@fabricorg/webhook-delivery 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @fabricorg/webhook-delivery
 
+## 0.2.3
+
+### Patch Changes
+
+- d09f378: Refresh packed workspace dependency ranges for the Host stored-record erasure capability.
+- be0938a: Refresh packed Host dependency consumers for the exported store conformance suites.
+  Existing peer ranges accept the additive minor release.
+- 0d4204e: Keep Host peer consumers in the release plan with the additive recorded-approval capability.
+  Existing peer ranges accept this minor release; no dependency range change is required.
+- 1e46ff0: Add opt-in `idempotency.recordRefusals` to reserve keyed terminal submission refusals.
+  The new `submission_refused` status is inert, and refusal identity includes actor type.
+  Defaults retain the free-key refusal behavior. Admission-declaring actions omit refusal
+  digests to preserve their pre-admission parameter boundary; refusal rows store fixed evidence
+  without parameters, proposal or provenance attributes. Recorded errors confirm persistence,
+  and store failures surface unchanged. Apply migration 15 and upgrade all hosts sharing a
+  database before activation. Unauthorized callers can occupy keys, and callbacks returning
+  false during outages can permanently reserve them. Refusal codes must be fixed action codes.
+
+  With recording enabled, an empty string is a present idempotency key. Stores preserve empty
+  key and authorization-binding identities on hydration, and memory insertion arbitrates empty
+  keys consistently with PostgreSQL. Default Host submissions keep their keyless empty-string behavior.
+
+  Generic creation and status-update methods reject `submission_refused` as a write input;
+  the narrow refusal insert owns new refusal rows and their fixed payloads.
+
+  Validate request-only metadata before recording an eligible refusal so malformed submissions
+  leave their keys free. The public tenant-isolation kit adds an optional recorded-refusal scope
+  check, including ordinary creation against a refusal in another scope. Its result list gains
+  `fabric.tenancy.submission-refusal-scoped.v1`; stores without the method skip that check.
+  A PostgreSQL store must have migration 15 applied (`ensureSchema()`) before running the kit, or the new check fails.
+
+## 0.2.2
+
+### Patch Changes
+
+- 08274e6: Refresh dependent packages for Platform Host approval expiry, verification evidence, and opt-in atomic lifecycle events.
+
 ## 0.2.1
 
 ### Patch Changes

package/README.md

@@ -10,8 +10,8 @@ pnpm add @fabricorg/webhook-delivery@^0.1.0 @fabricorg/platform@^1.7.0 @fabricor
 ```
 
 - **Peers.** `@fabricorg/platform` `^1.7.0` and `@fabricorg/platform-host` `^7.3.0`. Platform 1.7.0
-  defines `ActionDefinition.admitSubmission` and Host 7.3.0 runs it before it records a
-  submission. Every operator action declares the check, so against an older Host the actions
+  defines `ActionDefinition.admitSubmission` and Host 7.3.0 runs it before it persists
+  submission parameters. Every operator action declares the check, so against an older Host the actions
   refuse at execution as `admission_not_enforced` ([Secrets and parameters](#secrets-and-parameters)).
   `@fabricorg/platform` is imported for types only.
 - **Runtime.** Node.js 20 or newer; run 22.23.4, 24.22.1, or 26.12.1 or newer in the same release line in production for
@@ -476,8 +476,8 @@ The suite creates one database per run and one schema per store pair.
 `tests/store-contract.ts` is a record of named cases, each taking a factory that builds both
 stores from an injected clock and horizon. `tests/memory-stores.test.ts` runs it against the
 memory stores, and `tests/postgres-live.test.ts` runs the same record against PostgreSQL. It
-follows Host's `tests/outbox-requeue-contract.ts`, which is test-only, so the suite is not
-exported from the package. Two cycle-level records run the same way against both stores:
+uses the factory-per-case pattern also used by Host's published `outboxRequeueChecks`
+in `src/outbox-requeue-conformance.ts`; this webhook suite remains test-only. Two cycle-level records run the same way against both stores:
 `tests/delivery-cycle-contract.ts` and `tests/fan-out-lease-contract.ts`. A database-backed store meets four requirements; how the PostgreSQL
 store meets each is under [PostgreSQL stores](#postgresql-stores):
 
@@ -1366,7 +1366,7 @@ const host = createGovernedActionHost({
 ```
 
 Nothing has to be wired into Host for the secret-reference guarantee: every action declares
-`admitSubmission`, which Host runs on every submission before it records anything ([Secrets and
+`admitSubmission`, which Host runs on every submission before it persists parameters ([Secrets and
 parameters](#secrets-and-parameters)). The releases that define and run that check are
 `@fabricorg/platform` 1.7.0 and `@fabricorg/platform-host` 7.3.0, and the package's peer ranges
 are `^1.7.0` and `^7.3.0`.
@@ -1404,7 +1404,7 @@ letter" under [Ports](#ports)).
 A submission refused at admission makes `submitAction` throw Host's `ActionAdmissionError` with
 `refusal: "refused"` and `refusalCode` `webhook_parameters_refused:<code>:<field>`
 (`WEBHOOK_ACTION_PARAMETER_CODES` and a declared field or `parameters`) or
-`webhook_action_refused:<code>` (`WEBHOOK_ACTION_REFUSAL_CODES`); Host records nothing for it. A
+`webhook_action_refused:<code>` (`WEBHOOK_ACTION_REFUSAL_CODES`); Host records nothing for it by default. With `idempotency.recordRefusals`, a keyed definitive refusal reserves the key with fixed evidence and empty parameters. A
 refusal at execution fails the invocation with Host's `error` set to `webhook_action_refused:<code>`
 and emits no event. Neither carries a caller value or an undeclared key. `cancelledPendingIntents` is the
 cleanup's count, or `null` when that call threw, timed out or answered unreadably; the action
@@ -1452,11 +1452,11 @@ objects reach it; it is kept as a second line.
 
 ### Secrets and parameters
 
-Parameters carry secret references only (decision 8). The rule is enforced before anything is
-persisted, not by convention. Every action declares Platform's `admitSubmission` check, and
+Parameters carry secret references only (decision 8). The check runs before parameters are persisted. Every action declares Platform's `admitSubmission` check, and
 `@fabricorg/platform-host` 7.3.0 and later runs it on every submission, after authorizing the
-submitter and before it writes anything for the submission: no invocation record, idempotency key,
-event, policy record or error. The check reads the parameters with the package reader, which
+submitter and before it persists parameters. By default a refusal leaves no invocation record,
+idempotency key, event, policy record or error. With `idempotency.recordRefusals`, keyed definitive
+refusals instead retain a terminal `submission_refused` row with fixed evidence and empty parameters. The check reads the parameters with the package reader, which
 refuses undeclared keys and a `secretRef` not shaped like a reference. For the three actions that
 take a `secretRef` (`create_subscription`, `rotate_secret_staged`, `rotate_secret_emergency`) it
 then asks the application's `secretReferences.verify` with the submission's trusted tenant and
@@ -1464,8 +1464,8 @@ space. Neither step alone is enough. The shape rule refuses the forms key materi
 in, but it cannot tell an opaque reference from random bytes of the same shape (`x:` followed by 64
 hex digits passes it). The verifier confirms that the reference resolves in the tenant's own secret
 store, which also refuses another tenant's reference. A refusal, a verifier that throws or answers
-anything but `"valid"`, and a check whose answer does not settle within Host's `admissionTimeoutMs` all leave nothing in
-Host's store (tests "key material shaped like a reference …" and "a well-formed reference the
+anything but `"valid"`, and a check whose answer does not settle within Host's `admissionTimeoutMs` leave no submitted parameters in
+Host's store. Without recorded refusals they leave no row (tests "key material shaped like a reference …" and "a well-formed reference the
 tenant's secret store does not hold is refused at admission …").
 
 Host reads the submission once, when `submitAction` is called, and, because these actions declare

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabricorg/webhook-delivery",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Outbound webhook subscription delivery for @fabricorg/platform-host: the fabric.webhook-delivery.v1 wire contract, persistence and egress projections, response classification, retry schedule, and the store, signer, resolver, transport, admission and authorization ports.",
   "keywords": [
     "fabric",
@@ -63,8 +63,8 @@
     "typescript": "^5.7.3",
     "vitest": "^4.1.5",
     "@fabric-platform/bundling": "0.0.0",
-    "@fabricorg/platform": "1.12.0",
-    "@fabricorg/platform-host": "8.2.0"
+    "@fabricorg/platform": "1.17.0",
+    "@fabricorg/platform-host": "8.9.0"
   },
   "engines": {
     "node": ">=20"