@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.5

package/dist/schemas/public-tracking.d.ts

@@ -0,0 +1,243 @@
+import * as z from 'zod/v4';
+/**
+ * Explicit anonymous projection for one issue or pull request in a public
+ * repository. This is deliberately not a pick from an app-owned row schema:
+ * adding a persisted field must never make it public by accident.
+ */
+export declare const ForgePublicPullRequestSchema: z.ZodObject<{
+    sourceRef: z.ZodString;
+    targetRef: z.ZodString;
+    mergeBase: z.ZodOptional<z.ZodString>;
+    headSha: z.ZodOptional<z.ZodString>;
+    mergeCommitSha: z.ZodOptional<z.ZodString>;
+    state: z.ZodEnum<{
+        open: "open";
+        draft: "draft";
+        merged: "merged";
+        closed: "closed";
+    }>;
+    ciStatus: z.ZodOptional<z.ZodEnum<{
+        success: "success";
+        error: "error";
+        pending: "pending";
+        failure: "failure";
+    }>>;
+}, z.core.$strip>;
+export declare const ForgePublicIssueSchema: z.ZodObject<{
+    issueNumber: z.ZodNumber;
+    type: z.ZodEnum<{
+        task: "task";
+        bug: "bug";
+        research: "research";
+        ops: "ops";
+        doc: "doc";
+        pr: "pr";
+    }>;
+    title: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    status: z.ZodEnum<{
+        done: "done";
+        blocked: "blocked";
+        draft: "draft";
+        backlog: "backlog";
+        planned: "planned";
+        in_progress: "in_progress";
+        in_review: "in_review";
+        cancelled: "cancelled";
+    }>;
+    priority: z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+        urgent: "urgent";
+    }>;
+    tags: z.ZodArray<z.ZodString>;
+    pr: z.ZodOptional<z.ZodObject<{
+        sourceRef: z.ZodString;
+        targetRef: z.ZodString;
+        mergeBase: z.ZodOptional<z.ZodString>;
+        headSha: z.ZodOptional<z.ZodString>;
+        mergeCommitSha: z.ZodOptional<z.ZodString>;
+        state: z.ZodEnum<{
+            open: "open";
+            draft: "draft";
+            merged: "merged";
+            closed: "closed";
+        }>;
+        ciStatus: z.ZodOptional<z.ZodEnum<{
+            success: "success";
+            error: "error";
+            pending: "pending";
+            failure: "failure";
+        }>>;
+    }, z.core.$strip>>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+    startedAt: z.ZodOptional<z.ZodISODateTime>;
+    completedAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export declare const ForgePublicIssueCommentSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    body: z.ZodString;
+    source: z.ZodEnum<{
+        human: "human";
+        agent: "agent";
+        system: "system";
+    }>;
+    reviewPath: z.ZodOptional<z.ZodString>;
+    reviewLine: z.ZodOptional<z.ZodNumber>;
+    reviewSide: z.ZodOptional<z.ZodEnum<{
+        old: "old";
+        new: "new";
+    }>>;
+    reviewCommitSha: z.ZodOptional<z.ZodString>;
+    reviewState: z.ZodOptional<z.ZodEnum<{
+        approved: "approved";
+        "changes-requested": "changes-requested";
+        commented: "commented";
+    }>>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export declare const ForgePublicIssuesResponseSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        issueNumber: z.ZodNumber;
+        type: z.ZodEnum<{
+            task: "task";
+            bug: "bug";
+            research: "research";
+            ops: "ops";
+            doc: "doc";
+            pr: "pr";
+        }>;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        status: z.ZodEnum<{
+            done: "done";
+            blocked: "blocked";
+            draft: "draft";
+            backlog: "backlog";
+            planned: "planned";
+            in_progress: "in_progress";
+            in_review: "in_review";
+            cancelled: "cancelled";
+        }>;
+        priority: z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            urgent: "urgent";
+        }>;
+        tags: z.ZodArray<z.ZodString>;
+        pr: z.ZodOptional<z.ZodObject<{
+            sourceRef: z.ZodString;
+            targetRef: z.ZodString;
+            mergeBase: z.ZodOptional<z.ZodString>;
+            headSha: z.ZodOptional<z.ZodString>;
+            mergeCommitSha: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                open: "open";
+                draft: "draft";
+                merged: "merged";
+                closed: "closed";
+            }>;
+            ciStatus: z.ZodOptional<z.ZodEnum<{
+                success: "success";
+                error: "error";
+                pending: "pending";
+                failure: "failure";
+            }>>;
+        }, z.core.$strip>>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+        startedAt: z.ZodOptional<z.ZodISODateTime>;
+        completedAt: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const ForgePublicIssueResponseSchema: z.ZodObject<{
+    result: z.ZodObject<{
+        issueNumber: z.ZodNumber;
+        type: z.ZodEnum<{
+            task: "task";
+            bug: "bug";
+            research: "research";
+            ops: "ops";
+            doc: "doc";
+            pr: "pr";
+        }>;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        status: z.ZodEnum<{
+            done: "done";
+            blocked: "blocked";
+            draft: "draft";
+            backlog: "backlog";
+            planned: "planned";
+            in_progress: "in_progress";
+            in_review: "in_review";
+            cancelled: "cancelled";
+        }>;
+        priority: z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            urgent: "urgent";
+        }>;
+        tags: z.ZodArray<z.ZodString>;
+        pr: z.ZodOptional<z.ZodObject<{
+            sourceRef: z.ZodString;
+            targetRef: z.ZodString;
+            mergeBase: z.ZodOptional<z.ZodString>;
+            headSha: z.ZodOptional<z.ZodString>;
+            mergeCommitSha: z.ZodOptional<z.ZodString>;
+            state: z.ZodEnum<{
+                open: "open";
+                draft: "draft";
+                merged: "merged";
+                closed: "closed";
+            }>;
+            ciStatus: z.ZodOptional<z.ZodEnum<{
+                success: "success";
+                error: "error";
+                pending: "pending";
+                failure: "failure";
+            }>>;
+        }, z.core.$strip>>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+        startedAt: z.ZodOptional<z.ZodISODateTime>;
+        completedAt: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const ForgePublicIssueCommentsResponseSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        body: z.ZodString;
+        source: z.ZodEnum<{
+            human: "human";
+            agent: "agent";
+            system: "system";
+        }>;
+        reviewPath: z.ZodOptional<z.ZodString>;
+        reviewLine: z.ZodOptional<z.ZodNumber>;
+        reviewSide: z.ZodOptional<z.ZodEnum<{
+            old: "old";
+            new: "new";
+        }>>;
+        reviewCommitSha: z.ZodOptional<z.ZodString>;
+        reviewState: z.ZodOptional<z.ZodEnum<{
+            approved: "approved";
+            "changes-requested": "changes-requested";
+            commented: "commented";
+        }>>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ForgePublicIssue = z.infer<typeof ForgePublicIssueSchema>;
+export type ForgePublicIssueComment = z.infer<typeof ForgePublicIssueCommentSchema>;
+/** Parse-and-strip projection: unknown persisted fields are omitted by Zod. */
+export declare function projectForgePublicIssue(value: unknown): ForgePublicIssue;
+/** Parse-and-strip projection: identity and request provenance never cross. */
+export declare function projectForgePublicIssueComment(value: unknown): ForgePublicIssueComment;
+//# sourceMappingURL=public-tracking.d.ts.map

package/dist/schemas/public-tracking.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-tracking.d.ts","sourceRoot":"","sources":["../../src/schemas/public-tracking.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAY5B;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;iBAQvC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAajC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;iBAWxC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE1C,CAAC;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA+C,CAAC;AAC3F,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;iBAEjD,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAExE;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAEtF"}

package/dist/schemas/public-tracking.js

@@ -0,0 +1,59 @@
+import * as z from 'zod/v4';
+import { TrackingCommentSourceSchema, TrackingItemPrioritySchema, TrackingItemTypeSchema, TrackingPrCiStatusSchema, TrackingPrStateSchema, TrackingReviewSideSchema, TrackingReviewStateSchema } from '@vibesdotdev/tracking-schemas';
+import { VibesProductStatusSchema } from '@vibesdotdev/shared/schemas';
+/**
+ * Explicit anonymous projection for one issue or pull request in a public
+ * repository. This is deliberately not a pick from an app-owned row schema:
+ * adding a persisted field must never make it public by accident.
+ */
+export const ForgePublicPullRequestSchema = z.object({
+    sourceRef: z.string().min(1),
+    targetRef: z.string().min(1),
+    mergeBase: z.string().optional(),
+    headSha: z.string().optional(),
+    mergeCommitSha: z.string().optional(),
+    state: TrackingPrStateSchema,
+    ciStatus: TrackingPrCiStatusSchema.optional()
+});
+export const ForgePublicIssueSchema = z.object({
+    issueNumber: z.number().int().positive(),
+    type: TrackingItemTypeSchema,
+    title: z.string().min(1).max(220),
+    description: z.string().max(8000).optional(),
+    status: VibesProductStatusSchema,
+    priority: TrackingItemPrioritySchema,
+    tags: z.array(z.string()),
+    pr: ForgePublicPullRequestSchema.optional(),
+    createdAt: z.iso.datetime(),
+    updatedAt: z.iso.datetime(),
+    startedAt: z.iso.datetime().optional(),
+    completedAt: z.iso.datetime().optional()
+});
+export const ForgePublicIssueCommentSchema = z.object({
+    id: z.uuid(),
+    body: z.string().min(1).max(10000),
+    source: TrackingCommentSourceSchema,
+    reviewPath: z.string().optional(),
+    reviewLine: z.number().int().positive().optional(),
+    reviewSide: TrackingReviewSideSchema.optional(),
+    reviewCommitSha: z.string().optional(),
+    reviewState: TrackingReviewStateSchema.optional(),
+    createdAt: z.iso.datetime(),
+    updatedAt: z.iso.datetime()
+});
+export const ForgePublicIssuesResponseSchema = z.object({
+    results: z.array(ForgePublicIssueSchema)
+});
+export const ForgePublicIssueResponseSchema = z.object({ result: ForgePublicIssueSchema });
+export const ForgePublicIssueCommentsResponseSchema = z.object({
+    results: z.array(ForgePublicIssueCommentSchema)
+});
+/** Parse-and-strip projection: unknown persisted fields are omitted by Zod. */
+export function projectForgePublicIssue(value) {
+    return ForgePublicIssueSchema.parse(value);
+}
+/** Parse-and-strip projection: identity and request provenance never cross. */
+export function projectForgePublicIssueComment(value) {
+    return ForgePublicIssueCommentSchema.parse(value);
+}
+//# sourceMappingURL=public-tracking.js.map

package/dist/schemas/public-tracking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-tracking.js","sourceRoot":"","sources":["../../src/schemas/public-tracking.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,qBAAqB;IAC5B,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,wBAAwB;IAChC,QAAQ,EAAE,0BAA0B;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,EAAE,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAClC,MAAM,EAAE,2BAA2B;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,WAAW,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACjD,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACxC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;CAC/C,CAAC,CAAC;AAKH,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACrD,OAAO,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC"}

package/dist/schemas/repo-pushed.d.ts

@@ -0,0 +1,22 @@
+import * as z from 'zod/v4';
+/** A single ref transition carried by a push. */
+export declare const PushedRefSchema: z.ZodObject<{
+    name: z.ZodString;
+    oldSha: z.ZodString;
+    newSha: z.ZodString;
+}, z.core.$strip>;
+export declare const RepoPushedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"repo.pushed">;
+    owner: z.ZodString;
+    repo: z.ZodString;
+    refs: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        oldSha: z.ZodString;
+        newSha: z.ZodString;
+    }, z.core.$strip>>;
+    at: z.ZodString;
+    pusherId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type PushedRef = z.infer<typeof PushedRefSchema>;
+export type RepoPushedEvent = z.infer<typeof RepoPushedEventSchema>;
+//# sourceMappingURL=repo-pushed.d.ts.map

package/dist/schemas/repo-pushed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-pushed.d.ts","sourceRoot":"","sources":["../../src/schemas/repo-pushed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAqB5B,iDAAiD;AACjD,eAAO,MAAM,eAAe;;;;iBAO1B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAYhC,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/schemas/repo-pushed.js

@@ -0,0 +1,41 @@
+import * as z from 'zod/v4';
+/**
+ * `repo.pushed` — the canonical vcs/forge push event.
+ *
+ * Emitted host→platform after gitd commits a receive-pack ref update, and
+ * validated by the platform ingest route
+ * (`POST /api/internal/repositories/pushed`) before the forge pipeline engine
+ * matches `.forge/actions.yml` triggers + dispatches jobs.
+ *
+ * It is the wire contract between the host worker (producer) and platform-web
+ * (consumer). The producer constructs a plain object of this shape; the consumer
+ * parses with `RepoPushedEventSchema` and rejects anything malformed.
+ *
+ * `actor` is not part of the wire protocol; `pusherId`, when present, is
+ * threaded from the verified product-transport identity, else omitted.
+ */
+/** A 40-hex object id, or the all-zero sentinel (create → oldSha, delete → newSha). */
+const ShaSchema = z.string().regex(/^[0-9a-f]{40}$/, 'expected a 40-hex object id');
+/** A single ref transition carried by a push. */
+export const PushedRefSchema = z.object({
+    /** Full ref name, e.g. `refs/heads/feature-x`. */
+    name: z.string().min(1),
+    /** Prior value (`0{40}` on create). */
+    oldSha: ShaSchema,
+    /** New value (`0{40}` on delete). */
+    newSha: ShaSchema
+});
+export const RepoPushedEventSchema = z.object({
+    type: z.literal('repo.pushed'),
+    /** Repo owner (RepoId.owner). */
+    owner: z.string().min(1),
+    /** Repo name (RepoId.repo). */
+    repo: z.string().min(1),
+    /** The refs changed by this push (at least one). */
+    refs: z.array(PushedRefSchema).min(1),
+    /** Emit time, ISO-8601. */
+    at: z.string().min(1),
+    /** Optional verified pusher identity (Worker-layer, omitted by the DO). */
+    pusherId: z.string().optional()
+});
+//# sourceMappingURL=repo-pushed.js.map

package/dist/schemas/repo-pushed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-pushed.js","sourceRoot":"","sources":["../../src/schemas/repo-pushed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AAEH,uFAAuF;AACvF,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;AAEpF,iDAAiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,kDAAkD;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,uCAAuC;IACvC,MAAM,EAAE,SAAS;IACjB,qCAAqC;IACrC,MAAM,EAAE,SAAS;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9B,iCAAiC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,+BAA+B;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,oDAAoD;IACpD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,2BAA2B;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC"}

package/dist/schemas/review-merge-evidence.d.ts

@@ -0,0 +1,127 @@
+import * as z from 'zod/v4';
+/** Immutable reviewer verdict bound to one pull-request source head. */
+export declare const ForgeReviewDecisionSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    repositoryId: z.ZodString;
+    prNumber: z.ZodNumber;
+    headSha: z.ZodString;
+    reviewer: z.ZodObject<{
+        accountId: z.ZodString;
+        principalId: z.ZodString;
+        principalType: z.ZodEnum<{
+            human: "human";
+            agent: "agent";
+        }>;
+    }, z.core.$strict>;
+    verdict: z.ZodEnum<{
+        approved: "approved";
+        "changes-requested": "changes-requested";
+    }>;
+    requiredApprovals: z.ZodOptional<z.ZodNumber>;
+    rulesetEvaluation: z.ZodOptional<z.ZodUnknown>;
+    createdAt: z.ZodISODateTime;
+}, z.core.$strip>;
+export declare const ForgeOwnerOverrideAuditSchema: z.ZodObject<{
+    reason: z.ZodString;
+    overriddenBlockers: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** Immutable merge outcome bound to the source head the host actually merged. */
+export declare const ForgeMergeDecisionSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    repositoryId: z.ZodString;
+    prNumber: z.ZodNumber;
+    headSha: z.ZodString;
+    reviewedHeadSha: z.ZodString;
+    decision: z.ZodEnum<{
+        merged: "merged";
+        rejected: "rejected";
+    }>;
+    decidedBy: z.ZodObject<{
+        accountId: z.ZodString;
+        principalId: z.ZodString;
+        principalType: z.ZodEnum<{
+            human: "human";
+            agent: "agent";
+        }>;
+    }, z.core.$strict>;
+    checksSnapshot: z.ZodOptional<z.ZodUnknown>;
+    rulesetEvaluation: z.ZodOptional<z.ZodUnknown>;
+    ownerOverride: z.ZodOptional<z.ZodObject<{
+        reason: z.ZodString;
+        overriddenBlockers: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    createdAt: z.ZodISODateTime;
+}, z.core.$strip>;
+/** Persistence input only; append-only evidence deliberately has no update schema. */
+export declare const ForgeReviewDecisionCreateSchema: z.ZodObject<{
+    repositoryId: z.ZodString;
+    headSha: z.ZodString;
+    requiredApprovals: z.ZodOptional<z.ZodNumber>;
+    prNumber: z.ZodNumber;
+    reviewer: z.ZodObject<{
+        accountId: z.ZodString;
+        principalId: z.ZodString;
+        principalType: z.ZodEnum<{
+            human: "human";
+            agent: "agent";
+        }>;
+    }, z.core.$strict>;
+    verdict: z.ZodEnum<{
+        approved: "approved";
+        "changes-requested": "changes-requested";
+    }>;
+    rulesetEvaluation: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+/** Persistence input only; append-only evidence deliberately has no update schema. */
+export declare const ForgeMergeDecisionCreateSchema: z.ZodObject<{
+    repositoryId: z.ZodString;
+    headSha: z.ZodString;
+    prNumber: z.ZodNumber;
+    rulesetEvaluation: z.ZodOptional<z.ZodUnknown>;
+    decidedBy: z.ZodObject<{
+        accountId: z.ZodString;
+        principalId: z.ZodString;
+        principalType: z.ZodEnum<{
+            human: "human";
+            agent: "agent";
+        }>;
+    }, z.core.$strict>;
+    reviewedHeadSha: z.ZodString;
+    decision: z.ZodEnum<{
+        merged: "merged";
+        rejected: "rejected";
+    }>;
+    checksSnapshot: z.ZodOptional<z.ZodUnknown>;
+    ownerOverride: z.ZodOptional<z.ZodObject<{
+        reason: z.ZodString;
+        overriddenBlockers: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strip>;
+/**
+ * Client-facing review submission. Policy metadata is server evidence: callers
+ * may choose only their verdict while the app derives identity, repository,
+ * current head, required approvals, and ruleset evaluation.
+ */
+export declare const ForgeReviewDecisionRequestSchema: z.ZodObject<{
+    verdict: z.ZodEnum<{
+        approved: "approved";
+        "changes-requested": "changes-requested";
+    }>;
+}, z.core.$strict>;
+export type ForgeReviewDecision = z.infer<typeof ForgeReviewDecisionSchema>;
+export type ForgeMergeDecision = z.infer<typeof ForgeMergeDecisionSchema>;
+export type ForgeReviewDecisionCreate = z.input<typeof ForgeReviewDecisionCreateSchema>;
+export type ForgeMergeDecisionCreate = z.input<typeof ForgeMergeDecisionCreateSchema>;
+export type ForgeReviewDecisionRequest = z.input<typeof ForgeReviewDecisionRequestSchema>;
+/** Select the newest approved decision deterministically for reviewed-head CAS. */
+export declare function newestApprovedForgeReviewDecision(decisions: readonly ForgeReviewDecision[]): ForgeReviewDecision | undefined;
+/**
+ * Exact reviewed-head gate. No approval evidence preserves existing merge behavior;
+ * otherwise the latest approval must name the currently synchronized source head.
+ */
+export interface ReviewedHeadGateResult {
+    allowed: boolean;
+    reviewedHeadSha?: string;
+}
+export declare function reviewedHeadGate(decisions: readonly ForgeReviewDecision[], currentHeadSha: string): ReviewedHeadGateResult;
+//# sourceMappingURL=review-merge-evidence.d.ts.map

package/dist/schemas/review-merge-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-merge-evidence.d.ts","sourceRoot":"","sources":["../../src/schemas/review-merge-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,wEAAwE;AACxE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;iBAUpC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;kBAKhC,CAAC;AAEX,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;iBAYnC,CAAC;AAEH,sFAAsF;AACtF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;iBAG1C,CAAC;AAEH,sFAAsF;AACtF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;iBAGzC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAInC,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,mFAAmF;AACnF,wBAAgB,iCAAiC,CAChD,SAAS,EAAE,SAAS,mBAAmB,EAAE,GACvC,mBAAmB,GAAG,SAAS,CAUjC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAC/B,SAAS,EAAE,SAAS,mBAAmB,EAAE,EACzC,cAAc,EAAE,MAAM,GACpB,sBAAsB,CAOxB"}

package/dist/schemas/review-merge-evidence.js

@@ -0,0 +1,77 @@
+import * as z from 'zod/v4';
+import { ForgeActorPrincipalSchema } from "./review-principal.js";
+/** Immutable reviewer verdict bound to one pull-request source head. */
+export const ForgeReviewDecisionSchema = z.object({
+    id: z.uuid(),
+    repositoryId: z.string().min(1),
+    prNumber: z.number().int().positive(),
+    headSha: z.string().min(1),
+    reviewer: ForgeActorPrincipalSchema,
+    verdict: z.enum(['approved', 'changes-requested']),
+    requiredApprovals: z.number().int().nonnegative().optional(),
+    rulesetEvaluation: z.unknown().optional(),
+    createdAt: z.iso.datetime()
+});
+export const ForgeOwnerOverrideAuditSchema = z
+    .object({
+    reason: z.string().trim().min(20).max(2_000),
+    overriddenBlockers: z.array(z.string().min(1)).min(1)
+})
+    .strict();
+/** Immutable merge outcome bound to the source head the host actually merged. */
+export const ForgeMergeDecisionSchema = z.object({
+    id: z.uuid(),
+    repositoryId: z.string().min(1),
+    prNumber: z.number().int().positive(),
+    headSha: z.string().min(1),
+    reviewedHeadSha: z.string().min(1),
+    decision: z.enum(['merged', 'rejected']),
+    decidedBy: ForgeActorPrincipalSchema,
+    checksSnapshot: z.unknown().optional(),
+    rulesetEvaluation: z.unknown().optional(),
+    ownerOverride: ForgeOwnerOverrideAuditSchema.optional(),
+    createdAt: z.iso.datetime()
+});
+/** Persistence input only; append-only evidence deliberately has no update schema. */
+export const ForgeReviewDecisionCreateSchema = ForgeReviewDecisionSchema.omit({
+    id: true,
+    createdAt: true
+});
+/** Persistence input only; append-only evidence deliberately has no update schema. */
+export const ForgeMergeDecisionCreateSchema = ForgeMergeDecisionSchema.omit({
+    id: true,
+    createdAt: true
+});
+/**
+ * Client-facing review submission. Policy metadata is server evidence: callers
+ * may choose only their verdict while the app derives identity, repository,
+ * current head, required approvals, and ruleset evaluation.
+ */
+export const ForgeReviewDecisionRequestSchema = z
+    .object({
+    verdict: ForgeReviewDecisionSchema.shape.verdict
+})
+    .strict();
+/** Select the newest approved decision deterministically for reviewed-head CAS. */
+export function newestApprovedForgeReviewDecision(decisions) {
+    return decisions
+        .filter((decision) => decision.verdict === 'approved')
+        .reduce((newest, candidate) => {
+        if (!newest)
+            return candidate;
+        if (candidate.createdAt !== newest.createdAt) {
+            return candidate.createdAt > newest.createdAt ? candidate : newest;
+        }
+        return candidate.id > newest.id ? candidate : newest;
+    }, undefined);
+}
+export function reviewedHeadGate(decisions, currentHeadSha) {
+    const newestApproval = newestApprovedForgeReviewDecision(decisions);
+    if (!newestApproval)
+        return { allowed: true };
+    return {
+        allowed: newestApproval.headSha === currentHeadSha,
+        reviewedHeadSha: newestApproval.headSha
+    };
+}
+//# sourceMappingURL=review-merge-evidence.js.map

package/dist/schemas/review-merge-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-merge-evidence.js","sourceRoot":"","sources":["../../src/schemas/review-merge-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAClD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC5D,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC5C,MAAM,CAAC;IACP,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxC,SAAS,EAAE,yBAAyB;IACpC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACvD,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC,IAAI,CAAC;IAC7E,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,IAAI;CACf,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC,IAAI,CAAC;IAC3E,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,IAAI;CACf,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACP,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC,OAAO;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAQX,mFAAmF;AACnF,MAAM,UAAU,iCAAiC,CAChD,SAAyC;IAEzC,OAAO,SAAS;SACd,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,UAAU,CAAC;SACrD,MAAM,CAAkC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE;QAC9D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,IAAI,SAAS,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QACpE,CAAC;QACD,OAAO,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC,EAAE,SAAS,CAAC,CAAC;AAChB,CAAC;AAWD,MAAM,UAAU,gBAAgB,CAC/B,SAAyC,EACzC,cAAsB;IAEtB,MAAM,cAAc,GAAG,iCAAiC,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO;QACN,OAAO,EAAE,cAAc,CAAC,OAAO,KAAK,cAAc;QAClD,eAAe,EAAE,cAAc,CAAC,OAAO;KACvC,CAAC;AACH,CAAC"}

package/dist/schemas/review-principal.d.ts

@@ -0,0 +1,16 @@
+import { type ForgeActorPrincipal } from '@vibesdotdev/tracking-schemas';
+/**
+ * Authenticated identity used for Forge authorship, review distinctness, and
+ * merge audit. Account ownership remains a separate tenancy/notification
+ * concern; `principalId` is the identity that must be distinct for review.
+ *
+ * The schema itself now lives in the `tracking-schemas` leaf (App's tracking
+ * item PR sub-shape embeds it too); this module keeps the original names for
+ * back-compat and owns the one bit of behavior — `forgePrincipalKey` — that
+ * isn't a transport-neutral type.
+ */
+export { ForgePrincipalTypeSchema, ForgeActorPrincipalSchema } from '@vibesdotdev/tracking-schemas';
+export type { ForgePrincipalType, ForgeActorPrincipal } from '@vibesdotdev/tracking-schemas';
+/** Collision-safe identity key for reviewer de-duplication and self-review. */
+export declare function forgePrincipalKey(principal: ForgeActorPrincipal): string;
+//# sourceMappingURL=review-principal.d.ts.map

package/dist/schemas/review-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-principal.d.ts","sourceRoot":"","sources":["../../src/schemas/review-principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpG;;;;;;;;;GASG;AACH,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AACpG,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAE7F,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,mBAAmB,GAAG,MAAM,CAGxE"}

package/dist/schemas/review-principal.js

@@ -0,0 +1,18 @@
+import { ForgeActorPrincipalSchema } from '@vibesdotdev/tracking-schemas';
+/**
+ * Authenticated identity used for Forge authorship, review distinctness, and
+ * merge audit. Account ownership remains a separate tenancy/notification
+ * concern; `principalId` is the identity that must be distinct for review.
+ *
+ * The schema itself now lives in the `tracking-schemas` leaf (App's tracking
+ * item PR sub-shape embeds it too); this module keeps the original names for
+ * back-compat and owns the one bit of behavior — `forgePrincipalKey` — that
+ * isn't a transport-neutral type.
+ */
+export { ForgePrincipalTypeSchema, ForgeActorPrincipalSchema } from '@vibesdotdev/tracking-schemas';
+/** Collision-safe identity key for reviewer de-duplication and self-review. */
+export function forgePrincipalKey(principal) {
+    const parsed = ForgeActorPrincipalSchema.parse(principal);
+    return `${parsed.principalType}:${parsed.principalId}`;
+}
+//# sourceMappingURL=review-principal.js.map

package/dist/schemas/review-principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-principal.js","sourceRoot":"","sources":["../../src/schemas/review-principal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAA4B,MAAM,+BAA+B,CAAC;AAEpG;;;;;;;;;GASG;AACH,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAGpG,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,SAA8B;IAC/D,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1D,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;AACxD,CAAC"}