@voltro/plugin-webhooks 0.84.0 → 0.85.0

package/dist/index.js

@@ -1,29 +1,29 @@
 import { C as e, E as t, S as n, T as r, _ as i, a, b as o, c as s, d as c, f as l, g as u, h as d, i as f, l as p, m, n as h, o as g, p as _, r as v, s as y, t as ee, u as te, v as ne, w as re, x as ie, y as ae } from "./signing-DeHObNv6.js";
-import { WebhookDeliveryNotFound as oe, WebhookPayloadInvalid as se, WebhookPayloadUnrepresentable as b, WebhookPayloadVersionInvalid as ce, WebhookSubscribeInvalid as x, WebhookTargetNotFound as S } from "./errors.js";
-import { _voltroWebhookDeliveriesTable as le, _voltroWebhookEventStatsTable as ue, _voltroWebhookRateWindowsTable as de, _voltroWebhookTargetsTable as fe, webhookTables as pe } from "./mixin.js";
-import { Context as me, Effect as C, Either as he, Schema as w } from "effect";
-import { definePlugin as ge, publishServerError as _e } from "@voltro/protocol";
-import { randomBytes as ve, randomUUID as T } from "node:crypto";
-import { and as E, eq as D } from "@voltro/database";
-import { assertPublicUrl as ye } from "@voltro/integration-http";
-import { createLogger as O } from "@voltro/logger";
-import { Activity as k, DurableClock as A, Workflow as be } from "@effect/workflow";
-import { defineOutboxHandler as xe } from "@voltro/runtime";
+import { WebhookDeliveryNotFound as oe, WebhookPayloadInvalid as se, WebhookPayloadUnrepresentable as b, WebhookPayloadVersionInvalid as x, WebhookSubscribeInvalid as S, WebhookTargetNotFound as C } from "./errors.js";
+import { _voltroWebhookDeliveriesTable as ce, _voltroWebhookEventStatsTable as le, _voltroWebhookRateWindowsTable as ue, _voltroWebhookTargetsTable as de, webhookTables as fe } from "./mixin.js";
+import { Context as pe, Effect as w, Result as me, Schema as T } from "effect";
+import { definePlugin as he, publishServerError as ge } from "@voltro/protocol";
+import { randomBytes as _e, randomUUID as E } from "node:crypto";
+import { and as D, eq as O } from "@voltro/database";
+import { assertPublicUrl as k } from "@voltro/integration-http";
+import { createLogger as A } from "@voltro/logger";
+import { Activity as j, DurableClock as ve, Workflow as ye } from "effect/workflow";
+import { defineOutboxHandler as be } from "@voltro/runtime";
 //#region src/plugin.ts
-var j = ["network:outbound:*"], M = [{
+var xe = ["network:outbound:*"], M = [{
 	destination: "runtime:registered webhook targets (_voltro_webhook_targets)",
 	purpose: "event deliveries, HMAC-signed",
 	data: ["content", "metadata"],
 	disable: "remove or pause the targets; an emit then delivers nowhere"
-}], Se = (e = {}) => ge({
+}], Se = (e = {}) => he({
 	name: e.name ? `@voltro/plugin-webhooks#${e.name}` : "@voltro/plugin-webhooks",
 	description: "Outgoing webhooks (multi-target, durable-workflow delivery, HMAC signing, retry policies, rate limits) + incoming (signature verification, idempotency, provider templates). Declares wildcard outbound network access because targets are user-configured URLs.",
-	permissions: j,
+	permissions: xe,
 	egress: M,
-	onActivate: (e) => C.sync(() => {
+	onActivate: (e) => w.sync(() => {
 		e.logger.info("webhooks active", { outbound: "network:outbound:* (subscriber-configured target URLs — audit visibility, not a restriction)" });
 	})
-}), Ce = (e) => e.webhook !== void 0, we = (e) => {
+}), Ce = (e) => e.webhook !== void 0, N = (e) => {
 	let t = e.webhook;
 	if (t !== void 0) return {
 		_tag: "outgoingEvent",
@@ -33,8 +33,8 @@ var j = ["network:outbound:*"], M = [{
 		...t.version === void 0 ? {} : { version: t.version },
 		...t.rateLimit === void 0 ? {} : { globalRateLimit: t.rateLimit }
 	};
-}, Te = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, N = (e) => {
-	let t = Te.exec(e);
+}, we = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, P = (e) => {
+	let t = we.exec(e);
 	if (!t) throw Error(`invalid duration literal: ${e}`);
 	let n = Number(t[1]), r = t[2] ?? "s";
 	switch (r) {
@@ -45,7 +45,7 @@ var j = ["network:outbound:*"], M = [{
 		case "d": return n * 864e5;
 		default: throw Error(`unreachable unit: ${r}`);
 	}
-}, P = [
+}, F = [
 	408,
 	425,
 	429,
@@ -53,16 +53,16 @@ var j = ["network:outbound:*"], M = [{
 	502,
 	503,
 	504
-], Ee = (e, t, n) => {
-	if (t >= e.maxAttempts || n?.status !== void 0 && !(e.retryOn ?? P).includes(n.status)) return null;
+], Te = (e, t, n) => {
+	if (t >= e.maxAttempts || n?.status !== void 0 && !(e.retryOn ?? F).includes(n.status)) return null;
 	if (e.honourRetryAfter !== !1 && n?.retryAfterSeconds !== void 0) {
-		let t = n.retryAfterSeconds * 1e3, r = N(e.maxDelay), i = Math.min(t, r);
+		let t = n.retryAfterSeconds * 1e3, r = P(e.maxDelay), i = Math.min(t, r);
 		return {
 			delayMs: i,
 			baseDelayMs: i
 		};
 	}
-	let r = N(e.initialDelay), i = N(e.maxDelay), a;
+	let r = P(e.initialDelay), i = P(e.maxDelay), a;
 	switch (e.strategy) {
 		case "fixed":
 			a = r;
@@ -78,98 +78,98 @@ var j = ["network:outbound:*"], M = [{
 		delayMs: Math.max(1, Math.floor(o)),
 		baseDelayMs: a
 	};
-}, De = () => ({
+}, Ee = () => ({
 	strategy: "exponential",
 	maxAttempts: 8,
 	initialDelay: "5s",
 	maxDelay: "1h",
-	retryOn: P,
+	retryOn: F,
 	honourRetryAfter: !0,
 	jitter: "full"
-}), Oe = () => ({
+}), De = () => ({
 	strategy: "fixed",
 	maxAttempts: 120,
 	initialDelay: "30s",
 	maxDelay: "30s",
-	retryOn: P,
+	retryOn: F,
 	honourRetryAfter: !0,
 	jitter: "full"
-}), ke = class extends me.Tag("@voltro/webhooks/WebhooksService")() {}, Ae = 32, je = 32, Me = () => ve(Ae).toString("hex"), F = (e) => e.events ?? (e.event === void 0 ? [] : [e.event]), I = (e, t) => {
-	if (e !== void 0 && t?._tag === "standardWebhooks" && !ne(e)) throw new x({
+}), Oe = class extends pe.Service()("@voltro/webhooks/WebhooksService") {}, ke = 32, Ae = 32, je = () => _e(ke).toString("hex"), I = (e) => e.events ?? (e.event === void 0 ? [] : [e.event]), L = (e, t) => {
+	if (e !== void 0 && t?._tag === "standardWebhooks" && !ne(e)) throw new S({
 		field: "secret",
 		reason: "a standard-webhooks target needs the spec's secret serialization (\"whsec_\" + base64 of 24..64 random bytes) — mint one with generateStandardWebhooksSecret(), or omit `secret` and let subscribe mint it. If the incompatible key is inherited, rotate the endpoint secret and update the receiver before adding the event"
 	});
-}, L = (e) => {
+}, R = (e) => {
 	let t;
 	try {
 		t = new URL(e.url);
 	} catch (e) {
-		throw new x({
+		throw new S({
 			field: "url",
 			reason: `invalid subscriber url: ${e.message}`
 		});
 	}
-	if (t.protocol !== "http:" && t.protocol !== "https:") throw new x({
+	if (t.protocol !== "http:" && t.protocol !== "https:") throw new S({
 		field: "url",
 		reason: `url protocol must be http or https, got ${t.protocol}`
 	});
 	if (process.env.NODE_ENV === "production") try {
-		ye(e.url);
+		k(e.url);
 	} catch (e) {
-		throw new x({
+		throw new S({
 			field: "url",
 			reason: e.message
 		});
 	}
-	let n = F(e);
-	if (n.length === 0) throw new x({
+	let n = I(e);
+	if (n.length === 0) throw new S({
 		field: "event",
 		reason: "event id required"
 	});
-	if (e.event !== void 0 && e.events !== void 0) throw new x({
+	if (e.event !== void 0 && e.events !== void 0) throw new S({
 		field: "event",
 		reason: "pass `event` OR `events`, not both — the row set would be ambiguous"
 	});
-	if (n.some((e) => e.length === 0)) throw new x({
+	if (n.some((e) => e.length === 0)) throw new S({
 		field: "events",
 		reason: "event id required"
 	});
-	if (new Set(n).size !== n.length) throw new x({
+	if (new Set(n).size !== n.length) throw new S({
 		field: "events",
 		reason: "duplicate event — one row per event, so a repeat would deliver twice"
 	});
-	if (e.secret !== void 0 && e.secret.length < je) throw new x({
+	if (e.secret !== void 0 && e.secret.length < Ae) throw new S({
 		field: "secret",
-		reason: `secret must be at least ${je} chars`
+		reason: `secret must be at least ${Ae} chars`
 	});
-	if (I(e.secret, e.signing), e.retry !== void 0) {
-		if (e.retry.maxAttempts < 1) throw new x({
+	if (L(e.secret, e.signing), e.retry !== void 0) {
+		if (e.retry.maxAttempts < 1) throw new S({
 			field: "retry",
 			reason: "retry.maxAttempts must be ≥ 1"
 		});
-		if (e.retry.maxAttempts > 1e3) throw new x({
+		if (e.retry.maxAttempts > 1e3) throw new S({
 			field: "retry",
 			reason: "retry.maxAttempts must be ≤ 1000"
 		});
 	}
-	if (e.rateLimitPerMinute !== void 0 && e.rateLimitPerMinute < 1) throw new x({
+	if (e.rateLimitPerMinute !== void 0 && e.rateLimitPerMinute < 1) throw new S({
 		field: "rateLimitPerMinute",
 		reason: "rateLimitPerMinute must be ≥ 1"
 	});
-	if (e.autoDisableAfter !== void 0 && (e.autoDisableAfter < 1 || !Number.isInteger(e.autoDisableAfter))) throw new x({
+	if (e.autoDisableAfter !== void 0 && (e.autoDisableAfter < 1 || !Number.isInteger(e.autoDisableAfter))) throw new S({
 		field: "autoDisableAfter",
 		reason: `autoDisableAfter must be a positive integer, got ${e.autoDisableAfter}`
 	});
-}, R = (e, t, n, r) => {
-	let a = e.signing ?? t?.defaultSigning ?? ee(), o = a._tag === "standardWebhooks" ? i : Me, s = r ?? e.secret ?? o();
-	return I(s, a), {
-		id: T(),
+}, z = (e, t, n, r) => {
+	let a = e.signing ?? t?.defaultSigning ?? ee(), o = a._tag === "standardWebhooks" ? i : je, s = r ?? e.secret ?? o();
+	return L(s, a), {
+		id: E(),
 		tenantId: e.tenantId ?? null,
 		event: n ?? e.event ?? "",
 		url: e.url,
 		secret: s,
 		signing: a,
-		retry: e.retry ?? t?.defaultRetry ?? De(),
+		retry: e.retry ?? t?.defaultRetry ?? Ee(),
 		filter: e.filter ?? null,
 		scope: e.scope ?? null,
 		headers: e.headers ?? null,
@@ -183,14 +183,14 @@ var j = ["network:outbound:*"], M = [{
 		payloadVersion: e.payloadVersion ?? t?.version ?? 1,
 		description: e.description ?? null
 	};
-}, Ne = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, z = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : null, Pe = (e) => {
+}, Me = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, B = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : null, Ne = (e) => {
 	if (typeof e != "string") return e;
 	try {
 		return JSON.parse(e);
 	} catch {
 		return e;
 	}
-}, B = (e) => ({
+}, V = (e) => ({
 	id: String(e.id),
 	deliveryId: String(e.deliveryId),
 	targetId: String(e.targetId),
@@ -201,28 +201,28 @@ var j = ["network:outbound:*"], M = [{
 	responseStatus: e.responseStatus ?? null,
 	errorMessage: e.errorMessage ?? null,
 	latencyMs: e.latencyMs ?? null,
-	scheduledAt: z(e.scheduledAt),
-	nextAttemptAt: z(e.nextAttemptAt),
-	createdAt: z(e.createdAt)
-}), Fe = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", V = (e, t) => {
+	scheduledAt: B(e.scheduledAt),
+	nextAttemptAt: B(e.nextAttemptAt),
+	createdAt: B(e.createdAt)
+}), Pe = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", H = (e, t) => {
 	if (e === null) return !0;
 	let n = { payload: t };
-	for (let [t, r] of Object.entries(e)) if (!Le(Ie(n, t), r)) return !1;
+	for (let [t, r] of Object.entries(e)) if (!Ie(Fe(n, t), r)) return !1;
 	return !0;
-}, Ie = (e, t) => {
+}, Fe = (e, t) => {
 	let n = t.split("."), r = e;
 	for (let e of n) {
 		if (typeof r != "object" || !r) return;
 		r = r[e];
 	}
 	return r;
-}, H = (e, t) => {
+}, U = (e, t) => {
 	if (typeof e == "number" && typeof t == "number") return e - t;
 	if (typeof e == "string" && typeof t == "string") return e < t ? -1 : +(e > t);
-}, Le = (e, t) => {
+}, Ie = (e, t) => {
 	if (typeof t == "object" && t && !Array.isArray(t)) {
 		let n = t;
-		return "eq" in n && e !== n.eq || "in" in n && (!Array.isArray(n.in) || !n.in.includes(e)) || "gt" in n && !((H(e, n.gt) ?? 0) > 0) || "gte" in n && !((H(e, n.gte) ?? -1) >= 0) || "lt" in n && !((H(e, n.lt) ?? 0) < 0) || "lte" in n && !((H(e, n.lte) ?? 1) <= 0) ? !1 : [
+		return "eq" in n && e !== n.eq || "in" in n && (!Array.isArray(n.in) || !n.in.includes(e)) || "gt" in n && !((U(e, n.gt) ?? 0) > 0) || "gte" in n && !((U(e, n.gte) ?? -1) >= 0) || "lt" in n && !((U(e, n.lt) ?? 0) < 0) || "lte" in n && !((U(e, n.lte) ?? 1) <= 0) ? !1 : [
 			"eq",
 			"in",
 			"gt",
@@ -232,9 +232,9 @@ var j = ["network:outbound:*"], M = [{
 		].some((e) => e in n);
 	}
 	return e === t;
-}, U = (e, t) => e !== null && Object.entries(t).every(([t, n]) => e[t] === n), W = 500, Re = 200, G = async (e, t) => {
+}, W = (e, t) => e !== null && Object.entries(t).every(([t, n]) => e[t] === n), G = 500, Le = 200, K = async (e, t) => {
 	let n = [];
-	for (let r = 0; r < Re; r += 1) {
+	for (let r = 0; r < Le; r += 1) {
 		let i = await e.store.query({
 			table: "_voltro_webhook_targets",
 			predicate: t,
@@ -242,24 +242,24 @@ var j = ["network:outbound:*"], M = [{
 				column: "id",
 				direction: "asc"
 			}],
-			take: W,
-			skip: r === 0 ? void 0 : r * W,
+			take: G,
+			skip: r === 0 ? void 0 : r * G,
 			projection: void 0
 		});
-		if (n.push(...i), i.length < W) return n;
+		if (n.push(...i), i.length < G) return n;
 	}
-	throw Error(`webhooks: more than ${Re * W} rows in \`_voltro_webhook_targets\` — refusing to answer a scope lookup from a partial scan. A truncated scan mints a fresh secret for a live endpoint (breaking its signatures) or reports that a real scope matches nothing.`);
-}, ze = async (e, t) => {
-	let n = (await G(e)).filter((e) => U(e.scope, t));
+	throw Error(`webhooks: more than ${Le * G} rows in \`_voltro_webhook_targets\` — refusing to answer a scope lookup from a partial scan. A truncated scan mints a fresh secret for a live endpoint (breaking its signatures) or reports that a real scope matches nothing.`);
+}, Re = async (e, t) => {
+	let n = (await K(e)).filter((e) => W(e.scope, t));
 	if (n.length === 0) return;
 	let r = new Set(n.map((e) => e.secret));
 	if (r.size > 1) throw Error(`webhooks.subscribe: the scope ${JSON.stringify(t)} matches ${n.length} targets with ${r.size} different secrets, so it is not one endpoint. Pass \`secret\` explicitly, or narrow the scope.`);
 	return [...r][0];
-}, Be = async (e, t) => {
+}, ze = async (e, t) => {
 	try {
 		let n = await e.store.query({
 			table: "_voltro_webhook_event_stats",
-			predicate: D("event", t),
+			predicate: O("event", t),
 			order: [],
 			take: 1,
 			skip: void 0,
@@ -281,11 +281,11 @@ var j = ["network:outbound:*"], M = [{
 			updatedAt: r
 		});
 	} catch {}
-}, Ve = (e, t, n = {}) => {
+}, Be = (e, t, n = {}) => {
 	let r = new Map((n.events ?? []).map((e) => [e.id, e])), a = {
 		subscribe: async (t) => {
-			L(t);
-			let n = F(t), a = t.secret === void 0 && t.scope !== void 0 ? await ze(e, t.scope) : void 0, o = t.secret ?? a ?? i(), s = n.map((e) => R(t, r.get(e), e, o));
+			R(t);
+			let n = I(t), a = t.secret === void 0 && t.scope !== void 0 ? await Re(e, t.scope) : void 0, o = t.secret ?? a ?? i(), s = n.map((e) => z(t, r.get(e), e, o));
 			for (let t of s) await e.store.insert("_voltro_webhook_targets", {
 				...t,
 				createdAt: /* @__PURE__ */ new Date(),
@@ -306,32 +306,31 @@ var j = ["network:outbound:*"], M = [{
 			};
 		},
 		emit: async (n, i, a) => {
-			let o = typeof n == "object" && n.kind === "event" ? we(n) : void 0, s = typeof n == "string" ? r.get(n) : o ?? n, c = typeof n == "string" ? n : n.id ?? n.name;
+			let o = typeof n == "object" && n.kind === "event" ? N(n) : void 0, s = typeof n == "string" ? r.get(n) : o ?? n, c = typeof n == "string" ? n : n.id ?? n.name;
 			if (s !== void 0) {
-				let e = w.decodeUnknownEither(s.payload)(i, { errors: "all" });
-				if (he.isLeft(e)) throw new se({
+				let e = T.decodeUnknownResult(s.payload)(i, { errors: "all" });
+				if (me.isFailure(e)) throw new se({
 					event: c,
-					issues: e.left.message
+					issues: e.failure.message
 				});
 			}
-			let l = T(), u = a?.tenantId, d = await G(e, u == null ? D("event", c) : E(D("event", c), D("tenantId", u)));
-			await Be(e, c);
-			let f = d.filter((e) => V(e.filter, i)), p = [], m = JSON.stringify(i);
-			for (let n of f) {
-				let r = T();
+			let l = a?.eventId ?? E(), u = a?.tenantId, d = await K(e, u == null ? O("event", c) : D(O("event", c), O("tenantId", u)));
+			await ze(e, c);
+			let f = d.filter((e) => H(e.filter, i)), p = [], m = JSON.stringify(i), h = async (n, r) => {
+				let i = E();
 				n.active ? (await t({
-					deliveryId: r,
+					deliveryId: i,
 					targetId: n.id,
 					event: c,
 					eventId: l,
 					payloadJson: m
-				}), p.push({
+				}), p[r] = {
 					targetId: n.id,
-					deliveryId: r,
+					deliveryId: i,
 					status: "dispatched"
-				})) : (await e.store.insert("_voltro_webhook_deliveries", {
-					id: `${r}:1`,
-					deliveryId: r,
+				}) : (await e.store.insert("_voltro_webhook_deliveries", {
+					id: `${i}:1`,
+					deliveryId: i,
 					targetId: n.id,
 					tenantId: n.tenantId ?? null,
 					event: c,
@@ -342,12 +341,22 @@ var j = ["network:outbound:*"], M = [{
 					scheduledAt: /* @__PURE__ */ new Date(),
 					createdAt: /* @__PURE__ */ new Date(),
 					updatedAt: /* @__PURE__ */ new Date()
-				}), p.push({
+				}), p[r] = {
 					targetId: n.id,
-					deliveryId: r,
+					deliveryId: i,
 					status: "queued"
-				}));
-			}
+				});
+			}, g = 0, _ = !1, v;
+			if (await Promise.all(Array.from({ length: Math.min(4, f.length) }, async () => {
+				for (; !_ && g < f.length;) {
+					let e = g++;
+					try {
+						await h(f[e], e);
+					} catch (e) {
+						_ || (_ = !0, v = e);
+					}
+				}
+			})), _) throw v;
 			return {
 				eventId: l,
 				deliveries: p
@@ -356,7 +365,7 @@ var j = ["network:outbound:*"], M = [{
 		replay: async (n) => {
 			let r = (await e.store.query({
 				table: "_voltro_webhook_deliveries",
-				predicate: D("deliveryId", n),
+				predicate: O("deliveryId", n),
 				order: [{
 					column: "attempt",
 					direction: "asc"
@@ -370,7 +379,7 @@ var j = ["network:outbound:*"], M = [{
 				deliveryId: r.deliveryId,
 				targetId: r.targetId,
 				event: r.event,
-				eventId: r.eventId ?? T(),
+				eventId: r.eventId ?? E(),
 				payloadJson: typeof r.payload == "string" ? r.payload : JSON.stringify(r.payload),
 				attemptEpoch: Date.now()
 			});
@@ -379,15 +388,15 @@ var j = ["network:outbound:*"], M = [{
 			if (typeof t == "string") {
 				if ((await e.store.query({
 					table: "_voltro_webhook_targets",
-					predicate: D("id", t),
+					predicate: O("id", t),
 					order: [],
 					take: 1,
 					skip: void 0,
 					projection: ["id"]
-				})).length === 0) throw new S({ targetId: t });
+				})).length === 0) throw new C({ targetId: t });
 				return [t];
 			}
-			let n = (await G(e)).filter((e) => U(e.scope, t.scope)).map((e) => e.id);
+			let n = (await K(e)).filter((e) => W(e.scope, t.scope)).map((e) => e.id);
 			if (n.length === 0) throw Error(`webhooks: no target matches scope ${JSON.stringify(t.scope)} — the operation would have silently done nothing`);
 			return n;
 		},
@@ -408,7 +417,7 @@ var j = ["network:outbound:*"], M = [{
 				});
 				let n = await e.store.query({
 					table: "_voltro_webhook_deliveries",
-					predicate: E(D("targetId", r), D("status", "pending")),
+					predicate: D(O("targetId", r), O("status", "pending")),
 					order: [{
 						column: "createdAt",
 						direction: "asc"
@@ -421,14 +430,14 @@ var j = ["network:outbound:*"], M = [{
 					deliveryId: e.deliveryId,
 					targetId: r,
 					event: e.event,
-					eventId: e.eventId ?? T(),
+					eventId: e.eventId ?? E(),
 					payloadJson: typeof e.payload == "string" ? e.payload : JSON.stringify(e.payload),
 					attemptEpoch: i
 				});
 			}
 		},
 		deleteTarget: async (t) => {
-			for (let n of await a.resolveTargets(t)) await e.store.delete("_voltro_webhook_targets", n), await e.store.deleteMany("_voltro_webhook_deliveries", { where: E(D("targetId", n), D("status", "pending")) });
+			for (let n of await a.resolveTargets(t)) await e.store.delete("_voltro_webhook_targets", n), await e.store.deleteMany("_voltro_webhook_deliveries", { where: D(O("targetId", n), O("status", "pending")) });
 		},
 		rotateSecret: async (t) => {
 			let n = i();
@@ -439,7 +448,7 @@ var j = ["network:outbound:*"], M = [{
 			return { secret: n };
 		},
 		updateTarget: async (t, n) => {
-			if (n.url !== void 0 && L({
+			if (n.url !== void 0 && R({
 				event: "x",
 				url: n.url
 			}), n.rateLimitPerMinute !== void 0 && n.rateLimitPerMinute !== null && (!Number.isInteger(n.rateLimitPerMinute) || n.rateLimitPerMinute < 1)) throw Error("updateTarget: rateLimitPerMinute must be a positive integer or null");
@@ -459,14 +468,14 @@ var j = ["network:outbound:*"], M = [{
 		testTarget: async (n, r) => {
 			let i = (await e.store.query({
 				table: "_voltro_webhook_targets",
-				predicate: D("id", n),
+				predicate: O("id", n),
 				order: [],
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			}))[0];
-			if (i === void 0) throw new S({ targetId: n });
-			let a = T(), o = JSON.stringify(r ?? {
+			if (i === void 0) throw new C({ targetId: n });
+			let a = E(), o = JSON.stringify(r ?? {
 				test: !0,
 				targetId: n,
 				at: (/* @__PURE__ */ new Date()).toISOString()
@@ -475,7 +484,7 @@ var j = ["network:outbound:*"], M = [{
 				deliveryId: a,
 				targetId: i.id,
 				event: i.event,
-				eventId: T(),
+				eventId: E(),
 				payloadJson: o
 			}) : await e.store.insert("_voltro_webhook_deliveries", {
 				id: `${a}:1`,
@@ -495,7 +504,7 @@ var j = ["network:outbound:*"], M = [{
 		listDeliveries: async (t) => {
 			let n = t?.scope === void 0 ? void 0 : new Set(await a.resolveTargets({ scope: t.scope })), r = await e.store.query({
 				table: "_voltro_webhook_deliveries",
-				predicate: t?.targetId === void 0 ? void 0 : D("targetId", t.targetId),
+				predicate: t?.targetId === void 0 ? void 0 : O("targetId", t.targetId),
 				order: [{
 					column: "createdAt",
 					direction: "desc"
@@ -504,25 +513,25 @@ var j = ["network:outbound:*"], M = [{
 				skip: void 0,
 				projection: void 0
 			}), i = t?.since?.getTime();
-			return r.filter((e) => n === void 0 || n.has(String(e.targetId))).filter((e) => t?.status === void 0 || e.status === t.status).filter((e) => i === void 0 || Ne(e.createdAt) >= i).slice(0, t?.limit ?? 200).map(B);
+			return r.filter((e) => n === void 0 || n.has(String(e.targetId))).filter((e) => t?.status === void 0 || e.status === t.status).filter((e) => i === void 0 || Me(e.createdAt) >= i).slice(0, t?.limit ?? 200).map(V);
 		},
 		getDelivery: async (t) => {
 			let n = (await e.store.query({
 				table: "_voltro_webhook_deliveries",
-				predicate: D("id", t),
+				predicate: O("id", t),
 				order: [],
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			}))[0];
 			return n === void 0 ? null : {
-				...B(n),
-				payload: Pe(n.payload),
+				...V(n),
+				payload: Ne(n.payload),
 				responseBody: n.responseBody ?? null
 			};
 		},
 		updateTargetPayloadVersion: async (t, n) => {
-			if (n < 1 || !Number.isInteger(n)) throw new ce({ version: n });
+			if (n < 1 || !Number.isInteger(n)) throw new x({ version: n });
 			await a.resolveTargets(t), await e.store.update("_voltro_webhook_targets", t, {
 				payloadVersion: n,
 				updatedAt: /* @__PURE__ */ new Date()
@@ -531,7 +540,7 @@ var j = ["network:outbound:*"], M = [{
 		listTargets: async (t, n) => {
 			let r = await e.store.query({
 				table: "_voltro_webhook_targets",
-				predicate: t === void 0 ? void 0 : D("event", t),
+				predicate: t === void 0 ? void 0 : O("event", t),
 				order: [{
 					column: "createdAt",
 					direction: "desc"
@@ -558,15 +567,15 @@ var j = ["network:outbound:*"], M = [{
 		}
 	};
 	return a;
-}, He = C.gen(function* () {
-	return yield* ke;
-}), Ue = (e) => {
+}, Ve = w.gen(function* () {
+	return yield* Oe;
+}), He = (e) => {
 	if (e.webhooks === void 0) throw Error("useWebhooks: `ctx.webhooks` is not set. Declare an outgoing event with a `webhook:` block in a *.event.ts file, or an incoming endpoint in a *.webhook.tsx file — the service is wired the moment the app has either.");
 	return e.webhooks;
-}, We = 1e4, Ge = class {
+}, Ue = 1e4, We = class {
 	capacity;
 	cache = /* @__PURE__ */ new Map();
-	constructor(e = We) {
+	constructor(e = Ue) {
 		this.capacity = e;
 	}
 	evictExpired() {
@@ -601,36 +610,36 @@ var j = ["network:outbound:*"], M = [{
 	clear() {
 		this.cache.clear();
 	}
-}, K = null, Ke = () => (K === null && (K = new Ge()), K), q = {
+}, q = null, Ge = () => (q === null && (q = new We()), q), J = {
 	"5m": 3e5,
 	"1h": 36e5,
 	"6h": 216e5,
 	"1d": 864e5,
 	"7d": 6048e5,
 	"30d": 2592e6
-}, qe = (e) => e === void 0 ? q["7d"] : q[e] ?? q["7d"], J = (e, t) => ({
+}, Ke = (e) => e === void 0 ? J["7d"] : J[e] ?? J["7d"], Y = (e, t) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t)
-}), Je = "voltroWebhookVerification", Ye = class extends Error {
+}), qe = "voltroWebhookVerification", Je = class extends Error {
 	webhookId;
 	name = "UnverifiedIncomingWebhook";
 	constructor(e) {
 		super(`incoming webhook '${e}' declares no verification. It would be mounted as a public, unauthenticated POST that runs your application code, so the framework refuses to mount it. Pick one on the descriptor:\n  · provider: stripeWebhookProvider()   — a preset (HMAC scheme + idempotency + body type)\n  · signature: { _tag: 'hmac', algorithm: 'hmacSha256', header: 'X-Signature', encoding: 'hex', includeTimestamp: true }\n  · verification: 'provider'            — the handler verifies with the provider's own SDK\n  · verification: 'none'                — deliberately public; a gateway / IP allow-list owns it\nA signature-verified webhook reads its shared secret from VOLTRO_WEBHOOK_SECRET_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}. The framework never invents that value — the sender holds the other half of it.`), this.webhookId = e;
 	}
-}, Xe = (e) => `VOLTRO_WEBHOOK_SECRET_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, Ze = (e) => {
+}, Ye = (e) => `VOLTRO_WEBHOOK_SECRET_${e.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, Xe = (e) => {
 	let t = e.signature ?? e.provider?.signature ?? null;
 	return (e.verification === void 0 || e.verification === "signature") && t === null ? null : e.verification ?? "signature";
-}, Qe = (e, t) => {
-	let n = e.provider, r = e.signature ?? n?.signature ?? null, i = e.idempotency ?? n?.idempotency ?? null, a = e.bodyType ?? n?.bodyType ?? "json", o = Ze(e);
-	if (o === null) throw new Ye(e.id);
+}, Ze = (e, t) => {
+	let n = e.provider, r = e.signature ?? n?.signature ?? null, i = e.idempotency ?? n?.idempotency ?? null, a = e.bodyType ?? n?.bodyType ?? "json", o = Xe(e);
+	if (o === null) throw new Je(e.id);
 	let c = o;
-	c === "none" && O({ scope: `webhook:${e.id}` }).warn("incoming webhook mounted WITHOUT verification — anyone who can reach this URL can run its handler", {
+	c === "none" && A({ scope: `webhook:${e.id}` }).warn("incoming webhook mounted WITHOUT verification — anyone who can reach this URL can run its handler", {
 		webhookId: e.id,
 		verification: "none"
 	});
-	let l = t.idempotencyCache ?? Ke(), u = qe(i?.ttl), d = t.log ?? ((e) => {
-		O({ scope: `webhook:${e.webhookId}` }).debug("incoming webhook", {
+	let l = t.idempotencyCache ?? Ge(), u = Ke(i?.ttl), d = t.log ?? ((e) => {
+		A({ scope: `webhook:${e.webhookId}` }).debug("incoming webhook", {
 			status: e.status,
 			signatureOk: e.signatureOk,
 			idempotency: e.idempotency,
@@ -641,7 +650,7 @@ var j = ["network:outbound:*"], M = [{
 	return Object.assign(async (n) => {
 		let o = Date.now();
 		if (n.method !== "POST") {
-			let t = J(405, {
+			let t = Y(405, {
 				error: "method not allowed",
 				expected: "POST"
 			});
@@ -657,7 +666,7 @@ var j = ["network:outbound:*"], M = [{
 		if (r !== null && c === "signature") {
 			let i = await t.resolveSecret(e.id);
 			if (i === null) {
-				let t = `no signing secret configured — set ${Xe(e.id)}`, n = J(503, {
+				let t = `no signing secret configured — set ${Ye(e.id)}`, n = Y(503, {
 					error: "webhook not configured",
 					reason: t
 				});
@@ -677,7 +686,7 @@ var j = ["network:outbound:*"], M = [{
 					headers: n.headers
 				});
 				if (f = t.ok, !t.ok) {
-					let n = J(401, {
+					let n = Y(401, {
 						error: "invalid signature",
 						reason: t.reason
 					});
@@ -703,7 +712,7 @@ var j = ["network:outbound:*"], M = [{
 				p = r;
 			} else p = n.rawBody;
 		} catch (t) {
-			let n = J(400, {
+			let n = Y(400, {
 				error: "malformed body",
 				reason: t.message
 			});
@@ -718,9 +727,9 @@ var j = ["network:outbound:*"], M = [{
 		}
 		let m;
 		try {
-			m = w.decodeUnknownSync(e.payload)(p);
+			m = T.decodeUnknownSync(e.payload)(p);
 		} catch (t) {
-			let n = J(422, {
+			let n = Y(422, {
 				error: "schema validation failed",
 				reason: t.message
 			});
@@ -739,7 +748,7 @@ var j = ["network:outbound:*"], M = [{
 			if (h = typeof t == "string" ? n.headers[t.toLowerCase()] : t(n.headers, n.rawBody), h !== void 0 && h.length > 0) {
 				let t = l.claim(h, u);
 				if (g = t, t === "duplicate") {
-					let t = J(200, {
+					let t = Y(200, {
 						received: !0,
 						duplicate: !0
 					});
@@ -752,7 +761,7 @@ var j = ["network:outbound:*"], M = [{
 					}), t;
 				}
 				if (t === "inflight") {
-					let t = J(409, {
+					let t = Y(409, {
 						error: "request already in flight",
 						idempotencyKey: h
 					});
@@ -775,7 +784,7 @@ var j = ["network:outbound:*"], M = [{
 				idempotencyKey: h ?? "",
 				...r ? { workflows: r } : {}
 			}), h !== void 0 && l.commit(h);
-			let i = J(200, { received: !0 });
+			let i = Y(200, { received: !0 });
 			return d({
 				webhookId: e.id,
 				status: 200,
@@ -785,7 +794,7 @@ var j = ["network:outbound:*"], M = [{
 			}), i;
 		} catch (t) {
 			h !== void 0 && l.release(h);
-			let n = J(500, {
+			let n = Y(500, {
 				error: "handler threw",
 				reason: t.message
 			});
@@ -796,28 +805,28 @@ var j = ["network:outbound:*"], M = [{
 				idempotency: g,
 				durationMs: Date.now() - o,
 				errorMessage: t.message
-			}), _e({
+			}), ge({
 				error: t,
 				source: "webhook",
 				name: e.id,
 				fields: { status: 500 }
 			}), n;
 		}
-	}, { [Je]: c });
-}, $e = (e) => `/webhooks/${e}`, et = "_voltro_webhook_rate_windows", tt = 6e4, nt = (e, t) => `${e}@${t}`, rt = async (e, t, n) => (await e.query({
+	}, { [qe]: c });
+}, Qe = (e) => `/webhooks/${e}`, $e = "_voltro_webhook_rate_windows", et = 6e4, tt = (e, t) => `${e}@${t}`, nt = async (e, t, n) => (await e.query({
 	table: "_voltro_webhook_rate_windows",
-	predicate: E(D("scope", t), D("bucket", n)),
+	predicate: D(O("scope", t), O("bucket", n)),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, Y = 32, X = async (e, t, n) => {
-	for (let r = 0; r < Y; r++) {
+}))[0] ?? null, X = 32, rt = async (e, t, n) => {
+	for (let r = 0; r < X; r++) {
 		r > 0 && await new Promise((e) => setTimeout(e, r));
-		let i = await rt(e, t.key, n);
+		let i = await nt(e, t.key, n);
 		if (i === null) {
-			await e.insertIgnore(et, {
-				id: nt(t.key, n),
+			await e.insertIgnore($e, {
+				id: tt(t.key, n),
 				scope: t.key,
 				bucket: n,
 				count: 0,
@@ -830,27 +839,27 @@ var j = ["network:outbound:*"], M = [{
 		if (await e.updateMany("_voltro_webhook_rate_windows", {
 			count: i.count + 1,
 			updatedAt: /* @__PURE__ */ new Date()
-		}, { where: E(D("id", i.id), D("count", i.count)) }) === 1) return !0;
+		}, { where: D(O("id", i.id), O("count", i.count)) }) === 1) return !0;
 	}
-	throw Error(`webhook rate window: contention on (${t.key}, ${n}) exceeded ${Y} attempts`);
+	throw Error(`webhook rate window: contention on (${t.key}, ${n}) exceeded ${X} attempts`);
 }, it = async (e, t, n) => {
-	for (let r = 0; r < Y; r++) {
+	for (let r = 0; r < X; r++) {
 		r > 0 && await new Promise((e) => setTimeout(e, r));
-		let i = await rt(e, t, n);
+		let i = await nt(e, t, n);
 		if (i === null || i.count <= 0 || await e.updateMany("_voltro_webhook_rate_windows", {
 			count: i.count - 1,
 			updatedAt: /* @__PURE__ */ new Date()
-		}, { where: E(D("id", i.id), D("count", i.count)) }) === 1) return;
+		}, { where: D(O("id", i.id), O("count", i.count)) }) === 1) return;
 	}
-	throw Error(`webhook rate window: release contention on (${t}) exceeded ${Y} attempts`);
-}, at = async (e, t, n, r = tt) => {
+	throw Error(`webhook rate window: release contention on (${t}) exceeded ${X} attempts`);
+}, at = async (e, t, n, r = et) => {
 	if (t.length === 0) return {
 		acquired: !0,
 		retryInMs: 0
 	};
 	let i = Math.floor(n / r), a = [];
 	for (let o of t) {
-		if (await X(e, o, i)) {
+		if (await rt(e, o, i)) {
 			a.push(o);
 			continue;
 		}
@@ -923,7 +932,7 @@ var j = ["network:outbound:*"], M = [{
 	}
 }), ft = (e) => e === null ? "null" : Array.isArray(e) ? "array" : typeof e, pt = "_voltro_webhook_targets", mt = 32, ht = async (e, t) => (await e.query({
 	table: "_voltro_webhook_targets",
-	predicate: D("id", t),
+	predicate: O("id", t),
 	order: [],
 	take: 1,
 	skip: void 0,
@@ -941,7 +950,7 @@ var j = ["network:outbound:*"], M = [{
 			if (c === 0 || await e.updateMany("_voltro_webhook_targets", {
 				consecutiveFailures: 0,
 				updatedAt: i
-			}, { where: E(D("id", t), D("consecutiveFailures", c)) }) === 1) return {
+			}, { where: D(O("id", t), O("consecutiveFailures", c)) }) === 1) return {
 				consecutiveFailures: 0,
 				autoDisabled: !1
 			};
@@ -951,41 +960,48 @@ var j = ["network:outbound:*"], M = [{
 			consecutiveFailures: l,
 			updatedAt: i
 		};
-		if (d && (f.active = !1, f.autoDisabledAt = i, f.autoDisableReason = r.slice(0, 500)), await e.updateMany("_voltro_webhook_targets", f, { where: E(D("id", t), D("consecutiveFailures", c)) }) === 1) return {
+		if (d && (f.active = !1, f.autoDisabledAt = i, f.autoDisableReason = r.slice(0, 500)), await e.updateMany("_voltro_webhook_targets", f, { where: D(O("id", t), O("consecutiveFailures", c)) }) === 1) return {
 			consecutiveFailures: l,
 			autoDisabled: d
 		};
 	}
 	throw Error(`webhook auto-disable: streak CAS contention on target ${t} exceeded ${mt} attempts`);
-}, _t = w.Struct({
-	status: w.Number,
-	body: w.String,
-	latencyMs: w.Number,
-	retryAfterSec: w.Union(w.Number, w.Undefined),
-	transportError: w.Union(w.String, w.Undefined),
-	encodeError: w.Union(w.String, w.Undefined)
-}), vt = w.Struct({
-	outcome: w.Literal("succeeded", "failed", "retry"),
-	delayMs: w.Union(w.Number, w.Undefined),
-	reason: w.Union(w.String, w.Undefined),
-	autoDisabled: w.Union(w.Boolean, w.Undefined),
-	consecutiveFailures: w.Union(w.Number, w.Undefined)
-}), yt = w.Struct({
-	acquired: w.Boolean,
-	retryInMs: w.Number
+}, _t = T.Struct({
+	status: T.Number,
+	body: T.String,
+	latencyMs: T.Number,
+	retryAfterSec: T.Union([T.Number, T.Undefined]),
+	transportError: T.Union([T.String, T.Undefined]),
+	encodeError: T.Union([T.String, T.Undefined])
+}), vt = T.Struct({
+	outcome: T.Literals([
+		"succeeded",
+		"failed",
+		"retry"
+	]),
+	delayMs: T.Union([T.Number, T.Undefined]),
+	reason: T.Union([T.String, T.Undefined]),
+	autoDisabled: T.Union([T.Boolean, T.Undefined]),
+	consecutiveFailures: T.Union([T.Number, T.Undefined])
+}), yt = T.Struct({
+	acquired: T.Boolean,
+	retryInMs: T.Number
 }), bt = {
-	deliveryId: w.String,
-	targetId: w.String,
-	event: w.String,
-	eventId: w.String,
-	payloadJson: w.String,
-	attemptEpoch: w.optionalWith(w.Number, { default: () => 0 })
-}, xt = be.make({
-	name: "voltro.deliverWebhook",
+	deliveryId: T.String,
+	targetId: T.String,
+	event: T.String,
+	eventId: T.String,
+	payloadJson: T.String,
+	attemptEpoch: T.optional(T.Number)
+}, xt = ye.make("voltro.deliverWebhook", {
 	payload: bt,
-	success: w.Struct({
-		finalStatus: w.Literal("succeeded", "failed", "deferred"),
-		attempts: w.Number
+	success: T.Struct({
+		finalStatus: T.Literals([
+			"succeeded",
+			"failed",
+			"deferred"
+		]),
+		attempts: T.Number
 	}),
 	idempotencyKey: ({ deliveryId: e, attemptEpoch: t }) => `voltro.deliverWebhook:${e}:${t ?? 0}`
 }), St = 3e4, Ct = (e, t) => {
@@ -993,30 +1009,31 @@ var j = ["network:outbound:*"], M = [{
 	let n = Number(t.VOLTRO_WEBHOOK_TIMEOUT_MS);
 	return Number.isFinite(n) && n > 0 ? n : St;
 }, wt = (e, t = {}) => (n, r) => {
-	let { deliveryId: i, targetId: a, event: o, eventId: s, payloadJson: c } = n, l = O({ scope: `webhook:${i}` });
-	return C.gen(function* () {
-		let n = yield* k.make({
+	let { deliveryId: i, targetId: a, event: o, eventId: s, payloadJson: c } = n, l = A({ scope: `webhook:${i}` });
+	return w.gen(function* () {
+		let n = yield* j.make({
 			name: "fetch-target",
-			success: w.Union(w.Null, w.Struct({
-				id: w.String,
-				event: w.String,
-				url: w.String,
-				secret: w.String,
-				signing: w.Any,
-				retry: w.Any,
-				headers: w.Union(w.Record({
-					key: w.String,
-					value: w.String
-				}), w.Null),
-				rateLimitPerMinute: w.Union(w.Number, w.Null),
-				active: w.Boolean,
-				format: w.Literal("json", "form", "xml"),
-				tenantId: w.Union(w.String, w.Null)
-			})),
-			execute: C.tryPromise({
+			success: T.Union([T.Null, T.Struct({
+				id: T.String,
+				event: T.String,
+				url: T.String,
+				secret: T.String,
+				signing: T.Any,
+				retry: T.Any,
+				headers: T.Union([T.Record(T.String, T.String), T.Null]),
+				rateLimitPerMinute: T.Union([T.Number, T.Null]),
+				active: T.Boolean,
+				format: T.Literals([
+					"json",
+					"form",
+					"xml"
+				]),
+				tenantId: T.Union([T.String, T.Null])
+			})]),
+			execute: w.tryPromise({
 				try: async () => (await e.store.query({
 					table: "_voltro_webhook_targets",
-					predicate: D("id", a),
+					predicate: O("id", a),
 					order: [{
 						column: "createdAt",
 						direction: "asc"
@@ -1030,7 +1047,7 @@ var j = ["network:outbound:*"], M = [{
 					event: o,
 					cause: String(e)
 				}), /* @__PURE__ */ Error(`fetch-target failed: ${e.message}`))
-			}).pipe(C.orDie)
+			}).pipe(w.orDie)
 		});
 		if (n === null) return {
 			finalStatus: "failed",
@@ -1055,13 +1072,13 @@ var j = ["network:outbound:*"], M = [{
 				...l
 			});
 		};
-		if (n.active !== !0) return yield* k.make({
+		if (n.active !== !0) return yield* j.make({
 			name: "record-paused-pending",
-			success: w.Void,
-			execute: C.tryPromise({
+			success: T.Void,
+			execute: w.tryPromise({
 				try: () => r(`${i}:1`, 1, { status: "pending" }),
 				catch: (e) => /* @__PURE__ */ Error(`record-paused-pending failed: ${e.message}`)
-			}).pipe(C.orDie)
+			}).pipe(w.orDie)
 		}), {
 			finalStatus: "deferred",
 			attempts: 0
@@ -1076,10 +1093,10 @@ var j = ["network:outbound:*"], M = [{
 		for (let t = 1; t <= d.maxAttempts; t++) {
 			let u = `${i}:${t}`;
 			if (v.length > 0) for (let n = 0;; n++) {
-				let i = yield* k.make({
+				let i = yield* j.make({
 					name: `rate-acquire-${t}-${n}`,
 					success: yt,
-					execute: C.tryPromise({
+					execute: w.tryPromise({
 						try: () => at(e.store, v, Date.now(), h),
 						catch: (e) => (l.debug("rate-acquire raw error", {
 							targetId: a,
@@ -1087,40 +1104,40 @@ var j = ["network:outbound:*"], M = [{
 							attempt: t,
 							cause: String(e)
 						}), /* @__PURE__ */ Error(`rate-acquire failed: ${e.message}`))
-					}).pipe(C.orDie)
+					}).pipe(w.orDie)
 				});
 				if (i.acquired) break;
-				yield* k.make({
+				yield* j.make({
 					name: `record-rate-deferral-${t}-${n}`,
-					success: w.Void,
-					execute: C.tryPromise({
+					success: T.Void,
+					execute: w.tryPromise({
 						try: () => r(u, t, {
 							status: "pending",
 							nextAttemptAt: new Date(Date.now() + i.retryInMs)
 						}),
 						catch: (e) => /* @__PURE__ */ Error(`record-rate-deferral failed: ${e.message}`)
-					}).pipe(C.orDie)
-				}), yield* A.sleep({
+					}).pipe(w.orDie)
+				}), yield* ve.sleep({
 					name: `rate-window-sleep-${t}-${n}`,
 					duration: `${i.retryInMs} millis`
 				});
 			}
-			yield* k.make({
+			yield* j.make({
 				name: `record-attempt-start-${t}`,
-				success: w.Void,
-				execute: C.tryPromise({
+				success: T.Void,
+				execute: w.tryPromise({
 					try: () => r(u, t, {
 						status: "inFlight",
 						nextAttemptAt: null,
 						scheduledAt: /* @__PURE__ */ new Date()
 					}),
 					catch: (e) => /* @__PURE__ */ Error(`record-attempt-start failed: ${e.message}`)
-				}).pipe(C.orDie)
+				}).pipe(w.orDie)
 			});
-			let _ = yield* k.make({
+			let _ = yield* j.make({
 				name: `sign-and-post-${t}`,
 				success: _t,
-				execute: C.promise(async () => {
+				execute: w.promise(async () => {
 					let e = Date.now(), r;
 					try {
 						r = ot(n.format, c);
@@ -1140,7 +1157,7 @@ var j = ["network:outbound:*"], M = [{
 						secret: n.secret,
 						messageId: i
 					});
-					process.env.NODE_ENV === "production" && ye(n.url);
+					process.env.NODE_ENV === "production" && k(n.url);
 					try {
 						let c = await fetch(n.url, {
 							method: "POST",
@@ -1177,10 +1194,10 @@ var j = ["network:outbound:*"], M = [{
 						};
 					}
 				})
-			}), y = yield* k.make({
+			}), y = yield* j.make({
 				name: `classify-and-record-${t}`,
 				success: vt,
-				execute: C.tryPromise({
+				execute: w.tryPromise({
 					try: async () => {
 						let r = _.status >= 200 && _.status < 300, i = _.transportError !== void 0, o = _.encodeError !== void 0, s = _.status === 410, c = (t, n) => gt(e.store, a, t, n, /* @__PURE__ */ new Date(), !t && s);
 						if (r) {
@@ -1200,7 +1217,7 @@ var j = ["network:outbound:*"], M = [{
 								consecutiveFailures: t.consecutiveFailures
 							};
 						}
-						let l = o ? null : Ee(d, t, {
+						let l = o ? null : Te(d, t, {
 							...i ? {} : { status: _.status },
 							..._.retryAfterSec === void 0 ? {} : { retryAfterSeconds: _.retryAfterSec }
 						});
@@ -1245,7 +1262,7 @@ var j = ["network:outbound:*"], M = [{
 						attempt: t,
 						cause: String(e)
 					}), /* @__PURE__ */ Error(`classify-and-record failed: ${e.message}`))
-				}).pipe(C.orDie)
+				}).pipe(w.orDie)
 			});
 			if (y.autoDisabled === !0 && l.warn("target auto-disabled after consecutive failures", {
 				targetId: a,
@@ -1260,7 +1277,7 @@ var j = ["network:outbound:*"], M = [{
 				finalStatus: "failed",
 				attempts: t
 			};
-			y.delayMs !== void 0 && (yield* A.sleep({
+			y.delayMs !== void 0 && (yield* ve.sleep({
 				name: `retry-sleep-${t}`,
 				duration: `${y.delayMs} millis`
 			}));
@@ -1270,15 +1287,18 @@ var j = ["network:outbound:*"], M = [{
 			attempts: d.maxAttempts
 		};
 	});
-}, $ = "voltro.webhook.emit", Tt = (e) => typeof e.event == "string", Et = (e) => xe({
+}, $ = "voltro.webhook.emit", Tt = (e) => typeof e.event == "string", Et = (e) => be({
 	effect: $,
 	maxAttempts: 1,
-	handler: async ({ payload: t }) => {
+	handler: async ({ payload: t, outboxId: n }) => {
 		if (!Tt(t)) throw Error(`${$}: row payload has no \`event\` name — cannot resolve a descriptor. Got keys: ${Object.keys(t).join(", ") || "(none)"}`);
-		let n = e();
-		if (n === void 0) throw Error(`${$}: the outgoing-webhooks service is not available in this process. An emit was enqueued by a build that had the plugin registered; this one does not.`);
-		await n.emit(t.event, t.payload, { tenantId: t.tenantId });
+		let r = e();
+		if (r === void 0) throw Error(`${$}: the outgoing-webhooks service is not available in this process. An emit was enqueued by a build that had the plugin registered; this one does not.`);
+		await r.emit(t.event, t.payload, {
+			tenantId: t.tenantId,
+			eventId: n
+		});
 	}
 });
 //#endregion
-export { Ge as IdempotencyCache, tt as RATE_WINDOW_MS, et as RATE_WINDOW_TABLE, p as STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS, te as STANDARD_WEBHOOKS_ID_HEADER, c as STANDARD_WEBHOOKS_MAX_KEY_BYTES, l as STANDARD_WEBHOOKS_MIN_KEY_BYTES, _ as STANDARD_WEBHOOKS_SECRET_PREFIX, m as STANDARD_WEBHOOKS_SIGNATURE_HEADER, d as STANDARD_WEBHOOKS_TIMESTAMP_HEADER, u as STANDARD_WEBHOOKS_VERSION, pt as TARGETS_TABLE, Ye as UnverifiedIncomingWebhook, M as WEBHOOKS_EGRESS, j as WEBHOOKS_PLUGIN_PERMISSIONS, $ as WEBHOOK_EMIT_EFFECT, Je as WEBHOOK_VERIFICATION_PROPERTY, oe as WebhookDeliveryNotFound, se as WebhookPayloadInvalid, b as WebhookPayloadUnrepresentable, ce as WebhookPayloadVersionInvalid, x as WebhookSubscribeInvalid, S as WebhookTargetNotFound, ke as WebhooksService, le as _voltroWebhookDeliveriesTable, ue as _voltroWebhookEventStatsTable, de as _voltroWebhookRateWindowsTable, fe as _voltroWebhookTargetsTable, at as acquireRateSlots, we as asOutgoingEvent, wt as buildDeliverWebhookExecute, Ve as buildWebhooksService, Fe as compareVersions, X as consumeRateSlot, $e as defaultIncomingPath, ee as defaultOutgoingSignature, De as defaultRetryPolicy, re as defineIncomingWebhook, r as defineWebhookProvider, xt as deliverWebhookWorkflow, ot as encodePayload, F as eventsOf, Oe as fastRetryPolicy, Me as generateSecret, i as generateStandardWebhooksSecret, h as genericHmacSignature, Ke as getIdempotencyCache, v as githubSignature, Ce as hasWebhookAudience, Ze as incomingWebhookVerification, ne as isStandardWebhooksSecret, t as isWebhookDescriptor, Et as makeDeferredEmitHandler, V as matchesFilter, Qe as mountIncomingWebhook, Ee as nextRetry, N as parseDuration, qe as parseTtl, gt as recordDeliveryOutcome, it as releaseRateSlot, R as resolveSubscribe, f as signRequest, a as slackSignature, ae as standardWebhooksHeaders, o as standardWebhooksKey, g as standardWebhooksSignature, ie as standardWebhooksSignatureToken, n as standardWebhooksSignedContent, y as stripeSignature, Ue as useWebhooks, He as useWebhooksEffect, L as validateSubscribe, s as verifyRequest, e as verifyStandardWebhooks, pe as webhookTables, Se as webhooksPlugin };
+export { We as IdempotencyCache, et as RATE_WINDOW_MS, $e as RATE_WINDOW_TABLE, p as STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS, te as STANDARD_WEBHOOKS_ID_HEADER, c as STANDARD_WEBHOOKS_MAX_KEY_BYTES, l as STANDARD_WEBHOOKS_MIN_KEY_BYTES, _ as STANDARD_WEBHOOKS_SECRET_PREFIX, m as STANDARD_WEBHOOKS_SIGNATURE_HEADER, d as STANDARD_WEBHOOKS_TIMESTAMP_HEADER, u as STANDARD_WEBHOOKS_VERSION, pt as TARGETS_TABLE, Je as UnverifiedIncomingWebhook, M as WEBHOOKS_EGRESS, xe as WEBHOOKS_PLUGIN_PERMISSIONS, $ as WEBHOOK_EMIT_EFFECT, qe as WEBHOOK_VERIFICATION_PROPERTY, oe as WebhookDeliveryNotFound, se as WebhookPayloadInvalid, b as WebhookPayloadUnrepresentable, x as WebhookPayloadVersionInvalid, S as WebhookSubscribeInvalid, C as WebhookTargetNotFound, Oe as WebhooksService, ce as _voltroWebhookDeliveriesTable, le as _voltroWebhookEventStatsTable, ue as _voltroWebhookRateWindowsTable, de as _voltroWebhookTargetsTable, at as acquireRateSlots, N as asOutgoingEvent, wt as buildDeliverWebhookExecute, Be as buildWebhooksService, Pe as compareVersions, rt as consumeRateSlot, Qe as defaultIncomingPath, ee as defaultOutgoingSignature, Ee as defaultRetryPolicy, re as defineIncomingWebhook, r as defineWebhookProvider, xt as deliverWebhookWorkflow, ot as encodePayload, I as eventsOf, De as fastRetryPolicy, je as generateSecret, i as generateStandardWebhooksSecret, h as genericHmacSignature, Ge as getIdempotencyCache, v as githubSignature, Ce as hasWebhookAudience, Xe as incomingWebhookVerification, ne as isStandardWebhooksSecret, t as isWebhookDescriptor, Et as makeDeferredEmitHandler, H as matchesFilter, Ze as mountIncomingWebhook, Te as nextRetry, P as parseDuration, Ke as parseTtl, gt as recordDeliveryOutcome, it as releaseRateSlot, z as resolveSubscribe, f as signRequest, a as slackSignature, ae as standardWebhooksHeaders, o as standardWebhooksKey, g as standardWebhooksSignature, ie as standardWebhooksSignatureToken, n as standardWebhooksSignedContent, y as stripeSignature, He as useWebhooks, Ve as useWebhooksEffect, R as validateSubscribe, s as verifyRequest, e as verifyStandardWebhooks, fe as webhookTables, Se as webhooksPlugin };