@crowdsource.you/core 1.2.0

package/dist/express/store.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Idempotency by event id (§10.8: "store the processed event id").
+ *
+ * A delivery is retried on the schedule in §10.9 — six times over 24 hours —
+ * and a retry can also happen because the receiver's 2xx was lost rather than
+ * because it failed. So the same event WILL arrive twice at a healthy receiver,
+ * and "did I already do this?" is the only thing standing between that and a
+ * piece of content being removed twice or a user being suspended twice.
+ *
+ * The interface is claim/release rather than a "seen?" check, because the
+ * obvious design is wrong in a way that is hard to see. Recording the id BEFORE
+ * the handler runs makes a handler failure permanent: every retry is deduped
+ * away and the work is lost silently, which is the worst possible outcome for a
+ * moderation decision. Recording it AFTER lets two concurrent deliveries of the
+ * same event both run. Claiming before and releasing on failure gets both: one
+ * in flight, and a failure still retryable.
+ */
+export interface ProcessedEventStore {
+    /** True when this call took the claim; false when the event is already held. */
+    claim(eventId: string): boolean | Promise<boolean>;
+    /** Gives the claim back so a redelivery can be processed. */
+    release(eventId: string): void | Promise<void>;
+}
+export interface MemoryProcessedEventStoreOptions {
+    readonly ttlMs?: number;
+    readonly maxEntries?: number;
+}
+/**
+ * The default store: an in-process map with a TTL.
+ *
+ * **Per process.** Two instances behind a load balancer each keep their own,
+ * so a redelivery that lands on the other instance is NOT deduped. That is
+ * usually fine — the handlers a receiver should be writing are idempotent
+ * anyway, because §7.6 makes the application responsible for recording what it
+ * did about a decision — but an application whose enforcement is not idempotent
+ * must pass a shared store (Redis, its own database) instead. Saying so here is
+ * the point: a dedupe that silently only works on one instance is exactly the
+ * kind of thing that looks correct in staging.
+ *
+ * There is no timer. Expiry is evaluated on read and the map is pruned on
+ * insert, so nothing here keeps a Node event loop alive — a module-level
+ * `setInterval` in a library is how a consumer's test run stops exiting.
+ */
+export declare function memoryProcessedEventStore(options?: MemoryProcessedEventStoreOptions): ProcessedEventStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/express/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/express/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,6DAA6D;IAC7D,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,gCAAqC,GAC7C,mBAAmB,CA+BrB"}

package/dist/express/store.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Idempotency by event id (§10.8: "store the processed event id").
+ *
+ * A delivery is retried on the schedule in §10.9 — six times over 24 hours —
+ * and a retry can also happen because the receiver's 2xx was lost rather than
+ * because it failed. So the same event WILL arrive twice at a healthy receiver,
+ * and "did I already do this?" is the only thing standing between that and a
+ * piece of content being removed twice or a user being suspended twice.
+ *
+ * The interface is claim/release rather than a "seen?" check, because the
+ * obvious design is wrong in a way that is hard to see. Recording the id BEFORE
+ * the handler runs makes a handler failure permanent: every retry is deduped
+ * away and the work is lost silently, which is the worst possible outcome for a
+ * moderation decision. Recording it AFTER lets two concurrent deliveries of the
+ * same event both run. Claiming before and releasing on failure gets both: one
+ * in flight, and a failure still retryable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.memoryProcessedEventStore = memoryProcessedEventStore;
+/** The retry schedule of §10.9 ends at 24 hours; a claim outlives it. */
+const DEFAULT_TTL_MS = 25 * 60 * 60 * 1000;
+const DEFAULT_MAX_ENTRIES = 10000;
+/**
+ * The default store: an in-process map with a TTL.
+ *
+ * **Per process.** Two instances behind a load balancer each keep their own,
+ * so a redelivery that lands on the other instance is NOT deduped. That is
+ * usually fine — the handlers a receiver should be writing are idempotent
+ * anyway, because §7.6 makes the application responsible for recording what it
+ * did about a decision — but an application whose enforcement is not idempotent
+ * must pass a shared store (Redis, its own database) instead. Saying so here is
+ * the point: a dedupe that silently only works on one instance is exactly the
+ * kind of thing that looks correct in staging.
+ *
+ * There is no timer. Expiry is evaluated on read and the map is pruned on
+ * insert, so nothing here keeps a Node event loop alive — a module-level
+ * `setInterval` in a library is how a consumer's test run stops exiting.
+ */
+function memoryProcessedEventStore(options = {}) {
+    const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    const maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    const claims = new Map();
+    const prune = (now) => {
+        for (const [eventId, expiresAt] of claims) {
+            if (expiresAt <= now)
+                claims.delete(eventId);
+        }
+        // Insertion-ordered, so the oldest claims go first once the cap is hit.
+        while (claims.size >= maxEntries) {
+            const oldest = claims.keys().next();
+            if (oldest.done === true)
+                break;
+            claims.delete(oldest.value);
+        }
+    };
+    return {
+        claim(eventId) {
+            const now = Date.now();
+            const held = claims.get(eventId);
+            if (held !== undefined && held > now)
+                return false;
+            prune(now);
+            claims.set(eventId, now + ttlMs);
+            return true;
+        },
+        release(eventId) {
+            claims.delete(eventId);
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/express/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/express/store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;AAmCH,8DAiCC;AAlED,yEAAyE;AACzE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAK,CAAC;AAE5C,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAcnC;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,yBAAyB,CACvC,UAA4C,EAAE;IAE9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;YAC1C,IAAI,SAAS,IAAI,GAAG;gBAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,wEAAwE;QACxE,OAAO,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAe;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEnD,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,OAAe;YACrB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/express/verify.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Webhook signature verification (§10.8), as a pure function.
+ *
+ * Kept free of Express, of I/O and of the clock so that the security-critical
+ * decision — do these bytes carry a valid, fresh signature from a secret we
+ * hold? — can be attacked directly by a test rather than through a request. A
+ * signature check that cannot be made to fail is worse than no check at all, so
+ * the corpus in `__tests__/verify.test.ts` is mutation-tested: each deliberately
+ * weakened verifier must be CAUGHT by at least one case, and a case that no
+ * mutant fails is a case that proves nothing.
+ *
+ * §10.8 in full, and where each line lands:
+ *
+ *   * `signedPayload = timestamp + "." + rawBody` — `buildWebhookSignedPayload`
+ *     in the contracts package, so the signer and the verifier cannot disagree
+ *     about what gets signed. This module works on the BYTES of that value (see
+ *     `signedPayloadBytes`).
+ *   * "reject timestamps more than five minutes away" — `TOLERANCE`, applied in
+ *     BOTH directions. A future timestamp is as much a replay signal as an old
+ *     one, and only checking the past accepts a signature minted for a clock
+ *     nobody controls.
+ *   * "compare signatures in constant time" — `timingSafeEqual` over the decoded
+ *     digests. Never `===`: it returns on the first differing byte, which is a
+ *     forgery oracle with enough attempts.
+ *   * "store the processed event id" — `store.ts`, not here. Freshness and
+ *     authenticity are decidable from the request; whether it was already
+ *     handled is not.
+ *   * "allow two secrets during rotation" — `secrets` is a list, every entry is
+ *     tried, and the result names WHICH one matched so an operator can see the
+ *     old secret going quiet before they retire it.
+ */
+/**
+ * Why a delivery was refused. Terse on purpose: it goes back on the wire, into
+ * the sender's delivery log, and into `onRejected`.
+ *
+ * The first eight are what verification itself decides; the last three are the
+ * middleware's. They share one vocabulary so the reason a receiver reports and
+ * the reason it answers with are always the same string — two lists would drift
+ * the first time one of them grew.
+ */
+export declare const WEBHOOK_REJECTIONS: readonly ["missing_event_id", "missing_timestamp", "missing_signature", "malformed_timestamp", "malformed_signature", "timestamp_out_of_window", "signature_mismatch", "no_secret_configured", "malformed_event", "event_id_mismatch", "payload_too_large"];
+export type WebhookRejection = (typeof WEBHOOK_REJECTIONS)[number];
+export interface WebhookVerificationInput {
+    readonly eventIdHeader: string | undefined;
+    readonly timestampHeader: string | undefined;
+    readonly signatureHeader: string | undefined;
+    /** The bytes as they arrived. Never a re-serialisation of a parsed body. */
+    readonly rawBody: Buffer;
+    /** Active secret first; the previous one during rotation (§10.8). */
+    readonly secrets: readonly string[];
+    readonly nowMs: number;
+    readonly toleranceSeconds?: number;
+}
+export type WebhookVerification = {
+    readonly ok: true;
+    readonly eventId: string;
+    /** Which configured secret matched. `0` is the active one. */
+    readonly secretIndex: number;
+} | {
+    readonly ok: false;
+    readonly rejection: WebhookRejection;
+};
+/**
+ * The exact bytes signed, without a UTF-8 round trip.
+ *
+ * §10.8 defines the signed payload as a STRING, and
+ * `buildWebhookSignedPayload` is that definition. Decoding the body to a string
+ * to rebuild it would map any invalid UTF-8 byte to U+FFFD — which is lossy, so
+ * two different bodies could produce the same signed payload. Concatenating the
+ * prefix bytes with the body bytes is the same value for every well-formed
+ * (UTF-8) JSON body and is not lossy for anything else. `verify.test.ts` asserts
+ * the two agree.
+ */
+export declare function signedPayloadBytes(timestamp: string, rawBody: Buffer): Buffer;
+/**
+ * Verifies one delivery.
+ *
+ * Order matters: everything cheap and decidable from the headers is checked
+ * BEFORE any HMAC is computed, so a flood of malformed deliveries cannot be
+ * turned into a CPU cost. The one thing that must not be reordered is the
+ * timestamp window, which §10.8 puts before the comparison — a signature that
+ * was valid last week is still cryptographically valid, and freshness is the
+ * only thing that makes it a replay.
+ */
+export declare function verifyWebhookDelivery(input: WebhookVerificationInput): WebhookVerification;
+//# sourceMappingURL=verify.d.ts.map

package/dist/express/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/express/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAYH;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,6PAYrB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAM7E;AAYD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,wBAAwB,GAAG,mBAAmB,CAsC1F"}

package/dist/express/verify.js

@@ -0,0 +1,138 @@
+"use strict";
+/**
+ * Webhook signature verification (§10.8), as a pure function.
+ *
+ * Kept free of Express, of I/O and of the clock so that the security-critical
+ * decision — do these bytes carry a valid, fresh signature from a secret we
+ * hold? — can be attacked directly by a test rather than through a request. A
+ * signature check that cannot be made to fail is worse than no check at all, so
+ * the corpus in `__tests__/verify.test.ts` is mutation-tested: each deliberately
+ * weakened verifier must be CAUGHT by at least one case, and a case that no
+ * mutant fails is a case that proves nothing.
+ *
+ * §10.8 in full, and where each line lands:
+ *
+ *   * `signedPayload = timestamp + "." + rawBody` — `buildWebhookSignedPayload`
+ *     in the contracts package, so the signer and the verifier cannot disagree
+ *     about what gets signed. This module works on the BYTES of that value (see
+ *     `signedPayloadBytes`).
+ *   * "reject timestamps more than five minutes away" — `TOLERANCE`, applied in
+ *     BOTH directions. A future timestamp is as much a replay signal as an old
+ *     one, and only checking the past accepts a signature minted for a clock
+ *     nobody controls.
+ *   * "compare signatures in constant time" — `timingSafeEqual` over the decoded
+ *     digests. Never `===`: it returns on the first differing byte, which is a
+ *     forgery oracle with enough attempts.
+ *   * "store the processed event id" — `store.ts`, not here. Freshness and
+ *     authenticity are decidable from the request; whether it was already
+ *     handled is not.
+ *   * "allow two secrets during rotation" — `secrets` is a list, every entry is
+ *     tried, and the result names WHICH one matched so an operator can see the
+ *     old secret going quiet before they retire it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WEBHOOK_REJECTIONS = void 0;
+exports.signedPayloadBytes = signedPayloadBytes;
+exports.verifyWebhookDelivery = verifyWebhookDelivery;
+const node_crypto_1 = require("node:crypto");
+const contracts_1 = require("@crowdsource.you/contracts");
+/**
+ * Why a delivery was refused. Terse on purpose: it goes back on the wire, into
+ * the sender's delivery log, and into `onRejected`.
+ *
+ * The first eight are what verification itself decides; the last three are the
+ * middleware's. They share one vocabulary so the reason a receiver reports and
+ * the reason it answers with are always the same string — two lists would drift
+ * the first time one of them grew.
+ */
+exports.WEBHOOK_REJECTIONS = [
+    'missing_event_id',
+    'missing_timestamp',
+    'missing_signature',
+    'malformed_timestamp',
+    'malformed_signature',
+    'timestamp_out_of_window',
+    'signature_mismatch',
+    'no_secret_configured',
+    'malformed_event',
+    'event_id_mismatch',
+    'payload_too_large',
+];
+/**
+ * The exact bytes signed, without a UTF-8 round trip.
+ *
+ * §10.8 defines the signed payload as a STRING, and
+ * `buildWebhookSignedPayload` is that definition. Decoding the body to a string
+ * to rebuild it would map any invalid UTF-8 byte to U+FFFD — which is lossy, so
+ * two different bodies could produce the same signed payload. Concatenating the
+ * prefix bytes with the body bytes is the same value for every well-formed
+ * (UTF-8) JSON body and is not lossy for anything else. `verify.test.ts` asserts
+ * the two agree.
+ */
+function signedPayloadBytes(timestamp, rawBody) {
+    // The prefix is taken FROM the contract's own function rather than restated
+    // as `${timestamp}.`, so a change to the separator follows automatically
+    // instead of leaving two definitions to drift.
+    const prefix = (0, contracts_1.buildWebhookSignedPayload)(timestamp, '');
+    return Buffer.concat([Buffer.from(prefix, 'utf8'), rawBody]);
+}
+function digestsMatch(expectedHex, presentedHex) {
+    const expected = Buffer.from(expectedHex, 'hex');
+    const presented = Buffer.from(presentedHex, 'hex');
+    // The header schema fixes the length at 64 hex characters, so this is never
+    // the branch that rejects a real delivery — it is what stops `timingSafeEqual`
+    // from throwing if that ever stops being true.
+    if (expected.length !== presented.length)
+        return false;
+    return (0, node_crypto_1.timingSafeEqual)(expected, presented);
+}
+/**
+ * Verifies one delivery.
+ *
+ * Order matters: everything cheap and decidable from the headers is checked
+ * BEFORE any HMAC is computed, so a flood of malformed deliveries cannot be
+ * turned into a CPU cost. The one thing that must not be reordered is the
+ * timestamp window, which §10.8 puts before the comparison — a signature that
+ * was valid last week is still cryptographically valid, and freshness is the
+ * only thing that makes it a replay.
+ */
+function verifyWebhookDelivery(input) {
+    if (input.secrets.length === 0)
+        return { ok: false, rejection: 'no_secret_configured' };
+    const eventId = input.eventIdHeader?.trim();
+    if (!eventId)
+        return { ok: false, rejection: 'missing_event_id' };
+    if (input.timestampHeader === undefined)
+        return { ok: false, rejection: 'missing_timestamp' };
+    if (input.signatureHeader === undefined)
+        return { ok: false, rejection: 'missing_signature' };
+    if (!contracts_1.WebhookTimestampHeaderSchema.safeParse(input.timestampHeader).success) {
+        return { ok: false, rejection: 'malformed_timestamp' };
+    }
+    if (!contracts_1.WebhookSignatureHeaderSchema.safeParse(input.signatureHeader).success) {
+        return { ok: false, rejection: 'malformed_signature' };
+    }
+    const tolerance = input.toleranceSeconds ?? contracts_1.WEBHOOK_TIMESTAMP_TOLERANCE_SECONDS;
+    const skewSeconds = Math.abs(input.nowMs / 1000 - Number(input.timestampHeader));
+    if (skewSeconds > tolerance)
+        return { ok: false, rejection: 'timestamp_out_of_window' };
+    const presentedHex = input.signatureHeader.slice(`${contracts_1.WEBHOOK_SIGNATURE_VERSION}=`.length);
+    const payload = signedPayloadBytes(input.timestampHeader, input.rawBody);
+    /**
+     * Every secret is tried and the loop does not break early. Breaking would make
+     * "the active secret matched" measurably faster than "the previous one did",
+     * which tells a caller how far through a rotation the receiver is — small, but
+     * free to avoid.
+     */
+    let matchedIndex = -1;
+    input.secrets.forEach((secret, index) => {
+        const expected = (0, node_crypto_1.createHmac)('sha256', secret).update(payload).digest('hex');
+        if (digestsMatch(expected, presentedHex) && matchedIndex === -1) {
+            matchedIndex = index;
+        }
+    });
+    if (matchedIndex === -1)
+        return { ok: false, rejection: 'signature_mismatch' };
+    return { ok: true, eventId, secretIndex: matchedIndex };
+}
+//# sourceMappingURL=verify.js.map

package/dist/express/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/express/verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;;AAqEH,gDAMC;AAsBD,sDAsCC;AArID,6CAA0D;AAE1D,0DAMoC;AAEpC;;;;;;;;GAQG;AACU,QAAA,kBAAkB,GAAG;IAChC,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,qBAAqB;IACrB,qBAAqB;IACrB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;CACX,CAAC;AAyBX;;;;;;;;;;GAUG;AACH,SAAgB,kBAAkB,CAAC,SAAiB,EAAE,OAAe;IACnE,4EAA4E;IAC5E,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,MAAM,GAAG,IAAA,qCAAyB,EAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,YAAoB;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACnD,4EAA4E;IAC5E,+EAA+E;IAC/E,+CAA+C;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,IAAA,6BAAe,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,KAA+B;IACnE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;IAExF,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IAC9F,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IAE9F,IAAI,CAAC,wCAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,wCAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,+CAAmC,CAAC;IAChF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAK,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAClF,IAAI,WAAW,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;IAExF,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,qCAAyB,GAAG,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAEzE;;;;;OAKG;IACH,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC1D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `@crowdsource.you/core` — the TypeScript client for the CrowdSource moderation
+ * API.
+ *
+ * The smallest integration this package supports, in full:
+ *
+ * ```ts
+ * import { CrowdSource } from '@crowdsource.you/core';
+ *
+ * const crowdsource = new CrowdSource();
+ *
+ * await crowdsource.reports.create({
+ *   externalReportId: report.id,
+ *   reportedBy: { oxyUserId: session.sub },
+ *   subject: {
+ *     externalId: post.id,
+ *     type: 'social.post',
+ *     author: { oxyUserId: post.authorId },
+ *   },
+ *   content: post.text,
+ *   allegations: ['harassment.targeted_abuse'],
+ * });
+ * ```
+ *
+ * One environment variable (`CROWDSOURCE_SERVICE_KEY`) and the object being
+ * reported. The Case Envelope, its resource ids, its digests, its relations, its
+ * principal bindings, the identity binding proof, the policy version, the
+ * retention terms and the idempotency key are all composed from that — see
+ * `envelope.ts` for what each one is derived from and why it cannot be left to
+ * the caller.
+ *
+ * Types come from `@crowdsource.you/contracts`. This package re-exports none
+ * of them: an integrator imports the contract from the contract package, so a
+ * `Decision` or a `TaxonomyCode` has exactly one definition.
+ */
+export { CrowdSource, SERVICE_KEY_ENV_VAR, BASE_URL_ENV_VAR } from './client.js';
+export type { CrowdSourceOptions } from './client.js';
+export { formatServiceKey, parseServiceKey } from './credential.js';
+export type { ServiceCredential } from './credential.js';
+export { COMMUNITY_REVIEW_FORBIDDEN_ALLEGATIONS, DEFAULT_BASE_URL, DEFAULT_POLICY, DEFAULT_RETENTION_DAYS, } from './defaults.js';
+export { canonicalJson, resourceDigest, sha256Digest } from './digest.js';
+export type { CanonicalValue } from './digest.js';
+/**
+ * `composeCaseEnvelope` is deliberately NOT exported.
+ *
+ * It is the one function in this package that takes an `applicationId`, and it
+ * takes it from `Reports`, which got it from the credential. Exporting it would
+ * put an `applicationId` parameter on the public surface — which is the thing
+ * Appendix F says must not exist, however carefully the doc comment above it
+ * were worded. The envelope a report produces is reachable by reading what
+ * `reports.create` sends, not by building one yourself.
+ */
+export { CrowdSourceReportInputError, defaultIdempotencyKey } from './envelope.js';
+export type { AllegationInput, ContextInput, ContextRole, PrincipalInput, ReportInput, ReportSubjectInput, ResourceInput, } from './envelope.js';
+export { CROWDSOURCE_API_ERROR_CODES, CrowdSourceApiError, CrowdSourceConfigurationError, CrowdSourceError, CrowdSourceTransportError, isCrowdSourceApiError, isCrowdSourceApiErrorCode, isCrowdSourceError, } from './errors.js';
+export type { CrowdSourceApiErrorCode } from './errors.js';
+export { Reports } from './reports.js';
+export type { ReportReceipt, ReportRequestOptions } from './reports.js';
+export { Cases, Decisions } from './cases.js';
+export type { CaseView, ReadOptions } from './cases.js';
+export { CommunityNotes } from './communityNotes.js';
+export type { CommunityNoteReadOptions, CommunityNoteRequestOptions } from './communityNotes.js';
+export { WebhookEndpoints } from './webhookEndpoints.js';
+export type { RegisterWebhookEndpointInput, RotateSecretOptions, RotatedWebhookSecret, WebhookEndpoint, WebhookEndpointRequestOptions, WebhookSecret, } from './webhookEndpoints.js';
+export { DEFAULT_MAX_ATTEMPTS, DEFAULT_TIMEOUT_MS } from './transport.js';
+export type { FetchLike } from './transport.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACjF,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EACL,sCAAsC,EACtC,gBAAgB,EAChB,cAAc,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;;GASG;AACH,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACnF,YAAY,EACV,eAAe,EACf,YAAY,EACZ,WAAW,EACX,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,aAAa,GACd,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAExE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAEjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EACV,4BAA4B,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,6BAA6B,EAC7B,aAAa,GACd,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * `@crowdsource.you/core` — the TypeScript client for the CrowdSource moderation
+ * API.
+ *
+ * The smallest integration this package supports, in full:
+ *
+ * ```ts
+ * import { CrowdSource } from '@crowdsource.you/core';
+ *
+ * const crowdsource = new CrowdSource();
+ *
+ * await crowdsource.reports.create({
+ *   externalReportId: report.id,
+ *   reportedBy: { oxyUserId: session.sub },
+ *   subject: {
+ *     externalId: post.id,
+ *     type: 'social.post',
+ *     author: { oxyUserId: post.authorId },
+ *   },
+ *   content: post.text,
+ *   allegations: ['harassment.targeted_abuse'],
+ * });
+ * ```
+ *
+ * One environment variable (`CROWDSOURCE_SERVICE_KEY`) and the object being
+ * reported. The Case Envelope, its resource ids, its digests, its relations, its
+ * principal bindings, the identity binding proof, the policy version, the
+ * retention terms and the idempotency key are all composed from that — see
+ * `envelope.ts` for what each one is derived from and why it cannot be left to
+ * the caller.
+ *
+ * Types come from `@crowdsource.you/contracts`. This package re-exports none
+ * of them: an integrator imports the contract from the contract package, so a
+ * `Decision` or a `TaxonomyCode` has exactly one definition.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TIMEOUT_MS = exports.DEFAULT_MAX_ATTEMPTS = exports.WebhookEndpoints = exports.CommunityNotes = exports.Decisions = exports.Cases = exports.Reports = exports.isCrowdSourceError = exports.isCrowdSourceApiErrorCode = exports.isCrowdSourceApiError = exports.CrowdSourceTransportError = exports.CrowdSourceError = exports.CrowdSourceConfigurationError = exports.CrowdSourceApiError = exports.CROWDSOURCE_API_ERROR_CODES = exports.defaultIdempotencyKey = exports.CrowdSourceReportInputError = exports.sha256Digest = exports.resourceDigest = exports.canonicalJson = exports.DEFAULT_RETENTION_DAYS = exports.DEFAULT_POLICY = exports.DEFAULT_BASE_URL = exports.COMMUNITY_REVIEW_FORBIDDEN_ALLEGATIONS = exports.parseServiceKey = exports.formatServiceKey = exports.BASE_URL_ENV_VAR = exports.SERVICE_KEY_ENV_VAR = exports.CrowdSource = void 0;
+var client_js_1 = require("./client.js");
+Object.defineProperty(exports, "CrowdSource", { enumerable: true, get: function () { return client_js_1.CrowdSource; } });
+Object.defineProperty(exports, "SERVICE_KEY_ENV_VAR", { enumerable: true, get: function () { return client_js_1.SERVICE_KEY_ENV_VAR; } });
+Object.defineProperty(exports, "BASE_URL_ENV_VAR", { enumerable: true, get: function () { return client_js_1.BASE_URL_ENV_VAR; } });
+var credential_js_1 = require("./credential.js");
+Object.defineProperty(exports, "formatServiceKey", { enumerable: true, get: function () { return credential_js_1.formatServiceKey; } });
+Object.defineProperty(exports, "parseServiceKey", { enumerable: true, get: function () { return credential_js_1.parseServiceKey; } });
+var defaults_js_1 = require("./defaults.js");
+Object.defineProperty(exports, "COMMUNITY_REVIEW_FORBIDDEN_ALLEGATIONS", { enumerable: true, get: function () { return defaults_js_1.COMMUNITY_REVIEW_FORBIDDEN_ALLEGATIONS; } });
+Object.defineProperty(exports, "DEFAULT_BASE_URL", { enumerable: true, get: function () { return defaults_js_1.DEFAULT_BASE_URL; } });
+Object.defineProperty(exports, "DEFAULT_POLICY", { enumerable: true, get: function () { return defaults_js_1.DEFAULT_POLICY; } });
+Object.defineProperty(exports, "DEFAULT_RETENTION_DAYS", { enumerable: true, get: function () { return defaults_js_1.DEFAULT_RETENTION_DAYS; } });
+var digest_js_1 = require("./digest.js");
+Object.defineProperty(exports, "canonicalJson", { enumerable: true, get: function () { return digest_js_1.canonicalJson; } });
+Object.defineProperty(exports, "resourceDigest", { enumerable: true, get: function () { return digest_js_1.resourceDigest; } });
+Object.defineProperty(exports, "sha256Digest", { enumerable: true, get: function () { return digest_js_1.sha256Digest; } });
+/**
+ * `composeCaseEnvelope` is deliberately NOT exported.
+ *
+ * It is the one function in this package that takes an `applicationId`, and it
+ * takes it from `Reports`, which got it from the credential. Exporting it would
+ * put an `applicationId` parameter on the public surface — which is the thing
+ * Appendix F says must not exist, however carefully the doc comment above it
+ * were worded. The envelope a report produces is reachable by reading what
+ * `reports.create` sends, not by building one yourself.
+ */
+var envelope_js_1 = require("./envelope.js");
+Object.defineProperty(exports, "CrowdSourceReportInputError", { enumerable: true, get: function () { return envelope_js_1.CrowdSourceReportInputError; } });
+Object.defineProperty(exports, "defaultIdempotencyKey", { enumerable: true, get: function () { return envelope_js_1.defaultIdempotencyKey; } });
+var errors_js_1 = require("./errors.js");
+Object.defineProperty(exports, "CROWDSOURCE_API_ERROR_CODES", { enumerable: true, get: function () { return errors_js_1.CROWDSOURCE_API_ERROR_CODES; } });
+Object.defineProperty(exports, "CrowdSourceApiError", { enumerable: true, get: function () { return errors_js_1.CrowdSourceApiError; } });
+Object.defineProperty(exports, "CrowdSourceConfigurationError", { enumerable: true, get: function () { return errors_js_1.CrowdSourceConfigurationError; } });
+Object.defineProperty(exports, "CrowdSourceError", { enumerable: true, get: function () { return errors_js_1.CrowdSourceError; } });
+Object.defineProperty(exports, "CrowdSourceTransportError", { enumerable: true, get: function () { return errors_js_1.CrowdSourceTransportError; } });
+Object.defineProperty(exports, "isCrowdSourceApiError", { enumerable: true, get: function () { return errors_js_1.isCrowdSourceApiError; } });
+Object.defineProperty(exports, "isCrowdSourceApiErrorCode", { enumerable: true, get: function () { return errors_js_1.isCrowdSourceApiErrorCode; } });
+Object.defineProperty(exports, "isCrowdSourceError", { enumerable: true, get: function () { return errors_js_1.isCrowdSourceError; } });
+var reports_js_1 = require("./reports.js");
+Object.defineProperty(exports, "Reports", { enumerable: true, get: function () { return reports_js_1.Reports; } });
+var cases_js_1 = require("./cases.js");
+Object.defineProperty(exports, "Cases", { enumerable: true, get: function () { return cases_js_1.Cases; } });
+Object.defineProperty(exports, "Decisions", { enumerable: true, get: function () { return cases_js_1.Decisions; } });
+var communityNotes_js_1 = require("./communityNotes.js");
+Object.defineProperty(exports, "CommunityNotes", { enumerable: true, get: function () { return communityNotes_js_1.CommunityNotes; } });
+var webhookEndpoints_js_1 = require("./webhookEndpoints.js");
+Object.defineProperty(exports, "WebhookEndpoints", { enumerable: true, get: function () { return webhookEndpoints_js_1.WebhookEndpoints; } });
+var transport_js_1 = require("./transport.js");
+Object.defineProperty(exports, "DEFAULT_MAX_ATTEMPTS", { enumerable: true, get: function () { return transport_js_1.DEFAULT_MAX_ATTEMPTS; } });
+Object.defineProperty(exports, "DEFAULT_TIMEOUT_MS", { enumerable: true, get: function () { return transport_js_1.DEFAULT_TIMEOUT_MS; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;AAEH,yCAAiF;AAAxE,wGAAA,WAAW,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAG3D,iDAAoE;AAA3D,iHAAA,gBAAgB,OAAA;AAAE,gHAAA,eAAe,OAAA;AAG1C,6CAKuB;AAJrB,qIAAA,sCAAsC,OAAA;AACtC,+GAAA,gBAAgB,OAAA;AAChB,6GAAA,cAAc,OAAA;AACd,qHAAA,sBAAsB,OAAA;AAGxB,yCAA0E;AAAjE,0GAAA,aAAa,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,yGAAA,YAAY,OAAA;AAGpD;;;;;;;;;GASG;AACH,6CAAmF;AAA1E,0HAAA,2BAA2B,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAW3D,yCASqB;AARnB,wHAAA,2BAA2B,OAAA;AAC3B,gHAAA,mBAAmB,OAAA;AACnB,0HAAA,6BAA6B,OAAA;AAC7B,6GAAA,gBAAgB,OAAA;AAChB,sHAAA,yBAAyB,OAAA;AACzB,kHAAA,qBAAqB,OAAA;AACrB,sHAAA,yBAAyB,OAAA;AACzB,+GAAA,kBAAkB,OAAA;AAIpB,2CAAuC;AAA9B,qGAAA,OAAO,OAAA;AAGhB,uCAA8C;AAArC,iGAAA,KAAK,OAAA;AAAE,qGAAA,SAAS,OAAA;AAIzB,yDAAqD;AAA5C,mHAAA,cAAc,OAAA;AAGvB,6DAAyD;AAAhD,uHAAA,gBAAgB,OAAA;AAUzB,+CAA0E;AAAjE,oHAAA,oBAAoB,OAAA;AAAE,kHAAA,kBAAkB,OAAA"}

package/dist/outbox/client.d.ts

@@ -0,0 +1,35 @@
+import { CrowdSource } from '../index.js';
+import type { CrowdSourceConnectionConfig, ModerationLogger } from './types.js';
+/**
+ * The CrowdSource client, built once and only when configured.
+ *
+ * There is deliberately almost nothing here. The SDK already owns the base URL,
+ * the timeouts, the bounded per-attempt retries, the idempotency key and the
+ * error classification, and a wrapper that re-implemented any of them would be a
+ * second answer to a question that has one. What this adds is exactly two
+ * things: the client is absent until the integration is switched on, and it is
+ * built once rather than per delivery.
+ *
+ * `applicationId` appears nowhere — the client reads it off the service key, and
+ * there is no option, field or parameter through which one could be passed.
+ */
+export interface CrowdSourceClientProvider {
+    /**
+     * The client, or `undefined` when the integration is not configured.
+     *
+     * `undefined` rather than a throw: a disabled integration is the normal state
+     * of a local checkout and of every deployment before rollout, and a report
+     * filed there must still be stored. The delivery worker is what notices there
+     * is nowhere to send it.
+     *
+     * A MISCONFIGURED client — a malformed service key — is a different thing and
+     * is logged once at error level. Once, because the alternative is one line per
+     * delivery attempt per report, which buries the cause it is meant to reveal.
+     */
+    get(): CrowdSource | undefined;
+}
+export declare function createClientProvider(input: {
+    config: CrowdSourceConnectionConfig;
+    logger: ModerationLogger;
+}): CrowdSourceClientProvider;
+//# sourceMappingURL=client.d.ts.map

package/dist/outbox/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/outbox/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;;;;OAWG;IACH,GAAG,IAAI,WAAW,GAAG,SAAS,CAAC;CAChC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,2BAA2B,CAAC;IACpC,MAAM,EAAE,gBAAgB,CAAC;CAC1B,GAAG,yBAAyB,CAuC5B"}

package/dist/outbox/client.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createClientProvider = createClientProvider;
+const index_js_1 = require("../index.js");
+function createClientProvider(input) {
+    let client = null;
+    let configurationError = null;
+    return {
+        get() {
+            if (!input.config.enabled)
+                return undefined;
+            if (client)
+                return client;
+            if (configurationError !== null)
+                return undefined;
+            const serviceKey = input.config.serviceKey;
+            if (!serviceKey) {
+                configurationError = 'no CrowdSource service key is configured';
+                input.logger.error('[CrowdSource] enabled but not configured', {
+                    reason: configurationError,
+                });
+                return undefined;
+            }
+            try {
+                client = new index_js_1.CrowdSource({
+                    serviceKey,
+                    ...(input.config.baseUrl === undefined ? {} : { baseUrl: input.config.baseUrl }),
+                });
+                input.logger.info('[CrowdSource] client ready', {
+                    applicationId: client.applicationId,
+                });
+                return client;
+            }
+            catch (error) {
+                // The SDK's configuration errors name which part of the key is wrong and
+                // never echo the secret, so the message is safe to log.
+                configurationError = error instanceof Error ? error.message : String(error);
+                input.logger.error('[CrowdSource] service key rejected', {
+                    reason: configurationError,
+                });
+                return undefined;
+            }
+        },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/outbox/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/outbox/client.ts"],"names":[],"mappings":";;AAgCA,oDA0CC;AA1ED,0CAA0C;AAgC1C,SAAgB,oBAAoB,CAAC,KAGpC;IACC,IAAI,MAAM,GAAuB,IAAI,CAAC;IACtC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAE7C,OAAO;QACL,GAAG;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC5C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,IAAI,kBAAkB,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAElD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,kBAAkB,GAAG,0CAA0C,CAAC;gBAChE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;oBAC7D,MAAM,EAAE,kBAAkB;iBAC3B,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,sBAAW,CAAC;oBACvB,UAAU;oBACV,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;iBACjF,CAAC,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;oBAC9C,aAAa,EAAE,MAAM,CAAC,aAAa;iBACpC,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,yEAAyE;gBACzE,wDAAwD;gBACxD,kBAAkB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5E,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;oBACvD,MAAM,EAAE,kBAAkB;iBAC3B,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}