@objectstack/plugin-webhooks 16.1.0 → 17.0.0-rc.1

package/dist/chunk-6EPMRZ7I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sys-webhook.object.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_webhook — Outbound HTTP integration configuration (runtime).\n *\n * Persists a single {@link Webhook} envelope per row so administrators\n * can author, enable/disable, and edit webhook subscriptions from the\n * Studio UI without code changes. The canonical Zod schema for the\n * `definition_json` envelope lives at `@objectstack/spec/automation/webhook`.\n *\n * ## Two authoring doors, one row\n * Rows land here two ways, distinguished by the `managed_by` provenance column:\n *   - **admin** — created/edited directly through this object's CRUD UI.\n *   - **package** — declared in code (`defineStack({ webhooks })` /\n *     `defineWebhook()`) and materialized on boot by\n *     `bootstrapDeclaredWebhooks` (#3461). Re-seeded every boot, but an admin\n *     edit stamps `customized: true` and freezes the row (seed-not-clobber,\n *     mirrors `sys_sharing_rule` #2909).\n *\n * One row per `name`. This plugin's {@link AutoEnqueuer} loads active rows on\n * boot + on `sys_webhook:changed` events, and turns matching `data.record.*`\n * events into deliveries on the shared `service-messaging` HTTP outbox\n * (ADR-0018 M3 — `sys_http_delivery`, drained by the messaging dispatcher).\n *\n * Ownership (ADR-0029 K2.a): this object is **owned by\n * `@objectstack/plugin-webhooks`** — the plugin that consumes these rows. It\n * used to live in the `@objectstack/platform-objects` monolith and be imported\n * here; the definition now lives with its owner so the plugin ships both data\n * and behavior as one unit.\n *\n * Platform-wide on purpose: every project (standalone, single-tenant,\n * cloud) can integrate with external systems (Slack, Stripe, internal\n * services) the same way.\n *\n * @namespace sys\n */\nexport const SysWebhook = ObjectSchema.create({\n  name: 'sys_webhook',\n  label: 'Webhook',\n  pluralLabel: 'Webhooks',\n  icon: 'webhook',\n  isSystem: true,\n  managedBy: 'config',\n  // Authoring a webhook from the UI requires a structured form for the\n  // headers / auth / retry / payload blocks — the generic JSON textarea\n  // is acceptable as a v1 until a dedicated builder lands. Re-enable\n  // create/edit/delete so admins can at least toggle `active` and edit\n  // simple URL/method fields without round-tripping through code.\n  userActions: { create: true, edit: true, delete: true, import: false },\n  description: 'Outbound HTTP webhook subscription. Declared in code via defineStack({ webhooks }) / defineWebhook() (materialized into rows on boot) or authored directly in the Studio editor; dispatched by the webhook auto-enqueuer onto the shared HTTP outbox.',\n  displayNameField: 'name',\n  nameField: 'name', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)\n  titleFormat: '{label}',\n  highlightFields: ['name', 'object_name', 'url', 'active', 'updated_at'],\n\n  listViews: {\n    active: {\n      type: 'grid',\n      name: 'active',\n      label: 'Active',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      filter: [{ field: 'active', operator: 'equals', value: true }],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n    inactive: {\n      type: 'grid',\n      name: 'inactive',\n      label: 'Inactive',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      filter: [{ field: 'active', operator: 'equals', value: false }],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n    by_object: {\n      type: 'grid',\n      name: 'by_object',\n      label: 'By Object',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['object_name', 'label', 'url', 'active', 'updated_at'],\n      sort: [{ field: 'object_name', order: 'asc' }, { field: 'label', order: 'asc' }],\n      grouping: { fields: [{ field: 'object_name', order: 'asc', collapsed: false }] },\n      pagination: { pageSize: 100 },\n    },\n    all_webhooks: {\n      type: 'grid',\n      name: 'all_webhooks',\n      label: 'All',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n  },\n\n  fields: {\n    id: Field.text({ label: 'Webhook ID', required: true, readonly: true, group: 'System' }),\n\n    name: Field.text({\n      label: 'Name',\n      required: true,\n      maxLength: 100,\n      description: 'Unique snake_case name — referenced in logs and audit',\n      group: 'Definition',\n    }),\n\n    label: Field.text({\n      label: 'Display Label',\n      required: false,\n      maxLength: 200,\n      group: 'Definition',\n    }),\n\n    object_name: Field.text({\n      label: 'Object',\n      required: false,\n      maxLength: 100,\n      // Object picker (same widget as sys_sharing_rule) instead of a free-text\n      // machine name. Falls back to a text input when the widget is unavailable.\n      widget: 'object-ref',\n      description: 'Short object name whose record events (create/update/delete) fire this webhook',\n      group: 'Definition',\n    }),\n\n    triggers: Field.select(\n      ['create', 'update', 'delete'],\n      {\n        label: 'Triggers',\n        required: false,\n        // Multi-select instead of a hand-typed comma-separated string. Stored as\n        // an array; the auto-enqueuer parser also tolerates the legacy\n        // comma-separated / JSON-string forms so existing rows keep working.\n        multiple: true,\n        description: 'Record events that fire this webhook',\n        group: 'Definition',\n      },\n    ),\n\n    url: Field.text({\n      label: 'Target URL',\n      required: true,\n      maxLength: 2048,\n      description: 'External endpoint that receives the POST',\n      group: 'Definition',\n    }),\n\n    method: Field.select(\n      ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n      {\n        label: 'HTTP Method',\n        required: true,\n        // Select instead of free text. Option values are lowercased by the\n        // Field.select helper (get/post/…); the auto-enqueuer upper-cases the\n        // resolved method before delivery, so existing 'POST' rows and the\n        // lowercase option values both normalise correctly.\n        defaultValue: 'post',\n        description: 'HTTP method used for the callback request',\n        group: 'Definition',\n      },\n    ),\n\n    description: Field.textarea({ label: 'Description', required: false, group: 'Definition' }),\n\n    active: Field.boolean({\n      label: 'Active',\n      required: true,\n      defaultValue: true,\n      description: 'Inactive webhooks are skipped by the dispatcher',\n      group: 'Definition',\n    }),\n\n    definition_json: Field.textarea({\n      label: 'Definition',\n      required: true,\n      description: 'Serialised Webhook JSON (see @objectstack/spec/automation/webhook) — full headers/auth/retry/payload config',\n      group: 'Definition',\n    }),\n\n    // ── Provenance (#3461 — record-authoritative seed-not-clobber) ──\n    // Mirrors sys_sharing_rule (#2909). Both columns are `readonly`: the\n    // engine strips them from non-system payloads (forge/clear-proof), while\n    // bootstrapDeclaredWebhooks and the provenance stamp hook write with\n    // isSystem. Deliberately NOT a write gate: webhooks are a first-class admin\n    // authoring/tuning surface — admins may edit or deactivate a package row;\n    // the seeder simply stops overwriting it once `customized` is stamped.\n    managed_by: Field.select(\n      ['platform', 'package', 'admin'],\n      {\n        label: 'Managed By',\n        required: false,\n        readonly: true,\n        defaultValue: 'admin',\n        description:\n          'Record provenance: platform = framework built-in / package = app/package-declared ' +\n          '(boot-seeded from defineStack webhooks) / admin = created in Setup.',\n        group: 'System',\n      },\n    ),\n\n    customized: Field.boolean({\n      label: 'Customized',\n      required: false,\n      readonly: true,\n      defaultValue: false,\n      description:\n        'Set when an admin edits a package-declared webhook; boot seeding will no longer ' +\n        'overwrite the row (a deactivated noisy webhook survives redeploys). Meaningless on admin rows.',\n      group: 'System',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      required: true,\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n\n    updated_at: Field.datetime({ label: 'Updated At', required: false, group: 'System' }),\n  },\n\n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['object_name'] },\n    { fields: ['active', 'object_name'] },\n  ],\n});\n"],"mappings":";AAEA,SAAS,cAAc,aAAa;AAoC7B,IAAM,aAAa,aAAa,OAAO;AAAA,EAC5C,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMX,aAAa,EAAE,QAAQ,MAAM,MAAM,MAAM,QAAQ,MAAM,QAAQ,MAAM;AAAA,EACrE,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,WAAW;AAAA;AAAA,EACX,aAAa;AAAA,EACb,iBAAiB,CAAC,QAAQ,eAAe,OAAO,UAAU,YAAY;AAAA,EAEtE,WAAW;AAAA,IACT,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,cAAc;AAAA,MAClD,SAAS,CAAC,SAAS,eAAe,OAAO,UAAU,UAAU,YAAY;AAAA,MACzE,QAAQ,CAAC,EAAE,OAAO,UAAU,UAAU,UAAU,OAAO,KAAK,CAAC;AAAA,MAC7D,MAAM,CAAC,EAAE,OAAO,SAAS,OAAO,MAAM,CAAC;AAAA,MACvC,YAAY,EAAE,UAAU,GAAG;AAAA,IAC7B;AAAA,IACA,UAAU;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,cAAc;AAAA,MAClD,SAAS,CAAC,SAAS,eAAe,OAAO,UAAU,UAAU,YAAY;AAAA,MACzE,QAAQ,CAAC,EAAE,OAAO,UAAU,UAAU,UAAU,OAAO,MAAM,CAAC;AAAA,MAC9D,MAAM,CAAC,EAAE,OAAO,SAAS,OAAO,MAAM,CAAC;AAAA,MACvC,YAAY,EAAE,UAAU,GAAG;AAAA,IAC7B;AAAA,IACA,WAAW;AAAA,MACT,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,cAAc;AAAA,MAClD,SAAS,CAAC,eAAe,SAAS,OAAO,UAAU,YAAY;AAAA,MAC/D,MAAM,CAAC,EAAE,OAAO,eAAe,OAAO,MAAM,GAAG,EAAE,OAAO,SAAS,OAAO,MAAM,CAAC;AAAA,MAC/E,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,eAAe,OAAO,OAAO,WAAW,MAAM,CAAC,EAAE;AAAA,MAC/E,YAAY,EAAE,UAAU,IAAI;AAAA,IAC9B;AAAA,IACA,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,cAAc;AAAA,MAClD,SAAS,CAAC,SAAS,eAAe,OAAO,UAAU,UAAU,YAAY;AAAA,MACzE,MAAM,CAAC,EAAE,OAAO,SAAS,OAAO,MAAM,CAAC;AAAA,MACvC,YAAY,EAAE,UAAU,GAAG;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,QAAQ;AAAA,IACN,IAAI,MAAM,KAAK,EAAE,OAAO,cAAc,UAAU,MAAM,UAAU,MAAM,OAAO,SAAS,CAAC;AAAA,IAEvF,MAAM,MAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAa;AAAA,MACb,OAAO;AAAA,IACT,CAAC;AAAA,IAED,OAAO,MAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,MACX,OAAO;AAAA,IACT,CAAC;AAAA,IAED,aAAa,MAAM,KAAK;AAAA,MACtB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA;AAAA;AAAA,MAGX,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,OAAO;AAAA,IACT,CAAC;AAAA,IAED,UAAU,MAAM;AAAA,MACd,CAAC,UAAU,UAAU,QAAQ;AAAA,MAC7B;AAAA,QACE,OAAO;AAAA,QACP,UAAU;AAAA;AAAA;AAAA;AAAA,QAIV,UAAU;AAAA,QACV,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,KAAK,MAAM,KAAK;AAAA,MACd,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAa;AAAA,MACb,OAAO;AAAA,IACT,CAAC;AAAA,IAED,QAAQ,MAAM;AAAA,MACZ,CAAC,OAAO,QAAQ,OAAO,SAAS,QAAQ;AAAA,MACxC;AAAA,QACE,OAAO;AAAA,QACP,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,QAKV,cAAc;AAAA,QACd,aAAa;AAAA,QACb,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,aAAa,MAAM,SAAS,EAAE,OAAO,eAAe,UAAU,OAAO,OAAO,aAAa,CAAC;AAAA,IAE1F,QAAQ,MAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,cAAc;AAAA,MACd,aAAa;AAAA,MACb,OAAO;AAAA,IACT,CAAC;AAAA,IAED,iBAAiB,MAAM,SAAS;AAAA,MAC9B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,MACb,OAAO;AAAA,IACT,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASD,YAAY,MAAM;AAAA,MAChB,CAAC,YAAY,WAAW,OAAO;AAAA,MAC/B;AAAA,QACE,OAAO;AAAA,QACP,UAAU;AAAA,QACV,UAAU;AAAA,QACV,cAAc;AAAA,QACd,aACE;AAAA,QAEF,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,YAAY,MAAM,QAAQ;AAAA,MACxB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,cAAc;AAAA,MACd,aACE;AAAA,MAEF,OAAO;AAAA,IACT,CAAC;AAAA,IAED,YAAY,MAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,cAAc;AAAA,MACd,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,IAED,YAAY,MAAM,SAAS,EAAE,OAAO,cAAc,UAAU,OAAO,OAAO,SAAS,CAAC;AAAA,EACtF;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,aAAa,EAAE;AAAA,IAC1B,EAAE,QAAQ,CAAC,UAAU,aAAa,EAAE;AAAA,EACtC;AACF,CAAC;","names":[]}

package/dist/{chunk-PTMJ5BLL.cjs → chunk-QUTQSOQC.cjs}

@@ -13,7 +13,7 @@ var SysWebhook = _data.ObjectSchema.create({
   // create/edit/delete so admins can at least toggle `active` and edit
   // simple URL/method fields without round-tripping through code.
   userActions: { create: true, edit: true, delete: true, import: false },
-  description: "Outbound HTTP webhook subscription. Authored via defineWebhook() in code or the Studio editor; executed by the HTTP connector plugin.",
+  description: "Outbound HTTP webhook subscription. Declared in code via defineStack({ webhooks }) / defineWebhook() (materialized into rows on boot) or authored directly in the Studio editor; dispatched by the webhook auto-enqueuer onto the shared HTTP outbox.",
   displayNameField: "name",
   nameField: "name",
   // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
@@ -133,6 +133,32 @@ var SysWebhook = _data.ObjectSchema.create({
       description: "Serialised Webhook JSON (see @objectstack/spec/automation/webhook) \u2014 full headers/auth/retry/payload config",
       group: "Definition"
     }),
+    // ── Provenance (#3461 — record-authoritative seed-not-clobber) ──
+    // Mirrors sys_sharing_rule (#2909). Both columns are `readonly`: the
+    // engine strips them from non-system payloads (forge/clear-proof), while
+    // bootstrapDeclaredWebhooks and the provenance stamp hook write with
+    // isSystem. Deliberately NOT a write gate: webhooks are a first-class admin
+    // authoring/tuning surface — admins may edit or deactivate a package row;
+    // the seeder simply stops overwriting it once `customized` is stamped.
+    managed_by: _data.Field.select(
+      ["platform", "package", "admin"],
+      {
+        label: "Managed By",
+        required: false,
+        readonly: true,
+        defaultValue: "admin",
+        description: "Record provenance: platform = framework built-in / package = app/package-declared (boot-seeded from defineStack webhooks) / admin = created in Setup.",
+        group: "System"
+      }
+    ),
+    customized: _data.Field.boolean({
+      label: "Customized",
+      required: false,
+      readonly: true,
+      defaultValue: false,
+      description: "Set when an admin edits a package-declared webhook; boot seeding will no longer overwrite the row (a deactivated noisy webhook survives redeploys). Meaningless on admin rows.",
+      group: "System"
+    }),
     created_at: _data.Field.datetime({
       label: "Created At",
       required: true,
@@ -152,4 +178,4 @@ var SysWebhook = _data.ObjectSchema.create({
 
 
 exports.SysWebhook = SysWebhook;
-//# sourceMappingURL=chunk-PTMJ5BLL.cjs.map
+//# sourceMappingURL=chunk-QUTQSOQC.cjs.map

package/dist/chunk-QUTQSOQC.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/objectstack/objectstack/packages/plugins/plugin-webhooks/dist/chunk-QUTQSOQC.cjs","../src/sys-webhook.object.ts"],"names":[],"mappings":"AAAA;ACEA,8CAAoC;AAoC7B,IAAM,WAAA,EAAa,kBAAA,CAAa,MAAA,CAAO;AAAA,EAC5C,IAAA,EAAM,aAAA;AAAA,EACN,KAAA,EAAO,SAAA;AAAA,EACP,WAAA,EAAa,UAAA;AAAA,EACb,IAAA,EAAM,SAAA;AAAA,EACN,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMX,WAAA,EAAa,EAAE,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA;AAAA,EACrE,WAAA,EAAa,uPAAA;AAAA,EACb,gBAAA,EAAkB,MAAA;AAAA,EAClB,SAAA,EAAW,MAAA;AAAA;AAAA,EACX,WAAA,EAAa,SAAA;AAAA,EACb,eAAA,EAAiB,CAAC,MAAA,EAAQ,aAAA,EAAe,KAAA,EAAO,QAAA,EAAU,YAAY,CAAA;AAAA,EAEtE,SAAA,EAAW;AAAA,IACT,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,QAAA;AAAA,MACP,IAAA,EAAM,EAAE,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,cAAc,CAAA;AAAA,MAClD,OAAA,EAAS,CAAC,OAAA,EAAS,aAAA,EAAe,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,YAAY,CAAA;AAAA,MACzE,MAAA,EAAQ,CAAC,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,KAAA,EAAO,KAAK,CAAC,CAAA;AAAA,MAC7D,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MACvC,UAAA,EAAY,EAAE,QAAA,EAAU,GAAG;AAAA,IAC7B,CAAA;AAAA,IACA,QAAA,EAAU;AAAA,MACR,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,UAAA;AAAA,MACN,KAAA,EAAO,UAAA;AAAA,MACP,IAAA,EAAM,EAAE,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,cAAc,CAAA;AAAA,MAClD,OAAA,EAAS,CAAC,OAAA,EAAS,aAAA,EAAe,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,YAAY,CAAA;AAAA,MACzE,MAAA,EAAQ,CAAC,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MAC9D,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MACvC,UAAA,EAAY,EAAE,QAAA,EAAU,GAAG;AAAA,IAC7B,CAAA;AAAA,IACA,SAAA,EAAW;AAAA,MACT,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO,WAAA;AAAA,MACP,IAAA,EAAM,EAAE,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,cAAc,CAAA;AAAA,MAClD,OAAA,EAAS,CAAC,aAAA,EAAe,OAAA,EAAS,KAAA,EAAO,QAAA,EAAU,YAAY,CAAA;AAAA,MAC/D,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,aAAA,EAAe,KAAA,EAAO,MAAM,CAAA,EAAG,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MAC/E,QAAA,EAAU,EAAE,MAAA,EAAQ,CAAC,EAAE,KAAA,EAAO,aAAA,EAAe,KAAA,EAAO,KAAA,EAAO,SAAA,EAAW,MAAM,CAAC,EAAE,CAAA;AAAA,MAC/E,UAAA,EAAY,EAAE,QAAA,EAAU,IAAI;AAAA,IAC9B,CAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,cAAA;AAAA,MACN,KAAA,EAAO,KAAA;AAAA,MACP,IAAA,EAAM,EAAE,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,cAAc,CAAA;AAAA,MAClD,OAAA,EAAS,CAAC,OAAA,EAAS,aAAA,EAAe,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,YAAY,CAAA;AAAA,MACzE,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MACvC,UAAA,EAAY,EAAE,QAAA,EAAU,GAAG;AAAA,IAC7B;AAAA,EACF,CAAA;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,EAAA,EAAI,WAAA,CAAM,IAAA,CAAK,EAAE,KAAA,EAAO,YAAA,EAAc,QAAA,EAAU,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,SAAS,CAAC,CAAA;AAAA,IAEvF,IAAA,EAAM,WAAA,CAAM,IAAA,CAAK;AAAA,MACf,KAAA,EAAO,MAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,SAAA,EAAW,GAAA;AAAA,MACX,WAAA,EAAa,4DAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,KAAA,EAAO,WAAA,CAAM,IAAA,CAAK;AAAA,MAChB,KAAA,EAAO,eAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,GAAA;AAAA,MACX,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,WAAA,EAAa,WAAA,CAAM,IAAA,CAAK;AAAA,MACtB,KAAA,EAAO,QAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,GAAA;AAAA;AAAA;AAAA,MAGX,MAAA,EAAQ,YAAA;AAAA,MACR,WAAA,EAAa,gFAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,QAAA,EAAU,WAAA,CAAM,MAAA;AAAA,MACd,CAAC,QAAA,EAAU,QAAA,EAAU,QAAQ,CAAA;AAAA,MAC7B;AAAA,QACE,KAAA,EAAO,UAAA;AAAA,QACP,QAAA,EAAU,KAAA;AAAA;AAAA;AAAA;AAAA,QAIV,QAAA,EAAU,IAAA;AAAA,QACV,WAAA,EAAa,sCAAA;AAAA,QACb,KAAA,EAAO;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IAEA,GAAA,EAAK,WAAA,CAAM,IAAA,CAAK;AAAA,MACd,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,WAAA,EAAa,0CAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,MAAA,EAAQ,WAAA,CAAM,MAAA;AAAA,MACZ,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS,QAAQ,CAAA;AAAA,MACxC;AAAA,QACE,KAAA,EAAO,aAAA;AAAA,QACP,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKV,YAAA,EAAc,MAAA;AAAA,QACd,WAAA,EAAa,2CAAA;AAAA,QACb,KAAA,EAAO;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IAEA,WAAA,EAAa,WAAA,CAAM,QAAA,CAAS,EAAE,KAAA,EAAO,aAAA,EAAe,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,aAAa,CAAC,CAAA;AAAA,IAE1F,MAAA,EAAQ,WAAA,CAAM,OAAA,CAAQ;AAAA,MACpB,KAAA,EAAO,QAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,YAAA,EAAc,IAAA;AAAA,MACd,WAAA,EAAa,iDAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,eAAA,EAAiB,WAAA,CAAM,QAAA,CAAS;AAAA,MAC9B,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa,kHAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASD,UAAA,EAAY,WAAA,CAAM,MAAA;AAAA,MAChB,CAAC,UAAA,EAAY,SAAA,EAAW,OAAO,CAAA;AAAA,MAC/B;AAAA,QACE,KAAA,EAAO,YAAA;AAAA,QACP,QAAA,EAAU,KAAA;AAAA,QACV,QAAA,EAAU,IAAA;AAAA,QACV,YAAA,EAAc,OAAA;AAAA,QACd,WAAA,EACE,uJAAA;AAAA,QAEF,KAAA,EAAO;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IAEA,UAAA,EAAY,WAAA,CAAM,OAAA,CAAQ;AAAA,MACxB,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,QAAA,EAAU,IAAA;AAAA,MACV,YAAA,EAAc,KAAA;AAAA,MACd,WAAA,EACE,gLAAA;AAAA,MAEF,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,UAAA,EAAY,WAAA,CAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,UAAA,EAAY,WAAA,CAAM,QAAA,CAAS,EAAE,KAAA,EAAO,YAAA,EAAc,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,SAAS,CAAC;AAAA,EACtF,CAAA;AAAA,EAEA,OAAA,EAAS;AAAA,IACP,EAAE,MAAA,EAAQ,CAAC,MAAM,CAAA,EAAG,MAAA,EAAQ,KAAK,CAAA;AAAA,IACjC,EAAE,MAAA,EAAQ,CAAC,aAAa,EAAE,CAAA;AAAA,IAC1B,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,aAAa,EAAE;AAAA,EACtC;AACF,CAAC,CAAA;ADtDD;AACA;AACE;AACF,gCAAC","file":"/home/runner/work/objectstack/objectstack/packages/plugins/plugin-webhooks/dist/chunk-QUTQSOQC.cjs","sourcesContent":[null,"// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_webhook — Outbound HTTP integration configuration (runtime).\n *\n * Persists a single {@link Webhook} envelope per row so administrators\n * can author, enable/disable, and edit webhook subscriptions from the\n * Studio UI without code changes. The canonical Zod schema for the\n * `definition_json` envelope lives at `@objectstack/spec/automation/webhook`.\n *\n * ## Two authoring doors, one row\n * Rows land here two ways, distinguished by the `managed_by` provenance column:\n *   - **admin** — created/edited directly through this object's CRUD UI.\n *   - **package** — declared in code (`defineStack({ webhooks })` /\n *     `defineWebhook()`) and materialized on boot by\n *     `bootstrapDeclaredWebhooks` (#3461). Re-seeded every boot, but an admin\n *     edit stamps `customized: true` and freezes the row (seed-not-clobber,\n *     mirrors `sys_sharing_rule` #2909).\n *\n * One row per `name`. This plugin's {@link AutoEnqueuer} loads active rows on\n * boot + on `sys_webhook:changed` events, and turns matching `data.record.*`\n * events into deliveries on the shared `service-messaging` HTTP outbox\n * (ADR-0018 M3 — `sys_http_delivery`, drained by the messaging dispatcher).\n *\n * Ownership (ADR-0029 K2.a): this object is **owned by\n * `@objectstack/plugin-webhooks`** — the plugin that consumes these rows. It\n * used to live in the `@objectstack/platform-objects` monolith and be imported\n * here; the definition now lives with its owner so the plugin ships both data\n * and behavior as one unit.\n *\n * Platform-wide on purpose: every project (standalone, single-tenant,\n * cloud) can integrate with external systems (Slack, Stripe, internal\n * services) the same way.\n *\n * @namespace sys\n */\nexport const SysWebhook = ObjectSchema.create({\n  name: 'sys_webhook',\n  label: 'Webhook',\n  pluralLabel: 'Webhooks',\n  icon: 'webhook',\n  isSystem: true,\n  managedBy: 'config',\n  // Authoring a webhook from the UI requires a structured form for the\n  // headers / auth / retry / payload blocks — the generic JSON textarea\n  // is acceptable as a v1 until a dedicated builder lands. Re-enable\n  // create/edit/delete so admins can at least toggle `active` and edit\n  // simple URL/method fields without round-tripping through code.\n  userActions: { create: true, edit: true, delete: true, import: false },\n  description: 'Outbound HTTP webhook subscription. Declared in code via defineStack({ webhooks }) / defineWebhook() (materialized into rows on boot) or authored directly in the Studio editor; dispatched by the webhook auto-enqueuer onto the shared HTTP outbox.',\n  displayNameField: 'name',\n  nameField: 'name', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)\n  titleFormat: '{label}',\n  highlightFields: ['name', 'object_name', 'url', 'active', 'updated_at'],\n\n  listViews: {\n    active: {\n      type: 'grid',\n      name: 'active',\n      label: 'Active',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      filter: [{ field: 'active', operator: 'equals', value: true }],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n    inactive: {\n      type: 'grid',\n      name: 'inactive',\n      label: 'Inactive',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      filter: [{ field: 'active', operator: 'equals', value: false }],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n    by_object: {\n      type: 'grid',\n      name: 'by_object',\n      label: 'By Object',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['object_name', 'label', 'url', 'active', 'updated_at'],\n      sort: [{ field: 'object_name', order: 'asc' }, { field: 'label', order: 'asc' }],\n      grouping: { fields: [{ field: 'object_name', order: 'asc', collapsed: false }] },\n      pagination: { pageSize: 100 },\n    },\n    all_webhooks: {\n      type: 'grid',\n      name: 'all_webhooks',\n      label: 'All',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n  },\n\n  fields: {\n    id: Field.text({ label: 'Webhook ID', required: true, readonly: true, group: 'System' }),\n\n    name: Field.text({\n      label: 'Name',\n      required: true,\n      maxLength: 100,\n      description: 'Unique snake_case name — referenced in logs and audit',\n      group: 'Definition',\n    }),\n\n    label: Field.text({\n      label: 'Display Label',\n      required: false,\n      maxLength: 200,\n      group: 'Definition',\n    }),\n\n    object_name: Field.text({\n      label: 'Object',\n      required: false,\n      maxLength: 100,\n      // Object picker (same widget as sys_sharing_rule) instead of a free-text\n      // machine name. Falls back to a text input when the widget is unavailable.\n      widget: 'object-ref',\n      description: 'Short object name whose record events (create/update/delete) fire this webhook',\n      group: 'Definition',\n    }),\n\n    triggers: Field.select(\n      ['create', 'update', 'delete'],\n      {\n        label: 'Triggers',\n        required: false,\n        // Multi-select instead of a hand-typed comma-separated string. Stored as\n        // an array; the auto-enqueuer parser also tolerates the legacy\n        // comma-separated / JSON-string forms so existing rows keep working.\n        multiple: true,\n        description: 'Record events that fire this webhook',\n        group: 'Definition',\n      },\n    ),\n\n    url: Field.text({\n      label: 'Target URL',\n      required: true,\n      maxLength: 2048,\n      description: 'External endpoint that receives the POST',\n      group: 'Definition',\n    }),\n\n    method: Field.select(\n      ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n      {\n        label: 'HTTP Method',\n        required: true,\n        // Select instead of free text. Option values are lowercased by the\n        // Field.select helper (get/post/…); the auto-enqueuer upper-cases the\n        // resolved method before delivery, so existing 'POST' rows and the\n        // lowercase option values both normalise correctly.\n        defaultValue: 'post',\n        description: 'HTTP method used for the callback request',\n        group: 'Definition',\n      },\n    ),\n\n    description: Field.textarea({ label: 'Description', required: false, group: 'Definition' }),\n\n    active: Field.boolean({\n      label: 'Active',\n      required: true,\n      defaultValue: true,\n      description: 'Inactive webhooks are skipped by the dispatcher',\n      group: 'Definition',\n    }),\n\n    definition_json: Field.textarea({\n      label: 'Definition',\n      required: true,\n      description: 'Serialised Webhook JSON (see @objectstack/spec/automation/webhook) — full headers/auth/retry/payload config',\n      group: 'Definition',\n    }),\n\n    // ── Provenance (#3461 — record-authoritative seed-not-clobber) ──\n    // Mirrors sys_sharing_rule (#2909). Both columns are `readonly`: the\n    // engine strips them from non-system payloads (forge/clear-proof), while\n    // bootstrapDeclaredWebhooks and the provenance stamp hook write with\n    // isSystem. Deliberately NOT a write gate: webhooks are a first-class admin\n    // authoring/tuning surface — admins may edit or deactivate a package row;\n    // the seeder simply stops overwriting it once `customized` is stamped.\n    managed_by: Field.select(\n      ['platform', 'package', 'admin'],\n      {\n        label: 'Managed By',\n        required: false,\n        readonly: true,\n        defaultValue: 'admin',\n        description:\n          'Record provenance: platform = framework built-in / package = app/package-declared ' +\n          '(boot-seeded from defineStack webhooks) / admin = created in Setup.',\n        group: 'System',\n      },\n    ),\n\n    customized: Field.boolean({\n      label: 'Customized',\n      required: false,\n      readonly: true,\n      defaultValue: false,\n      description:\n        'Set when an admin edits a package-declared webhook; boot seeding will no longer ' +\n        'overwrite the row (a deactivated noisy webhook survives redeploys). Meaningless on admin rows.',\n      group: 'System',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      required: true,\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n\n    updated_at: Field.datetime({ label: 'Updated At', required: false, group: 'System' }),\n  },\n\n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['object_name'] },\n    { fields: ['active', 'object_name'] },\n  ],\n});\n"]}

package/dist/index.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkPTMJ5BLLcjs = require('./chunk-PTMJ5BLL.cjs');
+var _chunkQUTQSOQCcjs = require('./chunk-QUTQSOQC.cjs');
 
 // src/auto-enqueuer.ts
 var AutoEnqueuer = class {
@@ -180,12 +180,21 @@ var AutoEnqueuer = class {
         headers: sub.headers,
         signingSecret: sub.secret,
         timeoutMs: sub.timeoutMs,
+        // [#3946] Envelope keys are written LAST so the event payload
+        // cannot rewrite them. Behaviour-neutral for the engine's own
+        // publishers — `data.record.*` payloads are
+        // `{ recordId, after, changes }`, with record fields nested
+        // under `after`, so none of these four keys collide today. It
+        // is the shape that was wrong: a publisher that flattened
+        // record fields into the payload (the `payload.id` fallback
+        // above suggests some do) would have silently rewritten the
+        // `object` / `action` / `timestamp` a subscriber receives.
         payload: {
+          ...payload,
           object: event.object,
           recordId,
           action,
-          timestamp: event.timestamp,
-          ...payload
+          timestamp: event.timestamp
         }
       }).catch(
         (err) => _optionalChain([this, 'access', _25 => _25.logger, 'access', _26 => _26.warn, 'optionalCall', _27 => _27("[webhook-auto-enqueuer] enqueue failed", {
@@ -222,6 +231,163 @@ function mapActionToTrigger(action) {
 }
 var DISPATCHABLE_WEBHOOK_TRIGGERS = /* @__PURE__ */ new Set(["create", "update", "delete"]);
 
+// src/bootstrap-declared-webhooks.ts
+var _automation = require('@objectstack/spec/automation');
+var SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] };
+function uid(prefix) {
+  const g = globalThis;
+  if (_optionalChain([g, 'access', _35 => _35.crypto, 'optionalAccess', _36 => _36.randomUUID])) return `${prefix}_${g.crypto.randomUUID()}`;
+  return `${prefix}_${Math.random().toString(36).slice(2, 10)}`;
+}
+function readDeclared(engine, metadataService, type) {
+  try {
+    const reg = _optionalChain([engine, 'optionalAccess', _37 => _37._registry]);
+    if (_optionalChain([reg, 'optionalAccess', _38 => _38.listItems])) {
+      const items = (_nullishCoalesce(reg.listItems(type), () => ( []))).map((i) => _nullishCoalesce(_optionalChain([i, 'optionalAccess', _39 => _39.content]), () => ( i))).filter(Boolean);
+      if (items.length > 0) return items;
+    }
+  } catch (e3) {
+  }
+  try {
+    const listed = _optionalChain([metadataService, 'optionalAccess', _40 => _40.list, 'optionalCall', _41 => _41(type)]);
+    const arr = typeof _optionalChain([listed, 'optionalAccess', _42 => _42.then]) === "function" ? [] : _nullishCoalesce(listed, () => ( []));
+    return Array.isArray(arr) ? arr.map((i) => _nullishCoalesce(_optionalChain([i, 'optionalAccess', _43 => _43.content]), () => ( i))).filter(Boolean) : [];
+  } catch (e4) {
+    return [];
+  }
+}
+async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscriptionsObject = "sys_webhook") {
+  const declared = readDeclared(engine, metadataService, "webhook");
+  if (declared.length === 0) return { seeded: 0, skipped: 0 };
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  let seeded = 0;
+  let skipped = 0;
+  for (const raw of declared) {
+    let wh;
+    try {
+      wh = _automation.WebhookSchema.parse(raw);
+    } catch (err) {
+      _optionalChain([logger, 'optionalAccess', _44 => _44.warn, 'optionalCall', _45 => _45("[webhook] declared webhook failed validation \u2014 skipped", {
+        name: _optionalChain([raw, 'optionalAccess', _46 => _46.name]),
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _47 => _47.message]), () => ( String(err)))
+      })]);
+      skipped += 1;
+      continue;
+    }
+    try {
+      const existing = await engine.find(subscriptionsObject, {
+        where: { name: wh.name },
+        limit: 1,
+        context: SYSTEM_CTX
+      });
+      const row = Array.isArray(existing) ? existing[0] : void 0;
+      if (row) {
+        if (row.managed_by === "admin") {
+          _optionalChain([logger, 'optionalAccess', _48 => _48.warn, 'optionalCall', _49 => _49("[webhook] declared name collides with an admin-authored row \u2014 seed skipped", {
+            name: wh.name
+          })]);
+          skipped += 1;
+          continue;
+        }
+        if (row.customized === true) {
+          skipped += 1;
+          continue;
+        }
+        const patch = {
+          id: row.id,
+          ...mapWebhookToRow(wh),
+          // Adopt pristine/legacy (pre-provenance) rows so future boots
+          // recognize them as package-managed.
+          managed_by: "package",
+          updated_at: now
+        };
+        await engine.update(subscriptionsObject, patch, { context: SYSTEM_CTX });
+        seeded += 1;
+        continue;
+      }
+      const newRow = {
+        id: uid("whk"),
+        ...mapWebhookToRow(wh),
+        managed_by: "package",
+        customized: false,
+        created_at: now,
+        updated_at: now
+      };
+      await engine.insert(subscriptionsObject, newRow, { context: SYSTEM_CTX });
+      seeded += 1;
+    } catch (err) {
+      _optionalChain([logger, 'optionalAccess', _50 => _50.warn, 'optionalCall', _51 => _51("[webhook] declared webhook seed failed", {
+        name: wh.name,
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _52 => _52.message]), () => ( String(err)))
+      })]);
+      skipped += 1;
+    }
+  }
+  _optionalChain([logger, 'optionalAccess', _53 => _53.info, 'optionalCall', _54 => _54("[webhook] declared webhooks materialized into sys_webhook", {
+    seeded,
+    skipped,
+    total: declared.length
+  })]);
+  return { seeded, skipped };
+}
+function mapWebhookToRow(wh) {
+  return {
+    name: wh.name,
+    label: _nullishCoalesce(wh.label, () => ( wh.name)),
+    object_name: _nullishCoalesce(wh.object, () => ( null)),
+    triggers: _nullishCoalesce(wh.triggers, () => ( [])),
+    url: wh.url,
+    // Store lowercase to match the object's Field.select option values
+    // (get/post/…); the enqueuer upper-cases before delivery either way.
+    method: String(_nullishCoalesce(wh.method, () => ( "POST"))).toLowerCase(),
+    description: _nullishCoalesce(wh.description, () => ( null)),
+    active: wh.isActive !== false,
+    definition_json: JSON.stringify(wh)
+  };
+}
+
+// src/webhook-provenance.ts
+var WEBHOOK_PROVENANCE_PACKAGE = "plugin-webhooks:provenance";
+var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+function bindWebhookProvenanceStamp(engine, logger) {
+  if (typeof _optionalChain([engine, 'optionalAccess', _55 => _55.registerHook]) !== "function") return;
+  engine.registerHook(
+    "beforeUpdate",
+    async (ctx) => {
+      if (_optionalChain([ctx, 'optionalAccess', _56 => _56.session, 'optionalAccess', _57 => _57.isSystem])) return;
+      const id = _nullishCoalesce(_optionalChain([ctx, 'optionalAccess', _58 => _58.input, 'optionalAccess', _59 => _59.id]), () => ( _optionalChain([ctx, 'optionalAccess', _60 => _60.input, 'optionalAccess', _61 => _61.data, 'optionalAccess', _62 => _62.id])));
+      if (!id) return;
+      const data = _optionalChain([ctx, 'optionalAccess', _63 => _63.input, 'optionalAccess', _64 => _64.data]);
+      if (!data || typeof data !== "object") return;
+      try {
+        const rows = await engine.find("sys_webhook", {
+          where: { id },
+          fields: ["id", "managed_by", "customized"],
+          limit: 1,
+          context: SYSTEM_CTX2
+        });
+        const row = Array.isArray(rows) ? rows[0] : void 0;
+        if (!row) return;
+        if ((row.managed_by === "package" || row.managed_by === "platform") && row.customized !== true) {
+          data.customized = true;
+        }
+      } catch (err) {
+        _optionalChain([logger, 'optionalAccess', _65 => _65.warn, 'optionalCall', _66 => _66("[webhook] provenance stamp failed (edit proceeds unstamped)", {
+          id,
+          error: _optionalChain([err, 'optionalAccess', _67 => _67.message])
+        })]);
+      }
+    },
+    { object: "sys_webhook", packageId: WEBHOOK_PROVENANCE_PACKAGE, priority: 150 }
+  );
+  _optionalChain([logger, 'optionalAccess', _68 => _68.info, 'optionalCall', _69 => _69("[webhook] provenance stamp hook bound")]);
+}
+function unbindWebhookProvenanceStamp(engine) {
+  if (typeof _optionalChain([engine, 'optionalAccess', _70 => _70.unregisterHooksByPackage]) === "function") {
+    engine.unregisterHooksByPackage(WEBHOOK_PROVENANCE_PACKAGE);
+  }
+}
+
 // src/webhook-outbox-plugin.ts
 var WebhookOutboxPlugin = class {
   constructor(options = {}) {
@@ -230,6 +396,16 @@ var WebhookOutboxPlugin = class {
     this.version = "2.0.0";
     this.type = "standard";
     this.dependencies = ["com.objectstack.service.messaging"];
+    /**
+     * `init()` registers this plugin's schema through `manifest` with no
+     * fallback. Until #4187 that was safe only TRANSITIVELY — messaging happens
+     * to depend on ObjectQL, which provides `manifest` — so the guarantee would
+     * have evaporated silently the day messaging stopped depending on the
+     * engine, and the failure would have surfaced as an unrelated plugin's
+     * init crash. Declaring the requirement directly makes the kernel check it
+     * regardless of what messaging depends on.
+     */
+    this.requiresServices = ["manifest"];
   }
   async init(ctx) {
     const manifest = ctx.getService("manifest");
@@ -242,7 +418,7 @@ var WebhookOutboxPlugin = class {
         scope: "system",
         name: "Webhook Schemas",
         description: "Registers sys_webhook (configuration). Deliveries use messaging's sys_http_delivery outbox.",
-        objects: [_chunkPTMJ5BLLcjs.SysWebhook],
+        objects: [_chunkQUTQSOQCcjs.SysWebhook],
         navigationContributions: [
           {
             app: "setup",
@@ -256,7 +432,7 @@ var WebhookOutboxPlugin = class {
         ]
       });
     } else {
-      _optionalChain([ctx, 'access', _35 => _35.logger, 'access', _36 => _36.warn, 'optionalCall', _37 => _37(
+      _optionalChain([ctx, 'access', _71 => _71.logger, 'access', _72 => _72.warn, 'optionalCall', _73 => _73(
         "[webhook-outbox] manifest service unavailable \u2014 sys_webhook will NOT appear in REST or Studio nav. Register MetadataService before WebhookOutboxPlugin."
       )]);
     }
@@ -265,47 +441,88 @@ var WebhookOutboxPlugin = class {
         try {
           const i18n = ctx.getService("i18n");
           if (i18n && typeof i18n.loadTranslations === "function") {
-            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-L2JAQDJB.cjs")));
+            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-CBQRUIS5.cjs")));
             for (const [locale, data] of Object.entries(WebhooksTranslations)) {
               i18n.loadTranslations(locale, data);
             }
           }
-        } catch (e3) {
+        } catch (e5) {
         }
       });
     }
     const autoEnqueueOpt = _nullishCoalesce(this.options.autoEnqueue, () => ( true));
     if (typeof ctx.hook === "function") {
       ctx.hook("kernel:ready", async () => {
+        await this.bootDeclaredWebhooks(ctx);
         await this.bootAutoEnqueue(ctx, autoEnqueueOpt);
         this.registerAdminRoutes(ctx);
       });
     }
-    _optionalChain([ctx, 'access', _38 => _38.logger, 'access', _39 => _39.info, 'optionalCall', _40 => _40("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
+    _optionalChain([ctx, 'access', _74 => _74.logger, 'access', _75 => _75.info, 'optionalCall', _76 => _76("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
       autoEnqueue: autoEnqueueOpt !== false
     })]);
   }
   async dispose() {
-    await _optionalChain([this, 'access', _41 => _41.autoEnqueuer, 'optionalAccess', _42 => _42.stop, 'call', _43 => _43()]);
+    await _optionalChain([this, 'access', _77 => _77.autoEnqueuer, 'optionalAccess', _78 => _78.stop, 'call', _79 => _79()]);
+    if (this.boundEngine) {
+      try {
+        unbindWebhookProvenanceStamp(this.boundEngine);
+      } catch (e6) {
+      }
+      this.boundEngine = void 0;
+    }
   }
   getMessaging(ctx) {
     const svc = this.tryGetService(ctx, ["messaging"]);
     return svc && typeof svc.enqueueHttp === "function" ? svc : void 0;
   }
+  /**
+   * [#3461] Bridge the declarative authoring surface to the dispatcher:
+   * materialize stack/connector-declared `webhook` metadata into `sys_webhook`
+   * rows so the auto-enqueuer (and the Studio UI) can see them.
+   *
+   * Gated on the DATA ENGINE alone — deliberately independent of the
+   * auto-enqueue dispatch prerequisites (realtime + messaging). Materializing
+   * rows is a pure write; a deployment that mounts the webhook plugin without
+   * realtime must still get its declared webhooks into the table (and the
+   * Setup UI), even if nothing dispatches them yet. Runs before
+   * {@link bootAutoEnqueue} so the enqueuer's first cache refresh sees the rows.
+   */
+  async bootDeclaredWebhooks(ctx) {
+    const engine = this.tryGetService(ctx, ["objectql", "data"]);
+    if (!engine) {
+      _optionalChain([ctx, 'access', _80 => _80.logger, 'access', _81 => _81.warn, 'optionalCall', _82 => _82("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
+      return;
+    }
+    this.boundEngine = engine;
+    bindWebhookProvenanceStamp(engine, ctx.logger);
+    let metadataService;
+    try {
+      metadataService = ctx.getService("metadata");
+    } catch (e7) {
+    }
+    try {
+      await bootstrapDeclaredWebhooks(engine, metadataService, ctx.logger);
+    } catch (err) {
+      _optionalChain([ctx, 'access', _83 => _83.logger, 'access', _84 => _84.warn, 'optionalCall', _85 => _85("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _86 => _86.message]), () => ( String(err)))
+      })]);
+    }
+  }
   async bootAutoEnqueue(ctx, opt) {
     if (opt === false) return;
     const engine = this.tryGetService(ctx, ["objectql", "data"]);
     const realtime = this.tryGetService(ctx, ["realtime"]);
     const messaging = this.getMessaging(ctx);
     if (!engine || !realtime || !messaging) {
-      _optionalChain([ctx, 'access', _44 => _44.logger, 'access', _45 => _45.warn, 'optionalCall', _46 => _46(
+      _optionalChain([ctx, 'access', _87 => _87.logger, 'access', _88 => _88.warn, 'optionalCall', _89 => _89(
         "[webhook-auto-enqueuer] disabled \u2014 ObjectQL, Realtime, or Messaging service not available",
         { hasEngine: !!engine, hasRealtime: !!realtime, hasMessaging: !!messaging }
       )]);
       return;
     }
     if (!messaging.isHttpDeliveryReady()) {
-      _optionalChain([ctx, 'access', _47 => _47.logger, 'access', _48 => _48.warn, 'optionalCall', _49 => _49(
+      _optionalChain([ctx, 'access', _90 => _90.logger, 'access', _91 => _91.warn, 'optionalCall', _92 => _92(
         "[webhook-auto-enqueuer] messaging HTTP outbox not ready (no data engine / reliableDelivery off) \u2014 webhook deliveries will not be durable"
       )]);
     }
@@ -318,14 +535,14 @@ var WebhookOutboxPlugin = class {
     );
     await this.autoEnqueuer.start();
     ctx.registerService("webhook.autoEnqueuer", this.autoEnqueuer);
-    _optionalChain([ctx, 'access', _50 => _50.logger, 'access', _51 => _51.info, 'optionalCall', _52 => _52("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
+    _optionalChain([ctx, 'access', _93 => _93.logger, 'access', _94 => _94.info, 'optionalCall', _95 => _95("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
   }
   tryGetService(ctx, names) {
     for (const n of names) {
       try {
         const svc = ctx.getService(n);
         if (svc) return svc;
-      } catch (e4) {
+      } catch (e8) {
       }
     }
     return void 0;
@@ -338,7 +555,7 @@ var WebhookOutboxPlugin = class {
   registerAdminRoutes(ctx) {
     const http = this.tryGetService(ctx, ["http-server"]);
     if (!http || typeof http.getRawApp !== "function") {
-      _optionalChain([ctx, 'access', _53 => _53.logger, 'access', _54 => _54.debug, 'optionalCall', _55 => _55("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
+      _optionalChain([ctx, 'access', _96 => _96.logger, 'access', _97 => _97.debug, 'optionalCall', _98 => _98("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
       return;
     }
     const rawApp = http.getRawApp();
@@ -348,43 +565,43 @@ var WebhookOutboxPlugin = class {
       const userId = await this.resolveSessionUserId(ctx, c);
       if (!userId) {
         return c.json(
-          { success: false, error: "unauthenticated", message: "Sign in to redeliver webhook deliveries." },
+          { success: false, error: { code: "UNAUTHENTICATED", message: "Sign in to redeliver webhook deliveries." } },
           401
         );
       }
       let body;
       try {
         body = await c.req.json();
-      } catch (e5) {
-        return c.json({ success: false, error: "invalid_body", message: "Request body must be JSON." }, 400);
+      } catch (e9) {
+        return c.json({ success: false, error: { code: "INVALID_REQUEST", message: "Request body must be JSON." } }, 400);
       }
-      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _56 => _56.deliveryId]) === "string" ? body.deliveryId.trim() : "";
+      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _99 => _99.deliveryId]) === "string" ? body.deliveryId.trim() : "";
       if (!deliveryId) {
         return c.json(
-          { success: false, error: "missing_delivery_id", message: "Body must include `deliveryId: string`." },
+          { success: false, error: { code: "MISSING_REQUIRED_FIELD", message: "Body must include `deliveryId: string`." } },
           400
         );
       }
       try {
         const row = await messaging.redeliverHttp(deliveryId);
-        _optionalChain([ctx, 'access', _57 => _57.logger, 'access', _58 => _58.info, 'optionalCall', _59 => _59("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId })]);
+        _optionalChain([ctx, 'access', _100 => _100.logger, 'access', _101 => _101.info, 'optionalCall', _102 => _102("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId })]);
         return c.json({ success: true, data: { id: row.id, status: row.status } });
       } catch (err) {
-        const code = _optionalChain([err, 'optionalAccess', _60 => _60.code]);
-        if (code === "not_found") {
-          return c.json({ success: false, error: "not_found", message: err.message }, 404);
+        const code = _optionalChain([err, 'optionalAccess', _103 => _103.code]);
+        if (code === "RESOURCE_NOT_FOUND") {
+          return c.json({ success: false, error: { code, message: err.message } }, 404);
         }
-        if (code === "not_eligible") {
-          return c.json({ success: false, error: "not_eligible", message: err.message }, 409);
+        if (code === "DELIVERY_NOT_ELIGIBLE") {
+          return c.json({ success: false, error: { code, message: err.message } }, 409);
         }
-        _optionalChain([ctx, 'access', _61 => _61.logger, 'access', _62 => _62.error, 'optionalCall', _63 => _63("[webhook-outbox] redeliver failed", err)]);
+        _optionalChain([ctx, 'access', _104 => _104.logger, 'access', _105 => _105.error, 'optionalCall', _106 => _106("[webhook-outbox] redeliver failed", err)]);
         return c.json(
-          { success: false, error: "internal_error", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _64 => _64.message]), () => ( String(err))) },
+          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _107 => _107.message]), () => ( String(err))) } },
           500
         );
       }
     });
-    _optionalChain([ctx, 'access', _65 => _65.logger, 'access', _66 => _66.info, 'optionalCall', _67 => _67("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
+    _optionalChain([ctx, 'access', _108 => _108.logger, 'access', _109 => _109.info, 'optionalCall', _110 => _110("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
   }
   async resolveSessionUserId(ctx, c) {
     try {
@@ -394,11 +611,11 @@ var WebhookOutboxPlugin = class {
       if (!api && typeof authService.getApi === "function") {
         api = await authService.getApi();
       }
-      if (!_optionalChain([api, 'optionalAccess', _68 => _68.getSession])) return void 0;
+      if (!_optionalChain([api, 'optionalAccess', _111 => _111.getSession])) return void 0;
       const session = await api.getSession({ headers: c.req.raw.headers });
-      const uid = _optionalChain([session, 'optionalAccess', _69 => _69.user, 'optionalAccess', _70 => _70.id]);
-      return typeof uid === "string" && uid.length > 0 ? uid : void 0;
-    } catch (e6) {
+      const uid2 = _optionalChain([session, 'optionalAccess', _112 => _112.user, 'optionalAccess', _113 => _113.id]);
+      return typeof uid2 === "string" && uid2.length > 0 ? uid2 : void 0;
+    } catch (e10) {
       return void 0;
     }
   }
@@ -407,5 +624,5 @@ var WebhookOutboxPlugin = class {
 
 
 
-exports.AutoEnqueuer = AutoEnqueuer; exports.SysWebhook = _chunkPTMJ5BLLcjs.SysWebhook; exports.WebhookOutboxPlugin = WebhookOutboxPlugin;
+exports.AutoEnqueuer = AutoEnqueuer; exports.SysWebhook = _chunkQUTQSOQCcjs.SysWebhook; exports.WebhookOutboxPlugin = WebhookOutboxPlugin;
 //# sourceMappingURL=index.cjs.map