@smartcrab/contracts-management 0.1.0

package/src/users.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from "vitest";
+import {
+  userBlockResponseSchema,
+  userCreateRequestSchema,
+  userDeleteResponseSchema,
+  userEnvironmentQuerySchema,
+  userSchema,
+  userUpdateRequestSchema,
+} from "./users.js";
+
+const VALID_USER = {
+  id: `usr_${"a".repeat(32)}`,
+  environment_id: `env_${"a".repeat(32)}`,
+  email: "user@example.com",
+  email_verified: true,
+  name: "Ada Lovelace",
+  avatar_url: null,
+  locale: "en-US",
+  timezone: "UTC",
+  status: "active",
+  metadata: { plan: "pro" },
+  created_at: "2026-08-02T08:10:00Z",
+  updated_at: "2026-08-02T08:10:00Z",
+  last_login_at: null,
+};
+
+describe("userSchema (design.md §12.1-§12.2)", () => {
+  test("accepts a valid user", () => {
+    expect(userSchema.safeParse(VALID_USER).success).toBe(true);
+  });
+
+  test("rejects an unknown top-level key (e.g. leaking security_version)", () => {
+    expect(userSchema.safeParse({ ...VALID_USER, security_version: 3 }).success).toBe(false);
+  });
+
+  test("rejects email_ciphertext leaking through", () => {
+    expect(userSchema.safeParse({ ...VALID_USER, email_ciphertext: "abc" }).success).toBe(false);
+  });
+});
+
+describe("userCreateRequestSchema", () => {
+  test("requires environment_id and email", () => {
+    expect(
+      userCreateRequestSchema.safeParse({
+        environment_id: VALID_USER.environment_id,
+        email: "a@b.com",
+      }).success,
+    ).toBe(true);
+    expect(
+      userCreateRequestSchema.safeParse({ environment_id: VALID_USER.environment_id }).success,
+    ).toBe(false);
+  });
+});
+
+describe("userEnvironmentQuerySchema", () => {
+  test("requires environment_id for individual user routes", () => {
+    const environment_id = `env_${"a".repeat(32)}`;
+    expect(userEnvironmentQuerySchema.safeParse({ environment_id }).success).toBe(true);
+    expect(userEnvironmentQuerySchema.safeParse({}).success).toBe(false);
+  });
+});
+
+describe("userUpdateRequestSchema", () => {
+  test("does not allow patching email (dual-verify recovery flow, design.md §25)", () => {
+    expect(userUpdateRequestSchema.safeParse({ email: "new@example.com" }).success).toBe(false);
+  });
+
+  test("accepts a partial profile patch", () => {
+    expect(userUpdateRequestSchema.safeParse({ name: "New Name" }).success).toBe(true);
+  });
+});
+
+describe("userDeleteResponseSchema / userBlockResponseSchema", () => {
+  test("delete only reports pending_deletion (design.md §33.1)", () => {
+    expect(
+      userDeleteResponseSchema.safeParse({ id: VALID_USER.id, status: "pending_deletion" }).success,
+    ).toBe(true);
+    expect(
+      userDeleteResponseSchema.safeParse({ id: VALID_USER.id, status: "active" }).success,
+    ).toBe(false);
+  });
+
+  test("block only reports blocked", () => {
+    expect(
+      userBlockResponseSchema.safeParse({ id: VALID_USER.id, status: "blocked" }).success,
+    ).toBe(true);
+    expect(userBlockResponseSchema.safeParse({ id: VALID_USER.id, status: "active" }).success).toBe(
+      false,
+    );
+  });
+});

package/src/users.ts

@@ -0,0 +1,149 @@
+import { z } from "zod";
+import { cursorPageSchema, paginationQuerySchema } from "./common.js";
+import { environmentIdSchema, userIdSchema } from "./primitives.js";
+
+/**
+ * `users` (design.md §12.1) projected with `user_emails` (§12.2)'s decrypted
+ * display value. Excluded: `auth_partition_id` (assignment's forbidden-field
+ * list — internal Auth D1 co-location routing, §12), `security_version`
+ * (internal invalidation counter, excluded by the same rationale
+ * `@smartcrab/contracts-public`'s `/v1/me` uses), `primary_email_id`
+ * (internal FK, superseded here by the resolved `email` field itself), and
+ * `deleted_at` (status `pending_deletion` already reports this, matching
+ * `@smartcrab/contracts-public`'s `meUserSchema`).
+ *
+ * `email` is the plaintext address: `user_emails.email_ciphertext` (the
+ * forbidden column) is decrypted server-side before this projection is
+ * built, exactly as `/v1/me` does for the same underlying table.
+ * `metadata` (from `metadata_json`) IS exposed here — unlike `/v1/me`, this
+ * is the admin-facing Management API, and arbitrary app-defined user
+ * metadata is a normal, non-secret admin/dashboard field (design.md does not
+ * name it a secret column).
+ */
+export const USER_STATUSES = ["active", "blocked", "pending_deletion"] as const;
+export const userStatusSchema = z.enum(USER_STATUSES);
+export type UserStatus = (typeof USER_STATUSES)[number];
+
+const userMetadataSchema = z.record(z.string(), z.unknown());
+
+export const userSchema = z.strictObject({
+  id: userIdSchema,
+  environment_id: environmentIdSchema,
+  email: z.email().nullable(),
+  email_verified: z.boolean(),
+  name: z.string().nullable(),
+  avatar_url: z.url().nullable(),
+  locale: z.string().nullable(),
+  timezone: z.string().nullable(),
+  status: userStatusSchema,
+  metadata: userMetadataSchema,
+  created_at: z.iso.datetime(),
+  updated_at: z.iso.datetime(),
+  last_login_at: z.iso.datetime().nullable(),
+});
+export type User = z.infer<typeof userSchema>;
+
+// ---------------------------------------------------------------------------
+// GET /users
+// ---------------------------------------------------------------------------
+
+export const userListQuerySchema = paginationQuerySchema.extend({
+  environment_id: environmentIdSchema,
+  status: userStatusSchema.optional(),
+  /** Free-text search over name/email (matched server-side against the decrypted/normalized values). */
+  search: z.string().min(1).max(200).optional(),
+});
+export type UserListQuery = z.infer<typeof userListQuerySchema>;
+
+export const userListResponseSchema = cursorPageSchema(userSchema);
+export type UserListResponse = z.infer<typeof userListResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// POST /users
+// ---------------------------------------------------------------------------
+
+export const userCreateRequestSchema = z.strictObject({
+  environment_id: environmentIdSchema,
+  email: z.email(),
+  /** Admin-created users may be marked pre-verified (e.g. bulk import from a trusted source). */
+  email_verified: z.boolean().default(false),
+  name: z.string().min(1).max(200).optional(),
+  avatar_url: z.url().optional(),
+  locale: z.string().min(1).max(35).optional(),
+  timezone: z.string().min(1).max(64).optional(),
+  metadata: userMetadataSchema.default({}),
+});
+export type UserCreateRequest = z.infer<typeof userCreateRequestSchema>;
+
+export const userCreateResponseSchema = userSchema;
+export type UserCreateResponse = z.infer<typeof userCreateResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// GET /users/:userId
+// ---------------------------------------------------------------------------
+
+/** Environment context required by every individual-user route. */
+export const userEnvironmentQuerySchema = z.strictObject({
+  environment_id: environmentIdSchema,
+});
+export type UserEnvironmentQuery = z.infer<typeof userEnvironmentQuerySchema>;
+
+export const userGetResponseSchema = userSchema;
+export type UserGetResponse = z.infer<typeof userGetResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// PATCH /users/:userId
+// ---------------------------------------------------------------------------
+
+/**
+ * `email` is deliberately excluded, same as `@smartcrab/contracts-public`'s
+ * `meUpdateRequestSchema`: changing it is a dual-verification recovery flow
+ * (design.md §25), not a generic field patch — for admin-initiated changes,
+ * design.md §25 additionally requires Owner/Admin, a reason, and an audit
+ * record, which this generic `PATCH` does not carry.
+ */
+export const userUpdateRequestSchema = z.strictObject({
+  name: z.string().min(1).max(200).optional(),
+  avatar_url: z.url().optional(),
+  locale: z.string().min(1).max(35).optional(),
+  timezone: z.string().min(1).max(64).optional(),
+  metadata: userMetadataSchema.optional(),
+});
+export type UserUpdateRequest = z.infer<typeof userUpdateRequestSchema>;
+
+export const userUpdateResponseSchema = userSchema;
+export type UserUpdateResponse = z.infer<typeof userUpdateResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// DELETE /users/:userId (design.md §33.1: logical delete first)
+// ---------------------------------------------------------------------------
+
+export const userDeleteResponseSchema = z.strictObject({
+  id: userIdSchema,
+  status: z.literal("pending_deletion"),
+});
+export type UserDeleteResponse = z.infer<typeof userDeleteResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// POST /users/:userId/block, /users/:userId/unblock
+// ---------------------------------------------------------------------------
+
+export const userBlockRequestSchema = z.strictObject({
+  reason: z.string().min(1).max(1000).optional(),
+});
+export type UserBlockRequest = z.infer<typeof userBlockRequestSchema>;
+
+export const userBlockResponseSchema = z.strictObject({
+  id: userIdSchema,
+  status: z.literal("blocked"),
+});
+export type UserBlockResponse = z.infer<typeof userBlockResponseSchema>;
+
+export const userUnblockRequestSchema = z.strictObject({});
+export type UserUnblockRequest = z.infer<typeof userUnblockRequestSchema>;
+
+export const userUnblockResponseSchema = z.strictObject({
+  id: userIdSchema,
+  status: z.literal("active"),
+});
+export type UserUnblockResponse = z.infer<typeof userUnblockResponseSchema>;

package/src/webhooks.test.ts

@@ -0,0 +1,187 @@
+import { describe, expect, test } from "vitest";
+import {
+  webhookCreateRequestSchema,
+  webhookCreateResponseSchema,
+  webhookDeliveryListQuerySchema,
+  webhookDeliveryListResponseSchema,
+  webhookDeliverySchema,
+  webhookListResponseSchema,
+  webhookRotateSecretResponseSchema,
+  webhookSchema,
+  webhookTestResponseSchema,
+} from "./webhooks.js";
+
+const VALID_WEBHOOK = {
+  id: `whk_${"a".repeat(32)}`,
+  environment_id: `env_${"a".repeat(32)}`,
+  url: "https://hooks.customer.example/auth-events",
+  event_types: ["user.created", "login.succeeded"],
+  status: "active",
+  created_at: "2026-08-02T08:10:00Z",
+  updated_at: "2026-08-02T08:10:00Z",
+};
+
+describe("webhookSchema (design.md §11.13, §29.4)", () => {
+  test("accepts a valid webhook", () => {
+    expect(webhookSchema.safeParse(VALID_WEBHOOK).success).toBe(true);
+  });
+
+  test("rejects an unknown top-level key (e.g. leaking secret_ciphertext)", () => {
+    expect(webhookSchema.safeParse({ ...VALID_WEBHOOK, secret_ciphertext: "abc" }).success).toBe(
+      false,
+    );
+  });
+
+  test("rejects an unknown event type", () => {
+    expect(
+      webhookSchema.safeParse({ ...VALID_WEBHOOK, event_types: ["not.a.real.event"] }).success,
+    ).toBe(false);
+  });
+
+  test("requires at least one event type", () => {
+    expect(webhookSchema.safeParse({ ...VALID_WEBHOOK, event_types: [] }).success).toBe(false);
+  });
+});
+
+describe("webhookCreateRequestSchema / webhookCreateResponseSchema", () => {
+  test("create request needs environment_id, url, event_types", () => {
+    expect(
+      webhookCreateRequestSchema.safeParse({
+        environment_id: VALID_WEBHOOK.environment_id,
+        url: VALID_WEBHOOK.url,
+        event_types: ["user.created"],
+      }).success,
+    ).toBe(true);
+  });
+
+  test("create response includes a one-time plaintext secret", () => {
+    const parsed = webhookCreateResponseSchema.safeParse({
+      ...VALID_WEBHOOK,
+      secret: "whsec_abc123",
+    });
+    expect(parsed.success).toBe(true);
+  });
+});
+
+describe("webhookListResponseSchema never includes a secret field per item", () => {
+  test("rejects an item carrying a secret in the list envelope", () => {
+    expect(
+      webhookListResponseSchema.safeParse({
+        items: [{ ...VALID_WEBHOOK, secret: "leaked" }],
+        next_cursor: null,
+      }).success,
+    ).toBe(false);
+  });
+});
+
+describe("webhookRotateSecretResponseSchema", () => {
+  test("returns a one-time secret and rotated_at", () => {
+    expect(
+      webhookRotateSecretResponseSchema.safeParse({
+        id: VALID_WEBHOOK.id,
+        secret: "whsec_new123",
+        rotated_at: "2026-08-02T08:10:00Z",
+      }).success,
+    ).toBe(true);
+  });
+});
+
+describe("webhookTestResponseSchema (design.md §29.4: '2xxだけ成功')", () => {
+  test("accepts a successful delivery result", () => {
+    expect(
+      webhookTestResponseSchema.safeParse({
+        delivered: true,
+        response_status: 200,
+        response_time_ms: 120,
+        requested_at: "2026-08-02T08:10:00Z",
+      }).success,
+    ).toBe(true);
+  });
+});
+
+const VALID_DELIVERY = {
+  id: `dlv_${"a".repeat(32)}`,
+  webhook_id: VALID_WEBHOOK.id,
+  event_id: `evt_${"a".repeat(32)}`,
+  event_type: "login.succeeded",
+  attempt: 1,
+  status: "delivered",
+  response_status_code: 200,
+  duration_ms: 42,
+  occurred_at: "2026-08-02T08:10:00Z",
+};
+
+describe("webhookDeliverySchema (design.md §29.4, §10.10)", () => {
+  test("accepts a valid delivery record", () => {
+    expect(webhookDeliverySchema.safeParse(VALID_DELIVERY).success).toBe(true);
+  });
+
+  test("accepts a null response_status_code (e.g. a transport-level failure)", () => {
+    expect(
+      webhookDeliverySchema.safeParse({ ...VALID_DELIVERY, response_status_code: null }).success,
+    ).toBe(true);
+  });
+
+  test("rejects an unknown status value", () => {
+    expect(
+      webhookDeliverySchema.safeParse({ ...VALID_DELIVERY, status: "succeeded" }).success,
+    ).toBe(false);
+  });
+
+  test("rejects an unknown top-level key (e.g. a leaked request/response body field)", () => {
+    expect(webhookDeliverySchema.safeParse({ ...VALID_DELIVERY, body: "{}" }).success).toBe(false);
+    expect(
+      webhookDeliverySchema.safeParse({ ...VALID_DELIVERY, signature: "v1=abc" }).success,
+    ).toBe(false);
+  });
+
+  test("event_type tolerates a value outside the current webhookEventTypeSchema enum (90-day retention, design.md §10.10)", () => {
+    expect(
+      webhookDeliverySchema.safeParse({ ...VALID_DELIVERY, event_type: "some.retired.event" })
+        .success,
+    ).toBe(true);
+  });
+});
+
+describe("webhookDeliveryListQuerySchema", () => {
+  test("accepts an empty query (no filters)", () => {
+    expect(webhookDeliveryListQuerySchema.safeParse({}).success).toBe(true);
+  });
+
+  test("accepts status/occurred_after/occurred_before filters", () => {
+    expect(
+      webhookDeliveryListQuerySchema.safeParse({
+        status: "failed",
+        occurred_after: "2026-08-01T00:00:00Z",
+        occurred_before: "2026-08-02T00:00:00Z",
+      }).success,
+    ).toBe(true);
+  });
+
+  test("rejects an unknown status filter value", () => {
+    expect(webhookDeliveryListQuerySchema.safeParse({ status: "ok" }).success).toBe(false);
+  });
+
+  test("rejects a limit above the shared MAX_PAGE_SIZE of 100", () => {
+    expect(webhookDeliveryListQuerySchema.safeParse({ limit: 101 }).success).toBe(false);
+    expect(webhookDeliveryListQuerySchema.safeParse({ limit: 100 }).success).toBe(true);
+  });
+});
+
+describe("webhookDeliveryListResponseSchema", () => {
+  test("wraps a cursor page of deliveries", () => {
+    expect(
+      webhookDeliveryListResponseSchema.safeParse({ items: [VALID_DELIVERY], next_cursor: null })
+        .success,
+    ).toBe(true);
+  });
+
+  test("rejects an item carrying a body/header/signature field", () => {
+    expect(
+      webhookDeliveryListResponseSchema.safeParse({
+        items: [{ ...VALID_DELIVERY, headers: {} }],
+        next_cursor: null,
+      }).success,
+    ).toBe(false);
+  });
+});

package/src/webhooks.ts

@@ -0,0 +1,182 @@
+import { httpsUrlSchema } from "@smartcrab/contracts-public";
+import { z } from "zod";
+import { cursorPageSchema, paginationQuerySchema } from "./common.js";
+import {
+  deliveryIdSchema,
+  environmentIdSchema,
+  eventIdSchema,
+  webhookIdSchema,
+} from "./primitives.js";
+
+/**
+ * `webhook_endpoints` (design.md §11.13) and the Customer Webhook event
+ * catalog (design.md §29.4's "イベント例" list, treated as the canonical
+ * enum since no other source enumerates event types). `secret_ciphertext`/
+ * `secret_iv` are excluded per the assignment's forbidden-field list; like
+ * `management_api_keys` (§11.12) and client secrets, the plaintext webhook
+ * signing secret is shown exactly once, on create/rotate.
+ */
+export const WEBHOOK_EVENT_TYPES = [
+  "user.created",
+  "user.updated",
+  "user.deleted",
+  "user.blocked",
+  "identity.linked",
+  "identity.unlinked",
+  "passkey.created",
+  "passkey.deleted",
+  "session.created",
+  "session.revoked",
+  "login.succeeded",
+  "login.failed",
+  "email.delivery.bounced",
+  "mau.threshold_reached",
+] as const;
+export const webhookEventTypeSchema = z.enum(WEBHOOK_EVENT_TYPES);
+export type WebhookEventType = (typeof WEBHOOK_EVENT_TYPES)[number];
+
+export const WEBHOOK_STATUSES = ["active", "disabled"] as const;
+export const webhookStatusSchema = z.enum(WEBHOOK_STATUSES);
+export type WebhookStatus = (typeof WEBHOOK_STATUSES)[number];
+
+export const webhookSchema = z.strictObject({
+  id: webhookIdSchema,
+  environment_id: environmentIdSchema,
+  url: httpsUrlSchema,
+  event_types: z.array(webhookEventTypeSchema).min(1),
+  status: webhookStatusSchema,
+  created_at: z.iso.datetime(),
+  updated_at: z.iso.datetime(),
+});
+export type Webhook = z.infer<typeof webhookSchema>;
+
+// ---------------------------------------------------------------------------
+// GET /webhooks
+// ---------------------------------------------------------------------------
+
+export const webhookListQuerySchema = paginationQuerySchema.extend({
+  environment_id: environmentIdSchema,
+});
+export type WebhookListQuery = z.infer<typeof webhookListQuerySchema>;
+
+export const webhookListResponseSchema = cursorPageSchema(webhookSchema);
+export type WebhookListResponse = z.infer<typeof webhookListResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// POST /webhooks
+// ---------------------------------------------------------------------------
+
+export const webhookCreateRequestSchema = z.strictObject({
+  environment_id: environmentIdSchema,
+  url: httpsUrlSchema,
+  event_types: z.array(webhookEventTypeSchema).min(1),
+});
+export type WebhookCreateRequest = z.infer<typeof webhookCreateRequestSchema>;
+
+/** One-time plaintext signing secret (design.md §11.12's display-once rule, applied here too; §29.4 HMAC). */
+export const webhookCreateResponseSchema = webhookSchema.extend({
+  secret: z.string().min(1),
+});
+export type WebhookCreateResponse = z.infer<typeof webhookCreateResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// PATCH /webhooks/:webhookId
+// ---------------------------------------------------------------------------
+
+export const webhookUpdateRequestSchema = z.strictObject({
+  url: httpsUrlSchema.optional(),
+  event_types: z.array(webhookEventTypeSchema).min(1).optional(),
+  status: webhookStatusSchema.optional(),
+});
+export type WebhookUpdateRequest = z.infer<typeof webhookUpdateRequestSchema>;
+
+export const webhookUpdateResponseSchema = webhookSchema;
+export type WebhookUpdateResponse = z.infer<typeof webhookUpdateResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// DELETE /webhooks/:webhookId
+// ---------------------------------------------------------------------------
+
+export const webhookDeleteResponseSchema = z.strictObject({
+  id: webhookIdSchema,
+  deleted: z.literal(true),
+});
+export type WebhookDeleteResponse = z.infer<typeof webhookDeleteResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// POST /webhooks/:webhookId/rotate-secret
+// ---------------------------------------------------------------------------
+
+export const webhookRotateSecretRequestSchema = z.strictObject({});
+export type WebhookRotateSecretRequest = z.infer<typeof webhookRotateSecretRequestSchema>;
+
+export const webhookRotateSecretResponseSchema = z.strictObject({
+  id: webhookIdSchema,
+  secret: z.string().min(1),
+  rotated_at: z.iso.datetime(),
+});
+export type WebhookRotateSecretResponse = z.infer<typeof webhookRotateSecretResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// POST /webhooks/:webhookId/test
+// ---------------------------------------------------------------------------
+
+export const webhookTestRequestSchema = z.strictObject({
+  /** Defaults to a synthetic event if omitted; must be one of this webhook's subscribed `event_types`. */
+  event_type: webhookEventTypeSchema.optional(),
+});
+export type WebhookTestRequest = z.infer<typeof webhookTestRequestSchema>;
+
+/** design.md §29.4: "2xxだけ成功". `delivered` reports whether the endpoint returned 2xx. */
+export const webhookTestResponseSchema = z.strictObject({
+  delivered: z.boolean(),
+  response_status: z.number().int().min(100).max(599).nullable(),
+  response_time_ms: z.number().int().nonnegative().nullable(),
+  requested_at: z.iso.datetime(),
+});
+export type WebhookTestResponse = z.infer<typeof webhookTestResponseSchema>;
+
+// ---------------------------------------------------------------------------
+// GET /webhooks/:webhookId/deliveries
+// ---------------------------------------------------------------------------
+
+/**
+ * `webhook_delivery_history` (design.md §29.4, §10.10): one row per delivery
+ * attempt. Deliberately excludes any request/response body, header, or
+ * signature — only status/attempt/response code/duration are ever recorded
+ * or exposed here, matching `@smartcrab/database-control`'s
+ * `WebhookDeliveryHistoryRecord`.
+ */
+export const WEBHOOK_DELIVERY_STATUSES = ["pending", "delivered", "failed", "exhausted"] as const;
+export const webhookDeliveryStatusSchema = z.enum(WEBHOOK_DELIVERY_STATUSES);
+export type WebhookDeliveryStatus = (typeof WEBHOOK_DELIVERY_STATUSES)[number];
+
+export const webhookDeliverySchema = z.strictObject({
+  id: deliveryIdSchema,
+  webhook_id: webhookIdSchema,
+  event_id: eventIdSchema,
+  /**
+   * Not `webhookEventTypeSchema` (that closed enum belongs to a webhook's
+   * *subscription* list on `webhookSchema` above): history rows are retained
+   * 90 days (design.md §10.10) and must stay parseable even if the event
+   * catalog changes after a row was written, so this is a plain non-empty
+   * string.
+   */
+  event_type: z.string().min(1),
+  attempt: z.number().int().positive(),
+  status: webhookDeliveryStatusSchema,
+  response_status_code: z.number().int().min(100).max(599).nullable(),
+  duration_ms: z.number().int().nonnegative(),
+  occurred_at: z.iso.datetime(),
+});
+export type WebhookDelivery = z.infer<typeof webhookDeliverySchema>;
+
+export const webhookDeliveryListQuerySchema = paginationQuerySchema.extend({
+  status: webhookDeliveryStatusSchema.optional(),
+  occurred_after: z.iso.datetime().optional(),
+  occurred_before: z.iso.datetime().optional(),
+});
+export type WebhookDeliveryListQuery = z.infer<typeof webhookDeliveryListQuerySchema>;
+
+export const webhookDeliveryListResponseSchema = cursorPageSchema(webhookDeliverySchema);
+export type WebhookDeliveryListResponse = z.infer<typeof webhookDeliveryListResponseSchema>;