@vibesdotdev/tools 0.0.0-stage → 1.0.0-rc.3

package/dist/webhooks/store/memory-store.js

@@ -0,0 +1,238 @@
+import { createDefaultWebhookConfig } from "./webhook-default-config.js";
+import { applyWebhookRequestUpdate } from "../lifecycle.js";
+function nowIso() {
+    return new Date().toISOString();
+}
+export class MemoryWebhookStore {
+    config = createDefaultWebhookConfig();
+    requests = new Map();
+    idempotency = new Map();
+    outbox = new Map();
+    deliveries = new Map();
+    ingressRates = new Map();
+    async loadConfig() {
+        return structuredClone(this.config);
+    }
+    async saveConfig(config) {
+        this.config = structuredClone(config);
+        this.config.updated_at = nowIso();
+    }
+    async storeRequest(req) {
+        const next = { ...req };
+        this.requests.set(next.id, next);
+        if (next.idempotency_key)
+            this.idempotency.set(next.idempotency_key, next.id);
+        return next;
+    }
+    async claimRequest(req) {
+        if (req.idempotency_key) {
+            const existingId = this.idempotency.get(req.idempotency_key);
+            if (existingId) {
+                const existing = this.requests.get(existingId);
+                if (existing)
+                    return { claimed: false, request: structuredClone(existing) };
+            }
+            // Map writes are synchronous: no competing claim can interleave here.
+            this.idempotency.set(req.idempotency_key, req.id);
+        }
+        const request = await this.storeRequest(req);
+        return { claimed: true, request };
+    }
+    async acceptRequest(req, outbox, deliveries) {
+        const claim = await this.claimRequest(req);
+        if (!claim.claimed) {
+            return {
+                claimed: false,
+                request: claim.request,
+                deliveries: await this.listDeliveriesForRequest(claim.request.id)
+            };
+        }
+        for (const entry of outbox)
+            await this.storeOutboxEntry(entry);
+        for (const delivery of deliveries)
+            this.deliveries.set(delivery.id, structuredClone(delivery));
+        return {
+            claimed: true,
+            request: claim.request,
+            deliveries: structuredClone(deliveries)
+        };
+    }
+    async getRequest(id) {
+        return this.requests.get(id) ?? null;
+    }
+    async updateRequest(id, updates) {
+        const existing = this.requests.get(id);
+        if (!existing)
+            return null;
+        const next = applyWebhookRequestUpdate(existing, updates, nowIso());
+        this.requests.set(id, next);
+        return next;
+    }
+    async listRequests(filters = {}) {
+        let rows = [...this.requests.values()];
+        if (filters.source)
+            rows = rows.filter((r) => r.source === filters.source);
+        if (filters.status)
+            rows = rows.filter((r) => r.status === filters.status);
+        rows.sort((a, b) => (a.created_at < b.created_at ? 1 : -1));
+        const offset = filters.offset ?? 0;
+        const limit = filters.limit ?? 100;
+        return rows.slice(offset, offset + limit);
+    }
+    async storeOutboxEntry(entry) {
+        const next = { ...entry };
+        this.outbox.set(next.id, next);
+        return next;
+    }
+    async getOutboxEntry(id) {
+        return this.outbox.get(id) ?? null;
+    }
+    async updateOutboxEntry(id, updates) {
+        const existing = this.outbox.get(id);
+        if (!existing)
+            return null;
+        const next = { ...existing, ...updates };
+        this.outbox.set(id, next);
+        return next;
+    }
+    async listOutboxEntries(filters = {}) {
+        let rows = [...this.outbox.values()];
+        if (filters.source)
+            rows = rows.filter((r) => r.source === filters.source);
+        if (filters.status)
+            rows = rows.filter((r) => r.status === filters.status);
+        const limit = filters.limit ?? 100;
+        return rows.slice(0, limit);
+    }
+    async getPendingOutboxEntries() {
+        return [...this.outbox.values()].filter((e) => e.status === 'pending');
+    }
+    async listDeliveriesForRequest(requestId) {
+        return [...this.deliveries.values()]
+            .filter((delivery) => delivery.webhook_request_id === requestId)
+            .map((delivery) => structuredClone(delivery));
+    }
+    async listDueDeliveries(now, limit) {
+        return [...this.deliveries.values()]
+            .filter((delivery) => ((delivery.status === 'pending' || delivery.status === 'retry_wait') &&
+            delivery.next_attempt_at <= now) ||
+            (delivery.status === 'leased' &&
+                Boolean(delivery.lease_expires_at && delivery.lease_expires_at <= now)))
+            .sort((a, b) => a.next_attempt_at.localeCompare(b.next_attempt_at))
+            .slice(0, limit)
+            .map((delivery) => structuredClone(delivery));
+    }
+    async claimDelivery(input) {
+        const delivery = this.deliveries.get(input.deliveryId);
+        if (!delivery)
+            throw new Error(`Webhook delivery '${input.deliveryId}' does not exist`);
+        const due = ((delivery.status === 'pending' || delivery.status === 'retry_wait') &&
+            delivery.next_attempt_at <= input.now) ||
+            (delivery.status === 'leased' &&
+                Boolean(delivery.lease_expires_at && delivery.lease_expires_at <= input.now));
+        if (!due)
+            return { claimed: false, delivery: structuredClone(delivery) };
+        const claimed = {
+            ...delivery,
+            status: 'leased',
+            attempt_count: delivery.attempt_count + 1,
+            lease_owner: input.workerId,
+            lease_expires_at: input.leaseExpiresAt,
+            updated_at: input.now
+        };
+        this.deliveries.set(claimed.id, claimed);
+        return { claimed: true, delivery: structuredClone(claimed) };
+    }
+    ownedLease(deliveryId, workerId, now) {
+        const delivery = this.deliveries.get(deliveryId);
+        if (!delivery ||
+            delivery.status !== 'leased' ||
+            delivery.lease_owner !== workerId ||
+            !delivery.lease_expires_at ||
+            delivery.lease_expires_at <= now) {
+            return null;
+        }
+        return delivery;
+    }
+    async completeDelivery(input) {
+        const delivery = this.ownedLease(input.deliveryId, input.workerId, input.now);
+        if (!delivery)
+            return null;
+        const completed = {
+            ...delivery,
+            status: 'succeeded',
+            receipt: input.receipt,
+            lease_owner: undefined,
+            lease_expires_at: undefined,
+            last_error: undefined,
+            updated_at: input.now,
+            completed_at: input.now
+        };
+        this.deliveries.set(delivery.id, completed);
+        return structuredClone(completed);
+    }
+    async retryDelivery(input) {
+        const delivery = this.ownedLease(input.deliveryId, input.workerId, input.now);
+        if (!delivery)
+            return null;
+        const retried = {
+            ...delivery,
+            status: 'retry_wait',
+            next_attempt_at: input.nextAttemptAt,
+            lease_owner: undefined,
+            lease_expires_at: undefined,
+            last_error: input.error,
+            updated_at: input.now
+        };
+        this.deliveries.set(delivery.id, retried);
+        return structuredClone(retried);
+    }
+    async deadLetterDelivery(deliveryId, workerId, now, error) {
+        const delivery = this.ownedLease(deliveryId, workerId, now);
+        if (!delivery)
+            return null;
+        const failed = {
+            ...delivery,
+            status: 'dead_lettered',
+            lease_owner: undefined,
+            lease_expires_at: undefined,
+            last_error: error,
+            updated_at: now,
+            completed_at: now
+        };
+        this.deliveries.set(delivery.id, failed);
+        return structuredClone(failed);
+    }
+    async consumeIngressRejection(input) {
+        const key = `${input.source}:${input.reason}:${input.shard}:${input.windowSlot}`;
+        const existing = this.ingressRates.get(key);
+        const count = existing?.windowStart === input.windowStart ? existing.count + 1 : 1;
+        this.ingressRates.set(key, {
+            windowStart: input.windowStart,
+            count,
+            expiresAt: input.expiresAt
+        });
+        return {
+            allowed: count <= input.limit,
+            count,
+            limit: input.limit,
+            retry_after_seconds: input.retryAfterSeconds
+        };
+    }
+    async pruneWebhookData(now, limit) {
+        let removed = 0;
+        for (const [key, row] of this.ingressRates) {
+            if (removed >= limit)
+                break;
+            if (row.expiresAt <= now) {
+                this.ingressRates.delete(key);
+                removed++;
+            }
+        }
+        return { removed };
+    }
+}
+export function createMemoryWebhookStore() {
+    return new MemoryWebhookStore();
+}
+//# sourceMappingURL=memory-store.js.map

package/dist/webhooks/store/memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-store.js","sourceRoot":"","sources":["../../../src/webhooks/store/memory-store.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,SAAS,MAAM;IACd,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,kBAAkB;IACtB,MAAM,GAAkB,0BAA0B,EAAE,CAAC;IAC5C,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7C,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC/C,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,YAAY,GAAG,IAAI,GAAG,EAAqE,CAAC;IAE7G,KAAK,CAAC,UAAU;QACf,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAqB;QACrC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAmB;QACrC,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAmB;QACrC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAC7D,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC/C,IAAI,QAAQ;oBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,CAAC;YACD,sEAAsE;YACtE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,GAAmB,EACnB,MAA4B,EAC5B,UAA6B;QAE7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;aACjE,CAAC;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC/D,KAAK,MAAM,QAAQ,IAAI,UAAU;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/F,OAAO;YACN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;SACvC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,EAAU,EACV,OAAgC;QAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAsC,EAAE;QAC1D,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAyB;QAC/C,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,iBAAiB,CACtB,EAAU,EACV,OAAoC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAqC,EAAE;QAC9D,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,uBAAuB;QAC5B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,SAAiB;QAC/C,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,KAAK,SAAS,CAAC;aAC/D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,KAAa;QACjD,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;aAClC,MAAM,CACN,CAAC,QAAQ,EAAE,EAAE,CACZ,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC;YACnE,QAAQ,CAAC,eAAe,IAAI,GAAG,CAAC;YACjC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC,CACzE;aACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;aAClE,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAgC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,UAAU,kBAAkB,CAAC,CAAC;QACxF,MAAM,GAAG,GACR,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC;YACnE,QAAQ,CAAC,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC;YACvC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAoB;YAChC,GAAG,QAAQ;YACX,MAAM,EAAE,QAAQ;YAChB,aAAa,EAAE,QAAQ,CAAC,aAAa,GAAG,CAAC;YACzC,WAAW,EAAE,KAAK,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,UAAU,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,UAAU,CAAC,UAAkB,EAAE,QAAgB,EAAE,GAAW;QACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,IACC,CAAC,QAAQ;YACT,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAC5B,QAAQ,CAAC,WAAW,KAAK,QAAQ;YACjC,CAAC,QAAQ,CAAC,gBAAgB;YAC1B,QAAQ,CAAC,gBAAgB,IAAI,GAAG,EAC/B,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAmC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,SAAS,GAAoB;YAClC,GAAG,QAAQ;YACX,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,SAAS;YACtB,gBAAgB,EAAE,SAAS;YAC3B,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,KAAK,CAAC,GAAG;YACrB,YAAY,EAAE,KAAK,CAAC,GAAG;SACvB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5C,OAAO,eAAe,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAgC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,OAAO,GAAoB;YAChC,GAAG,QAAQ;YACX,MAAM,EAAE,YAAY;YACpB,eAAe,EAAE,KAAK,CAAC,aAAa;YACpC,WAAW,EAAE,SAAS;YACtB,gBAAgB,EAAE,SAAS;YAC3B,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,UAAU,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACvB,UAAkB,EAClB,QAAgB,EAChB,GAAW,EACX,KAAa;QAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,MAAM,GAAoB;YAC/B,GAAG,QAAQ;YACX,MAAM,EAAE,eAAe;YACvB,WAAW,EAAE,SAAS;YACtB,gBAAgB,EAAE,SAAS;YAC3B,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,GAAG;YACf,YAAY,EAAE,GAAG;SACjB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAA8B;QAC3D,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,QAAQ,EAAE,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO;YACN,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK;YAC7B,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,mBAAmB,EAAE,KAAK,CAAC,iBAAiB;SAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,KAAa;QAChD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,IAAI,OAAO,IAAI,KAAK;gBAAE,MAAM;YAC5B,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACpB,CAAC;CACD;AAED,MAAM,UAAU,wBAAwB;IACvC,OAAO,IAAI,kBAAkB,EAAE,CAAC;AACjC,CAAC"}

package/dist/webhooks/store/types.d.ts

@@ -0,0 +1,99 @@
+/**
+ * WebhookStore interface — abstract persistence for the webhook subsystem.
+ *
+ * The consumer implementation reads and writes JSON files under
+ * `~/.vibes/vibesOS/webhooks/{requests,outbox}/`. It sits behind the
+ * runtime-resolved `tools/webhook-service` capability, so a cloud host can
+ * provide D1/KV-backed orchestration without changing `ToolsClient` callers.
+ */
+import type { ReadonlyJsonObject } from '@vibesdotdev/kernel/schemas/json';
+import type { WebhookConfig, WebhookOutboxEntry, WebhookOutboxStatus, WebhookRequest, WebhookSource, WebhookEventStatus } from '../schemas/webhook-request.ts';
+import type { WebhookDelivery, WebhookDeliveryClaim, WebhookIngressRateDecision, WebhookIngressRejectionReason } from '../schemas/webhook-delivery.ts';
+export interface WebhookStoreRequestFilters {
+    source?: WebhookSource;
+    status?: WebhookEventStatus;
+    limit?: number;
+    offset?: number;
+}
+export interface WebhookStoreOutboxFilters {
+    source?: WebhookSource;
+    status?: WebhookOutboxStatus;
+    limit?: number;
+}
+export interface WebhookRequestClaim {
+    claimed: boolean;
+    request: WebhookRequest;
+}
+export interface WebhookRequestAcceptance {
+    claimed: boolean;
+    request: WebhookRequest;
+    deliveries: WebhookDelivery[];
+}
+export interface WebhookDeliveryLeaseInput {
+    deliveryId: string;
+    workerId: string;
+    now: string;
+    leaseExpiresAt: string;
+}
+export interface WebhookDeliveryRetryInput {
+    deliveryId: string;
+    workerId: string;
+    now: string;
+    nextAttemptAt: string;
+    error: string;
+}
+export interface WebhookDeliveryCompleteInput {
+    deliveryId: string;
+    workerId: string;
+    now: string;
+    receipt?: ReadonlyJsonObject;
+}
+export interface WebhookIngressRateInput {
+    source: string;
+    reason: WebhookIngressRejectionReason;
+    shard: number;
+    windowStart: string;
+    windowSlot: number;
+    expiresAt: string;
+    limit: number;
+    retryAfterSeconds: number;
+}
+export interface WebhookStore {
+    loadConfig(): Promise<WebhookConfig>;
+    saveConfig(config: WebhookConfig): Promise<void>;
+    /**
+     * Atomically persist the first request for an idempotency key.
+     * A duplicate returns the already-claimed request and must not emit hooks.
+     */
+    claimRequest(req: WebhookRequest): Promise<WebhookRequestClaim>;
+    /**
+     * Atomically persist a verified request, its provider outbox intents, and
+     * one delivery row per durable consumer. A duplicate provider key returns
+     * the canonical request and its existing deliveries.
+     */
+    acceptRequest(req: WebhookRequest, outbox: WebhookOutboxEntry[], deliveries: WebhookDelivery[]): Promise<WebhookRequestAcceptance>;
+    storeRequest(req: WebhookRequest): Promise<WebhookRequest>;
+    getRequest(id: string): Promise<WebhookRequest | null>;
+    updateRequest(id: string, updates: Partial<WebhookRequest>): Promise<WebhookRequest | null>;
+    listRequests(filters?: WebhookStoreRequestFilters): Promise<WebhookRequest[]>;
+    storeOutboxEntry(entry: WebhookOutboxEntry): Promise<WebhookOutboxEntry>;
+    getOutboxEntry(id: string): Promise<WebhookOutboxEntry | null>;
+    updateOutboxEntry(id: string, updates: Partial<WebhookOutboxEntry>): Promise<WebhookOutboxEntry | null>;
+    listOutboxEntries(filters?: WebhookStoreOutboxFilters): Promise<WebhookOutboxEntry[]>;
+    getPendingOutboxEntries(): Promise<WebhookOutboxEntry[]>;
+    listDeliveriesForRequest(requestId: string): Promise<WebhookDelivery[]>;
+    listDueDeliveries(now: string, limit: number): Promise<WebhookDelivery[]>;
+    claimDelivery(input: WebhookDeliveryLeaseInput): Promise<WebhookDeliveryClaim>;
+    completeDelivery(input: WebhookDeliveryCompleteInput): Promise<WebhookDelivery | null>;
+    retryDelivery(input: WebhookDeliveryRetryInput): Promise<WebhookDelivery | null>;
+    deadLetterDelivery(deliveryId: string, workerId: string, now: string, error: string): Promise<WebhookDelivery | null>;
+    /**
+     * Fixed-ring anonymous rejection accounting. Implementations must cap the
+     * number of physical rows independently of attacker-controlled source/IP.
+     */
+    consumeIngressRejection(input: WebhookIngressRateInput): Promise<WebhookIngressRateDecision>;
+    pruneWebhookData(now: string, limit: number): Promise<{
+        removed: number;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/webhooks/store/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/webhooks/store/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EACX,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACX,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,6BAA6B,EAC7B,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,0BAA0B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACzC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,yBAAyB;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,4BAA4B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACrC,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;;OAGG;IACH,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChE;;;;OAIG;IACH,aAAa,CACZ,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,kBAAkB,EAAE,EAC5B,UAAU,EAAE,eAAe,EAAE,GAC3B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACrC,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3D,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC5F,YAAY,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAE9E,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACzE,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAC/D,iBAAiB,CAChB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAClC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC,iBAAiB,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtF,uBAAuB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEzD,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxE,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1E,aAAa,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC/E,gBAAgB,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvF,aAAa,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACjF,kBAAkB,CACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEnC;;;OAGG;IACH,uBAAuB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC7F,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3E"}

package/dist/webhooks/store/types.js

@@ -0,0 +1,10 @@
+/**
+ * WebhookStore interface — abstract persistence for the webhook subsystem.
+ *
+ * The consumer implementation reads and writes JSON files under
+ * `~/.vibes/vibesOS/webhooks/{requests,outbox}/`. It sits behind the
+ * runtime-resolved `tools/webhook-service` capability, so a cloud host can
+ * provide D1/KV-backed orchestration without changing `ToolsClient` callers.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/webhooks/store/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/webhooks/store/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/webhooks/store/webhook-default-config.d.ts

@@ -0,0 +1,9 @@
+import type { WebhookConfig } from '../schemas/webhook-request.ts';
+/**
+ * Canonical first-run webhook config shared by consumer and cloud stores.
+ *
+ * Source-specific signing material is referenced by environment binding name;
+ * values never enter this config.
+ */
+export declare function createDefaultWebhookConfig(): WebhookConfig;
+//# sourceMappingURL=webhook-default-config.d.ts.map

package/dist/webhooks/store/webhook-default-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-default-config.d.ts","sourceRoot":"","sources":["../../../src/webhooks/store/webhook-default-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI,aAAa,CA4C1D"}

package/dist/webhooks/store/webhook-default-config.js

@@ -0,0 +1,52 @@
+/**
+ * Canonical first-run webhook config shared by consumer and cloud stores.
+ *
+ * Source-specific signing material is referenced by environment binding name;
+ * values never enter this config.
+ */
+export function createDefaultWebhookConfig() {
+    const now = new Date().toISOString();
+    return {
+        sources: {
+            resend: {
+                source: 'resend',
+                enabled: true,
+                signing_secret_env: 'RESEND_WEBHOOK_SECRET',
+                description: 'Resend email events',
+                allowed_events: ['email.received', 'email.bounced', 'email.delivered', 'email.complained'],
+                created_at: now,
+                updated_at: now
+            },
+            slack: {
+                source: 'slack',
+                enabled: true,
+                signing_secret_env: 'SLACK_SIGNING_SECRET',
+                description: 'Slack events',
+                allowed_events: ['message', 'app_mention', 'reaction_added', 'app_home_opened'],
+                created_at: now,
+                updated_at: now
+            },
+            discord: {
+                source: 'discord',
+                enabled: true,
+                signing_secret_env: 'DISCORD_PUBLIC_KEY',
+                description: 'Discord HTTP interactions',
+                allowed_events: ['PING', 'interactionCreate'],
+                created_at: now,
+                updated_at: now
+            },
+            'cloudflare-email': {
+                source: 'cloudflare-email',
+                enabled: true,
+                signing_secret_env: 'VIBES_EMAIL_INGRESS_TOKEN',
+                description: 'Cloudflare Email Routing → vibes-email worker inbound',
+                allowed_events: ['inboundEmail', 'email.received'],
+                created_at: now,
+                updated_at: now
+            }
+        },
+        created_at: now,
+        updated_at: now
+    };
+}
+//# sourceMappingURL=webhook-default-config.js.map

package/dist/webhooks/store/webhook-default-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-default-config.js","sourceRoot":"","sources":["../../../src/webhooks/store/webhook-default-config.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO;QACN,OAAO,EAAE;YACR,MAAM,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,IAAI;gBACb,kBAAkB,EAAE,uBAAuB;gBAC3C,WAAW,EAAE,qBAAqB;gBAClC,cAAc,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;gBAC1F,UAAU,EAAE,GAAG;gBACf,UAAU,EAAE,GAAG;aACf;YACD,KAAK,EAAE;gBACN,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,IAAI;gBACb,kBAAkB,EAAE,sBAAsB;gBAC1C,WAAW,EAAE,cAAc;gBAC3B,cAAc,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;gBAC/E,UAAU,EAAE,GAAG;gBACf,UAAU,EAAE,GAAG;aACf;YACD,OAAO,EAAE;gBACR,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,IAAI;gBACb,kBAAkB,EAAE,oBAAoB;gBACxC,WAAW,EAAE,2BAA2B;gBACxC,cAAc,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC;gBAC7C,UAAU,EAAE,GAAG;gBACf,UAAU,EAAE,GAAG;aACf;YACD,kBAAkB,EAAE;gBACnB,MAAM,EAAE,kBAAkB;gBAC1B,OAAO,EAAE,IAAI;gBACb,kBAAkB,EAAE,2BAA2B;gBAC/C,WAAW,EAAE,uDAAuD;gBACpE,cAAc,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC;gBAClD,UAAU,EAAE,GAAG;gBACf,UAAU,EAAE,GAAG;aACf;SACD;QACD,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KACf,CAAC;AACH,CAAC"}

package/dist/webhooks/verifiers/shared-secret.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Generic shared-secret signature verifier.
+ *
+ * Compares the request's `x-webhook-signature` header against the first
+ * 16 hex chars of `sha256(secret)`. Constant-time comparison without a
+ * length early-exit (length must not be a timing oracle).
+ *
+ * ONE verifier, built on Web Crypto (`crypto.subtle`), which every runtime we
+ * ship to provides — workerd, Bun, and Node 18+. It is therefore universal and
+ * needs no `node:crypto` import, so this module stays clean in cloud bundles
+ * without a scope split.
+ *
+ * There is deliberately no synchronous variant. A sync verifier cannot reach
+ * SHA-256 on workerd, and the previous attempt probed `globalThis.require` —
+ * which is `undefined` under ESM, so it silently returned `false` for every
+ * VALID signature on Bun and Node. A security check that fails closed when it
+ * cannot run is indistinguishable from "bad signature", which hides the real
+ * fault. `SignatureVerifierImplementation.verify` is async, so nothing needed
+ * the sync form.
+ */
+export declare function verifySharedSecretAsync(signature: string, secret: string): Promise<boolean>;
+//# sourceMappingURL=shared-secret.d.ts.map

package/dist/webhooks/verifiers/shared-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret.d.ts","sourceRoot":"","sources":["../../../src/webhooks/verifiers/shared-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA6BH,wBAAsB,uBAAuB,CAC5C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/webhooks/verifiers/shared-secret.js

@@ -0,0 +1,56 @@
+/**
+ * Generic shared-secret signature verifier.
+ *
+ * Compares the request's `x-webhook-signature` header against the first
+ * 16 hex chars of `sha256(secret)`. Constant-time comparison without a
+ * length early-exit (length must not be a timing oracle).
+ *
+ * ONE verifier, built on Web Crypto (`crypto.subtle`), which every runtime we
+ * ship to provides — workerd, Bun, and Node 18+. It is therefore universal and
+ * needs no `node:crypto` import, so this module stays clean in cloud bundles
+ * without a scope split.
+ *
+ * There is deliberately no synchronous variant. A sync verifier cannot reach
+ * SHA-256 on workerd, and the previous attempt probed `globalThis.require` —
+ * which is `undefined` under ESM, so it silently returned `false` for every
+ * VALID signature on Bun and Node. A security check that fails closed when it
+ * cannot run is indistinguishable from "bad signature", which hides the real
+ * fault. `SignatureVerifierImplementation.verify` is async, so nothing needed
+ * the sync form.
+ */
+function bytesToHex(bytes) {
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++) {
+        hex += bytes[i].toString(16).padStart(2, '0');
+    }
+    return hex;
+}
+function timingSafeEqualString(a, b) {
+    const enc = new TextEncoder();
+    const ab = enc.encode(a);
+    const bb = enc.encode(b);
+    let mismatch = ab.length === bb.length ? 0 : 1;
+    const len = Math.max(ab.length, bb.length);
+    for (let i = 0; i < len; i++) {
+        const av = i < ab.length ? ab[i] : 0;
+        const bv = i < bb.length ? bb[i] : 0;
+        mismatch |= av ^ bv;
+    }
+    return mismatch === 0 && ab.length === bb.length;
+}
+async function sha256HexPrefix16(secret) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(secret));
+    return bytesToHex(new Uint8Array(digest)).slice(0, 16);
+}
+export async function verifySharedSecretAsync(signature, secret) {
+    if (!secret || !signature)
+        return false;
+    if (!globalThis.crypto?.subtle) {
+        // Surface the environment fault loudly. Returning false here would be
+        // reported to the caller as an invalid signature and hide the cause.
+        throw new Error('verifySharedSecretAsync requires Web Crypto (crypto.subtle), which this runtime does not provide.');
+    }
+    const expected = await sha256HexPrefix16(secret);
+    return timingSafeEqualString(signature, expected);
+}
+//# sourceMappingURL=shared-secret.js.map

package/dist/webhooks/verifiers/shared-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-secret.js","sourceRoot":"","sources":["../../../src/webhooks/verifiers/shared-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,SAAS,UAAU,CAAC,KAAiB;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,QAAQ,GAAG,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,QAAQ,IAAI,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,SAAiB,EACjB,MAAc;IAEd,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAChC,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,IAAI,KAAK,CACd,mGAAmG,CACnG,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC"}

package/dist/webhooks/webhook-service.fs.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { WebhookServiceDescriptor } from './schemas/webhook-service.ts';
+declare const descriptor: WebhookServiceDescriptor;
+export default descriptor;
+//# sourceMappingURL=webhook-service.fs.descriptor.d.ts.map

package/dist/webhooks/webhook-service.fs.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-service.fs.descriptor.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-service.fs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAE7E,QAAA,MAAM,UAAU,EAAE,wBAQjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/webhooks/webhook-service.fs.descriptor.js

@@ -0,0 +1,11 @@
+const descriptor = {
+    id: 'webhook-service.fs',
+    kind: 'tools/webhook-service',
+    name: 'Filesystem webhook service',
+    description: 'Consumer-host webhook ingress and persistence under the Vibes home directory',
+    hardware: ['consumer'],
+    tags: ['webhooks', 'filesystem', 'consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=webhook-service.fs.descriptor.js.map

package/dist/webhooks/webhook-service.fs.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-service.fs.descriptor.js","sourceRoot":"","sources":["../../src/webhooks/webhook-service.fs.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAA6B;IAC5C,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,uBAAuB;IAC7B,IAAI,EAAE,4BAA4B;IAClC,WAAW,EAAE,8EAA8E;IAC3F,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC;IAC5C,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/webhooks/webhook-service.fs.impl.consumer.d.ts

@@ -0,0 +1,34 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+import type { WebhookService, WebhookServiceDescriptor, WebhookProcessOptions } from './schemas/webhook-service.ts';
+import type { WebhookProcessResult } from './schemas/webhook-process-result.ts';
+import type { WebhookPreparation } from './schemas/webhook-preparation.ts';
+import type { WebhookConfig, WebhookOutboxEntry, WebhookRequest, WebhookSource } from './schemas/webhook-request.ts';
+import type { WebhookStoreOutboxFilters, WebhookStoreRequestFilters } from './store/types.ts';
+/** Consumer implementation. Cloud hosts intentionally supply another descriptor. */
+export default class FsWebhookService implements WebhookService {
+    readonly descriptor: WebhookServiceDescriptor;
+    private readonly runtime;
+    private store;
+    constructor(descriptor: WebhookServiceDescriptor, context: KindContext<VibesRuntime>);
+    private getStore;
+    prepare(source: WebhookSource, rawBody: string, headers: Record<string, string>, options?: WebhookProcessOptions): Promise<WebhookPreparation>;
+    commit(preparation: WebhookPreparation, options?: WebhookProcessOptions): Promise<WebhookProcessResult>;
+    accept(preparation: WebhookPreparation, options?: WebhookProcessOptions): Promise<import("./index.ts").WebhookAcceptResult>;
+    dispatch(requestId: string, options?: WebhookProcessOptions): Promise<import("./index.ts").WebhookDispatchResult>;
+    reconcile(options?: WebhookProcessOptions & {
+        limit?: number;
+    }): Promise<import("./index.ts").WebhookReconcileResult>;
+    recordIngressRejection(input: Parameters<WebhookService['recordIngressRejection']>[0]): Promise<import("./index.ts").WebhookIngressRateDecision>;
+    process(source: WebhookSource, rawBody: string, headers: Record<string, string>, options?: WebhookProcessOptions): Promise<WebhookProcessResult>;
+    loadConfig(): Promise<WebhookConfig>;
+    saveConfig(config: WebhookConfig): Promise<void>;
+    listRequests(filters?: WebhookStoreRequestFilters): Promise<WebhookRequest[]>;
+    getRequest(id: string): Promise<WebhookRequest | null>;
+    updateRequest(id: string, updates: Partial<WebhookRequest>): Promise<WebhookRequest | null>;
+    listOutbox(filters?: WebhookStoreOutboxFilters): Promise<WebhookOutboxEntry[]>;
+    getOutboxEntry(id: string): Promise<WebhookOutboxEntry | null>;
+    updateOutboxEntry(id: string, updates: Partial<WebhookOutboxEntry>): Promise<WebhookOutboxEntry | null>;
+    getPendingOutbox(): Promise<WebhookOutboxEntry[]>;
+}
+//# sourceMappingURL=webhook-service.fs.impl.consumer.d.ts.map

package/dist/webhooks/webhook-service.fs.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-service.fs.impl.consumer.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhook-service.fs.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EACX,cAAc,EACd,wBAAwB,EACxB,qBAAqB,EACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EACX,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,MAAM,8BAA8B,CAAC;AAUtC,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9F,oFAAoF;AACpF,MAAM,CAAC,OAAO,OAAO,gBAAiB,YAAW,cAAc;IAK7D,QAAQ,CAAC,UAAU,EAAE,wBAAwB;IAJ9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,KAAK,CAAoC;gBAGvC,UAAU,EAAE,wBAAwB,EAC7C,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC;IAKnC,OAAO,CAAC,QAAQ;IAIV,OAAO,CACZ,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAOxB,MAAM,CACX,WAAW,EAAE,kBAAkB,EAC/B,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,oBAAoB,CAAC;IAQ1B,MAAM,CACX,WAAW,EAAE,kBAAkB,EAC/B,OAAO,GAAE,qBAA0B;IAS9B,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B;IAQ/D,SAAS,CAAC,OAAO,GAAE,qBAAqB,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO;IASlE,sBAAsB,CAC3B,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC;IAQzD,OAAO,CACZ,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,oBAAoB,CAAC;IAQ1B,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAIpC,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,YAAY,CAAC,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAI7E,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAItD,aAAa,CAClB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAC9B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAI3B,UAAU,CAAC,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAI9E,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAI9D,iBAAiB,CACtB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAClC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAI/B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;CAGvD"}