@critical-path/core 0.25.0 → 0.27.0

package/src/webhooks/dispatcher.ts

@@ -0,0 +1,190 @@
+import type { Webhook } from '../types/index.js';
+import type { DomainEvent } from '../domain/events.js';
+import { signWebhookPayload } from './signature.js';
+
+/** One attempt to deliver one event to one webhook. Serializable, so durable queues can store it. */
+export interface WebhookDeliveryJob {
+  /** Stable per event and webhook (`<eventId>:<webhookId>`); sent as `X-CriticalPath-Delivery`. */
+  id: string;
+  webhookId: string;
+  url: string;
+  secret?: string;
+  event: string;
+  /** JSON body, signed as-is. */
+  body: string;
+  /** 1-based attempt number. */
+  attempt: number;
+}
+
+/**
+ * Schedules delivery jobs. The default `InProcessWebhookQueue` keeps jobs in memory (lost on
+ * restart). A durable queue persists `job` and, when `delayMs` has passed, calls
+ * `engine.webhooks.deliver(job)` from a worker.
+ */
+export interface WebhookDeliveryQueue {
+  enqueue(job: WebhookDeliveryJob, delayMs: number): void | Promise<void>;
+}
+
+export interface WebhookDeliveryOptions {
+  /** Custom queue (e.g. backed by a database or job runner). Default: in-process timers. */
+  queue?: WebhookDeliveryQueue;
+  /** Fetch implementation. Default: global `fetch`. */
+  fetch?: typeof fetch;
+  /** Per-attempt timeout. Default 10 000 ms. */
+  timeoutMs?: number;
+  /** Attempts before giving up. Default 5. */
+  maxAttempts?: number;
+  /** First retry delay; doubles each attempt. Default 1 000 ms. */
+  retryBaseDelayMs?: number;
+  /**
+   * Allow webhook URLs that point at localhost or private network addresses. Default `false`,
+   * which blocks literal private hosts to reduce SSRF risk (DNS-based tricks are not detected).
+   */
+  allowPrivateUrls?: boolean;
+  onDelivered?: (job: WebhookDeliveryJob, status: number) => void;
+  /** Called after the final failed attempt. Default: `console.warn`. */
+  onDeliveryFailed?: (job: WebhookDeliveryJob, error: unknown) => void;
+}
+
+export interface WebhookSource {
+  listWebhooks(): Promise<Webhook[]>;
+  /** The tenant an event belongs to; only webhooks with the same `tenantId` receive it. */
+  resolveTenant(event: DomainEvent): Promise<string | undefined>;
+}
+
+/** Default queue: runs jobs on timers in this process. Timers do not keep the process alive. */
+export class InProcessWebhookQueue implements WebhookDeliveryQueue {
+  private outstanding = 0;
+  private waiters: Array<() => void> = [];
+
+  constructor(private readonly run: (job: WebhookDeliveryJob) => Promise<void>) {}
+
+  enqueue(job: WebhookDeliveryJob, delayMs: number): void {
+    this.outstanding++;
+    const timer = setTimeout(async () => {
+      try {
+        await this.run(job);
+      } finally {
+        this.outstanding--;
+        if (this.outstanding === 0) this.waiters.splice(0).forEach((resolve) => resolve());
+      }
+    }, delayMs);
+    (timer as { unref?: () => void }).unref?.();
+  }
+
+  /** Resolves when no deliveries (including scheduled retries) are pending. */
+  idle(): Promise<void> {
+    return this.outstanding === 0 ? Promise.resolve() : new Promise((resolve) => this.waiters.push(resolve));
+  }
+}
+
+const PRIVATE_HOST = /^(localhost|.*\.localhost|.*\.internal|127\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2\d|3[01])\.\d+\.\d+|169\.254\.\d+\.\d+|0\.0\.0\.0|\[::1?\]|\[f[cd][0-9a-f]*:.*\]|\[fe80:.*\])$/i;
+
+/** Throws if `url` is not an acceptable webhook target. */
+export function assertWebhookUrl(url: string, allowPrivateUrls = false): void {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid webhook URL "${url}".`);
+  }
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    throw new Error('Webhook URLs must use http or https.');
+  }
+  if (!allowPrivateUrls && PRIVATE_HOST.test(parsed.hostname)) {
+    throw new Error(`Webhook URL host "${parsed.hostname}" is a private or local address. Set webhookDelivery.allowPrivateUrls to allow it.`);
+  }
+}
+
+/**
+ * Turns domain events into signed webhook deliveries with timeouts and exponential-backoff retries.
+ * Subscribed to the engine's event bus, so every published event is deliverable.
+ */
+export class WebhookDispatcher {
+  private readonly queue: WebhookDeliveryQueue;
+  private readonly fetchImpl: typeof fetch;
+  private cache?: Promise<Webhook[]>;
+
+  constructor(
+    private readonly source: WebhookSource,
+    private readonly options: WebhookDeliveryOptions = {}
+  ) {
+    this.queue = options.queue ?? new InProcessWebhookQueue((job) => this.deliver(job));
+    this.fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+  }
+
+  /** Drops cached webhooks; call after creating, updating or deleting one. */
+  invalidate(): void {
+    this.cache = undefined;
+  }
+
+  /** Resolves when the default in-process queue has nothing pending. */
+  idle(): Promise<void> {
+    return this.queue instanceof InProcessWebhookQueue ? this.queue.idle() : Promise.resolve();
+  }
+
+  async handle(event: DomainEvent): Promise<void> {
+    this.cache ??= this.source.listWebhooks().catch((err) => {
+      this.cache = undefined;
+      throw err;
+    });
+    const subscribed = (await this.cache).filter(
+      (w) => w.active && (w.events.includes('*') || w.events.includes(event.name as Webhook['events'][number]))
+    );
+    if (subscribed.length === 0) return;
+
+    const tenantId = await this.source.resolveTenant(event);
+    const targets = subscribed.filter((w) => w.tenantId === tenantId);
+    if (targets.length === 0) return;
+
+    const body = JSON.stringify({
+      id: event.id,
+      event: event.name,
+      occurredAt: event.occurredAt,
+      ...(tenantId ? { tenantId } : {}),
+      data: event.payload
+    });
+    for (const webhook of targets) {
+      await this.queue.enqueue(
+        { id: `${event.id}:${webhook.id}`, webhookId: webhook.id, url: webhook.url, secret: webhook.secret, event: event.name, body, attempt: 1 },
+        0
+      );
+    }
+  }
+
+  /** Makes one delivery attempt, scheduling a retry (or reporting failure) if it does not succeed. */
+  async deliver(job: WebhookDeliveryJob): Promise<void> {
+    const maxAttempts = this.options.maxAttempts ?? 5;
+    try {
+      assertWebhookUrl(job.url, this.options.allowPrivateUrls);
+      const timestamp = Math.floor(Date.now() / 1000);
+      const headers: Record<string, string> = {
+        'Content-Type': 'application/json',
+        'User-Agent': 'CriticalPath-Webhooks/1',
+        'X-CriticalPath-Event': job.event,
+        'X-CriticalPath-Delivery': job.id,
+        'X-CriticalPath-Timestamp': String(timestamp)
+      };
+      if (job.secret) {
+        headers['X-CriticalPath-Signature'] = await signWebhookPayload({ secret: job.secret, body: job.body, timestamp });
+      }
+      const response = await this.fetchImpl(job.url, {
+        method: 'POST',
+        headers,
+        body: job.body,
+        signal: AbortSignal.timeout(this.options.timeoutMs ?? 10_000)
+      });
+      if (!response.ok) throw new Error(`Webhook responded with HTTP ${response.status}`);
+      this.options.onDelivered?.(job, response.status);
+    } catch (error) {
+      if (job.attempt < maxAttempts) {
+        const delay = (this.options.retryBaseDelayMs ?? 1_000) * 2 ** (job.attempt - 1);
+        await this.queue.enqueue({ ...job, attempt: job.attempt + 1 }, delay);
+      } else if (this.options.onDeliveryFailed) {
+        this.options.onDeliveryFailed(job, error);
+      } else {
+        console.warn(`[CriticalPath Webhooks] Giving up on delivery ${job.id} to ${job.url} after ${job.attempt} attempts:`, error);
+      }
+    }
+  }
+}

package/src/webhooks/index.ts

@@ -0,0 +1,2 @@
+export * from './signature.js';
+export * from './dispatcher.js';

package/src/webhooks/signature.ts

@@ -0,0 +1,57 @@
+/**
+ * Webhook signing (HMAC-SHA256 over `"<timestamp>.<body>"`) using Web Crypto, so it works in
+ * Node, edge runtimes and browsers alike.
+ */
+
+const encoder = new TextEncoder();
+
+async function hmacHex(secret: string, message: string): Promise<string> {
+  const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, [
+    'sign'
+  ]);
+  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message));
+  return Array.from(new Uint8Array(signature), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+function constantTimeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+/** Returns the `X-CriticalPath-Signature` header value: `sha256=<hex>`. */
+export async function signWebhookPayload(input: { secret: string; body: string; timestamp: number }): Promise<string> {
+  return `sha256=${await hmacHex(input.secret, `${input.timestamp}.${input.body}`)}`;
+}
+
+export interface VerifyWebhookSignatureInput {
+  secret: string;
+  /** The raw request body, exactly as received. */
+  body: string;
+  /** `X-CriticalPath-Timestamp` header (Unix seconds). */
+  timestamp: string | number;
+  /** `X-CriticalPath-Signature` header. */
+  signature: string;
+  /** Reject deliveries older or newer than this many seconds (replay protection). Default 300. */
+  toleranceSeconds?: number;
+  /** Current time in milliseconds, for tests. */
+  now?: number;
+}
+
+/** Verifies a delivery in a webhook receiver. */
+export async function verifyWebhookSignature(input: VerifyWebhookSignatureInput): Promise<boolean> {
+  const timestamp = Number(input.timestamp);
+  if (!Number.isFinite(timestamp)) return false;
+  const tolerance = input.toleranceSeconds ?? 300;
+  const nowSeconds = Math.floor((input.now ?? Date.now()) / 1000);
+  if (Math.abs(nowSeconds - timestamp) > tolerance) return false;
+  const expected = await signWebhookPayload({ secret: input.secret, body: input.body, timestamp });
+  return constantTimeEqual(expected, input.signature);
+}
+
+/** Generates a random signing secret (`whsec_` + 64 hex characters). */
+export function generateWebhookSecret(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(32));
+  return `whsec_${Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('')}`;
+}

package/src/webhooks/webhooks.test.ts

@@ -0,0 +1,200 @@
+import { describe, it, expect } from 'vitest';
+import {
+  CriticalPathEngine,
+  SQLiteStore,
+  createRolePolicy,
+  ForbiddenError,
+  ValidationError,
+  signWebhookPayload,
+  verifyWebhookSignature,
+  type WebhookDeliveryOptions
+} from '../index.js';
+
+interface Captured {
+  url: string;
+  headers: Record<string, string>;
+  body: any;
+  rawBody: string;
+}
+
+/** Engine whose webhook deliveries are captured instead of sent. `respond` decides each status. */
+function engineWithCapture(options: WebhookDeliveryOptions & { respond?: (n: number) => number } = {}, config = {}) {
+  const deliveries: Captured[] = [];
+  const fetchMock = (async (url: string, init: RequestInit) => {
+    const rawBody = init.body as string;
+    deliveries.push({ url, headers: init.headers as Record<string, string>, body: JSON.parse(rawBody), rawBody });
+    return new Response(null, { status: options.respond?.(deliveries.length) ?? 200 });
+  }) as unknown as typeof fetch;
+  const engine = new CriticalPathEngine({
+    ...config,
+    webhookDelivery: { retryBaseDelayMs: 1, ...options, fetch: options.fetch ?? fetchMock }
+  });
+  return { engine, deliveries };
+}
+
+describe('webhook signatures', () => {
+  it('signs and verifies, rejecting tampering and stale timestamps', async () => {
+    const timestamp = Math.floor(Date.now() / 1000);
+    const signature = await signWebhookPayload({ secret: 's3cret', body: '{"a":1}', timestamp });
+
+    expect(await verifyWebhookSignature({ secret: 's3cret', body: '{"a":1}', timestamp, signature })).toBe(true);
+    expect(await verifyWebhookSignature({ secret: 's3cret', body: '{"a":2}', timestamp, signature })).toBe(false);
+    expect(await verifyWebhookSignature({ secret: 'other', body: '{"a":1}', timestamp, signature })).toBe(false);
+    expect(
+      await verifyWebhookSignature({ secret: 's3cret', body: '{"a":1}', timestamp, signature, now: (timestamp + 3600) * 1000 })
+    ).toBe(false);
+  });
+});
+
+describe('webhook delivery', () => {
+  it('delivers signed domain events to subscribed webhooks', async () => {
+    const { engine, deliveries } = engineWithCapture();
+    const { secret } = await engine.createWebhook({ name: 'CI', url: 'https://hooks.example.com/cp', events: ['task.created'] });
+    const project = await engine.createProject({ name: 'Hooks' });
+    const task = await engine.createTask({ projectId: project.id, title: 'Ship it' });
+    await engine.webhooks.idle();
+
+    expect(deliveries).toHaveLength(1);
+    const [delivery] = deliveries;
+    expect(delivery.headers['X-CriticalPath-Event']).toBe('task.created');
+    expect(delivery.body.data.task.id).toBe(task.id);
+    expect(
+      await verifyWebhookSignature({
+        secret,
+        body: delivery.rawBody,
+        timestamp: delivery.headers['X-CriticalPath-Timestamp'],
+        signature: delivery.headers['X-CriticalPath-Signature']
+      })
+    ).toBe(true);
+  });
+
+  it('supports wildcard subscriptions and skips inactive webhooks', async () => {
+    const { engine, deliveries } = engineWithCapture();
+    await engine.createWebhook({ name: 'All', url: 'https://hooks.example.com/all', events: ['*'] });
+    const off = await engine.createWebhook({ name: 'Off', url: 'https://hooks.example.com/off', events: ['*'] });
+    await engine.updateWebhook(off.webhook.id, { active: false });
+
+    const project = await engine.createProject({ name: 'Wild' });
+    await engine.createTask({ projectId: project.id, title: 'T' });
+    await engine.webhooks.idle();
+
+    expect(deliveries.map((d) => d.body.event)).toEqual(['project.created', 'task.created']);
+    expect(deliveries.every((d) => d.url.endsWith('/all'))).toBe(true);
+  });
+
+  it('retries failed deliveries with backoff, then reports the final failure', async () => {
+    const failures: string[] = [];
+    const { engine, deliveries } = engineWithCapture({
+      maxAttempts: 3,
+      respond: () => 500,
+      onDeliveryFailed: (job) => failures.push(job.id)
+    });
+    await engine.createWebhook({ name: 'Flaky', url: 'https://hooks.example.com/flaky', events: ['project.created'] });
+    await engine.createProject({ name: 'Retry' });
+    await engine.webhooks.idle();
+
+    expect(deliveries).toHaveLength(3);
+    expect(new Set(deliveries.map((d) => d.headers['X-CriticalPath-Delivery'])).size).toBe(1);
+    expect(failures).toHaveLength(1);
+  });
+
+  it('stops retrying once a delivery succeeds', async () => {
+    const { engine, deliveries } = engineWithCapture({ respond: (n) => (n < 3 ? 503 : 200) });
+    await engine.createWebhook({ name: 'Eventually', url: 'https://hooks.example.com/ok', events: ['project.created'] });
+    await engine.createProject({ name: 'Recover' });
+    await engine.webhooks.idle();
+    expect(deliveries).toHaveLength(3);
+  });
+
+  it('times out hung receivers', async () => {
+    const failures: unknown[] = [];
+    const hanging = ((_url: string, init: RequestInit) =>
+      new Promise((_resolve, reject) => init.signal!.addEventListener('abort', () => reject(init.signal!.reason)))) as unknown as typeof fetch;
+    const { engine } = engineWithCapture({ fetch: hanging, timeoutMs: 10, maxAttempts: 1, onDeliveryFailed: (_job, err) => failures.push(err) });
+    await engine.createWebhook({ name: 'Slow', url: 'https://hooks.example.com/slow', events: ['project.created'] });
+    await engine.createProject({ name: 'Timeout' });
+    await engine.webhooks.idle();
+    expect(failures).toHaveLength(1);
+  });
+
+  it('routes events only to webhooks in the same tenant, including deletions', async () => {
+    const { engine, deliveries } = engineWithCapture();
+    const acme = engine.withActor({ userId: 'a', tenantId: 'acme' });
+    const globex = engine.withActor({ userId: 'g', tenantId: 'globex' });
+    await acme.createWebhook({ name: 'Acme', url: 'https://hooks.example.com/acme', events: ['*'] });
+    await globex.createWebhook({ name: 'Globex', url: 'https://hooks.example.com/globex', events: ['*'] });
+
+    const project = await acme.createProject({ name: 'Acme only' });
+    await acme.createTask({ projectId: project.id, title: 'T' });
+    await acme.deleteProject(project.id);
+    await engine.webhooks.idle();
+
+    expect(deliveries.length).toBeGreaterThan(0);
+    expect(deliveries.every((d) => d.url.endsWith('/acme'))).toBe(true);
+    expect(deliveries.every((d) => d.body.tenantId === 'acme')).toBe(true);
+    expect(deliveries.map((d) => d.body.event)).toContain('project.deleted');
+  });
+
+  it('delivers to static webhooks from config', async () => {
+    const { engine, deliveries } = engineWithCapture(
+      {},
+      { webhooks: [{ name: 'Static', url: 'https://hooks.example.com/static', events: ['project.created'], active: true }] }
+    );
+    await engine.createProject({ name: 'Configured' });
+    await engine.webhooks.idle();
+    expect(deliveries).toHaveLength(1);
+  });
+});
+
+describe('webhook management', () => {
+  it('returns the secret once and redacts it from reads', async () => {
+    const { engine } = engineWithCapture();
+    const created = await engine.createWebhook({ name: 'Mine', url: 'https://hooks.example.com/x', events: ['*'] });
+    expect(created.secret).toMatch(/^whsec_[0-9a-f]{64}$/);
+    expect(created.webhook).not.toHaveProperty('secret');
+    expect(created.webhook.hasSecret).toBe(true);
+
+    const [listed] = await engine.getWebhooks();
+    expect(listed).not.toHaveProperty('secret');
+    expect(await engine.deleteWebhook(created.webhook.id)).toBe(true);
+    expect(await engine.getWebhooks()).toHaveLength(0);
+  });
+
+  it('rejects non-http and private URLs unless private URLs are allowed', async () => {
+    const { engine } = engineWithCapture();
+    await expect(engine.createWebhook({ name: 'x', url: 'ftp://hooks.example.com', events: ['*'] })).rejects.toThrow(ValidationError);
+    await expect(engine.createWebhook({ name: 'x', url: 'http://169.254.169.254/latest', events: ['*'] })).rejects.toThrow(/private/);
+    await expect(engine.createWebhook({ name: 'x', url: 'http://localhost:3000/hook', events: ['*'] })).rejects.toThrow(/private/);
+
+    const { engine: dev } = engineWithCapture({ allowPrivateUrls: true });
+    await expect(dev.createWebhook({ name: 'x', url: 'http://localhost:3000/hook', events: ['*'] })).resolves.toBeDefined();
+  });
+
+  it('requires workspace.manage under a role policy and scopes webhooks by tenant', async () => {
+    const { engine } = engineWithCapture({}, { authorize: createRolePolicy() });
+    const member = engine.withActor({ userId: 'm', tenantId: 'acme' });
+    const admin = engine.withActor({ userId: 'root', tenantId: 'acme', roles: ['admin'] });
+    const otherAdmin = engine.withActor({ userId: 'root2', tenantId: 'globex', roles: ['admin'] });
+
+    await expect(member.createWebhook({ name: 'x', url: 'https://hooks.example.com/x', events: ['*'] })).rejects.toThrow(ForbiddenError);
+    const { webhook } = await admin.createWebhook({ name: 'Acme', url: 'https://hooks.example.com/acme', events: ['*'] });
+    expect(webhook.tenantId).toBe('acme');
+    expect(await otherAdmin.getWebhooks()).toHaveLength(0);
+    expect(await otherAdmin.deleteWebhook(webhook.id)).toBe(false);
+  });
+
+  it('persists webhooks in SQLiteStore', async () => {
+    const engine = new CriticalPathEngine({ store: new SQLiteStore({ filename: ':memory:' }) });
+    const { webhook } = await engine.withActor({ userId: 'a', tenantId: 'acme' }).createWebhook({
+      name: 'Stored',
+      url: 'https://hooks.example.com/s',
+      events: ['task.created']
+    });
+    await engine.updateWebhook(webhook.id, { events: ['*'], name: 'Renamed' });
+
+    const stored = await engine.store.getWebhook(webhook.id);
+    expect(stored).toMatchObject({ name: 'Renamed', events: ['*'], tenantId: 'acme', active: true });
+    expect(stored?.secret).toMatch(/^whsec_/);
+    expect(await engine.deleteWebhook(webhook.id)).toBe(true);
+  });
+});

package/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/deliverables.test.ts","./src/index.test.ts","./src/index.ts","./src/status.test.ts","./src/task-state.test.ts","./src/use-case-validation.test.ts","./src/domain/calendar.test.ts","./src/domain/calendar.ts","./src/domain/cpm.test.ts","./src/domain/cpm.ts","./src/domain/custom-fields.ts","./src/domain/ddd.test.ts","./src/domain/entities.ts","./src/domain/errors.ts","./src/domain/events.ts","./src/domain/graph.ts","./src/domain/index.ts","./src/domain/ladder.test.ts","./src/domain/ladder.ts","./src/domain/metrics.test.ts","./src/domain/metrics.ts","./src/domain/task-duration.test.ts","./src/domain/workload.test.ts","./src/domain/workload.ts","./src/engine/actor.test.ts","./src/engine/index.ts","./src/plugins/index.ts","./src/schemas/index.ts","./src/schemas/schemas.test.ts","./src/storage/file-storage.ts","./src/storage/firebase-storage.ts","./src/storage/index.ts","./src/storage/s3.ts","./src/storage/storage.test.ts","./src/store/firebase.test.ts","./src/store/firebase.ts","./src/store/index.ts","./src/store/sqlite.test.ts","./src/store/sqlite.ts","./src/types/index.ts","./src/utils/fractional-index.test.ts","./src/utils/fractional-index.ts","./src/utils/index.ts","./src/utils/key.test.ts","./src/utils/key.ts","./src/utils/mentions.test.ts","./src/utils/mentions.ts","./src/utils/status.ts","./src/utils/workflow.ts"],"version":"5.9.3"}
+{"root":["./src/deliverables.test.ts","./src/index.test.ts","./src/index.ts","./src/status.test.ts","./src/task-state.test.ts","./src/use-case-validation.test.ts","./src/domain/authorization.ts","./src/domain/calendar.test.ts","./src/domain/calendar.ts","./src/domain/cpm.test.ts","./src/domain/cpm.ts","./src/domain/custom-fields.ts","./src/domain/ddd.test.ts","./src/domain/entities.ts","./src/domain/errors.ts","./src/domain/events.ts","./src/domain/graph.ts","./src/domain/index.ts","./src/domain/ladder.test.ts","./src/domain/ladder.ts","./src/domain/metrics.test.ts","./src/domain/metrics.ts","./src/domain/task-duration.test.ts","./src/domain/workload.test.ts","./src/domain/workload.ts","./src/engine/actor.test.ts","./src/engine/authorization.test.ts","./src/engine/index.ts","./src/plugins/index.ts","./src/schemas/index.ts","./src/schemas/schemas.test.ts","./src/storage/file-storage.ts","./src/storage/firebase-storage.ts","./src/storage/index.ts","./src/storage/s3.ts","./src/storage/storage.test.ts","./src/store/firebase.test.ts","./src/store/firebase.ts","./src/store/index.ts","./src/store/sqlite.test.ts","./src/store/sqlite.ts","./src/types/index.ts","./src/utils/fractional-index.test.ts","./src/utils/fractional-index.ts","./src/utils/index.ts","./src/utils/key.test.ts","./src/utils/key.ts","./src/utils/mentions.test.ts","./src/utils/mentions.ts","./src/utils/status.ts","./src/utils/workflow.ts","./src/webhooks/dispatcher.ts","./src/webhooks/index.ts","./src/webhooks/signature.ts","./src/webhooks/webhooks.test.ts"],"version":"5.9.3"}