@shipfox/api-integration-github 2.0.0

package/dist/core/state.js

@@ -0,0 +1,54 @@
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { config } from '#config.js';
+import { GithubInstallStateError } from './errors.js';
+const STATE_TTL_SECONDS = 30 * 60;
+export function signGithubInstallState(params) {
+    const now = params.now ?? new Date();
+    const payload = {
+        workspaceId: params.workspaceId,
+        userId: params.userId,
+        nonce: params.nonce ?? randomUUID(),
+        expiresAt: Math.floor(now.getTime() / 1000) + STATE_TTL_SECONDS
+    };
+    const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    return `${encodedPayload}.${sign(encodedPayload)}`;
+}
+export function verifyGithubInstallState(state, now = new Date()) {
+    const [encodedPayload, signature, extra] = state.split('.');
+    if (!encodedPayload || !signature || extra !== undefined) {
+        throw new GithubInstallStateError('Invalid GitHub install state');
+    }
+    if (!constantTimeEqual(signature, sign(encodedPayload))) {
+        throw new GithubInstallStateError('Invalid GitHub install state signature');
+    }
+    const payload = parsePayload(encodedPayload);
+    if (payload.expiresAt < Math.floor(now.getTime() / 1000)) {
+        throw new GithubInstallStateError('Expired GitHub install state');
+    }
+    return {
+        workspaceId: payload.workspaceId,
+        userId: payload.userId
+    };
+}
+function sign(encodedPayload) {
+    return createHmac('sha256', config.GITHUB_INSTALL_STATE_SECRET).update(encodedPayload).digest('base64url');
+}
+function constantTimeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length) return false;
+    return timingSafeEqual(left, right);
+}
+function parsePayload(encodedPayload) {
+    try {
+        const parsed = JSON.parse(Buffer.from(encodedPayload, 'base64url').toString('utf8'));
+        if (typeof parsed.workspaceId !== 'string' || typeof parsed.userId !== 'string' || typeof parsed.nonce !== 'string' || typeof parsed.expiresAt !== 'number') {
+            throw new Error('Invalid payload shape');
+        }
+        return parsed;
+    } catch (_error) {
+        throw new GithubInstallStateError('Invalid GitHub install state payload');
+    }
+}
+
+//# sourceMappingURL=state.js.map

package/dist/core/state.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/state.ts"],"sourcesContent":["import {createHmac, randomUUID, timingSafeEqual} from 'node:crypto';\nimport {config} from '#config.js';\nimport {GithubInstallStateError} from './errors.js';\n\nconst STATE_TTL_SECONDS = 30 * 60;\n\ninterface GithubInstallStatePayload {\n  workspaceId: string;\n  userId: string;\n  nonce: string;\n  expiresAt: number;\n}\n\nexport interface GithubInstallStateClaims {\n  workspaceId: string;\n  userId: string;\n}\n\nexport function signGithubInstallState(params: {\n  workspaceId: string;\n  userId: string;\n  nonce?: string | undefined;\n  now?: Date | undefined;\n}): string {\n  const now = params.now ?? new Date();\n  const payload: GithubInstallStatePayload = {\n    workspaceId: params.workspaceId,\n    userId: params.userId,\n    nonce: params.nonce ?? randomUUID(),\n    expiresAt: Math.floor(now.getTime() / 1000) + STATE_TTL_SECONDS,\n  };\n  const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url');\n  return `${encodedPayload}.${sign(encodedPayload)}`;\n}\n\nexport function verifyGithubInstallState(\n  state: string,\n  now: Date = new Date(),\n): GithubInstallStateClaims {\n  const [encodedPayload, signature, extra] = state.split('.');\n  if (!encodedPayload || !signature || extra !== undefined) {\n    throw new GithubInstallStateError('Invalid GitHub install state');\n  }\n\n  if (!constantTimeEqual(signature, sign(encodedPayload))) {\n    throw new GithubInstallStateError('Invalid GitHub install state signature');\n  }\n\n  const payload = parsePayload(encodedPayload);\n  if (payload.expiresAt < Math.floor(now.getTime() / 1000)) {\n    throw new GithubInstallStateError('Expired GitHub install state');\n  }\n\n  return {workspaceId: payload.workspaceId, userId: payload.userId};\n}\n\nfunction sign(encodedPayload: string): string {\n  return createHmac('sha256', config.GITHUB_INSTALL_STATE_SECRET)\n    .update(encodedPayload)\n    .digest('base64url');\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  const left = Buffer.from(a);\n  const right = Buffer.from(b);\n  if (left.length !== right.length) return false;\n  return timingSafeEqual(left, right);\n}\n\nfunction parsePayload(encodedPayload: string): GithubInstallStatePayload {\n  try {\n    const parsed = JSON.parse(Buffer.from(encodedPayload, 'base64url').toString('utf8'));\n    if (\n      typeof parsed.workspaceId !== 'string' ||\n      typeof parsed.userId !== 'string' ||\n      typeof parsed.nonce !== 'string' ||\n      typeof parsed.expiresAt !== 'number'\n    ) {\n      throw new Error('Invalid payload shape');\n    }\n    return parsed;\n  } catch (_error) {\n    throw new GithubInstallStateError('Invalid GitHub install state payload');\n  }\n}\n"],"names":["createHmac","randomUUID","timingSafeEqual","config","GithubInstallStateError","STATE_TTL_SECONDS","signGithubInstallState","params","now","Date","payload","workspaceId","userId","nonce","expiresAt","Math","floor","getTime","encodedPayload","Buffer","from","JSON","stringify","toString","sign","verifyGithubInstallState","state","signature","extra","split","undefined","constantTimeEqual","parsePayload","GITHUB_INSTALL_STATE_SECRET","update","digest","a","b","left","right","length","parsed","parse","Error","_error"],"mappings":"AAAA,SAAQA,UAAU,EAAEC,UAAU,EAAEC,eAAe,QAAO,cAAc;AACpE,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,uBAAuB,QAAO,cAAc;AAEpD,MAAMC,oBAAoB,KAAK;AAc/B,OAAO,SAASC,uBAAuBC,MAKtC;IACC,MAAMC,MAAMD,OAAOC,GAAG,IAAI,IAAIC;IAC9B,MAAMC,UAAqC;QACzCC,aAAaJ,OAAOI,WAAW;QAC/BC,QAAQL,OAAOK,MAAM;QACrBC,OAAON,OAAOM,KAAK,IAAIZ;QACvBa,WAAWC,KAAKC,KAAK,CAACR,IAAIS,OAAO,KAAK,QAAQZ;IAChD;IACA,MAAMa,iBAAiBC,OAAOC,IAAI,CAACC,KAAKC,SAAS,CAACZ,UAAUa,QAAQ,CAAC;IACrE,OAAO,GAAGL,eAAe,CAAC,EAAEM,KAAKN,iBAAiB;AACpD;AAEA,OAAO,SAASO,yBACdC,KAAa,EACblB,MAAY,IAAIC,MAAM;IAEtB,MAAM,CAACS,gBAAgBS,WAAWC,MAAM,GAAGF,MAAMG,KAAK,CAAC;IACvD,IAAI,CAACX,kBAAkB,CAACS,aAAaC,UAAUE,WAAW;QACxD,MAAM,IAAI1B,wBAAwB;IACpC;IAEA,IAAI,CAAC2B,kBAAkBJ,WAAWH,KAAKN,kBAAkB;QACvD,MAAM,IAAId,wBAAwB;IACpC;IAEA,MAAMM,UAAUsB,aAAad;IAC7B,IAAIR,QAAQI,SAAS,GAAGC,KAAKC,KAAK,CAACR,IAAIS,OAAO,KAAK,OAAO;QACxD,MAAM,IAAIb,wBAAwB;IACpC;IAEA,OAAO;QAACO,aAAaD,QAAQC,WAAW;QAAEC,QAAQF,QAAQE,MAAM;IAAA;AAClE;AAEA,SAASY,KAAKN,cAAsB;IAClC,OAAOlB,WAAW,UAAUG,OAAO8B,2BAA2B,EAC3DC,MAAM,CAAChB,gBACPiB,MAAM,CAAC;AACZ;AAEA,SAASJ,kBAAkBK,CAAS,EAAEC,CAAS;IAC7C,MAAMC,OAAOnB,OAAOC,IAAI,CAACgB;IACzB,MAAMG,QAAQpB,OAAOC,IAAI,CAACiB;IAC1B,IAAIC,KAAKE,MAAM,KAAKD,MAAMC,MAAM,EAAE,OAAO;IACzC,OAAOtC,gBAAgBoC,MAAMC;AAC/B;AAEA,SAASP,aAAad,cAAsB;IAC1C,IAAI;QACF,MAAMuB,SAASpB,KAAKqB,KAAK,CAACvB,OAAOC,IAAI,CAACF,gBAAgB,aAAaK,QAAQ,CAAC;QAC5E,IACE,OAAOkB,OAAO9B,WAAW,KAAK,YAC9B,OAAO8B,OAAO7B,MAAM,KAAK,YACzB,OAAO6B,OAAO5B,KAAK,KAAK,YACxB,OAAO4B,OAAO3B,SAAS,KAAK,UAC5B;YACA,MAAM,IAAI6B,MAAM;QAClB;QACA,OAAOF;IACT,EAAE,OAAOG,QAAQ;QACf,MAAM,IAAIxC,wBAAwB;IACpC;AACF"}

package/dist/core/webhook.d.ts

@@ -0,0 +1,20 @@
+import { type GetIntegrationConnectionByIdFn, type IntegrationTx, type PublishIntegrationEventReceivedFn, type PublishSourcePushFn, type RecordDeliveryOnlyFn } from '@shipfox/api-integration-core-dto';
+export interface HandleGithubEventParams {
+    tx: IntegrationTx;
+    deliveryId: string;
+    event: string;
+    payload: unknown;
+    publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+    publishSourcePush: PublishSourcePushFn;
+    recordDeliveryOnly: RecordDeliveryOnlyFn;
+    getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+    deleteInstallationTokenSecret?: ((params: {
+        workspaceId: string;
+        installationId: number;
+    }) => Promise<unknown>) | undefined;
+}
+export type HandleGithubEventOutcome = 'published' | 'duplicate' | 'published-envelope' | 'duplicate-envelope' | 'published-push-envelope-only' | 'duplicate-push-envelope-only' | 'unknown-installation' | 'missing-connection' | 'inactive-connection' | 'no-installation-id';
+export declare function handleGithubEvent(params: HandleGithubEventParams): Promise<{
+    outcome: HandleGithubEventOutcome;
+}>;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/core/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/core/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,8BAA8B,EACnC,KAAK,aAAa,EAClB,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAE1B,MAAM,mCAAmC,CAAC;AAe3C,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,6BAA6B,CAAC,EAC1B,CAAC,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAC7E,SAAS,CAAC;CACf;AAED,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,8BAA8B,GAC9B,8BAA8B,GAC9B,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,oBAAoB,CAAC;AAMzB,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAC,CAAC,CAmH9C"}

package/dist/core/webhook.js

@@ -0,0 +1,216 @@
+import { buildProviderRepositoryId } from '@shipfox/api-integration-core-dto';
+import { githubPushPayloadSchema, githubWebhookActionSchema, githubWebhookInstallationSchema } from '@shipfox/api-integration-github-dto';
+import { logger } from '@shipfox/node-opentelemetry';
+import { getGithubInstallationByInstallationId } from '#db/installations.js';
+const REFS_HEADS_PREFIX = 'refs/heads/';
+const GITHUB_SOURCE = 'github';
+// GitHub sends a `push` webhook for a branch deletion with `after` set to this all-zero SHA.
+const DELETED_BRANCH_SHA = '0'.repeat(40);
+function isBranchDeletion(after) {
+    return after === DELETED_BRANCH_SHA;
+}
+export async function handleGithubEvent(params) {
+    const actionEnvelope = githubWebhookActionSchema.safeParse(params.payload);
+    const action = actionEnvelope.success ? actionEnvelope.data.action : undefined;
+    const installationEnvelope = githubWebhookInstallationSchema.safeParse(params.payload);
+    const installationId = installationEnvelope.success ? installationEnvelope.data.installation?.id : undefined;
+    if (installationId === undefined) {
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: GITHUB_SOURCE,
+            deliveryId: params.deliveryId
+        });
+        return {
+            outcome: 'no-installation-id'
+        };
+    }
+    const installation = await getGithubInstallationByInstallationId(String(installationId), {
+        tx: params.tx
+    });
+    if (!installation) {
+        logger().warn({
+            deliveryId: params.deliveryId,
+            installationId
+        }, 'github webhook: unknown installation, dropping');
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: GITHUB_SOURCE,
+            deliveryId: params.deliveryId
+        });
+        return {
+            outcome: 'unknown-installation'
+        };
+    }
+    const connection = await params.getIntegrationConnectionById(installation.connectionId, {
+        tx: params.tx
+    });
+    if (!connection) {
+        logger().warn({
+            deliveryId: params.deliveryId,
+            installationId,
+            connectionId: installation.connectionId
+        }, 'github webhook: installation has no connection, dropping');
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: GITHUB_SOURCE,
+            deliveryId: params.deliveryId
+        });
+        return {
+            outcome: 'missing-connection'
+        };
+    }
+    if (connection.lifecycleStatus !== 'active') {
+        const logContext = {
+            deliveryId: params.deliveryId,
+            installationId,
+            connectionId: connection.id,
+            workspaceId: connection.workspaceId,
+            lifecycleStatus: connection.lifecycleStatus
+        };
+        // `disabled` is an expected steady state; only `error` is anomalous.
+        if (connection.lifecycleStatus === 'error') {
+            logger().warn(logContext, 'github webhook: connection in error state, dropping');
+        } else {
+            logger().info(logContext, 'github webhook: connection disabled, dropping');
+        }
+        await params.recordDeliveryOnly({
+            tx: params.tx,
+            provider: GITHUB_SOURCE,
+            deliveryId: params.deliveryId
+        });
+        return {
+            outcome: 'inactive-connection'
+        };
+    }
+    if (params.event === 'push') {
+        const validated = githubPushPayloadSchema.safeParse(params.payload);
+        if (!validated.success) {
+            logger().warn({
+                deliveryId: params.deliveryId,
+                issues: validated.error.issues
+            }, 'github webhook push payload failed schema validation; publishing generic envelope only');
+            return publishGithubEnvelopeOnly({
+                tx: params.tx,
+                deliveryId: params.deliveryId,
+                payload: params.payload,
+                publishIntegrationEventReceived: params.publishIntegrationEventReceived,
+                connection,
+                event: 'push'
+            });
+        }
+        return publishGithubPush({
+            ...params,
+            eventPayload: validated.data,
+            rawPayload: params.payload,
+            connection
+        });
+    }
+    const eventName = action ? `${params.event}.${action}` : params.event;
+    const result = await publishGithubEnvelopeOnly({
+        tx: params.tx,
+        deliveryId: params.deliveryId,
+        payload: params.payload,
+        publishIntegrationEventReceived: params.publishIntegrationEventReceived,
+        connection,
+        event: eventName
+    });
+    if (result.outcome === 'published-envelope') {
+        await deleteInstallationTokenSecretBestEffort({
+            deleteInstallationTokenSecret: params.deleteInstallationTokenSecret,
+            event: params.event,
+            action,
+            deliveryId: params.deliveryId,
+            workspaceId: connection.workspaceId,
+            installationId
+        });
+    }
+    return result;
+}
+function shouldDeleteInstallationTokenSecret(event, action) {
+    return event === 'installation' && (action === 'deleted' || action === 'suspend');
+}
+async function deleteInstallationTokenSecretBestEffort(params) {
+    if (!shouldDeleteInstallationTokenSecret(params.event, params.action)) return;
+    try {
+        await params.deleteInstallationTokenSecret?.({
+            workspaceId: params.workspaceId,
+            installationId: params.installationId
+        });
+    } catch (error) {
+        logger().warn({
+            deliveryId: params.deliveryId,
+            installationId: params.installationId,
+            workspaceId: params.workspaceId,
+            error
+        }, 'github webhook installation token cleanup failed');
+    }
+}
+async function publishGithubPush(params) {
+    if (isBranchDeletion(params.eventPayload.after)) {
+        const result = await params.publishIntegrationEventReceived({
+            tx: params.tx,
+            event: {
+                provider: GITHUB_SOURCE,
+                source: params.connection.slug,
+                event: 'push',
+                workspaceId: params.connection.workspaceId,
+                connectionId: params.connection.id,
+                connectionName: params.connection.displayName,
+                deliveryId: params.deliveryId,
+                receivedAt: new Date().toISOString(),
+                payload: params.rawPayload
+            }
+        });
+        return {
+            outcome: result.published ? 'published-push-envelope-only' : 'duplicate-push-envelope-only'
+        };
+    }
+    const ref = stripRefsHeads(params.eventPayload.ref);
+    const defaultBranch = params.eventPayload.repository.default_branch;
+    const push = {
+        externalRepositoryId: buildProviderRepositoryId(GITHUB_SOURCE, String(params.eventPayload.repository.id)),
+        ref,
+        headCommitSha: params.eventPayload.after,
+        defaultBranch,
+        isDefaultBranch: ref === defaultBranch
+    };
+    const result = await params.publishSourcePush({
+        tx: params.tx,
+        provider: GITHUB_SOURCE,
+        source: params.connection.slug,
+        workspaceId: params.connection.workspaceId,
+        connectionId: params.connection.id,
+        connectionName: params.connection.displayName,
+        deliveryId: params.deliveryId,
+        receivedAt: new Date().toISOString(),
+        rawPayload: params.rawPayload,
+        push
+    });
+    return {
+        outcome: result.published ? 'published' : 'duplicate'
+    };
+}
+async function publishGithubEnvelopeOnly(params) {
+    const result = await params.publishIntegrationEventReceived({
+        tx: params.tx,
+        event: {
+            provider: GITHUB_SOURCE,
+            source: params.connection.slug,
+            event: params.event,
+            workspaceId: params.connection.workspaceId,
+            connectionId: params.connection.id,
+            connectionName: params.connection.displayName,
+            deliveryId: params.deliveryId,
+            receivedAt: new Date().toISOString(),
+            payload: params.payload
+        }
+    });
+    return {
+        outcome: result.published ? 'published-envelope' : 'duplicate-envelope'
+    };
+}
+function stripRefsHeads(ref) {
+    return ref.startsWith(REFS_HEADS_PREFIX) ? ref.slice(REFS_HEADS_PREFIX.length) : ref;
+}
+
+//# sourceMappingURL=webhook.js.map

package/dist/core/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/webhook.ts"],"sourcesContent":["import {\n  buildProviderRepositoryId,\n  type GetIntegrationConnectionByIdFn,\n  type IntegrationTx,\n  type PublishIntegrationEventReceivedFn,\n  type PublishSourcePushFn,\n  type RecordDeliveryOnlyFn,\n  type SourcePushPayload,\n} from '@shipfox/api-integration-core-dto';\nimport {\n  type GithubPushPayloadDto,\n  githubPushPayloadSchema,\n  githubWebhookActionSchema,\n  githubWebhookInstallationSchema,\n} from '@shipfox/api-integration-github-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {getGithubInstallationByInstallationId} from '#db/installations.js';\n\nconst REFS_HEADS_PREFIX = 'refs/heads/';\nconst GITHUB_SOURCE = 'github';\n// GitHub sends a `push` webhook for a branch deletion with `after` set to this all-zero SHA.\nconst DELETED_BRANCH_SHA = '0'.repeat(40);\n\nexport interface HandleGithubEventParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  event: string;\n  payload: unknown;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n  deleteInstallationTokenSecret?:\n    | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)\n    | undefined;\n}\n\nexport type HandleGithubEventOutcome =\n  | 'published'\n  | 'duplicate'\n  | 'published-envelope'\n  | 'duplicate-envelope'\n  | 'published-push-envelope-only'\n  | 'duplicate-push-envelope-only'\n  | 'unknown-installation'\n  | 'missing-connection'\n  | 'inactive-connection'\n  | 'no-installation-id';\n\nfunction isBranchDeletion(after: string): boolean {\n  return after === DELETED_BRANCH_SHA;\n}\n\nexport async function handleGithubEvent(\n  params: HandleGithubEventParams,\n): Promise<{outcome: HandleGithubEventOutcome}> {\n  const actionEnvelope = githubWebhookActionSchema.safeParse(params.payload);\n  const action = actionEnvelope.success ? actionEnvelope.data.action : undefined;\n  const installationEnvelope = githubWebhookInstallationSchema.safeParse(params.payload);\n  const installationId = installationEnvelope.success\n    ? installationEnvelope.data.installation?.id\n    : undefined;\n  if (installationId === undefined) {\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'no-installation-id'};\n  }\n\n  const installation = await getGithubInstallationByInstallationId(String(installationId), {\n    tx: params.tx,\n  });\n  if (!installation) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationId},\n      'github webhook: unknown installation, dropping',\n    );\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'unknown-installation'};\n  }\n\n  const connection = await params.getIntegrationConnectionById(installation.connectionId, {\n    tx: params.tx,\n  });\n  if (!connection) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationId, connectionId: installation.connectionId},\n      'github webhook: installation has no connection, dropping',\n    );\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'missing-connection'};\n  }\n\n  if (connection.lifecycleStatus !== 'active') {\n    const logContext = {\n      deliveryId: params.deliveryId,\n      installationId,\n      connectionId: connection.id,\n      workspaceId: connection.workspaceId,\n      lifecycleStatus: connection.lifecycleStatus,\n    };\n    // `disabled` is an expected steady state; only `error` is anomalous.\n    if (connection.lifecycleStatus === 'error') {\n      logger().warn(logContext, 'github webhook: connection in error state, dropping');\n    } else {\n      logger().info(logContext, 'github webhook: connection disabled, dropping');\n    }\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'inactive-connection'};\n  }\n\n  if (params.event === 'push') {\n    const validated = githubPushPayloadSchema.safeParse(params.payload);\n    if (!validated.success) {\n      logger().warn(\n        {deliveryId: params.deliveryId, issues: validated.error.issues},\n        'github webhook push payload failed schema validation; publishing generic envelope only',\n      );\n      return publishGithubEnvelopeOnly({\n        tx: params.tx,\n        deliveryId: params.deliveryId,\n        payload: params.payload,\n        publishIntegrationEventReceived: params.publishIntegrationEventReceived,\n        connection,\n        event: 'push',\n      });\n    }\n\n    return publishGithubPush({\n      ...params,\n      eventPayload: validated.data,\n      rawPayload: params.payload,\n      connection,\n    });\n  }\n\n  const eventName = action ? `${params.event}.${action}` : params.event;\n  const result = await publishGithubEnvelopeOnly({\n    tx: params.tx,\n    deliveryId: params.deliveryId,\n    payload: params.payload,\n    publishIntegrationEventReceived: params.publishIntegrationEventReceived,\n    connection,\n    event: eventName,\n  });\n  if (result.outcome === 'published-envelope') {\n    await deleteInstallationTokenSecretBestEffort({\n      deleteInstallationTokenSecret: params.deleteInstallationTokenSecret,\n      event: params.event,\n      action,\n      deliveryId: params.deliveryId,\n      workspaceId: connection.workspaceId,\n      installationId,\n    });\n  }\n  return result;\n}\n\nfunction shouldDeleteInstallationTokenSecret(event: string, action: string | undefined): boolean {\n  return event === 'installation' && (action === 'deleted' || action === 'suspend');\n}\n\nasync function deleteInstallationTokenSecretBestEffort(params: {\n  deleteInstallationTokenSecret:\n    | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)\n    | undefined;\n  event: string;\n  action: string | undefined;\n  deliveryId: string;\n  workspaceId: string;\n  installationId: number;\n}): Promise<void> {\n  if (!shouldDeleteInstallationTokenSecret(params.event, params.action)) return;\n\n  try {\n    await params.deleteInstallationTokenSecret?.({\n      workspaceId: params.workspaceId,\n      installationId: params.installationId,\n    });\n  } catch (error) {\n    logger().warn(\n      {\n        deliveryId: params.deliveryId,\n        installationId: params.installationId,\n        workspaceId: params.workspaceId,\n        error,\n      },\n      'github webhook installation token cleanup failed',\n    );\n  }\n}\n\nasync function publishGithubPush(params: {\n  tx: IntegrationTx;\n  deliveryId: string;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  eventPayload: GithubPushPayloadDto;\n  rawPayload: unknown;\n  connection: {\n    id: string;\n    workspaceId: string;\n    slug: string;\n    displayName: string;\n  };\n}): Promise<{outcome: HandleGithubEventOutcome}> {\n  if (isBranchDeletion(params.eventPayload.after)) {\n    const result = await params.publishIntegrationEventReceived({\n      tx: params.tx,\n      event: {\n        provider: GITHUB_SOURCE,\n        source: params.connection.slug,\n        event: 'push',\n        workspaceId: params.connection.workspaceId,\n        connectionId: params.connection.id,\n        connectionName: params.connection.displayName,\n        deliveryId: params.deliveryId,\n        receivedAt: new Date().toISOString(),\n        payload: params.rawPayload,\n      },\n    });\n    return {\n      outcome: result.published ? 'published-push-envelope-only' : 'duplicate-push-envelope-only',\n    };\n  }\n\n  const ref = stripRefsHeads(params.eventPayload.ref);\n  const defaultBranch = params.eventPayload.repository.default_branch;\n  const push: SourcePushPayload = {\n    externalRepositoryId: buildProviderRepositoryId(\n      GITHUB_SOURCE,\n      String(params.eventPayload.repository.id),\n    ),\n    ref,\n    headCommitSha: params.eventPayload.after,\n    defaultBranch,\n    isDefaultBranch: ref === defaultBranch,\n  };\n  const result = await params.publishSourcePush({\n    tx: params.tx,\n    provider: GITHUB_SOURCE,\n    source: params.connection.slug,\n    workspaceId: params.connection.workspaceId,\n    connectionId: params.connection.id,\n    connectionName: params.connection.displayName,\n    deliveryId: params.deliveryId,\n    receivedAt: new Date().toISOString(),\n    rawPayload: params.rawPayload,\n    push,\n  });\n\n  return {outcome: result.published ? 'published' : 'duplicate'};\n}\n\nasync function publishGithubEnvelopeOnly(params: {\n  tx: IntegrationTx;\n  deliveryId: string;\n  payload: unknown;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  connection: {id: string; workspaceId: string; slug: string; displayName: string};\n  event: string;\n}): Promise<{outcome: HandleGithubEventOutcome}> {\n  const result = await params.publishIntegrationEventReceived({\n    tx: params.tx,\n    event: {\n      provider: GITHUB_SOURCE,\n      source: params.connection.slug,\n      event: params.event,\n      workspaceId: params.connection.workspaceId,\n      connectionId: params.connection.id,\n      connectionName: params.connection.displayName,\n      deliveryId: params.deliveryId,\n      receivedAt: new Date().toISOString(),\n      payload: params.payload,\n    },\n  });\n  return {outcome: result.published ? 'published-envelope' : 'duplicate-envelope'};\n}\n\nfunction stripRefsHeads(ref: string): string {\n  return ref.startsWith(REFS_HEADS_PREFIX) ? ref.slice(REFS_HEADS_PREFIX.length) : ref;\n}\n"],"names":["buildProviderRepositoryId","githubPushPayloadSchema","githubWebhookActionSchema","githubWebhookInstallationSchema","logger","getGithubInstallationByInstallationId","REFS_HEADS_PREFIX","GITHUB_SOURCE","DELETED_BRANCH_SHA","repeat","isBranchDeletion","after","handleGithubEvent","params","actionEnvelope","safeParse","payload","action","success","data","undefined","installationEnvelope","installationId","installation","id","recordDeliveryOnly","tx","provider","deliveryId","outcome","String","warn","connection","getIntegrationConnectionById","connectionId","lifecycleStatus","logContext","workspaceId","info","event","validated","issues","error","publishGithubEnvelopeOnly","publishIntegrationEventReceived","publishGithubPush","eventPayload","rawPayload","eventName","result","deleteInstallationTokenSecretBestEffort","deleteInstallationTokenSecret","shouldDeleteInstallationTokenSecret","source","slug","connectionName","displayName","receivedAt","Date","toISOString","published","ref","stripRefsHeads","defaultBranch","repository","default_branch","push","externalRepositoryId","headCommitSha","isDefaultBranch","publishSourcePush","startsWith","slice","length"],"mappings":"AAAA,SACEA,yBAAyB,QAOpB,oCAAoC;AAC3C,SAEEC,uBAAuB,EACvBC,yBAAyB,EACzBC,+BAA+B,QAC1B,sCAAsC;AAC7C,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,qCAAqC,QAAO,uBAAuB;AAE3E,MAAMC,oBAAoB;AAC1B,MAAMC,gBAAgB;AACtB,6FAA6F;AAC7F,MAAMC,qBAAqB,IAAIC,MAAM,CAAC;AA4BtC,SAASC,iBAAiBC,KAAa;IACrC,OAAOA,UAAUH;AACnB;AAEA,OAAO,eAAeI,kBACpBC,MAA+B;IAE/B,MAAMC,iBAAiBZ,0BAA0Ba,SAAS,CAACF,OAAOG,OAAO;IACzE,MAAMC,SAASH,eAAeI,OAAO,GAAGJ,eAAeK,IAAI,CAACF,MAAM,GAAGG;IACrE,MAAMC,uBAAuBlB,gCAAgCY,SAAS,CAACF,OAAOG,OAAO;IACrF,MAAMM,iBAAiBD,qBAAqBH,OAAO,GAC/CG,qBAAqBF,IAAI,CAACI,YAAY,EAAEC,KACxCJ;IACJ,IAAIE,mBAAmBF,WAAW;QAChC,MAAMP,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAoB;IACvC;IAEA,MAAMN,eAAe,MAAMlB,sCAAsCyB,OAAOR,iBAAiB;QACvFI,IAAIb,OAAOa,EAAE;IACf;IACA,IAAI,CAACH,cAAc;QACjBnB,SAAS2B,IAAI,CACX;YAACH,YAAYf,OAAOe,UAAU;YAAEN;QAAc,GAC9C;QAEF,MAAMT,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAsB;IACzC;IAEA,MAAMG,aAAa,MAAMnB,OAAOoB,4BAA4B,CAACV,aAAaW,YAAY,EAAE;QACtFR,IAAIb,OAAOa,EAAE;IACf;IACA,IAAI,CAACM,YAAY;QACf5B,SAAS2B,IAAI,CACX;YAACH,YAAYf,OAAOe,UAAU;YAAEN;YAAgBY,cAAcX,aAAaW,YAAY;QAAA,GACvF;QAEF,MAAMrB,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAoB;IACvC;IAEA,IAAIG,WAAWG,eAAe,KAAK,UAAU;QAC3C,MAAMC,aAAa;YACjBR,YAAYf,OAAOe,UAAU;YAC7BN;YACAY,cAAcF,WAAWR,EAAE;YAC3Ba,aAAaL,WAAWK,WAAW;YACnCF,iBAAiBH,WAAWG,eAAe;QAC7C;QACA,qEAAqE;QACrE,IAAIH,WAAWG,eAAe,KAAK,SAAS;YAC1C/B,SAAS2B,IAAI,CAACK,YAAY;QAC5B,OAAO;YACLhC,SAASkC,IAAI,CAACF,YAAY;QAC5B;QACA,MAAMvB,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAqB;IACxC;IAEA,IAAIhB,OAAO0B,KAAK,KAAK,QAAQ;QAC3B,MAAMC,YAAYvC,wBAAwBc,SAAS,CAACF,OAAOG,OAAO;QAClE,IAAI,CAACwB,UAAUtB,OAAO,EAAE;YACtBd,SAAS2B,IAAI,CACX;gBAACH,YAAYf,OAAOe,UAAU;gBAAEa,QAAQD,UAAUE,KAAK,CAACD,MAAM;YAAA,GAC9D;YAEF,OAAOE,0BAA0B;gBAC/BjB,IAAIb,OAAOa,EAAE;gBACbE,YAAYf,OAAOe,UAAU;gBAC7BZ,SAASH,OAAOG,OAAO;gBACvB4B,iCAAiC/B,OAAO+B,+BAA+B;gBACvEZ;gBACAO,OAAO;YACT;QACF;QAEA,OAAOM,kBAAkB;YACvB,GAAGhC,MAAM;YACTiC,cAAcN,UAAUrB,IAAI;YAC5B4B,YAAYlC,OAAOG,OAAO;YAC1BgB;QACF;IACF;IAEA,MAAMgB,YAAY/B,SAAS,GAAGJ,OAAO0B,KAAK,CAAC,CAAC,EAAEtB,QAAQ,GAAGJ,OAAO0B,KAAK;IACrE,MAAMU,SAAS,MAAMN,0BAA0B;QAC7CjB,IAAIb,OAAOa,EAAE;QACbE,YAAYf,OAAOe,UAAU;QAC7BZ,SAASH,OAAOG,OAAO;QACvB4B,iCAAiC/B,OAAO+B,+BAA+B;QACvEZ;QACAO,OAAOS;IACT;IACA,IAAIC,OAAOpB,OAAO,KAAK,sBAAsB;QAC3C,MAAMqB,wCAAwC;YAC5CC,+BAA+BtC,OAAOsC,6BAA6B;YACnEZ,OAAO1B,OAAO0B,KAAK;YACnBtB;YACAW,YAAYf,OAAOe,UAAU;YAC7BS,aAAaL,WAAWK,WAAW;YACnCf;QACF;IACF;IACA,OAAO2B;AACT;AAEA,SAASG,oCAAoCb,KAAa,EAAEtB,MAA0B;IACpF,OAAOsB,UAAU,kBAAmBtB,CAAAA,WAAW,aAAaA,WAAW,SAAQ;AACjF;AAEA,eAAeiC,wCAAwCrC,MAStD;IACC,IAAI,CAACuC,oCAAoCvC,OAAO0B,KAAK,EAAE1B,OAAOI,MAAM,GAAG;IAEvE,IAAI;QACF,MAAMJ,OAAOsC,6BAA6B,GAAG;YAC3Cd,aAAaxB,OAAOwB,WAAW;YAC/Bf,gBAAgBT,OAAOS,cAAc;QACvC;IACF,EAAE,OAAOoB,OAAO;QACdtC,SAAS2B,IAAI,CACX;YACEH,YAAYf,OAAOe,UAAU;YAC7BN,gBAAgBT,OAAOS,cAAc;YACrCe,aAAaxB,OAAOwB,WAAW;YAC/BK;QACF,GACA;IAEJ;AACF;AAEA,eAAeG,kBAAkBhC,MAahC;IACC,IAAIH,iBAAiBG,OAAOiC,YAAY,CAACnC,KAAK,GAAG;QAC/C,MAAMsC,SAAS,MAAMpC,OAAO+B,+BAA+B,CAAC;YAC1DlB,IAAIb,OAAOa,EAAE;YACba,OAAO;gBACLZ,UAAUpB;gBACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;gBAC9Bf,OAAO;gBACPF,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;gBAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;gBAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;gBAC7C5B,YAAYf,OAAOe,UAAU;gBAC7B6B,YAAY,IAAIC,OAAOC,WAAW;gBAClC3C,SAASH,OAAOkC,UAAU;YAC5B;QACF;QACA,OAAO;YACLlB,SAASoB,OAAOW,SAAS,GAAG,iCAAiC;QAC/D;IACF;IAEA,MAAMC,MAAMC,eAAejD,OAAOiC,YAAY,CAACe,GAAG;IAClD,MAAME,gBAAgBlD,OAAOiC,YAAY,CAACkB,UAAU,CAACC,cAAc;IACnE,MAAMC,OAA0B;QAC9BC,sBAAsBnE,0BACpBO,eACAuB,OAAOjB,OAAOiC,YAAY,CAACkB,UAAU,CAACxC,EAAE;QAE1CqC;QACAO,eAAevD,OAAOiC,YAAY,CAACnC,KAAK;QACxCoD;QACAM,iBAAiBR,QAAQE;IAC3B;IACA,MAAMd,SAAS,MAAMpC,OAAOyD,iBAAiB,CAAC;QAC5C5C,IAAIb,OAAOa,EAAE;QACbC,UAAUpB;QACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;QAC9BjB,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;QAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;QAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;QAC7C5B,YAAYf,OAAOe,UAAU;QAC7B6B,YAAY,IAAIC,OAAOC,WAAW;QAClCZ,YAAYlC,OAAOkC,UAAU;QAC7BmB;IACF;IAEA,OAAO;QAACrC,SAASoB,OAAOW,SAAS,GAAG,cAAc;IAAW;AAC/D;AAEA,eAAejB,0BAA0B9B,MAOxC;IACC,MAAMoC,SAAS,MAAMpC,OAAO+B,+BAA+B,CAAC;QAC1DlB,IAAIb,OAAOa,EAAE;QACba,OAAO;YACLZ,UAAUpB;YACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;YAC9Bf,OAAO1B,OAAO0B,KAAK;YACnBF,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;YAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;YAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;YAC7C5B,YAAYf,OAAOe,UAAU;YAC7B6B,YAAY,IAAIC,OAAOC,WAAW;YAClC3C,SAASH,OAAOG,OAAO;QACzB;IACF;IACA,OAAO;QAACa,SAASoB,OAAOW,SAAS,GAAG,uBAAuB;IAAoB;AACjF;AAEA,SAASE,eAAeD,GAAW;IACjC,OAAOA,IAAIU,UAAU,CAACjE,qBAAqBuD,IAAIW,KAAK,CAAClE,kBAAkBmE,MAAM,IAAIZ;AACnF"}