@things-factory/webhook 10.1.203 → 10.1.206

package/dist-server/service/inbound/batch-judgement.d.ts

@@ -0,0 +1,69 @@
+import type { WebhookIntakeRefusal, WebhookRejection, WebhookResponse } from '@operato/ops-contract';
+/**
+ * **What a numbered batch lets the receiver take** - and what it answers, in the contract's words.
+ *
+ * ═════════════════════════════════════════════════════════════════════════
+ * The sender (`delivery.ts` `buildBatch`) numbers each envelope on its stream and the receiver keeps one
+ * cursor per stream. The rules are the contract's and are not restated here: `checkSequenceRun` takes the
+ * envelopes up to the first hole, a number already seen is a resend (`behind`), and a hole is answered with
+ * 409 and the number to resend from (ADR-0041, ADR-0078 decision 4).
+ *
+ * So the order of facts on one stream is the sender's order, and the receiver never sorts or compares
+ * times to decide which fact is newer: a later number is a later fact. A resend changes nothing, a gap
+ * holds everything behind it until the hole is filled, and a lost reply is a resend.
+ *
+ * Pure. The store and the door are in `receive-signed-batch.ts`.
+ * ═════════════════════════════════════════════════════════════════════════
+ */
+export interface ReceivedEnvelope {
+    seq: number;
+    scope: string;
+    eventId: string;
+    eventTime?: string;
+    recordTime?: string;
+    record: unknown;
+}
+export type BatchReading = {
+    kind: 'invalid';
+    reason: string;
+} | {
+    kind: 'run';
+    scope: string;
+    /** Envelopes with numbers above the cursor and before any hole - the ones to apply, in order. */
+    take: ReceivedEnvelope[];
+    /** Envelopes at or below the cursor - already applied once; they change nothing. */
+    resent: number;
+    /** Where the cursor stands once `take` is applied. */
+    lastSeq: number;
+    /** A hole: everything from here was not taken. */
+    expectedSeq?: number;
+    /** First envelope of a stream this receiver had never seen: how many numbers below it never arrived. */
+    firstUnseenBefore?: number;
+};
+/** Reads the body a sender posts (`{ batch: [...] }`). A body that is not that shape is refused whole. */
+export declare function readBatch(body: unknown, cursor: number | undefined): BatchReading;
+/** What applying the taken envelopes did - the receiving application says. */
+export interface Applied {
+    applied: number;
+    duplicates: number;
+    rejected: WebhookRejection[];
+}
+/**
+ * The reply, in the contract's shape (`WebhookResponse`): 200 when everything taken went in, 422 when some
+ * were refused for their shape, 409 when a hole stopped the batch - with `lastSeq` up to what did go in, so
+ * the sender marks those and resends from `expectedSeq`.
+ *
+ * `offered = applied + duplicates + rejected` closes on the 200 and the 422; resent envelopes count as
+ * duplicates, since they were applied the first time.
+ */
+export declare function batchReply(reading: Extract<BatchReading, {
+    kind: 'run';
+}>, applied: Applied): {
+    status: number;
+    body: WebhookResponse;
+};
+/** A body that is not a batch: 400 - resending the same bytes will be refused again. */
+export declare function invalidBatchReply(reason: string): {
+    status: number;
+    body: WebhookIntakeRefusal;
+};

package/dist-server/service/inbound/batch-judgement.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBatch = readBatch;
+exports.batchReply = batchReply;
+exports.invalidBatchReply = invalidBatchReply;
+const ops_contract_1 = require("@operato/ops-contract");
+/** Reads the body a sender posts (`{ batch: [...] }`). A body that is not that shape is refused whole. */
+function readBatch(body, cursor) {
+    const batch = body?.batch;
+    if (!Array.isArray(batch) || !batch.length)
+        return { kind: 'invalid', reason: 'the body carries no batch of envelopes' };
+    const envelopes = [];
+    for (const one of batch) {
+        const e = one;
+        if (!Number.isInteger(e?.seq) || e.seq < 1)
+            return { kind: 'invalid', reason: `an envelope carries no usable number: ${JSON.stringify(e?.seq)}` };
+        if (typeof e.scope !== 'string' || !e.scope)
+            return { kind: 'invalid', reason: 'an envelope does not name its numbering unit (scope)' };
+        if (typeof e.eventId !== 'string' || !e.eventId)
+            return { kind: 'invalid', reason: `envelope ${e.seq} carries no event id` };
+        envelopes.push(e);
+    }
+    /* One cursor per stream: a batch mixing streams would advance one cursor with another's numbers. */
+    const scopes = new Set(envelopes.map(e => e.scope));
+    if (scopes.size > 1)
+        return { kind: 'invalid', reason: `one batch names ${scopes.size} numbering units: ${[...scopes].join(', ')}` };
+    const scope = envelopes[0].scope;
+    const fresh = envelopes.filter(e => cursor === undefined || e.seq > cursor);
+    const resent = envelopes.length - fresh.length;
+    if (!fresh.length)
+        return { kind: 'run', scope, take: [], resent, lastSeq: cursor };
+    const first = (0, ops_contract_1.checkSequence)(cursor, fresh[0].seq);
+    const run = (0, ops_contract_1.checkSequenceRun)(cursor, fresh.map(e => e.seq));
+    const take = fresh.slice(0, run.accepted);
+    return {
+        kind: 'run',
+        scope,
+        take,
+        resent,
+        lastSeq: run.lastSeq,
+        ...(run.gap ? { expectedSeq: run.gap.expectedSeq } : {}),
+        ...(first.kind === 'first' && first.unseenBefore > 0 ? { firstUnseenBefore: first.unseenBefore } : {})
+    };
+}
+/**
+ * The reply, in the contract's shape (`WebhookResponse`): 200 when everything taken went in, 422 when some
+ * were refused for their shape, 409 when a hole stopped the batch - with `lastSeq` up to what did go in, so
+ * the sender marks those and resends from `expectedSeq`.
+ *
+ * `offered = applied + duplicates + rejected` closes on the 200 and the 422; resent envelopes count as
+ * duplicates, since they were applied the first time.
+ */
+function batchReply(reading, applied) {
+    const common = {
+        scope: reading.scope,
+        sequenceChecked: true,
+        lastSeq: reading.lastSeq,
+        ...(reading.firstUnseenBefore !== undefined ? { firstUnseenBefore: reading.firstUnseenBefore } : {})
+    };
+    if (reading.expectedSeq !== undefined) {
+        return { status: ops_contract_1.WEBHOOK_STATUS.sequenceGap, body: { ok: false, error: `numbers are missing: resend from ${reading.expectedSeq}`, ...common, expectedSeq: reading.expectedSeq } };
+    }
+    const counted = {
+        offered: reading.take.length + reading.resent,
+        applied: applied.applied,
+        duplicates: applied.duplicates + reading.resent
+    };
+    if (applied.rejected.length) {
+        return { status: ops_contract_1.WEBHOOK_STATUS.partial, body: { ok: false, error: `${applied.rejected.length} record(s) were refused`, ...common, ...counted, rejected: applied.rejected } };
+    }
+    return { status: ops_contract_1.WEBHOOK_STATUS.ok, body: { ok: true, ...common, ...counted } };
+}
+/** A body that is not a batch: 400 - resending the same bytes will be refused again. */
+function invalidBatchReply(reason) {
+    return { status: ops_contract_1.WEBHOOK_STATUS.badPayload, body: { code: ops_contract_1.WEBHOOK_DELIVERY_CODES.envelopeInvalid, error: reason } };
+}
+//# sourceMappingURL=batch-judgement.js.map

package/dist-server/service/inbound/batch-judgement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-judgement.js","sourceRoot":"","sources":["../../../server/service/inbound/batch-judgement.ts"],"names":[],"mappings":";;AA8CA,8BAmCC;AAiBD,gCAuBC;AAGD,8CAEC;AA9HD,wDAA+G;AA6C/G,0GAA0G;AAC1G,SAAgB,SAAS,CAAC,IAAa,EAAE,MAA0B;IACjE,MAAM,KAAK,GAAI,IAA4B,EAAE,KAAK,CAAA;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAA;IAExH,MAAM,SAAS,GAAuB,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAgC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,IAAK,CAAC,CAAC,GAAc,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,yCAAyC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;QAC7J,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAA;QACvI,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,sBAAsB,EAAE,CAAA;QAC5H,SAAS,CAAC,IAAI,CAAC,CAAqB,CAAC,CAAA;IACvC,CAAC;IAED,oGAAoG;IACpG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACnD,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAA;IACpI,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAEhC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAA;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC9C,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAgB,EAAE,CAAA;IAE7F,MAAM,KAAK,GAAG,IAAA,4BAAa,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,IAAA,+BAAgB,EAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IAEzC,OAAO;QACL,IAAI,EAAE,KAAK;QACX,KAAK;QACL,IAAI;QACJ,MAAM;QACN,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvG,CAAA;AACH,CAAC;AASD;;;;;;;GAOG;AACH,SAAgB,UAAU,CAAC,OAA+C,EAAE,OAAgB;IAC1F,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,eAAe,EAAE,IAAI;QACrB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAA;IAED,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,6BAAc,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IACnL,CAAC;IAED,MAAM,OAAO,GAAG;QACd,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM;KAChD,CAAA;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,6BAAc,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,yBAAyB,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAA;IAC/K,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,6BAAc,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,CAAA;AACjF,CAAC;AAED,wFAAwF;AACxF,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,OAAO,EAAE,MAAM,EAAE,6BAAc,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,qCAAsB,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAA;AACrH,CAAC","sourcesContent":["import { WEBHOOK_DELIVERY_CODES, WEBHOOK_STATUS, checkSequence, checkSequenceRun } from '@operato/ops-contract'\nimport type { WebhookIntakeRefusal, WebhookRejection, WebhookResponse } from '@operato/ops-contract'\n\n/**\n * **What a numbered batch lets the receiver take** - and what it answers, in the contract's words.\n *\n * ═════════════════════════════════════════════════════════════════════════\n * The sender (`delivery.ts` `buildBatch`) numbers each envelope on its stream and the receiver keeps one\n * cursor per stream. The rules are the contract's and are not restated here: `checkSequenceRun` takes the\n * envelopes up to the first hole, a number already seen is a resend (`behind`), and a hole is answered with\n * 409 and the number to resend from (ADR-0041, ADR-0078 decision 4).\n *\n * So the order of facts on one stream is the sender's order, and the receiver never sorts or compares\n * times to decide which fact is newer: a later number is a later fact. A resend changes nothing, a gap\n * holds everything behind it until the hole is filled, and a lost reply is a resend.\n *\n * Pure. The store and the door are in `receive-signed-batch.ts`.\n * ═════════════════════════════════════════════════════════════════════════\n */\nexport interface ReceivedEnvelope {\n  seq: number\n  scope: string\n  eventId: string\n  eventTime?: string\n  recordTime?: string\n  record: unknown\n}\n\nexport type BatchReading =\n  | { kind: 'invalid'; reason: string }\n  | {\n      kind: 'run'\n      scope: string\n      /** Envelopes with numbers above the cursor and before any hole - the ones to apply, in order. */\n      take: ReceivedEnvelope[]\n      /** Envelopes at or below the cursor - already applied once; they change nothing. */\n      resent: number\n      /** Where the cursor stands once `take` is applied. */\n      lastSeq: number\n      /** A hole: everything from here was not taken. */\n      expectedSeq?: number\n      /** First envelope of a stream this receiver had never seen: how many numbers below it never arrived. */\n      firstUnseenBefore?: number\n    }\n\n/** Reads the body a sender posts (`{ batch: [...] }`). A body that is not that shape is refused whole. */\nexport function readBatch(body: unknown, cursor: number | undefined): BatchReading {\n  const batch = (body as { batch?: unknown })?.batch\n  if (!Array.isArray(batch) || !batch.length) return { kind: 'invalid', reason: 'the body carries no batch of envelopes' }\n\n  const envelopes: ReceivedEnvelope[] = []\n  for (const one of batch) {\n    const e = one as Partial<ReceivedEnvelope>\n    if (!Number.isInteger(e?.seq) || (e.seq as number) < 1) return { kind: 'invalid', reason: `an envelope carries no usable number: ${JSON.stringify(e?.seq)}` }\n    if (typeof e.scope !== 'string' || !e.scope) return { kind: 'invalid', reason: 'an envelope does not name its numbering unit (scope)' }\n    if (typeof e.eventId !== 'string' || !e.eventId) return { kind: 'invalid', reason: `envelope ${e.seq} carries no event id` }\n    envelopes.push(e as ReceivedEnvelope)\n  }\n\n  /* One cursor per stream: a batch mixing streams would advance one cursor with another's numbers. */\n  const scopes = new Set(envelopes.map(e => e.scope))\n  if (scopes.size > 1) return { kind: 'invalid', reason: `one batch names ${scopes.size} numbering units: ${[...scopes].join(', ')}` }\n  const scope = envelopes[0].scope\n\n  const fresh = envelopes.filter(e => cursor === undefined || e.seq > cursor)\n  const resent = envelopes.length - fresh.length\n  if (!fresh.length) return { kind: 'run', scope, take: [], resent, lastSeq: cursor as number }\n\n  const first = checkSequence(cursor, fresh[0].seq)\n  const run = checkSequenceRun(cursor, fresh.map(e => e.seq))\n  const take = fresh.slice(0, run.accepted)\n\n  return {\n    kind: 'run',\n    scope,\n    take,\n    resent,\n    lastSeq: run.lastSeq,\n    ...(run.gap ? { expectedSeq: run.gap.expectedSeq } : {}),\n    ...(first.kind === 'first' && first.unseenBefore > 0 ? { firstUnseenBefore: first.unseenBefore } : {})\n  }\n}\n\n/** What applying the taken envelopes did - the receiving application says. */\nexport interface Applied {\n  applied: number\n  duplicates: number\n  rejected: WebhookRejection[]\n}\n\n/**\n * The reply, in the contract's shape (`WebhookResponse`): 200 when everything taken went in, 422 when some\n * were refused for their shape, 409 when a hole stopped the batch - with `lastSeq` up to what did go in, so\n * the sender marks those and resends from `expectedSeq`.\n *\n * `offered = applied + duplicates + rejected` closes on the 200 and the 422; resent envelopes count as\n * duplicates, since they were applied the first time.\n */\nexport function batchReply(reading: Extract<BatchReading, { kind: 'run' }>, applied: Applied): { status: number; body: WebhookResponse } {\n  const common = {\n    scope: reading.scope,\n    sequenceChecked: true,\n    lastSeq: reading.lastSeq,\n    ...(reading.firstUnseenBefore !== undefined ? { firstUnseenBefore: reading.firstUnseenBefore } : {})\n  }\n\n  if (reading.expectedSeq !== undefined) {\n    return { status: WEBHOOK_STATUS.sequenceGap, body: { ok: false, error: `numbers are missing: resend from ${reading.expectedSeq}`, ...common, expectedSeq: reading.expectedSeq } }\n  }\n\n  const counted = {\n    offered: reading.take.length + reading.resent,\n    applied: applied.applied,\n    duplicates: applied.duplicates + reading.resent\n  }\n\n  if (applied.rejected.length) {\n    return { status: WEBHOOK_STATUS.partial, body: { ok: false, error: `${applied.rejected.length} record(s) were refused`, ...common, ...counted, rejected: applied.rejected } }\n  }\n\n  return { status: WEBHOOK_STATUS.ok, body: { ok: true, ...common, ...counted } }\n}\n\n/** A body that is not a batch: 400 - resending the same bytes will be refused again. */\nexport function invalidBatchReply(reason: string): { status: number; body: WebhookIntakeRefusal } {\n  return { status: WEBHOOK_STATUS.badPayload, body: { code: WEBHOOK_DELIVERY_CODES.envelopeInvalid, error: reason } }\n}\n"]}

package/dist-server/service/inbound/receive-signed-batch.d.ts

@@ -0,0 +1,25 @@
+import type { EntityManager } from 'typeorm';
+import { type Applied, type ReceivedEnvelope } from './batch-judgement';
+/**
+ * **A door that takes a numbered batch a peer pushes** - signature, site, cursor, apply, reply, in one
+ * transaction per batch.
+ *
+ * The application gives what only it knows: how to find its site, and what one envelope means
+ * (`apply`). The module does the rest the same way for every receiving door (ADR-0078 decision 1). The
+ * cursor moves in the same transaction as what `apply` writes, so a crash leaves both or neither - the
+ * sender then resends and the cursor says which part is new.
+ */
+export interface ReceiveDoors {
+    findSite(siteId: string): Promise<{
+        id: string;
+    } | null | undefined>;
+    /** Run `work` in one transaction. */
+    transaction<T>(work: (tx: EntityManager) => Promise<T>): Promise<T>;
+    /** Applies the taken envelopes, in number order, inside the batch's transaction. */
+    apply(tx: EntityManager, site: {
+        id: string;
+    }, envelopes: ReceivedEnvelope[], peer: string): Promise<Applied>;
+    /** For the refusal sentence: what this door takes. */
+    takes: string;
+}
+export declare function receiveSignedBatch(context: any, peer: string, doors: ReceiveDoors, env?: Record<string, string | undefined>): Promise<void>;

package/dist-server/service/inbound/receive-signed-batch.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.receiveSignedBatch = receiveSignedBatch;
+const ops_contract_1 = require("@operato/ops-contract");
+const webhook_1 = require("@operato/ops-contract/webhook");
+const env_1 = require("@things-factory/env");
+const shell_1 = require("@things-factory/shell");
+const clock_offset_1 = require("../observability/clock-offset");
+const trace_context_1 = require("../observability/trace-context");
+const webhook_receive_cursor_1 = require("../webhook-receive-cursor/webhook-receive-cursor");
+const batch_judgement_1 = require("./batch-judgement");
+const signed_request_1 = require("./signed-request");
+async function receiveSignedBatch(context, peer, doors, env = process.env) {
+    const siteId = String(context.params?.siteId ?? '');
+    const timestamp = context.get(webhook_1.WEBHOOK_HEADER.timestamp);
+    const nowMs = Date.now();
+    /* The two clocks' gap is worth knowing most when the signature fails for time (`clock-offset.ts`). */
+    (0, clock_offset_1.noteClockReading)(siteId, (0, clock_offset_1.offsetFrom)(timestamp, nowMs), nowMs);
+    const verdict = (0, signed_request_1.verifySignedRequest)({
+        env,
+        siteId,
+        peer,
+        timestamp,
+        signature: context.get(webhook_1.WEBHOOK_HEADER.signature),
+        rawBody: context.request.rawBody ?? JSON.stringify(context.request.body ?? {}),
+        nowMs,
+        takes: doors.takes
+    });
+    if (verdict.ok === false) {
+        if (verdict.logNote)
+            env_1.logger.warn(`[webhook-receive] ${siteId}/${peer} ${doors.takes}: ${verdict.logNote}`);
+        context.status = verdict.status;
+        context.body = verdict.body;
+        return;
+    }
+    const trace = (0, trace_context_1.traceFor)(context.get(trace_context_1.TRACEPARENT));
+    context.set(trace_context_1.TRACEPARENT, (0, trace_context_1.toTraceparent)(trace));
+    const site = await doors.findSite(siteId);
+    if (!site) {
+        context.status = 404;
+        context.body = {
+            code: ops_contract_1.WEBHOOK_DELIVERY_CODES.siteUnknown,
+            error: `no site named ${siteId} - the path segment is this app's domain subdomain, not the sender's site name`
+        };
+        return;
+    }
+    try {
+        const reply = await doors.transaction(async (tx) => {
+            const scope = context.request.body?.batch?.[0]?.scope;
+            const cursor = typeof scope === 'string' && scope ? await lockedCursor(tx, site.id, peer, scope) : null;
+            const reading = (0, batch_judgement_1.readBatch)(context.request.body, cursor ? Number(cursor.lastSeq) : undefined);
+            if (reading.kind === 'invalid')
+                return (0, batch_judgement_1.invalidBatchReply)(reading.reason);
+            const applied = reading.take.length ? await doors.apply(tx, site, reading.take, peer) : { applied: 0, duplicates: 0, rejected: [] };
+            if (reading.take.length) {
+                const repository = tx.getRepository(webhook_receive_cursor_1.WebhookReceiveCursor);
+                await repository.save({
+                    ...(cursor ?? { domain: { id: site.id }, peer, scope: reading.scope }),
+                    lastSeq: reading.lastSeq,
+                    ...(!cursor && reading.firstUnseenBefore !== undefined ? { firstUnseenBefore: reading.firstUnseenBefore } : {})
+                });
+            }
+            return (0, batch_judgement_1.batchReply)(reading, applied);
+        });
+        context.status = reply.status;
+        context.body = reply.body;
+    }
+    catch (error) {
+        env_1.logger.warn(`[webhook-receive] ${siteId}/${peer} ${doors.takes} ${(0, trace_context_1.traceTag)(trace)} failed - ${String(error).slice(0, 200)}`);
+        context.status = 500;
+        context.body = { code: ops_contract_1.WEBHOOK_DELIVERY_CODES.peerInternalFailure, error: `could not store this batch`, detail: String(error).slice(0, 200) };
+    }
+}
+async function lockedCursor(tx, domainId, peer, scope) {
+    return await tx.getRepository(webhook_receive_cursor_1.WebhookReceiveCursor).findOne({
+        where: { domain: { id: domainId }, peer, scope },
+        ...((0, shell_1.writeLockSupported)(tx) ? { lock: { mode: 'pessimistic_write' } } : {})
+    });
+}
+//# sourceMappingURL=receive-signed-batch.js.map

package/dist-server/service/inbound/receive-signed-batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive-signed-batch.js","sourceRoot":"","sources":["../../../server/service/inbound/receive-signed-batch.ts"],"names":[],"mappings":";;AAgCA,gDAkEC;AAhGD,wDAA8D;AAC9D,2DAA8D;AAC9D,6CAA4C;AAC5C,iDAA0D;AAE1D,gEAA4E;AAC5E,kEAA+F;AAC/F,6FAAuF;AACvF,uDAAiH;AACjH,qDAAsD;AAqB/C,KAAK,UAAU,kBAAkB,CAAC,OAAY,EAAE,IAAY,EAAE,KAAmB,EAAE,MAA0C,OAAO,CAAC,GAAG;IAC7I,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAc,CAAC,SAAS,CAAC,CAAA;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAExB,sGAAsG;IACtG,IAAA,+BAAgB,EAAC,MAAM,EAAE,IAAA,yBAAU,EAAC,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IAE7D,MAAM,OAAO,GAAG,IAAA,oCAAmB,EAAC;QAClC,GAAG;QACH,MAAM;QACN,IAAI;QACJ,SAAS;QACT,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAc,CAAC,SAAS,CAAC;QAChD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9E,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,OAAO;YAAE,YAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1G,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC/B,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QAC3B,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,wBAAQ,EAAC,OAAO,CAAC,GAAG,CAAC,2BAAW,CAAC,CAAC,CAAA;IAChD,OAAO,CAAC,GAAG,CAAC,2BAAW,EAAE,IAAA,6BAAa,EAAC,KAAK,CAAC,CAAC,CAAA;IAE9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG;YACb,IAAI,EAAE,qCAAsB,CAAC,WAAW;YACxC,KAAK,EAAE,iBAAiB,MAAM,gFAAgF;SAC/G,CAAA;QACD,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;YAC/C,MAAM,KAAK,GAAI,OAAO,CAAC,OAAO,CAAC,IAA0C,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAA;YAC5F,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACvG,MAAM,OAAO,GAAG,IAAA,2BAAS,EAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAC5F,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAA,mCAAiB,EAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YAExE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;YAEnI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,6CAAoB,CAAC,CAAA;gBACzD,MAAM,UAAU,CAAC,IAAI,CAAC;oBACpB,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;oBAC7E,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,GAAG,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChH,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,IAAA,4BAAU,EAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrC,CAAC,CAAC,CAAA;QAEF,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAC7B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,IAAA,wBAAQ,EAAC,KAAK,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5H,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,qCAAsB,CAAC,mBAAmB,EAAE,KAAK,EAAE,4BAA4B,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;IAC/I,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAiB,EAAE,QAAgB,EAAE,IAAY,EAAE,KAAa;IAC1F,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,6CAAoB,CAAC,CAAC,OAAO,CAAC;QAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QAChD,GAAG,CAAC,IAAA,0BAAkB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,mBAA4B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type { EntityManager } from 'typeorm'\n\nimport { WEBHOOK_DELIVERY_CODES } from '@operato/ops-contract'\nimport { WEBHOOK_HEADER } from '@operato/ops-contract/webhook'\nimport { logger } from '@things-factory/env'\nimport { writeLockSupported } from '@things-factory/shell'\n\nimport { noteClockReading, offsetFrom } from '../observability/clock-offset'\nimport { TRACEPARENT, toTraceparent, traceFor, traceTag } from '../observability/trace-context'\nimport { WebhookReceiveCursor } from '../webhook-receive-cursor/webhook-receive-cursor'\nimport { type Applied, type ReceivedEnvelope, batchReply, invalidBatchReply, readBatch } from './batch-judgement'\nimport { verifySignedRequest } from './signed-request'\n\n/**\n * **A door that takes a numbered batch a peer pushes** - signature, site, cursor, apply, reply, in one\n * transaction per batch.\n *\n * The application gives what only it knows: how to find its site, and what one envelope means\n * (`apply`). The module does the rest the same way for every receiving door (ADR-0078 decision 1). The\n * cursor moves in the same transaction as what `apply` writes, so a crash leaves both or neither - the\n * sender then resends and the cursor says which part is new.\n */\nexport interface ReceiveDoors {\n  findSite(siteId: string): Promise<{ id: string } | null | undefined>\n  /** Run `work` in one transaction. */\n  transaction<T>(work: (tx: EntityManager) => Promise<T>): Promise<T>\n  /** Applies the taken envelopes, in number order, inside the batch's transaction. */\n  apply(tx: EntityManager, site: { id: string }, envelopes: ReceivedEnvelope[], peer: string): Promise<Applied>\n  /** For the refusal sentence: what this door takes. */\n  takes: string\n}\n\nexport async function receiveSignedBatch(context: any, peer: string, doors: ReceiveDoors, env: Record<string, string | undefined> = process.env): Promise<void> {\n  const siteId = String(context.params?.siteId ?? '')\n  const timestamp = context.get(WEBHOOK_HEADER.timestamp)\n  const nowMs = Date.now()\n\n  /* The two clocks' gap is worth knowing most when the signature fails for time (`clock-offset.ts`). */\n  noteClockReading(siteId, offsetFrom(timestamp, nowMs), nowMs)\n\n  const verdict = verifySignedRequest({\n    env,\n    siteId,\n    peer,\n    timestamp,\n    signature: context.get(WEBHOOK_HEADER.signature),\n    rawBody: context.request.rawBody ?? JSON.stringify(context.request.body ?? {}),\n    nowMs,\n    takes: doors.takes\n  })\n  if (verdict.ok === false) {\n    if (verdict.logNote) logger.warn(`[webhook-receive] ${siteId}/${peer} ${doors.takes}: ${verdict.logNote}`)\n    context.status = verdict.status\n    context.body = verdict.body\n    return\n  }\n\n  const trace = traceFor(context.get(TRACEPARENT))\n  context.set(TRACEPARENT, toTraceparent(trace))\n\n  const site = await doors.findSite(siteId)\n  if (!site) {\n    context.status = 404\n    context.body = {\n      code: WEBHOOK_DELIVERY_CODES.siteUnknown,\n      error: `no site named ${siteId} - the path segment is this app's domain subdomain, not the sender's site name`\n    }\n    return\n  }\n\n  try {\n    const reply = await doors.transaction(async tx => {\n      const scope = (context.request.body as { batch?: { scope?: unknown }[] })?.batch?.[0]?.scope\n      const cursor = typeof scope === 'string' && scope ? await lockedCursor(tx, site.id, peer, scope) : null\n      const reading = readBatch(context.request.body, cursor ? Number(cursor.lastSeq) : undefined)\n      if (reading.kind === 'invalid') return invalidBatchReply(reading.reason)\n\n      const applied = reading.take.length ? await doors.apply(tx, site, reading.take, peer) : { applied: 0, duplicates: 0, rejected: [] }\n\n      if (reading.take.length) {\n        const repository = tx.getRepository(WebhookReceiveCursor)\n        await repository.save({\n          ...(cursor ?? { domain: { id: site.id } as any, peer, scope: reading.scope }),\n          lastSeq: reading.lastSeq,\n          ...(!cursor && reading.firstUnseenBefore !== undefined ? { firstUnseenBefore: reading.firstUnseenBefore } : {})\n        })\n      }\n\n      return batchReply(reading, applied)\n    })\n\n    context.status = reply.status\n    context.body = reply.body\n  } catch (error) {\n    logger.warn(`[webhook-receive] ${siteId}/${peer} ${doors.takes} ${traceTag(trace)} failed - ${String(error).slice(0, 200)}`)\n    context.status = 500\n    context.body = { code: WEBHOOK_DELIVERY_CODES.peerInternalFailure, error: `could not store this batch`, detail: String(error).slice(0, 200) }\n  }\n}\n\nasync function lockedCursor(tx: EntityManager, domainId: string, peer: string, scope: string): Promise<WebhookReceiveCursor | null> {\n  return await tx.getRepository(WebhookReceiveCursor).findOne({\n    where: { domain: { id: domainId }, peer, scope },\n    ...(writeLockSupported(tx) ? { lock: { mode: 'pessimistic_write' as const } } : {})\n  })\n}\n"]}

package/dist-server/service/inbound/signed-request.d.ts

@@ -0,0 +1,59 @@
+import type { WebhookIntakeRefusal } from '@operato/ops-contract';
+/**
+ * **Whether a pushed request may be read at all** - the key, the headers and the signature, judged before
+ * anything is looked up or stored.
+ *
+ * ═════════════════════════════════════════════════════════════════════════
+ * ## One judgement for every door that receives
+ *
+ * operato-plant's job-order door was the only receiving door and held this judgement in its own files
+ * (`peer-secret.ts`, `intake-receive.ts`). A second door - the warehouse taking lot status from the plant
+ * (ADR-0080 decision 3) - needs exactly the same answer, so the judgement moves here and both read it
+ * (ADR-0078 decision 1: the machine is one, the doors are the applications').
+ *
+ * ## 503, 401 and 404 are three different people's problems
+ *
+ * ```
+ * 503   we hold no key for that peer           we fix it
+ * 401   the signature or the time is wrong     the sender fixes it
+ * 401   the signing headers are missing        the sender's code fixes it (envelope-invalid, not signature-rejected)
+ * ```
+ * The site lookup (404) comes after this, because it touches the store.
+ *
+ * ## The key is chosen by the name **we** call the peer
+ *
+ * `WEBHOOK_VERIFY_SECRET__<our site>__<peer>` and nothing wider: a wider key would let a peer that signs
+ * correctly land its envelope on another peer's address, and the address is what says whose it is. The
+ * contract no longer offers a wider rung (ADR-0046 1). A name that the derivation cannot form is "no key",
+ * not an exception - a name's shape is never a 500.
+ *
+ * ## The variable's name goes to the log, never to the reply
+ *
+ * A reply naming the variable tells a request that proved nothing how keys are chosen and which sites
+ * exist. `logNote` carries it for the operator; the reply carries only the code and the peer.
+ * ═════════════════════════════════════════════════════════════════════════
+ */
+export interface SignedRequest {
+    env: Record<string, string | undefined>;
+    /** Our site, as the address names it (the domain's subdomain). */
+    siteId: string;
+    /** What we call the sender - the address segment, chosen by us. */
+    peer: string;
+    timestamp?: string;
+    signature?: string;
+    /** The exact bytes that were signed. */
+    rawBody: string;
+    nowMs: number;
+    /** What the refusal says the door does not take yet, for a person reading it. */
+    takes?: string;
+}
+export type SignedRequestVerdict = {
+    ok: true;
+    keyName: string;
+} | {
+    ok: false;
+    status: 401 | 503;
+    body: WebhookIntakeRefusal;
+    logNote?: string;
+};
+export declare function verifySignedRequest(request: SignedRequest): SignedRequestVerdict;

package/dist-server/service/inbound/signed-request.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignedRequest = verifySignedRequest;
+const ops_contract_1 = require("@operato/ops-contract");
+const webhook_1 = require("@operato/ops-contract/webhook");
+function verifySignedRequest(request) {
+    const { siteId, peer } = request;
+    if (!(0, ops_contract_1.isWebhookSecretSegment)(siteId) || !(0, ops_contract_1.isWebhookSecretSegment)(peer)) {
+        return refusedForKey(peer, request.takes, `the name is not of the derivable shape - lower-case letters, digits and single inner hyphens (site=${siteId} peer=${peer})`);
+    }
+    const lookup = { purpose: 'verify', domain: siteId, peer };
+    const found = (0, ops_contract_1.webhookSecretFrom)(request.env, lookup);
+    if (!found.secret)
+        return refusedForKey(peer, request.takes, (0, ops_contract_1.webhookSecretMissingNote)((0, ops_contract_1.webhookSecretCandidates)(lookup)));
+    if (!request.timestamp || !request.signature) {
+        return {
+            ok: false,
+            status: 401,
+            body: { code: ops_contract_1.WEBHOOK_DELIVERY_CODES.envelopeInvalid, error: `${webhook_1.WEBHOOK_HEADER.timestamp} and ${webhook_1.WEBHOOK_HEADER.signature} are required` }
+        };
+    }
+    const verdict = (0, webhook_1.verifyWebhookSignature)({
+        secret: found.secret,
+        timestamp: request.timestamp,
+        signature: request.signature,
+        body: request.rawBody,
+        nowMs: request.nowMs
+    });
+    if (!verdict.ok) {
+        const reason = verdict.reason;
+        return {
+            ok: false,
+            status: 401,
+            body: { code: ops_contract_1.WEBHOOK_DELIVERY_CODES.signatureRejected, params: { reason }, error: `webhook rejected: ${reason}` }
+        };
+    }
+    return { ok: true, keyName: found.opened?.name ?? '' };
+}
+function refusedForKey(peer, takes, logNote) {
+    return {
+        ok: false,
+        status: 503,
+        /* The peer is our name for the sender. The variable name is never here - it goes to the log. */
+        body: { code: ops_contract_1.WEBHOOK_DELIVERY_CODES.verifySecretMissing, params: { peer }, error: `this site does not accept ${takes ?? 'pushes'} yet` },
+        logNote
+    };
+}
+//# sourceMappingURL=signed-request.js.map

package/dist-server/service/inbound/signed-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-request.js","sourceRoot":"","sources":["../../../server/service/inbound/signed-request.ts"],"names":[],"mappings":";;AAyDA,kDAwCC;AAjGD,wDAA4J;AAE5J,2DAAsF;AAuDtF,SAAgB,mBAAmB,CAAC,OAAsB;IACxD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAEhC,IAAI,CAAC,IAAA,qCAAsB,EAAC,MAAM,CAAC,IAAI,CAAC,IAAA,qCAAsB,EAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,aAAa,CAClB,IAAI,EACJ,OAAO,CAAC,KAAK,EACb,sGAAsG,MAAM,SAAS,IAAI,GAAG,CAC7H,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,QAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACnE,MAAM,KAAK,GAAG,IAAA,gCAAiB,EAAC,OAAO,CAAC,GAAwB,EAAE,MAAM,CAAC,CAAA;IACzE,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,IAAA,uCAAwB,EAAC,IAAA,sCAAuB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAEvH,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,IAAI,EAAE,qCAAsB,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,wBAAc,CAAC,SAAS,QAAQ,wBAAc,CAAC,SAAS,eAAe,EAAE;SAC1I,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,gCAAsB,EAAC;QACrC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,MAAM,GAAI,OAA8B,CAAC,MAAM,CAAA;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,IAAI,EAAE,qCAAsB,CAAC,iBAAiB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,qBAAqB,MAAM,EAAE,EAAE;SACnH,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAG,KAAuC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAA;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,KAAyB,EAAE,OAAe;IAC7E,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,gGAAgG;QAChG,IAAI,EAAE,EAAE,IAAI,EAAE,qCAAsB,CAAC,mBAAmB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,6BAA6B,KAAK,IAAI,QAAQ,MAAM,EAAE;QACzI,OAAO;KACR,CAAA;AACH,CAAC","sourcesContent":["import { WEBHOOK_DELIVERY_CODES, isWebhookSecretSegment, webhookSecretCandidates, webhookSecretFrom, webhookSecretMissingNote } from '@operato/ops-contract'\nimport type { WebhookIntakeRefusal } from '@operato/ops-contract'\nimport { WEBHOOK_HEADER, verifyWebhookSignature } from '@operato/ops-contract/webhook'\n\n/**\n * **Whether a pushed request may be read at all** - the key, the headers and the signature, judged before\n * anything is looked up or stored.\n *\n * ═════════════════════════════════════════════════════════════════════════\n * ## One judgement for every door that receives\n *\n * operato-plant's job-order door was the only receiving door and held this judgement in its own files\n * (`peer-secret.ts`, `intake-receive.ts`). A second door - the warehouse taking lot status from the plant\n * (ADR-0080 decision 3) - needs exactly the same answer, so the judgement moves here and both read it\n * (ADR-0078 decision 1: the machine is one, the doors are the applications').\n *\n * ## 503, 401 and 404 are three different people's problems\n *\n * ```\n * 503   we hold no key for that peer           we fix it\n * 401   the signature or the time is wrong     the sender fixes it\n * 401   the signing headers are missing        the sender's code fixes it (envelope-invalid, not signature-rejected)\n * ```\n * The site lookup (404) comes after this, because it touches the store.\n *\n * ## The key is chosen by the name **we** call the peer\n *\n * `WEBHOOK_VERIFY_SECRET__<our site>__<peer>` and nothing wider: a wider key would let a peer that signs\n * correctly land its envelope on another peer's address, and the address is what says whose it is. The\n * contract no longer offers a wider rung (ADR-0046 1). A name that the derivation cannot form is \"no key\",\n * not an exception - a name's shape is never a 500.\n *\n * ## The variable's name goes to the log, never to the reply\n *\n * A reply naming the variable tells a request that proved nothing how keys are chosen and which sites\n * exist. `logNote` carries it for the operator; the reply carries only the code and the peer.\n * ═════════════════════════════════════════════════════════════════════════\n */\nexport interface SignedRequest {\n  env: Record<string, string | undefined>\n  /** Our site, as the address names it (the domain's subdomain). */\n  siteId: string\n  /** What we call the sender - the address segment, chosen by us. */\n  peer: string\n  timestamp?: string\n  signature?: string\n  /** The exact bytes that were signed. */\n  rawBody: string\n  nowMs: number\n  /** What the refusal says the door does not take yet, for a person reading it. */\n  takes?: string\n}\n\nexport type SignedRequestVerdict =\n  | { ok: true; keyName: string }\n  | { ok: false; status: 401 | 503; body: WebhookIntakeRefusal; logNote?: string }\n\nexport function verifySignedRequest(request: SignedRequest): SignedRequestVerdict {\n  const { siteId, peer } = request\n\n  if (!isWebhookSecretSegment(siteId) || !isWebhookSecretSegment(peer)) {\n    return refusedForKey(\n      peer,\n      request.takes,\n      `the name is not of the derivable shape - lower-case letters, digits and single inner hyphens (site=${siteId} peer=${peer})`\n    )\n  }\n\n  const lookup = { purpose: 'verify' as const, domain: siteId, peer }\n  const found = webhookSecretFrom(request.env as NodeJS.ProcessEnv, lookup)\n  if (!found.secret) return refusedForKey(peer, request.takes, webhookSecretMissingNote(webhookSecretCandidates(lookup)))\n\n  if (!request.timestamp || !request.signature) {\n    return {\n      ok: false,\n      status: 401,\n      body: { code: WEBHOOK_DELIVERY_CODES.envelopeInvalid, error: `${WEBHOOK_HEADER.timestamp} and ${WEBHOOK_HEADER.signature} are required` }\n    }\n  }\n\n  const verdict = verifyWebhookSignature({\n    secret: found.secret,\n    timestamp: request.timestamp,\n    signature: request.signature,\n    body: request.rawBody,\n    nowMs: request.nowMs\n  })\n  if (!verdict.ok) {\n    const reason = (verdict as { reason: string }).reason\n    return {\n      ok: false,\n      status: 401,\n      body: { code: WEBHOOK_DELIVERY_CODES.signatureRejected, params: { reason }, error: `webhook rejected: ${reason}` }\n    }\n  }\n\n  return { ok: true, keyName: (found as { opened?: { name: string } }).opened?.name ?? '' }\n}\n\nfunction refusedForKey(peer: string, takes: string | undefined, logNote: string): SignedRequestVerdict {\n  return {\n    ok: false,\n    status: 503,\n    /* The peer is our name for the sender. The variable name is never here - it goes to the log. */\n    body: { code: WEBHOOK_DELIVERY_CODES.verifySecretMissing, params: { peer }, error: `this site does not accept ${takes ?? 'pushes'} yet` },\n    logNote\n  }\n}\n"]}

package/dist-server/service/index.d.ts

@@ -3,12 +3,14 @@ import { WebhookDestinationResolver } from './webhook-destination/webhook-destin
 import { WebhookOutboxEvent } from './webhook-outbox-event/webhook-outbox-event';
 import { WebhookOutboxResolver } from './webhook-outbox-event/webhook-outbox-resolver';
 import { WebhookSequence } from './webhook-sequence/webhook-sequence';
+import { WebhookReceiveCursor } from './webhook-receive-cursor/webhook-receive-cursor';
 export * from './webhook-destination/webhook-destination';
 export * from './webhook-destination/webhook-destination-resolver';
 export * from './webhook-outbox-event/webhook-outbox-event';
 export * from './webhook-outbox-event/webhook-outbox-resolver';
 export * from './webhook-sequence/webhook-sequence';
-export declare const entities: (typeof WebhookDestination | typeof WebhookOutboxEvent | typeof WebhookSequence)[];
+export * from './webhook-receive-cursor/webhook-receive-cursor';
+export declare const entities: (typeof WebhookDestination | typeof WebhookOutboxEvent | typeof WebhookSequence | typeof WebhookReceiveCursor)[];
 export declare const schema: {
     resolverClasses: (typeof WebhookDestinationResolver | typeof WebhookOutboxResolver)[];
 };
@@ -32,3 +34,6 @@ export * from './outbox/webhook-append-store';
 export * from './outbox/pump-round';
 export * from './outbox/pump';
 export * from './outbox/pump-loop';
+export * from './inbound/signed-request';
+export * from './inbound/batch-judgement';
+export * from './inbound/receive-signed-batch';

package/dist-server/service/index.js

@@ -16,18 +16,20 @@ const webhook_destination_resolver_1 = require("./webhook-destination/webhook-de
 const webhook_outbox_event_1 = require("./webhook-outbox-event/webhook-outbox-event");
 const webhook_outbox_resolver_1 = require("./webhook-outbox-event/webhook-outbox-resolver");
 const webhook_sequence_1 = require("./webhook-sequence/webhook-sequence");
+const webhook_receive_cursor_1 = require("./webhook-receive-cursor/webhook-receive-cursor");
 tslib_1.__exportStar(require("./webhook-destination/webhook-destination"), exports);
 tslib_1.__exportStar(require("./webhook-destination/webhook-destination-resolver"), exports);
 tslib_1.__exportStar(require("./webhook-outbox-event/webhook-outbox-event"), exports);
 tslib_1.__exportStar(require("./webhook-outbox-event/webhook-outbox-resolver"), exports);
 tslib_1.__exportStar(require("./webhook-sequence/webhook-sequence"), exports);
+tslib_1.__exportStar(require("./webhook-receive-cursor/webhook-receive-cursor"), exports);
 /*
  * ⚠ **The shell builds the database and the schema from these two names.** Without them the module's
  * tables are never created in any application and the destination door is in no schema - the files stand
  * and nothing reaches them. That was the state through 10.1.37 (found 2026-09-24 by the first application to
  * append: its database had no webhook table at all). `test/append-store-db.test.ts` holds this line.
  */
-exports.entities = [webhook_destination_1.WebhookDestination, webhook_outbox_event_1.WebhookOutboxEvent, webhook_sequence_1.WebhookSequence];
+exports.entities = [webhook_destination_1.WebhookDestination, webhook_outbox_event_1.WebhookOutboxEvent, webhook_sequence_1.WebhookSequence, webhook_receive_cursor_1.WebhookReceiveCursor];
 exports.schema = { resolverClasses: [webhook_destination_resolver_1.WebhookDestinationResolver, webhook_outbox_resolver_1.WebhookOutboxResolver] };
 /*
  * The outbox machine, moved from operato-plant (ADR-0078 decision 2). Step ①: the pure judgement —
@@ -66,4 +68,11 @@ tslib_1.__exportStar(require("./outbox/webhook-append-store"), exports);
 tslib_1.__exportStar(require("./outbox/pump-round"), exports);
 tslib_1.__exportStar(require("./outbox/pump"), exports);
 tslib_1.__exportStar(require("./outbox/pump-loop"), exports);
+/*
+ * The receiving side (ADR-0080 decision 3 is its first door): whether a pushed request may be read, what a
+ * numbered batch lets the receiver take, and the door that does both and keeps the cursor.
+ */
+tslib_1.__exportStar(require("./inbound/signed-request"), exports);
+tslib_1.__exportStar(require("./inbound/batch-judgement"), exports);
+tslib_1.__exportStar(require("./inbound/receive-signed-batch"), exports);
 //# sourceMappingURL=index.js.map

package/dist-server/service/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/service/index.ts"],"names":[],"mappings":";;;;AAAA;;;;;;;;GAQG;AACH,mFAA8E;AAC9E,qGAA+F;AAC/F,sFAAgF;AAChF,4FAAsF;AACtF,0EAAqE;AAErE,oFAAyD;AACzD,6FAAkE;AAClE,sFAA2D;AAC3D,yFAA8D;AAC9D,8EAAmD;AAEnD;;;;;GAKG;AACU,QAAA,QAAQ,GAAG,CAAC,wCAAkB,EAAE,yCAAkB,EAAE,kCAAe,CAAC,CAAA;AAEpE,QAAA,MAAM,GAAG,EAAE,eAAe,EAAE,CAAC,yDAA0B,EAAE,+CAAqB,CAAC,EAAE,CAAA;AAE9F;;;;GAIG;AACH,4DAAiC;AACjC,8DAAmC;AACnC,8DAAmC;AACnC,8DAAmC;AACnC,kEAAuC;AACvC,gEAAqC;AACrC,4DAAiC;AACjC,gEAAqC;AACrC,wDAA6B;AAC7B,uEAA4C;AAE5C;;;GAGG;AACH,0DAA+B;AAE/B;+EAC+E;AAC/E,uEAA4C;AAC5C,wEAA6C;AAE7C,6GAA6G;AAC7G,yDAA8B;AAC9B,8DAAmC;AACnC,iEAAsC;AACtC,wEAA6C;AAE7C;;;;GAIG;AACH,8DAAmC;AACnC,wDAA6B;AAC7B,6DAAkC","sourcesContent":["/*\n * Each source file is named rather than re-exporting folder barrels.\n *\n * A name added to a folder barrel but not listed here stops at the package boundary, and the\n * consumer's error is `TS2305: has no exported member` — which reads like the name does not\n * exist rather than like it is unreachable. That happened on 2026-09-07 with\n * `work-shift/days-of-week`: the parser was in the folder barrel, not here, and the consuming\n * lane wrote its own until the miss was found.\n */\nimport { WebhookDestination } from './webhook-destination/webhook-destination'\nimport { WebhookDestinationResolver } from './webhook-destination/webhook-destination-resolver'\nimport { WebhookOutboxEvent } from './webhook-outbox-event/webhook-outbox-event'\nimport { WebhookOutboxResolver } from './webhook-outbox-event/webhook-outbox-resolver'\nimport { WebhookSequence } from './webhook-sequence/webhook-sequence'\n\nexport * from './webhook-destination/webhook-destination'\nexport * from './webhook-destination/webhook-destination-resolver'\nexport * from './webhook-outbox-event/webhook-outbox-event'\nexport * from './webhook-outbox-event/webhook-outbox-resolver'\nexport * from './webhook-sequence/webhook-sequence'\n\n/*\n * ⚠ **The shell builds the database and the schema from these two names.** Without them the module's\n * tables are never created in any application and the destination door is in no schema - the files stand\n * and nothing reaches them. That was the state through 10.1.37 (found 2026-09-24 by the first application to\n * append: its database had no webhook table at all). `test/append-store-db.test.ts` holds this line.\n */\nexport const entities = [WebhookDestination, WebhookOutboxEvent, WebhookSequence]\n\nexport const schema = { resolverClasses: [WebhookDestinationResolver, WebhookOutboxResolver] }\n\n/*\n * The outbox machine, moved from operato-plant (ADR-0078 decision 2). Step ①: the pure judgement —\n * envelope, signature, reading the receiver's answer, settlement, what an answer does to our rows,\n * the sequence report, reconciliation, standing. None of these touch a store.\n */\nexport * from './outbox/delivery'\nexport * from './outbox/settlement'\nexport * from './outbox/row-effect'\nexport * from './outbox/seq-report'\nexport * from './outbox/reconciliation'\nexport * from './outbox/landed-probe'\nexport * from './outbox/standing'\nexport * from './outbox/requeue-note'\nexport * from './outbox/page'\nexport * from './outbox/writing-transaction'\n\n/*\n * Step ②: the back row. Writing a fact down takes the caller's open transaction - in the type, not only\n * in a check - because the number and the row have to commit together or the number burns.\n */\nexport * from './outbox/append'\n\n/* What a delivery needs to say \"when\" and \"which request\" — moved from operato-plant with the dispatcher's\n * needs in mind (ADR-0078 decision 1). The inbound side reads the same two. */\nexport * from './observability/clock-offset'\nexport * from './observability/trace-context'\n\n/* Step ②: the back row. One dispatcher over a store interface; `webhookStore` is this module's own store. */\nexport * from './outbox/store'\nexport * from './outbox/dispatcher'\nexport * from './outbox/webhook-store'\nexport * from './outbox/webhook-append-store'\n\n/*\n * The pump: one round's judgement (`pump-round`), one round (`pump`), and the loop an application starts from its\n * boot hook (`pump-loop`). Keys come from the contract's ladder - the product-named `pump-gate` is gone\n * (ADR-0078 decision 5, re-ruled 2026-09-24).\n */\nexport * from './outbox/pump-round'\nexport * from './outbox/pump'\nexport * from './outbox/pump-loop'\n\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/service/index.ts"],"names":[],"mappings":";;;;AAAA;;;;;;;;GAQG;AACH,mFAA8E;AAC9E,qGAA+F;AAC/F,sFAAgF;AAChF,4FAAsF;AACtF,0EAAqE;AACrE,4FAAsF;AAEtF,oFAAyD;AACzD,6FAAkE;AAClE,sFAA2D;AAC3D,yFAA8D;AAC9D,8EAAmD;AACnD,0FAA+D;AAE/D;;;;;GAKG;AACU,QAAA,QAAQ,GAAG,CAAC,wCAAkB,EAAE,yCAAkB,EAAE,kCAAe,EAAE,6CAAoB,CAAC,CAAA;AAE1F,QAAA,MAAM,GAAG,EAAE,eAAe,EAAE,CAAC,yDAA0B,EAAE,+CAAqB,CAAC,EAAE,CAAA;AAE9F;;;;GAIG;AACH,4DAAiC;AACjC,8DAAmC;AACnC,8DAAmC;AACnC,8DAAmC;AACnC,kEAAuC;AACvC,gEAAqC;AACrC,4DAAiC;AACjC,gEAAqC;AACrC,wDAA6B;AAC7B,uEAA4C;AAE5C;;;GAGG;AACH,0DAA+B;AAE/B;+EAC+E;AAC/E,uEAA4C;AAC5C,wEAA6C;AAE7C,6GAA6G;AAC7G,yDAA8B;AAC9B,8DAAmC;AACnC,iEAAsC;AACtC,wEAA6C;AAE7C;;;;GAIG;AACH,8DAAmC;AACnC,wDAA6B;AAC7B,6DAAkC;AAGlC;;;GAGG;AACH,mEAAwC;AACxC,oEAAyC;AACzC,yEAA8C","sourcesContent":["/*\n * Each source file is named rather than re-exporting folder barrels.\n *\n * A name added to a folder barrel but not listed here stops at the package boundary, and the\n * consumer's error is `TS2305: has no exported member` — which reads like the name does not\n * exist rather than like it is unreachable. That happened on 2026-09-07 with\n * `work-shift/days-of-week`: the parser was in the folder barrel, not here, and the consuming\n * lane wrote its own until the miss was found.\n */\nimport { WebhookDestination } from './webhook-destination/webhook-destination'\nimport { WebhookDestinationResolver } from './webhook-destination/webhook-destination-resolver'\nimport { WebhookOutboxEvent } from './webhook-outbox-event/webhook-outbox-event'\nimport { WebhookOutboxResolver } from './webhook-outbox-event/webhook-outbox-resolver'\nimport { WebhookSequence } from './webhook-sequence/webhook-sequence'\nimport { WebhookReceiveCursor } from './webhook-receive-cursor/webhook-receive-cursor'\n\nexport * from './webhook-destination/webhook-destination'\nexport * from './webhook-destination/webhook-destination-resolver'\nexport * from './webhook-outbox-event/webhook-outbox-event'\nexport * from './webhook-outbox-event/webhook-outbox-resolver'\nexport * from './webhook-sequence/webhook-sequence'\nexport * from './webhook-receive-cursor/webhook-receive-cursor'\n\n/*\n * ⚠ **The shell builds the database and the schema from these two names.** Without them the module's\n * tables are never created in any application and the destination door is in no schema - the files stand\n * and nothing reaches them. That was the state through 10.1.37 (found 2026-09-24 by the first application to\n * append: its database had no webhook table at all). `test/append-store-db.test.ts` holds this line.\n */\nexport const entities = [WebhookDestination, WebhookOutboxEvent, WebhookSequence, WebhookReceiveCursor]\n\nexport const schema = { resolverClasses: [WebhookDestinationResolver, WebhookOutboxResolver] }\n\n/*\n * The outbox machine, moved from operato-plant (ADR-0078 decision 2). Step ①: the pure judgement —\n * envelope, signature, reading the receiver's answer, settlement, what an answer does to our rows,\n * the sequence report, reconciliation, standing. None of these touch a store.\n */\nexport * from './outbox/delivery'\nexport * from './outbox/settlement'\nexport * from './outbox/row-effect'\nexport * from './outbox/seq-report'\nexport * from './outbox/reconciliation'\nexport * from './outbox/landed-probe'\nexport * from './outbox/standing'\nexport * from './outbox/requeue-note'\nexport * from './outbox/page'\nexport * from './outbox/writing-transaction'\n\n/*\n * Step ②: the back row. Writing a fact down takes the caller's open transaction - in the type, not only\n * in a check - because the number and the row have to commit together or the number burns.\n */\nexport * from './outbox/append'\n\n/* What a delivery needs to say \"when\" and \"which request\" — moved from operato-plant with the dispatcher's\n * needs in mind (ADR-0078 decision 1). The inbound side reads the same two. */\nexport * from './observability/clock-offset'\nexport * from './observability/trace-context'\n\n/* Step ②: the back row. One dispatcher over a store interface; `webhookStore` is this module's own store. */\nexport * from './outbox/store'\nexport * from './outbox/dispatcher'\nexport * from './outbox/webhook-store'\nexport * from './outbox/webhook-append-store'\n\n/*\n * The pump: one round's judgement (`pump-round`), one round (`pump`), and the loop an application starts from its\n * boot hook (`pump-loop`). Keys come from the contract's ladder - the product-named `pump-gate` is gone\n * (ADR-0078 decision 5, re-ruled 2026-09-24).\n */\nexport * from './outbox/pump-round'\nexport * from './outbox/pump'\nexport * from './outbox/pump-loop'\n\n\n/*\n * The receiving side (ADR-0080 decision 3 is its first door): whether a pushed request may be read, what a\n * numbered batch lets the receiver take, and the door that does both and keeps the cursor.\n */\nexport * from './inbound/signed-request'\nexport * from './inbound/batch-judgement'\nexport * from './inbound/receive-signed-batch'\n"]}

package/dist-server/service/webhook-receive-cursor/webhook-receive-cursor.d.ts

@@ -0,0 +1,16 @@
+import { Domain } from '@things-factory/shell';
+export declare class WebhookReceiveCursor {
+    readonly id: string;
+    domain: Domain;
+    domainId: string;
+    peer: string;
+    scope: string;
+    lastSeq: number;
+    /**
+     * How many numbers below the first envelope this site ever took were never received - taken once, when
+     * the stream began here. Not a loss count: a receiver attached after the sender started legitimately
+     * begins late, and only the sender knows which case it is.
+     */
+    firstUnseenBefore?: number;
+    updatedAt: Date;
+}

package/dist-server/service/webhook-receive-cursor/webhook-receive-cursor.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookReceiveCursor = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+/*
+ * ═══════════════════════════════════════════════════════════════════════════
+ * The last number this site took on one stream a peer pushes to it - the receiving twin of
+ * `WebhookSequence`.
+ *
+ * One row per (domain, peer, scope): the peer is what **we** call the sender (the address segment), the
+ * scope is the sender's numbering unit as the envelope names it. Moving forward only - a resend is below it
+ * and changes nothing, a hole above it holds the batch until the sender fills it (ADR-0041).
+ *
+ * This row is the receiver's own fact. The sender keeps the peer's reply in `WebhookSequence.peerLastSeq`;
+ * the two are the two ends of one stream.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+let WebhookReceiveCursor = class WebhookReceiveCursor {
+};
+exports.WebhookReceiveCursor = WebhookReceiveCursor;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    (0, type_graphql_1.Field)(type => type_graphql_1.ID),
+    tslib_1.__metadata("design:type", String)
+], WebhookReceiveCursor.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => shell_1.Domain),
+    (0, type_graphql_1.Field)(type => shell_1.Domain),
+    tslib_1.__metadata("design:type", shell_1.Domain)
+], WebhookReceiveCursor.prototype, "domain", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((cursor) => cursor.domain),
+    tslib_1.__metadata("design:type", String)
+], WebhookReceiveCursor.prototype, "domainId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'What this site calls the sender.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookReceiveCursor.prototype, "peer", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'The sender\'s numbering unit.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookReceiveCursor.prototype, "scope", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'int' }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Highest number taken on this stream. Never goes backwards.' }),
+    tslib_1.__metadata("design:type", Number)
+], WebhookReceiveCursor.prototype, "lastSeq", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'int', nullable: true }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { nullable: true, description: 'Numbers below the first envelope taken that never arrived, counted once at the start.' }),
+    tslib_1.__metadata("design:type", Number)
+], WebhookReceiveCursor.prototype, "firstUnseenBefore", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.UpdateDateColumn)(),
+    (0, type_graphql_1.Field)({ nullable: true }),
+    tslib_1.__metadata("design:type", Date)
+], WebhookReceiveCursor.prototype, "updatedAt", void 0);
+exports.WebhookReceiveCursor = WebhookReceiveCursor = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'The last sequence number this site took on one stream a peer pushes to it.' }),
+    (0, typeorm_1.Entity)(),
+    (0, typeorm_1.Index)('ix_webhook_receive_cursor_0', (cursor) => [cursor.domain, cursor.peer, cursor.scope], { unique: true })
+], WebhookReceiveCursor);
+//# sourceMappingURL=webhook-receive-cursor.js.map

package/dist-server/service/webhook-receive-cursor/webhook-receive-cursor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-receive-cursor.js","sourceRoot":"","sources":["../../../server/service/webhook-receive-cursor/webhook-receive-cursor.ts"],"names":[],"mappings":";;;;AAAA,qCAAgH;AAChH,+CAAyD;AAEzD,iDAA8C;AAE9C;;;;;;;;;;;;GAYG;AAII,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAoChC,CAAA;AApCY,oDAAoB;AAGtB;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,CAAC;;gDACC;AAInB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IACzB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;sCACd,cAAM;oDAAA;AAGd;IADC,IAAA,oBAAU,EAAC,CAAC,MAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;;sDAC5C;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;;kDAC/C;AAIZ;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;;mDAC3C;AAIb;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACvB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE,CAAC;;qDACnF;AASf;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uFAAuF,EAAE,CAAC;;+DACnH;AAI1B;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCACf,IAAI;uDAAA;+BAnCJ,oBAAoB;IAHhC,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,4EAA4E,EAAE,CAAC;IACzG,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,6BAA6B,EAAE,CAAC,MAA4B,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;GACxH,oBAAoB,CAoChC","sourcesContent":["import { Column, Entity, Index, ManyToOne, PrimaryGeneratedColumn, RelationId, UpdateDateColumn } from 'typeorm'\nimport { Field, ID, Int, ObjectType } from 'type-graphql'\n\nimport { Domain } from '@things-factory/shell'\n\n/*\n * ═══════════════════════════════════════════════════════════════════════════\n * The last number this site took on one stream a peer pushes to it - the receiving twin of\n * `WebhookSequence`.\n *\n * One row per (domain, peer, scope): the peer is what **we** call the sender (the address segment), the\n * scope is the sender's numbering unit as the envelope names it. Moving forward only - a resend is below it\n * and changes nothing, a hole above it holds the batch until the sender fills it (ADR-0041).\n *\n * This row is the receiver's own fact. The sender keeps the peer's reply in `WebhookSequence.peerLastSeq`;\n * the two are the two ends of one stream.\n * ═══════════════════════════════════════════════════════════════════════════\n */\n@ObjectType({ description: 'The last sequence number this site took on one stream a peer pushes to it.' })\n@Entity()\n@Index('ix_webhook_receive_cursor_0', (cursor: WebhookReceiveCursor) => [cursor.domain, cursor.peer, cursor.scope], { unique: true })\nexport class WebhookReceiveCursor {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID)\n  readonly id: string\n\n  @ManyToOne(type => Domain)\n  @Field(type => Domain)\n  domain: Domain\n\n  @RelationId((cursor: WebhookReceiveCursor) => cursor.domain)\n  domainId: string\n\n  @Column()\n  @Field({ description: 'What this site calls the sender.' })\n  peer: string\n\n  @Column()\n  @Field({ description: 'The sender\\'s numbering unit.' })\n  scope: string\n\n  @Column({ type: 'int' })\n  @Field(type => Int, { description: 'Highest number taken on this stream. Never goes backwards.' })\n  lastSeq: number\n\n  /**\n   * How many numbers below the first envelope this site ever took were never received - taken once, when\n   * the stream began here. Not a loss count: a receiver attached after the sender started legitimately\n   * begins late, and only the sender knows which case it is.\n   */\n  @Column({ type: 'int', nullable: true })\n  @Field(type => Int, { nullable: true, description: 'Numbers below the first envelope taken that never arrived, counted once at the start.' })\n  firstUnseenBefore?: number\n\n  @UpdateDateColumn()\n  @Field({ nullable: true })\n  updatedAt: Date\n}\n"]}