@fabricorg/webhook-delivery 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# @fabricorg/webhook-delivery
+
+## 0.1.1
+
+### Patch Changes
+
+- 4e429a3: Republish workspace dependents of `@fabricorg/platform` and `@fabricorg/platform-host`, including transitive and development dependencies, alongside the retryable governance contract (issue #56). Workspace ranges resolve to the released versions when packed; existing literal compatibility ranges remain unchanged. Runtime source is unchanged.
+
+## 0.1.0
+
+### Minor Changes
+
+- 82d9200: First release of `@fabricorg/webhook-delivery`: outbound webhook subscription delivery fed by the `@fabricorg/platform-host` outbox, as decided in ADR 0018. The package was private until now. Its README ("Install and requirements") and the docs page "Webhook delivery" describe adoption.
+
+  - **What it is.** A two-stage fan-out (`createWebhookFanOutPublisher()` stores a job inside the Host outbox relay; `runWebhookFanOutCycle()` turns each job into delivery intents or recorded denials), a delivery cycle (`runWebhookDeliveryCycle()`), the `fabric.webhook-delivery.v1` wire contract with `v1=` HMAC-SHA256 signatures, memory and PostgreSQL stores, a destination resolver, and `createWebhookDeliveryModule()`, which builds the operator mutations (subscription create, update, pause, resume and delete; staged and emergency secret rotation; delivery-intent and fan-out-job requeue; actor enrichment) as a Platform `FabricModule`.
+  - **Entry points.** `@fabricorg/webhook-delivery` and `@fabricorg/webhook-delivery/node` (the Node transport and DNS lookup). ESM and CommonJS, Node.js 20 or newer, no runtime dependencies.
+  - **Peers: `@fabricorg/platform` `^1.7.0` and `@fabricorg/platform-host` `^7.3.0`.** Those releases add submission admission (`ActionDefinition.admitSubmission`, run by Host before it records a submission). Every operator action declares the check, so a secret reference that is malformed or that the tenant's secret store does not hold is refused before Host stores the parameters. On a Host older than 7.3.0 the check does not run: the actions refuse at execution as `admission_not_enforced` and write nothing, but the submitted parameters are already in Host's invocation record. Install the peers at these versions. No Host option or wiring is needed for admission.
+  - **Host prerequisites** (ADR 0018, "Adoption gates"): outbox dead-letter requeue (`requeueOutboxDeadLetter` with `authorizeOutboxRequeue`), the opt-in envelope actor (`outbox.includeActor`) for subscriptions whose admission needs the actor, and submission admission as above. Run the Host outbox relay on a transactional store, with the retry budget the README gives.
+  - **PostgreSQL.** Run `ensureSchema()` on `PostgresWebhookSubscriptionStore` and `PostgresWebhookDeliveryStore` at startup or from a migration step before a worker or action uses them. It applies the package's migrations under an advisory lock and fails on a recorded migration whose SQL has changed. The stores take an injected pool; the memory stores are for tests and explicit local development.
+  - **No scheduler.** The package starts none. The application calls the fan-out and delivery cycles from its own workers.
+  - **Security.** Action parameters carry secret references only. Destinations are re-checked as public addresses at configuration, at intent requeue and before dispatch, and the Node transport connects only to the vetted addresses, follows no redirect and reads a bounded response. Stored diagnostics and refusals are fixed codes. Event payloads are projected through an egress allowlist. The README's "Security properties" and "Guarantees and what enforces it" tables name the test or line behind each statement.
+  - **Ordering and recovery.** Delivery is at least once. Fan-out and delivery leases are fenced; a crashed worker's job or intent is reclaimed after its lease expires, and a handed-off attempt is recorded before the handoff. Pause and delete are enforced at dispatch against the revision at which the status began, so once a dispatch check has seen a committed pause, an intent bound to an earlier revision is not handed off, even after a resume. A pause committed after the worker's last subscription check may still race with that attempt's handoff (README, "Check order and the irrevocable point"). The webhook stores are not Host's store, so a store write and Host's event append are not one transaction: subscription and rotation actions are declared not idempotent, and requeue and enrichment are idempotent and report a change another attempt already committed when its evidence is visible. One exception: an older attempt that commits after a newer one already refused leaves the change standing under a recorded refusal, for an operator to reconcile from the evidence (README, "Atomicity and re-runs"). The package's own action events are excluded from fan-out matching.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Fabric
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.