@pikku/core 0.12.123 → 0.12.126

package/CHANGELOG.md

@@ -1,3 +1,29 @@
+## 0.12.126
+
+### Patch Changes
+
+- 44da33f: A scenario run records which version of the suite it ran against — the commit, and which attempt against that commit it is
+- 44da33f: The scenarios screen and the runs screen are one surface: the declared suite is the document and a run is a lens over it. A scenario is filed as `running` the moment it starts, so a console watching a run in progress can tell what is on screen now from what is still waiting, and the run snapshots each scenario's title, description and cast so the record reads as prose.
+
+## 0.12.125
+
+### Patch Changes
+
+- 5e93f30: Add `defineOutgoingWebhook({ event, title, description?, payload })` in `@pikku/core/webhook`. The CLI collects every exported declaration into `.pikku/webhooks/pikku-outgoing-webhooks-meta.gen.json` and `pikku-outgoing-webhooks.gen.ts`, which exports `OutgoingWebhooksMap`, `TypedWebhookService` and `typedWebhookService(service)`: `send` checks `data` against the declared payload for a declared event and accepts any other event unchanged. `MetaService.getOutgoingWebhooksMeta()` and the console addon's `outgoingWebhooksMeta` serve the declarations.
+- 5e93f30: Add `wireTriggerWebhookSource({ name, method?, route?, secret?, events, receive?, check?, setup?, teardown? })` in `#pikku/trigger`. Each source becomes a `POST /webhooks/<name>` route whose events are validated against their schemas and queued on `pikku-incoming-webhooks` through `IncomingWebhookService`; a generated worker runs the matching `wireTrigger({ name: '<source>:<event>' })` and the queue retries it on failure. `pikku webhooks status | setup | teardown --url --labelPrefix [--previous]` registers the routes with the provider and prints one JSON line per source.
+
+  `KyselyIncomingWebhookService` (with the `incoming-webhook` schema) records a receipt per event, drops a provider's redelivery of an event it already accepted, and keeps each dispatch's attempts and last error. `pikku dev` and `pikku serve` use it when a Kysely database is configured.
+
+## 0.12.124
+
+### Patch Changes
+
+- 1394385: Carry the wired instance through a `ref('ns:fn')` an app writes. The wiring is
+  the app's, so the reference arrives with no instance and the function used to
+  run against the addon's declared secrets alone — the consuming app's
+  `secretOverrides` and grants silently did not apply, and the app's own global
+  middleware was denied secrets it owns.
+
 ## 0.12.123
 
 ### Patch Changes

package/dist/function/function-runner.js

@@ -98,6 +98,13 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
             funcMeta = pikkuState(addonTarget.packageName, 'function', 'meta')[addonTarget.localName];
             if (funcMeta) {
                 funcPackageName = addonTarget.packageName;
+                // A `ref('ns:fn')` the app wired arrives with no instance, because the
+                // wiring is the app's. Without adopting the one the namespace resolves
+                // to, the function runs with the addon's declared secrets alone — the
+                // consuming app's `secretOverrides` and grants silently do not apply,
+                // and the app's own global middleware, running inside that scope, is
+                // denied secrets it owns.
+                addonInstance = addonInstance ?? addonTarget.instance;
             }
         }
     }

package/dist/pikku-state.js

@@ -73,6 +73,8 @@ const createEmptyPackageState = () => ({
         triggerSources: new Map(),
         meta: {},
         sourceMeta: {},
+        webhookSources: new Map(),
+        webhookSourceMeta: {},
     },
     mcp: {
         resources: new Map(),

package/dist/services/file-scenario-run-store.js

@@ -15,6 +15,7 @@ export const scenarioRunSummary = (record) => ({
     runId: record.runId,
     environment: record.environment,
     surface: record.surface,
+    ...(record.version ? { version: record.version } : {}),
     status: record.status,
     startedAt: record.startedAt,
     finishedAt: record.finishedAt,
@@ -82,7 +83,18 @@ export class FileScenarioRunStore {
             if (!record) {
                 return;
             }
-            record.results.push(result);
+            const existing = record.results.findIndex((candidate) => candidate.name === result.name);
+            if (existing === -1) {
+                record.results.push(result);
+            }
+            else {
+                record.results[existing] = {
+                    ...(record.results[existing].artifacts
+                        ? { artifacts: record.results[existing].artifacts }
+                        : {}),
+                    ...result,
+                };
+            }
             await this.write(record);
         });
     }

package/dist/services/incoming-webhook-service.d.ts

@@ -0,0 +1,48 @@
+import type { QueueService } from '../wirings/queue/queue.types.js';
+import { type TriggerEvent, type WebhookRequest, type WebhookSourceJob } from '../wirings/trigger/webhook-source.types.js';
+export type IncomingWebhookAttempt = {
+    trigger: string;
+    error?: string;
+};
+export type IncomingWebhookReceiptRecord = {
+    receiptId: string;
+    source: string;
+    providerEventId: string | null;
+    event: string;
+    status: 'pending' | 'delivered' | 'failed';
+    attempts: number;
+    lastError: string | null;
+    createdAt: Date;
+    deliveredAt: Date | null;
+};
+/**
+ * Queues each event a webhook source received for the
+ * `pikku-incoming-webhooks` worker, so the provider is answered once the event
+ * is safe and our own processing is retried by the queue, not by the provider.
+ *
+ * The queue is a constructor argument, as in `QueueWebhookService`: a webhook
+ * source wired without one fails to compile rather than on its first delivery.
+ */
+export declare class IncomingWebhookService {
+    protected queueService: QueueService;
+    /** How often a failing trigger is retried before the event is given up on. */
+    protected retries: number;
+    constructor(queueService: QueueService, 
+    /** How often a failing trigger is retried before the event is given up on. */
+    retries?: number);
+    /** Returns how many events were queued. A store-backed service drops ones it has already seen. */
+    accept({ source, events, }: {
+        source: string;
+        request: WebhookRequest;
+        events: TriggerEvent[];
+    }): Promise<number>;
+    /** The job id is the provider's event id under its event name, which de-duplicates on queues that honour job ids. */
+    protected enqueue(job: WebhookSourceJob): Promise<string>;
+    /** Keeps nothing by default; a store-backed service records each dispatch. */
+    recordAttempt(_receiptId: string, _attempt: IncomingWebhookAttempt): Promise<void>;
+    /** Most recent first. Empty when nothing is stored. */
+    listReceipts(_opts?: {
+        source?: string;
+        limit?: number;
+    }): Promise<IncomingWebhookReceiptRecord[]>;
+}

package/dist/services/incoming-webhook-service.js

@@ -0,0 +1,46 @@
+import { DEFAULT_WEBHOOK_RETRIES } from './webhook-service.js';
+import { PIKKU_INCOMING_WEBHOOK_QUEUE_NAME, } from '../wirings/trigger/webhook-source.types.js';
+/**
+ * Queues each event a webhook source received for the
+ * `pikku-incoming-webhooks` worker, so the provider is answered once the event
+ * is safe and our own processing is retried by the queue, not by the provider.
+ *
+ * The queue is a constructor argument, as in `QueueWebhookService`: a webhook
+ * source wired without one fails to compile rather than on its first delivery.
+ */
+export class IncomingWebhookService {
+    queueService;
+    retries;
+    constructor(queueService, 
+    /** How often a failing trigger is retried before the event is given up on. */
+    retries = DEFAULT_WEBHOOK_RETRIES) {
+        this.queueService = queueService;
+        this.retries = retries;
+    }
+    /** Returns how many events were queued. A store-backed service drops ones it has already seen. */
+    async accept({ source, events, }) {
+        for (const event of events) {
+            await this.enqueue({ source, event });
+        }
+        return events.length;
+    }
+    /** The job id is the provider's event id under its event name, which de-duplicates on queues that honour job ids. */
+    async enqueue(job) {
+        const jobId = job.receiptId ??
+            (job.event.id
+                ? `${job.source}:${job.event.name}:${job.event.id}`
+                : undefined);
+        // knowledge: decisions/internals/queue-jobs-always-carry-an-explicit-attempts-count.md
+        return this.queueService.add(PIKKU_INCOMING_WEBHOOK_QUEUE_NAME, job, {
+            attempts: this.retries + 1,
+            ...(this.retries > 0 ? { backoff: 'exponential' } : {}),
+            ...(jobId ? { jobId } : {}),
+        });
+    }
+    /** Keeps nothing by default; a store-backed service records each dispatch. */
+    async recordAttempt(_receiptId, _attempt) { }
+    /** Most recent first. Empty when nothing is stored. */
+    async listReceipts(_opts) {
+        return [];
+    }
+}

package/dist/services/index.d.ts

@@ -12,6 +12,7 @@ export { LocalVariablesService } from './local-variables.js';
 export { ConsoleLogger, JsonConsoleLogger } from './logger-console.js';
 export { InMemoryWorkflowService } from './in-memory-workflow-service.js';
 export { QueueWebhookService, pikkuWebhookWorkerFunc, } from './queue-webhook-service.js';
+export { IncomingWebhookService, type IncomingWebhookAttempt, type IncomingWebhookReceiptRecord, } from './incoming-webhook-service.js';
 export { REMOTE_JOBS_SECRET_HEADER, REMOTE_JOBS_SECRET_VARIABLE, REMOTE_QUEUE_JOB_PATH, REMOTE_SCHEDULER_JOB_PATH, pikkuRemoteQueueJobFunc, pikkuRemoteScheduledJobFunc, type RemoteQueueJobData, type RemoteScheduledJobData, } from './remote-jobs.js';
 export { InMemoryQueueService } from './in-memory-queue-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';

package/dist/services/index.js

@@ -12,6 +12,7 @@ export { LocalVariablesService } from './local-variables.js';
 export { ConsoleLogger, JsonConsoleLogger } from './logger-console.js';
 export { InMemoryWorkflowService } from './in-memory-workflow-service.js';
 export { QueueWebhookService, pikkuWebhookWorkerFunc, } from './queue-webhook-service.js';
+export { IncomingWebhookService, } from './incoming-webhook-service.js';
 export { REMOTE_JOBS_SECRET_HEADER, REMOTE_JOBS_SECRET_VARIABLE, REMOTE_QUEUE_JOB_PATH, REMOTE_SCHEDULER_JOB_PATH, pikkuRemoteQueueJobFunc, pikkuRemoteScheduledJobFunc, } from './remote-jobs.js';
 export { InMemoryQueueService } from './in-memory-queue-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';

package/dist/services/meta-service.d.ts

@@ -15,6 +15,8 @@ import type { TriggerMeta, TriggerSourceMeta } from '../wirings/trigger/trigger.
 import type { SecretDefinitionsMeta } from '../wirings/secret/secret.types.js';
 import type { CredentialDefinitionsMeta } from '../wirings/credential/credential.types.js';
 import type { VariableDefinitionsMeta } from '../wirings/variable/variable.types.js';
+import type { OutgoingWebhooksMeta } from '../wirings/webhook/define-outgoing-webhook.js';
+import type { WebhookSourcesMeta } from '../wirings/trigger/webhook-source.types.js';
 import type { FunctionMeta, FunctionsMeta, PermissionMetadata } from '../function/function-meta.types.js';
 import type { MiddlewareMetadata } from '../middleware/middleware.types.js';
 import type { AgentsMeta } from '../wirings/agent/agent.types.js';
@@ -174,6 +176,8 @@ export interface MetaService {
     getSecretsMeta(): Promise<SecretDefinitionsMeta>;
     getCredentialsMeta(): Promise<CredentialDefinitionsMeta>;
     getVariablesMeta(): Promise<VariableDefinitionsMeta>;
+    getOutgoingWebhooksMeta(): Promise<OutgoingWebhooksMeta>;
+    getWebhookSourcesMeta(): Promise<WebhookSourcesMeta>;
     getEmailMeta(): Promise<EmailsMeta>;
     getEmailTemplateAssets(templateName: string, locale: string): Promise<EmailTemplateAssets>;
     getServicesMeta(): Promise<ServicesMetaRecord>;
@@ -184,6 +188,7 @@ export interface MetaService {
 export declare class LocalMetaService implements MetaService {
     readonly basePath: string;
     private httpMetaCache;
+    private webhookSourcesMetaCache;
     private channelsMetaCache;
     private schedulerMetaCache;
     private queueMetaCache;
@@ -204,6 +209,7 @@ export declare class LocalMetaService implements MetaService {
     private secretsMetaCache;
     private credentialsMetaCache;
     private variablesMetaCache;
+    private outgoingWebhooksMetaCache;
     private middlewareGroupsMetaCache;
     private permissionsGroupsMetaCache;
     private agentsMetaCache;
@@ -242,6 +248,8 @@ export declare class LocalMetaService implements MetaService {
     getSecretsMeta(): Promise<SecretDefinitionsMeta>;
     getCredentialsMeta(): Promise<CredentialDefinitionsMeta>;
     getVariablesMeta(): Promise<VariableDefinitionsMeta>;
+    getOutgoingWebhooksMeta(): Promise<OutgoingWebhooksMeta>;
+    getWebhookSourcesMeta(): Promise<WebhookSourcesMeta>;
     getEmailMeta(): Promise<EmailsMeta>;
     getEmailTemplateAssets(templateName: string, locale: string): Promise<EmailTemplateAssets>;
     getServicesMeta(): Promise<ServicesMetaRecord>;

package/dist/services/meta-service.js

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 export class LocalMetaService {
     basePath;
     httpMetaCache = null;
+    webhookSourcesMetaCache = null;
     channelsMetaCache = null;
     schedulerMetaCache = null;
     queueMetaCache = null;
@@ -25,6 +26,7 @@ export class LocalMetaService {
     secretsMetaCache = null;
     credentialsMetaCache = null;
     variablesMetaCache = null;
+    outgoingWebhooksMetaCache = null;
     middlewareGroupsMetaCache = null;
     permissionsGroupsMetaCache = null;
     agentsMetaCache = null;
@@ -123,6 +125,8 @@ export class LocalMetaService {
         this.secretsMetaCache = null;
         this.credentialsMetaCache = null;
         this.variablesMetaCache = null;
+        this.outgoingWebhooksMetaCache = null;
+        this.webhookSourcesMetaCache = null;
         this.middlewareGroupsMetaCache = null;
         this.permissionsGroupsMetaCache = null;
         this.agentsMetaCache = null;
@@ -375,6 +379,20 @@ export class LocalMetaService {
         this.variablesMetaCache = content ? JSON.parse(content) : {};
         return this.variablesMetaCache;
     }
+    async getOutgoingWebhooksMeta() {
+        if (this.outgoingWebhooksMetaCache)
+            return this.outgoingWebhooksMetaCache;
+        const content = await this.readFile('webhooks/pikku-outgoing-webhooks-meta.gen.json');
+        this.outgoingWebhooksMetaCache = content ? JSON.parse(content) : {};
+        return this.outgoingWebhooksMetaCache;
+    }
+    async getWebhookSourcesMeta() {
+        if (this.webhookSourcesMetaCache)
+            return this.webhookSourcesMetaCache;
+        const content = await this.readFile('webhooks/pikku-webhook-sources-meta.gen.json');
+        this.webhookSourcesMetaCache = content ? JSON.parse(content) : {};
+        return this.webhookSourcesMetaCache;
+    }
     async getEmailMeta() {
         // knowledge: decisions/internals/email-meta-is-read-uncached-because-codegen-rewrites-it-mid-session.md
         const content = await this.readFile('email/pikku-emails-meta.gen.json');

package/dist/types/core.types.d.ts

@@ -1,3 +1,4 @@
+import type { IncomingWebhookService } from '../services/incoming-webhook-service.js';
 import type { Logger, LogLevel } from '../services/logger.js';
 import type { VariablesService } from '../services/variables-service.js';
 import type { SecretService } from '../services/secret-service.js';
@@ -133,6 +134,8 @@ export interface CoreSingletonServices<Config extends CoreConfig = CoreConfig> {
      * the delivery-read methods; a store-backed implementation records history.
      */
     webhookService?: WebhookService;
+    /** Queues what webhook trigger sources receive. Required once any `wireTriggerWebhookSource` is wired. */
+    incomingWebhookService?: IncomingWebhookService;
     metaService?: MetaService;
     /**
      * Where virtual-user runs are recorded. A run is dispatched and answered for

package/dist/types/state.types.d.ts

@@ -1,3 +1,4 @@
+import type { CoreTriggerWebhookSource, WebhookSourcesMeta } from '../wirings/trigger/webhook-source.types.js';
 import type { CredentialOverrides } from '../wirings/credential/credential-overrides.js';
 import type { PikkuErrorConstructor, ErrorDetails } from '../errors/error-handler.js';
 import type { CorePikkuFunctionConfig, CorePermissionGroup, CorePikkuPermission } from '../function/functions.types.js';
@@ -101,6 +102,8 @@ export interface PikkuPackageState {
         triggerSources: Map<string, CoreTriggerSource>;
         meta: TriggerMeta;
         sourceMeta: TriggerSourceMeta;
+        webhookSources: Map<string, CoreTriggerWebhookSource>;
+        webhookSourceMeta: WebhookSourcesMeta;
     };
     mcp: {
         resources: Map<string, CoreMCPResource>;

package/dist/wirings/addon/addon-runner.js

@@ -84,6 +84,26 @@ const wrapWorkflowServiceForPackage = (service, packageName, namespace) => {
         },
     });
 };
+const scopedWebhookServices = new WeakSet();
+/** An addon names its outgoing events locally; they leave as `<instance>:<event>`. */
+const scopeWebhookService = (service, namespace) => {
+    if (scopedWebhookServices.has(service))
+        return service;
+    const scoped = new Proxy(service, {
+        get(target, prop, receiver) {
+            const value = Reflect.get(target, prop, receiver);
+            if (prop !== 'send' || typeof value !== 'function')
+                return value;
+            return function (input, ...rest) {
+                return value.call(this, input?.event && !input.event.startsWith(`${namespace}:`)
+                    ? { ...input, event: `${namespace}:${input.event}` }
+                    : input, ...rest);
+            };
+        },
+    });
+    scopedWebhookServices.add(scoped);
+    return scoped;
+};
 export const getOrCreatePackageSingletonServices = async (packageName, parentServices, addonInstance) => {
     const cacheKey = addonInstance?.namespace ?? packageName;
     const cachedServices = pikkuState(cacheKey, 'package', 'singletonServices');
@@ -116,6 +136,13 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
             credentialService: new ScopedCredentialService(existingServices.credentialService, allowedNames(Object.keys(pikkuState(packageName, 'package', 'credentialsMeta') ?? {}), addonInstance?.credentialGrants, addonInstance?.credentialOverrides)),
         };
     }
+    const namespace = addonInstance?.namespace ?? findAddonNamespaceForPackage(packageName);
+    if (namespace && existingServices.webhookService) {
+        existingServices = {
+            ...existingServices,
+            webhookService: scopeWebhookService(existingServices.webhookService, namespace),
+        };
+    }
     if (!factories || !factories.createSingletonServices) {
         return existingServices;
     }
@@ -128,6 +155,9 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
         typeof packageServices.workflowService === 'object') {
         packageServices.workflowService = wrapWorkflowServiceForPackage(packageServices.workflowService, packageName, addonInstance?.namespace ?? null);
     }
+    if (namespace && packageServices.webhookService) {
+        packageServices.webhookService = scopeWebhookService(packageServices.webhookService, namespace);
+    }
     pikkuState(cacheKey, 'package', 'singletonServices', packageServices);
     return packageServices;
 };

package/dist/wirings/addon/wire-addon.d.ts

@@ -1,5 +1,6 @@
 import type { CredentialOverrides } from '../credential/credential-overrides.js';
 import type { CorePikkuMiddleware } from '../../middleware/middleware.types.js';
+import type { AddonInstance } from './addon-runner.js';
 export type WireAddonConfig = {
     /** How this instance is addressed. One package may be wired more than once, and the name is what tells the instances apart. */
     name: string;
@@ -112,6 +113,7 @@ export declare const resolveAddonAuth: (packageName: string | null, namespace?:
 export declare const resolveAddonFunctionTarget: (funcName: string, packageName: string | null) => {
     packageName: string;
     localName: string;
+    instance: AddonInstance;
 } | null;
 /**
  * Addon tags name middleware the *consuming app* registered, so they resolve

package/dist/wirings/addon/wire-addon.js

@@ -125,6 +125,12 @@ export const resolveAddonFunctionTarget = (funcName, packageName) => {
     return {
         packageName: config.package,
         localName: funcName.slice(separator + 1),
+        // The instance, not just its package: everything the consuming app lent
+        // this addon — `secretOverrides`, grants, the scoping opt-outs — hangs off
+        // here, and a caller that only learns the package runs the function with
+        // none of it. The namespace is the map key rather than a field on the
+        // stored config, so it is put back on the way out.
+        instance: { namespace, ...config },
     };
 };
 /**

package/dist/wirings/trigger/index.d.ts

@@ -1,3 +1,7 @@
 export { wireTrigger, wireTriggerSource } from './trigger-runner.js';
+export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, subscribedWebhookEvents, } from './webhook-source-runner.js';
+export type { WebhookSourceOutcome } from './webhook-source-runner.js';
+export { PIKKU_INCOMING_WEBHOOK_QUEUE_NAME } from './webhook-source.types.js';
+export type { CoreTriggerWebhookSource, TriggerEvent, WebhookCheckResult, WebhookLifecycleInput, WebhookReceiveResult, WebhookRequest, WebhookSetupResult, WebhookSourceJob, WebhookSourceMeta, WebhookSourcesMeta, WebhookSourceState, WebhookTeardownInput, WebhookTeardownResult, } from './webhook-source.types.js';
 export { PikkuTriggerService } from './pikku-trigger-service.js';
 export type { TriggerMeta, TriggerSourceMeta, CorePikkuTriggerFunction, CorePikkuTriggerFunctionConfig, CoreTrigger, } from './trigger.types.js';

package/dist/wirings/trigger/index.js

@@ -1,2 +1,4 @@
 export { wireTrigger, wireTriggerSource } from './trigger-runner.js';
+export { wireTriggerWebhookSource, receiveWebhookSourceRequest, dispatchWebhookSourceJob, runWebhookSourceLifecycle, subscribedWebhookEvents, } from './webhook-source-runner.js';
+export { PIKKU_INCOMING_WEBHOOK_QUEUE_NAME } from './webhook-source.types.js';
 export { PikkuTriggerService } from './pikku-trigger-service.js';

package/dist/wirings/trigger/webhook-source-runner.d.ts

@@ -0,0 +1,45 @@
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+import type { CoreSingletonServices } from '../../types/core.types.js';
+import type { PikkuHTTP } from '../http/http.types.js';
+import type { CoreTriggerWebhookSource, WebhookCheckResult, WebhookSetupResult, WebhookSourceJob, WebhookSourceState, WebhookTeardownResult } from './webhook-source.types.js';
+export declare const wireTriggerWebhookSource: <Events extends Record<string, StandardSchemaV1>>(source: CoreTriggerWebhookSource<Events>) => void;
+/** The declared events some trigger is wired to: what `setup` registers with the provider. */
+export declare const subscribedWebhookEvents: (source: string) => string[];
+/**
+ * The body of a webhook source's route: `receive`, validate, and queue every
+ * event some trigger listens for. Events nobody listens for are answered and
+ * dropped, so the provider does not retry them forever.
+ */
+export declare const receiveWebhookSourceRequest: (sourceName: string, wire: {
+    http?: PikkuHTTP;
+}) => Promise<Response | {
+    received: number;
+}>;
+/** The `pikku-incoming-webhooks` worker: runs the trigger an event was queued for. Throws so the queue retries. */
+export declare const dispatchWebhookSourceJob: (job: WebhookSourceJob) => Promise<void>;
+export type WebhookSourceOutcome = {
+    source: string;
+    url: string;
+    status: WebhookCheckResult['status'] | WebhookSetupResult['status'] | WebhookTeardownResult['status'] | 'skipped' | 'failed';
+    reason?: string;
+    state?: WebhookSourceState;
+    /** The name the produced signing secret must be stored under. */
+    secretName?: string;
+    secret?: string;
+    instructions?: string;
+    error?: string;
+};
+/**
+ * Runs one lifecycle step for every webhook source, as `pikku webhooks
+ * status | setup | teardown` does at deploy. `setup` runs only where `check`
+ * does not report `ok`. One failing source does not stop the rest.
+ */
+export declare const runWebhookSourceLifecycle: ({ action, baseUrl, labelPrefix, previous, singletonServices, }: {
+    action: 'check' | 'setup' | 'teardown';
+    /** Where the app's routes are served, e.g. `https://shop.example.com/api`. */
+    baseUrl: string;
+    labelPrefix: string;
+    /** What the last `setup` returned as `state`, by source name. */
+    previous?: Record<string, WebhookSourceState>;
+    singletonServices?: CoreSingletonServices;
+}) => Promise<WebhookSourceOutcome[]>;

package/dist/wirings/trigger/webhook-source-runner.js

@@ -0,0 +1,221 @@
+import { getSingletonServices, pikkuState } from '../../pikku-state.js';
+import { addFunction, runPikkuFunc } from '../../function/function-runner.js';
+import { PikkuMissingMetaError } from '../../errors/errors.js';
+const LIFECYCLE = ['receive', 'check', 'setup', 'teardown'];
+export const wireTriggerWebhookSource = (source) => {
+    const meta = pikkuState(null, 'trigger', 'webhookSourceMeta')[source.name];
+    if (!meta) {
+        console.warn(`[pikku] Skipping webhook source '${source.name}' — metadata not found. Consider moving this wiring to its own file.`);
+        return;
+    }
+    const sources = pikkuState(null, 'trigger', 'webhookSources');
+    if (sources.has(source.name)) {
+        throw new Error(`Webhook source already exists: ${source.name}`);
+    }
+    sources.set(source.name, source);
+    for (const step of LIFECYCLE) {
+        const funcId = meta[step];
+        const config = source[step];
+        if (funcId && typeof config?.func === 'function') {
+            addFunction(funcId, config);
+        }
+    }
+};
+const triggerName = (source, event) => event ? `${source}:${event}` : source;
+/** The declared events some trigger is wired to: what `setup` registers with the provider. */
+export const subscribedWebhookEvents = (source) => {
+    const triggers = pikkuState(null, 'trigger', 'meta');
+    const meta = pikkuState(null, 'trigger', 'webhookSourceMeta')[source];
+    return (meta?.events ?? []).filter((event) => triggers[triggerName(source, event)]);
+};
+const getSourceMeta = (source) => {
+    const meta = pikkuState(null, 'trigger', 'webhookSourceMeta')[source];
+    if (!meta) {
+        throw new PikkuMissingMetaError(`Missing generated metadata for webhook source '${source}'`);
+    }
+    return meta;
+};
+const runSourceStep = (singletonServices, source, funcId, data) => runPikkuFunc('trigger', source, funcId, {
+    singletonServices,
+    auth: false,
+    data: () => data,
+    wire: {},
+});
+const readRequest = async (http) => {
+    const request = http?.request;
+    if (!request) {
+        throw new Error('A webhook source can only be reached over HTTP');
+    }
+    const query = {};
+    for (const [key, value] of Object.entries(request.query() ?? {})) {
+        if (value !== undefined)
+            query[key] = String(value);
+    }
+    return {
+        body: new Uint8Array(await request.arrayBuffer()),
+        headers: request.headers(),
+        method: request.method(),
+        url: request.path(),
+        query,
+    };
+};
+const validateEvents = async (source, events, logger) => {
+    const valid = [];
+    for (const event of events) {
+        const schema = source?.events?.[event.name];
+        if (!schema) {
+            valid.push(event);
+            continue;
+        }
+        const result = await schema['~standard'].validate(event.data);
+        if (result.issues) {
+            logger.warn(`Webhook source '${source.name}' dropped '${event.name}'${event.id ? ` (${event.id})` : ''}: ${result.issues.map((issue) => issue.message).join('; ')}`);
+            continue;
+        }
+        valid.push({ ...event, data: result.value });
+    }
+    return valid;
+};
+/**
+ * The body of a webhook source's route: `receive`, validate, and queue every
+ * event some trigger listens for. Events nobody listens for are answered and
+ * dropped, so the provider does not retry them forever.
+ */
+export const receiveWebhookSourceRequest = async (sourceName, wire) => {
+    const singletonServices = getSingletonServices();
+    const meta = getSourceMeta(sourceName);
+    const source = pikkuState(null, 'trigger', 'webhookSources').get(sourceName);
+    const request = await readRequest(wire.http);
+    const result = meta.receive
+        ? await runSourceStep(singletonServices, sourceName, meta.receive, request)
+        : {
+            events: [
+                {
+                    name: '',
+                    data: request.body.length
+                        ? JSON.parse(new TextDecoder().decode(request.body))
+                        : undefined,
+                },
+            ],
+        };
+    if ('respond' in result) {
+        const { status, body, headers } = result.respond;
+        const text = body === undefined
+            ? null
+            : typeof body === 'string'
+                ? body
+                : JSON.stringify(body);
+        return new Response(text, { status, headers });
+    }
+    const triggers = pikkuState(null, 'trigger', 'meta');
+    const listened = result.events.filter((event) => triggers[triggerName(sourceName, event.name)]);
+    const events = await validateEvents(source, listened, singletonServices.logger);
+    if (events.length === 0)
+        return { received: 0 };
+    const service = singletonServices.incomingWebhookService;
+    if (!service) {
+        throw new Error(`Webhook source '${sourceName}' received events but no incomingWebhookService is configured to queue them.`);
+    }
+    return {
+        received: await service.accept({ source: sourceName, request, events }),
+    };
+};
+/** The `pikku-incoming-webhooks` worker: runs the trigger an event was queued for. Throws so the queue retries. */
+export const dispatchWebhookSourceJob = async (job) => {
+    const singletonServices = getSingletonServices();
+    const name = triggerName(job.source, job.event.name);
+    const trigger = pikkuState(null, 'trigger', 'meta')[name];
+    if (!trigger) {
+        singletonServices.logger.warn(`No trigger named '${name}' is wired; dropping ${job.event.id ?? 'an event'} from '${job.source}'.`);
+        return;
+    }
+    let error;
+    try {
+        await runPikkuFunc('trigger', name, trigger.pikkuFuncId, {
+            singletonServices,
+            auth: false,
+            data: () => job.event.data,
+            wire: {},
+        });
+    }
+    catch (e) {
+        error = e instanceof Error ? e.message : String(e);
+        if (job.receiptId) {
+            await recordAttempt(singletonServices, job.receiptId, name, error);
+        }
+        throw e;
+    }
+    if (job.receiptId) {
+        await recordAttempt(singletonServices, job.receiptId, name);
+    }
+};
+const recordAttempt = (singletonServices, receiptId, trigger, error) => singletonServices.incomingWebhookService
+    ?.recordAttempt(receiptId, { trigger, ...(error ? { error } : {}) })
+    .catch((storeError) => singletonServices.logger.error(`Failed to record the attempt for webhook receipt ${receiptId}`, storeError));
+/**
+ * Runs one lifecycle step for every webhook source, as `pikku webhooks
+ * status | setup | teardown` does at deploy. `setup` runs only where `check`
+ * does not report `ok`. One failing source does not stop the rest.
+ */
+export const runWebhookSourceLifecycle = async ({ action, baseUrl, labelPrefix, previous = {}, singletonServices = getSingletonServices(), }) => {
+    const base = baseUrl.replace(/\/+$/, '');
+    const outcomes = [];
+    for (const meta of Object.values(pikkuState(null, 'trigger', 'webhookSourceMeta'))) {
+        const url = `${base}${meta.route}`;
+        const label = `${labelPrefix}:${meta.name}`;
+        const input = {
+            url,
+            label,
+            events: subscribedWebhookEvents(meta.name),
+            ...(previous[meta.name] ? { previous: previous[meta.name] } : {}),
+        };
+        const outcome = (status, extra = {}) => outcomes.push({ source: meta.name, url, status, ...extra });
+        try {
+            if (action === 'teardown') {
+                if (!meta.teardown) {
+                    outcome('skipped');
+                    continue;
+                }
+                const result = await runSourceStep(singletonServices, meta.name, meta.teardown, { label, ...(input.previous ? { previous: input.previous } : {}) });
+                outcome(result.status);
+                continue;
+            }
+            if (meta.check) {
+                const checked = await runSourceStep(singletonServices, meta.name, meta.check, input);
+                if (action === 'check' || checked.status === 'ok') {
+                    outcome(checked.status === 'ok' && action === 'setup'
+                        ? 'unchanged'
+                        : checked.status, checked.status === 'drifted' ? { reason: checked.reason } : {});
+                    continue;
+                }
+            }
+            else if (action === 'check') {
+                outcome('skipped');
+                continue;
+            }
+            if (!meta.setup) {
+                outcome('manual', {
+                    instructions: `Register ${url} with the provider for: ${input.events.join(', ') || 'every event'}.`,
+                });
+                continue;
+            }
+            const result = await runSourceStep(singletonServices, meta.name, meta.setup, input);
+            if (result.status === 'manual') {
+                outcome('manual', { instructions: result.instructions });
+                continue;
+            }
+            outcome(result.status, {
+                ...(result.state ? { state: result.state } : {}),
+                ...(result.secret && meta.secret
+                    ? { secretName: meta.secret, secret: result.secret }
+                    : {}),
+            });
+        }
+        catch (error) {
+            outcome('failed', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return outcomes;
+};

package/dist/wirings/trigger/webhook-source.types.d.ts

@@ -0,0 +1,106 @@
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+import type { CorePikkuFunctionConfig } from '../../function/functions.types.js';
+export declare const PIKKU_INCOMING_WEBHOOK_QUEUE_NAME = "pikku-incoming-webhooks";
+/** What every trigger source produces, whichever way it arrives. */
+export type TriggerEvent<Name extends string = string, Data = unknown> = {
+    /** The provider's event type; dispatched to the trigger named `<source>:<name>`. Empty dispatches to `<source>`. */
+    name: Name;
+    /** The provider's event id, which de-duplicates redeliveries. */
+    id?: string;
+    data: Data;
+};
+/** The request exactly as it arrived: providers sign the raw bytes, not re-serialised JSON. */
+export type WebhookRequest = {
+    body: Uint8Array;
+    headers: Record<string, string>;
+    method: string;
+    url: string;
+    query: Record<string, string>;
+};
+export type WebhookReceiveResult = {
+    events: TriggerEvent[];
+}
+/** A handshake, such as Slack's `url_verification`: answered directly, nothing is dispatched. */
+ | {
+    respond: {
+        status: number;
+        body?: unknown;
+        headers?: Record<string, string>;
+    };
+};
+/** Whatever `setup` wants back on the next deploy, for providers whose endpoints cannot be found by label. */
+export type WebhookSourceState = Record<string, unknown>;
+export type WebhookLifecycleInput = {
+    /** Always this deployment's own route: nothing can point it elsewhere. */
+    url: string;
+    /** Stable across deploys of one app and stage, for providers that let endpoints be tagged and listed. */
+    label: string;
+    /** The declared events some trigger is wired to. */
+    events: string[];
+    previous?: WebhookSourceState;
+};
+export type WebhookCheckResult = {
+    status: 'ok';
+} | {
+    status: 'missing';
+} | {
+    status: 'drifted';
+    reason: string;
+};
+export type WebhookSetupResult = {
+    status: 'created' | 'updated' | 'unchanged';
+    state?: WebhookSourceState;
+    /** Only when the provider issued a new signing secret. */
+    secret?: string;
+}
+/** The provider has no API for this: `instructions` tell a person what to set by hand. */
+ | {
+    status: 'manual';
+    instructions: string;
+};
+export type WebhookTeardownInput = {
+    label: string;
+    previous?: WebhookSourceState;
+};
+export type WebhookTeardownResult = {
+    status: 'deleted' | 'absent';
+};
+type SourceFunction<In, Out> = CorePikkuFunctionConfig<any, any> & {
+    func: (services: any, data: In, wire: any) => Promise<Out>;
+};
+export type CoreTriggerWebhookSource<Events extends Record<string, StandardSchemaV1> = Record<string, StandardSchemaV1>> = {
+    /** Triggers subscribe to `<name>:<event>`. Unique across every kind of trigger source. */
+    name: string;
+    method?: 'post' | 'put' | 'get';
+    /** Defaults to `/webhooks/<name>`. */
+    route?: string;
+    /** The secret `receive` verifies with, which `setup` produces. */
+    secret?: string;
+    /** What the source can produce. Each event's data is validated against its schema before it is queued. */
+    events?: Events;
+    /** Omitted: the JSON body is one event dispatched to the trigger named `<name>`. */
+    receive?: SourceFunction<WebhookRequest, WebhookReceiveResult>;
+    check?: SourceFunction<WebhookLifecycleInput, WebhookCheckResult>;
+    setup?: SourceFunction<WebhookLifecycleInput, WebhookSetupResult>;
+    teardown?: SourceFunction<WebhookTeardownInput, WebhookTeardownResult>;
+};
+export type WebhookSourceMeta = {
+    name: string;
+    method: 'post' | 'put' | 'get';
+    route: string;
+    secret?: string;
+    events: string[];
+    receive?: string;
+    check?: string;
+    setup?: string;
+    teardown?: string;
+};
+export type WebhookSourcesMeta = Record<string, WebhookSourceMeta>;
+/** One queued event on its way to its trigger. */
+export type WebhookSourceJob = {
+    source: string;
+    event: TriggerEvent;
+    /** Present when a store-backed service recorded the receipt. */
+    receiptId?: string;
+};
+export {};

package/dist/wirings/trigger/webhook-source.types.js

@@ -0,0 +1 @@
+export const PIKKU_INCOMING_WEBHOOK_QUEUE_NAME = 'pikku-incoming-webhooks';

package/dist/wirings/webhook/define-outgoing-webhook.d.ts

@@ -0,0 +1,28 @@
+import type { StandardSchemaV1 } from '@standard-schema/spec';
+import type { Safe } from '../../classification/secret-value.js';
+import type { SendWebhookInput, SendWebhookResult, WebhookService } from '../../services/webhook-service.js';
+export type CoreOutgoingWebhook<Event extends string = string, Payload extends StandardSchemaV1 = StandardSchemaV1> = {
+    event: Event;
+    title: string;
+    description?: string;
+    payload: Payload;
+};
+export type OutgoingWebhookMeta = {
+    event: string;
+    title: string;
+    description?: string;
+    payload?: Record<string, string>;
+    exportedName?: string;
+    sourceFile?: string;
+};
+export type OutgoingWebhooksMeta = Record<string, OutgoingWebhookMeta>;
+export type OutgoingWebhookPayloadOf<W> = W extends CoreOutgoingWebhook<string, infer S> ? StandardSchemaV1.InferInput<S> : never;
+export type OutgoingWebhookDataFor<TMap, Input> = Input extends {
+    event: infer Event;
+} ? Event extends keyof TMap ? {
+    data: Safe<TMap[Event]>;
+} : unknown : unknown;
+export interface TypedWebhookService<TMap = Record<string, unknown>> extends Omit<WebhookService, 'send'> {
+    send<const T extends SendWebhookInput>(input: Safe<T> & OutgoingWebhookDataFor<TMap, T>): Promise<SendWebhookResult>;
+}
+export declare const defineOutgoingWebhook: <const Event extends string, Payload extends StandardSchemaV1>(webhook: CoreOutgoingWebhook<Event, Payload>) => CoreOutgoingWebhook<Event, Payload>;

package/dist/wirings/webhook/define-outgoing-webhook.js

@@ -0,0 +1 @@
+export const defineOutgoingWebhook = (webhook) => webhook;

package/dist/wirings/webhook/index.d.ts

@@ -0,0 +1,2 @@
+export { defineOutgoingWebhook } from './define-outgoing-webhook.js';
+export type { CoreOutgoingWebhook, OutgoingWebhookDataFor, TypedWebhookService, OutgoingWebhookMeta, OutgoingWebhooksMeta, OutgoingWebhookPayloadOf, } from './define-outgoing-webhook.js';

package/dist/wirings/webhook/index.js

@@ -0,0 +1 @@
+export { defineOutgoingWebhook } from './define-outgoing-webhook.js';

package/dist/wirings/workflow/pikku-scenario-service.d.ts

@@ -8,7 +8,7 @@ import type { ScenarioBrowserProvider, ScenarioEnvironment, ScenarioSurface } fr
 import type { PikkuWorkflowWire, WorkflowQueueOptions } from './workflow.types.js';
 export { addFeature, resolveFeatureScenarios } from './feature.js';
 export type { CoreFeature, CoreFeatureScenario, FeatureMeta, FeaturesMeta, PikkuBrowserWire, PikkuScenarioWire, ScenarioBrowserFailure, ScenarioBrowserProvider, ScenarioEnvironment, ScenarioStepKind, ScenarioStepMeta, ScenarioStepOptions, ScenarioScreenshotOptions, ScenarioStepPhase, ScenarioSurface, TestIdSelector, } from './scenario.types.js';
-export type { ScenarioArtifact, ScenarioFailureDetail, ScenarioResult, ScenarioRunRecord, ScenarioRunReport, ScenarioRunSelection, ScenarioRunStatus, ScenarioRunStore, ScenarioRunSummary, ScenarioStepRow, ScenarioStepVideoOffset, } from './scenario-run.types.js';
+export type { ScenarioArtifact, ScenarioFailureDetail, ScenarioResult, ScenarioRunRecord, ScenarioRunReport, ScenarioRunSelection, ScenarioRunStatus, ScenarioRunStore, ScenarioRunSummary, ScenarioRunVersion, ScenarioStepRow, ScenarioStepVideoOffset, } from './scenario-run.types.js';
 export { SCENARIO_SURFACES } from './scenario-step.types.js';
 export { resolveScenarioSurfaces } from './scenario-surface.js';
 export { pollUntil, type PollOptions } from './scenario-poll.js';

package/dist/wirings/workflow/scenario-run.types.d.ts

@@ -95,7 +95,12 @@ export interface ScenarioFailureDetail {
 }
 export interface ScenarioResult {
     name: string;
-    status: 'passed' | 'failed';
+    /**
+     * `running` is filed the moment the scenario starts and replaced when it
+     * ends, so a console watching a run in progress can tell the scenario on
+     * screen right now from the ones still waiting their turn.
+     */
+    status: 'passed' | 'failed' | 'running';
     durationMs: number;
     output?: unknown;
     error?: string;
@@ -117,6 +122,11 @@ export interface ScenarioResult {
      * feature under, and it is what survives the title being rewritten.
      */
     featureId?: string;
+    /** The scenario's declared title, snapshotted so the record reads as prose. */
+    title?: string;
+    description?: string;
+    /** Who the scenario cast, in declaration order. */
+    actors?: string[];
     tags?: string[];
     /** Images and footage this scenario produced, filed under the run. */
     artifacts?: ScenarioArtifact[];
@@ -155,6 +165,32 @@ export interface ScenarioRunSelection {
     tags?: string[];
     excludeTags?: string[];
 }
+/**
+ * Which version of the suite a run ran against.
+ *
+ * A run is only comparable to another run of the same thing, and "the same
+ * thing" is the commit — two runs a day apart are not a flake and a fix if the
+ * suite moved between them. `attempt` counts the runs already filed against
+ * that commit, so a suite re-run until it passes reads as one version with
+ * several attempts rather than several unrelated runs.
+ *
+ * Absent when the project is not in a git repository, or has no commits yet:
+ * an unversioned run is still a run, and saying nothing is better than
+ * inventing a version for it.
+ */
+export interface ScenarioRunVersion {
+    /** The commit the working tree was at, in full. */
+    commit: string;
+    /**
+     * The tree had uncommitted changes, so the commit does not describe what
+     * actually ran. Recorded rather than refused — running against a dirty tree
+     * is the normal way to work — but a reader comparing two attempts of the
+     * same commit needs to know one of them was not really that commit.
+     */
+    dirty?: boolean;
+    /** Which run this is against that commit, counting from one. */
+    attempt: number;
+}
 /**
  * A whole run, as it is stored and read back.
  *
@@ -170,6 +206,8 @@ export interface ScenarioRunRecord extends ScenarioRunReport {
     surface: string;
     /** Absent on a run of the whole suite; see {@link ScenarioRunSelection}. */
     selection?: ScenarioRunSelection;
+    /** The suite version this ran against, when the project has one. */
+    version?: ScenarioRunVersion;
     startedAt: string;
     finishedAt?: string;
 }
@@ -178,6 +216,7 @@ export interface ScenarioRunSummary {
     runId: string;
     environment: string;
     surface: string;
+    version?: ScenarioRunVersion;
     status: ScenarioRunStatus;
     startedAt: string;
     finishedAt?: string;
@@ -202,7 +241,11 @@ export interface ScenarioRunSummary {
 export interface ScenarioRunStore {
     /** Open a run. Called before the first scenario, with `status: 'running'`. */
     start(record: ScenarioRunRecord): Promise<void>;
-    /** Append one finished scenario to an open run. */
+    /**
+     * File one scenario's state against an open run, replacing whatever was
+     * filed for that name before — a scenario is recorded twice, once as
+     * `running` and once with its outcome.
+     */
     recordScenario(runId: string, result: ScenarioResult): Promise<void>;
     /**
      * File the run's artifacts against the scenarios that produced them.

package/dist/wirings/workflow/scenario-step.types.d.ts

@@ -180,6 +180,9 @@ export interface ScenarioScreenshotOptions {
 /**
  * One actor's browser session, handed to a step as `wire.browser`.
  *
+ * Every actor gets their own, so a two-actor scenario drives two sessions and
+ * `screenshot` files each shot under the actor it belongs to.
+ *
  * Only what every driver can honour is declared here. A driver package adds
  * the rest by declaration-merging onto this interface — `@pikku/playwright`
  * contributes `page`, `context` and `locate` — so a step written against the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.123",
+  "version": "0.12.126",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -69,6 +69,7 @@
     "./persona": "./dist/wirings/persona/index.js",
     "./secret": "./dist/wirings/secret/index.js",
     "./variable": "./dist/wirings/variable/index.js",
+    "./webhook": "./dist/wirings/webhook/index.js",
     "./oauth2": "./dist/wirings/oauth2/index.js",
     "./errors": "./dist/errors/index.js",
     "./services": "./dist/services/index.js",

package/src/public-surface.json

@@ -100,9 +100,7 @@
     "reconstructStateAt"
   ],
   "./workflow/types": [],
-  "./actor-flow": [
-    "runConversation"
-  ],
+  "./actor-flow": ["runConversation"],
   "./virtual-user": [
     "DEFAULT_MAX_INTERVAL_MS",
     "DEFAULT_MIN_INTERVAL_MS",
@@ -165,9 +163,7 @@
     "wireHTTP",
     "wireHTTPRoutes"
   ],
-  "./remote": [
-    "buildRemoteHeaders"
-  ],
+  "./remote": ["buildRemoteHeaders"],
   "./queue": [
     "QueueJobDiscardedError",
     "QueueJobFailedError",
@@ -184,9 +180,15 @@
     "wireScheduler"
   ],
   "./trigger": [
+    "PIKKU_INCOMING_WEBHOOK_QUEUE_NAME",
     "PikkuTriggerService",
+    "dispatchWebhookSourceJob",
+    "receiveWebhookSourceRequest",
+    "runWebhookSourceLifecycle",
+    "subscribedWebhookEvents",
     "wireTrigger",
-    "wireTriggerSource"
+    "wireTriggerSource",
+    "wireTriggerWebhookSource"
   ],
   "./rpc": [
     "PikkuRPCService",
@@ -207,10 +209,7 @@
     "safeFetch",
     "setDefaultHostResolver"
   ],
-  "./node-host-resolver": [
-    "installNodeHostResolver",
-    "nodeHostResolver"
-  ],
+  "./node-host-resolver": ["installNodeHostResolver", "nodeHostResolver"],
   "./mcp": [
     "MCPEndpointRegistry",
     "MCPError",
@@ -297,10 +296,7 @@
     "wantsStackTrace",
     "wireCLI"
   ],
-  "./cli/command-parser": [
-    "generateCommandHelp",
-    "parseCLIArguments"
-  ],
+  "./cli/command-parser": ["generateCommandHelp", "parseCLIArguments"],
   "./cli/channel": [
     "executeCLIViaChannel",
     "executeRawCLIViaChannel",
@@ -360,10 +356,8 @@
     "deriveOAuth2AppSecrets",
     "validateAndBuildSecretDefinitionsMeta"
   ],
-  "./variable": [
-    "defineVariable",
-    "validateAndBuildVariableDefinitionsMeta"
-  ],
+  "./variable": ["defineVariable", "validateAndBuildVariableDefinitionsMeta"],
+  "./webhook": ["defineOutgoingWebhook"],
   "./oauth2": [],
   "./errors": [
     "AIProviderAuthError",
@@ -428,6 +422,7 @@
     "InMemorySessionStore",
     "InMemoryTriggerService",
     "InMemoryWorkflowService",
+    "IncomingWebhookService",
     "JsonConsoleLogger",
     "LocalCredentialService",
     "LocalEmailService",
@@ -486,19 +481,10 @@
     "subjectIdOf",
     "validateAndBuildFeatureFlagDefinitionsMeta"
   ],
-  "./services/local-meta": [
-    "LocalMetaService"
-  ],
-  "./services/v8-coverage": [
-    "V8CoverageService"
-  ],
-  "./services/istanbul-coverage": [
-    "IstanbulCoverageService"
-  ],
-  "./services/local-content": [
-    "LocalContent",
-    "signedContentPath"
-  ],
+  "./services/local-meta": ["LocalMetaService"],
+  "./services/v8-coverage": ["V8CoverageService"],
+  "./services/istanbul-coverage": ["IstanbulCoverageService"],
+  "./services/local-content": ["LocalContent", "signedContentPath"],
   "./services/local-content-request-handler": [
     "createLocalContentRequestHandler",
     "verifySignedContentRequest"
@@ -528,10 +514,7 @@
     "verifyWithKeyMaterial",
     "wrapDEK"
   ],
-  "./hmac": [
-    "hmacSha256Hex",
-    "timingSafeStringEqual"
-  ],
+  "./hmac": ["hmacSha256Hex", "timingSafeStringEqual"],
   "./state": [
     "addPackageServiceFactories",
     "getAllPackageStates",
@@ -578,13 +561,6 @@
     "getSchema",
     "validateSchema"
   ],
-  "./testing": [
-    "clearPikkuRuntimeState",
-    "defineServiceTests"
-  ],
-  "./dev": [
-    "pikkuDevReloader",
-    "reconcileAddonRegistry",
-    "reloadGeneratedMeta"
-  ]
+  "./testing": ["clearPikkuRuntimeState", "defineServiceTests"],
+  "./dev": ["pikkuDevReloader", "reconcileAddonRegistry", "reloadGeneratedMeta"]
 }