@dsbot-channel/webhook 0.0.0-stage → 0.7.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 zerodegress
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/skill.md

@@ -0,0 +1,17 @@
+### webhook transport
+
+| Field | Default | Meaning |
+| --- | --- | --- |
+| `listen.host` / `listen.port` / `listen.path` | `127.0.0.1` / `8463` / `/github/webhook` | where the calls arrive |
+| `secret` | required | credential reference: the HMAC-SHA256 key of the raw body |
+| `token` | required | credential reference used to post a comment |
+| `dialect` | `auto` | `github`, `forgejo`, or `auto` to read it from the request headers; a request naming the other dialect gets 400 |
+| `api` | `https://api.github.com` | base URL of the comment api |
+| `login` | required | the bot's own login, used for `@` mentions |
+| `bots` | `[]` | logins counted as bot speech; their events are answered without a mention check unless `policy.groupBots` says otherwise |
+| `repos` | `[]` | optional `owner/repo` allow list |
+
+An issue comment, a review comment, or a pull request review that carries a body runs a turn and the answer is posted as a comment on the issue. The turn text starts with `[github]` or `[forgejo]`, the repository and number, the author with `(person)` or `(bot)`, `event/action` and a link, then the comment itself; the text a policy matches on is still the comment. Events that are not comments, such as `issues`, `pull_request`, `push`, `release` and CI runs, are `action` events with a one line summary; they start no turn unless `events.turn` names the class (`action.push`, `action.ci`, …). Every `action` text starts with the dialect the request was signed with, `[github]` or `[forgejo]`, ahead of that summary. A `workflow_run` names the workflow, its state, the branch, the pull request and a link; a `check_run`, a `check_suite` and a commit `status` name their own name or context, state, commit or branch, and link. A failed signature is a 401 and never reaches the gateway, and a request that verifies but names no event header is a 400; a repeated delivery runs once.
+
+`@dsbot-channel/webhook` supplies this transport: mount it after `@dsbot-channel/core`, then write these fields under `transport` in this plugin's own `config`, beside `channel` and `botName`; `kind` is not written. Each entry is one instance, so the same package mounts twice with two different `channel` values. Without `@dsbot-channel/core` the plugin stays pending on `dsbot-channel.registry`.
+

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsbot-channel-webhook
+      name: '@dsbot-channel/webhook'

package/dist/adapter.d.ts

@@ -0,0 +1,67 @@
+import type { IncomingMessage } from 'node:http';
+import type { AdapterStatus, CapabilitySet } from '@dsbot-channel/core/adapter-status.js';
+import type { AdapterHandle, AdapterPorts, ChannelAdapter, SendInput, SendResult } from '@dsbot-channel/core/contract.js';
+import type { WebhookDialect } from './mapping.js';
+export declare const DEFAULT_WEBHOOK_HOST = "127.0.0.1";
+export declare const DEFAULT_WEBHOOK_PORT = 8463;
+export declare const DEFAULT_WEBHOOK_PATH = "/github/webhook";
+export declare const MAX_WEBHOOK_BODY_BYTES: number;
+export declare const SEEN_TTL_MS: number;
+export declare const SEND_QUEUE_MAX = 8;
+export interface WebhookConfig {
+    channel: string;
+    botName: string;
+    status: boolean;
+    listen: {
+        host: string;
+        port: number;
+        path: string;
+    };
+    secret: string;
+    token: string;
+    dialect: WebhookDialect;
+    api: string;
+    login: string;
+    bots: readonly string[];
+    repos: readonly string[];
+}
+export interface WebhookOptions {
+    warn?: ((message: string) => void) | undefined;
+    now?: (() => number) | undefined;
+}
+type SignatureKind = 'github' | 'forgejo';
+/** The signature the request carries, whichever dialect names it. */
+export declare function signatureOf(request: IncomingMessage): {
+    kind: SignatureKind;
+    value: string;
+} | undefined;
+export declare function verifySignature(secret: string, raw: Buffer, signature: string): boolean;
+export interface DialectPick {
+    dialect: 'github' | 'forgejo';
+    fallback: boolean;
+}
+/** Which dialect the request speaks, from its headers; only an ambiguous signature falls back to the payload. */
+export declare function pickDialect(request: IncomingMessage, configured: WebhookDialect, payload: unknown): DialectPick | 'mismatch' | 'unknown';
+/** The comment body the GitHub API expects, kept to what this adapter promises to write. */
+export declare function commentRequest(config: WebhookConfig, input: SendInput): {
+    url: string;
+    body: string;
+} | undefined;
+export declare class WebhookAdapter implements ChannelAdapter {
+    #private;
+    readonly kind = "webhook";
+    readonly capabilities: CapabilitySet;
+    readonly guidance: {
+        peer: string;
+        group: string;
+    };
+    constructor(config: WebhookConfig, options?: WebhookOptions);
+    checkConfig(): void;
+    checkSessionKey(key: string): string | undefined;
+    checkTarget(target: string): string | undefined;
+    describeTargets(): string;
+    status(): AdapterStatus;
+    start(ports: AdapterPorts): Promise<AdapterHandle>;
+    send(input: SendInput): Promise<SendResult>;
+}
+export {};

package/dist/adapter.js

@@ -0,0 +1,463 @@
+import { createServer } from 'node:http';
+import { ConfigError } from '@dsbot-channel/core/config.js';
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { NO_MEDIA, buildListenerHealth, buildStatus } from '@dsbot-channel/core/adapter-status.js';
+import { ChannelStats, countersOf } from '@dsbot-channel/core/channel-stats.js';
+import { ADAPTER_META_MAX_BYTES } from '@dsbot-channel/core/adapter-meta.js';
+import { classOf, fitAdapterMeta, mapWebhook } from './mapping.js';
+export const DEFAULT_WEBHOOK_HOST = '127.0.0.1';
+export const DEFAULT_WEBHOOK_PORT = 8463;
+export const DEFAULT_WEBHOOK_PATH = '/github/webhook';
+export const MAX_WEBHOOK_BODY_BYTES = 1024 * 1024;
+export const SEEN_TTL_MS = 10 * 60_000;
+export const SEND_QUEUE_MAX = 8;
+const CAPABILITIES = {
+    text: true,
+    image: NO_MEDIA,
+    file: NO_MEDIA,
+    voice: NO_MEDIA,
+    recall: false,
+    history: { group: false, private: false },
+    mention: true,
+    reply: false,
+    stream: false,
+    outbound: true,
+};
+function headerOf(request, name) {
+    const value = request.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+function hexToBytes(hex) {
+    if (!/^[0-9a-f]+$/i.test(hex) || hex.length % 2 !== 0)
+        return undefined;
+    return Buffer.from(hex, 'hex');
+}
+/** The signature the request carries, whichever dialect names it. */
+export function signatureOf(request) {
+    const github = headerOf(request, 'x-hub-signature-256') ?? headerOf(request, 'x-hub-signature');
+    if (github !== undefined) {
+        return { kind: 'github', value: github.startsWith('sha256=') ? github.slice('sha256='.length) : github };
+    }
+    for (const name of ['x-forgejo-signature', 'x-gitea-signature']) {
+        const found = headerOf(request, name);
+        if (found !== undefined) {
+            return { kind: 'forgejo', value: found.startsWith('sha256=') ? found.slice('sha256='.length) : found };
+        }
+    }
+    return undefined;
+}
+function retryAfterMs(response) {
+    const after = response.headers.get('retry-after');
+    if (after !== null) {
+        const seconds = Number(after);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            return Math.min(seconds * 1000, 30_000);
+    }
+    const remaining = response.headers.get('x-ratelimit-remaining');
+    return remaining === '0' ? 1000 : undefined;
+}
+export function verifySignature(secret, raw, signature) {
+    const expected = hexToBytes(signature);
+    if (expected === undefined)
+        return false;
+    const computed = createHmac('sha256', secret).update(raw).digest();
+    if (expected.length !== computed.length)
+        return false;
+    return timingSafeEqual(expected, computed);
+}
+/** Which dialect the request speaks, from its headers; only an ambiguous signature falls back to the payload. */
+export function pickDialect(request, configured, payload) {
+    const githubEvent = headerOf(request, 'x-github-event');
+    const forgejoEvent = headerOf(request, 'x-forgejo-event') ?? headerOf(request, 'x-gitea-event');
+    const seen = signatureOf(request)?.kind;
+    const byHeader = githubEvent !== undefined ? 'github' : forgejoEvent !== undefined ? 'forgejo' : undefined;
+    if (configured !== 'auto') {
+        if (byHeader !== undefined && byHeader !== configured)
+            return 'mismatch';
+        if (seen !== undefined && seen !== configured)
+            return 'mismatch';
+        return { dialect: configured, fallback: false };
+    }
+    if (byHeader !== undefined)
+        return { dialect: byHeader, fallback: false };
+    if (seen === undefined)
+        return 'unknown';
+    if (payload !== null && typeof payload === 'object' && 'repository' in payload) {
+        return { dialect: 'github', fallback: true };
+    }
+    return 'unknown';
+}
+/** The comment body the GitHub API expects, kept to what this adapter promises to write. */
+export function commentRequest(config, input) {
+    const matched = /^gh:([^/]+)\/([^#]+)#(\d+)$/.exec(input.target);
+    if (matched === null)
+        return undefined;
+    const [, owner, repo, number] = matched;
+    const base = config.api.replace(/\/+$/, '');
+    return {
+        url: `${base}/repos/${owner}/${repo}/issues/${number}/comments`,
+        body: input.body,
+    };
+}
+export class WebhookAdapter {
+    kind = 'webhook';
+    capabilities = CAPABILITIES;
+    guidance = {
+        peer: 'An issue or a pull request is the room: answer there, in markdown, as a comment.',
+        group: 'An issue or a pull request is the room: answer there, in markdown, as a comment.',
+    };
+    #config;
+    #now;
+    #stats = new ChannelStats();
+    #seen = new Map();
+    #inFlightKeys = new Set();
+    #queue = [];
+    #server;
+    #inFlight = 0;
+    #stopped = false;
+    #dialectFallback = 0;
+    constructor(config, options = {}) {
+        this.#config = config;
+        this.#now = options.now ?? Date.now;
+    }
+    checkConfig() {
+        if (this.#config.secret.length === 0)
+            throw new ConfigError('transport.secret is required', ['transport', 'secret']);
+        if (this.#config.token.length === 0) {
+            throw new ConfigError('transport.token is required to answer with a comment', ['transport', 'token']);
+        }
+        if (this.#config.login.length === 0)
+            throw new ConfigError('transport.login names the bot and is required', ['transport', 'login']);
+        if (!/^https?:\/\//.test(this.#config.api)) {
+            throw new ConfigError(`transport.api must be an absolute http(s) url: ${this.#config.api}`, ['transport', 'api']);
+        }
+        if (!this.#config.listen.path.startsWith('/')) {
+            throw new ConfigError(`transport.listen.path must start with "/": ${this.#config.listen.path}`, ['transport', 'listen', 'path']);
+        }
+    }
+    checkSessionKey(key) {
+        if (!/^gh:[^/#]+\/[^#]+(#[0-9]+)?$/.test(key))
+            return 'a webhook session key reads "gh:<owner>/<repo>[#<number>]"';
+        return undefined;
+    }
+    checkTarget(target) {
+        const matched = /^gh:([^#]+)#[0-9]+$/.exec(target);
+        if (matched === null)
+            return 'a webhook reply target reads "gh:<owner>/<repo>#<number>"';
+        if (this.#config.repos.length > 0 && !this.#config.repos.includes(matched[1])) {
+            return `"${matched[1]}" is not in transport.repos`;
+        }
+        return undefined;
+    }
+    describeTargets() {
+        return 'gh:<owner>/<repo>#<number>';
+    }
+    status() {
+        const snapshot = this.#stats.snapshot();
+        const counters = countersOf(snapshot);
+        if (this.#dialectFallback > 0)
+            counters.dialectFallback = this.#dialectFallback;
+        return buildStatus({
+            channel: this.#config.channel,
+            account: this.#config.channel,
+            bot: this.#config.botName,
+            health: buildListenerHealth({
+                listenState: snapshot.state === 'listening' ? 'listening' : snapshot.state === 'failed' ? 'failed' : 'stopped',
+                boundPort: snapshot.boundPort,
+                lastAuthenticatedAt: snapshot.lastAuthenticatedAt,
+                queueDepth: this.#queue.length + this.#inFlight,
+            }),
+            counters,
+            capabilities: this.capabilities,
+            attributes: { stableMessageId: true },
+            quota: { softLimit: 0, hardLimit: 0 },
+            sampledAt: this.#now(),
+            queueDepth: this.#queue.length + this.#inFlight,
+        });
+    }
+    async start(ports) {
+        const secret = await ports.resolveSecret(this.#config.secret);
+        if (secret === undefined || secret.length === 0)
+            throw new Error(`webhook: credential "${this.#config.secret}" did not resolve`);
+        const token = await ports.resolveSecret(this.#config.token);
+        if (token === undefined || token.length === 0)
+            throw new Error(`webhook: credential "${this.#config.token}" did not resolve`);
+        this.#tokenValue = token;
+        const server = createServer((request, response) => {
+            void this.#handle(secret, ports, request, response);
+        });
+        this.#server = server;
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(this.#config.listen.port, this.#config.listen.host, () => {
+                server.off('error', reject);
+                resolve();
+            });
+        });
+        const address = server.address();
+        this.#stats.listening(address.port);
+        return {
+            address: () => ({ port: address.port }),
+            stop: () => this.#stop(),
+        };
+    }
+    async send(input) {
+        if (this.#stopped)
+            return { ok: false, code: 'no_url', reason: 'the listener is closed', retryable: false };
+        const request = commentRequest(this.#config, input);
+        if (request === undefined) {
+            return { ok: false, code: 'no_url', reason: `"${input.target}" is not an issue address`, retryable: false };
+        }
+        if (this.#queue.length >= SEND_QUEUE_MAX) {
+            return { ok: false, code: 'busy', reason: 'too many comments are already waiting', retryable: true };
+        }
+        return new Promise((resolve) => {
+            this.#queue.push({ input, resolve });
+            void this.#drain();
+        });
+    }
+    async #drain() {
+        if (this.#inFlight > 0)
+            return;
+        const next = this.#queue.shift();
+        if (next === undefined)
+            return;
+        this.#inFlight = 1;
+        try {
+            next.resolve(await this.#postComment(next.input));
+        }
+        finally {
+            this.#inFlight = 0;
+            if (this.#queue.length > 0)
+                void this.#drain();
+        }
+    }
+    async #postComment(input) {
+        const request = commentRequest(this.#config, input);
+        if (request === undefined)
+            return { ok: false, code: 'no_url', reason: 'not an issue address', retryable: false };
+        const token = await this.#token();
+        if (token === undefined)
+            return { ok: false, code: 'unauthorized', reason: 'the token did not resolve', retryable: false };
+        const budget = input.timeoutMs ?? 10_000;
+        const deadline = Date.now() + budget;
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            const left = deadline - Date.now();
+            if (left <= 0)
+                break;
+            let response;
+            try {
+                response = await fetch(request.url, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json', authorization: `Bearer ${token}`, 'user-agent': 'dsbot-channel' },
+                    body: JSON.stringify({ body: request.body }),
+                    signal: AbortSignal.timeout(left),
+                });
+            }
+            catch (error) {
+                const name = error.name;
+                if (name === 'TimeoutError' || name === 'AbortError') {
+                    return this.#fail('busy', true, 'the api did not answer inside the send timeout');
+                }
+                if (attempt === 0)
+                    continue;
+                return this.#fail('unreachable', true, String(error));
+            }
+            if (response.ok) {
+                const body = (await response.json().catch(() => undefined));
+                const id = body !== undefined && (typeof body.id === 'number' || typeof body.id === 'string') ? String(body.id) : input.eventId;
+                return { ok: true, messageId: id, duplicate: false };
+            }
+            const status = response.status;
+            if (status === 401)
+                return this.#fail('unauthorized', false);
+            const waitMs = retryAfterMs(response);
+            if ((status === 429 || status === 403) && attempt === 0 && waitMs !== undefined && Date.now() + waitMs < deadline) {
+                await new Promise((resolve) => setTimeout(resolve, waitMs));
+                continue;
+            }
+            if (status === 429)
+                return this.#fail('busy', true);
+            if (status === 403)
+                return this.#fail(waitMs === undefined ? 'forbidden' : 'busy', waitMs !== undefined);
+            if (status >= 500)
+                return this.#fail('unreachable', true);
+            return this.#fail('rejected', false);
+        }
+        return this.#fail('busy', true, 'the api did not answer inside the send timeout');
+    }
+    #fail(code, retryable, reason = 'the api refused the comment') {
+        this.#stats.sendFailed(code);
+        return { ok: false, code, reason, retryable };
+    }
+    #tokenValue;
+    async #token() {
+        return this.#tokenValue;
+    }
+    async #handle(secret, ports, request, response) {
+        const path = (request.url ?? '').split('?')[0] ?? '';
+        if (path !== this.#config.listen.path) {
+            this.#stats.unknownPath();
+            this.#answer(response, 404, 'not found');
+            return;
+        }
+        if (request.method !== 'POST') {
+            this.#answer(response, 405, 'method not allowed');
+            return;
+        }
+        const raw = await this.#readBody(request);
+        if (raw === undefined) {
+            this.#answer(response, 413, 'payload too large');
+            return;
+        }
+        const signature = signatureOf(request);
+        if (signature === undefined || !verifySignature(secret, raw, signature.value)) {
+            this.#stats.authFailure();
+            this.#answer(response, 401, 'bad signature');
+            return;
+        }
+        this.#stats.authenticated();
+        let payload;
+        try {
+            payload = JSON.parse(raw.toString('utf8'));
+        }
+        catch {
+            this.#answer(response, 400, 'bad json');
+            return;
+        }
+        if (payload === null || typeof payload !== 'object' || Array.isArray(payload)) {
+            this.#answer(response, 400, 'bad json');
+            return;
+        }
+        const record = payload;
+        const picked = pickDialect(request, this.#config.dialect, record);
+        if (picked === 'mismatch') {
+            this.#stats.protocolMismatch();
+            this.#answer(response, 400, 'the event headers name another dialect');
+            return;
+        }
+        if (picked === 'unknown') {
+            this.#answer(response, 400, 'cannot tell the dialect');
+            return;
+        }
+        if (picked.fallback)
+            this.#dialectFallback += 1;
+        const event = headerOf(request, 'x-github-event') ?? headerOf(request, 'x-forgejo-event') ?? headerOf(request, 'x-gitea-event') ?? '';
+        if (event === '') {
+            this.#answer(response, 400, 'cannot tell the event class');
+            return;
+        }
+        const delivery = headerOf(request, 'x-github-delivery') ?? headerOf(request, 'x-forgejo-delivery') ?? headerOf(request, 'x-gitea-delivery') ?? '';
+        if (this.#config.repos.length > 0) {
+            const repo = record.repository;
+            const full = repo === undefined ? '' : `${String(repo.owner?.login ?? '')}/${String(repo.name ?? '')}`;
+            if (!this.#config.repos.includes(full)) {
+                this.#answer(response, 200, 'ignored');
+                return;
+            }
+        }
+        const mapped = mapWebhook({
+            dialect: picked.dialect,
+            event,
+            delivery: delivery === '' ? `${event}:${this.#now()}` : delivery,
+            payload: record,
+            config: { channel: this.#config.channel, login: this.#config.login, bots: this.#config.bots },
+        });
+        if ('skip' in mapped) {
+            if (mapped.skip === 'ping')
+                this.#stats.event('webhook.ping');
+            this.#answer(response, 200, 'ok');
+            return;
+        }
+        const key = delivery === '' ? mapped.message.eventKey : delivery;
+        const keys = [key, mapped.message.eventKey];
+        if (keys.some((one) => this.#inFlightKeys.has(one))) {
+            this.#answer(response, 503, 'busy');
+            return;
+        }
+        if (keys.some((one) => this.#seen.has(one))) {
+            this.#answer(response, 200, 'duplicate');
+            return;
+        }
+        for (const one of keys)
+            this.#inFlightKeys.add(one);
+        const at = this.#now();
+        const message = {
+            ...mapped.message,
+            transport: { ...mapped.message.transport, timestamp: mapped.message.transport.timestamp === 0 ? at : mapped.message.transport.timestamp },
+            receivedAt: at,
+            adapter: fitAdapterMeta(mapped.message.adapter, ADAPTER_META_MAX_BYTES),
+        };
+        this.#stats.event(classOf(message));
+        let verdict;
+        try {
+            verdict = await ports.onMessage(message).catch((error) => ({ ok: false, code: 'rejected', reason: String(error) }));
+        }
+        finally {
+            for (const one of keys)
+                this.#inFlightKeys.delete(one);
+        }
+        if (verdict.ok) {
+            for (const one of keys)
+                this.#remember(one);
+            this.#answer(response, 200, 'ok');
+            return;
+        }
+        if (verdict.code === 'busy') {
+            response.writeHead(503, { 'retry-after': '1', 'content-type': 'text/plain' });
+            response.end('busy');
+            return;
+        }
+        for (const one of keys)
+            this.#remember(one);
+        this.#answer(response, 202, verdict.reason);
+    }
+    #remember(key) {
+        const at = this.#now();
+        for (const [seen, when] of this.#seen) {
+            if (at - when.at > SEEN_TTL_MS)
+                this.#seen.delete(seen);
+        }
+        this.#seen.set(key, { at });
+    }
+    #readBody(request) {
+        return new Promise((resolve) => {
+            const chunks = [];
+            let size = 0;
+            let settled = false;
+            const settle = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(value);
+            };
+            request.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > MAX_WEBHOOK_BODY_BYTES) {
+                    settle(undefined);
+                    request.resume();
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            request.on('end', () => settle(Buffer.concat(chunks)));
+            request.on('error', () => settle(undefined));
+        });
+    }
+    #answer(response, status, body) {
+        response.writeHead(status, { 'content-type': 'text/plain', 'content-length': Buffer.byteLength(body) });
+        response.end(body);
+    }
+    async #stop() {
+        this.#stopped = true;
+        for (const waiting of this.#queue.splice(0)) {
+            waiting.resolve({ ok: false, code: 'no_url', reason: 'the listener is closed', retryable: false });
+        }
+        const server = this.#server;
+        this.#server = undefined;
+        if (server === undefined)
+            return;
+        await new Promise((resolve) => server.close(() => resolve()));
+        this.#stats.closed();
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,108 @@
+import type { AdapterFactory, AdapterMount } from '@dsbot-channel/core/adapter-registry.js';
+import { WebhookAdapter } from './adapter.js';
+import type { WebhookConfig } from './adapter.js';
+/** Reads the webhook block; every field is named, so a typo fails at mount. */
+export declare function parseWebhookConfig(mount: AdapterMount): WebhookConfig;
+export declare const createWebhookAdapter: AdapterFactory;
+export { WebhookAdapter };
+export { mapWebhook, classOf, mentionsOf, semanticClass } from './mapping.js';
+export type { WebhookConfig };
+export declare const Config: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+    channel: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    botName: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    anchor: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    session: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    model: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    reply: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    turn: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    delivery: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    policy: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    pipeline: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    events: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    status: import("@deepseek-ai/schemastery").default<boolean, boolean, "plain">;
+    transport: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    channel: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    botName: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    anchor: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    session: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    model: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+    reply: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    turn: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    delivery: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    policy: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    pipeline: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    events: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    status: import("@deepseek-ai/schemastery").default<boolean, boolean, "plain">;
+    transport: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+}>>, "plain">;
+export declare const apply: (ctx: import("@deepseek-ai/cordis").Context, config?: Record<string, unknown>) => void;
+export declare const plugin: {
+    name: string;
+    inject: string[];
+    Config: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+        channel: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        botName: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        anchor: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        session: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        model: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        reply: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        turn: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        delivery: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        policy: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        pipeline: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        events: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        status: import("@deepseek-ai/schemastery").default<boolean, boolean, "plain">;
+        transport: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        channel: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        botName: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        anchor: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        session: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        model: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        reply: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        turn: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        delivery: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        policy: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        pipeline: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        events: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        status: import("@deepseek-ai/schemastery").default<boolean, boolean, "plain">;
+        transport: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    }>>, "plain">;
+    apply: (ctx: import("@deepseek-ai/cordis").Context, config?: Record<string, unknown>) => void;
+};
+declare const _default: {
+    name: string;
+    inject: string[];
+    Config: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+        channel: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        botName: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        anchor: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        session: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        model: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        reply: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        turn: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        delivery: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        policy: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        pipeline: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        events: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        status: import("@deepseek-ai/schemastery").default<boolean, boolean, "plain">;
+        transport: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    }>>, Schemastery.ObjectT<NoInfer<{
+        channel: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        botName: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        anchor: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        session: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        model: import("@deepseek-ai/schemastery").default<string, string, "plain">;
+        reply: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        turn: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        delivery: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        policy: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        pipeline: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        events: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+        status: import("@deepseek-ai/schemastery").default<boolean, boolean, "plain">;
+        transport: import("@deepseek-ai/schemastery").default<any, any, "plain">;
+    }>>, "plain">;
+    apply: (ctx: import("@deepseek-ai/cordis").Context, config?: Record<string, unknown>) => void;
+};
+export default _default;

package/dist/index.js

@@ -0,0 +1,78 @@
+import { makeAdapterPlugin } from '@dsbot-channel/core/adapter-plugin.js';
+import { ConfigError, assertBindHost } from '@dsbot-channel/core/config.js';
+import { DEFAULT_WEBHOOK_HOST, DEFAULT_WEBHOOK_PATH, DEFAULT_WEBHOOK_PORT, WebhookAdapter } from './adapter.js';
+import { WEBHOOK_DIALECTS } from './mapping.js';
+const FIELDS = new Set(['listen', 'secret', 'token', 'dialect', 'api', 'login', 'bots', 'repos']);
+function refuse(message, path = ['transport']) {
+    throw new ConfigError(message, path);
+}
+function strings(value, field) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        refuse(`transport.${field} must be a list of names`, ['transport', field]);
+    return value.map((one, index) => {
+        if (typeof one !== 'string' || one.length === 0)
+            refuse(`transport.${field}[${index}] must be a non-empty string`, ['transport', field, index]);
+        return one;
+    });
+}
+/** Reads the webhook block; every field is named, so a typo fails at mount. */
+export function parseWebhookConfig(mount) {
+    const raw = mount.transport;
+    const unknown = Object.keys(raw).filter((key) => !FIELDS.has(key));
+    if (unknown.length > 0)
+        refuse(`transport names a field this adapter does not read: ${unknown.join(', ')}`);
+    const listen = (raw.listen ?? {});
+    const host = typeof listen.host === 'string' && listen.host.length > 0 ? listen.host : DEFAULT_WEBHOOK_HOST;
+    assertBindHost(host);
+    const port = typeof listen.port === 'number' && Number.isInteger(listen.port) ? listen.port : DEFAULT_WEBHOOK_PORT;
+    if (port < 0 || port > 65535)
+        refuse(`transport.listen.port must be between 0 and 65535: ${port}`, ['transport', 'listen', 'port']);
+    const path = typeof listen.path === 'string' && listen.path.length > 0 ? listen.path : DEFAULT_WEBHOOK_PATH;
+    if (!path.startsWith('/'))
+        refuse(`transport.listen.path must start with "/": ${path}`, ['transport', 'listen', 'path']);
+    const secret = raw.secret;
+    if (typeof secret !== 'string' || secret.length === 0)
+        refuse('transport.secret must be a credential reference name', ['transport', 'secret']);
+    const token = raw.token;
+    if (typeof token !== 'string' || token.length === 0)
+        refuse('transport.token must be a credential reference name', ['transport', 'token']);
+    const dialect = (raw.dialect ?? 'auto');
+    if (!WEBHOOK_DIALECTS.includes(dialect)) {
+        refuse(`transport.dialect must be one of ${WEBHOOK_DIALECTS.join(', ')}: ${String(dialect)}`, ['transport', 'dialect']);
+    }
+    const api = raw.api === undefined ? 'https://api.github.com' : raw.api;
+    if (typeof api !== 'string' || !/^https?:\/\//.test(api)) {
+        refuse(`transport.api must be an absolute http(s) url: ${String(api)}`, ['transport', 'api']);
+    }
+    const login = raw.login;
+    if (typeof login !== 'string' || login.length === 0)
+        refuse('transport.login names the bot and is required', ['transport', 'login']);
+    return {
+        channel: mount.channel,
+        botName: mount.botName,
+        status: mount.status !== false,
+        listen: { host, port, path },
+        secret,
+        token,
+        dialect,
+        api: api.replace(/\/+$/, ''),
+        login,
+        bots: strings(raw.bots, 'bots'),
+        repos: strings(raw.repos, 'repos'),
+    };
+}
+export const createWebhookAdapter = (mount, options) => new WebhookAdapter(parseWebhookConfig(mount), options);
+export { WebhookAdapter };
+export { mapWebhook, classOf, mentionsOf, semanticClass } from './mapping.js';
+const adapter = makeAdapterPlugin({
+    name: 'dsbot-channel/webhook',
+    kind: 'webhook',
+    factory: createWebhookAdapter,
+    check: parseWebhookConfig,
+});
+export const Config = adapter.Config;
+export const apply = adapter.apply;
+export const plugin = adapter.plugin;
+export default adapter.plugin;

package/dist/mapping.d.ts

@@ -0,0 +1,58 @@
+import type { InboundMessage } from '@dsbot-channel/core/contract.js';
+export declare const WEBHOOK_DIALECTS: readonly ["github", "forgejo", "auto"];
+export type WebhookDialect = (typeof WEBHOOK_DIALECTS)[number];
+export interface MappingConfig {
+    channel: string;
+    /** The bot's own login, used for `mentioned.self`. */
+    login: string;
+    /** Logins whose comments count as bot speech. */
+    bots: readonly string[];
+}
+export interface MappingInput {
+    dialect: 'github' | 'forgejo';
+    event: string;
+    delivery: string;
+    payload: Record<string, unknown>;
+    config: MappingConfig;
+}
+export type MappingResult = {
+    message: InboundMessage;
+} | {
+    skip: 'ping' | 'malformed';
+};
+type Payload = Record<string, unknown>;
+/** The class an adapter may list in `events.turn`; always two segments. */
+export declare function semanticClass(event: string): string;
+interface Entity {
+    owner: string;
+    repo: string;
+    full: string;
+    number?: number;
+}
+/** A workflow run names the fields a failure has to show, so a reader need not fetch the run. */
+export declare function workflowRunSummary(actor: string, entity: Entity, payload: Payload): string;
+/** A check run names the check, its state, the commit it ran on and a link. */
+export declare function checkRunSummary(actor: string, entity: Entity, payload: Payload): string;
+/** A check suite names its state, the branch it ran on and a link. */
+export declare function checkSuiteSummary(actor: string, entity: Entity, payload: Payload): string;
+/** A commit status names the commit, the context that reported it, the state and a link. */
+export declare function commitStatusSummary(actor: string, entity: Entity, payload: Payload): string;
+/** One line, no clock, so a redelivery of the same event reads the same. */
+export declare function summaryOf(input: {
+    actor: string;
+    event: string;
+    action: string;
+    entity: Entity;
+    title: string;
+}): string;
+export declare function mentionsOf(body: string, login: string): {
+    self: boolean;
+    others: boolean;
+};
+/** Turns a webhook call into the one inbound event core sees, or says it carries none. */
+export declare function mapWebhook(input: MappingInput): MappingResult;
+/** The class name an adapter may list in `events.turn`, e.g. `action.push`. */
+export declare function classOf(message: InboundMessage): string;
+/** Keeps `meta.adapter` under the core limit by dropping the biggest fields first. */
+export declare function fitAdapterMeta(meta: Record<string, unknown>, limit: number): Record<string, unknown>;
+export {};

package/dist/mapping.js

@@ -0,0 +1,422 @@
+import { safeUrl } from '@dsbot-channel/core/safe-url.js';
+export const WEBHOOK_DIALECTS = ['github', 'forgejo', 'auto'];
+const CI_EVENTS = new Set(['workflow_run', 'check_run', 'check_suite', 'status']);
+const VERBS = {
+    opened: 'opened',
+    closed: 'closed',
+    reopened: 'reopened',
+    edited: 'edited',
+    deleted: 'deleted',
+    created: 'added',
+    submitted: 'submitted',
+    synchronize: 'updated',
+    completed: 'completed',
+    labeled: 'labeled',
+    unlabeled: 'unlabeled',
+};
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function text(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function whole(value) {
+    return typeof value === 'number' && Number.isInteger(value) ? value : undefined;
+}
+function normalizedName(event) {
+    return event.replace(/[^a-z0-9_]/gi, '_').toLowerCase();
+}
+/** The class an adapter may list in `events.turn`; always two segments. */
+export function semanticClass(event) {
+    if (event === 'push')
+        return 'push';
+    if (CI_EVENTS.has(event))
+        return 'ci';
+    if (event === 'issues')
+        return 'issues';
+    if (event === 'pull_request')
+        return 'pull_request';
+    if (event === 'issue_comment' || event === 'pull_request_review_comment')
+        return 'comment';
+    if (event === 'pull_request_review')
+        return 'review';
+    if (event === 'release')
+        return 'release';
+    return normalizedName(event);
+}
+function entityOf(payload) {
+    const repo = record(payload.repository);
+    const owner = text(record(repo?.owner)?.login) ?? text(record(repo?.owner)?.username);
+    const name = text(repo?.name);
+    if (owner === undefined || name === undefined)
+        return undefined;
+    const number = whole(record(payload.issue)?.number) ??
+        whole(record(payload.pull_request)?.number) ??
+        whole(record(payload.discussion)?.number);
+    return { owner, repo: name, full: `${owner}/${name}`, ...(number === undefined ? {} : { number }) };
+}
+function scopeOf(entity) {
+    return entity.number === undefined ? `gh:${entity.full}` : `gh:${entity.full}#${entity.number}`;
+}
+function titleOf(payload) {
+    return (text(record(payload.issue)?.title) ??
+        text(record(payload.pull_request)?.title) ??
+        text(record(payload.release)?.name) ??
+        text(record(payload.release)?.tag_name) ??
+        text(record(payload.head_commit)?.message)?.split('\n')[0] ??
+        '');
+}
+const OBJECT = {
+    issues: 'issue',
+    pull_request: 'pull request',
+    pull_request_review: 'review',
+    release: 'release',
+};
+/** Longest field a CI line keeps; a summary states the facts, not the whole payload. */
+const CI_FIELD_MAX = 200;
+function clipped(value) {
+    if (value === undefined)
+        return undefined;
+    const flat = value.replace(/\s+/g, ' ').trim();
+    if (flat === '')
+        return undefined;
+    return flat.length <= CI_FIELD_MAX ? flat : flat.slice(0, CI_FIELD_MAX);
+}
+/** A workflow run names the fields a failure has to show, so a reader need not fetch the run. */
+export function workflowRunSummary(actor, entity, payload) {
+    const run = record(payload.workflow_run) ?? {};
+    const name = clipped(text(run.name) ?? text(run.display_title));
+    const status = text(run.status) ?? 'unknown';
+    const conclusion = text(run.conclusion);
+    const state = conclusion === undefined ? status : `${status}/${conclusion}`;
+    const branch = clipped(text(run.head_branch));
+    const number = Array.isArray(run.pull_requests)
+        ? run.pull_requests.map((one) => whole(record(one)?.number)).find((one) => one !== undefined)
+        : undefined;
+    const url = safeUrl(text(run.html_url), CI_FIELD_MAX);
+    const parts = [`${actor} workflow_run ${entity.full}`];
+    if (name !== undefined)
+        parts.push(`"${name}"`);
+    parts.push(state);
+    if (branch !== undefined)
+        parts.push(`on ${branch}`);
+    if (number !== undefined)
+        parts.push(`pr #${number}`);
+    if (url !== undefined)
+        parts.push(url);
+    return parts.join(' ');
+}
+/** A check run names the check, its state, the commit it ran on and a link. */
+export function checkRunSummary(actor, entity, payload) {
+    const run = record(payload.check_run) ?? {};
+    const name = clipped(text(run.name));
+    const status = text(run.status) ?? 'unknown';
+    const conclusion = text(run.conclusion);
+    const state = conclusion === undefined ? status : `${status}/${conclusion}`;
+    const sha = clipped(text(run.head_sha));
+    const url = safeUrl(text(run.html_url), CI_FIELD_MAX);
+    const parts = [`${actor} check_run ${entity.full}`];
+    if (name !== undefined)
+        parts.push(`"${name}"`);
+    parts.push(state);
+    if (sha !== undefined)
+        parts.push(sha);
+    if (url !== undefined)
+        parts.push(url);
+    return parts.join(' ');
+}
+/** A check suite names its state, the branch it ran on and a link. */
+export function checkSuiteSummary(actor, entity, payload) {
+    const suite = record(payload.check_suite) ?? {};
+    const status = text(suite.status) ?? 'unknown';
+    const conclusion = text(suite.conclusion);
+    const state = conclusion === undefined ? status : `${status}/${conclusion}`;
+    const branch = clipped(text(suite.head_branch));
+    const url = safeUrl(text(suite.html_url), CI_FIELD_MAX);
+    const parts = [`${actor} check_suite ${entity.full}`, state];
+    if (branch !== undefined)
+        parts.push(`on ${branch}`);
+    if (url !== undefined)
+        parts.push(url);
+    return parts.join(' ');
+}
+/** A commit status names the commit, the context that reported it, the state and a link. */
+export function commitStatusSummary(actor, entity, payload) {
+    const sha = clipped(text(payload.sha));
+    const context = clipped(text(payload.context));
+    const state = text(payload.state) ?? 'unknown';
+    const url = safeUrl(text(payload.target_url), CI_FIELD_MAX);
+    const parts = [`${actor} status ${entity.full}`];
+    if (sha !== undefined)
+        parts.push(sha);
+    parts.push(context === undefined ? state : `${context}: ${state}`);
+    if (url !== undefined)
+        parts.push(url);
+    return parts.join(' ');
+}
+/** One line, no clock, so a redelivery of the same event reads the same. */
+export function summaryOf(input) {
+    const verb = VERBS[input.action] ?? input.action;
+    const object = OBJECT[input.event] ?? input.event;
+    const subject = input.entity.number === undefined ? input.entity.full : `${input.entity.full}#${input.entity.number}`;
+    const head = `${input.actor} ${verb} ${object} ${subject}`.replace(/\s+/g, ' ').trim();
+    return input.title === '' ? head : `${head}: ${input.title}`;
+}
+function withoutCode(body) {
+    return body.replace(/```[\s\S]*?```/g, ' ').replace(/```[\s\S]*$/g, ' ').replace(/`[^`\n]*`/g, ' ');
+}
+const MENTION = /@([A-Za-z0-9][A-Za-z0-9-]*(?:\/[A-Za-z0-9][A-Za-z0-9-]*)?)/g;
+export function mentionsOf(body, login) {
+    const seen = new Set();
+    for (const match of withoutCode(body).matchAll(MENTION)) {
+        if (match[1] !== undefined)
+            seen.add(match[1].toLowerCase());
+    }
+    const mine = login.toLowerCase();
+    return {
+        self: mine.length > 0 && seen.has(mine),
+        others: [...seen].some((one) => one !== mine),
+    };
+}
+function sender(payload, action) {
+    const actor = record(payload.sender);
+    const comment = record(payload.comment);
+    const review = record(payload.review);
+    return (text(record(comment?.user)?.login) ??
+        text(record(comment?.user)?.username) ??
+        text(record(review?.user)?.login) ??
+        text(record(review?.user)?.username) ??
+        text(actor?.login) ??
+        text(actor?.username) ??
+        action);
+}
+function eventKeyOf(input) {
+    const comment = whole(record(input.payload.comment)?.id);
+    if (comment !== undefined) {
+        const base = input.event === 'pull_request_review_comment' ? `review_comment:${comment}` : `comment:${comment}`;
+        return input.action === 'created' ? base : `${base}:${input.action}`;
+    }
+    const review = whole(record(input.payload.review)?.id);
+    if (review !== undefined) {
+        return input.action === 'submitted' || input.action === 'created' ? `review:${review}` : `review:${review}:${input.action}`;
+    }
+    if (input.entity.number !== undefined) {
+        const stamp = text(record(input.payload.issue)?.updated_at) ??
+            text(record(input.payload.pull_request)?.updated_at) ??
+            text(record(input.payload.discussion)?.updated_at) ??
+            '';
+        const prefix = input.event === 'pull_request' ? 'pr' : 'issue';
+        return stamp === ''
+            ? `${prefix}:${input.entity.full}#${input.entity.number}:${input.action}:${input.delivery}`
+            : `${prefix}:${input.entity.full}#${input.entity.number}:${input.action}:${stamp}`;
+    }
+    if (input.event === 'push') {
+        const after = text(input.payload.after) ?? text(record(input.payload.head_commit)?.id) ?? '';
+        return `push:${input.entity.full}:${after}`;
+    }
+    if (input.event === 'workflow_run') {
+        const run = record(input.payload.workflow_run) ?? {};
+        return `run:${input.entity.full}:${whole(run.id) ?? ''}:${whole(run.run_attempt) ?? 1}:${text(run.conclusion) ?? ''}`;
+    }
+    if (input.event === 'check_run') {
+        const run = record(input.payload.check_run) ?? {};
+        return `check:${input.entity.full}:${whole(run.id) ?? ''}:${text(run.status) ?? ''}:${text(run.conclusion) ?? ''}`;
+    }
+    if (input.event === 'check_suite') {
+        const run = record(input.payload.check_suite) ?? {};
+        return `suite:${input.entity.full}:${whole(run.id) ?? ''}:${text(run.status) ?? ''}:${text(run.conclusion) ?? ''}`;
+    }
+    if (input.event === 'status') {
+        const sha = text(input.payload.sha) ?? '';
+        const context = text(input.payload.context) ?? '';
+        const state = text(input.payload.state) ?? '';
+        return `status:${input.entity.full}:${sha}:${context}:${state}`;
+    }
+    return `delivery:${input.delivery}`;
+}
+function botOrPerson(bots, login, type) {
+    return type === 'Bot' || bots.some((one) => one.toLowerCase() === login.toLowerCase()) ? 'bot' : 'person';
+}
+function bodyOf(payload) {
+    const comment = record(payload.comment);
+    const review = record(payload.review);
+    if (comment !== undefined) {
+        const parent = whole(comment.in_reply_to_id);
+        return {
+            body: text(comment.body) ?? '',
+            id: whole(comment.id) ?? 0,
+            ...(parent === undefined ? {} : { parent }),
+            user: comment.user,
+        };
+    }
+    const comments = Array.isArray(review?.comments) ? review?.comments : undefined;
+    const first = comments === undefined ? undefined : record(comments[0]);
+    return {
+        body: text(review?.body) ?? text(first?.body) ?? '',
+        id: whole(review?.id) ?? whole(first?.id) ?? 0,
+        ...(whole(first?.in_reply_to_id) === undefined ? {} : { parent: whole(first?.in_reply_to_id) }),
+        user: review?.user ?? first?.user,
+    };
+}
+/** The facts a comment names, on one line ahead of the body it carries. */
+function commentHeader(input, entity, login, authorKind, action, link) {
+    const subject = entity.number === undefined ? entity.full : `${entity.full}#${entity.number}`;
+    const parts = [`[${input.dialect}] ${subject}`, `${login} (${authorKind})`, `${input.event}/${action}`];
+    if (link !== undefined)
+        parts.push(link);
+    return parts.join(' \u00b7 ');
+}
+function messageOf(input, entity, action) {
+    const payload = input.payload;
+    const found = bodyOf(payload);
+    const comment = record(payload.comment);
+    const body = found.body;
+    const login = sender(payload, action);
+    const id = found.id;
+    const parent = found.parent;
+    const mentioned = mentionsOf(body, input.config.login);
+    const scoped = scopeOf(entity);
+    const authorKind = botOrPerson(input.config.bots, login, record(found.user)?.type);
+    const link = safeUrl(text(comment?.html_url) ?? text(record(payload.review)?.html_url), CI_FIELD_MAX);
+    const header = commentHeader(input, entity, login, authorKind, action, link);
+    return {
+        eventKey: eventKeyOf({ event: input.event, payload, delivery: input.delivery, entity, action: 'created' }),
+        kind: 'message',
+        event: { postType: input.event, type: normalizedName(input.event) },
+        sessionKey: scoped,
+        replyTarget: scoped,
+        requestId: String(id),
+        chainId: scoped,
+        source: {
+            kind: 'webhook',
+            instance: input.config.channel,
+            peer: entity.number === undefined ? entity.full : `${entity.full}#${entity.number}`,
+            scope: 'group',
+        },
+        author: { senderId: login, kind: authorKind, personId: null },
+        rawText: body,
+        body: { text: `${header}\n${body}`, media: [], replyTo: parent === undefined ? null : String(parent) },
+        transport: {
+            messageId: String(id),
+            timestamp: 0,
+            mentioned: { self: mentioned.self, others: mentioned.others, all: false },
+            isReply: parent !== undefined,
+            signature: null,
+        },
+        declared: { nickname: login, avatar: '' },
+        adapter: {
+            event: input.event,
+            action,
+            delivery: input.delivery,
+            dialect: input.dialect,
+            ...(entity.number === undefined ? {} : { number: entity.number }),
+            ...(whole(comment?.id) === undefined ? {} : { commentId: whole(comment?.id) }),
+        },
+        receivedAt: 0,
+    };
+}
+function ciSummaryOf(input, entity, login) {
+    if (input.event === 'workflow_run')
+        return workflowRunSummary(login, entity, input.payload);
+    if (input.event === 'check_run')
+        return checkRunSummary(login, entity, input.payload);
+    if (input.event === 'check_suite')
+        return checkSuiteSummary(login, entity, input.payload);
+    if (input.event === 'status')
+        return commitStatusSummary(login, entity, input.payload);
+    return undefined;
+}
+function actionOf(input, entity, action) {
+    const payload = input.payload;
+    const login = sender(payload, action);
+    const summary = ciSummaryOf(input, entity, login) ??
+        summaryOf({ actor: login, event: input.event, action, entity, title: titleOf(payload) });
+    const line = `[${input.dialect}] ${summary}`;
+    const scoped = scopeOf(entity);
+    return {
+        eventKey: eventKeyOf({ event: input.event, payload, delivery: input.delivery, entity, action }),
+        kind: 'action',
+        event: {
+            postType: input.event,
+            type: record(payload.comment) !== undefined
+                ? 'comment'
+                : record(payload.review) !== undefined
+                    ? 'review'
+                    : semanticClass(input.event),
+            ...(action === '' ? {} : { subType: action }),
+        },
+        sessionKey: scoped,
+        replyTarget: scoped,
+        requestId: input.delivery,
+        chainId: scoped,
+        source: {
+            kind: 'webhook',
+            instance: input.config.channel,
+            peer: entity.number === undefined ? entity.full : `${entity.full}#${entity.number}`,
+            scope: 'group',
+        },
+        author: {
+            senderId: login,
+            kind: botOrPerson(input.config.bots, login, record(payload.sender)?.type),
+            personId: null,
+        },
+        rawText: summary,
+        body: { text: line, media: [], replyTo: null },
+        transport: {
+            messageId: input.delivery,
+            timestamp: 0,
+            mentioned: { self: false, others: false, all: false },
+            isReply: false,
+            signature: null,
+        },
+        declared: { nickname: login, avatar: '' },
+        adapter: {
+            event: input.event,
+            action,
+            delivery: input.delivery,
+            dialect: input.dialect,
+            ...(entity.number === undefined ? {} : { number: entity.number }),
+        },
+        receivedAt: 0,
+    };
+}
+/** Turns a webhook call into the one inbound event core sees, or says it carries none. */
+export function mapWebhook(input) {
+    const { event, payload } = input;
+    if (event === 'ping' || event.startsWith('installation'))
+        return { skip: 'ping' };
+    const entity = entityOf(payload);
+    if (entity === undefined)
+        return { skip: 'malformed' };
+    const action = text(payload.action) ?? '';
+    const found = bodyOf(payload);
+    const written = found.body.length > 0;
+    const comment = record(payload.comment);
+    const review = record(payload.review);
+    const message = comment !== undefined ? action === 'created' : review !== undefined && written;
+    if (message)
+        return { message: messageOf(input, entity, action) };
+    return { message: actionOf(input, entity, action) };
+}
+/** The class name an adapter may list in `events.turn`, e.g. `action.push`. */
+export function classOf(message) {
+    const kind = message.kind ?? 'message';
+    const type = message.event?.type ?? 'unknown';
+    return `${kind}.${type}`;
+}
+/** Keeps `meta.adapter` under the core limit by dropping the biggest fields first. */
+export function fitAdapterMeta(meta, limit) {
+    const kept = { ...meta };
+    const size = (value) => JSON.stringify(value)?.length ?? 0;
+    for (const key of ['payload', 'title', 'body']) {
+        if (size(kept) <= limit)
+            return kept;
+        delete kept[key];
+    }
+    for (const key of Object.keys(kept).sort((left, right) => size({ [right]: kept[right] }) - size({ [left]: kept[left] }))) {
+        if (size(kept) <= limit)
+            return kept;
+        delete kept[key];
+    }
+    return kept;
+}

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@dsbot-channel/webhook",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.7.1",
+  "description": "Webhook transport for dsbot-channel.",
+  "type": "module",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./*.js": {
+      "types": "./dist/*.d.ts",
+      "default": "./dist/*.js"
+    },
+    "./package.json": "./package.json",
+    "./cordis.patch.yml": "./cordis.patch.yml"
+  },
+  "files": [
+    "dist",
+    "assets",
+    "cordis.patch.yml",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "engines": {
+    "node": "^20.19.0 || >=22.12.0"
+  },
+  "dependencies": {
+    "@dsbot-channel/core": "^0.7.1"
+  },
+  "devDependencies": {
+    "@types/node": "~22.20.5",
+    "typescript": "~5.9.3"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "scripts": {
+    "build": "pnpm clean && tsc -p tsconfig.build.json",
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "typecheck": "tsc -p tsconfig.build.json --noEmit",
+    "verify:dist": "node ../../scripts/verify-dist.mjs packages/webhook"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.