managed-deepagents 0.10.0-dev.17 → 0.10.0-dev.19

package/dist/channels/delivery.js

@@ -0,0 +1,359 @@
+/**
+ * The run's one delivery step: when the run ends, its answer goes to the
+ * thread's origin, and a paused Trigger run reports what it waits on.
+ *
+ * The run does it, not the process that received the event, so a restart of
+ * that process loses nothing, and a run LangSmith Studio resumes answers the
+ * conversation the paused run came from.
+ *
+ * A scheduled run that starts a new Trigger thread, with its answer or with a
+ * notice that it waits on a decision, hands its own thread to that thread's
+ * conversation, so replies and decisions there continue the run.
+ */
+import { randomUUID } from "node:crypto";
+import { v5 as uuidv5 } from "uuid";
+import { z } from "zod";
+import { THREAD_CONVERSATION_METADATA, originFromBinding, threadRecordMetadata, triggerTargetSchema, } from "../runtime/thread-record.js";
+import { handOffScheduledThread, scheduleExecution, } from "../runtime/schedule-auth.js";
+import { logger } from "../runtime/log.js";
+import { QUIET_REPLY, extractReplyContent, extractReplyText, } from "./assistant-text.js";
+import { channelAutoRepliesForName, channelProviderForName, messagingTransportForName, pausedNoticeForName, } from "./messaging-registry.js";
+import { deliverScheduleResult, getDeploymentId, isTrustedScheduleDeliveryRun, readScheduleDeliverTo, } from "./schedule-delivery.js";
+import { createTriggerClient } from "./trigger/client.js";
+import { resolveTracerSessionId } from "./trigger/tracing-project.js";
+import { createTriggerTransport, startTriggerThread, } from "./trigger/transport.js";
+/** What a new Trigger thread posted when a scheduled run pauses says. */
+export const PAUSED_NOTICE = "This scheduled run is waiting for a decision.";
+/**
+ * Deliver a finished top-level run's result to its thread's origin, or to a
+ * scheduled run's `deliverTo`. A thread with neither gets nothing. The Agent
+ * Server runs every TypeScript graph run on a thread with a checkpointer, a
+ * cron fire without a `thread_id` included, so its state can always be read.
+ *
+ * Failures follow what each channel did before: a Trigger post and any
+ * scheduled delivery fail the run; a direct channel's post is logged and the
+ * run still succeeds.
+ */
+export async function deliverRunResult(graph, run, delivered = {}) {
+    const { thread, origin } = run;
+    if (!thread)
+        return;
+    const delivery = origin ? undefined : scheduledDelivery(delivered);
+    if (!origin && !delivery)
+        return;
+    const deliverTo = delivery?.deliverTo;
+    const opening = openingOf(origin, delivery, delivered);
+    const { runId, subagent } = delivered;
+    const threadId = delivered.runThreadId ?? thread.id;
+    const config = { configurable: { thread_id: threadId } };
+    const state = await graph.getState(config);
+    const interrupts = pendingInterrupts(state);
+    if (interrupts.length) {
+        if (opening) {
+            const opened = await openThread(opening, run, delivered, {
+                text: PAUSED_NOTICE,
+                actionId: runId ? pausedActionId(runId) : randomUUID(),
+            });
+            if (opened)
+                await reportInterrupted(opened, threadId, runId, interrupts);
+        }
+        else if (origin?.transport === "trigger_server")
+            await reportInterrupted(origin, threadId, runId, interrupts);
+        else if (origin)
+            await noticePaused(origin, threadId, delivered.assistantId);
+        return;
+    }
+    // A static breakpoint stopped the run before it finished: no answer yet.
+    if (state.next.length > 0 || subagent)
+        return;
+    // A channel declared with `reply: "none"` leaves replying to the agent.
+    if (origin && !channelAutoRepliesForName(origin.name))
+        return;
+    const values = { messages: messagesOf(state.values) };
+    const boundary = await replyBoundary(graph, config, values.messages);
+    const text = extractReplyText(values, boundary);
+    if (text.trim() === QUIET_REPLY)
+        return;
+    if (opening) {
+        if (text)
+            await openThread(opening, run, delivered, {
+                text,
+                actionId: runId ? replyActionId(runId) : randomUUID(),
+            });
+        return;
+    }
+    if (!origin) {
+        if (deliverTo && text)
+            await deliverToTarget(deliverTo, text);
+        return;
+    }
+    const content = origin.transport === "trigger_server"
+        ? text || null
+        : extractReplyContent(values, boundary);
+    if (content === null)
+        return;
+    const scheduled = origin.event?.type === "schedule";
+    try {
+        await post(origin, content, runId);
+    }
+    catch (error) {
+        if (scheduled || origin.transport === "trigger_server")
+            throw error;
+        // The answer stays in the thread; the run itself succeeded.
+        logger.error(`channel reply failed (${logger.safeErrorLabel(error)})`);
+    }
+}
+/** A compiled schedule's routing: where it delivers, and whether each fire has its own thread. */
+const scheduleRoutingSchema = z.object({
+    deliver_to: z.unknown().optional(),
+    new_thread: z.boolean().optional(),
+});
+/** A trusted cron fire's schedule routing, when it posts its result to `deliverTo`. */
+function scheduledDelivery(delivered) {
+    if (!isTrustedScheduleDeliveryRun(delivered.configurable, delivered.metadata))
+        return undefined;
+    const schedule = scheduleRoutingSchema.safeParse(delivered.routing?.mda_schedule);
+    if (!schedule.success)
+        return undefined;
+    const deliverTo = readScheduleDeliverTo(schedule.data.deliver_to);
+    return deliverTo?.autoPost
+        ? { deliverTo, newThread: schedule.data.new_thread === true }
+        : undefined;
+}
+/**
+ * Where a scheduled run starts a new Trigger thread: a new-thread schedule on
+ * a Trigger channel, or a new-thread `deliverTo` conversation Trigger delivers
+ * to. A schedule with a fixed thread keeps it.
+ */
+function openingOf(origin, delivery, delivered) {
+    if (scheduleExecution(delivered.configurable) === undefined)
+        return undefined;
+    if (origin)
+        return origin.transport === "trigger_server" &&
+            origin.event?.type === "schedule" &&
+            origin.event.new_thread
+            ? { via: "channel", origin }
+            : undefined;
+    return delivery?.newThread === true &&
+        delivery.deliverTo.to.type === "provider_conversation" &&
+        getDeploymentId() !== undefined &&
+        hasTriggerClient()
+        ? { via: "deployment", deliverTo: delivery.deliverTo }
+        : undefined;
+}
+/** Whether Trigger is configured; a malformed setting leaves `deliverTo` its own fallback. */
+function hasTriggerClient() {
+    try {
+        return createTriggerClient() !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Post the first message of a new Trigger thread, then hand the run's thread
+ * to that thread's conversation. Returns the conversation, unless Trigger
+ * could not name the thread it started.
+ */
+async function openThread(opening, run, delivered, { text, actionId }) {
+    const client = createTriggerClient();
+    if (!client)
+        throw new Error("channel delivery is not configured");
+    let started;
+    let name;
+    if (opening.via === "channel") {
+        name = opening.origin.name;
+        started = await startTriggerThread(client, {
+            target: opening.origin.target,
+            text,
+            actionId,
+        });
+    }
+    else {
+        name = opening.deliverTo.channel;
+        const deploymentId = getDeploymentId();
+        if (!deploymentId)
+            throw new Error("channel delivery is not configured");
+        const result = await client.postDeploymentAction(deploymentId, name, {
+            type: "post",
+            action_id: actionId,
+            address: { conversation_id: opening.deliverTo.to.conversationId },
+            follow_thread: true,
+            message: { text },
+        });
+        started = result.thread;
+    }
+    if (!started) {
+        logger.warn("scheduled post started a thread Trigger did not name");
+        return undefined;
+    }
+    const provider = opening.via === "channel"
+        ? opening.origin.provider
+        : (channelProviderForName(name) ?? name);
+    const conversation = {
+        name,
+        provider,
+        transport: "trigger_server",
+        sourceThreadKey: started.source_thread_key,
+        deliveryId: actionId,
+        target: started,
+    };
+    await handOff(run, delivered, conversation);
+    return { ...conversation, event: null };
+}
+/** Make the run's thread the conversation's, keeping its participants. */
+async function handOff(run, delivered, conversation) {
+    const execution = scheduleExecution(delivered.configurable);
+    if (!execution || !run.thread)
+        throw new Error("scheduled thread handoff is unavailable");
+    const record = threadRecordMetadata({
+        origin: originFromBinding(conversation, null),
+        participants: run.thread.participants.map(({ id, role }) => ({ id, role })),
+    });
+    await handOffScheduledThread({
+        thread: run.thread.id,
+        execution,
+        conversation: {
+            provider: conversation.provider,
+            source_thread_key: conversation.sourceThreadKey,
+        },
+    }, { ...record, [THREAD_CONVERSATION_METADATA]: conversation.sourceThreadKey });
+}
+/** Post a `deliverTo` result into an existing conversation; a failure fails the run. */
+async function deliverToTarget(deliverTo, text) {
+    const outcome = await deliverScheduleResult({ deliverTo, replyText: text });
+    if (outcome === "failed")
+        throw new Error("Scheduled channel delivery failed");
+}
+async function post(origin, content, runId) {
+    const newThread = origin.event?.type === "schedule" ? origin.event.new_thread : undefined;
+    const message = { type: "content", content };
+    if (origin.transport === "trigger_server") {
+        const client = createTriggerClient();
+        if (!client)
+            throw new Error("channel delivery is not configured");
+        // A retried run posts its answer once.
+        await createTriggerTransport(client, {
+            actionId: runId ? replyActionId(runId) : randomUUID(),
+        }).post({ message, target: origin.target, newThread });
+        return;
+    }
+    const transport = messagingTransportForName(origin.name);
+    if (!transport)
+        throw new Error(`channel delivery is unavailable: no channel ${JSON.stringify(logger.logIdentifier(origin.name))}`);
+    await transport.post({
+        message,
+        target: origin.target,
+        ...(newThread !== undefined && { newThread }),
+    });
+}
+/** The Trigger post id of a paused run's notice, stable across retries. */
+function pausedActionId(runId) {
+    return uuidv5(`mda-paused:${runId}`, uuidv5.URL);
+}
+/** The Trigger post id for a run's answer, stable across retries. */
+export function replyActionId(runId) {
+    return uuidv5(`mda-reply:${runId}`, uuidv5.URL);
+}
+/**
+ * Where the run's messages start: after the last message of the latest
+ * checkpoint the run's input made. A resume makes none, so it counts from the
+ * paused run's input. Without one, the reply falls back to the answers since
+ * the last user message.
+ */
+async function replyBoundary(graph, config, messages) {
+    let input;
+    for await (const snapshot of graph.getStateHistory(config, {
+        filter: { source: "input" },
+        limit: 1,
+    })) {
+        input = snapshot;
+        break;
+    }
+    // A checkpointer may ignore the filter.
+    if (input?.metadata?.source !== "input")
+        return {};
+    const before = messagesOf(input.values);
+    const afterId = Array.isArray(before) ? messageId(before.at(-1)) : undefined;
+    const final = Array.isArray(messages) ? messages : [];
+    return afterId !== undefined &&
+        final.some((message) => messageId(message) === afterId)
+        ? { afterId }
+        : {};
+}
+/** The `messages` of graph state values, when they are an object. */
+function messagesOf(values) {
+    return isObject(values) ? values.messages : undefined;
+}
+function messageId(message) {
+    const id = isObject(message) ? message.id : undefined;
+    return typeof id === "string" && id ? id : undefined;
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null;
+}
+/** An interrupt Trigger can resume: a non-blank id, with its value. */
+const interruptSchema = z.object({
+    id: z.string().refine((id) => id.trim().length > 0),
+    value: z.unknown(),
+    response_schema: z.unknown().optional(),
+});
+/** The interrupts the run stopped on, as Trigger forwards them. */
+function pendingInterrupts(state) {
+    return state.tasks.flatMap((task) => (task.interrupts ?? []).flatMap((entry) => {
+        const parsed = interruptSchema.safeParse(entry);
+        if (!parsed.success)
+            return [];
+        const { id, value, response_schema: schema } = parsed.data;
+        return [
+            { id, value, ...(isObject(schema) && { response_schema: schema }) },
+        ];
+    }));
+}
+/**
+ * Tell a direct channel's conversation the run waits on a decision, with a
+ * Studio link to this thread, when the channel has such a notice. Best
+ * effort: it never fails the run.
+ */
+async function noticePaused(origin, threadId, assistantId) {
+    const notice = pausedNoticeForName(origin.name);
+    if (!notice)
+        return;
+    try {
+        await notice(origin.target, { threadId, ...(assistantId && { assistantId }) }, "interrupted");
+    }
+    catch (error) {
+        logger.error(`channel paused notice failed (${logger.safeErrorLabel(error)})`);
+    }
+}
+/** Tell Trigger the run waits on a decision. Best effort: it never fails the run. */
+async function reportInterrupted(origin, threadId, runId, interrupts) {
+    const target = triggerTargetSchema.safeParse(origin.target);
+    try {
+        if (!target.success) {
+            logger.warn("channel interrupt was not reported: invalid Trigger target");
+            return;
+        }
+        const client = createTriggerClient();
+        if (!client || !runId) {
+            logger.warn("channel interrupt was not reported: no run or transport");
+            return;
+        }
+        const tracerSessionId = await resolveTracerSessionId();
+        await client.postRuntimeEvent(target.data.channel_id, {
+            id: randomUUID(),
+            type: "run.interrupted",
+            delivery_id: origin.deliveryId,
+            source_thread_key: origin.sourceThreadKey,
+            address: target.data.address,
+            run_thread_id: threadId,
+            run_id: runId,
+            interrupts,
+            ...(tracerSessionId ? { tracer_session_id: tracerSessionId } : {}),
+        });
+    }
+    catch (error) {
+        logger.warn(`channel interrupt was not reported (${logger.safeErrorLabel(error)})`);
+    }
+}
+//# sourceMappingURL=delivery.js.map

package/dist/channels/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../../src/channels/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,4BAA4B,EAC5B,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAYhC,yEAAyE;AACzE,MAAM,CAAC,MAAM,aAAa,GAAG,+CAA+C,CAAC;AAwB7E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAY,EACZ,GAAc,EACd,SAAS,GAAiB,EAAE;IAE5B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO;IACjC,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,IAAI,MAAM,CAAC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;gBACvD,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,MAAM;gBAAE,MAAM,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3E,CAAC;aAAM,IAAI,MAAM,EAAE,SAAS,KAAK,gBAAgB;YAC/C,MAAM,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;aAC1D,IAAI,MAAM;YACb,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,yEAAyE;IACzE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ;QAAE,OAAO;IAC9C,wEAAwE;IACxE,IAAI,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO;IAC9D,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,WAAW;QAAE,OAAO;IACxC,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,IAAI;YACN,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;gBACxC,IAAI;gBACJ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;aACtD,CAAC,CAAC;QACL,OAAO;IACT,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,SAAS,IAAI,IAAI;YAAE,MAAM,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,KAAK,gBAAgB;QACnC,CAAC,CAAC,IAAI,IAAI,IAAI;QACd,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;YAAE,MAAM,KAAK,CAAC;QACpE,4DAA4D;QAC5D,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,uFAAuF;AACvF,SAAS,iBAAiB,CACxB,SAAuB;IAEvB,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAC9C,SAAS,CAAC,OAAO,EAAE,YAAY,CAChC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClE,OAAO,SAAS,EAAE,QAAQ;QACxB,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE;QAC7D,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,MAA0B,EAC1B,QAA8C,EAC9C,SAAuB;IAEvB,IAAI,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9E,IAAI,MAAM;QACR,OAAO,MAAM,CAAC,SAAS,KAAK,gBAAgB;YAC1C,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU;YACjC,MAAM,CAAC,KAAK,CAAC,UAAU;YACvB,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5B,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,QAAQ,EAAE,SAAS,KAAK,IAAI;QACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,KAAK,uBAAuB;QACtD,eAAe,EAAE,KAAK,SAAS;QAC/B,gBAAgB,EAAE;QAClB,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;QACtD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,8FAA8F;AAC9F,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,KAAK,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,GAAc,EACd,SAAuB,EACvB,EAAE,IAAI,EAAE,QAAQ,EAAsC;IAEtD,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,IAAI,OAAyC,CAAC;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3B,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE;YACzC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YAC7B,IAAI;YACJ,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;QACjC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,YAAY,EAAE,IAAI,EAAE;YACnE,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,cAAc,EAAE;YACjE,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,EAAE,IAAI,EAAE;SAClB,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,KAAK,SAAS;QACvB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ;QACzB,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAkB;QAClC,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,gBAAgB;QAC3B,eAAe,EAAE,OAAO,CAAC,iBAAiB;QAC1C,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,OAAO;KAChB,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,OAAO,CACpB,GAAc,EACd,SAAuB,EACvB,YAA2B;IAE3B,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM;QAC3B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,oBAAoB,CAAC;QAClC,MAAM,EAAE,iBAAiB,CAAC,YAAY,EAAE,IAAI,CAAC;QAC7C,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;KAC5E,CAAC,CAAC;IACH,MAAM,sBAAsB,CAC1B;QACE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE;QACrB,SAAS;QACT,YAAY,EAAE;YACZ,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,iBAAiB,EAAE,YAAY,CAAC,eAAe;SAChD;KACF,EACD,EAAE,GAAG,MAAM,EAAE,CAAC,4BAA4B,CAAC,EAAE,YAAY,CAAC,eAAe,EAAE,CAC5E,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,eAAe,CAC5B,SAAsC,EACtC,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,QAAQ;QACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,MAAc,EACd,OAA4D,EAC5D,KAAyB;IAEzB,MAAM,SAAS,GACb,MAAM,CAAC,KAAK,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAkB,EAAE,OAAO,EAAE,CAAC;IACtD,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACnE,uCAAuC;QACvC,MAAM,sBAAsB,CAAC,MAAM,EAAE;YACnC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE;SACtD,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS;QACZ,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CACnG,CAAC;IACJ,MAAM,SAAS,CAAC,IAAI,CAAC;QACnB,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,cAAc,KAAK,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,MAAM,CAAC,aAAa,KAAK,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAY,EACZ,MAA+C,EAC/C,QAAiB;IAEjB,IAAI,KAAgC,CAAC;IACrC,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE;QACzD,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAC3B,KAAK,EAAE,CAAC;KACT,CAAC,EAAE,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC;QACjB,MAAM;IACR,CAAC;IACD,wCAAwC;IACxC,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO,OAAO,KAAK,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC;QACvD,CAAC,CAAC,EAAE,OAAO,EAAE;QACb,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,MAAe;IACjC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,OAAgB;IACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,mEAAmE;AACnE,SAAS,iBAAiB,CAAC,KAAoB;IAC7C,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAClC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAA6B,EAAE;QACnE,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,EAAE;SACpE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,QAAgB,EAChB,WAA+B;IAE/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,CACV,MAAM,CAAC,MAAM,EACb,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,EACjD,aAAa,CACd,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,iCAAiC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,iBAAiB,CAC9B,MAAc,EACd,QAAgB,EAChB,KAAyB,EACzB,UAAqC;IAErC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;QACvD,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;YACpD,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,iBAAiB,EAAE,MAAM,CAAC,eAAe;YACzC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,aAAa,EAAE,QAAQ;YACvB,MAAM,EAAE,KAAK;YACb,UAAU;YACV,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,uCAAuC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACvE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/channels/github/app-setup.d.ts

@@ -0,0 +1,32 @@
+import type { GitHubAppOptions } from "./types.js";
+type PermissionLevel = "read" | "write";
+/** A permission the App asks for, with the handled events that need it. */
+export type AppPermission = {
+    name: string;
+    level: PermissionLevel;
+    /** Empty when the level comes from `app.permissions` or is `metadata`. */
+    events: string[];
+};
+/** What `mda deploy` needs to set up the GitHub App. */
+export type GitHubAppSetup = {
+    /** The handled event keys, such as `issues.opened`. */
+    events: string[];
+    /** The webhook events the App subscribes to, such as `issues`. */
+    webhookEvents: string[];
+    permissions: AppPermission[];
+    /** `owner/name`, lowercased and sorted; absent for every repository. */
+    repositories?: string[];
+};
+/**
+ * The App the channel's handlers and `app` options need. The CLI reads it
+ * from the channel's manifest instead of working it out; the Python runtime
+ * mirrors these rules in `github_app_setup.py`.
+ */
+export declare function githubAppSetup(handlers: object, app: GitHubAppOptions | undefined): GitHubAppSetup;
+/**
+ * The repositories the channel is limited to, lowercased since GitHub names
+ * are case-insensitive. One installation covers them, so they share an owner.
+ */
+export declare function repositoryAllowlist(repositories: readonly string[] | undefined): string[] | undefined;
+export {};
+//# sourceMappingURL=app-setup.d.ts.map

package/dist/channels/github/app-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-setup.d.ts","sourceRoot":"","sources":["../../../src/channels/github/app-setup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,YAAY,CAAC;AAEtE,KAAK,eAAe,GAAG,MAAM,GAAG,OAAO,CAAC;AAgExC,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG;IAC3B,uDAAuD;IACvD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,gBAAgB,GAAG,SAAS,GAChC,cAAc,CAiBhB;AAoDD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAC1C,MAAM,EAAE,GAAG,SAAS,CAiCtB"}

package/dist/channels/github/app-setup.js

@@ -0,0 +1,146 @@
+import { handledEventKeys } from "../http/provider.js";
+/**
+ * The App permission each event needs: read to receive it, write to also
+ * reply where it happened.
+ */
+const EVENT_PERMISSIONS = {
+    "issue_comment.created": { permission: "issues", level: "write" },
+    "issue_comment.edited": { permission: "issues", level: "write" },
+    "issues.edited": { permission: "issues", level: "write" },
+    "issues.labeled": { permission: "issues", level: "write" },
+    "issues.opened": { permission: "issues", level: "write" },
+    "issues.reopened": { permission: "issues", level: "write" },
+    "pull_request.closed": { permission: "pull_requests", level: "write" },
+    "pull_request.converted_to_draft": {
+        permission: "pull_requests",
+        level: "write",
+    },
+    "pull_request.edited": { permission: "pull_requests", level: "write" },
+    "pull_request.labeled": { permission: "pull_requests", level: "write" },
+    "pull_request.opened": { permission: "pull_requests", level: "write" },
+    "pull_request.ready_for_review": {
+        permission: "pull_requests",
+        level: "write",
+    },
+    "pull_request.reopened": { permission: "pull_requests", level: "write" },
+    "pull_request.synchronize": { permission: "pull_requests", level: "write" },
+    "pull_request_review.dismissed": {
+        permission: "pull_requests",
+        level: "write",
+    },
+    "pull_request_review.edited": {
+        permission: "pull_requests",
+        level: "write",
+    },
+    "pull_request_review.submitted": {
+        permission: "pull_requests",
+        level: "write",
+    },
+    "pull_request_review_comment.created": {
+        permission: "pull_requests",
+        level: "write",
+    },
+    "pull_request_review_comment.edited": {
+        permission: "pull_requests",
+        level: "write",
+    },
+    "check_run.completed": { permission: "checks", level: "read" },
+    "check_suite.completed": { permission: "checks", level: "read" },
+    push: { permission: "contents", level: "read" },
+    status: { permission: "statuses", level: "read" },
+    "workflow_run.completed": { permission: "actions", level: "read" },
+};
+const MAX_PERMISSIONS = 50;
+/** Keeps the App manifest and the deploy report readable. */
+const MAX_REPOSITORIES = 500;
+const PERMISSION_NAME = /^[a-z][a-z_]{0,63}$/;
+const GITHUB_LOGIN = /^(?!-)(?!.*--)[A-Za-z0-9-]{1,39}(?<!-)$/;
+const REPOSITORY_NAME = /^[A-Za-z0-9._-]{1,100}$/;
+/**
+ * The App the channel's handlers and `app` options need. The CLI reads it
+ * from the channel's manifest instead of working it out; the Python runtime
+ * mirrors these rules in `github_app_setup.py`.
+ */
+export function githubAppSetup(handlers, app) {
+    const events = handledEventKeys(handlers).filter(isSupportedEventKey);
+    // A misspelled option would silently widen what the agent's token reaches.
+    const unknown = Object.keys(app ?? {}).filter((key) => key !== "permissions" && key !== "repositories");
+    if (unknown.length)
+        throw new TypeError(`unknown GitHub app option ${unknown.join(", ")}; use permissions or repositories`);
+    const repositories = repositoryAllowlist(app?.repositories);
+    return {
+        events,
+        webhookEvents: [...new Set(events.map((key) => key.split(".")[0]))].sort(),
+        permissions: appPermissions(events, app?.permissions ?? {}),
+        ...(repositories && { repositories }),
+    };
+}
+function isSupportedEventKey(key) {
+    return Object.hasOwn(EVENT_PERMISSIONS, key);
+}
+/**
+ * Every App gets `metadata: read`; each handled event raises its permission
+ * to the level it needs, and `app.permissions` can raise it further.
+ */
+function appPermissions(events, extra) {
+    checkPermissions(extra);
+    const permissions = new Map([
+        ["metadata", { name: "metadata", level: "read", events: [] }],
+    ]);
+    for (const key of events) {
+        const { permission, level } = EVENT_PERMISSIONS[key];
+        const current = permissions.get(permission);
+        if (!current || (current.level === "read" && level === "write"))
+            permissions.set(permission, { name: permission, level, events: [key] });
+        else if (current.level === level)
+            current.events.push(key);
+    }
+    for (const [name, level] of Object.entries(extra)) {
+        const current = permissions.get(name);
+        if (!current || (current.level === "read" && level === "write"))
+            permissions.set(name, { name, level, events: [] });
+    }
+    return [...permissions.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/** JavaScript callers can pass anything, so check what types promise. */
+function checkPermissions(permissions) {
+    const names = Object.keys(permissions).sort();
+    if (names.length > MAX_PERMISSIONS)
+        throw new TypeError(`GitHub app.permissions must list at most ${MAX_PERMISSIONS} permissions`);
+    for (const name of names) {
+        if (!PERMISSION_NAME.test(name))
+            throw new TypeError(`GitHub app.permissions has an invalid permission name '${name}'; use GitHub's names, such as contents`);
+        if (permissions[name] !== "read" && permissions[name] !== "write")
+            throw new TypeError(`GitHub app.permissions.${name} must be read or write`);
+    }
+}
+/**
+ * The repositories the channel is limited to, lowercased since GitHub names
+ * are case-insensitive. One installation covers them, so they share an owner.
+ */
+export function repositoryAllowlist(repositories) {
+    if (repositories === undefined)
+        return undefined;
+    // An empty list could mean "none" or "all"; neither should be silent.
+    if (repositories.length === 0)
+        throw new TypeError("GitHub app.repositories must list at least one repository; omit it to allow every repository");
+    const valid = new Set();
+    for (const entry of repositories) {
+        const repository = entry.trim();
+        const [owner = "", name = "", ...rest] = repository.split("/");
+        if (rest.length > 0 ||
+            !GITHUB_LOGIN.test(owner) ||
+            !REPOSITORY_NAME.test(name) ||
+            name === "." ||
+            name === "..")
+            throw new TypeError(`GitHub app.repositories entry '${repository}' must be owner/name`);
+        valid.add(repository.toLowerCase());
+    }
+    if (valid.size > MAX_REPOSITORIES)
+        throw new TypeError(`GitHub app.repositories must list at most ${MAX_REPOSITORIES} repositories`);
+    const owners = [...new Set([...valid].map((r) => r.split("/")[0]))].sort();
+    if (owners.length > 1)
+        throw new TypeError(`GitHub app.repositories must all belong to one owner, because one installation covers them (found: ${owners.join(", ")})`);
+    return [...valid].sort();
+}
+//# sourceMappingURL=app-setup.js.map

package/dist/channels/github/app-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-setup.js","sourceRoot":"","sources":["../../../src/channels/github/app-setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAKvD;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,uBAAuB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IACjE,sBAAsB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IAChE,eAAe,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IACzD,gBAAgB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IAC1D,eAAe,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IACzD,iBAAiB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE;IAC3D,qBAAqB,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;IACtE,iCAAiC,EAAE;QACjC,UAAU,EAAE,eAAe;QAC3B,KAAK,EAAE,OAAO;KACf;IACD,qBAAqB,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;IACtE,sBAAsB,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;IACvE,qBAAqB,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;IACtE,+BAA+B,EAAE;QAC/B,UAAU,EAAE,eAAe;QAC3B,KAAK,EAAE,OAAO;KACf;IACD,uBAAuB,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;IACxE,0BAA0B,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;IAC3E,+BAA+B,EAAE;QAC/B,UAAU,EAAE,eAAe;QAC3B,KAAK,EAAE,OAAO;KACf;IACD,4BAA4B,EAAE;QAC5B,UAAU,EAAE,eAAe;QAC3B,KAAK,EAAE,OAAO;KACf;IACD,+BAA+B,EAAE;QAC/B,UAAU,EAAE,eAAe;QAC3B,KAAK,EAAE,OAAO;KACf;IACD,qCAAqC,EAAE;QACrC,UAAU,EAAE,eAAe;QAC3B,KAAK,EAAE,OAAO;KACf;IACD,oCAAoC,EAAE;QACpC,UAAU,EAAE,eAAe;QAC3B,KAAK,EAAE,OAAO;KACf;IACD,qBAAqB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;IAC9D,uBAAuB,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;IAChE,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;IAC/C,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE;IACjD,wBAAwB,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;CAInE,CAAC;AAEF,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAqBlD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,GAAiC;IAEjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtE,2EAA2E;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,cAAc,CACzD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,IAAI,SAAS,CACjB,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC,CACnF,CAAC;IACJ,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO;QACL,MAAM;QACN,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC3E,WAAW,EAAE,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,MAAoC,EACpC,KAAgD;IAEhD,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAwB;QACjD,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;KAC9D,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC;YAC7D,WAAW,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aACrE,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC;YAC7D,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,WAA6C;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;QAChC,MAAM,IAAI,SAAS,CACjB,4CAA4C,eAAe,cAAc,CAC1E,CAAC;IACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,MAAM,IAAI,SAAS,CACjB,0DAA0D,IAAI,yCAAyC,CACxG,CAAC;QACJ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,OAAO;YAC/D,MAAM,IAAI,SAAS,CACjB,0BAA0B,IAAI,wBAAwB,CACvD,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAA2C;IAE3C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,sEAAsE;IACtE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM,IAAI,SAAS,CACjB,8FAA8F,CAC/F,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/D,IACE,IAAI,CAAC,MAAM,GAAG,CAAC;YACf,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YACzB,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,IAAI,KAAK,GAAG;YACZ,IAAI,KAAK,IAAI;YAEb,MAAM,IAAI,SAAS,CACjB,kCAAkC,UAAU,sBAAsB,CACnE,CAAC;QACJ,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,GAAG,gBAAgB;QAC/B,MAAM,IAAI,SAAS,CACjB,6CAA6C,gBAAgB,eAAe,CAC7E,CAAC;IACJ,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QACnB,MAAM,IAAI,SAAS,CACjB,sGAAsG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3H,CAAC;IACJ,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/channels/github/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/channels/github/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,WAAW,EAKjB,MAAM,kBAAkB,CAAC;AA+B1B,OAAO,KAAK,EAEV,oBAAoB,EAIrB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAWpB,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,WAAW,CAwD7E;AAoDD,qDAAqD;AACrD,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/channels/github/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,WAAW,EAKjB,MAAM,kBAAkB,CAAC;AA+B1B,OAAO,KAAK,EACV,oBAAoB,EAIrB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAWpB,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,WAAW,CA+C7E;AA2CD,qDAAqD;AACrD,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}