   */
   validateStoredOutput(binding: WorkflowBinding, value: unknown): JsonValue;
 }
-/** Validates and freezes one exact workflow definition without executing it. */
+/**
+ * Validates and freezes one exact workflow definition without executing it.
+ *
+ * @remarks
+ * A definition is a typed contract, not a registered runtime. Pass every definition that stored
+ * Tasks may reference to `defineWorkflows`, then supply that registry to `createStores`. Input and
+ * output schemas may transform caller values only when `storedInput` or `storedOutput` describes
+ * the unchanged canonical JSON representation used after persistence.
+ *
+ * @param definition - Stable ID, positive version, and Zod input/output contracts.
+ * @returns An immutable definition whose binding carries the input and output types.
+ * @throws When the binding is invalid or the input/output fields are not Zod schemas.
+ * @see The shipped `docs/recipes/custom-workflow.md` recipe for registration and completion.
+ *
+ * @example
+ * ```ts
+ * import { defineWorkflow, defineWorkflows } from "@vercel/factory/workflows";
+ * import { z } from "zod";
+ *
+ * const greeting = defineWorkflow({
+ *   id: "greeting",
+ *   version: 1,
+ *   input: z.object({ name: z.string() }),
+ *   output: z.object({ message: z.string() }),
+ * });
+ * const workflows = defineWorkflows([greeting]);
+ * ```
+ */
 declare function defineWorkflow<Input extends z.ZodType, Output extends z.ZodType, const Id extends string, const Version extends number>(definition: WorkflowDefinitionInput<Input, Output, Id, Version>): Readonly<WorkflowDefinition<Input, Output, Id, Version>>;
-/** Builds an exact-version workflow registry and rejects duplicate definitions. */
+/**
+ * Builds an immutable exact-version workflow registry and rejects duplicate definitions.
+ *
+ * @remarks
+ * Register old versions for as long as persisted Tasks can still reference them. Resolution uses
+ * both ID and version and never falls forward to another version. Creating a new registry has no
+ * persistence side effects.
+ *
+ * @param definitions - All exact workflow versions readable by this runtime.
+ * @returns A registry for resolving bindings and validating caller and persisted values.
+ * @throws When a definition is invalid or the same `id@version` appears more than once.
+ *
+ * @example
+ * ```ts
+ * import { defineWorkflow, defineWorkflows } from "@vercel/factory/workflows";
+ * import { z } from "zod";
+ *
+ * const v1 = defineWorkflow({
+ *   id: "report",
+ *   version: 1,
+ *   input: z.object({ topic: z.string() }),
+ *   output: z.object({ summary: z.string() }),
+ * });
+ * const workflows = defineWorkflows([v1]);
+ * workflows.resolve(v1.binding);
+ * ```
+ */
 declare function defineWorkflows<const Definition extends WorkflowDefinitionInput>(definitions: readonly Definition[]): WorkflowRegistry<RegisteredWorkflow<Definition>>;
 //#endregion
 export { type AgentRoute, type AgentRouteBinding, type AgentRouteBindingInput, type AgentRouteInput, type AgentRouteKey, type AgentRouteRegistry, type JsonValue, MAX_WORK_JSON_BYTES, MAX_WORK_JSON_DEPTH, type RouteTaskWorkOptions, type RoutedTaskWork, type TaskWork, type TaskWorkOptions, type TaskWorkResult, type WorkflowBinding, type WorkflowBindingInput, WorkflowDefinition, WorkflowDefinitionInput, WorkflowInput, WorkflowOutput, type WorkflowReference, type WorkflowReferenceInput, WorkflowRegistry, type WorkflowTaskWorkOptions, agentRouteBindingSchema, agentRouteSchema, defaultTaskWorkflow, defineAgentRoutes, defineWorkflow, defineWorkflows, jsonValueSchema, parseAgentRouteBinding, parseWorkflowBinding, routeKey, routeTaskWork, taskWork, taskWorkResultSchema, taskWorkSchema, workflowBindingSchema };

package/dist/workflows.mjs

@@ -11,7 +11,34 @@ const defaultTaskWorkflow = defineWorkflow({
 	input: jsonValueSchema,
 	output: jsonValueSchema
 });
-/** Validates and freezes one exact workflow definition without executing it. */
+/**
+* Validates and freezes one exact workflow definition without executing it.
+*
+* @remarks
+* A definition is a typed contract, not a registered runtime. Pass every definition that stored
+* Tasks may reference to `defineWorkflows`, then supply that registry to `createStores`. Input and
+* output schemas may transform caller values only when `storedInput` or `storedOutput` describes
+* the unchanged canonical JSON representation used after persistence.
+*
+* @param definition - Stable ID, positive version, and Zod input/output contracts.
+* @returns An immutable definition whose binding carries the input and output types.
+* @throws When the binding is invalid or the input/output fields are not Zod schemas.
+* @see The shipped `docs/recipes/custom-workflow.md` recipe for registration and completion.
+*
+* @example
+* ```ts
+* import { defineWorkflow, defineWorkflows } from "@vercel/factory/workflows";
+* import { z } from "zod";
+*
+* const greeting = defineWorkflow({
+*   id: "greeting",
+*   version: 1,
+*   input: z.object({ name: z.string() }),
+*   output: z.object({ message: z.string() }),
+* });
+* const workflows = defineWorkflows([greeting]);
+* ```
+*/
 function defineWorkflow(definition) {
 	const parsedBinding = parseWorkflowBinding({
 		id: definition.id,
@@ -30,7 +57,33 @@ function defineWorkflow(definition) {
 		storedOutput: definition.storedOutput
 	});
 }
-/** Builds an exact-version workflow registry and rejects duplicate definitions. */
+/**
+* Builds an immutable exact-version workflow registry and rejects duplicate definitions.
+*
+* @remarks
+* Register old versions for as long as persisted Tasks can still reference them. Resolution uses
+* both ID and version and never falls forward to another version. Creating a new registry has no
+* persistence side effects.
+*
+* @param definitions - All exact workflow versions readable by this runtime.
+* @returns A registry for resolving bindings and validating caller and persisted values.
+* @throws When a definition is invalid or the same `id@version` appears more than once.
+*
+* @example
+* ```ts
+* import { defineWorkflow, defineWorkflows } from "@vercel/factory/workflows";
+* import { z } from "zod";
+*
+* const v1 = defineWorkflow({
+*   id: "report",
+*   version: 1,
+*   input: z.object({ topic: z.string() }),
+*   output: z.object({ summary: z.string() }),
+* });
+* const workflows = defineWorkflows([v1]);
+* workflows.resolve(v1.binding);
+* ```
+*/
 function defineWorkflows(definitions) {
 	const registered = definitions.map((definition) => defineWorkflow(definition));
 	const byBinding = /* @__PURE__ */ new Map();

package/dist/workflows.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.mjs","names":[],"sources":["../src/workflows.ts"],"sourcesContent":["import { isDeepStrictEqual } from \"node:util\";\nimport { z } from \"zod\";\nimport {\n  jsonValueSchema,\n  parseWorkflowBinding,\n  workflowBindingSchema,\n  type JsonValue,\n  type WorkflowBinding,\n  type WorkflowReference,\n} from \"./schema/work\";\n\nexport {\n  jsonValueSchema,\n  MAX_WORK_JSON_BYTES,\n  MAX_WORK_JSON_DEPTH,\n  taskWork,\n  taskWorkResultSchema,\n  taskWorkSchema,\n  parseWorkflowBinding,\n  workflowBindingSchema,\n} from \"./schema/work\";\nexport {\n  agentRouteBindingSchema,\n  agentRouteSchema,\n  defineAgentRoutes,\n  parseAgentRouteBinding,\n  routeKey,\n  routeTaskWork,\n  type AgentRoute,\n  type AgentRouteBinding,\n  type AgentRouteBindingInput,\n  type AgentRouteInput,\n  type AgentRouteKey,\n  type AgentRouteRegistry,\n  type RouteTaskWorkOptions,\n  type RoutedTaskWork,\n} from \"./agent-routes\";\n\n/** Generic `task@1` workflow accepting bounded JSON input and output. */\nexport const defaultTaskWorkflow = defineWorkflow({\n  id: \"task\",\n  version: 1,\n  input: jsonValueSchema,\n  output: jsonValueSchema,\n});\nexport type {\n  JsonValue,\n  TaskWork,\n  TaskWorkOptions,\n  TaskWorkResult,\n  WorkflowBinding,\n  WorkflowBindingInput,\n  WorkflowReference,\n  WorkflowReferenceInput,\n  WorkflowTaskWorkOptions,\n} from \"./schema/work\";\n\n/** Caller input accepted when defining one exact workflow contract. */\nexport interface WorkflowDefinitionInput<\n  Input extends z.ZodType = z.ZodType,\n  Output extends z.ZodType = z.ZodType,\n  Id extends string = string,\n  Version extends number = number,\n> {\n  readonly id: Id;\n  readonly version: Version;\n  readonly input: Input;\n  readonly output: Output;\n  /** Required when input transformation changes the stored shape; must preserve canonical JSON. */\n  readonly storedInput?: z.ZodType<NoInfer<z.output<Input>>>;\n  /** Required when output transformation changes the stored shape; must preserve canonical JSON. */\n  readonly storedOutput?: z.ZodType<NoInfer<z.output<Output>>>;\n}\n\n/** Exact-version workflow contract with a typed binding for constructing work. */\nexport interface WorkflowDefinition<\n  Input extends z.ZodType = z.ZodType,\n  Output extends z.ZodType = z.ZodType,\n  Id extends string = string,\n  Version extends number = number,\n>\n  extends\n    WorkflowDefinitionInput<Input, Output, Id, Version>,\n    WorkflowReference<\n      Input,\n      WorkflowBinding<z.input<Input> & JsonValue, z.input<Output> & JsonValue, Id, Version>\n    > {}\n\n/** JSON input accepted by a workflow definition before its schema transforms it. */\nexport type WorkflowInput<Definition extends WorkflowDefinition> = z.input<Definition[\"input\"]> &\n  JsonValue;\n\n/** JSON output accepted by a workflow definition before its schema transforms it. */\nexport type WorkflowOutput<Definition extends WorkflowDefinition> = z.input<Definition[\"output\"]> &\n  JsonValue;\n\ntype RegisteredWorkflow<Definition extends WorkflowDefinitionInput> =\n  Definition extends WorkflowDefinitionInput<infer Input, infer Output, infer Id, infer Version>\n    ? WorkflowDefinition<Input, Output, Id, Version>\n    : never;\n\ntype WorkflowForBinding<\n  Definition extends WorkflowDefinition,\n  Binding extends WorkflowBinding,\n> = Definition extends WorkflowDefinition\n  ? Binding extends {\n      readonly id: Definition[\"id\"];\n      readonly version: Definition[\"version\"];\n    }\n    ? Definition\n    : Definition extends {\n          readonly id: Binding[\"id\"];\n          readonly version: Binding[\"version\"];\n        }\n      ? Definition\n      : never\n  : never;\n\n/** Immutable registry that validates data against exact workflow versions. */\nexport interface WorkflowRegistry<Definition extends WorkflowDefinition = WorkflowDefinition> {\n  readonly definitions: readonly Readonly<Definition>[];\n  resolve<const Binding extends WorkflowBinding>(\n    binding: Binding,\n  ): Readonly<WorkflowForBinding<Definition, Binding>>;\n  validateInput(binding: WorkflowBinding, value: unknown): JsonValue;\n  validateOutput(binding: WorkflowBinding, value: unknown): JsonValue;\n  validateStoredInput(binding: WorkflowBinding, value: unknown): JsonValue;\n  validateStoredOutput(binding: WorkflowBinding, value: unknown): JsonValue;\n}\n\n/** Validates and freezes one exact workflow definition without executing it. */\nexport function defineWorkflow<\n  Input extends z.ZodType,\n  Output extends z.ZodType,\n  const Id extends string,\n  const Version extends number,\n>(\n  definition: WorkflowDefinitionInput<Input, Output, Id, Version>,\n): Readonly<WorkflowDefinition<Input, Output, Id, Version>> {\n  const parsedBinding = parseWorkflowBinding({\n    id: definition.id,\n    version: definition.version,\n  });\n  if (!(definition.input instanceof z.ZodType) || !(definition.output instanceof z.ZodType)) {\n    throw new Error(\n      `Workflow ${definition.id}@${definition.version} requires Zod input and output schemas`,\n    );\n  }\n  for (const field of [\"storedInput\", \"storedOutput\"] as const) {\n    if (definition[field] !== undefined && !(definition[field] instanceof z.ZodType)) {\n      throw new Error(\n        `Workflow ${definition.id}@${definition.version} requires a Zod ${field} schema`,\n      );\n    }\n  }\n  const binding: WorkflowBinding<\n    z.input<Input> & JsonValue,\n    z.input<Output> & JsonValue,\n    Id,\n    Version\n  > = Object.freeze(parsedBinding) as WorkflowBinding<\n    z.input<Input> & JsonValue,\n    z.input<Output> & JsonValue,\n    Id,\n    Version\n  >;\n  return Object.freeze({\n    id: definition.id,\n    version: definition.version,\n    binding,\n    input: definition.input,\n    output: definition.output,\n    storedInput: definition.storedInput,\n    storedOutput: definition.storedOutput,\n  });\n}\n\n/** Builds an exact-version workflow registry and rejects duplicate definitions. */\nexport function defineWorkflows<const Definition extends WorkflowDefinitionInput>(\n  definitions: readonly Definition[],\n): WorkflowRegistry<RegisteredWorkflow<Definition>> {\n  const registered = definitions.map((definition) =>\n    defineWorkflow(definition),\n  ) as unknown as readonly Readonly<RegisteredWorkflow<Definition>>[];\n  const byBinding = new Map<string, Readonly<RegisteredWorkflow<Definition>>>();\n  for (const definition of registered) {\n    const key = `${definition.id}@${definition.version}`;\n    if (byBinding.has(key)) {\n      throw new Error(\n        `Duplicate workflow definition ${key}; register each id and version exactly once`,\n      );\n    }\n    byBinding.set(key, definition);\n  }\n\n  function resolve<const Binding extends WorkflowBinding>(\n    binding: Binding,\n  ): Readonly<WorkflowForBinding<RegisteredWorkflow<Definition>, Binding>>;\n  function resolve(binding: WorkflowBinding): Readonly<RegisteredWorkflow<Definition>> {\n    const { id, version } = workflowBindingSchema.parse(binding);\n    const key = `${id}@${version}`;\n    const definition = byBinding.get(key);\n    if (!definition) {\n      const alternatives = [...byBinding.keys()].sort().join(\", \") || \"none\";\n      throw new Error(`Unknown workflow ${key}. Registered workflows: ${alternatives}`);\n    }\n    return definition;\n  }\n  const validateStored = (\n    binding: WorkflowBinding,\n    value: unknown,\n    field: \"input\" | \"output\",\n  ): JsonValue => {\n    const definition = resolve(binding);\n    const storedField = field === \"input\" ? \"storedInput\" : \"storedOutput\";\n    const storedSchema = definition[storedField];\n    const json = structuredClone(jsonValueSchema.parse(value));\n    let parsed: unknown;\n    try {\n      parsed = (storedSchema ?? definition[field]).parse(structuredClone(json));\n    } catch (cause) {\n      if (storedSchema !== undefined) throw cause;\n      throw new Error(\n        `Workflow ${definition.id}@${definition.version} cannot validate stored ${field}; provide ${storedField} when the ${field} transform changes shape`,\n        { cause },\n      );\n    }\n    const validated = jsonValueSchema.parse(parsed);\n    if (!isDeepStrictEqual(json, validated)) {\n      throw new Error(\n        `Workflow ${definition.id}@${definition.version} stored ${field} validation must preserve canonical JSON; provide a non-transforming ${storedField} schema`,\n      );\n    }\n    return structuredClone(validated);\n  };\n  const validate = (\n    binding: WorkflowBinding,\n    value: unknown,\n    field: \"input\" | \"output\",\n  ): JsonValue => {\n    const definition = resolve(binding);\n    const json = jsonValueSchema.parse(value);\n    const parsed = jsonValueSchema.parse(definition[field].parse(structuredClone(json)));\n    return validateStored(binding, parsed, field);\n  };\n\n  return Object.freeze({\n    definitions: Object.freeze(registered),\n    resolve,\n    validateInput: (binding: WorkflowBinding, value: unknown) => validate(binding, value, \"input\"),\n    validateOutput: (binding: WorkflowBinding, value: unknown) =>\n      validate(binding, value, \"output\"),\n    validateStoredInput: (binding: WorkflowBinding, value: unknown) =>\n      validateStored(binding, value, \"input\"),\n    validateStoredOutput: (binding: WorkflowBinding, value: unknown) =>\n      validateStored(binding, value, \"output\"),\n  });\n}\n"],"mappings":";;;;;;;AAuCA,MAAa,sBAAsB,eAAe;CAChD,IAAI;CACJ,SAAS;CACT,OAAO;CACP,QAAQ;AACV,CAAC;;AAuFD,SAAgB,eAMd,YAC0D;CAC1D,MAAM,gBAAgB,qBAAqB;EACzC,IAAI,WAAW;EACf,SAAS,WAAW;CACtB,CAAC;CACD,IAAI,EAAE,WAAW,iBAAiB,EAAE,YAAY,EAAE,WAAW,kBAAkB,EAAE,UAC/E,MAAM,IAAI,MACR,YAAY,WAAW,GAAG,GAAG,WAAW,QAAQ,uCAClD;CAEF,KAAK,MAAM,SAAS,CAAC,eAAe,cAAc,GAChD,IAAI,WAAW,WAAW,KAAA,KAAa,EAAE,WAAW,kBAAkB,EAAE,UACtE,MAAM,IAAI,MACR,YAAY,WAAW,GAAG,GAAG,WAAW,QAAQ,kBAAkB,MAAM,QAC1E;CAGJ,MAAM,UAKF,OAAO,OAAO,aAAa;CAM/B,OAAO,OAAO,OAAO;EACnB,IAAI,WAAW;EACf,SAAS,WAAW;EACpB;EACA,OAAO,WAAW;EAClB,QAAQ,WAAW;EACnB,aAAa,WAAW;EACxB,cAAc,WAAW;CAC3B,CAAC;AACH;;AAGA,SAAgB,gBACd,aACkD;CAClD,MAAM,aAAa,YAAY,KAAK,eAClC,eAAe,UAAU,CAC3B;CACA,MAAM,4BAAY,IAAI,IAAsD;CAC5E,KAAK,MAAM,cAAc,YAAY;EACnC,MAAM,MAAM,GAAG,WAAW,GAAG,GAAG,WAAW;EAC3C,IAAI,UAAU,IAAI,GAAG,GACnB,MAAM,IAAI,MACR,iCAAiC,IAAI,4CACvC;EAEF,UAAU,IAAI,KAAK,UAAU;CAC/B;CAKA,SAAS,QAAQ,SAAoE;EACnF,MAAM,EAAE,IAAI,YAAY,sBAAsB,MAAM,OAAO;EAC3D,MAAM,MAAM,GAAG,GAAG,GAAG;EACrB,MAAM,aAAa,UAAU,IAAI,GAAG;EACpC,IAAI,CAAC,YAAY;GACf,MAAM,eAAe,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,KAAK;GAChE,MAAM,IAAI,MAAM,oBAAoB,IAAI,0BAA0B,cAAc;EAClF;EACA,OAAO;CACT;CACA,MAAM,kBACJ,SACA,OACA,UACc;EACd,MAAM,aAAa,QAAQ,OAAO;EAClC,MAAM,cAAc,UAAU,UAAU,gBAAgB;EACxD,MAAM,eAAe,WAAW;EAChC,MAAM,OAAO,gBAAgB,gBAAgB,MAAM,KAAK,CAAC;EACzD,IAAI;EACJ,IAAI;GACF,UAAU,gBAAgB,WAAW,OAAA,CAAQ,MAAM,gBAAgB,IAAI,CAAC;EAC1E,SAAS,OAAO;GACd,IAAI,iBAAiB,KAAA,GAAW,MAAM;GACtC,MAAM,IAAI,MACR,YAAY,WAAW,GAAG,GAAG,WAAW,QAAQ,0BAA0B,MAAM,YAAY,YAAY,YAAY,MAAM,2BAC1H,EAAE,MAAM,CACV;EACF;EACA,MAAM,YAAY,gBAAgB,MAAM,MAAM;EAC9C,IAAI,CAAC,kBAAkB,MAAM,SAAS,GACpC,MAAM,IAAI,MACR,YAAY,WAAW,GAAG,GAAG,WAAW,QAAQ,UAAU,MAAM,uEAAuE,YAAY,QACrJ;EAEF,OAAO,gBAAgB,SAAS;CAClC;CACA,MAAM,YACJ,SACA,OACA,UACc;EACd,MAAM,aAAa,QAAQ,OAAO;EAClC,MAAM,OAAO,gBAAgB,MAAM,KAAK;EACxC,MAAM,SAAS,gBAAgB,MAAM,WAAW,MAAM,CAAC,MAAM,gBAAgB,IAAI,CAAC,CAAC;EACnF,OAAO,eAAe,SAAS,QAAQ,KAAK;CAC9C;CAEA,OAAO,OAAO,OAAO;EACnB,aAAa,OAAO,OAAO,UAAU;EACrC;EACA,gBAAgB,SAA0B,UAAmB,SAAS,SAAS,OAAO,OAAO;EAC7F,iBAAiB,SAA0B,UACzC,SAAS,SAAS,OAAO,QAAQ;EACnC,sBAAsB,SAA0B,UAC9C,eAAe,SAAS,OAAO,OAAO;EACxC,uBAAuB,SAA0B,UAC/C,eAAe,SAAS,OAAO,QAAQ;CAC3C,CAAC;AACH"}
+{"version":3,"file":"workflows.mjs","names":[],"sources":["../src/workflows.ts"],"sourcesContent":["import { isDeepStrictEqual } from \"node:util\";\nimport { z } from \"zod\";\nimport {\n  jsonValueSchema,\n  parseWorkflowBinding,\n  workflowBindingSchema,\n  type JsonValue,\n  type WorkflowBinding,\n  type WorkflowReference,\n} from \"./schema/work\";\n\nexport {\n  jsonValueSchema,\n  MAX_WORK_JSON_BYTES,\n  MAX_WORK_JSON_DEPTH,\n  taskWork,\n  taskWorkResultSchema,\n  taskWorkSchema,\n  parseWorkflowBinding,\n  workflowBindingSchema,\n} from \"./schema/work\";\nexport {\n  agentRouteBindingSchema,\n  agentRouteSchema,\n  defineAgentRoutes,\n  parseAgentRouteBinding,\n  routeKey,\n  routeTaskWork,\n  type AgentRoute,\n  type AgentRouteBinding,\n  type AgentRouteBindingInput,\n  type AgentRouteInput,\n  type AgentRouteKey,\n  type AgentRouteRegistry,\n  type RouteTaskWorkOptions,\n  type RoutedTaskWork,\n} from \"./agent-routes\";\n\n/** Generic `task@1` workflow accepting bounded JSON input and output. */\nexport const defaultTaskWorkflow = defineWorkflow({\n  id: \"task\",\n  version: 1,\n  input: jsonValueSchema,\n  output: jsonValueSchema,\n});\nexport type {\n  JsonValue,\n  TaskWork,\n  TaskWorkOptions,\n  TaskWorkResult,\n  WorkflowBinding,\n  WorkflowBindingInput,\n  WorkflowReference,\n  WorkflowReferenceInput,\n  WorkflowTaskWorkOptions,\n} from \"./schema/work\";\n\n/** Caller input accepted when defining one exact workflow contract. */\nexport interface WorkflowDefinitionInput<\n  Input extends z.ZodType = z.ZodType,\n  Output extends z.ZodType = z.ZodType,\n  Id extends string = string,\n  Version extends number = number,\n> {\n  /** Stable lowercase workflow identifier persisted on every Task. */\n  readonly id: Id;\n  /** Positive exact version; callers and recovery never select an implicit latest version. */\n  readonly version: Version;\n  /** Schema that validates caller input and supplies its static input type. */\n  readonly input: Input;\n  /** Schema that validates successful completion and supplies its static output type. */\n  readonly output: Output;\n  /**\n   * Canonical persisted-input schema required when `input` transforms its value. It must validate\n   * without changing the stored JSON shape.\n   */\n  readonly storedInput?: z.ZodType<NoInfer<z.output<Input>>>;\n  /**\n   * Canonical persisted-output schema required when `output` transforms its value. It must\n   * validate without changing the stored JSON shape.\n   */\n  readonly storedOutput?: z.ZodType<NoInfer<z.output<Output>>>;\n}\n\n/** Exact-version workflow contract with a typed binding for constructing work. */\nexport interface WorkflowDefinition<\n  Input extends z.ZodType = z.ZodType,\n  Output extends z.ZodType = z.ZodType,\n  Id extends string = string,\n  Version extends number = number,\n>\n  extends\n    WorkflowDefinitionInput<Input, Output, Id, Version>,\n    WorkflowReference<\n      Input,\n      WorkflowBinding<z.input<Input> & JsonValue, z.input<Output> & JsonValue, Id, Version>\n    > {}\n\n/** JSON input accepted by a workflow definition before its schema transforms it. */\nexport type WorkflowInput<Definition extends WorkflowDefinition> = z.input<Definition[\"input\"]> &\n  JsonValue;\n\n/** JSON output accepted by a workflow definition before its schema transforms it. */\nexport type WorkflowOutput<Definition extends WorkflowDefinition> = z.input<Definition[\"output\"]> &\n  JsonValue;\n\ntype RegisteredWorkflow<Definition extends WorkflowDefinitionInput> =\n  Definition extends WorkflowDefinitionInput<infer Input, infer Output, infer Id, infer Version>\n    ? WorkflowDefinition<Input, Output, Id, Version>\n    : never;\n\ntype WorkflowForBinding<\n  Definition extends WorkflowDefinition,\n  Binding extends WorkflowBinding,\n> = Definition extends WorkflowDefinition\n  ? Binding extends {\n      readonly id: Definition[\"id\"];\n      readonly version: Definition[\"version\"];\n    }\n    ? Definition\n    : Definition extends {\n          readonly id: Binding[\"id\"];\n          readonly version: Binding[\"version\"];\n        }\n      ? Definition\n      : never\n  : never;\n\n/** Immutable registry that validates data against exact workflow versions. */\nexport interface WorkflowRegistry<Definition extends WorkflowDefinition = WorkflowDefinition> {\n  /** Immutable exact-version definitions in registration order. */\n  readonly definitions: readonly Readonly<Definition>[];\n  /**\n   * Resolves one exact binding, throwing with the registered alternatives when it is unknown.\n   *\n   * @param binding - Exact workflow ID and version.\n   * @returns The matching immutable workflow definition.\n   */\n  resolve<const Binding extends WorkflowBinding>(\n    binding: Binding,\n  ): Readonly<WorkflowForBinding<Definition, Binding>>;\n  /**\n   * Validates caller input through the selected workflow and returns bounded canonical JSON.\n   *\n   * @param binding - Exact workflow ID and version.\n   * @param value - Untrusted caller input to validate and transform.\n   * @returns Validated bounded JSON produced by the input schema.\n   */\n  validateInput(binding: WorkflowBinding, value: unknown): JsonValue;\n  /**\n   * Validates candidate completion output through the selected workflow.\n   *\n   * @param binding - Exact workflow ID and version.\n   * @param value - Untrusted candidate output to validate and transform.\n   * @returns Validated bounded JSON produced by the output schema.\n   */\n  validateOutput(binding: WorkflowBinding, value: unknown): JsonValue;\n  /**\n   * Validates persisted input without permitting a schema transform to change its JSON shape.\n   *\n   * @param binding - Exact workflow ID and version stored on the Task.\n   * @param value - Canonical persisted JSON to validate.\n   * @returns A cloned validated value equal to the persisted JSON.\n   */\n  validateStoredInput(binding: WorkflowBinding, value: unknown): JsonValue;\n  /**\n   * Validates persisted output without permitting a schema transform to change its JSON shape.\n   *\n   * @param binding - Exact workflow ID and version stored on the Task.\n   * @param value - Canonical persisted JSON to validate.\n   * @returns A cloned validated value equal to the persisted JSON.\n   */\n  validateStoredOutput(binding: WorkflowBinding, value: unknown): JsonValue;\n}\n\n/**\n * Validates and freezes one exact workflow definition without executing it.\n *\n * @remarks\n * A definition is a typed contract, not a registered runtime. Pass every definition that stored\n * Tasks may reference to `defineWorkflows`, then supply that registry to `createStores`. Input and\n * output schemas may transform caller values only when `storedInput` or `storedOutput` describes\n * the unchanged canonical JSON representation used after persistence.\n *\n * @param definition - Stable ID, positive version, and Zod input/output contracts.\n * @returns An immutable definition whose binding carries the input and output types.\n * @throws When the binding is invalid or the input/output fields are not Zod schemas.\n * @see The shipped `docs/recipes/custom-workflow.md` recipe for registration and completion.\n *\n * @example\n * ```ts\n * import { defineWorkflow, defineWorkflows } from \"@vercel/factory/workflows\";\n * import { z } from \"zod\";\n *\n * const greeting = defineWorkflow({\n *   id: \"greeting\",\n *   version: 1,\n *   input: z.object({ name: z.string() }),\n *   output: z.object({ message: z.string() }),\n * });\n * const workflows = defineWorkflows([greeting]);\n * ```\n */\nexport function defineWorkflow<\n  Input extends z.ZodType,\n  Output extends z.ZodType,\n  const Id extends string,\n  const Version extends number,\n>(\n  definition: WorkflowDefinitionInput<Input, Output, Id, Version>,\n): Readonly<WorkflowDefinition<Input, Output, Id, Version>> {\n  const parsedBinding = parseWorkflowBinding({\n    id: definition.id,\n    version: definition.version,\n  });\n  if (!(definition.input instanceof z.ZodType) || !(definition.output instanceof z.ZodType)) {\n    throw new Error(\n      `Workflow ${definition.id}@${definition.version} requires Zod input and output schemas`,\n    );\n  }\n  for (const field of [\"storedInput\", \"storedOutput\"] as const) {\n    if (definition[field] !== undefined && !(definition[field] instanceof z.ZodType)) {\n      throw new Error(\n        `Workflow ${definition.id}@${definition.version} requires a Zod ${field} schema`,\n      );\n    }\n  }\n  const binding: WorkflowBinding<\n    z.input<Input> & JsonValue,\n    z.input<Output> & JsonValue,\n    Id,\n    Version\n  > = Object.freeze(parsedBinding) as WorkflowBinding<\n    z.input<Input> & JsonValue,\n    z.input<Output> & JsonValue,\n    Id,\n    Version\n  >;\n  return Object.freeze({\n    id: definition.id,\n    version: definition.version,\n    binding,\n    input: definition.input,\n    output: definition.output,\n    storedInput: definition.storedInput,\n    storedOutput: definition.storedOutput,\n  });\n}\n\n/**\n * Builds an immutable exact-version workflow registry and rejects duplicate definitions.\n *\n * @remarks\n * Register old versions for as long as persisted Tasks can still reference them. Resolution uses\n * both ID and version and never falls forward to another version. Creating a new registry has no\n * persistence side effects.\n *\n * @param definitions - All exact workflow versions readable by this runtime.\n * @returns A registry for resolving bindings and validating caller and persisted values.\n * @throws When a definition is invalid or the same `id@version` appears more than once.\n *\n * @example\n * ```ts\n * import { defineWorkflow, defineWorkflows } from \"@vercel/factory/workflows\";\n * import { z } from \"zod\";\n *\n * const v1 = defineWorkflow({\n *   id: \"report\",\n *   version: 1,\n *   input: z.object({ topic: z.string() }),\n *   output: z.object({ summary: z.string() }),\n * });\n * const workflows = defineWorkflows([v1]);\n * workflows.resolve(v1.binding);\n * ```\n */\nexport function defineWorkflows<const Definition extends WorkflowDefinitionInput>(\n  definitions: readonly Definition[],\n): WorkflowRegistry<RegisteredWorkflow<Definition>> {\n  const registered = definitions.map((definition) =>\n    defineWorkflow(definition),\n  ) as unknown as readonly Readonly<RegisteredWorkflow<Definition>>[];\n  const byBinding = new Map<string, Readonly<RegisteredWorkflow<Definition>>>();\n  for (const definition of registered) {\n    const key = `${definition.id}@${definition.version}`;\n    if (byBinding.has(key)) {\n      throw new Error(\n        `Duplicate workflow definition ${key}; register each id and version exactly once`,\n      );\n    }\n    byBinding.set(key, definition);\n  }\n\n  function resolve<const Binding extends WorkflowBinding>(\n    binding: Binding,\n  ): Readonly<WorkflowForBinding<RegisteredWorkflow<Definition>, Binding>>;\n  function resolve(binding: WorkflowBinding): Readonly<RegisteredWorkflow<Definition>> {\n    const { id, version } = workflowBindingSchema.parse(binding);\n    const key = `${id}@${version}`;\n    const definition = byBinding.get(key);\n    if (!definition) {\n      const alternatives = [...byBinding.keys()].sort().join(\", \") || \"none\";\n      throw new Error(`Unknown workflow ${key}. Registered workflows: ${alternatives}`);\n    }\n    return definition;\n  }\n  const validateStored = (\n    binding: WorkflowBinding,\n    value: unknown,\n    field: \"input\" | \"output\",\n  ): JsonValue => {\n    const definition = resolve(binding);\n    const storedField = field === \"input\" ? \"storedInput\" : \"storedOutput\";\n    const storedSchema = definition[storedField];\n    const json = structuredClone(jsonValueSchema.parse(value));\n    let parsed: unknown;\n    try {\n      parsed = (storedSchema ?? definition[field]).parse(structuredClone(json));\n    } catch (cause) {\n      if (storedSchema !== undefined) throw cause;\n      throw new Error(\n        `Workflow ${definition.id}@${definition.version} cannot validate stored ${field}; provide ${storedField} when the ${field} transform changes shape`,\n        { cause },\n      );\n    }\n    const validated = jsonValueSchema.parse(parsed);\n    if (!isDeepStrictEqual(json, validated)) {\n      throw new Error(\n        `Workflow ${definition.id}@${definition.version} stored ${field} validation must preserve canonical JSON; provide a non-transforming ${storedField} schema`,\n      );\n    }\n    return structuredClone(validated);\n  };\n  const validate = (\n    binding: WorkflowBinding,\n    value: unknown,\n    field: \"input\" | \"output\",\n  ): JsonValue => {\n    const definition = resolve(binding);\n    const json = jsonValueSchema.parse(value);\n    const parsed = jsonValueSchema.parse(definition[field].parse(structuredClone(json)));\n    return validateStored(binding, parsed, field);\n  };\n\n  return Object.freeze({\n    definitions: Object.freeze(registered),\n    resolve,\n    validateInput: (binding: WorkflowBinding, value: unknown) => validate(binding, value, \"input\"),\n    validateOutput: (binding: WorkflowBinding, value: unknown) =>\n      validate(binding, value, \"output\"),\n    validateStoredInput: (binding: WorkflowBinding, value: unknown) =>\n      validateStored(binding, value, \"input\"),\n    validateStoredOutput: (binding: WorkflowBinding, value: unknown) =>\n      validateStored(binding, value, \"output\"),\n  });\n}\n"],"mappings":";;;;;;;AAuCA,MAAa,sBAAsB,eAAe;CAChD,IAAI;CACJ,SAAS;CACT,OAAO;CACP,QAAQ;AACV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+JD,SAAgB,eAMd,YAC0D;CAC1D,MAAM,gBAAgB,qBAAqB;EACzC,IAAI,WAAW;EACf,SAAS,WAAW;CACtB,CAAC;CACD,IAAI,EAAE,WAAW,iBAAiB,EAAE,YAAY,EAAE,WAAW,kBAAkB,EAAE,UAC/E,MAAM,IAAI,MACR,YAAY,WAAW,GAAG,GAAG,WAAW,QAAQ,uCAClD;CAEF,KAAK,MAAM,SAAS,CAAC,eAAe,cAAc,GAChD,IAAI,WAAW,WAAW,KAAA,KAAa,EAAE,WAAW,kBAAkB,EAAE,UACtE,MAAM,IAAI,MACR,YAAY,WAAW,GAAG,GAAG,WAAW,QAAQ,kBAAkB,MAAM,QAC1E;CAGJ,MAAM,UAKF,OAAO,OAAO,aAAa;CAM/B,OAAO,OAAO,OAAO;EACnB,IAAI,WAAW;EACf,SAAS,WAAW;EACpB;EACA,OAAO,WAAW;EAClB,QAAQ,WAAW;EACnB,aAAa,WAAW;EACxB,cAAc,WAAW;CAC3B,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAgB,gBACd,aACkD;CAClD,MAAM,aAAa,YAAY,KAAK,eAClC,eAAe,UAAU,CAC3B;CACA,MAAM,4BAAY,IAAI,IAAsD;CAC5E,KAAK,MAAM,cAAc,YAAY;EACnC,MAAM,MAAM,GAAG,WAAW,GAAG,GAAG,WAAW;EAC3C,IAAI,UAAU,IAAI,GAAG,GACnB,MAAM,IAAI,MACR,iCAAiC,IAAI,4CACvC;EAEF,UAAU,IAAI,KAAK,UAAU;CAC/B;CAKA,SAAS,QAAQ,SAAoE;EACnF,MAAM,EAAE,IAAI,YAAY,sBAAsB,MAAM,OAAO;EAC3D,MAAM,MAAM,GAAG,GAAG,GAAG;EACrB,MAAM,aAAa,UAAU,IAAI,GAAG;EACpC,IAAI,CAAC,YAAY;GACf,MAAM,eAAe,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,KAAK;GAChE,MAAM,IAAI,MAAM,oBAAoB,IAAI,0BAA0B,cAAc;EAClF;EACA,OAAO;CACT;CACA,MAAM,kBACJ,SACA,OACA,UACc;EACd,MAAM,aAAa,QAAQ,OAAO;EAClC,MAAM,cAAc,UAAU,UAAU,gBAAgB;EACxD,MAAM,eAAe,WAAW;EAChC,MAAM,OAAO,gBAAgB,gBAAgB,MAAM,KAAK,CAAC;EACzD,IAAI;EACJ,IAAI;GACF,UAAU,gBAAgB,WAAW,OAAA,CAAQ,MAAM,gBAAgB,IAAI,CAAC;EAC1E,SAAS,OAAO;GACd,IAAI,iBAAiB,KAAA,GAAW,MAAM;GACtC,MAAM,IAAI,MACR,YAAY,WAAW,GAAG,GAAG,WAAW,QAAQ,0BAA0B,MAAM,YAAY,YAAY,YAAY,MAAM,2BAC1H,EAAE,MAAM,CACV;EACF;EACA,MAAM,YAAY,gBAAgB,MAAM,MAAM;EAC9C,IAAI,CAAC,kBAAkB,MAAM,SAAS,GACpC,MAAM,IAAI,MACR,YAAY,WAAW,GAAG,GAAG,WAAW,QAAQ,UAAU,MAAM,uEAAuE,YAAY,QACrJ;EAEF,OAAO,gBAAgB,SAAS;CAClC;CACA,MAAM,YACJ,SACA,OACA,UACc;EACd,MAAM,aAAa,QAAQ,OAAO;EAClC,MAAM,OAAO,gBAAgB,MAAM,KAAK;EACxC,MAAM,SAAS,gBAAgB,MAAM,WAAW,MAAM,CAAC,MAAM,gBAAgB,IAAI,CAAC,CAAC;EACnF,OAAO,eAAe,SAAS,QAAQ,KAAK;CAC9C;CAEA,OAAO,OAAO,OAAO;EACnB,aAAa,OAAO,OAAO,UAAU;EACrC;EACA,gBAAgB,SAA0B,UAAmB,SAAS,SAAS,OAAO,OAAO;EAC7F,iBAAiB,SAA0B,UACzC,SAAS,SAAS,OAAO,QAAQ;EACnC,sBAAsB,SAA0B,UAC9C,eAAe,SAAS,OAAO,OAAO;EACxC,uBAAuB,SAA0B,UAC/C,eAAe,SAAS,OAAO,QAAQ;CAC3C,CAAC;AACH"}

package/dist/workspace-files-git.d.mts

@@ -0,0 +1,15 @@
+//#region src/workspace-files-git.d.ts
+/** Configurable bounds for the supplied committed-Git file reader; custom adapters own their limits. */
+interface WorkspaceGitFilesOptions {
+  readonly maxFileBytes?: number;
+  readonly maxDirectoryEntries?: number;
+}
+/**
+ * Reads committed directories or files using Node.js and Git, without changing the checkout.
+ * Pass a JSON file containing root, path, optional revision, maxFileBytes, and maxDirectoryEntries.
+ * The caller adds its authorized executionId and validates the resulting WorkspaceFiles response.
+ */
+declare const workspaceGitFilesScript: string;
+//#endregion
+export { WorkspaceGitFilesOptions, workspaceGitFilesScript };
+//# sourceMappingURL=workspace-files-git.d.mts.map

package/dist/workspace-files-git.mjs

@@ -0,0 +1,61 @@
+//#region src/workspace-files-git.ts
+/**
+* Reads committed directories or files using Node.js and Git, without changing the checkout.
+* Pass a JSON file containing root, path, optional revision, maxFileBytes, and maxDirectoryEntries.
+* The caller adds its authorized executionId and validates the resulting WorkspaceFiles response.
+*/
+const workspaceGitFilesScript = String.raw`
+const fs = require('node:fs');
+const { execFileSync } = require('node:child_process');
+const input = JSON.parse(fs.readFileSync(process.argv[1], 'utf8'));
+const root = fs.realpathSync(input.root);
+const maxBytes = input.maxFileBytes ?? 2000000;
+const maxEntries = input.maxDirectoryEntries ?? 2000;
+const git = (args, encoding = 'utf8') => execFileSync('git', ['--no-optional-locks', '--literal-pathspecs', '-c', 'core.fsmonitor=false', ...args], { cwd: root, encoding, timeout: 10000, maxBuffer: Math.max(16000000, maxBytes + 1024), env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' } });
+const safe = (p) => p === '' || (!p.includes('\\') && !p.includes('\0') && p.split('/').every(v => v && v !== '.' && v !== '..' && v.toLowerCase() !== '.git'));
+const unavailable = (reason) => ({ state: 'unavailable', path: input.path, reason });
+const entryType = (mode, type) => mode === '120000' ? 'symlink' : type === 'tree' ? 'directory' : type === 'commit' ? 'submodule' : 'file';
+function entries(ref, selected) {
+  return git(['ls-tree', '-z', '-l', ref, ...(selected ? ['--', selected] : [])]).split('\0').filter(Boolean).map(line => {
+    const m = /^(\d+) (\w+) ([a-f0-9]+)\s+(-|\d+)\t([\s\S]+)$/u.exec(line);
+    if (!m) throw new Error('Invalid tree entry');
+    return { path: m[5], type: entryType(m[1], m[2]), sha: m[3], size: m[4] === '-' ? null : Number(m[4]) };
+  });
+}
+function inspect() {
+  if (!safe(input.path) || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || !Number.isSafeInteger(maxEntries) || maxEntries < 1) return unavailable('Invalid file inspection options.');
+  if (fs.realpathSync(git(['rev-parse', '--show-toplevel']).trim()) !== root) return unavailable('The workspace checkout is unavailable.');
+  const head = git(['rev-parse', '--verify', 'HEAD']).trim();
+  const revision = input.revision ?? head;
+  if (!/^[a-f0-9]{40,64}$/u.test(revision)) return unavailable('Select an immutable commit from this workspace.');
+  try { git(['merge-base', '--is-ancestor', revision, head]); }
+  catch { return unavailable('This revision is no longer part of the workspace history. Refresh files.'); }
+  const entry = input.path ? entries(revision, input.path).find(e => e.path === input.path) : null;
+  if (input.path && !entry) return unavailable('This path does not exist at the selected revision.');
+  if (!entry || entry.type === 'directory') {
+    const all = entries(entry ? entry.sha : revision);
+    const children = all.slice(0, maxEntries).map(e => ({ name: e.path, path: input.path ? input.path + '/' + e.path : e.path, type: e.type, size: e.size }));
+    if (children.some(e => !safe(e.path))) return unavailable('The directory contains an unsupported path.');
+    return { state: 'directory', path: input.path, revision, entries: children, truncated: all.length > maxEntries };
+  }
+  const metadata = { name: input.path.split('/').at(-1), path: input.path, type: entry.type, size: entry.size };
+  const result = content => ({ state: 'file', path: input.path, revision, entry: metadata, content });
+  if (entry.type === 'submodule') return result({ kind: 'unavailable', reason: 'Submodule contents belong to a separate repository.' });
+  if (entry.size === null || entry.size > maxBytes) return result({ kind: 'unavailable', reason: 'This file exceeds the configured ' + maxBytes.toLocaleString('en-US') + '-byte preview limit.' });
+  const bytes = git(['cat-file', 'blob', entry.sha], null);
+  if (bytes.length > maxBytes) return result({ kind: 'unavailable', reason: 'This file exceeds the configured preview limit.' });
+  const ext = input.path.split('.').at(-1).toLowerCase();
+  const mediaType = { png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp', avif: 'image/avif', svg: 'image/svg+xml' }[ext];
+  if (mediaType && entry.type === 'file') return result({ kind: 'image', mediaType, base64: bytes.toString('base64') });
+  try {
+    if (bytes.includes(0)) throw new Error('Binary');
+    return result({ kind: 'text', text: new TextDecoder('utf-8', { fatal: true }).decode(bytes) });
+  } catch { return result({ kind: 'unavailable', reason: 'This binary format cannot be previewed.' }); }
+}
+try { process.stdout.write(JSON.stringify(inspect())); }
+catch { process.stdout.write(JSON.stringify(unavailable('The committed file could not be read. Refresh files after the current Git operation finishes.'))); }
+`;
+//#endregion
+export { workspaceGitFilesScript };
+
+//# sourceMappingURL=workspace-files-git.mjs.map

package/dist/workspace-files-git.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-files-git.mjs","names":[],"sources":["../src/workspace-files-git.ts"],"sourcesContent":["/** Configurable bounds for the supplied committed-Git file reader; custom adapters own their limits. */\nexport interface WorkspaceGitFilesOptions {\n  readonly maxFileBytes?: number;\n  readonly maxDirectoryEntries?: number;\n}\n\n/**\n * Reads committed directories or files using Node.js and Git, without changing the checkout.\n * Pass a JSON file containing root, path, optional revision, maxFileBytes, and maxDirectoryEntries.\n * The caller adds its authorized executionId and validates the resulting WorkspaceFiles response.\n */\nexport const workspaceGitFilesScript = String.raw`\nconst fs = require('node:fs');\nconst { execFileSync } = require('node:child_process');\nconst input = JSON.parse(fs.readFileSync(process.argv[1], 'utf8'));\nconst root = fs.realpathSync(input.root);\nconst maxBytes = input.maxFileBytes ?? 2000000;\nconst maxEntries = input.maxDirectoryEntries ?? 2000;\nconst git = (args, encoding = 'utf8') => execFileSync('git', ['--no-optional-locks', '--literal-pathspecs', '-c', 'core.fsmonitor=false', ...args], { cwd: root, encoding, timeout: 10000, maxBuffer: Math.max(16000000, maxBytes + 1024), env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' } });\nconst safe = (p) => p === '' || (!p.includes('\\\\') && !p.includes('\\0') && p.split('/').every(v => v && v !== '.' && v !== '..' && v.toLowerCase() !== '.git'));\nconst unavailable = (reason) => ({ state: 'unavailable', path: input.path, reason });\nconst entryType = (mode, type) => mode === '120000' ? 'symlink' : type === 'tree' ? 'directory' : type === 'commit' ? 'submodule' : 'file';\nfunction entries(ref, selected) {\n  return git(['ls-tree', '-z', '-l', ref, ...(selected ? ['--', selected] : [])]).split('\\0').filter(Boolean).map(line => {\n    const m = /^(\\d+) (\\w+) ([a-f0-9]+)\\s+(-|\\d+)\\t([\\s\\S]+)$/u.exec(line);\n    if (!m) throw new Error('Invalid tree entry');\n    return { path: m[5], type: entryType(m[1], m[2]), sha: m[3], size: m[4] === '-' ? null : Number(m[4]) };\n  });\n}\nfunction inspect() {\n  if (!safe(input.path) || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || !Number.isSafeInteger(maxEntries) || maxEntries < 1) return unavailable('Invalid file inspection options.');\n  if (fs.realpathSync(git(['rev-parse', '--show-toplevel']).trim()) !== root) return unavailable('The workspace checkout is unavailable.');\n  const head = git(['rev-parse', '--verify', 'HEAD']).trim();\n  const revision = input.revision ?? head;\n  if (!/^[a-f0-9]{40,64}$/u.test(revision)) return unavailable('Select an immutable commit from this workspace.');\n  try { git(['merge-base', '--is-ancestor', revision, head]); }\n  catch { return unavailable('This revision is no longer part of the workspace history. Refresh files.'); }\n  const entry = input.path ? entries(revision, input.path).find(e => e.path === input.path) : null;\n  if (input.path && !entry) return unavailable('This path does not exist at the selected revision.');\n  if (!entry || entry.type === 'directory') {\n    const all = entries(entry ? entry.sha : revision);\n    const children = all.slice(0, maxEntries).map(e => ({ name: e.path, path: input.path ? input.path + '/' + e.path : e.path, type: e.type, size: e.size }));\n    if (children.some(e => !safe(e.path))) return unavailable('The directory contains an unsupported path.');\n    return { state: 'directory', path: input.path, revision, entries: children, truncated: all.length > maxEntries };\n  }\n  const metadata = { name: input.path.split('/').at(-1), path: input.path, type: entry.type, size: entry.size };\n  const result = content => ({ state: 'file', path: input.path, revision, entry: metadata, content });\n  if (entry.type === 'submodule') return result({ kind: 'unavailable', reason: 'Submodule contents belong to a separate repository.' });\n  if (entry.size === null || entry.size > maxBytes) return result({ kind: 'unavailable', reason: 'This file exceeds the configured ' + maxBytes.toLocaleString('en-US') + '-byte preview limit.' });\n  const bytes = git(['cat-file', 'blob', entry.sha], null);\n  if (bytes.length > maxBytes) return result({ kind: 'unavailable', reason: 'This file exceeds the configured preview limit.' });\n  const ext = input.path.split('.').at(-1).toLowerCase();\n  const mediaType = { png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp', avif: 'image/avif', svg: 'image/svg+xml' }[ext];\n  if (mediaType && entry.type === 'file') return result({ kind: 'image', mediaType, base64: bytes.toString('base64') });\n  try {\n    if (bytes.includes(0)) throw new Error('Binary');\n    return result({ kind: 'text', text: new TextDecoder('utf-8', { fatal: true }).decode(bytes) });\n  } catch { return result({ kind: 'unavailable', reason: 'This binary format cannot be previewed.' }); }\n}\ntry { process.stdout.write(JSON.stringify(inspect())); }\ncatch { process.stdout.write(JSON.stringify(unavailable('The committed file could not be read. Refresh files after the current Git operation finishes.'))); }\n`;\n"],"mappings":";;;;;;AAWA,MAAa,0BAA0B,OAAO,GAAG"}

package/dist/workspace-files.d.mts

@@ -0,0 +1,107 @@
+import { z } from "zod";
+//#region src/workspace-files.d.ts
+/** Validates a workspace-relative path, with the empty string identifying the root. */
+declare const workspacePathSchema: z.ZodString;
+/** Validates a directory or file inspection at an optional provider-owned immutable revision. */
+declare const workspaceFilesRequestSchema: z.ZodObject<{
+  path: z.ZodDefault<z.ZodString>;
+  revision: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** A directory or file inspection at an optional provider-owned immutable revision. */
+type WorkspaceFilesRequest = Readonly<z.input<typeof workspaceFilesRequestSchema>>;
+/** Validates an immediate child of a workspace directory. */
+declare const workspaceFileEntrySchema: z.ZodObject<{
+  name: z.ZodString;
+  path: z.ZodString;
+  type: z.ZodEnum<{
+    file: "file";
+    directory: "directory";
+    symlink: "symlink";
+    submodule: "submodule";
+  }>;
+  size: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>;
+/** An immediate child of a workspace directory. */
+type WorkspaceFileEntry = Readonly<z.infer<typeof workspaceFileEntrySchema>>;
+/** Validates text, an image, or an explicit explanation for an undisplayable file. */
+declare const workspaceFileContentSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  kind: z.ZodLiteral<"text">;
+  text: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"image">;
+  mediaType: z.ZodEnum<{
+    "image/png": "image/png";
+    "image/jpeg": "image/jpeg";
+    "image/webp": "image/webp";
+    "image/gif": "image/gif";
+    "image/avif": "image/avif";
+    "image/svg+xml": "image/svg+xml";
+  }>;
+  base64: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  kind: z.ZodLiteral<"unavailable">;
+  reason: z.ZodString;
+}, z.core.$strict>], "kind">;
+/** Validates a pinned directory listing, a complete file, or an unavailable workspace response. */
+declare const workspaceFilesSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  state: z.ZodLiteral<"directory">;
+  revision: z.ZodString;
+  entries: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    path: z.ZodString;
+    type: z.ZodEnum<{
+      file: "file";
+      directory: "directory";
+      symlink: "symlink";
+      submodule: "submodule";
+    }>;
+    size: z.ZodNullable<z.ZodNumber>;
+  }, z.core.$strict>>>;
+  truncated: z.ZodBoolean;
+  executionId: z.ZodNullable<z.ZodString>;
+  path: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  state: z.ZodLiteral<"file">;
+  revision: z.ZodString;
+  entry: z.ZodObject<{
+    name: z.ZodString;
+    path: z.ZodString;
+    type: z.ZodEnum<{
+      file: "file";
+      directory: "directory";
+      symlink: "symlink";
+      submodule: "submodule";
+    }>;
+    size: z.ZodNullable<z.ZodNumber>;
+  }, z.core.$strict>;
+  content: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"text">;
+    text: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"image">;
+    mediaType: z.ZodEnum<{
+      "image/png": "image/png";
+      "image/jpeg": "image/jpeg";
+      "image/webp": "image/webp";
+      "image/gif": "image/gif";
+      "image/avif": "image/avif";
+      "image/svg+xml": "image/svg+xml";
+    }>;
+    base64: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"unavailable">;
+    reason: z.ZodString;
+  }, z.core.$strict>], "kind">;
+  executionId: z.ZodNullable<z.ZodString>;
+  path: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  state: z.ZodLiteral<"unavailable">;
+  reason: z.ZodString;
+  executionId: z.ZodNullable<z.ZodString>;
+  path: z.ZodString;
+}, z.core.$strict>], "state">;
+/** A pinned directory listing, complete file, or unavailable workspace response. */
+type WorkspaceFiles = Readonly<z.infer<typeof workspaceFilesSchema>>;
+//#endregion
+export { WorkspaceFileEntry, WorkspaceFiles, WorkspaceFilesRequest, workspaceFileContentSchema, workspaceFileEntrySchema, workspaceFilesRequestSchema, workspaceFilesSchema, workspacePathSchema };
+//# sourceMappingURL=workspace-files.d.mts.map

package/dist/workspace-files.mjs

@@ -0,0 +1,74 @@
+import { z } from "zod";
+//#region src/workspace-files.ts
+/** Validates a workspace-relative path, with the empty string identifying the root. */
+const workspacePathSchema = z.string().refine((path) => path === "" || !path.includes("\\") && !path.includes("\0") && path.split("/").every((part) => part !== "" && part !== "." && part !== ".." && part.toLowerCase() !== ".git"), "Use a workspace-relative path without traversal or Git metadata");
+/** Validates a directory or file inspection at an optional provider-owned immutable revision. */
+const workspaceFilesRequestSchema = z.strictObject({
+	path: workspacePathSchema.default("").describe("Workspace-relative file or directory; empty for root."),
+	revision: z.string().min(1).optional().describe("Opaque immutable revision; absent selects the current revision.")
+});
+/** Validates an immediate child of a workspace directory. */
+const workspaceFileEntrySchema = z.strictObject({
+	name: z.string().min(1).describe("Display name within its parent directory."),
+	path: workspacePathSchema.describe("Workspace-relative entry path."),
+	type: z.enum([
+		"file",
+		"directory",
+		"symlink",
+		"submodule"
+	]).describe("Entry kind; links are never followed."),
+	size: z.number().int().nonnegative().nullable().describe("Byte length when known; null for directories or unknown sizes.")
+});
+/** Validates text, an image, or an explicit explanation for an undisplayable file. */
+const workspaceFileContentSchema = z.discriminatedUnion("kind", [
+	z.strictObject({
+		kind: z.literal("text").describe("Complete UTF-8 text, including an empty file."),
+		text: z.string().describe("Complete file contents; never a silently truncated prefix.")
+	}),
+	z.strictObject({
+		kind: z.literal("image").describe("Image bytes rendered in an image element, never as HTML."),
+		mediaType: z.enum([
+			"image/png",
+			"image/jpeg",
+			"image/gif",
+			"image/webp",
+			"image/avif",
+			"image/svg+xml"
+		]).describe("Image media type."),
+		base64: z.string().regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u).describe("Base64-encoded image bytes.")
+	}),
+	z.strictObject({
+		kind: z.literal("unavailable").describe("File exists but its content cannot be displayed."),
+		reason: z.string().min(1).describe("Why content is unavailable, such as a size limit or binary format.")
+	})
+]);
+const common = {
+	executionId: z.string().min(1).nullable().describe("Authorized execution whose workspace is being inspected."),
+	path: workspacePathSchema.describe("Requested workspace-relative path.")
+};
+/** Validates a pinned directory listing, a complete file, or an unavailable workspace response. */
+const workspaceFilesSchema = z.discriminatedUnion("state", [
+	z.strictObject({
+		...common,
+		state: z.literal("directory").describe("A directory listing at the returned revision."),
+		revision: z.string().min(1).describe("Immutable provider-owned revision for subsequent reads."),
+		entries: z.array(workspaceFileEntrySchema).readonly().describe("Immediate directory children."),
+		truncated: z.boolean().describe("The provider's configured directory limit omitted entries.")
+	}),
+	z.strictObject({
+		...common,
+		state: z.literal("file").describe("A file at the returned revision."),
+		revision: z.string().min(1).describe("Immutable provider-owned revision for subsequent reads."),
+		entry: workspaceFileEntrySchema.describe("Metadata for the requested file."),
+		content: workspaceFileContentSchema.describe("Complete contents or an explicit unavailability reason.")
+	}),
+	z.strictObject({
+		...common,
+		state: z.literal("unavailable").describe("The requested workspace, revision, or path cannot be read."),
+		reason: z.string().min(1).describe("Why the requested inspection is unavailable.")
+	})
+]);
+//#endregion
+export { workspaceFileContentSchema, workspaceFileEntrySchema, workspaceFilesRequestSchema, workspaceFilesSchema, workspacePathSchema };
+
+//# sourceMappingURL=workspace-files.mjs.map

package/dist/workspace-files.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-files.mjs","names":[],"sources":["../src/workspace-files.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Validates a workspace-relative path, with the empty string identifying the root. */\nexport const workspacePathSchema = z\n  .string()\n  .refine(\n    (path) =>\n      path === \"\" ||\n      (!path.includes(\"\\\\\") &&\n        !path.includes(\"\\0\") &&\n        path\n          .split(\"/\")\n          .every(\n            (part) => part !== \"\" && part !== \".\" && part !== \"..\" && part.toLowerCase() !== \".git\",\n          )),\n    \"Use a workspace-relative path without traversal or Git metadata\",\n  );\n\n/** Validates a directory or file inspection at an optional provider-owned immutable revision. */\nexport const workspaceFilesRequestSchema = z.strictObject({\n  path: workspacePathSchema\n    .default(\"\")\n    .describe(\"Workspace-relative file or directory; empty for root.\"),\n  revision: z\n    .string()\n    .min(1)\n    .optional()\n    .describe(\"Opaque immutable revision; absent selects the current revision.\"),\n});\n\n/** A directory or file inspection at an optional provider-owned immutable revision. */\nexport type WorkspaceFilesRequest = Readonly<z.input<typeof workspaceFilesRequestSchema>>;\n\n/** Validates an immediate child of a workspace directory. */\nexport const workspaceFileEntrySchema = z.strictObject({\n  name: z.string().min(1).describe(\"Display name within its parent directory.\"),\n  path: workspacePathSchema.describe(\"Workspace-relative entry path.\"),\n  type: z\n    .enum([\"file\", \"directory\", \"symlink\", \"submodule\"])\n    .describe(\"Entry kind; links are never followed.\"),\n  size: z\n    .number()\n    .int()\n    .nonnegative()\n    .nullable()\n    .describe(\"Byte length when known; null for directories or unknown sizes.\"),\n});\n\n/** An immediate child of a workspace directory. */\nexport type WorkspaceFileEntry = Readonly<z.infer<typeof workspaceFileEntrySchema>>;\n\n/** Validates text, an image, or an explicit explanation for an undisplayable file. */\nexport const workspaceFileContentSchema = z.discriminatedUnion(\"kind\", [\n  z.strictObject({\n    kind: z.literal(\"text\").describe(\"Complete UTF-8 text, including an empty file.\"),\n    text: z.string().describe(\"Complete file contents; never a silently truncated prefix.\"),\n  }),\n  z.strictObject({\n    kind: z.literal(\"image\").describe(\"Image bytes rendered in an image element, never as HTML.\"),\n    mediaType: z\n      .enum([\"image/png\", \"image/jpeg\", \"image/gif\", \"image/webp\", \"image/avif\", \"image/svg+xml\"])\n      .describe(\"Image media type.\"),\n    base64: z\n      .string()\n      .regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u)\n      .describe(\"Base64-encoded image bytes.\"),\n  }),\n  z.strictObject({\n    kind: z.literal(\"unavailable\").describe(\"File exists but its content cannot be displayed.\"),\n    reason: z\n      .string()\n      .min(1)\n      .describe(\"Why content is unavailable, such as a size limit or binary format.\"),\n  }),\n]);\n\nconst common = {\n  executionId: z\n    .string()\n    .min(1)\n    .nullable()\n    .describe(\"Authorized execution whose workspace is being inspected.\"),\n  path: workspacePathSchema.describe(\"Requested workspace-relative path.\"),\n};\n\n/** Validates a pinned directory listing, a complete file, or an unavailable workspace response. */\nexport const workspaceFilesSchema = z.discriminatedUnion(\"state\", [\n  z.strictObject({\n    ...common,\n    state: z.literal(\"directory\").describe(\"A directory listing at the returned revision.\"),\n    revision: z.string().min(1).describe(\"Immutable provider-owned revision for subsequent reads.\"),\n    entries: z.array(workspaceFileEntrySchema).readonly().describe(\"Immediate directory children.\"),\n    truncated: z.boolean().describe(\"The provider's configured directory limit omitted entries.\"),\n  }),\n  z.strictObject({\n    ...common,\n    state: z.literal(\"file\").describe(\"A file at the returned revision.\"),\n    revision: z.string().min(1).describe(\"Immutable provider-owned revision for subsequent reads.\"),\n    entry: workspaceFileEntrySchema.describe(\"Metadata for the requested file.\"),\n    content: workspaceFileContentSchema.describe(\n      \"Complete contents or an explicit unavailability reason.\",\n    ),\n  }),\n  z.strictObject({\n    ...common,\n    state: z\n      .literal(\"unavailable\")\n      .describe(\"The requested workspace, revision, or path cannot be read.\"),\n    reason: z.string().min(1).describe(\"Why the requested inspection is unavailable.\"),\n  }),\n]);\n\n/** A pinned directory listing, complete file, or unavailable workspace response. */\nexport type WorkspaceFiles = Readonly<z.infer<typeof workspaceFilesSchema>>;\n"],"mappings":";;;AAGA,MAAa,sBAAsB,EAChC,OAAO,CAAC,CACR,QACE,SACC,SAAS,MACR,CAAC,KAAK,SAAS,IAAI,KAClB,CAAC,KAAK,SAAS,IAAI,KACnB,KACG,MAAM,GAAG,CAAC,CACV,OACE,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,QAAQ,KAAK,YAAY,MAAM,MACnF,GACN,iEACF;;AAGF,MAAa,8BAA8B,EAAE,aAAa;CACxD,MAAM,oBACH,QAAQ,EAAE,CAAC,CACX,SAAS,uDAAuD;CACnE,UAAU,EACP,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,iEAAiE;AAC/E,CAAC;;AAMD,MAAa,2BAA2B,EAAE,aAAa;CACrD,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,2CAA2C;CAC5E,MAAM,oBAAoB,SAAS,gCAAgC;CACnE,MAAM,EACH,KAAK;EAAC;EAAQ;EAAa;EAAW;CAAW,CAAC,CAAC,CACnD,SAAS,uCAAuC;CACnD,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CACL,YAAY,CAAC,CACb,SAAS,CAAC,CACV,SAAS,gEAAgE;AAC9E,CAAC;;AAMD,MAAa,6BAA6B,EAAE,mBAAmB,QAAQ;CACrE,EAAE,aAAa;EACb,MAAM,EAAE,QAAQ,MAAM,CAAC,CAAC,SAAS,+CAA+C;EAChF,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,4DAA4D;CACxF,CAAC;CACD,EAAE,aAAa;EACb,MAAM,EAAE,QAAQ,OAAO,CAAC,CAAC,SAAS,0DAA0D;EAC5F,WAAW,EACR,KAAK;GAAC;GAAa;GAAc;GAAa;GAAc;GAAc;EAAe,CAAC,CAAC,CAC3F,SAAS,mBAAmB;EAC/B,QAAQ,EACL,OAAO,CAAC,CACR,MAAM,mEAAmE,CAAC,CAC1E,SAAS,6BAA6B;CAC3C,CAAC;CACD,EAAE,aAAa;EACb,MAAM,EAAE,QAAQ,aAAa,CAAC,CAAC,SAAS,kDAAkD;EAC1F,QAAQ,EACL,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SAAS,oEAAoE;CAClF,CAAC;AACH,CAAC;AAED,MAAM,SAAS;CACb,aAAa,EACV,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,0DAA0D;CACtE,MAAM,oBAAoB,SAAS,oCAAoC;AACzE;;AAGA,MAAa,uBAAuB,EAAE,mBAAmB,SAAS;CAChE,EAAE,aAAa;EACb,GAAG;EACH,OAAO,EAAE,QAAQ,WAAW,CAAC,CAAC,SAAS,+CAA+C;EACtF,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,yDAAyD;EAC9F,SAAS,EAAE,MAAM,wBAAwB,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,+BAA+B;EAC9F,WAAW,EAAE,QAAQ,CAAC,CAAC,SAAS,4DAA4D;CAC9F,CAAC;CACD,EAAE,aAAa;EACb,GAAG;EACH,OAAO,EAAE,QAAQ,MAAM,CAAC,CAAC,SAAS,kCAAkC;EACpE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,yDAAyD;EAC9F,OAAO,yBAAyB,SAAS,kCAAkC;EAC3E,SAAS,2BAA2B,SAClC,yDACF;CACF,CAAC;CACD,EAAE,aAAa;EACb,GAAG;EACH,OAAO,EACJ,QAAQ,aAAa,CAAC,CACtB,SAAS,4DAA4D;EACxE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,8CAA8C;CACnF,CAAC;AACH,CAAC"}