@things-factory/webhook 10.1.4

package/dist-server/service/index.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+/*
+ * Each source file is named rather than re-exporting folder barrels.
+ *
+ * A name added to a folder barrel but not listed here stops at the package boundary, and the
+ * consumer's error is `TS2305: has no exported member` — which reads like the name does not
+ * exist rather than like it is unreachable. That happened on 2026-09-07 with
+ * `work-shift/days-of-week`: the parser was in the folder barrel, not here, and the consuming
+ * lane wrote its own until the miss was found.
+ */
+tslib_1.__exportStar(require("./webhook-destination/webhook-destination"), exports);
+tslib_1.__exportStar(require("./webhook-destination/webhook-destination-resolver"), exports);
+tslib_1.__exportStar(require("./webhook-outbox-event/webhook-outbox-event"), exports);
+tslib_1.__exportStar(require("./webhook-sequence/webhook-sequence"), exports);
+//# sourceMappingURL=index.js.map

package/dist-server/service/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/service/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,oFAAyD;AACzD,6FAAkE;AAClE,sFAA2D;AAC3D,8EAAmD","sourcesContent":["/*\n * Each source file is named rather than re-exporting folder barrels.\n *\n * A name added to a folder barrel but not listed here stops at the package boundary, and the\n * consumer's error is `TS2305: has no exported member` — which reads like the name does not\n * exist rather than like it is unreachable. That happened on 2026-09-07 with\n * `work-shift/days-of-week`: the parser was in the folder barrel, not here, and the consuming\n * lane wrote its own until the miss was found.\n */\nexport * from './webhook-destination/webhook-destination'\nexport * from './webhook-destination/webhook-destination-resolver'\nexport * from './webhook-outbox-event/webhook-outbox-event'\nexport * from './webhook-sequence/webhook-sequence'\n"]}

package/dist-server/service/webhook-destination/webhook-destination-resolver.d.ts

@@ -0,0 +1,22 @@
+import { WebhookDestination } from './webhook-destination';
+export declare class WebhookDestinationResolver {
+    webhookDestinations(context: ResolverContext): Promise<WebhookDestination[]>;
+    webhookDestination(peer: string, context: ResolverContext): Promise<WebhookDestination | null>;
+    /**
+     * Create or update one peer's destination.
+     *
+     * `patch` is merged field by field so a caller may send only what changed. A screen that
+     * has to send every field in order to change one either reads the row first — and writes
+     * back a value that moved in between — or blanks the fields it did not ask about.
+     */
+    saveWebhookDestination(peer: string, patch: any, context: ResolverContext): Promise<WebhookDestination>;
+    /**
+     * Stop pushing to a peer without forgetting it.
+     *
+     * Deliberately not a delete: the numbering and the queue are keyed by peer, and removing
+     * the row would leave both orphaned. A destination that is turned off resumes where it
+     * left off; one that is deleted starts over, and the peer reads that as a stream of
+     * numbers it has already seen.
+     */
+    setWebhookDestinationActive(peer: string, active: boolean, context: ResolverContext): Promise<boolean>;
+}

package/dist-server/service/webhook-destination/webhook-destination-resolver.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookDestinationResolver = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const webhook_destination_1 = require("./webhook-destination");
+/*
+ * ═══════════════════════════════════════════════════════════════════════════
+ * Reading and writing the destinations of one tenant.
+ *
+ * ── A list, not "the" destination ──────────────────────────────────────────
+ * The screen this replaces asked for one row (`UNIQUE(domain_id)`), so its query took no
+ * arguments and its editor had no way to say which peer it was editing. That holds exactly
+ * until a tenant mirrors into two twins, or pushes to a twin and an ERP — and then the second
+ * peer cannot be entered at all (ADR-0041).
+ *
+ * ── Secrets are not read or written here ───────────────────────────────────
+ * Signing and verifying keys come from the environment, per peer. A mutation that accepted
+ * them would put them in a request body, a resolver log and an audit row; a query that
+ * returned them would hand them to anyone who can open the settings screen.
+ *
+ * What the screen may say about a key is whether one is *present* — that is a fact about
+ * configuration, not the value.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+let WebhookDestinationResolver = class WebhookDestinationResolver {
+    async webhookDestinations(context) {
+        return await (0, shell_1.getRepository)(webhook_destination_1.WebhookDestination).find({
+            where: { domain: { id: context.state.domain.id } },
+            order: { peer: 'ASC' }
+        });
+    }
+    async webhookDestination(peer, context) {
+        return await (0, shell_1.getRepository)(webhook_destination_1.WebhookDestination).findOne({
+            where: { domain: { id: context.state.domain.id }, peer }
+        });
+    }
+    /**
+     * Create or update one peer's destination.
+     *
+     * `patch` is merged field by field so a caller may send only what changed. A screen that
+     * has to send every field in order to change one either reads the row first — and writes
+     * back a value that moved in between — or blanks the fields it did not ask about.
+     */
+    async saveWebhookDestination(peer, patch, context) {
+        const domainId = context.state.domain.id;
+        const repo = (0, shell_1.getRepository)(webhook_destination_1.WebhookDestination);
+        const existing = await repo.findOne({ where: { domain: { id: domainId }, peer } });
+        /*
+         * `params` merges by key for the same reason the patch does — a peer's options are added
+         * to over time, and replacing the whole object drops the ones this screen version does
+         * not know about.
+         */
+        const params = patch.params
+            ? { ...(existing?.params ?? {}), ...patch.params }
+            : existing?.params;
+        return await repo.save(repo.create({
+            ...(existing ?? {}),
+            domain: { id: domainId },
+            peer,
+            endpoint: patch.endpoint ?? existing?.endpoint,
+            description: patch.description ?? existing?.description,
+            params,
+            /*
+             * `active` is a decision, so `false` has to be writable — `??` rather than `||`,
+             * or turning a peer off would silently do nothing.
+             */
+            active: patch.active ?? existing?.active ?? true,
+            creator: existing?.creator ?? context.state.user,
+            updater: context.state.user
+        }));
+    }
+    /**
+     * Stop pushing to a peer without forgetting it.
+     *
+     * Deliberately not a delete: the numbering and the queue are keyed by peer, and removing
+     * the row would leave both orphaned. A destination that is turned off resumes where it
+     * left off; one that is deleted starts over, and the peer reads that as a stream of
+     * numbers it has already seen.
+     */
+    async setWebhookDestinationActive(peer, active, context) {
+        const result = await (0, shell_1.getRepository)(webhook_destination_1.WebhookDestination).update({ domain: { id: context.state.domain.id }, peer }, { active, updater: context.state.user });
+        return !!result.affected;
+    }
+};
+exports.WebhookDestinationResolver = WebhookDestinationResolver;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "webhook", privilege: "query", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Query)(returns => [webhook_destination_1.WebhookDestination], {
+        description: 'Every peer this tenant pushes facts to. Secrets are never included — only whether a key is present.'
+    }),
+    tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookDestinationResolver.prototype, "webhookDestinations", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "webhook", privilege: "query", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Query)(returns => webhook_destination_1.WebhookDestination, { nullable: true, description: 'One peer\'s destination, or null if this tenant has none by that name.' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('peer')),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookDestinationResolver.prototype, "webhookDestination", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "webhook", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Mutation)(returns => webhook_destination_1.WebhookDestination, { description: 'Create or update the destination for one peer. Fields absent from the patch keep their stored value.' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('peer')),
+    tslib_1.__param(1, (0, type_graphql_1.Arg)('patch', type => shell_1.ScalarObject)),
+    tslib_1.__param(2, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookDestinationResolver.prototype, "saveWebhookDestination", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "webhook", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Mutation)(returns => Boolean, { description: 'Turn pushing to one peer off or on. The queue and the numbering are kept either way.' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('peer')),
+    tslib_1.__param(1, (0, type_graphql_1.Arg)('active')),
+    tslib_1.__param(2, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Boolean, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], WebhookDestinationResolver.prototype, "setWebhookDestinationActive", null);
+exports.WebhookDestinationResolver = WebhookDestinationResolver = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)()
+], WebhookDestinationResolver);
+//# sourceMappingURL=webhook-destination-resolver.js.map

package/dist-server/service/webhook-destination/webhook-destination-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-destination-resolver.js","sourceRoot":"","sources":["../../../server/service/webhook-destination/webhook-destination-resolver.ts"],"names":[],"mappings":";;;;AAAA,+CAA6E;AAE7E,iDAAmE;AAEnE,+DAA0D;AAE1D;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAK/B,AAAN,KAAK,CAAC,mBAAmB,CAAQ,OAAwB;QACvD,OAAO,MAAM,IAAA,qBAAa,EAAC,wCAAkB,CAAC,CAAC,IAAI,CAAC;YAClD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE;YAClD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SACvB,CAAC,CAAA;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,kBAAkB,CACT,IAAY,EAClB,OAAwB;QAE/B,OAAO,MAAM,IAAA,qBAAa,EAAC,wCAAkB,CAAC,CAAC,OAAO,CAAC;YACrD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;SACzD,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IAGG,AAAN,KAAK,CAAC,sBAAsB,CACb,IAAY,EACW,KAAU,EACvC,OAAwB;QAE/B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAA;QACxC,MAAM,IAAI,GAAG,IAAA,qBAAa,EAAC,wCAAkB,CAAC,CAAA;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QAElF;;;;WAIG;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;YACzB,CAAC,CAAC,EAAE,GAAG,CAAE,QAAQ,EAAE,MAAc,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE;YAC3D,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAA;QAEpB,OAAO,MAAM,IAAI,CAAC,IAAI,CACpB,IAAI,CAAC,MAAM,CAAC;YACV,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACnB,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAS;YAC/B,IAAI;YACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ;YAC9C,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW;YACvD,MAAM;YACN;;;eAGG;YACH,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,IAAI,IAAI;YAChD,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAK,OAAO,CAAC,KAAK,CAAC,IAAY;YACzD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAW;SACnC,CAAC,CACH,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IAGG,AAAN,KAAK,CAAC,2BAA2B,CAClB,IAAY,EACV,MAAe,EACvB,OAAwB;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAa,EAAC,wCAAkB,CAAC,CAAC,MAAM,CAC3D,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAS,EAAE,IAAI,EAAE,EACxD,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAW,EAAE,CAC/C,CAAA;QACD,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAA;IAC1B,CAAC;CACF,CAAA;AA1FY,gEAA0B;AAK/B;IAJL,IAAA,wBAAS,EAAC,uGAAuG,CAAC;IAClH,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,wCAAkB,CAAC,EAAE;QACtC,WAAW,EAAE,qGAAqG;KACnH,CAAC;IACyB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qEAK/B;AAIK;IAFL,IAAA,wBAAS,EAAC,uGAAuG,CAAC;IAClH,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wCAAkB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wEAAwE,EAAE,CAAC;IAE7I,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IACX,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;oEAKP;AAWK;IAFL,IAAA,wBAAS,EAAC,0GAA0G,CAAC;IACrH,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,wCAAkB,EAAE,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAE9J,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IACX,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,oBAAY,CAAC,CAAA;IAClC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wEAgCP;AAYK;IAFL,IAAA,wBAAS,EAAC,0GAA0G,CAAC;IACrH,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,sFAAsF,EAAE,CAAC;IAEnI,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IACX,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IACb,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;6EAOP;qCAzFU,0BAA0B;IADtC,IAAA,uBAAQ,GAAE;GACE,0BAA0B,CA0FtC","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Query, Resolver } from 'type-graphql'\n\nimport { getRepository, ScalarObject } from '@things-factory/shell'\n\nimport { WebhookDestination } from './webhook-destination'\n\n/*\n * ═══════════════════════════════════════════════════════════════════════════\n * Reading and writing the destinations of one tenant.\n *\n * ── A list, not \"the\" destination ──────────────────────────────────────────\n * The screen this replaces asked for one row (`UNIQUE(domain_id)`), so its query took no\n * arguments and its editor had no way to say which peer it was editing. That holds exactly\n * until a tenant mirrors into two twins, or pushes to a twin and an ERP — and then the second\n * peer cannot be entered at all (ADR-0041).\n *\n * ── Secrets are not read or written here ───────────────────────────────────\n * Signing and verifying keys come from the environment, per peer. A mutation that accepted\n * them would put them in a request body, a resolver log and an audit row; a query that\n * returned them would hand them to anyone who can open the settings screen.\n *\n * What the screen may say about a key is whether one is *present* — that is a fact about\n * configuration, not the value.\n * ═══════════════════════════════════════════════════════════════════════════\n */\n@Resolver()\nexport class WebhookDestinationResolver {\n  @Directive('@privilege(category: \"webhook\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [WebhookDestination], {\n    description: 'Every peer this tenant pushes facts to. Secrets are never included — only whether a key is present.'\n  })\n  async webhookDestinations(@Ctx() context: ResolverContext): Promise<WebhookDestination[]> {\n    return await getRepository(WebhookDestination).find({\n      where: { domain: { id: context.state.domain.id } },\n      order: { peer: 'ASC' }\n    })\n  }\n\n  @Directive('@privilege(category: \"webhook\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => WebhookDestination, { nullable: true, description: 'One peer\\'s destination, or null if this tenant has none by that name.' })\n  async webhookDestination(\n    @Arg('peer') peer: string,\n    @Ctx() context: ResolverContext\n  ): Promise<WebhookDestination | null> {\n    return await getRepository(WebhookDestination).findOne({\n      where: { domain: { id: context.state.domain.id }, peer }\n    })\n  }\n\n  /**\n   * Create or update one peer's destination.\n   *\n   * `patch` is merged field by field so a caller may send only what changed. A screen that\n   * has to send every field in order to change one either reads the row first — and writes\n   * back a value that moved in between — or blanks the fields it did not ask about.\n   */\n  @Directive('@privilege(category: \"webhook\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)')\n  @Mutation(returns => WebhookDestination, { description: 'Create or update the destination for one peer. Fields absent from the patch keep their stored value.' })\n  async saveWebhookDestination(\n    @Arg('peer') peer: string,\n    @Arg('patch', type => ScalarObject) patch: any,\n    @Ctx() context: ResolverContext\n  ): Promise<WebhookDestination> {\n    const domainId = context.state.domain.id\n    const repo = getRepository(WebhookDestination)\n    const existing = await repo.findOne({ where: { domain: { id: domainId }, peer } })\n\n    /*\n     * `params` merges by key for the same reason the patch does — a peer's options are added\n     * to over time, and replacing the whole object drops the ones this screen version does\n     * not know about.\n     */\n    const params = patch.params\n      ? { ...((existing?.params as any) ?? {}), ...patch.params }\n      : existing?.params\n\n    return await repo.save(\n      repo.create({\n        ...(existing ?? {}),\n        domain: { id: domainId } as any,\n        peer,\n        endpoint: patch.endpoint ?? existing?.endpoint,\n        description: patch.description ?? existing?.description,\n        params,\n        /*\n         * `active` is a decision, so `false` has to be writable — `??` rather than `||`,\n         * or turning a peer off would silently do nothing.\n         */\n        active: patch.active ?? existing?.active ?? true,\n        creator: existing?.creator ?? (context.state.user as any),\n        updater: context.state.user as any\n      })\n    )\n  }\n\n  /**\n   * Stop pushing to a peer without forgetting it.\n   *\n   * Deliberately not a delete: the numbering and the queue are keyed by peer, and removing\n   * the row would leave both orphaned. A destination that is turned off resumes where it\n   * left off; one that is deleted starts over, and the peer reads that as a stream of\n   * numbers it has already seen.\n   */\n  @Directive('@privilege(category: \"webhook\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)')\n  @Mutation(returns => Boolean, { description: 'Turn pushing to one peer off or on. The queue and the numbering are kept either way.' })\n  async setWebhookDestinationActive(\n    @Arg('peer') peer: string,\n    @Arg('active') active: boolean,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const result = await getRepository(WebhookDestination).update(\n      { domain: { id: context.state.domain.id } as any, peer },\n      { active, updater: context.state.user as any }\n    )\n    return !!result.affected\n  }\n}\n"]}

package/dist-server/service/webhook-destination/webhook-destination.d.ts

@@ -0,0 +1,57 @@
+import { Domain } from '@things-factory/shell';
+import { User } from '@things-factory/auth-base';
+export declare class WebhookDestination {
+    readonly id: string;
+    domain: Domain;
+    domainId: string;
+    /**
+     * Who we are talking to. **The unit of everything on this seam** — keys, numbering,
+     * delivery state and accounting are all per peer.
+     *
+     * A name, not a kind: `mes-miratek`, `erp-sap`, `twin-b`. Two peers of the same kind are
+     * two rows, and that is the point.
+     */
+    peer: string;
+    description: string;
+    /** Where the POST goes. */
+    endpoint: string;
+    /**
+     * What the receiving side needs in order to place the envelopes — its own tenant, the
+     * instance they belong to, and anything else that peer asks for.
+     *
+     * Deliberately open: the protocol is fixed by the contract, but what a given peer wants in
+     * the path or the headers is that peer's business. `receivingDomain` and `instanceId` live
+     * here rather than as columns, because the next peer may want neither.
+     *
+     * **No secrets here.** Signing and verifying keys come from the environment, per peer
+     * (`webhookSecretCandidates`), because that kind of key is one per installation and can be
+     * provisioned at deploy time.
+     *
+     * The column is nonetheless encrypted at rest. The rule above is a declaration, and a
+     * declaration does not stop a value arriving — on 2026-09-09 a connection config in the twin
+     * was found holding a signing secret and an access token in the clear, in a column whose own
+     * comment said credentials belong there. Encrypting this one costs a line and means a mistake
+     * is not readable from a database file or a backup. It does not make this the place for keys.
+     */
+    params: any;
+    /**
+     * Whether to push at all. **Off is not the same as removed** — a destination that is
+     * turned off keeps its numbering and its queue, so turning it back on resumes rather than
+     * starts over.
+     */
+    active: boolean;
+    /**
+     * What the last attempt learned — reachable or not.
+     *
+     * Separate from `active` because they answer different questions: `active` is what a person
+     * decided, this is what the network said. Folding them together loses the difference
+     * between "we stopped pushing" and "we cannot get through".
+     */
+    state: string;
+    createdAt: Date;
+    updatedAt: Date;
+    creator: User;
+    creatorId: string;
+    updater: User;
+    updaterId: string;
+}

package/dist-server/service/webhook-destination/webhook-destination.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookDestination = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const auth_base_1 = require("@things-factory/auth-base");
+/*
+ * ═══════════════════════════════════════════════════════════════════════════
+ * Where this tenant pushes facts, and who it is pushing them to.
+ *
+ * ── The unit is (domain, peer) — three places used three units ─────────────
+ * This concept already existed twice in the platform, keyed three different ways
+ * (ADR-0041, measured 2026-09-08):
+ *
+ *     operato-plant  the destination table    UNIQUE(domain_id)          per tenant
+ *     operato-plant  the inbound signing key  keyed by siteId            per site
+ *     operato-twin   the same pair of keys    twin_references row        per connection
+ *
+ * None of those survives one tenant talking to two peers. A tenant that mirrors into two
+ * twins, or pushes to a twin *and* an ERP, needs a row for each — and each of those rows
+ * needs its own keys, its own numbering and its own delivery state.
+ *
+ * So `peer` is the unit: `mes-miratek`, `erp-sap`, a second twin. It names **who we are
+ * talking to**, not what kind of system we are. That distinction is why `erp_postings` and
+ * `mes_outbox_events` were two machines in one package — they were two peers, and nothing
+ * in the model said so.
+ *
+ * ── The address is not here ────────────────────────────────────────────────
+ * `endpoint` is where the POST goes. The *route* on the receiving side is owned by whichever
+ * module opens that door, and it uses the contract's system vocabulary
+ * (`DomainSystem = 'wms' | 'yms' | 'mes' | 'ems'`), not a product name — `/webhook/mes/…`
+ * stays as it is. A sender writes an address into its own config, so the word in it has to
+ * outlive product renames.
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+let WebhookDestination = class WebhookDestination {
+};
+exports.WebhookDestination = WebhookDestination;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    (0, type_graphql_1.Field)(type => type_graphql_1.ID, { description: 'Unique identifier for this destination.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookDestination.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => shell_1.Domain),
+    (0, type_graphql_1.Field)(type => shell_1.Domain, { description: 'The tenant whose facts go to this peer.' }),
+    tslib_1.__metadata("design:type", shell_1.Domain)
+], WebhookDestination.prototype, "domain", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((dest) => dest.domain),
+    tslib_1.__metadata("design:type", String)
+], WebhookDestination.prototype, "domainId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'Name of the peer being pushed to (e.g. mes-miratek, erp-sap). The unit of keys, numbering and delivery state.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookDestination.prototype, "peer", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'What this destination is for, in a person\'s words.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookDestination.prototype, "description", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'The URL facts are posted to.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookDestination.prototype, "endpoint", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true, ...(0, shell_1.encryptedJsonColumn)() }),
+    (0, type_graphql_1.Field)(type => shell_1.ScalarObject, { nullable: true, description: 'Options this peer needs (receiving domain, instance, path parts). Not the place for secrets; encrypted at rest so a mistake is not readable.' }),
+    tslib_1.__metadata("design:type", Object)
+], WebhookDestination.prototype, "params", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ default: true }),
+    (0, type_graphql_1.Field)({ description: 'Whether facts are being pushed to this peer right now. Turning it off keeps the queue and the numbering.' }),
+    tslib_1.__metadata("design:type", Boolean)
+], WebhookDestination.prototype, "active", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'What the last delivery attempt learned about reachability. Not the same as `active`, which is a decision.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookDestination.prototype, "state", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)(),
+    (0, type_graphql_1.Field)({ nullable: true }),
+    tslib_1.__metadata("design:type", Date)
+], WebhookDestination.prototype, "createdAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.UpdateDateColumn)(),
+    (0, type_graphql_1.Field)({ nullable: true }),
+    tslib_1.__metadata("design:type", Date)
+], WebhookDestination.prototype, "updatedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => auth_base_1.User, { nullable: true }),
+    (0, type_graphql_1.Field)(type => auth_base_1.User, { nullable: true }),
+    tslib_1.__metadata("design:type", auth_base_1.User)
+], WebhookDestination.prototype, "creator", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((dest) => dest.creator),
+    tslib_1.__metadata("design:type", String)
+], WebhookDestination.prototype, "creatorId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => auth_base_1.User, { nullable: true }),
+    (0, type_graphql_1.Field)(type => auth_base_1.User, { nullable: true }),
+    tslib_1.__metadata("design:type", auth_base_1.User)
+], WebhookDestination.prototype, "updater", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((dest) => dest.updater),
+    tslib_1.__metadata("design:type", String)
+], WebhookDestination.prototype, "updaterId", void 0);
+exports.WebhookDestination = WebhookDestination = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A peer this tenant pushes facts to, and the address and options to reach it.' }),
+    (0, typeorm_1.Entity)(),
+    (0, typeorm_1.Index)('ix_webhook_destination_0', (dest) => [dest.domain, dest.peer], { unique: true })
+], WebhookDestination);
+//# sourceMappingURL=webhook-destination.js.map

package/dist-server/service/webhook-destination/webhook-destination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-destination.js","sourceRoot":"","sources":["../../../server/service/webhook-destination/webhook-destination.ts"],"names":[],"mappings":";;;;AAAA,qCASgB;AAChB,+CAAoD;AAEpD,iDAAiF;AACjF,yDAAgD;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAII,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CA+F9B,CAAA;AA/FY,gDAAkB;AAGpB;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CAC3D;AAInB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IACzB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;sCAC1E,cAAM;kDAAA;AAGd;IADC,IAAA,oBAAU,EAAC,CAAC,IAAwB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;;oDACtC;AAWhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,+GAA+G,EAAE,CAAC;;gDAC5H;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;;uDAC3E;AAKnB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;;oDACvC;AAsBhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAA,2BAAmB,GAAE,EAAE,CAAC;IACpD,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,oBAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8IAA8I,EAAE,CAAC;;kDAClM;AASX;IAFC,IAAA,gBAAM,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,0GAA0G,EAAE,CAAC;;kDACpH;AAWf;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2GAA2G,EAAE,CAAC;;iDACvI;AAIb;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCACf,IAAI;qDAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCACf,IAAI;qDAAA;AAIf;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,gBAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,gBAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCAC/B,gBAAI;mDAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAwB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;qDACtC;AAIjB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,gBAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,gBAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCAC/B,gBAAI;mDAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAwB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;qDACtC;6BA9FN,kBAAkB;IAH9B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;IAC3G,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,0BAA0B,EAAE,CAAC,IAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;GAC/F,kBAAkB,CA+F9B","sourcesContent":["import {\n  Column,\n  CreateDateColumn,\n  Entity,\n  Index,\n  ManyToOne,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\nimport { Field, ID, ObjectType } from 'type-graphql'\n\nimport { Domain, ScalarObject, encryptedJsonColumn } from '@things-factory/shell'\nimport { User } from '@things-factory/auth-base'\n\n/*\n * ═══════════════════════════════════════════════════════════════════════════\n * Where this tenant pushes facts, and who it is pushing them to.\n *\n * ── The unit is (domain, peer) — three places used three units ─────────────\n * This concept already existed twice in the platform, keyed three different ways\n * (ADR-0041, measured 2026-09-08):\n *\n *     operato-plant  the destination table    UNIQUE(domain_id)          per tenant\n *     operato-plant  the inbound signing key  keyed by siteId            per site\n *     operato-twin   the same pair of keys    twin_references row        per connection\n *\n * None of those survives one tenant talking to two peers. A tenant that mirrors into two\n * twins, or pushes to a twin *and* an ERP, needs a row for each — and each of those rows\n * needs its own keys, its own numbering and its own delivery state.\n *\n * So `peer` is the unit: `mes-miratek`, `erp-sap`, a second twin. It names **who we are\n * talking to**, not what kind of system we are. That distinction is why `erp_postings` and\n * `mes_outbox_events` were two machines in one package — they were two peers, and nothing\n * in the model said so.\n *\n * ── The address is not here ────────────────────────────────────────────────\n * `endpoint` is where the POST goes. The *route* on the receiving side is owned by whichever\n * module opens that door, and it uses the contract's system vocabulary\n * (`DomainSystem = 'wms' | 'yms' | 'mes' | 'ems'`), not a product name — `/webhook/mes/…`\n * stays as it is. A sender writes an address into its own config, so the word in it has to\n * outlive product renames.\n * ═══════════════════════════════════════════════════════════════════════════\n */\n@ObjectType({ description: 'A peer this tenant pushes facts to, and the address and options to reach it.' })\n@Entity()\n@Index('ix_webhook_destination_0', (dest: WebhookDestination) => [dest.domain, dest.peer], { unique: true })\nexport class WebhookDestination {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for this destination.' })\n  readonly id: string\n\n  @ManyToOne(type => Domain)\n  @Field(type => Domain, { description: 'The tenant whose facts go to this peer.' })\n  domain: Domain\n\n  @RelationId((dest: WebhookDestination) => dest.domain)\n  domainId: string\n\n  /**\n   * Who we are talking to. **The unit of everything on this seam** — keys, numbering,\n   * delivery state and accounting are all per peer.\n   *\n   * A name, not a kind: `mes-miratek`, `erp-sap`, `twin-b`. Two peers of the same kind are\n   * two rows, and that is the point.\n   */\n  @Column()\n  @Field({ description: 'Name of the peer being pushed to (e.g. mes-miratek, erp-sap). The unit of keys, numbering and delivery state.' })\n  peer: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'What this destination is for, in a person\\'s words.' })\n  description: string\n\n  /** Where the POST goes. */\n  @Column()\n  @Field({ description: 'The URL facts are posted to.' })\n  endpoint: string\n\n  /**\n   * What the receiving side needs in order to place the envelopes — its own tenant, the\n   * instance they belong to, and anything else that peer asks for.\n   *\n   * Deliberately open: the protocol is fixed by the contract, but what a given peer wants in\n   * the path or the headers is that peer's business. `receivingDomain` and `instanceId` live\n   * here rather than as columns, because the next peer may want neither.\n   *\n   * **No secrets here.** Signing and verifying keys come from the environment, per peer\n   * (`webhookSecretCandidates`), because that kind of key is one per installation and can be\n   * provisioned at deploy time.\n   *\n   * The column is nonetheless encrypted at rest. The rule above is a declaration, and a\n   * declaration does not stop a value arriving — on 2026-09-09 a connection config in the twin\n   * was found holding a signing secret and an access token in the clear, in a column whose own\n   * comment said credentials belong there. Encrypting this one costs a line and means a mistake\n   * is not readable from a database file or a backup. It does not make this the place for keys.\n   */\n  @Column({ nullable: true, ...encryptedJsonColumn() })\n  @Field(type => ScalarObject, { nullable: true, description: 'Options this peer needs (receiving domain, instance, path parts). Not the place for secrets; encrypted at rest so a mistake is not readable.' })\n  params: any\n\n  /**\n   * Whether to push at all. **Off is not the same as removed** — a destination that is\n   * turned off keeps its numbering and its queue, so turning it back on resumes rather than\n   * starts over.\n   */\n  @Column({ default: true })\n  @Field({ description: 'Whether facts are being pushed to this peer right now. Turning it off keeps the queue and the numbering.' })\n  active: boolean\n\n  /**\n   * What the last attempt learned — reachable or not.\n   *\n   * Separate from `active` because they answer different questions: `active` is what a person\n   * decided, this is what the network said. Folding them together loses the difference\n   * between \"we stopped pushing\" and \"we cannot get through\".\n   */\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'What the last delivery attempt learned about reachability. Not the same as `active`, which is a decision.' })\n  state: string\n\n  @CreateDateColumn()\n  @Field({ nullable: true })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ nullable: true })\n  updatedAt: Date\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field(type => User, { nullable: true })\n  creator: User\n\n  @RelationId((dest: WebhookDestination) => dest.creator)\n  creatorId: string\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field(type => User, { nullable: true })\n  updater: User\n\n  @RelationId((dest: WebhookDestination) => dest.updater)\n  updaterId: string\n}\n"]}

package/dist-server/service/webhook-outbox-event/webhook-outbox-event.d.ts

@@ -0,0 +1,57 @@
+import { Domain } from '@things-factory/shell';
+export declare enum WebhookOutboxStatus {
+    /** Waiting to go. The pump picks these up in `seq` order. */
+    Pending = "PENDING",
+    /** The peer took it. */
+    Sent = "SENT",
+    /** The peer refused it and resending will not change that — a person has to look. */
+    Failed = "FAILED"
+}
+export declare class WebhookOutboxEvent {
+    readonly id: string;
+    domain: Domain;
+    domainId: string;
+    /** Who this is going to. Same unit as the destination row. */
+    peer: string;
+    /**
+     * The unit the numbers are counted in — the contract's `WebhookEnvelope.scope`.
+     *
+     * Without it the receiving side cannot tell which run of numbers a given envelope belongs
+     * to, and two streams sharing one cursor answer "a number is missing" forever.
+     */
+    scope: string;
+    /** Increases by one within (domain, peer, scope). A hole here is a lost fact. */
+    seq: number;
+    /**
+     * Idempotency key. The receiving side uses it to recognise a fact it has already taken, so
+     * a resend after a lost response does not seat the same fact twice.
+     *
+     * It also lets a refusal name **which** envelope was refused: the receiver echoes this back
+     * in `WebhookResponse.rejected`, and without it the sender can only be told "one of these
+     * was refused" (measured 2026-09-07 — a whole batch was marked delivered because the
+     * refusal could not be matched to a row).
+     */
+    eventId: string;
+    /** When the fact happened. */
+    eventTime: Date;
+    /**
+     * When we wrote it down. **Kept apart from `eventTime`** — a fact that arrives late is not
+     * a fact that happened late, and folding them together makes a backfill look like a
+     * present-tense event.
+     */
+    recordTime: Date;
+    /** The fact itself, in whatever shape this product speaks. The only product-specific column. */
+    payload: any;
+    status: WebhookOutboxStatus;
+    sentAt: Date;
+    /**
+     * How many times a delivery was **really refused** — not how many times we tried.
+     *
+     * A peer answering 429 or 503 is asking us to wait; that does not count here, or a
+     * receiver under load becomes indistinguishable from a receiver that rejects us.
+     */
+    attempts: number;
+    lastError: string;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/dist-server/service/webhook-outbox-event/webhook-outbox-event.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookOutboxEvent = exports.WebhookOutboxStatus = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+/*
+ * ═══════════════════════════════════════════════════════════════════════════
+ * One fact waiting to reach a peer.
+ *
+ * ── This row is the contract's envelope plus delivery state ────────────────
+ * The shape is not invented here. `@operato/ops-contract` already declares what crosses
+ * this seam, and the row is that declaration with the delivery columns added:
+ *
+ *     WebhookEnvelope   seq · scope · eventId · eventTime · recordTime · record
+ *     this row          seq · scope · eventId · eventTime · recordTime · payload
+ *                       + status · attempts · lastError · sentAt
+ *
+ * `payload` is the only product-specific column — a production report, a putaway task, a
+ * setpoint. Everything else is the same whether the sender is an MES, a WMS, a YMS or an EMS,
+ * which is why this table does not carry a product's name (ADR-0041).
+ *
+ * ── Why `scope` and not `channel` ─────────────────────────────────────────
+ * operato-plant called this `channel` and the contract calls it `scope`. Same idea: the unit
+ * the numbers are counted in. The contract's word wins, because the receiving side reads
+ * `scope` off the envelope to decide which cursor to compare against — a sender using a
+ * different word has to translate, and a translation is a place to be wrong.
+ *
+ * ── Failure that keeps the fact, and failure that gives up ─────────────────
+ * A 429 or a 503 is not a failed delivery — it is "not now". Those must not consume the
+ * retry budget, and they must not be recorded as attempts, or a receiver asking us to wait
+ * looks identical to a receiver refusing us. Measured on 2026-09-08: the sender's
+ * backpressure path touched neither `attempts` nor `lastError`, so a loop that re-offered the
+ * same batch every five seconds left no trace on either side. The row cannot fix that alone —
+ * the pump has to say something out loud — but it is why `attempts` means "tries that were
+ * really refused".
+ * ═══════════════════════════════════════════════════════════════════════════
+ */
+var WebhookOutboxStatus;
+(function (WebhookOutboxStatus) {
+    /** Waiting to go. The pump picks these up in `seq` order. */
+    WebhookOutboxStatus["Pending"] = "PENDING";
+    /** The peer took it. */
+    WebhookOutboxStatus["Sent"] = "SENT";
+    /** The peer refused it and resending will not change that — a person has to look. */
+    WebhookOutboxStatus["Failed"] = "FAILED";
+})(WebhookOutboxStatus || (exports.WebhookOutboxStatus = WebhookOutboxStatus = {}));
+(0, type_graphql_1.registerEnumType)(WebhookOutboxStatus, {
+    name: 'WebhookOutboxStatus',
+    description: 'Whether a queued fact is waiting, delivered, or refused for good.'
+});
+let WebhookOutboxEvent = class WebhookOutboxEvent {
+};
+exports.WebhookOutboxEvent = WebhookOutboxEvent;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    (0, type_graphql_1.Field)(type => type_graphql_1.ID, { description: 'Unique identifier for this queued fact.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookOutboxEvent.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => shell_1.Domain),
+    (0, type_graphql_1.Field)(type => shell_1.Domain, { description: 'The tenant this fact belongs to.' }),
+    tslib_1.__metadata("design:type", shell_1.Domain)
+], WebhookOutboxEvent.prototype, "domain", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((event) => event.domain),
+    tslib_1.__metadata("design:type", String)
+], WebhookOutboxEvent.prototype, "domainId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'The peer this fact is queued for.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookOutboxEvent.prototype, "peer", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'The unit the sequence is counted in (the contract\'s scope). Two streams must not share one cursor.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookOutboxEvent.prototype, "scope", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'int' }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Position in this scope. Increases by one; a hole means a fact went missing.' }),
+    tslib_1.__metadata("design:type", Number)
+], WebhookOutboxEvent.prototype, "seq", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'Idempotency key. Echoed back in a refusal so the sender knows which row was refused.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookOutboxEvent.prototype, "eventId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When the fact happened, as the source knows it.' }),
+    tslib_1.__metadata("design:type", Date
+    /**
+     * When we wrote it down. **Kept apart from `eventTime`** — a fact that arrives late is not
+     * a fact that happened late, and folding them together makes a backfill look like a
+     * present-tense event.
+     */
+    )
+], WebhookOutboxEvent.prototype, "eventTime", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When this side recorded the fact. Not the same as when it happened.' }),
+    tslib_1.__metadata("design:type", Date
+    /** The fact itself, in whatever shape this product speaks. The only product-specific column. */
+    )
+], WebhookOutboxEvent.prototype, "recordTime", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-json' }),
+    (0, type_graphql_1.Field)(type => shell_1.ScalarObject, { description: 'The fact being pushed. The only column whose shape belongs to the product.' }),
+    tslib_1.__metadata("design:type", Object)
+], WebhookOutboxEvent.prototype, "payload", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', default: WebhookOutboxStatus.Pending }),
+    (0, type_graphql_1.Field)(type => WebhookOutboxStatus, { description: 'Waiting, delivered, or refused for good.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookOutboxEvent.prototype, "status", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When the peer took it.' }),
+    tslib_1.__metadata("design:type", Date
+    /**
+     * How many times a delivery was **really refused** — not how many times we tried.
+     *
+     * A peer answering 429 or 503 is asking us to wait; that does not count here, or a
+     * receiver under load becomes indistinguishable from a receiver that rejects us.
+     */
+    )
+], WebhookOutboxEvent.prototype, "sentAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'int', default: 0 }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Deliveries that were refused. Being asked to wait (429/503) does not count.' }),
+    tslib_1.__metadata("design:type", Number)
+], WebhookOutboxEvent.prototype, "attempts", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'What the peer said the last time it refused.' }),
+    tslib_1.__metadata("design:type", String)
+], WebhookOutboxEvent.prototype, "lastError", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)(),
+    (0, type_graphql_1.Field)({ nullable: true }),
+    tslib_1.__metadata("design:type", Date)
+], WebhookOutboxEvent.prototype, "createdAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.UpdateDateColumn)(),
+    (0, type_graphql_1.Field)({ nullable: true }),
+    tslib_1.__metadata("design:type", Date)
+], WebhookOutboxEvent.prototype, "updatedAt", void 0);
+exports.WebhookOutboxEvent = WebhookOutboxEvent = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A fact queued for one peer, with its number and what happened when we tried to deliver it.' }),
+    (0, typeorm_1.Entity)()
+    /*
+     * Numbering is per (domain, peer, scope) and must be unique there — the receiving side
+     * detects gaps by comparing consecutive numbers, so two rows sharing a number would make a
+     * gap invisible.
+     */
+    ,
+    (0, typeorm_1.Index)('ix_webhook_outbox_event_0', (event) => [event.domain, event.peer, event.scope, event.seq], {
+        unique: true
+    })
+    /* The pump's own query: what is still waiting for this peer, oldest first. */
+    ,
+    (0, typeorm_1.Index)('ix_webhook_outbox_event_1', (event) => [event.domain, event.peer, event.status, event.seq])
+], WebhookOutboxEvent);
+//# sourceMappingURL=webhook-outbox-event.js.map