@abyss-project/tools 2.1.0 → 2.2.0

package/src/api/probe-scan.api.ts

@@ -0,0 +1,191 @@
+// ──────────────────────────────────────────────
+// AbyssProbe scan API — POST /scan (sync + async), GET /scan/:scanId (poll),
+// GET /scan (history/search). Mirrors
+// apps/api/src/api/controllers/probe-scan.controller.ts EXACTLY (see that
+// file for the full contract this client targets). AbyssProbe's controllers
+// add no extra path segment (`@Controller({ prefixPath: '/scan' })`), so
+// these calls hit `scan`/`scan/:id` directly — no `probe/` prefix.
+//
+// File-upload dual environment handling (browser `FormData`/`Blob` vs Node
+// `Buffer`/stream + the `form-data` package) mirrors this package's own
+// extraction.api.ts (`detect`/`postExtract`): AbyssProbe is meant to be
+// called from the abyss-main UI (a browser) as well as from Node services
+// (abyss-storage, external integrators). `form-data` is lazy-`require`d
+// (never statically imported) so a browser bundle never tries to resolve
+// the Node-only package.
+//
+// `authHeader`/`serializeProbeQuery` are kept LOCAL and unexported (not a
+// shared utils file) — same convention as every other extract/*.api.ts file
+// in this package (each redefines its own tiny per-call apiKey helper; see
+// extraction.api.ts / extraction-settings.api.ts / extraction-plan-preset.api.ts).
+//
+// See probe-scan.application.api.ts for the application/API-key-auth
+// counterpart of this client (`/application/:applicationId/scan...`, Phase
+// 3a) — it reuses this file's `buildScanForm` and every request/response
+// type verbatim; only the URL prefix, the extra `applicationId` argument,
+// and the auth header differ.
+// ──────────────────────────────────────────────
+
+import { AbyssToolsCore } from '..';
+import { ProbeScanMode } from '../types';
+import type {
+  IScanOptions,
+  IListScansQuery,
+  IScanResponse,
+  IScanSyncResponse,
+  IScanAsyncResponse,
+  IGetScanResponse,
+  IPaginateScanResponse,
+} from '../types';
+
+const DEFAULT_API_KEY_HEADER = 'abyss-api-key';
+
+function authHeader(apiKey?: string): Record<string, string> {
+  return apiKey ? { [DEFAULT_API_KEY_HEADER]: apiKey } : {};
+}
+
+/**
+ * Turn a request/query options object into axios `params`: drops
+ * undefined/null, ISO-stringifies `Date`s, and renames `organizationId` to
+ * the wire's `organization_id` (the one snake_case key AbyssProbe's own
+ * controllers actually expect — see probe-scope.helper.ts#readOrganizationId
+ * — every other field name is already camelCase on both sides).
+ */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    const wireKey = key === 'organizationId' ? 'organization_id' : key;
+    out[wireKey] = value instanceof Date ? value.toISOString() : value;
+  }
+  return out;
+}
+
+/** Anything `sdk.probe.scan` accepts as the file to submit. */
+export type ProbeScanFileInput = Buffer | Uint8Array | NodeJS.ReadableStream | Blob;
+
+function isBrowserEnv(): boolean {
+  return typeof window !== 'undefined' && typeof FormData !== 'undefined';
+}
+
+async function loadNodeFormData(): Promise<any> {
+  // Indirect eval so bundlers (esbuild/vite/webpack) do not try to resolve
+  // the Node-only "form-data" package when this file is included in a
+  // browser bundle. The require only ever runs at runtime on Node.
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
+  const nodeRequire: NodeRequire = new Function('return require')();
+  return nodeRequire('form-data');
+}
+
+export interface BuiltScanForm {
+  form: unknown;
+  headers: Record<string, string>;
+}
+
+/**
+ * Exported (not just this file's own `scan` internals) so
+ * probe-scan.application.api.ts reuses this EXACT multipart-building logic
+ * (browser `FormData`/`Blob` vs Node `Buffer`/stream + lazy-required
+ * `form-data`) rather than duplicating it — the file-upload contract is
+ * identical for a personal/org caller and an application caller; only the
+ * URL/auth differ (see that file's header comment).
+ */
+export async function buildScanForm(
+  file: ProbeScanFileInput,
+  options: IScanOptions,
+): Promise<BuiltScanForm> {
+  const filename = options.filename ?? 'file';
+
+  if (isBrowserEnv()) {
+    const form = new FormData();
+    const blob =
+      file instanceof Blob ? file : new Blob([file as BlobPart], { type: options.mimeType });
+    form.append('file', blob, filename);
+    if (options.context) form.append('context', JSON.stringify(options.context));
+    if (options.callbackUrl) form.append('callbackUrl', options.callbackUrl);
+    return { form, headers: {} };
+  }
+
+  const FormDataCtor = await loadNodeFormData();
+  const form = new FormDataCtor();
+  const filePart =
+    Buffer.isBuffer(file) || file instanceof Uint8Array ? Buffer.from(file as Uint8Array) : file;
+  form.append('file', filePart, { filename, contentType: options.mimeType });
+  if (options.context) form.append('context', JSON.stringify(options.context));
+  if (options.callbackUrl) form.append('callbackUrl', options.callbackUrl);
+  const headers = typeof form.getHeaders === 'function' ? form.getHeaders() : {};
+  return { form, headers };
+}
+
+/**
+ * `POST /scan` — SYNC by default, ASYNC when `options.mode = ProbeScanMode.ASYNC`
+ * (same endpoint, query-param-selected — see the controller's doc comment).
+ * `mode` and `organizationId` travel as query params; `context`
+ * (JSON-encoded) and `callbackUrl` travel as multipart text fields alongside
+ * the file.
+ *
+ * Returns the SYNC (200, verdict inline) or ASYNC (202, `{ scanId, status:
+ * 'queued' }`) shape depending on `options.mode` — see {@link IScanResponse}.
+ * Prefer {@link scanSync} / {@link scanAsync} for a precisely-typed return
+ * instead of the union.
+ */
+export const scan = async (
+  file: ProbeScanFileInput,
+  options: IScanOptions = {},
+  apiKey?: string,
+): Promise<IScanResponse> => {
+  const { form, headers } = await buildScanForm(file, options);
+  return (
+    await AbyssToolsCore.axios.post<IScanResponse>('scan', form, {
+      params: serializeProbeQuery({ mode: options.mode, organizationId: options.organizationId }),
+      headers: { ...headers, ...authHeader(apiKey) },
+      maxBodyLength: Infinity,
+      maxContentLength: Infinity,
+    })
+  ).data;
+};
+
+/** {@link scan}, forced to `mode: sync` — HTTP 200, verdict returned inline. */
+export const scanSync = async (
+  file: ProbeScanFileInput,
+  options: Omit<IScanOptions, 'mode' | 'callbackUrl'> = {},
+  apiKey?: string,
+): Promise<IScanSyncResponse> =>
+  scan(file, { ...options, mode: ProbeScanMode.SYNC }, apiKey) as Promise<IScanSyncResponse>;
+
+/** {@link scan}, forced to `mode: async` — HTTP 202, job queued. */
+export const scanAsync = async (
+  file: ProbeScanFileInput,
+  options: Omit<IScanOptions, 'mode'> = {},
+  apiKey?: string,
+): Promise<IScanAsyncResponse> =>
+  scan(file, { ...options, mode: ProbeScanMode.ASYNC }, apiKey) as Promise<IScanAsyncResponse>;
+
+/**
+ * `GET /scan/:scanId` — poll the queued -> scanning -> done/error
+ * progression of an ASYNC scan (also answers for a SYNC scan's row). Cross-
+ * tenant guarded server-side (404, never 403) — needs no scope query param,
+ * the scanId alone determines it.
+ */
+export const getScan = async (scanId: string, apiKey?: string): Promise<IGetScanResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IGetScanResponse>(`scan/${scanId}`, {
+      headers: authHeader(apiKey),
+    })
+  ).data;
+
+/**
+ * `GET /scan` — paginated scan history/search for the caller's scope
+ * (personal by default, `organizationId` for an organization scope), newest
+ * first. See {@link IListScansQuery} for the available filters.
+ */
+export const listScans = async (
+  query: IListScansQuery = {},
+  apiKey?: string,
+): Promise<IPaginateScanResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IPaginateScanResponse>('scan', {
+      params: serializeProbeQuery(query),
+      headers: authHeader(apiKey),
+    })
+  ).data;

package/src/api/probe-scan.application.api.test.ts

@@ -0,0 +1,21 @@
+// Type-level compile test for the probe-scan APPLICATION api surface.
+// No jest runner in this SDK package; compile guard only (mirrors
+// probe-scan.api.test.ts).
+// Run: npx tsc --noEmit (from packages/abyss_tools_core), or `npm run build`.
+
+import * as api from './probe-scan.application.api';
+
+// All five functions must be exported with these exact signatures.
+const _scan: typeof api.scanApplication = api.scanApplication;
+const _scanSync: typeof api.scanSyncApplication = api.scanSyncApplication;
+const _scanAsync: typeof api.scanAsyncApplication = api.scanAsyncApplication;
+const _getScan: typeof api.getScanApplication = api.getScanApplication;
+const _listScans: typeof api.listScansApplication = api.listScansApplication;
+
+void _scan;
+void _scanSync;
+void _scanAsync;
+void _getScan;
+void _listScans;
+
+export {};

package/src/api/probe-scan.application.api.ts

@@ -0,0 +1,157 @@
+// ──────────────────────────────────────────────
+// AbyssProbe APPLICATION scan API — POST /application/:applicationId/scan
+// (sync + async), GET /application/:applicationId/scan/:scanId (poll),
+// GET /application/:applicationId/scan (history/search). Mirrors
+// apps/api/src/api/controllers/probe-scan-application.controller.ts EXACTLY
+// (see that file for the full contract this client targets) — the
+// application counterpart of probe-scan.api.ts, for inter-service callers
+// (abyss-storage, external integrations) authenticating with a project API
+// key instead of a personal/org session.
+//
+// Reuses probe-scan.api.ts's `buildScanForm` (same dual-environment
+// multipart handling — browser `FormData`/`Blob` vs Node `Buffer`/stream +
+// lazy-required `form-data`) and every request/response TYPE verbatim
+// (`IScanOptions`, `IListScansQuery`, `IScanResponse`, `IScanSyncResponse`,
+// `IScanAsyncResponse`, `IGetScanResponse`, `IPaginateScanResponse`) — never
+// redefined here. `organizationId` is `Omit`'d from every option/query type
+// below: unlike the personal/org route's `?organization_id=` override, an
+// application caller's scope is entirely its `:applicationId` URL segment,
+// resolved server-side by ProbeApplicationMiddleware (round-trips to
+// abyss-main) — there is no scope query param to send.
+//
+// `authHeaderApplication` is kept LOCAL and unexported, same convention as
+// the personal/org client's own `authHeader` (see probe-scan.api.ts's header
+// comment) — it sends `API_KEY_APPLICATION_HEADER` (`abyss-api-key-
+// application`, imported from this package's root) instead of the personal
+// `abyss-api-key` header.
+// ──────────────────────────────────────────────
+
+import { AbyssToolsCore, API_KEY_APPLICATION_HEADER } from '..';
+import { ProbeScanMode } from '../types';
+import type {
+  IScanOptions,
+  IListScansQuery,
+  IScanResponse,
+  IScanSyncResponse,
+  IScanAsyncResponse,
+  IGetScanResponse,
+  IPaginateScanResponse,
+} from '../types';
+import { buildScanForm } from './probe-scan.api';
+import type { ProbeScanFileInput } from './probe-scan.api';
+
+function authHeaderApplication(applicationApiKey?: string): Record<string, string> {
+  return applicationApiKey ? { [API_KEY_APPLICATION_HEADER]: applicationApiKey } : {};
+}
+
+/**
+ * Turn a request/query options object into axios `params`: drops
+ * undefined/null and ISO-stringifies `Date`s. No key-renaming here (unlike
+ * probe-scan.api.ts#serializeProbeQuery's `organizationId` -> `organization_id`
+ * rename) — an application call never carries `organizationId` (`Omit`'d
+ * from every option/query type in this file), so there is nothing to rename.
+ */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    out[key] = value instanceof Date ? value.toISOString() : value;
+  }
+  return out;
+}
+
+/**
+ * `POST /application/:applicationId/scan` — SYNC by default, ASYNC when
+ * `options.mode = ProbeScanMode.ASYNC` (identical contract to {@link
+ * ../probe-scan.api.scan | the personal/org `scan`} — see that function's
+ * doc comment for the full sequence). `mode` travels as a query param;
+ * `context` (JSON-encoded) and `callbackUrl` travel as multipart text fields
+ * alongside the file.
+ *
+ * Returns the SYNC (200, verdict inline) or ASYNC (202, `{ scanId, status:
+ * 'queued' }`) shape depending on `options.mode` — see {@link IScanResponse}.
+ * Prefer {@link scanSyncApplication} / {@link scanAsyncApplication} for a
+ * precisely-typed return instead of the union.
+ */
+export const scanApplication = async (
+  applicationId: string,
+  file: ProbeScanFileInput,
+  options: Omit<IScanOptions, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IScanResponse> => {
+  const { form, headers } = await buildScanForm(file, options);
+  return (
+    await AbyssToolsCore.axios.post<IScanResponse>(`application/${applicationId}/scan`, form, {
+      params: serializeProbeQuery({ mode: options.mode }),
+      headers: { ...headers, ...authHeaderApplication(applicationApiKey) },
+      maxBodyLength: Infinity,
+      maxContentLength: Infinity,
+    })
+  ).data;
+};
+
+/** {@link scanApplication}, forced to `mode: sync` — HTTP 200, verdict returned inline. */
+export const scanSyncApplication = async (
+  applicationId: string,
+  file: ProbeScanFileInput,
+  options: Omit<IScanOptions, 'organizationId' | 'mode' | 'callbackUrl'> = {},
+  applicationApiKey?: string,
+): Promise<IScanSyncResponse> =>
+  scanApplication(
+    applicationId,
+    file,
+    { ...options, mode: ProbeScanMode.SYNC },
+    applicationApiKey,
+  ) as Promise<IScanSyncResponse>;
+
+/** {@link scanApplication}, forced to `mode: async` — HTTP 202, job queued. */
+export const scanAsyncApplication = async (
+  applicationId: string,
+  file: ProbeScanFileInput,
+  options: Omit<IScanOptions, 'organizationId' | 'mode'> = {},
+  applicationApiKey?: string,
+): Promise<IScanAsyncResponse> =>
+  scanApplication(
+    applicationId,
+    file,
+    { ...options, mode: ProbeScanMode.ASYNC },
+    applicationApiKey,
+  ) as Promise<IScanAsyncResponse>;
+
+/**
+ * `GET /application/:applicationId/scan/:scanId` — poll the queued ->
+ * scanning -> done/error progression of an ASYNC scan (also answers for a
+ * SYNC scan's row). Cross-tenant guarded server-side by a direct
+ * `applicationId` column comparison (404, never 403) — needs no scope
+ * argument beyond `applicationId` itself, the scanId alone determines the
+ * rest.
+ */
+export const getScanApplication = async (
+  applicationId: string,
+  scanId: string,
+  applicationApiKey?: string,
+): Promise<IGetScanResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IGetScanResponse>(
+      `application/${applicationId}/scan/${scanId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `GET /application/:applicationId/scan` — paginated scan history/search for
+ * the calling application, newest first. Same filters as the personal/org
+ * `GET /scan` minus `organizationId` (see {@link IListScansQuery}) — the
+ * `:applicationId` URL segment is already the entire scope.
+ */
+export const listScansApplication = async (
+  applicationId: string,
+  query: Omit<IListScansQuery, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IPaginateScanResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IPaginateScanResponse>(`application/${applicationId}/scan`, {
+      params: serializeProbeQuery(query),
+      headers: authHeaderApplication(applicationApiKey),
+    })
+  ).data;

package/src/api/probe-webhook.api.test.ts

@@ -0,0 +1,17 @@
+// Type-level compile test for the probe-webhook api surface.
+// No jest runner in this SDK package; compile guard only.
+// Run: npx tsc --noEmit (from packages/abyss_tools_core), or `npm run build`.
+
+import * as api from './probe-webhook.api';
+
+// All three functions must be exported — deliberately no update/reset-secret
+// (see probe-webhook.controller.ts's header comment on the small CRUD surface).
+const _create: typeof api.createProbeWebhook = api.createProbeWebhook;
+const _list: typeof api.listProbeWebhook = api.listProbeWebhook;
+const _delete: typeof api.deleteProbeWebhook = api.deleteProbeWebhook;
+
+void _create;
+void _list;
+void _delete;
+
+export {};

package/src/api/probe-webhook.api.ts

@@ -0,0 +1,81 @@
+// ──────────────────────────────────────────────
+// AbyssProbe webhook subscription API — CRUD over registered `probe_webhooks`
+// (create / list / delete only — no update, no reset-secret: mirrors
+// apps/api/src/api/controllers/probe-webhook.controller.ts's deliberately
+// small surface EXACTLY, see that file's header comment). No `probe/` path
+// prefix — `@Controller({ prefixPath: '/webhook' })` mounts directly at
+// `webhook`.
+//
+// See probe-webhook.application.api.ts for the application/API-key-auth
+// counterpart of this client (`/application/:applicationId/webhook...`,
+// Phase 3a) — it reuses every request/response type verbatim; only the URL
+// prefix, the extra `applicationId` argument, and the auth header differ.
+// ──────────────────────────────────────────────
+
+import { AbyssToolsCore } from '..';
+import type {
+  ICreateProbeWebhookBody,
+  IProbeWebhookScopeQuery,
+  ICreateProbeWebhookResponse,
+  IListProbeWebhookResponse,
+  IDeleteProbeWebhookResponse,
+} from '../types';
+
+const DEFAULT_API_KEY_HEADER = 'abyss-api-key';
+
+function authHeader(apiKey?: string): Record<string, string> {
+  return apiKey ? { [DEFAULT_API_KEY_HEADER]: apiKey } : {};
+}
+
+/** Renames `organizationId` to the wire's `organization_id` (see probe-scan.api.ts). */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    const wireKey = key === 'organizationId' ? 'organization_id' : key;
+    out[wireKey] = value instanceof Date ? value.toISOString() : value;
+  }
+  return out;
+}
+
+/**
+ * `POST /webhook` — register a callbackUrl for the caller's scope. The
+ * response's `secret` field (HMAC signing secret) is returned ONLY here —
+ * store it immediately, it cannot be re-revealed later.
+ */
+export const createProbeWebhook = async (
+  body: ICreateProbeWebhookBody,
+  scope: IProbeWebhookScopeQuery = {},
+  apiKey?: string,
+): Promise<ICreateProbeWebhookResponse> =>
+  (
+    await AbyssToolsCore.axios.post<ICreateProbeWebhookResponse>('webhook', body, {
+      params: serializeProbeQuery(scope),
+      headers: authHeader(apiKey),
+    })
+  ).data;
+
+/** `GET /webhook` — flat, scope-filtered list (not paginated — bounded by WEBHOOK_MAX_PER_SCOPE server-side). */
+export const listProbeWebhook = async (
+  scope: IProbeWebhookScopeQuery = {},
+  apiKey?: string,
+): Promise<IListProbeWebhookResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IListProbeWebhookResponse>('webhook', {
+      params: serializeProbeQuery(scope),
+      headers: authHeader(apiKey),
+    })
+  ).data;
+
+/** `DELETE /webhook/:webhookId`. */
+export const deleteProbeWebhook = async (
+  webhookId: string,
+  scope: IProbeWebhookScopeQuery = {},
+  apiKey?: string,
+): Promise<IDeleteProbeWebhookResponse> =>
+  (
+    await AbyssToolsCore.axios.delete<IDeleteProbeWebhookResponse>(`webhook/${webhookId}`, {
+      params: serializeProbeQuery(scope),
+      headers: authHeader(apiKey),
+    })
+  ).data;

package/src/api/probe-webhook.application.api.test.ts

@@ -0,0 +1,18 @@
+// Type-level compile test for the probe-webhook APPLICATION api surface.
+// No jest runner in this SDK package; compile guard only (mirrors
+// probe-webhook.api.test.ts).
+// Run: npx tsc --noEmit (from packages/abyss_tools_core), or `npm run build`.
+
+import * as api from './probe-webhook.application.api';
+
+// All three functions must be exported — deliberately no update/reset-secret
+// (see probe-webhook.api.ts's header comment on the small CRUD surface).
+const _create: typeof api.createProbeWebhookApplication = api.createProbeWebhookApplication;
+const _list: typeof api.listProbeWebhookApplication = api.listProbeWebhookApplication;
+const _delete: typeof api.deleteProbeWebhookApplication = api.deleteProbeWebhookApplication;
+
+void _create;
+void _list;
+void _delete;
+
+export {};

package/src/api/probe-webhook.application.api.ts

@@ -0,0 +1,87 @@
+// ──────────────────────────────────────────────
+// AbyssProbe APPLICATION webhook subscription API — CRUD over registered
+// `probe_webhooks` owned by a calling application (create / list / delete
+// only — no update, no reset-secret: same deliberately small surface as the
+// personal/org client, see probe-webhook.api.ts's header comment). Mirrors
+// apps/api/src/api/controllers/probe-webhook-application.controller.ts
+// EXACTLY — the application counterpart of probe-webhook.api.ts, for
+// inter-service callers (abyss-storage, external integrations)
+// authenticating with a project API key instead of a personal/org session.
+//
+// Reuses every request/response TYPE verbatim (`ICreateProbeWebhookBody`,
+// `ICreateProbeWebhookResponse`, `IListProbeWebhookResponse`,
+// `IDeleteProbeWebhookResponse`) — never redefined here. No scope
+// argument/query on any of these calls (unlike the personal/org client's
+// `IProbeWebhookScopeQuery`) — an application caller's scope is entirely its
+// `:applicationId` URL segment, resolved server-side by
+// ProbeApplicationMiddleware; there is nothing to select between.
+//
+// `authHeaderApplication` is kept LOCAL and unexported, same convention as
+// the personal/org client's own `authHeader` — it sends
+// `API_KEY_APPLICATION_HEADER` (`abyss-api-key-application`, imported from
+// this package's root) instead of the personal `abyss-api-key` header.
+// ──────────────────────────────────────────────
+
+import { AbyssToolsCore, API_KEY_APPLICATION_HEADER } from '..';
+import type {
+  ICreateProbeWebhookBody,
+  ICreateProbeWebhookResponse,
+  IListProbeWebhookResponse,
+  IDeleteProbeWebhookResponse,
+} from '../types';
+
+function authHeaderApplication(applicationApiKey?: string): Record<string, string> {
+  return applicationApiKey ? { [API_KEY_APPLICATION_HEADER]: applicationApiKey } : {};
+}
+
+/**
+ * `POST /application/:applicationId/webhook` — register a callbackUrl owned
+ * by the calling application. The response's `secret` field (HMAC signing
+ * secret) is returned ONLY here — store it immediately, it cannot be
+ * re-revealed later.
+ */
+export const createProbeWebhookApplication = async (
+  applicationId: string,
+  body: ICreateProbeWebhookBody,
+  applicationApiKey?: string,
+): Promise<ICreateProbeWebhookResponse> =>
+  (
+    await AbyssToolsCore.axios.post<ICreateProbeWebhookResponse>(
+      `application/${applicationId}/webhook`,
+      body,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `GET /application/:applicationId/webhook` — flat list of the calling
+ * application's own webhooks (not paginated — bounded by
+ * WEBHOOK_MAX_PER_SCOPE server-side).
+ */
+export const listProbeWebhookApplication = async (
+  applicationId: string,
+  applicationApiKey?: string,
+): Promise<IListProbeWebhookResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IListProbeWebhookResponse>(
+      `application/${applicationId}/webhook`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `DELETE /application/:applicationId/webhook/:webhookId` — cross-tenant
+ * guarded server-side by a direct `applicationId` comparison (404, never
+ * 403).
+ */
+export const deleteProbeWebhookApplication = async (
+  applicationId: string,
+  webhookId: string,
+  applicationApiKey?: string,
+): Promise<IDeleteProbeWebhookResponse> =>
+  (
+    await AbyssToolsCore.axios.delete<IDeleteProbeWebhookResponse>(
+      `application/${applicationId}/webhook/${webhookId}`,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;