Initial Commit

openspec/changes/enterprise-testing-contract/specs/webhook-client/spec.md

@@ -0,0 +1,24 @@
+## ADDED Requirements
+
+### Requirement: Consumer-side pact recording
+
+The `@suaveplan/webhook-client` package SHALL ship a `webhook-client.contract.test.ts` that uses `recordPactInteraction` from `@suaveplan/testing-contract` to record signed-delivery POSTs to a webhook receiver. Recorded interactions MUST include the `X-Signature` HMAC-SHA256 header so receiver implementations can be verified against the canonical signing scheme. The resulting pact file MUST be committed to `pacts/webhook-client__webhook-receiver.json`.
+
+#### Scenario: Pact records signed delivery
+
+- **WHEN** the consumer-side test drives a signed delivery
+- **THEN** `pacts/webhook-client__webhook-receiver.json` contains an interaction whose `request.headers["X-Signature"]` is a valid HMAC-SHA256 of the recorded body under the recorded secret
+
+### Requirement: Provider-side pact verification
+
+The `@suaveplan/webhook-client` package SHALL ship a `webhook-client.provider.test.ts` that uses `verifyProviderAgainstPact` from `@suaveplan/testing-contract` to replay `pacts/webhook-client__webhook-receiver.json` against a running webhook-receiver instance and assert each response matches the recorded shape. Verification MUST run on every commit via the `pact:verify` Turborepo task.
+
+#### Scenario: Receiver passes verification
+
+- **WHEN** the receiver under test returns the recorded response shape for every interaction
+- **THEN** `verifyProviderAgainstPact` resolves with `passed: true`
+
+#### Scenario: Receiver drift trips verification
+
+- **WHEN** the receiver returns a 500 for an interaction recorded as 200
+- **THEN** `verifyProviderAgainstPact` throws `TestingContractError` with `code === "TESTING_CONTRACT.VERIFY.MISMATCH"` AND `pact:verify` fails the build