@vercel/factory 0.0.15 → 0.0.17

package/dist/vercel-git.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-git.mjs","names":[],"sources":["../src/vercel-git.ts"],"sourcesContent":["import type { Sandbox, NetworkPolicy } from \"@vercel/sandbox\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport { isSafeGitRef } from \"./github-publication\";\nimport { maxGitBundleBytes, validateGitBundle, type GitHubGitTransport } from \"./github-transfer\";\n\n/** Repository and access level used to mint one trusted Git transport token. */\nexport interface VercelGitHubTokenInput {\n  repository: RepositorySlug;\n  access: \"read\" | \"write\";\n}\n\n/** Configures fresh trusted sandboxes and repository-scoped Git tokens. */\nexport interface VercelGitHubGitTransportOptions {\n  /** Reads must mint contents:read credentials; writes are confined to the supplied repository. */\n  token(input: VercelGitHubTokenInput): Promise<string>;\n  /** Creates a fresh sandbox, without a snapshot, repository, or running agent. */\n  createSandbox?: () => Promise<\n    Pick<Sandbox, \"runCommand\" | \"writeFiles\" | \"readFileToBuffer\" | \"updateNetworkPolicy\" | \"stop\">\n  >;\n}\n\nfunction credentialPolicy(repository: RepositorySlug, token: string): NetworkPolicy {\n  return {\n    allow: {\n      \"github.com\": [\n        {\n          match: { path: { startsWith: `/${repository}.git/` } },\n          transform: [\n            {\n              headers: {\n                authorization: `Basic ${Buffer.from(`x-access-token:${token}`).toString(\"base64\")}`,\n              },\n            },\n          ],\n        },\n      ],\n    },\n  };\n}\n\n/** Transfer Git objects through fresh trusted sandboxes; credentials never reach an agent sandbox. */\nexport function createVercelGitHubGitTransport(\n  options: VercelGitHubGitTransportOptions,\n): GitHubGitTransport {\n  async function isolated<T>(\n    repository: RepositorySlug,\n    use: (\n      sandbox: Awaited<ReturnType<NonNullable<VercelGitHubGitTransportOptions[\"createSandbox\"]>>>,\n      git: (...args: string[]) => Promise<string>,\n      repository: RepositorySlug,\n    ) => Promise<T>,\n  ): Promise<T> {\n    const slug = repositorySlugSchema.parse(repository.toLowerCase());\n    const sandbox = options.createSandbox\n      ? await options.createSandbox()\n      : await (\n          await import(\"@vercel/sandbox\")\n        ).Sandbox.create({ runtime: \"node24\", timeout: 180_000, networkPolicy: \"deny-all\" });\n    async function git(...args: string[]): Promise<string> {\n      const result = await sandbox.runCommand({\n        cmd: \"/usr/bin/env\",\n        args: [\n          \"-i\",\n          \"PATH=/usr/bin:/bin\",\n          \"HOME=/tmp\",\n          \"GIT_CONFIG_NOSYSTEM=1\",\n          \"GIT_CONFIG_GLOBAL=/dev/null\",\n          \"GIT_TERMINAL_PROMPT=0\",\n          \"git\",\n          \"-c\",\n          \"core.hooksPath=/dev/null\",\n          \"-c\",\n          \"credential.helper=\",\n          \"-c\",\n          \"protocol.ext.allow=never\",\n          \"-c\",\n          \"protocol.file.allow=always\",\n          \"-c\",\n          \"http.followRedirects=false\",\n          ...args,\n        ],\n        timeoutMs: 120_000,\n      });\n      if (result.exitCode !== 0)\n        throw new Error(`Trusted Git operation failed (${result.exitCode})`);\n      return (await result.stdout()).trim();\n    }\n    try {\n      await sandbox.updateNetworkPolicy(\"deny-all\");\n      return await use(sandbox, git, slug);\n    } finally {\n      try {\n        await sandbox.updateNetworkPolicy(\"deny-all\");\n      } finally {\n        await sandbox.stop();\n      }\n    }\n  }\n  return {\n    async fetch(input) {\n      if (input.refs.some((ref) => !ref.startsWith(\"refs/\") || !isSafeGitRef(ref)))\n        throw new Error(\"Invalid Git fetch ref\");\n      return isolated(input.repository, async (sandbox, git, slug) => {\n        await sandbox.updateNetworkPolicy(\n          credentialPolicy(slug, await options.token({ repository: slug, access: \"read\" })),\n        );\n        await git(\n          \"clone\",\n          \"--bare\",\n          \"--no-hardlinks\",\n          `https://github.com/${slug}.git`,\n          \"/tmp/transfer.git\",\n        );\n        if (input.refs.length)\n          await git(\n            \"-C\",\n            \"/tmp/transfer.git\",\n            \"fetch\",\n            \"--no-tags\",\n            \"origin\",\n            ...input.refs.map((ref) => `+${ref}:${ref}`),\n          );\n        await sandbox.updateNetworkPolicy(\"deny-all\");\n        await git(\"-C\", \"/tmp/transfer.git\", \"bundle\", \"create\", \"/tmp/transfer.bundle\", \"--all\");\n        const size = await sandbox.runCommand({\n          cmd: \"stat\",\n          args: [\"-c\", \"%s\", \"/tmp/transfer.bundle\"],\n        });\n        const byteLength = Number(await size.stdout());\n        if (\n          size.exitCode !== 0 ||\n          !Number.isSafeInteger(byteLength) ||\n          byteLength < 1 ||\n          byteLength > maxGitBundleBytes\n        )\n          throw new Error(\"Git bundle exceeds transfer limit\");\n        const data = await sandbox.readFileToBuffer({ path: \"/tmp/transfer.bundle\" });\n        if (!data || data.length > maxGitBundleBytes) throw new Error(\"Invalid Git bundle size\");\n        const bundle = { base64: data.toString(\"base64\") };\n        validateGitBundle(bundle);\n        return bundle;\n      });\n    },\n    async push(input) {\n      if (\n        !isSafeGitRef(input.branch) ||\n        !/^[a-f0-9]{40}$/.test(input.head) ||\n        !/^[a-f0-9]{40}$/.test(input.expectedHead)\n      )\n        throw new Error(\"Invalid Git publication target\");\n      const bundle = validateGitBundle(input.bundle);\n      await isolated(input.repository, async (sandbox, git, slug) => {\n        await git(\"init\", \"--bare\", \"/tmp/transfer.git\");\n        await sandbox.writeFiles([{ path: \"/tmp/transfer.bundle\", content: bundle }]);\n        await git(\"-C\", \"/tmp/transfer.git\", \"bundle\", \"verify\", \"/tmp/transfer.bundle\");\n        await git(\n          \"-C\",\n          \"/tmp/transfer.git\",\n          \"fetch\",\n          \"/tmp/transfer.bundle\",\n          \"HEAD:refs/heads/candidate\",\n        );\n        if (\n          (await git(\"-C\", \"/tmp/transfer.git\", \"rev-parse\", \"refs/heads/candidate\")) !== input.head\n        )\n          throw new Error(\"Git bundle head does not match publication target\");\n        await sandbox.updateNetworkPolicy(\n          credentialPolicy(slug, await options.token({ repository: slug, access: \"write\" })),\n        );\n        await git(\n          \"-C\",\n          \"/tmp/transfer.git\",\n          \"push\",\n          `--force-with-lease=refs/heads/${input.branch}:${input.expectedHead}`,\n          `https://github.com/${slug}.git`,\n          `${input.head}:refs/heads/${input.branch}`,\n        );\n      });\n    },\n  };\n}\n"],"mappings":";;;;AAqBA,SAAS,iBAAiB,YAA4B,OAA8B;CAClF,OAAO,EACL,OAAO,EACL,cAAc,CACZ;EACE,OAAO,EAAE,MAAM,EAAE,YAAY,IAAI,WAAW,OAAO,EAAE;EACrD,WAAW,CACT,EACE,SAAS,EACP,eAAe,SAAS,OAAO,KAAK,kBAAkB,OAAO,CAAC,CAAC,SAAS,QAAQ,IAClF,EACF,CACF;CACF,CACF,EACF,EACF;AACF;;AAGA,SAAgB,+BACd,SACoB;CACpB,eAAe,SACb,YACA,KAKY;EACZ,MAAM,OAAO,qBAAqB,MAAM,WAAW,YAAY,CAAC;EAChE,MAAM,UAAU,QAAQ,gBACpB,MAAM,QAAQ,cAAc,IAC5B,OACE,MAAM,OAAO,mBAAA,CACb,QAAQ,OAAO;GAAE,SAAS;GAAU,SAAS;GAAS,eAAe;EAAW,CAAC;EACvF,eAAe,IAAI,GAAG,MAAiC;GACrD,MAAM,SAAS,MAAM,QAAQ,WAAW;IACtC,KAAK;IACL,MAAM;KACJ;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA,GAAG;IACL;IACA,WAAW;GACb,CAAC;GACD,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,iCAAiC,OAAO,SAAS,EAAE;GACrE,QAAQ,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;EACtC;EACA,IAAI;GACF,MAAM,QAAQ,oBAAoB,UAAU;GAC5C,OAAO,MAAM,IAAI,SAAS,KAAK,IAAI;EACrC,UAAU;GACR,IAAI;IACF,MAAM,QAAQ,oBAAoB,UAAU;GAC9C,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;CACF;CACA,OAAO;EACL,MAAM,MAAM,OAAO;GACjB,IAAI,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,aAAa,GAAG,CAAC,GACzE,MAAM,IAAI,MAAM,uBAAuB;GACzC,OAAO,SAAS,MAAM,YAAY,OAAO,SAAS,KAAK,SAAS;IAC9D,MAAM,QAAQ,oBACZ,iBAAiB,MAAM,MAAM,QAAQ,MAAM;KAAE,YAAY;KAAM,QAAQ;IAAO,CAAC,CAAC,CAClF;IACA,MAAM,IACJ,SACA,UACA,kBACA,sBAAsB,KAAK,OAC3B,mBACF;IACA,IAAI,MAAM,KAAK,QACb,MAAM,IACJ,MACA,qBACA,SACA,aACA,UACA,GAAG,MAAM,KAAK,KAAK,QAAQ,IAAI,IAAI,GAAG,KAAK,CAC7C;IACF,MAAM,QAAQ,oBAAoB,UAAU;IAC5C,MAAM,IAAI,MAAM,qBAAqB,UAAU,UAAU,wBAAwB,OAAO;IACxF,MAAM,OAAO,MAAM,QAAQ,WAAW;KACpC,KAAK;KACL,MAAM;MAAC;MAAM;MAAM;KAAsB;IAC3C,CAAC;IACD,MAAM,aAAa,OAAO,MAAM,KAAK,OAAO,CAAC;IAC7C,IACE,KAAK,aAAa,KAClB,CAAC,OAAO,cAAc,UAAU,KAChC,aAAa,KACb,aAAA,UAEA,MAAM,IAAI,MAAM,mCAAmC;IACrD,MAAM,OAAO,MAAM,QAAQ,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;IAC5E,IAAI,CAAC,QAAQ,KAAK,SAAA,UAA4B,MAAM,IAAI,MAAM,yBAAyB;IACvF,MAAM,SAAS,EAAE,QAAQ,KAAK,SAAS,QAAQ,EAAE;IACjD,kBAAkB,MAAM;IACxB,OAAO;GACT,CAAC;EACH;EACA,MAAM,KAAK,OAAO;GAChB,IACE,CAAC,aAAa,MAAM,MAAM,KAC1B,CAAC,iBAAiB,KAAK,MAAM,IAAI,KACjC,CAAC,iBAAiB,KAAK,MAAM,YAAY,GAEzC,MAAM,IAAI,MAAM,gCAAgC;GAClD,MAAM,SAAS,kBAAkB,MAAM,MAAM;GAC7C,MAAM,SAAS,MAAM,YAAY,OAAO,SAAS,KAAK,SAAS;IAC7D,MAAM,IAAI,QAAQ,UAAU,mBAAmB;IAC/C,MAAM,QAAQ,WAAW,CAAC;KAAE,MAAM;KAAwB,SAAS;IAAO,CAAC,CAAC;IAC5E,MAAM,IAAI,MAAM,qBAAqB,UAAU,UAAU,sBAAsB;IAC/E,MAAM,IACJ,MACA,qBACA,SACA,wBACA,2BACF;IACA,IACG,MAAM,IAAI,MAAM,qBAAqB,aAAa,sBAAsB,MAAO,MAAM,MAEtF,MAAM,IAAI,MAAM,mDAAmD;IACrE,MAAM,QAAQ,oBACZ,iBAAiB,MAAM,MAAM,QAAQ,MAAM;KAAE,YAAY;KAAM,QAAQ;IAAQ,CAAC,CAAC,CACnF;IACA,MAAM,IACJ,MACA,qBACA,QACA,iCAAiC,MAAM,OAAO,GAAG,MAAM,gBACvD,sBAAsB,KAAK,OAC3B,GAAG,MAAM,KAAK,cAAc,MAAM,QACpC;GACF,CAAC;EACH;CACF;AACF"}
+{"version":3,"file":"vercel-git.mjs","names":[],"sources":["../src/vercel-git.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { Readable } from \"node:stream\";\nimport type { Sandbox, NetworkPolicy } from \"@vercel/sandbox\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport { isSafeGitRef } from \"./github-publication\";\nimport {\n  maxGitBundleBytes,\n  withSandboxGitBundle,\n  type GitHubGitTransport,\n  type GitHubRepositoryBundle,\n} from \"./github-transfer\";\n\ntype TrustedGitSandbox = Pick<\n  Sandbox,\n  \"cwd\" | \"runCommand\" | \"writeFiles\" | \"readFile\" | \"updateNetworkPolicy\" | \"stop\"\n>;\n\n/** Exact creation request for a fresh Vercel-managed trusted Git publication Sandbox. */\nexport interface VercelManagedGitHubSandboxCreateInput {\n  source: {\n    type: \"git\";\n    url: string;\n  };\n  __source_credentials: true;\n  __commitAs: {\n    name: string;\n    email: string;\n  };\n  networkPolicy: NetworkPolicy;\n  persistent: false;\n  resources: { vcpus: 6 };\n  runtime: \"node24\";\n  timeout: number;\n}\n\nconst gitOidPattern = /^[a-f0-9]{40}$/u;\nconst absentGitOid = \"0\".repeat(40);\nconst managedGitTimeoutMs = 180_000;\n\n/** Repository and access level used to mint one trusted Git transport token. */\nexport interface VercelGitHubTokenInput {\n  repository: RepositorySlug;\n  access: \"read\" | \"write\";\n}\n\n/** Configures fresh trusted sandboxes and repository-scoped Git tokens. */\nexport interface VercelGitHubGitTransportOptions {\n  /** Reads must mint contents:read credentials; writes are confined to the supplied repository. */\n  token(input: VercelGitHubTokenInput): Promise<string>;\n  /** Creates a fresh sandbox, without a snapshot, repository, or running agent. */\n  createSandbox?: () => Promise<TrustedGitSandbox>;\n}\n\n/** Configures Vercel-managed Git reads and signed publication. */\nexport interface VercelManagedGitHubGitTransportOptions {\n  /** Attribution metadata supplied for managed signed commits. */\n  commitIdentity: { name: string; email: string };\n  /** Creates one unnamed Sandbox from the exact managed credential request. */\n  createSandbox?: (input: VercelManagedGitHubSandboxCreateInput) => Promise<TrustedGitSandbox>;\n}\n\nasync function createManagedSandbox(\n  input: VercelManagedGitHubSandboxCreateInput,\n): Promise<TrustedGitSandbox> {\n  const { Sandbox } = await import(\"@vercel/sandbox\");\n  return Sandbox.create({ ...input });\n}\n\nfunction publicationBase(input: {\n  branch: string;\n  head: string;\n  expectedHead: string;\n  baseHead?: string;\n}): string {\n  if (\n    !isSafeGitRef(input.branch) ||\n    !gitOidPattern.test(input.head) ||\n    !gitOidPattern.test(input.expectedHead) ||\n    (input.expectedHead === absentGitOid\n      ? input.baseHead === undefined || !gitOidPattern.test(input.baseHead)\n      : input.baseHead !== undefined)\n  ) {\n    throw new Error(\"Invalid Git publication target\");\n  }\n  return input.expectedHead === absentGitOid ? input.baseHead! : input.expectedHead;\n}\n\nasync function trustedCommand(\n  sandbox: TrustedGitSandbox,\n  input: { cmd: string; args: string[]; cwd?: string },\n): Promise<string> {\n  const result = await sandbox.runCommand({ ...input, timeoutMs: 120_000 });\n  if (result.exitCode !== 0) throw new Error(`Trusted Git operation failed (${result.exitCode})`);\n  return (await result.stdout()).trim();\n}\n\nfunction bundleTransferSandbox(sandbox: TrustedGitSandbox) {\n  return {\n    async run({ command }: { command: string }) {\n      const result = await sandbox.runCommand({ cmd: \"sh\", args: [\"-c\", command] });\n      return { exitCode: result.exitCode, stdout: await result.stdout() };\n    },\n    async writeBinaryFile({ path, content }: { path: string; content: Uint8Array }) {\n      await sandbox.writeFiles([\n        {\n          path,\n          content: Buffer.from(content.buffer, content.byteOffset, content.byteLength),\n        },\n      ]);\n    },\n  };\n}\n\nasync function consumeSandboxBundle(\n  sandbox: TrustedGitSandbox,\n  path: string,\n  use: (bundle: GitHubRepositoryBundle) => Promise<void>,\n): Promise<void> {\n  const size = await sandbox.runCommand({ cmd: \"stat\", args: [\"-c\", \"%s\", path] });\n  const byteLength = Number(await size.stdout());\n  if (\n    size.exitCode !== 0 ||\n    !Number.isSafeInteger(byteLength) ||\n    byteLength < 1 ||\n    byteLength > maxGitBundleBytes\n  ) {\n    throw new Error(\"Git bundle exceeds transfer limit\");\n  }\n  const source = await sandbox.readFile({ path });\n  if (!source) throw new Error(\"Git bundle was not created\");\n  const readable =\n    source instanceof Readable ? source : new Readable({ highWaterMark: 64 * 1024 }).wrap(source);\n  const iterator = readable[Symbol.asyncIterator]();\n  const stream = new ReadableStream<Uint8Array>(\n    {\n      async pull(controller) {\n        const { done, value } = await iterator.next();\n        if (done) controller.close();\n        else controller.enqueue(value);\n      },\n      async cancel() {\n        await iterator.return?.();\n      },\n    },\n    { highWaterMark: 0 },\n  );\n  try {\n    await use({ stream });\n  } finally {\n    readable.destroy();\n    if (!stream.locked) await stream.cancel();\n  }\n}\n\nfunction credentialPolicy(repository: RepositorySlug, token: string): NetworkPolicy {\n  return {\n    allow: {\n      \"github.com\": [\n        {\n          match: { path: { startsWith: `/${repository}.git/` } },\n          transform: [\n            {\n              headers: {\n                authorization: `Basic ${Buffer.from(`x-access-token:${token}`).toString(\"base64\")}`,\n              },\n            },\n          ],\n        },\n      ],\n    },\n  };\n}\n\n/** Transfer Git objects through fresh trusted sandboxes; credentials never reach an agent sandbox. */\nexport function createVercelGitHubGitTransport(\n  options: VercelGitHubGitTransportOptions,\n): GitHubGitTransport {\n  async function isolated<T>(\n    repository: RepositorySlug,\n    use: (\n      sandbox: Awaited<ReturnType<NonNullable<VercelGitHubGitTransportOptions[\"createSandbox\"]>>>,\n      git: (...args: string[]) => Promise<string>,\n      repository: RepositorySlug,\n    ) => Promise<T>,\n  ): Promise<T> {\n    const slug = repositorySlugSchema.parse(repository.toLowerCase());\n    const sandbox = options.createSandbox\n      ? await options.createSandbox()\n      : await (\n          await import(\"@vercel/sandbox\")\n        ).Sandbox.create({ runtime: \"node24\", timeout: 180_000, networkPolicy: \"deny-all\" });\n    async function git(...args: string[]): Promise<string> {\n      const result = await sandbox.runCommand({\n        cmd: \"/usr/bin/env\",\n        args: [\n          \"-i\",\n          \"PATH=/usr/bin:/bin\",\n          \"HOME=/tmp\",\n          \"GIT_CONFIG_NOSYSTEM=1\",\n          \"GIT_CONFIG_GLOBAL=/dev/null\",\n          \"GIT_TERMINAL_PROMPT=0\",\n          \"git\",\n          \"-c\",\n          \"core.hooksPath=/dev/null\",\n          \"-c\",\n          \"credential.helper=\",\n          \"-c\",\n          \"protocol.ext.allow=never\",\n          \"-c\",\n          \"protocol.file.allow=always\",\n          \"-c\",\n          \"http.followRedirects=false\",\n          ...args,\n        ],\n        timeoutMs: 120_000,\n      });\n      if (result.exitCode !== 0)\n        throw new Error(`Trusted Git operation failed (${result.exitCode})`);\n      return (await result.stdout()).trim();\n    }\n    try {\n      await sandbox.updateNetworkPolicy(\"deny-all\");\n      return await use(sandbox, git, slug);\n    } finally {\n      try {\n        await sandbox.updateNetworkPolicy(\"deny-all\");\n      } finally {\n        await sandbox.stop();\n      }\n    }\n  }\n  return {\n    async fetch(input, use) {\n      if (input.refs.some((ref) => !ref.startsWith(\"refs/\") || !isSafeGitRef(ref)))\n        throw new Error(\"Invalid Git fetch ref\");\n      return isolated(input.repository, async (sandbox, git, slug) => {\n        await sandbox.updateNetworkPolicy(\n          credentialPolicy(slug, await options.token({ repository: slug, access: \"read\" })),\n        );\n        await git(\n          \"clone\",\n          \"--bare\",\n          \"--no-hardlinks\",\n          `https://github.com/${slug}.git`,\n          \"/tmp/transfer.git\",\n        );\n        if (input.refs.length)\n          await git(\n            \"-C\",\n            \"/tmp/transfer.git\",\n            \"fetch\",\n            \"--no-tags\",\n            \"origin\",\n            ...input.refs.map((ref) => `+${ref}:${ref}`),\n          );\n        await sandbox.updateNetworkPolicy(\"deny-all\");\n        await git(\"-C\", \"/tmp/transfer.git\", \"bundle\", \"create\", \"/tmp/transfer.bundle\", \"--all\");\n        await consumeSandboxBundle(sandbox, \"/tmp/transfer.bundle\", use);\n      });\n    },\n    async push(input) {\n      try {\n        const baseHead = publicationBase(input);\n        return await isolated(input.repository, async (sandbox, git, slug) => {\n          await git(\"init\", \"--bare\", \"/tmp/transfer.git\");\n          return await withSandboxGitBundle({\n            sandbox: bundleTransferSandbox(sandbox),\n            bundle: input.bundle,\n            async use(path) {\n              await git(\"-C\", \"/tmp/transfer.git\", \"bundle\", \"verify\", path);\n              await git(\"-C\", \"/tmp/transfer.git\", \"fetch\", path, \"HEAD:refs/heads/candidate\");\n              if (\n                (await git(\"-C\", \"/tmp/transfer.git\", \"rev-parse\", \"refs/heads/candidate\")) !==\n                input.head\n              )\n                throw new Error(\"Git bundle head does not match publication target\");\n              await git(\n                \"-C\",\n                \"/tmp/transfer.git\",\n                \"merge-base\",\n                \"--is-ancestor\",\n                baseHead,\n                \"refs/heads/candidate\",\n              );\n              await sandbox.updateNetworkPolicy(\n                credentialPolicy(slug, await options.token({ repository: slug, access: \"write\" })),\n              );\n              await input.authorize();\n              await git(\n                \"-C\",\n                \"/tmp/transfer.git\",\n                \"push\",\n                `--force-with-lease=refs/heads/${input.branch}:${input.expectedHead}`,\n                `https://github.com/${slug}.git`,\n                `${input.head}:refs/heads/${input.branch}`,\n              );\n              return input.head;\n            },\n          });\n        });\n      } finally {\n        if (!input.bundle.stream.locked) await input.bundle.stream.cancel();\n      }\n    },\n  };\n}\n\n/** Use fresh Vercel-managed trusted Sandboxes for Git reads and signed publication. */\nexport function createVercelManagedGitHubGitTransport(\n  options: VercelManagedGitHubGitTransportOptions,\n): GitHubGitTransport {\n  const createSandbox = options.createSandbox ?? createManagedSandbox;\n  const createInput = (\n    repository: RepositorySlug,\n    access: \"read\" | \"write\",\n  ): VercelManagedGitHubSandboxCreateInput => ({\n    source: {\n      type: \"git\",\n      url: `https://github.com/${repository}.git`,\n    },\n    __source_credentials: true,\n    __commitAs: options.commitIdentity,\n    networkPolicy: { allow: access === \"read\" ? [\"github.com\"] : [\"github.com\", \"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: managedGitTimeoutMs,\n  });\n  return {\n    async fetch(input, use) {\n      if (input.refs.some((ref) => !ref.startsWith(\"refs/\") || !isSafeGitRef(ref))) {\n        throw new Error(\"Invalid Git fetch ref\");\n      }\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      const sandbox = await createSandbox(createInput(repository, \"read\"));\n      const repositoryPath = sandbox.cwd;\n      try {\n        await trustedCommand(sandbox, {\n          cmd: \"/usr/bin/git\",\n          args: [\"clone\", \"--bare\", \"--no-local\", repositoryPath, \"/tmp/transfer.git\"],\n        });\n        if (input.refs.length > 0) {\n          await trustedCommand(sandbox, {\n            cmd: \"git\",\n            args: [\n              \"-C\",\n              \"/tmp/transfer.git\",\n              \"fetch\",\n              \"--no-tags\",\n              `https://github.com/${repository}.git`,\n              ...input.refs.map((ref) => `+${ref}:${ref}`),\n            ],\n          });\n        }\n        await trustedCommand(sandbox, {\n          cmd: \"/usr/bin/git\",\n          args: [\"-C\", \"/tmp/transfer.git\", \"bundle\", \"create\", \"/tmp/transfer.bundle\", \"--all\"],\n        });\n        await consumeSandboxBundle(sandbox, \"/tmp/transfer.bundle\", use);\n      } finally {\n        await sandbox.stop();\n      }\n    },\n    async push(input) {\n      try {\n        const baseHead = publicationBase(input);\n        if (input.expectedHead === absentGitOid) {\n          throw new Error(\"Vercel-managed signed publication requires an existing remote branch\");\n        }\n        const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n        const sandbox = await createSandbox(createInput(repository, \"write\"));\n        const repositoryPath = sandbox.cwd;\n        try {\n          const hooksPath = `/tmp/factory-hooks-${randomUUID()}`;\n          await trustedCommand(sandbox, { cmd: \"mkdir\", args: [\"-m\", \"700\", hooksPath] });\n          await trustedCommand(sandbox, {\n            cmd: \"/usr/bin/git\",\n            args: [\"config\", \"core.hooksPath\", hooksPath],\n            cwd: repositoryPath,\n          });\n          await withSandboxGitBundle({\n            sandbox: bundleTransferSandbox(sandbox),\n            bundle: input.bundle,\n            async use(path) {\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/git\",\n                args: [\"bundle\", \"verify\", path],\n                cwd: repositoryPath,\n              });\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/git\",\n                args: [\"fetch\", \"--no-tags\", path, `${input.head}:refs/factory/candidate`],\n                cwd: repositoryPath,\n              });\n              if (\n                (await trustedCommand(sandbox, {\n                  cmd: \"/usr/bin/git\",\n                  args: [\"rev-parse\", \"refs/factory/candidate\"],\n                  cwd: repositoryPath,\n                })) !== input.head\n              ) {\n                throw new Error(\"Git bundle head does not match publication target\");\n              }\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/git\",\n                args: [\"merge-base\", \"--is-ancestor\", baseHead, \"refs/factory/candidate\"],\n                cwd: repositoryPath,\n              });\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/git\",\n                args: [\"checkout\", \"-B\", input.branch, \"refs/factory/candidate\"],\n                cwd: repositoryPath,\n              });\n              await input.authorize();\n              await trustedCommand(sandbox, {\n                cmd: \"/usr/bin/env\",\n                args: [\n                  `VERCEL_GIT_EXPECTED_REMOTE_OID=${input.expectedHead}`,\n                  ...(input.baseHead === undefined\n                    ? []\n                    : [`VERCEL_GIT_BASE_OID=${input.baseHead}`]),\n                  \"git\",\n                  \"push\",\n                  \"origin\",\n                  input.branch,\n                ],\n                cwd: repositoryPath,\n              });\n            },\n          });\n          const signedHead = await trustedCommand(sandbox, {\n            cmd: \"/usr/bin/git\",\n            args: [\"rev-parse\", \"HEAD\"],\n            cwd: repositoryPath,\n          });\n          if (!gitOidPattern.test(signedHead)) {\n            throw new Error(\"Managed signed push returned an invalid Git head\");\n          }\n          return signedHead;\n        } finally {\n          await sandbox.stop();\n        }\n      } finally {\n        if (!input.bundle.stream.locked) await input.bundle.stream.cancel();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;AAmCA,MAAM,gBAAgB;AACtB,MAAM,eAAe,IAAI,OAAO,EAAE;AAClC,MAAM,sBAAsB;AAwB5B,eAAe,qBACb,OAC4B;CAC5B,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,OAAO,QAAQ,OAAO,EAAE,GAAG,MAAM,CAAC;AACpC;AAEA,SAAS,gBAAgB,OAKd;CACT,IACE,CAAC,aAAa,MAAM,MAAM,KAC1B,CAAC,cAAc,KAAK,MAAM,IAAI,KAC9B,CAAC,cAAc,KAAK,MAAM,YAAY,MACrC,MAAM,iBAAiB,eACpB,MAAM,aAAa,KAAA,KAAa,CAAC,cAAc,KAAK,MAAM,QAAQ,IAClE,MAAM,aAAa,KAAA,IAEvB,MAAM,IAAI,MAAM,gCAAgC;CAElD,OAAO,MAAM,iBAAiB,eAAe,MAAM,WAAY,MAAM;AACvE;AAEA,eAAe,eACb,SACA,OACiB;CACjB,MAAM,SAAS,MAAM,QAAQ,WAAW;EAAE,GAAG;EAAO,WAAW;CAAQ,CAAC;CACxE,IAAI,OAAO,aAAa,GAAG,MAAM,IAAI,MAAM,iCAAiC,OAAO,SAAS,EAAE;CAC9F,QAAQ,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;AACtC;AAEA,SAAS,sBAAsB,SAA4B;CACzD,OAAO;EACL,MAAM,IAAI,EAAE,WAAgC;GAC1C,MAAM,SAAS,MAAM,QAAQ,WAAW;IAAE,KAAK;IAAM,MAAM,CAAC,MAAM,OAAO;GAAE,CAAC;GAC5E,OAAO;IAAE,UAAU,OAAO;IAAU,QAAQ,MAAM,OAAO,OAAO;GAAE;EACpE;EACA,MAAM,gBAAgB,EAAE,MAAM,WAAkD;GAC9E,MAAM,QAAQ,WAAW,CACvB;IACE;IACA,SAAS,OAAO,KAAK,QAAQ,QAAQ,QAAQ,YAAY,QAAQ,UAAU;GAC7E,CACF,CAAC;EACH;CACF;AACF;AAEA,eAAe,qBACb,SACA,MACA,KACe;CACf,MAAM,OAAO,MAAM,QAAQ,WAAW;EAAE,KAAK;EAAQ,MAAM;GAAC;GAAM;GAAM;EAAI;CAAE,CAAC;CAC/E,MAAM,aAAa,OAAO,MAAM,KAAK,OAAO,CAAC;CAC7C,IACE,KAAK,aAAa,KAClB,CAAC,OAAO,cAAc,UAAU,KAChC,aAAa,KACb,aAAA,WAEA,MAAM,IAAI,MAAM,mCAAmC;CAErD,MAAM,SAAS,MAAM,QAAQ,SAAS,EAAE,KAAK,CAAC;CAC9C,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,4BAA4B;CACzD,MAAM,WACJ,kBAAkB,WAAW,SAAS,IAAI,SAAS,EAAE,eAAe,MAAU,CAAC,CAAC,CAAC,KAAK,MAAM;CAC9F,MAAM,WAAW,SAAS,OAAO,cAAc,CAAC;CAChD,MAAM,SAAS,IAAI,eACjB;EACE,MAAM,KAAK,YAAY;GACrB,MAAM,EAAE,MAAM,UAAU,MAAM,SAAS,KAAK;GAC5C,IAAI,MAAM,WAAW,MAAM;QACtB,WAAW,QAAQ,KAAK;EAC/B;EACA,MAAM,SAAS;GACb,MAAM,SAAS,SAAS;EAC1B;CACF,GACA,EAAE,eAAe,EAAE,CACrB;CACA,IAAI;EACF,MAAM,IAAI,EAAE,OAAO,CAAC;CACtB,UAAU;EACR,SAAS,QAAQ;EACjB,IAAI,CAAC,OAAO,QAAQ,MAAM,OAAO,OAAO;CAC1C;AACF;AAEA,SAAS,iBAAiB,YAA4B,OAA8B;CAClF,OAAO,EACL,OAAO,EACL,cAAc,CACZ;EACE,OAAO,EAAE,MAAM,EAAE,YAAY,IAAI,WAAW,OAAO,EAAE;EACrD,WAAW,CACT,EACE,SAAS,EACP,eAAe,SAAS,OAAO,KAAK,kBAAkB,OAAO,CAAC,CAAC,SAAS,QAAQ,IAClF,EACF,CACF;CACF,CACF,EACF,EACF;AACF;;AAGA,SAAgB,+BACd,SACoB;CACpB,eAAe,SACb,YACA,KAKY;EACZ,MAAM,OAAO,qBAAqB,MAAM,WAAW,YAAY,CAAC;EAChE,MAAM,UAAU,QAAQ,gBACpB,MAAM,QAAQ,cAAc,IAC5B,OACE,MAAM,OAAO,mBAAA,CACb,QAAQ,OAAO;GAAE,SAAS;GAAU,SAAS;GAAS,eAAe;EAAW,CAAC;EACvF,eAAe,IAAI,GAAG,MAAiC;GACrD,MAAM,SAAS,MAAM,QAAQ,WAAW;IACtC,KAAK;IACL,MAAM;KACJ;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA;KACA,GAAG;IACL;IACA,WAAW;GACb,CAAC;GACD,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,iCAAiC,OAAO,SAAS,EAAE;GACrE,QAAQ,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;EACtC;EACA,IAAI;GACF,MAAM,QAAQ,oBAAoB,UAAU;GAC5C,OAAO,MAAM,IAAI,SAAS,KAAK,IAAI;EACrC,UAAU;GACR,IAAI;IACF,MAAM,QAAQ,oBAAoB,UAAU;GAC9C,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;CACF;CACA,OAAO;EACL,MAAM,MAAM,OAAO,KAAK;GACtB,IAAI,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,aAAa,GAAG,CAAC,GACzE,MAAM,IAAI,MAAM,uBAAuB;GACzC,OAAO,SAAS,MAAM,YAAY,OAAO,SAAS,KAAK,SAAS;IAC9D,MAAM,QAAQ,oBACZ,iBAAiB,MAAM,MAAM,QAAQ,MAAM;KAAE,YAAY;KAAM,QAAQ;IAAO,CAAC,CAAC,CAClF;IACA,MAAM,IACJ,SACA,UACA,kBACA,sBAAsB,KAAK,OAC3B,mBACF;IACA,IAAI,MAAM,KAAK,QACb,MAAM,IACJ,MACA,qBACA,SACA,aACA,UACA,GAAG,MAAM,KAAK,KAAK,QAAQ,IAAI,IAAI,GAAG,KAAK,CAC7C;IACF,MAAM,QAAQ,oBAAoB,UAAU;IAC5C,MAAM,IAAI,MAAM,qBAAqB,UAAU,UAAU,wBAAwB,OAAO;IACxF,MAAM,qBAAqB,SAAS,wBAAwB,GAAG;GACjE,CAAC;EACH;EACA,MAAM,KAAK,OAAO;GAChB,IAAI;IACF,MAAM,WAAW,gBAAgB,KAAK;IACtC,OAAO,MAAM,SAAS,MAAM,YAAY,OAAO,SAAS,KAAK,SAAS;KACpE,MAAM,IAAI,QAAQ,UAAU,mBAAmB;KAC/C,OAAO,MAAM,qBAAqB;MAChC,SAAS,sBAAsB,OAAO;MACtC,QAAQ,MAAM;MACd,MAAM,IAAI,MAAM;OACd,MAAM,IAAI,MAAM,qBAAqB,UAAU,UAAU,IAAI;OAC7D,MAAM,IAAI,MAAM,qBAAqB,SAAS,MAAM,2BAA2B;OAC/E,IACG,MAAM,IAAI,MAAM,qBAAqB,aAAa,sBAAsB,MACzE,MAAM,MAEN,MAAM,IAAI,MAAM,mDAAmD;OACrE,MAAM,IACJ,MACA,qBACA,cACA,iBACA,UACA,sBACF;OACA,MAAM,QAAQ,oBACZ,iBAAiB,MAAM,MAAM,QAAQ,MAAM;QAAE,YAAY;QAAM,QAAQ;OAAQ,CAAC,CAAC,CACnF;OACA,MAAM,MAAM,UAAU;OACtB,MAAM,IACJ,MACA,qBACA,QACA,iCAAiC,MAAM,OAAO,GAAG,MAAM,gBACvD,sBAAsB,KAAK,OAC3B,GAAG,MAAM,KAAK,cAAc,MAAM,QACpC;OACA,OAAO,MAAM;MACf;KACF,CAAC;IACH,CAAC;GACH,UAAU;IACR,IAAI,CAAC,MAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,OAAO,OAAO,OAAO;GACpE;EACF;CACF;AACF;;AAGA,SAAgB,sCACd,SACoB;CACpB,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,MAAM,eACJ,YACA,YAC2C;EAC3C,QAAQ;GACN,MAAM;GACN,KAAK,sBAAsB,WAAW;EACxC;EACA,sBAAsB;EACtB,YAAY,QAAQ;EACpB,eAAe,EAAE,OAAO,WAAW,SAAS,CAAC,YAAY,IAAI,CAAC,cAAc,gBAAgB,EAAE;EAC9F,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;CACA,OAAO;EACL,MAAM,MAAM,OAAO,KAAK;GACtB,IAAI,MAAM,KAAK,MAAM,QAAQ,CAAC,IAAI,WAAW,OAAO,KAAK,CAAC,aAAa,GAAG,CAAC,GACzE,MAAM,IAAI,MAAM,uBAAuB;GAEzC,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,MAAM,UAAU,MAAM,cAAc,YAAY,YAAY,MAAM,CAAC;GACnE,MAAM,iBAAiB,QAAQ;GAC/B,IAAI;IACF,MAAM,eAAe,SAAS;KAC5B,KAAK;KACL,MAAM;MAAC;MAAS;MAAU;MAAc;MAAgB;KAAmB;IAC7E,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,GACtB,MAAM,eAAe,SAAS;KAC5B,KAAK;KACL,MAAM;MACJ;MACA;MACA;MACA;MACA,sBAAsB,WAAW;MACjC,GAAG,MAAM,KAAK,KAAK,QAAQ,IAAI,IAAI,GAAG,KAAK;KAC7C;IACF,CAAC;IAEH,MAAM,eAAe,SAAS;KAC5B,KAAK;KACL,MAAM;MAAC;MAAM;MAAqB;MAAU;MAAU;MAAwB;KAAO;IACvF,CAAC;IACD,MAAM,qBAAqB,SAAS,wBAAwB,GAAG;GACjE,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;EACA,MAAM,KAAK,OAAO;GAChB,IAAI;IACF,MAAM,WAAW,gBAAgB,KAAK;IACtC,IAAI,MAAM,iBAAiB,cACzB,MAAM,IAAI,MAAM,sEAAsE;IAExF,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;IAC5E,MAAM,UAAU,MAAM,cAAc,YAAY,YAAY,OAAO,CAAC;IACpE,MAAM,iBAAiB,QAAQ;IAC/B,IAAI;KACF,MAAM,YAAY,sBAAsB,WAAW;KACnD,MAAM,eAAe,SAAS;MAAE,KAAK;MAAS,MAAM;OAAC;OAAM;OAAO;MAAS;KAAE,CAAC;KAC9E,MAAM,eAAe,SAAS;MAC5B,KAAK;MACL,MAAM;OAAC;OAAU;OAAkB;MAAS;MAC5C,KAAK;KACP,CAAC;KACD,MAAM,qBAAqB;MACzB,SAAS,sBAAsB,OAAO;MACtC,QAAQ,MAAM;MACd,MAAM,IAAI,MAAM;OACd,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SAAC;SAAU;SAAU;QAAI;QAC/B,KAAK;OACP,CAAC;OACD,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SAAC;SAAS;SAAa;SAAM,GAAG,MAAM,KAAK;QAAwB;QACzE,KAAK;OACP,CAAC;OACD,IACG,MAAM,eAAe,SAAS;QAC7B,KAAK;QACL,MAAM,CAAC,aAAa,wBAAwB;QAC5C,KAAK;OACP,CAAC,MAAO,MAAM,MAEd,MAAM,IAAI,MAAM,mDAAmD;OAErE,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SAAC;SAAc;SAAiB;SAAU;QAAwB;QACxE,KAAK;OACP,CAAC;OACD,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SAAC;SAAY;SAAM,MAAM;SAAQ;QAAwB;QAC/D,KAAK;OACP,CAAC;OACD,MAAM,MAAM,UAAU;OACtB,MAAM,eAAe,SAAS;QAC5B,KAAK;QACL,MAAM;SACJ,kCAAkC,MAAM;SACxC,GAAI,MAAM,aAAa,KAAA,IACnB,CAAC,IACD,CAAC,uBAAuB,MAAM,UAAU;SAC5C;SACA;SACA;SACA,MAAM;QACR;QACA,KAAK;OACP,CAAC;MACH;KACF,CAAC;KACD,MAAM,aAAa,MAAM,eAAe,SAAS;MAC/C,KAAK;MACL,MAAM,CAAC,aAAa,MAAM;MAC1B,KAAK;KACP,CAAC;KACD,IAAI,CAAC,cAAc,KAAK,UAAU,GAChC,MAAM,IAAI,MAAM,kDAAkD;KAEpE,OAAO;IACT,UAAU;KACR,MAAM,QAAQ,KAAK;IACrB;GACF,UAAU;IACR,IAAI,CAAC,MAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,OAAO,OAAO,OAAO;GACpE;EACF;CACF;AACF"}

package/dist/vercel-github-api.d.mts

@@ -0,0 +1,103 @@
+import { RepositorySlug } from "./schema/repository.mjs";
+import { GitHubTreeEntry } from "./github-publication.mjs";
+import { NetworkPolicy, Sandbox } from "@vercel/sandbox";
+//#region src/vercel-github-api.d.ts
+type TrustedGitHubApiSandbox = Pick<Sandbox, "runCommand" | "stop">;
+/** GitHub API actions supported by Vercel-managed Sandbox credentials. */
+type VercelManagedGitHubApiAction = "github:issues:read" | "github:pull-request:create";
+/** Exact creation request for one Vercel-managed GitHub API operation. */
+interface VercelManagedGitHubApiSandboxCreateInput {
+  source?: {
+    type: "git";
+    url: string;
+  };
+  __source_credentials?: true;
+  __commitAs?: {
+    name: string;
+    email: string;
+  };
+  __credentials: {
+    github: [{
+      repositories: [RepositorySlug];
+      actions: [VercelManagedGitHubApiAction];
+    }];
+  };
+  networkPolicy: NetworkPolicy;
+  persistent: false;
+  resources: {
+    vcpus: 6;
+  };
+  runtime: "node24";
+  timeout: 60_000 | 180_000;
+}
+/** Configures fresh trusted Sandboxes for brokered GitHub API requests. */
+interface VercelManagedGitHubApiOptions {
+  /** Attribution metadata supplied when managed publication creates a signed commit. */
+  commitIdentity?: {
+    name: string;
+    email: string;
+  };
+  createSandbox?: (input: VercelManagedGitHubApiSandboxCreateInput) => Promise<TrustedGitHubApiSandbox>;
+}
+/** Authorized request to read one exact GitHub issue. */
+interface VercelManagedGitHubIssueInput {
+  repository: RepositorySlug;
+  issueNumber: number;
+  authorize(): Promise<void>;
+}
+/** Issue fields returned by a Vercel-managed GitHub API request. */
+interface VercelManagedGitHubIssue {
+  title: string;
+  body: string | null;
+  url: string;
+  pullRequest: boolean;
+}
+/** Authorized request to create one draft or ready GitHub pull request. */
+interface VercelManagedGitHubPullRequestInput {
+  repository: RepositorySlug;
+  title: string;
+  body: string;
+  head: string;
+  base: string;
+  draft: boolean;
+  authorize(): Promise<void>;
+}
+/** Pull-request identity returned by a Vercel-managed GitHub API request. */
+interface VercelManagedGitHubPullRequest {
+  pullRequestNumber: number;
+  pullRequestUrl: string;
+  draft: boolean;
+}
+/** Git Data and pull-request inputs for one idempotent managed publication. */
+interface VercelManagedGitHubPublicationInput {
+  repository: RepositorySlug;
+  baseCommit: string;
+  tree: readonly GitHubTreeEntry[];
+  commitMessage: string;
+  branch: string;
+  title: string;
+  body: string;
+  baseBranch: string;
+  draft: boolean;
+  authorize(): Promise<void>;
+}
+/** Commit and pull-request identities returned after managed publication. */
+interface VercelManagedGitHubPublication extends VercelManagedGitHubPullRequest {
+  commitSha: string;
+}
+/** Repository-scoped brokered GitHub API operations supplied by Vercel Sandbox. */
+interface VercelManagedGitHubApi {
+  readIssue(input: VercelManagedGitHubIssueInput): Promise<VercelManagedGitHubIssue>;
+  createPullRequest(input: VercelManagedGitHubPullRequestInput): Promise<VercelManagedGitHubPullRequest>;
+  publishPullRequest(input: VercelManagedGitHubPublicationInput): Promise<VercelManagedGitHubPublication>;
+}
+/** GitHub API failure returned through the managed credential Sandbox. */
+declare class VercelManagedGitHubApiError extends Error {
+  readonly status: number;
+  constructor(status: number, message: string);
+}
+/** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */
+declare function createVercelManagedGitHubApi(options?: VercelManagedGitHubApiOptions): VercelManagedGitHubApi;
+//#endregion
+export { VercelManagedGitHubApi, VercelManagedGitHubApiAction, VercelManagedGitHubApiError, VercelManagedGitHubApiOptions, VercelManagedGitHubApiSandboxCreateInput, VercelManagedGitHubIssue, VercelManagedGitHubIssueInput, VercelManagedGitHubPublication, VercelManagedGitHubPublicationInput, VercelManagedGitHubPullRequest, VercelManagedGitHubPullRequestInput, createVercelManagedGitHubApi };
+//# sourceMappingURL=vercel-github-api.d.mts.map

package/dist/vercel-github-api.mjs

@@ -0,0 +1,363 @@
+import { repositorySlugSchema } from "./schema/repository.mjs";
+import { isSafeGitRef } from "./github-publication.mjs";
+import { z } from "zod";
+//#region src/vercel-github-api.ts
+/** GitHub API failure returned through the managed credential Sandbox. */
+var VercelManagedGitHubApiError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(`GitHub API request failed (${status}): ${message}`);
+		this.status = status;
+		this.name = "VercelManagedGitHubApiError";
+	}
+};
+const sandboxResponseSchema = z.object({
+	status: z.number().int().min(100).max(599),
+	body: z.unknown()
+});
+const issueSchema = z.object({
+	title: z.string(),
+	body: z.string().nullable(),
+	html_url: z.url(),
+	pull_request: z.unknown().optional()
+});
+const pullRequestSchema = z.object({
+	number: z.number().int().positive(),
+	html_url: z.url(),
+	draft: z.boolean()
+});
+const shaSchema = z.string().regex(/^[a-f0-9]{40}$/u);
+const commitSchema = z.object({
+	sha: shaSchema,
+	tree: z.object({ sha: shaSchema }),
+	parents: z.array(z.object({ sha: shaSchema }))
+});
+const treeSchema = z.object({ sha: shaSchema });
+const refSchema = z.object({ object: z.object({ sha: shaSchema }) });
+const publicationPullSchema = pullRequestSchema.extend({
+	state: z.enum(["open", "closed"]),
+	head: z.object({
+		ref: z.string(),
+		sha: shaSchema
+	})
+});
+const publicationPathSchema = z.string().min(1).max(1024).refine((path) => Buffer.byteLength(path, "utf8") <= 1024, { message: "Managed publication path exceeds byte limit" }).refine((path) => /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u.test(path) && !path.includes("..") && !path.includes("//") && !path.endsWith("/") && !path.split("/").some((part) => part === "."), { message: "Invalid managed publication path" });
+const publicationBranchSchema = z.string().min(1).max(256).refine((branch) => isSafeGitRef(branch) && branch.split("/").every((component) => component.length > 0 && !component.startsWith(".") && !component.endsWith(".") && !component.endsWith(".lock")), { message: "Invalid managed publication branch" });
+const publicationTextSchema = (maximum, field) => z.string().max(maximum).refine((value) => Buffer.byteLength(value, "utf8") <= maximum, { message: `Managed publication ${field} exceeds byte limit` });
+const publicationCommitMessageSchema = publicationTextSchema(65536, "commit message").min(1);
+const publicationTitleSchema = publicationTextSchema(256, "title").min(1);
+const publicationBodySchema = publicationTextSchema(65536, "body");
+const publicationBaseBranchSchema = z.string().min(1).max(256).refine((branch) => isSafeGitRef(branch), { message: "Invalid managed publication base branch" });
+const publicationContentSchema = z.string().max(2e5).refine((content) => Buffer.byteLength(content, "utf8") <= 2e5, { message: "Managed publication content exceeds byte limit" });
+const publicationTreeSchema = z.array(z.union([z.strictObject({
+	path: publicationPathSchema,
+	mode: z.enum(["100644", "100755"]),
+	type: z.literal("blob"),
+	content: publicationContentSchema
+}), z.strictObject({
+	path: publicationPathSchema,
+	mode: z.enum(["100644", "100755"]),
+	type: z.literal("blob"),
+	sha: z.null()
+})])).min(1).max(25).refine((entries) => new TextEncoder().encode(JSON.stringify({ tree: entries })).byteLength <= 1e6, "Managed publication tree exceeds transfer limit");
+const githubRequestScript = `
+const request = JSON.parse(process.argv[1]);
+const response = await fetch(request.url, {
+  method: request.method,
+  headers: {
+    accept: "application/vnd.github+json",
+    "content-type": "application/json",
+    "x-github-api-version": "2022-11-28",
+  },
+  body: request.body === undefined ? undefined : JSON.stringify(request.body),
+  redirect: "error",
+});
+const reader = response.body?.getReader();
+const chunks = [];
+let byteLength = 0;
+if (reader) {
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    byteLength += value.byteLength;
+    if (byteLength > 1_000_000) {
+      await reader.cancel();
+      throw new Error("GitHub API response exceeds transfer limit");
+    }
+    chunks.push(value);
+  }
+}
+const bytes = new Uint8Array(byteLength);
+let offset = 0;
+for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+const text = new TextDecoder().decode(bytes);
+let body = null;
+try { body = text === "" ? null : JSON.parse(text); } catch { body = { message: text }; }
+process.stdout.write(JSON.stringify({ status: response.status, body }));
+`;
+async function createManagedSandbox(input) {
+	const { Sandbox } = await import("@vercel/sandbox");
+	return Sandbox.create({ ...input });
+}
+function createInput(repository, action) {
+	return {
+		__credentials: { github: [{
+			repositories: [repository],
+			actions: [action]
+		}] },
+		networkPolicy: { allow: ["api.github.com"] },
+		persistent: false,
+		resources: { vcpus: 6 },
+		runtime: "node24",
+		timeout: 6e4
+	};
+}
+function createPublicationInput(repository, commitIdentity) {
+	return {
+		source: {
+			type: "git",
+			url: `https://github.com/${repository}.git`
+		},
+		__source_credentials: true,
+		__commitAs: commitIdentity,
+		__credentials: { github: [{
+			repositories: [repository],
+			actions: ["github:pull-request:create"]
+		}] },
+		networkPolicy: { allow: ["github.com", "api.github.com"] },
+		persistent: false,
+		resources: { vcpus: 6 },
+		runtime: "node24",
+		timeout: 18e4
+	};
+}
+async function request(createSandbox, input) {
+	const sandbox = await createSandbox(createInput(input.repository, input.action));
+	try {
+		await input.authorize();
+		const result = await sandbox.runCommand({
+			cmd: "node",
+			args: [
+				"--input-type=module",
+				"--eval",
+				githubRequestScript,
+				JSON.stringify({
+					method: input.method,
+					url: `https://api.github.com/repos/${input.repository}${input.path}`,
+					...input.body === void 0 ? {} : { body: input.body }
+				})
+			],
+			timeoutMs: 3e4
+		});
+		const stderr = (await result.stderr()).trim();
+		if (result.exitCode !== 0) throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);
+		const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));
+		if (response.status < 200 || response.status >= 300) {
+			const message = z.object({ message: z.string() }).safeParse(response.body);
+			throw new VercelManagedGitHubApiError(response.status, message.success ? message.data.message : "Unexpected response");
+		}
+		return response.body;
+	} finally {
+		await sandbox.stop();
+	}
+}
+async function sandboxRequest(sandbox, input) {
+	const result = await sandbox.runCommand({
+		cmd: "node",
+		args: [
+			"--input-type=module",
+			"--eval",
+			githubRequestScript,
+			JSON.stringify({
+				method: input.method,
+				url: `https://api.github.com/repos/${input.repository}${input.path}`,
+				...input.body === void 0 ? {} : { body: input.body }
+			})
+		],
+		timeoutMs: 3e4
+	});
+	const stderr = (await result.stderr()).trim();
+	if (result.exitCode !== 0) throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);
+	const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));
+	if (response.status < 200 || response.status >= 300) {
+		const message = z.object({ message: z.string() }).safeParse(response.body);
+		throw new VercelManagedGitHubApiError(response.status, message.success ? message.data.message : "Unexpected response");
+	}
+	return response.body;
+}
+/** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */
+function createVercelManagedGitHubApi(options = {}) {
+	const createSandbox = options.createSandbox ?? createManagedSandbox;
+	return {
+		async readIssue(input) {
+			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
+			if (!Number.isSafeInteger(input.issueNumber) || input.issueNumber < 1) throw new Error("Invalid GitHub issue number");
+			const issue = issueSchema.parse(await request(createSandbox, {
+				repository,
+				action: "github:issues:read",
+				method: "GET",
+				path: `/issues/${input.issueNumber}`,
+				authorize: input.authorize
+			}));
+			return {
+				title: issue.title,
+				body: issue.body,
+				url: issue.html_url,
+				pullRequest: issue.pull_request !== void 0
+			};
+		},
+		async createPullRequest(input) {
+			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
+			const head = publicationBranchSchema.parse(input.head);
+			const base = publicationBaseBranchSchema.parse(input.base);
+			const title = publicationTitleSchema.parse(input.title);
+			const body = publicationBodySchema.parse(input.body);
+			const pull = pullRequestSchema.parse(await request(createSandbox, {
+				repository,
+				action: "github:pull-request:create",
+				method: "POST",
+				path: "/pulls",
+				body: {
+					title,
+					body,
+					head,
+					base,
+					draft: input.draft
+				},
+				authorize: input.authorize
+			}));
+			return {
+				pullRequestNumber: pull.number,
+				pullRequestUrl: pull.html_url,
+				draft: pull.draft
+			};
+		},
+		async publishPullRequest(input) {
+			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
+			if (!options.commitIdentity) throw new Error("Managed publication requires commit identity");
+			if (!/^[a-f0-9]{40}$/u.test(input.baseCommit) || input.commitMessage.trim() === "") throw new Error("Invalid managed GitHub publication");
+			const publicationTree = publicationTreeSchema.parse(input.tree);
+			const branch = publicationBranchSchema.parse(input.branch);
+			const baseBranch = publicationBaseBranchSchema.parse(input.baseBranch);
+			const title = publicationTitleSchema.parse(input.title);
+			const body = publicationBodySchema.parse(input.body);
+			const commitMessage = publicationCommitMessageSchema.parse(`${input.commitMessage}\n\nCo-authored-by: ${options.commitIdentity.name} <${options.commitIdentity.email}>`);
+			const sandbox = await createSandbox(createPublicationInput(repository, options.commitIdentity));
+			try {
+				const authorizedRequest = async (request) => {
+					await input.authorize();
+					return sandboxRequest(sandbox, {
+						repository,
+						...request
+					});
+				};
+				const base = commitSchema.parse(await authorizedRequest({
+					method: "GET",
+					path: `/git/commits/${input.baseCommit}`
+				}));
+				const tree = treeSchema.parse(await authorizedRequest({
+					method: "POST",
+					path: "/git/trees",
+					body: {
+						base_tree: base.tree.sha,
+						tree: publicationTree
+					}
+				}));
+				const pullPath = `/pulls?${new URLSearchParams({
+					state: "all",
+					head: `${repository.split("/")[0]}:${branch}`,
+					per_page: "100"
+				})}`;
+				const pulls = async () => z.array(publicationPullSchema).parse(await authorizedRequest({
+					method: "GET",
+					path: pullPath
+				}));
+				const result = (pull, commitSha) => ({
+					commitSha,
+					pullRequestNumber: pull.number,
+					pullRequestUrl: pull.html_url,
+					draft: pull.draft
+				});
+				const refPath = `/git/ref/heads/${branch.split("/").map(encodeURIComponent).join("/")}`;
+				let existingRef;
+				try {
+					existingRef = refSchema.parse(await authorizedRequest({
+						method: "GET",
+						path: refPath
+					}));
+				} catch (error) {
+					if (!(error instanceof VercelManagedGitHubApiError) || error.status !== 404) throw error;
+					existingRef = null;
+				}
+				let commitSha = existingRef?.object.sha;
+				if (commitSha) {
+					const existingPull = (await pulls()).find((pull) => pull.head.ref === branch);
+					if (existingPull) {
+						if (existingPull.state !== "open") throw new Error("Managed publication pull request is closed");
+						const existingCommit = commitSchema.parse(await authorizedRequest({
+							method: "GET",
+							path: `/git/commits/${existingPull.head.sha}`
+						}));
+						if (existingCommit.tree.sha !== tree.sha || existingCommit.parents.length !== 1 || existingCommit.parents[0]?.sha !== input.baseCommit) throw new Error("Managed publication pull request contains different changes");
+						return result(existingPull, existingPull.head.sha);
+					}
+					const existingCommit = commitSchema.parse(await authorizedRequest({
+						method: "GET",
+						path: `/git/commits/${commitSha}`
+					}));
+					if (existingCommit.tree.sha !== tree.sha || existingCommit.parents.length !== 1 || existingCommit.parents[0]?.sha !== input.baseCommit) throw new Error("Managed publication branch contains different changes");
+				} else {
+					commitSha = commitSchema.parse(await authorizedRequest({
+						method: "POST",
+						path: "/git/commits",
+						body: {
+							message: commitMessage,
+							tree: tree.sha,
+							parents: [input.baseCommit]
+						}
+					})).sha;
+					try {
+						await authorizedRequest({
+							method: "POST",
+							path: "/git/refs",
+							body: {
+								ref: `refs/heads/${branch}`,
+								sha: commitSha
+							}
+						});
+					} catch (error) {
+						if (refSchema.parse(await authorizedRequest({
+							method: "GET",
+							path: refPath
+						})).object.sha !== commitSha) throw error;
+					}
+				}
+				let pull;
+				try {
+					pull = pullRequestSchema.parse(await authorizedRequest({
+						method: "POST",
+						path: "/pulls",
+						body: {
+							title,
+							body,
+							head: branch,
+							base: baseBranch,
+							draft: input.draft
+						}
+					}));
+				} catch (error) {
+					const reconciled = (await pulls()).find((candidate) => candidate.head.ref === branch);
+					if (!reconciled || reconciled.state !== "open" || reconciled.head.sha !== commitSha) throw error;
+					pull = reconciled;
+				}
+				return result(pull, commitSha);
+			} finally {
+				await sandbox.stop();
+			}
+		}
+	};
+}
+//#endregion
+export { VercelManagedGitHubApiError, createVercelManagedGitHubApi };
+
+//# sourceMappingURL=vercel-github-api.mjs.map

package/dist/vercel-github-api.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel-github-api.mjs","names":[],"sources":["../src/vercel-github-api.ts"],"sourcesContent":["import type { Sandbox, NetworkPolicy } from \"@vercel/sandbox\";\nimport { z } from \"zod\";\nimport { isSafeGitRef, type GitHubTreeEntry } from \"./github-publication\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\n\ntype TrustedGitHubApiSandbox = Pick<Sandbox, \"runCommand\" | \"stop\">;\n\n/** GitHub API actions supported by Vercel-managed Sandbox credentials. */\nexport type VercelManagedGitHubApiAction = \"github:issues:read\" | \"github:pull-request:create\";\n\n/** Exact creation request for one Vercel-managed GitHub API operation. */\nexport interface VercelManagedGitHubApiSandboxCreateInput {\n  source?: {\n    type: \"git\";\n    url: string;\n  };\n  __source_credentials?: true;\n  __commitAs?: {\n    name: string;\n    email: string;\n  };\n  __credentials: {\n    github: [\n      {\n        repositories: [RepositorySlug];\n        actions: [VercelManagedGitHubApiAction];\n      },\n    ];\n  };\n  networkPolicy: NetworkPolicy;\n  persistent: false;\n  resources: { vcpus: 6 };\n  runtime: \"node24\";\n  timeout: 60_000 | 180_000;\n}\n\n/** Configures fresh trusted Sandboxes for brokered GitHub API requests. */\nexport interface VercelManagedGitHubApiOptions {\n  /** Attribution metadata supplied when managed publication creates a signed commit. */\n  commitIdentity?: { name: string; email: string };\n  createSandbox?: (\n    input: VercelManagedGitHubApiSandboxCreateInput,\n  ) => Promise<TrustedGitHubApiSandbox>;\n}\n\n/** Authorized request to read one exact GitHub issue. */\nexport interface VercelManagedGitHubIssueInput {\n  repository: RepositorySlug;\n  issueNumber: number;\n  authorize(): Promise<void>;\n}\n\n/** Issue fields returned by a Vercel-managed GitHub API request. */\nexport interface VercelManagedGitHubIssue {\n  title: string;\n  body: string | null;\n  url: string;\n  pullRequest: boolean;\n}\n\n/** Authorized request to create one draft or ready GitHub pull request. */\nexport interface VercelManagedGitHubPullRequestInput {\n  repository: RepositorySlug;\n  title: string;\n  body: string;\n  head: string;\n  base: string;\n  draft: boolean;\n  authorize(): Promise<void>;\n}\n\n/** Pull-request identity returned by a Vercel-managed GitHub API request. */\nexport interface VercelManagedGitHubPullRequest {\n  pullRequestNumber: number;\n  pullRequestUrl: string;\n  draft: boolean;\n}\n\n/** Git Data and pull-request inputs for one idempotent managed publication. */\nexport interface VercelManagedGitHubPublicationInput {\n  repository: RepositorySlug;\n  baseCommit: string;\n  tree: readonly GitHubTreeEntry[];\n  commitMessage: string;\n  branch: string;\n  title: string;\n  body: string;\n  baseBranch: string;\n  draft: boolean;\n  authorize(): Promise<void>;\n}\n\n/** Commit and pull-request identities returned after managed publication. */\nexport interface VercelManagedGitHubPublication extends VercelManagedGitHubPullRequest {\n  commitSha: string;\n}\n\n/** Repository-scoped brokered GitHub API operations supplied by Vercel Sandbox. */\nexport interface VercelManagedGitHubApi {\n  readIssue(input: VercelManagedGitHubIssueInput): Promise<VercelManagedGitHubIssue>;\n  createPullRequest(\n    input: VercelManagedGitHubPullRequestInput,\n  ): Promise<VercelManagedGitHubPullRequest>;\n  publishPullRequest(\n    input: VercelManagedGitHubPublicationInput,\n  ): Promise<VercelManagedGitHubPublication>;\n}\n\n/** GitHub API failure returned through the managed credential Sandbox. */\nexport class VercelManagedGitHubApiError extends Error {\n  constructor(\n    readonly status: number,\n    message: string,\n  ) {\n    super(`GitHub API request failed (${status}): ${message}`);\n    this.name = \"VercelManagedGitHubApiError\";\n  }\n}\n\nconst sandboxResponseSchema = z.object({\n  status: z.number().int().min(100).max(599),\n  body: z.unknown(),\n});\nconst issueSchema = z.object({\n  title: z.string(),\n  body: z.string().nullable(),\n  html_url: z.url(),\n  pull_request: z.unknown().optional(),\n});\nconst pullRequestSchema = z.object({\n  number: z.number().int().positive(),\n  html_url: z.url(),\n  draft: z.boolean(),\n});\nconst shaSchema = z.string().regex(/^[a-f0-9]{40}$/u);\nconst commitSchema = z.object({\n  sha: shaSchema,\n  tree: z.object({ sha: shaSchema }),\n  parents: z.array(z.object({ sha: shaSchema })),\n});\nconst treeSchema = z.object({ sha: shaSchema });\nconst refSchema = z.object({ object: z.object({ sha: shaSchema }) });\nconst publicationPullSchema = pullRequestSchema.extend({\n  state: z.enum([\"open\", \"closed\"]),\n  head: z.object({ ref: z.string(), sha: shaSchema }),\n});\nconst publicationPathSchema = z\n  .string()\n  .min(1)\n  .max(1_024)\n  .refine((path) => Buffer.byteLength(path, \"utf8\") <= 1_024, {\n    message: \"Managed publication path exceeds byte limit\",\n  })\n  .refine(\n    (path) =>\n      /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u.test(path) &&\n      !path.includes(\"..\") &&\n      !path.includes(\"//\") &&\n      !path.endsWith(\"/\") &&\n      !path.split(\"/\").some((part) => part === \".\"),\n    { message: \"Invalid managed publication path\" },\n  );\nconst publicationBranchSchema = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine(\n    (branch) =>\n      isSafeGitRef(branch) &&\n      branch\n        .split(\"/\")\n        .every(\n          (component) =>\n            component.length > 0 &&\n            !component.startsWith(\".\") &&\n            !component.endsWith(\".\") &&\n            !component.endsWith(\".lock\"),\n        ),\n    { message: \"Invalid managed publication branch\" },\n  );\nconst publicationTextSchema = (maximum: number, field: string) =>\n  z\n    .string()\n    .max(maximum)\n    .refine((value) => Buffer.byteLength(value, \"utf8\") <= maximum, {\n      message: `Managed publication ${field} exceeds byte limit`,\n    });\nconst publicationCommitMessageSchema = publicationTextSchema(65_536, \"commit message\").min(1);\nconst publicationTitleSchema = publicationTextSchema(256, \"title\").min(1);\nconst publicationBodySchema = publicationTextSchema(65_536, \"body\");\nconst publicationBaseBranchSchema = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine((branch) => isSafeGitRef(branch), {\n    message: \"Invalid managed publication base branch\",\n  });\nconst publicationContentSchema = z\n  .string()\n  .max(200_000)\n  .refine((content) => Buffer.byteLength(content, \"utf8\") <= 200_000, {\n    message: \"Managed publication content exceeds byte limit\",\n  });\nconst publicationTreeSchema = z\n  .array(\n    z.union([\n      z.strictObject({\n        path: publicationPathSchema,\n        mode: z.enum([\"100644\", \"100755\"]),\n        type: z.literal(\"blob\"),\n        content: publicationContentSchema,\n      }),\n      z.strictObject({\n        path: publicationPathSchema,\n        mode: z.enum([\"100644\", \"100755\"]),\n        type: z.literal(\"blob\"),\n        sha: z.null(),\n      }),\n    ]),\n  )\n  .min(1)\n  .max(25)\n  .refine(\n    (entries) =>\n      new TextEncoder().encode(JSON.stringify({ tree: entries })).byteLength <= 1_000_000,\n    \"Managed publication tree exceeds transfer limit\",\n  );\nconst githubRequestScript = `\nconst request = JSON.parse(process.argv[1]);\nconst response = await fetch(request.url, {\n  method: request.method,\n  headers: {\n    accept: \"application/vnd.github+json\",\n    \"content-type\": \"application/json\",\n    \"x-github-api-version\": \"2022-11-28\",\n  },\n  body: request.body === undefined ? undefined : JSON.stringify(request.body),\n  redirect: \"error\",\n});\nconst reader = response.body?.getReader();\nconst chunks = [];\nlet byteLength = 0;\nif (reader) {\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    byteLength += value.byteLength;\n    if (byteLength > 1_000_000) {\n      await reader.cancel();\n      throw new Error(\"GitHub API response exceeds transfer limit\");\n    }\n    chunks.push(value);\n  }\n}\nconst bytes = new Uint8Array(byteLength);\nlet offset = 0;\nfor (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }\nconst text = new TextDecoder().decode(bytes);\nlet body = null;\ntry { body = text === \"\" ? null : JSON.parse(text); } catch { body = { message: text }; }\nprocess.stdout.write(JSON.stringify({ status: response.status, body }));\n`;\n\nasync function createManagedSandbox(\n  input: VercelManagedGitHubApiSandboxCreateInput,\n): Promise<TrustedGitHubApiSandbox> {\n  const { Sandbox } = await import(\"@vercel/sandbox\");\n  return Sandbox.create({ ...input });\n}\n\nfunction createInput(\n  repository: RepositorySlug,\n  action: VercelManagedGitHubApiAction,\n): VercelManagedGitHubApiSandboxCreateInput {\n  return {\n    __credentials: { github: [{ repositories: [repository], actions: [action] }] },\n    networkPolicy: { allow: [\"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: 60_000,\n  };\n}\n\nfunction createPublicationInput(\n  repository: RepositorySlug,\n  commitIdentity: { name: string; email: string },\n): VercelManagedGitHubApiSandboxCreateInput {\n  return {\n    source: { type: \"git\", url: `https://github.com/${repository}.git` },\n    __source_credentials: true,\n    __commitAs: commitIdentity,\n    __credentials: {\n      github: [\n        {\n          repositories: [repository],\n          actions: [\"github:pull-request:create\"],\n        },\n      ],\n    },\n    networkPolicy: { allow: [\"github.com\", \"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: 180_000,\n  };\n}\n\nasync function request(\n  createSandbox: (\n    input: VercelManagedGitHubApiSandboxCreateInput,\n  ) => Promise<TrustedGitHubApiSandbox>,\n  input: {\n    repository: RepositorySlug;\n    action: VercelManagedGitHubApiAction;\n    method: \"GET\" | \"POST\";\n    path: string;\n    body?: unknown;\n    authorize(): Promise<void>;\n  },\n): Promise<unknown> {\n  const sandbox = await createSandbox(createInput(input.repository, input.action));\n  try {\n    await input.authorize();\n    const result = await sandbox.runCommand({\n      cmd: \"node\",\n      args: [\n        \"--input-type=module\",\n        \"--eval\",\n        githubRequestScript,\n        JSON.stringify({\n          method: input.method,\n          url: `https://api.github.com/repos/${input.repository}${input.path}`,\n          ...(input.body === undefined ? {} : { body: input.body }),\n        }),\n      ],\n      timeoutMs: 30_000,\n    });\n    const stderr = (await result.stderr()).trim();\n    if (result.exitCode !== 0) {\n      throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);\n    }\n    const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));\n    if (response.status < 200 || response.status >= 300) {\n      const message = z.object({ message: z.string() }).safeParse(response.body);\n      throw new VercelManagedGitHubApiError(\n        response.status,\n        message.success ? message.data.message : \"Unexpected response\",\n      );\n    }\n    return response.body;\n  } finally {\n    await sandbox.stop();\n  }\n}\n\nasync function sandboxRequest(\n  sandbox: TrustedGitHubApiSandbox,\n  input: {\n    repository: RepositorySlug;\n    method: \"GET\" | \"POST\";\n    path: string;\n    body?: unknown;\n  },\n): Promise<unknown> {\n  const result = await sandbox.runCommand({\n    cmd: \"node\",\n    args: [\n      \"--input-type=module\",\n      \"--eval\",\n      githubRequestScript,\n      JSON.stringify({\n        method: input.method,\n        url: `https://api.github.com/repos/${input.repository}${input.path}`,\n        ...(input.body === undefined ? {} : { body: input.body }),\n      }),\n    ],\n    timeoutMs: 30_000,\n  });\n  const stderr = (await result.stderr()).trim();\n  if (result.exitCode !== 0) {\n    throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);\n  }\n  const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));\n  if (response.status < 200 || response.status >= 300) {\n    const message = z.object({ message: z.string() }).safeParse(response.body);\n    throw new VercelManagedGitHubApiError(\n      response.status,\n      message.success ? message.data.message : \"Unexpected response\",\n    );\n  }\n  return response.body;\n}\n\n/** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */\nexport function createVercelManagedGitHubApi(\n  options: VercelManagedGitHubApiOptions = {},\n): VercelManagedGitHubApi {\n  const createSandbox = options.createSandbox ?? createManagedSandbox;\n  return {\n    async readIssue(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!Number.isSafeInteger(input.issueNumber) || input.issueNumber < 1) {\n        throw new Error(\"Invalid GitHub issue number\");\n      }\n      const issue = issueSchema.parse(\n        await request(createSandbox, {\n          repository,\n          action: \"github:issues:read\",\n          method: \"GET\",\n          path: `/issues/${input.issueNumber}`,\n          authorize: input.authorize,\n        }),\n      );\n      return {\n        title: issue.title,\n        body: issue.body,\n        url: issue.html_url,\n        pullRequest: issue.pull_request !== undefined,\n      };\n    },\n    async createPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      const head = publicationBranchSchema.parse(input.head);\n      const base = publicationBaseBranchSchema.parse(input.base);\n      const title = publicationTitleSchema.parse(input.title);\n      const body = publicationBodySchema.parse(input.body);\n      const pull = pullRequestSchema.parse(\n        await request(createSandbox, {\n          repository,\n          action: \"github:pull-request:create\",\n          method: \"POST\",\n          path: \"/pulls\",\n          body: {\n            title,\n            body,\n            head,\n            base,\n            draft: input.draft,\n          },\n          authorize: input.authorize,\n        }),\n      );\n      return {\n        pullRequestNumber: pull.number,\n        pullRequestUrl: pull.html_url,\n        draft: pull.draft,\n      };\n    },\n    async publishPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!options.commitIdentity) throw new Error(\"Managed publication requires commit identity\");\n      if (!/^[a-f0-9]{40}$/u.test(input.baseCommit) || input.commitMessage.trim() === \"\") {\n        throw new Error(\"Invalid managed GitHub publication\");\n      }\n      const publicationTree = publicationTreeSchema.parse(input.tree);\n      const branch = publicationBranchSchema.parse(input.branch);\n      const baseBranch = publicationBaseBranchSchema.parse(input.baseBranch);\n      const title = publicationTitleSchema.parse(input.title);\n      const body = publicationBodySchema.parse(input.body);\n      const commitMessage = publicationCommitMessageSchema.parse(\n        `${input.commitMessage}\\n\\nCo-authored-by: ${options.commitIdentity.name} <${options.commitIdentity.email}>`,\n      );\n      const sandbox = await createSandbox(\n        createPublicationInput(repository, options.commitIdentity),\n      );\n      try {\n        const authorizedRequest = async (\n          request: Omit<Parameters<typeof sandboxRequest>[1], \"repository\">,\n        ) => {\n          await input.authorize();\n          return sandboxRequest(sandbox, { repository, ...request });\n        };\n        const base = commitSchema.parse(\n          await authorizedRequest({\n            method: \"GET\",\n            path: `/git/commits/${input.baseCommit}`,\n          }),\n        );\n        const tree = treeSchema.parse(\n          await authorizedRequest({\n            method: \"POST\",\n            path: \"/git/trees\",\n            body: { base_tree: base.tree.sha, tree: publicationTree },\n          }),\n        );\n        const pullPath = `/pulls?${new URLSearchParams({\n          state: \"all\",\n          head: `${repository.split(\"/\")[0]}:${branch}`,\n          per_page: \"100\",\n        })}`;\n        const pulls = async () =>\n          z\n            .array(publicationPullSchema)\n            .parse(await authorizedRequest({ method: \"GET\", path: pullPath }));\n        const result = (pull: z.infer<typeof pullRequestSchema>, commitSha: string) => ({\n          commitSha,\n          pullRequestNumber: pull.number,\n          pullRequestUrl: pull.html_url,\n          draft: pull.draft,\n        });\n        const refPath = `/git/ref/heads/${branch.split(\"/\").map(encodeURIComponent).join(\"/\")}`;\n        let existingRef: z.infer<typeof refSchema> | null;\n        try {\n          existingRef = refSchema.parse(await authorizedRequest({ method: \"GET\", path: refPath }));\n        } catch (error) {\n          if (!(error instanceof VercelManagedGitHubApiError) || error.status !== 404) throw error;\n          existingRef = null;\n        }\n        let commitSha = existingRef?.object.sha;\n        if (commitSha) {\n          const existingPull = (await pulls()).find((pull) => pull.head.ref === branch);\n          if (existingPull) {\n            if (existingPull.state !== \"open\") {\n              throw new Error(\"Managed publication pull request is closed\");\n            }\n            const existingCommit = commitSchema.parse(\n              await authorizedRequest({\n                method: \"GET\",\n                path: `/git/commits/${existingPull.head.sha}`,\n              }),\n            );\n            if (\n              existingCommit.tree.sha !== tree.sha ||\n              existingCommit.parents.length !== 1 ||\n              existingCommit.parents[0]?.sha !== input.baseCommit\n            ) {\n              throw new Error(\"Managed publication pull request contains different changes\");\n            }\n            return result(existingPull, existingPull.head.sha);\n          }\n          const existingCommit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"GET\",\n              path: `/git/commits/${commitSha}`,\n            }),\n          );\n          if (\n            existingCommit.tree.sha !== tree.sha ||\n            existingCommit.parents.length !== 1 ||\n            existingCommit.parents[0]?.sha !== input.baseCommit\n          ) {\n            throw new Error(\"Managed publication branch contains different changes\");\n          }\n        } else {\n          const commit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/git/commits\",\n              body: {\n                message: commitMessage,\n                tree: tree.sha,\n                parents: [input.baseCommit],\n              },\n            }),\n          );\n          commitSha = commit.sha;\n          try {\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/git/refs\",\n              body: { ref: `refs/heads/${branch}`, sha: commitSha },\n            });\n          } catch (error) {\n            const reconciled = refSchema.parse(\n              await authorizedRequest({ method: \"GET\", path: refPath }),\n            );\n            if (reconciled.object.sha !== commitSha) throw error;\n          }\n        }\n        let pull: z.infer<typeof pullRequestSchema>;\n        try {\n          pull = pullRequestSchema.parse(\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/pulls\",\n              body: {\n                title,\n                body,\n                head: branch,\n                base: baseBranch,\n                draft: input.draft,\n              },\n            }),\n          );\n        } catch (error) {\n          const reconciled = (await pulls()).find((candidate) => candidate.head.ref === branch);\n          if (!reconciled || reconciled.state !== \"open\" || reconciled.head.sha !== commitSha) {\n            throw error;\n          }\n          pull = reconciled;\n        }\n        return result(pull, commitSha);\n      } finally {\n        await sandbox.stop();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AA6GA,IAAa,8BAAb,cAAiD,MAAM;CAE1C;CADX,YACE,QACA,SACA;EACA,MAAM,8BAA8B,OAAO,KAAK,SAAS;EAHhD,KAAA,SAAA;EAIT,KAAK,OAAO;CACd;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;CACrC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG;CACzC,MAAM,EAAE,QAAQ;AAClB,CAAC;AACD,MAAM,cAAc,EAAE,OAAO;CAC3B,OAAO,EAAE,OAAO;CAChB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,IAAI;CAChB,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;AACD,MAAM,oBAAoB,EAAE,OAAO;CACjC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,IAAI;CAChB,OAAO,EAAE,QAAQ;AACnB,CAAC;AACD,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,iBAAiB;AACpD,MAAM,eAAe,EAAE,OAAO;CAC5B,KAAK;CACL,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;CACjC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC;AAC/C,CAAC;AACD,MAAM,aAAa,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;AAC9C,MAAM,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC;AACnE,MAAM,wBAAwB,kBAAkB,OAAO;CACrD,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;CAChC,MAAM,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,KAAK;CAAU,CAAC;AACpD,CAAC;AACD,MAAM,wBAAwB,EAC3B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAK,CAAC,CACV,QAAQ,SAAS,OAAO,WAAW,MAAM,MAAM,KAAK,MAAO,EAC1D,SAAS,8CACX,CAAC,CAAC,CACD,QACE,SACC,kCAAkC,KAAK,IAAI,KAC3C,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,GAAG,GAC9C,EAAE,SAAS,mCAAmC,CAChD;AACF,MAAM,0BAA0B,EAC7B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QACE,WACC,aAAa,MAAM,KACnB,OACG,MAAM,GAAG,CAAC,CACV,OACE,cACC,UAAU,SAAS,KACnB,CAAC,UAAU,WAAW,GAAG,KACzB,CAAC,UAAU,SAAS,GAAG,KACvB,CAAC,UAAU,SAAS,OAAO,CAC/B,GACJ,EAAE,SAAS,qCAAqC,CAClD;AACF,MAAM,yBAAyB,SAAiB,UAC9C,EACG,OAAO,CAAC,CACR,IAAI,OAAO,CAAC,CACZ,QAAQ,UAAU,OAAO,WAAW,OAAO,MAAM,KAAK,SAAS,EAC9D,SAAS,uBAAuB,MAAM,qBACxC,CAAC;AACL,MAAM,iCAAiC,sBAAsB,OAAQ,gBAAgB,CAAC,CAAC,IAAI,CAAC;AAC5F,MAAM,yBAAyB,sBAAsB,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC;AACxE,MAAM,wBAAwB,sBAAsB,OAAQ,MAAM;AAClE,MAAM,8BAA8B,EACjC,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QAAQ,WAAW,aAAa,MAAM,GAAG,EACxC,SAAS,0CACX,CAAC;AACH,MAAM,2BAA2B,EAC9B,OAAO,CAAC,CACR,IAAI,GAAO,CAAC,CACZ,QAAQ,YAAY,OAAO,WAAW,SAAS,MAAM,KAAK,KAAS,EAClE,SAAS,iDACX,CAAC;AACH,MAAM,wBAAwB,EAC3B,MACC,EAAE,MAAM,CACN,EAAE,aAAa;CACb,MAAM;CACN,MAAM,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACjC,MAAM,EAAE,QAAQ,MAAM;CACtB,SAAS;AACX,CAAC,GACD,EAAE,aAAa;CACb,MAAM;CACN,MAAM,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACjC,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK,EAAE,KAAK;AACd,CAAC,CACH,CAAC,CACH,CAAC,CACA,IAAI,CAAC,CAAC,CACN,IAAI,EAAE,CAAC,CACP,QACE,YACC,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,KAC5E,iDACF;AACF,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoC5B,eAAe,qBACb,OACkC;CAClC,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,OAAO,QAAQ,OAAO,EAAE,GAAG,MAAM,CAAC;AACpC;AAEA,SAAS,YACP,YACA,QAC0C;CAC1C,OAAO;EACL,eAAe,EAAE,QAAQ,CAAC;GAAE,cAAc,CAAC,UAAU;GAAG,SAAS,CAAC,MAAM;EAAE,CAAC,EAAE;EAC7E,eAAe,EAAE,OAAO,CAAC,gBAAgB,EAAE;EAC3C,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;AACF;AAEA,SAAS,uBACP,YACA,gBAC0C;CAC1C,OAAO;EACL,QAAQ;GAAE,MAAM;GAAO,KAAK,sBAAsB,WAAW;EAAM;EACnE,sBAAsB;EACtB,YAAY;EACZ,eAAe,EACb,QAAQ,CACN;GACE,cAAc,CAAC,UAAU;GACzB,SAAS,CAAC,4BAA4B;EACxC,CACF,EACF;EACA,eAAe,EAAE,OAAO,CAAC,cAAc,gBAAgB,EAAE;EACzD,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;AACF;AAEA,eAAe,QACb,eAGA,OAQkB;CAClB,MAAM,UAAU,MAAM,cAAc,YAAY,MAAM,YAAY,MAAM,MAAM,CAAC;CAC/E,IAAI;EACF,MAAM,MAAM,UAAU;EACtB,MAAM,SAAS,MAAM,QAAQ,WAAW;GACtC,KAAK;GACL,MAAM;IACJ;IACA;IACA;IACA,KAAK,UAAU;KACb,QAAQ,MAAM;KACd,KAAK,gCAAgC,MAAM,aAAa,MAAM;KAC9D,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;IACzD,CAAC;GACH;GACA,WAAW;EACb,CAAC;EACD,MAAM,UAAU,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;EAC5C,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,wCAAwC,OAAO,SAAS,KAAK,QAAQ;EAEvF,MAAM,WAAW,sBAAsB,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC;EACvF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;GACnD,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,SAAS,IAAI;GACzE,MAAM,IAAI,4BACR,SAAS,QACT,QAAQ,UAAU,QAAQ,KAAK,UAAU,qBAC3C;EACF;EACA,OAAO,SAAS;CAClB,UAAU;EACR,MAAM,QAAQ,KAAK;CACrB;AACF;AAEA,eAAe,eACb,SACA,OAMkB;CAClB,MAAM,SAAS,MAAM,QAAQ,WAAW;EACtC,KAAK;EACL,MAAM;GACJ;GACA;GACA;GACA,KAAK,UAAU;IACb,QAAQ,MAAM;IACd,KAAK,gCAAgC,MAAM,aAAa,MAAM;IAC9D,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;GACzD,CAAC;EACH;EACA,WAAW;CACb,CAAC;CACD,MAAM,UAAU,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;CAC5C,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,wCAAwC,OAAO,SAAS,KAAK,QAAQ;CAEvF,MAAM,WAAW,sBAAsB,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC;CACvF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;EACnD,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,SAAS,IAAI;EACzE,MAAM,IAAI,4BACR,SAAS,QACT,QAAQ,UAAU,QAAQ,KAAK,UAAU,qBAC3C;CACF;CACA,OAAO,SAAS;AAClB;;AAGA,SAAgB,6BACd,UAAyC,CAAC,GAClB;CACxB,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,OAAO;EACL,MAAM,UAAU,OAAO;GACrB,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,cAAc,GAClE,MAAM,IAAI,MAAM,6BAA6B;GAE/C,MAAM,QAAQ,YAAY,MACxB,MAAM,QAAQ,eAAe;IAC3B;IACA,QAAQ;IACR,QAAQ;IACR,MAAM,WAAW,MAAM;IACvB,WAAW,MAAM;GACnB,CAAC,CACH;GACA,OAAO;IACL,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,KAAK,MAAM;IACX,aAAa,MAAM,iBAAiB,KAAA;GACtC;EACF;EACA,MAAM,kBAAkB,OAAO;GAC7B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,MAAM,OAAO,wBAAwB,MAAM,MAAM,IAAI;GACrD,MAAM,OAAO,4BAA4B,MAAM,MAAM,IAAI;GACzD,MAAM,QAAQ,uBAAuB,MAAM,MAAM,KAAK;GACtD,MAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI;GACnD,MAAM,OAAO,kBAAkB,MAC7B,MAAM,QAAQ,eAAe;IAC3B;IACA,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;KACJ;KACA;KACA;KACA;KACA,OAAO,MAAM;IACf;IACA,WAAW,MAAM;GACnB,CAAC,CACH;GACA,OAAO;IACL,mBAAmB,KAAK;IACxB,gBAAgB,KAAK;IACrB,OAAO,KAAK;GACd;EACF;EACA,MAAM,mBAAmB,OAAO;GAC9B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,QAAQ,gBAAgB,MAAM,IAAI,MAAM,8CAA8C;GAC3F,IAAI,CAAC,kBAAkB,KAAK,MAAM,UAAU,KAAK,MAAM,cAAc,KAAK,MAAM,IAC9E,MAAM,IAAI,MAAM,oCAAoC;GAEtD,MAAM,kBAAkB,sBAAsB,MAAM,MAAM,IAAI;GAC9D,MAAM,SAAS,wBAAwB,MAAM,MAAM,MAAM;GACzD,MAAM,aAAa,4BAA4B,MAAM,MAAM,UAAU;GACrE,MAAM,QAAQ,uBAAuB,MAAM,MAAM,KAAK;GACtD,MAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI;GACnD,MAAM,gBAAgB,+BAA+B,MACnD,GAAG,MAAM,cAAc,sBAAsB,QAAQ,eAAe,KAAK,IAAI,QAAQ,eAAe,MAAM,EAC5G;GACA,MAAM,UAAU,MAAM,cACpB,uBAAuB,YAAY,QAAQ,cAAc,CAC3D;GACA,IAAI;IACF,MAAM,oBAAoB,OACxB,YACG;KACH,MAAM,MAAM,UAAU;KACtB,OAAO,eAAe,SAAS;MAAE;MAAY,GAAG;KAAQ,CAAC;IAC3D;IACA,MAAM,OAAO,aAAa,MACxB,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM,gBAAgB,MAAM;IAC9B,CAAC,CACH;IACA,MAAM,OAAO,WAAW,MACtB,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM;KACN,MAAM;MAAE,WAAW,KAAK,KAAK;MAAK,MAAM;KAAgB;IAC1D,CAAC,CACH;IACA,MAAM,WAAW,UAAU,IAAI,gBAAgB;KAC7C,OAAO;KACP,MAAM,GAAG,WAAW,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG;KACrC,UAAU;IACZ,CAAC;IACD,MAAM,QAAQ,YACZ,EACG,MAAM,qBAAqB,CAAC,CAC5B,MAAM,MAAM,kBAAkB;KAAE,QAAQ;KAAO,MAAM;IAAS,CAAC,CAAC;IACrE,MAAM,UAAU,MAAyC,eAAuB;KAC9E;KACA,mBAAmB,KAAK;KACxB,gBAAgB,KAAK;KACrB,OAAO,KAAK;IACd;IACA,MAAM,UAAU,kBAAkB,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;IACpF,IAAI;IACJ,IAAI;KACF,cAAc,UAAU,MAAM,MAAM,kBAAkB;MAAE,QAAQ;MAAO,MAAM;KAAQ,CAAC,CAAC;IACzF,SAAS,OAAO;KACd,IAAI,EAAE,iBAAiB,gCAAgC,MAAM,WAAW,KAAK,MAAM;KACnF,cAAc;IAChB;IACA,IAAI,YAAY,aAAa,OAAO;IACpC,IAAI,WAAW;KACb,MAAM,gBAAgB,MAAM,MAAM,EAAA,CAAG,MAAM,SAAS,KAAK,KAAK,QAAQ,MAAM;KAC5E,IAAI,cAAc;MAChB,IAAI,aAAa,UAAU,QACzB,MAAM,IAAI,MAAM,4CAA4C;MAE9D,MAAM,iBAAiB,aAAa,MAClC,MAAM,kBAAkB;OACtB,QAAQ;OACR,MAAM,gBAAgB,aAAa,KAAK;MAC1C,CAAC,CACH;MACA,IACE,eAAe,KAAK,QAAQ,KAAK,OACjC,eAAe,QAAQ,WAAW,KAClC,eAAe,QAAQ,EAAE,EAAE,QAAQ,MAAM,YAEzC,MAAM,IAAI,MAAM,6DAA6D;MAE/E,OAAO,OAAO,cAAc,aAAa,KAAK,GAAG;KACnD;KACA,MAAM,iBAAiB,aAAa,MAClC,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM,gBAAgB;KACxB,CAAC,CACH;KACA,IACE,eAAe,KAAK,QAAQ,KAAK,OACjC,eAAe,QAAQ,WAAW,KAClC,eAAe,QAAQ,EAAE,EAAE,QAAQ,MAAM,YAEzC,MAAM,IAAI,MAAM,uDAAuD;IAE3E,OAAO;KAYL,YAXe,aAAa,MAC1B,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM;MACN,MAAM;OACJ,SAAS;OACT,MAAM,KAAK;OACX,SAAS,CAAC,MAAM,UAAU;MAC5B;KACF,CAAC,CAEc,CAAC,CAAC;KACnB,IAAI;MACF,MAAM,kBAAkB;OACtB,QAAQ;OACR,MAAM;OACN,MAAM;QAAE,KAAK,cAAc;QAAU,KAAK;OAAU;MACtD,CAAC;KACH,SAAS,OAAO;MAId,IAHmB,UAAU,MAC3B,MAAM,kBAAkB;OAAE,QAAQ;OAAO,MAAM;MAAQ,CAAC,CAE7C,CAAC,CAAC,OAAO,QAAQ,WAAW,MAAM;KACjD;IACF;IACA,IAAI;IACJ,IAAI;KACF,OAAO,kBAAkB,MACvB,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM;MACN,MAAM;OACJ;OACA;OACA,MAAM;OACN,MAAM;OACN,OAAO,MAAM;MACf;KACF,CAAC,CACH;IACF,SAAS,OAAO;KACd,MAAM,cAAc,MAAM,MAAM,EAAA,CAAG,MAAM,cAAc,UAAU,KAAK,QAAQ,MAAM;KACpF,IAAI,CAAC,cAAc,WAAW,UAAU,UAAU,WAAW,KAAK,QAAQ,WACxE,MAAM;KAER,OAAO;IACT;IACA,OAAO,OAAO,MAAM,SAAS;GAC/B,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;CACF;AACF"}

package/dist/vercel.d.mts

@@ -1,6 +1,7 @@
 import { RepositorySlug } from "./schema/repository.mjs";
 import { WorkNotification, WorkNotifications } from "./store/work-notifications.mjs";
-import { VercelGitHubGitTransportOptions, VercelGitHubTokenInput, createVercelGitHubGitTransport } from "./vercel-git.mjs";
+import { VercelManagedGitHubApi, VercelManagedGitHubApiAction, VercelManagedGitHubApiError, VercelManagedGitHubApiOptions, VercelManagedGitHubApiSandboxCreateInput, VercelManagedGitHubIssue, VercelManagedGitHubIssueInput, VercelManagedGitHubPublication, VercelManagedGitHubPublicationInput, VercelManagedGitHubPullRequest, VercelManagedGitHubPullRequestInput, createVercelManagedGitHubApi } from "./vercel-github-api.mjs";
+import { VercelGitHubGitTransportOptions, VercelGitHubTokenInput, VercelManagedGitHubGitTransportOptions, VercelManagedGitHubSandboxCreateInput, createVercelGitHubGitTransport, createVercelManagedGitHubGitTransport } from "./vercel-git.mjs";
 //#region src/vercel.d.ts
 /** Provider delivery settings applied to one Vercel Queue message. */
 interface VercelQueueSendOptions {
@@ -59,5 +60,5 @@ declare function normalizeVercelProductionDeployment(payload: unknown): VercelPr
 /** Verify a personal Vercel API token against Vercel; never infer a person from workload OIDC. */
 declare function authenticateVercelUserToken(request: Request, fetcher?: typeof fetch): Promise<string | null>;
 //#endregion
-export { type VercelGitHubGitTransportOptions, type VercelGitHubTokenInput, VercelProductionDeployment, VercelQueueSend, VercelQueueSendOptions, VercelWorkQueue, VercelWorkQueueOptions, authenticateVercelUserToken, createVercelGitHubGitTransport, createVercelWorkQueue, normalizeVercelProductionDeployment, verifyVercelSignature };
+export { type VercelGitHubGitTransportOptions, type VercelGitHubTokenInput, type VercelManagedGitHubApi, type VercelManagedGitHubApiAction, VercelManagedGitHubApiError, type VercelManagedGitHubApiOptions, type VercelManagedGitHubApiSandboxCreateInput, type VercelManagedGitHubGitTransportOptions, type VercelManagedGitHubIssue, type VercelManagedGitHubIssueInput, type VercelManagedGitHubPublication, type VercelManagedGitHubPublicationInput, type VercelManagedGitHubPullRequest, type VercelManagedGitHubPullRequestInput, type VercelManagedGitHubSandboxCreateInput, VercelProductionDeployment, VercelQueueSend, VercelQueueSendOptions, VercelWorkQueue, VercelWorkQueueOptions, authenticateVercelUserToken, createVercelGitHubGitTransport, createVercelManagedGitHubApi, createVercelManagedGitHubGitTransport, createVercelWorkQueue, normalizeVercelProductionDeployment, verifyVercelSignature };
 //# sourceMappingURL=vercel.d.mts.map

package/dist/vercel.mjs

@@ -1,6 +1,7 @@
 import { repositorySlugSchema } from "./schema/repository.mjs";
 import { workNotificationSchema } from "./store/work-notifications.mjs";
-import { createVercelGitHubGitTransport } from "./vercel-git.mjs";
+import { VercelManagedGitHubApiError, createVercelManagedGitHubApi } from "./vercel-github-api.mjs";
+import { createVercelGitHubGitTransport, createVercelManagedGitHubGitTransport } from "./vercel-git.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { z } from "zod";
 //#region src/vercel.ts
@@ -102,6 +103,6 @@ async function authenticateVercelUserToken(request, fetcher = fetch) {
 	return result.success ? `vercel:${result.data.user.id}` : null;
 }
 //#endregion
-export { authenticateVercelUserToken, createVercelGitHubGitTransport, createVercelWorkQueue, normalizeVercelProductionDeployment, verifyVercelSignature };
+export { VercelManagedGitHubApiError, authenticateVercelUserToken, createVercelGitHubGitTransport, createVercelManagedGitHubApi, createVercelManagedGitHubGitTransport, createVercelWorkQueue, normalizeVercelProductionDeployment, verifyVercelSignature };
 
 //# sourceMappingURL=vercel.mjs.map