@deepseek-ai/dsh-webhook 0.1.2-alpha.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/webhook/webhook/README.md
+README.md: e19bb7edc26857312c9249294bcfab23942075c1
+README.zh.md: 39d17eb6e2d1b20e7f05b811d42804c7b3aa435c

package/README.md

@@ -0,0 +1,86 @@
+---
+description: "Webhook rule runtime for maintainers registering trusted external-event policies that create Workspace Sessions."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-webhook
+
+English | [中文](README.zh.md)
+
+## Summary
+
+`dsh-webhook` provides the Host `ctx.webhookRuntime`: a registry for trusted programmatic webhook rules plus the one built-in action, creating an ordinary root Session inside a Web Workspace. The interface stays at `register(rule)` and `dispatch(delivery)`; provider authentication belongs to adapter packages. Use it when a trusted rule must turn an external event into a new agent Session.
+
+## Table of Contents
+
+- [Rule interface](#rule-interface)
+- [Session request](#session-request)
+- [Composition](#composition)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="rule-interface"></a>
+## Rule interface
+
+`WebhookRule<K>` has a branded unique `id`, a provider `kind`, and `run(delivery, signal)`. A callback may execute arbitrary trusted code and returns either `null` or one `WebhookSessionRequest`. Rules of the same kind start independently, and one throw or rejection is logged without starving siblings.
+
+`VerifiedWebhookDelivery` carries provider kind, configured source id, provider delivery id, normalized lossless JSON, and receipt time. The runtime snapshots and freezes the complete value before sharing it. `deliveryId` is provenance only; repeated delivery runs the rules again.
+
+Registration is an effect. Its awaitable disposer first hides the rule, then aborts and drains active callbacks. Callbacks must observe the supplied signal; same-process code that ignores cancellation cannot be forcibly stopped safely.
+
+<a id="session-request"></a>
+## Session request
+
+`WebhookSessionRequest` requires `workspacePath`, `title`, `prompt`, `agentPreset`, and `permissionPreset`; optional `model` names an explicit provider/model route plus an output-token cap. An explicit route uses its adapter's reasoning default. Omission snapshots the complete current deployment selection, including reasoning effort, until the first request records its durable header; later Web model changes retain the ordinary session behavior.
+
+The runtime validates presets before mutation, resolves or creates the canonical Workspace, creates an Agent with that Workspace path as `SessionHeader.cwd`, mounts the agent preset before publication, and attaches the Session before applying permissions, title, and prompt. Failed attachment disposes the unpublished action. A later pre-prompt failure detaches the Workspace and disposes the Agent on a best-effort rollback.
+
+Successful `Agent.followup()` is the webhook operation's commit point. The message uses `source.kind: "webhook"` with provider, source, delivery, and rule provenance. The runtime does not wait for idle, flush specially, inspect the reply, or publish completion state; ordinary Agent and Session behavior owns everything afterward.
+
+<a id="composition"></a>
+## Composition
+
+Load the runtime on the Web Host plane after Agents, model defaults, agent presets, permission presets, titles, and the Workspace registry. User-authored rule plugins inject `webhookRuntime` and yield the disposer returned by `register()` through their own effect.
+
+The [GitHub review guide](../../../docs/user/guide/github-review.md) shows a rule module, dedicated ingress port, secret setup, and Workspace routing.
+
+<a id="model-experience"></a>
+## Model Experience
+
+### Rule-authored initial prompt
+
+#### What the model sees
+
+For each matching rule, the model sees exactly the non-empty text returned as `WebhookSessionRequest.prompt`. The generic runtime adds no private framing; a rule incorporating external text owns its trust labeling. The shipped GitHub example labels selected PR fields as untrusted JSON metadata.
+
+#### Token effect
+
+One data-dependent user-role message is retained in the new Session and contributes tokens until ordinary compaction replaces or removes that history.
+
+#### KV Cache effect
+
+The initial prompt begins a new Session, so it establishes rather than invalidates that Session's reusable request prefix.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **Process-local fire-and-forget only** — a crash loses rule calls that have not admitted a prompt; there is no queue, replay, or retry.
+- **No built-in deduplication** — repeated provider deliveries may create repeated Sessions; rules that need idempotency own it.
+- **No completion result** — HTTP acceptance and rule settlement do not report Agent success, idle, or output.
+- **Trusted callbacks must cooperate with cancellation** — runtime teardown aborts and awaits them but cannot terminate arbitrary same-process code.
+- **Workspace creation may outlive a failed Session attempt** — an empty Workspace is retained because another concurrent caller may already use it.
+
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+None.
+
+</details>

package/README.zh.md

@@ -0,0 +1,86 @@
+---
+description: "面向注册可信外部事件策略并创建 Workspace Session 的维护者，说明 webhook 规则运行时。"
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-webhook
+
+[English](README.md) | 中文
+
+## 概述
+
+`dsh-webhook` 提供 Host 侧的 `ctx.webhookRuntime`：它既是受信任程序化 webhook 规则的注册表，也拥有唯一内置动作——在 Web Workspace 中创建普通根 Session。接口只包含 `register(rule)` 和 `dispatch(delivery)`；提供方身份验证属于适配器包。当受信任规则必须把外部事件变成新的 agent Session 时，请使用它。
+
+## 目录
+
+- [规则接口](#rule-interface)
+- [Session 请求](#session-request)
+- [组合](#composition)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="rule-interface"></a>
+## 规则接口
+
+`WebhookRule<K>` 具有带品牌类型的唯一 `id`、提供方 `kind` 与 `run(delivery, signal)`。回调可以执行任意受信任代码，并返回 `null` 或一个 `WebhookSessionRequest`。同类规则彼此独立启动；某个规则抛出或拒绝只会记录日志，不会阻止同级规则。
+
+`VerifiedWebhookDelivery` 携带提供方种类、已配置来源 id、提供方交付 id、规范化的无损 JSON 与接收时间。runtime 会在共享前快照并冻结完整值。`deliveryId` 仅是来源信息；重复交付会再次运行规则。
+
+注册是一项 effect。它的可等待 disposer 会先隐藏规则，再中止并排空活动回调。回调必须观察所提供的 signal；忽略取消的同进程代码无法被安全强制停止。
+
+<a id="session-request"></a>
+## Session 请求
+
+`WebhookSessionRequest` 要求 `workspacePath`、`title`、`prompt`、`agentPreset` 与 `permissionPreset`；可选 `model` 会指定明确的提供方／模型路由与输出 token 上限。明确路由使用其适配器的默认推理强度。省略时会快照包含推理强度的完整当前部署选择，直到首个请求记录持久 header；之后的 Web 模型变更保留普通 Session 行为。
+
+runtime 会在变更状态前验证 preset，解析或创建规范 Workspace，以该 Workspace 路径作为 `SessionHeader.cwd` 创建 Agent，在发布前挂载 agent preset，并在应用权限、标题与提示词前附加 Session。附加失败会释放尚未提交动作的 Agent。之后若在提示词前失败，则以尽力而为方式脱离 Workspace 并释放 Agent。
+
+成功的 `Agent.followup()` 是 webhook 操作的提交点。消息使用 `source.kind: "webhook"`，并携带提供方、来源、交付与规则来源信息。runtime 不等待 idle、不执行特殊 flush、不检查回复，也不发布完成状态；之后完全由普通 Agent 与 Session 行为接管。
+
+<a id="composition"></a>
+## 组合
+
+在 Web Host plane 上，于 Agents、模型默认值、agent presets、permission presets、标题与 Workspace 注册表之后加载 runtime。用户编写的规则插件注入 `webhookRuntime`，并通过自己的 effect 交出 `register()` 返回的 disposer。
+
+[GitHub 评审指南](../../../docs/user/guide/github-review.zh.md)展示了规则模块、专用入口端口、密钥设置与 Workspace 路由。
+
+<a id="model-experience"></a>
+## Model Experience
+
+### 规则编写的初始提示词
+
+#### What the model sees
+
+每个匹配规则都会让模型看到 `WebhookSessionRequest.prompt` 返回的非空文本原文。通用 runtime 不增加私有框架；若规则包含外部文本，则由规则负责标明其信任属性。随附 GitHub 示例会把选定 PR 字段标为不受信任的 JSON 元数据。
+
+#### Token effect
+
+一条依赖数据的 user-role 消息保留在新 Session 中，并持续贡献 token，直到普通 compaction 替换或移除该历史。
+
+#### KV Cache effect
+
+初始提示词开启一个新 Session，因此它建立而不是使该 Session 的可复用请求前缀失效。
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **仅限进程内 fire-and-forget** — 崩溃会丢失尚未接纳提示词的规则调用；不存在队列、重放或重试。
+- **无内置去重** — 提供方重复交付可能创建重复 Session；需要幂等性的规则自行负责。
+- **无完成结果** — HTTP 接受与规则结算都不报告 Agent 成功、idle 或输出。
+- **受信任回调必须配合取消** — runtime teardown 会中止并等待回调，但无法终止任意同进程代码。
+- **Workspace 创建可能比失败的 Session 尝试更长寿** — 空 Workspace 会保留，因为另一个并发调用者可能已经使用它。
+
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者工作上下文——点击展开</summary>
+
+无。
+
+</details>

package/lib/index.js

@@ -0,0 +1,284 @@
+import { Service } from "@deepseek-ai/cordis";
+import { boundContextSummary, createUserMessage, errorChain } from "@deepseek-ai/dsh-llm";
+import { deepFreeze, snapshotJsonValue } from "@deepseek-ai/dsh-util-values";
+import { randomUUID } from "node:crypto";
+import { isAbsolute } from "node:path";
+import { brandString } from "@deepseek-ai/dsh-brand";
+//#region lib/types/session.js
+/** Workspace-backed Session creation for one settled webhook rule result. */
+/** Require one non-empty string field from an untyped rule result. */
+function requiredString(record, field) {
+	const value = record[field];
+	if (typeof value !== "string" || value.trim() === "") throw new TypeError(`webhook Session request ${field} must be a non-empty string`);
+	return value;
+}
+/** Snapshot and validate a same-process rule result before crossing awaits. */
+function resolveRequest(ctx, input) {
+	const candidate = input;
+	if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) throw new TypeError("webhook rule result must be null or a Session request object");
+	const record = candidate;
+	const workspacePath = requiredString(record, "workspacePath");
+	if (!isAbsolute(workspacePath)) throw new TypeError(`webhook Session request workspacePath must be absolute, got ${JSON.stringify(workspacePath)}`);
+	const title = requiredString(record, "title");
+	const prompt = requiredString(record, "prompt");
+	const agentPreset = requiredString(record, "agentPreset");
+	const permissionPreset = requiredString(record, "permissionPreset");
+	const model = record["model"];
+	if (model !== void 0 && (model === null || typeof model !== "object" || Array.isArray(model))) throw new TypeError("webhook Session request model must be an object");
+	let agentOptions;
+	let modelSelection;
+	if (model === void 0) {
+		const selected = ctx.agentDefaultModel.currentSelection();
+		agentOptions = {
+			provider: selected.provider,
+			model: selected.model
+		};
+		modelSelection = { ...selected };
+	} else {
+		const modelRecord = model;
+		const provider = requiredString(modelRecord, "provider");
+		const modelId = requiredString(modelRecord, "model");
+		const maxTokens = modelRecord["maxTokens"];
+		if (maxTokens !== void 0 && (typeof maxTokens !== "number" || !Number.isSafeInteger(maxTokens) || maxTokens <= 0)) throw new TypeError("webhook Session request model.maxTokens must be a positive safe integer");
+		agentOptions = {
+			provider,
+			model: modelId,
+			...maxTokens === void 0 ? {} : { maxTokens }
+		};
+		modelSelection = {
+			provider,
+			model: modelId
+		};
+	}
+	return {
+		workspacePath,
+		title,
+		prompt,
+		agentPreset,
+		permissionPreset,
+		modelSelection,
+		agentOptions
+	};
+}
+/** Log a rollback failure without replacing the operation's original failure. */
+function reportRollbackFailure(ctx, subject, error) {
+	ctx.logger.warn(`webhook: ${subject} rollback failed: ${errorChain(error)}`);
+}
+/** Apply the creation-time selection until its first durable request header exists. */
+function installInitialModelSelection(agentCtx, selection) {
+	agentCtx.on("agent/request", async (_payload, next) => {
+		const resolved = await next();
+		const agent = agentCtx.agent;
+		/* v8 ignore next -- AgentRegistry setup always provides the unpublished scoped Agent. */
+		if (agent === void 0) throw new Error("webhook Session setup has no scoped Agent");
+		if (agent.session.requestHeader() !== void 0 || resolved.provider !== selection.provider || resolved.model !== selection.model) return resolved;
+		const { reasoningEffort: _inheritedEffort, ...withoutInheritedEffort } = resolved;
+		return {
+			...withoutInheritedEffort,
+			...selection.reasoningEffort === void 0 ? {} : { reasoningEffort: selection.reasoningEffort }
+		};
+	});
+}
+/**
+* Create, attach, title, configure, and prompt one ordinary root Session.
+* Successful prompt admission ends webhook ownership of the operation; the
+* Agent remains lifecycle-owned by `ctx` and follows normal Session behavior.
+*
+* @param ctx - untraced runtime context that owns the resulting Agent.
+* @param delivery - exact verified provider delivery used for provenance.
+* @param ruleId - rule that returned the request.
+* @param request - same-process rule result.
+* @param signal - registration lifetime cancellation through publication.
+*/
+async function createWebhookSession(ctx, delivery, ruleId, request, signal) {
+	const resolved = resolveRequest(ctx, request);
+	ctx.permissionPresets.resolve(resolved.permissionPreset);
+	const preset = await ctx.agentPresets.resolve(resolved.agentPreset);
+	await ctx.agentPresets.standingKeyFor(preset.id);
+	signal.throwIfAborted();
+	const workspace = await ctx.workspaceRegistry.create(resolved.workspacePath);
+	signal.throwIfAborted();
+	const sessionId = brandString(`webhook-${randomUUID()}`);
+	const handle = await ctx.agents.create({
+		sessionId,
+		signal,
+		meta: {
+			cwd: workspace.path,
+			agentPreset: preset.id
+		},
+		agentOptions: resolved.agentOptions,
+		setup: async (agentCtx) => {
+			await ctx.agentPresets.mount(agentCtx, preset.id);
+			installInitialModelSelection(agentCtx, resolved.modelSelection);
+		}
+	});
+	let attached = false;
+	try {
+		signal.throwIfAborted();
+		await workspace.attachSession(sessionId);
+		attached = true;
+		signal.throwIfAborted();
+		ctx.permissionPresets.set(handle.agent.session, resolved.permissionPreset);
+		ctx.sessionTitle.rename(handle.agent.session, resolved.title);
+		handle.agent.followup(createUserMessage({
+			content: [{
+				type: "text",
+				text: resolved.prompt
+			}],
+			source: {
+				kind: "webhook",
+				provider: delivery.kind,
+				source: delivery.source,
+				deliveryId: delivery.deliveryId,
+				ruleId,
+				form: "notice",
+				summary: boundContextSummary(`${delivery.kind} webhook handled by ${ruleId}`)
+			}
+		}));
+	} catch (error) {
+		if (attached) try {
+			await workspace.detachSession(sessionId);
+		} catch (rollbackError) {
+			reportRollbackFailure(ctx, `Workspace detach for Session "${sessionId}"`, rollbackError);
+		}
+		try {
+			await handle.dispose();
+		} catch (rollbackError) {
+			reportRollbackFailure(ctx, `Agent disposal for Session "${sessionId}"`, rollbackError);
+		}
+		throw error;
+	}
+}
+//#endregion
+//#region lib/types/brand.js
+/** Opaque webhook identities shared by adapters, rules, and Session provenance. */
+/**
+* Brand a webhook rule id.
+* @param value - non-empty rule identifier validated at registration.
+* @returns the same string with its compile-time brand.
+*/
+function WebhookRuleId(value) {
+	return value;
+}
+/**
+* Brand a configured webhook source id.
+* @param value - non-empty adapter instance identifier validated by its adapter.
+* @returns the same string with its compile-time brand.
+*/
+function WebhookSourceId(value) {
+	return value;
+}
+/**
+* Brand a provider delivery id.
+* @param value - non-empty provider identity validated by its adapter.
+* @returns the same string with its compile-time brand.
+*/
+function WebhookDeliveryId(value) {
+	return value;
+}
+//#endregion
+//#region lib/types/index.js
+/** Fire-and-forget webhook rule registry and Workspace-backed Session runtime. */
+/** Validate and detach one delivery before sharing it across arbitrary rules. */
+function snapshotDelivery(delivery) {
+	if (typeof delivery.kind !== "string" || delivery.kind.trim() === "") throw new TypeError("webhook delivery kind must be a non-empty string");
+	if (typeof delivery.source !== "string" || delivery.source.trim() === "") throw new TypeError("webhook delivery source must be a non-empty string");
+	if (typeof delivery.deliveryId !== "string" || delivery.deliveryId.trim() === "") throw new TypeError("webhook delivery id must be a non-empty string");
+	if (!Number.isSafeInteger(delivery.receivedAt) || delivery.receivedAt < 0) throw new TypeError("webhook delivery receivedAt must be a non-negative safe integer");
+	const snapshot = snapshotJsonValue(delivery);
+	if (snapshot === void 0) throw new TypeError("webhook delivery must be lossless JSON");
+	return deepFreeze(snapshot);
+}
+/** Fire-and-forget rule runtime. Session creation is the only built-in action. */
+var WebhookRuntime = class extends Service {
+	static inject = [
+		"agents",
+		"agentDefaultModel",
+		"agentPresets",
+		"permissionPresets",
+		"sessionTitle",
+		"workspaceRegistry"
+	];
+	rules = /* @__PURE__ */ new Map();
+	selfCtx;
+	closing = false;
+	constructor(ctx) {
+		super(ctx, "webhookRuntime");
+		this.selfCtx = ctx;
+		ctx.effect(() => async () => {
+			this.closing = true;
+			/* v8 ignore next -- caller-owned registration effects normally dispose first; this covers provider-first unload. */
+			await Promise.all([...this.rules.values()].map((rule) => this.disposeRegistration(rule)));
+		}, "webhookRuntime.lifecycle()");
+	}
+	/**
+	* Register one trusted programmatic rule.
+	* @param rule - unique id, provider kind, and arbitrary callback.
+	* @returns awaitable effect disposer that aborts and drains this rule's active callbacks.
+	*/
+	register(rule) {
+		if (this.closing) throw new Error("webhook runtime is closing");
+		if (typeof rule.id !== "string" || rule.id.trim() === "") throw new TypeError("webhook rule id must be a non-empty string");
+		if (typeof rule.kind !== "string" || rule.kind.trim() === "") throw new TypeError(`webhook rule "${String(rule.id)}" kind must be a non-empty string`);
+		if (typeof rule.run !== "function") throw new TypeError(`webhook rule "${String(rule.id)}" requires run()`);
+		const erased = rule;
+		let registration;
+		const disposeEffect = this.ctx.effect(() => {
+			/* v8 ignore next -- no await separates the public liveness check from this initializer. */
+			if (this.closing) throw new Error("webhook runtime is closing");
+			if (this.rules.has(rule.id)) throw new Error(`webhook rule "${rule.id}" is already registered`);
+			registration = {
+				rule: erased,
+				controller: new AbortController(),
+				active: /* @__PURE__ */ new Set(),
+				closing: false
+			};
+			this.rules.set(rule.id, registration);
+			return () => this.disposeRegistration(registration);
+		}, `webhookRuntime.register(${rule.id})`);
+		return async () => {
+			await disposeEffect();
+		};
+	}
+	/**
+	* Start every currently matching rule and return before any callback settles.
+	* @param delivery - authenticated provider data; snapshotted before dispatch.
+	* @throws synchronously when the runtime is closing or the delivery is malformed.
+	*/
+	dispatch(delivery) {
+		if (this.closing) throw new Error("webhook runtime is closing");
+		const snapshot = snapshotDelivery(delivery);
+		for (const registration of [...this.rules.values()]) {
+			if (registration.closing || registration.rule.kind !== snapshot.kind) continue;
+			this.startInvocation(registration, snapshot);
+		}
+	}
+	/** Start one contained invocation and attach it to registration teardown. */
+	startInvocation(registration, delivery) {
+		const tracked = Promise.resolve().then(async () => {
+			registration.controller.signal.throwIfAborted();
+			const request = await registration.rule.run(delivery, registration.controller.signal);
+			registration.controller.signal.throwIfAborted();
+			if (request !== null) await createWebhookSession(this.selfCtx, delivery, registration.rule.id, request, registration.controller.signal);
+		}).catch((error) => {
+			const invocation = `webhook: provider=${JSON.stringify(delivery.kind)} source=${JSON.stringify(delivery.source)} delivery=${JSON.stringify(delivery.deliveryId)} rule=${JSON.stringify(registration.rule.id)}`;
+			if (registration.controller.signal.aborted) this.selfCtx.logger.debug(`${invocation} stopped after disposal: ${errorChain(error)}`);
+			else this.selfCtx.logger.warn(`${invocation} failed: ${errorChain(error)}`);
+		}).finally(() => {
+			registration.active.delete(tracked);
+		});
+		registration.active.add(tracked);
+	}
+	/** Memoized registration teardown: hide, abort, then drain. */
+	disposeRegistration(registration) {
+		registration.disposal ??= (async () => {
+			registration.closing = true;
+			this.rules.delete(registration.rule.id);
+			registration.controller.abort(/* @__PURE__ */ new Error(`webhook rule "${registration.rule.id}" was disposed`));
+			while (registration.active.size > 0) await Promise.allSettled([...registration.active]);
+		})();
+		return registration.disposal;
+	}
+};
+//#endregion
+export { WebhookDeliveryId, WebhookRuleId, WebhookRuntime, WebhookRuntime as default, WebhookSourceId };

package/lib/invariant.js

@@ -0,0 +1,29 @@
+//#region lib/types/invariant.js
+/** Package-owned relationship invariant for webhook-origin prompt admission. */
+const PACKAGE_NAME = "@deepseek-ai/dsh-webhook";
+/** Cordis invariant-companion plugin name. */
+const name = "webhook-invariant";
+/** Registry required before reserving this package's invariant ownership. */
+const inject = ["invariants"];
+/** Verify that one webhook-origin message already belongs to its cwd Workspace. */
+const install = Object.assign(function installWebhookMessages(ctx, fail) {
+	ctx.on("internal/dispatch", (_mode, eventName, args) => {
+		if (eventName !== "session/event") return;
+		const [session, event] = args;
+		if (event.type !== "agent/inbox/spliced") return;
+		if (event.data.inserted.filter((message) => message.source.kind === "webhook").length === 0) return;
+		const cwd = session.header.cwd;
+		if (cwd === void 0) return fail(`webhook Session "${session.id}" has no cwd`);
+		const owners = ctx.workspaceRegistry.list().filter((workspace) => workspace.sessionIds.includes(session.id));
+		if (owners.length !== 1) return fail(`webhook Session "${session.id}" belongs to ${owners.length} Workspaces at prompt admission`);
+		if (owners[0]?.path !== cwd) fail(`webhook Session "${session.id}" cwd ${JSON.stringify(cwd)} differs from its Workspace path`);
+	}, { global: true });
+}, { inject: ["workspaceRegistry"] });
+/**
+* Register this package's relationship invariant.
+* @param ctx - Cordis context carrying the invariant registry.
+* @returns the invariant registration disposer.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/brand.d.ts

@@ -0,0 +1,27 @@
+/** Opaque webhook identities shared by adapters, rules, and Session provenance. */
+import type { Branded } from '@deepseek-ai/dsh-brand';
+/** Identifies one programmatic webhook rule. */
+export type WebhookRuleId = Branded<'WebhookRuleId'>;
+/** Identifies one configured webhook adapter instance. */
+export type WebhookSourceId = Branded<'WebhookSourceId'>;
+/** Identifies one provider delivery. The runtime assigns no deduplication semantics. */
+export type WebhookDeliveryId = Branded<'WebhookDeliveryId'>;
+/**
+ * Brand a webhook rule id.
+ * @param value - non-empty rule identifier validated at registration.
+ * @returns the same string with its compile-time brand.
+ */
+export declare function WebhookRuleId(value: string): WebhookRuleId;
+/**
+ * Brand a configured webhook source id.
+ * @param value - non-empty adapter instance identifier validated by its adapter.
+ * @returns the same string with its compile-time brand.
+ */
+export declare function WebhookSourceId(value: string): WebhookSourceId;
+/**
+ * Brand a provider delivery id.
+ * @param value - non-empty provider identity validated by its adapter.
+ * @returns the same string with its compile-time brand.
+ */
+export declare function WebhookDeliveryId(value: string): WebhookDeliveryId;
+//# sourceMappingURL=brand.d.ts.map

package/lib/types/brand.js

@@ -0,0 +1,26 @@
+/** Opaque webhook identities shared by adapters, rules, and Session provenance. */
+/**
+ * Brand a webhook rule id.
+ * @param value - non-empty rule identifier validated at registration.
+ * @returns the same string with its compile-time brand.
+ */
+export function WebhookRuleId(value) {
+    return value;
+}
+/**
+ * Brand a configured webhook source id.
+ * @param value - non-empty adapter instance identifier validated by its adapter.
+ * @returns the same string with its compile-time brand.
+ */
+export function WebhookSourceId(value) {
+    return value;
+}
+/**
+ * Brand a provider delivery id.
+ * @param value - non-empty provider identity validated by its adapter.
+ * @returns the same string with its compile-time brand.
+ */
+export function WebhookDeliveryId(value) {
+    return value;
+}
+//# sourceMappingURL=brand.js.map

package/lib/types/index.d.ts

@@ -0,0 +1,36 @@
+/** Fire-and-forget webhook rule registry and Workspace-backed Session runtime. */
+import { Context, Service } from '@deepseek-ai/cordis';
+import type { VerifiedWebhookDelivery, WebhookRule } from './types.ts';
+export * from './brand.ts';
+export type * from './types.ts';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        webhookRuntime: WebhookRuntime;
+    }
+}
+/** Fire-and-forget rule runtime. Session creation is the only built-in action. */
+export declare class WebhookRuntime extends Service {
+    static inject: string[];
+    private readonly rules;
+    private readonly selfCtx;
+    private closing;
+    constructor(ctx: Context);
+    /**
+     * Register one trusted programmatic rule.
+     * @param rule - unique id, provider kind, and arbitrary callback.
+     * @returns awaitable effect disposer that aborts and drains this rule's active callbacks.
+     */
+    register<K extends string>(rule: WebhookRule<K>): () => Promise<void>;
+    /**
+     * Start every currently matching rule and return before any callback settles.
+     * @param delivery - authenticated provider data; snapshotted before dispatch.
+     * @throws synchronously when the runtime is closing or the delivery is malformed.
+     */
+    dispatch<K extends string>(delivery: VerifiedWebhookDelivery<K>): void;
+    /** Start one contained invocation and attach it to registration teardown. */
+    private startInvocation;
+    /** Memoized registration teardown: hide, abort, then drain. */
+    private disposeRegistration;
+}
+export default WebhookRuntime;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/index.js

@@ -0,0 +1,138 @@
+/** Fire-and-forget webhook rule registry and Workspace-backed Session runtime. */
+import { Service } from '@deepseek-ai/cordis';
+import { errorChain } from '@deepseek-ai/dsh-llm';
+import { deepFreeze, snapshotJsonValue } from '@deepseek-ai/dsh-util-values';
+import { createWebhookSession } from "./session.js";
+export * from "./brand.js";
+/** Validate and detach one delivery before sharing it across arbitrary rules. */
+function snapshotDelivery(delivery) {
+    if (typeof delivery.kind !== 'string' || delivery.kind.trim() === '') {
+        throw new TypeError('webhook delivery kind must be a non-empty string');
+    }
+    if (typeof delivery.source !== 'string' || delivery.source.trim() === '') {
+        throw new TypeError('webhook delivery source must be a non-empty string');
+    }
+    if (typeof delivery.deliveryId !== 'string' || delivery.deliveryId.trim() === '') {
+        throw new TypeError('webhook delivery id must be a non-empty string');
+    }
+    if (!Number.isSafeInteger(delivery.receivedAt) || delivery.receivedAt < 0) {
+        throw new TypeError('webhook delivery receivedAt must be a non-negative safe integer');
+    }
+    const snapshot = snapshotJsonValue(delivery);
+    if (snapshot === undefined)
+        throw new TypeError('webhook delivery must be lossless JSON');
+    return deepFreeze(snapshot);
+}
+/** Fire-and-forget rule runtime. Session creation is the only built-in action. */
+export class WebhookRuntime extends Service {
+    static inject = [
+        'agents',
+        'agentDefaultModel',
+        'agentPresets',
+        'permissionPresets',
+        'sessionTitle',
+        'workspaceRegistry',
+    ];
+    rules = new Map();
+    selfCtx;
+    closing = false;
+    constructor(ctx) {
+        super(ctx, 'webhookRuntime');
+        this.selfCtx = ctx;
+        ctx.effect(() => async () => {
+            this.closing = true;
+            /* v8 ignore next -- caller-owned registration effects normally dispose first; this covers provider-first unload. */
+            await Promise.all([...this.rules.values()].map(rule => this.disposeRegistration(rule)));
+        }, 'webhookRuntime.lifecycle()');
+    }
+    /**
+     * Register one trusted programmatic rule.
+     * @param rule - unique id, provider kind, and arbitrary callback.
+     * @returns awaitable effect disposer that aborts and drains this rule's active callbacks.
+     */
+    register(rule) {
+        if (this.closing)
+            throw new Error('webhook runtime is closing');
+        if (typeof rule.id !== 'string' || rule.id.trim() === '') {
+            throw new TypeError('webhook rule id must be a non-empty string');
+        }
+        if (typeof rule.kind !== 'string' || rule.kind.trim() === '') {
+            throw new TypeError(`webhook rule "${String(rule.id)}" kind must be a non-empty string`);
+        }
+        if (typeof rule.run !== 'function') {
+            throw new TypeError(`webhook rule "${String(rule.id)}" requires run()`);
+        }
+        // The public generic preserves adapter-specific authoring types. The runtime
+        // stores one erased callback after validating the shared provider tag.
+        const erased = rule;
+        let registration;
+        const disposeEffect = this.ctx.effect(() => {
+            /* v8 ignore next -- no await separates the public liveness check from this initializer. */
+            if (this.closing)
+                throw new Error('webhook runtime is closing');
+            if (this.rules.has(rule.id))
+                throw new Error(`webhook rule "${rule.id}" is already registered`);
+            registration = {
+                rule: erased,
+                controller: new AbortController(),
+                active: new Set(),
+                closing: false,
+            };
+            this.rules.set(rule.id, registration);
+            return () => this.disposeRegistration(registration);
+        }, `webhookRuntime.register(${rule.id})`);
+        return async () => { await disposeEffect(); };
+    }
+    /**
+     * Start every currently matching rule and return before any callback settles.
+     * @param delivery - authenticated provider data; snapshotted before dispatch.
+     * @throws synchronously when the runtime is closing or the delivery is malformed.
+     */
+    dispatch(delivery) {
+        if (this.closing)
+            throw new Error('webhook runtime is closing');
+        const snapshot = snapshotDelivery(delivery);
+        for (const registration of [...this.rules.values()]) {
+            if (registration.closing || registration.rule.kind !== snapshot.kind)
+                continue;
+            this.startInvocation(registration, snapshot);
+        }
+    }
+    /** Start one contained invocation and attach it to registration teardown. */
+    startInvocation(registration, delivery) {
+        const tracked = Promise.resolve().then(async () => {
+            registration.controller.signal.throwIfAborted();
+            const request = await registration.rule.run(delivery, registration.controller.signal);
+            registration.controller.signal.throwIfAborted();
+            if (request !== null) {
+                await createWebhookSession(this.selfCtx, delivery, registration.rule.id, request, registration.controller.signal);
+            }
+        }).catch((error) => {
+            const invocation = `webhook: provider=${JSON.stringify(delivery.kind)} source=${JSON.stringify(delivery.source)} `
+                + `delivery=${JSON.stringify(delivery.deliveryId)} rule=${JSON.stringify(registration.rule.id)}`;
+            if (registration.controller.signal.aborted) {
+                this.selfCtx.logger.debug(`${invocation} stopped after disposal: ${errorChain(error)}`);
+            }
+            else {
+                this.selfCtx.logger.warn(`${invocation} failed: ${errorChain(error)}`);
+            }
+        }).finally(() => {
+            registration.active.delete(tracked);
+        });
+        registration.active.add(tracked);
+    }
+    /** Memoized registration teardown: hide, abort, then drain. */
+    disposeRegistration(registration) {
+        registration.disposal ??= (async () => {
+            registration.closing = true;
+            this.rules.delete(registration.rule.id);
+            registration.controller.abort(new Error(`webhook rule "${registration.rule.id}" was disposed`));
+            while (registration.active.size > 0) {
+                await Promise.allSettled([...registration.active]);
+            }
+        })();
+        return registration.disposal;
+    }
+}
+export default WebhookRuntime;
+//# sourceMappingURL=index.js.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,13 @@
+/** Package-owned relationship invariant for webhook-origin prompt admission. */
+import type { Context } from '@deepseek-ai/cordis';
+/** Cordis invariant-companion plugin name. */
+export declare const name = "webhook-invariant";
+/** Registry required before reserving this package's invariant ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's relationship invariant.
+ * @param ctx - Cordis context carrying the invariant registry.
+ * @returns the invariant registration disposer.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -0,0 +1,38 @@
+/** Package-owned relationship invariant for webhook-origin prompt admission. */
+const PACKAGE_NAME = '@deepseek-ai/dsh-webhook';
+/** Cordis invariant-companion plugin name. */
+export const name = 'webhook-invariant';
+/** Registry required before reserving this package's invariant ownership. */
+export const inject = ['invariants'];
+/** Verify that one webhook-origin message already belongs to its cwd Workspace. */
+const install = Object.assign(function installWebhookMessages(ctx, fail) {
+    ctx.on('internal/dispatch', (_mode, eventName, args) => {
+        if (eventName !== 'session/event')
+            return;
+        const [session, event] = args;
+        if (event.type !== 'agent/inbox/spliced')
+            return;
+        const webhookMessages = event.data.inserted.filter(message => message.source.kind === 'webhook');
+        if (webhookMessages.length === 0)
+            return;
+        const cwd = session.header.cwd;
+        if (cwd === undefined)
+            return fail(`webhook Session "${session.id}" has no cwd`);
+        const owners = ctx.workspaceRegistry.list().filter(workspace => workspace.sessionIds.includes(session.id));
+        if (owners.length !== 1) {
+            return fail(`webhook Session "${session.id}" belongs to ${owners.length} Workspaces at prompt admission`);
+        }
+        if (owners[0]?.path !== cwd) {
+            fail(`webhook Session "${session.id}" cwd ${JSON.stringify(cwd)} differs from its Workspace path`);
+        }
+    }, { global: true });
+}, {
+    inject: ['workspaceRegistry'],
+});
+/**
+ * Register this package's relationship invariant.
+ * @param ctx - Cordis context carrying the invariant registry.
+ * @returns the invariant registration disposer.
+ */
+export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//# sourceMappingURL=invariant.js.map

package/lib/types/session.d.ts

@@ -0,0 +1,17 @@
+/** Workspace-backed Session creation for one settled webhook rule result. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { WebhookRuleId } from './brand.ts';
+import type { VerifiedWebhookDelivery, WebhookSessionRequest } from './types.ts';
+/**
+ * Create, attach, title, configure, and prompt one ordinary root Session.
+ * Successful prompt admission ends webhook ownership of the operation; the
+ * Agent remains lifecycle-owned by `ctx` and follows normal Session behavior.
+ *
+ * @param ctx - untraced runtime context that owns the resulting Agent.
+ * @param delivery - exact verified provider delivery used for provenance.
+ * @param ruleId - rule that returned the request.
+ * @param request - same-process rule result.
+ * @param signal - registration lifetime cancellation through publication.
+ */
+export declare function createWebhookSession(ctx: Context, delivery: VerifiedWebhookDelivery, ruleId: WebhookRuleId, request: WebhookSessionRequest, signal: AbortSignal): Promise<void>;
+//# sourceMappingURL=session.d.ts.map

package/lib/types/session.js

@@ -0,0 +1,150 @@
+/** Workspace-backed Session creation for one settled webhook rule result. */
+import { randomUUID } from 'node:crypto';
+import { isAbsolute } from 'node:path';
+import { brandString } from '@deepseek-ai/dsh-brand';
+import { boundContextSummary, createUserMessage, errorChain } from '@deepseek-ai/dsh-llm';
+/** Require one non-empty string field from an untyped rule result. */
+function requiredString(record, field) {
+    const value = record[field];
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new TypeError(`webhook Session request ${field} must be a non-empty string`);
+    }
+    return value;
+}
+/** Snapshot and validate a same-process rule result before crossing awaits. */
+function resolveRequest(ctx, input) {
+    const candidate = input;
+    if (candidate === null || typeof candidate !== 'object' || Array.isArray(candidate)) {
+        throw new TypeError('webhook rule result must be null or a Session request object');
+    }
+    const record = candidate;
+    const workspacePath = requiredString(record, 'workspacePath');
+    if (!isAbsolute(workspacePath)) {
+        throw new TypeError(`webhook Session request workspacePath must be absolute, got ${JSON.stringify(workspacePath)}`);
+    }
+    const title = requiredString(record, 'title');
+    const prompt = requiredString(record, 'prompt');
+    const agentPreset = requiredString(record, 'agentPreset');
+    const permissionPreset = requiredString(record, 'permissionPreset');
+    const model = record['model'];
+    if (model !== undefined && (model === null || typeof model !== 'object' || Array.isArray(model))) {
+        throw new TypeError('webhook Session request model must be an object');
+    }
+    let agentOptions;
+    let modelSelection;
+    if (model === undefined) {
+        const selected = ctx.agentDefaultModel.currentSelection();
+        agentOptions = { provider: selected.provider, model: selected.model };
+        modelSelection = { ...selected };
+    }
+    else {
+        const modelRecord = model;
+        const provider = requiredString(modelRecord, 'provider');
+        const modelId = requiredString(modelRecord, 'model');
+        const maxTokens = modelRecord['maxTokens'];
+        if (maxTokens !== undefined
+            && (typeof maxTokens !== 'number' || !Number.isSafeInteger(maxTokens) || maxTokens <= 0)) {
+            throw new TypeError('webhook Session request model.maxTokens must be a positive safe integer');
+        }
+        agentOptions = {
+            provider,
+            model: modelId,
+            ...(maxTokens === undefined ? {} : { maxTokens }),
+        };
+        modelSelection = { provider, model: modelId };
+    }
+    return { workspacePath, title, prompt, agentPreset, permissionPreset, modelSelection, agentOptions };
+}
+/** Log a rollback failure without replacing the operation's original failure. */
+function reportRollbackFailure(ctx, subject, error) {
+    ctx.logger.warn(`webhook: ${subject} rollback failed: ${errorChain(error)}`);
+}
+/** Apply the creation-time selection until its first durable request header exists. */
+function installInitialModelSelection(agentCtx, selection) {
+    agentCtx.on('agent/request', async (_payload, next) => {
+        const resolved = await next();
+        const agent = agentCtx.agent;
+        /* v8 ignore next -- AgentRegistry setup always provides the unpublished scoped Agent. */
+        if (agent === undefined)
+            throw new Error('webhook Session setup has no scoped Agent');
+        if (agent.session.requestHeader() !== undefined
+            || resolved.provider !== selection.provider
+            || resolved.model !== selection.model)
+            return resolved;
+        const { reasoningEffort: _inheritedEffort, ...withoutInheritedEffort } = resolved;
+        return {
+            ...withoutInheritedEffort,
+            ...selection.reasoningEffort === undefined ? {} : { reasoningEffort: selection.reasoningEffort },
+        };
+    });
+}
+/**
+ * Create, attach, title, configure, and prompt one ordinary root Session.
+ * Successful prompt admission ends webhook ownership of the operation; the
+ * Agent remains lifecycle-owned by `ctx` and follows normal Session behavior.
+ *
+ * @param ctx - untraced runtime context that owns the resulting Agent.
+ * @param delivery - exact verified provider delivery used for provenance.
+ * @param ruleId - rule that returned the request.
+ * @param request - same-process rule result.
+ * @param signal - registration lifetime cancellation through publication.
+ */
+export async function createWebhookSession(ctx, delivery, ruleId, request, signal) {
+    const resolved = resolveRequest(ctx, request);
+    ctx.permissionPresets.resolve(resolved.permissionPreset);
+    const preset = await ctx.agentPresets.resolve(resolved.agentPreset);
+    await ctx.agentPresets.standingKeyFor(preset.id);
+    signal.throwIfAborted();
+    const workspace = await ctx.workspaceRegistry.create(resolved.workspacePath);
+    signal.throwIfAborted();
+    const sessionId = brandString(`webhook-${randomUUID()}`);
+    const handle = await ctx.agents.create({
+        sessionId,
+        signal,
+        meta: { cwd: workspace.path, agentPreset: preset.id },
+        agentOptions: resolved.agentOptions,
+        setup: async (agentCtx) => {
+            await ctx.agentPresets.mount(agentCtx, preset.id);
+            installInitialModelSelection(agentCtx, resolved.modelSelection);
+        },
+    });
+    let attached = false;
+    try {
+        signal.throwIfAborted();
+        await workspace.attachSession(sessionId);
+        attached = true;
+        signal.throwIfAborted();
+        ctx.permissionPresets.set(handle.agent.session, resolved.permissionPreset);
+        ctx.sessionTitle.rename(handle.agent.session, resolved.title);
+        handle.agent.followup(createUserMessage({
+            content: [{ type: 'text', text: resolved.prompt }],
+            source: {
+                kind: 'webhook',
+                provider: delivery.kind,
+                source: delivery.source,
+                deliveryId: delivery.deliveryId,
+                ruleId,
+                form: 'notice',
+                summary: boundContextSummary(`${delivery.kind} webhook handled by ${ruleId}`),
+            },
+        }));
+    }
+    catch (error) {
+        if (attached) {
+            try {
+                await workspace.detachSession(sessionId);
+            }
+            catch (rollbackError) {
+                reportRollbackFailure(ctx, `Workspace detach for Session "${sessionId}"`, rollbackError);
+            }
+        }
+        try {
+            await handle.dispose();
+        }
+        catch (rollbackError) {
+            reportRollbackFailure(ctx, `Agent disposal for Session "${sessionId}"`, rollbackError);
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=session.js.map

package/lib/types/types.d.ts

@@ -0,0 +1,74 @@
+/** Provider-neutral webhook deliveries, rules, and Session requests. */
+import type { JsonValue } from '@deepseek-ai/dsh-util-values';
+import type { WebhookDeliveryId, WebhookRuleId, WebhookSourceId } from './brand.ts';
+/** Provider adapters add their normalized event type through declaration merging. */
+export interface WebhookEventMap {
+}
+/** Event value for a known provider kind, or generic lossless JSON for an out-of-tree kind. */
+export type WebhookEventOf<K extends string> = K extends keyof WebhookEventMap ? WebhookEventMap[K] : JsonValue;
+/** One authenticated and parsed provider delivery. */
+export interface VerifiedWebhookDelivery<K extends string = string> {
+    /** Provider family such as `github`. */
+    readonly kind: K;
+    /** Configured adapter instance such as `primary-github`. */
+    readonly source: WebhookSourceId;
+    /** Provider identity exposed as provenance, never as built-in deduplication state. */
+    readonly deliveryId: WebhookDeliveryId;
+    /** Provider-normalized lossless JSON. */
+    readonly event: WebhookEventOf<K>;
+    /** Host receipt time in Unix epoch milliseconds. */
+    readonly receivedAt: number;
+}
+/** Optional explicit model route and output cap for a webhook-created Agent. */
+export interface WebhookModelSelection {
+    /** Registered provider route. */
+    readonly provider: string;
+    /** Provider-owned model id. */
+    readonly model: string;
+    /** Optional positive output-token cap. */
+    readonly maxTokens?: number;
+}
+/** The sole runtime action: create and prompt one root Session. */
+export interface WebhookSessionRequest {
+    /** Existing local directory to resolve or create as a Web Workspace. */
+    readonly workspacePath: string;
+    /** Explicit Session title. */
+    readonly title: string;
+    /** Non-empty initial text prompt. */
+    readonly prompt: string;
+    /** Agent composition mounted before publication. */
+    readonly agentPreset: string;
+    /** Sandbox and approval preset applied before prompt admission. */
+    readonly permissionPreset: string;
+    /** Optional explicit route; omission uses the complete current default, including reasoning effort. */
+    readonly model?: WebhookModelSelection;
+}
+/** Trusted code that optionally creates one Session for a delivery. */
+export interface WebhookRule<K extends string = string> {
+    /** Globally unique diagnostic identity. */
+    readonly id: WebhookRuleId;
+    /** Provider kind this rule receives. */
+    readonly kind: K;
+    /**
+     * Run arbitrary trusted code and optionally request one Session.
+     * @param delivery - immutable authenticated provider data.
+     * @param signal - aborts when this registration or the runtime unloads.
+     * @returns one Session request, or `null` for no action.
+     */
+    run(delivery: Readonly<VerifiedWebhookDelivery<K>>, signal: AbortSignal): WebhookSessionRequest | null | Promise<WebhookSessionRequest | null>;
+}
+declare module '@deepseek-ai/dsh-llm' {
+    interface MessageSourceMap {
+        /** Programmatic input admitted from one verified webhook rule. */
+        webhook: {
+            readonly kind: 'webhook';
+            readonly provider: string;
+            readonly source: WebhookSourceId;
+            readonly deliveryId: WebhookDeliveryId;
+            readonly ruleId: WebhookRuleId;
+            readonly form: 'notice';
+            readonly summary: string;
+        };
+    }
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/types/types.js

@@ -0,0 +1,3 @@
+/** Provider-neutral webhook deliveries, rules, and Session requests. */
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@deepseek-ai/dsh-webhook",
+  "description": "Fire-and-forget webhook rule runtime that creates Workspace-backed DeepSeek Harness Sessions",
+  "version": "0.1.2-alpha.2",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/webhook/webhook"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types/types.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-agent-default-model": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-permission-presets": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session-title": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-workspace": "^0.1.2-alpha.2"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/cordis-plugin-include": "^1.0.7",
+    "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
+    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-permission-presets": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-session-title": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-agent-default-model": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-workspace": "^0.1.2-alpha.2"
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-brand": "^0.1.2-alpha.2",
+    "@deepseek-ai/dsh-util-values": "^0.1.2-alpha.2"
+  }
+}