@automagik/omni 2.260910.15 → 2.260910.17

package/dist/index.js

@@ -115765,7 +115765,7 @@ var require_client2 = __commonJS((exports) => {
 
 // ../../node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js
 var require_esmLoader = __commonJS((exports) => {
-  var __filename = "/home/runner/work/omni/omni/.stable-source/node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js";
+  var __filename = "/home/runner/work/omni/omni/node_modules/.bun/@sentry+node-core@10.52.0+2c50d7e904f6cfd7/node_modules/@sentry/node-core/build/cjs/sdk/esmLoader.js";
   Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
   var core = require_cjs();
   var importInTheMiddle = require_import_in_the_middle();
@@ -137198,7 +137198,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.260910.15",
+  version: "2.260910.17",
   repository: {
     type: "git",
     url: "git+https://github.com/automagik-dev/omni.git",
@@ -150668,6 +150668,744 @@ function createSlackCommand() {
   return cmd;
 }
 
+// src/commands/sources.ts
+import { randomBytes as randomBytes4 } from "crypto";
+init_config();
+init_output();
+// src/commands/sources/github/custom.github.issues.json
+var custom_github_issues_default = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "custom.github.issues",
+  description: "GitHub issues webhook delivery (X-GitHub-Event: issues). Minimal-but-real contract: the fields consumers rely on are required; everything else GitHub sends passes through (additionalProperties: true). Evolution rule: revisions must be additive-optional (issue #959).",
+  type: "object",
+  additionalProperties: true,
+  required: ["action", "issue", "repository", "sender"],
+  properties: {
+    action: {
+      type: "string",
+      description: "What happened: opened, closed, edited, labeled, ..."
+    },
+    issue: {
+      type: "object",
+      additionalProperties: true,
+      required: ["number"],
+      properties: {
+        number: { type: "integer", description: "Issue number" },
+        title: { type: "string" },
+        state: { type: "string" },
+        html_url: { type: "string" }
+      }
+    },
+    repository: {
+      type: "object",
+      additionalProperties: true,
+      required: ["full_name"],
+      properties: {
+        full_name: {
+          type: "string",
+          description: "owner/repo, e.g. automagik-dev/omni"
+        }
+      }
+    },
+    sender: {
+      type: "object",
+      additionalProperties: true,
+      required: ["login"],
+      properties: {
+        login: {
+          type: "string",
+          description: "GitHub username that triggered the delivery"
+        }
+      }
+    }
+  }
+};
+// src/commands/sources/github/custom.github.pull_request.json
+var custom_github_pull_request_default = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "custom.github.pull_request",
+  description: "GitHub pull_request webhook delivery (X-GitHub-Event: pull_request). Minimal-but-real contract: the fields consumers rely on are required; everything else GitHub sends passes through (additionalProperties: true). Evolution rule: revisions must be additive-optional (issue #959).",
+  type: "object",
+  additionalProperties: true,
+  required: ["action", "number", "repository", "sender"],
+  properties: {
+    action: {
+      type: "string",
+      description: "What happened: opened, closed, synchronize, reopened, ..."
+    },
+    number: {
+      type: "integer",
+      description: "Pull request number"
+    },
+    pull_request: {
+      type: "object",
+      additionalProperties: true,
+      properties: {
+        title: { type: "string" },
+        state: { type: "string" },
+        merged: { type: "boolean" },
+        html_url: { type: "string" }
+      }
+    },
+    repository: {
+      type: "object",
+      additionalProperties: true,
+      required: ["full_name"],
+      properties: {
+        full_name: {
+          type: "string",
+          description: "owner/repo, e.g. automagik-dev/omni"
+        }
+      }
+    },
+    sender: {
+      type: "object",
+      additionalProperties: true,
+      required: ["login"],
+      properties: {
+        login: {
+          type: "string",
+          description: "GitHub username that triggered the delivery"
+        }
+      }
+    }
+  }
+};
+// src/commands/sources/github/custom.github.push.json
+var custom_github_push_default = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "custom.github.push",
+  description: "GitHub push webhook delivery (X-GitHub-Event: push). Minimal-but-real contract: the fields consumers rely on are required; everything else GitHub sends passes through (additionalProperties: true). Evolution rule: revisions must be additive-optional (issue #959).",
+  type: "object",
+  additionalProperties: true,
+  required: ["ref", "repository", "sender"],
+  properties: {
+    ref: {
+      type: "string",
+      description: "Full git ref that was pushed, e.g. refs/heads/main"
+    },
+    before: {
+      type: "string",
+      description: "SHA of the most recent commit on ref before the push"
+    },
+    after: {
+      type: "string",
+      description: "SHA of the most recent commit on ref after the push"
+    },
+    commits: {
+      type: "array",
+      description: "Commits in the push (GitHub caps this at 2048 entries)",
+      items: {
+        type: "object",
+        additionalProperties: true,
+        properties: {
+          id: { type: "string" },
+          message: { type: "string" },
+          url: { type: "string" }
+        }
+      }
+    },
+    repository: {
+      type: "object",
+      additionalProperties: true,
+      required: ["full_name"],
+      properties: {
+        full_name: {
+          type: "string",
+          description: "owner/repo, e.g. automagik-dev/omni"
+        }
+      }
+    },
+    sender: {
+      type: "object",
+      additionalProperties: true,
+      required: ["login"],
+      properties: {
+        login: {
+          type: "string",
+          description: "GitHub username that triggered the delivery"
+        }
+      }
+    }
+  }
+};
+// src/commands/sources/github/custom.github.release.json
+var custom_github_release_default = {
+  $schema: "http://json-schema.org/draft-07/schema#",
+  title: "custom.github.release",
+  description: "GitHub release webhook delivery (X-GitHub-Event: release). Minimal-but-real contract: the fields consumers rely on are required; everything else GitHub sends passes through (additionalProperties: true). Evolution rule: revisions must be additive-optional (issue #959).",
+  type: "object",
+  additionalProperties: true,
+  required: ["action", "release", "repository", "sender"],
+  properties: {
+    action: {
+      type: "string",
+      description: "What happened: published, created, edited, released, ..."
+    },
+    release: {
+      type: "object",
+      additionalProperties: true,
+      required: ["tag_name"],
+      properties: {
+        tag_name: { type: "string", description: "Git tag of the release, e.g. v2.260907.4" },
+        name: { type: "string" },
+        draft: { type: "boolean" },
+        prerelease: { type: "boolean" },
+        html_url: { type: "string" }
+      }
+    },
+    repository: {
+      type: "object",
+      additionalProperties: true,
+      required: ["full_name"],
+      properties: {
+        full_name: {
+          type: "string",
+          description: "owner/repo, e.g. automagik-dev/omni"
+        }
+      }
+    },
+    sender: {
+      type: "object",
+      additionalProperties: true,
+      required: ["login"],
+      properties: {
+        login: {
+          type: "string",
+          description: "GitHub username that triggered the delivery"
+        }
+      }
+    }
+  }
+};
+
+// src/commands/webhooks.ts
+import { readFileSync as readFileSync18 } from "fs";
+init_zod();
+init_output();
+var SIGNATURE_ALGORITHMS = ["hmac-sha256", "hmac-sha1", "token-match"];
+var signatureSecretSchema = exports_external.string().min(8, "at least 8 characters").max(512, "at most 512 characters");
+var SECRET_SOURCE_FLAGS = "--signature-secret, --signature-secret-env, --signature-secret-stdin";
+async function readSecretFromStdin() {
+  if (process.stdin.isTTY) {
+    throw new Error('--signature-secret-stdin requires piped stdin (e.g. `printf %s "$SECRET" | omni webhooks ...`)');
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf-8");
+}
+async function resolveSignatureSecret(options3, readStdin = readSecretFromStdin) {
+  const sources = [
+    options3.signatureSecret !== undefined,
+    options3.signatureSecretEnv !== undefined,
+    options3.signatureSecretStdin === true
+  ].filter(Boolean).length;
+  if (sources === 0)
+    return;
+  if (sources > 1) {
+    throw new Error(`Use only one of ${SECRET_SOURCE_FLAGS}`);
+  }
+  let raw2;
+  let origin;
+  if (options3.signatureSecretEnv !== undefined) {
+    const name = options3.signatureSecretEnv;
+    if (!name)
+      throw new Error("--signature-secret-env requires a variable name");
+    raw2 = process.env[name];
+    origin = `environment variable ${name}`;
+    if (raw2 === undefined || raw2 === "") {
+      throw new Error(`${origin} is not set or empty`);
+    }
+  } else if (options3.signatureSecretStdin) {
+    raw2 = (await readStdin()).replace(/\r?\n$/, "");
+    origin = "stdin";
+    if (!raw2)
+      throw new Error("no secret received on stdin");
+  } else {
+    raw2 = options3.signatureSecret;
+    origin = "--signature-secret";
+  }
+  const parsed = signatureSecretSchema.safeParse(raw2);
+  if (!parsed.success) {
+    const reason = parsed.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid signature secret from ${origin}: ${reason}`);
+  }
+  return parsed.data;
+}
+function buildSignatureConfig(options3) {
+  const { signatureAlgorithm, signatureHeader, signaturePrefix } = options3;
+  if (!signatureAlgorithm && !signatureHeader && !signaturePrefix)
+    return;
+  if (!signatureAlgorithm || !signatureHeader) {
+    error("--signature-algorithm and --signature-header must be provided together");
+  }
+  const algorithm = SIGNATURE_ALGORITHMS.find((a2) => a2 === signatureAlgorithm);
+  if (!algorithm) {
+    error(`Invalid --signature-algorithm; expected one of: ${SIGNATURE_ALGORITHMS.join(", ")}`);
+  }
+  if (algorithm === "token-match" && signaturePrefix) {
+    error("--signature-prefix is not applicable to token-match (the header carries the secret verbatim)");
+  }
+  return { algorithm, header: signatureHeader, prefix: signaturePrefix };
+}
+var eventTypeMappingSchema = exports_external.discriminatedUnion("source", [
+  exports_external.object({
+    source: exports_external.literal("header"),
+    header: exports_external.string().min(1, "header must be 1-200 characters").max(200, "header must be 1-200 characters")
+  }),
+  exports_external.object({
+    source: exports_external.literal("body"),
+    path: exports_external.string().min(1, "path must be 1-200 characters").max(200, "path must be 1-200 characters")
+  })
+]);
+var EVENT_TYPE_MAPPING_HINT = 'expected {"source":"header","header":"X-GitHub-Event"} or {"source":"body","path":"event"}';
+function resolveEventTypeMapping(raw2) {
+  if (raw2 === undefined)
+    return;
+  let text3 = raw2;
+  if (raw2.startsWith("@")) {
+    const path = raw2.slice(1);
+    try {
+      text3 = readFileSync18(path, "utf-8");
+    } catch (err2) {
+      const reason = err2 instanceof Error ? err2.message : "Unknown error";
+      throw new Error(`Cannot read --event-type-mapping file '${path}': ${reason}`);
+    }
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text3);
+  } catch {
+    throw new Error(`Invalid JSON for --event-type-mapping; ${EVENT_TYPE_MAPPING_HINT}`);
+  }
+  const result = eventTypeMappingSchema.safeParse(parsed);
+  if (!result.success) {
+    const reason = result.error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
+    throw new Error(`Invalid --event-type-mapping: ${reason}; ${EVENT_TYPE_MAPPING_HINT}`);
+  }
+  return result.data;
+}
+async function buildUpdateSourcePatch(options3) {
+  const updates = buildLifecycleUpdates(options3);
+  if (options3.name)
+    updates.name = options3.name;
+  if (options3.description)
+    updates.description = options3.description;
+  if (options3.idempotencyKeyTemplate)
+    updates.idempotencyKeyTemplate = options3.idempotencyKeyTemplate;
+  if (options3.strictSchemas !== undefined)
+    updates.strictSchemas = options3.strictSchemas;
+  if (options3.clearEventTypeMapping && options3.eventTypeMapping !== undefined) {
+    throw new Error("Use only one of --event-type-mapping and --clear-event-type-mapping");
+  }
+  if (options3.clearEventTypeMapping)
+    updates.eventTypeMapping = null;
+  const eventTypeMapping = resolveEventTypeMapping(options3.eventTypeMapping);
+  if (eventTypeMapping !== undefined)
+    updates.eventTypeMapping = eventTypeMapping;
+  if (options3.enable)
+    updates.enabled = true;
+  if (options3.disable)
+    updates.enabled = false;
+  if (options3.clearSignature) {
+    updates.signatureConfig = null;
+    return updates;
+  }
+  const signatureConfig = buildSignatureConfig(options3);
+  if (signatureConfig)
+    updates.signatureConfig = signatureConfig;
+  const signatureSecret = await resolveSignatureSecret(options3);
+  if (signatureSecret)
+    updates.signatureSecret = signatureSecret;
+  return updates;
+}
+function assertPairedSignatureOnCreate(signatureConfig, signatureSecret) {
+  if (signatureConfig === undefined === (signatureSecret === undefined))
+    return;
+  if (signatureConfig === undefined) {
+    throw new Error(`a signature secret (${SECRET_SOURCE_FLAGS}) requires --signature-algorithm and --signature-header`);
+  }
+  throw new Error(`--signature-algorithm and --signature-header require a signature secret (${SECRET_SOURCE_FLAGS})`);
+}
+var WINDOW_SEMANTICS = ["future_only", "includes_in_progress"];
+var MUTATION_POLICIES = ["same_id", "new_id"];
+function parseExpectedInterval(raw2) {
+  if (raw2 === undefined)
+    return;
+  const seconds = Number(raw2);
+  if (!Number.isInteger(seconds) || seconds < 1) {
+    error("--expected-interval must be a positive integer number of seconds");
+  }
+  return seconds;
+}
+function parseWindowSemantics(raw2) {
+  if (raw2 === undefined)
+    return;
+  const value = WINDOW_SEMANTICS.find((v4) => v4 === raw2);
+  if (!value) {
+    error(`Invalid --window-semantics; expected one of: ${WINDOW_SEMANTICS.join(", ")}`);
+  }
+  return value;
+}
+function parseMutationPolicy(raw2) {
+  if (raw2 === undefined)
+    return;
+  const value = MUTATION_POLICIES.find((v4) => v4 === raw2);
+  if (!value) {
+    error(`Invalid --mutation-policy; expected one of: ${MUTATION_POLICIES.join(", ")}`);
+  }
+  return value;
+}
+function buildLifecycleUpdates(options3) {
+  if (options3.clearCadence && options3.expectedInterval !== undefined) {
+    error("Use only one of --expected-interval and --clear-cadence");
+  }
+  const updates = {};
+  if (options3.clearCadence)
+    updates.expectedIntervalSeconds = null;
+  const expectedIntervalSeconds = parseExpectedInterval(options3.expectedInterval);
+  if (expectedIntervalSeconds !== undefined)
+    updates.expectedIntervalSeconds = expectedIntervalSeconds;
+  const windowSemantics = parseWindowSemantics(options3.windowSemantics);
+  if (windowSemantics !== undefined)
+    updates.windowSemantics = windowSemantics;
+  const mutationPolicy = parseMutationPolicy(options3.mutationPolicy);
+  if (mutationPolicy !== undefined)
+    updates.mutationPolicy = mutationPolicy;
+  return updates;
+}
+function createWebhooksCommand() {
+  const webhooks = new Command("webhooks").description("Manage webhook sources");
+  webhooks.command("list").description("List webhook sources").option("--enabled", "Show only enabled sources").option("--disabled", "Show only disabled sources").action(async (options3) => {
+    const client = getClient();
+    try {
+      let enabledFilter;
+      if (options3.enabled)
+        enabledFilter = true;
+      if (options3.disabled)
+        enabledFilter = false;
+      const result = await client.webhooks.listSources({
+        enabled: enabledFilter
+      });
+      const items = result.map((w) => ({
+        id: w.id,
+        name: w.name,
+        enabled: w.enabled ? "yes" : "no",
+        health: w.livenessStatus ?? "-",
+        cadence: w.expectedIntervalSeconds != null ? `${w.expectedIntervalSeconds}s` : "-",
+        createdAt: w.createdAt
+      }));
+      list(items, { emptyMessage: "No webhook sources found." });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to list webhook sources: ${message2}`);
+    }
+  });
+  webhooks.command("get <id>").description("Get webhook source details").action(async (id) => {
+    const resolvedId = await resolveWebhookId(id);
+    const client = getClient();
+    try {
+      const source = await client.webhooks.getSource(resolvedId);
+      data(source);
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to get webhook source: ${message2}`);
+    }
+  });
+  webhooks.command("create").description("Create a webhook source").requiredOption("--name <name>", "Webhook source name").option("--description <desc>", "Description").option("--disabled", "Create in disabled state").option("--headers <json>", `Expected headers as JSON (e.g., '{"X-Secret": true}')`).option("--signature-algorithm <alg>", "Signature verification: hmac-sha256, hmac-sha1, or token-match").option("--signature-header <name>", "Header carrying the signature/token (e.g., X-Hub-Signature-256)").option("--signature-prefix <prefix>", "Prefix before the hex digest (e.g., 'sha256=')").option("--signature-secret <secret>", "Shared secret for signature verification (write-only). Visible in shell history and process lists \u2014 prefer --signature-secret-env or --signature-secret-stdin").option("--signature-secret-env <VAR>", "Read the shared secret from environment variable VAR").option("--signature-secret-stdin", "Read the shared secret from stdin (trailing newline stripped)").option("--idempotency-key-template <template>", "Delivery-identity key template for redelivery dedup (#958). Placeholders: {source}, {sha256(body)}, " + "{headers.<name>}, {payload.<dot.path>}. Defaults to '{source}:{sha256(body)}'").option("--strict-schemas", "Refuse deliveries whose event type has no enabled registered schema (dead-lettered as " + "schema_not_registered, #1000). Recommended for new sources. Defaults to off").option("--event-type-mapping <json>", "Semantic event-type extraction (#959): inline JSON or @path/to/file.json, e.g. " + `'{"source":"header","header":"X-GitHub-Event"}' or '{"source":"body","path":"event"}'. ` + "A mapped source emits custom.{source}.{event} instead of the collapsed custom.webhook.{source}").option("--expected-interval <seconds>", "Declared cadence: >=1 event or heartbeat per N seconds. Arms liveness supervision (#961)").option("--window-semantics <value>", `Declared window semantics: ${WINDOW_SEMANTICS.join(" or ")}`).option("--mutation-policy <value>", `Declared mutation re-emit policy: ${MUTATION_POLICIES.join(" or ")}`).action(async (options3) => {
+    const client = getClient();
+    try {
+      let expectedHeaders;
+      if (options3.headers) {
+        try {
+          expectedHeaders = JSON.parse(options3.headers);
+        } catch {
+          error("Invalid JSON for --headers");
+        }
+      }
+      const signatureConfig = buildSignatureConfig(options3);
+      const signatureSecret = await resolveSignatureSecret(options3);
+      assertPairedSignatureOnCreate(signatureConfig, signatureSecret);
+      const source = await client.webhooks.createSource({
+        name: options3.name,
+        description: options3.description,
+        enabled: !options3.disabled,
+        expectedHeaders,
+        signatureConfig,
+        signatureSecret,
+        idempotencyKeyTemplate: options3.idempotencyKeyTemplate,
+        strictSchemas: options3.strictSchemas,
+        eventTypeMapping: resolveEventTypeMapping(options3.eventTypeMapping),
+        expectedIntervalSeconds: parseExpectedInterval(options3.expectedInterval),
+        windowSemantics: parseWindowSemantics(options3.windowSemantics),
+        mutationPolicy: parseMutationPolicy(options3.mutationPolicy)
+      });
+      const details = {
+        id: source.id,
+        name: source.name,
+        url: `POST /api/v2/webhooks/${source.name}`
+      };
+      if (signatureConfig) {
+        details.publicUrl = `POST /api/v2/webhooks/ingress/${source.name}`;
+      }
+      success(`Webhook source created: ${source.id}`, details);
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to create webhook source: ${message2}`);
+    }
+  });
+  webhooks.command("update <id>").description("Update a webhook source").option("--name <name>", "New name").option("--description <desc>", "New description").option("--enable", "Enable the webhook").option("--disable", "Disable the webhook").option("--signature-algorithm <alg>", "Signature verification: hmac-sha256, hmac-sha1, or token-match").option("--signature-header <name>", "Header carrying the signature/token (e.g., X-Hub-Signature-256)").option("--signature-prefix <prefix>", "Prefix before the hex digest (e.g., 'sha256=')").option("--signature-secret <secret>", "Shared secret for signature verification (write-only). Visible in shell history and process lists \u2014 prefer --signature-secret-env or --signature-secret-stdin").option("--signature-secret-env <VAR>", "Read the shared secret from environment variable VAR").option("--signature-secret-stdin", "Read the shared secret from stdin (trailing newline stripped)").option("--clear-signature", "Remove the signature config and stored secret").option("--idempotency-key-template <template>", "Delivery-identity key template for redelivery dedup (#958). Placeholders: {source}, {sha256(body)}, " + "{headers.<name>}, {payload.<dot.path>}").option("--strict-schemas", "Refuse deliveries whose event type has no enabled registered schema (dead-lettered as " + "schema_not_registered, #1000)").option("--no-strict-schemas", "Return the source to opt-in pass-through for unregistered event types").option("--event-type-mapping <json>", "Semantic event-type extraction (#959): inline JSON or @path/to/file.json, e.g. " + `'{"source":"header","header":"X-GitHub-Event"}' or '{"source":"body","path":"event"}'`).option("--clear-event-type-mapping", "Remove the mapping (deliveries fall back to the collapsed custom.webhook.{source} type)").option("--expected-interval <seconds>", "Declared cadence: >=1 event or heartbeat per N seconds. (Re)arms liveness supervision (#961)").option("--clear-cadence", "Remove the declared cadence (disarms liveness supervision)").option("--window-semantics <value>", `Declared window semantics: ${WINDOW_SEMANTICS.join(" or ")}`).option("--mutation-policy <value>", `Declared mutation re-emit policy: ${MUTATION_POLICIES.join(" or ")}`).action(async (id, options3) => {
+    const resolvedId = await resolveWebhookId(id);
+    const client = getClient();
+    try {
+      const updates = await buildUpdateSourcePatch(options3);
+      const source = await client.webhooks.updateSource(resolvedId, updates);
+      success(`Webhook source updated: ${source.id}`, {
+        id: source.id,
+        name: source.name,
+        enabled: source.enabled
+      });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to update webhook source: ${message2}`);
+    }
+  });
+  webhooks.command("delete <id>").description("Delete a webhook source").action(async (id) => {
+    const resolvedId = await resolveWebhookId(id);
+    const client = getClient();
+    try {
+      await client.webhooks.deleteSource(resolvedId);
+      success(`Webhook source deleted: ${resolvedId}`);
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to delete webhook source: ${message2}`);
+    }
+  });
+  webhooks.command("trigger").description("Trigger a custom event").requiredOption("--type <type>", "Event type").requiredOption("--payload <json>", "Event payload as JSON").option("--instance <id>", "Instance ID").option("--correlation-id <id>", "Correlation ID").option("--causation-id <event-id>", "Parent event ID (keeps the causality tree for mid-flow emissions, #1072)").action(async (options3) => {
+    const client = getClient();
+    try {
+      let payload;
+      try {
+        payload = JSON.parse(options3.payload);
+      } catch {
+        error("Invalid JSON for --payload");
+        return;
+      }
+      const result = await client.webhooks.trigger({
+        eventType: options3.type,
+        payload,
+        instanceId: options3.instance,
+        correlationId: options3.correlationId,
+        causationId: options3.causationId
+      });
+      success(`Event triggered: ${result.eventId}`, {
+        eventId: result.eventId,
+        eventType: result.eventType
+      });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to trigger event: ${message2}`);
+    }
+  });
+  webhooks.command("heartbeat <source>").description('Record a connector heartbeat ("ran, zero events found") \u2014 resets the liveness window (#961)').action(async (source) => {
+    const client = getClient();
+    try {
+      const result = await client.webhooks.heartbeat(source);
+      success(`Heartbeat recorded for '${result.source}'`, {
+        heartbeatAt: result.heartbeatAt,
+        livenessStatus: result.livenessStatus ?? "unsupervised",
+        expectedIntervalSeconds: result.expectedIntervalSeconds
+      });
+    } catch (err2) {
+      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
+      error(`Failed to record heartbeat: ${message2}`);
+    }
+  });
+  return webhooks;
+}
+
+// src/commands/sources.ts
+var github = {
+  name: "github",
+  description: "GitHub repo webhooks (RFC #925 Phase 3 recipe)",
+  signatureConfig: { algorithm: "hmac-sha256", header: "X-Hub-Signature-256", prefix: "sha256=" },
+  idempotencyKeyTemplate: "github:{headers.x-github-delivery}",
+  eventTypeMapping: { source: "header", header: "X-GitHub-Event" },
+  expectedIntervalSeconds: 86400,
+  schemas: { push: custom_github_push_default, pull_request: custom_github_pull_request_default, issues: custom_github_issues_default, release: custom_github_release_default },
+  async ensureProviderWebhook(api, repo, hook) {
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo))
+      throw new Error(`--repo must be OWNER/NAME, got '${repo}'`);
+    const body = {
+      active: true,
+      events: hook.events,
+      config: { url: hook.url, content_type: "json", secret: hook.secret, insecure_ssl: "0" }
+    };
+    const existing = await api("GET", `/repos/${repo}/hooks`);
+    const match = existing.find((h10) => h10.config?.url === hook.url);
+    if (match) {
+      await api("PATCH", `/repos/${repo}/hooks/${match.id}`, body);
+      return String(match.id);
+    }
+    const created = await api("POST", `/repos/${repo}/hooks`, { name: "web", ...body });
+    return String(created.id);
+  }
+};
+var PRESETS = { github };
+var GITHUB_API = "https://api.github.com";
+async function ghAvailable() {
+  try {
+    return await Bun.spawn({ cmd: ["gh", "auth", "status"], stdout: "ignore", stderr: "ignore" }).exited === 0;
+  } catch {
+    return false;
+  }
+}
+async function githubApiViaGh(method, path, body) {
+  const cmd = ["gh", "api", "--method", method, path];
+  if (body !== undefined)
+    cmd.push("--input", "-");
+  const proc = Bun.spawn({ cmd, stdin: body === undefined ? "ignore" : "pipe", stdout: "pipe", stderr: "pipe" });
+  if (body !== undefined && proc.stdin) {
+    proc.stdin.write(JSON.stringify(body));
+    proc.stdin.end();
+  }
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited
+  ]);
+  if (code !== 0)
+    throw new Error(`gh api ${method} ${path} failed: ${stderr.trim() || stdout.trim()}`);
+  return stdout.trim() ? JSON.parse(stdout) : undefined;
+}
+function githubApiViaToken(token) {
+  return async (method, path, body) => {
+    const resp = await fetch(`${GITHUB_API}${path}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${token}`,
+        accept: "application/vnd.github+json",
+        "content-type": "application/json"
+      },
+      body: body === undefined ? undefined : JSON.stringify(body)
+    });
+    if (!resp.ok)
+      throw new Error(`GitHub API ${method} ${path} returned ${resp.status}: ${await resp.text()}`);
+    return resp.status === 204 ? undefined : await resp.json();
+  };
+}
+async function resolveGithubApi() {
+  if (await ghAvailable())
+    return githubApiViaGh;
+  const token = process.env.GITHUB_TOKEN;
+  if (token)
+    return githubApiViaToken(token);
+  throw new Error("no GitHub credentials: log in with `gh auth login` or set GITHUB_TOKEN (or pass --no-provider-webhook)");
+}
+
+class StepFailure extends Error {
+  step;
+  completed;
+  constructor(step, completed, cause) {
+    super(cause instanceof Error ? cause.message : String(cause));
+    this.step = step;
+    this.completed = completed;
+  }
+}
+var STEPS = ["source", "idempotency", "event-type-mapping", "schemas", "provider-webhook"];
+async function addSource(input) {
+  const { preset, client } = input;
+  const unknown2 = input.events.filter((e10) => !(e10 in preset.schemas));
+  if (unknown2.length > 0) {
+    throw new Error(`unknown ${preset.name} events: ${unknown2.join(", ")} (known: ${Object.keys(preset.schemas).join(", ")})`);
+  }
+  const webhookUrl = `${input.publicUrl.replace(/\/+$/, "")}/api/v2/webhooks/ingress/${preset.name}`;
+  const completed = [];
+  const run = async (step, fn) => {
+    try {
+      const value = await fn();
+      completed.push(step);
+      return value;
+    } catch (err2) {
+      throw new StepFailure(step, completed, err2);
+    }
+  };
+  const source = await run(STEPS[0], async () => {
+    const existing = (await client.listSources()).find((s2) => s2.name === preset.name);
+    const body = {
+      description: preset.description,
+      signatureConfig: preset.signatureConfig,
+      signatureSecret: input.secret,
+      expectedIntervalSeconds: preset.expectedIntervalSeconds
+    };
+    if (existing)
+      return { id: (await client.updateSource(existing.id, body)).id, created: false };
+    return { id: (await client.createSource({ name: preset.name, enabled: true, ...body })).id, created: true };
+  });
+  await run(STEPS[1], () => client.updateSource(source.id, { idempotencyKeyTemplate: preset.idempotencyKeyTemplate }));
+  await run(STEPS[2], () => client.updateSource(source.id, { eventTypeMapping: preset.eventTypeMapping }));
+  await run(STEPS[3], async () => {
+    for (const event of input.events) {
+      const eventType = `custom.${preset.name}.${event}`;
+      await input.registerSchema(eventType, preset.schemas[event], `${preset.name} ${event} deliveries`);
+    }
+  });
+  let providerHookId;
+  if (input.providerWebhook) {
+    providerHookId = await run(STEPS[4], async () => preset.ensureProviderWebhook(await input.providerApi(), input.target, {
+      url: webhookUrl,
+      secret: input.secret,
+      events: input.events
+    }));
+  }
+  return { sourceId: source.id, created: source.created, webhookUrl, providerHookId, completed };
+}
+function createSourcesCommand() {
+  const sources = new Command("sources").description("One-command onboarding of external webhook sources");
+  sources.command("add <provider>").description(`Create or update a provider source end to end (presets: ${Object.keys(PRESETS).join(", ")})`).requiredOption("--repo <owner/name>", "Provider-side target (GitHub: OWNER/NAME)").option("--events <list>", "Comma-separated provider events (default: every bundled schema)").option("--public-url <url>", "Omni URL reachable from the provider (default: configured apiUrl)").option("--secret-env <VAR>", "Reuse the webhook secret from environment variable VAR instead of generating one").option("--no-provider-webhook", "Skip creating the webhook on the provider side").action(async (provider, options3) => {
+    const preset = PRESETS[provider];
+    if (!preset)
+      error(`Unknown provider '${provider}'. Presets: ${Object.keys(PRESETS).join(", ")}`);
+    const client = getClient();
+    try {
+      const secret = await resolveSignatureSecret({ signatureSecretEnv: options3.secretEnv }) ?? randomBytes4(32).toString("hex");
+      const result = await addSource({
+        preset,
+        target: options3.repo,
+        events: options3.events ? options3.events.split(",").map((e10) => e10.trim()) : Object.keys(preset.schemas),
+        secret,
+        publicUrl: options3.publicUrl ?? loadConfig().apiUrl ?? "http://localhost:8882",
+        providerWebhook: options3.providerWebhook,
+        client: client.webhooks,
+        registerSchema: (eventType, schema3, description) => schemaApiRequest("", { method: "POST", body: JSON.stringify({ eventType, schema: schema3, description }) }),
+        providerApi: resolveGithubApi
+      });
+      success(`Source ${result.created ? "created" : "updated"}: ${result.sourceId}`, {
+        id: result.sourceId,
+        name: preset.name,
+        secret,
+        webhookUrl: result.webhookUrl,
+        providerHookId: result.providerHookId ?? "(skipped)",
+        steps: result.completed.join(", ")
+      });
+      warn("The secret is shown once; store it now (re-run with --secret-env VAR to reuse it).");
+    } catch (err2) {
+      if (err2 instanceof StepFailure) {
+        const remaining = STEPS.filter((s2) => !err2.completed.includes(s2));
+        error(`Step '${err2.step}' failed: ${err2.message}`, {
+          completed: err2.completed,
+          remaining,
+          resume: "re-run the same command; completed steps are updated in place, not duplicated"
+        });
+      }
+      error(`Failed to add source: ${err2 instanceof Error ? err2.message : String(err2)}`);
+    }
+  });
+  return sources;
+}
+
 // src/commands/speak.ts
 import { writeFile as writeFile2 } from "fs/promises";
 init_output();
@@ -151881,7 +152619,7 @@ async function cleanupLegacyArtifacts(skipList) {
 init_output();
 
 // src/update-diagnostics.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync11 } from "fs";
 import { homedir as homedir13 } from "os";
 import { join as join18 } from "path";
 var UPDATE_DIAGNOSTICS_SCHEMA_VERSION = 1;
@@ -151916,7 +152654,7 @@ function tailFileLines(path, maxLines) {
   if (!existsSync19(path))
     return [];
   try {
-    const raw2 = readFileSync18(path, "utf8");
+    const raw2 = readFileSync19(path, "utf8");
     const lines = raw2.split(/\r?\n/);
     if (lines.length > 0 && lines[lines.length - 1] === "")
       lines.pop();
@@ -152599,353 +153337,6 @@ ${lines.join(`
   return voice;
 }
 
-// src/commands/webhooks.ts
-import { readFileSync as readFileSync19 } from "fs";
-init_zod();
-init_output();
-var SIGNATURE_ALGORITHMS = ["hmac-sha256", "hmac-sha1", "token-match"];
-var signatureSecretSchema = exports_external.string().min(8, "at least 8 characters").max(512, "at most 512 characters");
-var SECRET_SOURCE_FLAGS = "--signature-secret, --signature-secret-env, --signature-secret-stdin";
-async function readSecretFromStdin() {
-  if (process.stdin.isTTY) {
-    throw new Error('--signature-secret-stdin requires piped stdin (e.g. `printf %s "$SECRET" | omni webhooks ...`)');
-  }
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(Buffer.from(chunk));
-  }
-  return Buffer.concat(chunks).toString("utf-8");
-}
-async function resolveSignatureSecret(options3, readStdin = readSecretFromStdin) {
-  const sources = [
-    options3.signatureSecret !== undefined,
-    options3.signatureSecretEnv !== undefined,
-    options3.signatureSecretStdin === true
-  ].filter(Boolean).length;
-  if (sources === 0)
-    return;
-  if (sources > 1) {
-    throw new Error(`Use only one of ${SECRET_SOURCE_FLAGS}`);
-  }
-  let raw2;
-  let origin;
-  if (options3.signatureSecretEnv !== undefined) {
-    const name = options3.signatureSecretEnv;
-    if (!name)
-      throw new Error("--signature-secret-env requires a variable name");
-    raw2 = process.env[name];
-    origin = `environment variable ${name}`;
-    if (raw2 === undefined || raw2 === "") {
-      throw new Error(`${origin} is not set or empty`);
-    }
-  } else if (options3.signatureSecretStdin) {
-    raw2 = (await readStdin()).replace(/\r?\n$/, "");
-    origin = "stdin";
-    if (!raw2)
-      throw new Error("no secret received on stdin");
-  } else {
-    raw2 = options3.signatureSecret;
-    origin = "--signature-secret";
-  }
-  const parsed = signatureSecretSchema.safeParse(raw2);
-  if (!parsed.success) {
-    const reason = parsed.error.issues.map((issue) => issue.message).join("; ");
-    throw new Error(`Invalid signature secret from ${origin}: ${reason}`);
-  }
-  return parsed.data;
-}
-function buildSignatureConfig(options3) {
-  const { signatureAlgorithm, signatureHeader, signaturePrefix } = options3;
-  if (!signatureAlgorithm && !signatureHeader && !signaturePrefix)
-    return;
-  if (!signatureAlgorithm || !signatureHeader) {
-    error("--signature-algorithm and --signature-header must be provided together");
-  }
-  const algorithm = SIGNATURE_ALGORITHMS.find((a2) => a2 === signatureAlgorithm);
-  if (!algorithm) {
-    error(`Invalid --signature-algorithm; expected one of: ${SIGNATURE_ALGORITHMS.join(", ")}`);
-  }
-  if (algorithm === "token-match" && signaturePrefix) {
-    error("--signature-prefix is not applicable to token-match (the header carries the secret verbatim)");
-  }
-  return { algorithm, header: signatureHeader, prefix: signaturePrefix };
-}
-var eventTypeMappingSchema = exports_external.discriminatedUnion("source", [
-  exports_external.object({
-    source: exports_external.literal("header"),
-    header: exports_external.string().min(1, "header must be 1-200 characters").max(200, "header must be 1-200 characters")
-  }),
-  exports_external.object({
-    source: exports_external.literal("body"),
-    path: exports_external.string().min(1, "path must be 1-200 characters").max(200, "path must be 1-200 characters")
-  })
-]);
-var EVENT_TYPE_MAPPING_HINT = 'expected {"source":"header","header":"X-GitHub-Event"} or {"source":"body","path":"event"}';
-function resolveEventTypeMapping(raw2) {
-  if (raw2 === undefined)
-    return;
-  let text3 = raw2;
-  if (raw2.startsWith("@")) {
-    const path = raw2.slice(1);
-    try {
-      text3 = readFileSync19(path, "utf-8");
-    } catch (err2) {
-      const reason = err2 instanceof Error ? err2.message : "Unknown error";
-      throw new Error(`Cannot read --event-type-mapping file '${path}': ${reason}`);
-    }
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text3);
-  } catch {
-    throw new Error(`Invalid JSON for --event-type-mapping; ${EVENT_TYPE_MAPPING_HINT}`);
-  }
-  const result = eventTypeMappingSchema.safeParse(parsed);
-  if (!result.success) {
-    const reason = result.error.issues.map((issue) => issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message).join("; ");
-    throw new Error(`Invalid --event-type-mapping: ${reason}; ${EVENT_TYPE_MAPPING_HINT}`);
-  }
-  return result.data;
-}
-async function buildUpdateSourcePatch(options3) {
-  const updates = buildLifecycleUpdates(options3);
-  if (options3.name)
-    updates.name = options3.name;
-  if (options3.description)
-    updates.description = options3.description;
-  if (options3.idempotencyKeyTemplate)
-    updates.idempotencyKeyTemplate = options3.idempotencyKeyTemplate;
-  if (options3.strictSchemas !== undefined)
-    updates.strictSchemas = options3.strictSchemas;
-  if (options3.clearEventTypeMapping && options3.eventTypeMapping !== undefined) {
-    throw new Error("Use only one of --event-type-mapping and --clear-event-type-mapping");
-  }
-  if (options3.clearEventTypeMapping)
-    updates.eventTypeMapping = null;
-  const eventTypeMapping = resolveEventTypeMapping(options3.eventTypeMapping);
-  if (eventTypeMapping !== undefined)
-    updates.eventTypeMapping = eventTypeMapping;
-  if (options3.enable)
-    updates.enabled = true;
-  if (options3.disable)
-    updates.enabled = false;
-  if (options3.clearSignature) {
-    updates.signatureConfig = null;
-    return updates;
-  }
-  const signatureConfig = buildSignatureConfig(options3);
-  if (signatureConfig)
-    updates.signatureConfig = signatureConfig;
-  const signatureSecret = await resolveSignatureSecret(options3);
-  if (signatureSecret)
-    updates.signatureSecret = signatureSecret;
-  return updates;
-}
-function assertPairedSignatureOnCreate(signatureConfig, signatureSecret) {
-  if (signatureConfig === undefined === (signatureSecret === undefined))
-    return;
-  if (signatureConfig === undefined) {
-    throw new Error(`a signature secret (${SECRET_SOURCE_FLAGS}) requires --signature-algorithm and --signature-header`);
-  }
-  throw new Error(`--signature-algorithm and --signature-header require a signature secret (${SECRET_SOURCE_FLAGS})`);
-}
-var WINDOW_SEMANTICS = ["future_only", "includes_in_progress"];
-var MUTATION_POLICIES = ["same_id", "new_id"];
-function parseExpectedInterval(raw2) {
-  if (raw2 === undefined)
-    return;
-  const seconds = Number(raw2);
-  if (!Number.isInteger(seconds) || seconds < 1) {
-    error("--expected-interval must be a positive integer number of seconds");
-  }
-  return seconds;
-}
-function parseWindowSemantics(raw2) {
-  if (raw2 === undefined)
-    return;
-  const value = WINDOW_SEMANTICS.find((v4) => v4 === raw2);
-  if (!value) {
-    error(`Invalid --window-semantics; expected one of: ${WINDOW_SEMANTICS.join(", ")}`);
-  }
-  return value;
-}
-function parseMutationPolicy(raw2) {
-  if (raw2 === undefined)
-    return;
-  const value = MUTATION_POLICIES.find((v4) => v4 === raw2);
-  if (!value) {
-    error(`Invalid --mutation-policy; expected one of: ${MUTATION_POLICIES.join(", ")}`);
-  }
-  return value;
-}
-function buildLifecycleUpdates(options3) {
-  if (options3.clearCadence && options3.expectedInterval !== undefined) {
-    error("Use only one of --expected-interval and --clear-cadence");
-  }
-  const updates = {};
-  if (options3.clearCadence)
-    updates.expectedIntervalSeconds = null;
-  const expectedIntervalSeconds = parseExpectedInterval(options3.expectedInterval);
-  if (expectedIntervalSeconds !== undefined)
-    updates.expectedIntervalSeconds = expectedIntervalSeconds;
-  const windowSemantics = parseWindowSemantics(options3.windowSemantics);
-  if (windowSemantics !== undefined)
-    updates.windowSemantics = windowSemantics;
-  const mutationPolicy = parseMutationPolicy(options3.mutationPolicy);
-  if (mutationPolicy !== undefined)
-    updates.mutationPolicy = mutationPolicy;
-  return updates;
-}
-function createWebhooksCommand() {
-  const webhooks = new Command("webhooks").description("Manage webhook sources");
-  webhooks.command("list").description("List webhook sources").option("--enabled", "Show only enabled sources").option("--disabled", "Show only disabled sources").action(async (options3) => {
-    const client = getClient();
-    try {
-      let enabledFilter;
-      if (options3.enabled)
-        enabledFilter = true;
-      if (options3.disabled)
-        enabledFilter = false;
-      const result = await client.webhooks.listSources({
-        enabled: enabledFilter
-      });
-      const items = result.map((w) => ({
-        id: w.id,
-        name: w.name,
-        enabled: w.enabled ? "yes" : "no",
-        health: w.livenessStatus ?? "-",
-        cadence: w.expectedIntervalSeconds != null ? `${w.expectedIntervalSeconds}s` : "-",
-        createdAt: w.createdAt
-      }));
-      list(items, { emptyMessage: "No webhook sources found." });
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to list webhook sources: ${message2}`);
-    }
-  });
-  webhooks.command("get <id>").description("Get webhook source details").action(async (id) => {
-    const resolvedId = await resolveWebhookId(id);
-    const client = getClient();
-    try {
-      const source = await client.webhooks.getSource(resolvedId);
-      data(source);
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to get webhook source: ${message2}`);
-    }
-  });
-  webhooks.command("create").description("Create a webhook source").requiredOption("--name <name>", "Webhook source name").option("--description <desc>", "Description").option("--disabled", "Create in disabled state").option("--headers <json>", `Expected headers as JSON (e.g., '{"X-Secret": true}')`).option("--signature-algorithm <alg>", "Signature verification: hmac-sha256, hmac-sha1, or token-match").option("--signature-header <name>", "Header carrying the signature/token (e.g., X-Hub-Signature-256)").option("--signature-prefix <prefix>", "Prefix before the hex digest (e.g., 'sha256=')").option("--signature-secret <secret>", "Shared secret for signature verification (write-only). Visible in shell history and process lists \u2014 prefer --signature-secret-env or --signature-secret-stdin").option("--signature-secret-env <VAR>", "Read the shared secret from environment variable VAR").option("--signature-secret-stdin", "Read the shared secret from stdin (trailing newline stripped)").option("--idempotency-key-template <template>", "Delivery-identity key template for redelivery dedup (#958). Placeholders: {source}, {sha256(body)}, " + "{headers.<name>}, {payload.<dot.path>}. Defaults to '{source}:{sha256(body)}'").option("--strict-schemas", "Refuse deliveries whose event type has no enabled registered schema (dead-lettered as " + "schema_not_registered, #1000). Recommended for new sources. Defaults to off").option("--event-type-mapping <json>", "Semantic event-type extraction (#959): inline JSON or @path/to/file.json, e.g. " + `'{"source":"header","header":"X-GitHub-Event"}' or '{"source":"body","path":"event"}'. ` + "A mapped source emits custom.{source}.{event} instead of the collapsed custom.webhook.{source}").option("--expected-interval <seconds>", "Declared cadence: >=1 event or heartbeat per N seconds. Arms liveness supervision (#961)").option("--window-semantics <value>", `Declared window semantics: ${WINDOW_SEMANTICS.join(" or ")}`).option("--mutation-policy <value>", `Declared mutation re-emit policy: ${MUTATION_POLICIES.join(" or ")}`).action(async (options3) => {
-    const client = getClient();
-    try {
-      let expectedHeaders;
-      if (options3.headers) {
-        try {
-          expectedHeaders = JSON.parse(options3.headers);
-        } catch {
-          error("Invalid JSON for --headers");
-        }
-      }
-      const signatureConfig = buildSignatureConfig(options3);
-      const signatureSecret = await resolveSignatureSecret(options3);
-      assertPairedSignatureOnCreate(signatureConfig, signatureSecret);
-      const source = await client.webhooks.createSource({
-        name: options3.name,
-        description: options3.description,
-        enabled: !options3.disabled,
-        expectedHeaders,
-        signatureConfig,
-        signatureSecret,
-        idempotencyKeyTemplate: options3.idempotencyKeyTemplate,
-        strictSchemas: options3.strictSchemas,
-        eventTypeMapping: resolveEventTypeMapping(options3.eventTypeMapping),
-        expectedIntervalSeconds: parseExpectedInterval(options3.expectedInterval),
-        windowSemantics: parseWindowSemantics(options3.windowSemantics),
-        mutationPolicy: parseMutationPolicy(options3.mutationPolicy)
-      });
-      const details = {
-        id: source.id,
-        name: source.name,
-        url: `POST /api/v2/webhooks/${source.name}`
-      };
-      if (signatureConfig) {
-        details.publicUrl = `POST /api/v2/webhooks/ingress/${source.name}`;
-      }
-      success(`Webhook source created: ${source.id}`, details);
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to create webhook source: ${message2}`);
-    }
-  });
-  webhooks.command("update <id>").description("Update a webhook source").option("--name <name>", "New name").option("--description <desc>", "New description").option("--enable", "Enable the webhook").option("--disable", "Disable the webhook").option("--signature-algorithm <alg>", "Signature verification: hmac-sha256, hmac-sha1, or token-match").option("--signature-header <name>", "Header carrying the signature/token (e.g., X-Hub-Signature-256)").option("--signature-prefix <prefix>", "Prefix before the hex digest (e.g., 'sha256=')").option("--signature-secret <secret>", "Shared secret for signature verification (write-only). Visible in shell history and process lists \u2014 prefer --signature-secret-env or --signature-secret-stdin").option("--signature-secret-env <VAR>", "Read the shared secret from environment variable VAR").option("--signature-secret-stdin", "Read the shared secret from stdin (trailing newline stripped)").option("--clear-signature", "Remove the signature config and stored secret").option("--idempotency-key-template <template>", "Delivery-identity key template for redelivery dedup (#958). Placeholders: {source}, {sha256(body)}, " + "{headers.<name>}, {payload.<dot.path>}").option("--strict-schemas", "Refuse deliveries whose event type has no enabled registered schema (dead-lettered as " + "schema_not_registered, #1000)").option("--no-strict-schemas", "Return the source to opt-in pass-through for unregistered event types").option("--event-type-mapping <json>", "Semantic event-type extraction (#959): inline JSON or @path/to/file.json, e.g. " + `'{"source":"header","header":"X-GitHub-Event"}' or '{"source":"body","path":"event"}'`).option("--clear-event-type-mapping", "Remove the mapping (deliveries fall back to the collapsed custom.webhook.{source} type)").option("--expected-interval <seconds>", "Declared cadence: >=1 event or heartbeat per N seconds. (Re)arms liveness supervision (#961)").option("--clear-cadence", "Remove the declared cadence (disarms liveness supervision)").option("--window-semantics <value>", `Declared window semantics: ${WINDOW_SEMANTICS.join(" or ")}`).option("--mutation-policy <value>", `Declared mutation re-emit policy: ${MUTATION_POLICIES.join(" or ")}`).action(async (id, options3) => {
-    const resolvedId = await resolveWebhookId(id);
-    const client = getClient();
-    try {
-      const updates = await buildUpdateSourcePatch(options3);
-      const source = await client.webhooks.updateSource(resolvedId, updates);
-      success(`Webhook source updated: ${source.id}`, {
-        id: source.id,
-        name: source.name,
-        enabled: source.enabled
-      });
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to update webhook source: ${message2}`);
-    }
-  });
-  webhooks.command("delete <id>").description("Delete a webhook source").action(async (id) => {
-    const resolvedId = await resolveWebhookId(id);
-    const client = getClient();
-    try {
-      await client.webhooks.deleteSource(resolvedId);
-      success(`Webhook source deleted: ${resolvedId}`);
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to delete webhook source: ${message2}`);
-    }
-  });
-  webhooks.command("trigger").description("Trigger a custom event").requiredOption("--type <type>", "Event type").requiredOption("--payload <json>", "Event payload as JSON").option("--instance <id>", "Instance ID").option("--correlation-id <id>", "Correlation ID").option("--causation-id <event-id>", "Parent event ID (keeps the causality tree for mid-flow emissions, #1072)").action(async (options3) => {
-    const client = getClient();
-    try {
-      let payload;
-      try {
-        payload = JSON.parse(options3.payload);
-      } catch {
-        error("Invalid JSON for --payload");
-        return;
-      }
-      const result = await client.webhooks.trigger({
-        eventType: options3.type,
-        payload,
-        instanceId: options3.instance,
-        correlationId: options3.correlationId,
-        causationId: options3.causationId
-      });
-      success(`Event triggered: ${result.eventId}`, {
-        eventId: result.eventId,
-        eventType: result.eventType
-      });
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to trigger event: ${message2}`);
-    }
-  });
-  webhooks.command("heartbeat <source>").description('Record a connector heartbeat ("ran, zero events found") \u2014 resets the liveness window (#961)').action(async (source) => {
-    const client = getClient();
-    try {
-      const result = await client.webhooks.heartbeat(source);
-      success(`Heartbeat recorded for '${result.source}'`, {
-        heartbeatAt: result.heartbeatAt,
-        livenessStatus: result.livenessStatus ?? "unsupervised",
-        expectedIntervalSeconds: result.expectedIntervalSeconds
-      });
-    } catch (err2) {
-      const message2 = err2 instanceof Error ? err2.message : "Unknown error";
-      error(`Failed to record heartbeat: ${message2}`);
-    }
-  });
-  return webhooks;
-}
-
 // src/commands/where.ts
 init_output();
 function createWhereCommand() {
@@ -153438,6 +153829,12 @@ var COMMANDS = [
     helpGroup: "Management",
     helpDescription: "Webhook management"
   },
+  {
+    create: createSourcesCommand,
+    category: "advanced",
+    helpGroup: "Management",
+    helpDescription: "One-command external source onboarding (github, ...)"
+  },
   {
     create: createTurnsCommand,
     category: "advanced",