@cosmicdrift/kumiko-bundled-features 0.320.0 → 0.321.0

package/src/delivery/unsubscribe.ts

@@ -1,9 +1,12 @@
 import {
   type ExtraRouteDefinition,
   ExtraRouteRejection,
+  type SignatureExtraRouteDeps,
+  type SignatureExtraRouteVerifyRequest,
   signatureRoute,
 } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import * as jose from "jose";
 import * as z from "zod";
 import { hashUnsubscribeAddress } from "./address-opt-out";
@@ -55,8 +58,8 @@ export type AddressUnsubscribeTokenPayload = {
 /**
  * `secret` must be a value dedicated to unsubscribe-token signing — do NOT
  * reuse the app's session `JWT_SECRET`. The app mounting `extraRoutes:
- * [createUnsubscribeRoute({ secret })]` signs outgoing links with the same
- * value via `signUnsubscribeToken` / `signAddressUnsubscribeToken`.
+ * [...createUnsubscribeRoutes({ secret })]` signs outgoing links with the
+ * same value via `signUnsubscribeToken` / `signAddressUnsubscribeToken`.
  */
 export type UnsubscribeRouteOptions = {
   readonly secret: string;
@@ -152,110 +155,185 @@ type VerifiedUnsubscribe =
       readonly channel: string;
     };
 
-export function createUnsubscribeRoute(options: UnsubscribeRouteOptions): ExtraRouteDefinition {
-  assertUnsubscribeSecret(options.secret, "createUnsubscribeRoute");
-  const encodedSecret = new TextEncoder().encode(options.secret);
+// RFC 8058 fixed value — both the List-Unsubscribe-Post header and the body a
+// one-click client POSTs.
+export const DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE = "List-Unsubscribe=One-Click" as const;
 
-  return signatureRoute<VerifiedUnsubscribe>({
-    method: "GET",
-    path: DELIVERY_UNSUBSCRIBE_PATH,
-    entry: "signature",
-    // Every throw here must become the same ExtraRouteRejection(400,
-    // unsubscribe_token_invalid) — anything else falls through to the
-    // framework's generic 401 extra_route_signature_invalid mapping, which
-    // would leak jose's internal error text into the response body.
-    verify: async ({ query }) => {
-      try {
-        const token = query["token"];
-        if (!token) {
-          throw new ExtraRouteRejection(
-            400,
-            UNSUBSCRIBE_TOKEN_INVALID_BODY,
-            "missing unsubscribe token",
-          );
-        }
+const CONFIRMATION_PAGE_HEADERS = {
+  "Cache-Control": "no-store",
+  "Referrer-Policy": "no-referrer",
+} as const;
 
-        const { payload: verifiedPayload } = await jose.jwtVerify(token, encodedSecret, {
-          issuer: "kumiko:unsubscribe",
-        });
+// Every throw here must become the same ExtraRouteRejection(400,
+// unsubscribe_token_invalid) — anything else falls through to the
+// framework's generic 401 extra_route_signature_invalid mapping, which
+// would leak jose's internal error text into the response body.
+async function verifyUnsubscribeToken(
+  token: string | undefined,
+  encodedSecret: Uint8Array,
+): Promise<VerifiedUnsubscribe> {
+  try {
+    if (!token) {
+      throw new ExtraRouteRejection(
+        400,
+        UNSUBSCRIBE_TOKEN_INVALID_BODY,
+        "missing unsubscribe token",
+      );
+    }
 
-        const addressAttempt = addressUnsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
-        if (addressAttempt.success) {
-          const parsed = addressAttempt.data;
-          if (parsed.sub !== parsed.addressHash) {
-            throw new ExtraRouteRejection(
-              400,
-              UNSUBSCRIBE_TOKEN_INVALID_BODY,
-              "address token subject mismatch",
-            );
-          }
-          // @cast-boundary engine-bridge — string post-zod → branded TenantId
-          const tenantId = parsed.tenantId as TenantId;
-          return {
-            kind: "address",
-            tenantId,
-            addressHash: parsed.addressHash,
-            notificationType: parsed.notificationType,
-            channel: parsed.channel,
-          };
-        }
+    const { payload: verifiedPayload } = await jose.jwtVerify(token, encodedSecret, {
+      issuer: "kumiko:unsubscribe",
+    });
+
+    const addressAttempt = addressUnsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
+    if (addressAttempt.success) {
+      const parsed = addressAttempt.data;
+      if (parsed.sub !== parsed.addressHash) {
+        throw new ExtraRouteRejection(
+          400,
+          UNSUBSCRIBE_TOKEN_INVALID_BODY,
+          "address token subject mismatch",
+        );
+      }
+      // @cast-boundary engine-bridge — string post-zod → branded TenantId
+      const tenantId = parsed.tenantId as TenantId;
+      return {
+        kind: "address",
+        tenantId,
+        addressHash: parsed.addressHash,
+        notificationType: parsed.notificationType,
+        channel: parsed.channel,
+      };
+    }
+
+    const userAttempt = unsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
+    if (!userAttempt.success) {
+      throw new ExtraRouteRejection(
+        400,
+        UNSUBSCRIBE_TOKEN_INVALID_BODY,
+        "unsubscribe token payload matched neither schema",
+      );
+    }
+    const parsed = userAttempt.data;
+    // @cast-boundary engine-bridge — string post-zod → branded TenantId
+    const tenantId = parsed.tenantId as TenantId;
+    return {
+      kind: "user",
+      tenantId,
+      userId: parsed.sub,
+      notificationType: parsed.notificationType,
+      channel: parsed.channel,
+    };
+  } catch (err) {
+    if (err instanceof ExtraRouteRejection) throw err;
+    throw new ExtraRouteRejection(
+      400,
+      UNSUBSCRIBE_TOKEN_INVALID_BODY,
+      "unsubscribe token verification failed",
+    );
+  }
+}
 
-        const userAttempt = unsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
-        if (!userAttempt.success) {
-          throw new ExtraRouteRejection(
-            400,
-            UNSUBSCRIBE_TOKEN_INVALID_BODY,
-            "unsubscribe token payload matched neither schema",
-          );
+async function dispatchUnsubscribeWrite(
+  verified: VerifiedUnsubscribe,
+  deps: SignatureExtraRouteDeps,
+): Promise<boolean> {
+  const payload =
+    verified.kind === "address"
+      ? {
+          addressHash: verified.addressHash,
+          notificationType: verified.notificationType,
+          channel: verified.channel,
         }
-        const parsed = userAttempt.data;
-        // @cast-boundary engine-bridge — string post-zod → branded TenantId
-        const tenantId = parsed.tenantId as TenantId;
-        return {
-          kind: "user",
-          tenantId,
-          userId: parsed.sub,
-          notificationType: parsed.notificationType,
-          channel: parsed.channel,
+      : {
+          userId: verified.userId,
+          notificationType: verified.notificationType,
+          channel: verified.channel,
         };
-      } catch (err) {
-        if (err instanceof ExtraRouteRejection) throw err;
+
+  const dispatched = await deps.dispatchSystemWrite({
+    handlerQn:
+      verified.kind === "address"
+        ? DeliveryHandlers.unsubscribeAddress
+        : DeliveryHandlers.unsubscribeUser,
+    tenantId: verified.tenantId,
+    payload,
+  });
+  return dispatched.isSuccess;
+}
+
+function confirmationPage(token: string): string {
+  return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="robots" content="noindex">
+<title>Unsubscribe</title>
+</head>
+<body>
+<p>Unsubscribe from these emails?</p>
+<form method="post" action="${DELIVERY_UNSUBSCRIBE_PATH}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(token)}">
+<button type="submit">Unsubscribe</button>
+</form>
+</body>
+</html>`;
+}
+
+// One-click clients put the token in the query string; only the
+// confirmation-page form submits it in the body.
+function tokenFromPostRequest(request: SignatureExtraRouteVerifyRequest): string | undefined {
+  const contentType = request.headers["content-type"];
+  if (contentType?.includes("application/x-www-form-urlencoded")) {
+    const fromBody = new URLSearchParams(request.rawBody).get("token");
+    if (fromBody) return fromBody;
+  }
+  return request.query["token"];
+}
+
+// GET renders a confirmation page without writing; POST performs the opt-out.
+export function createUnsubscribeRoutes(
+  options: UnsubscribeRouteOptions,
+): readonly ExtraRouteDefinition[] {
+  assertUnsubscribeSecret(options.secret, "createUnsubscribeRoutes");
+  const encodedSecret = new TextEncoder().encode(options.secret);
+
+  const confirmRoute = signatureRoute<{ token: string }>({
+    method: "GET",
+    path: DELIVERY_UNSUBSCRIBE_PATH,
+    entry: "signature",
+    verify: async ({ query }) => {
+      const token = query["token"];
+      if (!token) {
         throw new ExtraRouteRejection(
           400,
           UNSUBSCRIBE_TOKEN_INVALID_BODY,
-          "unsubscribe token verification failed",
+          "missing unsubscribe token",
         );
       }
+      await verifyUnsubscribeToken(token, encodedSecret);
+      return { token };
     },
-    handler: async (c, verified, deps) => {
-      const payload =
-        verified.kind === "address"
-          ? {
-              addressHash: verified.addressHash,
-              notificationType: verified.notificationType,
-              channel: verified.channel,
-            }
-          : {
-              userId: verified.userId,
-              notificationType: verified.notificationType,
-              channel: verified.channel,
-            };
+    handler: async (c, { token }) =>
+      c.html(confirmationPage(token), 200, CONFIRMATION_PAGE_HEADERS),
+  });
 
+  const writeRoute = signatureRoute<VerifiedUnsubscribe>({
+    method: "POST",
+    path: DELIVERY_UNSUBSCRIBE_PATH,
+    entry: "signature",
+    verify: async (request) => verifyUnsubscribeToken(tokenFromPostRequest(request), encodedSecret),
+    handler: async (c, verified, deps) => {
       // Token-verify passed — everything below is a legitimate write. Don't
       // swallow write-errors as "invalid token", that would mask real bugs
       // (e.g. events-table missing, DB down) behind a misleading 400.
-      const dispatched = await deps.dispatchSystemWrite({
-        handlerQn:
-          verified.kind === "address"
-            ? DeliveryHandlers.unsubscribeAddress
-            : DeliveryHandlers.unsubscribeUser,
-        tenantId: verified.tenantId,
-        payload,
-      });
-      if (!dispatched.isSuccess) {
-        return c.text("Unsubscribe failed", 500);
+      const succeeded = await dispatchUnsubscribeWrite(verified, deps);
+      if (!succeeded) {
+        return c.html("Unsubscribe failed", 500, { "Cache-Control": "no-store" });
       }
-      return c.text("You have been unsubscribed.", 200);
+      return c.html("You have been unsubscribed.", 200, { "Cache-Control": "no-store" });
     },
   });
+
+  return [confirmRoute, writeRoute];
 }

package/src/step-dispatcher/__tests__/feature.boot.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from "bun:test";
 import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createSecretsFeature } from "../../secrets";
 import { createStepDispatcherFeature } from "../feature";
 
 describe("step-dispatcher (fw#2068)", () => {
@@ -7,7 +8,13 @@ describe("step-dispatcher (fw#2068)", () => {
     expect(createStepDispatcherFeature().systemScope).toBeFalsy();
   });
 
-  test("boot-validates standalone", () => {
-    expect(() => validateBoot([createStepDispatcherFeature()])).not.toThrow();
+  test("boot-validates alongside the secrets feature it requires", () => {
+    expect(() =>
+      validateBoot([createStepDispatcherFeature(), createSecretsFeature()]),
+    ).not.toThrow();
+  });
+
+  test("boot-validation rejects step-dispatcher without secrets mounted", () => {
+    expect(() => validateBoot([createStepDispatcherFeature()])).toThrow(/secrets/);
   });
 });

package/src/step-dispatcher/__tests__/webhook-runner.test.ts

@@ -5,11 +5,13 @@
 
 import { afterEach, describe, expect, mock, test } from "bun:test";
 import type { lookup } from "node:dns/promises";
+import { createSecret, type SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import {
   performWebhookDispatch,
   setWebhookFetch,
   setWebhookHostLookup,
   WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR,
+  type WebhookDispatchDeps,
 } from "../webhook-runner";
 
 function fakeLookupFor(addressesByHost: Readonly<Record<string, string>>): typeof lookup {
@@ -22,6 +24,26 @@ function fakeLookupFor(addressesByHost: Readonly<Record<string, string>>): typeo
 
 const fetchMock = mock<typeof fetch>();
 
+const TEST_TENANT_ID = "11111111-1111-4111-8111-111111111111";
+const TEST_USER_ID = "22222222-2222-4222-8222-222222222222";
+
+const noSecretsDeps: WebhookDispatchDeps = {
+  tenantId: TEST_TENANT_ID,
+  userId: TEST_USER_ID,
+  secrets: undefined,
+};
+
+function fakeSecrets(value: string | undefined) {
+  const get = mock(async () => (value === undefined ? undefined : createSecret(value)));
+  const secrets: SecretsContext = {
+    get,
+    has: async () => value !== undefined,
+    set: async () => {},
+    delete: async () => true,
+  };
+  return { secrets, get };
+}
+
 afterEach(() => {
   fetchMock.mockReset();
   setWebhookFetch(fetch);
@@ -32,11 +54,14 @@ afterEach(() => {
 describe("performWebhookDispatch — host-egress guard", () => {
   test("a private IP-literal host is rejected before any connect attempt", async () => {
     setWebhookFetch(fetchMock as unknown as typeof fetch);
-    const result = await performWebhookDispatch({
-      url: "http://10.0.0.5/hook",
-      method: "POST",
-      headers: {},
-    });
+    const result = await performWebhookDispatch(
+      {
+        url: "http://10.0.0.5/hook",
+        method: "POST",
+        headers: {},
+      },
+      noSecretsDeps,
+    );
     expect(result.ok).toBe(false);
     expect(fetchMock).not.toHaveBeenCalled();
   });
@@ -44,11 +69,14 @@ describe("performWebhookDispatch — host-egress guard", () => {
   test("a hostname resolving to a private address is rejected, without leaking the resolved address", async () => {
     setWebhookHostLookup(fakeLookupFor({ "internal.example": "127.0.0.1" }));
     setWebhookFetch(fetchMock as unknown as typeof fetch);
-    const result = await performWebhookDispatch({
-      url: "http://internal.example/hook",
-      method: "POST",
-      headers: {},
-    });
+    const result = await performWebhookDispatch(
+      {
+        url: "http://internal.example/hook",
+        method: "POST",
+        headers: {},
+      },
+      noSecretsDeps,
+    );
     expect(result.ok).toBe(false);
     if (!result.ok) {
       expect(result.error).not.toContain("127.0.0.1");
@@ -59,11 +87,14 @@ describe("performWebhookDispatch — host-egress guard", () => {
   test("a DNS resolution failure surfaces as a delivery error, not a thrown exception", async () => {
     setWebhookHostLookup(fakeLookupFor({}));
     setWebhookFetch(fetchMock as unknown as typeof fetch);
-    const result = await performWebhookDispatch({
-      url: "http://nowhere.example/hook",
-      method: "POST",
-      headers: {},
-    });
+    const result = await performWebhookDispatch(
+      {
+        url: "http://nowhere.example/hook",
+        method: "POST",
+        headers: {},
+      },
+      noSecretsDeps,
+    );
     expect(result.ok).toBe(false);
     expect(fetchMock).not.toHaveBeenCalled();
   });
@@ -71,17 +102,23 @@ describe("performWebhookDispatch — host-egress guard", () => {
   test("a blocked host and a DNS resolution failure produce the exact same tenant-visible error, without the host", async () => {
     setWebhookFetch(fetchMock as unknown as typeof fetch);
 
-    const blocked = await performWebhookDispatch({
-      url: "http://10.0.0.5/hook",
-      method: "POST",
-      headers: {},
-    });
+    const blocked = await performWebhookDispatch(
+      {
+        url: "http://10.0.0.5/hook",
+        method: "POST",
+        headers: {},
+      },
+      noSecretsDeps,
+    );
     setWebhookHostLookup(fakeLookupFor({}));
-    const unresolvable = await performWebhookDispatch({
-      url: "http://nowhere.example/hook",
-      method: "POST",
-      headers: {},
-    });
+    const unresolvable = await performWebhookDispatch(
+      {
+        url: "http://nowhere.example/hook",
+        method: "POST",
+        headers: {},
+      },
+      noSecretsDeps,
+    );
 
     expect(blocked.ok).toBe(false);
     expect(unresolvable.ok).toBe(false);
@@ -96,11 +133,14 @@ describe("performWebhookDispatch — host-egress guard", () => {
     setWebhookFetch(fetchMock as unknown as typeof fetch);
     fetchMock.mockResolvedValueOnce(new Response(null, { status: 200 }));
 
-    const result = await performWebhookDispatch({
-      url: "http://webhook-receiver.internal/hook",
-      method: "POST",
-      headers: {},
-    });
+    const result = await performWebhookDispatch(
+      {
+        url: "http://webhook-receiver.internal/hook",
+        method: "POST",
+        headers: {},
+      },
+      noSecretsDeps,
+    );
 
     expect(result.ok).toBe(true);
     expect(fetchMock).toHaveBeenCalledTimes(1);
@@ -113,11 +153,14 @@ describe("performWebhookDispatch — host-egress guard", () => {
     setWebhookFetch(fetchMock as unknown as typeof fetch);
     fetchMock.mockResolvedValueOnce(new Response(null, { status: 200 }));
 
-    const result = await performWebhookDispatch({
-      url: "https://hooks.example.com/incident",
-      method: "POST",
-      headers: {},
-    });
+    const result = await performWebhookDispatch(
+      {
+        url: "https://hooks.example.com/incident",
+        method: "POST",
+        headers: {},
+      },
+      noSecretsDeps,
+    );
 
     expect(result.ok).toBe(true);
     const [calledUrl, init] = fetchMock.mock.calls[0]!;
@@ -129,3 +172,112 @@ describe("performWebhookDispatch — host-egress guard", () => {
     );
   });
 });
+
+describe("performWebhookDispatch — auth.secret resolution", () => {
+  test("bearer auth sends the tenant's secret under the Authorization header", async () => {
+    setWebhookFetch(fetchMock as unknown as typeof fetch);
+    fetchMock.mockResolvedValueOnce(new Response(null, { status: 200 }));
+    process.env[WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = "hooks.example";
+    const { secrets, get } = fakeSecrets("tok_live_abc123");
+
+    const result = await performWebhookDispatch(
+      {
+        url: "http://hooks.example/hook",
+        method: "POST",
+        headers: {},
+        auth: { kind: "bearer", secret: "incident-hook" },
+      },
+      { tenantId: TEST_TENANT_ID, userId: TEST_USER_ID, secrets },
+    );
+
+    expect(result.ok).toBe(true);
+    expect(get).toHaveBeenCalledWith(TEST_TENANT_ID, "step-dispatcher:webhook-auth.incident-hook", {
+      userId: TEST_USER_ID,
+      handlerName: "step-dispatcher:webhook.send",
+    });
+    const [, init] = fetchMock.mock.calls[0]!;
+    expect(new Headers(init?.headers).get("authorization")).toBe("Bearer tok_live_abc123");
+  });
+
+  test("header auth sends the tenant's secret under the configured header name", async () => {
+    setWebhookFetch(fetchMock as unknown as typeof fetch);
+    fetchMock.mockResolvedValueOnce(new Response(null, { status: 200 }));
+    process.env[WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = "hooks.example";
+    const { secrets } = fakeSecrets("shared-secret-xyz");
+
+    const result = await performWebhookDispatch(
+      {
+        url: "http://hooks.example/hook",
+        method: "POST",
+        headers: {},
+        auth: { kind: "header", name: "x-hub-signature", secret: "incident-hook" },
+      },
+      { tenantId: TEST_TENANT_ID, userId: TEST_USER_ID, secrets },
+    );
+
+    expect(result.ok).toBe(true);
+    const [, init] = fetchMock.mock.calls[0]!;
+    expect(new Headers(init?.headers).get("x-hub-signature")).toBe("shared-secret-xyz");
+  });
+
+  test("a missing secret fails without leaking the secret name or fetching", async () => {
+    setWebhookFetch(fetchMock as unknown as typeof fetch);
+    process.env[WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = "hooks.example";
+    const { secrets } = fakeSecrets(undefined);
+
+    const result = await performWebhookDispatch(
+      {
+        url: "http://hooks.example/hook",
+        method: "POST",
+        headers: {},
+        auth: { kind: "bearer", secret: "incident-hook" },
+      },
+      { tenantId: TEST_TENANT_ID, userId: TEST_USER_ID, secrets },
+    );
+
+    expect(result.ok).toBe(false);
+    if (result.ok) throw new Error("unreachable");
+    expect(result.error).toBe("webhook auth secret is not available");
+    expect(result.error).not.toContain("incident-hook");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  test("an undefined secrets context fails the same generic way as a missing secret", async () => {
+    setWebhookFetch(fetchMock as unknown as typeof fetch);
+    process.env[WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR] = "hooks.example";
+
+    const result = await performWebhookDispatch(
+      {
+        url: "http://hooks.example/hook",
+        method: "POST",
+        headers: {},
+        auth: { kind: "bearer", secret: "incident-hook" },
+      },
+      noSecretsDeps,
+    );
+
+    expect(result.ok).toBe(false);
+    if (result.ok) throw new Error("unreachable");
+    expect(result.error).toBe("webhook auth secret is not available");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  test("an invalid url is rejected before any secret is read", async () => {
+    setWebhookFetch(fetchMock as unknown as typeof fetch);
+    const { secrets, get } = fakeSecrets("should-never-be-read");
+
+    const result = await performWebhookDispatch(
+      {
+        url: "not-a-url",
+        method: "POST",
+        headers: {},
+        auth: { kind: "bearer", secret: "incident-hook" },
+      },
+      { tenantId: TEST_TENANT_ID, userId: TEST_USER_ID, secrets },
+    );
+
+    expect(result.ok).toBe(false);
+    expect(get).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});

package/src/step-dispatcher/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.321.0",
+    "type": "breaking",
+    "title": "Webhook auth secrets are now tenant-owned via the secrets feature, not a global env var",
+    "detail": "`r.step.webhook.send`'s `auth` config renamed `secretRef` → `secret`. The\nvalue is now a name inside the tenant-owned secrets namespace\n`step-dispatcher:webhook-auth.<secret>` (secrets feature), resolved via\n`SecretsContext.get()` at dispatch time with an audit read stamped with\nthe triggering event's userId (or the system actor for cron/resume\ndispatches). `setWebhookSecretResolver` / the `WEBHOOK_SECRET_*` env\nconvention are gone. `performWebhookDispatch(spec)` now takes a required\nsecond `deps: { tenantId, userId, secrets }` argument.",
+    "migration": "Mount `createSecretsFeature()` (with a `MasterKeyProvider`) alongside\n`createStepDispatcherFeature()` — boot-validation now fails without it.\nFor each tenant that uses `r.step.webhook.send` with `auth`, set the\ncredential via `secrets:write:set` under\n`step-dispatcher:webhook-auth.<secret>` (the same name passed as\n`auth.secret`). Rename `auth.secretRef` → `auth.secret` at every\n`r.step.webhook.send({ auth: {...} })` call site. Remove any\n`WEBHOOK_SECRET_*` env vars — they're no longer read.\n\nA `step.dispatch-requested` event already enqueued before this upgrade\n(still carrying the old `secretRef` shape) fails validation on drain and\nis recorded as `step.dispatch-failed` with `error: \"invalid dispatch\npayload\"` instead of silently resolving a stale ref — drain the queue (or\naccept the one-time failed event) before deploying.\n\nTests calling `performWebhookDispatch` directly or using\n`setWebhookSecretResolver` must pass a `SecretsContext` (or `undefined`)\nvia the new `deps` argument instead."
+  },
   {
     "version": "0.320.0",
     "type": "fix",