Webhooks for Ash Framework — inbound (receive, verify, dedup → domain events) and outbound (sign, deliver, retry, track).

Attach to a resource:

use Ash.Resource,
  extensions: [AshHooks]

webhooks do
  # convention-resolves to AshHooks.Provider.ComplyCube
  inbound :comply_cube do
    secret {:app_env, [:my_app, :complycube_secret]}
    # optional: extract a stable event id (payload -> {:ok, id} | :error);
    # otherwise the provider identity callback, then raw-body digest, applies
  end

  # convention-resolves to AshHooks.Provider.HubSpotV3 — the
  # vendor-default 300s replay window applies; override it either way
  inbound :hub_spot_v3 do
    secret {:app_env, [:my_app, :hubspot_client_secret]}
  end

  outbound :order_paid do
    signing_mode :dual
  end
end

Both halves are independently consumable: inbound-only consumers pull no queue infrastructure (ADR-0004).

Multi-tenant? Declare Ash attribute multitenancy on the four resources (subscription, endpoint, both ledgers) and pass :tenant / ctx[:tenant] to every entry point — every query, write, dedup identity, sweep, and job arg is tenant-scoped, and a tenant-less call against a multitenant resource fails closed with {:error, :tenant_required} before any data access. Single-tenant apps change nothing. The adoption checklist walks the ordered transition (ADR-0011).