@critical-path/core 0.25.0 → 0.27.0

package/dist/webhooks/dispatcher.js

@@ -0,0 +1,133 @@
+import { signWebhookPayload } from './signature.js';
+/** Default queue: runs jobs on timers in this process. Timers do not keep the process alive. */
+export class InProcessWebhookQueue {
+    run;
+    outstanding = 0;
+    waiters = [];
+    constructor(run) {
+        this.run = run;
+    }
+    enqueue(job, delayMs) {
+        this.outstanding++;
+        const timer = setTimeout(async () => {
+            try {
+                await this.run(job);
+            }
+            finally {
+                this.outstanding--;
+                if (this.outstanding === 0)
+                    this.waiters.splice(0).forEach((resolve) => resolve());
+            }
+        }, delayMs);
+        timer.unref?.();
+    }
+    /** Resolves when no deliveries (including scheduled retries) are pending. */
+    idle() {
+        return this.outstanding === 0 ? Promise.resolve() : new Promise((resolve) => this.waiters.push(resolve));
+    }
+}
+const PRIVATE_HOST = /^(localhost|.*\.localhost|.*\.internal|127\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|169\.254\.\d+\.\d+|0\.0\.0\.0|\[::1?\]|\[f[cd][0-9a-f]*:.*\]|\[fe80:.*\])$/i;
+/** Throws if `url` is not an acceptable webhook target. */
+export function assertWebhookUrl(url, allowPrivateUrls = false) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid webhook URL "${url}".`);
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new Error('Webhook URLs must use http or https.');
+    }
+    if (!allowPrivateUrls && PRIVATE_HOST.test(parsed.hostname)) {
+        throw new Error(`Webhook URL host "${parsed.hostname}" is a private or local address. Set webhookDelivery.allowPrivateUrls to allow it.`);
+    }
+}
+/**
+ * Turns domain events into signed webhook deliveries with timeouts and exponential-backoff retries.
+ * Subscribed to the engine's event bus, so every published event is deliverable.
+ */
+export class WebhookDispatcher {
+    source;
+    options;
+    queue;
+    fetchImpl;
+    cache;
+    constructor(source, options = {}) {
+        this.source = source;
+        this.options = options;
+        this.queue = options.queue ?? new InProcessWebhookQueue((job) => this.deliver(job));
+        this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+    }
+    /** Drops cached webhooks; call after creating, updating or deleting one. */
+    invalidate() {
+        this.cache = undefined;
+    }
+    /** Resolves when the default in-process queue has nothing pending. */
+    idle() {
+        return this.queue instanceof InProcessWebhookQueue ? this.queue.idle() : Promise.resolve();
+    }
+    async handle(event) {
+        this.cache ??= this.source.listWebhooks().catch((err) => {
+            this.cache = undefined;
+            throw err;
+        });
+        const subscribed = (await this.cache).filter((w) => w.active && (w.events.includes('*') || w.events.includes(event.name)));
+        if (subscribed.length === 0)
+            return;
+        const tenantId = await this.source.resolveTenant(event);
+        const targets = subscribed.filter((w) => w.tenantId === tenantId);
+        if (targets.length === 0)
+            return;
+        const body = JSON.stringify({
+            id: event.id,
+            event: event.name,
+            occurredAt: event.occurredAt,
+            ...(tenantId ? { tenantId } : {}),
+            data: event.payload
+        });
+        for (const webhook of targets) {
+            await this.queue.enqueue({ id: `${event.id}:${webhook.id}`, webhookId: webhook.id, url: webhook.url, secret: webhook.secret, event: event.name, body, attempt: 1 }, 0);
+        }
+    }
+    /** Makes one delivery attempt, scheduling a retry (or reporting failure) if it does not succeed. */
+    async deliver(job) {
+        const maxAttempts = this.options.maxAttempts ?? 5;
+        try {
+            assertWebhookUrl(job.url, this.options.allowPrivateUrls);
+            const timestamp = Math.floor(Date.now() / 1000);
+            const headers = {
+                'Content-Type': 'application/json',
+                'User-Agent': 'CriticalPath-Webhooks/1',
+                'X-CriticalPath-Event': job.event,
+                'X-CriticalPath-Delivery': job.id,
+                'X-CriticalPath-Timestamp': String(timestamp)
+            };
+            if (job.secret) {
+                headers['X-CriticalPath-Signature'] = await signWebhookPayload({ secret: job.secret, body: job.body, timestamp });
+            }
+            const response = await this.fetchImpl(job.url, {
+                method: 'POST',
+                headers,
+                body: job.body,
+                signal: AbortSignal.timeout(this.options.timeoutMs ?? 10_000)
+            });
+            if (!response.ok)
+                throw new Error(`Webhook responded with HTTP ${response.status}`);
+            this.options.onDelivered?.(job, response.status);
+        }
+        catch (error) {
+            if (job.attempt < maxAttempts) {
+                const delay = (this.options.retryBaseDelayMs ?? 1_000) * 2 ** (job.attempt - 1);
+                await this.queue.enqueue({ ...job, attempt: job.attempt + 1 }, delay);
+            }
+            else if (this.options.onDeliveryFailed) {
+                this.options.onDeliveryFailed(job, error);
+            }
+            else {
+                console.warn(`[CriticalPath Webhooks] Giving up on delivery ${job.id} to ${job.url} after ${job.attempt} attempts:`, error);
+            }
+        }
+    }
+}
+//# sourceMappingURL=dispatcher.js.map

package/dist/webhooks/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/webhooks/dispatcher.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAoDpD,gGAAgG;AAChG,MAAM,OAAO,qBAAqB;IAIH;IAHrB,WAAW,GAAG,CAAC,CAAC;IAChB,OAAO,GAAsB,EAAE,CAAC;IAExC,YAA6B,GAA+C;QAA/C,QAAG,GAAH,GAAG,CAA4C;IAAG,CAAC;IAEhF,OAAO,CAAC,GAAuB,EAAE,OAAe;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,IAAI,IAAI,CAAC,WAAW,KAAK,CAAC;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC,EAAE,OAAO,CAAC,CAAC;QACX,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,6EAA6E;IAC7E,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3G,CAAC;CACF;AAED,MAAM,YAAY,GAAG,8MAA8M,CAAC;AAEpO,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,gBAAgB,GAAG,KAAK;IACpE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,gBAAgB,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,QAAQ,oFAAoF,CAAC,CAAC;IAC5I,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IAMT;IACA;IANF,KAAK,CAAuB;IAC5B,SAAS,CAAe;IACjC,KAAK,CAAsB;IAEnC,YACmB,MAAqB,EACrB,UAAkC,EAAE;QADpC,WAAM,GAAN,MAAM,CAAe;QACrB,YAAO,GAAP,OAAO,CAA6B;QAErD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,qBAAqB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,4EAA4E;IAC5E,UAAU;QACR,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,sEAAsE;IACtE,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB;QAC7B,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACtD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAiC,CAAC,CAAC,CAC1G,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,OAAO;SACpB,CAAC,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CACtB,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EACzI,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,OAAO,CAAC,GAAuB;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAChD,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,yBAAyB;gBACvC,sBAAsB,EAAE,GAAG,CAAC,KAAK;gBACjC,yBAAyB,EAAE,GAAG,CAAC,EAAE;gBACjC,0BAA0B,EAAE,MAAM,CAAC,SAAS,CAAC;aAC9C,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO,CAAC,0BAA0B,CAAC,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACpH,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,GAAG,CAAC,OAAO,GAAG,WAAW,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBAChF,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACzC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,iDAAiD,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,UAAU,GAAG,CAAC,OAAO,YAAY,EAAE,KAAK,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/webhooks/index.d.ts

@@ -0,0 +1,3 @@
+export * from './signature.js';
+export * from './dispatcher.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC"}

package/dist/webhooks/index.js

@@ -0,0 +1,3 @@
+export * from './signature.js';
+export * from './dispatcher.js';
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC"}

package/dist/webhooks/signature.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Webhook signing (HMAC-SHA256 over `"<timestamp>.<body>"`) using Web Crypto, so it works in
+ * Node, edge runtimes and browsers alike.
+ */
+/** Returns the `X-CriticalPath-Signature` header value: `sha256=<hex>`. */
+export declare function signWebhookPayload(input: {
+    secret: string;
+    body: string;
+    timestamp: number;
+}): Promise<string>;
+export interface VerifyWebhookSignatureInput {
+    secret: string;
+    /** The raw request body, exactly as received. */
+    body: string;
+    /** `X-CriticalPath-Timestamp` header (Unix seconds). */
+    timestamp: string | number;
+    /** `X-CriticalPath-Signature` header. */
+    signature: string;
+    /** Reject deliveries older or newer than this many seconds (replay protection). Default 300. */
+    toleranceSeconds?: number;
+    /** Current time in milliseconds, for tests. */
+    now?: number;
+}
+/** Verifies a delivery in a webhook receiver. */
+export declare function verifyWebhookSignature(input: VerifyWebhookSignatureInput): Promise<boolean>;
+/** Generates a random signing secret (`whsec_` + 64 hex characters). */
+export declare function generateWebhookSecret(): string;
+//# sourceMappingURL=signature.d.ts.map

package/dist/webhooks/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/webhooks/signature.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,2EAA2E;AAC3E,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpH;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iDAAiD;AACjD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjG;AAED,wEAAwE;AACxE,wBAAgB,qBAAqB,IAAI,MAAM,CAG9C"}

package/dist/webhooks/signature.js

@@ -0,0 +1,42 @@
+/**
+ * Webhook signing (HMAC-SHA256 over `"<timestamp>.<body>"`) using Web Crypto, so it works in
+ * Node, edge runtimes and browsers alike.
+ */
+const encoder = new TextEncoder();
+async function hmacHex(secret, message) {
+    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, [
+        'sign'
+    ]);
+    const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message));
+    return Array.from(new Uint8Array(signature), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/** Returns the `X-CriticalPath-Signature` header value: `sha256=<hex>`. */
+export async function signWebhookPayload(input) {
+    return `sha256=${await hmacHex(input.secret, `${input.timestamp}.${input.body}`)}`;
+}
+/** Verifies a delivery in a webhook receiver. */
+export async function verifyWebhookSignature(input) {
+    const timestamp = Number(input.timestamp);
+    if (!Number.isFinite(timestamp))
+        return false;
+    const tolerance = input.toleranceSeconds ?? 300;
+    const nowSeconds = Math.floor((input.now ?? Date.now()) / 1000);
+    if (Math.abs(nowSeconds - timestamp) > tolerance)
+        return false;
+    const expected = await signWebhookPayload({ secret: input.secret, body: input.body, timestamp });
+    return constantTimeEqual(expected, input.signature);
+}
+/** Generates a random signing secret (`whsec_` + 64 hex characters). */
+export function generateWebhookSecret() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    return `whsec_${Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')}`;
+}
+//# sourceMappingURL=signature.js.map

package/dist/webhooks/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/webhooks/signature.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,OAAe;IACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QACjH,MAAM;KACP,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA0D;IACjG,OAAO,UAAU,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC;AAgBD,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAkC;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACjG,OAAO,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC"}

package/dist/webhooks/webhooks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhooks.test.d.ts.map

package/dist/webhooks/webhooks.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhooks.test.ts"],"names":[],"mappings":""}

package/dist/webhooks/webhooks.test.js

@@ -0,0 +1,153 @@
+import { describe, it, expect } from 'vitest';
+import { CriticalPathEngine, SQLiteStore, createRolePolicy, ForbiddenError, ValidationError, signWebhookPayload, verifyWebhookSignature } from '../index.js';
+/** Engine whose webhook deliveries are captured instead of sent. `respond` decides each status. */
+function engineWithCapture(options = {}, config = {}) {
+    const deliveries = [];
+    const fetchMock = (async (url, init) => {
+        const rawBody = init.body;
+        deliveries.push({ url, headers: init.headers, body: JSON.parse(rawBody), rawBody });
+        return new Response(null, { status: options.respond?.(deliveries.length) ?? 200 });
+    });
+    const engine = new CriticalPathEngine({
+        ...config,
+        webhookDelivery: { retryBaseDelayMs: 1, ...options, fetch: options.fetch ?? fetchMock }
+    });
+    return { engine, deliveries };
+}
+describe('webhook signatures', () => {
+    it('signs and verifies, rejecting tampering and stale timestamps', async () => {
+        const timestamp = Math.floor(Date.now() / 1000);
+        const signature = await signWebhookPayload({ secret: 's3cret', body: '{"a":1}', timestamp });
+        expect(await verifyWebhookSignature({ secret: 's3cret', body: '{"a":1}', timestamp, signature })).toBe(true);
+        expect(await verifyWebhookSignature({ secret: 's3cret', body: '{"a":2}', timestamp, signature })).toBe(false);
+        expect(await verifyWebhookSignature({ secret: 'other', body: '{"a":1}', timestamp, signature })).toBe(false);
+        expect(await verifyWebhookSignature({ secret: 's3cret', body: '{"a":1}', timestamp, signature, now: (timestamp + 3600) * 1000 })).toBe(false);
+    });
+});
+describe('webhook delivery', () => {
+    it('delivers signed domain events to subscribed webhooks', async () => {
+        const { engine, deliveries } = engineWithCapture();
+        const { secret } = await engine.createWebhook({ name: 'CI', url: 'https://hooks.example.com/cp', events: ['task.created'] });
+        const project = await engine.createProject({ name: 'Hooks' });
+        const task = await engine.createTask({ projectId: project.id, title: 'Ship it' });
+        await engine.webhooks.idle();
+        expect(deliveries).toHaveLength(1);
+        const [delivery] = deliveries;
+        expect(delivery.headers['X-CriticalPath-Event']).toBe('task.created');
+        expect(delivery.body.data.task.id).toBe(task.id);
+        expect(await verifyWebhookSignature({
+            secret,
+            body: delivery.rawBody,
+            timestamp: delivery.headers['X-CriticalPath-Timestamp'],
+            signature: delivery.headers['X-CriticalPath-Signature']
+        })).toBe(true);
+    });
+    it('supports wildcard subscriptions and skips inactive webhooks', async () => {
+        const { engine, deliveries } = engineWithCapture();
+        await engine.createWebhook({ name: 'All', url: 'https://hooks.example.com/all', events: ['*'] });
+        const off = await engine.createWebhook({ name: 'Off', url: 'https://hooks.example.com/off', events: ['*'] });
+        await engine.updateWebhook(off.webhook.id, { active: false });
+        const project = await engine.createProject({ name: 'Wild' });
+        await engine.createTask({ projectId: project.id, title: 'T' });
+        await engine.webhooks.idle();
+        expect(deliveries.map((d) => d.body.event)).toEqual(['project.created', 'task.created']);
+        expect(deliveries.every((d) => d.url.endsWith('/all'))).toBe(true);
+    });
+    it('retries failed deliveries with backoff, then reports the final failure', async () => {
+        const failures = [];
+        const { engine, deliveries } = engineWithCapture({
+            maxAttempts: 3,
+            respond: () => 500,
+            onDeliveryFailed: (job) => failures.push(job.id)
+        });
+        await engine.createWebhook({ name: 'Flaky', url: 'https://hooks.example.com/flaky', events: ['project.created'] });
+        await engine.createProject({ name: 'Retry' });
+        await engine.webhooks.idle();
+        expect(deliveries).toHaveLength(3);
+        expect(new Set(deliveries.map((d) => d.headers['X-CriticalPath-Delivery'])).size).toBe(1);
+        expect(failures).toHaveLength(1);
+    });
+    it('stops retrying once a delivery succeeds', async () => {
+        const { engine, deliveries } = engineWithCapture({ respond: (n) => (n < 3 ? 503 : 200) });
+        await engine.createWebhook({ name: 'Eventually', url: 'https://hooks.example.com/ok', events: ['project.created'] });
+        await engine.createProject({ name: 'Recover' });
+        await engine.webhooks.idle();
+        expect(deliveries).toHaveLength(3);
+    });
+    it('times out hung receivers', async () => {
+        const failures = [];
+        const hanging = ((_url, init) => new Promise((_resolve, reject) => init.signal.addEventListener('abort', () => reject(init.signal.reason))));
+        const { engine } = engineWithCapture({ fetch: hanging, timeoutMs: 10, maxAttempts: 1, onDeliveryFailed: (_job, err) => failures.push(err) });
+        await engine.createWebhook({ name: 'Slow', url: 'https://hooks.example.com/slow', events: ['project.created'] });
+        await engine.createProject({ name: 'Timeout' });
+        await engine.webhooks.idle();
+        expect(failures).toHaveLength(1);
+    });
+    it('routes events only to webhooks in the same tenant, including deletions', async () => {
+        const { engine, deliveries } = engineWithCapture();
+        const acme = engine.withActor({ userId: 'a', tenantId: 'acme' });
+        const globex = engine.withActor({ userId: 'g', tenantId: 'globex' });
+        await acme.createWebhook({ name: 'Acme', url: 'https://hooks.example.com/acme', events: ['*'] });
+        await globex.createWebhook({ name: 'Globex', url: 'https://hooks.example.com/globex', events: ['*'] });
+        const project = await acme.createProject({ name: 'Acme only' });
+        await acme.createTask({ projectId: project.id, title: 'T' });
+        await acme.deleteProject(project.id);
+        await engine.webhooks.idle();
+        expect(deliveries.length).toBeGreaterThan(0);
+        expect(deliveries.every((d) => d.url.endsWith('/acme'))).toBe(true);
+        expect(deliveries.every((d) => d.body.tenantId === 'acme')).toBe(true);
+        expect(deliveries.map((d) => d.body.event)).toContain('project.deleted');
+    });
+    it('delivers to static webhooks from config', async () => {
+        const { engine, deliveries } = engineWithCapture({}, { webhooks: [{ name: 'Static', url: 'https://hooks.example.com/static', events: ['project.created'], active: true }] });
+        await engine.createProject({ name: 'Configured' });
+        await engine.webhooks.idle();
+        expect(deliveries).toHaveLength(1);
+    });
+});
+describe('webhook management', () => {
+    it('returns the secret once and redacts it from reads', async () => {
+        const { engine } = engineWithCapture();
+        const created = await engine.createWebhook({ name: 'Mine', url: 'https://hooks.example.com/x', events: ['*'] });
+        expect(created.secret).toMatch(/^whsec_[0-9a-f]{64}$/);
+        expect(created.webhook).not.toHaveProperty('secret');
+        expect(created.webhook.hasSecret).toBe(true);
+        const [listed] = await engine.getWebhooks();
+        expect(listed).not.toHaveProperty('secret');
+        expect(await engine.deleteWebhook(created.webhook.id)).toBe(true);
+        expect(await engine.getWebhooks()).toHaveLength(0);
+    });
+    it('rejects non-http and private URLs unless private URLs are allowed', async () => {
+        const { engine } = engineWithCapture();
+        await expect(engine.createWebhook({ name: 'x', url: 'ftp://hooks.example.com', events: ['*'] })).rejects.toThrow(ValidationError);
+        await expect(engine.createWebhook({ name: 'x', url: 'http://169.254.169.254/latest', events: ['*'] })).rejects.toThrow(/private/);
+        await expect(engine.createWebhook({ name: 'x', url: 'http://localhost:3000/hook', events: ['*'] })).rejects.toThrow(/private/);
+        const { engine: dev } = engineWithCapture({ allowPrivateUrls: true });
+        await expect(dev.createWebhook({ name: 'x', url: 'http://localhost:3000/hook', events: ['*'] })).resolves.toBeDefined();
+    });
+    it('requires workspace.manage under a role policy and scopes webhooks by tenant', async () => {
+        const { engine } = engineWithCapture({}, { authorize: createRolePolicy() });
+        const member = engine.withActor({ userId: 'm', tenantId: 'acme' });
+        const admin = engine.withActor({ userId: 'root', tenantId: 'acme', roles: ['admin'] });
+        const otherAdmin = engine.withActor({ userId: 'root2', tenantId: 'globex', roles: ['admin'] });
+        await expect(member.createWebhook({ name: 'x', url: 'https://hooks.example.com/x', events: ['*'] })).rejects.toThrow(ForbiddenError);
+        const { webhook } = await admin.createWebhook({ name: 'Acme', url: 'https://hooks.example.com/acme', events: ['*'] });
+        expect(webhook.tenantId).toBe('acme');
+        expect(await otherAdmin.getWebhooks()).toHaveLength(0);
+        expect(await otherAdmin.deleteWebhook(webhook.id)).toBe(false);
+    });
+    it('persists webhooks in SQLiteStore', async () => {
+        const engine = new CriticalPathEngine({ store: new SQLiteStore({ filename: ':memory:' }) });
+        const { webhook } = await engine.withActor({ userId: 'a', tenantId: 'acme' }).createWebhook({
+            name: 'Stored',
+            url: 'https://hooks.example.com/s',
+            events: ['task.created']
+        });
+        await engine.updateWebhook(webhook.id, { events: ['*'], name: 'Renamed' });
+        const stored = await engine.store.getWebhook(webhook.id);
+        expect(stored).toMatchObject({ name: 'Renamed', events: ['*'], tenantId: 'acme', active: true });
+        expect(stored?.secret).toMatch(/^whsec_/);
+        expect(await engine.deleteWebhook(webhook.id)).toBe(true);
+    });
+});
+//# sourceMappingURL=webhooks.test.js.map

package/dist/webhooks/webhooks.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.js","sourceRoot":"","sources":["../../src/webhooks/webhooks.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EAEvB,MAAM,aAAa,CAAC;AASrB,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,UAAwE,EAAE,EAAE,MAAM,GAAG,EAAE;IAChH,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,IAAiB,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAc,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAiC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9G,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACrF,CAAC,CAA4B,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC;QACpC,GAAG,MAAM;QACT,eAAe,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS,EAAE;KACxF,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7F,MAAM,CAAC,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7G,MAAM,CAAC,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9G,MAAM,CAAC,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7G,MAAM,CACJ,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAC1H,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,8BAA8B,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC7H,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CACJ,MAAM,sBAAsB,CAAC;YAC3B,MAAM;YACN,IAAI,EAAE,QAAQ,CAAC,OAAO;YACtB,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,0BAA0B,CAAC;YACvD,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACnD,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7G,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC;YAC/C,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG;YAClB,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,iCAAiC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACnH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,8BAA8B,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACrH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAY,EAAE,IAAiB,EAAE,EAAE,CACnD,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAA4B,CAAC;QAC3I,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7I,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,kCAAkC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEvG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAC9C,EAAE,EACF,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,kCAAkC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CACvH,CAAC;QACF,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClI,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClI,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE/H,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1H,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE/F,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACrI,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtH,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC;YAC1F,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,CAAC,cAAc,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@critical-path/core",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "description": "Core headless domain engine, plugin architecture, and data stores for Critical Path",
   "author": "Jack James",
   "license": "MIT",

package/src/domain/authorization.ts

@@ -0,0 +1,82 @@
+import type {
+  Actor,
+  AuthorizationAction,
+  AuthorizationPolicy,
+  AuthorizationRequest,
+  ProjectRole
+} from '../types/index.js';
+
+const VIEWER: AuthorizationAction[] = ['project.read'];
+const CONTRIBUTOR: AuthorizationAction[] = [
+  ...VIEWER,
+  'task.create',
+  'task.update',
+  'comment.create',
+  'attachment.create',
+  'time.log'
+];
+const PROJECT_MANAGER: AuthorizationAction[] = [
+  ...CONTRIBUTOR,
+  'task.delete',
+  'plan.manage',
+  'project.update',
+  'project.manage_members',
+  'comment.moderate',
+  'attachment.delete'
+];
+const PROJECT_ADMIN: AuthorizationAction[] = [...PROJECT_MANAGER, 'project.delete'];
+
+/** Actions each project role grants by default. */
+export const DEFAULT_ROLE_PERMISSIONS: Record<ProjectRole, readonly AuthorizationAction[]> = {
+  viewer: VIEWER,
+  contributor: CONTRIBUTOR,
+  project_manager: PROJECT_MANAGER,
+  admin: PROJECT_ADMIN
+};
+
+export interface RolePolicyOptions {
+  /** Override or extend the actions granted to each project role. */
+  rolePermissions?: Partial<Record<ProjectRole, readonly AuthorizationAction[]>>;
+  /** Workspace roles (from `actor.roles`) that may do anything within their tenant. Default `['admin']`. */
+  superuserRoles?: string[];
+  /**
+   * Who may create projects (they become the project's `admin`). Default: any actor except the
+   * anonymous one (`userId === 'anonymous'`).
+   */
+  canCreateProjects?: (actor: Actor) => boolean;
+  /** Who may manage workflows, teams and webhooks. Default: superusers only. */
+  canManageWorkspace?: (actor: Actor) => boolean;
+}
+
+/**
+ * Role-based policy driven by `project.members`. Members get their role's actions on that project;
+ * authors may edit and delete their own comments and attachments; workspace superusers may do
+ * everything. Everyone else is denied.
+ */
+export function createRolePolicy(options: RolePolicyOptions = {}): AuthorizationPolicy {
+  const permissions = { ...DEFAULT_ROLE_PERMISSIONS, ...options.rolePermissions };
+  const superuserRoles = options.superuserRoles ?? ['admin'];
+  const isSuperuser = (actor: Actor) => (actor.roles ?? []).some((r) => superuserRoles.includes(r));
+  const canCreateProjects = options.canCreateProjects ?? ((actor: Actor) => actor.userId !== 'anonymous');
+  const canManageWorkspace = options.canManageWorkspace ?? isSuperuser;
+
+  return ({ actor, action, project, resource }: AuthorizationRequest): boolean => {
+    if (isSuperuser(actor)) return true;
+    if (action === 'project.create') return canCreateProjects(actor);
+    if (action === 'workspace.manage') return canManageWorkspace(actor);
+    if (!project) return false;
+
+    const role = project.members?.find((m) => m.userId === actor.userId)?.role;
+    if (!role) return false;
+
+    const granted = permissions[role] ?? [];
+    if (granted.includes(action)) return true;
+
+    // Authors manage their own comments and attachments without moderator rights.
+    const ownsResource = resource?.ownerId !== undefined && resource.ownerId === actor.userId;
+    if (action === 'comment.moderate' && ownsResource && granted.includes('comment.create')) return true;
+    if (action === 'attachment.delete' && ownsResource && granted.includes('attachment.create')) return true;
+
+    return false;
+  };
+}

package/src/domain/entities.ts

@@ -1,4 +1,5 @@
 import type {
+  ProjectMember,
   Task,
   Project,
   Workflow,
@@ -524,7 +525,7 @@ export class ProjectEntity extends BaseEntity {
   public name: string;
   public description?: string;
   public ownerId?: string;
-  public members?: string[];
+  public members?: ProjectMember[];
   public teamIds?: string[];
   public workflowId?: string;
   public workflow?: Workflow;

package/src/domain/errors.ts

@@ -26,3 +26,13 @@ export class NotFoundError extends Error {
     this.name = 'NotFoundError';
   }
 }
+
+/**
+ * Thrown when the actor is not allowed to perform an action. Route handlers map it to HTTP 403.
+ */
+export class ForbiddenError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'ForbiddenError';
+  }
+}

package/src/domain/events.ts

@@ -114,7 +114,7 @@ export interface AttachmentCreatedEvent extends DomainEvent<{ attachment: Attach
   readonly aggregateType: 'Attachment';
 }
 
-export interface AttachmentDeletedEvent extends DomainEvent<{ attachmentId: string; storageKey?: string; url: string }> {
+export interface AttachmentDeletedEvent extends DomainEvent<{ attachmentId: string; storageKey?: string; url: string; projectId?: string }> {
   readonly name: 'attachment.deleted';
   readonly aggregateType: 'Attachment';
 }
@@ -134,7 +134,7 @@ export interface ProjectUpdatedEvent extends DomainEvent<{ project: Project; pre
   readonly aggregateType: 'Project';
 }
 
-export interface ProjectDeletedEvent extends DomainEvent<{ projectId: string; name: string; deletedTaskIds: string[] }> {
+export interface ProjectDeletedEvent extends DomainEvent<{ projectId: string; name: string; deletedTaskIds: string[]; tenantId?: string }> {
   readonly name: 'project.deleted';
   readonly aggregateType: 'Project';
 }
@@ -149,7 +149,7 @@ export interface WorkflowUpdatedEvent extends DomainEvent<{ workflow: Workflow;
   readonly aggregateType: 'Workflow';
 }
 
-export interface WorkflowDeletedEvent extends DomainEvent<{ workflowId: string; name: string }> {
+export interface WorkflowDeletedEvent extends DomainEvent<{ workflowId: string; name: string; tenantId?: string }> {
   readonly name: 'workflow.deleted';
   readonly aggregateType: 'Workflow';
 }
@@ -272,3 +272,42 @@ export class DomainEventBus {
     this.handlers.clear();
   }
 }
+
+/** Every domain event name, e.g. for validating webhook subscriptions at runtime. */
+export const DOMAIN_EVENT_NAMES = [
+  'attachment.created',
+  'attachment.deleted',
+  'comment.created',
+  'comment.deleted',
+  'comment.reaction.added',
+  'comment.reaction.removed',
+  'comment.updated',
+  'container.created',
+  'deliverable.created',
+  'deliverable.deleted',
+  'deliverable.status_changed',
+  'deliverable.updated',
+  'dependency.added',
+  'iteration.completed',
+  'iteration.started',
+  'project.created',
+  'project.deleted',
+  'project.updated',
+  'task.blocked',
+  'task.created',
+  'task.deleted',
+  'task.status_changed',
+  'task.unblocked',
+  'task.updated',
+  'team.created',
+  'time.logged',
+  'workflow.created',
+  'workflow.deleted',
+  'workflow.updated'
+] as const satisfies readonly CriticalPathDomainEvent['name'][];
+
+// Compile-time guard: adding an event to CriticalPathDomainEvent without listing it here fails the build.
+type UnlistedDomainEvent = Exclude<CriticalPathDomainEvent['name'], (typeof DOMAIN_EVENT_NAMES)[number]>;
+const _allDomainEventsListed: [UnlistedDomainEvent] extends [never] ? true : UnlistedDomainEvent = true;
+void _allDomainEventsListed;
+

package/src/domain/index.ts

@@ -2,6 +2,7 @@ export * from './events.js';
 export * from './custom-fields.js';
 export * from './graph.js';
 export * from './errors.js';
+export * from './authorization.js';
 export * from './entities.js';
 export * from './cpm.js';
 export * from './ladder.js';