@kelpie/server 0.1.0

package/dist/modules/webhooks/delivery.js

@@ -0,0 +1,237 @@
+import { z } from 'zod';
+import { describeThrown } from '../../lib/errors.js';
+import * as repository from './repository.js';
+import { deliveryBody, deliveryHeaders, renderDeliveryBody, signDeliveryBody } from './signing.js';
+/**
+ * The delivery engine: a consumer of the internal event bus that turns one
+ * domain event into one signed HTTP request per subscribed webhook.
+ *
+ * It runs after the emitting transaction commits and is not awaited by the
+ * request that caused it (`runtime/transaction.ts`), so an unreachable endpoint
+ * slows nobody down.
+ *
+ * Delivery is at-least-once and there is no durable queue, the same caveat the
+ * bus itself carries. A crash between the commit and the last attempt loses the
+ * delivery; the retry budget below is deliberately small so a graceful shutdown
+ * is not held open for minutes waiting for an endpoint that is already gone.
+ */
+/** How long one attempt may take before it counts as failed. */
+export const DELIVERY_TIMEOUT_MS = 10_000;
+/** Waits between attempts. Its length plus one is the attempt budget. */
+export const RETRY_DELAYS_MS = [1_000, 5_000, 15_000];
+export const MAX_DELIVERY_ATTEMPTS = RETRY_DELAYS_MS.length + 1;
+/**
+ * @param attempts How many attempts have already been made.
+ * @returns How long to wait before the next one, or undefined when the budget
+ *   is spent and the delivery has failed for good.
+ */
+export function retryDelayAfter(attempts) {
+    return RETRY_DELAYS_MS[attempts - 1];
+}
+const DAY_MS = 86_400_000;
+/** What an unset `WEBHOOK_DELIVERY_RETENTION_DAYS` means. */
+export const DEFAULT_DELIVERY_RETENTION_DAYS = 30;
+/**
+ * The environment slice for the delivery log's retention window. Validated at
+ * boot through `context.config`, so a malformed value stops the service with
+ * the module named rather than quietly pruning by the wrong window.
+ *
+ * Optional with a stated default, unlike most of the environment: absence is
+ * the normal state for an operator who does not care how long the log is, and
+ * the README's configuration table carries the default so it is not silent.
+ * Blank counts as absent, the `SECRET_ENCRYPTION_KEY_PREVIOUS` rule: operators
+ * empty a line far more often than they delete it.
+ */
+export const deliveryRetentionConfigSchema = z.object({
+    WEBHOOK_DELIVERY_RETENTION_DAYS: z
+        .string()
+        .optional()
+        .transform((value) => (value === undefined || value.trim().length === 0 ? undefined : value))
+        .refine((value) => value === undefined || (Number.isInteger(Number(value)) && Number(value) >= 1), { message: 'must be a whole number of days, at least 1' })
+        .transform((value) => value === undefined ? DEFAULT_DELIVERY_RETENTION_DAYS : Number(value)),
+});
+/** The moment a log row written before has outlived its retention. */
+export function retentionCutoff(at, retentionDays) {
+    return new Date(at.getTime() - retentionDays * DAY_MS);
+}
+export function sleepFor(milliseconds) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, milliseconds);
+    });
+}
+/**
+ * The real sender.
+ *
+ * Redirects are not followed. A customer whose endpoint moved should see the
+ * `301` and update the registration, rather than have Kelpie quietly post
+ * workspace data to whichever host the old one now points at.
+ *
+ * The catch is broad because this is the process boundary: `fetch` rejects with
+ * anything from a DNS failure to an abort, the set is open, and turning all of
+ * it into one outcome is the port's whole job. Nothing is swallowed — the
+ * reason reaches the log and the delivery is recorded as failed.
+ */
+export function createHttpSender(fetchImplementation = fetch) {
+    return async (request) => {
+        try {
+            const response = await fetchImplementation(request.url, {
+                method: 'POST',
+                body: request.body,
+                headers: request.headers,
+                redirect: 'manual',
+                signal: AbortSignal.timeout(DELIVERY_TIMEOUT_MS),
+            });
+            return response.ok
+                ? { delivered: true, status: response.status, reason: null }
+                : {
+                    delivered: false,
+                    status: response.status,
+                    reason: `endpoint answered ${String(response.status)}`,
+                };
+        }
+        catch (error) {
+            return { delivered: false, status: null, reason: describeThrown(error) };
+        }
+    };
+}
+export function createDeliveryEngine(dependencies) {
+    /**
+     * Writes the outcome: one log row, the expired rows gone, and the webhook's
+     * status when it moved.
+     *
+     * One transaction, so a reader never sees a hook marked failing with no
+     * failure recorded against it.
+     *
+     * Retention is enforced here rather than by a schedule because there is no
+     * scheduler in the service, and the log only grows through this function —
+     * pruning on every append caps the table exactly where the growth happens.
+     * The cost is the documented residue: a hook that stops delivering keeps its
+     * last window of rows until the hook or the workspace is deleted.
+     */
+    async function record(webhook, payload, delivery) {
+        const nextStatus = delivery.outcome.delivered ? 'active' : 'failing';
+        const pruned = await dependencies.transaction(async ({ tx }) => {
+            await repository.insertDelivery(tx, {
+                id: delivery.id,
+                workspaceId: webhook.workspaceId,
+                webhookId: webhook.id,
+                event: payload.event,
+                payload: delivery.body,
+                status: delivery.outcome.delivered ? 'success' : 'failed',
+                attempts: delivery.attempts,
+                // `created_at` is when the delivery was built, which is the `created_at`
+                // inside the payload too, so the log row and what the receiver holds
+                // agree. `delivered_at` is when it actually landed, up to the whole
+                // retry budget later.
+                deliveredAt: delivery.outcome.delivered ? dependencies.now() : null,
+                createdAt: delivery.sentAt,
+            });
+            // The cutoff is later than the row above's `created_at` for any positive
+            // window, so a prune can never take the delivery it arrived with, and
+            // `last_delivery_*` always has a row to read.
+            const expired = await repository.deleteExpiredDeliveries(tx, webhook.id, retentionCutoff(dependencies.now(), dependencies.retentionDays));
+            // A paused webhook is never selected for delivery, so the only statuses
+            // reachable here are the two the engine owns. Leaving an unchanged one
+            // alone keeps a healthy endpoint from being rewritten on every event.
+            if (webhook.status !== nextStatus) {
+                await repository.setWebhookStatus(tx, webhook.id, nextStatus);
+            }
+            return expired;
+        });
+        // After the transaction settles: a rollback would make this line a lie.
+        if (pruned > 0) {
+            dependencies.log.debug('pruned expired webhook deliveries', {
+                webhookId: webhook.id,
+                pruned,
+            });
+        }
+    }
+    async function attemptUntilDelivered(request) {
+        let attempts = 0;
+        for (;;) {
+            attempts += 1;
+            const outcome = await dependencies.send(request);
+            if (outcome.delivered) {
+                return { attempts, outcome };
+            }
+            const delay = retryDelayAfter(attempts);
+            if (delay === undefined) {
+                return { attempts, outcome };
+            }
+            await dependencies.sleep(delay);
+        }
+    }
+    /**
+     * Every secret this delivery should be signed under, newest first.
+     *
+     * A secret that will not decrypt throws, and the caller logs it against this
+     * webhook. Deliberately not recorded as a failed delivery: the endpoint did
+     * nothing wrong, Kelpie's key did, and marking the registration `failing`
+     * would send the customer debugging their own server while the real fault is
+     * `SECRET_ENCRYPTION_KEY`.
+     *
+     * The expiry is read here rather than swept by a job. There is no scheduler in
+     * the service, and an overlap that has run out simply stops being signed with;
+     * the column is cleared by the next rotation or by deleting the registration.
+     */
+    function signaturesFor(webhook, text, at) {
+        const signatures = [signDeliveryBody(dependencies.cipher.open(webhook.secretEncrypted), text)];
+        const expiresAt = webhook.previousSecretExpiresAt;
+        if (webhook.previousSecretEncrypted !== null && expiresAt !== null && expiresAt > at) {
+            signatures.push(signDeliveryBody(dependencies.cipher.open(webhook.previousSecretEncrypted), text));
+        }
+        return signatures;
+    }
+    async function deliverTo(webhook, payload) {
+        const deliveryId = dependencies.createId('webhookDelivery');
+        const envelope = {
+            deliveryId,
+            event: payload.event,
+            sentAt: dependencies.now(),
+            workspaceId: payload.workspaceId,
+            data: payload.data,
+        };
+        const body = deliveryBody(envelope);
+        const text = renderDeliveryBody(body);
+        const { attempts, outcome } = await attemptUntilDelivered({
+            url: webhook.url,
+            body: text,
+            headers: deliveryHeaders(envelope, signaturesFor(webhook, text, envelope.sentAt)),
+        });
+        if (!outcome.delivered) {
+            dependencies.log.warn('webhook delivery failed', {
+                webhookId: webhook.id,
+                deliveryId,
+                event: payload.event,
+                attempts,
+                status: outcome.status,
+                reason: outcome.reason,
+            });
+        }
+        // The body is stored as it was sent, so the log answers "what did they
+        // actually receive" rather than "what would we build for this event today".
+        await record(webhook, payload, { id: deliveryId, sentAt: envelope.sentAt, body, attempts, outcome });
+    }
+    return {
+        async deliver(payload) {
+            const subscribed = await repository.listSubscribed(dependencies.db, payload.workspaceId, payload.event);
+            if (subscribed.length === 0) {
+                return;
+            }
+            // One unreachable endpoint, or one row whose secret will not decrypt,
+            // must not stop the others. Same reason the bus settles its handlers
+            // rather than racing them.
+            const outcomes = await Promise.allSettled(subscribed.map((webhook) => deliverTo(webhook, payload)));
+            for (const [index, outcome] of outcomes.entries()) {
+                if (outcome.status === 'rejected') {
+                    dependencies.log.error('webhook delivery could not be attempted', {
+                        webhookId: subscribed[index]?.id,
+                        event: payload.event,
+                        error: describeThrown(outcome.reason),
+                    });
+                }
+            }
+        },
+    };
+}
+//# sourceMappingURL=delivery.js.map

package/dist/modules/webhooks/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../../../src/modules/webhooks/delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAMpD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGlG;;;;;;;;;;;;GAYG;AAEH,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAEzC,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAA;AAE/D;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,eAAe,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,CAAA;AAEzB,6DAA6D;AAC7D,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAA;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,+BAA+B,EAAE,CAAC;SAC/B,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;SAC5F,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EACzF,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAC1D;SACA,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtE;CACJ,CAAC,CAAA;AAIF,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,EAAQ,EAAE,aAAqB;IAC7D,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,aAAa,GAAG,MAAM,CAAC,CAAA;AACxD,CAAC;AAqBD,MAAM,UAAU,QAAQ,CAAC,YAAoB;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,mBAAmB,GAAiB,KAAK;IACxE,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;aACjD,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAC,EAAE;gBAChB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;gBAC5D,CAAC,CAAC;oBACE,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;iBACvD,CAAA;QACP,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAA;QAC1E,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAqBD,MAAM,UAAU,oBAAoB,CAAC,YAAkC;IACrE;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,MAAM,CACnB,OAAsB,EACtB,OAA4B,EAC5B,QAMC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QAEpE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;YAC7D,MAAM,UAAU,CAAC,cAAc,CAAC,EAAE,EAAE;gBAClC,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,QAAQ,CAAC,IAAI;gBACtB,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;gBACzD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,yEAAyE;gBACzE,qEAAqE;gBACrE,oEAAoE;gBACpE,sBAAsB;gBACtB,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;gBACnE,SAAS,EAAE,QAAQ,CAAC,MAAM;aAC3B,CAAC,CAAA;YAEF,yEAAyE;YACzE,sEAAsE;YACtE,8CAA8C;YAC9C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,uBAAuB,CACtD,EAAE,EACF,OAAO,CAAC,EAAE,EACV,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,aAAa,CAAC,CAChE,CAAA;YAED,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,UAAU,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;YAC/D,CAAC;YAED,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAA;QAEF,wEAAwE;QACxE,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,mCAAmC,EAAE;gBAC1D,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,qBAAqB,CAAC,OAAwB;QAI3D,IAAI,QAAQ,GAAG,CAAC,CAAA;QAEhB,SAAS,CAAC;YACR,QAAQ,IAAI,CAAC,CAAA;YAEb,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAEhD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;YAC9B,CAAC;YAED,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;YAEvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;YAC9B,CAAC;YAED,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,aAAa,CAAC,OAAsB,EAAE,IAAY,EAAE,EAAQ;QACnE,MAAM,UAAU,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;QAC9F,MAAM,SAAS,GAAG,OAAO,CAAC,uBAAuB,CAAA;QAEjD,IAAI,OAAO,CAAC,uBAAuB,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,EAAE,EAAE,CAAC;YACrF,UAAU,CAAC,IAAI,CACb,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAClF,CAAA;QACH,CAAC;QAED,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,OAAsB,EAAE,OAA4B;QAC3E,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;QAC3D,MAAM,QAAQ,GAAqB;YACjC,UAAU;YACV,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAA;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACnC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAAC;YACxD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;SAClF,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAC/C,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,UAAU;gBACV,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACtG,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,cAAc,CAChD,YAAY,CAAC,EAAE,EACf,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,KAAK,CACd,CAAA;YAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAM;YACR,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CACvC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CACzD,CAAA;YAED,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAClC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,yCAAyC,EAAE;wBAChE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE;wBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;qBACtC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/webhooks/index.d.ts

@@ -0,0 +1,23 @@
+import type { KelpieModule } from '../../runtime/module.ts';
+import type { SendDelivery, Sleep } from './delivery.ts';
+/**
+ * Webhooks: registration, and the engine that bridges the internal event bus to
+ * outbound HTTP.
+ *
+ * `requires` is `workspace` alone. The engine consumes events by name and never
+ * reads the tables behind them, so it does not depend on the modules that emit
+ * them — a payload carries the record's type and id and nothing else, which is
+ * what keeps this module from growing a dependency on every CRM module in turn.
+ *
+ * Subscription happens during `register`, and `architecture.md` fixes this
+ * module near the end of the core order, so every emitting module is already in
+ * place. Nothing depends on that: the bus resolves handlers at publication.
+ */
+export interface WebhooksModuleOptions {
+    /** Injected by tests so no suite makes a network call. */
+    readonly send?: SendDelivery;
+    /** Injected by tests so no suite spends the retry budget in real time. */
+    readonly sleep?: Sleep;
+}
+export declare function createWebhooksModule(migrationsDirectory: string, options?: WebhooksModuleOptions): KelpieModule;
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAO3D,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAOxD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CACvB;AAED,wBAAgB,oBAAoB,CAClC,mBAAmB,EAAE,MAAM,EAC3B,OAAO,GAAE,qBAA0B,GAClC,YAAY,CA8Cd"}

package/dist/modules/webhooks/index.js

@@ -0,0 +1,48 @@
+import { createSecretCipher, secretEncryptionConfigSchema } from '../../lib/secrets.js';
+import { createDeliveryEngine, createHttpSender, deliveryRetentionConfigSchema, sleepFor, } from './delivery.js';
+import { subscribeDeliverableEvents } from './payloads.js';
+import { mountWebhooksRoutes } from './routes.js';
+import * as schema from './schema.js';
+import { createWebhooksService } from './service.js';
+import { registerWebhooksTools } from './tools.js';
+export function createWebhooksModule(migrationsDirectory, options = {}) {
+    return {
+        id: 'webhooks',
+        requires: ['workspace'],
+        register(context) {
+            // Validated at boot rather than on the first delivery: a missing or
+            // malformed key means no webhook can ever be signed, and finding that out
+            // when a customer's endpoint goes quiet is far too late. The retention
+            // window is validated the same way for the same reason — a bad value
+            // should stop boot, not prune by the wrong window.
+            const cipher = createSecretCipher(context.config(secretEncryptionConfigSchema));
+            const retention = context.config(deliveryRetentionConfigSchema);
+            const service = createWebhooksService({
+                db: context.db,
+                transaction: context.transaction,
+                createId: context.createId,
+                now: context.now,
+                cipher,
+            });
+            const engine = createDeliveryEngine({
+                db: context.db,
+                transaction: context.transaction,
+                createId: context.createId,
+                now: context.now,
+                cipher,
+                send: options.send ?? createHttpSender(),
+                sleep: options.sleep ?? sleepFor,
+                retentionDays: retention.WEBHOOK_DELIVERY_RETENTION_DAYS,
+                log: context.log,
+            });
+            context.schema(schema, migrationsDirectory);
+            subscribeDeliverableEvents(context.events, (payload) => engine.deliver(payload));
+            context.routes((router) => {
+                mountWebhooksRoutes(router, { db: context.db, now: context.now, service });
+            });
+            registerWebhooksTools(context.mcp, service);
+            return Promise.resolve();
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/modules/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/webhooks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEvF,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,6BAA6B,EAC7B,QAAQ,GACT,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAsBlD,MAAM,UAAU,oBAAoB,CAClC,mBAA2B,EAC3B,OAAO,GAA0B,EAAE;IAEnC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,QAAQ,EAAE,CAAC,WAAW,CAAC;QAEvB,QAAQ,CAAC,OAAO;YACd,oEAAoE;YACpE,0EAA0E;YAC1E,uEAAuE;YACvE,qEAAqE;YACrE,mDAAmD;YACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAA;YAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAE/D,MAAM,OAAO,GAAG,qBAAqB,CAAC;gBACpC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM;aACP,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,oBAAoB,CAAC;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE;gBACxC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,QAAQ;gBAChC,aAAa,EAAE,SAAS,CAAC,+BAA+B;gBACxD,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAC3C,0BAA0B,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YAEhF,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,mBAAmB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC5E,CAAC,CAAC,CAAA;YAEF,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAE3C,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/webhooks/payloads.d.ts

@@ -0,0 +1,31 @@
+import type { WebhookEvent } from '@kelpie/schemas';
+import type { EventBus } from '../../runtime/events.ts';
+/**
+ * The bridge from the internal event catalog to what a webhook receiver sees.
+ *
+ * `modules.md` makes the webhooks engine a consumer of the bus, so this is the
+ * only place that knows both vocabularies. Everything downstream works with a
+ * `WebhookEventPayload` and never sees a `DomainEvents` key.
+ *
+ * Payload keys are `snake_case`, matching `api.md`, because a receiver has no
+ * reason to expect a different convention from a webhook than from the REST
+ * surface it also calls.
+ */
+export type { WebhookEvent };
+/** One event, resolved to the workspace it belongs to and the body to send. */
+export interface WebhookEventPayload {
+    readonly workspaceId: string;
+    readonly event: WebhookEvent;
+    /** The `data` object of the delivery body. */
+    readonly data: Record<string, unknown>;
+}
+/**
+ * Subscribes the engine to every deliverable event.
+ *
+ * Written out one call at a time rather than looped over `WEBHOOK_EVENTS`,
+ * because TypeScript cannot correlate a payload type with a generic key: a loop
+ * would need a cast, and the cast is exactly what would let a wrong payload
+ * through. A literal key indexes `builders` at its precise signature.
+ */
+export declare function subscribeDeliverableEvents(bus: EventBus, deliver: (payload: WebhookEventPayload) => Promise<void>): void;
+//# sourceMappingURL=payloads.d.ts.map

package/dist/modules/webhooks/payloads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payloads.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/payloads.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEnD,OAAO,KAAK,EAAgB,QAAQ,EAAE,MAAM,yBAAyB,CAAA;AAErE;;;;;;;;;;GAUG;AAEH,YAAY,EAAE,YAAY,EAAE,CAAA;AAE5B,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACvC;AA2CD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,GACvD,IAAI,CAKN"}

package/dist/modules/webhooks/payloads.js

@@ -0,0 +1,52 @@
+/**
+ * Payload builders, one per deliverable event.
+ *
+ * `satisfies` is what keeps this honest: adding a name to `WEBHOOK_EVENTS`
+ * without a builder here is a compile error rather than an event that resolves
+ * to nothing at runtime.
+ */
+const builders = {
+    'record.created': (payload) => ({
+        workspaceId: payload.workspaceId,
+        event: 'record.created',
+        data: { object_type: payload.objectType, record_id: payload.recordId },
+    }),
+    'record.updated': (payload) => ({
+        workspaceId: payload.workspaceId,
+        event: 'record.updated',
+        data: {
+            object_type: payload.objectType,
+            record_id: payload.recordId,
+            // The values stay as the emitting service named them, which is camelCase
+            // (`parentId`, `sortOrder`) even though the keys around them are not.
+            // Translating them to the wire spelling would mean a second copy of every
+            // module's column naming, kept in step by hand.
+            changed_fields: [...payload.changedFields],
+        },
+    }),
+    'record.deleted': (payload) => ({
+        workspaceId: payload.workspaceId,
+        event: 'record.deleted',
+        data: { object_type: payload.objectType, record_id: payload.recordId },
+    }),
+    'form.submitted': (payload) => ({
+        workspaceId: payload.workspaceId,
+        event: 'form.submitted',
+        data: { form_id: payload.formId, submission_id: payload.submissionId },
+    }),
+};
+/**
+ * Subscribes the engine to every deliverable event.
+ *
+ * Written out one call at a time rather than looped over `WEBHOOK_EVENTS`,
+ * because TypeScript cannot correlate a payload type with a generic key: a loop
+ * would need a cast, and the cast is exactly what would let a wrong payload
+ * through. A literal key indexes `builders` at its precise signature.
+ */
+export function subscribeDeliverableEvents(bus, deliver) {
+    bus.subscribe('record.created', (payload) => deliver(builders['record.created'](payload)));
+    bus.subscribe('record.updated', (payload) => deliver(builders['record.updated'](payload)));
+    bus.subscribe('record.deleted', (payload) => deliver(builders['record.deleted'](payload)));
+    bus.subscribe('form.submitted', (payload) => deliver(builders['form.submitted'](payload)));
+}
+//# sourceMappingURL=payloads.js.map

package/dist/modules/webhooks/payloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payloads.js","sourceRoot":"","sources":["../../../src/modules/webhooks/payloads.ts"],"names":[],"mappings":"AA0BA;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG;IACf,gBAAgB,EAAE,CAAC,OAAuC,EAAuB,EAAE,CAAC,CAAC;QACnF,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;KACvE,CAAC;IAEF,gBAAgB,EAAE,CAAC,OAAuC,EAAuB,EAAE,CAAC,CAAC;QACnF,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE;YACJ,WAAW,EAAE,OAAO,CAAC,UAAU;YAC/B,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,yEAAyE;YACzE,sEAAsE;YACtE,0EAA0E;YAC1E,gDAAgD;YAChD,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;SAC3C;KACF,CAAC;IAEF,gBAAgB,EAAE,CAAC,OAAuC,EAAuB,EAAE,CAAC,CAAC;QACnF,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;KACvE,CAAC;IAEF,gBAAgB,EAAE,CAAC,OAAuC,EAAuB,EAAE,CAAC,CAAC;QACnF,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE;KACvE,CAAC;CACwF,CAAA;AAE5F;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAa,EACb,OAAwD;IAExD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1F,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1F,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1F,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAC5F,CAAC"}

package/dist/modules/webhooks/repository.d.ts

@@ -0,0 +1,70 @@
+import type { WebhookDeliveryStatus, WebhookEvent, WebhookStatus } from '@kelpie/schemas';
+import type { ListWindow, SortableFields } from '../../lib/pagination.ts';
+import type { Queryable } from '../../runtime/transaction.ts';
+import { webhookDeliveries, webhooks } from './schema.ts';
+export type WebhookRecord = typeof webhooks.$inferSelect;
+export type WebhookColumns = typeof webhooks.$inferInsert;
+export type DeliveryRecord = typeof webhookDeliveries.$inferSelect;
+export type DeliveryColumns = typeof webhookDeliveries.$inferInsert;
+export declare const WEBHOOK_SORTS: SortableFields<WebhookRecord>;
+export declare const DEFAULT_WEBHOOK_SORT = "-created_at";
+export declare const DELIVERY_SORTS: SortableFields<DeliveryRecord>;
+/** Newest first: a delivery log is read to find out what just happened. */
+export declare const DEFAULT_DELIVERY_SORT = "-created_at";
+export interface WebhookFilters {
+    readonly status?: WebhookStatus | undefined;
+}
+export interface DeliveryFilters {
+    readonly status?: WebhookDeliveryStatus | undefined;
+}
+/** The last settled delivery for one webhook, as the list view reports it. */
+export interface LastDelivery {
+    readonly at: Date;
+    readonly status: WebhookDeliveryStatus;
+}
+export declare function listWebhooks(db: Queryable, workspaceId: string, filters: WebhookFilters, window: ListWindow<WebhookRecord>): Promise<WebhookRecord[]>;
+export declare function findWebhook(db: Queryable, workspaceId: string, id: string): Promise<WebhookRecord | undefined>;
+/**
+ * The registrations one event should reach.
+ *
+ * `paused` is excluded and `failing` is not: pausing is the customer saying
+ * stop, while failing is a report on the endpoint. A failing webhook keeps
+ * being tried, which is the only way it can return to `active` by itself.
+ */
+export declare function listSubscribed(db: Queryable, workspaceId: string, event: WebhookEvent): Promise<WebhookRecord[]>;
+/**
+ * The most recent settled delivery per webhook, for the `last_delivery_*` fields.
+ *
+ * Derived rather than stored. `schema.md` gives `webhooks` no delivery columns,
+ * and a denormalised copy of the log's newest row is a second source of truth
+ * that can only ever drift from it.
+ *
+ * @param webhookIds At most one page of ids, so the `in` list is bounded by the
+ *   same ceiling `?limit=` is.
+ */
+export declare function findLastDeliveries(db: Queryable, webhookIds: readonly string[]): Promise<ReadonlyMap<string, LastDelivery>>;
+export declare function insertWebhook(db: Queryable, values: WebhookColumns): Promise<WebhookRecord>;
+export declare function updateWebhook(db: Queryable, workspaceId: string, id: string, changes: Partial<WebhookColumns>): Promise<WebhookRecord | undefined>;
+/**
+ * Moves a webhook between `active` and `failing` after a delivery settles.
+ *
+ * Deliberately does not touch `updated_at`. That column answers "when did
+ * somebody last change this registration", and a customer compares it against
+ * `last_delivery_at` to see whether their fix took effect. The engine moving it
+ * would destroy that comparison.
+ */
+export declare function setWebhookStatus(db: Queryable, id: string, status: WebhookStatus): Promise<void>;
+export declare function deleteWebhook(db: Queryable, workspaceId: string, id: string): Promise<number>;
+export declare function insertDelivery(db: Queryable, values: DeliveryColumns): Promise<DeliveryRecord>;
+/**
+ * Deletes this webhook's log rows older than the cutoff.
+ *
+ * Scoped to one webhook rather than the workspace so the delete walks
+ * `webhook_deliveries_webhook_idx` — the workspace column has no index here,
+ * and the engine calls this on every recorded delivery.
+ *
+ * @returns How many rows went, for the engine's log line.
+ */
+export declare function deleteExpiredDeliveries(db: Queryable, webhookId: string, before: Date): Promise<number>;
+export declare function listDeliveries(db: Queryable, workspaceId: string, webhookId: string, filters: DeliveryFilters, window: ListWindow<DeliveryRecord>): Promise<DeliveryRecord[]>;
+//# sourceMappingURL=repository.d.ts.map

package/dist/modules/webhooks/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../src/modules/webhooks/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAKzF,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEzD,MAAM,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAA;AACxD,MAAM,MAAM,cAAc,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAA;AACzD,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,YAAY,CAAA;AAClE,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,YAAY,CAAA;AAEnE,eAAO,MAAM,aAAa,EAAE,cAAc,CAAC,aAAa,CAGvD,CAAA;AAED,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAEjD,eAAO,MAAM,cAAc,EAAE,cAAc,CAAC,cAAc,CAEzD,CAAA;AAED,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,gBAAgB,CAAA;AAElD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;CAC5C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAA;CACpD;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CACvC;AASD,wBAAgB,YAAY,CAC1B,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,GAChC,OAAO,CAAC,aAAa,EAAE,CAAC,CAO1B;AAED,wBAAsB,WAAW,CAC/B,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAQpC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,aAAa,EAAE,CAAC,CAW1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAkB5C;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAQjG;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAC/B,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAQpC;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,wBAAgB,cAAc,CAC5B,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,GACjC,OAAO,CAAC,cAAc,EAAE,CAAC,CAc3B"}

package/dist/modules/webhooks/repository.js

@@ -0,0 +1,140 @@
+import { and, arrayContains, desc, eq, inArray, lt, ne } from 'drizzle-orm';
+import { keysetCondition, orderByWindow, timestampSort } from '../../lib/pagination.js';
+import { webhookDeliveries, webhooks } from './schema.js';
+export const WEBHOOK_SORTS = {
+    created_at: timestampSort(webhooks.createdAt, (webhook) => webhook.createdAt),
+    updated_at: timestampSort(webhooks.updatedAt, (webhook) => webhook.updatedAt),
+};
+export const DEFAULT_WEBHOOK_SORT = '-created_at';
+export const DELIVERY_SORTS = {
+    created_at: timestampSort(webhookDeliveries.createdAt, (delivery) => delivery.createdAt),
+};
+/** Newest first: a delivery log is read to find out what just happened. */
+export const DEFAULT_DELIVERY_SORT = '-created_at';
+function conditionsFor(workspaceId, filters) {
+    return [
+        eq(webhooks.workspaceId, workspaceId),
+        filters.status === undefined ? undefined : eq(webhooks.status, filters.status),
+    ];
+}
+export function listWebhooks(db, workspaceId, filters, window) {
+    return db
+        .select()
+        .from(webhooks)
+        .where(and(...conditionsFor(workspaceId, filters), keysetCondition(window, webhooks.id)))
+        .orderBy(...orderByWindow(window, webhooks.id))
+        .limit(window.fetchLimit);
+}
+export async function findWebhook(db, workspaceId, id) {
+    const [found] = await db
+        .select()
+        .from(webhooks)
+        .where(and(eq(webhooks.workspaceId, workspaceId), eq(webhooks.id, id)))
+        .limit(1);
+    return found;
+}
+/**
+ * The registrations one event should reach.
+ *
+ * `paused` is excluded and `failing` is not: pausing is the customer saying
+ * stop, while failing is a report on the endpoint. A failing webhook keeps
+ * being tried, which is the only way it can return to `active` by itself.
+ */
+export function listSubscribed(db, workspaceId, event) {
+    return db
+        .select()
+        .from(webhooks)
+        .where(and(eq(webhooks.workspaceId, workspaceId), ne(webhooks.status, 'paused'), arrayContains(webhooks.events, [event])));
+}
+/**
+ * The most recent settled delivery per webhook, for the `last_delivery_*` fields.
+ *
+ * Derived rather than stored. `schema.md` gives `webhooks` no delivery columns,
+ * and a denormalised copy of the log's newest row is a second source of truth
+ * that can only ever drift from it.
+ *
+ * @param webhookIds At most one page of ids, so the `in` list is bounded by the
+ *   same ceiling `?limit=` is.
+ */
+export async function findLastDeliveries(db, webhookIds) {
+    if (webhookIds.length === 0) {
+        return new Map();
+    }
+    const rows = await db
+        .selectDistinctOn([webhookDeliveries.webhookId], {
+        webhookId: webhookDeliveries.webhookId,
+        createdAt: webhookDeliveries.createdAt,
+        status: webhookDeliveries.status,
+    })
+        .from(webhookDeliveries)
+        .where(inArray(webhookDeliveries.webhookId, [...webhookIds]))
+        // The id breaks a tie: several deliveries of one event land in the same
+        // millisecond, and ULIDs order by creation within one.
+        .orderBy(webhookDeliveries.webhookId, desc(webhookDeliveries.createdAt), desc(webhookDeliveries.id));
+    return new Map(rows.map((row) => [row.webhookId, { at: row.createdAt, status: row.status }]));
+}
+export async function insertWebhook(db, values) {
+    const [created] = await db.insert(webhooks).values(values).returning();
+    if (created === undefined) {
+        throw new Error(`Inserting webhook ${values.id} returned no row`);
+    }
+    return created;
+}
+export async function updateWebhook(db, workspaceId, id, changes) {
+    const [updated] = await db
+        .update(webhooks)
+        .set(changes)
+        .where(and(eq(webhooks.workspaceId, workspaceId), eq(webhooks.id, id)))
+        .returning();
+    return updated;
+}
+/**
+ * Moves a webhook between `active` and `failing` after a delivery settles.
+ *
+ * Deliberately does not touch `updated_at`. That column answers "when did
+ * somebody last change this registration", and a customer compares it against
+ * `last_delivery_at` to see whether their fix took effect. The engine moving it
+ * would destroy that comparison.
+ */
+export async function setWebhookStatus(db, id, status) {
+    await db.update(webhooks).set({ status }).where(eq(webhooks.id, id));
+}
+export async function deleteWebhook(db, workspaceId, id) {
+    const deleted = await db
+        .delete(webhooks)
+        .where(and(eq(webhooks.workspaceId, workspaceId), eq(webhooks.id, id)))
+        .returning({ id: webhooks.id });
+    return deleted.length;
+}
+export async function insertDelivery(db, values) {
+    const [created] = await db.insert(webhookDeliveries).values(values).returning();
+    if (created === undefined) {
+        throw new Error(`Inserting webhook delivery ${values.id} returned no row`);
+    }
+    return created;
+}
+/**
+ * Deletes this webhook's log rows older than the cutoff.
+ *
+ * Scoped to one webhook rather than the workspace so the delete walks
+ * `webhook_deliveries_webhook_idx` — the workspace column has no index here,
+ * and the engine calls this on every recorded delivery.
+ *
+ * @returns How many rows went, for the engine's log line.
+ */
+export async function deleteExpiredDeliveries(db, webhookId, before) {
+    const deleted = await db
+        .delete(webhookDeliveries)
+        .where(and(eq(webhookDeliveries.webhookId, webhookId), lt(webhookDeliveries.createdAt, before)))
+        .returning({ id: webhookDeliveries.id });
+    return deleted.length;
+}
+export function listDeliveries(db, workspaceId, webhookId, filters, window) {
+    return db
+        .select()
+        .from(webhookDeliveries)
+        .where(and(eq(webhookDeliveries.workspaceId, workspaceId), eq(webhookDeliveries.webhookId, webhookId), filters.status === undefined ? undefined : eq(webhookDeliveries.status, filters.status), keysetCondition(window, webhookDeliveries.id)))
+        .orderBy(...orderByWindow(window, webhookDeliveries.id))
+        .limit(window.fetchLimit);
+}
+//# sourceMappingURL=repository.js.map