@objectstack/plugin-webhooks 17.1.0 → 17.3.0

package/dist/index.d.cts

@@ -32,7 +32,15 @@ type HttpEnqueueFn = (input: EnqueueHttpInput) => Promise<string>;
  */
 interface OptionalLogger {
     info?(msg: string, meta?: unknown): void;
-    warn?(msg: string, meta?: unknown): void;
+    /**
+     * The GUARANTEED fallback channel (#9754). `error` stays optional — hosts do
+     * inject reduced sinks — so `warn` is where a durability report lands when
+     * `error` is absent, and a fallback that may itself be missing is not a
+     * fallback. Call sites keep the `logger?.warn?.(…)` spelling as the backstop
+     * for hosts the TYPE cannot reach; `SweepLogger` in plugin-email's
+     * `outbox-sweep.ts` carries the full reasoning and the measurement.
+     */
+    warn(msg: string, meta?: unknown): void;
     debug?(msg: string, meta?: unknown): void;
     error?(msg: string, err?: unknown, meta?: unknown): void;
 }
@@ -51,6 +59,21 @@ interface CachedSubscription {
     headers?: Record<string, string>;
     secret?: string;
     timeoutMs?: number;
+    /**
+     * [#13546] The subscription's own organization — `sys_webhook` is
+     * organization-scoped (#8554), so each row carries the tenant that authored
+     * it. Stamped onto every delivery row this subscription produces
+     * (`EnqueueHttpInput.organizationId`), which is what makes the
+     * cross-organization wall on `redeliver()` (#10740) actually exclude other
+     * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+     * the driver's global-row arm, visible to every organization. There is no
+     * request context to read here — the enqueuer runs fire-and-forget off the
+     * write path — so the subscription row is the one honest source. Absent
+     * when the row itself carries no organization (a `single`-posture install):
+     * the delivery then lands NULL, which is honest for a subscription that
+     * belongs to no organization. Threaded, never fabricated (#11303's rule).
+     */
+    organizationId?: string;
     /**
      * [#8069] Set when a credential this subscription needs could not be
      * recovered. The subscription stays CACHED — that is the change — but every
@@ -129,7 +152,22 @@ declare class AutoEnqueuer {
     private readonly subscriptions;
     private readonly subscriptionsObject;
     private readonly refreshIntervalMs;
-    private readonly logger;
+    /**
+     * Optional, and deliberately NOT defaulted to `{}` (#10556).
+     *
+     * `OptionalLogger` guarantees a `warn` channel under #9754, so `{}` stopped being a
+     * legal value of the type — which is the gate working: an empty object is a
+     * sink that declares it can report and then discards everything. The repair
+     * is to say what is TRUE — there may be no logger at all — rather than to
+     * mint a sink that lies. Runtime behaviour is unchanged in both directions:
+     * absent logger and `{}` both printed nothing before, and print nothing now.
+     *
+     * ⛔ What this deliberately does NOT decide: whether an absent host sink should
+     * instead default to a `console`-backed one. That is the open design call the
+     * #9754 ledger records against `plugin-security`'s `= {}` field, and it is a
+     * maintainer decision — not something to settle here to make a checker green.
+     */
+    private readonly logger?;
     private subId;
     private subIdSelfHeal;
     private refreshTimer;
@@ -404,6 +442,28 @@ declare class WebhookOutboxPlugin implements Plugin {
     private boundEngine;
     constructor(options?: WebhookOutboxPluginOptions);
     init(ctx: PluginContext): Promise<void>;
+    /**
+     * Teardown — the kernel's ONLY teardown hook.
+     *
+     * [#10772] This body used to be spelled `dispose()`. `Plugin`
+     * (`@objectstack/core`'s `types.ts`) declares `init()`, `start?(ctx)` and
+     * `destroy?()` and no `dispose()`, and `ObjectKernel.performShutdown()` /
+     * `LiteKernel.destroy()` walk the plugins in reverse calling
+     * `plugin.destroy()` — so after `await kernel.shutdown()` had RESOLVED the
+     * auto-enqueuer was still running and both engine hooks were still bound.
+     * Measured on the same revision: `dispose()` had ZERO callers anywhere in
+     * the repo, so this teardown had never run in any process at all.
+     *
+     * Idempotent: `boundEngine` is cleared as it is unbound, so a second
+     * teardown is a no-op rather than a second unbind.
+     */
+    destroy(): Promise<void>;
+    /**
+     * Retained alias for {@link destroy}. Kept because it is public API of an
+     * exported class: an embedder may have learned to call it directly
+     * precisely BECAUSE the kernel never did, and deleting it would break them.
+     * Same signature, same return type — a direct caller sees no change.
+     */
     dispose(): Promise<void>;
     private getMessaging;
     /**
@@ -436,11 +496,35 @@ declare class WebhookOutboxPlugin implements Plugin {
     private tryGetService;
     /**
      * Mount POST /api/v1/webhooks/redeliver on the host Hono app, if one is
-     * available. Delegates to `messaging.redeliverHttp(deliveryId)`. Auth is the
-     * better-auth session cookie — every authenticated user counts.
+     * available. Delegates to `messaging.redeliverHttp(deliveryId, …)`. Auth is
+     * the better-auth session cookie — every authenticated user counts.
+     *
+     * [#10740] Which is precisely why the caller's ACTIVE ORGANIZATION is
+     * resolved here and threaded into the call. `sys_http_delivery` is
+     * tenant-scoped, and this is the one door on it a request can reach: an
+     * unscoped replay from here is an authenticated user reaching another
+     * organization's delivery row on a walled deployment. With the tenant
+     * threaded, a row outside the caller's organization is simply not found.
+     *
+     * ⚠️ A session with no active organization threads `undefined`, and the
+     * driver's tenant-audit line then fires for that write. That is deliberate:
+     * the deployment could not tell us who is asking, and reporting the gap is
+     * the correct outcome. ⛔ It is never repaired with `bypassTenantAudit`,
+     * which would silence the report without closing anything.
      */
     private registerAdminRoutes;
-    private resolveSessionUserId;
+    /**
+     * [#10740] The better-auth session envelope (`{ user, session }`) for this
+     * request, or `undefined`.
+     *
+     * Widened from the previous `resolveSessionUserId` because the route now
+     * needs two facts from ONE lookup: who is asking (`user.id`, the
+     * authentication gate) and which organization they are asking as
+     * (`session.activeOrganizationId`, the tenant threaded into the write).
+     * Resolving them separately would mean two `getSession` calls that can
+     * disagree.
+     */
+    private resolveSession;
 }
 
 /**

package/dist/index.d.ts

@@ -32,7 +32,15 @@ type HttpEnqueueFn = (input: EnqueueHttpInput) => Promise<string>;
  */
 interface OptionalLogger {
     info?(msg: string, meta?: unknown): void;
-    warn?(msg: string, meta?: unknown): void;
+    /**
+     * The GUARANTEED fallback channel (#9754). `error` stays optional — hosts do
+     * inject reduced sinks — so `warn` is where a durability report lands when
+     * `error` is absent, and a fallback that may itself be missing is not a
+     * fallback. Call sites keep the `logger?.warn?.(…)` spelling as the backstop
+     * for hosts the TYPE cannot reach; `SweepLogger` in plugin-email's
+     * `outbox-sweep.ts` carries the full reasoning and the measurement.
+     */
+    warn(msg: string, meta?: unknown): void;
     debug?(msg: string, meta?: unknown): void;
     error?(msg: string, err?: unknown, meta?: unknown): void;
 }
@@ -51,6 +59,21 @@ interface CachedSubscription {
     headers?: Record<string, string>;
     secret?: string;
     timeoutMs?: number;
+    /**
+     * [#13546] The subscription's own organization — `sys_webhook` is
+     * organization-scoped (#8554), so each row carries the tenant that authored
+     * it. Stamped onto every delivery row this subscription produces
+     * (`EnqueueHttpInput.organizationId`), which is what makes the
+     * cross-organization wall on `redeliver()` (#10740) actually exclude other
+     * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+     * the driver's global-row arm, visible to every organization. There is no
+     * request context to read here — the enqueuer runs fire-and-forget off the
+     * write path — so the subscription row is the one honest source. Absent
+     * when the row itself carries no organization (a `single`-posture install):
+     * the delivery then lands NULL, which is honest for a subscription that
+     * belongs to no organization. Threaded, never fabricated (#11303's rule).
+     */
+    organizationId?: string;
     /**
      * [#8069] Set when a credential this subscription needs could not be
      * recovered. The subscription stays CACHED — that is the change — but every
@@ -129,7 +152,22 @@ declare class AutoEnqueuer {
     private readonly subscriptions;
     private readonly subscriptionsObject;
     private readonly refreshIntervalMs;
-    private readonly logger;
+    /**
+     * Optional, and deliberately NOT defaulted to `{}` (#10556).
+     *
+     * `OptionalLogger` guarantees a `warn` channel under #9754, so `{}` stopped being a
+     * legal value of the type — which is the gate working: an empty object is a
+     * sink that declares it can report and then discards everything. The repair
+     * is to say what is TRUE — there may be no logger at all — rather than to
+     * mint a sink that lies. Runtime behaviour is unchanged in both directions:
+     * absent logger and `{}` both printed nothing before, and print nothing now.
+     *
+     * ⛔ What this deliberately does NOT decide: whether an absent host sink should
+     * instead default to a `console`-backed one. That is the open design call the
+     * #9754 ledger records against `plugin-security`'s `= {}` field, and it is a
+     * maintainer decision — not something to settle here to make a checker green.
+     */
+    private readonly logger?;
     private subId;
     private subIdSelfHeal;
     private refreshTimer;
@@ -404,6 +442,28 @@ declare class WebhookOutboxPlugin implements Plugin {
     private boundEngine;
     constructor(options?: WebhookOutboxPluginOptions);
     init(ctx: PluginContext): Promise<void>;
+    /**
+     * Teardown — the kernel's ONLY teardown hook.
+     *
+     * [#10772] This body used to be spelled `dispose()`. `Plugin`
+     * (`@objectstack/core`'s `types.ts`) declares `init()`, `start?(ctx)` and
+     * `destroy?()` and no `dispose()`, and `ObjectKernel.performShutdown()` /
+     * `LiteKernel.destroy()` walk the plugins in reverse calling
+     * `plugin.destroy()` — so after `await kernel.shutdown()` had RESOLVED the
+     * auto-enqueuer was still running and both engine hooks were still bound.
+     * Measured on the same revision: `dispose()` had ZERO callers anywhere in
+     * the repo, so this teardown had never run in any process at all.
+     *
+     * Idempotent: `boundEngine` is cleared as it is unbound, so a second
+     * teardown is a no-op rather than a second unbind.
+     */
+    destroy(): Promise<void>;
+    /**
+     * Retained alias for {@link destroy}. Kept because it is public API of an
+     * exported class: an embedder may have learned to call it directly
+     * precisely BECAUSE the kernel never did, and deleting it would break them.
+     * Same signature, same return type — a direct caller sees no change.
+     */
     dispose(): Promise<void>;
     private getMessaging;
     /**
@@ -436,11 +496,35 @@ declare class WebhookOutboxPlugin implements Plugin {
     private tryGetService;
     /**
      * Mount POST /api/v1/webhooks/redeliver on the host Hono app, if one is
-     * available. Delegates to `messaging.redeliverHttp(deliveryId)`. Auth is the
-     * better-auth session cookie — every authenticated user counts.
+     * available. Delegates to `messaging.redeliverHttp(deliveryId, …)`. Auth is
+     * the better-auth session cookie — every authenticated user counts.
+     *
+     * [#10740] Which is precisely why the caller's ACTIVE ORGANIZATION is
+     * resolved here and threaded into the call. `sys_http_delivery` is
+     * tenant-scoped, and this is the one door on it a request can reach: an
+     * unscoped replay from here is an authenticated user reaching another
+     * organization's delivery row on a walled deployment. With the tenant
+     * threaded, a row outside the caller's organization is simply not found.
+     *
+     * ⚠️ A session with no active organization threads `undefined`, and the
+     * driver's tenant-audit line then fires for that write. That is deliberate:
+     * the deployment could not tell us who is asking, and reporting the gap is
+     * the correct outcome. ⛔ It is never repaired with `bypassTenantAudit`,
+     * which would silence the report without closing anything.
      */
     private registerAdminRoutes;
-    private resolveSessionUserId;
+    /**
+     * [#10740] The better-auth session envelope (`{ user, session }`) for this
+     * request, or `undefined`.
+     *
+     * Widened from the previous `resolveSessionUserId` because the route now
+     * needs two facts from ONE lookup: who is asking (`user.id`, the
+     * authentication gate) and which organization they are asking as
+     * (`session.activeOrganizationId`, the tenant threaded into the write).
+     * Resolving them separately would mean two `getSession` calls that can
+     * disagree.
+     */
+    private resolveSession;
 }
 
 /**

package/dist/index.js

@@ -194,7 +194,7 @@ var AutoEnqueuer = class {
     this.droppedForSecret = /* @__PURE__ */ new Set();
     this.subscriptionsObject = opts.subscriptionsObject ?? "sys_webhook";
     this.refreshIntervalMs = opts.refreshIntervalMs ?? 6e4;
-    this.logger = opts.logger ?? {};
+    this.logger = opts.logger;
   }
   /**
    * Load the subscription cache and start listening for events.
@@ -219,7 +219,7 @@ var AutoEnqueuer = class {
     if (this.refreshIntervalMs > 0) {
       this.refreshTimer = setInterval(() => {
         this.refresh().catch(
-          (err) => this.logger.warn?.("[webhook-auto-enqueuer] periodic refresh failed", err)
+          (err) => this.logger?.warn?.("[webhook-auto-enqueuer] periodic refresh failed", err)
         );
       }, this.refreshIntervalMs);
       this.refreshTimer.unref?.();
@@ -252,7 +252,7 @@ var AutoEnqueuer = class {
   rearmAfterCryptoRegistered() {
     const inFlight = this.refreshing ?? Promise.resolve();
     void inFlight.catch(() => void 0).then(() => this.running ? this.refresh() : void 0).catch(
-      (err) => this.logger.warn?.(
+      (err) => this.logger?.warn?.(
         "[webhook-auto-enqueuer] re-arm after CryptoProvider registration failed",
         err
       )
@@ -276,7 +276,7 @@ var AutoEnqueuer = class {
         where: { active: true }
       });
     } catch (err) {
-      this.logger.warn?.(
+      this.logger?.warn?.(
         `[webhook-auto-enqueuer] failed to load ${this.subscriptionsObject}`,
         err
       );
@@ -300,7 +300,7 @@ var AutoEnqueuer = class {
         if (!live.has(id)) this.droppedForSecret.delete(id);
       }
     }
-    this.logger.debug?.("[webhook-auto-enqueuer] cache refreshed", {
+    this.logger?.debug?.("[webhook-auto-enqueuer] cache refreshed", {
       objects: this.subscriptions.size,
       rows: rows.length
     });
@@ -371,14 +371,14 @@ var AutoEnqueuer = class {
   reportWriteFailure(sub, eventId, err, verb) {
     const meta = { webhook: sub.name, eventId, err: err?.message ?? err };
     if (!sub.parkedReason) {
-      this.logger.warn?.(`[webhook-auto-enqueuer] ${verb} failed`, meta);
+      this.logger?.warn?.(`[webhook-auto-enqueuer] ${verb} failed`, meta);
       return;
     }
     const message = `[webhook-auto-enqueuer] could not record the undeliverable event for webhook '${sub.name}' \u2014 the subscription is parked for an unresolvable credential, and this event is now DISCARDED WITH NO TRACE in sys_http_delivery, which is the durability gap #8069 closes. Most likely cause: the enqueue callback was wired directly to IHttpOutbox.enqueue instead of MessagingService.enqueueHttp \u2014 only the messaging seam routes a parked event to recordUndeliverable(), and the delivery door refuses it rather than minting a pending row that would be sent UNSIGNED.`;
-    if (typeof this.logger.error === "function") {
-      this.logger.error(message, err, meta);
+    if (typeof this.logger?.error === "function") {
+      this.logger?.error(message, err, meta);
     } else {
-      this.logger.warn?.(message, meta);
+      this.logger?.warn?.(message, meta);
     }
   }
   park(sub, err, credential) {
@@ -430,7 +430,7 @@ var AutoEnqueuer = class {
     }
     const legacy = readLegacySecret(row?.definition_json);
     if (legacy) {
-      this.logger.warn?.(
+      this.logger?.warn?.(
         `[webhook-auto-enqueuer] webhook '${sub.name}' still carries its signing secret as CLEARTEXT in definition_json, readable over the data API (#7799). Signing continues from it; run the boot sweep (migrateLegacyWebhookSecrets) with a CryptoProvider wired to move it into sys_secret.`,
         { id: sub.id }
       );
@@ -480,7 +480,7 @@ var AutoEnqueuer = class {
     }
     const legacy = readLegacyHeaders(row?.definition_json);
     if (legacy) {
-      this.logger.warn?.(
+      this.logger?.warn?.(
         `[webhook-auto-enqueuer] webhook '${sub.name}' still carries its custom headers as CLEARTEXT in definition_json, readable over the data API (#7986) \u2014 that map is the ordinary place an Authorization header goes. Delivery continues from it; run the boot sweep (migrateLegacyWebhookSecrets) with a CryptoProvider wired to move them into sys_secret.`,
         { id: sub.id }
       );
@@ -523,7 +523,7 @@ var AutoEnqueuer = class {
       err: err?.message ?? err
     };
     if (this.droppedForSecret.has(sub.id)) {
-      this.logger.debug?.(
+      this.logger?.debug?.(
         `[webhook-auto-enqueuer] webhook '${sub.name}' is still dropped for an unresolvable ${credential.noun} (${credential.issues})`,
         meta
       );
@@ -531,10 +531,10 @@ var AutoEnqueuer = class {
     }
     this.droppedForSecret.add(sub.id);
     const message = `[webhook-auto-enqueuer] webhook '${sub.name}' holds ${credential.article} that could not be decrypted \u2014 the subscription is PARKED rather than ${credential.ratherThan} (${credential.issue}), so every matching record change is discarded with NO delivery, while the row keeps reading active:true in Setup. Each discarded event IS recorded in sys_http_delivery as a dead row with 0 attempts carrying this cause (#8069) \u2014 look there for the backlog; those rows can never be sent or redelivered, because a parked row has no HMAC signature. Fix: register a CryptoProvider (engine.setCryptoProvider \u2014 LocalCryptoProvider in dev, KMS/Vault in production) with the same key the ${credential.noun} was written under, and make sure the sys_secret row is reachable; the subscription re-arms on registration (#8022) and at the next periodic refresh.`;
-    if (typeof this.logger.error === "function") {
-      this.logger.error(message, err, meta);
+    if (typeof this.logger?.error === "function") {
+      this.logger?.error(message, err, meta);
     } else {
-      this.logger.warn?.(message, meta);
+      this.logger?.warn?.(message, meta);
     }
   }
   parseRow(row) {
@@ -559,7 +559,7 @@ var AutoEnqueuer = class {
     const normalized = triggerList.map((t) => t.trim().toLowerCase()).filter(Boolean);
     const unknown = normalized.filter((t) => !DISPATCHABLE_WEBHOOK_TRIGGERS.has(t));
     if (unknown.length > 0) {
-      this.logger.warn?.(
+      this.logger?.warn?.(
         `[webhook-auto-enqueuer] webhook '${row.name ?? row.id}' declares trigger(s) the engine never emits: ${unknown.join(", ")} \u2014 ignored. Dispatchable triggers: ${[...DISPATCHABLE_WEBHOOK_TRIGGERS].join(", ")}.`,
         { id: row.id, unknown }
       );
@@ -568,7 +568,7 @@ var AutoEnqueuer = class {
       normalized.filter((t) => DISPATCHABLE_WEBHOOK_TRIGGERS.has(t))
     );
     if (triggers.size === 0) {
-      this.logger.warn?.(
+      this.logger?.warn?.(
         `[webhook-auto-enqueuer] webhook '${row.name ?? row.id}' has no dispatchable triggers \u2014 it will NEVER fire (rule webhook/without-triggers): there is no manual fire path (#3196), so this row is dead while looking armed in Setup. Declare one of: ${[...DISPATCHABLE_WEBHOOK_TRIGGERS].join(", ")}, or set it inactive if it should be off.`,
         { id: row.id }
       );
@@ -596,7 +596,11 @@ var AutoEnqueuer = class {
       // `headers` and `secret` are both filled by attachCredentials()
       // from their encrypted columns, NOT read off the row — see #7799
       // (secret) and #7986 (headers).
-      timeoutMs: defn.timeoutMs
+      timeoutMs: defn.timeoutMs,
+      // [#13546] The tenant column the kernel provisions on sys_webhook.
+      // This cache read is a dispatcher-side unscoped find, so the column
+      // comes back for every organization's rows.
+      organizationId: row.organization_id ? String(row.organization_id) : void 0
     };
   }
   /**
@@ -625,7 +629,7 @@ var AutoEnqueuer = class {
     const payload = event.payload ?? {};
     const recordId = payload.recordId;
     if (typeof recordId !== "string" || recordId === "") {
-      this.logger.warn?.(
+      this.logger?.warn?.(
         "[webhook-auto-enqueuer] dropping off-contract data event: payload is not a DataEvent (no top-level string `recordId`) \u2014 fix the producer",
         { type: event.type, object: event.object }
       );
@@ -650,6 +654,12 @@ var AutoEnqueuer = class {
         // subscription, so the delivery path is byte-identical to before.
         undeliverableReason: sub.parkedReason,
         timeoutMs: sub.timeoutMs,
+        // [#13546] The delivery row belongs to the SUBSCRIPTION's
+        // organization — the one honest tenant in scope on this
+        // fire-and-forget path (no request context exists here).
+        // Absent for an org-less subscription; the row then lands
+        // NULL, the global-row shape.
+        organizationId: sub.organizationId,
         // [#3946] Envelope keys are written LAST so the event payload
         // cannot rewrite them. Behaviour-neutral for the engine's own
         // publishers — since #4626 a `data.record.*` payload is a
@@ -694,7 +704,7 @@ var AutoEnqueuer = class {
     const payload = event.payload ?? {};
     const matched = payload.matched;
     if (typeof matched !== "number" || !Number.isInteger(matched) || matched < 0) {
-      this.logger.warn?.(
+      this.logger?.warn?.(
         "[webhook-auto-enqueuer] dropping off-contract bulk data event: payload is not a BulkDataEvent (no top-level non-negative integer `matched`) \u2014 fix the producer",
         { type: event.type, object: event.object }
       );
@@ -702,7 +712,7 @@ var AutoEnqueuer = class {
     }
     const eventUuid = payload.id;
     if (typeof eventUuid !== "string" || eventUuid === "") {
-      this.logger.warn?.(
+      this.logger?.warn?.(
         "[webhook-auto-enqueuer] dropping off-contract bulk data event: payload has no top-level string `id` to dedup on \u2014 fix the producer",
         { type: event.type, object: event.object }
       );
@@ -724,6 +734,9 @@ var AutoEnqueuer = class {
         // an undeliverable row instead of enqueuing a delivery.
         undeliverableReason: sub.parkedReason,
         timeoutMs: sub.timeoutMs,
+        // [#13546] See the per-record path — the subscription's own
+        // organization, absent for an org-less subscription.
+        organizationId: sub.organizationId,
         // [#3946] Envelope keys last so the payload cannot rewrite them.
         payload: {
           ...payload,
@@ -739,7 +752,7 @@ var AutoEnqueuer = class {
     if (event.object !== this.subscriptionsObject) return;
     if (!event.type?.startsWith("data.record.") && !event.type?.startsWith("data.records.")) return;
     this.refresh().catch(
-      (err) => this.logger.warn?.("[webhook-auto-enqueuer] self-heal refresh failed", err)
+      (err) => this.logger?.warn?.("[webhook-auto-enqueuer] self-heal refresh failed", err)
     );
   }
   /** Test / admin accessor. */
@@ -1207,7 +1220,7 @@ var WebhookOutboxPlugin = class {
         try {
           const i18n = ctx.getService("i18n");
           if (i18n && typeof i18n.loadTranslations === "function") {
-            const { WebhooksTranslations } = await import("./translations-IAKF6NAP.js");
+            const { WebhooksTranslations } = await import("./translations-CPXQB2NM.js");
             for (const [locale, data] of Object.entries(WebhooksTranslations)) {
               i18n.loadTranslations(locale, data);
             }
@@ -1228,7 +1241,22 @@ var WebhookOutboxPlugin = class {
       autoEnqueue: autoEnqueueOpt !== false
     });
   }
-  async dispose() {
+  /**
+   * Teardown — the kernel's ONLY teardown hook.
+   *
+   * [#10772] This body used to be spelled `dispose()`. `Plugin`
+   * (`@objectstack/core`'s `types.ts`) declares `init()`, `start?(ctx)` and
+   * `destroy?()` and no `dispose()`, and `ObjectKernel.performShutdown()` /
+   * `LiteKernel.destroy()` walk the plugins in reverse calling
+   * `plugin.destroy()` — so after `await kernel.shutdown()` had RESOLVED the
+   * auto-enqueuer was still running and both engine hooks were still bound.
+   * Measured on the same revision: `dispose()` had ZERO callers anywhere in
+   * the repo, so this teardown had never run in any process at all.
+   *
+   * Idempotent: `boundEngine` is cleared as it is unbound, so a second
+   * teardown is a no-op rather than a second unbind.
+   */
+  async destroy() {
     await this.autoEnqueuer?.stop();
     if (this.boundEngine) {
       try {
@@ -1242,6 +1270,15 @@ var WebhookOutboxPlugin = class {
       this.boundEngine = void 0;
     }
   }
+  /**
+   * Retained alias for {@link destroy}. Kept because it is public API of an
+   * exported class: an embedder may have learned to call it directly
+   * precisely BECAUSE the kernel never did, and deleting it would break them.
+   * Same signature, same return type — a direct caller sees no change.
+   */
+  async dispose() {
+    await this.destroy();
+  }
   getMessaging(ctx) {
     const svc = this.tryGetService(ctx, ["messaging"]);
     return svc && typeof svc.enqueueHttp === "function" ? svc : void 0;
@@ -1353,8 +1390,21 @@ var WebhookOutboxPlugin = class {
   }
   /**
    * Mount POST /api/v1/webhooks/redeliver on the host Hono app, if one is
-   * available. Delegates to `messaging.redeliverHttp(deliveryId)`. Auth is the
-   * better-auth session cookie — every authenticated user counts.
+   * available. Delegates to `messaging.redeliverHttp(deliveryId, …)`. Auth is
+   * the better-auth session cookie — every authenticated user counts.
+   *
+   * [#10740] Which is precisely why the caller's ACTIVE ORGANIZATION is
+   * resolved here and threaded into the call. `sys_http_delivery` is
+   * tenant-scoped, and this is the one door on it a request can reach: an
+   * unscoped replay from here is an authenticated user reaching another
+   * organization's delivery row on a walled deployment. With the tenant
+   * threaded, a row outside the caller's organization is simply not found.
+   *
+   * ⚠️ A session with no active organization threads `undefined`, and the
+   * driver's tenant-audit line then fires for that write. That is deliberate:
+   * the deployment could not tell us who is asking, and reporting the gap is
+   * the correct outcome. ⛔ It is never repaired with `bypassTenantAudit`,
+   * which would silence the report without closing anything.
    */
   registerAdminRoutes(ctx) {
     const http = this.tryGetService(ctx, ["http-server"]);
@@ -1366,8 +1416,9 @@ var WebhookOutboxPlugin = class {
     const messaging = this.getMessaging(ctx);
     if (!rawApp || !messaging) return;
     rawApp.post("/api/v1/webhooks/redeliver", async (c) => {
-      const userId = await this.resolveSessionUserId(ctx, c);
-      if (!userId) {
+      const session = await this.resolveSession(ctx, c);
+      const userId = session?.user?.id;
+      if (typeof userId !== "string" || userId.length === 0) {
         return c.json(
           { success: false, error: { code: "UNAUTHENTICATED", message: "Sign in to redeliver webhook deliveries." } },
           401
@@ -1387,8 +1438,10 @@ var WebhookOutboxPlugin = class {
         );
       }
       try {
-        const row = await messaging.redeliverHttp(deliveryId);
-        ctx.logger.info?.("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId });
+        const activeOrg = session?.session?.activeOrganizationId;
+        const tenantId = typeof activeOrg === "string" && activeOrg.length > 0 ? activeOrg : void 0;
+        const row = await messaging.redeliverHttp(deliveryId, { tenantId });
+        ctx.logger.info?.("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId, tenantId });
         return c.json({ success: true, data: { id: row.id, status: row.status } });
       } catch (err) {
         const code = err?.code;
@@ -1407,7 +1460,18 @@ var WebhookOutboxPlugin = class {
     });
     ctx.logger.info?.("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver");
   }
-  async resolveSessionUserId(ctx, c) {
+  /**
+   * [#10740] The better-auth session envelope (`{ user, session }`) for this
+   * request, or `undefined`.
+   *
+   * Widened from the previous `resolveSessionUserId` because the route now
+   * needs two facts from ONE lookup: who is asking (`user.id`, the
+   * authentication gate) and which organization they are asking as
+   * (`session.activeOrganizationId`, the tenant threaded into the write).
+   * Resolving them separately would mean two `getSession` calls that can
+   * disagree.
+   */
+  async resolveSession(ctx, c) {
     try {
       const authService = this.tryGetService(ctx, ["auth"]);
       if (!authService) return void 0;
@@ -1416,9 +1480,7 @@ var WebhookOutboxPlugin = class {
         api = await authService.getApi();
       }
       if (!api?.getSession) return void 0;
-      const session = await api.getSession({ headers: c.req.raw.headers });
-      const uid2 = session?.user?.id;
-      return typeof uid2 === "string" && uid2.length > 0 ? uid2 : void 0;
+      return await api.getSession({ headers: c.req.raw.headers });
     } catch {
       return void 0;
     }