feat: phase 4 integrations — connectors, rybbit analytics, webhooks

- core.integrations (migration 00005) with AES-256-GCM-encrypted
  credentials (PRIMORA_ENCRYPTION_KEY, hex/base64, dev fallback);
  has_credentials serialization only — secrets never leave the server
- /projects/:id/integrations list/create/delete/test; health check hits
  the stored base URL with a 5s timeout and records status
- Rybbit connector: GET …/integrations/:id/analytics proxies
  /api/organizations + /api/sites/* server-side into a normalized shape
- core.webhooks + core.webhook_deliveries; CRUD, deliveries, test, and
  POST …/deploy-markers. Events: issue.created (new fingerprint on
  ingest), deploy.marker, webhook.test. X-Primora-Signature HMAC-SHA256
  over the raw body; in-process dispatcher, 3 attempts, quadratic
  backoff, 10s timeout, pending-scan on boot
- HTTPS enforced for public targets; HTTP allowed for loopback/private/
  self-hosted sinks
- Integrations page (connectors + webhooks tabs, inline analytics,
  delivery log, secret-shown-once), demo-mode stubs
- 12 new primora_* MCP tools
- workspace 0.4.0

Authored By: TDvorak <[email protected]>

packages/api-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primora/api-client",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "type": "module",
   "main": "./src/index.ts",

packages/api-client/src/generated/index.ts

@@ -32,10 +32,13 @@ export { CreateBucketRequest } from './models/CreateBucketRequest';
 export type { CreateCollectionRequest } from './models/CreateCollectionRequest';
 export type { CreatedApiKey } from './models/CreatedApiKey';
 export { CreateDBConnectionRequest } from './models/CreateDBConnectionRequest';
+export type { CreateDeployMarkerRequest } from './models/CreateDeployMarkerRequest';
 export type { CreateDocumentRequest } from './models/CreateDocumentRequest';
+export { CreateIntegrationRequest } from './models/CreateIntegrationRequest';
 export { CreateInvitationRequest } from './models/CreateInvitationRequest';
 export type { CreateOrganizationRequest } from './models/CreateOrganizationRequest';
 export type { CreateProjectRequest } from './models/CreateProjectRequest';
+export type { CreateWebhookRequest } from './models/CreateWebhookRequest';
 export type { DatabaseQuery } from './models/DatabaseQuery';
 export type { DBConnection } from './models/DBConnection';
 export type { DBConnectionListResponse } from './models/DBConnectionListResponse';
@@ -53,6 +56,7 @@ export type { DBRedisResponse } from './models/DBRedisResponse';
 export type { DBSchemaContextResponse } from './models/DBSchemaContextResponse';
 export type { DBTableListResponse } from './models/DBTableListResponse';
 export type { DBXStatus } from './models/DBXStatus';
+export type { DeployMarker } from './models/DeployMarker';
 export type { Document } from './models/Document';
 export type { DocumentID } from './models/DocumentID';
 export type { DocumentListResponse } from './models/DocumentListResponse';
@@ -62,6 +66,11 @@ export type { HealthStatus } from './models/HealthStatus';
 export { IngestEvent } from './models/IngestEvent';
 export type { IngestRequest } from './models/IngestRequest';
 export type { IngestResponse } from './models/IngestResponse';
+export { Integration } from './models/Integration';
+export type { IntegrationAnalytics } from './models/IntegrationAnalytics';
+export type { IntegrationID } from './models/IntegrationID';
+export type { IntegrationListResponse } from './models/IntegrationListResponse';
+export type { IntegrationTestResult } from './models/IntegrationTestResult';
 export type { Invitation } from './models/Invitation';
 export type { InvitationID } from './models/InvitationID';
 export type { MeResponse } from './models/MeResponse';
@@ -82,6 +91,8 @@ export { ProjectMember } from './models/ProjectMember';
 export type { ProjectOverview } from './models/ProjectOverview';
 export type { ProjectSummary } from './models/ProjectSummary';
 export type { ReadinessStatus } from './models/ReadinessStatus';
+export type { RybbitMetricItem } from './models/RybbitMetricItem';
+export type { RybbitSite } from './models/RybbitSite';
 export type { SchemaQuery } from './models/SchemaQuery';
 export type { TableQuery } from './models/TableQuery';
 export type { TelemetryComponent } from './models/TelemetryComponent';
@@ -99,8 +110,15 @@ export { UpdateOrganizationMemberRoleRequest } from './models/UpdateOrganization
 export type { UpdateOrganizationRequest } from './models/UpdateOrganizationRequest';
 export { UpdateProjectMemberRoleRequest } from './models/UpdateProjectMemberRoleRequest';
 export type { UpdateProjectRequest } from './models/UpdateProjectRequest';
+export type { UpdateWebhookRequest } from './models/UpdateWebhookRequest';
 export type { UserID } from './models/UserID';
 export type { UserSummary } from './models/UserSummary';
+export type { Webhook } from './models/Webhook';
+export type { WebhookCreateResponse } from './models/WebhookCreateResponse';
+export { WebhookDelivery } from './models/WebhookDelivery';
+export type { WebhookDeliveryListResponse } from './models/WebhookDeliveryListResponse';
+export type { WebhookID } from './models/WebhookID';
+export type { WebhookListResponse } from './models/WebhookListResponse';
 
 export { $AcceptInvitationRequest } from './schemas/$AcceptInvitationRequest';
 export { $ApiKey } from './schemas/$ApiKey';
@@ -127,10 +145,13 @@ export { $CreateBucketRequest } from './schemas/$CreateBucketRequest';
 export { $CreateCollectionRequest } from './schemas/$CreateCollectionRequest';
 export { $CreatedApiKey } from './schemas/$CreatedApiKey';
 export { $CreateDBConnectionRequest } from './schemas/$CreateDBConnectionRequest';
+export { $CreateDeployMarkerRequest } from './schemas/$CreateDeployMarkerRequest';
 export { $CreateDocumentRequest } from './schemas/$CreateDocumentRequest';
+export { $CreateIntegrationRequest } from './schemas/$CreateIntegrationRequest';
 export { $CreateInvitationRequest } from './schemas/$CreateInvitationRequest';
 export { $CreateOrganizationRequest } from './schemas/$CreateOrganizationRequest';
 export { $CreateProjectRequest } from './schemas/$CreateProjectRequest';
+export { $CreateWebhookRequest } from './schemas/$CreateWebhookRequest';
 export { $DatabaseQuery } from './schemas/$DatabaseQuery';
 export { $DBConnection } from './schemas/$DBConnection';
 export { $DBConnectionListResponse } from './schemas/$DBConnectionListResponse';
@@ -148,6 +169,7 @@ export { $DBRedisResponse } from './schemas/$DBRedisResponse';
 export { $DBSchemaContextResponse } from './schemas/$DBSchemaContextResponse';
 export { $DBTableListResponse } from './schemas/$DBTableListResponse';
 export { $DBXStatus } from './schemas/$DBXStatus';
+export { $DeployMarker } from './schemas/$DeployMarker';
 export { $Document } from './schemas/$Document';
 export { $DocumentID } from './schemas/$DocumentID';
 export { $DocumentListResponse } from './schemas/$DocumentListResponse';
@@ -157,6 +179,11 @@ export { $HealthStatus } from './schemas/$HealthStatus';
 export { $IngestEvent } from './schemas/$IngestEvent';
 export { $IngestRequest } from './schemas/$IngestRequest';
 export { $IngestResponse } from './schemas/$IngestResponse';
+export { $Integration } from './schemas/$Integration';
+export { $IntegrationAnalytics } from './schemas/$IntegrationAnalytics';
+export { $IntegrationID } from './schemas/$IntegrationID';
+export { $IntegrationListResponse } from './schemas/$IntegrationListResponse';
+export { $IntegrationTestResult } from './schemas/$IntegrationTestResult';
 export { $Invitation } from './schemas/$Invitation';
 export { $InvitationID } from './schemas/$InvitationID';
 export { $MeResponse } from './schemas/$MeResponse';
@@ -177,6 +204,8 @@ export { $ProjectMember } from './schemas/$ProjectMember';
 export { $ProjectOverview } from './schemas/$ProjectOverview';
 export { $ProjectSummary } from './schemas/$ProjectSummary';
 export { $ReadinessStatus } from './schemas/$ReadinessStatus';
+export { $RybbitMetricItem } from './schemas/$RybbitMetricItem';
+export { $RybbitSite } from './schemas/$RybbitSite';
 export { $SchemaQuery } from './schemas/$SchemaQuery';
 export { $TableQuery } from './schemas/$TableQuery';
 export { $TelemetryComponent } from './schemas/$TelemetryComponent';
@@ -194,14 +223,23 @@ export { $UpdateOrganizationMemberRoleRequest } from './schemas/$UpdateOrganizat
 export { $UpdateOrganizationRequest } from './schemas/$UpdateOrganizationRequest';
 export { $UpdateProjectMemberRoleRequest } from './schemas/$UpdateProjectMemberRoleRequest';
 export { $UpdateProjectRequest } from './schemas/$UpdateProjectRequest';
+export { $UpdateWebhookRequest } from './schemas/$UpdateWebhookRequest';
 export { $UserID } from './schemas/$UserID';
 export { $UserSummary } from './schemas/$UserSummary';
+export { $Webhook } from './schemas/$Webhook';
+export { $WebhookCreateResponse } from './schemas/$WebhookCreateResponse';
+export { $WebhookDelivery } from './schemas/$WebhookDelivery';
+export { $WebhookDeliveryListResponse } from './schemas/$WebhookDeliveryListResponse';
+export { $WebhookID } from './schemas/$WebhookID';
+export { $WebhookListResponse } from './schemas/$WebhookListResponse';
 
 export { CollectionsService } from './services/CollectionsService';
 export { DatabasesService } from './services/DatabasesService';
 export { HealthService } from './services/HealthService';
+export { IntegrationsService } from './services/IntegrationsService';
 export { OrganizationsService } from './services/OrganizationsService';
 export { PlatformService } from './services/PlatformService';
 export { ProjectsService } from './services/ProjectsService';
 export { StorageService } from './services/StorageService';
 export { TelemetryService } from './services/TelemetryService';
+export { WebhooksService } from './services/WebhooksService';

packages/api-client/src/generated/models/CreateDeployMarkerRequest.ts

@@ -0,0 +1,14 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type CreateDeployMarkerRequest = {
+    version?: string;
+    /**
+     * Git SHA, tag or branch being deployed.
+     */
+    ref?: string;
+    environment?: string;
+    note?: string;
+};
+

packages/api-client/src/generated/models/CreateIntegrationRequest.ts

@@ -0,0 +1,23 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type CreateIntegrationRequest = {
+    name: string;
+    type: CreateIntegrationRequest.type;
+    /**
+     * Root URL of the self-hosted instance, e.g. https://analytics.example.com
+     */
+    base_url: string;
+    /**
+     * Credential stored encrypted at rest; never returned by any endpoint.
+     */
+    api_key?: string;
+    site_id?: string;
+};
+export namespace CreateIntegrationRequest {
+    export enum type {
+        RYBBIT = 'rybbit',
+    }
+}
+

packages/api-client/src/generated/models/CreateWebhookRequest.ts

@@ -0,0 +1,14 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type CreateWebhookRequest = {
+    url: string;
+    /**
+     * HMAC key for X-Primora-Signature. Generated when omitted.
+     */
+    secret?: string;
+    events?: Array<'issue.created' | 'deploy.marker' | 'webhook.test'>;
+    enabled?: boolean;
+};
+

packages/api-client/src/generated/models/DeployMarker.ts

@@ -0,0 +1,12 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type DeployMarker = {
+    version?: string;
+    ref?: string;
+    environment?: string;
+    note?: string;
+    recorded_at: string;
+};
+

packages/api-client/src/generated/models/Integration.ts

@@ -0,0 +1,30 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type Integration = {
+    id: string;
+    project_id: string;
+    type: Integration.type;
+    name: string;
+    base_url: string;
+    /**
+     * Connector-specific target (Rybbit site id). Optional.
+     */
+    site_id?: string;
+    status: Integration.status;
+    last_health_at?: string | null;
+    has_credentials: boolean;
+    created_at?: string;
+};
+export namespace Integration {
+    export enum type {
+        RYBBIT = 'rybbit',
+    }
+    export enum status {
+        UNKNOWN = 'unknown',
+        OK = 'ok',
+        ERROR = 'error',
+    }
+}
+

packages/api-client/src/generated/models/IntegrationAnalytics.ts

@@ -0,0 +1,30 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { RybbitMetricItem } from './RybbitMetricItem';
+import type { RybbitSite } from './RybbitSite';
+export type IntegrationAnalytics = {
+    integration_id: string;
+    site?: RybbitSite;
+    sites?: Array<RybbitSite>;
+    overview?: {
+        sessions?: number;
+        pageviews?: number;
+        users?: number;
+        pages_per_session?: number;
+        bounce_rate?: number;
+        session_duration?: number;
+    };
+    series?: Array<{
+        time?: string;
+        sessions?: number;
+        pageviews?: number;
+        users?: number;
+        bounce_rate?: number;
+    }>;
+    top_pages?: Array<RybbitMetricItem>;
+    top_referrers?: Array<RybbitMetricItem>;
+    window_days: number;
+};
+

packages/api-client/src/generated/models/IntegrationID.ts

@@ -0,0 +1,5 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type IntegrationID = string;

packages/api-client/src/generated/models/IntegrationListResponse.ts

@@ -0,0 +1,9 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { Integration } from './Integration';
+export type IntegrationListResponse = {
+    items: Array<Integration>;
+};
+

packages/api-client/src/generated/models/IntegrationTestResult.ts

@@ -0,0 +1,10 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type IntegrationTestResult = {
+    ok: boolean;
+    status_code?: number;
+    error?: string;
+};
+

packages/api-client/src/generated/models/RybbitMetricItem.ts

@@ -0,0 +1,10 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type RybbitMetricItem = {
+    value: string;
+    count: number;
+    percentage?: number;
+};
+

packages/api-client/src/generated/models/RybbitSite.ts

@@ -0,0 +1,10 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type RybbitSite = {
+    site_id: string;
+    name: string;
+    domain?: string;
+};
+

packages/api-client/src/generated/models/UpdateWebhookRequest.ts

@@ -0,0 +1,14 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type UpdateWebhookRequest = {
+    url?: string;
+    /**
+     * Replace the signing secret. Omit to keep the current one.
+     */
+    secret?: string;
+    events?: Array<'issue.created' | 'deploy.marker' | 'webhook.test'>;
+    enabled?: boolean;
+};
+

packages/api-client/src/generated/models/Webhook.ts

@@ -0,0 +1,17 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type Webhook = {
+    id: string;
+    project_id: string;
+    url: string;
+    /**
+     * Event filter (issue.created, deploy.marker, webhook.test). Empty means all events.
+     */
+    events: Array<string>;
+    enabled: boolean;
+    has_secret: boolean;
+    created_at?: string;
+};
+

packages/api-client/src/generated/models/WebhookCreateResponse.ts

@@ -0,0 +1,12 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { Webhook } from './Webhook';
+export type WebhookCreateResponse = (Webhook & {
+    /**
+     * Plaintext secret — present only when Primora generated it. Store it; it cannot be recovered.
+     */
+    secret?: string;
+});
+

packages/api-client/src/generated/models/WebhookDelivery.ts

@@ -0,0 +1,25 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type WebhookDelivery = {
+    id: string;
+    webhook_id: string;
+    event_type: string;
+    payload?: Record<string, any>;
+    status: WebhookDelivery.status;
+    attempts: number;
+    last_status_code?: number | null;
+    last_error?: string;
+    delivered_at?: string | null;
+    next_retry_at?: string | null;
+    created_at?: string;
+};
+export namespace WebhookDelivery {
+    export enum status {
+        PENDING = 'pending',
+        DELIVERED = 'delivered',
+        FAILED = 'failed',
+    }
+}
+

packages/api-client/src/generated/models/WebhookDeliveryListResponse.ts

@@ -0,0 +1,9 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { WebhookDelivery } from './WebhookDelivery';
+export type WebhookDeliveryListResponse = {
+    items: Array<WebhookDelivery>;
+};
+

packages/api-client/src/generated/models/WebhookID.ts

@@ -0,0 +1,5 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export type WebhookID = string;

packages/api-client/src/generated/models/WebhookListResponse.ts

@@ -0,0 +1,9 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { Webhook } from './Webhook';
+export type WebhookListResponse = {
+    items: Array<Webhook>;
+};
+

packages/api-client/src/generated/schemas/$CreateDeployMarkerRequest.ts

@@ -0,0 +1,21 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $CreateDeployMarkerRequest = {
+    properties: {
+        version: {
+            type: 'string',
+        },
+        ref: {
+            type: 'string',
+            description: `Git SHA, tag or branch being deployed.`,
+        },
+        environment: {
+            type: 'string',
+        },
+        note: {
+            type: 'string',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$CreateIntegrationRequest.ts

@@ -0,0 +1,28 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $CreateIntegrationRequest = {
+    properties: {
+        name: {
+            type: 'string',
+            isRequired: true,
+        },
+        type: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        base_url: {
+            type: 'string',
+            description: `Root URL of the self-hosted instance, e.g. https://analytics.example.com`,
+            isRequired: true,
+        },
+        api_key: {
+            type: 'string',
+            description: `Credential stored encrypted at rest; never returned by any endpoint.`,
+        },
+        site_id: {
+            type: 'string',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$CreateWebhookRequest.ts

@@ -0,0 +1,26 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $CreateWebhookRequest = {
+    properties: {
+        url: {
+            type: 'string',
+            isRequired: true,
+            format: 'uri',
+        },
+        secret: {
+            type: 'string',
+            description: `HMAC key for X-Primora-Signature. Generated when omitted.`,
+        },
+        events: {
+            type: 'array',
+            contains: {
+                type: 'Enum',
+            },
+        },
+        enabled: {
+            type: 'boolean',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$DeployMarker.ts

@@ -0,0 +1,25 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $DeployMarker = {
+    properties: {
+        version: {
+            type: 'string',
+        },
+        ref: {
+            type: 'string',
+        },
+        environment: {
+            type: 'string',
+        },
+        note: {
+            type: 'string',
+        },
+        recorded_at: {
+            type: 'string',
+            isRequired: true,
+            format: 'date-time',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$Integration.ts

@@ -0,0 +1,51 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $Integration = {
+    properties: {
+        id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        project_id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        type: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        name: {
+            type: 'string',
+            isRequired: true,
+        },
+        base_url: {
+            type: 'string',
+            isRequired: true,
+        },
+        site_id: {
+            type: 'string',
+            description: `Connector-specific target (Rybbit site id). Optional.`,
+        },
+        status: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        last_health_at: {
+            type: 'string',
+            isNullable: true,
+            format: 'date-time',
+        },
+        has_credentials: {
+            type: 'boolean',
+            isRequired: true,
+        },
+        created_at: {
+            type: 'string',
+            format: 'date-time',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$IntegrationAnalytics.ts

@@ -0,0 +1,82 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $IntegrationAnalytics = {
+    properties: {
+        integration_id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        site: {
+            type: 'RybbitSite',
+        },
+        sites: {
+            type: 'array',
+            contains: {
+                type: 'RybbitSite',
+            },
+        },
+        overview: {
+            properties: {
+                sessions: {
+                    type: 'number',
+                },
+                pageviews: {
+                    type: 'number',
+                },
+                users: {
+                    type: 'number',
+                },
+                pages_per_session: {
+                    type: 'number',
+                },
+                bounce_rate: {
+                    type: 'number',
+                },
+                session_duration: {
+                    type: 'number',
+                },
+            },
+        },
+        series: {
+            type: 'array',
+            contains: {
+                properties: {
+                    time: {
+                        type: 'string',
+                    },
+                    sessions: {
+                        type: 'number',
+                    },
+                    pageviews: {
+                        type: 'number',
+                    },
+                    users: {
+                        type: 'number',
+                    },
+                    bounce_rate: {
+                        type: 'number',
+                    },
+                },
+            },
+        },
+        top_pages: {
+            type: 'array',
+            contains: {
+                type: 'RybbitMetricItem',
+            },
+        },
+        top_referrers: {
+            type: 'array',
+            contains: {
+                type: 'RybbitMetricItem',
+            },
+        },
+        window_days: {
+            type: 'number',
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$IntegrationID.ts

@@ -0,0 +1,8 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $IntegrationID = {
+    type: 'string',
+    format: 'uuid',
+} as const;

packages/api-client/src/generated/schemas/$IntegrationListResponse.ts

@@ -0,0 +1,15 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $IntegrationListResponse = {
+    properties: {
+        items: {
+            type: 'array',
+            contains: {
+                type: 'Integration',
+            },
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$IntegrationTestResult.ts

@@ -0,0 +1,18 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $IntegrationTestResult = {
+    properties: {
+        ok: {
+            type: 'boolean',
+            isRequired: true,
+        },
+        status_code: {
+            type: 'number',
+        },
+        error: {
+            type: 'string',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$RybbitMetricItem.ts

@@ -0,0 +1,19 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $RybbitMetricItem = {
+    properties: {
+        value: {
+            type: 'string',
+            isRequired: true,
+        },
+        count: {
+            type: 'number',
+            isRequired: true,
+        },
+        percentage: {
+            type: 'number',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$RybbitSite.ts

@@ -0,0 +1,19 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $RybbitSite = {
+    properties: {
+        site_id: {
+            type: 'string',
+            isRequired: true,
+        },
+        name: {
+            type: 'string',
+            isRequired: true,
+        },
+        domain: {
+            type: 'string',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$UpdateWebhookRequest.ts

@@ -0,0 +1,25 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $UpdateWebhookRequest = {
+    properties: {
+        url: {
+            type: 'string',
+            format: 'uri',
+        },
+        secret: {
+            type: 'string',
+            description: `Replace the signing secret. Omit to keep the current one.`,
+        },
+        events: {
+            type: 'array',
+            contains: {
+                type: 'Enum',
+            },
+        },
+        enabled: {
+            type: 'boolean',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$Webhook.ts

@@ -0,0 +1,41 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $Webhook = {
+    properties: {
+        id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        project_id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        url: {
+            type: 'string',
+            isRequired: true,
+        },
+        events: {
+            type: 'array',
+            contains: {
+                type: 'string',
+            },
+            isRequired: true,
+        },
+        enabled: {
+            type: 'boolean',
+            isRequired: true,
+        },
+        has_secret: {
+            type: 'boolean',
+            isRequired: true,
+        },
+        created_at: {
+            type: 'string',
+            format: 'date-time',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$WebhookCreateResponse.ts

@@ -0,0 +1,17 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $WebhookCreateResponse = {
+    type: 'all-of',
+    contains: [{
+        type: 'Webhook',
+    }, {
+        properties: {
+            secret: {
+                type: 'string',
+                description: `Plaintext secret — present only when Primora generated it. Store it; it cannot be recovered.`,
+            },
+        },
+    }],
+} as const;

packages/api-client/src/generated/schemas/$WebhookDelivery.ts

@@ -0,0 +1,58 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $WebhookDelivery = {
+    properties: {
+        id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        webhook_id: {
+            type: 'string',
+            isRequired: true,
+            format: 'uuid',
+        },
+        event_type: {
+            type: 'string',
+            isRequired: true,
+        },
+        payload: {
+            type: 'dictionary',
+            contains: {
+                properties: {
+                },
+            },
+        },
+        status: {
+            type: 'Enum',
+            isRequired: true,
+        },
+        attempts: {
+            type: 'number',
+            isRequired: true,
+        },
+        last_status_code: {
+            type: 'number',
+            isNullable: true,
+        },
+        last_error: {
+            type: 'string',
+        },
+        delivered_at: {
+            type: 'string',
+            isNullable: true,
+            format: 'date-time',
+        },
+        next_retry_at: {
+            type: 'string',
+            isNullable: true,
+            format: 'date-time',
+        },
+        created_at: {
+            type: 'string',
+            format: 'date-time',
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$WebhookDeliveryListResponse.ts

@@ -0,0 +1,15 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $WebhookDeliveryListResponse = {
+    properties: {
+        items: {
+            type: 'array',
+            contains: {
+                type: 'WebhookDelivery',
+            },
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/schemas/$WebhookID.ts

@@ -0,0 +1,8 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $WebhookID = {
+    type: 'string',
+    format: 'uuid',
+} as const;

packages/api-client/src/generated/schemas/$WebhookListResponse.ts

@@ -0,0 +1,15 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export const $WebhookListResponse = {
+    properties: {
+        items: {
+            type: 'array',
+            contains: {
+                type: 'Webhook',
+            },
+            isRequired: true,
+        },
+    },
+} as const;

packages/api-client/src/generated/services/IntegrationsService.ts

@@ -0,0 +1,143 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { CreateIntegrationRequest } from '../models/CreateIntegrationRequest';
+import type { Integration } from '../models/Integration';
+import type { IntegrationAnalytics } from '../models/IntegrationAnalytics';
+import type { IntegrationListResponse } from '../models/IntegrationListResponse';
+import type { IntegrationTestResult } from '../models/IntegrationTestResult';
+import type { CancelablePromise } from '../core/CancelablePromise';
+import { OpenAPI } from '../core/OpenAPI';
+import { request as __request } from '../core/request';
+export class IntegrationsService {
+    /**
+     * @returns IntegrationListResponse External service integrations for the project
+     * @throws ApiError
+     */
+    public static listIntegrations({
+        projectId,
+    }: {
+        projectId: string,
+    }): CancelablePromise<IntegrationListResponse> {
+        return __request(OpenAPI, {
+            method: 'GET',
+            url: '/projects/{projectID}/integrations',
+            path: {
+                'projectID': projectId,
+            },
+            errors: {
+                401: `Error response`,
+            },
+        });
+    }
+    /**
+     * @returns Integration Integration created
+     * @throws ApiError
+     */
+    public static createIntegration({
+        projectId,
+        requestBody,
+    }: {
+        projectId: string,
+        requestBody: CreateIntegrationRequest,
+    }): CancelablePromise<Integration> {
+        return __request(OpenAPI, {
+            method: 'POST',
+            url: '/projects/{projectID}/integrations',
+            path: {
+                'projectID': projectId,
+            },
+            body: requestBody,
+            mediaType: 'application/json',
+            errors: {
+                401: `Error response`,
+                409: `Error response`,
+            },
+        });
+    }
+    /**
+     * @returns void
+     * @throws ApiError
+     */
+    public static deleteIntegration({
+        projectId,
+        integrationId,
+    }: {
+        projectId: string,
+        integrationId: string,
+    }): CancelablePromise<void> {
+        return __request(OpenAPI, {
+            method: 'DELETE',
+            url: '/projects/{projectID}/integrations/{integrationID}',
+            path: {
+                'projectID': projectId,
+                'integrationID': integrationId,
+            },
+            errors: {
+                404: `Error response`,
+            },
+        });
+    }
+    /**
+     * Health check — HTTP GET against the integration's base URL with stored credentials (~5s timeout). Updates status and last_health_at.
+     * @returns IntegrationTestResult Connectivity probe result
+     * @throws ApiError
+     */
+    public static testIntegration({
+        projectId,
+        integrationId,
+    }: {
+        projectId: string,
+        integrationId: string,
+    }): CancelablePromise<IntegrationTestResult> {
+        return __request(OpenAPI, {
+            method: 'POST',
+            url: '/projects/{projectID}/integrations/{integrationID}/test',
+            path: {
+                'projectID': projectId,
+                'integrationID': integrationId,
+            },
+            errors: {
+                404: `Error response`,
+            },
+        });
+    }
+    /**
+     * Read-only analytics pulled from the integration (Rybbit). The API key never leaves the server.
+     * @returns IntegrationAnalytics Normalized analytics payload
+     * @throws ApiError
+     */
+    public static getIntegrationAnalytics({
+        projectId,
+        integrationId,
+        site,
+        days = 30,
+    }: {
+        projectId: string,
+        integrationId: string,
+        /**
+         * Rybbit site id override; defaults to the integration's configured site, else first accessible site.
+         */
+        site?: string,
+        days?: number,
+    }): CancelablePromise<IntegrationAnalytics> {
+        return __request(OpenAPI, {
+            method: 'GET',
+            url: '/projects/{projectID}/integrations/{integrationID}/analytics',
+            path: {
+                'projectID': projectId,
+                'integrationID': integrationId,
+            },
+            query: {
+                'site': site,
+                'days': days,
+            },
+            errors: {
+                400: `Error response`,
+                404: `Error response`,
+                502: `Error response`,
+            },
+        });
+    }
+}

packages/api-client/src/generated/services/WebhooksService.ts

@@ -0,0 +1,190 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+import type { CreateDeployMarkerRequest } from '../models/CreateDeployMarkerRequest';
+import type { CreateWebhookRequest } from '../models/CreateWebhookRequest';
+import type { DeployMarker } from '../models/DeployMarker';
+import type { UpdateWebhookRequest } from '../models/UpdateWebhookRequest';
+import type { WebhookCreateResponse } from '../models/WebhookCreateResponse';
+import type { WebhookDelivery } from '../models/WebhookDelivery';
+import type { WebhookDeliveryListResponse } from '../models/WebhookDeliveryListResponse';
+import type { WebhookListResponse } from '../models/WebhookListResponse';
+import type { CancelablePromise } from '../core/CancelablePromise';
+import { OpenAPI } from '../core/OpenAPI';
+import { request as __request } from '../core/request';
+export class WebhooksService {
+    /**
+     * @returns WebhookListResponse Outbound webhooks for the project
+     * @throws ApiError
+     */
+    public static listWebhooks({
+        projectId,
+    }: {
+        projectId: string,
+    }): CancelablePromise<WebhookListResponse> {
+        return __request(OpenAPI, {
+            method: 'GET',
+            url: '/projects/{projectID}/webhooks',
+            path: {
+                'projectID': projectId,
+            },
+            errors: {
+                401: `Error response`,
+            },
+        });
+    }
+    /**
+     * Deliveries are POSTed as JSON with X-Primora-Event and X-Primora-Signature (sha256=<HMAC-SHA256 hex of the raw body, keyed by the webhook secret>). If no secret is supplied one is generated and returned once.
+     * @returns WebhookCreateResponse Webhook created
+     * @throws ApiError
+     */
+    public static createWebhook({
+        projectId,
+        requestBody,
+    }: {
+        projectId: string,
+        requestBody: CreateWebhookRequest,
+    }): CancelablePromise<WebhookCreateResponse> {
+        return __request(OpenAPI, {
+            method: 'POST',
+            url: '/projects/{projectID}/webhooks',
+            path: {
+                'projectID': projectId,
+            },
+            body: requestBody,
+            mediaType: 'application/json',
+            errors: {
+                401: `Error response`,
+                409: `Error response`,
+            },
+        });
+    }
+    /**
+     * @returns WebhookCreateResponse Webhook updated
+     * @throws ApiError
+     */
+    public static updateWebhook({
+        projectId,
+        webhookId,
+        requestBody,
+    }: {
+        projectId: string,
+        webhookId: string,
+        requestBody: UpdateWebhookRequest,
+    }): CancelablePromise<WebhookCreateResponse> {
+        return __request(OpenAPI, {
+            method: 'PATCH',
+            url: '/projects/{projectID}/webhooks/{webhookID}',
+            path: {
+                'projectID': projectId,
+                'webhookID': webhookId,
+            },
+            body: requestBody,
+            mediaType: 'application/json',
+            errors: {
+                404: `Error response`,
+            },
+        });
+    }
+    /**
+     * @returns void
+     * @throws ApiError
+     */
+    public static deleteWebhook({
+        projectId,
+        webhookId,
+    }: {
+        projectId: string,
+        webhookId: string,
+    }): CancelablePromise<void> {
+        return __request(OpenAPI, {
+            method: 'DELETE',
+            url: '/projects/{projectID}/webhooks/{webhookID}',
+            path: {
+                'projectID': projectId,
+                'webhookID': webhookId,
+            },
+            errors: {
+                404: `Error response`,
+            },
+        });
+    }
+    /**
+     * @returns WebhookDeliveryListResponse Recent delivery attempts, newest first
+     * @throws ApiError
+     */
+    public static listWebhookDeliveries({
+        projectId,
+        webhookId,
+        limit = 50,
+    }: {
+        projectId: string,
+        webhookId: string,
+        limit?: number,
+    }): CancelablePromise<WebhookDeliveryListResponse> {
+        return __request(OpenAPI, {
+            method: 'GET',
+            url: '/projects/{projectID}/webhooks/{webhookID}/deliveries',
+            path: {
+                'projectID': projectId,
+                'webhookID': webhookId,
+            },
+            query: {
+                'limit': limit,
+            },
+            errors: {
+                404: `Error response`,
+            },
+        });
+    }
+    /**
+     * Queues a webhook.test ping delivery.
+     * @returns WebhookDelivery Test delivery queued
+     * @throws ApiError
+     */
+    public static testWebhook({
+        projectId,
+        webhookId,
+    }: {
+        projectId: string,
+        webhookId: string,
+    }): CancelablePromise<WebhookDelivery> {
+        return __request(OpenAPI, {
+            method: 'POST',
+            url: '/projects/{projectID}/webhooks/{webhookID}/test',
+            path: {
+                'projectID': projectId,
+                'webhookID': webhookId,
+            },
+            errors: {
+                404: `Error response`,
+            },
+        });
+    }
+    /**
+     * Records a deployment marker in the audit log and fires the deploy.marker webhook event.
+     * @returns DeployMarker Marker recorded
+     * @throws ApiError
+     */
+    public static createDeployMarker({
+        projectId,
+        requestBody,
+    }: {
+        projectId: string,
+        requestBody: CreateDeployMarkerRequest,
+    }): CancelablePromise<DeployMarker> {
+        return __request(OpenAPI, {
+            method: 'POST',
+            url: '/projects/{projectID}/deploy-markers',
+            path: {
+                'projectID': projectId,
+            },
+            body: requestBody,
+            mediaType: 'application/json',
+            errors: {
+                401: `Error response`,
+            },
+        });
+    }
+}

packages/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primora/client",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "type": "module",
   "main": "./src/index.ts",

packages/shared-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primora/shared-types",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "type": "module",
   "main": "./src/index.ts",