@crowdsource.you/core 1.2.0

package/dist/esm/webhookEndpoints.js

@@ -0,0 +1,139 @@
+/**
+ * Telling CrowdSource where to deliver decisions, and holding the secret it
+ * mints once.
+ *
+ * This is the half of the webhook integration that used to have no client at
+ * all: `@crowdsource.you/core/express` verifies deliveries against
+ * `CROWDSOURCE_WEBHOOK_SECRET`, and there was no supported way to obtain that
+ * value except hand-rolling an HTTP call with the bearer half of the service
+ * key. "Near-zero configuration" cannot mean an integrator writes their own
+ * fetch for a mandatory step, so §10.2's two management routes are here.
+ *
+ * Two properties of the secret shape everything below, and both are the server's
+ * design rather than this client's choice:
+ *
+ *   * **It is returned once and never again.** A webhook secret is decryptable
+ *     by CrowdSource because deliveries have to be signed with it, but re-serving
+ *     it would turn any credential holding `webhooks:manage` into a way to read
+ *     the signing key of an endpoint somebody else configured. So `secret` on a
+ *     registration is the only time that value exists outside the service.
+ *   * **Re-registering an existing URL mints nothing.** That is what makes a
+ *     deploy script safe to run on every boot — it will not invalidate the
+ *     secret the running process is verifying with. The corollary is that
+ *     re-registering cannot RECOVER a secret you failed to store; that is what
+ *     `rotateSecret` is for.
+ *
+ * Which is why `secret` is optional on the result. Its presence is not a detail:
+ * it means a value has just come into existence that nothing can produce again,
+ * and the integration is responsible for persisting it before the process exits.
+ */
+import { z } from 'zod';
+import { sha256Digest } from './digest.js';
+import { CrowdSourceTransportError } from './errors.js';
+/**
+ * Appendix D's key for a registration.
+ *
+ * Derived from the URL because the URL is the endpoint's identity as far as the
+ * server is concerned — the same URL registered twice is one logical operation,
+ * which is exactly what makes a deploy-time `register` safe to retry. Hashed
+ * rather than interpolated because a URL carries `:` and `/`, and a composite
+ * value with separators in it is how an id grammar gets ambiguous.
+ *
+ * Note that the two webhook routes do NOT currently read `Idempotency-Key`
+ * server-side; only `POST /v1/reports` does. This satisfies the transport's
+ * Appendix D requirement and is inert at the service until that changes.
+ */
+function registrationIdempotencyKey(url) {
+    return `webhook-endpoint.${sha256Digest(url).replace('sha256:', '')}`;
+}
+const WebhookSecretSchema = z.looseObject({
+    version: z.number(),
+    value: z.string(),
+    signingStartsAt: z.string(),
+});
+const WebhookEndpointSchema = z.looseObject({
+    webhookEndpointId: z.string(),
+    url: z.string(),
+    eventTypes: z.array(z.string()),
+    status: z.string(),
+    disabledReason: z.string().nullish(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+    secret: WebhookSecretSchema.optional(),
+});
+const RotatedWebhookSecretSchema = z.looseObject({
+    webhookEndpointId: z.string(),
+    secret: WebhookSecretSchema,
+    previousSecret: z
+        .looseObject({ version: z.number(), expiresAt: z.string() })
+        .nullish(),
+});
+/**
+ * §10.2's two webhook-management routes.
+ *
+ * There is no list, no read-back and no delete, because the API serves none —
+ * §10.2 defines exactly two routes. An integrator therefore cannot enumerate
+ * what it has registered, which is a real gap in the service rather than
+ * something this client can paper over; re-registering a URL is the documented
+ * way to change a subscription or revive a disabled endpoint.
+ *
+ * Both routes need a credential with the `crowdsource:webhooks:manage` scope,
+ * and both derive the application from that credential. There is no
+ * `applicationId` in any request or response here.
+ */
+export class WebhookEndpoints {
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /**
+     * Registers, or updates, the endpoint CrowdSource delivers to.
+     *
+     * Safe to call on every deploy: an existing URL is updated and no new secret
+     * is minted, so the secret the running process verifies with keeps working.
+     */
+    async register(input, options = {}) {
+        const response = await this.transport.request({
+            method: 'POST',
+            path: '/v1/webhook-endpoints',
+            body: { url: input.url, eventTypes: [...input.eventTypes] },
+            idempotencyKey: options.idempotencyKey ?? registrationIdempotencyKey(input.url),
+            signal: options.signal,
+        });
+        const parsed = WebhookEndpointSchema.safeParse(response);
+        if (!parsed.success) {
+            throw new CrowdSourceTransportError('CrowdSource registered the webhook endpoint but answered with a body this client does not recognise.', { retryable: false, cause: parsed.error });
+        }
+        const { disabledReason, secret, ...rest } = parsed.data;
+        return {
+            ...rest,
+            disabledReason: disabledReason ?? null,
+            ...(secret === undefined ? {} : { secret }),
+        };
+    }
+    /**
+     * Mints a new signing secret, retiring the current one after an overlap.
+     *
+     * The only way to recover from a secret that was never stored, and the correct
+     * response to one that leaked.
+     */
+    async rotateSecret(webhookEndpointId, options = {}) {
+        const response = await this.transport.request({
+            method: 'POST',
+            path: `/v1/webhook-endpoints/${encodeURIComponent(webhookEndpointId)}/rotate-secret`,
+            body: options.overlapSeconds === undefined ? {} : { overlapSeconds: options.overlapSeconds },
+            idempotencyKey: options.idempotencyKey ??
+                `webhook-endpoint.${sha256Digest(webhookEndpointId).replace('sha256:', '')}.rotate`,
+            signal: options.signal,
+        });
+        const parsed = RotatedWebhookSecretSchema.safeParse(response);
+        if (!parsed.success) {
+            throw new CrowdSourceTransportError('CrowdSource rotated the webhook secret but answered with a body this client does not recognise.', { retryable: false, cause: parsed.error });
+        }
+        return {
+            webhookEndpointId: parsed.data.webhookEndpointId,
+            secret: parsed.data.secret,
+            previousSecret: parsed.data.previousSecret ?? null,
+        };
+    }
+}
+//# sourceMappingURL=webhookEndpoints.js.map

package/dist/esm/webhookEndpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhookEndpoints.js","sourceRoot":"","sources":["../../src/webhookEndpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAoExD;;;;;;;;;;;;GAYG;AACH,SAAS,0BAA0B,CAAC,GAAW;IAC7C,OAAO,oBAAoB,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;AACxE,CAAC;AAyBD,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC1C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,mBAAmB;IAC3B,cAAc,EAAE,CAAC;SACd,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SAC3D,OAAO,EAAE;CACb,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,gBAAgB;IAG3B,YAAY,SAAoB;QAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,KAAmC,EACnC,UAAyC,EAAE;QAE3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAU;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE;YAC3D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,0BAA0B,CAAC,KAAK,CAAC,GAAG,CAAC;YAC/E,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAyB,CACjC,sGAAsG,EACtG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACxD,OAAO;YACL,GAAG,IAAI;YACP,cAAc,EAAE,cAAc,IAAI,IAAI;YACtC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,iBAAyB,EACzB,UAA+B,EAAE;QAEjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAU;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,yBAAyB,kBAAkB,CAAC,iBAAiB,CAAC,gBAAgB;YACpF,IAAI,EACF,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;YACxF,cAAc,EACZ,OAAO,CAAC,cAAc;gBACtB,oBAAoB,YAAY,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS;YACrF,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAyB,CACjC,iGAAiG,EACjG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAC1C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB;YAChD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI;SACnD,CAAC;IACJ,CAAC;CACF"}

package/dist/express/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `@crowdsource.you/core/express` — receiving CrowdSource webhooks safely.
+ *
+ * The whole integration:
+ *
+ * ```ts
+ * import { crowdsourceWebhooks } from '@crowdsource.you/core/express';
+ *
+ * app.post('/webhooks/crowdsource', crowdsourceWebhooks({
+ *   on: {
+ *     'case.decided': async (event) => {
+ *       await moderationQueue.add(event.id, event.data);
+ *     },
+ *   },
+ * }));
+ * ```
+ *
+ * The secret comes from `CROWDSOURCE_WEBHOOK_SECRET`, the raw body is read by
+ * the handler itself, the signature is verified in constant time over the bytes
+ * that arrived, a stale or replayed delivery is refused, and an event type this
+ * integration does not handle is acknowledged and ignored. None of that is
+ * optional and none of it can be got wrong by mounting things in the wrong
+ * order — see `middleware.ts` for what happens when a body parser gets there
+ * first.
+ */
+export { crowdsourceWebhooks, CrowdSourceWebhookConfigurationError, WEBHOOK_PREVIOUS_SECRET_ENV_VAR, WEBHOOK_SECRET_ENV_VAR, } from './middleware.js';
+export type { CrowdSourceWebhooksOptions, WebhookEventHandlers } from './middleware.js';
+export { memoryProcessedEventStore } from './store.js';
+export type { MemoryProcessedEventStoreOptions, ProcessedEventStore } from './store.js';
+export { signedPayloadBytes, verifyWebhookDelivery, WEBHOOK_REJECTIONS, } from './verify.js';
+export type { WebhookRejection, WebhookVerification, WebhookVerificationInput } from './verify.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/express/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,mBAAmB,EACnB,oCAAoC,EACpC,+BAA+B,EAC/B,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAExF,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACvD,YAAY,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExF,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC"}

package/dist/express/index.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * `@crowdsource.you/core/express` — receiving CrowdSource webhooks safely.
+ *
+ * The whole integration:
+ *
+ * ```ts
+ * import { crowdsourceWebhooks } from '@crowdsource.you/core/express';
+ *
+ * app.post('/webhooks/crowdsource', crowdsourceWebhooks({
+ *   on: {
+ *     'case.decided': async (event) => {
+ *       await moderationQueue.add(event.id, event.data);
+ *     },
+ *   },
+ * }));
+ * ```
+ *
+ * The secret comes from `CROWDSOURCE_WEBHOOK_SECRET`, the raw body is read by
+ * the handler itself, the signature is verified in constant time over the bytes
+ * that arrived, a stale or replayed delivery is refused, and an event type this
+ * integration does not handle is acknowledged and ignored. None of that is
+ * optional and none of it can be got wrong by mounting things in the wrong
+ * order — see `middleware.ts` for what happens when a body parser gets there
+ * first.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WEBHOOK_REJECTIONS = exports.verifyWebhookDelivery = exports.signedPayloadBytes = exports.memoryProcessedEventStore = exports.WEBHOOK_SECRET_ENV_VAR = exports.WEBHOOK_PREVIOUS_SECRET_ENV_VAR = exports.CrowdSourceWebhookConfigurationError = exports.crowdsourceWebhooks = void 0;
+var middleware_js_1 = require("./middleware.js");
+Object.defineProperty(exports, "crowdsourceWebhooks", { enumerable: true, get: function () { return middleware_js_1.crowdsourceWebhooks; } });
+Object.defineProperty(exports, "CrowdSourceWebhookConfigurationError", { enumerable: true, get: function () { return middleware_js_1.CrowdSourceWebhookConfigurationError; } });
+Object.defineProperty(exports, "WEBHOOK_PREVIOUS_SECRET_ENV_VAR", { enumerable: true, get: function () { return middleware_js_1.WEBHOOK_PREVIOUS_SECRET_ENV_VAR; } });
+Object.defineProperty(exports, "WEBHOOK_SECRET_ENV_VAR", { enumerable: true, get: function () { return middleware_js_1.WEBHOOK_SECRET_ENV_VAR; } });
+var store_js_1 = require("./store.js");
+Object.defineProperty(exports, "memoryProcessedEventStore", { enumerable: true, get: function () { return store_js_1.memoryProcessedEventStore; } });
+var verify_js_1 = require("./verify.js");
+Object.defineProperty(exports, "signedPayloadBytes", { enumerable: true, get: function () { return verify_js_1.signedPayloadBytes; } });
+Object.defineProperty(exports, "verifyWebhookDelivery", { enumerable: true, get: function () { return verify_js_1.verifyWebhookDelivery; } });
+Object.defineProperty(exports, "WEBHOOK_REJECTIONS", { enumerable: true, get: function () { return verify_js_1.WEBHOOK_REJECTIONS; } });
+//# sourceMappingURL=index.js.map

package/dist/express/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AAEH,iDAKyB;AAJvB,oHAAA,mBAAmB,OAAA;AACnB,qIAAA,oCAAoC,OAAA;AACpC,gIAAA,+BAA+B,OAAA;AAC/B,uHAAA,sBAAsB,OAAA;AAIxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAGlC,yCAIqB;AAHnB,+GAAA,kBAAkB,OAAA;AAClB,kHAAA,qBAAqB,OAAA;AACrB,+GAAA,kBAAkB,OAAA"}

package/dist/express/middleware.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The webhook receiver.
+ *
+ * ```ts
+ * app.post('/webhooks/crowdsource', crowdsourceWebhooks({
+ *   on: {
+ *     'case.decided': async (event) => { await moderationQueue.add(event.id, event.data); },
+ *   },
+ * }));
+ * ```
+ *
+ * No `express.raw`, no body-parser ordering to get right, no secret to plumb
+ * through — the secret comes from the environment and the handler reads the
+ * request stream itself. That is not convenience for its own sake. The single
+ * most likely way to ship a broken CrowdSource integration is to verify a
+ * signature over `JSON.stringify(req.body)`, which succeeds on every test
+ * payload a developer writes by hand and fails on the first real delivery whose
+ * key order or unicode escaping differs — or, far worse, succeeds on a forged
+ * body that happens to re-serialise identically. This middleware makes that
+ * unreachable: it verifies the bytes it read, and if something upstream already
+ * consumed them it REFUSES rather than reconstructing them.
+ *
+ * What it guarantees, in order:
+ *
+ *   1. The signature is checked over the bytes that arrived (§10.8).
+ *   2. A timestamp outside the five-minute window is rejected before anything
+ *      is dispatched, in both directions.
+ *   3. An event id already claimed is acknowledged without running the handler
+ *      again (§10.8), and a handler that throws releases the claim so the
+ *      retry in §10.9 still works.
+ *   4. An event type this integration does not handle — including one that did
+ *      not exist when it was written — is acknowledged and ignored (§10.11). A
+ *      new event type never breaks an existing integration.
+ *   5. Nothing sensitive is logged. The `onRejected` hook is given the reason
+ *      and never the body (§10.8's last line).
+ */
+import type { RequestHandler } from 'express';
+import { type KnownWebhookEvent, type WebhookEventEnvelope, type WebhookEventType } from '@crowdsource.you/contracts';
+import { type ProcessedEventStore } from './store.js';
+import { type WebhookRejection } from './verify.js';
+/** The active signing secret. */
+export declare const WEBHOOK_SECRET_ENV_VAR = "CROWDSOURCE_WEBHOOK_SECRET";
+/** The secret being retired, during the overlap §10.8 requires for rotation. */
+export declare const WEBHOOK_PREVIOUS_SECRET_ENV_VAR = "CROWDSOURCE_WEBHOOK_SECRET_PREVIOUS";
+/**
+ * A handler per event type, each receiving the event with its payload narrowed.
+ *
+ * Every entry is optional and an absent one is not an error: an integration that
+ * only cares about `case.decided` registers only that.
+ */
+export type WebhookEventHandlers = {
+    readonly [T in WebhookEventType]?: (event: Extract<KnownWebhookEvent, {
+        type: T;
+    }>) => void | Promise<void>;
+};
+export interface CrowdSourceWebhooksOptions {
+    /**
+     * The active secret. Defaults to `process.env.CROWDSOURCE_WEBHOOK_SECRET`.
+     */
+    readonly secret?: string;
+    /**
+     * The secret being retired. Defaults to
+     * `process.env.CROWDSOURCE_WEBHOOK_SECRET_PREVIOUS`. Both are accepted while
+     * it is set, which is what makes a rotation lossless (§10.8).
+     */
+    readonly previousSecret?: string;
+    readonly on?: WebhookEventHandlers;
+    /**
+     * Called for a verified event no handler in `on` covers, including a type this
+     * version of the contracts package does not know. Optional: without it, an
+     * unhandled event is acknowledged and dropped, which is what §10.11 requires.
+     */
+    readonly onUnhandled?: (event: WebhookEventEnvelope) => void | Promise<void>;
+    /** Defaults to an in-process store. See `store.ts` for when that is not enough. */
+    readonly store?: ProcessedEventStore;
+    /** §10.8's five minutes. Lower it in tests, never raise it in production. */
+    readonly toleranceSeconds?: number;
+    readonly maxBodyBytes?: number;
+    /**
+     * Observability for a refused delivery. Receives the reason and nothing else
+     * — never the body, never the signature, never a header.
+     */
+    readonly onRejected?: (rejection: WebhookRejection) => void;
+}
+/**
+ * Thrown when the request cannot be verified because of how the application is
+ * assembled, not because of anything the sender did.
+ *
+ * Passed to `next()` so it reaches the application's error handler and is
+ * impossible to miss. The alternative — falling back to `req.body` — is the bug
+ * this whole package exists to prevent.
+ */
+export declare class CrowdSourceWebhookConfigurationError extends Error {
+    constructor(message: string);
+}
+export declare function crowdsourceWebhooks(options?: CrowdSourceWebhooksOptions): RequestHandler;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/express/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/express/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmC,MAAM,SAAS,CAAC;AAE/E,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACtB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3E,iCAAiC;AACjC,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AAEnE,gFAAgF;AAChF,eAAO,MAAM,+BAA+B,wCAAwC,CAAC;AAKrF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,CAAC,IAAI,gBAAgB,CAAC,CAAC,EAAE,CACjC,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAAE,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,KAC3C,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,EAAE,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,mFAAmF;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC;CAC7D;AAED;;;;;;;GAOG;AACH,qBAAa,oCAAqC,SAAQ,KAAK;gBACjD,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,0BAA+B,GAAG,cAAc,CAgB5F"}

package/dist/express/middleware.js

@@ -0,0 +1,298 @@
+"use strict";
+/**
+ * The webhook receiver.
+ *
+ * ```ts
+ * app.post('/webhooks/crowdsource', crowdsourceWebhooks({
+ *   on: {
+ *     'case.decided': async (event) => { await moderationQueue.add(event.id, event.data); },
+ *   },
+ * }));
+ * ```
+ *
+ * No `express.raw`, no body-parser ordering to get right, no secret to plumb
+ * through — the secret comes from the environment and the handler reads the
+ * request stream itself. That is not convenience for its own sake. The single
+ * most likely way to ship a broken CrowdSource integration is to verify a
+ * signature over `JSON.stringify(req.body)`, which succeeds on every test
+ * payload a developer writes by hand and fails on the first real delivery whose
+ * key order or unicode escaping differs — or, far worse, succeeds on a forged
+ * body that happens to re-serialise identically. This middleware makes that
+ * unreachable: it verifies the bytes it read, and if something upstream already
+ * consumed them it REFUSES rather than reconstructing them.
+ *
+ * What it guarantees, in order:
+ *
+ *   1. The signature is checked over the bytes that arrived (§10.8).
+ *   2. A timestamp outside the five-minute window is rejected before anything
+ *      is dispatched, in both directions.
+ *   3. An event id already claimed is acknowledged without running the handler
+ *      again (§10.8), and a handler that throws releases the claim so the
+ *      retry in §10.9 still works.
+ *   4. An event type this integration does not handle — including one that did
+ *      not exist when it was written — is acknowledged and ignored (§10.11). A
+ *      new event type never breaks an existing integration.
+ *   5. Nothing sensitive is logged. The `onRejected` hook is given the reason
+ *      and never the body (§10.8's last line).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CrowdSourceWebhookConfigurationError = exports.WEBHOOK_PREVIOUS_SECRET_ENV_VAR = exports.WEBHOOK_SECRET_ENV_VAR = void 0;
+exports.crowdsourceWebhooks = crowdsourceWebhooks;
+const contracts_1 = require("@crowdsource.you/contracts");
+const store_js_1 = require("./store.js");
+const verify_js_1 = require("./verify.js");
+/** The active signing secret. */
+exports.WEBHOOK_SECRET_ENV_VAR = 'CROWDSOURCE_WEBHOOK_SECRET';
+/** The secret being retired, during the overlap §10.8 requires for rotation. */
+exports.WEBHOOK_PREVIOUS_SECRET_ENV_VAR = 'CROWDSOURCE_WEBHOOK_SECRET_PREVIOUS';
+/** Matches the backend's own `express.json` limit. */
+const DEFAULT_MAX_BODY_BYTES = 1048576;
+/**
+ * Thrown when the request cannot be verified because of how the application is
+ * assembled, not because of anything the sender did.
+ *
+ * Passed to `next()` so it reaches the application's error handler and is
+ * impossible to miss. The alternative — falling back to `req.body` — is the bug
+ * this whole package exists to prevent.
+ */
+class CrowdSourceWebhookConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CrowdSourceWebhookConfigurationError';
+    }
+}
+exports.CrowdSourceWebhookConfigurationError = CrowdSourceWebhookConfigurationError;
+function crowdsourceWebhooks(options = {}) {
+    const store = options.store ?? (0, store_js_1.memoryProcessedEventStore)();
+    const handlers = options.on ?? {};
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    return (request, response, next) => {
+        void handleDelivery({
+            request,
+            response,
+            next,
+            store,
+            handlers,
+            maxBodyBytes,
+            options,
+        });
+    };
+}
+async function handleDelivery(context) {
+    const { request, response, next, options } = context;
+    let rawBody;
+    try {
+        rawBody = await readRawBody(request, context.maxBodyBytes);
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError) {
+            options.onRejected?.('payload_too_large');
+            response.status(413).json({ received: false, rejection: 'payload_too_large' });
+            return;
+        }
+        next(error);
+        return;
+    }
+    const verification = (0, verify_js_1.verifyWebhookDelivery)({
+        eventIdHeader: request.get(contracts_1.WEBHOOK_EVENT_ID_HEADER),
+        timestampHeader: request.get(contracts_1.WEBHOOK_TIMESTAMP_HEADER),
+        signatureHeader: request.get(contracts_1.WEBHOOK_SIGNATURE_HEADER),
+        rawBody,
+        secrets: configuredSecrets(options),
+        nowMs: Date.now(),
+        ...(options.toleranceSeconds === undefined
+            ? {}
+            : { toleranceSeconds: options.toleranceSeconds }),
+    });
+    if (!verification.ok) {
+        options.onRejected?.(verification.rejection);
+        /**
+         * 401, not 400. A refused delivery is an authentication failure from the
+         * sender's point of view, and §10.9 keeps retrying 4xx a bounded number of
+         * times either way — what matters is that it is never a 2xx, because a 2xx
+         * would retire the delivery as successfully processed.
+         *
+         * `no_secret_configured` is the one case that is OUR fault, and it still
+         * answers 401 rather than 500: a receiver with no secret must not tell the
+         * world it is running unconfigured, and answering non-2xx keeps the event on
+         * the sender's retry schedule until somebody fixes it.
+         */
+        response.status(401).json({ received: false, rejection: verification.rejection });
+        return;
+    }
+    const parsed = contracts_1.WebhookEventEnvelopeSchema.safeParse(parseJson(rawBody));
+    if (!parsed.success) {
+        options.onRejected?.('malformed_event');
+        response.status(400).json({ received: false, rejection: 'malformed_event' });
+        return;
+    }
+    const envelope = parsed.data;
+    /**
+     * The signed header and the signed body must name the same event. They are
+     * both inside the signature, so a disagreement is not an attack — it is a
+     * sender defect — but a receiver that deduped on the header while handling the
+     * body would process one event under another's id.
+     */
+    if (envelope.id !== verification.eventId) {
+        options.onRejected?.('event_id_mismatch');
+        response.status(400).json({ received: false, rejection: 'event_id_mismatch' });
+        return;
+    }
+    const claimed = await context.store.claim(envelope.id);
+    if (!claimed) {
+        response.status(200).json({ received: true, eventId: envelope.id, duplicate: true });
+        return;
+    }
+    try {
+        const handled = await dispatch(context.handlers, envelope, options.onUnhandled);
+        response.status(200).json({ received: true, eventId: envelope.id, duplicate: false, handled });
+    }
+    catch (error) {
+        // The claim goes back so §10.9's retry schedule can deliver it again. Losing
+        // a decision because a queue was briefly down is not an acceptable outcome.
+        await context.store.release(envelope.id);
+        next(error);
+    }
+}
+/**
+ * Dispatches a verified event, and returns whether anything handled it.
+ *
+ * The switch is exhaustive over the contract's event types on purpose: adding an
+ * event to `WEBHOOK_EVENT_TYPES` stops this file compiling until it is handled
+ * here, which is the right failure for the SDK. For an INTEGRATION it is the
+ * opposite — the `default` branch means an unrecognised type is acknowledged and
+ * ignored, so a newer CrowdSource never breaks an older receiver (§10.11).
+ *
+ * The payload is only parsed against the known-event schema when a handler is
+ * actually registered for that type. An integration handling `case.decided` is
+ * therefore unaffected by a later change to what `appeal.created` carries.
+ */
+async function dispatch(handlers, envelope, onUnhandled) {
+    const known = contracts_1.KnownWebhookEventSchema.safeParse(envelope);
+    if (known.success && (await invoke(handlers, known.data)))
+        return true;
+    if (onUnhandled) {
+        await onUnhandled(envelope);
+        return true;
+    }
+    return false;
+}
+/** Calls `handler` with `event` if there is one, and says whether there was. */
+async function call(handler, event) {
+    if (handler === undefined)
+        return false;
+    await handler(event);
+    return true;
+}
+/**
+ * The exhaustive half of `dispatch`, written out rather than looked up.
+ *
+ * Indexing the handler map with `event.type` while `event.type` is still a union
+ * would need a cast to call the result, and a cast is exactly what must not sit
+ * between a signed event and the code that acts on it. Narrowing per case is
+ * what makes each call provably well-typed, and it means adding an event to the
+ * contract stops this file compiling until it is handled.
+ */
+async function invoke(handlers, event) {
+    switch (event.type) {
+        case 'report.received':
+            return await call(handlers['report.received'], event);
+        case 'case.created':
+            return await call(handlers['case.created'], event);
+        case 'case.escalated':
+            return await call(handlers['case.escalated'], event);
+        case 'case.decided':
+            return await call(handlers['case.decided'], event);
+        case 'decision.corrected':
+            return await call(handlers['decision.corrected'], event);
+        case 'appeal.created':
+            return await call(handlers['appeal.created'], event);
+        case 'appeal.decided':
+            return await call(handlers['appeal.decided'], event);
+        case 'case.closed':
+            return await call(handlers['case.closed'], event);
+        case 'community_note.status_changed':
+            return await call(handlers['community_note.status_changed'], event);
+        default:
+            return false;
+    }
+}
+function configuredSecrets(options) {
+    const active = options.secret ?? process.env[exports.WEBHOOK_SECRET_ENV_VAR];
+    const previous = options.previousSecret ?? process.env[exports.WEBHOOK_PREVIOUS_SECRET_ENV_VAR];
+    return [active, previous].filter((secret) => typeof secret === 'string' && secret.length > 0);
+}
+function parseJson(rawBody) {
+    try {
+        return JSON.parse(rawBody.toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+class BodyTooLargeError extends Error {
+}
+/**
+ * The bytes as they arrived.
+ *
+ * Three sources, in the order that keeps the guarantee:
+ *
+ *   1. `req.body` is already a Buffer — `express.raw()` is mounted ahead of this
+ *      handler, which is correct and supported.
+ *   2. `req.rawBody` is a Buffer — the `express.json({ verify })` idiom, also
+ *      correct.
+ *   3. Nothing has touched the request — read the stream.
+ *
+ * Anything else REFUSES. A parsed `req.body` means a JSON parser ran first and
+ * the original bytes are gone; re-serialising them would produce a different
+ * value from the one that was signed, and the only way to make that "work"
+ * would be to verify a signature over bytes CrowdSource never sent.
+ */
+async function readRawBody(request, maxBodyBytes) {
+    const carried = Reflect.get(request, 'rawBody');
+    if (Buffer.isBuffer(carried))
+        return carried;
+    const parsedBody = request.body;
+    if (Buffer.isBuffer(parsedBody))
+        return parsedBody;
+    if (parsedBody !== undefined && parsedBody !== null) {
+        throw new CrowdSourceWebhookConfigurationError('A body parser ran before the CrowdSource webhook handler, so the signed bytes no longer exist. Mount this handler before express.json(), scope express.json() away from the webhook route, or use express.json({ verify }) to keep the raw body.');
+    }
+    if (request.readableEnded) {
+        throw new CrowdSourceWebhookConfigurationError('The request body was already consumed before the CrowdSource webhook handler ran, so the signed bytes no longer exist.');
+    }
+    return await new Promise((resolve, reject) => {
+        const chunks = [];
+        let received = 0;
+        let settled = false;
+        request.on('data', (chunk) => {
+            if (settled)
+                return;
+            received += chunk.length;
+            if (received > maxBodyBytes) {
+                settled = true;
+                // Paused rather than destroyed: destroying the request takes the socket
+                // with it, and the 413 the caller is about to write would never reach
+                // the sender — which would turn a clear refusal into a connection reset
+                // that a delivery worker can only report as "unknown".
+                request.pause();
+                reject(new BodyTooLargeError());
+                return;
+            }
+            chunks.push(chunk);
+        });
+        request.on('end', () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(Buffer.concat(chunks));
+        });
+        request.on('error', (error) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        });
+    });
+}
+//# sourceMappingURL=middleware.js.map

package/dist/express/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/express/middleware.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAoFH,kDAgBC;AAhGD,0DASoC;AAEpC,yCAAiF;AACjF,2CAA2E;AAE3E,iCAAiC;AACpB,QAAA,sBAAsB,GAAG,4BAA4B,CAAC;AAEnE,gFAAgF;AACnE,QAAA,+BAA+B,GAAG,qCAAqC,CAAC;AAErF,sDAAsD;AACtD,MAAM,sBAAsB,GAAG,OAAS,CAAC;AA4CzC;;;;;;;GAOG;AACH,MAAa,oCAAqC,SAAQ,KAAK;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AALD,oFAKC;AAED,SAAgB,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAA,oCAAyB,GAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAEpE,OAAO,CAAC,OAAgB,EAAE,QAAkB,EAAE,IAAkB,EAAQ,EAAE;QACxE,KAAK,cAAc,CAAC;YAClB,OAAO;YACP,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,YAAY;YACZ,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAYD,KAAK,UAAU,cAAc,CAAC,OAAwB;IACpD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAErD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,OAAO,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,CAAC;YAC1C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,iCAAqB,EAAC;QACzC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAuB,CAAC;QACnD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAwB,CAAC;QACtD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAwB,CAAC;QACtD,OAAO;QACP,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACnC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;QACjB,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC7C;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,sCAA0B,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,UAAU,EAAE,CAAC,iBAAiB,CAAC,CAAC;QACxC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,IAAI,QAAQ,CAAC,EAAE,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC1C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAChF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,QAAQ,CACrB,QAA8B,EAC9B,QAA8B,EAC9B,WAAsD;IAEtD,MAAM,KAAK,GAAG,mCAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,IAAI,CACjB,OAAyD,EACzD,KAAQ;IAER,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,MAAM,CACnB,QAA8B,EAC9B,KAAwB;IAExB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB;YACpB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;QACxD,KAAK,cAAc;YACjB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,KAAK,gBAAgB;YACnB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,KAAK,cAAc;YACjB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,KAAK,oBAAoB;YACvB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,gBAAgB;YACnB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,KAAK,gBAAgB;YACnB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,KAAK,aAAa;YAChB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,+BAA+B;YAClC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,KAAK,CAAC,CAAC;QACtE;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAmC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,8BAAsB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,uCAA+B,CAAC,CAAC;IACxF,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,YAAoB;IAC/D,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE7C,MAAM,UAAU,GAAY,OAAO,CAAC,IAAI,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAEnD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,oCAAoC,CAC5C,kPAAkP,CACnP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,oCAAoC,CAC5C,wHAAwH,CACzH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO;YACpB,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;gBAC5B,OAAO,GAAG,IAAI,CAAC;gBACf,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,uDAAuD;gBACvD,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}