@volter/twin-hubspot 0.1.0 → 0.1.1

package/dist/src/webhooks.js

@@ -24,6 +24,7 @@
 // call and `API` otherwise, and `sourceId` is `userId:<id>` or `<appId>`; the v1 signature is sent on every event, which
 // the page does not promise for a developer-platform app's `object.*` event.
 import { createHash, createHmac } from 'node:crypto';
+import { appDestination, appFetch } from '@volter/world-core/app-route';
 import { worldEgressRefusal } from '@volter/world-core/network-policy';
 import { appById, installsIn, keep, stored } from "./accounts.js";
 import { currentPortal } from "./portal.js";
@@ -64,8 +65,9 @@ async function deliver(to, secret, events, hub, root, at) {
     };
     const n = stored('_webhook_delivery', root).length + 1;
     await keep('_webhook_delivery', `delivery:${n}`, { n, to, portalId: hub, body, headers, delivered_at: at }, root, at);
-    if (worldEgressRefusal(to) === null)
-        await fetch(to, { method: 'POST', headers, body }).then((r) => r.text()).catch(() => undefined);
+    // the application's own hostnames reach it inside the World; elsewhere, the World's egress rule decides
+    if (appDestination(to) || worldEgressRefusal(to) === null)
+        await appFetch(to, { method: 'POST', headers, body }).then((r) => r.text()).catch(() => undefined);
 }
 /** GET /_twin/deliveries?to=<url>: what an app's server received from HubSpot, oldest first — each request's headers,
  *  its body as sent, and the events in it. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-hubspot",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Local HubSpot CRM twin — a faithful, stateful local HubSpot v3/v4 CRM API your @hubspot/api-client integration talks to unmodified. Mirror, simulate, and fork. Built on @volter/world-core.",
   "keywords": [
     "twin",
@@ -52,15 +52,15 @@
     "postpack": "node ../../../scripts/publish/prepare-publish.mjs postpack"
   },
   "dependencies": {
-    "@volter/world-ui": "0.1.0",
+    "@volter/world-ui": "0.1.1",
     "react": "^19.2.7",
     "react-dom": "^19.2.7"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.0"
+    "@volter/world-core": "2.0.1"
   },
   "devDependencies": {
-    "@volter/world-core": "2.0.0",
+    "@volter/world-core": "2.0.1",
     "@volter/world-tooling": "0.1.0",
     "@hubspot/api-client": "^14.0.1",
     "@types/bun": "^1.2.20",

package/src/webhooks.ts

@@ -24,6 +24,7 @@
 // call and `API` otherwise, and `sourceId` is `userId:<id>` or `<appId>`; the v1 signature is sent on every event, which
 // the page does not promise for a developer-platform app's `object.*` event.
 import { createHash, createHmac } from 'node:crypto';
+import { appDestination, appFetch } from '@volter/world-core/app-route';
 import { worldEgressRefusal } from '@volter/world-core/network-policy';
 import { appById, installsIn, keep, stored, type Row } from './accounts.ts';
 import { currentPortal } from './portal.ts';
@@ -67,7 +68,8 @@ async function deliver(to: string, secret: string, events: Row[], hub: number, r
   };
   const n = stored('_webhook_delivery', root).length + 1;
   await keep('_webhook_delivery', `delivery:${n}`, { n, to, portalId: hub, body, headers, delivered_at: at }, root, at);
-  if (worldEgressRefusal(to) === null) await fetch(to, { method: 'POST', headers, body }).then((r) => r.text()).catch(() => undefined);
+  // the application's own hostnames reach it inside the World; elsewhere, the World's egress rule decides
+  if (appDestination(to) || worldEgressRefusal(to) === null) await appFetch(to, { method: 'POST', headers, body }).then((r) => r.text()).catch(() => undefined);
 }
 
 /** GET /_twin/deliveries?to=<url>: what an app's server received from HubSpot, oldest first — each request's headers,