@objectstack/plugin-webhooks 17.0.0 → 17.2.0

package/dist/index.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkQ4FEMGD6cjs = require('./chunk-Q4FEMGD6.cjs');
+var _chunkDRHJ2M45cjs = require('./chunk-DRHJ2M45.cjs');
 
 // src/webhook-secret.ts
 var WEBHOOK_SECRET_FIELD = "signing_secret";
@@ -194,7 +194,7 @@ var AutoEnqueuer = class {
     this.droppedForSecret = /* @__PURE__ */ new Set();
     this.subscriptionsObject = _nullishCoalesce(opts.subscriptionsObject, () => ( "sys_webhook"));
     this.refreshIntervalMs = _nullishCoalesce(opts.refreshIntervalMs, () => ( 6e4));
-    this.logger = _nullishCoalesce(opts.logger, () => ( {}));
+    this.logger = opts.logger;
   }
   /**
    * Load the subscription cache and start listening for events.
@@ -219,7 +219,7 @@ var AutoEnqueuer = class {
     if (this.refreshIntervalMs > 0) {
       this.refreshTimer = setInterval(() => {
         this.refresh().catch(
-          (err) => _optionalChain([this, 'access', _7 => _7.logger, 'access', _8 => _8.warn, 'optionalCall', _9 => _9("[webhook-auto-enqueuer] periodic refresh failed", err)])
+          (err) => _optionalChain([this, 'access', _7 => _7.logger, 'optionalAccess', _8 => _8.warn, 'optionalCall', _9 => _9("[webhook-auto-enqueuer] periodic refresh failed", err)])
         );
       }, this.refreshIntervalMs);
       _optionalChain([this, 'access', _10 => _10.refreshTimer, 'access', _11 => _11.unref, 'optionalCall', _12 => _12()]);
@@ -252,7 +252,7 @@ var AutoEnqueuer = class {
   rearmAfterCryptoRegistered() {
     const inFlight = _nullishCoalesce(this.refreshing, () => ( Promise.resolve()));
     void inFlight.catch(() => void 0).then(() => this.running ? this.refresh() : void 0).catch(
-      (err) => _optionalChain([this, 'access', _15 => _15.logger, 'access', _16 => _16.warn, 'optionalCall', _17 => _17(
+      (err) => _optionalChain([this, 'access', _15 => _15.logger, 'optionalAccess', _16 => _16.warn, 'optionalCall', _17 => _17(
         "[webhook-auto-enqueuer] re-arm after CryptoProvider registration failed",
         err
       )])
@@ -276,7 +276,7 @@ var AutoEnqueuer = class {
         where: { active: true }
       });
     } catch (err) {
-      _optionalChain([this, 'access', _18 => _18.logger, 'access', _19 => _19.warn, 'optionalCall', _20 => _20(
+      _optionalChain([this, 'access', _18 => _18.logger, 'optionalAccess', _19 => _19.warn, 'optionalCall', _20 => _20(
         `[webhook-auto-enqueuer] failed to load ${this.subscriptionsObject}`,
         err
       )]);
@@ -300,7 +300,7 @@ var AutoEnqueuer = class {
         if (!live.has(id)) this.droppedForSecret.delete(id);
       }
     }
-    _optionalChain([this, 'access', _22 => _22.logger, 'access', _23 => _23.debug, 'optionalCall', _24 => _24("[webhook-auto-enqueuer] cache refreshed", {
+    _optionalChain([this, 'access', _22 => _22.logger, 'optionalAccess', _23 => _23.debug, 'optionalCall', _24 => _24("[webhook-auto-enqueuer] cache refreshed", {
       objects: this.subscriptions.size,
       rows: rows.length
     })]);
@@ -371,20 +371,20 @@ var AutoEnqueuer = class {
   reportWriteFailure(sub, eventId, err, verb) {
     const meta = { webhook: sub.name, eventId, err: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _25 => _25.message]), () => ( err)) };
     if (!sub.parkedReason) {
-      _optionalChain([this, 'access', _26 => _26.logger, 'access', _27 => _27.warn, 'optionalCall', _28 => _28(`[webhook-auto-enqueuer] ${verb} failed`, meta)]);
+      _optionalChain([this, 'access', _26 => _26.logger, 'optionalAccess', _27 => _27.warn, 'optionalCall', _28 => _28(`[webhook-auto-enqueuer] ${verb} failed`, meta)]);
       return;
     }
     const message = `[webhook-auto-enqueuer] could not record the undeliverable event for webhook '${sub.name}' \u2014 the subscription is parked for an unresolvable credential, and this event is now DISCARDED WITH NO TRACE in sys_http_delivery, which is the durability gap #8069 closes. Most likely cause: the enqueue callback was wired directly to IHttpOutbox.enqueue instead of MessagingService.enqueueHttp \u2014 only the messaging seam routes a parked event to recordUndeliverable(), and the delivery door refuses it rather than minting a pending row that would be sent UNSIGNED.`;
-    if (typeof this.logger.error === "function") {
-      this.logger.error(message, err, meta);
+    if (typeof _optionalChain([this, 'access', _29 => _29.logger, 'optionalAccess', _30 => _30.error]) === "function") {
+      _optionalChain([this, 'access', _31 => _31.logger, 'optionalAccess', _32 => _32.error, 'call', _33 => _33(message, err, meta)]);
     } else {
-      _optionalChain([this, 'access', _29 => _29.logger, 'access', _30 => _30.warn, 'optionalCall', _31 => _31(message, meta)]);
+      _optionalChain([this, 'access', _34 => _34.logger, 'optionalAccess', _35 => _35.warn, 'optionalCall', _36 => _36(message, meta)]);
     }
   }
   park(sub, err, credential) {
     sub.secret = void 0;
     sub.headers = void 0;
-    sub.parkedReason = `[${WEBHOOK_SECRET_REFUSAL_CODE}/${WEBHOOK_SECRET_REFUSAL_STATUS}] webhook '${sub.name}' holds ${credential.article} that could not be decrypted, so this event was NOT delivered \u2014 recording it here rather than ${credential.ratherThan} (${credential.issue}, #8069). This row was never sent and cannot be redelivered: it carries no HMAC signature, because the ${credential.noun} that would have produced one is exactly what is missing. Fix: register a CryptoProvider (engine.setCryptoProvider \u2014 LocalCryptoProvider in dev, KMS/Vault in production) with the same key the ${credential.noun} was written under, and make sure the sys_secret row is reachable; the subscription re-arms on registration (#8022) and at the next periodic refresh, and later events are delivered normally. Cause: ${_nullishCoalesce(_optionalChain([err, 'optionalAccess', _32 => _32.message]), () => ( String(err)))}`;
+    sub.parkedReason = `[${WEBHOOK_SECRET_REFUSAL_CODE}/${WEBHOOK_SECRET_REFUSAL_STATUS}] webhook '${sub.name}' holds ${credential.article} that could not be decrypted, so this event was NOT delivered \u2014 recording it here rather than ${credential.ratherThan} (${credential.issue}, #8069). This row was never sent and cannot be redelivered: it carries no HMAC signature, because the ${credential.noun} that would have produced one is exactly what is missing. Fix: register a CryptoProvider (engine.setCryptoProvider \u2014 LocalCryptoProvider in dev, KMS/Vault in production) with the same key the ${credential.noun} was written under, and make sure the sys_secret row is reachable; the subscription re-arms on registration (#8022) and at the next periodic refresh, and later events are delivered normally. Cause: ${_nullishCoalesce(_optionalChain([err, 'optionalAccess', _37 => _37.message]), () => ( String(err)))}`;
   }
   /**
    * [#7799] Resolve `sub.secret`. Returns `false` when the subscription must
@@ -428,9 +428,9 @@ var AutoEnqueuer = class {
       this.park(sub, err, SIGNING_SECRET_CREDENTIAL);
       return false;
     }
-    const legacy = readLegacySecret(_optionalChain([row, 'optionalAccess', _33 => _33.definition_json]));
+    const legacy = readLegacySecret(_optionalChain([row, 'optionalAccess', _38 => _38.definition_json]));
     if (legacy) {
-      _optionalChain([this, 'access', _34 => _34.logger, 'access', _35 => _35.warn, 'optionalCall', _36 => _36(
+      _optionalChain([this, 'access', _39 => _39.logger, 'optionalAccess', _40 => _40.warn, 'optionalCall', _41 => _41(
         `[webhook-auto-enqueuer] webhook '${sub.name}' still carries its signing secret as CLEARTEXT in definition_json, readable over the data API (#7799). Signing continues from it; run the boot sweep (migrateLegacyWebhookSecrets) with a CryptoProvider wired to move it into sys_secret.`,
         { id: sub.id }
       )]);
@@ -478,9 +478,9 @@ var AutoEnqueuer = class {
       this.park(sub, err, CUSTOM_HEADERS_CREDENTIAL);
       return false;
     }
-    const legacy = readLegacyHeaders(_optionalChain([row, 'optionalAccess', _37 => _37.definition_json]));
+    const legacy = readLegacyHeaders(_optionalChain([row, 'optionalAccess', _42 => _42.definition_json]));
     if (legacy) {
-      _optionalChain([this, 'access', _38 => _38.logger, 'access', _39 => _39.warn, 'optionalCall', _40 => _40(
+      _optionalChain([this, 'access', _43 => _43.logger, 'optionalAccess', _44 => _44.warn, 'optionalCall', _45 => _45(
         `[webhook-auto-enqueuer] webhook '${sub.name}' still carries its custom headers as CLEARTEXT in definition_json, readable over the data API (#7986) \u2014 that map is the ordinary place an Authorization header goes. Delivery continues from it; run the boot sweep (migrateLegacyWebhookSecrets) with a CryptoProvider wired to move them into sys_secret.`,
         { id: sub.id }
       )]);
@@ -520,10 +520,10 @@ var AutoEnqueuer = class {
       field: credential.field,
       code: WEBHOOK_SECRET_REFUSAL_CODE,
       status: WEBHOOK_SECRET_REFUSAL_STATUS,
-      err: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _41 => _41.message]), () => ( err))
+      err: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _46 => _46.message]), () => ( err))
     };
     if (this.droppedForSecret.has(sub.id)) {
-      _optionalChain([this, 'access', _42 => _42.logger, 'access', _43 => _43.debug, 'optionalCall', _44 => _44(
+      _optionalChain([this, 'access', _47 => _47.logger, 'optionalAccess', _48 => _48.debug, 'optionalCall', _49 => _49(
         `[webhook-auto-enqueuer] webhook '${sub.name}' is still dropped for an unresolvable ${credential.noun} (${credential.issues})`,
         meta
       )]);
@@ -531,14 +531,14 @@ var AutoEnqueuer = class {
     }
     this.droppedForSecret.add(sub.id);
     const message = `[webhook-auto-enqueuer] webhook '${sub.name}' holds ${credential.article} that could not be decrypted \u2014 the subscription is PARKED rather than ${credential.ratherThan} (${credential.issue}), so every matching record change is discarded with NO delivery, while the row keeps reading active:true in Setup. Each discarded event IS recorded in sys_http_delivery as a dead row with 0 attempts carrying this cause (#8069) \u2014 look there for the backlog; those rows can never be sent or redelivered, because a parked row has no HMAC signature. Fix: register a CryptoProvider (engine.setCryptoProvider \u2014 LocalCryptoProvider in dev, KMS/Vault in production) with the same key the ${credential.noun} was written under, and make sure the sys_secret row is reachable; the subscription re-arms on registration (#8022) and at the next periodic refresh.`;
-    if (typeof this.logger.error === "function") {
-      this.logger.error(message, err, meta);
+    if (typeof _optionalChain([this, 'access', _50 => _50.logger, 'optionalAccess', _51 => _51.error]) === "function") {
+      _optionalChain([this, 'access', _52 => _52.logger, 'optionalAccess', _53 => _53.error, 'call', _54 => _54(message, err, meta)]);
     } else {
-      _optionalChain([this, 'access', _45 => _45.logger, 'access', _46 => _46.warn, 'optionalCall', _47 => _47(message, meta)]);
+      _optionalChain([this, 'access', _55 => _55.logger, 'optionalAccess', _56 => _56.warn, 'optionalCall', _57 => _57(message, meta)]);
     }
   }
   parseRow(row) {
-    if (!_optionalChain([row, 'optionalAccess', _48 => _48.id]) || !_optionalChain([row, 'optionalAccess', _49 => _49.url])) return null;
+    if (!_optionalChain([row, 'optionalAccess', _58 => _58.id]) || !_optionalChain([row, 'optionalAccess', _59 => _59.url])) return null;
     const rawTriggers = row.triggers;
     let triggerList;
     if (Array.isArray(rawTriggers)) {
@@ -559,7 +559,7 @@ var AutoEnqueuer = class {
     const normalized = triggerList.map((t) => t.trim().toLowerCase()).filter(Boolean);
     const unknown = normalized.filter((t) => !DISPATCHABLE_WEBHOOK_TRIGGERS.has(t));
     if (unknown.length > 0) {
-      _optionalChain([this, 'access', _50 => _50.logger, 'access', _51 => _51.warn, 'optionalCall', _52 => _52(
+      _optionalChain([this, 'access', _60 => _60.logger, 'optionalAccess', _61 => _61.warn, 'optionalCall', _62 => _62(
         `[webhook-auto-enqueuer] webhook '${_nullishCoalesce(row.name, () => ( row.id))}' declares trigger(s) the engine never emits: ${unknown.join(", ")} \u2014 ignored. Dispatchable triggers: ${[...DISPATCHABLE_WEBHOOK_TRIGGERS].join(", ")}.`,
         { id: row.id, unknown }
       )]);
@@ -568,7 +568,7 @@ var AutoEnqueuer = class {
       normalized.filter((t) => DISPATCHABLE_WEBHOOK_TRIGGERS.has(t))
     );
     if (triggers.size === 0) {
-      _optionalChain([this, 'access', _53 => _53.logger, 'access', _54 => _54.warn, 'optionalCall', _55 => _55(
+      _optionalChain([this, 'access', _63 => _63.logger, 'optionalAccess', _64 => _64.warn, 'optionalCall', _65 => _65(
         `[webhook-auto-enqueuer] webhook '${_nullishCoalesce(row.name, () => ( row.id))}' has no dispatchable triggers \u2014 it will NEVER fire (rule webhook/without-triggers): there is no manual fire path (#3196), so this row is dead while looking armed in Setup. Declare one of: ${[...DISPATCHABLE_WEBHOOK_TRIGGERS].join(", ")}, or set it inactive if it should be off.`,
         { id: row.id }
       )]);
@@ -609,11 +609,11 @@ var AutoEnqueuer = class {
   handleEvent(event) {
     if (!event.object) return;
     if (event.object === this.subscriptionsObject) return;
-    if (_optionalChain([event, 'access', _56 => _56.type, 'optionalAccess', _57 => _57.startsWith, 'call', _58 => _58("data.records.")])) {
+    if (_optionalChain([event, 'access', _66 => _66.type, 'optionalAccess', _67 => _67.startsWith, 'call', _68 => _68("data.records.")])) {
       this.handleBulkEvent(event);
       return;
     }
-    if (!_optionalChain([event, 'access', _59 => _59.type, 'optionalAccess', _60 => _60.startsWith, 'call', _61 => _61("data.record.")])) return;
+    if (!_optionalChain([event, 'access', _69 => _69.type, 'optionalAccess', _70 => _70.startsWith, 'call', _71 => _71("data.record.")])) return;
     const action = event.type.slice("data.record.".length);
     const trigger = mapActionToTrigger(action);
     if (!trigger) return;
@@ -625,7 +625,7 @@ var AutoEnqueuer = class {
     const payload = _nullishCoalesce(event.payload, () => ( {}));
     const recordId = payload.recordId;
     if (typeof recordId !== "string" || recordId === "") {
-      _optionalChain([this, 'access', _62 => _62.logger, 'access', _63 => _63.warn, 'optionalCall', _64 => _64(
+      _optionalChain([this, 'access', _72 => _72.logger, 'optionalAccess', _73 => _73.warn, 'optionalCall', _74 => _74(
         "[webhook-auto-enqueuer] dropping off-contract data event: payload is not a DataEvent (no top-level string `recordId`) \u2014 fix the producer",
         { type: event.type, object: event.object }
       )]);
@@ -694,7 +694,7 @@ var AutoEnqueuer = class {
     const payload = _nullishCoalesce(event.payload, () => ( {}));
     const matched = payload.matched;
     if (typeof matched !== "number" || !Number.isInteger(matched) || matched < 0) {
-      _optionalChain([this, 'access', _65 => _65.logger, 'access', _66 => _66.warn, 'optionalCall', _67 => _67(
+      _optionalChain([this, 'access', _75 => _75.logger, 'optionalAccess', _76 => _76.warn, 'optionalCall', _77 => _77(
         "[webhook-auto-enqueuer] dropping off-contract bulk data event: payload is not a BulkDataEvent (no top-level non-negative integer `matched`) \u2014 fix the producer",
         { type: event.type, object: event.object }
       )]);
@@ -702,7 +702,7 @@ var AutoEnqueuer = class {
     }
     const eventUuid = payload.id;
     if (typeof eventUuid !== "string" || eventUuid === "") {
-      _optionalChain([this, 'access', _68 => _68.logger, 'access', _69 => _69.warn, 'optionalCall', _70 => _70(
+      _optionalChain([this, 'access', _78 => _78.logger, 'optionalAccess', _79 => _79.warn, 'optionalCall', _80 => _80(
         "[webhook-auto-enqueuer] dropping off-contract bulk data event: payload has no top-level string `id` to dedup on \u2014 fix the producer",
         { type: event.type, object: event.object }
       )]);
@@ -737,9 +737,9 @@ var AutoEnqueuer = class {
   }
   handleSelfHealEvent(event) {
     if (event.object !== this.subscriptionsObject) return;
-    if (!_optionalChain([event, 'access', _71 => _71.type, 'optionalAccess', _72 => _72.startsWith, 'call', _73 => _73("data.record.")]) && !_optionalChain([event, 'access', _74 => _74.type, 'optionalAccess', _75 => _75.startsWith, 'call', _76 => _76("data.records.")])) return;
+    if (!_optionalChain([event, 'access', _81 => _81.type, 'optionalAccess', _82 => _82.startsWith, 'call', _83 => _83("data.record.")]) && !_optionalChain([event, 'access', _84 => _84.type, 'optionalAccess', _85 => _85.startsWith, 'call', _86 => _86("data.records.")])) return;
     this.refresh().catch(
-      (err) => _optionalChain([this, 'access', _77 => _77.logger, 'access', _78 => _78.warn, 'optionalCall', _79 => _79("[webhook-auto-enqueuer] self-heal refresh failed", err)])
+      (err) => _optionalChain([this, 'access', _87 => _87.logger, 'optionalAccess', _88 => _88.warn, 'optionalCall', _89 => _89("[webhook-auto-enqueuer] self-heal refresh failed", err)])
     );
   }
   /** Test / admin accessor. */
@@ -782,21 +782,21 @@ var _automation = require('@objectstack/spec/automation');
 var SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] };
 function uid(prefix) {
   const g = globalThis;
-  if (_optionalChain([g, 'access', _80 => _80.crypto, 'optionalAccess', _81 => _81.randomUUID])) return `${prefix}_${g.crypto.randomUUID()}`;
+  if (_optionalChain([g, 'access', _90 => _90.crypto, 'optionalAccess', _91 => _91.randomUUID])) return `${prefix}_${g.crypto.randomUUID()}`;
   return `${prefix}_${Math.random().toString(36).slice(2, 10)}`;
 }
 function readDeclared(engine, metadataService, type) {
   try {
-    const reg = _optionalChain([engine, 'optionalAccess', _82 => _82._registry]);
-    if (_optionalChain([reg, 'optionalAccess', _83 => _83.listItems])) {
+    const reg = _optionalChain([engine, 'optionalAccess', _92 => _92._registry]);
+    if (_optionalChain([reg, 'optionalAccess', _93 => _93.listItems])) {
       const items = (_nullishCoalesce(reg.listItems(type), () => ( []))).filter(Boolean);
       if (items.length > 0) return items;
     }
   } catch (e7) {
   }
   try {
-    const listed = _optionalChain([metadataService, 'optionalAccess', _84 => _84.list, 'optionalCall', _85 => _85(type)]);
-    const arr = typeof _optionalChain([listed, 'optionalAccess', _86 => _86.then]) === "function" ? [] : _nullishCoalesce(listed, () => ( []));
+    const listed = _optionalChain([metadataService, 'optionalAccess', _94 => _94.list, 'optionalCall', _95 => _95(type)]);
+    const arr = typeof _optionalChain([listed, 'optionalAccess', _96 => _96.then]) === "function" ? [] : _nullishCoalesce(listed, () => ( []));
     return Array.isArray(arr) ? arr.filter(Boolean) : [];
   } catch (e8) {
     return [];
@@ -813,9 +813,9 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
     try {
       wh = _automation.WebhookSchema.parse(raw);
     } catch (err) {
-      _optionalChain([logger, 'optionalAccess', _87 => _87.warn, 'optionalCall', _88 => _88("[webhook] declared webhook failed validation \u2014 skipped", {
-        name: _optionalChain([raw, 'optionalAccess', _89 => _89.name]),
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _90 => _90.message]), () => ( String(err)))
+      _optionalChain([logger, 'optionalAccess', _97 => _97.warn, 'optionalCall', _98 => _98("[webhook] declared webhook failed validation \u2014 skipped", {
+        name: _optionalChain([raw, 'optionalAccess', _99 => _99.name]),
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _100 => _100.message]), () => ( String(err)))
       })]);
       skipped += 1;
       continue;
@@ -829,7 +829,7 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
       const row = Array.isArray(existing) ? existing[0] : void 0;
       if (row) {
         if (row.managed_by === "admin") {
-          _optionalChain([logger, 'optionalAccess', _91 => _91.warn, 'optionalCall', _92 => _92("[webhook] declared name collides with an admin-authored row \u2014 seed skipped", {
+          _optionalChain([logger, 'optionalAccess', _101 => _101.warn, 'optionalCall', _102 => _102("[webhook] declared name collides with an admin-authored row \u2014 seed skipped", {
             name: wh.name
           })]);
           skipped += 1;
@@ -881,18 +881,18 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
       seeded += 1;
     } catch (err) {
       const protection = isSecretProtectionFailure(err);
-      _optionalChain([logger, 'optionalAccess', _93 => _93.warn, 'optionalCall', _94 => _94(
+      _optionalChain([logger, 'optionalAccess', _103 => _103.warn, 'optionalCall', _104 => _104(
         protection ? "[webhook] declared webhook NOT seeded \u2014 its signing secret cannot be stored encrypted (#7799)" : "[webhook] declared webhook seed failed",
         {
           name: wh.name,
           ...protection ? { code: WEBHOOK_SECRET_REFUSAL_CODE, status: WEBHOOK_SECRET_REFUSAL_STATUS } : {},
-          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _95 => _95.message]), () => ( String(err)))
+          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _105 => _105.message]), () => ( String(err)))
         }
       )]);
       skipped += 1;
     }
   }
-  _optionalChain([logger, 'optionalAccess', _96 => _96.info, 'optionalCall', _97 => _97("[webhook] declared webhooks materialized into sys_webhook", {
+  _optionalChain([logger, 'optionalAccess', _106 => _106.info, 'optionalCall', _107 => _107("[webhook] declared webhooks materialized into sys_webhook", {
     seeded,
     skipped,
     total: declared.length
@@ -901,7 +901,7 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
 }
 async function secretPatch(engine, wh, row, subscriptionsObject) {
   const { secret } = splitWebhookSecret(wh);
-  const hasStored = _optionalChain([row, 'optionalAccess', _98 => _98[WEBHOOK_SECRET_FIELD]]) != null && row[WEBHOOK_SECRET_FIELD] !== "";
+  const hasStored = _optionalChain([row, 'optionalAccess', _108 => _108[WEBHOOK_SECRET_FIELD]]) != null && row[WEBHOOK_SECRET_FIELD] !== "";
   if (!secret) return hasStored ? { [WEBHOOK_SECRET_FIELD]: null } : {};
   if (!hasStored || !canResolveSecrets(engine)) return { [WEBHOOK_SECRET_FIELD]: secret };
   try {
@@ -943,16 +943,16 @@ async function migrateLegacyWebhookSecrets(engine, logger, subscriptionsObject =
   let rows;
   try {
     const found = await engine.find(subscriptionsObject, SYSTEM_QUERY);
-    rows = Array.isArray(found) ? found : _nullishCoalesce(_optionalChain([found, 'optionalAccess', _99 => _99.data]), () => ( []));
+    rows = Array.isArray(found) ? found : _nullishCoalesce(_optionalChain([found, 'optionalAccess', _109 => _109.data]), () => ( []));
   } catch (err) {
-    _optionalChain([logger, 'optionalAccess', _100 => _100.warn, 'optionalCall', _101 => _101("[webhook] legacy secret sweep skipped \u2014 could not read subscriptions", {
+    _optionalChain([logger, 'optionalAccess', _110 => _110.warn, 'optionalCall', _111 => _111("[webhook] legacy secret sweep skipped \u2014 could not read subscriptions", {
       object: subscriptionsObject,
-      error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _102 => _102.message]), () => ( String(err)))
+      error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _112 => _112.message]), () => ( String(err)))
     })]);
     return out;
   }
   for (const row of rows) {
-    if (!_optionalChain([row, 'optionalAccess', _103 => _103.id])) continue;
+    if (!_optionalChain([row, 'optionalAccess', _113 => _113.id])) continue;
     const legacySecret = readLegacySecret(row.definition_json);
     const legacyHeaders = readLegacyHeaders(row.definition_json);
     if (!legacySecret && !legacyHeaders) continue;
@@ -973,20 +973,20 @@ async function migrateLegacyWebhookSecrets(engine, logger, subscriptionsObject =
       out.failed += 1;
       const protection = isSecretProtectionFailure(err);
       const what = legacySecret && legacyHeaders ? "signing secret and custom headers" : legacySecret ? "signing secret" : "custom headers";
-      _optionalChain([logger, 'optionalAccess', _104 => _104.warn, 'optionalCall', _105 => _105(
+      _optionalChain([logger, 'optionalAccess', _114 => _114.warn, 'optionalCall', _115 => _115(
         protection ? `[webhook] ${what} STILL CLEARTEXT in definition_json \u2014 no CryptoProvider to encrypt them (#7799/#7986)` : `[webhook] ${what} migration failed \u2014 row left unchanged (#7799/#7986)`,
         {
           name: _nullishCoalesce(row.name, () => ( row.id)),
           id: row.id,
           code: WEBHOOK_SECRET_REFUSAL_CODE,
           status: WEBHOOK_SECRET_REFUSAL_STATUS,
-          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _106 => _106.message]), () => ( String(err)))
+          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _116 => _116.message]), () => ( String(err)))
         }
       )]);
     }
   }
   if (out.found > 0) {
-    _optionalChain([logger, 'optionalAccess', _107 => _107.info, 'optionalCall', _108 => _108("[webhook] legacy cleartext credentials swept into sys_secret", { ...out })]);
+    _optionalChain([logger, 'optionalAccess', _117 => _117.info, 'optionalCall', _118 => _118("[webhook] legacy cleartext credentials swept into sys_secret", { ...out })]);
   }
   return out;
 }
@@ -1024,14 +1024,14 @@ function createWebhookRedeliverGuard(engine, subscriptionsObject = WEBHOOK_OBJEC
 var WEBHOOK_PROVENANCE_PACKAGE = "plugin-webhooks:provenance";
 var SYSTEM_CTX3 = { isSystem: true, positions: [], permissions: [] };
 function bindWebhookProvenanceStamp(engine, logger) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _109 => _109.registerHook]) !== "function") return;
+  if (typeof _optionalChain([engine, 'optionalAccess', _119 => _119.registerHook]) !== "function") return;
   engine.registerHook(
     "beforeUpdate",
     async (ctx) => {
-      if (_optionalChain([ctx, 'optionalAccess', _110 => _110.session, 'optionalAccess', _111 => _111.isSystem])) return;
-      const id = _nullishCoalesce(_optionalChain([ctx, 'optionalAccess', _112 => _112.input, 'optionalAccess', _113 => _113.id]), () => ( _optionalChain([ctx, 'optionalAccess', _114 => _114.input, 'optionalAccess', _115 => _115.data, 'optionalAccess', _116 => _116.id])));
+      if (_optionalChain([ctx, 'optionalAccess', _120 => _120.session, 'optionalAccess', _121 => _121.isSystem])) return;
+      const id = _nullishCoalesce(_optionalChain([ctx, 'optionalAccess', _122 => _122.input, 'optionalAccess', _123 => _123.id]), () => ( _optionalChain([ctx, 'optionalAccess', _124 => _124.input, 'optionalAccess', _125 => _125.data, 'optionalAccess', _126 => _126.id])));
       if (!id) return;
-      const data = _optionalChain([ctx, 'optionalAccess', _117 => _117.input, 'optionalAccess', _118 => _118.data]);
+      const data = _optionalChain([ctx, 'optionalAccess', _127 => _127.input, 'optionalAccess', _128 => _128.data]);
       if (!data || typeof data !== "object") return;
       try {
         const rows = await engine.find("sys_webhook", {
@@ -1046,22 +1046,114 @@ function bindWebhookProvenanceStamp(engine, logger) {
           data.customized = true;
         }
       } catch (err) {
-        _optionalChain([logger, 'optionalAccess', _119 => _119.warn, 'optionalCall', _120 => _120("[webhook] provenance stamp failed (edit proceeds unstamped)", {
+        _optionalChain([logger, 'optionalAccess', _129 => _129.warn, 'optionalCall', _130 => _130("[webhook] provenance stamp failed (edit proceeds unstamped)", {
           id,
-          error: _optionalChain([err, 'optionalAccess', _121 => _121.message])
+          error: _optionalChain([err, 'optionalAccess', _131 => _131.message])
         })]);
       }
     },
     { object: "sys_webhook", packageId: WEBHOOK_PROVENANCE_PACKAGE, priority: 150 }
   );
-  _optionalChain([logger, 'optionalAccess', _122 => _122.info, 'optionalCall', _123 => _123("[webhook] provenance stamp hook bound")]);
+  _optionalChain([logger, 'optionalAccess', _132 => _132.info, 'optionalCall', _133 => _133("[webhook] provenance stamp hook bound")]);
 }
 function unbindWebhookProvenanceStamp(engine) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _124 => _124.unregisterHooksByPackage]) === "function") {
+  if (typeof _optionalChain([engine, 'optionalAccess', _134 => _134.unregisterHooksByPackage]) === "function") {
     engine.unregisterHooksByPackage(WEBHOOK_PROVENANCE_PACKAGE);
   }
 }
 
+// src/webhook-headers-gate.ts
+var WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE = "VALIDATION_ERROR";
+var WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS = 400;
+var DECLARED_SHAPE = 'Custom HTTP headers sent with each delivery, as a JSON object ({"Authorization": "Bearer ..."})';
+var WebhookHeadersShapeError = class extends Error {
+  constructor(object, field, diagnosis) {
+    super(
+      `Custom headers refused for "${object}.${field}": ${diagnosis}. The required shape is a FLAT JSON object of string values, which is what the field itself asks for \u2014 its description reads: "${DECLARED_SHAPE}". This is checked at the write door because one step later there is nothing left to check: the engine encrypts this value into sys_secret and every read path returns only the mask, so a stored value that can never be used is indistinguishable from one that works until the next delivery tries to send it \u2014 at which point the subscription parks and the report arrives an unbounded time later, in a different surface from the one it was typed into (#7986, #8558, #8566). ${HEADERS_REMEDY}`
+    );
+    this.code = WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE;
+    this.status = WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS;
+    this.name = "WebhookHeadersShapeError";
+    this.object = object;
+    this.field = field;
+  }
+};
+function describeParsed(parsed) {
+  if (parsed === null) return "null";
+  if (Array.isArray(parsed)) return "a JSON array";
+  if (typeof parsed !== "object") return `a JSON ${typeof parsed}`;
+  const entries = Object.entries(parsed);
+  if (entries.length === 0) {
+    return 'an EMPTY JSON object, which is not the same thing as "send no custom headers"';
+  }
+  const bad = entries.filter(([, v]) => typeof v !== "string");
+  if (bad.length > 0) {
+    const named = bad.map(([k, v]) => `${JSON.stringify(k)} (${Array.isArray(v) ? "array" : v === null ? "null" : typeof v})`).join(", ");
+    return `a JSON object, but the wire carries only strings and ${bad.length === 1 ? "this value is" : "these values are"} not a string: ${named}`;
+  }
+  return "a JSON object the header seam does not accept";
+}
+function describeRejected(value) {
+  if (typeof value === "string") {
+    let parsed;
+    try {
+      parsed = JSON.parse(value);
+    } catch (e10) {
+      return "the value is a string that is not valid JSON at all \u2014 check for unquoted keys or values ({X-Team: crm}), single quotes instead of double, or a trailing comma";
+    }
+    return `the value parses as JSON but is ${describeParsed(parsed)}`;
+  }
+  return `the value is ${describeParsed(value)}`;
+}
+function assertWritableWebhookHeaders(data, object = WEBHOOK_OBJECT, field = WEBHOOK_HEADERS_FIELD) {
+  if (!data || typeof data !== "object") return;
+  if (!Object.prototype.hasOwnProperty.call(data, field)) return;
+  const value = data[field];
+  if (value === null || typeof value === "undefined") return;
+  if (value === "") return;
+  if (isOpaqueSecretForm(value)) return;
+  let serialized;
+  if (typeof value === "string") {
+    serialized = value;
+  } else {
+    try {
+      serialized = JSON.stringify(value);
+    } catch (e11) {
+      throw new WebhookHeadersShapeError(
+        object,
+        field,
+        "the value cannot be serialized to JSON at all (it contains a circular reference)"
+      );
+    }
+    if (typeof serialized !== "string") {
+      throw new WebhookHeadersShapeError(object, field, `the value is a ${typeof value}`);
+    }
+  }
+  if (parseStoredHeaders(serialized)) return;
+  throw new WebhookHeadersShapeError(object, field, describeRejected(value));
+}
+var WEBHOOK_HEADERS_GATE_PACKAGE = "plugin-webhooks:headers-shape-gate";
+var GATE_PRIORITY = 50;
+function bindWebhookHeadersShapeGate(engine, logger) {
+  if (typeof _optionalChain([engine, 'optionalAccess', _135 => _135.registerHook]) !== "function") return;
+  const handler = (ctx) => {
+    assertWritableWebhookHeaders(_optionalChain([ctx, 'optionalAccess', _136 => _136.input, 'optionalAccess', _137 => _137.data]));
+  };
+  for (const event of ["beforeInsert", "beforeUpdate"]) {
+    engine.registerHook(event, handler, {
+      object: WEBHOOK_OBJECT,
+      packageId: WEBHOOK_HEADERS_GATE_PACKAGE,
+      priority: GATE_PRIORITY
+    });
+  }
+  _optionalChain([logger, 'optionalAccess', _138 => _138.info, 'optionalCall', _139 => _139("[webhook] headers_secret shape gate bound (refuses non-flat-string-map plaintext)")]);
+}
+function unbindWebhookHeadersShapeGate(engine) {
+  if (typeof _optionalChain([engine, 'optionalAccess', _140 => _140.unregisterHooksByPackage]) === "function") {
+    engine.unregisterHooksByPackage(WEBHOOK_HEADERS_GATE_PACKAGE);
+  }
+}
+
 // src/webhook-outbox-plugin.ts
 var WebhookOutboxPlugin = class {
   constructor(options = {}) {
@@ -1092,7 +1184,7 @@ var WebhookOutboxPlugin = class {
         scope: "system",
         name: "Webhook Schemas",
         description: "Registers sys_webhook (configuration). Deliveries use messaging's sys_http_delivery outbox.",
-        objects: [_chunkQ4FEMGD6cjs.SysWebhook],
+        objects: [_chunkDRHJ2M45cjs.SysWebhook],
         navigationContributions: [
           {
             app: "setup",
@@ -1106,7 +1198,7 @@ var WebhookOutboxPlugin = class {
         ]
       });
     } else {
-      _optionalChain([ctx, 'access', _125 => _125.logger, 'access', _126 => _126.warn, 'optionalCall', _127 => _127(
+      _optionalChain([ctx, 'access', _141 => _141.logger, 'access', _142 => _142.warn, 'optionalCall', _143 => _143(
         "[webhook-outbox] manifest service unavailable \u2014 sys_webhook will NOT appear in REST or Studio nav. Register MetadataService before WebhookOutboxPlugin."
       )]);
     }
@@ -1115,12 +1207,12 @@ var WebhookOutboxPlugin = class {
         try {
           const i18n = ctx.getService("i18n");
           if (i18n && typeof i18n.loadTranslations === "function") {
-            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-H5ZYI6YP.cjs")));
+            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-IHRALWSP.cjs")));
             for (const [locale, data] of Object.entries(WebhooksTranslations)) {
               i18n.loadTranslations(locale, data);
             }
           }
-        } catch (e10) {
+        } catch (e12) {
         }
       });
     }
@@ -1132,20 +1224,48 @@ var WebhookOutboxPlugin = class {
         this.registerAdminRoutes(ctx);
       });
     }
-    _optionalChain([ctx, 'access', _128 => _128.logger, 'access', _129 => _129.info, 'optionalCall', _130 => _130("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
+    _optionalChain([ctx, 'access', _144 => _144.logger, 'access', _145 => _145.info, 'optionalCall', _146 => _146("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
       autoEnqueue: autoEnqueueOpt !== false
     })]);
   }
-  async dispose() {
-    await _optionalChain([this, 'access', _131 => _131.autoEnqueuer, 'optionalAccess', _132 => _132.stop, 'call', _133 => _133()]);
+  /**
+   * Teardown — the kernel's ONLY teardown hook.
+   *
+   * [#10772] This body used to be spelled `dispose()`. `Plugin`
+   * (`@objectstack/core`'s `types.ts`) declares `init()`, `start?(ctx)` and
+   * `destroy?()` and no `dispose()`, and `ObjectKernel.performShutdown()` /
+   * `LiteKernel.destroy()` walk the plugins in reverse calling
+   * `plugin.destroy()` — so after `await kernel.shutdown()` had RESOLVED the
+   * auto-enqueuer was still running and both engine hooks were still bound.
+   * Measured on the same revision: `dispose()` had ZERO callers anywhere in
+   * the repo, so this teardown had never run in any process at all.
+   *
+   * Idempotent: `boundEngine` is cleared as it is unbound, so a second
+   * teardown is a no-op rather than a second unbind.
+   */
+  async destroy() {
+    await _optionalChain([this, 'access', _147 => _147.autoEnqueuer, 'optionalAccess', _148 => _148.stop, 'call', _149 => _149()]);
     if (this.boundEngine) {
       try {
         unbindWebhookProvenanceStamp(this.boundEngine);
-      } catch (e11) {
+      } catch (e13) {
+      }
+      try {
+        unbindWebhookHeadersShapeGate(this.boundEngine);
+      } catch (e14) {
       }
       this.boundEngine = void 0;
     }
   }
+  /**
+   * Retained alias for {@link destroy}. Kept because it is public API of an
+   * exported class: an embedder may have learned to call it directly
+   * precisely BECAUSE the kernel never did, and deleting it would break them.
+   * Same signature, same return type — a direct caller sees no change.
+   */
+  async dispose() {
+    await this.destroy();
+  }
   getMessaging(ctx) {
     const svc = this.tryGetService(ctx, ["messaging"]);
     return svc && typeof svc.enqueueHttp === "function" ? svc : void 0;
@@ -1165,28 +1285,29 @@ var WebhookOutboxPlugin = class {
   async bootDeclaredWebhooks(ctx) {
     const engine = this.tryGetService(ctx, ["objectql", "data"]);
     if (!engine) {
-      _optionalChain([ctx, 'access', _134 => _134.logger, 'access', _135 => _135.warn, 'optionalCall', _136 => _136("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
+      _optionalChain([ctx, 'access', _150 => _150.logger, 'access', _151 => _151.warn, 'optionalCall', _152 => _152("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
       return;
     }
     this.boundEngine = engine;
     bindWebhookProvenanceStamp(engine, ctx.logger);
+    bindWebhookHeadersShapeGate(engine, ctx.logger);
     let metadataService;
     try {
       metadataService = ctx.getService("metadata");
-    } catch (e12) {
+    } catch (e15) {
     }
     try {
       await bootstrapDeclaredWebhooks(engine, metadataService, ctx.logger);
     } catch (err) {
-      _optionalChain([ctx, 'access', _137 => _137.logger, 'access', _138 => _138.warn, 'optionalCall', _139 => _139("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _140 => _140.message]), () => ( String(err)))
+      _optionalChain([ctx, 'access', _153 => _153.logger, 'access', _154 => _154.warn, 'optionalCall', _155 => _155("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _156 => _156.message]), () => ( String(err)))
       })]);
     }
     try {
       await migrateLegacyWebhookSecrets(engine, ctx.logger);
     } catch (err) {
-      _optionalChain([ctx, 'access', _141 => _141.logger, 'access', _142 => _142.warn, 'optionalCall', _143 => _143("[webhook] legacy signing-secret sweep failed (rows left unchanged)", {
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _144 => _144.message]), () => ( String(err)))
+      _optionalChain([ctx, 'access', _157 => _157.logger, 'access', _158 => _158.warn, 'optionalCall', _159 => _159("[webhook] legacy signing-secret sweep failed (rows left unchanged)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _160 => _160.message]), () => ( String(err)))
       })]);
     }
   }
@@ -1196,14 +1317,14 @@ var WebhookOutboxPlugin = class {
     const realtime = this.tryGetService(ctx, ["realtime"]);
     const messaging = this.getMessaging(ctx);
     if (!engine || !realtime || !messaging) {
-      _optionalChain([ctx, 'access', _145 => _145.logger, 'access', _146 => _146.warn, 'optionalCall', _147 => _147(
+      _optionalChain([ctx, 'access', _161 => _161.logger, 'access', _162 => _162.warn, 'optionalCall', _163 => _163(
         "[webhook-auto-enqueuer] disabled \u2014 ObjectQL, Realtime, or Messaging service not available",
         { hasEngine: !!engine, hasRealtime: !!realtime, hasMessaging: !!messaging }
       )]);
       return;
     }
     if (!messaging.isHttpDeliveryReady()) {
-      _optionalChain([ctx, 'access', _148 => _148.logger, 'access', _149 => _149.warn, 'optionalCall', _150 => _150(
+      _optionalChain([ctx, 'access', _164 => _164.logger, 'access', _165 => _165.warn, 'optionalCall', _166 => _166(
         "[webhook-auto-enqueuer] messaging HTTP outbox not ready (no data engine / reliableDelivery off) \u2014 webhook deliveries will not be durable"
       )]);
     }
@@ -1217,7 +1338,7 @@ var WebhookOutboxPlugin = class {
     );
     await this.autoEnqueuer.start();
     ctx.registerService("webhook.autoEnqueuer", this.autoEnqueuer);
-    _optionalChain([ctx, 'access', _151 => _151.logger, 'access', _152 => _152.info, 'optionalCall', _153 => _153("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
+    _optionalChain([ctx, 'access', _167 => _167.logger, 'access', _168 => _168.info, 'optionalCall', _169 => _169("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
   }
   /**
    * [#8069] Register {@link createWebhookRedeliverGuard} with messaging, so
@@ -1233,7 +1354,7 @@ var WebhookOutboxPlugin = class {
    */
   installRedeliverGuard(ctx, messaging, engine, subscriptionsObject) {
     if (typeof messaging.registerRedeliverGuard !== "function") {
-      _optionalChain([ctx, 'access', _154 => _154.logger, 'access', _155 => _155.error, 'optionalCall', _156 => _156(
+      _optionalChain([ctx, 'access', _170 => _170.logger, 'access', _171 => _171.error, 'optionalCall', _172 => _172(
         "[webhook-outbox] messaging service exposes no registerRedeliverGuard() \u2014 redelivery of a webhook whose signing configuration is gone CANNOT be refused, so an operator pressing redeliver may send a delivery that can no longer be authenticated (#7799, #8069). The POST /api/v1/webhooks/redeliver endpoint is reachable by any authenticated user. Fix: upgrade @objectstack/service-messaging to a build that implements registerRedeliverGuard."
       )]);
       return;
@@ -1242,35 +1363,49 @@ var WebhookOutboxPlugin = class {
       "webhook",
       createWebhookRedeliverGuard(engine, subscriptionsObject)
     );
-    _optionalChain([ctx, 'access', _157 => _157.logger, 'access', _158 => _158.debug, 'optionalCall', _159 => _159("[webhook-outbox] redeliver guard installed for source=webhook")]);
+    _optionalChain([ctx, 'access', _173 => _173.logger, 'access', _174 => _174.debug, 'optionalCall', _175 => _175("[webhook-outbox] redeliver guard installed for source=webhook")]);
   }
   tryGetService(ctx, names) {
     for (const n of names) {
       try {
         const svc = ctx.getService(n);
         if (svc) return svc;
-      } catch (e13) {
+      } catch (e16) {
       }
     }
     return void 0;
   }
   /**
    * Mount POST /api/v1/webhooks/redeliver on the host Hono app, if one is
-   * available. Delegates to `messaging.redeliverHttp(deliveryId)`. Auth is the
-   * better-auth session cookie — every authenticated user counts.
+   * available. Delegates to `messaging.redeliverHttp(deliveryId, …)`. Auth is
+   * the better-auth session cookie — every authenticated user counts.
+   *
+   * [#10740] Which is precisely why the caller's ACTIVE ORGANIZATION is
+   * resolved here and threaded into the call. `sys_http_delivery` is
+   * tenant-scoped, and this is the one door on it a request can reach: an
+   * unscoped replay from here is an authenticated user reaching another
+   * organization's delivery row on a walled deployment. With the tenant
+   * threaded, a row outside the caller's organization is simply not found.
+   *
+   * ⚠️ A session with no active organization threads `undefined`, and the
+   * driver's tenant-audit line then fires for that write. That is deliberate:
+   * the deployment could not tell us who is asking, and reporting the gap is
+   * the correct outcome. ⛔ It is never repaired with `bypassTenantAudit`,
+   * which would silence the report without closing anything.
    */
   registerAdminRoutes(ctx) {
     const http = this.tryGetService(ctx, ["http-server"]);
     if (!http || typeof http.getRawApp !== "function") {
-      _optionalChain([ctx, 'access', _160 => _160.logger, 'access', _161 => _161.debug, 'optionalCall', _162 => _162("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
+      _optionalChain([ctx, 'access', _176 => _176.logger, 'access', _177 => _177.debug, 'optionalCall', _178 => _178("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
       return;
     }
     const rawApp = http.getRawApp();
     const messaging = this.getMessaging(ctx);
     if (!rawApp || !messaging) return;
     rawApp.post("/api/v1/webhooks/redeliver", async (c) => {
-      const userId = await this.resolveSessionUserId(ctx, c);
-      if (!userId) {
+      const session = await this.resolveSession(ctx, c);
+      const userId = _optionalChain([session, 'optionalAccess', _179 => _179.user, 'optionalAccess', _180 => _180.id]);
+      if (typeof userId !== "string" || userId.length === 0) {
         return c.json(
           { success: false, error: { code: "UNAUTHENTICATED", message: "Sign in to redeliver webhook deliveries." } },
           401
@@ -1279,10 +1414,10 @@ var WebhookOutboxPlugin = class {
       let body;
       try {
         body = await c.req.json();
-      } catch (e14) {
+      } catch (e17) {
         return c.json({ success: false, error: { code: "INVALID_REQUEST", message: "Request body must be JSON." } }, 400);
       }
-      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _163 => _163.deliveryId]) === "string" ? body.deliveryId.trim() : "";
+      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _181 => _181.deliveryId]) === "string" ? body.deliveryId.trim() : "";
       if (!deliveryId) {
         return c.json(
           { success: false, error: { code: "MISSING_REQUIRED_FIELD", message: "Body must include `deliveryId: string`." } },
@@ -1290,27 +1425,40 @@ var WebhookOutboxPlugin = class {
         );
       }
       try {
-        const row = await messaging.redeliverHttp(deliveryId);
-        _optionalChain([ctx, 'access', _164 => _164.logger, 'access', _165 => _165.info, 'optionalCall', _166 => _166("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId })]);
+        const activeOrg = _optionalChain([session, 'optionalAccess', _182 => _182.session, 'optionalAccess', _183 => _183.activeOrganizationId]);
+        const tenantId = typeof activeOrg === "string" && activeOrg.length > 0 ? activeOrg : void 0;
+        const row = await messaging.redeliverHttp(deliveryId, { tenantId });
+        _optionalChain([ctx, 'access', _184 => _184.logger, 'access', _185 => _185.info, 'optionalCall', _186 => _186("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId, tenantId })]);
         return c.json({ success: true, data: { id: row.id, status: row.status } });
       } catch (err) {
-        const code = _optionalChain([err, 'optionalAccess', _167 => _167.code]);
+        const code = _optionalChain([err, 'optionalAccess', _187 => _187.code]);
         if (code === "RESOURCE_NOT_FOUND") {
           return c.json({ success: false, error: { code, message: err.message } }, 404);
         }
         if (code === "DELIVERY_NOT_ELIGIBLE" || code === "DELIVERY_NEVER_SENT") {
           return c.json({ success: false, error: { code, message: err.message } }, 409);
         }
-        _optionalChain([ctx, 'access', _168 => _168.logger, 'access', _169 => _169.error, 'optionalCall', _170 => _170("[webhook-outbox] redeliver failed", err)]);
+        _optionalChain([ctx, 'access', _188 => _188.logger, 'access', _189 => _189.error, 'optionalCall', _190 => _190("[webhook-outbox] redeliver failed", err)]);
         return c.json(
-          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _171 => _171.message]), () => ( String(err))) } },
+          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _191 => _191.message]), () => ( String(err))) } },
           500
         );
       }
     });
-    _optionalChain([ctx, 'access', _172 => _172.logger, 'access', _173 => _173.info, 'optionalCall', _174 => _174("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
+    _optionalChain([ctx, 'access', _192 => _192.logger, 'access', _193 => _193.info, 'optionalCall', _194 => _194("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
   }
-  async resolveSessionUserId(ctx, c) {
+  /**
+   * [#10740] The better-auth session envelope (`{ user, session }`) for this
+   * request, or `undefined`.
+   *
+   * Widened from the previous `resolveSessionUserId` because the route now
+   * needs two facts from ONE lookup: who is asking (`user.id`, the
+   * authentication gate) and which organization they are asking as
+   * (`session.activeOrganizationId`, the tenant threaded into the write).
+   * Resolving them separately would mean two `getSession` calls that can
+   * disagree.
+   */
+  async resolveSession(ctx, c) {
     try {
       const authService = this.tryGetService(ctx, ["auth"]);
       if (!authService) return void 0;
@@ -1318,11 +1466,9 @@ var WebhookOutboxPlugin = class {
       if (!api && typeof authService.getApi === "function") {
         api = await authService.getApi();
       }
-      if (!_optionalChain([api, 'optionalAccess', _175 => _175.getSession])) return void 0;
-      const session = await api.getSession({ headers: c.req.raw.headers });
-      const uid2 = _optionalChain([session, 'optionalAccess', _176 => _176.user, 'optionalAccess', _177 => _177.id]);
-      return typeof uid2 === "string" && uid2.length > 0 ? uid2 : void 0;
-    } catch (e15) {
+      if (!_optionalChain([api, 'optionalAccess', _195 => _195.getSession])) return void 0;
+      return await api.getSession({ headers: c.req.raw.headers });
+    } catch (e18) {
       return void 0;
     }
   }
@@ -1334,5 +1480,11 @@ var WebhookOutboxPlugin = class {
 
 
 
-exports.AutoEnqueuer = AutoEnqueuer; exports.SysWebhook = _chunkQ4FEMGD6cjs.SysWebhook; exports.WEBHOOK_HEADERS_FIELD = WEBHOOK_HEADERS_FIELD; exports.WEBHOOK_SECRET_FIELD = WEBHOOK_SECRET_FIELD; exports.WebhookOutboxPlugin = WebhookOutboxPlugin; exports.migrateLegacyWebhookSecrets = migrateLegacyWebhookSecrets;
+
+
+
+
+
+
+exports.AutoEnqueuer = AutoEnqueuer; exports.SysWebhook = _chunkDRHJ2M45cjs.SysWebhook; exports.WEBHOOK_HEADERS_FIELD = WEBHOOK_HEADERS_FIELD; exports.WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE = WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE; exports.WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS = WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS; exports.WEBHOOK_SECRET_FIELD = WEBHOOK_SECRET_FIELD; exports.WebhookHeadersShapeError = WebhookHeadersShapeError; exports.WebhookOutboxPlugin = WebhookOutboxPlugin; exports.assertWritableWebhookHeaders = assertWritableWebhookHeaders; exports.bindWebhookHeadersShapeGate = bindWebhookHeadersShapeGate; exports.migrateLegacyWebhookSecrets = migrateLegacyWebhookSecrets; exports.unbindWebhookHeadersShapeGate = unbindWebhookHeadersShapeGate;
 //# sourceMappingURL=index.cjs.map