@critical-path/core 0.26.0 → 0.27.0

package/src/engine/index.ts

@@ -17,7 +17,8 @@ import type {
   PresignedUrlOptions,
   PresignedUploadResult,
   TimeEntry,
-  WebhookEvent,
+  Webhook,
+  PublicWebhook,
   Workflow,
   CreateTaskInput,
   CreateProjectInput,
@@ -85,6 +86,9 @@ import { validateAttachmentUrl, AttachmentValidationError } from '../domain/enti
 import { validateCustomFieldValues } from '../domain/custom-fields.js';
 import { detectDependencyCycle, CircularDependencyError } from '../domain/graph.js';
 import { ValidationError, NotFoundError, ForbiddenError } from '../domain/errors.js';
+import { WebhookDispatcher, assertWebhookUrl } from '../webhooks/dispatcher.js';
+import { generateWebhookSecret } from '../webhooks/signature.js';
+import type { DomainEvent } from '../domain/events.js';
 import { calculateCPM, type CPMOptions } from '../domain/cpm.js';
 import { buildTimelineLadder, aggregateConcreteEvidenceForTask } from '../domain/ladder.js';
 import {
@@ -100,6 +104,8 @@ export class CriticalPathEngine {
   public readonly fileStorage?: FileStorageAdapter;
   public readonly plugins: PluginRegistry;
   public readonly events: DomainEventBus;
+  /** Delivers domain events to registered webhooks. Exposed for custom queues (`deliver`) and tests (`idle`). */
+  public readonly webhooks: WebhookDispatcher;
   public readonly ready: Promise<void> = Promise.resolve();
   /** The identity mutations are attributed to. Set only on views returned by `withActor`. */
   public readonly actor?: Actor;
@@ -115,6 +121,14 @@ export class CriticalPathEngine {
     this.fileStorage = config.fileStorage;
     this.plugins = new PluginRegistry();
     this.events = new DomainEventBus();
+    this.webhooks = new WebhookDispatcher(
+      {
+        listWebhooks: () => this.listAllWebhooks(),
+        resolveTenant: (event) => this.resolveEventTenant(event)
+      },
+      config.webhookDelivery
+    );
+    this.events.subscribe('*', (event) => this.webhooks.handle(event));
 
     if (config.plugins) {
       for (const plugin of config.plugins) {
@@ -319,7 +333,6 @@ export class CriticalPathEngine {
       action: 'workflow.created',
       details: { name: created.name }
     });
-    this.dispatchWebhook('workflow.created', { workflow: created });
     return created;
   }
 
@@ -347,7 +360,6 @@ export class CriticalPathEngine {
         action: 'workflow.updated',
         details: { name: updated.name }
       });
-      this.dispatchWebhook('workflow.updated', { workflow: updated, previous: existing });
     }
     return updated;
   }
@@ -366,7 +378,7 @@ export class CriticalPathEngine {
         aggregateId: id,
         aggregateType: 'Workflow',
         occurredAt: now,
-        payload: { workflowId: id, name: existing.name }
+        payload: { workflowId: id, name: existing.name, tenantId: existing.tenantId }
       };
       await this.events.publish(event);
 
@@ -375,7 +387,6 @@ export class CriticalPathEngine {
         action: 'workflow.deleted',
         details: { name: existing.name }
       });
-      this.dispatchWebhook('workflow.deleted', { workflowId: id, name: existing.name });
     }
     return deleted;
   }
@@ -456,7 +467,6 @@ export class CriticalPathEngine {
       action: 'project.created',
       details: { name: created.name, key: created.key }
     });
-    this.dispatchWebhook('project.created', { project: created });
     return created;
   }
 
@@ -486,7 +496,6 @@ export class CriticalPathEngine {
         action: 'project.updated',
         details: { name: updated.name }
       });
-      this.dispatchWebhook('project.updated', { project: updated });
     }
     return updated;
   }
@@ -519,7 +528,7 @@ export class CriticalPathEngine {
         aggregateId: id,
         aggregateType: 'Project',
         occurredAt: now,
-        payload: { projectId: id, name: existing.name, deletedTaskIds }
+        payload: { projectId: id, name: existing.name, deletedTaskIds, tenantId: existing.tenantId }
       };
       await this.events.publish(event);
 
@@ -529,7 +538,6 @@ export class CriticalPathEngine {
         action: 'project.deleted',
         details: { name: existing.name, deletedTaskCount: deletedTaskIds.length }
       });
-      this.dispatchWebhook('project.deleted', { projectId: id, name: existing.name, deletedTaskIds });
     }
     return deleted;
   }
@@ -642,7 +650,6 @@ export class CriticalPathEngine {
       details: { title: created.title, status: created.status }
     });
 
-    this.dispatchWebhook('task.created', { task: created });
     return created;
   }
 
@@ -925,10 +932,6 @@ export class CriticalPathEngine {
         action: 'task.blocked',
         details: { reason: blockedReason, ...(actorName ? { actorName } : {}) }
       });
-      this.dispatchWebhook('task.blocked', {
-        task: updated,
-        reason: blockedReason
-      });
     } else if (wasBlocked && !isNowBlocked) {
       const unblockedEvent: TaskUnblockedEvent = {
         id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -951,9 +954,6 @@ export class CriticalPathEngine {
         action: 'task.unblocked',
         details: { ...(actorName ? { actorName } : {}) }
       });
-      this.dispatchWebhook('task.unblocked', {
-        task: updated
-      });
     }
 
     await this.store.logActivity({
@@ -968,10 +968,6 @@ export class CriticalPathEngine {
       }
     });
 
-    this.dispatchWebhook(isStatusChange ? 'task.status_changed' : 'task.updated', {
-      task: updated,
-      previous: existing
-    });
 
     return updated;
   }
@@ -1042,10 +1038,6 @@ export class CriticalPathEngine {
             details: { unblockedByTaskId: completedTask.id }
           });
 
-          this.dispatchWebhook('task.unblocked', {
-            task: updatedDownstream,
-            upstreamTaskId: completedTask.id
-          });
         }
       }
     } catch (err) {
@@ -1086,7 +1078,6 @@ export class CriticalPathEngine {
         action: 'task.deleted',
         details: { title: existing.title }
       });
-      this.dispatchWebhook('task.deleted', { taskId: id, title: existing.title });
     }
     return deleted;
   }
@@ -1297,7 +1288,6 @@ export class CriticalPathEngine {
     };
     await this.events.publish(event);
 
-    this.dispatchWebhook('comment.created', { comment: created });
     return created;
   }
 
@@ -1326,7 +1316,6 @@ export class CriticalPathEngine {
     };
     await this.events.publish(event);
 
-    this.dispatchWebhook('comment.updated', { comment: updated });
     return updated;
   }
 
@@ -1351,7 +1340,6 @@ export class CriticalPathEngine {
       };
       await this.events.publish(event);
 
-      this.dispatchWebhook('comment.deleted', { commentId: id, taskId: existing.taskId });
     }
     return deleted;
   }
@@ -1399,7 +1387,6 @@ export class CriticalPathEngine {
     };
     await this.events.publish(event);
 
-    this.dispatchWebhook('comment.reaction.added', { comment: updated, reaction });
     return updated;
   }
 
@@ -1432,7 +1419,6 @@ export class CriticalPathEngine {
     };
     await this.events.publish(event);
 
-    this.dispatchWebhook('comment.reaction.removed', { comment: updated, reaction });
     return updated;
   }
 
@@ -1481,7 +1467,6 @@ export class CriticalPathEngine {
     };
     await this.events.publish(event);
 
-    this.dispatchWebhook('attachment.created', { attachment: created });
     return created;
   }
 
@@ -1510,11 +1495,15 @@ export class CriticalPathEngine {
         aggregateId: id,
         aggregateType: 'Attachment',
         occurredAt: now,
-        payload: { attachmentId: id, storageKey: existing.storageKey, url: existing.url }
+        payload: {
+          attachmentId: id,
+          storageKey: existing.storageKey,
+          url: existing.url,
+          projectId: await this.projectIdOfAttachment(existing)
+        }
       };
       await this.events.publish(event);
 
-      this.dispatchWebhook('attachment.deleted', { attachmentId: id, taskId: existing.taskId, projectId: existing.projectId });
     }
     return deleted;
   }
@@ -1639,7 +1628,6 @@ export class CriticalPathEngine {
     };
     await this.events.publish(event);
 
-    this.dispatchWebhook('team.created', { team: created });
     return created;
   }
 
@@ -1682,7 +1670,6 @@ export class CriticalPathEngine {
     };
     await this.events.publish(event);
 
-    this.dispatchWebhook('container.created', { container: created });
     return created;
   }
 
@@ -1743,7 +1730,6 @@ export class CriticalPathEngine {
       action: 'deliverable.created',
       details: { title: created.title, format: created.format }
     });
-    this.dispatchWebhook('deliverable.created', { deliverable: created });
     return created;
   }
 
@@ -1774,11 +1760,6 @@ export class CriticalPathEngine {
           }
         };
         await this.events.publish(statusEvent);
-        this.dispatchWebhook('deliverable.status_changed', {
-          deliverable: updated,
-          previousStatus: existing.status,
-          newStatus: updated.status
-        });
       }
 
       const updateEvent: DeliverableUpdatedEvent = {
@@ -1797,7 +1778,6 @@ export class CriticalPathEngine {
         action: 'deliverable.updated',
         details: { title: updated.title, status: updated.status }
       });
-      this.dispatchWebhook('deliverable.updated', { deliverable: updated });
     }
     return updated;
   }
@@ -1826,7 +1806,6 @@ export class CriticalPathEngine {
         action: 'deliverable.deleted',
         details: { title: existing.title }
       });
-      this.dispatchWebhook('deliverable.deleted', { deliverableId: id, projectId: existing.projectId });
     }
     return deleted;
   }
@@ -1904,7 +1883,6 @@ export class CriticalPathEngine {
         payload: { iteration: created }
       };
       await this.events.publish(event);
-      this.dispatchWebhook('iteration.started', { iteration: created });
     }
     return created;
   }
@@ -1927,7 +1905,6 @@ export class CriticalPathEngine {
           payload: { iteration: updated }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('iteration.started', { iteration: updated });
       } else if (existing.status !== 'completed' && updated.status === 'completed') {
         const event: IterationCompletedEvent = {
           id: `evt_${Math.random().toString(36).substring(2, 9)}`,
@@ -1938,7 +1915,6 @@ export class CriticalPathEngine {
           payload: { iteration: updated }
         };
         await this.events.publish(event);
-        this.dispatchWebhook('iteration.completed', { iteration: updated });
       }
     }
     return updated;
@@ -2123,19 +2099,108 @@ export class CriticalPathEngine {
     );
   }
 
-  private async dispatchWebhook(event: WebhookEvent, payload: Record<string, unknown>): Promise<void> {
+  // --- Webhooks ---
+
+  /** Webhooks from `config.webhooks` (static, not editable) plus those in the store. */
+  private async listAllWebhooks(): Promise<Webhook[]> {
+    const fromConfig: Webhook[] = (this.config.webhooks ?? []).map((w, i) => ({
+      ...w,
+      id: `config_${i}`,
+      createdAt: new Date(0).toISOString()
+    }));
+    return [...fromConfig, ...(await this.store.getWebhooks())];
+  }
+
+  private toPublicWebhook({ secret, ...webhook }: Webhook): PublicWebhook {
+    return { ...webhook, hasSecret: !!secret };
+  }
+
+  /** Webhooks in the actor's tenant, with secrets redacted. Requires `workspace.manage` on views. */
+  async getWebhooks(): Promise<PublicWebhook[]> {
+    await this.requireWorkspaceAccess('workspace.manage');
     const webhooks = await this.store.getWebhooks();
-    const active = webhooks.filter((w) => w.active && w.events.includes(event));
-
-    for (const wh of active) {
-      fetch(wh.url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ event, timestamp: new Date().toISOString(), data: payload })
-      }).catch(() => {
-        // Silent catch for webhook errors in dev
-      });
+    return webhooks.filter((w) => this.inActorTenant(w)).map((w) => this.toPublicWebhook(w));
+  }
+
+  async getWebhook(id: string): Promise<PublicWebhook | null> {
+    await this.requireWorkspaceAccess('workspace.manage');
+    const webhook = await this.store.getWebhook(id);
+    return webhook && this.inActorTenant(webhook) ? this.toPublicWebhook(webhook) : null;
+  }
+
+  /**
+   * Registers a webhook. The signing secret is returned only here; generate one by omitting
+   * `secret`. Deliveries carry `X-CriticalPath-Signature` (see `verifyWebhookSignature`).
+   */
+  async createWebhook(input: {
+    name: string;
+    url: string;
+    events: Webhook['events'];
+    secret?: string;
+    active?: boolean;
+  }): Promise<{ webhook: PublicWebhook; secret: string }> {
+    await this.requireWorkspaceAccess('workspace.manage');
+    this.validateWebhookUrl(input.url);
+    const secret = input.secret ?? generateWebhookSecret();
+    const created = await this.store.addWebhook({
+      name: input.name,
+      url: input.url,
+      events: input.events,
+      secret,
+      active: input.active ?? true,
+      tenantId: this.actor?.tenantId
+    });
+    this.webhooks.invalidate();
+    return { webhook: this.toPublicWebhook(created), secret };
+  }
+
+  async updateWebhook(
+    id: string,
+    updates: Partial<Pick<Webhook, 'name' | 'url' | 'events' | 'active' | 'secret'>>
+  ): Promise<PublicWebhook | null> {
+    if (!(await this.getWebhook(id))) return null;
+    if (updates.url) this.validateWebhookUrl(updates.url);
+    const { name, url, events, active, secret } = updates;
+    const updated = await this.store.updateWebhook(
+      id,
+      Object.fromEntries(Object.entries({ name, url, events, active, secret }).filter(([, v]) => v !== undefined))
+    );
+    this.webhooks.invalidate();
+    return updated ? this.toPublicWebhook(updated) : null;
+  }
+
+  async deleteWebhook(id: string): Promise<boolean> {
+    if (!(await this.getWebhook(id))) return false;
+    const deleted = await this.store.deleteWebhook(id);
+    this.webhooks.invalidate();
+    return deleted;
+  }
+
+  private validateWebhookUrl(url: string): void {
+    try {
+      assertWebhookUrl(url, this.config.webhookDelivery?.allowPrivateUrls);
+    } catch (err) {
+      throw new ValidationError((err as Error).message);
     }
   }
-}
 
+  /** Finds the tenant an event belongs to, from the entity in its payload or its project. */
+  private async resolveEventTenant(event: DomainEvent): Promise<string | undefined> {
+    const p = event.payload as Record<string, any>;
+    const owner = p.project ?? p.workflow ?? p.team;
+    if (owner) return owner.tenantId ?? undefined;
+    // Deleted projects and workflows carry their tenant in the payload.
+    if ('tenantId' in p) return p.tenantId ?? undefined;
+
+    const projectId: string | undefined =
+      p.projectId ??
+      p.task?.projectId ??
+      p.deliverable?.projectId ??
+      p.iteration?.projectId ??
+      p.container?.projectId ??
+      p.attachment?.projectId ??
+      (await this.projectIdOfTask(p.taskId ?? p.comment?.taskId ?? p.attachment?.taskId ?? p.dependency?.taskId ?? p.timeEntry?.taskId));
+    if (!projectId) return undefined;
+    return (await this.store.getProject(projectId))?.tenantId ?? undefined;
+  }
+}

package/src/index.ts

@@ -5,4 +5,5 @@ export * from './storage/index.js';
 export * from './plugins/index.js';
 export * from './engine/index.js';
 export * from './domain/index.js';
+export * from './webhooks/index.js';
 

package/src/schemas/index.ts

@@ -10,6 +10,7 @@
  */
 import { z } from 'zod';
 import { ValidationError, type ValidationIssue } from '../domain/errors.js';
+import { DOMAIN_EVENT_NAMES } from '../domain/events.js';
 
 /**
  * Parses `data` with `schema`, returning the cleaned value (unknown keys stripped, defaults
@@ -322,6 +323,20 @@ export const LogTimeSchema = strictObject({
   loggedAt: isoString.optional()
 });
 
+// --- Webhooks ---
+
+export const CreateWebhookSchema = strictObject({
+  name: nonEmpty,
+  /** http(s) URL; private and local addresses are rejected unless the engine allows them. */
+  url: nonEmpty,
+  /** Domain event names (e.g. `task.created`) or `'*'` for all events. */
+  events: z.array(z.enum(['*', ...DOMAIN_EVENT_NAMES])).min(1),
+  /** Signing secret (at least 16 characters). Generated when omitted and returned once. */
+  secret: z.string().min(16).optional(),
+  active: z.boolean().optional()
+});
+export const UpdateWebhookSchema = CreateWebhookSchema.partial();
+
 export type CreateTaskPayload = z.infer<typeof CreateTaskSchema>;
 export type UpdateTaskPayload = z.infer<typeof UpdateTaskSchema>;
 export type CreateProjectPayload = z.infer<typeof CreateProjectSchema>;
@@ -350,4 +365,6 @@ export type CreateAttachmentBody = z.input<typeof CreateAttachmentSchema>;
 export type UploadAttachmentBody = z.input<typeof UploadAttachmentSchema>;
 export type PresignAttachmentBody = z.input<typeof PresignAttachmentSchema>;
 export type LogTimeBody = z.input<typeof LogTimeSchema>;
+export type CreateWebhookBody = z.input<typeof CreateWebhookSchema>;
+export type UpdateWebhookBody = z.input<typeof UpdateWebhookSchema>;
 

package/src/schemas/schemas.test.ts

@@ -13,7 +13,8 @@ import type {
   Iteration,
   Comment,
   CreateAttachmentInput,
-  TimeEntry
+  TimeEntry,
+  Webhook
 } from '../types/index.js';
 import {
   CreateTaskSchema,
@@ -30,7 +31,8 @@ import {
   CreateCommentSchema,
   UpdateCommentSchema,
   CreateAttachmentSchema,
-  LogTimeSchema
+  LogTimeSchema,
+  CreateWebhookSchema
 } from './index.js';
 
 /**
@@ -69,7 +71,8 @@ const keyChecks: true[] = [
   true as SameKeys<Infer<typeof CreateCommentSchema>, Omit<Comment, ServerAssigned | 'reactions' | CommentIdentity>>,
   true as SameKeys<Infer<typeof UpdateCommentSchema>, Pick<Comment, 'content' | 'mentions' | 'metadata'>>,
   true as SameKeys<Infer<typeof CreateAttachmentSchema>, Omit<CreateAttachmentInput, UploaderIdentity>>,
-  true as SameKeys<Infer<typeof LogTimeSchema>, Omit<TimeEntry, 'id' | 'userId'>>
+  true as SameKeys<Infer<typeof LogTimeSchema>, Omit<TimeEntry, 'id' | 'userId'>>,
+  true as SameKeys<Infer<typeof CreateWebhookSchema>, Pick<Webhook, 'name' | 'url' | 'events' | 'secret' | 'active'>>
 ];
 
 describe('request schemas', () => {

package/src/store/firebase.test.ts

@@ -107,5 +107,25 @@ describe('FirebaseStore', () => {
     expect(byUpstream).toHaveLength(1);
     expect(byUpstream[0].id).toBe(dep.id);
   });
+
+  it('should create, update, clear fields on, and delete webhooks', async () => {
+    const created = await store.addWebhook({
+      name: 'Hook',
+      url: 'https://hooks.example.com/x',
+      events: ['task.created'],
+      secret: 'whsec_test',
+      active: true,
+      tenantId: 'acme'
+    });
+    expect(await store.getWebhook(created.id)).toMatchObject({ name: 'Hook', tenantId: 'acme' });
+
+    const updated = await store.updateWebhook(created.id, { events: ['*'], secret: undefined });
+    expect(updated?.events).toEqual(['*']);
+    expect((await store.getWebhook(created.id))?.secret).toBeUndefined();
+
+    expect(await store.deleteWebhook(created.id)).toBe(true);
+    expect(await store.getWebhook(created.id)).toBeNull();
+    expect(await store.deleteWebhook(created.id)).toBe(false);
+  });
 });
 

package/src/store/firebase.ts

@@ -573,6 +573,11 @@ export class FirebaseStore implements StorageAdapter {
     return snap.docs.map((doc) => ({ ...doc.data(), id: doc.id }));
   }
 
+  async getWebhook(id: string): Promise<Webhook | null> {
+    const doc = await this.db.collection('webhooks').doc(id).get();
+    return doc.exists ? ({ ...doc.data(), id: doc.id } as Webhook) : null;
+  }
+
   async addWebhook(webhook: Omit<Webhook, 'id' | 'createdAt'>): Promise<Webhook> {
     const docRef = this.db.collection('webhooks').doc();
     const now = new Date().toISOString();
@@ -580,4 +585,21 @@ export class FirebaseStore implements StorageAdapter {
     await docRef.set(sanitizeFirestoreData(newWh));
     return newWh;
   }
+
+  async updateWebhook(id: string, updates: Partial<Omit<Webhook, 'id' | 'createdAt'>>): Promise<Webhook | null> {
+    const existing = await this.getWebhook(id);
+    if (!existing) return null;
+    const updated: Webhook = { ...existing, ...updates, id, createdAt: existing.createdAt };
+    // Write the whole document (no merge) so fields cleared with `undefined` are removed.
+    await this.db.collection('webhooks').doc(id).set(sanitizeFirestoreData(updated));
+    return updated;
+  }
+
+  async deleteWebhook(id: string): Promise<boolean> {
+    const ref = this.db.collection('webhooks').doc(id);
+    const doc = await ref.get();
+    if (!doc.exists) return false;
+    await ref.delete();
+    return true;
+  }
 }

package/src/store/index.ts

@@ -101,7 +101,10 @@ export interface DependencyRepository {
 
 export interface WebhookRepository {
   getWebhooks(): Promise<Webhook[]>;
+  getWebhook(id: string): Promise<Webhook | null>;
   addWebhook(webhook: Omit<Webhook, 'id' | 'createdAt'>): Promise<Webhook>;
+  updateWebhook(id: string, updates: Partial<Omit<Webhook, 'id' | 'createdAt'>>): Promise<Webhook | null>;
+  deleteWebhook(id: string): Promise<boolean>;
 }
 
 export interface DeliverableRepository {
@@ -538,10 +541,26 @@ export class InMemoryStore implements StorageAdapter {
     return Array.from(this.webhooks.values());
   }
 
+  async getWebhook(id: string): Promise<Webhook | null> {
+    return this.webhooks.get(id) ?? null;
+  }
+
   async addWebhook(webhook: Omit<Webhook, 'id' | 'createdAt'>): Promise<Webhook> {
     const id = `wh_${Math.random().toString(36).substring(2, 9)}`;
     const newWh: Webhook = { ...webhook, id, createdAt: new Date().toISOString() };
     this.webhooks.set(id, newWh);
     return newWh;
   }
+
+  async updateWebhook(id: string, updates: Partial<Omit<Webhook, 'id' | 'createdAt'>>): Promise<Webhook | null> {
+    const existing = this.webhooks.get(id);
+    if (!existing) return null;
+    const updated: Webhook = { ...existing, ...updates, id, createdAt: existing.createdAt };
+    this.webhooks.set(id, updated);
+    return updated;
+  }
+
+  async deleteWebhook(id: string): Promise<boolean> {
+    return this.webhooks.delete(id);
+  }
 }

package/src/store/sqlite.ts

@@ -280,6 +280,14 @@ export class SQLiteStore implements StorageAdapter {
       // Column may already exist
     }
 
+    for (const column of ['name TEXT', 'tenantId TEXT']) {
+      try {
+        this.db.exec(`ALTER TABLE webhooks ADD COLUMN ${column}`);
+      } catch {
+        // Column may already exist
+      }
+    }
+
     for (const table of ['projects', 'workflows', 'teams']) {
       try {
         this.db.exec(`ALTER TABLE ${table} ADD COLUMN tenantId TEXT`);
@@ -1175,11 +1183,48 @@ export class SQLiteStore implements StorageAdapter {
   async getWebhooks(): Promise<Webhook[]> {
     const stmt = this.db.prepare('SELECT * FROM webhooks');
     const rows = stmt.all() as any[];
-    return rows.map((r) => ({
-      ...r,
-      events: JSON.parse(r.events),
-      active: Boolean(r.active)
-    }));
+    return rows.map((r) => this.mapWebhook(r));
+  }
+
+  async getWebhook(id: string): Promise<Webhook | null> {
+    const row = this.db.prepare('SELECT * FROM webhooks WHERE id = ?').get(id) as any;
+    return row ? this.mapWebhook(row) : null;
+  }
+
+  async updateWebhook(id: string, updates: Partial<Omit<Webhook, 'id' | 'createdAt'>>): Promise<Webhook | null> {
+    const existing = await this.getWebhook(id);
+    if (!existing) return null;
+    const updated: Webhook = { ...existing, ...updates, id, createdAt: existing.createdAt };
+    this.db
+      .prepare('UPDATE webhooks SET name = ?, url = ?, events = ?, secret = ?, active = ?, tenantId = ? WHERE id = ?')
+      .run(
+        updated.name ?? null,
+        updated.url,
+        JSON.stringify(updated.events),
+        updated.secret ?? null,
+        updated.active ? 1 : 0,
+        updated.tenantId ?? null,
+        id
+      );
+    return updated;
+  }
+
+  async deleteWebhook(id: string): Promise<boolean> {
+    const result = this.db.prepare('DELETE FROM webhooks WHERE id = ?').run(id);
+    return Number(result.changes) > 0;
+  }
+
+  private mapWebhook(row: any): Webhook {
+    return {
+      id: row.id,
+      name: row.name ?? '',
+      url: row.url,
+      events: JSON.parse(row.events),
+      secret: row.secret ?? undefined,
+      active: Boolean(row.active),
+      tenantId: row.tenantId ?? undefined,
+      createdAt: row.createdAt
+    };
   }
 
   async addWebhook(webhook: Omit<Webhook, 'id' | 'createdAt'>): Promise<Webhook> {
@@ -1188,15 +1233,17 @@ export class SQLiteStore implements StorageAdapter {
     const newWh: Webhook = { ...webhook, id, createdAt: now };
 
     const stmt = this.db.prepare(`
-      INSERT INTO webhooks (id, url, events, secret, active, createdAt)
-      VALUES (?, ?, ?, ?, ?, ?)
+      INSERT INTO webhooks (id, name, url, events, secret, active, tenantId, createdAt)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
     `);
     stmt.run(
       newWh.id,
+      newWh.name ?? null,
       newWh.url,
       JSON.stringify(newWh.events),
       newWh.secret || null,
       newWh.active ? 1 : 0,
+      newWh.tenantId ?? null,
       newWh.createdAt
     );
     return newWh;