@cat-factory/contracts 0.233.0 → 0.234.0

package/dist/notification-webhooks.d.ts

@@ -55,12 +55,25 @@ export declare const notificationWebhookSchema: v.ObjectSchema<{
 }, undefined>;
 export type NotificationWebhook = v.InferOutput<typeof notificationWebhookSchema>;
 /**
- * Register or update the workspace's notification webhook. `secret` is write-only: omit it to keep
- * the stored one, pass a new value to rotate it. An `https:` URL is required — deliveries carry a
- * signed payload describing internal work, and plaintext HTTP would leak it on the wire.
+ * Register or update the workspace's notification webhook. EVERY field is keep-on-omit: what the
+ * body leaves out retains its stored value, so subscribing an existing endpoint to a new event
+ * family is a one-field write.
+ *
+ * That uniformity is the point, and `url` is optional for it. A mandatory re-send would make the
+ * common edit carry a value the caller did not intend to change, and a caller re-sending a URL it
+ * cached before someone else rotated the endpoint would silently redirect the workspace's
+ * deliveries back to the old receiver while appearing to only add a subscription. The first `PUT`
+ * on a workspace with nothing registered still needs one, and the service refuses with
+ * `reason: 'webhook_url_required'` rather than storing a half-endpoint.
+ *
+ * When supplied it must be `https:`: deliveries carry a signed payload describing internal work,
+ * and plaintext HTTP would leak it on the wire.
+ *
+ * `secret` is write-only: omit it to keep the stored one, pass a new value to rotate it.
  */
 export declare const putNotificationWebhookSchema: v.ObjectSchema<{
-    readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.UrlAction<string, undefined>, v.StartsWithAction<string, "https://", "The webhook endpoint must be an https:// URL">, v.MaxLengthAction<string, 2000, undefined>]>;
+    /** Omit ⇒ keep the registered endpoint (required only when registering the first one). */
+    readonly url: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.UrlAction<string, undefined>, v.StartsWithAction<string, "https://", "The webhook endpoint must be an https:// URL">, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
     /** Omit ⇒ deliver the default parking types. */
     readonly types: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>, undefined>;
     /** Omit ⇒ keep the current run-event subscription (none, for an endpoint that never set one). */
@@ -72,6 +85,50 @@ export declare const putNotificationWebhookSchema: v.ObjectSchema<{
     readonly secret: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 16, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
 }, undefined>;
 export type PutNotificationWebhookInput = v.InferOutput<typeof putNotificationWebhookSchema>;
+/**
+ * What `GET /api/v1/notification-webhook` answers: the registered endpoint, or `null` when the
+ * workspace has none. Both the session surface and the public one project the SAME
+ * {@link notificationWebhookSchema}, because the projection is already the client-facing shape
+ * with the secret reduced to a boolean, and a second near-identical DTO would be one more thing
+ * to keep in step for no caller-visible gain.
+ *
+ * The WRAPPER, though, is public-surface-only, and it is not decoration. A bare nullable body is
+ * an honest wire shape but a poor generated one: the SDK emitters model a null at the top level of
+ * a response far less faithfully than a null on a FIELD (Go decodes a `null` body into a
+ * zero-valued struct, so "no endpoint registered" would arrive as an endpoint whose URL is the
+ * empty string). Wrapping keeps "none is registered" a value every client reads the same way, and
+ * leaves room to add a sibling field later without changing the response type.
+ */
+export declare const publicNotificationWebhookSchema: v.ObjectSchema<{
+    /** The registered endpoint, or `null` when the workspace has none. */
+    readonly webhook: v.NullableSchema<v.ObjectSchema<{
+        /** The HTTPS endpoint deliveries are POSTed to. */
+        readonly url: v.StringSchema<undefined>;
+        /**
+         * Which notification types are delivered. EMPTY means "the parking types" — the defaults a
+         * headless overseer cares about — rather than "everything", so registering an endpoint can't
+         * accidentally fire-hose every card at an integration that only wanted to hear about parks.
+         */
+        readonly types: v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>;
+        /**
+         * Which run-lifecycle events are delivered. EMPTY means NONE — the opposite of `types` above,
+         * deliberately: an endpoint registered before this existed must not start receiving a new event
+         * family it never asked for, so subscribing is explicit.
+         */
+        readonly runEvents: v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>;
+        /**
+         * Which platform-health transitions are delivered. EMPTY means NONE, like {@link runEvents}:
+         * subscribing a receiver to alerts about the deployment itself is always an explicit choice.
+         */
+        readonly alertEvents: v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>;
+        /** Whether deliveries are currently attempted. Registering an endpoint enables it. */
+        readonly enabled: v.BooleanSchema<undefined>;
+        /** Whether a signing secret is set (the secret itself is never returned). */
+        readonly hasSecret: v.BooleanSchema<undefined>;
+        readonly updatedAt: v.NumberSchema<undefined>;
+    }, undefined>, undefined>;
+}, undefined>;
+export type PublicNotificationWebhook = v.InferOutput<typeof publicNotificationWebhookSchema>;
 /**
  * The JSON body of one webhook delivery. Deliberately a thin envelope over the SAME
  * `notificationSchema` the in-app inbox and the public `GET /api/v1/notifications` already expose

package/dist/notification-webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification-webhooks.d.ts","sourceRoot":"","sources":["../src/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAoB5B;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,6EAA6D,CAAA;AACjG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEjF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,qFAGnC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAEnF,+FAA+F;AAC/F,eAAO,MAAM,yBAAyB;IACpC,mDAAmD;;IAEnD;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;OAGG;;IAEH,sFAAsF;;IAEtF,6EAA6E;;;aAG7E,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;IAQvC,gDAAgD;;IAEhD,iGAAiG;;IAEjG,uGAAuG;;;IAGvG,wDAAwD;;aAExD,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC;;IAE5C,kGAAkG;;;IAGlG,4DAA4D;;IAE5D,mEAAmE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAGnE,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB;;IAEnC,kGAAkG;;;;;;QAMhG,8FAA8F;;;;;QAK9F,sFAAsF;;;QAGtF;;;WAGG;;QAEH,oCAAoC;;;;;;;aAStC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mCAAmC;IAC9C,oEAAoE;;IAEpE,6FAA6F;;IAE7F,8EAA8E;;IAE9E;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,WAAW,CACvD,OAAO,mCAAmC,CAC3C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,kCAAkC;;IAE7C,kGAAkG;;;;;QAKhG;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;WAGG;;YArEL,oEAAoE;;YAEpE,6FAA6F;;YAE7F,8EAA8E;;YAE9E;;;;;eAKG;;;QA4DD;;;;WAIG;;QAEH;;;;;WAKG;;;;;;;QAEH;;;;WAIG;;;aAGL,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAEnG;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,kKAS6B,CAAA"}
+{"version":3,"file":"notification-webhooks.d.ts","sourceRoot":"","sources":["../src/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAoB5B;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,6EAA6D,CAAA;AACjG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEjF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,qFAGnC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAEnF,+FAA+F;AAC/F,eAAO,MAAM,yBAAyB;IACpC,mDAAmD;;IAEnD;;;;OAIG;;IAEH;;;;OAIG;;IAEH;;;OAGG;;IAEH,sFAAsF;;IAEtF,6EAA6E;;;aAG7E,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4BAA4B;IACvC,0FAA0F;;IAU1F,gDAAgD;;IAEhD,iGAAiG;;IAEjG,uGAAuG;;;IAGvG,wDAAwD;;aAExD,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAE5F;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,+BAA+B;IAC1C,sEAAsE;;QAlFtE,mDAAmD;;QAEnD;;;;WAIG;;QAEH;;;;WAIG;;QAEH;;;WAGG;;QAEH,sFAAsF;;QAEtF,6EAA6E;;;;aA+D7E,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC;;IAE5C,kGAAkG;;;IAGlG,4DAA4D;;IAE5D,mEAAmE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAGnE,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB;;IAEnC,kGAAkG;;;;;;QAMhG,8FAA8F;;;;;QAK9F,sFAAsF;;;QAGtF;;;WAGG;;QAEH,oCAAoC;;;;;;;aAStC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mCAAmC;IAC9C,oEAAoE;;IAEpE,6FAA6F;;IAE7F,8EAA8E;;IAE9E;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,WAAW,CACvD,OAAO,mCAAmC,CAC3C,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,kCAAkC;;IAE7C,kGAAkG;;;;;QAKhG;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;WAGG;;YArEL,oEAAoE;;YAEpE,6FAA6F;;YAE7F,8EAA8E;;YAE9E;;;;;eAKG;;;QA4DD;;;;WAIG;;QAEH;;;;;WAKG;;;;;;;QAEH;;;;WAIG;;;aAGL,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAEnG;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,kKAS6B,CAAA"}

package/dist/notification-webhooks.js

@@ -72,12 +72,25 @@ export const notificationWebhookSchema = v.object({
     updatedAt: v.number(),
 });
 /**
- * Register or update the workspace's notification webhook. `secret` is write-only: omit it to keep
- * the stored one, pass a new value to rotate it. An `https:` URL is required — deliveries carry a
- * signed payload describing internal work, and plaintext HTTP would leak it on the wire.
+ * Register or update the workspace's notification webhook. EVERY field is keep-on-omit: what the
+ * body leaves out retains its stored value, so subscribing an existing endpoint to a new event
+ * family is a one-field write.
+ *
+ * That uniformity is the point, and `url` is optional for it. A mandatory re-send would make the
+ * common edit carry a value the caller did not intend to change, and a caller re-sending a URL it
+ * cached before someone else rotated the endpoint would silently redirect the workspace's
+ * deliveries back to the old receiver while appearing to only add a subscription. The first `PUT`
+ * on a workspace with nothing registered still needs one, and the service refuses with
+ * `reason: 'webhook_url_required'` rather than storing a half-endpoint.
+ *
+ * When supplied it must be `https:`: deliveries carry a signed payload describing internal work,
+ * and plaintext HTTP would leak it on the wire.
+ *
+ * `secret` is write-only: omit it to keep the stored one, pass a new value to rotate it.
  */
 export const putNotificationWebhookSchema = v.object({
-    url: v.pipe(v.string(), v.trim(), v.url(), v.startsWith('https://', 'The webhook endpoint must be an https:// URL'), v.maxLength(2000)),
+    /** Omit ⇒ keep the registered endpoint (required only when registering the first one). */
+    url: v.optional(v.pipe(v.string(), v.trim(), v.url(), v.startsWith('https://', 'The webhook endpoint must be an https:// URL'), v.maxLength(2000))),
     /** Omit ⇒ deliver the default parking types. */
     types: v.optional(v.array(notificationTypeSchema)),
     /** Omit ⇒ keep the current run-event subscription (none, for an endpoint that never set one). */
@@ -88,6 +101,24 @@ export const putNotificationWebhookSchema = v.object({
     /** New signing secret; omit to keep the current one. */
     secret: v.optional(v.pipe(v.string(), v.trim(), v.minLength(16), v.maxLength(200))),
 });
+/**
+ * What `GET /api/v1/notification-webhook` answers: the registered endpoint, or `null` when the
+ * workspace has none. Both the session surface and the public one project the SAME
+ * {@link notificationWebhookSchema}, because the projection is already the client-facing shape
+ * with the secret reduced to a boolean, and a second near-identical DTO would be one more thing
+ * to keep in step for no caller-visible gain.
+ *
+ * The WRAPPER, though, is public-surface-only, and it is not decoration. A bare nullable body is
+ * an honest wire shape but a poor generated one: the SDK emitters model a null at the top level of
+ * a response far less faithfully than a null on a FIELD (Go decodes a `null` body into a
+ * zero-valued struct, so "no endpoint registered" would arrive as an endpoint whose URL is the
+ * empty string). Wrapping keeps "none is registered" a value every client reads the same way, and
+ * leaves room to add a sibling field later without changing the response type.
+ */
+export const publicNotificationWebhookSchema = v.object({
+    /** The registered endpoint, or `null` when the workspace has none. */
+    webhook: v.nullable(notificationWebhookSchema),
+});
 /**
  * The JSON body of one webhook delivery. Deliberately a thin envelope over the SAME
  * `notificationSchema` the in-app inbox and the public `GET /api/v1/notifications` already expose

package/dist/notification-webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification-webhooks.js","sourceRoot":"","sources":["../src/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,8EAA8E;AAC9E,iGAAiG;AACjG,8FAA8F;AAC9F,wFAAwF;AACxF,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,6FAA6F;AAC7F,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,uDAAuD;AACvD,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAA;AAGjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC;IACjD,wBAAwB;IACxB,0BAA0B;CAC3B,CAAC,CAAA;AAGF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,mDAAmD;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACtC;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC3C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,sFAAsF;IACtF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,GAAG,EAAE,CAAC,CAAC,IAAI,CACT,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,GAAG,EAAE,EACP,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,8CAA8C,CAAC,EACxE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAClB;IACD,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClD,iGAAiG;IACjG,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD,uGAAuG;IACvG,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChC,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;CACpF,CAAC,CAAA;AAGF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kGAAkG;IAClG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,4DAA4D;IAC5D,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,mEAAmE;IACnE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAA;AAGF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kGAAkG;IAClG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,uBAAuB;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,8FAA8F;QAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,sFAAsF;QACtF,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB;;;WAGG;QACH,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACtC,oCAAoC;QACpC,OAAO,EAAE,CAAC,CAAC,QAAQ,CACjB,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC/B,CAAC,CACH;KACF,CAAC;CACH,CAAC,CAAA;AAGF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,oEAAoE;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,6FAA6F;IAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAA;AAKF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kGAAkG;IAClG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,wBAAwB;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd;;;WAGG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB;;;;WAIG;QACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB;;;WAGG;QACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC;QACxD;;;;WAIG;QACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB;;;;;WAKG;QACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;QAC9C;;;;WAIG;QACH,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;CACH,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,uBAAuB;IACvB,cAAc;IACd,mBAAmB;IACnB,WAAW;IACX,aAAa;CAC6D,CAAA"}
+{"version":3,"file":"notification-webhooks.js","sourceRoot":"","sources":["../src/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,8EAA8E;AAC9E,iGAAiG;AACjG,8FAA8F;AAC9F,wFAAwF;AACxF,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,6FAA6F;AAC7F,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,uDAAuD;AACvD,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAA;AAGjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,QAAQ,CAAC;IACjD,wBAAwB;IACxB,0BAA0B;CAC3B,CAAC,CAAA;AAGF,+FAA+F;AAC/F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,mDAAmD;IACnD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACtC;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC3C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,sFAAsF;IACtF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,6EAA6E;IAC7E,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AAGF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,0FAA0F;IAC1F,GAAG,EAAE,CAAC,CAAC,QAAQ,CACb,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,GAAG,EAAE,EACP,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,8CAA8C,CAAC,EACxE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAClB,CACF;IACD,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClD,iGAAiG;IACjG,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvD,uGAAuG;IACvG,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChC,wDAAwD;IACxD,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;CACpF,CAAC,CAAA;AAGF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;CAC/C,CAAC,CAAA;AAGF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kGAAkG;IAClG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,4DAA4D;IAC5D,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,mEAAmE;IACnE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAA;AAGF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kGAAkG;IAClG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,uBAAuB;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,8FAA8F;QAC9F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,sFAAsF;QACtF,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB;;;WAGG;QACH,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACtC,oCAAoC;QACpC,OAAO,EAAE,CAAC,CAAC,QAAQ,CACjB,CAAC,CAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC/B,CAAC,CACH;KACF,CAAC;CACH,CAAC,CAAA;AAGF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,oEAAoE;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,6FAA6F;IAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;OAKG;IACH,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAA;AAKF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,kGAAkG;IAClG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,wBAAwB;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd;;;WAGG;QACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB;;;;WAIG;QACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB;;;WAGG;QACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC;QACxD;;;;WAIG;QACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB;;;;;WAKG;QACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;QAC9C;;;;WAIG;QACH,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACpC,CAAC;CACH,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,uBAAuB;IACvB,cAAc;IACd,mBAAmB;IACnB,WAAW;IACX,aAAa;CAC6D,CAAA"}

package/dist/routes/notification-webhooks.d.ts

@@ -43,7 +43,7 @@ export declare const putNotificationWebhookContract: {
     readonly method: "put";
     readonly pathResolver: () => string;
     readonly requestBodySchema: v.ObjectSchema<{
-        readonly url: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.UrlAction<string, undefined>, v.StartsWithAction<string, "https://", "The webhook endpoint must be an https:// URL">, v.MaxLengthAction<string, 2000, undefined>]>;
+        readonly url: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.UrlAction<string, undefined>, v.StartsWithAction<string, "https://", "The webhook endpoint must be an https:// URL">, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
         readonly types: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>, undefined>;
         readonly runEvents: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>, undefined>;
         readonly alertEvents: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>, undefined>;
@@ -114,4 +114,132 @@ export declare const deleteNotificationWebhookContract: {
         readonly 204: typeof ContractNoBody;
     };
 };
+/**
+ * Read the workspace's registered endpoint. `{ webhook: null }` when none is registered: a real
+ * answer rather than a 404, so a caller's startup self-check ("am I already wired up?") reads one
+ * response shape instead of branching on a status the surface also uses for a bad path.
+ */
+export declare const getPublicNotificationWebhookContract: {
+    readonly method: "get";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: v.ObjectSchema<{
+            readonly webhook: v.NullableSchema<v.ObjectSchema<{
+                readonly url: v.StringSchema<undefined>;
+                readonly types: v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>;
+                readonly runEvents: v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>;
+                readonly alertEvents: v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>;
+                readonly enabled: v.BooleanSchema<undefined>;
+                readonly hasSecret: v.BooleanSchema<undefined>;
+                readonly updatedAt: v.NumberSchema<undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+};
+/**
+ * Register or update the endpoint. Returns the stored projection directly (not the `webhook`
+ * wrapper the read uses): a successful write always has an endpoint to describe, so wrapping it
+ * would hand every client a null to check that cannot occur.
+ *
+ * `secret` is write-only on this surface exactly as it is on the session one: supplied here,
+ * never returned by the read. An `admin` key can therefore ROTATE the signing secret but can
+ * never exfiltrate the one already stored.
+ */
+export declare const putPublicNotificationWebhookContract: {
+    readonly method: "put";
+    readonly pathResolver: () => string;
+    readonly requestBodySchema: v.ObjectSchema<{
+        readonly url: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.UrlAction<string, undefined>, v.StartsWithAction<string, "https://", "The webhook endpoint must be an https:// URL">, v.MaxLengthAction<string, 2000, undefined>]>, undefined>;
+        readonly types: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>, undefined>;
+        readonly runEvents: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>, undefined>;
+        readonly alertEvents: v.OptionalSchema<v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>, undefined>;
+        readonly enabled: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+        readonly secret: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 16, undefined>, v.MaxLengthAction<string, 200, undefined>]>, undefined>;
+    }, undefined>;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 200: v.ObjectSchema<{
+            readonly url: v.StringSchema<undefined>;
+            readonly types: v.ArraySchema<v.PicklistSchema<["merge_review", "pipeline_complete", "ci_failed", "test_failed", "requirement_review", "clarity_review", "release_regression", "decision_required", "human_test_ready", "visual_confirmation_ready", "human_review", "followup_pending", "fork_decision_pending", "judge_review", "pr_review_ready", "initiative", "platform_health", "infra_unreachable", "budget_paused", "key_drift", "merge_tag_request"], undefined>, undefined>;
+            readonly runEvents: v.ArraySchema<v.PicklistSchema<["run.started", "run.completed", "run.failed"], undefined>, undefined>;
+            readonly alertEvents: v.ArraySchema<v.PicklistSchema<["platform_health.firing", "platform_health.resolved"], undefined>, undefined>;
+            readonly enabled: v.BooleanSchema<undefined>;
+            readonly hasSecret: v.BooleanSchema<undefined>;
+            readonly updatedAt: v.NumberSchema<undefined>;
+        }, undefined>;
+    };
+};
+/** Remove the endpoint (deliveries stop). Idempotent: 204 whether or not one was registered. */
+export declare const deletePublicNotificationWebhookContract: {
+    readonly method: "delete";
+    readonly pathResolver: () => string;
+    readonly responsesByStatusCode: {
+        readonly '4xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly '5xx': v.ObjectSchema<{
+            readonly error: v.ObjectSchema<{
+                readonly code: v.StringSchema<undefined>;
+                readonly message: v.StringSchema<undefined>;
+                readonly details: v.OptionalSchema<v.UnknownSchema, undefined>;
+                readonly issues: v.OptionalSchema<v.ArraySchema<v.ObjectSchema<{
+                    readonly path: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+                    readonly message: v.StringSchema<undefined>;
+                }, undefined>, undefined>, undefined>;
+            }, undefined>;
+        }, undefined>;
+        readonly 204: typeof ContractNoBody;
+    };
+};
 //# sourceMappingURL=notification-webhooks.d.ts.map

package/dist/routes/notification-webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notification-webhooks.d.ts","sourceRoot":"","sources":["../../src/routes/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAc5B,8FAA8F;AAC9F,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOzC,CAAA;AAEF,yFAAyF;AACzF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKzC,CAAA;AAEF,wDAAwD;AACxD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI5C,CAAA"}
+{"version":3,"file":"notification-webhooks.d.ts","sourceRoot":"","sources":["../../src/routes/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAqB,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA0B5B,8FAA8F;AAC9F,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOzC,CAAA;AAEF,yFAAyF;AACzF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKzC,CAAA;AAEF,wDAAwD;AACxD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI5C,CAAA;AAIF;;;;GAIG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI/C,CAAA;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAK/C,CAAA;AAEF,gGAAgG;AAChG,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIlD,CAAA"}

package/dist/routes/notification-webhooks.js

@@ -1,13 +1,24 @@
 import { ContractNoBody, defineApiContract } from '@toad-contracts/valibot';
 import * as v from 'valibot';
-import { notificationWebhookSchema, putNotificationWebhookSchema, } from '../notification-webhooks.js';
+import { notificationWebhookSchema, publicNotificationWebhookSchema, putNotificationWebhookSchema, } from '../notification-webhooks.js';
 import { errorResponses } from './_shared.js';
-// Management routes for a workspace's OUTBOUND notification webhook — session-authed and mounted
-// under `/workspaces/:workspaceId` (so paths are relative), like the tracker/Slack settings. The
-// endpoint they configure is consumed by `WebhookNotificationChannel`, not by these routes.
+// Management routes for a workspace's OUTBOUND notification webhook, on TWO surfaces:
 //
-// These are writes to an integration's configuration, so they sit behind the
-// `integrations.manage` workspace permission like every other admin controller.
+//  1. Session-authed, mounted under `/workspaces/:workspaceId` (so paths are relative), like the
+//     tracker/Slack settings. These are writes to an integration's configuration, so they sit
+//     behind the `integrations.manage` workspace permission like every other admin controller.
+//  2. `/api/v1/notification-webhook`, on absolute paths, authenticated in-controller by an
+//     `admin`-scope public-API key. Same three verbs against the same service.
+//
+// The endpoint they configure is consumed by `WebhookNotificationChannel` and the run-lifecycle /
+// platform-alert sinks beside it, not by these routes.
+//
+// The second surface exists because the FIRST one made the push channel unreachable to exactly
+// the caller it was built for. A deployment whose operator is headless has no browser session, so
+// the receiver that run-lifecycle push exists to feed could only be registered by a human clicking
+// through an app the feature deliberately does not need. Both surfaces are thin delegates over
+// `NotificationWebhookService` (same URL guard, same write-only secret, same
+// one-row-per-workspace rule), so neither can admit an endpoint the other would reject.
 /** The workspace's registered webhook, or null when none is set. Never returns the secret. */
 export const getNotificationWebhookContract = defineApiContract({
     method: 'get',
@@ -30,4 +41,36 @@ export const deleteNotificationWebhookContract = defineApiContract({
     pathResolver: () => '/notification-webhook',
     responsesByStatusCode: { 204: ContractNoBody, ...errorResponses },
 });
+// ---- the external `/api/v1` surface (absolute paths, key-authenticated) ----
+/**
+ * Read the workspace's registered endpoint. `{ webhook: null }` when none is registered: a real
+ * answer rather than a 404, so a caller's startup self-check ("am I already wired up?") reads one
+ * response shape instead of branching on a status the surface also uses for a bad path.
+ */
+export const getPublicNotificationWebhookContract = defineApiContract({
+    method: 'get',
+    pathResolver: () => '/api/v1/notification-webhook',
+    responsesByStatusCode: { 200: publicNotificationWebhookSchema, ...errorResponses },
+});
+/**
+ * Register or update the endpoint. Returns the stored projection directly (not the `webhook`
+ * wrapper the read uses): a successful write always has an endpoint to describe, so wrapping it
+ * would hand every client a null to check that cannot occur.
+ *
+ * `secret` is write-only on this surface exactly as it is on the session one: supplied here,
+ * never returned by the read. An `admin` key can therefore ROTATE the signing secret but can
+ * never exfiltrate the one already stored.
+ */
+export const putPublicNotificationWebhookContract = defineApiContract({
+    method: 'put',
+    pathResolver: () => '/api/v1/notification-webhook',
+    requestBodySchema: putNotificationWebhookSchema,
+    responsesByStatusCode: { 200: notificationWebhookSchema, ...errorResponses },
+});
+/** Remove the endpoint (deliveries stop). Idempotent: 204 whether or not one was registered. */
+export const deletePublicNotificationWebhookContract = defineApiContract({
+    method: 'delete',
+    pathResolver: () => '/api/v1/notification-webhook',
+    responsesByStatusCode: { 204: ContractNoBody, ...errorResponses },
+});
 //# sourceMappingURL=notification-webhooks.js.map

package/dist/routes/notification-webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"notification-webhooks.js","sourceRoot":"","sources":["../../src/routes/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAEhF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC1C,GAAG,cAAc;KAClB;CACF,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,iBAAiB,EAAE,4BAA4B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,cAAc,EAAE;CAC7E,CAAC,CAAA;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,iCAAiC,GAAG,iBAAiB,CAAC;IACjE,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA"}
+{"version":3,"file":"notification-webhooks.js","sourceRoot":"","sources":["../../src/routes/notification-webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3E,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,sFAAsF;AACtF,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,+FAA+F;AAC/F,2FAA2F;AAC3F,+EAA+E;AAC/E,EAAE;AACF,kGAAkG;AAClG,uDAAuD;AACvD,EAAE;AACF,+FAA+F;AAC/F,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,6EAA6E;AAC7E,wFAAwF;AAExF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAC1C,GAAG,cAAc;KAClB;CACF,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,iBAAiB,CAAC;IAC9D,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,iBAAiB,EAAE,4BAA4B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,cAAc,EAAE;CAC7E,CAAC,CAAA;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,iCAAiC,GAAG,iBAAiB,CAAC;IACjE,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,GAAG,EAAE,CAAC,uBAAuB;IAC3C,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA;AAEF,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,iBAAiB,CAAC;IACpE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,8BAA8B;IAClD,qBAAqB,EAAE,EAAE,GAAG,EAAE,+BAA+B,EAAE,GAAG,cAAc,EAAE;CACnF,CAAC,CAAA;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,iBAAiB,CAAC;IACpE,MAAM,EAAE,KAAK;IACb,YAAY,EAAE,GAAG,EAAE,CAAC,8BAA8B;IAClD,iBAAiB,EAAE,4BAA4B;IAC/C,qBAAqB,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,GAAG,cAAc,EAAE;CAC7E,CAAC,CAAA;AAEF,gGAAgG;AAChG,MAAM,CAAC,MAAM,uCAAuC,GAAG,iBAAiB,CAAC;IACvE,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,GAAG,EAAE,CAAC,8BAA8B;IAClD,qBAAqB,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;CAClE,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/contracts",
-  "version": "0.233.0",
+  "version": "0.234.0",
   "description": "Valibot wire contract shared between the Agent Architecture Board frontend and backend.",
   "repository": {
     "type": "git",