@voltro/plugin-webhooks 0.86.0 → 0.88.0

package/dist/autoDisable.js

@@ -1,5 +1,5 @@
 import { and as e, eq as t } from "@voltro/database";
-//#region src/autoDisable.ts
+// src/autoDisable.ts
 var n = "_voltro_webhook_targets", r = 32, i = async (e, n) => (await e.query({
 	table: "_voltro_webhook_targets",
 	predicate: t("id", n),
@@ -37,5 +37,4 @@ var n = "_voltro_webhook_targets", r = 32, i = async (e, n) => (await e.query({
 	}
 	throw Error(`webhook auto-disable: streak CAS contention on target ${a} exceeded ${r} attempts`);
 };
-//#endregion
 export { n as TARGETS_TABLE, a as recordDeliveryOutcome };

package/dist/deferredEmit.js

@@ -1,5 +1,5 @@
 import { defineOutboxHandler as e } from "@voltro/runtime";
-//#region src/deferredEmit.ts
+// src/deferredEmit.ts
 var t = "voltro.webhook.emit", n = (e) => typeof e.event == "string", r = (r) => e({
 	effect: t,
 	maxAttempts: 1,
@@ -13,5 +13,4 @@ var t = "voltro.webhook.emit", n = (e) => typeof e.event == "string", r = (r) =>
 		});
 	}
 });
-//#endregion
 export { t as WEBHOOK_EMIT_EFFECT, r as makeDeferredEmitHandler };

package/dist/deliverWorkflow.js

@@ -9,7 +9,7 @@ import { eq as c } from "@voltro/database";
 import { assertPublicUrl as l } from "@voltro/integration-http";
 import { createLogger as u } from "@voltro/logger";
 import { Activity as d, DurableClock as f, Workflow as p } from "effect/workflow";
-//#region src/deliverWorkflow.ts
+// src/deliverWorkflow.ts
 var m = s.Struct({
 	status: s.Number,
 	body: s.String,
@@ -62,6 +62,8 @@ var m = s.Struct({
 				event: s.String,
 				url: s.String,
 				secret: s.String,
+				previousSecret: s.optional(s.Union([s.String, s.Null])),
+				previousSecretUntil: s.optional(s.Union([s.String, s.Null])),
 				signing: s.Any,
 				retry: s.Any,
 				headers: s.Union([s.Record(s.String, s.String), s.Null]),
@@ -75,17 +77,26 @@ var m = s.Struct({
 				tenantId: s.Union([s.String, s.Null])
 			})]),
 			execute: o.tryPromise({
-				try: async () => (await p.store.query({
-					table: "_voltro_webhook_targets",
-					predicate: c("id", S),
-					order: [{
-						column: "createdAt",
-						direction: "asc"
-					}],
-					take: 1,
-					skip: void 0,
-					projection: void 0
-				}))[0] ?? null,
+				try: async () => {
+					let e = (await p.store.query({
+						table: "_voltro_webhook_targets",
+						predicate: c("id", S),
+						order: [{
+							column: "createdAt",
+							direction: "asc"
+						}],
+						take: 1,
+						skip: void 0,
+						projection: void 0
+					}))[0];
+					if (e === void 0) return null;
+					let t = e.previousSecretUntil;
+					return {
+						...e,
+						previousSecret: e.previousSecret ?? null,
+						previousSecretUntil: t instanceof Date ? t.toISOString() : t ?? null
+					};
+				},
 				catch: (e) => (E.debug("fetch-target raw error", {
 					targetId: S,
 					event: C,
@@ -196,7 +207,10 @@ var m = s.Struct({
 						};
 						throw e;
 					}
-					let a = Buffer.from(r.bytes), { headers: o } = e(O, {
+					let a = Buffer.from(r.bytes), o = u.previousSecret != null && u.previousSecretUntil != null && Date.parse(u.previousSecretUntil) > Date.now() && O._tag === "standardWebhooks" && O.previousSecret === void 0 ? {
+						...O,
+						previousSecret: u.previousSecret
+					} : O, { headers: s } = e(o, {
 						rawBody: a,
 						secret: u.secret,
 						messageId: x
@@ -207,7 +221,7 @@ var m = s.Struct({
 							method: "POST",
 							headers: {
 								"content-type": r.contentType,
-								...o,
+								...s,
 								"x-voltro-event": C,
 								"x-voltro-event-id": w,
 								"x-voltro-delivery-id": x,
@@ -332,5 +346,4 @@ var m = s.Struct({
 		};
 	});
 };
-//#endregion
 export { y as DEFAULT_WEBHOOK_TIMEOUT_MS, x as buildDeliverWebhookExecute, v as deliverWebhookWorkflow };

package/dist/dsl.js

@@ -1,4 +1,4 @@
-//#region src/dsl.ts
+// src/dsl.ts
 var e = (e) => ({
 	_tag: "incomingWebhook",
 	...e
@@ -10,5 +10,4 @@ var e = (e) => ({
 	let t = e._tag;
 	return t === "outgoingEvent" || t === "incomingWebhook" || t === "webhookProvider";
 };
-//#endregion
 export { e as defineIncomingWebhook, t as defineWebhookProvider, n as isWebhookDescriptor };

package/dist/encode.js

@@ -1,5 +1,5 @@
 import { WebhookPayloadUnrepresentable as e } from "./errors.js";
-//#region src/encode.ts
+// src/encode.ts
 var t = (t, r) => {
 	if (t === "json") return {
 		contentType: "application/json",
@@ -49,5 +49,4 @@ var t = (t, r) => {
 		default: return "'";
 	}
 }), l = (e) => e === null ? "null" : Array.isArray(e) ? "array" : typeof e;
-//#endregion
 export { t as encodePayload };

package/dist/errors.js

@@ -1,5 +1,5 @@
 import { Schema as e } from "effect";
-//#region src/errors.ts
+// src/errors.ts
 var t = class extends e.TaggedError()("WebhookSubscribeInvalid", {
 	field: e.String,
 	reason: e.String
@@ -18,5 +18,4 @@ var t = class extends e.TaggedError()("WebhookSubscribeInvalid", {
 	]),
 	reason: e.String
 }) {};
-//#endregion
 export { n as WebhookDeliveryNotFound, a as WebhookPayloadInvalid, o as WebhookPayloadUnrepresentable, i as WebhookPayloadVersionInvalid, t as WebhookSubscribeInvalid, r as WebhookTargetNotFound };

package/dist/eventAudience.js

@@ -1,4 +1,4 @@
-//#region src/eventAudience.ts
+// src/eventAudience.ts
 var e = (e) => e.webhook !== void 0, t = (e) => {
 	let t = e.webhook;
 	if (t !== void 0) return {
@@ -10,5 +10,4 @@ var e = (e) => e.webhook !== void 0, t = (e) => {
 		...t.rateLimit === void 0 ? {} : { globalRateLimit: t.rateLimit }
 	};
 };
-//#endregion
 export { t as asOutgoingEvent, e as hasWebhookAudience };

package/dist/idempotency.js

@@ -1,4 +1,4 @@
-//#region src/idempotency.ts
+// src/idempotency.ts
 var e = class {
 	capacity;
 	cache = /* @__PURE__ */ new Map();
@@ -45,5 +45,4 @@ var e = class {
 	"7d": 6048e5,
 	"30d": 2592e6
 }, i = (e) => e === void 0 ? r["7d"] : r[e] ?? r["7d"];
-//#endregion
 export { e as IdempotencyCache, n as getIdempotencyCache, i as parseTtl };

package/dist/incoming.js

@@ -3,7 +3,7 @@ import { getIdempotencyCache as t, parseTtl as n } from "./idempotency.js";
 import { Schema as r } from "effect";
 import { publishServerError as i } from "@voltro/protocol";
 import { createLogger as a } from "@voltro/logger";
-//#region src/incoming.ts
+// src/incoming.ts
 var o = (e, t) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
@@ -201,5 +201,4 @@ var o = (e, t) => ({
 		}
 	}, { [s]: v });
 }, f = (e) => `/webhooks/${e}`;
-//#endregion
 export { c as UnverifiedIncomingWebhook, s as WEBHOOK_VERIFICATION_PROPERTY, f as defaultIncomingPath, u as incomingWebhookVerification, d as mountIncomingWebhook };

package/dist/index.d.ts

@@ -617,6 +617,9 @@ emitter: () => Pick<WebhooksServiceShape, "emit"> | undefined) => OutboxHandlerD
  */
 export declare const matchesFilter: (filter: WebhookFilter | Readonly<Record<string, unknown>> | null, payload: unknown) => boolean;
 
+/** The longest overlap `rotateSecret` accepts, and its default: 30 days, unless ended earlier. */
+export declare const MAX_SECRET_OVERLAP_SECONDS: number;
+
 /** A mounted handler, carrying its verification declaration. */
 export declare type MountedIncomingWebhook = ((request: IncomingRequest) => Promise<IncomingResponse>) & {
     readonly [WEBHOOK_VERIFICATION_PROPERTY]: IncomingWebhookVerification;
@@ -822,6 +825,28 @@ export declare interface RetryPolicy {
 
 export declare type RetryStrategy = 'fixed' | 'linear' | 'exponential';
 
+/** What `rotateSecret` returns. */
+export declare interface RotatedSecret {
+    /** The new secret — returned once; hand it to the receiver. */
+    readonly secret: string;
+    /** Until when deliveries are signed under the previous secret too. `null`:
+     *  no overlap — asked for none, or a scheme with one signature per message. */
+    readonly previousSignedUntil: Date | null;
+}
+
+/** How long a rotated webhook secret keeps signing beside the new one. */
+export declare interface RotateSecretOptions {
+    /**
+     * Seconds every delivery still carries a signature under the previous
+     * secret, so the receiver can switch when it is ready. The length is the
+     * RECEIVER's switch-over time — nothing on the sending side can measure it —
+     * so by default the overlap lasts until {@link WebhooksServiceShape.endSecretOverlap}
+     * ends it (once the receiver has switched), and at most 30 days. Pass a
+     * number to bound it yourself; `0` switches at once (after a leak).
+     */
+    readonly overlapSeconds?: number;
+}
+
 export declare type SignatureScheme = HmacSignatureScheme | CustomSignatureScheme | StandardWebhooksSignatureScheme;
 
 export declare interface SignedRequest {
@@ -1250,7 +1275,7 @@ export declare const _voltroWebhookDeliveriesTable: Table<"_voltro_webhook_deliv
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */
@@ -1389,6 +1414,13 @@ export declare const _voltroWebhookTargetsTable: Table<"_voltro_webhook_targets"
      *  (a non-ciphertext value passes through); `voltro db encrypt-column
      *  _voltro_webhook_targets.secret` converts them in place. */
     readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** During a rotation (`rotateSecret`): the secret the receiver may still
+     *  verify with. Every delivery until {@link previousSecretUntil} carries a
+     *  signature under it beside the new one (Standard Webhooks' signature list),
+     *  so the receiver switches when it is ready. Encrypted like `secret`. */
+    readonly previousSecret: ColumnBuilder<string | null, "text", boolean>;
+    /** When deliveries stop signing under `previousSecret`. */
+    readonly previousSecretUntil: ColumnBuilder<Date | null, "timestamp", boolean>;
     /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
      *  Stored as JSON so future schemes don't require a schema migration. */
     readonly signing: ColumnBuilder<unknown, "json", boolean>;
@@ -1702,8 +1734,11 @@ export declare interface WebhooksServiceShape {
      * must sign identically, and the previous way to achieve it was delete +
      * re-subscribe, minting new ids and orphaning the delivery history.
      */
-    readonly rotateSecret: (target: TargetSelector) => Promise<{
-        readonly secret: string;
+    readonly rotateSecret: (target: TargetSelector, options?: RotateSecretOptions) => Promise<RotatedSecret>;
+    /** End a rotation's overlap once the receiver verifies with the new secret: the
+     *  previous secret stops signing at once. Returns how many targets were overlapping. */
+    readonly endSecretOverlap: (target: TargetSelector) => Promise<{
+        readonly ended: number;
     }>;
     /** Re-pin a target's `payloadVersion` to the event's current
      *  version. Called from the dashboard's "Re-pin" action after
@@ -1805,6 +1840,13 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
      *  (a non-ciphertext value passes through); `voltro db encrypt-column
      *  _voltro_webhook_targets.secret` converts them in place. */
     readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** During a rotation (`rotateSecret`): the secret the receiver may still
+     *  verify with. Every delivery until {@link previousSecretUntil} carries a
+     *  signature under it beside the new one (Standard Webhooks' signature list),
+     *  so the receiver switches when it is ready. Encrypted like `secret`. */
+    readonly previousSecret: ColumnBuilder<string | null, "text", boolean>;
+    /** When deliveries stop signing under `previousSecret`. */
+    readonly previousSecretUntil: ColumnBuilder<Date | null, "timestamp", boolean>;
     /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
      *  Stored as JSON so future schemes don't require a schema migration. */
     readonly signing: ColumnBuilder<unknown, "json", boolean>;
@@ -1910,7 +1952,7 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */

package/dist/index.js

@@ -5,13 +5,13 @@ import { STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS as c, STANDARD_WEBHOOKS_ID_
 import { defaultOutgoingSignature as C, genericHmacSignature as w, githubSignature as T, signRequest as E, slackSignature as D, standardWebhooksSignature as O, stripeSignature as k, verifyRequest as A } from "./signing.js";
 import { defaultRetryPolicy as j, fastRetryPolicy as M, nextRetry as N, parseDuration as P } from "./retry.js";
 import { WebhookDeliveryNotFound as F, WebhookPayloadInvalid as I, WebhookPayloadUnrepresentable as L, WebhookPayloadVersionInvalid as R, WebhookSubscribeInvalid as z, WebhookTargetNotFound as B } from "./errors.js";
-import { WebhooksService as V, buildWebhooksService as H, compareVersions as U, eventsOf as W, generateSecret as G, matchesFilter as K, resolveSubscribe as q, useWebhooks as J, useWebhooksEffect as Y, validateSubscribe as X } from "./service.js";
-import { IdempotencyCache as Z, getIdempotencyCache as Q, parseTtl as $ } from "./idempotency.js";
-import { UnverifiedIncomingWebhook as ee, WEBHOOK_VERIFICATION_PROPERTY as te, defaultIncomingPath as ne, incomingWebhookVerification as re, mountIncomingWebhook as ie } from "./incoming.js";
-import { RATE_WINDOW_MS as ae, RATE_WINDOW_TABLE as oe, acquireRateSlots as se, consumeRateSlot as ce, releaseRateSlot as le } from "./rateLimit.js";
-import { encodePayload as ue } from "./encode.js";
-import { TARGETS_TABLE as de, recordDeliveryOutcome as fe } from "./autoDisable.js";
-import { buildDeliverWebhookExecute as pe, deliverWebhookWorkflow as me } from "./deliverWorkflow.js";
-import { _voltroWebhookDeliveriesTable as he, _voltroWebhookEventStatsTable as ge, _voltroWebhookRateWindowsTable as _e, _voltroWebhookTargetsTable as ve, webhookTables as ye } from "./mixin.js";
-import { WEBHOOK_EMIT_EFFECT as be, makeDeferredEmitHandler as xe } from "./deferredEmit.js";
-export { Z as IdempotencyCache, ae as RATE_WINDOW_MS, oe as RATE_WINDOW_TABLE, c as STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS, l as STANDARD_WEBHOOKS_ID_HEADER, u as STANDARD_WEBHOOKS_MAX_KEY_BYTES, d as STANDARD_WEBHOOKS_MIN_KEY_BYTES, f as STANDARD_WEBHOOKS_SECRET_PREFIX, p as STANDARD_WEBHOOKS_SIGNATURE_HEADER, m as STANDARD_WEBHOOKS_TIMESTAMP_HEADER, h as STANDARD_WEBHOOKS_VERSION, de as TARGETS_TABLE, ee as UnverifiedIncomingWebhook, e as WEBHOOKS_EGRESS, t as WEBHOOKS_PLUGIN_PERMISSIONS, be as WEBHOOK_EMIT_EFFECT, te as WEBHOOK_VERIFICATION_PROPERTY, F as WebhookDeliveryNotFound, I as WebhookPayloadInvalid, L as WebhookPayloadUnrepresentable, R as WebhookPayloadVersionInvalid, z as WebhookSubscribeInvalid, B as WebhookTargetNotFound, V as WebhooksService, he as _voltroWebhookDeliveriesTable, ge as _voltroWebhookEventStatsTable, _e as _voltroWebhookRateWindowsTable, ve as _voltroWebhookTargetsTable, se as acquireRateSlots, o as asOutgoingEvent, pe as buildDeliverWebhookExecute, H as buildWebhooksService, U as compareVersions, ce as consumeRateSlot, ne as defaultIncomingPath, C as defaultOutgoingSignature, j as defaultRetryPolicy, r as defineIncomingWebhook, i as defineWebhookProvider, me as deliverWebhookWorkflow, ue as encodePayload, W as eventsOf, M as fastRetryPolicy, G as generateSecret, g as generateStandardWebhooksSecret, w as genericHmacSignature, Q as getIdempotencyCache, T as githubSignature, s as hasWebhookAudience, re as incomingWebhookVerification, _ as isStandardWebhooksSecret, a as isWebhookDescriptor, xe as makeDeferredEmitHandler, K as matchesFilter, ie as mountIncomingWebhook, N as nextRetry, P as parseDuration, $ as parseTtl, fe as recordDeliveryOutcome, le as releaseRateSlot, q as resolveSubscribe, E as signRequest, D as slackSignature, v as standardWebhooksHeaders, y as standardWebhooksKey, O as standardWebhooksSignature, b as standardWebhooksSignatureToken, x as standardWebhooksSignedContent, k as stripeSignature, J as useWebhooks, Y as useWebhooksEffect, X as validateSubscribe, A as verifyRequest, S as verifyStandardWebhooks, ye as webhookTables, n as webhooksPlugin };
+import { MAX_SECRET_OVERLAP_SECONDS as V, WebhooksService as H, buildWebhooksService as U, compareVersions as W, eventsOf as G, generateSecret as K, matchesFilter as q, resolveSubscribe as J, useWebhooks as Y, useWebhooksEffect as X, validateSubscribe as Z } from "./service.js";
+import { IdempotencyCache as Q, getIdempotencyCache as $, parseTtl as ee } from "./idempotency.js";
+import { UnverifiedIncomingWebhook as te, WEBHOOK_VERIFICATION_PROPERTY as ne, defaultIncomingPath as re, incomingWebhookVerification as ie, mountIncomingWebhook as ae } from "./incoming.js";
+import { RATE_WINDOW_MS as oe, RATE_WINDOW_TABLE as se, acquireRateSlots as ce, consumeRateSlot as le, releaseRateSlot as ue } from "./rateLimit.js";
+import { encodePayload as de } from "./encode.js";
+import { TARGETS_TABLE as fe, recordDeliveryOutcome as pe } from "./autoDisable.js";
+import { buildDeliverWebhookExecute as me, deliverWebhookWorkflow as he } from "./deliverWorkflow.js";
+import { _voltroWebhookDeliveriesTable as ge, _voltroWebhookEventStatsTable as _e, _voltroWebhookRateWindowsTable as ve, _voltroWebhookTargetsTable as ye, webhookTables as be } from "./mixin.js";
+import { WEBHOOK_EMIT_EFFECT as xe, makeDeferredEmitHandler as Se } from "./deferredEmit.js";
+export { Q as IdempotencyCache, V as MAX_SECRET_OVERLAP_SECONDS, oe as RATE_WINDOW_MS, se as RATE_WINDOW_TABLE, c as STANDARD_WEBHOOKS_DEFAULT_TOLERANCE_SECONDS, l as STANDARD_WEBHOOKS_ID_HEADER, u as STANDARD_WEBHOOKS_MAX_KEY_BYTES, d as STANDARD_WEBHOOKS_MIN_KEY_BYTES, f as STANDARD_WEBHOOKS_SECRET_PREFIX, p as STANDARD_WEBHOOKS_SIGNATURE_HEADER, m as STANDARD_WEBHOOKS_TIMESTAMP_HEADER, h as STANDARD_WEBHOOKS_VERSION, fe as TARGETS_TABLE, te as UnverifiedIncomingWebhook, e as WEBHOOKS_EGRESS, t as WEBHOOKS_PLUGIN_PERMISSIONS, xe as WEBHOOK_EMIT_EFFECT, ne as WEBHOOK_VERIFICATION_PROPERTY, F as WebhookDeliveryNotFound, I as WebhookPayloadInvalid, L as WebhookPayloadUnrepresentable, R as WebhookPayloadVersionInvalid, z as WebhookSubscribeInvalid, B as WebhookTargetNotFound, H as WebhooksService, ge as _voltroWebhookDeliveriesTable, _e as _voltroWebhookEventStatsTable, ve as _voltroWebhookRateWindowsTable, ye as _voltroWebhookTargetsTable, ce as acquireRateSlots, o as asOutgoingEvent, me as buildDeliverWebhookExecute, U as buildWebhooksService, W as compareVersions, le as consumeRateSlot, re as defaultIncomingPath, C as defaultOutgoingSignature, j as defaultRetryPolicy, r as defineIncomingWebhook, i as defineWebhookProvider, he as deliverWebhookWorkflow, de as encodePayload, G as eventsOf, M as fastRetryPolicy, K as generateSecret, g as generateStandardWebhooksSecret, w as genericHmacSignature, $ as getIdempotencyCache, T as githubSignature, s as hasWebhookAudience, ie as incomingWebhookVerification, _ as isStandardWebhooksSecret, a as isWebhookDescriptor, Se as makeDeferredEmitHandler, q as matchesFilter, ae as mountIncomingWebhook, N as nextRetry, P as parseDuration, ee as parseTtl, pe as recordDeliveryOutcome, ue as releaseRateSlot, J as resolveSubscribe, E as signRequest, D as slackSignature, v as standardWebhooksHeaders, y as standardWebhooksKey, O as standardWebhooksSignature, b as standardWebhooksSignatureToken, x as standardWebhooksSignedContent, k as stripeSignature, Y as useWebhooks, X as useWebhooksEffect, Z as validateSubscribe, A as verifyRequest, S as verifyStandardWebhooks, be as webhookTables, n as webhooksPlugin };

package/dist/mixin.d.ts

@@ -32,7 +32,7 @@ export declare const _voltroWebhookDeliveriesTable: Table<"_voltro_webhook_deliv
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */
@@ -171,6 +171,13 @@ export declare const _voltroWebhookTargetsTable: Table<"_voltro_webhook_targets"
      *  (a non-ciphertext value passes through); `voltro db encrypt-column
      *  _voltro_webhook_targets.secret` converts them in place. */
     readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** During a rotation (`rotateSecret`): the secret the receiver may still
+     *  verify with. Every delivery until {@link previousSecretUntil} carries a
+     *  signature under it beside the new one (Standard Webhooks' signature list),
+     *  so the receiver switches when it is ready. Encrypted like `secret`. */
+    readonly previousSecret: ColumnBuilder<string | null, "text", boolean>;
+    /** When deliveries stop signing under `previousSecret`. */
+    readonly previousSecretUntil: ColumnBuilder<Date | null, "timestamp", boolean>;
     /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
      *  Stored as JSON so future schemes don't require a schema migration. */
     readonly signing: ColumnBuilder<unknown, "json", boolean>;
@@ -287,6 +294,13 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
      *  (a non-ciphertext value passes through); `voltro db encrypt-column
      *  _voltro_webhook_targets.secret` converts them in place. */
     readonly secret: ColumnBuilder<string, "text", boolean>;
+    /** During a rotation (`rotateSecret`): the secret the receiver may still
+     *  verify with. Every delivery until {@link previousSecretUntil} carries a
+     *  signature under it beside the new one (Standard Webhooks' signature list),
+     *  so the receiver switches when it is ready. Encrypted like `secret`. */
+    readonly previousSecret: ColumnBuilder<string | null, "text", boolean>;
+    /** When deliveries stop signing under `previousSecret`. */
+    readonly previousSecretUntil: ColumnBuilder<Date | null, "timestamp", boolean>;
     /** Serialised `SignatureScheme` discriminated union — see `signing.ts`.
      *  Stored as JSON so future schemes don't require a schema migration. */
     readonly signing: ColumnBuilder<unknown, "json", boolean>;
@@ -392,7 +406,7 @@ export declare const webhookTables: () => readonly [ Table<"_voltro_webhook_targ
     readonly eventId: ColumnBuilder<string | null, "text", boolean>;
     /** Attempt counter (1-indexed). */
     readonly attempt: ColumnBuilder<number, "integer", boolean>;
-    readonly status: ColumnBuilder<"failed" | "pending" | "succeeded" | "inFlight" | "retryScheduled", "text", boolean>;
+    readonly status: ColumnBuilder<"failed" | "succeeded" | "pending" | "inFlight" | "retryScheduled", "text", boolean>;
     /** Payload as sent over the wire. Stored verbatim — re-rendering
      *  from a referenced event row would lose the snapshot if the
      *  source event was deleted. */

package/dist/mixin.js

@@ -1,11 +1,13 @@
 import { boolean as e, id as t, integer as n, json as r, registerRetention as i, retentionTtlMsFromEnv as a, table as o, text as s, timestamp as c } from "@voltro/database";
 import { tenant as l } from "@voltro/plugin-multitenancy/mixin";
-//#region src/mixin.ts
+// src/mixin.ts
 var u = o("_voltro_webhook_targets", {
 	id: t({ prefix: "whtarget" }),
 	event: s(),
 	url: s(),
 	secret: s().encrypted().serverOnly(),
+	previousSecret: s().encrypted().serverOnly().nullable(),
+	previousSecretUntil: c().nullable(),
 	signing: r(),
 	retry: r(),
 	scope: r().nullable(),
@@ -75,5 +77,4 @@ var u = o("_voltro_webhook_targets", {
 	f,
 	p
 ]);
-//#endregion
 export { d as _voltroWebhookDeliveriesTable, p as _voltroWebhookEventStatsTable, f as _voltroWebhookRateWindowsTable, u as _voltroWebhookTargetsTable, m as webhookTables };

package/dist/plugin.js

@@ -1,6 +1,6 @@
 import { Effect as e } from "effect";
 import { definePlugin as t } from "@voltro/protocol";
-//#region src/plugin.ts
+// src/plugin.ts
 var n = ["network:outbound:*"], r = [{
 	destination: "runtime:registered webhook targets (_voltro_webhook_targets)",
 	purpose: "event deliveries, HMAC-signed",
@@ -15,5 +15,4 @@ var n = ["network:outbound:*"], r = [{
 		t.logger.info("webhooks active", { outbound: "network:outbound:* (subscriber-configured target URLs — audit visibility, not a restriction)" });
 	})
 });
-//#endregion
 export { r as WEBHOOKS_EGRESS, n as WEBHOOKS_PLUGIN_PERMISSIONS, i as webhooksPlugin };

package/dist/providers/generic.js

@@ -1,6 +1,6 @@
 import { defineWebhookProvider as e } from "../dsl.js";
 import { genericHmacSignature as t } from "../signing.js";
-//#region src/providers/generic.ts
+// src/providers/generic.ts
 var n = (n) => e({
 	id: "generic",
 	name: "Generic",
@@ -15,5 +15,4 @@ var n = (n) => e({
 	},
 	bodyType: "json"
 });
-//#endregion
 export { n as genericProvider };

package/dist/providers/github.js

@@ -1,6 +1,6 @@
 import { defineWebhookProvider as e } from "../dsl.js";
 import { githubSignature as t } from "../signing.js";
-//#region src/providers/github.ts
+// src/providers/github.ts
 var n = () => e({
 	id: "github",
 	name: "GitHub",
@@ -12,5 +12,4 @@ var n = () => e({
 	bodyType: "json",
 	eventTypeFrom: (e) => {}
 });
-//#endregion
 export { n as githubProvider };

package/dist/providers/slack.js

@@ -1,6 +1,6 @@
 import { defineWebhookProvider as e } from "../dsl.js";
 import { createHmac as t, timingSafeEqual as n } from "node:crypto";
-//#region src/providers/slack.ts
+// src/providers/slack.ts
 var r = () => ({
 	_tag: "custom",
 	header: "X-Slack-Signature",
@@ -35,5 +35,4 @@ var r = () => ({
 		}
 	}
 });
-//#endregion
 export { i as slackProvider };

package/dist/providers/stripe.js

@@ -1,6 +1,6 @@
 import { defineWebhookProvider as e } from "../dsl.js";
 import { stripeSignature as t } from "../signing.js";
-//#region src/providers/stripe.ts
+// src/providers/stripe.ts
 var n = (n) => e({
 	id: "stripe",
 	name: "Stripe",
@@ -26,5 +26,4 @@ var n = (n) => e({
 		}
 	}
 });
-//#endregion
 export { n as stripeProvider };

package/dist/rateLimit.js

@@ -1,5 +1,5 @@
 import { and as e, eq as t } from "@voltro/database";
-//#region src/rateLimit.ts
+// src/rateLimit.ts
 var n = "_voltro_webhook_rate_windows", r = 6e4, i = (e, t) => `${e}@${t}`, a = async (n, r, i) => (await n.query({
 	table: "_voltro_webhook_rate_windows",
 	predicate: e(t("scope", r), t("bucket", i)),
@@ -57,5 +57,4 @@ var n = "_voltro_webhook_rate_windows", r = 6e4, i = (e, t) => `${e}@${t}`, a =
 		retryInMs: 0
 	};
 };
-//#endregion
 export { r as RATE_WINDOW_MS, n as RATE_WINDOW_TABLE, l as acquireRateSlots, s as consumeRateSlot, c as releaseRateSlot };

package/dist/retry.js

@@ -1,4 +1,4 @@
-//#region src/retry.ts
+// src/retry.ts
 var e = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, t = (t) => {
 	let n = e.exec(t);
 	if (!n) throw Error(`invalid duration literal: ${t}`);
@@ -61,5 +61,4 @@ var e = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)?$/, t = (t) => {
 	honourRetryAfter: !0,
 	jitter: "full"
 });
-//#endregion
 export { i as defaultRetryPolicy, a as fastRetryPolicy, r as nextRetry, t as parseDuration };