@estifanos-sh/convex-auth 0.0.2 → 0.0.3

package/dist/component/connection/webhook/delivery.js

@@ -1,10 +1,10 @@
-import { logMessage } from "../../../shared/log.js";
-import { vAuthEventKind, vGroupWebhookDeliveryDoc, vGroupWebhookDeliveryPublicDoc, vPaginated, vWebhookDeliveryStatus } from "../../model.js";
+import { vAuthEventKind, vGroupWebhookDeliveryDoc, vGroupWebhookDeliveryPublicDoc, vPaginated } from "../../model.js";
 import { unsafeFetchUrlReason } from "../../../shared/fetch/guard.js";
 import schema_default from "../../schema.js";
 import { api, components, internal } from "../../_generated/api.js";
 import { internalAction, internalMutation, internalQuery, mutation, query } from "../../_generated/server.js";
 import "../../functions.js";
+import { appendDeliveryEvent } from "./events.js";
 import { v } from "convex/values";
 import { paginationOptsValidator } from "convex/server";
 import { paginator } from "convex-helpers/server/pagination";
@@ -40,44 +40,6 @@ const workpool = new Workpool(components.webhookWorkpool, {
 function isRetriableStatus(status) {
 	return status >= 500 || status === 408 || status === 429;
 }
-async function appendDeliveryEvent(ctx, args) {
-	const attemptPart = typeof args.data?.attemptCount === "number" ? `:${args.data.attemptCount}` : "";
-	const event = {
-		eventId: `${args.kind}:${args.deliveryId}${attemptPart}`,
-		kind: args.kind,
-		category: "webhook",
-		occurredAt: args.occurredAt,
-		actor: {
-			type: "webhook",
-			id: args.endpointId
-		},
-		subject: {
-			type: "webhook_delivery",
-			id: args.deliveryId
-		},
-		targets: [{
-			kind: "connection",
-			id: args.connectionId
-		}],
-		outcome: args.outcome,
-		data: {
-			sourceEventId: args.sourceEventId,
-			sourceEventType: args.sourceEventType,
-			endpointId: args.endpointId,
-			deliveryId: args.deliveryId,
-			...args.data
-		}
-	};
-	try {
-		await ctx.runMutation(api.event.append, {
-			event,
-			targets: event.targets,
-			idempotencyKey: event.eventId
-		});
-	} catch (error) {
-		logMessage("connection.webhook.delivery", "WARN", [`audit event ${args.kind} emit failed (best-effort)`, error]);
-	}
-}
 function publicDelivery(delivery) {
 	return {
 		_id: delivery._id,
@@ -133,12 +95,85 @@ const dueForDispatch = query({
 		return await ctx.db.query("GroupWebhookDelivery").withIndex("status_next_attempt_at", (idx) => idx.eq("status", "pending").lte("nextAttemptAt", now)).take(take);
 	}
 });
+/** Mark a pending delivery as in progress and record its attempt atomically. */
+const begin = internalMutation({
+	args: {
+		id: v.id("GroupWebhookDelivery"),
+		occurredAt: v.number()
+	},
+	returns: v.union(vGroupWebhookDeliveryDoc, v.null()),
+	handler: async (ctx, { id: deliveryId, occurredAt }) => {
+		const delivery = await ctx.db.get("GroupWebhookDelivery", deliveryId);
+		if (delivery === null || delivery.status !== "pending") return null;
+		const attemptCount = delivery.attemptCount + 1;
+		await ctx.db.patch("GroupWebhookDelivery", deliveryId, {
+			status: "processing",
+			attemptCount,
+			lastAttemptAt: occurredAt
+		});
+		await appendDeliveryEvent(ctx, {
+			deliveryId,
+			connectionId: delivery.connectionId,
+			endpointId: delivery.endpointId,
+			sourceEventId: delivery.eventId,
+			sourceEventType: delivery.kind,
+			kind: "webhook.delivery.attempted",
+			outcome: "success",
+			occurredAt,
+			data: { attemptCount }
+		});
+		return {
+			...delivery,
+			status: "processing",
+			attemptCount,
+			lastAttemptAt: occurredAt
+		};
+	}
+});
+/** Settle an in-progress delivery and record its outcome atomically. */
+const settle = internalMutation({
+	args: {
+		id: v.id("GroupWebhookDelivery"),
+		occurredAt: v.number(),
+		outcome: v.union(v.literal("success"), v.literal("failure")),
+		retry: v.boolean(),
+		responseStatus: v.optional(v.number()),
+		error: v.optional(v.string())
+	},
+	returns: v.null(),
+	handler: async (ctx, args) => {
+		const delivery = await ctx.db.get("GroupWebhookDelivery", args.id);
+		if (delivery === null || delivery.status !== "processing") return null;
+		const succeeded = args.outcome === "success";
+		await ctx.db.patch("GroupWebhookDelivery", args.id, {
+			status: succeeded ? "delivered" : args.retry ? "pending" : "failed",
+			nextAttemptAt: args.retry ? args.occurredAt : delivery.nextAttemptAt,
+			lastAttemptAt: args.occurredAt,
+			lastResponseStatus: args.responseStatus,
+			lastError: args.error
+		});
+		await appendDeliveryEvent(ctx, {
+			deliveryId: args.id,
+			connectionId: delivery.connectionId,
+			endpointId: delivery.endpointId,
+			sourceEventId: delivery.eventId,
+			sourceEventType: delivery.kind,
+			kind: succeeded ? "webhook.delivery.succeeded" : "webhook.delivery.failed",
+			outcome: args.outcome,
+			occurredAt: args.occurredAt,
+			data: {
+				attemptCount: delivery.attemptCount,
+				status: args.responseStatus,
+				error: args.error
+			}
+		});
+		return null;
+	}
+});
 /**
 * Queue a delivery for an endpoint. Idempotent on `(eventId, endpointId)` —
-* returns the existing id if already queued. On insert, emits a
-* `webhook.delivery.created` audit event and enqueues the `dispatch` action on
-* the workpool (running at `nextAttemptAt`, with `onDispatchComplete` as the
-* completion hook).
+* returns the existing id if already queued. The row, its audit event, and the
+* durable workpool entry commit together; an audit failure aborts all three.
 */
 const create = mutation({
 	args: {
@@ -192,7 +227,21 @@ const onDispatchComplete = internalMutation({
 	handler: async (ctx, { context, result }) => {
 		if (result.kind === "success") return null;
 		const delivery = await ctx.db.get("GroupWebhookDelivery", context.deliveryId);
-		if (delivery === null || delivery.status === "delivered" || delivery.status === "failed") return null;
+		if (delivery === null || delivery.status !== "processing") return null;
+		await appendDeliveryEvent(ctx, {
+			deliveryId: context.deliveryId,
+			connectionId: delivery.connectionId,
+			endpointId: delivery.endpointId,
+			sourceEventId: delivery.eventId,
+			sourceEventType: delivery.kind,
+			kind: "webhook.delivery.failed",
+			outcome: "failure",
+			occurredAt: Date.now(),
+			data: {
+				attemptCount: delivery.attemptCount,
+				error: result.kind === "failed" ? result.error : "delivery canceled"
+			}
+		});
 		await ctx.db.patch("GroupWebhookDelivery", context.deliveryId, {
 			status: "failed",
 			lastError: result.kind === "failed" ? result.error : "delivery canceled"
@@ -200,25 +249,6 @@ const onDispatchComplete = internalMutation({
 		return null;
 	}
 });
-/** Patch fields on a delivery (attempt bookkeeping). */
-const update = mutation({
-	args: {
-		id: v.id("GroupWebhookDelivery"),
-		patch: v.object({
-			status: v.optional(vWebhookDeliveryStatus),
-			attemptCount: v.optional(v.number()),
-			nextAttemptAt: v.optional(v.number()),
-			lastAttemptAt: v.optional(v.number()),
-			lastResponseStatus: v.optional(v.number()),
-			lastError: v.optional(v.string())
-		})
-	},
-	returns: v.null(),
-	handler: async (ctx, { id: deliveryId, patch }) => {
-		await ctx.db.patch("GroupWebhookDelivery", deliveryId, patch);
-		return null;
-	}
-});
 /**
 * POST a delivery's signed payload to its endpoint and settle the row. Skips
 * (failing the delivery) when the endpoint is missing or disabled. Marks
@@ -231,49 +261,23 @@ const dispatch = internalAction({
 	args: { id: v.id("GroupWebhookDelivery") },
 	returns: v.null(),
 	handler: async (ctx, { id: deliveryId }) => {
-		const delivery = await ctx.runQuery(internal.connection.webhook.delivery.get, { id: deliveryId });
-		if (!delivery) return null;
-		if (delivery.status === "delivered" || delivery.status === "failed") return null;
+		const startedAt = Date.now();
+		const delivery = await ctx.runMutation(internal.connection.webhook.delivery.begin, {
+			id: deliveryId,
+			occurredAt: startedAt
+		});
+		if (delivery === null) return null;
 		const endpoint = await ctx.runQuery(api.connection.webhook.endpoint.get, { id: delivery.endpointId });
 		if (!endpoint || endpoint.status !== "active") {
-			const failedAt = Date.now();
-			await appendDeliveryEvent(ctx, {
-				deliveryId,
-				connectionId: delivery.connectionId,
-				endpointId: delivery.endpointId,
-				sourceEventId: delivery.eventId,
-				sourceEventType: delivery.kind,
-				kind: "webhook.delivery.failed",
-				outcome: "failure",
-				occurredAt: failedAt,
-				data: {
-					attemptCount: delivery.attemptCount + 1,
-					error: "endpoint missing or disabled"
-				}
-			});
-			await ctx.runMutation(api.connection.webhook.delivery.update, {
+			await ctx.runMutation(internal.connection.webhook.delivery.settle, {
 				id: deliveryId,
-				patch: {
-					status: "failed",
-					lastError: "endpoint missing or disabled",
-					lastAttemptAt: failedAt,
-					attemptCount: delivery.attemptCount + 1
-				}
+				occurredAt: startedAt,
+				outcome: "failure",
+				retry: false,
+				error: "endpoint missing or disabled"
 			});
 			return null;
 		}
-		const startedAt = Date.now();
-		await appendDeliveryEvent(ctx, {
-			deliveryId,
-			connectionId: delivery.connectionId,
-			endpointId: delivery.endpointId,
-			sourceEventId: delivery.eventId,
-			sourceEventType: delivery.kind,
-			kind: "webhook.delivery.attempted",
-			outcome: "success",
-			occurredAt: startedAt,
-			data: { attemptCount: delivery.attemptCount + 1 }
-		});
 		const body = JSON.stringify({
 			kind: delivery.kind,
 			payload: delivery.payload
@@ -296,89 +300,42 @@ const dispatch = internalAction({
 				signal: AbortSignal.timeout(15e3)
 			});
 		} catch (err) {
-			const exhausted = delivery.attemptCount + 1 >= MAX_ATTEMPTS;
-			await appendDeliveryEvent(ctx, {
-				deliveryId,
-				connectionId: delivery.connectionId,
-				endpointId: delivery.endpointId,
-				sourceEventId: delivery.eventId,
-				sourceEventType: delivery.kind,
-				kind: "webhook.delivery.failed",
-				outcome: "failure",
-				occurredAt: startedAt,
-				data: {
-					attemptCount: delivery.attemptCount + 1,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
-			await ctx.runMutation(api.connection.webhook.delivery.update, {
+			const error = err instanceof Error ? err.message : String(err);
+			const retry = delivery.attemptCount < MAX_ATTEMPTS;
+			await ctx.runMutation(internal.connection.webhook.delivery.settle, {
 				id: deliveryId,
-				patch: {
-					status: exhausted ? "failed" : "processing",
-					lastError: err instanceof Error ? err.message : String(err),
-					lastAttemptAt: startedAt,
-					attemptCount: delivery.attemptCount + 1
-				}
+				occurredAt: startedAt,
+				outcome: "failure",
+				retry,
+				error
 			});
-			if (!exhausted) throw err;
+			if (retry) throw err;
 			return null;
 		}
 		if (!response.ok) {
-			const terminal = !isRetriableStatus(response.status) || delivery.attemptCount + 1 >= MAX_ATTEMPTS;
-			await appendDeliveryEvent(ctx, {
-				deliveryId,
-				connectionId: delivery.connectionId,
-				endpointId: delivery.endpointId,
-				sourceEventId: delivery.eventId,
-				sourceEventType: delivery.kind,
-				kind: "webhook.delivery.failed",
-				outcome: "failure",
-				occurredAt: startedAt,
-				data: {
-					attemptCount: delivery.attemptCount + 1,
-					status: response.status
-				}
-			});
-			await ctx.runMutation(api.connection.webhook.delivery.update, {
+			const retry = isRetriableStatus(response.status) && delivery.attemptCount < MAX_ATTEMPTS;
+			await ctx.runMutation(internal.connection.webhook.delivery.settle, {
 				id: deliveryId,
-				patch: {
-					status: terminal ? "failed" : "processing",
-					lastResponseStatus: response.status,
-					lastError: `HTTP ${response.status}`,
-					lastAttemptAt: startedAt,
-					attemptCount: delivery.attemptCount + 1
-				}
+				occurredAt: startedAt,
+				outcome: "failure",
+				retry,
+				responseStatus: response.status,
+				error: `HTTP ${response.status}`
 			});
-			if (!terminal) throw new Error(`Webhook delivery failed: HTTP ${response.status}`);
+			if (retry) throw new Error(`Webhook delivery failed: HTTP ${response.status}`);
 			return null;
 		}
-		await appendDeliveryEvent(ctx, {
-			deliveryId,
-			connectionId: delivery.connectionId,
-			endpointId: delivery.endpointId,
-			sourceEventId: delivery.eventId,
-			sourceEventType: delivery.kind,
-			kind: "webhook.delivery.succeeded",
-			outcome: "success",
-			occurredAt: startedAt,
-			data: {
-				attemptCount: delivery.attemptCount + 1,
-				status: response.status
-			}
-		});
-		await ctx.runMutation(api.connection.webhook.delivery.update, {
+		await ctx.runMutation(internal.connection.webhook.delivery.settle, {
 			id: deliveryId,
-			patch: {
-				status: "delivered",
-				lastResponseStatus: response.status,
-				lastAttemptAt: startedAt,
-				attemptCount: delivery.attemptCount + 1
-			}
+			occurredAt: startedAt,
+			outcome: "success",
+			retry: false,
+			responseStatus: response.status
 		});
 		return null;
 	}
 });
 
 //#endregion
-export { create, dispatch, dueForDispatch, get, list, onDispatchComplete, update };
+export { begin, create, dispatch, dueForDispatch, get, list, onDispatchComplete, settle };
 //# sourceMappingURL=delivery.js.map

package/dist/component/connection/webhook/delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery.js","names":["schema"],"sources":["../../../../src/component/connection/webhook/delivery.ts"],"sourcesContent":["/**\n * `component.connection.webhook.delivery.*` — queued webhook delivery attempts\n * (sub-resource of webhook).\n *\n * `list` is overloaded (`{ connectionId }` history or\n * `{ now }` ready-for-dispatch).\n *\n * @module\n */\n\nimport { Workpool, vOnCompleteArgs } from \"@convex-dev/workpool\";\nimport { paginationOptsValidator } from \"convex/server\";\nimport { v, type Infer } from \"convex/values\";\nimport { paginator } from \"convex-helpers/server/pagination\";\n\nimport { api, components, internal } from \"../../_generated/api\";\nimport type { Id } from \"../../_generated/dataModel\";\nimport { internalAction, internalMutation, internalQuery, mutation, query } from \"../../functions\";\nimport { unsafeFetchUrlReason } from \"../../../shared/fetch/guard\";\nimport { logMessage } from \"../../../shared/log\";\nimport {\n  vAuthEventKind,\n  vGroupWebhookDeliveryDoc,\n  vGroupWebhookDeliveryPublicDoc,\n  vPaginated,\n  vWebhookDeliveryStatus,\n} from \"../../model\";\nimport schema from \"../../schema\";\n\nconst MAX_ATTEMPTS = 5;\n\nconst workpool = new Workpool(components.webhookWorkpool, {\n  maxParallelism: 5,\n  defaultRetryBehavior: { maxAttempts: MAX_ATTEMPTS, initialBackoffMs: 1_000, base: 2 },\n  retryActionsByDefault: true,\n});\n\n/**\n * Whether an HTTP response status warrants a retry. Only transient failures\n * retry — `5xx`, `408 Request Timeout`, and `429 Too Many Requests`. Every\n * other non-2xx (the rest of `4xx`, plus unfollowed `3xx`) is a permanent\n * rejection that re-sending the identical payload cannot fix, so it fails\n * immediately instead of burning the full retry budget.\n */\nfunction isRetriableStatus(status: number): boolean {\n  return status >= 500 || status === 408 || status === 429;\n}\n\nasync function appendDeliveryEvent(\n  ctx: any,\n  args: {\n    deliveryId: string;\n    connectionId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: Infer<typeof vAuthEventKind>;\n    kind:\n      | \"webhook.delivery.created\"\n      | \"webhook.delivery.attempted\"\n      | \"webhook.delivery.succeeded\"\n      | \"webhook.delivery.failed\";\n    outcome: \"success\" | \"failure\";\n    occurredAt: number;\n    data?: Record<string, unknown>;\n  },\n) {\n  const attemptPart =\n    typeof args.data?.attemptCount === \"number\" ? `:${args.data.attemptCount}` : \"\";\n  const event = {\n    eventId: `${args.kind}:${args.deliveryId}${attemptPart}`,\n    kind: args.kind,\n    category: \"webhook\" as const,\n    occurredAt: args.occurredAt,\n    actor: { type: \"webhook\" as const, id: args.endpointId },\n    subject: { type: \"webhook_delivery\" as const, id: args.deliveryId },\n    targets: [{ kind: \"connection\" as const, id: args.connectionId }],\n    outcome: args.outcome,\n    data: {\n      sourceEventId: args.sourceEventId,\n      sourceEventType: args.sourceEventType,\n      endpointId: args.endpointId,\n      deliveryId: args.deliveryId,\n      ...args.data,\n    },\n  };\n  try {\n    await ctx.runMutation(api.event.append, {\n      event,\n      targets: event.targets,\n      idempotencyKey: event.eventId,\n    });\n  } catch (error) {\n    logMessage(\"connection.webhook.delivery\", \"WARN\", [\n      `audit event ${args.kind} emit failed (best-effort)`,\n      error,\n    ]);\n  }\n}\n\nfunction publicDelivery(\n  delivery: Infer<typeof vGroupWebhookDeliveryDoc>,\n): Infer<typeof vGroupWebhookDeliveryPublicDoc> {\n  return {\n    _id: delivery._id,\n    _creationTime: delivery._creationTime,\n    connectionId: delivery.connectionId,\n    endpointId: delivery.endpointId,\n    eventId: delivery.eventId,\n    kind: delivery.kind,\n    status: delivery.status,\n    attemptCount: delivery.attemptCount,\n    nextAttemptAt: delivery.nextAttemptAt,\n    lastAttemptAt: delivery.lastAttemptAt,\n    lastResponseStatus: delivery.lastResponseStatus,\n    lastError: delivery.lastError,\n    signedAt: delivery.signedAt,\n  };\n}\n\n/** Read a delivery by id (internal — returns the full, unredacted doc). */\nexport const get = internalQuery({\n  args: { id: v.id(\"GroupWebhookDelivery\") },\n  returns: v.union(vGroupWebhookDeliveryDoc, v.null()),\n  handler: async (ctx, { id: deliveryId }) => {\n    return await ctx.db.get(\"GroupWebhookDelivery\", deliveryId);\n  },\n});\n\n/** List a connection's deliveries, newest first and paginated. Rows are redacted to public fields. */\nexport const list = query({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    paginationOpts: paginationOptsValidator,\n  },\n  returns: vPaginated(vGroupWebhookDeliveryPublicDoc),\n  handler: async (ctx, { connectionId, paginationOpts }) => {\n    const result = await paginator(ctx.db, schema)\n      .query(\"GroupWebhookDelivery\")\n      .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", connectionId))\n      .order(\"desc\")\n      .paginate(paginationOpts);\n    return {\n      ...result,\n      page: result.page.map(publicDelivery),\n    };\n  },\n});\n\n/**\n * List pending deliveries whose `nextAttemptAt` is at or before `now`, ready to\n * be dispatched (`limit` clamped to 1..100, default 50).\n */\nexport const dueForDispatch = query({\n  args: {\n    now: v.number(),\n    limit: v.optional(v.number()),\n  },\n  returns: v.array(vGroupWebhookDeliveryDoc),\n  handler: async (ctx, { now, limit }) => {\n    const take = Math.min(Math.max(limit ?? 50, 1), 100);\n    return await ctx.db\n      .query(\"GroupWebhookDelivery\")\n      .withIndex(\"status_next_attempt_at\", (idx) =>\n        idx.eq(\"status\", \"pending\").lte(\"nextAttemptAt\", now),\n      )\n      .take(take);\n  },\n});\n\n/**\n * Queue a delivery for an endpoint. Idempotent on `(eventId, endpointId)` —\n * returns the existing id if already queued. On insert, emits a\n * `webhook.delivery.created` audit event and enqueues the `dispatch` action on\n * the workpool (running at `nextAttemptAt`, with `onDispatchComplete` as the\n * completion hook).\n */\nexport const create = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    endpointId: v.id(\"GroupWebhookEndpoint\"),\n    eventId: v.string(),\n    kind: vAuthEventKind,\n    payload: v.any(),\n    nextAttemptAt: v.number(),\n    signature: v.string(),\n    signedAt: v.number(),\n  },\n  returns: v.id(\"GroupWebhookDelivery\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"GroupWebhookDelivery\")\n      .withIndex(\"event_id_endpoint_id\", (idx) =>\n        idx.eq(\"eventId\", args.eventId).eq(\"endpointId\", args.endpointId),\n      )\n      .unique();\n    if (existing !== null) return existing._id;\n    const deliveryId = await ctx.db.insert(\"GroupWebhookDelivery\", {\n      ...args,\n      status: \"pending\",\n      attemptCount: 0,\n    });\n    await appendDeliveryEvent(ctx, {\n      deliveryId,\n      connectionId: args.connectionId,\n      endpointId: args.endpointId,\n      sourceEventId: args.eventId,\n      sourceEventType: args.kind,\n      kind: \"webhook.delivery.created\",\n      outcome: \"success\",\n      occurredAt: args.signedAt,\n    });\n    await workpool.enqueueAction(\n      ctx,\n      internal.connection.webhook.delivery.dispatch,\n      { id: deliveryId },\n      {\n        runAt: args.nextAttemptAt,\n        onComplete: internal.connection.webhook.delivery.onDispatchComplete,\n        context: { deliveryId },\n      },\n    );\n    return deliveryId;\n  },\n});\n\n/**\n * Workpool completion hook for a delivery's dispatch chain.\n *\n * Guarantees a terminal row state even when `dispatch` itself never reached its\n * own terminal branch — e.g. a bookkeeping mutation threw on every attempt, so\n * the workpool exhausted its retries while the row was left non-terminal. On any\n * non-success outcome, settle a still-open delivery as `failed`.\n */\nexport const onDispatchComplete = internalMutation({\n  args: vOnCompleteArgs(v.object({ deliveryId: v.id(\"GroupWebhookDelivery\") })),\n  returns: v.null(),\n  handler: async (ctx, { context, result }) => {\n    if (result.kind === \"success\") return null;\n    const delivery = await ctx.db.get(\"GroupWebhookDelivery\", context.deliveryId);\n    if (delivery === null || delivery.status === \"delivered\" || delivery.status === \"failed\") {\n      return null;\n    }\n    await ctx.db.patch(\"GroupWebhookDelivery\", context.deliveryId, {\n      status: \"failed\",\n      lastError: result.kind === \"failed\" ? result.error : \"delivery canceled\",\n    });\n    return null;\n  },\n});\n\n/** Patch fields on a delivery (attempt bookkeeping). */\nexport const update = mutation({\n  args: {\n    id: v.id(\"GroupWebhookDelivery\"),\n    patch: v.object({\n      status: v.optional(vWebhookDeliveryStatus),\n      attemptCount: v.optional(v.number()),\n      nextAttemptAt: v.optional(v.number()),\n      lastAttemptAt: v.optional(v.number()),\n      lastResponseStatus: v.optional(v.number()),\n      lastError: v.optional(v.string()),\n    }),\n  },\n  returns: v.null(),\n  handler: async (ctx, { id: deliveryId, patch }) => {\n    await ctx.db.patch(\"GroupWebhookDelivery\", deliveryId, patch);\n    return null;\n  },\n});\n\n/**\n * POST a delivery's signed payload to its endpoint and settle the row. Skips\n * (failing the delivery) when the endpoint is missing or disabled. Marks\n * `delivered` on a 2xx; on failure, retries via the workpool until the attempt\n * budget is spent — only transient HTTP statuses (see `isRetriableStatus`) and\n * fetch errors are retried, everything else fails immediately. Emits\n * `attempted`/`succeeded`/`failed` audit events along the way.\n */\nexport const dispatch = internalAction({\n  args: { id: v.id(\"GroupWebhookDelivery\") },\n  returns: v.null(),\n  handler: async (ctx, { id: deliveryId }) => {\n    const delivery = (await ctx.runQuery(internal.connection.webhook.delivery.get, {\n      id: deliveryId,\n    })) as {\n      _id: string;\n      connectionId: string;\n      endpointId: string;\n      eventId: string;\n      kind: Infer<typeof vAuthEventKind>;\n      payload: unknown;\n      status: Infer<typeof vWebhookDeliveryStatus>;\n      attemptCount: number;\n      signature: string;\n      signedAt: number;\n    } | null;\n    if (!delivery) return null;\n\n    // At-least-once delivery. The workpool can re-invoke `dispatch` for a\n    // delivery whose previous attempt already settled — a retry scheduled\n    // before a sibling attempt committed its terminal status, a re-enqueue\n    // after a crash, or an `onDispatchComplete` that already failed the row.\n    // Re-read the row and bail before POSTing again once it is terminal, so a\n    // delivered/failed delivery is never re-sent. A crash in the narrow window\n    // between the POST and the status write still re-delivers, so receivers get\n    // at-least-once (not exactly-once) semantics and MUST dedup on the stable\n    // `X-Auth-Delivery-Id` header sent below.\n    if (delivery.status === \"delivered\" || delivery.status === \"failed\") {\n      return null;\n    }\n\n    const endpoint = (await ctx.runQuery(api.connection.webhook.endpoint.get, {\n      id: delivery.endpointId as Id<\"GroupWebhookEndpoint\">,\n    })) as { url: string; status: string } | null;\n    if (!endpoint || endpoint.status !== \"active\") {\n      const failedAt = Date.now();\n      await appendDeliveryEvent(ctx, {\n        deliveryId,\n        connectionId: delivery.connectionId,\n        endpointId: delivery.endpointId,\n        sourceEventId: delivery.eventId,\n        sourceEventType: delivery.kind,\n        kind: \"webhook.delivery.failed\",\n        outcome: \"failure\",\n        occurredAt: failedAt,\n        data: {\n          attemptCount: delivery.attemptCount + 1,\n          error: \"endpoint missing or disabled\",\n        },\n      });\n      await ctx.runMutation(api.connection.webhook.delivery.update, {\n        id: deliveryId,\n        patch: {\n          status: \"failed\",\n          lastError: \"endpoint missing or disabled\",\n          lastAttemptAt: failedAt,\n          attemptCount: delivery.attemptCount + 1,\n        },\n      });\n      return null;\n    }\n\n    const startedAt = Date.now();\n    await appendDeliveryEvent(ctx, {\n      deliveryId,\n      connectionId: delivery.connectionId,\n      endpointId: delivery.endpointId,\n      sourceEventId: delivery.eventId,\n      sourceEventType: delivery.kind,\n      kind: \"webhook.delivery.attempted\",\n      outcome: \"success\",\n      occurredAt: startedAt,\n      data: { attemptCount: delivery.attemptCount + 1 },\n    });\n    const body = JSON.stringify({\n      kind: delivery.kind,\n      payload: delivery.payload,\n    });\n    let response: Response;\n    try {\n      const unsafeUrlReason = unsafeFetchUrlReason(endpoint.url);\n      if (unsafeUrlReason !== null) {\n        throw new Error(`Webhook ${unsafeUrlReason}`);\n      }\n      response = await fetch(endpoint.url, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"X-Auth-Event-Type\": delivery.kind,\n          \"X-Auth-Delivery-Id\": delivery._id,\n          \"X-Auth-Timestamp\": String(delivery.signedAt),\n          \"X-Auth-Signature\": `sha256=${delivery.signature}`,\n        },\n        body,\n        redirect: \"manual\",\n        signal: AbortSignal.timeout(15_000),\n      });\n    } catch (err) {\n      const exhausted = delivery.attemptCount + 1 >= MAX_ATTEMPTS;\n      await appendDeliveryEvent(ctx, {\n        deliveryId,\n        connectionId: delivery.connectionId,\n        endpointId: delivery.endpointId,\n        sourceEventId: delivery.eventId,\n        sourceEventType: delivery.kind,\n        kind: \"webhook.delivery.failed\",\n        outcome: \"failure\",\n        occurredAt: startedAt,\n        data: {\n          attemptCount: delivery.attemptCount + 1,\n          error: err instanceof Error ? err.message : String(err),\n        },\n      });\n      await ctx.runMutation(api.connection.webhook.delivery.update, {\n        id: deliveryId,\n        patch: {\n          status: exhausted ? \"failed\" : \"processing\",\n          lastError: err instanceof Error ? err.message : String(err),\n          lastAttemptAt: startedAt,\n          attemptCount: delivery.attemptCount + 1,\n        },\n      });\n      if (!exhausted) throw err;\n      return null;\n    }\n\n    if (!response.ok) {\n      const terminal =\n        !isRetriableStatus(response.status) || delivery.attemptCount + 1 >= MAX_ATTEMPTS;\n      await appendDeliveryEvent(ctx, {\n        deliveryId,\n        connectionId: delivery.connectionId,\n        endpointId: delivery.endpointId,\n        sourceEventId: delivery.eventId,\n        sourceEventType: delivery.kind,\n        kind: \"webhook.delivery.failed\",\n        outcome: \"failure\",\n        occurredAt: startedAt,\n        data: {\n          attemptCount: delivery.attemptCount + 1,\n          status: response.status,\n        },\n      });\n      await ctx.runMutation(api.connection.webhook.delivery.update, {\n        id: deliveryId,\n        patch: {\n          status: terminal ? \"failed\" : \"processing\",\n          lastResponseStatus: response.status,\n          lastError: `HTTP ${response.status}`,\n          lastAttemptAt: startedAt,\n          attemptCount: delivery.attemptCount + 1,\n        },\n      });\n      if (!terminal) throw new Error(`Webhook delivery failed: HTTP ${response.status}`);\n      return null;\n    }\n\n    await appendDeliveryEvent(ctx, {\n      deliveryId,\n      connectionId: delivery.connectionId,\n      endpointId: delivery.endpointId,\n      sourceEventId: delivery.eventId,\n      sourceEventType: delivery.kind,\n      kind: \"webhook.delivery.succeeded\",\n      outcome: \"success\",\n      occurredAt: startedAt,\n      data: {\n        attemptCount: delivery.attemptCount + 1,\n        status: response.status,\n      },\n    });\n    await ctx.runMutation(api.connection.webhook.delivery.update, {\n      id: deliveryId,\n      patch: {\n        status: \"delivered\",\n        lastResponseStatus: response.status,\n        lastAttemptAt: startedAt,\n        attemptCount: delivery.attemptCount + 1,\n      },\n    });\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAM,eAAe;AAErB,MAAM,WAAW,IAAI,SAAS,WAAW,iBAAiB;CACxD,gBAAgB;CAChB,sBAAsB;EAAE,aAAa;EAAc,kBAAkB;EAAO,MAAM;EAAG;CACrF,uBAAuB;CACxB,CAAC;;;;;;;;AASF,SAAS,kBAAkB,QAAyB;AAClD,QAAO,UAAU,OAAO,WAAW,OAAO,WAAW;;AAGvD,eAAe,oBACb,KACA,MAeA;CACA,MAAM,cACJ,OAAO,KAAK,MAAM,iBAAiB,WAAW,IAAI,KAAK,KAAK,iBAAiB;CAC/E,MAAM,QAAQ;EACZ,SAAS,GAAG,KAAK,KAAK,GAAG,KAAK,aAAa;EAC3C,MAAM,KAAK;EACX,UAAU;EACV,YAAY,KAAK;EACjB,OAAO;GAAE,MAAM;GAAoB,IAAI,KAAK;GAAY;EACxD,SAAS;GAAE,MAAM;GAA6B,IAAI,KAAK;GAAY;EACnE,SAAS,CAAC;GAAE,MAAM;GAAuB,IAAI,KAAK;GAAc,CAAC;EACjE,SAAS,KAAK;EACd,MAAM;GACJ,eAAe,KAAK;GACpB,iBAAiB,KAAK;GACtB,YAAY,KAAK;GACjB,YAAY,KAAK;GACjB,GAAG,KAAK;GACT;EACF;AACD,KAAI;AACF,QAAM,IAAI,YAAY,IAAI,MAAM,QAAQ;GACtC;GACA,SAAS,MAAM;GACf,gBAAgB,MAAM;GACvB,CAAC;UACK,OAAO;AACd,aAAW,+BAA+B,QAAQ,CAChD,eAAe,KAAK,KAAK,6BACzB,MACD,CAAC;;;AAIN,SAAS,eACP,UAC8C;AAC9C,QAAO;EACL,KAAK,SAAS;EACd,eAAe,SAAS;EACxB,cAAc,SAAS;EACvB,YAAY,SAAS;EACrB,SAAS,SAAS;EAClB,MAAM,SAAS;EACf,QAAQ,SAAS;EACjB,cAAc,SAAS;EACvB,eAAe,SAAS;EACxB,eAAe,SAAS;EACxB,oBAAoB,SAAS;EAC7B,WAAW,SAAS;EACpB,UAAU,SAAS;EACpB;;;AAIH,MAAa,MAAM,cAAc;CAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,EAAE;CAC1C,SAAS,EAAE,MAAM,0BAA0B,EAAE,MAAM,CAAC;CACpD,SAAS,OAAO,KAAK,EAAE,IAAI,iBAAiB;AAC1C,SAAO,MAAM,IAAI,GAAG,IAAI,wBAAwB,WAAW;;CAE9D,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,gBAAgB;EACjB;CACD,SAAS,WAAW,+BAA+B;CACnD,SAAS,OAAO,KAAK,EAAE,cAAc,qBAAqB;EACxD,MAAM,SAAS,MAAM,UAAU,IAAI,IAAIA,eAAO,CAC3C,MAAM,uBAAuB,CAC7B,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CAC/E,MAAM,OAAO,CACb,SAAS,eAAe;AAC3B,SAAO;GACL,GAAG;GACH,MAAM,OAAO,KAAK,IAAI,eAAe;GACtC;;CAEJ,CAAC;;;;;AAMF,MAAa,iBAAiB,MAAM;CAClC,MAAM;EACJ,KAAK,EAAE,QAAQ;EACf,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B;CACD,SAAS,EAAE,MAAM,yBAAyB;CAC1C,SAAS,OAAO,KAAK,EAAE,KAAK,YAAY;EACtC,MAAM,OAAO,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,EAAE,EAAE,IAAI;AACpD,SAAO,MAAM,IAAI,GACd,MAAM,uBAAuB,CAC7B,UAAU,2BAA2B,QACpC,IAAI,GAAG,UAAU,UAAU,CAAC,IAAI,iBAAiB,IAAI,CACtD,CACA,KAAK,KAAK;;CAEhB,CAAC;;;;;;;;AASF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,YAAY,EAAE,GAAG,uBAAuB;EACxC,SAAS,EAAE,QAAQ;EACnB,MAAM;EACN,SAAS,EAAE,KAAK;EAChB,eAAe,EAAE,QAAQ;EACzB,WAAW,EAAE,QAAQ;EACrB,UAAU,EAAE,QAAQ;EACrB;CACD,SAAS,EAAE,GAAG,uBAAuB;CACrC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,uBAAuB,CAC7B,UAAU,yBAAyB,QAClC,IAAI,GAAG,WAAW,KAAK,QAAQ,CAAC,GAAG,cAAc,KAAK,WAAW,CAClE,CACA,QAAQ;AACX,MAAI,aAAa,KAAM,QAAO,SAAS;EACvC,MAAM,aAAa,MAAM,IAAI,GAAG,OAAO,wBAAwB;GAC7D,GAAG;GACH,QAAQ;GACR,cAAc;GACf,CAAC;AACF,QAAM,oBAAoB,KAAK;GAC7B;GACA,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,eAAe,KAAK;GACpB,iBAAiB,KAAK;GACtB,MAAM;GACN,SAAS;GACT,YAAY,KAAK;GAClB,CAAC;AACF,QAAM,SAAS,cACb,KACA,SAAS,WAAW,QAAQ,SAAS,UACrC,EAAE,IAAI,YAAY,EAClB;GACE,OAAO,KAAK;GACZ,YAAY,SAAS,WAAW,QAAQ,SAAS;GACjD,SAAS,EAAE,YAAY;GACxB,CACF;AACD,SAAO;;CAEV,CAAC;;;;;;;;;AAUF,MAAa,qBAAqB,iBAAiB;CACjD,MAAM,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAC;CAC7E,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,SAAS,aAAa;AAC3C,MAAI,OAAO,SAAS,UAAW,QAAO;EACtC,MAAM,WAAW,MAAM,IAAI,GAAG,IAAI,wBAAwB,QAAQ,WAAW;AAC7E,MAAI,aAAa,QAAQ,SAAS,WAAW,eAAe,SAAS,WAAW,SAC9E,QAAO;AAET,QAAM,IAAI,GAAG,MAAM,wBAAwB,QAAQ,YAAY;GAC7D,QAAQ;GACR,WAAW,OAAO,SAAS,WAAW,OAAO,QAAQ;GACtD,CAAC;AACF,SAAO;;CAEV,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,IAAI,EAAE,GAAG,uBAAuB;EAChC,OAAO,EAAE,OAAO;GACd,QAAQ,EAAE,SAAS,uBAAuB;GAC1C,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC;GACpC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;GACrC,oBAAoB,EAAE,SAAS,EAAE,QAAQ,CAAC;GAC1C,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;GAClC,CAAC;EACH;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,YAAY,YAAY;AACjD,QAAM,IAAI,GAAG,MAAM,wBAAwB,YAAY,MAAM;AAC7D,SAAO;;CAEV,CAAC;;;;;;;;;AAUF,MAAa,WAAW,eAAe;CACrC,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,EAAE;CAC1C,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,iBAAiB;EAC1C,MAAM,WAAY,MAAM,IAAI,SAAS,SAAS,WAAW,QAAQ,SAAS,KAAK,EAC7E,IAAI,YACL,CAAC;AAYF,MAAI,CAAC,SAAU,QAAO;AAWtB,MAAI,SAAS,WAAW,eAAe,SAAS,WAAW,SACzD,QAAO;EAGT,MAAM,WAAY,MAAM,IAAI,SAAS,IAAI,WAAW,QAAQ,SAAS,KAAK,EACxE,IAAI,SAAS,YACd,CAAC;AACF,MAAI,CAAC,YAAY,SAAS,WAAW,UAAU;GAC7C,MAAM,WAAW,KAAK,KAAK;AAC3B,SAAM,oBAAoB,KAAK;IAC7B;IACA,cAAc,SAAS;IACvB,YAAY,SAAS;IACrB,eAAe,SAAS;IACxB,iBAAiB,SAAS;IAC1B,MAAM;IACN,SAAS;IACT,YAAY;IACZ,MAAM;KACJ,cAAc,SAAS,eAAe;KACtC,OAAO;KACR;IACF,CAAC;AACF,SAAM,IAAI,YAAY,IAAI,WAAW,QAAQ,SAAS,QAAQ;IAC5D,IAAI;IACJ,OAAO;KACL,QAAQ;KACR,WAAW;KACX,eAAe;KACf,cAAc,SAAS,eAAe;KACvC;IACF,CAAC;AACF,UAAO;;EAGT,MAAM,YAAY,KAAK,KAAK;AAC5B,QAAM,oBAAoB,KAAK;GAC7B;GACA,cAAc,SAAS;GACvB,YAAY,SAAS;GACrB,eAAe,SAAS;GACxB,iBAAiB,SAAS;GAC1B,MAAM;GACN,SAAS;GACT,YAAY;GACZ,MAAM,EAAE,cAAc,SAAS,eAAe,GAAG;GAClD,CAAC;EACF,MAAM,OAAO,KAAK,UAAU;GAC1B,MAAM,SAAS;GACf,SAAS,SAAS;GACnB,CAAC;EACF,IAAI;AACJ,MAAI;GACF,MAAM,kBAAkB,qBAAqB,SAAS,IAAI;AAC1D,OAAI,oBAAoB,KACtB,OAAM,IAAI,MAAM,WAAW,kBAAkB;AAE/C,cAAW,MAAM,MAAM,SAAS,KAAK;IACnC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,qBAAqB,SAAS;KAC9B,sBAAsB,SAAS;KAC/B,oBAAoB,OAAO,SAAS,SAAS;KAC7C,oBAAoB,UAAU,SAAS;KACxC;IACD;IACA,UAAU;IACV,QAAQ,YAAY,QAAQ,KAAO;IACpC,CAAC;WACK,KAAK;GACZ,MAAM,YAAY,SAAS,eAAe,KAAK;AAC/C,SAAM,oBAAoB,KAAK;IAC7B;IACA,cAAc,SAAS;IACvB,YAAY,SAAS;IACrB,eAAe,SAAS;IACxB,iBAAiB,SAAS;IAC1B,MAAM;IACN,SAAS;IACT,YAAY;IACZ,MAAM;KACJ,cAAc,SAAS,eAAe;KACtC,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KACxD;IACF,CAAC;AACF,SAAM,IAAI,YAAY,IAAI,WAAW,QAAQ,SAAS,QAAQ;IAC5D,IAAI;IACJ,OAAO;KACL,QAAQ,YAAY,WAAW;KAC/B,WAAW,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KAC3D,eAAe;KACf,cAAc,SAAS,eAAe;KACvC;IACF,CAAC;AACF,OAAI,CAAC,UAAW,OAAM;AACtB,UAAO;;AAGT,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,WACJ,CAAC,kBAAkB,SAAS,OAAO,IAAI,SAAS,eAAe,KAAK;AACtE,SAAM,oBAAoB,KAAK;IAC7B;IACA,cAAc,SAAS;IACvB,YAAY,SAAS;IACrB,eAAe,SAAS;IACxB,iBAAiB,SAAS;IAC1B,MAAM;IACN,SAAS;IACT,YAAY;IACZ,MAAM;KACJ,cAAc,SAAS,eAAe;KACtC,QAAQ,SAAS;KAClB;IACF,CAAC;AACF,SAAM,IAAI,YAAY,IAAI,WAAW,QAAQ,SAAS,QAAQ;IAC5D,IAAI;IACJ,OAAO;KACL,QAAQ,WAAW,WAAW;KAC9B,oBAAoB,SAAS;KAC7B,WAAW,QAAQ,SAAS;KAC5B,eAAe;KACf,cAAc,SAAS,eAAe;KACvC;IACF,CAAC;AACF,OAAI,CAAC,SAAU,OAAM,IAAI,MAAM,iCAAiC,SAAS,SAAS;AAClF,UAAO;;AAGT,QAAM,oBAAoB,KAAK;GAC7B;GACA,cAAc,SAAS;GACvB,YAAY,SAAS;GACrB,eAAe,SAAS;GACxB,iBAAiB,SAAS;GAC1B,MAAM;GACN,SAAS;GACT,YAAY;GACZ,MAAM;IACJ,cAAc,SAAS,eAAe;IACtC,QAAQ,SAAS;IAClB;GACF,CAAC;AACF,QAAM,IAAI,YAAY,IAAI,WAAW,QAAQ,SAAS,QAAQ;GAC5D,IAAI;GACJ,OAAO;IACL,QAAQ;IACR,oBAAoB,SAAS;IAC7B,eAAe;IACf,cAAc,SAAS,eAAe;IACvC;GACF,CAAC;AACF,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"delivery.js","names":["schema"],"sources":["../../../../src/component/connection/webhook/delivery.ts"],"sourcesContent":["/**\n * `component.connection.webhook.delivery.*` — queued webhook delivery attempts\n * (sub-resource of webhook).\n *\n * `list` is overloaded (`{ connectionId }` history or\n * `{ now }` ready-for-dispatch).\n *\n * @module\n */\n\nimport { Workpool, vOnCompleteArgs } from \"@convex-dev/workpool\";\nimport { paginationOptsValidator } from \"convex/server\";\nimport { v, type Infer } from \"convex/values\";\nimport { paginator } from \"convex-helpers/server/pagination\";\n\nimport { api, components, internal } from \"../../_generated/api\";\nimport { internalAction, internalMutation, internalQuery, mutation, query } from \"../../functions\";\nimport { unsafeFetchUrlReason } from \"../../../shared/fetch/guard\";\nimport {\n  vAuthEventKind,\n  vGroupWebhookDeliveryDoc,\n  vGroupWebhookDeliveryPublicDoc,\n  vPaginated,\n} from \"../../model\";\nimport schema from \"../../schema\";\nimport { appendDeliveryEvent } from \"./events\";\n\nconst MAX_ATTEMPTS = 5;\n\nconst workpool = new Workpool(components.webhookWorkpool, {\n  maxParallelism: 5,\n  defaultRetryBehavior: { maxAttempts: MAX_ATTEMPTS, initialBackoffMs: 1_000, base: 2 },\n  retryActionsByDefault: true,\n});\n\n/**\n * Whether an HTTP response status warrants a retry. Only transient failures\n * retry — `5xx`, `408 Request Timeout`, and `429 Too Many Requests`. Every\n * other non-2xx (the rest of `4xx`, plus unfollowed `3xx`) is a permanent\n * rejection that re-sending the identical payload cannot fix, so it fails\n * immediately instead of burning the full retry budget.\n */\nfunction isRetriableStatus(status: number): boolean {\n  return status >= 500 || status === 408 || status === 429;\n}\n\nfunction publicDelivery(\n  delivery: Infer<typeof vGroupWebhookDeliveryDoc>,\n): Infer<typeof vGroupWebhookDeliveryPublicDoc> {\n  return {\n    _id: delivery._id,\n    _creationTime: delivery._creationTime,\n    connectionId: delivery.connectionId,\n    endpointId: delivery.endpointId,\n    eventId: delivery.eventId,\n    kind: delivery.kind,\n    status: delivery.status,\n    attemptCount: delivery.attemptCount,\n    nextAttemptAt: delivery.nextAttemptAt,\n    lastAttemptAt: delivery.lastAttemptAt,\n    lastResponseStatus: delivery.lastResponseStatus,\n    lastError: delivery.lastError,\n    signedAt: delivery.signedAt,\n  };\n}\n\n/** Read a delivery by id (internal — returns the full, unredacted doc). */\nexport const get = internalQuery({\n  args: { id: v.id(\"GroupWebhookDelivery\") },\n  returns: v.union(vGroupWebhookDeliveryDoc, v.null()),\n  handler: async (ctx, { id: deliveryId }) => {\n    return await ctx.db.get(\"GroupWebhookDelivery\", deliveryId);\n  },\n});\n\n/** List a connection's deliveries, newest first and paginated. Rows are redacted to public fields. */\nexport const list = query({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    paginationOpts: paginationOptsValidator,\n  },\n  returns: vPaginated(vGroupWebhookDeliveryPublicDoc),\n  handler: async (ctx, { connectionId, paginationOpts }) => {\n    const result = await paginator(ctx.db, schema)\n      .query(\"GroupWebhookDelivery\")\n      .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", connectionId))\n      .order(\"desc\")\n      .paginate(paginationOpts);\n    return {\n      ...result,\n      page: result.page.map(publicDelivery),\n    };\n  },\n});\n\n/**\n * List pending deliveries whose `nextAttemptAt` is at or before `now`, ready to\n * be dispatched (`limit` clamped to 1..100, default 50).\n */\nexport const dueForDispatch = query({\n  args: {\n    now: v.number(),\n    limit: v.optional(v.number()),\n  },\n  returns: v.array(vGroupWebhookDeliveryDoc),\n  handler: async (ctx, { now, limit }) => {\n    const take = Math.min(Math.max(limit ?? 50, 1), 100);\n    return await ctx.db\n      .query(\"GroupWebhookDelivery\")\n      .withIndex(\"status_next_attempt_at\", (idx) =>\n        idx.eq(\"status\", \"pending\").lte(\"nextAttemptAt\", now),\n      )\n      .take(take);\n  },\n});\n\n/** Mark a pending delivery as in progress and record its attempt atomically. */\nexport const begin = internalMutation({\n  args: { id: v.id(\"GroupWebhookDelivery\"), occurredAt: v.number() },\n  returns: v.union(vGroupWebhookDeliveryDoc, v.null()),\n  handler: async (ctx, { id: deliveryId, occurredAt }) => {\n    const delivery = await ctx.db.get(\"GroupWebhookDelivery\", deliveryId);\n    if (delivery === null || delivery.status !== \"pending\") return null;\n\n    const attemptCount = delivery.attemptCount + 1;\n    await ctx.db.patch(\"GroupWebhookDelivery\", deliveryId, {\n      status: \"processing\",\n      attemptCount,\n      lastAttemptAt: occurredAt,\n    });\n    await appendDeliveryEvent(ctx, {\n      deliveryId,\n      connectionId: delivery.connectionId,\n      endpointId: delivery.endpointId,\n      sourceEventId: delivery.eventId,\n      sourceEventType: delivery.kind,\n      kind: \"webhook.delivery.attempted\",\n      outcome: \"success\",\n      occurredAt,\n      data: { attemptCount },\n    });\n    return {\n      ...delivery,\n      status: \"processing\" as const,\n      attemptCount,\n      lastAttemptAt: occurredAt,\n    };\n  },\n});\n\n/** Settle an in-progress delivery and record its outcome atomically. */\nexport const settle = internalMutation({\n  args: {\n    id: v.id(\"GroupWebhookDelivery\"),\n    occurredAt: v.number(),\n    outcome: v.union(v.literal(\"success\"), v.literal(\"failure\")),\n    retry: v.boolean(),\n    responseStatus: v.optional(v.number()),\n    error: v.optional(v.string()),\n  },\n  returns: v.null(),\n  handler: async (ctx, args) => {\n    const delivery = await ctx.db.get(\"GroupWebhookDelivery\", args.id);\n    if (delivery === null || delivery.status !== \"processing\") return null;\n\n    const succeeded = args.outcome === \"success\";\n    await ctx.db.patch(\"GroupWebhookDelivery\", args.id, {\n      status: succeeded ? \"delivered\" : args.retry ? \"pending\" : \"failed\",\n      nextAttemptAt: args.retry ? args.occurredAt : delivery.nextAttemptAt,\n      lastAttemptAt: args.occurredAt,\n      lastResponseStatus: args.responseStatus,\n      lastError: args.error,\n    });\n    await appendDeliveryEvent(ctx, {\n      deliveryId: args.id,\n      connectionId: delivery.connectionId,\n      endpointId: delivery.endpointId,\n      sourceEventId: delivery.eventId,\n      sourceEventType: delivery.kind,\n      kind: succeeded ? \"webhook.delivery.succeeded\" : \"webhook.delivery.failed\",\n      outcome: args.outcome,\n      occurredAt: args.occurredAt,\n      data: {\n        attemptCount: delivery.attemptCount,\n        status: args.responseStatus,\n        error: args.error,\n      },\n    });\n    return null;\n  },\n});\n\n/**\n * Queue a delivery for an endpoint. Idempotent on `(eventId, endpointId)` —\n * returns the existing id if already queued. The row, its audit event, and the\n * durable workpool entry commit together; an audit failure aborts all three.\n */\nexport const create = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    endpointId: v.id(\"GroupWebhookEndpoint\"),\n    eventId: v.string(),\n    kind: vAuthEventKind,\n    payload: v.any(),\n    nextAttemptAt: v.number(),\n    signature: v.string(),\n    signedAt: v.number(),\n  },\n  returns: v.id(\"GroupWebhookDelivery\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"GroupWebhookDelivery\")\n      .withIndex(\"event_id_endpoint_id\", (idx) =>\n        idx.eq(\"eventId\", args.eventId).eq(\"endpointId\", args.endpointId),\n      )\n      .unique();\n    if (existing !== null) return existing._id;\n    const deliveryId = await ctx.db.insert(\"GroupWebhookDelivery\", {\n      ...args,\n      status: \"pending\",\n      attemptCount: 0,\n    });\n    await appendDeliveryEvent(ctx, {\n      deliveryId,\n      connectionId: args.connectionId,\n      endpointId: args.endpointId,\n      sourceEventId: args.eventId,\n      sourceEventType: args.kind,\n      kind: \"webhook.delivery.created\",\n      outcome: \"success\",\n      occurredAt: args.signedAt,\n    });\n    await workpool.enqueueAction(\n      ctx,\n      internal.connection.webhook.delivery.dispatch,\n      { id: deliveryId },\n      {\n        runAt: args.nextAttemptAt,\n        onComplete: internal.connection.webhook.delivery.onDispatchComplete,\n        context: { deliveryId },\n      },\n    );\n    return deliveryId;\n  },\n});\n\n/**\n * Workpool completion hook for a delivery's dispatch chain.\n *\n * Guarantees a terminal row state even when `dispatch` itself never reached its\n * own terminal branch — e.g. a bookkeeping mutation threw on every attempt, so\n * the workpool exhausted its retries while the row was left non-terminal. On any\n * non-success outcome, settle a still-open delivery as `failed`.\n */\nexport const onDispatchComplete = internalMutation({\n  args: vOnCompleteArgs(v.object({ deliveryId: v.id(\"GroupWebhookDelivery\") })),\n  returns: v.null(),\n  handler: async (ctx, { context, result }) => {\n    if (result.kind === \"success\") return null;\n    const delivery = await ctx.db.get(\"GroupWebhookDelivery\", context.deliveryId);\n    if (delivery === null || delivery.status !== \"processing\") {\n      return null;\n    }\n    await appendDeliveryEvent(ctx, {\n      deliveryId: context.deliveryId,\n      connectionId: delivery.connectionId,\n      endpointId: delivery.endpointId,\n      sourceEventId: delivery.eventId,\n      sourceEventType: delivery.kind,\n      kind: \"webhook.delivery.failed\",\n      outcome: \"failure\",\n      occurredAt: Date.now(),\n      data: {\n        attemptCount: delivery.attemptCount,\n        error: result.kind === \"failed\" ? result.error : \"delivery canceled\",\n      },\n    });\n    await ctx.db.patch(\"GroupWebhookDelivery\", context.deliveryId, {\n      status: \"failed\",\n      lastError: result.kind === \"failed\" ? result.error : \"delivery canceled\",\n    });\n    return null;\n  },\n});\n\n/**\n * POST a delivery's signed payload to its endpoint and settle the row. Skips\n * (failing the delivery) when the endpoint is missing or disabled. Marks\n * `delivered` on a 2xx; on failure, retries via the workpool until the attempt\n * budget is spent — only transient HTTP statuses (see `isRetriableStatus`) and\n * fetch errors are retried, everything else fails immediately. Emits\n * `attempted`/`succeeded`/`failed` audit events along the way.\n */\nexport const dispatch = internalAction({\n  args: { id: v.id(\"GroupWebhookDelivery\") },\n  returns: v.null(),\n  handler: async (ctx, { id: deliveryId }) => {\n    const startedAt = Date.now();\n    const delivery = await ctx.runMutation(internal.connection.webhook.delivery.begin, {\n      id: deliveryId,\n      occurredAt: startedAt,\n    });\n    if (delivery === null) return null;\n\n    const endpoint = (await ctx.runQuery(api.connection.webhook.endpoint.get, {\n      id: delivery.endpointId,\n    })) as { url: string; status: string } | null;\n    if (!endpoint || endpoint.status !== \"active\") {\n      await ctx.runMutation(internal.connection.webhook.delivery.settle, {\n        id: deliveryId,\n        occurredAt: startedAt,\n        outcome: \"failure\",\n        retry: false,\n        error: \"endpoint missing or disabled\",\n      });\n      return null;\n    }\n\n    const body = JSON.stringify({\n      kind: delivery.kind,\n      payload: delivery.payload,\n    });\n    let response: Response;\n    try {\n      const unsafeUrlReason = unsafeFetchUrlReason(endpoint.url);\n      if (unsafeUrlReason !== null) {\n        throw new Error(`Webhook ${unsafeUrlReason}`);\n      }\n      response = await fetch(endpoint.url, {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          \"X-Auth-Event-Type\": delivery.kind,\n          \"X-Auth-Delivery-Id\": delivery._id,\n          \"X-Auth-Timestamp\": String(delivery.signedAt),\n          \"X-Auth-Signature\": `sha256=${delivery.signature}`,\n        },\n        body,\n        redirect: \"manual\",\n        signal: AbortSignal.timeout(15_000),\n      });\n    } catch (err) {\n      const error = err instanceof Error ? err.message : String(err);\n      const retry = delivery.attemptCount < MAX_ATTEMPTS;\n      await ctx.runMutation(internal.connection.webhook.delivery.settle, {\n        id: deliveryId,\n        occurredAt: startedAt,\n        outcome: \"failure\",\n        retry,\n        error,\n      });\n      if (retry) throw err;\n      return null;\n    }\n\n    if (!response.ok) {\n      const retry = isRetriableStatus(response.status) && delivery.attemptCount < MAX_ATTEMPTS;\n      await ctx.runMutation(internal.connection.webhook.delivery.settle, {\n        id: deliveryId,\n        occurredAt: startedAt,\n        outcome: \"failure\",\n        retry,\n        responseStatus: response.status,\n        error: `HTTP ${response.status}`,\n      });\n      if (retry) throw new Error(`Webhook delivery failed: HTTP ${response.status}`);\n      return null;\n    }\n\n    await ctx.runMutation(internal.connection.webhook.delivery.settle, {\n      id: deliveryId,\n      occurredAt: startedAt,\n      outcome: \"success\",\n      retry: false,\n      responseStatus: response.status,\n    });\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA2BA,MAAM,eAAe;AAErB,MAAM,WAAW,IAAI,SAAS,WAAW,iBAAiB;CACxD,gBAAgB;CAChB,sBAAsB;EAAE,aAAa;EAAc,kBAAkB;EAAO,MAAM;EAAG;CACrF,uBAAuB;CACxB,CAAC;;;;;;;;AASF,SAAS,kBAAkB,QAAyB;AAClD,QAAO,UAAU,OAAO,WAAW,OAAO,WAAW;;AAGvD,SAAS,eACP,UAC8C;AAC9C,QAAO;EACL,KAAK,SAAS;EACd,eAAe,SAAS;EACxB,cAAc,SAAS;EACvB,YAAY,SAAS;EACrB,SAAS,SAAS;EAClB,MAAM,SAAS;EACf,QAAQ,SAAS;EACjB,cAAc,SAAS;EACvB,eAAe,SAAS;EACxB,eAAe,SAAS;EACxB,oBAAoB,SAAS;EAC7B,WAAW,SAAS;EACpB,UAAU,SAAS;EACpB;;;AAIH,MAAa,MAAM,cAAc;CAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,EAAE;CAC1C,SAAS,EAAE,MAAM,0BAA0B,EAAE,MAAM,CAAC;CACpD,SAAS,OAAO,KAAK,EAAE,IAAI,iBAAiB;AAC1C,SAAO,MAAM,IAAI,GAAG,IAAI,wBAAwB,WAAW;;CAE9D,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,gBAAgB;EACjB;CACD,SAAS,WAAW,+BAA+B;CACnD,SAAS,OAAO,KAAK,EAAE,cAAc,qBAAqB;EACxD,MAAM,SAAS,MAAM,UAAU,IAAI,IAAIA,eAAO,CAC3C,MAAM,uBAAuB,CAC7B,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CAC/E,MAAM,OAAO,CACb,SAAS,eAAe;AAC3B,SAAO;GACL,GAAG;GACH,MAAM,OAAO,KAAK,IAAI,eAAe;GACtC;;CAEJ,CAAC;;;;;AAMF,MAAa,iBAAiB,MAAM;CAClC,MAAM;EACJ,KAAK,EAAE,QAAQ;EACf,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B;CACD,SAAS,EAAE,MAAM,yBAAyB;CAC1C,SAAS,OAAO,KAAK,EAAE,KAAK,YAAY;EACtC,MAAM,OAAO,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,EAAE,EAAE,IAAI;AACpD,SAAO,MAAM,IAAI,GACd,MAAM,uBAAuB,CAC7B,UAAU,2BAA2B,QACpC,IAAI,GAAG,UAAU,UAAU,CAAC,IAAI,iBAAiB,IAAI,CACtD,CACA,KAAK,KAAK;;CAEhB,CAAC;;AAGF,MAAa,QAAQ,iBAAiB;CACpC,MAAM;EAAE,IAAI,EAAE,GAAG,uBAAuB;EAAE,YAAY,EAAE,QAAQ;EAAE;CAClE,SAAS,EAAE,MAAM,0BAA0B,EAAE,MAAM,CAAC;CACpD,SAAS,OAAO,KAAK,EAAE,IAAI,YAAY,iBAAiB;EACtD,MAAM,WAAW,MAAM,IAAI,GAAG,IAAI,wBAAwB,WAAW;AACrE,MAAI,aAAa,QAAQ,SAAS,WAAW,UAAW,QAAO;EAE/D,MAAM,eAAe,SAAS,eAAe;AAC7C,QAAM,IAAI,GAAG,MAAM,wBAAwB,YAAY;GACrD,QAAQ;GACR;GACA,eAAe;GAChB,CAAC;AACF,QAAM,oBAAoB,KAAK;GAC7B;GACA,cAAc,SAAS;GACvB,YAAY,SAAS;GACrB,eAAe,SAAS;GACxB,iBAAiB,SAAS;GAC1B,MAAM;GACN,SAAS;GACT;GACA,MAAM,EAAE,cAAc;GACvB,CAAC;AACF,SAAO;GACL,GAAG;GACH,QAAQ;GACR;GACA,eAAe;GAChB;;CAEJ,CAAC;;AAGF,MAAa,SAAS,iBAAiB;CACrC,MAAM;EACJ,IAAI,EAAE,GAAG,uBAAuB;EAChC,YAAY,EAAE,QAAQ;EACtB,SAAS,EAAE,MAAM,EAAE,QAAQ,UAAU,EAAE,EAAE,QAAQ,UAAU,CAAC;EAC5D,OAAO,EAAE,SAAS;EAClB,gBAAgB,EAAE,SAAS,EAAE,QAAQ,CAAC;EACtC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GAAG,IAAI,wBAAwB,KAAK,GAAG;AAClE,MAAI,aAAa,QAAQ,SAAS,WAAW,aAAc,QAAO;EAElE,MAAM,YAAY,KAAK,YAAY;AACnC,QAAM,IAAI,GAAG,MAAM,wBAAwB,KAAK,IAAI;GAClD,QAAQ,YAAY,cAAc,KAAK,QAAQ,YAAY;GAC3D,eAAe,KAAK,QAAQ,KAAK,aAAa,SAAS;GACvD,eAAe,KAAK;GACpB,oBAAoB,KAAK;GACzB,WAAW,KAAK;GACjB,CAAC;AACF,QAAM,oBAAoB,KAAK;GAC7B,YAAY,KAAK;GACjB,cAAc,SAAS;GACvB,YAAY,SAAS;GACrB,eAAe,SAAS;GACxB,iBAAiB,SAAS;GAC1B,MAAM,YAAY,+BAA+B;GACjD,SAAS,KAAK;GACd,YAAY,KAAK;GACjB,MAAM;IACJ,cAAc,SAAS;IACvB,QAAQ,KAAK;IACb,OAAO,KAAK;IACb;GACF,CAAC;AACF,SAAO;;CAEV,CAAC;;;;;;AAOF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,YAAY,EAAE,GAAG,uBAAuB;EACxC,SAAS,EAAE,QAAQ;EACnB,MAAM;EACN,SAAS,EAAE,KAAK;EAChB,eAAe,EAAE,QAAQ;EACzB,WAAW,EAAE,QAAQ;EACrB,UAAU,EAAE,QAAQ;EACrB;CACD,SAAS,EAAE,GAAG,uBAAuB;CACrC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,uBAAuB,CAC7B,UAAU,yBAAyB,QAClC,IAAI,GAAG,WAAW,KAAK,QAAQ,CAAC,GAAG,cAAc,KAAK,WAAW,CAClE,CACA,QAAQ;AACX,MAAI,aAAa,KAAM,QAAO,SAAS;EACvC,MAAM,aAAa,MAAM,IAAI,GAAG,OAAO,wBAAwB;GAC7D,GAAG;GACH,QAAQ;GACR,cAAc;GACf,CAAC;AACF,QAAM,oBAAoB,KAAK;GAC7B;GACA,cAAc,KAAK;GACnB,YAAY,KAAK;GACjB,eAAe,KAAK;GACpB,iBAAiB,KAAK;GACtB,MAAM;GACN,SAAS;GACT,YAAY,KAAK;GAClB,CAAC;AACF,QAAM,SAAS,cACb,KACA,SAAS,WAAW,QAAQ,SAAS,UACrC,EAAE,IAAI,YAAY,EAClB;GACE,OAAO,KAAK;GACZ,YAAY,SAAS,WAAW,QAAQ,SAAS;GACjD,SAAS,EAAE,YAAY;GACxB,CACF;AACD,SAAO;;CAEV,CAAC;;;;;;;;;AAUF,MAAa,qBAAqB,iBAAiB;CACjD,MAAM,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAC;CAC7E,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,SAAS,aAAa;AAC3C,MAAI,OAAO,SAAS,UAAW,QAAO;EACtC,MAAM,WAAW,MAAM,IAAI,GAAG,IAAI,wBAAwB,QAAQ,WAAW;AAC7E,MAAI,aAAa,QAAQ,SAAS,WAAW,aAC3C,QAAO;AAET,QAAM,oBAAoB,KAAK;GAC7B,YAAY,QAAQ;GACpB,cAAc,SAAS;GACvB,YAAY,SAAS;GACrB,eAAe,SAAS;GACxB,iBAAiB,SAAS;GAC1B,MAAM;GACN,SAAS;GACT,YAAY,KAAK,KAAK;GACtB,MAAM;IACJ,cAAc,SAAS;IACvB,OAAO,OAAO,SAAS,WAAW,OAAO,QAAQ;IAClD;GACF,CAAC;AACF,QAAM,IAAI,GAAG,MAAM,wBAAwB,QAAQ,YAAY;GAC7D,QAAQ;GACR,WAAW,OAAO,SAAS,WAAW,OAAO,QAAQ;GACtD,CAAC;AACF,SAAO;;CAEV,CAAC;;;;;;;;;AAUF,MAAa,WAAW,eAAe;CACrC,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,EAAE;CAC1C,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,iBAAiB;EAC1C,MAAM,YAAY,KAAK,KAAK;EAC5B,MAAM,WAAW,MAAM,IAAI,YAAY,SAAS,WAAW,QAAQ,SAAS,OAAO;GACjF,IAAI;GACJ,YAAY;GACb,CAAC;AACF,MAAI,aAAa,KAAM,QAAO;EAE9B,MAAM,WAAY,MAAM,IAAI,SAAS,IAAI,WAAW,QAAQ,SAAS,KAAK,EACxE,IAAI,SAAS,YACd,CAAC;AACF,MAAI,CAAC,YAAY,SAAS,WAAW,UAAU;AAC7C,SAAM,IAAI,YAAY,SAAS,WAAW,QAAQ,SAAS,QAAQ;IACjE,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,OAAO;IACP,OAAO;IACR,CAAC;AACF,UAAO;;EAGT,MAAM,OAAO,KAAK,UAAU;GAC1B,MAAM,SAAS;GACf,SAAS,SAAS;GACnB,CAAC;EACF,IAAI;AACJ,MAAI;GACF,MAAM,kBAAkB,qBAAqB,SAAS,IAAI;AAC1D,OAAI,oBAAoB,KACtB,OAAM,IAAI,MAAM,WAAW,kBAAkB;AAE/C,cAAW,MAAM,MAAM,SAAS,KAAK;IACnC,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,qBAAqB,SAAS;KAC9B,sBAAsB,SAAS;KAC/B,oBAAoB,OAAO,SAAS,SAAS;KAC7C,oBAAoB,UAAU,SAAS;KACxC;IACD;IACA,UAAU;IACV,QAAQ,YAAY,QAAQ,KAAO;IACpC,CAAC;WACK,KAAK;GACZ,MAAM,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAC9D,MAAM,QAAQ,SAAS,eAAe;AACtC,SAAM,IAAI,YAAY,SAAS,WAAW,QAAQ,SAAS,QAAQ;IACjE,IAAI;IACJ,YAAY;IACZ,SAAS;IACT;IACA;IACD,CAAC;AACF,OAAI,MAAO,OAAM;AACjB,UAAO;;AAGT,MAAI,CAAC,SAAS,IAAI;GAChB,MAAM,QAAQ,kBAAkB,SAAS,OAAO,IAAI,SAAS,eAAe;AAC5E,SAAM,IAAI,YAAY,SAAS,WAAW,QAAQ,SAAS,QAAQ;IACjE,IAAI;IACJ,YAAY;IACZ,SAAS;IACT;IACA,gBAAgB,SAAS;IACzB,OAAO,QAAQ,SAAS;IACzB,CAAC;AACF,OAAI,MAAO,OAAM,IAAI,MAAM,iCAAiC,SAAS,SAAS;AAC9E,UAAO;;AAGT,QAAM,IAAI,YAAY,SAAS,WAAW,QAAQ,SAAS,QAAQ;GACjE,IAAI;GACJ,YAAY;GACZ,SAAS;GACT,OAAO;GACP,gBAAgB,SAAS;GAC1B,CAAC;AACF,SAAO;;CAEV,CAAC"}

package/dist/component/connection/webhook/endpoint.d.ts

@@ -1,5 +1,5 @@
-import * as convex_values2855 from "convex/values";
-import * as convex_server215 from "convex/server";
+import * as convex_values3280 from "convex/values";
+import * as convex_server220 from "convex/server";
 
 //#region src/component/connection/webhook/endpoint.d.ts
 declare namespace endpoint_d_exports {
@@ -12,55 +12,55 @@ declare namespace endpoint_d_exports {
  * @module
  */
 /** Read a webhook endpoint by id. */
-declare const get: convex_server215.RegisteredQuery<"public", {
-  id: convex_values2855.GenericId<"GroupWebhookEndpoint">;
+declare const get: convex_server220.RegisteredQuery<"public", {
+  id: convex_values3280.GenericId<"GroupWebhookEndpoint">;
 }, Promise<{
-  _id: convex_values2855.GenericId<"GroupWebhookEndpoint">;
+  _id: convex_values3280.GenericId<"GroupWebhookEndpoint">;
   _creationTime: number;
   extend?: any;
-  createdByUserId?: convex_values2855.GenericId<"User"> | undefined;
+  createdByUserId?: convex_values3280.GenericId<"User"> | undefined;
   lastSuccessAt?: number | undefined;
   lastFailureAt?: number | undefined;
-  connectionId: convex_values2855.GenericId<"GroupConnection">;
+  connectionId: convex_values3280.GenericId<"GroupConnection">;
+  groupId: convex_values3280.GenericId<"Group">;
   status: "active" | "disabled";
-  groupId: convex_values2855.GenericId<"Group">;
   url: string;
   secretCiphertext: string;
   subscriptions: ("user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed")[];
   failureCount: number;
 } | null>>;
 /** List a connection's webhook endpoints. */
-declare const list: convex_server215.RegisteredQuery<"public", {
-  connectionId: convex_values2855.GenericId<"GroupConnection">;
+declare const list: convex_server220.RegisteredQuery<"public", {
+  connectionId: convex_values3280.GenericId<"GroupConnection">;
 }, Promise<{
-  _id: convex_values2855.GenericId<"GroupWebhookEndpoint">;
+  _id: convex_values3280.GenericId<"GroupWebhookEndpoint">;
   _creationTime: number;
   extend?: any;
-  createdByUserId?: convex_values2855.GenericId<"User"> | undefined;
+  createdByUserId?: convex_values3280.GenericId<"User"> | undefined;
   lastSuccessAt?: number | undefined;
   lastFailureAt?: number | undefined;
-  connectionId: convex_values2855.GenericId<"GroupConnection">;
+  connectionId: convex_values3280.GenericId<"GroupConnection">;
+  groupId: convex_values3280.GenericId<"Group">;
   status: "active" | "disabled";
-  groupId: convex_values2855.GenericId<"Group">;
   url: string;
   secretCiphertext: string;
   subscriptions: ("user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed")[];
   failureCount: number;
 }[]>>;
 /** Insert a new webhook endpoint (defaults `status` to `"active"`, `failureCount` to 0). */
-declare const create: convex_server215.RegisteredMutation<"public", {
+declare const create: convex_server220.RegisteredMutation<"public", {
   extend?: any;
   status?: "active" | "disabled" | undefined;
-  createdByUserId?: convex_values2855.GenericId<"User"> | undefined;
-  connectionId: convex_values2855.GenericId<"GroupConnection">;
-  groupId: convex_values2855.GenericId<"Group">;
+  createdByUserId?: convex_values3280.GenericId<"User"> | undefined;
+  connectionId: convex_values3280.GenericId<"GroupConnection">;
+  groupId: convex_values3280.GenericId<"Group">;
   url: string;
   secretCiphertext: string;
   subscriptions: ("user.created" | "user.updated" | "session.signed_in" | "session.signed_out" | "session.invalidated" | "session.refresh_exchanged" | "session.refresh_reuse_detected" | "account.linked" | "account.unlinked" | "password.changed" | "passkey.added" | "passkey.removed" | "totp.enrolled" | "totp.removed" | "email.verified" | "phone.verified" | "api_key.created" | "api_key.revoked" | "oauth.client.created" | "oauth.client.revoked" | "oauth.code.created" | "oauth.token.created" | "oauth.token.exchanged" | "oauth.refresh.reuse_detected" | "oauth.refresh.revoked" | "connection.created" | "connection.updated" | "connection.removed" | "connection.login.succeeded" | "connection.login.failed" | "connection.domain.verification_requested" | "connection.domain.verified" | "connection.policy.updated" | "connection.saml.set" | "connection.saml.refreshed" | "connection.oidc.set" | "connection.scim.set" | "connection.scim.read" | "connection.scim.user.provisioned" | "connection.scim.user.updated" | "connection.scim.user.deactivated" | "connection.scim.user.reactivated" | "connection.scim.group.provisioned" | "connection.scim.group.updated" | "connection.scim.group.deactivated" | "connection.scim.group.reactivated" | "webhook.endpoint.created" | "webhook.endpoint.disabled" | "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed")[];
-}, Promise<convex_values2855.GenericId<"GroupWebhookEndpoint">>>;
+}, Promise<convex_values3280.GenericId<"GroupWebhookEndpoint">>>;
 /** Patch fields on a webhook endpoint. */
-declare const update: convex_server215.RegisteredMutation<"public", {
-  id: convex_values2855.GenericId<"GroupWebhookEndpoint">;
+declare const update: convex_server220.RegisteredMutation<"public", {
+  id: convex_values3280.GenericId<"GroupWebhookEndpoint">;
   patch: {
     extend?: any;
     status?: "active" | "disabled" | undefined;

package/dist/component/connection/webhook/events.d.ts

@@ -0,0 +1,26 @@
+import { vAuthEventKind } from "../../model.js";
+import { MutationCtx } from "../../_generated/server.js";
+import { Infer } from "convex/values";
+
+//#region src/component/connection/webhook/events.d.ts
+declare namespace events_d_exports {
+  export { appendDeliveryEvent };
+}
+declare function appendDeliveryEvent(ctx: MutationCtx, args: {
+  deliveryId: string;
+  connectionId: string;
+  endpointId: string;
+  sourceEventId: string;
+  sourceEventType: Infer<typeof vAuthEventKind>;
+  kind: "webhook.delivery.created" | "webhook.delivery.attempted" | "webhook.delivery.succeeded" | "webhook.delivery.failed";
+  outcome: "success" | "failure";
+  occurredAt: number;
+  data?: {
+    attemptCount?: number;
+    status?: number;
+    error?: string;
+  };
+}): Promise<void>;
+//#endregion
+export { events_d_exports };
+//# sourceMappingURL=events.d.ts.map

package/dist/component/connection/webhook/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","names":[],"sources":["../../../../src/component/connection/webhook/events.ts"],"mappings":";;;;;;;;iBAQsB,mBAAA,CACpB,GAAA,EAAK,WAAA,EACL,IAAA;EACE,UAAA;EACA,YAAA;EACA,UAAA;EACA,aAAA;EACA,eAAA,EAAiB,KAAA,QAAa,cAAA;EAC9B,IAAA;EAKA,OAAA;EACA,UAAA;EACA,IAAA;IACE,YAAA;IACA,MAAA;IACA,KAAA;EAAA;AAAA,IAEH,OAAA"}

package/dist/component/connection/webhook/events.js

@@ -0,0 +1,39 @@
+import { appendAuthEventProjection } from "../../event.js";
+
+//#region src/component/connection/webhook/events.ts
+async function appendDeliveryEvent(ctx, args) {
+	const attemptPart = typeof args.data?.attemptCount === "number" ? `:${args.data.attemptCount}` : "";
+	const event = {
+		eventId: `${args.kind}:${args.deliveryId}${attemptPart}`,
+		kind: args.kind,
+		occurredAt: args.occurredAt,
+		actor: {
+			type: "webhook",
+			id: args.endpointId
+		},
+		subject: {
+			type: "webhook_delivery",
+			id: args.deliveryId
+		},
+		targets: [{
+			kind: "connection",
+			id: args.connectionId
+		}],
+		outcome: args.outcome,
+		data: {
+			sourceEventId: args.sourceEventId,
+			sourceEventType: args.sourceEventType,
+			endpointId: args.endpointId,
+			deliveryId: args.deliveryId,
+			...args.data
+		}
+	};
+	await appendAuthEventProjection(ctx, {
+		event,
+		targets: event.targets
+	});
+}
+
+//#endregion
+export { appendDeliveryEvent };
+//# sourceMappingURL=events.js.map

package/dist/component/connection/webhook/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../../../../src/component/connection/webhook/events.ts"],"sourcesContent":["/** Internal webhook delivery audit helpers. */\n\nimport type { Infer } from \"convex/values\";\n\nimport type { MutationCtx } from \"../../_generated/server\";\nimport { appendAuthEventProjection } from \"../../event\";\nimport { vAuthEventKind } from \"../../model\";\n\nexport async function appendDeliveryEvent(\n  ctx: MutationCtx,\n  args: {\n    deliveryId: string;\n    connectionId: string;\n    endpointId: string;\n    sourceEventId: string;\n    sourceEventType: Infer<typeof vAuthEventKind>;\n    kind:\n      | \"webhook.delivery.created\"\n      | \"webhook.delivery.attempted\"\n      | \"webhook.delivery.succeeded\"\n      | \"webhook.delivery.failed\";\n    outcome: \"success\" | \"failure\";\n    occurredAt: number;\n    data?: {\n      attemptCount?: number;\n      status?: number;\n      error?: string;\n    };\n  },\n) {\n  const attemptPart =\n    typeof args.data?.attemptCount === \"number\" ? `:${args.data.attemptCount}` : \"\";\n  const event = {\n    eventId: `${args.kind}:${args.deliveryId}${attemptPart}`,\n    kind: args.kind,\n    occurredAt: args.occurredAt,\n    actor: { type: \"webhook\" as const, id: args.endpointId },\n    subject: { type: \"webhook_delivery\" as const, id: args.deliveryId },\n    targets: [{ kind: \"connection\" as const, id: args.connectionId }],\n    outcome: args.outcome,\n    data: {\n      sourceEventId: args.sourceEventId,\n      sourceEventType: args.sourceEventType,\n      endpointId: args.endpointId,\n      deliveryId: args.deliveryId,\n      ...args.data,\n    },\n  };\n  await appendAuthEventProjection(ctx, { event, targets: event.targets });\n}\n"],"mappings":";;;AAQA,eAAsB,oBACpB,KACA,MAmBA;CACA,MAAM,cACJ,OAAO,KAAK,MAAM,iBAAiB,WAAW,IAAI,KAAK,KAAK,iBAAiB;CAC/E,MAAM,QAAQ;EACZ,SAAS,GAAG,KAAK,KAAK,GAAG,KAAK,aAAa;EAC3C,MAAM,KAAK;EACX,YAAY,KAAK;EACjB,OAAO;GAAE,MAAM;GAAoB,IAAI,KAAK;GAAY;EACxD,SAAS;GAAE,MAAM;GAA6B,IAAI,KAAK;GAAY;EACnE,SAAS,CAAC;GAAE,MAAM;GAAuB,IAAI,KAAK;GAAc,CAAC;EACjE,SAAS,KAAK;EACd,MAAM;GACJ,eAAe,KAAK;GACpB,iBAAiB,KAAK;GACtB,YAAY,KAAK;GACjB,YAAY,KAAK;GACjB,GAAG,KAAK;GACT;EACF;AACD,OAAM,0BAA0B,KAAK;EAAE;EAAO,SAAS,MAAM;EAAS,CAAC"}