@automagik/omni 2.260908.2 → 2.260908.4

package/dist/server/index.js

@@ -31173,7 +31173,7 @@ function zodToEventJsonSchema(schema, name) {
   }
   return artifact;
 }
-var import_ajv, SCHEMA_VALIDATION_FAILED = "schema_validation_failed", ajv, compiled;
+var import_ajv, SCHEMA_VALIDATION_FAILED = "schema_validation_failed", SCHEMA_NOT_REGISTERED = "schema_not_registered", ajv, compiled;
 var init_schema_registry = __esm(() => {
   init_esm();
   import_ajv = __toESM(require_ajv(), 1);
@@ -37807,6 +37807,16 @@ async function releaseEmissionClaim(deps, claimedEventId, eventType) {
     });
   });
 }
+async function enforceEmitEventSchema(deps, eventType, payload, trustedTenantId) {
+  if (!deps.validateEmitEvent)
+    return null;
+  const verdict = await deps.validateEmitEvent(eventType, payload, trustedTenantId);
+  if (verdict.valid)
+    return null;
+  const detail = verdict.errors?.length ? `: ${verdict.errors.join("; ")}` : "";
+  logger2.warn("Emit event refused by schema registry", { eventType, errors: verdict.errors });
+  return `${verdict.reason ?? SCHEMA_VALIDATION_FAILED}${detail}`;
+}
 async function executeEmitEventAction(config2, context2, deps, trustedTenantId, actionIndex = 0, provenance) {
   try {
     if (!deps.eventBus) {
@@ -37822,13 +37832,9 @@ async function executeEmitEventAction(config2, context2, deps, trustedTenantId,
       payload = context2.payload;
     }
     const eventType = substituteTemplate(config2.eventType, context2);
-    if (deps.validateEmitEvent) {
-      const verdict = await deps.validateEmitEvent(eventType, payload, trustedTenantId);
-      if (!verdict.valid) {
-        const detail = verdict.errors?.length ? `: ${verdict.errors.join("; ")}` : "";
-        logger2.warn("Emit event refused by schema registry", { eventType, errors: verdict.errors });
-        return { success: false, error: `${SCHEMA_VALIDATION_FAILED}${detail}` };
-      }
+    const schemaError = await enforceEmitEventSchema(deps, eventType, payload, trustedTenantId);
+    if (schemaError !== null) {
+      return { success: false, error: schemaError };
     }
     const correlationId = context2.event?.metadata.correlationId ?? context2.payload.correlationId ?? undefined;
     const causationId = context2.event?.id ?? provenance?.parentEventId;
@@ -44136,6 +44142,7 @@ __export(exports_src, {
   SETTING_VALUE_TYPES: () => SETTING_VALUE_TYPES,
   SECRET_BOX_VERSION: () => SECRET_BOX_VERSION,
   SCHEMA_VALIDATION_FAILED: () => SCHEMA_VALIDATION_FAILED,
+  SCHEMA_NOT_REGISTERED: () => SCHEMA_NOT_REGISTERED,
   RuleTypeSchema: () => RuleTypeSchema,
   ReplyFilterModeSchema: () => ReplyFilterModeSchema,
   RULE_TYPES: () => RULE_TYPES,
@@ -173707,6 +173714,7 @@ var init_schema2 = __esm(() => {
     signatureSecret: text("signature_secret"),
     idempotencyKeyTemplate: text("idempotency_key_template").notNull().default("{source}:{sha256(body)}"),
     eventTypeMapping: jsonb("event_type_mapping").$type(),
+    strictSchemas: boolean2("strict_schemas").notNull().default(false),
     enabled: boolean2("enabled").notNull().default(true),
     lastReceivedAt: timestamp("last_received_at", { withTimezone: true }),
     totalReceived: integer("total_received").notNull().default(0),
@@ -250967,7 +250975,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260908.2",
+    version: "2.260908.4",
     private: true,
     type: "module",
     exports: {
@@ -358528,7 +358536,7 @@ class DeadLetterService {
       eventType: input.eventType,
       subject: input.subject,
       payload: input.payload,
-      error: `${SCHEMA_VALIDATION_FAILED}: ${input.errors.join("; ")}`,
+      error: `${input.reason ?? SCHEMA_VALIDATION_FAILED}: ${input.errors.join("; ")}`,
       stack: null,
       autoRetryCount: 0,
       nextAutoRetryAt: null,
@@ -363650,8 +363658,14 @@ function sha256Hex(input) {
 function resolvePayloadPath(payload, path3) {
   let current = payload;
   for (const part of path3.split(".")) {
-    if (current === null || typeof current !== "object" || Array.isArray(current))
+    if (current === null || typeof current !== "object")
       return;
+    if (Array.isArray(current)) {
+      if (!/^(0|[1-9]\d*)$/.test(part))
+        return;
+      current = current[Number(part)];
+      continue;
+    }
     current = current[part];
   }
   if (typeof current === "string")
@@ -363720,12 +363734,13 @@ function sanitizeEventToken(raw2) {
   const token = raw2.trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
   return token.length > 0 ? token : null;
 }
-function resolveWebhookEventType(sourceName, mapping, headers) {
+function resolveWebhookEventType(sourceName, mapping, headers, payload = {}) {
   const fallback = `custom.webhook.${sourceName}`;
-  if (!mapping || mapping.source !== "header") {
+  if (!mapping) {
     return fallback;
   }
-  const token = sanitizeEventToken(headers[mapping.header.toLowerCase()]);
+  const raw2 = mapping.source === "header" ? headers[mapping.header.toLowerCase()] : resolvePayloadPath(payload, mapping.path);
+  const token = sanitizeEventToken(raw2);
   return token ? `custom.${sourceName}.${token}` : fallback;
 }
 
@@ -363864,13 +363879,13 @@ class WebhookService {
         }
       }
     }
-    const eventType = resolveWebhookEventType(sourceName, source.eventTypeMapping, headers);
+    const eventType = resolveWebhookEventType(sourceName, source.eventTypeMapping, headers, payload);
     const eventPayload = {
       source: sourceName,
       ...payload
     };
     const eventId = generateId();
-    await this.enforceRegisteredSchema(eventType, eventPayload, eventId, `webhook '${sourceName}'`);
+    await this.enforceRegisteredSchema(eventType, eventPayload, eventId, `webhook '${sourceName}'`, source.strictSchemas);
     const idempotencyKey = deriveIdempotencyKey({
       template: source.idempotencyKeyTemplate,
       sourceName,
@@ -363963,11 +363978,24 @@ class WebhookService {
       throw unauthorized("Invalid webhook signature");
     }
   }
-  async enforceRegisteredSchema(eventType, payload, eventId, origin) {
+  async enforceRegisteredSchema(eventType, payload, eventId, origin, strict = false) {
     if (!this.eventSchemas) {
       return;
     }
     const verdict = await this.eventSchemas.validate(eventType, payload);
+    if (strict && !verdict.registered) {
+      const errors4 = [`no enabled schema is registered for event type '${eventType}'`];
+      await this.deadLetters?.createSchemaValidationFailure({
+        eventId,
+        eventType,
+        subject: eventType,
+        payload,
+        errors: errors4,
+        reason: SCHEMA_NOT_REGISTERED
+      });
+      log112.warn("Webhook refused by strict schema mode: type not registered", { eventType, origin });
+      throw new ValidationError2(`${SCHEMA_NOT_REGISTERED}: '${eventType}' has no enabled registered schema and the source enforces strict schemas (${origin})`, undefined, { eventType, errors: errors4 });
+    }
     if (verdict.valid) {
       return;
     }
@@ -367846,7 +367874,7 @@ function registerEventSchemaSchemas(registry4) {
     operationId: "registerEventSchema",
     tags: ["Events"],
     summary: "Register or revise an event schema",
-    description: "Register a JSON Schema for an event type. Once registered, the webhook ingress and automation " + "emit_event validate payloads of this type before publishing; invalid payloads are dead-lettered with " + "reason schema_validation_failed. Revising an existing registration must be additive-optional " + "(the evolution rule) \u2014 an incompatible change is refused with 409 and must ship as a new versioned " + "event type (e.g. custom.github.push.v2).",
+    description: "Register a JSON Schema for an event type. Once registered, the webhook ingress and automation " + "emit_event validate payloads of this type before publishing; invalid payloads are dead-lettered with " + "reason schema_validation_failed. Unregistered types pass through unless the emitter is strict " + "(webhook_sources.strictSchemas, or OMNI_STRICT_EMIT_EVENT_SCHEMAS for emit_event), in which case " + "they are dead-lettered with reason schema_not_registered. " + "Revising an existing registration must be additive-optional " + "(the evolution rule) \u2014 an incompatible change is refused with 409 and must ship as a new versioned " + "event type (e.g. custom.github.push.v2).",
     request: { body: { content: { "application/json": { schema: RegisterEventSchemaSchema } } } },
     responses: {
       201: {
@@ -370952,14 +370980,24 @@ var init_webhooks2 = __esm(() => {
     message: "prefix is not applicable to algorithm 'token-match'",
     path: ["prefix"]
   });
-  WebhookEventTypeMappingSchema = exports_external.object({
-    source: exports_external.literal("header").openapi({
-      description: "Where the semantic event name is read from (only headers for now)"
+  WebhookEventTypeMappingSchema = exports_external.discriminatedUnion("source", [
+    exports_external.object({
+      source: exports_external.literal("header").openapi({
+        description: "Read the semantic event name from a request header"
+      }),
+      header: exports_external.string().min(1).max(200).openapi({
+        description: "Header carrying the semantic event name (e.g. X-GitHub-Event). 1-200 characters"
+      })
     }),
-    header: exports_external.string().min(1).max(200).openapi({
-      description: "Header carrying the semantic event name (e.g. X-GitHub-Event). 1-200 characters"
+    exports_external.object({
+      source: exports_external.literal("body").openapi({
+        description: "Read the semantic event name from the JSON body (body-first providers like ClickUp, #984)"
+      }),
+      path: exports_external.string().min(1).max(200).openapi({
+        description: 'Dot-path to the event name in the payload (e.g. "event"); numeric segments index arrays. 1-200 characters'
+      })
     })
-  });
+  ]);
   WebhookSourceSchema = exports_external.object({
     id: exports_external.string().uuid().openapi({ description: "Source UUID" }),
     name: exports_external.string().openapi({ description: "Source name" }),
@@ -370972,6 +371010,9 @@ var init_webhooks2 = __esm(() => {
     hasSignatureSecret: exports_external.boolean().openapi({ description: "Whether a signature secret is stored (secret is write-only)" }),
     idempotencyKeyTemplate: exports_external.string().openapi({ description: "Idempotency key derivation template" }),
     totalDuplicates: exports_external.number().int().openapi({ description: "Redeliveries acked without creating a second event" }),
+    strictSchemas: exports_external.boolean().openapi({
+      description: "Strict schema mode: deliveries resolving to an event type with no enabled registered schema are " + "refused and dead-lettered with reason schema_not_registered"
+    }),
     enabled: exports_external.boolean().openapi({ description: "Whether enabled" }),
     lastReceivedAt: exports_external.string().datetime().nullable().openapi({ description: "When the last webhook was received" }),
     totalReceived: exports_external.number().int().openapi({ description: "Total webhooks received" }),
@@ -370997,6 +371038,9 @@ var init_webhooks2 = __esm(() => {
       description: "Shared secret used by signatureConfig (write-only, never returned; 8-512 characters). Cannot be set " + "without a signatureConfig (given in the same request, or already stored on update); null clears it."
     }),
     idempotencyKeyTemplate: IdempotencyKeyTemplateSchema.optional(),
+    strictSchemas: exports_external.boolean().optional().openapi({
+      description: "Strict schema mode (RFC #925 G1 policy switch): when true, a delivery resolving to an event type " + "with no enabled registered schema is refused and dead-lettered with reason schema_not_registered " + "(manual retry only) instead of passing through. Defaults to false (opt-in pass-through). " + "Recommended true for NEW sources \u2014 they have no legacy emitters to grandfather."
+    }),
     eventTypeMapping: WebhookEventTypeMappingSchema.nullable().optional().openapi({
       description: "Semantic event-type extraction (e.g. header X-GitHub-Event: push emits custom.{source}.push). " + "Null or absent keeps the legacy collapsed custom.webhook.{source} type for every delivery."
     }),
@@ -387792,16 +387836,21 @@ function buildAutomationEngineDeps(services, db3, options = {}) {
     },
     validateEmitEvent: async (eventType, payload, trustedTenantId = null) => {
       const verdict = await runTenantWorkDb(db3, trustedTenantId, () => services.eventSchemas.validate(eventType, payload));
-      if (verdict.valid) {
+      const strictEmit = process.env.OMNI_STRICT_EMIT_EVENT_SCHEMAS === "true";
+      const refusedUnregistered = strictEmit && !verdict.registered;
+      if (verdict.valid && !refusedUnregistered) {
         return { valid: true };
       }
+      const errors4 = refusedUnregistered ? [`no enabled schema is registered for event type '${eventType}'`] : verdict.errors;
+      const reason2 = refusedUnregistered ? SCHEMA_NOT_REGISTERED : undefined;
       try {
         await runTenantWorkDb(db3, trustedTenantId, () => services.deadLetters.createSchemaValidationFailure({
           eventId: generateId(),
           eventType,
           subject: eventType,
           payload,
-          errors: verdict.errors
+          errors: errors4,
+          reason: reason2
         }));
       } catch (error3) {
         log130.error("Failed to dead-letter refused emit_event payload", {
@@ -387809,7 +387858,7 @@ function buildAutomationEngineDeps(services, db3, options = {}) {
           error: error3 instanceof Error ? error3.message : String(error3)
         });
       }
-      return { valid: false, errors: verdict.errors };
+      return { valid: false, errors: errors4, reason: reason2 };
     }
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.260908.2",
+  "version": "2.260908.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/automagik-dev/omni.git",