@shipfox/api-integration-github 4.0.0 → 6.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 28 files with swc (410.65ms)
+Successfully compiled: 29 files with swc (450.82ms)

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @shipfox/api-integration-github
 
+## 6.0.0
+
+### Minor Changes
+
+- f262539: Adds a composed webhook processor and optional provider-neutral delivery source for hosted API runtimes.
+- a869cfd: Adds shared stored-request processors for GitHub and Gitea webhook reception.
+
+### Patch Changes
+
+- 3bb4e26: Fixes composed webhook processing and exposes Slack URL-verification responses through the shared contract.
+- f73da5d: Enforces bounded API context imports and routes inter-module consumers through producer contracts.
+- 0649d62: Keeps GitHub credential cleanup and Sentry installation lifecycle handling safe across duplicate, concurrent, and reordered webhook delivery.
+- 326f4c0: Exposes Workspaces inter-module operations and moves Auth and OAuth providers onto injected clients.
+- Updated dependencies [0bb82a4]
+- Updated dependencies [7366f04]
+- Updated dependencies [7ac43a4]
+- Updated dependencies [f262539]
+- Updated dependencies [3bb4e26]
+- Updated dependencies [c2db8c3]
+- Updated dependencies [8bdc149]
+- Updated dependencies [f73da5d]
+- Updated dependencies [6bdf24b]
+- Updated dependencies [b00ed29]
+- Updated dependencies [8aa7cd3]
+- Updated dependencies [326f4c0]
+- Updated dependencies [1820feb]
+- Updated dependencies [4604a06]
+  - @shipfox/api-integration-core-dto@6.0.0
+  - @shipfox/api-workspaces@6.0.0
+  - @shipfox/node-drizzle@0.3.2
+  - @shipfox/api-auth-context@6.0.0
+  - @shipfox/node-fastify@0.2.4
+  - @shipfox/api-integration-github-dto@6.0.0
+
+## 5.0.0
+
+### Patch Changes
+
+- bb037af: Resolves workspace packages from source during development while published consumers continue to use compiled output.
+- Updated dependencies [2875241]
+- Updated dependencies [bb037af]
+- Updated dependencies [fb70438]
+  - @shipfox/api-integration-core-dto@5.0.0
+  - @shipfox/api-auth-context@5.0.0
+  - @shipfox/api-integration-github-dto@5.0.0
+  - @shipfox/api-workspaces@5.0.0
+  - @shipfox/config@1.2.2
+  - @shipfox/node-drizzle@0.3.1
+  - @shipfox/node-fastify@0.2.3
+  - @shipfox/node-opentelemetry@0.5.2
+  - @shipfox/node-postgres@0.4.2
+
 ## 4.0.0
 
 ### Patch Changes

package/dist/core/webhook-processor.d.ts

@@ -0,0 +1,18 @@
+import { type GetIntegrationConnectionByIdFn, type PublishIntegrationEventReceivedFn, type PublishSourcePushFn, type RecordDeliveryOnlyFn, type StoredWebhookRequest, type WebhookProcessingResult } from '@shipfox/api-integration-core-dto';
+import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
+export interface CreateGithubWebhookProcessorOptions {
+    coreDb: () => NodePgDatabase<Record<string, unknown>>;
+    publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
+    publishSourcePush: PublishSourcePushFn;
+    recordDeliveryOnly: RecordDeliveryOnlyFn;
+    getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
+    deleteInstallationTokenSecret?: ((params: {
+        workspaceId: string;
+        installationId: number;
+    }) => Promise<unknown>) | undefined;
+}
+export interface GithubWebhookProcessor {
+    process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;
+}
+export declare function createGithubWebhookProcessor(options: CreateGithubWebhookProcessorOptions): GithubWebhookProcessor;
+//# sourceMappingURL=webhook-processor.d.ts.map

package/dist/core/webhook-processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-processor.d.ts","sourceRoot":"","sources":["../../src/core/webhook-processor.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,8BAA8B,EACnC,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAQ9D,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,6BAA6B,CAAC,EAC1B,CAAC,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAC7E,SAAS,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC1E;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mCAAmC,GAC3C,sBAAsB,CAGxB"}

package/dist/core/webhook-processor.js

@@ -0,0 +1,83 @@
+import { Buffer } from 'node:buffer';
+import { Webhooks } from '@octokit/webhooks';
+import { decodeWebhookBody } from '@shipfox/api-integration-core-dto';
+import { logger } from '@shipfox/node-opentelemetry';
+import { config } from '#config.js';
+import { handleGithubEvent } from '#core/webhook.js';
+const DELIVERY_HEADER = 'x-github-delivery';
+const EVENT_HEADER = 'x-github-event';
+const SIGNATURE_HEADER = 'x-hub-signature-256';
+export function createGithubWebhookProcessor(options) {
+    const webhooks = new Webhooks({
+        secret: config.GITHUB_APP_WEBHOOK_SECRET
+    });
+    return {
+        process: (request)=>processGithubWebhookRequest(options, webhooks, request)
+    };
+}
+async function processGithubWebhookRequest(options, webhooks, request) {
+    if (request.route_id !== 'github') {
+        throw new Error(`GitHub processor cannot process ${request.route_id} requests`);
+    }
+    const deliveryId = request.headers[DELIVERY_HEADER];
+    const event = request.headers[EVENT_HEADER];
+    const signature = request.headers[SIGNATURE_HEADER];
+    if (!deliveryId || !event || !signature) {
+        return {
+            outcome: 'discarded',
+            reason: 'missing_required_input'
+        };
+    }
+    const rawBody = Buffer.from(decodeWebhookBody(request.body));
+    let verified;
+    try {
+        verified = await webhooks.verify(rawBody.toString('utf8'), signature);
+    } catch (error) {
+        logger().warn({
+            deliveryId,
+            err: error
+        }, 'github webhook signature verification threw');
+        verified = false;
+    }
+    if (!verified) return {
+        outcome: 'discarded',
+        reason: 'invalid_signature',
+        deliveryId
+    };
+    let payload;
+    try {
+        payload = JSON.parse(rawBody.toString('utf8'));
+    } catch (error) {
+        logger().warn({
+            deliveryId,
+            err: error
+        }, 'github webhook payload JSON parse failed');
+        return {
+            outcome: 'discarded',
+            reason: 'malformed_payload',
+            deliveryId
+        };
+    }
+    const result = await options.coreDb().transaction(async (tx)=>handleGithubEvent({
+            tx,
+            deliveryId,
+            event,
+            payload,
+            publishIntegrationEventReceived: options.publishIntegrationEventReceived,
+            publishSourcePush: options.publishSourcePush,
+            recordDeliveryOnly: options.recordDeliveryOnly,
+            getIntegrationConnectionById: options.getIntegrationConnectionById
+        }));
+    if (result.installationTokenCleanup && options.deleteInstallationTokenSecret) {
+        await options.deleteInstallationTokenSecret(result.installationTokenCleanup);
+    }
+    return result.outcome.startsWith('duplicate') ? {
+        outcome: 'duplicate',
+        deliveryId
+    } : {
+        outcome: 'processed',
+        deliveryId
+    };
+}
+
+//# sourceMappingURL=webhook-processor.js.map

package/dist/core/webhook-processor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/webhook-processor.ts"],"sourcesContent":["import {Buffer} from 'node:buffer';\nimport {Webhooks} from '@octokit/webhooks';\nimport {\n  decodeWebhookBody,\n  type GetIntegrationConnectionByIdFn,\n  type PublishIntegrationEventReceivedFn,\n  type PublishSourcePushFn,\n  type RecordDeliveryOnlyFn,\n  type StoredWebhookRequest,\n  type WebhookProcessingResult,\n} from '@shipfox/api-integration-core-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {NodePgDatabase} from 'drizzle-orm/node-postgres';\nimport {config} from '#config.js';\nimport {handleGithubEvent} from '#core/webhook.js';\n\nconst DELIVERY_HEADER = 'x-github-delivery';\nconst EVENT_HEADER = 'x-github-event';\nconst SIGNATURE_HEADER = 'x-hub-signature-256';\n\nexport interface CreateGithubWebhookProcessorOptions {\n  coreDb: () => NodePgDatabase<Record<string, unknown>>;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n  deleteInstallationTokenSecret?:\n    | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)\n    | undefined;\n}\n\nexport interface GithubWebhookProcessor {\n  process(request: StoredWebhookRequest): Promise<WebhookProcessingResult>;\n}\n\nexport function createGithubWebhookProcessor(\n  options: CreateGithubWebhookProcessorOptions,\n): GithubWebhookProcessor {\n  const webhooks = new Webhooks({secret: config.GITHUB_APP_WEBHOOK_SECRET});\n  return {process: (request) => processGithubWebhookRequest(options, webhooks, request)};\n}\n\nasync function processGithubWebhookRequest(\n  options: CreateGithubWebhookProcessorOptions,\n  webhooks: Webhooks,\n  request: StoredWebhookRequest,\n): Promise<WebhookProcessingResult> {\n  if (request.route_id !== 'github') {\n    throw new Error(`GitHub processor cannot process ${request.route_id} requests`);\n  }\n\n  const deliveryId = request.headers[DELIVERY_HEADER];\n  const event = request.headers[EVENT_HEADER];\n  const signature = request.headers[SIGNATURE_HEADER];\n  if (!deliveryId || !event || !signature) {\n    return {outcome: 'discarded', reason: 'missing_required_input'};\n  }\n\n  const rawBody = Buffer.from(decodeWebhookBody(request.body));\n  let verified: boolean;\n  try {\n    verified = await webhooks.verify(rawBody.toString('utf8'), signature);\n  } catch (error) {\n    logger().warn({deliveryId, err: error}, 'github webhook signature verification threw');\n    verified = false;\n  }\n  if (!verified) return {outcome: 'discarded', reason: 'invalid_signature', deliveryId};\n\n  let payload: unknown;\n  try {\n    payload = JSON.parse(rawBody.toString('utf8'));\n  } catch (error) {\n    logger().warn({deliveryId, err: error}, 'github webhook payload JSON parse failed');\n    return {outcome: 'discarded', reason: 'malformed_payload', deliveryId};\n  }\n\n  const result = await options.coreDb().transaction(async (tx) =>\n    handleGithubEvent({\n      tx,\n      deliveryId,\n      event,\n      payload,\n      publishIntegrationEventReceived: options.publishIntegrationEventReceived,\n      publishSourcePush: options.publishSourcePush,\n      recordDeliveryOnly: options.recordDeliveryOnly,\n      getIntegrationConnectionById: options.getIntegrationConnectionById,\n    }),\n  );\n\n  if (result.installationTokenCleanup && options.deleteInstallationTokenSecret) {\n    await options.deleteInstallationTokenSecret(result.installationTokenCleanup);\n  }\n\n  return result.outcome.startsWith('duplicate')\n    ? {outcome: 'duplicate', deliveryId}\n    : {outcome: 'processed', deliveryId};\n}\n"],"names":["Buffer","Webhooks","decodeWebhookBody","logger","config","handleGithubEvent","DELIVERY_HEADER","EVENT_HEADER","SIGNATURE_HEADER","createGithubWebhookProcessor","options","webhooks","secret","GITHUB_APP_WEBHOOK_SECRET","process","request","processGithubWebhookRequest","route_id","Error","deliveryId","headers","event","signature","outcome","reason","rawBody","from","body","verified","verify","toString","error","warn","err","payload","JSON","parse","result","coreDb","transaction","tx","publishIntegrationEventReceived","publishSourcePush","recordDeliveryOnly","getIntegrationConnectionById","installationTokenCleanup","deleteInstallationTokenSecret","startsWith"],"mappings":"AAAA,SAAQA,MAAM,QAAO,cAAc;AACnC,SAAQC,QAAQ,QAAO,oBAAoB;AAC3C,SACEC,iBAAiB,QAOZ,oCAAoC;AAC3C,SAAQC,MAAM,QAAO,8BAA8B;AAEnD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,QAAO,mBAAmB;AAEnD,MAAMC,kBAAkB;AACxB,MAAMC,eAAe;AACrB,MAAMC,mBAAmB;AAiBzB,OAAO,SAASC,6BACdC,OAA4C;IAE5C,MAAMC,WAAW,IAAIV,SAAS;QAACW,QAAQR,OAAOS,yBAAyB;IAAA;IACvE,OAAO;QAACC,SAAS,CAACC,UAAYC,4BAA4BN,SAASC,UAAUI;IAAQ;AACvF;AAEA,eAAeC,4BACbN,OAA4C,EAC5CC,QAAkB,EAClBI,OAA6B;IAE7B,IAAIA,QAAQE,QAAQ,KAAK,UAAU;QACjC,MAAM,IAAIC,MAAM,CAAC,gCAAgC,EAAEH,QAAQE,QAAQ,CAAC,SAAS,CAAC;IAChF;IAEA,MAAME,aAAaJ,QAAQK,OAAO,CAACd,gBAAgB;IACnD,MAAMe,QAAQN,QAAQK,OAAO,CAACb,aAAa;IAC3C,MAAMe,YAAYP,QAAQK,OAAO,CAACZ,iBAAiB;IACnD,IAAI,CAACW,cAAc,CAACE,SAAS,CAACC,WAAW;QACvC,OAAO;YAACC,SAAS;YAAaC,QAAQ;QAAwB;IAChE;IAEA,MAAMC,UAAUzB,OAAO0B,IAAI,CAACxB,kBAAkBa,QAAQY,IAAI;IAC1D,IAAIC;IACJ,IAAI;QACFA,WAAW,MAAMjB,SAASkB,MAAM,CAACJ,QAAQK,QAAQ,CAAC,SAASR;IAC7D,EAAE,OAAOS,OAAO;QACd5B,SAAS6B,IAAI,CAAC;YAACb;YAAYc,KAAKF;QAAK,GAAG;QACxCH,WAAW;IACb;IACA,IAAI,CAACA,UAAU,OAAO;QAACL,SAAS;QAAaC,QAAQ;QAAqBL;IAAU;IAEpF,IAAIe;IACJ,IAAI;QACFA,UAAUC,KAAKC,KAAK,CAACX,QAAQK,QAAQ,CAAC;IACxC,EAAE,OAAOC,OAAO;QACd5B,SAAS6B,IAAI,CAAC;YAACb;YAAYc,KAAKF;QAAK,GAAG;QACxC,OAAO;YAACR,SAAS;YAAaC,QAAQ;YAAqBL;QAAU;IACvE;IAEA,MAAMkB,SAAS,MAAM3B,QAAQ4B,MAAM,GAAGC,WAAW,CAAC,OAAOC,KACvDnC,kBAAkB;YAChBmC;YACArB;YACAE;YACAa;YACAO,iCAAiC/B,QAAQ+B,+BAA+B;YACxEC,mBAAmBhC,QAAQgC,iBAAiB;YAC5CC,oBAAoBjC,QAAQiC,kBAAkB;YAC9CC,8BAA8BlC,QAAQkC,4BAA4B;QACpE;IAGF,IAAIP,OAAOQ,wBAAwB,IAAInC,QAAQoC,6BAA6B,EAAE;QAC5E,MAAMpC,QAAQoC,6BAA6B,CAACT,OAAOQ,wBAAwB;IAC7E;IAEA,OAAOR,OAAOd,OAAO,CAACwB,UAAU,CAAC,eAC7B;QAACxB,SAAS;QAAaJ;IAAU,IACjC;QAACI,SAAS;QAAaJ;IAAU;AACvC"}

package/dist/core/webhook.d.ts

@@ -8,13 +8,14 @@ export interface HandleGithubEventParams {
     publishSourcePush: PublishSourcePushFn;
     recordDeliveryOnly: RecordDeliveryOnlyFn;
     getIntegrationConnectionById: GetIntegrationConnectionByIdFn;
-    deleteInstallationTokenSecret?: ((params: {
-        workspaceId: string;
-        installationId: number;
-    }) => Promise<unknown>) | undefined;
 }
 export type HandleGithubEventOutcome = 'published' | 'duplicate' | 'published-envelope' | 'duplicate-envelope' | 'published-push-envelope-only' | 'duplicate-push-envelope-only' | 'unknown-installation' | 'missing-connection' | 'inactive-connection' | 'no-installation-id';
-export declare function handleGithubEvent(params: HandleGithubEventParams): Promise<{
+export interface HandleGithubEventResult {
     outcome: HandleGithubEventOutcome;
-}>;
+    installationTokenCleanup?: {
+        workspaceId: string;
+        installationId: number;
+    } | undefined;
+}
+export declare function handleGithubEvent(params: HandleGithubEventParams): Promise<HandleGithubEventResult>;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/core/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/core/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,8BAA8B,EACnC,KAAK,aAAa,EAClB,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAE1B,MAAM,mCAAmC,CAAC;AAe3C,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,6BAA6B,CAAC,EAC1B,CAAC,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAC7E,SAAS,CAAC;CACf;AAED,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,8BAA8B,GAC9B,8BAA8B,GAC9B,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,oBAAoB,CAAC;AAMzB,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAC,CAAC,CAmH9C"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/core/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,8BAA8B,EACnC,KAAK,aAAa,EAClB,KAAK,iCAAiC,EACtC,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAE1B,MAAM,mCAAmC,CAAC;AAe3C,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,aAAa,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;CAC9D;AAED,MAAM,MAAM,wBAAwB,GAChC,WAAW,GACX,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,8BAA8B,GAC9B,8BAA8B,GAC9B,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,wBAAwB,CAAC;IAClC,wBAAwB,CAAC,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAC,GAAG,SAAS,CAAC;CACtF;AAMD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,uBAAuB,CAAC,CAqHlC"}

package/dist/core/webhook.js

@@ -78,9 +78,9 @@ export async function handleGithubEvent(params) {
             provider: GITHUB_SOURCE,
             deliveryId: params.deliveryId
         });
-        return {
+        return withInstallationTokenCleanup({
             outcome: 'inactive-connection'
-        };
+        }, params.event, action, connection.workspaceId, installationId);
     }
     if (params.event === 'push') {
         const validated = githubPushPayloadSchema.safeParse(params.payload);
@@ -114,36 +114,20 @@ export async function handleGithubEvent(params) {
         connection,
         event: eventName
     });
-    if (result.outcome === 'published-envelope') {
-        await deleteInstallationTokenSecretBestEffort({
-            deleteInstallationTokenSecret: params.deleteInstallationTokenSecret,
-            event: params.event,
-            action,
-            deliveryId: params.deliveryId,
-            workspaceId: connection.workspaceId,
-            installationId
-        });
-    }
-    return result;
+    return withInstallationTokenCleanup(result, params.event, action, connection.workspaceId, installationId);
 }
 function shouldDeleteInstallationTokenSecret(event, action) {
     return event === 'installation' && (action === 'deleted' || action === 'suspend');
 }
-async function deleteInstallationTokenSecretBestEffort(params) {
-    if (!shouldDeleteInstallationTokenSecret(params.event, params.action)) return;
-    try {
-        await params.deleteInstallationTokenSecret?.({
-            workspaceId: params.workspaceId,
-            installationId: params.installationId
-        });
-    } catch (error) {
-        logger().warn({
-            deliveryId: params.deliveryId,
-            installationId: params.installationId,
-            workspaceId: params.workspaceId,
-            error
-        }, 'github webhook installation token cleanup failed');
-    }
+function withInstallationTokenCleanup(result, event, action, workspaceId, installationId) {
+    if (!shouldDeleteInstallationTokenSecret(event, action)) return result;
+    return {
+        ...result,
+        installationTokenCleanup: {
+            workspaceId,
+            installationId
+        }
+    };
 }
 async function publishGithubPush(params) {
     if (isBranchDeletion(params.eventPayload.after)) {

package/dist/core/webhook.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/webhook.ts"],"sourcesContent":["import {\n  buildProviderRepositoryId,\n  type GetIntegrationConnectionByIdFn,\n  type IntegrationTx,\n  type PublishIntegrationEventReceivedFn,\n  type PublishSourcePushFn,\n  type RecordDeliveryOnlyFn,\n  type SourcePushPayload,\n} from '@shipfox/api-integration-core-dto';\nimport {\n  type GithubPushPayloadDto,\n  githubPushPayloadSchema,\n  githubWebhookActionSchema,\n  githubWebhookInstallationSchema,\n} from '@shipfox/api-integration-github-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {getGithubInstallationByInstallationId} from '#db/installations.js';\n\nconst REFS_HEADS_PREFIX = 'refs/heads/';\nconst GITHUB_SOURCE = 'github';\n// GitHub sends a `push` webhook for a branch deletion with `after` set to this all-zero SHA.\nconst DELETED_BRANCH_SHA = '0'.repeat(40);\n\nexport interface HandleGithubEventParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  event: string;\n  payload: unknown;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n  deleteInstallationTokenSecret?:\n    | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)\n    | undefined;\n}\n\nexport type HandleGithubEventOutcome =\n  | 'published'\n  | 'duplicate'\n  | 'published-envelope'\n  | 'duplicate-envelope'\n  | 'published-push-envelope-only'\n  | 'duplicate-push-envelope-only'\n  | 'unknown-installation'\n  | 'missing-connection'\n  | 'inactive-connection'\n  | 'no-installation-id';\n\nfunction isBranchDeletion(after: string): boolean {\n  return after === DELETED_BRANCH_SHA;\n}\n\nexport async function handleGithubEvent(\n  params: HandleGithubEventParams,\n): Promise<{outcome: HandleGithubEventOutcome}> {\n  const actionEnvelope = githubWebhookActionSchema.safeParse(params.payload);\n  const action = actionEnvelope.success ? actionEnvelope.data.action : undefined;\n  const installationEnvelope = githubWebhookInstallationSchema.safeParse(params.payload);\n  const installationId = installationEnvelope.success\n    ? installationEnvelope.data.installation?.id\n    : undefined;\n  if (installationId === undefined) {\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'no-installation-id'};\n  }\n\n  const installation = await getGithubInstallationByInstallationId(String(installationId), {\n    tx: params.tx,\n  });\n  if (!installation) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationId},\n      'github webhook: unknown installation, dropping',\n    );\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'unknown-installation'};\n  }\n\n  const connection = await params.getIntegrationConnectionById(installation.connectionId, {\n    tx: params.tx,\n  });\n  if (!connection) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationId, connectionId: installation.connectionId},\n      'github webhook: installation has no connection, dropping',\n    );\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'missing-connection'};\n  }\n\n  if (connection.lifecycleStatus !== 'active') {\n    const logContext = {\n      deliveryId: params.deliveryId,\n      installationId,\n      connectionId: connection.id,\n      workspaceId: connection.workspaceId,\n      lifecycleStatus: connection.lifecycleStatus,\n    };\n    // `disabled` is an expected steady state; only `error` is anomalous.\n    if (connection.lifecycleStatus === 'error') {\n      logger().warn(logContext, 'github webhook: connection in error state, dropping');\n    } else {\n      logger().info(logContext, 'github webhook: connection disabled, dropping');\n    }\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'inactive-connection'};\n  }\n\n  if (params.event === 'push') {\n    const validated = githubPushPayloadSchema.safeParse(params.payload);\n    if (!validated.success) {\n      logger().warn(\n        {deliveryId: params.deliveryId, issues: validated.error.issues},\n        'github webhook push payload failed schema validation; publishing generic envelope only',\n      );\n      return publishGithubEnvelopeOnly({\n        tx: params.tx,\n        deliveryId: params.deliveryId,\n        payload: params.payload,\n        publishIntegrationEventReceived: params.publishIntegrationEventReceived,\n        connection,\n        event: 'push',\n      });\n    }\n\n    return publishGithubPush({\n      ...params,\n      eventPayload: validated.data,\n      rawPayload: params.payload,\n      connection,\n    });\n  }\n\n  const eventName = action ? `${params.event}.${action}` : params.event;\n  const result = await publishGithubEnvelopeOnly({\n    tx: params.tx,\n    deliveryId: params.deliveryId,\n    payload: params.payload,\n    publishIntegrationEventReceived: params.publishIntegrationEventReceived,\n    connection,\n    event: eventName,\n  });\n  if (result.outcome === 'published-envelope') {\n    await deleteInstallationTokenSecretBestEffort({\n      deleteInstallationTokenSecret: params.deleteInstallationTokenSecret,\n      event: params.event,\n      action,\n      deliveryId: params.deliveryId,\n      workspaceId: connection.workspaceId,\n      installationId,\n    });\n  }\n  return result;\n}\n\nfunction shouldDeleteInstallationTokenSecret(event: string, action: string | undefined): boolean {\n  return event === 'installation' && (action === 'deleted' || action === 'suspend');\n}\n\nasync function deleteInstallationTokenSecretBestEffort(params: {\n  deleteInstallationTokenSecret:\n    | ((params: {workspaceId: string; installationId: number}) => Promise<unknown>)\n    | undefined;\n  event: string;\n  action: string | undefined;\n  deliveryId: string;\n  workspaceId: string;\n  installationId: number;\n}): Promise<void> {\n  if (!shouldDeleteInstallationTokenSecret(params.event, params.action)) return;\n\n  try {\n    await params.deleteInstallationTokenSecret?.({\n      workspaceId: params.workspaceId,\n      installationId: params.installationId,\n    });\n  } catch (error) {\n    logger().warn(\n      {\n        deliveryId: params.deliveryId,\n        installationId: params.installationId,\n        workspaceId: params.workspaceId,\n        error,\n      },\n      'github webhook installation token cleanup failed',\n    );\n  }\n}\n\nasync function publishGithubPush(params: {\n  tx: IntegrationTx;\n  deliveryId: string;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  eventPayload: GithubPushPayloadDto;\n  rawPayload: unknown;\n  connection: {\n    id: string;\n    workspaceId: string;\n    slug: string;\n    displayName: string;\n  };\n}): Promise<{outcome: HandleGithubEventOutcome}> {\n  if (isBranchDeletion(params.eventPayload.after)) {\n    const result = await params.publishIntegrationEventReceived({\n      tx: params.tx,\n      event: {\n        provider: GITHUB_SOURCE,\n        source: params.connection.slug,\n        event: 'push',\n        workspaceId: params.connection.workspaceId,\n        connectionId: params.connection.id,\n        connectionName: params.connection.displayName,\n        deliveryId: params.deliveryId,\n        receivedAt: new Date().toISOString(),\n        payload: params.rawPayload,\n      },\n    });\n    return {\n      outcome: result.published ? 'published-push-envelope-only' : 'duplicate-push-envelope-only',\n    };\n  }\n\n  const ref = stripRefsHeads(params.eventPayload.ref);\n  const defaultBranch = params.eventPayload.repository.default_branch;\n  const push: SourcePushPayload = {\n    externalRepositoryId: buildProviderRepositoryId(\n      GITHUB_SOURCE,\n      String(params.eventPayload.repository.id),\n    ),\n    ref,\n    headCommitSha: params.eventPayload.after,\n    defaultBranch,\n    isDefaultBranch: ref === defaultBranch,\n  };\n  const result = await params.publishSourcePush({\n    tx: params.tx,\n    provider: GITHUB_SOURCE,\n    source: params.connection.slug,\n    workspaceId: params.connection.workspaceId,\n    connectionId: params.connection.id,\n    connectionName: params.connection.displayName,\n    deliveryId: params.deliveryId,\n    receivedAt: new Date().toISOString(),\n    rawPayload: params.rawPayload,\n    push,\n  });\n\n  return {outcome: result.published ? 'published' : 'duplicate'};\n}\n\nasync function publishGithubEnvelopeOnly(params: {\n  tx: IntegrationTx;\n  deliveryId: string;\n  payload: unknown;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  connection: {id: string; workspaceId: string; slug: string; displayName: string};\n  event: string;\n}): Promise<{outcome: HandleGithubEventOutcome}> {\n  const result = await params.publishIntegrationEventReceived({\n    tx: params.tx,\n    event: {\n      provider: GITHUB_SOURCE,\n      source: params.connection.slug,\n      event: params.event,\n      workspaceId: params.connection.workspaceId,\n      connectionId: params.connection.id,\n      connectionName: params.connection.displayName,\n      deliveryId: params.deliveryId,\n      receivedAt: new Date().toISOString(),\n      payload: params.payload,\n    },\n  });\n  return {outcome: result.published ? 'published-envelope' : 'duplicate-envelope'};\n}\n\nfunction stripRefsHeads(ref: string): string {\n  return ref.startsWith(REFS_HEADS_PREFIX) ? ref.slice(REFS_HEADS_PREFIX.length) : ref;\n}\n"],"names":["buildProviderRepositoryId","githubPushPayloadSchema","githubWebhookActionSchema","githubWebhookInstallationSchema","logger","getGithubInstallationByInstallationId","REFS_HEADS_PREFIX","GITHUB_SOURCE","DELETED_BRANCH_SHA","repeat","isBranchDeletion","after","handleGithubEvent","params","actionEnvelope","safeParse","payload","action","success","data","undefined","installationEnvelope","installationId","installation","id","recordDeliveryOnly","tx","provider","deliveryId","outcome","String","warn","connection","getIntegrationConnectionById","connectionId","lifecycleStatus","logContext","workspaceId","info","event","validated","issues","error","publishGithubEnvelopeOnly","publishIntegrationEventReceived","publishGithubPush","eventPayload","rawPayload","eventName","result","deleteInstallationTokenSecretBestEffort","deleteInstallationTokenSecret","shouldDeleteInstallationTokenSecret","source","slug","connectionName","displayName","receivedAt","Date","toISOString","published","ref","stripRefsHeads","defaultBranch","repository","default_branch","push","externalRepositoryId","headCommitSha","isDefaultBranch","publishSourcePush","startsWith","slice","length"],"mappings":"AAAA,SACEA,yBAAyB,QAOpB,oCAAoC;AAC3C,SAEEC,uBAAuB,EACvBC,yBAAyB,EACzBC,+BAA+B,QAC1B,sCAAsC;AAC7C,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,qCAAqC,QAAO,uBAAuB;AAE3E,MAAMC,oBAAoB;AAC1B,MAAMC,gBAAgB;AACtB,6FAA6F;AAC7F,MAAMC,qBAAqB,IAAIC,MAAM,CAAC;AA4BtC,SAASC,iBAAiBC,KAAa;IACrC,OAAOA,UAAUH;AACnB;AAEA,OAAO,eAAeI,kBACpBC,MAA+B;IAE/B,MAAMC,iBAAiBZ,0BAA0Ba,SAAS,CAACF,OAAOG,OAAO;IACzE,MAAMC,SAASH,eAAeI,OAAO,GAAGJ,eAAeK,IAAI,CAACF,MAAM,GAAGG;IACrE,MAAMC,uBAAuBlB,gCAAgCY,SAAS,CAACF,OAAOG,OAAO;IACrF,MAAMM,iBAAiBD,qBAAqBH,OAAO,GAC/CG,qBAAqBF,IAAI,CAACI,YAAY,EAAEC,KACxCJ;IACJ,IAAIE,mBAAmBF,WAAW;QAChC,MAAMP,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAoB;IACvC;IAEA,MAAMN,eAAe,MAAMlB,sCAAsCyB,OAAOR,iBAAiB;QACvFI,IAAIb,OAAOa,EAAE;IACf;IACA,IAAI,CAACH,cAAc;QACjBnB,SAAS2B,IAAI,CACX;YAACH,YAAYf,OAAOe,UAAU;YAAEN;QAAc,GAC9C;QAEF,MAAMT,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAsB;IACzC;IAEA,MAAMG,aAAa,MAAMnB,OAAOoB,4BAA4B,CAACV,aAAaW,YAAY,EAAE;QACtFR,IAAIb,OAAOa,EAAE;IACf;IACA,IAAI,CAACM,YAAY;QACf5B,SAAS2B,IAAI,CACX;YAACH,YAAYf,OAAOe,UAAU;YAAEN;YAAgBY,cAAcX,aAAaW,YAAY;QAAA,GACvF;QAEF,MAAMrB,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAoB;IACvC;IAEA,IAAIG,WAAWG,eAAe,KAAK,UAAU;QAC3C,MAAMC,aAAa;YACjBR,YAAYf,OAAOe,UAAU;YAC7BN;YACAY,cAAcF,WAAWR,EAAE;YAC3Ba,aAAaL,WAAWK,WAAW;YACnCF,iBAAiBH,WAAWG,eAAe;QAC7C;QACA,qEAAqE;QACrE,IAAIH,WAAWG,eAAe,KAAK,SAAS;YAC1C/B,SAAS2B,IAAI,CAACK,YAAY;QAC5B,OAAO;YACLhC,SAASkC,IAAI,CAACF,YAAY;QAC5B;QACA,MAAMvB,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAqB;IACxC;IAEA,IAAIhB,OAAO0B,KAAK,KAAK,QAAQ;QAC3B,MAAMC,YAAYvC,wBAAwBc,SAAS,CAACF,OAAOG,OAAO;QAClE,IAAI,CAACwB,UAAUtB,OAAO,EAAE;YACtBd,SAAS2B,IAAI,CACX;gBAACH,YAAYf,OAAOe,UAAU;gBAAEa,QAAQD,UAAUE,KAAK,CAACD,MAAM;YAAA,GAC9D;YAEF,OAAOE,0BAA0B;gBAC/BjB,IAAIb,OAAOa,EAAE;gBACbE,YAAYf,OAAOe,UAAU;gBAC7BZ,SAASH,OAAOG,OAAO;gBACvB4B,iCAAiC/B,OAAO+B,+BAA+B;gBACvEZ;gBACAO,OAAO;YACT;QACF;QAEA,OAAOM,kBAAkB;YACvB,GAAGhC,MAAM;YACTiC,cAAcN,UAAUrB,IAAI;YAC5B4B,YAAYlC,OAAOG,OAAO;YAC1BgB;QACF;IACF;IAEA,MAAMgB,YAAY/B,SAAS,GAAGJ,OAAO0B,KAAK,CAAC,CAAC,EAAEtB,QAAQ,GAAGJ,OAAO0B,KAAK;IACrE,MAAMU,SAAS,MAAMN,0BAA0B;QAC7CjB,IAAIb,OAAOa,EAAE;QACbE,YAAYf,OAAOe,UAAU;QAC7BZ,SAASH,OAAOG,OAAO;QACvB4B,iCAAiC/B,OAAO+B,+BAA+B;QACvEZ;QACAO,OAAOS;IACT;IACA,IAAIC,OAAOpB,OAAO,KAAK,sBAAsB;QAC3C,MAAMqB,wCAAwC;YAC5CC,+BAA+BtC,OAAOsC,6BAA6B;YACnEZ,OAAO1B,OAAO0B,KAAK;YACnBtB;YACAW,YAAYf,OAAOe,UAAU;YAC7BS,aAAaL,WAAWK,WAAW;YACnCf;QACF;IACF;IACA,OAAO2B;AACT;AAEA,SAASG,oCAAoCb,KAAa,EAAEtB,MAA0B;IACpF,OAAOsB,UAAU,kBAAmBtB,CAAAA,WAAW,aAAaA,WAAW,SAAQ;AACjF;AAEA,eAAeiC,wCAAwCrC,MAStD;IACC,IAAI,CAACuC,oCAAoCvC,OAAO0B,KAAK,EAAE1B,OAAOI,MAAM,GAAG;IAEvE,IAAI;QACF,MAAMJ,OAAOsC,6BAA6B,GAAG;YAC3Cd,aAAaxB,OAAOwB,WAAW;YAC/Bf,gBAAgBT,OAAOS,cAAc;QACvC;IACF,EAAE,OAAOoB,OAAO;QACdtC,SAAS2B,IAAI,CACX;YACEH,YAAYf,OAAOe,UAAU;YAC7BN,gBAAgBT,OAAOS,cAAc;YACrCe,aAAaxB,OAAOwB,WAAW;YAC/BK;QACF,GACA;IAEJ;AACF;AAEA,eAAeG,kBAAkBhC,MAahC;IACC,IAAIH,iBAAiBG,OAAOiC,YAAY,CAACnC,KAAK,GAAG;QAC/C,MAAMsC,SAAS,MAAMpC,OAAO+B,+BAA+B,CAAC;YAC1DlB,IAAIb,OAAOa,EAAE;YACba,OAAO;gBACLZ,UAAUpB;gBACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;gBAC9Bf,OAAO;gBACPF,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;gBAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;gBAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;gBAC7C5B,YAAYf,OAAOe,UAAU;gBAC7B6B,YAAY,IAAIC,OAAOC,WAAW;gBAClC3C,SAASH,OAAOkC,UAAU;YAC5B;QACF;QACA,OAAO;YACLlB,SAASoB,OAAOW,SAAS,GAAG,iCAAiC;QAC/D;IACF;IAEA,MAAMC,MAAMC,eAAejD,OAAOiC,YAAY,CAACe,GAAG;IAClD,MAAME,gBAAgBlD,OAAOiC,YAAY,CAACkB,UAAU,CAACC,cAAc;IACnE,MAAMC,OAA0B;QAC9BC,sBAAsBnE,0BACpBO,eACAuB,OAAOjB,OAAOiC,YAAY,CAACkB,UAAU,CAACxC,EAAE;QAE1CqC;QACAO,eAAevD,OAAOiC,YAAY,CAACnC,KAAK;QACxCoD;QACAM,iBAAiBR,QAAQE;IAC3B;IACA,MAAMd,SAAS,MAAMpC,OAAOyD,iBAAiB,CAAC;QAC5C5C,IAAIb,OAAOa,EAAE;QACbC,UAAUpB;QACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;QAC9BjB,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;QAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;QAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;QAC7C5B,YAAYf,OAAOe,UAAU;QAC7B6B,YAAY,IAAIC,OAAOC,WAAW;QAClCZ,YAAYlC,OAAOkC,UAAU;QAC7BmB;IACF;IAEA,OAAO;QAACrC,SAASoB,OAAOW,SAAS,GAAG,cAAc;IAAW;AAC/D;AAEA,eAAejB,0BAA0B9B,MAOxC;IACC,MAAMoC,SAAS,MAAMpC,OAAO+B,+BAA+B,CAAC;QAC1DlB,IAAIb,OAAOa,EAAE;QACba,OAAO;YACLZ,UAAUpB;YACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;YAC9Bf,OAAO1B,OAAO0B,KAAK;YACnBF,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;YAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;YAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;YAC7C5B,YAAYf,OAAOe,UAAU;YAC7B6B,YAAY,IAAIC,OAAOC,WAAW;YAClC3C,SAASH,OAAOG,OAAO;QACzB;IACF;IACA,OAAO;QAACa,SAASoB,OAAOW,SAAS,GAAG,uBAAuB;IAAoB;AACjF;AAEA,SAASE,eAAeD,GAAW;IACjC,OAAOA,IAAIU,UAAU,CAACjE,qBAAqBuD,IAAIW,KAAK,CAAClE,kBAAkBmE,MAAM,IAAIZ;AACnF"}
+{"version":3,"sources":["../../src/core/webhook.ts"],"sourcesContent":["import {\n  buildProviderRepositoryId,\n  type GetIntegrationConnectionByIdFn,\n  type IntegrationTx,\n  type PublishIntegrationEventReceivedFn,\n  type PublishSourcePushFn,\n  type RecordDeliveryOnlyFn,\n  type SourcePushPayload,\n} from '@shipfox/api-integration-core-dto';\nimport {\n  type GithubPushPayloadDto,\n  githubPushPayloadSchema,\n  githubWebhookActionSchema,\n  githubWebhookInstallationSchema,\n} from '@shipfox/api-integration-github-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {getGithubInstallationByInstallationId} from '#db/installations.js';\n\nconst REFS_HEADS_PREFIX = 'refs/heads/';\nconst GITHUB_SOURCE = 'github';\n// GitHub sends a `push` webhook for a branch deletion with `after` set to this all-zero SHA.\nconst DELETED_BRANCH_SHA = '0'.repeat(40);\n\nexport interface HandleGithubEventParams {\n  tx: IntegrationTx;\n  deliveryId: string;\n  event: string;\n  payload: unknown;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n}\n\nexport type HandleGithubEventOutcome =\n  | 'published'\n  | 'duplicate'\n  | 'published-envelope'\n  | 'duplicate-envelope'\n  | 'published-push-envelope-only'\n  | 'duplicate-push-envelope-only'\n  | 'unknown-installation'\n  | 'missing-connection'\n  | 'inactive-connection'\n  | 'no-installation-id';\n\nexport interface HandleGithubEventResult {\n  outcome: HandleGithubEventOutcome;\n  installationTokenCleanup?: {workspaceId: string; installationId: number} | undefined;\n}\n\nfunction isBranchDeletion(after: string): boolean {\n  return after === DELETED_BRANCH_SHA;\n}\n\nexport async function handleGithubEvent(\n  params: HandleGithubEventParams,\n): Promise<HandleGithubEventResult> {\n  const actionEnvelope = githubWebhookActionSchema.safeParse(params.payload);\n  const action = actionEnvelope.success ? actionEnvelope.data.action : undefined;\n  const installationEnvelope = githubWebhookInstallationSchema.safeParse(params.payload);\n  const installationId = installationEnvelope.success\n    ? installationEnvelope.data.installation?.id\n    : undefined;\n  if (installationId === undefined) {\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'no-installation-id'};\n  }\n\n  const installation = await getGithubInstallationByInstallationId(String(installationId), {\n    tx: params.tx,\n  });\n  if (!installation) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationId},\n      'github webhook: unknown installation, dropping',\n    );\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'unknown-installation'};\n  }\n\n  const connection = await params.getIntegrationConnectionById(installation.connectionId, {\n    tx: params.tx,\n  });\n  if (!connection) {\n    logger().warn(\n      {deliveryId: params.deliveryId, installationId, connectionId: installation.connectionId},\n      'github webhook: installation has no connection, dropping',\n    );\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return {outcome: 'missing-connection'};\n  }\n\n  if (connection.lifecycleStatus !== 'active') {\n    const logContext = {\n      deliveryId: params.deliveryId,\n      installationId,\n      connectionId: connection.id,\n      workspaceId: connection.workspaceId,\n      lifecycleStatus: connection.lifecycleStatus,\n    };\n    // `disabled` is an expected steady state; only `error` is anomalous.\n    if (connection.lifecycleStatus === 'error') {\n      logger().warn(logContext, 'github webhook: connection in error state, dropping');\n    } else {\n      logger().info(logContext, 'github webhook: connection disabled, dropping');\n    }\n    await params.recordDeliveryOnly({\n      tx: params.tx,\n      provider: GITHUB_SOURCE,\n      deliveryId: params.deliveryId,\n    });\n    return withInstallationTokenCleanup(\n      {outcome: 'inactive-connection'},\n      params.event,\n      action,\n      connection.workspaceId,\n      installationId,\n    );\n  }\n\n  if (params.event === 'push') {\n    const validated = githubPushPayloadSchema.safeParse(params.payload);\n    if (!validated.success) {\n      logger().warn(\n        {deliveryId: params.deliveryId, issues: validated.error.issues},\n        'github webhook push payload failed schema validation; publishing generic envelope only',\n      );\n      return publishGithubEnvelopeOnly({\n        tx: params.tx,\n        deliveryId: params.deliveryId,\n        payload: params.payload,\n        publishIntegrationEventReceived: params.publishIntegrationEventReceived,\n        connection,\n        event: 'push',\n      });\n    }\n\n    return publishGithubPush({\n      ...params,\n      eventPayload: validated.data,\n      rawPayload: params.payload,\n      connection,\n    });\n  }\n\n  const eventName = action ? `${params.event}.${action}` : params.event;\n  const result = await publishGithubEnvelopeOnly({\n    tx: params.tx,\n    deliveryId: params.deliveryId,\n    payload: params.payload,\n    publishIntegrationEventReceived: params.publishIntegrationEventReceived,\n    connection,\n    event: eventName,\n  });\n  return withInstallationTokenCleanup(\n    result,\n    params.event,\n    action,\n    connection.workspaceId,\n    installationId,\n  );\n}\n\nfunction shouldDeleteInstallationTokenSecret(event: string, action: string | undefined): boolean {\n  return event === 'installation' && (action === 'deleted' || action === 'suspend');\n}\n\nfunction withInstallationTokenCleanup(\n  result: HandleGithubEventResult,\n  event: string,\n  action: string | undefined,\n  workspaceId: string,\n  installationId: number,\n): HandleGithubEventResult {\n  if (!shouldDeleteInstallationTokenSecret(event, action)) return result;\n  return {...result, installationTokenCleanup: {workspaceId, installationId}};\n}\n\nasync function publishGithubPush(params: {\n  tx: IntegrationTx;\n  deliveryId: string;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  eventPayload: GithubPushPayloadDto;\n  rawPayload: unknown;\n  connection: {\n    id: string;\n    workspaceId: string;\n    slug: string;\n    displayName: string;\n  };\n}): Promise<{outcome: HandleGithubEventOutcome}> {\n  if (isBranchDeletion(params.eventPayload.after)) {\n    const result = await params.publishIntegrationEventReceived({\n      tx: params.tx,\n      event: {\n        provider: GITHUB_SOURCE,\n        source: params.connection.slug,\n        event: 'push',\n        workspaceId: params.connection.workspaceId,\n        connectionId: params.connection.id,\n        connectionName: params.connection.displayName,\n        deliveryId: params.deliveryId,\n        receivedAt: new Date().toISOString(),\n        payload: params.rawPayload,\n      },\n    });\n    return {\n      outcome: result.published ? 'published-push-envelope-only' : 'duplicate-push-envelope-only',\n    };\n  }\n\n  const ref = stripRefsHeads(params.eventPayload.ref);\n  const defaultBranch = params.eventPayload.repository.default_branch;\n  const push: SourcePushPayload = {\n    externalRepositoryId: buildProviderRepositoryId(\n      GITHUB_SOURCE,\n      String(params.eventPayload.repository.id),\n    ),\n    ref,\n    headCommitSha: params.eventPayload.after,\n    defaultBranch,\n    isDefaultBranch: ref === defaultBranch,\n  };\n  const result = await params.publishSourcePush({\n    tx: params.tx,\n    provider: GITHUB_SOURCE,\n    source: params.connection.slug,\n    workspaceId: params.connection.workspaceId,\n    connectionId: params.connection.id,\n    connectionName: params.connection.displayName,\n    deliveryId: params.deliveryId,\n    receivedAt: new Date().toISOString(),\n    rawPayload: params.rawPayload,\n    push,\n  });\n\n  return {outcome: result.published ? 'published' : 'duplicate'};\n}\n\nasync function publishGithubEnvelopeOnly(params: {\n  tx: IntegrationTx;\n  deliveryId: string;\n  payload: unknown;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  connection: {id: string; workspaceId: string; slug: string; displayName: string};\n  event: string;\n}): Promise<{outcome: HandleGithubEventOutcome}> {\n  const result = await params.publishIntegrationEventReceived({\n    tx: params.tx,\n    event: {\n      provider: GITHUB_SOURCE,\n      source: params.connection.slug,\n      event: params.event,\n      workspaceId: params.connection.workspaceId,\n      connectionId: params.connection.id,\n      connectionName: params.connection.displayName,\n      deliveryId: params.deliveryId,\n      receivedAt: new Date().toISOString(),\n      payload: params.payload,\n    },\n  });\n  return {outcome: result.published ? 'published-envelope' : 'duplicate-envelope'};\n}\n\nfunction stripRefsHeads(ref: string): string {\n  return ref.startsWith(REFS_HEADS_PREFIX) ? ref.slice(REFS_HEADS_PREFIX.length) : ref;\n}\n"],"names":["buildProviderRepositoryId","githubPushPayloadSchema","githubWebhookActionSchema","githubWebhookInstallationSchema","logger","getGithubInstallationByInstallationId","REFS_HEADS_PREFIX","GITHUB_SOURCE","DELETED_BRANCH_SHA","repeat","isBranchDeletion","after","handleGithubEvent","params","actionEnvelope","safeParse","payload","action","success","data","undefined","installationEnvelope","installationId","installation","id","recordDeliveryOnly","tx","provider","deliveryId","outcome","String","warn","connection","getIntegrationConnectionById","connectionId","lifecycleStatus","logContext","workspaceId","info","withInstallationTokenCleanup","event","validated","issues","error","publishGithubEnvelopeOnly","publishIntegrationEventReceived","publishGithubPush","eventPayload","rawPayload","eventName","result","shouldDeleteInstallationTokenSecret","installationTokenCleanup","source","slug","connectionName","displayName","receivedAt","Date","toISOString","published","ref","stripRefsHeads","defaultBranch","repository","default_branch","push","externalRepositoryId","headCommitSha","isDefaultBranch","publishSourcePush","startsWith","slice","length"],"mappings":"AAAA,SACEA,yBAAyB,QAOpB,oCAAoC;AAC3C,SAEEC,uBAAuB,EACvBC,yBAAyB,EACzBC,+BAA+B,QAC1B,sCAAsC;AAC7C,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,qCAAqC,QAAO,uBAAuB;AAE3E,MAAMC,oBAAoB;AAC1B,MAAMC,gBAAgB;AACtB,6FAA6F;AAC7F,MAAMC,qBAAqB,IAAIC,MAAM,CAAC;AA8BtC,SAASC,iBAAiBC,KAAa;IACrC,OAAOA,UAAUH;AACnB;AAEA,OAAO,eAAeI,kBACpBC,MAA+B;IAE/B,MAAMC,iBAAiBZ,0BAA0Ba,SAAS,CAACF,OAAOG,OAAO;IACzE,MAAMC,SAASH,eAAeI,OAAO,GAAGJ,eAAeK,IAAI,CAACF,MAAM,GAAGG;IACrE,MAAMC,uBAAuBlB,gCAAgCY,SAAS,CAACF,OAAOG,OAAO;IACrF,MAAMM,iBAAiBD,qBAAqBH,OAAO,GAC/CG,qBAAqBF,IAAI,CAACI,YAAY,EAAEC,KACxCJ;IACJ,IAAIE,mBAAmBF,WAAW;QAChC,MAAMP,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAoB;IACvC;IAEA,MAAMN,eAAe,MAAMlB,sCAAsCyB,OAAOR,iBAAiB;QACvFI,IAAIb,OAAOa,EAAE;IACf;IACA,IAAI,CAACH,cAAc;QACjBnB,SAAS2B,IAAI,CACX;YAACH,YAAYf,OAAOe,UAAU;YAAEN;QAAc,GAC9C;QAEF,MAAMT,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAsB;IACzC;IAEA,MAAMG,aAAa,MAAMnB,OAAOoB,4BAA4B,CAACV,aAAaW,YAAY,EAAE;QACtFR,IAAIb,OAAOa,EAAE;IACf;IACA,IAAI,CAACM,YAAY;QACf5B,SAAS2B,IAAI,CACX;YAACH,YAAYf,OAAOe,UAAU;YAAEN;YAAgBY,cAAcX,aAAaW,YAAY;QAAA,GACvF;QAEF,MAAMrB,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAO;YAACC,SAAS;QAAoB;IACvC;IAEA,IAAIG,WAAWG,eAAe,KAAK,UAAU;QAC3C,MAAMC,aAAa;YACjBR,YAAYf,OAAOe,UAAU;YAC7BN;YACAY,cAAcF,WAAWR,EAAE;YAC3Ba,aAAaL,WAAWK,WAAW;YACnCF,iBAAiBH,WAAWG,eAAe;QAC7C;QACA,qEAAqE;QACrE,IAAIH,WAAWG,eAAe,KAAK,SAAS;YAC1C/B,SAAS2B,IAAI,CAACK,YAAY;QAC5B,OAAO;YACLhC,SAASkC,IAAI,CAACF,YAAY;QAC5B;QACA,MAAMvB,OAAOY,kBAAkB,CAAC;YAC9BC,IAAIb,OAAOa,EAAE;YACbC,UAAUpB;YACVqB,YAAYf,OAAOe,UAAU;QAC/B;QACA,OAAOW,6BACL;YAACV,SAAS;QAAqB,GAC/BhB,OAAO2B,KAAK,EACZvB,QACAe,WAAWK,WAAW,EACtBf;IAEJ;IAEA,IAAIT,OAAO2B,KAAK,KAAK,QAAQ;QAC3B,MAAMC,YAAYxC,wBAAwBc,SAAS,CAACF,OAAOG,OAAO;QAClE,IAAI,CAACyB,UAAUvB,OAAO,EAAE;YACtBd,SAAS2B,IAAI,CACX;gBAACH,YAAYf,OAAOe,UAAU;gBAAEc,QAAQD,UAAUE,KAAK,CAACD,MAAM;YAAA,GAC9D;YAEF,OAAOE,0BAA0B;gBAC/BlB,IAAIb,OAAOa,EAAE;gBACbE,YAAYf,OAAOe,UAAU;gBAC7BZ,SAASH,OAAOG,OAAO;gBACvB6B,iCAAiChC,OAAOgC,+BAA+B;gBACvEb;gBACAQ,OAAO;YACT;QACF;QAEA,OAAOM,kBAAkB;YACvB,GAAGjC,MAAM;YACTkC,cAAcN,UAAUtB,IAAI;YAC5B6B,YAAYnC,OAAOG,OAAO;YAC1BgB;QACF;IACF;IAEA,MAAMiB,YAAYhC,SAAS,GAAGJ,OAAO2B,KAAK,CAAC,CAAC,EAAEvB,QAAQ,GAAGJ,OAAO2B,KAAK;IACrE,MAAMU,SAAS,MAAMN,0BAA0B;QAC7ClB,IAAIb,OAAOa,EAAE;QACbE,YAAYf,OAAOe,UAAU;QAC7BZ,SAASH,OAAOG,OAAO;QACvB6B,iCAAiChC,OAAOgC,+BAA+B;QACvEb;QACAQ,OAAOS;IACT;IACA,OAAOV,6BACLW,QACArC,OAAO2B,KAAK,EACZvB,QACAe,WAAWK,WAAW,EACtBf;AAEJ;AAEA,SAAS6B,oCAAoCX,KAAa,EAAEvB,MAA0B;IACpF,OAAOuB,UAAU,kBAAmBvB,CAAAA,WAAW,aAAaA,WAAW,SAAQ;AACjF;AAEA,SAASsB,6BACPW,MAA+B,EAC/BV,KAAa,EACbvB,MAA0B,EAC1BoB,WAAmB,EACnBf,cAAsB;IAEtB,IAAI,CAAC6B,oCAAoCX,OAAOvB,SAAS,OAAOiC;IAChE,OAAO;QAAC,GAAGA,MAAM;QAAEE,0BAA0B;YAACf;YAAaf;QAAc;IAAC;AAC5E;AAEA,eAAewB,kBAAkBjC,MAahC;IACC,IAAIH,iBAAiBG,OAAOkC,YAAY,CAACpC,KAAK,GAAG;QAC/C,MAAMuC,SAAS,MAAMrC,OAAOgC,+BAA+B,CAAC;YAC1DnB,IAAIb,OAAOa,EAAE;YACbc,OAAO;gBACLb,UAAUpB;gBACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;gBAC9Bd,OAAO;gBACPH,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;gBAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;gBAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;gBAC7C5B,YAAYf,OAAOe,UAAU;gBAC7B6B,YAAY,IAAIC,OAAOC,WAAW;gBAClC3C,SAASH,OAAOmC,UAAU;YAC5B;QACF;QACA,OAAO;YACLnB,SAASqB,OAAOU,SAAS,GAAG,iCAAiC;QAC/D;IACF;IAEA,MAAMC,MAAMC,eAAejD,OAAOkC,YAAY,CAACc,GAAG;IAClD,MAAME,gBAAgBlD,OAAOkC,YAAY,CAACiB,UAAU,CAACC,cAAc;IACnE,MAAMC,OAA0B;QAC9BC,sBAAsBnE,0BACpBO,eACAuB,OAAOjB,OAAOkC,YAAY,CAACiB,UAAU,CAACxC,EAAE;QAE1CqC;QACAO,eAAevD,OAAOkC,YAAY,CAACpC,KAAK;QACxCoD;QACAM,iBAAiBR,QAAQE;IAC3B;IACA,MAAMb,SAAS,MAAMrC,OAAOyD,iBAAiB,CAAC;QAC5C5C,IAAIb,OAAOa,EAAE;QACbC,UAAUpB;QACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;QAC9BjB,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;QAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;QAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;QAC7C5B,YAAYf,OAAOe,UAAU;QAC7B6B,YAAY,IAAIC,OAAOC,WAAW;QAClCX,YAAYnC,OAAOmC,UAAU;QAC7BkB;IACF;IAEA,OAAO;QAACrC,SAASqB,OAAOU,SAAS,GAAG,cAAc;IAAW;AAC/D;AAEA,eAAehB,0BAA0B/B,MAOxC;IACC,MAAMqC,SAAS,MAAMrC,OAAOgC,+BAA+B,CAAC;QAC1DnB,IAAIb,OAAOa,EAAE;QACbc,OAAO;YACLb,UAAUpB;YACV8C,QAAQxC,OAAOmB,UAAU,CAACsB,IAAI;YAC9Bd,OAAO3B,OAAO2B,KAAK;YACnBH,aAAaxB,OAAOmB,UAAU,CAACK,WAAW;YAC1CH,cAAcrB,OAAOmB,UAAU,CAACR,EAAE;YAClC+B,gBAAgB1C,OAAOmB,UAAU,CAACwB,WAAW;YAC7C5B,YAAYf,OAAOe,UAAU;YAC7B6B,YAAY,IAAIC,OAAOC,WAAW;YAClC3C,SAASH,OAAOG,OAAO;QACzB;IACF;IACA,OAAO;QAACa,SAASqB,OAAOU,SAAS,GAAG,uBAAuB;IAAoB;AACjF;AAEA,SAASE,eAAeD,GAAW;IACjC,OAAOA,IAAIU,UAAU,CAACjE,qBAAqBuD,IAAIW,KAAK,CAAClE,kBAAkBmE,MAAM,IAAIZ;AACnF"}

package/dist/index.d.ts

@@ -19,6 +19,8 @@ export { handleGithubCallback } from '#core/install.js';
 export { signGithubInstallState, verifyGithubInstallState } from '#core/state.js';
 export type { HandleGithubEventOutcome } from '#core/webhook.js';
 export { handleGithubEvent } from '#core/webhook.js';
+export type { CreateGithubWebhookProcessorOptions, GithubWebhookProcessor, } from '#core/webhook-processor.js';
+export { createGithubWebhookProcessor } from '#core/webhook-processor.js';
 export type { GithubInstallation, UpsertGithubInstallationParams } from '#db/installations.js';
 export { getGithubInstallationByConnectionId, getGithubInstallationByInstallationId, upsertGithubInstallation, } from '#db/installations.js';
 export { type CreateGithubE2eRoutesOptions, closeDb, createGithubE2eRoutes, db, migrationsPath };
@@ -49,5 +51,9 @@ export declare function createGithubIntegrationProvider(options: CreateGithubInt
         id: string;
     }): Promise<string | undefined>;
     routes: import("@shipfox/node-fastify").RouteGroup[];
+    webhookProcessors: {
+        routeIds: readonly ["github"];
+        processor: import("#core/webhook-processor.js").GithubWebhookProcessor;
+    }[];
 };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,8BAA8B,EAC9B,iCAAiC,EACjC,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAwB,KAAK,eAAe,EAAC,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,EAAC,+BAA+B,EAAC,MAAM,qCAAqC,CAAC;AAEzF,OAAO,EAAC,wBAAwB,EAAC,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAC,2BAA2B,EAAC,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAC,OAAO,EAAE,EAAE,EAAC,MAAM,WAAW,CAAC;AACtC,OAAO,EAAC,mCAAmC,EAAC,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAC,cAAc,EAAC,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,oCAAoC,EAE1C,MAAM,iCAAiC,CAAC;AAGzC,YAAY,EAAC,eAAe,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,qCAAqC,EACrC,KAAK,+BAA+B,GACrC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EACtC,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAC,8BAA8B,EAAC,MAAM,iBAAiB,CAAC;AAC/D,YAAY,EAAC,8BAA8B,EAAC,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAC,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAC,sBAAsB,EAAE,wBAAwB,EAAC,MAAM,gBAAgB,CAAC;AAChF,YAAY,EAAC,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AACnD,YAAY,EAAC,kBAAkB,EAAE,8BAA8B,EAAC,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAC,KAAK,4BAA4B,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,cAAc,EAAC,CAAC;AAE/F,MAAM,WAAW,sCACf,SAAQ,IAAI,CAAC,oCAAoC,EAAE,QAAQ,CAAC;IAC5D,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,mCAAmC,CAAC,EAAE,OAAO,mCAAmC,GAAG,SAAS,CAAC;IAC7F,aAAa,CAAC,EACV,CAAC,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACvE,SAAS,CAAC;IACd,UAAU,CAAC,EAAE;QAAC,aAAa,EAAE,+BAA+B,CAAA;KAAC,GAAG,SAAS,CAAC;CAC3E;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,sCAAsC;;;;;;;sCAgBnD;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;EAiCrF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,8BAA8B,EAC9B,iCAAiC,EACjC,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAwB,KAAK,eAAe,EAAC,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,EAAC,+BAA+B,EAAC,MAAM,qCAAqC,CAAC;AAEzF,OAAO,EAAC,wBAAwB,EAAC,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAC,2BAA2B,EAAC,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAC,OAAO,EAAE,EAAE,EAAC,MAAM,WAAW,CAAC;AACtC,OAAO,EAAC,mCAAmC,EAAC,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAC,cAAc,EAAC,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,EACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,oCAAoC,EAE1C,MAAM,iCAAiC,CAAC;AAGzC,YAAY,EAAC,eAAe,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,qCAAqC,EACrC,KAAK,+BAA+B,GACrC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EACtC,KAAK,4BAA4B,EACjC,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAC,8BAA8B,EAAC,MAAM,iBAAiB,CAAC;AAC/D,YAAY,EAAC,8BAA8B,EAAC,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAC,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAC,sBAAsB,EAAE,wBAAwB,EAAC,MAAM,gBAAgB,CAAC;AAChF,YAAY,EAAC,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AACnD,YAAY,EACV,mCAAmC,EACnC,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAC,4BAA4B,EAAC,MAAM,4BAA4B,CAAC;AACxE,YAAY,EAAC,kBAAkB,EAAE,8BAA8B,EAAC,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EACL,mCAAmC,EACnC,qCAAqC,EACrC,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAC,KAAK,4BAA4B,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,cAAc,EAAC,CAAC;AAE/F,MAAM,WAAW,sCACf,SAAQ,IAAI,CAAC,oCAAoC,EAAE,QAAQ,CAAC;IAC5D,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,+BAA+B,EAAE,iCAAiC,CAAC;IACnE,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,kBAAkB,EAAE,oBAAoB,CAAC;IACzC,4BAA4B,EAAE,8BAA8B,CAAC;IAC7D,mCAAmC,CAAC,EAAE,OAAO,mCAAmC,GAAG,SAAS,CAAC;IAC7F,aAAa,CAAC,EACV,CAAC,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACvE,SAAS,CAAC;IACd,UAAU,CAAC,EAAE;QAAC,aAAa,EAAE,+BAA+B,CAAA;KAAC,GAAG,SAAS,CAAC;CAC3E;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,sCAAsC;;;;;;;sCA4BnD;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;;;;;EA+BrF"}

package/dist/index.js

@@ -2,6 +2,7 @@ import { createGithubApiClient } from '#api/client.js';
 import { deleteGithubInstallationTokenSecret } from '#api/installation-token-provider.js';
 import { GithubAgentToolsProvider } from '#core/agent-tools.js';
 import { GithubSourceControlProvider } from '#core/source-control.js';
+import { createGithubWebhookProcessor } from '#core/webhook-processor.js';
 import { closeDb, db } from '#db/db.js';
 import { getGithubInstallationByConnectionId } from '#db/installations.js';
 import { migrationsPath } from '#db/migrations.js';
@@ -15,12 +16,22 @@ export { GithubIntegrationProviderError } from '#core/errors.js';
 export { handleGithubCallback } from '#core/install.js';
 export { signGithubInstallState, verifyGithubInstallState } from '#core/state.js';
 export { handleGithubEvent } from '#core/webhook.js';
+export { createGithubWebhookProcessor } from '#core/webhook-processor.js';
 export { getGithubInstallationByConnectionId, getGithubInstallationByInstallationId, upsertGithubInstallation } from '#db/installations.js';
 export { closeDb, createGithubE2eRoutes, db, migrationsPath };
 export function createGithubIntegrationProvider(options) {
     const github = options.github ?? createGithubApiClient();
     const getInstallationByConnectionId = options.getGithubInstallationByConnectionId ?? getGithubInstallationByConnectionId;
     const deleteSecrets = options.deleteSecrets;
+    const deleteInstallationTokenSecret = deleteSecrets ? (params)=>deleteGithubInstallationTokenSecret({
+            workspaceId: params.workspaceId,
+            installationId: params.installationId,
+            deleteSecrets
+        }) : undefined;
+    const webhookProcessor = createGithubWebhookProcessor({
+        ...options,
+        deleteInstallationTokenSecret
+    });
     return {
         provider: 'github',
         displayName: 'GitHub',
@@ -45,7 +56,10 @@ export function createGithubIntegrationProvider(options) {
             createGithubIntegrationRoutes({
                 github,
                 getExistingGithubConnection: options.getExistingGithubConnection,
-                connectGithubInstallation: options.connectGithubInstallation
+                connectGithubInstallation: options.connectGithubInstallation,
+                ...options.requireActiveWorkspaceMembership ? {
+                    requireActiveWorkspaceMembership: options.requireActiveWorkspaceMembership
+                } : {}
             }),
             createGithubWebhookRoutes({
                 coreDb: options.coreDb,
@@ -53,12 +67,17 @@ export function createGithubIntegrationProvider(options) {
                 publishSourcePush: options.publishSourcePush,
                 recordDeliveryOnly: options.recordDeliveryOnly,
                 getIntegrationConnectionById: options.getIntegrationConnectionById,
-                deleteInstallationTokenSecret: deleteSecrets ? (params)=>deleteGithubInstallationTokenSecret({
-                        workspaceId: params.workspaceId,
-                        installationId: params.installationId,
-                        deleteSecrets
-                    }) : undefined
+                deleteInstallationTokenSecret,
+                processor: webhookProcessor
             })
+        ],
+        webhookProcessors: [
+            {
+                routeIds: [
+                    'github'
+                ],
+                processor: webhookProcessor
+            }
         ]
     };
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  GetIntegrationConnectionByIdFn,\n  PublishIntegrationEventReceivedFn,\n  PublishSourcePushFn,\n  RecordDeliveryOnlyFn,\n} from '@shipfox/api-integration-core-dto';\nimport type {NodePgDatabase} from 'drizzle-orm/node-postgres';\nimport {createGithubApiClient, type GithubApiClient} from '#api/client.js';\nimport type {GithubInstallationTokenProvider} from '#api/installation-token-provider.js';\nimport {deleteGithubInstallationTokenSecret} from '#api/installation-token-provider.js';\nimport {GithubAgentToolsProvider} from '#core/agent-tools.js';\nimport {GithubSourceControlProvider} from '#core/source-control.js';\nimport {closeDb, db} from '#db/db.js';\nimport {getGithubInstallationByConnectionId} from '#db/installations.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {\n  type CreateGithubE2eRoutesOptions,\n  createGithubE2eRoutes,\n} from '#presentation/e2eRoutes/index.js';\nimport {\n  type CreateGithubIntegrationRoutesOptions,\n  createGithubIntegrationRoutes,\n} from '#presentation/routes/install.js';\nimport {createGithubWebhookRoutes} from '#presentation/routes/webhooks.js';\n\nexport type {GithubApiClient} from '#api/client.js';\nexport {\n  encodeInstallationTokenEnvelope,\n  githubInstallationTokenNamespace,\n} from '#api/installation-token-envelope.js';\nexport {\n  createGithubInstallationTokenProvider,\n  type GithubInstallationTokenProvider,\n} from '#api/installation-token-provider.js';\nexport {\n  type GithubAgentToolCatalogEntry,\n  type GithubAgentToolCategory,\n  type GithubAgentToolId,\n  type GithubAgentToolPermission,\n  type GithubAgentToolPermissionAccess,\n  type GithubAgentToolRequiredPermission,\n  type GithubAgentToolRequiredScope,\n  GithubAgentToolsProvider,\n  githubAgentToolCatalog,\n} from '#core/agent-tools.js';\nexport {GithubIntegrationProviderError} from '#core/errors.js';\nexport type {ConnectGithubInstallationInput} from '#core/install.js';\nexport {handleGithubCallback} from '#core/install.js';\nexport {signGithubInstallState, verifyGithubInstallState} from '#core/state.js';\nexport type {HandleGithubEventOutcome} from '#core/webhook.js';\nexport {handleGithubEvent} from '#core/webhook.js';\nexport type {GithubInstallation, UpsertGithubInstallationParams} from '#db/installations.js';\nexport {\n  getGithubInstallationByConnectionId,\n  getGithubInstallationByInstallationId,\n  upsertGithubInstallation,\n} from '#db/installations.js';\nexport {type CreateGithubE2eRoutesOptions, closeDb, createGithubE2eRoutes, db, migrationsPath};\n\nexport interface CreateGithubIntegrationProviderOptions\n  extends Omit<CreateGithubIntegrationRoutesOptions, 'github'> {\n  github?: GithubApiClient | undefined;\n  coreDb: () => NodePgDatabase<Record<string, unknown>>;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n  getGithubInstallationByConnectionId?: typeof getGithubInstallationByConnectionId | undefined;\n  deleteSecrets?:\n    | ((params: {workspaceId: string; namespace: string}) => Promise<number>)\n    | undefined;\n  agentTools?: {tokenProvider: GithubInstallationTokenProvider} | undefined;\n}\n\nexport function createGithubIntegrationProvider(options: CreateGithubIntegrationProviderOptions) {\n  const github = options.github ?? createGithubApiClient();\n  const getInstallationByConnectionId =\n    options.getGithubInstallationByConnectionId ?? getGithubInstallationByConnectionId;\n  const deleteSecrets = options.deleteSecrets;\n\n  return {\n    provider: 'github' as const,\n    displayName: 'GitHub',\n    adapters: {\n      source_control: new GithubSourceControlProvider(github),\n      agent_tools: new GithubAgentToolsProvider({\n        getInstallationByConnectionId: getInstallationByConnectionId,\n        tokenProvider: options.agentTools?.tokenProvider,\n      }),\n    },\n    async connectionExternalUrl(connection: {id: string}): Promise<string | undefined> {\n      const installation = await getInstallationByConnectionId(connection.id);\n      if (!installation) return undefined;\n      const installationId = encodeURIComponent(installation.installationId);\n      if (installation.accountType === 'Organization') {\n        const login = encodeURIComponent(installation.accountLogin);\n        return `https://github.com/organizations/${login}/settings/installations/${installationId}`;\n      }\n      return `https://github.com/settings/installations/${installationId}`;\n    },\n    routes: [\n      createGithubIntegrationRoutes({\n        github,\n        getExistingGithubConnection: options.getExistingGithubConnection,\n        connectGithubInstallation: options.connectGithubInstallation,\n      }),\n      createGithubWebhookRoutes({\n        coreDb: options.coreDb,\n        publishIntegrationEventReceived: options.publishIntegrationEventReceived,\n        publishSourcePush: options.publishSourcePush,\n        recordDeliveryOnly: options.recordDeliveryOnly,\n        getIntegrationConnectionById: options.getIntegrationConnectionById,\n        deleteInstallationTokenSecret: deleteSecrets\n          ? (params) =>\n              deleteGithubInstallationTokenSecret({\n                workspaceId: params.workspaceId,\n                installationId: params.installationId,\n                deleteSecrets,\n              })\n          : undefined,\n      }),\n    ],\n  };\n}\n"],"names":["createGithubApiClient","deleteGithubInstallationTokenSecret","GithubAgentToolsProvider","GithubSourceControlProvider","closeDb","db","getGithubInstallationByConnectionId","migrationsPath","createGithubE2eRoutes","createGithubIntegrationRoutes","createGithubWebhookRoutes","encodeInstallationTokenEnvelope","githubInstallationTokenNamespace","createGithubInstallationTokenProvider","githubAgentToolCatalog","GithubIntegrationProviderError","handleGithubCallback","signGithubInstallState","verifyGithubInstallState","handleGithubEvent","getGithubInstallationByInstallationId","upsertGithubInstallation","createGithubIntegrationProvider","options","github","getInstallationByConnectionId","deleteSecrets","provider","displayName","adapters","source_control","agent_tools","tokenProvider","agentTools","connectionExternalUrl","connection","installation","id","undefined","installationId","encodeURIComponent","accountType","login","accountLogin","routes","getExistingGithubConnection","connectGithubInstallation","coreDb","publishIntegrationEventReceived","publishSourcePush","recordDeliveryOnly","getIntegrationConnectionById","deleteInstallationTokenSecret","params","workspaceId"],"mappings":"AAOA,SAAQA,qBAAqB,QAA6B,iBAAiB;AAE3E,SAAQC,mCAAmC,QAAO,sCAAsC;AACxF,SAAQC,wBAAwB,QAAO,uBAAuB;AAC9D,SAAQC,2BAA2B,QAAO,0BAA0B;AACpE,SAAQC,OAAO,EAAEC,EAAE,QAAO,YAAY;AACtC,SAAQC,mCAAmC,QAAO,uBAAuB;AACzE,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAEEC,qBAAqB,QAChB,mCAAmC;AAC1C,SAEEC,6BAA6B,QACxB,kCAAkC;AACzC,SAAQC,yBAAyB,QAAO,mCAAmC;AAG3E,SACEC,+BAA+B,EAC/BC,gCAAgC,QAC3B,sCAAsC;AAC7C,SACEC,qCAAqC,QAEhC,sCAAsC;AAC7C,SAQEX,wBAAwB,EACxBY,sBAAsB,QACjB,uBAAuB;AAC9B,SAAQC,8BAA8B,QAAO,kBAAkB;AAE/D,SAAQC,oBAAoB,QAAO,mBAAmB;AACtD,SAAQC,sBAAsB,EAAEC,wBAAwB,QAAO,iBAAiB;AAEhF,SAAQC,iBAAiB,QAAO,mBAAmB;AAEnD,SACEb,mCAAmC,EACnCc,qCAAqC,EACrCC,wBAAwB,QACnB,uBAAuB;AAC9B,SAA2CjB,OAAO,EAAEI,qBAAqB,EAAEH,EAAE,EAAEE,cAAc,GAAE;AAiB/F,OAAO,SAASe,gCAAgCC,OAA+C;IAC7F,MAAMC,SAASD,QAAQC,MAAM,IAAIxB;IACjC,MAAMyB,gCACJF,QAAQjB,mCAAmC,IAAIA;IACjD,MAAMoB,gBAAgBH,QAAQG,aAAa;IAE3C,OAAO;QACLC,UAAU;QACVC,aAAa;QACbC,UAAU;YACRC,gBAAgB,IAAI3B,4BAA4BqB;YAChDO,aAAa,IAAI7B,yBAAyB;gBACxCuB,+BAA+BA;gBAC/BO,eAAeT,QAAQU,UAAU,EAAED;YACrC;QACF;QACA,MAAME,uBAAsBC,UAAwB;YAClD,MAAMC,eAAe,MAAMX,8BAA8BU,WAAWE,EAAE;YACtE,IAAI,CAACD,cAAc,OAAOE;YAC1B,MAAMC,iBAAiBC,mBAAmBJ,aAAaG,cAAc;YACrE,IAAIH,aAAaK,WAAW,KAAK,gBAAgB;gBAC/C,MAAMC,QAAQF,mBAAmBJ,aAAaO,YAAY;gBAC1D,OAAO,CAAC,iCAAiC,EAAED,MAAM,wBAAwB,EAAEH,gBAAgB;YAC7F;YACA,OAAO,CAAC,0CAA0C,EAAEA,gBAAgB;QACtE;QACAK,QAAQ;YACNnC,8BAA8B;gBAC5Be;gBACAqB,6BAA6BtB,QAAQsB,2BAA2B;gBAChEC,2BAA2BvB,QAAQuB,yBAAyB;YAC9D;YACApC,0BAA0B;gBACxBqC,QAAQxB,QAAQwB,MAAM;gBACtBC,iCAAiCzB,QAAQyB,+BAA+B;gBACxEC,mBAAmB1B,QAAQ0B,iBAAiB;gBAC5CC,oBAAoB3B,QAAQ2B,kBAAkB;gBAC9CC,8BAA8B5B,QAAQ4B,4BAA4B;gBAClEC,+BAA+B1B,gBAC3B,CAAC2B,SACCpD,oCAAoC;wBAClCqD,aAAaD,OAAOC,WAAW;wBAC/Bf,gBAAgBc,OAAOd,cAAc;wBACrCb;oBACF,KACFY;YACN;SACD;IACH;AACF"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  GetIntegrationConnectionByIdFn,\n  PublishIntegrationEventReceivedFn,\n  PublishSourcePushFn,\n  RecordDeliveryOnlyFn,\n} from '@shipfox/api-integration-core-dto';\nimport type {NodePgDatabase} from 'drizzle-orm/node-postgres';\nimport {createGithubApiClient, type GithubApiClient} from '#api/client.js';\nimport type {GithubInstallationTokenProvider} from '#api/installation-token-provider.js';\nimport {deleteGithubInstallationTokenSecret} from '#api/installation-token-provider.js';\nimport {GithubAgentToolsProvider} from '#core/agent-tools.js';\nimport {GithubSourceControlProvider} from '#core/source-control.js';\nimport {createGithubWebhookProcessor} from '#core/webhook-processor.js';\nimport {closeDb, db} from '#db/db.js';\nimport {getGithubInstallationByConnectionId} from '#db/installations.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {\n  type CreateGithubE2eRoutesOptions,\n  createGithubE2eRoutes,\n} from '#presentation/e2eRoutes/index.js';\nimport {\n  type CreateGithubIntegrationRoutesOptions,\n  createGithubIntegrationRoutes,\n} from '#presentation/routes/install.js';\nimport {createGithubWebhookRoutes} from '#presentation/routes/webhooks.js';\n\nexport type {GithubApiClient} from '#api/client.js';\nexport {\n  encodeInstallationTokenEnvelope,\n  githubInstallationTokenNamespace,\n} from '#api/installation-token-envelope.js';\nexport {\n  createGithubInstallationTokenProvider,\n  type GithubInstallationTokenProvider,\n} from '#api/installation-token-provider.js';\nexport {\n  type GithubAgentToolCatalogEntry,\n  type GithubAgentToolCategory,\n  type GithubAgentToolId,\n  type GithubAgentToolPermission,\n  type GithubAgentToolPermissionAccess,\n  type GithubAgentToolRequiredPermission,\n  type GithubAgentToolRequiredScope,\n  GithubAgentToolsProvider,\n  githubAgentToolCatalog,\n} from '#core/agent-tools.js';\nexport {GithubIntegrationProviderError} from '#core/errors.js';\nexport type {ConnectGithubInstallationInput} from '#core/install.js';\nexport {handleGithubCallback} from '#core/install.js';\nexport {signGithubInstallState, verifyGithubInstallState} from '#core/state.js';\nexport type {HandleGithubEventOutcome} from '#core/webhook.js';\nexport {handleGithubEvent} from '#core/webhook.js';\nexport type {\n  CreateGithubWebhookProcessorOptions,\n  GithubWebhookProcessor,\n} from '#core/webhook-processor.js';\nexport {createGithubWebhookProcessor} from '#core/webhook-processor.js';\nexport type {GithubInstallation, UpsertGithubInstallationParams} from '#db/installations.js';\nexport {\n  getGithubInstallationByConnectionId,\n  getGithubInstallationByInstallationId,\n  upsertGithubInstallation,\n} from '#db/installations.js';\nexport {type CreateGithubE2eRoutesOptions, closeDb, createGithubE2eRoutes, db, migrationsPath};\n\nexport interface CreateGithubIntegrationProviderOptions\n  extends Omit<CreateGithubIntegrationRoutesOptions, 'github'> {\n  github?: GithubApiClient | undefined;\n  coreDb: () => NodePgDatabase<Record<string, unknown>>;\n  publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;\n  publishSourcePush: PublishSourcePushFn;\n  recordDeliveryOnly: RecordDeliveryOnlyFn;\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn;\n  getGithubInstallationByConnectionId?: typeof getGithubInstallationByConnectionId | undefined;\n  deleteSecrets?:\n    | ((params: {workspaceId: string; namespace: string}) => Promise<number>)\n    | undefined;\n  agentTools?: {tokenProvider: GithubInstallationTokenProvider} | undefined;\n}\n\nexport function createGithubIntegrationProvider(options: CreateGithubIntegrationProviderOptions) {\n  const github = options.github ?? createGithubApiClient();\n  const getInstallationByConnectionId =\n    options.getGithubInstallationByConnectionId ?? getGithubInstallationByConnectionId;\n  const deleteSecrets = options.deleteSecrets;\n  const deleteInstallationTokenSecret = deleteSecrets\n    ? (params: {workspaceId: string; installationId: number}) =>\n        deleteGithubInstallationTokenSecret({\n          workspaceId: params.workspaceId,\n          installationId: params.installationId,\n          deleteSecrets,\n        })\n    : undefined;\n  const webhookProcessor = createGithubWebhookProcessor({\n    ...options,\n    deleteInstallationTokenSecret,\n  });\n\n  return {\n    provider: 'github' as const,\n    displayName: 'GitHub',\n    adapters: {\n      source_control: new GithubSourceControlProvider(github),\n      agent_tools: new GithubAgentToolsProvider({\n        getInstallationByConnectionId: getInstallationByConnectionId,\n        tokenProvider: options.agentTools?.tokenProvider,\n      }),\n    },\n    async connectionExternalUrl(connection: {id: string}): Promise<string | undefined> {\n      const installation = await getInstallationByConnectionId(connection.id);\n      if (!installation) return undefined;\n      const installationId = encodeURIComponent(installation.installationId);\n      if (installation.accountType === 'Organization') {\n        const login = encodeURIComponent(installation.accountLogin);\n        return `https://github.com/organizations/${login}/settings/installations/${installationId}`;\n      }\n      return `https://github.com/settings/installations/${installationId}`;\n    },\n    routes: [\n      createGithubIntegrationRoutes({\n        github,\n        getExistingGithubConnection: options.getExistingGithubConnection,\n        connectGithubInstallation: options.connectGithubInstallation,\n        ...(options.requireActiveWorkspaceMembership\n          ? {requireActiveWorkspaceMembership: options.requireActiveWorkspaceMembership}\n          : {}),\n      }),\n      createGithubWebhookRoutes({\n        coreDb: options.coreDb,\n        publishIntegrationEventReceived: options.publishIntegrationEventReceived,\n        publishSourcePush: options.publishSourcePush,\n        recordDeliveryOnly: options.recordDeliveryOnly,\n        getIntegrationConnectionById: options.getIntegrationConnectionById,\n        deleteInstallationTokenSecret,\n        processor: webhookProcessor,\n      }),\n    ],\n    webhookProcessors: [{routeIds: ['github'] as const, processor: webhookProcessor}],\n  };\n}\n"],"names":["createGithubApiClient","deleteGithubInstallationTokenSecret","GithubAgentToolsProvider","GithubSourceControlProvider","createGithubWebhookProcessor","closeDb","db","getGithubInstallationByConnectionId","migrationsPath","createGithubE2eRoutes","createGithubIntegrationRoutes","createGithubWebhookRoutes","encodeInstallationTokenEnvelope","githubInstallationTokenNamespace","createGithubInstallationTokenProvider","githubAgentToolCatalog","GithubIntegrationProviderError","handleGithubCallback","signGithubInstallState","verifyGithubInstallState","handleGithubEvent","getGithubInstallationByInstallationId","upsertGithubInstallation","createGithubIntegrationProvider","options","github","getInstallationByConnectionId","deleteSecrets","deleteInstallationTokenSecret","params","workspaceId","installationId","undefined","webhookProcessor","provider","displayName","adapters","source_control","agent_tools","tokenProvider","agentTools","connectionExternalUrl","connection","installation","id","encodeURIComponent","accountType","login","accountLogin","routes","getExistingGithubConnection","connectGithubInstallation","requireActiveWorkspaceMembership","coreDb","publishIntegrationEventReceived","publishSourcePush","recordDeliveryOnly","getIntegrationConnectionById","processor","webhookProcessors","routeIds"],"mappings":"AAOA,SAAQA,qBAAqB,QAA6B,iBAAiB;AAE3E,SAAQC,mCAAmC,QAAO,sCAAsC;AACxF,SAAQC,wBAAwB,QAAO,uBAAuB;AAC9D,SAAQC,2BAA2B,QAAO,0BAA0B;AACpE,SAAQC,4BAA4B,QAAO,6BAA6B;AACxE,SAAQC,OAAO,EAAEC,EAAE,QAAO,YAAY;AACtC,SAAQC,mCAAmC,QAAO,uBAAuB;AACzE,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAEEC,qBAAqB,QAChB,mCAAmC;AAC1C,SAEEC,6BAA6B,QACxB,kCAAkC;AACzC,SAAQC,yBAAyB,QAAO,mCAAmC;AAG3E,SACEC,+BAA+B,EAC/BC,gCAAgC,QAC3B,sCAAsC;AAC7C,SACEC,qCAAqC,QAEhC,sCAAsC;AAC7C,SAQEZ,wBAAwB,EACxBa,sBAAsB,QACjB,uBAAuB;AAC9B,SAAQC,8BAA8B,QAAO,kBAAkB;AAE/D,SAAQC,oBAAoB,QAAO,mBAAmB;AACtD,SAAQC,sBAAsB,EAAEC,wBAAwB,QAAO,iBAAiB;AAEhF,SAAQC,iBAAiB,QAAO,mBAAmB;AAKnD,SAAQhB,4BAA4B,QAAO,6BAA6B;AAExE,SACEG,mCAAmC,EACnCc,qCAAqC,EACrCC,wBAAwB,QACnB,uBAAuB;AAC9B,SAA2CjB,OAAO,EAAEI,qBAAqB,EAAEH,EAAE,EAAEE,cAAc,GAAE;AAiB/F,OAAO,SAASe,gCAAgCC,OAA+C;IAC7F,MAAMC,SAASD,QAAQC,MAAM,IAAIzB;IACjC,MAAM0B,gCACJF,QAAQjB,mCAAmC,IAAIA;IACjD,MAAMoB,gBAAgBH,QAAQG,aAAa;IAC3C,MAAMC,gCAAgCD,gBAClC,CAACE,SACC5B,oCAAoC;YAClC6B,aAAaD,OAAOC,WAAW;YAC/BC,gBAAgBF,OAAOE,cAAc;YACrCJ;QACF,KACFK;IACJ,MAAMC,mBAAmB7B,6BAA6B;QACpD,GAAGoB,OAAO;QACVI;IACF;IAEA,OAAO;QACLM,UAAU;QACVC,aAAa;QACbC,UAAU;YACRC,gBAAgB,IAAIlC,4BAA4BsB;YAChDa,aAAa,IAAIpC,yBAAyB;gBACxCwB,+BAA+BA;gBAC/Ba,eAAef,QAAQgB,UAAU,EAAED;YACrC;QACF;QACA,MAAME,uBAAsBC,UAAwB;YAClD,MAAMC,eAAe,MAAMjB,8BAA8BgB,WAAWE,EAAE;YACtE,IAAI,CAACD,cAAc,OAAOX;YAC1B,MAAMD,iBAAiBc,mBAAmBF,aAAaZ,cAAc;YACrE,IAAIY,aAAaG,WAAW,KAAK,gBAAgB;gBAC/C,MAAMC,QAAQF,mBAAmBF,aAAaK,YAAY;gBAC1D,OAAO,CAAC,iCAAiC,EAAED,MAAM,wBAAwB,EAAEhB,gBAAgB;YAC7F;YACA,OAAO,CAAC,0CAA0C,EAAEA,gBAAgB;QACtE;QACAkB,QAAQ;YACNvC,8BAA8B;gBAC5Be;gBACAyB,6BAA6B1B,QAAQ0B,2BAA2B;gBAChEC,2BAA2B3B,QAAQ2B,yBAAyB;gBAC5D,GAAI3B,QAAQ4B,gCAAgC,GACxC;oBAACA,kCAAkC5B,QAAQ4B,gCAAgC;gBAAA,IAC3E,CAAC,CAAC;YACR;YACAzC,0BAA0B;gBACxB0C,QAAQ7B,QAAQ6B,MAAM;gBACtBC,iCAAiC9B,QAAQ8B,+BAA+B;gBACxEC,mBAAmB/B,QAAQ+B,iBAAiB;gBAC5CC,oBAAoBhC,QAAQgC,kBAAkB;gBAC9CC,8BAA8BjC,QAAQiC,4BAA4B;gBAClE7B;gBACA8B,WAAWzB;YACb;SACD;QACD0B,mBAAmB;YAAC;gBAACC,UAAU;oBAAC;iBAAS;gBAAWF,WAAWzB;YAAgB;SAAE;IACnF;AACF"}

package/dist/presentation/routes/install.d.ts

@@ -8,6 +8,11 @@ export interface CreateGithubIntegrationRoutesOptions {
         installationId: string;
     }) => Promise<IntegrationConnection<'github'> | undefined>;
     connectGithubInstallation: (input: ConnectGithubInstallationInput) => Promise<IntegrationConnection<'github'>>;
+    requireActiveWorkspaceMembership?: (input: {
+        workspaceId: string;
+        userId: string;
+        memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;
+    }) => Promise<unknown>;
 }
-export declare function createGithubIntegrationRoutes({ github, getExistingGithubConnection, connectGithubInstallation, }: CreateGithubIntegrationRoutesOptions): RouteGroup;
+export declare function createGithubIntegrationRoutes({ github, getExistingGithubConnection, connectGithubInstallation, requireActiveWorkspaceMembership, }: CreateGithubIntegrationRoutesOptions): RouteGroup;
 //# sourceMappingURL=install.d.ts.map

package/dist/presentation/routes/install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/install.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mCAAmC,CAAC;AAQ7E,OAAO,EAAc,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAC,KAAK,8BAA8B,EAAuB,MAAM,kBAAkB,CAAC;AAK3F,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,eAAe,CAAC;IACxB,2BAA2B,EAAE,CAAC,KAAK,EAAE;QACnC,cAAc,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,CAAC;IAC3D,yBAAyB,EAAE,CACzB,KAAK,EAAE,8BAA8B,KAClC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;CAC/C;AAED,wBAAgB,6BAA6B,CAAC,EAC5C,MAAM,EACN,2BAA2B,EAC3B,yBAAyB,GAC1B,EAAE,oCAAoC,GAAG,UAAU,CA6DnD"}
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/install.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mCAAmC,CAAC;AAO7E,OAAO,EAAc,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AACnE,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAC,KAAK,8BAA8B,EAAuB,MAAM,kBAAkB,CAAC;AAK3F,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,eAAe,CAAC;IACxB,2BAA2B,EAAE,CAAC,KAAK,EAAE;QACnC,cAAc,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,CAAC;IAC3D,yBAAyB,EAAE,CACzB,KAAK,EAAE,8BAA8B,KAClC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,gCAAgC,CAAC,EAAE,CAAC,KAAK,EAAE;QACzC,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,aAAa,CAAC,OAAO,2BAA2B,EAAE,qBAAqB,CAAC,CAAC;KACvF,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAAC,EAC5C,MAAM,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,gCAAgC,GACjC,EAAE,oCAAoC,GAAG,UAAU,CA8DnD"}

package/dist/presentation/routes/install.js

@@ -1,13 +1,12 @@
 import { AUTH_USER, requireUserContext, requireWorkspaceAccess } from '@shipfox/api-auth-context';
 import { createGithubInstallBodySchema, createGithubInstallResponseSchema, githubCallbackQuerySchema, githubCallbackResponseSchema } from '@shipfox/api-integration-github-dto';
-import { requireWorkspaceMembership } from '@shipfox/api-workspaces';
 import { defineRoute } from '@shipfox/node-fastify';
 import { config } from '#config.js';
 import { handleGithubCallback } from '#core/install.js';
 import { signGithubInstallState } from '#core/state.js';
 import { toIntegrationConnectionDto } from '#presentation/dto/integrations.js';
 import { githubRouteErrorHandler } from './errors.js';
-export function createGithubIntegrationRoutes({ github, getExistingGithubConnection, connectGithubInstallation }) {
+export function createGithubIntegrationRoutes({ github, getExistingGithubConnection, connectGithubInstallation, requireActiveWorkspaceMembership }) {
     const createInstallRoute = defineRoute({
         method: 'POST',
         path: '/install',
@@ -58,7 +57,7 @@ export function createGithubIntegrationRoutes({ github, getExistingGithubConnect
                 state: request.query.state,
                 sessionUserId: actor.userId,
                 sessionMemberships: actor.memberships,
-                requireWorkspaceMembership,
+                requireWorkspaceMembership: requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck,
                 getExistingGithubConnection,
                 connectGithubInstallation
             });
@@ -73,5 +72,8 @@ export function createGithubIntegrationRoutes({ github, getExistingGithubConnect
         ]
     };
 }
+function unavailableWorkspaceMembershipCheck(_input) {
+    return Promise.reject(new Error('Workspaces inter-module client is not configured'));
+}
 
 //# sourceMappingURL=install.js.map

package/dist/presentation/routes/install.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/install.ts"],"sourcesContent":["import {AUTH_USER, requireUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';\nimport type {IntegrationConnection} from '@shipfox/api-integration-core-dto';\nimport {\n  createGithubInstallBodySchema,\n  createGithubInstallResponseSchema,\n  githubCallbackQuerySchema,\n  githubCallbackResponseSchema,\n} from '@shipfox/api-integration-github-dto';\nimport {requireWorkspaceMembership} from '@shipfox/api-workspaces';\nimport {defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {GithubApiClient} from '#api/client.js';\nimport {config} from '#config.js';\nimport {type ConnectGithubInstallationInput, handleGithubCallback} from '#core/install.js';\nimport {signGithubInstallState} from '#core/state.js';\nimport {toIntegrationConnectionDto} from '#presentation/dto/integrations.js';\nimport {githubRouteErrorHandler} from './errors.js';\n\nexport interface CreateGithubIntegrationRoutesOptions {\n  github: GithubApiClient;\n  getExistingGithubConnection: (input: {\n    installationId: string;\n  }) => Promise<IntegrationConnection<'github'> | undefined>;\n  connectGithubInstallation: (\n    input: ConnectGithubInstallationInput,\n  ) => Promise<IntegrationConnection<'github'>>;\n}\n\nexport function createGithubIntegrationRoutes({\n  github,\n  getExistingGithubConnection,\n  connectGithubInstallation,\n}: CreateGithubIntegrationRoutesOptions): RouteGroup {\n  const createInstallRoute = defineRoute({\n    method: 'POST',\n    path: '/install',\n    auth: AUTH_USER,\n    description: 'Create a GitHub App installation URL for a workspace.',\n    schema: {\n      body: createGithubInstallBodySchema,\n      response: {\n        200: createGithubInstallResponseSchema,\n      },\n    },\n    handler: (request) => {\n      const {workspace_id: workspaceId} = request.body;\n      const actor = requireUserContext(request);\n\n      requireWorkspaceAccess({request, workspaceId});\n      const state = signGithubInstallState({workspaceId, userId: actor.userId});\n      const installUrl = new URL(\n        `https://github.com/apps/${config.GITHUB_APP_SLUG}/installations/new`,\n      );\n      installUrl.searchParams.set('state', state);\n\n      return {install_url: installUrl.toString()};\n    },\n  });\n\n  const callbackApiRoute = defineRoute({\n    method: 'GET',\n    path: '/callback/api',\n    auth: AUTH_USER,\n    description: 'Handle the GitHub App installation callback.',\n    schema: {\n      querystring: githubCallbackQuerySchema,\n      response: {\n        200: githubCallbackResponseSchema,\n      },\n    },\n    errorHandler: githubRouteErrorHandler,\n    handler: async (request) => {\n      const actor = requireUserContext(request);\n      const connection = await handleGithubCallback({\n        github,\n        code: request.query.code,\n        installationId: request.query.installation_id,\n        state: request.query.state,\n        sessionUserId: actor.userId,\n        sessionMemberships: actor.memberships,\n        requireWorkspaceMembership,\n        getExistingGithubConnection,\n        connectGithubInstallation,\n      });\n\n      return toIntegrationConnectionDto(connection);\n    },\n  });\n\n  return {\n    prefix: '/integrations/github',\n    routes: [createInstallRoute, callbackApiRoute],\n  };\n}\n"],"names":["AUTH_USER","requireUserContext","requireWorkspaceAccess","createGithubInstallBodySchema","createGithubInstallResponseSchema","githubCallbackQuerySchema","githubCallbackResponseSchema","requireWorkspaceMembership","defineRoute","config","handleGithubCallback","signGithubInstallState","toIntegrationConnectionDto","githubRouteErrorHandler","createGithubIntegrationRoutes","github","getExistingGithubConnection","connectGithubInstallation","createInstallRoute","method","path","auth","description","schema","body","response","handler","request","workspace_id","workspaceId","actor","state","userId","installUrl","URL","GITHUB_APP_SLUG","searchParams","set","install_url","toString","callbackApiRoute","querystring","errorHandler","connection","code","query","installationId","installation_id","sessionUserId","sessionMemberships","memberships","prefix","routes"],"mappings":"AAAA,SAAQA,SAAS,EAAEC,kBAAkB,EAAEC,sBAAsB,QAAO,4BAA4B;AAEhG,SACEC,6BAA6B,EAC7BC,iCAAiC,EACjCC,yBAAyB,EACzBC,4BAA4B,QACvB,sCAAsC;AAC7C,SAAQC,0BAA0B,QAAO,0BAA0B;AACnE,SAAQC,WAAW,QAAwB,wBAAwB;AAEnE,SAAQC,MAAM,QAAO,aAAa;AAClC,SAA6CC,oBAAoB,QAAO,mBAAmB;AAC3F,SAAQC,sBAAsB,QAAO,iBAAiB;AACtD,SAAQC,0BAA0B,QAAO,oCAAoC;AAC7E,SAAQC,uBAAuB,QAAO,cAAc;AAYpD,OAAO,SAASC,8BAA8B,EAC5CC,MAAM,EACNC,2BAA2B,EAC3BC,yBAAyB,EACY;IACrC,MAAMC,qBAAqBV,YAAY;QACrCW,QAAQ;QACRC,MAAM;QACNC,MAAMrB;QACNsB,aAAa;QACbC,QAAQ;YACNC,MAAMrB;YACNsB,UAAU;gBACR,KAAKrB;YACP;QACF;QACAsB,SAAS,CAACC;YACR,MAAM,EAACC,cAAcC,WAAW,EAAC,GAAGF,QAAQH,IAAI;YAChD,MAAMM,QAAQ7B,mBAAmB0B;YAEjCzB,uBAAuB;gBAACyB;gBAASE;YAAW;YAC5C,MAAME,QAAQpB,uBAAuB;gBAACkB;gBAAaG,QAAQF,MAAME,MAAM;YAAA;YACvE,MAAMC,aAAa,IAAIC,IACrB,CAAC,wBAAwB,EAAEzB,OAAO0B,eAAe,CAAC,kBAAkB,CAAC;YAEvEF,WAAWG,YAAY,CAACC,GAAG,CAAC,SAASN;YAErC,OAAO;gBAACO,aAAaL,WAAWM,QAAQ;YAAE;QAC5C;IACF;IAEA,MAAMC,mBAAmBhC,YAAY;QACnCW,QAAQ;QACRC,MAAM;QACNC,MAAMrB;QACNsB,aAAa;QACbC,QAAQ;YACNkB,aAAapC;YACboB,UAAU;gBACR,KAAKnB;YACP;QACF;QACAoC,cAAc7B;QACda,SAAS,OAAOC;YACd,MAAMG,QAAQ7B,mBAAmB0B;YACjC,MAAMgB,aAAa,MAAMjC,qBAAqB;gBAC5CK;gBACA6B,MAAMjB,QAAQkB,KAAK,CAACD,IAAI;gBACxBE,gBAAgBnB,QAAQkB,KAAK,CAACE,eAAe;gBAC7ChB,OAAOJ,QAAQkB,KAAK,CAACd,KAAK;gBAC1BiB,eAAelB,MAAME,MAAM;gBAC3BiB,oBAAoBnB,MAAMoB,WAAW;gBACrC3C;gBACAS;gBACAC;YACF;YAEA,OAAOL,2BAA2B+B;QACpC;IACF;IAEA,OAAO;QACLQ,QAAQ;QACRC,QAAQ;YAAClC;YAAoBsB;SAAiB;IAChD;AACF"}
+{"version":3,"sources":["../../../src/presentation/routes/install.ts"],"sourcesContent":["import {AUTH_USER, requireUserContext, requireWorkspaceAccess} from '@shipfox/api-auth-context';\nimport type {IntegrationConnection} from '@shipfox/api-integration-core-dto';\nimport {\n  createGithubInstallBodySchema,\n  createGithubInstallResponseSchema,\n  githubCallbackQuerySchema,\n  githubCallbackResponseSchema,\n} from '@shipfox/api-integration-github-dto';\nimport {defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport type {GithubApiClient} from '#api/client.js';\nimport {config} from '#config.js';\nimport {type ConnectGithubInstallationInput, handleGithubCallback} from '#core/install.js';\nimport {signGithubInstallState} from '#core/state.js';\nimport {toIntegrationConnectionDto} from '#presentation/dto/integrations.js';\nimport {githubRouteErrorHandler} from './errors.js';\n\nexport interface CreateGithubIntegrationRoutesOptions {\n  github: GithubApiClient;\n  getExistingGithubConnection: (input: {\n    installationId: string;\n  }) => Promise<IntegrationConnection<'github'> | undefined>;\n  connectGithubInstallation: (\n    input: ConnectGithubInstallationInput,\n  ) => Promise<IntegrationConnection<'github'>>;\n  requireActiveWorkspaceMembership?: (input: {\n    workspaceId: string;\n    userId: string;\n    memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;\n  }) => Promise<unknown>;\n}\n\nexport function createGithubIntegrationRoutes({\n  github,\n  getExistingGithubConnection,\n  connectGithubInstallation,\n  requireActiveWorkspaceMembership,\n}: CreateGithubIntegrationRoutesOptions): RouteGroup {\n  const createInstallRoute = defineRoute({\n    method: 'POST',\n    path: '/install',\n    auth: AUTH_USER,\n    description: 'Create a GitHub App installation URL for a workspace.',\n    schema: {\n      body: createGithubInstallBodySchema,\n      response: {\n        200: createGithubInstallResponseSchema,\n      },\n    },\n    handler: (request) => {\n      const {workspace_id: workspaceId} = request.body;\n      const actor = requireUserContext(request);\n\n      requireWorkspaceAccess({request, workspaceId});\n      const state = signGithubInstallState({workspaceId, userId: actor.userId});\n      const installUrl = new URL(\n        `https://github.com/apps/${config.GITHUB_APP_SLUG}/installations/new`,\n      );\n      installUrl.searchParams.set('state', state);\n\n      return {install_url: installUrl.toString()};\n    },\n  });\n\n  const callbackApiRoute = defineRoute({\n    method: 'GET',\n    path: '/callback/api',\n    auth: AUTH_USER,\n    description: 'Handle the GitHub App installation callback.',\n    schema: {\n      querystring: githubCallbackQuerySchema,\n      response: {\n        200: githubCallbackResponseSchema,\n      },\n    },\n    errorHandler: githubRouteErrorHandler,\n    handler: async (request) => {\n      const actor = requireUserContext(request);\n      const connection = await handleGithubCallback({\n        github,\n        code: request.query.code,\n        installationId: request.query.installation_id,\n        state: request.query.state,\n        sessionUserId: actor.userId,\n        sessionMemberships: actor.memberships,\n        requireWorkspaceMembership:\n          requireActiveWorkspaceMembership ?? unavailableWorkspaceMembershipCheck,\n        getExistingGithubConnection,\n        connectGithubInstallation,\n      });\n\n      return toIntegrationConnectionDto(connection);\n    },\n  });\n\n  return {\n    prefix: '/integrations/github',\n    routes: [createInstallRoute, callbackApiRoute],\n  };\n}\n\nfunction unavailableWorkspaceMembershipCheck(_input: {\n  workspaceId: string;\n  userId: string;\n  memberships: ReadonlyArray<import('@shipfox/api-auth-context').UserContextMembership>;\n}): Promise<never> {\n  return Promise.reject(new Error('Workspaces inter-module client is not configured'));\n}\n"],"names":["AUTH_USER","requireUserContext","requireWorkspaceAccess","createGithubInstallBodySchema","createGithubInstallResponseSchema","githubCallbackQuerySchema","githubCallbackResponseSchema","defineRoute","config","handleGithubCallback","signGithubInstallState","toIntegrationConnectionDto","githubRouteErrorHandler","createGithubIntegrationRoutes","github","getExistingGithubConnection","connectGithubInstallation","requireActiveWorkspaceMembership","createInstallRoute","method","path","auth","description","schema","body","response","handler","request","workspace_id","workspaceId","actor","state","userId","installUrl","URL","GITHUB_APP_SLUG","searchParams","set","install_url","toString","callbackApiRoute","querystring","errorHandler","connection","code","query","installationId","installation_id","sessionUserId","sessionMemberships","memberships","requireWorkspaceMembership","unavailableWorkspaceMembershipCheck","prefix","routes","_input","Promise","reject","Error"],"mappings":"AAAA,SAAQA,SAAS,EAAEC,kBAAkB,EAAEC,sBAAsB,QAAO,4BAA4B;AAEhG,SACEC,6BAA6B,EAC7BC,iCAAiC,EACjCC,yBAAyB,EACzBC,4BAA4B,QACvB,sCAAsC;AAC7C,SAAQC,WAAW,QAAwB,wBAAwB;AAEnE,SAAQC,MAAM,QAAO,aAAa;AAClC,SAA6CC,oBAAoB,QAAO,mBAAmB;AAC3F,SAAQC,sBAAsB,QAAO,iBAAiB;AACtD,SAAQC,0BAA0B,QAAO,oCAAoC;AAC7E,SAAQC,uBAAuB,QAAO,cAAc;AAiBpD,OAAO,SAASC,8BAA8B,EAC5CC,MAAM,EACNC,2BAA2B,EAC3BC,yBAAyB,EACzBC,gCAAgC,EACK;IACrC,MAAMC,qBAAqBX,YAAY;QACrCY,QAAQ;QACRC,MAAM;QACNC,MAAMrB;QACNsB,aAAa;QACbC,QAAQ;YACNC,MAAMrB;YACNsB,UAAU;gBACR,KAAKrB;YACP;QACF;QACAsB,SAAS,CAACC;YACR,MAAM,EAACC,cAAcC,WAAW,EAAC,GAAGF,QAAQH,IAAI;YAChD,MAAMM,QAAQ7B,mBAAmB0B;YAEjCzB,uBAAuB;gBAACyB;gBAASE;YAAW;YAC5C,MAAME,QAAQrB,uBAAuB;gBAACmB;gBAAaG,QAAQF,MAAME,MAAM;YAAA;YACvE,MAAMC,aAAa,IAAIC,IACrB,CAAC,wBAAwB,EAAE1B,OAAO2B,eAAe,CAAC,kBAAkB,CAAC;YAEvEF,WAAWG,YAAY,CAACC,GAAG,CAAC,SAASN;YAErC,OAAO;gBAACO,aAAaL,WAAWM,QAAQ;YAAE;QAC5C;IACF;IAEA,MAAMC,mBAAmBjC,YAAY;QACnCY,QAAQ;QACRC,MAAM;QACNC,MAAMrB;QACNsB,aAAa;QACbC,QAAQ;YACNkB,aAAapC;YACboB,UAAU;gBACR,KAAKnB;YACP;QACF;QACAoC,cAAc9B;QACdc,SAAS,OAAOC;YACd,MAAMG,QAAQ7B,mBAAmB0B;YACjC,MAAMgB,aAAa,MAAMlC,qBAAqB;gBAC5CK;gBACA8B,MAAMjB,QAAQkB,KAAK,CAACD,IAAI;gBACxBE,gBAAgBnB,QAAQkB,KAAK,CAACE,eAAe;gBAC7ChB,OAAOJ,QAAQkB,KAAK,CAACd,KAAK;gBAC1BiB,eAAelB,MAAME,MAAM;gBAC3BiB,oBAAoBnB,MAAMoB,WAAW;gBACrCC,4BACElC,oCAAoCmC;gBACtCrC;gBACAC;YACF;YAEA,OAAOL,2BAA2BgC;QACpC;IACF;IAEA,OAAO;QACLU,QAAQ;QACRC,QAAQ;YAACpC;YAAoBsB;SAAiB;IAChD;AACF;AAEA,SAASY,oCAAoCG,MAI5C;IACC,OAAOC,QAAQC,MAAM,CAAC,IAAIC,MAAM;AAClC"}

package/dist/presentation/routes/webhooks.d.ts

@@ -1,6 +1,7 @@
 import type { GetIntegrationConnectionByIdFn, PublishIntegrationEventReceivedFn, PublishSourcePushFn, RecordDeliveryOnlyFn } from '@shipfox/api-integration-core-dto';
 import { type RouteGroup } from '@shipfox/node-fastify';
 import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import { type GithubWebhookProcessor } from '#core/webhook-processor.js';
 export interface CreateGithubWebhookRoutesOptions {
     coreDb: () => NodePgDatabase<Record<string, unknown>>;
     publishIntegrationEventReceived: PublishIntegrationEventReceivedFn;
@@ -11,6 +12,7 @@ export interface CreateGithubWebhookRoutesOptions {
         workspaceId: string;
         installationId: number;
     }) => Promise<unknown>) | undefined;
+    processor?: GithubWebhookProcessor | undefined;
 }
 export declare function createGithubWebhookRoutes(options: CreateGithubWebhookRoutesOptions): RouteGroup;
 //# sourceMappingURL=webhooks.d.ts.map