tinybeeai 0.0.0-stage → 0.16.1

package/dist/webhooks.js

@@ -0,0 +1,625 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { config, log } from './config.js';
+import { insert, list, update, findOne } from './db.js';
+import { enqueue } from './queue.js';
+import { debouncedRunAfter, isStalePrHead, notePrHead, supersedeOlderPrJobs } from './flows/testSavings.js';
+import { inheritedWait, isStaleTicketEdit, queuedTicketReviews, supersedeQueuedTicketReviews } from './ticket-supersede.js';
+import { githubFor, normalizeCommentEdit, normalizeGithub, hasStickyMarker } from './integrations/github.js';
+import { applyChecklistEdit } from './flows/ticks.js';
+import { handleNewComments } from './flows/answers.js';
+import { issueApi, issueInScope, issueSkip, normalizeGithubIssue, recordIssueEvent, reviewedSameBody, REVIEW_COMMAND, trackerRepos, } from './integrations/github-issues.js';
+import { applyPrState } from './agent/approvals.js';
+import { normalizeJira } from './integrations/jira.js';
+import { normalizeLinear } from './integrations/linear.js';
+import { findRepo, repoForEvent, watchRepos } from './repos.js';
+import { filesMatchFilters, resolveChangedFiles } from './path-filters.js';
+import { outOfScope, resolvePrScope } from './pr-scope.js';
+import { noteWebhook } from './webhook-seen.js';
+import { stageFor } from './stages/index.js';
+import { stageOffReason, stageOn } from './stages/config.js';
+// Signature checks
+/** Constant-time compare of `prefix + hex(HMAC-SHA256(raw))` against the header value. */
+export function verifySignature(raw, secret, got, prefix = '') {
+    if (!got)
+        return false;
+    const want = Buffer.from(prefix + createHmac('sha256', secret).update(raw).digest('hex'));
+    const have = Buffer.from(got.trim());
+    return want.length === have.length && timingSafeEqual(want, have);
+}
+/** GitHub: `X-Hub-Signature-256: sha256=<hex>`. */
+export function verifyGithub(raw, secret, header) {
+    return verifySignature(raw, secret, header, 'sha256=');
+}
+/** Jira: `X-Hub-Signature: <method>=<hex>` (WebSub). Only sha256 is accepted. */
+export function verifyJira(raw, secret, header) {
+    if (!header)
+        return false;
+    const i = header.indexOf('=');
+    if (i < 0)
+        return false;
+    if (header.slice(0, i).trim().toLowerCase() !== 'sha256')
+        return false;
+    return verifySignature(raw, secret, header.slice(i + 1).toLowerCase());
+}
+/** Linear: `Linear-Signature: <hex>` plus a `webhookTimestamp` (ms) within 60 s of now. */
+export function verifyLinear(raw, secret, header, webhookTimestamp, now = Date.now()) {
+    if (!verifySignature(raw, secret, header?.toLowerCase()))
+        return { ok: false, reason: 'bad signature' };
+    const ts = Number(webhookTimestamp);
+    if (!Number.isFinite(ts))
+        return { ok: false, reason: 'missing webhookTimestamp' };
+    if (Math.abs(now - ts) > config.linearMaxSkewMs)
+        return { ok: false, reason: 'stale webhookTimestamp' };
+    return { ok: true };
+}
+// Trigger to job routing
+const JOB_FOR = {
+    pr_opened: 'pr_check',
+    pr_merged: 'post_merge',
+    push: 'post_merge',
+    ci_failure: 'ci_failure',
+    ticket_created: 'ticket_review',
+    ticket_updated: 'ticket_review',
+    probe_down: 'outage',
+    statuspage: 'outage',
+    probe_up: 'recovery',
+    schedule: 'digest',
+};
+export function jobKindFor(ev) {
+    return JOB_FOR[ev.kind] ?? null;
+}
+const lc = (s) => (s ?? '').toLowerCase();
+/**
+ * Jobs each repo role gets from a GitHub event (docs/MULTI-REPO.md sections 1.4 and 3.6).
+ * App repos keep the full table. A test repo gets CI triage only until test_pr_check and
+ * repo_scan exist (KAT-86, KAT-85 part 2); a docs repo gets no job yet.
+ */
+const ROLE_JOBS = {
+    app: new Set(['pr_check', 'post_merge', 'ci_failure']),
+    test: new Set(['ci_failure']),
+    docs: new Set(),
+};
+export function roleAllows(role, job) {
+    return !!job && ROLE_JOBS[role].has(job);
+}
+/**
+ * Does this Watch own the event? A GitHub event matches when its repo is in the dot's repo set and
+ * the repo's role takes the job. Push events also require that repo's default branch. A PR event must
+ * also be in the repo's PR scope (KAT-354, src/pr-scope.ts).
+ */
+export function watchMatches(w, ev) {
+    return matchesSources(w, ev) && !outOfScope(w, ev);
+}
+/** watchMatches without the PR scope: the dot watches what the event names. dispatchTrigger applies the scope next, so it can record a skip. */
+function matchesSources(w, ev) {
+    switch (ev.source) {
+        case 'github': {
+            // GitHub issues: the dot's tracker decides (repos, labels, issue types, milestones).
+            if (ev.ticket)
+                return issueInScope(w, ev);
+            const entry = repoForEvent(w, ev);
+            if (!entry)
+                return false;
+            if (!roleAllows(entry.role, jobKindFor(ev)))
+                return false;
+            if (ev.kind === 'push' && ev.push) {
+                const branch = ev.push.ref.replace(/^refs\/heads\//, '');
+                // The default branch, or a branch the dot lists in testBranches (KAT-292).
+                if (!(branch === entry.defaultBranch || (w.testBranches ?? []).includes(branch)))
+                    return false;
+            }
+            // Repo path filters (KAT-160): one changed file must fall inside them. Unknown files match, and the run says so.
+            if (entry.pathFilters?.length && (ev.pr || ev.push) && ev.changedFiles)
+                return filesMatchFilters(ev.changedFiles, entry.pathFilters);
+            return true;
+        }
+        case 'jira':
+        case 'linear': {
+            if (!w.tracker || !ev.ticket || w.tracker.kind !== ev.ticket.tracker)
+                return false;
+            const keys = w.tracker.kind === 'jira' ? w.tracker.projectKeys : w.tracker.kind === 'linear' ? w.tracker.teamKeys : [];
+            return keys.some((k) => lc(k) === lc(ev.ticket.projectKey));
+        }
+        case 'probe':
+            return !!ev.probe && w.probes.some((p) => p.url === ev.probe.url);
+        case 'statuspage':
+            return typeof ev.url === 'string' && w.statusPages.some((u) => ev.url.startsWith(u.replace(/\/+$/, '')));
+        default:
+            return false;
+    }
+}
+/** Records a PR the dot's scope keeps out: an events row with the reason (once per delivery), a log line, and an entry in the result. */
+function skipScope(w, ev, reason, stage, skipped) {
+    skipped.push({ watchId: w.id, stage: stage ?? 'reviewer', reason });
+    if (!findOne('events', { watchId: w.id, dedupeKey: ev.dedupeKey })) {
+        insert('events', { watchId: w.id, source: ev.source, kind: ev.kind, dedupeKey: ev.dedupeKey, title: ev.title, url: ev.url, trigger: ev, skipped: reason });
+    }
+    log.info(`${w.name}: skipped "${ev.title}": ${reason}`);
+}
+/** True when this dot has a PR check for this PR head that did not fail. */
+export function reviewedHead(watchId, ev) {
+    if (!ev.pr?.headSha || !ev.repo)
+        return false;
+    const want = `${ev.repo.owner}/${ev.repo.name}`.toLowerCase();
+    return list('jobs', { watchId, kind: 'pr_check' }, { orderBy: 'id DESC', limit: 300 }).some((j) => {
+        const p = (j.payload ?? {});
+        return (j.status !== 'failed' &&
+            p.pr?.number === ev.pr.number &&
+            p.pr?.headSha === ev.pr.headSha &&
+            (!p.repo || `${p.repo.owner}/${p.repo.name}`.toLowerCase() === want));
+    });
+}
+/**
+ * A GitHub issue that a dot's tracker covers but its scope skips (a missing required label, a type, a milestone, a skip
+ * label) is logged with the reason, once per dot, so a team can tell why an issue got no review. Dots whose tracker
+ * does not list the repo say nothing: the issue was never theirs.
+ */
+function logSkippedIssue(all, targets, ev) {
+    if (ev.source !== 'github' || ev.ticket?.tracker !== 'github')
+        return;
+    for (const w of all) {
+        if (w.paused || w.archived || targets.includes(w) || w.tracker?.kind !== 'github')
+            continue;
+        if (!trackerRepos(w).includes(lc(ev.ticket.projectKey)))
+            continue;
+        const skip = issueSkip(w, ev);
+        if (!skip)
+            continue;
+        // An in-scope issue whose event starts nothing is not a dropped issue: the wording keeps a team from reading it as one.
+        log.info(skip.inScope ? `${w.name}: no new review for ${ev.ticket.key}: ${skip.why}` : `${w.name}: skipped issue ${ev.ticket.key}: ${skip.why}`);
+    }
+}
+/**
+ * The single path from a normalized TriggerEvent to stored events rows and queued jobs.
+ * Webhooks, simulate, and any other producer go through here.
+ */
+export function dispatchTrigger(ev, opts = {}) {
+    const jobKind = jobKindFor(ev);
+    if (!jobKind)
+        return { accepted: false, reason: `no job for trigger ${ev.kind}`, trigger: ev, jobs: [] };
+    const all = list('watches');
+    const stage = stageFor(jobKind);
+    const skipped = [];
+    let targets;
+    if (opts.watchIds?.length)
+        targets = all.filter((w) => !w.archived && opts.watchIds.includes(w.id));
+    else {
+        const pool = all.filter((w) => !w.paused && !w.archived && (!opts.onlyWatchIds || opts.onlyWatchIds.includes(w.id)));
+        targets = [];
+        for (const w of pool) {
+            if (!matchesSources(w, ev))
+                continue;
+            // A PR outside the repo's PR scope is recorded as a skip with its rule, never dropped without a trace (KAT-354).
+            // A simulated event and a review a person asked for are not held back (outOfScope also checks requestedBy).
+            const why = opts.simulate ? null : outOfScope(w, ev);
+            if (why)
+                skipScope(w, ev, why, stage, skipped);
+            else
+                targets.push(w);
+        }
+        logSkippedIssue(all, targets, ev);
+        if (!targets.length && !skipped.length && opts.fallbackToAll)
+            targets = all.filter((w) => !w.paused && !w.archived);
+    }
+    if (!targets.length && skipped.length)
+        return { accepted: false, reason: skipped[0].reason, trigger: ev, jobKind, jobs: [], skipped };
+    if (!targets.length)
+        return { accepted: false, reason: 'no matching dot', trigger: ev, jobKind, jobs: [] };
+    const jobs = [];
+    let duplicates = 0;
+    let stale = 0;
+    for (const w of targets) {
+        // A stage that is off queues nothing. The event row keeps the trigger and the reason, so the skip is never silent.
+        if (stage && !stageOn(w, stage)) {
+            const reason = stageOffReason(stage);
+            skipped.push({ watchId: w.id, stage, reason });
+            if (!findOne('events', { watchId: w.id, dedupeKey: ev.dedupeKey })) {
+                insert('events', {
+                    watchId: w.id,
+                    source: ev.source,
+                    kind: ev.kind,
+                    dedupeKey: ev.dedupeKey,
+                    title: ev.title,
+                    url: ev.url,
+                    trigger: ev,
+                    skipped: reason,
+                });
+            }
+            log.info(`${w.name}: skipped ${jobKind} "${ev.title}": ${reason}`);
+            continue;
+        }
+        // KAT-346: a delivery for a head that is no longer the PR's current head starts no run and cancels nothing.
+        if (jobKind === 'pr_check' && !opts.simulate && !ev.requestedBy && isStalePrHead(ev)) {
+            stale++;
+            log.info(`${w.name}: ignored ${jobKind} "${ev.title}": stale head ${ev.pr?.headSha?.slice(0, 7) ?? ''}`);
+            continue;
+        }
+        const dedupeKey = `${ev.dedupeKey}:${w.id}:${jobKind}`;
+        // A draft turning ready has the head a dot may have reviewed while it was a draft: the dot that did takes no second review (KAT-354).
+        if (ev.pr?.readyForReview && !ev.requestedBy && reviewedHead(w.id, ev)) {
+            duplicates++;
+            continue;
+        }
+        if (findOne('jobs', { dedupeKey }) || reviewedSameBody(w.id, ev)) {
+            duplicates++;
+            continue;
+        }
+        // KAT-408: a ticket edited while its review still waits keeps one review, the newest. A backfilled review (nobody asked for it)
+        // never replaces one that is queued, and a simulated event never stops a real review (KAT-350).
+        const olderReviews = jobKind === 'ticket_review' && !opts.simulate ? queuedTicketReviews(w.id, ev) : [];
+        if (ev.backfill && olderReviews.length) {
+            duplicates++;
+            continue;
+        }
+        // A late delivery for an older edit than the queued review reads old text: it starts nothing and stops nothing.
+        if (!ev.requestedBy && isStaleTicketEdit(olderReviews, ev)) {
+            duplicates++;
+            log.info(`${w.name}: ignored ${jobKind} "${ev.title}": a newer edit of the ticket is already queued`);
+            continue;
+        }
+        const evRow = insert('events', {
+            watchId: w.id,
+            source: ev.source,
+            kind: ev.kind,
+            dedupeKey: ev.dedupeKey,
+            title: ev.title,
+            url: ev.url,
+            trigger: ev,
+        });
+        // KAT-344: a pr_check waits for a quiet period, and the jobs of older heads of the same PR stop.
+        // A review that replaces one held for the daily model cap stays held until the reset, so no second "waiting for the cap" run is made.
+        const wait = inheritedWait(olderReviews);
+        const runAfter = jobKind === 'pr_check' && !opts.simulate ? debouncedRunAfter(w, ev) : wait.runAfter;
+        const jobId = enqueue({ kind: jobKind, watchId: w.id, eventId: evRow.id, dedupeKey, payload: ev, ...(runAfter ? { runAfter } : {}) });
+        if (!jobId) {
+            duplicates++;
+            continue;
+        }
+        update('events', evRow.id, { jobId });
+        // A simulated event (e2e, demo) never stops a real review of the same PR (KAT-350).
+        if (jobKind === 'pr_check' && !opts.simulate)
+            supersedeOlderPrJobs(jobId, w, ev);
+        if (olderReviews.length) {
+            supersedeQueuedTicketReviews(jobId, olderReviews, ev);
+            if (wait.heldBy)
+                update('jobs', jobId, { heldBy: wait.heldBy });
+        }
+        jobs.push({ watchId: w.id, jobId, eventId: evRow.id });
+    }
+    const extra = skipped.length ? { skipped } : {};
+    if (!jobs.length && skipped.length && !duplicates)
+        return { accepted: false, reason: skipped[0].reason, trigger: ev, jobKind, jobs, ...extra };
+    if (!jobs.length && stale && !duplicates)
+        return { accepted: false, reason: 'stale head', trigger: ev, jobKind, jobs, ...extra };
+    if (!jobs.length && duplicates)
+        return { accepted: true, duplicate: true, trigger: ev, jobKind, jobs, ...extra };
+    log.info(`${ev.source} ${ev.kind} "${ev.title}" -> ${jobKind} x${jobs.length}`);
+    return { accepted: true, trigger: ev, jobKind, jobs, ...extra };
+}
+/**
+ * A pull_request delivery says the PR's state and head: pending approvals for a merged or closed PR,
+ * and check-run drafts for an old head, expire (KAT-94). Closed PRs make no trigger, so this runs first.
+ */
+export function notePrState(payload) {
+    try {
+        const p = (payload ?? {});
+        const pr = p.pull_request;
+        const owner = p.repository?.owner?.login;
+        const name = p.repository?.name;
+        if (!pr || !owner || !name || !Number.isInteger(Number(pr.number)))
+            return;
+        const state = pr.merged || pr.merged_at ? 'merged' : pr.state === 'open' ? 'open' : 'closed';
+        if (state === 'open')
+            notePrHead(`${owner}/${name}`, Number(pr.number), String(pr.head?.sha ?? ''), typeof pr.updated_at === 'string' ? pr.updated_at : undefined);
+        for (const w of list('watches')) {
+            // Any repo in the dot's set can own the PR, not only the first app repo.
+            if (!findRepo(w, { owner, name }))
+                continue;
+            // Only drafts older than this delivery's PR update: a redelivered or out-of-order event cannot expire newer ones.
+            const updated = typeof pr.updated_at === 'string' ? pr.updated_at : undefined;
+            applyPrState(w.id, Number(pr.number), { state, headSha: String(pr.head?.sha ?? ''), ...(state === 'merged' && pr.merge_commit_sha ? { mergeSha: String(pr.merge_commit_sha) } : {}) }, updated, `${owner}/${name}`);
+        }
+    }
+    catch (err) {
+        log.warn(`pull_request approval check failed: ${String(err)}`);
+    }
+}
+/** True when a dot that holds `repo` as an app repo lists `branch` in testBranches (KAT-292). */
+function listsTestBranch(repo, branch) {
+    return list('watches').some((w) => !w.paused && !w.archived && (w.testBranches ?? []).includes(branch) && findRepo(w, repo)?.role === 'app');
+}
+export function normalize(source, eventName, payload, deliveryId) {
+    switch (source) {
+        case 'github':
+            if (eventName === 'issues' || eventName === 'issue_comment')
+                return normalizeGithubIssue(eventName, payload);
+            return normalizeGithub(eventName ?? '', payload, deliveryId, { isTestBranch: listsTestBranch });
+        case 'jira':
+            return normalizeJira(payload, deliveryId);
+        case 'linear':
+            return normalizeLinear(payload);
+        default: {
+            const p = (payload ?? {});
+            const kind = p.kind ?? (source === 'statuspage' ? 'statuspage' : source === 'schedule' ? 'schedule' : 'probe_down');
+            return {
+                ...p,
+                source,
+                kind,
+                dedupeKey: p.dedupeKey ?? `${source}:${kind}:${p.probe?.url ?? p.url ?? ''}:${Date.now()}`,
+                title: p.title ?? (kind === 'probe_down' ? `Probe failing: ${p.probe?.url ?? ''}` : `${source} ${kind}`),
+            };
+        }
+    }
+}
+/** Normalizes a payload; returns the event, or the result that ends the delivery. */
+function prepare(source, eventName, payload, opts) {
+    let ev;
+    if (source === 'github' && eventName === 'pull_request' && !opts.simulate)
+        notePrState(payload);
+    try {
+        ev = normalize(source, eventName, payload, opts.deliveryId);
+    }
+    catch (err) {
+        log.error(`normalize ${source}/${eventName ?? ''} failed`, err);
+        return { result: { accepted: false, reason: `normalize failed: ${String(err)}`, jobs: [] } };
+    }
+    if (!ev)
+        return { result: { accepted: false, reason: `ignored ${source} event ${eventName ?? ''}`.trim(), jobs: [] } };
+    // Simulations must never collide with each other or with real deliveries.
+    if (opts.simulate)
+        ev = { ...ev, dedupeKey: `${ev.dedupeKey}:sim:${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}` };
+    return { ev };
+}
+export function ingest(source, eventName, payload, opts = {}) {
+    const p = prepare(source, eventName, payload, opts);
+    return 'result' in p ? p.result : dispatchTrigger(p.ev, opts);
+}
+/**
+ * Like ingest, but first reads what the dots need from GitHub: the PR's changed files when a dot filters the repo by
+ * path (KAT-160), and the team and linked issue answers when a dot scopes its PRs (KAT-354).
+ */
+export async function ingestResolved(source, eventName, payload, opts = {}) {
+    const p = prepare(source, eventName, payload, opts);
+    if ('result' in p)
+        return p.result;
+    const ev = await resolveChangedFiles(p.ev);
+    return dispatchTrigger(opts.simulate ? ev : await resolvePrScope(ev), opts);
+}
+/**
+ * The answer for a source whose webhook secret is unset: 503 and nothing queued, unless
+ * LOCALDOST_ALLOW_UNSIGNED_WEBHOOKS=1. Returns undefined when the event may go on to be handled.
+ */
+function unsignedGate(setting, label, warnKey) {
+    if (config.allowUnsignedWebhooks) {
+        log.warnOnce(warnKey, `${setting} unset: ${label} webhook signatures are not verified (LOCALDOST_ALLOW_UNSIGNED_WEBHOOKS is on)`);
+        return undefined;
+    }
+    const text = `${setting} is not set, so this server refuses ${label} webhooks. Set ${setting} to the secret configured on the ${label} webhook. For a local demo only, set LOCALDOST_ALLOW_UNSIGNED_WEBHOOKS=1.`;
+    return { status: 503, body: { error: text }, text };
+}
+function header(h, name) {
+    const v = h[name.toLowerCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+function parseBody(raw, contentType) {
+    const text = raw.toString('utf8');
+    // GitHub can be configured to send form-encoded `payload=<json>`.
+    if (contentType?.includes('application/x-www-form-urlencoded')) {
+        const p = new URLSearchParams(text).get('payload');
+        return p ? JSON.parse(p) : {};
+    }
+    return text ? JSON.parse(text) : {};
+}
+function toResponse(r) {
+    return {
+        status: 202,
+        body: { ok: true, accepted: r.accepted, duplicate: r.duplicate ?? false, reason: r.reason, jobs: r.jobs.map((j) => j.jobId) },
+    };
+}
+/** Does any live dot set a PR scope on an app repo? */
+function someDotScopesPrs() {
+    return list('watches').some((w) => !w.paused && !w.archived && watchRepos(w).some((r) => r.role === 'app' && !!r.prScope));
+}
+export function handleGithubHook(raw, headers) {
+    const secret = config.secrets.github;
+    const eventName = header(headers, 'x-github-event') ?? '';
+    if (secret) {
+        if (!verifyGithub(raw, secret, header(headers, 'x-hub-signature-256')))
+            return { status: 401, body: { error: 'bad signature' } };
+        // A signed delivery shows that GitHub sends webhooks here; the setup flow reads it (src/webhook-seen.ts).
+        noteWebhook('github', eventName);
+    }
+    else {
+        const refused = unsignedGate('GITHUB_WEBHOOK_SECRET', 'GitHub', 'gh-secret');
+        if (refused)
+            return refused;
+    }
+    if (eventName === 'ping')
+        return { status: 200, body: { ok: true, pong: true } };
+    let payload;
+    try {
+        payload = parseBody(raw, header(headers, 'content-type'));
+    }
+    catch {
+        return { status: 400, body: { error: 'invalid JSON' } };
+    }
+    if (eventName === 'issues') {
+        recordIssueEvent(payload);
+        return toResponse(ingest('github', eventName, payload, { deliveryId: header(headers, 'x-github-delivery') }));
+    }
+    // `/localdost review` on an issue asks for a ticket review, on a PR for a new check; the write-access check is async.
+    if (eventName === 'issue_comment' && payload?.action === 'created') {
+        const p = payload;
+        if (p.issue?.pull_request)
+            return handlePrCommand(payload);
+        // A comment on an issue that is no command may answer the questions of a ticket review (KAT-393).
+        return REVIEW_COMMAND.test(String(p.comment?.body ?? '')) ? handleIssueCommand(payload) : handleIssueAnswer(payload);
+    }
+    // Sticky-comment edits carry checklist ticks; they update a run and start no job.
+    if (eventName === 'issue_comment')
+        return handleCommentEdit(payload);
+    // The normalizer keys dedupe on X-GitHub-Delivery when present; redeliveries reuse the same GUID.
+    // A pull_request may need its file list for repo pathFilters, so it answers after that read. A push to a repo with a PR
+    // scope needs the PR whose merge it is, so the scope can keep the merge of a PR it kept out from running (KAT-354).
+    if (eventName === 'pull_request' || (eventName === 'push' && someDotScopesPrs()))
+        return ingestResolved('github', eventName, payload, { deliveryId: header(headers, 'x-github-delivery') }).then(toResponse);
+    return toResponse(ingest('github', eventName, payload, { deliveryId: header(headers, 'x-github-delivery') }));
+}
+/** issue_comment: only edits of the sticky comment matter. The permission check is async, so it runs after the 202. */
+export function handleCommentEdit(payload) {
+    const edit = normalizeCommentEdit('issue_comment', payload);
+    if (!edit)
+        return { status: 202, body: { ok: true, accepted: false, reason: 'not an edit of the localdost comment' } };
+    void applyChecklistEdit(edit)
+        .then((r) => log.info(`checklist edit on ${edit.repo.owner}/${edit.repo.name}#${edit.pr}: ${r.reason}`))
+        .catch((err) => log.error('checklist edit failed', err));
+    return { status: 202, body: { ok: true, accepted: true, checklist: true } };
+}
+/**
+ * issue_comment.created with `/localdost review` on an issue. Only users with write access may ask, so
+ * outsiders cannot spend model calls. The check runs after the 202.
+ */
+export function handleIssueCommand(payload, check) {
+    const ev = normalizeGithubIssue('issue_comment', payload);
+    if (!ev?.ticket)
+        return { status: 202, body: { ok: true, accepted: false, reason: 'not a /localdost review command on an issue' } };
+    const full = ev.ticket.projectKey;
+    const login = ev.ticket.change?.value ?? '';
+    const canWrite = check ?? ((repo, user) => issueApi(repo).writePermission(user));
+    void canWrite(full, login)
+        .then((ok) => {
+        if (ok !== true)
+            return log.info(`/localdost review on ${ev.ticket.key} by ${login}: ignored, no write access`);
+        const r = dispatchTrigger(ev);
+        log.info(`/localdost review on ${ev.ticket.key} by ${login}: ${r.accepted ? `${r.jobs.length} job(s)` : r.reason}`);
+    })
+        .catch((err) => log.error('/localdost review failed', err));
+    return { status: 202, body: { ok: true, accepted: true, command: true } };
+}
+/**
+ * issue_comment.created on an issue, no command in it (KAT-393): the same decision the poller makes for the comments it reads
+ * (src/flows/answers.ts). The checks that need GitHub (who wrote the issue, who has write access) run after the 202.
+ */
+export function answerFromWebhook(payload, deps = {}) {
+    const p = payload;
+    const repo = p?.repository;
+    const full = repo?.full_name ?? `${repo?.owner?.login ?? repo?.owner?.name ?? ''}/${repo?.name ?? ''}`;
+    const n = Number(p?.issue?.number);
+    if (!p?.comment || p.issue?.pull_request || !Number.isInteger(n) || !/^[^/]+\/[^/]+$/.test(full))
+        return Promise.resolve({ queued: 0, joined: 0, limit: 0, ignored: 1, retry: 0 });
+    // The delivery carries what the REST list does: the comment, its writer and role, and the issue it sits under.
+    const row = { ...p.comment, issue_url: p.comment.issue_url ?? `https://api.github.com/repos/${full}/issues/${n}` };
+    return handleNewComments(full, [row], deps);
+}
+/** A delivery that GitHub could not be asked about (the issue read or the write-access check failed) is judged again after each of these waits. */
+export const ANSWER_WEBHOOK_RETRY_MS = [30_000, 5 * 60_000, 20 * 60_000];
+const pause = (ms) => new Promise((resolve) => {
+    // The timer does not keep the process alive: a server that stops drops the retry, and a poll (when it is on) reads the comment again.
+    setTimeout(resolve, ms).unref();
+});
+/**
+ * answerFromWebhook, asked again after each wait of `delays` while GitHub fails (`retry` in the tally). A webhook is sent once, so without
+ * this a 5xx or a rate limit on the issue read would lose the answer for good. A comment judged on an earlier try is absorbed by its job
+ * key, so a dot that queued its review does not queue it twice. Returns the tally of the last try.
+ */
+export async function answerWithRetry(payload, deps = {}, delays = ANSWER_WEBHOOK_RETRY_MS, wait = pause) {
+    for (let i = 0;; i++) {
+        const t = await answerFromWebhook(payload, deps);
+        if (t.queued || t.joined || t.limit)
+            log.info(`issue comment: ${t.queued} review(s) queued, ${t.joined} joined to a waiting review, ${t.limit} over the daily limit`);
+        if (!t.retry)
+            return t;
+        if (i >= delays.length) {
+            log.warn(`issue comment: GitHub did not answer after ${i + 1} tries, so the comment is not judged`);
+            return t;
+        }
+        log.warn(`issue comment: GitHub did not answer, so the comment is judged again in ${Math.round(delays[i] / 1000)} s`);
+        await wait(delays[i]);
+    }
+}
+export function handleIssueAnswer(payload, deps = {}) {
+    void answerWithRetry(payload, deps).catch((err) => log.error('issue comment answer check failed', err));
+    return { status: 202, body: { ok: true, accepted: false, reason: 'not a /localdost review command on an issue' } };
+}
+/**
+ * issue_comment.created with `/localdost review` on a pull request: a new check of its latest push, for every dot that watches the
+ * repo as an app repo (KAT-376, the footer of every report says it works). Only users with write access may ask, so outsiders
+ * cannot spend model calls, and a bot never asks. The check runs after the 202.
+ */
+export function handlePrCommand(payload, deps = {}) {
+    const p = payload;
+    const body = String(p?.comment?.body ?? '');
+    const repo = { owner: String(p?.repository?.owner?.login ?? p?.repository?.owner?.name ?? ''), name: String(p?.repository?.name ?? '') };
+    const pr = Number(p?.issue?.number);
+    const login = String(p?.sender?.login ?? '');
+    const no = (reason) => ({ status: 202, body: { ok: true, accepted: false, reason } });
+    if (p?.action !== 'created' || !p.issue?.pull_request || !Number.isInteger(pr) || !repo.owner || !repo.name)
+        return no('not a /localdost review command on a PR');
+    if (!REVIEW_COMMAND.test(body) || hasStickyMarker(body))
+        return no('not a /localdost review command on a PR');
+    if (p.sender?.type === 'Bot' || /\[bot\]$/.test(login))
+        return no('a bot asked');
+    const canWrite = deps.canWrite ?? ((w, r, user) => githubFor(w, { repo: r }).writePermission(user));
+    const ask = deps.ask ??
+        (async (w, n, r) => {
+            const { requestReview } = await import('./review/on-demand.js');
+            return requestReview(w, { pr: n }, { requestedBy: 'user', repo: r });
+        });
+    void (async () => {
+        const watches = list('watches').filter((w) => !w.archived && !w.paused && findRepo(w, repo)?.role === 'app');
+        for (const w of watches) {
+            if ((await canWrite(w, repo, login)) !== true) {
+                log.info(`/localdost review on ${repo.owner}/${repo.name}#${pr} by ${login}: ignored, no write access`);
+                continue;
+            }
+            const r = await ask(w, pr, `${repo.owner}/${repo.name}`);
+            log.info(`/localdost review on ${repo.owner}/${repo.name}#${pr} by ${login}: ${r.ok ? 'queued' : (r.error ?? 'not queued')}`);
+        }
+    })().catch((err) => log.error('/localdost review on a PR failed', err));
+    return { status: 202, body: { ok: true, accepted: true, command: true } };
+}
+export function handleJiraHook(raw, headers) {
+    const secret = config.secrets.jira;
+    if (secret) {
+        if (!verifyJira(raw, secret, header(headers, 'x-hub-signature')))
+            return { status: 401, body: { error: 'bad signature' } };
+    }
+    else {
+        const refused = unsignedGate('JIRA_WEBHOOK_SECRET', 'Jira', 'jira-secret');
+        if (refused)
+            return refused;
+    }
+    let payload;
+    try {
+        payload = parseBody(raw, header(headers, 'content-type'));
+    }
+    catch {
+        return { status: 400, body: { error: 'invalid JSON' } };
+    }
+    return toResponse(ingest('jira', payload?.webhookEvent, payload, {
+        deliveryId: header(headers, 'x-atlassian-webhook-identifier'),
+    }));
+}
+export function handleLinearHook(raw, headers) {
+    const secret = config.secrets.linear;
+    if (!secret) {
+        const refused = unsignedGate('LINEAR_WEBHOOK_SECRET', 'Linear', 'linear-secret');
+        if (refused)
+            return refused;
+    }
+    let payload;
+    try {
+        payload = parseBody(raw, header(headers, 'content-type'));
+    }
+    catch {
+        return { status: 400, body: { error: 'invalid JSON' } };
+    }
+    if (secret) {
+        const v = verifyLinear(raw, secret, header(headers, 'linear-signature'), payload?.webhookTimestamp);
+        if (!v.ok)
+            return { status: 401, body: { error: v.reason } };
+    }
+    const p = payload;
+    return toResponse(ingest('linear', `${p?.type ?? ''}.${p?.action ?? ''}`, payload));
+}
+//# sourceMappingURL=webhooks.js.map