tapimo 0.0.2 → 0.2.0

package/src/internal/Webhooks.ts

@@ -1,10 +1,12 @@
 import { nanoid } from 'nanoid'
 import { Hash, Hex } from 'ox'
 
-import type * as app_Webhooks from '../apps/webhooks.js'
+import type * as app_Webhooks from '../apps/data/routes/webhooks.js'
+import type * as Db from '../db/Db.js'
+import * as WebhookDeliveries from '../db/tables/webhookDeliveries.js'
+import * as WebhookSubscriptions from '../db/tables/webhookSubscriptions.js'
 import type * as Metrics from '../Metrics.js'
 import * as MetricSink from './MetricSink.js'
-import * as Store from './Store.js'
 import * as WebhookDestination from './WebhookDestination.js'
 
 // The destination layer lives in `./WebhookDestination.js`. Re-export only the
@@ -159,22 +161,24 @@ export type Delivery = {
 
 /**
  * Creates a subscription, validating its URL and (optionally) enforcing a
- * per-owner cap, then persists it and indexes it for the poller.
+ * per-owner cap, then persists it. The cap check stays best-effort (count then
+ * insert, non-transactional) — parity with the old store behavior.
  */
 export async function createSubscription(
-  store: Store.State,
+  db: Db.Db,
   input: CreateInput,
   options: createSubscription.Options = {},
 ): Promise<Subscription> {
   WebhookDestination.assertDestination(input.destination)
 
+  const now = (options.now ?? (() => new Date()))()
+  const iso = now.toISOString()
+
   if (options.maxPerOwner !== undefined) {
-    const existing = await listSubscriptions(store, input.owner)
-    if (existing.length >= options.maxPerOwner) throw new LimitExceededError(options.maxPerOwner)
+    const existing = await WebhookSubscriptions.count(db, input.owner, iso)
+    if (existing >= options.maxPerOwner) throw new LimitExceededError(options.maxPerOwner)
   }
 
-  const now = (options.now ?? (() => new Date()))()
-  const iso = now.toISOString()
   const subscription: Subscription = {
     chainId: input.chainId,
     ...(input.context === undefined ? {} : { context: input.context }),
@@ -193,7 +197,7 @@ export async function createSubscription(
       : { expiresAt: new Date(now.getTime() + input.ttl).toISOString() }),
   }
 
-  await writeSubscription(store, subscription)
+  await WebhookSubscriptions.insert(db, subscription)
   return subscription
 }
 
@@ -209,39 +213,23 @@ export declare namespace createSubscription {
 
 /** Reads a single subscription scoped to its owner. Returns null when absent. */
 export async function getSubscription(
-  store: Store.State,
+  db: Db.Db,
   owner: Owner,
   id: string,
 ): Promise<Subscription | null> {
-  return readSubscription(store, subscriptionKey(owner, id))
+  return WebhookSubscriptions.get(db, owner, id, new Date().toISOString())
 }
 
 /**
  * Lists an owner's subscriptions, newest first, with optional keyset paging.
- * Subscription ids embed a timestamp, so lexical key order is chronological.
+ * Subscription ids embed a timestamp, so lexical id order is chronological.
  */
 export async function listSubscriptions(
-  store: Store.State,
+  db: Db.Db,
   owner: Owner,
   options: listSubscriptions.Options = {},
 ): Promise<Subscription[]> {
-  const prefix = subscriptionPrefix(owner)
-  const { keys } = await store.list({ prefix })
-
-  // Newest first: ids sort chronologically ascending, so reverse for descending.
-  let names = keys
-    .map((key) => key.name)
-    .sort()
-    .reverse()
-  if (options.cursor) names = names.filter((name) => name < `${prefix}${options.cursor}`)
-  if (options.offset) names = names.slice(options.offset)
-  if (options.limit !== undefined) names = names.slice(0, options.limit)
-
-  // Hydrate the page in parallel: the reads are independent, and a serial
-  // loop costs one store round trip per row (an N+1 against the production
-  // Durable Object).
-  const subscriptions = await Promise.all(names.map((name) => readSubscription(store, name)))
-  return subscriptions.filter((subscription) => subscription !== null)
+  return WebhookSubscriptions.list(db, owner, { ...options, now: new Date().toISOString() })
 }
 
 export declare namespace listSubscriptions {
@@ -257,47 +245,41 @@ export declare namespace listSubscriptions {
 }
 
 /**
- * Counts an owner's subscriptions. Reads only the key set under the owner
- * prefix (no row hydration), so it's a single store `list` — exact and cheap,
+ * Counts an owner's subscriptions — a single indexed count, exact and cheap,
  * since the per-owner set is bounded by `maxPerOwner`. Feeds the opt-in
  * `meta.totalCount` on `GET /webhooks`.
  */
-export async function countSubscriptions(store: Store.State, owner: Owner): Promise<number> {
-  const { keys } = await store.list({ prefix: subscriptionPrefix(owner) })
-  return keys.length
+export async function countSubscriptions(db: Db.Db, owner: Owner): Promise<number> {
+  return WebhookSubscriptions.count(db, owner, new Date().toISOString())
 }
 
 /**
- * Patches an owner's subscription, re-validating the URL when changed and
- * re-indexing for the poller when the status changes. Returns null when absent.
+ * Patches an owner's subscription, re-validating the URL when changed.
+ * Returns null when absent. The status column drives the poller's partial
+ * index, so no secondary-index maintenance is needed.
  */
 export async function updateSubscription(
-  store: Store.State,
+  db: Db.Db,
   owner: Owner,
   id: string,
   patch: PatchInput,
   options: updateSubscription.Options = {},
 ): Promise<Subscription | null> {
-  const current = await getSubscription(store, owner, id)
+  const current = await getSubscription(db, owner, id)
   if (!current) return null
 
   if (patch.destination !== undefined) WebhookDestination.assertDestination(patch.destination)
 
   const now = (options.now ?? (() => new Date()))()
-  const next: Subscription = {
-    ...current,
-    // `context: null` clears it (stored as undefined; drops from JSON + reads).
-    ...(patch.context === undefined
-      ? {}
-      : { context: patch.context === null ? undefined : patch.context }),
+  const next = await WebhookSubscriptions.update(db, id, {
+    // `context: null` clears it (stored as a null column; drops from reads).
+    ...(patch.context === undefined ? {} : { context: patch.context }),
     ...(patch.destination === undefined ? {} : { destination: patch.destination }),
     ...(patch.filters === undefined ? {} : { filters: patch.filters }),
     ...(patch.status === undefined ? {} : { status: patch.status }),
     updatedAt: now.toISOString(),
-  }
-
-  await writeSubscription(store, next)
-  return next
+  })
+  return next ?? null
 }
 
 export declare namespace updateSubscription {
@@ -308,61 +290,51 @@ export declare namespace updateSubscription {
   }
 }
 
-/** Deletes an owner's subscription and its index/cursor keys. */
-export async function deleteSubscription(
-  store: Store.State,
-  owner: Owner,
-  id: string,
-): Promise<boolean> {
-  const current = await getSubscription(store, owner, id)
-  if (!current) return false
-
-  await store.delete(subscriptionKey(owner, id))
-  await store.delete(activeKey(current.chainId, current.eventType, id))
-  await store.delete(cursorKey(id))
-
-  // Drop the delivery log so a deleted subscription leaves no orphaned rows.
-  const { keys } = await store.list({ prefix: deliveryPrefix(id) })
-  for (const { name } of keys) await store.delete(name)
-  return true
+/** Deletes an owner's subscription; its delivery rows cascade via the FK. */
+export async function deleteSubscription(db: Db.Db, owner: Owner, id: string): Promise<boolean> {
+  return WebhookSubscriptions.remove(db, owner, id, new Date().toISOString())
 }
 
 /**
  * Lists active subscriptions for a `(chainId, eventType)` stream. Used by the
- * poller; reads the secondary index, then hydrates each subscription.
+ * poller; one indexed query (the partial status index replaces the old
+ * secondary key space).
  */
 export async function listActive(
-  store: Store.State,
+  db: Db.Db,
   chainId: number,
   eventType: EventType,
 ): Promise<Subscription[]> {
-  const { keys } = await store.list({ prefix: activePrefix(chainId, eventType) })
-
-  const subscriptions: Subscription[] = []
-  for (const { name } of keys) {
-    const subKey = await store.get(name)
-    if (!subKey) continue
-    const subscription = await readSubscription(store, subKey)
-    if (subscription) subscriptions.push(subscription)
-  }
-  return subscriptions
+  return WebhookSubscriptions.listActive(db, chainId, eventType, new Date().toISOString())
 }
 
 /** Reads a subscription's keyset cursor. Returns null when unset. */
-export async function getCursor(
-  store: Store.State,
-  subscriptionId: string,
-): Promise<string | null> {
-  return store.get(cursorKey(subscriptionId))
+export async function getCursor(db: Db.Db, subscriptionId: string): Promise<string | null> {
+  return WebhookSubscriptions.getCursor(db, subscriptionId)
 }
 
 /** Writes a subscription's keyset cursor. */
-export async function setCursor(
-  store: Store.State,
-  subscriptionId: string,
-  cursor: string,
-): Promise<void> {
-  await store.put(cursorKey(subscriptionId), cursor)
+export async function setCursor(db: Db.Db, subscriptionId: string, cursor: string): Promise<void> {
+  await WebhookSubscriptions.setCursor(db, subscriptionId, cursor)
+}
+
+/**
+ * Deletes expired MPP-owned subscriptions (delivery rows cascade) and
+ * deliveries past retention. Reads already filter expiry at query time — this
+ * is the janitor reclaiming space, called best-effort per poller tick.
+ */
+export async function pruneExpired(db: Db.Db, options: pruneExpired.Options = {}): Promise<void> {
+  const iso = (options.now ?? (() => new Date()))().toISOString()
+  await WebhookDeliveries.pruneExpired(db, iso)
+  await WebhookSubscriptions.pruneExpired(db, iso)
+}
+
+export declare namespace pruneExpired {
+  /** Options for {@link pruneExpired}. */
+  type Options = {
+    /** Clock used for expiry evaluation; injectable for tests. */
+    now?: (() => Date) | undefined
+  }
 }
 
 /**
@@ -373,14 +345,16 @@ export const deliveryRetentionMs = 7 * 24 * 60 * 60 * 1_000
 
 /** Records one delivery-log row (stateful, owner-agnostic; scoped per subscription). */
 export async function recordDelivery(
-  store: Store.State,
+  db: Db.Db,
   delivery: Delivery,
   options: recordDelivery.Options = {},
 ): Promise<void> {
   const ttl = options.ttl ?? deliveryRetentionMs
-  await store.put(deliveryKey(delivery.subscriptionId, delivery.id), JSON.stringify(delivery), {
-    ttl,
-  })
+  // The retention deadline replaces the old store TTL: reads filter on it at
+  // query time and the poller prunes past it. Anchored to write time (not the
+  // row's `createdAt`, which tests pin) — exactly like the old `put` TTL.
+  const expiresAt = new Date(Date.now() + ttl).toISOString()
+  await WebhookDeliveries.insert(db, delivery, expiresAt)
 }
 
 export declare namespace recordDelivery {
@@ -396,27 +370,11 @@ export declare namespace recordDelivery {
  * paging. Delivery ids embed a timestamp, so lexical key order is chronological.
  */
 export async function listDeliveries(
-  store: Store.State,
+  db: Db.Db,
   subscriptionId: string,
   options: listDeliveries.Options = {},
 ): Promise<Delivery[]> {
-  const prefix = deliveryPrefix(subscriptionId)
-  const { keys } = await store.list({ prefix })
-
-  // Newest first: ids sort chronologically ascending, so reverse for descending.
-  let names = keys
-    .map((key) => key.name)
-    .sort()
-    .reverse()
-  if (options.cursor) names = names.filter((name) => name < `${prefix}${options.cursor}`)
-  if (options.offset) names = names.slice(options.offset)
-  if (options.limit !== undefined) names = names.slice(0, options.limit)
-
-  // Hydrate the page in parallel: the reads are independent, and a serial
-  // loop costs one store round trip per row (an N+1 against the production
-  // Durable Object).
-  const deliveries = await Promise.all(names.map((name) => readDelivery(store, name)))
-  return deliveries.filter((delivery) => delivery !== null)
+  return WebhookDeliveries.list(db, subscriptionId, { ...options, now: new Date().toISOString() })
 }
 
 export declare namespace listDeliveries {
@@ -432,23 +390,21 @@ export declare namespace listDeliveries {
 }
 
 /**
- * Counts a subscription's delivery-log entries. Reads only the key set under
- * the delivery prefix (no row hydration), so it's a single store `list` —
- * exact, and bounded by the delivery retention TTL. Feeds the opt-in
+ * Counts a subscription's delivery-log entries — a single indexed count,
+ * exact, and bounded by the delivery retention window. Feeds the opt-in
  * `meta.totalCount` on `GET /webhooks/:id/deliveries`.
  */
-export async function countDeliveries(store: Store.State, subscriptionId: string): Promise<number> {
-  const { keys } = await store.list({ prefix: deliveryPrefix(subscriptionId) })
-  return keys.length
+export async function countDeliveries(db: Db.Db, subscriptionId: string): Promise<number> {
+  return WebhookDeliveries.count(db, subscriptionId, new Date().toISOString())
 }
 
 /** Loads a single delivery-log row (`null` when absent), scoped to its subscription. */
 export async function getDelivery(
-  store: Store.State,
+  db: Db.Db,
   subscriptionId: string,
   deliveryId: string,
 ): Promise<Delivery | null> {
-  return readDelivery(store, deliveryKey(subscriptionId, deliveryId))
+  return WebhookDeliveries.get(db, subscriptionId, deliveryId, new Date().toISOString())
 }
 
 /**
@@ -459,23 +415,20 @@ export const maxFailures = 10
 
 /**
  * Records a successful delivery: resets the consecutive-failure counter and
- * stamps `lastDeliveryAt`. Returns the updated subscription (re-persisted so the
- * poller's active index and TTL stay correct).
+ * stamps `lastDeliveryAt`. A column-targeted update, so a concurrent patch is
+ * never clobbered by the stale copy carried through the delivery queue.
  */
 export async function recordSuccess(
-  store: Store.State,
+  db: Db.Db,
   subscription: Subscription,
   options: recordSuccess.Options = {},
 ): Promise<Subscription> {
   const now = (options.now ?? (() => new Date()))()
-  const next: Subscription = {
-    ...subscription,
-    failureCount: 0,
-    lastDeliveryAt: now.toISOString(),
-    updatedAt: now.toISOString(),
-  }
-  await writeSubscription(store, next)
-  return next
+  const iso = now.toISOString()
+  const next = await WebhookSubscriptions.recordSuccess(db, subscription.id, iso)
+  // A concurrently deleted subscription is not resurrected; return the
+  // optimistic next state so the caller still observes the outcome.
+  return next ?? { ...subscription, failureCount: 0, lastDeliveryAt: iso, updatedAt: iso }
 }
 
 export declare namespace recordSuccess {
@@ -487,27 +440,30 @@ export declare namespace recordSuccess {
 }
 
 /**
- * Records a failed delivery: increments the consecutive-failure counter and,
- * once it reaches `maxFailures`, sets `status: 'disabled'` so the subscription
- * drops out of the poller's active index (surfaced via the API). Returns the
- * updated subscription.
+ * Records a failed delivery: atomically increments the consecutive-failure
+ * counter and, once it reaches `maxFailures`, sets `status: 'disabled'` so the
+ * subscription drops out of the poller's partial index (surfaced via the API).
+ * Returns the updated subscription.
  */
 export async function recordFailure(
-  store: Store.State,
+  db: Db.Db,
   subscription: Subscription,
   options: recordFailure.Options = {},
 ): Promise<Subscription> {
   const now = (options.now ?? (() => new Date()))()
+  const iso = now.toISOString()
+  const max = options.maxFailures ?? maxFailures
+  const next = await WebhookSubscriptions.recordFailure(db, subscription.id, max, iso)
+  if (next) return next
+  // A concurrently deleted subscription is not resurrected; return the
+  // optimistic next state so the caller still observes the outcome.
   const failureCount = subscription.failureCount + 1
-  const disabled = failureCount >= (options.maxFailures ?? maxFailures)
-  const next: Subscription = {
+  return {
     ...subscription,
     failureCount,
-    ...(disabled ? { status: 'disabled' } : {}),
-    updatedAt: now.toISOString(),
+    ...(failureCount >= max ? { status: 'disabled' as const } : {}),
+    updatedAt: iso,
   }
-  await writeSubscription(store, next)
-  return next
 }
 
 export declare namespace recordFailure {
@@ -527,7 +483,7 @@ export declare namespace recordFailure {
  * point shared by the Cloudflare Queue consumer and the self-host inline path.
  */
 export async function deliverAndRecord(
-  store: Store.State,
+  db: Db.Db,
   subscription: Subscription,
   envelope: Envelope,
   options: deliverAndRecord.Options = {},
@@ -540,8 +496,8 @@ export async function deliverAndRecord(
     ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
     ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
   })
-  if (result.ok) await recordSuccess(store, subscription, options)
-  else await recordFailure(store, subscription, options)
+  if (result.ok) await recordSuccess(db, subscription, options)
+  else await recordFailure(db, subscription, options)
 
   // Emit a `webhook:delivery` metric. recordSuccess/recordFailure are immutable
   // (they spread into a new record), so `subscription.failureCount` here is still
@@ -563,7 +519,7 @@ export async function deliverAndRecord(
   // the delivery outcome the caller (Queue consumer / inline path) acts on.
   try {
     await recordDelivery(
-      store,
+      db,
       buildDelivery({ attempt, envelope, result, subscription }, options),
       options.deliveryRetentionMs === undefined ? {} : { ttl: options.deliveryRetentionMs },
     )
@@ -741,7 +697,7 @@ export declare namespace buildPingEnvelope {
  * delivery log.
  */
 export async function ping(
-  store: Store.State,
+  db: Db.Db,
   subscription: Subscription,
   options: ping.Options = {},
 ): Promise<ping.Result> {
@@ -761,7 +717,7 @@ export async function ping(
   const delivery = buildDelivery({ attempt: 1, envelope, result, subscription }, { now })
   try {
     await recordDelivery(
-      store,
+      db,
       delivery,
       options.deliveryRetentionMs === undefined ? {} : { ttl: options.deliveryRetentionMs },
     )
@@ -797,80 +753,6 @@ export declare namespace ping {
   }
 }
 
-function ownerKey(owner: Owner): string {
-  return owner.type === 'api_key'
-    ? `api_key:${encodeURIComponent(owner.orgId)}`
-    : `mpp:${encodeURIComponent(owner.payer)}`
-}
-
-function subscriptionPrefix(owner: Owner): string {
-  return `webhook:sub:${ownerKey(owner)}:`
-}
-
-function subscriptionKey(owner: Owner, id: string): string {
-  return `${subscriptionPrefix(owner)}${id}`
-}
-
-function cursorKey(subscriptionId: string): string {
-  return `webhook:cursor:${subscriptionId}`
-}
-
-function deliveryPrefix(subscriptionId: string): string {
-  return `webhook:delivery:${subscriptionId}:`
-}
-
-function deliveryKey(subscriptionId: string, deliveryId: string): string {
-  return `${deliveryPrefix(subscriptionId)}${deliveryId}`
-}
-
-function activePrefix(chainId: number, eventType: EventType): string {
-  return `webhook:active:${chainId}:${eventType}:`
-}
-
-function activeKey(chainId: number, eventType: EventType, id: string): string {
-  return `${activePrefix(chainId, eventType)}${id}`
-}
-
-async function readSubscription(store: Store.State, key: string): Promise<Subscription | null> {
-  const raw = await store.get(key)
-  if (!raw) return null
-  try {
-    return JSON.parse(raw) as Subscription
-  } catch {
-    // Corrupt entries are treated as absent.
-    return null
-  }
-}
-
-async function readDelivery(store: Store.State, key: string): Promise<Delivery | null> {
-  const raw = await store.get(key)
-  if (!raw) return null
-  try {
-    return JSON.parse(raw) as Delivery
-  } catch {
-    // Corrupt entries are treated as absent.
-    return null
-  }
-}
-
-async function writeSubscription(store: Store.State, subscription: Subscription): Promise<void> {
-  const ttl = ttlFor(subscription)
-  const key = subscriptionKey(subscription.owner, subscription.id)
-  await store.put(key, JSON.stringify(subscription), { ttl })
-
-  // Mirror status into the poller's secondary index: only `active`
-  // subscriptions are polled. The index value is the subscription's storage key
-  // so the poller can hydrate without knowing the owner.
-  const indexKey = activeKey(subscription.chainId, subscription.eventType, subscription.id)
-  if (subscription.status === 'active') await store.put(indexKey, key, { ttl })
-  else await store.delete(indexKey)
-}
-
-function ttlFor(subscription: Subscription): number | undefined {
-  if (!subscription.expiresAt) return undefined
-  return Math.max(1, new Date(subscription.expiresAt).getTime() - Date.now())
-}
-
 function generateId(now: Date): string {
   // Zero-pad the epoch-ms so ids sort chronologically by string comparison
   // (mirroring delivery ids), letting listSubscriptions page newest-first; 15