@objectstack/plugin-webhooks 5.2.0 → 6.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-webhooks",
-  "version": "5.2.0",
+  "version": "6.0.0",
   "license": "Apache-2.0",
   "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.",
   "type": "module",
@@ -24,10 +24,10 @@
     }
   },
   "dependencies": {
-    "@objectstack/core": "5.2.0",
-    "@objectstack/platform-objects": "5.2.0",
-    "@objectstack/spec": "5.2.0",
-    "@objectstack/service-cluster": "5.1.1"
+    "@objectstack/core": "6.0.0",
+    "@objectstack/platform-objects": "6.0.0",
+    "@objectstack/spec": "6.0.0",
+    "@objectstack/service-cluster": "5.1.2"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/src/index.ts

@@ -53,3 +53,4 @@ export type {
     IWebhookOutbox,
     WebhookDelivery,
 } from './outbox.js';
+export { RedeliverError } from './outbox.js';

package/src/memory-outbox.test.ts

@@ -0,0 +1,86 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * MemoryWebhookOutbox — focused tests for behaviours not already covered
+ * via `dispatcher.test.ts`. Today that's just `redeliver()` — the rest of
+ * the contract is exercised end-to-end through the dispatcher path.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { MemoryWebhookOutbox } from './memory-outbox.js';
+import type { EnqueueInput } from './outbox.js';
+
+function input(webhookId: string, eventId: string): EnqueueInput {
+    return {
+        webhookId,
+        eventId,
+        eventType: 'data.record.created',
+        url: 'https://example.test/hook',
+        payload: { hello: 'world' },
+    };
+}
+
+describe('MemoryWebhookOutbox.redeliver', () => {
+    it('resets a success row back to pending with attempts=0', async () => {
+        const outbox = new MemoryWebhookOutbox();
+        const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+        await outbox.claim({ nodeId: 'A', limit: 10, claimTtlMs: 60_000 });
+        await outbox.ack(id, { success: true, httpStatus: 200, durationMs: 1 });
+
+        const row = await outbox.redeliver(id);
+        expect(row.status).toBe('pending');
+        expect(row.attempts).toBe(0);
+        expect(row.claimedBy).toBeUndefined();
+        expect(row.claimedAt).toBeUndefined();
+        expect(row.nextRetryAt).toBeUndefined();
+        expect(row.error).toBeUndefined();
+        expect(row.responseCode).toBeUndefined();
+        expect(row.responseBody).toBeUndefined();
+        expect(row.url).toBe('https://example.test/hook');
+        expect(row.payload).toEqual({ hello: 'world' });
+    });
+
+    it('resets a dead row and makes it claimable again', async () => {
+        const outbox = new MemoryWebhookOutbox();
+        const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+        await outbox.claim({ nodeId: 'A', limit: 10, claimTtlMs: 60_000 });
+        await outbox.ack(id, {
+            success: false,
+            error: 'final',
+            dead: true,
+            durationMs: 5,
+        });
+
+        await outbox.redeliver(id);
+        const claimed = await outbox.claim({
+            nodeId: 'B',
+            limit: 10,
+            claimTtlMs: 60_000,
+        });
+        expect(claimed.map((r) => r.id)).toContain(id);
+    });
+
+    it('throws not_found when row does not exist', async () => {
+        const outbox = new MemoryWebhookOutbox();
+        await expect(outbox.redeliver('missing')).rejects.toMatchObject({
+            code: 'not_found',
+        });
+    });
+
+    it('throws not_eligible for pending rows', async () => {
+        const outbox = new MemoryWebhookOutbox();
+        const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+        await expect(outbox.redeliver(id)).rejects.toMatchObject({
+            code: 'not_eligible',
+        });
+    });
+
+    it('throws not_eligible for in_flight rows', async () => {
+        const outbox = new MemoryWebhookOutbox();
+        const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+        await outbox.claim({ nodeId: 'A', limit: 10, claimTtlMs: 60_000 });
+        await expect(outbox.redeliver(id)).rejects.toMatchObject({
+            code: 'not_eligible',
+        });
+    });
+});

package/src/memory-outbox.ts

@@ -9,6 +9,7 @@ import type {
     IWebhookOutbox,
     WebhookDelivery,
 } from './outbox.js';
+import { RedeliverError } from './outbox.js';
 import { hashPartition } from './partition.js';
 
 /**
@@ -124,4 +125,31 @@ export class MemoryWebhookOutbox implements IWebhookOutbox {
         const all = Array.from(this.rows.values()).map((r) => ({ ...r }));
         return filter?.status ? all.filter((r) => r.status === filter.status) : all;
     }
+
+    async redeliver(id: string): Promise<WebhookDelivery> {
+        const row = this.rows.get(id);
+        if (!row) {
+            throw new RedeliverError(
+                `Delivery row '${id}' not found`,
+                'not_found',
+            );
+        }
+        if (row.status !== 'success' && row.status !== 'failed' && row.status !== 'dead') {
+            throw new RedeliverError(
+                `Delivery row '${id}' is '${row.status}', expected one of: success, failed, dead`,
+                'not_eligible',
+            );
+        }
+        const now = Date.now();
+        row.status = 'pending';
+        row.attempts = 0;
+        row.claimedBy = undefined;
+        row.claimedAt = undefined;
+        row.nextRetryAt = undefined;
+        row.error = undefined;
+        row.responseCode = undefined;
+        row.responseBody = undefined;
+        row.updatedAt = now;
+        return { ...row };
+    }
 }

package/src/outbox.ts

@@ -113,6 +113,22 @@ export interface AckFailure {
 
 export type AckResult = AckSuccess | AckFailure;
 
+/**
+ * Error raised by `IWebhookOutbox.redeliver` when the requested row is
+ * either missing or in a non-terminal state. The dispatcher / admin UI
+ * surfaces this verbatim to the caller — never throw it for transient
+ * conditions (transport errors should bubble as native `Error`).
+ */
+export class RedeliverError extends Error {
+    constructor(
+        message: string,
+        readonly code: 'not_found' | 'not_eligible',
+    ) {
+        super(message);
+        this.name = 'RedeliverError';
+    }
+}
+
 /**
  * Pluggable storage backend for delivery rows. Implementations MUST make
  * `claim()` atomic across concurrent callers — that property is the
@@ -138,4 +154,22 @@ export interface IWebhookOutbox {
 
     /** Snapshot accessor for tests / admin tooling. */
     list(filter?: { status?: DeliveryStatus }): Promise<WebhookDelivery[]>;
+
+    /**
+     * Reset a terminal row back to `pending` so the dispatcher will pick
+     * it up again on its next tick.
+     *
+     * - Eligible source states: `success`, `failed`, `dead`.
+     * - Rejects `pending` / `in_flight` rows — replaying those would
+     *   double-deliver because they're either already queued or actively
+     *   being sent.
+     * - Resets `attempts=0` so the retry budget restarts.
+     * - Clears `claimed_by`, `claimed_at`, `next_retry_at`, `error`,
+     *   `response_code`, `response_body`. URL / payload / secret are NOT
+     *   touched — replay reproduces the original POST byte-for-byte.
+     *
+     * Throws `RedeliverError` with code `not_found` or `not_eligible`.
+     * Returns the post-reset row.
+     */
+    redeliver(id: string): Promise<WebhookDelivery>;
 }

package/src/sql-outbox.test.ts

@@ -407,4 +407,84 @@ describe('SqlWebhookOutbox', () => {
         const inFlight = await outbox.list({ status: 'in_flight' });
         expect(inFlight).toHaveLength(1);
     });
+
+    describe('redeliver', () => {
+        it('resets a success row back to pending with attempts=0', async () => {
+            const { outbox } = newOutbox();
+            const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+            await outbox.claim({ nodeId: 'A', limit: 10, claimTtlMs: 60_000 });
+            await outbox.ack(id, { success: true, httpStatus: 200, durationMs: 5 });
+
+            const row = await outbox.redeliver(id);
+            expect(row.status).toBe('pending');
+            expect(row.attempts).toBe(0);
+            expect(row.claimedBy).toBeUndefined();
+            expect(row.claimedAt).toBeUndefined();
+            expect(row.nextRetryAt).toBeUndefined();
+            expect(row.error).toBeUndefined();
+            expect(row.responseCode).toBeUndefined();
+            expect(row.responseBody).toBeUndefined();
+            // Original immutable fields preserved
+            expect(row.url).toBe('https://example.test/hook');
+            expect(row.payload).toEqual({ hello: 'world' });
+        });
+
+        it('resets a dead row back to pending and clears retry backoff', async () => {
+            const { outbox } = newOutbox();
+            const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+            await outbox.claim({ nodeId: 'A', limit: 10, claimTtlMs: 60_000 });
+            await outbox.ack(id, {
+                success: false,
+                error: 'final',
+                dead: true,
+                durationMs: 5,
+            });
+
+            const row = await outbox.redeliver(id);
+            expect(row.status).toBe('pending');
+            expect(row.attempts).toBe(0);
+            expect(row.error).toBeUndefined();
+            expect(row.nextRetryAt).toBeUndefined();
+        });
+
+        it('throws not_found when row does not exist', async () => {
+            const { outbox } = newOutbox();
+            await expect(outbox.redeliver('missing')).rejects.toMatchObject({
+                code: 'not_found',
+            });
+        });
+
+        it('throws not_eligible for pending rows', async () => {
+            const { outbox } = newOutbox();
+            const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+            await expect(outbox.redeliver(id)).rejects.toMatchObject({
+                code: 'not_eligible',
+            });
+        });
+
+        it('throws not_eligible for in_flight rows', async () => {
+            const { outbox } = newOutbox();
+            const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+            await outbox.claim({ nodeId: 'A', limit: 10, claimTtlMs: 60_000 });
+            await expect(outbox.redeliver(id)).rejects.toMatchObject({
+                code: 'not_eligible',
+            });
+        });
+
+        it('redelivered row is immediately claimable again', async () => {
+            const { outbox } = newOutbox();
+            const id = await outbox.enqueue(input('wh-1', 'ev-1'));
+            await outbox.claim({ nodeId: 'A', limit: 10, claimTtlMs: 60_000 });
+            await outbox.ack(id, { success: true, httpStatus: 200, durationMs: 1 });
+
+            await outbox.redeliver(id);
+
+            const claimed = await outbox.claim({
+                nodeId: 'B',
+                limit: 10,
+                claimTtlMs: 60_000,
+            });
+            expect(claimed.map((r) => r.id)).toContain(id);
+        });
+    });
 });

package/src/sql-outbox.ts

@@ -10,6 +10,7 @@ import type {
     IWebhookOutbox,
     WebhookDelivery,
 } from './outbox.js';
+import { RedeliverError } from './outbox.js';
 import { hashPartition } from './partition.js';
 import { SYS_WEBHOOK_DELIVERY } from './schema.js';
 
@@ -254,6 +255,66 @@ export class SqlWebhookOutbox implements IWebhookOutbox {
         return rows.map((r) => this.toDelivery(r));
     }
 
+    async redeliver(id: string): Promise<WebhookDelivery> {
+        const current = (await this.engine.findOne(this.objectName, {
+            where: { id },
+        })) as DeliveryRow | null;
+        if (!current) {
+            throw new RedeliverError(
+                `Delivery row '${id}' not found`,
+                'not_found',
+            );
+        }
+        if (
+            current.status !== 'success' &&
+            current.status !== 'failed' &&
+            current.status !== 'dead'
+        ) {
+            throw new RedeliverError(
+                `Delivery row '${id}' is '${current.status}', expected one of: success, failed, dead`,
+                'not_eligible',
+            );
+        }
+        const now = Date.now();
+        // Guarded UPDATE — re-check status server-side so two concurrent
+        // redeliver calls cannot both flip the row, and so a dispatcher
+        // tick that flipped the row to in_flight between our SELECT and
+        // UPDATE cannot be clobbered.
+        await this.engine.update(
+            this.objectName,
+            {
+                status: 'pending',
+                attempts: 0,
+                claimed_by: null,
+                claimed_at: null,
+                next_retry_at: null,
+                last_attempted_at: null,
+                response_code: null,
+                response_body: null,
+                error: null,
+                updated_at: now,
+            },
+            {
+                where: {
+                    id,
+                    status: { $in: ['success', 'failed', 'dead'] },
+                },
+                multi: false,
+            },
+        );
+        const after = (await this.engine.findOne(this.objectName, {
+            where: { id },
+        })) as DeliveryRow | null;
+        if (!after || after.status !== 'pending') {
+            // Lost the race — another writer flipped the row.
+            throw new RedeliverError(
+                `Delivery row '${id}' state changed during redeliver`,
+                'not_eligible',
+            );
+        }
+        return this.toDelivery(after);
+    }
+
     private toDelivery(r: DeliveryRow): WebhookDelivery {
         return {
             id: r.id,

package/src/sys-webhook-delivery.object.ts

@@ -42,6 +42,28 @@ export const SysWebhookDelivery = ObjectSchema.create({
     titleFormat: '{event_type} → {url}',
     compactLayout: ['event_type', 'url', 'status', 'attempts', 'next_retry_at'],
 
+    actions: [
+        {
+            name: 'redeliver',
+            label: 'Redeliver',
+            icon: 'refresh-cw',
+            variant: 'secondary',
+            locations: ['list_item', 'record_header'],
+            type: 'api',
+            target: '/api/v1/webhooks/redeliver',
+            method: 'POST',
+            recordIdParam: 'deliveryId',
+            confirmText:
+                'Replay this delivery? The receiver will get the original payload again — they must be idempotent on the X-Objectstack-Delivery header.',
+            successMessage: 'Queued for redelivery',
+            refreshAfter: true,
+            // Only terminal rows are safe to replay. Pending / in_flight rows
+            // are either already queued or actively being sent — replaying
+            // would double-deliver.
+            disabled: "!(status in ['success', 'failed', 'dead'])",
+        },
+    ],
+
     listViews: {
         recent: {
             type: 'grid',

package/src/webhook-outbox-plugin.ts

@@ -15,6 +15,7 @@ import {
     DeliveryRetentionSweeper,
     type DeliveryRetentionOptions,
 } from './retention.js';
+import { SqlWebhookOutbox } from './sql-outbox.js';
 import { SysWebhookDelivery } from './sys-webhook-delivery.object.js';
 
 export interface WebhookOutboxPluginOptions
@@ -171,11 +172,13 @@ export class WebhookOutboxPlugin implements Plugin {
         }
 
         // Loud warning when running with the in-memory outbox in production —
-        // it loses data on restart and never shares rows across nodes.
+        // it loses data on restart and never shares rows across nodes. With
+        // the auto-pick logic above this only fires when no IDataEngine is
+        // available, but flag it loudly anyway.
         const usingMemoryOutbox = outbox instanceof MemoryWebhookOutbox;
         if (usingMemoryOutbox && process.env.NODE_ENV === 'production') {
             ctx.logger.warn?.(
-                '[webhook-outbox] MemoryWebhookOutbox in production — webhook deliveries WILL be lost on process exit. Pass `outbox: (ctx) => new SqlWebhookOutbox(ctx.getService("objectql"), { partitionCount: 8 })` from `@objectstack/plugin-webhooks/sql`.',
+                '[webhook-outbox] MemoryWebhookOutbox in production — webhook deliveries WILL be lost on process exit. Ensure ObjectQL is registered before WebhookOutboxPlugin so the SQL outbox can auto-select.',
             );
         }
 
@@ -192,6 +195,20 @@ export class WebhookOutboxPlugin implements Plugin {
             });
         }
 
+        // Admin REST endpoint — POST /api/v1/webhooks/redeliver { deliveryId }.
+        // Wired in `kernel:ready` so the auth + http services are guaranteed
+        // resolvable. Gated on a session cookie so anonymous callers cannot
+        // replay deliveries; finer-grained RBAC (e.g. "only admins") can be
+        // layered on later — for now any signed-in user with access to the
+        // Setup app can redeliver. The action is also `disabled`-gated by
+        // status on the Studio side so the button only lights up on
+        // success / failed / dead rows.
+        if (typeof (ctx as any).hook === 'function') {
+            (ctx as any).hook('kernel:ready', () => {
+                this.registerAdminRoutes(ctx);
+            });
+        }
+
         ctx.logger.info?.('[webhook-outbox] initialised', {
             nodeId,
             partitions: this.options.partitionCount ?? 8,
@@ -209,9 +226,32 @@ export class WebhookOutboxPlugin implements Plugin {
 
     private resolveOutbox(ctx: PluginContext): IWebhookOutbox {
         const opt = this.options.outbox;
-        if (!opt) return new MemoryWebhookOutbox();
-        if (typeof opt === 'function') return (opt as (c: PluginContext) => IWebhookOutbox)(ctx);
-        return opt;
+        if (opt) {
+            return typeof opt === 'function'
+                ? (opt as (c: PluginContext) => IWebhookOutbox)(ctx)
+                : opt;
+        }
+        // No explicit override — auto-pick the right backend for the host.
+        // SqlWebhookOutbox needs an `IDataEngine`; if one is resolvable
+        // (the usual case in CLI-served stacks), use it so durable rows
+        // in `sys_webhook_delivery` actually round-trip through the
+        // dispatcher and the redeliver REST endpoint. Memory is only a
+        // last-resort fallback for tests / edge environments without an
+        // engine.
+        const engine = this.tryGetService<IDataEngine>(ctx, ['objectql', 'data']);
+        if (engine) {
+            const partitionCount = this.options.partitionCount ?? 8;
+            const sql = new SqlWebhookOutbox(engine, { partitionCount });
+            ctx.logger.info?.(
+                '[webhook-outbox] auto-selected SqlWebhookOutbox (objectql engine detected)',
+                { partitionCount },
+            );
+            return sql;
+        }
+        ctx.logger.warn?.(
+            '[webhook-outbox] no IDataEngine available — falling back to MemoryWebhookOutbox. Deliveries will NOT survive process restart and the redeliver REST endpoint will not see rows written through ObjectQL.',
+        );
+        return new MemoryWebhookOutbox();
     }
 
     private async bootAutoEnqueue(
@@ -277,4 +317,126 @@ export class WebhookOutboxPlugin implements Plugin {
         }
         return undefined;
     }
+
+    /**
+     * Mount POST /api/v1/webhooks/redeliver on the host Hono app, if one
+     * is available. Silently no-ops in environments without an HTTP
+     * server (MSW, edge tests, pure library use). Auth is delegated to
+     * the better-auth session cookie — every authenticated user counts.
+     */
+    private registerAdminRoutes(ctx: PluginContext): void {
+        const http = this.tryGetService<any>(ctx, ['http-server']);
+        if (!http || typeof http.getRawApp !== 'function') {
+            ctx.logger.debug?.(
+                '[webhook-outbox] HTTP server not available; redeliver REST endpoint not mounted',
+            );
+            return;
+        }
+        const rawApp = http.getRawApp();
+        const outbox = this.outboxInstance;
+        if (!rawApp || !outbox) return;
+
+        rawApp.post('/api/v1/webhooks/redeliver', async (c: any) => {
+            // Auth gate — require a signed-in session.
+            const userId = await this.resolveSessionUserId(ctx, c);
+            if (!userId) {
+                return c.json(
+                    {
+                        success: false,
+                        error: 'unauthenticated',
+                        message: 'Sign in to redeliver webhook deliveries.',
+                    },
+                    401,
+                );
+            }
+            let body: any;
+            try {
+                body = await c.req.json();
+            } catch {
+                return c.json(
+                    {
+                        success: false,
+                        error: 'invalid_body',
+                        message: 'Request body must be JSON.',
+                    },
+                    400,
+                );
+            }
+            const deliveryId =
+                typeof body?.deliveryId === 'string' ? body.deliveryId.trim() : '';
+            if (!deliveryId) {
+                return c.json(
+                    {
+                        success: false,
+                        error: 'missing_delivery_id',
+                        message: 'Body must include `deliveryId: string`.',
+                    },
+                    400,
+                );
+            }
+            try {
+                const row = await outbox.redeliver(deliveryId);
+                ctx.logger.info?.('[webhook-outbox] redelivered', {
+                    deliveryId,
+                    requestedBy: userId,
+                });
+                return c.json({ success: true, data: { id: row.id, status: row.status } });
+            } catch (err: any) {
+                const code = err?.code;
+                if (code === 'not_found') {
+                    return c.json(
+                        { success: false, error: 'not_found', message: err.message },
+                        404,
+                    );
+                }
+                if (code === 'not_eligible') {
+                    return c.json(
+                        { success: false, error: 'not_eligible', message: err.message },
+                        409,
+                    );
+                }
+                ctx.logger.error?.(
+                    '[webhook-outbox] redeliver failed',
+                    err as Error,
+                );
+                return c.json(
+                    {
+                        success: false,
+                        error: 'internal_error',
+                        message: err?.message ?? String(err),
+                    },
+                    500,
+                );
+            }
+        });
+
+        ctx.logger.info?.(
+            '[webhook-outbox] redeliver endpoint mounted at POST /api/v1/webhooks/redeliver',
+        );
+    }
+
+    /**
+     * Resolve the requesting user's id from a better-auth session cookie.
+     * Returns `undefined` for anonymous callers — the caller decides
+     * whether that's a 401.
+     */
+    private async resolveSessionUserId(
+        ctx: PluginContext,
+        c: any,
+    ): Promise<string | undefined> {
+        try {
+            const authService: any = this.tryGetService<any>(ctx, ['auth']);
+            if (!authService) return undefined;
+            let api: any = authService.api;
+            if (!api && typeof authService.getApi === 'function') {
+                api = await authService.getApi();
+            }
+            if (!api?.getSession) return undefined;
+            const session = await api.getSession({ headers: c.req.raw.headers });
+            const uid = session?.user?.id;
+            return typeof uid === 'string' && uid.length > 0 ? uid : undefined;
+        } catch {
+            return undefined;
+        }
+    }
 }

package/dist/chunk-JN76ZRWN.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sys-webhook-delivery.object.ts"],"sourcesContent":["// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Field, ObjectSchema } from '@objectstack/spec/data';\n\n/**\n * sys_webhook_delivery — Durable outbox row for one HTTP attempt.\n *\n * Schema is owned by `@objectstack/plugin-webhooks`. Add it to your stack\n * via:\n *\n *   import { SysWebhookDelivery } from '@objectstack/plugin-webhooks/schema';\n *   defineStack({ objects: [SysWebhookDelivery, ...], plugins: [...] });\n *\n * Designed for the SqlWebhookOutbox claim algorithm:\n *\n *   1. Producers INSERT pending rows (dedup'd by (event_id, webhook_id)).\n *   2. The dispatcher's per-partition lock-holder runs:\n *        SELECT id WHERE status='pending' AND partition_key=? AND (next_retry_at <= now OR null)\n *        UPDATE SET status='in_flight' WHERE id IN (...) AND status='pending'  ← atomic claim\n *        POST to target URL\n *        UPDATE SET status=success/pending/dead, attempts=attempts+1, ...\n *\n * `partition_key` is precomputed on enqueue (hash(webhook_id) mod N) so the\n * dispatcher can filter cheaply without DB-side hash functions.\n *\n * Indexes are tuned for the hot path: `(status, partition_key, next_retry_at)`\n * is the claim query; `(event_id, webhook_id)` is the dedup uniqueness.\n *\n * @namespace sys\n */\nexport const SysWebhookDelivery = ObjectSchema.create({\n    name: 'sys_webhook_delivery',\n    label: 'Webhook Delivery',\n    pluralLabel: 'Webhook Deliveries',\n    icon: 'package',\n    isSystem: true,\n    managedBy: 'config',\n    userActions: { create: false, edit: false, delete: false, import: false },\n    description:\n        'Durable outbox row for one webhook attempt. Managed by @objectstack/plugin-webhooks; do not write directly.',\n    displayNameField: 'id',\n    titleFormat: '{event_type} → {url}',\n    compactLayout: ['event_type', 'url', 'status', 'attempts', 'next_retry_at'],\n\n    listViews: {\n        recent: {\n            type: 'grid',\n            name: 'recent',\n            label: 'Recent',\n            data: { provider: 'object', object: 'sys_webhook_delivery' },\n            columns: ['event_type', 'url', 'status', 'attempts', 'response_code', 'updated_at'],\n            sort: [{ field: 'updated_at', order: 'desc' }],\n            pagination: { pageSize: 50 },\n        },\n        failures: {\n            type: 'grid',\n            name: 'failures',\n            label: 'Failures',\n            data: { provider: 'object', object: 'sys_webhook_delivery' },\n            columns: ['event_type', 'url', 'status', 'attempts', 'response_code', 'error', 'updated_at'],\n            filter: [{ field: 'status', operator: 'in', value: ['failed', 'dead'] }],\n            sort: [{ field: 'updated_at', order: 'desc' }],\n            pagination: { pageSize: 50 },\n        },\n        in_flight: {\n            type: 'grid',\n            name: 'in_flight',\n            label: 'In Flight',\n            data: { provider: 'object', object: 'sys_webhook_delivery' },\n            columns: ['event_type', 'url', 'attempts', 'claimed_by', 'claimed_at'],\n            filter: [{ field: 'status', operator: 'equals', value: 'in_flight' }],\n            sort: [{ field: 'claimed_at', order: 'desc' }],\n            pagination: { pageSize: 50 },\n        },\n        pending: {\n            type: 'grid',\n            name: 'pending',\n            label: 'Pending',\n            data: { provider: 'object', object: 'sys_webhook_delivery' },\n            columns: ['event_type', 'url', 'attempts', 'next_retry_at', 'updated_at'],\n            filter: [{ field: 'status', operator: 'equals', value: 'pending' }],\n            sort: [{ field: 'next_retry_at', order: 'asc' }],\n            pagination: { pageSize: 50 },\n        },\n        by_status: {\n            type: 'grid',\n            name: 'by_status',\n            label: 'By Status',\n            data: { provider: 'object', object: 'sys_webhook_delivery' },\n            columns: ['status', 'event_type', 'url', 'attempts', 'updated_at'],\n            sort: [{ field: 'status', order: 'asc' }, { field: 'updated_at', order: 'desc' }],\n            grouping: { fields: [{ field: 'status', order: 'asc', collapsed: false }] },\n            pagination: { pageSize: 100 },\n        },\n        by_webhook: {\n            type: 'grid',\n            name: 'by_webhook',\n            label: 'By Webhook',\n            data: { provider: 'object', object: 'sys_webhook_delivery' },\n            columns: ['webhook_id', 'event_type', 'status', 'attempts', 'updated_at'],\n            sort: [{ field: 'webhook_id', order: 'asc' }, { field: 'updated_at', order: 'desc' }],\n            grouping: { fields: [{ field: 'webhook_id', order: 'asc', collapsed: true }] },\n            pagination: { pageSize: 100 },\n        },\n        all_deliveries: {\n            type: 'grid',\n            name: 'all_deliveries',\n            label: 'All',\n            data: { provider: 'object', object: 'sys_webhook_delivery' },\n            columns: ['event_type', 'url', 'status', 'attempts', 'response_code', 'updated_at'],\n            sort: [{ field: 'updated_at', order: 'desc' }],\n            pagination: { pageSize: 100 },\n        },\n    },\n\n    fields: {\n        id: Field.text({\n            label: 'Delivery ID',\n            required: true,\n            maxLength: 64,\n            description: 'UUID — also doubles as the receiver-side idempotency key',\n        }),\n\n        webhook_id: Field.text({\n            label: 'Webhook ID',\n            required: true,\n            maxLength: 64,\n            description: 'FK to sys_webhook.id (loosely coupled — denormalised URL/secret on row)',\n        }),\n\n        event_id: Field.text({\n            label: 'Event ID',\n            required: true,\n            maxLength: 128,\n            description: 'Source event id; UNIQUE(event_id, webhook_id) for dedup',\n        }),\n\n        event_type: Field.text({\n            label: 'Event Type',\n            required: true,\n            maxLength: 128,\n            description: 'e.g. data.record.created',\n        }),\n\n        url: Field.text({\n            label: 'Target URL',\n            required: true,\n            maxLength: 2048,\n            description: 'Snapshotted at enqueue so config edits do not rewrite live rows',\n        }),\n\n        method: Field.text({ label: 'Method', required: false, maxLength: 10 }),\n        headers_json: Field.textarea({ label: 'Headers JSON', required: false }),\n        secret: Field.text({ label: 'HMAC Secret', required: false, maxLength: 256 }),\n        timeout_ms: Field.number({ label: 'Timeout (ms)', required: false }),\n        payload_json: Field.textarea({ label: 'Payload JSON', required: true }),\n\n        partition_key: Field.number({\n            label: 'Partition',\n            required: true,\n            description: 'hash(webhook_id) mod partitionCount — precomputed for cheap WHERE',\n        }),\n\n        status: Field.text({\n            label: 'Status',\n            required: true,\n            defaultValue: 'pending',\n            maxLength: 16,\n            description: 'pending | in_flight | success | failed | dead',\n        }),\n\n        attempts: Field.number({\n            label: 'Attempts',\n            required: true,\n            defaultValue: 0,\n            description: 'Number of POST attempts made so far',\n        }),\n\n        claimed_by: Field.text({ label: 'Claimed By', required: false, maxLength: 128 }),\n        claimed_at: Field.number({ label: 'Claimed At (ms)', required: false }),\n        next_retry_at: Field.number({ label: 'Next Retry At (ms)', required: false }),\n        last_attempted_at: Field.number({ label: 'Last Attempted At (ms)', required: false }),\n        response_code: Field.number({ label: 'HTTP Status', required: false }),\n        response_body: Field.textarea({ label: 'Response Body (capped)', required: false }),\n        error: Field.textarea({ label: 'Error', required: false }),\n\n        created_at: Field.number({ label: 'Created At (ms)', required: true }),\n        updated_at: Field.number({ label: 'Updated At (ms)', required: true }),\n    },\n\n    indexes: [\n        { fields: ['event_id', 'webhook_id'], unique: true },\n        // Hot path: claim query\n        { fields: ['status', 'partition_key', 'next_retry_at'] },\n        // Reaper: scan stale in_flight rows by claimed_at\n        { fields: ['status', 'claimed_at'] },\n        { fields: ['webhook_id'] },\n    ],\n});\n\n/** Canonical object name — exported so SqlWebhookOutbox callers can override if needed. */\nexport const SYS_WEBHOOK_DELIVERY = 'sys_webhook_delivery' as const;\n"],"mappings":";AAEA,SAAS,OAAO,oBAAoB;AA4B7B,IAAM,qBAAqB,aAAa,OAAO;AAAA,EAClD,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,WAAW;AAAA,EACX,aAAa,EAAE,QAAQ,OAAO,MAAM,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EACxE,aACI;AAAA,EACJ,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,eAAe,CAAC,cAAc,OAAO,UAAU,YAAY,eAAe;AAAA,EAE1E,WAAW;AAAA,IACP,QAAQ;AAAA,MACJ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,uBAAuB;AAAA,MAC3D,SAAS,CAAC,cAAc,OAAO,UAAU,YAAY,iBAAiB,YAAY;AAAA,MAClF,MAAM,CAAC,EAAE,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,MAC7C,YAAY,EAAE,UAAU,GAAG;AAAA,IAC/B;AAAA,IACA,UAAU;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,uBAAuB;AAAA,MAC3D,SAAS,CAAC,cAAc,OAAO,UAAU,YAAY,iBAAiB,SAAS,YAAY;AAAA,MAC3F,QAAQ,CAAC,EAAE,OAAO,UAAU,UAAU,MAAM,OAAO,CAAC,UAAU,MAAM,EAAE,CAAC;AAAA,MACvE,MAAM,CAAC,EAAE,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,MAC7C,YAAY,EAAE,UAAU,GAAG;AAAA,IAC/B;AAAA,IACA,WAAW;AAAA,MACP,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,uBAAuB;AAAA,MAC3D,SAAS,CAAC,cAAc,OAAO,YAAY,cAAc,YAAY;AAAA,MACrE,QAAQ,CAAC,EAAE,OAAO,UAAU,UAAU,UAAU,OAAO,YAAY,CAAC;AAAA,MACpE,MAAM,CAAC,EAAE,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,MAC7C,YAAY,EAAE,UAAU,GAAG;AAAA,IAC/B;AAAA,IACA,SAAS;AAAA,MACL,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,uBAAuB;AAAA,MAC3D,SAAS,CAAC,cAAc,OAAO,YAAY,iBAAiB,YAAY;AAAA,MACxE,QAAQ,CAAC,EAAE,OAAO,UAAU,UAAU,UAAU,OAAO,UAAU,CAAC;AAAA,MAClE,MAAM,CAAC,EAAE,OAAO,iBAAiB,OAAO,MAAM,CAAC;AAAA,MAC/C,YAAY,EAAE,UAAU,GAAG;AAAA,IAC/B;AAAA,IACA,WAAW;AAAA,MACP,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,uBAAuB;AAAA,MAC3D,SAAS,CAAC,UAAU,cAAc,OAAO,YAAY,YAAY;AAAA,MACjE,MAAM,CAAC,EAAE,OAAO,UAAU,OAAO,MAAM,GAAG,EAAE,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,MAChF,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,UAAU,OAAO,OAAO,WAAW,MAAM,CAAC,EAAE;AAAA,MAC1E,YAAY,EAAE,UAAU,IAAI;AAAA,IAChC;AAAA,IACA,YAAY;AAAA,MACR,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,uBAAuB;AAAA,MAC3D,SAAS,CAAC,cAAc,cAAc,UAAU,YAAY,YAAY;AAAA,MACxE,MAAM,CAAC,EAAE,OAAO,cAAc,OAAO,MAAM,GAAG,EAAE,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,MACpF,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,cAAc,OAAO,OAAO,WAAW,KAAK,CAAC,EAAE;AAAA,MAC7E,YAAY,EAAE,UAAU,IAAI;AAAA,IAChC;AAAA,IACA,gBAAgB;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,UAAU,QAAQ,uBAAuB;AAAA,MAC3D,SAAS,CAAC,cAAc,OAAO,UAAU,YAAY,iBAAiB,YAAY;AAAA,MAClF,MAAM,CAAC,EAAE,OAAO,cAAc,OAAO,OAAO,CAAC;AAAA,MAC7C,YAAY,EAAE,UAAU,IAAI;AAAA,IAChC;AAAA,EACJ;AAAA,EAEA,QAAQ;AAAA,IACJ,IAAI,MAAM,KAAK;AAAA,MACX,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAa;AAAA,IACjB,CAAC;AAAA,IAED,YAAY,MAAM,KAAK;AAAA,MACnB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAa;AAAA,IACjB,CAAC;AAAA,IAED,UAAU,MAAM,KAAK;AAAA,MACjB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAa;AAAA,IACjB,CAAC;AAAA,IAED,YAAY,MAAM,KAAK;AAAA,MACnB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAa;AAAA,IACjB,CAAC;AAAA,IAED,KAAK,MAAM,KAAK;AAAA,MACZ,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAa;AAAA,IACjB,CAAC;AAAA,IAED,QAAQ,MAAM,KAAK,EAAE,OAAO,UAAU,UAAU,OAAO,WAAW,GAAG,CAAC;AAAA,IACtE,cAAc,MAAM,SAAS,EAAE,OAAO,gBAAgB,UAAU,MAAM,CAAC;AAAA,IACvE,QAAQ,MAAM,KAAK,EAAE,OAAO,eAAe,UAAU,OAAO,WAAW,IAAI,CAAC;AAAA,IAC5E,YAAY,MAAM,OAAO,EAAE,OAAO,gBAAgB,UAAU,MAAM,CAAC;AAAA,IACnE,cAAc,MAAM,SAAS,EAAE,OAAO,gBAAgB,UAAU,KAAK,CAAC;AAAA,IAEtE,eAAe,MAAM,OAAO;AAAA,MACxB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACjB,CAAC;AAAA,IAED,QAAQ,MAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,cAAc;AAAA,MACd,WAAW;AAAA,MACX,aAAa;AAAA,IACjB,CAAC;AAAA,IAED,UAAU,MAAM,OAAO;AAAA,MACnB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,cAAc;AAAA,MACd,aAAa;AAAA,IACjB,CAAC;AAAA,IAED,YAAY,MAAM,KAAK,EAAE,OAAO,cAAc,UAAU,OAAO,WAAW,IAAI,CAAC;AAAA,IAC/E,YAAY,MAAM,OAAO,EAAE,OAAO,mBAAmB,UAAU,MAAM,CAAC;AAAA,IACtE,eAAe,MAAM,OAAO,EAAE,OAAO,sBAAsB,UAAU,MAAM,CAAC;AAAA,IAC5E,mBAAmB,MAAM,OAAO,EAAE,OAAO,0BAA0B,UAAU,MAAM,CAAC;AAAA,IACpF,eAAe,MAAM,OAAO,EAAE,OAAO,eAAe,UAAU,MAAM,CAAC;AAAA,IACrE,eAAe,MAAM,SAAS,EAAE,OAAO,0BAA0B,UAAU,MAAM,CAAC;AAAA,IAClF,OAAO,MAAM,SAAS,EAAE,OAAO,SAAS,UAAU,MAAM,CAAC;AAAA,IAEzD,YAAY,MAAM,OAAO,EAAE,OAAO,mBAAmB,UAAU,KAAK,CAAC;AAAA,IACrE,YAAY,MAAM,OAAO,EAAE,OAAO,mBAAmB,UAAU,KAAK,CAAC;AAAA,EACzE;AAAA,EAEA,SAAS;AAAA,IACL,EAAE,QAAQ,CAAC,YAAY,YAAY,GAAG,QAAQ,KAAK;AAAA;AAAA,IAEnD,EAAE,QAAQ,CAAC,UAAU,iBAAiB,eAAe,EAAE;AAAA;AAAA,IAEvD,EAAE,QAAQ,CAAC,UAAU,YAAY,EAAE;AAAA,IACnC,EAAE,QAAQ,CAAC,YAAY,EAAE;AAAA,EAC7B;AACJ,CAAC;AAGM,IAAM,uBAAuB;","names":[]}

package/dist/chunk-M4M5FWIH.cjs

@@ -1,15 +0,0 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/partition.ts
-function hashPartition(key, count) {
-  if (count <= 0) throw new Error("partition count must be > 0");
-  let h = 2166136261;
-  for (let i = 0; i < key.length; i++) {
-    h ^= key.charCodeAt(i);
-    h = Math.imul(h, 16777619);
-  }
-  return Math.abs(h | 0) % count;
-}
-
-
-
-exports.hashPartition = hashPartition;
-//# sourceMappingURL=chunk-M4M5FWIH.cjs.map

package/dist/chunk-M4M5FWIH.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["/home/runner/work/framework/framework/packages/plugins/plugin-webhooks/dist/chunk-M4M5FWIH.cjs","../src/partition.ts"],"names":[],"mappings":"AAAA;ACUO,SAAS,aAAA,CAAc,GAAA,EAAa,KAAA,EAAuB;AAC9D,EAAA,GAAA,CAAI,MAAA,GAAS,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,6BAA6B,CAAA;AAC7D,EAAA,IAAI,EAAA,EAAI,UAAA;AACR,EAAA,IAAA,CAAA,IAAS,EAAA,EAAI,CAAA,EAAG,EAAA,EAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK;AACjC,IAAA,EAAA,GAAK,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AACrB,IAAA,EAAA,EAAI,IAAA,CAAK,IAAA,CAAK,CAAA,EAAG,QAAU,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,CAAC,EAAA,EAAI,KAAA;AAC7B;ADRA;AACA;AACE;AACF,sCAAC","file":"/home/runner/work/framework/framework/packages/plugins/plugin-webhooks/dist/chunk-M4M5FWIH.cjs","sourcesContent":[null,"// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * Stable, framework-free partition hash. The dispatcher uses this to\n * assign webhooks to partitions; the in-memory outbox uses the same hash\n * to filter rows in `claim()`. Both call sites MUST agree, which is why\n * this is a single shared helper.\n *\n * Uses a 32-bit FNV-1a variant — fast, no allocations, deterministic.\n */\nexport function hashPartition(key: string, count: number): number {\n    if (count <= 0) throw new Error('partition count must be > 0');\n    let h = 0x811c9dc5;\n    for (let i = 0; i < key.length; i++) {\n        h ^= key.charCodeAt(i);\n        h = Math.imul(h, 0x01000193);\n    }\n    return Math.abs(h | 0) % count;\n}\n"]}