curl -X POST https://api.devin.ai/v3/organizations/YOUR_ORG_ID/sessions \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Say hello — this is a test session."}'

const PLAYBOOKS = {
  'devin-autofix': 'playbook-a1b2c3d4e5f6',
  'devin-feature': 'playbook-f6e5d4c3b2a1',
};

app.post('/webhooks/tickets', async (req, res) => {
  if (!verifySignature(req)) return res.status(401).send('Bad signature');

  const { id, title, description, labels } = req.body;
  const label = labels.find(l => PLAYBOOKS[l]);
  if (!label) return res.status(200).send('No Devin label — skipped');

  const orgId = process.env.DEVIN_ORG_ID;
  const { session_id } = await fetch(
    `https://api.devin.ai/v3/organizations/${orgId}/sessions`, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.DEVIN_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      prompt: [
        `Ticket ${id}: ${title}`,
        description,
        `Reference ticket ${id} in your commit message.`,
        `When done, post a comment on ticket ${id} with a summary of your`,
        `changes and a link to the PR. Use the ticketing API at`,
        `https://your-ticketing-system.com/api/docs to post the comment.`,
        `Authenticate with the $TICKET_API_TOKEN environment variable.`,
      ].join('\n\n'),
      playbook_id: PLAYBOOKS[label],
      session_secrets: [
        { key: 'TICKET_API_TOKEN', value: process.env.TICKET_API_TOKEN },
      ],
    }),
  }).then(r => r.json());

  res.json({ session_id });
});