@objectstack/plugin-webhooks 17.0.0 → 17.2.0

package/CHANGELOG.md

@@ -1,5 +1,431 @@
 # @objectstack/plugin-webhooks
 
+## 17.2.0
+
+### Minor Changes
+
+- cdaa72f: fix(service-messaging,plugin-webhooks): the `update`-op tenant-audit surface on the delivery outboxes is classified — `ack` is a dispatcher sweep, `redeliver` threads the caller's tenant (#10740)
+  
+  **BREAKING** signature change on `IHttpOutbox.redeliver` and
+  `MessagingService.redeliverHttp`, shipped as `minor` under the repo's
+  launch-window convention for breaking changes.
+  
+  `sys_http_delivery` and `sys_notification_delivery` carry three single-record
+  (`multi: false`) writes that the SQL driver audits under the **`update`** op —
+  a different op, and a different throttle key, from the `updateMany` half
+  classified previously. Their correct classifications are **opposite**, and
+  treating them as one sweep is the dangerous reading:
+  
+  | site | reachable from | classification |
+  | --- | --- | --- |
+  | `SqlNotificationOutbox.ack` | dispatcher tick only | global sweep |
+  | `SqlHttpOutbox.ack` | dispatcher tick only | global sweep |
+  | `SqlHttpOutbox.redeliver` | `POST /api/v1/webhooks/redeliver` | request-contextual |
+  
+  **The two `ack` sites** are declared global sweeps through a new
+  `dispatcherAckOptions()` helper, sibling to `dispatcherSweepOptions()` and
+  deliberately not the same function — that one returns `& { multi: true }`, so a
+  `multi: false` site cannot borrow it by accident. The warrant was re-derived
+  against the current tree rather than inherited: `ack` has exactly two callers,
+  both inside `runPartition()` on a `setInterval` tick holding a per-partition
+  cluster lock, so no request context exists to thread; and the row being acked
+  was claimed by a sweep that crosses organizations by construction
+  (`hash(refId | notificationId | digestKey) mod N` is a load-spreading key, and
+  one outbox per environment drains the whole queue). Passing the claimed row's
+  own `organization_id` is documented at the helper as the tempting wrong answer:
+  a predicate read off the row you are about to write matches exactly that row,
+  adds no isolation, and silences the audit anyway — the appearance of scoping
+  without the substance.
+  
+  **`redeliver` is not that**, and it is the reason this shipped separately. The
+  route in front of it is served to any authenticated user, so on a walled
+  deployment (`OS_TENANCY_POSTURE=isolated|group`) an unscoped replay is an
+  authenticated user writing another organization's delivery row — the case the
+  tenant audit exists to catch. It now carries the caller's tenant, applied to
+  the rows it reads as well as the row it writes, and it must never be given
+  `bypassTenantAudit`: a scoped write and a bypassed write produce the same
+  silence in the log, so the flag would convert a detectable hole into an
+  undetectable one. The webhook route resolves the session's
+  `activeOrganizationId` and threads it.
+  
+  Behaviour change at the endpoint: a delivery row outside the caller's
+  organization is now **not found** (`RESOURCE_NOT_FOUND`, HTTP 404) rather than
+  replayed. It is deliberately invisible rather than forbidden, so the endpoint
+  is not an existence oracle for other tenants' delivery ids. An in-tenant
+  redelivery is unchanged.
+  
+  Migrating a caller: `redeliver(id, guard?)` becomes
+  `redeliver(id, { tenantId, guard? })`, and `redeliverHttp(id)` becomes
+  `redeliverHttp(id, { tenantId })`. `tenantId` is a **required** property typed
+  `string | undefined`, so omitting it does not compile — a caller with no tenant
+  has to write `tenantId: undefined` and mean it. That is the point of the shape:
+  an optional property would let the dangerous case, a request path that simply
+  forgot, type-check in silence. Passing `undefined` leaves the write unscoped
+  and the audit line still fires, which is the intended reporting behaviour on a
+  deployment that cannot resolve an organization for the caller.
+  
+  <!-- adr-0087: not-required (runtime-interface-only packages/services/service-messaging/src/http-outbox.ts#IHttpOutbox, packages/services/service-messaging/src/http-outbox.ts#RedeliverOptions) The surface that changed shape is `IHttpOutbox.redeliver`, plus the new `RedeliverOptions` argument type beside it. Both are TypeScript declarations in a service package with no `packages/spec` schema behind them: no metadata author writes a `redeliver` key, there is no authorable spelling and no `retiredKey()` tombstone, so `os migrate meta` has no stack source to rewrite. The change is a required second argument on an in-process method — a compile error at every call site, which is the notification channel, not a silent runtime gap. `MessagingService.redeliverHttp` moves with it and is deliberately NOT in the list above: this gate refuses that symbol as unresolvable, because `packages/spec/src/api/protocol.zod.ts` mentions the class name in a prose comment about `MessagingService.listInbox` while neither declaring nor importing it. The claim would be true and the gate cannot check it, so it is stated here for a reviewer instead of asserted where it would read as verified. It is a thin delegate to `IHttpOutbox.redeliver` in the same package and carries no schema of its own either. -->
+- e222a53: **BREAKING** (compile-time only): twelve logger sink types that declared an
+  optional `error` now declare a **non-optional** `warn`, so a durability report
+  always has somewhere to land (#9754, #10556).
+  
+  `minor`, not `major`: during the launch window this stack ships breaking changes
+  as `minor` — every publishable package versions in lockstep, so a `major` would
+  promote the whole release. `patch` would be wrong in the other direction, because
+  this *can* break a consumer's build.
+  
+  `error` stays optional on every one of these types — hosts legitimately inject
+  reduced sinks, and requiring `error` was measured and rejected as #9754 option C.
+  What changes is that its *absence* now has a declared, guaranteed destination.
+  Call sites keep the `logger?.warn?.(…)` spelling as the backstop for hosts the
+  type cannot reach, so **no runtime behaviour changes**: nothing that printed
+  before stops printing, and nothing silent starts printing.
+  
+  ### Who has to change, and what to do
+  
+  Only a caller that hands one of these sinks an object with **no `warn` method** —
+  for example `{ info }` or `{ error }` alone. Add a `warn` member; there is no
+  rename, no removal, and no stored value or metadata key to rewrite. Every
+  construction site inside this repo already supplied one, so the in-repo cost was
+  zero; the compile error is reserved for the callers that were silently discarding
+  these reports.
+  
+  The affected types, by package:
+  
+  - `@objectstack/cloud-connection` — the internal `PluginContext['logger']`
+  - `@objectstack/metadata-protocol` — `IndexMigrationLogger`
+  - `@objectstack/plugin-approvals` — the internal `MinimalLogger` of `lifecycle-hooks`
+  - `@objectstack/plugin-audit` — `AuthEventAuditLogger`, `ReadAuditLogger`
+  - `@objectstack/plugin-auth` — `ReconcileMembershipDeps['logger']`, the internal
+    `LoggerLike` of `member-role-canonical`, and `AuthManagerOptions['logger']`
+  - `@objectstack/plugin-email` — `ReclaimLogger`, via `ReclaimAttachmentContentOptions`
+  - `@objectstack/plugin-reports` — `ReportServiceOptions['logger']`
+  - `@objectstack/plugin-sharing` — the internal `MinimalLogger` of `bulk-recompute`,
+    `rule-hooks` and `record-share-cascade`
+  - `@objectstack/plugin-webhooks` — `OptionalLogger`, via `AutoEnqueuerOptions`
+  - `@objectstack/service-knowledge` — `KnowledgeLogger`
+  
+  `AuthManagerOptions['logger']` is the one most likely to be reached from outside:
+  `AuthManager` is public surface, its `logger` option stays optional, and a logger
+  that *is* supplied must now carry `warn`. The only non-test construction site in
+  this repo passes the kernel `Logger`, whose `warn` is already required.
+  
+  `ReportService` and `AutoEnqueuer` additionally stopped defaulting their logger
+  field to `{}`. The field is now honestly optional rather than holding an empty
+  object that declared it could report and discarded everything. Behaviour is
+  unchanged in both directions.
+  
+  <!-- adr-0087: not-required (runtime-interface-only packages/plugins/plugin-auth/src/auth-manager.ts#AuthManagerOptions, packages/plugins/plugin-auth/src/reconcile-membership.ts#ReconcileMembershipDeps, packages/metadata-protocol/src/migrations/partial-index-probe.ts#IndexMigrationLogger, packages/plugins/plugin-audit/src/auth-event-audit.ts#AuthEventAuditLogger, packages/plugins/plugin-audit/src/read-audit.ts#ReadAuditLogger, packages/plugins/plugin-reports/src/report-service.ts#ReportServiceOptions, packages/services/service-knowledge/src/knowledge-service.ts#KnowledgeLogger) every tightened type is a plain TypeScript logger interface -- no Zod projection, no metadata surface, and none is referenced by one -- so `objectstack migrate meta` has nothing to rewrite. Nothing is removed or renamed and no stored value moves; the only consumer action is adding a `warn` member at a construction site the compiler names. -->
+
+### Patch Changes
+
+- 047ac86: Five `Plugin` implementations now release their resources from `destroy()`, the
+  only teardown hook the kernel calls (#10772).
+  
+  `Plugin` (`@objectstack/core`'s `types.ts`) declares `init()`, `start?(ctx)` and
+  `destroy?()`. `ObjectKernel.performShutdown()` and `LiteKernel.destroy()` walk
+  the plugins in reverse calling `plugin.destroy()` — and nothing anywhere calls
+  `stop()`, `dispose()`, `close()` or `shutdown()` on a plugin. Each of these five
+  spelled its teardown with one of those names instead, so what it released was
+  still held after `await kernel.shutdown()` had **resolved**:
+  
+  | package | class | was spelled | what outlived shutdown |
+  |:--|:--|:--|:--|
+  | `@objectstack/metadata` | `MetadataPlugin` | `stop` (arrow property) | artifact watcher, `manager.dispose()`, repository handle |
+  | `@objectstack/runtime` | `AppPlugin` | `stop` (arrow property) | the `app:unregistered` catalog event, never emitted |
+  | `@objectstack/runtime` | `ExternalValidationPlugin` | `stop` (arrow property) | every armed drift-check `setInterval` |
+  | `@objectstack/plugin-email` | `EmailServicePlugin` | `dispose` | two metadata subscriptions, the SMTP transport, an engine binding |
+  | `@objectstack/plugin-webhooks` | `WebhookOutboxPlugin` | `dispose` | the auto-enqueuer (2 realtime subscriptions + a refresh interval) and two engine hooks |
+  
+  `ExternalValidationPlugin` is the one with teeth: it is one of only two `Plugin`
+  implementations in the tree that own `setInterval` directly, it is mounted on
+  the real `os serve` path, and its `stop()`'s only caller anywhere was the class
+  itself re-arming. Measured against a real kernel, its drift checker performed
+  five further reads in the five intervals after a resolved shutdown — the #9371
+  mechanism verbatim. `WebhookOutboxPlugin.dispose()` had **zero** callers in the
+  entire repo, so its teardown had never run in any process at all.
+  
+  **Nothing is removed and no signature narrows.** Each old name is retained as a
+  delegating alias, because it is public API of an exported class and an embedder
+  may have learned to call it directly precisely BECAUSE the kernel never did.
+  `stop` stays an arrow property where it was one (so a detached
+  `const { stop } = plugin` keeps working) and stays synchronous on
+  `ExternalValidationPlugin` (so a non-awaiting call site is unaffected). The two
+  `stop(ctx)` aliases widen their parameter to optional.
+  
+  One behavioural note for direct callers, since `destroy()` takes no context:
+  `MetadataPlugin.stop(ctx)` and `AppPlugin.stop(ctx)` now use the context
+  captured in `init()` and ignore the argument. In a real composition these are
+  the same object. The visible difference is confined to a plugin whose `init()`
+  never ran — for `MetadataPlugin` a dropped `warn` line, for `AppPlugin` a
+  catalog event that is no longer emitted for an app that was never registered.
+- Updated dependencies [6936d07]
+- Updated dependencies [59eb04d]
+- Updated dependencies [9f05b7d]
+- Updated dependencies [3b2af5e]
+- Updated dependencies [7d2d112]
+- Updated dependencies [5fa0d72]
+- Updated dependencies [8cc8401]
+- Updated dependencies [02b3b07]
+- Updated dependencies [8163a1c]
+- Updated dependencies [cdaa72f]
+- Updated dependencies [914c413]
+- Updated dependencies [55809a0]
+- Updated dependencies [ee2ff45]
+- Updated dependencies [47cd3ec]
+- Updated dependencies [52db1d1]
+- Updated dependencies [5649efb]
+- Updated dependencies [9d7d2de]
+- Updated dependencies [c815c50]
+- Updated dependencies [795ea05]
+- Updated dependencies [900e489]
+- Updated dependencies [2306a76]
+- Updated dependencies [e5ea701]
+- Updated dependencies [a40dcc1]
+- Updated dependencies [def0d3e]
+- Updated dependencies [8d0bb79]
+- Updated dependencies [5acb58d]
+- Updated dependencies [2e3cf95]
+- Updated dependencies [4c93387]
+- Updated dependencies [504c8d5]
+- Updated dependencies [a037f7c]
+- Updated dependencies [3ee8ddf]
+- Updated dependencies [16cef97]
+- Updated dependencies [a79bd35]
+- Updated dependencies [6ceaa4b]
+- Updated dependencies [15ea214]
+- Updated dependencies [de19489]
+- Updated dependencies [c684d00]
+- Updated dependencies [923c424]
+- Updated dependencies [1ec36b7]
+- Updated dependencies [5f2e54c]
+- Updated dependencies [189373b]
+- Updated dependencies [35ad101]
+- Updated dependencies [ceb33a9]
+- Updated dependencies [73d9795]
+- Updated dependencies [8012960]
+- Updated dependencies [f34f56b]
+- Updated dependencies [f399618]
+- Updated dependencies [75e9301]
+- Updated dependencies [2810695]
+  - @objectstack/spec@17.2.0
+  - @objectstack/core@17.2.0
+  - @objectstack/service-messaging@17.2.0
+
+## 17.1.0
+
+### Patch Changes
+
+- 90417a8: chore(plugin-webhooks): `sys_webhook` declares its data-API exposure explicitly — recording the posture, not narrowing it (#9756)
+  
+  `sys_webhook` shipped with no `enable` block at all, so it kept the full default
+  data API. Three cards each noticed and each named the narrowing as the next
+  step — #7799 (the signing secret), #7986 (the custom headers), #8025 option 2
+  (the URL) — and each assumed a later one would write the line. None did, and the
+  last of them closed `completed` with the line still unwritten. The posture was
+  never a judgement; it was a default nobody had written down.
+  
+  It is written down now:
+  
+  ```ts
+  enable: { apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'] }
+  ```
+  
+  **The effective surface is unchanged, and that is the honest headline.** The set
+  is derived from a census of who actually reaches the object, taken before
+  anything was edited:
+  
+  | consumer | reaches it through | needs |
+  |:---|:---|:---|
+  | Setup/Studio console — `nav_webhooks`, four list views, `userActions` create/edit/delete | REST `/api/v1/data/sys_webhook` (gated) | `get` `list` `create` `update` `delete` |
+  | Operator predicate write — "deactivate every webhook on an object" (#4639) | REST `updateMany`/`deleteMany` (gated on `bulk`) | `bulk` |
+  | `AutoEnqueuer`, `bootstrapDeclaredWebhooks`, the provenance stamp, `redeliver-guard`, the secret sweep | `engine.*` and lifecycle hooks — ObjectQL directly, which never consults `enable.apiMethods` | ungated |
+  
+  Every primitive is required by a real consumer, so the set is all six — whose
+  operation closure is what the absent block already produced. Nothing that was
+  reachable becomes unreachable, and `/me/permissions` reports the identical
+  `apiOperations` array. No caller needs to change anything.
+  
+  ⛔ **Do not read this as the read-surface narrowing those three cards asked
+  for.** It is not one, and `apiMethods` cannot be one here: `url` (#8025 —
+  won't-fix on masking, because the URL is the routing key an operator must be
+  able to see, search, sort and edit) and a legacy row's un-migrated
+  `definition_json.headers` (#7986 — still read, and warned about, by
+  `readLegacyHeaders`) are served by `get`/`list`, which is exactly what the admin
+  console requires. Any set that removes them removes the admin surface too. The
+  sibling `sys_http_delivery` can hold `['get','list']` because it is engine-owned
+  and never authored; `sys_webhook` is a first-class admin authoring surface.
+  
+  The equality above is pinned in `sys-webhook-api-exposure.test.ts` rather than
+  left as a claim, so a later change that does move the surface has to say so.
+- b278695: fix(webhooks): refuse a malformed `sys_webhook.headers_secret` at the write door instead of at the next delivery (#8566)
+  
+  <!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is
+  renamed, retired or tombstoned. This adds a runtime validation hook on one
+  plugin-owned object's existing column; the authoring envelope
+  (`webhook.zod.ts`), the field declaration and every stored shape are untouched.
+  The accept-set narrows, but only over values that were already unusable at
+  delivery time (see below), so there is no configuration for a migration to
+  prescribe a rewrite of. -->
+  
+  `sys_webhook.headers_secret` is a `Field.secret()` whose plaintext is **not** an
+  opaque blob: it is a serialized header map with a required shape — a flat JSON
+  object of string values — and `parseStoredHeaders` is its only reader. Nothing
+  validated that shape on the way in. The ordinary data API accepted any string,
+  encrypted it like any other secret, minted a real `sys_secret` row, and left the
+  column holding a perfectly valid `secret:` ref that read back as the mask with
+  `active: true`.
+  
+  Measured on a real engine through `engine.update()` — the ordinary data API, no
+  privileged access — every one of these was **accepted** and is a value the
+  plugin can never use: `{}`, `[]`, `{"X-Count": 5}`, a nested object, and
+  `{X-Team: crm}` (a typo). The field is directly admin-authorable and its own
+  description instructs the author to type a JSON object into it, which makes a
+  typo the *expected* failure rather than an exotic one.
+  
+  **This is not an exposure fix and must not be read as one.** #8558/#8565 already
+  closed the consumer half: a webhook whose stored header map does not come back
+  as a flat string map parks the subscription and reports at `error`, rather than
+  delivering header-less with a valid signature. Nothing leaks, and nothing is
+  silently lost today. What this changes is **when the author finds out** — at the
+  write door where they typed it, instead of at the next matching record change,
+  an unbounded time later and in a different surface.
+  
+  **What is refused:** a `headers_secret` plaintext that does not parse back as a
+  flat JSON object of string values with at least one entry, with a located
+  ADR-0112 `VALIDATION_ERROR` / 400 naming `sys_webhook.headers_secret`, quoting
+  the shape the field's own description asks for, and diagnosing the specific
+  spelling (invalid JSON / an array / an empty object / which key's value is not a
+  string). ⛔ The message never echoes the rejected value — this column carries
+  credentials, and quoting the input would print an `Authorization: Bearer …` into
+  logs and error bodies, re-opening in the diagnostic exactly the exposure #7986
+  moved this field onto the encrypted channel to close. It names header *keys* and
+  value *types* only.
+  
+  **What stays accepted, byte for byte:** every valid flat string map (as JSON
+  text, or as an authored object the engine serializes into the same form); `null`
+  to clear; an omitted key to leave the stored value unchanged; and an **echoed
+  read-mask**, so the ordinary Setup-form round-trip (GET a row, edit an unrelated
+  field, PATCH it back) is untouched. `""` is deliberately passed through to
+  #8559's `EmptyCredentialWriteError` rather than re-refused here — one door, one
+  owner, one message.
+  
+  **Where it runs, and why that is the whole mechanism:** a `beforeInsert` /
+  `beforeUpdate` hook on `sys_webhook`, bound by `WebhookOutboxPlugin` before its
+  first seeded write. It has to run *before* the engine's `encryptSecretFields` —
+  one step later the plaintext is gone and the column holds an opaque ref, so a
+  validator behind it would have nothing left to validate. The suite measures that
+  ordering rather than asserting it: every refusal pins that **no `sys_secret`
+  cipher row was minted**, which is only true if the gate ran first.
+  
+  A hook rather than checks on the plugin's own write paths
+  (`bootstrapDeclaredWebhooks` / `headersPatch` / the migration sweep), because a
+  direct `PATCH /api/v1/data/sys_webhook` goes through none of them and that is
+  the measured trigger. Those paths inherit the validation through the hook and
+  deliberately carry no second check.
+  
+  A general `secret`-channel plaintext validator — letting any `secret`-typed
+  field declare its own plaintext shape — is the principled generalization and is
+  recorded as the **promotion path**, not built here: it becomes the shape the
+  moment a second shaped-plaintext `secret` field exists (maintainer ruling
+  2026-08-13; one consumer does not justify a general capability).
+- Updated dependencies [56656aa]
+- Updated dependencies [07e630e]
+- Updated dependencies [2f65b1b]
+- Updated dependencies [720ee95]
+- Updated dependencies [f287435]
+- Updated dependencies [2782805]
+- Updated dependencies [e43d63a]
+- Updated dependencies [9aa8890]
+- Updated dependencies [7c9c1dd]
+- Updated dependencies [75b7c24]
+- Updated dependencies [d5552ca]
+- Updated dependencies [d9813a9]
+- Updated dependencies [8640fb2]
+- Updated dependencies [2420641]
+- Updated dependencies [2ad91c3]
+- Updated dependencies [f57fb38]
+- Updated dependencies [00777a0]
+- Updated dependencies [d491625]
+- Updated dependencies [420804d]
+- Updated dependencies [716ac9b]
+- Updated dependencies [a38408a]
+- Updated dependencies [62b1427]
+- Updated dependencies [7ea1372]
+- Updated dependencies [23abe27]
+- Updated dependencies [985a9cd]
+- Updated dependencies [5f5e234]
+- Updated dependencies [a8189ae]
+- Updated dependencies [26e70fb]
+- Updated dependencies [42b05af]
+- Updated dependencies [2b292ce]
+- Updated dependencies [abcf853]
+- Updated dependencies [8b9eba5]
+- Updated dependencies [d575779]
+- Updated dependencies [94f7ef8]
+- Updated dependencies [c5ac5e4]
+- Updated dependencies [a777944]
+- Updated dependencies [dd88e1c]
+- Updated dependencies [856527c]
+- Updated dependencies [870f710]
+- Updated dependencies [79c46da]
+- Updated dependencies [7ff3975]
+- Updated dependencies [29d055b]
+- Updated dependencies [65589d6]
+- Updated dependencies [2c86fe3]
+- Updated dependencies [e196c6a]
+- Updated dependencies [24173e9]
+- Updated dependencies [4ab7523]
+- Updated dependencies [19539b4]
+- Updated dependencies [f8eb736]
+- Updated dependencies [11b779e]
+- Updated dependencies [739fe5b]
+- Updated dependencies [4bfe1a5]
+- Updated dependencies [2065e31]
+- Updated dependencies [b69d0f5]
+- Updated dependencies [4d47afe]
+- Updated dependencies [e4e5c6e]
+- Updated dependencies [9a56784]
+- Updated dependencies [d00d2f6]
+- Updated dependencies [df0c12d]
+- Updated dependencies [44738f7]
+- Updated dependencies [d31785f]
+- Updated dependencies [c308a4f]
+- Updated dependencies [e2899f6]
+- Updated dependencies [3851f87]
+- Updated dependencies [2a29caa]
+- Updated dependencies [09a6eee]
+- Updated dependencies [1a7f907]
+- Updated dependencies [cd455c8]
+- Updated dependencies [e1bb0ca]
+- Updated dependencies [30d3752]
+- Updated dependencies [c80e7ae]
+- Updated dependencies [09a9a8a]
+- Updated dependencies [07026cf]
+- Updated dependencies [5d4f3d5]
+- Updated dependencies [4d80e8b]
+- Updated dependencies [30b1c63]
+- Updated dependencies [079b457]
+- Updated dependencies [e43b211]
+- Updated dependencies [890b38f]
+- Updated dependencies [8bee54b]
+- Updated dependencies [7a537ce]
+- Updated dependencies [593c4bf]
+- Updated dependencies [ff08691]
+- Updated dependencies [60e0f90]
+- Updated dependencies [90c5285]
+- Updated dependencies [402c125]
+- Updated dependencies [7901b2d]
+- Updated dependencies [56bca91]
+- Updated dependencies [79394d7]
+- Updated dependencies [730fd9a]
+- Updated dependencies [44bc51d]
+- Updated dependencies [73cfddf]
+- Updated dependencies [d634e66]
+  - @objectstack/spec@17.1.0
+  - @objectstack/core@17.1.0
+  - @objectstack/service-messaging@17.1.0
+
 ## 17.0.0
 
 ### Minor Changes

package/dist/{chunk-Q4FEMGD6.cjs → chunk-DRHJ2M45.cjs}

@@ -251,10 +251,69 @@ var SysWebhook = _data.ObjectSchema.create({
     { fields: ["name"], unique: "organization" },
     { fields: ["object_name"] },
     { fields: ["active", "object_name"] }
-  ]
+  ],
+  /**
+   * [#9756] The data-API exposure of this object, declared EXPLICITLY.
+   *
+   * ## Why the block exists
+   *
+   * Three cards observed that `sys_webhook` declared no `enable` block at all
+   * and each named narrowing its read surface as the next step — #7799 (the
+   * signing secret), #7986 (the custom headers) and #8025 option 2 (the URL) —
+   * and each assumed a later one would write the line. None did. The condition
+   * held not because anyone judged the full default API correct here, but
+   * because the omission was never anybody's deliverable. That is the standard
+   * #8025 set and #9756 quotes back: *an omission is not a decision unless
+   * someone wrote it down.* This block is that decision, written down.
+   *
+   * ## The census the set is derived from (#9756, measured before writing)
+   *
+   * | consumer | reaches this object through | needs |
+   * |:---|:---|:---|
+   * | Setup/Studio console — `nav_webhooks` (`webhook-outbox-plugin.ts`), the four list views above, `userActions` create/edit/delete | REST `/api/v1/data/sys_webhook` — the gated data API | `get` `list` `create` `update` `delete` |
+   * | Operator predicate write — "deactivate every webhook on an object" (#4639, for which `AutoEnqueuer.handleSelfHealEvent` carries a `data.records.*` branch built expressly for this gesture) | REST `updateMany` / `deleteMany`, both gated on the `bulk` primitive | `bulk` |
+   * | `AutoEnqueuer` cache refresh, `bootstrapDeclaredWebhooks`, `stampWebhookProvenance`, `redeliver-guard`, `migrateLegacyWebhookSecrets`, the `headers_secret` write gate | `engine.find/findOne/insert/update` and lifecycle hooks — ObjectQL directly, which never consults `enable.apiMethods` | ungated: unaffected by anything declared here |
+   *
+   * ⇒ every primitive is required by a real, measured consumer, so the set is
+   * all six. No consumer outside the admin/operator surface was found.
+   *
+   * ## ⛔ This narrows NOTHING — do not read it as if it did
+   *
+   * `resolveEffectiveApiMethods` (`@objectstack/spec/data`) seeds the
+   * `unrestricted` branch with the very same `API_PRIMITIVES` set, so the six
+   * primitives resolve to the operation closure the *absent* block already
+   * produced. The serialized effective set (`/me/permissions`, the 405
+   * `allowed` array) is byte-identical, and no route or `callData` action
+   * reaches an operation whose answer differs. Only `mode` changes,
+   * `unrestricted` → `restricted`.
+   *
+   * So the presence of this block is NOT evidence that the reachable cleartext
+   * on this object was reduced. It was not, and `apiMethods` is the wrong
+   * instrument for it: `url` (#8025 — won't-fix on masking, because the URL is
+   * the routing key an operator must be able to see, search, sort and edit) and
+   * a legacy row's un-migrated `definition_json.headers` (#7986 —
+   * `readLegacyHeaders` in `auto-enqueuer.ts` still reads them and warns) are
+   * both served by `get`/`list`, which is exactly what the console requires.
+   * Any set that removes them removes the admin surface with them. A survey
+   * that greps this file for `enable:` and stops is measuring the wrong thing;
+   * #9756's report carries the census that says so.
+   *
+   * Contrast the sibling `sys_http_delivery` (`['get','list']`,
+   * `service-messaging`), whose narrowing is real: that table is engine-owned —
+   * written only by `SqlHttpOutbox` through context-less raw-engine writes,
+   * never authored — so closing its write surface costs nothing. `sys_webhook`
+   * is a first-class admin authoring surface. That is the whole difference, and
+   * it is why the sibling's shape could not simply be copied here.
+   *
+   * Pinned — the census, the no-narrowing equality, and the registration-time
+   * survival of every write verb — in `sys-webhook-api-exposure.test.ts`.
+   */
+  enable: {
+    apiMethods: ["get", "list", "create", "update", "delete", "bulk"]
+  }
 });
 
 
 
 exports.SysWebhook = SysWebhook;
-//# sourceMappingURL=chunk-Q4FEMGD6.cjs.map
+//# sourceMappingURL=chunk-DRHJ2M45.cjs.map

package/dist/chunk-DRHJ2M45.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/objectstack/objectstack/packages/plugins/plugin-webhooks/dist/chunk-DRHJ2M45.cjs","../src/sys-webhook.object.ts"],"names":[],"mappings":"AAAA;ACEA,8CAAoC;AAoC7B,IAAM,WAAA,EAAa,kBAAA,CAAa,MAAA,CAAO;AAAA,EAC5C,IAAA,EAAM,aAAA;AAAA,EACN,KAAA,EAAO,SAAA;AAAA,EACP,WAAA,EAAa,UAAA;AAAA,EACb,IAAA,EAAM,SAAA;AAAA,EACN,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,QAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMX,WAAA,EAAa,EAAE,MAAA,EAAQ,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA;AAAA,EACrE,WAAA,EAAa,uPAAA;AAAA,EACb,gBAAA,EAAkB,MAAA;AAAA,EAClB,SAAA,EAAW,MAAA;AAAA;AAAA,EACX,WAAA,EAAa,SAAA;AAAA,EACb,eAAA,EAAiB,CAAC,MAAA,EAAQ,aAAA,EAAe,KAAA,EAAO,QAAA,EAAU,YAAY,CAAA;AAAA,EAEtE,SAAA,EAAW;AAAA,IACT,MAAA,EAAQ;AAAA,MACN,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,KAAA,EAAO,QAAA;AAAA,MACP,IAAA,EAAM,EAAE,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,cAAc,CAAA;AAAA,MAClD,OAAA,EAAS,CAAC,OAAA,EAAS,aAAA,EAAe,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,YAAY,CAAA;AAAA,MACzE,MAAA,EAAQ,CAAC,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,KAAA,EAAO,KAAK,CAAC,CAAA;AAAA,MAC7D,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MACvC,UAAA,EAAY,EAAE,QAAA,EAAU,GAAG;AAAA,IAC7B,CAAA;AAAA,IACA,QAAA,EAAU;AAAA,MACR,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,UAAA;AAAA,MACN,KAAA,EAAO,UAAA;AAAA,MACP,IAAA,EAAM,EAAE,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,cAAc,CAAA;AAAA,MAClD,OAAA,EAAS,CAAC,OAAA,EAAS,aAAA,EAAe,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,YAAY,CAAA;AAAA,MACzE,MAAA,EAAQ,CAAC,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MAC9D,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MACvC,UAAA,EAAY,EAAE,QAAA,EAAU,GAAG;AAAA,IAC7B,CAAA;AAAA,IACA,SAAA,EAAW;AAAA,MACT,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,WAAA;AAAA,MACN,KAAA,EAAO,WAAA;AAAA,MACP,IAAA,EAAM,EAAE,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,cAAc,CAAA;AAAA,MAClD,OAAA,EAAS,CAAC,aAAA,EAAe,OAAA,EAAS,KAAA,EAAO,QAAA,EAAU,YAAY,CAAA;AAAA,MAC/D,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,aAAA,EAAe,KAAA,EAAO,MAAM,CAAA,EAAG,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MAC/E,QAAA,EAAU,EAAE,MAAA,EAAQ,CAAC,EAAE,KAAA,EAAO,aAAA,EAAe,KAAA,EAAO,KAAA,EAAO,SAAA,EAAW,MAAM,CAAC,EAAE,CAAA;AAAA,MAC/E,UAAA,EAAY,EAAE,QAAA,EAAU,IAAI;AAAA,IAC9B,CAAA;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,IAAA,EAAM,MAAA;AAAA,MACN,IAAA,EAAM,cAAA;AAAA,MACN,KAAA,EAAO,KAAA;AAAA,MACP,IAAA,EAAM,EAAE,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,cAAc,CAAA;AAAA,MAClD,OAAA,EAAS,CAAC,OAAA,EAAS,aAAA,EAAe,KAAA,EAAO,QAAA,EAAU,QAAA,EAAU,YAAY,CAAA;AAAA,MACzE,IAAA,EAAM,CAAC,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,MAAM,CAAC,CAAA;AAAA,MACvC,UAAA,EAAY,EAAE,QAAA,EAAU,GAAG;AAAA,IAC7B;AAAA,EACF,CAAA;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,EAAA,EAAI,WAAA,CAAM,IAAA,CAAK,EAAE,KAAA,EAAO,YAAA,EAAc,QAAA,EAAU,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,SAAS,CAAC,CAAA;AAAA,IAEvF,IAAA,EAAM,WAAA,CAAM,IAAA,CAAK;AAAA,MACf,KAAA,EAAO,MAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,SAAA,EAAW,GAAA;AAAA;AAAA;AAAA,MAGX,WAAA,EAAa,8EAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,KAAA,EAAO,WAAA,CAAM,IAAA,CAAK;AAAA,MAChB,KAAA,EAAO,eAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,GAAA;AAAA,MACX,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,WAAA,EAAa,WAAA,CAAM,IAAA,CAAK;AAAA,MACtB,KAAA,EAAO,QAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,SAAA,EAAW,GAAA;AAAA;AAAA;AAAA,MAGX,MAAA,EAAQ,YAAA;AAAA,MACR,WAAA,EAAa,gFAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,QAAA,EAAU,WAAA,CAAM,MAAA;AAAA,MACd,CAAC,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,aAAA,EAAe,aAAa,CAAA;AAAA,MAC3D;AAAA,QACE,KAAA,EAAO,UAAA;AAAA,QACP,QAAA,EAAU,KAAA;AAAA;AAAA;AAAA;AAAA,QAIV,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMV,WAAA,EAAa,6EAAA;AAAA,QACb,KAAA,EAAO;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IAEA,GAAA,EAAK,WAAA,CAAM,IAAA,CAAK;AAAA,MACd,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,SAAA,EAAW,IAAA;AAAA,MACX,WAAA,EAAa,0CAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,MAAA,EAAQ,WAAA,CAAM,MAAA;AAAA,MACZ,CAAC,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,OAAA,EAAS,QAAQ,CAAA;AAAA,MACxC;AAAA,QACE,KAAA,EAAO,aAAA;AAAA,QACP,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAKV,YAAA,EAAc,MAAA;AAAA,QACd,WAAA,EAAa,2CAAA;AAAA,QACb,KAAA,EAAO;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IAEA,WAAA,EAAa,WAAA,CAAM,QAAA,CAAS,EAAE,KAAA,EAAO,aAAA,EAAe,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,aAAa,CAAC,CAAA;AAAA,IAE1F,MAAA,EAAQ,WAAA,CAAM,OAAA,CAAQ;AAAA,MACpB,KAAA,EAAO,QAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,YAAA,EAAc,IAAA;AAAA,MACd,WAAA,EAAa,iDAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,eAAA,EAAiB,WAAA,CAAM,QAAA,CAAS;AAAA,MAC9B,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa,4RAAA;AAAA,MACb,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAgCD,cAAA,EAAgB,WAAA,CAAM,MAAA,CAAO;AAAA,MAC3B,KAAA,EAAO,gBAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EACE,oOAAA;AAAA,MAGF,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAyBD,cAAA,EAAgB,WAAA,CAAM,MAAA,CAAO;AAAA,MAC3B,KAAA,EAAO,gBAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EACE,+LAAA;AAAA,MAEF,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASD,UAAA,EAAY,WAAA,CAAM,MAAA;AAAA,MAChB,CAAC,UAAA,EAAY,SAAA,EAAW,OAAO,CAAA;AAAA,MAC/B;AAAA,QACE,KAAA,EAAO,YAAA;AAAA,QACP,QAAA,EAAU,KAAA;AAAA,QACV,QAAA,EAAU,IAAA;AAAA,QACV,YAAA,EAAc,OAAA;AAAA,QACd,WAAA,EACE,uJAAA;AAAA,QAEF,KAAA,EAAO;AAAA,MACT;AAAA,IACF,CAAA;AAAA,IAEA,UAAA,EAAY,WAAA,CAAM,OAAA,CAAQ;AAAA,MACxB,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,QAAA,EAAU,IAAA;AAAA,MACV,YAAA,EAAc,KAAA;AAAA,MACd,WAAA,EACE,gLAAA;AAAA,MAEF,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,UAAA,EAAY,WAAA,CAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,IACT,CAAC,CAAA;AAAA,IAED,UAAA,EAAY,WAAA,CAAM,QAAA,CAAS,EAAE,KAAA,EAAO,YAAA,EAAc,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,SAAS,CAAC;AAAA,EACtF,CAAA;AAAA,EAEA,OAAA,EAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQP,EAAE,MAAA,EAAQ,CAAC,MAAM,CAAA,EAAG,MAAA,EAAQ,eAAe,CAAA;AAAA,IAC3C,EAAE,MAAA,EAAQ,CAAC,aAAa,EAAE,CAAA;AAAA,IAC1B,EAAE,MAAA,EAAQ,CAAC,QAAA,EAAU,aAAa,EAAE;AAAA,EACtC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0DA,MAAA,EAAQ;AAAA,IACN,UAAA,EAAY,CAAC,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,MAAM;AAAA,EAClE;AACF,CAAC,CAAA;AD9DD;AACA;AACE;AACF,gCAAC","file":"/home/runner/work/objectstack/objectstack/packages/plugins/plugin-webhooks/dist/chunk-DRHJ2M45.cjs","sourcesContent":[null,"// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_webhook — Outbound HTTP integration configuration (runtime).\n *\n * Persists a single {@link Webhook} envelope per row so administrators\n * can author, enable/disable, and edit webhook subscriptions from the\n * Studio UI without code changes. The canonical Zod schema for the\n * `definition_json` envelope lives at `@objectstack/spec/automation/webhook`.\n *\n * ## Two authoring doors, one row\n * Rows land here two ways, distinguished by the `managed_by` provenance column:\n *   - **admin** — created/edited directly through this object's CRUD UI.\n *   - **package** — declared in code (`defineStack({ webhooks })` /\n *     `defineWebhook()`) and materialized on boot by\n *     `bootstrapDeclaredWebhooks` (#3461). Re-seeded every boot, but an admin\n *     edit stamps `customized: true` and freezes the row (seed-not-clobber,\n *     mirrors `sys_sharing_rule` #2909).\n *\n * One row per `name`. This plugin's {@link AutoEnqueuer} loads active rows on\n * boot + on `sys_webhook:changed` events, and turns matching `data.record.*`\n * events into deliveries on the shared `service-messaging` HTTP outbox\n * (ADR-0018 M3 — `sys_http_delivery`, drained by the messaging dispatcher).\n *\n * Ownership (ADR-0029 K2.a): this object is **owned by\n * `@objectstack/plugin-webhooks`** — the plugin that consumes these rows. It\n * used to live in the `@objectstack/platform-objects` monolith and be imported\n * here; the definition now lives with its owner so the plugin ships both data\n * and behavior as one unit.\n *\n * Platform-wide on purpose: every project (standalone, single-tenant,\n * cloud) can integrate with external systems (Slack, Stripe, internal\n * services) the same way.\n *\n * @namespace sys\n */\nexport const SysWebhook = ObjectSchema.create({\n  name: 'sys_webhook',\n  label: 'Webhook',\n  pluralLabel: 'Webhooks',\n  icon: 'webhook',\n  isSystem: true,\n  managedBy: 'config',\n  // Authoring a webhook from the UI requires a structured form for the\n  // headers / auth / retry / payload blocks — the generic JSON textarea\n  // is acceptable as a v1 until a dedicated builder lands. Re-enable\n  // create/edit/delete so admins can at least toggle `active` and edit\n  // simple URL/method fields without round-tripping through code.\n  userActions: { create: true, edit: true, delete: true, import: false },\n  description: 'Outbound HTTP webhook subscription. Declared in code via defineStack({ webhooks }) / defineWebhook() (materialized into rows on boot) or authored directly in the Studio editor; dispatched by the webhook auto-enqueuer onto the shared HTTP outbox.',\n  displayNameField: 'name',\n  nameField: 'name', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)\n  titleFormat: '{label}',\n  highlightFields: ['name', 'object_name', 'url', 'active', 'updated_at'],\n\n  listViews: {\n    active: {\n      type: 'grid',\n      name: 'active',\n      label: 'Active',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      filter: [{ field: 'active', operator: 'equals', value: true }],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n    inactive: {\n      type: 'grid',\n      name: 'inactive',\n      label: 'Inactive',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      filter: [{ field: 'active', operator: 'equals', value: false }],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n    by_object: {\n      type: 'grid',\n      name: 'by_object',\n      label: 'By Object',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['object_name', 'label', 'url', 'active', 'updated_at'],\n      sort: [{ field: 'object_name', order: 'asc' }, { field: 'label', order: 'asc' }],\n      grouping: { fields: [{ field: 'object_name', order: 'asc', collapsed: false }] },\n      pagination: { pageSize: 100 },\n    },\n    all_webhooks: {\n      type: 'grid',\n      name: 'all_webhooks',\n      label: 'All',\n      data: { provider: 'object', object: 'sys_webhook' },\n      columns: ['label', 'object_name', 'url', 'method', 'active', 'updated_at'],\n      sort: [{ field: 'label', order: 'asc' }],\n      pagination: { pageSize: 50 },\n    },\n  },\n\n  fields: {\n    id: Field.text({ label: 'Webhook ID', required: true, readonly: true, group: 'System' }),\n\n    name: Field.text({\n      label: 'Name',\n      required: true,\n      maxLength: 100,\n      // [#8554] \"unique per organization\", not bare \"unique\" — the bare wording\n      // described the installation-wide index this card removed.\n      description: 'snake_case name, unique per organization — referenced in logs and audit',\n      group: 'Definition',\n    }),\n\n    label: Field.text({\n      label: 'Display Label',\n      required: false,\n      maxLength: 200,\n      group: 'Definition',\n    }),\n\n    object_name: Field.text({\n      label: 'Object',\n      required: false,\n      maxLength: 100,\n      // Object picker (same widget as sys_sharing_rule) instead of a free-text\n      // machine name. Falls back to a text input when the widget is unavailable.\n      widget: 'object-ref',\n      description: 'Short object name whose record events (create/update/delete) fire this webhook',\n      group: 'Definition',\n    }),\n\n    triggers: Field.select(\n      ['create', 'update', 'delete', 'bulk_update', 'bulk_delete'],\n      {\n        label: 'Triggers',\n        required: false,\n        // Multi-select instead of a hand-typed comma-separated string. Stored as\n        // an array; the auto-enqueuer parser also tolerates the legacy\n        // comma-separated / JSON-string forms so existing rows keep working.\n        multiple: true,\n        // [#4639] `bulk_*` fire on predicate writes (`multi: true`), whose\n        // delivery carries `matched` instead of a record — opt-in precisely\n        // because that body is a different shape. Kept in step with\n        // `WebhookTriggerType` (`@objectstack/spec/automation`), which is the\n        // contract the auto-enqueuer validates against.\n        description: 'Record events that fire this webhook (bulk_* deliver a count, not a record)',\n        group: 'Definition',\n      },\n    ),\n\n    url: Field.text({\n      label: 'Target URL',\n      required: true,\n      maxLength: 2048,\n      description: 'External endpoint that receives the POST',\n      group: 'Definition',\n    }),\n\n    method: Field.select(\n      ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n      {\n        label: 'HTTP Method',\n        required: true,\n        // Select instead of free text. Option values are lowercased by the\n        // Field.select helper (get/post/…); the auto-enqueuer upper-cases the\n        // resolved method before delivery, so existing 'POST' rows and the\n        // lowercase option values both normalise correctly.\n        defaultValue: 'post',\n        description: 'HTTP method used for the callback request',\n        group: 'Definition',\n      },\n    ),\n\n    description: Field.textarea({ label: 'Description', required: false, group: 'Definition' }),\n\n    active: Field.boolean({\n      label: 'Active',\n      required: true,\n      defaultValue: true,\n      description: 'Inactive webhooks are skipped by the dispatcher',\n      group: 'Definition',\n    }),\n\n    definition_json: Field.textarea({\n      label: 'Definition',\n      required: true,\n      description: 'Serialised Webhook JSON (see @objectstack/spec/automation/webhook) — timeout and the rest of the authored envelope. Credentials are NOT stored here: the signing secret lives in the encrypted `signing_secret` field and the custom headers in the encrypted `headers_secret` field.',\n      group: 'Definition',\n    }),\n\n    /**\n     * [#7986] Custom HTTP headers, in the engine's ENCRYPTED credential channel.\n     *\n     * The sibling passenger #7799 left on the blob it emptied. That card was\n     * framed as \"the signing secret is in cleartext\" and was fixed exactly as\n     * framed — but the COLUMN was the problem, and `headers` is the ordinary\n     * place an `Authorization: Bearer …` goes. `definition_json` is an ordinary\n     * textarea on an admin-authorable object with no restrictive\n     * `enable.apiMethods` at all, so `GET /api/v1/data/sys_webhook` returned the\n     * header map to every persona that can read the object, with none of the\n     * retention bound that eventually ages out `sys_http_delivery`'s copies.\n     *\n     * The WHOLE map moves rather than the credential-looking entries, because\n     * only some entries are credentials and the platform cannot tell which:\n     * guessing from the header name is fail-OPEN on exactly the custom spellings\n     * (`X-Acme-Token`) most likely to be one, and letting the author declare\n     * which are sensitive is a change to the authoring envelope\n     * (`webhook.zod.ts`) that belongs to the spec seat. See\n     * `webhook-headers.ts` for the full comparison.\n     *\n     * Stored as the SERIALIZED map (the encrypted channel carries a string);\n     * the enqueuer recovers and re-parses it server-side through\n     * `engine.resolveSecretField()` when it refreshes its subscription cache,\n     * on the same refresh that recovers the signing secret.\n     *\n     * Fail-closed by construction, the same way `signing_secret` is: with no\n     * CryptoProvider the engine REFUSES the write rather than falling back to\n     * cleartext, and a stored map that cannot be decrypted DROPS the\n     * subscription rather than delivering it with its headers silently missing.\n     */\n    headers_secret: Field.secret({\n      label: 'Custom Headers',\n      required: false,\n      description:\n        'Custom HTTP headers sent with each delivery, as a JSON object ({\"Authorization\": \"Bearer …\"}). '\n        + 'Encrypted at rest into sys_secret; reads return a mask, never the headers. Leave the mask '\n        + 'untouched to keep the current value.',\n      group: 'Definition',\n    }),\n\n    /**\n     * [#7799] HMAC signing key, in the engine's ENCRYPTED credential channel.\n     *\n     * It used to ride inside `definition_json` as cleartext, because that column\n     * is where the seeder parked the whole authored envelope. `definition_json`\n     * is an ordinary textarea on an admin-authorable object with no restrictive\n     * `enable.apiMethods`, so `GET /api/v1/data/sys_webhook` handed the key back\n     * to every persona that can read the object — and that key is the receiver's\n     * ONLY proof a delivery came from us. Same exposure class as #7722's\n     * per-attempt copies, minus the retention window that eventually aged those\n     * out.\n     *\n     * `type: 'secret'` moves it onto the channel built for this: the engine\n     * encrypts on write via the registered `ICryptoProvider`, stores the\n     * ciphertext as a `sys_secret` row, keeps only an opaque `secret:<id>` ref\n     * on this column, and returns the mask on every read path. The enqueuer\n     * recovers the plaintext server-side through `engine.resolveSecretField()`\n     * when it refreshes its subscription cache.\n     *\n     * Fail-closed by construction: with no CryptoProvider wired the engine\n     * REFUSES the write rather than falling back to cleartext, so the seeder\n     * skips that webhook loudly instead of re-opening the hole in a new column.\n     */\n    signing_secret: Field.secret({\n      label: 'Signing Secret',\n      required: false,\n      description:\n        'HMAC-SHA256 key used to sign deliveries (X-Objectstack-Signature). Encrypted at rest into '\n        + 'sys_secret; reads return a mask, never the key. Leave the mask untouched to keep the current value.',\n      group: 'Definition',\n    }),\n\n    // ── Provenance (#3461 — record-authoritative seed-not-clobber) ──\n    // Mirrors sys_sharing_rule (#2909). Both columns are `readonly`: the\n    // engine strips them from non-system payloads (forge/clear-proof), while\n    // bootstrapDeclaredWebhooks and the provenance stamp hook write with\n    // isSystem. Deliberately NOT a write gate: webhooks are a first-class admin\n    // authoring/tuning surface — admins may edit or deactivate a package row;\n    // the seeder simply stops overwriting it once `customized` is stamped.\n    managed_by: Field.select(\n      ['platform', 'package', 'admin'],\n      {\n        label: 'Managed By',\n        required: false,\n        readonly: true,\n        defaultValue: 'admin',\n        description:\n          'Record provenance: platform = framework built-in / package = app/package-declared ' +\n          '(boot-seeded from defineStack webhooks) / admin = created in Setup.',\n        group: 'System',\n      },\n    ),\n\n    customized: Field.boolean({\n      label: 'Customized',\n      required: false,\n      readonly: true,\n      defaultValue: false,\n      description:\n        'Set when an admin edits a package-declared webhook; boot seeding will no longer ' +\n        'overwrite the row (a deactivated noisy webhook survives redeploys). Meaningless on admin rows.',\n      group: 'System',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      required: true,\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n\n    updated_at: Field.datetime({ label: 'Updated At', required: false, group: 'System' }),\n  },\n\n  indexes: [\n    // [#8554] Scope spelled EXPLICITLY (ADR-0120 D1). On a DECLARED index bare\n    // `unique: true` is the positional spelling of `'global'` — the listed\n    // columns verbatim — so this was an installation-wide key on a tenant-scoped\n    // object. Measured live before the fix: org_jia 201 / org_yi 409\n    // UNIQUE_VIOLATION on the same name / org_yi unused name 201 / org_yi's own\n    // GET on the colliding name 0 rows. Webhooks are named by admins from the\n    // UI, so two organizations both wanting `order_created_hook` is ordinary.\n    { fields: ['name'], unique: 'organization' },\n    { fields: ['object_name'] },\n    { fields: ['active', 'object_name'] },\n  ],\n\n  /**\n   * [#9756] The data-API exposure of this object, declared EXPLICITLY.\n   *\n   * ## Why the block exists\n   *\n   * Three cards observed that `sys_webhook` declared no `enable` block at all\n   * and each named narrowing its read surface as the next step — #7799 (the\n   * signing secret), #7986 (the custom headers) and #8025 option 2 (the URL) —\n   * and each assumed a later one would write the line. None did. The condition\n   * held not because anyone judged the full default API correct here, but\n   * because the omission was never anybody's deliverable. That is the standard\n   * #8025 set and #9756 quotes back: *an omission is not a decision unless\n   * someone wrote it down.* This block is that decision, written down.\n   *\n   * ## The census the set is derived from (#9756, measured before writing)\n   *\n   * | consumer | reaches this object through | needs |\n   * |:---|:---|:---|\n   * | Setup/Studio console — `nav_webhooks` (`webhook-outbox-plugin.ts`), the four list views above, `userActions` create/edit/delete | REST `/api/v1/data/sys_webhook` — the gated data API | `get` `list` `create` `update` `delete` |\n   * | Operator predicate write — \"deactivate every webhook on an object\" (#4639, for which `AutoEnqueuer.handleSelfHealEvent` carries a `data.records.*` branch built expressly for this gesture) | REST `updateMany` / `deleteMany`, both gated on the `bulk` primitive | `bulk` |\n   * | `AutoEnqueuer` cache refresh, `bootstrapDeclaredWebhooks`, `stampWebhookProvenance`, `redeliver-guard`, `migrateLegacyWebhookSecrets`, the `headers_secret` write gate | `engine.find/findOne/insert/update` and lifecycle hooks — ObjectQL directly, which never consults `enable.apiMethods` | ungated: unaffected by anything declared here |\n   *\n   * ⇒ every primitive is required by a real, measured consumer, so the set is\n   * all six. No consumer outside the admin/operator surface was found.\n   *\n   * ## ⛔ This narrows NOTHING — do not read it as if it did\n   *\n   * `resolveEffectiveApiMethods` (`@objectstack/spec/data`) seeds the\n   * `unrestricted` branch with the very same `API_PRIMITIVES` set, so the six\n   * primitives resolve to the operation closure the *absent* block already\n   * produced. The serialized effective set (`/me/permissions`, the 405\n   * `allowed` array) is byte-identical, and no route or `callData` action\n   * reaches an operation whose answer differs. Only `mode` changes,\n   * `unrestricted` → `restricted`.\n   *\n   * So the presence of this block is NOT evidence that the reachable cleartext\n   * on this object was reduced. It was not, and `apiMethods` is the wrong\n   * instrument for it: `url` (#8025 — won't-fix on masking, because the URL is\n   * the routing key an operator must be able to see, search, sort and edit) and\n   * a legacy row's un-migrated `definition_json.headers` (#7986 —\n   * `readLegacyHeaders` in `auto-enqueuer.ts` still reads them and warns) are\n   * both served by `get`/`list`, which is exactly what the console requires.\n   * Any set that removes them removes the admin surface with them. A survey\n   * that greps this file for `enable:` and stops is measuring the wrong thing;\n   * #9756's report carries the census that says so.\n   *\n   * Contrast the sibling `sys_http_delivery` (`['get','list']`,\n   * `service-messaging`), whose narrowing is real: that table is engine-owned —\n   * written only by `SqlHttpOutbox` through context-less raw-engine writes,\n   * never authored — so closing its write surface costs nothing. `sys_webhook`\n   * is a first-class admin authoring surface. That is the whole difference, and\n   * it is why the sibling's shape could not simply be copied here.\n   *\n   * Pinned — the census, the no-narrowing equality, and the registration-time\n   * survival of every write verb — in `sys-webhook-api-exposure.test.ts`.\n   */\n  enable: {\n    apiMethods: ['get', 'list', 'create', 'update', 'delete', 'bulk'],\n  },\n});\n"]}

package/dist/{chunk-GDCWDVDT.js → chunk-XERWWQKN.js}

@@ -251,10 +251,69 @@ var SysWebhook = ObjectSchema.create({
     { fields: ["name"], unique: "organization" },
     { fields: ["object_name"] },
     { fields: ["active", "object_name"] }
-  ]
+  ],
+  /**
+   * [#9756] The data-API exposure of this object, declared EXPLICITLY.
+   *
+   * ## Why the block exists
+   *
+   * Three cards observed that `sys_webhook` declared no `enable` block at all
+   * and each named narrowing its read surface as the next step — #7799 (the
+   * signing secret), #7986 (the custom headers) and #8025 option 2 (the URL) —
+   * and each assumed a later one would write the line. None did. The condition
+   * held not because anyone judged the full default API correct here, but
+   * because the omission was never anybody's deliverable. That is the standard
+   * #8025 set and #9756 quotes back: *an omission is not a decision unless
+   * someone wrote it down.* This block is that decision, written down.
+   *
+   * ## The census the set is derived from (#9756, measured before writing)
+   *
+   * | consumer | reaches this object through | needs |
+   * |:---|:---|:---|
+   * | Setup/Studio console — `nav_webhooks` (`webhook-outbox-plugin.ts`), the four list views above, `userActions` create/edit/delete | REST `/api/v1/data/sys_webhook` — the gated data API | `get` `list` `create` `update` `delete` |
+   * | Operator predicate write — "deactivate every webhook on an object" (#4639, for which `AutoEnqueuer.handleSelfHealEvent` carries a `data.records.*` branch built expressly for this gesture) | REST `updateMany` / `deleteMany`, both gated on the `bulk` primitive | `bulk` |
+   * | `AutoEnqueuer` cache refresh, `bootstrapDeclaredWebhooks`, `stampWebhookProvenance`, `redeliver-guard`, `migrateLegacyWebhookSecrets`, the `headers_secret` write gate | `engine.find/findOne/insert/update` and lifecycle hooks — ObjectQL directly, which never consults `enable.apiMethods` | ungated: unaffected by anything declared here |
+   *
+   * ⇒ every primitive is required by a real, measured consumer, so the set is
+   * all six. No consumer outside the admin/operator surface was found.
+   *
+   * ## ⛔ This narrows NOTHING — do not read it as if it did
+   *
+   * `resolveEffectiveApiMethods` (`@objectstack/spec/data`) seeds the
+   * `unrestricted` branch with the very same `API_PRIMITIVES` set, so the six
+   * primitives resolve to the operation closure the *absent* block already
+   * produced. The serialized effective set (`/me/permissions`, the 405
+   * `allowed` array) is byte-identical, and no route or `callData` action
+   * reaches an operation whose answer differs. Only `mode` changes,
+   * `unrestricted` → `restricted`.
+   *
+   * So the presence of this block is NOT evidence that the reachable cleartext
+   * on this object was reduced. It was not, and `apiMethods` is the wrong
+   * instrument for it: `url` (#8025 — won't-fix on masking, because the URL is
+   * the routing key an operator must be able to see, search, sort and edit) and
+   * a legacy row's un-migrated `definition_json.headers` (#7986 —
+   * `readLegacyHeaders` in `auto-enqueuer.ts` still reads them and warns) are
+   * both served by `get`/`list`, which is exactly what the console requires.
+   * Any set that removes them removes the admin surface with them. A survey
+   * that greps this file for `enable:` and stops is measuring the wrong thing;
+   * #9756's report carries the census that says so.
+   *
+   * Contrast the sibling `sys_http_delivery` (`['get','list']`,
+   * `service-messaging`), whose narrowing is real: that table is engine-owned —
+   * written only by `SqlHttpOutbox` through context-less raw-engine writes,
+   * never authored — so closing its write surface costs nothing. `sys_webhook`
+   * is a first-class admin authoring surface. That is the whole difference, and
+   * it is why the sibling's shape could not simply be copied here.
+   *
+   * Pinned — the census, the no-narrowing equality, and the registration-time
+   * survival of every write verb — in `sys-webhook-api-exposure.test.ts`.
+   */
+  enable: {
+    apiMethods: ["get", "list", "create", "update", "delete", "bulk"]
+  }
 });
 
 export {
   SysWebhook
 };
-//# sourceMappingURL=chunk-GDCWDVDT.js.map
+//# sourceMappingURL=chunk-XERWWQKN.js.map