@cursor/bdk 0.2.24 → 0.2.25

package/AGENTS.md

@@ -336,6 +336,7 @@ Fixtures still work for offline replay: `POST` a saved payload with an
 - Expect `bot/evals/` to be loaded — evals live at the **project root** `evals/`.
 - Build optional object fields with a conditional empty-object spread.
   Assign the property directly; `undefined` is fine on optional keys.
+  `bdk/no-conditional-empty-spread` enforces this.
 
   ```ts
   // ❌ BAD

package/dist/bin/agent-serve.d.ts

@@ -13,7 +13,7 @@
  *   agent-sdk convert-automation <url> [--dir <path>] [--json]
  *   agent-sdk migrate   [--dir .] [--no-wait] [--json]
  *   agent-sdk eval        [--dir .] [evalId...]
- *   agent-sdk validate   [--dir .]
+ *   agent-sdk validate   [--dir .] [--json]
  *   agent-sdk slack     <subcommand>
  */
 export {};

package/dist/bin/agent-serve.js

@@ -13,7 +13,7 @@
  *   agent-sdk convert-automation <url> [--dir <path>] [--json]
  *   agent-sdk migrate   [--dir .] [--no-wait] [--json]
  *   agent-sdk eval        [--dir .] [evalId...]
- *   agent-sdk validate   [--dir .]
+ *   agent-sdk validate   [--dir .] [--json]
  *   agent-sdk slack     <subcommand>
  */
 import { spawn } from "node:child_process";
@@ -22,6 +22,7 @@ import { resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { formatDiagnostics, projectInfo, resolveAgentMounts, serve } from "../index.js";
 import { registerAuthoredModuleLoaders } from "../internal/authored-loaders.js";
+import { formatValidateJson } from "../internal/discovery.js";
 import { cmdCall, cmdChat, cmdCost, cmdEval, cmdEvalCancel, cmdEvalStatus, cmdInit, cmdLogs, cmdPlayground, cmdResume, cmdRun, cmdSession, cmdSessions, cmdSkill, cmdTrajectory, } from "../internal/cli-ax.js";
 import { cmdCancelRuns, cmdDelete, cmdDeploy, cmdDeploymentStatus, cmdDeployments, cmdEventRepos, cmdKill, cmdRollback, cmdRotateToken, cmdSecretsList, cmdSecretsSet, cmdSecretsUnset, cmdStart, cmdStop, cmdUnlockDeploys, cmdUpgrade, } from "../internal/cli-deploy.js";
 import { cmdImagesList, cmdImagesPush, cmdImagesRm } from "../internal/cli-images.js";
@@ -99,7 +100,7 @@ Usage:
                           [--out <file.json>]
   ${CLI} eval cancel <runId> --url <baseUrl> [--dir <path>] [--json]
   ${CLI} info        [--dir <path>] [--json]
-  ${CLI} validate    [--dir <path>]
+  ${CLI} validate    [--dir <path>] [--json]
   ${CLI} login       [--api-key <key>] [--key-name <name>]
   ${CLI} logout
   ${CLI} whoami      [--json]
@@ -308,6 +309,8 @@ Commands:
               recipe (see gitlab help).
   bitbucket   Bitbucket webhook pack (Cloud + Data Center): replay a pull
               request, events, forward recipe (see bitbucket help).
+  pagerduty   PagerDuty webhook pack: replay synthesized incident events,
+              events (see pagerduty help).
 
 Agent loop:
   ${CLI} validate --dir .
@@ -442,7 +445,7 @@ Options:
   --skip-report      eval: ignore reporters from evals.config.ts / eval files.
   --no-stream        run/eval: silence live progress on stderr (JSON still prints).
   --json             JSON output (init/convert-automation/install-skills/
-                     info/chat/eval/logs/version/
+                     info/validate/chat/eval/logs/version/
                      sessions/session/github; run defaults to JSON). logs:
                      NDJSON progress/log events (v2: {sessionId, line}).
                      session: trajectory JSON
@@ -487,7 +490,7 @@ Options:
   --action           github/gitlab replay: event action (e.g. opened, open).
   --conclusion       github replay: CI conclusion (check_run/suite/status).
                      gitlab replay: pipeline status (success, failed, …).
-  --comment          github/gitlab/bitbucket replay: comment / note body.
+  --comment          github/gitlab/bitbucket/pagerduty replay: comment / note body.
   --context          github replay: commit-status context.
   --dry-run          github replay: print synthesized payloads, don't POST.
   --out              eval / eval status <runId>: also write the full results
@@ -726,6 +729,29 @@ async function main(argv) {
                 out: values.out,
             });
         }
+        case "pagerduty": {
+            const port = values.port === undefined ? undefined : Number.parseInt(values.port, 10);
+            if (port !== undefined && (Number.isNaN(port) || port < 0 || port > 65535)) {
+                process.stderr.write(`invalid --port: ${values.port}\n`);
+                return 1;
+            }
+            const { cmdPagerDuty } = await import("../internal/cli-pagerduty.js");
+            return cmdPagerDuty(positionals[0], {
+                dir,
+                slug: values.slug,
+                channel: values.channel?.at(-1),
+                host: values.host,
+                port,
+                url: values.url,
+                events: values.events,
+                secret: values.secret,
+                json: values.json,
+                incidentId: positionals[1],
+                comment: values.comment,
+                dryRun: values["dry-run"],
+                out: values.out,
+            });
+        }
         case "bitbucket": {
             const port = values.port === undefined ? undefined : Number.parseInt(values.port, 10);
             if (port !== undefined && (Number.isNaN(port) || port < 0 || port > 65535)) {
@@ -1172,16 +1198,20 @@ async function main(argv) {
         }
         case "validate": {
             const mounts = await loadMounts(dir);
-            let hasError = false;
-            for (const { slug, project } of mounts) {
-                const label = slug === "" ? project.name : `${slug} (${project.name})`;
-                if (project.diagnostics.length === 0) {
-                    process.stdout.write(`ok: ${label} has no diagnostics\n`);
-                    continue;
+            if (values.json === true) {
+                process.stdout.write(formatValidateJson(mounts));
+            }
+            else {
+                for (const { slug, project } of mounts) {
+                    const label = slug === "" ? project.name : `${slug} (${project.name})`;
+                    if (project.diagnostics.length === 0) {
+                        process.stdout.write(`ok: ${label} has no diagnostics\n`);
+                        continue;
+                    }
+                    process.stdout.write(`${label}:\n${formatDiagnostics(project.diagnostics)}\n`);
                 }
-                process.stdout.write(`${label}:\n${formatDiagnostics(project.diagnostics)}\n`);
-                hasError ||= project.diagnostics.some((d) => d.severity === "error");
             }
+            const hasError = mounts.some((mount) => mount.project.diagnostics.some((diagnostic) => diagnostic.severity === "error"));
             return hasError ? 1 : 0;
         }
         case "info": {
@@ -1570,6 +1600,12 @@ function printServeBanner(handle, opts) {
         handle.agents.some((agent) => projectInfo(agent.project).channels.some((c) => c.kind === "bitbucket"))) {
         process.stdout.write(c.dim(`  bitbucket: dev accepts unsigned loopback deliveries (${CLI} bitbucket replay works without a secret; set BITBUCKET_WEBHOOK_SECRET to verify X-Hub-Signature)\n`));
     }
+    if (opts.dev &&
+        (process.env.PAGERDUTY_WEBHOOK_SECRET === undefined ||
+            process.env.PAGERDUTY_WEBHOOK_SECRET === "") &&
+        handle.agents.some((agent) => projectInfo(agent.project).channels.some((c) => c.kind === "pagerduty"))) {
+        process.stdout.write(c.dim(`  pagerduty: dev accepts unsigned loopback deliveries (${CLI} pagerduty replay works without a secret; set PAGERDUTY_WEBHOOK_SECRET to verify X-PagerDuty-Signature)\n`));
+    }
 }
 /** Prefer the Vite playground URL in --dev; otherwise the static SPA path. */
 function resolvePlaygroundBannerUrl(handle, noPlayground) {

package/dist/channels/bitbucket/bitbucket-webhook.d.ts

@@ -19,8 +19,9 @@ export declare function resolveBitbucketWebhookSecret(options: Pick<BitbucketCha
 export declare function signBitbucketWebhookBody(rawBody: string | Buffer, secret: string): string;
 /**
  * Both dialects sign the raw body with HMAC-SHA256 in `X-Hub-Signature`
- * (`sha256=<hex>`, GitHub-shaped). Constant-time compare; a missing or
- * malformed header is a plain `false`.
+ * (`sha256=<hex>`, GitHub-shaped). `secret` is the named secret's value,
+ * which may hold several signing secrets one per line; any verifies.
+ * Constant-time compare; a missing or malformed header is a plain `false`.
  */
 export declare function verifyBitbucketWebhookSignature(rawBody: string | Buffer, signatureHeader: string | null | undefined, secret: string): boolean;
 /**

package/dist/channels/bitbucket/bitbucket-webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitbucket-webhook.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/bitbucket-webhook.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAqB,kBAAkB,EAAa,MAAM,gBAAgB,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAyBxD,OAAO,KAAK,EACV,uBAAuB,EAEvB,qBAAqB,EAGrB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAG9D;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,eAAe,CAAC,GACtD,MAAM,GAAG,SAAS,CAEpB;AAID,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,MAAM,GACb,OAAO,CAWT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,wBAAwB,GAAG,IAAI,CA2BjC;AAyED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,wBAAwB,GACjC,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAyBjF;AAwGD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgHpB;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,qEAAqE;IACrE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCpB"}
+{"version":3,"file":"bitbucket-webhook.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/bitbucket-webhook.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAqB,kBAAkB,EAAa,MAAM,gBAAgB,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAyBxD,OAAO,KAAK,EACV,uBAAuB,EAEvB,qBAAqB,EAGrB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAG9D;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,eAAe,CAAC,GACtD,MAAM,GAAG,SAAS,CAEpB;AAID,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,MAAM,GACb,OAAO,CAYT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,wBAAwB,GAAG,IAAI,CA2BjC;AAyED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,wBAAwB,GACjC,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAyBjF;AAwGD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgHpB;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,qEAAqE;IACrE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCpB"}

package/dist/channels/bitbucket/bitbucket-webhook.js

@@ -1,6 +1,7 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac } from "node:crypto";
 import { acknowledgeTask, isTaskDispatch, skipped, turnStarted, } from "../../internal/channel-dispatch.js";
 import { continuationSource } from "../../internal/continuation-identity.js";
+import { hmacSignatureMatchesAny, parseHmacSecrets } from "../../internal/hmac-secret-values.js";
 import { bindLocalIngressSend } from "../../internal/local-ingress.js";
 import { resolveWebhookSecretValue } from "../../internal/named-webhook-secret.js";
 import { asNonEmptyString, asPositiveInt, asRecord, bitbucketCommentFromPayload, bitbucketPullRequestFromPayload, bitbucketPullRequestRecord, bitbucketPullRequestUrl, bitbucketPushFromPayload, bitbucketRepositoryFromPayload, bitbucketUser, buildBitbucketBinding, } from "./binding.js";
@@ -33,18 +34,22 @@ export function signBitbucketWebhookBody(rawBody, secret) {
 }
 /**
  * Both dialects sign the raw body with HMAC-SHA256 in `X-Hub-Signature`
- * (`sha256=<hex>`, GitHub-shaped). Constant-time compare; a missing or
- * malformed header is a plain `false`.
+ * (`sha256=<hex>`, GitHub-shaped). `secret` is the named secret's value,
+ * which may hold several signing secrets one per line; any verifies.
+ * Constant-time compare; a missing or malformed header is a plain `false`.
  */
 export function verifyBitbucketWebhookSignature(rawBody, signatureHeader, secret) {
-    if (signatureHeader === null ||
-        signatureHeader === undefined ||
-        !signatureHeader.startsWith(SIGNATURE_PREFIX)) {
+    const parsed = parseHmacSecrets(secret);
+    if (signatureHeader === null || signatureHeader === undefined || !parsed.ok) {
         return false;
     }
-    const provided = Buffer.from(signatureHeader, "utf8");
-    const computed = Buffer.from(signBitbucketWebhookBody(rawBody, secret), "utf8");
-    return provided.length === computed.length && timingSafeEqual(provided, computed);
+    return hmacSignatureMatchesAny({
+        body: rawBody,
+        presented: signatureHeader,
+        secrets: parsed.secrets,
+        prefix: SIGNATURE_PREFIX,
+        separator: undefined,
+    });
 }
 /**
  * Accept a raw Bitbucket payload plus the event key. The key comes from

package/dist/channels/github/github-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/github/github-channel.ts"],"names":[],"mappings":"AA6BA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAMxB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,oBAAoB,EAKpB,aAAa,EAEb,qBAAqB,EACrB,kBAAkB,EAGlB,sBAAsB,EAKtB,kBAAkB,EAClB,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,KAAK,mBAAmB,GAAG,IAAI,CAC7B,kBAAkB,EAClB,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CACvD,CAAC;AAoFF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,GAAG,WAAW,CAkBvE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAU1F;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAEnE;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,MAAM,CAaR;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,kBAAkB,GAAG,IAAI,CAK3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,kBAAkB,GAAG,IAAI,CAW3B;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAUV;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAYlC;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,sBAAsB,CAAA;CAAE,GAAG,IAAI,CA8C3E;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,UAAU,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,UAAU,CAAC,CAc5E;AAqBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4FpB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8CpB;AAKD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE5F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,kBAAkB,CAAC,CA4GvC;AAKD,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAgBjE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuCrF;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAe/E;AAED,gEAAgE;AAChE,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAGxE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAMzE;AA+zBD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAcT"}
+{"version":3,"file":"github-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/github/github-channel.ts"],"names":[],"mappings":"AA6BA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAMxB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,oBAAoB,EAKpB,aAAa,EAEb,qBAAqB,EACrB,kBAAkB,EAGlB,sBAAsB,EAKtB,kBAAkB,EAClB,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,KAAK,mBAAmB,GAAG,IAAI,CAC7B,kBAAkB,EAClB,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CACvD,CAAC;AAoFF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,GAAG,WAAW,CAkBvE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAU1F;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAEnE;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,MAAM,CAaR;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,kBAAkB,GAAG,IAAI,CAK3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,kBAAkB,GAAG,IAAI,CAW3B;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAUV;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAYlC;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,sBAAsB,CAAA;CAAE,GAAG,IAAI,CA8C3E;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,UAAU,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,UAAU,CAAC,CAiB5E;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4FpB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8CpB;AAKD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE5F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,kBAAkB,CAAC,CA4GvC;AAKD,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAgBjE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuCrF;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAe/E;AAED,gEAAgE;AAChE,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAGxE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAMzE;AA+zBD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAcT"}

package/dist/channels/github/github-channel.js

@@ -1,9 +1,9 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
 import { z } from "zod/v3";
 import { allowAll, defineChannel, hmacSignatureAuth, localDevStrict, loopbackGitHubDev, POST, } from "../../channels.js";
 import { acknowledgeTask, acknowledgeTurn, isTaskDispatch, scheduleAfterAck, skipped, turnStarted, withPropagatingBackgroundErrors, } from "../../internal/channel-dispatch.js";
 import { continuationSource, normalizeIdentity } from "../../internal/continuation-identity.js";
 import { isDevMode } from "../../internal/dev-mode.js";
+import { hmacSignatureMatchesAny, parseHmacSecrets } from "../../internal/hmac-secret-values.js";
 import { attachHostedAdmissionAdapter } from "../../internal/hosted-admission-adapter.js";
 import { CATCH_DELIVERY_ID_HEADER, replayCatchRequest } from "../../internal/hosted-catch.js";
 import { AGENT_SDK_CATCH_EVENT_TYPE } from "../../internal/hosted-catch-protocol.js";
@@ -253,32 +253,23 @@ export function parseGitHubPullRequestEvent(args) {
     return { ctx, pullRequest };
 }
 export async function verifyGitHubWebhookSignature(args) {
-    const secret = await resolveCredentialValue(args.secret);
-    if (secret === undefined || secret === "") {
+    // A value over the secret cap holds no usable secret, the same as unset.
+    const parsed = parseHmacSecrets(await resolveCredentialValue(args.secret));
+    if (!parsed.ok) {
         return "missing_secret";
     }
     if (args.signatureHeader === null) {
         return "missing_signature";
     }
-    const isVerified = verifyWebhookSha256Signature({
-        secret,
+    const isVerified = hmacSignatureMatchesAny({
         body: args.body,
-        signatureHeader: args.signatureHeader,
+        presented: args.signatureHeader,
+        secrets: parsed.secrets,
+        prefix: GITHUB_SIGNATURE_PREFIX,
+        separator: undefined,
     });
     return isVerified ? "verified" : "mismatch";
 }
-function verifyWebhookSha256Signature(args) {
-    if (!args.signatureHeader.startsWith(GITHUB_SIGNATURE_PREFIX)) {
-        return false;
-    }
-    const receivedHex = args.signatureHeader.slice(GITHUB_SIGNATURE_PREFIX.length);
-    if (!/^[0-9a-f]+$/i.test(receivedHex) || receivedHex.length % 2 !== 0) {
-        return false;
-    }
-    const expected = createHmac("sha256", args.secret).update(args.body).digest();
-    const received = Buffer.from(receivedHex, "hex");
-    return received.length === expected.length && timingSafeEqual(received, expected);
-}
 /**
  * Run the authored hooks for one GitHub delivery and `send()` the turn.
  * Callers own delivery auth: the HTTP route verifies the HMAC; trigger

package/dist/channels/pagerduty/api.d.ts

@@ -0,0 +1,74 @@
+/**
+ * A minimal PagerDuty REST client for write-backs (notes, incident updates).
+ * Every credential defaults to a well-known env var / deployment secret and
+ * is read per call, so a hosted deployment, which receives its secrets per
+ * request, sees them.
+ */
+import type { WebhookSecretValue } from "../../internal/named-webhook-secret.js";
+import type { PagerDutyChannelOptions } from "./types.js";
+/**
+ * API token: a REST API key (user or account level), or an OAuth access
+ * token written as `Bearer <token>`.
+ */
+export declare const PAGERDUTY_TOKEN_ENV = "PAGERDUTY_TOKEN";
+/** REST base override, e.g. `https://api.eu.pagerduty.com` for the EU service region. */
+export declare const PAGERDUTY_API_BASE_URL_ENV = "PAGERDUTY_API_BASE_URL";
+/** `From` email for write calls made with an account-level REST API key. */
+export declare const PAGERDUTY_FROM_EMAIL_ENV = "PAGERDUTY_FROM_EMAIL";
+export declare const PAGERDUTY_DEFAULT_API_BASE_URL = "https://api.pagerduty.com";
+/**
+ * The REST base for a call: the authored `apiBaseUrl`, else
+ * `PAGERDUTY_API_BASE_URL`, else `https://api.pagerduty.com`.
+ */
+export declare function pagerDutyApiBaseUrl(apiBaseUrl?: string): string;
+/**
+ * `Authorization` for a token: a value already written as `Bearer <token>`
+ * (an OAuth access token) is sent as-is; anything else is a REST API key.
+ */
+export declare function pagerDutyAuthorizationHeader(token: string): string;
+export interface PagerDutyClientOptions {
+    /** Falls back to `PAGERDUTY_TOKEN`. */
+    token?: WebhookSecretValue;
+    /** Falls back to `PAGERDUTY_API_BASE_URL`, else `https://api.pagerduty.com`. */
+    apiBaseUrl?: string;
+    /**
+     * Email of a PagerDuty user, sent as `From` on every call. PagerDuty
+     * requires it for writes made with an account-level API key; a user token
+     * acts as its own user. Falls back to `PAGERDUTY_FROM_EMAIL`.
+     */
+    from?: WebhookSecretValue;
+    /** Fetch implementation; defaults to the global `fetch`. */
+    fetch?: typeof fetch;
+}
+export declare class PagerDutyApiError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(input: {
+        method: string;
+        path: string;
+        status: number;
+        body: string;
+    });
+}
+export interface PagerDutyClient {
+    /** One REST call; `path` is relative to the API base, e.g. `/incidents/PINC001`. */
+    request<T = unknown>(input: {
+        method: string;
+        path: string;
+        body?: unknown;
+    }): Promise<T>;
+    /** `POST /incidents/{id}/notes`. Returns the created note. */
+    addNote(input: {
+        incidentId: string;
+        content: string;
+    }): Promise<{
+        id: string;
+        content: string;
+    }>;
+    /** `GET /incidents/{id}`, the incident's current state. */
+    getIncident(incidentId: string): Promise<Record<string, unknown>>;
+}
+export declare function createPagerDutyClient(options?: PagerDutyClientOptions): PagerDutyClient;
+/** The REST client for a channel's credentials, each falling back to its well-known secret. */
+export declare function pagerDutyChannelClient(options: Pick<PagerDutyChannelOptions, "token" | "from" | "apiBaseUrl">): PagerDutyClient;
+//# sourceMappingURL=api.d.ts.map

package/dist/channels/pagerduty/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/pagerduty/api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AACnE,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,MAAM,WAAW,sBAAsB;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAKhF;CACF;AAED,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1F,8DAA8D;IAC9D,OAAO,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClG,2DAA2D;IAC3D,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnE;AAED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAyD3F;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC,GACtE,eAAe,CAMjB"}

package/dist/channels/pagerduty/api.js

@@ -0,0 +1,101 @@
+/**
+ * A minimal PagerDuty REST client for write-backs (notes, incident updates).
+ * Every credential defaults to a well-known env var / deployment secret and
+ * is read per call, so a hosted deployment, which receives its secrets per
+ * request, sees them.
+ */
+import { pagerDutySecretName, resolvePagerDutySecret } from "./secrets.js";
+/**
+ * API token: a REST API key (user or account level), or an OAuth access
+ * token written as `Bearer <token>`.
+ */
+export const PAGERDUTY_TOKEN_ENV = "PAGERDUTY_TOKEN";
+/** REST base override, e.g. `https://api.eu.pagerduty.com` for the EU service region. */
+export const PAGERDUTY_API_BASE_URL_ENV = "PAGERDUTY_API_BASE_URL";
+/** `From` email for write calls made with an account-level REST API key. */
+export const PAGERDUTY_FROM_EMAIL_ENV = "PAGERDUTY_FROM_EMAIL";
+export const PAGERDUTY_DEFAULT_API_BASE_URL = "https://api.pagerduty.com";
+/**
+ * The REST base for a call: the authored `apiBaseUrl`, else
+ * `PAGERDUTY_API_BASE_URL`, else `https://api.pagerduty.com`.
+ */
+export function pagerDutyApiBaseUrl(apiBaseUrl) {
+    return (apiBaseUrl ??
+        resolvePagerDutySecret(undefined, PAGERDUTY_API_BASE_URL_ENV) ??
+        PAGERDUTY_DEFAULT_API_BASE_URL).replace(/\/+$/, "");
+}
+/**
+ * `Authorization` for a token: a value already written as `Bearer <token>`
+ * (an OAuth access token) is sent as-is; anything else is a REST API key.
+ */
+export function pagerDutyAuthorizationHeader(token) {
+    return /^bearer\s/i.test(token) ? token : `Token token=${token}`;
+}
+export class PagerDutyApiError extends Error {
+    constructor(input) {
+        super(`PagerDuty ${input.method} ${input.path} failed with ${input.status}`);
+        this.name = "PagerDutyApiError";
+        this.status = input.status;
+        this.body = input.body;
+    }
+}
+export function createPagerDutyClient(options = {}) {
+    const request = async (input) => {
+        const token = resolvePagerDutySecret(options.token, PAGERDUTY_TOKEN_ENV);
+        if (token === undefined) {
+            const name = pagerDutySecretName(options.token, PAGERDUTY_TOKEN_ENV) ?? PAGERDUTY_TOKEN_ENV;
+            throw new Error(`PagerDuty API token is not set: set ${name} (\`bdk secrets set <slug> ${name}\`) or pass \`token\`.`);
+        }
+        const from = resolvePagerDutySecret(options.from, PAGERDUTY_FROM_EMAIL_ENV);
+        const base = pagerDutyApiBaseUrl(options.apiBaseUrl);
+        const headers = {
+            Accept: "application/vnd.pagerduty+json;version=2",
+            Authorization: pagerDutyAuthorizationHeader(token),
+            "Content-Type": "application/json",
+        };
+        if (from !== undefined) {
+            headers.From = from;
+        }
+        const response = await (options.fetch ?? fetch)(`${base}${input.path}`, {
+            method: input.method,
+            headers,
+            body: input.body === undefined ? undefined : JSON.stringify(input.body),
+        });
+        const text = await response.text();
+        if (!response.ok) {
+            throw new PagerDutyApiError({
+                method: input.method,
+                path: input.path,
+                status: response.status,
+                body: text,
+            });
+        }
+        return (text === "" ? undefined : JSON.parse(text));
+    };
+    return {
+        request,
+        addNote: async ({ incidentId, content }) => {
+            const created = await request({
+                method: "POST",
+                path: `/incidents/${encodeURIComponent(incidentId)}/notes`,
+                body: { note: { content } },
+            });
+            return created.note;
+        },
+        getIncident: async (incidentId) => {
+            const found = await request({
+                method: "GET",
+                path: `/incidents/${encodeURIComponent(incidentId)}`,
+            });
+            return found.incident;
+        },
+    };
+}
+/** The REST client for a channel's credentials, each falling back to its well-known secret. */
+export function pagerDutyChannelClient(options) {
+    return createPagerDutyClient({
+        token: options.token,
+        from: options.from,
+        apiBaseUrl: options.apiBaseUrl,
+    });
+}

package/dist/channels/pagerduty/defaults.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Default dispatch decisions for the PagerDuty channel: turn auth derived
+ * from the event's agent, the title and message a turn starts with, which
+ * lifecycle events dispatch when no `onIncident` hook exists, and the
+ * stream handlers that post replies back to the incident.
+ */
+import type { AuthContext, ChannelEventHandlers } from "../../types.js";
+import type { PagerDutyChannelState } from "./state.js";
+import type { PagerDutyChannelOptions, PagerDutyEventContext, PagerDutyIncidentEvent, PagerDutyTurnDispatch } from "./types.js";
+type DispatchContext = Omit<PagerDutyEventContext, "host" | "artifacts" | "send" | "pagerduty">;
+/**
+ * Derive the turn's auth from who made the change: a PagerDuty user, a
+ * service integration, or PagerDuty itself. The webhook subscriber is not
+ * the turn principal (same pattern as `defaultGitHubAuth`).
+ */
+export declare function defaultPagerDutyAuth(ctx: DispatchContext): AuthContext;
+export declare function defaultPagerDutyTitle(ctx: Pick<PagerDutyEventContext, "eventType" | "incidentId">, incident?: {
+    number?: number;
+    title?: string;
+}): string;
+/** The facts of a lifecycle event, one per line, for the turn's first message. */
+export declare function defaultPagerDutyIncidentMessage(ctx: DispatchContext, event: PagerDutyIncidentEvent): string;
+/**
+ * Default gate when no `onIncident` hook is declared: a new or reopened
+ * incident starts a turn as the event's agent. Acknowledgements,
+ * escalations, and resolves are acknowledged without one.
+ */
+export declare function defaultPagerDutyIncidentDispatch(ctx: DispatchContext, event: PagerDutyIncidentEvent): PagerDutyTurnDispatch | null;
+/**
+ * Opt-in delivery (`deliverReplies: true`): post each completed assistant
+ * reply as a note on the session's incident, and a short note when a turn
+ * or session fails. Skipped when the session names no incident or is an
+ * eval run, or when the channel has no token (a read-only agent).
+ *
+ * A posted note comes back as an `incident.annotated` event, which only the
+ * echo skip keeps from starting another turn. So nothing is posted until the
+ * agent's own PagerDuty user resolves (see `selfUserIds`); until then each
+ * skipped note logs a warning.
+ */
+export declare function buildDefaultPagerDutyEvents(options: Pick<PagerDutyChannelOptions, "deliverReplies" | "selfUserIds" | "token" | "from" | "apiBaseUrl">): ChannelEventHandlers<PagerDutyChannelState>;
+export {};
+//# sourceMappingURL=defaults.d.ts.map

package/dist/channels/pagerduty/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/channels/pagerduty/defaults.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAIxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAEpB,KAAK,eAAe,GAAG,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC;AAEhG;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,WAAW,CA2BtE;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,GAAG,YAAY,CAAC,EAC5D,QAAQ,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,MAAM,CAOR;AAED,kFAAkF;AAClF,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,sBAAsB,GAC5B,MAAM,CAeR;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,sBAAsB,GAC5B,qBAAqB,GAAG,IAAI,CAK9B;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,IAAI,CACX,uBAAuB,EACvB,gBAAgB,GAAG,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,CACnE,GACA,oBAAoB,CAAC,qBAAqB,CAAC,CAgD7C"}

package/dist/channels/pagerduty/defaults.js

@@ -0,0 +1,132 @@
+/**
+ * Default dispatch decisions for the PagerDuty channel: turn auth derived
+ * from the event's agent, the title and message a turn starts with, which
+ * lifecycle events dispatch when no `onIncident` hook exists, and the
+ * stream handlers that post replies back to the incident.
+ */
+import { PAGERDUTY_TOKEN_ENV, pagerDutyChannelClient } from "./api.js";
+import { resolvePagerDutySecret } from "./secrets.js";
+import { PAGERDUTY_USER_ID_ENV, resolvePagerDutySelfUserIds } from "./self-user.js";
+/**
+ * Derive the turn's auth from who made the change: a PagerDuty user, a
+ * service integration, or PagerDuty itself. The webhook subscriber is not
+ * the turn principal (same pattern as `defaultGitHubAuth`).
+ */
+export function defaultPagerDutyAuth(ctx) {
+    const agent = ctx.agent;
+    const isUser = agent?.type === "user_reference" || agent?.type === "user";
+    const attributes = {
+        conversation_kind: "incident",
+        event_type: ctx.eventType,
+        event_id: ctx.eventId,
+        issuer: ctx.accountSubdomain === undefined ? "pagerduty" : `pagerduty:${ctx.accountSubdomain}`,
+    };
+    if (ctx.incidentId !== undefined) {
+        attributes.incident_id = ctx.incidentId;
+    }
+    if (ctx.incidentKey !== undefined) {
+        attributes.incident_key = ctx.incidentKey;
+    }
+    if (ctx.deliveryId !== undefined) {
+        attributes.delivery_id = ctx.deliveryId;
+    }
+    if (agent !== undefined) {
+        attributes.subject = agent.id;
+    }
+    return {
+        authenticator: "pagerduty-webhook",
+        principalId: agent === undefined ? "pagerduty" : `pagerduty:${agent.id}`,
+        principalType: isUser ? "user" : "service",
+        attributes,
+    };
+}
+export function defaultPagerDutyTitle(ctx, incident) {
+    if (incident?.number !== undefined && incident.title !== undefined) {
+        return `PagerDuty #${incident.number}: ${incident.title}`;
+    }
+    return ctx.incidentId === undefined
+        ? `PagerDuty ${ctx.eventType}`
+        : `PagerDuty incident ${ctx.incidentId}`;
+}
+/** The facts of a lifecycle event, one per line, for the turn's first message. */
+export function defaultPagerDutyIncidentMessage(ctx, event) {
+    const incident = event.incident;
+    return [
+        `PagerDuty ${ctx.eventType}: ${incident.number === undefined ? incident.id : `#${incident.number}`}`,
+        ...(incident.title === undefined ? [] : [`Title: ${incident.title}`]),
+        ...(incident.status === undefined ? [] : [`Status: ${incident.status}`]),
+        ...(incident.urgency === undefined ? [] : [`Urgency: ${incident.urgency}`]),
+        ...(incident.service?.summary === undefined ? [] : [`Service: ${incident.service.summary}`]),
+        ...(incident.priority?.summary === undefined ? [] : [`Priority: ${incident.priority.summary}`]),
+        ...(incident.incidentKey === undefined ? [] : [`Incident key: ${incident.incidentKey}`]),
+        ...(incident.htmlUrl === undefined ? [] : [`URL: ${incident.htmlUrl}`]),
+        ...(ctx.agent?.summary === undefined ? [] : [`By: ${ctx.agent.summary}`]),
+        ...(ctx.occurredAt === undefined ? [] : [`Occurred at: ${ctx.occurredAt}`]),
+        "Handle this PagerDuty incident event.",
+    ].join("\n");
+}
+/**
+ * Default gate when no `onIncident` hook is declared: a new or reopened
+ * incident starts a turn as the event's agent. Acknowledgements,
+ * escalations, and resolves are acknowledged without one.
+ */
+export function defaultPagerDutyIncidentDispatch(ctx, event) {
+    if (event.eventType !== "incident.triggered" && event.eventType !== "incident.reopened") {
+        return null;
+    }
+    return { auth: defaultPagerDutyAuth(ctx) };
+}
+const PAGERDUTY_FAILURE_NOTE = "The agent hit an error while handling this incident. Check the agent's session for details.";
+/**
+ * Opt-in delivery (`deliverReplies: true`): post each completed assistant
+ * reply as a note on the session's incident, and a short note when a turn
+ * or session fails. Skipped when the session names no incident or is an
+ * eval run, or when the channel has no token (a read-only agent).
+ *
+ * A posted note comes back as an `incident.annotated` event, which only the
+ * echo skip keeps from starting another turn. So nothing is posted until the
+ * agent's own PagerDuty user resolves (see `selfUserIds`); until then each
+ * skipped note logs a warning.
+ */
+export function buildDefaultPagerDutyEvents(options) {
+    if (options.deliverReplies !== true) {
+        return {};
+    }
+    const postNote = async (state, content) => {
+        if (state.incidentId === null ||
+            resolvePagerDutySecret(options.token, PAGERDUTY_TOKEN_ENV) === undefined) {
+            return;
+        }
+        if ((await resolvePagerDutySelfUserIds({ options })).size === 0) {
+            console.warn(`[bdk/pagerduty] warn not posting a reply note to incident ${state.incidentId}: the agent's own PagerDuty user is unknown, so the note would come back as a new event. Set ${PAGERDUTY_USER_ID_ENV} or selfUserIds, or use a token that names one user.`);
+            return;
+        }
+        try {
+            await pagerDutyChannelClient(options).addNote({ incidentId: state.incidentId, content });
+        }
+        catch (error) {
+            console.warn(`[bdk/pagerduty] warn could not post a note to incident ${state.incidentId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+    return {
+        async "message.completed"(event, channel, ctx) {
+            if (ctx.session.purpose === "eval" ||
+                event.data.parentCallId !== undefined ||
+                event.data.finishReason === "tool_call" ||
+                event.data.text === "") {
+                return;
+            }
+            await postNote(channel.state, event.data.text);
+        },
+        async "turn.failed"(_event, channel, ctx) {
+            if (ctx.session.purpose !== "eval") {
+                await postNote(channel.state, PAGERDUTY_FAILURE_NOTE);
+            }
+        },
+        async "session.failed"(_event, channel, ctx) {
+            if (ctx.session.purpose !== "eval") {
+                await postNote(channel.state, PAGERDUTY_FAILURE_NOTE);
+            }
+        },
+    };
+}