@nestarc/webhook 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nestarc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,281 @@
+# @nestarc/webhook
+
+Outbound webhook delivery for NestJS — HMAC signing, exponential retry, circuit breaker, delivery logs, fan-out, [Standard Webhooks](https://www.standardwebhooks.com/) compatible.
+
+**No separate infrastructure required.** Uses your existing PostgreSQL database.
+
+[![CI](https://github.com/nestarc/webhook/actions/workflows/ci.yml/badge.svg)](https://github.com/nestarc/webhook/actions/workflows/ci.yml)
+
+## Features
+
+- **Fan-out delivery** — one event to many endpoints
+- **HMAC-SHA256 signing** — Standard Webhooks compatible headers
+- **Exponential backoff** — 30s, 5m, 30m, 2h, 24h (with jitter)
+- **Circuit breaker** — auto-disable failing endpoints, auto-recover after cooldown
+- **Dead letter queue** — failed deliveries tracked for manual retry
+- **Delivery logs** — full audit trail (status code, latency, response body)
+- **Multi-instance safe** — `FOR UPDATE SKIP LOCKED` prevents duplicate delivery
+- **Graceful shutdown** — waits for in-flight deliveries on process exit
+- **SSRF defense** — DNS resolution validation at registration and dispatch time
+- **Ports/adapters architecture** — swap Prisma or fetch with custom implementations
+- **Stale delivery recovery** — lease-based reaper recovers crashed worker deliveries
+
+## Installation
+
+```bash
+npm install @nestarc/webhook
+```
+
+**Peer dependencies:**
+
+```bash
+npm install @nestjs/common @nestjs/core @nestjs/schedule @prisma/client
+```
+
+## Database Setup
+
+Run the migration SQL against your PostgreSQL database:
+
+```bash
+psql -d your_database -f node_modules/@nestarc/webhook/src/sql/create-webhook-tables.sql
+```
+
+This creates three tables: `webhook_endpoints`, `webhook_events`, `webhook_deliveries`.
+
+The migration includes `CREATE EXTENSION IF NOT EXISTS pgcrypto` for PostgreSQL < 13 compatibility.
+
+## Quick Start
+
+### 1. Register the module
+
+```typescript
+import { WebhookModule } from '@nestarc/webhook';
+
+@Module({
+  imports: [
+    WebhookModule.forRoot({
+      prisma: prismaService,
+      delivery: {
+        timeout: 10_000,
+        maxRetries: 5,
+        backoff: 'exponential',
+        jitter: true,
+      },
+      circuitBreaker: {
+        failureThreshold: 5,
+        cooldownMinutes: 60,
+      },
+      polling: {
+        interval: 5000,
+        batchSize: 50,
+      },
+    }),
+  ],
+})
+export class AppModule {}
+```
+
+### 2. Define events
+
+```typescript
+import { WebhookEvent } from '@nestarc/webhook';
+
+export class OrderCreatedEvent extends WebhookEvent {
+  static readonly eventType = 'order.created';
+
+  constructor(
+    public readonly orderId: string,
+    public readonly total: number,
+  ) {
+    super();
+  }
+}
+```
+
+> **Note:** Subclasses **must** define `static readonly eventType`. The module throws at runtime if this is missing.
+
+### 3. Send events
+
+```typescript
+import { WebhookService } from '@nestarc/webhook';
+
+@Injectable()
+export class OrderService {
+  constructor(private readonly webhooks: WebhookService) {}
+
+  async createOrder(dto: CreateOrderDto) {
+    const order = await this.saveOrder(dto);
+    await this.webhooks.send(new OrderCreatedEvent(order.id, order.total));
+    return order;
+  }
+}
+```
+
+### 4. Manage endpoints
+
+```typescript
+import { WebhookEndpointAdminService } from '@nestarc/webhook';
+
+@Injectable()
+export class WebhookController {
+  constructor(private readonly endpointAdmin: WebhookEndpointAdminService) {}
+
+  async register() {
+    // Secret is returned only on creation
+    return this.endpointAdmin.createEndpoint({
+      url: 'https://customer.com/webhooks',
+      events: ['order.created', 'order.paid'],
+      secret: 'auto',
+    });
+  }
+}
+```
+
+## API Reference
+
+### WebhookService
+
+| Method | Description |
+|--------|-------------|
+| `send(event)` | Publish event to all matching endpoints |
+| `sendToTenant(tenantId, event)` | Publish to tenant-specific endpoints only |
+
+### WebhookEndpointAdminService
+
+| Method | Description |
+|--------|-------------|
+| `createEndpoint(dto)` | Register a new webhook endpoint (returns secret) |
+| `listEndpoints(tenantId?)` | List all endpoints (secret excluded) |
+| `getEndpoint(id)` | Get endpoint details (secret excluded) |
+| `updateEndpoint(id, dto)` | Update endpoint URL, events, etc. |
+| `deleteEndpoint(id)` | Delete an endpoint |
+| `sendTestEvent(endpointId)` | Send a `webhook.test` ping event |
+
+### WebhookDeliveryAdminService
+
+| Method | Description |
+|--------|-------------|
+| `getDeliveryLogs(endpointId, filters?)` | Query delivery history |
+| `retryDelivery(deliveryId)` | Manually retry a failed delivery |
+
+### WebhookSigner
+
+| Method | Description |
+|--------|-------------|
+| `sign(eventId, timestamp, body, secret)` | Generate Standard Webhooks signature headers |
+| `verify(eventId, timestamp, body, secret, signature)` | Verify a webhook signature |
+| `generateSecret()` | Generate a random base64 signing secret |
+
+> **Deprecated:** `WebhookAdminService` is a facade that delegates to `WebhookEndpointAdminService` and `WebhookDeliveryAdminService`. It will be removed in v0.3.0.
+
+## Configuration
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `prisma` | — | PrismaClient instance (required unless all custom repos provided) |
+| `delivery.timeout` | `10000` | HTTP request timeout (ms) |
+| `delivery.maxRetries` | `5` | Maximum delivery attempts |
+| `delivery.jitter` | `true` | Add random jitter to retry delays |
+| `circuitBreaker.failureThreshold` | `5` | Consecutive failures before disabling endpoint |
+| `circuitBreaker.cooldownMinutes` | `60` | Minutes before attempting recovery |
+| `polling.interval` | `5000` | Delivery worker poll interval (ms) |
+| `polling.batchSize` | `50` | Max deliveries per poll cycle |
+| `polling.staleSendingMinutes` | `5` | Minutes before a stuck SENDING delivery is recovered |
+| `allowPrivateUrls` | `false` | Allow private/internal URLs (dev/test only) |
+
+### Custom adapters
+
+Replace default Prisma or fetch implementations by providing custom ports:
+
+```typescript
+WebhookModule.forRoot({
+  prisma: prismaService,
+  httpClient: myCustomHttpClient,          // implements WebhookHttpClient
+  eventRepository: myCustomEventRepo,      // implements WebhookEventRepository
+  endpointRepository: myCustomEndpointRepo,// implements WebhookEndpointRepository
+  deliveryRepository: myCustomDeliveryRepo,// implements WebhookDeliveryRepository
+});
+```
+
+### Async configuration
+
+```typescript
+WebhookModule.forRootAsync({
+  imports: [ConfigModule],
+  useFactory: (config: ConfigService, prisma: PrismaService) => ({
+    prisma,
+    delivery: {
+      maxRetries: config.get('WEBHOOK_MAX_RETRIES', 5),
+    },
+  }),
+  inject: [ConfigService, PrismaService],
+});
+```
+
+## Security
+
+### Signing
+
+All webhooks are signed with **HMAC-SHA256** using [Standard Webhooks](https://www.standardwebhooks.com/) headers:
+
+```
+webhook-id: <event-uuid>
+webhook-timestamp: <unix-seconds>
+webhook-signature: v1,<base64-hmac-sha256>
+```
+
+**Secret format:** Secrets must be valid base64 strings decoding to at least 16 bytes. Use `"auto"` for automatic generation.
+
+### SSRF defense
+
+- Endpoint URLs are validated at **registration** and at **every dispatch**
+- Blocks: private IPs, loopback, link-local, cloud metadata (169.254.x), IPv4-mapped IPv6
+- DNS resolution is checked to prevent rebinding attacks
+- HTTP redirects are disabled (`redirect: 'manual'`)
+- Use `allowPrivateUrls: true` for local development only
+
+### Secret handling
+
+- Signing secrets are excluded from read queries (`listEndpoints`, `getEndpoint`)
+- Secrets are only returned on `createEndpoint` (initial provisioning)
+- Delivery enrichment uses an internal path that does not expose secrets through admin APIs
+
+## Webhook Payload Format
+
+```json
+{
+  "type": "order.created",
+  "data": {
+    "orderId": "ord_123",
+    "total": 99.99
+  }
+}
+```
+
+## Architecture
+
+```
+┌─────────────┐     ┌──────────────────┐     ┌───────────────────┐
+│ Your Service │────>│  WebhookService  │────>│  PostgreSQL (tx)  │
+└─────────────┘     └──────────────────┘     └───────────────────┘
+                            │
+                    ┌───────┴────────┐
+                    │ DeliveryWorker │  (polls every N seconds)
+                    └───────┬────────┘
+                            │
+              ┌─────────────┼─────────────┐
+              v             v             v
+        ┌──────────┐ ┌──────────┐ ┌──────────┐
+        │Dispatcher│ │RetryPolicy│ │CircuitBkr│
+        └────┬─────┘ └──────────┘ └──────────┘
+             │
+        ┌────┴─────┐
+        │HttpClient│──> customer endpoints
+        └──────────┘
+```
+
+All components depend on **port interfaces**, not concrete implementations. Default adapters use Prisma and Node.js fetch.
+
+## License
+
+MIT

package/dist/adapters/fetch-http-client.d.ts

@@ -0,0 +1,6 @@
+import { WebhookHttpClient } from '../ports/webhook-http-client';
+import { DeliveryResult } from '../interfaces/webhook-delivery.interface';
+export declare class FetchHttpClient implements WebhookHttpClient {
+    post(url: string, headers: Record<string, string>, body: string, timeout: number): Promise<DeliveryResult>;
+}
+//# sourceMappingURL=fetch-http-client.d.ts.map

package/dist/adapters/fetch-http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-http-client.d.ts","sourceRoot":"","sources":["../../src/adapters/fetch-http-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAG1E,qBACa,eAAgB,YAAW,iBAAiB;IACjD,IAAI,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC;CAuC3B"}

package/dist/adapters/fetch-http-client.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FetchHttpClient = void 0;
+const common_1 = require("@nestjs/common");
+const webhook_constants_1 = require("../webhook.constants");
+let FetchHttpClient = class FetchHttpClient {
+    async post(url, headers, body, timeout) {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), timeout);
+        const start = Date.now();
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'User-Agent': '@nestarc/webhook',
+                    ...headers,
+                },
+                body,
+                signal: controller.signal,
+                redirect: 'manual',
+            });
+            const latencyMs = Date.now() - start;
+            const responseBody = await response.text();
+            return {
+                success: response.status >= 200 && response.status < 300,
+                statusCode: response.status,
+                body: responseBody.slice(0, webhook_constants_1.RESPONSE_BODY_MAX_LENGTH),
+                latencyMs,
+            };
+        }
+        catch (error) {
+            const latencyMs = Date.now() - start;
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                success: false,
+                latencyMs,
+                error: message,
+            };
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    }
+};
+exports.FetchHttpClient = FetchHttpClient;
+exports.FetchHttpClient = FetchHttpClient = __decorate([
+    (0, common_1.Injectable)()
+], FetchHttpClient);
+//# sourceMappingURL=fetch-http-client.js.map

package/dist/adapters/fetch-http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-http-client.js","sourceRoot":"","sources":["../../src/adapters/fetch-http-client.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAG5C,4DAAgE;AAGzD,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,KAAK,CAAC,IAAI,CACR,GAAW,EACX,OAA+B,EAC/B,IAAY,EACZ,OAAe;QAEf,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,kBAAkB;oBAChC,GAAG,OAAO;iBACX;gBACD,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACrC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAE3C,OAAO;gBACL,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBACxD,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,4CAAwB,CAAC;gBACrD,SAAS;aACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACrC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS;gBACT,KAAK,EAAE,OAAO;aACf,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF,CAAA;AA7CY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;GACA,eAAe,CA6C3B"}

package/dist/adapters/prisma-delivery.repository.d.ts

@@ -0,0 +1,18 @@
+import { PendingDelivery, WebhookDeliveryRepository } from '../ports/webhook-delivery.repository';
+import { DeliveryLogFilters, DeliveryRecord, DeliveryResult } from '../interfaces/webhook-delivery.interface';
+export declare class PrismaDeliveryRepository implements WebhookDeliveryRepository {
+    private readonly prisma;
+    constructor(prisma: any);
+    createDeliveriesInTransaction(tx: any, eventId: string, endpointIds: string[], maxAttempts: number): Promise<void>;
+    runInTransaction<T>(fn: (tx: unknown) => Promise<T>): Promise<T>;
+    claimPendingDeliveries(batchSize: number): Promise<PendingDelivery[]>;
+    enrichDeliveries(deliveryIds: string[]): Promise<PendingDelivery[]>;
+    markSent(deliveryId: string, attempts: number, result: DeliveryResult): Promise<void>;
+    markFailed(deliveryId: string, attempts: number, result: DeliveryResult): Promise<void>;
+    markRetry(deliveryId: string, attempts: number, nextAt: Date, result: DeliveryResult): Promise<void>;
+    recoverStaleSending(stalenessMinutes: number): Promise<number>;
+    getDeliveryLogs(endpointId: string, filters?: DeliveryLogFilters): Promise<DeliveryRecord[]>;
+    retryDelivery(deliveryId: string): Promise<boolean>;
+    createTestDelivery(eventId: string, endpointId: string): Promise<void>;
+}
+//# sourceMappingURL=prisma-delivery.repository.d.ts.map

package/dist/adapters/prisma-delivery.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-delivery.repository.d.ts","sourceRoot":"","sources":["../../src/adapters/prisma-delivery.repository.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,yBAAyB,EAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,cAAc,EACf,MAAM,0CAA0C,CAAC;AAElD,qBACa,wBAAyB,YAAW,yBAAyB;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,GAAG;IAElC,6BAA6B,CACjC,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EAAE,EACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAUV,gBAAgB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhE,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAqBrE,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAYnE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrF,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAYvF,SAAS,CACb,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,IAAI,EACZ,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;IAYV,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAY9D,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;IAgDtB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQnD,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAK7E"}

package/dist/adapters/prisma-delivery.repository.js

@@ -0,0 +1,162 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaDeliveryRepository = void 0;
+const common_1 = require("@nestjs/common");
+let PrismaDeliveryRepository = class PrismaDeliveryRepository {
+    prisma;
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    async createDeliveriesInTransaction(tx, eventId, endpointIds, maxAttempts) {
+        await tx.$executeRawUnsafe(`INSERT INTO webhook_deliveries (event_id, endpoint_id, status, attempts, max_attempts, next_attempt_at)
+       SELECT $1::uuid, unnest($2::uuid[]), 'PENDING', 0, $3, NOW()`, eventId, endpointIds, maxAttempts);
+    }
+    async runInTransaction(fn) {
+        return this.prisma.$transaction(fn);
+    }
+    async claimPendingDeliveries(batchSize) {
+        return this.prisma.$queryRaw `
+      UPDATE webhook_deliveries
+      SET status = 'SENDING', claimed_at = NOW()
+      WHERE id IN (
+        SELECT d.id
+        FROM webhook_deliveries d
+        WHERE d.status = 'PENDING'
+          AND d.next_attempt_at <= NOW()
+        ORDER BY d.next_attempt_at ASC
+        LIMIT ${batchSize}
+        FOR UPDATE SKIP LOCKED
+      )
+      RETURNING
+        webhook_deliveries.id,
+        webhook_deliveries.event_id,
+        webhook_deliveries.endpoint_id,
+        webhook_deliveries.attempts,
+        webhook_deliveries.max_attempts`;
+    }
+    async enrichDeliveries(deliveryIds) {
+        return this.prisma.$queryRaw `
+      SELECT
+        d.id, d.event_id, d.endpoint_id, d.attempts, d.max_attempts,
+        e.url, e.secret,
+        ev.event_type, ev.payload
+      FROM webhook_deliveries d
+      JOIN webhook_endpoints e ON e.id = d.endpoint_id
+      JOIN webhook_events ev ON ev.id = d.event_id
+      WHERE d.id = ANY(${deliveryIds}::uuid[])`;
+    }
+    async markSent(deliveryId, attempts, result) {
+        await this.prisma.$executeRaw `
+      UPDATE webhook_deliveries
+      SET status = 'SENT', attempts = ${attempts},
+          last_attempt_at = NOW(), completed_at = NOW(),
+          response_status = ${result.statusCode ?? null},
+          response_body = ${result.body ?? null},
+          latency_ms = ${result.latencyMs}
+      WHERE id = ${deliveryId}::uuid`;
+    }
+    async markFailed(deliveryId, attempts, result) {
+        await this.prisma.$executeRaw `
+      UPDATE webhook_deliveries
+      SET status = 'FAILED', attempts = ${attempts},
+          last_attempt_at = NOW(), completed_at = NOW(),
+          response_status = ${result.statusCode ?? null},
+          response_body = ${result.body ?? null},
+          latency_ms = ${result.latencyMs},
+          last_error = ${result.error ?? null}
+      WHERE id = ${deliveryId}::uuid`;
+    }
+    async markRetry(deliveryId, attempts, nextAt, result) {
+        await this.prisma.$executeRaw `
+      UPDATE webhook_deliveries
+      SET status = 'PENDING', attempts = ${attempts},
+          last_attempt_at = NOW(), next_attempt_at = ${nextAt},
+          response_status = ${result.statusCode ?? null},
+          response_body = ${result.body ?? null},
+          latency_ms = ${result.latencyMs},
+          last_error = ${result.error ?? null}
+      WHERE id = ${deliveryId}::uuid`;
+    }
+    async recoverStaleSending(stalenessMinutes) {
+        const interval = `${stalenessMinutes} minutes`;
+        const recovered = await this.prisma.$queryRaw `
+      UPDATE webhook_deliveries
+      SET status = 'PENDING', claimed_at = NULL
+      WHERE status = 'SENDING'
+        AND claimed_at IS NOT NULL
+        AND claimed_at + ${interval}::interval < NOW()
+      RETURNING id`;
+        return recovered.length;
+    }
+    async getDeliveryLogs(endpointId, filters) {
+        const conditions = ['d.endpoint_id = $1::uuid'];
+        const values = [endpointId];
+        let paramIndex = 2;
+        if (filters?.status) {
+            conditions.push(`d.status = $${paramIndex++}`);
+            values.push(filters.status);
+        }
+        if (filters?.eventType) {
+            conditions.push(`ev.event_type = $${paramIndex++}`);
+            values.push(filters.eventType);
+        }
+        if (filters?.since) {
+            conditions.push(`d.last_attempt_at >= $${paramIndex++}`);
+            values.push(filters.since);
+        }
+        if (filters?.until) {
+            conditions.push(`d.last_attempt_at <= $${paramIndex++}`);
+            values.push(filters.until);
+        }
+        const limit = filters?.limit ?? 50;
+        const offset = filters?.offset ?? 0;
+        const query = `
+      SELECT d.id, d.status, d.attempts,
+             d.event_id AS "eventId",
+             d.endpoint_id AS "endpointId",
+             d.max_attempts AS "maxAttempts",
+             d.next_attempt_at AS "nextAttemptAt",
+             d.last_attempt_at AS "lastAttemptAt",
+             d.completed_at AS "completedAt",
+             d.response_status AS "responseStatus",
+             d.response_body AS "responseBody",
+             d.latency_ms AS "latencyMs",
+             d.last_error AS "lastError"
+      FROM webhook_deliveries d
+      JOIN webhook_events ev ON ev.id = d.event_id
+      WHERE ${conditions.join(' AND ')}
+      ORDER BY d.last_attempt_at DESC NULLS LAST
+      LIMIT $${paramIndex++}
+      OFFSET $${paramIndex}`;
+        values.push(limit, offset);
+        const results = await this.prisma.$queryRawUnsafe(query, ...values);
+        return results;
+    }
+    async retryDelivery(deliveryId) {
+        const result = await this.prisma.$executeRaw `
+      UPDATE webhook_deliveries
+      SET status = 'PENDING', next_attempt_at = NOW()
+      WHERE id = ${deliveryId}::uuid AND status = 'FAILED'`;
+        return result > 0;
+    }
+    async createTestDelivery(eventId, endpointId) {
+        await this.prisma.$executeRaw `
+      INSERT INTO webhook_deliveries (event_id, endpoint_id, status, max_attempts, next_attempt_at)
+      VALUES (${eventId}::uuid, ${endpointId}::uuid, 'PENDING', 1, NOW())`;
+    }
+};
+exports.PrismaDeliveryRepository = PrismaDeliveryRepository;
+exports.PrismaDeliveryRepository = PrismaDeliveryRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Object])
+], PrismaDeliveryRepository);
+//# sourceMappingURL=prisma-delivery.repository.js.map

package/dist/adapters/prisma-delivery.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-delivery.repository.js","sourceRoot":"","sources":["../../src/adapters/prisma-delivery.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAYrC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACN;IAA7B,YAA6B,MAAW;QAAX,WAAM,GAAN,MAAM,CAAK;IAAG,CAAC;IAE5C,KAAK,CAAC,6BAA6B,CACjC,EAAO,EACP,OAAe,EACf,WAAqB,EACrB,WAAmB;QAEnB,MAAM,EAAE,CAAC,iBAAiB,CACxB;oEAC8D,EAC9D,OAAO,EACP,WAAW,EACX,WAAW,CACZ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAI,EAA+B;QACvD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,SAAiB;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAmB;;;;;;;;;gBASnC,SAAS;;;;;;;;wCAQe,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAqB;QAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAmB;;;;;;;;yBAQ1B,WAAW,WAAW,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAgB,EAAE,MAAsB;QACzE,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA;;wCAEO,QAAQ;;8BAElB,MAAM,CAAC,UAAU,IAAI,IAAI;4BAC3B,MAAM,CAAC,IAAI,IAAI,IAAI;yBACtB,MAAM,CAAC,SAAS;mBACtB,UAAU,QAAQ,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,QAAgB,EAAE,MAAsB;QAC3E,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA;;0CAES,QAAQ;;8BAEpB,MAAM,CAAC,UAAU,IAAI,IAAI;4BAC3B,MAAM,CAAC,IAAI,IAAI,IAAI;yBACtB,MAAM,CAAC,SAAS;yBAChB,MAAM,CAAC,KAAK,IAAI,IAAI;mBAC1B,UAAU,QAAQ,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,UAAkB,EAClB,QAAgB,EAChB,MAAY,EACZ,MAAsB;QAEtB,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA;;2CAEU,QAAQ;uDACI,MAAM;8BAC/B,MAAM,CAAC,UAAU,IAAI,IAAI;4BAC3B,MAAM,CAAC,IAAI,IAAI,IAAI;yBACtB,MAAM,CAAC,SAAS;yBAChB,MAAM,CAAC,KAAK,IAAI,IAAI;mBAC1B,UAAU,QAAQ,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,gBAAwB;QAChD,MAAM,QAAQ,GAAG,GAAG,gBAAgB,UAAU,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAkB;;;;;2BAKxC,QAAQ;mBAChB,CAAC;QAChB,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,UAAkB,EAClB,OAA4B;QAE5B,MAAM,UAAU,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAChD,MAAM,MAAM,GAAc,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,UAAU,CAAC,IAAI,CAAC,eAAe,UAAU,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,UAAU,CAAC,IAAI,CAAC,oBAAoB,UAAU,EAAE,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,yBAAyB,UAAU,EAAE,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,yBAAyB,UAAU,EAAE,EAAE,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;cAcJ,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;;eAEvB,UAAU,EAAE;gBACX,UAAU,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3B,MAAM,OAAO,GAAqB,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC;QACtF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA;;;mBAG7B,UAAU,8BAA8B,CAAC;QACxD,OAAO,MAAM,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,UAAkB;QAC1D,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA;;gBAEjB,OAAO,WAAW,UAAU,8BAA8B,CAAC;IACzE,CAAC;CACF,CAAA;AA3KY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;;GACA,wBAAwB,CA2KpC"}

package/dist/adapters/prisma-endpoint.repository.d.ts

@@ -0,0 +1,18 @@
+import { WebhookEndpointRepository } from '../ports/webhook-endpoint.repository';
+import { EndpointRecord, EndpointRecordWithSecret, UpdateEndpointDto } from '../interfaces/webhook-endpoint.interface';
+export declare class PrismaEndpointRepository implements WebhookEndpointRepository {
+    private readonly prisma;
+    constructor(prisma: any);
+    findMatchingEndpoints(eventType: string, tenantId: string | undefined): Promise<EndpointRecord[]>;
+    findMatchingEndpointsInTransaction(tx: any, eventType: string, tenantId: string | undefined): Promise<EndpointRecord[]>;
+    createEndpoint(url: string, secret: string, events: string[], description: string | null, metadata: Record<string, unknown> | null, tenantId: string | null): Promise<EndpointRecordWithSecret>;
+    getEndpoint(id: string): Promise<EndpointRecord | null>;
+    listEndpoints(tenantId?: string): Promise<EndpointRecord[]>;
+    updateEndpoint(id: string, dto: UpdateEndpointDto): Promise<EndpointRecord | null>;
+    deleteEndpoint(id: string): Promise<boolean>;
+    resetFailures(endpointId: string): Promise<void>;
+    incrementFailures(endpointId: string): Promise<number>;
+    disableEndpoint(endpointId: string, reason: string): Promise<void>;
+    recoverEligibleEndpoints(cooldownMinutes: number): Promise<number>;
+}
+//# sourceMappingURL=prisma-endpoint.repository.d.ts.map

package/dist/adapters/prisma-endpoint.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-endpoint.repository.d.ts","sourceRoot":"","sources":["../../src/adapters/prisma-endpoint.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,0CAA0C,CAAC;AAsBlD,qBACa,wBAAyB,YAAW,yBAAyB;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,GAAG;IAElC,qBAAqB,CACzB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;IAoBtB,kCAAkC,CACtC,EAAE,EAAE,GAAG,EACP,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,OAAO,CAAC,cAAc,EAAE,CAAC;IAoBtB,cAAc,CAClB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EAAE,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxC,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,OAAO,CAAC,wBAAwB,CAAC;IAe9B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAQvD,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAe3D,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAqC3B,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM5C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQhD,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAStD,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlE,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAYzE"}