@prettier-ai/dsh-webhook-github 0.1.2-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/webhook/webhook-github/README.md
+README.md: ce0e2da0aa355166ba940b9a991f6ee5c7fa1f9c
+README.zh.md: c5ad924ec2040281d12c5890e5679413a07a4c81

package/README.md

@@ -0,0 +1,86 @@
+---
+description: "Signed GitHub webhook adapter for deployments routing authenticated JSON events into the webhook runtime."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-webhook-github
+
+English | [中文](README.zh.md)
+
+## Summary
+
+`dsh-webhook-github` registers one exact HTTP route on the injected `ctx.webServer`. It bounds and verifies GitHub's raw JSON body, projects a provider-neutral delivery, calls `ctx.webhookRuntime.dispatch()`, and returns `202` without waiting for rules or Sessions. Use it when a deployment needs authenticated GitHub ingress for the generic webhook runtime.
+
+## Table of Contents
+
+- [Configuration](#configuration)
+- [HTTP contract](#http-contract)
+- [Dedicated listener composition](#dedicated-listener-composition)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="configuration"></a>
+## Configuration
+
+| Key | Meaning |
+|---|---|
+| `source` | Non-empty adapter instance carried to rules, such as `primary-github`. |
+| `path` | Exact non-root pathname without trailing slash, query, or fragment. |
+| `secretEnv` | Credential reference containing the GitHub webhook secret. |
+| `maxBodyBytes` | Positive safe-integer ceiling for the untouched request body. |
+
+All fields are required. The secret reference is resolved for every request, so rotation affects the next delivery without reloading the plugin.
+
+<a id="http-contract"></a>
+## HTTP contract
+
+Only `POST application/json` is accepted. The adapter reads a bounded UTF-8 body, requires `X-Hub-Signature-256`, `X-GitHub-Delivery`, and `X-GitHub-Event`, resolves the secret, verifies HMAC before JSON parsing, and requires a top-level lossless-JSON object. It never logs the secret, signature, or payload.
+
+| Status | Meaning |
+|---|---|
+| `202` | Verified JSON was dispatched in memory. |
+| `400` | Required header, UTF-8, JSON, or top-level object was invalid. |
+| `401` | Signature was invalid. |
+| `405` | Method was not `POST`. |
+| `413` | Declared or streamed body exceeded `maxBodyBytes`. |
+| `415` | Media type was not `application/json`. |
+| `503` | Credential or webhook runtime was unavailable. |
+
+`202` does not state that any rule matched or that a Session was created. GitHub event-specific field validation belongs to each rule; the adapter guarantees only authenticated generic JSON.
+
+<a id="dedicated-listener-composition"></a>
+## Dedicated listener composition
+
+The normal Web profile already owns `ctx.webServer`. Mount another `dsh-host-webserver` and this adapter inside a group that isolates only `webServer`; the adapter still inherits credentials and `webhookRuntime`. The [GitHub review guide](../../../docs/user/guide/github-review.md) uses `127.0.0.1:3081/github` behind a TLS reverse proxy while the UI remains on port 3080.
+
+<a id="model-experience"></a>
+## Model Experience
+
+Indirectly, through `dsh-webhook`: this adapter contributes no prompt or tool schema; a matching rule owns the Session request and model-visible text.
+
+#### KV Cache effect
+
+Independent. Authentication and HTTP dispatch do not touch a model request; any new Session prefix belongs to the consuming rule and runtime.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **No TLS** — the injected development WebServer is normally loopback-only behind a TLS reverse proxy or tunnel.
+- **Generic payload validation only** — rules own validation of the GitHub event fields they consume.
+- **No provider acknowledgement of downstream work** — `202` precedes arbitrary rule calls and Session creation.
+- **No form encoding** — GitHub must send `application/json`; `application/x-www-form-urlencoded` is rejected.
+
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+None.
+
+</details>

package/README.zh.md

@@ -0,0 +1,86 @@
+---
+description: "面向把已认证 JSON 事件路由到 webhook 运行时的部署，说明带签名的 GitHub webhook 适配器。"
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-webhook-github
+
+[English](README.md) | 中文
+
+## 概述
+
+`dsh-webhook-github` 会在注入的 `ctx.webServer` 上注册一条精确 HTTP 路由。它限制并验证 GitHub 原始 JSON body，投影提供方无关的交付，调用 `ctx.webhookRuntime.dispatch()`，并在不等待规则或 Session 的情况下返回 `202`。部署需要为通用 webhook runtime 提供经过身份验证的 GitHub 入口时，请使用它。
+
+## 目录
+
+- [配置](#configuration)
+- [HTTP 约定](#http-contract)
+- [专用监听器组合](#dedicated-listener-composition)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="configuration"></a>
+## 配置
+
+| Key | 含义 |
+|---|---|
+| `source` | 携带给规则的非空适配器实例，例如 `primary-github`。 |
+| `path` | 不带尾随斜杠、查询或片段的精确非根路径。 |
+| `secretEnv` | 包含 GitHub webhook 密钥的凭据引用。 |
+| `maxBodyBytes` | 未改动请求 body 的正安全整数上限。 |
+
+所有字段均为必填。每次请求都会重新解析密钥引用，因此轮换会在下一次交付生效，而无需重新加载插件。
+
+<a id="http-contract"></a>
+## HTTP 约定
+
+只接受 `POST application/json`。适配器读取有界 UTF-8 body，要求 `X-Hub-Signature-256`、`X-GitHub-Delivery` 与 `X-GitHub-Event`，解析密钥，在 JSON 解析前验证 HMAC，并要求顶层是无损 JSON 对象。它绝不记录密钥、签名或 payload。
+
+| 状态 | 含义 |
+|---|---|
+| `202` | 已验证 JSON 已在内存中分发。 |
+| `400` | 必需 header、UTF-8、JSON 或顶层对象无效。 |
+| `401` | 签名无效。 |
+| `405` | 方法不是 `POST`。 |
+| `413` | 声明或流式 body 超过 `maxBodyBytes`。 |
+| `415` | media type 不是 `application/json`。 |
+| `503` | 凭据或 webhook runtime 不可用。 |
+
+`202` 不表示任何规则已经匹配，也不表示已创建 Session。GitHub 事件特定字段的验证属于各规则；适配器只保证通过身份验证的通用 JSON。
+
+<a id="dedicated-listener-composition"></a>
+## 专用监听器组合
+
+普通 Web profile 已经拥有 `ctx.webServer`。把另一个 `dsh-host-webserver` 和此适配器挂载到仅隔离 `webServer` 的 group 内；适配器仍会继承凭据与 `webhookRuntime`。[GitHub 评审指南](../../../docs/user/guide/github-review.zh.md)在 TLS 反向代理后使用 `127.0.0.1:3081/github`，而 UI 继续位于端口 3080。
+
+<a id="model-experience"></a>
+## Model Experience
+
+通过 `dsh-webhook` 间接产生影响：此适配器不贡献提示词或工具 schema；匹配规则拥有 Session 请求与模型可见文本。
+
+#### KV Cache effect
+
+相互独立。身份验证与 HTTP 分发不触碰模型请求；任何新 Session 前缀都属于消费它的规则与 runtime。
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- **无 TLS** — 注入的开发 WebServer 通常只监听 loopback，并位于 TLS 反向代理或 tunnel 后。
+- **仅通用 payload 验证** — 规则负责验证自己消费的 GitHub 事件字段。
+- **不向提供方确认下游工作** — `202` 先于任意规则调用与 Session 创建。
+- **不支持表单编码** — GitHub 必须发送 `application/json`；`application/x-www-form-urlencoded` 会被拒绝。
+
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者工作上下文——点击展开</summary>
+
+无。
+
+</details>

package/lib/index.js

@@ -0,0 +1,193 @@
+import { credentialRef } from "@prettier-ai/dsh-credentials";
+import z from "@prettier-ai/schemastery";
+import { Webhooks } from "@octokit/webhooks";
+import { snapshotJsonValue } from "@prettier-ai/dsh-session";
+import { WebhookDeliveryId, WebhookSourceId } from "@prettier-ai/dsh-webhook";
+//#region lib/types/body.js
+/** Bounded raw HTTP body intake for GitHub signature verification. */
+/** HTTP refusal whose message is safe to return without request data. */
+var WebhookHttpError = class extends Error {
+	status;
+	name = "WebhookHttpError";
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+/** Parse a decimal Content-Length or reject an ambiguous header. */
+function contentLength(request) {
+	const value = request.headers["content-length"];
+	if (value === void 0) return void 0;
+	if (!/^(0|[1-9]\d*)$/.test(value)) throw new WebhookHttpError(400, "invalid Content-Length");
+	const length = Number(value);
+	if (!Number.isSafeInteger(length)) throw new WebhookHttpError(413, "request body is too large");
+	return length;
+}
+/**
+* Read one request body as exact, bounded UTF-8 text.
+* @param request - incoming request before any parser consumes it.
+* @param maxBodyBytes - positive byte ceiling.
+* @returns the decoded body after EOF.
+* @throws {WebhookHttpError} for invalid length, excessive bytes, invalid UTF-8, or an aborted stream.
+*/
+async function readBoundedUtf8Body(request, maxBodyBytes) {
+	const declared = contentLength(request);
+	if (declared !== void 0 && declared > maxBodyBytes) {
+		request.resume();
+		throw new WebhookHttpError(413, "request body is too large");
+	}
+	const chunks = [];
+	let size = 0;
+	try {
+		for await (const raw of request) {
+			const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+			size += chunk.byteLength;
+			if (size > maxBodyBytes) {
+				request.resume();
+				throw new WebhookHttpError(413, "request body is too large");
+			}
+			chunks.push(chunk);
+		}
+	} catch (error) {
+		if (error instanceof WebhookHttpError) throw error;
+		throw new WebhookHttpError(400, "request body was aborted");
+	}
+	if (!request.complete) throw new WebhookHttpError(400, "request body was aborted");
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks, size));
+	} catch {
+		throw new WebhookHttpError(400, "request body is not valid UTF-8");
+	}
+}
+//#endregion
+//#region lib/types/handler.js
+/** GitHub HTTP authentication, parsing, and fire-and-forget dispatch. */
+/** Require one unambiguous non-empty request header. */
+function requiredHeader(request, name) {
+	const values = request.headersDistinct[name];
+	const value = values?.[0];
+	if (values?.length !== 1 || value === void 0 || value.trim() === "") throw new WebhookHttpError(400, `missing ${name} header`);
+	return value;
+}
+/** Whether Content-Type names JSON with at most one UTF-8 charset parameter. */
+function isJsonContentType(value) {
+	if (value === void 0) return false;
+	const [mediaType, parameter, ...extra] = value.split(";").map((part) => part.trim());
+	if (mediaType?.toLowerCase() !== "application/json") return false;
+	if (parameter === void 0) return true;
+	return extra.length === 0 && /^charset=(?:utf-8|"utf-8")$/i.test(parameter);
+}
+/** Send one empty or plain-text response exactly once. */
+function respond(response, status, message) {
+	if (message === void 0) {
+		response.writeHead(status);
+		response.end();
+		return;
+	}
+	response.writeHead(status, { "content-type": "text/plain; charset=utf-8" });
+	response.end(message);
+}
+/** Convert a parsed value into the adapter's generic signed-object guarantee. */
+function parsePayload(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		throw new WebhookHttpError(400, "request body is not valid JSON");
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new WebhookHttpError(400, "GitHub webhook payload must be a JSON object");
+	const snapshot = snapshotJsonValue(parsed);
+	if (snapshot === void 0) throw new WebhookHttpError(400, "GitHub webhook payload is not lossless JSON");
+	return snapshot;
+}
+/**
+* Create one exact-route GitHub handler.
+* @param ctx - adapter context carrying credentials and webhook runtime.
+* @param config - validated source, credential reference, and body ceiling.
+* @returns an HTTP handler that answers after in-memory dispatch, never rule settlement.
+*/
+function createGitHubWebhookHandler(ctx, config) {
+	return async (request, response) => {
+		try {
+			if (request.method !== "POST") {
+				response.setHeader("allow", "POST");
+				throw new WebhookHttpError(405, "method not allowed");
+			}
+			if (!isJsonContentType(request.headers["content-type"])) throw new WebhookHttpError(415, "content type must be application/json");
+			const body = await readBoundedUtf8Body(request, config.maxBodyBytes);
+			const signature = requiredHeader(request, "x-hub-signature-256");
+			const deliveryId = requiredHeader(request, "x-github-delivery");
+			const eventName = requiredHeader(request, "x-github-event");
+			const credential = await ctx.credentials.resolve(config.secretEnv);
+			if (credential === void 0 || credential.value === "") throw new WebhookHttpError(503, "GitHub webhook secret is unavailable");
+			let verified = false;
+			try {
+				verified = await new Webhooks({ secret: credential.value }).verify(body, signature);
+			} catch {}
+			if (!verified) throw new WebhookHttpError(401, "invalid webhook signature");
+			const payload = parsePayload(body);
+			const delivery = {
+				kind: "github",
+				source: WebhookSourceId(config.source),
+				deliveryId: WebhookDeliveryId(deliveryId),
+				event: {
+					name: eventName,
+					payload
+				},
+				receivedAt: Date.now()
+			};
+			try {
+				ctx.webhookRuntime.dispatch(delivery);
+			} catch {
+				ctx.logger.warn("webhook-github: dispatch unavailable");
+				throw new WebhookHttpError(503, "webhook runtime is unavailable");
+			}
+			respond(response, 202);
+		} catch (error) {
+			if (error instanceof WebhookHttpError) {
+				respond(response, error.status, error.message);
+				return;
+			}
+			ctx.logger.warn("webhook-github: request failed");
+			respond(response, 503, "webhook ingress is unavailable");
+		}
+	};
+}
+//#endregion
+//#region lib/types/index.js
+/** Signed GitHub HTTP adapter for the provider-neutral webhook runtime. */
+/** Cordis function-plugin name. */
+const name = "webhook-github";
+/** Host services required before the exact route can register. */
+const inject = [
+	"webServer",
+	"webhookRuntime",
+	"credentials"
+];
+const Config = z.object({
+	source: z.string().required(),
+	path: z.string().required(),
+	secretEnv: z.string().role("credential-ref").required(),
+	maxBodyBytes: z.number().step(1).min(1).max(Number.MAX_SAFE_INTEGER).required()
+});
+/** Validate route and source facts that Schemastery cannot express. */
+function assertConfig(config) {
+	if (config.source.trim() !== config.source || config.source === "") throw new Error("webhook-github source must be a non-empty trimmed string");
+	if (!config.path.startsWith("/") || config.path === "/" || config.path.endsWith("/") || config.path.includes("?") || config.path.includes("#")) throw new Error("webhook-github path must be an absolute non-root pathname without a trailing slash, query, or fragment");
+}
+/** Register one signed GitHub endpoint on the injected WebServer. */
+function apply(ctx, config) {
+	assertConfig(config);
+	const route = {
+		kind: "exact",
+		path: config.path,
+		handler: createGitHubWebhookHandler(ctx, {
+			source: config.source,
+			secretEnv: credentialRef(config.secretEnv),
+			maxBodyBytes: config.maxBodyBytes
+		})
+	};
+	ctx.effect(() => ctx.webServer.register(route), `webhook-github: ${config.path}`);
+}
+//#endregion
+export { Config, apply, inject, name };

package/lib/invariant.js

@@ -0,0 +1,20 @@
+//#region lib/types/invariant.js
+/** Package-owned invariant companion for the GitHub webhook adapter. */
+const PACKAGE_NAME = "@prettier-ai/dsh-webhook-github";
+/** Cordis invariant-companion plugin name. */
+const name = "webhook-github-invariant";
+/** Registry required before reserving this package's invariant ownership. */
+const inject = ["invariants"];
+/**
+* No runtime invariant: authentication and input validation occur at the exact
+* HTTP operation; dsh-host-webserver owns route/disposer symmetry.
+*/
+const install = () => {};
+/**
+* Register this package's explained empty invariant.
+* @param ctx - Cordis context carrying the invariant registry.
+* @returns the invariant registration disposer.
+*/
+const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//#endregion
+export { apply, inject, name };

package/lib/types/body.d.ts

@@ -0,0 +1,17 @@
+/** Bounded raw HTTP body intake for GitHub signature verification. */
+import type { IncomingMessage } from 'node:http';
+/** HTTP refusal whose message is safe to return without request data. */
+export declare class WebhookHttpError extends Error {
+    readonly status: 400 | 401 | 405 | 413 | 415 | 503;
+    readonly name = "WebhookHttpError";
+    constructor(status: 400 | 401 | 405 | 413 | 415 | 503, message: string);
+}
+/**
+ * Read one request body as exact, bounded UTF-8 text.
+ * @param request - incoming request before any parser consumes it.
+ * @param maxBodyBytes - positive byte ceiling.
+ * @returns the decoded body after EOF.
+ * @throws {WebhookHttpError} for invalid length, excessive bytes, invalid UTF-8, or an aborted stream.
+ */
+export declare function readBoundedUtf8Body(request: IncomingMessage, maxBodyBytes: number): Promise<string>;
+//# sourceMappingURL=body.d.ts.map

package/lib/types/body.js

@@ -0,0 +1,65 @@
+/** Bounded raw HTTP body intake for GitHub signature verification. */
+/** HTTP refusal whose message is safe to return without request data. */
+export class WebhookHttpError extends Error {
+    status;
+    name = 'WebhookHttpError';
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/** Parse a decimal Content-Length or reject an ambiguous header. */
+function contentLength(request) {
+    const value = request.headers['content-length'];
+    if (value === undefined)
+        return undefined;
+    if (!/^(0|[1-9]\d*)$/.test(value)) {
+        throw new WebhookHttpError(400, 'invalid Content-Length');
+    }
+    const length = Number(value);
+    if (!Number.isSafeInteger(length))
+        throw new WebhookHttpError(413, 'request body is too large');
+    return length;
+}
+/**
+ * Read one request body as exact, bounded UTF-8 text.
+ * @param request - incoming request before any parser consumes it.
+ * @param maxBodyBytes - positive byte ceiling.
+ * @returns the decoded body after EOF.
+ * @throws {WebhookHttpError} for invalid length, excessive bytes, invalid UTF-8, or an aborted stream.
+ */
+export async function readBoundedUtf8Body(request, maxBodyBytes) {
+    const declared = contentLength(request);
+    if (declared !== undefined && declared > maxBodyBytes) {
+        request.resume();
+        throw new WebhookHttpError(413, 'request body is too large');
+    }
+    const chunks = [];
+    let size = 0;
+    try {
+        for await (const raw of request) {
+            const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+            size += chunk.byteLength;
+            if (size > maxBodyBytes) {
+                request.resume();
+                throw new WebhookHttpError(413, 'request body is too large');
+            }
+            chunks.push(chunk);
+        }
+    }
+    catch (error) {
+        if (error instanceof WebhookHttpError)
+            throw error;
+        throw new WebhookHttpError(400, 'request body was aborted');
+    }
+    if (!request.complete)
+        throw new WebhookHttpError(400, 'request body was aborted');
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks, size));
+    }
+    catch {
+        // TextDecoder is the only statement in the try; GitHub JSON must be valid UTF-8.
+        throw new WebhookHttpError(400, 'request body is not valid UTF-8');
+    }
+}
+//# sourceMappingURL=body.js.map

package/lib/types/handler.d.ts

@@ -0,0 +1,18 @@
+/** GitHub HTTP authentication, parsing, and fire-and-forget dispatch. */
+import type { Context } from '@prettier-ai/cordis';
+import type { CredentialRef } from '@prettier-ai/dsh-credentials';
+import type { WebRoute } from '@prettier-ai/dsh-host-webserver';
+/** Handler values validated once at plugin load. */
+export interface GitHubWebhookHandlerConfig {
+    readonly source: string;
+    readonly secretEnv: CredentialRef;
+    readonly maxBodyBytes: number;
+}
+/**
+ * Create one exact-route GitHub handler.
+ * @param ctx - adapter context carrying credentials and webhook runtime.
+ * @param config - validated source, credential reference, and body ceiling.
+ * @returns an HTTP handler that answers after in-memory dispatch, never rule settlement.
+ */
+export declare function createGitHubWebhookHandler(ctx: Context, config: GitHubWebhookHandlerConfig): WebRoute['handler'];
+//# sourceMappingURL=handler.d.ts.map

package/lib/types/handler.js

@@ -0,0 +1,115 @@
+/** GitHub HTTP authentication, parsing, and fire-and-forget dispatch. */
+import { Webhooks } from '@octokit/webhooks';
+import { snapshotJsonValue } from '@prettier-ai/dsh-session';
+import { WebhookDeliveryId, WebhookSourceId, } from '@prettier-ai/dsh-webhook';
+import { readBoundedUtf8Body, WebhookHttpError } from "./body.js";
+/** Require one unambiguous non-empty request header. */
+function requiredHeader(request, name) {
+    const values = request.headersDistinct[name];
+    const value = values?.[0];
+    if (values?.length !== 1 || value === undefined || value.trim() === '') {
+        throw new WebhookHttpError(400, `missing ${name} header`);
+    }
+    return value;
+}
+/** Whether Content-Type names JSON with at most one UTF-8 charset parameter. */
+function isJsonContentType(value) {
+    if (value === undefined)
+        return false;
+    const parts = value.split(';').map(part => part.trim());
+    const [mediaType, parameter, ...extra] = parts;
+    if (mediaType?.toLowerCase() !== 'application/json')
+        return false;
+    if (parameter === undefined)
+        return true;
+    return extra.length === 0 && /^charset=(?:utf-8|"utf-8")$/i.test(parameter);
+}
+/** Send one empty or plain-text response exactly once. */
+function respond(response, status, message) {
+    if (message === undefined) {
+        response.writeHead(status);
+        response.end();
+        return;
+    }
+    response.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });
+    response.end(message);
+}
+/** Convert a parsed value into the adapter's generic signed-object guarantee. */
+function parsePayload(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        // JSON.parse is the only statement in the try; no other failure is normalized.
+        throw new WebhookHttpError(400, 'request body is not valid JSON');
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new WebhookHttpError(400, 'GitHub webhook payload must be a JSON object');
+    }
+    const snapshot = snapshotJsonValue(parsed);
+    if (snapshot === undefined)
+        throw new WebhookHttpError(400, 'GitHub webhook payload is not lossless JSON');
+    return snapshot;
+}
+/**
+ * Create one exact-route GitHub handler.
+ * @param ctx - adapter context carrying credentials and webhook runtime.
+ * @param config - validated source, credential reference, and body ceiling.
+ * @returns an HTTP handler that answers after in-memory dispatch, never rule settlement.
+ */
+export function createGitHubWebhookHandler(ctx, config) {
+    return async (request, response) => {
+        try {
+            if (request.method !== 'POST') {
+                response.setHeader('allow', 'POST');
+                throw new WebhookHttpError(405, 'method not allowed');
+            }
+            if (!isJsonContentType(request.headers['content-type'])) {
+                throw new WebhookHttpError(415, 'content type must be application/json');
+            }
+            const body = await readBoundedUtf8Body(request, config.maxBodyBytes);
+            const signature = requiredHeader(request, 'x-hub-signature-256');
+            const deliveryId = requiredHeader(request, 'x-github-delivery');
+            const eventName = requiredHeader(request, 'x-github-event');
+            const credential = await ctx.credentials.resolve(config.secretEnv);
+            if (credential === undefined || credential.value === '') {
+                throw new WebhookHttpError(503, 'GitHub webhook secret is unavailable');
+            }
+            let verified = false;
+            try {
+                verified = await new Webhooks({ secret: credential.value }).verify(body, signature);
+            }
+            catch {
+                // Octokit verification errors carry no response detail safe or useful to the sender.
+            }
+            if (!verified)
+                throw new WebhookHttpError(401, 'invalid webhook signature');
+            const payload = parsePayload(body);
+            const delivery = {
+                kind: 'github',
+                source: WebhookSourceId(config.source),
+                deliveryId: WebhookDeliveryId(deliveryId),
+                event: { name: eventName, payload },
+                receivedAt: Date.now(),
+            };
+            try {
+                ctx.webhookRuntime.dispatch(delivery);
+            }
+            catch {
+                ctx.logger.warn('webhook-github: dispatch unavailable');
+                throw new WebhookHttpError(503, 'webhook runtime is unavailable');
+            }
+            respond(response, 202);
+        }
+        catch (error) {
+            if (error instanceof WebhookHttpError) {
+                respond(response, error.status, error.message);
+                return;
+            }
+            ctx.logger.warn('webhook-github: request failed');
+            respond(response, 503, 'webhook ingress is unavailable');
+        }
+    };
+}
+//# sourceMappingURL=handler.js.map

package/lib/types/index.d.ts

@@ -0,0 +1,23 @@
+/** Signed GitHub HTTP adapter for the provider-neutral webhook runtime. */
+import type { Context } from '@prettier-ai/cordis';
+import z from '@prettier-ai/schemastery';
+export type * from './types.ts';
+/** Cordis function-plugin name. */
+export declare const name = "webhook-github";
+/** Host services required before the exact route can register. */
+export declare const inject: string[];
+/** Required GitHub ingress configuration. */
+export interface Config {
+    /** Adapter instance name carried to rules. */
+    readonly source: string;
+    /** Exact absolute route path. */
+    readonly path: string;
+    /** Credential reference containing the shared webhook secret. */
+    readonly secretEnv: string;
+    /** Positive raw body ceiling in bytes. */
+    readonly maxBodyBytes: number;
+}
+export declare const Config: z<Config>;
+/** Register one signed GitHub endpoint on the injected WebServer. */
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/index.js

@@ -0,0 +1,39 @@
+/** Signed GitHub HTTP adapter for the provider-neutral webhook runtime. */
+import { credentialRef } from '@prettier-ai/dsh-credentials';
+import z from '@prettier-ai/schemastery';
+import { createGitHubWebhookHandler } from "./handler.js";
+/** Cordis function-plugin name. */
+export const name = 'webhook-github';
+/** Host services required before the exact route can register. */
+export const inject = ['webServer', 'webhookRuntime', 'credentials'];
+export const Config = z.object({
+    source: z.string().required(),
+    path: z.string().required(),
+    secretEnv: z.string().role('credential-ref').required(),
+    maxBodyBytes: z.number().step(1).min(1).max(Number.MAX_SAFE_INTEGER).required(),
+});
+/** Validate route and source facts that Schemastery cannot express. */
+function assertConfig(config) {
+    if (config.source.trim() !== config.source || config.source === '') {
+        throw new Error('webhook-github source must be a non-empty trimmed string');
+    }
+    if (!config.path.startsWith('/') || config.path === '/' || config.path.endsWith('/')
+        || config.path.includes('?') || config.path.includes('#')) {
+        throw new Error('webhook-github path must be an absolute non-root pathname without a trailing slash, query, or fragment');
+    }
+}
+/** Register one signed GitHub endpoint on the injected WebServer. */
+export function apply(ctx, config) {
+    assertConfig(config);
+    const route = {
+        kind: 'exact',
+        path: config.path,
+        handler: createGitHubWebhookHandler(ctx, {
+            source: config.source,
+            secretEnv: credentialRef(config.secretEnv),
+            maxBodyBytes: config.maxBodyBytes,
+        }),
+    };
+    ctx.effect(() => ctx.webServer.register(route), `webhook-github: ${config.path}`);
+}
+//# sourceMappingURL=index.js.map

package/lib/types/invariant.d.ts

@@ -0,0 +1,13 @@
+/** Package-owned invariant companion for the GitHub webhook adapter. */
+import type { Context } from '@prettier-ai/cordis';
+/** Cordis invariant-companion plugin name. */
+export declare const name = "webhook-github-invariant";
+/** Registry required before reserving this package's invariant ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's explained empty invariant.
+ * @param ctx - Cordis context carrying the invariant registry.
+ * @returns the invariant registration disposer.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -0,0 +1,18 @@
+/** Package-owned invariant companion for the GitHub webhook adapter. */
+const PACKAGE_NAME = '@prettier-ai/dsh-webhook-github';
+/** Cordis invariant-companion plugin name. */
+export const name = 'webhook-github-invariant';
+/** Registry required before reserving this package's invariant ownership. */
+export const inject = ['invariants'];
+/**
+ * No runtime invariant: authentication and input validation occur at the exact
+ * HTTP operation; dsh-host-webserver owns route/disposer symmetry.
+ */
+const install = () => { };
+/**
+ * Register this package's explained empty invariant.
+ * @param ctx - Cordis context carrying the invariant registry.
+ * @returns the invariant registration disposer.
+ */
+export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//# sourceMappingURL=invariant.js.map

package/lib/types/types.d.ts

@@ -0,0 +1,20 @@
+/** GitHub event values projected after signature verification. */
+import type { JsonValue } from '@prettier-ai/dsh-session';
+/** Signed GitHub JSON object. Event-specific field validation belongs to each rule. */
+export type GitHubJsonObject = {
+    readonly [key: string]: JsonValue;
+};
+/** Provider event supplied to `WebhookRule<'github'>`. */
+export interface GitHubWebhookEvent {
+    /** Raw `X-GitHub-Event` name such as `pull_request`. */
+    readonly name: string;
+    /** Signed JSON object exactly as parsed from the request body. */
+    readonly payload: GitHubJsonObject;
+}
+declare module '@prettier-ai/dsh-webhook' {
+    interface WebhookEventMap {
+        github: GitHubWebhookEvent;
+    }
+}
+export type { EmitterWebhookEvent, EmitterWebhookEventName } from '@octokit/webhooks';
+//# sourceMappingURL=types.d.ts.map

package/lib/types/types.js

@@ -0,0 +1,3 @@
+/** GitHub event values projected after signature verification. */
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@prettier-ai/dsh-webhook-github",
+  "description": "Signed GitHub HTTP webhook adapter for the DeepSeek Harness webhook runtime",
+  "version": "0.1.2-alpha.1",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/webhook/webhook-github"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types/types.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@prettier-ai/cordis": "^4.0.1",
+    "@prettier-ai/dsh-host-webserver": "^0.1.2-alpha.1",
+    "@prettier-ai/dsh-session": "^0.1.2-alpha.1",
+    "@prettier-ai/dsh-webhook": "^0.1.2-alpha.1",
+    "@prettier-ai/dsh-credentials": "^0.1.2-alpha.1",
+    "@prettier-ai/dsh-invariants": "^0.1.2-alpha.1"
+  },
+  "dependencies": {
+    "@octokit/webhooks": "^14.2.0",
+    "@prettier-ai/schemastery": "^3.18.1"
+  },
+  "devDependencies": {
+    "@prettier-ai/cordis": "^4.0.1",
+    "@prettier-ai/cordis-plugin-include": "^1.0.6",
+    "@prettier-ai/cordis-plugin-loader": "^1.0.2",
+    "@prettier-ai/dsh-credentials": "^0.1.2-alpha.1",
+    "@prettier-ai/dsh-host-webserver": "^0.1.2-alpha.1",
+    "@prettier-ai/dsh-invariants": "^0.1.2-alpha.1",
+    "@prettier-ai/dsh-session": "^0.1.2-alpha.1",
+    "@prettier-ai/dsh-webhook": "^0.1.2-alpha.1"
+  }
+}