CEXT-6834: Plan webhook upgrades from live state

[iivvaannxx]

Description

Webhook upgrades now plan from what is subscribed in Commerce instead of diffing the baseline config against the target config.

• Live read. plan lists the webhooks in Commerce and maps them into the resolved config shape (toResolvedWebhookPayload). If the read fails, the plan is blocked with WEBHOOK_LIVE_READ_FAILED.
• Diff. The plan compares the resolved target with live. It adds what is missing and updates what differs (unsubscribe, then subscribe, as before). It removes webhooks the app owns that the target no longer declares. Operations run in remove, update, add order.
• Ownership. A webhook is the app's if the baseline config declares it, or if its URL proves it: the app prefix and the runtime host from __OW_NAMESPACE, the same check as CEXT-6770: Remove app-owned resources left behind by failed upgrades #711. The baseline check covers webhooks with an explicit URL. This needs appId, which is now on LifecycleContext.
• Fields the target leaves out. No Commerce defaults are hardcoded. A field the target sets must equal live. A field the target leaves out counts as changed only when live equals a value that a config of ours set: the baseline config, the failed attempt's target, or values that failed plan stored (configuredValues). A successful upgrade resets this.
• Reason. An add or update is change when the target adds the webhook or changes it compared with the baseline config, and drift otherwise. A remove is change when the baseline declares the webhook, and drift when only ownership found it. For the baseline comparison, a field the target drops counts as changed.
• pruneStaleWebhooks is removed. The plan's remove operations find leftovers.
• fieldValuesEqual and isUnset live in common/utils/values.ts, so events can use them too.

Known trade-offs:

• Fields Commerce doesn't store as sent show an update on every upgrade: required: false isn't stored, and batch_order is per batch.
• A manual edit to a field that no config of ours ever set isn't detected.

Related Issue

https://jira.corp.adobe.com/browse/CEXT-6834

Motivation and Context

Example: 1.0.0 is installed. 1.1.0 changes a webhook and fails after unsubscribing it. 1.1.0 is then redeployed with that change reverted. The baseline is still 1.0.0, and 1.0.0 matches the target, so the old planner saw nothing to do. The upgrade succeeded while the webhook was missing in Commerce. Reading live state removes the dependency on the baseline matching reality.

Stacked on #716.

How Has This Been Tested?

• pnpm --filter @adobe/aio-commerce-lib-app test: 1342 passing.
• plan.test.ts is rewritten around live state. It covers: add, update and remove; the rule for fields the target leaves out, including the chain across failed attempts; env narrowing and widening; ownership by baseline and by URL; operation order; the reason for each kind. Mutation checks: dropping the baseline evidence, labeling undeclared webhooks as drift, and hardcoding any of the three reasons each fail a test.
• Integration tests in webhooks.test.ts cover the scenario above and the removal of a webhook the target dropped.
• The Commerce behaviour the comparison depends on was checked on a SaaS sandbox: which fields Commerce stores as sent, header values, and masked secrets.
• pnpm typecheck and Biome are clean.

Screenshots (if appropriate):

Not applicable.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have signed the Adobe Open Source CLA.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have read the DEVELOPMENT document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 96a5e91

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@adobe/aio-commerce-lib-app	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR