@digimuza/saas-core 0.0.2

package/dist/users/index.d.ts

@@ -0,0 +1,9 @@
+export { createUsersService, type ProfileUpdate, type UsersService, type UsersServiceDeps, type UserWithProfile, type WorkosUserAttributes, } from "./service.ts";
+/**
+ * Default service, bound to the configuration-driven database handle.
+ *
+ * `db` is a getter so the handle — and therefore the `database` configuration
+ * section — is resolved on first use rather than at import.
+ */
+export declare const users: import("./service.ts").UsersService;
+//# sourceMappingURL=index.d.ts.map

package/dist/users/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/users/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AAEtB;;;;;GAKG;AACH,eAAO,MAAM,KAAK,qCAKhB,CAAC"}

package/dist/users/index.js

@@ -0,0 +1,23 @@
+/**
+ * Public users surface: `@digimuza/saas-core/users`. Server-only.
+ *
+ * Identity (`users`) and profile (`user_profiles`) are separate tables but a
+ * single concern here, because callers almost always want both.
+ */
+import { getDatabase } from "../db/client.js";
+import { events as coreEventsService } from "../events/index.js";
+import { createUsersService } from "./service.js";
+export { createUsersService, } from "./service.js";
+/**
+ * Default service, bound to the configuration-driven database handle.
+ *
+ * `db` is a getter so the handle — and therefore the `database` configuration
+ * section — is resolved on first use rather than at import.
+ */
+export const users = createUsersService({
+    get db() {
+        return getDatabase();
+    },
+    events: coreEventsService,
+});
+//# sourceMappingURL=index.js.map

package/dist/users/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/users/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,MAAM,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EACL,kBAAkB,GAMnB,MAAM,cAAc,CAAC;AAEtB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,kBAAkB,CAAC;IACtC,IAAI,EAAE;QACJ,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC"}

package/dist/users/service.d.ts

@@ -0,0 +1,43 @@
+import type { CoreDatabase } from "../db/types.ts";
+import { type CoreEventPublisher } from "../events/publisher.ts";
+import type { User, UserProfile } from "../db/schema/index.ts";
+/** A user together with their profile, which is how callers almost always want them. */
+export interface UserWithProfile extends User {
+    readonly profile: UserProfile | null;
+}
+/** Identity attributes as supplied by WorkOS. */
+export interface WorkosUserAttributes {
+    readonly workosUserId: string;
+    readonly email: string;
+    readonly firstName?: string | null;
+    readonly lastName?: string | null;
+    readonly profilePictureUrl?: string | null;
+}
+export interface ProfileUpdate {
+    readonly firstName?: string | null;
+    readonly lastName?: string | null;
+    readonly displayName?: string | null;
+    readonly avatarUrl?: string | null;
+}
+export interface UsersService {
+    getById(userId: string): Promise<UserWithProfile | undefined>;
+    /** As {@link getById}, but throws {@link NotFoundError}. */
+    requireById(userId: string): Promise<UserWithProfile>;
+    getByWorkosId(workosUserId: string): Promise<UserWithProfile | undefined>;
+    /**
+     * Create or update the local record for a WorkOS identity.
+     *
+     * Called on every successful authentication so the local copy tracks the
+     * identity provider. Idempotent, and safe to call concurrently.
+     */
+    syncFromWorkos(attributes: WorkosUserAttributes): Promise<UserWithProfile>;
+    updateProfile(userId: string, update: ProfileUpdate): Promise<UserProfile>;
+}
+export interface UsersServiceDeps {
+    /** Read per call, so the caller can supply a lazily resolved handle. */
+    readonly db: CoreDatabase;
+    /** Optional event publisher. Omit it and the service emits nothing. */
+    readonly events?: CoreEventPublisher;
+}
+export declare function createUsersService(deps: UsersServiceDeps): UsersService;
+//# sourceMappingURL=service.d.ts.map

package/dist/users/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/users/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAe,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAE/D,wFAAwF;AACxF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;CACtC;AAED,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC9D,4DAA4D;IAC5D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACtD,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC1E;;;;;OAKG;IACH,cAAc,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3E,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AASD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,CA2HvE"}

package/dist/users/service.js

@@ -0,0 +1,113 @@
+import { eq } from "drizzle-orm";
+import { NotFoundError } from "../errors.js";
+import { userProfiles, users } from "../db/schema/index.js";
+import { EventOutbox } from "../events/publisher.js";
+function displayNameFrom(attributes) {
+    const parts = [attributes.firstName, attributes.lastName].filter((part) => typeof part === "string" && part.trim().length > 0);
+    return parts.length > 0 ? parts.join(" ") : null;
+}
+export function createUsersService(deps) {
+    async function loadBy(column, value) {
+        const rows = await deps.db
+            .select({ user: users, profile: userProfiles })
+            .from(users)
+            .leftJoin(userProfiles, eq(userProfiles.userId, users.id))
+            .where(eq(column, value))
+            .limit(1);
+        const row = rows[0];
+        return row === undefined ? undefined : { ...row.user, profile: row.profile };
+    }
+    return {
+        getById(userId) {
+            return loadBy(users.id, userId);
+        },
+        async requireById(userId) {
+            const user = await loadBy(users.id, userId);
+            if (user === undefined) {
+                throw new NotFoundError("User not found.");
+            }
+            return user;
+        },
+        getByWorkosId(workosUserId) {
+            return loadBy(users.workosUserId, workosUserId);
+        },
+        async syncFromWorkos(attributes) {
+            const events = new EventOutbox(deps.events);
+            const userId = await deps.db.transaction(async (tx) => {
+                /**
+                 * `onConflictDoUpdate` rather than select-then-insert: two concurrent
+                 * sign-ins for the same WorkOS identity would otherwise race and one
+                 * would fail on the unique index. `updated_at` is touched so the upsert
+                 * always returns a row.
+                 */
+                const [user] = await tx
+                    .insert(users)
+                    .values({ workosUserId: attributes.workosUserId })
+                    .onConflictDoUpdate({
+                    target: users.workosUserId,
+                    set: { updatedAt: new Date() },
+                })
+                    .returning({ id: users.id });
+                const id = user.id;
+                await tx
+                    .insert(userProfiles)
+                    .values({
+                    userId: id,
+                    email: attributes.email,
+                    firstName: attributes.firstName ?? null,
+                    lastName: attributes.lastName ?? null,
+                    displayName: displayNameFrom(attributes),
+                    avatarUrl: attributes.profilePictureUrl ?? null,
+                })
+                    .onConflictDoUpdate({
+                    target: userProfiles.userId,
+                    set: {
+                        email: attributes.email,
+                        firstName: attributes.firstName ?? null,
+                        lastName: attributes.lastName ?? null,
+                        avatarUrl: attributes.profilePictureUrl ?? null,
+                        updatedAt: new Date(),
+                    },
+                });
+                /**
+                 * `user.created` fires once per identity, keyed on the WorkOS id.
+                 *
+                 * The upsert cannot report whether it inserted, and a select-then-decide
+                 * would race. The idempotency key makes the unique index settle it: the
+                 * first sync records the event, every later one silently finds it
+                 * already there.
+                 */
+                await events.record({
+                    type: "user.created",
+                    workspaceId: null,
+                    actorId: id,
+                    idempotencyKey: attributes.workosUserId,
+                    data: { userId: id, workosUserId: attributes.workosUserId },
+                }, tx);
+                return id;
+            });
+            await events.flush();
+            /**
+             * `display_name` is intentionally not overwritten on update: a user may
+             * have set it themselves, and the identity provider must not clobber it.
+             */
+            const synced = await loadBy(users.id, userId);
+            if (synced === undefined) {
+                throw new NotFoundError("User disappeared during sync.");
+            }
+            return synced;
+        },
+        async updateProfile(userId, update) {
+            const [profile] = await deps.db
+                .update(userProfiles)
+                .set({ ...update, updatedAt: new Date() })
+                .where(eq(userProfiles.userId, userId))
+                .returning();
+            if (profile === undefined) {
+                throw new NotFoundError("User profile not found.");
+            }
+            return profile;
+        },
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/users/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/users/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,WAAW,EAA2B,MAAM,wBAAwB,CAAC;AA8C9E,SAAS,eAAe,CAAC,UAAgC;IACvD,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC9D,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC7E,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,KAAK,UAAU,MAAM,CACnB,MAAmD,EACnD,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC9C,IAAI,CAAC,KAAK,CAAC;aACX,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACzD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;aACxB,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,OAAO,CAAC,MAAM;YACZ,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,aAAa,CAAC,iBAAiB,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,aAAa,CAAC,YAAY;YACxB,OAAO,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,UAAU;YAC7B,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACpD;;;;;mBAKG;gBACH,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;qBACpB,MAAM,CAAC,KAAK,CAAC;qBACb,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;qBACjD,kBAAkB,CAAC;oBAClB,MAAM,EAAE,KAAK,CAAC,YAAY;oBAC1B,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;iBAC/B,CAAC;qBACD,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBAE/B,MAAM,EAAE,GAAG,IAAK,CAAC,EAAE,CAAC;gBAEpB,MAAM,EAAE;qBACL,MAAM,CAAC,YAAY,CAAC;qBACpB,MAAM,CAAC;oBACN,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,IAAI;oBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,IAAI;oBACrC,WAAW,EAAE,eAAe,CAAC,UAAU,CAAC;oBACxC,SAAS,EAAE,UAAU,CAAC,iBAAiB,IAAI,IAAI;iBAChD,CAAC;qBACD,kBAAkB,CAAC;oBAClB,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,GAAG,EAAE;wBACH,KAAK,EAAE,UAAU,CAAC,KAAK;wBACvB,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,IAAI;wBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,IAAI;wBACrC,SAAS,EAAE,UAAU,CAAC,iBAAiB,IAAI,IAAI;wBAC/C,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB;iBACF,CAAC,CAAC;gBAEL;;;;;;;mBAOG;gBACH,MAAM,MAAM,CAAC,MAAM,CACjB;oBACE,IAAI,EAAE,cAAc;oBACpB,WAAW,EAAE,IAAI;oBACjB,OAAO,EAAE,EAAE;oBACX,cAAc,EAAE,UAAU,CAAC,YAAY;oBACvC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;iBAC5D,EACD,EAAE,CACH,CAAC;gBAEF,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAErB;;;eAGG;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,aAAa,CAAC,+BAA+B,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM;YAChC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC5B,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACzC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBACtC,SAAS,EAAE,CAAC;YAEf,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/webhooks/inbound.d.ts

@@ -0,0 +1,70 @@
+import type { InboundWebhook } from "../db/schema/index.ts";
+import type { CoreDatabase } from "../db/types.ts";
+/** Raised when an inbound signature does not verify. */
+export declare class InvalidInboundSignatureError extends Error {
+    readonly name = "InvalidInboundSignatureError";
+    constructor();
+}
+export interface ReceiveWebhookInput {
+    /** Which system sent it, e.g. `"github"`. */
+    readonly source: string;
+    /** The sender's own event id. The idempotency key. */
+    readonly externalId: string;
+    readonly type: string;
+    readonly payload: unknown;
+    /** Set when the sender identifies a tenant you can resolve. */
+    readonly workspaceId?: string | null;
+}
+export type ReceiveOutcome = 
+/** Claimed for processing. Run the handler, then mark the result. */
+{
+    readonly status: "claimed";
+    readonly id: string;
+}
+/** Already handled, or being handled now. Nothing was claimed. */
+ | {
+    readonly status: "duplicate";
+    readonly id: string | undefined;
+};
+export interface InboundWebhooksService {
+    /**
+     * Record and claim an inbound webhook.
+     *
+     * The insert *is* the claim, so at-least-once delivery and concurrent
+     * redeliveries are handled by PostgreSQL rather than by a check-then-act two
+     * requests could both pass. A retry re-claims an event whose previous attempt
+     * **failed**, but never one already `processed` or currently `pending`.
+     */
+    receive(input: ReceiveWebhookInput, tx?: CoreDatabase): Promise<ReceiveOutcome>;
+    /** Mark a claimed webhook processed. */
+    markProcessed(id: string): Promise<void>;
+    /** Mark a claimed webhook failed, so a redelivery can re-claim it. */
+    markFailed(id: string, error: unknown): Promise<void>;
+    /**
+     * Mark a claimed webhook as not actionable — an unknown tenant, an event type
+     * you do not handle. Distinct from failed, which needs attention.
+     */
+    markIgnored(id: string): Promise<void>;
+    /** Look one up, for replay or diagnostics. */
+    get(source: string, externalId: string): Promise<InboundWebhook | undefined>;
+    /** Everything awaiting replay. */
+    listFailed(options?: {
+        source?: string;
+        limit?: number;
+    }): Promise<InboundWebhook[]>;
+    /**
+     * Run a handler inside the claim, marking the outcome automatically.
+     *
+     * The shape most callers want: claim, handle, record. Rethrows so the sender
+     * sees a non-2xx and retries.
+     */
+    process(input: ReceiveWebhookInput, handler: (webhook: InboundWebhook) => Promise<"processed" | "ignored" | void>): Promise<ReceiveOutcome & {
+        readonly handled?: boolean;
+    }>;
+}
+export interface InboundWebhooksServiceDeps {
+    readonly db: CoreDatabase;
+    readonly now?: () => Date;
+}
+export declare function createInboundWebhooksService(deps: InboundWebhooksServiceDeps): InboundWebhooksService;
+//# sourceMappingURL=inbound.d.ts.map

package/dist/webhooks/inbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../../src/webhooks/inbound.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,wDAAwD;AACxD,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,SAAkB,IAAI,kCAAkC;IAExD,cAMC;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,cAAc;AACxB,qEAAqE;AACnE;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE;AACrD,kEAAkE;GAChE;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACrC;;;;;;;OAOG;IACH,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAEhF,wCAAwC;IACxC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC,sEAAsE;IACtE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtD;;;OAGG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvC,8CAA8C;IAC9C,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAE7E,kCAAkC;IAClC,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAErF;;;;;OAKG;IACH,OAAO,CACL,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC,GAC5E,OAAO,CAAC,cAAc,GAAG;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAKD,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,0BAA0B,GAC/B,sBAAsB,CA6JxB"}

package/dist/webhooks/inbound.js

@@ -0,0 +1,146 @@
+import { and, eq } from "drizzle-orm";
+import { inboundWebhooks } from "../db/schema/index.js";
+import { InvalidInputError } from "../errors.js";
+/** Raised when an inbound signature does not verify. */
+export class InvalidInboundSignatureError extends Error {
+    name = "InvalidInboundSignatureError";
+    constructor() {
+        /**
+         * Deliberately uninformative. A caller who cannot produce a valid signature
+         * gets no hint about which part failed.
+         */
+        super("Webhook signature verification failed.");
+    }
+}
+const MAX_ERROR_LENGTH = 1000;
+const DEFAULT_LIMIT = 50;
+export function createInboundWebhooksService(deps) {
+    const now = deps.now ?? (() => new Date());
+    async function load(id) {
+        const rows = await deps.db
+            .select()
+            .from(inboundWebhooks)
+            .where(eq(inboundWebhooks.id, id))
+            .limit(1);
+        return rows[0];
+    }
+    const service = {
+        async receive(input, tx) {
+            if (input.source.trim().length === 0 || input.externalId.trim().length === 0) {
+                /**
+                 * Without a stable source and external id there is nothing to deduplicate
+                 * on, and accepting the event would risk applying it repeatedly.
+                 */
+                throw new InvalidInputError("An inbound webhook needs a source and an external id.");
+            }
+            const db = tx ?? deps.db;
+            const claimed = await db
+                .insert(inboundWebhooks)
+                .values({
+                source: input.source,
+                externalId: input.externalId,
+                type: input.type,
+                payload: input.payload,
+                workspaceId: input.workspaceId ?? null,
+                status: "pending",
+            })
+                .onConflictDoUpdate({
+                target: [inboundWebhooks.source, inboundWebhooks.externalId],
+                set: { status: "pending", error: null, updatedAt: now() },
+                /**
+                 * Only re-claim a *failed* event. One already `processed` must not be
+                 * applied twice, and one currently `pending` is being handled by
+                 * another request right now.
+                 */
+                setWhere: eq(inboundWebhooks.status, "failed"),
+            })
+                .returning({ id: inboundWebhooks.id });
+            const claim = claimed[0];
+            if (claim !== undefined) {
+                return { status: "claimed", id: claim.id };
+            }
+            const existing = await db
+                .select({ id: inboundWebhooks.id })
+                .from(inboundWebhooks)
+                .where(and(eq(inboundWebhooks.source, input.source), eq(inboundWebhooks.externalId, input.externalId)))
+                .limit(1);
+            return { status: "duplicate", id: existing[0]?.id };
+        },
+        async markProcessed(id) {
+            const at = now();
+            await deps.db
+                .update(inboundWebhooks)
+                .set({ status: "processed", processedAt: at, error: null, updatedAt: at })
+                .where(eq(inboundWebhooks.id, id));
+        },
+        async markFailed(id, error) {
+            const message = error instanceof Error ? error.message : "Unknown error";
+            const at = now();
+            await deps.db
+                .update(inboundWebhooks)
+                .set({
+                status: "failed",
+                error: message.length > MAX_ERROR_LENGTH
+                    ? `${message.slice(0, MAX_ERROR_LENGTH - 1)}…`
+                    : message,
+                updatedAt: at,
+            })
+                .where(eq(inboundWebhooks.id, id));
+        },
+        async markIgnored(id) {
+            const at = now();
+            await deps.db
+                .update(inboundWebhooks)
+                .set({ status: "ignored", processedAt: at, updatedAt: at })
+                .where(eq(inboundWebhooks.id, id));
+        },
+        async get(source, externalId) {
+            const rows = await deps.db
+                .select()
+                .from(inboundWebhooks)
+                .where(and(eq(inboundWebhooks.source, source), eq(inboundWebhooks.externalId, externalId)))
+                .limit(1);
+            return rows[0];
+        },
+        async listFailed(options = {}) {
+            const clauses = [eq(inboundWebhooks.status, "failed")];
+            if (options.source !== undefined) {
+                clauses.push(eq(inboundWebhooks.source, options.source));
+            }
+            return deps.db
+                .select()
+                .from(inboundWebhooks)
+                .where(and(...clauses))
+                .limit(options.limit ?? DEFAULT_LIMIT);
+        },
+        async process(input, handler) {
+            const outcome = await service.receive(input);
+            if (outcome.status === "duplicate") {
+                return outcome;
+            }
+            const webhook = await load(outcome.id);
+            if (webhook === undefined) {
+                throw new Error("Claimed inbound webhook disappeared.");
+            }
+            try {
+                const result = await handler(webhook);
+                if (result === "ignored") {
+                    await service.markIgnored(outcome.id);
+                    return { ...outcome, handled: false };
+                }
+                await service.markProcessed(outcome.id);
+                return { ...outcome, handled: true };
+            }
+            catch (error) {
+                /**
+                 * Record the failure so the event can be replayed from the stored
+                 * payload, then rethrow so the sender sees a non-2xx and retries.
+                 */
+                await service.markFailed(outcome.id, error);
+                throw error;
+            }
+        },
+    };
+    return service;
+}
+//# sourceMappingURL=inbound.js.map

package/dist/webhooks/inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../src/webhooks/inbound.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,wDAAwD;AACxD,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACnC,IAAI,GAAG,8BAA8B,CAAC;IAExD;QACE;;;WAGG;QACH,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAClD,CAAC;CACF;AAiED,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,MAAM,UAAU,4BAA4B,CAC1C,IAAgC;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C,KAAK,UAAU,IAAI,CAAC,EAAU;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE;YACrB,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7E;;;mBAGG;gBACH,MAAM,IAAI,iBAAiB,CAAC,uDAAuD,CAAC,CAAC;YACvF,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YAEzB,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,eAAe,CAAC;iBACvB,MAAM,CAAC;gBACN,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAgB;gBAC/B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACtC,MAAM,EAAE,SAAS;aAClB,CAAC;iBACD,kBAAkB,CAAC;gBAClB,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,UAAU,CAAC;gBAC5D,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;gBACzD;;;;mBAIG;gBACH,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC;aAC/C,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;YAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAC7C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EACxC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CACjD,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YAEZ,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE;YACpB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,eAAe,CAAC;iBACvB,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACzE,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YAEjB,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,eAAe,CAAC;iBACvB,GAAG,CAAC;gBACH,MAAM,EAAE,QAAQ;gBAChB,KAAK,EACH,OAAO,CAAC,MAAM,GAAG,gBAAgB;oBAC/B,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG;oBAC9C,CAAC,CAAC,OAAO;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE;YAClB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,eAAe,CAAC;iBACvB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAC1D,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CACpF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YAEZ,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,EAAE;YAC3B,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,IAAI,CAAC,EAAE;iBACX,MAAM,EAAE;iBACR,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;iBACtB,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;YAC1B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAE7C,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACnC,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;gBAEtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACtC,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBACxC,CAAC;gBAED,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACxC,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf;;;mBAGG;gBACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/webhooks/index.d.ts

@@ -0,0 +1,12 @@
+import { type InboundWebhooksService } from "./inbound.ts";
+import { type OutgoingWebhooksService } from "./outgoing.ts";
+export { createInboundWebhooksService, InvalidInboundSignatureError, type InboundWebhooksService, type InboundWebhooksServiceDeps, type ReceiveOutcome, type ReceiveWebhookInput, } from "./inbound.ts";
+export { createFetchWebhookSender, createOutgoingWebhooksService, type CreateEndpointInput, type DeliveryAttemptResult, type EndpointWithSecret, type OutgoingWebhooksService, type OutgoingWebhooksServiceDeps, type WebhookSender, } from "./outgoing.ts";
+export { generateWebhookSecret, SIGNATURE_HEADER, SIGNATURE_VERSION, signingPayload, signWebhookPayload, TIMESTAMP_HEADER, verifyWebhookSignature, } from "./signature.ts";
+export interface WebhooksService {
+    readonly outgoing: OutgoingWebhooksService;
+    readonly inbound: InboundWebhooksService;
+}
+/** Default service, bound to the database and a `fetch`-based sender. */
+export declare const webhooks: WebhooksService;
+//# sourceMappingURL=index.d.ts.map

package/dist/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AA6CA,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAC1C;AAED,yEAAyE;AACzE,eAAO,MAAM,QAAQ,EAAE,eAYtB,CAAC"}

package/dist/webhooks/index.js

@@ -0,0 +1,65 @@
+/**
+ * Public webhooks surface: `@digimuza/saas-core/webhooks`. Server-only.
+ *
+ * Both directions, sharing one signature scheme so there is a single
+ * implementation to audit:
+ *
+ * **Outgoing.** A workspace registers endpoints; events are queued as delivery
+ * *records* and sent by a durable worker with signing, retries and backoff. A
+ * process dying mid-attempt loses nothing.
+ *
+ * **Inbound.** Receive from an external system with signature verification and
+ * database-enforced idempotency — the same mechanism billing already uses for
+ * Revolut, generalised.
+ *
+ * ```ts
+ * import { webhooks } from "@digimuza/saas-core/webhooks";
+ *
+ * // Register an endpoint. The secret is shown so the receiver can be configured.
+ * const { endpoint, secret } = await webhooks.outgoing.endpoints.create(context, {
+ *   url: "https://customer.example.com/hooks/acme",
+ *   eventTypes: ["project.created"],
+ * });
+ *
+ * // Queue deliveries, in the same transaction as the change if you like.
+ * await webhooks.outgoing.dispatch(event);
+ * ```
+ *
+ * ## Driving delivery
+ *
+ * The core records deliveries; it does not run a loop. Wire a Trigger.dev
+ * scheduled task, so retries are durable rather than tied to a process:
+ *
+ * ```ts
+ * export const drainWebhooks = schedules.task({
+ *   id: "drain-webhooks",
+ *   cron: "* * * * *",
+ *   run: async () => {
+ *     for (const delivery of await webhooks.outgoing.claimDue({ limit: 100 })) {
+ *       await webhooks.outgoing.attempt(delivery);
+ *     }
+ *   },
+ * });
+ * ```
+ */
+import { getDatabase } from "../db/client.js";
+import { createInboundWebhooksService, } from "./inbound.js";
+import { createFetchWebhookSender, createOutgoingWebhooksService, } from "./outgoing.js";
+export { createInboundWebhooksService, InvalidInboundSignatureError, } from "./inbound.js";
+export { createFetchWebhookSender, createOutgoingWebhooksService, } from "./outgoing.js";
+export { generateWebhookSecret, SIGNATURE_HEADER, SIGNATURE_VERSION, signingPayload, signWebhookPayload, TIMESTAMP_HEADER, verifyWebhookSignature, } from "./signature.js";
+/** Default service, bound to the database and a `fetch`-based sender. */
+export const webhooks = {
+    outgoing: createOutgoingWebhooksService({
+        get db() {
+            return getDatabase();
+        },
+        sender: createFetchWebhookSender(),
+    }),
+    inbound: createInboundWebhooksService({
+        get db() {
+            return getDatabase();
+        },
+    }),
+};
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACL,4BAA4B,GAE7B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAE9B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAK7B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAO9B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAOxB,yEAAyE;AACzE,MAAM,CAAC,MAAM,QAAQ,GAAoB;IACvC,QAAQ,EAAE,6BAA6B,CAAC;QACtC,IAAI,EAAE;YACJ,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;QACD,MAAM,EAAE,wBAAwB,EAAE;KACnC,CAAC;IACF,OAAO,EAAE,4BAA4B,CAAC;QACpC,IAAI,EAAE;YACJ,OAAO,WAAW,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;CACH,CAAC"}

package/dist/webhooks/outgoing.d.ts

@@ -0,0 +1,89 @@
+import type { WebhookDelivery, WebhookEndpoint } from "../db/schema/index.ts";
+import type { CoreDatabase } from "../db/types.ts";
+import type { SaasEvent } from "../events/registry.ts";
+import type { WorkspaceContext } from "../workspaces/context.ts";
+export interface CreateEndpointInput {
+    readonly url: string;
+    readonly description?: string;
+    /** Event types to receive. Empty means every type. */
+    readonly eventTypes?: readonly string[];
+}
+/** An endpoint as returned to a caller, with the secret shown. */
+export interface EndpointWithSecret {
+    readonly endpoint: WebhookEndpoint;
+    readonly secret: string;
+}
+export interface DeliveryAttemptResult {
+    readonly delivered: boolean;
+    readonly responseStatus?: number;
+    readonly error?: string;
+}
+/**
+ * Performs the actual HTTP request.
+ *
+ * Injectable so retry and backoff logic is testable without a network, and so a
+ * deployment can route webhook traffic through its own egress proxy — which is
+ * how you stop a tenant pointing an endpoint at an internal address.
+ */
+export interface WebhookSender {
+    send(input: {
+        url: string;
+        body: string;
+        headers: Record<string, string>;
+    }): Promise<DeliveryAttemptResult>;
+}
+export interface OutgoingWebhooksService {
+    readonly endpoints: {
+        create(context: WorkspaceContext, input: CreateEndpointInput): Promise<EndpointWithSecret>;
+        list(context: WorkspaceContext): Promise<WebhookEndpoint[]>;
+        /** Includes the signing secret, so the receiver can be configured. */
+        get(context: WorkspaceContext, endpointId: string): Promise<EndpointWithSecret>;
+        update(context: WorkspaceContext, endpointId: string, patch: {
+            url?: string;
+            description?: string | null;
+            eventTypes?: readonly string[];
+            isActive?: boolean;
+        }): Promise<WebhookEndpoint>;
+        /** Issue a new secret. The old one stops working immediately. */
+        rotateSecret(context: WorkspaceContext, endpointId: string): Promise<EndpointWithSecret>;
+        remove(context: WorkspaceContext, endpointId: string): Promise<void>;
+    };
+    /**
+     * Queue deliveries for every active endpoint subscribed to this event.
+     *
+     * Records rows; sends nothing. The HTTP calls are driven by a durable worker
+     * reading the table, so a process dying between dispatch and delivery loses
+     * nothing.
+     */
+    dispatch(event: SaasEvent, tx?: CoreDatabase): Promise<WebhookDelivery[]>;
+    /** Deliveries whose next attempt is due. For a worker to pick up. */
+    claimDue(options?: {
+        limit?: number;
+    }): Promise<WebhookDelivery[]>;
+    /** Attempt one delivery and record the outcome. */
+    attempt(delivery: WebhookDelivery): Promise<DeliveryAttemptResult>;
+    /** A workspace's delivery history, newest first. */
+    listDeliveries(context: WorkspaceContext, options?: {
+        endpointId?: string;
+        limit?: number;
+    }): Promise<WebhookDelivery[]>;
+}
+export interface OutgoingWebhooksServiceDeps {
+    readonly db: CoreDatabase;
+    readonly sender: WebhookSender;
+    readonly now?: () => Date;
+    /** Attempts before a delivery is exhausted. */
+    readonly maxAttempts?: number;
+    /** First retry delay; doubles per attempt. */
+    readonly initialRetryDelayMs?: number;
+    readonly maxRetryDelayMs?: number;
+    /** Consecutive failures before an endpoint is disabled. */
+    readonly failureThreshold?: number;
+}
+export declare function createOutgoingWebhooksService(deps: OutgoingWebhooksServiceDeps): OutgoingWebhooksService;
+/** A {@link WebhookSender} over `fetch`, with a timeout. */
+export declare function createFetchWebhookSender(options?: {
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}): WebhookSender;
+//# sourceMappingURL=outgoing.d.ts.map

package/dist/webhooks/outgoing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outgoing.d.ts","sourceRoot":"","sources":["../../src/webhooks/outgoing.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,KAAK,EAAE;QACV,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE;QAClB,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3F,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QAC5D,sEAAsE;QACtE,GAAG,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAChF,MAAM,CACJ,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,GACvG,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5B,iEAAiE;QACjE,YAAY,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACzF,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACtE,CAAC;IAEF;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE1E,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEnE,mDAAmD;IACnD,OAAO,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEnE,oDAAoD;IACpD,cAAc,CACZ,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8CAA8C;IAC9C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AA6DD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,2BAA2B,GAChC,uBAAuB,CA4VzB;AAED,4DAA4D;AAC5D,wBAAgB,wBAAwB,CAAC,OAAO,GAAE;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACrB,GAAG,aAAa,CAiCrB"}