@abyss-project/probe 2.0.0 → 3.0.0

package/dist/types/tests/probe.dto.test.js

@@ -74,6 +74,21 @@ const _deliveryRecord = {
     createdAt: new Date(),
 };
 const _deliveryRecordAdHoc = { ..._deliveryRecord, webhookId: null };
+const _createSubscription = {
+    eventTypes: ['PROBE_SCAN_COMPLETED'],
+    url: 'https://example.com/hook',
+};
+const _updateSubscription = { isEnabled: false };
+const _subscriptionQuery = {
+    organizationId: 'o1',
+    isEnabled: true,
+    page: 1,
+    limit: 20,
+};
+const _deliveryQuery = { organizationId: 'o1', page: 2 };
+const _secret = created.data.secret;
+const _noSecret = read.data.secret;
+const _callbackCode = __1.Code.probeCallbackRequiresSubscription;
 const _usage = { used: 10, limit: 1000, remaining: 990 };
 const _usageUnlimited = { used: 10, limit: -1, remaining: -1 };
 const _asyncCost = (0, utils_1.estimateProbeScanCost)(5 * 1024 * 1024, __1.ProbeScanMode.ASYNC);
@@ -89,6 +104,13 @@ void _historyItem;
 void _scanSyncData;
 void _scanAsyncData;
 void _webhook;
+void _createSubscription;
+void _updateSubscription;
+void _subscriptionQuery;
+void _deliveryQuery;
+void _secret;
+void _noSecret;
+void _callbackCode;
 void _updateBody;
 void _updateBody2;
 void _deliveryPayload;

package/dist/types/tests/probe.dto.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"probe.dto.test.js","sourceRoot":"","sources":["../../../src/types/tests/probe.dto.test.ts"],"names":[],"mappings":";;AAQA,0BAaY;AAKZ,uCAAoD;AAMpD,MAAM,SAAS,GAAmC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClF,MAAM,MAAM,GAAgC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxE,MAAM,SAAS,GAAkC;IAC/C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;CACZ,CAAC;AAIF,MAAM,WAAW,GAAqB;IACpC,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,mBAAe,CAAC,IAAI;IAC5B,OAAO,EAAE,oBAAgB,CAAC,KAAK;IAC/B,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,iBAAiB;IAC3B,IAAI,EAAE,iBAAa,CAAC,IAAI;IACxB,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,UAAU,EAAE,IAAI,IAAI,EAAE;IACtB,SAAS,EAAE,CAAC;CACb,CAAC;AAGF,MAAM,YAAY,GAA0B;IAC1C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,oBAAgB,CAAC,QAAQ;IAClC,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,IAAI,EAAE,iBAAa,CAAC,KAAK;IACzB,MAAM,EAAE,mBAAe,CAAC,IAAI;IAC5B,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACrC,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,UAAU,EAAE,IAAI,IAAI,EAAE;IACtB,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAGF,MAAM,aAAa,GAAkB;IACnC,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,oBAAgB,CAAC,KAAK;IAC/B,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,CAAC;CACb,CAAC;AACF,MAAM,cAAc,GAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAe,CAAC,MAAM,EAAE,CAAC;AAIxF,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,IAAI;IACR,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAGF,MAAM,WAAW,GAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/D,MAAM,YAAY,GAA4B,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;AAI3F,MAAM,gBAAgB,GAAiC;IACrD,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,oBAAgB,CAAC,QAAQ;IAClC,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,SAAS,EAAE,CAAC;CACb,CAAC;AAGF,MAAM,eAAe,GAA0B;IAC7C,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,0BAA0B;IAC/B,UAAU,EAAE,GAAG;IACf,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI,IAAI,EAAE;IACvB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAA0B,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAG5F,MAAM,MAAM,GAAoB,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAG1E,MAAM,eAAe,GAAoB,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;AAMhF,MAAM,UAAU,GAAW,IAAA,6BAAqB,EAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,iBAAa,CAAC,KAAK,CAAC,CAAC;AACvF,MAAM,SAAS,GAAW,IAAA,6BAAqB,EAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,iBAAa,CAAC,IAAI,CAAC,CAAC;AACrF,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;IAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,SAAS,CAAC;AACf,KAAK,MAAM,CAAC;AACZ,KAAK,SAAS,CAAC;AACf,KAAK,WAAW,CAAC;AACjB,KAAK,YAAY,CAAC;AAClB,KAAK,aAAa,CAAC;AACnB,KAAK,cAAc,CAAC;AACpB,KAAK,QAAQ,CAAC;AACd,KAAK,WAAW,CAAC;AACjB,KAAK,YAAY,CAAC;AAClB,KAAK,gBAAgB,CAAC;AACtB,KAAK,eAAe,CAAC;AACrB,KAAK,oBAAoB,CAAC;AAC1B,KAAK,MAAM,CAAC;AACZ,KAAK,eAAe,CAAC"}
+{"version":3,"file":"probe.dto.test.js","sourceRoot":"","sources":["../../../src/types/tests/probe.dto.test.ts"],"names":[],"mappings":";;AAQA,0BAoBY;AAKZ,uCAAoD;AAMpD,MAAM,SAAS,GAAmC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClF,MAAM,MAAM,GAAgC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxE,MAAM,SAAS,GAAkC;IAC/C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;CACZ,CAAC;AAIF,MAAM,WAAW,GAAqB;IACpC,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,mBAAe,CAAC,IAAI;IAC5B,OAAO,EAAE,oBAAgB,CAAC,KAAK;IAC/B,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,iBAAiB;IAC3B,IAAI,EAAE,iBAAa,CAAC,IAAI;IACxB,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,UAAU,EAAE,IAAI,IAAI,EAAE;IACtB,SAAS,EAAE,CAAC;CACb,CAAC;AAGF,MAAM,YAAY,GAA0B;IAC1C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,oBAAgB,CAAC,QAAQ;IAClC,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,IAAI,EAAE,iBAAa,CAAC,KAAK;IACzB,MAAM,EAAE,mBAAe,CAAC,IAAI;IAC5B,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACrC,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,UAAU,EAAE,IAAI,IAAI,EAAE;IACtB,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAGF,MAAM,aAAa,GAAkB;IACnC,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,oBAAgB,CAAC,KAAK;IAC/B,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,CAAC;CACb,CAAC;AACF,MAAM,cAAc,GAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAe,CAAC,MAAM,EAAE,CAAC;AAIxF,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,IAAI;IACR,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAGF,MAAM,WAAW,GAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/D,MAAM,YAAY,GAA4B,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;AAI3F,MAAM,gBAAgB,GAAiC;IACrD,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,oBAAgB,CAAC,QAAQ;IAClC,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,SAAS,EAAE,CAAC;CACb,CAAC;AAGF,MAAM,eAAe,GAA0B;IAC7C,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,0BAA0B;IAC/B,UAAU,EAAE,GAAG;IACf,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI,IAAI,EAAE;IACvB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAA0B,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAI5F,MAAM,mBAAmB,GAAyC;IAChE,UAAU,EAAE,CAAC,sBAAsB,CAAC;IACpC,GAAG,EAAE,0BAA0B;CAChC,CAAC;AACF,MAAM,mBAAmB,GAAyC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACvF,MAAM,kBAAkB,GAA4C;IAClE,cAAc,EAAE,IAAI;IACpB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,EAAE;CACV,CAAC;AACF,MAAM,cAAc,GAAgC,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAItF,MAAM,OAAO,GAAW,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;AAE5C,MAAM,SAAS,GAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;AAC3C,MAAM,aAAa,GAAS,QAAI,CAAC,iCAAiC,CAAC;AAGnE,MAAM,MAAM,GAAoB,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAG1E,MAAM,eAAe,GAAoB,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;AAMhF,MAAM,UAAU,GAAW,IAAA,6BAAqB,EAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,iBAAa,CAAC,KAAK,CAAC,CAAC;AACvF,MAAM,SAAS,GAAW,IAAA,6BAAqB,EAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,iBAAa,CAAC,IAAI,CAAC,CAAC;AACrF,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;IAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,SAAS,CAAC;AACf,KAAK,MAAM,CAAC;AACZ,KAAK,SAAS,CAAC;AACf,KAAK,WAAW,CAAC;AACjB,KAAK,YAAY,CAAC;AAClB,KAAK,aAAa,CAAC;AACnB,KAAK,cAAc,CAAC;AACpB,KAAK,QAAQ,CAAC;AACd,KAAK,mBAAmB,CAAC;AACzB,KAAK,mBAAmB,CAAC;AACzB,KAAK,kBAAkB,CAAC;AACxB,KAAK,cAAc,CAAC;AACpB,KAAK,OAAO,CAAC;AACb,KAAK,SAAS,CAAC;AACf,KAAK,aAAa,CAAC;AACnB,KAAK,WAAW,CAAC;AACjB,KAAK,YAAY,CAAC;AAClB,KAAK,gBAAgB,CAAC;AACtB,KAAK,eAAe,CAAC;AACrB,KAAK,oBAAoB,CAAC;AAC1B,KAAK,MAAM,CAAC;AACZ,KAAK,eAAe,CAAC"}

package/dist/utils/probe-webhook-signature.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"probe-webhook-signature.utils.js","sourceRoot":"","sources":["../../src/utils/probe-webhook-signature.utils.ts"],"names":[],"mappings":";;AAiCA,kEAsBC;AAtBD,SAAgB,2BAA2B,CAAC,KAAuC;IACjF,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAG1D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAW,MAAM;SAC5B,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAEnE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,EACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAC7B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QAGP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"probe-webhook-signature.utils.js","sourceRoot":"","sources":["../../src/utils/probe-webhook-signature.utils.ts"],"names":[],"mappings":";;AAkCA,kEAsBC;AAtBD,SAAgB,2BAA2B,CAAC,KAAuC;IACjF,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAG1D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAW,MAAM;SAC5B,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAEnE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,EACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAC7B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QAGP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/package.json

@@ -1,24 +1,12 @@
 {
   "name": "@abyss-project/probe",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "Core package to interact with AbyssProbe",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "publishConfig": {
-    "main": "dist/index.js",
-    "types": "dist/index.d.ts"
-  },
-  "scripts": {
-    "lint": "eslint \"{src,apps,libs,test,core}/**/*.ts\" --fix",
-    "lint:check": "eslint \"{src,apps,libs,test,core}/**/*.ts\" --max-warnings 0",
-    "tsc": "tsc",
-    "build": "tsc",
-    "prepublishOnly": "tsc && node ../../scripts/check-sdk-surface.cjs",
-    "dev": "tsc --watch"
-  },
   "repository": {
     "type": "git",
-    "url": "https://gitlab.com/abyss-group/abyss-tools/abyss-tools"
+    "url": "https://gitlab.com/abyss-group/abyss-probe.git"
   },
   "keywords": [],
   "author": "scylla",
@@ -38,6 +26,7 @@
     "uuid": "^8.3.2"
   },
   "devDependencies": {
+    "@abyss-project/flow": "^1.3.0",
     "@types/express-serve-static-core": "^4.19.6",
     "@types/jsonwebtoken": "^8.5.0",
     "@types/node": "^20.11.0",
@@ -56,5 +45,20 @@
     "prettier": "2.3.1",
     "tsc-watch": "^4.6.2",
     "typescript": "5.9.3"
+  },
+  "peerDependencies": {
+    "@abyss-project/flow": "^1.3.0"
+  },
+  "peerDependenciesMeta": {
+    "@abyss-project/flow": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "lint": "eslint \"{src,apps,libs,test,core}/**/*.ts\" --fix",
+    "lint:check": "eslint \"{src,apps,libs,test,core}/**/*.ts\" --max-warnings 0",
+    "tsc": "tsc",
+    "build": "tsc",
+    "dev": "tsc --watch"
   }
-}
+}

package/src/api/index.ts

@@ -1,6 +1,7 @@
 export * from './probe-scan.api';
-export * from './probe-webhook.api';
 export * from './probe-scan.application.api';
 export * from './probe-webhook.application.api';
 export * from './probe-usage.api';
 export * from './probe-usage.application.api';
+export * from './probe-delivery-subscription.api';
+export * from './probe-delivery-subscription.application.api';

package/src/api/probe-delivery-subscription.api.ts

@@ -0,0 +1,183 @@
+// ──────────────────────────────────────────────
+// AbyssProbe delivery-subscription API for a personal or organization caller: the endpoints that
+// receive the verdict of the caller's scans (`PROBE_SCAN_COMPLETED`). The subscriptions live in
+// Flow; AbyssProbe checks the caller's access to the scope (self, or a member of the organization
+// named by `organizationId`) and calls Flow for it. Mirrors
+// apps/api/src/api/controllers/probe-delivery-subscription.controller.ts.
+//
+// See probe-delivery-subscription.application.api.ts for the application counterpart.
+// ──────────────────────────────────────────────
+
+import { AbyssProbeCore } from '..';
+import type {
+  ICreateProbeDeliverySubscriptionBody,
+  ICreateProbeDeliverySubscriptionResponse,
+  IDeleteProbeDeliverySubscriptionResponse,
+  IGetProbeDeliveryResponse,
+  IGetProbeDeliverySubscriptionResponse,
+  IPaginateProbeDeliveryQuery,
+  IPaginateProbeDeliveryResponse,
+  IPaginateProbeDeliverySubscriptionQuery,
+  IPaginateProbeDeliverySubscriptionResponse,
+  IProbeDeliverySubscriptionScopeQuery,
+  IReplayProbeDeliveryResponse,
+  IResetSecretProbeDeliverySubscriptionResponse,
+  IUpdateProbeDeliverySubscriptionBody,
+  IUpdateProbeDeliverySubscriptionResponse,
+} from '../types';
+
+const DEFAULT_API_KEY_HEADER = 'abyss-api-key';
+
+function authHeader(apiKey?: string): Record<string, string> {
+  return apiKey ? { [DEFAULT_API_KEY_HEADER]: apiKey } : {};
+}
+
+/** Renames `organizationId` to the wire's `organization_id` (see probe-scan.api.ts). */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    out[key === 'organizationId' ? 'organization_id' : key] = value;
+  }
+  return out;
+}
+
+const SUBSCRIPTIONS_PATH = 'delivery-subscription';
+
+/** `GET /delivery-subscription` — the subscriptions of the scope. */
+export const paginateProbeDeliverySubscription = async (
+  query: IPaginateProbeDeliverySubscriptionQuery = {},
+  apiKey?: string,
+): Promise<IPaginateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliverySubscriptionResponse>(SUBSCRIPTIONS_PATH, {
+      params: serializeProbeQuery(query),
+      headers: authHeader(apiKey),
+    })
+  ).data;
+
+/** `GET /delivery-subscription/:deliverySubscriptionId` — never carries the secret. */
+export const getProbeDeliverySubscription = async (
+  deliverySubscriptionId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IGetProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IGetProbeDeliverySubscriptionResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}`,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/**
+ * `POST /delivery-subscription` — HTTP 201. The response's `secret` (signing secret of the
+ * deliveries) is returned ONLY here and by {@link resetSecretProbeDeliverySubscription}.
+ */
+export const createProbeDeliverySubscription = async (
+  body: ICreateProbeDeliverySubscriptionBody,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<ICreateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.post<ICreateProbeDeliverySubscriptionResponse>(
+      SUBSCRIPTIONS_PATH,
+      body,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `PUT /delivery-subscription/:deliverySubscriptionId` — at least one field. */
+export const updateProbeDeliverySubscription = async (
+  deliverySubscriptionId: string,
+  body: IUpdateProbeDeliverySubscriptionBody,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IUpdateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.put<IUpdateProbeDeliverySubscriptionResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}`,
+      body,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `DELETE /delivery-subscription/:deliverySubscriptionId`. */
+export const deleteProbeDeliverySubscription = async (
+  deliverySubscriptionId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IDeleteProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.delete<IDeleteProbeDeliverySubscriptionResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}`,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `POST /delivery-subscription/:deliverySubscriptionId/reset-secret` — the new secret, once. */
+export const resetSecretProbeDeliverySubscription = async (
+  deliverySubscriptionId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IResetSecretProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.post<IResetSecretProbeDeliverySubscriptionResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}/reset-secret`,
+      undefined,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `GET /delivery-subscription/delivery` — the deliveries of every subscription of the scope. */
+export const paginateProbeScopeDelivery = async (
+  query: IPaginateProbeDeliveryQuery = {},
+  apiKey?: string,
+): Promise<IPaginateProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliveryResponse>(
+      `${SUBSCRIPTIONS_PATH}/delivery`,
+      { params: serializeProbeQuery(query), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `GET /delivery-subscription/:deliverySubscriptionId/delivery`. */
+export const paginateProbeDelivery = async (
+  deliverySubscriptionId: string,
+  query: IPaginateProbeDeliveryQuery = {},
+  apiKey?: string,
+): Promise<IPaginateProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliveryResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}/delivery`,
+      { params: serializeProbeQuery(query), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `GET /delivery-subscription/:deliverySubscriptionId/delivery/:deliveryId`. */
+export const getProbeDelivery = async (
+  deliverySubscriptionId: string,
+  deliveryId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IGetProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IGetProbeDeliveryResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}/delivery/${deliveryId}`,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `POST .../delivery/:deliveryId/replay` — only a delivered or failed one (409 otherwise). */
+export const replayProbeDelivery = async (
+  deliverySubscriptionId: string,
+  deliveryId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IReplayProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.post<IReplayProbeDeliveryResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}/delivery/${deliveryId}/replay`,
+      undefined,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;

package/src/api/probe-delivery-subscription.application.api.ts

@@ -0,0 +1,186 @@
+// ──────────────────────────────────────────────
+// AbyssProbe delivery-subscription API for an application caller (project API key, or a project
+// member's session): the endpoints that receive the verdict of the application's scans. The
+// application counterpart of probe-delivery-subscription.api.ts, with `FULL_ACCESS` on the
+// application as the access rule and no scope argument (the scope is the `:applicationId` URL
+// segment). Mirrors
+// apps/api/src/api/controllers/probe-delivery-subscription-application.controller.ts.
+//
+// `authHeaderApplication` sends `API_KEY_APPLICATION_HEADER` instead of the personal header.
+// ──────────────────────────────────────────────
+
+import { AbyssProbeCore, API_KEY_APPLICATION_HEADER } from '..';
+import type {
+  ICreateProbeDeliverySubscriptionBody,
+  ICreateProbeDeliverySubscriptionResponse,
+  IDeleteProbeDeliverySubscriptionResponse,
+  IGetProbeDeliveryResponse,
+  IGetProbeDeliverySubscriptionResponse,
+  IPaginateProbeDeliveryQuery,
+  IPaginateProbeDeliveryResponse,
+  IPaginateProbeDeliverySubscriptionQuery,
+  IPaginateProbeDeliverySubscriptionResponse,
+  IReplayProbeDeliveryResponse,
+  IResetSecretProbeDeliverySubscriptionResponse,
+  IUpdateProbeDeliverySubscriptionBody,
+  IUpdateProbeDeliverySubscriptionResponse,
+} from '../types';
+
+function authHeaderApplication(applicationApiKey?: string): Record<string, string> {
+  return applicationApiKey ? { [API_KEY_APPLICATION_HEADER]: applicationApiKey } : {};
+}
+
+/** Drops undefined/null: no `organizationId` ever travels on an application call. */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    out[key] = value;
+  }
+  return out;
+}
+
+const subscriptionsPath = (applicationId: string): string =>
+  `application/${applicationId}/delivery-subscription`;
+
+/** `GET /application/:applicationId/delivery-subscription`. */
+export const paginateProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  query: Omit<IPaginateProbeDeliverySubscriptionQuery, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IPaginateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliverySubscriptionResponse>(
+      subscriptionsPath(applicationId),
+      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `GET /application/:applicationId/delivery-subscription/:deliverySubscriptionId` — no secret. */
+export const getProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  applicationApiKey?: string,
+): Promise<IGetProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IGetProbeDeliverySubscriptionResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `POST /application/:applicationId/delivery-subscription` — HTTP 201, the `secret` once. With a
+ * project member's session the subscription is theirs; with an API key it is recorded under the
+ * project's creator.
+ */
+export const createProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  body: ICreateProbeDeliverySubscriptionBody,
+  applicationApiKey?: string,
+): Promise<ICreateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.post<ICreateProbeDeliverySubscriptionResponse>(
+      subscriptionsPath(applicationId),
+      body,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `PUT /application/:applicationId/delivery-subscription/:deliverySubscriptionId`. */
+export const updateProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  body: IUpdateProbeDeliverySubscriptionBody,
+  applicationApiKey?: string,
+): Promise<IUpdateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.put<IUpdateProbeDeliverySubscriptionResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}`,
+      body,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `DELETE /application/:applicationId/delivery-subscription/:deliverySubscriptionId`. */
+export const deleteProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  applicationApiKey?: string,
+): Promise<IDeleteProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.delete<IDeleteProbeDeliverySubscriptionResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `POST .../delivery-subscription/:deliverySubscriptionId/reset-secret` — the new secret, once. */
+export const resetSecretProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  applicationApiKey?: string,
+): Promise<IResetSecretProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.post<IResetSecretProbeDeliverySubscriptionResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}/reset-secret`,
+      undefined,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `GET /application/:applicationId/delivery-subscription/delivery` — every subscription of the application. */
+export const paginateProbeScopeDeliveryApplication = async (
+  applicationId: string,
+  query: Omit<IPaginateProbeDeliveryQuery, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IPaginateProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliveryResponse>(
+      `${subscriptionsPath(applicationId)}/delivery`,
+      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `GET .../delivery-subscription/:deliverySubscriptionId/delivery`. */
+export const paginateProbeDeliveryApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  query: Omit<IPaginateProbeDeliveryQuery, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IPaginateProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliveryResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}/delivery`,
+      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `GET .../delivery-subscription/:deliverySubscriptionId/delivery/:deliveryId`. */
+export const getProbeDeliveryApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  deliveryId: string,
+  applicationApiKey?: string,
+): Promise<IGetProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IGetProbeDeliveryResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}/delivery/${deliveryId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `POST .../delivery/:deliveryId/replay` — only a delivered or failed one (409 otherwise). */
+export const replayProbeDeliveryApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  deliveryId: string,
+  applicationApiKey?: string,
+): Promise<IReplayProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.post<IReplayProbeDeliveryResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}/delivery/${deliveryId}/replay`,
+      undefined,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;

package/src/api/probe-scan.api.test.ts

@@ -1,47 +1,47 @@
-// Type-level compile test for the probe-scan api surface.
-// No jest runner in this SDK package; compile guard only (mirrors this
-// package's own extraction-plan-preset.api.test.ts).
-// Run: npx tsc --noEmit (from packages/abyss_probe_core), or `npm run build`.
-
-import * as api from './probe-scan.api';
-
-// All five functions must be exported with these exact signatures.
-const _scan: typeof api.scan = api.scan;
-const _scanSync: typeof api.scanSync = api.scanSync;
-const _scanAsync: typeof api.scanAsync = api.scanAsync;
-const _getScan: typeof api.getScan = api.getScan;
-const _listScans: typeof api.listScans = api.listScans;
-
-void _scan;
-void _scanSync;
-void _scanAsync;
-void _getScan;
-void _listScans;
-
-// The accepted file inputs (#519). A Blob covers the browser's File and Node's
-// file-backed fs.openAsBlob(path); raw bytes are accepted as a Uint8Array (and
-// therefore a Buffer). A Node stream is refused AT COMPILE TIME: the body is a
-// spec FormData, whose parts need a known length, so honouring a stream would
-// mean buffering up to 2 GiB in memory.
-declare const blob: Blob;
-declare const bytes: Uint8Array;
-declare const buffer: Buffer;
-declare const stream: NodeJS.ReadableStream;
-
-const _fromBlob: api.ProbeScanFileInput = blob;
-const _fromBytes: api.ProbeScanFileInput = bytes;
-const _fromBuffer: api.ProbeScanFileInput = buffer;
-// @ts-expect-error a Readable stream is not an accepted scan input since 2.12.0
-const _fromStream: api.ProbeScanFileInput = stream;
-
-void _fromBlob;
-void _fromBytes;
-void _fromBuffer;
-void _fromStream;
-
-// buildScanForm returns the FormData alone — axios sets the multipart
-// content type and boundary, so there are no headers to merge in.
-const _form: FormData = api.buildScanForm(blob, { filename: 'f.bin' });
-void _form;
-
-export {};
+// Type-level compile test for the probe-scan api surface.
+// No jest runner in this SDK package; compile guard only (mirrors this
+// package's own extraction-plan-preset.api.test.ts).
+// Run: npx tsc --noEmit (from packages/abyss_probe_core), or `npm run build`.
+
+import * as api from './probe-scan.api';
+
+// All five functions must be exported with these exact signatures.
+const _scan: typeof api.scan = api.scan;
+const _scanSync: typeof api.scanSync = api.scanSync;
+const _scanAsync: typeof api.scanAsync = api.scanAsync;
+const _getScan: typeof api.getScan = api.getScan;
+const _listScans: typeof api.listScans = api.listScans;
+
+void _scan;
+void _scanSync;
+void _scanAsync;
+void _getScan;
+void _listScans;
+
+// The accepted file inputs (#519). A Blob covers the browser's File and Node's
+// file-backed fs.openAsBlob(path); raw bytes are accepted as a Uint8Array (and
+// therefore a Buffer). A Node stream is refused AT COMPILE TIME: the body is a
+// spec FormData, whose parts need a known length, so honouring a stream would
+// mean buffering up to 2 GiB in memory.
+declare const blob: Blob;
+declare const bytes: Uint8Array;
+declare const buffer: Buffer;
+declare const stream: NodeJS.ReadableStream;
+
+const _fromBlob: api.ProbeScanFileInput = blob;
+const _fromBytes: api.ProbeScanFileInput = bytes;
+const _fromBuffer: api.ProbeScanFileInput = buffer;
+// @ts-expect-error a Readable stream is not an accepted scan input since 2.12.0
+const _fromStream: api.ProbeScanFileInput = stream;
+
+void _fromBlob;
+void _fromBytes;
+void _fromBuffer;
+void _fromStream;
+
+// buildScanForm returns the FormData alone — axios sets the multipart
+// content type and boundary, so there are no headers to merge in.
+const _form: FormData = api.buildScanForm(blob, { filename: 'f.bin' });
+void _form;
+
+export {};