@cursor/bdk 0.2.9 → 0.2.11

package/dist/channels/github/github-channel.js

@@ -1,15 +1,6 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { z } from "zod";
-import { allowAll, defineChannel, localDevStrict, loopbackGitHubDev, POST, } from "../../channels.js";
+import { allowAll, defineChannel, hmacSignatureAuth, localDevStrict, loopbackGitHubDev, POST, } from "../../channels.js";
 import { acknowledgeTask, acknowledgeTurn, isTaskDispatch, scheduleAfterAck, skipped, turnStarted, withPropagatingBackgroundErrors, } from "../../internal/channel-dispatch.js";
 import { continuationSource, normalizeIdentity } from "../../internal/continuation-identity.js";
 import { isDevMode } from "../../internal/dev-mode.js";
@@ -17,9 +8,11 @@ import { attachHostedAdmissionAdapter } from "../../internal/hosted-admission-ad
 import { CATCH_DELIVERY_ID_HEADER, replayCatchRequest } from "../../internal/hosted-catch.js";
 import { AGENT_SDK_CATCH_EVENT_TYPE } from "../../internal/hosted-catch-protocol.js";
 import { bindLocalIngressSend } from "../../internal/local-ingress.js";
+import { envSecretRef, namedWebhookSecretArchitectureError, } from "../../internal/named-webhook-secret.js";
+import { isSecretRef, } from "../../types.js";
 import { resolveCredentialValue } from "./auth.js";
 import { buildGitHubBinding, } from "./binding.js";
-import { createCursorAccountGithubTokenResolver, createPendingCursorGithubCredentials, cursorGithubPermissionsForChannel, parseCursorGithubRepoScope, registerGithubCursorAccountRuntime, } from "./cursor-account.js";
+import { createCursorAccountGithubTokenResolver, createPendingCursorGithubCredentials, cursorGithubPermissionsForChannel, isCursorAccountGithubTokenResolver, parseCursorGithubRepoScope, registerGithubCursorAccountRuntime, } from "./cursor-account.js";
 import { buildDefaultGitHubEvents } from "./defaults.js";
 import { deriveGitHubWebhookEvents, GITHUB_CHANNEL_KIND } from "./events.js";
 import { emptyGitHubChannelState, githubBindingStateForEvent, } from "./state.js";
@@ -105,14 +98,22 @@ const githubPullRequestPayloadSchema = z.object({
  * standard `{ auth: defaultGitHubAuth(ctx) }` dispatch from an inbound hook.
  */
 export function defaultGitHubAuth(ctx) {
-    var _a, _b, _c;
-    var _d;
-    const senderId = (_a = ctx.sender) === null || _a === void 0 ? void 0 : _a.id;
+    const senderId = ctx.sender?.id;
     return {
         authenticator: "github-webhook",
-        principalId: senderId !== undefined ? `github:${senderId}` : ((_d = ctx.senderLogin) !== null && _d !== void 0 ? _d : "github"),
-        principalType: ((_b = ctx.sender) === null || _b === void 0 ? void 0 : _b.type) === "Bot" ? "service" : "user",
-        attributes: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ conversation_kind: ctx.conversation.kind }, (ctx.deliveryId === undefined ? {} : { delivery_id: ctx.deliveryId })), (ctx.installationId === undefined ? {} : { installation_id: String(ctx.installationId) })), { repository: ctx.repository.fullName }), (ctx.repository.id === undefined ? {} : { repository_id: String(ctx.repository.id) })), (ctx.senderLogin === undefined ? {} : { user_login: ctx.senderLogin })), (((_c = ctx.sender) === null || _c === void 0 ? void 0 : _c.type) === undefined ? {} : { user_type: ctx.sender.type })), (ctx.repository.owner === "" ? {} : { issuer: `github:${ctx.repository.owner}` })), (ctx.senderLogin === undefined ? {} : { subject: ctx.senderLogin })),
+        principalId: senderId !== undefined ? `github:${senderId}` : (ctx.senderLogin ?? "github"),
+        principalType: ctx.sender?.type === "Bot" ? "service" : "user",
+        attributes: {
+            conversation_kind: ctx.conversation.kind,
+            ...(ctx.deliveryId === undefined ? {} : { delivery_id: ctx.deliveryId }),
+            ...(ctx.installationId === undefined ? {} : { installation_id: String(ctx.installationId) }),
+            repository: ctx.repository.fullName,
+            ...(ctx.repository.id === undefined ? {} : { repository_id: String(ctx.repository.id) }),
+            ...(ctx.senderLogin === undefined ? {} : { user_login: ctx.senderLogin }),
+            ...(ctx.sender?.type === undefined ? {} : { user_type: ctx.sender.type }),
+            ...(ctx.repository.owner === "" ? {} : { issuer: `github:${ctx.repository.owner}` }),
+            ...(ctx.senderLogin === undefined ? {} : { subject: ctx.senderLogin }),
+        },
     };
 }
 export function githubContinuationKey(ctx) {
@@ -181,8 +182,7 @@ export function defaultOnComment(ctx, comment, options) {
     return { auth: defaultGitHubAuth(ctx) };
 }
 export function shouldDispatchGitHubComment(args) {
-    var _a;
-    const botName = (_a = args.botName) === null || _a === void 0 ? void 0 : _a.trim();
+    const botName = args.botName?.trim();
     if (botName === undefined || botName === "") {
         return false;
     }
@@ -193,8 +193,7 @@ export function shouldDispatchGitHubComment(args) {
     return mention.test(args.body);
 }
 export function extractGitHubCommentTrigger(args) {
-    var _a;
-    const botName = (_a = args.botName) === null || _a === void 0 ? void 0 : _a.trim();
+    const botName = args.botName?.trim();
     if (botName === undefined || botName === "") {
         const trimmed = args.body.trim();
         return trimmed === "" ? undefined : { message: trimmed };
@@ -207,8 +206,6 @@ export function extractGitHubCommentTrigger(args) {
     return { message: stripped };
 }
 export function parseGitHubPullRequestEvent(args) {
-    var _a, _b, _c, _d, _e, _f;
-    var _g;
     const parsed = githubPullRequestPayloadSchema.safeParse(args.payload);
     if (!parsed.success) {
         return null;
@@ -216,46 +213,65 @@ export function parseGitHubPullRequestEvent(args) {
     const payload = parsed.data;
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
-    const ctx = Object.assign(Object.assign(Object.assign(Object.assign({}, (args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId })), { eventName: "pull_request", repository, conversation: {
+    const installationId = payload.installation?.id;
+    const ctx = {
+        ...(args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId }),
+        eventName: "pull_request",
+        repository,
+        conversation: {
             kind: "pull_request",
             number: payload.pull_request.number,
             url: payload.pull_request.html_url,
-        } }), (sender === undefined ? {} : { sender, senderLogin: sender.login })), (installationId === undefined ? {} : { installationId }));
-    const pullRequest = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ action: payload.action, number: payload.pull_request.number, url: payload.pull_request.html_url, title: payload.pull_request.title }, (payload.pull_request.body === undefined || payload.pull_request.body === null
-        ? {}
-        : { body: payload.pull_request.body })), { headRef: payload.pull_request.head.ref, headSha: payload.pull_request.head.sha, baseRef: payload.pull_request.base.ref }), (payload.pull_request.base.sha === undefined
-        ? {}
-        : { baseSha: payload.pull_request.base.sha })), (((_d = (_c = (_b = payload.changes) === null || _b === void 0 ? void 0 : _b.base) === null || _c === void 0 ? void 0 : _c.ref) === null || _d === void 0 ? void 0 : _d.from) === undefined
-        ? {}
-        : { baseRefChangedFrom: payload.changes.base.ref.from })), { draft: (_g = payload.pull_request.draft) !== null && _g !== void 0 ? _g : false, merged: payload.pull_request.merged === true }), (((_e = payload.pull_request.user) === null || _e === void 0 ? void 0 : _e.login) === undefined
-        ? {}
-        : { authorLogin: payload.pull_request.user.login })), (((_f = payload.label) === null || _f === void 0 ? void 0 : _f.name) === undefined ? {} : { label: { name: payload.label.name } }));
+        },
+        ...(sender === undefined ? {} : { sender, senderLogin: sender.login }),
+        ...(installationId === undefined ? {} : { installationId }),
+    };
+    const pullRequest = {
+        action: payload.action,
+        number: payload.pull_request.number,
+        url: payload.pull_request.html_url,
+        title: payload.pull_request.title,
+        ...(payload.pull_request.body === undefined || payload.pull_request.body === null
+            ? {}
+            : { body: payload.pull_request.body }),
+        headRef: payload.pull_request.head.ref,
+        headSha: payload.pull_request.head.sha,
+        baseRef: payload.pull_request.base.ref,
+        ...(payload.pull_request.base.sha === undefined
+            ? {}
+            : { baseSha: payload.pull_request.base.sha }),
+        ...(payload.changes?.base?.ref?.from === undefined
+            ? {}
+            : { baseRefChangedFrom: payload.changes.base.ref.from }),
+        draft: payload.pull_request.draft ?? false,
+        merged: payload.pull_request.merged === true,
+        ...(payload.pull_request.user?.login === undefined
+            ? {}
+            : { authorLogin: payload.pull_request.user.login }),
+        ...(payload.label?.name === undefined ? {} : { label: { name: payload.label.name } }),
+    };
     return { ctx, pullRequest };
 }
-export function verifyGitHubWebhookSignature(args) {
-    return __awaiter(this, void 0, void 0, function* () {
-        const secret = yield resolveCredentialValue(args.secret);
-        if (secret === undefined || secret === "") {
-            return "missing_secret";
-        }
-        if (args.signatureHeader === null) {
-            return "missing_signature";
-        }
-        const isVerified = verifyWebhookSha256Signature({
-            secret,
-            body: args.body,
-            signatureHeader: args.signatureHeader,
-        });
-        return isVerified ? "verified" : "mismatch";
+export async function verifyGitHubWebhookSignature(args) {
+    const secret = await resolveCredentialValue(args.secret);
+    if (secret === undefined || secret === "") {
+        return "missing_secret";
+    }
+    if (args.signatureHeader === null) {
+        return "missing_signature";
+    }
+    const isVerified = verifyWebhookSha256Signature({
+        secret,
+        body: args.body,
+        signatureHeader: args.signatureHeader,
     });
+    return isVerified ? "verified" : "mismatch";
 }
 function verifyWebhookSha256Signature(args) {
-    const prefix = "sha256=";
-    if (!args.signatureHeader.startsWith(prefix)) {
+    if (!args.signatureHeader.startsWith(GITHUB_SIGNATURE_PREFIX)) {
         return false;
     }
-    const receivedHex = args.signatureHeader.slice(prefix.length);
+    const receivedHex = args.signatureHeader.slice(GITHUB_SIGNATURE_PREFIX.length);
     if (!/^[0-9a-f]+$/i.test(receivedHex) || receivedHex.length % 2 !== 0) {
         return false;
     }
@@ -269,149 +285,142 @@ function verifyWebhookSha256Signature(args) {
  * fan-out and hosted admission arrive verified. The v2 mailbox is stamped
  * upstream (local CP or hosted ingress), never here.
  */
-export function dispatchGitHubWebhook(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const { options, eventName, payload, deliveryId, args } = input;
-        const botName = (_a = options.botName) !== null && _a !== void 0 ? _a : process.env.GITHUB_APP_SLUG;
-        const bindingConfig = {
-            api: options.api,
-            credentials: options.credentials,
-        };
-        if (eventName === "ping") {
-            return Response.json({ ok: true, event: "ping" });
-        }
-        switch (eventName) {
-            case "pull_request":
-                return handlePullRequest({
-                    options,
-                    bindingConfig,
-                    payload,
-                    deliveryId,
-                    args,
-                });
-            case "issue_comment":
-                return handleIssueComment({
-                    options,
-                    bindingConfig,
-                    botName,
-                    payload,
-                    deliveryId,
-                    args,
-                });
-            case "pull_request_review_comment":
-                return handleReviewComment({
-                    options,
-                    bindingConfig,
-                    botName,
-                    payload,
-                    deliveryId,
-                    args,
-                });
-            case "issues":
-                return handleIssue({
-                    options,
-                    bindingConfig,
-                    payload,
-                    deliveryId,
-                    args,
-                });
-            case "check_suite":
-                return handleCheckSuite({
-                    options,
-                    bindingConfig,
-                    payload,
-                    deliveryId,
-                    args,
-                });
-            case "check_run":
-                return handleCheckRun({
-                    options,
-                    bindingConfig,
-                    payload,
-                    deliveryId,
-                    args,
-                });
-            case "workflow_run":
-                return handleWorkflowRun({
-                    options,
-                    bindingConfig,
-                    payload,
-                    deliveryId,
-                    args,
-                });
-            case "status":
-                return handleStatus({
+export async function dispatchGitHubWebhook(input) {
+    const { options, eventName, payload, deliveryId, args } = input;
+    const botName = options.botName ?? process.env.GITHUB_APP_SLUG;
+    const bindingConfig = {
+        api: options.api,
+        credentials: options.credentials,
+    };
+    if (eventName === "ping") {
+        return Response.json({ ok: true, event: "ping" });
+    }
+    switch (eventName) {
+        case "pull_request":
+            return handlePullRequest({
+                options,
+                bindingConfig,
+                payload,
+                deliveryId,
+                args,
+            });
+        case "issue_comment":
+            return handleIssueComment({
+                options,
+                bindingConfig,
+                botName,
+                payload,
+                deliveryId,
+                args,
+            });
+        case "pull_request_review_comment":
+            return handleReviewComment({
+                options,
+                bindingConfig,
+                botName,
+                payload,
+                deliveryId,
+                args,
+            });
+        case "issues":
+            return handleIssue({
+                options,
+                bindingConfig,
+                payload,
+                deliveryId,
+                args,
+            });
+        case "check_suite":
+            return handleCheckSuite({
+                options,
+                bindingConfig,
+                payload,
+                deliveryId,
+                args,
+            });
+        case "check_run":
+            return handleCheckRun({
+                options,
+                bindingConfig,
+                payload,
+                deliveryId,
+                args,
+            });
+        case "workflow_run":
+            return handleWorkflowRun({
+                options,
+                bindingConfig,
+                payload,
+                deliveryId,
+                args,
+            });
+        case "status":
+            return handleStatus({
+                options,
+                bindingConfig,
+                payload,
+                deliveryId,
+                args,
+            });
+        default:
+            if (options.onEvent !== undefined && eventName !== null) {
+                return handleGenericEvent({
                     options,
                     bindingConfig,
+                    eventName,
                     payload,
                     deliveryId,
                     args,
                 });
-            default:
-                if (options.onEvent !== undefined && eventName !== null) {
-                    return handleGenericEvent({
-                        options,
-                        bindingConfig,
-                        eventName,
-                        payload,
-                        deliveryId,
-                        args,
-                    });
-                }
-                return skipped("unsupported_event", { event: eventName });
-        }
-    });
+            }
+            return skipped("unsupported_event", { event: eventName });
+    }
 }
 /**
  * HTTP entry for a single agent's GitHub channel: optional HMAC verify, then
  * {@link dispatchGitHubWebhook}.
  */
-export function handleGitHubWebhookRequest(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        var _b, _c;
-        const bodyText = yield input.request.text();
-        const webhookSecret = (_b = (_a = input.options.credentials) === null || _a === void 0 ? void 0 : _a.webhookSecret) !== null && _b !== void 0 ? _b : envWebhookSecret();
-        // A hosted public catch is reachable without an alias token. Require a
-        // verified Hub signature there even when no secret is configured, so a
-        // missing secret is a rejection rather than an unsigned accept. Local
-        // routes keep the existing rule: verify only when a secret is set.
-        const requireSignature = input.skipSignatureVerification !== true &&
-            (webhookSecret !== undefined || input.request.headers.has(CATCH_DELIVERY_ID_HEADER));
-        if (requireSignature) {
-            const signatureResult = yield verifyGitHubWebhookSignature({
-                body: bodyText,
-                signatureHeader: input.request.headers.get("x-hub-signature-256"),
-                secret: webhookSecret,
-            });
-            if (signatureResult !== "verified") {
-                return Response.json({ ok: false, error: signatureResult }, { status: 401 });
-            }
-        }
-        let payload;
-        try {
-            payload = JSON.parse(bodyText);
-        }
-        catch (_d) {
-            return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
+export async function handleGitHubWebhookRequest(input) {
+    const bodyText = await input.request.text();
+    const webhookSecret = input.options.credentials?.webhookSecret ?? envWebhookSecret();
+    // A hosted public catch is reachable without an alias token. Require a
+    // verified Hub signature there even when no secret is configured, so a
+    // missing secret is a rejection rather than an unsigned accept. Local
+    // routes keep the existing rule: verify only when a secret is set.
+    const requireSignature = input.skipSignatureVerification !== true &&
+        (webhookSecret !== undefined || input.request.headers.has(CATCH_DELIVERY_ID_HEADER));
+    if (requireSignature) {
+        const signatureResult = await verifyGitHubWebhookSignature({
+            body: bodyText,
+            signatureHeader: input.request.headers.get(GITHUB_SIGNATURE_HEADER),
+            secret: webhookSecret,
+        });
+        if (signatureResult !== "verified") {
+            return Response.json({ ok: false, error: signatureResult }, { status: 401 });
         }
-        const eventName = input.request.headers.get("x-github-event");
-        const args = eventName === null
-            ? input.args
-            : bindLocalIngressSend(input.args, {
-                identity: input.options.continuation,
-                kind: "github",
-                eventType: eventName,
-                payload,
-            });
-        return dispatchGitHubWebhook({
-            options: input.options,
-            eventName,
+    }
+    let payload;
+    try {
+        payload = JSON.parse(bodyText);
+    }
+    catch {
+        return Response.json({ ok: false, error: "invalid_json" }, { status: 400 });
+    }
+    const eventName = input.request.headers.get("x-github-event");
+    const args = eventName === null
+        ? input.args
+        : bindLocalIngressSend(input.args, {
+            identity: input.options.continuation,
+            kind: "github",
+            eventType: eventName,
             payload,
-            deliveryId: (_c = input.request.headers.get("x-github-delivery")) !== null && _c !== void 0 ? _c : undefined,
-            args,
         });
+    return dispatchGitHubWebhook({
+        options: input.options,
+        eventName,
+        payload,
+        deliveryId: input.request.headers.get("x-github-delivery") ?? undefined,
+        args,
     });
 }
 /** Options used to construct a github channel — for host-level fan-out. */
@@ -433,7 +442,9 @@ export function getGitHubChannelOptions(definition) {
  *
  * export default githubChannel({
  *   botName: "my-agent",
- *   credentials: { webhookSecret: () => process.env.GITHUB_WEBHOOK_SECRET },
+ *   // Named, not read: locally `process.env.GITHUB_WEBHOOK_SECRET`; hosted,
+ *   // the deployment secret, which the control plane checks at ingestion.
+ *   credentials: { webhookSecret: { secretName: "GITHUB_WEBHOOK_SECRET" } },
  *   // Replaces the @mention gate. Prefer typed Octokit via getOctokit().
  *   onComment: (ctx, comment) => ({ auth: defaultGitHubAuth(ctx) }),
  *   onPullRequest: (ctx, pr) => {
@@ -469,7 +480,6 @@ export function getGitHubChannelOptions(definition) {
  * ```
  */
 export function githubChannel(options = {}) {
-    var _a, _b, _c;
     const usesCursorAccount = options.cursorAccount === true || typeof options.cursorAccount === "object";
     // Normalized scope lives on the private runtime — never rewrite authored
     // `cursorAccount` on the options object the author passed in.
@@ -484,29 +494,24 @@ export function githubChannel(options = {}) {
         }
         const pending = createPendingCursorGithubCredentials();
         cursorCredentials = pending;
-        credentials = Object.assign(Object.assign({}, options.credentials), { token: createCursorAccountGithubTokenResolver(() => pending.getToken(), pending) });
-    }
-    const routePath = (_a = options.path) !== null && _a !== void 0 ? _a : "/";
-    const webhookSecret = (_b = credentials === null || credentials === void 0 ? void 0 : credentials.webhookSecret) !== null && _b !== void 0 ? _b : envWebhookSecret();
-    // With a secret the HMAC is the request auth (allowAll). Without one, prod
-    // stays loopback-strict; dev admits unsigned deliveries from a loopback peer
-    // only (loopbackGitHubDev) — not the LAN. Admits `gh webhook forward`
-    // deliveries (loopback peer + GitHub forwarding/delivery headers) while
-    // rejecting loopback tunnels that relay unsigned traffic without
-    // `X-GitHub-Event`.
-    //
-    // Evaluate `isDevMode()` per request (not at channel construction): channel
-    // modules call `githubChannel()` at import, and discovery may cache the
-    // definition across serve() calls. `serve()` sets the flag before discovery,
-    // but request-time lookup stays correct if that ordering ever drifts.
-    const auth = (_c = options.auth) !== null && _c !== void 0 ? _c : (webhookSecret !== undefined
-        ? [allowAll()]
-        : [(request, info) => (isDevMode() ? loopbackGitHubDev() : localDevStrict())(request, info)]);
-    const channelOptions = Object.assign(Object.assign({}, options), { credentials });
+        credentials = {
+            ...options.credentials,
+            token: createCursorAccountGithubTokenResolver(() => pending.getToken(), pending),
+        };
+    }
+    const routePath = options.path ?? "/";
+    const auth = options.auth ?? defaultGitHubRouteAuth(credentials?.webhookSecret ?? envWebhookSecret());
+    const channelOptions = {
+        ...options,
+        credentials,
+    };
     if (channelOptions.continuation !== undefined) {
         channelOptions.continuation = normalizeIdentity(channelOptions.continuation, "github");
     }
-    const events = Object.assign(Object.assign({}, buildDefaultGitHubEvents(Object.assign({}, channelOptions))), options.events);
+    const events = {
+        ...buildDefaultGitHubEvents({ ...channelOptions }),
+        ...options.events,
+    };
     const definition = defineChannel({
         auth,
         state: emptyGitHubChannelState(),
@@ -524,12 +529,10 @@ export function githubChannel(options = {}) {
                 // route boundary so /v1/info + Try always have something to show.
                 bodySchema: z.unknown(),
                 description: "GitHub webhook ingress",
-                handler: (request, args) => __awaiter(this, void 0, void 0, function* () {
-                    return handleGitHubWebhookRequest({
-                        options: channelOptions,
-                        request,
-                        args,
-                    });
+                handler: async (request, args) => handleGitHubWebhookRequest({
+                    options: channelOptions,
+                    request,
+                    args,
                 }),
             }),
         ],
@@ -539,16 +542,17 @@ export function githubChannel(options = {}) {
         kind: GITHUB_CHANNEL_KIND,
         prepareArgs: withPropagatingBackgroundErrors,
         dispatch: ({ channelId, eventType, payload, deliveryId, args }) => {
-            var _a;
-            // A publicEndpoint() catch is an http.request envelope. Replay it
-            // into the route handler, which verifies X-Hub-Signature-256.
-            // Forge deliveries carry a GitHub event name and stay on
+            // A catch (publicEndpoint() or a named webhook secret) is an
+            // http.request envelope. Replay it into the route handler, which
+            // verifies X-Hub-Signature-256 — the only check on a public catch,
+            // and a second one behind the control plane's on a named-secret
+            // catch. Forge deliveries carry a GitHub event name and stay on
             // dispatchGitHubWebhook.
             if (eventType === AGENT_SDK_CATCH_EVENT_TYPE) {
                 return replayCatchRequest({
-                    channelId: channelId !== null && channelId !== void 0 ? channelId : "github",
+                    channelId: channelId ?? "github",
                     deliveryId,
-                    routes: (_a = definition.routes) !== null && _a !== void 0 ? _a : [],
+                    routes: definition.routes ?? [],
                     payload,
                     args,
                 });
@@ -571,698 +575,817 @@ export function githubChannel(options = {}) {
     }
     return definition;
 }
-function hasDedicatedGitHubApiCredentials(options) {
-    var _a, _b, _c, _d;
-    return (((_a = options.credentials) === null || _a === void 0 ? void 0 : _a.token) !== undefined ||
-        ((_b = options.credentials) === null || _b === void 0 ? void 0 : _b.installationToken) !== undefined ||
-        ((_c = options.credentials) === null || _c === void 0 ? void 0 : _c.appId) !== undefined ||
-        ((_d = options.credentials) === null || _d === void 0 ? void 0 : _d.privateKey) !== undefined);
-}
-function handlePullRequest(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d;
-        const parsed = parseGitHubPullRequestEvent({
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return Response.json({ ok: false, error: "invalid_pull_request_payload" }, { status: 400 });
-        }
-        const { pullRequest } = parsed;
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.ctx.installationId;
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-        });
-        const ctx = enrichEventContext({
-            bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
-            payload: input.payload,
-            bindingState: binding,
-            installationId,
-            host: input.args.host,
-            artifacts: input.args.artifacts,
-            send: input.args.send,
-        });
-        const dispatch = input.options.onPullRequest === undefined
-            ? defaultGitHubPullRequestDispatch(ctx, pullRequest)
-            : yield input.options.onPullRequest(ctx, pullRequest);
-        if (dispatch === null) {
-            return skipped("not_dispatched", { action: pullRequest.action });
+/** Header GitHub signs deliveries with; `sha256=<hex hmac of the raw body>`. */
+const GITHUB_SIGNATURE_HEADER = "x-hub-signature-256";
+const GITHUB_SIGNATURE_PREFIX = "sha256=";
+/** Env var / deployment secret an omitted `webhookSecret` falls back to. */
+export const GITHUB_WEBHOOK_SECRET_ENV = "GITHUB_WEBHOOK_SECRET";
+/**
+ * The secret name the v2 error suggests for each API credential: the env
+ * var the field falls back to when omitted, or for `installationToken`
+ * (which has no fallback) the conventional name.
+ */
+const GITHUB_API_CREDENTIAL_ENV = {
+    token: "GITHUB_TOKEN",
+    installationToken: "GITHUB_APP_INSTALLATION_TOKEN",
+    appId: "GITHUB_APP_ID",
+    privateKey: "GITHUB_APP_PRIVATE_KEY",
+};
+/**
+ * Why a `githubChannel` cannot deploy onto architecture v2 as authored, or
+ * `undefined` when it can.
+ *
+ * v2 terminates the Hub signature on the control plane, which can only do
+ * that for a secret it can name: a literal or getter `webhookSecret` never
+ * reaches the manifest, so the check would run inside the guest only —
+ * after compute was spent and after GitHub already got its 202.
+ *
+ * The API credentials (`token`, `installationToken`, `appId`,
+ * `privateKey`) follow the same rule on v2: a name is what lets `deploy`
+ * flag an unset deployment secret before the first API call fails inside
+ * the guest, and a getter is a hook that runs inside the guest with no
+ * declared input. A numeric `appId` is configuration, not a secret, and
+ * stays allowed. Omitting a field (its env fallback) and `publicEndpoint()`
+ * postures are both still allowed. Architecture `"v1"` accepts every shape.
+ */
+export function githubChannelArchitectureError(definition) {
+    const options = getGitHubChannelOptions(definition);
+    if (options === undefined) {
+        return undefined;
+    }
+    const webhookError = namedWebhookSecretArchitectureError({
+        option: "githubChannel credentials.webhookSecret",
+        webhookSecret: options.credentials?.webhookSecret,
+        envName: GITHUB_WEBHOOK_SECRET_ENV,
+        verifies: "X-Hub-Signature-256",
+    });
+    if (webhookError !== undefined) {
+        return webhookError;
+    }
+    for (const field of Object.keys(GITHUB_API_CREDENTIAL_ENV)) {
+        const value = options.credentials?.[field];
+        if (value === undefined ||
+            isSecretRef(value) ||
+            typeof value === "number" ||
+            // `cursorAccount: true` installs the SDK's own token resolver; it is
+            // not something the author wrote and the control plane mints it.
+            isCursorAccountGithubTokenResolver(value)) {
+            continue;
         }
-        if (isTaskDispatch(dispatch)) {
-            return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
-                action: pullRequest.action,
-                prUrl: pullRequest.url,
-                headSha: pullRequest.headSha,
-            });
+        const envName = GITHUB_API_CREDENTIAL_ENV[field];
+        const authored = typeof value === "function" ? "a function" : "a literal value";
+        return (`githubChannel credentials.${field} is ${authored}; architecture "v2" requires a named secret: ` +
+            `{ secretName: "${envName}" }. The guest reads the deployment secret of that name from its ` +
+            `environment, and \`deploy\` warns when it is not set; a literal or function value is neither ` +
+            `declared nor checkable before the first API call. Set the value with ` +
+            `\`secrets set <slug> ${envName}\`.`);
+    }
+    return undefined;
+}
+/**
+ * Deployment secrets a `githubChannel`'s API credentials name
+ * (`{ secretName }` values of `token`, `installationToken`, `appId`, and
+ * `privateKey`). `deploy` declares them beside `hosting.secretNames` and the
+ * catch secrets so an unset one is flagged at deploy time rather than as a
+ * failed API call inside the guest. The webhook secret is not here: it is
+ * a catch secret and travels through the catch declaration.
+ */
+export function githubChannelCredentialSecretNames(definition) {
+    const credentials = getGitHubChannelOptions(definition)?.credentials;
+    if (credentials === undefined) {
+        return [];
+    }
+    const names = new Set();
+    for (const field of Object.keys(GITHUB_API_CREDENTIAL_ENV)) {
+        const value = credentials[field];
+        if (isSecretRef(value)) {
+            names.add(value.secretName);
         }
-        const message = [
-            (_b = dispatch.message) !== null && _b !== void 0 ? _b : defaultGitHubPullRequestMessage(ctx, pullRequest),
-            ...((_c = dispatch.context) !== null && _c !== void 0 ? _c : []),
-        ].join("\n");
-        const cloud = (_d = dispatch.cloud) !== null && _d !== void 0 ? _d : (yield resolveCloudOptions(input.options.cloud, ctx, pullRequest));
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            cloud,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-                headSha: pullRequest.headSha,
-                baseRef: pullRequest.baseRef,
-                headRef: pullRequest.headRef,
-            }),
-        });
+    }
+    return [...names];
+}
+/** True for a `githubChannel({ cursorAccount })` definition. */
+export function isCursorAccountGitHubChannel(definition) {
+    const cursorAccount = getGitHubChannelOptions(definition)?.cursorAccount;
+    return cursorAccount === true || typeof cursorAccount === "object";
+}
+/**
+ * The route policy for a GitHub webhook whose secret is named: verify
+ * `X-Hub-Signature-256` under the env var / deployment secret `secretName`.
+ * Being an {@link hmacSignatureAuth} policy, `deploy` writes it into the
+ * manifest, so on Cursor hosting the control plane runs the same check
+ * at ingestion and refuses a bad signature before any compute starts.
+ */
+export function githubWebhookSignatureAuth(secretName) {
+    return hmacSignatureAuth({
+        header: GITHUB_SIGNATURE_HEADER,
+        secret: secretName,
+        prefix: GITHUB_SIGNATURE_PREFIX,
     });
 }
-function handleIssueComment(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d;
-        const parsed = parseIssueCommentEvent({
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return Response.json({ ok: false, error: "invalid_issue_comment_payload" }, { status: 400 });
-        }
-        if (parsed.action !== "created") {
-            return skipped("not_dispatched", { action: parsed.action });
-        }
-        if (isIgnoredInboundComment(parsed.comment.body, parsed.comment.author, input.botName)) {
-            return skipped("ignored_comment");
-        }
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.ctx.installationId;
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-            triggeringCommentId: parsed.comment.id,
-        });
-        const ctx = enrichEventContext({
-            bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
-            payload: input.payload,
-            bindingState: binding,
-            installationId,
-            host: input.args.host,
-            artifacts: input.args.artifacts,
-            send: input.args.send,
+/**
+ * Default route auth for the resolved webhook secret:
+ *
+ * - A named secret makes the HMAC the route policy itself
+ *   ({@link githubWebhookSignatureAuth}), which is also what makes the
+ *   channel catchable on the control plane.
+ * - A literal or getter secret keeps the HMAC inside the handler, so the
+ *   route admits everything (allowAll) and the handler is the request auth.
+ * - No secret: prod stays loopback-strict; dev admits unsigned deliveries
+ *   from a loopback peer only (loopbackGitHubDev) — not the LAN. Admits
+ *   `gh webhook forward` deliveries (loopback peer + GitHub forwarding /
+ *   delivery headers) while rejecting loopback tunnels that relay unsigned
+ *   traffic without `X-GitHub-Event`.
+ *
+ * `isDevMode()` is evaluated per request (not at channel construction):
+ * channel modules call `githubChannel()` at import, and discovery may cache
+ * the definition across serve() calls. `serve()` sets the flag before
+ * discovery, but request-time lookup stays correct if that ordering drifts.
+ */
+function defaultGitHubRouteAuth(webhookSecret) {
+    if (webhookSecret === undefined) {
+        return [
+            (request, info) => (isDevMode() ? loopbackGitHubDev() : localDevStrict())(request, info),
+        ];
+    }
+    if (isSecretRef(webhookSecret)) {
+        return [githubWebhookSignatureAuth(webhookSecret.secretName)];
+    }
+    return [allowAll()];
+}
+function hasDedicatedGitHubApiCredentials(options) {
+    return (options.credentials?.token !== undefined ||
+        options.credentials?.installationToken !== undefined ||
+        options.credentials?.appId !== undefined ||
+        options.credentials?.privateKey !== undefined);
+}
+async function handlePullRequest(input) {
+    const parsed = parseGitHubPullRequestEvent({
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return Response.json({ ok: false, error: "invalid_pull_request_payload" }, { status: 400 });
+    }
+    const { pullRequest } = parsed;
+    const installationId = readInstallationId(input.payload) ?? parsed.ctx.installationId;
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = input.options.onPullRequest === undefined
+        ? defaultGitHubPullRequestDispatch(ctx, pullRequest)
+        : await input.options.onPullRequest(ctx, pullRequest);
+    if (dispatch === null) {
+        return skipped("not_dispatched", { action: pullRequest.action });
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            action: pullRequest.action,
+            prUrl: pullRequest.url,
+            headSha: pullRequest.headSha,
         });
-        const dispatch = input.options.onComment === undefined
-            ? defaultOnComment(ctx, parsed.comment, {
-                botName: input.botName,
-            })
-            : yield input.options.onComment(ctx, parsed.comment);
-        if (dispatch === null) {
-            return skipped("not_dispatched");
-        }
-        if (isTaskDispatch(dispatch)) {
-            return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
-                event: "issue_comment",
-                action: parsed.action,
-            });
-        }
-        const trigger = extractGitHubCommentTrigger({
-            body: parsed.comment.body,
+    }
+    const message = [
+        dispatch.message ?? defaultGitHubPullRequestMessage(ctx, pullRequest),
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    const cloud = dispatch.cloud ?? (await resolveCloudOptions(input.options.cloud, ctx, pullRequest));
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        cloud,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+            headSha: pullRequest.headSha,
+            baseRef: pullRequest.baseRef,
+            headRef: pullRequest.headRef,
+        }),
+    });
+}
+async function handleIssueComment(input) {
+    const parsed = parseIssueCommentEvent({
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return Response.json({ ok: false, error: "invalid_issue_comment_payload" }, { status: 400 });
+    }
+    if (parsed.action !== "created") {
+        return skipped("not_dispatched", { action: parsed.action });
+    }
+    if (isIgnoredInboundComment(parsed.comment.body, parsed.comment.author, input.botName)) {
+        return skipped("ignored_comment");
+    }
+    const installationId = readInstallationId(input.payload) ?? parsed.ctx.installationId;
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+        triggeringCommentId: parsed.comment.id,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = input.options.onComment === undefined
+        ? defaultOnComment(ctx, parsed.comment, {
             botName: input.botName,
+        })
+        : await input.options.onComment(ctx, parsed.comment);
+    if (dispatch === null) {
+        return skipped("not_dispatched");
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            event: "issue_comment",
+            action: parsed.action,
         });
-        const message = [
-            (_c = (_b = dispatch.message) !== null && _b !== void 0 ? _b : trigger === null || trigger === void 0 ? void 0 : trigger.message) !== null && _c !== void 0 ? _c : parsed.comment.body.trim(),
-            ...((_d = dispatch.context) !== null && _d !== void 0 ? _d : []),
-        ].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-            }),
-        });
+    }
+    const trigger = extractGitHubCommentTrigger({
+        body: parsed.comment.body,
+        botName: input.botName,
+    });
+    const message = [
+        dispatch.message ?? trigger?.message ?? parsed.comment.body.trim(),
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+        }),
     });
 }
-function handleReviewComment(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c, _d, _e;
-        const parsed = parseReviewCommentEvent({
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return Response.json({ ok: false, error: "invalid_review_comment_payload" }, { status: 400 });
-        }
-        if (parsed.action !== "created") {
-            return skipped("not_dispatched", { action: parsed.action });
-        }
-        if (isIgnoredInboundComment(parsed.comment.body, parsed.comment.author, input.botName)) {
-            return skipped("ignored_comment");
-        }
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.ctx.installationId;
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-            triggeringCommentId: parsed.comment.id,
-            reviewCommentId: parsed.comment.id,
-            reviewThreadRootCommentId: (_b = parsed.comment.inReplyToId) !== null && _b !== void 0 ? _b : parsed.comment.id,
-        });
-        const ctx = enrichEventContext({
-            bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
-            payload: input.payload,
-            bindingState: binding,
-            installationId,
-            host: input.args.host,
-            artifacts: input.args.artifacts,
-            send: input.args.send,
-        });
-        const dispatch = input.options.onComment === undefined
-            ? defaultOnComment(ctx, parsed.comment, {
-                botName: input.botName,
-            })
-            : yield input.options.onComment(ctx, parsed.comment);
-        if (dispatch === null) {
-            return skipped("not_dispatched");
-        }
-        if (isTaskDispatch(dispatch)) {
-            return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
-                event: "pull_request_review_comment",
-                action: parsed.action,
-            });
-        }
-        const trigger = extractGitHubCommentTrigger({
-            body: parsed.comment.body,
+async function handleReviewComment(input) {
+    const parsed = parseReviewCommentEvent({
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return Response.json({ ok: false, error: "invalid_review_comment_payload" }, { status: 400 });
+    }
+    if (parsed.action !== "created") {
+        return skipped("not_dispatched", { action: parsed.action });
+    }
+    if (isIgnoredInboundComment(parsed.comment.body, parsed.comment.author, input.botName)) {
+        return skipped("ignored_comment");
+    }
+    const installationId = readInstallationId(input.payload) ?? parsed.ctx.installationId;
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+        triggeringCommentId: parsed.comment.id,
+        reviewCommentId: parsed.comment.id,
+        reviewThreadRootCommentId: parsed.comment.inReplyToId ?? parsed.comment.id,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = input.options.onComment === undefined
+        ? defaultOnComment(ctx, parsed.comment, {
             botName: input.botName,
+        })
+        : await input.options.onComment(ctx, parsed.comment);
+    if (dispatch === null) {
+        return skipped("not_dispatched");
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            event: "pull_request_review_comment",
+            action: parsed.action,
         });
-        const message = [
-            (_d = (_c = dispatch.message) !== null && _c !== void 0 ? _c : trigger === null || trigger === void 0 ? void 0 : trigger.message) !== null && _d !== void 0 ? _d : parsed.comment.body.trim(),
-            ...((_e = dispatch.context) !== null && _e !== void 0 ? _e : []),
-        ].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-                headSha: parsed.headSha,
-                headRef: parsed.headRef,
-                baseRef: parsed.baseRef,
-            }),
-        });
+    }
+    const trigger = extractGitHubCommentTrigger({
+        body: parsed.comment.body,
+        botName: input.botName,
+    });
+    const message = [
+        dispatch.message ?? trigger?.message ?? parsed.comment.body.trim(),
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+            headSha: parsed.headSha,
+            headRef: parsed.headRef,
+            baseRef: parsed.baseRef,
+        }),
     });
 }
-function handleIssue(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        if (input.options.onIssue === undefined) {
-            return skipped("no_handler", { event: "issues" });
-        }
-        const parsed = parseIssueEvent({
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return Response.json({ ok: false, error: "invalid_issues_payload" }, { status: 400 });
-        }
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.ctx.installationId;
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-        });
-        const ctx = enrichEventContext({
-            bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
-            payload: input.payload,
-            bindingState: binding,
-            installationId,
-            host: input.args.host,
-            artifacts: input.args.artifacts,
-            send: input.args.send,
-        });
-        const dispatch = yield input.options.onIssue(ctx, parsed.issue);
-        if (dispatch === null) {
-            return skipped("not_dispatched", { action: parsed.issue.action });
-        }
-        if (isTaskDispatch(dispatch)) {
-            return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
-                event: "issues",
-                action: parsed.issue.action,
-                issueNumber: parsed.issue.number,
-            });
-        }
-        const message = [
-            (_b = dispatch.message) !== null && _b !== void 0 ? _b : `Issue ${parsed.issue.action}: #${parsed.issue.number} ${parsed.issue.title}`,
-            ...((_c = dispatch.context) !== null && _c !== void 0 ? _c : []),
-        ].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-            }),
+async function handleIssue(input) {
+    if (input.options.onIssue === undefined) {
+        return skipped("no_handler", { event: "issues" });
+    }
+    const parsed = parseIssueEvent({
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return Response.json({ ok: false, error: "invalid_issues_payload" }, { status: 400 });
+    }
+    const installationId = readInstallationId(input.payload) ?? parsed.ctx.installationId;
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = await input.options.onIssue(ctx, parsed.issue);
+    if (dispatch === null) {
+        return skipped("not_dispatched", { action: parsed.issue.action });
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            event: "issues",
+            action: parsed.issue.action,
+            issueNumber: parsed.issue.number,
         });
+    }
+    const message = [
+        dispatch.message ??
+            `Issue ${parsed.issue.action}: #${parsed.issue.number} ${parsed.issue.title}`,
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+        }),
     });
 }
-function handleCheckSuite(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        if (input.options.onCheckSuite === undefined) {
-            return skipped("no_handler", { event: "check_suite" });
-        }
-        const parsed = parseCheckSuiteEvent({
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return Response.json({ ok: false, error: "invalid_check_suite_payload" }, { status: 400 });
-        }
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.unanchoredCtx.installationId;
-        if (parsed.ctx === null) {
-            const dispatch = yield input.options.onCheckSuite(enrichCiContext({
-                bindingConfig: input.bindingConfig,
-                ctx: parsed.unanchoredCtx,
-                payload: input.payload,
-                installationId,
-                host: input.args.host,
-                artifacts: input.args.artifacts,
-                send: input.args.send,
-            }), parsed.checkSuite);
-            if (dispatch !== null && isTaskDispatch(dispatch)) {
-                return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
-                    event: "check_suite",
-                    action: parsed.checkSuite.action,
-                    checkSuiteId: parsed.checkSuite.checkSuiteId,
-                });
-            }
-            return skipped("no_pull_request", { event: "check_suite" });
-        }
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-        });
-        const ctx = enrichEventContext({
+async function handleCheckSuite(input) {
+    if (input.options.onCheckSuite === undefined) {
+        return skipped("no_handler", { event: "check_suite" });
+    }
+    const parsed = parseCheckSuiteEvent({
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return Response.json({ ok: false, error: "invalid_check_suite_payload" }, { status: 400 });
+    }
+    const installationId = readInstallationId(input.payload) ?? parsed.unanchoredCtx.installationId;
+    if (parsed.ctx === null) {
+        const dispatch = await input.options.onCheckSuite(enrichCiContext({
             bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
+            ctx: parsed.unanchoredCtx,
             payload: input.payload,
-            bindingState: binding,
             installationId,
             host: input.args.host,
             artifacts: input.args.artifacts,
             send: input.args.send,
-        });
-        const dispatch = yield input.options.onCheckSuite(ctx, parsed.checkSuite);
-        if (dispatch === null) {
-            return skipped("not_dispatched", { action: parsed.checkSuite.action });
-        }
-        if (isTaskDispatch(dispatch)) {
+        }), parsed.checkSuite);
+        if (dispatch !== null && isTaskDispatch(dispatch)) {
             return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
                 event: "check_suite",
                 action: parsed.checkSuite.action,
                 checkSuiteId: parsed.checkSuite.checkSuiteId,
             });
         }
-        const message = [
-            (_b = dispatch.message) !== null && _b !== void 0 ? _b : formatCiMessage("Check suite", parsed.checkSuite.checkSuiteId, parsed.checkSuite),
-            ...((_c = dispatch.context) !== null && _c !== void 0 ? _c : []),
-        ].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-                headSha: parsed.checkSuite.headSha,
-            }),
+        return skipped("no_pull_request", { event: "check_suite" });
+    }
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = await input.options.onCheckSuite(ctx, parsed.checkSuite);
+    if (dispatch === null) {
+        return skipped("not_dispatched", { action: parsed.checkSuite.action });
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            event: "check_suite",
+            action: parsed.checkSuite.action,
+            checkSuiteId: parsed.checkSuite.checkSuiteId,
         });
+    }
+    const message = [
+        dispatch.message ??
+            formatCiMessage("Check suite", parsed.checkSuite.checkSuiteId, parsed.checkSuite),
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+            headSha: parsed.checkSuite.headSha,
+        }),
     });
 }
-function handleCheckRun(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        if (input.options.onCheckRun === undefined) {
-            return skipped("no_handler", { event: "check_run" });
-        }
-        const parsed = parseCheckRunEvent({
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return Response.json({ ok: false, error: "invalid_check_run_payload" }, { status: 400 });
-        }
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.unanchoredCtx.installationId;
-        if (parsed.ctx === null) {
-            const dispatch = yield input.options.onCheckRun(enrichCiContext({
-                bindingConfig: input.bindingConfig,
-                ctx: parsed.unanchoredCtx,
-                payload: input.payload,
-                installationId,
-                host: input.args.host,
-                artifacts: input.args.artifacts,
-                send: input.args.send,
-            }), parsed.checkRun);
-            if (dispatch !== null && isTaskDispatch(dispatch)) {
-                return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
-                    event: "check_run",
-                    action: parsed.checkRun.action,
-                    checkRunId: parsed.checkRun.checkRunId,
-                });
-            }
-            return skipped("no_pull_request", { event: "check_run" });
-        }
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-        });
-        const ctx = enrichEventContext({
+async function handleCheckRun(input) {
+    if (input.options.onCheckRun === undefined) {
+        return skipped("no_handler", { event: "check_run" });
+    }
+    const parsed = parseCheckRunEvent({
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return Response.json({ ok: false, error: "invalid_check_run_payload" }, { status: 400 });
+    }
+    const installationId = readInstallationId(input.payload) ?? parsed.unanchoredCtx.installationId;
+    if (parsed.ctx === null) {
+        const dispatch = await input.options.onCheckRun(enrichCiContext({
             bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
+            ctx: parsed.unanchoredCtx,
             payload: input.payload,
-            bindingState: binding,
             installationId,
             host: input.args.host,
             artifacts: input.args.artifacts,
             send: input.args.send,
-        });
-        const dispatch = yield input.options.onCheckRun(ctx, parsed.checkRun);
-        if (dispatch === null) {
-            return skipped("not_dispatched", { action: parsed.checkRun.action });
-        }
-        if (isTaskDispatch(dispatch)) {
+        }), parsed.checkRun);
+        if (dispatch !== null && isTaskDispatch(dispatch)) {
             return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
                 event: "check_run",
                 action: parsed.checkRun.action,
                 checkRunId: parsed.checkRun.checkRunId,
             });
         }
-        const message = [
-            (_b = dispatch.message) !== null && _b !== void 0 ? _b : formatCiMessage("Check run", parsed.checkRun.checkRunId, parsed.checkRun),
-            ...((_c = dispatch.context) !== null && _c !== void 0 ? _c : []),
-        ].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-                headSha: parsed.checkRun.headSha,
-            }),
+        return skipped("no_pull_request", { event: "check_run" });
+    }
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = await input.options.onCheckRun(ctx, parsed.checkRun);
+    if (dispatch === null) {
+        return skipped("not_dispatched", { action: parsed.checkRun.action });
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            event: "check_run",
+            action: parsed.checkRun.action,
+            checkRunId: parsed.checkRun.checkRunId,
         });
+    }
+    const message = [
+        dispatch.message ?? formatCiMessage("Check run", parsed.checkRun.checkRunId, parsed.checkRun),
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+            headSha: parsed.checkRun.headSha,
+        }),
     });
 }
-function handleWorkflowRun(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        if (input.options.onWorkflowRun === undefined) {
-            return skipped("no_handler", { event: "workflow_run" });
-        }
-        const parsed = parseWorkflowRunEvent({
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return Response.json({ ok: false, error: "invalid_workflow_run_payload" }, { status: 400 });
-        }
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.unanchoredCtx.installationId;
-        if (parsed.ctx === null) {
-            const dispatch = yield input.options.onWorkflowRun(enrichCiContext({
-                bindingConfig: input.bindingConfig,
-                ctx: parsed.unanchoredCtx,
-                payload: input.payload,
-                installationId,
-                host: input.args.host,
-                artifacts: input.args.artifacts,
-                send: input.args.send,
-            }), parsed.workflowRun);
-            if (dispatch !== null && isTaskDispatch(dispatch)) {
-                return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
-                    event: "workflow_run",
-                    action: parsed.workflowRun.action,
-                    workflowRunId: parsed.workflowRun.workflowRunId,
-                });
-            }
-            return skipped("no_pull_request", { event: "workflow_run" });
-        }
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-        });
-        const ctx = enrichEventContext({
+async function handleWorkflowRun(input) {
+    if (input.options.onWorkflowRun === undefined) {
+        return skipped("no_handler", { event: "workflow_run" });
+    }
+    const parsed = parseWorkflowRunEvent({
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return Response.json({ ok: false, error: "invalid_workflow_run_payload" }, { status: 400 });
+    }
+    const installationId = readInstallationId(input.payload) ?? parsed.unanchoredCtx.installationId;
+    if (parsed.ctx === null) {
+        const dispatch = await input.options.onWorkflowRun(enrichCiContext({
             bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
+            ctx: parsed.unanchoredCtx,
             payload: input.payload,
-            bindingState: binding,
             installationId,
             host: input.args.host,
             artifacts: input.args.artifacts,
             send: input.args.send,
-        });
-        const dispatch = yield input.options.onWorkflowRun(ctx, parsed.workflowRun);
-        if (dispatch === null) {
-            return skipped("not_dispatched", { action: parsed.workflowRun.action });
-        }
-        if (isTaskDispatch(dispatch)) {
+        }), parsed.workflowRun);
+        if (dispatch !== null && isTaskDispatch(dispatch)) {
             return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
                 event: "workflow_run",
                 action: parsed.workflowRun.action,
                 workflowRunId: parsed.workflowRun.workflowRunId,
             });
         }
-        const message = [
-            (_b = dispatch.message) !== null && _b !== void 0 ? _b : formatCiMessage("Workflow run", parsed.workflowRun.workflowRunId, parsed.workflowRun),
-            ...((_c = dispatch.context) !== null && _c !== void 0 ? _c : []),
-        ].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-                headSha: parsed.workflowRun.headSha,
-            }),
+        return skipped("no_pull_request", { event: "workflow_run" });
+    }
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = await input.options.onWorkflowRun(ctx, parsed.workflowRun);
+    if (dispatch === null) {
+        return skipped("not_dispatched", { action: parsed.workflowRun.action });
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            event: "workflow_run",
+            action: parsed.workflowRun.action,
+            workflowRunId: parsed.workflowRun.workflowRunId,
         });
+    }
+    const message = [
+        dispatch.message ??
+            formatCiMessage("Workflow run", parsed.workflowRun.workflowRunId, parsed.workflowRun),
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+            headSha: parsed.workflowRun.headSha,
+        }),
     });
 }
-function handleStatus(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        if (input.options.onStatus === undefined) {
-            return skipped("no_handler", { event: "status" });
-        }
-        const parsed = parseStatusEvent({
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return Response.json({ ok: false, error: "invalid_status_payload" }, { status: 400 });
-        }
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.ctx.installationId;
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-        });
-        const ctx = enrichEventContext({
-            bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
-            payload: input.payload,
-            bindingState: binding,
-            installationId,
-            host: input.args.host,
-            artifacts: input.args.artifacts,
-            send: input.args.send,
+async function handleStatus(input) {
+    if (input.options.onStatus === undefined) {
+        return skipped("no_handler", { event: "status" });
+    }
+    const parsed = parseStatusEvent({
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return Response.json({ ok: false, error: "invalid_status_payload" }, { status: 400 });
+    }
+    const installationId = readInstallationId(input.payload) ?? parsed.ctx.installationId;
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = await input.options.onStatus(ctx, parsed.status);
+    if (dispatch === null) {
+        return skipped("not_dispatched", {
+            event: "status",
+            state: parsed.status.state,
         });
-        const dispatch = yield input.options.onStatus(ctx, parsed.status);
-        if (dispatch === null) {
-            return skipped("not_dispatched", {
-                event: "status",
-                state: parsed.status.state,
-            });
-        }
-        if (isTaskDispatch(dispatch)) {
-            return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
-                event: "status",
-                state: parsed.status.state,
-                sha: parsed.status.sha,
-            });
-        }
-        // A turn needs a thread to anchor to; commit statuses often have no PR.
-        if (ctx.conversation.number === 0) {
-            return skipped("no_pull_request", { event: "status" });
-        }
-        const message = [
-            (_b = dispatch.message) !== null && _b !== void 0 ? _b : `Commit status ${parsed.status.state} for ${parsed.status.context} at ${parsed.status.sha}`,
-            ...((_c = dispatch.context) !== null && _c !== void 0 ? _c : []),
-        ].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-                headSha: parsed.status.sha,
-            }),
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            event: "status",
+            state: parsed.status.state,
+            sha: parsed.status.sha,
         });
+    }
+    // A turn needs a thread to anchor to; commit statuses often have no PR.
+    if (ctx.conversation.number === 0) {
+        return skipped("no_pull_request", { event: "status" });
+    }
+    const message = [
+        dispatch.message ??
+            `Commit status ${parsed.status.state} for ${parsed.status.context} at ${parsed.status.sha}`,
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+            headSha: parsed.status.sha,
+        }),
     });
 }
-function handleGenericEvent(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b, _c;
-        if (input.options.onEvent === undefined) {
-            return skipped("no_handler", { event: input.eventName });
-        }
-        const parsed = parseGenericEvent({
-            eventName: input.eventName,
-            payload: input.payload,
-            deliveryId: input.deliveryId,
-        });
-        if (parsed === null) {
-            return skipped("unsupported_event", { event: input.eventName });
-        }
-        const installationId = (_a = readInstallationId(input.payload)) !== null && _a !== void 0 ? _a : parsed.ctx.installationId;
-        const binding = githubBindingStateForEvent({
-            kind: parsed.ctx.conversation.kind,
-            owner: parsed.ctx.repository.owner,
-            repo: parsed.ctx.repository.name,
-            number: parsed.ctx.conversation.number,
-            repositoryId: parsed.ctx.repository.id,
-            repositoryUrl: parsed.ctx.repository.url,
-            installationId,
-        });
-        const ctx = enrichEventContext({
-            bindingConfig: input.bindingConfig,
-            ctx: parsed.ctx,
-            payload: input.payload,
-            bindingState: binding,
-            installationId,
-            host: input.args.host,
-            artifacts: input.args.artifacts,
-            send: input.args.send,
-        });
-        const dispatch = yield input.options.onEvent(ctx, parsed.event);
-        if (dispatch === null) {
-            return skipped("not_dispatched", { event: input.eventName });
-        }
-        if (isTaskDispatch(dispatch)) {
-            return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, Object.assign({ event: input.eventName }, (parsed.event.action === undefined ? {} : { action: parsed.event.action })));
-        }
-        if (ctx.conversation.number === 0) {
-            return skipped("no_conversation", { event: input.eventName });
-        }
-        const message = [
-            (_b = dispatch.message) !== null && _b !== void 0 ? _b : `GitHub ${input.eventName} event`,
-            ...((_c = dispatch.context) !== null && _c !== void 0 ? _c : []),
-        ].join("\n");
-        return startTurn({
-            options: input.options,
-            args: input.args,
-            ctx,
-            message,
-            dispatch,
-            state: sessionStateFromBinding({
-                binding,
-                deliveryId: ctx.deliveryId,
-                eventName: ctx.eventName,
-            }),
+async function handleGenericEvent(input) {
+    if (input.options.onEvent === undefined) {
+        return skipped("no_handler", { event: input.eventName });
+    }
+    const parsed = parseGenericEvent({
+        eventName: input.eventName,
+        payload: input.payload,
+        deliveryId: input.deliveryId,
+    });
+    if (parsed === null) {
+        return skipped("unsupported_event", { event: input.eventName });
+    }
+    const installationId = readInstallationId(input.payload) ?? parsed.ctx.installationId;
+    const binding = githubBindingStateForEvent({
+        kind: parsed.ctx.conversation.kind,
+        owner: parsed.ctx.repository.owner,
+        repo: parsed.ctx.repository.name,
+        number: parsed.ctx.conversation.number,
+        repositoryId: parsed.ctx.repository.id,
+        repositoryUrl: parsed.ctx.repository.url,
+        installationId,
+    });
+    const ctx = enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: parsed.ctx,
+        payload: input.payload,
+        bindingState: binding,
+        installationId,
+        host: input.args.host,
+        artifacts: input.args.artifacts,
+        send: input.args.send,
+    });
+    const dispatch = await input.options.onEvent(ctx, parsed.event);
+    if (dispatch === null) {
+        return skipped("not_dispatched", { event: input.eventName });
+    }
+    if (isTaskDispatch(dispatch)) {
+        return acknowledgeTask(input.args, GITHUB_CHANNEL_KIND, dispatch, {
+            event: input.eventName,
+            ...(parsed.event.action === undefined ? {} : { action: parsed.event.action }),
         });
+    }
+    if (ctx.conversation.number === 0) {
+        return skipped("no_conversation", { event: input.eventName });
+    }
+    const message = [
+        dispatch.message ?? `GitHub ${input.eventName} event`,
+        ...(dispatch.context ?? []),
+    ].join("\n");
+    return startTurn({
+        options: input.options,
+        args: input.args,
+        ctx,
+        message,
+        dispatch,
+        state: sessionStateFromBinding({
+            binding,
+            deliveryId: ctx.deliveryId,
+            eventName: ctx.eventName,
+        }),
     });
 }
-function startTurn(input) {
-    return __awaiter(this, void 0, void 0, function* () {
-        var _a;
-        const files = input.dispatch.workspaceFiles;
-        const lazy = typeof files === "function";
-        const cloud = (_a = input.dispatch.cloud) !== null && _a !== void 0 ? _a : input.cloud;
-        const state = Object.assign(Object.assign({}, input.dispatch.state), input.state);
-        const sendTurn = () => __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const workspaceFiles = lazy ? yield files() : files;
-            const source = continuationSource(input.options.continuation, "github");
-            return input.args.send(input.message, Object.assign(Object.assign(Object.assign(Object.assign({ auth: input.dispatch.auth }, (source === "engine" ? { continuationToken: githubContinuationKey(input.ctx) } : {})), { title: (_a = input.dispatch.title) !== null && _a !== void 0 ? _a : defaultGitHubTitle(input.ctx), cloud }), (workspaceFiles === undefined ? {} : { workspaceFiles })), { state: state, 
-                // Resume must refresh headSha / refs without wiping sticky banner id.
-                refreshState: state }));
+async function startTurn(input) {
+    const files = input.dispatch.workspaceFiles;
+    const lazy = typeof files === "function";
+    const cloud = input.dispatch.cloud ?? input.cloud;
+    const state = { ...input.dispatch.state, ...input.state };
+    const sendTurn = async () => {
+        const workspaceFiles = lazy ? await files() : files;
+        const source = continuationSource(input.options.continuation, "github");
+        return input.args.send(input.message, {
+            auth: input.dispatch.auth,
+            ...(source === "engine" ? { continuationToken: githubContinuationKey(input.ctx) } : {}),
+            title: input.dispatch.title ?? defaultGitHubTitle(input.ctx),
+            cloud,
+            ...(workspaceFiles === undefined ? {} : { workspaceFiles }),
+            state: state,
+            // Resume must refresh headSha / refs without wiping sticky banner id.
+            refreshState: state,
         });
-        if (lazy) {
-            scheduleAfterAck(input.args, GITHUB_CHANNEL_KIND, () => __awaiter(this, void 0, void 0, function* () {
-                yield sendTurn();
-            }));
-            return acknowledgeTurn();
-        }
-        return turnStarted(yield sendTurn());
-    });
+    };
+    if (lazy) {
+        scheduleAfterAck(input.args, GITHUB_CHANNEL_KIND, async () => {
+            await sendTurn();
+        });
+        return acknowledgeTurn();
+    }
+    return turnStarted(await sendTurn());
 }
 function formatCiMessage(label, id, event) {
-    var _a;
-    const outcome = (_a = event.conclusion) !== null && _a !== void 0 ? _a : event.status;
+    const outcome = event.conclusion ?? event.status;
     return `${label} ${event.action}: ${id}${outcome ? ` (${outcome})` : ""}`;
 }
 function isIgnoredInboundComment(body, author, botName) {
@@ -1276,11 +1399,11 @@ function isIgnoredInboundComment(body, author, botName) {
 }
 /** Match GitHub App bot actors (`slug` config vs `slug[bot]` login). */
 export function isGitHubAppBotAuthor(author, botName) {
-    const normalizedBot = botName === null || botName === void 0 ? void 0 : botName.trim();
+    const normalizedBot = botName?.trim();
     if (normalizedBot === undefined || normalizedBot === "") {
         return false;
     }
-    if ((author === null || author === void 0 ? void 0 : author.type) !== "Bot") {
+    if (author?.type !== "Bot") {
         return false;
     }
     const login = author.login;
@@ -1289,8 +1412,6 @@ export function isGitHubAppBotAuthor(author, botName) {
         stripBotSuffix(login) === stripBotSuffix(normalizedBot));
 }
 function parseIssueCommentEvent(args) {
-    var _a;
-    var _b;
     const schema = z.object({
         action: z.string().min(1),
         repository: repositorySchema,
@@ -1324,18 +1445,29 @@ function parseIssueCommentEvent(args) {
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
     const author = toUser(payload.comment.user);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
-    const ctx = Object.assign(Object.assign(Object.assign(Object.assign({}, (args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId })), { eventName: "issue_comment", repository, conversation: {
+    const installationId = payload.installation?.id;
+    const ctx = {
+        ...(args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId }),
+        eventName: "issue_comment",
+        repository,
+        conversation: {
             kind,
             number: payload.issue.number,
             url: payload.issue.html_url,
-        } }), (sender === undefined ? {} : { sender, senderLogin: sender.login })), (installationId === undefined ? {} : { installationId }));
-    const comment = Object.assign({ id: payload.comment.id, body: payload.comment.body, htmlUrl: payload.comment.html_url, url: (_b = payload.comment.url) !== null && _b !== void 0 ? _b : payload.comment.html_url }, (author === undefined ? {} : { author }));
+        },
+        ...(sender === undefined ? {} : { sender, senderLogin: sender.login }),
+        ...(installationId === undefined ? {} : { installationId }),
+    };
+    const comment = {
+        id: payload.comment.id,
+        body: payload.comment.body,
+        htmlUrl: payload.comment.html_url,
+        url: payload.comment.url ?? payload.comment.html_url,
+        ...(author === undefined ? {} : { author }),
+    };
     return { action: payload.action, ctx, comment };
 }
 function parseReviewCommentEvent(args) {
-    var _a, _b, _c, _d;
-    var _e;
     const schema = z.object({
         action: z.string().min(1),
         repository: repositorySchema,
@@ -1382,28 +1514,44 @@ function parseReviewCommentEvent(args) {
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
     const author = toUser(payload.comment.user);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
-    const ctx = Object.assign(Object.assign(Object.assign(Object.assign({}, (args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId })), { eventName: "pull_request_review_comment", repository, conversation: {
+    const installationId = payload.installation?.id;
+    const ctx = {
+        ...(args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId }),
+        eventName: "pull_request_review_comment",
+        repository,
+        conversation: {
             kind: "review_thread",
             number: payload.pull_request.number,
             url: payload.pull_request.html_url,
-        } }), (sender === undefined ? {} : { sender, senderLogin: sender.login })), (installationId === undefined ? {} : { installationId }));
-    const comment = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ id: payload.comment.id, body: payload.comment.body, htmlUrl: payload.comment.html_url, url: (_e = payload.comment.url) !== null && _e !== void 0 ? _e : payload.comment.html_url }, (author === undefined ? {} : { author })), (payload.comment.path === undefined ? {} : { path: payload.comment.path })), (payload.comment.line === undefined ? {} : { line: payload.comment.line })), (payload.comment.pull_request_review_id === undefined
-        ? {}
-        : { pullRequestReviewId: payload.comment.pull_request_review_id })), (payload.comment.in_reply_to_id === undefined
-        ? {}
-        : { inReplyToId: payload.comment.in_reply_to_id }));
+        },
+        ...(sender === undefined ? {} : { sender, senderLogin: sender.login }),
+        ...(installationId === undefined ? {} : { installationId }),
+    };
+    const comment = {
+        id: payload.comment.id,
+        body: payload.comment.body,
+        htmlUrl: payload.comment.html_url,
+        url: payload.comment.url ?? payload.comment.html_url,
+        ...(author === undefined ? {} : { author }),
+        ...(payload.comment.path === undefined ? {} : { path: payload.comment.path }),
+        ...(payload.comment.line === undefined ? {} : { line: payload.comment.line }),
+        ...(payload.comment.pull_request_review_id === undefined
+            ? {}
+            : { pullRequestReviewId: payload.comment.pull_request_review_id }),
+        ...(payload.comment.in_reply_to_id === undefined
+            ? {}
+            : { inReplyToId: payload.comment.in_reply_to_id }),
+    };
     return {
         action: payload.action,
         ctx,
         comment,
-        headSha: (_b = payload.pull_request.head) === null || _b === void 0 ? void 0 : _b.sha,
-        headRef: (_c = payload.pull_request.head) === null || _c === void 0 ? void 0 : _c.ref,
-        baseRef: (_d = payload.pull_request.base) === null || _d === void 0 ? void 0 : _d.ref,
+        headSha: payload.pull_request.head?.sha,
+        headRef: payload.pull_request.head?.ref,
+        baseRef: payload.pull_request.base?.ref,
     };
 }
 function parseIssueEvent(args) {
-    var _a, _b;
     const schema = z.object({
         action: z.string().min(1),
         repository: repositorySchema,
@@ -1428,20 +1576,32 @@ function parseIssueEvent(args) {
     const payload = parsed.data;
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
-    const ctx = Object.assign(Object.assign(Object.assign(Object.assign({}, (args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId })), { eventName: "issues", repository, conversation: {
+    const installationId = payload.installation?.id;
+    const ctx = {
+        ...(args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId }),
+        eventName: "issues",
+        repository,
+        conversation: {
             kind: "issue",
             number: payload.issue.number,
             url: payload.issue.html_url,
-        } }), (sender === undefined ? {} : { sender, senderLogin: sender.login })), (installationId === undefined ? {} : { installationId }));
-    const issue = Object.assign(Object.assign({ action: payload.action, number: payload.issue.number, url: payload.issue.html_url, title: payload.issue.title }, (payload.issue.body === undefined || payload.issue.body === null
-        ? {}
-        : { body: payload.issue.body })), (((_b = payload.issue.user) === null || _b === void 0 ? void 0 : _b.login) === undefined ? {} : { authorLogin: payload.issue.user.login }));
+        },
+        ...(sender === undefined ? {} : { sender, senderLogin: sender.login }),
+        ...(installationId === undefined ? {} : { installationId }),
+    };
+    const issue = {
+        action: payload.action,
+        number: payload.issue.number,
+        url: payload.issue.html_url,
+        title: payload.issue.title,
+        ...(payload.issue.body === undefined || payload.issue.body === null
+            ? {}
+            : { body: payload.issue.body }),
+        ...(payload.issue.user?.login === undefined ? {} : { authorLogin: payload.issue.user.login }),
+    };
     return { ctx, issue };
 }
 function parseCheckSuiteEvent(args) {
-    var _a;
-    var _b, _c;
     const schema = z.object({
         action: z.string().min(1),
         repository: repositorySchema,
@@ -1474,9 +1634,17 @@ function parseCheckSuiteEvent(args) {
     const payload = parsed.data;
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
+    const installationId = payload.installation?.id;
     const pullRequests = toCiPullRequests(payload.check_suite.pull_requests);
-    const checkSuite = Object.assign(Object.assign({ action: payload.action, checkSuiteId: payload.check_suite.id, headSha: payload.check_suite.head_sha }, (payload.check_suite.status === undefined ? {} : { status: payload.check_suite.status })), { conclusion: ((_b = payload.check_suite.conclusion) !== null && _b !== void 0 ? _b : null), app: toCiApp(payload.check_suite.app), pullRequests });
+    const checkSuite = {
+        action: payload.action,
+        checkSuiteId: payload.check_suite.id,
+        headSha: payload.check_suite.head_sha,
+        ...(payload.check_suite.status === undefined ? {} : { status: payload.check_suite.status }),
+        conclusion: (payload.check_suite.conclusion ?? null),
+        app: toCiApp(payload.check_suite.app),
+        pullRequests,
+    };
     const unanchoredCtx = unanchoredEventContext({
         deliveryId: args.deliveryId,
         eventName: "check_suite",
@@ -1489,18 +1657,19 @@ function parseCheckSuiteEvent(args) {
         return { ctx: null, unanchoredCtx, checkSuite };
     }
     return {
-        ctx: Object.assign(Object.assign({}, unanchoredCtx), { conversation: {
+        ctx: {
+            ...unanchoredCtx,
+            conversation: {
                 kind: "pull_request",
                 number: first.number,
-                url: (_c = first.url) !== null && _c !== void 0 ? _c : `${repository.url}/pull/${first.number}`,
-            } }),
+                url: first.url ?? `${repository.url}/pull/${first.number}`,
+            },
+        },
         unanchoredCtx,
         checkSuite,
     };
 }
 function parseCheckRunEvent(args) {
-    var _a, _b;
-    var _c, _d;
     const schema = z.object({
         action: z.string().min(1),
         repository: repositorySchema,
@@ -1540,11 +1709,21 @@ function parseCheckRunEvent(args) {
     const payload = parsed.data;
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
+    const installationId = payload.installation?.id;
     const pullRequests = toCiPullRequests(payload.check_run.pull_requests);
-    const checkRun = Object.assign(Object.assign(Object.assign(Object.assign({ action: payload.action, checkRunId: payload.check_run.id, headSha: payload.check_run.head_sha }, (payload.check_run.name === undefined ? {} : { name: payload.check_run.name })), (((_b = payload.check_run.check_suite) === null || _b === void 0 ? void 0 : _b.id) === undefined
-        ? {}
-        : { checkSuiteId: payload.check_run.check_suite.id })), (payload.check_run.status === undefined ? {} : { status: payload.check_run.status })), { conclusion: ((_c = payload.check_run.conclusion) !== null && _c !== void 0 ? _c : null), app: toCiApp(payload.check_run.app), pullRequests });
+    const checkRun = {
+        action: payload.action,
+        checkRunId: payload.check_run.id,
+        headSha: payload.check_run.head_sha,
+        ...(payload.check_run.name === undefined ? {} : { name: payload.check_run.name }),
+        ...(payload.check_run.check_suite?.id === undefined
+            ? {}
+            : { checkSuiteId: payload.check_run.check_suite.id }),
+        ...(payload.check_run.status === undefined ? {} : { status: payload.check_run.status }),
+        conclusion: (payload.check_run.conclusion ?? null),
+        app: toCiApp(payload.check_run.app),
+        pullRequests,
+    };
     const unanchoredCtx = unanchoredEventContext({
         deliveryId: args.deliveryId,
         eventName: "check_run",
@@ -1557,18 +1736,19 @@ function parseCheckRunEvent(args) {
         return { ctx: null, unanchoredCtx, checkRun };
     }
     return {
-        ctx: Object.assign(Object.assign({}, unanchoredCtx), { conversation: {
+        ctx: {
+            ...unanchoredCtx,
+            conversation: {
                 kind: "pull_request",
                 number: first.number,
-                url: (_d = first.url) !== null && _d !== void 0 ? _d : `${repository.url}/pull/${first.number}`,
-            } }),
+                url: first.url ?? `${repository.url}/pull/${first.number}`,
+            },
+        },
         unanchoredCtx,
         checkRun,
     };
 }
 function parseWorkflowRunEvent(args) {
-    var _a;
-    var _b, _c;
     const schema = z.object({
         action: z.string().min(1),
         repository: repositorySchema,
@@ -1597,17 +1777,27 @@ function parseWorkflowRunEvent(args) {
     const payload = parsed.data;
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
+    const installationId = payload.installation?.id;
     const pullRequests = toCiPullRequests(payload.workflow_run.pull_requests);
-    const workflowRun = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ action: payload.action, workflowRunId: payload.workflow_run.id, headSha: payload.workflow_run.head_sha }, (payload.workflow_run.name === undefined || payload.workflow_run.name === null
-        ? {}
-        : { name: payload.workflow_run.name })), (payload.workflow_run.workflow_id === undefined
-        ? {}
-        : { workflowId: payload.workflow_run.workflow_id })), (payload.workflow_run.html_url === undefined
-        ? {}
-        : { htmlUrl: payload.workflow_run.html_url })), (payload.workflow_run.status === undefined ? {} : { status: payload.workflow_run.status })), { conclusion: ((_b = payload.workflow_run.conclusion) !== null && _b !== void 0 ? _b : null), 
+    const workflowRun = {
+        action: payload.action,
+        workflowRunId: payload.workflow_run.id,
+        headSha: payload.workflow_run.head_sha,
+        ...(payload.workflow_run.name === undefined || payload.workflow_run.name === null
+            ? {}
+            : { name: payload.workflow_run.name }),
+        ...(payload.workflow_run.workflow_id === undefined
+            ? {}
+            : { workflowId: payload.workflow_run.workflow_id }),
+        ...(payload.workflow_run.html_url === undefined
+            ? {}
+            : { htmlUrl: payload.workflow_run.html_url }),
+        ...(payload.workflow_run.status === undefined ? {} : { status: payload.workflow_run.status }),
+        conclusion: (payload.workflow_run.conclusion ?? null),
         // workflow_run is GitHub Actions-only (Eve semantics).
-        app: { slug: "github-actions", name: "GitHub Actions" }, pullRequests });
+        app: { slug: "github-actions", name: "GitHub Actions" },
+        pullRequests,
+    };
     const unanchoredCtx = unanchoredEventContext({
         deliveryId: args.deliveryId,
         eventName: "workflow_run",
@@ -1620,18 +1810,19 @@ function parseWorkflowRunEvent(args) {
         return { ctx: null, unanchoredCtx, workflowRun };
     }
     return {
-        ctx: Object.assign(Object.assign({}, unanchoredCtx), { conversation: {
+        ctx: {
+            ...unanchoredCtx,
+            conversation: {
                 kind: "pull_request",
                 number: first.number,
-                url: (_c = first.url) !== null && _c !== void 0 ? _c : `${repository.url}/pull/${first.number}`,
-            } }),
+                url: first.url ?? `${repository.url}/pull/${first.number}`,
+            },
+        },
         unanchoredCtx,
         workflowRun,
     };
 }
 function parseStatusEvent(args) {
-    var _a;
-    var _b, _c, _d, _e;
     const schema = z.object({
         state: z.string().min(1),
         sha: z.string().min(1),
@@ -1668,24 +1859,45 @@ function parseStatusEvent(args) {
     const payload = parsed.data;
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
+    const installationId = payload.installation?.id;
     const pullRequests = toCiPullRequests(payload.pull_requests);
     const first = pullRequests[0];
-    const status = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ state: payload.state, context: (_b = payload.context) !== null && _b !== void 0 ? _b : "" }, (payload.description === undefined ? {} : { description: payload.description })), (payload.target_url === undefined ? {} : { targetUrl: payload.target_url })), { sha: payload.sha }), (payload.name === undefined ? {} : { name: payload.name })), { branches: ((_c = payload.branches) !== null && _c !== void 0 ? _c : []).map(branch => (Object.assign({ name: branch.name }, (branch.commit === undefined ? {} : { commit: branch.commit })))) }), (payload.commit === undefined
-        ? {}
-        : {
-            commit: Object.assign(Object.assign({}, (payload.commit.sha === undefined ? {} : { sha: payload.commit.sha })), (payload.commit.html_url === undefined ? {} : { htmlUrl: payload.commit.html_url })),
-        })), { raw: args.payload });
-    const ctx = Object.assign(Object.assign(Object.assign(Object.assign({}, (args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId })), { eventName: "status", repository, conversation: {
+    const status = {
+        state: payload.state,
+        context: payload.context ?? "",
+        ...(payload.description === undefined ? {} : { description: payload.description }),
+        ...(payload.target_url === undefined ? {} : { targetUrl: payload.target_url }),
+        sha: payload.sha,
+        ...(payload.name === undefined ? {} : { name: payload.name }),
+        branches: (payload.branches ?? []).map(branch => ({
+            name: branch.name,
+            ...(branch.commit === undefined ? {} : { commit: branch.commit }),
+        })),
+        ...(payload.commit === undefined
+            ? {}
+            : {
+                commit: {
+                    ...(payload.commit.sha === undefined ? {} : { sha: payload.commit.sha }),
+                    ...(payload.commit.html_url === undefined ? {} : { htmlUrl: payload.commit.html_url }),
+                },
+            }),
+        raw: args.payload,
+    };
+    const ctx = {
+        ...(args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId }),
+        eventName: "status",
+        repository,
+        conversation: {
             kind: "pull_request",
-            number: (_d = first === null || first === void 0 ? void 0 : first.number) !== null && _d !== void 0 ? _d : 0,
-            url: (_e = first === null || first === void 0 ? void 0 : first.url) !== null && _e !== void 0 ? _e : repository.url,
-        } }), (sender === undefined ? {} : { sender, senderLogin: sender.login })), (installationId === undefined ? {} : { installationId }));
+            number: first?.number ?? 0,
+            url: first?.url ?? repository.url,
+        },
+        ...(sender === undefined ? {} : { sender, senderLogin: sender.login }),
+        ...(installationId === undefined ? {} : { installationId }),
+    };
     return { ctx, status };
 }
 function parseGenericEvent(args) {
-    var _a, _b, _c, _d, _e, _f;
-    var _g, _h, _j, _k;
     const schema = z.object({
         action: z.string().optional(),
         repository: repositorySchema.optional(),
@@ -1715,45 +1927,78 @@ function parseGenericEvent(args) {
     }
     const repository = toRepositoryRef(payload.repository);
     const sender = toUser(payload.sender);
-    const installationId = (_a = payload.installation) === null || _a === void 0 ? void 0 : _a.id;
-    const kind = ((_b = payload.issue) === null || _b === void 0 ? void 0 : _b.pull_request) !== undefined
+    const installationId = payload.installation?.id;
+    const kind = payload.issue?.pull_request !== undefined
         ? "pull_request"
         : payload.issue !== undefined
             ? "issue"
             : "pull_request";
-    const number = (_h = (_g = (_c = payload.issue) === null || _c === void 0 ? void 0 : _c.number) !== null && _g !== void 0 ? _g : (_d = payload.pull_request) === null || _d === void 0 ? void 0 : _d.number) !== null && _h !== void 0 ? _h : 0;
-    const url = (_k = (_j = (_e = payload.issue) === null || _e === void 0 ? void 0 : _e.html_url) !== null && _j !== void 0 ? _j : (_f = payload.pull_request) === null || _f === void 0 ? void 0 : _f.html_url) !== null && _k !== void 0 ? _k : repository.url;
-    const event = Object.assign(Object.assign(Object.assign({ eventName: args.eventName }, (args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId })), (payload.action === undefined ? {} : { action: payload.action })), { payload: args.payload });
-    const ctx = Object.assign(Object.assign(Object.assign(Object.assign({}, (args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId })), { eventName: args.eventName, repository, conversation: { kind, number, url } }), (sender === undefined ? {} : { sender, senderLogin: sender.login })), (installationId === undefined ? {} : { installationId }));
+    const number = payload.issue?.number ?? payload.pull_request?.number ?? 0;
+    const url = payload.issue?.html_url ?? payload.pull_request?.html_url ?? repository.url;
+    const event = {
+        eventName: args.eventName,
+        ...(args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId }),
+        ...(payload.action === undefined ? {} : { action: payload.action }),
+        payload: args.payload,
+    };
+    const ctx = {
+        ...(args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId }),
+        eventName: args.eventName,
+        repository,
+        conversation: { kind, number, url },
+        ...(sender === undefined ? {} : { sender, senderLogin: sender.login }),
+        ...(installationId === undefined ? {} : { installationId }),
+    };
     return { ctx, event };
 }
 function unanchoredEventContext(args) {
-    return Object.assign(Object.assign(Object.assign(Object.assign({}, (args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId })), { eventName: args.eventName, repository: args.repository, conversation: {
+    return {
+        ...(args.deliveryId === undefined ? {} : { deliveryId: args.deliveryId }),
+        eventName: args.eventName,
+        repository: args.repository,
+        conversation: {
             kind: "pull_request",
             number: 0,
             url: args.repository.url,
-        } }), (args.sender === undefined ? {} : { sender: args.sender, senderLogin: args.sender.login })), (args.installationId === undefined ? {} : { installationId: args.installationId }));
+        },
+        ...(args.sender === undefined ? {} : { sender: args.sender, senderLogin: args.sender.login }),
+        ...(args.installationId === undefined ? {} : { installationId: args.installationId }),
+    };
 }
 function toRepositoryRef(repo) {
-    var _a;
-    var _b, _c, _d, _e;
     const [ownerFromName, nameFromFull] = repo.full_name.split("/");
-    return Object.assign({ fullName: repo.full_name, url: repo.html_url, owner: (_c = (_b = (_a = repo.owner) === null || _a === void 0 ? void 0 : _a.login) !== null && _b !== void 0 ? _b : ownerFromName) !== null && _c !== void 0 ? _c : "", name: (_e = (_d = repo.name) !== null && _d !== void 0 ? _d : nameFromFull) !== null && _e !== void 0 ? _e : repo.full_name }, (repo.id === undefined ? {} : { id: repo.id }));
+    return {
+        fullName: repo.full_name,
+        url: repo.html_url,
+        owner: repo.owner?.login ?? ownerFromName ?? "",
+        name: repo.name ?? nameFromFull ?? repo.full_name,
+        ...(repo.id === undefined ? {} : { id: repo.id }),
+    };
 }
 function toUser(raw) {
-    if ((raw === null || raw === void 0 ? void 0 : raw.login) === undefined || raw.login === "")
+    if (raw?.login === undefined || raw.login === "")
         return undefined;
-    return Object.assign(Object.assign({ login: raw.login }, (raw.id === undefined ? {} : { id: raw.id })), (raw.type === undefined ? {} : { type: raw.type }));
+    return {
+        login: raw.login,
+        ...(raw.id === undefined ? {} : { id: raw.id }),
+        ...(raw.type === undefined ? {} : { type: raw.type }),
+    };
 }
 function toCiPullRequests(raw) {
-    return (raw !== null && raw !== void 0 ? raw : []).map(pr => (Object.assign({ number: pr.number }, (pr.html_url !== undefined
-        ? { url: pr.html_url }
-        : pr.url !== undefined
-            ? { url: pr.url }
-            : {}))));
+    return (raw ?? []).map(pr => ({
+        number: pr.number,
+        ...(pr.html_url !== undefined
+            ? { url: pr.html_url }
+            : pr.url !== undefined
+                ? { url: pr.url }
+                : {}),
+    }));
 }
 function toCiApp(raw) {
-    return Object.assign(Object.assign({}, ((raw === null || raw === void 0 ? void 0 : raw.slug) === undefined ? {} : { slug: raw.slug })), ((raw === null || raw === void 0 ? void 0 : raw.name) === undefined ? {} : { name: raw.name }));
+    return {
+        ...(raw?.slug === undefined ? {} : { slug: raw.slug }),
+        ...(raw?.name === undefined ? {} : { name: raw.name }),
+    };
 }
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -1767,8 +2012,16 @@ function enrichEventContext(input) {
         config: input.bindingConfig,
         state: input.bindingState,
     });
-    return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, input.ctx), { payload: input.payload }), (input.installationId === undefined ? {} : { installationId: input.installationId })), { github,
-        thread, host: input.host, artifacts: input.artifacts }), (input.send === undefined ? {} : { send: input.send }));
+    return {
+        ...input.ctx,
+        payload: input.payload,
+        ...(input.installationId === undefined ? {} : { installationId: input.installationId }),
+        github,
+        thread,
+        host: input.host,
+        artifacts: input.artifacts,
+        ...(input.send === undefined ? {} : { send: input.send }),
+    };
 }
 /**
  * Enrich an unanchored CI context (`conversation.number === 0`). The binding
@@ -1784,45 +2037,62 @@ function enrichCiContext(input) {
         repositoryUrl: input.ctx.repository.url,
         installationId: input.installationId,
     });
-    return enrichEventContext(Object.assign({ bindingConfig: input.bindingConfig, ctx: input.ctx, bindingState: binding, installationId: input.installationId, payload: input.payload, host: input.host, artifacts: input.artifacts }, (input.send === undefined ? {} : { send: input.send })));
+    return enrichEventContext({
+        bindingConfig: input.bindingConfig,
+        ctx: input.ctx,
+        bindingState: binding,
+        installationId: input.installationId,
+        payload: input.payload,
+        host: input.host,
+        artifacts: input.artifacts,
+        ...(input.send === undefined ? {} : { send: input.send }),
+    });
 }
 /** Build the durable per-session channel state stored with the turn. */
 function sessionStateFromBinding(input) {
-    var _a, _b, _c, _d;
-    return emptyGitHubChannelState(Object.assign(Object.assign({}, input.binding), { deliveryId: (_a = input.deliveryId) !== null && _a !== void 0 ? _a : null, eventName: input.eventName, headSha: (_b = input.headSha) !== null && _b !== void 0 ? _b : null, baseRef: (_c = input.baseRef) !== null && _c !== void 0 ? _c : null, headRef: (_d = input.headRef) !== null && _d !== void 0 ? _d : null }));
+    return emptyGitHubChannelState({
+        ...input.binding,
+        deliveryId: input.deliveryId ?? null,
+        eventName: input.eventName,
+        headSha: input.headSha ?? null,
+        baseRef: input.baseRef ?? null,
+        headRef: input.headRef ?? null,
+    });
 }
 /** Read `installation.id` from a raw webhook payload when present. */
 function readInstallationId(payload) {
     if (typeof payload !== "object" || payload === null)
         return undefined;
     const installation = payload.installation;
-    return typeof (installation === null || installation === void 0 ? void 0 : installation.id) === "number" ? installation.id : undefined;
+    return typeof installation?.id === "number" ? installation.id : undefined;
 }
+/**
+ * The omitted-`webhookSecret` fallback: a {@link SecretRef} naming
+ * `GITHUB_WEBHOOK_SECRET`, present only while that env var is set at
+ * channel construction. Named rather than read so the fallback keeps the
+ * same route policy (and the same control-plane catch declaration) as an
+ * authored `{ secretName: "GITHUB_WEBHOOK_SECRET" }`.
+ */
 function envWebhookSecret() {
-    if (process.env.GITHUB_WEBHOOK_SECRET === undefined || process.env.GITHUB_WEBHOOK_SECRET === "") {
+    return envSecretRef(GITHUB_WEBHOOK_SECRET_ENV);
+}
+async function resolveCloudOptions(cloud, ctx, pullRequest) {
+    if (cloud === undefined || cloud === false) {
         return undefined;
     }
-    return () => process.env.GITHUB_WEBHOOK_SECRET;
-}
-function resolveCloudOptions(cloud, ctx, pullRequest) {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (cloud === undefined || cloud === false) {
-            return undefined;
-        }
-        if (cloud === true) {
-            return {
-                repos: [
-                    {
-                        url: ctx.repository.url,
-                        prUrl: pullRequest.url,
-                        startingRef: pullRequest.headSha,
-                    },
-                ],
-            };
-        }
-        if (typeof cloud === "function") {
-            return yield cloud(ctx, pullRequest);
-        }
-        return cloud;
-    });
+    if (cloud === true) {
+        return {
+            repos: [
+                {
+                    url: ctx.repository.url,
+                    prUrl: pullRequest.url,
+                    startingRef: pullRequest.headSha,
+                },
+            ],
+        };
+    }
+    if (typeof cloud === "function") {
+        return await cloud(ctx, pullRequest);
+    }
+    return cloud;
 }