@stratum-hq/lib 1.2.1 → 1.4.0

package/dist/services/event-service.d.ts

@@ -7,6 +7,13 @@ export declare function validateWebhookUrl(url: string): void;
  * against blocked ranges. Call this at delivery time, not just registration.
  */
 export declare function validateWebhookUrlWithDns(url: string): Promise<void>;
+/**
+ * POST a webhook payload and return the HTTP status. The host is resolved once,
+ * every address is validated, and the socket connects only to those addresses
+ * (the client never resolves the name again), so a DNS answer that changes
+ * after validation cannot redirect the request. Redirects are not followed.
+ */
+export declare function postWebhook(url: string, headers: Record<string, string>, body: string): Promise<number>;
 interface WebhookEventRow {
     id: string;
     type: string;
@@ -31,6 +38,11 @@ export declare function deliverWebhook(webhook: WebhookRow, event: WebhookEventR
     responseCode: number | null;
     error: string | null;
 }>;
+/**
+ * Deliver every due pending delivery. At most one run is active per pool in
+ * this process; a trigger that arrives during a run joins it and makes it
+ * check for due deliveries once more before finishing.
+ */
 export declare function processDeliveries(pool: pg.Pool): Promise<void>;
 export declare function retryFailedDeliveries(pool: pg.Pool, tenantId?: string): Promise<number>;
 export declare function retryDelivery(pool: pg.Pool, deliveryId: string): Promise<boolean>;

package/dist/services/event-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-service.d.ts","sourceRoot":"","sources":["../../src/services/event-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAiD/E,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAwBpD;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC1E;AAoBD,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA4ClF;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmFpE;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4B7F;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA0B/F;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,KAAK,SAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CA0BpC"}
+{"version":3,"file":"event-service.d.ts","sourceRoot":"","sources":["../../src/services/event-service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgF/E,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAwBpD;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsC1E;AAgCD;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAyCjB;AAoBD,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA0ClF;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB9D;AAkID,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4B7F;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBvF;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA0B/F;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,KAAK,SAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CA0BpC"}

package/dist/services/event-service.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateWebhookUrl = validateWebhookUrl;
 exports.validateWebhookUrlWithDns = validateWebhookUrlWithDns;
+exports.postWebhook = postWebhook;
 exports.emitEvent = emitEvent;
 exports.deliverWebhook = deliverWebhook;
 exports.processDeliveries = processDeliveries;
@@ -13,15 +14,25 @@ exports.retryDelivery = retryDelivery;
 exports.getDeliveryStats = getDeliveryStats;
 exports.listFailedDeliveries = listFailedDeliveries;
 const promises_1 = __importDefault(require("node:dns/promises"));
+const node_http_1 = __importDefault(require("node:http"));
+const node_https_1 = __importDefault(require("node:https"));
 const node_net_1 = __importDefault(require("node:net"));
 const pool_helpers_js_1 = require("../pool-helpers.js");
 const core_1 = require("@stratum-hq/core");
 const webhook_service_js_1 = require("./webhook-service.js");
 const webhook_signature_js_1 = require("../webhook-signature.js");
 const MAX_ATTEMPTS = 5;
+const DELIVERY_TIMEOUT_MS = 10_000;
+/** Deliveries claimed and sent concurrently per pass. */
+const DELIVERY_BATCH_SIZE = 10;
 /**
- * Reserved, private, loopback, link-local, and cloud-metadata ranges a webhook
- * must never target (SSRF protection). BlockList compares parsed address bytes,
+ * How long a claimed delivery stays invisible to other workers. Longer than a
+ * delivery can take, so a row is only reclaimed if its worker died mid-flight.
+ */
+const DELIVERY_LEASE_MS = 60_000;
+/**
+ * Reserved, private, loopback, link-local, and cloud-metadata ranges, plus the
+ * IANA special-purpose ranges, that a webhook must never target (SSRF protection). BlockList compares parsed address bytes,
  * so it matches every textual notation of an address, and it also checks an
  * IPv4-mapped IPv6 literal against the IPv4 rules.
  */
@@ -29,15 +40,38 @@ const BLOCKED_IP_RANGES = new node_net_1.default.BlockList();
 // IPv4
 BLOCKED_IP_RANGES.addSubnet("0.0.0.0", 8, "ipv4"); // "this" network / unspecified
 BLOCKED_IP_RANGES.addSubnet("10.0.0.0", 8, "ipv4"); // RFC 1918
+BLOCKED_IP_RANGES.addSubnet("100.64.0.0", 10, "ipv4"); // shared address space (CGNAT), incl. some cloud metadata
 BLOCKED_IP_RANGES.addSubnet("127.0.0.0", 8, "ipv4"); // loopback
 BLOCKED_IP_RANGES.addSubnet("169.254.0.0", 16, "ipv4"); // link-local, incl. cloud metadata
 BLOCKED_IP_RANGES.addSubnet("172.16.0.0", 12, "ipv4"); // RFC 1918
+BLOCKED_IP_RANGES.addSubnet("192.0.0.0", 24, "ipv4"); // IETF protocol assignments
+BLOCKED_IP_RANGES.addSubnet("192.0.2.0", 24, "ipv4"); // documentation (TEST-NET-1)
+BLOCKED_IP_RANGES.addSubnet("192.31.196.0", 24, "ipv4"); // AS112-v4
+BLOCKED_IP_RANGES.addSubnet("192.52.193.0", 24, "ipv4"); // AMT
+BLOCKED_IP_RANGES.addSubnet("192.88.99.0", 24, "ipv4"); // deprecated 6to4 relay anycast
 BLOCKED_IP_RANGES.addSubnet("192.168.0.0", 16, "ipv4"); // RFC 1918
+BLOCKED_IP_RANGES.addSubnet("192.175.48.0", 24, "ipv4"); // direct delegation AS112
+BLOCKED_IP_RANGES.addSubnet("198.18.0.0", 15, "ipv4"); // benchmarking
+BLOCKED_IP_RANGES.addSubnet("198.51.100.0", 24, "ipv4"); // documentation (TEST-NET-2)
+BLOCKED_IP_RANGES.addSubnet("203.0.113.0", 24, "ipv4"); // documentation (TEST-NET-3)
+BLOCKED_IP_RANGES.addSubnet("224.0.0.0", 4, "ipv4"); // multicast
+BLOCKED_IP_RANGES.addSubnet("240.0.0.0", 4, "ipv4"); // reserved, incl. limited broadcast
 // IPv6
-BLOCKED_IP_RANGES.addAddress("::", "ipv6"); // unspecified
-BLOCKED_IP_RANGES.addAddress("::1", "ipv6"); // loopback
+BLOCKED_IP_RANGES.addSubnet("::", 96, "ipv6"); // unspecified, loopback, deprecated IPv4-compatible
+BLOCKED_IP_RANGES.addSubnet("64:ff9b::", 96, "ipv6"); // NAT64 well-known prefix (maps to IPv4)
+BLOCKED_IP_RANGES.addSubnet("64:ff9b:1::", 48, "ipv6"); // local-use NAT64 (maps to IPv4)
+BLOCKED_IP_RANGES.addSubnet("100::", 64, "ipv6"); // discard-only
+BLOCKED_IP_RANGES.addSubnet("100:0:0:1::", 64, "ipv6"); // dummy prefix
+BLOCKED_IP_RANGES.addSubnet("2001::", 23, "ipv6"); // IETF protocol assignments, incl. Teredo (maps to IPv4)
+BLOCKED_IP_RANGES.addSubnet("2001:db8::", 32, "ipv6"); // documentation
+BLOCKED_IP_RANGES.addSubnet("2002::", 16, "ipv6"); // 6to4 (maps to IPv4)
+BLOCKED_IP_RANGES.addSubnet("2620:4f:8000::", 48, "ipv6"); // direct delegation AS112
+BLOCKED_IP_RANGES.addSubnet("3fff::", 20, "ipv6"); // documentation
+BLOCKED_IP_RANGES.addSubnet("5f00::", 16, "ipv6"); // SRv6 SIDs
 BLOCKED_IP_RANGES.addSubnet("fc00::", 7, "ipv6"); // unique-local (covers fc00::/8 and fd00::/8)
 BLOCKED_IP_RANGES.addSubnet("fe80::", 10, "ipv6"); // link-local
+BLOCKED_IP_RANGES.addSubnet("fec0::", 10, "ipv6"); // deprecated site-local
+BLOCKED_IP_RANGES.addSubnet("ff00::", 8, "ipv6"); // multicast
 const BLOCKED_HOSTNAMES = new Set([
     "localhost",
     "localhost.localdomain",
@@ -119,6 +153,75 @@ async function validateWebhookUrlWithDns(url) {
         }
     }
 }
+/**
+ * Resolve a webhook host once and validate every address it resolves to.
+ * The caller connects only to the returned addresses.
+ */
+async function resolveWebhookHost(hostname) {
+    const literal = unwrapHostLiteral(hostname);
+    const family = node_net_1.default.isIP(literal);
+    if (family !== 0) {
+        return [{ address: literal, family }]; // IP literal, already checked by validateWebhookUrl
+    }
+    let addresses;
+    try {
+        addresses = await promises_1.default.lookup(hostname, { all: true });
+    }
+    catch {
+        addresses = [];
+    }
+    if (addresses.length === 0) {
+        throw new core_1.WebhookUrlValidationError(`DNS resolution failed for webhook host: ${hostname}`);
+    }
+    for (const { address } of addresses) {
+        if (isBlockedIp(address)) {
+            throw new core_1.WebhookUrlValidationError(`Webhook URL hostname ${hostname} resolves to blocked IP ${address}`);
+        }
+    }
+    return addresses;
+}
+/**
+ * POST a webhook payload and return the HTTP status. The host is resolved once,
+ * every address is validated, and the socket connects only to those addresses
+ * (the client never resolves the name again), so a DNS answer that changes
+ * after validation cannot redirect the request. Redirects are not followed.
+ */
+async function postWebhook(url, headers, body) {
+    validateWebhookUrl(url);
+    const target = new URL(url);
+    const signal = AbortSignal.timeout(DELIVERY_TIMEOUT_MS);
+    const addresses = await Promise.race([
+        resolveWebhookHost(target.hostname.toLowerCase()),
+        new Promise((_, reject) => {
+            signal.addEventListener("abort", () => reject(signal.reason), { once: true });
+        }),
+    ]);
+    const pinnedLookup = (_hostname, options, callback) => {
+        if (options.all) {
+            callback(null, addresses);
+        }
+        else {
+            callback(null, addresses[0].address, addresses[0].family);
+        }
+    };
+    const send = target.protocol === "https:" ? node_https_1.default.request : node_http_1.default.request;
+    return new Promise((resolve, reject) => {
+        const req = send(target, {
+            method: "POST",
+            headers: { ...headers, "Content-Length": String(Buffer.byteLength(body)) },
+            lookup: pinnedLookup,
+            signal,
+        }, (res) => {
+            // Only the status is used; drain the body. A timeout that fires while
+            // the body is still arriving must not surface as an unhandled error.
+            res.on("error", () => { });
+            res.resume();
+            resolve(res.statusCode ?? 0);
+        });
+        req.on("error", reject);
+        req.end(body);
+    });
+}
 function retryDelayMs(attempts) {
     // attempts^2 * 5000ms: 5s, 20s, 45s, 80s, 125s
     return Math.pow(attempts, 2) * 5000;
@@ -156,32 +259,27 @@ async function deliverWebhook(webhook, event, deliveryId) {
         data: event.data,
         created_at: event.created_at,
     });
-    // SSRF protection: validate URL with DNS rebinding check before making request
-    await validateWebhookUrlWithDns(webhook.url);
-    const rawSecret = (0, webhook_service_js_1.decryptSecret)(webhook.secret_hash);
-    const timestamp = new Date().toISOString();
-    const signature = (0, webhook_signature_js_1.signWebhookPayload)(rawSecret, timestamp, payload);
+    // Any failure, including URL validation and secret decryption, is reported
+    // as a failed attempt so it gets backoff and eventually reaches the DLQ.
     try {
-        const response = await globalThis.fetch(webhook.url, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "X-Stratum-Event": event.type,
-                "X-Stratum-Signature": signature,
-                "X-Stratum-Delivery-ID": deliveryId,
-                "X-Stratum-Timestamp": timestamp,
-            },
-            body: payload,
-            redirect: "error",
-            signal: AbortSignal.timeout(10_000),
-        });
-        if (response.ok) {
-            return { success: true, responseCode: response.status, error: null };
+        const rawSecret = (0, webhook_service_js_1.decryptSecret)(webhook.secret_hash);
+        const timestamp = new Date().toISOString();
+        const signature = (0, webhook_signature_js_1.signWebhookPayload)(rawSecret, timestamp, payload);
+        // SSRF protection: resolves, validates and pins the address it connects to.
+        const status = await postWebhook(webhook.url, {
+            "Content-Type": "application/json",
+            "X-Stratum-Event": event.type,
+            "X-Stratum-Signature": signature,
+            "X-Stratum-Delivery-ID": deliveryId,
+            "X-Stratum-Timestamp": timestamp,
+        }, payload);
+        if (status >= 200 && status < 300) {
+            return { success: true, responseCode: status, error: null };
         }
         return {
             success: false,
-            responseCode: response.status,
-            error: `HTTP ${response.status}`,
+            responseCode: status,
+            error: `HTTP ${status}`,
         };
     }
     catch (err) {
@@ -189,61 +287,124 @@ async function deliverWebhook(webhook, event, deliveryId) {
         return { success: false, responseCode: null, error: message };
     }
 }
-async function processDeliveries(pool) {
-    // Find pending deliveries due for delivery
-    const deliveries = await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
-        const res = await client.query(`SELECT * FROM webhook_deliveries
-       WHERE status = 'pending'
-         AND (next_retry_at IS NULL OR next_retry_at <= now())
-       ORDER BY created_at ASC
-       LIMIT 100`);
-        return res.rows;
+/** In-flight delivery run per pool, so concurrent triggers share one worker loop. */
+const activeRuns = new WeakMap();
+const rerunRequested = new WeakSet();
+/**
+ * Deliver every due pending delivery. At most one run is active per pool in
+ * this process; a trigger that arrives during a run joins it and makes it
+ * check for due deliveries once more before finishing.
+ */
+function processDeliveries(pool) {
+    const active = activeRuns.get(pool);
+    if (active) {
+        rerunRequested.add(pool);
+        return active;
+    }
+    const run = (async () => {
+        try {
+            do {
+                rerunRequested.delete(pool);
+                while ((await deliverDueBatch(pool)) > 0) {
+                    // keep going until nothing is due
+                }
+            } while (rerunRequested.has(pool));
+        }
+        finally {
+            activeRuns.delete(pool);
+        }
+    })();
+    activeRuns.set(pool, run);
+    return run;
+}
+/**
+ * Claim, deliver and record one batch. No database connection or transaction
+ * is held while a delivery is on the network: the claim and each result are
+ * separate short transactions. Returns the number of deliveries claimed.
+ */
+async function deliverDueBatch(pool) {
+    const claimed = await claimDueDeliveries(pool);
+    await Promise.all(claimed.map((c) => deliverClaimed(pool, c).catch(() => {
+        // Non-fatal: the lease expires and the delivery is picked up again.
+    })));
+    return claimed.length;
+}
+/**
+ * Lease a batch of due deliveries: count the attempt and move next_retry_at
+ * past the lease so no other worker takes them. Deliveries are taken in turns
+ * across tenants (oldest first within a tenant), so one tenant's backlog does
+ * not crowd out everyone else's.
+ */
+async function claimDueDeliveries(pool) {
+    return (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
+        const res = await client.query(`WITH due AS (
+         SELECT d.id, d.created_at,
+                row_number() OVER (PARTITION BY e.tenant_id ORDER BY d.created_at) AS turn
+         FROM webhook_deliveries d
+         JOIN webhook_events e ON e.id = d.event_id
+         WHERE d.status = 'pending'
+           AND (d.next_retry_at IS NULL OR d.next_retry_at <= now())
+       ), picked AS (
+         SELECT id FROM due ORDER BY turn, created_at LIMIT $2
+       )
+       UPDATE webhook_deliveries d
+       SET attempts = d.attempts + 1,
+           next_retry_at = now() + ($1 || ' milliseconds')::interval
+       WHERE d.id IN (
+         SELECT id FROM webhook_deliveries
+         WHERE id IN (SELECT id FROM picked)
+           AND status = 'pending'
+           AND (next_retry_at IS NULL OR next_retry_at <= now())
+         FOR UPDATE SKIP LOCKED
+       )
+       RETURNING d.*`, [DELIVERY_LEASE_MS, DELIVERY_BATCH_SIZE]);
+        if (res.rows.length === 0) {
+            return [];
+        }
+        const webhookRes = await client.query(`SELECT * FROM webhooks WHERE id = ANY($1)`, [res.rows.map((d) => d.webhook_id)]);
+        const eventRes = await client.query(`SELECT * FROM webhook_events WHERE id = ANY($1)`, [res.rows.map((d) => d.event_id)]);
+        const webhooks = new Map(webhookRes.rows.map((w) => [w.id, w]));
+        const events = new Map(eventRes.rows.map((e) => [e.id, e]));
+        return res.rows.map((delivery) => ({
+            delivery,
+            webhook: webhooks.get(delivery.webhook_id),
+            event: events.get(delivery.event_id),
+        }));
     });
-    for (const delivery of deliveries) {
-        await (0, pool_helpers_js_1.withTransaction)(pool, async (client) => {
-            // Re-fetch delivery with row lock
-            const lockRes = await client.query(`SELECT * FROM webhook_deliveries WHERE id = $1 AND status = 'pending' FOR UPDATE SKIP LOCKED`, [delivery.id]);
-            if (lockRes.rows.length === 0) {
-                return; // Already processed by another worker
-            }
-            const locked = lockRes.rows[0];
-            // Fetch the webhook and event
-            const webhookRes = await client.query(`SELECT * FROM webhooks WHERE id = $1`, [locked.webhook_id]);
-            const eventRes = await client.query(`SELECT * FROM webhook_events WHERE id = $1`, [locked.event_id]);
-            if (webhookRes.rows.length === 0 || eventRes.rows.length === 0) {
-                // Webhook or event was deleted; mark failed
-                await client.query(`UPDATE webhook_deliveries
-           SET status = 'failed', last_error = 'Webhook or event not found', completed_at = now()
-           WHERE id = $1`, [locked.id]);
-                return;
-            }
-            const webhook = webhookRes.rows[0];
-            const event = eventRes.rows[0];
-            const attempts = locked.attempts + 1;
-            const result = await deliverWebhook(webhook, event, locked.id);
-            if (result.success) {
-                await client.query(`UPDATE webhook_deliveries
-           SET status = 'success', attempts = $1, response_code = $2,
-               last_error = NULL, completed_at = now()
-           WHERE id = $3`, [attempts, result.responseCode, locked.id]);
-            }
-            else if (attempts >= MAX_ATTEMPTS) {
-                await client.query(`UPDATE webhook_deliveries
-           SET status = 'failed', attempts = $1, response_code = $2,
-               last_error = $3, completed_at = now()
-           WHERE id = $4`, [attempts, result.responseCode, result.error, locked.id]);
-            }
-            else {
-                const nextRetryMs = retryDelayMs(attempts);
-                await client.query(`UPDATE webhook_deliveries
-           SET attempts = $1, response_code = $2, last_error = $3,
-               next_retry_at = now() + ($4 || ' milliseconds')::interval
-           WHERE id = $5`, [attempts, result.responseCode, result.error, nextRetryMs, locked.id]);
-            }
-        }).catch(() => {
-            // Per-delivery failures are non-fatal; continue processing others
-        });
+}
+async function deliverClaimed(pool, claimed) {
+    const { delivery, webhook, event } = claimed;
+    if (!webhook || !event) {
+        // Webhook or event was deleted; mark failed
+        await (0, pool_helpers_js_1.withClient)(pool, (client) => client.query(`UPDATE webhook_deliveries
+         SET status = 'failed', last_error = 'Webhook or event not found', completed_at = now()
+         WHERE id = $1 AND status = 'pending'`, [delivery.id]));
+        return;
     }
+    // The attempt was already counted when the delivery was claimed.
+    const attempts = delivery.attempts;
+    const result = await deliverWebhook(webhook, event, delivery.id);
+    await (0, pool_helpers_js_1.withClient)(pool, async (client) => {
+        if (result.success) {
+            await client.query(`UPDATE webhook_deliveries
+         SET status = 'success', response_code = $1,
+             last_error = NULL, completed_at = now()
+         WHERE id = $2 AND status = 'pending'`, [result.responseCode, delivery.id]);
+        }
+        else if (attempts >= MAX_ATTEMPTS) {
+            await client.query(`UPDATE webhook_deliveries
+         SET status = 'failed', response_code = $1,
+             last_error = $2, completed_at = now()
+         WHERE id = $3 AND status = 'pending'`, [result.responseCode, result.error, delivery.id]);
+        }
+        else {
+            const nextRetryMs = retryDelayMs(attempts);
+            await client.query(`UPDATE webhook_deliveries
+         SET response_code = $1, last_error = $2,
+             next_retry_at = now() + ($3 || ' milliseconds')::interval
+         WHERE id = $4 AND status = 'pending'`, [result.responseCode, result.error, nextRetryMs, delivery.id]);
+        }
+    });
 }
 async function retryFailedDeliveries(pool, tenantId) {
     const result = await (0, pool_helpers_js_1.withClient)(pool, async (client) => {

package/dist/services/event-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"event-service.js","sourceRoot":"","sources":["../../src/services/event-service.ts"],"names":[],"mappings":";;;;;AAsDA,gDAwBC;AAMD,8DAsCC;AAwCD,8BAuCC;AAED,wCAgDC;AAED,8CAmFC;AAED,sDA4BC;AAED,sCAgBC;AASD,4CA0BC;AAED,oDA8BC;AAncD,iEAAoC;AACpC,wDAA2B;AAE3B,wDAAiE;AACjE,2CAA+E;AAC/E,6DAA0E;AAC1E,kEAA6D;AAE7D,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,kBAAG,CAAC,SAAS,EAAE,CAAC;AAC9C,OAAO;AACP,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,+BAA+B;AAClF,iBAAiB,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AAC/D,iBAAiB,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AAChE,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,mCAAmC;AAC3F,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AAClE,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AACnE,OAAO;AACP,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc;AAC1D,iBAAiB,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AACxD,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,8CAA8C;AAChG,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa;AAEhE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,uBAAuB;IACvB,0BAA0B,EAAE,eAAe;IAC3C,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,qBAAqB;CACzC,CAAC,CAAC;AAEH,uFAAuF;AACvF,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,wFAAwF;AACxF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,kBAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,CAAC,uDAAuD;IACvE,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gCAAyB,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,gCAAyB,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,iCAAiC;IACjC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,gCAAyB,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,0BAA0B;IAC1B,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,gCAAyB,CAAC,oDAAoD,QAAQ,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,yBAAyB,CAAC,GAAW;IACzD,mCAAmC;IACnC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,wEAAwE;IACxE,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACpD,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACvB,CAAC,CAAC;QACH,SAAS,GAAG;YACV,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,IAAI,gCAAyB,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,gCAAyB,CACjC,wBAAwB,QAAQ,2BAA2B,EAAE,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,+CAA+C;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACtC,CAAC;AAmCM,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,IAAiB,EACjB,QAAgB,EAChB,IAA6B;IAE7B,sBAAsB;IACtB,MAAM,QAAQ,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAmB,EAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,oDAAoD;IACpD,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,KAAK,CAChB;uCAC+B,EAC/B,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAC1B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACjC,oEAAoE;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,OAAmB,EACnB,KAAsB,EACtB,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,IAAA,kCAAa,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAA,yCAAkB,EAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,iBAAiB,EAAE,KAAK,CAAC,IAAI;gBAC7B,qBAAqB,EAAE,SAAS;gBAChC,uBAAuB,EAAE,UAAU;gBACnC,qBAAqB,EAAE,SAAS;aACjC;YACD,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,QAAQ,CAAC,MAAM;YAC7B,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;SACjC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAa;IACnD,2CAA2C;IAC3C,MAAM,UAAU,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;iBAIW,CACZ,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3C,kCAAkC;YAClC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,8FAA8F,EAC9F,CAAC,QAAQ,CAAC,EAAE,CAAC,CACd,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,sCAAsC;YAChD,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAE/B,8BAA8B;YAC9B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,sCAAsC,EACtC,CAAC,MAAM,CAAC,UAAU,CAAC,CACpB,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,4CAA4C,EAC5C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAClB,CAAC;YAEF,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/D,4CAA4C;gBAC5C,MAAM,MAAM,CAAC,KAAK,CAChB;;yBAEe,EACf,CAAC,MAAM,CAAC,EAAE,CAAC,CACZ,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;YAErC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAE/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,MAAM,CAAC,KAAK,CAChB;;;yBAGe,EACf,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAC3C,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;gBACpC,MAAM,MAAM,CAAC,KAAK,CAChB;;;yBAGe,EACf,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CACzD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC3C,MAAM,MAAM,CAAC,KAAK,CAChB;;;yBAGe,EACf,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CACtE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACZ,kEAAkE;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CAAC,IAAa,EAAE,QAAiB;IAC1E,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrD,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;;;;8CAKgC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG;;;;;8CAKgC,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAoB,KAAK,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,UAAkB;IACnE,MAAM,OAAO,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;oBAGc,EACd,CAAC,UAAU,CAAC,CACb,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,EAAE,CAAC;QACZ,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AASM,KAAK,UAAU,gBAAgB,CAAC,IAAa,EAAE,QAAiB;IACrE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;yDAE2C,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,0EAA0E,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAoC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,IAAa,EACb,KAAK,GAAG,GAAG,EACX,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;;;;;wBAMU,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG;;;;;;wBAMU,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAA0B,KAAK,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"event-service.js","sourceRoot":"","sources":["../../src/services/event-service.ts"],"names":[],"mappings":";;;;;AAwFA,gDAwBC;AAMD,8DAsCC;AAsCD,kCA6CC;AAwCD,8BAuCC;AAED,wCA8CC;AAWD,8CAoBC;AAkID,sDA4BC;AAED,sCAgBC;AASD,4CA0BC;AAED,oDA8BC;AA/nBD,iEAAoC;AACpC,0DAA6B;AAC7B,4DAA+B;AAC/B,wDAA2B;AAE3B,wDAAiE;AACjE,2CAA+E;AAC/E,6DAA0E;AAC1E,kEAA6D;AAE7D,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B;;;GAGG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,IAAI,kBAAG,CAAC,SAAS,EAAE,CAAC;AAC9C,OAAO;AACP,iBAAiB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,+BAA+B;AAClF,iBAAiB,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AAC/D,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,0DAA0D;AACjH,iBAAiB,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AAChE,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,mCAAmC;AAC3F,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AAClE,iBAAiB,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,4BAA4B;AAClF,iBAAiB,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,6BAA6B;AACnF,iBAAiB,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AACpE,iBAAiB,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM;AAC/D,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,gCAAgC;AACxF,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW;AACnE,iBAAiB,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,0BAA0B;AACnF,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe;AACtE,iBAAiB,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,6BAA6B;AACtF,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,6BAA6B;AACrF,iBAAiB,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY;AACjE,iBAAiB,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,oCAAoC;AACzF,OAAO;AACP,iBAAiB,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,oDAAoD;AACnG,iBAAiB,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,yCAAyC;AAC/F,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,iCAAiC;AACzF,iBAAiB,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe;AACjE,iBAAiB,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe;AACvE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,yDAAyD;AAC5G,iBAAiB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB;AACvE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,sBAAsB;AACzE,iBAAiB,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,0BAA0B;AACrF,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB;AACnE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY;AAC/D,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,8CAA8C;AAChG,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa;AAChE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,wBAAwB;AAC3E,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY;AAE9D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,uBAAuB;IACvB,0BAA0B,EAAE,eAAe;IAC3C,eAAe,EAAE,gBAAgB;IACjC,iBAAiB,EAAE,qBAAqB;CACzC,CAAC,CAAC;AAEH,uFAAuF;AACvF,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED,wFAAwF;AACxF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,kBAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,CAAC,uDAAuD;IACvE,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gCAAyB,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,gCAAyB,CAAC,uCAAuC,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,iCAAiC;IACjC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,gCAAyB,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,0BAA0B;IAC1B,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,gCAAyB,CAAC,oDAAoD,QAAQ,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,yBAAyB,CAAC,GAAW;IACzD,mCAAmC;IACnC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,wEAAwE;IACxE,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACpD,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,kBAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACvB,CAAC,CAAC;QACH,SAAS,GAAG;YACV,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,IAAI,gCAAyB,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,gCAAyB,CACjC,wBAAwB,QAAQ,2BAA2B,EAAE,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,kBAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,oDAAoD;IAC7F,CAAC;IAED,IAAI,SAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,kBAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,gCAAyB,CAAC,2CAA2C,QAAQ,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,gCAAyB,CACjC,wBAAwB,QAAQ,2BAA2B,OAAO,EAAE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,OAA+B,EAC/B,IAAY;IAEZ,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QACnC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/B,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,YAAY,GAAuB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACxE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAI,CAAC,OAAO,CAAC;IAEzE,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,CACd,MAAM,EACN;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE;YAC1E,MAAM,EAAE,YAAY;YACpB,MAAM;SACP,EACD,CAAC,GAAG,EAAE,EAAE;YACN,sEAAsE;YACtE,qEAAqE;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1B,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,+CAA+C;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACtC,CAAC;AAmCM,KAAK,UAAU,SAAS,CAC7B,IAAa,EACb,IAAiB,EACjB,QAAgB,EAChB,IAA6B;IAE7B,sBAAsB;IACtB,MAAM,QAAQ,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;mBAEa,EACb,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAmB,EAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,oDAAoD;IACpD,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,KAAK,CAChB;uCAC+B,EAC/B,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAC1B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACjC,oEAAoE;IACtE,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,OAAmB,EACnB,KAAsB,EACtB,UAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAA,kCAAa,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAA,yCAAkB,EAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAEpE,4EAA4E;QAC5E,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,OAAO,CAAC,GAAG,EACX;YACE,cAAc,EAAE,kBAAkB;YAClC,iBAAiB,EAAE,KAAK,CAAC,IAAI;YAC7B,qBAAqB,EAAE,SAAS;YAChC,uBAAuB,EAAE,UAAU;YACnC,qBAAqB,EAAE,SAAS;SACjC,EACD,OAAO,CACR,CAAC;QAEF,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,MAAM;YACpB,KAAK,EAAE,QAAQ,MAAM,EAAE;SACxB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,GAAG,IAAI,OAAO,EAA0B,CAAC;AACzD,MAAM,cAAc,GAAG,IAAI,OAAO,EAAW,CAAC;AAE9C;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,IAAa;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,EAAE,CAAC;QACX,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE;QACtB,IAAI,CAAC;YACH,GAAG,CAAC;gBACF,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,OAAO,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzC,kCAAkC;gBACpC,CAAC;YACH,CAAC,QAAQ,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACrC,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC;AACb,CAAC;AAQD;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,IAAa;IAC1C,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChB,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACjC,oEAAoE;IACtE,CAAC,CAAC,CACH,CACF,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAa;IAC7C,OAAO,IAAA,iCAAe,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;;;;;;;;;;;;;;;;;;qBAoBe,EACf,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CACzC,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CACnC,2CAA2C,EAC3C,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CACpC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,iDAAiD,EACjD,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAClC,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5D,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjC,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACrC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAa,EAAE,OAAwB;IACnE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAE7C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,4CAA4C;QAC5C,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,KAAK,CACV;;8CAEsC,EACtC,CAAC,QAAQ,CAAC,EAAE,CAAC,CACd,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEjE,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,MAAM,CAAC,KAAK,CAChB;;;8CAGsC,EACtC,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC,CACnC,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,MAAM,CAAC,KAAK,CAChB;;;8CAGsC,EACtC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CACjD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,MAAM,CAAC,KAAK,CAChB;;;8CAGsC,EACtC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,qBAAqB,CAAC,IAAa,EAAE,QAAiB;IAC1E,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrD,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;;;;8CAKgC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG;;;;;8CAKgC,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAoB,KAAK,EAAE,MAAM,CAAC,CAAC;QACjE,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,UAAkB;IACnE,MAAM,OAAO,GAAG,MAAM,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B;;;oBAGc,EACd,CAAC,UAAU,CAAC,CACb,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,EAAE,CAAC;QACZ,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AASM,KAAK,UAAU,gBAAgB,CAAC,IAAa,EAAE,QAAiB;IACrE,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;yDAE2C,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,0EAA0E,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAoC,KAAK,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7C,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,IAAa,EACb,KAAK,GAAG,GAAG,EACX,QAAiB;IAEjB,OAAO,IAAA,4BAAU,EAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACvC,IAAI,KAAa,CAAC;QAClB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG;;;;;;wBAMU,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG;;;;;;wBAMU,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAA0B,KAAK,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/key-rotation-service.d.ts

@@ -1,14 +1,31 @@
 import pg from "pg";
+/** A row that decrypts with neither the old key nor the new key. Rotation leaves it unchanged. */
+export interface KeyRotationUnreadableRow {
+    table: "config_entries" | "webhooks";
+    id: string;
+}
 export interface KeyRotationResult {
     config_entries_rotated: number;
     webhooks_rotated: number;
+    /** Rows that already decrypt with the new key, for example after an interrupted run. */
+    already_rotated: number;
+    /** Rows that decrypt with neither key. */
+    unreadable: KeyRotationUnreadableRow[];
 }
 /**
  * Re-encrypts all sensitive data (config entries and webhook secrets)
  * from oldKey to newKey in batches, walking the primary key with a keyset
- * cursor (id > lastId, ordered by id) so every row is rotated exactly once.
+ * cursor (id > lastId, ordered by id) so every row is visited exactly once.
  * Each batch is its own transaction so locks are held briefly.
  *
+ * The run is safe to repeat with the same keys. A value that already decrypts
+ * with the new key stays as it is and counts in `already_rotated`. A value that
+ * decrypts with neither key stays as it is and appears in `unreadable`.
+ *
+ * Throws a ValidationError when encrypted values exist and none of them
+ * decrypts with either key. That result almost always means `oldKeyMaterial`
+ * is wrong, and the run has changed no row.
+ *
  * After rotation, update the STRATUM_ENCRYPTION_KEY environment variable to
  * the new key.
  */

package/dist/services/key-rotation-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"key-rotation-service.d.ts","sourceRoot":"","sources":["../../src/services/key-rotation-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAIpB,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAKD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,SAAS,GAAE,MAAY,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAwD5B"}
+{"version":3,"file":"key-rotation-service.d.ts","sourceRoot":"","sources":["../../src/services/key-rotation-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAKpB,kGAAkG;AAClG,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,eAAe,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,UAAU,EAAE,wBAAwB,EAAE,CAAC;CACxC;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,SAAS,GAAE,MAAY,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAmF5B"}

package/dist/services/key-rotation-service.js

@@ -2,21 +2,44 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rotateEncryptionKey = rotateEncryptionKey;
 const pool_helpers_js_1 = require("../pool-helpers.js");
+const core_1 = require("@stratum-hq/core");
 const crypto_js_1 = require("../crypto.js");
 // Lowest possible UUID; a keyset cursor starting here precedes every real row.
 const ZERO_UUID = "00000000-0000-0000-0000-000000000000";
+// A run that fails partway leaves earlier batches committed under the new key.
+// Accepting those values, instead of failing on them, is what lets a re-run
+// with the same keys finish the rotation.
+function rotateValue(encrypted, oldKeyMaterial, newKeyMaterial) {
+    const plaintext = (0, crypto_js_1.decryptWithKeyMaterial)(encrypted, oldKeyMaterial);
+    if (plaintext !== null) {
+        return { kind: "rotated", value: (0, crypto_js_1.encryptWithKeyMaterial)(plaintext, newKeyMaterial) };
+    }
+    if ((0, crypto_js_1.decryptWithKeyMaterial)(encrypted, newKeyMaterial) !== null)
+        return { kind: "already_rotated" };
+    return { kind: "unreadable" };
+}
 /**
  * Re-encrypts all sensitive data (config entries and webhook secrets)
  * from oldKey to newKey in batches, walking the primary key with a keyset
- * cursor (id > lastId, ordered by id) so every row is rotated exactly once.
+ * cursor (id > lastId, ordered by id) so every row is visited exactly once.
  * Each batch is its own transaction so locks are held briefly.
  *
+ * The run is safe to repeat with the same keys. A value that already decrypts
+ * with the new key stays as it is and counts in `already_rotated`. A value that
+ * decrypts with neither key stays as it is and appears in `unreadable`.
+ *
+ * Throws a ValidationError when encrypted values exist and none of them
+ * decrypts with either key. That result almost always means `oldKeyMaterial`
+ * is wrong, and the run has changed no row.
+ *
  * After rotation, update the STRATUM_ENCRYPTION_KEY environment variable to
  * the new key.
  */
 async function rotateEncryptionKey(pool, oldKeyMaterial, newKeyMaterial, batchSize = 100) {
     let configCount = 0;
     let webhookCount = 0;
+    let alreadyRotated = 0;
+    const unreadable = [];
     // Process config entries in batches, advancing a keyset cursor by id.
     let lastConfigId = ZERO_UUID;
     while (true) {
@@ -27,14 +50,21 @@ async function rotateEncryptionKey(pool, oldKeyMaterial, newKeyMaterial, batchSi
             if (batch.rows.length === 0)
                 return 0;
             for (const row of batch.rows) {
-                const encryptedBlob = row.value;
-                const reEncrypted = (0, crypto_js_1.reEncrypt)(encryptedBlob, oldKeyMaterial, newKeyMaterial);
-                await client.query(`UPDATE config_entries SET value = $1, updated_at = now() WHERE id = $2`, [JSON.stringify(reEncrypted), row.id]);
+                const outcome = rotateValue(row.value, oldKeyMaterial, newKeyMaterial);
+                if (outcome.kind === "already_rotated") {
+                    alreadyRotated++;
+                }
+                else if (outcome.kind === "unreadable") {
+                    unreadable.push({ table: "config_entries", id: row.id });
+                }
+                else {
+                    await client.query(`UPDATE config_entries SET value = $1, updated_at = now() WHERE id = $2`, [JSON.stringify(outcome.value), row.id]);
+                    configCount++;
+                }
             }
             lastConfigId = batch.rows[batch.rows.length - 1].id;
             return batch.rows.length;
         });
-        configCount += count;
         if (count < batchSize)
             break;
     }
@@ -48,16 +78,34 @@ async function rotateEncryptionKey(pool, oldKeyMaterial, newKeyMaterial, batchSi
             if (batch.rows.length === 0)
                 return 0;
             for (const row of batch.rows) {
-                const reEncrypted = (0, crypto_js_1.reEncrypt)(row.secret_hash, oldKeyMaterial, newKeyMaterial);
-                await client.query(`UPDATE webhooks SET secret_hash = $1 WHERE id = $2`, [reEncrypted, row.id]);
+                const outcome = rotateValue(row.secret_hash, oldKeyMaterial, newKeyMaterial);
+                if (outcome.kind === "already_rotated") {
+                    alreadyRotated++;
+                }
+                else if (outcome.kind === "unreadable") {
+                    unreadable.push({ table: "webhooks", id: row.id });
+                }
+                else {
+                    await client.query(`UPDATE webhooks SET secret_hash = $1 WHERE id = $2`, [outcome.value, row.id]);
+                    webhookCount++;
+                }
             }
             lastWebhookId = batch.rows[batch.rows.length - 1].id;
             return batch.rows.length;
         });
-        webhookCount += count;
         if (count < batchSize)
             break;
     }
-    return { config_entries_rotated: configCount, webhooks_rotated: webhookCount };
+    // A run that changed nothing and matched no value on either key must not look
+    // like a success, because the operator would then retire a key that is still in use.
+    if (unreadable.length > 0 && configCount + webhookCount + alreadyRotated === 0) {
+        throw new core_1.ValidationError("Key rotation found no encrypted value that decrypts with the old key or the new key. Check the old key. No row was changed.", { unreadable: unreadable.length });
+    }
+    return {
+        config_entries_rotated: configCount,
+        webhooks_rotated: webhookCount,
+        already_rotated: alreadyRotated,
+        unreadable,
+    };
 }
 //# sourceMappingURL=key-rotation-service.js.map