@shipfox/api-integration-core 2.0.0

package/src/providers/github.ts

@@ -0,0 +1,150 @@
+import {
+  type IntegrationConnection as CoreIntegrationConnection,
+  slugifyConnectionSlug,
+} from '@shipfox/api-integration-core-dto';
+import type {ConnectGithubInstallationInput} from '@shipfox/api-integration-github';
+import {config} from '#config.js';
+import {
+  getIntegrationConnectionById,
+  resolveUniqueConnectionSlug,
+  upsertIntegrationConnection,
+} from '#db/connections.js';
+import {db} from '#db/db.js';
+import {
+  publishIntegrationEventReceived,
+  publishSourcePush,
+  recordDeliveryOnly,
+} from '#db/webhook-deliveries.js';
+import {retryConnectionSlugCollision} from '#providers/connection-slug.js';
+import type {
+  IntegrationModuleParts,
+  IntegrationProviderModule,
+  IntegrationProviderModuleLoadOptions,
+} from '#providers/types.js';
+
+// Stable migration-tracking table name for the GitHub provider database. This
+// must NOT depend on the provider's position in the module `database` array. A
+// positional name would shift if a provider is flag-disabled and silently
+// re-run migrations against existing tables.
+const GITHUB_MIGRATIONS_TABLE = '__drizzle_migrations_integrations_github';
+
+async function loadGithubModuleParts(
+  options: IntegrationProviderModuleLoadOptions = {},
+): Promise<IntegrationModuleParts> {
+  const {
+    createGithubInstallationTokenProvider,
+    createGithubE2eRoutes,
+    encodeInstallationTokenEnvelope,
+    createGithubIntegrationProvider,
+    getGithubInstallationByInstallationId,
+    githubInstallationTokenNamespace,
+    db: githubDb,
+    migrationsPath: githubMigrationsPath,
+    upsertGithubInstallation,
+  } = await import('@shipfox/api-integration-github');
+
+  const tokenProvider = createGithubInstallationTokenProvider({
+    getIntegrationConnectionById,
+    secretStore: options.secrets?.github
+      ? {
+          read: async (workspaceId, installationId) =>
+            (await options.secrets?.github?.getSecret({
+              workspaceId,
+              namespace: githubInstallationTokenNamespace(installationId),
+              key: 'envelope',
+            })) ?? null,
+          write: async (workspaceId, installationId, envelope) => {
+            await options.secrets?.github?.setSecrets({
+              workspaceId,
+              namespace: githubInstallationTokenNamespace(installationId),
+              values: {envelope: encodeInstallationTokenEnvelope(envelope)},
+            });
+          },
+        }
+      : undefined,
+  });
+
+  async function getExistingGithubConnection(input: {
+    installationId: string;
+  }): Promise<CoreIntegrationConnection<'github'> | undefined> {
+    const installation = await getGithubInstallationByInstallationId(input.installationId);
+    if (!installation) return undefined;
+    const connection = await getIntegrationConnectionById(installation.connectionId);
+    if (!connection) return undefined;
+    return connection as CoreIntegrationConnection<'github'>;
+  }
+
+  async function connectGithubInstallation(
+    input: ConnectGithubInstallationInput,
+  ): Promise<CoreIntegrationConnection<'github'>> {
+    return await retryConnectionSlugCollision(() =>
+      db().transaction(async (tx) => {
+        const baseSlug = slugifyConnectionSlug(`github_${input.installation.accountLogin}`, {
+          fallback: 'github',
+        });
+        const slug = await resolveUniqueConnectionSlug(
+          {
+            workspaceId: input.workspaceId,
+            provider: 'github',
+            externalAccountId: input.installationId,
+            baseSlug,
+          },
+          {tx},
+        );
+        const connection = await upsertIntegrationConnection(
+          {
+            workspaceId: input.workspaceId,
+            provider: 'github',
+            externalAccountId: input.installationId,
+            slug,
+            displayName: input.displayName,
+            lifecycleStatus: 'active',
+          },
+          {tx},
+        );
+
+        await upsertGithubInstallation(
+          {
+            connectionId: connection.id,
+            ...input.installation,
+          },
+          {tx},
+        );
+
+        return connection as CoreIntegrationConnection<'github'>;
+      }),
+    );
+  }
+
+  return {
+    provider: createGithubIntegrationProvider({
+      getExistingGithubConnection,
+      connectGithubInstallation,
+      publishIntegrationEventReceived,
+      publishSourcePush,
+      recordDeliveryOnly,
+      getIntegrationConnectionById,
+      coreDb: db,
+      deleteSecrets: options.secrets?.deleteSecrets,
+      agentTools: {tokenProvider},
+    }),
+    e2eRoutes: [
+      createGithubE2eRoutes({
+        getExistingGithubConnection,
+        connectGithubInstallation,
+        connectionCapabilities: ['source_control', 'agent_tools'],
+      }),
+    ],
+    database: {
+      db: githubDb,
+      migrationsPath: githubMigrationsPath,
+      migrationsTableName: GITHUB_MIGRATIONS_TABLE,
+    },
+  };
+}
+
+export const githubProviderModule: IntegrationProviderModule = {
+  id: 'github',
+  enabled: config.INTEGRATIONS_ENABLE_GITHUB_PROVIDER,
+  load: loadGithubModuleParts,
+};

package/src/providers/linear.ts

@@ -0,0 +1,179 @@
+import {
+  type IntegrationConnection as CoreIntegrationConnection,
+  slugifyConnectionSlug,
+} from '@shipfox/api-integration-core-dto';
+import type {
+  ConnectLinearInstallationInput,
+  LinearSecretsStore,
+} from '@shipfox/api-integration-linear';
+import {config} from '#config.js';
+import {
+  deleteIntegrationConnection,
+  getIntegrationConnectionById,
+  resolveUniqueConnectionSlug,
+  upsertIntegrationConnection,
+} from '#db/connections.js';
+import {db} from '#db/db.js';
+import {publishIntegrationEventReceived, recordDeliveryOnly} from '#db/webhook-deliveries.js';
+import {retryConnectionSlugCollision} from '#providers/connection-slug.js';
+import type {IntegrationModuleParts, IntegrationProviderModule} from '#providers/types.js';
+
+const LINEAR_MIGRATIONS_TABLE = '__drizzle_migrations_integrations_linear';
+const LINEAR_SECRETS_NAMESPACE_PREFIX = 'system/integrations/linear/';
+
+type IntegrationDb = ReturnType<typeof db>;
+type IntegrationTx = Parameters<Parameters<IntegrationDb['transaction']>[0]>[0];
+
+async function loadLinearModuleParts(
+  options: Parameters<IntegrationProviderModule['load']>[0] = {},
+): Promise<IntegrationModuleParts> {
+  const {
+    createLinearTokenStore,
+    createLinearE2eRoutes,
+    createLinearIntegrationProvider,
+    config: linearConfig,
+    disconnectLinearInstallation: disconnectLinearInstallationRecords,
+    getLinearInstallationByOrganizationId,
+    db: linearDb,
+    migrationsPath: linearMigrationsPath,
+    upsertLinearInstallation,
+  } = await import('@shipfox/api-integration-linear');
+
+  async function getExistingLinearConnection(input: {
+    organizationId: string;
+  }): Promise<CoreIntegrationConnection<'linear'> | undefined> {
+    const installation = await getLinearInstallationByOrganizationId(input.organizationId);
+    if (!installation) return undefined;
+    const connection = await getIntegrationConnectionById(installation.connectionId);
+    if (!connection) return undefined;
+    return connection as CoreIntegrationConnection<'linear'>;
+  }
+
+  async function connectLinearInstallation(
+    input: ConnectLinearInstallationInput,
+  ): Promise<CoreIntegrationConnection<'linear'>> {
+    return await retryConnectionSlugCollision(() =>
+      db().transaction(async (tx) => {
+        const baseSlug = slugifyConnectionSlug(`linear_${input.organizationUrlKey}`, {
+          fallback: 'linear',
+        });
+        const slug = await resolveUniqueConnectionSlug(
+          {
+            workspaceId: input.workspaceId,
+            provider: 'linear',
+            externalAccountId: input.organizationId,
+            baseSlug,
+          },
+          {tx},
+        );
+        const connection = await upsertIntegrationConnection(
+          {
+            workspaceId: input.workspaceId,
+            provider: 'linear',
+            externalAccountId: input.organizationId,
+            slug,
+            displayName: input.displayName,
+            lifecycleStatus: 'active',
+          },
+          {tx},
+        );
+
+        await upsertLinearInstallation(
+          {
+            connectionId: connection.id,
+            organizationId: input.organizationId,
+            organizationUrlKey: input.organizationUrlKey,
+            appUserId: input.appUserId,
+            scopes: input.scopes,
+            tokenExpiresAt: input.tokenExpiresAt,
+            status: 'installed',
+          },
+          {tx},
+        );
+
+        return connection as CoreIntegrationConnection<'linear'>;
+      }),
+    );
+  }
+
+  async function disconnectLinearInstallation(input: {connectionId: string}): Promise<void> {
+    await disconnectLinearInstallationRecords<IntegrationTx>({
+      connectionId: input.connectionId,
+      getConnection: getIntegrationConnectionById,
+      deleteSecrets: (params) =>
+        options.secrets?.linear?.deleteSecrets({
+          ...params,
+          namespace: linearNamespaceSuffix(params.namespace),
+        }) ?? Promise.resolve(0),
+      transaction: (fn) => db().transaction((tx) => fn(tx)),
+      deleteConnection: (params, options) =>
+        deleteIntegrationConnection({id: params.connectionId}, options),
+    });
+  }
+
+  const fallbackSecrets: LinearSecretsStore = {
+    getSecret: () => Promise.resolve(null),
+    setSecrets: () => Promise.reject(new Error('Linear token storage is not configured')),
+  };
+  const secrets: LinearSecretsStore = options.secrets?.linear
+    ? {
+        getSecret: (params: Parameters<LinearSecretsStore['getSecret']>[0]) =>
+          options.secrets?.linear?.getSecret({
+            ...params,
+            namespace: linearNamespaceSuffix(params.namespace),
+          }) ?? Promise.resolve(null),
+        setSecrets: (params: Parameters<LinearSecretsStore['setSecrets']>[0]) =>
+          options.secrets?.linear?.setSecrets({
+            ...params,
+            namespace: linearNamespaceSuffix(params.namespace),
+          }) ?? Promise.resolve(),
+      }
+    : fallbackSecrets;
+  const tokenStore = createLinearTokenStore({
+    resolveConnection: async (connectionId) => getIntegrationConnectionById(connectionId),
+    secrets,
+  });
+
+  return {
+    provider: createLinearIntegrationProvider({
+      agentTools: {tokenStore, endpoint: linearConfig.LINEAR_MCP_ENDPOINT},
+      routes: {
+        tokenStore,
+        getExistingLinearConnection,
+        connectLinearInstallation,
+        disconnectLinearInstallation,
+        publishIntegrationEventReceived,
+        recordDeliveryOnly,
+        getIntegrationConnectionById,
+        coreDb: db,
+      },
+    }),
+    e2eRoutes: [
+      createLinearE2eRoutes({
+        tokenStore,
+        getExistingLinearConnection,
+        connectLinearInstallation,
+        disconnectLinearInstallation,
+        connectionCapabilities: ['agent_tools'],
+      }),
+    ],
+    database: {
+      db: linearDb,
+      migrationsPath: linearMigrationsPath,
+      migrationsTableName: LINEAR_MIGRATIONS_TABLE,
+    },
+  };
+}
+
+export const linearProviderModule: IntegrationProviderModule = {
+  id: 'linear',
+  enabled: config.INTEGRATIONS_ENABLE_LINEAR_PROVIDER,
+  load: loadLinearModuleParts,
+};
+
+function linearNamespaceSuffix(namespace: string): string {
+  if (!namespace.startsWith(LINEAR_SECRETS_NAMESPACE_PREFIX)) {
+    throw new Error('Linear provider attempted to access an unscoped secret namespace');
+  }
+  return namespace.slice(LINEAR_SECRETS_NAMESPACE_PREFIX.length);
+}

package/src/providers/modules.test.ts

@@ -0,0 +1,40 @@
+describe('loadEnabledProviderModules', () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+    vi.resetModules();
+  });
+
+  it('loads cron alongside webhook by default', async () => {
+    vi.resetModules();
+
+    const {loadEnabledProviderModules} = await import('#providers/modules.js');
+    const parts = await loadEnabledProviderModules();
+
+    expect(parts.map((part) => part.provider.provider)).toEqual(['cron', 'webhook']);
+  });
+
+  it('does not load cron when the provider is disabled', async () => {
+    vi.stubEnv('INTEGRATIONS_ENABLE_CRON_PROVIDER', 'false');
+    vi.resetModules();
+
+    const {loadEnabledProviderModules} = await import('#providers/modules.js');
+    const parts = await loadEnabledProviderModules();
+
+    expect(parts.map((part) => part.provider.provider)).toEqual(['webhook']);
+  });
+
+  it('loads Linear when the provider is enabled', async () => {
+    vi.stubEnv('INTEGRATIONS_ENABLE_LINEAR_PROVIDER', 'true');
+    vi.resetModules();
+
+    const {loadEnabledProviderModules} = await import('#providers/modules.js');
+    const parts = await loadEnabledProviderModules();
+
+    expect(parts.map((part) => part.provider.provider)).toEqual(['linear', 'cron', 'webhook']);
+    expect(parts[0]?.provider).toMatchObject({
+      provider: 'linear',
+      displayName: 'Linear',
+      adapters: {},
+    });
+  });
+});

package/src/providers/modules.ts

@@ -0,0 +1,32 @@
+import {cronProviderModule} from '#providers/cron.js';
+import {giteaProviderModule} from '#providers/gitea.js';
+import {githubProviderModule} from '#providers/github.js';
+import {linearProviderModule} from '#providers/linear.js';
+import {sentryProviderModule} from '#providers/sentry.js';
+import type {
+  IntegrationModuleParts,
+  IntegrationProviderModuleLoadOptions,
+} from '#providers/types.js';
+import {webhookProviderModule} from '#providers/webhook.js';
+
+// Order is significant: databases are migrated in this order, so list a provider
+// before any that depend on its tables.
+const providerModules = [
+  githubProviderModule,
+  linearProviderModule,
+  sentryProviderModule,
+  giteaProviderModule,
+  cronProviderModule,
+  webhookProviderModule,
+];
+
+export async function loadEnabledProviderModules(
+  options: IntegrationProviderModuleLoadOptions = {},
+): Promise<IntegrationModuleParts[]> {
+  const parts: IntegrationModuleParts[] = [];
+  for (const module of providerModules) {
+    if (!module.enabled) continue;
+    parts.push(await module.load(options));
+  }
+  return parts;
+}

package/src/providers/sentry.ts

@@ -0,0 +1,113 @@
+import {
+  type IntegrationConnection as CoreIntegrationConnection,
+  slugifyConnectionSlug,
+} from '@shipfox/api-integration-core-dto';
+import type {ConnectSentryInstallationInput} from '@shipfox/api-integration-sentry';
+import {config} from '#config.js';
+import {
+  getIntegrationConnectionById,
+  resolveUniqueConnectionSlug,
+  updateIntegrationConnectionLifecycleStatus,
+  upsertIntegrationConnection,
+} from '#db/connections.js';
+import {db} from '#db/db.js';
+import {publishIntegrationEventReceived, recordDeliveryOnly} from '#db/webhook-deliveries.js';
+import {retryConnectionSlugCollision} from '#providers/connection-slug.js';
+import type {IntegrationModuleParts, IntegrationProviderModule} from '#providers/types.js';
+
+// Stable migration-tracking table name for the Sentry provider database. This
+// must NOT depend on the provider's position in the module `database` array. A
+// positional name would shift if a provider is flag-disabled and silently
+// re-run migrations against existing tables.
+const SENTRY_MIGRATIONS_TABLE = '__drizzle_migrations_integrations_sentry';
+
+async function loadSentryModuleParts(): Promise<IntegrationModuleParts> {
+  const {
+    createSentryIntegrationProvider,
+    createSentryMaintenanceWorker,
+    getSentryInstallationByInstallationUuid,
+    persistVerifiedUnclaimedInstallation,
+    upsertSentryInstallation,
+    db: sentryDb,
+    migrationsPath: sentryMigrationsPath,
+  } = await import('@shipfox/api-integration-sentry');
+
+  async function getConnectionById(
+    id: string,
+  ): Promise<CoreIntegrationConnection<'sentry'> | undefined> {
+    const connection = await getIntegrationConnectionById(id);
+    if (!connection) return undefined;
+    return connection as CoreIntegrationConnection<'sentry'>;
+  }
+
+  async function connectSentryInstallation(
+    input: ConnectSentryInstallationInput,
+  ): Promise<CoreIntegrationConnection<'sentry'>> {
+    return await retryConnectionSlugCollision(() =>
+      db().transaction(async (tx) => {
+        const baseSlug = slugifyConnectionSlug(`sentry_${input.orgSlug}`, {fallback: 'sentry'});
+        const slug = await resolveUniqueConnectionSlug(
+          {
+            workspaceId: input.workspaceId,
+            provider: 'sentry',
+            externalAccountId: input.installationUuid,
+            baseSlug,
+          },
+          {tx},
+        );
+        const connection = await upsertIntegrationConnection(
+          {
+            workspaceId: input.workspaceId,
+            provider: 'sentry',
+            externalAccountId: input.installationUuid,
+            slug,
+            displayName: input.displayName,
+            lifecycleStatus: 'active',
+          },
+          {tx},
+        );
+
+        await upsertSentryInstallation(
+          {
+            connectionId: connection.id,
+            installationUuid: input.installationUuid,
+            orgSlug: input.orgSlug,
+            status: 'installed',
+            codeHash: input.codeHash,
+            installerUserId: input.installerUserId,
+          },
+          {tx},
+        );
+
+        return connection as CoreIntegrationConnection<'sentry'>;
+      }),
+    );
+  }
+
+  return {
+    provider: createSentryIntegrationProvider({
+      getSentryInstallation: ({installationUuid}) =>
+        getSentryInstallationByInstallationUuid(installationUuid),
+      getConnectionById,
+      connectSentryInstallation,
+      persistVerifiedUnclaimedInstallation,
+      coreDb: db,
+      publishIntegrationEventReceived,
+      recordDeliveryOnly,
+      getIntegrationConnectionById,
+      updateConnectionLifecycleStatus: updateIntegrationConnectionLifecycleStatus,
+    }),
+    database: {
+      db: sentryDb,
+      migrationsPath: sentryMigrationsPath,
+      migrationsTableName: SENTRY_MIGRATIONS_TABLE,
+    },
+    workers: [createSentryMaintenanceWorker()],
+  };
+}
+
+export const sentryProviderModule: IntegrationProviderModule = {
+  id: 'sentry',
+  enabled: config.INTEGRATIONS_ENABLE_SENTRY_PROVIDER,
+  load: loadSentryModuleParts,
+};

package/src/providers/types.ts

@@ -0,0 +1,52 @@
+import type {RouteExport} from '@shipfox/node-fastify';
+import type {ModuleDatabase, ModuleWorker} from '@shipfox/node-module';
+import type {IntegrationProvider} from '#core/entities/provider.js';
+
+/**
+ * Everything one integration contributes to the composed integrations module:
+ * a registry provider, plus an optional dedicated database, background workers,
+ * and one-shot boot-time tasks. Providers that own none of these simply omit them.
+ *
+ * A startup task is run once after modules are initialized (migrations done). The
+ * provider owns its own wiring — core runs each task generically and isolates
+ * failures so a task can never gate API boot.
+ */
+export interface IntegrationModuleParts {
+  provider: IntegrationProvider;
+  database?: ModuleDatabase | undefined;
+  e2eRoutes?: RouteExport[] | undefined;
+  workers?: ModuleWorker[] | undefined;
+  startupTasks?: Array<() => Promise<void>> | undefined;
+}
+
+/**
+ * A config-gated integration, registered once in `providerModules`. `load` is
+ * called lazily and only when `enabled`, so a disabled provider never imports
+ * its (potentially heavy) implementation package.
+ */
+export interface IntegrationProviderModule {
+  id: string;
+  enabled: boolean;
+  load(options?: IntegrationProviderModuleLoadOptions): Promise<IntegrationModuleParts>;
+}
+
+export interface IntegrationProviderModuleLoadOptions {
+  secrets?: IntegrationProviderSecrets | undefined;
+}
+
+export interface IntegrationProviderSecrets {
+  github?: IntegrationProviderScopedSecrets | undefined;
+  linear?: IntegrationProviderScopedSecrets | undefined;
+  deleteSecrets(params: {workspaceId: string; namespace: string}): Promise<number>;
+}
+
+export interface IntegrationProviderScopedSecrets {
+  getSecret(params: {workspaceId: string; namespace: string; key: string}): Promise<string | null>;
+  setSecrets(params: {
+    workspaceId: string;
+    namespace: string;
+    values: Record<string, string>;
+    editedBy?: string | null | undefined;
+  }): Promise<void>;
+  deleteSecrets(params: {workspaceId: string; namespace: string}): Promise<number>;
+}

package/src/providers/webhook.ts

@@ -0,0 +1,30 @@
+import {config} from '#config.js';
+import {
+  createIntegrationConnection,
+  deleteIntegrationConnection,
+  getIntegrationConnectionById,
+  listIntegrationConnections,
+  updateIntegrationConnectionLifecycleStatus,
+} from '#db/connections.js';
+import {db} from '#db/db.js';
+import {publishIntegrationEventReceived} from '#db/webhook-deliveries.js';
+import type {IntegrationProviderModule} from '#providers/types.js';
+
+export const webhookProviderModule: IntegrationProviderModule = {
+  id: 'webhook',
+  enabled: config.INTEGRATIONS_ENABLE_WEBHOOK_PROVIDER,
+  load: async () => {
+    const {createWebhookIntegrationProvider} = await import('@shipfox/api-integration-webhook');
+    return {
+      provider: createWebhookIntegrationProvider({
+        coreDb: db,
+        createIntegrationConnection,
+        listIntegrationConnections,
+        getIntegrationConnectionById,
+        updateIntegrationConnectionLifecycleStatus,
+        deleteIntegrationConnection,
+        publishIntegrationEventReceived,
+      }),
+    };
+  },
+};

package/src/temporal/activities/index.ts

@@ -0,0 +1,7 @@
+import {pruneWebhookDeliveriesActivity} from './prune-webhook-deliveries.js';
+
+export function createIntegrationsMaintenanceActivities() {
+  return {
+    pruneWebhookDeliveriesActivity,
+  };
+}

package/src/temporal/activities/prune-webhook-deliveries.test.ts

@@ -0,0 +1,39 @@
+import {randomUUID} from 'node:crypto';
+import {inArray} from 'drizzle-orm';
+import {db} from '#db/db.js';
+import {integrationsWebhookDeliveries} from '#db/schema/webhook-deliveries.js';
+import {pruneWebhookDeliveriesActivity} from './prune-webhook-deliveries.js';
+
+async function insertDelivery(deliveryId: string, receivedAt: Date): Promise<void> {
+  await db()
+    .insert(integrationsWebhookDeliveries)
+    .values({provider: 'github', dedupScope: 'provider:github', deliveryId, receivedAt});
+}
+
+describe('pruneWebhookDeliveriesActivity', () => {
+  it('deletes rows older than the retention window and keeps recent ones', async () => {
+    const oldId = randomUUID();
+    const recentId = randomUUID();
+    const longAgo = new Date(Date.now() - 60 * 24 * 60 * 60 * 1000);
+    const yesterday = new Date(Date.now() - 24 * 60 * 60 * 1000);
+    await insertDelivery(oldId, longAgo);
+    await insertDelivery(recentId, yesterday);
+
+    const result = await pruneWebhookDeliveriesActivity();
+
+    expect(result.deleted).toBe(1);
+    const remaining = await db()
+      .select()
+      .from(integrationsWebhookDeliveries)
+      .where(inArray(integrationsWebhookDeliveries.deliveryId, [oldId, recentId]));
+    expect(remaining.map((row) => row.deliveryId)).toEqual([recentId]);
+  });
+
+  it('returns zero deleted when nothing is past the retention window', async () => {
+    await insertDelivery(randomUUID(), new Date());
+
+    const result = await pruneWebhookDeliveriesActivity();
+
+    expect(result.deleted).toBe(0);
+  });
+});

package/src/temporal/activities/prune-webhook-deliveries.ts

@@ -0,0 +1,9 @@
+import {pruneWebhookDeliveries} from '#db/webhook-deliveries.js';
+import {WEBHOOK_DELIVERY_RETENTION_DAYS} from '#temporal/constants.js';
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+export async function pruneWebhookDeliveriesActivity(): Promise<{deleted: number}> {
+  const olderThan = new Date(Date.now() - WEBHOOK_DELIVERY_RETENTION_DAYS * MS_PER_DAY);
+  return await pruneWebhookDeliveries({olderThan});
+}

package/src/temporal/constants.ts

@@ -0,0 +1,3 @@
+export const INTEGRATIONS_MAINTENANCE_TASK_QUEUE = 'integrations-maintenance';
+
+export const WEBHOOK_DELIVERY_RETENTION_DAYS = 30;

package/src/temporal/workflows/index.ts

@@ -0,0 +1 @@
+export {pruneWebhookDeliveriesCron} from './prune-webhook-deliveries-cron.js';

package/src/temporal/workflows/prune-webhook-deliveries-cron.ts

@@ -0,0 +1,15 @@
+import {log, proxyActivities} from '@temporalio/workflow';
+import type {createIntegrationsMaintenanceActivities} from '../activities/index.js';
+
+const {pruneWebhookDeliveriesActivity} = proxyActivities<
+  ReturnType<typeof createIntegrationsMaintenanceActivities>
+>({
+  startToCloseTimeout: '5 minutes',
+});
+
+export async function pruneWebhookDeliveriesCron(): Promise<void> {
+  const {deleted} = await pruneWebhookDeliveriesActivity();
+  if (deleted > 0) {
+    log.info('Pruned integrations webhook deliveries', {deleted});
+  }
+}