Anchorage API reference
    Preparing search index...

    Interface WebhookRouterOptions

    interface WebhookRouterOptions {
        audit?: SignalProviderAuditSink;
        basePath?: string;
        deploymentTag?: string;
        executionFence: ExecutionFenceWiring;
        forgeryAuditWindowMs?: number;
        maxBodyBytes?: number;
        maxForgeryAuditsPerWindow?: number;
        now?: () => number;
        providers: Record<string, SignalProviderAdapter>;
        rateLimit?: WebhookRateLimiter;
        secretForProvider: (providerId: string) => string | undefined;
        subscriptions: SubscriptionStore;
        topology: ThreadTopology;
    }
    Index

    Properties

    audit? basePath? deploymentTag? executionFence forgeryAuditWindowMs? maxBodyBytes? maxForgeryAuditsPerWindow? now? providers rateLimit? secretForProvider subscriptions topology

    Properties

    audit?: SignalProviderAuditSink

    Every ingest audited (accepted + rejected). Forgery audits are bounded (see below).

    basePath?: string

    Route prefix. Default '/api/signal-providers'.

    deploymentTag?: string

    Infrastructure-verified deployment tag for audit attribution.

    executionFence: ExecutionFenceWiring

    The deployment execution fence, consulted AFTER signature verification, or 'none' for a router with no database behind it. A locked deployment answers 503 so the provider redelivers rather than treating the event as accepted; putting the check before the verify would turn the fence into a free oracle for unauthenticated callers, and would spend the forgery-audit budget on requests the fence refused anyway.

    REQUIRED: an unfenced webhook route accepts a delivery a locked deployment cannot forward, and a provider that saw a 2xx does not redeliver — the event is then lost at the migration boundary. See ExecutionFenceWiring.

    forgeryAuditWindowMs?: number

    Positive safe-integer forgery-audit window in ms. Default 60000.

    maxBodyBytes?: number

    Max raw webhook body in bytes. Must be a nonnegative safe integer; zero denies every non-empty body. Default 1 MiB.

    maxForgeryAuditsPerWindow?: number

    Forgery audits per provider per window. Must be a nonnegative safe integer; zero disables forgery audit writes without accepting forgeries. Default 10.

    now?: () => number

    Epoch-ms clock for the forgery window, injectable for tests. Default Date.now.

    providers: Record<string, SignalProviderAdapter>

    Registered providers, keyed by id. Empty ⇒ every webhook is route-absent.

    rateLimit?: WebhookRateLimiter

    Per-provider deployment delivery rate cap. Absent means unmetered.

    secretForProvider: (providerId: string) => string | undefined

    Per-provider signing secret (from a binding/env). undefined ⇒ provider route absent.

    subscriptions: SubscriptionStore

    The deployment subscription store; matched rows are routing authority.

    topology: ThreadTopology

    The sanctioned reach into a thread DO.

    Settings

    Member Visibility

    On This Page

    Properties