@cat-factory/integrations 0.143.1 → 0.145.0

package/dist/modules/notificationWebhook/WebhookNotificationChannel.js

@@ -1,5 +1,5 @@
 import { DEFAULT_NOTIFICATION_WEBHOOK_TYPES, } from '@cat-factory/contracts';
-import { postSignedWebhook } from './signedDelivery.js';
+import { fanOutSignedWebhook } from './signedDelivery.js';
 import { WEBHOOK_SIGNATURE_HEADERS } from './webhookSignature.js';
 export class WebhookNotificationChannel {
     deps;
@@ -14,30 +14,26 @@ export class WebhookNotificationChannel {
             // Best-effort: never let a receiver outage/misconfig break the notification lifecycle
             // (CompositeNotificationChannel also isolates us, belt-and-braces). Surface it through the
             // optional observability hook so the failure is diagnosable instead of silently dropped.
-            this.deps.onError?.(error, {
-                workspaceId,
-                notificationId: notification.id,
-                type: notification.type,
-            });
-            // The notification TYPE is a bounded enum, so it is safe as a dimension and is the one
-            // split worth having: an endpoint that only fails on a particular card is a receiver
-            // bug, where a flat failure across types is an outage.
-            this.deps.operationalMetrics?.increment('notification.delivery_failed', {
-                channel: 'webhook',
-                type: notification.type,
-            });
+            //
+            // With the fan-out below reporting each endpoint's own failure, what reaches HERE is the
+            // read or the compose failing — a fault of the workspace's configuration rather than of any
+            // one receiver, which is why this report names no `webhookId`.
+            this.reportFailure(error, workspaceId, notification);
         }
     }
     async post(workspaceId, notification) {
-        const webhook = await this.deps.notificationWebhookRepository.get(workspaceId);
-        if (!webhook || !webhook.enabled)
-            return;
-        if (!deliversType(webhook, notification.type))
+        const endpoints = (await this.deps.notificationWebhookRepository.list(workspaceId)).filter((webhook) => webhook.enabled && deliversType(webhook, notification.type));
+        if (endpoints.length === 0)
             return;
         const body = {
             // Stable per notification-and-status: a retried attempt repeats it, so a receiver dedupes on
             // it. The status suffix keeps the delivery of a RESOLVED card (channels are re-delivered on
             // resolve) distinct from the original open one, which is a genuinely different event.
+            //
+            // Deliberately NOT scoped by endpoint: each receiver only ever sees its own copy, so an
+            // endpoint segment would put a value in the dedupe key that no receiver can act on, and
+            // would break the one case where two subscriptions DO collapse correctly (the same URL
+            // registered twice, which should deliver one card once).
             deliveryId: `${notification.id}-${notification.status}`,
             sentAt: this.deps.clock.now(),
             workspaceId,
@@ -45,11 +41,22 @@ export class WebhookNotificationChannel {
             taskId: notification.blockId,
             notification,
         };
-        await postSignedWebhook(this.deps, {
-            url: webhook.url,
-            secretSealed: webhook.secretSealed,
-            payload: JSON.stringify(body),
-            sentAt: body.sentAt,
+        await fanOutSignedWebhook(this.deps, endpoints, { payload: JSON.stringify(body), sentAt: body.sentAt }, (error, target) => this.reportFailure(error, workspaceId, notification, target.id));
+    }
+    reportFailure(error, workspaceId, notification, webhookId) {
+        this.deps.onError?.(error, {
+            workspaceId,
+            notificationId: notification.id,
+            type: notification.type,
+            ...(webhookId === undefined ? {} : { webhookId }),
+        });
+        // The notification TYPE is a bounded enum, so it is safe as a dimension and is the one
+        // split worth having: an endpoint that only fails on a particular card is a receiver
+        // bug, where a flat failure across types is an outage. The webhook ID is deliberately NOT a
+        // dimension: it is operator-chosen, so every workspace's naming would mint its own series.
+        this.deps.operationalMetrics?.increment('notification.delivery_failed', {
+            channel: 'webhook',
+            type: notification.type,
         });
     }
 }

package/dist/modules/notificationWebhook/WebhookNotificationChannel.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebhookNotificationChannel.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAA;AAY/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAsDjE,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAA4C;oBAA5C,IAAI;IAA2C,CAAC;IAE7E,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,2FAA2F;YAC3F,yFAAyF;YACzF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,IAAI,EAAE,YAAY,CAAC,IAAI;aACxB,CAAC,CAAA;YACF,uFAAuF;YACvF,qFAAqF;YACrF,uDAAuD;YACvD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,8BAA8B,EAAE;gBACtE,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,YAAY,CAAC,IAAI;aACxB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,YAA0B;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAM;QACxC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC;YAAE,OAAM;QAErD,MAAM,IAAI,GAAgC;YACxC,6FAA6F;YAC7F,4FAA4F;YAC5F,sFAAsF;YACtF,UAAU,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,YAAY,CAAC,WAAW;YAC/B,MAAM,EAAE,YAAY,CAAC,OAAO;YAC5B,YAAY;SACb,CAAA;QACD,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAkC,EAAE,IAAsB;IAC9E,MAAM,KAAK,GAAgC,OAAO,CAAC,KAAK,CAAC,MAAM;QAC7D,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,kCAAkC,CAAA;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}
+{"version":3,"file":"WebhookNotificationChannel.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookNotificationChannel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,GAEnC,MAAM,wBAAwB,CAAA;AAY/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAuDjE,MAAM,OAAO,0BAA0B;IACR,IAAI;IAAjC,YAA6B,IAA4C;oBAA5C,IAAI;IAA2C,CAAC;IAE7E,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,YAA0B;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,2FAA2F;YAC3F,yFAAyF;YACzF,EAAE;YACF,yFAAyF;YACzF,4FAA4F;YAC5F,+DAA+D;YAC/D,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,YAA0B;QAChE,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CACxF,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,CACzE,CAAA;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAElC,MAAM,IAAI,GAAgC;YACxC,6FAA6F;YAC7F,4FAA4F;YAC5F,sFAAsF;YACtF,EAAE;YACF,wFAAwF;YACxF,wFAAwF;YACxF,uFAAuF;YACvF,yDAAyD;YACzD,UAAU,EAAE,GAAG,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,YAAY,CAAC,WAAW;YAC/B,MAAM,EAAE,YAAY,CAAC,OAAO;YAC5B,YAAY;SACb,CAAA;QACD,MAAM,mBAAmB,CACvB,IAAI,CAAC,IAAI,EACT,SAAS,EACT,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACtD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CACnF,CAAA;IACH,CAAC;IAEO,aAAa,CACnB,KAAc,EACd,WAAmB,EACnB,YAA0B,EAC1B,SAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;YACzB,WAAW;YACX,cAAc,EAAE,YAAY,CAAC,EAAE;YAC/B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;SAClD,CAAC,CAAA;QACF,uFAAuF;QACvF,qFAAqF;QACrF,4FAA4F;QAC5F,2FAA2F;QAC3F,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,8BAA8B,EAAE;YACtE,OAAO,EAAE,SAAS;YAClB,IAAI,EAAE,YAAY,CAAC,IAAI;SACxB,CAAC,CAAA;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAkC,EAAE,IAAsB;IAC9E,MAAM,KAAK,GAAgC,OAAO,CAAC,KAAK,CAAC,MAAM;QAC7D,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,kCAAkC,CAAA;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}

package/dist/modules/notificationWebhook/WebhookPlatformAlertSink.d.ts

@@ -19,6 +19,7 @@ export interface WebhookPlatformAlertSinkDependencies {
         workspaceId: string;
         accountId: string;
         event: string;
+        webhookId?: string;
     }) => void;
 }
 export declare class WebhookPlatformAlertSink implements PlatformAlertSink {

package/dist/modules/notificationWebhook/WebhookPlatformAlertSink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebhookPlatformAlertSink.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookPlatformAlertSink.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,KAAK,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAuB5B,MAAM,WAAW,oCAAoC;IACnD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAC/D,IAAI,CAAA;CACV;AAED,qBAAa,wBAAyB,YAAW,iBAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,oCAAoC,EAAI;IAErE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzF;YAEa,IAAI;CAuCnB"}
+{"version":3,"file":"WebhookPlatformAlertSink.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookPlatformAlertSink.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,KAAK,EACL,6BAA6B,EAC7B,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAwB5B,MAAM,WAAW,oCAAoC;IACnD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACnF,IAAI,CAAA;CACV;AAED,qBAAa,wBAAyB,YAAW,iBAAiB;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,oCAAoC,EAAI;IAErE,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzF;YAEa,IAAI;CA8CnB"}

package/dist/modules/notificationWebhook/WebhookPlatformAlertSink.js

@@ -1,4 +1,4 @@
-import { postSignedWebhook } from './signedDelivery.js';
+import { fanOutSignedWebhook } from './signedDelivery.js';
 export class WebhookPlatformAlertSink {
     deps;
     constructor(deps) {
@@ -17,13 +17,12 @@ export class WebhookPlatformAlertSink {
         }
     }
     async post(workspaceId, event) {
-        const webhook = await this.deps.notificationWebhookRepository.get(workspaceId);
-        if (!webhook || !webhook.enabled)
-            return;
+        const endpoints = (await this.deps.notificationWebhookRepository.list(workspaceId)).filter(
         // EMPTY means NONE, like the run-lifecycle filter and unlike the notification `types` one: an
         // endpoint registered to hear about parked decisions must never start paging an on-call
         // rotation because the deployment shipped a new event family.
-        if (!webhook.alertEvents.includes(event.event))
+        (webhook) => webhook.enabled && webhook.alertEvents.includes(event.event));
+        if (endpoints.length === 0)
             return;
         const body = {
             deliveryId: deliveryIdFor(event),
@@ -49,12 +48,12 @@ export class WebhookPlatformAlertSink {
                 failedTotal: event.failedTotal,
             },
         };
-        await postSignedWebhook(this.deps, {
-            url: webhook.url,
-            secretSealed: webhook.secretSealed,
-            payload: JSON.stringify(body),
-            sentAt: body.sentAt,
-        });
+        await fanOutSignedWebhook(this.deps, endpoints, { payload: JSON.stringify(body), sentAt: body.sentAt }, (error, target) => this.deps.onError?.(error, {
+            workspaceId,
+            accountId: event.accountId,
+            event: event.event,
+            webhookId: target.id,
+        }));
     }
 }
 /**

package/dist/modules/notificationWebhook/WebhookPlatformAlertSink.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebhookPlatformAlertSink.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookPlatformAlertSink.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AA4CvD,MAAM,OAAO,wBAAwB;IACN,IAAI;IAAjC,YAA6B,IAA0C;oBAA1C,IAAI;IAAyC,CAAC;IAE3E,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,KAAyB;QACxE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,KAAyB;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAM;QACxC,8FAA8F;QAC9F,wFAAwF;QACxF,8DAA8D;QAC9D,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAM;QAEtD,MAAM,IAAI,GAAiC;YACzC,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE;gBACL,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBAC/C,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;iBAClE,CAAC,CAAC;gBACH,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC3C,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC,CAAC;gBACH,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B;SACF,CAAA;QACD,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,aAAa,CAAC,KAAyB;IAC9C,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAA;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU;SAC7B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAC5E;SACA,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9C,CAAC"}
+{"version":3,"file":"WebhookPlatformAlertSink.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookPlatformAlertSink.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AA6CzD,MAAM,OAAO,wBAAwB;IACN,IAAI;IAAjC,YAA6B,IAA0C;oBAA1C,IAAI;IAAyC,CAAC;IAE3E,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,KAAyB;QACxE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,KAAyB;QAC/D,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;QACxF,8FAA8F;QAC9F,wFAAwF;QACxF,8DAA8D;QAC9D,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAC1E,CAAA;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAElC,MAAM,IAAI,GAAiC;YACzC,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE;gBACL,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBAC/C,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,SAAS,EAAE,SAAS,CAAC,SAAS;oBAC9B,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;iBAClE,CAAC,CAAC;gBACH,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC3C,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC,CAAC;gBACH,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B;SACF,CAAA;QACD,MAAM,mBAAmB,CACvB,IAAI,CAAC,IAAI,EACT,SAAS,EACT,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACtD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;YACzB,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CACL,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,aAAa,CAAC,KAAyB;IAC9C,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAA;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU;SAC7B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAC5E;SACA,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9C,CAAC"}

package/dist/modules/notificationWebhook/WebhookRunLifecycleSink.d.ts

@@ -18,6 +18,7 @@ export interface WebhookRunLifecycleSinkDependencies {
         workspaceId: string;
         runId: string;
         event: string;
+        webhookId?: string;
     }) => void;
 }
 export declare class WebhookRunLifecycleSink implements RunLifecycleSink {

package/dist/modules/notificationWebhook/WebhookRunLifecycleSink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebhookRunLifecycleSink.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookRunLifecycleSink.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,KAAK,EACL,6BAA6B,EAC7B,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAgB5B,MAAM,WAAW,mCAAmC;IAClD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;CACnG;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,mCAAmC,EAAI;IAEpE,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUlF;YAEa,IAAI;CAmCnB"}
+{"version":3,"file":"WebhookRunLifecycleSink.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookRunLifecycleSink.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,KAAK,EACL,6BAA6B,EAC7B,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAmB5B,MAAM,WAAW,mCAAmC;IAClD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,8FAA8F;IAC9F,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;OAIG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/E,IAAI,CAAA;CACV;AAED,qBAAa,uBAAwB,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,mCAAmC,EAAI;IAEpE,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYlF;YAEa,IAAI;CA0CnB"}

package/dist/modules/notificationWebhook/WebhookRunLifecycleSink.js

@@ -1,4 +1,4 @@
-import { postSignedWebhook } from './signedDelivery.js';
+import { fanOutSignedWebhook } from './signedDelivery.js';
 export class WebhookRunLifecycleSink {
     deps;
     constructor(deps) {
@@ -9,6 +9,8 @@ export class WebhookRunLifecycleSink {
             await this.post(workspaceId, event);
         }
         catch (error) {
+            // A per-endpoint failure is reported by the fan-out with the endpoint named; what reaches
+            // here is the read or the compose failing, which belongs to no one receiver.
             this.deps.onError?.(error, {
                 workspaceId,
                 runId: event.runId,
@@ -17,12 +19,11 @@ export class WebhookRunLifecycleSink {
         }
     }
     async post(workspaceId, event) {
-        const webhook = await this.deps.notificationWebhookRepository.get(workspaceId);
-        if (!webhook || !webhook.enabled)
-            return;
+        const endpoints = (await this.deps.notificationWebhookRepository.list(workspaceId)).filter(
         // EMPTY means NONE here, unlike the notification `types` filter next door: an endpoint
         // registered before run events existed must not silently start receiving a new event family.
-        if (!webhook.runEvents.includes(event.event))
+        (webhook) => webhook.enabled && webhook.runEvents.includes(event.event));
+        if (endpoints.length === 0)
             return;
         const body = {
             // `<runId>:<event>` — stable across retries AND across a re-delivery, so it is the dedupe
@@ -45,12 +46,12 @@ export class WebhookRunLifecycleSink {
                 failure: event.failure,
             },
         };
-        await postSignedWebhook(this.deps, {
-            url: webhook.url,
-            secretSealed: webhook.secretSealed,
-            payload: JSON.stringify(body),
-            sentAt: body.sentAt,
-        });
+        await fanOutSignedWebhook(this.deps, endpoints, { payload: JSON.stringify(body), sentAt: body.sentAt }, (error, target) => this.deps.onError?.(error, {
+            workspaceId,
+            runId: event.runId,
+            event: event.event,
+            webhookId: target.id,
+        }));
     }
 }
 //# sourceMappingURL=WebhookRunLifecycleSink.js.map

package/dist/modules/notificationWebhook/WebhookRunLifecycleSink.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebhookRunLifecycleSink.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookRunLifecycleSink.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAiCvD,MAAM,OAAO,uBAAuB;IACL,IAAI;IAAjC,YAA6B,IAAyC;oBAAzC,IAAI;IAAwC,CAAC;IAE1E,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,KAAwB;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,KAAwB;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9E,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAM;QACxC,uFAAuF;QACvF,6FAA6F;QAC7F,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAM;QAEpD,MAAM,IAAI,GAAuB;YAC/B,0FAA0F;YAC1F,2FAA2F;YAC3F,wFAAwF;YACxF,wFAAwF;YACxF,UAAU,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE;gBACH,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB;SACF,CAAA;QACD,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"WebhookRunLifecycleSink.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/WebhookRunLifecycleSink.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAuCzD,MAAM,OAAO,uBAAuB;IACL,IAAI;IAAjC,YAA6B,IAAyC;oBAAzC,IAAI;IAAwC,CAAC;IAE1E,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,KAAwB;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,6EAA6E;YAC7E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;gBACzB,WAAW;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,KAAwB;QAC9D,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;QACxF,uFAAuF;QACvF,6FAA6F;QAC7F,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CACxE,CAAA;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAElC,MAAM,IAAI,GAAuB;YAC/B,0FAA0F;YAC1F,2FAA2F;YAC3F,wFAAwF;YACxF,wFAAwF;YACxF,UAAU,EAAE,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE;YAC3C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7B,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE;gBACH,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB;SACF,CAAA;QACD,MAAM,mBAAmB,CACvB,IAAI,CAAC,IAAI,EACT,SAAS,EACT,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACtD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;YACzB,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CACL,CAAA;IACH,CAAC;CACF"}

package/dist/modules/notificationWebhook/signedDelivery.d.ts

@@ -23,6 +23,24 @@ export interface SignedDeliveryRequest {
     payload: string;
     /** The epoch-ms stamp inside the payload; signed alongside it so a replay is detectable. */
     sentAt: number;
+    /**
+     * Absolute epoch-ms ceiling for this delivery across all of its attempts. Omitted ⇒
+     * {@link TOTAL_DELIVERY_BUDGET_MS} from now, which is the single-delivery case.
+     *
+     * A fan-out supplies its own so that N endpoints share ONE budget: the whole point of the number
+     * is the latency the caller pays on a run's terminal path, and that is a property of the fan-out,
+     * not of each delivery in it.
+     */
+    deadline?: number;
+}
+/**
+ * Raised for an endpoint the fan-out never got to before the shared budget ran out. Distinct from
+ * a delivery error on purpose: "the receiver rejected us" and "we ran out of time to ask" need
+ * different fixes, and reporting the second as the first would send an operator to debug a
+ * receiver that was never contacted.
+ */
+export declare class WebhookDeliveryNotAttemptedError extends Error {
+    constructor(endpointId: string);
 }
 /**
  * POST one signed delivery, retrying within the shared wall-clock budget. Throws the last error
@@ -30,4 +48,42 @@ export interface SignedDeliveryRequest {
  * treat it as best-effort and report it through their observability hook).
  */
 export declare function postSignedWebhook(deps: SignedDeliveryDependencies, request: SignedDeliveryRequest): Promise<void>;
+/** One subscribed endpoint, as the fan-out needs it: where to POST and what to sign with. */
+export interface SignedDeliveryTarget {
+    id: string;
+    url: string;
+    secretSealed: string | null;
+}
+/**
+ * POST one already-composed body to EVERY subscribed endpoint, isolating each.
+ *
+ * Three properties are the whole reason this is a helper rather than a loop at each of the three
+ * call sites:
+ *
+ * - **Concurrent, but BOUNDED.** The caller awaits the fan-out, so its cost is latency on the
+ *   engine step that produced the event: the step that parks or settles a run. Running the
+ *   deliveries in series would multiply the budget by the endpoint count, so a workspace would pay
+ *   for enrolling a second integration in the latency of every run. Running them all at once is
+ *   the opposite mistake, and a quieter one, because the concurrency past `MAX_CONCURRENT_DELIVERIES`
+ *   is imaginary on the Worker (see that constant) while the budget it burns is real.
+ * - **ONE wall-clock budget for the whole fan-out**, not one per endpoint. The number exists to
+ *   bound what the caller waits for, and the caller waits for all of this, so a per-endpoint budget
+ *   would let ten endpoints bound nothing at all. Each delivery is clamped to what is left when it
+ *   actually starts, so its own retry loop still stops on time.
+ * - **One failing receiver costs only its own delivery.** A rejected `Promise.all` would abandon
+ *   nothing (the others are already in flight) but would report ONE failure for the batch, so a
+ *   permanently broken endpoint would mask the health of every sibling. Each result is settled and
+ *   reported on its own, naming the endpoint.
+ *
+ * An endpoint the budget never reached is reported too, as {@link WebhookDeliveryNotAttemptedError}
+ * rather than as a delivery failure: it is a cap, and a cap records what it dropped. Silence there
+ * would read as a delivery that succeeded, and a generic failure would read as a broken receiver.
+ *
+ * Never throws: every outcome goes to `onEndpointError` and the fan-out carries on, which is what
+ * "best-effort" means for this transport.
+ */
+export declare function fanOutSignedWebhook(deps: SignedDeliveryDependencies, targets: readonly SignedDeliveryTarget[], delivery: {
+    payload: string;
+    sentAt: number;
+}, onEndpointError: (error: unknown, target: SignedDeliveryTarget) => void): Promise<void>;
 //# sourceMappingURL=signedDelivery.d.ts.map

package/dist/modules/notificationWebhook/signedDelivery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signedDelivery.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/signedDelivery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAkC/E,yFAAyF;AACzF,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAA;IACf,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,0BAA0B,EAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAiEf"}
+{"version":3,"file":"signedDelivery.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/signedDelivery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AA8C/E,yFAAyF;AACzF,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,yFAAyF;IACzF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAoBD,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAA;IACX,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAA;IACf,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,YAAY,UAAU,EAAE,MAAM,EAK7B;CACF;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,0BAA0B,EAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAiEf;AAED,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,0BAA0B,EAChC,OAAO,EAAE,SAAS,oBAAoB,EAAE,EACxC,QAAQ,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,KAAK,IAAI,GACtE,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/dist/modules/notificationWebhook/signedDelivery.js

@@ -2,30 +2,71 @@ import { ValidationError } from '@cat-factory/kernel';
 import { DEFAULT_MAX_REDIRECTS, safeFetch } from '../shared/safe-fetch.js';
 import { assertSafeNotificationWebhookUrl } from './webhookUrl.js';
 import { signWebhookDelivery } from './webhookSignature.js';
-// The one outbound-delivery core the workspace's registered webhook endpoint is driven through.
-// Both families that POST to it — the notification cards and the run-lifecycle events — share
-// this rather than each carrying its own retry loop, because everything interesting about the
-// delivery (the wall-clock budget, which failures are worth retrying, re-validating the URL on
-// every redirect hop, the signature headers) is a property of the ENDPOINT, not of the payload.
-// A second copy would be a second place to get the SSRF guard subtly wrong.
+// The one outbound-delivery core every registered webhook endpoint is driven through. All three
+// families that POST to one — the notification cards, the run-lifecycle events and the
+// platform-health alerts — share this rather than each carrying its own retry loop, because
+// everything interesting about the delivery (the wall-clock budget, which failures are worth
+// retrying, re-validating the URL on every redirect hop, the signature headers) is a property of
+// the ENDPOINT, not of the payload. A second copy would be a second place to get the SSRF guard
+// subtly wrong.
+//
+// A workspace registers SEVERAL endpoints, so the three families reach this through
+// `fanOutSignedWebhook` rather than calling `postSignedWebhook` per endpoint themselves: the
+// bounded concurrency, the shared wall-clock budget and the per-endpoint isolation are properties
+// of the fan-out, and three hand-rolled copies of it is exactly the drift this file exists to
+// prevent one layer down.
 /** How many attempts one delivery gets, and how long to wait between them (exponential). */
 const MAX_ATTEMPTS = 3;
 const BASE_RETRY_MS = 250;
 /** Give up on a single HTTP attempt after this long, so a black-holing endpoint can't hang us. */
 const REQUEST_TIMEOUT_MS = 5000;
 /**
- * The ceiling on ONE delivery across all of its attempts. This is the number that matters, and it
- * is not the per-attempt timeout multiplied out: the caller AWAITS the delivery, so every
- * millisecond spent here is latency added to the engine step that produced the event — the very
- * step that parks or settles a run. Three 5s attempts plus backoff would let a dead receiver add
- * ~15.8s, which the in-app and Slack channels never do.
+ * The ceiling on one EMISSION: a single delivery, or a whole fan-out across every subscribed
+ * endpoint. This is the number that matters, and it is not the per-attempt timeout multiplied out.
+ * The caller AWAITS it, so every millisecond spent here is latency added to the engine step that
+ * produced the event, the very step that parks or settles a run. Three 5s attempts plus backoff
+ * would let a dead receiver add ~15.8s, which the in-app and Slack channels never do.
  *
  * So the retry budget is a WALL-CLOCK deadline, not an attempt count: attempts stop as soon as the
  * remaining budget is gone, and each attempt's own timeout is clamped to what is left. Delivery is
  * best-effort by contract, so a receiver too slow to answer inside the budget is treated exactly
  * like one that failed.
+ *
+ * `fanOutSignedWebhook` hands the SAME deadline to every endpoint it drives rather than giving each
+ * a fresh one, so registering a tenth webhook cannot turn a bounded wait into a ten-times-bounded
+ * one. What that trades away is stated at the fan-out: past the budget, endpoints are reported as
+ * not attempted rather than delivered late.
  */
 const TOTAL_DELIVERY_BUDGET_MS = 6000;
+/**
+ * How many deliveries may be in flight at once during a fan-out.
+ *
+ * Six because that is the Cloudflare Workers ceiling on simultaneous open connections per
+ * invocation: a seventh `fetch` does not fail, it QUEUES, invisibly to the code that issued it. An
+ * unbounded fan-out therefore does not buy parallelism past six, it only hides the queue, and the
+ * hiding is the bug: each delivery's wall-clock budget starts when `postSignedWebhook` is entered,
+ * so a queued endpoint spends its budget waiting for a connection and is then reported as a
+ * failure it never actually attempted. Bounding the fan-out is what makes a reported failure mean
+ * the receiver failed.
+ *
+ * Deliberately ONE number rather than a per-runtime one. Node has no such ceiling, but the cap is
+ * ten endpoints, so the parallelism it would unlock is a second wave at most, and both facades
+ * behaving identically is worth more than that: the fan-out's timing is what the conformance and
+ * unit suites assert against.
+ */
+const MAX_CONCURRENT_DELIVERIES = 6;
+/**
+ * Raised for an endpoint the fan-out never got to before the shared budget ran out. Distinct from
+ * a delivery error on purpose: "the receiver rejected us" and "we ran out of time to ask" need
+ * different fixes, and reporting the second as the first would send an operator to debug a
+ * receiver that was never contacted.
+ */
+export class WebhookDeliveryNotAttemptedError extends Error {
+    constructor(endpointId) {
+        super(`Webhook delivery to \`${endpointId}\` was not attempted: the fan-out spent its ${TOTAL_DELIVERY_BUDGET_MS}ms budget on earlier endpoints`);
+        this.name = 'WebhookDeliveryNotAttemptedError';
+    }
+}
 /**
  * POST one signed delivery, retrying within the shared wall-clock budget. Throws the last error
  * when every attempt is spent — the CALLER decides what a failure means (both current callers
@@ -49,7 +90,7 @@ export async function postSignedWebhook(deps, request) {
     // `safeFetch` also strips the body and credential headers on a cross-origin hop, so a permitted
     // host cannot bounce the delivery to a different one.
     const assertSafe = (u) => assertSafeNotificationWebhookUrl(u, deps.urlSafetyPolicy);
-    const deadline = deps.clock.now() + TOTAL_DELIVERY_BUDGET_MS;
+    const deadline = request.deadline ?? deps.clock.now() + TOTAL_DELIVERY_BUDGET_MS;
     let lastError;
     for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
         if (attempt > 0) {
@@ -92,6 +133,67 @@ export async function postSignedWebhook(deps, request) {
     }
     throw lastError ?? new Error('Webhook delivery failed');
 }
+/**
+ * POST one already-composed body to EVERY subscribed endpoint, isolating each.
+ *
+ * Three properties are the whole reason this is a helper rather than a loop at each of the three
+ * call sites:
+ *
+ * - **Concurrent, but BOUNDED.** The caller awaits the fan-out, so its cost is latency on the
+ *   engine step that produced the event: the step that parks or settles a run. Running the
+ *   deliveries in series would multiply the budget by the endpoint count, so a workspace would pay
+ *   for enrolling a second integration in the latency of every run. Running them all at once is
+ *   the opposite mistake, and a quieter one, because the concurrency past `MAX_CONCURRENT_DELIVERIES`
+ *   is imaginary on the Worker (see that constant) while the budget it burns is real.
+ * - **ONE wall-clock budget for the whole fan-out**, not one per endpoint. The number exists to
+ *   bound what the caller waits for, and the caller waits for all of this, so a per-endpoint budget
+ *   would let ten endpoints bound nothing at all. Each delivery is clamped to what is left when it
+ *   actually starts, so its own retry loop still stops on time.
+ * - **One failing receiver costs only its own delivery.** A rejected `Promise.all` would abandon
+ *   nothing (the others are already in flight) but would report ONE failure for the batch, so a
+ *   permanently broken endpoint would mask the health of every sibling. Each result is settled and
+ *   reported on its own, naming the endpoint.
+ *
+ * An endpoint the budget never reached is reported too, as {@link WebhookDeliveryNotAttemptedError}
+ * rather than as a delivery failure: it is a cap, and a cap records what it dropped. Silence there
+ * would read as a delivery that succeeded, and a generic failure would read as a broken receiver.
+ *
+ * Never throws: every outcome goes to `onEndpointError` and the fan-out carries on, which is what
+ * "best-effort" means for this transport.
+ */
+export async function fanOutSignedWebhook(deps, targets, delivery, onEndpointError) {
+    const deadline = deps.clock.now() + TOTAL_DELIVERY_BUDGET_MS;
+    // A shared cursor rather than pre-sliced waves: a worker that finishes early picks up the next
+    // endpoint immediately, so one slow receiver delays only itself and not the whole batch behind
+    // it. With fixed waves, six healthy endpoints would all wait on the slowest of their six.
+    let next = 0;
+    const deliverFrom = async () => {
+        for (;;) {
+            const index = next;
+            next += 1;
+            const target = targets[index];
+            if (!target)
+                return;
+            if (deps.clock.now() >= deadline) {
+                onEndpointError(new WebhookDeliveryNotAttemptedError(target.id), target);
+                continue;
+            }
+            try {
+                await postSignedWebhook(deps, {
+                    url: target.url,
+                    secretSealed: target.secretSealed,
+                    payload: delivery.payload,
+                    sentAt: delivery.sentAt,
+                    deadline,
+                });
+            }
+            catch (error) {
+                onEndpointError(error, target);
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(MAX_CONCURRENT_DELIVERIES, targets.length) }, deliverFrom));
+}
 /** Builds the redirect/size errors `safeFetch` raises, carrying its status for the log line. */
 function makeWebhookError(status, message) {
     return new Error(`Webhook delivery failed (${status}): ${message}`);

package/dist/modules/notificationWebhook/signedDelivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"signedDelivery.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/signedDelivery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,gGAAgG;AAChG,8FAA8F;AAC9F,8FAA8F;AAC9F,+FAA+F;AAC/F,gGAAgG;AAChG,4EAA4E;AAE5E,4FAA4F;AAC5F,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,kGAAkG;AAClG,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B;;;;;;;;;;;GAWG;AACH,MAAM,wBAAwB,GAAG,IAAI,CAAA;AA6BrC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAgC,EAChC,OAA8B;IAE9B,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IAE/F,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,aAAa;KAC5B,CAAA;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACpE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5F,CAAC;IAED,+FAA+F;IAC/F,yFAAyF;IACzF,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,sDAAsD;IACtD,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,gCAAgC,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;IAE3F,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAA;IAC5D,IAAI,SAAkB,CAAA;IACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,uFAAuF;YACvF,mFAAmF;YACnF,MAAM,OAAO,GAAG,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;YAClD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,QAAQ;gBAAE,MAAK;YACjD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;QACD,8FAA8F;QAC9F,2CAA2C;QAC3C,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAC7C,IAAI,SAAS,IAAI,CAAC;YAAE,MAAK;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,OAAO,CAAC,GAAG,EACX;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,OAAO;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;aACrE,EACD,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,CACV,CAAA;YACD,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAM;YACvB,2FAA2F;YAC3F,wFAAwF;YACxF,qFAAqF;YACrF,SAAS,GAAG,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YACtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAK;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,yFAAyF;YACzF,8CAA8C;YAC9C,SAAS,GAAG,KAAK,CAAA;YACjB,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAK;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;AACzD,CAAC;AAED,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe;IACvD,OAAO,IAAI,KAAK,CAAC,4BAA4B,MAAM,MAAM,OAAO,EAAE,CAAC,CAAA;AACrE,CAAC"}
+{"version":3,"file":"signedDelivery.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/signedDelivery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,gGAAgG;AAChG,uFAAuF;AACvF,4FAA4F;AAC5F,6FAA6F;AAC7F,iGAAiG;AACjG,gGAAgG;AAChG,gBAAgB;AAChB,EAAE;AACF,oFAAoF;AACpF,6FAA6F;AAC7F,kGAAkG;AAClG,8FAA8F;AAC9F,0BAA0B;AAE1B,4FAA4F;AAC5F,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,kGAAkG;AAClG,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,wBAAwB,GAAG,IAAI,CAAA;AAkBrC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAA;AAsBnC;;;;;GAKG;AACH,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACzD,YAAY,UAAkB;QAC5B,KAAK,CACH,yBAAyB,UAAU,+CAA+C,wBAAwB,gCAAgC,CAC3I,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAA;IAChD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAgC,EAChC,OAA8B;IAE9B,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAA8B,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAA;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;IAE/F,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,YAAY,EAAE,aAAa;KAC5B,CAAA;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACpE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5F,CAAC;IAED,+FAA+F;IAC/F,yFAAyF;IACzF,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,sDAAsD;IACtD,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,gCAAgC,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;IAE3F,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAA;IAChF,IAAI,SAAkB,CAAA;IACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,uFAAuF;YACvF,mFAAmF;YACnF,MAAM,OAAO,GAAG,aAAa,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;YAClD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,QAAQ;gBAAE,MAAK;YACjD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;QACD,8FAA8F;QAC9F,2CAA2C;QAC3C,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAC7C,IAAI,SAAS,IAAI,CAAC;YAAE,MAAK;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,OAAO,CAAC,GAAG,EACX;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,OAAO;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;aACrE,EACD,UAAU,EACV,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,CACV,CAAA;YACD,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAM;YACvB,2FAA2F;YAC3F,wFAAwF;YACxF,qFAAqF;YACrF,SAAS,GAAG,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YACtE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAK;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,yFAAyF;YACzF,8CAA8C;YAC9C,SAAS,GAAG,KAAK,CAAA;YACjB,IAAI,KAAK,YAAY,eAAe;gBAAE,MAAK;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;AACzD,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAgC,EAChC,OAAwC,EACxC,QAA6C,EAC7C,eAAuE;IAEvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAA;IAC5D,+FAA+F;IAC/F,+FAA+F;IAC/F,0FAA0F;IAC1F,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;QAC5C,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,IAAI,CAAA;YAClB,IAAI,IAAI,CAAC,CAAA;YACT,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,CAAC,MAAM;gBAAE,OAAM;YACnB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACjC,eAAe,CAAC,IAAI,gCAAgC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAA;gBACxE,SAAQ;YACV,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,IAAI,EAAE;oBAC5B,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,QAAQ;iBACT,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAChC,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IAED,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CACzF,CAAA;AACH,CAAC;AAED,gGAAgG;AAChG,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe;IACvD,OAAO,IAAI,KAAK,CAAC,4BAA4B,MAAM,MAAM,OAAO,EAAE,CAAC,CAAA;AACrE,CAAC"}

package/dist/modules/notificationWebhook/support.d.ts

@@ -25,12 +25,14 @@ export interface NotificationWebhookSupportDependencies {
         workspaceId: string;
         notificationId: string;
         type: string;
+        webhookId?: string;
     }) => void;
     /** The same hook for a RUN-LIFECYCLE delivery, whose context names a run rather than a card. */
     onRunEventError?: (error: unknown, context: {
         workspaceId: string;
         runId: string;
         event: string;
+        webhookId?: string;
     }) => void;
     /**
      * The same hook for a PLATFORM-HEALTH delivery, whose context names the account whose health
@@ -41,6 +43,7 @@ export interface NotificationWebhookSupportDependencies {
         workspaceId: string;
         accountId: string;
         event: string;
+        webhookId?: string;
     }) => void;
 }
 /**

package/dist/modules/notificationWebhook/support.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,6BAA6B,EAC7B,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAEtE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,qCAAqC,CAAA;AAElF,MAAM,WAAW,sCAAsC;IACrD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KACnE,IAAI,CAAA;IACT,gGAAgG;IAChG,eAAe,CAAC,EAAE,CAChB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAC3D,IAAI,CAAA;IACT;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CACrB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAC/D,IAAI,CAAA;CACV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,sCAAsC,GAAG;IAC7F,OAAO,EAAE,0BAA0B,CAAA;IACnC,OAAO,EAAE,0BAA0B,CAAA;IACnC,gBAAgB,EAAE,uBAAuB,CAAA;IACzC,iBAAiB,EAAE,wBAAwB,CAAA;CAC5C,CAiCA"}
+{"version":3,"file":"support.d.ts","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/support.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,6BAA6B,EAC7B,YAAY,EACZ,eAAe,EAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAEtE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,qCAAqC,CAAA;AAElF,MAAM,WAAW,sCAAsC;IACrD,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,YAAY,EAAE,YAAY,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IAKxB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACvF,IAAI,CAAA;IACT,gGAAgG;IAChG,eAAe,CAAC,EAAE,CAChB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAC/E,IAAI,CAAA;IACT;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CACrB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACnF,IAAI,CAAA;CACV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,sCAAsC,GAAG;IAC7F,OAAO,EAAE,0BAA0B,CAAA;IACnC,OAAO,EAAE,0BAA0B,CAAA;IACnC,gBAAgB,EAAE,uBAAuB,CAAA;IACzC,iBAAiB,EAAE,wBAAwB,CAAA;CAC5C,CAiCA"}

package/dist/modules/notificationWebhook/support.js.map

@@ -1 +1 @@
-{"version":3,"file":"support.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/support.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,kCAAkC,CAAA;AAkClF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAA4C;IAM1F,OAAO;QACL,iBAAiB,EAAE,IAAI,wBAAwB,CAAC;YAC9C,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,oBAAoB;SACnC,CAAC;QACF,gBAAgB,EAAE,IAAI,uBAAuB,CAAC;YAC5C,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,eAAe;SAC9B,CAAC;QACF,OAAO,EAAE,IAAI,0BAA0B,CAAC;YACtC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC;QACF,OAAO,EAAE,IAAI,0BAA0B,CAAC;YACtC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;KACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"support.js","sourceRoot":"","sources":["../../../src/modules/notificationWebhook/support.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,kCAAkC,CAAA;AAsClF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAA4C;IAM1F,OAAO;QACL,iBAAiB,EAAE,IAAI,wBAAwB,CAAC;YAC9C,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,oBAAoB;SACnC,CAAC;QACF,gBAAgB,EAAE,IAAI,uBAAuB,CAAC;YAC5C,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,eAAe;SAC9B,CAAC;QACF,OAAO,EAAE,IAAI,0BAA0B,CAAC;YACtC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC;QACF,OAAO,EAAE,IAAI,0BAA0B,CAAC;YACtC,6BAA6B,EAAE,IAAI,CAAC,6BAA6B;YACjE,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/modules/observability/RegistryReleaseHealthProvider.d.ts

@@ -1,4 +1,4 @@
-import type { BlockRepository, ObservabilityConnectionRepository, ReleaseEvidence, ReleaseHealthConfigRecord, ReleaseHealthConfigRepository, ReleaseHealthProvider, ReleaseHealthReport, ReleaseSignal, SecretCipher } from '@cat-factory/kernel';
+import type { BlockRepository, ObservabilityConnectionRepository, ReleaseEvidence, ReleaseHealthConfigRecord, ReleaseHealthConfigRepository, ReleaseHealthProvider, ReleaseHealthReport, ReleaseSignal, SecretCipher, SecretDelegate } from '@cat-factory/kernel';
 import type { ObservabilityProviderRegistry } from './registry.js';
 /**
  * A single observability vendor's reads, built from its already-decrypted credentials.
@@ -21,6 +21,12 @@ export interface RegistryReleaseHealthProviderDependencies {
     blockRepository: BlockRepository;
     /** Decrypts the workspace's sealed credentials blob at call time. */
     secretCipher: SecretCipher;
+    /**
+     * Present ONLY on a mothership-mode node, where the connection row was sealed under the
+     * MOTHERSHIP's key and this process holds none. The gate probe runs wherever the RUN runs, so
+     * without it a mothership-mode deployment could save a connection and never probe with it.
+     */
+    secretDelegate?: SecretDelegate;
     /** The provider adapters this facade can build. */
     registry: ObservabilityProviderRegistry;
     /** Override fetch (tests). */
@@ -36,6 +42,7 @@ export interface RegistryReleaseHealthProviderDependencies {
  */
 export declare class RegistryReleaseHealthProvider implements ReleaseHealthProvider {
     private readonly deps;
+    private readonly orgSecrets;
     constructor(deps: RegistryReleaseHealthProviderDependencies);
     probe(workspaceId: string, blockId: string, since: number): Promise<ReleaseHealthReport>;
     gatherEvidence(workspaceId: string, blockId: string, since: number): Promise<ReleaseEvidence>;

package/dist/modules/observability/RegistryReleaseHealthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RegistryReleaseHealthProvider.d.ts","sourceRoot":"","sources":["../../../src/modules/observability/RegistryReleaseHealthProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,iCAAiC,EACjC,eAAe,EACf,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACb,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAA;AAElE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACvF,YAAY,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;CACnG;AAED,kFAAkF;AAClF,MAAM,MAAM,2BAA2B,GAAG,CACxC,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,KAC/B,oBAAoB,CAAA;AAEzB,MAAM,WAAW,yCAAyC;IACxD,iCAAiC,EAAE,iCAAiC,CAAA;IACpE,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,+EAA+E;IAC/E,eAAe,EAAE,eAAe,CAAA;IAChC,qEAAqE;IACrE,YAAY,EAAE,YAAY,CAAA;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,6BAA6B,CAAA;IACvC,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,YAAW,qBAAqB;IAC7D,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,yCAAyC,EAAI;IAE1E,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAU7F;IAEK,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAc1B;IAED,iFAAiF;YACnE,OAAO;IAmBrB,mFAAmF;YACrE,aAAa;CAiB5B"}
+{"version":3,"file":"RegistryReleaseHealthProvider.d.ts","sourceRoot":"","sources":["../../../src/modules/observability/RegistryReleaseHealthProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EAEf,iCAAiC,EACjC,eAAe,EACf,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,cAAc,EACf,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAA;AAElE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACvF,YAAY,CAAC,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;CACnG;AAED,kFAAkF;AAClF,MAAM,MAAM,2BAA2B,GAAG,CACxC,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,KAC/B,oBAAoB,CAAA;AAEzB,MAAM,WAAW,yCAAyC;IACxD,iCAAiC,EAAE,iCAAiC,CAAA;IACpE,6BAA6B,EAAE,6BAA6B,CAAA;IAC5D,+EAA+E;IAC/E,eAAe,EAAE,eAAe,CAAA;IAChC,qEAAqE;IACrE,YAAY,EAAE,YAAY,CAAA;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,mDAAmD;IACnD,QAAQ,EAAE,6BAA6B,CAAA;IACvC,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA8B,YAAW,qBAAqB;IAG7D,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAE5C,YAA6B,IAAI,EAAE,yCAAyC,EAK3E;IAEK,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAU7F;IAEK,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAc1B;IAED,iFAAiF;YACnE,OAAO;IAsBrB,mFAAmF;YACrE,aAAa;CAiB5B"}

package/dist/modules/observability/RegistryReleaseHealthProvider.js

@@ -1,3 +1,4 @@
+import { createOrgSecretCipher } from '@cat-factory/kernel';
 /**
  * The pluggable `ReleaseHealthProvider` the post-release-health gate reads: resolve the
  * block's monitor/SLO config (its own, else its service frame's) → load the workspace's
@@ -8,8 +9,13 @@
  */
 export class RegistryReleaseHealthProvider {
     deps;
+    orgSecrets;
     constructor(deps) {
         this.deps = deps;
+        this.orgSecrets = createOrgSecretCipher({
+            cipher: deps.secretCipher,
+            ...(deps.secretDelegate ? { delegate: deps.secretDelegate } : {}),
+        });
     }
     async probe(workspaceId, blockId, since) {
         const resolved = await this.resolve(workspaceId, blockId);
@@ -50,7 +56,7 @@ export class RegistryReleaseHealthProvider {
         const factory = this.deps.registry.get(connection.provider);
         if (!factory)
             return null;
-        const credentials = JSON.parse(await this.deps.secretCipher.decrypt(connection.credentials));
+        const credentials = JSON.parse(await this.orgSecrets.decryptFor({ source: 'observability_connection', workspaceId }, connection.credentials));
         const adapter = factory(credentials, { fetchImpl: this.deps.fetchImpl });
         return { adapter, config };
     }