@voltro/plugin-webhooks 0.22.1 → 0.23.0

package/CHANGELOG.md

@@ -39,6 +39,322 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.23.0] — 2026-08-02
+
+### ⚠ BREAKING
+
+- **@voltro/plugin-versioning, @voltro/database, @voltro/cli** — **`versioningPlugin({ tables: string[] })` is gone. Row history is ON by default for every table your app declares, and the two escape hatches take table VALUES.**
+
+  ```ts
+  versioningPlugin({})                              // every app table
+  versioningPlugin({ exclude: [domainEvents] })     // opt one out — by value
+  versioningPlugin({ include: [aiFlowsTable] })     // add a PLUGIN's table
+  ```
+
+  The old shape had two failure modes and both were silent:
+
+  - you listed six tables, forgot the seventh, and nothing ever told you its history was missing; - nothing cross-checked the strings, so `'invoces'` recorded nothing — forever — while the plugin reported itself active at boot.
+
+  Opt-out fixes the first (forgetting is now the safe direction) and values fix the second (`tsc` catches a misspelling at the call site, exactly as it does for `reference(() => table)`).
+
+  **Framework- and plugin-owned tables are OUT of the default**, and that is not tidiness. There are 34 of them, and the busiest — `_voltro_cdc_log`, `_voltro_events`, `_voltro_undo_log`, `_voltro_workflow_events`, `_voltro_webhook_rate_windows` — are append-only logs. A full row snapshot per write there is the history of a history, at the highest write rate in the system. `include` is the supported way to version one anyway, and it works whether or not your app declares the table — which answers "can I version a plugin's table I do not own": yes.
+
+  **The set resolves LAZILY, on first use.** `versioningPlugin()` is called in `app.config.ts`, before a single table has registered; resolving at construction would produce an empty set and record nothing, silently, which is the defect this change removes. Both boot paths register the app's tables during discovery and activate plugins afterwards.
+
+  A table named in BOTH `include` and `exclude` throws at construction rather than picking one — only the author knows which was the mistake.
+
+  The boot log prints the **resolved** count (`versioning active · tables: N`), not the configured one: with an opt-out default, "how many did I configure" is not a number anybody has, and "how many am I recording" is the one worth seeing.
+
+  **Check your storage budget once after upgrading.** If you previously versioned three tables out of forty, you now version forty. The retention sweep (`VOLTRO_ROW_HISTORY_TTL_HOURS`) still bounds age.
+
+  `isFrameworkOwnedLiveTable` is now exported from `@voltro/database` — one copy of that rule, since a second copy of it is how a per-dialect difference in what `voltro dev` does got shipped once already.
+
+### Added
+
+- **@voltro/cli, @voltro/plugin-ai-flows, @voltro/plugin-notifications, @voltro/plugin-presence, @voltro/plugin-versioning, @voltro/plugin-webhooks** — **The direction into a plugin's table — first half.** There were two doors OUT of a plugin's schema (`tables: false` on rbac, `alias` on ai-flows) and none in, so an app with grown data either ran a second source of truth beside the framework or did not use the plugin. A consumer named the cost: five plugins unused, not one of them because the plugin was worse than what they had.
+
+  `planAdopt` decides whether a move is safe and in what order it must run — the half that costs hours when you get it wrong, and the half that needs no database. It refuses three things rather than guessing:
+
+  - **a NOT NULL target column nobody maps to.** The alternative is a silent zero that reads as real data forever after. - **a target table that already holds rows.** Adopt MOVES rows into a table; it does not merge into one somebody else already wrote. - **a typo on either side of the map.**
+
+  And it states, before anything runs, the thing that is expensive to discover late: differing typeid prefixes (`afl_` → `aifl_`) mean every row gets a new id, so every reference elsewhere must be rewritten from a translation table — **including ids embedded in JSON columns**, which is where the reporter's own hand-written migration had its hardest step.
+
+  A source column nobody carries across is reported but not fatal: it is deliberate often enough, and "I forgot this column" and "I decided" look identical in a map file.
+
+  The field mapping itself stays the app's — units, merged fields, a status vocabulary that does not line up are domain knowledge, and a tool inventing them silently corrupts data.
+
+  **The move itself ships with it**, behind `voltro db adopt --from … --into … --map … [--apply]`. **Dry run by default** — `--apply` is the only way anything is written, because the interesting failure is irreversible and the interesting output is the refusal. A refused plan prints no steps at all, rather than a preview of something that will not happen.
+
+  The ordering is the product, not the SQL, and every step is there because skipping it loses data you find out about later:
+
+  1. **snapshot** the source into `<table>__adopt_snapshot` — a real table in the same database, so the restore path is a statement rather than an operational procedure at 2am. It keeps the columns the adopt deliberately left behind. 2. **copy**, with the mapping's raw expressions. 3. **verify by count** — this catches the one failure that is otherwise invisible: a `WHERE` inside a raw expression silently dropping rows. 4. **drop the source, last**, and only if the counts match.
+
+  Two things it refuses to do, both because the alternative is a silent partial state: it never drops the source on a count mismatch (both tables stay, and it says so), and it never removes the snapshot after a failed verify — the snapshot exists for exactly the run that goes wrong. `--keep-source` copies and verifies without dropping at all.
+
+  Verified against live postgres (`sql-postgres/__tests__/adoptExecute.integration.test.ts`): the rows move, a unit conversion and a two-field merge come out right, the snapshot holds the originals including the dropped column, a failed adopt leaves the source standing, and a refused plan runs nothing.
+
+  **Reference rewriting after an id re-mint is deliberately NOT automatic.** The ids live in the app's own columns and inside its JSON, and only the app knows where. The translation table is what we owe it; the rewrite is what it owes itself. Doing that automatically is the one place in this command where being wrong would be silent.
+
+  Also in this drop, from the same report: every table-carrying plugin exports its table handles, so `reference(() => pluginTable, { onDelete: 'cascade' })` works across the boundary with database-enforced integrity — verified by a planner test against the real `_voltro_ai_flows`, including that the plugin table is created before the app table that points at it.
+- **@voltro/cli** — **`voltro doctor` reports where a plugin's surface meets one the app already has.** An app that did not start on a green field already has a table for half the plugins it installs, and whether it uses them is decided at that seam — which the framework knew both sides of at boot and said nothing about.
+
+  A consumer measured it across eleven table-carrying plugins: eight model a concept they already had a table for, and every overlap was found when it hurt — `rbac` at the role model, `notifications` on switch-on, `ai-flows` at a blocked boot. Half an hour to several hours of diagnosis, three times.
+
+  Three findings, all exact:
+
+  - **a plugin table whose `.renamedFrom()` names a table you declare** — saying explicitly that the plugin's empty table is the INTENDED outcome and not a failed migration, which is the sentence that was missing; - **an exact rpc tag collision** — already fatal at codegen, named here because the codegen error does not mention that `alias` is the way out; - **a shared rpc namespace** — advisory. It is what makes a plugin unusable without anyone noticing: your `notifications.list` and its `notifications.inbox` coexist while one namespace means two things.
+
+  Deliberately exact, with no name-similarity guessing: a fuzzy matcher over 27 plugin tables produces the noise that gets a check switched off, which is how the authz scan became ignorable on that same repo. The advice names `tables: false` / `alias` only for plugins that actually accept them.
+
+  Also confirmed while answering the same report, and pinned by test: `versioningPlugin({ tables: [...] })` already works on a plugin-owned table the app never declares — it watches by NAME and contributes only its own history table. Nothing validates those names, so a typo silently records nothing; that is the cost of the decoupling and it is now stated.
+- **@voltro/data-transfer** — **A bundle can be imported into a schema that has moved on.** `classifyImportDrift` compares what a bundle carries against what the target declares and classifies each difference the way `db plan` classifies schema operations, instead of the one all-or-nothing fingerprint comparison that came before.
+
+  | difference | verdict | |---|---| | a column the SCHEMA dropped | values discarded — said out loud, and the loader skips it | | a NULLABLE / DEFAULTED column the schema added | filled, not refused | | a column whose TYPE changed | **refused** | | a NOT NULL column with no default the bundle cannot fill | **refused** | | a table the target does not have | **refused** — nowhere to put the rows | | a table only the target has | not drift (a `--tables` scope, or added since) |
+
+  Before this, a bundle exported before a column was added could not be imported at all, even though the difference was additive and harmless. The only escape was `--force`, which this package's own doc comment describes as failing "mid-load with raw DB errors after rows may have landed" — an escape hatch that trades a clean refusal for a dirty one.
+
+  The line it draws is the one a transport primitive has to draw: a row that lands INCOMPLETE is recoverable and is reported; a row that lands WRONG is not, so a changed column type refuses. That is the same distinction the reporter praised in the planner — additive is safe, the destructive one is blocked with the remedy in the message.
+
+  **It does not replay authored data migrations, and should not.** A bundle carries no migration ledger, so ordered data steps stay on the physical path (`data restore` → `db apply`), where the restored database brings its own `_voltro_migration_plans` and the diff moves forward from there — which is exactly what the report concluded and demonstrated row by row.
+- **@voltro/web, @voltro/cli** — **`LoaderContext.search`** — the raw query string (leading `?` included, `''` when absent), filled identically on client navigation, `voltro dev` SSR and `voltro start` SSR.
+
+  `pathname` is query-free by contract, and for DATA that is right — a loader keyed on `?tab=2` caches badly. It is wrong for CONTROL FLOW, which is what a loader does since 0.22.0 made it throw `RedirectError` correctly: a redirect target routinely depends on a query parameter, so **the only place a redirect belongs was the only place with no access to one**.
+
+  ```ts
+  const mode = new URLSearchParams(ctx.search).get('mode')
+  throw new RedirectError(`/?error=${code}${mode ? `&mode=${mode}` : ''}`)
+  ```
+
+  The reported case: a player page redirects an unknown wristband code back to the entry page and must preserve `?mode=kiosk`, or a kiosk terminal drops to normal mode after every failed scan. Both workarounds are bad — moving the redirect into a component gives up the 303 (back to what 0.22.0 just fixed), and `window.location.search` exists only on the client-navigation path, so a fresh SSR request loses it.
+
+  **The testability half is why it is a FIELD and not advice.** Because `pathname` is a free-form string in the spec, their loader test passed `'/evo5/abc?mode=kiosk'` — a shape the runtime never produces — and was green for as long as production dropped the parameter on every request. In their words: *wo der Harness etwas liefern kann, das die Laufzeit nicht hat, wird ein kaputter Pfad grün.* A separate field makes that mistake impossible rather than unlikely.
+
+  Both SSR paths derive it through one shared `splitPathAndSearch`, with a test that fails if either grows its own copy back — a two-line `url.split('?')` is exactly what two independent boot paths write for themselves and then disagree about. A prerendered (SSG) page has no request, so its `search` is `''`.
+- **@voltro/plugin-notifications, @voltro/plugin-presence, @voltro/plugin-flags, @voltro/plugin-versioning, @voltro/plugin-webhooks, @voltro/cli** — **Every table-carrying plugin now exports its table handles, so an app can point a column at a plugin row.**
+
+  ```ts
+  import { aiFlowsTable } from '@voltro/plugin-ai-flows'
+  
+  export const flowFavourites = table('flow_favourites', {
+    id:     id({ prefix: 'fav' }),
+    flowId: reference(() => aiFlowsTable, { onDelete: 'cascade' }),
+  })
+  ```
+
+  A consumer measured **711** app→app references against **2** app→plugin ones and diagnosed it exactly: *"Das liegt nicht daran, dass man selten auf Plugin-Zeilen zeigen will. Es liegt daran, dass es dafür kein Muster gibt — und man deshalb aufhört, es zu wollen."*
+
+  **The pattern existed and was unreachable.** `plugin-storage`'s `assetRef()` is, by default, a real foreign key to `_voltro_storage_refs` with `onDelete: 'setNull'` — database-enforced integrity across the plugin boundary, shipping since it was written. It was simply impossible for every plugin that kept its `table(...)` handles module-local: `notifications` declared six as private `const`, `presence` one, and `flags` / `versioning` / `webhooks` exported theirs from a module but not from the package entrypoint.
+
+  So this needed no new primitive and no new machinery — it needed the `export` keyword in seven places. `pluginTableExports.test.ts` fails on the eighth: a plugin whose tables nobody can name is a plugin nobody can point at, and that is invisible, because everything still compiles while the app quietly writes a plain `text()` column plus a hand-rolled cleanup subscriber.
+
+  **Two corrections that came out of building it**, because designing on the stated model would have produced the wrong thing:
+
+  - **`orphanPolicy` has no runtime semantics.** Its own doc comment says so — it is planner metadata deciding how existing orphans are cleaned up *before* the FK constraint is added. Runtime referential integrity comes from the FOREIGN KEY (`onDelete`), executed by the database. A proposal to have "the framework execute the orphan policy over the post-commit channel" described machinery that does not exist and did not need to. - **A foreign key across the plugin boundary survives the plugin renaming its table.** Referencing the table as a VALUE is what makes that true; the 0.22.0 `_voltro_` namespace move was catalog-only and the constraint travelled with it. A `text()` column holding ids would have told you nothing.
+
+  `fk: false`-style decoupling remains available — declare a plain `text()` column — but it should be a deliberate choice, not the default that an unreachable handle forces.
+- **@voltro/runtime, @voltro/cli** — **`serveApi` / `startRpcServer` take a `host`.** Absent → the wildcard, which is what a container needs and stays the default. It exists because of what a wildcard bind does to a server that its OWN process then connects to.
+
+  **The bug it closes had been read as "flaky tests" for eight occurrences.** A test boots a server with `{ port: 0 }`, fetches it, and the fetch never returns — the test dies at its timeout on an operation that takes 20ms. It moved between files and packages every time, which is what made it look like machine contention.
+
+  It is not. A wildcard bind lands on `:::<port>` — IPv6. The client fetches `127.0.0.1:<port>` — IPv4. Those are two independent binds of the same number, so a lingering IPv4 socket on that port takes the connection instead: the kernel completes the handshake into ITS backlog, `lsof` reports `ESTABLISHED`, and the server under test never receives a `connection` event. The request then waits against a peer that will never answer.
+
+  **Every symptom follows from that**, including the ones that made "the machine is busy" look right: it needs earlier files in the same process (they leave the IPv4 sockets), it is intermittent (an ephemeral-port collision), and a diagnostic report taken mid-hang shows an idle event loop with an empty JavaScript stack — because there is genuinely nothing to run. It reproduces at rest, roughly one run in nine, with no docker stack and a load average of 3, and it has failed on a dedicated CI runner.
+
+  Found by instrumenting `net.Server.prototype.listen` and catching a hung run: `listener#3 bound :::53011 … closed after 0 connection(s)` while its client sat in `fetch`. That instrument ships behind `VOLTRO_TEST_DIAG=1` (`packages/cli/src/integrationDiagnostics.ts`) together with the harness-level fix — a port-0 bind with no host goes to the loopback, so server and client share an address family and a collision becomes an ordinary `EADDRINUSE` at bind time instead of a silent hang.
+
+  Measured after: **0 failures in 25 consecutive runs** of the suite that previously failed about one run in nine.
+
+  Production is untouched: the wildcard is still the default, and nothing here runs outside a test process.
+
+### Fixed
+
+- **@voltro/database, @voltro/sql-postgres** — **`cdcChannel` was an option that did nothing.** Setting it produced zero change events and zero errors.
+
+  The store read it and issued `LISTEN <channel>`. The DDL never received it: `emitSchemaSql` hardcoded `pg_notify('framework_changes', …)` inside the trigger function. So a store configured with its own channel listened somewhere nobody ever sent, and — because a NOTIFY with no listener is not an error — nothing said so. Measured before the fix:
+
+  ```
+  cdcChannel=(default)      → events received: 1
+  cdcChannel=my_own_channel → events received: 0
+  ```
+
+  It could not have worked even with the channel threaded through, because the trigger function had ONE database-global name. `CREATE OR REPLACE FUNCTION framework_notify_change()` is a single `pg_proc` row, so two schemas applied with different channels overwrote each other and the last one won — everything applied earlier then emitted on somebody else's channel, silently. The function and the per-table trigger are both named after the channel now, so channels coexist. The default keeps its old names, so nothing existing is renamed.
+
+  `applySchema` / `emitSchemaSql` / `emitFrameworkBootstrapSql` take the channel as an optional third argument defaulting to `DEFAULT_CDC_CHANNEL` (now exported, so the store and the DDL cannot drift apart again). Pass the SAME value to the store and to `applySchema`: they are two halves of one contract, and giving only one still yields silence.
+
+  **Why it surfaced now.** `cdcAttribution.integration.test.ts` failed twice in CI with `delivered 0×` and never once locally. Forty test files write to that one postgres in a gate run, and on the shared default channel every NOTIFY they emit lands in this suite's consumer — its assertions depended on traffic it does not control. It now uses a per-run channel and is hermetic by construction rather than by luck. Verified: 4/4 in the suite, 101/101 in `sql-postgres`, 1335/1335 in `database`.
+
+  Stated plainly because the earlier attempt at this failure was not: raising that suite's delivery wait from 10s to 20s was tried first and changed nothing, which is what a patience bound does when the problem is not patience.
+- **@voltro/cli, @voltro/data-transfer** — **`voltro db apply` never ran file-based migrations, and the deployment topology we recommend has no other path that does.** A data step authored in `migrations/` would never execute in staging or production — silently, because the planner still converged the schema, so the Job went green and the deploy succeeded.
+
+  A consumer mapped it exactly while working out how a months-old dump lands on today's schema:
+
+  | command | ran `migrations/*.ts`? | |---|---| | `voltro dev` (boot) | yes, before the diff | | `voltro db files` | yes | | `voltro db apply` / `--plan` | **no** | | `voltro serve` | no (fingerprint check only) |
+
+  Their pipeline is the documented one — a pre-upgrade Job running `db plan --json` → `db apply --plan`, pods on `voltro serve`. Nothing in it ran a file migration. And file migrations are the escape hatch for precisely what a state diff cannot infer (table splits, cross-table data moves, USING-expression type changes), which makes them exactly the steps whose absence a schema diff cannot detect: the shape is right either way.
+
+  **Two different answers, because the two paths are not the same problem.**
+
+  - **`db apply`** diffs live, so it now runs pending file migrations FIRST and then diffs — the same order boot uses, with nothing to invalidate. If one fails, the diff does not run: a half-migrated database with the schema already reshaped underneath it is harder to reason about than one that stopped where it broke. - **`db apply --plan`** applies a plan computed and REVIEWED against an earlier state, so it **refuses** when any are pending, before touching anything. Running them first would reshape the schema and trip the fingerprint guard immediately after — a half-applied deploy plus a drift message the operator did not cause. Running them after would apply a plan reviewed against a state that no longer exists. The refusal names the three commands that recover it, because a message that stops a deploy without restarting it is half a message.
+
+  ### Also from the same report
+
+  **`data backup` says what it did not do.** It runs the native dump and nothing else, while this module's own header claimed it reused "the shared content-addressed asset pipeline for blobs" — true of the logical `data export --assets`, never of a native backup. The consumer had retired the system this data came from, which made that artifact their entire rollback story, and they found out by listing the output directory. The command now prints `assets: 'NOT included — use \`voltro data export --assets\`'`, and the header and CLI summary no longer claim otherwise.
+
+  **`data backup` prefers `mariadb-dump` on MariaDB.** The `mysql | mariadb` branch spawned a fixed `mysqldump` and took whichever was on PATH. Oracle's MySQL 8 client queries `information_schema.COLUMN_STATISTICS`, which MariaDB does not have, so the dump died after the first table — leaving a partial `db.sql` that looks like a file. MariaDB has shipped `mariadb-dump` / `mariadb` since 10.5 for exactly this split, and on a MariaDB install `mysqldump` is a symlink to it anyway, so preferring the real name costs nothing and removes the guess. NOT fixed with `--column-statistics=0`: that flag does not exist on `mariadb-dump`, so it would break the correct client to accommodate the wrong one.
+
+  **`NativeToolError` shows the child's stderr.** It was being CAPTURED and then never rendered — `Data.TaggedError` with no `message` prints the Effect default, so the failure above surfaced as `NativeToolError: An error has occurred` and diagnosing it meant reconstructing the argv by hand out of our source.
+
+  **`db plan` / `db apply` name the rows a default will fill.** "47,000 existing rows in `todos` will get the default for `slug`" is a sentence a reviewer acts on; a plan line that reads the same whether the table is empty or not is one they scroll past. The PLANNER cannot say this — it is pure by design and does no row counts, which is the property that lets a plan be computed in CI, reviewed and saved — so the count is taken at the command layer, which holds both the classification and the connection. Asked for as the one thing a state diff structurally cannot catch: it gets the shape right and is silently wrong about values.
+- **@voltro/cli** — **`voltro doctor`'s authz scan could not see an app's guards, and said so without anyone being able to act on it.** An app exporting 17 guards was told `guard vocabulary: framework names only — no exported require*/assert* found in this app`, and the scan reported **447** findings of which **5** were real.
+
+  The inference was handed the DISCOVERY file set — dev.ts's `walk()`, which returns only convention-named files (`*.query.ts`, `*.mutation.ts`, `schema.ts`, …). Guards do not live in those. They live in `lib/access.ts`, which that walk never yields, so the vocabulary read every file EXCEPT the ones that could have taught it anything. It reads the whole source tree now.
+
+  The report came with a measurement rather than an argument, which is why the cause was findable in one hop: they moved two throwaway exports into a file the discovery set does cover, re-ran, and took it back.
+
+  | | before | after two names | |---|---|---| | ✗ no access check | 447 | 246 | | ✓ vocabulary | 91 | 294 |
+
+  Two names out of seventeen removed 201 false findings. And the 91 originally recognised were **coincidence**: one of their guards is called `requireScope`, which collides with a framework name, so it was in the set without the inference ever having run. "Partially working" was zero inference plus one collision.
+
+  **Why no test caught it.** Every unit test of `inferGuardVocabulary` passed throughout, because the function was never wrong — the caller handed it the wrong files. The vocabulary is computed by an exported `root`-taking function now, tested against real trees, because the defect lives in *which files reach the function* and no test that hands it strings can see that.
+
+  They declined to write the allowlist ratchet, and were right to: *"442 false lines in a file that says DEBT lead the next reader further astray than no file at all."* The ratchet is worth using now that the vocabulary is.
+- **@voltro/database** — **`voltro dev` sent plpgsql to MariaDB and could not boot.** With auto-migrate on, an app whose plugins declare a reactive `_voltro_*` table (plugin-versioning, among others) failed at startup with `Unknown data type: 'trigger'` — the framework bootstrap emitting `CREATE OR REPLACE FUNCTION … RETURNS trigger AS $$` to a driver that has no such thing. Reported against 0.22.1 and measured on the SHIPPED build rather than inferred from source, on all five dialects.
+
+  Two emitters write schema DDL — `emitSchemaSql` for user tables and `emitFrameworkBootstrapSql` for `_voltro_*` — and each carried a hand-written copy of the reactive-trigger block. Only one had the postgres gate. The trigger function is plpgsql and `pg_notify` has no equivalent elsewhere (the other dialects get cross-instance capture from a binlog/CDC reader), so the gate is a gate and not a missing implementation.
+
+  It is one function now, and the tests assert the OUTCOME rather than the presence of a gate: the two emitters must agree, per dialect, about whether a reactive table produces plpgsql.
+
+  **Why the existing dialect tests did not catch it.** They already passed a reactive table through the emitter — `table()` sets `isReactive: true`, so every case in that file did. Their "every dialect gets the same shape of DDL" test compared `CREATE TABLE` / `ADD COLUMN` / `CREATE INDEX` and simply did not list the trigger block, so the one statement kind that legitimately differs per dialect was the one kind nothing looked at. It is asserted explicitly now, per dialect, including the exception.
+
+  The block is byte-identical in 0.21.0, so this is not a regression — it was reachable only with auto-migrate enabled, which is why it surfaced now.
+- **@voltro/cli, @voltro/protocol** — **`internal: true` took the rpc server down instead of taking a procedure off the wire.** The flag shipped in 0.22.0. Marking five procedures with it produced
+
+  TypeError: Cannot read properties of undefined (reading 'key')
+
+  and no server — on `voltro dev` and, identically, on `voltro serve`. The consumer isolated it by toggling one at a time (an action alone, mutations alone), confirmed the codegen half was correct (603 → 598 procedures, zero dangling references), and left the flag commented out.
+
+  Each boot path builds TWO things from the discovered procedure lists — the rpc GROUP and the HANDLER MAP, several hundred lines apart. Only the group consulted the filter. `RpcGroup.toHandlersContext` then looks a bound handler's tag up in the group, gets `undefined`, and reads `.key` off it.
+
+  `serveApi.ts` already carried a comment describing that exact crash in the opposite direction — a handler bound with no group entry, for the undo and connection built-ins — and it did not generalise to the new filter. Both paths now filter ONCE and read the filtered bindings, so the group and the handler map cannot be built from different sets.
+
+  Three further holes came out with it:
+
+  - **A `internal: true` STREAM was still served in production.** `serveApi`'s group filtered queries, mutations and actions and not streams, so dev crashed at boot while serve quietly kept the stream on the wire — two paths, two wrong behaviours, and the silent one in production. - **The dev inspect invoker** routed internal procedures. It is filtered too: an internal procedure is the one MOST likely to have no guard ("only server code calls this" is the reason people write them), so an admin-token surface is a narrower door, not a closed one. - **`internal: true` combined with `publicApi` or `exposeAsTool` now THROWS at declaration.** Those projections add a REST route / an agent tool and never consulted the flag, so a procedure carrying both was off the WebSocket and still served over HTTP — the same hole, one surface across. Neither silent resolution is acceptable (dropping the route breaks a live endpoint invisibly; keeping it defeats the flag), so the author decides while both fields are still in front of them.
+
+  **Why the parity guard was green.** It reads each assembly site's source and asserts it mentions `isWireReachable`. Every site did; the handler map is not an assembly site by that definition and never calls an `xToRpc` lifter, so the offender scan was structurally blind to it. There is a shape-based check for the binding loops now, and — because the defect satisfied every source-level rule stated — a test that BOOTS a server with an internal procedure present. That is the one that fails.
+- **@voltro/database** — **A plugin table whose `.renamedFrom()` names a table the APP owns made every boot after the first one impossible.** Reported against `@voltro/plugin-ai-flows@0.22.1`; the mechanic applies to any plugin table carrying `.renamedFrom(<a name the app declares>)`.
+
+  Boot one decided correctly and said so:
+
+  ```txt
+  ✓ CREATE TABLE _voltro_ai_flows (27 cols)
+    # .renamedFrom('ai_flows') NOT applied — 'ai_flows' is still declared by this
+    # schema … that is the intended outcome when an app owns a table of the same name.
+  ```
+
+  Boot two, over exactly that state, refused:
+
+  ```txt
+  auto-migrate: REFUSED — 2 blocked operation(s)
+    - rename-table : both 'ai_flows' and '_voltro_ai_flows' exist in the database
+  ```
+
+  **The guards were evaluated in the wrong order.** Guard 1 ("the old name must not still be declared") answers the question completely: if the app declares the old name, the marker is INAPPLICABLE and there is no rename to have a conflict about. Guard 2 ("the target must not already exist live") asks a follow-up — *which of these two holds the real rows?* — that only makes sense once a rename is actually on the table. Guard 2 ran first.
+
+  So the planner blocked the boot over the exact state it had itself produced one pass earlier and documented as intended, and the state was not stabilisable: dropping the empty `_voltro_*` table just let boot one recreate it. Neither remedy in the message worked either — the rows belong to the app's own schema, and letting the rename run would take them.
+
+  The reporter's case makes it worse than a name collision: the plugin is a port of *their* engine, so it carries the names of the tables it grew out of. They had to unregister the plugin — losing its inspect endpoints — to boot at all. The changelog's "**Nothing is required of you**" was false for precisely the case guard 1 exists to protect.
+
+  Guard 1 runs first now. The test that pins it models TWO passes, because one pass is what the original test did and one pass is green either way.
+- **@voltro/cli** — **`voltro update` bumped `@voltro/*` and left what `@voltro/*` requires behind.** The `@effect/*` packages are peer dependencies, so a user app declares them directly. When a release moved its peer range, `update` rewrote every `@voltro/*` spec, installed, and left the app pinned to the old peers:
+
+  0.22.1 requires @effect/rpc ^0.76.0 @effect/platform ^0.97.0 the app declared @effect/rpc ^0.75.1 @effect/platform ^0.96.2
+
+  pnpm warns about that and installs anyway. The app compiles and boots — on a dependency graph the framework was never tested against, which is the worst shape a version mismatch takes: nothing fails, so nothing points at the cause. Found by a consumer while diagnosing something unrelated.
+
+  `update` now reads the peer requirements off the freshly installed `@voltro/*` packages (disk, after the install — no second per-package-manager registry query to get wrong, and no exposure to the yarn-classic hazard where `yarn npm info …` parses as `yarn run npm`), aligns the app's declared ranges, and re-installs if anything moved.
+
+  Three rules keep it from doing damage:
+
+  - **Only peers the app already declares.** One resolved transitively is not ours to add — that would change the app's dependency surface on its behalf. - **Only when the declared floor is genuinely BELOW the requirement.** An app pinned ahead, or pinned exactly at the floor with different syntax (`0.76.0` vs `^0.76.0`), is left alone. Those are choices, not drift. - **Only ranges it can judge** (`^`, `~`, `>=`, exact). A union, an upper bound, `workspace:` / `catalog:` — left alone. Under-reporting an exotic range is safe; rewriting one we did not understand is not.
+
+  If two framework packages disagree about one peer, that is REPORTED with both names and skipped — it is our bug, and resolving it inside a user's upgrade would hide it.
+- **@voltro/cli** — **`voltro update` now also reports a peer that NOBODY declares.** The alignment added alongside this rewrites ranges an app already declares; a second consumer hit the other half of the same problem.
+
+  Their `apps/voltro-api/package.json` declared the three `@effect/*` packages. The workspace ROOT did not — and the root's `@voltro/client` / `web` / `database` / `protocol` / `ai`, the ones all three frontends use, all require `effect ^3.22`. It resolved `3.21.4` transitively. The peer was unsatisfied workspace-wide, the install succeeded, and nothing said a word.
+
+  That matters more than a version skew usually does because **Effect types are nominal**: two copies produce red `tsc` on `rpcGroup.generated.ts` while the server runs green — the exact symptom `voltro doctor`'s duplicate-install check describes. Doctor already caught it after the fact, with cause and recipe, and the reporter says so; the point of this is to stop the state being created.
+
+  It is REPORTED, not repaired: the fix is to declare a dependency the app never declared, which changes its dependency surface. That is the user's call.
+
+### Internal (no consumer-facing effect)
+
+- **The four 0.22.0 codemods gain the gate tests the convention asks for.**
+
+  `codemodRegistry.test.ts` asserts that every `*.codemod.ts` on disk is registered and that ids are unique — registration, not behaviour. The way a `manual` codemod actually fails is an `appliesTo` that is too broad, so the note prints for projects with nothing to do. That is not cosmetic: a note everyone sees is a note nobody reads, and the next one in the series announces a boot refusal or an irreversible deletion.
+
+  Fifteen cases, both directions for each codemod. The silent direction is the one that needed pinning — `rename-index` must not fire on an app that merely READS a plan (additive there), the plugin-table move must not fire on an app that installs none of the three, and `cache.scope` must not fire on a logger scope or an OAuth scope, both of which are ordinary English in any codebase.
+
+  Verified by breaking a gate rather than by watching green: widening `TOUCHES_SCOPE` to match everything fails exactly the two silent-direction cases and nothing else. A test that has never been seen to fail is not evidence that it checks anything.
+
+  **One finding, pinned rather than quietly fixed.** `04_inspect-write-credential` gates on `envTokenAuthResolver|InspectAuthResolver|authResolver`, and the third alternative is not inspect-scoped — any project with its own unrelated `authResolver` gets the note. It is the loosest gate in the set. There is a test asserting the current behaviour, so tightening it is a deliberate act with a failing test to update, rather than a silent change to who hears about a credential split.
+- **The test harness sends ANY hostless bind to the loopback, not just `port: 0`.**
+
+  The first version rewrote only ephemeral binds, and that was worse than not doing it at all: it made the two halves of a single test disagree about address family.
+
+  `devHealthServer`'s conflict case caught it in the next gate run. That test binds ephemerally, then asks for the SAME port again and expects `EADDRINUSE` to degrade the handle to `port: null`. With only port-0 rewritten, the first server took `127.0.0.1:P` while the second — an explicit port, so untouched — took `:::P`. Those do not collide. The expected conflict silently stopped happening and the assertion read `expected 51500 to be null`.
+
+  The failure is worth keeping in view because it is the same mechanism the harness exists to remove, produced by a half-applied fix: two binds of one port number in different families are two independent binds. A test that names its own interface still keeps it, and production is untouched — the wildcard remains the default there, because a container must be reachable from outside.
+
+  Re-verified after: `devHealthServer` 5 passed, `mcp` 13, `protocol` 301, `runtime` 1038, and an instrumented run still reports `bound 127.0.0.1:<port>`.
+- **The net harness is shared across every package that binds a listener, and a derived guard keeps it that way.**
+
+  The bind fix itself ships with the `host` option in this same release. What did not ship with it was reach: the mitigation lived in `packages/cli/vitest.config.ts`, written where the symptom appeared, so the other eleven packages whose tests bind a real listener never had it. `@voltro/mcp` then failed a release gate with the identical signature — bound, zero connections, its client stuck in `fetch` — and that read as a NEW problem rather than as the containment being too narrow. It is the second time this repo fixed a real-listener flake inside one package's config.
+
+  `test/harness/setup.ts` is now loaded by all twelve. It is deliberately NOT in `@voltro/testing`: that package is published, and a `net.Server` monkey-patch does not belong in a shipped API surface.
+
+  `packages/cli/src/netHarnessPackages.test.ts` DERIVES the required set — any test file calling `.listen(` / `createServer(` / `serveApi(` / `startRpcServer(` — instead of curating a list that would rot exactly the way the original mitigation did. Remove a package's config and it fails naming that package; verified by deleting `@voltro/mcp`'s and watching it go red. It also asserts the derivation matches more than five packages, because a guard that silently matches nothing reads exactly like a clean repo.
+
+  The harness covers `@voltro/cli`'s `unit` project too, not only `integration`: the light mock-server suites live there, and `devHealthServer` — one of them — is among the files this failure mode has hung.
+- **Thirty-two tests reported `passed` when their service was absent. They skip now, and a derived check keeps it that way.**
+
+  The rule is not new — `voltro/CLAUDE.md` states that a suite needing a live service must SKIP rather than pass, that all 36 suites with the hand-rolled shape were converted, and that a new one must never be added. It was enforced by prose, so it rotted: seven files had grown it back.
+
+  Measured, not inferred:
+
+  ```
+  $ PG_PORT=1 vitest run plugin-ratelimit/src/postgresStore.test.ts
+  Tests  5 passed (5)
+  ```
+
+  Five tests that connected to nothing. The shape is a `beforeAll` probe plus `if (!ok) return` in each body: an absent dependency becomes a PASS, the only trace is a shorter duration, and vitest swallows the `console.warn` meant to say otherwise. Two of the seven — `concurrency.pg` and `jsonArrayWrite.pg` — exist specifically to prove atomicity under real concurrency, so a green there was evidence for a claim nobody had checked.
+
+  All seven now use `describeIfReachable` (`plugin-ratelimit` ×2, `plugin-broadcast`, `plugin-flags`, `plugin-versioning`, `integration-harness` ×2), and four packages gained the `@voltro/testing` devDependency they were missing — the import would have typechecked clean and died at runtime with `Cannot find package`, which this repo has been bitten by before.
+
+  Verified in BOTH directions, because only one is obvious: with no service, `2 passed | 3 skipped` where it used to be `5 passed`; with the stack up, 5/10/4/2 tests actually run and pass.
+
+  `packages/cli/src/noHandRolledReachability.test.ts` makes the rule mechanical. It DERIVES the offenders from source rather than curating a list, and it strips comments first — the first version flagged two files whose only offence was a comment *explaining* the anti-pattern, and a check that punishes documenting a hazard teaches people to stop documenting it. It also excludes itself, since it must state the pattern in order to forbid it, and asserts the supported helper is used by more than twenty files, so an empty repo could not make it vacuous. Red-checked by reintroducing the guard into `plugin-flags`: it fails and names the file.
+- **@voltro/runtime, @voltro/cli, @voltro/mcp** — Two `@voltro/runtime` tests asserting that a symbol is EXPORTED carried vitest's 5s default timeout around a dynamic `import('./index')`. That silently added a second assertion nobody meant to make — "…and a cold import of this package's whole barrel completes within 5 seconds" — which is a claim about the MACHINE.
+
+  In a full uncached monorepo run the package's import phase alone was 88s and the file went red while every assertion in it would have passed. Given an explicit 60s ceiling: the timeout is now a backstop rather than the assertion, which is the same correction already applied to `coordinatedSchedule.test.ts`.
+
+  **Three more files had the same shape**, and they are the ones this repo's maintainer notes already list as "rotating victims" of full-monorepo runs: `cli/src/adminExportServe.test.ts`, `cli/src/connectionServe.test.ts` and `mcp/src/http.test.ts`. All three BOOT a real listener and make real HTTP round-trips — the last one boots two servers — against the same 5s default. Each went red in an uncached full run under load ~19 and green alone seconds later, with every assertion in them passing either way.
+
+  That is worth naming precisely, because "it passes in isolation" has been the signature of both machine load AND a defect the suite carried itself, and this repo has been wrong in both directions. Here it is neither: the suites are correct and the timeout was measuring the wrong thing. A test whose claim is "these two endpoints compose" should not also be claiming how many milliseconds that takes on a saturated machine.
+
+  **And one of the four turned out NOT to be the machine.** With the 60s ceiling in place, `connectionServe.test.ts`'s "callback route is NOT mounted" test consumed the entire budget in a full parallel run — 60006ms — while its four siblings in the same file took 82ms, 50ms, 38ms and 1ms. A test that is 700× slower than its neighbours is hanging, not slow, and the raised ceiling is what made that readable: at 5s it looked like every other saturation red.
+
+  The cause is **not** known. It does not reproduce alone (3 runs) or as a whole file (4 runs), which leaves the full-parallel context and nothing more specific. So this does not claim a fix. Every request in that file now carries `AbortSignal.timeout(10_000)`, which turns the next occurrence into a named `TimeoutError` on a specific request instead of an anonymous test timeout that eats a minute of the run and reports nothing — the difference between an observation and a diagnosis.
+
+  Recorded rather than resolved, because "it passes in isolation" has been the signature of both machine load and a real defect in this repo, and this one has not been told apart yet.
+- **The 0.23.0 versioning codemod gains its gate test.**
+
+  Same reason as the four before it: `codemodRegistry.test.ts` covers registration, not behaviour, and what a `manual` codemod gets wrong is an `appliesTo` that fires for projects with nothing to do. This note is long and carries a storage-budget warning, which makes a spurious print worse than usual — a long note on an app that is unaffected is the most reliable way to teach someone to stop reading them.
+
+  Four cases, both directions. Verified by breaking the gate: widening `TOUCHES_VERSIONING` to match everything fails exactly the two silent-direction cases.
+
+---
+
 ## [0.22.1] — 2026-08-01
 
 ### Fixed

package/dist/index.d.ts

@@ -666,6 +666,183 @@ export declare const verifySignature: (scheme: SignatureScheme, rawBody: Uint8Ar
  */
 export declare type VersionState = 'current' | 'behind' | 'ahead';
 
+/**
+ * One row per delivery attempt — NOT per emit. An emit fans out to
+ * N targets; each target then runs ≤ `maxAttempts` deliveries. The
+ * primary key is `(deliveryId, attempt)`; `deliveryId` is shared
+ * across retries of the SAME (event, payload, target) tuple so the
+ * dashboard groups them.
+ *
+ * Status lifecycle: `pending` (queued — the target was paused at emit
+ * time, or the attempt is rate-deferred to the next window) →
+ * `inFlight` → `succeeded` | `failed` | `retryScheduled`. On retry the
+ * workflow creates a new `(deliveryId, attempt+1)` row; on
+ * resume/deferral the SAME attempt-1 row transitions out of `pending`.
+ */
+export declare const _voltroWebhookDeliveriesTable: Table<"_voltro_webhook_deliveries", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    /** Grouping key for retries of the same delivery. See above. */
+    readonly deliveryId: ColumnBuilder<string, "text", boolean>;
+    /** FK to `_voltro_webhook_targets.id`. */
+    readonly targetId: ColumnBuilder<string, "text", boolean>;
+    /** Event id at emit time — denormalised so dashboard listings
+     *  don't need to JOIN through `_voltro_webhook_targets` (which
+     *  may have been deleted by the time someone audits this row). */
+    readonly event: ColumnBuilder<string, "text", boolean>;
+    /** The emit's `eventId` (shared by every target fan-out of one
+     *  emit) — lets `resumeTarget`'s flush re-trigger a queued delivery
+     *  with its ORIGINAL event id, and correlates rows across targets. */
+    readonly eventId: ColumnBuilder<string | null, "text", boolean>;
+    /** Attempt counter (1-indexed). */
+    readonly attempt: ColumnBuilder<number, "integer", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
+    /** Payload as sent over the wire. Stored verbatim — re-rendering
+     *  from a referenced event row would lose the snapshot if the
+     *  source event was deleted. */
+    readonly payload: ColumnBuilder<unknown, "json", boolean>;
+    /** HTTP status code returned. `null` for transport errors (DNS,
+     *  TLS, timeout) — `errorMessage` carries the detail. */
+    readonly responseStatus: ColumnBuilder<number | null, "integer", boolean>;
+    /** Response body sample (clipped to 8 KB). Lets the dashboard
+     *  show the recipient's error reply inline. */
+    readonly responseBody: ColumnBuilder<string | null, "text", boolean>;
+    /** Transport-layer error message ("ENOTFOUND", "ETIMEDOUT", TLS
+     *  handshake failure). Null on HTTP-layer errors (those carry
+     *  `responseStatus`). */
+    readonly errorMessage: ColumnBuilder<string | null, "text", boolean>;
+    /** End-to-end attempt latency in ms — includes DNS, TLS, request,
+     *  response read. Useful for the dashboard's "slowest endpoint"
+     *  ranking. */
+    readonly latencyMs: ColumnBuilder<number | null, "integer", boolean>;
+    /** When this attempt was scheduled (NOT when it was sent — sent
+     *  time is approximately `scheduledAt + queueDelay`). */
+    readonly scheduledAt: ColumnBuilder<Date, "timestamp", boolean>;
+    /** When the next retry is due (set ONLY when `status =
+     *  retryScheduled`). Lets the workflow's sleep block read its
+     *  wake time from the persisted row across restarts. */
+    readonly nextAttemptAt: ColumnBuilder<Date | null, "timestamp", boolean>;
+}> & {
+    tenantId: ColumnDefinition<string>;
+} & {
+    readonly createdAt: ColumnDefinition<Date, "timestamp", true>;
+    readonly updatedAt: ColumnDefinition<Date, "timestamp", true>;
+    readonly createdBy: ColumnDefinition<string | null, "reference", boolean>;
+    readonly updatedBy: ColumnDefinition<string | null, "reference", boolean>;
+}, true, never>;
+
+/**
+ * Fixed-window rate-limit counters — one row per (scope, minute
+ * bucket), where scope is `target:<targetId>` (per-target
+ * `rateLimitPerMinute`) or `event:<eventId>` (an outgoing event's
+ * `globalRateLimit`). The delivery workflow claims a slot via a CAS
+ * loop over `count` (see `rateLimit.ts`) BEFORE every wire POST, so
+ * the cap holds across replicas — the counter lives here, never in
+ * process memory.
+ *
+ * Deliberately NOT tenant-scoped: rows carry only a scope key + an
+ * integer count (no payload, no secret, no tenant data), and the
+ * background delivery workflow that writes them has no request
+ * subject. The deterministic PK `<scope>@<bucket>` is the
+ * `insertIgnore` conflict target for the first-in-window create race.
+ */
+export declare const _voltroWebhookRateWindowsTable: Table<"_voltro_webhook_rate_windows", FieldDefinitions<{
+    /** Deterministic `<scope>@<bucket>` — always supplied explicitly by
+     *  the CAS writer (the prefix scheme only fires for omitted ids,
+     *  which never happens here). */
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    /** `target:<targetId>` | `event:<eventId>`. */
+    readonly scope: ColumnBuilder<string, "text", boolean>;
+    /** Epoch-minute bucket (`floor(now / windowMs)`). */
+    readonly bucket: ColumnBuilder<number, "integer", boolean>;
+    /** Slots consumed in this window. */
+    readonly count: ColumnBuilder<number, "integer", true>;
+    readonly createdAt: ColumnBuilder<Date, "timestamp", boolean>;
+    readonly updatedAt: ColumnBuilder<Date, "timestamp", boolean>;
+}>, true, never>;
+
+/**
+ * One row per subscribed delivery target. Created via
+ * `webhooks.subscribe(...)`. Read-only from app code; mutate via
+ * the `webhooks` service so the framework can run validation +
+ * generate secrets + invalidate caches.
+ */
+export declare const _voltroWebhookTargetsTable: Table<"_voltro_webhook_targets", FieldDefinitions<{
+    readonly id: ColumnBuilder<string, "id", boolean>;
+    /** Event id from the outgoing-event descriptor (e.g. `'order.completed'`). */
+    readonly event: ColumnBuilder<string, "text", boolean>;
+    /** Active subscription URL the delivery posts to. */
+    readonly url: ColumnBuilder<string, "text", boolean>;
+    /** Per-target signing secret. Generated at subscribe time when not
+     *  supplied. Stored as-is — encryption is a deployment concern
+     *  (Postgres-at-rest, KMS-wrapped column, vault sidecar). */
+    readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
+     *  Stored as JSON so future schemes don't require a schema migration. */
+    readonly signing: ColumnBuilder<unknown, "json", boolean>;
+    /** Serialised `RetryPolicy` — see `retry.ts`. */
+    readonly retry: ColumnBuilder<unknown, "json", boolean>;
+    /** Optional predicate filter (subset of `Predicate`) — the engine
+     *  evaluates this against each emit's payload to decide whether
+     *  this target receives the delivery. */
+    readonly filter: ColumnBuilder<unknown, "json", boolean>;
+    /** Optional custom headers merged with the framework's
+     *  Content-Type + signature header. Values larger than 2 KB are
+     *  rejected at subscribe time. */
+    readonly headers: ColumnBuilder<unknown, "json", boolean>;
+    /** Per-target rate limit — at most N wire POSTs per minute to this
+     *  target, enforced by the delivery workflow via a shared-store
+     *  fixed-window counter (`_voltro_webhook_rate_windows`, so the cap
+     *  holds across replicas). Excess deliveries are DEFERRED: parked as
+     *  `status='pending'` rows and durable-slept until the next window
+     *  opens — they're never dropped silently. */
+    readonly rateLimitPerMinute: ColumnBuilder<number | null, "integer", boolean>;
+    /** Soft-disable without deleting the row — the dashboard's
+     *  "Pause" affordance flips this. While paused, emits against this
+     *  target accumulate as `_voltro_webhook_deliveries` rows with
+     *  status `'pending'` (no POST happens); `resumeTarget` flushes
+     *  them through the delivery workflow in emit order. */
+    readonly active: ColumnBuilder<boolean, "boolean", true>;
+    /** Format the payload is delivered as. `json` is the default and
+     *  what every modern integration expects. `form`
+     *  (`application/x-www-form-urlencoded`, bracketed-key flattening)
+     *  and `xml` (`application/xml`, `<webhook>`-rooted) exist for
+     *  SOAP-era partners; the delivery workflow re-encodes the payload
+     *  into this format and signs the re-encoded bytes. */
+    readonly format: ColumnBuilder<"json" | "form" | "xml", "text", true>;
+    /** Auto-disable threshold — after this many CONSECUTIVE terminal
+     *  delivery failures the target is auto-paused (dead-letter guard).
+     *  `null` (the default) disables the feature. When it trips, the
+     *  target flips to `active=false` and subsequent emits QUEUE as
+     *  `status='pending'` rows (same as a manual pause — nothing is
+     *  dropped); a manual `resumeTarget` re-activates, flushes the queue,
+     *  and clears the streak. */
+    readonly autoDisableAfter: ColumnBuilder<number | null, "integer", boolean>;
+    /** Consecutive terminal-failure streak. Incremented on each terminal
+     *  `failed` delivery, reset to 0 on any `succeeded`. Drives
+     *  `autoDisableAfter`. Multi-replica-correct via a CAS loop
+     *  (`autoDisable.ts`). */
+    readonly consecutiveFailures: ColumnBuilder<number, "integer", true>;
+    /** When the auto-disable last fired (`null` = never / cleared by a
+     *  manual resume). Surfaced on the inspect panel. */
+    readonly autoDisabledAt: ColumnBuilder<Date | null, "timestamp", boolean>;
+    /** The terminal failure reason that tripped the auto-disable
+     *  (`null` = not auto-disabled). Surfaced on the inspect panel. */
+    readonly autoDisableReason: ColumnBuilder<string | null, "text", boolean>;
+    /** Schema version bound at subscribe time. Lets the dashboard
+     *  show which targets are still pinned to an older event version
+     *  after the producer bumps it. */
+    readonly payloadVersion: ColumnBuilder<number, "integer", true>;
+    /** Human-readable label surfaced in the dashboard listing. */
+    readonly description: ColumnBuilder<string | null, "text", boolean>;
+}> & {
+    tenantId: ColumnDefinition<string>;
+} & {
+    readonly createdAt: ColumnDefinition<Date, "timestamp", true>;
+    readonly updatedAt: ColumnDefinition<Date, "timestamp", true>;
+    readonly createdBy: ColumnDefinition<string | null, "reference", boolean>;
+    readonly updatedBy: ColumnDefinition<string | null, "reference", boolean>;
+}, true, never>;
+
 /**
  * Thrown by `WebhooksService.replay` when no delivery row exists for the
  * given `deliveryId` — the row can't be re-triggered because the

package/dist/index.js

@@ -1,16 +1,16 @@
 import { a as e, c as t, i as n, l as r, n as i, o as a, r as o, s, t as c, u as l } from "./signing-BOUxHdAo.js";
 import { WebhookDeliveryNotFound as u, WebhookPayloadInvalid as d, WebhookPayloadUnrepresentable as f, WebhookPayloadVersionInvalid as p, WebhookSubscribeInvalid as m } from "./errors.js";
-import { webhookTables as h } from "./mixin.js";
-import { randomBytes as g, randomUUID as _ } from "node:crypto";
-import { Context as v, Effect as y, Either as b, Schema as x } from "effect";
-import { and as S, eq as C } from "@voltro/database";
-import { assertPublicUrl as w } from "@voltro/integration-http";
-import { publishServerError as ee } from "@voltro/protocol";
-import { createLogger as T } from "@voltro/logger";
-import { Activity as E, DurableClock as D, Workflow as te } from "@effect/workflow";
+import { _voltroWebhookDeliveriesTable as h, _voltroWebhookRateWindowsTable as g, _voltroWebhookTargetsTable as _, webhookTables as v } from "./mixin.js";
+import { randomBytes as y, randomUUID as b } from "node:crypto";
+import { Context as ee, Effect as x, Either as te, Schema as S } from "effect";
+import { and as C, eq as w } from "@voltro/database";
+import { assertPublicUrl as T } from "@voltro/integration-http";
+import { publishServerError as ne } from "@voltro/protocol";
+import { createLogger as re } from "@voltro/logger";
+import { Activity as E, DurableClock as D, Workflow as ie } from "@effect/workflow";
 //#region src/retry.ts
-var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
-	let t = ne.exec(e);
+var ae = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
+	let t = ae.exec(e);
 	if (!t) throw Error(`invalid duration literal: ${e}`);
 	let n = Number(t[1]), r = t[2] ?? "s";
 	switch (r) {
@@ -64,7 +64,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 	retryOn: k,
 	honourRetryAfter: !0,
 	jitter: "full"
-}), re = () => ({
+}), oe = () => ({
 	strategy: "fixed",
 	maxAttempts: 120,
 	initialDelay: "30s",
@@ -72,7 +72,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 	retryOn: k,
 	honourRetryAfter: !0,
 	jitter: "full"
-}), M = class extends v.Tag("@voltro/webhooks/WebhooksService")() {}, ie = 32, N = 32, P = () => g(ie).toString("hex"), F = (e) => {
+}), M = class extends ee.Tag("@voltro/webhooks/WebhooksService")() {}, se = 32, N = 32, P = () => y(se).toString("hex"), F = (e) => {
 	let t;
 	try {
 		t = new URL(e.url);
@@ -87,7 +87,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		reason: `url protocol must be http or https, got ${t.protocol}`
 	});
 	if (process.env.NODE_ENV === "production") try {
-		w(e.url);
+		T(e.url);
 	} catch (e) {
 		throw new m({
 			field: "url",
@@ -121,7 +121,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		reason: `autoDisableAfter must be a positive integer, got ${e.autoDisableAfter}`
 	});
 }, I = (e, t) => ({
-	id: _(),
+	id: b(),
 	event: e.event,
 	url: e.url,
 	secret: e.secret ?? P(),
@@ -138,19 +138,19 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 	autoDisableReason: null,
 	payloadVersion: e.payloadVersion ?? t?.version ?? 1,
 	description: e.description ?? null
-}), ae = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", L = (e, t) => {
+}), ce = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", L = (e, t) => {
 	if (e === null) return !0;
 	let n = { payload: t };
-	for (let [t, r] of Object.entries(e)) if (!se(oe(n, t), r)) return !1;
+	for (let [t, r] of Object.entries(e)) if (!ue(le(n, t), r)) return !1;
 	return !0;
-}, oe = (e, t) => {
+}, le = (e, t) => {
 	let n = t.split("."), r = e;
 	for (let e of n) {
 		if (typeof r != "object" || !r) return;
 		r = r[e];
 	}
 	return r;
-}, se = (e, t) => {
+}, ue = (e, t) => {
 	if (typeof t == "object" && t && !Array.isArray(t)) {
 		let n = t;
 		if ("eq" in n) return e === n.eq;
@@ -161,7 +161,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		if ("in" in n && Array.isArray(n.in)) return n.in.includes(e);
 	}
 	return e === t;
-}, ce = (e, t, n = {}) => {
+}, de = (e, t, n = {}) => {
 	let r = new Map((n.events ?? []).map((e) => [e.id, e]));
 	return {
 		subscribe: async (t) => {
@@ -183,15 +183,15 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		emit: async (n, i) => {
 			let a = typeof n == "string" ? r.get(n) : n, o = typeof n == "string" ? n : n.id;
 			if (a !== void 0) {
-				let e = x.decodeUnknownEither(a.payload)(i, { errors: "all" });
-				if (b.isLeft(e)) throw new d({
+				let e = S.decodeUnknownEither(a.payload)(i, { errors: "all" });
+				if (te.isLeft(e)) throw new d({
 					event: o,
 					issues: e.left.message
 				});
 			}
-			let s = _(), c = (await e.store.query({
+			let s = b(), c = (await e.store.query({
 				table: "_voltro_webhook_targets",
-				predicate: C("event", o),
+				predicate: w("event", o),
 				order: [{
 					column: "createdAt",
 					direction: "asc"
@@ -201,7 +201,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 				projection: void 0
 			})).filter((e) => L(e.filter, i)), l = [], u = JSON.stringify(i);
 			for (let n of c) {
-				let r = _();
+				let r = b();
 				n.active ? (await t({
 					deliveryId: r,
 					targetId: n.id,
@@ -239,7 +239,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		replay: async (n) => {
 			let r = (await e.store.query({
 				table: "_voltro_webhook_deliveries",
-				predicate: C("deliveryId", n),
+				predicate: w("deliveryId", n),
 				order: [{
 					column: "attempt",
 					direction: "asc"
@@ -253,7 +253,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 				deliveryId: r.deliveryId,
 				targetId: r.targetId,
 				event: r.event,
-				eventId: r.eventId ?? _(),
+				eventId: r.eventId ?? b(),
 				payloadJson: typeof r.payload == "string" ? r.payload : JSON.stringify(r.payload),
 				attemptEpoch: Date.now()
 			});
@@ -274,7 +274,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 			});
 			let r = await e.store.query({
 				table: "_voltro_webhook_deliveries",
-				predicate: S(C("targetId", n), C("status", "pending")),
+				predicate: C(w("targetId", n), w("status", "pending")),
 				order: [{
 					column: "createdAt",
 					direction: "asc"
@@ -287,13 +287,13 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 				deliveryId: e.deliveryId,
 				targetId: n,
 				event: e.event,
-				eventId: e.eventId ?? _(),
+				eventId: e.eventId ?? b(),
 				payloadJson: typeof e.payload == "string" ? e.payload : JSON.stringify(e.payload),
 				attemptEpoch: i
 			});
 		},
 		deleteTarget: async (t) => {
-			await e.store.delete("_voltro_webhook_targets", t), await e.store.deleteMany("_voltro_webhook_deliveries", { where: S(C("targetId", t), C("status", "pending")) });
+			await e.store.delete("_voltro_webhook_targets", t), await e.store.deleteMany("_voltro_webhook_deliveries", { where: C(w("targetId", t), w("status", "pending")) });
 		},
 		rotateSecret: async (t) => {
 			let n = P();
@@ -311,7 +311,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		},
 		listTargets: async (t) => (await e.store.query({
 			table: "_voltro_webhook_targets",
-			predicate: t === void 0 ? void 0 : C("event", t),
+			predicate: t === void 0 ? void 0 : w("event", t),
 			order: [{
 				column: "createdAt",
 				direction: "desc"
@@ -333,15 +333,15 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 			autoDisableReason: e.autoDisableReason
 		}))
 	};
-}, le = y.gen(function* () {
+}, fe = x.gen(function* () {
 	return yield* M;
-}), ue = (e) => {
+}), pe = (e) => {
 	if (e.webhooks === void 0) throw Error("useWebhooks: `ctx.webhooks` is not set. Add @voltro/plugin-webhooks to your app.config.ts plugin list and declare at least one *.webhook.tsx file.");
 	return e.webhooks;
-}, de = 1e4, R = class {
+}, me = 1e4, R = class {
 	capacity;
 	cache = /* @__PURE__ */ new Map();
-	constructor(e = de) {
+	constructor(e = me) {
 		this.capacity = e;
 	}
 	evictExpired() {
@@ -387,9 +387,9 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t)
-}), fe = (e, t) => {
+}), he = (e, t) => {
 	let n = e.provider, r = e.signature ?? n?.signature ?? null, i = e.idempotency ?? n?.idempotency ?? null, o = e.bodyType ?? n?.bodyType ?? "json", s = t.idempotencyCache ?? B(), c = H(i?.ttl), l = t.log ?? ((e) => {
-		T({ scope: `webhook:${e.webhookId}` }).debug("incoming webhook", {
+		re({ scope: `webhook:${e.webhookId}` }).debug("incoming webhook", {
 			status: e.status,
 			signatureOk: e.signatureOk,
 			idempotency: e.idempotency,
@@ -462,7 +462,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		}
 		let p;
 		try {
-			p = x.decodeUnknownSync(e.payload)(f);
+			p = S.decodeUnknownSync(e.payload)(f);
 		} catch (t) {
 			let n = U(422, {
 				error: "schema validation failed",
@@ -540,7 +540,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 				idempotency: h,
 				durationMs: Date.now() - u,
 				errorMessage: t.message
-			}), ee({
+			}), ne({
 				error: t,
 				source: "webhook",
 				name: e.id,
@@ -548,9 +548,9 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 			}), n;
 		}
 	};
-}, pe = (e) => `/webhooks/${e}`, W = "_voltro_webhook_rate_windows", G = 6e4, me = (e, t) => `${e}@${t}`, K = async (e, t, n) => (await e.query({
+}, ge = (e) => `/webhooks/${e}`, W = "_voltro_webhook_rate_windows", G = 6e4, _e = (e, t) => `${e}@${t}`, K = async (e, t, n) => (await e.query({
 	table: "_voltro_webhook_rate_windows",
-	predicate: S(C("scope", t), C("bucket", n)),
+	predicate: C(w("scope", t), w("bucket", n)),
 	order: [],
 	take: 1,
 	skip: void 0,
@@ -561,7 +561,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		let i = await K(e, t.key, n);
 		if (i === null) {
 			await e.insertIgnore(W, {
-				id: me(t.key, n),
+				id: _e(t.key, n),
 				scope: t.key,
 				bucket: n,
 				count: 0,
@@ -574,7 +574,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		if (await e.updateMany("_voltro_webhook_rate_windows", {
 			count: i.count + 1,
 			updatedAt: /* @__PURE__ */ new Date()
-		}, { where: S(C("id", i.id), C("count", i.count)) }) === 1) return !0;
+		}, { where: C(w("id", i.id), w("count", i.count)) }) === 1) return !0;
 	}
 	throw Error(`webhook rate window: contention on (${t.key}, ${n}) exceeded ${q} attempts`);
 }, Y = async (e, t, n) => {
@@ -584,7 +584,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		if (i === null || i.count <= 0 || await e.updateMany("_voltro_webhook_rate_windows", {
 			count: i.count - 1,
 			updatedAt: /* @__PURE__ */ new Date()
-		}, { where: S(C("id", i.id), C("count", i.count)) }) === 1) return;
+		}, { where: C(w("id", i.id), w("count", i.count)) }) === 1) return;
 	}
 	throw Error(`webhook rate window: release contention on (${t}) exceeded ${q} attempts`);
 }, X = async (e, t, n, r = G) => {
@@ -624,15 +624,15 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 	}
 	return e === "form" ? {
 		contentType: "application/x-www-form-urlencoded",
-		bytes: Buffer.from(he(n), "utf8")
+		bytes: Buffer.from(ve(n), "utf8")
 	} : {
 		contentType: "application/xml",
-		bytes: Buffer.from(_e(n), "utf8")
+		bytes: Buffer.from(be(n), "utf8")
 	};
-}, he = (e) => {
+}, ve = (e) => {
 	if (typeof e != "object" || !e || Array.isArray(e)) throw new f({
 		format: "form",
-		reason: `form encoding requires a JSON object at the top level, got ${be(e)}`
+		reason: `form encoding requires a JSON object at the top level, got ${Ce(e)}`
 	});
 	let t = new URLSearchParams();
 	for (let [n, r] of Object.entries(e)) Q(t, n, r);
@@ -651,13 +651,13 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		return;
 	}
 	e.append(t, String(n));
-}, ge = /^[A-Za-z_][A-Za-z0-9_.-]*$/, _e = (e) => `<?xml version="1.0" encoding="UTF-8"?>${$("webhook", e)}`, $ = (e, t) => {
-	if (!ge.test(e)) throw new f({
+}, ye = /^[A-Za-z_][A-Za-z0-9_.-]*$/, be = (e) => `<?xml version="1.0" encoding="UTF-8"?>${$("webhook", e)}`, $ = (e, t) => {
+	if (!ye.test(e)) throw new f({
 		format: "xml",
 		reason: `object key ${JSON.stringify(e)} is not a valid XML element name`
 	});
-	return `<${e}>${ve(e, t)}</${e}>`;
-}, ve = (e, t) => t == null ? "" : Array.isArray(t) ? t.map((e) => $("item", e)).join("") : typeof t == "object" ? Object.entries(t).map(([e, t]) => $(e, t)).join("") : ye(String(t)), ye = (e) => e.replace(/[&<>"']/g, (e) => {
+	return `<${e}>${xe(e, t)}</${e}>`;
+}, xe = (e, t) => t == null ? "" : Array.isArray(t) ? t.map((e) => $("item", e)).join("") : typeof t == "object" ? Object.entries(t).map(([e, t]) => $(e, t)).join("") : Se(String(t)), Se = (e) => e.replace(/[&<>"']/g, (e) => {
 	switch (e) {
 		case "&": return "&amp;";
 		case "<": return "&lt;";
@@ -665,17 +665,17 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		case "\"": return "&quot;";
 		default: return "&apos;";
 	}
-}), be = (e) => e === null ? "null" : Array.isArray(e) ? "array" : typeof e, xe = "_voltro_webhook_targets", Se = 32, Ce = async (e, t) => (await e.query({
+}), Ce = (e) => e === null ? "null" : Array.isArray(e) ? "array" : typeof e, we = "_voltro_webhook_targets", Te = 32, Ee = async (e, t) => (await e.query({
 	table: "_voltro_webhook_targets",
-	predicate: C("id", t),
+	predicate: w("id", t),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, we = async (e, t, n, r, i = /* @__PURE__ */ new Date()) => {
-	for (let a = 0; a < Se; a++) {
+}))[0] ?? null, De = async (e, t, n, r, i = /* @__PURE__ */ new Date()) => {
+	for (let a = 0; a < Te; a++) {
 		a > 0 && await new Promise((e) => setTimeout(e, a));
-		let o = await Ce(e, t);
+		let o = await Ee(e, t);
 		if (o === null) return {
 			consecutiveFailures: 0,
 			autoDisabled: !1
@@ -685,7 +685,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 			if (s === 0 || await e.updateMany("_voltro_webhook_targets", {
 				consecutiveFailures: 0,
 				updatedAt: i
-			}, { where: S(C("id", t), C("consecutiveFailures", s)) }) === 1) return {
+			}, { where: C(w("id", t), w("consecutiveFailures", s)) }) === 1) return {
 				consecutiveFailures: 0,
 				autoDisabled: !1
 			};
@@ -695,68 +695,68 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 			consecutiveFailures: c,
 			updatedAt: i
 		};
-		if (u && (d.active = !1, d.autoDisabledAt = i, d.autoDisableReason = r.slice(0, 500)), await e.updateMany("_voltro_webhook_targets", d, { where: S(C("id", t), C("consecutiveFailures", s)) }) === 1) return {
+		if (u && (d.active = !1, d.autoDisabledAt = i, d.autoDisableReason = r.slice(0, 500)), await e.updateMany("_voltro_webhook_targets", d, { where: C(w("id", t), w("consecutiveFailures", s)) }) === 1) return {
 			consecutiveFailures: c,
 			autoDisabled: u
 		};
 	}
-	throw Error(`webhook auto-disable: streak CAS contention on target ${t} exceeded ${Se} attempts`);
-}, Te = x.Struct({
-	status: x.Number,
-	body: x.String,
-	latencyMs: x.Number,
-	retryAfterSec: x.Union(x.Number, x.Undefined),
-	transportError: x.Union(x.String, x.Undefined),
-	encodeError: x.Union(x.String, x.Undefined)
-}), Ee = x.Struct({
-	outcome: x.Literal("succeeded", "failed", "retry"),
-	delayMs: x.Union(x.Number, x.Undefined),
-	reason: x.Union(x.String, x.Undefined),
-	autoDisabled: x.Union(x.Boolean, x.Undefined),
-	consecutiveFailures: x.Union(x.Number, x.Undefined)
-}), De = x.Struct({
-	acquired: x.Boolean,
-	retryInMs: x.Number
-}), Oe = te.make({
+	throw Error(`webhook auto-disable: streak CAS contention on target ${t} exceeded ${Te} attempts`);
+}, Oe = S.Struct({
+	status: S.Number,
+	body: S.String,
+	latencyMs: S.Number,
+	retryAfterSec: S.Union(S.Number, S.Undefined),
+	transportError: S.Union(S.String, S.Undefined),
+	encodeError: S.Union(S.String, S.Undefined)
+}), ke = S.Struct({
+	outcome: S.Literal("succeeded", "failed", "retry"),
+	delayMs: S.Union(S.Number, S.Undefined),
+	reason: S.Union(S.String, S.Undefined),
+	autoDisabled: S.Union(S.Boolean, S.Undefined),
+	consecutiveFailures: S.Union(S.Number, S.Undefined)
+}), Ae = S.Struct({
+	acquired: S.Boolean,
+	retryInMs: S.Number
+}), je = ie.make({
 	name: "voltro.deliverWebhook",
 	payload: {
-		deliveryId: x.String,
-		targetId: x.String,
-		event: x.String,
-		eventId: x.String,
-		payloadJson: x.String,
-		attemptEpoch: x.optionalWith(x.Number, { default: () => 0 })
+		deliveryId: S.String,
+		targetId: S.String,
+		event: S.String,
+		eventId: S.String,
+		payloadJson: S.String,
+		attemptEpoch: S.optionalWith(S.Number, { default: () => 0 })
 	},
-	success: x.Struct({
-		finalStatus: x.Literal("succeeded", "failed", "deferred"),
-		attempts: x.Number
+	success: S.Struct({
+		finalStatus: S.Literal("succeeded", "failed", "deferred"),
+		attempts: S.Number
 	}),
 	idempotencyKey: ({ deliveryId: e, attemptEpoch: t }) => `voltro.deliverWebhook:${e}:${t ?? 0}`
-}), ke = (e, t = {}) => (n, r) => {
-	let { deliveryId: i, targetId: a, event: s, eventId: c, payloadJson: l } = n, u = T({ scope: `webhook:${i}` });
-	return y.gen(function* () {
+}), Me = (e, t = {}) => (n, r) => {
+	let { deliveryId: i, targetId: a, event: s, eventId: c, payloadJson: l } = n, u = re({ scope: `webhook:${i}` });
+	return x.gen(function* () {
 		let n = yield* E.make({
 			name: "fetch-target",
-			success: x.Union(x.Null, x.Struct({
-				id: x.String,
-				event: x.String,
-				url: x.String,
-				secret: x.String,
-				signing: x.Any,
-				retry: x.Any,
-				headers: x.Union(x.Record({
-					key: x.String,
-					value: x.String
-				}), x.Null),
-				rateLimitPerMinute: x.Union(x.Number, x.Null),
-				active: x.Boolean,
-				format: x.Literal("json", "form", "xml"),
-				tenantId: x.Union(x.String, x.Null)
+			success: S.Union(S.Null, S.Struct({
+				id: S.String,
+				event: S.String,
+				url: S.String,
+				secret: S.String,
+				signing: S.Any,
+				retry: S.Any,
+				headers: S.Union(S.Record({
+					key: S.String,
+					value: S.String
+				}), S.Null),
+				rateLimitPerMinute: S.Union(S.Number, S.Null),
+				active: S.Boolean,
+				format: S.Literal("json", "form", "xml"),
+				tenantId: S.Union(S.String, S.Null)
 			})),
-			execute: y.tryPromise({
+			execute: x.tryPromise({
 				try: async () => (await e.store.query({
 					table: "_voltro_webhook_targets",
-					predicate: C("id", a),
+					predicate: w("id", a),
 					order: [{
 						column: "createdAt",
 						direction: "asc"
@@ -770,7 +770,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 					event: s,
 					cause: String(e)
 				}), /* @__PURE__ */ Error(`fetch-target failed: ${e.message}`))
-			}).pipe(y.orDie)
+			}).pipe(x.orDie)
 		});
 		if (n === null) return {
 			finalStatus: "failed",
@@ -797,11 +797,11 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 		};
 		if (n.active !== !0) return yield* E.make({
 			name: "record-paused-pending",
-			success: x.Void,
-			execute: y.tryPromise({
+			success: S.Void,
+			execute: x.tryPromise({
 				try: () => r(`${i}:1`, 1, { status: "pending" }),
 				catch: (e) => /* @__PURE__ */ Error(`record-paused-pending failed: ${e.message}`)
-			}).pipe(y.orDie)
+			}).pipe(x.orDie)
 		}), {
 			finalStatus: "deferred",
 			attempts: 0
@@ -818,8 +818,8 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 			if (v.length > 0) for (let n = 0;; n++) {
 				let i = yield* E.make({
 					name: `rate-acquire-${t}-${n}`,
-					success: De,
-					execute: y.tryPromise({
+					success: Ae,
+					execute: x.tryPromise({
 						try: () => X(e.store, v, Date.now(), g),
 						catch: (e) => (u.debug("rate-acquire raw error", {
 							targetId: a,
@@ -827,19 +827,19 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 							attempt: t,
 							cause: String(e)
 						}), /* @__PURE__ */ Error(`rate-acquire failed: ${e.message}`))
-					}).pipe(y.orDie)
+					}).pipe(x.orDie)
 				});
 				if (i.acquired) break;
 				yield* E.make({
 					name: `record-rate-deferral-${t}-${n}`,
-					success: x.Void,
-					execute: y.tryPromise({
+					success: S.Void,
+					execute: x.tryPromise({
 						try: () => r(d, t, {
 							status: "pending",
 							nextAttemptAt: new Date(Date.now() + i.retryInMs)
 						}),
 						catch: (e) => /* @__PURE__ */ Error(`record-rate-deferral failed: ${e.message}`)
-					}).pipe(y.orDie)
+					}).pipe(x.orDie)
 				}), yield* D.sleep({
 					name: `rate-window-sleep-${t}-${n}`,
 					duration: `${i.retryInMs} millis`
@@ -847,20 +847,20 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 			}
 			yield* E.make({
 				name: `record-attempt-start-${t}`,
-				success: x.Void,
-				execute: y.tryPromise({
+				success: S.Void,
+				execute: x.tryPromise({
 					try: () => r(d, t, {
 						status: "inFlight",
 						nextAttemptAt: null,
 						scheduledAt: /* @__PURE__ */ new Date()
 					}),
 					catch: (e) => /* @__PURE__ */ Error(`record-attempt-start failed: ${e.message}`)
-				}).pipe(y.orDie)
+				}).pipe(x.orDie)
 			});
 			let _ = yield* E.make({
 				name: `sign-and-post-${t}`,
-				success: Te,
-				execute: y.promise(async () => {
+				success: Oe,
+				execute: x.promise(async () => {
 					let e = Date.now(), r;
 					try {
 						r = Z(n.format, l);
@@ -876,7 +876,7 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 						throw t;
 					}
 					let a = Buffer.from(r.bytes), { headerName: u, headerValue: d } = o(m, a, n.secret);
-					process.env.NODE_ENV === "production" && w(n.url);
+					process.env.NODE_ENV === "production" && T(n.url);
 					try {
 						let o = await fetch(n.url, {
 							method: "POST",
@@ -911,12 +911,12 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 						};
 					}
 				})
-			}), b = yield* E.make({
+			}), y = yield* E.make({
 				name: `classify-and-record-${t}`,
-				success: Ee,
-				execute: y.tryPromise({
+				success: ke,
+				execute: x.tryPromise({
 					try: async () => {
-						let r = _.status >= 200 && _.status < 300, i = _.transportError !== void 0, o = _.encodeError !== void 0, s = (t, n) => we(e.store, a, t, n);
+						let r = _.status >= 200 && _.status < 300, i = _.transportError !== void 0, o = _.encodeError !== void 0, s = (t, n) => De(e.store, a, t, n);
 						if (r) {
 							await e.store.update("_voltro_webhook_deliveries", d, {
 								status: "succeeded",
@@ -979,24 +979,24 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 						attempt: t,
 						cause: String(e)
 					}), /* @__PURE__ */ Error(`classify-and-record failed: ${e.message}`))
-				}).pipe(y.orDie)
+				}).pipe(x.orDie)
 			});
-			if (b.autoDisabled === !0 && u.warn("target auto-disabled after consecutive failures", {
+			if (y.autoDisabled === !0 && u.warn("target auto-disabled after consecutive failures", {
 				targetId: a,
 				event: s,
-				consecutiveFailures: b.consecutiveFailures ?? null,
-				reason: b.reason ?? null
-			}), b.outcome === "succeeded") return {
+				consecutiveFailures: y.consecutiveFailures ?? null,
+				reason: y.reason ?? null
+			}), y.outcome === "succeeded") return {
 				finalStatus: "succeeded",
 				attempts: t
 			};
-			if (b.outcome === "failed") return {
+			if (y.outcome === "failed") return {
 				finalStatus: "failed",
 				attempts: t
 			};
-			b.delayMs !== void 0 && (yield* D.sleep({
+			y.delayMs !== void 0 && (yield* D.sleep({
 				name: `retry-sleep-${t}`,
-				duration: `${b.delayMs} millis`
+				duration: `${y.delayMs} millis`
 			}));
 		}
 		return {
@@ -1006,4 +1006,4 @@ var ne = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, O = (e) => {
 	});
 };
 //#endregion
-export { R as IdempotencyCache, G as RATE_WINDOW_MS, W as RATE_WINDOW_TABLE, xe as TARGETS_TABLE, u as WebhookDeliveryNotFound, d as WebhookPayloadInvalid, f as WebhookPayloadUnrepresentable, p as WebhookPayloadVersionInvalid, m as WebhookSubscribeInvalid, M as WebhooksService, X as acquireRateSlots, ke as buildDeliverWebhookExecute, ce as buildWebhooksService, ae as compareVersions, J as consumeRateSlot, pe as defaultIncomingPath, c as defaultOutgoingSignature, j as defaultRetryPolicy, s as defineIncomingWebhook, t as defineOutgoingEvent, r as defineWebhookProvider, Oe as deliverWebhookWorkflow, Z as encodePayload, re as fastRetryPolicy, P as generateSecret, B as getIdempotencyCache, i as githubSignature, l as isWebhookDescriptor, L as matchesFilter, fe as mountIncomingWebhook, A as nextRetry, O as parseDuration, H as parseTtl, we as recordDeliveryOutcome, Y as releaseRateSlot, I as resolveSubscribe, o as signPayload, n as slackSignature, e as stripeSignature, ue as useWebhooks, le as useWebhooksEffect, F as validateSubscribe, a as verifySignature, h as webhookTables };
+export { R as IdempotencyCache, G as RATE_WINDOW_MS, W as RATE_WINDOW_TABLE, we as TARGETS_TABLE, u as WebhookDeliveryNotFound, d as WebhookPayloadInvalid, f as WebhookPayloadUnrepresentable, p as WebhookPayloadVersionInvalid, m as WebhookSubscribeInvalid, M as WebhooksService, h as _voltroWebhookDeliveriesTable, g as _voltroWebhookRateWindowsTable, _ as _voltroWebhookTargetsTable, X as acquireRateSlots, Me as buildDeliverWebhookExecute, de as buildWebhooksService, ce as compareVersions, J as consumeRateSlot, ge as defaultIncomingPath, c as defaultOutgoingSignature, j as defaultRetryPolicy, s as defineIncomingWebhook, t as defineOutgoingEvent, r as defineWebhookProvider, je as deliverWebhookWorkflow, Z as encodePayload, oe as fastRetryPolicy, P as generateSecret, B as getIdempotencyCache, i as githubSignature, l as isWebhookDescriptor, L as matchesFilter, he as mountIncomingWebhook, A as nextRetry, O as parseDuration, H as parseTtl, De as recordDeliveryOutcome, Y as releaseRateSlot, I as resolveSubscribe, o as signPayload, n as slackSignature, e as stripeSignature, pe as useWebhooks, fe as useWebhooksEffect, F as validateSubscribe, a as verifySignature, v as webhookTables };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-webhooks",
-  "version": "0.22.1",
+  "version": "0.23.0",
   "description": "Webhooks plugin — first-class outgoing (multi-target, durable-workflow delivery, HMAC signing, retry policies, rate limits) + incoming (signature verification, idempotency, provider templates for Stripe / GitHub / Slack / generic).",
   "keywords": [
     "voltro",
@@ -48,12 +48,12 @@
   },
   "dependencies": {
     "@effect/workflow": "^0.19.0",
-    "@voltro/database": "0.22.1",
-    "@voltro/integration-http": "0.22.1",
-    "@voltro/logger": "0.22.1",
-    "@voltro/plugin-multitenancy": "0.22.1",
-    "@voltro/protocol": "0.22.1",
-    "@voltro/runtime": "0.22.1"
+    "@voltro/database": "0.23.0",
+    "@voltro/integration-http": "0.23.0",
+    "@voltro/logger": "0.23.0",
+    "@voltro/plugin-multitenancy": "0.23.0",
+    "@voltro/protocol": "0.23.0",
+    "@voltro/runtime": "0.23.0"
   },
   "peerDependencies": {
     "effect": "^3.22.0"