Hook endpoint for your own agent in Node.js

// verify.js
import { Buffer } from 'node:buffer';
import { createHmac, timingSafeEqual } from 'node:crypto';

const SECRET = process.env.CKEDITOR_AI_HOOK_SECRET; // whsec_...
const TOLERANCE_SECONDS = 300;

export function verify( headers, rawBody ) {
	const id = headers[ 'webhook-id' ];
	const timestamp = headers[ 'webhook-timestamp' ];
	const header = headers[ 'webhook-signature' ];

	if ( !id || !timestamp || !header ) {
		return false;
	}

	if ( Math.abs( Date.now() / 1000 - Number( timestamp ) ) > TOLERANCE_SECONDS ) {
		return false;
	}

	const key = Buffer.from( SECRET.slice( 'whsec_'.length ), 'base64' );
	const expected = createHmac( 'sha256', key )
		.update( `${ id }.${ timestamp }.` )
		.update( rawBody, 'utf8' )
		.digest( 'base64' );

	return header.split( ' ' ).some( entry => equals( entry.split( ',' )[ 1 ] ?? '', expected ) );
}

function equals( a, b ) {
	return a.length === b.length && timingSafeEqual( Buffer.from( a ), Buffer.from( b ) );
}

import express from 'express';
import { verify } from './verify.js'; // the signature check from Dependencies

// Stand-in for your agent: a keyword map instead of a model, so every path is easy to hit from a test.
function classify( prompt ) {
	if ( /independence check/i.test( prompt ) ) {
		return { kind: 'start-workflow', workflow: 'independence check' };
	}
	if ( /findings/i.test( prompt ) ) {
		return { kind: 'enrich' };
	}
	return { kind: 'pass-through' };
}

// Stand-in for the deal database. In production this is a query keyed on the engagement id.
const FINDINGS = `
## Deal review findings, engagement 4711

1. Revenue for FY2025 includes EUR 1.2m recognised before delivery. Risk: high.
2. Three supplier contracts have change-of-control clauses triggered by the transaction. Risk: medium.
3. Deferred tax asset of EUR 0.4m has no supporting recoverability analysis. Risk: medium.
`;

// Stand-in for your back office. In production this starts a real job and returns its id.
async function startWorkflow( workflow, who, conversationId ) {
	console.log( 'start', workflow, who, conversationId );

	return 'wf-2026-09-08-0001';
}

const app = express();

// Note the text parser: the signature covers the body exactly as it arrived.
app.post( '/ckeditor-ai/turn-start', express.text( { type: 'application/json', limit: '32mb' } ), async ( req, res ) => {
	if ( !verify( req.headers, req.body ) ) {
		res.sendStatus( 401 );
		return;
	}

	const { turn, conversationId } = JSON.parse( req.body );
	const who = turn.content.find( part => part.type === 'delegation-context' )?.data ?? {};

	// In production your agent reads the message and decides. Here it is the keyword map above.
	const intent = classify( turn.prompt );

	switch ( intent.kind ) {
		// Path 1: a back-office job. Start it and answer the chat ourselves.
		case 'start-workflow': {
			const workflowId = await startWorkflow( intent.workflow, who, conversationId );
			res.json( {
				directive: 'halt',
				reply: [ `Started the ${ intent.workflow }. I will post the result here when it is done.` ],
				attributes: { workflowId }
			} );
			break;
		}

		// Path 2: an edit that needs your data. Fetch it and brief the CKEditor AI agent.
		case 'enrich': {
			res.json( {
				directive: 'continue',
				reply: [ 'Found the deal review findings. Drafting the changes now.' ],
				forward: {
					context: [ FINDINGS ],
					instructions: [ 'Use only the findings provided. Do not invent figures.' ]
				},
				attributes: { engagementId: who.engagementId }
			} );
			break;
		}

		// Path 3: nothing to add. Hand the turn over as it is.
		default: {
			res.json( { directive: 'continue' } );
		}
	}
} );

app.listen( 3010 );

const HOST = process.env.CKEDITOR_AI_HOST;	// your on-premises CKEditor AI
const TOKEN = process.env.CKEDITOR_AI_TOKEN;  // the response body of <your-development-token-url>

async function post( path, body ) {
	const response = await fetch( `${ HOST }${ path }`, {
		method: 'POST',
		headers: { 'Authorization': `Bearer ${ TOKEN }`, 'Content-Type': 'application/json' },
		body: JSON.stringify( body )
	} );

	if ( !response.ok ) {
		throw new Error( `${ response.status } ${ await response.text() }` );
	}

	return response.json();
}

async function stream( path, body ) {
	const response = await fetch( `${ HOST }${ path }`, {
		method: 'POST',
		headers: { 'Authorization': `Bearer ${ TOKEN }`, 'Content-Type': 'application/json', 'Accept': 'text/event-stream' },
		body: JSON.stringify( body )
	} );

	if ( !response.ok ) {
		throw new Error( `${ response.status } ${ await response.text() }` );
	}

	const decoder = new TextDecoder();
	let buffer = '';

	for await ( const chunk of response.body ) {
		buffer += decoder.decode( chunk, { stream: true } );

		let end;
		while ( ( end = buffer.indexOf( '\n\n' ) ) >= 0 ) {
			const lines = buffer.slice( 0, end ).split( '\n' );
			buffer = buffer.slice( end + 2 );

			const event = lines.find( line => line.startsWith( 'event: ' ) )?.slice( 7 );
			const data = lines.find( line => line.startsWith( 'data: ' ) )?.slice( 6 );

			console.log( `event: ${ event }\ndata: ${ data }\n` );
		}
	}
}

await post( '/v1/conversations', { id: 'engagement-4711-report' } );

const { id: documentId } = await post( '/v1/conversations/engagement-4711-report/documents', {
	content: '<h1>Engagement 4711: financial due diligence</h1><h2>1. Scope</h2><p>The Company engaged us to review the financial position of the target ahead of the proposed acquisition.</p><h2>2. Approach</h2><p>We reviewed management accounts, the audited statements for FY2024 and FY2025, and the principal supplier contracts.</p><h2>3. Key findings</h2><p>To be completed.</p><h2>4. Next steps</h2><p>Findings will be discussed with management on the next call.</p>'
} );

await stream( '/v1/conversations/engagement-4711-report/messages', {
	prompt: 'Add the key findings from the deal review to section 3.',
	model: 'agent-1',
	content: [
		{ type: 'document', id: documentId },
		{ type: 'delegation-context', id: 'who', data: { engagementId: '4711' } }
	]
} );