@cat-factory/worker 0.171.2 → 0.172.0

package/dist/infrastructure/repositories/D1NotificationWebhookRepository.d.ts

@@ -1,17 +1,19 @@
-import type { NotificationWebhookRecord, NotificationWebhookRepository } from '@cat-factory/kernel';
+import type { NotificationWebhookPutOutcome, NotificationWebhookRecord, NotificationWebhookRepository } from '@cat-factory/kernel';
 import type { D1Database } from '@cloudflare/workers-types';
 /**
- * A workspace's outbound webhook, one row per workspace (migration 0061; `run_events` added in
- * 0072, `alert_events` in 0080). All three JSON filter columns are decoded through the SHARED
- * parsers the Drizzle repo uses, so the columns can't drift between runtimes.
+ * A workspace's outbound webhooks, keyed by (workspace, endpoint id) (migration 0061; `run_events`
+ * added in 0072, `alert_events` in 0080, the named-collection key in 0085). All three JSON filter
+ * columns are decoded through the SHARED parsers the Drizzle repo uses, so the columns can't drift
+ * between runtimes.
  */
 export declare class D1NotificationWebhookRepository implements NotificationWebhookRepository {
     private readonly db;
     constructor({ db }: {
         db: D1Database;
     });
-    get(workspaceId: string): Promise<NotificationWebhookRecord | null>;
-    put(record: NotificationWebhookRecord): Promise<void>;
-    delete(workspaceId: string): Promise<void>;
+    get(workspaceId: string, id: string): Promise<NotificationWebhookRecord | null>;
+    list(workspaceId: string): Promise<NotificationWebhookRecord[]>;
+    put(record: NotificationWebhookRecord, limit: number): Promise<NotificationWebhookPutOutcome>;
+    delete(workspaceId: string, id: string): Promise<void>;
 }
 //# sourceMappingURL=D1NotificationWebhookRepository.d.ts.map

package/dist/infrastructure/repositories/D1NotificationWebhookRepository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"D1NotificationWebhookRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1NotificationWebhookRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAA;AACnG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAkB3D;;;;GAIG;AACH,qBAAa,+BAAgC,YAAW,6BAA6B;IACnF,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAgBxE;IAEK,GAAG,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B1D;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/C;CACF"}
+{"version":3,"file":"D1NotificationWebhookRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1NotificationWebhookRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAoB3D;;;;;GAKG;AACH,qBAAa,+BAAgC,YAAW,6BAA6B;IACnF,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAE,EAAE;QAAE,EAAE,EAAE,UAAU,CAAA;KAAE,EAErC;IAEK,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAMpF;IAEK,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAYpE;IAEK,GAAG,CACP,MAAM,EAAE,yBAAyB,EACjC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,6BAA6B,CAAC,CAmDxC;IAEK,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3D;CACF"}

package/dist/infrastructure/repositories/D1NotificationWebhookRepository.js

@@ -1,38 +1,55 @@
 import { parseNotificationWebhookTypes, parsePlatformAlertEvents, parseRunLifecycleEvents, } from '@cat-factory/server';
 /**
- * A workspace's outbound webhook, one row per workspace (migration 0061; `run_events` added in
- * 0072, `alert_events` in 0080). All three JSON filter columns are decoded through the SHARED
- * parsers the Drizzle repo uses, so the columns can't drift between runtimes.
+ * A workspace's outbound webhooks, keyed by (workspace, endpoint id) (migration 0061; `run_events`
+ * added in 0072, `alert_events` in 0080, the named-collection key in 0085). All three JSON filter
+ * columns are decoded through the SHARED parsers the Drizzle repo uses, so the columns can't drift
+ * between runtimes.
  */
 export class D1NotificationWebhookRepository {
     db;
     constructor({ db }) {
         this.db = db;
     }
-    async get(workspaceId) {
+    async get(workspaceId, id) {
         const row = await this.db
-            .prepare(`SELECT * FROM notification_webhooks WHERE workspace_id = ?`)
-            .bind(workspaceId)
+            .prepare(`SELECT * FROM notification_webhooks WHERE workspace_id = ? AND id = ?`)
+            .bind(workspaceId, id)
             .first();
-        if (!row)
-            return null;
-        return {
-            workspaceId: row.workspace_id,
-            url: row.url,
-            types: parseNotificationWebhookTypes(row.types),
-            runEvents: parseRunLifecycleEvents(row.run_events),
-            alertEvents: parsePlatformAlertEvents(row.alert_events),
-            enabled: row.enabled === 1,
-            secretSealed: row.secret_sealed,
-            updatedAt: row.updated_at,
-        };
+        return row ? toRecord(row) : null;
     }
-    async put(record) {
-        await this.db
+    async list(workspaceId) {
+        // `COLLATE BINARY` is SQLite's default for a text column and is spelled out only to name the
+        // order this port promises: the Drizzle mirror has to ask Postgres for `COLLATE "C"` to match,
+        // because its database-locale default would sort `web-hook` after `webhook` by ignoring the
+        // punctuation. Byte order on both, so the two runtimes return one sequence.
+        const { results } = await this.db
+            .prepare(`SELECT * FROM notification_webhooks WHERE workspace_id = ? ORDER BY id COLLATE BINARY`)
+            .bind(workspaceId)
+            .all();
+        return (results ?? []).map(toRecord);
+    }
+    async put(record, limit) {
+        // ONE statement, so the cap and the write cannot be separated by another writer. The row
+        // source is a `SELECT ... WHERE` rather than `VALUES` precisely so the admission test rides
+        // inside the insert: SQLite serializes statements, so a concurrent enrolment either sees this
+        // row or is seen by it, and can never read the same free slot twice.
+        //
+        // The predicate admits an existing endpoint unconditionally (`EXISTS`) before it consults the
+        // count, because the count includes that row: without the first half, a workspace sitting
+        // exactly at the limit could no longer edit, disable or re-point what it had already
+        // registered, which are the only ways back under it.
+        //
+        // The `WHERE` also disambiguates the parse. SQLite cannot otherwise tell an upsert's `ON
+        // CONFLICT` from a join's `ON` in an `INSERT ... SELECT`, and its documented fix is exactly a
+        // `WHERE` clause on the SELECT, which this needs anyway.
+        const result = await this.db
             .prepare(`INSERT INTO notification_webhooks
-           (workspace_id, url, types, run_events, alert_events, enabled, secret_sealed, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (workspace_id) DO UPDATE SET
+           (workspace_id, id, name, url, types, run_events, alert_events, enabled, secret_sealed, updated_at)
+         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+         WHERE EXISTS (SELECT 1 FROM notification_webhooks WHERE workspace_id = ? AND id = ?)
+            OR (SELECT COUNT(*) FROM notification_webhooks WHERE workspace_id = ?) < ?
+         ON CONFLICT (workspace_id, id) DO UPDATE SET
+           name = excluded.name,
            url = excluded.url,
            types = excluded.types,
            run_events = excluded.run_events,
@@ -40,14 +57,31 @@ export class D1NotificationWebhookRepository {
            enabled = excluded.enabled,
            secret_sealed = excluded.secret_sealed,
            updated_at = excluded.updated_at`)
-            .bind(record.workspaceId, record.url, JSON.stringify(record.types), JSON.stringify(record.runEvents), JSON.stringify(record.alertEvents), record.enabled ? 1 : 0, record.secretSealed, record.updatedAt)
+            .bind(record.workspaceId, record.id, record.name, record.url, JSON.stringify(record.types), JSON.stringify(record.runEvents), JSON.stringify(record.alertEvents), record.enabled ? 1 : 0, record.secretSealed, record.updatedAt, record.workspaceId, record.id, record.workspaceId, limit)
             .run();
+        // A filtered-out row writes nothing, which is the refusal. An admitted one always reports a
+        // change, whether it inserted or took the conflict branch.
+        return (result.meta?.changes ?? 0) > 0 ? 'stored' : 'limit_reached';
     }
-    async delete(workspaceId) {
+    async delete(workspaceId, id) {
         await this.db
-            .prepare(`DELETE FROM notification_webhooks WHERE workspace_id = ?`)
-            .bind(workspaceId)
+            .prepare(`DELETE FROM notification_webhooks WHERE workspace_id = ? AND id = ?`)
+            .bind(workspaceId, id)
             .run();
     }
 }
+function toRecord(row) {
+    return {
+        workspaceId: row.workspace_id,
+        id: row.id,
+        name: row.name,
+        url: row.url,
+        types: parseNotificationWebhookTypes(row.types),
+        runEvents: parseRunLifecycleEvents(row.run_events),
+        alertEvents: parsePlatformAlertEvents(row.alert_events),
+        enabled: row.enabled === 1,
+        secretSealed: row.secret_sealed,
+        updatedAt: row.updated_at,
+    };
+}
 //# sourceMappingURL=D1NotificationWebhookRepository.js.map

package/dist/infrastructure/repositories/D1NotificationWebhookRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"D1NotificationWebhookRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1NotificationWebhookRepository.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAa5B;;;;GAIG;AACH,MAAM,OAAO,+BAA+B;IACzB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,4DAA4D,CAAC;aACrE,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,EAA0B,CAAA;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/C,SAAS,EAAE,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;YAClD,WAAW,EAAE,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC;YACvD,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;YAC1B,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAA;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAiC;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CACN;;;;;;;;;;4CAUoC,CACrC;aACA,IAAI,CACH,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,GAAG,EACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAClC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,SAAS,CACjB;aACA,GAAG,EAAE,CAAA;IACV,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,0DAA0D,CAAC;aACnE,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAAE,CAAA;IACV,CAAC;CACF"}
+{"version":3,"file":"D1NotificationWebhookRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/repositories/D1NotificationWebhookRepository.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAe5B;;;;;GAKG;AACH,MAAM,OAAO,+BAA+B;IACzB,EAAE,CAAY;IAE/B,YAAY,EAAE,EAAE,EAAsB;QACpC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,OAAO,CAAC,uEAAuE,CAAC;aAChF,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,KAAK,EAA0B,CAAA;QAClC,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAmB;QAC5B,6FAA6F;QAC7F,+FAA+F;QAC/F,4FAA4F;QAC5F,4EAA4E;QAC5E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE;aAC9B,OAAO,CACN,uFAAuF,CACxF;aACA,IAAI,CAAC,WAAW,CAAC;aACjB,GAAG,EAA0B,CAAA;QAChC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACtC,CAAC;IAED,KAAK,CAAC,GAAG,CACP,MAAiC,EACjC,KAAa;QAEb,yFAAyF;QACzF,4FAA4F;QAC5F,8FAA8F;QAC9F,qEAAqE;QACrE,EAAE;QACF,8FAA8F;QAC9F,0FAA0F;QAC1F,qFAAqF;QACrF,qDAAqD;QACrD,EAAE;QACF,yFAAyF;QACzF,8FAA8F;QAC9F,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,OAAO,CACN;;;;;;;;;;;;;4CAaoC,CACrC;aACA,IAAI,CACH,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,GAAG,EACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAClC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtB,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,EAAE,EACT,MAAM,CAAC,WAAW,EAClB,KAAK,CACN;aACA,GAAG,EAAE,CAAA;QACR,4FAA4F;QAC5F,2DAA2D;QAC3D,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAA;IACrE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,IAAI,CAAC,EAAE;aACV,OAAO,CAAC,qEAAqE,CAAC;aAC9E,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACrB,GAAG,EAAE,CAAA;IACV,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAA2B;IAC3C,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC;QAC/C,SAAS,EAAE,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC;QACvD,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;QAC1B,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAA;AACH,CAAC"}

package/migrations/0085_notification_webhook_collection.sql

@@ -0,0 +1,37 @@
+-- Several NAMED outbound webhooks per workspace, replacing the one-row-per-workspace shape from
+-- migration 0061. One endpoint per workspace made a second integration's enrolment a hostile act:
+-- registering it overwrote whatever was already there, and the only symptom was that the previous
+-- receiver went quiet. Each row now carries a caller-chosen `id` (the key, alongside the workspace)
+-- and an operator-facing `name`.
+--
+-- SQLite cannot re-key a table in place, so this is the standard rebuild. Existing rows migrate to
+-- the id `default`, which is exactly what the singular `/api/v1/notification-webhook` routes now
+-- address: an already-registered endpoint keeps delivering, and the caller that registered it keeps
+-- addressing it through the same route.
+
+CREATE TABLE notification_webhooks_new (
+  workspace_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  name TEXT NOT NULL,
+  url TEXT NOT NULL,
+  types TEXT NOT NULL DEFAULT '[]',
+  run_events TEXT NOT NULL DEFAULT '[]',
+  alert_events TEXT NOT NULL DEFAULT '[]',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  secret_sealed TEXT,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (workspace_id, id)
+);
+
+INSERT INTO notification_webhooks_new
+  (workspace_id, id, name, url, types, run_events, alert_events, enabled, secret_sealed, updated_at)
+SELECT
+  workspace_id, 'default', 'Default', url, types, run_events, alert_events, enabled, secret_sealed, updated_at
+FROM notification_webhooks;
+
+DROP TABLE notification_webhooks;
+
+ALTER TABLE notification_webhooks_new RENAME TO notification_webhooks;
+
+-- No extra index on `workspace_id`: it is the leading column of the composite primary key, so the
+-- per-workspace list every delivery reads is already served by that index.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/worker",
-  "version": "0.171.2",
+  "version": "0.172.0",
   "description": "Reusable Cloudflare Worker library (Hono + D1) exposing the Agent Architecture Board core: the `createApp()` Hono factory, the default fetch/scheduled/queue handler, and the Durable Object + Workflow classes. Deployments (see deploy/backend) supply the wrangler.toml + config and re-export these.",
   "repository": {
     "type": "git",
@@ -43,22 +43,22 @@
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
     "workers-ai-provider": "^4.0.0",
-    "@cat-factory/agents": "0.117.5",
-    "@cat-factory/caching": "0.18.6",
-    "@cat-factory/consensus": "0.14.51",
-    "@cat-factory/contracts": "0.267.0",
-    "@cat-factory/eks": "0.1.263",
-    "@cat-factory/gates": "0.9.31",
-    "@cat-factory/gitlab": "0.17.2",
-    "@cat-factory/integrations": "0.143.1",
-    "@cat-factory/kernel": "0.265.0",
-    "@cat-factory/observability-langfuse": "0.10.35",
-    "@cat-factory/observability-otel": "0.17.6",
-    "@cat-factory/orchestration": "0.234.0",
-    "@cat-factory/prompt-fragments": "1.0.15",
-    "@cat-factory/provider-cloudflare": "0.7.413",
-    "@cat-factory/server": "0.245.0",
-    "@cat-factory/spend": "0.15.33"
+    "@cat-factory/agents": "0.117.6",
+    "@cat-factory/caching": "0.18.7",
+    "@cat-factory/eks": "0.1.264",
+    "@cat-factory/consensus": "0.14.52",
+    "@cat-factory/gitlab": "0.17.3",
+    "@cat-factory/contracts": "0.268.0",
+    "@cat-factory/gates": "0.9.32",
+    "@cat-factory/observability-langfuse": "0.10.36",
+    "@cat-factory/orchestration": "0.234.1",
+    "@cat-factory/prompt-fragments": "1.0.16",
+    "@cat-factory/provider-cloudflare": "0.7.414",
+    "@cat-factory/kernel": "0.266.0",
+    "@cat-factory/spend": "0.15.34",
+    "@cat-factory/integrations": "0.144.0",
+    "@cat-factory/observability-otel": "0.17.7",
+    "@cat-factory/server": "0.246.0"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.20.1",
@@ -66,7 +66,7 @@
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
     "wrangler": "^4.118.0",
-    "@cat-factory/conformance": "0.31.27"
+    "@cat-factory/conformance": "0.31.28"
   },
   "scripts": {
     "build": "tsc -b tsconfig.build.json",