@endora-commerce/mod-newsletter 0.100.0

package/dist/backend/services/tag.service.js

@@ -0,0 +1,79 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { NewsletterTag } from '../entities/newsletter-tag.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+/** Newsletter tag CRUD (feature 048, US3). */
+export class NewsletterTagService {
+    emFactory;
+    auditLog;
+    constructor(emFactory, auditLog) {
+        this.emFactory = emFactory;
+        this.auditLog = auditLog;
+    }
+    #audit(em, action, objectId, stateAfter) {
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, {
+                action,
+                objectType: 'newsletter_tag',
+                objectId,
+                stateBefore: null,
+                stateAfter,
+            });
+        }
+    }
+    async list() {
+        const em = this.emFactory();
+        const rows = await em.find(NewsletterTag, {}, { orderBy: { code: 'asc' } });
+        return rows.map((t) => this.toDto(t));
+    }
+    async create(input) {
+        const em = this.emFactory();
+        const existing = await em.findOne(NewsletterTag, { code: input.code });
+        if (existing)
+            throw new HttpError(409, ERROR_CODES.VALIDATION_FAILED, 'Tag code already exists.');
+        const tag = em.create(NewsletterTag, {
+            code: input.code,
+            name: input.name,
+            description: input.description ?? null,
+        });
+        em.persist(tag);
+        this.#audit(em, 'newsletter_tag.create', tag.id, { code: tag.code });
+        await em.flush();
+        return this.toDto(tag);
+    }
+    async update(id, input) {
+        const em = this.emFactory();
+        const tag = await em.findOne(NewsletterTag, { id });
+        if (!tag)
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Tag not found.');
+        if (input.name !== undefined)
+            tag.name = input.name;
+        if (input.description !== undefined)
+            tag.description = input.description;
+        this.#audit(em, 'newsletter_tag.update', tag.id, { name: tag.name });
+        await em.persistAndFlush(tag);
+        return this.toDto(tag);
+    }
+    async remove(id) {
+        const em = this.emFactory();
+        const tag = await em.findOne(NewsletterTag, { id });
+        if (!tag)
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Tag not found.');
+        // Guard: block delete if referenced by a campaign target or automation trigger.
+        const refs = (await em.getConnection().execute(`select 1 from newsletter_campaigns where target_tag_ids @> ?::jsonb
+       union all
+       select 1 from newsletter_automations where trigger_tag_ids @> ?::jsonb limit 1`, [JSON.stringify([id]), JSON.stringify([id])], 'all', em.getTransactionContext()));
+        if (refs.length > 0) {
+            throw new HttpError(409, ERROR_CODES.VALIDATION_FAILED, 'Tag is used by a campaign or automation.', {
+                code: 'tag_in_use',
+            });
+        }
+        // Subscriber-tag bridge rows cascade via FK.
+        this.#audit(em, 'newsletter_tag.delete', tag.id, null);
+        await em.removeAndFlush(tag);
+    }
+    toDto(t) {
+        return { id: t.id, code: t.code, name: t.name, description: t.description };
+    }
+}
+//# sourceMappingURL=tag.service.js.map

package/dist/backend/services/tag.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag.service.js","sourceRoot":"","sources":["../../../src/backend/services/tag.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAA4G,MAAM,4BAA4B,CAAC;AACnK,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAG5E,8CAA8C;AAC9C,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,SAA8B,EAC9B,QAAoB;QADpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,MAAM,CAAC,EAAiB,EAAE,MAAc,EAAE,QAAgB,EAAE,UAA0C;QACpG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxC,MAAM;gBACN,UAAU,EAAE,gBAAgB;gBAC5B,QAAQ;gBACR,WAAW,EAAE,IAAI;gBACjB,UAAU;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,IAAI,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;QAClG,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;SACvC,CAAC,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,uBAAuB,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAiC;QACxD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACpD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,uBAAuB,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC5E,gFAAgF;QAChF,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAC5C;;sFAEgF,EAChF,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,KAAK,EACL,EAAE,CAAC,qBAAqB,EAAE,CAC3B,CAAc,CAAC;QAChB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,iBAAiB,EAAE,0CAA0C,EAAE;gBAClG,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;QACL,CAAC;QACD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,uBAAuB,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,CAAgB;QAC5B,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/backend/services/token.helper.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Signed, TTL-bounded tokens for the newsletter public surface (feature 048,
+ * research R5/R10). One helper mints/verifies all four token purposes so the
+ * confirm/unsubscribe/open/click links share a single HMAC secret and format.
+ *
+ * Token format: `base64url(payloadJson).base64url(hmacSha256(payloadJson))`.
+ * The payload always carries `{ p: purpose, exp: epochSeconds, ...claims }`.
+ */
+export type NewsletterTokenPurpose = 'confirm' | 'unsubscribe' | 'open' | 'click';
+export interface NewsletterTokenClaims {
+    /** Subscriber id (confirm/unsubscribe) or send-record id (open/click). */
+    id: string;
+    /** Optional link id for click tracking. */
+    linkId?: string;
+}
+export declare class NewsletterTokenHelper {
+    private readonly secret;
+    constructor(secret: string);
+    private sign;
+    /**
+     * Mint a token. `ttlSeconds` bounds validity; `nowSeconds` is injectable for
+     * deterministic tests (defaults to the current time).
+     */
+    mint(purpose: NewsletterTokenPurpose, claims: NewsletterTokenClaims, ttlSeconds: number, nowSeconds?: number): string;
+    /**
+     * Verify a token against the expected purpose. Returns the claims on success,
+     * or `null` when the signature is invalid, the purpose mismatches, the token
+     * is malformed, or it has expired.
+     */
+    verify(token: string, purpose: NewsletterTokenPurpose, nowSeconds?: number): NewsletterTokenClaims | null;
+}
+//# sourceMappingURL=token.helper.d.ts.map

package/dist/backend/services/token.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.helper.d.ts","sourceRoot":"","sources":["../../../src/backend/services/token.helper.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC;AAElF,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgBD,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAM3C,OAAO,CAAC,IAAI;IAIZ;;;OAGG;IACH,IAAI,CACF,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,qBAAqB,EAC7B,UAAU,EAAE,MAAM,EAClB,UAAU,GAAE,MAAsC,GACjD,MAAM;IAYT;;;;OAIG;IACH,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,sBAAsB,EAC/B,UAAU,GAAE,MAAsC,GACjD,qBAAqB,GAAG,IAAI;CAgChC"}

package/dist/backend/services/token.helper.js

@@ -0,0 +1,76 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+function b64urlEncode(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function b64urlDecode(s) {
+    const pad = s.length % 4 === 0 ? '' : '='.repeat(4 - (s.length % 4));
+    return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/') + pad, 'base64');
+}
+export class NewsletterTokenHelper {
+    secret;
+    constructor(secret) {
+        this.secret = secret;
+        if (!secret) {
+            throw new Error('[newsletter] token secret must be a non-empty string');
+        }
+    }
+    sign(payloadJson) {
+        return b64urlEncode(createHmac('sha256', this.secret).update(payloadJson).digest());
+    }
+    /**
+     * Mint a token. `ttlSeconds` bounds validity; `nowSeconds` is injectable for
+     * deterministic tests (defaults to the current time).
+     */
+    mint(purpose, claims, ttlSeconds, nowSeconds = Math.floor(Date.now() / 1000)) {
+        const payload = {
+            p: purpose,
+            exp: nowSeconds + ttlSeconds,
+            id: claims.id,
+            ...(claims.linkId !== undefined ? { linkId: claims.linkId } : {}),
+        };
+        const payloadJson = JSON.stringify(payload);
+        const body = b64urlEncode(Buffer.from(payloadJson, 'utf8'));
+        return `${body}.${this.sign(payloadJson)}`;
+    }
+    /**
+     * Verify a token against the expected purpose. Returns the claims on success,
+     * or `null` when the signature is invalid, the purpose mismatches, the token
+     * is malformed, or it has expired.
+     */
+    verify(token, purpose, nowSeconds = Math.floor(Date.now() / 1000)) {
+        const dot = token.indexOf('.');
+        if (dot <= 0)
+            return null;
+        const body = token.slice(0, dot);
+        const sig = token.slice(dot + 1);
+        let payloadJson;
+        try {
+            payloadJson = b64urlDecode(body).toString('utf8');
+        }
+        catch {
+            return null;
+        }
+        const expectedSig = this.sign(payloadJson);
+        const a = Buffer.from(sig);
+        const b = Buffer.from(expectedSig);
+        if (a.length !== b.length || !timingSafeEqual(a, b))
+            return null;
+        let payload;
+        try {
+            payload = JSON.parse(payloadJson);
+        }
+        catch {
+            return null;
+        }
+        if (payload.p !== purpose)
+            return null;
+        if (typeof payload.exp !== 'number' || payload.exp < nowSeconds)
+            return null;
+        if (typeof payload.id !== 'string' || payload.id.length === 0)
+            return null;
+        return payload.linkId !== undefined
+            ? { id: payload.id, linkId: payload.linkId }
+            : { id: payload.id };
+    }
+}
+//# sourceMappingURL=token.helper.js.map

package/dist/backend/services/token.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.helper.js","sourceRoot":"","sources":["../../../src/backend/services/token.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAwB1D,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,WAAmB;QAC9B,OAAO,YAAY,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;OAGG;IACH,IAAI,CACF,OAA+B,EAC/B,MAA6B,EAC7B,UAAkB,EAClB,aAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAElD,MAAM,OAAO,GAAiB;YAC5B,CAAC,EAAE,OAAO;YACV,GAAG,EAAE,UAAU,GAAG,UAAU;YAC5B,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,MAAM,CACJ,KAAa,EACb,OAA+B,EAC/B,aAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAElD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEjC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjE,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAiB,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3E,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;YAC5C,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/backend/services/tracking.service.d.ts

@@ -0,0 +1,14 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+/**
+ * Engagement tracking (feature 048, US6). Records open + click events against a
+ * send record and maintains the denormalized counters the stats service reads.
+ * Token minting/verification lives in NewsletterTokenHelper; the routes verify
+ * the signed token then call these methods with the resolved send-record id.
+ */
+export declare class NewsletterTrackingService {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    recordOpen(sendRecordId: string): Promise<void>;
+    recordClick(sendRecordId: string, linkId: string | null, url: string | null): Promise<void>;
+}
+//# sourceMappingURL=tracking.service.d.ts.map

package/dist/backend/services/tracking.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracking.service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/tracking.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAI3D;;;;;GAKG;AACH,qBAAa,yBAAyB;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/C,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBlG"}

package/dist/backend/services/tracking.service.js

@@ -0,0 +1,45 @@
+import { NewsletterSendRecord } from '../entities/newsletter-send-record.entity.js';
+import { NewsletterEngagementEvent } from '../entities/newsletter-engagement-event.entity.js';
+/**
+ * Engagement tracking (feature 048, US6). Records open + click events against a
+ * send record and maintains the denormalized counters the stats service reads.
+ * Token minting/verification lives in NewsletterTokenHelper; the routes verify
+ * the signed token then call these methods with the resolved send-record id.
+ */
+export class NewsletterTrackingService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async recordOpen(sendRecordId) {
+        // command-coverage-ignore: engagement telemetry — records an email open,
+        // high-volume delivery tracking, not an audited domain-state mutation.
+        const em = this.emFactory();
+        const record = await em.findOne(NewsletterSendRecord, { id: sendRecordId });
+        if (!record)
+            return;
+        em.create(NewsletterEngagementEvent, { sendRecordId, type: 'open' });
+        if (record.openedAt === null)
+            record.openedAt = new Date();
+        await em.flush();
+    }
+    async recordClick(sendRecordId, linkId, url) {
+        // command-coverage-ignore: engagement telemetry — records a link click,
+        // high-volume delivery tracking, not an audited domain-state mutation.
+        const em = this.emFactory();
+        const record = await em.findOne(NewsletterSendRecord, { id: sendRecordId });
+        if (!record)
+            return;
+        em.create(NewsletterEngagementEvent, {
+            sendRecordId,
+            type: 'click',
+            linkId,
+            url,
+        });
+        record.clickCount += 1;
+        if (record.openedAt === null)
+            record.openedAt = new Date();
+        await em.flush();
+    }
+}
+//# sourceMappingURL=tracking.service.js.map

package/dist/backend/services/tracking.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracking.service.js","sourceRoot":"","sources":["../../../src/backend/services/tracking.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,UAAU,CAAC,YAAoB;QACnC,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,EAAE,CAAC,MAAM,CAAC,yBAAyB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3D,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,YAAoB,EAAE,MAAqB,EAAE,GAAkB;QAC/E,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,EAAE,CAAC,MAAM,CAAC,yBAAyB,EAAE;YACnC,YAAY;YACZ,IAAI,EAAE,OAAO;YACb,MAAM;YACN,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC3D,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;CACF"}

package/dist/manifest.d.ts

@@ -0,0 +1,192 @@
+/**
+ * Newsletter module (feature 048). Owns the subscriber list, tags, custom
+ * fields, campaigns, linear automations, reusable email-safe blocks, the
+ * bulk-sending provider (SMTP / Amazon SES via nodemailer), and engagement
+ * tracking. Bulk delivery is independent of the transactional-email transport.
+ * The SMTP connection + credentials come from a reusable `email_adapter`
+ * credential configuration referenced by `newsletter.email_credentials`
+ * (feature 058); when unset, dispatch uses the console (dev) sink.
+ */
+export declare const newsletterSettingsManifest: {
+    moduleCode: string;
+    groups: {
+        code: string;
+        name: string;
+        salesChannelCodes?: string[] | undefined;
+        isSystemProtected?: boolean | undefined;
+    }[];
+    settings: {
+        code: string;
+        name: string;
+        valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+        defaultValue: unknown;
+        description?: string | undefined;
+        groupCode?: string | undefined;
+        previousDefaultValues?: unknown[] | undefined;
+        salesChannelCodes?: string[] | undefined;
+        enumOptions?: string[] | undefined;
+        configurationType?: string | undefined;
+        hidden?: boolean | undefined;
+    }[];
+};
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("newsletter" | "cms" | "email" | "invoice")[];
+        fields: Record<string, {
+            type: "number" | "object" | "array" | "text" | "textarea" | "select" | "radio" | "external" | "uuid" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("newsletter" | "cms" | "email" | "invoice")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;CAqErC,CAAC;AAEH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmInB,CAAC"}