@abyss-project/tools 2.2.0 → 2.4.0

package/dist/types/tests/probe.dto.test.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const __1 = require("..");
+const utils_1 = require("../../utils");
 const _verdicts = { clean: true, infected: true };
 const _modes = { sync: true, async: true };
 const _statuses = {
@@ -15,6 +16,13 @@ const _scanDetail = {
     verdict: __1.ProbeScanVerdict.CLEAN,
     viruses: [],
     context: null,
+    fileName: 'invoice.pdf',
+    fileSize: 1024,
+    mimeType: 'application/pdf',
+    mode: __1.ProbeScanMode.SYNC,
+    startedAt: new Date(),
+    finishedAt: new Date(),
+    costUnits: 3,
 };
 const _historyItem = {
     scanId: 's1',
@@ -28,27 +36,52 @@ const _historyItem = {
     context: { applicationFileId: 'af1' },
     startedAt: new Date(),
     finishedAt: new Date(),
+    costUnits: 1,
     createdAt: new Date(),
 };
 const _scanSyncData = {
     scanId: 's1',
     verdict: __1.ProbeScanVerdict.CLEAN,
     viruses: [],
+    costUnits: 3,
 };
 const _scanAsyncData = { scanId: 's1', status: __1.ProbeScanStatus.QUEUED };
 const _webhook = {
     id: 'w1',
     callbackUrl: 'https://example.com/hook',
+    secret: 'shh',
     active: true,
     createdAt: new Date(),
 };
-const _webhookCreated = { ..._webhook, secret: 'shh' };
+const _webhookCreated = _webhook;
+const _updateBody = { active: false };
+const _updateBody2 = { callbackUrl: 'https://example.com/hook2' };
 const _deliveryPayload = {
     scanId: 's1',
     context: null,
     verdict: __1.ProbeScanVerdict.INFECTED,
     viruses: ['Eicar-Test-Signature'],
+    costUnits: 5,
+};
+const _deliveryRecord = {
+    id: 'd1',
+    webhookId: 'w1',
+    scanId: 's1',
+    url: 'https://example.com/hook',
+    statusCode: 200,
+    success: true,
+    attemptedAt: new Date(),
+    error: null,
+    createdAt: new Date(),
 };
+const _deliveryRecordAdHoc = { ..._deliveryRecord, webhookId: null };
+const _usage = { used: 10, limit: 1000, remaining: 990 };
+const _usageUnlimited = { used: 10, limit: -1, remaining: -1 };
+const _asyncCost = (0, utils_1.estimateProbeScanCost)(5 * 1024 * 1024, __1.ProbeScanMode.ASYNC);
+const _syncCost = (0, utils_1.estimateProbeScanCost)(5 * 1024 * 1024, __1.ProbeScanMode.SYNC);
+if (_asyncCost >= _syncCost) {
+    throw new Error('estimateProbeScanCost: ASYNC must cost strictly less than SYNC');
+}
 void _verdicts;
 void _modes;
 void _statuses;
@@ -58,5 +91,11 @@ void _scanSyncData;
 void _scanAsyncData;
 void _webhook;
 void _webhookCreated;
+void _updateBody;
+void _updateBody2;
 void _deliveryPayload;
+void _deliveryRecord;
+void _deliveryRecordAdHoc;
+void _usage;
+void _usageUnlimited;
 //# sourceMappingURL=probe.dto.test.js.map

package/dist/types/tests/probe.dto.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"probe.dto.test.js","sourceRoot":"","sources":["../../../src/types/tests/probe.dto.test.ts"],"names":[],"mappings":";;AAOA,0BAWY;AAMZ,MAAM,SAAS,GAAmC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClF,MAAM,MAAM,GAAgC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxE,MAAM,SAAS,GAAkC;IAC/C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;CACZ,CAAC;AAGF,MAAM,WAAW,GAAqB;IACpC,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,mBAAe,CAAC,IAAI;IAC5B,OAAO,EAAE,oBAAgB,CAAC,KAAK;IAC/B,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,IAAI;CACd,CAAC;AAIF,MAAM,YAAY,GAA0B;IAC1C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,oBAAgB,CAAC,QAAQ;IAClC,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,IAAI,EAAE,iBAAa,CAAC,KAAK;IACzB,MAAM,EAAE,mBAAe,CAAC,IAAI;IAC5B,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACrC,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,UAAU,EAAE,IAAI,IAAI,EAAE;IACtB,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAGF,MAAM,aAAa,GAAkB;IACnC,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,oBAAgB,CAAC,KAAK;IAC/B,OAAO,EAAE,EAAE;CACZ,CAAC;AACF,MAAM,cAAc,GAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAe,CAAC,MAAM,EAAE,CAAC;AAGxF,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,IAAI;IACR,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AACF,MAAM,eAAe,GAAyB,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAI7E,MAAM,gBAAgB,GAAiC;IACrD,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,oBAAgB,CAAC,QAAQ;IAClC,OAAO,EAAE,CAAC,sBAAsB,CAAC;CAClC,CAAC;AAEF,KAAK,SAAS,CAAC;AACf,KAAK,MAAM,CAAC;AACZ,KAAK,SAAS,CAAC;AACf,KAAK,WAAW,CAAC;AACjB,KAAK,YAAY,CAAC;AAClB,KAAK,aAAa,CAAC;AACnB,KAAK,cAAc,CAAC;AACpB,KAAK,QAAQ,CAAC;AACd,KAAK,eAAe,CAAC;AACrB,KAAK,gBAAgB,CAAC"}
+{"version":3,"file":"probe.dto.test.js","sourceRoot":"","sources":["../../../src/types/tests/probe.dto.test.ts"],"names":[],"mappings":";;AAQA,0BAcY;AAKZ,uCAAoD;AAMpD,MAAM,SAAS,GAAmC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClF,MAAM,MAAM,GAAgC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxE,MAAM,SAAS,GAAkC;IAC/C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;CACZ,CAAC;AAIF,MAAM,WAAW,GAAqB;IACpC,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,mBAAe,CAAC,IAAI;IAC5B,OAAO,EAAE,oBAAgB,CAAC,KAAK;IAC/B,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,iBAAiB;IAC3B,IAAI,EAAE,iBAAa,CAAC,IAAI;IACxB,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,UAAU,EAAE,IAAI,IAAI,EAAE;IACtB,SAAS,EAAE,CAAC;CACb,CAAC;AAGF,MAAM,YAAY,GAA0B;IAC1C,MAAM,EAAE,IAAI;IACZ,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,iBAAiB;IAC3B,OAAO,EAAE,oBAAgB,CAAC,QAAQ;IAClC,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,IAAI,EAAE,iBAAa,CAAC,KAAK;IACzB,MAAM,EAAE,mBAAe,CAAC,IAAI;IAC5B,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;IACrC,SAAS,EAAE,IAAI,IAAI,EAAE;IACrB,UAAU,EAAE,IAAI,IAAI,EAAE;IACtB,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAGF,MAAM,aAAa,GAAkB;IACnC,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,oBAAgB,CAAC,KAAK;IAC/B,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,CAAC;CACb,CAAC;AACF,MAAM,cAAc,GAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAe,CAAC,MAAM,EAAE,CAAC;AAIxF,MAAM,QAAQ,GAAkB;IAC9B,EAAE,EAAE,IAAI;IACR,WAAW,EAAE,0BAA0B;IACvC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AACF,MAAM,eAAe,GAAyB,QAAQ,CAAC;AAGvD,MAAM,WAAW,GAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC/D,MAAM,YAAY,GAA4B,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;AAI3F,MAAM,gBAAgB,GAAiC;IACrD,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,oBAAgB,CAAC,QAAQ;IAClC,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,SAAS,EAAE,CAAC;CACb,CAAC;AAGF,MAAM,eAAe,GAA0B;IAC7C,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,0BAA0B;IAC/B,UAAU,EAAE,GAAG;IACf,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI,IAAI,EAAE;IACvB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI,IAAI,EAAE;CACtB,CAAC;AAEF,MAAM,oBAAoB,GAA0B,EAAE,GAAG,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAG5F,MAAM,MAAM,GAAoB,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAG1E,MAAM,eAAe,GAAoB,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;AAMhF,MAAM,UAAU,GAAW,IAAA,6BAAqB,EAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,iBAAa,CAAC,KAAK,CAAC,CAAC;AACvF,MAAM,SAAS,GAAW,IAAA,6BAAqB,EAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,iBAAa,CAAC,IAAI,CAAC,CAAC;AACrF,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;IAC5B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,SAAS,CAAC;AACf,KAAK,MAAM,CAAC;AACZ,KAAK,SAAS,CAAC;AACf,KAAK,WAAW,CAAC;AACjB,KAAK,YAAY,CAAC;AAClB,KAAK,aAAa,CAAC;AACnB,KAAK,cAAc,CAAC;AACpB,KAAK,QAAQ,CAAC;AACd,KAAK,eAAe,CAAC;AACrB,KAAK,WAAW,CAAC;AACjB,KAAK,YAAY,CAAC;AAClB,KAAK,gBAAgB,CAAC;AACtB,KAAK,eAAe,CAAC;AACrB,KAAK,oBAAoB,CAAC;AAC1B,KAAK,MAAM,CAAC;AACZ,KAAK,eAAe,CAAC"}

package/dist/utils/index.d.ts

@@ -5,3 +5,4 @@ export * from './icons.utils';
 export * from './enum.utils';
 export * from './extraction-webhook.utils';
 export * from './probe-webhook-signature.utils';
+export * from './probe-scan-cost.utils';

package/dist/utils/index.js

@@ -21,4 +21,5 @@ __exportStar(require("./icons.utils"), exports);
 __exportStar(require("./enum.utils"), exports);
 __exportStar(require("./extraction-webhook.utils"), exports);
 __exportStar(require("./probe-webhook-signature.utils"), exports);
+__exportStar(require("./probe-scan-cost.utils"), exports);
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,gDAA8B;AAC9B,gDAA8B;AAC9B,gDAA8B;AAC9B,+CAA6B;AAC7B,6DAA2C;AAC3C,kEAAgD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,gDAA8B;AAC9B,gDAA8B;AAC9B,gDAA8B;AAC9B,+CAA6B;AAC7B,6DAA2C;AAC3C,kEAAgD;AAChD,0DAAwC"}

package/dist/utils/probe-scan-cost.utils.d.ts

@@ -0,0 +1,5 @@
+import { ProbeScanMode } from '../types';
+export declare const PROBE_SCAN_COST_BASE = 1;
+export declare const PROBE_SCAN_COST_K_MB = 1;
+export declare const PROBE_SCAN_COST_MODE_WEIGHT: Record<ProbeScanMode, number>;
+export declare const estimateProbeScanCost: (sizeOctet: number, mode: ProbeScanMode | 'sync' | 'async') => number;

package/dist/utils/probe-scan-cost.utils.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.estimateProbeScanCost = exports.PROBE_SCAN_COST_MODE_WEIGHT = exports.PROBE_SCAN_COST_K_MB = exports.PROBE_SCAN_COST_BASE = void 0;
+const types_1 = require("../types");
+exports.PROBE_SCAN_COST_BASE = 1;
+exports.PROBE_SCAN_COST_K_MB = 1;
+exports.PROBE_SCAN_COST_MODE_WEIGHT = {
+    [types_1.ProbeScanMode.ASYNC]: 1,
+    [types_1.ProbeScanMode.SYNC]: 3,
+};
+const ONE_MB = 1024 * 1024;
+const estimateProbeScanCost = (sizeOctet, mode) => {
+    if (!Number.isFinite(sizeOctet) || sizeOctet <= 0) {
+        return 0;
+    }
+    const megabytes = Math.ceil(sizeOctet / ONE_MB);
+    const weight = exports.PROBE_SCAN_COST_MODE_WEIGHT[mode] ?? exports.PROBE_SCAN_COST_MODE_WEIGHT[types_1.ProbeScanMode.ASYNC];
+    return Math.round((exports.PROBE_SCAN_COST_BASE + exports.PROBE_SCAN_COST_K_MB * megabytes) * weight);
+};
+exports.estimateProbeScanCost = estimateProbeScanCost;
+//# sourceMappingURL=probe-scan-cost.utils.js.map

package/dist/utils/probe-scan-cost.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-scan-cost.utils.js","sourceRoot":"","sources":["../../src/utils/probe-scan-cost.utils.ts"],"names":[],"mappings":";;;AAuCA,oCAAyC;AAG5B,QAAA,oBAAoB,GAAG,CAAC,CAAC;AAGzB,QAAA,oBAAoB,GAAG,CAAC,CAAC;AAUzB,QAAA,2BAA2B,GAAkC;IACxE,CAAC,qBAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IACxB,CAAC,qBAAa,CAAC,IAAI,CAAC,EAAE,CAAC;CACxB,CAAC;AAGF,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;AA4BpB,MAAM,qBAAqB,GAAG,CACnC,SAAiB,EACjB,IAAsC,EAC9B,EAAE;IACV,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IAChD,MAAM,MAAM,GACV,mCAA2B,CAAC,IAAI,CAAC,IAAI,mCAA2B,CAAC,qBAAa,CAAC,KAAK,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,4BAAoB,GAAG,4BAAoB,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC;AACxF,CAAC,CAAC;AAXW,QAAA,qBAAqB,yBAWhC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abyss-project/tools",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Core package to interact with Abyss-Project Tools",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/api/index.ts

@@ -60,3 +60,5 @@ export * from './probe-scan.api';
 export * from './probe-webhook.api';
 export * from './probe-scan.application.api';
 export * from './probe-webhook.application.api';
+export * from './probe-usage.api';
+export * from './probe-usage.application.api';

package/src/api/probe-usage.api.ts

@@ -0,0 +1,47 @@
+// ──────────────────────────────────────────────
+// AbyssProbe usage API — WS5-3 (AbyssProbe UX rework). `GET /usage`: current
+// ACCOUNT_AV_SCAN_UNITS ("tokens") used/limit/remaining for the caller's
+// scope, via the same billing check the quota gate itself already uses (see
+// apps/api/src/utils/probe-scan-billing.util.ts#getProbeScanUsage). Mirrors
+// apps/api/src/api/controllers/probe-usage.controller.ts EXACTLY. No
+// `probe/` path prefix — `@Controller({ prefixPath: '/usage' })` mounts
+// directly at `usage`.
+//
+// See probe-usage.application.api.ts for the application/API-key-auth
+// counterpart (`/application/:applicationId/usage`, Phase 3a).
+// ──────────────────────────────────────────────
+
+import { AbyssToolsCore } from '..';
+import type { IProbeUsageScopeQuery, IProbeUsageResponse } from '../types';
+
+const DEFAULT_API_KEY_HEADER = 'abyss-api-key';
+
+function authHeader(apiKey?: string): Record<string, string> {
+  return apiKey ? { [DEFAULT_API_KEY_HEADER]: apiKey } : {};
+}
+
+/** Renames `organizationId` to the wire's `organization_id` (see probe-scan.api.ts). */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    const wireKey = key === 'organizationId' ? 'organization_id' : key;
+    out[wireKey] = value;
+  }
+  return out;
+}
+
+/**
+ * `GET /usage` — current ACCOUNT_AV_SCAN_UNITS consumption for the caller's
+ * scope (personal by default, `organizationId` for an organization scope).
+ */
+export const getProbeUsage = async (
+  scope: IProbeUsageScopeQuery = {},
+  apiKey?: string,
+): Promise<IProbeUsageResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IProbeUsageResponse>('usage', {
+      params: serializeProbeQuery(scope),
+      headers: authHeader(apiKey),
+    })
+  ).data;

package/src/api/probe-usage.application.api.ts

@@ -0,0 +1,25 @@
+// ──────────────────────────────────────────────
+// AbyssProbe APPLICATION usage API — WS5-3 (AbyssProbe UX rework). `GET
+// /application/:applicationId/usage`: current ACCOUNT_AV_SCAN_UNITS
+// consumption for the calling application's resolved billing organization.
+// Mirrors apps/api/src/api/controllers/probe-usage-application.controller.ts
+// EXACTLY — the application counterpart of probe-usage.api.ts.
+// ──────────────────────────────────────────────
+
+import { AbyssToolsCore, API_KEY_APPLICATION_HEADER } from '..';
+import type { IProbeUsageResponse } from '../types';
+
+function authHeaderApplication(applicationApiKey?: string): Record<string, string> {
+  return applicationApiKey ? { [API_KEY_APPLICATION_HEADER]: applicationApiKey } : {};
+}
+
+/** `GET /application/:applicationId/usage` — current ACCOUNT_AV_SCAN_UNITS consumption for the calling application. */
+export const getProbeUsageApplication = async (
+  applicationId: string,
+  applicationApiKey?: string,
+): Promise<IProbeUsageResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IProbeUsageResponse>(`application/${applicationId}/usage`, {
+      headers: authHeaderApplication(applicationApiKey),
+    })
+  ).data;

package/src/api/probe-webhook.api.ts

@@ -1,10 +1,9 @@
 // ──────────────────────────────────────────────
 // AbyssProbe webhook subscription API — CRUD over registered `probe_webhooks`
-// (create / list / delete only — no update, no reset-secret: mirrors
-// apps/api/src/api/controllers/probe-webhook.controller.ts's deliberately
-// small surface EXACTLY, see that file's header comment). No `probe/` path
-// prefix — `@Controller({ prefixPath: '/webhook' })` mounts directly at
-// `webhook`.
+// (create / list / delete / update, + paginated delivery history — mirrors
+// apps/api/src/api/controllers/probe-webhook.controller.ts EXACTLY, see that
+// file's header comment). No `probe/` path prefix — `@Controller({
+// prefixPath: '/webhook' })` mounts directly at `webhook`.
 //
 // See probe-webhook.application.api.ts for the application/API-key-auth
 // counterpart of this client (`/application/:applicationId/webhook...`,
@@ -15,10 +14,14 @@
 import { AbyssToolsCore } from '..';
 import type {
   ICreateProbeWebhookBody,
+  IUpdateProbeWebhookBody,
   IProbeWebhookScopeQuery,
+  IListProbeWebhookDeliveriesQuery,
   ICreateProbeWebhookResponse,
   IListProbeWebhookResponse,
   IDeleteProbeWebhookResponse,
+  IUpdateProbeWebhookResponse,
+  IListProbeWebhookDeliveriesResponse,
 } from '../types';
 
 const DEFAULT_API_KEY_HEADER = 'abyss-api-key';
@@ -79,3 +82,38 @@ export const deleteProbeWebhook = async (
       headers: authHeader(apiKey),
     })
   ).data;
+
+/**
+ * `PATCH /webhook/:webhookId` (WS5-5) — edit `callbackUrl` and/or `active`.
+ * At least one field is required. Scoped like {@link deleteProbeWebhook}
+ * (404, never 403, for a webhookId outside the resolved scope). The response
+ * includes `secret` — re-displayable now, see {@link IProbeWebhook}.
+ */
+export const updateProbeWebhook = async (
+  webhookId: string,
+  body: IUpdateProbeWebhookBody,
+  scope: IProbeWebhookScopeQuery = {},
+  apiKey?: string,
+): Promise<IUpdateProbeWebhookResponse> =>
+  (
+    await AbyssToolsCore.axios.patch<IUpdateProbeWebhookResponse>(`webhook/${webhookId}`, body, {
+      params: serializeProbeQuery(scope),
+      headers: authHeader(apiKey),
+    })
+  ).data;
+
+/**
+ * `GET /webhook/:webhookId/deliveries` (WS5-6) — paginated delivery-attempt
+ * history for one registered webhook. Scoped like {@link deleteProbeWebhook}.
+ */
+export const listProbeWebhookDeliveries = async (
+  webhookId: string,
+  query: IListProbeWebhookDeliveriesQuery = {},
+  apiKey?: string,
+): Promise<IListProbeWebhookDeliveriesResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IListProbeWebhookDeliveriesResponse>(
+      `webhook/${webhookId}/deliveries`,
+      { params: serializeProbeQuery(query), headers: authHeader(apiKey) },
+    )
+  ).data;

package/src/api/probe-webhook.application.api.ts

@@ -1,8 +1,8 @@
 // ──────────────────────────────────────────────
 // AbyssProbe APPLICATION webhook subscription API — CRUD over registered
-// `probe_webhooks` owned by a calling application (create / list / delete
-// only — no update, no reset-secret: same deliberately small surface as the
-// personal/org client, see probe-webhook.api.ts's header comment). Mirrors
+// `probe_webhooks` owned by a calling application (create / list / delete /
+// update, + paginated delivery history — same surface as the personal/org
+// client, see probe-webhook.api.ts's header comment). Mirrors
 // apps/api/src/api/controllers/probe-webhook-application.controller.ts
 // EXACTLY — the application counterpart of probe-webhook.api.ts, for
 // inter-service callers (abyss-storage, external integrations)
@@ -10,7 +10,9 @@
 //
 // Reuses every request/response TYPE verbatim (`ICreateProbeWebhookBody`,
 // `ICreateProbeWebhookResponse`, `IListProbeWebhookResponse`,
-// `IDeleteProbeWebhookResponse`) — never redefined here. No scope
+// `IDeleteProbeWebhookResponse`, `IUpdateProbeWebhookBody`,
+// `IUpdateProbeWebhookResponse`, `IListProbeWebhookDeliveriesQuery`,
+// `IListProbeWebhookDeliveriesResponse`) — never redefined here. No scope
 // argument/query on any of these calls (unlike the personal/org client's
 // `IProbeWebhookScopeQuery`) — an application caller's scope is entirely its
 // `:applicationId` URL segment, resolved server-side by
@@ -25,15 +27,29 @@
 import { AbyssToolsCore, API_KEY_APPLICATION_HEADER } from '..';
 import type {
   ICreateProbeWebhookBody,
+  IUpdateProbeWebhookBody,
+  IListProbeWebhookDeliveriesQuery,
   ICreateProbeWebhookResponse,
   IListProbeWebhookResponse,
   IDeleteProbeWebhookResponse,
+  IUpdateProbeWebhookResponse,
+  IListProbeWebhookDeliveriesResponse,
 } from '../types';
 
 function authHeaderApplication(applicationApiKey?: string): Record<string, string> {
   return applicationApiKey ? { [API_KEY_APPLICATION_HEADER]: applicationApiKey } : {};
 }
 
+/** Renames nothing (no `organizationId` ever travels on an application call) — drops undefined/null and ISO-stringifies `Date`s, mirroring probe-scan.application.api.ts's own local helper. */
+function serializeProbeQuery<T extends object>(query: T): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(query as Record<string, unknown>)) {
+    if (value === undefined || value === null) continue;
+    out[key] = value instanceof Date ? value.toISOString() : value;
+  }
+  return out;
+}
+
 /**
  * `POST /application/:applicationId/webhook` — register a callbackUrl owned
  * by the calling application. The response's `secret` field (HMAC signing
@@ -85,3 +101,41 @@ export const deleteProbeWebhookApplication = async (
       { headers: authHeaderApplication(applicationApiKey) },
     )
   ).data;
+
+/**
+ * `PATCH /application/:applicationId/webhook/:webhookId` (WS5-5) — edit
+ * `callbackUrl` and/or `active` on a webhook owned by the calling
+ * application. Cross-tenant guarded server-side (404, never 403). The
+ * response includes `secret` — re-displayable now, see {@link IProbeWebhook}.
+ */
+export const updateProbeWebhookApplication = async (
+  applicationId: string,
+  webhookId: string,
+  body: IUpdateProbeWebhookBody,
+  applicationApiKey?: string,
+): Promise<IUpdateProbeWebhookResponse> =>
+  (
+    await AbyssToolsCore.axios.patch<IUpdateProbeWebhookResponse>(
+      `application/${applicationId}/webhook/${webhookId}`,
+      body,
+      { headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;
+
+/**
+ * `GET /application/:applicationId/webhook/:webhookId/deliveries` (WS5-6) —
+ * paginated delivery-attempt history for one webhook owned by the calling
+ * application. Cross-tenant guarded server-side (404, never 403).
+ */
+export const listProbeWebhookDeliveriesApplication = async (
+  applicationId: string,
+  webhookId: string,
+  query: Omit<IListProbeWebhookDeliveriesQuery, 'organizationId'> = {},
+  applicationApiKey?: string,
+): Promise<IListProbeWebhookDeliveriesResponse> =>
+  (
+    await AbyssToolsCore.axios.get<IListProbeWebhookDeliveriesResponse>(
+      `application/${applicationId}/webhook/${webhookId}/deliveries`,
+      { params: serializeProbeQuery(query), headers: authHeaderApplication(applicationApiKey) },
+    )
+  ).data;

package/src/index.ts

@@ -36,6 +36,8 @@ import * as probeScanApi from './api/probe-scan.api';
 import * as probeWebhookApi from './api/probe-webhook.api';
 import * as probeScanApplicationApi from './api/probe-scan.application.api';
 import * as probeWebhookApplicationApi from './api/probe-webhook.application.api';
+import * as probeUsageApi from './api/probe-usage.api';
+import * as probeUsageApplicationApi from './api/probe-usage.application.api';
 
 export * from './api';
 export * from './types';
@@ -347,10 +349,18 @@ type AbyssToolsCoreSDK = {
     getScan: typeof probeScanApi.getScan;
     /** `GET /scan` — paginated history/search. */
     listScans: typeof probeScanApi.listScans;
+    /** `GET /usage` — current ACCOUNT_AV_SCAN_UNITS used/limit/remaining for the caller's scope. */
+    usage: {
+      get: typeof probeUsageApi.getProbeUsage;
+    };
     webhook: {
       create: typeof probeWebhookApi.createProbeWebhook;
       list: typeof probeWebhookApi.listProbeWebhook;
       delete: typeof probeWebhookApi.deleteProbeWebhook;
+      /** `PATCH /webhook/:webhookId` — edit callbackUrl and/or active. */
+      update: typeof probeWebhookApi.updateProbeWebhook;
+      /** `GET /webhook/:webhookId/deliveries` — paginated delivery-attempt history. */
+      listDeliveries: typeof probeWebhookApi.listProbeWebhookDeliveries;
     };
     /**
      * Application/API-key-auth counterpart (Phase 3a) — for inter-service
@@ -371,10 +381,18 @@ type AbyssToolsCoreSDK = {
       getScan: typeof probeScanApplicationApi.getScanApplication;
       /** `GET /application/:applicationId/scan` — paginated history/search. */
       listScans: typeof probeScanApplicationApi.listScansApplication;
+      /** `GET /application/:applicationId/usage` — current ACCOUNT_AV_SCAN_UNITS used/limit/remaining for the calling application. */
+      usage: {
+        get: typeof probeUsageApplicationApi.getProbeUsageApplication;
+      };
       webhook: {
         create: typeof probeWebhookApplicationApi.createProbeWebhookApplication;
         list: typeof probeWebhookApplicationApi.listProbeWebhookApplication;
         delete: typeof probeWebhookApplicationApi.deleteProbeWebhookApplication;
+        /** `PATCH /application/:applicationId/webhook/:webhookId` — edit callbackUrl and/or active. */
+        update: typeof probeWebhookApplicationApi.updateProbeWebhookApplication;
+        /** `GET /application/:applicationId/webhook/:webhookId/deliveries` — paginated delivery-attempt history. */
+        listDeliveries: typeof probeWebhookApplicationApi.listProbeWebhookDeliveriesApplication;
       };
     };
   };
@@ -775,10 +793,15 @@ export class AbyssToolsCore {
         scanAsync: probeScanApi.scanAsync,
         getScan: probeScanApi.getScan,
         listScans: probeScanApi.listScans,
+        usage: {
+          get: probeUsageApi.getProbeUsage,
+        },
         webhook: {
           create: probeWebhookApi.createProbeWebhook,
           list: probeWebhookApi.listProbeWebhook,
           delete: probeWebhookApi.deleteProbeWebhook,
+          update: probeWebhookApi.updateProbeWebhook,
+          listDeliveries: probeWebhookApi.listProbeWebhookDeliveries,
         },
         application: {
           scan: probeScanApplicationApi.scanApplication,
@@ -786,10 +809,15 @@ export class AbyssToolsCore {
           scanAsync: probeScanApplicationApi.scanAsyncApplication,
           getScan: probeScanApplicationApi.getScanApplication,
           listScans: probeScanApplicationApi.listScansApplication,
+          usage: {
+            get: probeUsageApplicationApi.getProbeUsageApplication,
+          },
           webhook: {
             create: probeWebhookApplicationApi.createProbeWebhookApplication,
             list: probeWebhookApplicationApi.listProbeWebhookApplication,
             delete: probeWebhookApplicationApi.deleteProbeWebhookApplication,
+            update: probeWebhookApplicationApi.updateProbeWebhookApplication,
+            listDeliveries: probeWebhookApplicationApi.listProbeWebhookDeliveriesApplication,
           },
         },
       },

package/src/types/enum/beam.enum.ts

@@ -20,7 +20,23 @@ export enum BeamServeDenyReasonCode {
   FORBIDDEN_VISIBILITY = 'forbidden_visibility',
   MAX_DOWNLOADS = 'max_downloads',
   SCAN_PENDING = 'scan_pending',
-  SCAN_INFECTED = 'scan_infected',
+}
+
+// Per-file AV verdict surfaced on the public listing (GET /b/:slug) so the
+// front can render a per-file badge — clean / "en analyse" (pending) /
+// "infecté" — independently of the whole-transfer denial reason above.
+// Storage-neutral: AbyssBeam serves an INFECTED file's bytes (spec decision —
+// infected files stay downloadable, not blocked; the front is expected to
+// warn before/at download). Mirrors the storage extension's `FileScanStatus`
+// (`@abyss-project/storage`) byte-for-byte; duplicated locally because this
+// package does not depend on `@abyss-project/storage` (same rationale as
+// BeamServeDenyReasonCode above).
+export enum BeamFileScanStatus {
+  PENDING_SCAN = 'pending_scan',
+  CLEAN = 'clean',
+  INFECTED = 'infected',
+  SKIPPED = 'skipped',
+  ERROR = 'error',
 }
 
 // What a beam_download_events row counted: a single-file download (/b/:slug/

package/src/types/interface/api/requests/index.ts

@@ -29,3 +29,4 @@ export * from './transfer.request';
 export * from './extraction.request';
 export * from './probe-scan.request';
 export * from './probe-webhook.request';
+export * from './probe-usage.request';

package/src/types/interface/api/requests/probe-usage.request.ts

@@ -0,0 +1,7 @@
+// WS5-3 (AbyssProbe UX rework) — `GET /usage` / `GET /application/:applicationId/usage`.
+// Mirrors apps/api/src/api/validators/probe-usage.validator.ts's Joi schema.
+
+/** `GET /usage` query — personal scope (default) or an organization. Not needed for the application variant (its scope is the `:applicationId` URL segment). */
+export interface IProbeUsageScopeQuery {
+  organizationId?: string;
+}

package/src/types/interface/api/requests/probe-webhook.request.ts

@@ -1,7 +1,8 @@
 // Mirrors apps/api/src/api/controllers/probe-webhook.controller.ts's
-// ScopeQuery/CreateBody and probe-webhook.validator.ts's Joi schemas.
+// ScopeQuery/CreateBody/UpdateBody and probe-webhook.validator.ts's Joi
+// schemas.
 
-/** Shared by create/list/delete — personal scope (default) or an organization. */
+/** Shared by create/list/delete/update — personal scope (default) or an organization. */
 export interface IProbeWebhookScopeQuery {
   organizationId?: string;
 }
@@ -10,3 +11,23 @@ export interface ICreateProbeWebhookBody {
   /** HTTPS endpoint the verdict is POSTed to. Required, `https://` only. */
   callbackUrl: string;
 }
+
+/**
+ * `PATCH /webhook/:webhookId` body (WS5-5) — at least one field required
+ * (mirrors probe-webhook.validator.ts#updateBody's `.min(1)`); omitted
+ * fields are left unchanged.
+ */
+export interface IUpdateProbeWebhookBody {
+  /** HTTPS endpoint the verdict is POSTed to, `https://` only. */
+  callbackUrl?: string;
+  /** Disabled webhooks are skipped by dispatch (soft-off, not deleted). */
+  active?: boolean;
+}
+
+/** `GET /webhook/:webhookId/deliveries` query (WS5-6) — paginated. */
+export interface IListProbeWebhookDeliveriesQuery extends IProbeWebhookScopeQuery {
+  /** @default 1 */
+  page?: number;
+  /** @default 20 */
+  limit?: number;
+}

package/src/types/interface/api/responses/beam.response.ts

@@ -2,7 +2,12 @@ import { BasePaginate } from '../type-message/base-paginate';
 import { IResponse } from '../type-message/response';
 import { IBeamTransfer, IBeamFile, IBeamRecipient } from '../../models/beam.dto';
 import { IContentShare } from '../../models/content-share.dto';
-import { BeamVisibility, BeamServeDenyReasonCode, BeamDownloadKind } from '../../../enum/beam.enum';
+import {
+  BeamVisibility,
+  BeamServeDenyReasonCode,
+  BeamDownloadKind,
+  BeamFileScanStatus,
+} from '../../../enum/beam.enum';
 
 export interface IGetBeamData {
   beamTransfer: IBeamTransfer;
@@ -39,6 +44,9 @@ export type IFinalizeBeamResponse = IResponse<IFinalizeBeamData>;
 // Public serving (B3) — safe, purpose-built projection of a transfer for the
 // browser-facing view: no owner ids, no password/manage hashes; adds
 // hasPassword/isLocked/hasThumbnail so the front can render the locked state.
+// `scanStatus` is the per-file AV verdict (storage-neutral — an INFECTED file
+// is still listed and downloadable; the front renders the warning from this
+// field, see BeamFileScanStatus).
 export interface IBeamPublicFile {
   id: string;
   name: string;
@@ -48,6 +56,7 @@ export interface IBeamPublicFile {
   hasThumbnail: boolean;
   width: number | null;
   height: number | null;
+  scanStatus: BeamFileScanStatus;
 }
 
 export interface IBeamPublicView {

package/src/types/interface/api/responses/index.ts

@@ -33,3 +33,4 @@ export * from './extraction.response';
 export * from './monitor.response';
 export * from './probe-scan.response';
 export * from './probe-webhook.response';
+export * from './probe-usage.response';

package/src/types/interface/api/responses/probe-scan.response.ts

@@ -12,6 +12,13 @@ export interface IScanSyncData {
   scanId: string;
   verdict: ProbeScanVerdict;
   viruses: string[];
+  /**
+   * `ACCOUNT_AV_SCAN_UNITS` this scan consumed (WS5-1/2 — see
+   * `estimateProbeScanCost`). Always a number here (never null): a SYNC
+   * response is only ever sent once the scan has reached a verdict, at
+   * which point the cost is always known and already billed.
+   */
+  costUnits: number;
 }
 export type IScanSyncResponse = IResponse<IScanSyncData>;
 

package/src/types/interface/api/responses/probe-usage.response.ts

@@ -0,0 +1,25 @@
+import { IResponse } from '../type-message/response';
+
+// WS5-3 (AbyssProbe UX rework) — mirrors
+// apps/api/src/api/controllers/probe-usage.controller.ts's local response
+// shape EXACTLY. Current ACCOUNT_AV_SCAN_UNITS ("tokens") consumption for the
+// caller's scope, via the same billing check the quota gate itself uses.
+
+export interface IProbeUsageData {
+  /** Units consumed so far in the current billing period. */
+  used: number;
+  /**
+   * Plan cap. `-1` is this codebase's established "unlimited" sentinel (see
+   * `utils/billing-emit.util.ts#UNLIMITED_EXPIRY_DAYS` server-side) — an
+   * unmetered plan tier reports `-1` here rather than `Infinity`/`null`, so
+   * treat a negative value as "no cap", never a literal negative quota.
+   */
+  limit: number;
+  /**
+   * `limit - used`, floored at 0 — except it mirrors `limit`'s own `-1`
+   * sentinel unchanged when `limit` is unlimited (never a finite number in
+   * that case).
+   */
+  remaining: number;
+}
+export type IProbeUsageResponse = IResponse<IProbeUsageData>;