@iveri/contracts 0.3.0 → 0.5.0

package/README.md

@@ -77,10 +77,17 @@ one consumer each and stay in the service until a second one appears.
 
 ### `api/conduit/` → `@iveri/contracts/conduit`
 
-`conduit-api`'s full admin surface: `Endpoint`, `CaptureSummary`/`CaptureDetail`, `Provider`
-with its `SignatureManifest`/`HandshakeManifest`, `Replay`, `SignatureDiagnostic`, the request
-bodies for each, and the five enums they are built from — `SignatureVerdict`,
-`SignatureAlgorithm`, `SignatureEncoding`, `SignatureHeaderScheme`, `HandshakeKind`.
+`conduit-api`'s full admin surface.
+
+Inspect mode: `Endpoint`, `CaptureSummary`/`CaptureDetail`, `Provider` with its
+`SignatureManifest`/`HandshakeManifest`, `Replay`, `SignatureDiagnostic`.
+
+Gateway mode: `Destination`, `Route` with its `HeaderMatcher`/`BodyMatcher`, `Delivery` and
+`DeliveryAttempt`.
+
+Plus the request bodies for each, and the seven enums they are built from — `SignatureVerdict`,
+`SignatureAlgorithm`, `SignatureEncoding`, `SignatureHeaderScheme`, `HandshakeKind`,
+`MatchOperator`, `DeliveryStatus`.
 
 ### Why the wire shapes moved here
 

package/dist/cjs/api/conduit/delivery-status.enum.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Where one delivery is in its life.
+ *
+ * The states a processor can be interrupted in matter as much as the ones it ends in, which is
+ * why `IN_FLIGHT` is a status rather than an implied one: a replica killed mid-attempt leaves
+ * rows in it, and the reclaim query needs something to look for.
+ */
+export declare enum DeliveryStatus {
+    /** Waiting for its next attempt time. The only state the processor claims from. */
+    PENDING = "pending",
+    /**
+     * Claimed by a replica and being attempted right now.
+     *
+     * A row stuck here past the claim timeout is assumed abandoned and reclaimed. That reclaim
+     * is where at-least-once becomes visible — a replica that died *after* the receiver
+     * processed the request will have its work redone, which is what the idempotency key is
+     * for.
+     */
+    IN_FLIGHT = "in-flight",
+    /** The destination answered 2xx. Terminal. */
+    DELIVERED = "delivered",
+    /**
+     * Every attempt was used and none succeeded, or the failure was permanent. Terminal until an
+     * operator redrives it.
+     *
+     * **This is the dead-letter queue** — a status, not a separate resource. A DLQ that lives
+     * somewhere else is a DLQ nobody looks at.
+     */
+    DEAD_LETTERED = "dead-lettered",
+    /**
+     * An operator stopped it before it succeeded. Terminal.
+     *
+     * Distinct from `DEAD_LETTERED`: dead-lettered means the gateway tried and failed, cancelled
+     * means someone decided it should not be sent. Collapsing them makes "how reliable is our
+     * delivery" unanswerable.
+     */
+    CANCELLED = "cancelled"
+}
+//# sourceMappingURL=delivery-status.enum.d.ts.map

package/dist/cjs/api/conduit/delivery-status.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-status.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/delivery-status.enum.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,oBAAY,cAAc;IACtB,mFAAmF;IACnF,OAAO,YAAY;IAEnB;;;;;;;OAOG;IACH,SAAS,cAAc;IAEvB,8CAA8C;IAC9C,SAAS,cAAc;IAEvB;;;;;;OAMG;IACH,aAAa,kBAAkB;IAE/B;;;;;;OAMG;IACH,SAAS,cAAc;CAC1B"}

package/dist/cjs/api/conduit/delivery-status.enum.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeliveryStatus = void 0;
+/**
+ * Where one delivery is in its life.
+ *
+ * The states a processor can be interrupted in matter as much as the ones it ends in, which is
+ * why `IN_FLIGHT` is a status rather than an implied one: a replica killed mid-attempt leaves
+ * rows in it, and the reclaim query needs something to look for.
+ */
+var DeliveryStatus;
+(function (DeliveryStatus) {
+    /** Waiting for its next attempt time. The only state the processor claims from. */
+    DeliveryStatus["PENDING"] = "pending";
+    /**
+     * Claimed by a replica and being attempted right now.
+     *
+     * A row stuck here past the claim timeout is assumed abandoned and reclaimed. That reclaim
+     * is where at-least-once becomes visible — a replica that died *after* the receiver
+     * processed the request will have its work redone, which is what the idempotency key is
+     * for.
+     */
+    DeliveryStatus["IN_FLIGHT"] = "in-flight";
+    /** The destination answered 2xx. Terminal. */
+    DeliveryStatus["DELIVERED"] = "delivered";
+    /**
+     * Every attempt was used and none succeeded, or the failure was permanent. Terminal until an
+     * operator redrives it.
+     *
+     * **This is the dead-letter queue** — a status, not a separate resource. A DLQ that lives
+     * somewhere else is a DLQ nobody looks at.
+     */
+    DeliveryStatus["DEAD_LETTERED"] = "dead-lettered";
+    /**
+     * An operator stopped it before it succeeded. Terminal.
+     *
+     * Distinct from `DEAD_LETTERED`: dead-lettered means the gateway tried and failed, cancelled
+     * means someone decided it should not be sent. Collapsing them makes "how reliable is our
+     * delivery" unanswerable.
+     */
+    DeliveryStatus["CANCELLED"] = "cancelled";
+})(DeliveryStatus || (exports.DeliveryStatus = DeliveryStatus = {}));
+//# sourceMappingURL=delivery-status.enum.js.map

package/dist/cjs/api/conduit/delivery-status.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery-status.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/delivery-status.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,IAAY,cAkCX;AAlCD,WAAY,cAAc;IACtB,mFAAmF;IACnF,qCAAmB,CAAA;IAEnB;;;;;;;OAOG;IACH,yCAAuB,CAAA;IAEvB,8CAA8C;IAC9C,yCAAuB,CAAA;IAEvB;;;;;;OAMG;IACH,iDAA+B,CAAA;IAE/B;;;;;;OAMG;IACH,yCAAuB,CAAA;AAC3B,CAAC,EAlCW,cAAc,8BAAd,cAAc,QAkCzB"}

package/dist/cjs/api/conduit/delivery.type.d.ts

@@ -0,0 +1,79 @@
+import type { CursorPage } from '../../type/cursor-page.type.js';
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+import type { DeliveryStatus } from './delivery-status.enum.js';
+/** One capture on its way to one destination. */
+export interface Delivery {
+    id: UUID;
+    captureId: UUID;
+    /** The route that matched. May since have been deleted — the reference is loose. */
+    routeId: UUID;
+    destinationId: UUID;
+    /**
+     * Snapshotted when the delivery was enqueued, not read from the destination now: "we sent it
+     * here" must not silently become "we sent it wherever that points today".
+     */
+    targetUrl: string;
+    method: string;
+    /**
+     * Sent as `Idempotency-Key`, stable across every retry and every redrive.
+     *
+     * **At-least-once is the only guarantee Conduit offers.** A timeout that actually succeeded,
+     * a replica that died after the request landed, and an operator redriving a dead letter all
+     * arrive with the same key — a receiver must dedupe on it.
+     */
+    idempotencyKey: string;
+    status: DeliveryStatus;
+    attemptCount: number;
+    /** Snapshotted from the destination when enqueued. */
+    maxAttempts: number;
+    nextAttemptAt: IsoDateTime;
+    lastAttemptAt: Nullable<IsoDateTime>;
+    /** Null when no response arrived. See `lastError`. */
+    lastResponseStatus: Nullable<number>;
+    lastResponseBodyPreview: Nullable<string>;
+    lastError: Nullable<string>;
+    /** Set when an operator redrove this. */
+    redrivenByUserId: Nullable<UUID>;
+    completedAt: Nullable<IsoDateTime>;
+    createdAt: IsoDateTime;
+}
+/**
+ * One attempt at one delivery.
+ *
+ * What makes a dead letter diagnosable: "timed out, 502, 502, 401" is a different afternoon from
+ * "failed after 5 attempts", and the difference is whether the receiver was down or the
+ * credential is wrong.
+ */
+export interface DeliveryAttempt {
+    id: UUID;
+    /** 1-based. */
+    attemptNumber: number;
+    /** Null when no response arrived at all. */
+    responseStatus: Nullable<number>;
+    responseBodyPreview: Nullable<string>;
+    errorMessage: Nullable<string>;
+    /** Wall time, so a receiver that is slow rather than broken is visible. */
+    durationMs: number;
+    isSuccess: boolean;
+    createdAt: IsoDateTime;
+}
+/** `GET /api/v1/deliveries/:id/attempts`. Oldest first — an attempt history reads as a story. */
+export interface DeliveryAttemptsList {
+    items: DeliveryAttempt[];
+}
+/** `GET /api/v1/deliveries`. Cursor-paginated: the collection is appended to while it is read. */
+export type DeliveriesPage = CursorPage<Delivery>;
+/** Query for `GET /api/v1/deliveries`. */
+export interface GetDeliveriesQuery {
+    limit?: number;
+    /** Opaque cursor from the previous page's `nextCursor`. Never parse it. */
+    after?: Nullable<string>;
+    /** `dead-lettered` is the DLQ view. The DLQ is a filter, not a separate resource. */
+    status?: Nullable<DeliveryStatus>;
+    destinationId?: Nullable<UUID>;
+    /** Everything one capture fanned out to. */
+    captureId?: Nullable<UUID>;
+}
+//# sourceMappingURL=delivery.type.d.ts.map

package/dist/cjs/api/conduit/delivery.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/delivery.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE,iDAAiD;AACjD,MAAM,WAAW,QAAQ;IACrB,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,IAAI,CAAC;IAEhB,oFAAoF;IACpF,OAAO,EAAE,IAAI,CAAC;IAEd,aAAa,EAAE,IAAI,CAAC;IAEpB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,EAAE,MAAM,CAAC;IAEf;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB,MAAM,EAAE,cAAc,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IAErB,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IAEpB,aAAa,EAAE,WAAW,CAAC;IAC3B,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,sDAAsD;IACtD,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAErC,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5B,yCAAyC;IACzC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEjC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC5B,EAAE,EAAE,IAAI,CAAC;IAET,eAAe;IACf,aAAa,EAAE,MAAM,CAAC;IAEtB,4CAA4C;IAC5C,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,kGAAkG;AAClG,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;AAElD,0CAA0C;AAC1C,MAAM,WAAW,kBAAkB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2EAA2E;IAC3E,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzB,qFAAqF;IACrF,MAAM,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAElC,aAAa,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE/B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;CAC9B"}

package/dist/cjs/api/conduit/delivery.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=delivery.type.js.map

package/dist/cjs/api/conduit/delivery.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/delivery.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/conduit/destination.type.d.ts

@@ -0,0 +1,73 @@
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+/**
+ * A URL Conduit delivers to, in gateway mode.
+ *
+ * Carries `headerNames`, never the header values. Not masked, not truncated — the values have no
+ * field to appear in, the same control the endpoint shapes use for signing secrets. An operator
+ * can see that `authorization` is configured; nobody can read it back.
+ */
+export interface Destination {
+    id: UUID;
+    name: string;
+    description: Nullable<string>;
+    url: string;
+    /** Null means the provider's own method is reused — a gateway is a proxy, and a PUT meant a PUT. */
+    method: Nullable<string>;
+    /** Sorted, lowercase. **The values are never returned by any endpoint of this API.** */
+    headerNames: string[];
+    /** Per-attempt timeout. Null falls back to the service default. */
+    timeoutMs: Nullable<number>;
+    /** Attempts before dead-lettering. Null falls back to the service default. */
+    maxAttempts: Nullable<number>;
+    /** Stops *new* deliveries being enqueued. Does not cancel ones already queued. */
+    isActive: boolean;
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+}
+/** `GET /api/v1/destinations`. Offset-paginated — a small, slow-moving collection. */
+export interface DestinationsPage {
+    items: Destination[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** `POST /api/v1/destinations`. */
+export interface CreateDestinationBody {
+    name: string;
+    description?: Nullable<string>;
+    /**
+     * Absolute http/https URL. Private, loopback and link-local addresses are refused unless the
+     * service is configured to allow them, which it is locally and is not anywhere else.
+     * Credentials in the URL are rejected outright — send them as a header.
+     */
+    url: string;
+    method?: Nullable<string>;
+    /**
+     * Static headers merged over the forwarded ones. **Stored encrypted and never returned.**
+     * This is where an `Authorization` header for the receiver goes.
+     */
+    headers?: Nullable<Record<string, string>>;
+    timeoutMs?: Nullable<number>;
+    maxAttempts?: Nullable<number>;
+}
+/**
+ * `PATCH /api/v1/destinations/:id`.
+ *
+ * **`headers` has three states, not two.** Omitting it leaves the stored map untouched, `null`
+ * clears it, an object replaces it wholesale. A form must never send `{}` where it means
+ * "unchanged" — that strips the receiver's auth header, and the symptom is 401s on deliveries
+ * that worked yesterday.
+ */
+export interface UpdateDestinationBody {
+    name?: string;
+    description?: Nullable<string>;
+    url?: string;
+    method?: Nullable<string>;
+    headers?: Nullable<Record<string, string>>;
+    timeoutMs?: Nullable<number>;
+    maxAttempts?: Nullable<number>;
+    isActive?: boolean;
+}
+//# sourceMappingURL=destination.type.d.ts.map

package/dist/cjs/api/conduit/destination.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destination.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/destination.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IACxB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;IAEZ,oGAAoG;IACpG,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzB,wFAAwF;IACxF,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,mEAAmE;IACnE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5B,8EAA8E;IAC9E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAElB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,qBAAqB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE1B;;;OAGG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3C,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB"}

package/dist/cjs/api/conduit/destination.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=destination.type.js.map

package/dist/cjs/api/conduit/destination.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destination.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/destination.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/conduit/index.d.ts

@@ -1,8 +1,13 @@
 export * from './capture.type.js';
+export * from './delivery-status.enum.js';
+export * from './delivery.type.js';
+export * from './destination.type.js';
 export * from './endpoint.type.js';
 export * from './handshake-kind.enum.js';
+export * from './match-operator.enum.js';
 export * from './provider.type.js';
 export * from './replay.type.js';
+export * from './route.type.js';
 export * from './signature-algorithm.enum.js';
 export * from './signature-encoding.enum.js';
 export * from './signature-header-scheme.enum.js';

package/dist/cjs/api/conduit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC"}

package/dist/cjs/api/conduit/index.js

@@ -15,10 +15,15 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./capture.type.js"), exports);
+__exportStar(require("./delivery-status.enum.js"), exports);
+__exportStar(require("./delivery.type.js"), exports);
+__exportStar(require("./destination.type.js"), exports);
 __exportStar(require("./endpoint.type.js"), exports);
 __exportStar(require("./handshake-kind.enum.js"), exports);
+__exportStar(require("./match-operator.enum.js"), exports);
 __exportStar(require("./provider.type.js"), exports);
 __exportStar(require("./replay.type.js"), exports);
+__exportStar(require("./route.type.js"), exports);
 __exportStar(require("./signature-algorithm.enum.js"), exports);
 __exportStar(require("./signature-encoding.enum.js"), exports);
 __exportStar(require("./signature-header-scheme.enum.js"), exports);

package/dist/cjs/api/conduit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,qDAAmC;AACnC,2DAAyC;AACzC,qDAAmC;AACnC,mDAAiC;AACjC,gEAA8C;AAC9C,+DAA6C;AAC7C,oEAAkD;AAClD,8DAA4C;AAC5C,sDAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/conduit/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,4DAA0C;AAC1C,qDAAmC;AACnC,wDAAsC;AACtC,qDAAmC;AACnC,2DAAyC;AACzC,2DAAyC;AACzC,qDAAmC;AACnC,mDAAiC;AACjC,kDAAgC;AAChC,gEAA8C;AAC9C,+DAA6C;AAC7C,oEAAkD;AAClD,8DAA4C;AAC5C,sDAAoC"}

package/dist/cjs/api/conduit/match-operator.enum.d.ts

@@ -0,0 +1,22 @@
+/**
+ * How one header or body matcher compares.
+ *
+ * Four operators, and the list is short on purpose. A routing rule is declarative data, never
+ * code, and every operator added here is a step toward an expression language — the moment a
+ * rule can express arbitrary logic we own the customer's bugs and can never change the
+ * evaluator.
+ *
+ * `EXISTS` earns its place because "this field is present at all" is the most common real
+ * condition and cannot be written with the other three.
+ */
+export declare enum MatchOperator {
+    /** Exact string comparison, case-sensitive. */
+    EQUALS = "equals",
+    /** Substring. Deliberately not a regular expression. */
+    CONTAINS = "contains",
+    /** Value starts with the operand. Enough for `application/json; charset=utf-8`. */
+    STARTS_WITH = "starts-with",
+    /** The field is present, whatever its value. The operand is ignored. */
+    EXISTS = "exists"
+}
+//# sourceMappingURL=match-operator.enum.d.ts.map

package/dist/cjs/api/conduit/match-operator.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"match-operator.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/match-operator.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACrB,+CAA+C;IAC/C,MAAM,WAAW;IAEjB,wDAAwD;IACxD,QAAQ,aAAa;IAErB,mFAAmF;IACnF,WAAW,gBAAgB;IAE3B,wEAAwE;IACxE,MAAM,WAAW;CACpB"}

package/dist/cjs/api/conduit/match-operator.enum.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MatchOperator = void 0;
+/**
+ * How one header or body matcher compares.
+ *
+ * Four operators, and the list is short on purpose. A routing rule is declarative data, never
+ * code, and every operator added here is a step toward an expression language — the moment a
+ * rule can express arbitrary logic we own the customer's bugs and can never change the
+ * evaluator.
+ *
+ * `EXISTS` earns its place because "this field is present at all" is the most common real
+ * condition and cannot be written with the other three.
+ */
+var MatchOperator;
+(function (MatchOperator) {
+    /** Exact string comparison, case-sensitive. */
+    MatchOperator["EQUALS"] = "equals";
+    /** Substring. Deliberately not a regular expression. */
+    MatchOperator["CONTAINS"] = "contains";
+    /** Value starts with the operand. Enough for `application/json; charset=utf-8`. */
+    MatchOperator["STARTS_WITH"] = "starts-with";
+    /** The field is present, whatever its value. The operand is ignored. */
+    MatchOperator["EXISTS"] = "exists";
+})(MatchOperator || (exports.MatchOperator = MatchOperator = {}));
+//# sourceMappingURL=match-operator.enum.js.map

package/dist/cjs/api/conduit/match-operator.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match-operator.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/match-operator.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;GAUG;AACH,IAAY,aAYX;AAZD,WAAY,aAAa;IACrB,+CAA+C;IAC/C,kCAAiB,CAAA;IAEjB,wDAAwD;IACxD,sCAAqB,CAAA;IAErB,mFAAmF;IACnF,4CAA2B,CAAA;IAE3B,wEAAwE;IACxE,kCAAiB,CAAA;AACrB,CAAC,EAZW,aAAa,6BAAb,aAAa,QAYxB"}

package/dist/cjs/api/conduit/route.type.d.ts

@@ -0,0 +1,124 @@
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Maybe, Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+import type { MatchOperator } from './match-operator.enum.js';
+/** One condition on a request header. */
+export interface HeaderMatcher {
+    /** Lowercase. Inbound header names are lowercased, so anything else never matches. */
+    name: string;
+    operator: MatchOperator;
+    /** Ignored when the operator is `exists`. */
+    value: Nullable<string>;
+}
+/**
+ * One condition on a field inside a JSON body.
+ *
+ * `path` is a **dotted path**, not JSONPath: `type`, `data.object.id`, `entry.0.changes.0.field`.
+ * Numeric segments index arrays.
+ *
+ * Deliberately not JSONPath and not a regular expression. An expression evaluator running over
+ * an attacker-controlled webhook body is a different risk class from a path walk —
+ * `jsonpath-plus` shipped a remote code execution hole doing exactly this job (CVE-2024-21534).
+ * A dotted path has nothing in it to exploit, and it covers every real routing rule: branch on
+ * an event type, a channel, an object id.
+ */
+export interface BodyMatcher {
+    path: string;
+    operator: MatchOperator;
+    /** Ignored when the operator is `exists`. */
+    value: Nullable<string>;
+}
+/** A matcher as sent on a request, where the operand may simply be omitted. */
+export interface HeaderMatcherInput extends Omit<HeaderMatcher, 'value'> {
+    value?: Maybe<string>;
+}
+/** A body matcher as sent on a request. See {@link HeaderMatcherInput}. */
+export interface BodyMatcherInput extends Omit<BodyMatcher, 'value'> {
+    value?: Maybe<string>;
+}
+/**
+ * Which captures fan out to which destinations.
+ *
+ * **Every criterion is nullable, and null means "any".** A route with all of them null matches
+ * every request on the tenant, which is what a customer writes first. Criteria are ANDed; there
+ * is no OR and no negation, because two routes express an OR and one rule that can express
+ * arbitrary boolean logic is a language.
+ */
+export interface Route {
+    id: UUID;
+    name: string;
+    description: Nullable<string>;
+    /** Null matches any endpoint. */
+    endpointId: Nullable<UUID>;
+    /** Null matches any provider. */
+    providerKey: Nullable<string>;
+    /** Null matches any method. */
+    method: Nullable<string>;
+    /**
+     * Glob over the path after the ingress token. `*` spans one segment, `**` spans any number,
+     * and both ends are anchored — `/orders` does not match `/orders/created`. A glob rather
+     * than a regular expression: a customer-supplied pattern evaluated on the ingress path would
+     * be a ReDoS primitive. Null matches any path.
+     */
+    pathPattern: Nullable<string>;
+    /** Empty rather than null when there are no conditions, so a client handles one spelling. */
+    headerMatchers: HeaderMatcher[];
+    bodyMatchers: BodyMatcher[];
+    /** In order. At least one. */
+    destinationIds: UUID[];
+    /** Evaluation order, lowest first. Only observable through `stopOnMatch`. */
+    priority: number;
+    /**
+     * Stop evaluating further routes once this one matches.
+     *
+     * Default false, so the natural behaviour is fan-out — two routes matching one request both
+     * fire, which is what "also send this to the audit service" means.
+     */
+    stopOnMatch: boolean;
+    isActive: boolean;
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+}
+/** `GET /api/v1/routes`. Ordered by priority then age — the order they are evaluated in. */
+export interface RoutesPage {
+    items: Route[];
+    total: number;
+    limit: number;
+    offset: number;
+}
+/** `POST /api/v1/routes`. */
+export interface CreateRouteBody {
+    name: string;
+    description?: Nullable<string>;
+    endpointId?: Nullable<UUID>;
+    providerKey?: Nullable<string>;
+    method?: Nullable<string>;
+    pathPattern?: Nullable<string>;
+    headerMatchers?: Nullable<HeaderMatcherInput[]>;
+    bodyMatchers?: Nullable<BodyMatcherInput[]>;
+    destinationIds: UUID[];
+    priority?: Nullable<number>;
+    stopOnMatch?: Nullable<boolean>;
+}
+/**
+ * `PATCH /api/v1/routes/:id`.
+ *
+ * For the criteria, `null` and omission differ: omitting leaves the stored criterion alone,
+ * sending `null` widens the route to "any" for it. A form must send `null` rather than `''` to
+ * clear one — an empty string is a criterion nothing matches, which looks like the route broke.
+ */
+export interface UpdateRouteBody {
+    name?: string;
+    description?: Nullable<string>;
+    endpointId?: Nullable<UUID>;
+    providerKey?: Nullable<string>;
+    method?: Nullable<string>;
+    pathPattern?: Nullable<string>;
+    headerMatchers?: Nullable<HeaderMatcherInput[]>;
+    bodyMatchers?: Nullable<BodyMatcherInput[]>;
+    destinationIds?: UUID[];
+    priority?: number;
+    stopOnMatch?: boolean;
+    isActive?: boolean;
+}
+//# sourceMappingURL=route.type.d.ts.map

package/dist/cjs/api/conduit/route.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/route.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC1B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;IACpE,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;IAChE,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,KAAK;IAClB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,iCAAiC;IACjC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE3B,iCAAiC;IACjC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,+BAA+B;IAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,6FAA6F;IAC7F,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,YAAY,EAAE,WAAW,EAAE,CAAC;IAE5B,8BAA8B;IAC9B,cAAc,EAAE,IAAI,EAAE,CAAC;IAEvB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACvB,KAAK,EAAE,KAAK,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,WAAW,eAAe;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5C,cAAc,EAAE,IAAI,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB"}

package/dist/cjs/api/conduit/route.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=route.type.js.map

package/dist/cjs/api/conduit/route.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/route.type.ts"],"names":[],"mappings":""}

package/dist/cjs/enum/user-permission.enum.d.ts

@@ -60,7 +60,36 @@ export declare enum UserPermission {
     CONDUIT_REPLAY_EXECUTE = "conduit:replay:execute",
     CONDUIT_PROVIDER_READ = "conduit:provider:read",
     /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
-    CONDUIT_PROVIDER_MANAGE = "conduit:provider:manage"
+    CONDUIT_PROVIDER_MANAGE = "conduit:provider:manage",
+    /** Read destinations. Never exposes their stored header values. */
+    CONDUIT_DESTINATION_READ = "conduit:destination:read",
+    /**
+     * Create, amend or delete a destination — **a URL Conduit will then post to on its own**,
+     * repeatedly, from inside our network, carrying whatever a provider sent.
+     *
+     * Deliberately a single manage permission rather than create/update/delete: the dangerous
+     * act is naming the URL at all, and splitting it would imply the three carry different
+     * risk. They do not.
+     */
+    CONDUIT_DESTINATION_MANAGE = "conduit:destination:manage",
+    CONDUIT_ROUTE_READ = "conduit:route:read",
+    /** Define which captures fan out to which destinations. */
+    CONDUIT_ROUTE_MANAGE = "conduit:route:manage",
+    /**
+     * Read the delivery log and the dead-letter queue, including each attempt's response.
+     *
+     * Grouped with reading rather than with operating the queue: a delivery record holds a
+     * target's response body, which can echo back the payload that was sent.
+     */
+    CONDUIT_DELIVERY_READ = "conduit:delivery:read",
+    /**
+     * Redrive a dead-lettered delivery, or cancel one still pending.
+     *
+     * Separate from `CONDUIT_DELIVERY_READ` for the same reason replay is separate from capture
+     * read: it causes an outbound request rather than returning a row, and redriving a large
+     * dead-letter backlog is a way to flood a customer's own service.
+     */
+    CONDUIT_DELIVERY_OPERATE = "conduit:delivery:operate"
 }
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;CACtD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}

package/dist/cjs/enum/user-permission.enum.js

@@ -76,6 +76,38 @@ var UserPermission;
     UserPermission["CONDUIT_PROVIDER_READ"] = "conduit:provider:read";
     /** Define or amend a custom provider manifest — signature scheme, headers, handshake. */
     UserPermission["CONDUIT_PROVIDER_MANAGE"] = "conduit:provider:manage";
+    // ── Destination (gateway mode) ──────────────────────────────────────────
+    /** Read destinations. Never exposes their stored header values. */
+    UserPermission["CONDUIT_DESTINATION_READ"] = "conduit:destination:read";
+    /**
+     * Create, amend or delete a destination — **a URL Conduit will then post to on its own**,
+     * repeatedly, from inside our network, carrying whatever a provider sent.
+     *
+     * Deliberately a single manage permission rather than create/update/delete: the dangerous
+     * act is naming the URL at all, and splitting it would imply the three carry different
+     * risk. They do not.
+     */
+    UserPermission["CONDUIT_DESTINATION_MANAGE"] = "conduit:destination:manage";
+    // ── Route (gateway mode) ────────────────────────────────────────────────
+    UserPermission["CONDUIT_ROUTE_READ"] = "conduit:route:read";
+    /** Define which captures fan out to which destinations. */
+    UserPermission["CONDUIT_ROUTE_MANAGE"] = "conduit:route:manage";
+    // ── Delivery (gateway mode) ─────────────────────────────────────────────
+    /**
+     * Read the delivery log and the dead-letter queue, including each attempt's response.
+     *
+     * Grouped with reading rather than with operating the queue: a delivery record holds a
+     * target's response body, which can echo back the payload that was sent.
+     */
+    UserPermission["CONDUIT_DELIVERY_READ"] = "conduit:delivery:read";
+    /**
+     * Redrive a dead-lettered delivery, or cancel one still pending.
+     *
+     * Separate from `CONDUIT_DELIVERY_READ` for the same reason replay is separate from capture
+     * read: it causes an outbound request rather than returning a row, and redriving a large
+     * dead-letter backlog is a way to flood a customer's own service.
+     */
+    UserPermission["CONDUIT_DELIVERY_OPERATE"] = "conduit:delivery:operate";
 })(UserPermission || (exports.UserPermission = UserPermission = {}));
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAkEX;AAlED,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;AACvD,CAAC,EAlEW,cAAc,8BAAd,cAAc,QAkEzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}
+{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAqGX;AArGD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;AACzD,CAAC,EArGW,cAAc,8BAAd,cAAc,QAqGzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}