@endora-commerce/mod-webhooks 0.100.0

package/dist/backend/entities/webhook.entity.js

@@ -0,0 +1,91 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, Index, OptionalProps, PrimaryKey, Property } from '@mikro-orm/core';
+import { GlobalEntity } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * Outbound webhook subscription (FR-121).
+ *
+ *   - `eventTypes` array gates which events trigger a delivery for this row.
+ *   - `secret` is shared with the receiver so they can verify the HMAC the
+ *     delivery worker stamps on every POST body.
+ *   - `status='paused'` stops new deliveries without deleting historical
+ *     WebhookDelivery rows.
+ */
+let Webhook = class Webhook {
+    [OptionalProps];
+    id = randomUUID();
+    name;
+    url;
+    /** Shared secret, stored plaintext (already at rest in the DB; the HMAC is
+     *  what protects payload integrity in transit). 64 hex chars by default. */
+    secret;
+    eventTypes = [];
+    status = 'active';
+    createdByAdminUserId;
+    /**
+     * Feature 062 — delivery filter (data-model.md §3). NULL = platform-wide
+     * subscription (legacy semantics); a value restricts delivery to events
+     * whose payload `organizationId` matches. Evaluated in the event-bridge
+     * lookup; the row itself stays `@GlobalEntity()` (admin-managed platform
+     * configuration — research §R12).
+     */
+    organizationId;
+    createdAt = new Date();
+    updatedAt = new Date();
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], Webhook.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'string', length: 160 }),
+    __metadata("design:type", String)
+], Webhook.prototype, "name", void 0);
+__decorate([
+    Property({ type: 'string', length: 2048 }),
+    __metadata("design:type", String)
+], Webhook.prototype, "url", void 0);
+__decorate([
+    Property({ type: 'string', length: 128 }),
+    __metadata("design:type", String)
+], Webhook.prototype, "secret", void 0);
+__decorate([
+    Property({ type: 'json' }),
+    __metadata("design:type", Array)
+], Webhook.prototype, "eventTypes", void 0);
+__decorate([
+    Property({ type: 'string', length: 16 }),
+    Index(),
+    __metadata("design:type", String)
+], Webhook.prototype, "status", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    __metadata("design:type", Object)
+], Webhook.prototype, "createdByAdminUserId", void 0);
+__decorate([
+    Property({ type: 'uuid', nullable: true }),
+    Index(),
+    __metadata("design:type", Object)
+], Webhook.prototype, "organizationId", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], Webhook.prototype, "createdAt", void 0);
+__decorate([
+    Property({ type: 'datetime', onUpdate: () => new Date() }),
+    __metadata("design:type", Date)
+], Webhook.prototype, "updatedAt", void 0);
+Webhook = __decorate([
+    GlobalEntity(),
+    Entity({ tableName: 'webhooks' })
+], Webhook);
+export { Webhook };
+//# sourceMappingURL=webhook.entity.js.map

package/dist/backend/entities/webhook.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/webhook.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;;;GAQG;AAGI,IAAM,OAAO,GAAb,MAAM,OAAO;IAClB,CAAC,aAAa,CAAC,CAOM;IAGrB,EAAE,GAAW,UAAU,EAAE,CAAC;IAG1B,IAAI,CAAU;IAGd,GAAG,CAAU;IAEb;gFAC4E;IAE5E,MAAM,CAAU;IAGhB,UAAU,GAAa,EAAE,CAAC;IAI1B,MAAM,GAAwB,QAAQ,CAAC;IAGvC,oBAAoB,CAAiB;IAErC;;;;;;OAMG;IAGH,cAAc,CAAiB;IAG/B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;IAG7B,SAAS,GAAS,IAAI,IAAI,EAAE,CAAC;CAC9B,CAAA;AAvCC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;mCACH;AAG1B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;qCAC5B;AAGd;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;oCAC9B;AAKb;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;uCAC1B;AAGhB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;2CACD;AAI1B;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACxC,KAAK,EAAE;;uCAC+B;AAGvC;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACN;AAWrC;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,KAAK,EAAE;;+CACuB;AAG/B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;0CAAc;AAG7B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BAChD,IAAI;0CAAc;AAjDlB,OAAO;IAFnB,YAAY,EAAE;IACd,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;GACrB,OAAO,CAkDnB"}

package/dist/backend/index.d.ts

@@ -0,0 +1,85 @@
+import type { FastifyRequest } from 'fastify';
+import type { Queue, Worker } from 'bullmq';
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import { type ModuleContext } from '@endora-commerce/platform/kernel';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import { WebhookService } from './services/webhook-service.js';
+import { type WebhookJobData } from './services/webhook-queue.js';
+import { WebhookDelivery } from './entities/webhook-delivery.entity.js';
+import { Webhook } from './entities/webhook.entity.js';
+/**
+ * `webhooks` — the module whose subscriptions are rows, not registrations
+ * (feature 072, wave 1, T098).
+ *
+ * `api_keys/plugin.ts` built the `WebhookService` and mounted the admin routes;
+ * `composition.ts` created the queue, wired the EventBus bridge and started the
+ * delivery worker. Three files for one module, none of them its own.
+ *
+ * **The gating question this module poses is the interesting part.** A webhook
+ * subscription is a database row an operator creates at runtime, so there is no
+ * registration seam per subscription to wrap — the obvious reading of
+ * Constitution XVII ("gate every subscription") has nothing to attach to. But
+ * the module owns exactly **two** EventBus subscriptions, one per bridged event
+ * type, and every delivery in the platform passes through them. Gating the
+ * bridge stops all of it at one seam, and does so without consulting the
+ * database: while the module is off, the subscription lookup is never reached,
+ * so no row is read and no job is enqueued.
+ *
+ * That also gives the right off-state semantics. Switching `webhooks` off is
+ * not uninstalling: the subscriptions stay in the table, deliveries already
+ * recorded stay in `webhook_deliveries`, and switching it back on resumes
+ * bridging without the operator re-creating anything. Events emitted while it
+ * was off are simply not delivered, which is what "behaves as if never
+ * installed" means for a module whose job is to react to events.
+ *
+ * **The delivery consumer came home in T143a cluster 6.** T098 left it in
+ * `composition.ts` on the grounds that "whether workers run at all is a
+ * deployment decision" — true of the *flag*, and not of the worker. Built by a
+ * root it was the one part of this module no lifecycle seam covered: the
+ * bridge stopped enqueuing when the module went off, while the consumer kept
+ * draining whatever was already on the queue and kept writing
+ * `webhook_deliveries` rows. `ctx.worker` puts it behind `defineModuleWorker`,
+ * which pauses it with the module and resumes it with it. The deployment half
+ * stays a root's, as `webhooksRunWorkers` — the same shape `searchRunWorkers`
+ * already has, and for the same reason: the harness runs no consumer, and
+ * deriving that from `BACKEND_ROLE` here would start one in every test file.
+ */
+/** The events bridged to the delivery queue (contracts/order-webhooks.md §2). */
+export declare const BRIDGED_EVENT_TYPES: readonly ["order.created.v1", "order.status_changed.v1"];
+export interface WebhooksCradle {
+    readonly emFactory: () => EntityManager;
+    readonly auditLogService: AuditPort;
+    readonly requireAdmin: RequireAdminFactory;
+    readonly redis: import('ioredis').Redis;
+    /**
+     * Whether this composition runs the delivery consumer (Principle X).
+     * Root-supplied: production follows `BACKEND_ROLE`, the harness runs none.
+     */
+    readonly webhooksRunWorkers: boolean;
+    readonly webhookService: WebhookService;
+    readonly webhookQueue: Queue<WebhookJobData>;
+    readonly webhookDeliveryWorker: Worker<WebhookJobData>;
+    /**
+     * Who the acting admin is, from the production actor (feature 080, T051).
+     * Root-supplied, like the other request resolvers; both roots answer it from
+     * `request.actor` and throw 401 for a non-admin.
+     */
+    readonly adminContextResolver: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+}
+export declare function registerModule(ctx: ModuleContext): void;
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export declare const entities: (typeof Webhook | typeof WebhookDelivery)[];
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAG5E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,0DAA2D,CAAC;AAE5F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,OAAO,SAAS,EAAE,KAAK,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAmFvD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,6CAGpB,CAAC"}

package/dist/backend/index.js

@@ -0,0 +1,129 @@
+import { lazyPort } from '@endora-commerce/platform/kernel';
+import { registerWebhooksAdminRoutes } from './routes.js';
+import { bridgeEventHandler } from './services/event-bridge.js';
+import { WebhookService } from './services/webhook-service.js';
+import { createWebhookQueue, createWebhookWorker, } from './services/webhook-queue.js';
+import { createDeliveryProcessor } from './services/webhook-delivery-worker.js';
+import { WebhookDelivery } from './entities/webhook-delivery.entity.js';
+import { Webhook } from './entities/webhook.entity.js';
+/**
+ * `webhooks` — the module whose subscriptions are rows, not registrations
+ * (feature 072, wave 1, T098).
+ *
+ * `api_keys/plugin.ts` built the `WebhookService` and mounted the admin routes;
+ * `composition.ts` created the queue, wired the EventBus bridge and started the
+ * delivery worker. Three files for one module, none of them its own.
+ *
+ * **The gating question this module poses is the interesting part.** A webhook
+ * subscription is a database row an operator creates at runtime, so there is no
+ * registration seam per subscription to wrap — the obvious reading of
+ * Constitution XVII ("gate every subscription") has nothing to attach to. But
+ * the module owns exactly **two** EventBus subscriptions, one per bridged event
+ * type, and every delivery in the platform passes through them. Gating the
+ * bridge stops all of it at one seam, and does so without consulting the
+ * database: while the module is off, the subscription lookup is never reached,
+ * so no row is read and no job is enqueued.
+ *
+ * That also gives the right off-state semantics. Switching `webhooks` off is
+ * not uninstalling: the subscriptions stay in the table, deliveries already
+ * recorded stay in `webhook_deliveries`, and switching it back on resumes
+ * bridging without the operator re-creating anything. Events emitted while it
+ * was off are simply not delivered, which is what "behaves as if never
+ * installed" means for a module whose job is to react to events.
+ *
+ * **The delivery consumer came home in T143a cluster 6.** T098 left it in
+ * `composition.ts` on the grounds that "whether workers run at all is a
+ * deployment decision" — true of the *flag*, and not of the worker. Built by a
+ * root it was the one part of this module no lifecycle seam covered: the
+ * bridge stopped enqueuing when the module went off, while the consumer kept
+ * draining whatever was already on the queue and kept writing
+ * `webhook_deliveries` rows. `ctx.worker` puts it behind `defineModuleWorker`,
+ * which pauses it with the module and resumes it with it. The deployment half
+ * stays a root's, as `webhooksRunWorkers` — the same shape `searchRunWorkers`
+ * already has, and for the same reason: the harness runs no consumer, and
+ * deriving that from `BACKEND_ROLE` here would start one in every test file.
+ */
+/** The events bridged to the delivery queue (contracts/order-webhooks.md §2). */
+export const BRIDGED_EVENT_TYPES = ['order.created.v1', 'order.status_changed.v1'];
+export function registerModule(ctx) {
+    ctx.di.providePort('webhookService', ctx
+        .asFunction(({ emFactory, auditLogService }) => new WebhookService(emFactory, auditLogService))
+        .singleton());
+    ctx.di.register({
+        webhookQueue: ctx
+            .asFunction(({ redis }) => createWebhookQueue(redis))
+            .singleton()
+            .disposer((queue) => queue.close().catch(() => undefined)),
+        /**
+         * The delivery consumer: HMAC signing, retries and the
+         * `webhook_deliveries` bookkeeping (T143a).
+         *
+         * A registration rather than a `new` inside the route body, so it carries
+         * a **disposer** exactly as the queue does — a composition that disposes
+         * its container drains the worker before the Redis sockets go, which is
+         * what the graceful shutdown in `composition.ts` used to spell by hand.
+         * Nothing resolves it unless `webhooksRunWorkers` is true, and a
+         * registration nobody resolves is never constructed, so a composition that
+         * runs no consumer pays nothing for this.
+         */
+        webhookDeliveryWorker: ctx
+            .asFunction(({ redis }) => createWebhookWorker(redis, createDeliveryProcessor({
+            // Read per call rather than captured: `webhookService` is this
+            // module's own gated port, and a job draining mid-flight must
+            // still meet the gate.
+            recordDelivery: async (input) => {
+                await ctx.cradle().webhookService.recordDelivery(input);
+            },
+        })))
+            .singleton()
+            .disposer((worker) => worker.close().catch(() => undefined)),
+    });
+    for (const eventType of BRIDGED_EVENT_TYPES) {
+        // One `ctx.subscribe` per bridged type. The kernel's wrapper is what makes
+        // the module's effective state decide whether the handler runs at all, so
+        // the lookup below is never reached while the module is off.
+        ctx.subscribe(eventType, (payload) => {
+            const { webhookQueue, webhookService } = ctx.cradle();
+            return bridgeEventHandler(eventType, {
+                queue: webhookQueue,
+                subscriptionLookup: webhookService,
+            })(payload);
+        });
+    }
+    ctx.routes(async (app) => {
+        const { requireAdmin, webhooksRunWorkers } = ctx.cradle();
+        // `ctx.worker` wraps it in `defineModuleWorker`, so it starts paused when
+        // the module is off and the orchestrator pauses and resumes it as the
+        // operator flips the module. Attached here rather than at registration
+        // because that is where `app.log` exists — the same place
+        // `google_analytics` attaches its delivery consumer.
+        if (webhooksRunWorkers) {
+            ctx.worker(ctx.cradle().webhookDeliveryWorker, { logger: app.log });
+        }
+        await registerWebhooksAdminRoutes(app, {
+            // Lazily, even though the module owns this port: route *registration* runs
+            // inside `buildServer` whatever the module's effective state is, so
+            // destructuring the gate here would stop the next start instead of
+            // stopping the routes (D-40).
+            webhookService: lazyPort(ctx, 'webhookService'),
+            requireAdmin,
+            resolveAdminUserId: (request) => ctx.cradle().adminContextResolver(request).adminUserId,
+        });
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export const entities = [
+    WebhookDelivery,
+    Webhook,
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAsB,MAAM,kCAAkC,CAAC;AAEhF,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,kBAAkB,EAAE,yBAAyB,CAAU,CAAC;AAuB5F,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,gBAAgB,EAChB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,eAAe,EAAkB,EAAE,EAAE,CACjD,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,CAAC,CACjD;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,YAAY,EAAE,GAAG;aACd,UAAU,CAAC,CAAC,EAAE,KAAK,EAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;aACpE,SAAS,EAAE;aACX,QAAQ,CAAC,CAAC,KAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAEnF;;;;;;;;;;;WAWG;QACH,qBAAqB,EAAE,GAAG;aACvB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAkB,EAAE,EAAE,CACxC,mBAAmB,CACjB,KAAK,EACL,uBAAuB,CAAC;YACtB,+DAA+D;YAC/D,8DAA8D;YAC9D,uBAAuB;YACvB,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC9B,MAAM,GAAG,CAAC,MAAM,EAAkB,CAAC,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CACH,CACF;aACA,SAAS,EAAE;aACX,QAAQ,CAAC,CAAC,MAA8B,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;KACvF,CAAC,CAAC;IAEH,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;QAC5C,2EAA2E;QAC3E,0EAA0E;QAC1E,6DAA6D;QAC7D,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,MAAM,EAAkB,CAAC;YACtE,OAAO,kBAAkB,CAAC,SAAS,EAAE;gBACnC,KAAK,EAAE,YAAY;gBACnB,kBAAkB,EAAE,cAAc;aACnC,CAAC,CAAC,OAAO,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAkB,CAAC;QAE1E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,0DAA0D;QAC1D,qDAAqD;QACrD,IAAI,kBAAkB,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAkB,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,2BAA2B,CAAC,GAAG,EAAE;YACrC,2EAA2E;YAC3E,oEAAoE;YACpE,mEAAmE;YACnE,8BAA8B;YAC9B,cAAc,EAAE,QAAQ,CAAiB,GAAG,EAAE,gBAAgB,CAAC;YAC/D,YAAY;YACZ,kBAAkB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,GAAG,CAAC,MAAM,EAAkB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,WAAW;SACzE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,eAAe;IACf,OAAO;CACR,CAAC"}

package/dist/backend/routes.d.ts

@@ -0,0 +1,26 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { WebhookService } from './services/webhook-service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+export interface WebhooksAdminDeps {
+    webhookService: WebhookService;
+    requireAdmin: RequireAdminFactory;
+    /**
+     * The acting admin's id, resolved from the request the guard in front of
+     * these routes has already accepted.
+     *
+     * Injected rather than read here, because the read used to be
+     * `testAdminUserId(request)` — `http/test-actor-carrier`, which
+     * `contracts/host-package.md` §1.4j classifies **A**: the file exists to
+     * narrow this repository's test-harness Fastify augmentation, and an
+     * installed package has no relationship to that harness. It also answered
+     * `undefined` in production for every request, because nothing under `src/`
+     * writes `request.testActor`.
+     *
+     * Both composition roots supply it from `adminContextResolver`, which reads
+     * the production actor and throws 401 for a non-admin. Every call site sits
+     * behind `requireAdmin(...)`, so the actor is an admin by the time it runs.
+     */
+    resolveAdminUserId: (request: FastifyRequest) => string;
+}
+export declare function registerWebhooksAdminRoutes(app: FastifyInstance, deps: WebhooksAdminDeps): Promise<void>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/backend/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/backend/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CACzD;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC,CAmFf"}

package/dist/backend/routes.js

@@ -0,0 +1,84 @@
+import { createWebhookRequestSchema, updateWebhookRequestSchema } from '@endora-commerce/contracts';
+export async function registerWebhooksAdminRoutes(app, deps) {
+    const { webhookService, requireAdmin, resolveAdminUserId } = deps;
+    app.get('/api/v1/admin/webhooks', { preHandler: requireAdmin('integrations:manage') }, async () => {
+        const rows = await webhookService.list();
+        return { data: rows.map(serializeWebhook) };
+    });
+    app.post('/api/v1/admin/webhooks', {
+        preHandler: requireAdmin('integrations:manage'),
+        schema: { body: createWebhookRequestSchema },
+    }, async (request, reply) => {
+        const body = createWebhookRequestSchema.parse(request.body);
+        const w = await webhookService.create({
+            name: body.name,
+            url: body.url,
+            eventTypes: body.eventTypes,
+            // Feature 062 — optional organization binding (additive).
+            organizationId: body.organizationId ?? null,
+            createdByAdminUserId: resolveAdminUserId(request),
+        });
+        reply.status(201);
+        // Reveal the signing secret once, on creation, so the operator can share
+        // it with the receiving system (it is never returned by the list/update
+        // endpoints again).
+        return { data: { ...serializeWebhook(w), secret: w.secret } };
+    });
+    app.patch('/api/v1/admin/webhooks/:id', {
+        preHandler: requireAdmin('integrations:manage'),
+        schema: { body: updateWebhookRequestSchema },
+    }, async (request) => {
+        const body = updateWebhookRequestSchema.parse(request.body);
+        const w = await webhookService.update(request.params.id, body);
+        return { data: serializeWebhook(w) };
+    });
+    app.delete('/api/v1/admin/webhooks/:id', { preHandler: requireAdmin('integrations:manage') }, async (request, reply) => {
+        await webhookService.remove(request.params.id);
+        return reply.status(204).send();
+    });
+    app.get('/api/v1/admin/webhooks/deliveries', { preHandler: requireAdmin('integrations:manage') }, async (request) => {
+        const { webhookId, status, limit } = request.query;
+        const rows = await webhookService.listDeliveries({
+            ...(webhookId ? { webhookId } : {}),
+            ...(status
+                ? { status: status }
+                : {}),
+            ...(limit ? { limit: Number(limit) } : {}),
+        });
+        return { data: rows.map(serializeDelivery) };
+    });
+    app.post('/api/v1/admin/webhooks/deliveries/:id/replay', { preHandler: requireAdmin('integrations:manage') }, async (request, reply) => {
+        const copy = await webhookService.replay(request.params.id);
+        reply.status(202);
+        return { data: serializeDelivery(copy) };
+    });
+}
+function serializeWebhook(w) {
+    return {
+        id: w.id,
+        name: w.name,
+        url: w.url,
+        eventTypes: w.eventTypes,
+        status: w.status,
+        organizationId: w.organizationId ?? null,
+        createdAt: w.createdAt.toISOString(),
+        updatedAt: w.updatedAt.toISOString(),
+    };
+}
+function serializeDelivery(d) {
+    return {
+        id: d.id,
+        webhookId: d.webhookId,
+        eventId: d.eventId,
+        eventType: d.eventType,
+        status: d.status,
+        attemptCount: d.attemptCount,
+        dispatchedAt: d.dispatchedAt?.toISOString() ?? null,
+        completedAt: d.completedAt?.toISOString() ?? null,
+        deadLetteredAt: d.deadLetteredAt?.toISOString() ?? null,
+        lastResponseStatus: d.lastResponseStatus ?? null,
+        lastError: d.lastError ?? null,
+        createdAt: d.createdAt.toISOString(),
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/backend/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/backend/routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AA4BpG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,GAAoB,EACpB,IAAuB;IAEvB,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAElE,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB,EAAE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC,EAAE,EACnD,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;IAC9C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB;QACE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC;QAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;KAC7C,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,0DAA0D;YAC1D,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;YAC3C,oBAAoB,EAAE,kBAAkB,CAAC,OAAO,CAAC;SAClD,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,yEAAyE;QACzE,wEAAwE;QACxE,oBAAoB;QACpB,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAChE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,4BAA4B,EAC5B;QACE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC;QAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;KAC7C,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,4BAA4B,EAC5B,EAAE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC,EAAE,EACnD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,mCAAmC,EACnC,EAAE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC,EAAE,EACnD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,cAAc,CAAC;YAC/C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,MAAM,EAAE,MAA4E,EAAE;gBAC1F,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAC/C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,8CAA8C,EAC9C,EAAE,UAAU,EAAE,YAAY,CAAC,qBAAqB,CAAC,EAAE,EACnD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5D,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3C,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACxC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAkB;IAC3C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,IAAI;QACnD,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QACjD,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,IAAI;QACvD,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,IAAI,IAAI;QAChD,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC"}

package/dist/backend/services/event-bridge.d.ts

@@ -0,0 +1,54 @@
+import type { Queue } from 'bullmq';
+import type { EventBase } from '@endora-commerce/platform/events';
+import type { WebhookJobData } from './webhook-queue.js';
+/**
+ * Bridges the in-process event bus (R-17) to the durable webhook queue (R-13).
+ *
+ * On each emitted domain event:
+ *   1. Look up active Webhook subscriptions that match the event type.
+ *   2. For every subscriber, enqueue one BullMQ job on the webhook.deliver queue.
+ *
+ * The actual lookup of Webhook rows is injected; this keeps the bridge independent
+ * of MikroORM and easy to test.
+ */
+export interface SubscriptionLookup {
+    /**
+     * Feature 062 — org-scoped delivery (contracts/order-webhooks.md §2).
+     * `organizationId` is the value extracted from the event payload (or null
+     * when the payload carries none). Implementations return active
+     * subscriptions matching the event type where the subscription is
+     * platform-wide (`organizationId` NULL, legacy semantics — FR-015) OR bound
+     * to exactly this organization. An event without an organization must never
+     * reach an org-scoped subscription (fail closed — Principle XI).
+     */
+    findActiveByEventType(eventType: string, organizationId: string | null): Promise<Array<{
+        webhookId: string;
+        url: string;
+        secret: string;
+    }>>;
+}
+/**
+ * Delivery-filter predicate shared by the subscription lookup: a subscription
+ * receives the event iff it is platform-wide, or the event carries an
+ * organization and it matches the subscription's binding.
+ */
+export declare function subscriptionReceivesOrganization(subscriptionOrganizationId: string | null, eventOrganizationId: string | null): boolean;
+export interface EventBridgeOptions {
+    queue: Pick<Queue<WebhookJobData>, 'add'>;
+    subscriptionLookup: SubscriptionLookup;
+}
+export interface BridgedEventPayload extends EventBase {
+    [key: string]: unknown;
+}
+/**
+ * The per-event-type half of the bridge, extracted so a converted module can
+ * hand it to `ctx.subscribe` (feature 072, T098).
+ *
+ * That is the whole gating story for this module. A webhook subscription is a
+ * database row created at runtime, so there is no registration seam per
+ * subscription to gate — but there are exactly **two** EventBus subscriptions,
+ * and gating those stops every delivery at once. Gate the bridge, not the
+ * subscriptions.
+ */
+export declare function bridgeEventHandler(eventType: string, deps: EventBridgeOptions): (payload: unknown) => Promise<void>;
+//# sourceMappingURL=event-bridge.d.ts.map

package/dist/backend/services/event-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bridge.d.ts","sourceRoot":"","sources":["../../../src/backend/services/event-bridge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;GASG;AAEH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;OAQG;IACH,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CACvE;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,0BAA0B,EAAE,MAAM,GAAG,IAAI,EACzC,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,OAAO,CAGT;AAQD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED,MAAM,WAAW,mBAAoB,SAAQ,SAAS;IAGpD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,kBAAkB,GACvB,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAkBrC"}

package/dist/backend/services/event-bridge.js

@@ -0,0 +1,43 @@
+import { randomUUID } from 'crypto';
+/**
+ * Delivery-filter predicate shared by the subscription lookup: a subscription
+ * receives the event iff it is platform-wide, or the event carries an
+ * organization and it matches the subscription's binding.
+ */
+export function subscriptionReceivesOrganization(subscriptionOrganizationId, eventOrganizationId) {
+    if (subscriptionOrganizationId === null)
+        return true;
+    return eventOrganizationId !== null && subscriptionOrganizationId === eventOrganizationId;
+}
+/** Extract the tenant key from a bridged event payload; non-string values count as absent. */
+function extractOrganizationId(payload) {
+    const value = payload['organizationId'];
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+/**
+ * The per-event-type half of the bridge, extracted so a converted module can
+ * hand it to `ctx.subscribe` (feature 072, T098).
+ *
+ * That is the whole gating story for this module. A webhook subscription is a
+ * database row created at runtime, so there is no registration seam per
+ * subscription to gate — but there are exactly **two** EventBus subscriptions,
+ * and gating those stops every delivery at once. Gate the bridge, not the
+ * subscriptions.
+ */
+export function bridgeEventHandler(eventType, deps) {
+    return async (payload) => {
+        const subs = await deps.subscriptionLookup.findActiveByEventType(eventType, extractOrganizationId(payload));
+        for (const sub of subs) {
+            const jobData = {
+                webhookId: sub.webhookId,
+                eventId: payload.eventId ?? randomUUID(),
+                eventType,
+                payload,
+                url: sub.url,
+                secret: sub.secret,
+            };
+            await deps.queue.add(`${eventType}.${jobData.eventId}`, jobData);
+        }
+    };
+}
+//# sourceMappingURL=event-bridge.js.map

package/dist/backend/services/event-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bridge.js","sourceRoot":"","sources":["../../../src/backend/services/event-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAgCpC;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,0BAAyC,EACzC,mBAAkC;IAElC,IAAI,0BAA0B,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,mBAAmB,KAAK,IAAI,IAAI,0BAA0B,KAAK,mBAAmB,CAAC;AAC5F,CAAC;AAED,8FAA8F;AAC9F,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,MAAM,KAAK,GAAI,OAAmC,CAAC,gBAAgB,CAAC,CAAC;IACrE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,IAAwB;IAExB,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAC9D,SAAS,EACT,qBAAqB,CAAC,OAAO,CAAC,CAC/B,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAmB;gBAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO,EAAG,OAA+B,CAAC,OAAO,IAAI,UAAU,EAAE;gBACjE,SAAS;gBACT,OAAO;gBACP,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/backend/services/webhook-delivery-worker.d.ts

@@ -0,0 +1,34 @@
+import type { Job } from 'bullmq';
+import type { WebhookJobData } from './webhook-queue.js';
+/**
+ * Worker-side processor: signs the payload with HMAC-SHA-256, POSTs it to the
+ * receiver URL, and throws on non-2xx so BullMQ retries (R-13).
+ */
+export interface DeliveryRecordInput {
+    webhookId: string;
+    eventId: string;
+    eventType: string;
+    payload: unknown;
+    status: 'succeeded' | 'failed' | 'dead_lettered';
+    attemptCount: number;
+    lastResponseStatus?: number;
+    lastError?: string;
+}
+export interface ProcessorDependencies {
+    /** Injectable for tests; defaults to globalThis.fetch at call time. */
+    fetchFn?: typeof fetch;
+    /** Per-attempt timeout in ms. */
+    timeoutMs?: number;
+    /** Logger for failed deliveries (pino.Logger compatible). */
+    onFailure?: (err: unknown, job: Job<WebhookJobData>) => void;
+    /**
+     * Feature 062 — persistence hook for the `webhook_deliveries` audit trail
+     * (typically `WebhookService.recordDelivery`). One row per attempt outcome:
+     * `succeeded` on 2xx, `failed` on a retryable attempt, `dead_lettered` on
+     * the final exhausted attempt. Best-effort: a bookkeeping failure never
+     * changes the delivery outcome.
+     */
+    recordDelivery?: (input: DeliveryRecordInput) => Promise<unknown>;
+}
+export declare function createDeliveryProcessor(deps?: ProcessorDependencies): (job: Job<WebhookJobData>) => Promise<void>;
+//# sourceMappingURL=webhook-delivery-worker.d.ts.map

package/dist/backend/services/webhook-delivery-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-delivery-worker.d.ts","sourceRoot":"","sources":["../../../src/backend/services/webhook-delivery-worker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;GAGG;AAEH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC;IAC7D;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,qBAA0B,IAYxC,KAAK,GAAG,CAAC,cAAc,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC,CAsDvE"}