@vorionsys/contracts 0.1.0 → 0.1.1

package/dist/db/trust.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Trust Schema
+ *
+ * Database schema for trust records, signals, and history.
+ *
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trustHistory = exports.trustSignals = exports.trustRecords = exports.trustLevelEnum = void 0;
+const pg_core_1 = require("drizzle-orm/pg-core");
+/**
+ * Trust level enum (T0-T7)
+ *
+ * 8-tier model:
+ * - 0: T0 Sandbox
+ * - 1: T1 Observed
+ * - 2: T2 Provisional
+ * - 3: T3 Monitored
+ * - 4: T4 Standard
+ * - 5: T5 Trusted
+ * - 6: T6 Certified
+ * - 7: T7 Autonomous
+ */
+exports.trustLevelEnum = (0, pg_core_1.pgEnum)('trust_level', ['0', '1', '2', '3', '4', '5', '6', '7']);
+/**
+ * Trust records table - current trust state for entities
+ */
+exports.trustRecords = (0, pg_core_1.pgTable)('trust_records', {
+    id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+    entityId: (0, pg_core_1.uuid)('entity_id').notNull().unique(),
+    // Current score (0-1000)
+    score: (0, pg_core_1.integer)('score').notNull().default(200),
+    level: (0, exports.trustLevelEnum)('level').notNull().default('1'),
+    // Component scores (0.0 - 1.0)
+    behavioralScore: (0, pg_core_1.real)('behavioral_score').notNull().default(0.5),
+    complianceScore: (0, pg_core_1.real)('compliance_score').notNull().default(0.5),
+    identityScore: (0, pg_core_1.real)('identity_score').notNull().default(0.5),
+    contextScore: (0, pg_core_1.real)('context_score').notNull().default(0.5),
+    // Metadata
+    signalCount: (0, pg_core_1.integer)('signal_count').notNull().default(0),
+    lastCalculatedAt: (0, pg_core_1.timestamp)('last_calculated_at', { withTimezone: true })
+        .notNull()
+        .defaultNow(),
+    lastActivityAt: (0, pg_core_1.timestamp)('last_activity_at', { withTimezone: true })
+        .notNull()
+        .defaultNow(),
+    // Observability metadata for trust ceiling calculations
+    // Stores ObservabilityClass, attestation info, audit history, etc.
+    metadata: (0, pg_core_1.jsonb)('metadata').$type(),
+    // Timestamps
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true })
+        .notNull()
+        .defaultNow(),
+    updatedAt: (0, pg_core_1.timestamp)('updated_at', { withTimezone: true })
+        .notNull()
+        .defaultNow(),
+}, (table) => ({
+    entityIdIdx: (0, pg_core_1.index)('trust_records_entity_id_idx').on(table.entityId),
+    scoreIdx: (0, pg_core_1.index)('trust_records_score_idx').on(table.score),
+    levelIdx: (0, pg_core_1.index)('trust_records_level_idx').on(table.level),
+}));
+/**
+ * Trust signals table - behavioral events affecting trust
+ */
+exports.trustSignals = (0, pg_core_1.pgTable)('trust_signals', {
+    id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+    entityId: (0, pg_core_1.uuid)('entity_id').notNull(),
+    // Signal details
+    type: (0, pg_core_1.text)('type').notNull(), // e.g., 'behavioral.success', 'compliance.violation'
+    value: (0, pg_core_1.real)('value').notNull(), // 0.0 - 1.0
+    weight: (0, pg_core_1.real)('weight').notNull().default(1.0),
+    // Context
+    source: (0, pg_core_1.text)('source'), // Where the signal came from
+    metadata: (0, pg_core_1.jsonb)('metadata').$type(),
+    // Timestamp
+    timestamp: (0, pg_core_1.timestamp)('timestamp', { withTimezone: true })
+        .notNull()
+        .defaultNow(),
+}, (table) => ({
+    entityIdIdx: (0, pg_core_1.index)('trust_signals_entity_id_idx').on(table.entityId),
+    typeIdx: (0, pg_core_1.index)('trust_signals_type_idx').on(table.type),
+    timestampIdx: (0, pg_core_1.index)('trust_signals_timestamp_idx').on(table.timestamp),
+    // Composite for efficient signal queries
+    entityTimestampIdx: (0, pg_core_1.index)('trust_signals_entity_timestamp_idx').on(table.entityId, table.timestamp),
+}));
+/**
+ * Trust history table - significant score changes
+ */
+exports.trustHistory = (0, pg_core_1.pgTable)('trust_history', {
+    id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+    entityId: (0, pg_core_1.uuid)('entity_id').notNull(),
+    // Score snapshot
+    score: (0, pg_core_1.integer)('score').notNull(),
+    previousScore: (0, pg_core_1.integer)('previous_score'),
+    level: (0, exports.trustLevelEnum)('level').notNull(),
+    previousLevel: (0, exports.trustLevelEnum)('previous_level'),
+    // Change details
+    reason: (0, pg_core_1.text)('reason').notNull(),
+    signalId: (0, pg_core_1.uuid)('signal_id'), // Reference to triggering signal
+    // Timestamp
+    timestamp: (0, pg_core_1.timestamp)('timestamp', { withTimezone: true })
+        .notNull()
+        .defaultNow(),
+}, (table) => ({
+    entityIdIdx: (0, pg_core_1.index)('trust_history_entity_id_idx').on(table.entityId),
+    timestampIdx: (0, pg_core_1.index)('trust_history_timestamp_idx').on(table.timestamp),
+    // For history queries with ordering
+    entityTimestampIdx: (0, pg_core_1.index)('trust_history_entity_timestamp_idx').on(table.entityId, table.timestamp),
+}));
+//# sourceMappingURL=trust.js.map

package/dist/db/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../../src/db/trust.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,iDAU6B;AAE7B;;;;;;;;;;;;GAYG;AACU,QAAA,cAAc,GAAG,IAAA,gBAAM,EAAC,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE9F;;GAEG;AACU,QAAA,YAAY,GAAG,IAAA,iBAAO,EACjC,eAAe,EACf;IACE,EAAE,EAAE,IAAA,cAAI,EAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,QAAQ,EAAE,IAAA,cAAI,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAE9C,yBAAyB;IACzB,KAAK,EAAE,IAAA,iBAAO,EAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9C,KAAK,EAAE,IAAA,sBAAc,EAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAErD,+BAA+B;IAC/B,eAAe,EAAE,IAAA,cAAI,EAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAChE,eAAe,EAAE,IAAA,cAAI,EAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAChE,aAAa,EAAE,IAAA,cAAI,EAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC5D,YAAY,EAAE,IAAA,cAAI,EAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAE1D,WAAW;IACX,WAAW,EAAE,IAAA,iBAAO,EAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,gBAAgB,EAAE,IAAA,mBAAS,EAAC,oBAAoB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACtE,OAAO,EAAE;SACT,UAAU,EAAE;IACf,cAAc,EAAE,IAAA,mBAAS,EAAC,kBAAkB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SAClE,OAAO,EAAE;SACT,UAAU,EAAE;IAEf,wDAAwD;IACxD,mEAAmE;IACnE,QAAQ,EAAE,IAAA,eAAK,EAAC,UAAU,CAAC,CAAC,KAAK,EAO7B;IAEJ,aAAa;IACb,SAAS,EAAE,IAAA,mBAAS,EAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,OAAO,EAAE;SACT,UAAU,EAAE;IACf,SAAS,EAAE,IAAA,mBAAS,EAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,OAAO,EAAE;SACT,UAAU,EAAE;CAChB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,IAAA,eAAK,EAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IACpE,QAAQ,EAAE,IAAA,eAAK,EAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;IAC1D,QAAQ,EAAE,IAAA,eAAK,EAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;CAC3D,CAAC,CACH,CAAC;AAEF;;GAEG;AACU,QAAA,YAAY,GAAG,IAAA,iBAAO,EACjC,eAAe,EACf;IACE,EAAE,EAAE,IAAA,cAAI,EAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,QAAQ,EAAE,IAAA,cAAI,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IAErC,iBAAiB;IACjB,IAAI,EAAE,IAAA,cAAI,EAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,qDAAqD;IACnF,KAAK,EAAE,IAAA,cAAI,EAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,YAAY;IAC5C,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAE7C,UAAU;IACV,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC,EAAE,6BAA6B;IACrD,QAAQ,EAAE,IAAA,eAAK,EAAC,UAAU,CAAC,CAAC,KAAK,EAA2B;IAE5D,YAAY;IACZ,SAAS,EAAE,IAAA,mBAAS,EAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACtD,OAAO,EAAE;SACT,UAAU,EAAE;CAChB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,IAAA,eAAK,EAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IACpE,OAAO,EAAE,IAAA,eAAK,EAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;IACvD,YAAY,EAAE,IAAA,eAAK,EAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACtE,yCAAyC;IACzC,kBAAkB,EAAE,IAAA,eAAK,EAAC,oCAAoC,CAAC,CAAC,EAAE,CAChE,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,CAChB;CACF,CAAC,CACH,CAAC;AAEF;;GAEG;AACU,QAAA,YAAY,GAAG,IAAA,iBAAO,EACjC,eAAe,EACf;IACE,EAAE,EAAE,IAAA,cAAI,EAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAC3C,QAAQ,EAAE,IAAA,cAAI,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IAErC,iBAAiB;IACjB,KAAK,EAAE,IAAA,iBAAO,EAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IACjC,aAAa,EAAE,IAAA,iBAAO,EAAC,gBAAgB,CAAC;IACxC,KAAK,EAAE,IAAA,sBAAc,EAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IACxC,aAAa,EAAE,IAAA,sBAAc,EAAC,gBAAgB,CAAC;IAE/C,iBAAiB;IACjB,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,QAAQ,EAAE,IAAA,cAAI,EAAC,WAAW,CAAC,EAAE,iCAAiC;IAE9D,YAAY;IACZ,SAAS,EAAE,IAAA,mBAAS,EAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACtD,OAAO,EAAE;SACT,UAAU,EAAE;CAChB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,WAAW,EAAE,IAAA,eAAK,EAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IACpE,YAAY,EAAE,IAAA,eAAK,EAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACtE,oCAAoC;IACpC,kBAAkB,EAAE,IAAA,eAAK,EAAC,oCAAoC,CAAC,CAAC,EAAE,CAChE,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,SAAS,CAChB;CACF,CAAC,CACH,CAAC"}

package/dist/db/webhooks.d.ts

@@ -0,0 +1,280 @@
+/**
+ * Webhook Database Schema
+ *
+ * Defines the database schema for webhook configurations including
+ * secret management for request signing.
+ *
+ * @packageDocumentation
+ */
+/**
+ * Webhook configurations table
+ *
+ * Stores webhook endpoint configurations including:
+ * - URL and event subscriptions
+ * - Secret hash for HMAC signing (not stored in plaintext)
+ * - Secret rotation tracking
+ * - SSRF protection via resolved IP pinning
+ */
+export declare const webhookConfigs: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "webhook_configs";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "webhook_configs";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "webhook_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        url: import("drizzle-orm/pg-core").PgColumn<{
+            name: "url";
+            tableName: "webhook_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        secretHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_hash";
+            tableName: "webhook_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        secretPrefix: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_prefix";
+            tableName: "webhook_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        enabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "enabled";
+            tableName: "webhook_configs";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+        events: import("drizzle-orm/pg-core").PgColumn<{
+            name: "events";
+            tableName: "webhook_configs";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+        retryAttempts: import("drizzle-orm/pg-core").PgColumn<{
+            name: "retry_attempts";
+            tableName: "webhook_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        retryDelayMs: import("drizzle-orm/pg-core").PgColumn<{
+            name: "retry_delay_ms";
+            tableName: "webhook_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        resolvedIp: import("drizzle-orm/pg-core").PgColumn<{
+            name: "resolved_ip";
+            tableName: "webhook_configs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        lastRotatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_rotated_at";
+            tableName: "webhook_configs";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "webhook_configs";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "webhook_configs";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+/**
+ * Webhook secret rotation history for audit purposes.
+ * Tracks when secrets were rotated and by whom.
+ */
+export declare const webhookSecretRotations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "webhook_secret_rotations";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "webhook_secret_rotations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+        webhookId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "webhook_id";
+            tableName: "webhook_secret_rotations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "webhook_secret_rotations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        rotatedBy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "rotated_by";
+            tableName: "webhook_secret_rotations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        previousSecretHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "previous_secret_hash";
+            tableName: "webhook_secret_rotations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "webhook_secret_rotations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+        }, {}, {}>;
+        rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "rotated_at";
+            tableName: "webhook_secret_rotations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type WebhookConfigRow = typeof webhookConfigs.$inferSelect;
+export type NewWebhookConfigRow = typeof webhookConfigs.$inferInsert;
+export type WebhookSecretRotationRow = typeof webhookSecretRotations.$inferSelect;
+export type NewWebhookSecretRotationRow = typeof webhookSecretRotations.$inferInsert;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/db/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/db/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DxB,CAAC;AAEJ;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BhC,CAAC;AAMJ,MAAM,MAAM,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AACrE,MAAM,MAAM,wBAAwB,GAAG,OAAO,sBAAsB,CAAC,YAAY,CAAC;AAClF,MAAM,MAAM,2BAA2B,GAAG,OAAO,sBAAsB,CAAC,YAAY,CAAC"}

package/dist/db/webhooks.js

@@ -0,0 +1,94 @@
+"use strict";
+/**
+ * Webhook Database Schema
+ *
+ * Defines the database schema for webhook configurations including
+ * secret management for request signing.
+ *
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webhookSecretRotations = exports.webhookConfigs = void 0;
+const pg_core_1 = require("drizzle-orm/pg-core");
+/**
+ * Webhook configurations table
+ *
+ * Stores webhook endpoint configurations including:
+ * - URL and event subscriptions
+ * - Secret hash for HMAC signing (not stored in plaintext)
+ * - Secret rotation tracking
+ * - SSRF protection via resolved IP pinning
+ */
+exports.webhookConfigs = (0, pg_core_1.pgTable)('webhook_configs', {
+    /** Unique webhook identifier */
+    id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+    /** Tenant ID for multi-tenant isolation */
+    tenantId: (0, pg_core_1.text)('tenant_id').notNull(),
+    /** Webhook endpoint URL */
+    url: (0, pg_core_1.text)('url').notNull(),
+    /**
+     * Hashed webhook secret for signature verification.
+     * The actual secret is only returned once on creation/rotation.
+     * Stored as SHA-256 hash for verification purposes.
+     */
+    secretHash: (0, pg_core_1.text)('secret_hash').notNull(),
+    /**
+     * Secret ID prefix shown to users (e.g., "whsec_abc...xyz").
+     * Allows users to identify which secret is in use without exposing it.
+     */
+    secretPrefix: (0, pg_core_1.text)('secret_prefix').notNull(),
+    /** Whether the webhook is enabled for delivery */
+    enabled: (0, pg_core_1.boolean)('enabled').notNull().default(true),
+    /** Array of event types this webhook subscribes to */
+    events: (0, pg_core_1.jsonb)('events').notNull().$type(),
+    /** Number of retry attempts for failed deliveries */
+    retryAttempts: (0, pg_core_1.text)('retry_attempts'),
+    /** Delay between retry attempts in milliseconds */
+    retryDelayMs: (0, pg_core_1.text)('retry_delay_ms'),
+    /**
+     * Resolved IP address at registration time for DNS pinning.
+     * Prevents DNS rebinding attacks.
+     */
+    resolvedIp: (0, pg_core_1.text)('resolved_ip'),
+    /** Timestamp of last secret rotation */
+    lastRotatedAt: (0, pg_core_1.timestamp)('last_rotated_at', { withTimezone: true }),
+    /** Created timestamp */
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true }).defaultNow().notNull(),
+    /** Updated timestamp */
+    updatedAt: (0, pg_core_1.timestamp)('updated_at', { withTimezone: true }).defaultNow().notNull(),
+}, (table) => ({
+    /** Index for efficient tenant-scoped queries */
+    tenantIdx: (0, pg_core_1.index)('webhook_configs_tenant_idx').on(table.tenantId),
+    /** Index for finding webhooks by tenant and enabled status */
+    tenantEnabledIdx: (0, pg_core_1.index)('webhook_configs_tenant_enabled_idx').on(table.tenantId, table.enabled),
+    /** Unique constraint: only one webhook per URL per tenant */
+    tenantUrlUnique: (0, pg_core_1.uniqueIndex)('webhook_configs_tenant_url_unique').on(table.tenantId, table.url),
+}));
+/**
+ * Webhook secret rotation history for audit purposes.
+ * Tracks when secrets were rotated and by whom.
+ */
+exports.webhookSecretRotations = (0, pg_core_1.pgTable)('webhook_secret_rotations', {
+    /** Unique rotation record identifier */
+    id: (0, pg_core_1.uuid)('id').primaryKey().defaultRandom(),
+    /** Reference to the webhook */
+    webhookId: (0, pg_core_1.uuid)('webhook_id')
+        .notNull()
+        .references(() => exports.webhookConfigs.id, { onDelete: 'cascade' }),
+    /** Tenant ID for multi-tenant isolation */
+    tenantId: (0, pg_core_1.text)('tenant_id').notNull(),
+    /** User ID who performed the rotation (if applicable) */
+    rotatedBy: (0, pg_core_1.text)('rotated_by'),
+    /** Previous secret hash (for audit trail) */
+    previousSecretHash: (0, pg_core_1.text)('previous_secret_hash'),
+    /** Reason for rotation */
+    reason: (0, pg_core_1.text)('reason'),
+    /** Timestamp of rotation */
+    rotatedAt: (0, pg_core_1.timestamp)('rotated_at', { withTimezone: true }).defaultNow().notNull(),
+}, (table) => ({
+    /** Index for efficient webhook history queries */
+    webhookIdx: (0, pg_core_1.index)('webhook_secret_rotations_webhook_idx').on(table.webhookId),
+    /** Index for tenant-scoped audit queries */
+    tenantIdx: (0, pg_core_1.index)('webhook_secret_rotations_tenant_idx').on(table.tenantId),
+}));
+//# sourceMappingURL=webhooks.js.map

package/dist/db/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/db/webhooks.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,iDAS6B;AAE7B;;;;;;;;GAQG;AACU,QAAA,cAAc,GAAG,IAAA,iBAAO,EAAC,iBAAiB,EAAE;IACvD,gCAAgC;IAChC,EAAE,EAAE,IAAA,cAAI,EAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAE3C,2CAA2C;IAC3C,QAAQ,EAAE,IAAA,cAAI,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IAErC,2BAA2B;IAC3B,GAAG,EAAE,IAAA,cAAI,EAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAE1B;;;;OAIG;IACH,UAAU,EAAE,IAAA,cAAI,EAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IAEzC;;;OAGG;IACH,YAAY,EAAE,IAAA,cAAI,EAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAE7C,kDAAkD;IAClD,OAAO,EAAE,IAAA,iBAAO,EAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAEnD,sDAAsD;IACtD,MAAM,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAY;IAEnD,qDAAqD;IACrD,aAAa,EAAE,IAAA,cAAI,EAAC,gBAAgB,CAAC;IAErC,mDAAmD;IACnD,YAAY,EAAE,IAAA,cAAI,EAAC,gBAAgB,CAAC;IAEpC;;;OAGG;IACH,UAAU,EAAE,IAAA,cAAI,EAAC,aAAa,CAAC;IAE/B,wCAAwC;IACxC,aAAa,EAAE,IAAA,mBAAS,EAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAEnE,wBAAwB;IACxB,SAAS,EAAE,IAAA,mBAAS,EAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAEjF,wBAAwB;IACxB,SAAS,EAAE,IAAA,mBAAS,EAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAClF,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACb,gDAAgD;IAChD,SAAS,EAAE,IAAA,eAAK,EAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IAEjE,8DAA8D;IAC9D,gBAAgB,EAAE,IAAA,eAAK,EAAC,oCAAoC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;IAE/F,6DAA6D;IAC7D,eAAe,EAAE,IAAA,qBAAW,EAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC;CAChG,CAAC,CAAC,CAAC;AAEJ;;;GAGG;AACU,QAAA,sBAAsB,GAAG,IAAA,iBAAO,EAAC,0BAA0B,EAAE;IACxE,wCAAwC;IACxC,EAAE,EAAE,IAAA,cAAI,EAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,aAAa,EAAE;IAE3C,+BAA+B;IAC/B,SAAS,EAAE,IAAA,cAAI,EAAC,YAAY,CAAC;SAC1B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,sBAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAE/D,2CAA2C;IAC3C,QAAQ,EAAE,IAAA,cAAI,EAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IAErC,yDAAyD;IACzD,SAAS,EAAE,IAAA,cAAI,EAAC,YAAY,CAAC;IAE7B,6CAA6C;IAC7C,kBAAkB,EAAE,IAAA,cAAI,EAAC,sBAAsB,CAAC;IAEhD,0BAA0B;IAC1B,MAAM,EAAE,IAAA,cAAI,EAAC,QAAQ,CAAC;IAEtB,4BAA4B;IAC5B,SAAS,EAAE,IAAA,mBAAS,EAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAClF,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACb,kDAAkD;IAClD,UAAU,EAAE,IAAA,eAAK,EAAC,sCAAsC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAE7E,4CAA4C;IAC5C,SAAS,EAAE,IAAA,eAAK,EAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;CAC3E,CAAC,CAAC,CAAC"}