@vercel/factory 0.0.24 → 0.0.26

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @vercel/factory
 
+## 0.0.26
+
+### Patch Changes
+
+- 6f3dec5: Let managed-credential Factory demos skip unavailable GitHub PR discovery while reporting the gap and checking recorded work.
+
+## 0.0.25
+
+### Patch Changes
+
+- a0e8c40: `checkoutGitHubRepository` can also fetch a pull request's head (including forks) to `origin/pr/<number>`, and Foreman's `inspect_repository` accepts a `pullRequestNumber`.
+
 ## 0.0.24
 
 ### Patch Changes

package/dist/api-contracts.d.mts

@@ -7,7 +7,7 @@ import { ImageAttachment } from "./image-input.mjs";
 import { AgentSession } from "./schema/session.mjs";
 import { RepositorySlug } from "./schema/repository.mjs";
 import "./tasks.mjs";
-import "./client.mjs";
+import "./api.mjs";
 import { z } from "zod";
 //#region src/api-contracts.d.ts
 /** Validates an agent exposed by the operator API. */

package/dist/client-stream.d.mts

@@ -1,9 +1,9 @@
 import { TaskId } from "./schema/id.mjs";
 import { AgentSessionId } from "./schema/session.mjs";
 import { TranscriptBlock } from "./schema/transcript.mjs";
+import { SessionView } from "./api-contracts.mjs";
 import { Transcript } from "./client-transcript.mjs";
 import { FactoryClient } from "./client.mjs";
-import { SessionView } from "./api-contracts.mjs";
 //#region src/client-stream.d.ts
 /** Client operations required to hydrate and follow a Factory session stream. */
 type SessionStreamClient = Pick<FactoryClient, "getSessionTranscriptResponse" | "getSessionEventStreamResponse" | "getSessionHistory">;

package/dist/client.d.mts

@@ -14,12 +14,12 @@ import { SessionReview, SessionReviewCheck, SessionReviewIssue, SessionReviewScr
 import { WorkspaceFileEntry, WorkspaceFiles, WorkspaceFilesRequest, workspaceFileContentSchema, workspaceFileEntrySchema, workspaceFilesRequestSchema, workspaceFilesSchema, workspacePathSchema } from "./workspace-files.mjs";
 import { ApprovalListOptions, ApprovalPage, ApprovalView } from "./approval-contracts.mjs";
 import { WorkspaceDiff, WorkspaceDiffFile, workspaceDiffFileSchema, workspaceDiffSchema } from "./workspace-diff.mjs";
+import { AnswerSessionQuestionRequest, ApiAgent, ControlSessionRequest, CreateSessionRequest, PendingFollowUp, RepositoryDetails, RepositorySummary, SendSessionMessageRequest, SessionInputResponse, SessionPage, SessionPullRequest, SessionSummary, SessionView, SessionWorkGroup, SessionWorkResult, SessionWorkTask, SubmitSessionInputRequest, answerSessionQuestionRequestSchema, apiAgentSchema, controlSessionRequestSchema, createSessionRequestSchema, pendingFollowUpSchema, repositoryDetailsSchema, repositorySummarySchema, sendSessionMessageRequestSchema, sessionInputResponseSchema, sessionPageSchema, sessionPullRequestSchema, sessionPullRequestStateSchema, sessionSummarySchema, sessionViewSchema, sessionWorkGroupSchema, sessionWorkResultSchema, sessionWorkTaskSchema, submitSessionInputRequestSchema } from "./api-contracts.mjs";
 import { IntakeView, describeIntake } from "./intake-contracts.mjs";
 import { TaskGraphView } from "./task-graph-view.mjs";
 import { StreamEvent, readEvents, streamEventSchema } from "./client-events.mjs";
 import { Transcript, TranscriptHistoryPage } from "./client-transcript.mjs";
 import { FollowSessionStreamOptions, SessionStreamClient, expandTranscriptBlock, followSessionStream, loadPreviousTranscriptPage } from "./client-stream.mjs";
-import { AnswerSessionQuestionRequest, ApiAgent, ControlSessionRequest, CreateSessionRequest, PendingFollowUp, RepositoryDetails, RepositorySummary, SendSessionMessageRequest, SessionInputResponse, SessionPage, SessionPullRequest, SessionSummary, SessionView, SessionWorkGroup, SessionWorkResult, SessionWorkTask, SubmitSessionInputRequest, answerSessionQuestionRequestSchema, apiAgentSchema, controlSessionRequestSchema, createSessionRequestSchema, pendingFollowUpSchema, repositoryDetailsSchema, repositorySummarySchema, sendSessionMessageRequestSchema, sessionInputResponseSchema, sessionPageSchema, sessionPullRequestSchema, sessionPullRequestStateSchema, sessionSummarySchema, sessionViewSchema, sessionWorkGroupSchema, sessionWorkResultSchema, sessionWorkTaskSchema, submitSessionInputRequestSchema } from "./api-contracts.mjs";
 //#region src/client.d.ts
 /** All durable Task states in their schema-defined order. */
 declare const taskStates: readonly ("queued" | "running" | "stalled" | "verifying" | "succeeded" | "failed" | "needs_human" | "cancelled")[];

package/dist/github-publication.d.mts

@@ -157,6 +157,8 @@ interface CheckoutGitHubRepositoryBaseInput {
   sandbox: GitTransferSandbox;
   repositorySlug: RepositorySlug;
   transport: GitHubGitTransport;
+  /** Also fetch this pull request's head, including forks, to `refs/remotes/origin/pr/<number>`. */
+  pullRequestNumber?: number;
 }
 /** Authorized repository checkout with recovery options that require a branch to resume. */
 type CheckoutGitHubRepositoryInput = CheckoutGitHubRepositoryBaseInput & ({

package/dist/github-publication.mjs

@@ -227,9 +227,12 @@ async function checkoutGitHubRepository(input) {
 	if (existingOrigin !== "" && existingOrigin.toLowerCase() !== expectedOrigin) throw new GitHubCheckoutConflictError(existingOrigin, expectedOrigin);
 	const resume = input.resumeBranch;
 	if (resume !== void 0 && !isSafeGitRef(resume)) throw new Error(`refusing to resume unsafe branch name: ${resume}`);
+	const pullRequestNumber = input.pullRequestNumber;
+	if (pullRequestNumber !== void 0 && (!Number.isSafeInteger(pullRequestNumber) || pullRequestNumber < 1)) throw new Error("pullRequestNumber must be a positive integer");
+	const pullRequestRef = pullRequestNumber === void 0 ? void 0 : `refs/pull/${pullRequestNumber}/head`;
 	await input.transport.fetch({
 		repository: slug,
-		refs: []
+		refs: pullRequestRef === void 0 ? [] : [pullRequestRef]
 	}, async (bundle) => {
 		await withSandboxGitBundle({
 			sandbox: input.sandbox,
@@ -285,6 +288,14 @@ async function checkoutGitHubRepository(input) {
 						"origin/HEAD"
 					]);
 				}
+				if (pullRequestRef !== void 0) await runSandboxCommand(input.sandbox, [
+					"git",
+					"-C",
+					"repo",
+					"fetch",
+					path,
+					`+${pullRequestRef}:refs/remotes/origin/pr/${pullRequestNumber}`
+				]);
 				if (resume === void 0) return;
 				if ((await input.sandbox.run({ command: [
 					"git",

package/dist/github-publication.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"github-publication.mjs","names":[],"sources":["../src/github-publication.ts"],"sourcesContent":["import {\n  withSandboxGitBundle,\n  quoteShellArgument,\n  runSandboxCommand,\n  type GitHubGitTransport,\n  type GitTransferSandbox,\n} from \"./github-transfer\";\nimport type { TaskId } from \"./schema/id\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport { agentSessionIdSchema, type AgentSessionId } from \"./schema/session\";\nimport { z } from \"zod\";\n\n/** Minimal sandbox command boundary required by Git checkout and publication helpers. */\nexport interface SandboxGit {\n  run(options: SandboxGitCommandInput): PromiseLike<SandboxGitCommandResult>;\n}\n\n/** Shell command submitted through the minimal Git sandbox boundary. */\nexport interface SandboxGitCommandInput {\n  command: string;\n}\n\n/** Captured output and optional exit status from a sandbox Git command. */\nexport interface SandboxGitCommandResult {\n  stdout: string;\n  stderr?: string;\n  exitCode?: number;\n}\n\n/** Bounds applied while translating committed workspace changes into GitHub tree entries. */\nexport interface GitHubPublicationLimits {\n  maxChangedFiles?: number;\n  maxFileBytes?: number;\n}\n\n/** Repository-scoped credentials and transport for the GitHub publication client. */\nexport interface GitHubPublicationClientOptions {\n  repository: RepositorySlug;\n  token: string;\n  fetch?: typeof globalThis.fetch;\n}\n\n/** Pull-request snapshot used to reconcile idempotent publication effects. */\nexport interface GitHubPublicationPullRequest {\n  pullRequestNumber: number;\n  pullRequestUrl: string;\n  nodeId: string;\n  title: string;\n  body: string | null;\n  state: \"open\" | \"closed\";\n  draft: boolean;\n  head: {\n    branch: string;\n    sha: string;\n    repository: RepositorySlug | null;\n  };\n}\n\n/** Git Data and pull-request operations needed by supplied publication workflows. */\nexport interface GitHubPublicationClient {\n  commit(input: ReadGitHubCommitInput): Promise<GitHubCommit>;\n  branchHead(input: ReadGitHubBranchHeadInput): Promise<string | null>;\n  createTree(input: CreateGitHubTreeInput): Promise<string>;\n  createCommit(input: CreateGitHubCommitInput): Promise<string>;\n  createBranch(input: CreateGitHubBranchInput): Promise<void>;\n  updateBranch(input: UpdateGitHubBranchInput): Promise<void>;\n  createPullRequest(\n    input: CreateGitHubPublicationPullRequestInput,\n  ): Promise<CreatedGitHubPublicationPullRequest>;\n  pullRequest(input: ReadGitHubPullRequestInput): Promise<GitHubPublicationPullRequest>;\n  pullRequests(\n    input: ListGitHubPublicationPullRequestsInput,\n  ): Promise<readonly GitHubPublicationPullRequest[]>;\n  markReady(input: MarkGitHubPullRequestReadyInput): Promise<void>;\n}\n\n/** Exact commit requested from GitHub's Git Data API. */\nexport interface ReadGitHubCommitInput {\n  sha: string;\n}\n\n/** Tree and parents recorded for one GitHub commit. */\nexport interface GitHubCommit {\n  treeSha: string;\n  parentShas: readonly string[];\n}\n\n/** Exact branch whose current GitHub head should be read. */\nexport interface ReadGitHubBranchHeadInput {\n  branch: string;\n}\n\n/** Base tree and exclusive file operations used to create a GitHub tree. */\nexport interface CreateGitHubTreeInput {\n  baseTreeSha: string;\n  entries: readonly GitHubTreeEntry[];\n}\n\n/** Commit content and parent identities used to create a GitHub commit. */\nexport interface CreateGitHubCommitInput {\n  message: string;\n  treeSha: string;\n  parentShas: readonly string[];\n}\n\n/** Branch and commit identity used to create a GitHub branch. */\nexport interface CreateGitHubBranchInput {\n  branch: string;\n  sha: string;\n}\n\n/** Branch update and force policy used to move a GitHub branch. */\nexport interface UpdateGitHubBranchInput extends CreateGitHubBranchInput {\n  force: boolean;\n}\n\n/** Provider-owned pull-request number to read. */\nexport interface ReadGitHubPullRequestInput {\n  pullRequestNumber: number;\n}\n\n/** Provider GraphQL node identity of a draft pull request to mark ready. */\nexport interface MarkGitHubPullRequestReadyInput {\n  nodeId: string;\n}\n\n/** Pull-request presentation and branch inputs used during GitHub publication. */\nexport interface CreateGitHubPublicationPullRequestInput {\n  title: string;\n  body: string;\n  head: string;\n  base: string;\n  draft: boolean;\n}\n\n/** Provider identity and draft state returned after creating a pull request. */\nexport interface CreatedGitHubPublicationPullRequest {\n  pullRequestNumber: number;\n  pullRequestUrl: string;\n  draft: boolean;\n}\n\n/** State and optional exact head filter used to list publication pull requests. */\nexport interface ListGitHubPublicationPullRequestsInput {\n  state: \"open\" | \"all\";\n  head?: string;\n}\n\n/** GitHub publication failure that preserves the provider HTTP status. */\nexport class GitHubPublicationApiError extends Error {\n  constructor(\n    readonly status: number,\n    message: string,\n  ) {\n    super(`GitHub API request failed (${status}): ${message}`);\n    this.name = \"GitHubPublicationApiError\";\n  }\n}\n\ninterface GitHubTreeEntryBase {\n  path: string;\n  mode: \"100644\" | \"100755\";\n  type: \"blob\";\n}\n\n/** File content uploaded through GitHub's Git Data API. */\nexport interface GitHubTreeUpsert extends GitHubTreeEntryBase {\n  content: string;\n  sha?: never;\n}\n\n/** Existing file removed through GitHub's Git Data API. */\nexport interface GitHubTreeDeletion extends GitHubTreeEntryBase {\n  sha: null;\n  content?: never;\n}\n\n/** Exclusive bounded file upsert or deletion accepted by GitHub's Git Data API. */\nexport type GitHubTreeEntry = GitHubTreeUpsert | GitHubTreeDeletion;\n\n/** Committed workspace delta represented against a specific base commit. */\nexport interface CommittedGitChange {\n  base: string;\n  commitMessage: string;\n  tree: readonly GitHubTreeEntry[];\n  changedFiles: number;\n}\n\n/** Sandbox, repository, and bounds for reading a committed workspace delta. */\nexport interface ReadCommittedGitChangeInput extends GitHubPublicationLimits {\n  sandbox: SandboxGit;\n  repositorySlug: RepositorySlug;\n  baseRef?: string;\n  allowEmpty?: boolean;\n}\n\n/** Common dependencies for an authorized repository checkout. */\ninterface CheckoutGitHubRepositoryBaseInput {\n  sandbox: GitTransferSandbox;\n  repositorySlug: RepositorySlug;\n  transport: GitHubGitTransport;\n}\n\n/** Authorized repository checkout with recovery options that require a branch to resume. */\nexport type CheckoutGitHubRepositoryInput = CheckoutGitHubRepositoryBaseInput &\n  (\n    | {\n        resumeBranch?: never;\n        rememberPublishedHead?: never;\n      }\n    | {\n        /** Resume this remote branch when it exists after refreshing the default branch. */\n        resumeBranch: string;\n        /** Remember the resumed remote head for later publication reconciliation. */\n        rememberPublishedHead?: true;\n      }\n  );\n\n/** Refusal raised when an existing sandbox checkout points at another repository. */\nexport class GitHubCheckoutConflictError extends Error {\n  constructor(\n    readonly existingOrigin: string,\n    readonly expectedOrigin: string,\n  ) {\n    super(`sandbox checkout ${existingOrigin} does not match ${expectedOrigin}`);\n    this.name = \"GitHubCheckoutConflictError\";\n  }\n}\n\nconst safePathPattern = /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u;\nconst safeRefPattern = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/u;\nconst allowedModes = new Set([\"100644\", \"100755\"]);\nconst gitHubApiUrl = \"https://api.github.com\";\n\nconst shaSchema = z.string().min(1);\nconst pullRequestSchema = z.object({\n  number: z.number().int().positive(),\n  html_url: z.url(),\n  node_id: z.string().min(1),\n  title: z.string(),\n  body: z.string().nullable(),\n  state: z.enum([\"open\", \"closed\"]),\n  draft: z.boolean(),\n  head: z.object({\n    ref: z.string().min(1),\n    sha: shaSchema,\n    repo: z.object({ full_name: z.string().min(1) }).nullable(),\n  }),\n});\n\n/** GitHub Git Data and pull-request operations used by publication workflows. */\nexport function createGitHubPublicationClient(\n  options: GitHubPublicationClientOptions,\n): GitHubPublicationClient {\n  const repository = repositorySlugSchema.parse(options.repository.toLowerCase());\n  const request = async (path: string, init: RequestInit = {}): Promise<unknown> => {\n    let response: Response;\n    try {\n      response = await (options.fetch ?? globalThis.fetch)(\n        `${gitHubApiUrl}/repos/${repository}${path}`,\n        {\n          ...init,\n          headers: {\n            Accept: \"application/vnd.github+json\",\n            Authorization: `Bearer ${options.token}`,\n            \"Content-Type\": \"application/json\",\n            \"X-GitHub-Api-Version\": \"2022-11-28\",\n            ...init.headers,\n          },\n        },\n      );\n    } catch (error) {\n      throw new Error(\"GitHub API request failed\", { cause: error });\n    }\n    const body: unknown = await response.json().catch(() => null);\n    if (!response.ok) {\n      const parsed = z.object({ message: z.string() }).safeParse(body);\n      throw new GitHubPublicationApiError(\n        response.status,\n        parsed.success ? parsed.data.message : response.statusText,\n      );\n    }\n    return body;\n  };\n  const graphql = async (query: string, variables: Record<string, unknown>): Promise<void> => {\n    let response: Response;\n    try {\n      response = await (options.fetch ?? globalThis.fetch)(`${gitHubApiUrl}/graphql`, {\n        method: \"POST\",\n        headers: {\n          Accept: \"application/vnd.github+json\",\n          Authorization: `Bearer ${options.token}`,\n          \"Content-Type\": \"application/json\",\n          \"X-GitHub-Api-Version\": \"2022-11-28\",\n        },\n        body: JSON.stringify({ query, variables }),\n      });\n    } catch (error) {\n      throw new Error(\"GitHub GraphQL request failed\", { cause: error });\n    }\n    const body: unknown = await response.json().catch(() => null);\n    const parsed = z\n      .object({ errors: z.array(z.object({ message: z.string() })).optional() })\n      .safeParse(body);\n    if (!response.ok || (parsed.success && parsed.data.errors?.length)) {\n      throw new GitHubPublicationApiError(\n        response.status,\n        parsed.success && parsed.data.errors?.[0] !== undefined\n          ? parsed.data.errors[0].message\n          : response.statusText,\n      );\n    }\n  };\n  const parsePullRequest = (value: unknown): GitHubPublicationPullRequest => {\n    const pull = pullRequestSchema.parse(value);\n    return {\n      pullRequestNumber: pull.number,\n      pullRequestUrl: pull.html_url,\n      nodeId: pull.node_id,\n      title: pull.title,\n      body: pull.body,\n      state: pull.state,\n      draft: pull.draft,\n      head: {\n        branch: pull.head.ref,\n        sha: pull.head.sha,\n        repository:\n          pull.head.repo === null\n            ? null\n            : repositorySlugSchema.parse(pull.head.repo.full_name.toLowerCase()),\n      },\n    };\n  };\n  const branchPath = (branch: string): string => {\n    if (!isSafeGitRef(branch)) throw new Error(`refusing to use unsafe branch name: ${branch}`);\n    return branch;\n  };\n\n  return {\n    async commit(input) {\n      const commit = z\n        .object({\n          tree: z.object({ sha: shaSchema }),\n          parents: z.array(z.object({ sha: shaSchema })),\n        })\n        .parse(await request(`/git/commits/${encodeURIComponent(input.sha)}`));\n      return { treeSha: commit.tree.sha, parentShas: commit.parents.map((parent) => parent.sha) };\n    },\n    async branchHead(input) {\n      try {\n        const ref = z\n          .object({ object: z.object({ sha: shaSchema }) })\n          .parse(await request(`/git/ref/heads/${branchPath(input.branch)}`));\n        return ref.object.sha;\n      } catch (error) {\n        if (error instanceof GitHubPublicationApiError && error.status === 404) return null;\n        throw error;\n      }\n    },\n    async createTree(input) {\n      return z.object({ sha: shaSchema }).parse(\n        await request(\"/git/trees\", {\n          method: \"POST\",\n          body: JSON.stringify({ base_tree: input.baseTreeSha, tree: input.entries }),\n        }),\n      ).sha;\n    },\n    async createCommit(input) {\n      return z.object({ sha: shaSchema }).parse(\n        await request(\"/git/commits\", {\n          method: \"POST\",\n          body: JSON.stringify({\n            message: input.message,\n            tree: input.treeSha,\n            parents: input.parentShas,\n          }),\n        }),\n      ).sha;\n    },\n    async createBranch(input) {\n      await request(\"/git/refs\", {\n        method: \"POST\",\n        body: JSON.stringify({\n          ref: `refs/heads/${branchPath(input.branch)}`,\n          sha: input.sha,\n        }),\n      });\n    },\n    async updateBranch(input) {\n      await request(`/git/refs/heads/${branchPath(input.branch)}`, {\n        method: \"PATCH\",\n        body: JSON.stringify({ sha: input.sha, force: input.force }),\n      });\n    },\n    async createPullRequest(input) {\n      const pull = z\n        .object({\n          number: z.number().int().positive(),\n          html_url: z.url(),\n          draft: z.boolean(),\n        })\n        .parse(\n          await request(\"/pulls\", {\n            method: \"POST\",\n            body: JSON.stringify(input),\n          }),\n        );\n      return {\n        pullRequestNumber: pull.number,\n        pullRequestUrl: pull.html_url,\n        draft: pull.draft,\n      };\n    },\n    async pullRequest(input) {\n      return parsePullRequest(await request(`/pulls/${input.pullRequestNumber}`));\n    },\n    async pullRequests(input) {\n      const query = new URLSearchParams({ state: input.state, per_page: \"100\" });\n      if (input.head !== undefined) query.set(\"head\", input.head);\n      return z\n        .array(pullRequestSchema)\n        .parse(await request(`/pulls?${query.toString()}`))\n        .map(parsePullRequest);\n    },\n    async markReady(input) {\n      await graphql(\n        \"mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { clientMutationId } }\",\n        { id: input.nodeId },\n      );\n    },\n  };\n}\n\n/** Derive the deterministic publication branch owned by a durable Task. */\nexport function factoryTaskBranch(taskId: TaskId): string {\n  return `factory/${taskId}`;\n}\n\n/** Derive the deterministic publication branch owned by an operator session. */\nexport function factorySessionBranch(sessionId: AgentSessionId): string {\n  return `factory/${agentSessionIdSchema.parse(sessionId)}`;\n}\n\n/** Check whether a Git reference is safe to interpolate into supplied Git commands. */\nexport function isSafeGitRef(ref: string): boolean {\n  return safeRefPattern.test(ref) && !ref.includes(\"..\");\n}\n\n/** Clone or refresh one authorized GitHub repository without retaining credentials. */\nexport async function checkoutGitHubRepository(\n  input: CheckoutGitHubRepositoryInput,\n): Promise<void> {\n  const slug = repositorySlugSchema.parse(input.repositorySlug.toLowerCase());\n  const expectedOrigin = `https://github.com/${slug}.git`;\n  const checkout = await input.sandbox.run({ command: \"test -d repo/.git\" });\n  const existingOrigin =\n    checkout.exitCode === undefined || checkout.exitCode === 0\n      ? (\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"remote\",\n            \"get-url\",\n            \"origin\",\n          ])\n        ).trim()\n      : \"\";\n  if (existingOrigin !== \"\" && existingOrigin.toLowerCase() !== expectedOrigin) {\n    throw new GitHubCheckoutConflictError(existingOrigin, expectedOrigin);\n  }\n\n  const resume = input.resumeBranch;\n  if (resume !== undefined && !isSafeGitRef(resume)) {\n    throw new Error(`refusing to resume unsafe branch name: ${resume}`);\n  }\n  await input.transport.fetch({ repository: slug, refs: [] }, async (bundle) => {\n    await withSandboxGitBundle({\n      sandbox: input.sandbox,\n      bundle,\n      async use(path) {\n        if (existingOrigin === \"\") {\n          await runSandboxCommand(input.sandbox, [\"git\", \"clone\", path, \"repo\"]);\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"remote\",\n            \"set-url\",\n            \"origin\",\n            expectedOrigin,\n          ]);\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"config\",\n            \"user.name\",\n            \"factory\",\n          ]);\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"config\",\n            \"user.email\",\n            \"factory@localhost\",\n          ]);\n        } else {\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"fetch\",\n            path,\n            \"+refs/heads/*:refs/remotes/origin/*\",\n          ]);\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"reset\",\n            \"--hard\",\n            \"origin/HEAD\",\n          ]);\n        }\n        if (resume === undefined) return;\n        const exists = await input.sandbox.run({\n          command: [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"show-ref\",\n            \"--verify\",\n            \"--quiet\",\n            `refs/remotes/origin/${resume}`,\n          ]\n            .map(quoteShellArgument)\n            .join(\" \"),\n        });\n        if (exists.exitCode !== 0) return;\n        await runSandboxCommand(input.sandbox, [\n          \"git\",\n          \"-C\",\n          \"repo\",\n          \"checkout\",\n          \"-B\",\n          resume,\n          `refs/remotes/origin/${resume}`,\n        ]);\n        if (input.rememberPublishedHead === true) {\n          const head = (\n            await runSandboxCommand(input.sandbox, [\"git\", \"-C\", \"repo\", \"rev-parse\", \"HEAD\"])\n          ).trim();\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"config\",\n            \"factory.publishedHead\",\n            head,\n          ]);\n        }\n      },\n    });\n  });\n}\n\n/** Sandbox and argument vector for one Git command in a repository checkout. */\nexport interface RunSandboxGitInput {\n  sandbox: SandboxGit;\n  args: readonly string[];\n  repositoryPath?: string;\n}\n\n/** Run a Git argument vector in a sandbox repository and reject nonzero exits. */\nexport function runSandboxGit(input: RunSandboxGitInput): Promise<string> {\n  return runSandboxCommand(input.sandbox, [\n    \"git\",\n    \"-C\",\n    input.repositoryPath ?? \"repo\",\n    ...input.args,\n  ]);\n}\n\n/** Read committed sandbox changes as a bounded GitHub Git Data API tree. */\nexport async function readCommittedGitChange(\n  input: ReadCommittedGitChangeInput,\n): Promise<CommittedGitChange> {\n  const repositorySlug = repositorySlugSchema.parse(input.repositorySlug.toLowerCase());\n  const baseRef = input.baseRef ?? \"origin/HEAD\";\n  if (!isSafeGitRef(baseRef)) {\n    throw new Error(`refusing to read unsafe base ref: ${baseRef}`);\n  }\n  const maxChangedFiles = input.maxChangedFiles ?? 25;\n  const maxFileBytes = input.maxFileBytes ?? 200_000;\n  if (!Number.isSafeInteger(maxChangedFiles) || maxChangedFiles < 1) {\n    throw new Error(\"maxChangedFiles must be a positive integer\");\n  }\n  if (!Number.isSafeInteger(maxFileBytes) || maxFileBytes < 1) {\n    throw new Error(\"maxFileBytes must be a positive integer\");\n  }\n  const origin = (\n    await runSandboxGit({ sandbox: input.sandbox, args: [\"remote\", \"get-url\", \"origin\"] })\n  ).trim();\n  if (origin !== `https://github.com/${repositorySlug}.git`) {\n    throw new Error(`sandbox checkout does not match task repository ${repositorySlug}`);\n  }\n  const head = (\n    await runSandboxGit({ sandbox: input.sandbox, args: [\"rev-parse\", \"HEAD\"] })\n  ).trim();\n  const base = (\n    await runSandboxGit({ sandbox: input.sandbox, args: [\"rev-parse\", baseRef] })\n  ).trim();\n  if (head === base && input.allowEmpty !== true) {\n    throw new Error(\"no local commits to publish; commit your changes in the repo first\");\n  }\n  const commitMessage = (\n    await runSandboxGit({ sandbox: input.sandbox, args: [\"log\", \"-1\", \"--format=%B\", \"HEAD\"] })\n  ).trimEnd();\n  if (commitMessage.length === 0) throw new Error(\"the committed change has no commit message\");\n  if (Buffer.byteLength(commitMessage, \"utf8\") > 65_536) {\n    throw new Error(\"the committed change message exceeds the publication limit\");\n  }\n\n  const nameStatus = (\n    await runSandboxGit({\n      sandbox: input.sandbox,\n      args: [\"diff\", \"--name-status\", base, head],\n    })\n  ).trim();\n  const upserts: string[] = [];\n  const deletions: string[] = [];\n  for (const line of nameStatus.split(\"\\n\").filter(Boolean)) {\n    const fields = line.split(\"\\t\");\n    const status = fields[0] ?? \"\";\n    if (status === \"A\" || status === \"M\" || status === \"T\") {\n      upserts.push(requireSafePath(fields[1]));\n    } else if (status === \"D\") {\n      deletions.push(requireSafePath(fields[1]));\n    } else if (status.startsWith(\"R\") || status.startsWith(\"C\")) {\n      if (status.startsWith(\"R\")) deletions.push(requireSafePath(fields[1]));\n      upserts.push(requireSafePath(fields[2]));\n    } else {\n      throw new Error(`unsupported change status \"${status}\" in ${line}`);\n    }\n  }\n  const changedFiles = upserts.length + deletions.length;\n  if (changedFiles === 0 && input.allowEmpty !== true) {\n    throw new Error(\"the local commits contain no file changes\");\n  }\n  if (changedFiles > maxChangedFiles) {\n    throw new Error(`too many changed files (${changedFiles} > ${maxChangedFiles})`);\n  }\n\n  const tree: GitHubTreeEntry[] = [];\n  for (const path of upserts) {\n    const mode = (\n      await runSandboxGit({\n        sandbox: input.sandbox,\n        args: [\"ls-tree\", head, \"--\", path],\n      })\n    )\n      .trim()\n      .split(\" \")[0];\n    if (mode === undefined || !allowedModes.has(mode)) {\n      throw new Error(`unsupported file mode ${mode || \"(none)\"} for ${path}`);\n    }\n    const content = await runSandboxGit({\n      sandbox: input.sandbox,\n      args: [\"show\", `${head}:${path}`],\n    });\n    if (Buffer.byteLength(content, \"utf8\") > maxFileBytes) {\n      throw new Error(`${path} exceeds the ${maxFileBytes} byte publication limit`);\n    }\n    tree.push({ path, mode: mode as \"100644\" | \"100755\", type: \"blob\", content });\n  }\n  for (const path of deletions) {\n    tree.push({ path, mode: \"100644\", type: \"blob\", sha: null });\n  }\n  return { base, commitMessage, tree, changedFiles };\n}\n\nfunction requireSafePath(path: string | undefined): string {\n  if (path === undefined || path === \"\" || !safePathPattern.test(path) || path.includes(\"..\")) {\n    throw new Error(`refusing to publish unsafe path: ${path ?? \"(missing)\"}`);\n  }\n  return path;\n}\n"],"mappings":";;;;;;AAqJA,IAAa,4BAAb,cAA+C,MAAM;CAExC;CADX,YACE,QACA,SACA;EACA,MAAM,8BAA8B,OAAO,KAAK,SAAS;EAHhD,KAAA,SAAA;EAIT,KAAK,OAAO;CACd;AACF;;AA8DA,IAAa,8BAAb,cAAiD,MAAM;CAE1C;CACA;CAFX,YACE,gBACA,gBACA;EACA,MAAM,oBAAoB,eAAe,kBAAkB,gBAAgB;EAHlE,KAAA,iBAAA;EACA,KAAA,iBAAA;EAGT,KAAK,OAAO;CACd;AACF;AAEA,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AACvB,MAAM,+BAAe,IAAI,IAAI,CAAC,UAAU,QAAQ,CAAC;AACjD,MAAM,eAAe;AAErB,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAClC,MAAM,oBAAoB,EAAE,OAAO;CACjC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,IAAI;CAChB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,OAAO,EAAE,OAAO;CAChB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;CAChC,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,OAAO;EACb,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACrB,KAAK;EACL,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;CAC5D,CAAC;AACH,CAAC;;AAGD,SAAgB,8BACd,SACyB;CACzB,MAAM,aAAa,qBAAqB,MAAM,QAAQ,WAAW,YAAY,CAAC;CAC9E,MAAM,UAAU,OAAO,MAAc,OAAoB,CAAC,MAAwB;EAChF,IAAI;EACJ,IAAI;GACF,WAAW,OAAO,QAAQ,SAAS,WAAW,MAAA,CAC5C,GAAG,aAAa,SAAS,aAAa,QACtC;IACE,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ;KACjC,gBAAgB;KAChB,wBAAwB;KACxB,GAAG,KAAK;IACV;GACF,CACF;EACF,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,6BAA6B,EAAE,OAAO,MAAM,CAAC;EAC/D;EACA,MAAM,OAAgB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;EAC5D,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI;GAC/D,MAAM,IAAI,0BACR,SAAS,QACT,OAAO,UAAU,OAAO,KAAK,UAAU,SAAS,UAClD;EACF;EACA,OAAO;CACT;CACA,MAAM,UAAU,OAAO,OAAe,cAAsD;EAC1F,IAAI;EACJ,IAAI;GACF,WAAW,OAAO,QAAQ,SAAS,WAAW,MAAA,CAAO,GAAG,aAAa,WAAW;IAC9E,QAAQ;IACR,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ;KACjC,gBAAgB;KAChB,wBAAwB;IAC1B;IACA,MAAM,KAAK,UAAU;KAAE;KAAO;IAAU,CAAC;GAC3C,CAAC;EACH,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,iCAAiC,EAAE,OAAO,MAAM,CAAC;EACnE;EACA,MAAM,OAAgB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;EAC5D,MAAM,SAAS,EACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CACzE,UAAU,IAAI;EACjB,IAAI,CAAC,SAAS,MAAO,OAAO,WAAW,OAAO,KAAK,QAAQ,QACzD,MAAM,IAAI,0BACR,SAAS,QACT,OAAO,WAAW,OAAO,KAAK,SAAS,OAAO,KAAA,IAC1C,OAAO,KAAK,OAAO,EAAE,CAAC,UACtB,SAAS,UACf;CAEJ;CACA,MAAM,oBAAoB,UAAiD;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,OAAO;GACL,mBAAmB,KAAK;GACxB,gBAAgB,KAAK;GACrB,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,OAAO,KAAK;GACZ,MAAM;IACJ,QAAQ,KAAK,KAAK;IAClB,KAAK,KAAK,KAAK;IACf,YACE,KAAK,KAAK,SAAS,OACf,OACA,qBAAqB,MAAM,KAAK,KAAK,KAAK,UAAU,YAAY,CAAC;GACzE;EACF;CACF;CACA,MAAM,cAAc,WAA2B;EAC7C,IAAI,CAAC,aAAa,MAAM,GAAG,MAAM,IAAI,MAAM,uCAAuC,QAAQ;EAC1F,OAAO;CACT;CAEA,OAAO;EACL,MAAM,OAAO,OAAO;GAClB,MAAM,SAAS,EACZ,OAAO;IACN,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC;GAC/C,CAAC,CAAC,CACD,MAAM,MAAM,QAAQ,gBAAgB,mBAAmB,MAAM,GAAG,GAAG,CAAC;GACvE,OAAO;IAAE,SAAS,OAAO,KAAK;IAAK,YAAY,OAAO,QAAQ,KAAK,WAAW,OAAO,GAAG;GAAE;EAC5F;EACA,MAAM,WAAW,OAAO;GACtB,IAAI;IAIF,OAHY,EACT,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC,CAChD,MAAM,MAAM,QAAQ,kBAAkB,WAAW,MAAM,MAAM,GAAG,CAC1D,CAAC,CAAC,OAAO;GACpB,SAAS,OAAO;IACd,IAAI,iBAAiB,6BAA6B,MAAM,WAAW,KAAK,OAAO;IAC/E,MAAM;GACR;EACF;EACA,MAAM,WAAW,OAAO;GACtB,OAAO,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,MAClC,MAAM,QAAQ,cAAc;IAC1B,QAAQ;IACR,MAAM,KAAK,UAAU;KAAE,WAAW,MAAM;KAAa,MAAM,MAAM;IAAQ,CAAC;GAC5E,CAAC,CACH,CAAC,CAAC;EACJ;EACA,MAAM,aAAa,OAAO;GACxB,OAAO,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,MAClC,MAAM,QAAQ,gBAAgB;IAC5B,QAAQ;IACR,MAAM,KAAK,UAAU;KACnB,SAAS,MAAM;KACf,MAAM,MAAM;KACZ,SAAS,MAAM;IACjB,CAAC;GACH,CAAC,CACH,CAAC,CAAC;EACJ;EACA,MAAM,aAAa,OAAO;GACxB,MAAM,QAAQ,aAAa;IACzB,QAAQ;IACR,MAAM,KAAK,UAAU;KACnB,KAAK,cAAc,WAAW,MAAM,MAAM;KAC1C,KAAK,MAAM;IACb,CAAC;GACH,CAAC;EACH;EACA,MAAM,aAAa,OAAO;GACxB,MAAM,QAAQ,mBAAmB,WAAW,MAAM,MAAM,KAAK;IAC3D,QAAQ;IACR,MAAM,KAAK,UAAU;KAAE,KAAK,MAAM;KAAK,OAAO,MAAM;IAAM,CAAC;GAC7D,CAAC;EACH;EACA,MAAM,kBAAkB,OAAO;GAC7B,MAAM,OAAO,EACV,OAAO;IACN,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;IAClC,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE,QAAQ;GACnB,CAAC,CAAC,CACD,MACC,MAAM,QAAQ,UAAU;IACtB,QAAQ;IACR,MAAM,KAAK,UAAU,KAAK;GAC5B,CAAC,CACH;GACF,OAAO;IACL,mBAAmB,KAAK;IACxB,gBAAgB,KAAK;IACrB,OAAO,KAAK;GACd;EACF;EACA,MAAM,YAAY,OAAO;GACvB,OAAO,iBAAiB,MAAM,QAAQ,UAAU,MAAM,mBAAmB,CAAC;EAC5E;EACA,MAAM,aAAa,OAAO;GACxB,MAAM,QAAQ,IAAI,gBAAgB;IAAE,OAAO,MAAM;IAAO,UAAU;GAAM,CAAC;GACzE,IAAI,MAAM,SAAS,KAAA,GAAW,MAAM,IAAI,QAAQ,MAAM,IAAI;GAC1D,OAAO,EACJ,MAAM,iBAAiB,CAAC,CACxB,MAAM,MAAM,QAAQ,UAAU,MAAM,SAAS,GAAG,CAAC,CAAC,CAClD,IAAI,gBAAgB;EACzB;EACA,MAAM,UAAU,OAAO;GACrB,MAAM,QACJ,4GACA,EAAE,IAAI,MAAM,OAAO,CACrB;EACF;CACF;AACF;;AAGA,SAAgB,kBAAkB,QAAwB;CACxD,OAAO,WAAW;AACpB;;AAGA,SAAgB,qBAAqB,WAAmC;CACtE,OAAO,WAAW,qBAAqB,MAAM,SAAS;AACxD;;AAGA,SAAgB,aAAa,KAAsB;CACjD,OAAO,eAAe,KAAK,GAAG,KAAK,CAAC,IAAI,SAAS,IAAI;AACvD;;AAGA,eAAsB,yBACpB,OACe;CACf,MAAM,OAAO,qBAAqB,MAAM,MAAM,eAAe,YAAY,CAAC;CAC1E,MAAM,iBAAiB,sBAAsB,KAAK;CAClD,MAAM,WAAW,MAAM,MAAM,QAAQ,IAAI,EAAE,SAAS,oBAAoB,CAAC;CACzE,MAAM,iBACJ,SAAS,aAAa,KAAA,KAAa,SAAS,aAAa,KAEnD,MAAM,kBAAkB,MAAM,SAAS;EACrC;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,EAAA,CACD,KAAK,IACP;CACN,IAAI,mBAAmB,MAAM,eAAe,YAAY,MAAM,gBAC5D,MAAM,IAAI,4BAA4B,gBAAgB,cAAc;CAGtE,MAAM,SAAS,MAAM;CACrB,IAAI,WAAW,KAAA,KAAa,CAAC,aAAa,MAAM,GAC9C,MAAM,IAAI,MAAM,0CAA0C,QAAQ;CAEpE,MAAM,MAAM,UAAU,MAAM;EAAE,YAAY;EAAM,MAAM,CAAC;CAAE,GAAG,OAAO,WAAW;EAC5E,MAAM,qBAAqB;GACzB,SAAS,MAAM;GACf;GACA,MAAM,IAAI,MAAM;IACd,IAAI,mBAAmB,IAAI;KACzB,MAAM,kBAAkB,MAAM,SAAS;MAAC;MAAO;MAAS;MAAM;KAAM,CAAC;KACrE,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;KACD,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;KACD,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;IACH,OAAO;KACL,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;KACD,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;IACH;IACA,IAAI,WAAW,KAAA,GAAW;IAc1B,KAAI,MAbiB,MAAM,QAAQ,IAAI,EACrC,SAAS;KACP;KACA;KACA;KACA;KACA;KACA;KACA,uBAAuB;IACzB,CAAC,CACE,IAAI,kBAAkB,CAAC,CACvB,KAAK,GAAG,EACb,CAAC,EAAA,CACU,aAAa,GAAG;IAC3B,MAAM,kBAAkB,MAAM,SAAS;KACrC;KACA;KACA;KACA;KACA;KACA;KACA,uBAAuB;IACzB,CAAC;IACD,IAAI,MAAM,0BAA0B,MAAM;KACxC,MAAM,QACJ,MAAM,kBAAkB,MAAM,SAAS;MAAC;MAAO;MAAM;MAAQ;MAAa;KAAM,CAAC,EAAA,CACjF,KAAK;KACP,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;IACH;GACF;EACF,CAAC;CACH,CAAC;AACH;;AAUA,SAAgB,cAAc,OAA4C;CACxE,OAAO,kBAAkB,MAAM,SAAS;EACtC;EACA;EACA,MAAM,kBAAkB;EACxB,GAAG,MAAM;CACX,CAAC;AACH;;AAGA,eAAsB,uBACpB,OAC6B;CAC7B,MAAM,iBAAiB,qBAAqB,MAAM,MAAM,eAAe,YAAY,CAAC;CACpF,MAAM,UAAU,MAAM,WAAW;CACjC,IAAI,CAAC,aAAa,OAAO,GACvB,MAAM,IAAI,MAAM,qCAAqC,SAAS;CAEhE,MAAM,kBAAkB,MAAM,mBAAmB;CACjD,MAAM,eAAe,MAAM,gBAAgB;CAC3C,IAAI,CAAC,OAAO,cAAc,eAAe,KAAK,kBAAkB,GAC9D,MAAM,IAAI,MAAM,4CAA4C;CAE9D,IAAI,CAAC,OAAO,cAAc,YAAY,KAAK,eAAe,GACxD,MAAM,IAAI,MAAM,yCAAyC;CAK3D,KAFE,MAAM,cAAc;EAAE,SAAS,MAAM;EAAS,MAAM;GAAC;GAAU;GAAW;EAAQ;CAAE,CAAC,EAAA,CACrF,KACO,MAAM,sBAAsB,eAAe,OAClD,MAAM,IAAI,MAAM,mDAAmD,gBAAgB;CAErF,MAAM,QACJ,MAAM,cAAc;EAAE,SAAS,MAAM;EAAS,MAAM,CAAC,aAAa,MAAM;CAAE,CAAC,EAAA,CAC3E,KAAK;CACP,MAAM,QACJ,MAAM,cAAc;EAAE,SAAS,MAAM;EAAS,MAAM,CAAC,aAAa,OAAO;CAAE,CAAC,EAAA,CAC5E,KAAK;CACP,IAAI,SAAS,QAAQ,MAAM,eAAe,MACxC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,MAAM,iBACJ,MAAM,cAAc;EAAE,SAAS,MAAM;EAAS,MAAM;GAAC;GAAO;GAAM;GAAe;EAAM;CAAE,CAAC,EAAA,CAC1F,QAAQ;CACV,IAAI,cAAc,WAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5F,IAAI,OAAO,WAAW,eAAe,MAAM,IAAI,OAC7C,MAAM,IAAI,MAAM,4DAA4D;CAG9E,MAAM,cACJ,MAAM,cAAc;EAClB,SAAS,MAAM;EACf,MAAM;GAAC;GAAQ;GAAiB;GAAM;EAAI;CAC5C,CAAC,EAAA,CACD,KAAK;CACP,MAAM,UAAoB,CAAC;CAC3B,MAAM,YAAsB,CAAC;CAC7B,KAAK,MAAM,QAAQ,WAAW,MAAM,IAAI,CAAC,CAAC,OAAO,OAAO,GAAG;EACzD,MAAM,SAAS,KAAK,MAAM,GAAI;EAC9B,MAAM,SAAS,OAAO,MAAM;EAC5B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,QAAQ,KAAK,gBAAgB,OAAO,EAAE,CAAC;OAClC,IAAI,WAAW,KACpB,UAAU,KAAK,gBAAgB,OAAO,EAAE,CAAC;OACpC,IAAI,OAAO,WAAW,GAAG,KAAK,OAAO,WAAW,GAAG,GAAG;GAC3D,IAAI,OAAO,WAAW,GAAG,GAAG,UAAU,KAAK,gBAAgB,OAAO,EAAE,CAAC;GACrE,QAAQ,KAAK,gBAAgB,OAAO,EAAE,CAAC;EACzC,OACE,MAAM,IAAI,MAAM,8BAA8B,OAAO,OAAO,MAAM;CAEtE;CACA,MAAM,eAAe,QAAQ,SAAS,UAAU;CAChD,IAAI,iBAAiB,KAAK,MAAM,eAAe,MAC7C,MAAM,IAAI,MAAM,2CAA2C;CAE7D,IAAI,eAAe,iBACjB,MAAM,IAAI,MAAM,2BAA2B,aAAa,KAAK,gBAAgB,EAAE;CAGjF,MAAM,OAA0B,CAAC;CACjC,KAAK,MAAM,QAAQ,SAAS;EAC1B,MAAM,QACJ,MAAM,cAAc;GAClB,SAAS,MAAM;GACf,MAAM;IAAC;IAAW;IAAM;IAAM;GAAI;EACpC,CAAC,EAAA,CAEA,KAAK,CAAC,CACN,MAAM,GAAG,CAAC,CAAC;EACd,IAAI,SAAS,KAAA,KAAa,CAAC,aAAa,IAAI,IAAI,GAC9C,MAAM,IAAI,MAAM,yBAAyB,QAAQ,SAAS,OAAO,MAAM;EAEzE,MAAM,UAAU,MAAM,cAAc;GAClC,SAAS,MAAM;GACf,MAAM,CAAC,QAAQ,GAAG,KAAK,GAAG,MAAM;EAClC,CAAC;EACD,IAAI,OAAO,WAAW,SAAS,MAAM,IAAI,cACvC,MAAM,IAAI,MAAM,GAAG,KAAK,eAAe,aAAa,wBAAwB;EAE9E,KAAK,KAAK;GAAE;GAAY;GAA6B,MAAM;GAAQ;EAAQ,CAAC;CAC9E;CACA,KAAK,MAAM,QAAQ,WACjB,KAAK,KAAK;EAAE;EAAM,MAAM;EAAU,MAAM;EAAQ,KAAK;CAAK,CAAC;CAE7D,OAAO;EAAE;EAAM;EAAe;EAAM;CAAa;AACnD;AAEA,SAAS,gBAAgB,MAAkC;CACzD,IAAI,SAAS,KAAA,KAAa,SAAS,MAAM,CAAC,gBAAgB,KAAK,IAAI,KAAK,KAAK,SAAS,IAAI,GACxF,MAAM,IAAI,MAAM,oCAAoC,QAAQ,aAAa;CAE3E,OAAO;AACT"}
+{"version":3,"file":"github-publication.mjs","names":[],"sources":["../src/github-publication.ts"],"sourcesContent":["import {\n  withSandboxGitBundle,\n  quoteShellArgument,\n  runSandboxCommand,\n  type GitHubGitTransport,\n  type GitTransferSandbox,\n} from \"./github-transfer\";\nimport type { TaskId } from \"./schema/id\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./schema/repository\";\nimport { agentSessionIdSchema, type AgentSessionId } from \"./schema/session\";\nimport { z } from \"zod\";\n\n/** Minimal sandbox command boundary required by Git checkout and publication helpers. */\nexport interface SandboxGit {\n  run(options: SandboxGitCommandInput): PromiseLike<SandboxGitCommandResult>;\n}\n\n/** Shell command submitted through the minimal Git sandbox boundary. */\nexport interface SandboxGitCommandInput {\n  command: string;\n}\n\n/** Captured output and optional exit status from a sandbox Git command. */\nexport interface SandboxGitCommandResult {\n  stdout: string;\n  stderr?: string;\n  exitCode?: number;\n}\n\n/** Bounds applied while translating committed workspace changes into GitHub tree entries. */\nexport interface GitHubPublicationLimits {\n  maxChangedFiles?: number;\n  maxFileBytes?: number;\n}\n\n/** Repository-scoped credentials and transport for the GitHub publication client. */\nexport interface GitHubPublicationClientOptions {\n  repository: RepositorySlug;\n  token: string;\n  fetch?: typeof globalThis.fetch;\n}\n\n/** Pull-request snapshot used to reconcile idempotent publication effects. */\nexport interface GitHubPublicationPullRequest {\n  pullRequestNumber: number;\n  pullRequestUrl: string;\n  nodeId: string;\n  title: string;\n  body: string | null;\n  state: \"open\" | \"closed\";\n  draft: boolean;\n  head: {\n    branch: string;\n    sha: string;\n    repository: RepositorySlug | null;\n  };\n}\n\n/** Git Data and pull-request operations needed by supplied publication workflows. */\nexport interface GitHubPublicationClient {\n  commit(input: ReadGitHubCommitInput): Promise<GitHubCommit>;\n  branchHead(input: ReadGitHubBranchHeadInput): Promise<string | null>;\n  createTree(input: CreateGitHubTreeInput): Promise<string>;\n  createCommit(input: CreateGitHubCommitInput): Promise<string>;\n  createBranch(input: CreateGitHubBranchInput): Promise<void>;\n  updateBranch(input: UpdateGitHubBranchInput): Promise<void>;\n  createPullRequest(\n    input: CreateGitHubPublicationPullRequestInput,\n  ): Promise<CreatedGitHubPublicationPullRequest>;\n  pullRequest(input: ReadGitHubPullRequestInput): Promise<GitHubPublicationPullRequest>;\n  pullRequests(\n    input: ListGitHubPublicationPullRequestsInput,\n  ): Promise<readonly GitHubPublicationPullRequest[]>;\n  markReady(input: MarkGitHubPullRequestReadyInput): Promise<void>;\n}\n\n/** Exact commit requested from GitHub's Git Data API. */\nexport interface ReadGitHubCommitInput {\n  sha: string;\n}\n\n/** Tree and parents recorded for one GitHub commit. */\nexport interface GitHubCommit {\n  treeSha: string;\n  parentShas: readonly string[];\n}\n\n/** Exact branch whose current GitHub head should be read. */\nexport interface ReadGitHubBranchHeadInput {\n  branch: string;\n}\n\n/** Base tree and exclusive file operations used to create a GitHub tree. */\nexport interface CreateGitHubTreeInput {\n  baseTreeSha: string;\n  entries: readonly GitHubTreeEntry[];\n}\n\n/** Commit content and parent identities used to create a GitHub commit. */\nexport interface CreateGitHubCommitInput {\n  message: string;\n  treeSha: string;\n  parentShas: readonly string[];\n}\n\n/** Branch and commit identity used to create a GitHub branch. */\nexport interface CreateGitHubBranchInput {\n  branch: string;\n  sha: string;\n}\n\n/** Branch update and force policy used to move a GitHub branch. */\nexport interface UpdateGitHubBranchInput extends CreateGitHubBranchInput {\n  force: boolean;\n}\n\n/** Provider-owned pull-request number to read. */\nexport interface ReadGitHubPullRequestInput {\n  pullRequestNumber: number;\n}\n\n/** Provider GraphQL node identity of a draft pull request to mark ready. */\nexport interface MarkGitHubPullRequestReadyInput {\n  nodeId: string;\n}\n\n/** Pull-request presentation and branch inputs used during GitHub publication. */\nexport interface CreateGitHubPublicationPullRequestInput {\n  title: string;\n  body: string;\n  head: string;\n  base: string;\n  draft: boolean;\n}\n\n/** Provider identity and draft state returned after creating a pull request. */\nexport interface CreatedGitHubPublicationPullRequest {\n  pullRequestNumber: number;\n  pullRequestUrl: string;\n  draft: boolean;\n}\n\n/** State and optional exact head filter used to list publication pull requests. */\nexport interface ListGitHubPublicationPullRequestsInput {\n  state: \"open\" | \"all\";\n  head?: string;\n}\n\n/** GitHub publication failure that preserves the provider HTTP status. */\nexport class GitHubPublicationApiError extends Error {\n  constructor(\n    readonly status: number,\n    message: string,\n  ) {\n    super(`GitHub API request failed (${status}): ${message}`);\n    this.name = \"GitHubPublicationApiError\";\n  }\n}\n\ninterface GitHubTreeEntryBase {\n  path: string;\n  mode: \"100644\" | \"100755\";\n  type: \"blob\";\n}\n\n/** File content uploaded through GitHub's Git Data API. */\nexport interface GitHubTreeUpsert extends GitHubTreeEntryBase {\n  content: string;\n  sha?: never;\n}\n\n/** Existing file removed through GitHub's Git Data API. */\nexport interface GitHubTreeDeletion extends GitHubTreeEntryBase {\n  sha: null;\n  content?: never;\n}\n\n/** Exclusive bounded file upsert or deletion accepted by GitHub's Git Data API. */\nexport type GitHubTreeEntry = GitHubTreeUpsert | GitHubTreeDeletion;\n\n/** Committed workspace delta represented against a specific base commit. */\nexport interface CommittedGitChange {\n  base: string;\n  commitMessage: string;\n  tree: readonly GitHubTreeEntry[];\n  changedFiles: number;\n}\n\n/** Sandbox, repository, and bounds for reading a committed workspace delta. */\nexport interface ReadCommittedGitChangeInput extends GitHubPublicationLimits {\n  sandbox: SandboxGit;\n  repositorySlug: RepositorySlug;\n  baseRef?: string;\n  allowEmpty?: boolean;\n}\n\n/** Common dependencies for an authorized repository checkout. */\ninterface CheckoutGitHubRepositoryBaseInput {\n  sandbox: GitTransferSandbox;\n  repositorySlug: RepositorySlug;\n  transport: GitHubGitTransport;\n  /** Also fetch this pull request's head, including forks, to `refs/remotes/origin/pr/<number>`. */\n  pullRequestNumber?: number;\n}\n\n/** Authorized repository checkout with recovery options that require a branch to resume. */\nexport type CheckoutGitHubRepositoryInput = CheckoutGitHubRepositoryBaseInput &\n  (\n    | {\n        resumeBranch?: never;\n        rememberPublishedHead?: never;\n      }\n    | {\n        /** Resume this remote branch when it exists after refreshing the default branch. */\n        resumeBranch: string;\n        /** Remember the resumed remote head for later publication reconciliation. */\n        rememberPublishedHead?: true;\n      }\n  );\n\n/** Refusal raised when an existing sandbox checkout points at another repository. */\nexport class GitHubCheckoutConflictError extends Error {\n  constructor(\n    readonly existingOrigin: string,\n    readonly expectedOrigin: string,\n  ) {\n    super(`sandbox checkout ${existingOrigin} does not match ${expectedOrigin}`);\n    this.name = \"GitHubCheckoutConflictError\";\n  }\n}\n\nconst safePathPattern = /^[A-Za-z0-9.][A-Za-z0-9._/-]*$/u;\nconst safeRefPattern = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/u;\nconst allowedModes = new Set([\"100644\", \"100755\"]);\nconst gitHubApiUrl = \"https://api.github.com\";\n\nconst shaSchema = z.string().min(1);\nconst pullRequestSchema = z.object({\n  number: z.number().int().positive(),\n  html_url: z.url(),\n  node_id: z.string().min(1),\n  title: z.string(),\n  body: z.string().nullable(),\n  state: z.enum([\"open\", \"closed\"]),\n  draft: z.boolean(),\n  head: z.object({\n    ref: z.string().min(1),\n    sha: shaSchema,\n    repo: z.object({ full_name: z.string().min(1) }).nullable(),\n  }),\n});\n\n/** GitHub Git Data and pull-request operations used by publication workflows. */\nexport function createGitHubPublicationClient(\n  options: GitHubPublicationClientOptions,\n): GitHubPublicationClient {\n  const repository = repositorySlugSchema.parse(options.repository.toLowerCase());\n  const request = async (path: string, init: RequestInit = {}): Promise<unknown> => {\n    let response: Response;\n    try {\n      response = await (options.fetch ?? globalThis.fetch)(\n        `${gitHubApiUrl}/repos/${repository}${path}`,\n        {\n          ...init,\n          headers: {\n            Accept: \"application/vnd.github+json\",\n            Authorization: `Bearer ${options.token}`,\n            \"Content-Type\": \"application/json\",\n            \"X-GitHub-Api-Version\": \"2022-11-28\",\n            ...init.headers,\n          },\n        },\n      );\n    } catch (error) {\n      throw new Error(\"GitHub API request failed\", { cause: error });\n    }\n    const body: unknown = await response.json().catch(() => null);\n    if (!response.ok) {\n      const parsed = z.object({ message: z.string() }).safeParse(body);\n      throw new GitHubPublicationApiError(\n        response.status,\n        parsed.success ? parsed.data.message : response.statusText,\n      );\n    }\n    return body;\n  };\n  const graphql = async (query: string, variables: Record<string, unknown>): Promise<void> => {\n    let response: Response;\n    try {\n      response = await (options.fetch ?? globalThis.fetch)(`${gitHubApiUrl}/graphql`, {\n        method: \"POST\",\n        headers: {\n          Accept: \"application/vnd.github+json\",\n          Authorization: `Bearer ${options.token}`,\n          \"Content-Type\": \"application/json\",\n          \"X-GitHub-Api-Version\": \"2022-11-28\",\n        },\n        body: JSON.stringify({ query, variables }),\n      });\n    } catch (error) {\n      throw new Error(\"GitHub GraphQL request failed\", { cause: error });\n    }\n    const body: unknown = await response.json().catch(() => null);\n    const parsed = z\n      .object({ errors: z.array(z.object({ message: z.string() })).optional() })\n      .safeParse(body);\n    if (!response.ok || (parsed.success && parsed.data.errors?.length)) {\n      throw new GitHubPublicationApiError(\n        response.status,\n        parsed.success && parsed.data.errors?.[0] !== undefined\n          ? parsed.data.errors[0].message\n          : response.statusText,\n      );\n    }\n  };\n  const parsePullRequest = (value: unknown): GitHubPublicationPullRequest => {\n    const pull = pullRequestSchema.parse(value);\n    return {\n      pullRequestNumber: pull.number,\n      pullRequestUrl: pull.html_url,\n      nodeId: pull.node_id,\n      title: pull.title,\n      body: pull.body,\n      state: pull.state,\n      draft: pull.draft,\n      head: {\n        branch: pull.head.ref,\n        sha: pull.head.sha,\n        repository:\n          pull.head.repo === null\n            ? null\n            : repositorySlugSchema.parse(pull.head.repo.full_name.toLowerCase()),\n      },\n    };\n  };\n  const branchPath = (branch: string): string => {\n    if (!isSafeGitRef(branch)) throw new Error(`refusing to use unsafe branch name: ${branch}`);\n    return branch;\n  };\n\n  return {\n    async commit(input) {\n      const commit = z\n        .object({\n          tree: z.object({ sha: shaSchema }),\n          parents: z.array(z.object({ sha: shaSchema })),\n        })\n        .parse(await request(`/git/commits/${encodeURIComponent(input.sha)}`));\n      return { treeSha: commit.tree.sha, parentShas: commit.parents.map((parent) => parent.sha) };\n    },\n    async branchHead(input) {\n      try {\n        const ref = z\n          .object({ object: z.object({ sha: shaSchema }) })\n          .parse(await request(`/git/ref/heads/${branchPath(input.branch)}`));\n        return ref.object.sha;\n      } catch (error) {\n        if (error instanceof GitHubPublicationApiError && error.status === 404) return null;\n        throw error;\n      }\n    },\n    async createTree(input) {\n      return z.object({ sha: shaSchema }).parse(\n        await request(\"/git/trees\", {\n          method: \"POST\",\n          body: JSON.stringify({ base_tree: input.baseTreeSha, tree: input.entries }),\n        }),\n      ).sha;\n    },\n    async createCommit(input) {\n      return z.object({ sha: shaSchema }).parse(\n        await request(\"/git/commits\", {\n          method: \"POST\",\n          body: JSON.stringify({\n            message: input.message,\n            tree: input.treeSha,\n            parents: input.parentShas,\n          }),\n        }),\n      ).sha;\n    },\n    async createBranch(input) {\n      await request(\"/git/refs\", {\n        method: \"POST\",\n        body: JSON.stringify({\n          ref: `refs/heads/${branchPath(input.branch)}`,\n          sha: input.sha,\n        }),\n      });\n    },\n    async updateBranch(input) {\n      await request(`/git/refs/heads/${branchPath(input.branch)}`, {\n        method: \"PATCH\",\n        body: JSON.stringify({ sha: input.sha, force: input.force }),\n      });\n    },\n    async createPullRequest(input) {\n      const pull = z\n        .object({\n          number: z.number().int().positive(),\n          html_url: z.url(),\n          draft: z.boolean(),\n        })\n        .parse(\n          await request(\"/pulls\", {\n            method: \"POST\",\n            body: JSON.stringify(input),\n          }),\n        );\n      return {\n        pullRequestNumber: pull.number,\n        pullRequestUrl: pull.html_url,\n        draft: pull.draft,\n      };\n    },\n    async pullRequest(input) {\n      return parsePullRequest(await request(`/pulls/${input.pullRequestNumber}`));\n    },\n    async pullRequests(input) {\n      const query = new URLSearchParams({ state: input.state, per_page: \"100\" });\n      if (input.head !== undefined) query.set(\"head\", input.head);\n      return z\n        .array(pullRequestSchema)\n        .parse(await request(`/pulls?${query.toString()}`))\n        .map(parsePullRequest);\n    },\n    async markReady(input) {\n      await graphql(\n        \"mutation($id: ID!) { markPullRequestReadyForReview(input: { pullRequestId: $id }) { clientMutationId } }\",\n        { id: input.nodeId },\n      );\n    },\n  };\n}\n\n/** Derive the deterministic publication branch owned by a durable Task. */\nexport function factoryTaskBranch(taskId: TaskId): string {\n  return `factory/${taskId}`;\n}\n\n/** Derive the deterministic publication branch owned by an operator session. */\nexport function factorySessionBranch(sessionId: AgentSessionId): string {\n  return `factory/${agentSessionIdSchema.parse(sessionId)}`;\n}\n\n/** Check whether a Git reference is safe to interpolate into supplied Git commands. */\nexport function isSafeGitRef(ref: string): boolean {\n  return safeRefPattern.test(ref) && !ref.includes(\"..\");\n}\n\n/** Clone or refresh one authorized GitHub repository without retaining credentials. */\nexport async function checkoutGitHubRepository(\n  input: CheckoutGitHubRepositoryInput,\n): Promise<void> {\n  const slug = repositorySlugSchema.parse(input.repositorySlug.toLowerCase());\n  const expectedOrigin = `https://github.com/${slug}.git`;\n  const checkout = await input.sandbox.run({ command: \"test -d repo/.git\" });\n  const existingOrigin =\n    checkout.exitCode === undefined || checkout.exitCode === 0\n      ? (\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"remote\",\n            \"get-url\",\n            \"origin\",\n          ])\n        ).trim()\n      : \"\";\n  if (existingOrigin !== \"\" && existingOrigin.toLowerCase() !== expectedOrigin) {\n    throw new GitHubCheckoutConflictError(existingOrigin, expectedOrigin);\n  }\n\n  const resume = input.resumeBranch;\n  if (resume !== undefined && !isSafeGitRef(resume)) {\n    throw new Error(`refusing to resume unsafe branch name: ${resume}`);\n  }\n  const pullRequestNumber = input.pullRequestNumber;\n  if (\n    pullRequestNumber !== undefined &&\n    (!Number.isSafeInteger(pullRequestNumber) || pullRequestNumber < 1)\n  ) {\n    throw new Error(\"pullRequestNumber must be a positive integer\");\n  }\n  const pullRequestRef =\n    pullRequestNumber === undefined ? undefined : `refs/pull/${pullRequestNumber}/head`;\n  await input.transport.fetch(\n    { repository: slug, refs: pullRequestRef === undefined ? [] : [pullRequestRef] },\n    async (bundle) => {\n      await withSandboxGitBundle({\n        sandbox: input.sandbox,\n        bundle,\n        async use(path) {\n          if (existingOrigin === \"\") {\n            await runSandboxCommand(input.sandbox, [\"git\", \"clone\", path, \"repo\"]);\n            await runSandboxCommand(input.sandbox, [\n              \"git\",\n              \"-C\",\n              \"repo\",\n              \"remote\",\n              \"set-url\",\n              \"origin\",\n              expectedOrigin,\n            ]);\n            await runSandboxCommand(input.sandbox, [\n              \"git\",\n              \"-C\",\n              \"repo\",\n              \"config\",\n              \"user.name\",\n              \"factory\",\n            ]);\n            await runSandboxCommand(input.sandbox, [\n              \"git\",\n              \"-C\",\n              \"repo\",\n              \"config\",\n              \"user.email\",\n              \"factory@localhost\",\n            ]);\n          } else {\n            await runSandboxCommand(input.sandbox, [\n              \"git\",\n              \"-C\",\n              \"repo\",\n              \"fetch\",\n              path,\n              \"+refs/heads/*:refs/remotes/origin/*\",\n            ]);\n            await runSandboxCommand(input.sandbox, [\n              \"git\",\n              \"-C\",\n              \"repo\",\n              \"reset\",\n              \"--hard\",\n              \"origin/HEAD\",\n            ]);\n          }\n          if (pullRequestRef !== undefined)\n            await runSandboxCommand(input.sandbox, [\n              \"git\",\n              \"-C\",\n              \"repo\",\n              \"fetch\",\n              path,\n              `+${pullRequestRef}:refs/remotes/origin/pr/${pullRequestNumber}`,\n            ]);\n          if (resume === undefined) return;\n          const exists = await input.sandbox.run({\n            command: [\n              \"git\",\n              \"-C\",\n              \"repo\",\n              \"show-ref\",\n              \"--verify\",\n              \"--quiet\",\n              `refs/remotes/origin/${resume}`,\n            ]\n              .map(quoteShellArgument)\n              .join(\" \"),\n          });\n          if (exists.exitCode !== 0) return;\n          await runSandboxCommand(input.sandbox, [\n            \"git\",\n            \"-C\",\n            \"repo\",\n            \"checkout\",\n            \"-B\",\n            resume,\n            `refs/remotes/origin/${resume}`,\n          ]);\n          if (input.rememberPublishedHead === true) {\n            const head = (\n              await runSandboxCommand(input.sandbox, [\"git\", \"-C\", \"repo\", \"rev-parse\", \"HEAD\"])\n            ).trim();\n            await runSandboxCommand(input.sandbox, [\n              \"git\",\n              \"-C\",\n              \"repo\",\n              \"config\",\n              \"factory.publishedHead\",\n              head,\n            ]);\n          }\n        },\n      });\n    },\n  );\n}\n\n/** Sandbox and argument vector for one Git command in a repository checkout. */\nexport interface RunSandboxGitInput {\n  sandbox: SandboxGit;\n  args: readonly string[];\n  repositoryPath?: string;\n}\n\n/** Run a Git argument vector in a sandbox repository and reject nonzero exits. */\nexport function runSandboxGit(input: RunSandboxGitInput): Promise<string> {\n  return runSandboxCommand(input.sandbox, [\n    \"git\",\n    \"-C\",\n    input.repositoryPath ?? \"repo\",\n    ...input.args,\n  ]);\n}\n\n/** Read committed sandbox changes as a bounded GitHub Git Data API tree. */\nexport async function readCommittedGitChange(\n  input: ReadCommittedGitChangeInput,\n): Promise<CommittedGitChange> {\n  const repositorySlug = repositorySlugSchema.parse(input.repositorySlug.toLowerCase());\n  const baseRef = input.baseRef ?? \"origin/HEAD\";\n  if (!isSafeGitRef(baseRef)) {\n    throw new Error(`refusing to read unsafe base ref: ${baseRef}`);\n  }\n  const maxChangedFiles = input.maxChangedFiles ?? 25;\n  const maxFileBytes = input.maxFileBytes ?? 200_000;\n  if (!Number.isSafeInteger(maxChangedFiles) || maxChangedFiles < 1) {\n    throw new Error(\"maxChangedFiles must be a positive integer\");\n  }\n  if (!Number.isSafeInteger(maxFileBytes) || maxFileBytes < 1) {\n    throw new Error(\"maxFileBytes must be a positive integer\");\n  }\n  const origin = (\n    await runSandboxGit({ sandbox: input.sandbox, args: [\"remote\", \"get-url\", \"origin\"] })\n  ).trim();\n  if (origin !== `https://github.com/${repositorySlug}.git`) {\n    throw new Error(`sandbox checkout does not match task repository ${repositorySlug}`);\n  }\n  const head = (\n    await runSandboxGit({ sandbox: input.sandbox, args: [\"rev-parse\", \"HEAD\"] })\n  ).trim();\n  const base = (\n    await runSandboxGit({ sandbox: input.sandbox, args: [\"rev-parse\", baseRef] })\n  ).trim();\n  if (head === base && input.allowEmpty !== true) {\n    throw new Error(\"no local commits to publish; commit your changes in the repo first\");\n  }\n  const commitMessage = (\n    await runSandboxGit({ sandbox: input.sandbox, args: [\"log\", \"-1\", \"--format=%B\", \"HEAD\"] })\n  ).trimEnd();\n  if (commitMessage.length === 0) throw new Error(\"the committed change has no commit message\");\n  if (Buffer.byteLength(commitMessage, \"utf8\") > 65_536) {\n    throw new Error(\"the committed change message exceeds the publication limit\");\n  }\n\n  const nameStatus = (\n    await runSandboxGit({\n      sandbox: input.sandbox,\n      args: [\"diff\", \"--name-status\", base, head],\n    })\n  ).trim();\n  const upserts: string[] = [];\n  const deletions: string[] = [];\n  for (const line of nameStatus.split(\"\\n\").filter(Boolean)) {\n    const fields = line.split(\"\\t\");\n    const status = fields[0] ?? \"\";\n    if (status === \"A\" || status === \"M\" || status === \"T\") {\n      upserts.push(requireSafePath(fields[1]));\n    } else if (status === \"D\") {\n      deletions.push(requireSafePath(fields[1]));\n    } else if (status.startsWith(\"R\") || status.startsWith(\"C\")) {\n      if (status.startsWith(\"R\")) deletions.push(requireSafePath(fields[1]));\n      upserts.push(requireSafePath(fields[2]));\n    } else {\n      throw new Error(`unsupported change status \"${status}\" in ${line}`);\n    }\n  }\n  const changedFiles = upserts.length + deletions.length;\n  if (changedFiles === 0 && input.allowEmpty !== true) {\n    throw new Error(\"the local commits contain no file changes\");\n  }\n  if (changedFiles > maxChangedFiles) {\n    throw new Error(`too many changed files (${changedFiles} > ${maxChangedFiles})`);\n  }\n\n  const tree: GitHubTreeEntry[] = [];\n  for (const path of upserts) {\n    const mode = (\n      await runSandboxGit({\n        sandbox: input.sandbox,\n        args: [\"ls-tree\", head, \"--\", path],\n      })\n    )\n      .trim()\n      .split(\" \")[0];\n    if (mode === undefined || !allowedModes.has(mode)) {\n      throw new Error(`unsupported file mode ${mode || \"(none)\"} for ${path}`);\n    }\n    const content = await runSandboxGit({\n      sandbox: input.sandbox,\n      args: [\"show\", `${head}:${path}`],\n    });\n    if (Buffer.byteLength(content, \"utf8\") > maxFileBytes) {\n      throw new Error(`${path} exceeds the ${maxFileBytes} byte publication limit`);\n    }\n    tree.push({ path, mode: mode as \"100644\" | \"100755\", type: \"blob\", content });\n  }\n  for (const path of deletions) {\n    tree.push({ path, mode: \"100644\", type: \"blob\", sha: null });\n  }\n  return { base, commitMessage, tree, changedFiles };\n}\n\nfunction requireSafePath(path: string | undefined): string {\n  if (path === undefined || path === \"\" || !safePathPattern.test(path) || path.includes(\"..\")) {\n    throw new Error(`refusing to publish unsafe path: ${path ?? \"(missing)\"}`);\n  }\n  return path;\n}\n"],"mappings":";;;;;;AAqJA,IAAa,4BAAb,cAA+C,MAAM;CAExC;CADX,YACE,QACA,SACA;EACA,MAAM,8BAA8B,OAAO,KAAK,SAAS;EAHhD,KAAA,SAAA;EAIT,KAAK,OAAO;CACd;AACF;;AAgEA,IAAa,8BAAb,cAAiD,MAAM;CAE1C;CACA;CAFX,YACE,gBACA,gBACA;EACA,MAAM,oBAAoB,eAAe,kBAAkB,gBAAgB;EAHlE,KAAA,iBAAA;EACA,KAAA,iBAAA;EAGT,KAAK,OAAO;CACd;AACF;AAEA,MAAM,kBAAkB;AACxB,MAAM,iBAAiB;AACvB,MAAM,+BAAe,IAAI,IAAI,CAAC,UAAU,QAAQ,CAAC;AACjD,MAAM,eAAe;AAErB,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAClC,MAAM,oBAAoB,EAAE,OAAO;CACjC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,UAAU,EAAE,IAAI;CAChB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,OAAO,EAAE,OAAO;CAChB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;CAChC,OAAO,EAAE,QAAQ;CACjB,MAAM,EAAE,OAAO;EACb,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACrB,KAAK;EACL,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;CAC5D,CAAC;AACH,CAAC;;AAGD,SAAgB,8BACd,SACyB;CACzB,MAAM,aAAa,qBAAqB,MAAM,QAAQ,WAAW,YAAY,CAAC;CAC9E,MAAM,UAAU,OAAO,MAAc,OAAoB,CAAC,MAAwB;EAChF,IAAI;EACJ,IAAI;GACF,WAAW,OAAO,QAAQ,SAAS,WAAW,MAAA,CAC5C,GAAG,aAAa,SAAS,aAAa,QACtC;IACE,GAAG;IACH,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ;KACjC,gBAAgB;KAChB,wBAAwB;KACxB,GAAG,KAAK;IACV;GACF,CACF;EACF,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,6BAA6B,EAAE,OAAO,MAAM,CAAC;EAC/D;EACA,MAAM,OAAgB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;EAC5D,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI;GAC/D,MAAM,IAAI,0BACR,SAAS,QACT,OAAO,UAAU,OAAO,KAAK,UAAU,SAAS,UAClD;EACF;EACA,OAAO;CACT;CACA,MAAM,UAAU,OAAO,OAAe,cAAsD;EAC1F,IAAI;EACJ,IAAI;GACF,WAAW,OAAO,QAAQ,SAAS,WAAW,MAAA,CAAO,GAAG,aAAa,WAAW;IAC9E,QAAQ;IACR,SAAS;KACP,QAAQ;KACR,eAAe,UAAU,QAAQ;KACjC,gBAAgB;KAChB,wBAAwB;IAC1B;IACA,MAAM,KAAK,UAAU;KAAE;KAAO;IAAU,CAAC;GAC3C,CAAC;EACH,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,iCAAiC,EAAE,OAAO,MAAM,CAAC;EACnE;EACA,MAAM,OAAgB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;EAC5D,MAAM,SAAS,EACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CACzE,UAAU,IAAI;EACjB,IAAI,CAAC,SAAS,MAAO,OAAO,WAAW,OAAO,KAAK,QAAQ,QACzD,MAAM,IAAI,0BACR,SAAS,QACT,OAAO,WAAW,OAAO,KAAK,SAAS,OAAO,KAAA,IAC1C,OAAO,KAAK,OAAO,EAAE,CAAC,UACtB,SAAS,UACf;CAEJ;CACA,MAAM,oBAAoB,UAAiD;EACzE,MAAM,OAAO,kBAAkB,MAAM,KAAK;EAC1C,OAAO;GACL,mBAAmB,KAAK;GACxB,gBAAgB,KAAK;GACrB,QAAQ,KAAK;GACb,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,OAAO,KAAK;GACZ,OAAO,KAAK;GACZ,MAAM;IACJ,QAAQ,KAAK,KAAK;IAClB,KAAK,KAAK,KAAK;IACf,YACE,KAAK,KAAK,SAAS,OACf,OACA,qBAAqB,MAAM,KAAK,KAAK,KAAK,UAAU,YAAY,CAAC;GACzE;EACF;CACF;CACA,MAAM,cAAc,WAA2B;EAC7C,IAAI,CAAC,aAAa,MAAM,GAAG,MAAM,IAAI,MAAM,uCAAuC,QAAQ;EAC1F,OAAO;CACT;CAEA,OAAO;EACL,MAAM,OAAO,OAAO;GAClB,MAAM,SAAS,EACZ,OAAO;IACN,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC;IACjC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC;GAC/C,CAAC,CAAC,CACD,MAAM,MAAM,QAAQ,gBAAgB,mBAAmB,MAAM,GAAG,GAAG,CAAC;GACvE,OAAO;IAAE,SAAS,OAAO,KAAK;IAAK,YAAY,OAAO,QAAQ,KAAK,WAAW,OAAO,GAAG;GAAE;EAC5F;EACA,MAAM,WAAW,OAAO;GACtB,IAAI;IAIF,OAHY,EACT,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC,CAChD,MAAM,MAAM,QAAQ,kBAAkB,WAAW,MAAM,MAAM,GAAG,CAC1D,CAAC,CAAC,OAAO;GACpB,SAAS,OAAO;IACd,IAAI,iBAAiB,6BAA6B,MAAM,WAAW,KAAK,OAAO;IAC/E,MAAM;GACR;EACF;EACA,MAAM,WAAW,OAAO;GACtB,OAAO,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,MAClC,MAAM,QAAQ,cAAc;IAC1B,QAAQ;IACR,MAAM,KAAK,UAAU;KAAE,WAAW,MAAM;KAAa,MAAM,MAAM;IAAQ,CAAC;GAC5E,CAAC,CACH,CAAC,CAAC;EACJ;EACA,MAAM,aAAa,OAAO;GACxB,OAAO,EAAE,OAAO,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,MAClC,MAAM,QAAQ,gBAAgB;IAC5B,QAAQ;IACR,MAAM,KAAK,UAAU;KACnB,SAAS,MAAM;KACf,MAAM,MAAM;KACZ,SAAS,MAAM;IACjB,CAAC;GACH,CAAC,CACH,CAAC,CAAC;EACJ;EACA,MAAM,aAAa,OAAO;GACxB,MAAM,QAAQ,aAAa;IACzB,QAAQ;IACR,MAAM,KAAK,UAAU;KACnB,KAAK,cAAc,WAAW,MAAM,MAAM;KAC1C,KAAK,MAAM;IACb,CAAC;GACH,CAAC;EACH;EACA,MAAM,aAAa,OAAO;GACxB,MAAM,QAAQ,mBAAmB,WAAW,MAAM,MAAM,KAAK;IAC3D,QAAQ;IACR,MAAM,KAAK,UAAU;KAAE,KAAK,MAAM;KAAK,OAAO,MAAM;IAAM,CAAC;GAC7D,CAAC;EACH;EACA,MAAM,kBAAkB,OAAO;GAC7B,MAAM,OAAO,EACV,OAAO;IACN,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;IAClC,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE,QAAQ;GACnB,CAAC,CAAC,CACD,MACC,MAAM,QAAQ,UAAU;IACtB,QAAQ;IACR,MAAM,KAAK,UAAU,KAAK;GAC5B,CAAC,CACH;GACF,OAAO;IACL,mBAAmB,KAAK;IACxB,gBAAgB,KAAK;IACrB,OAAO,KAAK;GACd;EACF;EACA,MAAM,YAAY,OAAO;GACvB,OAAO,iBAAiB,MAAM,QAAQ,UAAU,MAAM,mBAAmB,CAAC;EAC5E;EACA,MAAM,aAAa,OAAO;GACxB,MAAM,QAAQ,IAAI,gBAAgB;IAAE,OAAO,MAAM;IAAO,UAAU;GAAM,CAAC;GACzE,IAAI,MAAM,SAAS,KAAA,GAAW,MAAM,IAAI,QAAQ,MAAM,IAAI;GAC1D,OAAO,EACJ,MAAM,iBAAiB,CAAC,CACxB,MAAM,MAAM,QAAQ,UAAU,MAAM,SAAS,GAAG,CAAC,CAAC,CAClD,IAAI,gBAAgB;EACzB;EACA,MAAM,UAAU,OAAO;GACrB,MAAM,QACJ,4GACA,EAAE,IAAI,MAAM,OAAO,CACrB;EACF;CACF;AACF;;AAGA,SAAgB,kBAAkB,QAAwB;CACxD,OAAO,WAAW;AACpB;;AAGA,SAAgB,qBAAqB,WAAmC;CACtE,OAAO,WAAW,qBAAqB,MAAM,SAAS;AACxD;;AAGA,SAAgB,aAAa,KAAsB;CACjD,OAAO,eAAe,KAAK,GAAG,KAAK,CAAC,IAAI,SAAS,IAAI;AACvD;;AAGA,eAAsB,yBACpB,OACe;CACf,MAAM,OAAO,qBAAqB,MAAM,MAAM,eAAe,YAAY,CAAC;CAC1E,MAAM,iBAAiB,sBAAsB,KAAK;CAClD,MAAM,WAAW,MAAM,MAAM,QAAQ,IAAI,EAAE,SAAS,oBAAoB,CAAC;CACzE,MAAM,iBACJ,SAAS,aAAa,KAAA,KAAa,SAAS,aAAa,KAEnD,MAAM,kBAAkB,MAAM,SAAS;EACrC;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,EAAA,CACD,KAAK,IACP;CACN,IAAI,mBAAmB,MAAM,eAAe,YAAY,MAAM,gBAC5D,MAAM,IAAI,4BAA4B,gBAAgB,cAAc;CAGtE,MAAM,SAAS,MAAM;CACrB,IAAI,WAAW,KAAA,KAAa,CAAC,aAAa,MAAM,GAC9C,MAAM,IAAI,MAAM,0CAA0C,QAAQ;CAEpE,MAAM,oBAAoB,MAAM;CAChC,IACE,sBAAsB,KAAA,MACrB,CAAC,OAAO,cAAc,iBAAiB,KAAK,oBAAoB,IAEjE,MAAM,IAAI,MAAM,8CAA8C;CAEhE,MAAM,iBACJ,sBAAsB,KAAA,IAAY,KAAA,IAAY,aAAa,kBAAkB;CAC/E,MAAM,MAAM,UAAU,MACpB;EAAE,YAAY;EAAM,MAAM,mBAAmB,KAAA,IAAY,CAAC,IAAI,CAAC,cAAc;CAAE,GAC/E,OAAO,WAAW;EAChB,MAAM,qBAAqB;GACzB,SAAS,MAAM;GACf;GACA,MAAM,IAAI,MAAM;IACd,IAAI,mBAAmB,IAAI;KACzB,MAAM,kBAAkB,MAAM,SAAS;MAAC;MAAO;MAAS;MAAM;KAAM,CAAC;KACrE,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;KACD,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;KACD,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;IACH,OAAO;KACL,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;KACD,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;IACH;IACA,IAAI,mBAAmB,KAAA,GACrB,MAAM,kBAAkB,MAAM,SAAS;KACrC;KACA;KACA;KACA;KACA;KACA,IAAI,eAAe,0BAA0B;IAC/C,CAAC;IACH,IAAI,WAAW,KAAA,GAAW;IAc1B,KAAI,MAbiB,MAAM,QAAQ,IAAI,EACrC,SAAS;KACP;KACA;KACA;KACA;KACA;KACA;KACA,uBAAuB;IACzB,CAAC,CACE,IAAI,kBAAkB,CAAC,CACvB,KAAK,GAAG,EACb,CAAC,EAAA,CACU,aAAa,GAAG;IAC3B,MAAM,kBAAkB,MAAM,SAAS;KACrC;KACA;KACA;KACA;KACA;KACA;KACA,uBAAuB;IACzB,CAAC;IACD,IAAI,MAAM,0BAA0B,MAAM;KACxC,MAAM,QACJ,MAAM,kBAAkB,MAAM,SAAS;MAAC;MAAO;MAAM;MAAQ;MAAa;KAAM,CAAC,EAAA,CACjF,KAAK;KACP,MAAM,kBAAkB,MAAM,SAAS;MACrC;MACA;MACA;MACA;MACA;MACA;KACF,CAAC;IACH;GACF;EACF,CAAC;CACH,CACF;AACF;;AAUA,SAAgB,cAAc,OAA4C;CACxE,OAAO,kBAAkB,MAAM,SAAS;EACtC;EACA;EACA,MAAM,kBAAkB;EACxB,GAAG,MAAM;CACX,CAAC;AACH;;AAGA,eAAsB,uBACpB,OAC6B;CAC7B,MAAM,iBAAiB,qBAAqB,MAAM,MAAM,eAAe,YAAY,CAAC;CACpF,MAAM,UAAU,MAAM,WAAW;CACjC,IAAI,CAAC,aAAa,OAAO,GACvB,MAAM,IAAI,MAAM,qCAAqC,SAAS;CAEhE,MAAM,kBAAkB,MAAM,mBAAmB;CACjD,MAAM,eAAe,MAAM,gBAAgB;CAC3C,IAAI,CAAC,OAAO,cAAc,eAAe,KAAK,kBAAkB,GAC9D,MAAM,IAAI,MAAM,4CAA4C;CAE9D,IAAI,CAAC,OAAO,cAAc,YAAY,KAAK,eAAe,GACxD,MAAM,IAAI,MAAM,yCAAyC;CAK3D,KAFE,MAAM,cAAc;EAAE,SAAS,MAAM;EAAS,MAAM;GAAC;GAAU;GAAW;EAAQ;CAAE,CAAC,EAAA,CACrF,KACO,MAAM,sBAAsB,eAAe,OAClD,MAAM,IAAI,MAAM,mDAAmD,gBAAgB;CAErF,MAAM,QACJ,MAAM,cAAc;EAAE,SAAS,MAAM;EAAS,MAAM,CAAC,aAAa,MAAM;CAAE,CAAC,EAAA,CAC3E,KAAK;CACP,MAAM,QACJ,MAAM,cAAc;EAAE,SAAS,MAAM;EAAS,MAAM,CAAC,aAAa,OAAO;CAAE,CAAC,EAAA,CAC5E,KAAK;CACP,IAAI,SAAS,QAAQ,MAAM,eAAe,MACxC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,MAAM,iBACJ,MAAM,cAAc;EAAE,SAAS,MAAM;EAAS,MAAM;GAAC;GAAO;GAAM;GAAe;EAAM;CAAE,CAAC,EAAA,CAC1F,QAAQ;CACV,IAAI,cAAc,WAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5F,IAAI,OAAO,WAAW,eAAe,MAAM,IAAI,OAC7C,MAAM,IAAI,MAAM,4DAA4D;CAG9E,MAAM,cACJ,MAAM,cAAc;EAClB,SAAS,MAAM;EACf,MAAM;GAAC;GAAQ;GAAiB;GAAM;EAAI;CAC5C,CAAC,EAAA,CACD,KAAK;CACP,MAAM,UAAoB,CAAC;CAC3B,MAAM,YAAsB,CAAC;CAC7B,KAAK,MAAM,QAAQ,WAAW,MAAM,IAAI,CAAC,CAAC,OAAO,OAAO,GAAG;EACzD,MAAM,SAAS,KAAK,MAAM,GAAI;EAC9B,MAAM,SAAS,OAAO,MAAM;EAC5B,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,KACjD,QAAQ,KAAK,gBAAgB,OAAO,EAAE,CAAC;OAClC,IAAI,WAAW,KACpB,UAAU,KAAK,gBAAgB,OAAO,EAAE,CAAC;OACpC,IAAI,OAAO,WAAW,GAAG,KAAK,OAAO,WAAW,GAAG,GAAG;GAC3D,IAAI,OAAO,WAAW,GAAG,GAAG,UAAU,KAAK,gBAAgB,OAAO,EAAE,CAAC;GACrE,QAAQ,KAAK,gBAAgB,OAAO,EAAE,CAAC;EACzC,OACE,MAAM,IAAI,MAAM,8BAA8B,OAAO,OAAO,MAAM;CAEtE;CACA,MAAM,eAAe,QAAQ,SAAS,UAAU;CAChD,IAAI,iBAAiB,KAAK,MAAM,eAAe,MAC7C,MAAM,IAAI,MAAM,2CAA2C;CAE7D,IAAI,eAAe,iBACjB,MAAM,IAAI,MAAM,2BAA2B,aAAa,KAAK,gBAAgB,EAAE;CAGjF,MAAM,OAA0B,CAAC;CACjC,KAAK,MAAM,QAAQ,SAAS;EAC1B,MAAM,QACJ,MAAM,cAAc;GAClB,SAAS,MAAM;GACf,MAAM;IAAC;IAAW;IAAM;IAAM;GAAI;EACpC,CAAC,EAAA,CAEA,KAAK,CAAC,CACN,MAAM,GAAG,CAAC,CAAC;EACd,IAAI,SAAS,KAAA,KAAa,CAAC,aAAa,IAAI,IAAI,GAC9C,MAAM,IAAI,MAAM,yBAAyB,QAAQ,SAAS,OAAO,MAAM;EAEzE,MAAM,UAAU,MAAM,cAAc;GAClC,SAAS,MAAM;GACf,MAAM,CAAC,QAAQ,GAAG,KAAK,GAAG,MAAM;EAClC,CAAC;EACD,IAAI,OAAO,WAAW,SAAS,MAAM,IAAI,cACvC,MAAM,IAAI,MAAM,GAAG,KAAK,eAAe,aAAa,wBAAwB;EAE9E,KAAK,KAAK;GAAE;GAAY;GAA6B,MAAM;GAAQ;EAAQ,CAAC;CAC9E;CACA,KAAK,MAAM,QAAQ,WACjB,KAAK,KAAK;EAAE;EAAM,MAAM;EAAU,MAAM;EAAQ,KAAK;CAAK,CAAC;CAE7D,OAAO;EAAE;EAAM;EAAe;EAAM;CAAa;AACnD;AAEA,SAAS,gBAAgB,MAAkC;CACzD,IAAI,SAAS,KAAA,KAAa,SAAS,MAAM,CAAC,gBAAgB,KAAK,IAAI,KAAK,KAAK,SAAS,IAAI,GACxF,MAAM,IAAI,MAAM,oCAAoC,QAAQ,aAAa;CAE3E,OAAO;AACT"}

package/dist/schema/factory-config.d.mts

@@ -70,6 +70,7 @@ declare const factoryConfigSchema: z.ZodReadonly<z.ZodObject<{
     connect: "connect";
     vercel: "vercel";
   }>>;
+  enableGitHubPullRequestDiscovery: z.ZodDefault<z.ZodBoolean>;
   sandboxGitHubActAs: z.ZodOptional<z.ZodString>;
   commitIdentity: z.ZodDefault<z.ZodReadonly<z.ZodObject<{
     name: z.ZodString;

package/dist/schema/factory-config.mjs

@@ -53,6 +53,7 @@ const factoryConfigSchema = z.strictObject({
 	repositories: z.array(factoryConfigRepositorySchema).min(1).readonly().describe("Repositories this factory is allowed to inspect and change."),
 	operators: z.array(z.string().min(1)).min(1).readonly().describe("Provider-qualified identities allowed to operate this factory."),
 	sandboxGitHubCredentials: z.enum(["connect", "vercel"]).default("connect").describe("Credential source selected for trusted GitHub Sandbox operations."),
+	enableGitHubPullRequestDiscovery: z.boolean().default(true).describe("Check live GitHub pull requests before admitting repository work."),
 	sandboxGitHubActAs: z.string().regex(/^[1-9][0-9]*$/u).max(16).refine((id) => Number.isSafeInteger(Number(id))).optional().describe("GitHub user ID selected for Vercel-managed GitHub API Sandbox operations."),
 	commitIdentity: commitIdentitySchema.default({
 		name: "Vercel Factory",
@@ -85,6 +86,11 @@ const factoryConfigSchema = z.strictObject({
 		path: ["sandboxGitHubActAs"],
 		message: "A managed GitHub act-as identity requires Vercel-managed Sandbox credentials."
 	});
+	if (!config.enableGitHubPullRequestDiscovery && config.sandboxGitHubCredentials !== "vercel") ctx.addIssue({
+		code: "custom",
+		path: ["enableGitHubPullRequestDiscovery"],
+		message: "Skipping GitHub pull request discovery requires managed GitHub credentials."
+	});
 }).readonly();
 /** Validates a Factory configuration and applies its declared defaults. */
 function defineFactory(config) {

package/dist/schema/factory-config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"factory-config.mjs","names":[],"sources":["../../src/schema/factory-config.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { allowByDefaultApprovalPolicy, approvalPolicySchema } from \"../approval\";\nimport { budgetLimitsSchema } from \"./budget\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./repository\";\nimport { taskKindSchema } from \"./task\";\nimport { slackPrNotificationsSchema } from \"./slack-pr-notifications\";\n\n/** Validates one repository allowlist entry and its configured dependency ordering. */\nexport const factoryConfigRepositorySchema = z\n  .strictObject({\n    slug: repositorySlugSchema.describe(\"Repository this factory may work on.\"),\n    defaultBranch: z\n      .string()\n      .min(1)\n      .default(\"main\")\n      .describe(\"Branch changes land on, usually main.\"),\n    dependsOn: z\n      .array(repositorySlugSchema)\n      .readonly()\n      .default([])\n      .describe(\"Repositories that must land changes before this repository.\"),\n  })\n  .readonly();\n\nconst githubConnectorSchema = z\n  .strictObject({\n    owner: z\n      .string()\n      .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"GitHub user or organization that owns this connector installation.\"),\n    connector: z\n      .string()\n      .regex(/^github\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this GitHub owner.\"),\n  })\n  .readonly();\n\nconst slackConnectorSchema = z\n  .strictObject({\n    connector: z\n      .string()\n      .regex(/^slack\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this Slack app.\"),\n    operatorDirectMessages: z\n      .boolean()\n      .default(false)\n      .describe(\n        \"Opt in to operator DMs for human-action requests, digests, and budget alerts. Independent of operator authorization, PR announcements, and replies in the original conversation.\",\n      ),\n    approvalChannel: z\n      .string()\n      .regex(/^[CDG][A-Z0-9]+$/u)\n      .optional()\n      .describe(\n        \"Explicit Slack channel for approval proposals that have no originating Slack thread. Absent disables cross-channel approval notifications.\",\n      ),\n    autonomousPullRequests: slackPrNotificationsSchema\n      .optional()\n      .describe(\n        \"Channel announcements for every Factory-produced PR, including human-requested work, in addition to the original conversation reply. Saved Slack settings override this default; resetting restores it. Absent disables announcements unless Slack enables them.\",\n      ),\n    autonomousPullRequestsByRepository: z\n      .record(repositorySlugSchema, slackPrNotificationsSchema.nullable())\n      .readonly()\n      .optional()\n      .describe(\n        \"Repository-specific PR destinations, taking precedence over the factory-wide default. Null disables announcements for that repository. Saved repository settings override these entries.\",\n      ),\n  })\n  .readonly();\n\nfunction isSupportedCommitIdentityValue(value: string, maxBytes: number): boolean {\n  return (\n    value.trim() === value &&\n    !/[\\0\\r\\n<>]/u.test(value) &&\n    new TextEncoder().encode(value).byteLength <= maxBytes\n  );\n}\n\nconst commitIdentitySchema = z\n  .strictObject({\n    name: z\n      .string()\n      .min(1)\n      .refine((value) => isSupportedCommitIdentityValue(value, 256))\n      .describe(\"Name recorded on Factory-authored commits.\"),\n    email: z\n      .string()\n      .email()\n      .refine((value) => isSupportedCommitIdentityValue(value, 320))\n      .describe(\"Email recorded on Factory-authored commits.\"),\n  })\n  .readonly();\n\n/** Validates stall detection and replacement-attempt limits for running Tasks. */\nexport const executionPolicySchema = z\n  .strictObject({\n    maxAttempts: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Attempts a task may consume before a stall fails it for good.\"),\n    stallMinutes: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Minutes without progress before a running task is marked stalled.\"),\n    stallMinutesByKind: z\n      .partialRecord(taskKindSchema, z.number().int().min(1))\n      .readonly()\n      .default({})\n      .describe(\"Per-kind stall windows for long single-step work, e.g. security_scan: 300.\"),\n  })\n  .readonly();\n\n/** Stall detection and retry limits applied to running Tasks. */\nexport type ExecutionPolicy = z.infer<typeof executionPolicySchema>;\n\n/** Conservative default stall window and three-attempt execution policy. */\nexport const defaultExecutionPolicy = executionPolicySchema.parse({\n  maxAttempts: 3,\n  stallMinutes: 45,\n  stallMinutesByKind: {},\n});\n\n/** Validates the repositories, operators, connectors, budget, and policies of a Factory. */\nexport const factoryConfigSchema = z\n  .strictObject({\n    connectors: z\n      .strictObject({\n        github: z\n          .array(githubConnectorSchema)\n          .readonly()\n          .refine(\n            (connectors) =>\n              new Set(connectors.map(({ owner }) => owner)).size === connectors.length,\n            \"GitHub connector owners must be unique.\",\n          ),\n        slack: z\n          .array(slackConnectorSchema)\n          .max(1, \"A factory may configure one Slack connector.\")\n          .readonly()\n          .default([]),\n      })\n      .readonly()\n      .default({ github: [], slack: [] })\n      .describe(\"Provider connections available to this factory.\"),\n    repositories: z\n      .array(factoryConfigRepositorySchema)\n      .min(1)\n      .readonly()\n      .describe(\"Repositories this factory is allowed to inspect and change.\"),\n    operators: z\n      .array(z.string().min(1))\n      .min(1)\n      .readonly()\n      .describe(\"Provider-qualified identities allowed to operate this factory.\"),\n    sandboxGitHubCredentials: z\n      .enum([\"connect\", \"vercel\"])\n      .default(\"connect\")\n      .describe(\"Credential source selected for trusted GitHub Sandbox operations.\"),\n    sandboxGitHubActAs: z\n      .string()\n      .regex(/^[1-9][0-9]*$/u)\n      .max(16)\n      .refine((id) => Number.isSafeInteger(Number(id)))\n      .optional()\n      .describe(\"GitHub user ID selected for Vercel-managed GitHub API Sandbox operations.\"),\n    commitIdentity: commitIdentitySchema\n      .default({ name: \"Vercel Factory\", email: \"not+real@example.org\" })\n      .describe(\"Replaceable attribution metadata for Factory-authored commits.\"),\n    approval: approvalPolicySchema\n      .default(allowByDefaultApprovalPolicy)\n      .describe(\"Which Tasks wait for a human before they run. First match wins.\"),\n    budget: budgetLimitsSchema\n      .default({\n        totalUsd: 500,\n        investigationUsd: 100,\n        perTaskReservationUsd: 5,\n        warningPercent: 80,\n      })\n      .describe(\"Monthly spending thresholds and per-task accounting reservations.\"),\n    enforceBudget: z\n      .boolean()\n      .default(true)\n      .describe(\n        \"Refuse new work above the monthly budget. False keeps cost accounting without spending limits or budget alerts.\",\n      ),\n    execution: executionPolicySchema\n      .default(defaultExecutionPolicy)\n      .describe(\"Stall detection and retry limits for running tasks.\"),\n  })\n  .superRefine((config, ctx) => {\n    const repositories = new Set<string>(config.repositories.map(({ slug }) => slug));\n    for (const [index, connector] of config.connectors.slack.entries()) {\n      for (const slug of Object.keys(connector.autonomousPullRequestsByRepository ?? {})) {\n        if (!repositories.has(slug))\n          ctx.addIssue({\n            code: \"custom\",\n            path: [\"connectors\", \"slack\", index, \"autonomousPullRequestsByRepository\", slug],\n            message: \"PR notification destinations must name a configured repository.\",\n          });\n      }\n    }\n    if (config.sandboxGitHubActAs !== undefined && config.sandboxGitHubCredentials !== \"vercel\") {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"sandboxGitHubActAs\"],\n        message: \"A managed GitHub act-as identity requires Vercel-managed Sandbox credentials.\",\n      });\n    }\n  })\n  .readonly();\n\n/** Fully resolved repository allowlist entry in a Factory configuration. */\nexport type FactoryConfigRepository = z.infer<typeof factoryConfigRepositorySchema>;\n\n/** Fully resolved and validated Factory configuration. */\nexport type FactoryConfig = z.infer<typeof factoryConfigSchema>;\ntype FactoryConfigSchemaInput = z.input<typeof factoryConfigSchema>;\ntype FactoryConfigConnectorsInput = Readonly<{\n  github: readonly Readonly<z.input<typeof githubConnectorSchema>>[];\n  slack?: readonly Readonly<z.input<typeof slackConnectorSchema>>[];\n}>;\n/** Repository allowlist entry accepted when defining a Factory, before defaults are applied. */\nexport type FactoryConfigRepositoryInput = Readonly<{\n  slug: RepositorySlug;\n  defaultBranch?: string;\n  dependsOn?: readonly RepositorySlug[];\n}>;\n/** Caller input accepted when defining a Factory, before schema defaults are applied. */\nexport type FactoryConfigInput = Readonly<\n  Omit<FactoryConfigSchemaInput, \"connectors\" | \"repositories\" | \"operators\"> & {\n    connectors?: FactoryConfigConnectorsInput;\n    repositories: readonly FactoryConfigRepositoryInput[];\n    operators: readonly string[];\n  }\n>;\n\n/** Validates a Factory configuration and applies its declared defaults. */\nexport function defineFactory(config: FactoryConfigInput): FactoryConfig {\n  return factoryConfigSchema.parse(config);\n}\n"],"mappings":";;;;;;;;AAQA,MAAa,gCAAgC,EAC1C,aAAa;CACZ,MAAM,qBAAqB,SAAS,sCAAsC;CAC1E,eAAe,EACZ,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,MAAM,CAAC,CACf,SAAS,uCAAuC;CACnD,WAAW,EACR,MAAM,oBAAoB,CAAC,CAC3B,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,6DAA6D;AAC3E,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,wBAAwB,EAC3B,aAAa;CACZ,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,mCAAmC,CAAC,CAC1C,SAAS,oEAAoE;CAChF,WAAW,EACR,OAAO,CAAC,CACR,MAAM,2CAA2C,CAAC,CAClD,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,uBAAuB,EAC1B,aAAa;CACZ,WAAW,EACR,OAAO,CAAC,CACR,MAAM,0CAA0C,CAAC,CACjD,SAAS,kDAAkD;CAC9D,wBAAwB,EACrB,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,kLACF;CACF,iBAAiB,EACd,OAAO,CAAC,CACR,MAAM,mBAAmB,CAAC,CAC1B,SAAS,CAAC,CACV,SACC,4IACF;CACF,wBAAwB,2BACrB,SAAS,CAAC,CACV,SACC,kQACF;CACF,oCAAoC,EACjC,OAAO,sBAAsB,2BAA2B,SAAS,CAAC,CAAC,CACnE,SAAS,CAAC,CACV,SAAS,CAAC,CACV,SACC,0LACF;AACJ,CAAC,CAAC,CACD,SAAS;AAEZ,SAAS,+BAA+B,OAAe,UAA2B;CAChF,OACE,MAAM,KAAK,MAAM,SACjB,CAAC,cAAc,KAAK,KAAK,KACzB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,cAAc;AAElD;AAEA,MAAM,uBAAuB,EAC1B,aAAa;CACZ,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,UAAU,+BAA+B,OAAO,GAAG,CAAC,CAAC,CAC7D,SAAS,4CAA4C;CACxD,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,CAAC,CACP,QAAQ,UAAU,+BAA+B,OAAO,GAAG,CAAC,CAAC,CAC7D,SAAS,6CAA6C;AAC3D,CAAC,CAAC,CACD,SAAS;;AAGZ,MAAa,wBAAwB,EAClC,aAAa;CACZ,aAAa,EACV,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,+DAA+D;CAC3E,cAAc,EACX,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,mEAAmE;CAC/E,oBAAoB,EACjB,cAAc,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,4EAA4E;AAC1F,CAAC,CAAC,CACD,SAAS;;AAMZ,MAAa,yBAAyB,sBAAsB,MAAM;CAChE,aAAa;CACb,cAAc;CACd,oBAAoB,CAAC;AACvB,CAAC;;AAGD,MAAa,sBAAsB,EAChC,aAAa;CACZ,YAAY,EACT,aAAa;EACZ,QAAQ,EACL,MAAM,qBAAqB,CAAC,CAC5B,SAAS,CAAC,CACV,QACE,eACC,IAAI,IAAI,WAAW,KAAK,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW,QACpE,yCACF;EACF,OAAO,EACJ,MAAM,oBAAoB,CAAC,CAC3B,IAAI,GAAG,8CAA8C,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC;CACf,CAAC,CAAC,CACD,SAAS,CAAC,CACV,QAAQ;EAAE,QAAQ,CAAC;EAAG,OAAO,CAAC;CAAE,CAAC,CAAC,CAClC,SAAS,iDAAiD;CAC7D,cAAc,EACX,MAAM,6BAA6B,CAAC,CACpC,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,6DAA6D;CACzE,WAAW,EACR,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACxB,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,gEAAgE;CAC5E,0BAA0B,EACvB,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,CAC3B,QAAQ,SAAS,CAAC,CAClB,SAAS,mEAAmE;CAC/E,oBAAoB,EACjB,OAAO,CAAC,CACR,MAAM,gBAAgB,CAAC,CACvB,IAAI,EAAE,CAAC,CACP,QAAQ,OAAO,OAAO,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,CAChD,SAAS,CAAC,CACV,SAAS,2EAA2E;CACvF,gBAAgB,qBACb,QAAQ;EAAE,MAAM;EAAkB,OAAO;CAAuB,CAAC,CAAC,CAClE,SAAS,gEAAgE;CAC5E,UAAU,qBACP,QAAQ,4BAA4B,CAAC,CACrC,SAAS,iEAAiE;CAC7E,QAAQ,mBACL,QAAQ;EACP,UAAU;EACV,kBAAkB;EAClB,uBAAuB;EACvB,gBAAgB;CAClB,CAAC,CAAC,CACD,SAAS,mEAAmE;CAC/E,eAAe,EACZ,QAAQ,CAAC,CACT,QAAQ,IAAI,CAAC,CACb,SACC,iHACF;CACF,WAAW,sBACR,QAAQ,sBAAsB,CAAC,CAC/B,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,aAAa,QAAQ,QAAQ;CAC5B,MAAM,eAAe,IAAI,IAAY,OAAO,aAAa,KAAK,EAAE,WAAW,IAAI,CAAC;CAChF,KAAK,MAAM,CAAC,OAAO,cAAc,OAAO,WAAW,MAAM,QAAQ,GAC/D,KAAK,MAAM,QAAQ,OAAO,KAAK,UAAU,sCAAsC,CAAC,CAAC,GAC/E,IAAI,CAAC,aAAa,IAAI,IAAI,GACxB,IAAI,SAAS;EACX,MAAM;EACN,MAAM;GAAC;GAAc;GAAS;GAAO;GAAsC;EAAI;EAC/E,SAAS;CACX,CAAC;CAGP,IAAI,OAAO,uBAAuB,KAAA,KAAa,OAAO,6BAA6B,UACjF,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,oBAAoB;EAC3B,SAAS;CACX,CAAC;AAEL,CAAC,CAAC,CACD,SAAS;;AA4BZ,SAAgB,cAAc,QAA2C;CACvE,OAAO,oBAAoB,MAAM,MAAM;AACzC"}
+{"version":3,"file":"factory-config.mjs","names":[],"sources":["../../src/schema/factory-config.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { allowByDefaultApprovalPolicy, approvalPolicySchema } from \"../approval\";\nimport { budgetLimitsSchema } from \"./budget\";\nimport { repositorySlugSchema, type RepositorySlug } from \"./repository\";\nimport { taskKindSchema } from \"./task\";\nimport { slackPrNotificationsSchema } from \"./slack-pr-notifications\";\n\n/** Validates one repository allowlist entry and its configured dependency ordering. */\nexport const factoryConfigRepositorySchema = z\n  .strictObject({\n    slug: repositorySlugSchema.describe(\"Repository this factory may work on.\"),\n    defaultBranch: z\n      .string()\n      .min(1)\n      .default(\"main\")\n      .describe(\"Branch changes land on, usually main.\"),\n    dependsOn: z\n      .array(repositorySlugSchema)\n      .readonly()\n      .default([])\n      .describe(\"Repositories that must land changes before this repository.\"),\n  })\n  .readonly();\n\nconst githubConnectorSchema = z\n  .strictObject({\n    owner: z\n      .string()\n      .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"GitHub user or organization that owns this connector installation.\"),\n    connector: z\n      .string()\n      .regex(/^github\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this GitHub owner.\"),\n  })\n  .readonly();\n\nconst slackConnectorSchema = z\n  .strictObject({\n    connector: z\n      .string()\n      .regex(/^slack\\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/)\n      .describe(\"Vercel Connect UID installed for this Slack app.\"),\n    operatorDirectMessages: z\n      .boolean()\n      .default(false)\n      .describe(\n        \"Opt in to operator DMs for human-action requests, digests, and budget alerts. Independent of operator authorization, PR announcements, and replies in the original conversation.\",\n      ),\n    approvalChannel: z\n      .string()\n      .regex(/^[CDG][A-Z0-9]+$/u)\n      .optional()\n      .describe(\n        \"Explicit Slack channel for approval proposals that have no originating Slack thread. Absent disables cross-channel approval notifications.\",\n      ),\n    autonomousPullRequests: slackPrNotificationsSchema\n      .optional()\n      .describe(\n        \"Channel announcements for every Factory-produced PR, including human-requested work, in addition to the original conversation reply. Saved Slack settings override this default; resetting restores it. Absent disables announcements unless Slack enables them.\",\n      ),\n    autonomousPullRequestsByRepository: z\n      .record(repositorySlugSchema, slackPrNotificationsSchema.nullable())\n      .readonly()\n      .optional()\n      .describe(\n        \"Repository-specific PR destinations, taking precedence over the factory-wide default. Null disables announcements for that repository. Saved repository settings override these entries.\",\n      ),\n  })\n  .readonly();\n\nfunction isSupportedCommitIdentityValue(value: string, maxBytes: number): boolean {\n  return (\n    value.trim() === value &&\n    !/[\\0\\r\\n<>]/u.test(value) &&\n    new TextEncoder().encode(value).byteLength <= maxBytes\n  );\n}\n\nconst commitIdentitySchema = z\n  .strictObject({\n    name: z\n      .string()\n      .min(1)\n      .refine((value) => isSupportedCommitIdentityValue(value, 256))\n      .describe(\"Name recorded on Factory-authored commits.\"),\n    email: z\n      .string()\n      .email()\n      .refine((value) => isSupportedCommitIdentityValue(value, 320))\n      .describe(\"Email recorded on Factory-authored commits.\"),\n  })\n  .readonly();\n\n/** Validates stall detection and replacement-attempt limits for running Tasks. */\nexport const executionPolicySchema = z\n  .strictObject({\n    maxAttempts: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Attempts a task may consume before a stall fails it for good.\"),\n    stallMinutes: z\n      .number()\n      .int()\n      .min(1)\n      .describe(\"Minutes without progress before a running task is marked stalled.\"),\n    stallMinutesByKind: z\n      .partialRecord(taskKindSchema, z.number().int().min(1))\n      .readonly()\n      .default({})\n      .describe(\"Per-kind stall windows for long single-step work, e.g. security_scan: 300.\"),\n  })\n  .readonly();\n\n/** Stall detection and retry limits applied to running Tasks. */\nexport type ExecutionPolicy = z.infer<typeof executionPolicySchema>;\n\n/** Conservative default stall window and three-attempt execution policy. */\nexport const defaultExecutionPolicy = executionPolicySchema.parse({\n  maxAttempts: 3,\n  stallMinutes: 45,\n  stallMinutesByKind: {},\n});\n\n/** Validates the repositories, operators, connectors, budget, and policies of a Factory. */\nexport const factoryConfigSchema = z\n  .strictObject({\n    connectors: z\n      .strictObject({\n        github: z\n          .array(githubConnectorSchema)\n          .readonly()\n          .refine(\n            (connectors) =>\n              new Set(connectors.map(({ owner }) => owner)).size === connectors.length,\n            \"GitHub connector owners must be unique.\",\n          ),\n        slack: z\n          .array(slackConnectorSchema)\n          .max(1, \"A factory may configure one Slack connector.\")\n          .readonly()\n          .default([]),\n      })\n      .readonly()\n      .default({ github: [], slack: [] })\n      .describe(\"Provider connections available to this factory.\"),\n    repositories: z\n      .array(factoryConfigRepositorySchema)\n      .min(1)\n      .readonly()\n      .describe(\"Repositories this factory is allowed to inspect and change.\"),\n    operators: z\n      .array(z.string().min(1))\n      .min(1)\n      .readonly()\n      .describe(\"Provider-qualified identities allowed to operate this factory.\"),\n    sandboxGitHubCredentials: z\n      .enum([\"connect\", \"vercel\"])\n      .default(\"connect\")\n      .describe(\"Credential source selected for trusted GitHub Sandbox operations.\"),\n    enableGitHubPullRequestDiscovery: z\n      .boolean()\n      .default(true)\n      .describe(\"Check live GitHub pull requests before admitting repository work.\"),\n    sandboxGitHubActAs: z\n      .string()\n      .regex(/^[1-9][0-9]*$/u)\n      .max(16)\n      .refine((id) => Number.isSafeInteger(Number(id)))\n      .optional()\n      .describe(\"GitHub user ID selected for Vercel-managed GitHub API Sandbox operations.\"),\n    commitIdentity: commitIdentitySchema\n      .default({ name: \"Vercel Factory\", email: \"not+real@example.org\" })\n      .describe(\"Replaceable attribution metadata for Factory-authored commits.\"),\n    approval: approvalPolicySchema\n      .default(allowByDefaultApprovalPolicy)\n      .describe(\"Which Tasks wait for a human before they run. First match wins.\"),\n    budget: budgetLimitsSchema\n      .default({\n        totalUsd: 500,\n        investigationUsd: 100,\n        perTaskReservationUsd: 5,\n        warningPercent: 80,\n      })\n      .describe(\"Monthly spending thresholds and per-task accounting reservations.\"),\n    enforceBudget: z\n      .boolean()\n      .default(true)\n      .describe(\n        \"Refuse new work above the monthly budget. False keeps cost accounting without spending limits or budget alerts.\",\n      ),\n    execution: executionPolicySchema\n      .default(defaultExecutionPolicy)\n      .describe(\"Stall detection and retry limits for running tasks.\"),\n  })\n  .superRefine((config, ctx) => {\n    const repositories = new Set<string>(config.repositories.map(({ slug }) => slug));\n    for (const [index, connector] of config.connectors.slack.entries()) {\n      for (const slug of Object.keys(connector.autonomousPullRequestsByRepository ?? {})) {\n        if (!repositories.has(slug))\n          ctx.addIssue({\n            code: \"custom\",\n            path: [\"connectors\", \"slack\", index, \"autonomousPullRequestsByRepository\", slug],\n            message: \"PR notification destinations must name a configured repository.\",\n          });\n      }\n    }\n    if (config.sandboxGitHubActAs !== undefined && config.sandboxGitHubCredentials !== \"vercel\") {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"sandboxGitHubActAs\"],\n        message: \"A managed GitHub act-as identity requires Vercel-managed Sandbox credentials.\",\n      });\n    }\n    if (!config.enableGitHubPullRequestDiscovery && config.sandboxGitHubCredentials !== \"vercel\") {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"enableGitHubPullRequestDiscovery\"],\n        message: \"Skipping GitHub pull request discovery requires managed GitHub credentials.\",\n      });\n    }\n  })\n  .readonly();\n\n/** Fully resolved repository allowlist entry in a Factory configuration. */\nexport type FactoryConfigRepository = z.infer<typeof factoryConfigRepositorySchema>;\n\n/** Fully resolved and validated Factory configuration. */\nexport type FactoryConfig = z.infer<typeof factoryConfigSchema>;\ntype FactoryConfigSchemaInput = z.input<typeof factoryConfigSchema>;\ntype FactoryConfigConnectorsInput = Readonly<{\n  github: readonly Readonly<z.input<typeof githubConnectorSchema>>[];\n  slack?: readonly Readonly<z.input<typeof slackConnectorSchema>>[];\n}>;\n/** Repository allowlist entry accepted when defining a Factory, before defaults are applied. */\nexport type FactoryConfigRepositoryInput = Readonly<{\n  slug: RepositorySlug;\n  defaultBranch?: string;\n  dependsOn?: readonly RepositorySlug[];\n}>;\n/** Caller input accepted when defining a Factory, before schema defaults are applied. */\nexport type FactoryConfigInput = Readonly<\n  Omit<FactoryConfigSchemaInput, \"connectors\" | \"repositories\" | \"operators\"> & {\n    connectors?: FactoryConfigConnectorsInput;\n    repositories: readonly FactoryConfigRepositoryInput[];\n    operators: readonly string[];\n  }\n>;\n\n/** Validates a Factory configuration and applies its declared defaults. */\nexport function defineFactory(config: FactoryConfigInput): FactoryConfig {\n  return factoryConfigSchema.parse(config);\n}\n"],"mappings":";;;;;;;;AAQA,MAAa,gCAAgC,EAC1C,aAAa;CACZ,MAAM,qBAAqB,SAAS,sCAAsC;CAC1E,eAAe,EACZ,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,MAAM,CAAC,CACf,SAAS,uCAAuC;CACnD,WAAW,EACR,MAAM,oBAAoB,CAAC,CAC3B,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,6DAA6D;AAC3E,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,wBAAwB,EAC3B,aAAa;CACZ,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,mCAAmC,CAAC,CAC1C,SAAS,oEAAoE;CAChF,WAAW,EACR,OAAO,CAAC,CACR,MAAM,2CAA2C,CAAC,CAClD,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,SAAS;AAEZ,MAAM,uBAAuB,EAC1B,aAAa;CACZ,WAAW,EACR,OAAO,CAAC,CACR,MAAM,0CAA0C,CAAC,CACjD,SAAS,kDAAkD;CAC9D,wBAAwB,EACrB,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,kLACF;CACF,iBAAiB,EACd,OAAO,CAAC,CACR,MAAM,mBAAmB,CAAC,CAC1B,SAAS,CAAC,CACV,SACC,4IACF;CACF,wBAAwB,2BACrB,SAAS,CAAC,CACV,SACC,kQACF;CACF,oCAAoC,EACjC,OAAO,sBAAsB,2BAA2B,SAAS,CAAC,CAAC,CACnE,SAAS,CAAC,CACV,SAAS,CAAC,CACV,SACC,0LACF;AACJ,CAAC,CAAC,CACD,SAAS;AAEZ,SAAS,+BAA+B,OAAe,UAA2B;CAChF,OACE,MAAM,KAAK,MAAM,SACjB,CAAC,cAAc,KAAK,KAAK,KACzB,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,cAAc;AAElD;AAEA,MAAM,uBAAuB,EAC1B,aAAa;CACZ,MAAM,EACH,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,QAAQ,UAAU,+BAA+B,OAAO,GAAG,CAAC,CAAC,CAC7D,SAAS,4CAA4C;CACxD,OAAO,EACJ,OAAO,CAAC,CACR,MAAM,CAAC,CACP,QAAQ,UAAU,+BAA+B,OAAO,GAAG,CAAC,CAAC,CAC7D,SAAS,6CAA6C;AAC3D,CAAC,CAAC,CACD,SAAS;;AAGZ,MAAa,wBAAwB,EAClC,aAAa;CACZ,aAAa,EACV,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,+DAA+D;CAC3E,cAAc,EACX,OAAO,CAAC,CACR,IAAI,CAAC,CACL,IAAI,CAAC,CAAC,CACN,SAAS,mEAAmE;CAC/E,oBAAoB,EACjB,cAAc,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC,CAAC,CACX,SAAS,4EAA4E;AAC1F,CAAC,CAAC,CACD,SAAS;;AAMZ,MAAa,yBAAyB,sBAAsB,MAAM;CAChE,aAAa;CACb,cAAc;CACd,oBAAoB,CAAC;AACvB,CAAC;;AAGD,MAAa,sBAAsB,EAChC,aAAa;CACZ,YAAY,EACT,aAAa;EACZ,QAAQ,EACL,MAAM,qBAAqB,CAAC,CAC5B,SAAS,CAAC,CACV,QACE,eACC,IAAI,IAAI,WAAW,KAAK,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,WAAW,QACpE,yCACF;EACF,OAAO,EACJ,MAAM,oBAAoB,CAAC,CAC3B,IAAI,GAAG,8CAA8C,CAAC,CACtD,SAAS,CAAC,CACV,QAAQ,CAAC,CAAC;CACf,CAAC,CAAC,CACD,SAAS,CAAC,CACV,QAAQ;EAAE,QAAQ,CAAC;EAAG,OAAO,CAAC;CAAE,CAAC,CAAC,CAClC,SAAS,iDAAiD;CAC7D,cAAc,EACX,MAAM,6BAA6B,CAAC,CACpC,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,6DAA6D;CACzE,WAAW,EACR,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CACxB,IAAI,CAAC,CAAC,CACN,SAAS,CAAC,CACV,SAAS,gEAAgE;CAC5E,0BAA0B,EACvB,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC,CAC3B,QAAQ,SAAS,CAAC,CAClB,SAAS,mEAAmE;CAC/E,kCAAkC,EAC/B,QAAQ,CAAC,CACT,QAAQ,IAAI,CAAC,CACb,SAAS,mEAAmE;CAC/E,oBAAoB,EACjB,OAAO,CAAC,CACR,MAAM,gBAAgB,CAAC,CACvB,IAAI,EAAE,CAAC,CACP,QAAQ,OAAO,OAAO,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,CAChD,SAAS,CAAC,CACV,SAAS,2EAA2E;CACvF,gBAAgB,qBACb,QAAQ;EAAE,MAAM;EAAkB,OAAO;CAAuB,CAAC,CAAC,CAClE,SAAS,gEAAgE;CAC5E,UAAU,qBACP,QAAQ,4BAA4B,CAAC,CACrC,SAAS,iEAAiE;CAC7E,QAAQ,mBACL,QAAQ;EACP,UAAU;EACV,kBAAkB;EAClB,uBAAuB;EACvB,gBAAgB;CAClB,CAAC,CAAC,CACD,SAAS,mEAAmE;CAC/E,eAAe,EACZ,QAAQ,CAAC,CACT,QAAQ,IAAI,CAAC,CACb,SACC,iHACF;CACF,WAAW,sBACR,QAAQ,sBAAsB,CAAC,CAC/B,SAAS,qDAAqD;AACnE,CAAC,CAAC,CACD,aAAa,QAAQ,QAAQ;CAC5B,MAAM,eAAe,IAAI,IAAY,OAAO,aAAa,KAAK,EAAE,WAAW,IAAI,CAAC;CAChF,KAAK,MAAM,CAAC,OAAO,cAAc,OAAO,WAAW,MAAM,QAAQ,GAC/D,KAAK,MAAM,QAAQ,OAAO,KAAK,UAAU,sCAAsC,CAAC,CAAC,GAC/E,IAAI,CAAC,aAAa,IAAI,IAAI,GACxB,IAAI,SAAS;EACX,MAAM;EACN,MAAM;GAAC;GAAc;GAAS;GAAO;GAAsC;EAAI;EAC/E,SAAS;CACX,CAAC;CAGP,IAAI,OAAO,uBAAuB,KAAA,KAAa,OAAO,6BAA6B,UACjF,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,oBAAoB;EAC3B,SAAS;CACX,CAAC;CAEH,IAAI,CAAC,OAAO,oCAAoC,OAAO,6BAA6B,UAClF,IAAI,SAAS;EACX,MAAM;EACN,MAAM,CAAC,kCAAkC;EACzC,SAAS;CACX,CAAC;AAEL,CAAC,CAAC,CACD,SAAS;;AA4BZ,SAAgB,cAAc,QAA2C;CACvE,OAAO,oBAAoB,MAAM,MAAM;AACzC"}

package/dist/work-triage/find-existing-work.d.mts

@@ -8,6 +8,7 @@ import { OpenPullRequest } from "../pull-requests/contracts.mjs";
 /** Provider-neutral readers used to discover work already in progress. */
 interface ExistingWorkLookupOptions {
   listOpenPullRequests: (repository: RepositorySlug) => Promise<readonly OpenPullRequest[]>;
+  enableGitHubPullRequestDiscovery?: boolean;
 }
 /** Stores, repository identity, and provider lookup used for one existing-work query. */
 interface FindExistingWorkInput extends ExistingWorkLookupOptions {
@@ -21,6 +22,8 @@ type ExistingWorkLookupResult = {
   reason: string;
 } | {
   found: true;
+  githubPullRequestDiscovery: "checked" | "skipped";
+  githubPullRequestDiscoveryWarning?: string;
   openPullRequests: readonly OpenPullRequest[];
   openChanges: readonly Change[];
   activeTasks: readonly Task[];

package/dist/work-triage/find-existing-work.mjs

@@ -14,8 +14,9 @@ async function findExistingWork(input) {
 		reasonCode: "repository_not_found",
 		reason: `repository ${input.repositoryId} does not exist`
 	};
+	const githubPullRequestDiscovery = input.enableGitHubPullRequestDiscovery === false ? "skipped" : "checked";
 	const [openPullRequests, changes, tasks] = await Promise.all([
-		input.listOpenPullRequests(repository.slug),
+		githubPullRequestDiscovery === "skipped" ? Promise.resolve([]) : input.listOpenPullRequests(repository.slug),
 		collectFactoryRecords(input.stores.changes.list, {
 			limit: 100,
 			match: [...openChangeStates].map((state) => ({
@@ -30,6 +31,8 @@ async function findExistingWork(input) {
 	]);
 	return {
 		found: true,
+		githubPullRequestDiscovery,
+		...githubPullRequestDiscovery === "skipped" ? { githubPullRequestDiscoveryWarning: "GitHub pull requests were not checked; duplicate pull requests are possible." } : {},
 		openPullRequests,
 		openChanges: changes.filter((change) => change.repositoryId === input.repositoryId && openChangeStates.has(change.state)),
 		activeTasks: tasks.filter((task) => task.repositoryIds.includes(input.repositoryId) && activeTaskStates.has(task.state))

package/dist/work-triage/find-existing-work.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"find-existing-work.mjs","names":[],"sources":["../../src/work-triage/find-existing-work.ts"],"sourcesContent":["import { collectFactoryRecords } from \"../store/iterate\";\nimport type { Change } from \"../schema/change\";\nimport type { Task } from \"../schema/task\";\nimport type { FactoryStores } from \"../store/engine\";\nimport type { OpenPullRequest } from \"../pull-requests/contracts\";\nimport type { RepositoryId } from \"../schema/id\";\nimport type { RepositorySlug } from \"../schema/repository\";\n\n/** Provider-neutral readers used to discover work already in progress. */\nexport interface ExistingWorkLookupOptions {\n  listOpenPullRequests: (repository: RepositorySlug) => Promise<readonly OpenPullRequest[]>;\n}\n\n/** Stores, repository identity, and provider lookup used for one existing-work query. */\nexport interface FindExistingWorkInput extends ExistingWorkLookupOptions {\n  stores: Pick<FactoryStores, \"changes\" | \"repositories\" | \"tasks\">;\n  repositoryId: RepositoryId;\n}\n\n/** The refusal or existing pull requests, Changes, and active Tasks found during triage. */\nexport type ExistingWorkLookupResult =\n  | { found: false; reasonCode: \"repository_not_found\"; reason: string }\n  | {\n      found: true;\n      openPullRequests: readonly OpenPullRequest[];\n      openChanges: readonly Change[];\n      activeTasks: readonly Task[];\n    };\n\nconst openChangeStates: ReadonlySet<Change[\"state\"]> = new Set([\"verifying\", \"ready\"]);\nconst activeTaskStates: ReadonlySet<Task[\"state\"]> = new Set([\"queued\", \"running\", \"needs_human\"]);\n\n/** Find open pull requests, Changes, and active Tasks for one repository. */\nexport async function findExistingWork(\n  input: FindExistingWorkInput,\n): Promise<ExistingWorkLookupResult> {\n  const repository = await input.stores.repositories.get(input.repositoryId);\n  if (repository === null) {\n    return {\n      found: false,\n      reasonCode: \"repository_not_found\",\n      reason: `repository ${input.repositoryId} does not exist`,\n    };\n  }\n  const [openPullRequests, changes, tasks] = await Promise.all([\n    input.listOpenPullRequests(repository.slug),\n    collectFactoryRecords(input.stores.changes.list, {\n      limit: 100,\n      match: [...openChangeStates].map((state) => ({ repositoryId: input.repositoryId, state })),\n    }),\n    collectFactoryRecords(input.stores.tasks.list, {\n      limit: 100,\n      match: { repositoryIds: [input.repositoryId] },\n    }),\n  ]);\n  return {\n    found: true,\n    openPullRequests,\n    openChanges: changes.filter(\n      (change) => change.repositoryId === input.repositoryId && openChangeStates.has(change.state),\n    ),\n    activeTasks: tasks.filter(\n      (task) => task.repositoryIds.includes(input.repositoryId) && activeTaskStates.has(task.state),\n    ),\n  };\n}\n"],"mappings":";;AA6BA,MAAM,mCAAiD,IAAI,IAAI,CAAC,aAAa,OAAO,CAAC;AACrF,MAAM,mCAA+C,IAAI,IAAI;CAAC;CAAU;CAAW;AAAa,CAAC;;AAGjG,eAAsB,iBACpB,OACmC;CACnC,MAAM,aAAa,MAAM,MAAM,OAAO,aAAa,IAAI,MAAM,YAAY;CACzE,IAAI,eAAe,MACjB,OAAO;EACL,OAAO;EACP,YAAY;EACZ,QAAQ,cAAc,MAAM,aAAa;CAC3C;CAEF,MAAM,CAAC,kBAAkB,SAAS,SAAS,MAAM,QAAQ,IAAI;EAC3D,MAAM,qBAAqB,WAAW,IAAI;EAC1C,sBAAsB,MAAM,OAAO,QAAQ,MAAM;GAC/C,OAAO;GACP,OAAO,CAAC,GAAG,gBAAgB,CAAC,CAAC,KAAK,WAAW;IAAE,cAAc,MAAM;IAAc;GAAM,EAAE;EAC3F,CAAC;EACD,sBAAsB,MAAM,OAAO,MAAM,MAAM;GAC7C,OAAO;GACP,OAAO,EAAE,eAAe,CAAC,MAAM,YAAY,EAAE;EAC/C,CAAC;CACH,CAAC;CACD,OAAO;EACL,OAAO;EACP;EACA,aAAa,QAAQ,QAClB,WAAW,OAAO,iBAAiB,MAAM,gBAAgB,iBAAiB,IAAI,OAAO,KAAK,CAC7F;EACA,aAAa,MAAM,QAChB,SAAS,KAAK,cAAc,SAAS,MAAM,YAAY,KAAK,iBAAiB,IAAI,KAAK,KAAK,CAC9F;CACF;AACF"}
+{"version":3,"file":"find-existing-work.mjs","names":[],"sources":["../../src/work-triage/find-existing-work.ts"],"sourcesContent":["import { collectFactoryRecords } from \"../store/iterate\";\nimport type { Change } from \"../schema/change\";\nimport type { Task } from \"../schema/task\";\nimport type { FactoryStores } from \"../store/engine\";\nimport type { OpenPullRequest } from \"../pull-requests/contracts\";\nimport type { RepositoryId } from \"../schema/id\";\nimport type { RepositorySlug } from \"../schema/repository\";\n\n/** Provider-neutral readers used to discover work already in progress. */\nexport interface ExistingWorkLookupOptions {\n  listOpenPullRequests: (repository: RepositorySlug) => Promise<readonly OpenPullRequest[]>;\n  enableGitHubPullRequestDiscovery?: boolean;\n}\n\n/** Stores, repository identity, and provider lookup used for one existing-work query. */\nexport interface FindExistingWorkInput extends ExistingWorkLookupOptions {\n  stores: Pick<FactoryStores, \"changes\" | \"repositories\" | \"tasks\">;\n  repositoryId: RepositoryId;\n}\n\n/** The refusal or existing pull requests, Changes, and active Tasks found during triage. */\nexport type ExistingWorkLookupResult =\n  | { found: false; reasonCode: \"repository_not_found\"; reason: string }\n  | {\n      found: true;\n      githubPullRequestDiscovery: \"checked\" | \"skipped\";\n      githubPullRequestDiscoveryWarning?: string;\n      openPullRequests: readonly OpenPullRequest[];\n      openChanges: readonly Change[];\n      activeTasks: readonly Task[];\n    };\n\nconst openChangeStates: ReadonlySet<Change[\"state\"]> = new Set([\"verifying\", \"ready\"]);\nconst activeTaskStates: ReadonlySet<Task[\"state\"]> = new Set([\"queued\", \"running\", \"needs_human\"]);\n\n/** Find open pull requests, Changes, and active Tasks for one repository. */\nexport async function findExistingWork(\n  input: FindExistingWorkInput,\n): Promise<ExistingWorkLookupResult> {\n  const repository = await input.stores.repositories.get(input.repositoryId);\n  if (repository === null) {\n    return {\n      found: false,\n      reasonCode: \"repository_not_found\",\n      reason: `repository ${input.repositoryId} does not exist`,\n    };\n  }\n  // Temporary managed-credential demo mode: recorded work is still checked, but GitHub PRs may be missed (PLAT-9026).\n  const githubPullRequestDiscovery =\n    input.enableGitHubPullRequestDiscovery === false ? \"skipped\" : \"checked\";\n  const [openPullRequests, changes, tasks] = await Promise.all([\n    githubPullRequestDiscovery === \"skipped\"\n      ? Promise.resolve([])\n      : input.listOpenPullRequests(repository.slug),\n    collectFactoryRecords(input.stores.changes.list, {\n      limit: 100,\n      match: [...openChangeStates].map((state) => ({ repositoryId: input.repositoryId, state })),\n    }),\n    collectFactoryRecords(input.stores.tasks.list, {\n      limit: 100,\n      match: { repositoryIds: [input.repositoryId] },\n    }),\n  ]);\n  return {\n    found: true,\n    githubPullRequestDiscovery,\n    ...(githubPullRequestDiscovery === \"skipped\"\n      ? {\n          githubPullRequestDiscoveryWarning:\n            \"GitHub pull requests were not checked; duplicate pull requests are possible.\",\n        }\n      : {}),\n    openPullRequests,\n    openChanges: changes.filter(\n      (change) => change.repositoryId === input.repositoryId && openChangeStates.has(change.state),\n    ),\n    activeTasks: tasks.filter(\n      (task) => task.repositoryIds.includes(input.repositoryId) && activeTaskStates.has(task.state),\n    ),\n  };\n}\n"],"mappings":";;AAgCA,MAAM,mCAAiD,IAAI,IAAI,CAAC,aAAa,OAAO,CAAC;AACrF,MAAM,mCAA+C,IAAI,IAAI;CAAC;CAAU;CAAW;AAAa,CAAC;;AAGjG,eAAsB,iBACpB,OACmC;CACnC,MAAM,aAAa,MAAM,MAAM,OAAO,aAAa,IAAI,MAAM,YAAY;CACzE,IAAI,eAAe,MACjB,OAAO;EACL,OAAO;EACP,YAAY;EACZ,QAAQ,cAAc,MAAM,aAAa;CAC3C;CAGF,MAAM,6BACJ,MAAM,qCAAqC,QAAQ,YAAY;CACjE,MAAM,CAAC,kBAAkB,SAAS,SAAS,MAAM,QAAQ,IAAI;EAC3D,+BAA+B,YAC3B,QAAQ,QAAQ,CAAC,CAAC,IAClB,MAAM,qBAAqB,WAAW,IAAI;EAC9C,sBAAsB,MAAM,OAAO,QAAQ,MAAM;GAC/C,OAAO;GACP,OAAO,CAAC,GAAG,gBAAgB,CAAC,CAAC,KAAK,WAAW;IAAE,cAAc,MAAM;IAAc;GAAM,EAAE;EAC3F,CAAC;EACD,sBAAsB,MAAM,OAAO,MAAM,MAAM;GAC7C,OAAO;GACP,OAAO,EAAE,eAAe,CAAC,MAAM,YAAY,EAAE;EAC/C,CAAC;CACH,CAAC;CACD,OAAO;EACL,OAAO;EACP;EACA,GAAI,+BAA+B,YAC/B,EACE,mCACE,+EACJ,IACA,CAAC;EACL;EACA,aAAa,QAAQ,QAClB,WAAW,OAAO,iBAAiB,MAAM,gBAAgB,iBAAiB,IAAI,OAAO,KAAK,CAC7F;EACA,aAAa,MAAM,QAChB,SAAS,KAAK,cAAc,SAAS,MAAM,YAAY,KAAK,iBAAiB,IAAI,KAAK,KAAK,CAC9F;CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/factory",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "description": "Schema, state machines, and kernel primitives for Agent Factory.",
   "homepage": "https://github.com/vercel-labs/agent-factory/tree/main/packages/factory",
   "bugs": "https://github.com/vercel-labs/agent-factory/issues",