@stage-labs/metro 0.1.0-beta.13 → 0.1.0-beta.15

package/dist/cli/tail.js

@@ -1,128 +1,64 @@
-/** CLI subcommands: `metro tail` (claim-aware log subscriber) + `metro claim|release|claims`. */
-import { existsSync, watch } from 'node:fs';
-import { CLAIMS_FILE, HISTORY_FILE, claimLine, cursorKey, historySize, passesMode, readClaims, readCursor, readEntriesFrom, releaseLine, writeCursor, } from '../broker.js';
+/** CLI: `metro tail / claim / release / claims`. HTTP monitor endpoints live in monitor-api.ts. */
+import { existsSync } from 'node:fs';
+import { CLAIMS_FILE, claimLine, readClaims, releaseLine } from '../broker/claims.js';
+import { cursorKey, drainTail, followTail, historySize, readCursor, writeCursor, } from '../broker/history-stream.js';
 import { userSelf } from '../history.js';
-import { asLine } from '../stations/index.js';
+import { asLine } from '../lines.js';
 import { loadMetroEnv } from '../paths.js';
+import { pickMode } from './monitor-api.js';
 import { emit, exitErr, flagOne, isJson, need, writeJson } from './util.js';
-function resolveMode(f, self) {
-    const strict = f.strict === true, unclaimed = f.unclaimed === true, all = f.all === true;
-    if ([strict, unclaimed, all].filter(Boolean).length > 1) {
-        throw exitErr('--strict, --unclaimed, --all are mutually exclusive', 1);
-    }
-    if (strict) {
-        if (!self)
-            throw exitErr('--strict requires --as <user-uri>', 1);
-        return 'mine-only';
-    }
-    if (unclaimed)
-        return 'unclaimed';
-    if (all || !self)
-        return 'all';
-    return 'mine-or-unclaimed';
-}
-/** Generic fallback returned by `userSelf()` when there's no Claude/Codex env — treat as "no identity". */
-const GENERIC_USER = 'metro://user';
-function resolveSelf(f) {
-    const raw = flagOne(f, 'as');
-    if (raw !== undefined)
-        return asLine(raw);
-    const auto = userSelf();
-    return auto === GENERIC_USER ? null : auto;
-}
-function resolveStartOffset(f, key) {
-    const since = flagOne(f, 'since');
-    if (since === 'tail')
-        return historySize();
-    if (since !== undefined) {
-        const n = Number(since);
-        if (!Number.isFinite(n) || n < 0)
-            throw exitErr(`--since must be a byte offset or 'tail' (got '${since}')`, 1);
-        return n;
-    }
-    return key ? readCursor(key) : 0;
-}
+export { handleMonitorRequest } from './monitor-api.js';
 export async function cmdTail(_, f) {
     loadMetroEnv();
-    const self = resolveSelf(f);
-    const mode = resolveMode(f, self);
+    const raw = flagOne(f, 'as');
+    const auto = userSelf();
+    const self = raw !== undefined ? asLine(raw) : auto === 'metro://user' ? null : auto;
+    const mode = pickMode(f.strict === true, f.unclaimed === true, f.all === true, self, msg => { throw exitErr(`--${msg}`, 1); });
+    const excludeFromFlag = flagOne(f, 'exclude-from');
+    const tail = {
+        mode, self, chatFilter: flagOne(f, 'chat'), stationFilter: flagOne(f, 'station'),
+        includeWebhooks: f['include-webhooks'] === true,
+        excludeFrom: excludeFromFlag
+            ? excludeFromFlag.split(',').map(s => s.trim()).filter(Boolean)
+            : undefined,
+    };
     const follow = f.follow === true;
-    const chatFilter = flagOne(f, 'chat');
-    const stationFilter = flagOne(f, 'station');
     const limit = Number(flagOne(f, 'limit')) || 0;
     const json = isJson(f);
-    const includeWebhooks = f['include-webhooks'] === true;
-    /** Cursor key derives from the effective mode (not userSelf), so `--all` / `--unclaimed` */
-    /** don't trample the personal `--as=<me>` cursor in a CLAUDECODE shell. */
-    const key = cursorKey(mode, self, { includeWebhooks });
-    const startOffset = resolveStartOffset(f, key);
+    /** Cursor key derives from effective mode (not userSelf), so --all/--unclaimed don't trample --as. */
+    const key = cursorKey(mode, self, { includeWebhooks: tail.includeWebhooks });
+    const since = flagOne(f, 'since');
+    const sN = since !== undefined && since !== 'tail' ? Number(since) : NaN;
+    if (since !== undefined && since !== 'tail' && (!Number.isFinite(sN) || sN < 0)) {
+        throw exitErr(`--since must be a byte offset or 'tail' (got '${since}')`, 1);
+    }
+    let offset = since === 'tail' ? historySize() : Number.isFinite(sN) ? sN : key ? readCursor(key) : 0;
     let emitted = 0;
-    let offset = startOffset;
-    const drain = () => {
-        /** read claims once per drain so a burst of events shares a snapshot */
-        const claims = readClaims();
-        for (const { entry, offset: next } of readEntriesFrom(offset)) {
-            offset = next;
-            if (chatFilter && entry.line !== chatFilter)
-                continue;
-            if (stationFilter && entry.station !== stationFilter)
-                continue;
-            if (!passesMode(entry, mode, self, claims, { includeWebhooks }))
-                continue;
-            if (json)
-                process.stdout.write(JSON.stringify(entry) + '\n');
-            else
-                process.stdout.write(fmtRow(entry) + '\n');
-            if (key)
-                writeCursor(key, offset);
-            emitted++;
-            if (limit && emitted >= limit)
-                return true;
-        }
-        return false;
+    const onEntry = (entry) => {
+        process.stdout.write((json ? JSON.stringify(entry) : fmtRow(entry)) + '\n');
+        if (key)
+            writeCursor(key, offset);
+        if (limit && ++emitted >= limit)
+            return true;
     };
-    if (drain() && !follow)
+    offset = drainTail(offset, tail, onEntry);
+    if ((limit && emitted >= limit) || !follow)
         return;
-    if (!follow)
-        return;
-    /** fs.watch on macOS sometimes coalesces or drops events — poll every 500ms as a backstop. */
     await new Promise(resolve => {
-        let watcher = null;
-        const trigger = () => { if (drain())
-            cleanup(); };
-        const cleanup = () => {
-            if (watcher) {
-                try {
-                    watcher.close();
-                }
-                catch { /* ignore */ }
-                watcher = null;
-            }
-            clearInterval(poll);
-            resolve();
-        };
-        const poll = setInterval(trigger, 500);
-        const startWatcher = () => {
-            if (!existsSync(HISTORY_FILE))
-                return;
-            try {
-                watcher = watch(HISTORY_FILE, () => trigger());
-            }
-            catch { /* ignore — poll will catch */ }
-        };
-        startWatcher();
-        process.on('SIGINT', cleanup);
-        process.on('SIGTERM', cleanup);
-        process.stdin.on('end', cleanup).on('close', cleanup);
+        const stop = followTail(offset, tail, e => { if (onEntry(e) === true)
+            finish(); }, 500);
+        const finish = () => { stop(); resolve(); };
+        process.on('SIGINT', finish);
+        process.on('SIGTERM', finish);
+        process.stdin.on('end', finish).on('close', finish);
     });
 }
 function fmtRow(e) {
-    const ts = e.ts.slice(11, 19);
-    const body = e.text ?? (e.emoji ? `[react ${e.emoji}]` : '');
+    const body = e.text ?? '';
     const text = body.length > 80 ? body.slice(0, 79) + '…' : body;
     const who = (e.fromName ?? e.from).padEnd(28).slice(0, 28);
     const where = e.line.padEnd(40).slice(0, 40);
-    return `${ts}  ${e.id.padEnd(12)}  ${e.kind.padEnd(8)}  ${who}  ${where}  ${text}`;
+    return `${e.ts.slice(11, 19)}  ${e.id.padEnd(12)}  ${who}  ${where}  ${text}`;
 }
 export async function cmdClaim(p, f) {
     loadMetroEnv();
@@ -138,11 +74,7 @@ export async function cmdRelease(p, f) {
     need(p, 1, 'metro release <line>');
     const line = asLine(p[0]);
     const { released, claims } = releaseLine(line);
-    if (!released) {
-        emit(f, `${line} was not claimed`, { ok: true, released: false, line, claims });
-        return;
-    }
-    emit(f, `released ${line}`, { ok: true, released: true, line, claims });
+    emit(f, released ? `released ${line}` : `${line} was not claimed`, { ok: true, released, line, claims });
 }
 export async function cmdClaims(_, f) {
     loadMetroEnv();
@@ -151,14 +83,13 @@ export async function cmdClaims(_, f) {
     if (isJson(f))
         return writeJson({ claims });
     if (!entries.length) {
-        process.stdout.write('(no claims — every tail with matching filters receives every event)\n');
-        process.stdout.write(`file: ${CLAIMS_FILE}${existsSync(CLAIMS_FILE) ? '' : ' (not created yet)'}\n`);
+        process.stdout.write('(no claims — every tail with matching filters receives every event)\n'
+            + `file: ${CLAIMS_FILE}${existsSync(CLAIMS_FILE) ? '' : ' (not created yet)'}\n`);
         return;
     }
-    const widest = Math.max(...entries.map(([l]) => l.length));
+    const w = Math.max(...entries.map(([l]) => l.length));
     process.stdout.write('metro claims\n\n');
-    for (const [line, owner] of entries) {
-        process.stdout.write(`  ${line.padEnd(widest)}  →  ${owner}\n`);
-    }
+    for (const [l, o] of entries)
+        process.stdout.write(`  ${l.padEnd(w)}  →  ${o}\n`);
     process.stdout.write(`\n${entries.length} claim${entries.length === 1 ? '' : 's'} · ${CLAIMS_FILE}\n`);
 }

package/dist/cli/webhook.js

@@ -1,7 +1,13 @@
-/** CLI subcommands: `metro webhook add|list|remove` + `metro tunnel setup`. */
+/** CLI subcommands: `metro call`, `metro trains list`, `metro webhook ...`, `metro tunnel ...`. */
+import { copyFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
-import { addEndpoint, listEndpoints, removeEndpoint, webhookPort } from '../webhooks.js';
-import { loadTunnelConfig, saveTunnelConfig } from '../tunnel.js';
+import { ipcCall } from '../ipc.js';
+import { loadMetroEnv } from '../paths.js';
+import { TRAINS_DIR } from '../trains/supervisor.js';
+import { addEndpoint, listEndpoints, loadTunnelConfig, removeEndpoint, saveTunnelConfig, webhookPort, } from '../tunnel.js';
 import { emit, exitErr, flagOne, isJson, need, writeJson } from './util.js';
 function urlFor(endpointId) {
     const t = loadTunnelConfig();
@@ -79,3 +85,97 @@ function run(cmd, args, opts = {}) {
     if (r.status !== 0 && !opts.allowFail)
         throw exitErr(`${cmd} ${args.join(' ')} exited ${r.status}`, 2);
 }
+/* ──────────── metro call <train> <action> [args]  +  metro trains list ──────────── */
+async function readArgs(raw) {
+    if (raw === undefined)
+        return {};
+    if (raw === '-') {
+        const chunks = [];
+        for await (const c of process.stdin)
+            chunks.push(c);
+        const s = Buffer.concat(chunks).toString('utf8').trim();
+        return s ? JSON.parse(s) : {};
+    }
+    if (raw.startsWith('@'))
+        return JSON.parse(readFileSync(raw.slice(1), 'utf8'));
+    /** Bare string allowed (handed to the train as-is). */
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+export async function cmdCall(p, f) {
+    need(p, 2, 'metro call <train> <action> [args-json | @file | -]');
+    loadMetroEnv();
+    const [train, action, rawArgs] = p;
+    const resp = await ipcCall({ op: 'forward-call', train, action, args: await readArgs(rawArgs) });
+    if (!resp.ok)
+        throw new Error(resp.error);
+    if (!('response' in resp))
+        throw new Error('daemon returned malformed forward-call response');
+    if (resp.response.error)
+        throw new Error(`train '${train}': ${resp.response.error}`);
+    if (isJson(f))
+        writeJson(resp.response.result ?? null);
+    else
+        process.stdout.write(JSON.stringify(resp.response.result ?? null) + '\n');
+}
+export async function cmdTrains(p, f) {
+    const sub = p[0] ?? 'list';
+    if (sub === 'restart')
+        return cmdTrainsRestart(p.slice(1), f);
+    if (sub === 'new')
+        return cmdTrainsNew(p.slice(1), f);
+    if (sub !== 'list')
+        throw new Error(`metro trains <list|restart|new>   (got '${sub}')`);
+    loadMetroEnv();
+    const resp = await ipcCall({ op: 'trains-list' });
+    if (!resp.ok)
+        throw new Error(resp.error);
+    if (!('trains' in resp))
+        throw new Error('daemon returned malformed trains-list response');
+    if (isJson(f))
+        return writeJson({ trains: resp.trains });
+    if (!resp.trains.length) {
+        process.stdout.write('metro trains\n\n  (no trains in ~/.metro/trains/)\n');
+        return;
+    }
+    process.stdout.write('metro trains\n\n');
+    for (const t of resp.trains) {
+        const mark = t.running ? '●' : '○';
+        const pid = t.pid ? ` pid ${t.pid}` : '';
+        const started = t.startedAt ? ` since ${t.startedAt.slice(11, 19)}` : '';
+        const fails = t.failCount ? ` · ${t.failCount} fail${t.failCount === 1 ? '' : 's'}` : '';
+        process.stdout.write(`  ${mark} ${t.name.padEnd(16)}${pid}${started}${fails}\n        ${t.path}\n`);
+    }
+    process.stdout.write('\n');
+}
+async function cmdTrainsRestart(p, f) {
+    need(p, 1, 'metro trains restart <name>');
+    loadMetroEnv();
+    const resp = await ipcCall({ op: 'train-restart', name: p[0] });
+    if (!resp.ok)
+        throw new Error(resp.error);
+    emit(f, `restarted train '${p[0]}'`, { ok: true, name: p[0] });
+}
+/** dist/cli/webhook.js → <package-root>/examples/telegram.ts */
+const bundledExample = () => join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'examples', 'telegram.ts');
+async function cmdTrainsNew(p, f) {
+    need(p, 1, 'metro trains new <name>');
+    const name = p[0];
+    if (!/^[A-Za-z0-9_-]+$/.test(name))
+        throw exitErr(`bad train name '${name}' (use [A-Za-z0-9_-])`, 1);
+    const src = bundledExample();
+    if (!existsSync(src))
+        throw exitErr(`bundled example missing at ${src} (broken install?)`, 2);
+    mkdirSync(TRAINS_DIR, { recursive: true });
+    const dest = join(TRAINS_DIR, `${name}.ts`);
+    if (existsSync(dest))
+        throw exitErr(`train already exists: ${dest}`, 1);
+    copyFileSync(src, dest);
+    const metroPkg = join(homedir(), '.metro', 'package.json');
+    const pkgHint = existsSync(metroPkg) ? '' : '\n  (run `cd ~/.metro && bun init` first if your train needs deps)';
+    emit(f, `created ${dest}${pkgHint}\n  next: edit the file, then \`metro trains restart ${name}\``, { ok: true, path: dest, pkgInitialized: existsSync(metroPkg) });
+}

package/dist/{codex-rc.js → codex-rc/client.js}

@@ -1,30 +1,10 @@
-/**
- * JSON-RPC/WS client for codex app-server: each event → `turn/start` (Codex's Monitor equivalent).
- */
-import { createConnection } from 'node:net';
-import { WebSocket } from 'ws';
-import { errMsg, log } from './log.js';
+/** JSON-RPC/WS client for codex app-server: each event → `turn/start`. */
+import { errMsg, log } from '../log.js';
+import { buildTurnInput, encodeRpc, extractThreadStartedId, isStatusActive, openSocket, parseUrl, } from './protocol.js';
 const RECONNECT_DELAY_MS = 2_000;
 const MAX_QUEUE = 100;
 /** Backstop in case `turn/completed` never arrives — unstick the single-flight gate. */
 const TURN_TIMEOUT_MS = 120_000;
-/** Accept ws://, wss://, unix:///abs/path, or /abs/path (shorthand for unix). */
-function parseUrl(input) {
-    if (input.startsWith('ws://') || input.startsWith('wss://'))
-        return { kind: 'tcp', url: input };
-    if (input.startsWith('unix://'))
-        return { kind: 'unix', path: input.replace(/^unix:\/+/, '/') };
-    if (input.startsWith('/'))
-        return { kind: 'unix', path: input };
-    throw new Error(`unsupported METRO_CODEX_RC: ${input} (expected ws://, wss://, unix://, or abs path)`);
-}
-function openSocket(endpoint) {
-    if (endpoint.kind === 'tcp')
-        return new WebSocket(endpoint.url);
-    return new WebSocket('ws://localhost/', {
-        createConnection: () => createConnection({ path: endpoint.path }),
-    });
-}
 export class CodexRC {
     url;
     clientVersion;
@@ -115,9 +95,12 @@ export class CodexRC {
                 p.resolve(msg.result);
             return;
         }
+        this.handleNotification(msg);
+    }
+    handleNotification(msg) {
         switch (msg.method) {
             case 'thread/started': {
-                const id = msg.params?.thread?.id;
+                const id = extractThreadStartedId(msg.params);
                 if (id) {
                     this.setThreadId(id);
                     log.info({ thread: id }, 'codex-rc thread started');
@@ -126,12 +109,10 @@ export class CodexRC {
                 break;
             }
             case 'thread/status/changed': {
-                /* Codex 0.130+: status `{active}` means in-flight; anything else is idle. */
-                const p = msg.params;
-                if (p?.threadId !== this.threadId)
+                const s = isStatusActive(msg.params, this.threadId);
+                if (!s.match)
                     break;
-                const active = typeof p.status === 'object' && p.status !== null && 'active' in p.status;
-                if (active)
+                if (s.active)
                     this.turnInFlight = true;
                 else {
                     this.clearTurnTimeout();
@@ -203,8 +184,7 @@ export class CodexRC {
         this.turnInFlight = true;
         this.armTurnTimeout();
         try {
-            const input = [{ type: 'text', text: line, textElements: [] }];
-            await this.call('turn/start', { threadId: this.threadId, input });
+            await this.call('turn/start', { threadId: this.threadId, input: buildTurnInput(line) });
             this.queue.shift();
         }
         catch (err) {
@@ -239,7 +219,7 @@ export class CodexRC {
         const ws = this.ws;
         return new Promise((resolve, reject) => {
             this.pending.set(id, { resolve: resolve, reject });
-            ws.send(JSON.stringify({ jsonrpc: '2.0', id, method, params }));
+            ws.send(encodeRpc(id, method, params));
         });
     }
 }

package/dist/codex-rc/protocol.js

@@ -0,0 +1,38 @@
+/** Codex JSON-RPC over WS: endpoint parsing, socket open, message encode/decode. */
+import { createConnection } from 'node:net';
+import { WebSocket } from 'ws';
+/** Accept ws://, wss://, unix:///abs/path, or /abs/path (shorthand for unix). */
+export function parseUrl(input) {
+    if (input.startsWith('ws://') || input.startsWith('wss://'))
+        return { kind: 'tcp', url: input };
+    if (input.startsWith('unix://'))
+        return { kind: 'unix', path: input.replace(/^unix:\/+/, '/') };
+    if (input.startsWith('/'))
+        return { kind: 'unix', path: input };
+    throw new Error(`unsupported METRO_CODEX_RC: ${input} (expected ws://, wss://, unix://, or abs path)`);
+}
+export function openSocket(endpoint) {
+    if (endpoint.kind === 'tcp')
+        return new WebSocket(endpoint.url);
+    return new WebSocket('ws://localhost/', {
+        createConnection: () => createConnection({ path: endpoint.path }),
+    });
+}
+export function encodeRpc(id, method, params) {
+    return JSON.stringify({ jsonrpc: '2.0', id, method, params });
+}
+/** Extract the active-thread state from a `thread/status/changed` params payload. */
+/** Codex 0.130+: `status: {active}` ⇒ in-flight; any other shape ⇒ idle. */
+export function isStatusActive(params, expectedThreadId) {
+    const p = params;
+    if (p?.threadId !== expectedThreadId)
+        return { match: false, active: false };
+    const active = typeof p.status === 'object' && p.status !== null && 'active' in p.status;
+    return { match: true, active };
+}
+export function extractThreadStartedId(params) {
+    return params?.thread?.id;
+}
+export function buildTurnInput(line) {
+    return [{ type: 'text', text: line, textElements: [] }];
+}

package/dist/dispatcher/server.js

@@ -0,0 +1,122 @@
+/** Dispatcher's plumbing: outbound event emission + train-envelope translation + HTTP receiver. */
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { createServer, } from 'node:http';
+import { Line } from '../lines.js';
+import { errMsg, log } from '../log.js';
+import { noteSeen } from '../paths.js';
+import { appendHistory, formatDisplay, mintId, noteUserFromLine, userSelf, } from '../history.js';
+import { handleMonitorRequest } from '../cli/tail.js';
+import { findEndpoint, listEndpoints, webhookPort } from '../tunnel.js';
+export function makeEmit(codexRc) {
+    return function emit(entry) {
+        /** `display` first so it survives Monitor's body truncation — the user must see it to echo it. */
+        const enriched = { display: formatDisplay(entry), ...entry };
+        const json = JSON.stringify(enriched);
+        process.stdout.write(json + '\n');
+        codexRc?.push(json);
+        noteSeen(entry.line, entry.lineName);
+        for (const l of [entry.line, entry.from, entry.to])
+            if (l)
+                noteUserFromLine(l);
+        appendHistory(enriched);
+    };
+}
+/** Translate the snake_case train wire envelope to a camelCase `HistoryEntry`. */
+/** Trains can omit `id`/`station`/`to`; metro fills sensible defaults. */
+export function trainEventToHistoryEntry(env, trainName) {
+    const line = env.line;
+    if (typeof line !== 'string') {
+        log.warn({ train: trainName }, 'train: dropped event without `line`');
+        return null;
+    }
+    const station = env.station ?? Line.station(line) ?? trainName;
+    const isPrivate = env.is_private === true;
+    /** Trains may still emit `emoji` for reactions — fold it into text so the new envelope stays minimal. */
+    const text = env.text ?? (env.emoji ? `[react ${env.emoji}]` : undefined);
+    return {
+        id: env.id ?? mintId(),
+        ts: env.ts ?? new Date().toISOString(),
+        station,
+        line: line,
+        lineName: env.line_name,
+        from: (env.from ?? `metro://${station}`),
+        fromName: env.from_name,
+        to: (env.to ?? (isPrivate ? userSelf() : line)),
+        text,
+        messageId: env.message_id,
+        replyTo: env.reply_to,
+        payload: env.payload,
+    };
+}
+export async function startWebhookServer(emit) {
+    const port = webhookPort();
+    const server = createServer((req, res) => {
+        handleRequest(req, res, emit).catch(err => {
+            log.warn({ err: errMsg(err) }, 'webhook handler error');
+            if (!res.headersSent)
+                res.writeHead(500).end();
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(port, '127.0.0.1', () => {
+            log.info({ port, endpoints: listEndpoints().length }, 'webhook + monitor ready');
+            resolve();
+        });
+    });
+    return server;
+}
+async function handleRequest(req, res, emit) {
+    if (handleMonitorRequest(req, res, emit))
+        return;
+    const m = req.url?.match(/^\/wh\/([A-Za-z0-9_-]+)/);
+    if (!m) {
+        res.writeHead(404).end();
+        return;
+    }
+    const endpointId = m[1];
+    const endpoint = findEndpoint(endpointId);
+    if (!endpoint) {
+        res.writeHead(404).end();
+        return;
+    }
+    if (req.method === 'GET') {
+        res.writeHead(200).end(`metro webhook ${endpointId} ready\n`);
+        return;
+    }
+    if (req.method !== 'POST') {
+        res.writeHead(405).end();
+        return;
+    }
+    const chunks = [];
+    for await (const c of req)
+        chunks.push(c);
+    const raw = Buffer.concat(chunks);
+    const headers = Object.fromEntries(Object.entries(req.headers).map(([k, v]) => [k, Array.isArray(v) ? v.join(',') : v ?? '']));
+    if (endpoint.secret && !verifySig(endpoint.secret, raw, headers['x-hub-signature-256'])) {
+        log.warn({ endpoint: endpointId }, 'webhook signature mismatch — rejecting');
+        res.writeHead(401).end('signature mismatch');
+        return;
+    }
+    let body = raw.toString('utf8');
+    try {
+        body = JSON.parse(body);
+    }
+    catch { /* keep as string */ }
+    const line = Line.webhook(endpointId);
+    emit({
+        id: mintId(), ts: new Date().toISOString(), station: 'webhook',
+        line, lineName: endpoint.label, from: line, to: line,
+        messageId: headers['x-github-delivery'] || headers['x-request-id'] || randomUUID(),
+        text: `${headers['x-github-event'] ?? headers['x-intercom-topic'] ?? 'event'} ${req.method} ${req.url}`,
+        payload: { headers, body },
+    });
+    res.writeHead(200).end('ok');
+}
+function verifySig(secret, raw, header) {
+    if (!header?.startsWith('sha256='))
+        return false;
+    const given = Buffer.from(header.slice(7), 'hex');
+    const want = createHmac('sha256', secret).update(raw).digest();
+    return given.length === want.length && timingSafeEqual(given, want);
+}