(janitor/dedupe): consolidate webhook user ID path encoding into worker-utils

[kilo-code-bot]

Summary

encodeUserIdForPath / decodeUserIdFromPath were duplicated across two packages:

• apps/web/src/lib/webhook-agent/user-id-encoding.ts (encode only)
• services/webhook-agent-ingest/src/util/user-id-encoding.ts (encode + decode)

The web client builds webhook URL paths with encodeUserIdForPath, and the ingest worker parses them with decodeUserIdFromPath. They are two halves of the same domain concept and must change together: if they drift, webhook routing silently breaks.

Change

Both apps/web and cloudflare-webhook-agent-ingest already depend on @kilocode/worker-utils, so it becomes the single owner of the concept. This is a shared behavior consolidation, not an abstraction: the duplicated implementation and its test are moved verbatim, then the call sites import from the shared package.

• Add @kilocode/worker-utils/user-id-encoding (encode + decode) and its tests.
• Delete the two duplicated source files and the service's test file.
• Update the 5 call sites to import from the shared package.

Verification

• tsgo --noEmit passes for packages/worker-utils, services/webhook-agent-ingest, and apps/web.
• vitest run src/user-id-encoding.test.ts (worker-utils): 12 passed.
• vitest run src/routes/api.test.ts (webhook-agent-ingest): 29 passed.
• oxlint and oxfmt --list-different clean on all changed files.

Postgres/Redis were not needed for this change.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Verified the verbatim relocation of encodeUserIdForPath/decodeUserIdFromPath into @kilocode/worker-utils, with all 5 call sites updated, no stale references to the removed files, and the new subpath export correctly declared.

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Verification Notes

• The moved user-id-encoding.ts is 100% similar to the prior ingest implementation; the deleted apps/web copy's encodeUserIdForPath body is byte-identical, so no behavior drift is introduced between encoder and decoder.
• Whole-repo search for user-id-encoding shows only the intended new imports plus the new package.json export; no references to apps/web/src/lib/webhook-agent/user-id-encoding or services/webhook-agent-ingest/src/util/user-id-encoding remain.
• packages/worker-utils/package.json declares ./user-id-encoding -> ./src/user-id-encoding.ts, matching the subpath-export convention already used by the other 40+ entries, and both consumers already depend on @kilocode/worker-utils.
• apps/web has existing precedent for 165 subpath imports from this package, so Next.js bundling/resolution of the new subpath is consistent with current practice.
• packages/worker-utils/tsconfig.json uses lib: ["esnext", "webworker"], which types btoa/atob used by the moved module; the relocated test imports describe/it/expect explicitly so it does not rely on the service's globals: true unit config.
• Worker-utils already has 37 test files, so the relocated test will be discovered by its default vitest run; CI's workspace-tests matrix includes packages/worker-utils/** in the changed-path filter.
• No memory-leak risk introduced: this is a pure synchronous, stateless helper move with no timers, listeners, subscriptions, or retained references.

Files Reviewed (9 files)

• apps/web/src/lib/webhook-agent/user-id-encoding.ts (deleted)
• apps/web/src/lib/webhook-agent/webhook-agent-client.ts
• packages/worker-utils/package.json
• packages/worker-utils/src/user-id-encoding.ts (moved)
• packages/worker-utils/src/user-id-encoding.test.ts (moved)
• services/webhook-agent-ingest/src/routes/api.ts
• services/webhook-agent-ingest/src/routes/api.test.ts
• services/webhook-agent-ingest/src/routes/inbound.ts
• services/webhook-agent-ingest/test/integration/routes.test.ts

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}