n8n-nodes-base 3.0.1 → 3.1.0

package/dist/nodes/Microsoft/Teams/v2/helpers/utils-trigger.js

@@ -1,14 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateClientState = generateClientState;
+exports.logTrigger = logTrigger;
 exports.isLiveSubscription = isLiveSubscription;
 exports.getStoredSecret = getStoredSecret;
-exports.deleteSubscription = deleteSubscription;
+exports.getStoredIds = getStoredIds;
+exports.deleteSubscriptions = deleteSubscriptions;
 exports.fetchAllTeams = fetchAllTeams;
 exports.fetchAllChannels = fetchAllChannels;
 exports.createSubscription = createSubscription;
+exports.createSubscriptions = createSubscriptions;
 exports.listOwnSubscriptions = listOwnSubscriptions;
+exports.markPendingReconcile = markPendingReconcile;
+exports.reconcileSubscriptions = reconcileSubscriptions;
+exports.storedSubscriptionsCover = storedSubscriptionsCover;
 exports.isLifecycleNotification = isLifecycleNotification;
+exports.isSubscriptionResponse = isSubscriptionResponse;
 exports.handleLifecycleNotifications = handleLifecycleNotifications;
 exports.verifyWebhook = verifyWebhook;
 exports.getResourcePath = getResourcePath;
@@ -22,6 +29,14 @@ const forbiddenHints_1 = require("../transport/forbiddenHints");
 function generateClientState() {
     return (0, crypto_1.randomBytes)(32).toString('hex');
 }
+/** One shape for every trigger log line: the prefix, the workflow and node, then the fields. */
+function logTrigger(level, message, fields = {}) {
+    this.logger[level](`Microsoft Teams Trigger: ${message}`, {
+        workflowId: this.getWorkflow().id,
+        nodeName: this.getNode().name,
+        ...fields,
+    });
+}
 // Graph caps Teams subscriptions at 4320 minutes. 4318 keeps a margin for clock skew.
 const SUBSCRIPTION_TTL_MINUTES = 4318;
 // A subscription this close to its expiry counts as gone, so the node replaces it in time.
@@ -38,25 +53,56 @@ function getStoredSecret(webhookData) {
     const secret = webhookData.webhookSecret;
     return typeof secret === 'string' && secret.length > 0 ? secret : undefined;
 }
-/** Deletes one subscription. A `404` counts as done, for example after it expired. */
-async function deleteSubscription(subscriptionId) {
-    try {
-        await transport_1.microsoftApiRequest.call(this, 'DELETE', transport_1.buildTeamsPath.call(this, ['/v1.0/subscriptions/', { id: subscriptionId }]));
-    }
-    catch (error) {
-        if (!(error instanceof n8n_workflow_1.NodeApiError && error.httpCode === '404'))
-            throw error;
-    }
+/** The stored subscription ids, strings only. */
+function getStoredIds(webhookData) {
+    return Array.isArray(webhookData.subscriptionIds)
+        ? webhookData.subscriptionIds.filter((id) => typeof id === 'string')
+        : [];
+}
+/**
+ * Deletes every id once, all in parallel, and returns the ids Graph refused to remove, in input
+ * order. Never throws: a 404 counts as done, an id that fails validation is warned only, and every
+ * other refusal is warned and returned, so the caller decides what it means.
+ */
+async function deleteSubscriptions(ids) {
+    const refused = await Promise.all([...new Set(ids)].map(async (id) => {
+        let path;
+        try {
+            path = transport_1.buildTeamsPath.call(this, ['/v1.0/subscriptions/', { id }]);
+        }
+        catch (error) {
+            // No Graph call can ever succeed for this id, so it is not reported.
+            logTrigger.call(this, 'warn', 'failed to remove subscription', {
+                subscriptionId: id,
+                error: (0, ensure_error_1.ensureError)(error).message,
+            });
+            return [];
+        }
+        try {
+            await transport_1.microsoftApiRequest.call(this, 'DELETE', path);
+            return [];
+        }
+        catch (error) {
+            if (error instanceof n8n_workflow_1.NodeApiError && error.httpCode === '404')
+                return [];
+            logTrigger.call(this, 'warn', 'failed to remove subscription', {
+                subscriptionId: id,
+                error: (0, ensure_error_1.ensureError)(error).message,
+            });
+            return [id];
+        }
+    }));
+    return refused.flat();
 }
+// The reconcile removes an own subscription whose resource is missing from these lists, so
+// they read every page: Graph pages a long list with `@odata.nextLink`.
 async function fetchAllTeams() {
-    const { value: teams } = (await transport_1.microsoftApiRequest.call(this, 'GET', transport_1.joinedTeamsEndpoint.call(this)));
-    return teams;
+    return (await transport_1.microsoftApiRequestAllItems.call(this, 'value', 'GET', transport_1.joinedTeamsEndpoint.call(this)));
 }
 async function fetchAllChannels(teamId) {
     // Route through buildTeamsPath so `teamId` is validated before interpolation
     // (watch-all is also guarded in getResourcePath).
-    const { value: channels } = (await transport_1.microsoftApiRequest.call(this, 'GET', transport_1.buildTeamsPath.call(this, ['/v1.0/teams/', { id: teamId }, '/channels'])));
-    return channels;
+    return (await transport_1.microsoftApiRequestAllItems.call(this, 'value', 'GET', transport_1.buildTeamsPath.call(this, ['/v1.0/teams/', { id: teamId }, '/channels'])));
 }
 async function createSubscription(webhookUrl, resourcePath, clientState) {
     const expirationTime = newSubscriptionExpiry();
@@ -72,48 +118,273 @@ async function createSubscription(webhookUrl, resourcePath, clientState) {
     const response = (await transport_1.microsoftApiRequest.call(this, 'POST', '/v1.0/subscriptions', body));
     return response;
 }
+/**
+ * Creates one subscription per resource in parallel. Every POST settles first, so the
+ * ids that landed are known before the cleanup core runs next. An error is returned as
+ * thrown (`ensureError` keeps the object), so a Graph 403 keeps its hint copy.
+ */
+async function createSubscriptions(webhookUrl, resources, clientState) {
+    const results = await Promise.allSettled(resources.map(async (resource) => await createSubscription.call(this, webhookUrl, resource, clientState)));
+    const ids = [];
+    const errors = [];
+    results.forEach((result, index) => {
+        if (result.status === 'fulfilled') {
+            ids.push(result.value.id);
+            return;
+        }
+        const error = (0, ensure_error_1.ensureError)(result.reason);
+        logTrigger.call(this, 'warn', 'failed to create subscription', {
+            resource: resources[index],
+            error: error.message,
+        });
+        errors.push(error);
+    });
+    return { ids, errors };
+}
 async function listOwnSubscriptions(webhookUrl) {
     const subscriptions = (await transport_1.microsoftApiRequestAllItems.call(this, 'value', 'GET', '/v1.0/subscriptions'));
     return subscriptions.filter((subscription) => subscription.notificationUrl === webhookUrl);
 }
+/**
+ * Reads each id with GET by id, which returns the clientState that the listing hides, and
+ * says whether the subscription carries the stored secret. A 404 counts as another secret:
+ * nothing is there to keep. A failed read, or an answer without a clientState or for another
+ * id or URL, is unknown. Never throws.
+ */
+async function proveSecrets(ids, webhookUrl, clientState) {
+    const proofs = await Promise.all(ids.map(async (id) => {
+        try {
+            const answer = await transport_1.microsoftApiRequest.call(this, 'GET', transport_1.buildTeamsPath.call(this, ['/v1.0/subscriptions/', { id }]));
+            const answeredSecret = (0, is_record_1.isRecord)(answer) ? answer.clientState : undefined;
+            if (isSubscriptionResponse(answer) &&
+                answer.id === id &&
+                answer.notificationUrl === webhookUrl &&
+                typeof answeredSecret === 'string') {
+                return [id, answeredSecret === clientState ? 'match' : 'other'];
+            }
+            logTrigger.call(this, 'debug', 'could not prove the secret of a subscription', {
+                subscriptionId: id,
+            });
+        }
+        catch (error) {
+            if (error instanceof n8n_workflow_1.NodeApiError && error.httpCode === '404')
+                return [id, 'other'];
+            logTrigger.call(this, 'debug', 'failed to read subscription', {
+                subscriptionId: id,
+                error: (0, ensure_error_1.ensureError)(error).message,
+            });
+        }
+        return [id, 'unknown'];
+    }));
+    return new Map(proofs);
+}
+/**
+ * Marks the workflow so that its next lifecycle batch lists and reconciles instead of only
+ * renewing, after a failed create, read or listing. Only a subscription that still delivers
+ * sends that batch: when every subscription of the workflow is gone, nothing reads the mark
+ * (ENT-537, ENT-545). Writes on change only: the static-data proxy marks every set and delete
+ * as a change, and each change is a database write.
+ */
+function markPendingReconcile(webhookData, pending) {
+    if (pending && webhookData.pendingReconcile !== true)
+        webhookData.pendingReconcile = true;
+    if (!pending && webhookData.pendingReconcile !== undefined)
+        delete webhookData.pendingReconcile;
+}
+/**
+ * Applies the ownership rule to one own listing: one live subscription with the stored secret
+ * per required resource stays, the uncovered resources are created with the stored secret, and
+ * every other listed own subscription goes, except a stored one beside a keeper, which is
+ * forgotten, and everything on a held resource. Reads and writes
+ * `subscriptionIds` itself, so the trust decision and the write share one source. Returns the
+ * create errors, and whether the next lifecycle batch must reconcile again. Never throws.
+ */
+async function reconcileSubscriptions(input) {
+    const { webhookUrl, clientState, subscriptions, renewed = new Set(), gone = new Set(), holdUnproven, } = input;
+    const webhookData = this.getWorkflowStaticData('node');
+    const storedIds = getStoredIds(webhookData);
+    const required = [...new Set(input.requiredResources)];
+    // Liveness is decided once: the awaited deletes below must not move the line.
+    const live = new Set(subscriptions
+        .filter((sub) => !gone.has(sub.id) && (renewed.has(sub.id) || isLiveSubscription(sub)))
+        .map((sub) => sub.id));
+    const isStored = (sub) => storedIds.includes(sub.id) && !gone.has(sub.id);
+    // Renewed first, then stored, then the later expiry, then the id, so requests that see the
+    // same subscriptions keep the same one whatever the listing order.
+    const byPreference = (a, b) => Number(renewed.has(b.id)) - Number(renewed.has(a.id)) ||
+        Number(isStored(b)) - Number(isStored(a)) ||
+        (Date.parse(b.expirationDateTime) || 0) - (Date.parse(a.expirationDateTime) || 0) ||
+        (a.id < b.id ? -1 : 1);
+    // A renewal in this request proves the secret: its lifecycle item passed verification. Earlier
+    // versions stored every own subscription, whatever its secret, so storage alone decides only
+    // for a stored subscription that is the only live own one and the only stored one on its
+    // resource. Elsewhere GET by id proves the live ones, so a live listed subscription with the
+    // stored secret goes only beside a keeper, or at activation when it is not stored and its read
+    // failed. Stale, unlisted and no longer required ones go without a read.
+    const keepers = new Map();
+    const unproven = [];
+    for (const resource of required) {
+        const onResource = subscriptions.filter((sub) => sub.resource === resource);
+        const liveHere = onResource.filter((sub) => live.has(sub.id));
+        const storedLive = liveHere.filter(isStored);
+        const [renewedKeeper] = storedLive.filter((sub) => renewed.has(sub.id)).sort(byPreference);
+        if (renewedKeeper)
+            keepers.set(resource, renewedKeeper.id);
+        else if (storedLive.length === 1 &&
+            liveHere.length === 1 &&
+            onResource.filter(isStored).length === 1) {
+            keepers.set(resource, storedLive[0].id);
+        }
+        else
+            unproven.push(...liveHere);
+    }
+    const proofs = await proveSecrets.call(this, unproven.map((sub) => sub.id), webhookUrl, clientState);
+    // A read can fail for a reason about the transport, a 429 for example, not about the
+    // subscription, so a failed read never costs a stored subscription.
+    const held = new Set();
+    for (const resource of required) {
+        if (keepers.has(resource))
+            continue;
+        const candidates = unproven.filter((sub) => sub.resource === resource);
+        if (candidates.some((sub) => proofs.get(sub.id) === 'unknown' && (holdUnproven || isStored(sub)))) {
+            held.add(resource);
+            continue;
+        }
+        const [keeper] = candidates.filter((sub) => proofs.get(sub.id) === 'match').sort(byPreference);
+        if (keeper)
+            keepers.set(resource, keeper.id);
+    }
+    const keeperIds = new Set(keepers.values());
+    // A stored subscription beside a keeper is forgotten, not deleted, whatever its listed
+    // expiry: a request that renewed it can run at the same time and keep it, and two requests
+    // that share the stored ids must not delete each other's keeper. Unless it expires first, one
+    // with the stored secret names an unknown id at its next renewal, and that reconcile removes
+    // it. One with another secret is never renewed and expires, or goes now when GET by id
+    // proved it.
+    const forgotten = new Set(subscriptions
+        .filter((sub) => isStored(sub) &&
+        keepers.has(sub.resource) &&
+        !keeperIds.has(sub.id) &&
+        proofs.get(sub.id) !== 'other')
+        .map((sub) => sub.id));
+    const listedIds = new Set(subscriptions.map((sub) => sub.id));
+    const storedAbsent = storedIds.filter((id) => !listedIds.has(id) && !gone.has(id));
+    // The deletes finish before the first create: Graph refuses a second
+    // `/teams/{id}/channels` subscription.
+    const refused = new Set(await deleteSubscriptions.call(this, [
+        ...subscriptions
+            .filter((sub) => !keeperIds.has(sub.id) && !forgotten.has(sub.id) && !held.has(sub.resource))
+            .map((sub) => sub.id),
+        ...storedAbsent,
+    ]));
+    const { ids: created, errors } = await createSubscriptions.call(this, webhookUrl, required.filter((resource) => !keepers.has(resource) && !held.has(resource)), clientState);
+    // A stored id that is not listed and that Graph refused to remove stays, so the next
+    // reconcile retries the delete; the by-URL listing cannot find it. The stored ids of a held
+    // resource stay too, so the next reconcile sees the same subscriptions.
+    const retained = storedAbsent.filter((id) => refused.has(id));
+    const heldIds = subscriptions
+        .filter((sub) => isStored(sub) && held.has(sub.resource))
+        .map((sub) => sub.id);
+    const ids = [
+        ...new Set([
+            ...required.flatMap((resource) => keepers.get(resource) ?? []),
+            ...heldIds,
+            ...retained,
+            ...created,
+        ]),
+    ];
+    // Every save is a DB write and widens the last-write-wins window, so save on change only.
+    const raw = Array.isArray(webhookData.subscriptionIds)
+        ? webhookData.subscriptionIds
+        : undefined;
+    const unchanged = raw !== undefined && raw.length === ids.length && ids.every((id) => raw.includes(id));
+    if (!unchanged)
+        webhookData.subscriptionIds = ids;
+    return { errors, retry: errors.length > 0 || held.size > 0 };
+}
+/**
+ * Whether the stored ids alone cover every required resource with a live subscription at
+ * this URL. Reads each stored id with GET by id, which has its own budget: 2000 requests per
+ * 20 s for an app across all tenants, against 40 for the listing. Two stored subscriptions on
+ * one resource both count: keeping them is safer than core's cleanup, and the next reconcile
+ * proves each secret. An answer with another clientState covers nothing. An answer without
+ * one still counts here; the reconcile treats it as unproven. Never throws.
+ */
+async function storedSubscriptionsCover(webhookUrl, clientState, event) {
+    let required;
+    try {
+        required = [await getResourcePath.call(this, event)].flat();
+    }
+    catch {
+        return false;
+    }
+    const covered = new Set();
+    await Promise.all(getStoredIds(this.getWorkflowStaticData('node')).map(async (id) => {
+        try {
+            const answer = await transport_1.microsoftApiRequest.call(this, 'GET', transport_1.buildTeamsPath.call(this, ['/v1.0/subscriptions/', { id }]));
+            const answeredSecret = (0, is_record_1.isRecord)(answer) ? answer.clientState : undefined;
+            if (isSubscriptionResponse(answer) &&
+                answer.id === id &&
+                answer.notificationUrl === webhookUrl &&
+                isLiveSubscription(answer) &&
+                (typeof answeredSecret !== 'string' || answeredSecret === clientState)) {
+                covered.add(answer.resource);
+                return;
+            }
+            logTrigger.call(this, 'debug', 'stored subscription does not count', {
+                subscriptionId: id,
+            });
+        }
+        catch (error) {
+            logTrigger.call(this, 'debug', 'failed to read stored subscription', {
+                subscriptionId: id,
+                error: (0, ensure_error_1.ensureError)(error).message,
+            });
+        }
+    }));
+    return required.every((resource) => covered.has(resource));
+}
 // Anything with a `lifecycleEvent` is a lifecycle item and never a workflow item; the
 // handler checks the id before it uses it.
 function isLifecycleNotification(item) {
     return (0, is_record_1.isRecord)(item) && typeof item.lifecycleEvent === 'string';
 }
+/** A PATCH answer that can stand in for a listing entry. */
+function isSubscriptionResponse(value) {
+    return ((0, is_record_1.isRecord)(value) &&
+        typeof value.id === 'string' &&
+        typeof value.resource === 'string' &&
+        typeof value.expirationDateTime === 'string' &&
+        typeof value.notificationUrl === 'string');
+}
 /**
  * Runs after `webhook()` sent the 202. Never throws: a throw skips the static-data
- * save and core would answer an ended response. Lists the subscriptions at most once
- * per request.
+ * save and core would answer an ended response. Renews the stored ids the batch names;
+ * a batch with a removal, an unknown id, a failed renewal or a rejected item lists once
+ * and reconciles, and so does a trigger that watches one resource but stores more ids, or
+ * one that an earlier batch marked because its reconcile did not finish. A batch arrives only
+ * while a subscription still delivers.
  */
-async function handleLifecycleNotifications(items) {
+async function handleLifecycleNotifications(items, rejectedCount = 0) {
     const webhookData = this.getWorkflowStaticData('node');
-    const meta = { workflowId: this.getWorkflow().id, nodeName: this.getNode().name };
-    const log = (level, message, fields) => this.logger[level](`Microsoft Teams Trigger: ${message}`, { ...meta, ...fields });
     // Do not make Graph calls if this helper is invoked without a stored secret.
     const clientState = getStoredSecret(webhookData);
     if (clientState === undefined) {
-        log('warn', 'skipped lifecycle notifications: no stored secret, republish the workflow', {});
+        logTrigger.call(this, 'warn', 'skipped lifecycle notifications: no stored secret, republish the workflow');
         return;
     }
     const webhookUrl = this.getNodeWebhookUrl('default');
     // Type narrowing only: the subscriptions were created with this URL.
     if (webhookUrl === undefined)
         return;
-    const rawIds = Array.isArray(webhookData.subscriptionIds)
-        ? webhookData.subscriptionIds
-        : [];
-    const storedIds = rawIds.filter((id) => typeof id === 'string');
-    // One listing per request; a rejected listing is never fetched again.
-    let ownList;
-    const ownSubscriptions = async () => await (ownList ??= listOwnSubscriptions.call(this, webhookUrl));
+    const storedIds = getStoredIds(webhookData);
     // Classify first, so the order inside the batch does not change the outcome. Logged
     // request values are capped: the sender holds the secret, but the body is still input.
     const gone = new Set();
     const toRenew = new Set();
     for (const { subscriptionId, lifecycleEvent } of items) {
         if (typeof subscriptionId !== 'string') {
-            log('debug', 'ignored lifecycle event without a subscription id', {
+            logTrigger.call(this, 'debug', 'ignored lifecycle event without a subscription id', {
                 lifecycleEvent: lifecycleEvent.slice(0, 64),
             });
         }
@@ -124,121 +395,105 @@ async function handleLifecycleNotifications(items) {
             toRenew.add(subscriptionId);
         }
         else {
-            log('debug', 'ignored lifecycle event', {
+            logTrigger.call(this, 'debug', 'ignored lifecycle event', {
                 subscriptionId: subscriptionId.slice(0, 64),
                 lifecycleEvent: lifecycleEvent.slice(0, 64),
             });
         }
     }
-    const unresolved = new Set();
     const renewed = new Set();
-    let needsReconcile = gone.size > 0;
+    const renewedEntries = new Map();
     for (const subscriptionId of toRenew) {
         if (gone.has(subscriptionId))
             continue;
-        let isOwn;
-        try {
-            isOwn =
-                storedIds.includes(subscriptionId) ||
-                    (await ownSubscriptions()).some((subscription) => subscription.id === subscriptionId);
-        }
-        catch {
-            // Route to the reconcile, which awaits the same rejected listing and warns once.
-            unresolved.add(subscriptionId);
-            needsReconcile = true;
-            continue;
-        }
-        if (!isOwn) {
-            log('debug', 'skipped renewal: unknown subscription', {
+        // An own id that is not stored is an orphan; the reconcile below removes it.
+        if (!storedIds.includes(subscriptionId)) {
+            logTrigger.call(this, 'debug', 'skipped renewal: unknown subscription', {
                 subscriptionId: subscriptionId.slice(0, 64),
             });
-            needsReconcile = true;
             continue;
         }
         try {
-            await transport_1.microsoftApiRequest.call(this, 'PATCH', transport_1.buildTeamsPath.call(this, ['/v1.0/subscriptions/', { id: subscriptionId }]), { expirationDateTime: newSubscriptionExpiry() });
+            const answer = await transport_1.microsoftApiRequest.call(this, 'PATCH', transport_1.buildTeamsPath.call(this, ['/v1.0/subscriptions/', { id: subscriptionId }]), { expirationDateTime: newSubscriptionExpiry() });
             renewed.add(subscriptionId);
-            log('debug', 'renewed subscription', { subscriptionId });
+            logTrigger.call(this, 'debug', 'renewed subscription', { subscriptionId });
+            // The answer stands in for a listing entry that can lag. A stored id at an old
+            // webhook URL must not become a keeper for the current URL through its answer.
+            if (isSubscriptionResponse(answer) &&
+                answer.id === subscriptionId &&
+                answer.notificationUrl === webhookUrl) {
+                renewedEntries.set(subscriptionId, answer);
+            }
+            else {
+                logTrigger.call(this, 'debug', 'renewed subscription without a usable answer', {
+                    subscriptionId,
+                });
+            }
         }
         catch (error) {
             if (error instanceof n8n_workflow_1.NodeApiError && error.httpCode === '404') {
                 gone.add(subscriptionId);
-                needsReconcile = true;
-                log('debug', 'subscription gone, will re-create', { subscriptionId });
+                logTrigger.call(this, 'debug', 'subscription gone, will re-create', { subscriptionId });
             }
             else {
-                log('warn', 'failed to renew subscription', {
+                logTrigger.call(this, 'warn', 'failed to renew subscription', {
                     subscriptionId,
                     error: (0, ensure_error_1.ensureError)(error).message,
                 });
             }
         }
     }
-    if (!needsReconcile) {
-        // Store the ids that the listing proved to be own, so `delete()` removes them on unpublish.
-        const discovered = [...renewed].filter((id) => !storedIds.includes(id));
-        if (discovered.length > 0)
-            webhookData.subscriptionIds = [...storedIds, ...discovered];
+    // A plain renewal lists nothing: Graph allows 25 `GET /subscriptions` per 20 s per app
+    // per tenant and 40 per 20 s per app across tenants. A trigger that watches one resource
+    // but stores more ids lists anyway: earlier versions stored duplicates with the valid
+    // secret, and they renew forever unless a listing removes them.
+    const event = this.getNodeParameter('event', '');
+    const watchesMany = (event === 'newChannel' || event === 'newChannelMessage' || event === 'newTeamMember') &&
+        (this.getNodeParameter('watchAllTeams', false) === true ||
+            (event === 'newChannelMessage' && this.getNodeParameter('watchAllChannels', false) === true));
+    // ponytail: no backoff for a marked workflow; it lists at most once per lifecycle batch, and
+    // Graph sets the batch rate and documents no limit. Add a backoff if marked workflows show up
+    // in the listing budget.
+    const renewOnly = webhookData.pendingReconcile !== true &&
+        rejectedCount === 0 &&
+        gone.size === 0 &&
+        [...toRenew].every((id) => renewed.has(id)) &&
+        (watchesMany || storedIds.length <= 1);
+    if (renewOnly)
         return;
-    }
-    const affectedIds = [...gone, ...unresolved].slice(0, 20).map((id) => id.slice(0, 64));
     let subscriptions;
     let requiredResources;
     try {
-        subscriptions = await ownSubscriptions();
-        const resourcePaths = await getResourcePath.call(this, this.getNodeParameter('event'));
-        requiredResources = Array.isArray(resourcePaths) ? resourcePaths : [resourcePaths];
+        subscriptions = await listOwnSubscriptions.call(this, webhookUrl);
+        requiredResources = [
+            await getResourcePath.call(this, this.getNodeParameter('event')),
+        ].flat();
     }
     catch (error) {
-        log('warn', 'failed to list subscriptions or resolve resources, skipped re-create', {
-            subscriptionIds: affectedIds,
-            error: (0, ensure_error_1.ensureError)(error).message,
-        });
+        const affectedIds = [...gone, ...toRenew].slice(0, 20).map((id) => id.slice(0, 64));
+        logTrigger.call(this, 'warn', 'failed to list subscriptions or resolve resources, skipped re-create', { subscriptionIds: affectedIds, error: (0, ensure_error_1.ensureError)(error).message });
+        markPendingReconcile(webhookData, true);
         return;
     }
-    // Partition once: an id renewed in this request stays live even when its listed expiry
-    // passed meanwhile, and the awaited deletes below must not move the line.
-    const live = subscriptions.filter((subscription) => !gone.has(subscription.id) &&
-        (renewed.has(subscription.id) || isLiveSubscription(subscription)));
-    const liveIds = new Set(live.map((subscription) => subscription.id));
-    // Every other own subscription is removed before its replacement is created, so the two
-    // never deliver together and Graph does not reject the replacement as a duplicate. One
-    // that Graph already removed answers 404, which counts as done.
-    for (const { id } of subscriptions) {
-        if (liveIds.has(id))
-            continue;
-        try {
-            await deleteSubscription.call(this, id);
-        }
-        catch (error) {
-            log('debug', 'failed to remove a stale subscription', {
-                subscriptionId: id,
-                error: (0, ensure_error_1.ensureError)(error).message,
-            });
-        }
-    }
-    const liveResources = new Set(live.map((subscription) => subscription.resource));
-    const created = [];
-    for (const resource of requiredResources.filter((path) => !liveResources.has(path))) {
-        try {
-            const subscription = await createSubscription.call(this, webhookUrl, resource, clientState);
-            created.push(subscription.id);
-            log('debug', 're-created subscription', { resource, subscriptionId: subscription.id });
-        }
-        catch (error) {
-            log('warn', 'failed to re-create subscription', {
-                resource,
-                subscriptionIds: affectedIds,
-                error: (0, ensure_error_1.ensureError)(error).message,
-            });
-        }
-    }
-    const nextIds = [...live.map((subscription) => subscription.id), ...created];
-    // Every save is a DB write and widens the last-write-wins window, so save on change only.
-    const unchanged = nextIds.length === rawIds.length && nextIds.every((id) => rawIds.includes(id));
-    if (!unchanged)
-        webhookData.subscriptionIds = nextIds;
+    // An orphan whose own challenge fails verification never reaches this handler, so a
+    // batch with an anomaly (a removal, an unknown id, a failed renewal, a rejected item)
+    // must prune for it. The helpers log the failures. A failed create or read marks the
+    // workflow, so a later batch reconciles again instead of only renewing.
+    const { retry } = await reconcileSubscriptions.call(this, {
+        webhookUrl,
+        clientState,
+        requiredResources,
+        subscriptions: [
+            ...subscriptions.filter((subscription) => !renewedEntries.has(subscription.id)),
+            ...renewedEntries.values(),
+        ],
+        renewed,
+        gone,
+        holdUnproven: true,
+    });
+    markPendingReconcile(webhookData, retry);
 }
+/** The accepted items of the request body; `[]` for a missing, empty or non-array body. */
 function verifyWebhook() {
     const req = this.getRequestObject();
     const webhookData = this.getWorkflowStaticData('node');
@@ -246,9 +501,12 @@ function verifyWebhook() {
     const body = req.body;
     const notifications = body?.value;
     if (!Array.isArray(notifications) || notifications.length === 0) {
-        return false;
+        return [];
     }
-    return notifications.every((notification) => {
+    // Graph batches several subscriptions into one POST, so an item from another
+    // subscription must not drop the valid ones. Without a stored secret no item is
+    // accepted.
+    return notifications.filter((notification) => {
         const actualClientState = typeof notification === 'object' && notification !== null
             ? notification.clientState
             : undefined;