@marinoscar/platform-api 0.1.0-next.19 → 0.1.0-next.21

package/dist/webhooks/webhook-secrets.service.d.ts

@@ -0,0 +1,49 @@
+import { CredentialsService, OrgCredentialsService, UserCredentialsService } from '../credentials/index';
+import type { WebhookEndpointRow } from './data/webhooks-db';
+/** The columns of an endpoint the store addresses by. @stability experimental */
+export type SecretAddress = Pick<WebhookEndpointRow, 'id' | 'scope' | 'orgId' | 'ownerUserId'>;
+/**
+ * The credential name of one secret version.
+ *
+ * @param endpointId - the endpoint id.
+ * @param version - the secret version.
+ * @returns `endpoint:<id>:v<version>`.
+ *
+ * @stability experimental
+ */
+export declare function secretName(endpointId: string, version: number): string;
+/**
+ * The signing-secret port. See the file header.
+ *
+ * @stability experimental
+ */
+export declare abstract class WebhookSecrets {
+    /** Stores version `version` of an endpoint's secret. */
+    abstract put(endpoint: SecretAddress, version: number, secret: string): Promise<void>;
+    /** Reads a version, or `null` when it is gone. */
+    abstract get(endpoint: SecretAddress, version: number): Promise<string | null>;
+    /** Deletes one version (a rotation's expired predecessor). */
+    abstract remove(endpoint: SecretAddress, version: number): Promise<void>;
+    /** Deletes versions `1..upTo` of an endpoint (its deletion). */
+    abstract removeAll(endpoint: SecretAddress, upTo: number): Promise<void>;
+}
+/**
+ * The credentials-store implementation.
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+export declare class CredentialsWebhookSecrets extends WebhookSecrets {
+    private readonly userCredentials;
+    private readonly orgCredentials;
+    private readonly systemCredentials;
+    constructor(userCredentials: UserCredentialsService, orgCredentials: OrgCredentialsService, systemCredentials: CredentialsService);
+    put(endpoint: SecretAddress, version: number, secret: string): Promise<void>;
+    get(endpoint: SecretAddress, version: number): Promise<string | null>;
+    remove(endpoint: SecretAddress, version: number): Promise<void>;
+    removeAll(endpoint: SecretAddress, upTo: number): Promise<void>;
+    private owner;
+    private org;
+}
+//# sourceMappingURL=webhook-secrets.service.d.ts.map

package/dist/webhooks/webhook-secrets.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-secrets.service.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-secrets.service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,EAAE,IAAI,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,CAAC,CAAC;AAE/F;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED;;;;GAIG;AACH,8BAAsB,cAAc;IAClC,wDAAwD;IACxD,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACrF,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAC9E,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACxE,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CACzE;AAED;;;;;;GAMG;AACH,qBACa,yBAA0B,SAAQ,cAAc;IAEzD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,eAAe,EAAE,sBAAsB,EACvC,cAAc,EAAE,qBAAqB,EACrC,iBAAiB,EAAE,kBAAkB;IAKlD,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5E,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAOrE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,GAAG;CAIZ"}

package/dist/webhooks/webhook-secrets.service.js

@@ -0,0 +1,118 @@
+"use strict";
+// =============================================================================
+// WebhookSecretsService: an endpoint's signing secrets (issue #1046)
+// =============================================================================
+//
+// The secret is never a column and never in a delivery row. It lives in the
+// encrypted credentials store, in the tier that matches the endpoint:
+//
+//   user scope    UserCredentialsService   (the owner's own store)
+//   org scope     OrgCredentialsService    (the organization's store)
+//   system scope  CredentialsService       (the deployment's store)
+//
+// under the purpose `webhook_signing` and the name `endpoint:<id>:v<version>`.
+// A rotation writes version N+1 and keeps N for the overlap window; the
+// endpoint row's `secretVersion` says which is current.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialsWebhookSecrets = exports.WebhookSecrets = void 0;
+exports.secretName = secretName;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../credentials/index");
+const webhooks_constants_1 = require("./webhooks.constants");
+/**
+ * The credential name of one secret version.
+ *
+ * @param endpointId - the endpoint id.
+ * @param version - the secret version.
+ * @returns `endpoint:<id>:v<version>`.
+ *
+ * @stability experimental
+ */
+function secretName(endpointId, version) {
+    return `endpoint:${endpointId}:v${version}`;
+}
+/**
+ * The signing-secret port. See the file header.
+ *
+ * @stability experimental
+ */
+class WebhookSecrets {
+}
+exports.WebhookSecrets = WebhookSecrets;
+/**
+ * The credentials-store implementation.
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+let CredentialsWebhookSecrets = class CredentialsWebhookSecrets extends WebhookSecrets {
+    userCredentials;
+    orgCredentials;
+    systemCredentials;
+    constructor(userCredentials, orgCredentials, systemCredentials) {
+        super();
+        this.userCredentials = userCredentials;
+        this.orgCredentials = orgCredentials;
+        this.systemCredentials = systemCredentials;
+    }
+    async put(endpoint, version, secret) {
+        const name = secretName(endpoint.id, version);
+        const label = 'Webhook signing secret';
+        if (endpoint.scope === 'user')
+            await this.userCredentials.setSecret(this.owner(endpoint), webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name, secret, { label });
+        else if (endpoint.scope === 'org')
+            await this.orgCredentials.setSecret(this.org(endpoint), webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name, secret, { label });
+        else
+            await this.systemCredentials.setSecret(webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name, secret, { label });
+    }
+    async get(endpoint, version) {
+        const name = secretName(endpoint.id, version);
+        if (endpoint.scope === 'user')
+            return this.userCredentials.getSecret(this.owner(endpoint), webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name);
+        if (endpoint.scope === 'org')
+            return this.orgCredentials.getSecret(this.org(endpoint), webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name);
+        return this.systemCredentials.getSecret(webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name);
+    }
+    async remove(endpoint, version) {
+        const name = secretName(endpoint.id, version);
+        if (endpoint.scope === 'user')
+            await this.userCredentials.deleteSecret(this.owner(endpoint), webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name);
+        else if (endpoint.scope === 'org')
+            await this.orgCredentials.deleteSecret(this.org(endpoint), webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name);
+        else
+            await this.systemCredentials.deleteSecret(webhooks_constants_1.WEBHOOK_SIGNING_PURPOSE, name);
+    }
+    async removeAll(endpoint, upTo) {
+        for (let version = 1; version <= upTo; version += 1)
+            await this.remove(endpoint, version);
+    }
+    owner(endpoint) {
+        if (!endpoint.ownerUserId)
+            throw new Error('A user-scope webhook endpoint has no owner');
+        return endpoint.ownerUserId;
+    }
+    org(endpoint) {
+        if (!endpoint.orgId)
+            throw new Error('An org-scope webhook endpoint has no organization');
+        return endpoint.orgId;
+    }
+};
+exports.CredentialsWebhookSecrets = CredentialsWebhookSecrets;
+exports.CredentialsWebhookSecrets = CredentialsWebhookSecrets = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.UserCredentialsService,
+        index_1.OrgCredentialsService,
+        index_1.CredentialsService])
+], CredentialsWebhookSecrets);
+//# sourceMappingURL=webhook-secrets.service.js.map

package/dist/webhooks/webhook-secrets.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-secrets.service.js","sourceRoot":"","sources":["../../src/webhooks/webhook-secrets.service.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,qEAAqE;AACrE,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,wDAAwD;AACxD,gFAAgF;;;;;;;;;;;;AAoBhF,gCAEC;AApBD,2CAA4C;AAE5C,gDAAyG;AAEzG,6DAA+D;AAK/D;;;;;;;;GAQG;AACH,SAAgB,UAAU,CAAC,UAAkB,EAAE,OAAe;IAC5D,OAAO,YAAY,UAAU,KAAK,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAsB,cAAc;CASnC;AATD,wCASC;AAED;;;;;;GAMG;AAEI,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,cAAc;IAExC;IACA;IACA;IAHnB,YACmB,eAAuC,EACvC,cAAqC,EACrC,iBAAqC;QAEtD,KAAK,EAAE,CAAC;QAJS,oBAAe,GAAf,eAAe,CAAwB;QACvC,mBAAc,GAAd,cAAc,CAAuB;QACrC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAGxD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAuB,EAAE,OAAe,EAAE,MAAc;QAChE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,wBAAwB,CAAC;QACvC,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM;YAAE,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,4CAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;aACvI,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,4CAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;;YACxI,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,4CAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAuB,EAAE,OAAe;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,4CAAuB,EAAE,IAAI,CAAC,CAAC;QAC1H,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,4CAAuB,EAAE,IAAI,CAAC,CAAC;QACtH,OAAO,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,4CAAuB,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAuB,EAAE,OAAe;QACnD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM;YAAE,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,4CAAuB,EAAE,IAAI,CAAC,CAAC;aACvH,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,4CAAuB,EAAE,IAAI,CAAC,CAAC;;YACxH,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,4CAAuB,EAAE,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAuB,EAAE,IAAY;QACnD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,EAAE,OAAO,IAAI,CAAC;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,QAAuB;QACnC,IAAI,CAAC,QAAQ,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC,WAAW,CAAC;IAC9B,CAAC;IAEO,GAAG,CAAC,QAAuB;QACjC,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1F,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;CACF,CAAA;AA5CY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAGyB,8BAAsB;QACvB,6BAAqB;QAClB,0BAAkB;GAJ7C,yBAAyB,CA4CrC"}

package/dist/webhooks/webhook-views.d.ts

@@ -0,0 +1,34 @@
+import type { WebhookDelivery, WebhookDeliveryDetail, WebhookEndpoint } from '@marinoscar/platform-contract/webhooks';
+import type { WebhookDeliveryRow, WebhookEndpointRow } from './data/webhooks-db';
+/**
+ * An endpoint row as the API serves it. There is no secret column to leak; the
+ * view lists exactly the contract's fields.
+ *
+ * @param row - the row.
+ * @returns the wire shape.
+ *
+ * @stability experimental
+ */
+export declare function toEndpointView(row: WebhookEndpointRow): WebhookEndpoint;
+/**
+ * A delivery row as the list serves it (no payload).
+ *
+ * @param row - the row.
+ * @returns the wire shape.
+ *
+ * @stability experimental
+ */
+export declare function toDeliveryView(row: WebhookDeliveryRow): WebhookDelivery;
+/**
+ * One delivery with its payload and the request headers that are stable across
+ * attempts. The signature and the timestamp are computed per attempt and never
+ * stored, so neither is shown.
+ *
+ * @param row - the row.
+ * @param userAgent - the `User-Agent` the slice sends.
+ * @returns the wire shape.
+ *
+ * @stability experimental
+ */
+export declare function toDeliveryDetail(row: WebhookDeliveryRow, userAgent: string): WebhookDeliveryDetail;
+//# sourceMappingURL=webhook-views.d.ts.map

package/dist/webhooks/webhook-views.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-views.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-views.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,eAAe,EAChB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIjF;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,kBAAkB,GAAG,eAAe,CAoBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,kBAAkB,GAAG,eAAe,CAgBvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAMlG"}

package/dist/webhooks/webhook-views.js

@@ -0,0 +1,83 @@
+"use strict";
+// =============================================================================
+// Row to wire shape (issue #1046)
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toEndpointView = toEndpointView;
+exports.toDeliveryView = toDeliveryView;
+exports.toDeliveryDetail = toDeliveryDetail;
+const iso = (value) => (value ? value.toISOString() : null);
+/**
+ * An endpoint row as the API serves it. There is no secret column to leak; the
+ * view lists exactly the contract's fields.
+ *
+ * @param row - the row.
+ * @returns the wire shape.
+ *
+ * @stability experimental
+ */
+function toEndpointView(row) {
+    return {
+        id: row.id,
+        scope: row.scope,
+        orgId: row.orgId,
+        ownerUserId: row.ownerUserId,
+        name: row.name,
+        description: row.description,
+        url: row.url,
+        eventKeys: [...row.eventKeys],
+        enabled: row.enabled,
+        disabledReason: row.disabledReason,
+        consecutiveFailures: row.consecutiveFailures,
+        secretVersion: row.secretVersion,
+        previousSecretUntil: iso(row.previousSecretUntil),
+        lastDeliveryAt: iso(row.lastDeliveryAt),
+        lastSuccessAt: iso(row.lastSuccessAt),
+        createdAt: row.createdAt.toISOString(),
+        updatedAt: row.updatedAt.toISOString(),
+    };
+}
+/**
+ * A delivery row as the list serves it (no payload).
+ *
+ * @param row - the row.
+ * @returns the wire shape.
+ *
+ * @stability experimental
+ */
+function toDeliveryView(row) {
+    return {
+        id: row.id,
+        endpointId: row.endpointId,
+        eventKey: row.eventKey,
+        eventId: row.eventId,
+        status: row.status,
+        attempt: row.attempt,
+        responseStatus: row.responseStatus,
+        responseSnippet: row.responseSnippet,
+        errorCode: row.errorCode,
+        durationMs: row.durationMs,
+        nextAttemptAt: iso(row.nextAttemptAt),
+        deliveredAt: iso(row.deliveredAt),
+        createdAt: row.createdAt.toISOString(),
+    };
+}
+/**
+ * One delivery with its payload and the request headers that are stable across
+ * attempts. The signature and the timestamp are computed per attempt and never
+ * stored, so neither is shown.
+ *
+ * @param row - the row.
+ * @param userAgent - the `User-Agent` the slice sends.
+ * @returns the wire shape.
+ *
+ * @stability experimental
+ */
+function toDeliveryDetail(row, userAgent) {
+    return {
+        ...toDeliveryView(row),
+        payload: row.payload,
+        requestHeaders: { 'content-type': 'application/json', 'user-agent': userAgent, 'webhook-id': row.eventId },
+    };
+}
+//# sourceMappingURL=webhook-views.js.map

package/dist/webhooks/webhook-views.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-views.js","sourceRoot":"","sources":["../../src/webhooks/webhook-views.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;;AAqBhF,wCAoBC;AAUD,wCAgBC;AAaD,4CAMC;AA5ED,MAAM,GAAG,GAAG,CAAC,KAAkB,EAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,GAAuB;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;QAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,mBAAmB,EAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACjD,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;QACvC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;QACrC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,GAAuB;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;QACrC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;QACjC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,SAAiB;IACzE,OAAO;QACL,GAAG,cAAc,CAAC,GAAG,CAAC;QACtB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE;KAC3G,CAAC;AACJ,CAAC"}

package/dist/webhooks/webhooks.access.d.ts

@@ -0,0 +1,28 @@
+import { type WebhookScope } from '@marinoscar/platform-contract/webhooks';
+import type { WebhookEndpointRow, WebhookUserRow } from './data/webhooks-db';
+import type { WebhookEventDef } from './registry/webhook-event.registry';
+/** The permission that lets someone read their own endpoints of `scope`. @stability experimental */
+export declare function basePermissionFor(scope: WebhookScope): string;
+/**
+ * Who owns an endpoint for the access check.
+ *
+ * @param endpoint - the endpoint.
+ * @returns the user id, or `null` when there is no owner to check.
+ *
+ * @stability experimental
+ */
+export declare function ownerIdOf(endpoint: Pick<WebhookEndpointRow, 'ownerUserId' | 'createdById'>): string | null;
+/**
+ * Whether `owner` still holds what the endpoint needs: an active account, the
+ * scope's base permission in the endpoint's organization (system permissions
+ * only for a system endpoint) and the event's own permission, when it names one.
+ *
+ * @param owner - the owner loaded with roles and memberships; `null` when the account is gone.
+ * @param endpoint - the endpoint.
+ * @param event - the event being delivered.
+ * @returns `true` when the event may be delivered.
+ *
+ * @stability experimental
+ */
+export declare function ownerMayReceive(owner: WebhookUserRow | null, endpoint: Pick<WebhookEndpointRow, 'scope' | 'orgId'>, event: Pick<WebhookEventDef, 'permission'>): boolean;
+//# sourceMappingURL=webhooks.access.d.ts.map

package/dist/webhooks/webhooks.access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.access.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhooks.access.ts"],"names":[],"mappings":"AAYA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAGhG,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,aAAa,CAAC,GAAG,MAAM,GAAG,IAAI,CAE1G;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,GAAG,IAAI,EAC5B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,EACrD,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,GACzC,OAAO,CAST"}

package/dist/webhooks/webhooks.access.js

@@ -0,0 +1,55 @@
+"use strict";
+// =============================================================================
+// The owner's access to an endpoint's events (issue #1046)
+// =============================================================================
+//
+// An endpoint is its owner's delegate: it may receive an event only while the
+// person who set it up could read that event. The check is made at FAN-OUT time
+// (not at creation), so revoking a permission, suspending the member or
+// deactivating the account silences the endpoint at the next event. The owner
+// is the user for a user-scope endpoint and the creator for an org or system
+// endpoint; an endpoint whose creator no longer exists has no owner to check.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.basePermissionFor = basePermissionFor;
+exports.ownerIdOf = ownerIdOf;
+exports.ownerMayReceive = ownerMayReceive;
+const webhooks_1 = require("@marinoscar/platform-contract/webhooks");
+const index_1 = require("../identity/index");
+/** The permission that lets someone read their own endpoints of `scope`. @stability experimental */
+function basePermissionFor(scope) {
+    return scope === 'user' ? webhooks_1.WEBHOOK_PERMISSIONS.READ : scope === 'org' ? webhooks_1.WEBHOOK_PERMISSIONS.ORG_READ : webhooks_1.WEBHOOK_PERMISSIONS.SYSTEM_READ;
+}
+/**
+ * Who owns an endpoint for the access check.
+ *
+ * @param endpoint - the endpoint.
+ * @returns the user id, or `null` when there is no owner to check.
+ *
+ * @stability experimental
+ */
+function ownerIdOf(endpoint) {
+    return endpoint.ownerUserId ?? endpoint.createdById;
+}
+/**
+ * Whether `owner` still holds what the endpoint needs: an active account, the
+ * scope's base permission in the endpoint's organization (system permissions
+ * only for a system endpoint) and the event's own permission, when it names one.
+ *
+ * @param owner - the owner loaded with roles and memberships; `null` when the account is gone.
+ * @param endpoint - the endpoint.
+ * @param event - the event being delivered.
+ * @returns `true` when the event may be delivered.
+ *
+ * @stability experimental
+ */
+function ownerMayReceive(owner, endpoint, event) {
+    if (!owner || !owner.isActive)
+        return false;
+    const access = (0, index_1.resolveEffectiveAccess)({ userRoles: owner.userRoles, memberships: owner.memberships, activeOrgId: endpoint.orgId ?? null }, (0, index_1.currentTenancyMode)());
+    const held = new Set(access.permissions);
+    if (!held.has(basePermissionFor(endpoint.scope)))
+        return false;
+    return event.permission === undefined || held.has(event.permission);
+}
+//# sourceMappingURL=webhooks.access.js.map

package/dist/webhooks/webhooks.access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.access.js","sourceRoot":"","sources":["../../src/webhooks/webhooks.access.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2DAA2D;AAC3D,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;;AAShF,8CAEC;AAUD,8BAEC;AAcD,0CAaC;AAhDD,qEAAgG;AAEhG,6CAA+E;AAI/E,oGAAoG;AACpG,SAAgB,iBAAiB,CAAC,KAAmB;IACnD,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,8BAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,8BAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,8BAAmB,CAAC,WAAW,CAAC;AACxI,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,SAAS,CAAC,QAAiE;IACzF,OAAO,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,eAAe,CAC7B,KAA4B,EAC5B,QAAqD,EACrD,KAA0C;IAE1C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,8BAAsB,EACnC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,WAAoB,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,EAC5G,IAAA,0BAAkB,GAAE,CACrB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACtE,CAAC"}

package/dist/webhooks/webhooks.constants.d.ts

@@ -0,0 +1,73 @@
+/** The delivery job: one attempt of one delivery. PERMANENT once jobs of this type exist. @stability experimental */
+export declare const WEBHOOK_DELIVER_JOB_TYPE = "webhooks.deliver";
+/** The fan-out job: one emitted event to every matching endpoint. PERMANENT once jobs of this type exist. @stability experimental */
+export declare const WEBHOOK_FANOUT_JOB_TYPE = "webhooks.fanout";
+/** The daily retention job. PERMANENT once jobs of this type exist. @stability experimental */
+export declare const WEBHOOK_PURGE_JOB_TYPE = "webhooks.deliveries_purge";
+/** `subjectType` of a delivery job. @stability experimental */
+export declare const WEBHOOK_DELIVERY_SUBJECT_TYPE = "webhook_delivery";
+/** The credential purpose of an endpoint's signing secret, in all three tiers. @stability experimental */
+export declare const WEBHOOK_SIGNING_PURPOSE = "webhook_signing";
+/** The notification channel that carries user notifications to a user's webhook endpoints. @stability experimental */
+export declare const WEBHOOK_NOTIFICATION_CHANNEL_ID = "webhook";
+/** The notification event raised when an endpoint is disabled. @stability experimental */
+export declare const WEBHOOK_ENDPOINT_DISABLED_EVENT_KEY = "webhooks.endpoint_disabled";
+/** The email template of that event. @stability experimental */
+export declare const WEBHOOK_ENDPOINT_DISABLED_EMAIL_TEMPLATE = "webhook-endpoint-disabled";
+/** Prefix of the webhook event key a notification is exposed under (`notification.<eventKey>`). @stability experimental */
+export declare const WEBHOOK_NOTIFICATION_EVENT_PREFIX = "notification.";
+/** The system access reason every cross-organization (system-scope) webhook query names. @stability experimental */
+export declare const WEBHOOKS_SYSTEM_ACCESS_REASON = "webhooks";
+/**
+ * Registers the `webhooks` system access reason with core's registry, once.
+ * `WebhooksModule.forRoot()` calls it, and so does the repository's constructor,
+ * so code that builds the repository by hand (a database test) is covered too.
+ *
+ * @stability experimental
+ */
+export declare function registerWebhooksSystemAccessReason(): void;
+/** The `apiVersion` of the envelope. @stability experimental */
+export declare const WEBHOOK_ENVELOPE_API_VERSION = "2026-11-01";
+/** The audit actions the slice writes. @stability experimental */
+export declare const WEBHOOK_AUDIT_ACTIONS: {
+    readonly CREATE: "webhook.endpoint.create";
+    readonly UPDATE: "webhook.endpoint.update";
+    readonly DELETE: "webhook.endpoint.delete";
+    readonly ROTATE: "webhook.endpoint.rotate_secret";
+    readonly REDELIVER: "webhook.delivery.redeliver";
+    readonly DISABLE: "webhook.endpoint.disable";
+};
+/** The audit `targetType` of an endpoint. @stability experimental */
+export declare const WEBHOOK_AUDIT_TARGET = "webhook_endpoint";
+/** Why an endpoint was switched off by the platform. @stability experimental */
+export declare const WEBHOOK_DISABLED_REASONS: {
+    readonly CIRCUIT_OPEN: "circuit_open";
+    readonly OWNER_LOST_ACCESS: "owner_lost_access";
+    readonly GONE: "gone";
+};
+/** Defaults of {@link WebhooksModuleOptions}. @stability experimental */
+export declare const WEBHOOK_DEFAULTS: Readonly<{
+    readonly circuitBreakerThreshold: 20;
+    readonly rotationOverlapHours: 24;
+    readonly deliveryRetentionDays: 30;
+    readonly requestTimeoutMs: 10000;
+    readonly maxDeliveryAttempts: 10;
+    readonly limits: Readonly<{
+        user: 20;
+        org: 50;
+        system: 50;
+    }>;
+}>;
+/** The response body kept on a delivery row, in characters. @stability experimental */
+export declare const WEBHOOK_SNIPPET_MAX = 1024;
+/** Rows per batch of the retention purge. @stability experimental */
+export declare const WEBHOOK_PURGE_BATCH = 2000;
+/** Safety stop on the purge loop. @stability experimental */
+export declare const WEBHOOK_PURGE_MAX_BATCHES = 500;
+/** The retry schedule, in milliseconds, indexed by the attempt that just failed (1-based). The last entry repeats. @stability experimental */
+export declare const WEBHOOK_RETRY_SCHEDULE_MS: readonly number[];
+/** A server's `Retry-After` never delays a retry beyond this. @stability experimental */
+export declare const WEBHOOK_RETRY_AFTER_CAP_MS: number;
+/** The headers a stored delivery detail never shows (the signature is derived, not stored). @stability experimental */
+export declare const WEBHOOK_REDACTED_HEADERS: readonly ["webhook-signature"];
+//# sourceMappingURL=webhooks.constants.d.ts.map

package/dist/webhooks/webhooks.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.constants.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhooks.constants.ts"],"names":[],"mappings":"AAaA,qHAAqH;AACrH,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAC3D,qIAAqI;AACrI,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AACzD,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAEhE,0GAA0G;AAC1G,eAAO,MAAM,uBAAuB,oBAAoB,CAAC;AAEzD,sHAAsH;AACtH,eAAO,MAAM,+BAA+B,YAAY,CAAC;AAEzD,0FAA0F;AAC1F,eAAO,MAAM,mCAAmC,+BAA+B,CAAC;AAEhF,gEAAgE;AAChE,eAAO,MAAM,wCAAwC,8BAA8B,CAAC;AAEpF,2HAA2H;AAC3H,eAAO,MAAM,iCAAiC,kBAAkB,CAAC;AAEjE,oHAAoH;AACpH,eAAO,MAAM,6BAA6B,aAAa,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,kCAAkC,IAAI,IAAI,CAMzD;AAED,gEAAgE;AAChE,eAAO,MAAM,4BAA4B,eAAsB,CAAC;AAEhE,kEAAkE;AAClE,eAAO,MAAM,qBAAqB;;;;;;;CAOxB,CAAC;AAEX,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,gFAAgF;AAChF,eAAO,MAAM,wBAAwB;;;;CAI3B,CAAC;AAEX,yEAAyE;AACzE,eAAO,MAAM,gBAAgB;;;;;;;;;;;EAOlB,CAAC;AAEZ,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,OAAO,CAAC;AAExC,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,8IAA8I;AAC9I,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAUrD,CAAC;AAEH,yFAAyF;AACzF,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD,uHAAuH;AACvH,eAAO,MAAM,wBAAwB,gCAAiC,CAAC"}

package/dist/webhooks/webhooks.constants.js

@@ -0,0 +1,100 @@
+"use strict";
+// =============================================================================
+// The webhooks slice's constants (issue #1046)
+// =============================================================================
+//
+// PERMANENT strings: the three job types, the credential purpose, the
+// notification channel and event ids, the audit actions. Rename none once rows
+// or preferences name it.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WEBHOOK_REDACTED_HEADERS = exports.WEBHOOK_RETRY_AFTER_CAP_MS = exports.WEBHOOK_RETRY_SCHEDULE_MS = exports.WEBHOOK_PURGE_MAX_BATCHES = exports.WEBHOOK_PURGE_BATCH = exports.WEBHOOK_SNIPPET_MAX = exports.WEBHOOK_DEFAULTS = exports.WEBHOOK_DISABLED_REASONS = exports.WEBHOOK_AUDIT_TARGET = exports.WEBHOOK_AUDIT_ACTIONS = exports.WEBHOOK_ENVELOPE_API_VERSION = exports.WEBHOOKS_SYSTEM_ACCESS_REASON = exports.WEBHOOK_NOTIFICATION_EVENT_PREFIX = exports.WEBHOOK_ENDPOINT_DISABLED_EMAIL_TEMPLATE = exports.WEBHOOK_ENDPOINT_DISABLED_EVENT_KEY = exports.WEBHOOK_NOTIFICATION_CHANNEL_ID = exports.WEBHOOK_SIGNING_PURPOSE = exports.WEBHOOK_DELIVERY_SUBJECT_TYPE = exports.WEBHOOK_PURGE_JOB_TYPE = exports.WEBHOOK_FANOUT_JOB_TYPE = exports.WEBHOOK_DELIVER_JOB_TYPE = void 0;
+exports.registerWebhooksSystemAccessReason = registerWebhooksSystemAccessReason;
+const webhooks_1 = require("@marinoscar/platform-contract/webhooks");
+const index_1 = require("../core/index");
+/** The delivery job: one attempt of one delivery. PERMANENT once jobs of this type exist. @stability experimental */
+exports.WEBHOOK_DELIVER_JOB_TYPE = 'webhooks.deliver';
+/** The fan-out job: one emitted event to every matching endpoint. PERMANENT once jobs of this type exist. @stability experimental */
+exports.WEBHOOK_FANOUT_JOB_TYPE = 'webhooks.fanout';
+/** The daily retention job. PERMANENT once jobs of this type exist. @stability experimental */
+exports.WEBHOOK_PURGE_JOB_TYPE = 'webhooks.deliveries_purge';
+/** `subjectType` of a delivery job. @stability experimental */
+exports.WEBHOOK_DELIVERY_SUBJECT_TYPE = 'webhook_delivery';
+/** The credential purpose of an endpoint's signing secret, in all three tiers. @stability experimental */
+exports.WEBHOOK_SIGNING_PURPOSE = 'webhook_signing';
+/** The notification channel that carries user notifications to a user's webhook endpoints. @stability experimental */
+exports.WEBHOOK_NOTIFICATION_CHANNEL_ID = 'webhook';
+/** The notification event raised when an endpoint is disabled. @stability experimental */
+exports.WEBHOOK_ENDPOINT_DISABLED_EVENT_KEY = 'webhooks.endpoint_disabled';
+/** The email template of that event. @stability experimental */
+exports.WEBHOOK_ENDPOINT_DISABLED_EMAIL_TEMPLATE = 'webhook-endpoint-disabled';
+/** Prefix of the webhook event key a notification is exposed under (`notification.<eventKey>`). @stability experimental */
+exports.WEBHOOK_NOTIFICATION_EVENT_PREFIX = 'notification.';
+/** The system access reason every cross-organization (system-scope) webhook query names. @stability experimental */
+exports.WEBHOOKS_SYSTEM_ACCESS_REASON = 'webhooks';
+/**
+ * Registers the `webhooks` system access reason with core's registry, once.
+ * `WebhooksModule.forRoot()` calls it, and so does the repository's constructor,
+ * so code that builds the repository by hand (a database test) is covered too.
+ *
+ * @stability experimental
+ */
+function registerWebhooksSystemAccessReason() {
+    if (index_1.systemAccessReasonRegistry.has(exports.WEBHOOKS_SYSTEM_ACCESS_REASON))
+        return;
+    (0, index_1.registerSystemAccessReason)({
+        id: exports.WEBHOOKS_SYSTEM_ACCESS_REASON,
+        description: 'The webhooks slice: system-scope endpoints and their deliveries, which belong to no organization.',
+    });
+}
+/** The `apiVersion` of the envelope. @stability experimental */
+exports.WEBHOOK_ENVELOPE_API_VERSION = webhooks_1.WEBHOOK_API_VERSION;
+/** The audit actions the slice writes. @stability experimental */
+exports.WEBHOOK_AUDIT_ACTIONS = {
+    CREATE: 'webhook.endpoint.create',
+    UPDATE: 'webhook.endpoint.update',
+    DELETE: 'webhook.endpoint.delete',
+    ROTATE: 'webhook.endpoint.rotate_secret',
+    REDELIVER: 'webhook.delivery.redeliver',
+    DISABLE: 'webhook.endpoint.disable',
+};
+/** The audit `targetType` of an endpoint. @stability experimental */
+exports.WEBHOOK_AUDIT_TARGET = 'webhook_endpoint';
+/** Why an endpoint was switched off by the platform. @stability experimental */
+exports.WEBHOOK_DISABLED_REASONS = {
+    CIRCUIT_OPEN: 'circuit_open',
+    OWNER_LOST_ACCESS: 'owner_lost_access',
+    GONE: 'gone',
+};
+/** Defaults of {@link WebhooksModuleOptions}. @stability experimental */
+exports.WEBHOOK_DEFAULTS = Object.freeze({
+    circuitBreakerThreshold: 20,
+    rotationOverlapHours: 24,
+    deliveryRetentionDays: 30,
+    requestTimeoutMs: 10_000,
+    maxDeliveryAttempts: 10,
+    limits: Object.freeze({ user: 20, org: 50, system: 50 }),
+});
+/** The response body kept on a delivery row, in characters. @stability experimental */
+exports.WEBHOOK_SNIPPET_MAX = 1024;
+/** Rows per batch of the retention purge. @stability experimental */
+exports.WEBHOOK_PURGE_BATCH = 2000;
+/** Safety stop on the purge loop. @stability experimental */
+exports.WEBHOOK_PURGE_MAX_BATCHES = 500;
+/** The retry schedule, in milliseconds, indexed by the attempt that just failed (1-based). The last entry repeats. @stability experimental */
+exports.WEBHOOK_RETRY_SCHEDULE_MS = Object.freeze([
+    30_000,
+    2 * 60_000,
+    10 * 60_000,
+    30 * 60_000,
+    60 * 60_000,
+    2 * 3_600_000,
+    4 * 3_600_000,
+    6 * 3_600_000,
+    6 * 3_600_000,
+]);
+/** A server's `Retry-After` never delays a retry beyond this. @stability experimental */
+exports.WEBHOOK_RETRY_AFTER_CAP_MS = 24 * 3_600_000;
+/** The headers a stored delivery detail never shows (the signature is derived, not stored). @stability experimental */
+exports.WEBHOOK_REDACTED_HEADERS = ['webhook-signature'];
+//# sourceMappingURL=webhooks.constants.js.map

package/dist/webhooks/webhooks.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.constants.js","sourceRoot":"","sources":["../../src/webhooks/webhooks.constants.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAChF,EAAE;AACF,sEAAsE;AACtE,+EAA+E;AAC/E,0BAA0B;AAC1B,gFAAgF;;;AAyChF,gFAMC;AA7CD,qEAA6E;AAE7E,yCAAuF;AAEvF,qHAAqH;AACxG,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAC3D,qIAAqI;AACxH,QAAA,uBAAuB,GAAG,iBAAiB,CAAC;AACzD,+FAA+F;AAClF,QAAA,sBAAsB,GAAG,2BAA2B,CAAC;AAElE,+DAA+D;AAClD,QAAA,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE,0GAA0G;AAC7F,QAAA,uBAAuB,GAAG,iBAAiB,CAAC;AAEzD,sHAAsH;AACzG,QAAA,+BAA+B,GAAG,SAAS,CAAC;AAEzD,0FAA0F;AAC7E,QAAA,mCAAmC,GAAG,4BAA4B,CAAC;AAEhF,gEAAgE;AACnD,QAAA,wCAAwC,GAAG,2BAA2B,CAAC;AAEpF,2HAA2H;AAC9G,QAAA,iCAAiC,GAAG,eAAe,CAAC;AAEjE,oHAAoH;AACvG,QAAA,6BAA6B,GAAG,UAAU,CAAC;AAExD;;;;;;GAMG;AACH,SAAgB,kCAAkC;IAChD,IAAI,kCAA0B,CAAC,GAAG,CAAC,qCAA6B,CAAC;QAAE,OAAO;IAC1E,IAAA,kCAA0B,EAAC;QACzB,EAAE,EAAE,qCAA6B;QACjC,WAAW,EAAE,mGAAmG;KACjH,CAAC,CAAC;AACL,CAAC;AAED,gEAAgE;AACnD,QAAA,4BAA4B,GAAG,8BAAmB,CAAC;AAEhE,kEAAkE;AACrD,QAAA,qBAAqB,GAAG;IACnC,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE,4BAA4B;IACvC,OAAO,EAAE,0BAA0B;CAC3B,CAAC;AAEX,qEAAqE;AACxD,QAAA,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,gFAAgF;AACnE,QAAA,wBAAwB,GAAG;IACtC,YAAY,EAAE,cAAc;IAC5B,iBAAiB,EAAE,mBAAmB;IACtC,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,yEAAyE;AAC5D,QAAA,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,uBAAuB,EAAE,EAAE;IAC3B,oBAAoB,EAAE,EAAE;IACxB,qBAAqB,EAAE,EAAE;IACzB,gBAAgB,EAAE,MAAM;IACxB,mBAAmB,EAAE,EAAE;IACvB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;CAChD,CAAC,CAAC;AAEZ,uFAAuF;AAC1E,QAAA,mBAAmB,GAAG,IAAI,CAAC;AAExC,qEAAqE;AACxD,QAAA,mBAAmB,GAAG,IAAI,CAAC;AAExC,6DAA6D;AAChD,QAAA,yBAAyB,GAAG,GAAG,CAAC;AAE7C,8IAA8I;AACjI,QAAA,yBAAyB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACxE,MAAM;IACN,CAAC,GAAG,MAAM;IACV,EAAE,GAAG,MAAM;IACX,EAAE,GAAG,MAAM;IACX,EAAE,GAAG,MAAM;IACX,CAAC,GAAG,SAAS;IACb,CAAC,GAAG,SAAS;IACb,CAAC,GAAG,SAAS;IACb,CAAC,GAAG,SAAS;CACd,CAAC,CAAC;AAEH,yFAAyF;AAC5E,QAAA,0BAA0B,GAAG,EAAE,GAAG,SAAS,CAAC;AAEzD,uHAAuH;AAC1G,QAAA,wBAAwB,GAAG,CAAC,mBAAmB,CAAU,CAAC"}

package/dist/webhooks/webhooks.credentials.d.ts

@@ -0,0 +1,28 @@
+import type { CredentialPurposeDef, UserCredentialPurposeDef } from '../credentials/index';
+/**
+ * The organization and deployment tiers of `webhook_signing`, for
+ * `registerCredentialPurpose`.
+ *
+ * @example
+ * ```ts
+ * registerCredentialPurpose(WEBHOOK_SIGNING_CREDENTIAL_PURPOSE_DEF);
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare const WEBHOOK_SIGNING_CREDENTIAL_PURPOSE_DEF: CredentialPurposeDef;
+/**
+ * The user tier of `webhook_signing`, for `registerUserCredentialPurpose`. No
+ * deployment or organization fallback: a member's secret is theirs alone.
+ *
+ * @example
+ * ```ts
+ * registerUserCredentialPurpose(WEBHOOK_SIGNING_USER_CREDENTIAL_PURPOSE_DEF);
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare const WEBHOOK_SIGNING_USER_CREDENTIAL_PURPOSE_DEF: UserCredentialPurposeDef;
+//# sourceMappingURL=webhooks.credentials.d.ts.map

package/dist/webhooks/webhooks.credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.credentials.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhooks.credentials.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAG3F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sCAAsC,EAAE,oBAKnD,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2CAA2C,EAAE,wBAKxD,CAAC"}