@integrity-labs/agt-cli 0.28.1163 → 0.28.1165

package/dist/mcp/origami.js

@@ -19117,7 +19117,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str, str.replace(/^\s*|\s*$/g, ""));
     }
     _exports.trim = trim;
-    function truncate(input, length, killwords, end) {
+    function truncate2(input, length, killwords, end) {
       var orig = input;
       input = normalize(input, "");
       length = length || 255;
@@ -19136,7 +19136,7 @@ var require_filters = __commonJS({
       input += end !== void 0 && end !== null ? end : "...";
       return r.copySafeness(orig, input);
     }
-    _exports.truncate = truncate;
+    _exports.truncate = truncate2;
     function upper(str) {
       str = normalize(str, "");
       return str.toUpperCase();
@@ -43225,6 +43225,183 @@ var videoRenderTriggerAdapter = {
 };
 registerTriggerSource(videoRenderTriggerAdapter);
 
+// ../core/dist/triggers/adapters/webhook.js
+var WEBHOOK_TRIGGER_PROVIDER = "webhook";
+var WEBHOOK_MAX_BODY_BYTES = 1280 * 1024;
+var WEBHOOK_PROMPT_MAX_CHARS = 8e3;
+var WEBHOOK_RAW_MAX_CHARS = 64 * 1024;
+var WEBHOOK_INSTRUCTION_MAX_CHARS = 2e3;
+var WEBHOOK_NAME_MAX_CHARS = 80;
+var WEBHOOK_DEFAULT_RATE_CAP = 60;
+var WEBHOOK_MAX_RATE_CAP = 1e3;
+var WEBHOOK_PRESETS = {
+  // https://docs.aws.amazon.com/eventbridge/latest/ref/overiew-event-structure.html
+  eventbridge: {
+    dedupPath: "id",
+    eventTypePaths: ["source", "detail-type"],
+    payloadPath: "detail",
+    timePath: "time"
+  },
+  // Raw-body hash dedup, whole body as payload. Set dedup_path when the
+  // sender has a stable id, or two identical bodies collapse into one.
+  generic: {}
+};
+var PATH_RE = /^[A-Za-z0-9_$-]+(\.[A-Za-z0-9_$-]+){0,9}$/;
+function readPath(value, path) {
+  let cur = value;
+  for (const key of path.split(".")) {
+    if (cur === null || typeof cur !== "object" || Array.isArray(cur))
+      return void 0;
+    if (!Object.prototype.hasOwnProperty.call(cur, key))
+      return void 0;
+    cur = cur[key];
+  }
+  return cur;
+}
+function scalarString(v) {
+  if (typeof v === "string")
+    return v.length > 0 ? v : null;
+  if (typeof v === "number" && Number.isFinite(v))
+    return String(v);
+  return null;
+}
+function truncate(text, max) {
+  if (text.length <= max)
+    return text;
+  return `${text.slice(0, max)}
+... [truncated ${text.length - max} more characters]`;
+}
+function resolvePreset(config2) {
+  const name = config2["preset"];
+  const base = typeof name === "string" && name in WEBHOOK_PRESETS ? WEBHOOK_PRESETS[name] : WEBHOOK_PRESETS.generic;
+  const dedup = config2["dedup_path"];
+  const type = config2["event_type_path"];
+  const payload = config2["payload_path"];
+  return {
+    ...base,
+    ...typeof dedup === "string" && dedup ? { dedupPath: dedup } : {},
+    ...typeof type === "string" && type ? { eventTypePaths: [type] } : {},
+    ...typeof payload === "string" && payload ? { payloadPath: payload } : {}
+  };
+}
+function validateWebhookConfig(input) {
+  const out = {};
+  const name = input["name"];
+  if (name !== void 0) {
+    if (typeof name !== "string")
+      return { ok: false, error: "name must be a string" };
+    const trimmed = name.trim();
+    if (trimmed.length > WEBHOOK_NAME_MAX_CHARS) {
+      return { ok: false, error: `name must be at most ${WEBHOOK_NAME_MAX_CHARS} characters` };
+    }
+    if (trimmed)
+      out["name"] = trimmed;
+  }
+  const instruction = input["instruction"];
+  if (typeof instruction !== "string" || !instruction.trim()) {
+    return {
+      ok: false,
+      error: "instruction is required: tell the agent what to do when an event arrives"
+    };
+  }
+  if (instruction.trim().length > WEBHOOK_INSTRUCTION_MAX_CHARS) {
+    return {
+      ok: false,
+      error: `instruction must be at most ${WEBHOOK_INSTRUCTION_MAX_CHARS} characters`
+    };
+  }
+  out["instruction"] = instruction.trim();
+  const preset = input["preset"] ?? "generic";
+  if (typeof preset !== "string" || !(preset in WEBHOOK_PRESETS)) {
+    return {
+      ok: false,
+      error: `preset must be one of: ${Object.keys(WEBHOOK_PRESETS).join(", ")}`
+    };
+  }
+  out["preset"] = preset;
+  for (const key of ["dedup_path", "event_type_path", "payload_path"]) {
+    const v = input[key];
+    if (v === void 0 || v === null || v === "")
+      continue;
+    if (typeof v !== "string" || !PATH_RE.test(v)) {
+      return { ok: false, error: `${key} must be a dot path like "detail.id"` };
+    }
+    out[key] = v;
+  }
+  const cap = input["max_events_per_hour"];
+  if (cap !== void 0 && cap !== null) {
+    if (typeof cap !== "number" || !Number.isInteger(cap) || cap < 1 || cap > WEBHOOK_MAX_RATE_CAP) {
+      return {
+        ok: false,
+        error: `max_events_per_hour must be an integer from 1 to ${WEBHOOK_MAX_RATE_CAP}`
+      };
+    }
+    out["max_events_per_hour"] = cap;
+  } else {
+    out["max_events_per_hour"] = WEBHOOK_DEFAULT_RATE_CAP;
+  }
+  return { ok: true, config: out };
+}
+function webhookRateCap(trigger) {
+  const cap = trigger.config["max_events_per_hour"];
+  if (typeof cap === "number" && Number.isInteger(cap) && cap >= 1) {
+    return Math.min(cap, WEBHOOK_MAX_RATE_CAP);
+  }
+  return WEBHOOK_DEFAULT_RATE_CAP;
+}
+function buildWebhookEvent(req, config2, now = /* @__PURE__ */ new Date()) {
+  const preset = resolvePreset(config2);
+  const body = req.body;
+  const raw = req.rawBody ?? JSON.stringify(body ?? null);
+  const idValue = preset.dedupPath ? scalarString(readPath(body, preset.dedupPath)) : null;
+  const dedupKey = idValue ? `wh:id:${stableHash(idValue)}` : `wh:raw:${stableHash(raw)}`;
+  const typeParts = (preset.eventTypePaths ?? []).map((p2) => scalarString(readPath(body, p2))).filter((v) => v !== null).map((v) => v.slice(0, 200));
+  const eventType = typeParts.length > 0 ? typeParts.join(" / ") : "webhook event";
+  const timeValue = preset.timePath ? scalarString(readPath(body, preset.timePath)) : null;
+  const timeMs = timeValue ? Date.parse(timeValue) : NaN;
+  const occurredAt = Number.isFinite(timeMs) ? new Date(timeMs).toISOString() : now.toISOString();
+  let payload = body;
+  if (preset.payloadPath) {
+    const sub = readPath(body, preset.payloadPath);
+    if (sub !== void 0)
+      payload = sub;
+  }
+  const rendered = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) ?? "null";
+  const lines = [`Event: ${eventType}`];
+  if (idValue)
+    lines.push(`Event id: ${idValue.slice(0, 200)}`);
+  lines.push("", truncate(rendered, WEBHOOK_PROMPT_MAX_CHARS));
+  return {
+    provider: WEBHOOK_TRIGGER_PROVIDER,
+    occurredAt,
+    dedupKey,
+    sourceTrust: "untrusted",
+    title: eventType,
+    body: lines.join("\n"),
+    // Keep the ledger row bounded: the full body when small, else a marker
+    // with the head of it. Never headers (the bearer token rides there).
+    raw: raw.length <= WEBHOOK_RAW_MAX_CHARS ? body : { truncated: true, bytes: raw.length, head: raw.slice(0, WEBHOOK_RAW_MAX_CHARS) },
+    meaningful: true
+  };
+}
+var webhookTriggerAdapter = {
+  provider: WEBHOOK_TRIGGER_PROVIDER,
+  kind: "webhook",
+  webhookAuth: "bearer",
+  webhookEvents: [],
+  multiInstance: true,
+  maxBodyBytes: WEBHOOK_MAX_BODY_BYTES,
+  validateConfig: validateWebhookConfig,
+  rateCapPerHour: (trigger) => webhookRateCap(trigger),
+  // Webhook-kind triggers are minted only on POST /agents/:id/triggers
+  // (agent.edit); /host/triggers refuses non-poll providers.
+  operatorInstruction: true,
+  ingest(req, trigger) {
+    return [buildWebhookEvent(req, trigger.config)];
+  }
+};
+registerTriggerSource(webhookTriggerAdapter);
+
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
   {
@@ -44986,7 +45163,7 @@ var FLAG_REGISTRY = [
   },
   {
     key: "ninja-lists",
-    description: 'Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Lists" nav item, the /lists pages AND the /ninja-lists API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
+    description: 'Apps, formerly Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Apps" nav item, the /apps pages AND the /ninja-lists API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
     flagType: "boolean",
     // PUBLIC (ADR-0022 §2): the nav shells read it via usePublicBooleanFlag and
     // the pages via getPublicBooleanFlagServer, so it is serialized to the

package/dist/mcp/slack-channel.js

@@ -19182,7 +19182,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str2, str2.replace(/^\s*|\s*$/g, ""));
     }
     _exports.trim = trim;
-    function truncate(input, length, killwords, end) {
+    function truncate2(input, length, killwords, end) {
       var orig = input;
       input = normalize(input, "");
       length = length || 255;
@@ -19201,7 +19201,7 @@ var require_filters = __commonJS({
       input += end !== void 0 && end !== null ? end : "...";
       return r.copySafeness(orig, input);
     }
-    _exports.truncate = truncate;
+    _exports.truncate = truncate2;
     function upper(str2) {
       str2 = normalize(str2, "");
       return str2.toUpperCase();
@@ -38052,6 +38052,183 @@ var videoRenderTriggerAdapter = {
 };
 registerTriggerSource(videoRenderTriggerAdapter);
 
+// ../core/dist/triggers/adapters/webhook.js
+var WEBHOOK_TRIGGER_PROVIDER = "webhook";
+var WEBHOOK_MAX_BODY_BYTES = 1280 * 1024;
+var WEBHOOK_PROMPT_MAX_CHARS = 8e3;
+var WEBHOOK_RAW_MAX_CHARS = 64 * 1024;
+var WEBHOOK_INSTRUCTION_MAX_CHARS = 2e3;
+var WEBHOOK_NAME_MAX_CHARS = 80;
+var WEBHOOK_DEFAULT_RATE_CAP = 60;
+var WEBHOOK_MAX_RATE_CAP = 1e3;
+var WEBHOOK_PRESETS = {
+  // https://docs.aws.amazon.com/eventbridge/latest/ref/overiew-event-structure.html
+  eventbridge: {
+    dedupPath: "id",
+    eventTypePaths: ["source", "detail-type"],
+    payloadPath: "detail",
+    timePath: "time"
+  },
+  // Raw-body hash dedup, whole body as payload. Set dedup_path when the
+  // sender has a stable id, or two identical bodies collapse into one.
+  generic: {}
+};
+var PATH_RE = /^[A-Za-z0-9_$-]+(\.[A-Za-z0-9_$-]+){0,9}$/;
+function readPath(value, path) {
+  let cur = value;
+  for (const key2 of path.split(".")) {
+    if (cur === null || typeof cur !== "object" || Array.isArray(cur))
+      return void 0;
+    if (!Object.prototype.hasOwnProperty.call(cur, key2))
+      return void 0;
+    cur = cur[key2];
+  }
+  return cur;
+}
+function scalarString(v) {
+  if (typeof v === "string")
+    return v.length > 0 ? v : null;
+  if (typeof v === "number" && Number.isFinite(v))
+    return String(v);
+  return null;
+}
+function truncate(text, max) {
+  if (text.length <= max)
+    return text;
+  return `${text.slice(0, max)}
+... [truncated ${text.length - max} more characters]`;
+}
+function resolvePreset(config2) {
+  const name = config2["preset"];
+  const base = typeof name === "string" && name in WEBHOOK_PRESETS ? WEBHOOK_PRESETS[name] : WEBHOOK_PRESETS.generic;
+  const dedup = config2["dedup_path"];
+  const type = config2["event_type_path"];
+  const payload = config2["payload_path"];
+  return {
+    ...base,
+    ...typeof dedup === "string" && dedup ? { dedupPath: dedup } : {},
+    ...typeof type === "string" && type ? { eventTypePaths: [type] } : {},
+    ...typeof payload === "string" && payload ? { payloadPath: payload } : {}
+  };
+}
+function validateWebhookConfig(input) {
+  const out = {};
+  const name = input["name"];
+  if (name !== void 0) {
+    if (typeof name !== "string")
+      return { ok: false, error: "name must be a string" };
+    const trimmed = name.trim();
+    if (trimmed.length > WEBHOOK_NAME_MAX_CHARS) {
+      return { ok: false, error: `name must be at most ${WEBHOOK_NAME_MAX_CHARS} characters` };
+    }
+    if (trimmed)
+      out["name"] = trimmed;
+  }
+  const instruction = input["instruction"];
+  if (typeof instruction !== "string" || !instruction.trim()) {
+    return {
+      ok: false,
+      error: "instruction is required: tell the agent what to do when an event arrives"
+    };
+  }
+  if (instruction.trim().length > WEBHOOK_INSTRUCTION_MAX_CHARS) {
+    return {
+      ok: false,
+      error: `instruction must be at most ${WEBHOOK_INSTRUCTION_MAX_CHARS} characters`
+    };
+  }
+  out["instruction"] = instruction.trim();
+  const preset = input["preset"] ?? "generic";
+  if (typeof preset !== "string" || !(preset in WEBHOOK_PRESETS)) {
+    return {
+      ok: false,
+      error: `preset must be one of: ${Object.keys(WEBHOOK_PRESETS).join(", ")}`
+    };
+  }
+  out["preset"] = preset;
+  for (const key2 of ["dedup_path", "event_type_path", "payload_path"]) {
+    const v = input[key2];
+    if (v === void 0 || v === null || v === "")
+      continue;
+    if (typeof v !== "string" || !PATH_RE.test(v)) {
+      return { ok: false, error: `${key2} must be a dot path like "detail.id"` };
+    }
+    out[key2] = v;
+  }
+  const cap = input["max_events_per_hour"];
+  if (cap !== void 0 && cap !== null) {
+    if (typeof cap !== "number" || !Number.isInteger(cap) || cap < 1 || cap > WEBHOOK_MAX_RATE_CAP) {
+      return {
+        ok: false,
+        error: `max_events_per_hour must be an integer from 1 to ${WEBHOOK_MAX_RATE_CAP}`
+      };
+    }
+    out["max_events_per_hour"] = cap;
+  } else {
+    out["max_events_per_hour"] = WEBHOOK_DEFAULT_RATE_CAP;
+  }
+  return { ok: true, config: out };
+}
+function webhookRateCap(trigger) {
+  const cap = trigger.config["max_events_per_hour"];
+  if (typeof cap === "number" && Number.isInteger(cap) && cap >= 1) {
+    return Math.min(cap, WEBHOOK_MAX_RATE_CAP);
+  }
+  return WEBHOOK_DEFAULT_RATE_CAP;
+}
+function buildWebhookEvent(req, config2, now = /* @__PURE__ */ new Date()) {
+  const preset = resolvePreset(config2);
+  const body = req.body;
+  const raw = req.rawBody ?? JSON.stringify(body ?? null);
+  const idValue = preset.dedupPath ? scalarString(readPath(body, preset.dedupPath)) : null;
+  const dedupKey = idValue ? `wh:id:${stableHash(idValue)}` : `wh:raw:${stableHash(raw)}`;
+  const typeParts = (preset.eventTypePaths ?? []).map((p2) => scalarString(readPath(body, p2))).filter((v) => v !== null).map((v) => v.slice(0, 200));
+  const eventType = typeParts.length > 0 ? typeParts.join(" / ") : "webhook event";
+  const timeValue = preset.timePath ? scalarString(readPath(body, preset.timePath)) : null;
+  const timeMs = timeValue ? Date.parse(timeValue) : NaN;
+  const occurredAt = Number.isFinite(timeMs) ? new Date(timeMs).toISOString() : now.toISOString();
+  let payload = body;
+  if (preset.payloadPath) {
+    const sub = readPath(body, preset.payloadPath);
+    if (sub !== void 0)
+      payload = sub;
+  }
+  const rendered = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) ?? "null";
+  const lines = [`Event: ${eventType}`];
+  if (idValue)
+    lines.push(`Event id: ${idValue.slice(0, 200)}`);
+  lines.push("", truncate(rendered, WEBHOOK_PROMPT_MAX_CHARS));
+  return {
+    provider: WEBHOOK_TRIGGER_PROVIDER,
+    occurredAt,
+    dedupKey,
+    sourceTrust: "untrusted",
+    title: eventType,
+    body: lines.join("\n"),
+    // Keep the ledger row bounded: the full body when small, else a marker
+    // with the head of it. Never headers (the bearer token rides there).
+    raw: raw.length <= WEBHOOK_RAW_MAX_CHARS ? body : { truncated: true, bytes: raw.length, head: raw.slice(0, WEBHOOK_RAW_MAX_CHARS) },
+    meaningful: true
+  };
+}
+var webhookTriggerAdapter = {
+  provider: WEBHOOK_TRIGGER_PROVIDER,
+  kind: "webhook",
+  webhookAuth: "bearer",
+  webhookEvents: [],
+  multiInstance: true,
+  maxBodyBytes: WEBHOOK_MAX_BODY_BYTES,
+  validateConfig: validateWebhookConfig,
+  rateCapPerHour: (trigger) => webhookRateCap(trigger),
+  // Webhook-kind triggers are minted only on POST /agents/:id/triggers
+  // (agent.edit); /host/triggers refuses non-poll providers.
+  operatorInstruction: true,
+  ingest(req, trigger) {
+    return [buildWebhookEvent(req, trigger.config)];
+  }
+};
+registerTriggerSource(webhookTriggerAdapter);
+
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
   {
@@ -39813,7 +39990,7 @@ var FLAG_REGISTRY = [
   },
   {
     key: "ninja-lists",
-    description: 'Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Lists" nav item, the /lists pages AND the /ninja-lists API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
+    description: 'Apps, formerly Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Apps" nav item, the /apps pages AND the /ninja-lists API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
     flagType: "boolean",
     // PUBLIC (ADR-0022 §2): the nav shells read it via usePublicBooleanFlag and
     // the pages via getPublicBooleanFlagServer, so it is serialized to the

package/dist/mcp/telegram-channel.js

@@ -19182,7 +19182,7 @@ var require_filters = __commonJS({
       return r.copySafeness(str, str.replace(/^\s*|\s*$/g, ""));
     }
     _exports.trim = trim;
-    function truncate(input, length, killwords, end) {
+    function truncate2(input, length, killwords, end) {
       var orig = input;
       input = normalize(input, "");
       length = length || 255;
@@ -19201,7 +19201,7 @@ var require_filters = __commonJS({
       input += end !== void 0 && end !== null ? end : "...";
       return r.copySafeness(orig, input);
     }
-    _exports.truncate = truncate;
+    _exports.truncate = truncate2;
     function upper(str) {
       str = normalize(str, "");
       return str.toUpperCase();
@@ -38263,6 +38263,183 @@ var videoRenderTriggerAdapter = {
 };
 registerTriggerSource(videoRenderTriggerAdapter);
 
+// ../core/dist/triggers/adapters/webhook.js
+var WEBHOOK_TRIGGER_PROVIDER = "webhook";
+var WEBHOOK_MAX_BODY_BYTES = 1280 * 1024;
+var WEBHOOK_PROMPT_MAX_CHARS = 8e3;
+var WEBHOOK_RAW_MAX_CHARS = 64 * 1024;
+var WEBHOOK_INSTRUCTION_MAX_CHARS = 2e3;
+var WEBHOOK_NAME_MAX_CHARS = 80;
+var WEBHOOK_DEFAULT_RATE_CAP = 60;
+var WEBHOOK_MAX_RATE_CAP = 1e3;
+var WEBHOOK_PRESETS = {
+  // https://docs.aws.amazon.com/eventbridge/latest/ref/overiew-event-structure.html
+  eventbridge: {
+    dedupPath: "id",
+    eventTypePaths: ["source", "detail-type"],
+    payloadPath: "detail",
+    timePath: "time"
+  },
+  // Raw-body hash dedup, whole body as payload. Set dedup_path when the
+  // sender has a stable id, or two identical bodies collapse into one.
+  generic: {}
+};
+var PATH_RE = /^[A-Za-z0-9_$-]+(\.[A-Za-z0-9_$-]+){0,9}$/;
+function readPath(value, path) {
+  let cur = value;
+  for (const key2 of path.split(".")) {
+    if (cur === null || typeof cur !== "object" || Array.isArray(cur))
+      return void 0;
+    if (!Object.prototype.hasOwnProperty.call(cur, key2))
+      return void 0;
+    cur = cur[key2];
+  }
+  return cur;
+}
+function scalarString(v) {
+  if (typeof v === "string")
+    return v.length > 0 ? v : null;
+  if (typeof v === "number" && Number.isFinite(v))
+    return String(v);
+  return null;
+}
+function truncate(text, max) {
+  if (text.length <= max)
+    return text;
+  return `${text.slice(0, max)}
+... [truncated ${text.length - max} more characters]`;
+}
+function resolvePreset(config2) {
+  const name = config2["preset"];
+  const base = typeof name === "string" && name in WEBHOOK_PRESETS ? WEBHOOK_PRESETS[name] : WEBHOOK_PRESETS.generic;
+  const dedup = config2["dedup_path"];
+  const type = config2["event_type_path"];
+  const payload = config2["payload_path"];
+  return {
+    ...base,
+    ...typeof dedup === "string" && dedup ? { dedupPath: dedup } : {},
+    ...typeof type === "string" && type ? { eventTypePaths: [type] } : {},
+    ...typeof payload === "string" && payload ? { payloadPath: payload } : {}
+  };
+}
+function validateWebhookConfig(input) {
+  const out = {};
+  const name = input["name"];
+  if (name !== void 0) {
+    if (typeof name !== "string")
+      return { ok: false, error: "name must be a string" };
+    const trimmed = name.trim();
+    if (trimmed.length > WEBHOOK_NAME_MAX_CHARS) {
+      return { ok: false, error: `name must be at most ${WEBHOOK_NAME_MAX_CHARS} characters` };
+    }
+    if (trimmed)
+      out["name"] = trimmed;
+  }
+  const instruction = input["instruction"];
+  if (typeof instruction !== "string" || !instruction.trim()) {
+    return {
+      ok: false,
+      error: "instruction is required: tell the agent what to do when an event arrives"
+    };
+  }
+  if (instruction.trim().length > WEBHOOK_INSTRUCTION_MAX_CHARS) {
+    return {
+      ok: false,
+      error: `instruction must be at most ${WEBHOOK_INSTRUCTION_MAX_CHARS} characters`
+    };
+  }
+  out["instruction"] = instruction.trim();
+  const preset = input["preset"] ?? "generic";
+  if (typeof preset !== "string" || !(preset in WEBHOOK_PRESETS)) {
+    return {
+      ok: false,
+      error: `preset must be one of: ${Object.keys(WEBHOOK_PRESETS).join(", ")}`
+    };
+  }
+  out["preset"] = preset;
+  for (const key2 of ["dedup_path", "event_type_path", "payload_path"]) {
+    const v = input[key2];
+    if (v === void 0 || v === null || v === "")
+      continue;
+    if (typeof v !== "string" || !PATH_RE.test(v)) {
+      return { ok: false, error: `${key2} must be a dot path like "detail.id"` };
+    }
+    out[key2] = v;
+  }
+  const cap = input["max_events_per_hour"];
+  if (cap !== void 0 && cap !== null) {
+    if (typeof cap !== "number" || !Number.isInteger(cap) || cap < 1 || cap > WEBHOOK_MAX_RATE_CAP) {
+      return {
+        ok: false,
+        error: `max_events_per_hour must be an integer from 1 to ${WEBHOOK_MAX_RATE_CAP}`
+      };
+    }
+    out["max_events_per_hour"] = cap;
+  } else {
+    out["max_events_per_hour"] = WEBHOOK_DEFAULT_RATE_CAP;
+  }
+  return { ok: true, config: out };
+}
+function webhookRateCap(trigger) {
+  const cap = trigger.config["max_events_per_hour"];
+  if (typeof cap === "number" && Number.isInteger(cap) && cap >= 1) {
+    return Math.min(cap, WEBHOOK_MAX_RATE_CAP);
+  }
+  return WEBHOOK_DEFAULT_RATE_CAP;
+}
+function buildWebhookEvent(req, config2, now = /* @__PURE__ */ new Date()) {
+  const preset = resolvePreset(config2);
+  const body = req.body;
+  const raw = req.rawBody ?? JSON.stringify(body ?? null);
+  const idValue = preset.dedupPath ? scalarString(readPath(body, preset.dedupPath)) : null;
+  const dedupKey = idValue ? `wh:id:${stableHash(idValue)}` : `wh:raw:${stableHash(raw)}`;
+  const typeParts = (preset.eventTypePaths ?? []).map((p2) => scalarString(readPath(body, p2))).filter((v) => v !== null).map((v) => v.slice(0, 200));
+  const eventType = typeParts.length > 0 ? typeParts.join(" / ") : "webhook event";
+  const timeValue = preset.timePath ? scalarString(readPath(body, preset.timePath)) : null;
+  const timeMs = timeValue ? Date.parse(timeValue) : NaN;
+  const occurredAt = Number.isFinite(timeMs) ? new Date(timeMs).toISOString() : now.toISOString();
+  let payload = body;
+  if (preset.payloadPath) {
+    const sub = readPath(body, preset.payloadPath);
+    if (sub !== void 0)
+      payload = sub;
+  }
+  const rendered = typeof payload === "string" ? payload : JSON.stringify(payload, null, 2) ?? "null";
+  const lines = [`Event: ${eventType}`];
+  if (idValue)
+    lines.push(`Event id: ${idValue.slice(0, 200)}`);
+  lines.push("", truncate(rendered, WEBHOOK_PROMPT_MAX_CHARS));
+  return {
+    provider: WEBHOOK_TRIGGER_PROVIDER,
+    occurredAt,
+    dedupKey,
+    sourceTrust: "untrusted",
+    title: eventType,
+    body: lines.join("\n"),
+    // Keep the ledger row bounded: the full body when small, else a marker
+    // with the head of it. Never headers (the bearer token rides there).
+    raw: raw.length <= WEBHOOK_RAW_MAX_CHARS ? body : { truncated: true, bytes: raw.length, head: raw.slice(0, WEBHOOK_RAW_MAX_CHARS) },
+    meaningful: true
+  };
+}
+var webhookTriggerAdapter = {
+  provider: WEBHOOK_TRIGGER_PROVIDER,
+  kind: "webhook",
+  webhookAuth: "bearer",
+  webhookEvents: [],
+  multiInstance: true,
+  maxBodyBytes: WEBHOOK_MAX_BODY_BYTES,
+  validateConfig: validateWebhookConfig,
+  rateCapPerHour: (trigger) => webhookRateCap(trigger),
+  // Webhook-kind triggers are minted only on POST /agents/:id/triggers
+  // (agent.edit); /host/triggers refuses non-poll providers.
+  operatorInstruction: true,
+  ingest(req, trigger) {
+    return [buildWebhookEvent(req, trigger.config)];
+  }
+};
+registerTriggerSource(webhookTriggerAdapter);
+
 // ../core/dist/feature-flags/registry.js
 var FLAG_REGISTRY = [
   {
@@ -40024,7 +40201,7 @@ var FLAG_REGISTRY = [
   },
   {
     key: "ninja-lists",
-    description: 'Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Lists" nav item, the /lists pages AND the /ninja-lists API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
+    description: 'Apps, formerly Ninja Lists (ADR-0120): small tables agents and people fill and review together. Gates the "Apps" nav item, the /apps pages AND the /ninja-lists API, per org. Unlike its siblings `projects-menu` / `ninjafy-notes-menu`, this is the whole feature\'s gate, not only its menu entry: the surface is unlaunched, so an org with the flag off gets 404 from the API rather than a hidden link to a working one.',
     flagType: "boolean",
     // PUBLIC (ADR-0022 §2): the nav shells read it via usePublicBooleanFlag and
     // the pages via getPublicBooleanFlagServer, so it is serialized to the

package/dist/{persistent-session-XCV7VQWS.js → persistent-session-KSV7RIQQ.js}

@@ -68,12 +68,12 @@ import {
   writeDirectChatSessionState,
   writeEgressAllowlist,
   writePersistentClaudeWrapper
-} from "./chunk-QRFACFSH.js";
-import "./chunk-CXEP3UC7.js";
+} from "./chunk-FGPPJKJ5.js";
+import "./chunk-ZDHCIJL6.js";
 import "./chunk-B6UYVEMD.js";
 import "./chunk-OAWK4OBN.js";
 import "./chunk-XWVM4KPK.js";
-import "./chunk-D55RMQTG.js";
+import "./chunk-TNPLCJIG.js";
 import "./chunk-EL5MWGGH.js";
 import "./chunk-DGUM43GV.js";
 export {
@@ -147,4 +147,4 @@ export {
   writeEgressAllowlist,
   writePersistentClaudeWrapper
 };
-//# sourceMappingURL=persistent-session-XCV7VQWS.js.map
+//# sourceMappingURL=persistent-session-KSV7RIQQ.js.map

package/dist/{responsiveness-probe-WZVS3U5H.js → responsiveness-probe-XVYYSQQN.js}

@@ -1,11 +1,11 @@
 import {
   paneLogPath
-} from "./chunk-QRFACFSH.js";
-import "./chunk-CXEP3UC7.js";
+} from "./chunk-FGPPJKJ5.js";
+import "./chunk-ZDHCIJL6.js";
 import "./chunk-B6UYVEMD.js";
 import "./chunk-OAWK4OBN.js";
 import "./chunk-XWVM4KPK.js";
-import "./chunk-D55RMQTG.js";
+import "./chunk-TNPLCJIG.js";
 import "./chunk-EL5MWGGH.js";
 import "./chunk-DGUM43GV.js";
 
@@ -804,4 +804,4 @@ export {
   readAndResetSlackReplyBindingClassifications,
   readAndResetSlackReplyTargetClassifications
 };
-//# sourceMappingURL=responsiveness-probe-WZVS3U5H.js.map
+//# sourceMappingURL=responsiveness-probe-XVYYSQQN.js.map