@vercel/factory 0.0.23 → 0.0.24

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @vercel/factory
 
+## 0.0.24
+
+### Patch Changes
+
+- 6a062c0: Authorize Vercel-managed GitHub credentials to act as the factory creator.
+
 ## 0.0.23
 
 ### Patch Changes

package/dist/schema/factory-config.d.mts

@@ -70,6 +70,7 @@ declare const factoryConfigSchema: z.ZodReadonly<z.ZodObject<{
     connect: "connect";
     vercel: "vercel";
   }>>;
+  sandboxGitHubActAs: z.ZodOptional<z.ZodString>;
   commitIdentity: z.ZodDefault<z.ZodReadonly<z.ZodObject<{
     name: z.ZodString;
     email: z.ZodString;

package/dist/schema/factory-config.mjs

@@ -53,6 +53,7 @@ const factoryConfigSchema = z.strictObject({
 	repositories: z.array(factoryConfigRepositorySchema).min(1).readonly().describe("Repositories this factory is allowed to inspect and change."),
 	operators: z.array(z.string().min(1)).min(1).readonly().describe("Provider-qualified identities allowed to operate this factory."),
 	sandboxGitHubCredentials: z.enum(["connect", "vercel"]).default("connect").describe("Credential source selected for trusted GitHub Sandbox operations."),
+	sandboxGitHubActAs: z.string().regex(/^[1-9][0-9]*$/u).max(16).refine((id) => Number.isSafeInteger(Number(id))).optional().describe("GitHub user ID selected for Vercel-managed GitHub API Sandbox operations."),
 	commitIdentity: commitIdentitySchema.default({
 		name: "Vercel Factory",
 		email: "not+real@example.org"
@@ -79,6 +80,11 @@ const factoryConfigSchema = z.strictObject({
 		],
 		message: "PR notification destinations must name a configured repository."
 	});
+	if (config.sandboxGitHubActAs !== void 0 && config.sandboxGitHubCredentials !== "vercel") ctx.addIssue({
+		code: "custom",
+		path: ["sandboxGitHubActAs"],
+		message: "A managed GitHub act-as identity requires Vercel-managed Sandbox credentials."
+	});
 }).readonly();
 /** Validates a Factory configuration and applies its declared defaults. */
 function defineFactory(config) {

package/dist/schema/factory-config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"factory-config.mjs","names":[],"sources":["../../src/schema/factory-config.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { allowByDefaultApprovalPolicy, approvalPolicySchema } from \"../approval\";\nimport { budgetLimitsSchema } from \"./budget\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./repository\";\nimport { taskKindSchema } from \"./task\";\nimport { slackPrNotificationsSchema } from \"./slack-pr-notifications\";\n\n/** Validates one repository allowlist entry and its configured dependency ordering. */\nexport const factoryConfigRepositorySchema = z\n  .strictObject({\n    slug: repositorySlugSchema.describe(\"Repository this factory may work on.\"),\n    defaultBranch: z\n      .string()\n      .min(1)\n      .default(\"main\")\n      .describe(\"Branch changes land on, usually main.\"),\n    dependsOn: z\n      .array(repositorySlugSchema)\n      .readonly()\n      .default([])\n      .describe(\"Repositories that must land changes before this repository.\"),\n  })\n  .readonly();\n\nconst githubConnectorSchema = z\n  .strictObject({\n    owner: z\n      .string()\n      .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"GitHub user or organization that owns this connector installation.\"),\n    connector: z\n      .string()\n      .regex(/^github\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this GitHub owner.\"),\n  })\n  .readonly();\n\nconst slackConnectorSchema = z\n  .strictObject({\n    connector: z\n      .string()\n      .regex(/^slack\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this Slack app.\"),\n    operatorDirectMessages: z\n      .boolean()\n      .default(false)\n      .describe(\n        \"Opt in to operator DMs for human-action requests, digests, and budget alerts. Independent of operator authorization, PR announcements, and replies in the original conversation.\",\n      ),\n    approvalChannel: z\n      .string()\n      .regex(/^[CDG][A-Z0-9]+$/u)\n      .optional()\n      .describe(\n        \"Explicit Slack channel for approval proposals that have no originating Slack thread. Absent disables cross-channel approval notifications.\",\n      ),\n    autonomousPullRequests: slackPrNotificationsSchema\n      .optional()\n      .describe(\n        \"Channel announcements for every Factory-produced PR, including human-requested work, in addition to the original conversation reply. Saved Slack settings override this default; resetting restores it. Absent disables announcements unless Slack enables them.\",\n      ),\n    autonomousPullRequestsByRepository: z\n      .record(repositorySlugSchema, slackPrNotificationsSchema.nullable())\n      .readonly()\n      .optional()\n      .describe(\n        \"Repository-specific PR destinations, taking precedence over the factory-wide default. Null disables announcements for that repository. Saved repository settings override these entries.\",\n      ),\n  })\n  .readonly();\n\nfunction isSupportedCommitIdentityValue(value: string, maxBytes: number): boolean {\n  return (\n    value.trim() === value &&\n    !/[\\0\\r\\n<>]/u.test(value) &&\n    new TextEncoder().encode(value).byteLength <= maxBytes\n  );\n}\n\nconst commitIdentitySchema = z\n  .strictObject({\n    name: z\n      .string()\n      .min(1)\n      .refine((value) => isSupportedCommitIdentityValue(value, 256))\n      .describe(\"Name recorded on Factory-authored commits.\"),\n    email: z\n      .string()\n      .email()\n      .refine((value) => isSupportedCommitIdentityValue(value, 320))\n      .describe(\"Email recorded on Factory-authored commits.\"),\n  })\n  .readonly();\n\n/** Validates stall detection and replacement-attempt limits for running Tasks. */\nexport const executionPolicySchema = z\n  .strictObject({\n    maxAttempts: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Attempts a task may consume before a stall fails it for good.\"),\n    stallMinutes: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Minutes without progress before a running task is marked stalled.\"),\n    stallMinutesByKind: z\n      .partialRecord(taskKindSchema, z.number().int().min(1))\n      .readonly()\n      .default({})\n      .describe(\"Per-kind stall windows for long single-step work, e.g. security_scan: 300.\"),\n  })\n  .readonly();\n\n/** Stall detection and retry limits applied to running Tasks. */\nexport type ExecutionPolicy = z.infer<typeof executionPolicySchema>;\n\n/** Conservative default stall window and three-attempt execution policy. */\nexport const defaultExecutionPolicy = executionPolicySchema.parse({\n  maxAttempts: 3,\n  stallMinutes: 45,\n  stallMinutesByKind: {},\n});\n\n/** Validates the repositories, operators, connectors, budget, and policies of a Factory. */\nexport const factoryConfigSchema = z\n  .strictObject({\n    connectors: z\n      .strictObject({\n        github: z\n          .array(githubConnectorSchema)\n          .readonly()\n          .refine(\n            (connectors) =>\n              new Set(connectors.map(({ owner }) => owner)).size === connectors.length,\n            \"GitHub connector owners must be unique.\",\n          ),\n        slack: z\n          .array(slackConnectorSchema)\n          .max(1, \"A factory may configure one Slack connector.\")\n          .readonly()\n          .default([]),\n      })\n      .readonly()\n      .default({ github: [], slack: [] })\n      .describe(\"Provider connections available to this factory.\"),\n    repositories: z\n      .array(factoryConfigRepositorySchema)\n      .min(1)\n      .readonly()\n      .describe(\"Repositories this factory is allowed to inspect and change.\"),\n    operators: z\n      .array(z.string().min(1))\n      .min(1)\n      .readonly()\n      .describe(\"Provider-qualified identities allowed to operate this factory.\"),\n    sandboxGitHubCredentials: z\n      .enum([\"connect\", \"vercel\"])\n      .default(\"connect\")\n      .describe(\"Credential source selected for trusted GitHub Sandbox operations.\"),\n    commitIdentity: commitIdentitySchema\n      .default({ name: \"Vercel Factory\", email: \"not+real@example.org\" })\n      .describe(\"Replaceable attribution metadata for Factory-authored commits.\"),\n    approval: approvalPolicySchema\n      .default(allowByDefaultApprovalPolicy)\n      .describe(\"Which Tasks wait for a human before they run. First match wins.\"),\n    budget: budgetLimitsSchema\n      .default({\n        totalUsd: 500,\n        investigationUsd: 100,\n        perTaskReservationUsd: 5,\n        warningPercent: 80,\n      })\n      .describe(\"Monthly spending thresholds and per-task accounting reservations.\"),\n    enforceBudget: z\n      .boolean()\n      .default(true)\n      .describe(\n        \"Refuse new work above the monthly budget. False keeps cost accounting without spending limits or budget alerts.\",\n      ),\n    execution: executionPolicySchema\n      .default(defaultExecutionPolicy)\n      .describe(\"Stall detection and retry limits for running tasks.\"),\n  })\n  .superRefine((config, ctx) => {\n    const repositories = new Set<string>(config.repositories.map(({ slug }) => slug));\n    for (const [index, connector] of config.connectors.slack.entries()) {\n      for (const slug of Object.keys(connector.autonomousPullRequestsByRepository ?? {})) {\n        if (!repositories.has(slug))\n          ctx.addIssue({\n            code: \"custom\",\n            path: [\"connectors\", \"slack\", index, \"autonomousPullRequestsByRepository\", slug],\n            message: \"PR notification destinations must name a configured repository.\",\n          });\n      }\n    }\n  })\n  .readonly();\n\n/** Fully resolved repository allowlist entry in a Factory configuration. */\nexport type FactoryConfigRepository = z.infer<typeof factoryConfigRepositorySchema>;\n\n/** Fully resolved and validated Factory configuration. */\nexport type FactoryConfig = z.infer<typeof factoryConfigSchema>;\ntype FactoryConfigSchemaInput = z.input<typeof factoryConfigSchema>;\ntype FactoryConfigConnectorsInput = Readonly<{\n  github: readonly Readonly<z.input<typeof githubConnectorSchema>>[];\n  slack?: readonly Readonly<z.input<typeof slackConnectorSchema>>[];\n}>;\n/** Repository allowlist entry accepted when defining a Factory, before defaults are applied. */\nexport type FactoryConfigRepositoryInput = Readonly<{\n  slug: RepositorySlug;\n  defaultBranch?: string;\n  dependsOn?: readonly RepositorySlug[];\n}>;\n/** Caller input accepted when defining a Factory, before schema defaults are applied. */\nexport type FactoryConfigInput = Readonly<\n  Omit<FactoryConfigSchemaInput, \"connectors\" | \"repositories\" | \"operators\"> & {\n    connectors?: FactoryConfigConnectorsInput;\n    repositories: readonly FactoryConfigRepositoryInput[];\n    operators: readonly string[];\n  }\n>;\n\n/** Validates a Factory configuration and applies its declared defaults. */\nexport function defineFactory(config: FactoryConfigInput): FactoryConfig {\n  return factoryConfigSchema.parse(config);\n}\n"],"mappings":";;;;;;;;AAQA,MAAa,gCAAgC,EAC1C,aAAa;CACZ,MAAM,qBAAqB,SAAS,sCAAsC;CAC1E,eAAe,EACZ,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,MAAM,CAAC,CACf,SAAS,uCAAuC;CACnD,WAAW,EACR,MAAM,oBAAoB,CAAC,CAC3B,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,6DAA6D;AAC3E,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,wBAAwB,EAC3B,aAAa;CACZ,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,mCAAmC,CAAC,CAC1C,SAAS,oEAAoE;CAChF,WAAW,EACR,OAAO,CAAC,CACR,MAAM,2CAA2C,CAAC,CAClD,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,uBAAuB,EAC1B,aAAa;CACZ,WAAW,EACR,OAAO,CAAC,CACR,MAAM,0CAA0C,CAAC,CACjD,SAAS,kDAAkD;CAC9D,wBAAwB,EACrB,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,kLACF;CACF,iBAAiB,EACd,OAAO,CAAC,CACR,MAAM,mBAAmB,CAAC,CAC1B,SAAS,CAAC,CACV,SACC,4IACF;CACF,wBAAwB,2BACrB,SAAS,CAAC,CACV,SACC,kQACF;CACF,oCAAoC,EACjC,OAAO,sBAAsB,2BAA2B,SAAS,CAAC,CAAC,CACnE,SAAS,CAAC,CACV,SAAS,CAAC,CACV,SACC,0LACF;AACJ,CAAC,CAAC,CACD,SAAS;AAEZ,SAAS,+BAA+B,OAAe,UAA2B;CAChF,OACE,MAAM,KAAK,MAAM,SACjB,CAAC,cAAc,KAAK,KAAK,KACzB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,cAAc;AAElD;AAEA,MAAM,uBAAuB,EAC1B,aAAa;CACZ,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,UAAU,+BAA+B,OAAO,GAAG,CAAC,CAAC,CAC7D,SAAS,4CAA4C;CACxD,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,CAAC,CACP,QAAQ,UAAU,+BAA+B,OAAO,GAAG,CAAC,CAAC,CAC7D,SAAS,6CAA6C;AAC3D,CAAC,CAAC,CACD,SAAS;;AAGZ,MAAa,wBAAwB,EAClC,aAAa;CACZ,aAAa,EACV,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,+DAA+D;CAC3E,cAAc,EACX,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,mEAAmE;CAC/E,oBAAoB,EACjB,cAAc,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,4EAA4E;AAC1F,CAAC,CAAC,CACD,SAAS;;AAMZ,MAAa,yBAAyB,sBAAsB,MAAM;CAChE,aAAa;CACb,cAAc;CACd,oBAAoB,CAAC;AACvB,CAAC;;AAGD,MAAa,sBAAsB,EAChC,aAAa;CACZ,YAAY,EACT,aAAa;EACZ,QAAQ,EACL,MAAM,qBAAqB,CAAC,CAC5B,SAAS,CAAC,CACV,QACE,eACC,IAAI,IAAI,WAAW,KAAK,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW,QACpE,yCACF;EACF,OAAO,EACJ,MAAM,oBAAoB,CAAC,CAC3B,IAAI,GAAG,8CAA8C,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC;CACf,CAAC,CAAC,CACD,SAAS,CAAC,CACV,QAAQ;EAAE,QAAQ,CAAC;EAAG,OAAO,CAAC;CAAE,CAAC,CAAC,CAClC,SAAS,iDAAiD;CAC7D,cAAc,EACX,MAAM,6BAA6B,CAAC,CACpC,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,6DAA6D;CACzE,WAAW,EACR,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACxB,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,gEAAgE;CAC5E,0BAA0B,EACvB,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,CAC3B,QAAQ,SAAS,CAAC,CAClB,SAAS,mEAAmE;CAC/E,gBAAgB,qBACb,QAAQ;EAAE,MAAM;EAAkB,OAAO;CAAuB,CAAC,CAAC,CAClE,SAAS,gEAAgE;CAC5E,UAAU,qBACP,QAAQ,4BAA4B,CAAC,CACrC,SAAS,iEAAiE;CAC7E,QAAQ,mBACL,QAAQ;EACP,UAAU;EACV,kBAAkB;EAClB,uBAAuB;EACvB,gBAAgB;CAClB,CAAC,CAAC,CACD,SAAS,mEAAmE;CAC/E,eAAe,EACZ,QAAQ,CAAC,CACT,QAAQ,IAAI,CAAC,CACb,SACC,iHACF;CACF,WAAW,sBACR,QAAQ,sBAAsB,CAAC,CAC/B,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,aAAa,QAAQ,QAAQ;CAC5B,MAAM,eAAe,IAAI,IAAY,OAAO,aAAa,KAAK,EAAE,WAAW,IAAI,CAAC;CAChF,KAAK,MAAM,CAAC,OAAO,cAAc,OAAO,WAAW,MAAM,QAAQ,GAC/D,KAAK,MAAM,QAAQ,OAAO,KAAK,UAAU,sCAAsC,CAAC,CAAC,GAC/E,IAAI,CAAC,aAAa,IAAI,IAAI,GACxB,IAAI,SAAS;EACX,MAAM;EACN,MAAM;GAAC;GAAc;GAAS;GAAO;GAAsC;EAAI;EAC/E,SAAS;CACX,CAAC;AAGT,CAAC,CAAC,CACD,SAAS;;AA4BZ,SAAgB,cAAc,QAA2C;CACvE,OAAO,oBAAoB,MAAM,MAAM;AACzC"}
+{"version":3,"file":"factory-config.mjs","names":[],"sources":["../../src/schema/factory-config.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { allowByDefaultApprovalPolicy, approvalPolicySchema } from \"../approval\";\nimport { budgetLimitsSchema } from \"./budget\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./repository\";\nimport { taskKindSchema } from \"./task\";\nimport { slackPrNotificationsSchema } from \"./slack-pr-notifications\";\n\n/** Validates one repository allowlist entry and its configured dependency ordering. */\nexport const factoryConfigRepositorySchema = z\n  .strictObject({\n    slug: repositorySlugSchema.describe(\"Repository this factory may work on.\"),\n    defaultBranch: z\n      .string()\n      .min(1)\n      .default(\"main\")\n      .describe(\"Branch changes land on, usually main.\"),\n    dependsOn: z\n      .array(repositorySlugSchema)\n      .readonly()\n      .default([])\n      .describe(\"Repositories that must land changes before this repository.\"),\n  })\n  .readonly();\n\nconst githubConnectorSchema = z\n  .strictObject({\n    owner: z\n      .string()\n      .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"GitHub user or organization that owns this connector installation.\"),\n    connector: z\n      .string()\n      .regex(/^github\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this GitHub owner.\"),\n  })\n  .readonly();\n\nconst slackConnectorSchema = z\n  .strictObject({\n    connector: z\n      .string()\n      .regex(/^slack\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this Slack app.\"),\n    operatorDirectMessages: z\n      .boolean()\n      .default(false)\n      .describe(\n        \"Opt in to operator DMs for human-action requests, digests, and budget alerts. Independent of operator authorization, PR announcements, and replies in the original conversation.\",\n      ),\n    approvalChannel: z\n      .string()\n      .regex(/^[CDG][A-Z0-9]+$/u)\n      .optional()\n      .describe(\n        \"Explicit Slack channel for approval proposals that have no originating Slack thread. Absent disables cross-channel approval notifications.\",\n      ),\n    autonomousPullRequests: slackPrNotificationsSchema\n      .optional()\n      .describe(\n        \"Channel announcements for every Factory-produced PR, including human-requested work, in addition to the original conversation reply. Saved Slack settings override this default; resetting restores it. Absent disables announcements unless Slack enables them.\",\n      ),\n    autonomousPullRequestsByRepository: z\n      .record(repositorySlugSchema, slackPrNotificationsSchema.nullable())\n      .readonly()\n      .optional()\n      .describe(\n        \"Repository-specific PR destinations, taking precedence over the factory-wide default. Null disables announcements for that repository. Saved repository settings override these entries.\",\n      ),\n  })\n  .readonly();\n\nfunction isSupportedCommitIdentityValue(value: string, maxBytes: number): boolean {\n  return (\n    value.trim() === value &&\n    !/[\\0\\r\\n<>]/u.test(value) &&\n    new TextEncoder().encode(value).byteLength <= maxBytes\n  );\n}\n\nconst commitIdentitySchema = z\n  .strictObject({\n    name: z\n      .string()\n      .min(1)\n      .refine((value) => isSupportedCommitIdentityValue(value, 256))\n      .describe(\"Name recorded on Factory-authored commits.\"),\n    email: z\n      .string()\n      .email()\n      .refine((value) => isSupportedCommitIdentityValue(value, 320))\n      .describe(\"Email recorded on Factory-authored commits.\"),\n  })\n  .readonly();\n\n/** Validates stall detection and replacement-attempt limits for running Tasks. */\nexport const executionPolicySchema = z\n  .strictObject({\n    maxAttempts: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Attempts a task may consume before a stall fails it for good.\"),\n    stallMinutes: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Minutes without progress before a running task is marked stalled.\"),\n    stallMinutesByKind: z\n      .partialRecord(taskKindSchema, z.number().int().min(1))\n      .readonly()\n      .default({})\n      .describe(\"Per-kind stall windows for long single-step work, e.g. security_scan: 300.\"),\n  })\n  .readonly();\n\n/** Stall detection and retry limits applied to running Tasks. */\nexport type ExecutionPolicy = z.infer<typeof executionPolicySchema>;\n\n/** Conservative default stall window and three-attempt execution policy. */\nexport const defaultExecutionPolicy = executionPolicySchema.parse({\n  maxAttempts: 3,\n  stallMinutes: 45,\n  stallMinutesByKind: {},\n});\n\n/** Validates the repositories, operators, connectors, budget, and policies of a Factory. */\nexport const factoryConfigSchema = z\n  .strictObject({\n    connectors: z\n      .strictObject({\n        github: z\n          .array(githubConnectorSchema)\n          .readonly()\n          .refine(\n            (connectors) =>\n              new Set(connectors.map(({ owner }) => owner)).size === connectors.length,\n            \"GitHub connector owners must be unique.\",\n          ),\n        slack: z\n          .array(slackConnectorSchema)\n          .max(1, \"A factory may configure one Slack connector.\")\n          .readonly()\n          .default([]),\n      })\n      .readonly()\n      .default({ github: [], slack: [] })\n      .describe(\"Provider connections available to this factory.\"),\n    repositories: z\n      .array(factoryConfigRepositorySchema)\n      .min(1)\n      .readonly()\n      .describe(\"Repositories this factory is allowed to inspect and change.\"),\n    operators: z\n      .array(z.string().min(1))\n      .min(1)\n      .readonly()\n      .describe(\"Provider-qualified identities allowed to operate this factory.\"),\n    sandboxGitHubCredentials: z\n      .enum([\"connect\", \"vercel\"])\n      .default(\"connect\")\n      .describe(\"Credential source selected for trusted GitHub Sandbox operations.\"),\n    sandboxGitHubActAs: z\n      .string()\n      .regex(/^[1-9][0-9]*$/u)\n      .max(16)\n      .refine((id) => Number.isSafeInteger(Number(id)))\n      .optional()\n      .describe(\"GitHub user ID selected for Vercel-managed GitHub API Sandbox operations.\"),\n    commitIdentity: commitIdentitySchema\n      .default({ name: \"Vercel Factory\", email: \"not+real@example.org\" })\n      .describe(\"Replaceable attribution metadata for Factory-authored commits.\"),\n    approval: approvalPolicySchema\n      .default(allowByDefaultApprovalPolicy)\n      .describe(\"Which Tasks wait for a human before they run. First match wins.\"),\n    budget: budgetLimitsSchema\n      .default({\n        totalUsd: 500,\n        investigationUsd: 100,\n        perTaskReservationUsd: 5,\n        warningPercent: 80,\n      })\n      .describe(\"Monthly spending thresholds and per-task accounting reservations.\"),\n    enforceBudget: z\n      .boolean()\n      .default(true)\n      .describe(\n        \"Refuse new work above the monthly budget. False keeps cost accounting without spending limits or budget alerts.\",\n      ),\n    execution: executionPolicySchema\n      .default(defaultExecutionPolicy)\n      .describe(\"Stall detection and retry limits for running tasks.\"),\n  })\n  .superRefine((config, ctx) => {\n    const repositories = new Set<string>(config.repositories.map(({ slug }) => slug));\n    for (const [index, connector] of config.connectors.slack.entries()) {\n      for (const slug of Object.keys(connector.autonomousPullRequestsByRepository ?? {})) {\n        if (!repositories.has(slug))\n          ctx.addIssue({\n            code: \"custom\",\n            path: [\"connectors\", \"slack\", index, \"autonomousPullRequestsByRepository\", slug],\n            message: \"PR notification destinations must name a configured repository.\",\n          });\n      }\n    }\n    if (config.sandboxGitHubActAs !== undefined && config.sandboxGitHubCredentials !== \"vercel\") {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"sandboxGitHubActAs\"],\n        message: \"A managed GitHub act-as identity requires Vercel-managed Sandbox credentials.\",\n      });\n    }\n  })\n  .readonly();\n\n/** Fully resolved repository allowlist entry in a Factory configuration. */\nexport type FactoryConfigRepository = z.infer<typeof factoryConfigRepositorySchema>;\n\n/** Fully resolved and validated Factory configuration. */\nexport type FactoryConfig = z.infer<typeof factoryConfigSchema>;\ntype FactoryConfigSchemaInput = z.input<typeof factoryConfigSchema>;\ntype FactoryConfigConnectorsInput = Readonly<{\n  github: readonly Readonly<z.input<typeof githubConnectorSchema>>[];\n  slack?: readonly Readonly<z.input<typeof slackConnectorSchema>>[];\n}>;\n/** Repository allowlist entry accepted when defining a Factory, before defaults are applied. */\nexport type FactoryConfigRepositoryInput = Readonly<{\n  slug: RepositorySlug;\n  defaultBranch?: string;\n  dependsOn?: readonly RepositorySlug[];\n}>;\n/** Caller input accepted when defining a Factory, before schema defaults are applied. */\nexport type FactoryConfigInput = Readonly<\n  Omit<FactoryConfigSchemaInput, \"connectors\" | \"repositories\" | \"operators\"> & {\n    connectors?: FactoryConfigConnectorsInput;\n    repositories: readonly FactoryConfigRepositoryInput[];\n    operators: readonly string[];\n  }\n>;\n\n/** Validates a Factory configuration and applies its declared defaults. */\nexport function defineFactory(config: FactoryConfigInput): FactoryConfig {\n  return factoryConfigSchema.parse(config);\n}\n"],"mappings":";;;;;;;;AAQA,MAAa,gCAAgC,EAC1C,aAAa;CACZ,MAAM,qBAAqB,SAAS,sCAAsC;CAC1E,eAAe,EACZ,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,MAAM,CAAC,CACf,SAAS,uCAAuC;CACnD,WAAW,EACR,MAAM,oBAAoB,CAAC,CAC3B,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,6DAA6D;AAC3E,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,wBAAwB,EAC3B,aAAa;CACZ,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,mCAAmC,CAAC,CAC1C,SAAS,oEAAoE;CAChF,WAAW,EACR,OAAO,CAAC,CACR,MAAM,2CAA2C,CAAC,CAClD,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,uBAAuB,EAC1B,aAAa;CACZ,WAAW,EACR,OAAO,CAAC,CACR,MAAM,0CAA0C,CAAC,CACjD,SAAS,kDAAkD;CAC9D,wBAAwB,EACrB,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,kLACF;CACF,iBAAiB,EACd,OAAO,CAAC,CACR,MAAM,mBAAmB,CAAC,CAC1B,SAAS,CAAC,CACV,SACC,4IACF;CACF,wBAAwB,2BACrB,SAAS,CAAC,CACV,SACC,kQACF;CACF,oCAAoC,EACjC,OAAO,sBAAsB,2BAA2B,SAAS,CAAC,CAAC,CACnE,SAAS,CAAC,CACV,SAAS,CAAC,CACV,SACC,0LACF;AACJ,CAAC,CAAC,CACD,SAAS;AAEZ,SAAS,+BAA+B,OAAe,UAA2B;CAChF,OACE,MAAM,KAAK,MAAM,SACjB,CAAC,cAAc,KAAK,KAAK,KACzB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,cAAc;AAElD;AAEA,MAAM,uBAAuB,EAC1B,aAAa;CACZ,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,UAAU,+BAA+B,OAAO,GAAG,CAAC,CAAC,CAC7D,SAAS,4CAA4C;CACxD,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,CAAC,CACP,QAAQ,UAAU,+BAA+B,OAAO,GAAG,CAAC,CAAC,CAC7D,SAAS,6CAA6C;AAC3D,CAAC,CAAC,CACD,SAAS;;AAGZ,MAAa,wBAAwB,EAClC,aAAa;CACZ,aAAa,EACV,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,+DAA+D;CAC3E,cAAc,EACX,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,mEAAmE;CAC/E,oBAAoB,EACjB,cAAc,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,4EAA4E;AAC1F,CAAC,CAAC,CACD,SAAS;;AAMZ,MAAa,yBAAyB,sBAAsB,MAAM;CAChE,aAAa;CACb,cAAc;CACd,oBAAoB,CAAC;AACvB,CAAC;;AAGD,MAAa,sBAAsB,EAChC,aAAa;CACZ,YAAY,EACT,aAAa;EACZ,QAAQ,EACL,MAAM,qBAAqB,CAAC,CAC5B,SAAS,CAAC,CACV,QACE,eACC,IAAI,IAAI,WAAW,KAAK,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW,QACpE,yCACF;EACF,OAAO,EACJ,MAAM,oBAAoB,CAAC,CAC3B,IAAI,GAAG,8CAA8C,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC;CACf,CAAC,CAAC,CACD,SAAS,CAAC,CACV,QAAQ;EAAE,QAAQ,CAAC;EAAG,OAAO,CAAC;CAAE,CAAC,CAAC,CAClC,SAAS,iDAAiD;CAC7D,cAAc,EACX,MAAM,6BAA6B,CAAC,CACpC,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,6DAA6D;CACzE,WAAW,EACR,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACxB,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,gEAAgE;CAC5E,0BAA0B,EACvB,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,CAC3B,QAAQ,SAAS,CAAC,CAClB,SAAS,mEAAmE;CAC/E,oBAAoB,EACjB,OAAO,CAAC,CACR,MAAM,gBAAgB,CAAC,CACvB,IAAI,EAAE,CAAC,CACP,QAAQ,OAAO,OAAO,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,CAChD,SAAS,CAAC,CACV,SAAS,2EAA2E;CACvF,gBAAgB,qBACb,QAAQ;EAAE,MAAM;EAAkB,OAAO;CAAuB,CAAC,CAAC,CAClE,SAAS,gEAAgE;CAC5E,UAAU,qBACP,QAAQ,4BAA4B,CAAC,CACrC,SAAS,iEAAiE;CAC7E,QAAQ,mBACL,QAAQ;EACP,UAAU;EACV,kBAAkB;EAClB,uBAAuB;EACvB,gBAAgB;CAClB,CAAC,CAAC,CACD,SAAS,mEAAmE;CAC/E,eAAe,EACZ,QAAQ,CAAC,CACT,QAAQ,IAAI,CAAC,CACb,SACC,iHACF;CACF,WAAW,sBACR,QAAQ,sBAAsB,CAAC,CAC/B,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,aAAa,QAAQ,QAAQ;CAC5B,MAAM,eAAe,IAAI,IAAY,OAAO,aAAa,KAAK,EAAE,WAAW,IAAI,CAAC;CAChF,KAAK,MAAM,CAAC,OAAO,cAAc,OAAO,WAAW,MAAM,QAAQ,GAC/D,KAAK,MAAM,QAAQ,OAAO,KAAK,UAAU,sCAAsC,CAAC,CAAC,GAC/E,IAAI,CAAC,aAAa,IAAI,IAAI,GACxB,IAAI,SAAS;EACX,MAAM;EACN,MAAM;GAAC;GAAc;GAAS;GAAO;GAAsC;EAAI;EAC/E,SAAS;CACX,CAAC;CAGP,IAAI,OAAO,uBAAuB,KAAA,KAAa,OAAO,6BAA6B,UACjF,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,oBAAoB;EAC3B,SAAS;CACX,CAAC;AAEL,CAAC,CAAC,CACD,SAAS;;AA4BZ,SAAgB,cAAc,QAA2C;CACvE,OAAO,oBAAoB,MAAM,MAAM;AACzC"}

package/dist/vercel-github-api.d.mts

@@ -20,6 +20,7 @@ interface VercelManagedGitHubApiSandboxCreateInput {
     github: [{
       repositories: [RepositorySlug];
       actions: [VercelManagedGitHubApiAction];
+      actAs?: string;
     }];
   };
   networkPolicy: NetworkPolicy;
@@ -32,6 +33,8 @@ interface VercelManagedGitHubApiSandboxCreateInput {
 }
 /** Configures fresh trusted Sandboxes for brokered GitHub API requests. */
 interface VercelManagedGitHubApiOptions {
+  /** GitHub user ID selected for managed GitHub API requests. */
+  actAs?: string;
   /** Attribution metadata supplied when managed publication creates a signed commit. */
   commitIdentity?: {
     name: string;

package/dist/vercel-github-api.mjs

@@ -15,6 +15,7 @@ const sandboxResponseSchema = z.object({
 	status: z.number().int().min(100).max(599),
 	body: z.unknown()
 });
+const githubUserIdSchema = z.string().regex(/^[1-9][0-9]*$/u).max(16).refine((id) => Number.isSafeInteger(Number(id)));
 const issueSchema = z.object({
 	title: z.string(),
 	body: z.string().nullable(),
@@ -108,11 +109,12 @@ async function createManagedSandbox(input) {
 	const { Sandbox } = await import("@vercel/sandbox");
 	return Sandbox.create({ ...input });
 }
-function createInput(repository, action) {
+function createInput(repository, action, actAs) {
 	return {
 		__credentials: { github: [{
 			repositories: [repository],
-			actions: [action]
+			actions: [action],
+			...actAs === void 0 ? {} : { actAs }
 		}] },
 		networkPolicy: { allow: ["api.github.com"] },
 		persistent: false,
@@ -121,7 +123,7 @@ function createInput(repository, action) {
 		timeout: 6e4
 	};
 }
-function createPublicationInput(repository, commitIdentity) {
+function createPublicationInput(repository, commitIdentity, actAs) {
 	return {
 		source: {
 			type: "git",
@@ -131,7 +133,8 @@ function createPublicationInput(repository, commitIdentity) {
 		__commitAs: commitIdentity,
 		__credentials: { github: [{
 			repositories: [repository],
-			actions: ["github:pull-request:create"]
+			actions: ["github:pull-request:create"],
+			...actAs === void 0 ? {} : { actAs }
 		}] },
 		networkPolicy: { allow: ["github.com", "api.github.com"] },
 		persistent: false,
@@ -141,7 +144,7 @@ function createPublicationInput(repository, commitIdentity) {
 	};
 }
 async function request(createSandbox, input) {
-	const sandbox = await createSandbox(createInput(input.repository, input.action));
+	const sandbox = await createSandbox(createInput(input.repository, input.action, input.actAs));
 	try {
 		await input.authorize();
 		const result = await sandbox.runCommand({
@@ -197,6 +200,7 @@ async function sandboxRequest(sandbox, input) {
 /** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */
 function createVercelManagedGitHubApi(options = {}) {
 	const createSandbox = options.createSandbox ?? createManagedSandbox;
+	const actAs = options.actAs === void 0 ? void 0 : githubUserIdSchema.parse(options.actAs);
 	return {
 		async readIssue(input) {
 			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
@@ -204,6 +208,7 @@ function createVercelManagedGitHubApi(options = {}) {
 			const issue = issueSchema.parse(await request(createSandbox, {
 				repository,
 				action: "github:issues:read",
+				actAs,
 				method: "GET",
 				path: `/issues/${input.issueNumber}`,
 				authorize: input.authorize
@@ -219,7 +224,7 @@ function createVercelManagedGitHubApi(options = {}) {
 			const repository = repositorySlugSchema.parse(input.repository.toLowerCase());
 			if (!Number.isSafeInteger(input.pullRequestNumber) || input.pullRequestNumber < 1) throw new Error("Invalid GitHub pull request number");
 			const label = labelInputSchema.parse(input);
-			const sandbox = await createSandbox(createInput(repository, "github:labels:write"));
+			const sandbox = await createSandbox(createInput(repository, "github:labels:write", actAs));
 			try {
 				const authorizedRequest = async (request) => {
 					await input.authorize();
@@ -268,6 +273,7 @@ function createVercelManagedGitHubApi(options = {}) {
 			const pull = pullRequestSchema.parse(await request(createSandbox, {
 				repository,
 				action: "github:pull-request:create",
+				actAs,
 				method: "POST",
 				path: "/pulls",
 				body: {
@@ -295,7 +301,7 @@ function createVercelManagedGitHubApi(options = {}) {
 			const title = publicationTitleSchema.parse(input.title);
 			const body = publicationBodySchema.parse(input.body);
 			const commitMessage = publicationCommitMessageSchema.parse(`${input.commitMessage}\n\nCo-authored-by: ${options.commitIdentity.name} <${options.commitIdentity.email}>`);
-			const sandbox = await createSandbox(createPublicationInput(repository, options.commitIdentity));
+			const sandbox = await createSandbox(createPublicationInput(repository, options.commitIdentity, actAs));
 			try {
 				const authorizedRequest = async (request) => {
 					await input.authorize();

package/dist/vercel-github-api.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-github-api.mjs","names":[],"sources":["../src/vercel-github-api.ts"],"sourcesContent":["import type { Sandbox, NetworkPolicy } from \"@vercel/sandbox\";\nimport { z } from \"zod\";\nimport { isSafeGitRef, type GitHubTreeEntry } from \"./github-publication\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\n\ntype TrustedGitHubApiSandbox = Pick<Sandbox, \"runCommand\" | \"stop\">;\n\n/** GitHub API actions supported by Vercel-managed Sandbox credentials. */\nexport type VercelManagedGitHubApiAction =\n  | \"github:issues:read\"\n  | \"github:pull-request:create\"\n  | \"github:labels:write\";\n\n/** Exact creation request for one Vercel-managed GitHub API operation. */\nexport interface VercelManagedGitHubApiSandboxCreateInput {\n  source?: {\n    type: \"git\";\n    url: string;\n  };\n  __source_credentials?: true;\n  __commitAs?: {\n    name: string;\n    email: string;\n  };\n  __credentials: {\n    github: [\n      {\n        repositories: [RepositorySlug];\n        actions: [VercelManagedGitHubApiAction];\n      },\n    ];\n  };\n  networkPolicy: NetworkPolicy;\n  persistent: false;\n  resources: { vcpus: 6 };\n  runtime: \"node24\";\n  timeout: 60_000 | 180_000;\n}\n\n/** Configures fresh trusted Sandboxes for brokered GitHub API requests. */\nexport interface VercelManagedGitHubApiOptions {\n  /** Attribution metadata supplied when managed publication creates a signed commit. */\n  commitIdentity?: { name: string; email: string };\n  createSandbox?: (\n    input: VercelManagedGitHubApiSandboxCreateInput,\n  ) => Promise<TrustedGitHubApiSandbox>;\n}\n\n/** Authorized request to read one exact GitHub issue. */\nexport interface VercelManagedGitHubIssueInput {\n  repository: RepositorySlug;\n  issueNumber: number;\n  authorize(): Promise<void>;\n}\n\n/** Issue fields returned by a Vercel-managed GitHub API request. */\nexport interface VercelManagedGitHubIssue {\n  title: string;\n  body: string | null;\n  url: string;\n  pullRequest: boolean;\n}\n\n/** Authorized request to ensure and attach a repository flow label to a pull request. */\nexport interface VercelManagedGitHubLabelInput {\n  repository: RepositorySlug;\n  pullRequestNumber: number;\n  name: string;\n  color: string;\n  description: string;\n  authorize(): Promise<void>;\n}\n\n/** Authorized request to create one draft or ready GitHub pull request. */\nexport interface VercelManagedGitHubPullRequestInput {\n  repository: RepositorySlug;\n  title: string;\n  body: string;\n  head: string;\n  base: string;\n  draft: boolean;\n  authorize(): Promise<void>;\n}\n\n/** Pull-request identity returned by a Vercel-managed GitHub API request. */\nexport interface VercelManagedGitHubPullRequest {\n  pullRequestNumber: number;\n  pullRequestUrl: string;\n  draft: boolean;\n}\n\n/** Git Data and pull-request inputs for one idempotent managed publication. */\nexport interface VercelManagedGitHubPublicationInput {\n  repository: RepositorySlug;\n  baseCommit: string;\n  tree: readonly GitHubTreeEntry[];\n  commitMessage: string;\n  branch: string;\n  title: string;\n  body: string;\n  baseBranch: string;\n  draft: boolean;\n  authorize(): Promise<void>;\n}\n\n/** Commit and pull-request identities returned after managed publication. */\nexport interface VercelManagedGitHubPublication extends VercelManagedGitHubPullRequest {\n  commitSha: string;\n}\n\n/** Repository-scoped brokered GitHub API operations supplied by Vercel Sandbox. */\nexport interface VercelManagedGitHubApi {\n  readIssue(input: VercelManagedGitHubIssueInput): Promise<VercelManagedGitHubIssue>;\n  labelPullRequest(input: VercelManagedGitHubLabelInput): Promise<void>;\n  createPullRequest(\n    input: VercelManagedGitHubPullRequestInput,\n  ): Promise<VercelManagedGitHubPullRequest>;\n  publishPullRequest(\n    input: VercelManagedGitHubPublicationInput,\n  ): Promise<VercelManagedGitHubPublication>;\n}\n\n/** GitHub API failure returned through the managed credential Sandbox. */\nexport class VercelManagedGitHubApiError extends Error {\n  constructor(\n    readonly status: number,\n    message: string,\n  ) {\n    super(`GitHub API request failed (${status}): ${message}`);\n    this.name = \"VercelManagedGitHubApiError\";\n  }\n}\n\nconst sandboxResponseSchema = z.object({\n  status: z.number().int().min(100).max(599),\n  body: z.unknown(),\n});\nconst issueSchema = z.object({\n  title: z.string(),\n  body: z.string().nullable(),\n  html_url: z.url(),\n  pull_request: z.unknown().optional(),\n});\nconst labelSchema = z.object({ name: z.string() });\nconst labelInputSchema = z.object({\n  name: z\n    .string()\n    .min(1)\n    .max(50)\n    .refine(\n      (name) =>\n        Buffer.byteLength(name, \"utf8\") <= 50 &&\n        name.trim() === name &&\n        [...name].every((character) => {\n          const code = character.charCodeAt(0);\n          return code > 31 && code !== 127 && character !== \"\\\\\";\n        }) &&\n        name.split(\"/\").every((part) => part !== \"\" && part !== \".\" && part !== \"..\"),\n    ),\n  color: z.string().regex(/^[a-fA-F0-9]{6}$/u),\n  description: z\n    .string()\n    .max(100)\n    .refine((description) => Buffer.byteLength(description, \"utf8\") <= 100),\n});\nconst pullRequestSchema = z.object({\n  number: z.number().int().positive(),\n  html_url: z.url(),\n  draft: z.boolean(),\n});\nconst shaSchema = z.string().regex(/^[a-f0-9]{40}$/u);\nconst commitSchema = z.object({\n  sha: shaSchema,\n  tree: z.object({ sha: shaSchema }),\n  parents: z.array(z.object({ sha: shaSchema })),\n});\nconst treeSchema = z.object({ sha: shaSchema });\nconst refSchema = z.object({ object: z.object({ sha: shaSchema }) });\nconst publicationPullSchema = pullRequestSchema.extend({\n  state: z.enum([\"open\", \"closed\"]),\n  head: z.object({ ref: z.string(), sha: shaSchema }),\n});\nconst publicationPathSchema = z\n  .string()\n  .min(1)\n  .max(1_024)\n  .refine((path) => Buffer.byteLength(path, \"utf8\") <= 1_024, {\n    message: \"Managed publication path exceeds byte limit\",\n  })\n  .refine(\n    (path) =>\n      /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u.test(path) &&\n      !path.includes(\"..\") &&\n      !path.includes(\"//\") &&\n      !path.endsWith(\"/\") &&\n      !path.split(\"/\").some((part) => part === \".\"),\n    { message: \"Invalid managed publication path\" },\n  );\nconst publicationBranchSchema = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine(\n    (branch) =>\n      isSafeGitRef(branch) &&\n      branch\n        .split(\"/\")\n        .every(\n          (component) =>\n            component.length > 0 &&\n            !component.startsWith(\".\") &&\n            !component.endsWith(\".\") &&\n            !component.endsWith(\".lock\"),\n        ),\n    { message: \"Invalid managed publication branch\" },\n  );\nconst publicationTextSchema = (maximum: number, field: string) =>\n  z\n    .string()\n    .max(maximum)\n    .refine((value) => Buffer.byteLength(value, \"utf8\") <= maximum, {\n      message: `Managed publication ${field} exceeds byte limit`,\n    });\nconst publicationCommitMessageSchema = publicationTextSchema(65_536, \"commit message\").min(1);\nconst publicationTitleSchema = publicationTextSchema(256, \"title\").min(1);\nconst publicationBodySchema = publicationTextSchema(65_536, \"body\");\nconst publicationBaseBranchSchema = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine((branch) => isSafeGitRef(branch), {\n    message: \"Invalid managed publication base branch\",\n  });\nconst publicationContentSchema = z\n  .string()\n  .max(200_000)\n  .refine((content) => Buffer.byteLength(content, \"utf8\") <= 200_000, {\n    message: \"Managed publication content exceeds byte limit\",\n  });\nconst publicationTreeSchema = z\n  .array(\n    z.union([\n      z.strictObject({\n        path: publicationPathSchema,\n        mode: z.enum([\"100644\", \"100755\"]),\n        type: z.literal(\"blob\"),\n        content: publicationContentSchema,\n      }),\n      z.strictObject({\n        path: publicationPathSchema,\n        mode: z.enum([\"100644\", \"100755\"]),\n        type: z.literal(\"blob\"),\n        sha: z.null(),\n      }),\n    ]),\n  )\n  .min(1)\n  .max(25)\n  .refine(\n    (entries) =>\n      new TextEncoder().encode(JSON.stringify({ tree: entries })).byteLength <= 1_000_000,\n    \"Managed publication tree exceeds transfer limit\",\n  );\nconst githubRequestScript = `\nconst request = JSON.parse(process.argv[1]);\nconst response = await fetch(request.url, {\n  method: request.method,\n  headers: {\n    accept: \"application/vnd.github+json\",\n    \"content-type\": \"application/json\",\n    \"x-github-api-version\": \"2022-11-28\",\n  },\n  body: request.body === undefined ? undefined : JSON.stringify(request.body),\n  redirect: \"error\",\n});\nconst reader = response.body?.getReader();\nconst chunks = [];\nlet byteLength = 0;\nif (reader) {\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    byteLength += value.byteLength;\n    if (byteLength > 1_000_000) {\n      await reader.cancel();\n      throw new Error(\"GitHub API response exceeds transfer limit\");\n    }\n    chunks.push(value);\n  }\n}\nconst bytes = new Uint8Array(byteLength);\nlet offset = 0;\nfor (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }\nconst text = new TextDecoder().decode(bytes);\nlet body = null;\ntry { body = text === \"\" ? null : JSON.parse(text); } catch { body = { message: text }; }\nprocess.stdout.write(JSON.stringify({ status: response.status, body }));\n`;\n\nasync function createManagedSandbox(\n  input: VercelManagedGitHubApiSandboxCreateInput,\n): Promise<TrustedGitHubApiSandbox> {\n  const { Sandbox } = await import(\"@vercel/sandbox\");\n  return Sandbox.create({ ...input });\n}\n\nfunction createInput(\n  repository: RepositorySlug,\n  action: VercelManagedGitHubApiAction,\n): VercelManagedGitHubApiSandboxCreateInput {\n  return {\n    __credentials: { github: [{ repositories: [repository], actions: [action] }] },\n    networkPolicy: { allow: [\"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: 60_000,\n  };\n}\n\nfunction createPublicationInput(\n  repository: RepositorySlug,\n  commitIdentity: { name: string; email: string },\n): VercelManagedGitHubApiSandboxCreateInput {\n  return {\n    source: { type: \"git\", url: `https://github.com/${repository}.git` },\n    __source_credentials: true,\n    __commitAs: commitIdentity,\n    __credentials: {\n      github: [\n        {\n          repositories: [repository],\n          actions: [\"github:pull-request:create\"],\n        },\n      ],\n    },\n    networkPolicy: { allow: [\"github.com\", \"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: 180_000,\n  };\n}\n\nasync function request(\n  createSandbox: (\n    input: VercelManagedGitHubApiSandboxCreateInput,\n  ) => Promise<TrustedGitHubApiSandbox>,\n  input: {\n    repository: RepositorySlug;\n    action: VercelManagedGitHubApiAction;\n    method: \"GET\" | \"POST\";\n    path: string;\n    body?: unknown;\n    authorize(): Promise<void>;\n  },\n): Promise<unknown> {\n  const sandbox = await createSandbox(createInput(input.repository, input.action));\n  try {\n    await input.authorize();\n    const result = await sandbox.runCommand({\n      cmd: \"node\",\n      args: [\n        \"--input-type=module\",\n        \"--eval\",\n        githubRequestScript,\n        JSON.stringify({\n          method: input.method,\n          url: `https://api.github.com/repos/${input.repository}${input.path}`,\n          ...(input.body === undefined ? {} : { body: input.body }),\n        }),\n      ],\n      timeoutMs: 30_000,\n    });\n    const stderr = (await result.stderr()).trim();\n    if (result.exitCode !== 0) {\n      throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);\n    }\n    const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));\n    if (response.status < 200 || response.status >= 300) {\n      const message = z.object({ message: z.string() }).safeParse(response.body);\n      throw new VercelManagedGitHubApiError(\n        response.status,\n        message.success ? message.data.message : \"Unexpected response\",\n      );\n    }\n    return response.body;\n  } finally {\n    await sandbox.stop();\n  }\n}\n\nasync function sandboxRequest(\n  sandbox: TrustedGitHubApiSandbox,\n  input: {\n    repository: RepositorySlug;\n    method: \"GET\" | \"POST\";\n    path: string;\n    body?: unknown;\n  },\n): Promise<unknown> {\n  const result = await sandbox.runCommand({\n    cmd: \"node\",\n    args: [\n      \"--input-type=module\",\n      \"--eval\",\n      githubRequestScript,\n      JSON.stringify({\n        method: input.method,\n        url: `https://api.github.com/repos/${input.repository}${input.path}`,\n        ...(input.body === undefined ? {} : { body: input.body }),\n      }),\n    ],\n    timeoutMs: 30_000,\n  });\n  const stderr = (await result.stderr()).trim();\n  if (result.exitCode !== 0) {\n    throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);\n  }\n  const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));\n  if (response.status < 200 || response.status >= 300) {\n    const message = z.object({ message: z.string() }).safeParse(response.body);\n    throw new VercelManagedGitHubApiError(\n      response.status,\n      message.success ? message.data.message : \"Unexpected response\",\n    );\n  }\n  return response.body;\n}\n\n/** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */\nexport function createVercelManagedGitHubApi(\n  options: VercelManagedGitHubApiOptions = {},\n): VercelManagedGitHubApi {\n  const createSandbox = options.createSandbox ?? createManagedSandbox;\n  return {\n    async readIssue(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!Number.isSafeInteger(input.issueNumber) || input.issueNumber < 1) {\n        throw new Error(\"Invalid GitHub issue number\");\n      }\n      const issue = issueSchema.parse(\n        await request(createSandbox, {\n          repository,\n          action: \"github:issues:read\",\n          method: \"GET\",\n          path: `/issues/${input.issueNumber}`,\n          authorize: input.authorize,\n        }),\n      );\n      return {\n        title: issue.title,\n        body: issue.body,\n        url: issue.html_url,\n        pullRequest: issue.pull_request !== undefined,\n      };\n    },\n    async labelPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!Number.isSafeInteger(input.pullRequestNumber) || input.pullRequestNumber < 1) {\n        throw new Error(\"Invalid GitHub pull request number\");\n      }\n      const label = labelInputSchema.parse(input);\n      const sandbox = await createSandbox(createInput(repository, \"github:labels:write\"));\n      try {\n        const authorizedRequest = async (\n          request: Omit<Parameters<typeof sandboxRequest>[1], \"repository\">,\n        ) => {\n          await input.authorize();\n          return sandboxRequest(sandbox, { repository, ...request });\n        };\n        const labelPath = `/labels/${encodeURIComponent(label.name)}`;\n        const read = async () => {\n          const existing = labelSchema.parse(\n            await authorizedRequest({ method: \"GET\", path: labelPath }),\n          );\n          if (existing.name.toLowerCase() !== label.name.toLowerCase()) {\n            throw new Error(\"GitHub returned a different repository label\");\n          }\n        };\n        try {\n          await read();\n        } catch (error) {\n          if (!(error instanceof VercelManagedGitHubApiError) || error.status !== 404) throw error;\n          try {\n            await authorizedRequest({ method: \"POST\", path: \"/labels\", body: label });\n          } catch (creationError) {\n            if (\n              !(creationError instanceof VercelManagedGitHubApiError) ||\n              creationError.status !== 422\n            ) {\n              throw creationError;\n            }\n            await read();\n          }\n        }\n        await authorizedRequest({\n          method: \"POST\",\n          path: `/issues/${input.pullRequestNumber}/labels`,\n          body: { labels: [label.name] },\n        });\n      } finally {\n        await sandbox.stop();\n      }\n    },\n    async createPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      const head = publicationBranchSchema.parse(input.head);\n      const base = publicationBaseBranchSchema.parse(input.base);\n      const title = publicationTitleSchema.parse(input.title);\n      const body = publicationBodySchema.parse(input.body);\n      const pull = pullRequestSchema.parse(\n        await request(createSandbox, {\n          repository,\n          action: \"github:pull-request:create\",\n          method: \"POST\",\n          path: \"/pulls\",\n          body: {\n            title,\n            body,\n            head,\n            base,\n            draft: input.draft,\n          },\n          authorize: input.authorize,\n        }),\n      );\n      return {\n        pullRequestNumber: pull.number,\n        pullRequestUrl: pull.html_url,\n        draft: pull.draft,\n      };\n    },\n    async publishPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!options.commitIdentity) throw new Error(\"Managed publication requires commit identity\");\n      if (!/^[a-f0-9]{40}$/u.test(input.baseCommit) || input.commitMessage.trim() === \"\") {\n        throw new Error(\"Invalid managed GitHub publication\");\n      }\n      const publicationTree = publicationTreeSchema.parse(input.tree);\n      const branch = publicationBranchSchema.parse(input.branch);\n      const baseBranch = publicationBaseBranchSchema.parse(input.baseBranch);\n      const title = publicationTitleSchema.parse(input.title);\n      const body = publicationBodySchema.parse(input.body);\n      const commitMessage = publicationCommitMessageSchema.parse(\n        `${input.commitMessage}\\n\\nCo-authored-by: ${options.commitIdentity.name} <${options.commitIdentity.email}>`,\n      );\n      const sandbox = await createSandbox(\n        createPublicationInput(repository, options.commitIdentity),\n      );\n      try {\n        const authorizedRequest = async (\n          request: Omit<Parameters<typeof sandboxRequest>[1], \"repository\">,\n        ) => {\n          await input.authorize();\n          return sandboxRequest(sandbox, { repository, ...request });\n        };\n        const base = commitSchema.parse(\n          await authorizedRequest({\n            method: \"GET\",\n            path: `/git/commits/${input.baseCommit}`,\n          }),\n        );\n        const tree = treeSchema.parse(\n          await authorizedRequest({\n            method: \"POST\",\n            path: \"/git/trees\",\n            body: { base_tree: base.tree.sha, tree: publicationTree },\n          }),\n        );\n        const pullPath = `/pulls?${new URLSearchParams({\n          state: \"all\",\n          head: `${repository.split(\"/\")[0]}:${branch}`,\n          per_page: \"100\",\n        })}`;\n        const pulls = async () =>\n          z\n            .array(publicationPullSchema)\n            .parse(await authorizedRequest({ method: \"GET\", path: pullPath }));\n        const result = (pull: z.infer<typeof pullRequestSchema>, commitSha: string) => ({\n          commitSha,\n          pullRequestNumber: pull.number,\n          pullRequestUrl: pull.html_url,\n          draft: pull.draft,\n        });\n        const existingPull = (await pulls()).find((pull) => pull.head.ref === branch);\n        const refPath = `/git/ref/heads/${branch.split(\"/\").map(encodeURIComponent).join(\"/\")}`;\n        let existingRef: z.infer<typeof refSchema> | null;\n        try {\n          existingRef = refSchema.parse(await authorizedRequest({ method: \"GET\", path: refPath }));\n        } catch (error) {\n          if (!(error instanceof VercelManagedGitHubApiError) || error.status !== 404) throw error;\n          existingRef = null;\n        }\n        let commitSha = existingRef?.object.sha;\n        if (existingPull) {\n          if (existingPull.state !== \"open\") {\n            throw new Error(\"Managed publication pull request is closed\");\n          }\n          if (commitSha !== existingPull.head.sha) {\n            throw new Error(\"Managed publication pull request head differs from its branch\");\n          }\n          const existingCommit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"GET\",\n              path: `/git/commits/${existingPull.head.sha}`,\n            }),\n          );\n          if (\n            existingCommit.tree.sha !== tree.sha ||\n            existingCommit.parents.length !== 1 ||\n            existingCommit.parents[0]?.sha !== input.baseCommit\n          ) {\n            throw new Error(\"Managed publication pull request contains different changes\");\n          }\n          return result(existingPull, existingPull.head.sha);\n        }\n        if (commitSha) {\n          const existingCommit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"GET\",\n              path: `/git/commits/${commitSha}`,\n            }),\n          );\n          if (\n            existingCommit.tree.sha !== tree.sha ||\n            existingCommit.parents.length !== 1 ||\n            existingCommit.parents[0]?.sha !== input.baseCommit\n          ) {\n            throw new Error(\"Managed publication branch contains different changes\");\n          }\n        } else {\n          const commit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/git/commits\",\n              body: {\n                message: commitMessage,\n                tree: tree.sha,\n                parents: [input.baseCommit],\n              },\n            }),\n          );\n          commitSha = commit.sha;\n          try {\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/git/refs\",\n              body: { ref: `refs/heads/${branch}`, sha: commitSha },\n            });\n          } catch (error) {\n            const reconciled = refSchema.parse(\n              await authorizedRequest({ method: \"GET\", path: refPath }),\n            );\n            if (reconciled.object.sha !== commitSha) throw error;\n          }\n        }\n        let pull: z.infer<typeof pullRequestSchema>;\n        try {\n          pull = pullRequestSchema.parse(\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/pulls\",\n              body: {\n                title,\n                body,\n                head: branch,\n                base: baseBranch,\n                draft: input.draft,\n              },\n            }),\n          );\n        } catch (error) {\n          const reconciled = (await pulls()).find((candidate) => candidate.head.ref === branch);\n          if (!reconciled || reconciled.state !== \"open\" || reconciled.head.sha !== commitSha) {\n            throw error;\n          }\n          pull = reconciled;\n        }\n        return result(pull, commitSha);\n      } finally {\n        await sandbox.stop();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AA2HA,IAAa,8BAAb,cAAiD,MAAM;CAE1C;CADX,YACE,QACA,SACA;EACA,MAAM,8BAA8B,OAAO,KAAK,SAAS;EAHhD,KAAA,SAAA;EAIT,KAAK,OAAO;CACd;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;CACrC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG;CACzC,MAAM,EAAE,QAAQ;AAClB,CAAC;AACD,MAAM,cAAc,EAAE,OAAO;CAC3B,OAAO,EAAE,OAAO;CAChB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,IAAI;CAChB,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACjD,MAAM,mBAAmB,EAAE,OAAO;CAChC,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,EAAE,CAAC,CACP,QACE,SACC,OAAO,WAAW,MAAM,MAAM,KAAK,MACnC,KAAK,KAAK,MAAM,QAChB,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,cAAc;EAC7B,MAAM,OAAO,UAAU,WAAW,CAAC;EACnC,OAAO,OAAO,MAAM,SAAS,OAAO,cAAc;CACpD,CAAC,KACD,KAAK,MAAM,GAAG,CAAC,CAAC,OAAO,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,CAChF;CACF,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB;CAC3C,aAAa,EACV,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,QAAQ,gBAAgB,OAAO,WAAW,aAAa,MAAM,KAAK,GAAG;AAC1E,CAAC;AACD,MAAM,oBAAoB,EAAE,OAAO;CACjC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,IAAI;CAChB,OAAO,EAAE,QAAQ;AACnB,CAAC;AACD,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,iBAAiB;AACpD,MAAM,eAAe,EAAE,OAAO;CAC5B,KAAK;CACL,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;CACjC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC;AAC/C,CAAC;AACD,MAAM,aAAa,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;AAC9C,MAAM,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC;AACnE,MAAM,wBAAwB,kBAAkB,OAAO;CACrD,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;CAChC,MAAM,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,KAAK;CAAU,CAAC;AACpD,CAAC;AACD,MAAM,wBAAwB,EAC3B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAK,CAAC,CACV,QAAQ,SAAS,OAAO,WAAW,MAAM,MAAM,KAAK,MAAO,EAC1D,SAAS,8CACX,CAAC,CAAC,CACD,QACE,SACC,kCAAkC,KAAK,IAAI,KAC3C,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,GAAG,GAC9C,EAAE,SAAS,mCAAmC,CAChD;AACF,MAAM,0BAA0B,EAC7B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QACE,WACC,aAAa,MAAM,KACnB,OACG,MAAM,GAAG,CAAC,CACV,OACE,cACC,UAAU,SAAS,KACnB,CAAC,UAAU,WAAW,GAAG,KACzB,CAAC,UAAU,SAAS,GAAG,KACvB,CAAC,UAAU,SAAS,OAAO,CAC/B,GACJ,EAAE,SAAS,qCAAqC,CAClD;AACF,MAAM,yBAAyB,SAAiB,UAC9C,EACG,OAAO,CAAC,CACR,IAAI,OAAO,CAAC,CACZ,QAAQ,UAAU,OAAO,WAAW,OAAO,MAAM,KAAK,SAAS,EAC9D,SAAS,uBAAuB,MAAM,qBACxC,CAAC;AACL,MAAM,iCAAiC,sBAAsB,OAAQ,gBAAgB,CAAC,CAAC,IAAI,CAAC;AAC5F,MAAM,yBAAyB,sBAAsB,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC;AACxE,MAAM,wBAAwB,sBAAsB,OAAQ,MAAM;AAClE,MAAM,8BAA8B,EACjC,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QAAQ,WAAW,aAAa,MAAM,GAAG,EACxC,SAAS,0CACX,CAAC;AACH,MAAM,2BAA2B,EAC9B,OAAO,CAAC,CACR,IAAI,GAAO,CAAC,CACZ,QAAQ,YAAY,OAAO,WAAW,SAAS,MAAM,KAAK,KAAS,EAClE,SAAS,iDACX,CAAC;AACH,MAAM,wBAAwB,EAC3B,MACC,EAAE,MAAM,CACN,EAAE,aAAa;CACb,MAAM;CACN,MAAM,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACjC,MAAM,EAAE,QAAQ,MAAM;CACtB,SAAS;AACX,CAAC,GACD,EAAE,aAAa;CACb,MAAM;CACN,MAAM,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACjC,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK,EAAE,KAAK;AACd,CAAC,CACH,CAAC,CACH,CAAC,CACA,IAAI,CAAC,CAAC,CACN,IAAI,EAAE,CAAC,CACP,QACE,YACC,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,KAC5E,iDACF;AACF,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoC5B,eAAe,qBACb,OACkC;CAClC,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,OAAO,QAAQ,OAAO,EAAE,GAAG,MAAM,CAAC;AACpC;AAEA,SAAS,YACP,YACA,QAC0C;CAC1C,OAAO;EACL,eAAe,EAAE,QAAQ,CAAC;GAAE,cAAc,CAAC,UAAU;GAAG,SAAS,CAAC,MAAM;EAAE,CAAC,EAAE;EAC7E,eAAe,EAAE,OAAO,CAAC,gBAAgB,EAAE;EAC3C,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;AACF;AAEA,SAAS,uBACP,YACA,gBAC0C;CAC1C,OAAO;EACL,QAAQ;GAAE,MAAM;GAAO,KAAK,sBAAsB,WAAW;EAAM;EACnE,sBAAsB;EACtB,YAAY;EACZ,eAAe,EACb,QAAQ,CACN;GACE,cAAc,CAAC,UAAU;GACzB,SAAS,CAAC,4BAA4B;EACxC,CACF,EACF;EACA,eAAe,EAAE,OAAO,CAAC,cAAc,gBAAgB,EAAE;EACzD,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;AACF;AAEA,eAAe,QACb,eAGA,OAQkB;CAClB,MAAM,UAAU,MAAM,cAAc,YAAY,MAAM,YAAY,MAAM,MAAM,CAAC;CAC/E,IAAI;EACF,MAAM,MAAM,UAAU;EACtB,MAAM,SAAS,MAAM,QAAQ,WAAW;GACtC,KAAK;GACL,MAAM;IACJ;IACA;IACA;IACA,KAAK,UAAU;KACb,QAAQ,MAAM;KACd,KAAK,gCAAgC,MAAM,aAAa,MAAM;KAC9D,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;IACzD,CAAC;GACH;GACA,WAAW;EACb,CAAC;EACD,MAAM,UAAU,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;EAC5C,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,wCAAwC,OAAO,SAAS,KAAK,QAAQ;EAEvF,MAAM,WAAW,sBAAsB,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC;EACvF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;GACnD,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,SAAS,IAAI;GACzE,MAAM,IAAI,4BACR,SAAS,QACT,QAAQ,UAAU,QAAQ,KAAK,UAAU,qBAC3C;EACF;EACA,OAAO,SAAS;CAClB,UAAU;EACR,MAAM,QAAQ,KAAK;CACrB;AACF;AAEA,eAAe,eACb,SACA,OAMkB;CAClB,MAAM,SAAS,MAAM,QAAQ,WAAW;EACtC,KAAK;EACL,MAAM;GACJ;GACA;GACA;GACA,KAAK,UAAU;IACb,QAAQ,MAAM;IACd,KAAK,gCAAgC,MAAM,aAAa,MAAM;IAC9D,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;GACzD,CAAC;EACH;EACA,WAAW;CACb,CAAC;CACD,MAAM,UAAU,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;CAC5C,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,wCAAwC,OAAO,SAAS,KAAK,QAAQ;CAEvF,MAAM,WAAW,sBAAsB,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC;CACvF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;EACnD,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,SAAS,IAAI;EACzE,MAAM,IAAI,4BACR,SAAS,QACT,QAAQ,UAAU,QAAQ,KAAK,UAAU,qBAC3C;CACF;CACA,OAAO,SAAS;AAClB;;AAGA,SAAgB,6BACd,UAAyC,CAAC,GAClB;CACxB,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,OAAO;EACL,MAAM,UAAU,OAAO;GACrB,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,cAAc,GAClE,MAAM,IAAI,MAAM,6BAA6B;GAE/C,MAAM,QAAQ,YAAY,MACxB,MAAM,QAAQ,eAAe;IAC3B;IACA,QAAQ;IACR,QAAQ;IACR,MAAM,WAAW,MAAM;IACvB,WAAW,MAAM;GACnB,CAAC,CACH;GACA,OAAO;IACL,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,KAAK,MAAM;IACX,aAAa,MAAM,iBAAiB,KAAA;GACtC;EACF;EACA,MAAM,iBAAiB,OAAO;GAC5B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,OAAO,cAAc,MAAM,iBAAiB,KAAK,MAAM,oBAAoB,GAC9E,MAAM,IAAI,MAAM,oCAAoC;GAEtD,MAAM,QAAQ,iBAAiB,MAAM,KAAK;GAC1C,MAAM,UAAU,MAAM,cAAc,YAAY,YAAY,qBAAqB,CAAC;GAClF,IAAI;IACF,MAAM,oBAAoB,OACxB,YACG;KACH,MAAM,MAAM,UAAU;KACtB,OAAO,eAAe,SAAS;MAAE;MAAY,GAAG;KAAQ,CAAC;IAC3D;IACA,MAAM,YAAY,WAAW,mBAAmB,MAAM,IAAI;IAC1D,MAAM,OAAO,YAAY;KAIvB,IAHiB,YAAY,MAC3B,MAAM,kBAAkB;MAAE,QAAQ;MAAO,MAAM;KAAU,CAAC,CAEjD,CAAC,CAAC,KAAK,YAAY,MAAM,MAAM,KAAK,YAAY,GACzD,MAAM,IAAI,MAAM,8CAA8C;IAElE;IACA,IAAI;KACF,MAAM,KAAK;IACb,SAAS,OAAO;KACd,IAAI,EAAE,iBAAiB,gCAAgC,MAAM,WAAW,KAAK,MAAM;KACnF,IAAI;MACF,MAAM,kBAAkB;OAAE,QAAQ;OAAQ,MAAM;OAAW,MAAM;MAAM,CAAC;KAC1E,SAAS,eAAe;MACtB,IACE,EAAE,yBAAyB,gCAC3B,cAAc,WAAW,KAEzB,MAAM;MAER,MAAM,KAAK;KACb;IACF;IACA,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM,WAAW,MAAM,kBAAkB;KACzC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,EAAE;IAC/B,CAAC;GACH,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;EACA,MAAM,kBAAkB,OAAO;GAC7B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,MAAM,OAAO,wBAAwB,MAAM,MAAM,IAAI;GACrD,MAAM,OAAO,4BAA4B,MAAM,MAAM,IAAI;GACzD,MAAM,QAAQ,uBAAuB,MAAM,MAAM,KAAK;GACtD,MAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI;GACnD,MAAM,OAAO,kBAAkB,MAC7B,MAAM,QAAQ,eAAe;IAC3B;IACA,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;KACJ;KACA;KACA;KACA;KACA,OAAO,MAAM;IACf;IACA,WAAW,MAAM;GACnB,CAAC,CACH;GACA,OAAO;IACL,mBAAmB,KAAK;IACxB,gBAAgB,KAAK;IACrB,OAAO,KAAK;GACd;EACF;EACA,MAAM,mBAAmB,OAAO;GAC9B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,QAAQ,gBAAgB,MAAM,IAAI,MAAM,8CAA8C;GAC3F,IAAI,CAAC,kBAAkB,KAAK,MAAM,UAAU,KAAK,MAAM,cAAc,KAAK,MAAM,IAC9E,MAAM,IAAI,MAAM,oCAAoC;GAEtD,MAAM,kBAAkB,sBAAsB,MAAM,MAAM,IAAI;GAC9D,MAAM,SAAS,wBAAwB,MAAM,MAAM,MAAM;GACzD,MAAM,aAAa,4BAA4B,MAAM,MAAM,UAAU;GACrE,MAAM,QAAQ,uBAAuB,MAAM,MAAM,KAAK;GACtD,MAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI;GACnD,MAAM,gBAAgB,+BAA+B,MACnD,GAAG,MAAM,cAAc,sBAAsB,QAAQ,eAAe,KAAK,IAAI,QAAQ,eAAe,MAAM,EAC5G;GACA,MAAM,UAAU,MAAM,cACpB,uBAAuB,YAAY,QAAQ,cAAc,CAC3D;GACA,IAAI;IACF,MAAM,oBAAoB,OACxB,YACG;KACH,MAAM,MAAM,UAAU;KACtB,OAAO,eAAe,SAAS;MAAE;MAAY,GAAG;KAAQ,CAAC;IAC3D;IACA,MAAM,OAAO,aAAa,MACxB,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM,gBAAgB,MAAM;IAC9B,CAAC,CACH;IACA,MAAM,OAAO,WAAW,MACtB,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM;KACN,MAAM;MAAE,WAAW,KAAK,KAAK;MAAK,MAAM;KAAgB;IAC1D,CAAC,CACH;IACA,MAAM,WAAW,UAAU,IAAI,gBAAgB;KAC7C,OAAO;KACP,MAAM,GAAG,WAAW,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG;KACrC,UAAU;IACZ,CAAC;IACD,MAAM,QAAQ,YACZ,EACG,MAAM,qBAAqB,CAAC,CAC5B,MAAM,MAAM,kBAAkB;KAAE,QAAQ;KAAO,MAAM;IAAS,CAAC,CAAC;IACrE,MAAM,UAAU,MAAyC,eAAuB;KAC9E;KACA,mBAAmB,KAAK;KACxB,gBAAgB,KAAK;KACrB,OAAO,KAAK;IACd;IACA,MAAM,gBAAgB,MAAM,MAAM,EAAA,CAAG,MAAM,SAAS,KAAK,KAAK,QAAQ,MAAM;IAC5E,MAAM,UAAU,kBAAkB,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;IACpF,IAAI;IACJ,IAAI;KACF,cAAc,UAAU,MAAM,MAAM,kBAAkB;MAAE,QAAQ;MAAO,MAAM;KAAQ,CAAC,CAAC;IACzF,SAAS,OAAO;KACd,IAAI,EAAE,iBAAiB,gCAAgC,MAAM,WAAW,KAAK,MAAM;KACnF,cAAc;IAChB;IACA,IAAI,YAAY,aAAa,OAAO;IACpC,IAAI,cAAc;KAChB,IAAI,aAAa,UAAU,QACzB,MAAM,IAAI,MAAM,4CAA4C;KAE9D,IAAI,cAAc,aAAa,KAAK,KAClC,MAAM,IAAI,MAAM,+DAA+D;KAEjF,MAAM,iBAAiB,aAAa,MAClC,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM,gBAAgB,aAAa,KAAK;KAC1C,CAAC,CACH;KACA,IACE,eAAe,KAAK,QAAQ,KAAK,OACjC,eAAe,QAAQ,WAAW,KAClC,eAAe,QAAQ,EAAE,EAAE,QAAQ,MAAM,YAEzC,MAAM,IAAI,MAAM,6DAA6D;KAE/E,OAAO,OAAO,cAAc,aAAa,KAAK,GAAG;IACnD;IACA,IAAI,WAAW;KACb,MAAM,iBAAiB,aAAa,MAClC,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM,gBAAgB;KACxB,CAAC,CACH;KACA,IACE,eAAe,KAAK,QAAQ,KAAK,OACjC,eAAe,QAAQ,WAAW,KAClC,eAAe,QAAQ,EAAE,EAAE,QAAQ,MAAM,YAEzC,MAAM,IAAI,MAAM,uDAAuD;IAE3E,OAAO;KAYL,YAXe,aAAa,MAC1B,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM;MACN,MAAM;OACJ,SAAS;OACT,MAAM,KAAK;OACX,SAAS,CAAC,MAAM,UAAU;MAC5B;KACF,CAAC,CAEc,CAAC,CAAC;KACnB,IAAI;MACF,MAAM,kBAAkB;OACtB,QAAQ;OACR,MAAM;OACN,MAAM;QAAE,KAAK,cAAc;QAAU,KAAK;OAAU;MACtD,CAAC;KACH,SAAS,OAAO;MAId,IAHmB,UAAU,MAC3B,MAAM,kBAAkB;OAAE,QAAQ;OAAO,MAAM;MAAQ,CAAC,CAE7C,CAAC,CAAC,OAAO,QAAQ,WAAW,MAAM;KACjD;IACF;IACA,IAAI;IACJ,IAAI;KACF,OAAO,kBAAkB,MACvB,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM;MACN,MAAM;OACJ;OACA;OACA,MAAM;OACN,MAAM;OACN,OAAO,MAAM;MACf;KACF,CAAC,CACH;IACF,SAAS,OAAO;KACd,MAAM,cAAc,MAAM,MAAM,EAAA,CAAG,MAAM,cAAc,UAAU,KAAK,QAAQ,MAAM;KACpF,IAAI,CAAC,cAAc,WAAW,UAAU,UAAU,WAAW,KAAK,QAAQ,WACxE,MAAM;KAER,OAAO;IACT;IACA,OAAO,OAAO,MAAM,SAAS;GAC/B,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;CACF;AACF"}
+{"version":3,"file":"vercel-github-api.mjs","names":[],"sources":["../src/vercel-github-api.ts"],"sourcesContent":["import type { Sandbox, NetworkPolicy } from \"@vercel/sandbox\";\nimport { z } from \"zod\";\nimport { isSafeGitRef, type GitHubTreeEntry } from \"./github-publication\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\n\ntype TrustedGitHubApiSandbox = Pick<Sandbox, \"runCommand\" | \"stop\">;\n\n/** GitHub API actions supported by Vercel-managed Sandbox credentials. */\nexport type VercelManagedGitHubApiAction =\n  | \"github:issues:read\"\n  | \"github:pull-request:create\"\n  | \"github:labels:write\";\n\n/** Exact creation request for one Vercel-managed GitHub API operation. */\nexport interface VercelManagedGitHubApiSandboxCreateInput {\n  source?: {\n    type: \"git\";\n    url: string;\n  };\n  __source_credentials?: true;\n  __commitAs?: {\n    name: string;\n    email: string;\n  };\n  __credentials: {\n    github: [\n      {\n        repositories: [RepositorySlug];\n        actions: [VercelManagedGitHubApiAction];\n        actAs?: string;\n      },\n    ];\n  };\n  networkPolicy: NetworkPolicy;\n  persistent: false;\n  resources: { vcpus: 6 };\n  runtime: \"node24\";\n  timeout: 60_000 | 180_000;\n}\n\n/** Configures fresh trusted Sandboxes for brokered GitHub API requests. */\nexport interface VercelManagedGitHubApiOptions {\n  /** GitHub user ID selected for managed GitHub API requests. */\n  actAs?: string;\n  /** Attribution metadata supplied when managed publication creates a signed commit. */\n  commitIdentity?: { name: string; email: string };\n  createSandbox?: (\n    input: VercelManagedGitHubApiSandboxCreateInput,\n  ) => Promise<TrustedGitHubApiSandbox>;\n}\n\n/** Authorized request to read one exact GitHub issue. */\nexport interface VercelManagedGitHubIssueInput {\n  repository: RepositorySlug;\n  issueNumber: number;\n  authorize(): Promise<void>;\n}\n\n/** Issue fields returned by a Vercel-managed GitHub API request. */\nexport interface VercelManagedGitHubIssue {\n  title: string;\n  body: string | null;\n  url: string;\n  pullRequest: boolean;\n}\n\n/** Authorized request to ensure and attach a repository flow label to a pull request. */\nexport interface VercelManagedGitHubLabelInput {\n  repository: RepositorySlug;\n  pullRequestNumber: number;\n  name: string;\n  color: string;\n  description: string;\n  authorize(): Promise<void>;\n}\n\n/** Authorized request to create one draft or ready GitHub pull request. */\nexport interface VercelManagedGitHubPullRequestInput {\n  repository: RepositorySlug;\n  title: string;\n  body: string;\n  head: string;\n  base: string;\n  draft: boolean;\n  authorize(): Promise<void>;\n}\n\n/** Pull-request identity returned by a Vercel-managed GitHub API request. */\nexport interface VercelManagedGitHubPullRequest {\n  pullRequestNumber: number;\n  pullRequestUrl: string;\n  draft: boolean;\n}\n\n/** Git Data and pull-request inputs for one idempotent managed publication. */\nexport interface VercelManagedGitHubPublicationInput {\n  repository: RepositorySlug;\n  baseCommit: string;\n  tree: readonly GitHubTreeEntry[];\n  commitMessage: string;\n  branch: string;\n  title: string;\n  body: string;\n  baseBranch: string;\n  draft: boolean;\n  authorize(): Promise<void>;\n}\n\n/** Commit and pull-request identities returned after managed publication. */\nexport interface VercelManagedGitHubPublication extends VercelManagedGitHubPullRequest {\n  commitSha: string;\n}\n\n/** Repository-scoped brokered GitHub API operations supplied by Vercel Sandbox. */\nexport interface VercelManagedGitHubApi {\n  readIssue(input: VercelManagedGitHubIssueInput): Promise<VercelManagedGitHubIssue>;\n  labelPullRequest(input: VercelManagedGitHubLabelInput): Promise<void>;\n  createPullRequest(\n    input: VercelManagedGitHubPullRequestInput,\n  ): Promise<VercelManagedGitHubPullRequest>;\n  publishPullRequest(\n    input: VercelManagedGitHubPublicationInput,\n  ): Promise<VercelManagedGitHubPublication>;\n}\n\n/** GitHub API failure returned through the managed credential Sandbox. */\nexport class VercelManagedGitHubApiError extends Error {\n  constructor(\n    readonly status: number,\n    message: string,\n  ) {\n    super(`GitHub API request failed (${status}): ${message}`);\n    this.name = \"VercelManagedGitHubApiError\";\n  }\n}\n\nconst sandboxResponseSchema = z.object({\n  status: z.number().int().min(100).max(599),\n  body: z.unknown(),\n});\nconst githubUserIdSchema = z\n  .string()\n  .regex(/^[1-9][0-9]*$/u)\n  .max(16)\n  .refine((id) => Number.isSafeInteger(Number(id)));\nconst issueSchema = z.object({\n  title: z.string(),\n  body: z.string().nullable(),\n  html_url: z.url(),\n  pull_request: z.unknown().optional(),\n});\nconst labelSchema = z.object({ name: z.string() });\nconst labelInputSchema = z.object({\n  name: z\n    .string()\n    .min(1)\n    .max(50)\n    .refine(\n      (name) =>\n        Buffer.byteLength(name, \"utf8\") <= 50 &&\n        name.trim() === name &&\n        [...name].every((character) => {\n          const code = character.charCodeAt(0);\n          return code > 31 && code !== 127 && character !== \"\\\\\";\n        }) &&\n        name.split(\"/\").every((part) => part !== \"\" && part !== \".\" && part !== \"..\"),\n    ),\n  color: z.string().regex(/^[a-fA-F0-9]{6}$/u),\n  description: z\n    .string()\n    .max(100)\n    .refine((description) => Buffer.byteLength(description, \"utf8\") <= 100),\n});\nconst pullRequestSchema = z.object({\n  number: z.number().int().positive(),\n  html_url: z.url(),\n  draft: z.boolean(),\n});\nconst shaSchema = z.string().regex(/^[a-f0-9]{40}$/u);\nconst commitSchema = z.object({\n  sha: shaSchema,\n  tree: z.object({ sha: shaSchema }),\n  parents: z.array(z.object({ sha: shaSchema })),\n});\nconst treeSchema = z.object({ sha: shaSchema });\nconst refSchema = z.object({ object: z.object({ sha: shaSchema }) });\nconst publicationPullSchema = pullRequestSchema.extend({\n  state: z.enum([\"open\", \"closed\"]),\n  head: z.object({ ref: z.string(), sha: shaSchema }),\n});\nconst publicationPathSchema = z\n  .string()\n  .min(1)\n  .max(1_024)\n  .refine((path) => Buffer.byteLength(path, \"utf8\") <= 1_024, {\n    message: \"Managed publication path exceeds byte limit\",\n  })\n  .refine(\n    (path) =>\n      /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u.test(path) &&\n      !path.includes(\"..\") &&\n      !path.includes(\"//\") &&\n      !path.endsWith(\"/\") &&\n      !path.split(\"/\").some((part) => part === \".\"),\n    { message: \"Invalid managed publication path\" },\n  );\nconst publicationBranchSchema = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine(\n    (branch) =>\n      isSafeGitRef(branch) &&\n      branch\n        .split(\"/\")\n        .every(\n          (component) =>\n            component.length > 0 &&\n            !component.startsWith(\".\") &&\n            !component.endsWith(\".\") &&\n            !component.endsWith(\".lock\"),\n        ),\n    { message: \"Invalid managed publication branch\" },\n  );\nconst publicationTextSchema = (maximum: number, field: string) =>\n  z\n    .string()\n    .max(maximum)\n    .refine((value) => Buffer.byteLength(value, \"utf8\") <= maximum, {\n      message: `Managed publication ${field} exceeds byte limit`,\n    });\nconst publicationCommitMessageSchema = publicationTextSchema(65_536, \"commit message\").min(1);\nconst publicationTitleSchema = publicationTextSchema(256, \"title\").min(1);\nconst publicationBodySchema = publicationTextSchema(65_536, \"body\");\nconst publicationBaseBranchSchema = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine((branch) => isSafeGitRef(branch), {\n    message: \"Invalid managed publication base branch\",\n  });\nconst publicationContentSchema = z\n  .string()\n  .max(200_000)\n  .refine((content) => Buffer.byteLength(content, \"utf8\") <= 200_000, {\n    message: \"Managed publication content exceeds byte limit\",\n  });\nconst publicationTreeSchema = z\n  .array(\n    z.union([\n      z.strictObject({\n        path: publicationPathSchema,\n        mode: z.enum([\"100644\", \"100755\"]),\n        type: z.literal(\"blob\"),\n        content: publicationContentSchema,\n      }),\n      z.strictObject({\n        path: publicationPathSchema,\n        mode: z.enum([\"100644\", \"100755\"]),\n        type: z.literal(\"blob\"),\n        sha: z.null(),\n      }),\n    ]),\n  )\n  .min(1)\n  .max(25)\n  .refine(\n    (entries) =>\n      new TextEncoder().encode(JSON.stringify({ tree: entries })).byteLength <= 1_000_000,\n    \"Managed publication tree exceeds transfer limit\",\n  );\nconst githubRequestScript = `\nconst request = JSON.parse(process.argv[1]);\nconst response = await fetch(request.url, {\n  method: request.method,\n  headers: {\n    accept: \"application/vnd.github+json\",\n    \"content-type\": \"application/json\",\n    \"x-github-api-version\": \"2022-11-28\",\n  },\n  body: request.body === undefined ? undefined : JSON.stringify(request.body),\n  redirect: \"error\",\n});\nconst reader = response.body?.getReader();\nconst chunks = [];\nlet byteLength = 0;\nif (reader) {\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    byteLength += value.byteLength;\n    if (byteLength > 1_000_000) {\n      await reader.cancel();\n      throw new Error(\"GitHub API response exceeds transfer limit\");\n    }\n    chunks.push(value);\n  }\n}\nconst bytes = new Uint8Array(byteLength);\nlet offset = 0;\nfor (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }\nconst text = new TextDecoder().decode(bytes);\nlet body = null;\ntry { body = text === \"\" ? null : JSON.parse(text); } catch { body = { message: text }; }\nprocess.stdout.write(JSON.stringify({ status: response.status, body }));\n`;\n\nasync function createManagedSandbox(\n  input: VercelManagedGitHubApiSandboxCreateInput,\n): Promise<TrustedGitHubApiSandbox> {\n  const { Sandbox } = await import(\"@vercel/sandbox\");\n  return Sandbox.create({ ...input });\n}\n\nfunction createInput(\n  repository: RepositorySlug,\n  action: VercelManagedGitHubApiAction,\n  actAs: string | undefined,\n): VercelManagedGitHubApiSandboxCreateInput {\n  return {\n    __credentials: {\n      github: [\n        {\n          repositories: [repository],\n          actions: [action],\n          ...(actAs === undefined ? {} : { actAs }),\n        },\n      ],\n    },\n    networkPolicy: { allow: [\"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: 60_000,\n  };\n}\n\nfunction createPublicationInput(\n  repository: RepositorySlug,\n  commitIdentity: { name: string; email: string },\n  actAs: string | undefined,\n): VercelManagedGitHubApiSandboxCreateInput {\n  return {\n    source: { type: \"git\", url: `https://github.com/${repository}.git` },\n    __source_credentials: true,\n    __commitAs: commitIdentity,\n    __credentials: {\n      github: [\n        {\n          repositories: [repository],\n          actions: [\"github:pull-request:create\"],\n          ...(actAs === undefined ? {} : { actAs }),\n        },\n      ],\n    },\n    networkPolicy: { allow: [\"github.com\", \"api.github.com\"] },\n    persistent: false,\n    resources: { vcpus: 6 },\n    runtime: \"node24\",\n    timeout: 180_000,\n  };\n}\n\nasync function request(\n  createSandbox: (\n    input: VercelManagedGitHubApiSandboxCreateInput,\n  ) => Promise<TrustedGitHubApiSandbox>,\n  input: {\n    repository: RepositorySlug;\n    action: VercelManagedGitHubApiAction;\n    actAs?: string;\n    method: \"GET\" | \"POST\";\n    path: string;\n    body?: unknown;\n    authorize(): Promise<void>;\n  },\n): Promise<unknown> {\n  const sandbox = await createSandbox(createInput(input.repository, input.action, input.actAs));\n  try {\n    await input.authorize();\n    const result = await sandbox.runCommand({\n      cmd: \"node\",\n      args: [\n        \"--input-type=module\",\n        \"--eval\",\n        githubRequestScript,\n        JSON.stringify({\n          method: input.method,\n          url: `https://api.github.com/repos/${input.repository}${input.path}`,\n          ...(input.body === undefined ? {} : { body: input.body }),\n        }),\n      ],\n      timeoutMs: 30_000,\n    });\n    const stderr = (await result.stderr()).trim();\n    if (result.exitCode !== 0) {\n      throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);\n    }\n    const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));\n    if (response.status < 200 || response.status >= 300) {\n      const message = z.object({ message: z.string() }).safeParse(response.body);\n      throw new VercelManagedGitHubApiError(\n        response.status,\n        message.success ? message.data.message : \"Unexpected response\",\n      );\n    }\n    return response.body;\n  } finally {\n    await sandbox.stop();\n  }\n}\n\nasync function sandboxRequest(\n  sandbox: TrustedGitHubApiSandbox,\n  input: {\n    repository: RepositorySlug;\n    method: \"GET\" | \"POST\";\n    path: string;\n    body?: unknown;\n  },\n): Promise<unknown> {\n  const result = await sandbox.runCommand({\n    cmd: \"node\",\n    args: [\n      \"--input-type=module\",\n      \"--eval\",\n      githubRequestScript,\n      JSON.stringify({\n        method: input.method,\n        url: `https://api.github.com/repos/${input.repository}${input.path}`,\n        ...(input.body === undefined ? {} : { body: input.body }),\n      }),\n    ],\n    timeoutMs: 30_000,\n  });\n  const stderr = (await result.stderr()).trim();\n  if (result.exitCode !== 0) {\n    throw new Error(`Managed GitHub API operation failed (${result.exitCode}): ${stderr}`);\n  }\n  const response = sandboxResponseSchema.parse(JSON.parse((await result.stdout()).trim()));\n  if (response.status < 200 || response.status >= 300) {\n    const message = z.object({ message: z.string() }).safeParse(response.body);\n    throw new VercelManagedGitHubApiError(\n      response.status,\n      message.success ? message.data.message : \"Unexpected response\",\n    );\n  }\n  return response.body;\n}\n\n/** Create repository-scoped GitHub API operations backed by managed Sandbox credentials. */\nexport function createVercelManagedGitHubApi(\n  options: VercelManagedGitHubApiOptions = {},\n): VercelManagedGitHubApi {\n  const createSandbox = options.createSandbox ?? createManagedSandbox;\n  const actAs = options.actAs === undefined ? undefined : githubUserIdSchema.parse(options.actAs);\n  return {\n    async readIssue(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!Number.isSafeInteger(input.issueNumber) || input.issueNumber < 1) {\n        throw new Error(\"Invalid GitHub issue number\");\n      }\n      const issue = issueSchema.parse(\n        await request(createSandbox, {\n          repository,\n          action: \"github:issues:read\",\n          actAs,\n          method: \"GET\",\n          path: `/issues/${input.issueNumber}`,\n          authorize: input.authorize,\n        }),\n      );\n      return {\n        title: issue.title,\n        body: issue.body,\n        url: issue.html_url,\n        pullRequest: issue.pull_request !== undefined,\n      };\n    },\n    async labelPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!Number.isSafeInteger(input.pullRequestNumber) || input.pullRequestNumber < 1) {\n        throw new Error(\"Invalid GitHub pull request number\");\n      }\n      const label = labelInputSchema.parse(input);\n      const sandbox = await createSandbox(createInput(repository, \"github:labels:write\", actAs));\n      try {\n        const authorizedRequest = async (\n          request: Omit<Parameters<typeof sandboxRequest>[1], \"repository\">,\n        ) => {\n          await input.authorize();\n          return sandboxRequest(sandbox, { repository, ...request });\n        };\n        const labelPath = `/labels/${encodeURIComponent(label.name)}`;\n        const read = async () => {\n          const existing = labelSchema.parse(\n            await authorizedRequest({ method: \"GET\", path: labelPath }),\n          );\n          if (existing.name.toLowerCase() !== label.name.toLowerCase()) {\n            throw new Error(\"GitHub returned a different repository label\");\n          }\n        };\n        try {\n          await read();\n        } catch (error) {\n          if (!(error instanceof VercelManagedGitHubApiError) || error.status !== 404) throw error;\n          try {\n            await authorizedRequest({ method: \"POST\", path: \"/labels\", body: label });\n          } catch (creationError) {\n            if (\n              !(creationError instanceof VercelManagedGitHubApiError) ||\n              creationError.status !== 422\n            ) {\n              throw creationError;\n            }\n            await read();\n          }\n        }\n        await authorizedRequest({\n          method: \"POST\",\n          path: `/issues/${input.pullRequestNumber}/labels`,\n          body: { labels: [label.name] },\n        });\n      } finally {\n        await sandbox.stop();\n      }\n    },\n    async createPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      const head = publicationBranchSchema.parse(input.head);\n      const base = publicationBaseBranchSchema.parse(input.base);\n      const title = publicationTitleSchema.parse(input.title);\n      const body = publicationBodySchema.parse(input.body);\n      const pull = pullRequestSchema.parse(\n        await request(createSandbox, {\n          repository,\n          action: \"github:pull-request:create\",\n          actAs,\n          method: \"POST\",\n          path: \"/pulls\",\n          body: {\n            title,\n            body,\n            head,\n            base,\n            draft: input.draft,\n          },\n          authorize: input.authorize,\n        }),\n      );\n      return {\n        pullRequestNumber: pull.number,\n        pullRequestUrl: pull.html_url,\n        draft: pull.draft,\n      };\n    },\n    async publishPullRequest(input) {\n      const repository = repositorySlugSchema.parse(input.repository.toLowerCase());\n      if (!options.commitIdentity) throw new Error(\"Managed publication requires commit identity\");\n      if (!/^[a-f0-9]{40}$/u.test(input.baseCommit) || input.commitMessage.trim() === \"\") {\n        throw new Error(\"Invalid managed GitHub publication\");\n      }\n      const publicationTree = publicationTreeSchema.parse(input.tree);\n      const branch = publicationBranchSchema.parse(input.branch);\n      const baseBranch = publicationBaseBranchSchema.parse(input.baseBranch);\n      const title = publicationTitleSchema.parse(input.title);\n      const body = publicationBodySchema.parse(input.body);\n      const commitMessage = publicationCommitMessageSchema.parse(\n        `${input.commitMessage}\\n\\nCo-authored-by: ${options.commitIdentity.name} <${options.commitIdentity.email}>`,\n      );\n      const sandbox = await createSandbox(\n        createPublicationInput(repository, options.commitIdentity, actAs),\n      );\n      try {\n        const authorizedRequest = async (\n          request: Omit<Parameters<typeof sandboxRequest>[1], \"repository\">,\n        ) => {\n          await input.authorize();\n          return sandboxRequest(sandbox, { repository, ...request });\n        };\n        const base = commitSchema.parse(\n          await authorizedRequest({\n            method: \"GET\",\n            path: `/git/commits/${input.baseCommit}`,\n          }),\n        );\n        const tree = treeSchema.parse(\n          await authorizedRequest({\n            method: \"POST\",\n            path: \"/git/trees\",\n            body: { base_tree: base.tree.sha, tree: publicationTree },\n          }),\n        );\n        const pullPath = `/pulls?${new URLSearchParams({\n          state: \"all\",\n          head: `${repository.split(\"/\")[0]}:${branch}`,\n          per_page: \"100\",\n        })}`;\n        const pulls = async () =>\n          z\n            .array(publicationPullSchema)\n            .parse(await authorizedRequest({ method: \"GET\", path: pullPath }));\n        const result = (pull: z.infer<typeof pullRequestSchema>, commitSha: string) => ({\n          commitSha,\n          pullRequestNumber: pull.number,\n          pullRequestUrl: pull.html_url,\n          draft: pull.draft,\n        });\n        const existingPull = (await pulls()).find((pull) => pull.head.ref === branch);\n        const refPath = `/git/ref/heads/${branch.split(\"/\").map(encodeURIComponent).join(\"/\")}`;\n        let existingRef: z.infer<typeof refSchema> | null;\n        try {\n          existingRef = refSchema.parse(await authorizedRequest({ method: \"GET\", path: refPath }));\n        } catch (error) {\n          if (!(error instanceof VercelManagedGitHubApiError) || error.status !== 404) throw error;\n          existingRef = null;\n        }\n        let commitSha = existingRef?.object.sha;\n        if (existingPull) {\n          if (existingPull.state !== \"open\") {\n            throw new Error(\"Managed publication pull request is closed\");\n          }\n          if (commitSha !== existingPull.head.sha) {\n            throw new Error(\"Managed publication pull request head differs from its branch\");\n          }\n          const existingCommit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"GET\",\n              path: `/git/commits/${existingPull.head.sha}`,\n            }),\n          );\n          if (\n            existingCommit.tree.sha !== tree.sha ||\n            existingCommit.parents.length !== 1 ||\n            existingCommit.parents[0]?.sha !== input.baseCommit\n          ) {\n            throw new Error(\"Managed publication pull request contains different changes\");\n          }\n          return result(existingPull, existingPull.head.sha);\n        }\n        if (commitSha) {\n          const existingCommit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"GET\",\n              path: `/git/commits/${commitSha}`,\n            }),\n          );\n          if (\n            existingCommit.tree.sha !== tree.sha ||\n            existingCommit.parents.length !== 1 ||\n            existingCommit.parents[0]?.sha !== input.baseCommit\n          ) {\n            throw new Error(\"Managed publication branch contains different changes\");\n          }\n        } else {\n          const commit = commitSchema.parse(\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/git/commits\",\n              body: {\n                message: commitMessage,\n                tree: tree.sha,\n                parents: [input.baseCommit],\n              },\n            }),\n          );\n          commitSha = commit.sha;\n          try {\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/git/refs\",\n              body: { ref: `refs/heads/${branch}`, sha: commitSha },\n            });\n          } catch (error) {\n            const reconciled = refSchema.parse(\n              await authorizedRequest({ method: \"GET\", path: refPath }),\n            );\n            if (reconciled.object.sha !== commitSha) throw error;\n          }\n        }\n        let pull: z.infer<typeof pullRequestSchema>;\n        try {\n          pull = pullRequestSchema.parse(\n            await authorizedRequest({\n              method: \"POST\",\n              path: \"/pulls\",\n              body: {\n                title,\n                body,\n                head: branch,\n                base: baseBranch,\n                draft: input.draft,\n              },\n            }),\n          );\n        } catch (error) {\n          const reconciled = (await pulls()).find((candidate) => candidate.head.ref === branch);\n          if (!reconciled || reconciled.state !== \"open\" || reconciled.head.sha !== commitSha) {\n            throw error;\n          }\n          pull = reconciled;\n        }\n        return result(pull, commitSha);\n      } finally {\n        await sandbox.stop();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AA8HA,IAAa,8BAAb,cAAiD,MAAM;CAE1C;CADX,YACE,QACA,SACA;EACA,MAAM,8BAA8B,OAAO,KAAK,SAAS;EAHhD,KAAA,SAAA;EAIT,KAAK,OAAO;CACd;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;CACrC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG;CACzC,MAAM,EAAE,QAAQ;AAClB,CAAC;AACD,MAAM,qBAAqB,EACxB,OAAO,CAAC,CACR,MAAM,gBAAgB,CAAC,CACvB,IAAI,EAAE,CAAC,CACP,QAAQ,OAAO,OAAO,cAAc,OAAO,EAAE,CAAC,CAAC;AAClD,MAAM,cAAc,EAAE,OAAO;CAC3B,OAAO,EAAE,OAAO;CAChB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,UAAU,EAAE,IAAI;CAChB,cAAc,EAAE,QAAQ,CAAC,CAAC,SAAS;AACrC,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACjD,MAAM,mBAAmB,EAAE,OAAO;CAChC,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,EAAE,CAAC,CACP,QACE,SACC,OAAO,WAAW,MAAM,MAAM,KAAK,MACnC,KAAK,KAAK,MAAM,QAChB,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,cAAc;EAC7B,MAAM,OAAO,UAAU,WAAW,CAAC;EACnC,OAAO,OAAO,MAAM,SAAS,OAAO,cAAc;CACpD,CAAC,KACD,KAAK,MAAM,GAAG,CAAC,CAAC,OAAO,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,CAChF;CACF,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB;CAC3C,aAAa,EACV,OAAO,CAAC,CACR,IAAI,GAAG,CAAC,CACR,QAAQ,gBAAgB,OAAO,WAAW,aAAa,MAAM,KAAK,GAAG;AAC1E,CAAC;AACD,MAAM,oBAAoB,EAAE,OAAO;CACjC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,IAAI;CAChB,OAAO,EAAE,QAAQ;AACnB,CAAC;AACD,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,MAAM,iBAAiB;AACpD,MAAM,eAAe,EAAE,OAAO;CAC5B,KAAK;CACL,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;CACjC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC;AAC/C,CAAC;AACD,MAAM,aAAa,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;AAC9C,MAAM,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC;AACnE,MAAM,wBAAwB,kBAAkB,OAAO;CACrD,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;CAChC,MAAM,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,KAAK;CAAU,CAAC;AACpD,CAAC;AACD,MAAM,wBAAwB,EAC3B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAK,CAAC,CACV,QAAQ,SAAS,OAAO,WAAW,MAAM,MAAM,KAAK,MAAO,EAC1D,SAAS,8CACX,CAAC,CAAC,CACD,QACE,SACC,kCAAkC,KAAK,IAAI,KAC3C,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,KAAK,SAAS,IAAI,KACnB,CAAC,KAAK,SAAS,GAAG,KAClB,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,GAAG,GAC9C,EAAE,SAAS,mCAAmC,CAChD;AACF,MAAM,0BAA0B,EAC7B,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QACE,WACC,aAAa,MAAM,KACnB,OACG,MAAM,GAAG,CAAC,CACV,OACE,cACC,UAAU,SAAS,KACnB,CAAC,UAAU,WAAW,GAAG,KACzB,CAAC,UAAU,SAAS,GAAG,KACvB,CAAC,UAAU,SAAS,OAAO,CAC/B,GACJ,EAAE,SAAS,qCAAqC,CAClD;AACF,MAAM,yBAAyB,SAAiB,UAC9C,EACG,OAAO,CAAC,CACR,IAAI,OAAO,CAAC,CACZ,QAAQ,UAAU,OAAO,WAAW,OAAO,MAAM,KAAK,SAAS,EAC9D,SAAS,uBAAuB,MAAM,qBACxC,CAAC;AACL,MAAM,iCAAiC,sBAAsB,OAAQ,gBAAgB,CAAC,CAAC,IAAI,CAAC;AAC5F,MAAM,yBAAyB,sBAAsB,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC;AACxE,MAAM,wBAAwB,sBAAsB,OAAQ,MAAM;AAClE,MAAM,8BAA8B,EACjC,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QAAQ,WAAW,aAAa,MAAM,GAAG,EACxC,SAAS,0CACX,CAAC;AACH,MAAM,2BAA2B,EAC9B,OAAO,CAAC,CACR,IAAI,GAAO,CAAC,CACZ,QAAQ,YAAY,OAAO,WAAW,SAAS,MAAM,KAAK,KAAS,EAClE,SAAS,iDACX,CAAC;AACH,MAAM,wBAAwB,EAC3B,MACC,EAAE,MAAM,CACN,EAAE,aAAa;CACb,MAAM;CACN,MAAM,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACjC,MAAM,EAAE,QAAQ,MAAM;CACtB,SAAS;AACX,CAAC,GACD,EAAE,aAAa;CACb,MAAM;CACN,MAAM,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACjC,MAAM,EAAE,QAAQ,MAAM;CACtB,KAAK,EAAE,KAAK;AACd,CAAC,CACH,CAAC,CACH,CAAC,CACA,IAAI,CAAC,CAAC,CACN,IAAI,EAAE,CAAC,CACP,QACE,YACC,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,KAC5E,iDACF;AACF,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoC5B,eAAe,qBACb,OACkC;CAClC,MAAM,EAAE,YAAY,MAAM,OAAO;CACjC,OAAO,QAAQ,OAAO,EAAE,GAAG,MAAM,CAAC;AACpC;AAEA,SAAS,YACP,YACA,QACA,OAC0C;CAC1C,OAAO;EACL,eAAe,EACb,QAAQ,CACN;GACE,cAAc,CAAC,UAAU;GACzB,SAAS,CAAC,MAAM;GAChB,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EACzC,CACF,EACF;EACA,eAAe,EAAE,OAAO,CAAC,gBAAgB,EAAE;EAC3C,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;AACF;AAEA,SAAS,uBACP,YACA,gBACA,OAC0C;CAC1C,OAAO;EACL,QAAQ;GAAE,MAAM;GAAO,KAAK,sBAAsB,WAAW;EAAM;EACnE,sBAAsB;EACtB,YAAY;EACZ,eAAe,EACb,QAAQ,CACN;GACE,cAAc,CAAC,UAAU;GACzB,SAAS,CAAC,4BAA4B;GACtC,GAAI,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM;EACzC,CACF,EACF;EACA,eAAe,EAAE,OAAO,CAAC,cAAc,gBAAgB,EAAE;EACzD,YAAY;EACZ,WAAW,EAAE,OAAO,EAAE;EACtB,SAAS;EACT,SAAS;CACX;AACF;AAEA,eAAe,QACb,eAGA,OASkB;CAClB,MAAM,UAAU,MAAM,cAAc,YAAY,MAAM,YAAY,MAAM,QAAQ,MAAM,KAAK,CAAC;CAC5F,IAAI;EACF,MAAM,MAAM,UAAU;EACtB,MAAM,SAAS,MAAM,QAAQ,WAAW;GACtC,KAAK;GACL,MAAM;IACJ;IACA;IACA;IACA,KAAK,UAAU;KACb,QAAQ,MAAM;KACd,KAAK,gCAAgC,MAAM,aAAa,MAAM;KAC9D,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;IACzD,CAAC;GACH;GACA,WAAW;EACb,CAAC;EACD,MAAM,UAAU,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;EAC5C,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,wCAAwC,OAAO,SAAS,KAAK,QAAQ;EAEvF,MAAM,WAAW,sBAAsB,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC;EACvF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;GACnD,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,SAAS,IAAI;GACzE,MAAM,IAAI,4BACR,SAAS,QACT,QAAQ,UAAU,QAAQ,KAAK,UAAU,qBAC3C;EACF;EACA,OAAO,SAAS;CAClB,UAAU;EACR,MAAM,QAAQ,KAAK;CACrB;AACF;AAEA,eAAe,eACb,SACA,OAMkB;CAClB,MAAM,SAAS,MAAM,QAAQ,WAAW;EACtC,KAAK;EACL,MAAM;GACJ;GACA;GACA;GACA,KAAK,UAAU;IACb,QAAQ,MAAM;IACd,KAAK,gCAAgC,MAAM,aAAa,MAAM;IAC9D,GAAI,MAAM,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;GACzD,CAAC;EACH;EACA,WAAW;CACb,CAAC;CACD,MAAM,UAAU,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK;CAC5C,IAAI,OAAO,aAAa,GACtB,MAAM,IAAI,MAAM,wCAAwC,OAAO,SAAS,KAAK,QAAQ;CAEvF,MAAM,WAAW,sBAAsB,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC;CACvF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;EACnD,MAAM,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,SAAS,IAAI;EACzE,MAAM,IAAI,4BACR,SAAS,QACT,QAAQ,UAAU,QAAQ,KAAK,UAAU,qBAC3C;CACF;CACA,OAAO,SAAS;AAClB;;AAGA,SAAgB,6BACd,UAAyC,CAAC,GAClB;CACxB,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,MAAM,QAAQ,QAAQ,UAAU,KAAA,IAAY,KAAA,IAAY,mBAAmB,MAAM,QAAQ,KAAK;CAC9F,OAAO;EACL,MAAM,UAAU,OAAO;GACrB,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,OAAO,cAAc,MAAM,WAAW,KAAK,MAAM,cAAc,GAClE,MAAM,IAAI,MAAM,6BAA6B;GAE/C,MAAM,QAAQ,YAAY,MACxB,MAAM,QAAQ,eAAe;IAC3B;IACA,QAAQ;IACR;IACA,QAAQ;IACR,MAAM,WAAW,MAAM;IACvB,WAAW,MAAM;GACnB,CAAC,CACH;GACA,OAAO;IACL,OAAO,MAAM;IACb,MAAM,MAAM;IACZ,KAAK,MAAM;IACX,aAAa,MAAM,iBAAiB,KAAA;GACtC;EACF;EACA,MAAM,iBAAiB,OAAO;GAC5B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,OAAO,cAAc,MAAM,iBAAiB,KAAK,MAAM,oBAAoB,GAC9E,MAAM,IAAI,MAAM,oCAAoC;GAEtD,MAAM,QAAQ,iBAAiB,MAAM,KAAK;GAC1C,MAAM,UAAU,MAAM,cAAc,YAAY,YAAY,uBAAuB,KAAK,CAAC;GACzF,IAAI;IACF,MAAM,oBAAoB,OACxB,YACG;KACH,MAAM,MAAM,UAAU;KACtB,OAAO,eAAe,SAAS;MAAE;MAAY,GAAG;KAAQ,CAAC;IAC3D;IACA,MAAM,YAAY,WAAW,mBAAmB,MAAM,IAAI;IAC1D,MAAM,OAAO,YAAY;KAIvB,IAHiB,YAAY,MAC3B,MAAM,kBAAkB;MAAE,QAAQ;MAAO,MAAM;KAAU,CAAC,CAEjD,CAAC,CAAC,KAAK,YAAY,MAAM,MAAM,KAAK,YAAY,GACzD,MAAM,IAAI,MAAM,8CAA8C;IAElE;IACA,IAAI;KACF,MAAM,KAAK;IACb,SAAS,OAAO;KACd,IAAI,EAAE,iBAAiB,gCAAgC,MAAM,WAAW,KAAK,MAAM;KACnF,IAAI;MACF,MAAM,kBAAkB;OAAE,QAAQ;OAAQ,MAAM;OAAW,MAAM;MAAM,CAAC;KAC1E,SAAS,eAAe;MACtB,IACE,EAAE,yBAAyB,gCAC3B,cAAc,WAAW,KAEzB,MAAM;MAER,MAAM,KAAK;KACb;IACF;IACA,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM,WAAW,MAAM,kBAAkB;KACzC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,EAAE;IAC/B,CAAC;GACH,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;EACA,MAAM,kBAAkB,OAAO;GAC7B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,MAAM,OAAO,wBAAwB,MAAM,MAAM,IAAI;GACrD,MAAM,OAAO,4BAA4B,MAAM,MAAM,IAAI;GACzD,MAAM,QAAQ,uBAAuB,MAAM,MAAM,KAAK;GACtD,MAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI;GACnD,MAAM,OAAO,kBAAkB,MAC7B,MAAM,QAAQ,eAAe;IAC3B;IACA,QAAQ;IACR;IACA,QAAQ;IACR,MAAM;IACN,MAAM;KACJ;KACA;KACA;KACA;KACA,OAAO,MAAM;IACf;IACA,WAAW,MAAM;GACnB,CAAC,CACH;GACA,OAAO;IACL,mBAAmB,KAAK;IACxB,gBAAgB,KAAK;IACrB,OAAO,KAAK;GACd;EACF;EACA,MAAM,mBAAmB,OAAO;GAC9B,MAAM,aAAa,qBAAqB,MAAM,MAAM,WAAW,YAAY,CAAC;GAC5E,IAAI,CAAC,QAAQ,gBAAgB,MAAM,IAAI,MAAM,8CAA8C;GAC3F,IAAI,CAAC,kBAAkB,KAAK,MAAM,UAAU,KAAK,MAAM,cAAc,KAAK,MAAM,IAC9E,MAAM,IAAI,MAAM,oCAAoC;GAEtD,MAAM,kBAAkB,sBAAsB,MAAM,MAAM,IAAI;GAC9D,MAAM,SAAS,wBAAwB,MAAM,MAAM,MAAM;GACzD,MAAM,aAAa,4BAA4B,MAAM,MAAM,UAAU;GACrE,MAAM,QAAQ,uBAAuB,MAAM,MAAM,KAAK;GACtD,MAAM,OAAO,sBAAsB,MAAM,MAAM,IAAI;GACnD,MAAM,gBAAgB,+BAA+B,MACnD,GAAG,MAAM,cAAc,sBAAsB,QAAQ,eAAe,KAAK,IAAI,QAAQ,eAAe,MAAM,EAC5G;GACA,MAAM,UAAU,MAAM,cACpB,uBAAuB,YAAY,QAAQ,gBAAgB,KAAK,CAClE;GACA,IAAI;IACF,MAAM,oBAAoB,OACxB,YACG;KACH,MAAM,MAAM,UAAU;KACtB,OAAO,eAAe,SAAS;MAAE;MAAY,GAAG;KAAQ,CAAC;IAC3D;IACA,MAAM,OAAO,aAAa,MACxB,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM,gBAAgB,MAAM;IAC9B,CAAC,CACH;IACA,MAAM,OAAO,WAAW,MACtB,MAAM,kBAAkB;KACtB,QAAQ;KACR,MAAM;KACN,MAAM;MAAE,WAAW,KAAK,KAAK;MAAK,MAAM;KAAgB;IAC1D,CAAC,CACH;IACA,MAAM,WAAW,UAAU,IAAI,gBAAgB;KAC7C,OAAO;KACP,MAAM,GAAG,WAAW,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG;KACrC,UAAU;IACZ,CAAC;IACD,MAAM,QAAQ,YACZ,EACG,MAAM,qBAAqB,CAAC,CAC5B,MAAM,MAAM,kBAAkB;KAAE,QAAQ;KAAO,MAAM;IAAS,CAAC,CAAC;IACrE,MAAM,UAAU,MAAyC,eAAuB;KAC9E;KACA,mBAAmB,KAAK;KACxB,gBAAgB,KAAK;KACrB,OAAO,KAAK;IACd;IACA,MAAM,gBAAgB,MAAM,MAAM,EAAA,CAAG,MAAM,SAAS,KAAK,KAAK,QAAQ,MAAM;IAC5E,MAAM,UAAU,kBAAkB,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG;IACpF,IAAI;IACJ,IAAI;KACF,cAAc,UAAU,MAAM,MAAM,kBAAkB;MAAE,QAAQ;MAAO,MAAM;KAAQ,CAAC,CAAC;IACzF,SAAS,OAAO;KACd,IAAI,EAAE,iBAAiB,gCAAgC,MAAM,WAAW,KAAK,MAAM;KACnF,cAAc;IAChB;IACA,IAAI,YAAY,aAAa,OAAO;IACpC,IAAI,cAAc;KAChB,IAAI,aAAa,UAAU,QACzB,MAAM,IAAI,MAAM,4CAA4C;KAE9D,IAAI,cAAc,aAAa,KAAK,KAClC,MAAM,IAAI,MAAM,+DAA+D;KAEjF,MAAM,iBAAiB,aAAa,MAClC,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM,gBAAgB,aAAa,KAAK;KAC1C,CAAC,CACH;KACA,IACE,eAAe,KAAK,QAAQ,KAAK,OACjC,eAAe,QAAQ,WAAW,KAClC,eAAe,QAAQ,EAAE,EAAE,QAAQ,MAAM,YAEzC,MAAM,IAAI,MAAM,6DAA6D;KAE/E,OAAO,OAAO,cAAc,aAAa,KAAK,GAAG;IACnD;IACA,IAAI,WAAW;KACb,MAAM,iBAAiB,aAAa,MAClC,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM,gBAAgB;KACxB,CAAC,CACH;KACA,IACE,eAAe,KAAK,QAAQ,KAAK,OACjC,eAAe,QAAQ,WAAW,KAClC,eAAe,QAAQ,EAAE,EAAE,QAAQ,MAAM,YAEzC,MAAM,IAAI,MAAM,uDAAuD;IAE3E,OAAO;KAYL,YAXe,aAAa,MAC1B,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM;MACN,MAAM;OACJ,SAAS;OACT,MAAM,KAAK;OACX,SAAS,CAAC,MAAM,UAAU;MAC5B;KACF,CAAC,CAEc,CAAC,CAAC;KACnB,IAAI;MACF,MAAM,kBAAkB;OACtB,QAAQ;OACR,MAAM;OACN,MAAM;QAAE,KAAK,cAAc;QAAU,KAAK;OAAU;MACtD,CAAC;KACH,SAAS,OAAO;MAId,IAHmB,UAAU,MAC3B,MAAM,kBAAkB;OAAE,QAAQ;OAAO,MAAM;MAAQ,CAAC,CAE7C,CAAC,CAAC,OAAO,QAAQ,WAAW,MAAM;KACjD;IACF;IACA,IAAI;IACJ,IAAI;KACF,OAAO,kBAAkB,MACvB,MAAM,kBAAkB;MACtB,QAAQ;MACR,MAAM;MACN,MAAM;OACJ;OACA;OACA,MAAM;OACN,MAAM;OACN,OAAO,MAAM;MACf;KACF,CAAC,CACH;IACF,SAAS,OAAO;KACd,MAAM,cAAc,MAAM,MAAM,EAAA,CAAG,MAAM,cAAc,UAAU,KAAK,QAAQ,MAAM;KACpF,IAAI,CAAC,cAAc,WAAW,UAAU,UAAU,WAAW,KAAK,QAAQ,WACxE,MAAM;KAER,OAAO;IACT;IACA,OAAO,OAAO,MAAM,SAAS;GAC/B,UAAU;IACR,MAAM,QAAQ,KAAK;GACrB;EACF;CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/factory",
-  "version": "0.0.23",
+  "version": "0.0.24",
   "description": "Schema, state machines, and kernel primitives for Agent Factory.",
   "homepage": "https://github.com/vercel-labs/agent-factory/tree/main/packages/factory",
   "bugs": "https://github.com/vercel-labs/agent-factory/issues",