@classytic/arc 2.41.1 → 2.44.0

package/dist/integrations/webhooks.d.mts

@@ -1,10 +1,10 @@
 
-import { a as EventTransport, n as DomainEvent } from "../EventTransport-CbUKDzZZ.mjs";
-import { n as OutboxModuleOptions, r as createOutboxModule } from "../outbox-module-BHdUnuuK.mjs";
+import { a as EventTransport, n as DomainEvent } from "../EventTransport-CiicKz2Z.mjs";
+import { i as createOutboxModule, r as OutboxModuleOptions } from "../outbox-module-gZCHoE4H.mjs";
 import { FastifyPluginAsync } from "fastify";
 import { OutboxFailurePolicy, OutboxStore } from "@classytic/primitives/outbox";
 //#region src/integrations/webhooks.d.ts
-interface WebhookSubscription {
+export interface WebhookSubscription {
   /** Unique subscription ID */
   id: string;
   /** Delivery URL */
@@ -16,7 +16,7 @@ interface WebhookSubscription {
   /** Optional metadata */
   metadata?: Record<string, unknown>;
 }
-interface WebhookDeliveryRecord {
+export interface WebhookDeliveryRecord {
   subscriptionId: string;
   eventType: string;
   success: boolean;
@@ -27,13 +27,13 @@ interface WebhookDeliveryRecord {
   attempts?: number;
 }
 /** Pluggable persistence — memory for dev, bring your own DB for prod */
-interface WebhookStore {
+export interface WebhookStore {
   readonly name: string;
   getAll(): Promise<WebhookSubscription[]>;
   save(sub: WebhookSubscription): Promise<void>;
   remove(id: string): Promise<void>;
 }
-interface WebhookPluginOptions {
+export interface WebhookPluginOptions {
   /** Custom store for persistent subscriptions (default: in-memory) */
   store?: WebhookStore;
   /** Custom fetch (for testing) */
@@ -42,24 +42,15 @@ interface WebhookPluginOptions {
   timeout?: number;
   /** Max delivery log entries kept in memory (default: 1000) */
   maxLogEntries?: number;
-  /**
-   * Max concurrent deliveries per event (default: 5). Set to 1 for
-   * sequential. Must be >= 1 — the plugin throws at registration otherwise
-   * (a zero would make the delivery loop spin forever without progress).
-   */
+  /** Max concurrent deliveries per event, integer >= 1 (default: 5). */
   concurrency?: number;
   /**
-   * In-process retry for failed deliveries. Default: single attempt.
-   * Retries fire on network errors, timeouts, 429 and 5xx — NOT on other
-   * 4xx (the receiver rejected the payload; repeating it can't succeed).
-   * Each attempt is re-signed with a fresh timestamp so the receiver's
-   * replay-tolerance window applies per attempt; `x-arc-webhook-delivery`
-   * stays constant, which is exactly what receiver-side dedup keys on.
+   * In-process retry (default: single attempt) on network errors, timeouts,
+   * 429 and 5xx — not other 4xx. Each attempt is re-signed with a fresh
+   * timestamp; `x-arc-webhook-delivery` stays constant for receiver dedup.
    *
-   * This is BEST-EFFORT: attempts live in this process, so a crash or
-   * deploy drops the remaining ones. Guaranteed delivery is a durable-job
-   * concern (queue keyed by subscription + delivery id) — pair the events
-   * outbox with a worker if you need it.
+   * BEST-EFFORT: a crash or deploy drops remaining attempts. Use `durable`
+   * for guaranteed delivery.
    */
   retry?: {
     /** Total attempts including the first. Must be an integer >= 1. */
@@ -68,39 +59,24 @@ interface WebhookPluginOptions {
     backoffMs?: number;
   };
   /**
-   * URL policy hook — the SSRF seam for tenant-registered URLs. Throw to
-   * reject. Pass {@link defaultWebhookUrlPolicy} to require HTTPS and block
-   * localhost / link-local / private-network / cloud-metadata destinations,
-   * or supply your own (allowlists, per-tenant rules).
-   *
-   * Enforcement points when set:
-   *  - `register()` — new subscriptions are validated BEFORE saving.
-   *  - Plugin init — every PERSISTED subscription is re-validated; failures
-   *    are excluded from dispatch and logged (they stay in the store for
-   *    the host to fix), so pre-policy rows and out-of-band store writes
-   *    can't bypass the policy.
-   *  - Delivery — `fetch` runs with `redirect: "manual"`, so an allowed
-   *    public URL can't 302 into a blocked private/metadata target; a 3xx
-   *    records as a failed delivery.
+   * URL policy — the SSRF seam for tenant-registered URLs; throw to reject.
+   * Pass {@link defaultWebhookUrlPolicy} or your own. No policy applies by
+   * default (internal webhooks to private services are legitimate).
    *
-   * Arc deliberately ships no DEFAULT policy — deployments differ (internal
-   * webhooks to private services are legitimate), and DNS-rebinding
-   * protection belongs at the actual outbound network boundary, not in the
-   * framework.
+   * When set it is enforced:
+   *  - on `register()`, before saving;
+   *  - at init on every PERSISTED subscription — failures are excluded from
+   *    dispatch and logged, so pre-policy / out-of-band rows can't bypass it;
+   *  - at delivery via `redirect: "manual"`, so an allowed URL can't 302 into
+   *    a blocked target (a 3xx records as failed).
    */
   validateUrl?: (url: URL, subscription: WebhookSubscription) => void | Promise<void>;
   /**
-   * DURABLE delivery — the outbox→worker composition. When set, a matching
-   * event no longer POSTs inline: each (event × subscription) pair becomes ONE
-   * durable row in the given outbox store, and `createDurableWebhookModule`'s
-   * relay claims, delivers, retries with backoff, and dead-letters — all
-   * surviving crash and deploy, which the in-process `retry` cannot.
-   *
-   * The row id is deterministic (`<event id>:wh:<subscription id>`) and the
-   * save carries it as `dedupeKey`, so an at-least-once upstream (Redis
-   * Streams, an events outbox) redelivering the same event enqueues each
-   * delivery exactly once. Mutually exclusive with `retry` — the retry axis
-   * moves to the relay's failure policy.
+   * Durable delivery: each (event × subscription) becomes one outbox row that
+   * `createDurableWebhookModule`'s relay delivers, retries and dead-letters,
+   * surviving crash and deploy. The row id `<event id>:wh:<subscription id>`
+   * doubles as `dedupeKey`, so an at-least-once upstream enqueues each
+   * delivery once. Mutually exclusive with `retry`.
    */
   durable?: {
     /** Outbox store the delivery rows are written to — share it with the module. */
@@ -108,20 +84,13 @@ interface WebhookPluginOptions {
   };
 }
 /** `WebhookSubscription` as returned by `list()` — secret withheld. */
-type WebhookSubscriptionPublic = Omit<WebhookSubscription, "secret">;
-interface WebhookManager {
+export type WebhookSubscriptionPublic = Omit<WebhookSubscription, "secret">;
+export interface WebhookManager {
   register(sub: WebhookSubscription): Promise<void> | void;
   unregister(id: string): Promise<void> | void;
-  /**
-   * Enumerate subscriptions WITHOUT their secrets — safe to surface in
-   * admin UIs / API responses. Use {@link WebhookManager.getSecret} for
-   * the privileged retrieval path.
-   */
+  /** Subscriptions WITHOUT secrets — safe for admin UIs / API responses. */
   list(): WebhookSubscriptionPublic[];
-  /**
-   * Privileged secret retrieval — separate from `list()` so enumerating
-   * subscriptions never leaks signing material into logs or UIs.
-   */
+  /** Privileged secret retrieval, kept out of `list()` so enumeration never leaks it. */
   getSecret(id: string): string | undefined;
   deliveryLog(limit?: number): WebhookDeliveryRecord[];
 }
@@ -131,14 +100,11 @@ declare module "fastify" {
   }
 }
 /**
- * Signed-string layout for the v1 webhook contract:
- *
- *     v1.<timestampMs>.<deliveryId>.<body>
+ * Sign a v1 webhook. Signed string: `v1.<timestampMs>.<deliveryId>.<body>`.
  *
- * Binding the timestamp bounds replay to the verifier's tolerance window,
- * and binding the delivery id lets receivers deduplicate redeliveries on an
- * AUTHENTICATED value (the legacy `x-webhook-id` header was unsigned — an
- * attacker replaying a captured request could change it and defeat dedup).
+ * The timestamp bounds replay to the verifier's tolerance window; the
+ * delivery id is signed so receivers dedupe on an AUTHENTICATED value (an
+ * unsigned id header could be altered on replay to defeat dedup).
  *
  * Wire headers:
  *   - `x-arc-webhook-signature: v1=<hex hmac-sha256>`
@@ -147,11 +113,11 @@ declare module "fastify" {
  *     `meta.id` — STABLE across retries of the same event, so dedup on it
  *     collapses redeliveries)
  */
-declare function signWebhook(body: string, secret: string, meta: {
+export declare function signWebhook(body: string, secret: string, meta: {
   timestamp: number;
   deliveryId: string;
 }): string;
-interface VerifyWebhookInput {
+export interface VerifyWebhookInput {
   /** Raw request body — the exact bytes the sender signed (`req.rawBody`). */
   body: string | Buffer;
   /** Shared secret. */
@@ -170,7 +136,7 @@ interface VerifyWebhookInput {
   /** Injectable clock for tests. @default Date.now */
   now?: () => number;
 }
-type VerifyWebhookResult = {
+export type VerifyWebhookResult = {
   valid: true;
   /** The AUTHENTICATED delivery id — dedup redeliveries on this. */
   deliveryId: string;
@@ -203,10 +169,17 @@ type VerifyWebhookResult = {
  * });
  * ```
  */
-declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
-declare function defaultWebhookUrlPolicy(url: URL): void;
+export declare function verifyWebhook(input: VerifyWebhookInput): VerifyWebhookResult;
+/**
+ * Opt-in URL policy: requires HTTPS and rejects loopback, link-local,
+ * private-network and cloud-metadata hosts. Pass as `validateUrl`.
+ *
+ * Validates the URL LITERAL only — no DNS resolution. Rebinding protection
+ * belongs at the outbound network boundary (egress proxy / network policy).
+ */
+export declare function defaultWebhookUrlPolicy(url: URL): void;
 /** Options for `verifySignature` — customize for non-Arc webhook senders */
-interface VerifySignatureOptions {
+export interface VerifySignatureOptions {
   /**
    * Expected prefix before the hex digest (default: `'sha256='`).
    * Set to `''` for bare hex signatures.
@@ -219,56 +192,34 @@ interface VerifySignatureOptions {
   algorithm?: string;
 }
 /**
- * Verify an INBOUND third-party webhook signature using timing-safe
- * comparison — for webhooks arc RECEIVES (GitHub, Stripe, ...), not for
- * arc-to-arc delivery. Arc's own outbound contract is v1
- * (`x-arc-webhook-*`) — receivers of arc webhooks use {@link verifyWebhook}.
- *
- * Defaults to the common `sha256=<hex>` format; configurable for any HMAC
- * scheme via options.
+ * Timing-safe verification of an INBOUND third-party webhook (GitHub,
+ * Stripe, ...). Defaults to `sha256=<hex>`; prefix/algorithm configurable.
+ * Receivers of arc's own webhooks use {@link verifyWebhook}.
  *
- * ⚠ The `body` argument must be the exact bytes the sender signed. Fastify
- * parses JSON bodies by default and the re-serialised object will NOT match
- * the original signature. Register `fastify-raw-body` (arc's createApp does
- * this automatically with `global: false`) and opt the route in via
- * `config: { rawBody: true }`, then pass `req.rawBody` here.
+ * ⚠ `body` must be the exact signed bytes: opt the route into
+ * `config: { rawBody: true }` (arc registers fastify-raw-body with
+ * `global: false`) and pass `req.rawBody` — re-serialised JSON won't match.
  *
- * @param body      - Raw request body (string or Buffer — must be the exact bytes the sender signed)
- * @param secret    - Shared secret between sender and receiver
- * @param signature - The signature header value (e.g. `req.headers['x-webhook-signature']`)
- * @param options   - Override prefix/algorithm for non-Arc senders
- * @returns `true` if valid, `false` otherwise — never throws
+ * @returns `true` if valid, `false` otherwise. Throws `TypeError` only when
+ *   `body` is not a string/Buffer.
  *
  * @example
  * ```typescript
- * import { verifySignature } from '@classytic/arc/integrations/webhooks';
- *
- * // `config: { rawBody: true }` is REQUIRED — arc registers
- * // fastify-raw-body with `global: false`, so routes opt in per-route;
- * // without it `req.rawBody` is undefined and verifySignature throws a
- * // TypeError.
- *
- * // GitHub-style sender (sha256=<hex>)
  * fastify.post('/webhooks/github', { config: { rawBody: true } }, async (req, reply) => {
  *   const sig = req.headers['x-hub-signature-256'] as string;
  *   if (!verifySignature(req.rawBody, secret, sig)) {
  *     return reply.status(401).send({ error: 'Invalid signature' });
  *   }
  * });
- *
- * // Stripe-style (bare hex, different header)
- * const valid = verifySignature(body, stripeSecret, req.headers['stripe-signature'], {
- *   prefix: '',
- * });
  * ```
  */
-declare function verifySignature(body: string | Buffer, secret: string, signature: string | undefined, options?: VerifySignatureOptions): boolean;
+export declare function verifySignature(body: string | Buffer, secret: string, signature: string | undefined, options?: VerifySignatureOptions): boolean;
 declare const webhookPlugin: FastifyPluginAsync<WebhookPluginOptions>;
 declare const _default: FastifyPluginAsync<WebhookPluginOptions>;
 /** Event type carried by durable webhook delivery rows. */
-declare const WEBHOOK_DELIVERY_EVENT = "arc.webhook.delivery";
+export declare const WEBHOOK_DELIVERY_EVENT = "arc.webhook.delivery";
 /** Payload of a {@link WEBHOOK_DELIVERY_EVENT} row. */
-interface WebhookDeliveryPayload {
+export interface WebhookDeliveryPayload {
   subscriptionId: string;
   /** The original event, verbatim — what the receiver is signed and sent. */
   event: {
@@ -278,12 +229,10 @@ interface WebhookDeliveryPayload {
   };
 }
 /**
- * A failed webhook POST, classified for the failure policy: `transient`
- * failures (network error, timeout, 429, 5xx) are worth retrying; the rest
- * (4xx rejection, 3xx under `redirect: "manual"`, URL-policy rejection,
- * malformed row) are final for this payload and dead-letter immediately.
+ * A failed webhook POST. `transient` (network, timeout, 429, 5xx) retries;
+ * anything else (4xx, 3xx, URL-policy rejection, malformed row) dead-letters.
  */
-declare class WebhookDeliveryError extends Error {
+export declare class WebhookDeliveryError extends Error {
   readonly status?: number;
   readonly transient: boolean;
   constructor(message: string, options: {
@@ -292,11 +241,10 @@ declare class WebhookDeliveryError extends Error {
     cause?: unknown;
   });
 }
-interface WebhookDeliveryTransportOptions {
+export interface WebhookDeliveryTransportOptions {
   /**
-   * Resolve a subscription (WITH secret) at delivery time — fresh URL and
-   * secret apply to every attempt, and an unregistered id is an acknowledged
-   * no-op (the delivery is moot, not an error).
+   * Resolve a subscription (WITH secret) per attempt. `undefined` (unregistered)
+   * acknowledges the delivery as moot.
    */
   getSubscription: (id: string) => WebhookSubscription | undefined | Promise<WebhookSubscription | undefined>;
   /** Custom fetch (for testing). */
@@ -304,28 +252,23 @@ interface WebhookDeliveryTransportOptions {
   /** Per-POST timeout in ms (default: 10000). */
   timeout?: number;
   /**
-   * URL policy — same seam as {@link WebhookPluginOptions.validateUrl}, but
-   * enforced at DELIVERY time (covers rows enqueued before a policy existed
-   * and out-of-band store writes). When set, `redirect: "manual"` applies so
-   * an allowed URL can't 302 into a blocked target; a rejection is permanent.
+   * Same seam as {@link WebhookPluginOptions.validateUrl}, enforced at
+   * DELIVERY time (with `redirect: "manual"`); a rejection is permanent.
    */
   validateUrl?: (url: URL, subscription: WebhookSubscription) => void | Promise<void>;
   /** Resolve private auth headers at delivery time; reserved Arc headers cannot be replaced. */
   resolveHeaders?: (subscription: WebhookSubscription, event: WebhookDeliveryPayload["event"]) => Record<string, string> | Promise<Record<string, string>>;
 }
 /**
- * Publish-only `EventTransport` whose `publish()` IS the webhook POST —
- * plugged into an outbox relay, delivery inherits the relay's guarantees.
- * Throws {@link WebhookDeliveryError} on failure so the relay observes it
- * (fail → policy → retryAt/deadLetter); returns normally on 2xx and on
- * unregistered subscriptions (acknowledge).
+ * Publish-only `EventTransport` whose `publish()` IS the webhook POST, for an
+ * outbox relay. Throws {@link WebhookDeliveryError} on failure; returns on
+ * 2xx or an unregistered subscription.
  *
- * The wire contract is IDENTICAL to inline dispatch: v1 signing, and
- * `x-arc-webhook-delivery` carries the ORIGINAL event's `meta.id` — stable
- * across retries, so receiver-side dedup is unchanged.
+ * Same wire contract as inline dispatch: `x-arc-webhook-delivery` is the
+ * ORIGINAL event's `meta.id`, stable across retries.
  */
-declare function createWebhookDeliveryTransport(options: WebhookDeliveryTransportOptions): EventTransport;
-interface WebhookDeliveryPolicyOptions {
+export declare function createWebhookDeliveryTransport(options: WebhookDeliveryTransportOptions): EventTransport;
+export interface WebhookDeliveryPolicyOptions {
   /** Total attempts before dead-lettering (default: 8). */
   maxAttempts?: number;
   /** First retry delay in ms (default: 5000). */
@@ -334,13 +277,12 @@ interface WebhookDeliveryPolicyOptions {
   maxMs?: number;
 }
 /**
- * Default failure policy for durable webhook delivery: permanent failures
- * ({@link WebhookDeliveryError} with `transient: false`) dead-letter on the
- * first attempt — repeating a rejected payload can't succeed; transient ones
- * retry on exponential backoff until `maxAttempts`, then dead-letter.
+ * Default durable-delivery policy: non-transient {@link WebhookDeliveryError}s
+ * dead-letter immediately; others retry with exponential backoff until
+ * `maxAttempts`.
  */
-declare function webhookDeliveryFailurePolicy(options?: WebhookDeliveryPolicyOptions): OutboxFailurePolicy;
-interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl" | "resolveHeaders"> {
+export declare function webhookDeliveryFailurePolicy(options?: WebhookDeliveryPolicyOptions): OutboxFailurePolicy;
+export interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" | "transport" | "failurePolicy">, Pick<WebhookDeliveryTransportOptions, "fetch" | "timeout" | "validateUrl" | "resolveHeaders"> {
   /** Module name / `dependsOn` key. Default `'webhook-delivery'`. */
   name?: string;
   /** Retry/backoff tuning for the default failure policy. */
@@ -363,12 +305,10 @@ interface DurableWebhookModuleOptions extends Omit<OutboxModuleOptions, "name" |
  * });
  * ```
  *
- * The relay arm is `kind: 'relay'`, so `role: 'relay'` deployments run
- * delivery and `role: 'api'` deployments only enqueue. The delivering process
- * must ALSO register `webhookPlugin` (with the shared subscription store) —
- * subscriptions resolve through `fastify.webhooks` at delivery time, which is
- * boot-checked, not discovered on the first row.
+ * `role: 'relay'` deployments deliver; `role: 'api'` only enqueues. The
+ * delivering process must ALSO register `webhookPlugin` with the shared
+ * subscription store (boot-checked).
  */
-declare function createDurableWebhookModule(options: DurableWebhookModuleOptions): ReturnType<typeof createOutboxModule>;
+export declare function createDurableWebhookModule(options: DurableWebhookModuleOptions): ReturnType<typeof createOutboxModule>;
 //#endregion
-export { DurableWebhookModuleOptions, VerifySignatureOptions, VerifyWebhookInput, VerifyWebhookResult, WEBHOOK_DELIVERY_EVENT, WebhookDeliveryError, WebhookDeliveryPayload, WebhookDeliveryPolicyOptions, WebhookDeliveryRecord, WebhookDeliveryTransportOptions, WebhookManager, WebhookPluginOptions, WebhookStore, WebhookSubscription, WebhookSubscriptionPublic, createDurableWebhookModule, createWebhookDeliveryTransport, _default as default, defaultWebhookUrlPolicy, signWebhook, verifySignature, verifyWebhook, webhookDeliveryFailurePolicy, webhookPlugin };
+export { _default as default, webhookPlugin };

package/dist/integrations/webhooks.mjs

@@ -1,9 +1,9 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
-import { n as declareRuntimeCapability } from "../runtimeCapabilities-CkhS6jn6.mjs";
-import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-D2z5WkDY.mjs";
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { n as declareRuntimeCapability } from "../runtimeCapabilities-DIMKMV2G.mjs";
+import { i as exponentialBackoff, t as createOutboxModule } from "../outbox-module-Ryk270jd.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import fp from "fastify-plugin";
-import { createChildEvent } from "@classytic/primitives/events";
+import { createChildEvent, matchEventPattern } from "@classytic/primitives/events";
 //#region src/integrations/webhooks.ts
 /**
 * Outbound webhooks — auto-dispatch arc events to registered endpoints with
@@ -22,14 +22,11 @@ import { createChildEvent } from "@classytic/primitives/events";
 * ```
 */
 /**
-* Signed-string layout for the v1 webhook contract:
+* Sign a v1 webhook. Signed string: `v1.<timestampMs>.<deliveryId>.<body>`.
 *
-*     v1.<timestampMs>.<deliveryId>.<body>
-*
-* Binding the timestamp bounds replay to the verifier's tolerance window,
-* and binding the delivery id lets receivers deduplicate redeliveries on an
-* AUTHENTICATED value (the legacy `x-webhook-id` header was unsigned — an
-* attacker replaying a captured request could change it and defeat dedup).
+* The timestamp bounds replay to the verifier's tolerance window; the
+* delivery id is signed so receivers dedupe on an AUTHENTICATED value (an
+* unsigned id header could be altered on replay to defeat dedup).
 *
 * Wire headers:
 *   - `x-arc-webhook-signature: v1=<hex hmac-sha256>`
@@ -98,18 +95,14 @@ function verifyWebhook(input) {
 		timestamp
 	};
 }
+const BLOCKED_V4 = /^(?:127\.|10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|0\.)/;
 /**
-* Opt-in URL policy for tenant-registered webhooks: requires HTTPS and
-* rejects loopback, link-local, private-network, and cloud-metadata
-* destinations. Pass as `validateUrl: defaultWebhookUrlPolicy`.
+* Opt-in URL policy: requires HTTPS and rejects loopback, link-local,
+* private-network and cloud-metadata hosts. Pass as `validateUrl`.
 *
-* Scope note: this validates the URL LITERAL at registration time. It does
-* not resolve DNS — rebinding/level-2 SSRF protection belongs at the actual
-* outbound network boundary (egress proxy, network policy), where the real
-* connection target is known. Internal deployments that legitimately POST
-* to private services should write their own narrower policy instead.
+* Validates the URL LITERAL only — no DNS resolution. Rebinding protection
+* belongs at the outbound network boundary (egress proxy / network policy).
 */
-const BLOCKED_V4 = /^(?:127\.|10\.|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.|169\.254\.|0\.)/;
 function defaultWebhookUrlPolicy(url) {
 	if (url.protocol !== "https:") throw new Error(`Webhook URL must use https (got ${url.protocol}//)`);
 	let host = url.hostname.toLowerCase();
@@ -136,47 +129,25 @@ function decodeMappedV4(host) {
 	return `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
 }
 /**
-* Verify an INBOUND third-party webhook signature using timing-safe
-* comparison — for webhooks arc RECEIVES (GitHub, Stripe, ...), not for
-* arc-to-arc delivery. Arc's own outbound contract is v1
-* (`x-arc-webhook-*`) — receivers of arc webhooks use {@link verifyWebhook}.
+* Timing-safe verification of an INBOUND third-party webhook (GitHub,
+* Stripe, ...). Defaults to `sha256=<hex>`; prefix/algorithm configurable.
+* Receivers of arc's own webhooks use {@link verifyWebhook}.
 *
-* Defaults to the common `sha256=<hex>` format; configurable for any HMAC
-* scheme via options.
+* ⚠ `body` must be the exact signed bytes: opt the route into
+* `config: { rawBody: true }` (arc registers fastify-raw-body with
+* `global: false`) and pass `req.rawBody` — re-serialised JSON won't match.
 *
-* ⚠ The `body` argument must be the exact bytes the sender signed. Fastify
-* parses JSON bodies by default and the re-serialised object will NOT match
-* the original signature. Register `fastify-raw-body` (arc's createApp does
-* this automatically with `global: false`) and opt the route in via
-* `config: { rawBody: true }`, then pass `req.rawBody` here.
-*
-* @param body      - Raw request body (string or Buffer — must be the exact bytes the sender signed)
-* @param secret    - Shared secret between sender and receiver
-* @param signature - The signature header value (e.g. `req.headers['x-webhook-signature']`)
-* @param options   - Override prefix/algorithm for non-Arc senders
-* @returns `true` if valid, `false` otherwise — never throws
+* @returns `true` if valid, `false` otherwise. Throws `TypeError` only when
+*   `body` is not a string/Buffer.
 *
 * @example
 * ```typescript
-* import { verifySignature } from '@classytic/arc/integrations/webhooks';
-*
-* // `config: { rawBody: true }` is REQUIRED — arc registers
-* // fastify-raw-body with `global: false`, so routes opt in per-route;
-* // without it `req.rawBody` is undefined and verifySignature throws a
-* // TypeError.
-*
-* // GitHub-style sender (sha256=<hex>)
 * fastify.post('/webhooks/github', { config: { rawBody: true } }, async (req, reply) => {
 *   const sig = req.headers['x-hub-signature-256'] as string;
 *   if (!verifySignature(req.rawBody, secret, sig)) {
 *     return reply.status(401).send({ error: 'Invalid signature' });
 *   }
 * });
-*
-* // Stripe-style (bare hex, different header)
-* const valid = verifySignature(body, stripeSecret, req.headers['stripe-signature'], {
-*   prefix: '',
-* });
 * ```
 */
 function verifySignature(body, secret, signature, options) {
@@ -197,16 +168,9 @@ function verifySignature(body, secret, signature, options) {
 		return false;
 	}
 }
+/** The transports' own matcher — a local copy missed `order:*` (the `:` convention). */
 function matchesPattern(patterns, eventType) {
-	for (const pattern of patterns) {
-		if (pattern === "*") return true;
-		if (pattern === eventType) return true;
-		if (pattern.endsWith(".*")) {
-			const prefix = pattern.slice(0, -2);
-			if (eventType.startsWith(`${prefix}.`)) return true;
-		}
-	}
-	return false;
+	return patterns.some((pattern) => matchEventPattern(pattern, eventType));
 }
 var MemoryWebhookStore = class {
 	name = "memory";
@@ -376,10 +340,8 @@ var webhooks_default = fp(webhookPlugin, {
 /** Event type carried by durable webhook delivery rows. */
 const WEBHOOK_DELIVERY_EVENT = "arc.webhook.delivery";
 /**
-* A failed webhook POST, classified for the failure policy: `transient`
-* failures (network error, timeout, 429, 5xx) are worth retrying; the rest
-* (4xx rejection, 3xx under `redirect: "manual"`, URL-policy rejection,
-* malformed row) are final for this payload and dead-letter immediately.
+* A failed webhook POST. `transient` (network, timeout, 429, 5xx) retries;
+* anything else (4xx, 3xx, URL-policy rejection, malformed row) dead-letters.
 */
 var WebhookDeliveryError = class extends Error {
 	status;
@@ -392,15 +354,12 @@ var WebhookDeliveryError = class extends Error {
 	}
 };
 /**
-* Publish-only `EventTransport` whose `publish()` IS the webhook POST —
-* plugged into an outbox relay, delivery inherits the relay's guarantees.
-* Throws {@link WebhookDeliveryError} on failure so the relay observes it
-* (fail → policy → retryAt/deadLetter); returns normally on 2xx and on
-* unregistered subscriptions (acknowledge).
+* Publish-only `EventTransport` whose `publish()` IS the webhook POST, for an
+* outbox relay. Throws {@link WebhookDeliveryError} on failure; returns on
+* 2xx or an unregistered subscription.
 *
-* The wire contract is IDENTICAL to inline dispatch: v1 signing, and
-* `x-arc-webhook-delivery` carries the ORIGINAL event's `meta.id` — stable
-* across retries, so receiver-side dedup is unchanged.
+* Same wire contract as inline dispatch: `x-arc-webhook-delivery` is the
+* ORIGINAL event's `meta.id`, stable across retries.
 */
 function createWebhookDeliveryTransport(options) {
 	const fetchFn = options.fetch ?? globalThis.fetch;
@@ -464,10 +423,9 @@ function createWebhookDeliveryTransport(options) {
 	};
 }
 /**
-* Default failure policy for durable webhook delivery: permanent failures
-* ({@link WebhookDeliveryError} with `transient: false`) dead-letter on the
-* first attempt — repeating a rejected payload can't succeed; transient ones
-* retry on exponential backoff until `maxAttempts`, then dead-letter.
+* Default durable-delivery policy: non-transient {@link WebhookDeliveryError}s
+* dead-letter immediately; others retry with exponential backoff until
+* `maxAttempts`.
 */
 function webhookDeliveryFailurePolicy(options = {}) {
 	const maxAttempts = options.maxAttempts ?? 8;
@@ -498,11 +456,9 @@ function webhookDeliveryFailurePolicy(options = {}) {
 * });
 * ```
 *
-* The relay arm is `kind: 'relay'`, so `role: 'relay'` deployments run
-* delivery and `role: 'api'` deployments only enqueue. The delivering process
-* must ALSO register `webhookPlugin` (with the shared subscription store) —
-* subscriptions resolve through `fastify.webhooks` at delivery time, which is
-* boot-checked, not discovered on the first row.
+* `role: 'relay'` deployments deliver; `role: 'api'` only enqueues. The
+* delivering process must ALSO register `webhookPlugin` with the shared
+* subscription store (boot-checked).
 */
 function createDurableWebhookModule(options) {
 	const { name, delivery, failurePolicy, fetch, timeout, validateUrl, resolveHeaders, ...outboxOptions } = options;

package/dist/integrations/websocket-pushref-redis.d.mts

@@ -1,5 +1,5 @@
 
-import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as PushRefStore, t as EnvelopeSnapshot } from "../pushref-registry-Dov9l4qE.mjs";
+import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as PushRefStore, t as EnvelopeSnapshot } from "../pushref-registry-UxCkoA4C.mjs";
 //#region src/integrations/websocket-pushref-redis.d.ts
 /**
  * Minimal `ioredis` shape — typed structurally so this file doesn't
@@ -7,7 +7,7 @@ import { c as SerializedEntry, i as Principal, n as FencedWriteOutcome, s as Pus
  * `optional: true` in package.json; hosts who don't use this subpath
  * never need to install ioredis.
  */
-interface RedisLike {
+export interface RedisLike {
   get(key: string): Promise<string | null>;
   set(key: string, value: string, ...args: unknown[]): Promise<unknown>;
   del(key: string): Promise<number>;
@@ -15,7 +15,7 @@ interface RedisLike {
   scan(cursor: string | number, matchKw: "MATCH", pattern: string, countKw: "COUNT", count: number): Promise<[string, string[]]>;
   eval(script: string, numKeys: number, ...args: (string | number)[]): Promise<unknown>;
 }
-interface RedisPushRefStoreOptions {
+export interface RedisPushRefStoreOptions {
   /** Redis key namespace. Default `arc:pushref:`. */
   keyPrefix?: string;
   /**
@@ -25,7 +25,7 @@ interface RedisPushRefStoreOptions {
    */
   graceMs?: number;
 }
-declare class RedisPushRefStore implements PushRefStore {
+export declare class RedisPushRefStore implements PushRefStore {
   private redis;
   private prefix;
   private graceMs;
@@ -67,5 +67,4 @@ declare class RedisPushRefStore implements PushRefStore {
   gc(_now: number): Promise<number>;
   size(): Promise<number>;
 }
-//#endregion
-export { RedisLike, RedisPushRefStore, RedisPushRefStoreOptions };
+//#endregion

package/dist/integrations/websocket-pushref-redis.mjs

@@ -1,4 +1,4 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
 //#region src/integrations/websocket-pushref-redis.ts
 /**
 * Lua script for atomic claim. Runs server-side, single-roundtrip.