@objectstack/plugin-webhooks 17.2.0 → 17.4.0

package/dist/index.cjs

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkDRHJ2M45cjs = require('./chunk-DRHJ2M45.cjs');
+var _chunkCWE6CIEZcjs = require('./chunk-CWE6CIEZ.cjs');
 
 // src/webhook-secret.ts
 var WEBHOOK_SECRET_FIELD = "signing_secret";
@@ -192,6 +192,17 @@ var AutoEnqueuer = class {
      * refresh, forever.
      */
     this.droppedForSecret = /* @__PURE__ */ new Set();
+    /**
+     * [#13566] Webhook ids whose FIRST organization-dimension refusal has been
+     * said out loud (see {@link admitsOrganization}). Same say-once shape as
+     * {@link droppedForSecret}, for the same reason: a subscription that
+     * cannot receive a class of events must be reported once, with the
+     * remedy, and not once per event forever — an org-less `'*'` subscription
+     * on a walled deployment would otherwise warn on every write of every
+     * organization. Pruned on refresh to the rows still live, so a row that
+     * is deleted and re-created reports again.
+     */
+    this.organizationRefusalReported = /* @__PURE__ */ new Set();
     this.subscriptionsObject = _nullishCoalesce(opts.subscriptionsObject, () => ( "sys_webhook"));
     this.refreshIntervalMs = _nullishCoalesce(opts.refreshIntervalMs, () => ( 6e4));
     this.logger = opts.logger;
@@ -294,11 +305,14 @@ var AutoEnqueuer = class {
     }
     this.subscriptions.clear();
     for (const [k, v] of next) this.subscriptions.set(k, v);
-    if (this.droppedForSecret.size > 0) {
+    if (this.droppedForSecret.size > 0 || this.organizationRefusalReported.size > 0) {
       const live = new Set(rows.map((r) => String(_optionalChain([r, 'optionalAccess', _21 => _21.id]))));
       for (const id of this.droppedForSecret) {
         if (!live.has(id)) this.droppedForSecret.delete(id);
       }
+      for (const id of this.organizationRefusalReported) {
+        if (!live.has(id)) this.organizationRefusalReported.delete(id);
+      }
     }
     _optionalChain([this, 'access', _22 => _22.logger, 'optionalAccess', _23 => _23.debug, 'optionalCall', _24 => _24("[webhook-auto-enqueuer] cache refreshed", {
       objects: this.subscriptions.size,
@@ -596,7 +610,11 @@ var AutoEnqueuer = class {
       // `headers` and `secret` are both filled by attachCredentials()
       // from their encrypted columns, NOT read off the row — see #7799
       // (secret) and #7986 (headers).
-      timeoutMs: defn.timeoutMs
+      timeoutMs: defn.timeoutMs,
+      // [#13546] The tenant column the kernel provisions on sys_webhook.
+      // This cache read is a dispatcher-side unscoped find, so the column
+      // comes back for every organization's rows.
+      organizationId: row.organization_id ? String(row.organization_id) : void 0
     };
   }
   /**
@@ -631,9 +649,18 @@ var AutoEnqueuer = class {
       )]);
       return;
     }
+    const organization = readEventOrganizationId(payload);
+    if (!organization) {
+      _optionalChain([this, 'access', _75 => _75.logger, 'optionalAccess', _76 => _76.warn, 'optionalCall', _77 => _77(
+        '[webhook-auto-enqueuer] dropping off-contract data event: `organizationId` is present but not a non-empty string (DataEventSchema refuses that at the publish site) \u2014 fix the producer; never coerced and never read as "no organization"',
+        { type: event.type, object: event.object }
+      )]);
+      return;
+    }
     const eventId = `${event.object}:${recordId}:${action}:${event.timestamp}`;
     for (const sub of subs) {
       if (!sub.triggers.has(trigger)) continue;
+      if (!this.admitsOrganization(sub, organization.organizationId, event)) continue;
       void this.enqueue({
         source: "webhook",
         refId: sub.id,
@@ -650,6 +677,12 @@ var AutoEnqueuer = class {
         // subscription, so the delivery path is byte-identical to before.
         undeliverableReason: sub.parkedReason,
         timeoutMs: sub.timeoutMs,
+        // [#13546] The delivery row belongs to the SUBSCRIPTION's
+        // organization — the one honest tenant in scope on this
+        // fire-and-forget path (no request context exists here).
+        // Absent for an org-less subscription; the row then lands
+        // NULL, the global-row shape.
+        organizationId: sub.organizationId,
         // [#3946] Envelope keys are written LAST so the event payload
         // cannot rewrite them. Behaviour-neutral for the engine's own
         // publishers — since #4626 a `data.record.*` payload is a
@@ -694,7 +727,7 @@ var AutoEnqueuer = class {
     const payload = _nullishCoalesce(event.payload, () => ( {}));
     const matched = payload.matched;
     if (typeof matched !== "number" || !Number.isInteger(matched) || matched < 0) {
-      _optionalChain([this, 'access', _75 => _75.logger, 'optionalAccess', _76 => _76.warn, 'optionalCall', _77 => _77(
+      _optionalChain([this, 'access', _78 => _78.logger, 'optionalAccess', _79 => _79.warn, 'optionalCall', _80 => _80(
         "[webhook-auto-enqueuer] dropping off-contract bulk data event: payload is not a BulkDataEvent (no top-level non-negative integer `matched`) \u2014 fix the producer",
         { type: event.type, object: event.object }
       )]);
@@ -702,15 +735,24 @@ var AutoEnqueuer = class {
     }
     const eventUuid = payload.id;
     if (typeof eventUuid !== "string" || eventUuid === "") {
-      _optionalChain([this, 'access', _78 => _78.logger, 'optionalAccess', _79 => _79.warn, 'optionalCall', _80 => _80(
+      _optionalChain([this, 'access', _81 => _81.logger, 'optionalAccess', _82 => _82.warn, 'optionalCall', _83 => _83(
         "[webhook-auto-enqueuer] dropping off-contract bulk data event: payload has no top-level string `id` to dedup on \u2014 fix the producer",
         { type: event.type, object: event.object }
       )]);
       return;
     }
     const eventId = `${event.object}:${event.type}:${eventUuid}`;
+    const organization = readEventOrganizationId(payload);
+    if (!organization) {
+      _optionalChain([this, 'access', _84 => _84.logger, 'optionalAccess', _85 => _85.warn, 'optionalCall', _86 => _86(
+        '[webhook-auto-enqueuer] dropping off-contract bulk data event: `organizationId` is present but not a non-empty string (BulkDataEventSchema refuses that at the publish site) \u2014 fix the producer; never coerced and never read as "not asserted"',
+        { type: event.type, object: event.object }
+      )]);
+      return;
+    }
     for (const sub of subs) {
       if (!sub.triggers.has(trigger)) continue;
+      if (!this.admitsOrganization(sub, organization.organizationId, event)) continue;
       void this.enqueue({
         source: "webhook",
         refId: sub.id,
@@ -724,6 +766,9 @@ var AutoEnqueuer = class {
         // an undeliverable row instead of enqueuing a delivery.
         undeliverableReason: sub.parkedReason,
         timeoutMs: sub.timeoutMs,
+        // [#13546] See the per-record path — the subscription's own
+        // organization, absent for an org-less subscription.
+        organizationId: sub.organizationId,
         // [#3946] Envelope keys last so the payload cannot rewrite them.
         payload: {
           ...payload,
@@ -735,11 +780,96 @@ var AutoEnqueuer = class {
       }).catch((err) => this.reportWriteFailure(sub, eventId, err, "bulk enqueue"));
     }
   }
+  /**
+   * [#13566] The organization dimension of the match — ONE comparison
+   * between the subscription's own organization (cached off its
+   * `sys_webhook` row, #13546) and the organization the producer stamped on
+   * the event (#14970 per record; #15225 / #15813 per batch). ⛔ No lookup:
+   * the enqueuer exists to keep this path O(1), and both halves are already
+   * in hand — the filter is a comparison, never a resolution.
+   *
+   * The cells, and why each falls where it does:
+   *
+   *  | subscription | event  | verdict                                        |
+   *  |--------------|--------|------------------------------------------------|
+   *  | org A        | org A  | deliver                                        |
+   *  | org A        | org B  | not a match — the routine outcome of the new   |
+   *  |              |        | term, silent like an object-name mismatch      |
+   *  | org A        | absent | REFUSE (fail-closed), said once per sub        |
+   *  | none         | org A  | REFUSE, said once per sub — the ruling's case  |
+   *  | none         | absent | deliver — no wall on either side               |
+   *
+   * **`none` × `org A` — the ruling.** A `sys_webhook` row with no
+   * organization on a walled deployment (a package-declared row bootstrapped
+   * under `isSystem`, a row authored before the column was provisioned)
+   * would otherwise receive EVERY organization's records at its URL, signed
+   * with its secret — the leak this card is. Maintainer's ruling
+   * (2026-09-07), verbatim: *a subscription with no organisation ownership
+   * does not fan out — loud refusal, never a silent cross-organisation
+   * delivery.* ADR-0131 D1 is why there is no third reading — NULL is not a
+   * state, so "no organization" is never "every organization".
+   *
+   * **`org A` × `absent` — fail-closed, on BOTH paths.** The two event
+   * families spell absence with the same key and mean different things by
+   * it (`packages/spec/src/api/events.zod.ts`, both members' docs). On a
+   * `DataEvent` it is "this record belongs to no organization" — an
+   * environment-wide row, an object outside the wall, or (the per-record
+   * producer's own docblock, `eventOrganizationId` in
+   * `packages/objectql/src/engine.ts`) no row in hand at the publish site,
+   * published absent rather than substituting the caller's organization.
+   * On a `BulkDataEvent` it is "the producer did not assert one
+   * organization for this batch" — a system or cross-membership predicate
+   * write — and the contract says outright that a tenant-scoped consumer
+   * must not deliver it inside an organization wall. Neither reading names
+   * organization A, so a subscription that belongs to A delivers on
+   * neither. ⛔ Absent is never "no tenancy concern": delivering on it
+   * would turn each of those cases into a cross-organization delivery. The
+   * cost is an environment-wide record not reaching an organization's
+   * webhook — accepted, and said once so the subscription is not dead while
+   * looking armed.
+   *
+   * **`none` × `absent` — deliver.** A `single`-posture deployment stamps
+   * nothing on either side (`postureStampsOrganization` is false there), so
+   * this cell is every event on every non-walled install; on a walled one
+   * it is an environment-wide subscription taking an environment-wide
+   * event. No organization is named anywhere, so there is no wall to cross.
+   *
+   * Both refusals are said ONCE per subscription (the #8022 say-once rule,
+   * ledger {@link organizationRefusalReported}): the first refused event is
+   * a `warn` naming the consequence and the remedy, later ones are
+   * debug-level. Without that a refused subscription reads active:true in
+   * Setup with nothing ever arriving — the "dead while looking armed" shape
+   * ADR-0078 refuses.
+   */
+  admitsOrganization(sub, eventOrganizationId, event) {
+    if (sub.organizationId === eventOrganizationId) return true;
+    if (sub.organizationId !== void 0 && eventOrganizationId !== void 0) return false;
+    const orgless = sub.organizationId === void 0;
+    const meta = {
+      id: sub.id,
+      webhook: sub.name,
+      type: event.type,
+      object: event.object,
+      subscriptionOrganizationId: sub.organizationId,
+      eventNamesOrganization: eventOrganizationId !== void 0
+    };
+    if (this.organizationRefusalReported.has(sub.id)) {
+      _optionalChain([this, 'access', _87 => _87.logger, 'optionalAccess', _88 => _88.debug, 'optionalCall', _89 => _89(
+        `[webhook-auto-enqueuer] webhook '${sub.name}' still refused on the organization dimension`,
+        meta
+      )]);
+      return false;
+    }
+    this.organizationRefusalReported.add(sub.id);
+    const message = orgless ? `[webhook-auto-enqueuer] webhook '${sub.name}' belongs to NO organization, but this ${event.type} event on '${event.object}' is organization-walled (the producer stamped organizationId) \u2014 refusing to fan out: a subscription with no organization ownership does not receive an organization's records. It will receive NO organization-walled event while reading active:true in Setup; author the webhook inside the organization that should receive these events. Said once per subscription.` : `[webhook-auto-enqueuer] webhook '${sub.name}' belongs to organization '${sub.organizationId}', but this ${event.type} event on '${event.object}' names no organization \u2014 refusing to deliver it inside an organization wall: on the per-record path an absent organizationId is an environment-wide row or an object outside the wall; on the bulk path it is a batch the producer could not attribute to one organization (a system or cross-membership predicate write). A tenant-scoped subscription receives only events attributable to its own organization. Said once per subscription.`;
+    _optionalChain([this, 'access', _90 => _90.logger, 'optionalAccess', _91 => _91.warn, 'optionalCall', _92 => _92(message, meta)]);
+    return false;
+  }
   handleSelfHealEvent(event) {
     if (event.object !== this.subscriptionsObject) return;
-    if (!_optionalChain([event, 'access', _81 => _81.type, 'optionalAccess', _82 => _82.startsWith, 'call', _83 => _83("data.record.")]) && !_optionalChain([event, 'access', _84 => _84.type, 'optionalAccess', _85 => _85.startsWith, 'call', _86 => _86("data.records.")])) return;
+    if (!_optionalChain([event, 'access', _93 => _93.type, 'optionalAccess', _94 => _94.startsWith, 'call', _95 => _95("data.record.")]) && !_optionalChain([event, 'access', _96 => _96.type, 'optionalAccess', _97 => _97.startsWith, 'call', _98 => _98("data.records.")])) return;
     this.refresh().catch(
-      (err) => _optionalChain([this, 'access', _87 => _87.logger, 'optionalAccess', _88 => _88.warn, 'optionalCall', _89 => _89("[webhook-auto-enqueuer] self-heal refresh failed", err)])
+      (err) => _optionalChain([this, 'access', _99 => _99.logger, 'optionalAccess', _100 => _100.warn, 'optionalCall', _101 => _101("[webhook-auto-enqueuer] self-heal refresh failed", err)])
     );
   }
   /** Test / admin accessor. */
@@ -759,6 +889,12 @@ function mapActionToTrigger(action) {
       return null;
   }
 }
+function readEventOrganizationId(payload) {
+  const value = payload.organizationId;
+  if (value === void 0) return { organizationId: void 0 };
+  if (typeof value !== "string" || value === "") return void 0;
+  return { organizationId: value };
+}
 function mapBulkActionToTrigger(action) {
   switch (action) {
     case "updated":
@@ -782,21 +918,21 @@ var _automation = require('@objectstack/spec/automation');
 var SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] };
 function uid(prefix) {
   const g = globalThis;
-  if (_optionalChain([g, 'access', _90 => _90.crypto, 'optionalAccess', _91 => _91.randomUUID])) return `${prefix}_${g.crypto.randomUUID()}`;
+  if (_optionalChain([g, 'access', _102 => _102.crypto, 'optionalAccess', _103 => _103.randomUUID])) return `${prefix}_${g.crypto.randomUUID()}`;
   return `${prefix}_${Math.random().toString(36).slice(2, 10)}`;
 }
 function readDeclared(engine, metadataService, type) {
   try {
-    const reg = _optionalChain([engine, 'optionalAccess', _92 => _92._registry]);
-    if (_optionalChain([reg, 'optionalAccess', _93 => _93.listItems])) {
+    const reg = _optionalChain([engine, 'optionalAccess', _104 => _104._registry]);
+    if (_optionalChain([reg, 'optionalAccess', _105 => _105.listItems])) {
       const items = (_nullishCoalesce(reg.listItems(type), () => ( []))).filter(Boolean);
       if (items.length > 0) return items;
     }
   } catch (e7) {
   }
   try {
-    const listed = _optionalChain([metadataService, 'optionalAccess', _94 => _94.list, 'optionalCall', _95 => _95(type)]);
-    const arr = typeof _optionalChain([listed, 'optionalAccess', _96 => _96.then]) === "function" ? [] : _nullishCoalesce(listed, () => ( []));
+    const listed = _optionalChain([metadataService, 'optionalAccess', _106 => _106.list, 'optionalCall', _107 => _107(type)]);
+    const arr = typeof _optionalChain([listed, 'optionalAccess', _108 => _108.then]) === "function" ? [] : _nullishCoalesce(listed, () => ( []));
     return Array.isArray(arr) ? arr.filter(Boolean) : [];
   } catch (e8) {
     return [];
@@ -813,9 +949,9 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
     try {
       wh = _automation.WebhookSchema.parse(raw);
     } catch (err) {
-      _optionalChain([logger, 'optionalAccess', _97 => _97.warn, 'optionalCall', _98 => _98("[webhook] declared webhook failed validation \u2014 skipped", {
-        name: _optionalChain([raw, 'optionalAccess', _99 => _99.name]),
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _100 => _100.message]), () => ( String(err)))
+      _optionalChain([logger, 'optionalAccess', _109 => _109.warn, 'optionalCall', _110 => _110("[webhook] declared webhook failed validation \u2014 skipped", {
+        name: _optionalChain([raw, 'optionalAccess', _111 => _111.name]),
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _112 => _112.message]), () => ( String(err)))
       })]);
       skipped += 1;
       continue;
@@ -829,7 +965,7 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
       const row = Array.isArray(existing) ? existing[0] : void 0;
       if (row) {
         if (row.managed_by === "admin") {
-          _optionalChain([logger, 'optionalAccess', _101 => _101.warn, 'optionalCall', _102 => _102("[webhook] declared name collides with an admin-authored row \u2014 seed skipped", {
+          _optionalChain([logger, 'optionalAccess', _113 => _113.warn, 'optionalCall', _114 => _114("[webhook] declared name collides with an admin-authored row \u2014 seed skipped", {
             name: wh.name
           })]);
           skipped += 1;
@@ -881,18 +1017,18 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
       seeded += 1;
     } catch (err) {
       const protection = isSecretProtectionFailure(err);
-      _optionalChain([logger, 'optionalAccess', _103 => _103.warn, 'optionalCall', _104 => _104(
+      _optionalChain([logger, 'optionalAccess', _115 => _115.warn, 'optionalCall', _116 => _116(
         protection ? "[webhook] declared webhook NOT seeded \u2014 its signing secret cannot be stored encrypted (#7799)" : "[webhook] declared webhook seed failed",
         {
           name: wh.name,
           ...protection ? { code: WEBHOOK_SECRET_REFUSAL_CODE, status: WEBHOOK_SECRET_REFUSAL_STATUS } : {},
-          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _105 => _105.message]), () => ( String(err)))
+          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _117 => _117.message]), () => ( String(err)))
         }
       )]);
       skipped += 1;
     }
   }
-  _optionalChain([logger, 'optionalAccess', _106 => _106.info, 'optionalCall', _107 => _107("[webhook] declared webhooks materialized into sys_webhook", {
+  _optionalChain([logger, 'optionalAccess', _118 => _118.info, 'optionalCall', _119 => _119("[webhook] declared webhooks materialized into sys_webhook", {
     seeded,
     skipped,
     total: declared.length
@@ -901,7 +1037,7 @@ async function bootstrapDeclaredWebhooks(engine, metadataService, logger, subscr
 }
 async function secretPatch(engine, wh, row, subscriptionsObject) {
   const { secret } = splitWebhookSecret(wh);
-  const hasStored = _optionalChain([row, 'optionalAccess', _108 => _108[WEBHOOK_SECRET_FIELD]]) != null && row[WEBHOOK_SECRET_FIELD] !== "";
+  const hasStored = _optionalChain([row, 'optionalAccess', _120 => _120[WEBHOOK_SECRET_FIELD]]) != null && row[WEBHOOK_SECRET_FIELD] !== "";
   if (!secret) return hasStored ? { [WEBHOOK_SECRET_FIELD]: null } : {};
   if (!hasStored || !canResolveSecrets(engine)) return { [WEBHOOK_SECRET_FIELD]: secret };
   try {
@@ -943,16 +1079,16 @@ async function migrateLegacyWebhookSecrets(engine, logger, subscriptionsObject =
   let rows;
   try {
     const found = await engine.find(subscriptionsObject, SYSTEM_QUERY);
-    rows = Array.isArray(found) ? found : _nullishCoalesce(_optionalChain([found, 'optionalAccess', _109 => _109.data]), () => ( []));
+    rows = Array.isArray(found) ? found : _nullishCoalesce(_optionalChain([found, 'optionalAccess', _121 => _121.data]), () => ( []));
   } catch (err) {
-    _optionalChain([logger, 'optionalAccess', _110 => _110.warn, 'optionalCall', _111 => _111("[webhook] legacy secret sweep skipped \u2014 could not read subscriptions", {
+    _optionalChain([logger, 'optionalAccess', _122 => _122.warn, 'optionalCall', _123 => _123("[webhook] legacy secret sweep skipped \u2014 could not read subscriptions", {
       object: subscriptionsObject,
-      error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _112 => _112.message]), () => ( String(err)))
+      error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _124 => _124.message]), () => ( String(err)))
     })]);
     return out;
   }
   for (const row of rows) {
-    if (!_optionalChain([row, 'optionalAccess', _113 => _113.id])) continue;
+    if (!_optionalChain([row, 'optionalAccess', _125 => _125.id])) continue;
     const legacySecret = readLegacySecret(row.definition_json);
     const legacyHeaders = readLegacyHeaders(row.definition_json);
     if (!legacySecret && !legacyHeaders) continue;
@@ -973,20 +1109,20 @@ async function migrateLegacyWebhookSecrets(engine, logger, subscriptionsObject =
       out.failed += 1;
       const protection = isSecretProtectionFailure(err);
       const what = legacySecret && legacyHeaders ? "signing secret and custom headers" : legacySecret ? "signing secret" : "custom headers";
-      _optionalChain([logger, 'optionalAccess', _114 => _114.warn, 'optionalCall', _115 => _115(
+      _optionalChain([logger, 'optionalAccess', _126 => _126.warn, 'optionalCall', _127 => _127(
         protection ? `[webhook] ${what} STILL CLEARTEXT in definition_json \u2014 no CryptoProvider to encrypt them (#7799/#7986)` : `[webhook] ${what} migration failed \u2014 row left unchanged (#7799/#7986)`,
         {
           name: _nullishCoalesce(row.name, () => ( row.id)),
           id: row.id,
           code: WEBHOOK_SECRET_REFUSAL_CODE,
           status: WEBHOOK_SECRET_REFUSAL_STATUS,
-          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _116 => _116.message]), () => ( String(err)))
+          error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _128 => _128.message]), () => ( String(err)))
         }
       )]);
     }
   }
   if (out.found > 0) {
-    _optionalChain([logger, 'optionalAccess', _117 => _117.info, 'optionalCall', _118 => _118("[webhook] legacy cleartext credentials swept into sys_secret", { ...out })]);
+    _optionalChain([logger, 'optionalAccess', _129 => _129.info, 'optionalCall', _130 => _130("[webhook] legacy cleartext credentials swept into sys_secret", { ...out })]);
   }
   return out;
 }
@@ -1022,42 +1158,26 @@ function createWebhookRedeliverGuard(engine, subscriptionsObject = WEBHOOK_OBJEC
 
 // src/webhook-provenance.ts
 var WEBHOOK_PROVENANCE_PACKAGE = "plugin-webhooks:provenance";
-var SYSTEM_CTX3 = { isSystem: true, positions: [], permissions: [] };
 function bindWebhookProvenanceStamp(engine, logger) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _119 => _119.registerHook]) !== "function") return;
+  if (typeof _optionalChain([engine, 'optionalAccess', _131 => _131.registerHook]) !== "function") return;
   engine.registerHook(
     "beforeUpdate",
     async (ctx) => {
-      if (_optionalChain([ctx, 'optionalAccess', _120 => _120.session, 'optionalAccess', _121 => _121.isSystem])) return;
-      const id = _nullishCoalesce(_optionalChain([ctx, 'optionalAccess', _122 => _122.input, 'optionalAccess', _123 => _123.id]), () => ( _optionalChain([ctx, 'optionalAccess', _124 => _124.input, 'optionalAccess', _125 => _125.data, 'optionalAccess', _126 => _126.id])));
-      if (!id) return;
-      const data = _optionalChain([ctx, 'optionalAccess', _127 => _127.input, 'optionalAccess', _128 => _128.data]);
+      if (_optionalChain([ctx, 'optionalAccess', _132 => _132.session, 'optionalAccess', _133 => _133.isSystem])) return;
+      const data = _optionalChain([ctx, 'optionalAccess', _134 => _134.input, 'optionalAccess', _135 => _135.data]);
       if (!data || typeof data !== "object") return;
-      try {
-        const rows = await engine.find("sys_webhook", {
-          where: { id },
-          fields: ["id", "managed_by", "customized"],
-          limit: 1,
-          context: SYSTEM_CTX3
-        });
-        const row = Array.isArray(rows) ? rows[0] : void 0;
-        if (!row) return;
-        if ((row.managed_by === "package" || row.managed_by === "platform") && row.customized !== true) {
-          data.customized = true;
-        }
-      } catch (err) {
-        _optionalChain([logger, 'optionalAccess', _129 => _129.warn, 'optionalCall', _130 => _130("[webhook] provenance stamp failed (edit proceeds unstamped)", {
-          id,
-          error: _optionalChain([err, 'optionalAccess', _131 => _131.message])
-        })]);
+      const previous = _optionalChain([ctx, 'optionalAccess', _136 => _136.previous]);
+      if (!previous || typeof previous !== "object") return;
+      if ((previous.managed_by === "package" || previous.managed_by === "platform") && previous.customized !== true) {
+        data.customized = true;
       }
     },
     { object: "sys_webhook", packageId: WEBHOOK_PROVENANCE_PACKAGE, priority: 150 }
   );
-  _optionalChain([logger, 'optionalAccess', _132 => _132.info, 'optionalCall', _133 => _133("[webhook] provenance stamp hook bound")]);
+  _optionalChain([logger, 'optionalAccess', _137 => _137.info, 'optionalCall', _138 => _138("[webhook] provenance stamp hook bound")]);
 }
 function unbindWebhookProvenanceStamp(engine) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _134 => _134.unregisterHooksByPackage]) === "function") {
+  if (typeof _optionalChain([engine, 'optionalAccess', _139 => _139.unregisterHooksByPackage]) === "function") {
     engine.unregisterHooksByPackage(WEBHOOK_PROVENANCE_PACKAGE);
   }
 }
@@ -1135,9 +1255,9 @@ function assertWritableWebhookHeaders(data, object = WEBHOOK_OBJECT, field = WEB
 var WEBHOOK_HEADERS_GATE_PACKAGE = "plugin-webhooks:headers-shape-gate";
 var GATE_PRIORITY = 50;
 function bindWebhookHeadersShapeGate(engine, logger) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _135 => _135.registerHook]) !== "function") return;
+  if (typeof _optionalChain([engine, 'optionalAccess', _140 => _140.registerHook]) !== "function") return;
   const handler = (ctx) => {
-    assertWritableWebhookHeaders(_optionalChain([ctx, 'optionalAccess', _136 => _136.input, 'optionalAccess', _137 => _137.data]));
+    assertWritableWebhookHeaders(_optionalChain([ctx, 'optionalAccess', _141 => _141.input, 'optionalAccess', _142 => _142.data]));
   };
   for (const event of ["beforeInsert", "beforeUpdate"]) {
     engine.registerHook(event, handler, {
@@ -1146,10 +1266,10 @@ function bindWebhookHeadersShapeGate(engine, logger) {
       priority: GATE_PRIORITY
     });
   }
-  _optionalChain([logger, 'optionalAccess', _138 => _138.info, 'optionalCall', _139 => _139("[webhook] headers_secret shape gate bound (refuses non-flat-string-map plaintext)")]);
+  _optionalChain([logger, 'optionalAccess', _143 => _143.info, 'optionalCall', _144 => _144("[webhook] headers_secret shape gate bound (refuses non-flat-string-map plaintext)")]);
 }
 function unbindWebhookHeadersShapeGate(engine) {
-  if (typeof _optionalChain([engine, 'optionalAccess', _140 => _140.unregisterHooksByPackage]) === "function") {
+  if (typeof _optionalChain([engine, 'optionalAccess', _145 => _145.unregisterHooksByPackage]) === "function") {
     engine.unregisterHooksByPackage(WEBHOOK_HEADERS_GATE_PACKAGE);
   }
 }
@@ -1184,7 +1304,7 @@ var WebhookOutboxPlugin = class {
         scope: "system",
         name: "Webhook Schemas",
         description: "Registers sys_webhook (configuration). Deliveries use messaging's sys_http_delivery outbox.",
-        objects: [_chunkDRHJ2M45cjs.SysWebhook],
+        objects: [_chunkCWE6CIEZcjs.SysWebhook],
         navigationContributions: [
           {
             app: "setup",
@@ -1198,7 +1318,7 @@ var WebhookOutboxPlugin = class {
         ]
       });
     } else {
-      _optionalChain([ctx, 'access', _141 => _141.logger, 'access', _142 => _142.warn, 'optionalCall', _143 => _143(
+      _optionalChain([ctx, 'access', _146 => _146.logger, 'access', _147 => _147.warn, 'optionalCall', _148 => _148(
         "[webhook-outbox] manifest service unavailable \u2014 sys_webhook will NOT appear in REST or Studio nav. Register MetadataService before WebhookOutboxPlugin."
       )]);
     }
@@ -1207,7 +1327,7 @@ var WebhookOutboxPlugin = class {
         try {
           const i18n = ctx.getService("i18n");
           if (i18n && typeof i18n.loadTranslations === "function") {
-            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-IHRALWSP.cjs")));
+            const { WebhooksTranslations } = await Promise.resolve().then(() => _interopRequireWildcard(require("./translations-VX3ONQXN.cjs")));
             for (const [locale, data] of Object.entries(WebhooksTranslations)) {
               i18n.loadTranslations(locale, data);
             }
@@ -1224,7 +1344,7 @@ var WebhookOutboxPlugin = class {
         this.registerAdminRoutes(ctx);
       });
     }
-    _optionalChain([ctx, 'access', _144 => _144.logger, 'access', _145 => _145.info, 'optionalCall', _146 => _146("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
+    _optionalChain([ctx, 'access', _149 => _149.logger, 'access', _150 => _150.info, 'optionalCall', _151 => _151("[webhook-outbox] initialised (delivery via shared messaging HTTP outbox)", {
       autoEnqueue: autoEnqueueOpt !== false
     })]);
   }
@@ -1244,7 +1364,7 @@ var WebhookOutboxPlugin = class {
    * teardown is a no-op rather than a second unbind.
    */
   async destroy() {
-    await _optionalChain([this, 'access', _147 => _147.autoEnqueuer, 'optionalAccess', _148 => _148.stop, 'call', _149 => _149()]);
+    await _optionalChain([this, 'access', _152 => _152.autoEnqueuer, 'optionalAccess', _153 => _153.stop, 'call', _154 => _154()]);
     if (this.boundEngine) {
       try {
         unbindWebhookProvenanceStamp(this.boundEngine);
@@ -1285,7 +1405,7 @@ var WebhookOutboxPlugin = class {
   async bootDeclaredWebhooks(ctx) {
     const engine = this.tryGetService(ctx, ["objectql", "data"]);
     if (!engine) {
-      _optionalChain([ctx, 'access', _150 => _150.logger, 'access', _151 => _151.warn, 'optionalCall', _152 => _152("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
+      _optionalChain([ctx, 'access', _155 => _155.logger, 'access', _156 => _156.warn, 'optionalCall', _157 => _157("[webhook] declared-webhook bootstrap skipped \u2014 no data engine available")]);
       return;
     }
     this.boundEngine = engine;
@@ -1299,15 +1419,15 @@ var WebhookOutboxPlugin = class {
     try {
       await bootstrapDeclaredWebhooks(engine, metadataService, ctx.logger);
     } catch (err) {
-      _optionalChain([ctx, 'access', _153 => _153.logger, 'access', _154 => _154.warn, 'optionalCall', _155 => _155("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _156 => _156.message]), () => ( String(err)))
+      _optionalChain([ctx, 'access', _158 => _158.logger, 'access', _159 => _159.warn, 'optionalCall', _160 => _160("[webhook] declared-webhook bootstrap failed (dispatcher still serves admin rows)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _161 => _161.message]), () => ( String(err)))
       })]);
     }
     try {
       await migrateLegacyWebhookSecrets(engine, ctx.logger);
     } catch (err) {
-      _optionalChain([ctx, 'access', _157 => _157.logger, 'access', _158 => _158.warn, 'optionalCall', _159 => _159("[webhook] legacy signing-secret sweep failed (rows left unchanged)", {
-        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _160 => _160.message]), () => ( String(err)))
+      _optionalChain([ctx, 'access', _162 => _162.logger, 'access', _163 => _163.warn, 'optionalCall', _164 => _164("[webhook] legacy signing-secret sweep failed (rows left unchanged)", {
+        error: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _165 => _165.message]), () => ( String(err)))
       })]);
     }
   }
@@ -1317,14 +1437,14 @@ var WebhookOutboxPlugin = class {
     const realtime = this.tryGetService(ctx, ["realtime"]);
     const messaging = this.getMessaging(ctx);
     if (!engine || !realtime || !messaging) {
-      _optionalChain([ctx, 'access', _161 => _161.logger, 'access', _162 => _162.warn, 'optionalCall', _163 => _163(
+      _optionalChain([ctx, 'access', _166 => _166.logger, 'access', _167 => _167.warn, 'optionalCall', _168 => _168(
         "[webhook-auto-enqueuer] disabled \u2014 ObjectQL, Realtime, or Messaging service not available",
         { hasEngine: !!engine, hasRealtime: !!realtime, hasMessaging: !!messaging }
       )]);
       return;
     }
     if (!messaging.isHttpDeliveryReady()) {
-      _optionalChain([ctx, 'access', _164 => _164.logger, 'access', _165 => _165.warn, 'optionalCall', _166 => _166(
+      _optionalChain([ctx, 'access', _169 => _169.logger, 'access', _170 => _170.warn, 'optionalCall', _171 => _171(
         "[webhook-auto-enqueuer] messaging HTTP outbox not ready (no data engine / reliableDelivery off) \u2014 webhook deliveries will not be durable"
       )]);
     }
@@ -1338,7 +1458,7 @@ var WebhookOutboxPlugin = class {
     );
     await this.autoEnqueuer.start();
     ctx.registerService("webhook.autoEnqueuer", this.autoEnqueuer);
-    _optionalChain([ctx, 'access', _167 => _167.logger, 'access', _168 => _168.info, 'optionalCall', _169 => _169("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
+    _optionalChain([ctx, 'access', _172 => _172.logger, 'access', _173 => _173.info, 'optionalCall', _174 => _174("[webhook-auto-enqueuer] started (enqueues source=webhook onto sys_http_delivery)")]);
   }
   /**
    * [#8069] Register {@link createWebhookRedeliverGuard} with messaging, so
@@ -1354,7 +1474,7 @@ var WebhookOutboxPlugin = class {
    */
   installRedeliverGuard(ctx, messaging, engine, subscriptionsObject) {
     if (typeof messaging.registerRedeliverGuard !== "function") {
-      _optionalChain([ctx, 'access', _170 => _170.logger, 'access', _171 => _171.error, 'optionalCall', _172 => _172(
+      _optionalChain([ctx, 'access', _175 => _175.logger, 'access', _176 => _176.error, 'optionalCall', _177 => _177(
         "[webhook-outbox] messaging service exposes no registerRedeliverGuard() \u2014 redelivery of a webhook whose signing configuration is gone CANNOT be refused, so an operator pressing redeliver may send a delivery that can no longer be authenticated (#7799, #8069). The POST /api/v1/webhooks/redeliver endpoint is reachable by any authenticated user. Fix: upgrade @objectstack/service-messaging to a build that implements registerRedeliverGuard."
       )]);
       return;
@@ -1363,7 +1483,7 @@ var WebhookOutboxPlugin = class {
       "webhook",
       createWebhookRedeliverGuard(engine, subscriptionsObject)
     );
-    _optionalChain([ctx, 'access', _173 => _173.logger, 'access', _174 => _174.debug, 'optionalCall', _175 => _175("[webhook-outbox] redeliver guard installed for source=webhook")]);
+    _optionalChain([ctx, 'access', _178 => _178.logger, 'access', _179 => _179.debug, 'optionalCall', _180 => _180("[webhook-outbox] redeliver guard installed for source=webhook")]);
   }
   tryGetService(ctx, names) {
     for (const n of names) {
@@ -1396,7 +1516,7 @@ var WebhookOutboxPlugin = class {
   registerAdminRoutes(ctx) {
     const http = this.tryGetService(ctx, ["http-server"]);
     if (!http || typeof http.getRawApp !== "function") {
-      _optionalChain([ctx, 'access', _176 => _176.logger, 'access', _177 => _177.debug, 'optionalCall', _178 => _178("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
+      _optionalChain([ctx, 'access', _181 => _181.logger, 'access', _182 => _182.debug, 'optionalCall', _183 => _183("[webhook-outbox] HTTP server not available; redeliver endpoint not mounted")]);
       return;
     }
     const rawApp = http.getRawApp();
@@ -1404,7 +1524,7 @@ var WebhookOutboxPlugin = class {
     if (!rawApp || !messaging) return;
     rawApp.post("/api/v1/webhooks/redeliver", async (c) => {
       const session = await this.resolveSession(ctx, c);
-      const userId = _optionalChain([session, 'optionalAccess', _179 => _179.user, 'optionalAccess', _180 => _180.id]);
+      const userId = _optionalChain([session, 'optionalAccess', _184 => _184.user, 'optionalAccess', _185 => _185.id]);
       if (typeof userId !== "string" || userId.length === 0) {
         return c.json(
           { success: false, error: { code: "UNAUTHENTICATED", message: "Sign in to redeliver webhook deliveries." } },
@@ -1417,7 +1537,7 @@ var WebhookOutboxPlugin = class {
       } catch (e17) {
         return c.json({ success: false, error: { code: "INVALID_REQUEST", message: "Request body must be JSON." } }, 400);
       }
-      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _181 => _181.deliveryId]) === "string" ? body.deliveryId.trim() : "";
+      const deliveryId = typeof _optionalChain([body, 'optionalAccess', _186 => _186.deliveryId]) === "string" ? body.deliveryId.trim() : "";
       if (!deliveryId) {
         return c.json(
           { success: false, error: { code: "MISSING_REQUIRED_FIELD", message: "Body must include `deliveryId: string`." } },
@@ -1425,27 +1545,27 @@ var WebhookOutboxPlugin = class {
         );
       }
       try {
-        const activeOrg = _optionalChain([session, 'optionalAccess', _182 => _182.session, 'optionalAccess', _183 => _183.activeOrganizationId]);
+        const activeOrg = _optionalChain([session, 'optionalAccess', _187 => _187.session, 'optionalAccess', _188 => _188.activeOrganizationId]);
         const tenantId = typeof activeOrg === "string" && activeOrg.length > 0 ? activeOrg : void 0;
         const row = await messaging.redeliverHttp(deliveryId, { tenantId });
-        _optionalChain([ctx, 'access', _184 => _184.logger, 'access', _185 => _185.info, 'optionalCall', _186 => _186("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId, tenantId })]);
+        _optionalChain([ctx, 'access', _189 => _189.logger, 'access', _190 => _190.info, 'optionalCall', _191 => _191("[webhook-outbox] redelivered", { deliveryId, requestedBy: userId, tenantId })]);
         return c.json({ success: true, data: { id: row.id, status: row.status } });
       } catch (err) {
-        const code = _optionalChain([err, 'optionalAccess', _187 => _187.code]);
+        const code = _optionalChain([err, 'optionalAccess', _192 => _192.code]);
         if (code === "RESOURCE_NOT_FOUND") {
           return c.json({ success: false, error: { code, message: err.message } }, 404);
         }
         if (code === "DELIVERY_NOT_ELIGIBLE" || code === "DELIVERY_NEVER_SENT") {
           return c.json({ success: false, error: { code, message: err.message } }, 409);
         }
-        _optionalChain([ctx, 'access', _188 => _188.logger, 'access', _189 => _189.error, 'optionalCall', _190 => _190("[webhook-outbox] redeliver failed", err)]);
+        _optionalChain([ctx, 'access', _193 => _193.logger, 'access', _194 => _194.error, 'optionalCall', _195 => _195("[webhook-outbox] redeliver failed", err)]);
         return c.json(
-          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _191 => _191.message]), () => ( String(err))) } },
+          { success: false, error: { code: "INTERNAL_ERROR", message: _nullishCoalesce(_optionalChain([err, 'optionalAccess', _196 => _196.message]), () => ( String(err))) } },
           500
         );
       }
     });
-    _optionalChain([ctx, 'access', _192 => _192.logger, 'access', _193 => _193.info, 'optionalCall', _194 => _194("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
+    _optionalChain([ctx, 'access', _197 => _197.logger, 'access', _198 => _198.info, 'optionalCall', _199 => _199("[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver")]);
   }
   /**
    * [#10740] The better-auth session envelope (`{ user, session }`) for this
@@ -1466,7 +1586,7 @@ var WebhookOutboxPlugin = class {
       if (!api && typeof authService.getApi === "function") {
         api = await authService.getApi();
       }
-      if (!_optionalChain([api, 'optionalAccess', _195 => _195.getSession])) return void 0;
+      if (!_optionalChain([api, 'optionalAccess', _200 => _200.getSession])) return void 0;
       return await api.getSession({ headers: c.req.raw.headers });
     } catch (e18) {
       return void 0;
@@ -1486,5 +1606,5 @@ var WebhookOutboxPlugin = class {
 
 
 
-exports.AutoEnqueuer = AutoEnqueuer; exports.SysWebhook = _chunkDRHJ2M45cjs.SysWebhook; exports.WEBHOOK_HEADERS_FIELD = WEBHOOK_HEADERS_FIELD; exports.WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE = WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE; exports.WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS = WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS; exports.WEBHOOK_SECRET_FIELD = WEBHOOK_SECRET_FIELD; exports.WebhookHeadersShapeError = WebhookHeadersShapeError; exports.WebhookOutboxPlugin = WebhookOutboxPlugin; exports.assertWritableWebhookHeaders = assertWritableWebhookHeaders; exports.bindWebhookHeadersShapeGate = bindWebhookHeadersShapeGate; exports.migrateLegacyWebhookSecrets = migrateLegacyWebhookSecrets; exports.unbindWebhookHeadersShapeGate = unbindWebhookHeadersShapeGate;
+exports.AutoEnqueuer = AutoEnqueuer; exports.SysWebhook = _chunkCWE6CIEZcjs.SysWebhook; exports.WEBHOOK_HEADERS_FIELD = WEBHOOK_HEADERS_FIELD; exports.WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE = WEBHOOK_HEADERS_SHAPE_REFUSAL_CODE; exports.WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS = WEBHOOK_HEADERS_SHAPE_REFUSAL_STATUS; exports.WEBHOOK_SECRET_FIELD = WEBHOOK_SECRET_FIELD; exports.WebhookHeadersShapeError = WebhookHeadersShapeError; exports.WebhookOutboxPlugin = WebhookOutboxPlugin; exports.assertWritableWebhookHeaders = assertWritableWebhookHeaders; exports.bindWebhookHeadersShapeGate = bindWebhookHeadersShapeGate; exports.migrateLegacyWebhookSecrets = migrateLegacyWebhookSecrets; exports.unbindWebhookHeadersShapeGate = unbindWebhookHeadersShapeGate;
 //# sourceMappingURL=index.cjs.map