@open-mercato/webhooks 0.6.6 → 0.6.7-canary.316.1.e6c38e0bef

package/dist/modules/webhooks/api/inbound/[endpointId]/route.js

@@ -5,7 +5,7 @@ import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_ERROR_KEY } from "@open-mercato/shared/lib/ratelimit/helpers";
 import { emitWebhooksEvent } from "../../../events.js";
 import { getWebhookEndpointAdapter } from "../../../lib/adapter-registry.js";
-import { isWebhookIntegrationEnabled } from "../../../lib/integration-state.js";
+import { isWebhookIntegrationEnabled, WEBHOOK_INTEGRATION_DISABLED_MESSAGE } from "../../../lib/integration-state.js";
 import { json } from "../../helpers.js";
 import { WebhookInboundReceiptEntity } from "../../../data/entities.js";
 const metadata = {
@@ -47,14 +47,19 @@ async function POST(request, context) {
   } catch {
     return json({ error: "Verification failed" }, { status: 400 });
   }
-  if (verified.tenantId && verified.organizationId) {
-    const integrationEnabled = await isWebhookIntegrationEnabled(em, {
-      tenantId: verified.tenantId,
-      organizationId: verified.organizationId
-    });
+  const hasTenantId = Boolean(verified.tenantId);
+  const hasOrganizationId = Boolean(verified.organizationId);
+  if (hasTenantId !== hasOrganizationId) {
+    return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 });
+  }
+  const integrationScope = hasTenantId && hasOrganizationId ? { tenantId: verified.tenantId, organizationId: verified.organizationId } : null;
+  if (integrationScope) {
+    const integrationEnabled = await isWebhookIntegrationEnabled(em, integrationScope);
     if (!integrationEnabled) {
-      return json({ error: "Custom Webhooks integration is disabled" }, { status: 503 });
+      return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 });
     }
+  } else if (!adapter.allowUnscopedInbound) {
+    return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 });
   }
   const messageId = resolveInboundReceiptMessageId({
     endpointId: params.endpointId,

package/dist/modules/webhooks/api/inbound/[endpointId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/webhooks/api/inbound/%5BendpointId%5D/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_ERROR_KEY } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport { emitWebhooksEvent } from '../../../events'\nimport { getWebhookEndpointAdapter } from '../../../lib/adapter-registry'\nimport { isWebhookIntegrationEnabled } from '../../../lib/integration-state'\nimport { json } from '../../helpers'\nimport { WebhookInboundReceiptEntity } from '../../../data/entities'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\ninterface RouteContext {\n  params: Promise<{ endpointId: string }>\n}\n\nconst inboundResponseSchema = z.object({\n  ok: z.boolean(),\n  duplicate: z.boolean().optional(),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nexport async function POST(request: Request, context: RouteContext): Promise<Response> {\n  const params = await context.params\n  const adapter = getWebhookEndpointAdapter(params.endpointId)\n  const { translate } = await resolveTranslations()\n\n  if (!adapter) {\n    return json({ error: 'Webhook endpoint not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n  const rateLimiterService = tryResolve<RateLimiterService>(container, 'rateLimiterService')\n\n  if (rateLimiterService) {\n    const rateLimitResponse = await checkRateLimit(\n      rateLimiterService,\n      { points: 60, duration: 60, keyPrefix: `webhooks:inbound:${params.endpointId}` },\n      buildInboundRateLimitKey(params.endpointId, request, rateLimiterService.trustProxyDepth),\n      translate(RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK),\n    )\n\n    if (rateLimitResponse) return rateLimitResponse\n  }\n\n  const body = await request.text()\n  const headers = Object.fromEntries(request.headers.entries())\n  let verified: Awaited<ReturnType<typeof adapter.verifyWebhook>>\n  try {\n    verified = await adapter.verifyWebhook({\n      headers,\n      body,\n      method: request.method,\n    })\n  } catch {\n    return json({ error: 'Verification failed' }, { status: 400 })\n  }\n\n  if (verified.tenantId && verified.organizationId) {\n    const integrationEnabled = await isWebhookIntegrationEnabled(em, {\n      tenantId: verified.tenantId,\n      organizationId: verified.organizationId,\n    })\n\n    if (!integrationEnabled) {\n      return json({ error: 'Custom Webhooks integration is disabled' }, { status: 503 })\n    }\n  }\n\n  const messageId = resolveInboundReceiptMessageId({\n    endpointId: params.endpointId,\n    providerKey: adapter.providerKey,\n    headers,\n    body,\n  })\n  try {\n    em.persist(em.create(WebhookInboundReceiptEntity, {\n      endpointId: params.endpointId,\n      messageId,\n      providerKey: adapter.providerKey,\n      eventType: verified.eventType,\n      tenantId: verified.tenantId ?? null,\n      organizationId: verified.organizationId ?? null,\n      createdAt: new Date(),\n    }))\n    await em.flush()\n  } catch (error) {\n    if (isUniqueViolation(error)) {\n      return json({ ok: true, duplicate: true })\n    }\n    throw error\n  }\n\n  await emitWebhooksEvent('webhooks.inbound.received', {\n    providerKey: adapter.providerKey,\n    endpointId: params.endpointId,\n    messageId,\n    eventType: verified.eventType,\n    payload: verified.payload,\n    tenantId: verified.tenantId ?? null,\n    organizationId: verified.organizationId ?? null,\n  }, { persistent: true })\n\n  return json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Receive inbound webhook',\n  description: 'Verifies, rate limits, deduplicates, and processes an inbound webhook using the registered endpoint adapter.',\n  methods: {\n    POST: {\n      summary: 'Receive inbound webhook',\n      description: 'Endpoint ids currently resolve to registered adapter provider keys.',\n      pathParams: z.object({ endpointId: z.string().min(1) }),\n      responses: [{ status: 200, description: 'Inbound webhook accepted', schema: inboundResponseSchema }],\n      errors: [\n        { status: 400, description: 'Verification failed', schema: errorSchema },\n        { status: 404, description: 'Endpoint not found', schema: errorSchema },\n        { status: 429, description: 'Rate limit exceeded', schema: errorSchema },\n        { status: 503, description: 'Webhook integration disabled', schema: errorSchema },\n      ],\n    },\n  },\n}\n\nfunction tryResolve<T>(container: { resolve: (name: string) => unknown }, name: string): T | null {\n  try {\n    return container.resolve(name) as T\n  } catch {\n    return null\n  }\n}\n\nfunction isUniqueViolation(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const maybeError = error as { code?: string; cause?: unknown }\n  if (maybeError.code === '23505') return true\n  if (!maybeError.cause || typeof maybeError.cause !== 'object') return false\n  return (maybeError.cause as { code?: string }).code === '23505'\n}\n\ntype ResolveInboundReceiptMessageIdInput = {\n  endpointId: string\n  providerKey: string\n  headers: Record<string, string>\n  body: string\n}\n\nexport function buildInboundRateLimitKey(endpointId: string, request: Request, trustProxyDepth: number): string {\n  const clientIp = getClientIp(request, trustProxyDepth)\n  return clientIp ? `${endpointId}:ip:${clientIp}` : `${endpointId}:global`\n}\n\nexport function resolveInboundReceiptMessageId(\n  input: ResolveInboundReceiptMessageIdInput\n): string {\n  const explicitMessageId = input.headers['webhook-id'] ?? input.headers['svix-id'] ?? null\n  if (typeof explicitMessageId === 'string' && explicitMessageId.trim().length > 0) {\n    return explicitMessageId.trim()\n  }\n\n  const timestamp =\n    input.headers['webhook-timestamp'] ??\n    input.headers['svix-timestamp'] ??\n    null\n\n  if (typeof timestamp === 'string' && timestamp.trim().length > 0) {\n    const digest = createHash('sha256')\n      .update(input.providerKey)\n      .update(':')\n      .update(input.endpointId)\n      .update(':')\n      .update(timestamp.trim())\n      .update(':')\n      .update(input.body)\n      .digest('hex')\n\n    return `derived:${timestamp.trim()}:${digest}`\n  }\n\n  const digest = createHash('sha256')\n    .update(input.providerKey)\n    .update(':')\n    .update(input.endpointId)\n    .update(':')\n    .update(input.body)\n    .digest('hex')\n\n  return `derived:no-timestamp:${digest}`\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAG3B,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,gBAAgB,aAAa,2BAA2B,4BAA4B;AAE7F,SAAS,yBAAyB;AAClC,SAAS,iCAAiC;AAC1C,SAAS,mCAAmC;AAC5C,SAAS,YAAY;AACrB,SAAS,mCAAmC;AAErC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAMA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ;AAAA,EACd,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,eAAsB,KAAK,SAAkB,SAA0C;AACrF,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,UAAU,0BAA0B,OAAO,UAAU;AAC3D,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,SAAS;AACZ,WAAO,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,qBAAqB,WAA+B,WAAW,oBAAoB;AAEzF,MAAI,oBAAoB;AACtB,UAAM,oBAAoB,MAAM;AAAA,MAC9B;AAAA,MACA,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW,oBAAoB,OAAO,UAAU,GAAG;AAAA,MAC/E,yBAAyB,OAAO,YAAY,SAAS,mBAAmB,eAAe;AAAA,MACvF,UAAU,sBAAsB,yBAAyB;AAAA,IAC3D;AAEA,QAAI,kBAAmB,QAAO;AAAA,EAChC;AAEA,QAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,QAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ,QAAQ,CAAC;AAC5D,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,cAAc;AAAA,MACrC;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/D;AAEA,MAAI,SAAS,YAAY,SAAS,gBAAgB;AAChD,UAAM,qBAAqB,MAAM,4BAA4B,IAAI;AAAA,MAC/D,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B,CAAC;AAED,QAAI,CAAC,oBAAoB;AACvB,aAAO,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,YAAY,+BAA+B;AAAA,IAC/C,YAAY,OAAO;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI;AACF,OAAG,QAAQ,GAAG,OAAO,6BAA6B;AAAA,MAChD,YAAY,OAAO;AAAA,MACnB;AAAA,MACA,aAAa,QAAQ;AAAA,MACrB,WAAW,SAAS;AAAA,MACpB,UAAU,SAAS,YAAY;AAAA,MAC/B,gBAAgB,SAAS,kBAAkB;AAAA,MAC3C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,CAAC;AACF,UAAM,GAAG,MAAM;AAAA,EACjB,SAAS,OAAO;AACd,QAAI,kBAAkB,KAAK,GAAG;AAC5B,aAAO,KAAK,EAAE,IAAI,MAAM,WAAW,KAAK,CAAC;AAAA,IAC3C;AACA,UAAM;AAAA,EACR;AAEA,QAAM,kBAAkB,6BAA6B;AAAA,IACnD,aAAa,QAAQ;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB;AAAA,IACA,WAAW,SAAS;AAAA,IACpB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS,YAAY;AAAA,IAC/B,gBAAgB,SAAS,kBAAkB;AAAA,EAC7C,GAAG,EAAE,YAAY,KAAK,CAAC;AAEvB,SAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAC1B;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,MACtD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB,CAAC;AAAA,MACnG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,YAAY;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,WAAc,WAAmD,MAAwB;AAChG,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,OAAyB;AAClD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,aAAa;AACnB,MAAI,WAAW,SAAS,QAAS,QAAO;AACxC,MAAI,CAAC,WAAW,SAAS,OAAO,WAAW,UAAU,SAAU,QAAO;AACtE,SAAQ,WAAW,MAA4B,SAAS;AAC1D;AASO,SAAS,yBAAyB,YAAoB,SAAkB,iBAAiC;AAC9G,QAAM,WAAW,YAAY,SAAS,eAAe;AACrD,SAAO,WAAW,GAAG,UAAU,OAAO,QAAQ,KAAK,GAAG,UAAU;AAClE;AAEO,SAAS,+BACd,OACQ;AACR,QAAM,oBAAoB,MAAM,QAAQ,YAAY,KAAK,MAAM,QAAQ,SAAS,KAAK;AACrF,MAAI,OAAO,sBAAsB,YAAY,kBAAkB,KAAK,EAAE,SAAS,GAAG;AAChF,WAAO,kBAAkB,KAAK;AAAA,EAChC;AAEA,QAAM,YACJ,MAAM,QAAQ,mBAAmB,KACjC,MAAM,QAAQ,gBAAgB,KAC9B;AAEF,MAAI,OAAO,cAAc,YAAY,UAAU,KAAK,EAAE,SAAS,GAAG;AAChE,UAAMA,UAAS,WAAW,QAAQ,EAC/B,OAAO,MAAM,WAAW,EACxB,OAAO,GAAG,EACV,OAAO,MAAM,UAAU,EACvB,OAAO,GAAG,EACV,OAAO,UAAU,KAAK,CAAC,EACvB,OAAO,GAAG,EACV,OAAO,MAAM,IAAI,EACjB,OAAO,KAAK;AAEf,WAAO,WAAW,UAAU,KAAK,CAAC,IAAIA,OAAM;AAAA,EAC9C;AAEA,QAAM,SAAS,WAAW,QAAQ,EAC/B,OAAO,MAAM,WAAW,EACxB,OAAO,GAAG,EACV,OAAO,MAAM,UAAU,EACvB,OAAO,GAAG,EACV,OAAO,MAAM,IAAI,EACjB,OAAO,KAAK;AAEf,SAAO,wBAAwB,MAAM;AACvC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_ERROR_KEY } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport { emitWebhooksEvent } from '../../../events'\nimport { getWebhookEndpointAdapter } from '../../../lib/adapter-registry'\nimport { isWebhookIntegrationEnabled, WEBHOOK_INTEGRATION_DISABLED_MESSAGE } from '../../../lib/integration-state'\nimport { json } from '../../helpers'\nimport { WebhookInboundReceiptEntity } from '../../../data/entities'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\ninterface RouteContext {\n  params: Promise<{ endpointId: string }>\n}\n\nconst inboundResponseSchema = z.object({\n  ok: z.boolean(),\n  duplicate: z.boolean().optional(),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nexport async function POST(request: Request, context: RouteContext): Promise<Response> {\n  const params = await context.params\n  const adapter = getWebhookEndpointAdapter(params.endpointId)\n  const { translate } = await resolveTranslations()\n\n  if (!adapter) {\n    return json({ error: 'Webhook endpoint not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n  const rateLimiterService = tryResolve<RateLimiterService>(container, 'rateLimiterService')\n\n  if (rateLimiterService) {\n    const rateLimitResponse = await checkRateLimit(\n      rateLimiterService,\n      { points: 60, duration: 60, keyPrefix: `webhooks:inbound:${params.endpointId}` },\n      buildInboundRateLimitKey(params.endpointId, request, rateLimiterService.trustProxyDepth),\n      translate(RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK),\n    )\n\n    if (rateLimitResponse) return rateLimitResponse\n  }\n\n  const body = await request.text()\n  const headers = Object.fromEntries(request.headers.entries())\n  let verified: Awaited<ReturnType<typeof adapter.verifyWebhook>>\n  try {\n    verified = await adapter.verifyWebhook({\n      headers,\n      body,\n      method: request.method,\n    })\n  } catch {\n    return json({ error: 'Verification failed' }, { status: 400 })\n  }\n\n  const hasTenantId = Boolean(verified.tenantId)\n  const hasOrganizationId = Boolean(verified.organizationId)\n  if (hasTenantId !== hasOrganizationId) {\n    return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 })\n  }\n\n  const integrationScope = hasTenantId && hasOrganizationId\n    ? { tenantId: verified.tenantId as string, organizationId: verified.organizationId as string }\n    : null\n\n  if (integrationScope) {\n    const integrationEnabled = await isWebhookIntegrationEnabled(em, integrationScope)\n    if (!integrationEnabled) {\n      return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 })\n    }\n  } else if (!adapter.allowUnscopedInbound) {\n    return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 })\n  }\n\n  const messageId = resolveInboundReceiptMessageId({\n    endpointId: params.endpointId,\n    providerKey: adapter.providerKey,\n    headers,\n    body,\n  })\n  try {\n    em.persist(em.create(WebhookInboundReceiptEntity, {\n      endpointId: params.endpointId,\n      messageId,\n      providerKey: adapter.providerKey,\n      eventType: verified.eventType,\n      tenantId: verified.tenantId ?? null,\n      organizationId: verified.organizationId ?? null,\n      createdAt: new Date(),\n    }))\n    await em.flush()\n  } catch (error) {\n    if (isUniqueViolation(error)) {\n      return json({ ok: true, duplicate: true })\n    }\n    throw error\n  }\n\n  await emitWebhooksEvent('webhooks.inbound.received', {\n    providerKey: adapter.providerKey,\n    endpointId: params.endpointId,\n    messageId,\n    eventType: verified.eventType,\n    payload: verified.payload,\n    tenantId: verified.tenantId ?? null,\n    organizationId: verified.organizationId ?? null,\n  }, { persistent: true })\n\n  return json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Receive inbound webhook',\n  description: 'Verifies, rate limits, deduplicates, and processes an inbound webhook using the registered endpoint adapter.',\n  methods: {\n    POST: {\n      summary: 'Receive inbound webhook',\n      description: 'Endpoint ids currently resolve to registered adapter provider keys.',\n      pathParams: z.object({ endpointId: z.string().min(1) }),\n      responses: [{ status: 200, description: 'Inbound webhook accepted', schema: inboundResponseSchema }],\n      errors: [\n        { status: 400, description: 'Verification failed', schema: errorSchema },\n        { status: 404, description: 'Endpoint not found', schema: errorSchema },\n        { status: 429, description: 'Rate limit exceeded', schema: errorSchema },\n        { status: 503, description: 'Webhook integration disabled', schema: errorSchema },\n      ],\n    },\n  },\n}\n\nfunction tryResolve<T>(container: { resolve: (name: string) => unknown }, name: string): T | null {\n  try {\n    return container.resolve(name) as T\n  } catch {\n    return null\n  }\n}\n\nfunction isUniqueViolation(error: unknown): boolean {\n  if (!error || typeof error !== 'object') return false\n  const maybeError = error as { code?: string; cause?: unknown }\n  if (maybeError.code === '23505') return true\n  if (!maybeError.cause || typeof maybeError.cause !== 'object') return false\n  return (maybeError.cause as { code?: string }).code === '23505'\n}\n\ntype ResolveInboundReceiptMessageIdInput = {\n  endpointId: string\n  providerKey: string\n  headers: Record<string, string>\n  body: string\n}\n\nexport function buildInboundRateLimitKey(endpointId: string, request: Request, trustProxyDepth: number): string {\n  const clientIp = getClientIp(request, trustProxyDepth)\n  return clientIp ? `${endpointId}:ip:${clientIp}` : `${endpointId}:global`\n}\n\nexport function resolveInboundReceiptMessageId(\n  input: ResolveInboundReceiptMessageIdInput\n): string {\n  const explicitMessageId = input.headers['webhook-id'] ?? input.headers['svix-id'] ?? null\n  if (typeof explicitMessageId === 'string' && explicitMessageId.trim().length > 0) {\n    return explicitMessageId.trim()\n  }\n\n  const timestamp =\n    input.headers['webhook-timestamp'] ??\n    input.headers['svix-timestamp'] ??\n    null\n\n  if (typeof timestamp === 'string' && timestamp.trim().length > 0) {\n    const digest = createHash('sha256')\n      .update(input.providerKey)\n      .update(':')\n      .update(input.endpointId)\n      .update(':')\n      .update(timestamp.trim())\n      .update(':')\n      .update(input.body)\n      .digest('hex')\n\n    return `derived:${timestamp.trim()}:${digest}`\n  }\n\n  const digest = createHash('sha256')\n    .update(input.providerKey)\n    .update(':')\n    .update(input.endpointId)\n    .update(':')\n    .update(input.body)\n    .digest('hex')\n\n  return `derived:no-timestamp:${digest}`\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAG3B,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,gBAAgB,aAAa,2BAA2B,4BAA4B;AAE7F,SAAS,yBAAyB;AAClC,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B,4CAA4C;AAClF,SAAS,YAAY;AACrB,SAAS,mCAAmC;AAErC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAMA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,QAAQ;AAAA,EACd,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,eAAsB,KAAK,SAAkB,SAA0C;AACrF,QAAM,SAAS,MAAM,QAAQ;AAC7B,QAAM,UAAU,0BAA0B,OAAO,UAAU;AAC3D,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,SAAS;AACZ,WAAO,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,qBAAqB,WAA+B,WAAW,oBAAoB;AAEzF,MAAI,oBAAoB;AACtB,UAAM,oBAAoB,MAAM;AAAA,MAC9B;AAAA,MACA,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW,oBAAoB,OAAO,UAAU,GAAG;AAAA,MAC/E,yBAAyB,OAAO,YAAY,SAAS,mBAAmB,eAAe;AAAA,MACvF,UAAU,sBAAsB,yBAAyB;AAAA,IAC3D;AAEA,QAAI,kBAAmB,QAAO;AAAA,EAChC;AAEA,QAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,QAAM,UAAU,OAAO,YAAY,QAAQ,QAAQ,QAAQ,CAAC;AAC5D,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,cAAc;AAAA,MACrC;AAAA,MACA;AAAA,MACA,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/D;AAEA,QAAM,cAAc,QAAQ,SAAS,QAAQ;AAC7C,QAAM,oBAAoB,QAAQ,SAAS,cAAc;AACzD,MAAI,gBAAgB,mBAAmB;AACrC,WAAO,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,mBAAmB,eAAe,oBACpC,EAAE,UAAU,SAAS,UAAoB,gBAAgB,SAAS,eAAyB,IAC3F;AAEJ,MAAI,kBAAkB;AACpB,UAAM,qBAAqB,MAAM,4BAA4B,IAAI,gBAAgB;AACjF,QAAI,CAAC,oBAAoB;AACvB,aAAO,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAAA,EACF,WAAW,CAAC,QAAQ,sBAAsB;AACxC,WAAO,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,+BAA+B;AAAA,IAC/C,YAAY,OAAO;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI;AACF,OAAG,QAAQ,GAAG,OAAO,6BAA6B;AAAA,MAChD,YAAY,OAAO;AAAA,MACnB;AAAA,MACA,aAAa,QAAQ;AAAA,MACrB,WAAW,SAAS;AAAA,MACpB,UAAU,SAAS,YAAY;AAAA,MAC/B,gBAAgB,SAAS,kBAAkB;AAAA,MAC3C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC,CAAC;AACF,UAAM,GAAG,MAAM;AAAA,EACjB,SAAS,OAAO;AACd,QAAI,kBAAkB,KAAK,GAAG;AAC5B,aAAO,KAAK,EAAE,IAAI,MAAM,WAAW,KAAK,CAAC;AAAA,IAC3C;AACA,UAAM;AAAA,EACR;AAEA,QAAM,kBAAkB,6BAA6B;AAAA,IACnD,aAAa,QAAQ;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB;AAAA,IACA,WAAW,SAAS;AAAA,IACpB,SAAS,SAAS;AAAA,IAClB,UAAU,SAAS,YAAY;AAAA,IAC/B,gBAAgB,SAAS,kBAAkB;AAAA,EAC7C,GAAG,EAAE,YAAY,KAAK,CAAC;AAEvB,SAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AAC1B;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,MACtD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB,CAAC;AAAA,MACnG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,YAAY;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,WAAc,WAAmD,MAAwB;AAChG,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,OAAyB;AAClD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,aAAa;AACnB,MAAI,WAAW,SAAS,QAAS,QAAO;AACxC,MAAI,CAAC,WAAW,SAAS,OAAO,WAAW,UAAU,SAAU,QAAO;AACtE,SAAQ,WAAW,MAA4B,SAAS;AAC1D;AASO,SAAS,yBAAyB,YAAoB,SAAkB,iBAAiC;AAC9G,QAAM,WAAW,YAAY,SAAS,eAAe;AACrD,SAAO,WAAW,GAAG,UAAU,OAAO,QAAQ,KAAK,GAAG,UAAU;AAClE;AAEO,SAAS,+BACd,OACQ;AACR,QAAM,oBAAoB,MAAM,QAAQ,YAAY,KAAK,MAAM,QAAQ,SAAS,KAAK;AACrF,MAAI,OAAO,sBAAsB,YAAY,kBAAkB,KAAK,EAAE,SAAS,GAAG;AAChF,WAAO,kBAAkB,KAAK;AAAA,EAChC;AAEA,QAAM,YACJ,MAAM,QAAQ,mBAAmB,KACjC,MAAM,QAAQ,gBAAgB,KAC9B;AAEF,MAAI,OAAO,cAAc,YAAY,UAAU,KAAK,EAAE,SAAS,GAAG;AAChE,UAAMA,UAAS,WAAW,QAAQ,EAC/B,OAAO,MAAM,WAAW,EACxB,OAAO,GAAG,EACV,OAAO,MAAM,UAAU,EACvB,OAAO,GAAG,EACV,OAAO,UAAU,KAAK,CAAC,EACvB,OAAO,GAAG,EACV,OAAO,MAAM,IAAI,EACjB,OAAO,KAAK;AAEf,WAAO,WAAW,UAAU,KAAK,CAAC,IAAIA,OAAM;AAAA,EAC9C;AAEA,QAAM,SAAS,WAAW,QAAQ,EAC/B,OAAO,MAAM,WAAW,EACxB,OAAO,GAAG,EACV,OAAO,MAAM,UAAU,EACvB,OAAO,GAAG,EACV,OAAO,MAAM,IAAI,EACjB,OAAO,KAAK;AAEf,SAAO,wBAAwB,MAAM;AACvC;",
   "names": ["digest"]
 }

package/dist/modules/webhooks/lib/adapter-registry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/webhooks/lib/adapter-registry.ts"],
-  "sourcesContent": ["const WEBHOOK_ENDPOINT_ADAPTERS_KEY = '__openMercatoWebhookEndpointAdapters__'\n\nexport interface WebhookEndpointAdapter {\n  readonly providerKey: string\n  readonly subscribedEvents: string[]\n\n  formatPayload?(event: { type: string; data: unknown }): Promise<{\n    url: string\n    headers: Record<string, string>\n    body: Record<string, unknown>\n    method: 'POST' | 'PUT' | 'PATCH'\n  }>\n\n  verifyWebhook(input: {\n    headers: Record<string, string>\n    body: string\n    method: string\n  }): Promise<{\n    eventType: string\n    payload: Record<string, unknown>\n    tenantId?: string\n    organizationId?: string\n  }>\n\n  processInbound(event: {\n    eventType: string\n    payload: Record<string, unknown>\n    tenantId?: string\n    organizationId?: string\n    providerKey: string\n  }): Promise<void>\n}\n\nfunction getRegistry(): Map<string, WebhookEndpointAdapter> {\n  const globalState = globalThis as typeof globalThis & {\n    [WEBHOOK_ENDPOINT_ADAPTERS_KEY]?: Map<string, WebhookEndpointAdapter>\n  }\n\n  if (!globalState[WEBHOOK_ENDPOINT_ADAPTERS_KEY]) {\n    globalState[WEBHOOK_ENDPOINT_ADAPTERS_KEY] = new Map<string, WebhookEndpointAdapter>()\n  }\n\n  return globalState[WEBHOOK_ENDPOINT_ADAPTERS_KEY]\n}\n\nexport function registerWebhookEndpointAdapter(adapter: WebhookEndpointAdapter): () => void {\n  const registry = getRegistry()\n  registry.set(adapter.providerKey, adapter)\n  return () => {\n    registry.delete(adapter.providerKey)\n  }\n}\n\nexport function getWebhookEndpointAdapter(providerKey: string): WebhookEndpointAdapter | undefined {\n  return getRegistry().get(providerKey)\n}\n\nexport function listWebhookEndpointAdapters(): WebhookEndpointAdapter[] {\n  return Array.from(getRegistry().values())\n}\n\nexport function clearWebhookEndpointAdapters(): void {\n  getRegistry().clear()\n}\n"],
-  "mappings": "AAAA,MAAM,gCAAgC;AAiCtC,SAAS,cAAmD;AAC1D,QAAM,cAAc;AAIpB,MAAI,CAAC,YAAY,6BAA6B,GAAG;AAC/C,gBAAY,6BAA6B,IAAI,oBAAI,IAAoC;AAAA,EACvF;AAEA,SAAO,YAAY,6BAA6B;AAClD;AAEO,SAAS,+BAA+B,SAA6C;AAC1F,QAAM,WAAW,YAAY;AAC7B,WAAS,IAAI,QAAQ,aAAa,OAAO;AACzC,SAAO,MAAM;AACX,aAAS,OAAO,QAAQ,WAAW;AAAA,EACrC;AACF;AAEO,SAAS,0BAA0B,aAAyD;AACjG,SAAO,YAAY,EAAE,IAAI,WAAW;AACtC;AAEO,SAAS,8BAAwD;AACtE,SAAO,MAAM,KAAK,YAAY,EAAE,OAAO,CAAC;AAC1C;AAEO,SAAS,+BAAqC;AACnD,cAAY,EAAE,MAAM;AACtB;",
+  "sourcesContent": ["const WEBHOOK_ENDPOINT_ADAPTERS_KEY = '__openMercatoWebhookEndpointAdapters__'\n\nexport interface WebhookEndpointAdapter {\n  readonly providerKey: string\n  readonly subscribedEvents: string[]\n  /**\n   * Opt-in for adapters whose verified events intentionally cannot be mapped to\n   * tenant/organization scope. Unscoped events cannot be checked against the\n   * Custom Webhooks integration enabled state, so the inbound route rejects them\n   * by default unless an adapter explicitly declares this behavior.\n   */\n  readonly allowUnscopedInbound?: boolean\n\n  formatPayload?(event: { type: string; data: unknown }): Promise<{\n    url: string\n    headers: Record<string, string>\n    body: Record<string, unknown>\n    method: 'POST' | 'PUT' | 'PATCH'\n  }>\n\n  verifyWebhook(input: {\n    headers: Record<string, string>\n    body: string\n    method: string\n  }): Promise<{\n    eventType: string\n    payload: Record<string, unknown>\n    tenantId?: string\n    organizationId?: string\n  }>\n\n  processInbound(event: {\n    eventType: string\n    payload: Record<string, unknown>\n    tenantId?: string\n    organizationId?: string\n    providerKey: string\n  }): Promise<void>\n}\n\nfunction getRegistry(): Map<string, WebhookEndpointAdapter> {\n  const globalState = globalThis as typeof globalThis & {\n    [WEBHOOK_ENDPOINT_ADAPTERS_KEY]?: Map<string, WebhookEndpointAdapter>\n  }\n\n  if (!globalState[WEBHOOK_ENDPOINT_ADAPTERS_KEY]) {\n    globalState[WEBHOOK_ENDPOINT_ADAPTERS_KEY] = new Map<string, WebhookEndpointAdapter>()\n  }\n\n  return globalState[WEBHOOK_ENDPOINT_ADAPTERS_KEY]\n}\n\nexport function registerWebhookEndpointAdapter(adapter: WebhookEndpointAdapter): () => void {\n  const registry = getRegistry()\n  registry.set(adapter.providerKey, adapter)\n  return () => {\n    registry.delete(adapter.providerKey)\n  }\n}\n\nexport function getWebhookEndpointAdapter(providerKey: string): WebhookEndpointAdapter | undefined {\n  return getRegistry().get(providerKey)\n}\n\nexport function listWebhookEndpointAdapters(): WebhookEndpointAdapter[] {\n  return Array.from(getRegistry().values())\n}\n\nexport function clearWebhookEndpointAdapters(): void {\n  getRegistry().clear()\n}\n"],
+  "mappings": "AAAA,MAAM,gCAAgC;AAwCtC,SAAS,cAAmD;AAC1D,QAAM,cAAc;AAIpB,MAAI,CAAC,YAAY,6BAA6B,GAAG;AAC/C,gBAAY,6BAA6B,IAAI,oBAAI,IAAoC;AAAA,EACvF;AAEA,SAAO,YAAY,6BAA6B;AAClD;AAEO,SAAS,+BAA+B,SAA6C;AAC1F,QAAM,WAAW,YAAY;AAC7B,WAAS,IAAI,QAAQ,aAAa,OAAO;AACzC,SAAO,MAAM;AACX,aAAS,OAAO,QAAQ,WAAW;AAAA,EACrC;AACF;AAEO,SAAS,0BAA0B,aAAyD;AACjG,SAAO,YAAY,EAAE,IAAI,WAAW;AACtC;AAEO,SAAS,8BAAwD;AACtE,SAAO,MAAM,KAAK,YAAY,EAAE,OAAO,CAAC;AAC1C;AAEO,SAAS,+BAAqC;AACnD,cAAY,EAAE,MAAM;AACtB;",
   "names": []
 }

package/dist/modules/webhooks/workers/webhook-delivery.js

@@ -9,11 +9,11 @@ const metadata = {
 async function handler(job, ctx) {
   const em = ctx.resolve("em").fork();
   try {
-    await processWebhookDeliveryJob(em, job.data);
+    await processWebhookDeliveryJob(em, job.payload);
   } catch (error) {
     logger.error("Job processing failed", {
-      deliveryId: job.data.deliveryId,
-      tenantId: job.data.tenantId,
+      deliveryId: job.payload?.deliveryId,
+      tenantId: job.payload?.tenantId,
       err: error
     });
     throw error;

package/dist/modules/webhooks/workers/webhook-delivery.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/webhooks/workers/webhook-delivery.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { processWebhookDeliveryJob, type WebhookDeliveryJob } from '../lib/delivery'\n\nconst logger = createLogger('webhooks').child({ component: 'delivery' })\n\nexport const metadata = {\n  queue: 'webhook-deliveries',\n  id: 'webhooks:delivery-worker',\n  concurrency: 10,\n}\n\nexport default async function handler(\n  job: { data: WebhookDeliveryJob },\n  ctx: { resolve: <T = unknown>(name: string) => T },\n) {\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  try {\n    await processWebhookDeliveryJob(em, job.data)\n  } catch (error) {\n    logger.error('Job processing failed', {\n      deliveryId: job.data.deliveryId,\n      tenantId: job.data.tenantId,\n      err: error,\n    })\n    throw error\n  }\n}\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,iCAA0D;AAEnE,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,WAAW,CAAC;AAEhE,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa;AACf;AAEA,eAAO,QACL,KACA,KACA;AACA,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,MAAI;AACF,UAAM,0BAA0B,IAAI,IAAI,IAAI;AAAA,EAC9C,SAAS,OAAO;AACd,WAAO,MAAM,yBAAyB;AAAA,MACpC,YAAY,IAAI,KAAK;AAAA,MACrB,UAAU,IAAI,KAAK;AAAA,MACnB,KAAK;AAAA,IACP,CAAC;AACD,UAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { processWebhookDeliveryJob, type WebhookDeliveryJob } from '../lib/delivery'\n\nconst logger = createLogger('webhooks').child({ component: 'delivery' })\n\nexport const metadata = {\n  queue: 'webhook-deliveries',\n  id: 'webhooks:delivery-worker',\n  concurrency: 10,\n}\n\nexport default async function handler(\n  job: { payload: WebhookDeliveryJob },\n  ctx: { resolve: <T = unknown>(name: string) => T },\n) {\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  try {\n    await processWebhookDeliveryJob(em, job.payload)\n  } catch (error) {\n    logger.error('Job processing failed', {\n      deliveryId: job.payload?.deliveryId,\n      tenantId: job.payload?.tenantId,\n      err: error,\n    })\n    throw error\n  }\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,iCAA0D;AAEnE,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,WAAW,CAAC;AAEhE,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa;AACf;AAEA,eAAO,QACL,KACA,KACA;AACA,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,MAAI;AACF,UAAM,0BAA0B,IAAI,IAAI,OAAO;AAAA,EACjD,SAAS,OAAO;AACd,WAAO,MAAM,yBAAyB;AAAA,MACpC,YAAY,IAAI,SAAS;AAAA,MACzB,UAAU,IAAI,SAAS;AAAA,MACvB,KAAK;AAAA,IACP,CAAC;AACD,UAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/webhooks",
-  "version": "0.6.6",
+  "version": "0.6.7-canary.316.1.e6c38e0bef",
   "license": "MIT",
   "description": "Webhooks module for Open Mercato — Standard Webhooks compliant outbound/inbound delivery",
   "type": "module",
@@ -70,19 +70,19 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.6.6",
-    "@open-mercato/queue": "0.6.6",
-    "@open-mercato/ui": "0.6.6",
+    "@open-mercato/core": "0.6.7-canary.316.1.e6c38e0bef",
+    "@open-mercato/queue": "0.6.7-canary.316.1.e6c38e0bef",
+    "@open-mercato/ui": "0.6.7-canary.316.1.e6c38e0bef",
     "svix": "^1.96.1"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^7.0.14",
-    "@open-mercato/shared": "0.6.6",
+    "@open-mercato/shared": "0.6.7-canary.316.1.e6c38e0bef",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.6",
+    "@open-mercato/shared": "0.6.7-canary.316.1.e6c38e0bef",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
@@ -92,7 +92,7 @@
     "react": "19.2.7",
     "react-dom": "19.2.7",
     "ts-jest": "^29.4.11",
-    "typescript": "^6.0.3"
+    "typescript": "7.0.2"
   },
   "publishConfig": {
     "access": "public"
@@ -101,5 +101,6 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/webhooks"
-  }
+  },
+  "stableVersion": "0.6.6"
 }

package/src/modules/webhooks/api/inbound/[endpointId]/__tests__/route.test.ts

@@ -1,4 +1,244 @@
-import { buildInboundRateLimitKey, resolveInboundReceiptMessageId } from '../route'
+/** @jest-environment node */
+
+const mockCreateRequestContainer = jest.fn()
+const mockResolveTranslations = jest.fn()
+const mockEmitWebhooksEvent = jest.fn()
+const mockGetWebhookEndpointAdapter = jest.fn()
+const mockIsWebhookIntegrationEnabled = jest.fn()
+
+const mockPersistedEntities: unknown[] = []
+
+const mockRouteEm = {
+  create: jest.fn((_entity: unknown, data: Record<string, unknown>) => ({ ...data })),
+  persist: jest.fn((entity: unknown) => {
+    mockPersistedEntities.push(entity)
+    return mockRouteEm
+  }),
+  flush: jest.fn(async () => undefined),
+}
+
+const mockRootEm = {
+  fork: jest.fn(() => mockRouteEm),
+}
+
+const mockContainer = {
+  resolve: jest.fn((name: string) => {
+    if (name === 'em') return mockRootEm
+    throw new Error(`Unexpected dependency: ${name}`)
+  }),
+}
+
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: () => mockCreateRequestContainer(),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: () => mockResolveTranslations(),
+}))
+
+jest.mock('../../../../events', () => ({
+  emitWebhooksEvent: (...args: unknown[]) => mockEmitWebhooksEvent(...args),
+}))
+
+jest.mock('../../../../lib/adapter-registry', () => ({
+  getWebhookEndpointAdapter: (...args: unknown[]) => mockGetWebhookEndpointAdapter(...args),
+}))
+
+jest.mock('../../../../lib/integration-state', () => ({
+  isWebhookIntegrationEnabled: (...args: unknown[]) => mockIsWebhookIntegrationEnabled(...args),
+  WEBHOOK_INTEGRATION_DISABLED_MESSAGE: 'Custom Webhooks integration is disabled',
+}))
+
+jest.mock('../../../helpers', () => ({
+  json: (payload: unknown, init: ResponseInit = { status: 200 }) =>
+    new Response(JSON.stringify(payload), {
+      ...init,
+      headers: { 'content-type': 'application/json' },
+    }),
+}))
+
+import type { WebhookEndpointAdapter } from '../../../../lib/adapter-registry'
+import { POST, buildInboundRateLimitKey, resolveInboundReceiptMessageId } from '../route'
+
+const routeContext = { params: Promise.resolve({ endpointId: 'mock_inbound' }) }
+
+function createRequest(body: string = '{"ok":true}') {
+  return new Request('http://localhost/api/webhooks/inbound/mock_inbound', {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'webhook-id': 'msg-1',
+    },
+    body,
+  })
+}
+
+function createAdapter(
+  verified: Awaited<ReturnType<WebhookEndpointAdapter['verifyWebhook']>>,
+  overrides: Partial<WebhookEndpointAdapter> = {},
+): WebhookEndpointAdapter {
+  return {
+    providerKey: 'mock_inbound',
+    subscribedEvents: ['*'],
+    verifyWebhook: jest.fn(async () => verified),
+    processInbound: jest.fn(async () => undefined),
+    ...overrides,
+  }
+}
+
+describe('POST', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockPersistedEntities.length = 0
+    mockCreateRequestContainer.mockResolvedValue(mockContainer)
+    mockResolveTranslations.mockResolvedValue({
+      translate: (_key: string, fallback?: string) => fallback ?? '',
+    })
+    mockIsWebhookIntegrationEnabled.mockResolvedValue(true)
+  })
+
+  it('rejects verified inbound webhooks without tenant and organization scope before side effects', async () => {
+    mockGetWebhookEndpointAdapter.mockReturnValue(createAdapter({
+      eventType: 'mock.inbound.received',
+      payload: { ok: true },
+    }))
+
+    const response = await POST(createRequest(), routeContext)
+
+    expect(response.status).toBe(503)
+    await expect(response.json()).resolves.toEqual({
+      error: 'Custom Webhooks integration is disabled',
+    })
+    expect(mockIsWebhookIntegrationEnabled).not.toHaveBeenCalled()
+    expect(mockRouteEm.persist).not.toHaveBeenCalled()
+    expect(mockRouteEm.flush).not.toHaveBeenCalled()
+    expect(mockEmitWebhooksEvent).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    ['tenant only', { tenantId: 'tenant-1' }],
+    ['organization only', { organizationId: 'org-1' }],
+  ] as const)('rejects verified inbound webhooks with partial scope before side effects: %s', async (_label, partialScope) => {
+    mockGetWebhookEndpointAdapter.mockReturnValue(createAdapter({
+      eventType: 'mock.inbound.received',
+      payload: { ok: true },
+      ...partialScope,
+    }))
+
+    const response = await POST(createRequest(), routeContext)
+
+    expect(response.status).toBe(503)
+    await expect(response.json()).resolves.toEqual({
+      error: 'Custom Webhooks integration is disabled',
+    })
+    expect(mockIsWebhookIntegrationEnabled).not.toHaveBeenCalled()
+    expect(mockRouteEm.persist).not.toHaveBeenCalled()
+    expect(mockRouteEm.flush).not.toHaveBeenCalled()
+    expect(mockEmitWebhooksEvent).not.toHaveBeenCalled()
+  })
+
+  it('allows adapters that explicitly opt in to unscoped inbound events', async () => {
+    mockGetWebhookEndpointAdapter.mockReturnValue(createAdapter(
+      {
+        eventType: 'mock.inbound.received',
+        payload: { ok: true },
+      },
+      { allowUnscopedInbound: true },
+    ))
+
+    const response = await POST(createRequest(), routeContext)
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({ ok: true })
+    expect(mockIsWebhookIntegrationEnabled).not.toHaveBeenCalled()
+    expect(mockPersistedEntities).toEqual([
+      expect.objectContaining({
+        endpointId: 'mock_inbound',
+        messageId: 'msg-1',
+        providerKey: 'mock_inbound',
+        eventType: 'mock.inbound.received',
+        tenantId: null,
+        organizationId: null,
+      }),
+    ])
+    expect(mockEmitWebhooksEvent).toHaveBeenCalledWith(
+      'webhooks.inbound.received',
+      expect.objectContaining({
+        providerKey: 'mock_inbound',
+        endpointId: 'mock_inbound',
+        messageId: 'msg-1',
+        eventType: 'mock.inbound.received',
+        tenantId: null,
+        organizationId: null,
+      }),
+      { persistent: true },
+    )
+  })
+
+  it('rejects scoped inbound webhooks before side effects when the integration is disabled', async () => {
+    mockIsWebhookIntegrationEnabled.mockResolvedValue(false)
+    mockGetWebhookEndpointAdapter.mockReturnValue(createAdapter({
+      eventType: 'mock.inbound.received',
+      payload: { ok: true },
+      tenantId: 'tenant-1',
+      organizationId: 'org-1',
+    }))
+
+    const response = await POST(createRequest(), routeContext)
+
+    expect(response.status).toBe(503)
+    await expect(response.json()).resolves.toEqual({
+      error: 'Custom Webhooks integration is disabled',
+    })
+    expect(mockIsWebhookIntegrationEnabled).toHaveBeenCalledWith(mockRouteEm, {
+      tenantId: 'tenant-1',
+      organizationId: 'org-1',
+    })
+    expect(mockRouteEm.persist).not.toHaveBeenCalled()
+    expect(mockRouteEm.flush).not.toHaveBeenCalled()
+    expect(mockEmitWebhooksEvent).not.toHaveBeenCalled()
+  })
+
+  it('persists and emits scoped inbound webhooks when the integration is enabled', async () => {
+    mockGetWebhookEndpointAdapter.mockReturnValue(createAdapter({
+      eventType: 'mock.inbound.received',
+      payload: { ok: true },
+      tenantId: 'tenant-1',
+      organizationId: 'org-1',
+    }))
+
+    const response = await POST(createRequest(), routeContext)
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({ ok: true })
+    expect(mockIsWebhookIntegrationEnabled).toHaveBeenCalledWith(mockRouteEm, {
+      tenantId: 'tenant-1',
+      organizationId: 'org-1',
+    })
+    expect(mockPersistedEntities).toEqual([
+      expect.objectContaining({
+        endpointId: 'mock_inbound',
+        messageId: 'msg-1',
+        providerKey: 'mock_inbound',
+        eventType: 'mock.inbound.received',
+        tenantId: 'tenant-1',
+        organizationId: 'org-1',
+      }),
+    ])
+    expect(mockEmitWebhooksEvent).toHaveBeenCalledWith(
+      'webhooks.inbound.received',
+      expect.objectContaining({
+        providerKey: 'mock_inbound',
+        endpointId: 'mock_inbound',
+        messageId: 'msg-1',
+        eventType: 'mock.inbound.received',
+        tenantId: 'tenant-1',
+        organizationId: 'org-1',
+      }),
+      { persistent: true },
+    )
+  })
+})
 
 describe('buildInboundRateLimitKey', () => {
   it('uses an endpoint-global bucket when proxy headers are untrusted', () => {

package/src/modules/webhooks/api/inbound/[endpointId]/route.ts

@@ -8,7 +8,7 @@ import { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_ERRO
 import type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'
 import { emitWebhooksEvent } from '../../../events'
 import { getWebhookEndpointAdapter } from '../../../lib/adapter-registry'
-import { isWebhookIntegrationEnabled } from '../../../lib/integration-state'
+import { isWebhookIntegrationEnabled, WEBHOOK_INTEGRATION_DISABLED_MESSAGE } from '../../../lib/integration-state'
 import { json } from '../../helpers'
 import { WebhookInboundReceiptEntity } from '../../../data/entities'
 
@@ -64,15 +64,23 @@ export async function POST(request: Request, context: RouteContext): Promise<Res
     return json({ error: 'Verification failed' }, { status: 400 })
   }
 
-  if (verified.tenantId && verified.organizationId) {
-    const integrationEnabled = await isWebhookIntegrationEnabled(em, {
-      tenantId: verified.tenantId,
-      organizationId: verified.organizationId,
-    })
+  const hasTenantId = Boolean(verified.tenantId)
+  const hasOrganizationId = Boolean(verified.organizationId)
+  if (hasTenantId !== hasOrganizationId) {
+    return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 })
+  }
+
+  const integrationScope = hasTenantId && hasOrganizationId
+    ? { tenantId: verified.tenantId as string, organizationId: verified.organizationId as string }
+    : null
 
+  if (integrationScope) {
+    const integrationEnabled = await isWebhookIntegrationEnabled(em, integrationScope)
     if (!integrationEnabled) {
-      return json({ error: 'Custom Webhooks integration is disabled' }, { status: 503 })
+      return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 })
     }
+  } else if (!adapter.allowUnscopedInbound) {
+    return json({ error: WEBHOOK_INTEGRATION_DISABLED_MESSAGE }, { status: 503 })
   }
 
   const messageId = resolveInboundReceiptMessageId({

package/src/modules/webhooks/i18n/pl.json

@@ -1,104 +1,104 @@
 {
-  "webhooks.deliveries.actions.retry": "Retry",
+  "webhooks.deliveries.actions.retry": "Ponów",
   "webhooks.deliveries.actions.viewDetails": "Zobacz szczegóły",
-  "webhooks.deliveries.autoRefreshHint": "The delivery log refreshes automatically while this page is open.",
-  "webhooks.deliveries.columns.attempts": "Attempts",
-  "webhooks.deliveries.columns.createdAt": "Time",
-  "webhooks.deliveries.columns.duration": "Duration",
-  "webhooks.deliveries.columns.enqueuedAt": "Enqueued At",
-  "webhooks.deliveries.columns.event": "Event",
-  "webhooks.deliveries.columns.responseStatus": "HTTP Status",
+  "webhooks.deliveries.autoRefreshHint": "Log dostaw odświeża się automatycznie, dopóki ta strona jest otwarta.",
+  "webhooks.deliveries.columns.attempts": "Próby",
+  "webhooks.deliveries.columns.createdAt": "Czas",
+  "webhooks.deliveries.columns.duration": "Czas trwania",
+  "webhooks.deliveries.columns.enqueuedAt": "Dodano do kolejki",
+  "webhooks.deliveries.columns.event": "Zdarzenie",
+  "webhooks.deliveries.columns.responseStatus": "Status HTTP",
   "webhooks.deliveries.columns.status": "Status",
-  "webhooks.deliveries.detailTitle": "Delivery Detail",
-  "webhooks.deliveries.empty": "No delivery attempts yet.",
-  "webhooks.deliveries.loadError": "Failed to load delivery detail.",
-  "webhooks.deliveries.refresh": "Refresh",
-  "webhooks.deliveries.refreshing": "Refreshing...",
-  "webhooks.deliveries.requestBody": "Request Body",
-  "webhooks.deliveries.responseBody": "Response Body",
-  "webhooks.deliveries.responseHeaders": "Response Headers",
-  "webhooks.deliveries.retryError": "Failed to retry delivery.",
-  "webhooks.deliveries.retrySuccess": "Delivery re-enqueued successfully.",
-  "webhooks.deliveries.status.delivered": "Delivered",
-  "webhooks.deliveries.status.expired": "Expired",
-  "webhooks.deliveries.status.failed": "Failed",
-  "webhooks.deliveries.status.pending": "Pending",
-  "webhooks.deliveries.status.sending": "Sending",
-  "webhooks.deliveries.title": "Delivery Log",
-  "webhooks.detail.actions.activate": "Activate",
-  "webhooks.detail.actions.deactivate": "Deactivate",
-  "webhooks.detail.actions.rotateSecret": "Rotate Secret",
-  "webhooks.detail.actions.test": "Send Test",
+  "webhooks.deliveries.detailTitle": "Szczegóły dostawy",
+  "webhooks.deliveries.empty": "Nie ma jeszcze żadnych prób dostawy.",
+  "webhooks.deliveries.loadError": "Nie udało się załadować szczegółów dostawy.",
+  "webhooks.deliveries.refresh": "Odśwież",
+  "webhooks.deliveries.refreshing": "Odświeżanie...",
+  "webhooks.deliveries.requestBody": "Treść żądania",
+  "webhooks.deliveries.responseBody": "Treść odpowiedzi",
+  "webhooks.deliveries.responseHeaders": "Nagłówki odpowiedzi",
+  "webhooks.deliveries.retryError": "Nie udało się ponowić dostawy.",
+  "webhooks.deliveries.retrySuccess": "Dostawa została ponownie dodana do kolejki.",
+  "webhooks.deliveries.status.delivered": "Dostarczono",
+  "webhooks.deliveries.status.expired": "Wygasła",
+  "webhooks.deliveries.status.failed": "Niepowodzenie",
+  "webhooks.deliveries.status.pending": "Oczekuje",
+  "webhooks.deliveries.status.sending": "Wysyłanie",
+  "webhooks.deliveries.title": "Log dostaw",
+  "webhooks.detail.actions.activate": "Aktywuj",
+  "webhooks.detail.actions.deactivate": "Dezaktywuj",
+  "webhooks.detail.actions.rotateSecret": "Zmień sekret",
+  "webhooks.detail.actions.test": "Wyślij test",
   "webhooks.detail.backToList": "Wróć do webhooków",
-  "webhooks.detail.consecutiveFailures": "Consecutive Failures",
-  "webhooks.detail.deliveryTip": "Start with a test delivery before enabling a broad event pattern. The delivery log below shows exactly what your consumer returned.",
-  "webhooks.detail.loadError": "Failed to load webhook.",
-  "webhooks.detail.loading": "Loading webhook details...",
-  "webhooks.detail.previousSecretSetAt": "Previous Secret Active Since",
-  "webhooks.detail.readOnlyTip": "You currently have read-only access. Ask an administrator for manage, test, or secret rotation permissions if you need to change this endpoint.",
-  "webhooks.detail.rotateError": "Failed to rotate webhook secret.",
-  "webhooks.detail.rotateSuccess": "Webhook secret rotated",
-  "webhooks.detail.signatureTip": "Consumers should verify the Standard Webhooks headers: webhook-id, webhook-timestamp, and webhook-signature.",
-  "webhooks.detail.testError": "Failed to send test delivery.",
-  "webhooks.detail.testQueued": "Test delivery finished with a non-success status.",
-  "webhooks.detail.testResult": "Latest Test Result",
-  "webhooks.detail.testSuccess": "Test delivery succeeded.",
-  "webhooks.detail.title": "Webhook Detail",
-  "webhooks.errors.forbidden": "You do not have permission to perform this action.",
-  "webhooks.errors.notFound": "Webhook not found.",
-  "webhooks.errors.orgRequired": "Organization context required.",
-  "webhooks.errors.tenantRequired": "Tenant context required.",
-  "webhooks.form.advancedStrategyTip": "HTTP delivery is active today. Use custom headers for routing hints, and keep secrets out of request headers.",
-  "webhooks.form.autoDisableThreshold": "Auto-Disable Threshold",
-  "webhooks.form.autoDisableThresholdHint": "Disable the webhook after this many consecutive failures (0 disables auto-disable).",
-  "webhooks.form.createError": "Failed to create webhook.",
-  "webhooks.form.createSuccess": "Webhook created successfully.",
-  "webhooks.form.customHeaders": "Custom Headers",
-  "webhooks.form.customHeadersHint": "Optional JSON object of additional headers to send with each webhook request.",
-  "webhooks.form.customHeadersInvalid": "Custom headers must be a valid JSON object with string values.",
-  "webhooks.form.customHeadersTip": "Use headers for static metadata such as environment or source identifiers. Do not put access tokens or secrets here.",
-  "webhooks.form.deliveryDefaultsTip": "The defaults are a safe starting point for most consumers. Increase retries or timeout only if the receiver is known to be slow.",
-  "webhooks.form.description": "Description",
-  "webhooks.form.descriptionPlaceholder": "Optional description for this webhook",
-  "webhooks.form.events": "Subscribed Events",
-  "webhooks.form.eventsHint": "Select which events should trigger this webhook.",
-  "webhooks.form.eventsPatternTip": "Tip: you can pick exact events from the list or type wildcard patterns like customers.* or * to subscribe broadly.",
-  "webhooks.form.eventsPlaceholder": "Select events...",
-  "webhooks.form.eventsRequired": "Select at least one event.",
-  "webhooks.form.group.advanced": "Advanced",
-  "webhooks.form.group.delivery": "Delivery Settings",
-  "webhooks.form.group.events": "Event Subscription",
-  "webhooks.form.group.general": "General",
-  "webhooks.form.guidanceBody": "Configure where events should be delivered, choose the event patterns you need, then use Send Test to validate the consumer before going live.",
-  "webhooks.form.guidanceSecurityBody": "A signing secret is generated automatically. You will only see it in full after create or rotate, so store it in your receiver before closing the page.",
-  "webhooks.form.guidanceSecurityTitle": "Security Checklist",
-  "webhooks.form.guidanceTitle": "Setup Guide",
-  "webhooks.form.httpMethod": "HTTP Method",
-  "webhooks.form.isActive": "Active",
-  "webhooks.form.maxRetries": "Max Retries",
-  "webhooks.form.maxRetriesHint": "Maximum number of delivery retry attempts (0-30).",
-  "webhooks.form.name": "Name",
-  "webhooks.form.namePlaceholder": "My Webhook",
-  "webhooks.form.rateLimitPerMinute": "Rate Limit Per Minute",
-  "webhooks.form.rateLimitPerMinuteHint": "Maximum deliveries per minute for this endpoint (0 means unlimited).",
-  "webhooks.form.secret": "Signing Secret",
-  "webhooks.form.secretCopied": "Secret copied to clipboard.",
-  "webhooks.form.secretCopy": "Copy Secret",
-  "webhooks.form.secretHint": "This secret is used to sign webhook payloads. Keep it safe.",
-  "webhooks.form.secretMissing": "Webhook created but secret was not returned.",
-  "webhooks.form.secretRotationTip": "Rotate the secret only after your consumer accepts signatures generated with both the old and new secret during the transition window.",
-  "webhooks.form.secretUsageTip": "Store this secret in your receiving service now. Future reads only show a masked value.",
-  "webhooks.form.secretVerificationTip": "Use this value to verify the webhook-signature header together with webhook-id and webhook-timestamp.",
-  "webhooks.form.secretVisibleOnce": "This is the only time you can see this secret. Store it securely now.",
-  "webhooks.form.subscribedEvents": "Subscribed Events",
-  "webhooks.form.timeoutMs": "Timeout (ms)",
-  "webhooks.form.timeoutMsHint": "Request timeout in milliseconds (1000-60000).",
-  "webhooks.form.title.create": "Create Webhook",
-  "webhooks.form.title.edit": "Edit Webhook",
-  "webhooks.form.updateError": "Failed to update webhook.",
-  "webhooks.form.updateSuccess": "Webhook updated successfully.",
-  "webhooks.form.url": "Endpoint URL",
-  "webhooks.form.urlHint": "The URL that will receive webhook payloads via HTTP POST.",
+  "webhooks.detail.consecutiveFailures": "Kolejne niepowodzenia",
+  "webhooks.detail.deliveryTip": "Zanim włączysz szeroki wzorzec zdarzeń, zacznij od testowej dostawy. Log dostaw poniżej pokazuje dokładnie, co zwrócił Twój odbiorca.",
+  "webhooks.detail.loadError": "Nie udało się załadować webhooka.",
+  "webhooks.detail.loading": "Ładowanie szczegółów webhooka...",
+  "webhooks.detail.previousSecretSetAt": "Poprzedni sekret aktywny od",
+  "webhooks.detail.readOnlyTip": "Masz obecnie dostęp tylko do odczytu. Jeśli chcesz zmienić ten endpoint, poproś administratora o uprawnienia do zarządzania, testowania lub zmiany sekretu.",
+  "webhooks.detail.rotateError": "Nie udało się zmienić sekretu webhooka.",
+  "webhooks.detail.rotateSuccess": "Zmieniono sekret webhooka",
+  "webhooks.detail.signatureTip": "Odbiorcy powinni weryfikować nagłówki Standard Webhooks: webhook-id, webhook-timestamp i webhook-signature.",
+  "webhooks.detail.testError": "Nie udało się wysłać testowej dostawy.",
+  "webhooks.detail.testQueued": "Testowa dostawa zakończyła się statusem innym niż sukces.",
+  "webhooks.detail.testResult": "Wynik ostatniego testu",
+  "webhooks.detail.testSuccess": "Testowa dostawa powiodła się.",
+  "webhooks.detail.title": "Szczegóły webhooka",
+  "webhooks.errors.forbidden": "Nie masz uprawnień do wykonania tej akcji.",
+  "webhooks.errors.notFound": "Nie znaleziono webhooka.",
+  "webhooks.errors.orgRequired": "Wymagany jest kontekst organizacji.",
+  "webhooks.errors.tenantRequired": "Wymagany jest kontekst najemcy.",
+  "webhooks.form.advancedStrategyTip": "Obecnie działa dostawa przez HTTP. Nagłówków własnych używaj do wskazówek routingu i nie umieszczaj w nich sekretów.",
+  "webhooks.form.autoDisableThreshold": "Próg automatycznego wyłączenia",
+  "webhooks.form.autoDisableThresholdHint": "Wyłącz webhook po tylu kolejnych niepowodzeniach (0 wyłącza automatyczne wyłączanie).",
+  "webhooks.form.createError": "Nie udało się utworzyć webhooka.",
+  "webhooks.form.createSuccess": "Utworzono webhook.",
+  "webhooks.form.customHeaders": "Nagłówki własne",
+  "webhooks.form.customHeadersHint": "Opcjonalny obiekt JSON z dodatkowymi nagłówkami wysyłanymi z każdym żądaniem webhooka.",
+  "webhooks.form.customHeadersInvalid": "Nagłówki własne muszą być poprawnym obiektem JSON z wartościami tekstowymi.",
+  "webhooks.form.customHeadersTip": "Używaj nagłówków do statycznych metadanych, takich jak środowisko czy identyfikator źródła. Nie umieszczaj w nich tokenów dostępu ani sekretów.",
+  "webhooks.form.deliveryDefaultsTip": "Wartości domyślne są bezpiecznym punktem wyjścia dla większości odbiorców. Zwiększaj liczbę ponowień lub limit czasu tylko wtedy, gdy wiesz, że odbiorca działa wolno.",
+  "webhooks.form.description": "Opis",
+  "webhooks.form.descriptionPlaceholder": "Opcjonalny opis tego webhooka",
+  "webhooks.form.events": "Subskrybowane zdarzenia",
+  "webhooks.form.eventsHint": "Wybierz, które zdarzenia mają wyzwalać ten webhook.",
+  "webhooks.form.eventsPatternTip": "Wskazówka: możesz wybrać konkretne zdarzenia z listy albo wpisać wzorce z gwiazdką, np. customers.* lub *, aby subskrybować szerzej.",
+  "webhooks.form.eventsPlaceholder": "Wybierz zdarzenia...",
+  "webhooks.form.eventsRequired": "Wybierz co najmniej jedno zdarzenie.",
+  "webhooks.form.group.advanced": "Zaawansowane",
+  "webhooks.form.group.delivery": "Ustawienia dostawy",
+  "webhooks.form.group.events": "Subskrypcja zdarzeń",
+  "webhooks.form.group.general": "Ogólne",
+  "webhooks.form.guidanceBody": "Skonfiguruj, dokąd mają trafiać zdarzenia, wybierz potrzebne wzorce zdarzeń, a następnie użyj opcji Wyślij test, aby sprawdzić odbiorcę przed uruchomieniem produkcyjnym.",
+  "webhooks.form.guidanceSecurityBody": "Sekret podpisujący jest generowany automatycznie. Zobaczysz go w całości tylko po utworzeniu lub zmianie, więc zapisz go w swoim odbiorcy przed zamknięciem strony.",
+  "webhooks.form.guidanceSecurityTitle": "Lista kontrolna bezpieczeństwa",
+  "webhooks.form.guidanceTitle": "Przewodnik konfiguracji",
+  "webhooks.form.httpMethod": "Metoda HTTP",
+  "webhooks.form.isActive": "Aktywny",
+  "webhooks.form.maxRetries": "Maks. liczba ponowień",
+  "webhooks.form.maxRetriesHint": "Maksymalna liczba prób ponowienia dostawy (0-30).",
+  "webhooks.form.name": "Nazwa",
+  "webhooks.form.namePlaceholder": "Mój webhook",
+  "webhooks.form.rateLimitPerMinute": "Limit na minutę",
+  "webhooks.form.rateLimitPerMinuteHint": "Maksymalna liczba dostaw na minutę dla tego endpointu (0 oznacza brak limitu).",
+  "webhooks.form.secret": "Sekret podpisujący",
+  "webhooks.form.secretCopied": "Skopiowano sekret do schowka.",
+  "webhooks.form.secretCopy": "Kopiuj sekret",
+  "webhooks.form.secretHint": "Ten sekret służy do podpisywania payloadów webhooków. Przechowuj go bezpiecznie.",
+  "webhooks.form.secretMissing": "Webhook został utworzony, ale sekret nie został zwrócony.",
+  "webhooks.form.secretRotationTip": "Zmieniaj sekret dopiero wtedy, gdy Twój odbiorca akceptuje podpisy wygenerowane starym i nowym sekretem w okresie przejściowym.",
+  "webhooks.form.secretUsageTip": "Zapisz ten sekret w swojej usłudze odbiorczej teraz. Przy kolejnych odczytach zobaczysz tylko wartość zamaskowaną.",
+  "webhooks.form.secretVerificationTip": "Użyj tej wartości do weryfikacji nagłówka webhook-signature razem z webhook-id i webhook-timestamp.",
+  "webhooks.form.secretVisibleOnce": "To jedyny moment, w którym możesz zobaczyć ten sekret. Zapisz go teraz w bezpiecznym miejscu.",
+  "webhooks.form.subscribedEvents": "Subskrybowane zdarzenia",
+  "webhooks.form.timeoutMs": "Limit czasu (ms)",
+  "webhooks.form.timeoutMsHint": "Limit czasu żądania w milisekundach (1000-60000).",
+  "webhooks.form.title.create": "Utwórz webhook",
+  "webhooks.form.title.edit": "Edytuj webhook",
+  "webhooks.form.updateError": "Nie udało się zaktualizować webhooka.",
+  "webhooks.form.updateSuccess": "Zaktualizowano webhook.",
+  "webhooks.form.url": "Adres URL endpointu",
+  "webhooks.form.urlHint": "Adres URL, który będzie odbierał payloady webhooków przez HTTP POST.",
   "webhooks.form.urlPlaceholder": "https://example.com/webhook",
   "webhooks.integrationDeliveries.actions.openWebhook": "Otwórz webhook",
   "webhooks.integrationDeliveries.columns.webhook": "Webhook",
@@ -129,33 +129,33 @@
   "webhooks.integrationSetup.summary": "Zarządzaj Custom Webhooks z dedykowanego ekranu webhooków. Wyłączenie tej integracji blokuje dostawy wychodzące, wysyłki testowe, ponowienia i odbiór webhooków przychodzących.",
   "webhooks.integrationSetup.title": "Konfiguracja webhooków",
   "webhooks.integrationTabs.settings": "Ustawienia",
-  "webhooks.list.actions.delete": "Delete",
-  "webhooks.list.actions.edit": "Edit",
-  "webhooks.list.actions.test": "Test",
-  "webhooks.list.actions.viewDeliveries": "View Deliveries",
-  "webhooks.list.columns.createdAt": "Created",
-  "webhooks.list.columns.events": "Events",
-  "webhooks.list.columns.lastDelivery": "Last Delivery",
-  "webhooks.list.columns.lastTriggered": "Last Triggered",
-  "webhooks.list.columns.name": "Name",
+  "webhooks.list.actions.delete": "Usuń",
+  "webhooks.list.actions.edit": "Edytuj",
+  "webhooks.list.actions.test": "Testuj",
+  "webhooks.list.actions.viewDeliveries": "Zobacz dostawy",
+  "webhooks.list.columns.createdAt": "Utworzono",
+  "webhooks.list.columns.events": "Zdarzenia",
+  "webhooks.list.columns.lastDelivery": "Ostatnia dostawa",
+  "webhooks.list.columns.lastTriggered": "Ostatnie wyzwolenie",
+  "webhooks.list.columns.name": "Nazwa",
   "webhooks.list.columns.status": "Status",
-  "webhooks.list.columns.successRate": "Health",
+  "webhooks.list.columns.successRate": "Kondycja",
   "webhooks.list.columns.url": "URL",
-  "webhooks.list.confirmDelete": "Are you sure you want to delete this webhook? This action cannot be undone.",
-  "webhooks.list.createFirst": "Create your first webhook to start receiving event notifications.",
-  "webhooks.list.deleteError": "Failed to delete webhook.",
-  "webhooks.list.deleteSuccess": "Webhook deleted successfully.",
-  "webhooks.list.description": "Manage webhook endpoints for receiving platform events.",
-  "webhooks.list.empty": "No webhooks configured yet.",
+  "webhooks.list.confirmDelete": "Czy na pewno chcesz usunąć ten webhook? Tej operacji nie można cofnąć.",
+  "webhooks.list.createFirst": "Utwórz pierwszy webhook, aby zacząć otrzymywać powiadomienia o zdarzeniach.",
+  "webhooks.list.deleteError": "Nie udało się usunąć webhooka.",
+  "webhooks.list.deleteSuccess": "Usunięto webhook.",
+  "webhooks.list.description": "Zarządzaj endpointami webhooków odbierającymi zdarzenia platformy.",
+  "webhooks.list.empty": "Nie skonfigurowano jeszcze żadnych webhooków.",
   "webhooks.list.filters.status": "Status",
-  "webhooks.list.loadError": "Failed to load webhooks.",
-  "webhooks.list.operatorTip": "Use exact events for narrow automations, or wildcard patterns when one consumer handles a whole domain. Check delivery logs after each rollout.",
-  "webhooks.list.status.active": "Active",
-  "webhooks.list.status.inactive": "Inactive",
-  "webhooks.list.title": "Webhooks",
-  "webhooks.nav.create": "Create Webhook",
-  "webhooks.nav.group": "Integrations",
-  "webhooks.nav.title": "Webhooks",
+  "webhooks.list.loadError": "Nie udało się załadować webhooków.",
+  "webhooks.list.operatorTip": "Do wąskich automatyzacji używaj konkretnych zdarzeń, a wzorców z gwiazdką wtedy, gdy jeden odbiorca obsługuje całą domenę. Po każdym wdrożeniu sprawdzaj logi dostaw.",
+  "webhooks.list.status.active": "Aktywny",
+  "webhooks.list.status.inactive": "Nieaktywny",
+  "webhooks.list.title": "Webhooki",
+  "webhooks.nav.create": "Utwórz webhook",
+  "webhooks.nav.group": "Integracje",
+  "webhooks.nav.title": "Webhooki",
   "webhooks.notifications.delivery.failed.body": "Webhook {webhookName} nie mógł dostarczyć zdarzenia {eventType}. {errorMessage}",
   "webhooks.notifications.delivery.failed.title": "Dostawa webhooka nie powiodła się dla {webhookName}"
 }

package/src/modules/webhooks/lib/adapter-registry.ts

@@ -3,6 +3,13 @@ const WEBHOOK_ENDPOINT_ADAPTERS_KEY = '__openMercatoWebhookEndpointAdapters__'
 export interface WebhookEndpointAdapter {
   readonly providerKey: string
   readonly subscribedEvents: string[]
+  /**
+   * Opt-in for adapters whose verified events intentionally cannot be mapped to
+   * tenant/organization scope. Unscoped events cannot be checked against the
+   * Custom Webhooks integration enabled state, so the inbound route rejects them
+   * by default unless an adapter explicitly declares this behavior.
+   */
+  readonly allowUnscopedInbound?: boolean
 
   formatPayload?(event: { type: string; data: unknown }): Promise<{
     url: string

package/src/modules/webhooks/workers/__tests__/webhook-delivery.test.ts

@@ -27,7 +27,7 @@ describe('webhooks delivery worker', () => {
     const em = { fork: jest.fn().mockReturnThis() } as unknown as EntityManager
     mockProcessWebhookDeliveryJob.mockResolvedValue(null)
 
-    await handler({ data: jobData }, makeCtx(em))
+    await handler({ payload: jobData }, makeCtx(em))
 
     expect(mockProcessWebhookDeliveryJob).toHaveBeenCalledWith(em, jobData)
   })
@@ -37,6 +37,6 @@ describe('webhooks delivery worker', () => {
     const cause = new Error('DB connection lost')
     mockProcessWebhookDeliveryJob.mockRejectedValue(cause)
 
-    await expect(handler({ data: jobData }, makeCtx(em))).rejects.toThrow('DB connection lost')
+    await expect(handler({ payload: jobData }, makeCtx(em))).rejects.toThrow('DB connection lost')
   })
 })

package/src/modules/webhooks/workers/webhook-delivery.ts

@@ -11,16 +11,16 @@ export const metadata = {
 }
 
 export default async function handler(
-  job: { data: WebhookDeliveryJob },
+  job: { payload: WebhookDeliveryJob },
   ctx: { resolve: <T = unknown>(name: string) => T },
 ) {
   const em = (ctx.resolve('em') as EntityManager).fork()
   try {
-    await processWebhookDeliveryJob(em, job.data)
+    await processWebhookDeliveryJob(em, job.payload)
   } catch (error) {
     logger.error('Job processing failed', {
-      deliveryId: job.data.deliveryId,
-      tenantId: job.data.tenantId,
+      deliveryId: job.payload?.deliveryId,
+      tenantId: job.payload?.tenantId,
       err: error,
     })
     throw error