@headless-lms/core 0.1.0 → 0.2.0

package/dist/assets/events.d.ts

@@ -13,6 +13,7 @@ declare const assetEvents: {
     status: "pending" | "ready";
     uploadedBy: string;
     createdAt: Date;
+    updatedAt: Date;
   }, "asset.created", 1>, {
     orgId: string;
     id: string;
@@ -24,7 +25,27 @@ declare const assetEvents: {
     status: "pending" | "ready";
     uploadedBy: string;
     createdAt: unknown;
-  }>;
+    updatedAt: unknown;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    kind: import("zod").ZodEnum<{
+      video: "video";
+      download: "download";
+      content: "content";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    status: import("zod").ZodEnum<{
+      pending: "pending";
+      ready: "ready";
+    }>;
+    uploadedBy: import("zod").ZodString;
+    key: import("zod").ZodString;
+    filename: import("zod").ZodString;
+    contentType: import("zod").ZodString;
+    size: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
   assetReady: RuntimeEventDefinition<VersionedDomainEvent<{
     orgId: string;
     id: string;
@@ -36,6 +57,7 @@ declare const assetEvents: {
     status: "pending" | "ready";
     uploadedBy: string;
     createdAt: Date;
+    updatedAt: Date;
   }, "asset.ready", 1>, {
     orgId: string;
     id: string;
@@ -47,7 +69,27 @@ declare const assetEvents: {
     status: "pending" | "ready";
     uploadedBy: string;
     createdAt: unknown;
-  }>;
+    updatedAt: unknown;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    kind: import("zod").ZodEnum<{
+      video: "video";
+      download: "download";
+      content: "content";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    status: import("zod").ZodEnum<{
+      pending: "pending";
+      ready: "ready";
+    }>;
+    uploadedBy: import("zod").ZodString;
+    key: import("zod").ZodString;
+    filename: import("zod").ZodString;
+    contentType: import("zod").ZodString;
+    size: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
   assetDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
     orgId: string;
     id: string;
@@ -59,6 +101,7 @@ declare const assetEvents: {
     status: "pending" | "ready";
     uploadedBy: string;
     createdAt: Date;
+    updatedAt: Date;
   }, "asset.deleted", 1>, {
     orgId: string;
     id: string;
@@ -70,7 +113,27 @@ declare const assetEvents: {
     status: "pending" | "ready";
     uploadedBy: string;
     createdAt: unknown;
-  }>;
+    updatedAt: unknown;
+  }, import("zod").ZodObject<{
+    orgId: import("zod").ZodString;
+    id: import("zod").ZodString;
+    kind: import("zod").ZodEnum<{
+      video: "video";
+      download: "download";
+      content: "content";
+    }>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    status: import("zod").ZodEnum<{
+      pending: "pending";
+      ready: "ready";
+    }>;
+    uploadedBy: import("zod").ZodString;
+    key: import("zod").ZodString;
+    filename: import("zod").ZodString;
+    contentType: import("zod").ZodString;
+    size: import("zod").ZodNumber;
+  }, import("zod/v4/core").$strip>>;
 };
 type AssetCreated = EventOf<typeof assetEvents.assetCreated>;
 type AssetReady = EventOf<typeof assetEvents.assetReady>;

package/dist/assets/events.js

@@ -1,21 +1,37 @@
 import { assetSchema } from "../types/schemas/assets.js";
 import { defineEvent } from "../shared/events.js";
 //#region src/assets/events.ts
+const publicAsset = assetSchema.pick({
+	orgId: true,
+	id: true,
+	key: true,
+	kind: true,
+	filename: true,
+	contentType: true,
+	size: true,
+	status: true,
+	uploadedBy: true,
+	createdAt: true,
+	updatedAt: true
+}).strip();
 const assetEvents = {
 	assetCreated: defineEvent({
 		type: "asset.created",
 		version: 1,
-		data: assetSchema
+		data: assetSchema,
+		publicData: publicAsset
 	}),
 	assetReady: defineEvent({
 		type: "asset.ready",
 		version: 1,
-		data: assetSchema
+		data: assetSchema,
+		publicData: publicAsset
 	}),
 	assetDeleted: defineEvent({
 		type: "asset.deleted",
 		version: 1,
-		data: assetSchema
+		data: assetSchema,
+		publicData: publicAsset
 	})
 };
 //#endregion

package/dist/assets/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","names":[],"sources":["../../src/assets/events.ts"],"sourcesContent":["import { assetSchema } from '../types/schemas/index.js';\nimport { defineEvent, type EventOf, type EventOfValues } from '../shared/ports.js';\n\nexport const assetEvents = {\n  assetCreated: defineEvent({\n    type: 'asset.created',\n    version: 1,\n    data: assetSchema,\n  }),\n  assetReady: defineEvent({\n    type: 'asset.ready',\n    version: 1,\n    data: assetSchema,\n  }),\n  assetDeleted: defineEvent({\n    type: 'asset.deleted',\n    version: 1,\n    data: assetSchema,\n  }),\n};\n\nexport type AssetCreated = EventOf<typeof assetEvents.assetCreated>;\nexport type AssetReady = EventOf<typeof assetEvents.assetReady>;\nexport type AssetDeleted = EventOf<typeof assetEvents.assetDeleted>;\nexport type AssetEvent = EventOfValues<typeof assetEvents>;\n"],"mappings":";;;AAGA,MAAa,cAAc;CACzB,cAAc,YAAY;EACxB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,YAAY,YAAY;EACtB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;CACD,cAAc,YAAY;EACxB,MAAM;EACN,SAAS;EACT,MAAM;CACR,CAAC;AACH"}
+{"version":3,"file":"events.js","names":[],"sources":["../../src/assets/events.ts"],"sourcesContent":["import { assetSchema } from '../types/schemas/index.js';\nimport { defineEvent, type EventOf, type EventOfValues } from '../shared/ports.js';\n\nconst publicAsset = assetSchema\n  .pick({\n    orgId: true,\n    id: true,\n    key: true,\n    kind: true,\n    filename: true,\n    contentType: true,\n    size: true,\n    status: true,\n    uploadedBy: true,\n    createdAt: true,\n    updatedAt: true,\n  })\n  .strip();\n\nexport const assetEvents = {\n  assetCreated: defineEvent({\n    type: 'asset.created',\n    version: 1,\n    data: assetSchema,\n    publicData: publicAsset,\n  }),\n  assetReady: defineEvent({\n    type: 'asset.ready',\n    version: 1,\n    data: assetSchema,\n    publicData: publicAsset,\n  }),\n  assetDeleted: defineEvent({\n    type: 'asset.deleted',\n    version: 1,\n    data: assetSchema,\n    publicData: publicAsset,\n  }),\n};\n\nexport type AssetCreated = EventOf<typeof assetEvents.assetCreated>;\nexport type AssetReady = EventOf<typeof assetEvents.assetReady>;\nexport type AssetDeleted = EventOf<typeof assetEvents.assetDeleted>;\nexport type AssetEvent = EventOfValues<typeof assetEvents>;\n"],"mappings":";;;AAGA,MAAM,cAAc,YACjB,KAAK;CACJ,OAAO;CACP,IAAI;CACJ,KAAK;CACL,MAAM;CACN,UAAU;CACV,aAAa;CACb,MAAM;CACN,QAAQ;CACR,YAAY;CACZ,WAAW;CACX,WAAW;AACb,CAAC,CAAC,CACD,MAAM;AAET,MAAa,cAAc;CACzB,cAAc,YAAY;EACxB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,YAAY,YAAY;EACtB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;CACD,cAAc,YAAY;EACxB,MAAM;EACN,SAAS;EACT,MAAM;EACN,YAAY;CACd,CAAC;AACH"}

package/dist/assets/service.js

@@ -1,6 +1,6 @@
-import { assetEvents } from "./events.js";
-import { genId } from "../shared/id.js";
 import { noopLogger } from "../shared/logger.js";
+import { genId } from "../shared/id.js";
+import { assetEvents } from "./events.js";
 //#region src/assets/service.ts
 function orgPrefix(orgId) {
 	return `org/${orgId}/`;
@@ -26,6 +26,7 @@ var AssetsServiceImpl = class {
 			key,
 			contentType: input.contentType
 		});
+		const now = /* @__PURE__ */ new Date();
 		const asset = await this.uow.run(async ({ assets, outbox }) => {
 			const asset = await assets.insert(orgId, {
 				orgId,
@@ -37,7 +38,8 @@ var AssetsServiceImpl = class {
 				size: 0,
 				status: "pending",
 				uploadedBy: input.uploadedBy,
-				createdAt: /* @__PURE__ */ new Date()
+				createdAt: now,
+				updatedAt: now
 			});
 			await outbox.append([assetEvents.assetCreated.make({
 				orgId,

package/dist/assets/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/assets/service.ts"],"sourcesContent":["// assets context — service. Owns org-scoped key construction and the asset\n// lifecycle (register → upload → confirm → serve → remove); delegates the\n// actual object operations to the ObjectStorage port. Org isolation is enforced\n// by scoping every lookup to the caller's org (cross-org reads return null).\nimport { genId } from '../shared/id.js';\nimport type { Logger, ObjectStorage } from '../shared/ports.js';\nimport type {\n  Asset,\n  AssetsQuery,\n  DownloadTicket,\n  Page,\n  RequestUploadInput,\n  UploadTicket,\n} from './model.js';\nimport type { AssetsRepository, AssetsService, AssetsUnitOfWork } from './ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { assetEvents } from './events.js';\n\nfunction orgPrefix(orgId: string): string {\n  return `org/${orgId}/`;\n}\n\nfunction sanitizeFilename(filename: string): string {\n  const base = filename.split(/[\\\\/]/).pop() ?? 'file';\n  return base.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 120) || 'file';\n}\n\nexport type AssetsServiceParams = {\n  storage: ObjectStorage;\n  repo: AssetsRepository;\n  uow: AssetsUnitOfWork;\n  logger?: Logger;\n};\n\nexport class AssetsServiceImpl implements AssetsService {\n  private readonly storage: ObjectStorage;\n  private readonly repo: AssetsRepository;\n  private readonly uow: AssetsUnitOfWork;\n  private readonly logger: Logger;\n\n  constructor(params: AssetsServiceParams) {\n    this.storage = params.storage;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  async requestUpload(orgId: string, input: RequestUploadInput): Promise<UploadTicket> {\n    const id = genId('asset');\n    const key = `${orgPrefix(orgId)}${input.kind}/${id}/${sanitizeFilename(input.filename)}`;\n    const presigned = await this.storage.presignUpload({ key, contentType: input.contentType });\n    const asset = await this.uow.run(async ({ assets, outbox }) => {\n      const asset = await assets.insert(orgId, {\n        orgId,\n        id,\n        key,\n        kind: input.kind,\n        filename: input.filename,\n        contentType: input.contentType,\n        size: 0,\n        status: 'pending',\n        uploadedBy: input.uploadedBy,\n        createdAt: new Date(),\n      });\n      await outbox.append([assetEvents.assetCreated.make({ orgId, data: asset })]);\n      return asset;\n    });\n    this.logger.info('asset upload requested', { orgId, assetId: id, kind: input.kind });\n    return {\n      asset,\n      uploadUrl: presigned.url,\n      method: 'PUT',\n      expiresInSeconds: presigned.expiresInSeconds,\n      headers: presigned.headers,\n    };\n  }\n\n  async confirm(orgId: string, id: string): Promise<Asset | null> {\n    const asset = await this.repo.findById(orgId, id);\n    if (!asset) {\n      return null;\n    }\n    const stat = await this.storage.stat(asset.key);\n    if (!stat) {\n      this.logger.debug('asset not yet uploaded', { orgId, assetId: id });\n      return asset; // not uploaded yet — stays pending\n    }\n    const updated = await this.uow.run(async ({ assets, outbox }) => {\n      const updated = await assets.update(id, {\n        size: stat.size,\n        contentType: stat.contentType ?? asset.contentType,\n        status: 'ready',\n      });\n      if (updated) {\n        await outbox.append([assetEvents.assetReady.make({ orgId, data: updated })]);\n      }\n      return updated;\n    });\n    this.logger.info('asset confirmed', { orgId, assetId: id });\n    return updated;\n  }\n\n  list(orgId: string, query: AssetsQuery): Promise<Page<Asset>> {\n    return this.repo.list(orgId, query);\n  }\n\n  get(orgId: string, id: string): Promise<Asset | null> {\n    return this.repo.findById(orgId, id);\n  }\n\n  async requestDownload(\n    orgId: string,\n    id: string,\n    filename?: string,\n    expiresInSeconds?: number,\n  ): Promise<DownloadTicket | null> {\n    const asset = await this.repo.findById(orgId, id);\n    if (!asset) {\n      return null;\n    }\n    const url = await this.storage.presignDownload({\n      key: asset.key,\n      downloadFilename: filename ?? asset.filename,\n      ...(expiresInSeconds === undefined ? {} : { expiresInSeconds }),\n    });\n    return { url, asset };\n  }\n\n  async remove(orgId: string, id: string): Promise<boolean> {\n    const asset = await this.repo.findById(orgId, id);\n    if (!asset) {\n      return false;\n    }\n    await this.storage.remove(asset.key);\n    const deleted = await this.uow.run(async ({ assets, outbox }) => {\n      const deleted = await assets.delete(id);\n      if (deleted) {\n        await outbox.append([assetEvents.assetDeleted.make({ orgId, data: asset })]);\n      }\n      return deleted;\n    });\n    this.logger.info('asset removed', { orgId, assetId: id });\n    return deleted;\n  }\n}\n"],"mappings":";;;;AAkBA,SAAS,UAAU,OAAuB;CACxC,OAAO,OAAO,MAAM;AACtB;AAEA,SAAS,iBAAiB,UAA0B;CAElD,QADa,SAAS,MAAM,OAAO,CAAC,CAAC,IAAI,KAAK,OAAA,CAClC,QAAQ,oBAAoB,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,KAAK;AAChE;AASA,IAAa,oBAAb,MAAwD;CACtD;CACA;CACA;CACA;CAEA,YAAY,QAA6B;EACvC,KAAK,UAAU,OAAO;EACtB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,MAAM,cAAc,OAAe,OAAkD;EACnF,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,MAAM,GAAG,UAAU,KAAK,IAAI,MAAM,KAAK,GAAG,GAAG,GAAG,iBAAiB,MAAM,QAAQ;EACrF,MAAM,YAAY,MAAM,KAAK,QAAQ,cAAc;GAAE;GAAK,aAAa,MAAM;EAAY,CAAC;EAC1F,MAAM,QAAQ,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,QAAQ,aAAa;GAC7D,MAAM,QAAQ,MAAM,OAAO,OAAO,OAAO;IACvC;IACA;IACA;IACA,MAAM,MAAM;IACZ,UAAU,MAAM;IAChB,aAAa,MAAM;IACnB,MAAM;IACN,QAAQ;IACR,YAAY,MAAM;IAClB,2BAAW,IAAI,KAAK;GACtB,CAAC;GACD,MAAM,OAAO,OAAO,CAAC,YAAY,aAAa,KAAK;IAAE;IAAO,MAAM;GAAM,CAAC,CAAC,CAAC;GAC3E,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GAAE;GAAO,SAAS;GAAI,MAAM,MAAM;EAAK,CAAC;EACnF,OAAO;GACL;GACA,WAAW,UAAU;GACrB,QAAQ;GACR,kBAAkB,UAAU;GAC5B,SAAS,UAAU;EACrB;CACF;CAEA,MAAM,QAAQ,OAAe,IAAmC;EAC9D,MAAM,QAAQ,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,MAAM,GAAG;EAC9C,IAAI,CAAC,MAAM;GACT,KAAK,OAAO,MAAM,0BAA0B;IAAE;IAAO,SAAS;GAAG,CAAC;GAClE,OAAO;EACT;EACA,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,QAAQ,aAAa;GAC/D,MAAM,UAAU,MAAM,OAAO,OAAO,IAAI;IACtC,MAAM,KAAK;IACX,aAAa,KAAK,eAAe,MAAM;IACvC,QAAQ;GACV,CAAC;GACD,IAAI,SACF,MAAM,OAAO,OAAO,CAAC,YAAY,WAAW,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GAE7E,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mBAAmB;GAAE;GAAO,SAAS;EAAG,CAAC;EAC1D,OAAO;CACT;CAEA,KAAK,OAAe,OAA0C;EAC5D,OAAO,KAAK,KAAK,KAAK,OAAO,KAAK;CACpC;CAEA,IAAI,OAAe,IAAmC;EACpD,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE;CACrC;CAEA,MAAM,gBACJ,OACA,IACA,UACA,kBACgC;EAChC,MAAM,QAAQ,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EAChD,IAAI,CAAC,OACH,OAAO;EAOT,OAAO;GAAE,KAAA,MALS,KAAK,QAAQ,gBAAgB;IAC7C,KAAK,MAAM;IACX,kBAAkB,YAAY,MAAM;IACpC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC/D,CAAC;GACa;EAAM;CACtB;CAEA,MAAM,OAAO,OAAe,IAA8B;EACxD,MAAM,QAAQ,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,KAAK,QAAQ,OAAO,MAAM,GAAG;EACnC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,QAAQ,aAAa;GAC/D,MAAM,UAAU,MAAM,OAAO,OAAO,EAAE;GACtC,IAAI,SACF,MAAM,OAAO,OAAO,CAAC,YAAY,aAAa,KAAK;IAAE;IAAO,MAAM;GAAM,CAAC,CAAC,CAAC;GAE7E,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,iBAAiB;GAAE;GAAO,SAAS;EAAG,CAAC;EACxD,OAAO;CACT;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/assets/service.ts"],"sourcesContent":["// assets context — service. Owns org-scoped key construction and the asset\n// lifecycle (register → upload → confirm → serve → remove); delegates the\n// actual object operations to the ObjectStorage port. Org isolation is enforced\n// by scoping every lookup to the caller's org (cross-org reads return null).\nimport { genId } from '../shared/id.js';\nimport type { Logger, ObjectStorage } from '../shared/ports.js';\nimport type {\n  Asset,\n  AssetsQuery,\n  DownloadTicket,\n  Page,\n  RequestUploadInput,\n  UploadTicket,\n} from './model.js';\nimport type { AssetsRepository, AssetsService, AssetsUnitOfWork } from './ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { assetEvents } from './events.js';\n\nfunction orgPrefix(orgId: string): string {\n  return `org/${orgId}/`;\n}\n\nfunction sanitizeFilename(filename: string): string {\n  const base = filename.split(/[\\\\/]/).pop() ?? 'file';\n  return base.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 120) || 'file';\n}\n\nexport type AssetsServiceParams = {\n  storage: ObjectStorage;\n  repo: AssetsRepository;\n  uow: AssetsUnitOfWork;\n  logger?: Logger;\n};\n\nexport class AssetsServiceImpl implements AssetsService {\n  private readonly storage: ObjectStorage;\n  private readonly repo: AssetsRepository;\n  private readonly uow: AssetsUnitOfWork;\n  private readonly logger: Logger;\n\n  constructor(params: AssetsServiceParams) {\n    this.storage = params.storage;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  async requestUpload(orgId: string, input: RequestUploadInput): Promise<UploadTicket> {\n    const id = genId('asset');\n    const key = `${orgPrefix(orgId)}${input.kind}/${id}/${sanitizeFilename(input.filename)}`;\n    const presigned = await this.storage.presignUpload({ key, contentType: input.contentType });\n    const now = new Date();\n    const asset = await this.uow.run(async ({ assets, outbox }) => {\n      const asset = await assets.insert(orgId, {\n        orgId,\n        id,\n        key,\n        kind: input.kind,\n        filename: input.filename,\n        contentType: input.contentType,\n        size: 0,\n        status: 'pending',\n        uploadedBy: input.uploadedBy,\n        createdAt: now,\n        updatedAt: now,\n      });\n      await outbox.append([assetEvents.assetCreated.make({ orgId, data: asset })]);\n      return asset;\n    });\n    this.logger.info('asset upload requested', { orgId, assetId: id, kind: input.kind });\n    return {\n      asset,\n      uploadUrl: presigned.url,\n      method: 'PUT',\n      expiresInSeconds: presigned.expiresInSeconds,\n      headers: presigned.headers,\n    };\n  }\n\n  async confirm(orgId: string, id: string): Promise<Asset | null> {\n    const asset = await this.repo.findById(orgId, id);\n    if (!asset) {\n      return null;\n    }\n    const stat = await this.storage.stat(asset.key);\n    if (!stat) {\n      this.logger.debug('asset not yet uploaded', { orgId, assetId: id });\n      return asset; // not uploaded yet — stays pending\n    }\n    const updated = await this.uow.run(async ({ assets, outbox }) => {\n      const updated = await assets.update(id, {\n        size: stat.size,\n        contentType: stat.contentType ?? asset.contentType,\n        status: 'ready',\n      });\n      if (updated) {\n        await outbox.append([assetEvents.assetReady.make({ orgId, data: updated })]);\n      }\n      return updated;\n    });\n    this.logger.info('asset confirmed', { orgId, assetId: id });\n    return updated;\n  }\n\n  list(orgId: string, query: AssetsQuery): Promise<Page<Asset>> {\n    return this.repo.list(orgId, query);\n  }\n\n  get(orgId: string, id: string): Promise<Asset | null> {\n    return this.repo.findById(orgId, id);\n  }\n\n  async requestDownload(\n    orgId: string,\n    id: string,\n    filename?: string,\n    expiresInSeconds?: number,\n  ): Promise<DownloadTicket | null> {\n    const asset = await this.repo.findById(orgId, id);\n    if (!asset) {\n      return null;\n    }\n    const url = await this.storage.presignDownload({\n      key: asset.key,\n      downloadFilename: filename ?? asset.filename,\n      ...(expiresInSeconds === undefined ? {} : { expiresInSeconds }),\n    });\n    return { url, asset };\n  }\n\n  async remove(orgId: string, id: string): Promise<boolean> {\n    const asset = await this.repo.findById(orgId, id);\n    if (!asset) {\n      return false;\n    }\n    await this.storage.remove(asset.key);\n    const deleted = await this.uow.run(async ({ assets, outbox }) => {\n      const deleted = await assets.delete(id);\n      if (deleted) {\n        await outbox.append([assetEvents.assetDeleted.make({ orgId, data: asset })]);\n      }\n      return deleted;\n    });\n    this.logger.info('asset removed', { orgId, assetId: id });\n    return deleted;\n  }\n}\n"],"mappings":";;;;AAkBA,SAAS,UAAU,OAAuB;CACxC,OAAO,OAAO,MAAM;AACtB;AAEA,SAAS,iBAAiB,UAA0B;CAElD,QADa,SAAS,MAAM,OAAO,CAAC,CAAC,IAAI,KAAK,OAAA,CAClC,QAAQ,oBAAoB,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,KAAK;AAChE;AASA,IAAa,oBAAb,MAAwD;CACtD;CACA;CACA;CACA;CAEA,YAAY,QAA6B;EACvC,KAAK,UAAU,OAAO;EACtB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,MAAM,cAAc,OAAe,OAAkD;EACnF,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,MAAM,GAAG,UAAU,KAAK,IAAI,MAAM,KAAK,GAAG,GAAG,GAAG,iBAAiB,MAAM,QAAQ;EACrF,MAAM,YAAY,MAAM,KAAK,QAAQ,cAAc;GAAE;GAAK,aAAa,MAAM;EAAY,CAAC;EAC1F,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,QAAQ,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,QAAQ,aAAa;GAC7D,MAAM,QAAQ,MAAM,OAAO,OAAO,OAAO;IACvC;IACA;IACA;IACA,MAAM,MAAM;IACZ,UAAU,MAAM;IAChB,aAAa,MAAM;IACnB,MAAM;IACN,QAAQ;IACR,YAAY,MAAM;IAClB,WAAW;IACX,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO,CAAC,YAAY,aAAa,KAAK;IAAE;IAAO,MAAM;GAAM,CAAC,CAAC,CAAC;GAC3E,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GAAE;GAAO,SAAS;GAAI,MAAM,MAAM;EAAK,CAAC;EACnF,OAAO;GACL;GACA,WAAW,UAAU;GACrB,QAAQ;GACR,kBAAkB,UAAU;GAC5B,SAAS,UAAU;EACrB;CACF;CAEA,MAAM,QAAQ,OAAe,IAAmC;EAC9D,MAAM,QAAQ,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,MAAM,GAAG;EAC9C,IAAI,CAAC,MAAM;GACT,KAAK,OAAO,MAAM,0BAA0B;IAAE;IAAO,SAAS;GAAG,CAAC;GAClE,OAAO;EACT;EACA,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,QAAQ,aAAa;GAC/D,MAAM,UAAU,MAAM,OAAO,OAAO,IAAI;IACtC,MAAM,KAAK;IACX,aAAa,KAAK,eAAe,MAAM;IACvC,QAAQ;GACV,CAAC;GACD,IAAI,SACF,MAAM,OAAO,OAAO,CAAC,YAAY,WAAW,KAAK;IAAE;IAAO,MAAM;GAAQ,CAAC,CAAC,CAAC;GAE7E,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mBAAmB;GAAE;GAAO,SAAS;EAAG,CAAC;EAC1D,OAAO;CACT;CAEA,KAAK,OAAe,OAA0C;EAC5D,OAAO,KAAK,KAAK,KAAK,OAAO,KAAK;CACpC;CAEA,IAAI,OAAe,IAAmC;EACpD,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE;CACrC;CAEA,MAAM,gBACJ,OACA,IACA,UACA,kBACgC;EAChC,MAAM,QAAQ,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EAChD,IAAI,CAAC,OACH,OAAO;EAOT,OAAO;GAAE,KAAA,MALS,KAAK,QAAQ,gBAAgB;IAC7C,KAAK,MAAM;IACX,kBAAkB,YAAY,MAAM;IACpC,GAAI,qBAAqB,KAAA,IAAY,CAAC,IAAI,EAAE,iBAAiB;GAC/D,CAAC;GACa;EAAM;CACtB;CAEA,MAAM,OAAO,OAAe,IAA8B;EACxD,MAAM,QAAQ,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EAChD,IAAI,CAAC,OACH,OAAO;EAET,MAAM,KAAK,QAAQ,OAAO,MAAM,GAAG;EACnC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,QAAQ,aAAa;GAC/D,MAAM,UAAU,MAAM,OAAO,OAAO,EAAE;GACtC,IAAI,SACF,MAAM,OAAO,OAAO,CAAC,YAAY,aAAa,KAAK;IAAE;IAAO,MAAM;GAAM,CAAC,CAAC,CAAC;GAE7E,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,iBAAiB;GAAE;GAAO,SAAS;EAAG,CAAC;EACxD,OAAO;CACT;AACF"}

package/dist/automations/actions.d.ts

@@ -1,11 +1,19 @@
 import { DomainEvent } from "../types/shared.js";
 import { EmailTemplateId, EmailTemplateParams } from "../types/email-templates.js";
 import { AutomationAction } from "../types/schemas/automations.js";
+import { WebhookSender } from "../types/automations.js";
 import "../types/index.js";
-import "../shared/ports.js";
+import { CredentialStore } from "../shared/ports.js";
 import { Mailer, MailerLookups } from "../shared/mailer.js";
 import "./model.js";
+import "./ports.js";
 //#region src/automations/actions.d.ts
+interface ActionDeps {
+  mailer: Pick<Mailer, 'send'>;
+  lookups: MailerLookups;
+  credentials: Pick<CredentialStore, 'reveal'>;
+  webhooks: WebhookSender;
+}
 interface SendEmailDerivation<K extends EmailTemplateId> {
   /** The only event type this template's params can be derived from. */
   trigger: string;
@@ -18,7 +26,7 @@ interface SendEmailDerivation<K extends EmailTemplateId> {
 type SendEmailDerivations = { [K in EmailTemplateId]?: SendEmailDerivation<K>; };
 declare const SEND_EMAIL_DERIVATIONS: SendEmailDerivations;
 /** Throws on any failure — the engine owns retry policy and failure bookkeeping. */
-declare function executeAction(action: AutomationAction, event: DomainEvent, mailer: Pick<Mailer, 'send'>, lookups: MailerLookups): Promise<void>;
+declare function executeAction(action: AutomationAction, event: DomainEvent, deps: ActionDeps): Promise<void>;
 //#endregion
-export { SEND_EMAIL_DERIVATIONS, executeAction };
+export { ActionDeps, SEND_EMAIL_DERIVATIONS, executeAction };
 //# sourceMappingURL=actions.d.ts.map

package/dist/automations/actions.js

@@ -1,5 +1,7 @@
+import { deliverWebhookInputSchema } from "../types/schemas/automations.js";
 import { entitlementEvents } from "../entitlements/events.js";
-import { ALL_EMAIL_TEMPLATE_IDS } from "./catalog.js";
+import { ALL_EMAIL_TEMPLATE_IDS, DELIVER_WEBHOOK_ACTION, publicDataSchema } from "./catalog.js";
+import { webhookHeaders } from "./webhook-signing.js";
 //#region src/automations/actions.ts
 const SEND_EMAIL_DERIVATIONS = {
 	accessGranted: {
@@ -8,13 +10,15 @@ const SEND_EMAIL_DERIVATIONS = {
 			const result = entitlementEvents.entitlementCreated.safeParse(event);
 			if (!result.success) return;
 			const entitlement = result.data.data;
+			if (!entitlement.contentId) return;
 			const [to, content] = await Promise.all([lookups.orgUserEmail(entitlement.orgId, entitlement.orgUserId), lookups.contentInfo(entitlement.orgId, entitlement.contentId)]);
 			if (!to || !content) return;
 			return {
 				to,
 				params: {
 					contentTitle: content.title,
-					contentId: content.id
+					contentId: content.id,
+					contentType: content.type
 				}
 			};
 		}
@@ -25,6 +29,7 @@ const SEND_EMAIL_DERIVATIONS = {
 			const result = entitlementEvents.entitlementDeleted.safeParse(event);
 			if (!result.success) return;
 			const entitlement = result.data.data;
+			if (!entitlement.contentId) return;
 			const [to, content] = await Promise.all([lookups.orgUserEmail(entitlement.orgId, entitlement.orgUserId), lookups.contentInfo(entitlement.orgId, entitlement.contentId)]);
 			if (!to || !content) return;
 			return {
@@ -38,21 +43,49 @@ function isEmailTemplateId(value) {
 	return typeof value === "string" && value in ALL_EMAIL_TEMPLATE_IDS;
 }
 /** Throws on any failure — the engine owns retry policy and failure bookkeeping. */
-async function executeAction(action, event, mailer, lookups) {
+async function executeAction(action, event, deps) {
 	switch (action.type) {
 		case "sendEmail": {
 			const template = action.input["template"];
 			if (!isEmailTemplateId(template)) throw new Error(`sendEmail: unknown template "${String(template)}"`);
 			const derivation = SEND_EMAIL_DERIVATIONS[template];
 			if (!derivation || derivation.trigger !== event.type) throw new Error(`sendEmail: template "${template}" cannot be derived from event "${event.type}"`);
-			const derived = await derivation.derive(event, lookups);
+			const derived = await derivation.derive(event, deps.lookups);
 			if (!derived) throw new Error(`sendEmail: event "${event.type}" is missing the data required to derive template "${template}"`);
-			await mailer.send(derived.to, template, derived.params);
+			await deps.mailer.send(derived.to, template, derived.params);
 			return;
 		}
+		case DELIVER_WEBHOOK_ACTION:
+			await deliverWebhook(action, event, deps);
+			return;
 		default: throw new Error(`unknown automation action type "${action.type}"`);
 	}
 }
+async function deliverWebhook(action, event, deps) {
+	const input = deliverWebhookInputSchema.safeParse(action.input);
+	if (!input.success) throw new Error(`${DELIVER_WEBHOOK_ACTION}: invalid input`);
+	const publicData = publicDataSchema(event.type);
+	if (!publicData) throw new Error(`${DELIVER_WEBHOOK_ACTION}: event "${event.type}" is not published`);
+	const data = publicData.safeParse(event.data);
+	if (!data.success) throw new Error(`${DELIVER_WEBHOOK_ACTION}: event "${event.type}" does not match its published shape`);
+	const secret = (await deps.credentials.reveal(event.orgId, input.data.secretRef))?.["secret"];
+	if (typeof secret !== "string") throw new Error(`${DELIVER_WEBHOOK_ACTION}: signing secret not found`);
+	const body = JSON.stringify({
+		id: event.id,
+		type: event.type,
+		version: event.version,
+		orgId: event.orgId,
+		occurredAt: event.occurredAt,
+		data: data.data
+	});
+	const timestamp = Math.floor(Date.now() / 1e3);
+	const response = await deps.webhooks.send({
+		url: input.data.url,
+		headers: webhookHeaders(secret, event.id, timestamp, body),
+		body
+	});
+	if (response.status < 200 || response.status >= 300) throw new Error(`${DELIVER_WEBHOOK_ACTION}: endpoint responded ${response.status}`);
+}
 //#endregion
 export { SEND_EMAIL_DERIVATIONS, executeAction };
 

package/dist/automations/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","names":[],"sources":["../../src/automations/actions.ts"],"sourcesContent":["// automations context — action runners. `executeAction` maps one\n// AutomationAction against the DomainEvent that triggered its run.\n//\n// SEND_EMAIL_DERIVATIONS is the sendEmail runner's internal derivation table:\n// which (trigger, template) pairings are derivable. A template with no entry\n// (e.g. courseCompleted) makes `executeAction` throw a named error, recorded\n// by the engine as a failed action.\nimport type { EmailTemplateId, EmailTemplateParams } from '../types/index.js';\nimport { entitlementEvents } from '../entitlements/index.js';\nimport type { Mailer, MailerLookups } from '../shared/mailer.js';\nimport type { DomainEvent } from '../shared/ports.js';\nimport type { AutomationAction } from './model.js';\nimport { ALL_EMAIL_TEMPLATE_IDS } from './catalog.js';\n\ninterface SendEmailDerivation<K extends EmailTemplateId> {\n  /** The only event type this template's params can be derived from. */\n  trigger: string;\n  /** Undefined = the recipient or content behind the event's ids cannot be resolved. */\n  derive(\n    event: DomainEvent,\n    lookups: MailerLookups,\n  ): Promise<{ to: string; params: EmailTemplateParams[K] } | undefined>;\n}\n\ntype SendEmailDerivations = { [K in EmailTemplateId]?: SendEmailDerivation<K> };\n\nexport const SEND_EMAIL_DERIVATIONS: SendEmailDerivations = {\n  accessGranted: {\n    trigger: 'entitlement.created',\n    derive: async (event, lookups) => {\n      const result = entitlementEvents.entitlementCreated.safeParse(event);\n      if (!result.success) {\n        return undefined;\n      }\n      const entitlement = result.data.data;\n      const [to, content] = await Promise.all([\n        lookups.orgUserEmail(entitlement.orgId, entitlement.orgUserId),\n        lookups.contentInfo(entitlement.orgId, entitlement.contentId),\n      ]);\n      if (!to || !content) {\n        return undefined;\n      }\n      return {\n        to,\n        params: { contentTitle: content.title, contentId: content.id },\n      };\n    },\n  },\n  accessRevoked: {\n    trigger: 'entitlement.deleted',\n    derive: async (event, lookups) => {\n      const result = entitlementEvents.entitlementDeleted.safeParse(event);\n      if (!result.success) {\n        return undefined;\n      }\n      const entitlement = result.data.data;\n      const [to, content] = await Promise.all([\n        lookups.orgUserEmail(entitlement.orgId, entitlement.orgUserId),\n        lookups.contentInfo(entitlement.orgId, entitlement.contentId),\n      ]);\n      if (!to || !content) {\n        return undefined;\n      }\n      return {\n        to,\n        params: { contentTitle: content.title },\n      };\n    },\n  },\n};\n\nfunction isEmailTemplateId(value: unknown): value is EmailTemplateId {\n  return typeof value === 'string' && value in ALL_EMAIL_TEMPLATE_IDS;\n}\n\n/** Throws on any failure — the engine owns retry policy and failure bookkeeping. */\nexport async function executeAction(\n  action: AutomationAction,\n  event: DomainEvent,\n  mailer: Pick<Mailer, 'send'>,\n  lookups: MailerLookups,\n): Promise<void> {\n  switch (action.type) {\n    case 'sendEmail': {\n      const template = action.input['template'];\n      if (!isEmailTemplateId(template)) {\n        throw new Error(`sendEmail: unknown template \"${String(template)}\"`);\n      }\n      const derivation = SEND_EMAIL_DERIVATIONS[template];\n      if (!derivation || derivation.trigger !== event.type) {\n        throw new Error(\n          `sendEmail: template \"${template}\" cannot be derived from event \"${event.type}\"`,\n        );\n      }\n      const derived = await derivation.derive(event, lookups);\n      if (!derived) {\n        throw new Error(\n          `sendEmail: event \"${event.type}\" is missing the data required to derive template \"${template}\"`,\n        );\n      }\n      await mailer.send(derived.to, template, derived.params);\n      return;\n    }\n    default: {\n      throw new Error(`unknown automation action type \"${action.type}\"`);\n    }\n  }\n}\n"],"mappings":";;;AA0BA,MAAa,yBAA+C;CAC1D,eAAe;EACb,SAAS;EACT,QAAQ,OAAO,OAAO,YAAY;GAChC,MAAM,SAAS,kBAAkB,mBAAmB,UAAU,KAAK;GACnE,IAAI,CAAC,OAAO,SACV;GAEF,MAAM,cAAc,OAAO,KAAK;GAChC,MAAM,CAAC,IAAI,WAAW,MAAM,QAAQ,IAAI,CACtC,QAAQ,aAAa,YAAY,OAAO,YAAY,SAAS,GAC7D,QAAQ,YAAY,YAAY,OAAO,YAAY,SAAS,CAC9D,CAAC;GACD,IAAI,CAAC,MAAM,CAAC,SACV;GAEF,OAAO;IACL;IACA,QAAQ;KAAE,cAAc,QAAQ;KAAO,WAAW,QAAQ;IAAG;GAC/D;EACF;CACF;CACA,eAAe;EACb,SAAS;EACT,QAAQ,OAAO,OAAO,YAAY;GAChC,MAAM,SAAS,kBAAkB,mBAAmB,UAAU,KAAK;GACnE,IAAI,CAAC,OAAO,SACV;GAEF,MAAM,cAAc,OAAO,KAAK;GAChC,MAAM,CAAC,IAAI,WAAW,MAAM,QAAQ,IAAI,CACtC,QAAQ,aAAa,YAAY,OAAO,YAAY,SAAS,GAC7D,QAAQ,YAAY,YAAY,OAAO,YAAY,SAAS,CAC9D,CAAC;GACD,IAAI,CAAC,MAAM,CAAC,SACV;GAEF,OAAO;IACL;IACA,QAAQ,EAAE,cAAc,QAAQ,MAAM;GACxC;EACF;CACF;AACF;AAEA,SAAS,kBAAkB,OAA0C;CACnE,OAAO,OAAO,UAAU,YAAY,SAAS;AAC/C;;AAGA,eAAsB,cACpB,QACA,OACA,QACA,SACe;CACf,QAAQ,OAAO,MAAf;EACE,KAAK,aAAa;GAChB,MAAM,WAAW,OAAO,MAAM;GAC9B,IAAI,CAAC,kBAAkB,QAAQ,GAC7B,MAAM,IAAI,MAAM,gCAAgC,OAAO,QAAQ,EAAE,EAAE;GAErE,MAAM,aAAa,uBAAuB;GAC1C,IAAI,CAAC,cAAc,WAAW,YAAY,MAAM,MAC9C,MAAM,IAAI,MACR,wBAAwB,SAAS,kCAAkC,MAAM,KAAK,EAChF;GAEF,MAAM,UAAU,MAAM,WAAW,OAAO,OAAO,OAAO;GACtD,IAAI,CAAC,SACH,MAAM,IAAI,MACR,qBAAqB,MAAM,KAAK,qDAAqD,SAAS,EAChG;GAEF,MAAM,OAAO,KAAK,QAAQ,IAAI,UAAU,QAAQ,MAAM;GACtD;EACF;EACA,SACE,MAAM,IAAI,MAAM,mCAAmC,OAAO,KAAK,EAAE;CAErE;AACF"}
+{"version":3,"file":"actions.js","names":[],"sources":["../../src/automations/actions.ts"],"sourcesContent":["// automations context — action runners. `executeAction` maps one\n// AutomationAction against the DomainEvent that triggered its run.\n//\n// SEND_EMAIL_DERIVATIONS is the sendEmail runner's internal derivation table:\n// which (trigger, template) pairings are derivable. A template with no entry\n// (e.g. courseCompleted) makes `executeAction` throw a named error, recorded\n// by the engine as a failed action.\nimport type { EmailTemplateId, EmailTemplateParams } from '../types/index.js';\nimport { deliverWebhookInputSchema } from '../types/schemas/index.js';\nimport { entitlementEvents } from '../entitlements/index.js';\nimport type { Mailer, MailerLookups } from '../shared/mailer.js';\nimport type { CredentialStore, DomainEvent } from '../shared/ports.js';\nimport type { AutomationAction } from './model.js';\nimport type { WebhookSender } from './ports.js';\nimport { ALL_EMAIL_TEMPLATE_IDS, DELIVER_WEBHOOK_ACTION, publicDataSchema } from './catalog.js';\nimport { webhookHeaders } from './webhook-signing.js';\n\nexport interface ActionDeps {\n  mailer: Pick<Mailer, 'send'>;\n  lookups: MailerLookups;\n  credentials: Pick<CredentialStore, 'reveal'>;\n  webhooks: WebhookSender;\n}\n\ninterface SendEmailDerivation<K extends EmailTemplateId> {\n  /** The only event type this template's params can be derived from. */\n  trigger: string;\n  /** Undefined = the recipient or content behind the event's ids cannot be resolved. */\n  derive(\n    event: DomainEvent,\n    lookups: MailerLookups,\n  ): Promise<{ to: string; params: EmailTemplateParams[K] } | undefined>;\n}\n\ntype SendEmailDerivations = { [K in EmailTemplateId]?: SendEmailDerivation<K> };\n\nexport const SEND_EMAIL_DERIVATIONS: SendEmailDerivations = {\n  accessGranted: {\n    trigger: 'entitlement.created',\n    derive: async (event, lookups) => {\n      const result = entitlementEvents.entitlementCreated.safeParse(event);\n      if (!result.success) {\n        return undefined;\n      }\n      const entitlement = result.data.data;\n      // Bundle grants carry no content id — this email is per content item.\n      if (!entitlement.contentId) {\n        return undefined;\n      }\n      const [to, content] = await Promise.all([\n        lookups.orgUserEmail(entitlement.orgId, entitlement.orgUserId),\n        lookups.contentInfo(entitlement.orgId, entitlement.contentId),\n      ]);\n      if (!to || !content) {\n        return undefined;\n      }\n      return {\n        to,\n        params: { contentTitle: content.title, contentId: content.id, contentType: content.type },\n      };\n    },\n  },\n  accessRevoked: {\n    trigger: 'entitlement.deleted',\n    derive: async (event, lookups) => {\n      const result = entitlementEvents.entitlementDeleted.safeParse(event);\n      if (!result.success) {\n        return undefined;\n      }\n      const entitlement = result.data.data;\n      // Bundle grants carry no content id — this email is per content item.\n      if (!entitlement.contentId) {\n        return undefined;\n      }\n      const [to, content] = await Promise.all([\n        lookups.orgUserEmail(entitlement.orgId, entitlement.orgUserId),\n        lookups.contentInfo(entitlement.orgId, entitlement.contentId),\n      ]);\n      if (!to || !content) {\n        return undefined;\n      }\n      return {\n        to,\n        params: { contentTitle: content.title },\n      };\n    },\n  },\n};\n\nfunction isEmailTemplateId(value: unknown): value is EmailTemplateId {\n  return typeof value === 'string' && value in ALL_EMAIL_TEMPLATE_IDS;\n}\n\n/** Throws on any failure — the engine owns retry policy and failure bookkeeping. */\nexport async function executeAction(\n  action: AutomationAction,\n  event: DomainEvent,\n  deps: ActionDeps,\n): Promise<void> {\n  switch (action.type) {\n    case 'sendEmail': {\n      const template = action.input['template'];\n      if (!isEmailTemplateId(template)) {\n        throw new Error(`sendEmail: unknown template \"${String(template)}\"`);\n      }\n      const derivation = SEND_EMAIL_DERIVATIONS[template];\n      if (!derivation || derivation.trigger !== event.type) {\n        throw new Error(\n          `sendEmail: template \"${template}\" cannot be derived from event \"${event.type}\"`,\n        );\n      }\n      const derived = await derivation.derive(event, deps.lookups);\n      if (!derived) {\n        throw new Error(\n          `sendEmail: event \"${event.type}\" is missing the data required to derive template \"${template}\"`,\n        );\n      }\n      await deps.mailer.send(derived.to, template, derived.params);\n      return;\n    }\n    case DELIVER_WEBHOOK_ACTION: {\n      await deliverWebhook(action, event, deps);\n      return;\n    }\n    default: {\n      throw new Error(`unknown automation action type \"${action.type}\"`);\n    }\n  }\n}\n\nasync function deliverWebhook(\n  action: AutomationAction,\n  event: DomainEvent,\n  deps: ActionDeps,\n): Promise<void> {\n  const input = deliverWebhookInputSchema.safeParse(action.input);\n  if (!input.success) {\n    throw new Error(`${DELIVER_WEBHOOK_ACTION}: invalid input`);\n  }\n  const publicData = publicDataSchema(event.type);\n  if (!publicData) {\n    throw new Error(`${DELIVER_WEBHOOK_ACTION}: event \"${event.type}\" is not published`);\n  }\n  const data = publicData.safeParse(event.data);\n  if (!data.success) {\n    throw new Error(\n      `${DELIVER_WEBHOOK_ACTION}: event \"${event.type}\" does not match its published shape`,\n    );\n  }\n  const secrets = await deps.credentials.reveal(event.orgId, input.data.secretRef);\n  const secret = secrets?.['secret'];\n  if (typeof secret !== 'string') {\n    throw new Error(`${DELIVER_WEBHOOK_ACTION}: signing secret not found`);\n  }\n  const body = JSON.stringify({\n    id: event.id,\n    type: event.type,\n    version: event.version,\n    orgId: event.orgId,\n    occurredAt: event.occurredAt,\n    data: data.data,\n  });\n  const timestamp = Math.floor(Date.now() / 1000);\n  const response = await deps.webhooks.send({\n    url: input.data.url,\n    headers: webhookHeaders(secret, event.id, timestamp, body),\n    body,\n  });\n  if (response.status < 200 || response.status >= 300) {\n    throw new Error(`${DELIVER_WEBHOOK_ACTION}: endpoint responded ${response.status}`);\n  }\n}\n"],"mappings":";;;;;AAoCA,MAAa,yBAA+C;CAC1D,eAAe;EACb,SAAS;EACT,QAAQ,OAAO,OAAO,YAAY;GAChC,MAAM,SAAS,kBAAkB,mBAAmB,UAAU,KAAK;GACnE,IAAI,CAAC,OAAO,SACV;GAEF,MAAM,cAAc,OAAO,KAAK;GAEhC,IAAI,CAAC,YAAY,WACf;GAEF,MAAM,CAAC,IAAI,WAAW,MAAM,QAAQ,IAAI,CACtC,QAAQ,aAAa,YAAY,OAAO,YAAY,SAAS,GAC7D,QAAQ,YAAY,YAAY,OAAO,YAAY,SAAS,CAC9D,CAAC;GACD,IAAI,CAAC,MAAM,CAAC,SACV;GAEF,OAAO;IACL;IACA,QAAQ;KAAE,cAAc,QAAQ;KAAO,WAAW,QAAQ;KAAI,aAAa,QAAQ;IAAK;GAC1F;EACF;CACF;CACA,eAAe;EACb,SAAS;EACT,QAAQ,OAAO,OAAO,YAAY;GAChC,MAAM,SAAS,kBAAkB,mBAAmB,UAAU,KAAK;GACnE,IAAI,CAAC,OAAO,SACV;GAEF,MAAM,cAAc,OAAO,KAAK;GAEhC,IAAI,CAAC,YAAY,WACf;GAEF,MAAM,CAAC,IAAI,WAAW,MAAM,QAAQ,IAAI,CACtC,QAAQ,aAAa,YAAY,OAAO,YAAY,SAAS,GAC7D,QAAQ,YAAY,YAAY,OAAO,YAAY,SAAS,CAC9D,CAAC;GACD,IAAI,CAAC,MAAM,CAAC,SACV;GAEF,OAAO;IACL;IACA,QAAQ,EAAE,cAAc,QAAQ,MAAM;GACxC;EACF;CACF;AACF;AAEA,SAAS,kBAAkB,OAA0C;CACnE,OAAO,OAAO,UAAU,YAAY,SAAS;AAC/C;;AAGA,eAAsB,cACpB,QACA,OACA,MACe;CACf,QAAQ,OAAO,MAAf;EACE,KAAK,aAAa;GAChB,MAAM,WAAW,OAAO,MAAM;GAC9B,IAAI,CAAC,kBAAkB,QAAQ,GAC7B,MAAM,IAAI,MAAM,gCAAgC,OAAO,QAAQ,EAAE,EAAE;GAErE,MAAM,aAAa,uBAAuB;GAC1C,IAAI,CAAC,cAAc,WAAW,YAAY,MAAM,MAC9C,MAAM,IAAI,MACR,wBAAwB,SAAS,kCAAkC,MAAM,KAAK,EAChF;GAEF,MAAM,UAAU,MAAM,WAAW,OAAO,OAAO,KAAK,OAAO;GAC3D,IAAI,CAAC,SACH,MAAM,IAAI,MACR,qBAAqB,MAAM,KAAK,qDAAqD,SAAS,EAChG;GAEF,MAAM,KAAK,OAAO,KAAK,QAAQ,IAAI,UAAU,QAAQ,MAAM;GAC3D;EACF;EACA,KAAK;GACH,MAAM,eAAe,QAAQ,OAAO,IAAI;GACxC;EAEF,SACE,MAAM,IAAI,MAAM,mCAAmC,OAAO,KAAK,EAAE;CAErE;AACF;AAEA,eAAe,eACb,QACA,OACA,MACe;CACf,MAAM,QAAQ,0BAA0B,UAAU,OAAO,KAAK;CAC9D,IAAI,CAAC,MAAM,SACT,MAAM,IAAI,MAAM,GAAG,uBAAuB,gBAAgB;CAE5D,MAAM,aAAa,iBAAiB,MAAM,IAAI;CAC9C,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,GAAG,uBAAuB,WAAW,MAAM,KAAK,mBAAmB;CAErF,MAAM,OAAO,WAAW,UAAU,MAAM,IAAI;CAC5C,IAAI,CAAC,KAAK,SACR,MAAM,IAAI,MACR,GAAG,uBAAuB,WAAW,MAAM,KAAK,qCAClD;CAGF,MAAM,UAAS,MADO,KAAK,YAAY,OAAO,MAAM,OAAO,MAAM,KAAK,SAAS,EAAA,GACtD;CACzB,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,MAAM,GAAG,uBAAuB,2BAA2B;CAEvE,MAAM,OAAO,KAAK,UAAU;EAC1B,IAAI,MAAM;EACV,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,OAAO,MAAM;EACb,YAAY,MAAM;EAClB,MAAM,KAAK;CACb,CAAC;CACD,MAAM,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAC9C,MAAM,WAAW,MAAM,KAAK,SAAS,KAAK;EACxC,KAAK,MAAM,KAAK;EAChB,SAAS,eAAe,QAAQ,MAAM,IAAI,WAAW,IAAI;EACzD;CACF,CAAC;CACD,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAC9C,MAAM,IAAI,MAAM,GAAG,uBAAuB,uBAAuB,SAAS,QAAQ;AAEtF"}

package/dist/automations/catalog.d.ts

@@ -2,11 +2,14 @@ import { EmailTemplateId } from "../types/email-templates.js";
 import { AvailableActions, AvailableTriggers } from "../types/schemas/automations.js";
 import "../types/index.js";
 import "./types.js";
+import { z } from "zod";
 //#region src/automations/catalog.d.ts
 /** Every EmailTemplateId — a missing key here is a compile error, kept exhaustive by construction. */
 declare const ALL_EMAIL_TEMPLATE_IDS: Record<EmailTemplateId, true>;
+declare const DELIVER_WEBHOOK_ACTION = "deliverWebhook";
 declare function catalogActions(): AvailableActions;
 declare function catalogTriggers(): AvailableTriggers['triggers'];
+declare function publicDataSchema(type: string): z.ZodType | undefined;
 //#endregion
-export { ALL_EMAIL_TEMPLATE_IDS, catalogActions, catalogTriggers };
+export { ALL_EMAIL_TEMPLATE_IDS, DELIVER_WEBHOOK_ACTION, catalogActions, catalogTriggers, publicDataSchema };
 //# sourceMappingURL=catalog.d.ts.map