@atolis-hq/wake 0.4.35 → 0.4.37

package/dist/src/integrations/github/infrastructure/webhook.js

@@ -0,0 +1,148 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { GitHubWebhookStateStore } from './webhook-state.js';
+const events = new Set([
+    'issues',
+    'issue_comment',
+    'pull_request',
+    'pull_request_review',
+    'pull_request_review_comment',
+    'check_run',
+    'status',
+]);
+export function createGitHubWebhook(adapter, config, publicUrl, root, client, health) {
+    const state = new GitHubWebhookStateStore(root, adapter);
+    const endpoint = publicUrl === undefined ? undefined : webhookEndpoint(publicUrl);
+    return {
+        async provision() {
+            for (const repository of config.repositories) {
+                if (!config.webhooks.enabled)
+                    continue;
+                if (endpoint === undefined) {
+                    health.recordFailure(`${repository.owner}/${repository.repo}`, 'webhook', new Error('surfaces.web.publicUrl is not configured'));
+                    continue;
+                }
+                try {
+                    await state.serialise(repository.owner, repository.repo, () => provisionRepository(repository, endpoint, state, client, health));
+                }
+                catch (error) {
+                    health.recordFailure(`${repository.owner}/${repository.repo}`, 'webhook', error);
+                }
+            }
+        },
+        async receive(body, headers, trigger) {
+            if (!config.webhooks.enabled)
+                return 404;
+            const signature = header(headers, 'x-hub-signature-256');
+            if (signature === undefined)
+                return 401;
+            const event = header(headers, 'x-github-event');
+            if (event === undefined)
+                return 400;
+            const fullName = parseRepository(body);
+            if (fullName === null)
+                return 400;
+            if (fullName === undefined)
+                return 404;
+            const [owner, repo] = fullName.split('/');
+            if (owner === undefined ||
+                repo === undefined ||
+                !config.repositories.some((value) => value.owner === owner && value.repo === repo))
+                return 404;
+            return state.serialise(owner, repo, async () => {
+                const saved = await state.load(owner, repo);
+                const expected = `sha256=${createHmac('sha256', saved.secret).update(body).digest('hex')}`;
+                if (!safeEqual(signature, expected))
+                    return 401;
+                if (!events.has(event))
+                    return 404;
+                trigger();
+                return 202;
+            });
+        },
+    };
+}
+async function provisionRepository(repository, endpoint, state, client, health) {
+    const scope = `${repository.owner}/${repository.repo}`;
+    try {
+        const saved = await state.load(repository.owner, repository.repo);
+        if (saved.hookId !== undefined &&
+            (await updateManagedHook(repository, endpoint, saved, client))) {
+            health.recordSuccess(scope, 'webhook');
+            return;
+        }
+        const hookId = await client.createHook({
+            ...repository,
+            url: endpoint,
+            secret: saved.secret,
+            events: [...events],
+        });
+        await state.save(repository.owner, repository.repo, { ...saved, hookId });
+        health.recordSuccess(scope, 'webhook');
+    }
+    catch (error) {
+        health.recordFailure(scope, 'webhook', error);
+    }
+}
+async function updateManagedHook(repository, endpoint, saved, client) {
+    if (saved.hookId === undefined)
+        return false;
+    try {
+        await client.getHook(repository.owner, repository.repo, saved.hookId);
+        await client.updateHook({
+            ...repository,
+            hookId: saved.hookId,
+            url: endpoint,
+            secret: saved.secret,
+            events: [...events],
+        });
+        return true;
+    }
+    catch (error) {
+        if (statusOf(error) === 404)
+            return false;
+        throw error;
+    }
+}
+function header(headers, name) {
+    const value = headers[name] ?? headers[name.toLowerCase()];
+    return Array.isArray(value) ? value[0] : value;
+}
+function repositoryName(value) {
+    if (typeof value !== 'object' ||
+        value === null ||
+        !('full_name' in value) ||
+        typeof value.full_name !== 'string')
+        return undefined;
+    return value.full_name;
+}
+function parseRepository(body) {
+    try {
+        const payload = JSON.parse(body.toString('utf8'));
+        if (typeof payload !== 'object' || payload === null || !('repository' in payload))
+            return null;
+        return repositoryName(payload.repository);
+    }
+    catch {
+        return null;
+    }
+}
+function safeEqual(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function statusOf(error) {
+    return typeof error === 'object' &&
+        error !== null &&
+        'status' in error &&
+        typeof error.status === 'number'
+        ? error.status
+        : undefined;
+}
+function webhookEndpoint(publicUrl) {
+    const base = new URL(publicUrl);
+    base.pathname = `${base.pathname.replace(/\/$/, '')}/webhooks/github`;
+    base.search = '';
+    base.hash = '';
+    return base.href;
+}

package/dist/src/integrations/github/provider.js

@@ -14,6 +14,7 @@ import { createGitHubDelivery } from './infrastructure/delivery.js';
 import { resolveGitHubCliToken } from './infrastructure/gh-auth.js';
 import { createGitHubRequestCoordinator } from './infrastructure/request-coordinator.js';
 import { createGitHubSource } from './infrastructure/source.js';
+import { createGitHubWebhook } from './infrastructure/webhook.js';
 export const gitHubProviderDefinition = {
     provider: 'github',
     eventTypes: Object.values(GitHubEventType),
@@ -59,6 +60,7 @@ export const gitHubProviderDefinition = {
                 requests,
             }),
             health: () => health.snapshotAll(),
+            webhook: createGitHubWebhook(adapter, config, services.publicUiUrl, services.providerStateRoot, client, health),
             commands: () => [
                 ...Object.values(GitHubBuiltInCommand).map((syntax) => ({ syntax })),
                 ...config.commands.map((syntax) => ({ syntax })),

package/dist/src/surfaces/api/contracts/control-plane.d.ts

@@ -1,12 +1,12 @@
 import { type ValueOf } from '../../../kernel/index.js';
 export interface ControlPlaneStatusResponse {
-    readonly paused: boolean;
-    readonly pausedUntil?: string;
-    readonly reason?: string;
+    readonly dispatchPaused: boolean;
+    readonly dispatchPausedUntil?: string;
+    readonly dispatchPauseReason?: string;
     readonly updatedAt: string;
     /**
      * A retained update-maintenance lease pauses every resident loop
-     * (intake and dispatch) independent of `paused`/`pausedUntil`, which only
+     * (intake and dispatch) independent of `dispatchPaused`/`dispatchPausedUntil`, which only
      * reflect an explicit pause or a runner-quota backoff. Present whenever a
      * lease exists, including a failed one -- see update-maintenance-lease.ts.
      */

package/dist/src/surfaces/api/http-server.d.ts

@@ -24,6 +24,7 @@ export interface SurfaceHttpServerOptions {
         readonly disabled: boolean;
         readonly redeemGrant: (grant: string) => Promise<boolean>;
     };
+    readonly webhookReceiver?: (body: Buffer, headers: Readonly<Record<string, string | string[] | undefined>>) => Promise<number>;
 }
 /**
  * The production HTTP surface. Public login routes are declared separately;

package/dist/src/surfaces/api/http-server.js

@@ -41,6 +41,17 @@ export function createSurfaceHttpServer(options) {
             return sendFastifyJson(reply, errorResult(new MalformedJsonError()), false);
         return sendFastifyJson(reply, errorResult(error), false);
     });
+    if (options.webhookReceiver !== undefined) {
+        app.register((webhooks, _pluginOptions, done) => {
+            webhooks.removeAllContentTypeParsers();
+            webhooks.addContentTypeParser('*', { parseAs: 'buffer' }, (_request, body, callback) => callback(null, body));
+            webhooks.post('/github', { bodyLimit: 64 * 1024 }, async (request, reply) => {
+                const status = await options.webhookReceiver(request.body, request.headers);
+                return reply.code(status).send();
+            });
+            done();
+        }, { prefix: '/webhooks' });
+    }
     app.get('/api/v1/auth/session', async (request, reply) => {
         if (authDisabled)
             return { authenticated: true };

package/dist/src/surfaces/api/routes/applications.d.ts

@@ -47,8 +47,8 @@ export interface ApiApplications {
     };
     readonly controlPlane: {
         status(): Promise<ApiResourceResult<ControlPlaneStatusResponse>>;
-        pause?(command: ApiCommandRequest): Promise<ApiCommandResult>;
-        resume?(command: ApiCommandRequest): Promise<ApiCommandResult>;
+        pauseDispatch?(command: ApiCommandRequest): Promise<ApiCommandResult>;
+        resumeDispatch?(command: ApiCommandRequest): Promise<ApiCommandResult>;
         clearMaintenance?(command: ApiClearMaintenanceRequest): Promise<ApiCommandResult>;
     };
     readonly work: {

package/dist/src/surfaces/api/routes/commands.js

@@ -94,7 +94,13 @@ function controlCommandName(pathname) {
     if (!pathname.startsWith(prefix))
         return undefined;
     const name = pathname.slice(prefix.length);
-    return name === 'pause' || name === 'resume' || name === 'clear-maintenance' ? name : undefined;
+    if (name === 'pause-dispatch')
+        return 'pauseDispatch';
+    if (name === 'resume-dispatch')
+        return 'resumeDispatch';
+    if (name === 'clear-maintenance')
+        return 'clear-maintenance';
+    return undefined;
 }
 async function dispatchMaintenanceClear(applications, pathname, body) {
     if (pathname !== '/api/v1/control-plane/commands/clear-maintenance')

package/dist/src/surfaces/api/routes/control-plane.d.ts

@@ -1 +1 @@
-export declare const controlPlaneRoutes: readonly ["/api/v1/control-plane/status", "/api/v1/control-plane/commands/pause", "/api/v1/control-plane/commands/resume", "/api/v1/control-plane/commands/clear-maintenance"];
+export declare const controlPlaneRoutes: readonly ["/api/v1/control-plane/status", "/api/v1/control-plane/commands/pause-dispatch", "/api/v1/control-plane/commands/resume-dispatch", "/api/v1/control-plane/commands/clear-maintenance"];

package/dist/src/surfaces/api/routes/control-plane.js

@@ -1,6 +1,6 @@
 export const controlPlaneRoutes = [
     '/api/v1/control-plane/status',
-    '/api/v1/control-plane/commands/pause',
-    '/api/v1/control-plane/commands/resume',
+    '/api/v1/control-plane/commands/pause-dispatch',
+    '/api/v1/control-plane/commands/resume-dispatch',
     '/api/v1/control-plane/commands/clear-maintenance',
 ];