pi-ghwebhook 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] - 2026-11-09
+
+### Added
+
+- **Universal Upstream-Aligned Event Bus**: Direct 1-to-1 match with GitHub Webhook wire protocol (`<event>` / `<event>.<action>`), natively supporting all 100+ GitHub events (`workflow_run.completed`, `pull_request.opened`, `push`, `issues.opened`, etc.).
+- **Composable Declarative Filters**: Replaced rigid synthetic code topics with flexible filters (`branch`, `conclusion`, `workflow`, `state`, `senders`, `isBot`, `match`), empowering users to configure any combination of conditions directly in `.pi/ghwebhook.json`.
+- **Official Schema Alignment**: Full type alignment with official `@octokit/openapi-webhooks-types`.
+- **In-Process Loopback Server**: Ephemeral port listener on `127.0.0.1:0` with optional HMAC SHA-256 webhook signature validation.
+- **Full-Event Reverse Tunnel Forwarding**: Managed `gh webhook forward --events=*` subprocess with automatic teardown on `session_shutdown` and `process.exit`.
+- **Template Renderer**: Safe, single-pass $O(N)$ string interpolation engine for prompt synthesis.
+- **Workspace Probing**: Zero-footprint detection of `.pi/ghwebhook.json` and `.agents/ghwebhook.json`.
+- **Tooling & Quality Gates**: Native `mise` and `hk` orchestration with `oxlint`, `tsc`, `prettier`, `lizard` complexity audit, and `jscpd` code duplication gate.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 xifan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,168 @@
-# Temporary Holding Version
+<div align="center">
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# pi-ghwebhook
+
+**Universal GitHub Webhook event bus and wake-up driver for the Pi coding agent**
+
+[![npm version](https://img.shields.io/npm/v/pi-ghwebhook?logo=npm&logoColor=white)](https://www.npmjs.com/package/pi-ghwebhook)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D22.19.0-339933?logo=nodedotjs&logoColor=white)](https://nodejs.org)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.8-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org)
+[![Pi Package](https://img.shields.io/badge/pi--package-extension-black)](https://github.com/earendil-works/pi)
+[![GitHub License](https://img.shields.io/github/license/xifan2333/pi-ghwebhook?logo=github&logoColor=white)](LICENSE)
+
+English | [中文](README_zh.md)
+
+</div>
+
+## Overview
+
+pi-ghwebhook eliminates manual polling and terminal switching after pushing code or creating pull requests. By hosting an in-process loopback server connected to GitHub CLI's `gh webhook forward` reverse tunnel, it receives real-time GitHub Webhook events, evaluates declarative filters, and wakes up the Pi Agent via `pi.sendUserMessage()` to close the loop.
+
+## Key Architecture
+
+- Upstream wire protocol: directly matches GitHub Webhook events (`<event>` or `<event>.<action>`). Supports all 100+ GitHub Webhook events.
+- Declarative filters: condition evaluation (`branch`, `conclusion`, `workflow`, `state`, `senders`, `isBot`, `match`) is offloaded to configuration rules rather than rigid code branches.
+- Zero public exposure: uses `gh webhook forward --events=*` local reverse tunnels. No public server, ngrok, or exposed port required.
+- Dynamic port allocation: binds to `127.0.0.1:0`. The OS kernel dynamically assigns an unused port, eliminating port contention across concurrent sessions.
+- Table-driven dispatch: O(1) hash map routing with strict complexity constraints (CCN <= 15, CogC <= 15).
+- Workspace detection: probes `.pi/ghwebhook.json` on `session_start`. If absent, sleeps silently with zero resource consumption.
+- Clean teardown: hooks into `session_shutdown` and process exit to terminate child processes and servers idempotently.
+
+## Installation
+
+Install into your Pi coding agent:
+
+```bash
+pi install npm:pi-ghwebhook
+```
+
+Or install from GitHub:
+
+```bash
+pi install git:github.com/xifan2333/pi-ghwebhook
+```
+
+To test locally in an active session:
+
+```bash
+pi -e /path/to/pi-ghwebhook
+```
+
+## Configuration (`.pi/ghwebhook.json`)
+
+Place `.pi/ghwebhook.json` (or `.agents/ghwebhook.json`) in the root of any repository:
+
+```json
+{
+  "version": 1,
+  "enabled": true,
+  "repo": "auto",
+  "subscriptions": [
+    {
+      "event": "workflow_run.completed",
+      "filters": {
+        "branch": "@current",
+        "workflow": "CI",
+        "conclusion": "failure"
+      },
+      "action": {
+        "deliverAs": "followUp",
+        "prompt": "CI run failed on branch {{ branch }}.\n\nRun URL: {{ run_url }}\nCommit: {{ head_sha }}\n\nPlease inspect the failed run logs and propose a fix."
+      }
+    },
+    {
+      "event": "workflow_run.completed",
+      "filters": {
+        "branch": "@current",
+        "conclusion": "success"
+      },
+      "action": {
+        "deliverAs": "followUp",
+        "prompt": "Remote CI has passed on branch {{ branch }}.\n\nRun URL: {{ run_url }}\n\nPlease check PR status and verify if it is ready to merge."
+      }
+    },
+    {
+      "event": "pull_request_review.submitted",
+      "filters": {
+        "branch": "@current",
+        "isBot": true,
+        "senders": ["coderabbitai[bot]", "greptile[bot]"]
+      },
+      "action": {
+        "deliverAs": "steer",
+        "prompt": "Received review feedback from {{ sender }}:\n\nState: {{ review_state }}\nDetails:\n{{ review_body }}\n\nPlease evaluate these comments critically: fix genuine issues and refute false positives."
+      }
+    },
+    {
+      "event": "issues.opened",
+      "action": {
+        "prompt": "New issue opened #{{ issue_number }}: {{ issue_title }}\n\n{{ issue_body }}"
+      }
+    },
+    {
+      "event": "push",
+      "filters": {
+        "branch": "main"
+      },
+      "action": {
+        "prompt": "New commit pushed to main: {{ head_sha }} - {{ commit_message }}"
+      }
+    }
+  ]
+}
+```
+
+### Configuration Fields
+
+| Field           | Type      | Default     | Description                                                                                              |
+| --------------- | --------- | ----------- | -------------------------------------------------------------------------------------------------------- |
+| `version`       | `1`       | `1`         | Schema version (must be 1).                                                                              |
+| `enabled`       | `boolean` | `true`      | Enable or disable the extension for this workspace.                                                      |
+| `repo`          | `string`  | `"auto"`    | Target GitHub repository (`owner/repo`). Resolved from `git remote get-url origin` when set to `"auto"`. |
+| `secret`        | `string`  | `undefined` | Optional webhook HMAC SHA-256 secret.                                                                    |
+| `subscriptions` | `Array`   | `[]`        | List of event subscription rules.                                                                        |
+
+### Subscription Rule Fields
+
+- `event`: Upstream GitHub Webhook event identifier (e.g., `workflow_run.completed`, `pull_request.opened`, `push`, `issues.labeled`).
+- `topic`: Optional alias for `event`.
+- `filters`: Declarative matching criteria.
+- `action`: Action payload containing `prompt` and optional `deliverAs` (`"steer"` or `"followUp"`).
+
+### Filters
+
+- `branch`: Target branch name or `@current` (dynamically resolved to current working branch).
+- `conclusion`: Workflow conclusion (`success`, `failure`, `cancelled`, `skipped`, etc.).
+- `workflow`: Workflow name (e.g., `CI`).
+- `state`: Review state (`approved`, `changes_requested`, `commented`) or PR state.
+- `senders`: Array of allowed sender logins (e.g., `["coderabbitai[bot]"]`).
+- `isBot`: Boolean flag matching Bot (`true`) or Human (`false`) senders.
+- `match`: Key-value map for matching nested payload fields using dot notation (e.g., `{"review.state": "changes_requested"}`).
+
+### Template Variables
+
+- `{{ branch }}`: Branch name
+- `{{ head_sha }}`: Commit SHA
+- `{{ commit_message }}`: Head commit message
+- `{{ repo }}` / `{{ repo_url }}`: Repository name and URL
+- `{{ run_id }}` / `{{ run_url }}` / `{{ workflow }}` / `{{ conclusion }}`: Workflow run metadata
+- `{{ pr_number }}` / `{{ pr_title }}` / `{{ pr_url }}`: Pull request details
+- `{{ issue_number }}` / `{{ issue_title }}` / `{{ issue_url }}` / `{{ issue_body }}`: Issue details
+- `{{ sender }}` / `{{ sender_type }}`: Triggering actor
+- `{{ review_state }}` / `{{ review_body }}` / `{{ review_url }}`: Review details
+- `{{ comment_body }}` / `{{ comment_url }}`: Comment details
+- `{{ action }}`: Payload action string
+
+## Development & Quality Gates
+
+```bash
+mise run check         # Run all quality gates (tsc, oxlint, prettier, lizard, jscpd, typos)
+mise run check:plan    # Preview execution plan
+mise run check:changed # Check only staged/modified files (< 50ms)
+mise run fix           # Auto-format and fix lint/package issues
+mise run test          # Run test suite
+```
+
+## License
+
+[MIT](LICENSE) © 2026 xifan

package/README_zh.md

@@ -0,0 +1,168 @@
+<div align="center">
+
+# pi-ghwebhook
+
+**适用于 Pi coding agent 的通用 GitHub Webhook 事件总线与自动唤醒驱动**
+
+[![npm version](https://img.shields.io/npm/v/pi-ghwebhook?logo=npm&logoColor=white)](https://www.npmjs.com/package/pi-ghwebhook)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D22.19.0-339933?logo=nodedotjs&logoColor=white)](https://nodejs.org)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.8-3178C6?logo=typescript&logoColor=white)](https://www.typescriptlang.org)
+[![Pi Package](https://img.shields.io/badge/pi--package-extension-black)](https://github.com/earendil-works/pi)
+[![GitHub License](https://img.shields.io/github/license/xifan2333/pi-ghwebhook?logo=github&logoColor=white)](LICENSE)
+
+[English](README.md) | 简体中文
+
+</div>
+
+## 概述
+
+pi-ghwebhook 旨在彻底消除提交代码或创建 Pull Request 后的人工轮询与终端反复切换。通过在进程内运行回环 HTTP 服务并托管 GitHub CLI 的 `gh webhook forward` 反向长连接隧道，它可以实时接收 GitHub Webhook 事件，依据声明式守卫规则进行快速匹配过滤，并通过 `pi.sendUserMessage()` 主动唤醒 Pi Agent 进入闭环处置。
+
+## 核心架构特性
+
+- 上游协议 1:1 对齐：直接匹配 GitHub 官方线缆事件（`<event>` 或 `<event>.<action>`），天然支持所有 100+ 种 GitHub Webhook 事件。
+- 声明式灵活过滤：将状态与结论判断（`branch`、`conclusion`、`workflow`、`state`、`senders`、`isBot`、`match`）全部下沉至配置规则中，拒绝代码硬编码伪语义。
+- 零公网暴露：依托 `gh webhook forward --events=*` 反向隧道，无需公网服务器、固定 IP 或内网穿透工具。
+- 动态端口分配：监听 `127.0.0.1:0`，由操作系统内核分配空闲端口，杜绝多终端或多会话并发运行时的端口冲突。
+- 表驱动分发：基于哈希表实现 O(1) 路由分发，执行严格的复杂度门禁（CCN <= 15, CogC <= 15）。
+- 工作区自感知：在 `session_start` 生命周期探测 `.pi/ghwebhook.json`，无配置时静默休眠，零资源占用。
+- 幂等清理保障：深度绑定 `session_shutdown` 与进程退出钩子，确保子进程与本地服务干净释放，不留孤儿进程。
+
+## 安装
+
+安装到 Pi coding agent：
+
+```bash
+pi install npm:pi-ghwebhook
+```
+
+或直接通过 GitHub 仓库安装：
+
+```bash
+pi install git:github.com/xifan2333/pi-ghwebhook
+```
+
+在当前会话中即时测试：
+
+```bash
+pi -e /path/to/pi-ghwebhook
+```
+
+## 配置契约 (`.pi/ghwebhook.json`)
+
+在需要启用事件驱动的仓库根目录下创建 `.pi/ghwebhook.json`（或 `.agents/ghwebhook.json`）：
+
+```json
+{
+  "version": 1,
+  "enabled": true,
+  "repo": "auto",
+  "subscriptions": [
+    {
+      "event": "workflow_run.completed",
+      "filters": {
+        "branch": "@current",
+        "workflow": "CI",
+        "conclusion": "failure"
+      },
+      "action": {
+        "deliverAs": "followUp",
+        "prompt": "分支 {{ branch }} 的 CI 运行失败。\n\n运行链接: {{ run_url }}\n提交哈希: {{ head_sha }}\n\n请查看失败日志并给出修复方案。"
+      }
+    },
+    {
+      "event": "workflow_run.completed",
+      "filters": {
+        "branch": "@current",
+        "conclusion": "success"
+      },
+      "action": {
+        "deliverAs": "followUp",
+        "prompt": "分支 {{ branch }} 的远程 CI 已全部通过。\n\n运行链接: {{ run_url }}\n\n请检查 PR 状态并确认是否准备合入。"
+      }
+    },
+    {
+      "event": "pull_request_review.submitted",
+      "filters": {
+        "branch": "@current",
+        "isBot": true,
+        "senders": ["coderabbitai[bot]", "greptile[bot]"]
+      },
+      "action": {
+        "deliverAs": "steer",
+        "prompt": "收到来自 {{ sender }} 的评审意见：\n\n评审状态: {{ review_state }}\n详情内容:\n{{ review_body }}\n\n请批判性评估上述审查意见：修复真实问题，驳回误报。"
+      }
+    },
+    {
+      "event": "issues.opened",
+      "action": {
+        "prompt": "收到新 Issue #{{ issue_number }}: {{ issue_title }}\n\n{{ issue_body }}"
+      }
+    },
+    {
+      "event": "push",
+      "filters": {
+        "branch": "main"
+      },
+      "action": {
+        "prompt": "main 分支收到新推送: {{ head_sha }} - {{ commit_message }}"
+      }
+    }
+  ]
+}
+```
+
+### 顶层配置字段
+
+| 字段            | 类型      | 默认值      | 说明                                                                                        |
+| --------------- | --------- | ----------- | ------------------------------------------------------------------------------------------- |
+| `version`       | `1`       | `1`         | 契约版本号（必须为 1）。                                                                    |
+| `enabled`       | `boolean` | `true`      | 是否在当前工作区启用该扩展。                                                                |
+| `repo`          | `string`  | `"auto"`    | 目标 GitHub 仓库名（`owner/repo`）。为 `"auto"` 时自动从 `git remote get-url origin` 提取。 |
+| `secret`        | `string`  | `undefined` | 可选的 Webhook HMAC SHA-256 鉴权密钥。                                                      |
+| `subscriptions` | `Array`   | `[]`        | 声明式事件订阅规则列表。                                                                    |
+
+### 订阅规则字段
+
+- `event`: 上游 GitHub Webhook 事件名称（如 `workflow_run.completed`、`pull_request.opened`、`push`、`issues.labeled`）。
+- `topic`: `event` 字段的可选别名。
+- `filters`: 声明式过滤守卫。
+- `action`: 唤醒动作负载，包含 `prompt` 模板和可选的 `deliverAs`（`"steer"` 或 `"followUp"`）。
+
+### 过滤守卫 (Filters)
+
+- `branch`: 目标分支名称，或特殊符号 `@current`（动态解析为本地当前分支）。
+- `conclusion`: 工作流运行结论（`success`、`failure`、`cancelled`、`skipped` 等）。
+- `workflow`: 工作流名称（如 `CI`）。
+- `state`: 评审状态（`approved`、`changes_requested`、`commented`）或 PR 状态。
+- `senders`: 允许的发送者登录名数组（如 `["coderabbitai[bot]"]`）。
+- `isBot`: 布尔标志，匹配机器人（`true`）或人类（`false`）发送者。
+- `match`: 任意键值映射表，使用点路径语法匹配负载深层字段（如 `{"review.state": "changes_requested"}`）。
+
+### 模板插值变量
+
+- `{{ branch }}`: 分支名称
+- `{{ head_sha }}`: 触发提交哈希
+- `{{ commit_message }}`: 提交日志
+- `{{ repo }}` / `{{ repo_url }}`: 仓库名及网页链接
+- `{{ run_id }}` / `{{ run_url }}` / `{{ workflow }}` / `{{ conclusion }}`: 工作流运行元数据
+- `{{ pr_number }}` / `{{ pr_title }}` / `{{ pr_url }}`: PR 详情
+- `{{ issue_number }}` / `{{ issue_title }}` / `{{ issue_url }}` / `{{ issue_body }}`: Issue 详情
+- `{{ sender }}` / `{{ sender_type }}`: 触发人或机器人
+- `{{ review_state }}` / `{{ review_body }}` / `{{ review_url }}`: 评审详情
+- `{{ comment_body }}` / `{{ comment_url }}`: 评论详情
+- `{{ action }}`: 负载操作动作名
+
+## 开发与质量门禁
+
+```bash
+mise run check         # 执行全量质量检查（tsc, oxlint, prettier, lizard, jscpd, typos）
+mise run check:plan    # 预览执行计划
+mise run check:changed # 增量检查暂存区及修改文件 (< 50ms)
+mise run fix           # 自动格式化并修复问题
+mise run test          # 运行测试套件
+```
+
+## 许可证
+
+[MIT](LICENSE) © 2026 xifan

package/dist/bus/event-bus.d.ts

@@ -0,0 +1,14 @@
+import type { SubscriptionRule } from "../types/schema.js";
+import type { WebhookPayload } from "../types/payload.js";
+export interface ActionPlan {
+    prompt: string;
+    deliverAs: "steer" | "followUp";
+    event: string;
+}
+export declare class WebhookEventBus {
+    private readonly routes;
+    constructor(rules: SubscriptionRule[]);
+    getEvents(): string[];
+    dispatch(event: string, payload: WebhookPayload, currentBranch: string): ActionPlan[];
+}
+//# sourceMappingURL=event-bus.d.ts.map

package/dist/bus/event-bus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bus.d.ts","sourceRoot":"","sources":["../../src/bus/event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAK1D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,GAAG,UAAU,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAEpD,KAAK,EAAE,gBAAgB,EAAE;IAYrC,SAAS,IAAI,MAAM,EAAE;IAIrB,QAAQ,CACN,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,cAAc,EACvB,aAAa,EAAE,MAAM,GACpB,UAAU,EAAE;CAoChB"}

package/dist/bus/event-bus.js

@@ -0,0 +1,53 @@
+import { evaluateGuards } from "./guards.js";
+import { normalizeEventKey, resolveIncomingEventKeys } from "./normalizer.js";
+import { extractVariables, renderTemplate } from "../template/renderer.js";
+export class WebhookEventBus {
+    routes = new Map();
+    constructor(rules) {
+        for (const rule of rules) {
+            const rawKey = rule.event ?? rule.topic;
+            if (!rawKey)
+                continue;
+            const normalizedKey = normalizeEventKey(rawKey);
+            const existing = this.routes.get(normalizedKey) ?? [];
+            existing.push(rule);
+            this.routes.set(normalizedKey, existing);
+        }
+    }
+    getEvents() {
+        return Array.from(this.routes.keys());
+    }
+    dispatch(event, payload, currentBranch) {
+        const candidateKeys = resolveIncomingEventKeys(event, payload);
+        const seenRules = new Set();
+        const matchedRules = [];
+        for (const key of candidateKeys) {
+            const rules = this.routes.get(key);
+            if (!rules)
+                continue;
+            for (const rule of rules) {
+                if (!seenRules.has(rule)) {
+                    seenRules.add(rule);
+                    matchedRules.push(rule);
+                }
+            }
+        }
+        if (matchedRules.length === 0) {
+            return [];
+        }
+        const ctx = { currentBranch, payload };
+        const vars = extractVariables(payload, currentBranch);
+        const plans = [];
+        for (const rule of matchedRules) {
+            if (evaluateGuards(rule.filters, ctx)) {
+                plans.push({
+                    prompt: renderTemplate(rule.action.prompt, vars),
+                    deliverAs: rule.action.deliverAs ?? "followUp",
+                    event: rule.event ?? rule.topic ?? event,
+                });
+            }
+        }
+        return plans;
+    }
+}
+//# sourceMappingURL=event-bus.js.map

package/dist/bus/event-bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bus.js","sourceRoot":"","sources":["../../src/bus/event-bus.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAQ3E,MAAM,OAAO,eAAe;IACT,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEhE,YAAY,KAAyB;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YACxC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,QAAQ,CACN,KAAa,EACb,OAAuB,EACvB,aAAqB;QAErB,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC9C,MAAM,YAAY,GAAuB,EAAE,CAAC;QAE5C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACpB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,KAAK,GAAiB,EAAE,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;oBAChD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU;oBAC9C,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK;iBACzC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/bus/guards.d.ts

@@ -0,0 +1,10 @@
+import type { WebhookPayload } from "../types/payload.js";
+import type { FilterConfig } from "../types/schema.js";
+export interface FilterContext {
+    currentBranch: string;
+    payload: WebhookPayload;
+}
+export type GuardPredicate = (expectedValue: unknown, ctx: FilterContext) => boolean;
+export declare const GUARDS: ReadonlyMap<keyof FilterConfig, GuardPredicate>;
+export declare function evaluateGuards(filters: FilterConfig | undefined, ctx: FilterContext): boolean;
+//# sourceMappingURL=guards.d.ts.map

package/dist/bus/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/bus/guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,aAAa,EAAE,OAAO,EACtB,GAAG,EAAE,aAAa,KACf,OAAO,CAAC;AAiFb,eAAO,MAAM,MAAM,EAAE,WAAW,CAAC,MAAM,YAAY,EAAE,cAAc,CAQjE,CAAC;AAEH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,GAAG,EAAE,aAAa,GACjB,OAAO,CAYT"}

package/dist/bus/guards.js

@@ -0,0 +1,88 @@
+function resolvePayloadBranch(payload) {
+    return (payload.workflow_run?.head_branch ??
+        payload.pull_request?.head?.ref ??
+        payload.check_suite?.head_branch ??
+        payload.workflow_job?.head_branch ??
+        (typeof payload.ref === "string"
+            ? payload.ref.replace("refs/heads/", "")
+            : undefined));
+}
+function resolvePayloadSender(payload) {
+    return (payload.sender?.login ??
+        payload.review?.user?.login ??
+        payload.comment?.user?.login);
+}
+function getNestedValue(obj, path) {
+    const parts = path.split(".");
+    let current = obj;
+    for (const part of parts) {
+        if (current == null || typeof current !== "object")
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+const branchGuard = (expected, { currentBranch, payload }) => {
+    const target = expected === "@current" ? currentBranch : expected;
+    const actualBranch = resolvePayloadBranch(payload);
+    return typeof target === "string" && actualBranch === target;
+};
+const conclusionGuard = (expected, { payload }) => {
+    const actual = payload.workflow_run?.conclusion ??
+        payload.check_suite?.conclusion ??
+        payload.workflow_job?.conclusion;
+    return typeof expected === "string" && actual === expected;
+};
+const workflowGuard = (expected, { payload }) => {
+    const workflowName = payload.workflow_run?.name ?? payload.workflow_job?.workflow_name;
+    return typeof expected === "string" && workflowName === expected;
+};
+const stateGuard = (expected, { payload }) => {
+    const actual = payload.review?.state ?? payload.pull_request?.state;
+    return typeof expected === "string" && actual === expected;
+};
+const sendersGuard = (allowedList, { payload }) => {
+    if (!Array.isArray(allowedList))
+        return true;
+    const sender = resolvePayloadSender(payload);
+    return typeof sender === "string" && allowedList.includes(sender);
+};
+const isBotGuard = (expected, { payload }) => {
+    const senderType = payload.review?.user?.type ?? payload.sender?.type;
+    const login = payload.review?.user?.login ?? payload.sender?.login ?? "";
+    const isBot = senderType === "Bot" || login.endsWith("[bot]");
+    return isBot === Boolean(expected);
+};
+const matchGuard = (matchObj, { payload }) => {
+    if (!matchObj || typeof matchObj !== "object")
+        return true;
+    for (const [path, expected] of Object.entries(matchObj)) {
+        const actual = getNestedValue(payload, path);
+        if (actual !== expected)
+            return false;
+    }
+    return true;
+};
+export const GUARDS = new Map([
+    ["branch", branchGuard],
+    ["conclusion", conclusionGuard],
+    ["workflow", workflowGuard],
+    ["state", stateGuard],
+    ["senders", sendersGuard],
+    ["isBot", isBotGuard],
+    ["match", matchGuard],
+]);
+export function evaluateGuards(filters, ctx) {
+    if (!filters)
+        return true;
+    for (const [key, value] of Object.entries(filters)) {
+        if (value === undefined)
+            continue;
+        const guard = GUARDS.get(key);
+        if (guard && !guard(value, ctx)) {
+            return false;
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=guards.js.map

package/dist/bus/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/bus/guards.ts"],"names":[],"mappings":"AAaA,SAAS,oBAAoB,CAAC,OAAuB;IACnD,OAAO,CACL,OAAO,CAAC,YAAY,EAAE,WAAW;QACjC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG;QAC/B,OAAO,CAAC,WAAW,EAAE,WAAW;QAChC,OAAO,CAAC,YAAY,EAAE,WAAW;QACjC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC,CACf,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAuB;IACnD,OAAO,CACL,OAAO,CAAC,MAAM,EAAE,KAAK;QACrB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK;QAC3B,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAwB,EAAE,IAAY;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAQ,GAAG,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,WAAW,GAAmB,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3E,MAAM,MAAM,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClE,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,YAAY,KAAK,MAAM,CAAC;AAC/D,CAAC,CAAC;AAEF,MAAM,eAAe,GAAmB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAChE,MAAM,MAAM,GACV,OAAO,CAAC,YAAY,EAAE,UAAU;QAChC,OAAO,CAAC,WAAW,EAAE,UAAU;QAC/B,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC;IACnC,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,aAAa,GAAmB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC9D,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,IAAI,IAAI,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC;IACpE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,KAAK,QAAQ,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,UAAU,GAAmB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC;IACpE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,YAAY,GAAmB,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,MAAM,UAAU,GAAmB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IACzE,MAAM,KAAK,GAAG,UAAU,KAAK,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9D,OAAO,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,UAAU,GAAmB,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAC3D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAC3C,QAAmC,CACpC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAAoD,IAAI,GAAG,CAAC;IAC7E,CAAC,QAAQ,EAAE,WAAW,CAAC;IACvB,CAAC,YAAY,EAAE,eAAe,CAAC;IAC/B,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3B,CAAC,OAAO,EAAE,UAAU,CAAC;IACrB,CAAC,SAAS,EAAE,YAAY,CAAC;IACzB,CAAC,OAAO,EAAE,UAAU,CAAC;IACrB,CAAC,OAAO,EAAE,UAAU,CAAC;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAC5B,OAAiC,EACjC,GAAkB;IAElB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAyB,CAAC,CAAC;QACpD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/bus/normalizer.d.ts

@@ -0,0 +1,14 @@
+import type { WebhookPayload } from "../types/payload.js";
+/**
+ * Normalizes an event identifier by stripping optional "github." prefix.
+ * e.g. "github.workflow_run.completed" -> "workflow_run.completed"
+ */
+export declare function normalizeEventKey(key: string): string;
+/**
+ * Resolves candidate event keys from an incoming GitHub Webhook event and payload.
+ * Upstream convention:
+ * 1. If payload has action: `${event}.${action}` (e.g. "workflow_run.completed", "pull_request.opened")
+ * 2. Wildcard/base event: `${event}` (e.g. "workflow_run", "push", "issues")
+ */
+export declare function resolveIncomingEventKeys(event: string, payload: WebhookPayload): string[];
+//# sourceMappingURL=normalizer.d.ts.map

package/dist/bus/normalizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizer.d.ts","sourceRoot":"","sources":["../../src/bus/normalizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,cAAc,GACtB,MAAM,EAAE,CAWV"}

package/dist/bus/normalizer.js

@@ -0,0 +1,25 @@
+/**
+ * Normalizes an event identifier by stripping optional "github." prefix.
+ * e.g. "github.workflow_run.completed" -> "workflow_run.completed"
+ */
+export function normalizeEventKey(key) {
+    const trimmed = key.trim();
+    return trimmed.startsWith("github.") ? trimmed.slice(7) : trimmed;
+}
+/**
+ * Resolves candidate event keys from an incoming GitHub Webhook event and payload.
+ * Upstream convention:
+ * 1. If payload has action: `${event}.${action}` (e.g. "workflow_run.completed", "pull_request.opened")
+ * 2. Wildcard/base event: `${event}` (e.g. "workflow_run", "push", "issues")
+ */
+export function resolveIncomingEventKeys(event, payload) {
+    const normalizedEvent = normalizeEventKey(event);
+    const action = typeof payload.action === "string" ? payload.action.trim() : undefined;
+    const keys = [];
+    if (action) {
+        keys.push(`${normalizedEvent}.${action}`);
+    }
+    keys.push(normalizedEvent);
+    return keys;
+}
+//# sourceMappingURL=normalizer.js.map

package/dist/bus/normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalizer.js","sourceRoot":"","sources":["../../src/bus/normalizer.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,OAAuB;IAEvB,MAAM,eAAe,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,IAAI,CAAC,GAAG,eAAe,IAAI,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/config/loader.d.ts

@@ -0,0 +1,6 @@
+import type { GhWebhookConfig } from "../types/schema.js";
+export declare function loadProjectConfig(cwd: string): Promise<GhWebhookConfig | null>;
+export declare function resolveGitBranch(cwd: string): Promise<string>;
+export declare function parseGitHubRepo(remoteUrl: string): string | null;
+export declare function resolveGitRepo(cwd: string): Promise<string | null>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/config/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAmB1D,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAmBjC;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWnE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOhE;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxE"}