@shipfox/api-integration-jira 12.2.0 → 12.4.0

package/src/db/installations.test.ts

@@ -8,10 +8,12 @@ import {
   getJiraInstallationByConnectionId,
   getJiraInstallationByWebhookId,
   listJiraInstallationsDueForTokenRefresh,
+  listJiraInstallationsDueForWebhookRenewal,
   markJiraInstallationRevoked,
   markJiraInstallationTokenRefreshAttempt,
   updateJiraInstallationTokenExpiry,
   updateJiraInstallationWebhook,
+  updateJiraInstallationWebhookIfUnchanged,
   upsertJiraInstallation,
   withJiraWebhookRegistrationLock,
 } from './installations.js';
@@ -96,6 +98,53 @@ describe('jira installations', () => {
     expect(result).toMatchObject({webhookIds: [654], webhookExpiresAt});
   });
 
+  it('only updates webhook metadata when the refreshed ids are still current', async () => {
+    const currentWebhookExpiresAt = new Date('2026-08-05T00:00:00.000Z');
+    const input = createInstallationInput({
+      webhookIds: [123],
+      webhookExpiresAt: currentWebhookExpiresAt,
+    });
+    await upsertJiraInstallation(input);
+
+    await expect(
+      updateJiraInstallationWebhookIfUnchanged({
+        connectionId: input.connectionId,
+        expectedWebhookIds: [456],
+        expectedWebhookExpiresAt: currentWebhookExpiresAt,
+        webhookIds: [789],
+        webhookExpiresAt: new Date('2026-08-31T00:00:00.000Z'),
+      }),
+    ).resolves.toBeUndefined();
+    await expect(getJiraInstallationByConnectionId(input.connectionId)).resolves.toMatchObject({
+      webhookIds: [123],
+      webhookExpiresAt: currentWebhookExpiresAt,
+    });
+
+    await expect(
+      updateJiraInstallationWebhookIfUnchanged({
+        connectionId: input.connectionId,
+        expectedWebhookIds: [123],
+        expectedWebhookExpiresAt: new Date('2026-08-04T00:00:00.000Z'),
+        webhookIds: [789],
+        webhookExpiresAt: new Date('2026-08-31T00:00:00.000Z'),
+      }),
+    ).resolves.toBeUndefined();
+    await expect(getJiraInstallationByConnectionId(input.connectionId)).resolves.toMatchObject({
+      webhookIds: [123],
+      webhookExpiresAt: currentWebhookExpiresAt,
+    });
+
+    await expect(
+      updateJiraInstallationWebhookIfUnchanged({
+        connectionId: input.connectionId,
+        expectedWebhookIds: [123],
+        expectedWebhookExpiresAt: currentWebhookExpiresAt,
+        webhookIds: [789],
+        webhookExpiresAt: new Date('2026-08-31T00:00:00.000Z'),
+      }),
+    ).resolves.toMatchObject({webhookIds: [789]});
+  });
+
   it('refuses to repoint a connection to a different Jira site', async () => {
     const first = createInstallationInput();
     await upsertJiraInstallation(first);
@@ -186,6 +235,39 @@ describe('jira installations', () => {
     );
   });
 
+  it('lists only installed installations whose webhooks are nearing expiry', async () => {
+    const due = createInstallationInput({
+      webhookExpiresAt: new Date('2026-08-05T00:00:00.000Z'),
+    });
+    const fresh = createInstallationInput({
+      webhookExpiresAt: new Date('2026-08-20T00:00:00.000Z'),
+    });
+    const missingExpiry = createInstallationInput({webhookExpiresAt: null});
+    const revoked = createInstallationInput({
+      webhookExpiresAt: new Date('2026-08-05T00:00:00.000Z'),
+      status: 'revoked',
+    });
+    await upsertJiraInstallation(due);
+    await upsertJiraInstallation(fresh);
+    await upsertJiraInstallation(missingExpiry);
+    await upsertJiraInstallation(revoked);
+
+    const result = await listJiraInstallationsDueForWebhookRenewal({
+      before: new Date('2026-08-07T00:00:00.000Z'),
+    });
+
+    expect(result.map((installation) => installation.connectionId)).toContain(due.connectionId);
+    expect(result.map((installation) => installation.connectionId)).not.toContain(
+      fresh.connectionId,
+    );
+    expect(result.map((installation) => installation.connectionId)).not.toContain(
+      missingExpiry.connectionId,
+    );
+    expect(result.map((installation) => installation.connectionId)).not.toContain(
+      revoked.connectionId,
+    );
+  });
+
   it('orders due installations by their latest refresh attempt', async () => {
     const refreshTokenLastUsedAt = new Date('1970-01-01T00:00:00.000Z');
     const attemptBase = Date.now();

package/src/db/installations.ts

@@ -1,6 +1,6 @@
 import {isUniqueViolation} from '@shipfox/node-drizzle';
 import {pgClient, withPostgresSession} from '@shipfox/node-postgres';
-import {and, asc, eq, lte, sql} from 'drizzle-orm';
+import {and, asc, eq, isNotNull, isNull, lte, sql} from 'drizzle-orm';
 import {
   JiraConnectionAlreadyLinkedError,
   JiraInstallationAlreadyLinkedError,
@@ -83,6 +83,12 @@ export interface UpdateJiraInstallationWebhookParams {
   webhookExpiresAt: Date | null;
 }
 
+export interface UpdateJiraInstallationWebhookIfUnchangedParams
+  extends UpdateJiraInstallationWebhookParams {
+  expectedWebhookIds: number[];
+  expectedWebhookExpiresAt: Date | null;
+}
+
 type JiraDb = ReturnType<typeof db>;
 type JiraTx = Parameters<Parameters<JiraDb['transaction']>[0]>[0];
 
@@ -211,6 +217,26 @@ export async function listJiraInstallationsDueForTokenRefresh(
   return rows.map(toJiraInstallation);
 }
 
+export async function listJiraInstallationsDueForWebhookRenewal(
+  params: {before: Date; limit?: number | undefined},
+  options: {tx?: unknown} = {},
+): Promise<JiraInstallation[]> {
+  const executor = (options.tx ?? db()) as JiraDb | JiraTx;
+  const rows = await executor
+    .select()
+    .from(jiraInstallations)
+    .where(
+      and(
+        eq(jiraInstallations.status, 'installed'),
+        isNotNull(jiraInstallations.webhookExpiresAt),
+        lte(jiraInstallations.webhookExpiresAt, params.before),
+      ),
+    )
+    .orderBy(asc(jiraInstallations.webhookExpiresAt))
+    .limit(params.limit ?? 100);
+  return rows.map(toJiraInstallation);
+}
+
 export async function updateJiraInstallationWebhook(
   params: UpdateJiraInstallationWebhookParams,
   options: {tx?: unknown} = {},
@@ -228,6 +254,33 @@ export async function updateJiraInstallationWebhook(
   return row ? toJiraInstallation(row) : undefined;
 }
 
+export async function updateJiraInstallationWebhookIfUnchanged(
+  params: UpdateJiraInstallationWebhookIfUnchangedParams,
+  options: {tx?: unknown} = {},
+): Promise<JiraInstallation | undefined> {
+  const executor = (options.tx ?? db()) as JiraDb | JiraTx;
+  const expectedWebhookIds = JSON.stringify([...new Set(params.expectedWebhookIds)]);
+  const [row] = await executor
+    .update(jiraInstallations)
+    .set({
+      webhookIds: params.webhookIds,
+      webhookExpiresAt: params.webhookExpiresAt,
+      updatedAt: new Date(),
+    })
+    .where(
+      and(
+        eq(jiraInstallations.connectionId, params.connectionId),
+        sql`${jiraInstallations.webhookIds} @> ${expectedWebhookIds}::jsonb`,
+        sql`${jiraInstallations.webhookIds} <@ ${expectedWebhookIds}::jsonb`,
+        params.expectedWebhookExpiresAt === null
+          ? isNull(jiraInstallations.webhookExpiresAt)
+          : eq(jiraInstallations.webhookExpiresAt, params.expectedWebhookExpiresAt),
+      ),
+    )
+    .returning();
+  return row ? toJiraInstallation(row) : undefined;
+}
+
 export async function deleteJiraInstallationByConnectionId(
   connectionId: string,
   options: {tx?: unknown} = {},

package/src/index.test.ts

@@ -34,11 +34,17 @@ describe('createJiraIntegrationProvider', () => {
 
   it('exposes explicit connection cleanup without requiring routes', () => {
     const deleteConnectionRecords = vi.fn(() => Promise.resolve());
+    const deleteConnectionRemoteResources = vi.fn(() => Promise.resolve(undefined));
     const deleteConnectionSecrets = vi.fn(() => Promise.resolve());
     const provider = createJiraIntegrationProvider({
-      cleanup: {deleteConnectionRecords, deleteConnectionSecrets},
+      cleanup: {
+        deleteConnectionRemoteResources,
+        deleteConnectionRecords,
+        deleteConnectionSecrets,
+      },
     });
 
+    expect(provider.deleteConnectionRemoteResources).toBe(deleteConnectionRemoteResources);
     expect(provider.deleteConnectionRecords).toBe(deleteConnectionRecords);
     expect(provider.deleteConnectionSecrets).toBe(deleteConnectionSecrets);
   });
@@ -48,6 +54,12 @@ describe('createJiraMaintenanceWorker', () => {
   it('describes the Jira proactive token refresh worker', () => {
     const worker = createJiraMaintenanceWorker({
       tokenStore: {getAccessToken: vi.fn()},
+      jira: {
+        refreshDynamicWebhooks: vi.fn(),
+        registerDynamicWebhook: vi.fn(),
+        deleteDynamicWebhook: vi.fn(),
+      },
+      webhookUrlForConnection: (connectionId) => `https://example.test/${connectionId}`,
       resolveConnection: vi.fn(),
     });
 
@@ -56,12 +68,20 @@ describe('createJiraMaintenanceWorker', () => {
     expect(Object.keys(worker.activities({outboxRegistry: createOutboxRegistry()}))).toContain(
       'refreshJiraTokensActivity',
     );
+    expect(Object.keys(worker.activities({outboxRegistry: createOutboxRegistry()}))).toContain(
+      'renewJiraWebhooksActivity',
+    );
     expect(worker.workflows).toEqual([
       {
         name: 'refreshJiraTokensCron',
         id: 'jira-refresh-tokens',
         cronSchedule: '0 */6 * * *',
       },
+      {
+        name: 'renewJiraWebhooksCron',
+        id: 'jira-renew-webhooks',
+        cronSchedule: '0 */6 * * *',
+      },
     ]);
   });
 });

package/src/index.ts

@@ -10,6 +10,7 @@ import {JiraAgentToolsProvider} from '#core/agent-tools-provider.js';
 import type {JiraTokenStore} from '#core/tokens.js';
 import {createJiraWebhookProcessor} from '#core/webhook-processor.js';
 import {registerJiraWebhook} from '#core/webhook-registration.js';
+import {jiraWebhookUrl} from '#core/webhook-url.js';
 import {closeDb, db} from '#db/db.js';
 import {getJiraInstallationByConnectionId} from '#db/installations.js';
 import {migrationsPath} from '#db/migrations.js';
@@ -20,11 +21,8 @@ import {
 import {
   type CreateJiraWebhookRoutesOptions,
   createJiraWebhookRoutes,
-  JIRA_WEBHOOK_ROUTE_PREFIX,
 } from '#presentation/routes/webhooks.js';
 
-const TRAILING_SLASHES_RE = /\/+$/;
-
 export type {JiraProvider} from '@shipfox/api-integration-jira-dto';
 export type {
   JiraAccessibleResource,
@@ -60,8 +58,15 @@ export type {
   JiraToolCallResult,
 } from '#core/agent-tools-provider.js';
 export {JiraAgentToolsProvider} from '#core/agent-tools-provider.js';
-export type {DisconnectJiraInstallationParams} from '#core/disconnect.js';
-export {disconnectJiraInstallation} from '#core/disconnect.js';
+export type {
+  DeregisterJiraWebhooksParams,
+  DisconnectJiraInstallationParams,
+} from '#core/disconnect.js';
+export {
+  deregisterJiraWebhooks,
+  disconnectJiraInstallation,
+  prepareJiraWebhookDeregistration,
+} from '#core/disconnect.js';
 export {
   JiraAccessTokenMissingError,
   JiraAuthorizationScopeMismatchError,
@@ -108,10 +113,12 @@ export type {
 export {createJiraWebhookProcessor} from '#core/webhook-processor.js';
 export type {RegisterJiraWebhookParams} from '#core/webhook-registration.js';
 export {JIRA_WEBHOOK_TTL_MS, registerJiraWebhook} from '#core/webhook-registration.js';
+export {JIRA_WEBHOOK_ROUTE_PREFIX, jiraWebhookUrl} from '#core/webhook-url.js';
 export type {
   JiraInstallation,
   JiraInstallationLock,
   JiraInstallationStatus,
+  UpdateJiraInstallationWebhookIfUnchangedParams,
   UpdateJiraInstallationWebhookParams,
   UpsertJiraInstallationParams,
 } from '#db/installations.js';
@@ -121,9 +128,11 @@ export {
   getJiraInstallationByConnectionId,
   getJiraInstallationByWebhookId,
   listJiraInstallationsDueForTokenRefresh,
+  listJiraInstallationsDueForWebhookRenewal,
   markJiraInstallationRevoked,
   updateJiraInstallationTokenExpiry,
   updateJiraInstallationWebhook,
+  updateJiraInstallationWebhookIfUnchanged,
   upsertJiraInstallation,
   withJiraRefreshLock,
   withJiraRefreshLockAndWait,
@@ -145,6 +154,13 @@ export interface CreateJiraIntegrationProviderOptions {
   getJiraInstallationByConnectionId?: typeof getJiraInstallationByConnectionId | undefined;
   cleanup?:
     | {
+        deleteConnectionRemoteResources?: (connection: {
+          id: string;
+        }) => Promise<(() => Promise<void>) | undefined>;
+        withConnectionDeletionLock?: (
+          connection: {id: string},
+          fn: () => Promise<void>,
+        ) => Promise<void>;
         deleteConnectionRecords?: (
           connection: {id: string},
           options: {tx: unknown},
@@ -228,10 +244,6 @@ export function createJiraIntegrationProvider(options: CreateJiraIntegrationProv
   };
 }
 
-function jiraWebhookUrl(connectionId: string): string {
-  return `${config.JIRA_WEBHOOK_BASE_URL.replace(TRAILING_SLASHES_RE, '')}${JIRA_WEBHOOK_ROUTE_PREFIX}/${connectionId}`;
-}
-
 function toJiraWebhookOptions(
   routes: CreateJiraIntegrationProviderOptions['routes'],
 ): CreateJiraWebhookRoutesOptions | undefined {

package/src/presentation/routes/webhooks.ts

@@ -14,9 +14,11 @@ import {
   createJiraWebhookProcessor,
   type JiraWebhookProcessor,
 } from '#core/webhook-processor.js';
+import {JIRA_WEBHOOK_ROUTE_PREFIX} from '#core/webhook-url.js';
 
 const jiraWebhookParamsSchema = z.object({connectionId: z.string().uuid()});
-export const JIRA_WEBHOOK_ROUTE_PREFIX = '/webhooks/integrations/jira';
+
+export {JIRA_WEBHOOK_ROUTE_PREFIX};
 
 export interface CreateJiraWebhookRoutesOptions
   extends Omit<CreateJiraWebhookProcessorOptions, 'getJiraInstallationByConnectionId'> {

package/src/temporal/activities/index.ts

@@ -1,5 +1,22 @@
-export {
-  type CreateJiraMaintenanceActivitiesOptions,
-  createJiraMaintenanceActivities,
+import {
+  type CreateJiraMaintenanceActivitiesOptions as CreateJiraTokenMaintenanceActivitiesOptions,
+  createJiraMaintenanceActivities as createJiraTokenMaintenanceActivities,
   type JiraTokenRefreshActivityResult,
 } from './refresh-jira-tokens.js';
+import {
+  type CreateJiraWebhookRenewalActivitiesOptions,
+  createJiraWebhookRenewalActivities,
+  type JiraWebhookRenewalActivityResult,
+} from './renew-jira-webhooks.js';
+
+export type CreateJiraMaintenanceActivitiesOptions = CreateJiraTokenMaintenanceActivitiesOptions &
+  CreateJiraWebhookRenewalActivitiesOptions;
+
+export function createJiraMaintenanceActivities(options: CreateJiraMaintenanceActivitiesOptions) {
+  return {
+    ...createJiraTokenMaintenanceActivities(options),
+    ...createJiraWebhookRenewalActivities(options),
+  };
+}
+
+export type {JiraTokenRefreshActivityResult, JiraWebhookRenewalActivityResult};

package/src/temporal/activities/renew-jira-webhooks.test.ts

@@ -0,0 +1,215 @@
+import type {JiraInstallation} from '#db/installations.js';
+import {JIRA_WEBHOOK_RENEWAL_THRESHOLD_MS} from '#temporal/constants.js';
+import {createJiraWebhookRenewalActivities} from './renew-jira-webhooks.js';
+
+function installation(
+  connectionId: string,
+  overrides: Partial<JiraInstallation> = {},
+): JiraInstallation {
+  const now = new Date('2026-08-01T00:00:00.000Z');
+  return {
+    id: crypto.randomUUID(),
+    connectionId,
+    cloudId: crypto.randomUUID(),
+    siteUrl: 'https://acme.atlassian.net',
+    siteName: 'Acme',
+    authorizingAccountId: crypto.randomUUID(),
+    scopes: ['manage:jira-webhook'],
+    webhookIds: [123],
+    webhookExpiresAt: new Date('2026-08-05T00:00:00.000Z'),
+    status: 'installed',
+    tokenExpiresAt: now,
+    refreshTokenLastUsedAt: now,
+    refreshTokenLastAttemptedAt: now,
+    createdAt: now,
+    updatedAt: now,
+    ...overrides,
+  };
+}
+
+describe('Jira webhook renewal activity', () => {
+  it('refreshes due active connections and skips outside-threshold or inactive connections', async () => {
+    const now = new Date('2026-08-01T00:00:00.000Z');
+    const dueConnectionId = crypto.randomUUID();
+    const outsideConnectionId = crypto.randomUUID();
+    const inactiveConnectionId = crypto.randomUUID();
+    const due = installation(dueConnectionId);
+    const outside = installation(outsideConnectionId, {
+      webhookExpiresAt: new Date(now.getTime() + JIRA_WEBHOOK_RENEWAL_THRESHOLD_MS + 1),
+    });
+    const inactive = installation(inactiveConnectionId);
+    const expirationDate = new Date('2026-08-31T00:00:00.000Z');
+    const getAccessToken = vi.fn().mockResolvedValue('fresh-access-token');
+    const refreshDynamicWebhooks = vi.fn().mockResolvedValue(expirationDate);
+    const updateInstallation = vi.fn().mockResolvedValue({id: 'installation-1'});
+    const resolveConnection = vi
+      .fn()
+      .mockImplementation(async (connectionId: string) =>
+        connectionId === inactiveConnectionId
+          ? {lifecycleStatus: 'error'}
+          : {lifecycleStatus: 'active'},
+      );
+    const listInstallations = vi.fn().mockResolvedValue([due, outside, inactive]);
+    const activities = createJiraWebhookRenewalActivities({
+      tokenStore: {getAccessToken},
+      jira: {
+        refreshDynamicWebhooks,
+        registerDynamicWebhook: vi.fn(),
+        deleteDynamicWebhook: vi.fn(),
+      },
+      webhookUrlForConnection: (connectionId) =>
+        `https://shipfox.example.test/webhooks/integrations/jira/${connectionId}`,
+      resolveConnection,
+      listInstallations,
+      updateInstallation,
+      now: () => now,
+    });
+
+    const result = await activities.renewJiraWebhooksActivity();
+
+    expect(listInstallations).toHaveBeenCalledWith({
+      before: new Date(now.getTime() + JIRA_WEBHOOK_RENEWAL_THRESHOLD_MS),
+      limit: 20,
+    });
+    expect(getAccessToken).toHaveBeenCalledWith({connectionId: dueConnectionId});
+    expect(refreshDynamicWebhooks).toHaveBeenCalledWith({
+      accessToken: 'fresh-access-token',
+      cloudId: due.cloudId,
+      webhookIds: due.webhookIds,
+    });
+    expect(updateInstallation).toHaveBeenCalledWith({
+      connectionId: dueConnectionId,
+      webhookIds: due.webhookIds,
+      webhookExpiresAt: expirationDate,
+      expectedWebhookIds: due.webhookIds,
+      expectedWebhookExpiresAt: due.webhookExpiresAt,
+    });
+    expect(result).toEqual({renewed: 1, reregistered: 0, skipped: 2, failed: 0});
+  });
+
+  it('re-registers and replaces webhook metadata when Jira no longer refreshes the ids', async () => {
+    const connectionId = crypto.randomUUID();
+    const due = installation(connectionId);
+    const registerWebhook = vi.fn().mockResolvedValue({
+      webhookId: 456,
+      webhookExpiresAt: new Date('2026-08-31T00:00:00.000Z'),
+    });
+    const now = new Date('2026-08-01T00:00:00.000Z');
+    const jira = {
+      refreshDynamicWebhooks: vi.fn().mockResolvedValue(undefined),
+      registerDynamicWebhook: vi.fn(),
+      deleteDynamicWebhook: vi.fn(),
+    };
+    const activities = createJiraWebhookRenewalActivities({
+      tokenStore: {getAccessToken: vi.fn().mockResolvedValue('fresh-access-token')},
+      jira,
+      webhookUrlForConnection: (id) =>
+        `https://shipfox.example.test/webhooks/integrations/jira/${id}`,
+      resolveConnection: vi.fn().mockResolvedValue({lifecycleStatus: 'active'}),
+      listInstallations: vi.fn().mockResolvedValue([due]),
+      registerWebhook,
+      now: () => now,
+    });
+
+    const result = await activities.renewJiraWebhooksActivity();
+
+    expect(registerWebhook).toHaveBeenCalledWith(
+      expect.objectContaining({
+        connectionId,
+        cloudId: due.cloudId,
+        accessToken: 'fresh-access-token',
+        webhookUrl: `https://shipfox.example.test/webhooks/integrations/jira/${connectionId}`,
+        replaceExistingWebhooks: true,
+      }),
+    );
+    expect(result).toEqual({renewed: 0, reregistered: 1, skipped: 0, failed: 0});
+  });
+
+  it('counts a failure and keeps sweeping when one connection cannot be renewed', async () => {
+    const brokenConnectionId = crypto.randomUUID();
+    const healthyConnectionId = crypto.randomUUID();
+    const expirationDate = new Date('2026-08-31T00:00:00.000Z');
+    const broken = installation(brokenConnectionId);
+    const healthy = installation(healthyConnectionId);
+    const refreshDynamicWebhooks = vi
+      .fn()
+      .mockImplementation(({cloudId}: {cloudId: string}) =>
+        cloudId === broken.cloudId
+          ? Promise.reject(new Error('Jira rejected'))
+          : Promise.resolve(expirationDate),
+      );
+    const updateInstallation = vi.fn().mockResolvedValue({id: 'installation-1'});
+    const activities = createJiraWebhookRenewalActivities({
+      tokenStore: {getAccessToken: vi.fn().mockResolvedValue('fresh-access-token')},
+      jira: {
+        refreshDynamicWebhooks,
+        registerDynamicWebhook: vi.fn(),
+        deleteDynamicWebhook: vi.fn(),
+      },
+      webhookUrlForConnection: (id) =>
+        `https://shipfox.example.test/webhooks/integrations/jira/${id}`,
+      resolveConnection: vi.fn().mockResolvedValue({lifecycleStatus: 'active'}),
+      listInstallations: vi.fn().mockResolvedValue([broken, healthy]),
+      updateInstallation,
+      now: () => new Date('2026-08-01T00:00:00.000Z'),
+    });
+
+    const result = await activities.renewJiraWebhooksActivity();
+
+    expect(updateInstallation).toHaveBeenCalledOnce();
+    expect(updateInstallation).toHaveBeenCalledWith(
+      expect.objectContaining({connectionId: healthyConnectionId}),
+    );
+    expect(result).toEqual({renewed: 1, reregistered: 0, skipped: 0, failed: 1});
+  });
+
+  it('fails the sweep entry when webhook renewal dependencies are not configured', async () => {
+    const due = installation(crypto.randomUUID());
+    const activities = createJiraWebhookRenewalActivities({
+      tokenStore: {getAccessToken: vi.fn()},
+      resolveConnection: vi.fn().mockResolvedValue({lifecycleStatus: 'active'}),
+      listInstallations: vi.fn().mockResolvedValue([due]),
+      now: () => new Date('2026-08-01T00:00:00.000Z'),
+    });
+
+    await expect(activities.renewJiraWebhooksActivity()).resolves.toEqual({
+      renewed: 0,
+      reregistered: 0,
+      skipped: 0,
+      failed: 1,
+    });
+  });
+
+  it('skips a stale refresh result when webhook metadata changed during the request', async () => {
+    const connectionId = crypto.randomUUID();
+    const due = installation(connectionId);
+    const updateInstallation = vi.fn().mockResolvedValue(undefined);
+    const activities = createJiraWebhookRenewalActivities({
+      tokenStore: {getAccessToken: vi.fn().mockResolvedValue('fresh-access-token')},
+      jira: {
+        refreshDynamicWebhooks: vi.fn().mockResolvedValue(new Date('2026-08-31T00:00:00.000Z')),
+        registerDynamicWebhook: vi.fn(),
+        deleteDynamicWebhook: vi.fn(),
+      },
+      webhookUrlForConnection: (id) => `https://shipfox.example.test/${id}`,
+      resolveConnection: vi.fn().mockResolvedValue({lifecycleStatus: 'active'}),
+      listInstallations: vi.fn().mockResolvedValue([due]),
+      updateInstallation,
+      now: () => new Date('2026-08-01T00:00:00.000Z'),
+    });
+
+    await expect(activities.renewJiraWebhooksActivity()).resolves.toEqual({
+      renewed: 0,
+      reregistered: 0,
+      skipped: 1,
+      failed: 0,
+    });
+    expect(updateInstallation).toHaveBeenCalledWith({
+      connectionId,
+      webhookIds: due.webhookIds,
+      webhookExpiresAt: new Date('2026-08-31T00:00:00.000Z'),
+      expectedWebhookIds: due.webhookIds,
+      expectedWebhookExpiresAt: due.webhookExpiresAt,
+    });
+  });
+});