@voltro/plugin-webhooks 0.32.0 → 0.34.0

package/dist/index.js

@@ -1,16 +1,23 @@
-import { a as e, c as t, i as n, l as r, n as i, o as a, r as o, s, t as c } from "./signing-DUG4JWwk.js";
-import { WebhookDeliveryNotFound as l, WebhookPayloadInvalid as u, WebhookPayloadUnrepresentable as d, WebhookPayloadVersionInvalid as f, WebhookSubscribeInvalid as p } from "./errors.js";
-import { _voltroWebhookDeliveriesTable as m, _voltroWebhookEventStatsTable as h, _voltroWebhookRateWindowsTable as g, _voltroWebhookTargetsTable as _, webhookTables as v } from "./mixin.js";
-import { randomBytes as y, randomUUID as b } from "node:crypto";
-import { Context as ee, Effect as x, Either as te, Schema as S } from "effect";
-import { and as C, eq as w } from "@voltro/database";
-import { assertPublicUrl as T } from "@voltro/integration-http";
-import { publishServerError as ne } from "@voltro/protocol";
-import { createLogger as E } from "@voltro/logger";
-import { Activity as D, DurableClock as O, Workflow as re } from "@effect/workflow";
-import { defineOutboxHandler as ie } from "@voltro/runtime";
-//#region src/eventAudience.ts
-var ae = (e) => e.webhook !== void 0, k = (e) => {
+import { C as e, E as t, S as n, T as r, _ as i, a, b as o, c as s, d as c, f as l, g as u, h as d, i as f, l as p, m, n as h, o as g, p as _, r as v, s as y, t as b, u as ee, v as te, w as ne, x as re, y as ie } from "./signing-DeHObNv6.js";
+import { WebhookDeliveryNotFound as ae, WebhookPayloadInvalid as x, WebhookPayloadUnrepresentable as S, WebhookPayloadVersionInvalid as C, WebhookSubscribeInvalid as w } from "./errors.js";
+import { _voltroWebhookDeliveriesTable as oe, _voltroWebhookEventStatsTable as se, _voltroWebhookRateWindowsTable as ce, _voltroWebhookTargetsTable as le, webhookTables as ue } from "./mixin.js";
+import { Context as de, Effect as T, Either as fe, Schema as E } from "effect";
+import { definePlugin as pe, publishServerError as me } from "@voltro/protocol";
+import { randomBytes as he, randomUUID as D } from "node:crypto";
+import { and as O, eq as k } from "@voltro/database";
+import { assertPublicUrl as ge } from "@voltro/integration-http";
+import { createLogger as A } from "@voltro/logger";
+import { Activity as j, DurableClock as M, Workflow as _e } from "@effect/workflow";
+import { defineOutboxHandler as ve } from "@voltro/runtime";
+//#region src/plugin.ts
+var N = ["network:outbound:*"], ye = (e = {}) => pe({
+	name: e.name ? `@voltro/plugin-webhooks#${e.name}` : "@voltro/plugin-webhooks",
+	description: "Outgoing webhooks (multi-target, durable-workflow delivery, HMAC signing, retry policies, rate limits) + incoming (signature verification, idempotency, provider templates). Declares wildcard outbound network access because targets are user-configured URLs.",
+	permissions: N,
+	onActivate: (e) => T.sync(() => {
+		e.logger.info("webhooks active", { outbound: "network:outbound:* (subscriber-configured target URLs — audit visibility, not a restriction)" });
+	})
+}), be = (e) => e.webhook !== void 0, P = (e) => {
 	let t = e.webhook;
 	if (t !== void 0) return {
 		_tag: "outgoingEvent",
@@ -20,8 +27,8 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		...t.version === void 0 ? {} : { version: t.version },
 		...t.rateLimit === void 0 ? {} : { globalRateLimit: t.rateLimit }
 	};
-}, oe = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, A = (e) => {
-	let t = oe.exec(e);
+}, xe = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, F = (e) => {
+	let t = xe.exec(e);
 	if (!t) throw Error(`invalid duration literal: ${e}`);
 	let n = Number(t[1]), r = t[2] ?? "s";
 	switch (r) {
@@ -32,7 +39,7 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		case "d": return n * 864e5;
 		default: throw Error(`unreachable unit: ${r}`);
 	}
-}, j = [
+}, I = [
 	408,
 	425,
 	429,
@@ -40,16 +47,16 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 	502,
 	503,
 	504
-], M = (e, t, n) => {
-	if (t >= e.maxAttempts || n?.status !== void 0 && !(e.retryOn ?? j).includes(n.status)) return null;
+], L = (e, t, n) => {
+	if (t >= e.maxAttempts || n?.status !== void 0 && !(e.retryOn ?? I).includes(n.status)) return null;
 	if (e.honourRetryAfter !== !1 && n?.retryAfterSeconds !== void 0) {
-		let t = n.retryAfterSeconds * 1e3, r = A(e.maxDelay), i = Math.min(t, r);
+		let t = n.retryAfterSeconds * 1e3, r = F(e.maxDelay), i = Math.min(t, r);
 		return {
 			delayMs: i,
 			baseDelayMs: i
 		};
 	}
-	let r = A(e.initialDelay), i = A(e.maxDelay), a;
+	let r = F(e.initialDelay), i = F(e.maxDelay), a;
 	switch (e.strategy) {
 		case "fixed":
 			a = r;
@@ -67,111 +74,118 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		delayMs: Math.max(1, Math.floor(o)),
 		baseDelayMs: a
 	};
-}, se = () => ({
+}, R = () => ({
 	strategy: "exponential",
 	maxAttempts: 8,
 	initialDelay: "5s",
 	maxDelay: "1h",
-	retryOn: j,
+	retryOn: I,
 	honourRetryAfter: !0,
 	jitter: "full"
-}), ce = () => ({
+}), Se = () => ({
 	strategy: "fixed",
 	maxAttempts: 120,
 	initialDelay: "30s",
 	maxDelay: "30s",
-	retryOn: j,
+	retryOn: I,
 	honourRetryAfter: !0,
 	jitter: "full"
-}), N = class extends ee.Tag("@voltro/webhooks/WebhooksService")() {}, le = 32, P = 32, F = () => y(le).toString("hex"), I = (e) => e.events ?? (e.event === void 0 ? [] : [e.event]), L = (e) => {
+}), Ce = class extends de.Tag("@voltro/webhooks/WebhooksService")() {}, we = 32, Te = 32, z = () => he(we).toString("hex"), B = (e) => e.events ?? (e.event === void 0 ? [] : [e.event]), V = (e) => {
 	let t;
 	try {
 		t = new URL(e.url);
 	} catch (e) {
-		throw new p({
+		throw new w({
 			field: "url",
 			reason: `invalid subscriber url: ${e.message}`
 		});
 	}
-	if (t.protocol !== "http:" && t.protocol !== "https:") throw new p({
+	if (t.protocol !== "http:" && t.protocol !== "https:") throw new w({
 		field: "url",
 		reason: `url protocol must be http or https, got ${t.protocol}`
 	});
 	if (process.env.NODE_ENV === "production") try {
-		T(e.url);
+		ge(e.url);
 	} catch (e) {
-		throw new p({
+		throw new w({
 			field: "url",
 			reason: e.message
 		});
 	}
-	let n = I(e);
-	if (n.length === 0) throw new p({
+	let n = B(e);
+	if (n.length === 0) throw new w({
 		field: "event",
 		reason: "event id required"
 	});
-	if (e.event !== void 0 && e.events !== void 0) throw new p({
+	if (e.event !== void 0 && e.events !== void 0) throw new w({
 		field: "event",
 		reason: "pass `event` OR `events`, not both — the row set would be ambiguous"
 	});
-	if (n.some((e) => e.length === 0)) throw new p({
+	if (n.some((e) => e.length === 0)) throw new w({
 		field: "events",
 		reason: "event id required"
 	});
-	if (new Set(n).size !== n.length) throw new p({
+	if (new Set(n).size !== n.length) throw new w({
 		field: "events",
 		reason: "duplicate event — one row per event, so a repeat would deliver twice"
 	});
-	if (e.secret !== void 0 && e.secret.length < P) throw new p({
+	if (e.secret !== void 0 && e.secret.length < Te) throw new w({
 		field: "secret",
-		reason: `secret must be at least ${P} chars`
+		reason: `secret must be at least ${Te} chars`
+	});
+	if (e.secret !== void 0 && e.signing?._tag === "standardWebhooks" && !te(e.secret)) throw new w({
+		field: "secret",
+		reason: "a standard-webhooks target needs the spec's secret serialization (\"whsec_\" + base64 of 24..64 random bytes) — mint one with generateStandardWebhooksSecret(), or omit `secret` and let subscribe mint it"
 	});
 	if (e.retry !== void 0) {
-		if (e.retry.maxAttempts < 1) throw new p({
+		if (e.retry.maxAttempts < 1) throw new w({
 			field: "retry",
 			reason: "retry.maxAttempts must be ≥ 1"
 		});
-		if (e.retry.maxAttempts > 1e3) throw new p({
+		if (e.retry.maxAttempts > 1e3) throw new w({
 			field: "retry",
 			reason: "retry.maxAttempts must be ≤ 1000"
 		});
 	}
-	if (e.rateLimitPerMinute !== void 0 && e.rateLimitPerMinute < 1) throw new p({
+	if (e.rateLimitPerMinute !== void 0 && e.rateLimitPerMinute < 1) throw new w({
 		field: "rateLimitPerMinute",
 		reason: "rateLimitPerMinute must be ≥ 1"
 	});
-	if (e.autoDisableAfter !== void 0 && (e.autoDisableAfter < 1 || !Number.isInteger(e.autoDisableAfter))) throw new p({
+	if (e.autoDisableAfter !== void 0 && (e.autoDisableAfter < 1 || !Number.isInteger(e.autoDisableAfter))) throw new w({
 		field: "autoDisableAfter",
 		reason: `autoDisableAfter must be a positive integer, got ${e.autoDisableAfter}`
 	});
-}, ue = (e, t, n, r) => ({
-	id: b(),
-	tenantId: e.tenantId ?? null,
-	event: n ?? e.event ?? "",
-	url: e.url,
-	secret: r ?? e.secret ?? F(),
-	signing: e.signing ?? t?.defaultSigning ?? c(),
-	retry: e.retry ?? t?.defaultRetry ?? se(),
-	filter: e.filter ?? null,
-	scope: e.scope ?? null,
-	headers: e.headers ?? null,
-	rateLimitPerMinute: e.rateLimitPerMinute ?? null,
-	active: !0,
-	format: e.format ?? "json",
-	autoDisableAfter: e.autoDisableAfter ?? null,
-	consecutiveFailures: 0,
-	autoDisabledAt: null,
-	autoDisableReason: null,
-	payloadVersion: e.payloadVersion ?? t?.version ?? 1,
-	description: e.description ?? null
-}), de = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, R = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : null, fe = (e) => {
+}, Ee = (e, t, n, r) => {
+	let a = e.signing ?? t?.defaultSigning ?? b(), o = a._tag === "standardWebhooks" ? i : z;
+	return {
+		id: D(),
+		tenantId: e.tenantId ?? null,
+		event: n ?? e.event ?? "",
+		url: e.url,
+		secret: r ?? e.secret ?? o(),
+		signing: a,
+		retry: e.retry ?? t?.defaultRetry ?? R(),
+		filter: e.filter ?? null,
+		scope: e.scope ?? null,
+		headers: e.headers ?? null,
+		rateLimitPerMinute: e.rateLimitPerMinute ?? null,
+		active: !0,
+		format: e.format ?? "json",
+		autoDisableAfter: e.autoDisableAfter ?? null,
+		consecutiveFailures: 0,
+		autoDisabledAt: null,
+		autoDisableReason: null,
+		payloadVersion: e.payloadVersion ?? t?.version ?? 1,
+		description: e.description ?? null
+	};
+}, De = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, H = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : null, Oe = (e) => {
 	if (typeof e != "string") return e;
 	try {
 		return JSON.parse(e);
 	} catch {
 		return e;
 	}
-}, pe = (e) => ({
+}, U = (e) => ({
 	id: String(e.id),
 	deliveryId: String(e.deliveryId),
 	targetId: String(e.targetId),
@@ -182,28 +196,28 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 	responseStatus: e.responseStatus ?? null,
 	errorMessage: e.errorMessage ?? null,
 	latencyMs: e.latencyMs ?? null,
-	scheduledAt: R(e.scheduledAt),
-	nextAttemptAt: R(e.nextAttemptAt),
-	createdAt: R(e.createdAt)
-}), me = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", he = (e, t) => {
+	scheduledAt: H(e.scheduledAt),
+	nextAttemptAt: H(e.nextAttemptAt),
+	createdAt: H(e.createdAt)
+}), ke = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", Ae = (e, t) => {
 	if (e === null) return !0;
 	let n = { payload: t };
-	for (let [t, r] of Object.entries(e)) if (!_e(ge(n, t), r)) return !1;
+	for (let [t, r] of Object.entries(e)) if (!Me(je(n, t), r)) return !1;
 	return !0;
-}, ge = (e, t) => {
+}, je = (e, t) => {
 	let n = t.split("."), r = e;
 	for (let e of n) {
 		if (typeof r != "object" || !r) return;
 		r = r[e];
 	}
 	return r;
-}, z = (e, t) => {
+}, W = (e, t) => {
 	if (typeof e == "number" && typeof t == "number") return e - t;
 	if (typeof e == "string" && typeof t == "string") return e < t ? -1 : +(e > t);
-}, _e = (e, t) => {
+}, Me = (e, t) => {
 	if (typeof t == "object" && t && !Array.isArray(t)) {
 		let n = t;
-		return "eq" in n && e !== n.eq || "in" in n && (!Array.isArray(n.in) || !n.in.includes(e)) || "gt" in n && !((z(e, n.gt) ?? 0) > 0) || "gte" in n && !((z(e, n.gte) ?? -1) >= 0) || "lt" in n && !((z(e, n.lt) ?? 0) < 0) || "lte" in n && !((z(e, n.lte) ?? 1) <= 0) ? !1 : [
+		return "eq" in n && e !== n.eq || "in" in n && (!Array.isArray(n.in) || !n.in.includes(e)) || "gt" in n && !((W(e, n.gt) ?? 0) > 0) || "gte" in n && !((W(e, n.gte) ?? -1) >= 0) || "lt" in n && !((W(e, n.lt) ?? 0) < 0) || "lte" in n && !((W(e, n.lte) ?? 1) <= 0) ? !1 : [
 			"eq",
 			"in",
 			"gt",
@@ -213,9 +227,9 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		].some((e) => e in n);
 	}
 	return e === t;
-}, B = (e, t) => e !== null && Object.entries(t).every(([t, n]) => e[t] === n), V = 500, H = 200, U = async (e, t) => {
+}, Ne = (e, t) => e !== null && Object.entries(t).every(([t, n]) => e[t] === n), G = 500, Pe = 200, K = async (e, t) => {
 	let n = [];
-	for (let r = 0; r < H; r += 1) {
+	for (let r = 0; r < Pe; r += 1) {
 		let i = await e.store.query({
 			table: "_voltro_webhook_targets",
 			predicate: t,
@@ -223,24 +237,24 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 				column: "id",
 				direction: "asc"
 			}],
-			take: V,
-			skip: r === 0 ? void 0 : r * V,
+			take: G,
+			skip: r === 0 ? void 0 : r * G,
 			projection: void 0
 		});
-		if (n.push(...i), i.length < V) return n;
+		if (n.push(...i), i.length < G) return n;
 	}
-	throw Error(`webhooks: more than ${H * V} rows in \`_voltro_webhook_targets\` — refusing to answer a scope lookup from a partial scan. A truncated scan mints a fresh secret for a live endpoint (breaking its signatures) or reports that a real scope matches nothing.`);
-}, ve = async (e, t) => {
-	let n = (await U(e)).filter((e) => B(e.scope, t));
+	throw Error(`webhooks: more than ${Pe * G} rows in \`_voltro_webhook_targets\` — refusing to answer a scope lookup from a partial scan. A truncated scan mints a fresh secret for a live endpoint (breaking its signatures) or reports that a real scope matches nothing.`);
+}, Fe = async (e, t) => {
+	let n = (await K(e)).filter((e) => Ne(e.scope, t));
 	if (n.length === 0) return;
 	let r = new Set(n.map((e) => e.secret));
 	if (r.size > 1) throw Error(`webhooks.subscribe: the scope ${JSON.stringify(t)} matches ${n.length} targets with ${r.size} different secrets, so it is not one endpoint. Pass \`secret\` explicitly, or narrow the scope.`);
 	return [...r][0];
-}, ye = async (e, t) => {
+}, Ie = async (e, t) => {
 	try {
 		let n = await e.store.query({
 			table: "_voltro_webhook_event_stats",
-			predicate: w("event", t),
+			predicate: k("event", t),
 			order: [],
 			take: 1,
 			skip: void 0,
@@ -262,11 +276,11 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 			updatedAt: r
 		});
 	} catch {}
-}, be = (e, t, n = {}) => {
+}, Le = (e, t, n = {}) => {
 	let r = new Map((n.events ?? []).map((e) => [e.id, e])), i = {
 		subscribe: async (t) => {
-			L(t);
-			let n = I(t), i = t.secret === void 0 && t.scope !== void 0 ? await ve(e, t.scope) : void 0, a = t.secret ?? i ?? F(), o = n.map((e) => ue(t, r.get(e), e, a));
+			V(t);
+			let n = B(t), i = t.secret === void 0 && t.scope !== void 0 ? await Fe(e, t.scope) : void 0, a = t.secret ?? i ?? z(), o = n.map((e) => Ee(t, r.get(e), e, a));
 			for (let t of o) await e.store.insert("_voltro_webhook_targets", {
 				...t,
 				createdAt: /* @__PURE__ */ new Date(),
@@ -287,26 +301,26 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 			};
 		},
 		emit: async (n, i, a) => {
-			let o = typeof n == "object" && n.kind === "event" ? k(n) : void 0, s = typeof n == "string" ? r.get(n) : o ?? n, c = typeof n == "string" ? n : n.id ?? n.name;
+			let o = typeof n == "object" && n.kind === "event" ? P(n) : void 0, s = typeof n == "string" ? r.get(n) : o ?? n, c = typeof n == "string" ? n : n.id ?? n.name;
 			if (s !== void 0) {
-				let e = S.decodeUnknownEither(s.payload)(i, { errors: "all" });
-				if (te.isLeft(e)) throw new u({
+				let e = E.decodeUnknownEither(s.payload)(i, { errors: "all" });
+				if (fe.isLeft(e)) throw new x({
 					event: c,
 					issues: e.left.message
 				});
 			}
-			let l = b(), d = a?.tenantId, f = await U(e, d == null ? w("event", c) : C(w("event", c), w("tenantId", d)));
-			await ye(e, c);
-			let p = f.filter((e) => he(e.filter, i)), m = [], h = JSON.stringify(i);
-			for (let n of p) {
-				let r = b();
+			let l = D(), u = a?.tenantId, d = await K(e, u == null ? k("event", c) : O(k("event", c), k("tenantId", u)));
+			await Ie(e, c);
+			let f = d.filter((e) => Ae(e.filter, i)), p = [], m = JSON.stringify(i);
+			for (let n of f) {
+				let r = D();
 				n.active ? (await t({
 					deliveryId: r,
 					targetId: n.id,
 					event: c,
 					eventId: l,
-					payloadJson: h
-				}), m.push({
+					payloadJson: m
+				}), p.push({
 					targetId: n.id,
 					deliveryId: r,
 					status: "dispatched"
@@ -319,11 +333,11 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 					eventId: l,
 					attempt: 1,
 					status: "pending",
-					payload: h,
+					payload: m,
 					scheduledAt: /* @__PURE__ */ new Date(),
 					createdAt: /* @__PURE__ */ new Date(),
 					updatedAt: /* @__PURE__ */ new Date()
-				}), m.push({
+				}), p.push({
 					targetId: n.id,
 					deliveryId: r,
 					status: "queued"
@@ -331,13 +345,13 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 			}
 			return {
 				eventId: l,
-				deliveries: m
+				deliveries: p
 			};
 		},
 		replay: async (n) => {
 			let r = (await e.store.query({
 				table: "_voltro_webhook_deliveries",
-				predicate: w("deliveryId", n),
+				predicate: k("deliveryId", n),
 				order: [{
 					column: "attempt",
 					direction: "asc"
@@ -346,19 +360,19 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 				skip: void 0,
 				projection: void 0
 			}))[0];
-			if (r === void 0) throw new l({ deliveryId: n });
+			if (r === void 0) throw new ae({ deliveryId: n });
 			await t({
 				deliveryId: r.deliveryId,
 				targetId: r.targetId,
 				event: r.event,
-				eventId: r.eventId ?? b(),
+				eventId: r.eventId ?? D(),
 				payloadJson: typeof r.payload == "string" ? r.payload : JSON.stringify(r.payload),
 				attemptEpoch: Date.now()
 			});
 		},
 		resolveTargets: async (t) => {
 			if (typeof t == "string") return [t];
-			let n = (await U(e)).filter((e) => B(e.scope, t.scope)).map((e) => e.id);
+			let n = (await K(e)).filter((e) => Ne(e.scope, t.scope)).map((e) => e.id);
 			if (n.length === 0) throw Error(`webhooks: no target matches scope ${JSON.stringify(t.scope)} — the operation would have silently done nothing`);
 			return n;
 		},
@@ -379,7 +393,7 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 				});
 				let n = await e.store.query({
 					table: "_voltro_webhook_deliveries",
-					predicate: C(w("targetId", r), w("status", "pending")),
+					predicate: O(k("targetId", r), k("status", "pending")),
 					order: [{
 						column: "createdAt",
 						direction: "asc"
@@ -392,17 +406,17 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 					deliveryId: e.deliveryId,
 					targetId: r,
 					event: e.event,
-					eventId: e.eventId ?? b(),
+					eventId: e.eventId ?? D(),
 					payloadJson: typeof e.payload == "string" ? e.payload : JSON.stringify(e.payload),
 					attemptEpoch: i
 				});
 			}
 		},
 		deleteTarget: async (t) => {
-			for (let n of await i.resolveTargets(t)) await e.store.delete("_voltro_webhook_targets", n), await e.store.deleteMany("_voltro_webhook_deliveries", { where: C(w("targetId", n), w("status", "pending")) });
+			for (let n of await i.resolveTargets(t)) await e.store.delete("_voltro_webhook_targets", n), await e.store.deleteMany("_voltro_webhook_deliveries", { where: O(k("targetId", n), k("status", "pending")) });
 		},
 		rotateSecret: async (t) => {
-			let n = F();
+			let n = z();
 			for (let r of await i.resolveTargets(t)) await e.store.update("_voltro_webhook_targets", r, {
 				secret: n,
 				updatedAt: /* @__PURE__ */ new Date()
@@ -410,7 +424,7 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 			return { secret: n };
 		},
 		updateTarget: async (t, n) => {
-			if (n.url !== void 0 && L({
+			if (n.url !== void 0 && V({
 				event: "x",
 				url: n.url
 			}), n.rateLimitPerMinute !== void 0 && n.rateLimitPerMinute !== null && (!Number.isInteger(n.rateLimitPerMinute) || n.rateLimitPerMinute < 1)) throw Error("updateTarget: rateLimitPerMinute must be a positive integer or null");
@@ -430,14 +444,14 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		testTarget: async (n, r) => {
 			let i = (await e.store.query({
 				table: "_voltro_webhook_targets",
-				predicate: w("id", n),
+				predicate: k("id", n),
 				order: [],
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			}))[0];
 			if (i === void 0) throw Error(`testTarget: no target ${n}`);
-			let a = b(), o = JSON.stringify(r ?? {
+			let a = D(), o = JSON.stringify(r ?? {
 				test: !0,
 				targetId: n,
 				at: (/* @__PURE__ */ new Date()).toISOString()
@@ -446,7 +460,7 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 				deliveryId: a,
 				targetId: i.id,
 				event: i.event,
-				eventId: b(),
+				eventId: D(),
 				payloadJson: o
 			}) : await e.store.insert("_voltro_webhook_deliveries", {
 				id: `${a}:1`,
@@ -466,7 +480,7 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		listDeliveries: async (t) => {
 			let n = t?.scope === void 0 ? void 0 : new Set(await i.resolveTargets({ scope: t.scope })), r = await e.store.query({
 				table: "_voltro_webhook_deliveries",
-				predicate: t?.targetId === void 0 ? void 0 : w("targetId", t.targetId),
+				predicate: t?.targetId === void 0 ? void 0 : k("targetId", t.targetId),
 				order: [{
 					column: "createdAt",
 					direction: "desc"
@@ -475,25 +489,25 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 				skip: void 0,
 				projection: void 0
 			}), a = t?.since?.getTime();
-			return r.filter((e) => n === void 0 || n.has(String(e.targetId))).filter((e) => t?.status === void 0 || e.status === t.status).filter((e) => a === void 0 || de(e.createdAt) >= a).slice(0, t?.limit ?? 200).map(pe);
+			return r.filter((e) => n === void 0 || n.has(String(e.targetId))).filter((e) => t?.status === void 0 || e.status === t.status).filter((e) => a === void 0 || De(e.createdAt) >= a).slice(0, t?.limit ?? 200).map(U);
 		},
 		getDelivery: async (t) => {
 			let n = (await e.store.query({
 				table: "_voltro_webhook_deliveries",
-				predicate: w("id", t),
+				predicate: k("id", t),
 				order: [],
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			}))[0];
 			return n === void 0 ? null : {
-				...pe(n),
-				payload: fe(n.payload),
+				...U(n),
+				payload: Oe(n.payload),
 				responseBody: n.responseBody ?? null
 			};
 		},
 		updateTargetPayloadVersion: async (t, n) => {
-			if (n < 1 || !Number.isInteger(n)) throw new f({ version: n });
+			if (n < 1 || !Number.isInteger(n)) throw new C({ version: n });
 			await e.store.update("_voltro_webhook_targets", t, {
 				payloadVersion: n,
 				updatedAt: /* @__PURE__ */ new Date()
@@ -502,7 +516,7 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		listTargets: async (t, n) => {
 			let r = await e.store.query({
 				table: "_voltro_webhook_targets",
-				predicate: t === void 0 ? void 0 : w("event", t),
+				predicate: t === void 0 ? void 0 : k("event", t),
 				order: [{
 					column: "createdAt",
 					direction: "desc"
@@ -528,15 +542,15 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		}
 	};
 	return i;
-}, xe = x.gen(function* () {
-	return yield* N;
-}), Se = (e) => {
+}, Re = T.gen(function* () {
+	return yield* Ce;
+}), ze = (e) => {
 	if (e.webhooks === void 0) throw Error("useWebhooks: `ctx.webhooks` is not set. Add @voltro/plugin-webhooks to your app.config.ts plugin list and declare at least one *.webhook.tsx file.");
 	return e.webhooks;
-}, Ce = 1e4, W = class {
+}, Be = 1e4, Ve = class {
 	capacity;
 	cache = /* @__PURE__ */ new Map();
-	constructor(e = Ce) {
+	constructor(e = Be) {
 		this.capacity = e;
 	}
 	evictExpired() {
@@ -571,20 +585,36 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 	clear() {
 		this.cache.clear();
 	}
-}, G = null, K = () => (G === null && (G = new W()), G), q = {
+}, q = null, He = () => (q === null && (q = new Ve()), q), J = {
 	"5m": 5 * 6e4,
 	"1h": 60 * 6e4,
 	"6h": 360 * 6e4,
 	"1d": 1440 * 6e4,
 	"7d": 10080 * 6e4,
 	"30d": 720 * 60 * 6e4
-}, J = (e) => e === void 0 ? q["7d"] : q[e] ?? q["7d"], Y = (e, t) => ({
+}, Ue = (e) => e === void 0 ? J["7d"] : J[e] ?? J["7d"], Y = (e, t) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t)
-}), we = (e, t) => {
-	let n = e.provider, r = e.signature ?? n?.signature ?? null, i = e.idempotency ?? n?.idempotency ?? null, o = e.bodyType ?? n?.bodyType ?? "json", s = t.idempotencyCache ?? K(), c = J(i?.ttl), l = t.log ?? ((e) => {
-		E({ scope: `webhook:${e.webhookId}` }).debug("incoming webhook", {
+}), We = "voltroWebhookVerification", Ge = class extends Error {
+	webhookId;
+	name = "UnverifiedIncomingWebhook";
+	constructor(e) {
+		super(`incoming webhook '${e}' declares no verification. It would be mounted as a public, unauthenticated POST that runs your application code, so the framework refuses to mount it. Pick one on the descriptor:\n  · provider: stripeWebhookProvider()   — a preset (HMAC scheme + idempotency + body type)\n  · signature: { _tag: 'hmac', algorithm: 'hmacSha256', header: 'X-Signature', encoding: 'hex', includeTimestamp: true }\n  · verification: 'provider'            — the handler verifies with the provider's own SDK\n  · verification: 'none'                — deliberately public; a gateway / IP allow-list owns it\nA signature-verified webhook reads its shared secret from VOLTRO_WEBHOOK_SECRET_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}. The framework never invents that value — the sender holds the other half of it.`), this.webhookId = e;
+	}
+}, Ke = (e) => `VOLTRO_WEBHOOK_SECRET_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, qe = (e) => {
+	let t = e.signature ?? e.provider?.signature ?? null;
+	return (e.verification === void 0 || e.verification === "signature") && t === null ? null : e.verification ?? "signature";
+}, Je = (e, t) => {
+	let n = e.provider, r = e.signature ?? n?.signature ?? null, i = e.idempotency ?? n?.idempotency ?? null, a = e.bodyType ?? n?.bodyType ?? "json", o = qe(e);
+	if (o === null) throw new Ge(e.id);
+	let c = o;
+	c === "none" && A({ scope: `webhook:${e.id}` }).warn("incoming webhook mounted WITHOUT verification — anyone who can reach this URL can run its handler", {
+		webhookId: e.id,
+		verification: "none"
+	});
+	let l = t.idempotencyCache ?? He(), u = Ue(i?.ttl), d = t.log ?? ((e) => {
+		A({ scope: `webhook:${e.webhookId}` }).debug("incoming webhook", {
 			status: e.status,
 			signatureOk: e.signatureOk,
 			idempotency: e.idempotency,
@@ -592,115 +622,129 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 			...e.errorMessage === void 0 ? {} : { errorMessage: e.errorMessage }
 		});
 	});
-	return async (n) => {
-		let u = Date.now();
+	return Object.assign(async (n) => {
+		let o = Date.now();
 		if (n.method !== "POST") {
 			let t = Y(405, {
 				error: "method not allowed",
 				expected: "POST"
 			});
-			return l({
+			return d({
 				webhookId: e.id,
 				status: 405,
 				signatureOk: "skipped",
 				idempotency: "skipped",
-				durationMs: Date.now() - u
+				durationMs: Date.now() - o
 			}), t;
 		}
-		let d = "skipped";
-		if (r !== null) {
+		let f = "skipped";
+		if (r !== null && c === "signature") {
 			let i = await t.resolveSecret(e.id);
-			if (i === null) d = "skipped";
-			else {
-				let t = n.headers[r.header.toLowerCase()], o = t;
-				r._tag === "custom" && n.headers["x-slack-request-timestamp"] && (o = `${n.headers["x-slack-request-timestamp"]}|${t ?? ""}`);
-				let s = a(r, n.rawBody, i, o);
-				if (d = s.ok, !s.ok) {
-					let t = Y(401, {
+			if (i === null) {
+				let t = `no signing secret configured — set ${Ke(e.id)}`, n = Y(503, {
+					error: "webhook not configured",
+					reason: t
+				});
+				return d({
+					webhookId: e.id,
+					status: 503,
+					signatureOk: !1,
+					idempotency: "skipped",
+					durationMs: Date.now() - o,
+					errorMessage: t
+				}), n;
+			} else {
+				let t = s(r, {
+					rawBody: n.rawBody,
+					secret: i,
+					headers: n.headers
+				});
+				if (f = t.ok, !t.ok) {
+					let n = Y(401, {
 						error: "invalid signature",
-						reason: s.reason
+						reason: t.reason
 					});
-					return l({
+					return d({
 						webhookId: e.id,
 						status: 401,
 						signatureOk: !1,
 						idempotency: "skipped",
-						durationMs: Date.now() - u,
-						errorMessage: s.reason
-					}), t;
+						durationMs: Date.now() - o,
+						errorMessage: t.reason
+					}), n;
 				}
 			}
 		}
-		let f;
+		let p;
 		try {
-			if (o === "json") {
+			if (a === "json") {
 				let e = new TextDecoder().decode(n.rawBody);
-				f = e.length === 0 ? null : JSON.parse(e);
-			} else if (o === "form") {
+				p = e.length === 0 ? null : JSON.parse(e);
+			} else if (a === "form") {
 				let e = new TextDecoder().decode(n.rawBody), t = new URLSearchParams(e), r = {};
 				for (let [e, n] of t.entries()) r[e] = n;
-				f = r;
-			} else f = n.rawBody;
+				p = r;
+			} else p = n.rawBody;
 		} catch (t) {
 			let n = Y(400, {
 				error: "malformed body",
 				reason: t.message
 			});
-			return l({
+			return d({
 				webhookId: e.id,
 				status: 400,
-				signatureOk: d,
+				signatureOk: f,
 				idempotency: "skipped",
-				durationMs: Date.now() - u,
+				durationMs: Date.now() - o,
 				errorMessage: t.message
 			}), n;
 		}
-		let p;
+		let m;
 		try {
-			p = S.decodeUnknownSync(e.payload)(f);
+			m = E.decodeUnknownSync(e.payload)(p);
 		} catch (t) {
 			let n = Y(422, {
 				error: "schema validation failed",
 				reason: t.message
 			});
-			return l({
+			return d({
 				webhookId: e.id,
 				status: 422,
-				signatureOk: d,
+				signatureOk: f,
 				idempotency: "skipped",
-				durationMs: Date.now() - u,
+				durationMs: Date.now() - o,
 				errorMessage: t.message
 			}), n;
 		}
-		let m, h = "skipped";
+		let h, g = "skipped";
 		if (i !== null) {
 			let t = i.from;
-			if (m = typeof t == "string" ? n.headers[t.toLowerCase()] : t(n.headers, n.rawBody), m !== void 0 && m.length > 0) {
-				let t = s.claim(m, c);
-				if (h = t, t === "duplicate") {
+			if (h = typeof t == "string" ? n.headers[t.toLowerCase()] : t(n.headers, n.rawBody), h !== void 0 && h.length > 0) {
+				let t = l.claim(h, u);
+				if (g = t, t === "duplicate") {
 					let t = Y(200, {
 						received: !0,
 						duplicate: !0
 					});
-					return l({
+					return d({
 						webhookId: e.id,
 						status: 200,
-						signatureOk: d,
+						signatureOk: f,
 						idempotency: "duplicate",
-						durationMs: Date.now() - u
+						durationMs: Date.now() - o
 					}), t;
 				}
 				if (t === "inflight") {
 					let t = Y(409, {
 						error: "request already in flight",
-						idempotencyKey: m
+						idempotencyKey: h
 					});
-					return l({
+					return d({
 						webhookId: e.id,
 						status: 409,
-						signatureOk: d,
+						signatureOk: f,
 						idempotency: "inflight",
-						durationMs: Date.now() - u
+						durationMs: Date.now() - o
 					}), t;
 				}
 			}
@@ -708,55 +752,55 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		try {
 			let r = t.resolveWorkflows?.();
 			await e.handler({
-				body: p,
+				body: m,
 				rawBody: n.rawBody,
 				headers: n.headers,
-				idempotencyKey: m ?? "",
+				idempotencyKey: h ?? "",
 				...r ? { workflows: r } : {}
-			}), m !== void 0 && s.commit(m);
+			}), h !== void 0 && l.commit(h);
 			let i = Y(200, { received: !0 });
-			return l({
+			return d({
 				webhookId: e.id,
 				status: 200,
-				signatureOk: d,
-				idempotency: h,
-				durationMs: Date.now() - u
+				signatureOk: f,
+				idempotency: g,
+				durationMs: Date.now() - o
 			}), i;
 		} catch (t) {
-			m !== void 0 && s.release(m);
+			h !== void 0 && l.release(h);
 			let n = Y(500, {
 				error: "handler threw",
 				reason: t.message
 			});
-			return l({
+			return d({
 				webhookId: e.id,
 				status: 500,
-				signatureOk: d,
-				idempotency: h,
-				durationMs: Date.now() - u,
+				signatureOk: f,
+				idempotency: g,
+				durationMs: Date.now() - o,
 				errorMessage: t.message
-			}), ne({
+			}), me({
 				error: t,
 				source: "webhook",
 				name: e.id,
 				fields: { status: 500 }
 			}), n;
 		}
-	};
-}, Te = (e) => `/webhooks/${e}`, Ee = "_voltro_webhook_rate_windows", De = 6e4, Oe = (e, t) => `${e}@${t}`, ke = async (e, t, n) => (await e.query({
+	}, { [We]: c });
+}, Ye = (e) => `/webhooks/${e}`, Xe = "_voltro_webhook_rate_windows", Ze = 6e4, Qe = (e, t) => `${e}@${t}`, $e = async (e, t, n) => (await e.query({
 	table: "_voltro_webhook_rate_windows",
-	predicate: C(w("scope", t), w("bucket", n)),
+	predicate: O(k("scope", t), k("bucket", n)),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, X = 32, Ae = async (e, t, n) => {
+}))[0] ?? null, X = 32, et = async (e, t, n) => {
 	for (let r = 0; r < X; r++) {
 		r > 0 && await new Promise((e) => setTimeout(e, r));
-		let i = await ke(e, t.key, n);
+		let i = await $e(e, t.key, n);
 		if (i === null) {
-			await e.insertIgnore(Ee, {
-				id: Oe(t.key, n),
+			await e.insertIgnore(Xe, {
+				id: Qe(t.key, n),
 				scope: t.key,
 				bucket: n,
 				count: 0,
@@ -769,31 +813,31 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		if (await e.updateMany("_voltro_webhook_rate_windows", {
 			count: i.count + 1,
 			updatedAt: /* @__PURE__ */ new Date()
-		}, { where: C(w("id", i.id), w("count", i.count)) }) === 1) return !0;
+		}, { where: O(k("id", i.id), k("count", i.count)) }) === 1) return !0;
 	}
 	throw Error(`webhook rate window: contention on (${t.key}, ${n}) exceeded ${X} attempts`);
-}, je = async (e, t, n) => {
+}, tt = async (e, t, n) => {
 	for (let r = 0; r < X; r++) {
 		r > 0 && await new Promise((e) => setTimeout(e, r));
-		let i = await ke(e, t, n);
+		let i = await $e(e, t, n);
 		if (i === null || i.count <= 0 || await e.updateMany("_voltro_webhook_rate_windows", {
 			count: i.count - 1,
 			updatedAt: /* @__PURE__ */ new Date()
-		}, { where: C(w("id", i.id), w("count", i.count)) }) === 1) return;
+		}, { where: O(k("id", i.id), k("count", i.count)) }) === 1) return;
 	}
 	throw Error(`webhook rate window: release contention on (${t}) exceeded ${X} attempts`);
-}, Me = async (e, t, n, r = De) => {
+}, nt = async (e, t, n, r = Ze) => {
 	if (t.length === 0) return {
 		acquired: !0,
 		retryInMs: 0
 	};
 	let i = Math.floor(n / r), a = [];
 	for (let o of t) {
-		if (await Ae(e, o, i)) {
+		if (await et(e, o, i)) {
 			a.push(o);
 			continue;
 		}
-		for (let t of a) await je(e, t.key, i);
+		for (let t of a) await tt(e, t.key, i);
 		return {
 			acquired: !1,
 			retryInMs: (i + 1) * r - n
@@ -803,7 +847,7 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		acquired: !0,
 		retryInMs: 0
 	};
-}, Ne = (e, t) => {
+}, rt = (e, t) => {
 	if (e === "json") return {
 		contentType: "application/json",
 		bytes: Buffer.from(t, "utf8")
@@ -812,22 +856,22 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 	try {
 		n = JSON.parse(t);
 	} catch (t) {
-		throw new d({
+		throw new S({
 			format: e,
 			reason: `payload is not valid JSON: ${t.message}`
 		});
 	}
 	return e === "form" ? {
 		contentType: "application/x-www-form-urlencoded",
-		bytes: Buffer.from(Pe(n), "utf8")
+		bytes: Buffer.from(it(n), "utf8")
 	} : {
 		contentType: "application/xml",
-		bytes: Buffer.from(Ie(n), "utf8")
+		bytes: Buffer.from(ot(n), "utf8")
 	};
-}, Pe = (e) => {
-	if (typeof e != "object" || !e || Array.isArray(e)) throw new d({
+}, it = (e) => {
+	if (typeof e != "object" || !e || Array.isArray(e)) throw new S({
 		format: "form",
-		reason: `form encoding requires a JSON object at the top level, got ${ze(e)}`
+		reason: `form encoding requires a JSON object at the top level, got ${lt(e)}`
 	});
 	let t = new URLSearchParams();
 	for (let [n, r] of Object.entries(e)) Z(t, n, r);
@@ -846,13 +890,13 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		return;
 	}
 	e.append(t, String(n));
-}, Fe = /^[A-Za-z_][A-Za-z0-9_.-]*$/, Ie = (e) => `<?xml version="1.0" encoding="UTF-8"?>${Q("webhook", e)}`, Q = (e, t) => {
-	if (!Fe.test(e)) throw new d({
+}, at = /^[A-Za-z_][A-Za-z0-9_.-]*$/, ot = (e) => `<?xml version="1.0" encoding="UTF-8"?>${Q("webhook", e)}`, Q = (e, t) => {
+	if (!at.test(e)) throw new S({
 		format: "xml",
 		reason: `object key ${JSON.stringify(e)} is not a valid XML element name`
 	});
-	return `<${e}>${Le(e, t)}</${e}>`;
-}, Le = (e, t) => t == null ? "" : Array.isArray(t) ? t.map((e) => Q("item", e)).join("") : typeof t == "object" ? Object.entries(t).map(([e, t]) => Q(e, t)).join("") : Re(String(t)), Re = (e) => e.replace(/[&<>"']/g, (e) => {
+	return `<${e}>${st(e, t)}</${e}>`;
+}, st = (e, t) => t == null ? "" : Array.isArray(t) ? t.map((e) => Q("item", e)).join("") : typeof t == "object" ? Object.entries(t).map(([e, t]) => Q(e, t)).join("") : ct(String(t)), ct = (e) => e.replace(/[&<>"']/g, (e) => {
 	switch (e) {
 		case "&": return "&amp;";
 		case "<": return "&lt;";
@@ -860,98 +904,102 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 		case "\"": return "&quot;";
 		default: return "&apos;";
 	}
-}), ze = (e) => e === null ? "null" : Array.isArray(e) ? "array" : typeof e, Be = "_voltro_webhook_targets", Ve = 32, He = async (e, t) => (await e.query({
+}), lt = (e) => e === null ? "null" : Array.isArray(e) ? "array" : typeof e, ut = "_voltro_webhook_targets", dt = 32, ft = async (e, t) => (await e.query({
 	table: "_voltro_webhook_targets",
-	predicate: w("id", t),
+	predicate: k("id", t),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, Ue = async (e, t, n, r, i = /* @__PURE__ */ new Date()) => {
-	for (let a = 0; a < Ve; a++) {
-		a > 0 && await new Promise((e) => setTimeout(e, a));
-		let o = await He(e, t);
-		if (o === null) return {
+}))[0] ?? null, pt = async (e, t, n, r, i = /* @__PURE__ */ new Date(), a = !1) => {
+	for (let o = 0; o < dt; o++) {
+		o > 0 && await new Promise((e) => setTimeout(e, o));
+		let s = await ft(e, t);
+		if (s === null) return {
 			consecutiveFailures: 0,
 			autoDisabled: !1
 		};
-		let s = o.consecutiveFailures ?? 0;
+		let c = s.consecutiveFailures ?? 0;
 		if (n) {
-			if (s === 0 || await e.updateMany("_voltro_webhook_targets", {
+			if (c === 0 || await e.updateMany("_voltro_webhook_targets", {
 				consecutiveFailures: 0,
 				updatedAt: i
-			}, { where: C(w("id", t), w("consecutiveFailures", s)) }) === 1) return {
+			}, { where: O(k("id", t), k("consecutiveFailures", c)) }) === 1) return {
 				consecutiveFailures: 0,
 				autoDisabled: !1
 			};
 			continue;
 		}
-		let c = s + 1, l = o.autoDisableAfter, u = typeof l == "number" && l > 0 && o.active && c >= l, d = {
-			consecutiveFailures: c,
+		let l = c + 1, u = s.autoDisableAfter, d = s.active && (a || typeof u == "number" && u > 0 && l >= u), f = {
+			consecutiveFailures: l,
 			updatedAt: i
 		};
-		if (u && (d.active = !1, d.autoDisabledAt = i, d.autoDisableReason = r.slice(0, 500)), await e.updateMany("_voltro_webhook_targets", d, { where: C(w("id", t), w("consecutiveFailures", s)) }) === 1) return {
-			consecutiveFailures: c,
-			autoDisabled: u
+		if (d && (f.active = !1, f.autoDisabledAt = i, f.autoDisableReason = r.slice(0, 500)), await e.updateMany("_voltro_webhook_targets", f, { where: O(k("id", t), k("consecutiveFailures", c)) }) === 1) return {
+			consecutiveFailures: l,
+			autoDisabled: d
 		};
 	}
-	throw Error(`webhook auto-disable: streak CAS contention on target ${t} exceeded ${Ve} attempts`);
-}, We = S.Struct({
-	status: S.Number,
-	body: S.String,
-	latencyMs: S.Number,
-	retryAfterSec: S.Union(S.Number, S.Undefined),
-	transportError: S.Union(S.String, S.Undefined),
-	encodeError: S.Union(S.String, S.Undefined)
-}), Ge = S.Struct({
-	outcome: S.Literal("succeeded", "failed", "retry"),
-	delayMs: S.Union(S.Number, S.Undefined),
-	reason: S.Union(S.String, S.Undefined),
-	autoDisabled: S.Union(S.Boolean, S.Undefined),
-	consecutiveFailures: S.Union(S.Number, S.Undefined)
-}), Ke = S.Struct({
-	acquired: S.Boolean,
-	retryInMs: S.Number
-}), qe = re.make({
+	throw Error(`webhook auto-disable: streak CAS contention on target ${t} exceeded ${dt} attempts`);
+}, mt = E.Struct({
+	status: E.Number,
+	body: E.String,
+	latencyMs: E.Number,
+	retryAfterSec: E.Union(E.Number, E.Undefined),
+	transportError: E.Union(E.String, E.Undefined),
+	encodeError: E.Union(E.String, E.Undefined)
+}), ht = E.Struct({
+	outcome: E.Literal("succeeded", "failed", "retry"),
+	delayMs: E.Union(E.Number, E.Undefined),
+	reason: E.Union(E.String, E.Undefined),
+	autoDisabled: E.Union(E.Boolean, E.Undefined),
+	consecutiveFailures: E.Union(E.Number, E.Undefined)
+}), gt = E.Struct({
+	acquired: E.Boolean,
+	retryInMs: E.Number
+}), _t = _e.make({
 	name: "voltro.deliverWebhook",
 	payload: {
-		deliveryId: S.String,
-		targetId: S.String,
-		event: S.String,
-		eventId: S.String,
-		payloadJson: S.String,
-		attemptEpoch: S.optionalWith(S.Number, { default: () => 0 })
+		deliveryId: E.String,
+		targetId: E.String,
+		event: E.String,
+		eventId: E.String,
+		payloadJson: E.String,
+		attemptEpoch: E.optionalWith(E.Number, { default: () => 0 })
 	},
-	success: S.Struct({
-		finalStatus: S.Literal("succeeded", "failed", "deferred"),
-		attempts: S.Number
+	success: E.Struct({
+		finalStatus: E.Literal("succeeded", "failed", "deferred"),
+		attempts: E.Number
 	}),
 	idempotencyKey: ({ deliveryId: e, attemptEpoch: t }) => `voltro.deliverWebhook:${e}:${t ?? 0}`
-}), Je = (e, t = {}) => (n, r) => {
-	let { deliveryId: i, targetId: a, event: s, eventId: c, payloadJson: l } = n, u = E({ scope: `webhook:${i}` });
-	return x.gen(function* () {
-		let n = yield* D.make({
+}), vt = 3e4, yt = (e, t) => {
+	if (e !== void 0) return e;
+	let n = Number(t.VOLTRO_WEBHOOK_TIMEOUT_MS);
+	return Number.isFinite(n) && n > 0 ? n : vt;
+}, bt = (e, t = {}) => (n, r) => {
+	let { deliveryId: i, targetId: a, event: o, eventId: s, payloadJson: c } = n, l = A({ scope: `webhook:${i}` });
+	return T.gen(function* () {
+		let n = yield* j.make({
 			name: "fetch-target",
-			success: S.Union(S.Null, S.Struct({
-				id: S.String,
-				event: S.String,
-				url: S.String,
-				secret: S.String,
-				signing: S.Any,
-				retry: S.Any,
-				headers: S.Union(S.Record({
-					key: S.String,
-					value: S.String
-				}), S.Null),
-				rateLimitPerMinute: S.Union(S.Number, S.Null),
-				active: S.Boolean,
-				format: S.Literal("json", "form", "xml"),
-				tenantId: S.Union(S.String, S.Null)
+			success: E.Union(E.Null, E.Struct({
+				id: E.String,
+				event: E.String,
+				url: E.String,
+				secret: E.String,
+				signing: E.Any,
+				retry: E.Any,
+				headers: E.Union(E.Record({
+					key: E.String,
+					value: E.String
+				}), E.Null),
+				rateLimitPerMinute: E.Union(E.Number, E.Null),
+				active: E.Boolean,
+				format: E.Literal("json", "form", "xml"),
+				tenantId: E.Union(E.String, E.Null)
 			})),
-			execute: x.tryPromise({
+			execute: T.tryPromise({
 				try: async () => (await e.store.query({
 					table: "_voltro_webhook_targets",
-					predicate: w("id", a),
+					predicate: k("id", a),
 					order: [{
 						column: "createdAt",
 						direction: "asc"
@@ -960,107 +1008,107 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 					skip: void 0,
 					projection: void 0
 				}))[0] ?? null,
-				catch: (e) => (u.debug("fetch-target raw error", {
+				catch: (e) => (l.debug("fetch-target raw error", {
 					targetId: a,
-					event: s,
+					event: o,
 					cause: String(e)
 				}), /* @__PURE__ */ Error(`fetch-target failed: ${e.message}`))
-			}).pipe(x.orDie)
+			}).pipe(T.orDie)
 		});
 		if (n === null) return {
 			finalStatus: "failed",
 			attempts: 0
 		};
-		let r = async (t, r, o) => {
+		let r = async (t, r, l) => {
 			await e.store.update("_voltro_webhook_deliveries", t, {
-				...o,
+				...l,
 				updatedAt: /* @__PURE__ */ new Date()
 			}) === null && await e.store.insert("_voltro_webhook_deliveries", {
 				id: t,
 				deliveryId: i,
 				targetId: a,
 				tenantId: n.tenantId ?? null,
-				event: s,
-				eventId: c,
+				event: o,
+				eventId: s,
 				attempt: r,
-				payload: l,
+				payload: c,
 				scheduledAt: /* @__PURE__ */ new Date(),
 				createdAt: /* @__PURE__ */ new Date(),
 				updatedAt: /* @__PURE__ */ new Date(),
-				...o
+				...l
 			});
 		};
-		if (n.active !== !0) return yield* D.make({
+		if (n.active !== !0) return yield* j.make({
 			name: "record-paused-pending",
-			success: S.Void,
-			execute: x.tryPromise({
+			success: E.Void,
+			execute: T.tryPromise({
 				try: () => r(`${i}:1`, 1, { status: "pending" }),
 				catch: (e) => /* @__PURE__ */ Error(`record-paused-pending failed: ${e.message}`)
-			}).pipe(x.orDie)
+			}).pipe(T.orDie)
 		}), {
 			finalStatus: "deferred",
 			attempts: 0
 		};
-		let f = (e) => typeof e == "string" ? JSON.parse(e) : e, p = f(n.retry), m = f(n.signing), h = n.headers === null ? null : f(n.headers), g = t.rateWindowMs ?? 6e4, _ = t.events?.find((e) => e.id === s)?.globalRateLimit, v = [...typeof n.rateLimitPerMinute == "number" && n.rateLimitPerMinute > 0 ? [{
+		let u = (e) => typeof e == "string" ? JSON.parse(e) : e, d = u(n.retry), p = u(n.signing), m = n.headers === null ? null : u(n.headers), h = t.rateWindowMs ?? 6e4, g = yt(t.timeoutMs, process.env), _ = t.events?.find((e) => e.id === o)?.globalRateLimit, v = [...typeof n.rateLimitPerMinute == "number" && n.rateLimitPerMinute > 0 ? [{
 			key: `target:${n.id}`,
 			limit: n.rateLimitPerMinute
 		}] : [], ..._ !== void 0 && _.perMinute > 0 ? [{
-			key: `event:${s}`,
+			key: `event:${o}`,
 			limit: _.perMinute
 		}] : []];
-		for (let t = 1; t <= p.maxAttempts; t++) {
-			let f = `${i}:${t}`;
+		for (let t = 1; t <= d.maxAttempts; t++) {
+			let u = `${i}:${t}`;
 			if (v.length > 0) for (let n = 0;; n++) {
-				let i = yield* D.make({
+				let i = yield* j.make({
 					name: `rate-acquire-${t}-${n}`,
-					success: Ke,
-					execute: x.tryPromise({
-						try: () => Me(e.store, v, Date.now(), g),
-						catch: (e) => (u.debug("rate-acquire raw error", {
+					success: gt,
+					execute: T.tryPromise({
+						try: () => nt(e.store, v, Date.now(), h),
+						catch: (e) => (l.debug("rate-acquire raw error", {
 							targetId: a,
-							event: s,
+							event: o,
 							attempt: t,
 							cause: String(e)
 						}), /* @__PURE__ */ Error(`rate-acquire failed: ${e.message}`))
-					}).pipe(x.orDie)
+					}).pipe(T.orDie)
 				});
 				if (i.acquired) break;
-				yield* D.make({
+				yield* j.make({
 					name: `record-rate-deferral-${t}-${n}`,
-					success: S.Void,
-					execute: x.tryPromise({
-						try: () => r(f, t, {
+					success: E.Void,
+					execute: T.tryPromise({
+						try: () => r(u, t, {
 							status: "pending",
 							nextAttemptAt: new Date(Date.now() + i.retryInMs)
 						}),
 						catch: (e) => /* @__PURE__ */ Error(`record-rate-deferral failed: ${e.message}`)
-					}).pipe(x.orDie)
-				}), yield* O.sleep({
+					}).pipe(T.orDie)
+				}), yield* M.sleep({
 					name: `rate-window-sleep-${t}-${n}`,
 					duration: `${i.retryInMs} millis`
 				});
 			}
-			yield* D.make({
+			yield* j.make({
 				name: `record-attempt-start-${t}`,
-				success: S.Void,
-				execute: x.tryPromise({
-					try: () => r(f, t, {
+				success: E.Void,
+				execute: T.tryPromise({
+					try: () => r(u, t, {
 						status: "inFlight",
 						nextAttemptAt: null,
 						scheduledAt: /* @__PURE__ */ new Date()
 					}),
 					catch: (e) => /* @__PURE__ */ Error(`record-attempt-start failed: ${e.message}`)
-				}).pipe(x.orDie)
+				}).pipe(T.orDie)
 			});
-			let _ = yield* D.make({
+			let _ = yield* j.make({
 				name: `sign-and-post-${t}`,
-				success: We,
-				execute: x.promise(async () => {
+				success: mt,
+				execute: T.promise(async () => {
 					let e = Date.now(), r;
 					try {
-						r = Ne(n.format, l);
+						r = rt(n.format, c);
 					} catch (t) {
-						if (t instanceof d) return {
+						if (t instanceof S) return {
 							status: 0,
 							body: "",
 							latencyMs: Date.now() - e,
@@ -1070,26 +1118,32 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 						};
 						throw t;
 					}
-					let a = Buffer.from(r.bytes), { headerName: u, headerValue: f } = o(m, a, n.secret);
-					process.env.NODE_ENV === "production" && T(n.url);
+					let a = Buffer.from(r.bytes), { headers: l } = f(p, {
+						rawBody: a,
+						secret: n.secret,
+						messageId: i
+					});
+					process.env.NODE_ENV === "production" && ge(n.url);
 					try {
-						let o = await fetch(n.url, {
+						let c = await fetch(n.url, {
 							method: "POST",
 							headers: {
 								"content-type": r.contentType,
-								[u]: f,
-								"x-voltro-event": s,
-								"x-voltro-event-id": c,
+								...l,
+								"x-voltro-event": o,
+								"x-voltro-event-id": s,
 								"x-voltro-delivery-id": i,
 								"x-voltro-attempt": String(t),
 								"idempotency-key": i,
-								...h ?? {}
+								...m ?? {}
 							},
-							body: a
-						}), l = (await o.text()).slice(0, 8192), d = o.headers.get("retry-after");
+							body: a,
+							redirect: "manual",
+							signal: AbortSignal.timeout(g)
+						}), u = (await c.text()).slice(0, 8192), d = c.headers.get("retry-after");
 						return {
-							status: o.status,
-							body: l,
+							status: c.status,
+							body: u,
 							latencyMs: Date.now() - e,
 							retryAfterSec: d !== null && /^\d+$/.test(d) ? Number(d) : void 0,
 							transportError: void 0,
@@ -1106,21 +1160,21 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 						};
 					}
 				})
-			}), y = yield* D.make({
+			}), y = yield* j.make({
 				name: `classify-and-record-${t}`,
-				success: Ge,
-				execute: x.tryPromise({
+				success: ht,
+				execute: T.tryPromise({
 					try: async () => {
-						let r = _.status >= 200 && _.status < 300, i = _.transportError !== void 0, o = _.encodeError !== void 0, s = (t, n) => Ue(e.store, a, t, n);
+						let r = _.status >= 200 && _.status < 300, i = _.transportError !== void 0, o = _.encodeError !== void 0, s = _.status === 410, c = (t, n) => pt(e.store, a, t, n, /* @__PURE__ */ new Date(), !t && s);
 						if (r) {
-							await e.store.update("_voltro_webhook_deliveries", f, {
+							await e.store.update("_voltro_webhook_deliveries", u, {
 								status: "succeeded",
 								responseStatus: _.status,
 								responseBody: _.body,
 								latencyMs: _.latencyMs,
 								updatedAt: /* @__PURE__ */ new Date()
 							});
-							let t = await s(!0, "");
+							let t = await c(!0, "");
 							return {
 								outcome: "succeeded",
 								delayMs: void 0,
@@ -1129,13 +1183,13 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 								consecutiveFailures: t.consecutiveFailures
 							};
 						}
-						let c = o ? null : M(p, t, {
+						let l = o ? null : L(d, t, {
 							...i ? {} : { status: _.status },
 							..._.retryAfterSec === void 0 ? {} : { retryAfterSeconds: _.retryAfterSec }
 						});
-						if (c === null) {
+						if (l === null) {
 							let t = o ? `encode (${n.format}): ${_.encodeError}` : i ? `transport: ${_.transportError}` : `http ${_.status}: ${_.body.slice(0, 200)}`;
-							await e.store.update("_voltro_webhook_deliveries", f, {
+							await e.store.update("_voltro_webhook_deliveries", u, {
 								status: "failed",
 								responseStatus: i || o ? null : _.status,
 								responseBody: i || o ? null : _.body,
@@ -1143,7 +1197,7 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 								latencyMs: _.latencyMs,
 								updatedAt: /* @__PURE__ */ new Date()
 							});
-							let r = await s(!1, t);
+							let r = await c(!1, t);
 							return {
 								outcome: "failed",
 								delayMs: void 0,
@@ -1152,33 +1206,33 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 								consecutiveFailures: r.consecutiveFailures
 							};
 						}
-						return await e.store.update("_voltro_webhook_deliveries", f, {
+						return await e.store.update("_voltro_webhook_deliveries", u, {
 							status: "retryScheduled",
 							responseStatus: i ? null : _.status,
 							responseBody: i ? null : _.body,
 							errorMessage: _.transportError ?? null,
 							latencyMs: _.latencyMs,
-							nextAttemptAt: new Date(Date.now() + c.delayMs),
+							nextAttemptAt: new Date(Date.now() + l.delayMs),
 							updatedAt: /* @__PURE__ */ new Date()
 						}), {
 							outcome: "retry",
-							delayMs: c.delayMs,
+							delayMs: l.delayMs,
 							reason: void 0,
 							autoDisabled: void 0,
 							consecutiveFailures: void 0
 						};
 					},
-					catch: (e) => (u.debug("classify-and-record raw error", {
+					catch: (e) => (l.debug("classify-and-record raw error", {
 						targetId: a,
-						event: s,
+						event: o,
 						attempt: t,
 						cause: String(e)
 					}), /* @__PURE__ */ Error(`classify-and-record failed: ${e.message}`))
-				}).pipe(x.orDie)
+				}).pipe(T.orDie)
 			});
-			if (y.autoDisabled === !0 && u.warn("target auto-disabled after consecutive failures", {
+			if (y.autoDisabled === !0 && l.warn("target auto-disabled after consecutive failures", {
 				targetId: a,
-				event: s,
+				event: o,
 				consecutiveFailures: y.consecutiveFailures ?? null,
 				reason: y.reason ?? null
 			}), y.outcome === "succeeded") return {
@@ -1189,25 +1243,25 @@ var ae = (e) => e.webhook !== void 0, k = (e) => {
 				finalStatus: "failed",
 				attempts: t
 			};
-			y.delayMs !== void 0 && (yield* O.sleep({
+			y.delayMs !== void 0 && (yield* M.sleep({
 				name: `retry-sleep-${t}`,
 				duration: `${y.delayMs} millis`
 			}));
 		}
 		return {
 			finalStatus: "failed",
-			attempts: p.maxAttempts
+			attempts: d.maxAttempts
 		};
 	});
-}, $ = "voltro.webhook.emit", Ye = (e) => typeof e.event == "string", Xe = (e) => ie({
+}, $ = "voltro.webhook.emit", xt = (e) => typeof e.event == "string", St = (e) => ve({
 	effect: $,
 	maxAttempts: 1,
 	handler: async ({ payload: t }) => {
-		if (!Ye(t)) throw Error(`${$}: row payload has no \`event\` name — cannot resolve a descriptor. Got keys: ${Object.keys(t).join(", ") || "(none)"}`);
+		if (!xt(t)) throw Error(`${$}: row payload has no \`event\` name — cannot resolve a descriptor. Got keys: ${Object.keys(t).join(", ") || "(none)"}`);
 		let n = e();
 		if (n === void 0) throw Error(`${$}: the outgoing-webhooks service is not available in this process. An emit was enqueued by a build that had the plugin registered; this one does not.`);
 		await n.emit(t.event, t.payload, { tenantId: t.tenantId });
 	}
 });
 //#endregion
-export { W as IdempotencyCache, De as RATE_WINDOW_MS, Ee as RATE_WINDOW_TABLE, Be as TARGETS_TABLE, $ as WEBHOOK_EMIT_EFFECT, l as WebhookDeliveryNotFound, u as WebhookPayloadInvalid, d as WebhookPayloadUnrepresentable, f as WebhookPayloadVersionInvalid, p as WebhookSubscribeInvalid, N as WebhooksService, m as _voltroWebhookDeliveriesTable, h as _voltroWebhookEventStatsTable, g as _voltroWebhookRateWindowsTable, _ as _voltroWebhookTargetsTable, Me as acquireRateSlots, k as asOutgoingEvent, Je as buildDeliverWebhookExecute, be as buildWebhooksService, me as compareVersions, Ae as consumeRateSlot, Te as defaultIncomingPath, c as defaultOutgoingSignature, se as defaultRetryPolicy, s as defineIncomingWebhook, t as defineWebhookProvider, qe as deliverWebhookWorkflow, Ne as encodePayload, I as eventsOf, ce as fastRetryPolicy, F as generateSecret, K as getIdempotencyCache, i as githubSignature, ae as hasWebhookAudience, r as isWebhookDescriptor, Xe as makeDeferredEmitHandler, he as matchesFilter, we as mountIncomingWebhook, M as nextRetry, A as parseDuration, J as parseTtl, Ue as recordDeliveryOutcome, je as releaseRateSlot, ue as resolveSubscribe, o as signPayload, n as slackSignature, e as stripeSignature, Se as useWebhooks, xe as useWebhooksEffect, L as validateSubscribe, a as verifySignature, v as webhookTables };
+export { Ve as IdempotencyCache, Ze as RATE_WINDOW_MS, Xe as RATE_WINDOW_TABLE, p as STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS, ee as STANDARD_WEBHOOKS_ID_HEADER, c as STANDARD_WEBHOOKS_MAX_KEY_BYTES, l as STANDARD_WEBHOOKS_MIN_KEY_BYTES, _ as STANDARD_WEBHOOKS_SECRET_PREFIX, m as STANDARD_WEBHOOKS_SIGNATURE_HEADER, d as STANDARD_WEBHOOKS_TIMESTAMP_HEADER, u as STANDARD_WEBHOOKS_VERSION, ut as TARGETS_TABLE, Ge as UnverifiedIncomingWebhook, N as WEBHOOKS_PLUGIN_PERMISSIONS, $ as WEBHOOK_EMIT_EFFECT, We as WEBHOOK_VERIFICATION_PROPERTY, ae as WebhookDeliveryNotFound, x as WebhookPayloadInvalid, S as WebhookPayloadUnrepresentable, C as WebhookPayloadVersionInvalid, w as WebhookSubscribeInvalid, Ce as WebhooksService, oe as _voltroWebhookDeliveriesTable, se as _voltroWebhookEventStatsTable, ce as _voltroWebhookRateWindowsTable, le as _voltroWebhookTargetsTable, nt as acquireRateSlots, P as asOutgoingEvent, bt as buildDeliverWebhookExecute, Le as buildWebhooksService, ke as compareVersions, et as consumeRateSlot, Ye as defaultIncomingPath, b as defaultOutgoingSignature, R as defaultRetryPolicy, ne as defineIncomingWebhook, r as defineWebhookProvider, _t as deliverWebhookWorkflow, rt as encodePayload, B as eventsOf, Se as fastRetryPolicy, z as generateSecret, i as generateStandardWebhooksSecret, h as genericHmacSignature, He as getIdempotencyCache, v as githubSignature, be as hasWebhookAudience, qe as incomingWebhookVerification, te as isStandardWebhooksSecret, t as isWebhookDescriptor, St as makeDeferredEmitHandler, Ae as matchesFilter, Je as mountIncomingWebhook, L as nextRetry, F as parseDuration, Ue as parseTtl, pt as recordDeliveryOutcome, tt as releaseRateSlot, Ee as resolveSubscribe, f as signRequest, a as slackSignature, ie as standardWebhooksHeaders, o as standardWebhooksKey, g as standardWebhooksSignature, re as standardWebhooksSignatureToken, n as standardWebhooksSignedContent, y as stripeSignature, ze as useWebhooks, Re as useWebhooksEffect, V as validateSubscribe, s as verifyRequest, e as verifyStandardWebhooks, ue as webhookTables, ye as webhooksPlugin };