@abyss-project/probe 2.0.1 → 3.0.0

package/src/api/probe-delivery-subscription.api.ts

@@ -0,0 +1,183 @@
+// ──────────────────────────────────────────────
+// AbyssProbe delivery-subscription API for a personal or organization caller: the endpoints that
+// receive the verdict of the caller's scans (`PROBE_SCAN_COMPLETED`). The subscriptions live in
+// Flow; AbyssProbe checks the caller's access to the scope (self, or a member of the organization
+// named by `organizationId`) and calls Flow for it. Mirrors
+// apps/api/src/api/controllers/probe-delivery-subscription.controller.ts.
+//
+// See probe-delivery-subscription.application.api.ts for the application counterpart.
+// ──────────────────────────────────────────────
+
+import { AbyssProbeCore } from '..';
+import type {
+  ICreateProbeDeliverySubscriptionBody,
+  ICreateProbeDeliverySubscriptionResponse,
+  IDeleteProbeDeliverySubscriptionResponse,
+  IGetProbeDeliveryResponse,
+  IGetProbeDeliverySubscriptionResponse,
+  IPaginateProbeDeliveryQuery,
+  IPaginateProbeDeliveryResponse,
+  IPaginateProbeDeliverySubscriptionQuery,
+  IPaginateProbeDeliverySubscriptionResponse,
+  IProbeDeliverySubscriptionScopeQuery,
+  IReplayProbeDeliveryResponse,
+  IResetSecretProbeDeliverySubscriptionResponse,
+  IUpdateProbeDeliverySubscriptionBody,
+  IUpdateProbeDeliverySubscriptionResponse,
+} from '../types';
+
+const DEFAULT_API_KEY_HEADER = 'abyss-api-key';
+
+function authHeader(apiKey?: string): Record<string, string> {
+  return apiKey ? { [DEFAULT_API_KEY_HEADER]: apiKey } : {};
+}
+
+/** Renames `organizationId` to the wire's `organization_id` (see probe-scan.api.ts). */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    out[key === 'organizationId' ? 'organization_id' : key] = value;
+  }
+  return out;
+}
+
+const SUBSCRIPTIONS_PATH = 'delivery-subscription';
+
+/** `GET /delivery-subscription` — the subscriptions of the scope. */
+export const paginateProbeDeliverySubscription = async (
+  query: IPaginateProbeDeliverySubscriptionQuery = {},
+  apiKey?: string,
+): Promise<IPaginateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliverySubscriptionResponse>(SUBSCRIPTIONS_PATH, {
+      params: serializeProbeQuery(query),
+      headers: authHeader(apiKey),
+    })
+  ).data;
+
+/** `GET /delivery-subscription/:deliverySubscriptionId` — never carries the secret. */
+export const getProbeDeliverySubscription = async (
+  deliverySubscriptionId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IGetProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IGetProbeDeliverySubscriptionResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}`,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/**
+ * `POST /delivery-subscription` — HTTP 201. The response's `secret` (signing secret of the
+ * deliveries) is returned ONLY here and by {@link resetSecretProbeDeliverySubscription}.
+ */
+export const createProbeDeliverySubscription = async (
+  body: ICreateProbeDeliverySubscriptionBody,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<ICreateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.post<ICreateProbeDeliverySubscriptionResponse>(
+      SUBSCRIPTIONS_PATH,
+      body,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `PUT /delivery-subscription/:deliverySubscriptionId` — at least one field. */
+export const updateProbeDeliverySubscription = async (
+  deliverySubscriptionId: string,
+  body: IUpdateProbeDeliverySubscriptionBody,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IUpdateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.put<IUpdateProbeDeliverySubscriptionResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}`,
+      body,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `DELETE /delivery-subscription/:deliverySubscriptionId`. */
+export const deleteProbeDeliverySubscription = async (
+  deliverySubscriptionId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IDeleteProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.delete<IDeleteProbeDeliverySubscriptionResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}`,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `POST /delivery-subscription/:deliverySubscriptionId/reset-secret` — the new secret, once. */
+export const resetSecretProbeDeliverySubscription = async (
+  deliverySubscriptionId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IResetSecretProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.post<IResetSecretProbeDeliverySubscriptionResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}/reset-secret`,
+      undefined,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `GET /delivery-subscription/delivery` — the deliveries of every subscription of the scope. */
+export const paginateProbeScopeDelivery = async (
+  query: IPaginateProbeDeliveryQuery = {},
+  apiKey?: string,
+): Promise<IPaginateProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliveryResponse>(
+      `${SUBSCRIPTIONS_PATH}/delivery`,
+      { params: serializeProbeQuery(query), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `GET /delivery-subscription/:deliverySubscriptionId/delivery`. */
+export const paginateProbeDelivery = async (
+  deliverySubscriptionId: string,
+  query: IPaginateProbeDeliveryQuery = {},
+  apiKey?: string,
+): Promise<IPaginateProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliveryResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}/delivery`,
+      { params: serializeProbeQuery(query), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `GET /delivery-subscription/:deliverySubscriptionId/delivery/:deliveryId`. */
+export const getProbeDelivery = async (
+  deliverySubscriptionId: string,
+  deliveryId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IGetProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IGetProbeDeliveryResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}/delivery/${deliveryId}`,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;
+
+/** `POST .../delivery/:deliveryId/replay` — only a delivered or failed one (409 otherwise). */
+export const replayProbeDelivery = async (
+  deliverySubscriptionId: string,
+  deliveryId: string,
+  scope: IProbeDeliverySubscriptionScopeQuery = {},
+  apiKey?: string,
+): Promise<IReplayProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.post<IReplayProbeDeliveryResponse>(
+      `${SUBSCRIPTIONS_PATH}/${deliverySubscriptionId}/delivery/${deliveryId}/replay`,
+      undefined,
+      { params: serializeProbeQuery(scope), headers: authHeader(apiKey) },
+    )
+  ).data;

package/src/api/probe-delivery-subscription.application.api.ts

@@ -0,0 +1,186 @@
+// ──────────────────────────────────────────────
+// AbyssProbe delivery-subscription API for an application caller (project API key, or a project
+// member's session): the endpoints that receive the verdict of the application's scans. The
+// application counterpart of probe-delivery-subscription.api.ts, with `FULL_ACCESS` on the
+// application as the access rule and no scope argument (the scope is the `:applicationId` URL
+// segment). Mirrors
+// apps/api/src/api/controllers/probe-delivery-subscription-application.controller.ts.
+//
+// `authHeaderApplication` sends `API_KEY_APPLICATION_HEADER` instead of the personal header.
+// ──────────────────────────────────────────────
+
+import { AbyssProbeCore, API_KEY_APPLICATION_HEADER } from '..';
+import type {
+  ICreateProbeDeliverySubscriptionBody,
+  ICreateProbeDeliverySubscriptionResponse,
+  IDeleteProbeDeliverySubscriptionResponse,
+  IGetProbeDeliveryResponse,
+  IGetProbeDeliverySubscriptionResponse,
+  IPaginateProbeDeliveryQuery,
+  IPaginateProbeDeliveryResponse,
+  IPaginateProbeDeliverySubscriptionQuery,
+  IPaginateProbeDeliverySubscriptionResponse,
+  IReplayProbeDeliveryResponse,
+  IResetSecretProbeDeliverySubscriptionResponse,
+  IUpdateProbeDeliverySubscriptionBody,
+  IUpdateProbeDeliverySubscriptionResponse,
+} from '../types';
+
+function authHeaderApplication(applicationApiKey?: string): Record<string, string> {
+  return applicationApiKey ? { [API_KEY_APPLICATION_HEADER]: applicationApiKey } : {};
+}
+
+/** Drops undefined/null: no `organizationId` ever travels on an application call. */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    out[key] = value;
+  }
+  return out;
+}
+
+const subscriptionsPath = (applicationId: string): string =>
+  `application/${applicationId}/delivery-subscription`;
+
+/** `GET /application/:applicationId/delivery-subscription`. */
+export const paginateProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  query: Omit<IPaginateProbeDeliverySubscriptionQuery, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IPaginateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliverySubscriptionResponse>(
+      subscriptionsPath(applicationId),
+      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `GET /application/:applicationId/delivery-subscription/:deliverySubscriptionId` — no secret. */
+export const getProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  applicationApiKey?: string,
+): Promise<IGetProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IGetProbeDeliverySubscriptionResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `POST /application/:applicationId/delivery-subscription` — HTTP 201, the `secret` once. With a
+ * project member's session the subscription is theirs; with an API key it is recorded under the
+ * project's creator.
+ */
+export const createProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  body: ICreateProbeDeliverySubscriptionBody,
+  applicationApiKey?: string,
+): Promise<ICreateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.post<ICreateProbeDeliverySubscriptionResponse>(
+      subscriptionsPath(applicationId),
+      body,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `PUT /application/:applicationId/delivery-subscription/:deliverySubscriptionId`. */
+export const updateProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  body: IUpdateProbeDeliverySubscriptionBody,
+  applicationApiKey?: string,
+): Promise<IUpdateProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.put<IUpdateProbeDeliverySubscriptionResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}`,
+      body,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `DELETE /application/:applicationId/delivery-subscription/:deliverySubscriptionId`. */
+export const deleteProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  applicationApiKey?: string,
+): Promise<IDeleteProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.delete<IDeleteProbeDeliverySubscriptionResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `POST .../delivery-subscription/:deliverySubscriptionId/reset-secret` — the new secret, once. */
+export const resetSecretProbeDeliverySubscriptionApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  applicationApiKey?: string,
+): Promise<IResetSecretProbeDeliverySubscriptionResponse> =>
+  (
+    await AbyssProbeCore.axios.post<IResetSecretProbeDeliverySubscriptionResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}/reset-secret`,
+      undefined,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `GET /application/:applicationId/delivery-subscription/delivery` — every subscription of the application. */
+export const paginateProbeScopeDeliveryApplication = async (
+  applicationId: string,
+  query: Omit<IPaginateProbeDeliveryQuery, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IPaginateProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliveryResponse>(
+      `${subscriptionsPath(applicationId)}/delivery`,
+      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `GET .../delivery-subscription/:deliverySubscriptionId/delivery`. */
+export const paginateProbeDeliveryApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  query: Omit<IPaginateProbeDeliveryQuery, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IPaginateProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IPaginateProbeDeliveryResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}/delivery`,
+      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `GET .../delivery-subscription/:deliverySubscriptionId/delivery/:deliveryId`. */
+export const getProbeDeliveryApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  deliveryId: string,
+  applicationApiKey?: string,
+): Promise<IGetProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IGetProbeDeliveryResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}/delivery/${deliveryId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/** `POST .../delivery/:deliveryId/replay` — only a delivered or failed one (409 otherwise). */
+export const replayProbeDeliveryApplication = async (
+  applicationId: string,
+  deliverySubscriptionId: string,
+  deliveryId: string,
+  applicationApiKey?: string,
+): Promise<IReplayProbeDeliveryResponse> =>
+  (
+    await AbyssProbeCore.axios.post<IReplayProbeDeliveryResponse>(
+      `${subscriptionsPath(applicationId)}/${deliverySubscriptionId}/delivery/${deliveryId}/replay`,
+      undefined,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;

package/src/api/probe-webhook.application.api.ts

@@ -1,141 +1,128 @@
-// ──────────────────────────────────────────────
-// AbyssProbe APPLICATION webhook subscription API — CRUD over registered
-// `probe_webhooks` owned by a calling application (create / list / delete /
-// update, + paginated delivery history — same surface as the personal/org
-// client, see probe-webhook.api.ts's header comment). Mirrors
-// apps/api/src/api/controllers/probe-webhook-application.controller.ts
-// EXACTLY — the application counterpart of probe-webhook.api.ts, for
-// inter-service callers (abyss-storage, external integrations)
-// authenticating with a project API key instead of a personal/org session.
-//
-// Reuses every request/response TYPE verbatim (`ICreateProbeWebhookBody`,
-// `ICreateProbeWebhookResponse`, `IListProbeWebhookResponse`,
-// `IDeleteProbeWebhookResponse`, `IUpdateProbeWebhookBody`,
-// `IUpdateProbeWebhookResponse`, `IListProbeWebhookDeliveriesQuery`,
-// `IListProbeWebhookDeliveriesResponse`) — never redefined here. No scope
-// argument/query on any of these calls (unlike the personal/org client's
-// `IProbeWebhookScopeQuery`) — an application caller's scope is entirely its
-// `:applicationId` URL segment, resolved server-side by
-// ProbeApplicationMiddleware; there is nothing to select between.
-//
-// `authHeaderApplication` is kept LOCAL and unexported, same convention as
-// the personal/org client's own `authHeader` — it sends
-// `API_KEY_APPLICATION_HEADER` (`abyss-api-key-application`, imported from
-// this package's root) instead of the personal `abyss-api-key` header.
-// ──────────────────────────────────────────────
-
-import { AbyssProbeCore, API_KEY_APPLICATION_HEADER } from '..';
-import type {
-  ICreateProbeWebhookBody,
-  IUpdateProbeWebhookBody,
-  IListProbeWebhookDeliveriesQuery,
-  ICreateProbeWebhookResponse,
-  IListProbeWebhookResponse,
-  IDeleteProbeWebhookResponse,
-  IUpdateProbeWebhookResponse,
-  IListProbeWebhookDeliveriesResponse,
-} from '../types';
-
-function authHeaderApplication(applicationApiKey?: string): Record<string, string> {
-  return applicationApiKey ? { [API_KEY_APPLICATION_HEADER]: applicationApiKey } : {};
-}
-
-/** Renames nothing (no `organizationId` ever travels on an application call) — drops undefined/null and ISO-stringifies `Date`s, mirroring probe-scan.application.api.ts's own local helper. */
-function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
-  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
-    if (value === undefined || value === null) continue;
-    out[key] = value instanceof Date ? value.toISOString() : value;
-  }
-  return out;
-}
-
-/**
- * `POST /application/:applicationId/webhook` — register a callbackUrl owned
- * by the calling application. The response's `secret` field (HMAC signing
- * secret) is returned ONLY here — store it immediately, it cannot be
- * re-revealed later.
- */
-export const createProbeWebhookApplication = async (
-  applicationId: string,
-  body: ICreateProbeWebhookBody,
-  applicationApiKey?: string,
-): Promise<ICreateProbeWebhookResponse> =>
-  (
-    await AbyssProbeCore.axios.post<ICreateProbeWebhookResponse>(
-      `application/${applicationId}/webhook`,
-      body,
-      { headers: authHeaderApplication(applicationApiKey) },
-    )
-  ).data;
-
-/**
- * `GET /application/:applicationId/webhook` — flat list of the calling
- * application's own webhooks (not paginated — bounded by
- * WEBHOOK_MAX_PER_SCOPE server-side).
- */
-export const listProbeWebhookApplication = async (
-  applicationId: string,
-  applicationApiKey?: string,
-): Promise<IListProbeWebhookResponse> =>
-  (
-    await AbyssProbeCore.axios.get<IListProbeWebhookResponse>(
-      `application/${applicationId}/webhook`,
-      { headers: authHeaderApplication(applicationApiKey) },
-    )
-  ).data;
-
-/**
- * `DELETE /application/:applicationId/webhook/:webhookId` — cross-tenant
- * guarded server-side by a direct `applicationId` comparison (404, never
- * 403).
- */
-export const deleteProbeWebhookApplication = async (
-  applicationId: string,
-  webhookId: string,
-  applicationApiKey?: string,
-): Promise<IDeleteProbeWebhookResponse> =>
-  (
-    await AbyssProbeCore.axios.delete<IDeleteProbeWebhookResponse>(
-      `application/${applicationId}/webhook/${webhookId}`,
-      { headers: authHeaderApplication(applicationApiKey) },
-    )
-  ).data;
-
-/**
- * `PATCH /application/:applicationId/webhook/:webhookId` (WS5-5) — edit
- * `callbackUrl` and/or `active` on a webhook owned by the calling
- * application. Cross-tenant guarded server-side (404, never 403). The
- * response includes `secret` — re-displayable now, see {@link IProbeWebhook}.
- */
-export const updateProbeWebhookApplication = async (
-  applicationId: string,
-  webhookId: string,
-  body: IUpdateProbeWebhookBody,
-  applicationApiKey?: string,
-): Promise<IUpdateProbeWebhookResponse> =>
-  (
-    await AbyssProbeCore.axios.patch<IUpdateProbeWebhookResponse>(
-      `application/${applicationId}/webhook/${webhookId}`,
-      body,
-      { headers: authHeaderApplication(applicationApiKey) },
-    )
-  ).data;
-
-/**
- * `GET /application/:applicationId/webhook/:webhookId/deliveries` (WS5-6) —
- * paginated delivery-attempt history for one webhook owned by the calling
- * application. Cross-tenant guarded server-side (404, never 403).
- */
-export const listProbeWebhookDeliveriesApplication = async (
-  applicationId: string,
-  webhookId: string,
-  query: Omit<IListProbeWebhookDeliveriesQuery, 'organizationId'> = {},
-  applicationApiKey?: string,
-): Promise<IListProbeWebhookDeliveriesResponse> =>
-  (
-    await AbyssProbeCore.axios.get<IListProbeWebhookDeliveriesResponse>(
-      `application/${applicationId}/webhook/${webhookId}/deliveries`,
-      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
-    )
-  ).data;
+// ──────────────────────────────────────────────
+// INTERNAL (P5 #792): AbyssProbe application webhooks, CRUD over the `probe_webhooks` rows owned
+// by a calling application (create / list / delete / update, + paginated delivery history).
+// They serve AbyssStorage's antivirus subscription until its client subscriptions move to Flow
+// (L2). A client's own subscriptions to the verdict of its scans are the Flow delivery
+// subscriptions (probe-delivery-subscription.application.api.ts). Mirrors
+// apps/api/src/api/controllers/probe-webhook-application.controller.ts EXACTLY.
+//
+// The scope is entirely the `:applicationId` URL segment, resolved server-side by
+// ProbeApplicationMiddleware; there is nothing to select between. `authHeaderApplication` sends
+// `API_KEY_APPLICATION_HEADER` (`abyss-api-key-application`, imported from this package's root).
+// ──────────────────────────────────────────────
+
+import { AbyssProbeCore, API_KEY_APPLICATION_HEADER } from '..';
+import type {
+  ICreateProbeWebhookBody,
+  IUpdateProbeWebhookBody,
+  IListProbeWebhookDeliveriesQuery,
+  ICreateProbeWebhookResponse,
+  IListProbeWebhookResponse,
+  IDeleteProbeWebhookResponse,
+  IUpdateProbeWebhookResponse,
+  IListProbeWebhookDeliveriesResponse,
+} from '../types';
+
+function authHeaderApplication(applicationApiKey?: string): Record<string, string> {
+  return applicationApiKey ? { [API_KEY_APPLICATION_HEADER]: applicationApiKey } : {};
+}
+
+/** Renames nothing (no `organizationId` ever travels on an application call) — drops undefined/null and ISO-stringifies `Date`s, mirroring probe-scan.application.api.ts's own local helper. */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    out[key] = value instanceof Date ? value.toISOString() : value;
+  }
+  return out;
+}
+
+/**
+ * `POST /application/:applicationId/webhook` — register a callbackUrl owned
+ * by the calling application. The response's `secret` field (HMAC signing
+ * secret) is returned ONLY here — store it immediately, it cannot be
+ * re-revealed later.
+ */
+export const createProbeWebhookApplication = async (
+  applicationId: string,
+  body: ICreateProbeWebhookBody,
+  applicationApiKey?: string,
+): Promise<ICreateProbeWebhookResponse> =>
+  (
+    await AbyssProbeCore.axios.post<ICreateProbeWebhookResponse>(
+      `application/${applicationId}/webhook`,
+      body,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `GET /application/:applicationId/webhook` — flat list of the calling
+ * application's own webhooks (not paginated — bounded by
+ * WEBHOOK_MAX_PER_SCOPE server-side).
+ */
+export const listProbeWebhookApplication = async (
+  applicationId: string,
+  applicationApiKey?: string,
+): Promise<IListProbeWebhookResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IListProbeWebhookResponse>(
+      `application/${applicationId}/webhook`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `DELETE /application/:applicationId/webhook/:webhookId` — cross-tenant
+ * guarded server-side by a direct `applicationId` comparison (404, never
+ * 403).
+ */
+export const deleteProbeWebhookApplication = async (
+  applicationId: string,
+  webhookId: string,
+  applicationApiKey?: string,
+): Promise<IDeleteProbeWebhookResponse> =>
+  (
+    await AbyssProbeCore.axios.delete<IDeleteProbeWebhookResponse>(
+      `application/${applicationId}/webhook/${webhookId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `PATCH /application/:applicationId/webhook/:webhookId` (WS5-5) — edit
+ * `callbackUrl` and/or `active` on a webhook owned by the calling
+ * application. Cross-tenant guarded server-side (404, never 403). The
+ * response includes `secret` — re-displayable now, see {@link IProbeWebhook}.
+ */
+export const updateProbeWebhookApplication = async (
+  applicationId: string,
+  webhookId: string,
+  body: IUpdateProbeWebhookBody,
+  applicationApiKey?: string,
+): Promise<IUpdateProbeWebhookResponse> =>
+  (
+    await AbyssProbeCore.axios.patch<IUpdateProbeWebhookResponse>(
+      `application/${applicationId}/webhook/${webhookId}`,
+      body,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `GET /application/:applicationId/webhook/:webhookId/deliveries` (WS5-6) —
+ * paginated delivery-attempt history for one webhook owned by the calling
+ * application. Cross-tenant guarded server-side (404, never 403).
+ */
+export const listProbeWebhookDeliveriesApplication = async (
+  applicationId: string,
+  webhookId: string,
+  query: IListProbeWebhookDeliveriesQuery = {},
+  applicationApiKey?: string,
+): Promise<IListProbeWebhookDeliveriesResponse> =>
+  (
+    await AbyssProbeCore.axios.get<IListProbeWebhookDeliveriesResponse>(
+      `application/${applicationId}/webhook/${webhookId}/deliveries`,
+      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;