@snappedly-tools/shipyard 0.7.0 → 0.9.0

package/dist/integrations/github.js

@@ -0,0 +1,1049 @@
+import { createWorkBrief, parseRepositoryPolicy, processHumanReviewDecision, runTriage, parseWorkBrief } from '../chunk-NQRFVKCU.js';
+import { createHmac, timingSafeEqual, createHash } from 'crypto';
+
+var asBytes = (value) => typeof value === "string" ? Buffer.from(value, "utf8") : Buffer.from(value);
+var verifyGitHubWebhookSignature = (input) => {
+  const expected = createHmac("sha256", asBytes(input.secret)).update(asBytes(input.body)).digest();
+  const signature = input.signature ?? "";
+  const prefix = "sha256=";
+  const encoded = signature.startsWith(prefix) ? signature.slice(prefix.length) : "";
+  const isHexDigest = /^[0-9a-f]{64}$/i.test(encoded);
+  const candidate = isHexDigest ? Buffer.from(encoded, "hex") : Buffer.alloc(expected.length);
+  return timingSafeEqual(expected, candidate) && isHexDigest;
+};
+
+// src/integrations/github/store.ts
+var InMemoryGitHubStore = class {
+  deliveries = /* @__PURE__ */ new Map();
+  trackedPullRequests = /* @__PURE__ */ new Map();
+  async recordDeliveryIfAbsent(delivery) {
+    const existing = this.deliveries.get(delivery.deliveryId);
+    if (existing !== void 0) {
+      return { delivery: existing, inserted: false };
+    }
+    this.deliveries.set(delivery.deliveryId, delivery);
+    return { delivery, inserted: true };
+  }
+  async getDelivery(deliveryId) {
+    return this.deliveries.get(deliveryId);
+  }
+  async updateDelivery(delivery) {
+    const existing = this.deliveries.get(delivery.deliveryId);
+    if (existing === void 0) {
+      throw new Error(`GitHub delivery ${delivery.deliveryId} does not exist`);
+    }
+    this.deliveries.set(delivery.deliveryId, delivery);
+  }
+  async findTrackedPullRequest(repository, pullRequestNumber2) {
+    return this.trackedPullRequests.get(
+      `${repository.toLowerCase()}\0${pullRequestNumber2}`
+    );
+  }
+  async saveTrackedPullRequest(pullRequest) {
+    this.trackedPullRequests.set(
+      `${pullRequest.repository.toLowerCase()}\0${pullRequest.pullRequestNumber}`,
+      pullRequest
+    );
+  }
+};
+
+// src/integrations/github/integration.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var record = (value) => isRecord(value) ? value : void 0;
+var stringValue = (value, fallback = "") => typeof value === "string" ? value : fallback;
+var requiredStringValue = (value) => {
+  const result2 = stringValue(value).trim();
+  return result2.length === 0 ? void 0 : result2;
+};
+var numberValue = (value) => typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+var header = (headers, name) => {
+  const wanted = name.toLowerCase();
+  const key = Object.keys(headers).find(
+    (candidate) => candidate.toLowerCase() === wanted
+  );
+  return key === void 0 ? void 0 : headers[key];
+};
+var bodyBytes = (body) => typeof body === "string" ? new TextEncoder().encode(body) : body;
+var bodyText = (body) => typeof body === "string" ? body : new TextDecoder().decode(body);
+var payloadHash = (body) => createHash("sha256").update(bodyBytes(body)).digest("hex");
+var MAX_WEBHOOK_BODY_BYTES = 10 * 1024 * 1024;
+var parseBody = (body) => {
+  try {
+    return JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+};
+var actor = (value) => {
+  const candidate = record(value);
+  return {
+    login: stringValue(candidate?.login, "unknown"),
+    type: stringValue(candidate?.type) || void 0
+  };
+};
+var repositoryName = (payload) => requiredStringValue(record(payload.repository)?.full_name);
+var sender = (payload) => actor(payload.sender ?? record(payload.comment)?.user ?? void 0);
+var labels = (value) => {
+  if (!Array.isArray(value)) return [];
+  return value.map(
+    (entry) => typeof entry === "string" ? entry : stringValue(record(entry)?.name)
+  ).filter((entry) => entry.length > 0);
+};
+var state = (value) => value === "closed" ? "closed" : "open";
+var allowedEventNames = /* @__PURE__ */ new Set([
+  "issues",
+  "issue_comment",
+  "pull_request",
+  "pull_request_review",
+  "pull_request_review_comment",
+  "check_run",
+  "check_suite"
+]);
+var supportedActions = {
+  issues: ["opened", "edited", "reopened", "closed"],
+  issue_comment: ["created", "edited"],
+  pull_request: [
+    "opened",
+    "edited",
+    "reopened",
+    "closed",
+    "synchronize",
+    "ready_for_review",
+    "converted_to_draft"
+  ],
+  pull_request_review: ["submitted", "edited", "dismissed"],
+  pull_request_review_comment: ["created", "edited", "deleted"],
+  check_run: ["created", "rerequested", "completed"],
+  check_suite: ["completed", "requested", "rerequested"]
+};
+var ignored = (input) => ({ disposition: "ignored", ...input });
+var issueSnapshot = (payload) => {
+  const value = record(payload.issue);
+  const number = numberValue(value?.number);
+  if (value === void 0 || number === void 0) return void 0;
+  return {
+    number,
+    title: stringValue(value.title, "Untitled issue"),
+    body: stringValue(value.body),
+    state: state(value.state),
+    updatedAt: stringValue(value.updated_at),
+    htmlUrl: requiredStringValue(value.html_url),
+    authorLogin: requiredStringValue(record(value.user)?.login),
+    labels: labels(value.labels),
+    pullRequestNumber: numberValue(record(value.pull_request)?.number)
+  };
+};
+var commentSnapshot = (payload) => {
+  const value = record(payload.comment);
+  const id = requiredStringValue(value?.id);
+  if (value === void 0 || id === void 0) return void 0;
+  return {
+    id,
+    body: stringValue(value.body),
+    updatedAt: stringValue(value.updated_at),
+    htmlUrl: requiredStringValue(value.html_url),
+    authorLogin: requiredStringValue(record(value.user)?.login)
+  };
+};
+var reviewState = (value) => {
+  const normalized = requiredStringValue(value)?.toLowerCase().replaceAll("_", "-");
+  switch (normalized) {
+    case "approved":
+    case "changes-requested":
+    case "commented":
+    case "dismissed":
+    case "pending":
+      return normalized;
+    default:
+      return void 0;
+  }
+};
+var reviewSnapshot = (payload) => {
+  const value = record(payload.review);
+  if (value === void 0) return void 0;
+  const rawId = value.id;
+  const id = typeof rawId === "number" && Number.isInteger(rawId) && rawId > 0 ? String(rawId) : requiredStringValue(rawId);
+  const state2 = reviewState(value.state);
+  const pullRequest = record(payload.pull_request);
+  const headSha = requiredStringValue(value.commit_id) ?? requiredStringValue(record(pullRequest?.head)?.sha);
+  const submittedAt = requiredStringValue(value.submitted_at) ?? requiredStringValue(value.updated_at) ?? requiredStringValue(value.created_at);
+  if (id === void 0 || state2 === void 0 || headSha === void 0 || submittedAt === void 0) {
+    return void 0;
+  }
+  return {
+    id,
+    state: state2,
+    headSha,
+    submittedAt,
+    authorLogin: requiredStringValue(record(value.user)?.login)
+  };
+};
+var reviewDecisionFor = (review) => {
+  switch (review.state) {
+    case "approved":
+      return { decision: "approved" };
+    case "changes-requested":
+      return { decision: "changes-requested" };
+    case "dismissed":
+      return { decision: "rejected", reason: "GitHub review was dismissed" };
+    case "commented":
+    case "pending":
+      return void 0;
+  }
+};
+var pullRequestNumber = (payload) => {
+  const direct = numberValue(record(payload.pull_request)?.number);
+  if (direct !== void 0) return direct;
+  const issue = numberValue(record(payload.issue)?.number);
+  if (issue !== void 0 && record(payload.issue)?.pull_request !== void 0) {
+    return issue;
+  }
+  const check = record(payload.check_run) ?? record(payload.check_suite);
+  const pullRequests = check?.pull_requests;
+  if (Array.isArray(pullRequests)) {
+    return numberValue(record(pullRequests[0])?.number);
+  }
+  return void 0;
+};
+var pullRequestHead = (payload, fallback) => requiredStringValue(record(record(payload.pull_request)?.head)?.sha) ?? requiredStringValue(record(payload.check_run)?.head_sha) ?? requiredStringValue(record(payload.check_suite)?.head_sha) ?? fallback;
+var issueKind = (issue) => {
+  const normalized = new Set(issue.labels.map((label) => label.toLowerCase()));
+  if (normalized.has("planning-spec") || normalized.has("planning")) {
+    return "planning-spec";
+  }
+  if (normalized.has("pr-repair") || normalized.has("repair")) {
+    return "pr-repair";
+  }
+  return "executable-issue";
+};
+var sameIssueContent = (brief, issue) => (brief.problem === `${issue.title}
+
+${issue.body || "(empty issue body)"}` || brief.problem === issue.title) && brief.source.originalBody === (issue.body || "(empty issue body)");
+var createGitHubIssueBrief = (input) => {
+  const issue = input.event;
+  return createWorkBrief({
+    id: `${issue.repository}:${issue.kind}:${issue.issueNumber}`,
+    revision: input.revision,
+    identity: {
+      repository: issue.repository,
+      itemId: String(issue.issueNumber),
+      kind: input.itemKind
+    },
+    source: {
+      provider: "github",
+      repository: issue.repository,
+      itemId: String(issue.issueNumber),
+      url: issue.reply?.htmlUrl ?? issue.trackedPullRequest?.brief.source.url,
+      originalBody: issue.body || "(empty issue body)",
+      author: issue.reply?.authorLogin
+    },
+    problem: issue.title + "\n\n" + (issue.body || "(empty issue body)"),
+    evidence: ["Submitted through authenticated GitHub intake."],
+    acceptanceCriteria: input.defaults?.acceptanceCriteria ?? [],
+    exclusions: input.defaults?.exclusions ?? [],
+    risk: input.defaults?.risk ?? "medium",
+    verification: {
+      checks: input.policy.checks.map((check) => check.command),
+      artifacts: input.defaults?.verificationArtifacts ?? []
+    },
+    unresolvedQuestions: input.defaults?.unresolvedQuestions ?? [
+      "A maintainer must confirm acceptance criteria and execution authorization."
+    ],
+    authorization: { status: "pending" },
+    base: input.base,
+    policyRevision: input.policy.revision,
+    skillRevision: input.policy.worker.skillRevision,
+    createdAt: issue.observedAt
+  });
+};
+var eventName = (value) => allowedEventNames.has(value) ? value : void 0;
+var GitHubIntegration = class {
+  options;
+  now;
+  constructor(options) {
+    this.options = {
+      ...options,
+      policy: parseRepositoryPolicy(options.policy)
+    };
+    this.now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  }
+  async receiveWebhook(request) {
+    const deliveryId = header(request.headers, "x-github-delivery");
+    const eventHeader = header(request.headers, "x-github-event");
+    if (deliveryId === void 0 || eventHeader === void 0) {
+      return {
+        status: "rejected",
+        deliveryId: deliveryId ?? "unknown",
+        reason: "missing-delivery-or-event-header"
+      };
+    }
+    if (bodyBytes(request.body).byteLength > MAX_WEBHOOK_BODY_BYTES) {
+      return { status: "rejected", deliveryId, reason: "body-too-large" };
+    }
+    const body = bodyText(request.body);
+    if (!verifyGitHubWebhookSignature({
+      body: request.body,
+      signature: header(request.headers, "x-hub-signature-256"),
+      secret: this.options.webhookSecret
+    })) {
+      return { status: "rejected", deliveryId, reason: "invalid-signature" };
+    }
+    return this.processEnvelope({
+      eventName: eventHeader,
+      deliveryId,
+      payload: parseBody(body),
+      receivedAt: this.now(),
+      body
+    });
+  }
+  async normalize(envelope) {
+    const payload = record(envelope.payload);
+    const name = eventName(envelope.eventName);
+    const repository = payload ? repositoryName(payload) ?? "unknown" : "unknown";
+    const source = payload ? sender(payload) : { login: "unknown" };
+    if (name === void 0) {
+      return ignored({
+        reason: "unsupported-event",
+        eventName: envelope.eventName,
+        deliveryId: envelope.deliveryId,
+        repository,
+        sender: source
+      });
+    }
+    const action = stringValue(payload?.action);
+    if (!supportedActions[name].includes(action)) {
+      return ignored({
+        reason: "unsupported-action",
+        eventName: name,
+        action,
+        deliveryId: envelope.deliveryId,
+        repository,
+        sender: source
+      });
+    }
+    if (payload === void 0) {
+      return ignored({
+        reason: "unsupported-event",
+        eventName: name,
+        action,
+        deliveryId: envelope.deliveryId,
+        repository,
+        sender: source
+      });
+    }
+    if (name === "issues" || name === "issue_comment") {
+      const issue = issueSnapshot(payload);
+      if (issue === void 0) {
+        return ignored({
+          reason: "unsupported-event",
+          eventName: name,
+          action,
+          deliveryId: envelope.deliveryId,
+          repository,
+          sender: source
+        });
+      }
+      const issueIsPullRequest = issue.pullRequestNumber !== void 0 || record(record(payload.issue)?.pull_request) !== void 0;
+      if (issueIsPullRequest) {
+        return this.normalizeTrackedPullRequest(
+          envelope,
+          payload,
+          issue.pullRequestNumber ?? issue.number,
+          name === "issue_comment" ? commentSnapshot(payload) : void 0
+        );
+      }
+      const kind = issueKind(issue);
+      const draft = {
+        kind: name === "issue_comment" ? "issue-replied" : action === "opened" || action === "reopened" ? "issue-created" : "issue-edited",
+        eventName: name,
+        action,
+        deliveryId: envelope.deliveryId,
+        repository,
+        sender: source,
+        issueNumber: issue.number,
+        title: issue.title,
+        body: issue.body,
+        labels: issue.labels,
+        relevantRevision: issue.updatedAt || envelope.receivedAt,
+        observedAt: issue.updatedAt || envelope.receivedAt,
+        sourceState: issue.state,
+        reply: name === "issue_comment" ? commentSnapshot(payload) : void 0
+      };
+      const briefResolution = await this.briefForIssue(draft, issue, kind);
+      if ("ignoredReason" in briefResolution) {
+        return ignored({
+          reason: briefResolution.ignoredReason,
+          eventName: envelope.eventName,
+          action,
+          deliveryId: envelope.deliveryId,
+          repository,
+          sender: source
+        });
+      }
+      const brief = briefResolution.brief;
+      return {
+        disposition: "accepted",
+        event: {
+          ...draft,
+          workflowEvent: {
+            deliveryId: envelope.deliveryId,
+            brief,
+            policy: this.options.policy,
+            phase: "triage",
+            relevantRevision: draft.relevantRevision,
+            observedAt: draft.observedAt,
+            sourceState: draft.sourceState,
+            payload: envelope.payload
+          }
+        }
+      };
+    }
+    const number = pullRequestNumber(payload);
+    if (number === void 0) {
+      return ignored({
+        reason: "unrelated-pull-request",
+        eventName: name,
+        action,
+        deliveryId: envelope.deliveryId,
+        repository,
+        sender: source
+      });
+    }
+    const review = name === "pull_request_review" ? reviewSnapshot(payload) : void 0;
+    if (name === "pull_request_review" && review === void 0) {
+      return ignored({
+        reason: "unsupported-event",
+        eventName: name,
+        action,
+        deliveryId: envelope.deliveryId,
+        repository,
+        sender: source
+      });
+    }
+    return this.normalizeTrackedPullRequest(
+      envelope,
+      payload,
+      number,
+      void 0,
+      review
+    );
+  }
+  async reconcile(input) {
+    const hasIssue = input.issueNumber !== void 0;
+    const hasPullRequest = input.pullRequestNumber !== void 0;
+    if (hasIssue === hasPullRequest) {
+      throw new Error(
+        "Reconciliation requires exactly one issue or pull request"
+      );
+    }
+    if (hasIssue) {
+      const issue = await input.transport.fetchIssue({
+        repository: input.repository,
+        issueNumber: input.issueNumber
+      });
+      if (issue === void 0) {
+        return {
+          status: "not-found",
+          deliveryId: `reconcile:issue:${input.repository}:${input.issueNumber}`
+        };
+      }
+      const payload = this.issuePayload(issue, input.repository);
+      return this.toReconciliationResult(
+        await this.processEnvelope(
+          {
+            eventName: "issues",
+            deliveryId: `reconcile:issue:${input.repository}:${issue.number}:${issue.updatedAt}`,
+            payload,
+            receivedAt: this.now()
+          },
+          true
+        )
+      );
+    }
+    const pullRequest = await input.transport.fetchPullRequest({
+      repository: input.repository,
+      pullRequestNumber: input.pullRequestNumber
+    });
+    if (pullRequest === void 0) {
+      return {
+        status: "not-found",
+        deliveryId: `reconcile:pull-request:${input.repository}:${input.pullRequestNumber}`
+      };
+    }
+    return this.toReconciliationResult(
+      await this.processEnvelope(
+        {
+          eventName: "pull_request",
+          deliveryId: `reconcile:pull-request:${input.repository}:${pullRequest.number}:${pullRequest.headSha}`,
+          payload: this.pullRequestPayload(pullRequest, input.repository),
+          receivedAt: this.now()
+        },
+        true
+      )
+    );
+  }
+  async processEnvelope(envelope, trustedReconciliation = false) {
+    const payload = record(envelope.payload);
+    const repository = payload ? repositoryName(payload) ?? "unknown" : "unknown";
+    const source = payload ? sender(payload) : { login: "unknown" };
+    const body = envelope.body ?? JSON.stringify(envelope.payload);
+    const delivery = {
+      deliveryId: envelope.deliveryId,
+      eventName: envelope.eventName,
+      repository,
+      senderLogin: source.login,
+      receivedAt: envelope.receivedAt,
+      payloadHash: payloadHash(body),
+      payload: envelope.payload,
+      status: "received"
+    };
+    const stored = await this.options.deliveryStore.recordDeliveryIfAbsent(delivery);
+    if (!stored.inserted && stored.delivery.status !== "received") {
+      return { status: "duplicate", deliveryId: envelope.deliveryId };
+    }
+    const effectiveEnvelope = stored.inserted ? envelope : {
+      ...envelope,
+      payload: stored.delivery.payload,
+      receivedAt: stored.delivery.receivedAt,
+      body: JSON.stringify(stored.delivery.payload)
+    };
+    const effectiveDelivery = stored.inserted ? delivery : stored.delivery;
+    if (!allowedRepository(
+      this.options.authorization,
+      effectiveDelivery.repository
+    )) {
+      return this.rejectStored(effectiveDelivery, "disallowed-repository");
+    }
+    const effectivePayload = record(effectiveEnvelope.payload);
+    const effectiveSource = effectivePayload ? sender(effectivePayload) : { login: "unknown" };
+    if (!trustedReconciliation && isBot(effectiveSource, this.options.authorization)) {
+      return this.ignoreStored(effectiveDelivery, "bot-originated");
+    }
+    if (!trustedReconciliation) {
+      const isReview = effectiveEnvelope.eventName === "pull_request_review";
+      const authorized = isReview ? allowedReviewer(this.options.authorization, effectiveSource) : allowedSender(this.options.authorization, effectiveSource);
+      if (!authorized) {
+        return this.rejectStored(
+          effectiveDelivery,
+          isReview ? "disallowed-reviewer" : "disallowed-sender"
+        );
+      }
+    }
+    const normalized = await this.normalize(effectiveEnvelope);
+    if (normalized.disposition === "ignored") {
+      return this.ignoreStored(effectiveDelivery, normalized.reason);
+    }
+    if (normalized.event.review !== void 0) {
+      const tracked = normalized.event.trackedPullRequest;
+      const handler = this.options.reviewHandler;
+      const decision = reviewDecisionFor(normalized.event.review);
+      if (handler === void 0) {
+        return this.rejectStored(
+          effectiveDelivery,
+          "review-handler-unconfigured"
+        );
+      }
+      if (tracked === void 0) {
+        return this.rejectStored(
+          effectiveDelivery,
+          "review-missing-tracked-pull-request"
+        );
+      }
+      if (decision === void 0) {
+        return this.ignoreStored(effectiveDelivery, "review-without-decision");
+      }
+      const candidate = {
+        base: tracked.brief.base,
+        head: {
+          branch: tracked.branch,
+          sha: normalized.event.review.headSha
+        },
+        briefHash: tracked.brief.hash
+      };
+      let reviewResult;
+      try {
+        reviewResult = await processHumanReviewDecision({
+          candidate,
+          decision,
+          pullRequestNumber: tracked.pullRequestNumber,
+          readCurrent: () => handler.readCurrent({
+            candidate,
+            trackedPullRequest: tracked
+          }),
+          requestRepair: handler.requestRepair
+        });
+      } catch (error) {
+        return this.rejectStored(
+          effectiveDelivery,
+          `review-handler-failed: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+      const status = reviewResult.outcome === "blocked" ? "ignored" : "accepted";
+      await this.options.deliveryStore.updateDelivery({
+        ...effectiveDelivery,
+        status,
+        eventKind: normalized.event.kind,
+        jobId: tracked.jobId,
+        reason: reviewResult.reason
+      });
+      return {
+        status,
+        deliveryId: envelope.deliveryId,
+        event: normalized.event,
+        review: reviewResult,
+        reason: reviewResult.reason
+      };
+    }
+    const ingest = await this.options.coordinator.ingest(
+      normalized.event.workflowEvent
+    );
+    await this.options.deliveryStore.updateDelivery({
+      ...effectiveDelivery,
+      status: ingest.disposition === "ignored" ? "ignored" : "accepted",
+      eventKind: normalized.event.kind,
+      jobId: ingest.job?.id,
+      reason: ingest.reason
+    });
+    return {
+      status: ingest.disposition === "duplicate" ? "duplicate" : ingest.disposition === "ignored" ? "ignored" : "accepted",
+      deliveryId: envelope.deliveryId,
+      event: normalized.event,
+      ingest,
+      reason: ingest.reason
+    };
+  }
+  async rejectStored(delivery, reason) {
+    await this.options.deliveryStore.updateDelivery({
+      ...delivery,
+      status: "rejected",
+      reason
+    });
+    return { status: "rejected", deliveryId: delivery.deliveryId, reason };
+  }
+  async ignoreStored(delivery, reason) {
+    await this.options.deliveryStore.updateDelivery({
+      ...delivery,
+      status: "ignored",
+      reason
+    });
+    return { status: "ignored", deliveryId: delivery.deliveryId, reason };
+  }
+  async briefForIssue(draft, issue, kind) {
+    const identity = {
+      repository: draft.repository,
+      itemId: String(issue.number),
+      kind
+    };
+    const current = await this.options.coordinator.getCurrentJob(identity);
+    if (this.options.triage === void 0 && current !== void 0 && current.control === "active" && sameIssueContent(current.brief, issue)) {
+      return { brief: current.brief };
+    }
+    if (this.options.triage !== void 0) {
+      const source = {
+        provider: "github",
+        repository: draft.repository,
+        itemId: String(issue.number),
+        title: issue.title,
+        body: issue.body,
+        author: issue.authorLogin ?? draft.sender.login,
+        url: issue.htmlUrl,
+        updatedAt: issue.updatedAt || draft.observedAt,
+        kind,
+        labels: issue.labels
+      };
+      const triage = await runTriage({
+        source,
+        policy: this.options.policy,
+        base: this.options.base,
+        store: this.options.triage.store,
+        investigator: this.options.triage.investigator,
+        clarificationReply: draft.kind === "issue-replied" && draft.reply !== void 0 ? {
+          id: draft.reply.id,
+          body: draft.reply.body,
+          author: draft.reply.authorLogin,
+          updatedAt: draft.reply.updatedAt
+        } : void 0,
+        now: this.now
+      });
+      if (triage.record.sourceConflict !== void 0) {
+        return { ignoredReason: "triage-source-conflict" };
+      }
+      if (triage.brief !== void 0) {
+        if (triage.brief.authorization.status === "approved") {
+          return {
+            brief: createWorkBrief({
+              ...triage.brief,
+              authorization: { status: "pending" }
+            })
+          };
+        }
+        return { brief: triage.brief };
+      }
+      return { ignoredReason: "triage-incomplete" };
+    }
+    const event = draft;
+    const revision = current === void 0 ? 1 : current.brief.revision + 1;
+    const factory = this.options.briefFactory ?? createGitHubIssueBrief;
+    const candidate = factory({
+      event,
+      itemKind: kind,
+      policy: this.options.policy,
+      base: this.options.base,
+      authorization: { status: "pending" },
+      revision,
+      defaults: this.options.briefDefaults
+    });
+    const brief = parseWorkBrief(candidate);
+    if (brief.authorization.status !== "pending") {
+      throw new Error(
+        "GitHub intake cannot authorize work from webhook content"
+      );
+    }
+    return { brief };
+  }
+  async normalizeTrackedPullRequest(envelope, payload, pullRequestNumberValue, reply, review) {
+    const repository = repositoryName(payload) ?? "unknown";
+    const source = sender(payload);
+    const trackingStore = this.options.trackingStore;
+    const tracked = trackingStore ? await trackingStore.findTrackedPullRequest(
+      repository,
+      pullRequestNumberValue
+    ) : void 0;
+    if (tracked === void 0) {
+      return ignored({
+        reason: "unrelated-pull-request",
+        eventName: envelope.eventName,
+        action: stringValue(payload.action),
+        deliveryId: envelope.deliveryId,
+        repository,
+        sender: source
+      });
+    }
+    const pullRequest = record(payload.pull_request);
+    const observedAt = requiredStringValue(pullRequest?.updated_at) ?? requiredStringValue(record(payload.issue)?.updated_at) ?? reply?.updatedAt ?? envelope.receivedAt;
+    const headSha = pullRequestHead(payload, tracked.headSha);
+    const sourceState = state(pullRequest?.state);
+    const event = {
+      kind: "tracked-pr-updated",
+      eventName: eventName(envelope.eventName) ?? "pull_request",
+      action: stringValue(payload.action),
+      deliveryId: envelope.deliveryId,
+      repository,
+      sender: source,
+      issueNumber: Number(tracked.itemId) || pullRequestNumberValue,
+      pullRequestNumber: pullRequestNumberValue,
+      title: stringValue(pullRequest?.title, tracked.brief.problem),
+      body: stringValue(pullRequest?.body, tracked.brief.source.originalBody),
+      labels: labels(pullRequest?.labels),
+      relevantRevision: headSha,
+      observedAt,
+      sourceState,
+      reply,
+      review,
+      trackedPullRequest: tracked
+    };
+    return {
+      disposition: "accepted",
+      event: {
+        ...event,
+        workflowEvent: {
+          deliveryId: envelope.deliveryId,
+          brief: tracked.brief,
+          policy: tracked.policy,
+          phase: "checking",
+          relevantRevision: headSha,
+          observedAt,
+          sourceState,
+          payload: envelope.payload
+        }
+      }
+    };
+  }
+  issuePayload(issue, repository) {
+    return {
+      action: issue.state === "closed" ? "closed" : "edited",
+      issue: {
+        number: issue.number,
+        title: issue.title,
+        body: issue.body,
+        state: issue.state,
+        updated_at: issue.updatedAt,
+        html_url: issue.htmlUrl,
+        user: issue.authorLogin ? { login: issue.authorLogin } : void 0,
+        labels: issue.labels.map((name) => ({ name })),
+        pull_request: issue.pullRequestNumber === void 0 ? void 0 : { number: issue.pullRequestNumber }
+      },
+      repository: { full_name: repository },
+      sender: {
+        login: this.options.authorization.allowedSenders[0] ?? "shipyard"
+      }
+    };
+  }
+  pullRequestPayload(pullRequest, repository) {
+    return {
+      action: "synchronize",
+      pull_request: {
+        number: pullRequest.number,
+        title: pullRequest.title,
+        body: pullRequest.body,
+        state: pullRequest.state,
+        updated_at: pullRequest.updatedAt,
+        html_url: pullRequest.htmlUrl,
+        user: pullRequest.authorLogin ? { login: pullRequest.authorLogin } : void 0,
+        head: { ref: pullRequest.branch, sha: pullRequest.headSha },
+        base: { ref: pullRequest.baseBranch }
+      },
+      repository: { full_name: repository },
+      sender: {
+        login: this.options.authorization.allowedSenders[0] ?? "shipyard"
+      }
+    };
+  }
+  toReconciliationResult(receipt) {
+    return {
+      status: receipt.status === "rejected" ? "ignored" : receipt.status,
+      deliveryId: receipt.deliveryId,
+      reason: receipt.reason,
+      event: receipt.event,
+      ingest: receipt.ingest
+    };
+  }
+};
+var includesCaseInsensitive = (candidates, value) => candidates.some(
+  (candidate) => candidate.toLowerCase() === value.toLowerCase()
+);
+var allowedRepository = (policy, repository) => includesCaseInsensitive(policy.allowedRepositories, repository);
+var allowedSender = (policy, source) => includesCaseInsensitive(policy.allowedSenders, source.login);
+var allowedReviewer = (policy, source) => includesCaseInsensitive(policy.allowedReviewers, source.login);
+var isBot = (source, policy) => source.type === "Bot" || includesCaseInsensitive(policy.botLogins ?? [], source.login);
+var markerText = (marker) => `<!-- shipyard:${marker} -->`;
+var markerPart = (value) => encodeURIComponent(String(value));
+var markerHash = (value) => createHash("sha256").update(value).digest("hex").slice(0, 16);
+var result = (marker, execution) => ({
+  marker,
+  remote: execution.externalRef,
+  disposition: execution.disposition,
+  effect: execution.effect
+});
+var GitHubPublication = class {
+  options;
+  constructor(options) {
+    this.options = options;
+  }
+  async publishComment(input) {
+    const marker = `comment:${markerPart(input.jobId)}:${markerPart(input.key ?? "default")}`;
+    const body = `${markerText(marker)}
+${input.body}`;
+    const execution = await this.options.coordinator.publishEffect({
+      jobId: input.jobId,
+      lease: input.lease,
+      itemId: String(input.issueNumber),
+      kind: "github-comment",
+      marker,
+      payload: {
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber
+      },
+      reconcile: () => this.options.transport.findCommentByMarker({
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber,
+        marker: markerText(marker)
+      }),
+      publish: () => this.options.transport.createComment({
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber,
+        body
+      })
+    });
+    return result(marker, execution);
+  }
+  async publishBrief(input) {
+    const marker = `brief:${markerPart(input.jobId)}:${markerPart(input.brief.revision)}`;
+    const body = [
+      markerText(marker),
+      "## Shipyard executable brief",
+      `- Revision: ${input.brief.revision}`,
+      `- Brief hash: \`${input.brief.hash}\``,
+      `- Risk: ${input.brief.risk}`,
+      "",
+      input.brief.problem,
+      "",
+      "### Acceptance criteria",
+      ...input.brief.acceptanceCriteria.map((criterion) => `- ${criterion}`),
+      "",
+      "### Unresolved questions",
+      ...input.brief.unresolvedQuestions.map((question) => `- ${question}`)
+    ].join("\n");
+    const execution = await this.options.coordinator.publishEffect({
+      jobId: input.jobId,
+      lease: input.lease,
+      itemId: String(input.issueNumber),
+      kind: "github-brief",
+      marker,
+      payload: {
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber
+      },
+      reconcile: () => this.options.transport.findCommentByMarker({
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber,
+        marker: markerText(marker)
+      }),
+      publish: () => this.options.transport.createComment({
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber,
+        body
+      })
+    });
+    return result(marker, execution);
+  }
+  async publishBranch(input) {
+    const marker = `branch:${markerPart(input.jobId)}:${markerPart(input.branch)}`;
+    const execution = await this.options.coordinator.publishEffect({
+      jobId: input.jobId,
+      lease: input.lease,
+      branch: input.branch,
+      headSha: input.headSha,
+      kind: "github-branch",
+      marker,
+      payload: { repository: input.lease.repository, branch: input.branch },
+      reconcile: () => this.options.transport.findBranchByName({
+        repository: input.lease.repository,
+        branch: input.branch
+      }),
+      publish: () => this.options.transport.createBranch({
+        repository: input.lease.repository,
+        branch: input.branch,
+        headSha: input.headSha,
+        marker: markerText(marker)
+      })
+    });
+    return result(marker, execution);
+  }
+  async publishPullRequest(input) {
+    const marker = `pull-request:${markerPart(input.jobId)}:${markerPart(input.branch)}`;
+    const execution = await this.options.coordinator.publishEffect({
+      jobId: input.jobId,
+      lease: input.lease,
+      branch: input.branch,
+      headSha: input.headSha,
+      kind: "github-pull-request",
+      marker,
+      payload: { repository: input.lease.repository, branch: input.branch },
+      reconcile: () => this.options.transport.findPullRequestByMarker({
+        repository: input.lease.repository,
+        marker: markerText(marker)
+      }),
+      publish: () => this.options.transport.createPullRequest({
+        repository: input.lease.repository,
+        title: input.title,
+        body: `${markerText(marker)}
+${input.body}`,
+        branch: input.branch,
+        baseBranch: input.baseBranch,
+        draft: input.draft ?? true,
+        marker: markerText(marker)
+      })
+    });
+    const publication = result(marker, execution);
+    if (publication.remote !== void 0 && publication.remote.branch === input.branch && publication.remote.baseBranch === input.baseBranch && publication.remote.headSha === input.headSha) {
+      const job = await this.options.coordinator.getJob(input.jobId);
+      if (job !== void 0) {
+        await this.options.trackingStore.saveTrackedPullRequest({
+          repository: input.lease.repository,
+          pullRequestNumber: publication.remote.number,
+          jobId: input.jobId,
+          itemId: job.key.itemId,
+          branch: input.branch,
+          headSha: input.headSha,
+          marker,
+          brief: job.brief,
+          policy: job.policy,
+          createdAt: this.options.now?.() ?? (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    }
+    return publication;
+  }
+  async publishCheck(input) {
+    const marker = `check:${markerPart(input.jobId)}:${markerPart(input.key ?? input.name)}:${markerPart(input.headSha)}`;
+    const execution = await this.options.coordinator.publishEffect({
+      jobId: input.jobId,
+      lease: input.lease,
+      branch: input.branch,
+      headSha: input.headSha,
+      kind: "github-check",
+      marker,
+      payload: { repository: input.lease.repository, name: input.name },
+      reconcile: () => this.options.transport.findCheckByMarker({
+        repository: input.lease.repository,
+        marker: markerText(marker),
+        headSha: input.headSha
+      }),
+      publish: () => this.options.transport.createCheck({
+        repository: input.lease.repository,
+        name: input.name,
+        headSha: input.headSha,
+        marker: markerText(marker),
+        status: input.status,
+        conclusion: input.conclusion,
+        summary: input.summary
+      })
+    });
+    return result(marker, execution);
+  }
+  async publishRepairIssue(input) {
+    const marker = `repair-issue:${markerPart(input.jobId)}:${markerHash(input.title)}`;
+    const execution = await this.options.coordinator.publishEffect({
+      jobId: input.jobId,
+      lease: input.lease,
+      kind: "github-repair-issue",
+      marker,
+      payload: { repository: input.lease.repository },
+      reconcile: () => this.options.transport.findIssueByMarker({
+        repository: input.lease.repository,
+        marker: markerText(marker)
+      }),
+      publish: () => this.options.transport.createRepairIssue({
+        repository: input.lease.repository,
+        title: input.title,
+        body: `${markerText(marker)}
+${input.body}`,
+        marker: markerText(marker),
+        labels: input.labels ?? ["shipyard:pr-repair"]
+      })
+    });
+    return result(marker, execution);
+  }
+  async publishRepairLink(input) {
+    const marker = `repair-link:${markerPart(input.jobId)}:${markerHash(input.repairIssueUrl)}`;
+    const body = `${markerText(marker)}
+Linked repair issue: ${input.repairIssueUrl}`;
+    const execution = await this.options.coordinator.publishEffect({
+      jobId: input.jobId,
+      lease: input.lease,
+      itemId: String(input.issueNumber),
+      kind: "github-repair-link",
+      marker,
+      payload: {
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber
+      },
+      reconcile: () => this.options.transport.findCommentByMarker({
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber,
+        marker: markerText(marker)
+      }),
+      publish: () => this.options.transport.createComment({
+        repository: input.lease.repository,
+        issueNumber: input.issueNumber,
+        body
+      })
+    });
+    return result(marker, execution);
+  }
+};
+
+export { GitHubIntegration, GitHubPublication, InMemoryGitHubStore, createGitHubIssueBrief, reviewDecisionFor, verifyGitHubWebhookSignature };
+//# sourceMappingURL=github.js.map
+//# sourceMappingURL=github.js.map