@hilbras/keystone 1.1.0

package/dist/services/webauthn.js

@@ -0,0 +1,147 @@
+import crypto from "node:crypto";
+import { eq } from "drizzle-orm";
+import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from "@simplewebauthn/server";
+import { db } from "../db/index.js";
+import { webauthnCredentials, users, } from "../db/schema.js";
+import { config } from "../config.js";
+const RP_NAME = "Hilbras Keystone";
+function rpID() {
+    const url = config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+    return new URL(url).hostname;
+}
+function origin() {
+    return config.AUTH_API_PUBLIC_URL || `http://localhost:${config.PORT}`;
+}
+const challenges = new Map();
+function cleanupChallenges() {
+    const now = Date.now();
+    for (const [key, value] of challenges) {
+        if (value.expiresAt < now)
+            challenges.delete(key);
+    }
+}
+export function createChallenge(userId) {
+    cleanupChallenges();
+    const challenge = crypto.randomBytes(32).toString("base64url");
+    challenges.set(challenge, { challenge, userId, expiresAt: Date.now() + 5 * 60 * 1000 });
+    return challenge;
+}
+export function consumeChallenge(challenge) {
+    const record = challenges.get(challenge);
+    challenges.delete(challenge);
+    if (!record)
+        return undefined;
+    if (record.expiresAt < Date.now())
+        return undefined;
+    return record;
+}
+export async function listCredentialsByUser(userId) {
+    return db.select().from(webauthnCredentials).where(eq(webauthnCredentials.userId, userId));
+}
+export async function findCredentialById(credentialId) {
+    const [record] = await db
+        .select()
+        .from(webauthnCredentials)
+        .where(eq(webauthnCredentials.credentialId, credentialId))
+        .limit(1);
+    return record;
+}
+export async function buildRegistrationOptions(user) {
+    const options = await generateRegistrationOptions({
+        rpName: RP_NAME,
+        rpID: rpID(),
+        userName: user.email,
+        userDisplayName: user.name || user.username,
+        userID: Buffer.from(user.id, "utf8"),
+        challenge: createChallenge(user.id),
+        attestationType: "none",
+        authenticatorSelection: {
+            residentKey: "preferred",
+            userVerification: "preferred",
+        },
+    });
+    return options;
+}
+export async function verifyAndStoreRegistration(user, response, expectedChallenge, deviceName) {
+    const verification = await verifyRegistrationResponse({
+        response,
+        expectedChallenge,
+        expectedOrigin: origin(),
+        expectedRPID: rpID(),
+        requireUserVerification: false,
+    });
+    if (!verification.verified || !verification.registrationInfo) {
+        throw new Error("WebAuthn registration verification failed");
+    }
+    const info = verification.registrationInfo;
+    const credential = info.credential;
+    await db.insert(webauthnCredentials).values({
+        userId: user.id,
+        credentialId: credential.id,
+        publicKey: Buffer.from(credential.publicKey).toString("base64url"),
+        counter: credential.counter,
+        transports: (credential.transports || []),
+        aaguid: info.aaguid || null,
+        deviceName: deviceName || null,
+    });
+    return { verified: true };
+}
+export async function buildAuthenticationOptions(email) {
+    let allowCredentials;
+    let userId;
+    if (email) {
+        const [user] = await db.select().from(users).where(eq(users.email, email.toLowerCase())).limit(1);
+        if (user) {
+            userId = user.id;
+            const credentials = await listCredentialsByUser(user.id);
+            allowCredentials = credentials.map((c) => ({
+                id: c.credentialId,
+                type: "public-key",
+                transports: (c.transports || []),
+            }));
+        }
+    }
+    const options = await generateAuthenticationOptions({
+        rpID: rpID(),
+        challenge: createChallenge(userId),
+        allowCredentials,
+        userVerification: "preferred",
+    });
+    return options;
+}
+export async function verifyAuthentication(response, expectedChallenge) {
+    const credentialId = response.id;
+    const credential = await findCredentialById(credentialId);
+    if (!credential) {
+        throw new Error("Credential not found");
+    }
+    const verification = await verifyAuthenticationResponse({
+        response,
+        expectedChallenge,
+        expectedOrigin: origin(),
+        expectedRPID: rpID(),
+        credential: {
+            id: credential.credentialId,
+            publicKey: Buffer.from(credential.publicKey, "base64url"),
+            counter: credential.counter,
+            transports: (credential.transports || []),
+        },
+        requireUserVerification: false,
+    });
+    if (!verification.verified) {
+        throw new Error("WebAuthn authentication verification failed");
+    }
+    await db
+        .update(webauthnCredentials)
+        .set({
+        counter: verification.authenticationInfo.newCounter,
+        lastUsedAt: new Date(),
+    })
+        .where(eq(webauthnCredentials.id, credential.id));
+    const [user] = await db.select().from(users).where(eq(users.id, credential.userId)).limit(1);
+    if (!user) {
+        throw new Error("User not found");
+    }
+    return { verified: true, user };
+}
+//# sourceMappingURL=webauthn.js.map

package/dist/services/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/services/webauthn.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAI7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,KAAK,GAGN,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC,SAAS,IAAI;IACX,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5E,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AAC/B,CAAC;AAED,SAAS,MAAM;IACb,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAQD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;AAExD,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;YAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,iBAAiB,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACxF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,YAAoB;IAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;SACzD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAU;IACvD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,EAAE;QACZ,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QAC3C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC;QACpC,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,eAAe,EAAE,MAAM;QACvB,sBAAsB,EAAE;YACtB,WAAW,EAAE,WAAW;YACxB,gBAAgB,EAAE,WAAW;SAC9B;KACF,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAU,EACV,QAAkC,EAClC,iBAAyB,EACzB,UAAmB;IAEnB,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;QACpD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,MAAM,EAAE;QACxB,YAAY,EAAE,IAAI,EAAE;QACpB,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,YAAY,EAAE,UAAU,CAAC,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClE,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAmC;QAC3E,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,UAAU,EAAE,UAAU,IAAI,IAAI;KAC/B,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAc;IAC7D,IAAI,gBAES,CAAC;IACd,IAAI,MAA0B,CAAC;IAE/B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzD,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzC,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,IAAI,EAAE,YAAqB;gBAC3B,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAmC;aACnE,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;QAClD,IAAI,EAAE,IAAI,EAAE;QACZ,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC;QAClC,gBAAgB;QAChB,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAoC,EAAE,iBAAyB;IACxG,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;QACtD,QAAQ;QACR,iBAAiB;QACjB,cAAc,EAAE,MAAM,EAAE;QACxB,YAAY,EAAE,IAAI,EAAE;QACpB,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC;YACzD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAmC;SAC5E;QACD,uBAAuB,EAAE,KAAK;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,mBAAmB,CAAC;SAC3B,GAAG,CAAC;QACH,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,UAAU;QACnD,UAAU,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAEpD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC"}

package/dist/services/webhooks.d.ts

@@ -0,0 +1,86 @@
+import { type WebhookEndpoint } from "../db/schema.js";
+import type { KeystoneEvent } from "./events/types.js";
+export type { WebhookEndpoint };
+export declare function listEndpoints(appId?: string): Promise<{
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    isActive: boolean;
+    appId: string | null;
+    description: string | null;
+    url: string;
+    events: string[];
+    secret: string;
+}[]>;
+export declare function createEndpoint(input: {
+    appId?: string | null;
+    url: string;
+    description?: string;
+    events?: string[];
+}): Promise<WebhookEndpoint & {
+    signingSecret: string;
+}>;
+export declare function updateEndpoint(id: string, input: Partial<{
+    url: string;
+    description: string | null;
+    events: string[];
+    isActive: boolean;
+}>): Promise<{
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    isActive: boolean;
+    appId: string | null;
+    description: string | null;
+    url: string;
+    events: string[];
+    secret: string;
+}>;
+export declare function deleteEndpoint(id: string): Promise<{
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    isActive: boolean;
+    appId: string | null;
+    description: string | null;
+    url: string;
+    events: string[];
+    secret: string;
+}>;
+export declare function rotateEndpointSecret(id: string): Promise<{
+    endpoint: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        isActive: boolean;
+        appId: string | null;
+        description: string | null;
+        url: string;
+        events: string[];
+        secret: string;
+    };
+    signingSecret: string;
+} | undefined>;
+export declare function listDeliveries(endpointId: string, limit?: number): Promise<{
+    id: string;
+    createdAt: Date;
+    payload: unknown;
+    status: string;
+    endpointId: string;
+    eventType: string;
+    attempts: number;
+    responseStatus: number | null;
+    responseBody: string | null;
+    lastAttemptAt: Date | null;
+}[]>;
+/**
+ * Fan an event out to every active endpoint subscribed to it.
+ * Each delivery is persisted first, then handed to the queue worker.
+ */
+export declare function dispatchEvent(event: KeystoneEvent): Promise<void>;
+export declare function deliverNow(deliveryId: string): Promise<void>;
+/** Manual retry from the dashboard: reset to pending and enqueue. */
+export declare function retryDelivery(deliveryId: string): Promise<boolean>;
+/** Register the delivery worker with the queue. */
+export declare function startWebhookWorker(): void;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/services/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/services/webhooks.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuC,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAG5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvD,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,wBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM;;;;;;;;;;KAKjD;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE;IAC1C,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,OAAO,CAAC,eAAe,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAavD;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;;;;;;;;;;GAQjG;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;GAG9C;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;eAQpD;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,SAAK;;;;;;;;;;;KAOlE;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BvE;AAED,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDlE;AAUD,qEAAqE;AACrE,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASxE;AAED,mDAAmD;AACnD,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC"}

package/dist/services/webhooks.js

@@ -0,0 +1,164 @@
+import crypto from "node:crypto";
+import { and, desc, eq } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { webhookDeliveries, webhookEndpoints } from "../db/schema.js";
+import { signWebhookPayload } from "../lib/webhookSignature.js";
+import { queue } from "./queue/index.js";
+const MAX_ATTEMPTS = 5;
+const RETRY_DELAY_MS = 30_000;
+export async function listEndpoints(appId) {
+    if (appId) {
+        return db.select().from(webhookEndpoints).where(eq(webhookEndpoints.appId, appId)).orderBy(webhookEndpoints.createdAt);
+    }
+    return db.select().from(webhookEndpoints).orderBy(webhookEndpoints.createdAt);
+}
+export async function createEndpoint(input) {
+    const secret = `whsec_${crypto.randomBytes(24).toString("base64url")}`;
+    const [endpoint] = await db
+        .insert(webhookEndpoints)
+        .values({
+        appId: input.appId ?? null,
+        url: input.url,
+        description: input.description ?? null,
+        events: input.events ?? [],
+        secret,
+    })
+        .returning();
+    return { ...endpoint, signingSecret: secret };
+}
+export async function updateEndpoint(id, input) {
+    const [updated] = await db
+        .update(webhookEndpoints)
+        .set({ ...input, updatedAt: new Date() })
+        .where(eq(webhookEndpoints.id, id))
+        .returning();
+    return updated;
+}
+export async function deleteEndpoint(id) {
+    const [deleted] = await db.delete(webhookEndpoints).where(eq(webhookEndpoints.id, id)).returning();
+    return deleted;
+}
+export async function rotateEndpointSecret(id) {
+    const secret = `whsec_${crypto.randomBytes(24).toString("base64url")}`;
+    const [updated] = await db
+        .update(webhookEndpoints)
+        .set({ secret, updatedAt: new Date() })
+        .where(eq(webhookEndpoints.id, id))
+        .returning();
+    return updated ? { endpoint: updated, signingSecret: secret } : undefined;
+}
+export async function listDeliveries(endpointId, limit = 50) {
+    return db
+        .select()
+        .from(webhookDeliveries)
+        .where(eq(webhookDeliveries.endpointId, endpointId))
+        .orderBy(desc(webhookDeliveries.createdAt))
+        .limit(limit);
+}
+/**
+ * Fan an event out to every active endpoint subscribed to it.
+ * Each delivery is persisted first, then handed to the queue worker.
+ */
+export async function dispatchEvent(event) {
+    const endpoints = await db.select().from(webhookEndpoints).where(eq(webhookEndpoints.isActive, true));
+    for (const endpoint of endpoints) {
+        // App-scoped endpoints only receive events for their own application.
+        if (endpoint.appId && event.payload.appId && endpoint.appId !== event.payload.appId)
+            continue;
+        if (endpoint.events.length > 0 && !endpoint.events.includes(event.type))
+            continue;
+        const body = {
+            id: crypto.randomUUID(),
+            type: event.type,
+            version: event.version,
+            timestamp: event.timestamp,
+            payload: event.payload,
+        };
+        const [delivery] = await db
+            .insert(webhookDeliveries)
+            .values({ endpointId: endpoint.id, eventType: event.type, payload: body })
+            .returning();
+        await queue.enqueue({
+            type: "webhook-delivery",
+            payload: { deliveryId: delivery.id },
+        });
+    }
+}
+export async function deliverNow(deliveryId) {
+    const [delivery] = await db.select().from(webhookDeliveries).where(eq(webhookDeliveries.id, deliveryId)).limit(1);
+    if (!delivery)
+        return;
+    const [endpoint] = await db.select().from(webhookEndpoints).where(eq(webhookEndpoints.id, delivery.endpointId)).limit(1);
+    if (!endpoint || !endpoint.isActive)
+        return;
+    const attempts = delivery.attempts + 1;
+    const now = new Date();
+    try {
+        const response = await fetch(endpoint.url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-Keystone-Signature": signWebhookPayload(endpoint.secret, delivery.payload),
+                "X-Keystone-Event": delivery.eventType,
+                "X-Keystone-Delivery": delivery.id,
+            },
+            body: JSON.stringify(delivery.payload),
+            signal: AbortSignal.timeout(10_000),
+        });
+        const responseBody = (await response.text()).slice(0, 2000);
+        await db
+            .update(webhookDeliveries)
+            .set({
+            attempts,
+            lastAttemptAt: now,
+            responseStatus: response.status,
+            responseBody,
+            status: response.ok ? "success" : "failed",
+        })
+            .where(eq(webhookDeliveries.id, deliveryId));
+        if (!response.ok && attempts < MAX_ATTEMPTS) {
+            await retryLater(deliveryId);
+        }
+    }
+    catch (err) {
+        await db
+            .update(webhookDeliveries)
+            .set({
+            attempts,
+            lastAttemptAt: now,
+            responseBody: err instanceof Error ? err.message.slice(0, 2000) : "Delivery error",
+            status: attempts >= MAX_ATTEMPTS ? "failed" : "pending",
+        })
+            .where(eq(webhookDeliveries.id, deliveryId));
+        if (attempts < MAX_ATTEMPTS) {
+            await retryLater(deliveryId);
+        }
+    }
+}
+async function retryLater(deliveryId) {
+    setTimeout(() => {
+        queue.enqueue({ type: "webhook-delivery", payload: { deliveryId } }).catch((err) => {
+            console.error("[webhooks] failed to re-enqueue delivery:", err);
+        });
+    }, RETRY_DELAY_MS).unref();
+}
+/** Manual retry from the dashboard: reset to pending and enqueue. */
+export async function retryDelivery(deliveryId) {
+    const [updated] = await db
+        .update(webhookDeliveries)
+        .set({ status: "pending" })
+        .where(and(eq(webhookDeliveries.id, deliveryId), eq(webhookDeliveries.status, "failed")))
+        .returning();
+    if (!updated)
+        return false;
+    await queue.enqueue({ type: "webhook-delivery", payload: { deliveryId } });
+    return true;
+}
+/** Register the delivery worker with the queue. */
+export function startWebhookWorker() {
+    queue.process("webhook-delivery", async (job) => {
+        const { deliveryId } = job.payload;
+        await deliverNow(deliveryId);
+    });
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/services/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/services/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAwB,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAGzC,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,MAAM,CAAC;AAI9B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAKpC;IACC,MAAM,MAAM,GAAG,SAAS,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACvE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,MAAM;KACP,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,KAAgG;IAEhG,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SACxC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SAClC,SAAS,EAAE,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACnG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAU;IACnD,MAAM,MAAM,GAAG,SAAS,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACvE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SACtC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SAClC,SAAS,EAAE,CAAC;IACf,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,KAAK,GAAG,EAAE;IACjE,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,iBAAiB,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SACnD,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;SAC1C,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAoB;IACtD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAEtG,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,sEAAsE;QACtE,IAAI,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK;YAAE,SAAS;QAC9F,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAElF,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACzE,SAAS,EAAE,CAAC;QAEf,MAAM,KAAK,CAAC,OAAO,CAAC;YAClB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClH,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAAE,OAAO;IAE5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,sBAAsB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAC7E,kBAAkB,EAAE,QAAQ,CAAC,SAAS;gBACtC,qBAAqB,EAAE,QAAQ,CAAC,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC;YACH,QAAQ;YACR,aAAa,EAAE,GAAG;YAClB,cAAc,EAAE,QAAQ,CAAC,MAAM;YAC/B,YAAY;YACZ,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;SAC3C,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAE/C,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;YAC5C,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC;YACH,QAAQ;YACR,aAAa,EAAE,GAAG;YAClB,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB;YAClF,MAAM,EAAE,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAE/C,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;YAC5B,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC1F,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAkB;IACpD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,iBAAiB,CAAC;SACzB,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;SACxF,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,kBAAkB;IAChC,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,OAAiC,CAAC;QAC7D,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/workflows/engine.d.ts

@@ -0,0 +1,18 @@
+import { type Workflow, type WorkflowRun } from "../../db/schema.js";
+import type { KeystoneEvent } from "../events/types.js";
+import { type WorkflowStep } from "./steps.js";
+export interface WorkflowDefinition {
+    steps: WorkflowStep[];
+    [key: string]: unknown;
+}
+export declare function loadWorkflows(): Promise<void>;
+export declare function registerWorkflow(input: {
+    orgId?: string;
+    name: string;
+    trigger: string;
+    definition: WorkflowDefinition;
+}): Promise<Workflow>;
+export declare function triggerWorkflowRun(workflow: Workflow, event: KeystoneEvent): Promise<WorkflowRun>;
+export declare function executeRunById(runId: string, workflowId: string): Promise<void>;
+export declare function listWorkflowRuns(workflowId?: string): Promise<WorkflowRun[]>;
+//# sourceMappingURL=engine.d.ts.map

package/dist/services/workflows/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/services/workflows/engine.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAG9F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,kBAAkB,CAAC;CAChC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAcpB;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBvG;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQrF;AAqCD,wBAAsB,gBAAgB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAKlF"}

package/dist/services/workflows/engine.js

@@ -0,0 +1,104 @@
+import { eq, and } from "drizzle-orm";
+import { db } from "../../db/index.js";
+import { workflows, workflowRuns } from "../../db/schema.js";
+import { findUserById } from "../users.js";
+import { subscribe } from "../events/bus.js";
+import { queue } from "../queue/index.js";
+import { executeStep } from "./steps.js";
+let loaded = false;
+export async function loadWorkflows() {
+    if (loaded)
+        return;
+    loaded = true;
+    const activeWorkflows = await db
+        .select()
+        .from(workflows)
+        .where(and(eq(workflows.isActive, true)));
+    for (const workflow of activeWorkflows) {
+        subscribe(workflow.trigger, async (event) => {
+            await triggerWorkflowRun(workflow, event);
+        });
+    }
+}
+export async function registerWorkflow(input) {
+    const [workflow] = await db
+        .insert(workflows)
+        .values({
+        orgId: input.orgId ?? null,
+        name: input.name,
+        trigger: input.trigger,
+        definition: input.definition,
+    })
+        .returning();
+    subscribe(workflow.trigger, async (event) => {
+        await triggerWorkflowRun(workflow, event);
+    });
+    return workflow;
+}
+export async function triggerWorkflowRun(workflow, event) {
+    const [run] = await db
+        .insert(workflowRuns)
+        .values({
+        workflowId: workflow.id,
+        triggerEvent: event.type,
+        payload: event.payload,
+        status: "running",
+        startedAt: new Date(),
+    })
+        .returning();
+    // Dispatch to the background queue so the HTTP response is not blocked.
+    await queue.enqueue({
+        type: "workflow_run",
+        payload: { runId: run.id, workflowId: workflow.id },
+    });
+    return run;
+}
+export async function executeRunById(runId, workflowId) {
+    const [run] = await db.select().from(workflowRuns).where(eq(workflowRuns.id, runId)).limit(1);
+    const [workflow] = await db.select().from(workflows).where(eq(workflows.id, workflowId)).limit(1);
+    if (!run || !workflow) {
+        console.error(`[workflow-engine] run or workflow not found: ${runId}, ${workflowId}`);
+        return;
+    }
+    await executeRun(run, workflow);
+}
+async function executeRun(run, workflow) {
+    const definition = (workflow.definition ?? { steps: [] });
+    const payload = (run.payload ?? {});
+    const userId = payload.userId;
+    const user = userId ? await findUserById(userId) : undefined;
+    const outputs = {};
+    const log = [];
+    for (const step of definition.steps ?? []) {
+        const result = await executeStep(step, { payload, outputs, user });
+        if (result.output) {
+            Object.assign(outputs, result.output);
+            if (step.name)
+                outputs[step.name] = Object.values(result.output)[0] ?? "";
+        }
+        log.push({
+            step: step.type,
+            status: result.error ? "failed" : "ok",
+            output: result.output,
+            error: result.error,
+        });
+        if (result.error) {
+            await db
+                .update(workflowRuns)
+                .set({ status: "failed", finishedAt: new Date(), log })
+                .where(eq(workflowRuns.id, run.id));
+            return;
+        }
+    }
+    await db
+        .update(workflowRuns)
+        .set({ status: "completed", finishedAt: new Date(), log })
+        .where(eq(workflowRuns.id, run.id));
+}
+export async function listWorkflowRuns(workflowId) {
+    if (workflowId) {
+        return db.select().from(workflowRuns).where(eq(workflowRuns.workflowId, workflowId));
+    }
+    return db.select().from(workflowRuns);
+}
+//# sourceMappingURL=engine.js.map

package/dist/services/workflows/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/services/workflows/engine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAmC,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAC;AAO5D,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,GAAG,IAAI,CAAC;IAEd,MAAM,eAAe,GAAG,MAAM,EAAE;SAC7B,MAAM,EAAE;SACR,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5C,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1C,MAAM,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAKtC;IACC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;SACD,SAAS,EAAE,CAAC;IACf,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB,EAAE,KAAoB;IAC/E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC;QACN,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,OAAO,EAAE,KAAK,CAAC,OAAkC;QACjD,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,wEAAwE;IACxE,MAAM,KAAK,CAAC,OAAO,CAAC;QAClB,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE;KACpD,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,UAAkB;IACpE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,gDAAgD,KAAK,KAAK,UAAU,EAAE,CAAC,CAAC;QACtF,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAgB,EAAE,QAAkB;IAC5D,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAuB,CAAC;IAChF,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAA4B,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,GAAG,GAA6F,EAAE,CAAC;IAEzG,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YACtC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,EAAE;iBACL,MAAM,CAAC,YAAY,CAAC;iBACpB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC;iBACtD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,YAAY,CAAC;SACpB,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC;SACzD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAmB;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACxC,CAAC"}

package/dist/services/workflows/steps.d.ts

@@ -0,0 +1,17 @@
+import type { User } from "../../db/schema.js";
+export interface StepContext {
+    payload: Record<string, unknown>;
+    outputs: Record<string, string>;
+    user?: User;
+}
+export interface WorkflowStep {
+    type: string;
+    name?: string;
+    [key: string]: unknown;
+}
+export interface StepResult {
+    output?: Record<string, string>;
+    error?: string;
+}
+export declare function executeStep(step: WorkflowStep, context: StepContext): Promise<StepResult>;
+//# sourceMappingURL=steps.d.ts.map

package/dist/services/workflows/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/services/workflows/steps.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AASD,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAgG/F"}