@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.1

package/src/automation.js

@@ -0,0 +1,901 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { mkdir, open, readFile, rename } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { CODEFLOW_HOME } from "./config.js";
+import { untrustedBlock } from "./github.js";
+import { logError, logInfo, logWarn } from "./log.js";
+import { readRepoConfig } from "./repo-config.js";
+import { findSweepItem, nextSweepItems, sourceKeys, sweepTakes, upgradeLegacyKeys } from "./sweeps.js";
+const MAX_HANDLED = 2e3;
+const MAX_DELIVERIES = 500;
+const MAX_QUEUED = 10;
+const MAX_EVENT_HISTORY = 100;
+const WEBHOOK_RUNS_PER_HOUR = 10;
+const HOUR = 36e5;
+const MISSED_GRACE_MS = HOUR;
+const FILE = join(CODEFLOW_HOME, "triggers.json");
+const MIN_EVERY_MINUTES = 5;
+const SWEEP_KINDS = ["issues", "dependabot", "alerts"];
+function validateSchedule(input) {
+  if (!input || typeof input !== "object") return void 0;
+  const raw = input;
+  if (raw.every !== void 0) {
+    const every = Math.round(Number(raw.every));
+    if (!Number.isFinite(every) || every < MIN_EVERY_MINUTES) throw new Error(`Repeat at most every ${MIN_EVERY_MINUTES} minutes`);
+    return { every: Math.min(every, 7 * 24 * 60) };
+  }
+  if (typeof raw.at === "string") {
+    if (!/^([01]\d|2[0-3]):[0-5]\d$/.test(raw.at)) throw new Error('Time must look like "07:30"');
+    if (raw.days !== void 0 && (!Array.isArray(raw.days) || raw.days.length > 7 || !raw.days.length || raw.days.some((d) => !Number.isInteger(d) || d < 0 || d > 6))) throw new Error("Choose at least one valid day of the week");
+    const days = Array.isArray(raw.days) ? [...new Set(raw.days)].sort() : void 0;
+    let timezone;
+    if (raw.timezone !== void 0) {
+      if (typeof raw.timezone !== "string" || !raw.timezone.trim() || raw.timezone.length > 100) throw new Error("Choose a valid IANA time zone, such as Europe/Stockholm");
+      try {
+        timezone = new Intl.DateTimeFormat("en", { timeZone: raw.timezone.trim() }).resolvedOptions().timeZone;
+      } catch {
+        throw new Error("Choose a valid IANA time zone, such as Europe/Stockholm");
+      }
+    }
+    return { at: raw.at, days: days?.length && days.length < 7 ? days : void 0, ...timezone ? { timezone } : {} };
+  }
+  throw new Error("A schedule needs every (minutes) or at (HH:MM)");
+}
+const zoneFormats = /* @__PURE__ */ new Map();
+function zonedParts(at, timezone) {
+  let format = zoneFormats.get(timezone);
+  if (!format) {
+    format = new Intl.DateTimeFormat("en-GB", { timeZone: timezone, calendar: "gregory", numberingSystem: "latn", year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", hourCycle: "h23" });
+    if (zoneFormats.size >= 64) zoneFormats.clear();
+    zoneFormats.set(timezone, format);
+  }
+  const parts = Object.fromEntries(format.formatToParts(at).map((p) => [p.type, p.value]));
+  return { year: Number(parts.year), month: Number(parts.month), day: Number(parts.day), hour: Number(parts.hour), minute: Number(parts.minute) };
+}
+const wallTime = (p) => Date.UTC(p.year, p.month - 1, p.day, p.hour, p.minute);
+function zonedTime(day, hour, minute, timezone) {
+  const desired = Date.UTC(day.getUTCFullYear(), day.getUTCMonth(), day.getUTCDate(), hour, minute);
+  const offsets = new Set([-36, -12, 0, 12, 36].map((h) => {
+    const sample = desired + h * HOUR;
+    return wallTime(zonedParts(sample, timezone)) - sample;
+  }));
+  const candidates = [...offsets].map((offset) => desired - offset).sort((a, b) => a - b);
+  const exact = candidates.find((at) => wallTime(zonedParts(at, timezone)) === desired);
+  if (exact !== void 0) return exact;
+  return candidates.filter((at) => {
+    const p = zonedParts(at, timezone);
+    return p.year === day.getUTCFullYear() && p.month === day.getUTCMonth() + 1 && p.day === day.getUTCDate() && wallTime(p) > desired;
+  }).sort((a, b) => wallTime(zonedParts(a, timezone)) - wallTime(zonedParts(b, timezone)))[0];
+}
+function nextFire(schedule, after) {
+  if ("every" in schedule) return after + schedule.every * 6e4;
+  const [h, m] = schedule.at.split(":").map(Number);
+  if (schedule.timezone) {
+    const local = zonedParts(after, schedule.timezone);
+    const day = new Date(Date.UTC(local.year, local.month - 1, local.day));
+    for (let i = 0; i < 14; i++) {
+      if (!schedule.days?.length || schedule.days.includes(day.getUTCDay())) {
+        const candidate = zonedTime(day, h, m, schedule.timezone);
+        if (candidate !== void 0 && candidate > after) return candidate;
+      }
+      day.setUTCDate(day.getUTCDate() + 1);
+    }
+    throw new Error("Could not find the next scheduled time in this time zone");
+  }
+  const d = new Date(after);
+  const nextDay = () => {
+    d.setDate(d.getDate() + 1);
+    d.setHours(h, m, 0, 0);
+  };
+  d.setHours(h, m, 0, 0);
+  if (d.getTime() <= after) nextDay();
+  for (let i = 0; i < 7 && schedule.days?.length && !schedule.days.includes(d.getDay()); i++) nextDay();
+  return d.getTime();
+}
+function previewSchedule(input, after = Date.now(), count = 5) {
+  const schedule = validateSchedule(input);
+  if (!schedule) return [];
+  if (!Number.isFinite(after) || !Number.isInteger(count) || count < 1 || count > 10) throw new Error("Schedule preview needs a valid date and 1\u201310 occurrences");
+  const times = [];
+  for (let i = 0; i < count; i++) {
+    after = nextFire(schedule, after);
+    times.push(after);
+  }
+  return times;
+}
+function stillDue(schedule, due, now) {
+  if (now - due > MISSED_GRACE_MS) return false;
+  if ("every" in schedule || !schedule.days?.length) return true;
+  const day = schedule.timezone ? zonedParts(due, schedule.timezone) : void 0;
+  const weekday = day ? new Date(Date.UTC(day.year, day.month - 1, day.day)).getUTCDay() : new Date(due).getDay();
+  return schedule.days.includes(weekday);
+}
+function resumeSchedule(schedule, saved, now) {
+  if (!saved || !Number.isFinite(saved)) return nextFire(schedule, now);
+  if (saved <= now) return stillDue(schedule, saved, now) ? saved : nextFire(schedule, now);
+  const longest = "every" in schedule ? schedule.every * 6e4 : 8 * 24 * HOUR;
+  return saved - now > longest ? nextFire(schedule, now) : saved;
+}
+function describeSchedule(schedule) {
+  if (!schedule) return "only when triggered";
+  if ("every" in schedule) return schedule.every % 60 === 0 ? `every ${schedule.every / 60} h` : `every ${schedule.every} min`;
+  const names = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+  const days = schedule.days?.length ? schedule.days.map((d) => names[d]).join(", ") : "every day";
+  return `${days} at ${schedule.at}${schedule.timezone ? ` (${schedule.timezone})` : " (server local time)"}`;
+}
+class Automations {
+  constructor(manager, startRun, listSweep, file = FILE) {
+    this.manager = manager;
+    this.startRun = startRun;
+    this.listSweep = listSweep;
+    this.file = file;
+  }
+  triggers = [];
+  managed;
+  setProjectTeams(hooks) {
+    this.managed = hooks;
+  }
+  /** Internal projection: execution settings remain owned by the team's versioned mission. */
+  async syncProjectTeam(team) {
+    this.requireWritable();
+    const id = `t-${team.id}`, previous = this.get(id);
+    if (previous && previous.target?.teamId !== team.id) throw new Error("Managed automation identity collision");
+    const enabled = team.status === "active", schedule = team.mission.schedule;
+    const next = { ...previous, id, target: { kind: "project-team", teamId: team.id }, name: team.name, run: { repo: team.repo, project: team.projectId, pattern: "auto-team", task: `Standing team: ${team.name}` }, schedule, enabled, webhook: false, isolate: false, token: previous?.token ?? randomBytes(24).toString("hex"), createdAt: previous?.createdAt ?? Date.now(), nextAt: enabled ? previous?.enabled && JSON.stringify(previous.schedule) === JSON.stringify(schedule) ? previous.nextAt : nextFire(schedule, Date.now()) : void 0 };
+    if (previous && JSON.stringify(previous) === JSON.stringify(next)) return id;
+    this.triggers = [...this.triggers.filter((t) => t.id !== id), next];
+    try {
+      await this.save(true);
+    } catch (error) {
+      this.triggers = this.triggers.filter((t) => t.id !== id);
+      if (previous) this.triggers.push(previous);
+      throw error;
+    }
+    return id;
+  }
+  timer;
+  unsubscribe;
+  saving = Promise.resolve();
+  stopped = false;
+  firing = /* @__PURE__ */ new Set();
+  /**
+   * False until triggers.json was read cleanly (or there was none). A file that couldn't be read
+   * or set aside is never written over: that would lose every automation and webhook secret.
+   */
+  writable = false;
+  /** Automations starting their run right now; a second fire meanwhile doesn't start another. */
+  starting = /* @__PURE__ */ new Set();
+  /** Sweeps listing their work right now. */
+  sweeping = /* @__PURE__ */ new Set();
+  /** Per sweep: the items a run is being started for right now. */
+  claimed = /* @__PURE__ */ new Map();
+  /**
+   * Read triggers.json. A file that isn't valid JSON, or isn't a list, is moved aside to
+   * `triggers.json.corrupt-<time>` (and logged), and code-flow starts with no automations; so
+   * is one with entries that can't be used, keeping the usable ones. Saved next times are kept.
+   */
+  async load(now = Date.now()) {
+    this.writable = false;
+    this.triggers = [];
+    let text;
+    try {
+      text = await readFile(this.file, "utf8");
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        logError(`Couldn't read ${this.file}; automations are off and it won't be written over until it can be read`, err);
+        return;
+      }
+    }
+    const entries = [];
+    if (text !== void 0) {
+      let parsed;
+      let why = "isn't a list of automations";
+      try {
+        parsed = JSON.parse(text);
+      } catch (err) {
+        why = `isn't valid JSON (${err.message})`;
+      }
+      if (Array.isArray(parsed)) entries.push(...parsed);
+      else if (!await this.setAside(why)) return;
+    }
+    let rejected = 0;
+    for (const entry of entries) {
+      const t = readTrigger(entry);
+      if (t) this.triggers.push(t);
+      else rejected++;
+    }
+    if (rejected && !await this.setAside(`has ${rejected} automation(s) code-flow can't read`)) {
+      this.triggers = [];
+      return;
+    }
+    this.writable = true;
+    for (const t of this.triggers) t.nextAt = t.enabled && t.schedule ? resumeSchedule(t.schedule, t.nextAt, now) : void 0;
+    if (rejected) await this.save();
+  }
+  /** Move triggers.json aside so it isn't lost when the usable automations are saved. */
+  async setAside(why) {
+    const aside = `${this.file}.corrupt-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+    try {
+      await rename(this.file, aside);
+      logError(`${this.file} ${why}: moved it to ${aside}`);
+      return true;
+    } catch (err) {
+      logError(`${this.file} ${why}, and it couldn't be moved aside; automations are off until it's fixed`, err);
+      return false;
+    }
+  }
+  list() {
+    return this.triggers.map((t) => ({ ...t }));
+  }
+  get(id) {
+    return this.triggers.find((t) => t.id === id);
+  }
+  async create(input) {
+    this.requireWritable();
+    const trigger = { ...input, id: `t-${randomBytes(4).toString("hex")}`, token: randomBytes(24).toString("hex"), createdAt: Date.now() };
+    trigger.nextAt = trigger.enabled && trigger.schedule ? nextFire(trigger.schedule, Date.now()) : void 0;
+    this.triggers.push(trigger);
+    await this.save();
+    return { ...trigger };
+  }
+  async update(id, patch) {
+    this.requireWritable();
+    const t = this.require(id);
+    if (t.target) throw new Error("Edit this automation through its standing project team");
+    const { rotateToken, ...rest } = patch;
+    const timing = JSON.stringify([t.enabled, t.schedule]);
+    Object.assign(t, rest);
+    if ("schedule" in patch && !patch.schedule) t.schedule = void 0;
+    if (rotateToken) t.token = randomBytes(24).toString("hex");
+    if (JSON.stringify([t.enabled, t.schedule]) !== timing || t.enabled && t.schedule && !t.nextAt) {
+      t.nextAt = t.enabled && t.schedule ? nextFire(t.schedule, Date.now()) : void 0;
+    }
+    if (!t.enabled) {
+      for (const queued of t.queued ?? []) this.updateEvent(t, queued.eventId, "dropped", "Automation was disabled before this event could run");
+      t.queued = void 0;
+    }
+    await this.save();
+    return { ...t };
+  }
+  /** A sweep started runs for these items itself (when you created it): don't start them again. */
+  async markHandled(id, keys) {
+    const t = this.require(id);
+    t.handled = [.../* @__PURE__ */ new Set([...t.handled ?? [], ...keys])].slice(-MAX_HANDLED);
+    await this.save();
+  }
+  async remove(id) {
+    this.requireWritable();
+    if (this.require(id).target) throw new Error("Archive this automation through its standing project team");
+    this.triggers = this.triggers.filter((t) => t.id !== id);
+    await this.save();
+  }
+  start(tickMs = 3e4) {
+    if (this.timer) return;
+    this.stopped = false;
+    this.timer = setInterval(() => {
+      void this.tick().catch((error) => logError("Automation tick failed", error));
+    }, tickMs);
+    this.timer.unref?.();
+    this.unsubscribe = this.manager.subscribeAll((run) => this.runChanged(run));
+  }
+  /** Stop firing; resolves once the last save is on disk. */
+  async stop() {
+    this.stopped = true;
+    if (this.timer) clearInterval(this.timer);
+    this.timer = void 0;
+    this.unsubscribe?.();
+    this.unsubscribe = void 0;
+    await Promise.allSettled([...this.firing]);
+    await this.saving;
+  }
+  /**
+   * Fire every enabled schedule that is due. A time missed while code-flow was closed or the
+   * computer asleep fires once if it's at most an hour late (and on one of its days), and is
+   * skipped otherwise; it never fires on a day the schedule leaves out.
+   */
+  async tick(now = Date.now()) {
+    if (this.stopped) return;
+    await this.managed?.tick().catch((error) => logError("Project team recovery failed", error));
+    let changed = false;
+    for (const t of this.triggers) {
+      if (this.stopped) return;
+      if (t.queued?.length) void this.drain(t);
+      if (!t.enabled || !t.schedule) continue;
+      if (!t.nextAt) {
+        t.nextAt = nextFire(t.schedule, now);
+        changed = true;
+        continue;
+      }
+      if (t.nextAt > now) continue;
+      const due = t.nextAt;
+      if (t.target) {
+        if (stillDue(t.schedule, due, now)) {
+          try {
+            await this.fire(t.id, { via: "schedule", occurrence: `schedule:${due}` });
+          } catch (error) {
+            logWarn("Managed cycle admission failed; retaining the scheduled occurrence", { error: error.message });
+            continue;
+          }
+        }
+        t.nextAt = nextFire(t.schedule, now);
+        await this.save(true);
+        continue;
+      }
+      t.nextAt = nextFire(t.schedule, now);
+      changed = true;
+      if (!stillDue(t.schedule, due, now)) {
+        logInfo(`Automation "${t.name}" skipped its ${new Date(due).toLocaleString()} run: code-flow was closed or asleep then`);
+        continue;
+      }
+      await this.save();
+      await this.fire(t.id, { via: "schedule" }).catch((err) => logWarn(`Automation "${t.name}" couldn't start its scheduled run`, { error: err.message }));
+    }
+    if (changed) await this.save();
+  }
+  /**
+   * A webhook call, answered at once: GitHub gives up on a delivery after 10 seconds, and
+   * starting a run takes longer than that. The run starts in the background; a failure is
+   * recorded on the automation (lastError). A delivery GitHub sends again is ignored.
+   *
+   * GitHub's signature covers the body but not the X-GitHub-Delivery id, so anyone who saw one
+   * signed delivery (a tunnel's log, plain HTTP on the Wi-Fi) could send it again with the id
+   * changed or left out. A signed body (`signedBody`) that came before is a replay whatever id it
+   * carries, or none.
+   */
+  accept(id, input, delivery, signedBody) {
+    if (this.stopped) return { ignored: "Automation dispatch is paused" };
+    const t = this.require(id);
+    const validated = validateFireInput({ via: "webhook", ...input });
+    const body = signedBody && `sha256:${createHash("sha256").update(signedBody).digest("hex")}`;
+    const duplicateReason = delivery && t.deliveries?.includes(delivery) ? `Delivery ${delivery} was already handled` : body && t.deliveries?.includes(body) ? "This delivery was already handled: the same signed body came before" : void 0;
+    if (duplicateReason) {
+      const duplicate = this.recordEvent(t, validated, delivery);
+      this.updateEvent(t, duplicate.id, "deduplicated", duplicateReason);
+      void this.save();
+      return { ignored: duplicateReason };
+    }
+    const seen = [delivery, body].filter((key) => !!key);
+    if (seen.length) {
+      t.deliveries = [...t.deliveries ?? [], ...seen].slice(-MAX_DELIVERIES);
+      void this.save();
+    }
+    const event = this.recordEvent(t, validated, delivery);
+    void this.fire(id, { ...validated, eventId: event.id }).then(
+      (result) => result.skipped && logInfo(`Webhook for automation "${t.name}": ${result.skipped}`),
+      (err) => logWarn(`Webhook for automation "${t.name}" couldn't start a run`, { error: err.message })
+    );
+    return { accepted: true };
+  }
+  /**
+   * Start the automation's run. If its previous run is still going (or still starting), a
+   * schedule or "Run now" is skipped, so automations never pile up; a webhook event waits and
+   * fires once that run ends, so a push made meanwhile isn't lost.
+   */
+  fire(id, input) {
+    if (this.stopped) return Promise.resolve({ skipped: "Automation dispatch is paused" });
+    const work = this.fireTracked(id, input);
+    this.firing.add(work);
+    void work.finally(() => this.firing.delete(work)).catch(() => void 0);
+    return work;
+  }
+  async fireTracked(id, input) {
+    const t = this.require(id);
+    const validated = validateFireInput(input);
+    const event = input.eventId ? t.eventHistory?.find((e) => e.id === input.eventId) : void 0;
+    const tracked = event ?? this.recordEvent(t, validated);
+    try {
+      const result = await this.fireOne(t, { ...validated, occurrence: input.occurrence, eventId: tracked.id });
+      const runs = result.runs ?? (result.run ? [result.run] : []);
+      tracked.runIds = runs.map((run) => run.id);
+      const state = result.queued ? "queued" : result.skipped ? /already started \d+ runs from webhooks/.test(result.skipped) ? "dropped" : "skipped" : "started";
+      if (!(result.queued && (tracked.state === "deduplicated" || tracked.state === "dropped"))) this.updateEvent(t, tracked.id, state, result.skipped);
+      return result;
+    } catch (err) {
+      this.updateEvent(t, tracked.id, "failed", err.message);
+      throw err;
+    } finally {
+      await this.save();
+    }
+  }
+  /** Recent queue decisions, start failures and dropped deliveries, newest first. */
+  events(id) {
+    return structuredClone([...this.require(id).eventHistory ?? []].reverse());
+  }
+  async retryEvent(id, eventId) {
+    const t = this.require(id);
+    this.requireWritable();
+    if (!t.enabled) throw new Error("Enable this automation before retrying an event");
+    const event = t.eventHistory?.find((e) => e.id === eventId);
+    if (!event) throw new Error("Event is no longer in the bounded history");
+    if (event.state !== "failed" && event.state !== "dropped") throw new Error("Only failed or dropped events can be retried");
+    const input = validateFireInput({ via: event.via, ...event.input });
+    event.retries++;
+    this.updateEvent(t, event.id, "received", "Explicit retry requested");
+    return this.fire(id, { ...input, eventId: event.id });
+  }
+  /** List the same candidates and execution settings without claiming items or starting agents. */
+  async dryRun(id, raw = { via: "manual" }) {
+    const t = this.require(id);
+    if (t.target) {
+      if (!this.managed) throw new Error("Project teams are unavailable");
+      return this.managed.preview(t.target.teamId);
+    }
+    const input = validateFireInput(raw);
+    const { config, error: configError } = await readRepoConfig(t.run.repo);
+    const busy = this.busy(t);
+    const warnings = [];
+    if (configError) warnings.push(`Repository configuration: ${configError}`);
+    const selected = [];
+    const skipped = [];
+    if (t.sweep) {
+      if (!this.listSweep) throw new Error("Sweeps aren't available here");
+      const list = await this.listSweep(t.run.repo, t.sweep.kind);
+      warnings.push(...list.notices);
+      const handled = new Set(t.handled ?? []);
+      upgradeLegacyKeys(list, handled);
+      const claims = this.claimed.get(t.id) ?? /* @__PURE__ */ new Set();
+      const items = input.source ? sweepTakes(t.sweep.kind, input.source) ? [findSweepItem(list, input.source)].filter((i) => i !== void 0) : [] : nextSweepItems(list, /* @__PURE__ */ new Set([...handled, ...claims]), t.sweep.max);
+      for (const item of items) {
+        if (item.source && item.task && (!("selected" in item) || item.selected) && (!("manual" in item) || !item.manual) && !sourceKeys(item.source).every((k) => handled.has(k)) && !sourceKeys(item.source).some((k) => claims.has(k))) selected.push({ key: item.key, task: item.task, source: item.source });
+      }
+      for (const item of list.items.slice(0, 100)) if (!selected.some((chosen) => chosen.key === item.key)) skipped.push({ key: item.key, reason: item.note ?? (item.manual ? "Requires manual action" : handled.has(item.key) ? "Already handled" : "Outside the current selection or limit") });
+      if (input.source && !items.length) warnings.push("The event's source is absent from the sweep's current list");
+    } else selected.push({ key: "saved-task", task: input.details?.trim() ? `${t.run.task}
+
+## Details from the ${input.via}
+${input.details}` : t.run.task, source: input.source ?? t.run.source });
+    const startsPerHour = t.sweep?.max ?? WEBHOOK_RUNS_PER_HOUR;
+    const startsUsed = (t.webhookStarts ?? []).filter((at) => Date.now() - at < HOUR).length;
+    if (!t.enabled && input.via !== "manual") warnings.push("This automation is disabled");
+    if (input.via === "webhook" && startsUsed >= startsPerHour) warnings.push("The webhook run limit has been reached for this hour");
+    if (!(t.run.loop?.check ?? config.check) && !t.run.loop?.verification && !t.run.verificationProfile) warnings.push("No independent verification command or profile is configured");
+    if (selected.some((item) => item.source)) warnings.push("Source permissions and isolation are rechecked against current GitHub authorship when the run starts");
+    const configuredTrust = t.run.trust ?? config.trust ?? "standard";
+    const effectiveTrust = configuredTrust === "full" ? "trusted" : configuredTrust;
+    return {
+      automation: id,
+      ready: !!selected.length && (t.enabled || input.via === "manual") && !(busy && input.via !== "webhook") && !(input.via === "webhook" && startsUsed >= startsPerHour),
+      busy,
+      wouldQueue: !!busy && input.via === "webhook" && !t.sweep,
+      nextTimes: t.schedule ? previewSchedule(t.schedule) : [],
+      selected,
+      skipped,
+      warnings,
+      permissions: { trust: effectiveTrust, isolate: t.isolate, ...t.isolate ? { image: t.image || "node:22" } : {} },
+      limits: { maxSteps: t.run.loop?.maxSteps ?? config.limits?.maxSteps ?? 40, maxInvocations: t.run.loop?.maxInvocations ?? t.run.loop?.maxSteps ?? config.limits?.maxSteps ?? 40, maxMinutes: t.run.loop?.maxMinutes ?? config.limits?.maxMinutes ?? 60, startsPerHour, startsUsed },
+      commands: { setup: t.run.loop?.setup ?? config.setup, check: t.run.loop?.check ?? config.check }
+    };
+  }
+  recordEvent(t, input, delivery) {
+    const event = { id: `event-${randomBytes(6).toString("hex")}`, at: Date.now(), updatedAt: Date.now(), via: input.via, state: "received", input: { details: input.details, source: input.source }, delivery, retries: 0 };
+    const pinned = new Set((t.queued ?? []).map((q) => q.eventId));
+    const history = [...t.eventHistory ?? [], event];
+    while (history.length > MAX_EVENT_HISTORY) {
+      const completed = history.findIndex((e) => !pinned.has(e.id) && e.state !== "received");
+      const index = completed >= 0 ? completed : history.findIndex((e) => !pinned.has(e.id));
+      history.splice(index < 0 ? 0 : index, 1);
+    }
+    t.eventHistory = history;
+    return event;
+  }
+  updateEvent(t, id, state, reason) {
+    const event = id && t.eventHistory?.find((e) => e.id === id);
+    if (!event) return;
+    event.state = state;
+    event.updatedAt = Date.now();
+    event.reason = reason?.slice(0, 1e3);
+  }
+  async fireOne(t, input) {
+    if (!t.enabled && input.via !== "manual") return { skipped: "This automation is disabled" };
+    if (t.target) {
+      if (!this.managed || input.via === "webhook") throw new Error("Project team automations require the project team service");
+      const result = await this.managed.fire(t.target.teamId, input.occurrence ?? `manual:${input.eventId}`);
+      t.lastFiredAt = Date.now();
+      t.lastRunId = result.run?.id ?? t.lastRunId;
+      t.lastError = result.skipped;
+      return result;
+    }
+    if (t.sweep) return this.fireSweep(t, input);
+    const busy = this.busy(t);
+    if (busy) return input.via === "webhook" ? this.enqueue(t, input, busy) : { skipped: busy };
+    const startedAt = Date.now();
+    if (input.via === "webhook" && !this.takeWebhookSlot(t, WEBHOOK_RUNS_PER_HOUR, startedAt)) {
+      await this.save();
+      return { skipped: t.lastError };
+    }
+    this.starting.add(t.id);
+    const body = {
+      ...t.run,
+      task: withDetails(t.run.task, input),
+      source: input.source ?? t.run.source,
+      loop: { ...t.run.loop ?? {}, container: t.isolate ? { image: t.image || "node:22", network: true } : void 0 }
+    };
+    t.lastFiredAt = startedAt;
+    try {
+      const run = await this.startRun(body, { trigger: { id: t.id, name: t.name, via: input.via }, ...hasDetails(input) && { untrustedText: true } });
+      t.lastRunId = run.id;
+      t.lastError = void 0;
+      return { run };
+    } catch (err) {
+      t.lastError = err.message;
+      if (input.via === "webhook") this.releaseWebhookSlot(t, startedAt);
+      throw err;
+    } finally {
+      this.starting.delete(t.id);
+      await this.save();
+    }
+  }
+  /** Why the automation can't start a run right now, if it can't. */
+  busy(t) {
+    if (this.starting.has(t.id)) return "it's starting a run right now";
+    const previous = t.lastRunId ? this.manager.get(t.lastRunId) : void 0;
+    if (previous?.status === "running") return `the previous run (${previous.id}) is still running`;
+    return void 0;
+  }
+  /** Keep a webhook event for when the running run ends; the same event twice is kept once. */
+  async enqueue(t, input, busy) {
+    const { via: _via, ...event } = input;
+    const key = eventKey(event);
+    const unique = (t.queued ?? []).filter((q) => {
+      if (eventKey(q) !== key) return true;
+      this.updateEvent(t, q.eventId, "deduplicated", "A newer delivery describes the same queued work");
+      return false;
+    });
+    const queue = [...unique, event];
+    for (const dropped of queue.slice(0, -MAX_QUEUED)) this.updateEvent(t, dropped.eventId, "dropped", `The queue limit of ${MAX_QUEUED} events was reached`);
+    t.queued = queue.slice(-MAX_QUEUED);
+    await this.save();
+    return { skipped: `${busy}; this event fires when it ends`, queued: true };
+  }
+  runChanged(run) {
+    if (run.deleted) return;
+    const t = run.trigger && run.status !== "running" ? this.get(run.trigger.id) : void 0;
+    if (t?.queued?.length && t.lastRunId === run.id) void this.drain(t);
+  }
+  /** Fire the oldest webhook event that waited, once nothing of this automation is running. */
+  async drain(t) {
+    if (this.stopped) return;
+    if (!t.queued?.length || this.busy(t)) return;
+    const [next, ...rest] = t.queued;
+    t.queued = rest.length ? rest : void 0;
+    if (!t.enabled || !this.get(t.id)) return void this.save();
+    await this.fire(t.id, { via: "webhook", ...next }).catch(
+      (err) => logWarn(`Automation "${t.name}" couldn't start a webhook run that waited`, { error: err.message })
+    );
+  }
+  /**
+   * Room for one more webhook-started run this hour (`perHour` of them), taken at once so
+   * concurrent deliveries count too. Without room the event is dropped and that's recorded:
+   * an outsider opening 50 issues mustn't start 50 runs.
+   */
+  takeWebhookSlot(t, perHour, now) {
+    const recent = (t.webhookStarts ?? []).filter((at) => now - at < HOUR);
+    if (recent.length >= perHour) {
+      t.webhookStarts = recent;
+      t.lastError = `Ignored a webhook event: this automation already started ${recent.length} runs from webhooks in the last hour (at most ${perHour})`;
+      return false;
+    }
+    t.webhookStarts = [...recent, now];
+    return true;
+  }
+  releaseWebhookSlot(t, at) {
+    const i = t.webhookStarts?.lastIndexOf(at) ?? -1;
+    if (i >= 0) t.webhookStarts.splice(i, 1);
+  }
+  claims(t) {
+    let set = this.claimed.get(t.id);
+    if (!set) this.claimed.set(t.id, set = /* @__PURE__ */ new Set());
+    return set;
+  }
+  /**
+   * A sweep fires: a webhook names one item (an issue, PR or alert); a schedule or "Run now" lists
+   * the work and starts a run for each new item that would be picked by default, up to `max`.
+   * Items already started (or covered by another run) are left alone.
+   */
+  async fireSweep(t, input) {
+    if (input.source) return this.fireSweepItem(t, input, input.source);
+    if (!this.listSweep) throw new Error("Sweeps aren't available here");
+    if (this.sweeping.has(t.id)) return { runs: [], skipped: "it's already sweeping" };
+    this.sweeping.add(t.id);
+    const sweep = t.sweep;
+    const claimed = this.claims(t);
+    const mine = [];
+    t.lastFiredAt = Date.now();
+    try {
+      const list = await this.listSweep(t.run.repo, sweep.kind);
+      const handled = new Set(t.handled ?? []);
+      if (upgradeLegacyKeys(list, handled)) t.handled = [...handled].slice(-MAX_HANDLED);
+      const items = nextSweepItems(list, /* @__PURE__ */ new Set([...handled, ...claimed]), sweep.max);
+      for (const item of items) for (const key of sourceKeys(item.source)) claimed.add(key), mine.push(key);
+      if (!items.length) {
+        t.lastError = void 0;
+        return { runs: [], skipped: "nothing new to sweep" };
+      }
+      const runs = [];
+      const errors = [];
+      for (const item of items) {
+        try {
+          runs.push(await this.startRun(this.sweepRun(t, item.task, item.source), { trigger: { id: t.id, name: t.name, via: input.via } }));
+          this.handle(t, sourceKeys(item.source));
+        } catch (err) {
+          errors.push(`${item.key}: ${err.message}`);
+          const failed = this.recordEvent(t, { ...input, source: item.source });
+          this.updateEvent(t, failed.id, "failed", `${item.key}: ${err.message}`);
+        }
+      }
+      t.lastRunId = runs.at(-1)?.id ?? t.lastRunId;
+      t.lastError = errors.length ? errors.join("; ").slice(0, 1e3) : void 0;
+      if (!runs.length && errors.length) throw new Error(t.lastError);
+      return { runs };
+    } finally {
+      for (const key of mine) claimed.delete(key);
+      this.sweeping.delete(t.id);
+      await this.save();
+    }
+  }
+  /**
+   * A webhook names one item. It goes through the same rules as the sweep's list: the event
+   * must be the sweep's kind, and the item must be one the list would pick (not labelled
+   * wontfix or question, not a green Dependabot PR, not a low-severity or unpatched alert, not
+   * already covered by a run) — at most `max` runs an hour.
+   */
+  async fireSweepItem(t, input, source) {
+    const sweep = t.sweep;
+    if (!sweepTakes(sweep.kind, source)) return { runs: [], skipped: `a ${sweep.kind} sweep doesn't start from ${source.kind === "pr" ? "a pull request" : `an ${source.kind}`}` };
+    const claimed = this.claims(t);
+    const keys = sourceKeys(source);
+    if (keys.every((k) => (t.handled ?? []).includes(k) || claimed.has(k))) return { runs: [], skipped: "nothing new to sweep" };
+    const startedAt = Date.now();
+    if (input.via === "webhook" && !this.takeWebhookSlot(t, sweep.max, startedAt)) {
+      await this.save();
+      return { runs: [], skipped: t.lastError };
+    }
+    const mine = keys.filter((k) => !claimed.has(k));
+    for (const key of mine) claimed.add(key);
+    let started = false;
+    t.lastFiredAt = startedAt;
+    try {
+      if (!this.listSweep) throw new Error("Sweeps aren't available here");
+      const list = await this.listSweep(t.run.repo, sweep.kind);
+      const handled = new Set(t.handled ?? []);
+      if (upgradeLegacyKeys(list, handled)) t.handled = [...handled].slice(-MAX_HANDLED);
+      const item = findSweepItem(list, source);
+      if (!item?.source || !item.task || item.manual) return { runs: [], skipped: "it isn't in the sweep's list (closed, or not the kind this sweep fixes)" };
+      if (!item.selected) return { runs: [], skipped: `the sweep wouldn't pick it: ${item.note ?? "not picked by default"}` };
+      const itemKeys = sourceKeys(item.source);
+      if (itemKeys.every((k) => handled.has(k))) return { runs: [], skipped: "nothing new to sweep" };
+      if (itemKeys.some((k) => claimed.has(k) && !mine.includes(k))) return { runs: [], skipped: "a run for it is starting right now" };
+      for (const key of itemKeys) if (!claimed.has(key)) claimed.add(key), mine.push(key);
+      const run = await this.startRun(this.sweepRun(t, withDetails(item.task, input), item.source), {
+        trigger: { id: t.id, name: t.name, via: input.via },
+        ...hasDetails(input) && { untrustedText: true }
+      });
+      started = true;
+      this.handle(t, itemKeys);
+      t.lastRunId = run.id;
+      t.lastError = void 0;
+      return { runs: [run] };
+    } catch (err) {
+      t.lastError = err.message.slice(0, 1e3);
+      throw err;
+    } finally {
+      if (!started && input.via === "webhook") this.releaseWebhookSlot(t, startedAt);
+      for (const key of mine) claimed.delete(key);
+      await this.save();
+    }
+  }
+  sweepRun(t, task, source) {
+    return { ...t.run, task, source, loop: { ...t.run.loop ?? {}, container: t.isolate ? { image: t.image || "node:22", network: true } : void 0 } };
+  }
+  handle(t, keys) {
+    t.handled = [.../* @__PURE__ */ new Set([...t.handled ?? [], ...keys])].slice(-MAX_HANDLED);
+  }
+  /**
+   * Check a webhook call: `Authorization: Bearer <token>`, or GitHub's `X-Hub-Signature-256`
+   * (HMAC of the body with the token as the secret). Says which, since a signed body can be sent
+   * again by anyone who saw it, and the secret can't.
+   */
+  authorize(id, headers, body) {
+    const t = this.get(id);
+    if (!t || !t.webhook) throw Object.assign(new Error("Not found"), { status: 404 });
+    if (!t.enabled) throw Object.assign(new Error("This automation is turned off"), { status: 409 });
+    const bearer = String(headers.authorization ?? "").replace(/^Bearer\s+/i, "");
+    if (bearer && same(bearer, t.token)) return { trigger: t, signed: false };
+    const signature = String(headers["x-hub-signature-256"] ?? "");
+    const expected = `sha256=${createHmac("sha256", t.token).update(body).digest("hex")}`;
+    if (signature && same(signature, expected)) return { trigger: t, signed: true };
+    throw Object.assign(new Error("Bad token or signature"), { status: 401 });
+  }
+  /**
+   * Changes you make must be saved, or a webhook secret you copied would be gone after a restart:
+   * refuse them while triggers.json couldn't be read (and so isn't written).
+   */
+  requireWritable() {
+    if (!this.writable) throw new Error(`Automations can't be changed: ${this.file} couldn't be read when code-flow started (see server.log). Fix or remove it, then restart code-flow.`);
+  }
+  require(id) {
+    const t = this.get(id);
+    if (!t) throw new Error("Automation not found");
+    return t;
+  }
+  save(strict = false) {
+    if (!this.writable) {
+      if (strict) return Promise.reject(new Error("Automations storage is unavailable"));
+      return this.saving;
+    }
+    const snapshot = JSON.stringify(this.triggers, null, 2);
+    const saving = this.saving.then(async () => {
+      await mkdir(dirname(this.file), { recursive: true });
+      const tmp = `${this.file}.tmp`;
+      const handle = await open(tmp, "w", 384);
+      try {
+        await handle.writeFile(snapshot);
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await rename(tmp, this.file);
+      if (process.platform !== "win32") {
+        const dir = await open(dirname(this.file), "r");
+        try {
+          await dir.sync();
+        } finally {
+          await dir.close();
+        }
+      }
+    });
+    this.saving = saving.catch((err) => logError(`Couldn't save automations to ${this.file}`, err));
+    return strict ? saving : this.saving;
+  }
+}
+function validateFireInput(raw) {
+  if (!raw || typeof raw !== "object") throw new Error("Invalid automation event");
+  const input = raw;
+  if (!["manual", "schedule", "webhook"].includes(input.via)) throw new Error("Invalid automation event origin");
+  if (input.details !== void 0 && typeof input.details !== "string") throw new Error("Automation event details must be text");
+  if (input.event !== void 0 && typeof input.event !== "string") throw new Error("Automation event description must be text");
+  let source;
+  if (input.source !== void 0) {
+    const s = input.source;
+    if (!s || typeof s !== "object" || !["issue", "pr", "alert"].includes(s.kind) || !Number.isSafeInteger(s.number) || s.number < 1) throw new Error("Invalid automation event source");
+    if (s.kind === "alert" && !["dependabot", "code-scanning"].includes(s.tool)) throw new Error("Invalid automation alert tool");
+    if (s.numbers !== void 0 && (!Array.isArray(s.numbers) || s.numbers.length > 20 || s.numbers.some((n) => !Number.isSafeInteger(n) || n < 1))) throw new Error("Invalid automation alert numbers");
+    source = { kind: s.kind, number: s.number, ...s.kind === "alert" ? { tool: s.tool, ...s.numbers ? { numbers: [...new Set(s.numbers)] } : {} } : { ciLogs: s.ciLogs === true } };
+  }
+  return { via: input.via, details: input.details?.slice(0, 4e3), event: input.event?.slice(0, 1e3), source };
+}
+function eventKey(event) {
+  return event.source ? sourceKeys(event.source).join(",") : `details:${event.details ?? ""}`;
+}
+const hasDetails = (input) => !!input.details?.trim();
+function withDetails(task, input) {
+  const details = input.details?.trim().slice(0, 4e3);
+  const parts = [input.event?.trim(), details && untrustedBlock(`text sent with the ${input.via}`, details)].filter(Boolean);
+  return parts.length ? `${task}
+
+## Details from the ${input.via}
+${parts.join("\n\n")}` : task;
+}
+function readTrigger(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  if (typeof raw.id !== "string" || !raw.id || typeof raw.token !== "string" || raw.token.length < 16) return void 0;
+  const run = raw.run;
+  if (!run || typeof run !== "object" || typeof run.repo !== "string" || typeof run.pattern !== "string" || typeof run.task !== "string") return void 0;
+  if (raw.target && (raw.target.kind !== "project-team" || !/^pt-[a-f0-9]{24}$/.test(raw.target.teamId))) return void 0;
+  const problems = [];
+  let schedule;
+  try {
+    schedule = validateSchedule(raw.schedule);
+  } catch {
+    problems.push("its schedule couldn't be read; set it again");
+  }
+  let sweep;
+  if (raw.sweep !== void 0) {
+    if (raw.sweep && SWEEP_KINDS.includes(raw.sweep.kind)) sweep = { kind: raw.sweep.kind, max: Math.min(10, Math.max(1, Math.round(Number(raw.sweep.max)) || 5)) };
+    else problems.push("its sweep couldn't be read");
+  }
+  const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : void 0;
+  const time = (v) => typeof v === "number" && Number.isFinite(v) ? v : void 0;
+  const queued = Array.isArray(raw.queued) ? raw.queued.slice(-MAX_QUEUED).flatMap((q) => {
+    try {
+      const { via: _via, ...input } = validateFireInput({ ...q, via: "webhook" });
+      return [{ ...input, ...typeof q.eventId === "string" ? { eventId: q.eventId.slice(0, 100) } : {} }];
+    } catch {
+      return [];
+    }
+  }) : void 0;
+  const eventHistory = Array.isArray(raw.eventHistory) ? raw.eventHistory.slice(-MAX_EVENT_HISTORY).flatMap((event) => {
+    try {
+      if (!event || typeof event.id !== "string" || !["received", "queued", "started", "failed", "dropped", "deduplicated", "skipped"].includes(event.state)) return [];
+      const { via, ...input } = validateFireInput({ ...event.input, via: event.via });
+      return [{
+        id: event.id.slice(0, 100),
+        at: time(event.at) ?? Date.now(),
+        updatedAt: time(event.updatedAt) ?? Date.now(),
+        via,
+        input,
+        state: event.state === "received" ? "failed" : event.state,
+        reason: event.state === "received" ? "code-flow restarted before this event finished starting" : typeof event.reason === "string" ? event.reason.slice(0, 1e3) : void 0,
+        delivery: typeof event.delivery === "string" ? event.delivery.slice(0, 200) : void 0,
+        runIds: strings(event.runIds)?.slice(0, 10),
+        retries: Number.isSafeInteger(event.retries) && event.retries > 0 ? event.retries : 0
+      }];
+    } catch {
+      return [];
+    }
+  }) : void 0;
+  if (problems.length) logWarn(`Automation "${raw.name ?? raw.id}" was turned off: ${problems.join("; ")}`);
+  return {
+    id: raw.id,
+    target: raw.target,
+    name: typeof raw.name === "string" && raw.name.trim() ? raw.name.slice(0, 80) : "Automation",
+    enabled: raw.enabled === true && !problems.length,
+    run,
+    schedule,
+    webhook: raw.webhook === true,
+    token: raw.token,
+    isolate: raw.isolate === true,
+    image: typeof raw.image === "string" ? raw.image : void 0,
+    createdAt: time(raw.createdAt) ?? Date.now(),
+    nextAt: time(raw.nextAt),
+    lastFiredAt: time(raw.lastFiredAt),
+    lastRunId: typeof raw.lastRunId === "string" ? raw.lastRunId : void 0,
+    lastError: problems.length ? `Turned off: ${problems.join("; ")}` : typeof raw.lastError === "string" ? raw.lastError : void 0,
+    sweep,
+    handled: strings(raw.handled)?.slice(-MAX_HANDLED),
+    deliveries: strings(raw.deliveries)?.slice(-MAX_DELIVERIES),
+    queued: queued?.length ? queued : void 0,
+    eventHistory,
+    webhookStarts: Array.isArray(raw.webhookStarts) ? raw.webhookStarts.filter((n) => time(n) !== void 0) : void 0
+  };
+}
+function readWebhook(headers, payload) {
+  const event = String(headers["x-github-event"] ?? "");
+  if (!event) {
+    const source = payload?.source;
+    const number2 = Number(source?.number);
+    const tool = source?.tool === "dependabot" || source?.tool === "code-scanning" ? source.tool : void 0;
+    const valid = source && (source.kind === "issue" || source.kind === "pr" || source.kind === "alert" && tool) && Number.isInteger(number2) && number2 > 0;
+    return {
+      details: typeof payload?.details === "string" ? payload.details : typeof payload?.task === "string" ? payload.task : void 0,
+      source: valid ? source.kind === "alert" ? { kind: "alert", tool, number: number2 } : { kind: source.kind, number: number2, ciLogs: source.ciLogs === true } : void 0
+    };
+  }
+  const number = (n) => Number.isInteger(n) && n > 0 ? n : void 0;
+  const login = (u) => typeof u?.login === "string" && /^[\w-]{1,39}(\[bot\])?$/.test(u.login) ? `@${u.login}` : "someone";
+  if (event === "dependabot_alert" && ["created", "reopened", "reintroduced"].includes(payload?.action) && number(payload.alert?.number)) {
+    return { source: { kind: "alert", tool: "dependabot", number: payload.alert.number }, event: `GitHub: Dependabot alert ${payload.action}` };
+  }
+  if (event === "code_scanning_alert" && ["created", "reopened", "appeared_in_branch"].includes(payload?.action) && number(payload.alert?.number)) {
+    return { source: { kind: "alert", tool: "code-scanning", number: payload.alert.number }, event: `GitHub: code scanning alert ${payload.action}` };
+  }
+  if (event === "issues" && ["opened", "labeled", "reopened"].includes(payload?.action) && number(payload.issue?.number)) {
+    return { source: { kind: "issue", number: payload.issue.number }, event: `GitHub: issue ${payload.action} by ${login(payload.sender)}` };
+  }
+  if (event === "pull_request" && ["opened", "synchronize", "reopened", "ready_for_review", "labeled"].includes(payload?.action) && number(payload.pull_request?.number)) {
+    return { source: { kind: "pr", number: payload.pull_request.number }, event: `GitHub: pull request ${payload.action}` };
+  }
+  if (event === "workflow_run" && payload?.action === "completed" && payload.workflow_run?.conclusion === "failure") {
+    const pr = number(payload.workflow_run.pull_requests?.[0]?.number);
+    const name = String(payload.workflow_run.name ?? "").replace(/[^\w .()/-]/g, "").slice(0, 80);
+    return pr ? { source: { kind: "pr", number: pr, ciLogs: true }, event: `GitHub: workflow "${name}" failed` } : null;
+  }
+  return null;
+}
+function same(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+export {
+  Automations,
+  MISSED_GRACE_MS,
+  describeSchedule,
+  nextFire,
+  previewSchedule,
+  readWebhook,
+  resumeSchedule,
+  stillDue,
+  validateFireInput,
+  validateSchedule
+};