shutro-erp 0.3.1 → 0.3.3

package/dist/account_portal/.kosh/bindings.js

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 0ea5d21ac5b24166
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 668898d9db81475e
 // Bindings of module `account_portal`: import the definition API from here to get types scoped to what it can see.
 export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
 import { definitions } from '../../server/orm.js';

package/dist/account_portal/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 0ea5d21ac5b24166
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 668898d9db81475e
 // Schema view of module `account_portal` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -24,6 +24,7 @@ export interface SchemaView {
   readonly 'audit.event': AuditEvent;
   readonly 'auth.api_key': AuthApiKey;
   readonly 'auth.credential': AuthCredential;
+  readonly 'auth.policy': AuthPolicy;
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
@@ -634,6 +635,26 @@ export interface AuthCredential {
 export interface AuthCredentialMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.credential'> {
 }
 
+/** `auth.policy` (owner: base). */
+export interface AuthPolicy {
+  readonly name: 'auth.policy';
+  readonly fields: {
+    readonly id: F.Id<'auth.policy'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly twoFactor: F.Selection<'administrators' | 'everyone', { readonly required: true; readonly default: true }>;
+    readonly sessionDays: F.Integer;
+  };
+  readonly methods: AuthPolicyMethods;
+}
+
+/** Methods of `auth.policy`: declared ones and transitions. */
+export interface AuthPolicyMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.policy'> {
+}
+
 /** `auth.session` (owner: base). */
 export interface AuthSession {
   readonly name: 'auth.session';
@@ -1200,6 +1221,13 @@ export interface ResCompany {
     readonly name: F.Char<{ readonly required: true }>;
     readonly currency: F.Many2one<'res.currency', { readonly required: true }>;
     readonly numberGrouping: F.Selection<'international' | 'lakh', { readonly required: true; readonly default: true }>;
+    readonly accentColor: F.Char;
+    readonly street: F.Char;
+    readonly city: F.Char;
+    readonly zip: F.Char;
+    readonly email: F.Char;
+    readonly phone: F.Char;
+    readonly website: F.Char;
     readonly fiscalYearStart: F.Integer<{ readonly required: true; readonly default: true }>; // accounting
     readonly chartTemplate: F.Char; // accounting
     readonly country: F.Char; // accounting

package/dist/account_portal/index.js

@@ -2,8 +2,8 @@
  * @packageDocumentation
  * `shutro-erp/account_portal`: Accounting in the portal (RFC 0015 §5.4). Proposed whenever Accounting and the portal
  * are installed. Customers see their posted invoices and credit notes, what is still due, print them and write on
- * them; vendors see the bills recorded for them. Payment is by the details on the invoice (online payment comes
- * with the integrations RFC).
+ * them; vendors see the bills recorded for them. Open invoices are payable online when the `payment` module and
+ * a provider are installed (RFC 0017 §5.5); otherwise by the payment details on the invoice.
  */
 import { accounting } from '../accounting/index.js';
 import { defineModule } from '../modules-sdk/index.js';
@@ -55,6 +55,7 @@ export const accountPortal = defineModule({
                 thread: true,
                 attention: { kind: 'out_invoice', paymentState: { in: ['not_paid', 'partial'] } },
                 announce: { state: 'posted' },
+                payment: { when: { kind: 'out_invoice', paymentState: { in: ['not_paid', 'partial'] } } },
             },
             {
                 key: 'bills',

package/dist/accounting/.kosh/bindings.js

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: c83d584195f8dd43
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: e7d2cbddec9ade69
 // Bindings of module `accounting`: import the definition API from here to get types scoped to what it can see.
 export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
 import { definitions } from '../../server/orm.js';

package/dist/accounting/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: c83d584195f8dd43
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: e7d2cbddec9ade69
 // Schema view of module `accounting` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -24,6 +24,7 @@ export interface SchemaView {
   readonly 'audit.event': AuditEvent;
   readonly 'auth.api_key': AuthApiKey;
   readonly 'auth.credential': AuthCredential;
+  readonly 'auth.policy': AuthPolicy;
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
@@ -631,6 +632,26 @@ export interface AuthCredential {
 export interface AuthCredentialMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.credential'> {
 }
 
+/** `auth.policy` (owner: base). */
+export interface AuthPolicy {
+  readonly name: 'auth.policy';
+  readonly fields: {
+    readonly id: F.Id<'auth.policy'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly twoFactor: F.Selection<'administrators' | 'everyone', { readonly required: true; readonly default: true }>;
+    readonly sessionDays: F.Integer;
+  };
+  readonly methods: AuthPolicyMethods;
+}
+
+/** Methods of `auth.policy`: declared ones and transitions. */
+export interface AuthPolicyMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.policy'> {
+}
+
 /** `auth.session` (owner: base). */
 export interface AuthSession {
   readonly name: 'auth.session';
@@ -1125,6 +1146,13 @@ export interface ResCompany {
     readonly name: F.Char<{ readonly required: true }>;
     readonly currency: F.Many2one<'res.currency', { readonly required: true }>;
     readonly numberGrouping: F.Selection<'international' | 'lakh', { readonly required: true; readonly default: true }>;
+    readonly accentColor: F.Char;
+    readonly street: F.Char;
+    readonly city: F.Char;
+    readonly zip: F.Char;
+    readonly email: F.Char;
+    readonly phone: F.Char;
+    readonly website: F.Char;
     readonly fiscalYearStart: F.Integer<{ readonly required: true; readonly default: true }>; // accounting
     readonly chartTemplate: F.Char; // accounting
     readonly country: F.Char; // accounting

package/dist/accounting/index.js

@@ -404,6 +404,10 @@ export const accounting = defineModule({
             sequence: 5,
         },
     ],
+    // What webhooks may subscribe to besides record changes (RFC 0017 §5.3).
+    events: [
+        { topic: 'account.move.posted', model: 'account.move', label: 'Entry, invoice or bill posted' },
+    ],
     approvals: [
         {
             name: 'Vendor bill approvals',

package/dist/assistant/index.js

@@ -42,7 +42,7 @@ export function createAssistant(options = {}) {
         menus: [
             {
                 id: 'assistant.settings',
-                parent: 'settings.root',
+                parent: 'settings.group_apps',
                 label: 'AI assistant',
                 action: 'assistant.action_settings',
                 sequence: 50,

package/dist/cli/init.js

@@ -503,6 +503,7 @@ async function modulesFor(apps) {
         (await import('../notify/index.js')).notify,
         (await import('../mail/index.js')).mail,
         (await import('../automation/index.js')).automation,
+        (await import('../integrations/index.js')).integrations,
         (await import('../studio/index.js')).studio,
         (await import('../import/index.js')).dataImport,
     ];
@@ -940,6 +941,7 @@ export async function runInit(argv, io) {
                     'notify',
                     'mail',
                     'automation',
+                    'integrations',
                     'studio',
                     'import',
                     ...answers.apps,

package/dist/cli/launch.js

@@ -24,14 +24,17 @@ export function browserCommand(url, platform = process.platform) {
 const windows = process.platform === 'win32';
 /** A child process running `pm args` in `cwd`, its output kept (the last 200 lines). */
 function start(pm, args, cwd) {
-    const child = spawn(pm, args, {
+    const options = {
         cwd,
         env: { ...process.env, FORCE_COLOR: '0' },
         stdio: ['ignore', 'pipe', 'pipe'],
-        // npm, pnpm… are .cmd scripts on Windows; elsewhere a process group, stopped as a whole.
-        shell: windows,
-        detached: !windows,
-    });
+        detached: !windows, // elsewhere a process group, stopped as a whole
+    };
+    // npm, pnpm… are .cmd scripts on Windows: run through the shell as one command line (the arguments are this
+    // module's own words, never input), which Node prefers to separate arguments with `shell: true`.
+    const child = windows
+        ? spawn([pm, ...args].join(' '), { ...options, shell: true })
+        : spawn(pm, args, options);
     const lines = [];
     const keep = (chunk) => {
         lines.push(...chunk

package/dist/cli/templates.js

@@ -88,6 +88,7 @@ const REACT = {
     react: '^19.1.0',
     'react-dom': '^19.1.0',
     '@tanstack/react-query': '^5.90.0',
+    '@tanstack/react-router': '^1.170.0',
     i18next: '^25.0.0 || ^26.0.0',
     'react-i18next': '^16.0.0 || ^17.0.0',
 };
@@ -136,6 +137,7 @@ export function modulesTs(_options) {
  */
 import { base } from 'shutro-erp';
 import { automation } from 'shutro-erp/automation';
+import { integrations } from 'shutro-erp/integrations';
 import { mail } from 'shutro-erp/mail';
 import { notify } from 'shutro-erp/notify';
 import { realtime } from 'shutro-erp/realtime';
@@ -145,7 +147,7 @@ import { dataImport } from 'shutro-erp/import';
 import { studio } from 'shutro-erp/studio';
 ${imports.join('\n')}
 
-export const modules = [base, settings, realtime, notify, mail, automation, studio, dataImport, assistant${apps.map((a) => `, ${APPS[a].server}`).join('')}];
+export const modules = [base, settings, realtime, notify, mail, automation, integrations, studio, dataImport, assistant${apps.map((a) => `, ${APPS[a].server}`).join('')}];
 `;
 }
 export function serverTs() {
@@ -216,6 +218,7 @@ export function mainTsx(_options) {
         { name: 'notify', fn: 'registerNotifyWeb' },
         { name: 'mail', fn: 'registerMailWeb' },
         { name: 'automation', fn: 'registerAutomationWeb' },
+        { name: 'integrations', fn: 'registerIntegrationsWeb' },
         { name: 'studio', fn: 'registerStudioWeb' },
         { name: 'assistant', fn: 'registerAssistantWeb' },
         { name: 'import', fn: 'registerImportWeb' },

package/dist/cli/ui.js

@@ -251,7 +251,25 @@ export function createUi(out, terminal = PLAIN_TERMINAL, options = {}) {
         },
         card(title, rows, tone = 'green') {
             const labelWidth = Math.max(0, ...rows.map(([l]) => width(l)));
-            const body = rows.map(([l, v]) => `${s('gray', l.padEnd(labelWidth))}  ${v}`);
+            // Long values wrap at the terminal's width, aligned after their label.
+            const room = Math.max(20, Math.min(terminal.columns, 100) - labelWidth - 10);
+            const wrap = (value) => {
+                const lines = [];
+                let current = '';
+                for (const word of value.split(' ')) {
+                    const next = current === '' ? word : `${current} ${word}`;
+                    if (current !== '' && width(next) > room) {
+                        lines.push(current);
+                        current = word;
+                    }
+                    else
+                        current = next;
+                }
+                return [...lines, current];
+            };
+            const body = rows.flatMap(([l, v]) => wrap(v).map((part, i) => i === 0
+                ? `${s('gray', l.padEnd(labelWidth))}  ${part}`
+                : `${' '.repeat(labelWidth)}  ${part}`));
             const inner = Math.max(width(title), ...body.map(width)) + 2;
             const [tl, tr, bl, br, h, v] = terminal.unicode
                 ? ['╭', '╮', '╰', '╯', '─', '│']

package/dist/contacts/.kosh/bindings.js

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 2271aaa68e1a18a5
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 31cf57953410c779
 // Bindings of module `contacts`: import the definition API from here to get types scoped to what it can see.
 export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
 import { definitions } from '../../server/orm.js';

package/dist/contacts/.kosh/schema.d.ts

@@ -1,4 +1,4 @@
-// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 2271aaa68e1a18a5
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: 31cf57953410c779
 // Schema view of module `contacts` (RFC 0002 §7.7): the models it owns or depends on, with the extensions it can see.
 import type { F } from '../../server/orm.js';
 
@@ -7,6 +7,7 @@ export interface SchemaView {
   readonly 'audit.event': AuditEvent;
   readonly 'auth.api_key': AuthApiKey;
   readonly 'auth.credential': AuthCredential;
+  readonly 'auth.policy': AuthPolicy;
   readonly 'auth.session': AuthSession;
   readonly 'auth.user_grant': AuthUserGrant;
   readonly 'auth.user_group': AuthUserGroup;
@@ -94,6 +95,26 @@ export interface AuthCredential {
 export interface AuthCredentialMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.credential'> {
 }
 
+/** `auth.policy` (owner: base). */
+export interface AuthPolicy {
+  readonly name: 'auth.policy';
+  readonly fields: {
+    readonly id: F.Id<'auth.policy'>;
+    readonly createdAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly updatedAt: F.Datetime<{ readonly required: true; readonly readonly: true }>;
+    readonly createdBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly updatedBy: F.Many2one<'res.users', { readonly readonly: true }>;
+    readonly displayName: F.Char<{ readonly required: true; readonly readonly: true; readonly compute: true }>;
+    readonly twoFactor: F.Selection<'administrators' | 'everyone', { readonly required: true; readonly default: true }>;
+    readonly sessionDays: F.Integer;
+  };
+  readonly methods: AuthPolicyMethods;
+}
+
+/** Methods of `auth.policy`: declared ones and transitions. */
+export interface AuthPolicyMethods extends F.Methods<typeof import('../../server/index.js').baseShutro, 'auth.policy'> {
+}
+
 /** `auth.session` (owner: base). */
 export interface AuthSession {
   readonly name: 'auth.session';
@@ -203,6 +224,13 @@ export interface ResCompany {
     readonly name: F.Char<{ readonly required: true }>;
     readonly currency: F.Many2one<'res.currency', { readonly required: true }>;
     readonly numberGrouping: F.Selection<'international' | 'lakh', { readonly required: true; readonly default: true }>;
+    readonly accentColor: F.Char;
+    readonly street: F.Char;
+    readonly city: F.Char;
+    readonly zip: F.Char;
+    readonly email: F.Char;
+    readonly phone: F.Char;
+    readonly website: F.Char;
   };
   readonly methods: ResCompanyMethods;
 }

package/dist/integrations/inbound.d.ts

@@ -0,0 +1,36 @@
+import type { InboundCall, InboundWebhookSpec } from '../modules-sdk/index.js';
+import type { KoshRegistry } from '../server/index.js';
+import type { Shutro } from '../server/orm.js';
+export declare const INBOUND_JOB = "webhook.inbound";
+/** The declared inbound webhooks of the loaded modules, by `<module>.<key>`. */
+export declare function inboundHooks(registry: KoshRegistry): Map<string, InboundWebhookSpec & {
+    readonly module: string;
+}>;
+/**
+ * A `verify` for providers that sign with an HMAC of the raw body: the signature in `header` (hex or base64,
+ * optionally after a prefix such as `sha256=`), compared in constant time; the event id from `eventId`.
+ */
+export declare function hmacVerifier(options: {
+    readonly header: string;
+    readonly algorithm?: 'sha256' | 'sha512' | 'sha1';
+    readonly encoding?: 'hex' | 'base64';
+    readonly prefix?: string;
+    readonly eventId: (call: InboundCall) => string | null | undefined;
+}): (call: InboundCall, secret: string) => string | null;
+export interface ReceiveResult {
+    readonly status: 202 | 200 | 401 | 404;
+    readonly body: Record<string, unknown>;
+}
+/** Receives a call on the endpoint of `token`: checked, stored, queued once per event id. */
+export declare function receive(context: {
+    readonly shutro: Shutro;
+    readonly registry: KoshRegistry;
+}, token: string, call: InboundCall): Promise<ReceiveResult>;
+/**
+ * Handles a stored call with its module's `handle`, as the system in the endpoint's company; records the outcome
+ * in its own transaction. Throws to be retried while attempts remain.
+ */
+export declare function handleInbound(context: {
+    readonly shutro: Shutro;
+    readonly registry: KoshRegistry;
+}, callId: number, company: number, last: boolean): Promise<void>;

package/dist/integrations/inbound.js

@@ -0,0 +1,171 @@
+/**
+ * Inbound webhooks (RFC 0017 §5.4). Modules declare endpoints (`inboundWebhooks` in their manifest); a company
+ * switches one on (`webhook.endpoint`: a URL token and a secret). A call to `POST /api/v1/hooks/<token>` is checked
+ * by the module's `verify` against the raw body, stored (refused calls too, for the log), and — once per event id —
+ * handled by the module in a job, as the system in the endpoint's company, retried on failure. A repeated event id
+ * is answered 200 and not handled again; a call can be handled again from the log (replay).
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { ref } from './webhooks.js';
+export const INBOUND_JOB = 'webhook.inbound';
+/** The declared inbound webhooks of the loaded modules, by `<module>.<key>`. */
+export function inboundHooks(registry) {
+    const out = new Map();
+    for (const m of registry.loaded.modules)
+        for (const hook of m.inboundWebhooks ?? [])
+            out.set(`${m.name}.${hook.key}`, { ...hook, module: m.name });
+    return out;
+}
+/**
+ * A `verify` for providers that sign with an HMAC of the raw body: the signature in `header` (hex or base64,
+ * optionally after a prefix such as `sha256=`), compared in constant time; the event id from `eventId`.
+ */
+export function hmacVerifier(options) {
+    return (call, secret) => {
+        let given = call.headers[options.header.toLowerCase()] ?? '';
+        if (options.prefix !== undefined) {
+            if (!given.startsWith(options.prefix))
+                return null;
+            given = given.slice(options.prefix.length);
+        }
+        const expected = createHmac(options.algorithm ?? 'sha256', secret)
+            .update(call.body)
+            .digest(options.encoding ?? 'hex');
+        const a = Buffer.from(given);
+        const b = Buffer.from(expected);
+        if (a.length !== b.length || !timingSafeEqual(a, b))
+            return null;
+        const id = options.eventId(call);
+        return id === null || id === undefined || id === '' ? null : String(id);
+    };
+}
+/** Headers worth keeping in the log (no cookies, no credentials). */
+const KEPT = /^(content-type|user-agent|x-[a-z0-9-]+)$/;
+function keptHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).filter((e) => e[1] !== undefined && KEPT.test(e[0]) && !/authorization|api-key|cookie/.test(e[0])));
+}
+/** Receives a call on the endpoint of `token`: checked, stored, queued once per event id. */
+export async function receive(context, token, call) {
+    const hooks = inboundHooks(context.registry);
+    // Which endpoint (and company) the token names: looked up across companies (the token is unique).
+    const found = await context.shutro.bootstrap({ reason: 'inbound webhook: endpoint' }, (env) => env.asSuperuser({ reason: 'inbound webhook: which endpoint' }, async (su) => {
+        const set = await ref(su.withFlags({ checkCompany: false }), 'webhook.endpoint').search({
+            where: { token, active: true },
+            limit: 1,
+        });
+        if (set.length === 0)
+            return null;
+        const [row] = (await set.load(['hook', 'secret', 'company'])).read([
+            'id',
+            'hook',
+            'secret',
+            'company',
+        ]);
+        return row ?? null;
+    }));
+    const hook = found === null ? undefined : hooks.get(String(found['hook']));
+    if (found === null || hook === undefined)
+        return { status: 404, body: { title: 'Not found', detail: 'No such webhook endpoint.' } };
+    const company = found['company'];
+    let eventId = null;
+    try {
+        eventId = await hook.verify(call, String(found['secret']));
+    }
+    catch {
+        eventId = null;
+    }
+    return context.shutro.bootstrap({ reason: `inbound webhook ${hook.module}.${hook.key}`, company }, async (env) => {
+        const calls = ref(env, 'webhook.inbound');
+        const base = {
+            endpoint: found['id'],
+            headers: keptHeaders(call.headers),
+            body: call.body.slice(0, 256 * 1024),
+            company,
+        };
+        if (eventId === null) {
+            await calls.create([{ ...base, verified: false, state: 'refused' }]);
+            return {
+                status: 401,
+                body: { title: 'Not verified', detail: 'The call’s signature does not match.' },
+            };
+        }
+        const seen = await calls.search({
+            where: { endpoint: found['id'], eventId, verified: true },
+            limit: 1,
+        });
+        if (seen.length > 0)
+            return { status: 200, body: { duplicate: true, eventId } };
+        const created = await calls.create([{ ...base, eventId, verified: true, state: 'received' }]);
+        const id = created.ids[0];
+        await env.enqueue(INBOUND_JOB, { call: id, company }, { attempts: 6 });
+        return { status: 202, body: { received: true, eventId } };
+    });
+}
+/**
+ * Handles a stored call with its module's `handle`, as the system in the endpoint's company; records the outcome
+ * in its own transaction. Throws to be retried while attempts remain.
+ */
+export async function handleInbound(context, callId, company, last) {
+    const hooks = inboundHooks(context.registry);
+    const system = (reason, fn) => context.shutro.bootstrap({ reason, company }, fn);
+    const found = await system('inbound webhook: the call', async (env) => {
+        const set = ref(env, 'webhook.inbound').browse([callId]);
+        const [c] = (await set.load(['endpoint', 'body', 'headers', 'state', 'attempts'])).read([
+            'endpoint',
+            'body',
+            'headers',
+            'state',
+            'attempts',
+        ]);
+        if (c === undefined)
+            return null;
+        const [e] = (await ref(env, 'webhook.endpoint')
+            .browse([c['endpoint']])
+            .load(['hook'])).read(['hook']);
+        return { row: c, hook: String(e?.['hook'] ?? '') };
+    });
+    if (found === null || found.row['state'] === 'done')
+        return;
+    const { row, hook: name } = found;
+    const hook = hooks.get(name);
+    const attempts = Number(row['attempts'] ?? 0) + 1;
+    const write = (values) => system('inbound webhook: the outcome', (env) => ref(env, 'webhook.inbound').browse([callId]).write(values));
+    if (hook === undefined) {
+        await write({
+            state: 'failed',
+            attempts,
+            error: `The endpoint ${name} is no longer installed.`,
+        });
+        return;
+    }
+    const body = String(row['body']);
+    let json = null;
+    try {
+        json = JSON.parse(body);
+    }
+    catch {
+        json = null;
+    }
+    const call = {
+        headers: (row['headers'] ?? {}),
+        query: {},
+        body,
+        json,
+    };
+    try {
+        const result = await system(`inbound webhook ${name}`, (env) => hook.handle(env, call));
+        await write({
+            state: 'done',
+            attempts,
+            result: typeof result === 'string' ? result : null,
+            error: null,
+            handledAt: new Date(),
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        await write({ state: last ? 'failed' : 'received', attempts, error: message });
+        if (!last)
+            throw error;
+    }
+}

package/dist/integrations/index.d.ts

@@ -0,0 +1,18 @@
+import { type KoshModule } from '../modules-sdk/index.js';
+import type { Worker } from '../server/orm.js';
+import { type IntegrationsContext } from './webhooks.js';
+export { handleInbound, hmacVerifier, INBOUND_JOB, inboundHooks, type ReceiveResult, receive, } from './inbound.js';
+export { integrationsShutro, newSecret, newToken } from './models.js';
+export { CHANGE_EVENTS, DELIVER_JOB, deliver, fanOut, type IntegrationsContext, PING_EVENT, signature, urlProblem, type WebhookEvent, webhookEvents, webhookHosts, } from './webhooks.js';
+/** The workers: events to deliveries (change events and the modules' events), and the delivery jobs. */
+export declare function webhookWorkers(integrations: IntegrationsContext): Worker[];
+export interface IntegrationsOptions {
+    /** The HTTP client deliveries use (tests). */
+    readonly fetch?: typeof fetch;
+    /** Start the workers (default: unless `SHUTRO_ERP_SCHEDULES=off`). */
+    readonly workers?: boolean;
+}
+/** The Integrations app with explicit options (tests, installations wiring their own). */
+export declare function integrationsModule(options?: IntegrationsOptions): KoshModule;
+/** The Integrations app (providers and workers from the environment). */
+export declare const integrations: KoshModule;