@critical-path/core 0.26.0 → 0.27.0

package/dist/webhooks/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/webhooks/signature.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,OAAe;IACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QACjH,MAAM;KACP,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA0D;IACjG,OAAO,UAAU,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC;AAgBD,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAkC;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACjG,OAAO,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC"}

package/dist/webhooks/webhooks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhooks.test.d.ts.map

package/dist/webhooks/webhooks.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.d.ts","sourceRoot":"","sources":["../../src/webhooks/webhooks.test.ts"],"names":[],"mappings":""}

package/dist/webhooks/webhooks.test.js

@@ -0,0 +1,153 @@
+import { describe, it, expect } from 'vitest';
+import { CriticalPathEngine, SQLiteStore, createRolePolicy, ForbiddenError, ValidationError, signWebhookPayload, verifyWebhookSignature } from '../index.js';
+/** Engine whose webhook deliveries are captured instead of sent. `respond` decides each status. */
+function engineWithCapture(options = {}, config = {}) {
+    const deliveries = [];
+    const fetchMock = (async (url, init) => {
+        const rawBody = init.body;
+        deliveries.push({ url, headers: init.headers, body: JSON.parse(rawBody), rawBody });
+        return new Response(null, { status: options.respond?.(deliveries.length) ?? 200 });
+    });
+    const engine = new CriticalPathEngine({
+        ...config,
+        webhookDelivery: { retryBaseDelayMs: 1, ...options, fetch: options.fetch ?? fetchMock }
+    });
+    return { engine, deliveries };
+}
+describe('webhook signatures', () => {
+    it('signs and verifies, rejecting tampering and stale timestamps', async () => {
+        const timestamp = Math.floor(Date.now() / 1000);
+        const signature = await signWebhookPayload({ secret: 's3cret', body: '{"a":1}', timestamp });
+        expect(await verifyWebhookSignature({ secret: 's3cret', body: '{"a":1}', timestamp, signature })).toBe(true);
+        expect(await verifyWebhookSignature({ secret: 's3cret', body: '{"a":2}', timestamp, signature })).toBe(false);
+        expect(await verifyWebhookSignature({ secret: 'other', body: '{"a":1}', timestamp, signature })).toBe(false);
+        expect(await verifyWebhookSignature({ secret: 's3cret', body: '{"a":1}', timestamp, signature, now: (timestamp + 3600) * 1000 })).toBe(false);
+    });
+});
+describe('webhook delivery', () => {
+    it('delivers signed domain events to subscribed webhooks', async () => {
+        const { engine, deliveries } = engineWithCapture();
+        const { secret } = await engine.createWebhook({ name: 'CI', url: 'https://hooks.example.com/cp', events: ['task.created'] });
+        const project = await engine.createProject({ name: 'Hooks' });
+        const task = await engine.createTask({ projectId: project.id, title: 'Ship it' });
+        await engine.webhooks.idle();
+        expect(deliveries).toHaveLength(1);
+        const [delivery] = deliveries;
+        expect(delivery.headers['X-CriticalPath-Event']).toBe('task.created');
+        expect(delivery.body.data.task.id).toBe(task.id);
+        expect(await verifyWebhookSignature({
+            secret,
+            body: delivery.rawBody,
+            timestamp: delivery.headers['X-CriticalPath-Timestamp'],
+            signature: delivery.headers['X-CriticalPath-Signature']
+        })).toBe(true);
+    });
+    it('supports wildcard subscriptions and skips inactive webhooks', async () => {
+        const { engine, deliveries } = engineWithCapture();
+        await engine.createWebhook({ name: 'All', url: 'https://hooks.example.com/all', events: ['*'] });
+        const off = await engine.createWebhook({ name: 'Off', url: 'https://hooks.example.com/off', events: ['*'] });
+        await engine.updateWebhook(off.webhook.id, { active: false });
+        const project = await engine.createProject({ name: 'Wild' });
+        await engine.createTask({ projectId: project.id, title: 'T' });
+        await engine.webhooks.idle();
+        expect(deliveries.map((d) => d.body.event)).toEqual(['project.created', 'task.created']);
+        expect(deliveries.every((d) => d.url.endsWith('/all'))).toBe(true);
+    });
+    it('retries failed deliveries with backoff, then reports the final failure', async () => {
+        const failures = [];
+        const { engine, deliveries } = engineWithCapture({
+            maxAttempts: 3,
+            respond: () => 500,
+            onDeliveryFailed: (job) => failures.push(job.id)
+        });
+        await engine.createWebhook({ name: 'Flaky', url: 'https://hooks.example.com/flaky', events: ['project.created'] });
+        await engine.createProject({ name: 'Retry' });
+        await engine.webhooks.idle();
+        expect(deliveries).toHaveLength(3);
+        expect(new Set(deliveries.map((d) => d.headers['X-CriticalPath-Delivery'])).size).toBe(1);
+        expect(failures).toHaveLength(1);
+    });
+    it('stops retrying once a delivery succeeds', async () => {
+        const { engine, deliveries } = engineWithCapture({ respond: (n) => (n < 3 ? 503 : 200) });
+        await engine.createWebhook({ name: 'Eventually', url: 'https://hooks.example.com/ok', events: ['project.created'] });
+        await engine.createProject({ name: 'Recover' });
+        await engine.webhooks.idle();
+        expect(deliveries).toHaveLength(3);
+    });
+    it('times out hung receivers', async () => {
+        const failures = [];
+        const hanging = ((_url, init) => new Promise((_resolve, reject) => init.signal.addEventListener('abort', () => reject(init.signal.reason))));
+        const { engine } = engineWithCapture({ fetch: hanging, timeoutMs: 10, maxAttempts: 1, onDeliveryFailed: (_job, err) => failures.push(err) });
+        await engine.createWebhook({ name: 'Slow', url: 'https://hooks.example.com/slow', events: ['project.created'] });
+        await engine.createProject({ name: 'Timeout' });
+        await engine.webhooks.idle();
+        expect(failures).toHaveLength(1);
+    });
+    it('routes events only to webhooks in the same tenant, including deletions', async () => {
+        const { engine, deliveries } = engineWithCapture();
+        const acme = engine.withActor({ userId: 'a', tenantId: 'acme' });
+        const globex = engine.withActor({ userId: 'g', tenantId: 'globex' });
+        await acme.createWebhook({ name: 'Acme', url: 'https://hooks.example.com/acme', events: ['*'] });
+        await globex.createWebhook({ name: 'Globex', url: 'https://hooks.example.com/globex', events: ['*'] });
+        const project = await acme.createProject({ name: 'Acme only' });
+        await acme.createTask({ projectId: project.id, title: 'T' });
+        await acme.deleteProject(project.id);
+        await engine.webhooks.idle();
+        expect(deliveries.length).toBeGreaterThan(0);
+        expect(deliveries.every((d) => d.url.endsWith('/acme'))).toBe(true);
+        expect(deliveries.every((d) => d.body.tenantId === 'acme')).toBe(true);
+        expect(deliveries.map((d) => d.body.event)).toContain('project.deleted');
+    });
+    it('delivers to static webhooks from config', async () => {
+        const { engine, deliveries } = engineWithCapture({}, { webhooks: [{ name: 'Static', url: 'https://hooks.example.com/static', events: ['project.created'], active: true }] });
+        await engine.createProject({ name: 'Configured' });
+        await engine.webhooks.idle();
+        expect(deliveries).toHaveLength(1);
+    });
+});
+describe('webhook management', () => {
+    it('returns the secret once and redacts it from reads', async () => {
+        const { engine } = engineWithCapture();
+        const created = await engine.createWebhook({ name: 'Mine', url: 'https://hooks.example.com/x', events: ['*'] });
+        expect(created.secret).toMatch(/^whsec_[0-9a-f]{64}$/);
+        expect(created.webhook).not.toHaveProperty('secret');
+        expect(created.webhook.hasSecret).toBe(true);
+        const [listed] = await engine.getWebhooks();
+        expect(listed).not.toHaveProperty('secret');
+        expect(await engine.deleteWebhook(created.webhook.id)).toBe(true);
+        expect(await engine.getWebhooks()).toHaveLength(0);
+    });
+    it('rejects non-http and private URLs unless private URLs are allowed', async () => {
+        const { engine } = engineWithCapture();
+        await expect(engine.createWebhook({ name: 'x', url: 'ftp://hooks.example.com', events: ['*'] })).rejects.toThrow(ValidationError);
+        await expect(engine.createWebhook({ name: 'x', url: 'http://169.254.169.254/latest', events: ['*'] })).rejects.toThrow(/private/);
+        await expect(engine.createWebhook({ name: 'x', url: 'http://localhost:3000/hook', events: ['*'] })).rejects.toThrow(/private/);
+        const { engine: dev } = engineWithCapture({ allowPrivateUrls: true });
+        await expect(dev.createWebhook({ name: 'x', url: 'http://localhost:3000/hook', events: ['*'] })).resolves.toBeDefined();
+    });
+    it('requires workspace.manage under a role policy and scopes webhooks by tenant', async () => {
+        const { engine } = engineWithCapture({}, { authorize: createRolePolicy() });
+        const member = engine.withActor({ userId: 'm', tenantId: 'acme' });
+        const admin = engine.withActor({ userId: 'root', tenantId: 'acme', roles: ['admin'] });
+        const otherAdmin = engine.withActor({ userId: 'root2', tenantId: 'globex', roles: ['admin'] });
+        await expect(member.createWebhook({ name: 'x', url: 'https://hooks.example.com/x', events: ['*'] })).rejects.toThrow(ForbiddenError);
+        const { webhook } = await admin.createWebhook({ name: 'Acme', url: 'https://hooks.example.com/acme', events: ['*'] });
+        expect(webhook.tenantId).toBe('acme');
+        expect(await otherAdmin.getWebhooks()).toHaveLength(0);
+        expect(await otherAdmin.deleteWebhook(webhook.id)).toBe(false);
+    });
+    it('persists webhooks in SQLiteStore', async () => {
+        const engine = new CriticalPathEngine({ store: new SQLiteStore({ filename: ':memory:' }) });
+        const { webhook } = await engine.withActor({ userId: 'a', tenantId: 'acme' }).createWebhook({
+            name: 'Stored',
+            url: 'https://hooks.example.com/s',
+            events: ['task.created']
+        });
+        await engine.updateWebhook(webhook.id, { events: ['*'], name: 'Renamed' });
+        const stored = await engine.store.getWebhook(webhook.id);
+        expect(stored).toMatchObject({ name: 'Renamed', events: ['*'], tenantId: 'acme', active: true });
+        expect(stored?.secret).toMatch(/^whsec_/);
+        expect(await engine.deleteWebhook(webhook.id)).toBe(true);
+    });
+});
+//# sourceMappingURL=webhooks.test.js.map

package/dist/webhooks/webhooks.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.test.js","sourceRoot":"","sources":["../../src/webhooks/webhooks.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EAEvB,MAAM,aAAa,CAAC;AASrB,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,UAAwE,EAAE,EAAE,MAAM,GAAG,EAAE;IAChH,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAW,EAAE,IAAiB,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAc,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAiC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9G,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACrF,CAAC,CAA4B,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC;QACpC,GAAG,MAAM;QACT,eAAe,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS,EAAE;KACxF,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7F,MAAM,CAAC,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7G,MAAM,CAAC,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9G,MAAM,CAAC,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7G,MAAM,CACJ,MAAM,sBAAsB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAC1H,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,8BAA8B,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAC7H,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CACJ,MAAM,sBAAsB,CAAC;YAC3B,MAAM;YACN,IAAI,EAAE,QAAQ,CAAC,OAAO;YACtB,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,0BAA0B,CAAC;YACvD,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,0BAA0B,CAAC;SACxD,CAAC,CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACnD,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7G,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC;YAC/C,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG;YAClB,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,iCAAiC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACnH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,8BAA8B,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACrH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAY,EAAE,IAAiB,EAAE,EAAE,CACnD,IAAI,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAA4B,CAAC;QAC3I,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7I,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACjH,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,kCAAkC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEvG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE7B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAC9C,EAAE,EACF,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,kCAAkC,EAAE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CACvH,CAAC;QACF,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACvD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACvC,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,yBAAyB,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClI,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,+BAA+B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClI,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE/H,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1H,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE/F,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,6BAA6B,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACrI,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtH,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC;YAC1F,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,6BAA6B;YAClC,MAAM,EAAE,CAAC,cAAc,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@critical-path/core",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Core headless domain engine, plugin architecture, and data stores for Critical Path",
   "author": "Jack James",
   "license": "MIT",

package/src/domain/events.ts

@@ -114,7 +114,7 @@ export interface AttachmentCreatedEvent extends DomainEvent<{ attachment: Attach
   readonly aggregateType: 'Attachment';
 }
 
-export interface AttachmentDeletedEvent extends DomainEvent<{ attachmentId: string; storageKey?: string; url: string }> {
+export interface AttachmentDeletedEvent extends DomainEvent<{ attachmentId: string; storageKey?: string; url: string; projectId?: string }> {
   readonly name: 'attachment.deleted';
   readonly aggregateType: 'Attachment';
 }
@@ -134,7 +134,7 @@ export interface ProjectUpdatedEvent extends DomainEvent<{ project: Project; pre
   readonly aggregateType: 'Project';
 }
 
-export interface ProjectDeletedEvent extends DomainEvent<{ projectId: string; name: string; deletedTaskIds: string[] }> {
+export interface ProjectDeletedEvent extends DomainEvent<{ projectId: string; name: string; deletedTaskIds: string[]; tenantId?: string }> {
   readonly name: 'project.deleted';
   readonly aggregateType: 'Project';
 }
@@ -149,7 +149,7 @@ export interface WorkflowUpdatedEvent extends DomainEvent<{ workflow: Workflow;
   readonly aggregateType: 'Workflow';
 }
 
-export interface WorkflowDeletedEvent extends DomainEvent<{ workflowId: string; name: string }> {
+export interface WorkflowDeletedEvent extends DomainEvent<{ workflowId: string; name: string; tenantId?: string }> {
   readonly name: 'workflow.deleted';
   readonly aggregateType: 'Workflow';
 }
@@ -272,3 +272,42 @@ export class DomainEventBus {
     this.handlers.clear();
   }
 }
+
+/** Every domain event name, e.g. for validating webhook subscriptions at runtime. */
+export const DOMAIN_EVENT_NAMES = [
+  'attachment.created',
+  'attachment.deleted',
+  'comment.created',
+  'comment.deleted',
+  'comment.reaction.added',
+  'comment.reaction.removed',
+  'comment.updated',
+  'container.created',
+  'deliverable.created',
+  'deliverable.deleted',
+  'deliverable.status_changed',
+  'deliverable.updated',
+  'dependency.added',
+  'iteration.completed',
+  'iteration.started',
+  'project.created',
+  'project.deleted',
+  'project.updated',
+  'task.blocked',
+  'task.created',
+  'task.deleted',
+  'task.status_changed',
+  'task.unblocked',
+  'task.updated',
+  'team.created',
+  'time.logged',
+  'workflow.created',
+  'workflow.deleted',
+  'workflow.updated'
+] as const satisfies readonly CriticalPathDomainEvent['name'][];
+
+// Compile-time guard: adding an event to CriticalPathDomainEvent without listing it here fails the build.
+type UnlistedDomainEvent = Exclude<CriticalPathDomainEvent['name'], (typeof DOMAIN_EVENT_NAMES)[number]>;
+const _allDomainEventsListed: [UnlistedDomainEvent] extends [never] ? true : UnlistedDomainEvent = true;
+void _allDomainEventsListed;
+