managed-deepagents 0.4.0-dev.72 → 0.4.0

package/dist/channels/github/define.js

@@ -0,0 +1,166 @@
+/**
+ * `defineGitHubChannel` — declarative GitHub App webhook channel authoring.
+ *
+ * Authors declare **handlers** (event filter + optional repo scope + `prompt`).
+ * `instructions.md` remains the agent system prompt; each handler's `prompt`
+ * builds the human message for that webhook turn.
+ *
+ * MDA does **not** ship copies of GitHub webhook payload types. Prefer
+ * [`@octokit/webhooks-types`](https://www.npmjs.com/package/@octokit/webhooks-types)
+ * in the agent project and narrow {@link GitHubWebhookPromptEvent.payload}:
+ *
+ * @example
+ * ```ts
+ * import type { PullRequestOpenedEvent } from "@octokit/webhooks-types";
+ *
+ * prompt(event) {
+ *   const pr = event.payload as PullRequestOpenedEvent;
+ *   return `Review ${pr.pull_request.title}`;
+ * }
+ * ```
+ */
+import { defineChannel, } from "../plugin.js";
+import { githubChannelAdapter } from "./adapter-core.js";
+/** Env vars for Phase 1 single-install GitHub App webhooks. */
+export const GITHUB_CHANNEL_REQUIRED_ENV = [
+    "GITHUB_WEBHOOK_SECRET",
+    "GITHUB_APP_ID",
+    "GITHUB_APP_PRIVATE_KEY",
+    "GITHUB_INSTALLATION_ID",
+];
+/**
+ * Declare a managed GitHub channel. Files under `channels/*.ts` export a named
+ * `channel` created with this helper.
+ *
+ * @param config - Handlers that map webhook events to agent turns.
+ */
+export function defineGitHubChannel(config) {
+    const normalized = validateAndNormalize(config);
+    return defineChannel({
+        provider: "github",
+        adapter: githubChannelAdapter,
+        config: normalized,
+        toManifest: () => toGitHubChannelManifest(normalized),
+    });
+}
+/**
+ * GitHub App permissions implied by handlers.
+ *
+ * Auto-reply comments need `issues:write`. Contents/metadata reads are declared
+ * broadly so arbitrary webhook handlers can inspect payloads; tighten App
+ * permissions in GitHub settings to match what you actually use.
+ */
+export function requiredGitHubPermissions(config) {
+    const perms = new Set(["metadata:read"]);
+    for (const handler of config.handlers) {
+        if (handler.autoReply) {
+            perms.add("issues:write");
+            perms.add("pull_requests:read");
+        }
+    }
+    return [...perms].sort();
+}
+/**
+ * Build author-supplied deploy fields for a GitHub channel.
+ *
+ * `name` and `provider` are stamped by {@link defineChannel} / `toManifest(name)`.
+ */
+export function toGitHubChannelManifest(definition) {
+    const config = "config" in definition && definition.config
+        ? definition.config
+        : definition;
+    const handlers = config.handlers.map((handler) => ({
+        on: handler.on,
+        repositories: handler.repositories,
+        autoReply: handler.autoReply,
+    }));
+    const triggers = [...new Set(handlers.map((h) => h.on))];
+    const anyAutoReply = handlers.some((h) => h.autoReply);
+    return {
+        autoReply: anyAutoReply,
+        requiredPermissions: requiredGitHubPermissions(config),
+        requiredEnv: [...GITHUB_CHANNEL_REQUIRED_ENV],
+        providerConfig: {
+            triggers,
+            handlers: handlers,
+        },
+    };
+}
+/**
+ * Whether a handler `on` filter matches a delivery.
+ *
+ * @param on - `"*"`, `"pull_request"`, or `"pull_request.opened"`
+ * @param eventName - `X-GitHub-Event`
+ * @param action - `payload.action` when present
+ */
+export function githubTriggerMatches(on, eventName, action) {
+    if (!on || !eventName)
+        return false;
+    if (on === "*")
+        return true;
+    if (on === eventName)
+        return true;
+    if (action !== undefined && on === `${eventName}.${action}`)
+        return true;
+    return false;
+}
+/**
+ * Find the first handler that matches event/action + repository.
+ *
+ * @returns The handler, or `undefined` when no handler matches (event ignored).
+ */
+export function matchGitHubHandler(config, eventName, repository, action) {
+    for (const handler of config.handlers) {
+        if (!githubTriggerMatches(handler.on, eventName, action))
+            continue;
+        const repos = handler.repositories;
+        if (repos && repos.length > 0) {
+            if (!repository || !repos.includes(repository))
+                continue;
+        }
+        return handler;
+    }
+    return undefined;
+}
+function validateAndNormalize(config) {
+    if (config === null || typeof config !== "object") {
+        throw new Error("defineGitHubChannel(...) requires a configuration object.");
+    }
+    if (!Array.isArray(config.handlers) || config.handlers.length === 0) {
+        throw new Error("defineGitHubChannel(...) requires a non-empty `handlers` array.");
+    }
+    const handlers = [];
+    for (let i = 0; i < config.handlers.length; i++) {
+        const raw = config.handlers[i];
+        if (raw === null || typeof raw !== "object") {
+            throw new Error(`defineGitHubChannel(...) handlers[${i}] must be an object.`);
+        }
+        if (typeof raw.on !== "string" || raw.on.trim().length === 0) {
+            throw new Error(`defineGitHubChannel(...) handlers[${i}].on must be a non-empty string ` +
+                '(e.g. "pull_request", "pull_request.opened", or "*").');
+        }
+        if (typeof raw.prompt !== "function") {
+            throw new Error(`defineGitHubChannel(...) handlers[${i}] requires a \`prompt\` function.`);
+        }
+        const autoReply = raw.autoReply ?? true;
+        if (typeof autoReply !== "boolean") {
+            throw new Error(`defineGitHubChannel(...) handlers[${i}].autoReply must be a boolean.`);
+        }
+        let repositories;
+        if (raw.repositories !== undefined) {
+            if (!Array.isArray(raw.repositories) ||
+                raw.repositories.some((v) => typeof v !== "string")) {
+                throw new Error(`defineGitHubChannel(...) handlers[${i}].repositories must be an array of strings.`);
+            }
+            repositories = [...raw.repositories];
+        }
+        handlers.push({
+            on: raw.on.trim(),
+            repositories,
+            autoReply,
+            prompt: raw.prompt,
+        });
+    }
+    return { handlers };
+}
+//# sourceMappingURL=define.js.map

package/dist/channels/github/define.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.js","sourceRoot":"","sources":["../../../src/channels/github/define.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,aAAa,GAGd,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAqJzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,uBAAuB;IACvB,eAAe;IACf,wBAAwB;IACxB,wBAAwB;CAChB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA2B;IAE3B,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC;QACnB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,oBAAoB;QAC7B,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,UAAU,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAmC;IAEnC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAiE;IAEjE,MAAM,MAAM,GACV,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM;QACzC,CAAC,CAAC,UAAU,CAAC,MAAM;QACnB,CAAC,CAAE,UAA0C,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAClC,CAAC,OAAO,EAAgC,EAAE,CAAC,CAAC;QAC1C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,mBAAmB,EAAE,yBAAyB,CAAC,MAAM,CAAC;QACtD,WAAW,EAAE,CAAC,GAAG,2BAA2B,CAAC;QAC7C,cAAc,EAAE;YACd,QAAQ;YACR,QAAQ,EAAE,QAAgC;SAC3C;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,EAAU,EACV,SAAiB,EACjB,MAAe;IAEf,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,GAAG,SAAS,IAAI,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAmC,EACnC,SAAiB,EACjB,UAA8B,EAC9B,MAAe;IAEf,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC;YAAE,SAAS;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;QACnC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,SAAS;QAC3D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAA2B;IAE3B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,sBAAsB,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,kCAAkC;gBACtE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,mCAAmC,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,gCAAgC,CACvE,CAAC;QACJ,CAAC;QACD,IAAI,YAA2C,CAAC;QAChD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACnC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;gBAChC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC5D,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,qCAAqC,CAAC,6CAA6C,CACpF,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;YACjB,YAAY;YACZ,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/dist/channels/github/http.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Managed GitHub App webhook HTTP handler + agent runner.
+ */
+import { InMemoryChannelStore } from "../store.js";
+import { invokeChannelAgent } from "../slack/http.js";
+import type { GitHubChannelDefinition, RequiredGitHubChannelConfig } from "./define.js";
+export interface GitHubChannelHttpConfig {
+    name: string;
+    config: RequiredGitHubChannelConfig;
+    /** Live channel definition (preferred); supplies handlers with `prompt`. */
+    definition?: GitHubChannelDefinition;
+    store?: InMemoryChannelStore;
+    schedule?: (work: () => Promise<void>) => void;
+    invokeAgent?: typeof invokeChannelAgent;
+    rawBody?: string | Uint8Array;
+    webhookSecret?: string;
+    installationId?: string;
+    assistantId?: string;
+    deploymentId?: string;
+}
+/**
+ * Handle `POST /channels/{name}/events` for a GitHub App webhook.
+ */
+export declare function handleGitHubEventsRequest(request: Request, channel: GitHubChannelHttpConfig): Promise<Response>;
+//# sourceMappingURL=http.d.ts.map

package/dist/channels/github/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/channels/github/http.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAOnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,aAAa,CAAC;AAgBrB,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,2BAA2B,CAAC;IACpC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAC/C,WAAW,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,QAAQ,CAAC,CAqJnB"}

package/dist/channels/github/http.js

@@ -0,0 +1,147 @@
+/**
+ * Managed GitHub App webhook HTTP handler + agent runner.
+ */
+import { ChannelError } from "../errors.js";
+import { InMemoryChannelStore } from "../store.js";
+import { clearFinalPosted, wasDeliveryFinalPosted, } from "../binding.js";
+import { createRuntimeChannel } from "../runtime.js";
+import { invokeChannelAgent } from "../slack/http.js";
+import { GITHUB_WEBHOOK_SECRET_ENV, normalizeGitHubEvent, verifyGitHubWebhookSignature, } from "./normalize.js";
+import { createGitHubAppTransport, GITHUB_APP_ID_ENV, GITHUB_APP_PRIVATE_KEY_ENV, GITHUB_INSTALLATION_ID_ENV, } from "./transport.js";
+const DEFAULT_ASSISTANT_ID = "agent";
+const defaultStore = new InMemoryChannelStore();
+/**
+ * Handle `POST /channels/{name}/events` for a GitHub App webhook.
+ */
+export async function handleGitHubEventsRequest(request, channel) {
+    const secret = channel.webhookSecret ?? process.env[GITHUB_WEBHOOK_SECRET_ENV] ?? "";
+    const rawBody = channel.rawBody ?? (await request.text());
+    const signature = request.headers.get("x-hub-signature-256") ?? "";
+    try {
+        verifyGitHubWebhookSignature(rawBody, signature, secret);
+    }
+    catch (error) {
+        if (error instanceof ChannelError) {
+            return jsonError(401, error.message);
+        }
+        throw error;
+    }
+    let body;
+    try {
+        const text = typeof rawBody === "string" ? rawBody : new TextDecoder().decode(rawBody);
+        body = JSON.parse(text);
+    }
+    catch {
+        return jsonError(400, "invalid JSON body");
+    }
+    const eventName = request.headers.get("x-github-event") ?? "";
+    const deliveryHeader = request.headers.get("x-github-delivery") ?? "";
+    const installationId = channel.installationId ?? process.env[GITHUB_INSTALLATION_ID_ENV] ?? "";
+    const config = channel.definition?.config ?? channel.config;
+    const normalized = normalizeGitHubEvent(body, { eventName, deliveryId: deliveryHeader || cryptoRandom() }, config, installationId);
+    const store = channel.store ?? defaultStore;
+    const deploymentId = channel.deploymentId ?? "local";
+    if (normalized.ignored) {
+        store.acceptDelivery({
+            deploymentId,
+            channelDefinitionId: channel.name,
+            provider: "github",
+            apiAppId: installationId,
+            eventId: normalized.event.eventId,
+            sourceThreadKey: normalized.sourceThreadKey || "ignored",
+            status: "filtered",
+            filterReason: "event_filtered",
+            event: normalized.event,
+        });
+        return new Response("", { status: 202 });
+    }
+    const { delivery, duplicate } = store.acceptDelivery({
+        deploymentId,
+        channelDefinitionId: channel.name,
+        provider: "github",
+        apiAppId: installationId,
+        eventId: normalized.event.eventId,
+        sourceThreadKey: normalized.sourceThreadKey,
+        status: "accepted",
+        event: normalized.event,
+    });
+    if (duplicate) {
+        return new Response("", { status: 202 });
+    }
+    const schedule = channel.schedule ??
+        ((work) => {
+            work().catch((error) => {
+                console.error(`[mda] channel "${channel.name}" delivery ${delivery.deliveryId} failed:`, error);
+            });
+        });
+    const invoke = channel.invokeAgent ?? invokeChannelAgent;
+    const actorId = `github-app:${installationId || "unknown"}`;
+    // Auto-reply needs owner/repo#N for the installation comment transport.
+    const conversationId = normalized.event.address.conversationId ?? "";
+    const canComment = /^[^/]+\/[^#]+#\d+$/.test(conversationId);
+    const autoReply = (normalized.handler?.autoReply ?? true) && canComment;
+    schedule(async () => {
+        clearFinalPosted(delivery.deliveryId);
+        delivery.status = "running";
+        delivery.updatedAt = new Date().toISOString();
+        const binding = {
+            name: channel.name,
+            provider: "github",
+            event: normalized.event,
+            address: normalized.event.address,
+            autoReply,
+            deliveryId: delivery.deliveryId,
+        };
+        const text = normalized.event.message?.text?.trim() ?? "";
+        if (!text) {
+            delivery.status = "delivered";
+            delivery.updatedAt = new Date().toISOString();
+            return;
+        }
+        const result = await invoke({
+            actorId,
+            sourceThreadKey: normalized.sourceThreadKey,
+            binding,
+            text,
+            assistantId: channel.assistantId ?? DEFAULT_ASSISTANT_ID,
+            sourceProvider: "github",
+        });
+        if (autoReply &&
+            !wasDeliveryFinalPosted(delivery.deliveryId) &&
+            result.replyText.trim().length > 0) {
+            const transport = transportFromEnv();
+            if (!transport) {
+                throw new ChannelError("channel_run_failed", "auto-reply requires GitHub App credentials (GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY, GITHUB_INSTALLATION_ID)");
+            }
+            const runtimeChannel = createRuntimeChannel({
+                name: channel.name,
+                provider: "github",
+                event: normalized.event,
+                address: normalized.event.address,
+                capabilities: { update: false },
+                transport,
+                onFinalPosted: () => undefined,
+            });
+            const posted = await runtimeChannel.post({ text: result.replyText }, { final: true });
+            delivery.outboundMessageIds.push(posted.id);
+        }
+        delivery.status = "delivered";
+        delivery.updatedAt = new Date().toISOString();
+    });
+    return new Response("", { status: 202 });
+}
+function transportFromEnv() {
+    const appId = process.env[GITHUB_APP_ID_ENV] ?? "";
+    const privateKey = process.env[GITHUB_APP_PRIVATE_KEY_ENV] ?? "";
+    const installationId = process.env[GITHUB_INSTALLATION_ID_ENV] ?? "";
+    if (!appId || !privateKey || !installationId)
+        return undefined;
+    return createGitHubAppTransport({ appId, privateKey, installationId });
+}
+function jsonError(status, message) {
+    return Response.json({ error: message }, { status });
+}
+function cryptoRandom() {
+    return globalThis.crypto?.randomUUID?.() ?? `delivery-${Date.now()}`;
+}
+//# sourceMappingURL=http.js.map

package/dist/channels/github/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/channels/github/http.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,gBAAgB,EAEhB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAKtD,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAExB,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAiBhD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,OAAgC;IAEhC,MAAM,MAAM,GACV,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;IACnE,IAAI,CAAC;QACH,4BAA4B,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;IAE1E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAC5D,MAAM,UAAU,GAAG,oBAAoB,CACrC,IAAI,EACJ,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,IAAI,YAAY,EAAE,EAAE,EAC3D,MAAM,EACN,cAAc,CACf,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC;IAErD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,CAAC,cAAc,CAAC;YACnB,YAAY;YACZ,mBAAmB,EAAE,OAAO,CAAC,IAAI;YACjC,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;YACjC,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,SAAS;YACxD,MAAM,EAAE,UAAU;YAClB,YAAY,EAAE,gBAAgB;YAC9B,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC;QACnD,YAAY;QACZ,mBAAmB,EAAE,OAAO,CAAC,IAAI;QACjC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;QACjC,eAAe,EAAE,UAAU,CAAC,eAAe;QAC3C,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC,CAAC;IACH,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ;QAChB,CAAC,CAAC,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC9B,OAAO,CAAC,KAAK,CACX,kBAAkB,OAAO,CAAC,IAAI,cAAc,QAAQ,CAAC,UAAU,UAAU,EACzE,KAAK,CACN,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACzD,MAAM,OAAO,GAAG,cAAc,cAAc,IAAI,SAAS,EAAE,CAAC;IAC5D,wEAAwE;IACxE,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IACrE,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,UAAU,CAAC;IAExE,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtC,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC;QAC5B,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,OAAO,GAAmB;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;YACjC,SAAS;YACT,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC;QAEF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC;YAC9B,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC1B,OAAO;YACP,eAAe,EAAE,UAAU,CAAC,eAAe;YAC3C,OAAO;YACP,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,oBAAoB;YACxD,cAAc,EAAE,QAAQ;SACzB,CAAC,CAAC;QAEH,IACE,SAAS;YACT,CAAC,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC5C,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAClC,CAAC;YACD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,4GAA4G,CAC7G,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAG,oBAAoB,CAAC;gBAC1C,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;gBACjC,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;gBAC/B,SAAS;gBACT,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS;aAC/B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CACtC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,EAC1B,EAAE,KAAK,EAAE,IAAI,EAAE,CAChB,CAAC;YACF,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,QAAQ,CAAC,MAAM,GAAG,WAAW,CAAC;QAC9B,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,wBAAwB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACvE,CAAC"}

package/dist/channels/github/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * GitHub App webhook channel integration.
+ */
+export { defineGitHubChannel, githubTriggerMatches, matchGitHubHandler, requiredGitHubPermissions, toGitHubChannelManifest, GITHUB_CHANNEL_REQUIRED_ENV, } from "./define.js";
+export type { GitHubChannelConfig, GitHubChannelDefinition, GitHubChannelHandler, GitHubChannelHandlerManifest, GitHubChannelTrigger, GitHubWebhookPromptEvent, RequiredGitHubChannelConfig, RequiredGitHubChannelHandler, } from "./define.js";
+export { verifyGitHubWebhookSignature, normalizeGitHubEvent, extractIssueOrPullNumber, GITHUB_WEBHOOK_SECRET_ENV, } from "./normalize.js";
+export { createGitHubAppTransport, GITHUB_APP_ID_ENV, GITHUB_APP_PRIVATE_KEY_ENV, GITHUB_INSTALLATION_ID_ENV, } from "./transport.js";
+export { encodeGitHubSourceThreadKey, decodeGitHubSourceThreadKey, } from "./source-thread.js";
+export { handleGitHubEventsRequest } from "./http.js";
+export type { GitHubChannelHttpConfig } from "./http.js";
+export { githubChannelAdapter, githubConfigFromManifest } from "./adapter.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/channels/github/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/channels/github/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,YAAY,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC"}

package/dist/channels/github/index.js

@@ -0,0 +1,10 @@
+/**
+ * GitHub App webhook channel integration.
+ */
+export { defineGitHubChannel, githubTriggerMatches, matchGitHubHandler, requiredGitHubPermissions, toGitHubChannelManifest, GITHUB_CHANNEL_REQUIRED_ENV, } from "./define.js";
+export { verifyGitHubWebhookSignature, normalizeGitHubEvent, extractIssueOrPullNumber, GITHUB_WEBHOOK_SECRET_ENV, } from "./normalize.js";
+export { createGitHubAppTransport, GITHUB_APP_ID_ENV, GITHUB_APP_PRIVATE_KEY_ENV, GITHUB_INSTALLATION_ID_ENV, } from "./transport.js";
+export { encodeGitHubSourceThreadKey, decodeGitHubSourceThreadKey, } from "./source-thread.js";
+export { handleGitHubEventsRequest } from "./http.js";
+export { githubChannelAdapter, githubConfigFromManifest } from "./adapter.js";
+//# sourceMappingURL=index.js.map

package/dist/channels/github/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/channels/github/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AAYrB,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAGtD,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC"}

package/dist/channels/github/normalize.d.ts

@@ -0,0 +1,32 @@
+/**
+ * GitHub App webhook verify + normalize into {@link ChannelEvent}.
+ */
+import type { ChannelEvent } from "../types.js";
+import type { GitHubWebhookPromptEvent, RequiredGitHubChannelConfig, RequiredGitHubChannelHandler } from "./define.js";
+export declare const GITHUB_WEBHOOK_SECRET_ENV = "GITHUB_WEBHOOK_SECRET";
+export interface GitHubNormalizeResult {
+    event: ChannelEvent;
+    sourceThreadKey: string;
+    trigger: string;
+    ignored?: boolean;
+    /** Matched handler when the event is accepted (live `prompt` included). */
+    handler?: RequiredGitHubChannelHandler;
+    /** Envelope passed to {@link RequiredGitHubChannelHandler.prompt}. */
+    promptEvent?: GitHubWebhookPromptEvent;
+}
+/**
+ * Verify `X-Hub-Signature-256` against the raw body before parsing JSON.
+ */
+export declare function verifyGitHubWebhookSignature(rawBody: string | Uint8Array, signatureHeader: string, secret: string): void;
+/**
+ * Normalize a verified GitHub webhook payload into a {@link ChannelEvent}.
+ *
+ * Accepts any `X-GitHub-Event`. Returns `ignored: true` when no handler matches.
+ */
+export declare function normalizeGitHubEvent(body: unknown, headers: {
+    eventName: string;
+    deliveryId: string;
+}, config: RequiredGitHubChannelConfig, installationIdFallback?: string): GitHubNormalizeResult;
+/** Best-effort issue/PR number from common webhook payload shapes. */
+export declare function extractIssueOrPullNumber(payload: Record<string, unknown>): number | undefined;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/channels/github/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../src/channels/github/normalize.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,aAAa,CAAC;AAIrB,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,YAAY,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,4BAA4B,CAAC;IACvC,sEAAsE;IACtE,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,IAAI,CA0BN;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,EACD,MAAM,EAAE,2BAA2B,EACnC,sBAAsB,CAAC,EAAE,MAAM,GAC9B,qBAAqB,CAgGvB;AAED,sEAAsE;AACtE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,GAAG,SAAS,CAMpB"}

package/dist/channels/github/normalize.js

@@ -0,0 +1,152 @@
+/**
+ * GitHub App webhook verify + normalize into {@link ChannelEvent}.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { randomUUID } from "node:crypto";
+import { ChannelError } from "../errors.js";
+import { matchGitHubHandler } from "./define.js";
+import { encodeGitHubSourceThreadKey } from "./source-thread.js";
+export const GITHUB_WEBHOOK_SECRET_ENV = "GITHUB_WEBHOOK_SECRET";
+/**
+ * Verify `X-Hub-Signature-256` against the raw body before parsing JSON.
+ */
+export function verifyGitHubWebhookSignature(rawBody, signatureHeader, secret) {
+    if (!secret) {
+        throw new ChannelError("channel_provider_rejected", "GitHub webhook secret is not configured");
+    }
+    const expectedPrefix = "sha256=";
+    if (!signatureHeader.startsWith(expectedPrefix)) {
+        throw new ChannelError("channel_invalid_signature", "missing or invalid X-Hub-Signature-256");
+    }
+    const body = typeof rawBody === "string" ? Buffer.from(rawBody) : Buffer.from(rawBody);
+    const digest = createHmac("sha256", secret).update(body).digest("hex");
+    const provided = signatureHeader.slice(expectedPrefix.length);
+    const a = Buffer.from(digest, "utf8");
+    const b = Buffer.from(provided, "utf8");
+    if (a.length !== b.length || !timingSafeEqual(a, b)) {
+        throw new ChannelError("channel_invalid_signature", "GitHub webhook signature mismatch");
+    }
+}
+/**
+ * Normalize a verified GitHub webhook payload into a {@link ChannelEvent}.
+ *
+ * Accepts any `X-GitHub-Event`. Returns `ignored: true` when no handler matches.
+ */
+export function normalizeGitHubEvent(body, headers, config, installationIdFallback) {
+    if (!headers.eventName) {
+        return ignoredResult(headers.deliveryId);
+    }
+    const payload = asObject(body);
+    const action = stringField(payload.action);
+    const installationId = stringField(asObject(payload.installation)?.id) ??
+        (numberField(asObject(payload.installation)?.id) !== undefined
+            ? String(numberField(asObject(payload.installation)?.id))
+            : undefined) ??
+        installationIdFallback ??
+        undefined;
+    const repository = asObject(payload.repository);
+    const ownerLogin = stringField(asObject(repository.owner)?.login) ??
+        stringField(repository.full_name)?.split("/")[0] ??
+        undefined;
+    const repoName = stringField(repository.name) ??
+        stringField(repository.full_name)?.split("/")[1] ??
+        undefined;
+    const fullName = stringField(repository.full_name) ??
+        (ownerLogin && repoName ? `${ownerLogin}/${repoName}` : undefined);
+    const handler = matchGitHubHandler(config, headers.eventName, fullName, action);
+    if (!handler) {
+        return ignoredResult(headers.deliveryId);
+    }
+    const issueOrPullNumber = extractIssueOrPullNumber(payload);
+    const trigger = action !== undefined ? `${headers.eventName}.${action}` : headers.eventName;
+    const promptEvent = {
+        eventName: headers.eventName,
+        ...(action !== undefined ? { action } : {}),
+        trigger,
+        deliveryId: headers.deliveryId,
+        ...(fullName !== undefined ? { repository: fullName } : {}),
+        ...(installationId !== undefined ? { installationId } : {}),
+        ...(issueOrPullNumber !== undefined ? { issueOrPullNumber } : {}),
+        payload: body,
+    };
+    const text = handler.prompt(promptEvent);
+    const conversationId = ownerLogin && repoName && issueOrPullNumber !== undefined
+        ? `${ownerLogin}/${repoName}#${issueOrPullNumber}`
+        : (fullName ?? headers.deliveryId);
+    const sourceThreadKey = encodeGitHubSourceThreadKey({
+        installationId: installationId ?? "unknown",
+        owner: ownerLogin,
+        repo: repoName,
+        number: issueOrPullNumber,
+        deliveryId: headers.deliveryId,
+    });
+    return {
+        trigger,
+        sourceThreadKey,
+        handler,
+        promptEvent,
+        event: {
+            deliveryId: randomUUID(),
+            eventId: headers.deliveryId,
+            type: trigger,
+            address: {
+                conversationId,
+                ...(issueOrPullNumber !== undefined
+                    ? { threadId: conversationId }
+                    : {}),
+            },
+            message: { id: headers.deliveryId, text, attachments: [] },
+            native: {
+                provider: "github",
+                payload: {
+                    eventName: headers.eventName,
+                    ...(action !== undefined ? { action } : {}),
+                    ...(fullName !== undefined ? { repository: fullName } : {}),
+                    ...(installationId !== undefined
+                        ? { installation: { id: installationId } }
+                        : {}),
+                },
+            },
+        },
+    };
+}
+/** Best-effort issue/PR number from common webhook payload shapes. */
+export function extractIssueOrPullNumber(payload) {
+    const pr = numberField(asObject(payload.pull_request).number);
+    if (pr !== undefined)
+        return pr;
+    const issue = numberField(asObject(payload.issue).number);
+    if (issue !== undefined)
+        return issue;
+    return numberField(payload.number);
+}
+function ignoredResult(deliveryHeader) {
+    return {
+        ignored: true,
+        trigger: "ignored",
+        sourceThreadKey: "",
+        event: {
+            deliveryId: randomUUID(),
+            eventId: deliveryHeader,
+            type: "ignored",
+            address: { conversationId: "" },
+        },
+    };
+}
+function asObject(value) {
+    return typeof value === "object" && value !== null
+        ? value
+        : {};
+}
+function stringField(value) {
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return String(value);
+    }
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function numberField(value) {
+    return typeof value === "number" && Number.isFinite(value)
+        ? value
+        : undefined;
+}
+//# sourceMappingURL=normalize.js.map

package/dist/channels/github/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../src/channels/github/normalize.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAO5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAajE;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA4B,EAC5B,eAAuB,EACvB,MAAc;IAEd,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,2BAA2B,EAC3B,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,SAAS,CAAC;IACjC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,2BAA2B,EAC3B,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,EAC3B,mCAAmC,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,OAGC,EACD,MAAmC,EACnC,sBAA+B;IAE/B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAClB,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QAC/C,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,KAAK,SAAS;YAC5D,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QACd,sBAAsB;QACtB,SAAS,CAAC;IAEZ,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,UAAU,GACd,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAC9C,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,SAAS,CAAC;IACZ,MAAM,QAAQ,GACZ,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5B,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,SAAS,CAAC;IACZ,MAAM,QAAQ,GACZ,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QACjC,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,kBAAkB,CAChC,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,QAAQ,EACR,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,OAAO,GACX,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAE9E,MAAM,WAAW,GAA6B;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI;KACd,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,cAAc,GAClB,UAAU,IAAI,QAAQ,IAAI,iBAAiB,KAAK,SAAS;QACvD,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,IAAI,iBAAiB,EAAE;QAClD,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvC,MAAM,eAAe,GAAG,2BAA2B,CAAC;QAClD,cAAc,EAAE,cAAc,IAAI,SAAS;QAC3C,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,eAAe;QACf,OAAO;QACP,WAAW;QACX,KAAK,EAAE;YACL,UAAU,EAAE,UAAU,EAAE;YACxB,OAAO,EAAE,OAAO,CAAC,UAAU;YAC3B,IAAI,EAAE,OAAO;YACb,OAAO,EAAE;gBACP,cAAc;gBACd,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE;oBAC9B,CAAC,CAAC,EAAE,CAAC;aACR;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;YAC1D,MAAM,EAAE;gBACN,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,cAAc,KAAK,SAAS;wBAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;wBAC1C,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,wBAAwB,CACtC,OAAgC;IAEhC,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,cAAsB;IAC3C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,EAAE;QACnB,KAAK,EAAE;YACL,UAAU,EAAE,UAAU,EAAE;YACxB,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;SAChC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/channels/github/source-thread.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Stable GitHub source-thread keys for trusted channel ingress.
+ *
+ * Prefer issue/PR scoped keys when a number is known:
+ *   `github:<installationId>:<owner>/<repo>#<number>`
+ * Otherwise fall back to delivery-scoped keys:
+ *   `github:<installationId>:<owner>/<repo>:delivery:<deliveryId>`
+ *   `github:<installationId>:delivery:<deliveryId>`
+ */
+export declare function encodeGitHubSourceThreadKey(input: {
+    installationId: string;
+    owner?: string;
+    repo?: string;
+    number?: number;
+    deliveryId?: string;
+}): string;
+export declare function decodeGitHubSourceThreadKey(key: string): {
+    installationId: string;
+    owner?: string;
+    repo?: string;
+    number?: number;
+    deliveryId?: string;
+} | null;
+//# sourceMappingURL=source-thread.d.ts.map

package/dist/channels/github/source-thread.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-thread.d.ts","sourceRoot":"","sources":["../../../src/channels/github/source-thread.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAiBT;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG;IACxD,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,IAAI,CA6BP"}