@endora-commerce/mod-webhooks 0.100.0

package/dist/manifest.js

@@ -0,0 +1,122 @@
+import { defineModuleManifest } from '@endora-commerce/contracts';
+/**
+ * Webhooks module — manifest backfill (Module Lifecycle, feature 018).
+ *
+ * Predates the lifecycle system; this manifest is the static record
+ * required so the module participates in the registry. No install /
+ * uninstall hook today — the module's schema is owned by earlier
+ * platform-wide migrations.
+ */
+export const manifest = defineModuleManifest({
+    id: 'webhooks',
+    name: 'Webhooks',
+    description: 'Outbound webhook subscription registry and dispatcher.',
+    version: '1.0.0',
+    // `auth` owns the `requireAdmin` port the admin routes are gated by; the
+    // edge became real with the conversion (feature 072, T098).
+    // `webhooks.organization_id` scopes a subscription to a tenant — a real
+    // foreign key, surfaced by feature 072 exporting this module's entities.
+    dependencies: ['auth', 'organizations'],
+    settings: {
+        moduleCode: 'webhooks',
+        groups: [{ code: 'webhooks', name: 'Webhooks' }],
+        settings: [
+            {
+                // Feature 073 — the operator's activation control. Platform-wide.
+                code: 'webhooks.enabled',
+                name: 'Webhooks enabled',
+                description: 'Switches outbound webhook delivery and its admin screens on or off. While off no event is bridged and no delivery is attempted; events emitted during that time are not delivered retroactively. Nothing is deleted — subscriptions and delivery history are preserved and resume when you switch it back on.',
+                groupCode: 'webhooks',
+                valueType: 'boolean',
+                defaultValue: true,
+            },
+        ],
+    },
+    // Issue #213 — `integrations:manage` is a **shared** gate: it guards this
+    // module's admin surface and `api_keys`', and the core `PERMISSION_CATALOGUE`
+    // row that carries its label names `api_keys` alone. Declaring it here makes
+    // this module a second *owner*, so the presence filter on `/admin-roles` keeps
+    // it grantable while either surface is on. Without this line, switching
+    // `api_keys` off would take the code off the role editor while every route in
+    // `webhooks/routes.ts` went on enforcing it — a gate nobody can be granted.
+    permissions: [{ code: 'integrations:manage', label: 'Manage API keys + webhooks' }],
+    /**
+     * The module's command-palette entry — feature 091, Phase 4 (the plan's
+     * batch 6), and one of the fifteen Principle XVI entries
+     * `specs/deferred-defects.md` records as owed.
+     *
+     * It arrives with the drain rather than before it, by the mechanism that
+     * register predicts: the batch owes an off-state proof over every surface the
+     * module contributes, and until this declaration existed the `AppShell.tsx`
+     * `PALETTE_ITEMS` row that advertised /webhooks was the admin's own — a
+     * hand-written copy no server-side presence check was ever asked about, so it
+     * went on offering the screen to an operator who had switched the module off.
+     * The Actions group is resolved by `AdminActionsService` against the effective
+     * enabled-set, which is what makes the withdrawal real.
+     *
+     * `requiredPermission` is the code the target route enforces, which
+     * `check:action-route-permissions` compares against the registration on
+     * `GET /api/v1/admin/webhooks` itself. It is `integrations:manage` and not a
+     * `webhooks:`-prefixed code because that is the gate the module actually
+     * has: issue #213 records why both owners declare it.
+     */
+    actions: [
+        {
+            id: 'open-webhooks',
+            labelKey: 'actions.openWebhooks.label',
+            descriptionKey: 'actions.openWebhooks.description',
+            icon: 'Webhook',
+            targetRoute: '/webhooks',
+            requiredPermission: 'integrations:manage',
+            keywords: ['webhook', 'webhooks', 'webhooki', 'events', 'zdarzenia', 'signing secret', 'integration', 'integracja'],
+            weight: 800,
+        },
+    ],
+    activation: { settingCode: 'webhooks.enabled', default: true },
+    /**
+     * This module's first i18n bundle — D-129's remaining sweep, MR 5.
+     *
+     * It exists because a **declaring** module that contributes no bundle file is
+     * `check:error-translations` exit 2 for the whole tree rather than a finding
+     * (`specs/090-module-owned-error-codes/contracts/error-translation-population.md`
+     * §2.1, §2.3; `d129-sweep.md` §3.4). The bundle lives at the **package
+     * root**, not under `dist`: `manifest-locations.ts` resolves a packaged
+     * module's `manifestPath` to its `package.json`, so `dirname` is the package
+     * directory. The file is a **flat** `{"a.b.c": "text"}` map, because a nested
+     * object fails `TranslationBundleEntriesSchema` and the boot reconciler logs
+     * and skips it — silently.
+     */
+    i18n: { bundlesDir: 'i18n' },
+    docs: { dir: 'docs' },
+    /**
+     * `WEBHOOK_DELIVERY_NOT_REPLAYABLE` — D-129's remaining sweep, Tier B
+     * (`specs/090-module-owned-error-codes/d129-sweep.md` §5.2, Appendix A;
+     * MR 5).
+     *
+     * It was declared by `_i18n` until this merge request, not because anybody
+     * judged it the platform's but because the deleted prefix chain had no rule
+     * for it and its last line was `return 'core'`. **D-121 T1 puts it here**:
+     * the noun is a webhook delivery, this module's own `webhook_deliveries` row,
+     * and the refusal is an invariant of that row's status — only `failed` and
+     * `dead_lettered` can be re-queued. This module is also the only one that
+     * raises it, from `services/webhook-service.ts`.
+     *
+     * **It arrives with a sentence.** It carried a placeholder in `_i18n`'s
+     * bundle — `"Webhook Delivery Not Replayable."` /
+     * `"Błąd: webhook delivery not replayable."` — which D-186 §2 deletes rather
+     * than carries, because in this module's own bundle it would read as this
+     * module's answer. §5.4 keeps writing the prose available and is not a
+     * re-opening of that ruling, and this is the case for taking it: the reader
+     * is an operator looking at the delivery row on the Webhooks screen, so the
+     * one thing the raise site's message carries that a fixed sentence cannot —
+     * `status=<status>` — is already on the screen beside the button they
+     * pressed.
+     *
+     * **`tokens` is derived from the raise sites, not from the bundle**
+     * (runbook §5), and there are none: the one raise is a bare
+     * `HttpError(409, code, message)` with no `details` argument, measured by
+     * balanced-paren extraction of the call's own arguments.
+     */
+    errorCodes: [{ code: 'WEBHOOK_DELIVERY_NOT_REPLAYABLE' }],
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,wDAAwD;IAC1D,OAAO,EAAE,OAAO;IAChB,yEAAyE;IACzE,4DAA4D;IAC5D,wEAAwE;IACxE,yEAAyE;IACzE,YAAY,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC;IACvC,QAAQ,EAAE;QACR,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAChD,QAAQ,EAAE;YACR;gBACE,kEAAkE;gBAClE,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,kBAAkB;gBACxB,WAAW,EACT,+SAA+S;gBACjT,SAAS,EAAE,UAAU;gBACrB,SAAS,EAAE,SAAS;gBACpB,YAAY,EAAE,IAAI;aACnB;SACF;KACF;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,wEAAwE;IACxE,8EAA8E;IAC9E,4EAA4E;IAC5E,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACnF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,eAAe;YACnB,QAAQ,EAAE,4BAA4B;YACtC,cAAc,EAAE,kCAAkC;YAClD,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,WAAW;YACxB,kBAAkB,EAAE,qBAAqB;YACzC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,CAAC;YACnH,MAAM,EAAE,GAAG;SACZ;KACF;IACD,UAAU,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE;IAC9D;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;IACrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC;CAC1D,CAAC,CAAC"}

package/dist/migrations/20260425T091359_webhooks_us7_init.d.ts

@@ -0,0 +1,22 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * US7 surface — Phase 9 (T225). Lands webhooks + webhook_deliveries +
+ * external_integrations.
+ *
+ * It also created `api_keys` until
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3. The two modules were
+ * one surface when this was written and split afterwards, which left the
+ * creation stranded here: this module names `api_keys` in no statement of its
+ * own, and an instance that installs `api_keys` without `webhooks` had no
+ * migration that builds the table. Under D-226 the creation belongs to the
+ * module that owns the table, so it is
+ * `Migration20260724T173916ApiKeysDistributorBinding`'s now — its own frozen
+ * body, above its own `alter table`, and **not** a new migration above the
+ * watermark, which would have run after the two frozen migrations that
+ * reference `api_keys` and broken a fresh database (FR-014).
+ */
+export declare class Migration20260425T091359WebhooksUs7Init extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260425T091359_webhooks_us7_init.d.ts.map

package/dist/migrations/20260425T091359_webhooks_us7_init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260425T091359_webhooks_us7_init.d.ts","sourceRoot":"","sources":["../../src/migrations/20260425T091359_webhooks_us7_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,uCAAwC,SAAQ,SAAS;IACrD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAgEnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAKrC"}

package/dist/migrations/20260425T091359_webhooks_us7_init.js

@@ -0,0 +1,86 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * US7 surface — Phase 9 (T225). Lands webhooks + webhook_deliveries +
+ * external_integrations.
+ *
+ * It also created `api_keys` until
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3. The two modules were
+ * one surface when this was written and split afterwards, which left the
+ * creation stranded here: this module names `api_keys` in no statement of its
+ * own, and an instance that installs `api_keys` without `webhooks` had no
+ * migration that builds the table. Under D-226 the creation belongs to the
+ * module that owns the table, so it is
+ * `Migration20260724T173916ApiKeysDistributorBinding`'s now — its own frozen
+ * body, above its own `alter table`, and **not** a new migration above the
+ * watermark, which would have run after the two frozen migrations that
+ * reference `api_keys` and broken a fresh database (FR-014).
+ */
+export class Migration20260425T091359WebhooksUs7Init extends Migration {
+    async up() {
+        this.addSql(`
+      create table "webhooks" (
+        "id" uuid not null,
+        "name" varchar(160) not null,
+        "url" varchar(2048) not null,
+        "secret" varchar(128) not null,
+        "event_types" jsonb not null default '[]'::jsonb,
+        "status" varchar(16) not null default 'active',
+        "created_by_admin_user_id" uuid null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "webhooks_pkey" primary key ("id")
+      );
+    `);
+        this.addSql('create index "webhooks_status_index" on "webhooks" ("status");');
+        this.addSql(`
+      create table "webhook_deliveries" (
+        "id" uuid not null,
+        "webhook_id" uuid not null,
+        "event_id" varchar(64) not null,
+        "event_type" varchar(64) not null,
+        "payload" jsonb not null,
+        "status" varchar(16) not null default 'pending',
+        "attempt_count" int not null default 0,
+        "dispatched_at" timestamptz null,
+        "last_response_status" int null,
+        "last_response_body" varchar(4000) null,
+        "last_error" varchar(4000) null,
+        "completed_at" timestamptz null,
+        "dead_lettered_at" timestamptz null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "webhook_deliveries_pkey" primary key ("id"),
+        constraint "webhook_deliveries_webhook_fk" foreign key ("webhook_id")
+          references "webhooks" ("id") on delete cascade
+      );
+    `);
+        this.addSql('create index "webhook_deliveries_webhook_id_index" on "webhook_deliveries" ("webhook_id");');
+        this.addSql('create index "webhook_deliveries_event_id_index" on "webhook_deliveries" ("event_id");');
+        this.addSql('create index "webhook_deliveries_event_type_index" on "webhook_deliveries" ("event_type");');
+        this.addSql('create index "webhook_deliveries_status_index" on "webhook_deliveries" ("status");');
+        this.addSql(`
+      create table "external_integrations" (
+        "id" uuid not null,
+        "name" varchar(160) not null,
+        "vendor" varchar(64) not null,
+        "kind" varchar(32) not null,
+        "encrypted_config" text not null,
+        "status" varchar(16) not null default 'inactive',
+        "last_tested_at" timestamptz null,
+        "last_error" varchar(4000) null,
+        "created_by_admin_user_id" uuid null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "external_integrations_pkey" primary key ("id"),
+        constraint "external_integrations_vendor_unique" unique ("vendor")
+      );
+    `);
+        this.addSql('create index "external_integrations_vendor_index" on "external_integrations" ("vendor");');
+    }
+    async down() {
+        this.addSql('drop table if exists "external_integrations" cascade;');
+        this.addSql('drop table if exists "webhook_deliveries" cascade;');
+        this.addSql('drop table if exists "webhooks" cascade;');
+    }
+}
+//# sourceMappingURL=20260425T091359_webhooks_us7_init.js.map

package/dist/migrations/20260425T091359_webhooks_us7_init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260425T091359_webhooks_us7_init.js","sourceRoot":"","sources":["../../src/migrations/20260425T091359_webhooks_us7_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,uCAAwC,SAAQ,SAAS;IAC3D,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;KAaX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC;QAE9E,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;KAqBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,4FAA4F,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,wFAAwF,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,4FAA4F,CAAC,CAAC;QAC1G,IAAI,CAAC,MAAM,CAAC,oFAAoF,CAAC,CAAC;QAElG,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;KAgBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,0FAA0F,CAAC,CAAC;IAC1G,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/migrations/20260724T203140_webhooks_org_filter.d.ts

@@ -0,0 +1,17 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 062 — org-scoped webhook delivery (data-model.md §3).
+ *
+ * Adds `webhooks.organization_id uuid NULL`:
+ *  - NULL  = platform-wide subscription (legacy semantics preserved, FR-015);
+ *  - value = the subscription only receives events whose payload
+ *    `organizationId` matches (evaluated in the event-bridge lookup —
+ *    research §R9; Principle XI).
+ *
+ * Existing rows stay NULL and behave exactly as before once delivery turns on.
+ */
+export declare class Migration20260724T203140WebhooksOrgFilter extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260724T203140_webhooks_org_filter.d.ts.map

package/dist/migrations/20260724T203140_webhooks_org_filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260724T203140_webhooks_org_filter.d.ts","sourceRoot":"","sources":["../../src/migrations/20260724T203140_webhooks_org_filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,qBAAa,yCAA0C,SAAQ,SAAS;IACvD,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAWnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAKrC"}

package/dist/migrations/20260724T203140_webhooks_org_filter.js

@@ -0,0 +1,30 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Feature 062 — org-scoped webhook delivery (data-model.md §3).
+ *
+ * Adds `webhooks.organization_id uuid NULL`:
+ *  - NULL  = platform-wide subscription (legacy semantics preserved, FR-015);
+ *  - value = the subscription only receives events whose payload
+ *    `organizationId` matches (evaluated in the event-bridge lookup —
+ *    research §R9; Principle XI).
+ *
+ * Existing rows stay NULL and behave exactly as before once delivery turns on.
+ */
+export class Migration20260724T203140WebhooksOrgFilter extends Migration {
+    async up() {
+        this.addSql(`alter table "webhooks" add column "organization_id" uuid null;`);
+        this.addSql(`
+      alter table "webhooks"
+        add constraint "webhooks_organization_id_foreign"
+          foreign key ("organization_id") references "organizations" ("id")
+          on update cascade on delete cascade;
+    `);
+        this.addSql(`create index "webhooks_organization_id_index" on "webhooks" ("organization_id");`);
+    }
+    async down() {
+        this.addSql(`drop index if exists "webhooks_organization_id_index";`);
+        this.addSql(`alter table "webhooks" drop constraint if exists "webhooks_organization_id_foreign";`);
+        this.addSql(`alter table "webhooks" drop column if exists "organization_id";`);
+    }
+}
+//# sourceMappingURL=20260724T203140_webhooks_org_filter.js.map

package/dist/migrations/20260724T203140_webhooks_org_filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260724T203140_webhooks_org_filter.js","sourceRoot":"","sources":["../../src/migrations/20260724T203140_webhooks_org_filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yCAA0C,SAAQ,SAAS;IAC7D,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,gEAAgE,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC;;;;;KAKX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,kFAAkF,CAAC,CAAC;IAClG,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,sFAAsF,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,iEAAiE,CAAC,CAAC;IACjF,CAAC;CACF"}

package/dist/migrations/20260727T200555_webhooks_drop_external_integrations.d.ts

@@ -0,0 +1,28 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Drops `external_integrations` together with the removal of the
+ * `integrations` module.
+ *
+ * The module was scaffolding that never grew a consumer: no adapter registry
+ * was ever built, nothing decrypted `encrypted_config` outside its own
+ * service, and its role is covered by `credentials` (encrypted vendor
+ * credentials referenced from Settings), `api_keys` (inbound machine access),
+ * `webhooks` (outbound notifications), and the per-vendor integration modules.
+ *
+ * The table lives here rather than in an `integrations` migration directory
+ * because `009_us7_init.ts` — which also creates `webhooks` and
+ * `webhook_deliveries` — is what created it. That migration has already run in
+ * production, and what follows from that is that its class name cannot move,
+ * not that its body cannot change: the storage persists the name and no
+ * checksum, so an edited body is never re-offered.
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3 took the `api_keys`
+ * creation out of it on exactly that reasoning.
+ *
+ * `down()` recreates the table exactly as `009_us7_init.ts` left it, so a
+ * rollback restores the schema. Row data is not recoverable.
+ */
+export declare class Migration20260727T200555WebhooksDropExternalIntegrations extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260727T200555_webhooks_drop_external_integrations.d.ts.map

package/dist/migrations/20260727T200555_webhooks_drop_external_integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260727T200555_webhooks_drop_external_integrations.d.ts","sourceRoot":"","sources":["../../src/migrations/20260727T200555_webhooks_drop_external_integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,wDAAyD,SAAQ,SAAS;IACtE,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAInB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAoBrC"}

package/dist/migrations/20260727T200555_webhooks_drop_external_integrations.js

@@ -0,0 +1,49 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * Drops `external_integrations` together with the removal of the
+ * `integrations` module.
+ *
+ * The module was scaffolding that never grew a consumer: no adapter registry
+ * was ever built, nothing decrypted `encrypted_config` outside its own
+ * service, and its role is covered by `credentials` (encrypted vendor
+ * credentials referenced from Settings), `api_keys` (inbound machine access),
+ * `webhooks` (outbound notifications), and the per-vendor integration modules.
+ *
+ * The table lives here rather than in an `integrations` migration directory
+ * because `009_us7_init.ts` — which also creates `webhooks` and
+ * `webhook_deliveries` — is what created it. That migration has already run in
+ * production, and what follows from that is that its class name cannot move,
+ * not that its body cannot change: the storage persists the name and no
+ * checksum, so an edited body is never re-offered.
+ * `specs/120-migration-closure-bridge-ownership/` Phase 3 took the `api_keys`
+ * creation out of it on exactly that reasoning.
+ *
+ * `down()` recreates the table exactly as `009_us7_init.ts` left it, so a
+ * rollback restores the schema. Row data is not recoverable.
+ */
+export class Migration20260727T200555WebhooksDropExternalIntegrations extends Migration {
+    async up() {
+        this.addSql('drop table if exists "external_integrations" cascade;');
+    }
+    async down() {
+        this.addSql(`
+      create table "external_integrations" (
+        "id" uuid not null,
+        "name" varchar(160) not null,
+        "vendor" varchar(64) not null,
+        "kind" varchar(32) not null,
+        "encrypted_config" text not null,
+        "status" varchar(16) not null default 'inactive',
+        "last_tested_at" timestamptz null,
+        "last_error" varchar(4000) null,
+        "created_by_admin_user_id" uuid null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "external_integrations_pkey" primary key ("id"),
+        constraint "external_integrations_vendor_unique" unique ("vendor")
+      );
+    `);
+        this.addSql('create index "external_integrations_vendor_index" on "external_integrations" ("vendor");');
+    }
+}
+//# sourceMappingURL=20260727T200555_webhooks_drop_external_integrations.js.map

package/dist/migrations/20260727T200555_webhooks_drop_external_integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260727T200555_webhooks_drop_external_integrations.js","sourceRoot":"","sources":["../../src/migrations/20260727T200555_webhooks_drop_external_integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,wDAAyD,SAAQ,SAAS;IAC5E,KAAK,CAAC,EAAE;QACf,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;KAgBX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,0FAA0F,CAAC,CAAC;IAC1G,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260425T091359WebhooksUs7Init } from './20260425T091359_webhooks_us7_init.js';
+import { Migration20260724T203140WebhooksOrgFilter } from './20260724T203140_webhooks_org_filter.js';
+import { Migration20260727T200555WebhooksDropExternalIntegrations } from './20260727T200555_webhooks_drop_external_integrations.js';
+export declare const migrations: (typeof Migration20260425T091359WebhooksUs7Init)[];
+export { Migration20260425T091359WebhooksUs7Init, Migration20260724T203140WebhooksOrgFilter, Migration20260727T200555WebhooksDropExternalIntegrations, };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,wDAAwD,EAAE,MAAM,0DAA0D,CAAC;AAEpI,eAAO,MAAM,UAAU,oDAItB,CAAC;AAEF,OAAO,EACL,uCAAuC,EACvC,yCAAyC,EACzC,wDAAwD,GACzD,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,33 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260425T091359WebhooksUs7Init } from './20260425T091359_webhooks_us7_init.js';
+import { Migration20260724T203140WebhooksOrgFilter } from './20260724T203140_webhooks_org_filter.js';
+import { Migration20260727T200555WebhooksDropExternalIntegrations } from './20260727T200555_webhooks_drop_external_integrations.js';
+export const migrations = [
+    Migration20260425T091359WebhooksUs7Init,
+    Migration20260724T203140WebhooksOrgFilter,
+    Migration20260727T200555WebhooksDropExternalIntegrations,
+];
+export { Migration20260425T091359WebhooksUs7Init, Migration20260724T203140WebhooksOrgFilter, Migration20260727T200555WebhooksDropExternalIntegrations, };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,uCAAuC,EAAE,MAAM,wCAAwC,CAAC;AACjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,wDAAwD,EAAE,MAAM,0DAA0D,CAAC;AAEpI,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,uCAAuC;IACvC,yCAAyC;IACzC,wDAAwD;CACzD,CAAC;AAEF,OAAO,EACL,uCAAuC,EACvC,yCAAyC,EACzC,wDAAwD,GACzD,CAAC"}

package/docs/webhooks.md

@@ -0,0 +1,50 @@
+---
+title: webhooks
+description: Outbound HMAC-signed event subscriptions
+---
+
+# `webhooks`
+
+Outbound HMAC-signed event subscriptions. Domain events on the in-process
+event bus are bridged to a BullMQ queue; the worker signs and POSTs each
+delivery to the subscriber URL.
+
+## Public surface
+
+| Verb + Path | Purpose |
+| --- | --- |
+| `GET /api/v1/admin/webhooks` | List subscriptions |
+| `POST /api/v1/admin/webhooks` | Create — secret returned once |
+| `PATCH /api/v1/admin/webhooks/:id` | Update (status, eventTypes, url) |
+| `DELETE /api/v1/admin/webhooks/:id` | Remove |
+| `GET /api/v1/admin/webhooks/deliveries` | Recent deliveries (filterable by status) |
+| `POST /api/v1/admin/webhooks/deliveries/:id/replay` | Replay a `failed` / `dead_lettered` delivery |
+
+## Delivery contract
+
+Headers: `Content-Type: application/json`,
+`X-Webhook-Event-Id`, `X-Webhook-Event-Type`,
+`X-Webhook-Signature-256`, `X-Webhook-Attempt`. Receivers MUST verify the
+signature with `timingSafeEqual` and dedupe on the event id.
+The *Subscribing to webhooks* section of Endora's Integrations guide carries the
+verification example.
+
+## Retry model
+
+Up to 8 attempts per delivery, exponential backoff starting at 1 s, 10 s
+per-attempt timeout. Final attempt → `dead_lettered`. The replay endpoint
+copies a failed/dead-lettered row into a fresh `pending` delivery.
+
+## Entities
+
+`Webhook` (name, url, eventTypes, secret, status), `WebhookDelivery`
+(per-attempt audit row).
+
+## Extension points
+
+- **Custom signing scheme** — `webhook-delivery-worker.ts#process` is the
+  single place HMAC headers are set; replace with a different signature
+  format or add a JWS variant here.
+- **Subscription scope policy** — `webhook-service.ts#create` accepts any
+  event type today; layer authorization (e.g. only certain integrations
+  may subscribe to `payment.*`) by injecting a policy callback.

package/i18n/en.json

@@ -0,0 +1,6 @@
+{
+  "errors.WEBHOOK_DELIVERY_NOT_REPLAYABLE": "Only a delivery that failed or was dead-lettered can be replayed. This one is still pending or has already succeeded.",
+  "nav.webhooks.label": "Webhooks",
+  "actions.openWebhooks.label": "Webhooks",
+  "actions.openWebhooks.description": "Event subscriptions & deliveries"
+}

package/i18n/pl.json

@@ -0,0 +1,6 @@
+{
+  "errors.WEBHOOK_DELIVERY_NOT_REPLAYABLE": "Ponowić można tylko dostarczenie, które zakończyło się niepowodzeniem albo trafiło do kolejki martwych komunikatów. To wciąż oczekuje albo już się powiodło.",
+  "nav.webhooks.label": "Webhooki",
+  "actions.openWebhooks.label": "Webhooki",
+  "actions.openWebhooks.description": "Subskrypcje zdarzeń i dostarczenia"
+}

package/package.json

@@ -0,0 +1,97 @@
+{
+  "name": "@endora-commerce/mod-webhooks",
+  "version": "0.100.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Outbound webhook subscription registry and dispatcher.",
+  "license": "MIT",
+  "endora": {
+    "type": "module",
+    "id": "webhooks"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/modules/webhooks"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "default": "./dist/backend/index.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations/index.d.ts",
+      "default": "./dist/migrations/index.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "default": "./dist/admin/index.js"
+    },
+    "./tailwind.css": "./tailwind.css",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "i18n",
+    "docs",
+    "tailwind.css"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "peerDependencies": {
+    "@mikro-orm/core": "^6",
+    "@mikro-orm/migrations": "^6",
+    "@mikro-orm/postgresql": "^6",
+    "bullmq": "^5",
+    "fastify": "^5",
+    "ioredis": "^5",
+    "lucide-react": "^1",
+    "react": "^19",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "peerDependenciesMeta": {
+    "@endora-commerce/admin-kit": {
+      "optional": true
+    },
+    "lucide-react": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@fastify/type-provider-zod": "^1.0.0",
+    "@mikro-orm/core": "^6.6.13",
+    "@mikro-orm/migrations": "^6.6.13",
+    "@mikro-orm/postgresql": "^6.6.13",
+    "@types/node": "^22.9.0",
+    "@types/react": "^19.2.14",
+    "bullmq": "^5.76.1",
+    "fastify": "^5.12.5",
+    "ioredis": "^5.10.1",
+    "lucide-react": "^1.11.0",
+    "react": "^19.2.5",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.ui.json",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.ui.json --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}

package/tailwind.css

@@ -0,0 +1,14 @@
+/* @endora-commerce/mod-webhooks — AUTO-GENERATED by `pnpm --filter backend run manifests:generate`.
+ *
+ * The `@source` directives this package asks its host to scan
+ * (`specs/110-instance-repository/contracts/admin-stylesheet-composition.md` R1).
+ * They resolve relative to **this file**, so they hold wherever the package is
+ * installed — a workspace link here, `node_modules` in a client's instance.
+ *
+ * The `dist` line is what a published tarball ships and is what an instance
+ * scans; the `src` line is inert there and is what keeps `pnpm --filter admin
+ * run dev` reading source in this repository. Do not edit: run
+ * `pnpm --filter backend run manifests:generate`.
+ */
+@source "./dist/admin";
+@source "./src/admin";