spine-framework 0.3.125 → 0.3.126

package/.framework/functions/integration-routes.ts

@@ -1,523 +1,297 @@
-/**
- * @module integration-routes
- * @audience core-contributor
- * @layer api-handler
- * @stability stable
- *
- * Unified integration routing system for all integration types.
- * Handles webhook, API, database, file, and custom integrations
- * through a single entry point with type-specific handlers.
- *
- ** Routed by:** `POST /api/integration-routes?slug=:slug`
- *
- * Route patterns:
- * | method | path                                      | handler                |
- * |--------|-------------------------------------------|------------------------|
- * | POST   | /api/integration-routes?slug=:slug        | handleWebhook          |
- *
- * **Authorization:** API key authentication with integration permissions
- * - API key validated via resolvePrincipal
- * - Integration permissions checked against principal.permissions.integrations[slug]
- *
- * **Security Flow:**
- * 1. API key validation (resolvePrincipal)
- * 2. Integration permission check
- * 3. Schema validation (if configured)
- * 4. Data sanitization
- * 5. Custom script execution
- *
- * INVARIANT: All validation failures return generic { status: "rejected" }
- * INVARIANT: Detailed errors logged server-side only
- * INVARIANT: Unknown fields in payload = HARD FAIL (fishing detection)
- *
- * @seeAlso integrations.ts (integration configuration)
- * @seeAlso principal.ts (machine principal resolution)
- * @seeAlso api-keys.ts (API key permissions)
- */
-
+// CIL[BEGIN chunk_id="integration_routes_module_header_1784200006" type="module_header" identity="imports" parent="none"]
+// CIL[DOC-MACRO purpose="Single inbound webhook gateway for all integrations"]
+// CIL[DOC-RESPONSIBILITY responsibility="Authenticate, route, dispatch, and persist inbound webhooks through admin-data"]
+// CIL[DOC-CONTEXT module="integration-routes" layer="backend_functions" related_files="[".framework/functions/_shared/principal.ts",".framework/functions/_shared/webhook-registry.ts",".framework/functions/admin-data.ts",".framework/functions/_shared/hash-api-key.ts",".framework/functions/_shared/resolve-credentials.ts",".framework/migrations/051_integration_broker.sql"]"]
+// CIL[DOC-CONTRACT inputs="x-api-key header and ?slug= query param" outputs="created record" errors="auth, routing, adapter, admin-data errors" side_effects="API key usage log, webhook delivery ledger, admin-data record creation"]
+// CIL[DOC-MICRO logic_summary="Resolves API key by x-api-key, loads integration by slug, finds a registered webhook handler, runs the adapter, and creates the resulting record through admin-data." notable_decisions="["Uses createPublicHandler because the caller is not a human JWT.","Created_by is null for machine writes; account_id is inherited from the integration.","Never passes adminDb or ctx.db to adapters."]"]
+// CIL[DOC-CONFIDENCE pass="first" score="0.9" flags="none"]
+// CIL[DOC-STABILITY stability="experimental"]
+// CIL[DOC-AUDIENCE audience="developer"]
+// CIL[DOC-VECTOR type="context" content="Layer: backend_functions. Direct callers: 0. Direct calls: 0. Related files: .framework/functions/_shared/principal.ts, .framework/functions/_shared/webhook-registry.ts, .framework/functions/admin-data.ts, .framework/functions/_shared/hash-api-key.ts, .framework/functions/_shared/resolve-credentials.ts, .framework/migrations/051_integration_broker.sql."]
+// CIL[DOC-VECTOR type="blast_radius" content="Direct callers: 0. Total affected: 0."]
+// CIL[DOC-VECTOR type="configuration" content="No configuration dependencies."]
+// CIL[DOC-VECTOR type="constraint" content="Requires x-api-key header and ?slug= query parameter."]
+// CIL[DOC-VECTOR type="implementation_pattern" content="Called by external services as POST /.netlify/functions/integration-routes?slug=<integration>."]
+// CIL[DOC-VECTOR type="user_journey" content="External service pushes data into Spine."]
+
+import { createPublicHandler, CoreContext } from './_shared/middleware'
 import { adminDb } from './_shared/db'
-import { resolvePrincipal } from './_shared/principal'
-import { resolveHandler, listRegisteredHandlers } from './_shared/webhook-registry'
-
-// ─── TYPES ────────────────────────────────────────────────────────────────
+import { emitLog } from './_shared/audit'
+import { resolveHandler } from './_shared/webhook-registry'
+import { create as adminDataCreate } from './admin-data'
 
-interface IntegrationContext {
+interface InboundAdapterContext {
+  payload: any
   integration: any
-  principal: any
-  requestPath: string
-  method: string
+  apiKey: any
+  accountId: string | null
+  appId: string | null
+  event: string | null
   headers: Record<string, string>
-  body: any
-  query: Record<string, string>
-  requestId: string
+  logger: { info: (msg: string, meta?: any) => void; warn: (msg: string, meta?: any) => void; error: (msg: string, meta?: any) => void }
 }
 
-interface ValidationResult {
-  valid: boolean
-  errors: string[]
-  unknownFields: string[]
+interface AdapterResult {
+  type_slug: string
+  data: Record<string, any>
+  title?: string
+  status?: string
+  thread?: any
+  links?: any[]
+  external_id?: string
+  error?: string
+  retryable?: boolean
 }
 
-interface IntegrationHandler {
-  (ctx: IntegrationContext): Promise<any>
+function getClientIp(event: any): string {
+  return event.headers?.['x-forwarded-for'] || event.headers?.['X-Forwarded-For'] || 'unknown'
 }
 
-// ─── INTEGRATION RESOLUTION ────────────────────────────────────────────────
-
-/**
- * Resolves integration by slug and validates it's active and configured
- */
-async function resolveIntegration(slug: string, type: string): Promise<any> {
-  const { data, error } = await adminDb
-    .from('integrations')
-    .select('*')
-    .eq('name', slug)
-    .eq('integration_type', type)
-    .eq('is_active', true)
-    .single()
-
-  if (error || !data) {
-    throw new Error(`Integration not found: ${type}/${slug}`)
-  }
-
-  if (!data.is_configured) {
-    throw new Error(`Integration not configured: ${type}/${slug}`)
-  }
-
-  return data
+function computeNextAttempt(attemptCount: number, baseMs = 30000, maxDelayMs = 3600000): Date {
+  const delay = Math.min(baseMs * Math.pow(2, attemptCount), maxDelayMs)
+  const jitter = Math.floor(Math.random() * delay * 0.2)
+  return new Date(Date.now() + delay + jitter)
 }
 
-// ─── VALIDATION & SANITIZATION ───────────────────────────────────────────
-
-/**
- * Validates data against schema definition
- * Returns validation result with any errors and unknown fields
- */
-function validateSchema(data: any, schema: any, requestId: string): ValidationResult {
-  const errors: string[] = []
-  const unknownFields: string[] = []
-  
-  if (!schema || typeof schema !== 'object') {
-    return { valid: true, errors: [], unknownFields: [] }
+function extractEvent(payload: any, eventHeader?: string | null, eventPath?: string | null): string | null {
+  if (eventHeader) {
+    const h = eventHeader.toLowerCase()
+    return eventHeader
   }
-  
-  // Check for unknown fields
-  const allowedFields = Object.keys(schema)
-  for (const field of Object.keys(data)) {
-    if (!allowedFields.includes(field)) {
-      unknownFields.push(field)
+  if (eventPath) {
+    const parts = eventPath.split('.')
+    let current = payload
+    for (const p of parts) {
+      if (current == null) return null
+      current = current[p]
     }
+    return current || null
   }
-  
-  // Validate each field against schema
-  for (const [fieldName, fieldConfig] of Object.entries(schema)) {
-    const config = fieldConfig as any
-    const value = data[fieldName]
-    
-    // Check required fields
-    if (config.required && (value === undefined || value === null || value === '')) {
-      errors.push(`Field '${fieldName}' is required but missing`)
-      continue
-    }
-    
-    // Skip further validation if field is not required and not present
-    if (!config.required && (value === undefined || value === null)) {
-      continue
-    }
-    
-    // Validate data type
-    if (config.type) {
-      const typeValid = validateType(value, config.type, fieldName)
-      if (!typeValid.valid) {
-        errors.push(typeValid.error)
-      }
-    }
-    
-    // Validate constraints
-    if (config.min !== undefined && typeof value === 'number' && value < config.min) {
-      errors.push(`Field '${fieldName}' must be at least ${config.min}`)
-    }
-    
-    if (config.max !== undefined && typeof value === 'number' && value > config.max) {
-      errors.push(`Field '${fieldName}' must be at most ${config.max}`)
-    }
-    
-    if (config.maxLength !== undefined && typeof value === 'string' && value.length > config.maxLength) {
-      errors.push(`Field '${fieldName}' must be at most ${config.maxLength} characters`)
-    }
-    
-    if (config.pattern && typeof value === 'string') {
-      const regex = new RegExp(config.pattern)
-      if (!regex.test(value)) {
-        errors.push(`Field '${fieldName}' does not match required pattern`)
-      }
-    }
-  }
-  
-  return {
-    valid: errors.length === 0 && unknownFields.length === 0,
-    errors,
-    unknownFields
-  }
+  return null
 }
 
-/**
- * Validates a value against a type definition
- */
-function validateType(value: any, type: string, fieldName: string): { valid: boolean; error?: string } {
-  switch (type) {
-    case 'string':
-      if (typeof value !== 'string') {
-        return { valid: false, error: `Field '${fieldName}' must be a string` }
-      }
-      break
-    case 'number':
-      if (typeof value !== 'number' || isNaN(value)) {
-        return { valid: false, error: `Field '${fieldName}' must be a number` }
-      }
-      break
-    case 'boolean':
-      if (typeof value !== 'boolean') {
-        return { valid: false, error: `Field '${fieldName}' must be a boolean` }
-      }
-      break
-    case 'email':
-      if (typeof value !== 'string' || !value.includes('@')) {
-        return { valid: false, error: `Field '${fieldName}' must be a valid email` }
-      }
-      break
-    case 'array':
-      if (!Array.isArray(value)) {
-        return { valid: false, error: `Field '${fieldName}' must be an array` }
-      }
-      break
-    case 'object':
-      if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        return { valid: false, error: `Field '${fieldName}' must be an object` }
-      }
-      break
+export async function execute(ctx: CoreContext, body: any = {}): Promise<any> {
+  const slug = ctx.query?.slug || body?.slug
+
+  if (!slug) {
+    const e: any = new Error('Integration slug is required')
+    e.statusCode = 400
+    throw e
   }
-  
-  return { valid: true }
-}
 
-/**
- * Sanitizes data to prevent injection attacks
- */
-function sanitizeData(data: any, rules: string = 'strict'): any {
-  if (data === null || data === undefined) {
-    return data
+  const apiKeyId = ctx.principal?.id
+  if (!apiKeyId) {
+    const e: any = new Error('Machine principal required')
+    e.statusCode = 401
+    throw e
   }
-  
-  if (typeof data === 'string') {
-    // Remove HTML tags
-    let sanitized = data.replace(/<[^>]*>/g, '')
-    // Escape special characters
-    sanitized = sanitized
-      .replace(/&/g, '&amp;')
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;')
-      .replace(/"/g, '&quot;')
-      .replace(/'/g, '&#x27;')
-    // Normalize whitespace
-    sanitized = sanitized.trim().replace(/\s+/g, ' ')
-    return sanitized
+
+  const { data: apiKey, error: apiKeyError } = await adminDb
+    .from('api_keys')
+    .select('*')
+    .eq('id', apiKeyId)
+    .single()
+
+  if (apiKeyError || !apiKey) {
+    const e: any = new Error('Invalid API key')
+    e.statusCode = 401
+    throw e
   }
-  
-  if (Array.isArray(data)) {
-    return data.map(item => sanitizeData(item, rules))
+
+  const { data: integration, error: integrationError } = await adminDb
+    .from('integrations')
+    .select('*')
+    .eq('slug', slug)
+    .eq('account_id', apiKey.account_id)
+    .eq('is_active', true)
+    .single()
+
+  if (integrationError || !integration) {
+    const e: any = new Error(`Integration not found: ${slug}`)
+    e.statusCode = 404
+    throw e
   }
-  
-  if (typeof data === 'object') {
-    const result: any = {}
-    const BLOCKED_KEYS = ['__proto__', 'constructor', 'prototype']
-    for (const [key, value] of Object.entries(data)) {
-      if (BLOCKED_KEYS.includes(key)) continue
-      // Sanitize keys (prevent prototype pollution, allow hyphens)
-      const sanitizedKey = key.replace(/[^a-zA-Z0-9_-]/g, '')
-      if (!sanitizedKey) continue
-      result[sanitizedKey] = sanitizeData(value, rules)
-    }
-    return result
+
+  if (apiKey.integration_id && apiKey.integration_id !== integration.id) {
+    const e: any = new Error('API key is not authorized for this integration')
+    e.statusCode = 403
+    throw e
   }
-  
-  return data
-}
 
-// ─── CUSTOM SCRIPT LOADER ────────────────────────────────────────────────
-
-/**
- * Loads a custom handler from the dynamic webhook registry.
- *
- * Handlers are registered in the `webhook_handlers` table at runtime,
- * allowing custom functions to self-register without core code changes.
- *
- * @param handlerName - The handler key from integration config (e.g. "webhook-handler")
- */
-async function loadCustomScript(handlerName: string): Promise<Function | null> {
-  return resolveHandler(handlerName)
-}
+  if (apiKey.app_id && integration.app_id && apiKey.app_id !== integration.app_id) {
+    const e: any = new Error('API key is not authorized for this app')
+    e.statusCode = 403
+    throw e
+  }
 
-// ─── DIAGNOSTIC HANDLER (temporary — full trace in response) ──────────────
-
-/**
- * Integration router with full diagnostic tracing.
- * Every step logs to a trace[] array that is returned in the response body.
- * REMOVE THIS DIAGNOSTIC MODE before production.
- */
-const integrationHandler = async (event: any, _context: any) => {
-  const requestId = crypto.randomUUID()
-  const trace: { step: string; status: string; detail?: any }[] = []
-
-  // ── Step 0: Can an external service hit the endpoint? ───────────────
-  trace.push({
-    step: '0_endpoint_reached',
-    status: 'PASS',
-    detail: {
-      method: event.httpMethod,
-      path: event.path,
-      queryParams: event.queryStringParameters,
-      hasBody: !!event.body,
-      timestamp: new Date().toISOString()
-    }
-  })
+  const event = extractEvent(
+    body,
+    (ctx as any).headers?.['x-event-type'] || (ctx as any).headers?.['X-Event-Type'],
+    integration.config?.event_path
+  )
 
-  // Method check
-  if ((event.httpMethod || 'GET') !== 'POST') {
-    trace.push({ step: '0_method_check', status: 'FAIL', detail: `Expected POST, got ${event.httpMethod}` })
-    return respond(405, { status: 'rejected', trace })
-  }
-  trace.push({ step: '0_method_check', status: 'PASS' })
+  const handlerName = integration.config?.handler_name || integration.provider || 'generic-webhook'
+  const adapter = await resolveHandler(handlerName, integration.app_id, integration.account_id)
 
-  // Slug check
-  const integrationSlug = event.queryStringParameters?.slug
-  if (!integrationSlug) {
-    trace.push({ step: '0_slug_check', status: 'FAIL', detail: 'No ?slug= query param' })
-    return respond(400, { status: 'rejected', trace })
+  if (!adapter) {
+    const e: any = new Error(`Handler not found: ${handlerName}`)
+    e.statusCode = 404
+    throw e
   }
-  trace.push({ step: '0_slug_check', status: 'PASS', detail: { slug: integrationSlug } })
-
-  // ── Step 1: Does the endpoint see the API key header? ───────────────
-  const apiKeyRaw = event.headers?.['x-api-key'] || event.headers?.['X-Api-Key'] || null
-  trace.push({
-    step: '1_header_extraction',
-    status: apiKeyRaw ? 'PASS' : 'FAIL',
-    detail: {
-      'x-api-key_present': !!apiKeyRaw,
-      'x-api-key_prefix': apiKeyRaw ? apiKeyRaw.substring(0, 6) + '...' : null,
-      all_header_keys: Object.keys(event.headers || {})
-    }
-  })
-  if (!apiKeyRaw) {
-    return respond(401, { status: 'rejected', trace })
+
+  const deliveryPayload = {
+    direction: 'inbound',
+    integration_id: integration.id,
+    api_key_id: apiKey.id,
+    handler_name: handlerName,
+    external_id: body?.id || null,
+    payload: body,
+    status: 'pending',
+    attempt_count: 0,
+    max_attempts: integration.config?.retry_policy?.max_attempts ?? 3,
+    next_attempt_at: null,
+    account_id: integration.account_id,
+    created_at: new Date().toISOString(),
+    updated_at: new Date().toISOString()
   }
 
-  // ── Step 2: Does resolvePrincipal validate the key? ─────────────────
-  let principal: any
-  try {
-    principal = await resolvePrincipal(event)
-    const isAnon = !principal || principal.id === 'anonymous'
-    trace.push({
-      step: '2_api_key_validation',
-      status: isAnon ? 'FAIL' : 'PASS',
-      detail: {
-        principal_id: principal?.id,
-        principal_type: principal?.type,
-        account_id: principal?.accountId,
-        scopes: principal?.scopes,
-        machine_type: principal?.machineType,
-        is_internal: principal?.isInternal
-      }
-    })
-    if (isAnon) {
-      return respond(401, { status: 'rejected', trace })
-    }
-  } catch (err: any) {
-    trace.push({
-      step: '2_api_key_validation',
-      status: 'ERROR',
-      detail: { message: err.message, stack: err.stack?.split('\n').slice(0, 3) }
-    })
-    return respond(401, { status: 'rejected', trace })
+  const { data: deliveryRow, error: deliveryInsertError } = await adminDb
+    .from('webhook_deliveries')
+    .insert(deliveryPayload)
+    .select('id')
+    .single()
+
+  if (deliveryInsertError || !deliveryRow) {
+    throw new Error('Failed to create inbound delivery record')
   }
 
-  // ── Step 3: Permission check ────────────────────────────────────────
-  const permViaIntegrations = (principal as any).permissions?.integrations?.[integrationSlug]
-  const permViaScopes = principal.scopes?.includes('webhook:execute')
-  const hasPermission = !!permViaIntegrations?.includes?.('execute') || !!permViaScopes
-  trace.push({
-    step: '3_permission_check',
-    status: hasPermission ? 'PASS' : 'FAIL',
-    detail: {
-      checked_permissions_path: `principal.permissions.integrations.${integrationSlug}`,
-      permissions_value: permViaIntegrations ?? 'undefined (property does not exist)',
-      checked_scopes: 'webhook:execute',
-      scopes_value: principal.scopes,
-      scopes_match: permViaScopes,
-      final_result: hasPermission
-    }
+  const deliveryId = deliveryRow.id
+
+  await emitLog(ctx, 'integration.inbound.started', { type: 'integration', id: integration.id }, undefined, {
+    delivery_id: deliveryId,
+    integration_id: integration.id,
+    api_key_id: apiKey.id,
+    account_id: integration.account_id,
+    event
   })
-  if (!hasPermission) {
-    return respond(403, { status: 'rejected', trace })
+
+  const logger = {
+    info: (msg: string, meta?: any) => console.log(`[integration-routes] ${msg}`, meta),
+    warn: (msg: string, meta?: any) => console.warn(`[integration-routes] ${msg}`, meta),
+    error: (msg: string, meta?: any) => console.error(`[integration-routes] ${msg}`, meta)
   }
 
-  // ── Step 4: Resolve integration record ──────────────────────────────
-  let integration: any
-  try {
-    integration = await resolveIntegration(integrationSlug, 'webhook')
-    trace.push({
-      step: '4_integration_resolution',
-      status: 'PASS',
-      detail: {
-        id: integration.id,
-        name: integration.name,
-        type: integration.integration_type,
-        is_active: integration.is_active,
-        is_configured: integration.is_configured,
-        has_config: !!integration.config,
-        config_keys: integration.config ? Object.keys(integration.config) : []
-      }
-    })
-  } catch (err: any) {
-    trace.push({
-      step: '4_integration_resolution',
-      status: 'ERROR',
-      detail: { message: err.message }
-    })
-    return respond(500, { status: 'rejected', trace })
+  const adapterCtx: InboundAdapterContext = {
+    payload: body,
+    integration,
+    apiKey,
+    accountId: integration.account_id,
+    appId: integration.app_id,
+    event,
+    headers: (ctx as any).headers || {},
+    logger
   }
 
-  // ── Step 5: Parse request body ──────────────────────────────────────
-  let body: any = {}
   try {
-    body = event.body ? JSON.parse(event.body) : {}
-    trace.push({
-      step: '5_body_parse',
-      status: 'PASS',
-      detail: { parsed_keys: Object.keys(body), parsed_body: body }
-    })
-  } catch (e: any) {
-    body = { raw: event.body }
-    trace.push({
-      step: '5_body_parse',
-      status: 'WARN',
-      detail: { message: 'Not valid JSON, wrapped as { raw: ... }', raw_length: event.body?.length }
-    })
-  }
+    const adapterResult: AdapterResult = await adapter(adapterCtx.payload, adapterCtx)
+
+    if (adapterResult.error) {
+      const status = adapterResult.retryable ? 'pending' : 'failed'
+      const nextAttempt = adapterResult.retryable ? computeNextAttempt(1).toISOString() : null
+
+      await adminDb
+        .from('webhook_deliveries')
+        .update({
+          status,
+          attempt_count: 1,
+          next_attempt_at: nextAttempt,
+          last_error: adapterResult.error,
+          updated_at: new Date().toISOString()
+        })
+        .eq('id', deliveryId)
+
+      await emitLog(ctx, adapterResult.retryable ? 'integration.inbound.adapter_retryable' : 'integration.inbound.adapter_failed', { type: 'integration', id: integration.id }, undefined, {
+        delivery_id: deliveryId,
+        error: adapterResult.error,
+        account_id: integration.account_id
+      })
+
+      throw new Error(adapterResult.error)
+    }
 
-  // ── Step 6: Schema validation ───────────────────────────────────────
-  const config = integration.config || {}
-  if (config.validation?.schema) {
-    const validation = validateSchema(body, config.validation.schema, requestId)
-    trace.push({
-      step: '6_schema_validation',
-      status: validation.valid ? 'PASS' : 'FAIL',
-      detail: {
-        schema_fields: Object.keys(config.validation.schema),
-        body_fields: Object.keys(body),
-        errors: validation.errors,
-        unknown_fields: validation.unknownFields,
-        reject_unknown: config.validation.rejectUnknownFields
+    if (!adapterResult.type_slug) {
+      throw new Error('Adapter result is missing type_slug')
+    }
+
+    const adminCtx: any = {
+      ...ctx,
+      db: adminDb,
+      accountId: integration.account_id,
+      principal: {
+        ...ctx.principal,
+        id: null,
+        accountId: integration.account_id
       }
-    })
-    if (!validation.valid) {
-      return respond(400, { status: 'rejected', trace })
     }
-  } else {
-    trace.push({ step: '6_schema_validation', status: 'SKIP', detail: 'No validation.schema in config' })
-  }
 
-  // ── Step 7: Sanitize data ───────────────────────────────────────────
-  const sanitizedData = sanitizeData(body, config.validation?.sanitization || 'strict')
-  trace.push({
-    step: '7_sanitization',
-    status: 'PASS',
-    detail: {
-      input_keys: Object.keys(body),
-      output_keys: Object.keys(sanitizedData),
-      sanitized_data: sanitizedData,
-      note: 'Key sanitizer strips non-alphanumeric/underscore chars (hyphens removed)'
+    const createBody: any = {
+      entity: 'items',
+      type_slug: adapterResult.type_slug,
+      title: adapterResult.title,
+      status: adapterResult.status,
+      data: adapterResult.data
     }
-  })
 
-  // ── Step 8: Locate custom handler ───────────────────────────────────
-  if (!config.handler?.path) {
-    trace.push({ step: '8_handler_lookup', status: 'SKIP', detail: 'No handler.path in config' })
-    return respond(200, { status: 'success', trace, result: sanitizedData })
-  }
+    const record = await adminDataCreate(adminCtx, createBody)
 
-  const scriptHandler = await loadCustomScript(config.handler.path)
-  const registeredHandlers = await listRegisteredHandlers()
-  trace.push({
-    step: '8_handler_lookup',
-    status: scriptHandler ? 'PASS' : 'FAIL',
-    detail: {
-      handler_key: config.handler.path,
-      found_in_registry: !!scriptHandler,
-      registered_handlers: registeredHandlers,
-      note: 'Dynamic registry - handlers self-register via webhook_handlers table'
+    if (adapterResult.thread) {
+      // TODO: create thread via admin-data if needed
     }
-  })
-  if (!scriptHandler) {
-    return respond(500, { status: 'rejected', trace })
-  }
 
-  // ── Step 9: Prepare handler arguments ───────────────────────────────
-  const scriptContext = {
-    integrationId: integration.id,
-    accountId: integration.account_id,
-    slug: config.slug || integration.name,
-    principal: { id: principal.id, type: principal.type, accountId: principal.accountId },
-    requestId,
-    headers: event.headers || {}
-  }
-  const scriptEvent = {
-    httpMethod: event.httpMethod,
-    headers: event.headers || {},
-    body: body,
-    path: event.path,
-    queryStringParameters: event.queryStringParameters || {}
-  }
-  trace.push({
-    step: '9_handler_args',
-    status: 'PASS',
-    detail: {
-      arg1_sanitized_data: sanitizedData,
-      arg2_context_keys: Object.keys(scriptContext),
-      arg3_event_keys: Object.keys(scriptEvent)
+    if (adapterResult.links?.length) {
+      // TODO: create links via admin-data if needed
     }
-  })
 
-  // ── Step 10: Execute handler ────────────────────────────────────────
-  try {
-    const result = await scriptHandler(sanitizedData, scriptContext, scriptEvent)
-    trace.push({
-      step: '10_handler_execution',
-      status: 'PASS',
-      detail: { result_type: typeof result, result }
+    await adminDb
+      .from('webhook_deliveries')
+      .update({
+        status: 'delivered',
+        attempt_count: 1,
+        next_attempt_at: null,
+        response_status: 200,
+        updated_at: new Date().toISOString()
+      })
+      .eq('id', deliveryId)
+
+    await emitLog(ctx, 'integration.inbound.delivered', { type: 'integration', id: integration.id }, undefined, {
+      delivery_id: deliveryId,
+      record_id: record?.id,
+      account_id: integration.account_id
     })
-    return respond(200, { status: 'success', trace, result })
+
+    return record
   } catch (err: any) {
-    trace.push({
-      step: '10_handler_execution',
-      status: 'ERROR',
-      detail: { message: err.message, stack: err.stack?.split('\n').slice(0, 5) }
+    await adminDb
+      .from('webhook_deliveries')
+      .update({
+        status: 'pending',
+        attempt_count: 1,
+        next_attempt_at: computeNextAttempt(1).toISOString(),
+        last_error: err.message || String(err),
+        updated_at: new Date().toISOString()
+      })
+      .eq('id', deliveryId)
+
+    await emitLog(ctx, 'integration.inbound.error', { type: 'integration', id: integration.id }, undefined, {
+      delivery_id: deliveryId,
+      error: err.message || String(err),
+      account_id: integration.account_id
     })
-    return respond(500, { status: 'rejected', trace })
-  }
-}
-
-// ─── HELPERS ──────────────────────────────────────────────────────────────
 
-function respond(statusCode: number, body: any) {
-  return {
-    statusCode,
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body, null, 2)
+    throw err
   }
 }
 
-// ─── EXPORTS ─────────────────────────────────────────────────────────────
+export default createPublicHandler(execute)
 
-const handler = integrationHandler
-export { handler }
+// CIL[END chunk_id="integration_routes_module_header_1784200006"]