@voltro/plugin-webhooks 0.86.0 → 0.87.0

package/dist/deliverWorkflow.js

@@ -62,6 +62,8 @@ var m = s.Struct({
 				event: s.String,
 				url: s.String,
 				secret: s.String,
+				previousSecret: s.optional(s.Union([s.String, s.Null])),
+				previousSecretUntil: s.optional(s.Union([s.String, s.Null])),
 				signing: s.Any,
 				retry: s.Any,
 				headers: s.Union([s.Record(s.String, s.String), s.Null]),
@@ -75,17 +77,26 @@ var m = s.Struct({
 				tenantId: s.Union([s.String, s.Null])
 			})]),
 			execute: o.tryPromise({
-				try: async () => (await p.store.query({
-					table: "_voltro_webhook_targets",
-					predicate: c("id", S),
-					order: [{
-						column: "createdAt",
-						direction: "asc"
-					}],
-					take: 1,
-					skip: void 0,
-					projection: void 0
-				}))[0] ?? null,
+				try: async () => {
+					let e = (await p.store.query({
+						table: "_voltro_webhook_targets",
+						predicate: c("id", S),
+						order: [{
+							column: "createdAt",
+							direction: "asc"
+						}],
+						take: 1,
+						skip: void 0,
+						projection: void 0
+					}))[0];
+					if (e === void 0) return null;
+					let t = e.previousSecretUntil;
+					return {
+						...e,
+						previousSecret: e.previousSecret ?? null,
+						previousSecretUntil: t instanceof Date ? t.toISOString() : t ?? null
+					};
+				},
 				catch: (e) => (E.debug("fetch-target raw error", {
 					targetId: S,
 					event: C,
@@ -196,7 +207,10 @@ var m = s.Struct({
 						};
 						throw e;
 					}
-					let a = Buffer.from(r.bytes), { headers: o } = e(O, {
+					let a = Buffer.from(r.bytes), o = u.previousSecret != null && u.previousSecretUntil != null && Date.parse(u.previousSecretUntil) > Date.now() && O._tag === "standardWebhooks" && O.previousSecret === void 0 ? {
+						...O,
+						previousSecret: u.previousSecret
+					} : O, { headers: s } = e(o, {
 						rawBody: a,
 						secret: u.secret,
 						messageId: x
@@ -207,7 +221,7 @@ var m = s.Struct({
 							method: "POST",
 							headers: {
 								"content-type": r.contentType,
-								...o,
+								...s,
 								"x-voltro-event": C,
 								"x-voltro-event-id": w,
 								"x-voltro-delivery-id": x,

package/dist/index.d.ts

@@ -617,6 +617,9 @@ emitter: () => Pick<WebhooksServiceShape, "emit"> | undefined) => OutboxHandlerD
  */
 export declare const matchesFilter: (filter: WebhookFilter | Readonly<Record<string, unknown>> | null, payload: unknown) => boolean;
 
+/** The longest overlap `rotateSecret` accepts, and its default: 30 days, unless ended earlier. */
+export declare const MAX_SECRET_OVERLAP_SECONDS: number;
+
 /** A mounted handler, carrying its verification declaration. */
 export declare type MountedIncomingWebhook = ((request: IncomingRequest) => Promise<IncomingResponse>) & {
     readonly [WEBHOOK_VERIFICATION_PROPERTY]: IncomingWebhookVerification;
@@ -822,6 +825,28 @@ export declare interface RetryPolicy {
 
 export declare type RetryStrategy = 'fixed' | 'linear' | 'exponential';
 
+/** What `rotateSecret` returns. */
+export declare interface RotatedSecret {
+    /** The new secret — returned once; hand it to the receiver. */
+    readonly secret: string;
+    /** Until when deliveries are signed under the previous secret too. `null`:
+     *  no overlap — asked for none, or a scheme with one signature per message. */
+    readonly previousSignedUntil: Date | null;
+}
+
+/** How long a rotated webhook secret keeps signing beside the new one. */
+export declare interface RotateSecretOptions {
+    /**
+     * Seconds every delivery still carries a signature under the previous
+     * secret, so the receiver can switch when it is ready. The length is the
+     * RECEIVER's switch-over time — nothing on the sending side can measure it —
+     * so by default the overlap lasts until {@link WebhooksServiceShape.endSecretOverlap}
+     * ends it (once the receiver has switched), and at most 30 days. Pass a
+     * number to bound it yourself; `0` switches at once (after a leak).
+     */
+    readonly overlapSeconds?: number;
+}
+
 export declare type SignatureScheme = HmacSignatureScheme | CustomSignatureScheme | StandardWebhooksSignatureScheme;
 
 export declare interface SignedRequest {
@@ -1250,7 +1275,7 @@ export declare const _voltroWebhookDeliveriesTable: Table<"_voltro_webhook_deliv
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */
@@ -1389,6 +1414,13 @@ export declare const _voltroWebhookTargetsTable: Table<"_voltro_webhook_targets"
      *  (a non-ciphertext value passes through); `voltro db encrypt-column
      *  _voltro_webhook_targets.secret` converts them in place. */
     readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** During a rotation (`rotateSecret`): the secret the receiver may still
+     *  verify with. Every delivery until {@link previousSecretUntil} carries a
+     *  signature under it beside the new one (Standard Webhooks' signature list),
+     *  so the receiver switches when it is ready. Encrypted like `secret`. */
+    readonly previousSecret: ColumnBuilder<string | null, "text", boolean>;
+    /** When deliveries stop signing under `previousSecret`. */
+    readonly previousSecretUntil: ColumnBuilder<Date | null, "timestamp", boolean>;
     /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
      *  Stored as JSON so future schemes don't require a schema migration. */
     readonly signing: ColumnBuilder<unknown, "json", boolean>;
@@ -1702,8 +1734,11 @@ export declare interface WebhooksServiceShape {
      * must sign identically, and the previous way to achieve it was delete +
      * re-subscribe, minting new ids and orphaning the delivery history.
      */
-    readonly rotateSecret: (target: TargetSelector) => Promise<{
-        readonly secret: string;
+    readonly rotateSecret: (target: TargetSelector, options?: RotateSecretOptions) => Promise<RotatedSecret>;
+    /** End a rotation's overlap once the receiver verifies with the new secret: the
+     *  previous secret stops signing at once. Returns how many targets were overlapping. */
+    readonly endSecretOverlap: (target: TargetSelector) => Promise<{
+        readonly ended: number;
     }>;
     /** Re-pin a target's `payloadVersion` to the event's current
      *  version. Called from the dashboard's "Re-pin" action after
@@ -1805,6 +1840,13 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
      *  (a non-ciphertext value passes through); `voltro db encrypt-column
      *  _voltro_webhook_targets.secret` converts them in place. */
     readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** During a rotation (`rotateSecret`): the secret the receiver may still
+     *  verify with. Every delivery until {@link previousSecretUntil} carries a
+     *  signature under it beside the new one (Standard Webhooks' signature list),
+     *  so the receiver switches when it is ready. Encrypted like `secret`. */
+    readonly previousSecret: ColumnBuilder<string | null, "text", boolean>;
+    /** When deliveries stop signing under `previousSecret`. */
+    readonly previousSecretUntil: ColumnBuilder<Date | null, "timestamp", boolean>;
     /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
      *  Stored as JSON so future schemes don't require a schema migration. */
     readonly signing: ColumnBuilder<unknown, "json", boolean>;
@@ -1910,7 +1952,7 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */

package/dist/index.js

@@ -5,13 +5,13 @@ import { STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS as c, STANDARD_WEBHOOKS_ID_
 import { defaultOutgoingSignature as C, genericHmacSignature as w, githubSignature as T, signRequest as E, slackSignature as D, standardWebhooksSignature as O, stripeSignature as k, verifyRequest as A } from "./signing.js";
 import { defaultRetryPolicy as j, fastRetryPolicy as M, nextRetry as N, parseDuration as P } from "./retry.js";
 import { WebhookDeliveryNotFound as F, WebhookPayloadInvalid as I, WebhookPayloadUnrepresentable as L, WebhookPayloadVersionInvalid as R, WebhookSubscribeInvalid as z, WebhookTargetNotFound as B } from "./errors.js";
-import { WebhooksService as V, buildWebhooksService as H, compareVersions as U, eventsOf as W, generateSecret as G, matchesFilter as K, resolveSubscribe as q, useWebhooks as J, useWebhooksEffect as Y, validateSubscribe as X } from "./service.js";
-import { IdempotencyCache as Z, getIdempotencyCache as Q, parseTtl as $ } from "./idempotency.js";
-import { UnverifiedIncomingWebhook as ee, WEBHOOK_VERIFICATION_PROPERTY as te, defaultIncomingPath as ne, incomingWebhookVerification as re, mountIncomingWebhook as ie } from "./incoming.js";
-import { RATE_WINDOW_MS as ae, RATE_WINDOW_TABLE as oe, acquireRateSlots as se, consumeRateSlot as ce, releaseRateSlot as le } from "./rateLimit.js";
-import { encodePayload as ue } from "./encode.js";
-import { TARGETS_TABLE as de, recordDeliveryOutcome as fe } from "./autoDisable.js";
-import { buildDeliverWebhookExecute as pe, deliverWebhookWorkflow as me } from "./deliverWorkflow.js";
-import { _voltroWebhookDeliveriesTable as he, _voltroWebhookEventStatsTable as ge, _voltroWebhookRateWindowsTable as _e, _voltroWebhookTargetsTable as ve, webhookTables as ye } from "./mixin.js";
-import { WEBHOOK_EMIT_EFFECT as be, makeDeferredEmitHandler as xe } from "./deferredEmit.js";
-export { Z as IdempotencyCache, ae as RATE_WINDOW_MS, oe as RATE_WINDOW_TABLE, c as STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS, l as STANDARD_WEBHOOKS_ID_HEADER, u as STANDARD_WEBHOOKS_MAX_KEY_BYTES, d as STANDARD_WEBHOOKS_MIN_KEY_BYTES, f as STANDARD_WEBHOOKS_SECRET_PREFIX, p as STANDARD_WEBHOOKS_SIGNATURE_HEADER, m as STANDARD_WEBHOOKS_TIMESTAMP_HEADER, h as STANDARD_WEBHOOKS_VERSION, de as TARGETS_TABLE, ee as UnverifiedIncomingWebhook, e as WEBHOOKS_EGRESS, t as WEBHOOKS_PLUGIN_PERMISSIONS, be as WEBHOOK_EMIT_EFFECT, te as WEBHOOK_VERIFICATION_PROPERTY, F as WebhookDeliveryNotFound, I as WebhookPayloadInvalid, L as WebhookPayloadUnrepresentable, R as WebhookPayloadVersionInvalid, z as WebhookSubscribeInvalid, B as WebhookTargetNotFound, V as WebhooksService, he as _voltroWebhookDeliveriesTable, ge as _voltroWebhookEventStatsTable, _e as _voltroWebhookRateWindowsTable, ve as _voltroWebhookTargetsTable, se as acquireRateSlots, o as asOutgoingEvent, pe as buildDeliverWebhookExecute, H as buildWebhooksService, U as compareVersions, ce as consumeRateSlot, ne as defaultIncomingPath, C as defaultOutgoingSignature, j as defaultRetryPolicy, r as defineIncomingWebhook, i as defineWebhookProvider, me as deliverWebhookWorkflow, ue as encodePayload, W as eventsOf, M as fastRetryPolicy, G as generateSecret, g as generateStandardWebhooksSecret, w as genericHmacSignature, Q as getIdempotencyCache, T as githubSignature, s as hasWebhookAudience, re as incomingWebhookVerification, _ as isStandardWebhooksSecret, a as isWebhookDescriptor, xe as makeDeferredEmitHandler, K as matchesFilter, ie as mountIncomingWebhook, N as nextRetry, P as parseDuration, $ as parseTtl, fe as recordDeliveryOutcome, le as releaseRateSlot, q as resolveSubscribe, E as signRequest, D as slackSignature, v as standardWebhooksHeaders, y as standardWebhooksKey, O as standardWebhooksSignature, b as standardWebhooksSignatureToken, x as standardWebhooksSignedContent, k as stripeSignature, J as useWebhooks, Y as useWebhooksEffect, X as validateSubscribe, A as verifyRequest, S as verifyStandardWebhooks, ye as webhookTables, n as webhooksPlugin };
+import { MAX_SECRET_OVERLAP_SECONDS as V, WebhooksService as H, buildWebhooksService as U, compareVersions as W, eventsOf as G, generateSecret as K, matchesFilter as q, resolveSubscribe as J, useWebhooks as Y, useWebhooksEffect as X, validateSubscribe as Z } from "./service.js";
+import { IdempotencyCache as Q, getIdempotencyCache as $, parseTtl as ee } from "./idempotency.js";
+import { UnverifiedIncomingWebhook as te, WEBHOOK_VERIFICATION_PROPERTY as ne, defaultIncomingPath as re, incomingWebhookVerification as ie, mountIncomingWebhook as ae } from "./incoming.js";
+import { RATE_WINDOW_MS as oe, RATE_WINDOW_TABLE as se, acquireRateSlots as ce, consumeRateSlot as le, releaseRateSlot as ue } from "./rateLimit.js";
+import { encodePayload as de } from "./encode.js";
+import { TARGETS_TABLE as fe, recordDeliveryOutcome as pe } from "./autoDisable.js";
+import { buildDeliverWebhookExecute as me, deliverWebhookWorkflow as he } from "./deliverWorkflow.js";
+import { _voltroWebhookDeliveriesTable as ge, _voltroWebhookEventStatsTable as _e, _voltroWebhookRateWindowsTable as ve, _voltroWebhookTargetsTable as ye, webhookTables as be } from "./mixin.js";
+import { WEBHOOK_EMIT_EFFECT as xe, makeDeferredEmitHandler as Se } from "./deferredEmit.js";
+export { Q as IdempotencyCache, V as MAX_SECRET_OVERLAP_SECONDS, oe as RATE_WINDOW_MS, se as RATE_WINDOW_TABLE, c as STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS, l as STANDARD_WEBHOOKS_ID_HEADER, u as STANDARD_WEBHOOKS_MAX_KEY_BYTES, d as STANDARD_WEBHOOKS_MIN_KEY_BYTES, f as STANDARD_WEBHOOKS_SECRET_PREFIX, p as STANDARD_WEBHOOKS_SIGNATURE_HEADER, m as STANDARD_WEBHOOKS_TIMESTAMP_HEADER, h as STANDARD_WEBHOOKS_VERSION, fe as TARGETS_TABLE, te as UnverifiedIncomingWebhook, e as WEBHOOKS_EGRESS, t as WEBHOOKS_PLUGIN_PERMISSIONS, xe as WEBHOOK_EMIT_EFFECT, ne as WEBHOOK_VERIFICATION_PROPERTY, F as WebhookDeliveryNotFound, I as WebhookPayloadInvalid, L as WebhookPayloadUnrepresentable, R as WebhookPayloadVersionInvalid, z as WebhookSubscribeInvalid, B as WebhookTargetNotFound, H as WebhooksService, ge as _voltroWebhookDeliveriesTable, _e as _voltroWebhookEventStatsTable, ve as _voltroWebhookRateWindowsTable, ye as _voltroWebhookTargetsTable, ce as acquireRateSlots, o as asOutgoingEvent, me as buildDeliverWebhookExecute, U as buildWebhooksService, W as compareVersions, le as consumeRateSlot, re as defaultIncomingPath, C as defaultOutgoingSignature, j as defaultRetryPolicy, r as defineIncomingWebhook, i as defineWebhookProvider, he as deliverWebhookWorkflow, de as encodePayload, G as eventsOf, M as fastRetryPolicy, K as generateSecret, g as generateStandardWebhooksSecret, w as genericHmacSignature, $ as getIdempotencyCache, T as githubSignature, s as hasWebhookAudience, ie as incomingWebhookVerification, _ as isStandardWebhooksSecret, a as isWebhookDescriptor, Se as makeDeferredEmitHandler, q as matchesFilter, ae as mountIncomingWebhook, N as nextRetry, P as parseDuration, ee as parseTtl, pe as recordDeliveryOutcome, ue as releaseRateSlot, J as resolveSubscribe, E as signRequest, D as slackSignature, v as standardWebhooksHeaders, y as standardWebhooksKey, O as standardWebhooksSignature, b as standardWebhooksSignatureToken, x as standardWebhooksSignedContent, k as stripeSignature, Y as useWebhooks, X as useWebhooksEffect, Z as validateSubscribe, A as verifyRequest, S as verifyStandardWebhooks, be as webhookTables, n as webhooksPlugin };

package/dist/mixin.d.ts

@@ -32,7 +32,7 @@ export declare const _voltroWebhookDeliveriesTable: Table<"_voltro_webhook_deliv
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */
@@ -171,6 +171,13 @@ export declare const _voltroWebhookTargetsTable: Table<"_voltro_webhook_targets"
      *  (a non-ciphertext value passes through); `voltro db encrypt-column
      *  _voltro_webhook_targets.secret` converts them in place. */
     readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** During a rotation (`rotateSecret`): the secret the receiver may still
+     *  verify with. Every delivery until {@link previousSecretUntil} carries a
+     *  signature under it beside the new one (Standard Webhooks' signature list),
+     *  so the receiver switches when it is ready. Encrypted like `secret`. */
+    readonly previousSecret: ColumnBuilder<string | null, "text", boolean>;
+    /** When deliveries stop signing under `previousSecret`. */
+    readonly previousSecretUntil: ColumnBuilder<Date | null, "timestamp", boolean>;
     /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
      *  Stored as JSON so future schemes don't require a schema migration. */
     readonly signing: ColumnBuilder<unknown, "json", boolean>;
@@ -287,6 +294,13 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
      *  (a non-ciphertext value passes through); `voltro db encrypt-column
      *  _voltro_webhook_targets.secret` converts them in place. */
     readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** During a rotation (`rotateSecret`): the secret the receiver may still
+     *  verify with. Every delivery until {@link previousSecretUntil} carries a
+     *  signature under it beside the new one (Standard Webhooks' signature list),
+     *  so the receiver switches when it is ready. Encrypted like `secret`. */
+    readonly previousSecret: ColumnBuilder<string | null, "text", boolean>;
+    /** When deliveries stop signing under `previousSecret`. */
+    readonly previousSecretUntil: ColumnBuilder<Date | null, "timestamp", boolean>;
     /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
      *  Stored as JSON so future schemes don't require a schema migration. */
     readonly signing: ColumnBuilder<unknown, "json", boolean>;
@@ -392,7 +406,7 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */

package/dist/mixin.js

@@ -6,6 +6,8 @@ var u = o("_voltro_webhook_targets", {
 	event: s(),
 	url: s(),
 	secret: s().encrypted().serverOnly(),
+	previousSecret: s().encrypted().serverOnly().nullable(),
+	previousSecretUntil: c().nullable(),
 	signing: r(),
 	retry: r(),
 	scope: r().nullable(),

package/dist/service.js

@@ -8,12 +8,12 @@ import { randomBytes as m, randomUUID as h } from "node:crypto";
 import { and as g, eq as _ } from "@voltro/database";
 import { assertPublicUrl as v } from "@voltro/integration-http";
 //#region src/service.ts
-var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32, x = 32, S = () => m(b).toString("hex"), C = (e) => e.events ?? (e.event === void 0 ? [] : [e.event]), w = (e, t) => {
+var y = 2592e3, b = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, x = 32, S = 32, C = () => m(x).toString("hex"), w = (e) => e.events ?? (e.event === void 0 ? [] : [e.event]), T = (e, t) => {
 	if (e !== void 0 && t?._tag === "standardWebhooks" && !n(e)) throw new c({
 		field: "secret",
 		reason: "a standard-webhooks target needs the spec's secret serialization (\"whsec_\" + base64 of 24..64 random bytes) — mint one with generateStandardWebhooksSecret(), or omit `secret` and let subscribe mint it. If the incompatible key is inherited, rotate the endpoint secret and update the receiver before adding the event"
 	});
-}, T = (e) => {
+}, E = (e) => {
 	let t;
 	try {
 		t = new URL(e.url);
@@ -35,7 +35,7 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 			reason: e.message
 		});
 	}
-	let n = C(e);
+	let n = w(e);
 	if (n.length === 0) throw new c({
 		field: "event",
 		reason: "event id required"
@@ -52,11 +52,11 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 		field: "events",
 		reason: "duplicate event — one row per event, so a repeat would deliver twice"
 	});
-	if (e.secret !== void 0 && e.secret.length < x) throw new c({
+	if (e.secret !== void 0 && e.secret.length < S) throw new c({
 		field: "secret",
-		reason: `secret must be at least ${x} chars`
+		reason: `secret must be at least ${S} chars`
 	});
-	if (w(e.secret, e.signing), e.retry !== void 0) {
+	if (T(e.secret, e.signing), e.retry !== void 0) {
 		if (e.retry.maxAttempts < 1) throw new c({
 			field: "retry",
 			reason: "retry.maxAttempts must be ≥ 1"
@@ -74,9 +74,9 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 		field: "autoDisableAfter",
 		reason: `autoDisableAfter must be a positive integer, got ${e.autoDisableAfter}`
 	});
-}, E = (e, n, a, o) => {
-	let s = e.signing ?? n?.defaultSigning ?? r(), c = s._tag === "standardWebhooks" ? t : S, l = o ?? e.secret ?? c();
-	return w(l, s), {
+}, D = (e, n, a, o) => {
+	let s = e.signing ?? n?.defaultSigning ?? r(), c = s._tag === "standardWebhooks" ? t : C, l = o ?? e.secret ?? c();
+	return T(l, s), {
 		id: h(),
 		tenantId: e.tenantId ?? null,
 		event: a ?? e.event ?? "",
@@ -97,14 +97,14 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 		payloadVersion: e.payloadVersion ?? n?.version ?? 1,
 		description: e.description ?? null
 	};
-}, D = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, O = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : null, k = (e) => {
+}, O = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, k = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : null, A = (e) => {
 	if (typeof e != "string") return e;
 	try {
 		return JSON.parse(e);
 	} catch {
 		return e;
 	}
-}, A = (e) => ({
+}, j = (e) => ({
 	id: String(e.id),
 	deliveryId: String(e.deliveryId),
 	targetId: String(e.targetId),
@@ -115,28 +115,28 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 	responseStatus: e.responseStatus ?? null,
 	errorMessage: e.errorMessage ?? null,
 	latencyMs: e.latencyMs ?? null,
-	scheduledAt: O(e.scheduledAt),
-	nextAttemptAt: O(e.nextAttemptAt),
-	createdAt: O(e.createdAt)
-}), j = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", M = (e, t) => {
+	scheduledAt: k(e.scheduledAt),
+	nextAttemptAt: k(e.nextAttemptAt),
+	createdAt: k(e.createdAt)
+}), M = (e, t) => e === t ? "current" : e < t ? "behind" : "ahead", N = (e, t) => {
 	if (e === null) return !0;
 	let n = { payload: t };
-	for (let [t, r] of Object.entries(e)) if (!F(N(n, t), r)) return !1;
+	for (let [t, r] of Object.entries(e)) if (!I(P(n, t), r)) return !1;
 	return !0;
-}, N = (e, t) => {
+}, P = (e, t) => {
 	let n = t.split("."), r = e;
 	for (let e of n) {
 		if (typeof r != "object" || !r) return;
 		r = r[e];
 	}
 	return r;
-}, P = (e, t) => {
+}, F = (e, t) => {
 	if (typeof e == "number" && typeof t == "number") return e - t;
 	if (typeof e == "string" && typeof t == "string") return e < t ? -1 : +(e > t);
-}, F = (e, t) => {
+}, I = (e, t) => {
 	if (typeof t == "object" && t && !Array.isArray(t)) {
 		let n = t;
-		return "eq" in n && e !== n.eq || "in" in n && (!Array.isArray(n.in) || !n.in.includes(e)) || "gt" in n && !((P(e, n.gt) ?? 0) > 0) || "gte" in n && !((P(e, n.gte) ?? -1) >= 0) || "lt" in n && !((P(e, n.lt) ?? 0) < 0) || "lte" in n && !((P(e, n.lte) ?? 1) <= 0) ? !1 : [
+		return "eq" in n && e !== n.eq || "in" in n && (!Array.isArray(n.in) || !n.in.includes(e)) || "gt" in n && !((F(e, n.gt) ?? 0) > 0) || "gte" in n && !((F(e, n.gte) ?? -1) >= 0) || "lt" in n && !((F(e, n.lt) ?? 0) < 0) || "lte" in n && !((F(e, n.lte) ?? 1) <= 0) ? !1 : [
 			"eq",
 			"in",
 			"gt",
@@ -146,9 +146,9 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 		].some((e) => e in n);
 	}
 	return e === t;
-}, I = (e, t) => e !== null && Object.entries(t).every(([t, n]) => e[t] === n), L = 500, R = 200, z = async (e, t) => {
+}, L = (e, t) => e !== null && Object.entries(t).every(([t, n]) => e[t] === n), R = 500, z = 200, B = async (e, t) => {
 	let n = [];
-	for (let r = 0; r < R; r += 1) {
+	for (let r = 0; r < z; r += 1) {
 		let i = await e.store.query({
 			table: "_voltro_webhook_targets",
 			predicate: t,
@@ -156,20 +156,20 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 				column: "id",
 				direction: "asc"
 			}],
-			take: L,
-			skip: r === 0 ? void 0 : r * L,
+			take: R,
+			skip: r === 0 ? void 0 : r * R,
 			projection: void 0
 		});
-		if (n.push(...i), i.length < L) return n;
+		if (n.push(...i), i.length < R) return n;
 	}
-	throw Error(`webhooks: more than ${R * L} rows in \`_voltro_webhook_targets\` — refusing to answer a scope lookup from a partial scan. A truncated scan mints a fresh secret for a live endpoint (breaking its signatures) or reports that a real scope matches nothing.`);
-}, B = async (e, t) => {
-	let n = (await z(e)).filter((e) => I(e.scope, t));
+	throw Error(`webhooks: more than ${z * R} rows in \`_voltro_webhook_targets\` — refusing to answer a scope lookup from a partial scan. A truncated scan mints a fresh secret for a live endpoint (breaking its signatures) or reports that a real scope matches nothing.`);
+}, V = async (e, t) => {
+	let n = (await B(e)).filter((e) => L(e.scope, t));
 	if (n.length === 0) return;
 	let r = new Set(n.map((e) => e.secret));
 	if (r.size > 1) throw Error(`webhooks.subscribe: the scope ${JSON.stringify(t)} matches ${n.length} targets with ${r.size} different secrets, so it is not one endpoint. Pass \`secret\` explicitly, or narrow the scope.`);
 	return [...r][0];
-}, V = async (e, t) => {
+}, H = async (e, t) => {
 	try {
 		let n = await e.store.query({
 			table: "_voltro_webhook_event_stats",
@@ -195,11 +195,11 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 			updatedAt: r
 		});
 	} catch {}
-}, H = (n, r, i = {}) => {
+}, U = (n, r, i = {}) => {
 	let c = new Map((i.events ?? []).map((e) => [e.id, e])), u = {
 		subscribe: async (e) => {
-			T(e);
-			let r = C(e), i = e.secret === void 0 && e.scope !== void 0 ? await B(n, e.scope) : void 0, a = e.secret ?? i ?? t(), o = r.map((t) => E(e, c.get(t), t, a));
+			E(e);
+			let r = w(e), i = e.secret === void 0 && e.scope !== void 0 ? await V(n, e.scope) : void 0, a = e.secret ?? i ?? t(), o = r.map((t) => D(e, c.get(t), t, a));
 			for (let e of o) await n.store.insert("_voltro_webhook_targets", {
 				...e,
 				createdAt: /* @__PURE__ */ new Date(),
@@ -228,9 +228,9 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 					issues: e.failure.message
 				});
 			}
-			let d = a?.eventId ?? h(), m = a?.tenantId, v = await z(n, m == null ? _("event", u) : g(_("event", u), _("tenantId", m)));
-			await V(n, u);
-			let y = v.filter((e) => M(e.filter, i)), b = [], x = JSON.stringify(i), S = async (e, t) => {
+			let d = a?.eventId ?? h(), m = a?.tenantId, v = await B(n, m == null ? _("event", u) : g(_("event", u), _("tenantId", m)));
+			await H(n, u);
+			let y = v.filter((e) => N(e.filter, i)), b = [], x = JSON.stringify(i), S = async (e, t) => {
 				let i = h();
 				e.active ? (await r({
 					deliveryId: i,
@@ -310,7 +310,7 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 				})).length === 0) throw new l({ targetId: e });
 				return [e];
 			}
-			let t = (await z(n)).filter((t) => I(t.scope, e.scope)).map((e) => e.id);
+			let t = (await B(n)).filter((t) => L(t.scope, e.scope)).map((e) => e.id);
 			if (t.length === 0) throw Error(`webhooks: no target matches scope ${JSON.stringify(e.scope)} — the operation would have silently done nothing`);
 			return t;
 		},
@@ -353,16 +353,52 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 		deleteTarget: async (e) => {
 			for (let t of await u.resolveTargets(e)) await n.store.delete("_voltro_webhook_targets", t), await n.store.deleteMany("_voltro_webhook_deliveries", { where: g(_("targetId", t), _("status", "pending")) });
 		},
-		rotateSecret: async (e) => {
-			let r = t();
-			for (let t of await u.resolveTargets(e)) await n.store.update("_voltro_webhook_targets", t, {
-				secret: r,
-				updatedAt: /* @__PURE__ */ new Date()
-			});
-			return { secret: r };
+		rotateSecret: async (e, r = {}) => {
+			let i = r.overlapSeconds ?? 2592e3;
+			if (!Number.isInteger(i) || i < 0 || i > 2592e3) throw Error(`rotateSecret: overlapSeconds must be an integer between 0 and ${y} (30 days), got ${String(i)}`);
+			let a = t(), o = i > 0 ? /* @__PURE__ */ new Date(Math.floor(Date.now() / 1e3) * 1e3 + i * 1e3) : null, s = o !== null;
+			for (let t of await u.resolveTargets(e)) {
+				let [e] = await n.store.query({
+					table: "_voltro_webhook_targets",
+					predicate: _("id", t),
+					order: [],
+					take: 1,
+					skip: void 0,
+					projection: void 0
+				}), r = typeof e?.signing == "string" ? JSON.parse(e.signing) : e?.signing, i = o !== null && e !== void 0 && r?._tag === "standardWebhooks";
+				i || (s = !1), await n.store.update("_voltro_webhook_targets", t, {
+					secret: a,
+					previousSecret: i ? e.secret : null,
+					previousSecretUntil: i ? o : null,
+					updatedAt: /* @__PURE__ */ new Date()
+				});
+			}
+			return {
+				secret: a,
+				previousSignedUntil: s ? o : null
+			};
+		},
+		endSecretOverlap: async (e) => {
+			let t = 0;
+			for (let r of await u.resolveTargets(e)) {
+				let [e] = await n.store.query({
+					table: "_voltro_webhook_targets",
+					predicate: _("id", r),
+					order: [],
+					take: 1,
+					skip: void 0,
+					projection: void 0
+				});
+				e?.previousSecret != null && (await n.store.update("_voltro_webhook_targets", r, {
+					previousSecret: null,
+					previousSecretUntil: null,
+					updatedAt: /* @__PURE__ */ new Date()
+				}), t += 1);
+			}
+			return { ended: t };
 		},
 		updateTarget: async (e, t) => {
-			if (t.url !== void 0 && T({
+			if (t.url !== void 0 && E({
 				event: "x",
 				url: t.url
 			}), t.rateLimitPerMinute !== void 0 && t.rateLimitPerMinute !== null && (!Number.isInteger(t.rateLimitPerMinute) || t.rateLimitPerMinute < 1)) throw Error("updateTarget: rateLimitPerMinute must be a positive integer or null");
@@ -427,7 +463,7 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 				skip: void 0,
 				projection: void 0
 			}), i = e?.since?.getTime();
-			return r.filter((e) => t === void 0 || t.has(String(e.targetId))).filter((t) => e?.status === void 0 || t.status === e.status).filter((e) => i === void 0 || D(e.createdAt) >= i).slice(0, e?.limit ?? 200).map(A);
+			return r.filter((e) => t === void 0 || t.has(String(e.targetId))).filter((t) => e?.status === void 0 || t.status === e.status).filter((e) => i === void 0 || O(e.createdAt) >= i).slice(0, e?.limit ?? 200).map(j);
 		},
 		getDelivery: async (e) => {
 			let t = (await n.store.query({
@@ -439,8 +475,8 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 				projection: void 0
 			}))[0];
 			return t === void 0 ? null : {
-				...A(t),
-				payload: k(t.payload),
+				...j(t),
+				payload: A(t.payload),
 				responseBody: t.responseBody ?? null
 			};
 		},
@@ -481,11 +517,11 @@ var y = class extends u.Service()("@voltro/webhooks/WebhooksService") {}, b = 32
 		}
 	};
 	return u;
-}, U = d.gen(function* () {
-	return yield* y;
-}), W = (e) => {
+}, W = d.gen(function* () {
+	return yield* b;
+}), G = (e) => {
 	if (e.webhooks === void 0) throw Error("useWebhooks: `ctx.webhooks` is not set. Declare an outgoing event with a `webhook:` block in a *.event.ts file, or an incoming endpoint in a *.webhook.tsx file — the service is wired the moment the app has either.");
 	return e.webhooks;
 };
 //#endregion
-export { y as WebhooksService, H as buildWebhooksService, j as compareVersions, C as eventsOf, S as generateSecret, M as matchesFilter, E as resolveSubscribe, W as useWebhooks, U as useWebhooksEffect, T as validateSubscribe };
+export { y as MAX_SECRET_OVERLAP_SECONDS, b as WebhooksService, U as buildWebhooksService, M as compareVersions, w as eventsOf, C as generateSecret, N as matchesFilter, D as resolveSubscribe, G as useWebhooks, W as useWebhooksEffect, E as validateSubscribe };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-webhooks",
-  "version": "0.86.0",
+  "version": "0.87.0",
   "description": "Webhooks plugin — first-class outgoing (multi-target, durable-workflow delivery, HMAC signing, retry policies, rate limits) + incoming (signature verification, idempotency, provider templates for Stripe / GitHub / Slack / generic).",
   "keywords": [
     "voltro",
@@ -48,12 +48,12 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.86.0",
-    "@voltro/integration-http": "0.86.0",
-    "@voltro/logger": "0.86.0",
-    "@voltro/plugin-multitenancy": "0.86.0",
-    "@voltro/protocol": "0.86.0",
-    "@voltro/runtime": "0.86.0"
+    "@voltro/database": "0.87.0",
+    "@voltro/integration-http": "0.87.0",
+    "@voltro/logger": "0.87.0",
+    "@voltro/plugin-multitenancy": "0.87.0",
+    "@voltro/protocol": "0.87.0",
+    "@voltro/runtime": "0.87.0"
   },
   "peerDependencies": {
     "effect": "4.0.1"