effect-agent 0.1.0-beta.9 → 0.1.0-beta.91

package/dist/durable/GitHubWorkflowSource.mjs

@@ -0,0 +1,209 @@
+import { SubscriptionSourceError } from "./Subscription.mjs";
+import { makeEventSource } from "./EventSource.mjs";
+import { SubscriptionIntake } from "./Subscriptions.mjs";
+import { Context, Effect, Encoding, FileSystem, Layer, Redacted, Schema } from "effect";
+import { HttpClient, HttpClientRequest, HttpIncomingMessage } from "effect/unstable/http";
+//#region src/durable/GitHubWorkflowSource.ts
+const PositiveId = Schema.Int.check(Schema.isGreaterThan(0));
+const GitHubName = Schema.NonEmptyString.check(Schema.isMaxLength(100), Schema.isPattern(/^[A-Za-z0-9_.-]+$/));
+const GitCommitSha = Schema.String.check(Schema.isPattern(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/));
+const GitHubConclusion = Schema.NonEmptyString.check(Schema.isMaxLength(64));
+const GitHubStatus = Schema.NonEmptyString.check(Schema.isMaxLength(32));
+const strict = (schema) => schema.pipe(Schema.annotate({ parseOptions: { onExcessProperty: "error" } }));
+/** One repository whose identity and credentials are selected by the host. */
+const GitHubRepository = strict(Schema.Struct({
+	id: PositiveId,
+	owner: GitHubName,
+	name: GitHubName
+}));
+/** Exact workflow attempt requested by an Agent through a host-permitted source. */
+const GitHubWorkflowRunWatch = strict(Schema.Struct({
+	runId: PositiveId,
+	attempt: PositiveId,
+	expectedHeadSha: GitCommitSha
+}));
+/**
+* Small canonical completion shared by webhook intake and REST reconciliation. Provider delivery
+* IDs, URLs, actors, and mutable metadata are deliberately omitted from durable event identity.
+*/
+const GitHubWorkflowRunCompletion = strict(Schema.Struct({
+	repositoryId: PositiveId,
+	runId: PositiveId,
+	attempt: PositiveId,
+	headSha: GitCommitSha,
+	conclusion: GitHubConclusion
+}));
+const GitHubWorkflowRunWire = Schema.Struct({
+	id: PositiveId,
+	run_attempt: PositiveId,
+	head_sha: GitCommitSha,
+	status: GitHubStatus,
+	conclusion: Schema.NullOr(GitHubConclusion),
+	repository: Schema.Struct({ id: PositiveId })
+});
+const GitHubWorkflowRunWebhook = Schema.Struct({
+	action: Schema.Literal("completed"),
+	repository: Schema.Struct({ id: PositiveId }),
+	workflow_run: GitHubWorkflowRunWire
+});
+const GitHubWorkflowRunAttempt = GitHubWorkflowRunWire;
+const GitHubWorkflowRunSourceVersion = {
+	name: "github-workflow-run-completed",
+	version: "1"
+};
+var GitHubWorkflowRunsError = class extends Schema.TaggedError()("GitHubWorkflowRunsError", {
+	reason: Schema.Literals([
+		"rate-limited",
+		"unavailable",
+		"unauthorized",
+		"not-found",
+		"invalid-response"
+	]),
+	retryable: Schema.Boolean
+}) {};
+/**
+* Credentialed, read-only GitHub boundary. Implementations must authorize the repository and read
+* the exact attempt endpoint; the source never receives or persists a credential.
+*/
+var GitHubWorkflowRuns = class extends Context.Service()("@effect-agent/thread/GitHubWorkflowRuns") {};
+const httpFailure = (reason, retryable) => GitHubWorkflowRunsError.make({
+	reason,
+	retryable
+});
+/**
+* GitHub REST adapter for `GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt}`.
+* It performs one bounded read. Scheduling retries and backoff remain owned by SubscriptionDriver.
+*/
+const githubWorkflowRunsHttpLayer = (options) => Layer.effect(GitHubWorkflowRuns, Effect.gen(function* () {
+	const client = yield* HttpClient.HttpClient;
+	const permittedRepository = yield* Schema.decodeEffect(GitHubRepository)(options.repository).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+	const getAttempt = Effect.fn("GitHubWorkflowRuns.getAttempt")(function* (request) {
+		const repository = yield* Schema.decodeEffect(GitHubRepository)(request.repository).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+		if (repository.id !== permittedRepository.id || repository.owner !== permittedRepository.owner || repository.name !== permittedRepository.name) return yield* httpFailure("unauthorized", false);
+		const watch = yield* Schema.decodeEffect(GitHubWorkflowRunWatch)({
+			runId: request.runId,
+			attempt: request.attempt,
+			expectedHeadSha: "0".repeat(40)
+		}).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+		const url = `${apiUrl}/repos/${repository.owner}/${repository.name}/actions/runs/${String(watch.runId)}/attempts/${String(watch.attempt)}`;
+		const response = yield* client.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeaders({
+			Accept: "application/vnd.github+json",
+			"X-GitHub-Api-Version": "2026-03-10",
+			"User-Agent": options.userAgent ?? "effect-agent-subscriptions"
+		}), HttpClientRequest.bearerToken(options.token))).pipe(Effect.mapError(() => httpFailure("unavailable", true)));
+		if (response.status === 429 || response.status === 403 && (response.headers["x-ratelimit-remaining"] === "0" || response.headers["retry-after"] !== void 0)) return yield* httpFailure("rate-limited", true);
+		if (response.status === 401 || response.status === 403) return yield* httpFailure("unauthorized", false);
+		if (response.status === 404) return yield* httpFailure("not-found", true);
+		if (response.status < 200 || response.status >= 300) return yield* httpFailure("unavailable", response.status >= 500);
+		return yield* response.json.pipe(Effect.provideService(HttpIncomingMessage.MaxBodySize, FileSystem.Size(1048576)), Effect.mapError(() => httpFailure("invalid-response", false)), Effect.flatMap(Schema.decodeUnknownEffect(GitHubWorkflowRunAttempt)), Effect.mapError(() => httpFailure("invalid-response", false)));
+	});
+	return GitHubWorkflowRuns.of({ getAttempt });
+}));
+const sourceError = (code, retryable) => SubscriptionSourceError.make({
+	code,
+	retryable
+});
+const completionIdentity = (completion) => `github-workflow-run:${String(completion.repositoryId)}:${String(completion.runId)}:${String(completion.attempt)}:completed`;
+const watchIdentity = (repositoryId, watch) => `github-workflow-run:${String(repositoryId)}:${String(watch.runId)}:${String(watch.attempt)}:completed`;
+const completionFromWire = Effect.fn("GitHubWorkflowRun.completionFromWire")(function* (repository, watch, wire) {
+	if (wire.repository.id !== repository.id || wire.id !== watch.runId || wire.run_attempt !== watch.attempt || wire.head_sha !== watch.expectedHeadSha) return yield* sourceError("github-identity-mismatch", false);
+	if (wire.status !== "completed") return null;
+	if (wire.conclusion === null) return yield* sourceError("github-completed-without-conclusion", false);
+	return GitHubWorkflowRunCompletion.make({
+		repositoryId: repository.id,
+		runId: wire.id,
+		attempt: wire.run_attempt,
+		headSha: wire.head_sha,
+		conclusion: wire.conclusion
+	});
+});
+/**
+* Build the exact-attempt completion source, shared by all destination Agents in this partition.
+* Reconciliation depends on GitHub retaining a readable exact attempt.
+*/
+const makeGitHubWorkflowRunSource = Effect.fn("makeGitHubWorkflowRunSource")(function* (options) {
+	const repository = yield* Schema.decodeEffect(GitHubRepository)(options.repository).pipe(Effect.mapError(() => sourceError("github-repository-configuration", false)));
+	const runs = yield* GitHubWorkflowRuns;
+	return yield* makeEventSource({
+		source: GitHubWorkflowRunSourceVersion,
+		continuity: "Webhook delivery is not replayed by GitHub; reconciliation can recover only while the exact workflow run attempt remains readable and authorized.",
+		event: GitHubWorkflowRunCompletion.check(Schema.makeFilter((completion) => completion.repositoryId === repository.id, { title: "GitHub completion belongs to the host-bound repository" })),
+		parameters: GitHubWorkflowRunWatch,
+		identity: completionIdentity,
+		eventKey: completionIdentity,
+		parameterKey: (watch) => watchIdentity(repository.id, watch),
+		matches: (completion, watch) => completion.repositoryId === repository.id && completion.runId === watch.runId && completion.attempt === watch.attempt && completion.headSha === watch.expectedHeadSha,
+		reconcile: (watch) => runs.getAttempt({
+			repository,
+			runId: watch.runId,
+			attempt: watch.attempt
+		}).pipe(Effect.mapError((error) => sourceError(`github-${error.reason}`, error.retryable)), Effect.flatMap((wire) => completionFromWire(repository, watch, wire)))
+	});
+});
+var GitHubWebhookVerificationError = class extends Schema.TaggedError()("GitHubWebhookVerificationError", { reason: Schema.Literals([
+	"invalid-signature",
+	"invalid-event",
+	"invalid-payload",
+	"payload-too-large",
+	"crypto-unavailable"
+]) }) {};
+/** Host-held webhook secret verification; callers cannot bypass it by supplying parsed JSON. */
+var GitHubWebhookSignatureVerifier = class extends Context.Service()("@effect-agent/thread/GitHubWebhookSignatureVerifier") {};
+/** GitHub-compatible HMAC-SHA256 verifier over the exact raw request bytes. */
+const webCryptoGitHubWebhookSignatureVerifierLayer = (secret, subtle) => Layer.effect(GitHubWebhookSignatureVerifier, Effect.sync(() => {
+	const verify = Effect.fn("GitHubWebhookSignatureVerifier.verify")(function* (body, signature) {
+		if (!/^sha256=[0-9a-f]{64}$/.test(signature)) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-signature" });
+		const signatureBytes = yield* Effect.fromResult(Encoding.decodeHex(signature.slice(7))).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: "invalid-signature" })));
+		const keyBytes = new TextEncoder().encode(Redacted.value(secret));
+		const keyBuffer = new ArrayBuffer(keyBytes.byteLength);
+		new Uint8Array(keyBuffer).set(keyBytes);
+		const key = yield* Effect.tryPromise({
+			try: () => subtle.importKey("raw", keyBuffer, {
+				name: "HMAC",
+				hash: "SHA-256"
+			}, false, ["verify"]),
+			catch: () => GitHubWebhookVerificationError.make({ reason: "crypto-unavailable" })
+		});
+		const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);
+		new Uint8Array(signatureBuffer).set(signatureBytes);
+		const bodyBuffer = new ArrayBuffer(body.byteLength);
+		new Uint8Array(bodyBuffer).set(body);
+		if (!(yield* Effect.tryPromise({
+			try: () => subtle.verify("HMAC", key, signatureBuffer, bodyBuffer),
+			catch: () => GitHubWebhookVerificationError.make({ reason: "crypto-unavailable" })
+		}))) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-signature" });
+	});
+	return GitHubWebhookSignatureVerifier.of({ verify });
+}));
+/**
+* Verify raw ingress, decode only a completed `workflow_run`, and hand its canonical completion to
+* durable intake. The acknowledgement means routing work is retained; it is not a Submission Receipt.
+*/
+const acceptVerifiedGitHubWorkflowRunWebhook = Effect.fn("acceptVerifiedGitHubWorkflowRunWebhook")(function* (request) {
+	if (request.body.byteLength > 1048576) return yield* GitHubWebhookVerificationError.make({ reason: "payload-too-large" });
+	if (request.eventHeader !== "workflow_run" || request.signatureHeader === void 0) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-event" });
+	yield* (yield* GitHubWebhookSignatureVerifier).verify(request.body, request.signatureHeader);
+	const text = yield* Effect.try({
+		try: () => new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(request.body),
+		catch: () => GitHubWebhookVerificationError.make({ reason: "invalid-payload" })
+	});
+	const webhook = yield* Schema.decodeEffect(Schema.fromJsonString(GitHubWorkflowRunWebhook))(text).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: "invalid-payload" })));
+	if (webhook.repository.id !== webhook.workflow_run.repository.id) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-payload" });
+	if (webhook.workflow_run.status !== "completed" || webhook.workflow_run.conclusion === null) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-payload" });
+	const completion = GitHubWorkflowRunCompletion.make({
+		repositoryId: webhook.repository.id,
+		runId: webhook.workflow_run.id,
+		attempt: webhook.workflow_run.run_attempt,
+		headSha: webhook.workflow_run.head_sha,
+		conclusion: webhook.workflow_run.conclusion
+	});
+	return yield* (yield* SubscriptionIntake).accept(request.principal, GitHubWorkflowRunSourceVersion, completion);
+});
+//#endregion
+export { GitHubRepository, GitHubWebhookSignatureVerifier, GitHubWebhookVerificationError, GitHubWorkflowRunAttempt, GitHubWorkflowRunCompletion, GitHubWorkflowRunSourceVersion, GitHubWorkflowRunWatch, GitHubWorkflowRunWebhook, GitHubWorkflowRuns, GitHubWorkflowRunsError, acceptVerifiedGitHubWorkflowRunWebhook, githubWorkflowRunsHttpLayer, makeGitHubWorkflowRunSource, webCryptoGitHubWebhookSignatureVerifierLayer };
+
+//# sourceMappingURL=GitHubWorkflowSource.mjs.map

package/dist/durable/GitHubWorkflowSource.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubWorkflowSource.mjs","names":[],"sources":["../../src/durable/GitHubWorkflowSource.ts"],"sourcesContent":["import { Context, Effect, Encoding, FileSystem, Layer, Redacted, Schema } from \"effect\";\nimport { HttpClient, HttpIncomingMessage, HttpClientRequest } from \"effect/unstable/http\";\n\nimport { makeEventSource, type EventSource } from \"./EventSource.ts\";\nimport type { Principal } from \"./SubmissionLedger.ts\";\nimport type { EventAcknowledgement } from \"./Subscription.ts\";\nimport { SubscriptionSourceError } from \"./Subscription.ts\";\nimport { SubscriptionIntake } from \"./Subscriptions.ts\";\n\nconst PositiveId = Schema.Int.check(Schema.isGreaterThan(0));\n\nconst GitHubName = Schema.NonEmptyString.check(\n  Schema.isMaxLength(100),\n  Schema.isPattern(/^[A-Za-z0-9_.-]+$/),\n);\n\nconst GitCommitSha = Schema.String.check(Schema.isPattern(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/));\nconst GitHubConclusion = Schema.NonEmptyString.check(Schema.isMaxLength(64));\nconst GitHubStatus = Schema.NonEmptyString.check(Schema.isMaxLength(32));\n\nconst strict = <S extends Schema.Top>(schema: S) =>\n  schema.pipe(Schema.annotate({ parseOptions: { onExcessProperty: \"error\" } }));\n\n/** One repository whose identity and credentials are selected by the host. */\nexport const GitHubRepository = strict(\n  Schema.Struct({\n    id: PositiveId,\n    owner: GitHubName,\n    name: GitHubName,\n  }),\n);\n\nexport type GitHubRepository = typeof GitHubRepository.Type;\n\n/** Exact workflow attempt requested by an Agent through a host-permitted source. */\nexport const GitHubWorkflowRunWatch = strict(\n  Schema.Struct({\n    runId: PositiveId,\n    attempt: PositiveId,\n    expectedHeadSha: GitCommitSha,\n  }),\n);\n\nexport type GitHubWorkflowRunWatch = typeof GitHubWorkflowRunWatch.Type;\n\n/**\n * Small canonical completion shared by webhook intake and REST reconciliation. Provider delivery\n * IDs, URLs, actors, and mutable metadata are deliberately omitted from durable event identity.\n */\nexport const GitHubWorkflowRunCompletion = strict(\n  Schema.Struct({\n    repositoryId: PositiveId,\n    runId: PositiveId,\n    attempt: PositiveId,\n    headSha: GitCommitSha,\n    conclusion: GitHubConclusion,\n  }),\n);\n\nexport type GitHubWorkflowRunCompletion = typeof GitHubWorkflowRunCompletion.Type;\n\n// Provider wire payloads intentionally project the fields we own. GitHub adds many fields and\n// may add more; canonical values below remain strict after this projection.\nconst GitHubWorkflowRunWire = Schema.Struct({\n  id: PositiveId,\n  run_attempt: PositiveId,\n  head_sha: GitCommitSha,\n  status: GitHubStatus,\n  conclusion: Schema.NullOr(GitHubConclusion),\n  repository: Schema.Struct({ id: PositiveId }),\n});\n\nexport const GitHubWorkflowRunWebhook = Schema.Struct({\n  action: Schema.Literal(\"completed\"),\n  repository: Schema.Struct({ id: PositiveId }),\n  workflow_run: GitHubWorkflowRunWire,\n});\n\nexport type GitHubWorkflowRunWebhook = typeof GitHubWorkflowRunWebhook.Type;\n\nexport const GitHubWorkflowRunAttempt = GitHubWorkflowRunWire;\nexport type GitHubWorkflowRunAttempt = typeof GitHubWorkflowRunAttempt.Type;\n\nexport const GitHubWorkflowRunSourceVersion = {\n  name: \"github-workflow-run-completed\",\n  version: \"1\",\n} as const;\n\nexport class GitHubWorkflowRunsError extends Schema.TaggedError<GitHubWorkflowRunsError>()(\n  \"GitHubWorkflowRunsError\",\n  {\n    reason: Schema.Literals([\n      \"rate-limited\",\n      \"unavailable\",\n      \"unauthorized\",\n      \"not-found\",\n      \"invalid-response\",\n    ]),\n    retryable: Schema.Boolean,\n  },\n) {}\n\nexport interface GitHubWorkflowRunAttemptRequest {\n  readonly repository: GitHubRepository;\n  readonly runId: number;\n  readonly attempt: number;\n}\n\n/**\n * Credentialed, read-only GitHub boundary. Implementations must authorize the repository and read\n * the exact attempt endpoint; the source never receives or persists a credential.\n */\nexport class GitHubWorkflowRuns extends Context.Service<\n  GitHubWorkflowRuns,\n  {\n    readonly getAttempt: (\n      request: GitHubWorkflowRunAttemptRequest,\n    ) => Effect.Effect<GitHubWorkflowRunAttempt, GitHubWorkflowRunsError>;\n  }\n>()(\"@effect-agent/thread/GitHubWorkflowRuns\") {}\n\nexport interface GitHubWorkflowRunsHttpOptions {\n  /** Repository this credentialed adapter is authorized to read. */\n  readonly repository: GitHubRepository;\n  readonly token: Redacted.Redacted<string>;\n  readonly apiUrl?: string | undefined;\n  readonly userAgent?: string | undefined;\n}\n\nconst httpFailure = (\n  reason: GitHubWorkflowRunsError[\"reason\"],\n  retryable: boolean,\n): GitHubWorkflowRunsError => GitHubWorkflowRunsError.make({ reason, retryable });\n\n/**\n * GitHub REST adapter for `GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt}`.\n * It performs one bounded read. Scheduling retries and backoff remain owned by SubscriptionDriver.\n */\nexport const githubWorkflowRunsHttpLayer = (\n  options: GitHubWorkflowRunsHttpOptions,\n): Layer.Layer<GitHubWorkflowRuns, GitHubWorkflowRunsError, HttpClient.HttpClient> =>\n  Layer.effect(\n    GitHubWorkflowRuns,\n    Effect.gen(function* () {\n      const client = yield* HttpClient.HttpClient;\n\n      const permittedRepository = yield* Schema.decodeEffect(GitHubRepository)(\n        options.repository,\n      ).pipe(Effect.mapError(() => httpFailure(\"invalid-response\", false)));\n\n      const apiUrl = (options.apiUrl ?? \"https://api.github.com\").replace(/\\/$/, \"\");\n\n      const getAttempt = Effect.fn(\"GitHubWorkflowRuns.getAttempt\")(function* (\n        request: GitHubWorkflowRunAttemptRequest,\n      ) {\n        const repository = yield* Schema.decodeEffect(GitHubRepository)(request.repository).pipe(\n          Effect.mapError(() => httpFailure(\"invalid-response\", false)),\n        );\n\n        if (\n          repository.id !== permittedRepository.id ||\n          repository.owner !== permittedRepository.owner ||\n          repository.name !== permittedRepository.name\n        ) {\n          return yield* httpFailure(\"unauthorized\", false);\n        }\n\n        const watch = yield* Schema.decodeEffect(GitHubWorkflowRunWatch)({\n          runId: request.runId,\n          attempt: request.attempt,\n          expectedHeadSha: \"0\".repeat(40),\n        }).pipe(Effect.mapError(() => httpFailure(\"invalid-response\", false)));\n\n        const url = `${apiUrl}/repos/${repository.owner}/${repository.name}/actions/runs/${String(watch.runId)}/attempts/${String(watch.attempt)}`;\n\n        const response = yield* client\n          .execute(\n            HttpClientRequest.get(url).pipe(\n              HttpClientRequest.setHeaders({\n                Accept: \"application/vnd.github+json\",\n                \"X-GitHub-Api-Version\": \"2026-03-10\",\n                \"User-Agent\": options.userAgent ?? \"effect-agent-subscriptions\",\n              }),\n              HttpClientRequest.bearerToken(options.token),\n            ),\n          )\n          .pipe(Effect.mapError(() => httpFailure(\"unavailable\", true)));\n\n        if (\n          response.status === 429 ||\n          (response.status === 403 &&\n            (response.headers[\"x-ratelimit-remaining\"] === \"0\" ||\n              response.headers[\"retry-after\"] !== undefined))\n        ) {\n          return yield* httpFailure(\"rate-limited\", true);\n        }\n        if (response.status === 401 || response.status === 403) {\n          return yield* httpFailure(\"unauthorized\", false);\n        }\n        if (response.status === 404) return yield* httpFailure(\"not-found\", true);\n        if (response.status < 200 || response.status >= 300) {\n          return yield* httpFailure(\"unavailable\", response.status >= 500);\n        }\n\n        return yield* response.json.pipe(\n          Effect.provideService(HttpIncomingMessage.MaxBodySize, FileSystem.Size(1024 * 1024)),\n          Effect.mapError(() => httpFailure(\"invalid-response\", false)),\n          Effect.flatMap(Schema.decodeUnknownEffect(GitHubWorkflowRunAttempt)),\n          Effect.mapError(() => httpFailure(\"invalid-response\", false)),\n        );\n      });\n\n      return GitHubWorkflowRuns.of({ getAttempt });\n    }),\n  );\n\nconst sourceError = (code: string, retryable: boolean) =>\n  SubscriptionSourceError.make({ code, retryable });\n\nconst completionIdentity = (completion: GitHubWorkflowRunCompletion): string =>\n  `github-workflow-run:${String(completion.repositoryId)}:${String(completion.runId)}:${String(completion.attempt)}:completed`;\n\nconst watchIdentity = (repositoryId: number, watch: GitHubWorkflowRunWatch): string =>\n  `github-workflow-run:${String(repositoryId)}:${String(watch.runId)}:${String(watch.attempt)}:completed`;\n\nconst completionFromWire = Effect.fn(\"GitHubWorkflowRun.completionFromWire\")(function* (\n  repository: GitHubRepository,\n  watch: GitHubWorkflowRunWatch,\n  wire: GitHubWorkflowRunAttempt,\n) {\n  if (\n    wire.repository.id !== repository.id ||\n    wire.id !== watch.runId ||\n    wire.run_attempt !== watch.attempt ||\n    wire.head_sha !== watch.expectedHeadSha\n  ) {\n    return yield* sourceError(\"github-identity-mismatch\", false);\n  }\n  if (wire.status !== \"completed\") return null;\n  if (wire.conclusion === null) {\n    return yield* sourceError(\"github-completed-without-conclusion\", false);\n  }\n\n  return GitHubWorkflowRunCompletion.make({\n    repositoryId: repository.id,\n    runId: wire.id,\n    attempt: wire.run_attempt,\n    headSha: wire.head_sha,\n    conclusion: wire.conclusion,\n  });\n});\n\nexport interface GitHubWorkflowRunSourceOptions {\n  readonly repository: GitHubRepository;\n}\n\n/**\n * Build the exact-attempt completion source, shared by all destination Agents in this partition.\n * Reconciliation depends on GitHub retaining a readable exact attempt.\n */\nexport const makeGitHubWorkflowRunSource = Effect.fn(\"makeGitHubWorkflowRunSource\")(function* (\n  options: GitHubWorkflowRunSourceOptions,\n): Effect.fn.Return<EventSource, SubscriptionSourceError, GitHubWorkflowRuns> {\n  const repository = yield* Schema.decodeEffect(GitHubRepository)(options.repository).pipe(\n    Effect.mapError(() => sourceError(\"github-repository-configuration\", false)),\n  );\n\n  const runs = yield* GitHubWorkflowRuns;\n\n  return yield* makeEventSource({\n    source: GitHubWorkflowRunSourceVersion,\n    continuity:\n      \"Webhook delivery is not replayed by GitHub; reconciliation can recover only while the exact workflow run attempt remains readable and authorized.\",\n    event: GitHubWorkflowRunCompletion.check(\n      Schema.makeFilter((completion) => completion.repositoryId === repository.id, {\n        title: \"GitHub completion belongs to the host-bound repository\",\n      }),\n    ),\n    parameters: GitHubWorkflowRunWatch,\n    identity: completionIdentity,\n    eventKey: completionIdentity,\n    parameterKey: (watch) => watchIdentity(repository.id, watch),\n    matches: (completion, watch) =>\n      completion.repositoryId === repository.id &&\n      completion.runId === watch.runId &&\n      completion.attempt === watch.attempt &&\n      completion.headSha === watch.expectedHeadSha,\n    reconcile: (watch) =>\n      runs.getAttempt({ repository, runId: watch.runId, attempt: watch.attempt }).pipe(\n        Effect.mapError((error) => sourceError(`github-${error.reason}`, error.retryable)),\n        Effect.flatMap((wire) => completionFromWire(repository, watch, wire)),\n      ),\n  });\n});\n\nexport class GitHubWebhookVerificationError extends Schema.TaggedError<GitHubWebhookVerificationError>()(\n  \"GitHubWebhookVerificationError\",\n  {\n    reason: Schema.Literals([\n      \"invalid-signature\",\n      \"invalid-event\",\n      \"invalid-payload\",\n      \"payload-too-large\",\n      \"crypto-unavailable\",\n    ]),\n  },\n) {}\n\n/** Host-held webhook secret verification; callers cannot bypass it by supplying parsed JSON. */\nexport class GitHubWebhookSignatureVerifier extends Context.Service<\n  GitHubWebhookSignatureVerifier,\n  {\n    readonly verify: (\n      body: Uint8Array,\n      signature: string,\n    ) => Effect.Effect<void, GitHubWebhookVerificationError>;\n  }\n>()(\"@effect-agent/thread/GitHubWebhookSignatureVerifier\") {}\n\n/** Narrow host WebCrypto capability used for GitHub HMAC-SHA256 verification. */\nexport interface GitHubWebhookSubtleCrypto<Key> {\n  readonly importKey: (\n    format: \"raw\",\n    keyData: ArrayBuffer,\n    algorithm: { readonly name: \"HMAC\"; readonly hash: \"SHA-256\" },\n    extractable: false,\n    usages: [\"verify\"],\n  ) => PromiseLike<Key>;\n  readonly verify: (\n    algorithm: \"HMAC\",\n    key: Key,\n    signature: ArrayBuffer,\n    data: ArrayBuffer,\n  ) => PromiseLike<boolean>;\n}\n\n/** GitHub-compatible HMAC-SHA256 verifier over the exact raw request bytes. */\nexport const webCryptoGitHubWebhookSignatureVerifierLayer = <Key>(\n  secret: Redacted.Redacted<string>,\n  subtle: GitHubWebhookSubtleCrypto<Key>,\n): Layer.Layer<GitHubWebhookSignatureVerifier> =>\n  Layer.effect(\n    GitHubWebhookSignatureVerifier,\n    Effect.sync(() => {\n      const verify = Effect.fn(\"GitHubWebhookSignatureVerifier.verify\")(function* (\n        body: Uint8Array,\n        signature: string,\n      ) {\n        if (!/^sha256=[0-9a-f]{64}$/.test(signature)) {\n          return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" });\n        }\n\n        const signatureBytes = yield* Effect.fromResult(\n          Encoding.decodeHex(signature.slice(\"sha256=\".length)),\n        ).pipe(\n          Effect.mapError(() =>\n            GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" }),\n          ),\n        );\n\n        const keyBytes = new TextEncoder().encode(Redacted.value(secret));\n        const keyBuffer = new ArrayBuffer(keyBytes.byteLength);\n\n        new Uint8Array(keyBuffer).set(keyBytes);\n\n        const key = yield* Effect.tryPromise({\n          try: () =>\n            subtle.importKey(\"raw\", keyBuffer, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\n              \"verify\",\n            ]),\n          catch: () => GitHubWebhookVerificationError.make({ reason: \"crypto-unavailable\" }),\n        });\n\n        const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n\n        new Uint8Array(signatureBuffer).set(signatureBytes);\n        const bodyBuffer = new ArrayBuffer(body.byteLength);\n\n        new Uint8Array(bodyBuffer).set(body);\n\n        const valid = yield* Effect.tryPromise({\n          try: () => subtle.verify(\"HMAC\", key, signatureBuffer, bodyBuffer),\n          catch: () => GitHubWebhookVerificationError.make({ reason: \"crypto-unavailable\" }),\n        });\n\n        if (!valid) {\n          return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" });\n        }\n      });\n\n      return GitHubWebhookSignatureVerifier.of({ verify });\n    }),\n  );\n\nexport interface VerifiedGitHubWorkflowRunWebhookRequest {\n  readonly body: Uint8Array;\n  readonly eventHeader: string | undefined;\n  readonly signatureHeader: string | undefined;\n  readonly principal: Principal;\n}\n\n/**\n * Verify raw ingress, decode only a completed `workflow_run`, and hand its canonical completion to\n * durable intake. The acknowledgement means routing work is retained; it is not a Submission Receipt.\n */\nexport const acceptVerifiedGitHubWorkflowRunWebhook = Effect.fn(\n  \"acceptVerifiedGitHubWorkflowRunWebhook\",\n)(function* (\n  request: VerifiedGitHubWorkflowRunWebhookRequest,\n): Effect.fn.Return<\n  EventAcknowledgement,\n  | GitHubWebhookVerificationError\n  | Effect.Error<ReturnType<SubscriptionIntake[\"Service\"][\"accept\"]>>,\n  GitHubWebhookSignatureVerifier | SubscriptionIntake\n> {\n  if (request.body.byteLength > 1024 * 1024) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"payload-too-large\" });\n  }\n  if (request.eventHeader !== \"workflow_run\" || request.signatureHeader === undefined) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-event\" });\n  }\n  const verifier = yield* GitHubWebhookSignatureVerifier;\n\n  yield* verifier.verify(request.body, request.signatureHeader);\n\n  const text = yield* Effect.try({\n    try: () => new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: false }).decode(request.body),\n    catch: () => GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" }),\n  });\n\n  const webhook = yield* Schema.decodeEffect(Schema.fromJsonString(GitHubWorkflowRunWebhook))(\n    text,\n  ).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" })));\n\n  if (webhook.repository.id !== webhook.workflow_run.repository.id) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" });\n  }\n  if (webhook.workflow_run.status !== \"completed\" || webhook.workflow_run.conclusion === null) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" });\n  }\n\n  const completion = GitHubWorkflowRunCompletion.make({\n    repositoryId: webhook.repository.id,\n    runId: webhook.workflow_run.id,\n    attempt: webhook.workflow_run.run_attempt,\n    headSha: webhook.workflow_run.head_sha,\n    conclusion: webhook.workflow_run.conclusion,\n  });\n\n  const intake = yield* SubscriptionIntake;\n\n  return yield* intake.accept(request.principal, GitHubWorkflowRunSourceVersion, completion);\n});\n"],"mappings":";;;;;;AASA,MAAM,aAAa,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAE3D,MAAM,aAAa,OAAO,eAAe,MACvC,OAAO,YAAY,GAAG,GACtB,OAAO,UAAU,mBAAmB,CACtC;AAEA,MAAM,eAAe,OAAO,OAAO,MAAM,OAAO,UAAU,iCAAiC,CAAC;AAC5F,MAAM,mBAAmB,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;AAC3E,MAAM,eAAe,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;AAEvE,MAAM,UAAgC,WACpC,OAAO,KAAK,OAAO,SAAS,EAAE,cAAc,EAAE,kBAAkB,QAAQ,EAAE,CAAC,CAAC;;AAG9E,MAAa,mBAAmB,OAC9B,OAAO,OAAO;CACZ,IAAI;CACJ,OAAO;CACP,MAAM;AACR,CAAC,CACH;;AAKA,MAAa,yBAAyB,OACpC,OAAO,OAAO;CACZ,OAAO;CACP,SAAS;CACT,iBAAiB;AACnB,CAAC,CACH;;;;;AAQA,MAAa,8BAA8B,OACzC,OAAO,OAAO;CACZ,cAAc;CACd,OAAO;CACP,SAAS;CACT,SAAS;CACT,YAAY;AACd,CAAC,CACH;AAMA,MAAM,wBAAwB,OAAO,OAAO;CAC1C,IAAI;CACJ,aAAa;CACb,UAAU;CACV,QAAQ;CACR,YAAY,OAAO,OAAO,gBAAgB;CAC1C,YAAY,OAAO,OAAO,EAAE,IAAI,WAAW,CAAC;AAC9C,CAAC;AAED,MAAa,2BAA2B,OAAO,OAAO;CACpD,QAAQ,OAAO,QAAQ,WAAW;CAClC,YAAY,OAAO,OAAO,EAAE,IAAI,WAAW,CAAC;CAC5C,cAAc;AAChB,CAAC;AAID,MAAa,2BAA2B;AAGxC,MAAa,iCAAiC;CAC5C,MAAM;CACN,SAAS;AACX;AAEA,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA;CACE,QAAQ,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,WAAW,OAAO;AACpB,CACF,CAAC,CAAC,CAAC;;;;;AAYH,IAAa,qBAAb,cAAwC,QAAQ,QAO9C,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC;AAUhD,MAAM,eACJ,QACA,cAC4B,wBAAwB,KAAK;CAAE;CAAQ;AAAU,CAAC;;;;;AAMhF,MAAa,+BACX,YAEA,MAAM,OACJ,oBACA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO,WAAW;CAEjC,MAAM,sBAAsB,OAAO,OAAO,aAAa,gBAAgB,CAAC,CACtE,QAAQ,UACV,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAAC;CAEpE,MAAM,UAAU,QAAQ,UAAU,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAE7E,MAAM,aAAa,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC5D,SACA;EACA,MAAM,aAAa,OAAO,OAAO,aAAa,gBAAgB,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,KAClF,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAC9D;EAEA,IACE,WAAW,OAAO,oBAAoB,MACtC,WAAW,UAAU,oBAAoB,SACzC,WAAW,SAAS,oBAAoB,MAExC,OAAO,OAAO,YAAY,gBAAgB,KAAK;EAGjD,MAAM,QAAQ,OAAO,OAAO,aAAa,sBAAsB,CAAC,CAAC;GAC/D,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,iBAAiB,IAAI,OAAO,EAAE;EAChC,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAAC;EAErE,MAAM,MAAM,GAAG,OAAO,SAAS,WAAW,MAAM,GAAG,WAAW,KAAK,gBAAgB,OAAO,MAAM,KAAK,EAAE,YAAY,OAAO,MAAM,OAAO;EAEvI,MAAM,WAAW,OAAO,OACrB,QACC,kBAAkB,IAAI,GAAG,CAAC,CAAC,KACzB,kBAAkB,WAAW;GAC3B,QAAQ;GACR,wBAAwB;GACxB,cAAc,QAAQ,aAAa;EACrC,CAAC,GACD,kBAAkB,YAAY,QAAQ,KAAK,CAC7C,CACF,CAAC,CACA,KAAK,OAAO,eAAe,YAAY,eAAe,IAAI,CAAC,CAAC;EAE/D,IACE,SAAS,WAAW,OACnB,SAAS,WAAW,QAClB,SAAS,QAAQ,6BAA6B,OAC7C,SAAS,QAAQ,mBAAmB,KAAA,IAExC,OAAO,OAAO,YAAY,gBAAgB,IAAI;EAEhD,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,OAAO,YAAY,gBAAgB,KAAK;EAEjD,IAAI,SAAS,WAAW,KAAK,OAAO,OAAO,YAAY,aAAa,IAAI;EACxE,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAC9C,OAAO,OAAO,YAAY,eAAe,SAAS,UAAU,GAAG;EAGjE,OAAO,OAAO,SAAS,KAAK,KAC1B,OAAO,eAAe,oBAAoB,aAAa,WAAW,KAAK,OAAW,CAAC,GACnF,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,GAC5D,OAAO,QAAQ,OAAO,oBAAoB,wBAAwB,CAAC,GACnE,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAC9D;CACF,CAAC;CAED,OAAO,mBAAmB,GAAG,EAAE,WAAW,CAAC;AAC7C,CAAC,CACH;AAEF,MAAM,eAAe,MAAc,cACjC,wBAAwB,KAAK;CAAE;CAAM;AAAU,CAAC;AAElD,MAAM,sBAAsB,eAC1B,uBAAuB,OAAO,WAAW,YAAY,EAAE,GAAG,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,WAAW,OAAO,EAAE;AAEnH,MAAM,iBAAiB,cAAsB,UAC3C,uBAAuB,OAAO,YAAY,EAAE,GAAG,OAAO,MAAM,KAAK,EAAE,GAAG,OAAO,MAAM,OAAO,EAAE;AAE9F,MAAM,qBAAqB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC3E,YACA,OACA,MACA;CACA,IACE,KAAK,WAAW,OAAO,WAAW,MAClC,KAAK,OAAO,MAAM,SAClB,KAAK,gBAAgB,MAAM,WAC3B,KAAK,aAAa,MAAM,iBAExB,OAAO,OAAO,YAAY,4BAA4B,KAAK;CAE7D,IAAI,KAAK,WAAW,aAAa,OAAO;CACxC,IAAI,KAAK,eAAe,MACtB,OAAO,OAAO,YAAY,uCAAuC,KAAK;CAGxE,OAAO,4BAA4B,KAAK;EACtC,cAAc,WAAW;EACzB,OAAO,KAAK;EACZ,SAAS,KAAK;EACd,SAAS,KAAK;EACd,YAAY,KAAK;CACnB,CAAC;AACH,CAAC;;;;;AAUD,MAAa,8BAA8B,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAClF,SAC4E;CAC5E,MAAM,aAAa,OAAO,OAAO,aAAa,gBAAgB,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,KAClF,OAAO,eAAe,YAAY,mCAAmC,KAAK,CAAC,CAC7E;CAEA,MAAM,OAAO,OAAO;CAEpB,OAAO,OAAO,gBAAgB;EAC5B,QAAQ;EACR,YACE;EACF,OAAO,4BAA4B,MACjC,OAAO,YAAY,eAAe,WAAW,iBAAiB,WAAW,IAAI,EAC3E,OAAO,yDACT,CAAC,CACH;EACA,YAAY;EACZ,UAAU;EACV,UAAU;EACV,eAAe,UAAU,cAAc,WAAW,IAAI,KAAK;EAC3D,UAAU,YAAY,UACpB,WAAW,iBAAiB,WAAW,MACvC,WAAW,UAAU,MAAM,SAC3B,WAAW,YAAY,MAAM,WAC7B,WAAW,YAAY,MAAM;EAC/B,YAAY,UACV,KAAK,WAAW;GAAE;GAAY,OAAO,MAAM;GAAO,SAAS,MAAM;EAAQ,CAAC,CAAC,CAAC,KAC1E,OAAO,UAAU,UAAU,YAAY,UAAU,MAAM,UAAU,MAAM,SAAS,CAAC,GACjF,OAAO,SAAS,SAAS,mBAAmB,YAAY,OAAO,IAAI,CAAC,CACtE;CACJ,CAAC;AACH,CAAC;AAED,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,iCAAb,cAAoD,QAAQ,QAQ1D,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC;;AAoB5D,MAAa,gDACX,QACA,WAEA,MAAM,OACJ,gCACA,OAAO,WAAW;CAChB,MAAM,SAAS,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAChE,MACA,WACA;EACA,IAAI,CAAC,wBAAwB,KAAK,SAAS,GACzC,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;EAGnF,MAAM,iBAAiB,OAAO,OAAO,WACnC,SAAS,UAAU,UAAU,MAAM,CAAgB,CAAC,CACtD,CAAC,CAAC,KACA,OAAO,eACL,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC,CACrE,CACF;EAEA,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,MAAM,MAAM,CAAC;EAChE,MAAM,YAAY,IAAI,YAAY,SAAS,UAAU;EAErD,IAAI,WAAW,SAAS,CAAC,CAAC,IAAI,QAAQ;EAEtC,MAAM,MAAM,OAAO,OAAO,WAAW;GACnC,WACE,OAAO,UAAU,OAAO,WAAW;IAAE,MAAM;IAAQ,MAAM;GAAU,GAAG,OAAO,CAC3E,QACF,CAAC;GACH,aAAa,+BAA+B,KAAK,EAAE,QAAQ,qBAAqB,CAAC;EACnF,CAAC;EAED,MAAM,kBAAkB,IAAI,YAAY,eAAe,UAAU;EAEjE,IAAI,WAAW,eAAe,CAAC,CAAC,IAAI,cAAc;EAClD,MAAM,aAAa,IAAI,YAAY,KAAK,UAAU;EAElD,IAAI,WAAW,UAAU,CAAC,CAAC,IAAI,IAAI;EAOnC,IAAI,EAAC,OALgB,OAAO,WAAW;GACrC,WAAW,OAAO,OAAO,QAAQ,KAAK,iBAAiB,UAAU;GACjE,aAAa,+BAA+B,KAAK,EAAE,QAAQ,qBAAqB,CAAC;EACnF,CAAC,IAGC,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;CAErF,CAAC;CAED,OAAO,+BAA+B,GAAG,EAAE,OAAO,CAAC;AACrD,CAAC,CACH;;;;;AAaF,MAAa,yCAAyC,OAAO,GAC3D,wCACF,CAAC,CAAC,WACA,SAMA;CACA,IAAI,QAAQ,KAAK,aAAa,SAC5B,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;CAEnF,IAAI,QAAQ,gBAAgB,kBAAkB,QAAQ,oBAAoB,KAAA,GACxE,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,gBAAgB,CAAC;CAI/E,QAAO,OAFiB,+BAAA,CAER,OAAO,QAAQ,MAAM,QAAQ,eAAe;CAE5D,MAAM,OAAO,OAAO,OAAO,IAAI;EAC7B,WAAW,IAAI,YAAY,SAAS;GAAE,OAAO;GAAM,WAAW;EAAM,CAAC,CAAC,CAAC,OAAO,QAAQ,IAAI;EAC1F,aAAa,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAChF,CAAC;CAED,MAAM,UAAU,OAAO,OAAO,aAAa,OAAO,eAAe,wBAAwB,CAAC,CAAC,CACzF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC,CAAC,CAAC;CAEhG,IAAI,QAAQ,WAAW,OAAO,QAAQ,aAAa,WAAW,IAC5D,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAEjF,IAAI,QAAQ,aAAa,WAAW,eAAe,QAAQ,aAAa,eAAe,MACrF,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAGjF,MAAM,aAAa,4BAA4B,KAAK;EAClD,cAAc,QAAQ,WAAW;EACjC,OAAO,QAAQ,aAAa;EAC5B,SAAS,QAAQ,aAAa;EAC9B,SAAS,QAAQ,aAAa;EAC9B,YAAY,QAAQ,aAAa;CACnC,CAAC;CAID,OAAO,QAAO,OAFQ,mBAAA,CAED,OAAO,QAAQ,WAAW,gCAAgC,UAAU;AAC3F,CAAC"}