@objectstack/plugin-webhooks 17.1.0 → 17.3.0

package/dist/index.cjs

@@ -194,7 +194,7 @@ var AutoEnqueuer = class {
     this.droppedForSecret = /* @__PURE__ */ new Set();
     this.subscriptionsObject = _nullishCoalesce(opts.subscriptionsObject, () => ( "sys_webhook"));
     this.refreshIntervalMs = _nullishCoalesce(opts.refreshIntervalMs, () => ( 6e4));
-    this.logger = _nullishCoalesce(opts.logger, () => ( {}));
+    this.logger = opts.logger;
   }
   /**
    * Load the subscription cache and start listening for events.
@@ -219,7 +219,7 @@ var AutoEnqueuer = class {
     if (this.refreshIntervalMs > 0) {
       this.refreshTimer = setInterval(() => {
         this.refresh().catch(
-          (err) => _optionalChain([this, 'access', _7 => _7.logger, 'access', _8 => _8.warn, 'optionalCall', _9 => _9("[webhook-auto-enqueuer] periodic refresh failed", err)])
+          (err) => _optionalChain([this, 'access', _7 => _7.logger, 'optionalAccess', _8 => _8.warn, 'optionalCall', _9 => _9("[webhook-auto-enqueuer] periodic refresh failed", err)])
         );
       }, this.refreshIntervalMs);
       _optionalChain([this, 'access', _10 => _10.refreshTimer, 'access', _11 => _11.unref, 'optionalCall', _12 => _12()]);
@@ -252,7 +252,7 @@ var AutoEnqueuer = class {
   rearmAfterCryptoRegistered() {
     const inFlight = _nullishCoalesce(this.refreshing, () => ( Promise.resolve()));
     void inFlight.catch(() => void 0).then(() => this.running ? this.refresh() : void 0).catch(
-      (err) => _optionalChain([this, 'access', _15 => _15.logger, 'access', _16 => _16.warn, 'optionalCall', _17 => _17(
+      (err) => _optionalChain([this, 'access', _15 => _15.logger, 'optionalAccess', _16 => _16.warn, 'optionalCall', _17 => _17(
         "[webhook-auto-enqueuer] re-arm after CryptoProvider registration failed",
         err
       )])
@@ -276,7 +276,7 @@ var AutoEnqueuer = class {
         where: { active: true }
       });
     } catch (err) {
-      _optionalChain([this, 'access', _18 => _18.logger, 'access', _19 => _19.warn, 'optionalCall', _20 => _20(
+      _optionalChain([this, 'access', _18 => _18.logger, 'optionalAccess', _19 => _19.warn, 'optionalCall', _20 => _20(
         `[webhook-auto-enqueuer] failed to load ${this.subscriptionsObject}`,
         err
       )]);
@@ -300,7 +300,7 @@ var AutoEnqueuer = class {
         if (!live.has(id)) this.droppedForSecret.delete(id);
       }
     }
-    _optionalChain([this, 'access', _22 => _22.logger, 'access', _23 => _23.debug, 'optionalCall', _24 => _24("[webhook-auto-enqueuer] cache refreshed", {
+    _optionalChain([this, 'access', _22 => _22.logger, 'optionalAccess', _23 => _23.debug, 'optionalCall', _24 => _24("[webhook-auto-enqueuer] cache refreshed", {
       objects: this.subscriptions.size,
       rows: rows.length
     })]);
@@ -371,20 +371,20 @@ var AutoEnqueuer = class {
   reportWriteFailure(sub, eventId, err, verb) {
     const meta = { webhook: sub.name, eventId, err: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _25 => _25.message]), () => ( err)) };
     if (!sub.parkedReason) {
-      _optionalChain([this, 'access', _26 => _26.logger, 'access', _27 => _27.warn, 'optionalCall', _28 => _28(`[webhook-auto-enqueuer] ${verb} failed`, meta)]);
+      _optionalChain([this, 'access', _26 => _26.logger, 'optionalAccess', _27 => _27.warn, 'optionalCall', _28 => _28(`[webhook-auto-enqueuer] ${verb} failed`, meta)]);
       return;
     }
     const message = `[webhook-auto-enqueuer] could not record the undeliverable event for webhook '${sub.name}' \u2014 the subscription is parked for an unresolvable credential, and this event is now DISCARDED WITH NO TRACE in sys_http_delivery, which is the durability gap #8069 closes. Most likely cause: the enqueue callback was wired directly to IHttpOutbox.enqueue instead of MessagingService.enqueueHttp \u2014 only the messaging seam routes a parked event to recordUndeliverable(), and the delivery door refuses it rather than minting a pending row that would be sent UNSIGNED.`;
-    if (typeof this.logger.error === "function") {
-      this.logger.error(message, err, meta);
+    if (typeof _optionalChain([this, 'access', _29 => _29.logger, 'optionalAccess', _30 => _30.error]) === "function") {
+      _optionalChain([this, 'access', _31 => _31.logger, 'optionalAccess', _32 => _32.error, 'call', _33 => _33(message, err, meta)]);
     } else {
-      _optionalChain([this, 'access', _29 => _29.logger, 'access', _30 => _30.warn, 'optionalCall', _31 => _31(message, meta)]);
+      _optionalChain([this, 'access', _34 => _34.logger, 'optionalAccess', _35 => _35.warn, 'optionalCall', _36 => _36(message, meta)]);
     }
   }
   park(sub, err, credential) {
     sub.secret = void 0;
     sub.headers = void 0;
-    sub.parkedReason = `[${WEBHOOK_SECRET_REFUSAL_CODE}/${WEBHOOK_SECRET_REFUSAL_STATUS}] webhook '${sub.name}' holds ${credential.article} that could not be decrypted, so this event was NOT delivered \u2014 recording it here rather than ${credential.ratherThan} (${credential.issue}, #8069). This row was never sent and cannot be redelivered: it carries no HMAC signature, because the ${credential.noun} that would have produced one is exactly what is missing. Fix: register a CryptoProvider (engine.setCryptoProvider \u2014 LocalCryptoProvider in dev, KMS/Vault in production) with the same key the ${credential.noun} was written under, and make sure the sys_secret row is reachable; the subscription re-arms on registration (#8022) and at the next periodic refresh, and later events are delivered normally. Cause: ${_nullishCoalesce(_optionalChain([err, 'optionalAccess', _32 => _32.message]), () => ( String(err)))}`;
+    sub.parkedReason = `[${WEBHOOK_SECRET_REFUSAL_CODE}/${WEBHOOK_SECRET_REFUSAL_STATUS}] webhook '${sub.name}' holds ${credential.article} that could not be decrypted, so this event was NOT delivered \u2014 recording it here rather than ${credential.ratherThan} (${credential.issue}, #8069). This row was never sent and cannot be redelivered: it carries no HMAC signature, because the ${credential.noun} that would have produced one is exactly what is missing. Fix: register a CryptoProvider (engine.setCryptoProvider \u2014 LocalCryptoProvider in dev, KMS/Vault in production) with the same key the ${credential.noun} was written under, and make sure the sys_secret row is reachable; the subscription re-arms on registration (#8022) and at the next periodic refresh, and later events are delivered normally. Cause: ${_nullishCoalesce(_optionalChain([err, 'optionalAccess', _37 => _37.message]), () => ( String(err)))}`;
   }
   /**
    * [#7799] Resolve `sub.secret`. Returns `false` when the subscription must
@@ -428,9 +428,9 @@ var AutoEnqueuer = class {
       this.park(sub, err, SIGNING_SECRET_CREDENTIAL);
       return false;
     }
-    const legacy = readLegacySecret(_optionalChain([row, 'optionalAccess', _33 => _33.definition_json]));
+    const legacy = readLegacySecret(_optionalChain([row, 'optionalAccess', _38 => _38.definition_json]));
     if (legacy) {
-      _optionalChain([this, 'access', _34 => _34.logger, 'access', _35 => _35.warn, 'optionalCall', _36 => _36(
+      _optionalChain([this, 'access', _39 => _39.logger, 'optionalAccess', _40 => _40.warn, 'optionalCall', _41 => _41(
         `[webhook-auto-enqueuer] webhook '${sub.name}' still carries its signing secret as CLEARTEXT in definition_json, readable over the data API (#7799). Signing continues from it; run the boot sweep (migrateLegacyWebhookSecrets) with a CryptoProvider wired to move it into sys_secret.`,
         { id: sub.id }
       )]);
@@ -478,9 +478,9 @@ var AutoEnqueuer = class {
       this.park(sub, err, CUSTOM_HEADERS_CREDENTIAL);
       return false;
     }
-    const legacy = readLegacyHeaders(_optionalChain([row, 'optionalAccess', _37 => _37.definition_json]));
+    const legacy = readLegacyHeaders(_optionalChain([row, 'optionalAccess', _42 => _42.definition_json]));
     if (legacy) {
-      _optionalChain([this, 'access', _38 => _38.logger, 'access', _39 => _39.warn, 'optionalCall', _40 => _40(
+      _optionalChain([this, 'access', _43 => _43.logger, 'optionalAccess', _44 => _44.warn, 'optionalCall', _45 => _45(
         `[webhook-auto-enqueuer] webhook '${sub.name}' still carries its custom headers as CLEARTEXT in definition_json, readable over the data API (#7986) \u2014 that map is the ordinary place an Authorization header goes. Delivery continues from it; run the boot sweep (migrateLegacyWebhookSecrets) with a CryptoProvider wired to move them into sys_secret.`,
         { id: sub.id }
       )]);
@@ -520,10 +520,10 @@ var AutoEnqueuer = class {
       field: credential.field,
       code: WEBHOOK_SECRET_REFUSAL_CODE,
       status: WEBHOOK_SECRET_REFUSAL_STATUS,
-      err: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _41 => _41.message]), () => ( err))
+      err: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _46 => _46.message]), () => ( err))
     };
     if (this.droppedForSecret.has(sub.id)) {
-      _optionalChain([this, 'access', _42 => _42.logger, 'access', _43 => _43.debug, 'optionalCall', _44 => _44(
+      _optionalChain([this, 'access', _47 => _47.logger, 'optionalAccess', _48 => _48.debug, 'optionalCall', _49 => _49(
         `[webhook-auto-enqueuer] webhook '${sub.name}' is still dropped for an unresolvable ${credential.noun} (${credential.issues})`,
         meta
       )]);
@@ -531,14 +531,14 @@ var AutoEnqueuer = class {
     }
     this.droppedForSecret.add(sub.id);
     const message = `[webhook-auto-enqueuer] webhook '${sub.name}' holds ${credential.article} that could not be decrypted \u2014 the subscription is PARKED rather than ${credential.ratherThan} (${credential.issue}), so every matching record change is discarded with NO delivery, while the row keeps reading active:true in Setup. Each discarded event IS recorded in sys_http_delivery as a dead row with 0 attempts carrying this cause (#8069) \u2014 look there for the backlog; those rows can never be sent or redelivered, because a parked row has no HMAC signature. Fix: register a CryptoProvider (engine.setCryptoProvider \u2014 LocalCryptoProvider in dev, KMS/Vault in production) with the same key the ${credential.noun} was written under, and make sure the sys_secret row is reachable; the subscription re-arms on registration (#8022) and at the next periodic refresh.`;
-    if (typeof this.logger.error === "function") {
-      this.logger.error(message, err, meta);
+    if (typeof _optionalChain([this, 'access', _50 => _50.logger, 'optionalAccess', _51 => _51.error]) === "function") {
+      _optionalChain([this, 'access', _52 => _52.logger, 'optionalAccess', _53 => _53.error, 'call', _54 => _54(message, err, meta)]);
     } else {
-      _optionalChain([this, 'access', _45 => _45.logger, 'access', _46 => _46.warn, 'optionalCall', _47 => _47(message, meta)]);
+      _optionalChain([this, 'access', _55 => _55.logger, 'optionalAccess', _56 => _56.warn, 'optionalCall', _57 => _57(message, meta)]);
     }
   }
   parseRow(row) {
-    if (!_optionalChain([row, 'optionalAccess', _48 => _48.id]) || !_optionalChain([row, 'optionalAccess', _49 => _49.url])) return null;
+    if (!_optionalChain([row, 'optionalAccess', _58 => _58.id]) || !_optionalChain([row, 'optionalAccess', _59 => _59.url])) return null;
     const rawTriggers = row.triggers;
     let triggerList;
     if (Array.isArray(rawTriggers)) {
@@ -559,7 +559,7 @@ var AutoEnqueuer = class {
     const normalized = triggerList.map((t) => t.trim().toLowerCase()).filter(Boolean);
     const unknown = normalized.filter((t) => !DISPATCHABLE_WEBHOOK_TRIGGERS.has(t));
     if (unknown.length > 0) {
-      _optionalChain([this, 'access', _50 => _50.logger, 'access', _51 => _51.warn, 'optionalCall', _52 => _52(
+      _optionalChain([this, 'access', _60 => _60.logger, 'optionalAccess', _61 => _61.warn, 'optionalCall', _62 => _62(
         `[webhook-auto-enqueuer] webhook '${_nullishCoalesce(row.name, () => ( row.id))}' declares trigger(s) the engine never emits: ${unknown.join(", ")} \u2014 ignored. Dispatchable triggers: ${[...DISPATCHABLE_WEBHOOK_TRIGGERS].join(", ")}.`,
         { id: row.id, unknown }
       )]);
@@ -568,7 +568,7 @@ var AutoEnqueuer = class {
       normalized.filter((t) => DISPATCHABLE_WEBHOOK_TRIGGERS.has(t))
     );
     if (triggers.size === 0) {
-      _optionalChain([this, 'access', _53 => _53.logger, 'access', _54 => _54.warn, 'optionalCall', _55 => _55(
+      _optionalChain([this, 'access', _63 => _63.logger, 'optionalAccess', _64 => _64.warn, 'optionalCall', _65 => _65(
         `[webhook-auto-enqueuer] webhook '${_nullishCoalesce(row.name, () => ( row.id))}' has no dispatchable triggers \u2014 it will NEVER fire (rule webhook/without-triggers): there is no manual fire path (#3196), so this row is dead while looking armed in Setup. Declare one of: ${[...DISPATCHABLE_WEBHOOK_TRIGGERS].join(", ")}, or set it inactive if it should be off.`,
         { id: row.id }
       )]);
@@ -596,7 +596,11 @@ var AutoEnqueuer = class {
       // `headers` and `secret` are both filled by attachCredentials()
       // from their encrypted columns, NOT read off the row — see #7799
       // (secret) and #7986 (headers).
-      timeoutMs: defn.timeoutMs
+      timeoutMs: defn.timeoutMs,
+      // [#13546] The tenant column the kernel provisions on sys_webhook.
+      // This cache read is a dispatcher-side unscoped find, so the column
+      // comes back for every organization's rows.
+      organizationId: row.organization_id ? String(row.organization_id) : void 0
     };
   }
   /**
@@ -609,11 +613,11 @@ var AutoEnqueuer = class {
   handleEvent(event) {
     if (!event.object) return;
     if (event.object === this.subscriptionsObject) return;
-    if (_optionalChain([event, 'access', _56 => _56.type, 'optionalAccess', _57 => _57.startsWith, 'call', _58 => _58("data.records.")])) {
+    if (_optionalChain([event, 'access', _66 => _66.type, 'optionalAccess', _67 => _67.startsWith, 'call', _68 => _68("data.records.")])) {
       this.handleBulkEvent(event);
       return;
     }
-    if (!_optionalChain([event, 'access', _59 => _59.type, 'optionalAccess', _60 => _60.startsWith, 'call', _61 => _61("data.record.")])) return;
+    if (!_optionalChain([event, 'access', _69 => _69.type, 'optionalAccess', _70 => _70.startsWith, 'call', _71 => _71("data.record.")])) return;
     const action = event.type.slice("data.record.".length);
     const trigger = mapActionToTrigger(action);
     if (!trigger) return;
@@ -625,7 +629,7 @@ var AutoEnqueuer = class {
     const payload = _nullishCoalesce(event.payload, () => ( {}));
     const recordId = payload.recordId;
     if (typeof recordId !== "string" || recordId === "") {
-      _optionalChain([this, 'access', _62 => _62.logger, 'access', _63 => _63.warn, 'optionalCall', _64 => _64(
+      _optionalChain([this, 'access', _72 => _72.logger, 'optionalAccess', _73 => _73.warn, 'optionalCall', _74 => _74(
         "[webhook-auto-enqueuer] dropping off-contract data event: payload is not a DataEvent (no top-level string `recordId`) \u2014 fix the producer",
         { type: event.type, object: event.object }
       )]);
@@ -650,6 +654,12 @@ var AutoEnqueuer = class {
         // subscription, so the delivery path is byte-identical to before.
         undeliverableReason: sub.parkedReason,
         timeoutMs: sub.timeoutMs,
+        // [#13546] The delivery row belongs to the SUBSCRIPTION's
+        // organization — the one honest tenant in scope on this
+        // fire-and-forget path (no request context exists here).
+        // Absent for an org-less subscription; the row then lands
+        // NULL, the global-row shape.
+        organizationId: sub.organizationId,
         // [#3946] Envelope keys are written LAST so the event payload
         // cannot rewrite them. Behaviour-neutral for the engine's own
         // publishers — since #4626 a `data.record.*` payload is a
@@ -694,7 +704,7 @@ var AutoEnqueuer = class {
     const payload = _nullishCoalesce(event.payload, () => ( {}));
     const matched = payload.matched;
     if (typeof matched !== "number" || !Number.isInteger(matched) || matched < 0) {
-      _optionalChain([this, 'access', _65 => _65.logger, 'access', _66 => _66.warn, 'optionalCall', _67 => _67(
+      _optionalChain([this, 'access', _75 => _75.logger, 'optionalAccess', _76 => _76.warn, 'optionalCall', _77 => _77(
         "[webhook-auto-enqueuer] dropping off-contract bulk data event: payload is not a BulkDataEvent (no top-level non-negative integer `matched`) \u2014 fix the producer",
         { type: event.type, object: event.object }
       )]);
@@ -702,7 +712,7 @@ var AutoEnqueuer = class {
     }
     const eventUuid = payload.id;
     if (typeof eventUuid !== "string" || eventUuid === "") {
-      _optionalChain([this, 'access', _68 => _68.logger, 'access', _69 => _69.warn, 'optionalCall', _70 => _70(
+      _optionalChain([this, 'access', _78 => _78.logger, 'optionalAccess', _79 => _79.warn, 'optionalCall', _80 => _80(
         "[webhook-auto-enqueuer] dropping off-contract bulk data event: payload has no top-level string `id` to dedup on \u2014 fix the producer",
         { type: event.type, object: event.object }
       )]);
@@ -724,6 +734,9 @@ var AutoEnqueuer = class {
         // an undeliverable row instead of enqueuing a delivery.
         undeliverableReason: sub.parkedReason,
         timeoutMs: sub.timeoutMs,
+        // [#13546] See the per-record path — the subscription's own
+        // organization, absent for an org-less subscription.
+        organizationId: sub.organizationId,
         // [#3946] Envelope keys last so the payload cannot rewrite them.
         payload: {
           ...payload,
@@ -737,9 +750,9 @@ var AutoEnqueuer = class {
   }
   handleSelfHealEvent(event) {
     if (event.object !== this.subscriptionsObject) return;
-    if (!_optionalChain([event, 'access', _71 => _71.type, 'optionalAccess', _72 => _72.startsWith, 'call', _73 => _73("data.record.")]) && !_optionalChain([event, 'access', _74 => _74.type, 'optionalAccess', _75 => _75.startsWith, 'call', _76 => _76("data.records.")])) return;
+    if (!_optionalChain([event, 'access', _81 => _81.type, 'optionalAccess', _82 => _82.startsWith, 'call', _83 => _83("data.record.")]) && !_optionalChain([event, 'access', _84 => _84.type, 'optionalAccess', _85 => _85.startsWith, 'call', _86 => _86("data.records.")])) return;
     this.refresh().catch(
-      (err) => _optionalChain([this, 'access', _77 => _77.logger, 'access', _78 => _78.warn, 'optionalCall', _79 => _79("[webhook-auto-enqueuer] self-heal refresh failed", err)])
+      (err) => _optionalChain([this, 'access', _87 => _87.logger, 'optionalAccess', _88 => _88.warn, 'optionalCall', _89 => _89("[webhook-auto-enqueuer] self-heal refresh failed", err)])
     );
   }
   /** Test / admin accessor. */
@@ -782,21 +795,21 @@ var _automation = require('@objectstack/spec/automation');
 var SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] };
 function uid(prefix) {
   const g = globalThis;
-  if (_optionalChain([g, 'access', _80 => _80.crypto, 'optionalAccess', _81 => _81.randomUUID])) return `${prefix}_${g.crypto.randomUUID()}`;
+  if (_optionalChain([g, 'access', _90 => _90.crypto, 'optionalAccess', _91 => _91.randomUUID])) return `${prefix}_${g.crypto.randomUUID()}`;
   return `${prefix}_${Math.random().toString(36).slice(2, 10)}`;
 }
 function readDeclared(engine, metadataService, type) {
   try {
-    const reg = _optionalChain([engine, 'optionalAccess', _82 => _82._registry]);
-    if (_optionalChain([reg, 'optionalAccess', _83 => _83.listItems])) {
+    const reg = _optionalChain([engine, 'optionalAccess', _92 => _92._registry]);
+    if (_optionalChain([reg, 'optionalAccess', _93 => _93.listItems])) {
       const items = (_nullishCoalesce(reg.listItems(type), () => ( []))).filter(Boolean);
       if (items.length > 0) return items;
     }
   } catch (e7) {
   }
   try {
-    const listed = _optionalChain([metadataService, 'optionalAccess', _84 => _84.list, 'optionalCall', _85 => _85(type)]);
-    const arr = typeof _optionalChain([listed, 'optionalAccess', _86 => _86.then]) === "function" ? [] : _nullishCoalesce(listed, () => ( []));
+    const listed = _optionalChain([metadataService, 'optionalAccess', _94 => _94.list, 'optionalCall', _95 => _95(type)]);
+    const arr = typeof _optionalChain([listed, 'optionalAccess', _96 => _96.then]) === "function" ? [] : _nullishCoalesce(listed, () => ( []));
     return Array.isArray(arr) ? arr.filter(Boolean) : [];
   } catch (e8) {
     return [];
@@ -813,9 +826,9 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
     try {
       wh = _automation.WebhookSchema.parse(raw);
     } catch (err) {
-      _optionalChain([logger, 'optionalAccess', _87 => _87.warn, 'optionalCall', _88 => _88("[webhook] declared webhook failed validation \u2014 skipped", {
-        name: _optionalChain([raw, 'optionalAccess', _89 => _89.name]),
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _90 => _90.message]), () => ( String(err)))
+      _optionalChain([logger, 'optionalAccess', _97 => _97.warn, 'optionalCall', _98 => _98("[webhook] declared webhook failed validation \u2014 skipped", {
+        name: _optionalChain([raw, 'optionalAccess', _99 => _99.name]),
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _100 => _100.message]), () => ( String(err)))
       })]);
       skipped += 1;
       continue;
@@ -829,7 +842,7 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
       const row = Array.isArray(existing) ? existing[0] : void 0;
       if (row) {
         if (row.managed_by === "admin") {
-          _optionalChain([logger, 'optionalAccess', _91 => _91.warn, 'optionalCall', _92 => _92("[webhook] declared name collides with an admin-authored row \u2014 seed skipped", {
+          _optionalChain([logger, 'optionalAccess', _101 => _101.warn, 'optionalCall', _102 => _102("[webhook] declared name collides with an admin-authored row \u2014 seed skipped", {
             name: wh.name
           })]);
           skipped += 1;
@@ -881,18 +894,18 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
       seeded += 1;
     } catch (err) {
       const protection = isSecretProtectionFailure(err);
-      _optionalChain([logger, 'optionalAccess', _93 => _93.warn, 'optionalCall', _94 => _94(
+      _optionalChain([logger, 'optionalAccess', _103 => _103.warn, 'optionalCall', _104 => _104(
         protection ? "[webhook] declared webhook NOT seeded \u2014 its signing secret cannot be stored encrypted (#7799)" : "[webhook] declared webhook seed failed",
         {
           name: wh.name,
           ...protection ? { code: WEBHOOK_SECRET_REFUSAL_CODE, status: WEBHOOK_SECRET_REFUSAL_STATUS } : {},
-          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _95 => _95.message]), () => ( String(err)))
+          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _105 => _105.message]), () => ( String(err)))
         }
       )]);
       skipped += 1;
     }
   }
-  _optionalChain([logger, 'optionalAccess', _96 => _96.info, 'optionalCall', _97 => _97("[webhook] declared webhooks materialized into sys_webhook", {
+  _optionalChain([logger, 'optionalAccess', _106 => _106.info, 'optionalCall', _107 => _107("[webhook] declared webhooks materialized into sys_webhook", {
     seeded,
     skipped,
     total: declared.length
@@ -901,7 +914,7 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
 }
 async function secretPatch(engine, wh, row, subscriptionsObject) {
   const { secret } = splitWebhookSecret(wh);
-  const hasStored = _optionalChain([row, 'optionalAccess', _98 => _98[WEBHOOK_SECRET_FIELD]]) != null && row[WEBHOOK_SECRET_FIELD] !== "";
+  const hasStored = _optionalChain([row, 'optionalAccess', _108 => _108[WEBHOOK_SECRET_FIELD]]) != null && row[WEBHOOK_SECRET_FIELD] !== "";
   if (!secret) return hasStored ? { [WEBHOOK_SECRET_FIELD]: null } : {};
   if (!hasStored || !canResolveSecrets(engine)) return { [WEBHOOK_SECRET_FIELD]: secret };
   try {
@@ -943,16 +956,16 @@ async function migrateLegacyWebhookSecrets(engine, logger, subscriptionsObject =
   let rows;
   try {
     const found = await engine.find(subscriptionsObject, SYSTEM_QUERY);
-    rows = Array.isArray(found) ? found : _nullishCoalesce(_optionalChain([found, 'optionalAccess', _99 => _99.data]), () => ( []));
+    rows = Array.isArray(found) ? found : _nullishCoalesce(_optionalChain([found, 'optionalAccess', _109 => _109.data]), () => ( []));
   } catch (err) {
-    _optionalChain([logger, 'optionalAccess', _100 => _100.warn, 'optionalCall', _101 => _101("[webhook] legacy secret sweep skipped \u2014 could not read subscriptions", {
+    _optionalChain([logger, 'optionalAccess', _110 => _110.warn, 'optionalCall', _111 => _111("[webhook] legacy secret sweep skipped \u2014 could not read subscriptions", {
       object: subscriptionsObject,
-      error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _102 => _102.message]), () => ( String(err)))
+      error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _112 => _112.message]), () => ( String(err)))
     })]);
     return out;
   }
   for (const row of rows) {
-    if (!_optionalChain([row, 'optionalAccess', _103 => _103.id])) continue;
+    if (!_optionalChain([row, 'optionalAccess', _113 => _113.id])) continue;
     const legacySecret = readLegacySecret(row.definition_json);
     const legacyHeaders = readLegacyHeaders(row.definition_json);
     if (!legacySecret && !legacyHeaders) continue;
@@ -973,20 +986,20 @@ async function migrateLegacyWebhookSecrets(engine, logger, subscriptionsObject =
       out.failed += 1;
       const protection = isSecretProtectionFailure(err);
       const what = legacySecret && legacyHeaders ? "signing secret and custom headers" : legacySecret ? "signing secret" : "custom headers";
-      _optionalChain([logger, 'optionalAccess', _104 => _104.warn, 'optionalCall', _105 => _105(
+      _optionalChain([logger, 'optionalAccess', _114 => _114.warn, 'optionalCall', _115 => _115(
         protection ? `[webhook] ${what} STILL CLEARTEXT in definition_json \u2014 no CryptoProvider to encrypt them (#7799/#7986)` : `[webhook] ${what} migration failed \u2014 row left unchanged (#7799/#7986)`,
         {
           name: _nullishCoalesce(row.name, () => ( row.id)),
           id: row.id,
           code: WEBHOOK_SECRET_REFUSAL_CODE,
           status: WEBHOOK_SECRET_REFUSAL_STATUS,
-          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _106 => _106.message]), () => ( String(err)))
+          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _116 => _116.message]), () => ( String(err)))
         }
       )]);
     }
   }
   if (out.found > 0) {
-    _optionalChain([logger, 'optionalAccess', _107 => _107.info, 'optionalCall', _108 => _108("[webhook] legacy cleartext credentials swept into sys_secret", { ...out })]);
+    _optionalChain([logger, 'optionalAccess', _117 => _117.info, 'optionalCall', _118 => _118("[webhook] legacy cleartext credentials swept into sys_secret", { ...out })]);
   }
   return out;
 }
@@ -1024,14 +1037,14 @@ function createWebhookRedeliverGuard(engine, subscriptionsObject = WEBHOOK_OBJEC
 var WEBHOOK_PROVENANCE_PACKAGE = "plugin-webhooks:provenance";
 var SYSTEM_CTX3 = { isSystem: true, positions: [], permissions: [] };
 function bindWebhookProvenanceStamp(engine, logger) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _109 => _109.registerHook]) !== "function") return;
+  if (typeof _optionalChain([engine, 'optionalAccess', _119 => _119.registerHook]) !== "function") return;
   engine.registerHook(
     "beforeUpdate",
     async (ctx) => {
-      if (_optionalChain([ctx, 'optionalAccess', _110 => _110.session, 'optionalAccess', _111 => _111.isSystem])) return;
-      const id = _nullishCoalesce(_optionalChain([ctx, 'optionalAccess', _112 => _112.input, 'optionalAccess', _113 => _113.id]), () => ( _optionalChain([ctx, 'optionalAccess', _114 => _114.input, 'optionalAccess', _115 => _115.data, 'optionalAccess', _116 => _116.id])));
+      if (_optionalChain([ctx, 'optionalAccess', _120 => _120.session, 'optionalAccess', _121 => _121.isSystem])) return;
+      const id = _nullishCoalesce(_optionalChain([ctx, 'optionalAccess', _122 => _122.input, 'optionalAccess', _123 => _123.id]), () => ( _optionalChain([ctx, 'optionalAccess', _124 => _124.input, 'optionalAccess', _125 => _125.data, 'optionalAccess', _126 => _126.id])));
       if (!id) return;
-      const data = _optionalChain([ctx, 'optionalAccess', _117 => _117.input, 'optionalAccess', _118 => _118.data]);
+      const data = _optionalChain([ctx, 'optionalAccess', _127 => _127.input, 'optionalAccess', _128 => _128.data]);
       if (!data || typeof data !== "object") return;
       try {
         const rows = await engine.find("sys_webhook", {
@@ -1046,18 +1059,18 @@ function bindWebhookProvenanceStamp(engine, logger) {
           data.customized = true;
         }
       } catch (err) {
-        _optionalChain([logger, 'optionalAccess', _119 => _119.warn, 'optionalCall', _120 => _120("[webhook] provenance stamp failed (edit proceeds unstamped)", {
+        _optionalChain([logger, 'optionalAccess', _129 => _129.warn, 'optionalCall', _130 => _130("[webhook] provenance stamp failed (edit proceeds unstamped)", {
           id,
-          error: _optionalChain([err, 'optionalAccess', _121 => _121.message])
+          error: _optionalChain([err, 'optionalAccess', _131 => _131.message])
         })]);
       }
     },
     { object: "sys_webhook", packageId: WEBHOOK_PROVENANCE_PACKAGE, priority: 150 }
   );
-  _optionalChain([logger, 'optionalAccess', _122 => _122.info, 'optionalCall', _123 => _123("[webhook] provenance stamp hook bound")]);
+  _optionalChain([logger, 'optionalAccess', _132 => _132.info, 'optionalCall', _133 => _133("[webhook] provenance stamp hook bound")]);
 }
 function unbindWebhookProvenanceStamp(engine) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _124 => _124.unregisterHooksByPackage]) === "function") {
+  if (typeof _optionalChain([engine, 'optionalAccess', _134 => _134.unregisterHooksByPackage]) === "function") {
     engine.unregisterHooksByPackage(WEBHOOK_PROVENANCE_PACKAGE);
   }
 }
@@ -1135,9 +1148,9 @@ function assertWritableWebhookHeaders(data, object = WEBHOOK_OBJECT, field = WEB
 var WEBHOOK_HEADERS_GATE_PACKAGE = "plugin-webhooks:headers-shape-gate";
 var GATE_PRIORITY = 50;
 function bindWebhookHeadersShapeGate(engine, logger) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _125 => _125.registerHook]) !== "function") return;
+  if (typeof _optionalChain([engine, 'optionalAccess', _135 => _135.registerHook]) !== "function") return;
   const handler = (ctx) => {
-    assertWritableWebhookHeaders(_optionalChain([ctx, 'optionalAccess', _126 => _126.input, 'optionalAccess', _127 => _127.data]));
+    assertWritableWebhookHeaders(_optionalChain([ctx, 'optionalAccess', _136 => _136.input, 'optionalAccess', _137 => _137.data]));
   };
   for (const event of ["beforeInsert", "beforeUpdate"]) {
     engine.registerHook(event, handler, {
@@ -1146,10 +1159,10 @@ function bindWebhookHeadersShapeGate(engine, logger) {
       priority: GATE_PRIORITY
     });
   }
-  _optionalChain([logger, 'optionalAccess', _128 => _128.info, 'optionalCall', _129 => _129("[webhook] headers_secret shape gate bound (refuses non-flat-string-map plaintext)")]);
+  _optionalChain([logger, 'optionalAccess', _138 => _138.info, 'optionalCall', _139 => _139("[webhook] headers_secret shape gate bound (refuses non-flat-string-map plaintext)")]);
 }
 function unbindWebhookHeadersShapeGate(engine) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _130 => _130.unregisterHooksByPackage]) === "function") {
+  if (typeof _optionalChain([engine, 'optionalAccess', _140 => _140.unregisterHooksByPackage]) === "function") {
     engine.unregisterHooksByPackage(WEBHOOK_HEADERS_GATE_PACKAGE);
   }
 }
@@ -1198,7 +1211,7 @@ var WebhookOutboxPlugin = class {
         ]
       });
     } else {
-      _optionalChain([ctx, 'access', _131 => _131.logger, 'access', _132 => _132.warn, 'optionalCall', _133 => _133(
+      _optionalChain([ctx, 'access', _141 => _141.logger, 'access', _142 => _142.warn, 'optionalCall', _143 => _143(
         "[webhook-outbox] manifest service unavailable \u2014 sys_webhook will NOT appear in REST or Studio nav. Register MetadataService before WebhookOutboxPlugin."
       )]);
     }
@@ -1207,7 +1220,7 @@ var WebhookOutboxPlugin = class {
         try {
           const i18n = ctx.getService("i18n");
           if (i18n && typeof i18n.loadTranslations === "function") {
-            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-IHRALWSP.cjs")));
+            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-YO6CI7LZ.cjs")));
             for (const [locale, data] of Object.entries(WebhooksTranslations)) {
               i18n.loadTranslations(locale, data);
             }
@@ -1224,12 +1237,27 @@ var WebhookOutboxPlugin = class {
         this.registerAdminRoutes(ctx);
       });
     }
-    _optionalChain([ctx, 'access', _134 => _134.logger, 'access', _135 => _135.info, 'optionalCall', _136 => _136("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
+    _optionalChain([ctx, 'access', _144 => _144.logger, 'access', _145 => _145.info, 'optionalCall', _146 => _146("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
       autoEnqueue: autoEnqueueOpt !== false
     })]);
   }
-  async dispose() {
-    await _optionalChain([this, 'access', _137 => _137.autoEnqueuer, 'optionalAccess', _138 => _138.stop, 'call', _139 => _139()]);
+  /**
+   * Teardown — the kernel's ONLY teardown hook.
+   *
+   * [#10772] This body used to be spelled `dispose()`. `Plugin`
+   * (`@objectstack/core`'s `types.ts`) declares `init()`, `start?(ctx)` and
+   * `destroy?()` and no `dispose()`, and `ObjectKernel.performShutdown()` /
+   * `LiteKernel.destroy()` walk the plugins in reverse calling
+   * `plugin.destroy()` — so after `await kernel.shutdown()` had RESOLVED the
+   * auto-enqueuer was still running and both engine hooks were still bound.
+   * Measured on the same revision: `dispose()` had ZERO callers anywhere in
+   * the repo, so this teardown had never run in any process at all.
+   *
+   * Idempotent: `boundEngine` is cleared as it is unbound, so a second
+   * teardown is a no-op rather than a second unbind.
+   */
+  async destroy() {
+    await _optionalChain([this, 'access', _147 => _147.autoEnqueuer, 'optionalAccess', _148 => _148.stop, 'call', _149 => _149()]);
     if (this.boundEngine) {
       try {
         unbindWebhookProvenanceStamp(this.boundEngine);
@@ -1242,6 +1270,15 @@ var WebhookOutboxPlugin = class {
       this.boundEngine = void 0;
     }
   }
+  /**
+   * Retained alias for {@link destroy}. Kept because it is public API of an
+   * exported class: an embedder may have learned to call it directly
+   * precisely BECAUSE the kernel never did, and deleting it would break them.
+   * Same signature, same return type — a direct caller sees no change.
+   */
+  async dispose() {
+    await this.destroy();
+  }
   getMessaging(ctx) {
     const svc = this.tryGetService(ctx, ["messaging"]);
     return svc && typeof svc.enqueueHttp === "function" ? svc : void 0;
@@ -1261,7 +1298,7 @@ var WebhookOutboxPlugin = class {
   async bootDeclaredWebhooks(ctx) {
     const engine = this.tryGetService(ctx, ["objectql", "data"]);
     if (!engine) {
-      _optionalChain([ctx, 'access', _140 => _140.logger, 'access', _141 => _141.warn, 'optionalCall', _142 => _142("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
+      _optionalChain([ctx, 'access', _150 => _150.logger, 'access', _151 => _151.warn, 'optionalCall', _152 => _152("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
       return;
     }
     this.boundEngine = engine;
@@ -1275,15 +1312,15 @@ var WebhookOutboxPlugin = class {
     try {
       await bootstrapDeclaredWebhooks(engine, metadataService, ctx.logger);
     } catch (err) {
-      _optionalChain([ctx, 'access', _143 => _143.logger, 'access', _144 => _144.warn, 'optionalCall', _145 => _145("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _146 => _146.message]), () => ( String(err)))
+      _optionalChain([ctx, 'access', _153 => _153.logger, 'access', _154 => _154.warn, 'optionalCall', _155 => _155("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _156 => _156.message]), () => ( String(err)))
       })]);
     }
     try {
       await migrateLegacyWebhookSecrets(engine, ctx.logger);
     } catch (err) {
-      _optionalChain([ctx, 'access', _147 => _147.logger, 'access', _148 => _148.warn, 'optionalCall', _149 => _149("[webhook] legacy signing-secret sweep failed (rows left unchanged)", {
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _150 => _150.message]), () => ( String(err)))
+      _optionalChain([ctx, 'access', _157 => _157.logger, 'access', _158 => _158.warn, 'optionalCall', _159 => _159("[webhook] legacy signing-secret sweep failed (rows left unchanged)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _160 => _160.message]), () => ( String(err)))
       })]);
     }
   }
@@ -1293,14 +1330,14 @@ var WebhookOutboxPlugin = class {
     const realtime = this.tryGetService(ctx, ["realtime"]);
     const messaging = this.getMessaging(ctx);
     if (!engine || !realtime || !messaging) {
-      _optionalChain([ctx, 'access', _151 => _151.logger, 'access', _152 => _152.warn, 'optionalCall', _153 => _153(
+      _optionalChain([ctx, 'access', _161 => _161.logger, 'access', _162 => _162.warn, 'optionalCall', _163 => _163(
         "[webhook-auto-enqueuer] disabled \u2014 ObjectQL, Realtime, or Messaging service not available",
         { hasEngine: !!engine, hasRealtime: !!realtime, hasMessaging: !!messaging }
       )]);
       return;
     }
     if (!messaging.isHttpDeliveryReady()) {
-      _optionalChain([ctx, 'access', _154 => _154.logger, 'access', _155 => _155.warn, 'optionalCall', _156 => _156(
+      _optionalChain([ctx, 'access', _164 => _164.logger, 'access', _165 => _165.warn, 'optionalCall', _166 => _166(
         "[webhook-auto-enqueuer] messaging HTTP outbox not ready (no data engine / reliableDelivery off) \u2014 webhook deliveries will not be durable"
       )]);
     }
@@ -1314,7 +1351,7 @@ var WebhookOutboxPlugin = class {
     );
     await this.autoEnqueuer.start();
     ctx.registerService("webhook.autoEnqueuer", this.autoEnqueuer);
-    _optionalChain([ctx, 'access', _157 => _157.logger, 'access', _158 => _158.info, 'optionalCall', _159 => _159("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
+    _optionalChain([ctx, 'access', _167 => _167.logger, 'access', _168 => _168.info, 'optionalCall', _169 => _169("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
   }
   /**
    * [#8069] Register {@link createWebhookRedeliverGuard} with messaging, so
@@ -1330,7 +1367,7 @@ var WebhookOutboxPlugin = class {
    */
   installRedeliverGuard(ctx, messaging, engine, subscriptionsObject) {
     if (typeof messaging.registerRedeliverGuard !== "function") {
-      _optionalChain([ctx, 'access', _160 => _160.logger, 'access', _161 => _161.error, 'optionalCall', _162 => _162(
+      _optionalChain([ctx, 'access', _170 => _170.logger, 'access', _171 => _171.error, 'optionalCall', _172 => _172(
         "[webhook-outbox] messaging service exposes no registerRedeliverGuard() \u2014 redelivery of a webhook whose signing configuration is gone CANNOT be refused, so an operator pressing redeliver may send a delivery that can no longer be authenticated (#7799, #8069). The POST /api/v1/webhooks/redeliver endpoint is reachable by any authenticated user. Fix: upgrade @objectstack/service-messaging to a build that implements registerRedeliverGuard."
       )]);
       return;
@@ -1339,7 +1376,7 @@ var WebhookOutboxPlugin = class {
       "webhook",
       createWebhookRedeliverGuard(engine, subscriptionsObject)
     );
-    _optionalChain([ctx, 'access', _163 => _163.logger, 'access', _164 => _164.debug, 'optionalCall', _165 => _165("[webhook-outbox] redeliver guard installed for source=webhook")]);
+    _optionalChain([ctx, 'access', _173 => _173.logger, 'access', _174 => _174.debug, 'optionalCall', _175 => _175("[webhook-outbox] redeliver guard installed for source=webhook")]);
   }
   tryGetService(ctx, names) {
     for (const n of names) {
@@ -1353,21 +1390,35 @@ var WebhookOutboxPlugin = class {
   }
   /**
    * Mount POST /api/v1/webhooks/redeliver on the host Hono app, if one is
-   * available. Delegates to `messaging.redeliverHttp(deliveryId)`. Auth is the
-   * better-auth session cookie — every authenticated user counts.
+   * available. Delegates to `messaging.redeliverHttp(deliveryId, …)`. Auth is
+   * the better-auth session cookie — every authenticated user counts.
+   *
+   * [#10740] Which is precisely why the caller's ACTIVE ORGANIZATION is
+   * resolved here and threaded into the call. `sys_http_delivery` is
+   * tenant-scoped, and this is the one door on it a request can reach: an
+   * unscoped replay from here is an authenticated user reaching another
+   * organization's delivery row on a walled deployment. With the tenant
+   * threaded, a row outside the caller's organization is simply not found.
+   *
+   * ⚠️ A session with no active organization threads `undefined`, and the
+   * driver's tenant-audit line then fires for that write. That is deliberate:
+   * the deployment could not tell us who is asking, and reporting the gap is
+   * the correct outcome. ⛔ It is never repaired with `bypassTenantAudit`,
+   * which would silence the report without closing anything.
    */
   registerAdminRoutes(ctx) {
     const http = this.tryGetService(ctx, ["http-server"]);
     if (!http || typeof http.getRawApp !== "function") {
-      _optionalChain([ctx, 'access', _166 => _166.logger, 'access', _167 => _167.debug, 'optionalCall', _168 => _168("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
+      _optionalChain([ctx, 'access', _176 => _176.logger, 'access', _177 => _177.debug, 'optionalCall', _178 => _178("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
       return;
     }
     const rawApp = http.getRawApp();
     const messaging = this.getMessaging(ctx);
     if (!rawApp || !messaging) return;
     rawApp.post("/api/v1/webhooks/redeliver", async (c) => {
-      const userId = await this.resolveSessionUserId(ctx, c);
-      if (!userId) {
+      const session = await this.resolveSession(ctx, c);
+      const userId = _optionalChain([session, 'optionalAccess', _179 => _179.user, 'optionalAccess', _180 => _180.id]);
+      if (typeof userId !== "string" || userId.length === 0) {
         return c.json(
           { success: false, error: { code: "UNAUTHENTICATED", message: "Sign in to redeliver webhook deliveries." } },
           401
@@ -1379,7 +1430,7 @@ var WebhookOutboxPlugin = class {
       } catch (e17) {
         return c.json({ success: false, error: { code: "INVALID_REQUEST", message: "Request body must be JSON." } }, 400);
       }
-      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _169 => _169.deliveryId]) === "string" ? body.deliveryId.trim() : "";
+      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _181 => _181.deliveryId]) === "string" ? body.deliveryId.trim() : "";
       if (!deliveryId) {
         return c.json(
           { success: false, error: { code: "MISSING_REQUIRED_FIELD", message: "Body must include `deliveryId: string`." } },
@@ -1387,27 +1438,40 @@ var WebhookOutboxPlugin = class {
         );
       }
       try {
-        const row = await messaging.redeliverHttp(deliveryId);
-        _optionalChain([ctx, 'access', _170 => _170.logger, 'access', _171 => _171.info, 'optionalCall', _172 => _172("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId })]);
+        const activeOrg = _optionalChain([session, 'optionalAccess', _182 => _182.session, 'optionalAccess', _183 => _183.activeOrganizationId]);
+        const tenantId = typeof activeOrg === "string" && activeOrg.length > 0 ? activeOrg : void 0;
+        const row = await messaging.redeliverHttp(deliveryId, { tenantId });
+        _optionalChain([ctx, 'access', _184 => _184.logger, 'access', _185 => _185.info, 'optionalCall', _186 => _186("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId, tenantId })]);
         return c.json({ success: true, data: { id: row.id, status: row.status } });
       } catch (err) {
-        const code = _optionalChain([err, 'optionalAccess', _173 => _173.code]);
+        const code = _optionalChain([err, 'optionalAccess', _187 => _187.code]);
         if (code === "RESOURCE_NOT_FOUND") {
           return c.json({ success: false, error: { code, message: err.message } }, 404);
         }
         if (code === "DELIVERY_NOT_ELIGIBLE" || code === "DELIVERY_NEVER_SENT") {
           return c.json({ success: false, error: { code, message: err.message } }, 409);
         }
-        _optionalChain([ctx, 'access', _174 => _174.logger, 'access', _175 => _175.error, 'optionalCall', _176 => _176("[webhook-outbox] redeliver failed", err)]);
+        _optionalChain([ctx, 'access', _188 => _188.logger, 'access', _189 => _189.error, 'optionalCall', _190 => _190("[webhook-outbox] redeliver failed", err)]);
         return c.json(
-          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _177 => _177.message]), () => ( String(err))) } },
+          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _191 => _191.message]), () => ( String(err))) } },
           500
         );
       }
     });
-    _optionalChain([ctx, 'access', _178 => _178.logger, 'access', _179 => _179.info, 'optionalCall', _180 => _180("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
+    _optionalChain([ctx, 'access', _192 => _192.logger, 'access', _193 => _193.info, 'optionalCall', _194 => _194("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
   }
-  async resolveSessionUserId(ctx, c) {
+  /**
+   * [#10740] The better-auth session envelope (`{ user, session }`) for this
+   * request, or `undefined`.
+   *
+   * Widened from the previous `resolveSessionUserId` because the route now
+   * needs two facts from ONE lookup: who is asking (`user.id`, the
+   * authentication gate) and which organization they are asking as
+   * (`session.activeOrganizationId`, the tenant threaded into the write).
+   * Resolving them separately would mean two `getSession` calls that can
+   * disagree.
+   */
+  async resolveSession(ctx, c) {
     try {
       const authService = this.tryGetService(ctx, ["auth"]);
       if (!authService) return void 0;
@@ -1415,10 +1479,8 @@ var WebhookOutboxPlugin = class {
       if (!api && typeof authService.getApi === "function") {
         api = await authService.getApi();
       }
-      if (!_optionalChain([api, 'optionalAccess', _181 => _181.getSession])) return void 0;
-      const session = await api.getSession({ headers: c.req.raw.headers });
-      const uid2 = _optionalChain([session, 'optionalAccess', _182 => _182.user, 'optionalAccess', _183 => _183.id]);
-      return typeof uid2 === "string" && uid2.length > 0 ? uid2 : void 0;
+      if (!_optionalChain([api, 'optionalAccess', _195 => _195.getSession])) return void 0;
+      return await api.getSession({ headers: c.req.raw.headers });
     } catch (e18) {
       return void 0;
     }