orizu 0.5.19 → 0.5.21

package/dist/deploy-key-merge-core.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Transport-agnostic deploy-key merge core (ALI-1084, merge-sandbox-job
+ * Phase 0). Extracted VERBATIM from `lib/git-ssh-merge.ts` so both the server
+ * (`lib/`) and the published CLI (`orizu internal merge-job`, Phase 2) run the
+ * EXACT SAME merge logic — no forked implementations, one place where the
+ * ADR-007 §4 `--no-ff` invariant is asserted on the exact argv.
+ *
+ * DELIBERATELY NO `import 'server-only'`: this module runs inside the one-shot
+ * merge sandbox (a plain Node process) as well as on the server. It must not
+ * import anything outside the CLI package root (bun-bundled) — node builtins
+ * only. `lib/git-ssh-merge.ts` re-exports everything here so every existing
+ * server import path and test keeps working unchanged.
+ *
+ * SECURITY PROPERTIES (unchanged from the lib original):
+ *   - throwaway temp worktree + isolated SSH identity (key file mode 0600);
+ *   - pinned GitHub host keys (StrictHostKeyChecking=yes, own known_hosts);
+ *   - expected-head verification: the merge targets the REVIEWED SHA, never a
+ *     branch name;
+ *   - `merge-base --is-ancestor` alreadyMerged idempotency check;
+ *   - argv-asserted commit-preserving `--no-ff` merge (ADR-007 §4).
+ */
+export interface MergeBranchWithDeployKeyInput {
+    base: string;
+    sourceBranch: string;
+    expectedHeadSha: string;
+    commitMessage: string;
+    privateKeyPem: string;
+}
+export interface GitCommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export type GitCommandRunner = (args: string[], options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}) => Promise<GitCommandResult>;
+export interface MergeBranchWithDeployKeyDeps {
+    runGit?: GitCommandRunner;
+    /**
+     * D8 pre-push gate (merge-sandbox-job Phase 2): called IMMEDIATELY before
+     * `git push`, after the merge commit exists locally. Returning `false`
+     * aborts WITHOUT pushing (`superseded: true` in the result) — a manifest
+     * rejected while the job was in flight must never reach `main`. Absent
+     * (the local/server executor), the merge pushes unconditionally as before.
+     */
+    prePushGate?: () => Promise<boolean>;
+}
+/**
+ * The merge outcome contract. Structurally identical to `MergeResult` in
+ * `lib/github-repo-ops.ts` (which cannot be imported from the CLI package —
+ * it is server-only); TypeScript's structural typing keeps the two
+ * assignable, and `lib/git-ssh-merge.ts` continues to expose the lib-side
+ * type to server callers.
+ */
+export interface DeployKeyMergeResult {
+    merged: boolean;
+    sha: string | null;
+    /** true when the base already contained head (GitHub 204 equivalent). */
+    alreadyMerged: boolean;
+    /** true when git reported a merge conflict (409 equivalent). */
+    conflict: boolean;
+    /** true when the D8 pre-push gate refused the push (manifest no longer
+     *  appliable) — the merge commit was built but NEVER pushed. */
+    superseded?: boolean;
+    status: number;
+}
+/**
+ * Assert a git invocation is the commit-preserving seal merge ADR-007 §4
+ * requires. Called on the exact argv the merge runs with, so the invariant is
+ * enforced where the merge happens rather than by reviewer vigilance.
+ */
+export declare function assertCommitPreservingMergeArgs(args: readonly string[]): void;
+/**
+ * Strip git's repo-context env vars from a child git's environment. Git
+ * EXPORTS these into hook subprocesses (from a linked worktree, GIT_DIR is an
+ * ABSOLUTE path into the shared .git), so any descendant git command that
+ * inherits the parent env operates on THAT repo instead of its own cwd —
+ * `git config` writes land in the shared .git/config and `git init` flips it
+ * to core.bare=true (both observed when the pre-push hook ran the test suite
+ * from a worktree). Every real-git spawn must build its env through this.
+ */
+export declare function scrubGitRepoContextEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function defaultRunGit(args: string[], options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}): Promise<GitCommandResult>;
+export declare function sshRemote(repoFullName: string): string;
+/**
+ * The SSH-over-the-HTTPS-port remote (GitHub-supported: `ssh.github.com:443`
+ * speaks the same SSH protocol, same auth, same host-key set). The MERGE core
+ * uses this endpoint because the merge sandbox's egress firewall enforces at
+ * the SNI/CIDR layer and reset raw SSH on :22 in the first live run
+ * (ALI-1084); :443 within GitHub's published git CIDRs is the compatible
+ * path. Equivalent from dev machines, so local/sandbox parity holds (D6).
+ * The push/read paths (D9/Phase 6) keep `sshRemote` untouched.
+ */
+export declare function sshRemoteOverHttpsPort(repoFullName: string): string;
+/** Exported for `lib/git-ssh-merge.ts` (pushFilesWithDeployKey keeps living
+ *  there — D9 scopes the push path as a follow-on, not part of the core). */
+export declare function assertGitOk(result: GitCommandResult, operation: string): void;
+export interface DeployKeyGitContext {
+    dir: string;
+    git: (args: string[]) => Promise<GitCommandResult>;
+    gitOk: (args: string[], operation: string) => Promise<GitCommandResult>;
+}
+/**
+ * Run a callback inside a throwaway git worktree wired to the repo's merge
+ * deploy key (isolated SSH identity + pinned GitHub host keys). Exported for
+ * the ADR-007 read path (lib/artifact-git-read.ts), which reuses the same
+ * clone/pack infrastructure for bulk artifact reads.
+ */
+export declare function withDeployKeyGit<T>(privateKeyPem: string, runGit: GitCommandRunner, tempPrefix: string, callback: (context: DeployKeyGitContext) => Promise<T>): Promise<T>;
+/**
+ * Merge a reviewed session/revert branch head into the default branch using the
+ * server-only merge deploy key. The source branch is fetched only so GitHub can
+ * prove the reviewed SHA is still the branch tip; the merge itself targets the
+ * expected SHA, preserving the manifest CAS guarantee.
+ */
+export declare function mergeBranchWithDeployKey(repoFullName: string, input: MergeBranchWithDeployKeyInput, deps?: MergeBranchWithDeployKeyDeps): Promise<DeployKeyMergeResult>;
+//# sourceMappingURL=deploy-key-merge-core.d.ts.map

package/dist/deploy-key-merge-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-key-merge-core.d.ts","sourceRoot":"","sources":["../src/deploy-key-merge-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAC7C,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAE9B,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAA;IACf,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAA;IACtB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAA;IACjB;oEACgE;IAChE,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf;AAaD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAgB7E;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAS9F;AAID,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GAC/C,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AAED,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAKnE;AAMD;6EAC6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAI7E;AAOD,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACxE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,CAAC,CAAC,GACrD,OAAO,CAAC,CAAC,CAAC,CAwCZ;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAsE/B"}

package/dist/diff-comments-cli.d.ts

@@ -0,0 +1,12 @@
+export interface DiffCommentsCliContext {
+    getArg: (name: string) => string | null;
+    rejectDashPrefixedOptionValue: (name: string, value: string | null) => void;
+    authedFetch: (path: string, init?: RequestInit) => Promise<Response>;
+    parseJsonResponse: <T>(response: Response, context: string) => Promise<T>;
+    hasJsonFlag: () => boolean;
+    printJson: (value: Record<string, unknown>) => void;
+    printLine: (message?: string) => void;
+    sanitizeTerminalText: (value: unknown) => string;
+}
+export declare function diffCommentsCommand(ctx: DiffCommentsCliContext): Promise<void>;
+//# sourceMappingURL=diff-comments-cli.d.ts.map

package/dist/diff-comments-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-comments-cli.d.ts","sourceRoot":"","sources":["../src/diff-comments-cli.ts"],"names":[],"mappings":"AAyFA,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACvC,6BAA6B,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAA;IAC3E,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpE,iBAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IACzE,WAAW,EAAE,MAAM,OAAO,CAAA;IAC1B,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnD,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAA;CACjD;AAwTD,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,iBAiBpE"}

package/dist/diff-comments-cli.js

@@ -61,6 +61,16 @@ function formatDeltaValue(value, metric, signed = false) {
         return '—';
     return metric === 'tokens' ? `~${formatted}` : formatted;
 }
+function isLengthMetricDelta(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const delta = value;
+    const isNullableFiniteNumber = (candidate) => candidate === null || (typeof candidate === 'number' && Number.isFinite(candidate));
+    return isNullableFiniteNumber(delta.removed) &&
+        isNullableFiniteNumber(delta.added) &&
+        isNullableFiniteNumber(delta.net);
+}
 function printLengthMeasurements(ctx, pair) {
     function unavailableSuffix(reason) {
         if (typeof reason !== 'string' || reason.length === 0)
@@ -83,8 +93,10 @@ function printLengthMeasurements(ctx, pair) {
         ctx.printLine(`  Length delta: unavailable${unavailableSuffix(pair.lengthDeltaUnavailableReason ?? pair.degraded?.reason)}`);
         return;
     }
-    if (pair.lengthDelta.splitUnavailableReason) {
-        ctx.printLine(`  Split unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, pair.lengthDelta.splitUnavailableReason)}`);
+    const splitUnavailableReason = pair.lengthDelta.splitUnavailableReason;
+    if (typeof splitUnavailableReason === 'string' &&
+        splitUnavailableReason.length > 0) {
+        ctx.printLine(`  Split unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, splitUnavailableReason)}`);
     }
     for (const [metric, label] of [
         ['tokens', 'Tokens'],
@@ -93,6 +105,10 @@ function printLengthMeasurements(ctx, pair) {
         ['words', 'Words'],
     ]) {
         const delta = pair.lengthDelta[metric];
+        if (!isLengthMetricDelta(delta)) {
+            ctx.printLine(`  ${label}: unavailable`);
+            continue;
+        }
         ctx.printLine(`  ${label}: removed ${formatDeltaValue(delta.removed, metric)} · ` +
             `added ${formatDeltaValue(delta.added, metric)} · ` +
             `net ${formatDeltaValue(delta.net, metric, true)}`);
@@ -182,6 +198,9 @@ function printDiffComments(ctx, payload) {
                 `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.anchor.side)} line ` +
                 `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, String(comment.anchor.line + 1))}`);
             printHumanTextBlock(ctx, comment.body);
+            if (typeof comment.componentKey === 'string' && comment.componentKey) {
+                ctx.printLine(`    Component: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.componentKey)}`);
+            }
             if (comment.contextUnavailableReason) {
                 ctx.printLine(`    Context unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.contextUnavailableReason)}`);
                 if (comment.context) {

package/dist/egress-allowlist-cli.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Per-team ADDITIVE egress allowlist CLI (ALI-1006 / G5):
+ *   orizu team egress-allowlist <team>                 # show extra domains
+ *   orizu team egress-allowlist <team> --add <domain>
+ *   orizu team egress-allowlist <team> --remove <domain>
+ *   orizu team egress-allowlist <team> --set a.com,b.com
+ *   orizu team egress-allowlist <team> --clear
+ *
+ * The BASE allowlist (Orizu API + model provider + git host) is code-owned and
+ * NOT shown/managed here — this surface only widens a team's egress with domains
+ * a customer workflow needs. Human ADMIN only: the server rejects agent bearers
+ * and non-admins (the definer RPC gates on is_team_admin). Pure command logic
+ * with an injected fetcher.
+ */
+export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface EgressAllowlistCommandIo {
+    json: boolean;
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    fetcher?: CliFetcher;
+}
+export declare function egressAllowlistCommand(args: string[], io: EgressAllowlistCommandIo): Promise<number>;
+//# sourceMappingURL=egress-allowlist-cli.d.ts.map

package/dist/egress-allowlist-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-allowlist-cli.d.ts","sourceRoot":"","sources":["../src/egress-allowlist-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AAiID,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D1G"}

package/dist/egress-policy.d.ts

@@ -0,0 +1,108 @@
+/**
+ * G5 — sandbox egress policy builder (ALI-1006, per the hosted-agent threat
+ * model T1). Owns the ALLOWLIST CONTENT the `SandboxProvider` seam plumbs to the
+ * sandbox firewall at create (`packages/cli/src/vercel-sandbox-provider.ts` →
+ * Vercel `networkPolicy`). The Vercel adapter is a pass-through; this file is
+ * where "default-deny with a per-team allowlist (Orizu API, model providers, git
+ * host); blocked attempts logged" is actually decided.
+ *
+ * The policy is DEFAULT-DENY: the record form `{ allow: { host: rules } }` denies
+ * everything NOT explicitly listed, so the correctness invariant is simply that
+ * we NEVER emit a `"*"` allow entry (which would re-open the sandbox). The
+ * model-key credential broker (G3 / `buildModelKeyBrokerPolicy`) is COMPOSED onto
+ * the model host's rule here so brokering + allowlisting are ONE coherent policy,
+ * not two policies that could disagree.
+ *
+ * SNI matching (verified against @vercel/sandbox@1.10.2 `NetworkPolicy`): an
+ * allow entry matches the exact SNI host; a LEADING-wildcard entry (`*.orizu.ai`)
+ * matches any single-or-multi-label subdomain but NOT the apex — so a host that
+ * must serve BOTH apex and subdomains is listed twice (`orizu.ai` +
+ * `*.orizu.ai`). Domains are hostnames only — never a protocol, path, or port.
+ *
+ * The BASE allowlist (Orizu API + model provider + git host) is CODE-OWNED and
+ * non-negotiable: `buildEgressPolicy` always includes it and per-team config can
+ * only ADD to it, never remove a base host. See
+ * docs/requirements/hosted-customer-workbench/sandbox-egress-policy.md for the
+ * rationale per host and the honest statement of what Vercel enforces (firewall,
+ * SNI-level) vs. what we generate (blocked-attempt evidence via the canary).
+ */
+import type { SandboxEgressPolicy } from './sandbox-provider.js';
+/** Default model-provider endpoint (Anthropic) the broker injects a key for. */
+export declare const ANTHROPIC_API_HOST = "api.anthropic.com";
+/** Anthropic authenticates with `x-api-key` (not a Bearer Authorization). */
+export declare const ANTHROPIC_API_KEY_HEADER = "x-api-key";
+/** GitHub git-over-HTTPS SNIs. `git clone`/`git push` over the smart HTTP
+ *  protocol connect to `github.com`; `codeload.github.com` serves repository
+ *  archive/tarball fetches (release assets, `pip`/`go` github-archive installs).
+ *  Both are allowed so the agent's git work AND any archive fetch its workflow
+ *  triggers succeed — everything else on github's infra stays denied. */
+export declare const GIT_HOST_DOMAINS: readonly ["github.com", "codeload.github.com"];
+/** Default host the startup canary probes to PROVE the policy is live (a known
+ *  non-allowlisted host: reaching it means egress is NOT enforced). */
+export declare const DEFAULT_EGRESS_CANARY_HOST = "example.com";
+/**
+ * Resolve the Orizu control-plane host from a base URL and CONSERVATIVELY
+ * wildcard its registrable base domain so the policy survives the API moving to
+ * a subdomain (e.g. `api.orizu.ai`) without re-opening egress. Returns the apex
+ * PLUS a leading-wildcard for its subdomains: `orizu.ai` + `*.orizu.ai`. A
+ * loopback/localhost base (rehearsal) yields just the bare host (no wildcard —
+ * there is nothing to broaden and the firewall does not enforce it anyway).
+ */
+export declare function orizuEgressDomains(baseUrl: string | undefined): string[];
+/**
+ * Normalize a per-team extra domain to a bare hostname (or leading-wildcard).
+ * Strips protocol/path/port, lowercases, and validates the SNI shape. Returns
+ * null for anything that is not a plausible hostname so a bad config entry is
+ * dropped rather than silently widening the policy in an unexpected way.
+ */
+export declare function normalizeEgressDomain(input: string): string | null;
+export interface EgressModelKeyBroker {
+    /** The raw model API key. It lives ONLY in the policy the host sends to the
+     *  firewall control plane; it never enters the sandbox env/disk/run events. */
+    apiKey: string;
+    /** Domain to inject the key for (default api.anthropic.com). */
+    host?: string;
+    /** Header the endpoint authenticates with (default x-api-key). */
+    headerName?: string;
+}
+export interface BuildEgressPolicyOptions {
+    /** Orizu control-plane base URL (default env ORIZU_BASE_URL / orizu.ai). */
+    orizuBaseUrl?: string;
+    /** Additional model-provider hosts to allow WITHOUT a key transform. The broker
+     *  host (below) is added automatically; list only extra providers here. */
+    modelHosts?: readonly string[];
+    /** Compose the G3 model-key broker transform onto its host's allow rule, so
+     *  brokering and the allowlist are one policy. */
+    modelKeyBroker?: EgressModelKeyBroker;
+    /** Per-team ADDITIVE domains (a customer's own API a workflow needs). Base
+     *  hosts can never be removed; these only widen. Invalid entries are dropped. */
+    extraDomains?: readonly string[];
+    /** Exact server-derived Git remote hosts needed in addition to the legacy
+     * GitHub migration hosts. Artifacts account hosts are passed here only after
+     * strict remote validation; never use a broad wildcard. */
+    repositoryHosts?: readonly string[];
+}
+/**
+ * Compute the ordered list of BASE (code-owned, non-removable) allow domains for
+ * an Orizu base URL: the Orizu control-plane host(s), the model provider host,
+ * and the git host(s). Exported so tests and the policy doc assert the exact set.
+ */
+export declare function baseEgressDomains(opts?: {
+    orizuBaseUrl?: string;
+    modelHost?: string;
+    modelHosts?: readonly string[];
+    repositoryHosts?: readonly string[];
+}): string[];
+/**
+ * Build a DEFAULT-DENY Vercel network policy whose allowlist is exactly the base
+ * hosts (Orizu API + model provider + git) plus any valid per-team extra domains,
+ * with the model-key broker transform COMPOSED onto the model host's rule.
+ *
+ * Correctness invariants (unit-tested):
+ *   - record form → default-deny (no `"*"` key is EVER emitted);
+ *   - every base host is present;
+ *   - the broker transform sits on the model host's rule (one coherent policy);
+ *   - base hosts survive regardless of `extraDomains` (cannot be removed).
+ */
+export declare function buildEgressPolicy(opts?: BuildEgressPolicyOptions): SandboxEgressPolicy;
+//# sourceMappingURL=egress-policy.d.ts.map

package/dist/egress-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-policy.d.ts","sourceRoot":"","sources":["../src/egress-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAqB,MAAM,uBAAuB,CAAA;AAEnF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsB,CAAA;AACrD,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,cAAc,CAAA;AAEnD;;;;yEAIyE;AACzE,eAAO,MAAM,gBAAgB,gDAAiD,CAAA;AAE9E;uEACuE;AACvE,eAAO,MAAM,0BAA0B,gBAAgB,CAAA;AAKvD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAwBxE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAelE;AAED,MAAM,WAAW,oBAAoB;IACnC;mFAC+E;IAC/E,MAAM,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;+EAC2E;IAC3E,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B;sDACkD;IAClD,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC;qFACiF;IACjF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC;;+DAE2D;IAC3D,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE;IACtC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/B,GAAG,MAAM,EAAE,CAuBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,mBAAmB,CA6B1F"}

package/dist/error-response.d.ts

@@ -0,0 +1,9 @@
+interface ErrorResponsePayload {
+    error?: string;
+}
+export declare function isJsonErrorResponsePayload(response: Response, payload: unknown): payload is ErrorResponsePayload & {
+    error: string;
+};
+export declare function extractErrorMessage(response: Response): Promise<string>;
+export {};
+//# sourceMappingURL=error-response.d.ts.map

package/dist/error-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-response.d.ts","sourceRoot":"","sources":["../src/error-response.ts"],"names":[],"mappings":"AAEA,UAAU,oBAAoB;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CASrD;AAMD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAa7E"}

package/dist/file-parser.d.ts

@@ -0,0 +1,5 @@
+export declare function parseDatasetFile(filePath: string): {
+    rows: Array<Record<string, unknown>>;
+    sourceType: 'csv' | 'json' | 'jsonl';
+};
+//# sourceMappingURL=file-parser.d.ts.map

package/dist/file-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-parser.d.ts","sourceRoot":"","sources":["../src/file-parser.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAClD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACpC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;CACrC,CA6DA"}

package/dist/gepa-engine-dispatch.d.ts

@@ -0,0 +1,9 @@
+export type GepaEngine = 'official' | 'legacy';
+export interface GepaEngineDispatch {
+    engine: GepaEngine;
+    args: string[];
+    environment: NodeJS.ProcessEnv;
+    module: string;
+}
+export declare function dispatchGepaEngine(args: string[], project: string, environment: NodeJS.ProcessEnv): GepaEngineDispatch;
+//# sourceMappingURL=gepa-engine-dispatch.d.ts.map

package/dist/gepa-engine-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gepa-engine-dispatch.d.ts","sourceRoot":"","sources":["../src/gepa-engine-dispatch.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAA;AAE9C,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;CACf;AAuTD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,CAmBtH"}