@critical-path/core 0.26.0 → 0.28.0

package/src/plugins/plugins.test.ts

@@ -0,0 +1,161 @@
+import { describe, it, expect, vi } from 'vitest';
+import {
+  CriticalPathEngine,
+  CustomFieldValidationError,
+  ValidationError,
+  WorkflowValidationError,
+  type CriticalPathPlugin
+} from '../index.js';
+
+const strictWorkflow = {
+  name: 'Strict',
+  defaultStatusKey: 'todo',
+  statuses: [
+    { key: 'todo', label: 'To Do', category: 'not_started' as const },
+    { key: 'doing', label: 'Doing', category: 'in_progress' as const },
+    { key: 'done', label: 'Done', category: 'completed' as const }
+  ],
+  transitions: [
+    { fromStatusKey: 'todo', toStatusKey: 'doing' },
+    { fromStatusKey: 'doing', toStatusKey: 'done' }
+  ]
+};
+
+describe('plugin system', () => {
+  it('runs init once with the engine before ready resolves', async () => {
+    const init = vi.fn(async (engine: CriticalPathEngine) => {
+      await engine.createProject({ name: 'Seeded by plugin' });
+    });
+    const engine = new CriticalPathEngine({ plugins: [{ id: 'seed', name: 'Seed', version: '1', init }] });
+    await engine.ready;
+
+    expect(init).toHaveBeenCalledTimes(1);
+    expect(init).toHaveBeenCalledWith(engine);
+    expect(await engine.getProjects()).toHaveLength(1);
+  });
+
+  it('surfaces init failures through ready without unhandled rejections', async () => {
+    const engine = new CriticalPathEngine({
+      plugins: [{ id: 'bad', name: 'Bad', version: '1', init: () => Promise.reject(new Error('boom')) }]
+    });
+    await expect(engine.ready).rejects.toThrow('boom');
+  });
+
+  it('validates values of plugin-registered custom field types and rejects unknown types', async () => {
+    const urlField: CriticalPathPlugin = {
+      id: 'url-field',
+      name: 'URL field',
+      version: '1',
+      customFieldTypes: [
+        { type: 'url', validate: (value) => (typeof value === 'string' && /^https?:\/\//.test(value) ? null : 'must be an http(s) URL') }
+      ]
+    };
+    const engine = new CriticalPathEngine({ plugins: [urlField] });
+    const project = await engine.createProject({
+      name: 'Links',
+      customFieldDefinitions: [{ id: 'f1', key: 'spec', label: 'Spec', type: 'url' }]
+    });
+
+    await engine.createTask({ projectId: project.id, title: 'ok', customFields: { spec: 'https://example.com' } });
+    await expect(engine.createTask({ projectId: project.id, title: 'bad', customFields: { spec: 'ftp://x' } })).rejects.toThrow(
+      /must be an http\(s\) URL/
+    );
+    await expect(
+      engine.createProject({ name: 'Unknown', customFieldDefinitions: [{ id: 'f', key: 'x', label: 'X', type: 'nope' }] })
+    ).rejects.toThrow(CustomFieldValidationError);
+  });
+
+  it('refuses custom field types that clash with built-in or already registered types', () => {
+    const clash = (type: string): CriticalPathPlugin => ({
+      id: `p-${type}-${Math.random()}`,
+      name: 'Clash',
+      version: '1',
+      customFieldTypes: [{ type, validate: () => null }]
+    });
+    expect(() => new CriticalPathEngine({ plugins: [clash('number')] })).toThrow(/already exists/);
+    expect(() => new CriticalPathEngine({ plugins: [clash('money'), clash('money')] })).toThrow(/already exists/);
+  });
+
+  it('validates the output of before-hooks, so plugins cannot bypass workflow rules', async () => {
+    const skipAhead: CriticalPathPlugin = {
+      id: 'skip',
+      name: 'Skip ahead',
+      version: '1',
+      hooks: { beforeTaskUpdate: (_id, updates) => ({ ...updates, status: 'done' }) }
+    };
+    const engine = new CriticalPathEngine({ plugins: [skipAhead] });
+    const workflow = await engine.createWorkflow(strictWorkflow);
+    const project = await engine.createProject({ name: 'Strict', workflowId: workflow.id });
+    const task = await engine.createTask({ projectId: project.id, title: 'T' });
+
+    await expect(engine.updateTask(task.id, { title: 'renamed' })).rejects.toThrow(WorkflowValidationError);
+    expect((await engine.getTask(task.id))?.status).toBe('todo');
+  });
+
+  it('prevents before-hooks from moving tasks between projects', async () => {
+    let otherProjectId = '';
+    const mover: CriticalPathPlugin = {
+      id: 'mover',
+      name: 'Mover',
+      version: '1',
+      hooks: {
+        beforeTaskCreate: (task) => (task.title === 'move me' ? { ...task, projectId: otherProjectId } : task),
+        beforeTaskUpdate: (_id, updates) => ({ ...updates, projectId: otherProjectId })
+      }
+    };
+    const engine = new CriticalPathEngine({ plugins: [mover] });
+    const home = await engine.createProject({ name: 'Home' });
+    otherProjectId = (await engine.createProject({ name: 'Other' })).id;
+
+    await expect(engine.createTask({ projectId: home.id, title: 'move me' })).rejects.toThrow(ValidationError);
+    const task = await engine.createTask({ projectId: home.id, title: 'stay' });
+    await engine.updateTask(task.id, { title: 'still here' });
+    expect((await engine.getTask(task.id))?.projectId).toBe(home.id);
+  });
+
+  it('enforces required custom fields even when none are supplied', async () => {
+    const engine = new CriticalPathEngine();
+    const project = await engine.createProject({
+      name: 'Required',
+      customFieldDefinitions: [{ id: 'f', key: 'client', label: 'Client', type: 'text', required: true }]
+    });
+    await expect(engine.createTask({ projectId: project.id, title: 'missing' })).rejects.toThrow(/required/);
+  });
+
+  it('logs after-hook failures without failing the write or skipping events', async () => {
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    const engine = new CriticalPathEngine({
+      plugins: [{ id: 'flaky', name: 'Flaky', version: '1', hooks: { afterTaskCreate: () => { throw new Error('downstream'); } } }]
+    });
+    const published: string[] = [];
+    engine.events.subscribe('task.created', (e) => void published.push(e.name));
+
+    const project = await engine.createProject({ name: 'After' });
+    const task = await engine.createTask({ projectId: project.id, title: 'stored' });
+    expect(await engine.getTask(task.id)).not.toBeNull();
+    expect(published).toEqual(['task.created']);
+    expect(consoleError).toHaveBeenCalledWith(expect.stringContaining('"flaky" afterTaskCreate'), expect.any(Error));
+    consoleError.mockRestore();
+  });
+
+  it('passes the deleted task to delete hooks', async () => {
+    const seen: string[] = [];
+    const engine = new CriticalPathEngine({
+      plugins: [
+        {
+          id: 'audit',
+          name: 'Audit',
+          version: '1',
+          hooks: {
+            beforeTaskDelete: (_id, task) => void seen.push(`before:${task.title}`),
+            afterTaskDelete: (_id, task) => void seen.push(`after:${task.title}`)
+          }
+        }
+      ]
+    });
+    const project = await engine.createProject({ name: 'Del' });
+    const task = await engine.createTask({ projectId: project.id, title: 'gone' });
+    await engine.deleteTask(task.id);
+    expect(seen).toEqual(['before:gone', 'after:gone']);
+  });
+});

package/src/schemas/index.ts

@@ -10,6 +10,7 @@
  */
 import { z } from 'zod';
 import { ValidationError, type ValidationIssue } from '../domain/errors.js';
+import { DOMAIN_EVENT_NAMES } from '../domain/events.js';
 
 /**
  * Parses `data` with `schema`, returning the cleaned value (unknown keys stripped, defaults
@@ -64,7 +65,8 @@ export const CustomFieldDefinitionSchema = strictObject({
   id: z.string(),
   key: nonEmpty,
   label: z.string(),
-  type: z.enum(['text', 'number', 'date', 'boolean', 'single_select', 'multi_select', 'user']),
+  /** Built-in type or one registered by a plugin (checked by the engine). */
+  type: nonEmpty,
   options: z.array(z.string()).optional(),
   required: z.boolean().optional(),
   defaultValue: z.unknown().optional()
@@ -322,6 +324,20 @@ export const LogTimeSchema = strictObject({
   loggedAt: isoString.optional()
 });
 
+// --- Webhooks ---
+
+export const CreateWebhookSchema = strictObject({
+  name: nonEmpty,
+  /** http(s) URL; private and local addresses are rejected unless the engine allows them. */
+  url: nonEmpty,
+  /** Domain event names (e.g. `task.created`) or `'*'` for all events. */
+  events: z.array(z.enum(['*', ...DOMAIN_EVENT_NAMES])).min(1),
+  /** Signing secret (at least 16 characters). Generated when omitted and returned once. */
+  secret: z.string().min(16).optional(),
+  active: z.boolean().optional()
+});
+export const UpdateWebhookSchema = CreateWebhookSchema.partial();
+
 export type CreateTaskPayload = z.infer<typeof CreateTaskSchema>;
 export type UpdateTaskPayload = z.infer<typeof UpdateTaskSchema>;
 export type CreateProjectPayload = z.infer<typeof CreateProjectSchema>;
@@ -350,4 +366,6 @@ export type CreateAttachmentBody = z.input<typeof CreateAttachmentSchema>;
 export type UploadAttachmentBody = z.input<typeof UploadAttachmentSchema>;
 export type PresignAttachmentBody = z.input<typeof PresignAttachmentSchema>;
 export type LogTimeBody = z.input<typeof LogTimeSchema>;
+export type CreateWebhookBody = z.input<typeof CreateWebhookSchema>;
+export type UpdateWebhookBody = z.input<typeof UpdateWebhookSchema>;
 

package/src/schemas/schemas.test.ts

@@ -13,7 +13,8 @@ import type {
   Iteration,
   Comment,
   CreateAttachmentInput,
-  TimeEntry
+  TimeEntry,
+  Webhook
 } from '../types/index.js';
 import {
   CreateTaskSchema,
@@ -30,7 +31,8 @@ import {
   CreateCommentSchema,
   UpdateCommentSchema,
   CreateAttachmentSchema,
-  LogTimeSchema
+  LogTimeSchema,
+  CreateWebhookSchema
 } from './index.js';
 
 /**
@@ -69,7 +71,8 @@ const keyChecks: true[] = [
   true as SameKeys<Infer<typeof CreateCommentSchema>, Omit<Comment, ServerAssigned | 'reactions' | CommentIdentity>>,
   true as SameKeys<Infer<typeof UpdateCommentSchema>, Pick<Comment, 'content' | 'mentions' | 'metadata'>>,
   true as SameKeys<Infer<typeof CreateAttachmentSchema>, Omit<CreateAttachmentInput, UploaderIdentity>>,
-  true as SameKeys<Infer<typeof LogTimeSchema>, Omit<TimeEntry, 'id' | 'userId'>>
+  true as SameKeys<Infer<typeof LogTimeSchema>, Omit<TimeEntry, 'id' | 'userId'>>,
+  true as SameKeys<Infer<typeof CreateWebhookSchema>, Pick<Webhook, 'name' | 'url' | 'events' | 'secret' | 'active'>>
 ];
 
 describe('request schemas', () => {

package/src/store/firebase.test.ts

@@ -107,5 +107,25 @@ describe('FirebaseStore', () => {
     expect(byUpstream).toHaveLength(1);
     expect(byUpstream[0].id).toBe(dep.id);
   });
+
+  it('should create, update, clear fields on, and delete webhooks', async () => {
+    const created = await store.addWebhook({
+      name: 'Hook',
+      url: 'https://hooks.example.com/x',
+      events: ['task.created'],
+      secret: 'whsec_test',
+      active: true,
+      tenantId: 'acme'
+    });
+    expect(await store.getWebhook(created.id)).toMatchObject({ name: 'Hook', tenantId: 'acme' });
+
+    const updated = await store.updateWebhook(created.id, { events: ['*'], secret: undefined });
+    expect(updated?.events).toEqual(['*']);
+    expect((await store.getWebhook(created.id))?.secret).toBeUndefined();
+
+    expect(await store.deleteWebhook(created.id)).toBe(true);
+    expect(await store.getWebhook(created.id)).toBeNull();
+    expect(await store.deleteWebhook(created.id)).toBe(false);
+  });
 });
 

package/src/store/firebase.ts

@@ -573,6 +573,11 @@ export class FirebaseStore implements StorageAdapter {
     return snap.docs.map((doc) => ({ ...doc.data(), id: doc.id }));
   }
 
+  async getWebhook(id: string): Promise<Webhook | null> {
+    const doc = await this.db.collection('webhooks').doc(id).get();
+    return doc.exists ? ({ ...doc.data(), id: doc.id } as Webhook) : null;
+  }
+
   async addWebhook(webhook: Omit<Webhook, 'id' | 'createdAt'>): Promise<Webhook> {
     const docRef = this.db.collection('webhooks').doc();
     const now = new Date().toISOString();
@@ -580,4 +585,21 @@ export class FirebaseStore implements StorageAdapter {
     await docRef.set(sanitizeFirestoreData(newWh));
     return newWh;
   }
+
+  async updateWebhook(id: string, updates: Partial<Omit<Webhook, 'id' | 'createdAt'>>): Promise<Webhook | null> {
+    const existing = await this.getWebhook(id);
+    if (!existing) return null;
+    const updated: Webhook = { ...existing, ...updates, id, createdAt: existing.createdAt };
+    // Write the whole document (no merge) so fields cleared with `undefined` are removed.
+    await this.db.collection('webhooks').doc(id).set(sanitizeFirestoreData(updated));
+    return updated;
+  }
+
+  async deleteWebhook(id: string): Promise<boolean> {
+    const ref = this.db.collection('webhooks').doc(id);
+    const doc = await ref.get();
+    if (!doc.exists) return false;
+    await ref.delete();
+    return true;
+  }
 }

package/src/store/index.ts

@@ -101,7 +101,10 @@ export interface DependencyRepository {
 
 export interface WebhookRepository {
   getWebhooks(): Promise<Webhook[]>;
+  getWebhook(id: string): Promise<Webhook | null>;
   addWebhook(webhook: Omit<Webhook, 'id' | 'createdAt'>): Promise<Webhook>;
+  updateWebhook(id: string, updates: Partial<Omit<Webhook, 'id' | 'createdAt'>>): Promise<Webhook | null>;
+  deleteWebhook(id: string): Promise<boolean>;
 }
 
 export interface DeliverableRepository {
@@ -538,10 +541,26 @@ export class InMemoryStore implements StorageAdapter {
     return Array.from(this.webhooks.values());
   }
 
+  async getWebhook(id: string): Promise<Webhook | null> {
+    return this.webhooks.get(id) ?? null;
+  }
+
   async addWebhook(webhook: Omit<Webhook, 'id' | 'createdAt'>): Promise<Webhook> {
     const id = `wh_${Math.random().toString(36).substring(2, 9)}`;
     const newWh: Webhook = { ...webhook, id, createdAt: new Date().toISOString() };
     this.webhooks.set(id, newWh);
     return newWh;
   }
+
+  async updateWebhook(id: string, updates: Partial<Omit<Webhook, 'id' | 'createdAt'>>): Promise<Webhook | null> {
+    const existing = this.webhooks.get(id);
+    if (!existing) return null;
+    const updated: Webhook = { ...existing, ...updates, id, createdAt: existing.createdAt };
+    this.webhooks.set(id, updated);
+    return updated;
+  }
+
+  async deleteWebhook(id: string): Promise<boolean> {
+    return this.webhooks.delete(id);
+  }
 }

package/src/store/sqlite.ts

@@ -280,6 +280,14 @@ export class SQLiteStore implements StorageAdapter {
       // Column may already exist
     }
 
+    for (const column of ['name TEXT', 'tenantId TEXT']) {
+      try {
+        this.db.exec(`ALTER TABLE webhooks ADD COLUMN ${column}`);
+      } catch {
+        // Column may already exist
+      }
+    }
+
     for (const table of ['projects', 'workflows', 'teams']) {
       try {
         this.db.exec(`ALTER TABLE ${table} ADD COLUMN tenantId TEXT`);
@@ -1175,11 +1183,48 @@ export class SQLiteStore implements StorageAdapter {
   async getWebhooks(): Promise<Webhook[]> {
     const stmt = this.db.prepare('SELECT * FROM webhooks');
     const rows = stmt.all() as any[];
-    return rows.map((r) => ({
-      ...r,
-      events: JSON.parse(r.events),
-      active: Boolean(r.active)
-    }));
+    return rows.map((r) => this.mapWebhook(r));
+  }
+
+  async getWebhook(id: string): Promise<Webhook | null> {
+    const row = this.db.prepare('SELECT * FROM webhooks WHERE id = ?').get(id) as any;
+    return row ? this.mapWebhook(row) : null;
+  }
+
+  async updateWebhook(id: string, updates: Partial<Omit<Webhook, 'id' | 'createdAt'>>): Promise<Webhook | null> {
+    const existing = await this.getWebhook(id);
+    if (!existing) return null;
+    const updated: Webhook = { ...existing, ...updates, id, createdAt: existing.createdAt };
+    this.db
+      .prepare('UPDATE webhooks SET name = ?, url = ?, events = ?, secret = ?, active = ?, tenantId = ? WHERE id = ?')
+      .run(
+        updated.name ?? null,
+        updated.url,
+        JSON.stringify(updated.events),
+        updated.secret ?? null,
+        updated.active ? 1 : 0,
+        updated.tenantId ?? null,
+        id
+      );
+    return updated;
+  }
+
+  async deleteWebhook(id: string): Promise<boolean> {
+    const result = this.db.prepare('DELETE FROM webhooks WHERE id = ?').run(id);
+    return Number(result.changes) > 0;
+  }
+
+  private mapWebhook(row: any): Webhook {
+    return {
+      id: row.id,
+      name: row.name ?? '',
+      url: row.url,
+      events: JSON.parse(row.events),
+      secret: row.secret ?? undefined,
+      active: Boolean(row.active),
+      tenantId: row.tenantId ?? undefined,
+      createdAt: row.createdAt
+    };
   }
 
   async addWebhook(webhook: Omit<Webhook, 'id' | 'createdAt'>): Promise<Webhook> {
@@ -1188,15 +1233,17 @@ export class SQLiteStore implements StorageAdapter {
     const newWh: Webhook = { ...webhook, id, createdAt: now };
 
     const stmt = this.db.prepare(`
-      INSERT INTO webhooks (id, url, events, secret, active, createdAt)
-      VALUES (?, ?, ?, ?, ?, ?)
+      INSERT INTO webhooks (id, name, url, events, secret, active, tenantId, createdAt)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
     `);
     stmt.run(
       newWh.id,
+      newWh.name ?? null,
       newWh.url,
       JSON.stringify(newWh.events),
       newWh.secret || null,
       newWh.active ? 1 : 0,
+      newWh.tenantId ?? null,
       newWh.createdAt
     );
     return newWh;

package/src/types/index.ts

@@ -88,7 +88,8 @@ export interface CustomFieldDefinition {
   id: string;
   key: string;
   label: string;
-  type: 'text' | 'number' | 'date' | 'boolean' | 'single_select' | 'multi_select' | 'user';
+  /** A built-in type, or a type registered by a plugin's `customFieldTypes`. */
+  type: 'text' | 'number' | 'date' | 'boolean' | 'single_select' | 'multi_select' | 'user' | (string & {});
   options?: string[];
   required?: boolean;
   defaultValue?: unknown;
@@ -429,58 +430,93 @@ export interface Webhook {
   id: string;
   name: string;
   url: string;
+  /** HMAC-SHA256 signing secret. Never returned by engine reads (see `PublicWebhook`). */
   secret?: string;
+  /** Event names to deliver, or `'*'` for every event. */
   events: WebhookEvent[];
   active: boolean;
+  /** Tenant whose events this webhook receives. Set from the creating actor. */
+  tenantId?: string;
   createdAt: string;
 }
 
-export type WebhookEvent =
-  | 'project.created'
-  | 'project.updated'
-  | 'project.deleted'
-  | 'task.created'
-  | 'task.updated'
-  | 'task.deleted'
-  | 'task.status_changed'
-  | 'task.blocked'
-  | 'task.unblocked'
-  | 'comment.created'
-  | 'comment.updated'
-  | 'comment.deleted'
-  | 'comment.reaction.added'
-  | 'comment.reaction.removed'
-  | 'attachment.created'
-  | 'attachment.deleted'
-  | 'iteration.started'
-  | 'iteration.completed'
-  | 'team.created'
-  | 'container.created'
-  | 'workflow.created'
-  | 'workflow.updated'
-  | 'workflow.deleted'
-  | 'deliverable.created'
-  | 'deliverable.updated'
-  | 'deliverable.deleted'
-  | 'deliverable.status_changed';
+/** A webhook as returned by engine and API reads: the secret is replaced by `hasSecret`. */
+export type PublicWebhook = Omit<Webhook, 'secret'> & { hasSecret: boolean };
+
+/**
+ * Webhook subscriptions use domain event names (e.g. `task.created`, `time.logged`); see
+ * `CriticalPathDomainEvent` in `domain/events.ts`. `'*'` subscribes to everything.
+ */
+export type WebhookEvent = import('../domain/events.js').CriticalPathDomainEvent['name'] | '*';
 
+/**
+ * Lifecycle hooks, run in plugin registration order.
+ *
+ * - `before*` hooks may transform the input or throw to abort the operation. Their output is
+ *   validated (workflow transitions, custom fields) exactly like caller input, and they cannot
+ *   move a task to another project.
+ * - `after*` hooks run once the change is stored. Errors are logged and do not fail the call.
+ */
 export interface PluginHooks {
   beforeTaskCreate?: (task: Partial<Task>) => Promise<Partial<Task>> | Partial<Task>;
   afterTaskCreate?: (task: Task) => Promise<void> | void;
   beforeTaskUpdate?: (id: string, updates: Partial<Task>) => Promise<Partial<Task>> | Partial<Task>;
   afterTaskUpdate?: (task: Task, previousState: Task) => Promise<void> | void;
-  beforeTaskDelete?: (id: string) => Promise<void> | void;
-  afterTaskDelete?: (id: string) => Promise<void> | void;
+  beforeTaskDelete?: (id: string, task: Task) => Promise<void> | void;
+  afterTaskDelete?: (id: string, task: Task) => Promise<void> | void;
+}
+
+/** A custom field type contributed by a plugin, e.g. `url` or `currency`. */
+export interface CustomFieldType {
+  /** The `type` value used in `CustomFieldDefinition`s. Must not clash with a built-in type. */
+  type: string;
+  label?: string;
+  /** Returns an error message for an invalid value, or nothing when valid. Not called for empty values. */
+  validate: (value: unknown, definition: CustomFieldDefinition) => string | null | undefined | void;
 }
 
+/** Context passed to plugin routes and middleware. */
+export interface PluginRequestContext {
+  /** The engine as the calling actor (authorization and tenancy apply). */
+  engine: import('../engine/index.js').CriticalPathEngine;
+  /** The caller resolved by the router's `getContext`, if any. */
+  context?: Record<string, unknown> & { userId?: string };
+  url: URL;
+  /** Path parameters from the route pattern, e.g. `{ projectId: 'p1' }` for `/reports/:projectId`. */
+  params: Record<string, string>;
+}
+
+export interface PluginRoute {
+  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+  /** Path below the router's base, with `:name` parameters, e.g. `/reports/:projectId`. */
+  path: string;
+  handler: (request: Request, ctx: PluginRequestContext) => Response | Promise<Response>;
+}
+
+/**
+ * Wraps every routed request (after authentication). Call `next()` to continue, or return a
+ * `Response` to short-circuit (e.g. rate limiting).
+ */
+export type PluginMiddleware = (
+  request: Request,
+  ctx: Omit<PluginRequestContext, 'params'>,
+  next: () => Promise<Response>
+) => Response | Promise<Response>;
+
 export interface CriticalPathPlugin {
   id: string;
   name: string;
   version: string;
   description?: string;
   hooks?: PluginHooks;
-  customFieldTypes?: CustomFieldDefinition[];
-  init?: (engine: unknown) => Promise<void> | void;
+  /** Additional custom field types projects can use in `customFieldDefinitions`. */
+  customFieldTypes?: CustomFieldType[];
+  /** Runs once when the engine starts; `engine.ready` resolves after every plugin's `init`. */
+  init?: (engine: import('../engine/index.js').CriticalPathEngine) => Promise<void> | void;
+  /** HTTP routes served by `@critical-path/server`, matched before built-in routes. */
+  routes?: PluginRoute[];
+  /** Middleware run by `@critical-path/server` around every routed request. */
+  middleware?: PluginMiddleware;
 }
 
 export interface CriticalPathConfig {
@@ -494,7 +530,10 @@ export interface CriticalPathConfig {
   store?: 'memory' | 'sqlite' | unknown;
   fileStorage?: FileStorageAdapter;
   plugins?: CriticalPathPlugin[];
+  /** Static webhooks (not stored or editable through the API). */
   webhooks?: Omit<Webhook, 'id' | 'createdAt'>[];
+  /** Delivery behaviour: queue, timeouts, retries, private URL policy, failure callbacks. */
+  webhookDelivery?: import('../webhooks/dispatcher.js').WebhookDeliveryOptions;
   defaultSchedule?: WorkSchedule;
   initialData?: {
     projects?: Project[];