@antasphere/chassis-server 1.1.0 → 1.3.0

package/dist/tool-definition.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-definition.js","sourceRoot":"","sources":["../src/tool-definition.ts"],"names":[],"mappings":"AAkaA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAA0B;IACvD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC3E,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,WAAW,CAAU,EAAE,CAAC;QAC3E,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qCAAqC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,iBAAiB,CAAU,EAAE,CAAC;QAC1E,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,gCAAgC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAkC;IACnE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnF,MAAM,CAAC,GAAG,QACe,CAAC;IAC1B,MAAM,MAAM,GAA6B;QACvC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC;QAC9B,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAChC,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;QAC/B,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,CAAC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC;QAC3C,CAAC,mBAAmB,EAAE,CAAC,CAAC,iBAAiB,CAAC;QAC1C,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC;QACvB,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC;QACnC,CAAC,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC;QAC/C,CAAC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;QACrC,CAAC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;QACrC,CAAC,iBAAiB,EAAE,CAAC,CAAC,eAAe,CAAC;QACtC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,mCAAmC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-definition.js","sourceRoot":"","sources":["../src/tool-definition.ts"],"names":[],"mappings":"AA+bA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAA0B;IACvD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC3E,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,aAAa,EAAE,WAAW,CAAU,EAAE,CAAC;QAC3E,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qCAAqC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,iBAAiB,CAAU,EAAE,CAAC;QAC1E,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,gCAAgC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAkC;IACnE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACnF,MAAM,CAAC,GAAG,QACe,CAAC;IAC1B,MAAM,MAAM,GAA6B;QACvC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC,aAAa,EAAE,CAAC,CAAC,WAAW,CAAC;QAC9B,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC;QAChC,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;QAC/B,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,CAAC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC;QAC3C,CAAC,mBAAmB,EAAE,CAAC,CAAC,iBAAiB,CAAC;QAC1C,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC;QACvB,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC;QACnC,CAAC,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC;QAC/C,CAAC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;QACrC,CAAC,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;QACrC,CAAC,iBAAiB,EAAE,CAAC,CAAC,eAAe,CAAC;QACtC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,mCAAmC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/webhooks/catalog.d.ts

@@ -0,0 +1,80 @@
+import { z } from 'zod';
+import type { WebhookCatalog } from '@antasphere/chassis-contract';
+/**
+ * The event catalog (PRDCT-3482): what an instance can deliver to a webhook
+ * endpoint. The TOOL declares its events through the `webhooks` slot of its
+ * definition (its subjects, its event types, the zod schema of each event's
+ * `data`); the chassis adds its own events, checks the whole at boot, matches
+ * subscriptions against it and serves it on `GET /webhooks/events` with the
+ * JSON Schema of every payload, so an agent discovers the types and the
+ * shapes without reading a page of documentation.
+ *
+ * A SUBJECT is a filterable key the tool exposes (`thing`, `project`): an
+ * endpoint narrows its subscription to a list of ids per subject, and the
+ * envelope carries each subject's value under the FIELD the tool names for it
+ * (`thingId`, `projectIds`). An event declares which subjects it carries. A
+ * subject's value in the envelope is one id, or always a list of ids when
+ * the subject is declared `list` (the shape never varies per event).
+ */
+/** One filterable key of the tool, as the slot declares it. */
+export interface WebhookSubjectDeclaration {
+    /** The envelope field the subject's value is written under (`thingId`, `projectIds`). */
+    field: string;
+    description: string;
+    /**
+     * The subject's value is a LIST of ids (a thing in several projects): the
+     * envelope always writes an array under the field, a single id included.
+     * Absent: one id, always a string; a list is refused at emit.
+     */
+    list?: boolean;
+}
+/** One event type of the tool, as the slot declares it. */
+export interface WebhookEventDeclaration {
+    /** `thing.created`: a lowercase family, a dot, a lowercase verb. */
+    type: string;
+    description: string;
+    /** The subjects this event carries, by key; every one must be declared in `subjects`. */
+    subjects: readonly string[];
+    /** The schema of the event's `data`, validated at emit (a mismatch is a bug, logged and skipped). */
+    data: z.ZodType;
+}
+/** The `webhooks` slot of a tool definition. */
+export interface WebhookCatalogDeclaration {
+    subjects: Readonly<Record<string, WebhookSubjectDeclaration>>;
+    events: readonly WebhookEventDeclaration[];
+}
+/** The value one emit gives a subject: one id, or a list (a thing in several projects). */
+export type WebhookSubjectValue = string | readonly string[];
+/** An event type: `family.verb`, lowercase, digits and underscores allowed after the first letter. */
+export declare const WEBHOOK_EVENT_TYPE: RegExp;
+/** The test ping every endpoint can be sent (`POST /webhooks/{id}/test`). */
+export declare const WEBHOOK_PING_EVENT = "webhook.ping";
+/**
+ * The chassis's own events: what the generic half knows happened, bridged
+ * from the in-process bus (member, workspace, key events) or emitted inside
+ * the write's transaction where the chassis owns it (projects, the ping).
+ * None names a tool. A tool may not re-declare one of these types.
+ */
+export declare const CHASSIS_WEBHOOK_EVENTS: readonly WebhookEventDeclaration[];
+/**
+ * The chassis's own subject: a project, which every tool has (the chassis
+ * owns projects). A tool that declares `project` itself may name another
+ * field for it (`projectIds`, a list); the chassis's project events follow.
+ */
+export declare const CHASSIS_WEBHOOK_SUBJECTS: Readonly<Record<string, WebhookSubjectDeclaration>>;
+/** The merged, checked catalog an instance runs on. */
+export interface WebhookCatalogIndex {
+    subjects: Readonly<Record<string, WebhookSubjectDeclaration>>;
+    events: ReadonlyMap<string, WebhookEventDeclaration>;
+}
+/**
+ * Merge the chassis's events with the tool's and check the whole, at boot:
+ * a type that is not `family.verb`, a type declared twice (or re-declaring a
+ * chassis type), a subject key that is not a plain identifier, an event
+ * carrying a subject nobody declared, or the chassis's `project` subject
+ * declared under another field, stops the boot naming the fault.
+ */
+export declare function buildWebhookCatalog(tool: WebhookCatalogDeclaration | undefined): WebhookCatalogIndex;
+/** The catalog as `GET /webhooks/events` answers it: every event with the JSON Schema of its data. */
+export declare function catalogToWire(catalog: WebhookCatalogIndex): WebhookCatalog;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/webhooks/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/webhooks/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE;;;;;;;;;;;;;;;GAeG;AAEH,+DAA+D;AAC/D,MAAM,WAAW,yBAAyB;IACxC,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,qGAAqG;IACrG,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;CACjB;AAED,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC9D,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC5C;AAED,2FAA2F;AAC3F,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;AAE7D,sGAAsG;AACtG,eAAO,MAAM,kBAAkB,QAAuC,CAAC;AAGvE,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,uBAAuB,EAmDpE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAExF,CAAC;AAEF,uDAAuD;AACvD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC9D,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;CACtD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,GAAG,SAAS,GAAG,mBAAmB,CA0CpG;AAED,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,cAAc,CAkB1E"}

package/dist/webhooks/catalog.js

@@ -0,0 +1,134 @@
+import { z } from 'zod';
+/** An event type: `family.verb`, lowercase, digits and underscores allowed after the first letter. */
+export const WEBHOOK_EVENT_TYPE = /^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$/;
+const SUBJECT_KEY = /^[a-z][a-z0-9_]*$/;
+/** The test ping every endpoint can be sent (`POST /webhooks/{id}/test`). */
+export const WEBHOOK_PING_EVENT = 'webhook.ping';
+/**
+ * The chassis's own events: what the generic half knows happened, bridged
+ * from the in-process bus (member, workspace, key events) or emitted inside
+ * the write's transaction where the chassis owns it (projects, the ping).
+ * None names a tool. A tool may not re-declare one of these types.
+ */
+export const CHASSIS_WEBHOOK_EVENTS = [
+    {
+        type: WEBHOOK_PING_EVENT,
+        description: 'A test delivery, sent on request from the endpoint page or the API.',
+        subjects: [],
+        data: z.object({ endpointId: z.string(), sentBy: z.string().nullable() })
+    },
+    {
+        type: 'member.joined',
+        description: 'A person joined the workspace by accepting an invitation.',
+        subjects: [],
+        data: z.object({ userId: z.string(), role: z.string() })
+    },
+    {
+        type: 'member.removed',
+        description: 'A person was removed from the workspace by an owner or an admin.',
+        subjects: [],
+        data: z.object({ userId: z.string() })
+    },
+    {
+        type: 'workspace.created',
+        description: 'A workspace was created from inside the product.',
+        subjects: [],
+        data: z.object({ ownerUserId: z.string() })
+    },
+    {
+        type: 'apikey.created',
+        description: 'An API key was created on the API keys page or through the API (not the command line’s own sign-in key).',
+        subjects: [],
+        data: z.object({ apiKeyId: z.string() })
+    },
+    {
+        type: 'apikey.revoked',
+        description: 'An API key of the workspace was revoked from the API keys page or through the API (not a key revoking itself at logout).',
+        subjects: [],
+        data: z.object({ apiKeyId: z.string() })
+    },
+    {
+        type: 'project.created',
+        description: 'A project was created in the workspace.',
+        subjects: ['project'],
+        data: z.object({ projectId: z.string(), name: z.string(), createdBy: z.string() })
+    },
+    {
+        type: 'project.archived',
+        description: 'A project of the workspace was archived.',
+        subjects: ['project'],
+        data: z.object({ projectId: z.string(), name: z.string() })
+    }
+];
+/**
+ * The chassis's own subject: a project, which every tool has (the chassis
+ * owns projects). A tool that declares `project` itself may name another
+ * field for it (`projectIds`, a list); the chassis's project events follow.
+ */
+export const CHASSIS_WEBHOOK_SUBJECTS = {
+    project: { field: 'projectId', description: 'A project of the workspace, by id' }
+};
+/**
+ * Merge the chassis's events with the tool's and check the whole, at boot:
+ * a type that is not `family.verb`, a type declared twice (or re-declaring a
+ * chassis type), a subject key that is not a plain identifier, an event
+ * carrying a subject nobody declared, or the chassis's `project` subject
+ * declared under another field, stops the boot naming the fault.
+ */
+export function buildWebhookCatalog(tool) {
+    const subjects = { ...CHASSIS_WEBHOOK_SUBJECTS };
+    for (const [key, subject] of Object.entries(tool?.subjects ?? {})) {
+        if (!SUBJECT_KEY.test(key)) {
+            throw new Error(`tool definition: webhooks.subjects key "${key}" must match ${SUBJECT_KEY}`);
+        }
+        if (typeof subject.field !== 'string' || subject.field === '') {
+            throw new Error(`tool definition: webhooks.subjects.${key}.field is required (the envelope field)`);
+        }
+        // A tool may re-declare the chassis's `project` subject under its own
+        // field (a tool whose things belong to several projects writes a list
+        // under `projectIds`); the chassis's own project events then write
+        // their one id under that field too. A subject's value is one id or a
+        // list of ids, and the catalog says so.
+        subjects[key] = subject;
+    }
+    const events = new Map();
+    for (const event of [...CHASSIS_WEBHOOK_EVENTS, ...(tool?.events ?? [])]) {
+        if (!WEBHOOK_EVENT_TYPE.test(event.type)) {
+            throw new Error(`tool definition: webhooks event type "${event.type}" must be family.verb (${WEBHOOK_EVENT_TYPE})`);
+        }
+        if (events.has(event.type)) {
+            throw new Error(`tool definition: webhooks event type "${event.type}" is declared twice`);
+        }
+        if (event.type === '*' || event.type.endsWith('.*')) {
+            throw new Error(`tool definition: webhooks event type "${event.type}" is a pattern, not a type`);
+        }
+        for (const key of event.subjects) {
+            if (!(key in subjects)) {
+                throw new Error(`tool definition: webhooks event "${event.type}" carries the subject "${key}", which webhooks.subjects does not declare`);
+            }
+        }
+        if (typeof event.description !== 'string' || event.description === '') {
+            throw new Error(`tool definition: webhooks event "${event.type}" needs a description`);
+        }
+        events.set(event.type, event);
+    }
+    return { subjects, events };
+}
+/** The catalog as `GET /webhooks/events` answers it: every event with the JSON Schema of its data. */
+export function catalogToWire(catalog) {
+    return {
+        subjects: Object.entries(catalog.subjects).map(([key, s]) => ({
+            key,
+            field: s.field,
+            description: s.description,
+            list: s.list === true
+        })),
+        events: [...catalog.events.values()].map((e) => ({
+            type: e.type,
+            description: e.description,
+            subjects: [...e.subjects],
+            schema: z.toJSONSchema(e.data, { target: 'draft-2020-12', unrepresentable: 'any' })
+        }))
+    };
+}
+//# sourceMappingURL=catalog.js.map

package/dist/webhooks/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/webhooks/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqDxB,sGAAsG;AACtG,MAAM,CAAC,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AACvE,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,qEAAqE;QAClF,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KAC1E;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,2DAA2D;QACxE,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACzD;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,kEAAkE;QAC/E,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACvC;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,kDAAkD;QAC/D,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC5C;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,0GAA0G;QAC5G,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,0HAA0H;QAC5H,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACzC;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,yCAAyC;QACtD,QAAQ,EAAE,CAAC,SAAS,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACnF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,0CAA0C;QACvD,QAAQ,EAAE,CAAC,SAAS,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC5D;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwD;IAC3F,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,mCAAmC,EAAE;CAClF,CAAC;AAQF;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA2C;IAC7E,MAAM,QAAQ,GAA8C,EAAE,GAAG,wBAAwB,EAAE,CAAC;IAC5F,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,gBAAgB,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,yCAAyC,CAAC,CAAC;QACtG,CAAC;QACD,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,wCAAwC;QACxC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,sBAAsB,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,yCAAyC,KAAK,CAAC,IAAI,0BAA0B,kBAAkB,GAAG,CACnG,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,qBAAqB,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACnG,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,CAAC,IAAI,0BAA0B,GAAG,6CAA6C,CACzH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,IAAI,uBAAuB,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,GAAG;YACH,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI;SACtB,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACzB,MAAM,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,EAAE,CAGjF;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/webhooks/index.d.ts

@@ -0,0 +1,9 @@
+export { buildWebhookCatalog, catalogToWire, CHASSIS_WEBHOOK_EVENTS, CHASSIS_WEBHOOK_SUBJECTS, WEBHOOK_EVENT_TYPE, WEBHOOK_PING_EVENT, type WebhookCatalogDeclaration, type WebhookCatalogIndex, type WebhookEventDeclaration, type WebhookSubjectDeclaration, type WebhookSubjectValue } from './catalog.js';
+export { endpointWants, matchesEventType, matchesFilters } from './match.js';
+export { checkWebhookUrl, isPublicAddress, safePost, WebhookUrlRefusedError, type SafeFetchOptions, type SafeFetchPolicy, type SafeFetchResult, type SafeLookup, type SafeTransport, type WebhookUrlRefusal } from './safe-fetch.js';
+export { generateWebhookSecret, signWebhook, SigningError, verifyWebhookSignature, WEBHOOK_SECRET_PREFIX, webhookHeaders, webhookSecretKey } from './signing.js';
+export { DEFAULT_WEBHOOK_DIALS, deliveryToWire, endpointToWire, WEBHOOK_DELIVERIES_HELD_QUEUE, WEBHOOK_DELIVERIES_QUEUE, WEBHOOK_EVENTS_QUEUE, WEBHOOK_PURGE_QUEUE, WEBHOOK_SECRET_BOX_INFO, MAX_IN_FLIGHT_PER_ENDPOINT, WebhookDeliveryDeferred, WebhookDeliveryFailed, WebhookRefusedError, WebhookService, type WebhookDials, type WebhookEmit, type WebhookEmitter, type WebhookEventJob, type WebhookServiceDeps } from './service.js';
+export { webhookJobs } from './jobs.js';
+export { buildWebhookDisabledEmail, type WebhookDisabledEmailParams } from './mail.js';
+export { connectionOf, drizzleExecutor, sendInTx } from './tx-send.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EACL,eAAe,EACf,eAAe,EACf,QAAQ,EACR,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,6BAA6B,EAC7B,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,KAAK,0BAA0B,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC"}

package/dist/webhooks/index.js

@@ -0,0 +1,9 @@
+export { buildWebhookCatalog, catalogToWire, CHASSIS_WEBHOOK_EVENTS, CHASSIS_WEBHOOK_SUBJECTS, WEBHOOK_EVENT_TYPE, WEBHOOK_PING_EVENT } from './catalog.js';
+export { endpointWants, matchesEventType, matchesFilters } from './match.js';
+export { checkWebhookUrl, isPublicAddress, safePost, WebhookUrlRefusedError } from './safe-fetch.js';
+export { generateWebhookSecret, signWebhook, SigningError, verifyWebhookSignature, WEBHOOK_SECRET_PREFIX, webhookHeaders, webhookSecretKey } from './signing.js';
+export { DEFAULT_WEBHOOK_DIALS, deliveryToWire, endpointToWire, WEBHOOK_DELIVERIES_HELD_QUEUE, WEBHOOK_DELIVERIES_QUEUE, WEBHOOK_EVENTS_QUEUE, WEBHOOK_PURGE_QUEUE, WEBHOOK_SECRET_BOX_INFO, MAX_IN_FLIGHT_PER_ENDPOINT, WebhookDeliveryDeferred, WebhookDeliveryFailed, WebhookRefusedError, WebhookService } from './service.js';
+export { webhookJobs } from './jobs.js';
+export { buildWebhookDisabledEmail } from './mail.js';
+export { connectionOf, drizzleExecutor, sendInTx } from './tx-send.js';
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAMnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EACL,eAAe,EACf,eAAe,EACf,QAAQ,EACR,sBAAsB,EAOvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,6BAA6B,EAC7B,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EAMf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAmC,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC"}

package/dist/webhooks/jobs.d.ts

@@ -0,0 +1,12 @@
+import type { JobDeclaration } from '../jobs/pgboss.js';
+import type { Logger } from '../logger.js';
+import { type WebhookService } from './service.js';
+/**
+ * The four queues of the webhooks, declared to the job runtime like a tool's
+ * own (`createJobs` installs them in the same lock section, in this order):
+ * the held queue FIRST so the delivery queue can name it as its dead letter
+ * (pg-boss's job row holds a foreign key on it), then the fan-out, the
+ * delivery with its retry budget, and the nightly purge.
+ */
+export declare function webhookJobs(service: WebhookService, logger: Logger, retentionDays: number): JobDeclaration[];
+//# sourceMappingURL=jobs.d.ts.map

package/dist/webhooks/jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../src/webhooks/jobs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAEtB;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,cAAc,EAAE,CAkElB"}

package/dist/webhooks/jobs.js

@@ -0,0 +1,77 @@
+import { WEBHOOK_DELIVERIES_HELD_QUEUE, WEBHOOK_DELIVERIES_QUEUE, WEBHOOK_EVENTS_QUEUE, WEBHOOK_PURGE_QUEUE, WebhookDeliveryDeferred, WebhookDeliveryFailed } from './service.js';
+/**
+ * The four queues of the webhooks, declared to the job runtime like a tool's
+ * own (`createJobs` installs them in the same lock section, in this order):
+ * the held queue FIRST so the delivery queue can name it as its dead letter
+ * (pg-boss's job row holds a foreign key on it), then the fan-out, the
+ * delivery with its retry budget, and the nightly purge.
+ */
+export function webhookJobs(service, logger, retentionDays) {
+    const { dials } = service;
+    return [
+        {
+            queue: WEBHOOK_DELIVERIES_HELD_QUEUE,
+            options: { retryLimit: 10, retryDelaySeconds: 60, retryBackoff: true },
+            handler: async (data) => {
+                const job = data;
+                if (!job?.deliveryId)
+                    return;
+                await service.hold(job.deliveryId);
+            }
+        },
+        {
+            queue: WEBHOOK_EVENTS_QUEUE,
+            concurrency: 2,
+            pollingIntervalSeconds: 0.5,
+            handler: async (data) => {
+                const job = data;
+                if (!job?.id)
+                    return;
+                const count = await service.fanOut(job);
+                logger.debug({ eventId: job.id, type: job.type, deliveries: count }, 'webhooks: event fanned out');
+            }
+        },
+        {
+            queue: WEBHOOK_DELIVERIES_QUEUE,
+            options: {
+                retryLimit: dials.retryLimit,
+                retryDelaySeconds: dials.retryDelaySeconds,
+                retryBackoff: true,
+                deadLetter: WEBHOOK_DELIVERIES_HELD_QUEUE
+            },
+            // Eight deliveries in flight per replica: a receiver that answers
+            // nothing holds one slot for its timeout, not the instance.
+            concurrency: 8,
+            pollingIntervalSeconds: 0.5,
+            handler: async (data) => {
+                const job = data;
+                if (!job?.deliveryId)
+                    return;
+                try {
+                    await service.attempt(job.deliveryId, { retryable: true });
+                }
+                catch (e) {
+                    if (e instanceof WebhookDeliveryDeferred) {
+                        // The endpoint already holds its share of the pollers: back in the
+                        // queue in two seconds, its retry budget untouched.
+                        await service.requeue(job.deliveryId, 2);
+                        return;
+                    }
+                    if (e instanceof WebhookDeliveryFailed) {
+                        logger.warn({ deliveryId: e.deliveryId, reason: e.message }, 'webhooks: a delivery attempt failed, will retry');
+                    }
+                    throw e;
+                }
+            }
+        },
+        {
+            queue: WEBHOOK_PURGE_QUEUE,
+            schedule: { cron: '0 3 * * *', enabled: retentionDays > 0 },
+            handler: async () => {
+                const deleted = await service.purge(retentionDays);
+                logger.info({ retentionDays, deleted }, 'webhook deliveries retention purge ran');
+            }
+        }
+    ];
+}
+//# sourceMappingURL=jobs.js.map

package/dist/webhooks/jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../src/webhooks/jobs.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EAItB,MAAM,cAAc,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,OAAuB,EACvB,MAAc,EACd,aAAqB;IAErB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,OAAO;QACL;YACE,KAAK,EAAE,6BAA6B;YACpC,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;YACtE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,IAAiC,CAAC;gBAC9C,IAAI,CAAC,GAAG,EAAE,UAAU;oBAAE,OAAO;gBAC7B,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;SACF;QACD;YACE,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,CAAC;YACd,sBAAsB,EAAE,GAAG;YAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,IAA8B,CAAC;gBAC3C,IAAI,CAAC,GAAG,EAAE,EAAE;oBAAE,OAAO;gBACrB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACrG,CAAC;SACF;QACD;YACE,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE;gBACP,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,6BAA6B;aAC1C;YACD,kEAAkE;YAClE,4DAA4D;YAC5D,WAAW,EAAE,CAAC;YACd,sBAAsB,EAAE,GAAG;YAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBACtB,MAAM,GAAG,GAAG,IAAiC,CAAC;gBAC9C,IAAI,CAAC,GAAG,EAAE,UAAU;oBAAE,OAAO;gBAC7B,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,uBAAuB,EAAE,CAAC;wBACzC,mEAAmE;wBACnE,oDAAoD;wBACpD,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;wBACzC,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC,YAAY,qBAAqB,EAAE,CAAC;wBACvC,MAAM,CAAC,IAAI,CACT,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAC/C,iDAAiD,CAClD,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;SACF;QACD;YACE,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,CAAC,EAAE;YAC3D,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,wCAAwC,CAAC,CAAC;YACpF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/webhooks/mail.d.ts

@@ -0,0 +1,24 @@
+import { type MailBrand } from '../email/shell.js';
+/**
+ * The one mail of the webhooks: an endpoint was switched off after failing
+ * for days, sent once to the person who registered it. Env-free like the
+ * account mails (`email/templates.ts`): every value arrives as a parameter,
+ * so a tool's mail wall renders it standalone.
+ */
+export interface WebhookDisabledEmailParams {
+    brand: MailBrand;
+    recipientName: string;
+    url: string;
+    description: string;
+    workspaceName: string;
+    consecutiveFailures: number;
+    firstFailureAt: Date;
+    /** The endpoint on its page in the dashboard: where it is re-enabled. */
+    manageUrl: string;
+}
+export declare function buildWebhookDisabledEmail(p: WebhookDisabledEmailParams): {
+    subject: string;
+    html: string;
+    text: string;
+};
+//# sourceMappingURL=mail.d.ts.map

package/dist/webhooks/mail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.d.ts","sourceRoot":"","sources":["../../src/webhooks/mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4D,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE7G;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,IAAI,CAAC;IACrB,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,0BAA0B,GAAG;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAuBA"}

package/dist/webhooks/mail.js

@@ -0,0 +1,21 @@
+import { button, esc, fine, fmtDate, makeShell, para, spelledLink } from '../email/shell.js';
+export function buildWebhookDisabledEmail(p) {
+    const name = p.brand.name;
+    const what = p.description ? `${p.description} (${p.url})` : p.url;
+    const subject = `A webhook of ${p.workspaceName} was switched off`;
+    const html = makeShell(p.brand)({
+        preheader: `${what} has not accepted a delivery since ${fmtDate(p.firstFailureAt)}.`,
+        eyebrow: 'Webhooks',
+        title: 'A webhook was switched off',
+        body: para(`${esc(name)} has stopped delivering to <strong>${esc(what)}</strong>, a webhook of
+         <strong>${esc(p.workspaceName)}</strong>: every delivery since ${fmtDate(p.firstFailureAt)}
+         failed, ${p.consecutiveFailures} in a row.`) +
+            para('The deliveries it missed are kept on its page. Once the receiver answers again, switch the webhook back on there and redeliver what matters.') +
+            button(p.manageUrl, 'Open the webhook') +
+            fine(`You receive this because you registered the webhook, ${esc(p.recipientName)}.`) +
+            spelledLink(p.manageUrl)
+    });
+    const text = `${name} has stopped delivering to ${what}, a webhook of ${p.workspaceName}: every delivery since ${fmtDate(p.firstFailureAt)} failed, ${p.consecutiveFailures} in a row.\n\nOpen the webhook: ${p.manageUrl}\n\nThe deliveries it missed are kept on its page. Once the receiver answers again, switch the webhook back on there and redeliver what matters.`;
+    return { subject, html, text };
+}
+//# sourceMappingURL=mail.js.map

package/dist/webhooks/mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail.js","sourceRoot":"","sources":["../../src/webhooks/mail.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAoB7G,MAAM,UAAU,yBAAyB,CAAC,CAA6B;IAKrE,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,aAAa,mBAAmB,CAAC;IACnE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9B,SAAS,EAAE,GAAG,IAAI,sCAAsC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG;QACpF,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,4BAA4B;QACnC,IAAI,EACF,IAAI,CACF,GAAG,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,IAAI,CAAC;mBAChD,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,mCAAmC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;mBAChF,CAAC,CAAC,mBAAmB,YAAY,CAC7C;YACD,IAAI,CACF,8IAA8I,CAC/I;YACD,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,kBAAkB,CAAC;YACvC,IAAI,CAAC,wDAAwD,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC;YACrF,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,IAAI,8BAA8B,IAAI,kBAAkB,CAAC,CAAC,aAAa,0BAA0B,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,mBAAmB,mCAAmC,CAAC,CAAC,SAAS,kJAAkJ,CAAC;IAC5W,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/dist/webhooks/match.d.ts

@@ -0,0 +1,22 @@
+import type { WebhookSubjectValue } from './catalog.js';
+/**
+ * The subscription rule, pure and unit-tested (`webhook-match.test.ts`): an
+ * endpoint's `events` are matched against an event's type, its `filters`
+ * against the event's subjects. The chassis never knows what a subject IS,
+ * only that it is a key with one or several ids.
+ */
+/** `*` matches every type; `family.*` matches the family; a type matches itself. */
+export declare function matchesEventType(patterns: readonly string[], type: string): boolean;
+/**
+ * AND across the filter's keys, OR within a key's ids. An event that does not
+ * carry a filtered subject does not match (a filter on `project` excludes an
+ * event with no project). An empty filter matches everything.
+ */
+export declare function matchesFilters(filters: Readonly<Record<string, readonly string[]>>, subjects: Readonly<Record<string, WebhookSubjectValue>>): boolean;
+/** Whether an endpoint takes this event: enabled, the type subscribed, the filters satisfied. */
+export declare function endpointWants(endpoint: {
+    enabled: boolean;
+    events: readonly string[];
+    filters: Readonly<Record<string, readonly string[]>>;
+}, type: string, subjects: Readonly<Record<string, WebhookSubjectValue>>): boolean;
+//# sourceMappingURL=match.d.ts.map

package/dist/webhooks/match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.d.ts","sourceRoot":"","sources":["../../src/webhooks/match.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD;;;;;GAKG;AAEH,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOnF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EACpD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,GACtD,OAAO,CAST;AAED,iGAAiG;AACjG,wBAAgB,aAAa,CAC3B,QAAQ,EAAE;IACR,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CACtD,EACD,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,GACtD,OAAO,CAIT"}

package/dist/webhooks/match.js

@@ -0,0 +1,40 @@
+/**
+ * The subscription rule, pure and unit-tested (`webhook-match.test.ts`): an
+ * endpoint's `events` are matched against an event's type, its `filters`
+ * against the event's subjects. The chassis never knows what a subject IS,
+ * only that it is a key with one or several ids.
+ */
+/** `*` matches every type; `family.*` matches the family; a type matches itself. */
+export function matchesEventType(patterns, type) {
+    const family = type.slice(0, type.indexOf('.'));
+    for (const pattern of patterns) {
+        if (pattern === '*' || pattern === type)
+            return true;
+        if (pattern.endsWith('.*') && pattern.slice(0, -2) === family)
+            return true;
+    }
+    return false;
+}
+/**
+ * AND across the filter's keys, OR within a key's ids. An event that does not
+ * carry a filtered subject does not match (a filter on `project` excludes an
+ * event with no project). An empty filter matches everything.
+ */
+export function matchesFilters(filters, subjects) {
+    for (const [key, ids] of Object.entries(filters)) {
+        if (ids.length === 0)
+            continue;
+        const value = subjects[key];
+        if (value === undefined)
+            return false;
+        const values = typeof value === 'string' ? [value] : value;
+        if (!values.some((v) => ids.includes(v)))
+            return false;
+    }
+    return true;
+}
+/** Whether an endpoint takes this event: enabled, the type subscribed, the filters satisfied. */
+export function endpointWants(endpoint, type, subjects) {
+    return (endpoint.enabled && matchesEventType(endpoint.events, type) && matchesFilters(endpoint.filters, subjects));
+}
+//# sourceMappingURL=match.js.map

package/dist/webhooks/match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.js","sourceRoot":"","sources":["../../src/webhooks/match.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,QAA2B,EAAE,IAAY;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAoD,EACpD,QAAuD;IAEvD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,aAAa,CAC3B,QAIC,EACD,IAAY,EACZ,QAAuD;IAEvD,OAAO,CACL,QAAQ,CAAC,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC1G,CAAC;AACJ,CAAC"}

package/dist/webhooks/safe-fetch.d.ts

@@ -0,0 +1,94 @@
+import { type Readable } from 'node:stream';
+/**
+ * The guarded outbound POST the webhook delivery worker uses. A webhook's
+ * address is somebody else's choice, so the one rule that is not negotiable:
+ * a POST never reaches the instance's own network unless the operator opened
+ * it (`allowPrivateNetworks`, a self-hoster's LAN).
+ *
+ *  - Up front, before any request (`checkWebhookUrl`): `http:`/`https:` only
+ *    (`https:` alone under `httpsOnly`), the scheme's default port only, no
+ *    userinfo, a hostname, and a literal IP host must be public.
+ *  - A name is resolved with ALL its addresses, and the connection is refused
+ *    (`WebhookUrlRefusedError`) when ANY of them is not public. The check is
+ *    the socket's own `lookup`, so the address connected to IS the one
+ *    checked: no gap for a name that answers differently the second time.
+ *  - No redirect is ever followed: a 3xx comes back as its status.
+ *  - One timeout over the whole call (resolution, connection, the body read).
+ *  - The response body is read up to `maxResponseBytes`, then the stream is
+ *    destroyed.
+ */
+export type WebhookUrlRefusal = 'scheme' | 'port' | 'userinfo' | 'private_address' | 'https_required' | 'unresolvable' | 'malformed';
+/** A webhook URL the guard refused (a scheme, a port, userinfo, an address). */
+export declare class WebhookUrlRefusedError extends Error {
+    readonly code: WebhookUrlRefusal;
+    constructor(code: WebhookUrlRefusal, message?: string);
+}
+export interface SafeFetchPolicy {
+    /** Private, loopback, link-local and other non-public addresses are reachable (a self-hoster's LAN). Default false. */
+    allowPrivateNetworks: boolean;
+    /** Only https: URLs are accepted (the cloud edition). Default false. */
+    httpsOnly: boolean;
+}
+export interface LookupAddress {
+    address: string;
+    family: number;
+}
+/** Every address a name resolves to (`dns.lookup(host, { all: true })` by default). */
+export type SafeLookup = (hostname: string) => Promise<LookupAddress[]>;
+export interface SafeFetchResponse {
+    status: number;
+    headers: Record<string, string | string[] | undefined>;
+    body: Readable;
+}
+/**
+ * One POST, no redirect followed. The default speaks `node:http`/`node:https`
+ * with the guarded lookup in the socket; a test hands its own, and the
+ * address check then runs before it.
+ */
+export type SafeTransport = (url: URL, init: {
+    method: 'POST';
+    headers: Record<string, string>;
+    body: string;
+}, signal: AbortSignal) => Promise<SafeFetchResponse>;
+export interface SafeFetchOptions {
+    lookup?: SafeLookup;
+    transport?: SafeTransport;
+    /** Over the whole call. Default 10 000. */
+    timeoutMs?: number;
+    /** The response body is cut there. Default 65 536. */
+    maxResponseBytes?: number;
+}
+export interface SafeFetchResult {
+    status: number;
+    /** the response body, utf8, cut at maxResponseBytes */
+    bodyText: string;
+    durationMs: number;
+}
+/**
+ * Whether an address is on the public internet: false for loopback, private,
+ * link-local (the metadata address), carrier-grade NAT, multicast, reserved,
+ * and every IPv6 outside global unicast (`2000::/3`): `::`, `::1`, `fc00::/7`,
+ * `fe80::/10`, `ff00::/8`. An IPv4-mapped (`::ffff:a.b.c.d`) or a 6to4
+ * (`2002::/16`) address is judged by the IPv4 inside it. Unparseable: false.
+ */
+export declare function isPublicAddress(ip: string): boolean;
+/**
+ * The checks that need no lookup: `http:`/`https:` only (`https:` alone under
+ * `httpsOnly`), the scheme's default port only (`url.port === ''`, so an
+ * explicit default port, which the URL parser drops, passes), no userinfo, a
+ * non-empty hostname, a literal IP public unless `allowPrivateNetworks`.
+ * Throws `WebhookUrlRefusedError`; returns the parsed URL.
+ */
+export declare function checkWebhookUrl(url: string, policy: SafeFetchPolicy): URL;
+/**
+ * One POST, no redirect followed (a 3xx comes back as its status), the address
+ * check inside the socket's own lookup (ALL resolved addresses must be public
+ * unless `allowPrivateNetworks`; an empty resolution is `unresolvable`),
+ * `AbortSignal.timeout(timeoutMs)` over the whole call, the response body read
+ * up to `maxResponseBytes` then the stream destroyed. Rejects with
+ * `WebhookUrlRefusedError` on a refused address, with the transport's error
+ * (ECONNREFUSED, the timeout's AbortError…) otherwise. Sets no `user-agent`:
+ * that is the caller's.
+ */
+export declare function safePost(url: string, headers: Record<string, string>, body: string, policy: SafeFetchPolicy, options?: SafeFetchOptions): Promise<SafeFetchResult>;
+//# sourceMappingURL=safe-fetch.d.ts.map

package/dist/webhooks/safe-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../../src/webhooks/safe-fetch.ts"],"names":[],"mappings":"AAIA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,iBAAiB,GAC3B,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,cAAc,GAAG,WAAW,CAAC;AAYvG,gFAAgF;AAChF,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBACrB,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,MAAM;CAKtD;AAED,MAAM,WAAW,eAAe;IAC9B,uHAAuH;IACvH,oBAAoB,EAAE,OAAO,CAAC;IAC9B,wEAAwE;IACxE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,uFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,EAAE,QAAQ,CAAC;CAChB;AACD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,GAAG,EACR,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvE,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAkDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAanD;AAOD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,GAAG,CAoBzE;AAuFD;;;;;;;;;GASG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAmC1B"}