suaveplan/openspec/changes/enterprise-testing-contract/specs/webhook-client/spec.md

ADDED Requirements

Requirement: Consumer-side pact recording

The @suaveplan/webhook-client package SHALL ship a webhook-client.contract.test.ts that uses recordPactInteraction from @suaveplan/testing-contract to record signed-delivery POSTs to a webhook receiver. Recorded interactions MUST include the X-Signature HMAC-SHA256 header so receiver implementations can be verified against the canonical signing scheme. The resulting pact file MUST be committed to pacts/webhook-client__webhook-receiver.json.

Scenario: Pact records signed delivery

• WHEN the consumer-side test drives a signed delivery
• THEN pacts/webhook-client__webhook-receiver.json contains an interaction whose request.headers["X-Signature"] is a valid HMAC-SHA256 of the recorded body under the recorded secret

Requirement: Provider-side pact verification

The @suaveplan/webhook-client package SHALL ship a webhook-client.provider.test.ts that uses verifyProviderAgainstPact from @suaveplan/testing-contract to replay pacts/webhook-client__webhook-receiver.json against a running webhook-receiver instance and assert each response matches the recorded shape. Verification MUST run on every commit via the pact:verify Turborepo task.

Scenario: Receiver passes verification

• WHEN the receiver under test returns the recorded response shape for every interaction
• THEN verifyProviderAgainstPact resolves with passed: true

Scenario: Receiver drift trips verification

• WHEN the receiver returns a 500 for an interaction recorded as 200
• THEN verifyProviderAgainstPact throws TestingContractError with code === "TESTING_CONTRACT.VERIFY.MISMATCH" AND pact:verify fails the build