@crowdsource.you/core 1.2.0

package/dist/outbox/evidence.js

@@ -0,0 +1,181 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModerationTaxonomyError = exports.ModerationSubjectUnsupportedError = void 0;
+exports.snapshotHash = snapshotHash;
+exports.createSubjectRegistry = createSubjectRegistry;
+exports.buildModerationReportInput = buildModerationReportInput;
+const crypto_1 = require("crypto");
+/**
+ * Turning a stored report into the thing the SDK delivers.
+ *
+ * This is NOT a case-envelope builder, and the difference matters enough to
+ * name: `@crowdsource.you/core` builds the Case Envelope, and it deliberately does
+ * not export the function that does it. What this module produces is the SDK's
+ * `ReportInput` — a description of the material — and the SDK derives the
+ * envelope from it: resource ids, relations, digests, pseudonymous principal
+ * refs, the identity binding proof, the pinned policy version, the privacy terms
+ * and the idempotency key.
+ *
+ * That is not a technicality. Those derived values are exactly what the case
+ * dedup key is computed over, so an application that composed its own envelope
+ * would be the reason two reporters about one object opened two cases — and "one
+ * penalty per incident" would fail in production with nothing failing in a test.
+ * Building the description and letting the SDK build the document is what keeps
+ * that property true for every application at once.
+ *
+ * So this module does three things and no more: ask the registry for a snapshot
+ * of the reported object, translate the reporter's categories into allegations,
+ * and assemble both with the report's own identity.
+ */
+/**
+ * The material could not be described, because nothing can describe it.
+ *
+ * This is a DEFECT, not a state, and it should be unreachable. A report whose
+ * type has no subject provider never gets a delivery event in the first place —
+ * intake decides that from the same registry this module reads — so an event
+ * that arrives here has been created by something that bypassed intake, or by a
+ * deployment where a provider was removed while its reports were still in
+ * flight.
+ *
+ * `retryable: false` therefore dead-letters the outbox event, so the
+ * reconciliation sweep counts it and a human looks. The alternative — writing a
+ * local state — would file a genuine defect in the one place that looks
+ * identical to the deliberate local-only reports, and nothing would ever alert
+ * on it.
+ *
+ * Separate from "the object is gone": a deleted object is a fact about the world
+ * and closes the report normally.
+ */
+class ModerationSubjectUnsupportedError extends Error {
+    constructor(reportedType) {
+        super(`No moderation subject provider is registered for '${reportedType}'.`);
+        this.retryable = false;
+        this.name = 'ModerationSubjectUnsupportedError';
+    }
+}
+exports.ModerationSubjectUnsupportedError = ModerationSubjectUnsupportedError;
+/**
+ * The application's taxonomy produced no allegation for a report.
+ *
+ * Not retryable and never silently defaulted. A report with no allegation is not
+ * a report, and substituting `other.unclassifiable` here would put a claim in
+ * front of a jury that no reporter made and that no version of the mapping
+ * records — the taxonomy is the application's to fix, and dead-lettering is what
+ * makes somebody fix it.
+ */
+class ModerationTaxonomyError extends Error {
+    constructor(categories) {
+        super(`The report taxonomy produced no allegation for categories [${categories.join(', ')}]. ` +
+            'Map every category to a code; use `other.unclassifiable` for one the universal taxonomy cannot name.');
+        this.retryable = false;
+        this.name = 'ModerationTaxonomyError';
+    }
+}
+exports.ModerationTaxonomyError = ModerationTaxonomyError;
+/**
+ * SHA-256 of the snapshot, stored on the report.
+ *
+ * Taken over the described MATERIAL, not over the whole `ReportInput`: the
+ * report id, the reporter and the allegations are properties of the report, and
+ * including them would mean two people reporting identical content produced
+ * different hashes — which is the opposite of what this hash is for. Key order
+ * is fixed by the literal below rather than by `Object.keys`, so the digest is
+ * stable across Node versions and across a refactor that reorders a field.
+ */
+function snapshotHash(snapshot) {
+    const canonical = JSON.stringify({
+        subject: {
+            externalId: snapshot.subject.externalId,
+            type: snapshot.subject.type,
+            author: snapshot.subject.author?.oxyUserId ?? null,
+        },
+        content: snapshot.content,
+        attachments: snapshot.attachments ?? [],
+        context: snapshot.context ?? [],
+    });
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(canonical, 'utf8').digest('hex')}`;
+}
+function createSubjectRegistry(providers) {
+    const byType = new Map();
+    for (const provider of providers) {
+        const existing = byType.get(provider.reportedType);
+        if (existing) {
+            /**
+             * Two providers for one noun is not a merge to resolve quietly: whichever
+             * one lost would describe nothing, and the subject type a jury reasons
+             * about would depend on array order.
+             */
+            throw new Error(`Two moderation subject providers are registered for '${provider.reportedType}' ` +
+                `('${existing.subjectType}' and '${provider.subjectType}'). A reported type has one provider.`);
+        }
+        byType.set(provider.reportedType, provider);
+    }
+    return {
+        providerFor: (reportedType) => byType.get(reportedType),
+        deliverableTypes: () => Array.from(byType.keys()),
+    };
+}
+/**
+ * Describe a stored report for delivery, or report why it cannot be described.
+ *
+ * Returns `null` when the reported object no longer exists. That is not an error
+ * either: content deleted between the report and its delivery is ordinary, and
+ * evidence stays available through retention on CrowdSource's side — but an
+ * object the application never got to snapshot has no evidence to keep.
+ */
+async function buildModerationReportInput(input) {
+    const { report, registry, taxonomy } = input;
+    const provider = registry.providerFor(report.reportedType);
+    if (!provider)
+        throw new ModerationSubjectUnsupportedError(report.reportedType);
+    const snapshot = await provider.snapshot(report.reportedId);
+    if (!snapshot)
+        return null;
+    const allegationCodes = taxonomy.allegationsFor(report.categories);
+    if (allegationCodes.length === 0)
+        throw new ModerationTaxonomyError(report.categories);
+    const details = report.details?.trim();
+    return {
+        reportInput: {
+            externalReportId: report.id,
+            subject: snapshot.subject,
+            content: snapshot.content,
+            ...(snapshot.attachments === undefined ? {} : { attachments: snapshot.attachments }),
+            ...(snapshot.context === undefined ? {} : { context: snapshot.context }),
+            /**
+             * The reporter's own words ride on the FIRST allegation only.
+             *
+             * Repeating one free-text field across every code would say the reporter
+             * wrote it about each of them separately, and details are the reporter's
+             * claim and never evidence for it.
+             */
+            allegations: allegationCodes.map((code, index) => index === 0 && details ? { code, details } : { code }),
+            /**
+             * The Oxy subject IS the binding proof. Reporters are stored as Oxy user
+             * ids, so there is no separate binding step to implement here.
+             */
+            reportedBy: { oxyUserId: report.reporter },
+            /**
+             * The moment the USER reported it — the local report's own timestamp, not
+             * the moment of delivery. Any value invented per attempt would make every
+             * retry from the outbox a permanent 409.
+             */
+            submittedAt: report.createdAt,
+            metadata: {
+                /**
+                 * The application's own entries FIRST, so the two below cannot be
+                 * shadowed. An adopter that names `taxonomyVersion` or `categories` gets
+                 * them overwritten rather than winning — a case has to be readable back
+                 * against the mapping that produced it, and that is not negotiable per
+                 * application.
+                 */
+                ...taxonomy.metadata,
+                /** So a case can be read back against the mapping that produced it. */
+                taxonomyVersion: taxonomy.version,
+                categories: [...report.categories].sort().join(','),
+            },
+        },
+        snapshotHash: snapshotHash(snapshot),
+    };
+}
+//# sourceMappingURL=evidence.js.map

package/dist/outbox/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/outbox/evidence.ts"],"names":[],"mappings":";;;AA2FA,oCAYC;AAuBD,sDAwBC;AAiBD,gEA+DC;AAtOD,mCAAoC;AASpC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,iCAAkC,SAAQ,KAAK;IAG1D,YAAY,YAAoB;QAC9B,KAAK,CAAC,qDAAqD,YAAY,IAAI,CAAC,CAAC;QAHtE,cAAS,GAAG,KAAK,CAAC;QAIzB,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAPD,8EAOC;AAED;;;;;;;;GAQG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IAGhD,YAAY,UAA6B;QACvC,KAAK,CACH,8DAA8D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACtF,sGAAsG,CACzG,CAAC;QANK,cAAS,GAAG,KAAK,CAAC;QAOzB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAVD,0DAUC;AAED;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAAC,QAAmC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,OAAO,EAAE;YACP,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;YACvC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;YAC3B,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI;SACnD;QACD,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;QACvC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;KAChC,CAAC,CAAC;IACH,OAAO,UAAU,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAClF,CAAC;AAuBD,SAAgB,qBAAqB,CACnC,SAA+C;IAE/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC5D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb;;;;eAIG;YACH,MAAM,IAAI,KAAK,CACb,wDAAwD,QAAQ,CAAC,YAAY,IAAI;gBAC/E,KAAK,QAAQ,CAAC,WAAW,UAAU,QAAQ,CAAC,WAAW,uCAAuC,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO;QACL,WAAW,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACvD,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AASD;;;;;;;GAOG;AACI,KAAK,UAAU,0BAA0B,CAAC,KAOhD;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iCAAiC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAEhF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,eAAe,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IAEvC,OAAO;QACL,WAAW,EAAE;YACX,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;YACpF,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxE;;;;;;eAMG;YACH,WAAW,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/C,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CACtD;YACD;;;eAGG;YACH,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE;YAC1C;;;;eAIG;YACH,WAAW,EAAE,MAAM,CAAC,SAAS;YAC7B,QAAQ,EAAE;gBACR;;;;;;mBAMG;gBACH,GAAG,QAAQ,CAAC,QAAQ;gBACpB,uEAAuE;gBACvE,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;aACpD;SACF;QACD,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;KACrC,CAAC;AACJ,CAAC"}

package/dist/outbox/inbound.d.ts

@@ -0,0 +1,78 @@
+import type { ProcessedEventStore } from '../express/index.js';
+import { type OutboxService } from './outbox/service.js';
+import type { ModerationEventStore, ModerationTransactionRunner } from './store/types.js';
+/**
+ * What happens between "a signed decision arrived" and "2xx".
+ *
+ * The receiver's contract is to answer quickly and queue the processing. So
+ * exactly two writes happen here, in ONE transaction — the event's audit row is
+ * completed and a durable `decision.apply` event is created — and the dispatcher
+ * does the rest.
+ *
+ * The transaction is what makes the dedupe safe. The middleware has already
+ * claimed the event id by inserting the row (see {@link createProcessedEventStore});
+ * if completing that row and queueing the work were two operations, a crash
+ * between them would leave an event that is permanently deduplicated with no
+ * work queued — a decision silently lost, with a row that says it arrived.
+ * Committing both together means the only two possible outcomes are "recorded
+ * and queued" or "neither", and "neither" releases the claim and gets
+ * redelivered.
+ */
+/**
+ * The webhook dedupe store, backed by the moderation event log.
+ *
+ * `@crowdsource.you/core/express` defaults to an in-process store and says exactly
+ * when that is not enough: two instances behind a load balancer each keep their
+ * own, so a redelivery landing on the other instance is not deduplicated. Every
+ * Oxy backend runs several tasks behind one load balancer, so this is that case.
+ *
+ * The claim/release contract is the SDK's, and it is the right one. A row
+ * inserted BEFORE the handler runs means a concurrent redelivery cannot also run
+ * it; deleting that row when the handler THROWS means the sender's retry
+ * schedule can still deliver the event later. Recording the id only after
+ * success would let two copies run at once; recording it before and never
+ * releasing would make a transient failure permanent and lose a decision
+ * silently.
+ *
+ * The retention window is computed HERE rather than in a store, so both backends
+ * keep an audit row for the same length of time.
+ */
+export declare function createProcessedEventStore<TTx>(events: ModerationEventStore<TTx>): ProcessedEventStore;
+export interface RecordDecisionEventInput {
+    eventId: string;
+    type: string;
+    caseId: string;
+    /**
+     * The decision as delivered.
+     *
+     * `unknown`, deliberately. It is stored whole and parsed against the published
+     * contract by the worker that acts on it — these payloads are deliberately
+     * loose, and validating here would mean an event whose shape this deployment
+     * does not recognise yet is refused at the door and retried until it
+     * dead-letters, instead of being kept until the code catches up.
+     */
+    decision: unknown;
+}
+export interface InboundService {
+    /** Record a decision-bearing event and queue its application. */
+    recordDecisionEvent(input: RecordDecisionEventInput): Promise<void>;
+    /**
+     * Record an event there is nothing to do about.
+     *
+     * `case.created`, `case.escalated`, `case.closed` and any type a newer
+     * CrowdSource introduces. No outbox row, because no work — but the row is
+     * kept, because "did CrowdSource tell us about this case, and when" is the
+     * first question asked when a report looks stuck, and it has to be answerable.
+     */
+    recordIgnoredEvent(input: {
+        eventId: string;
+        type: string;
+        caseId?: string;
+    }): Promise<void>;
+}
+export declare function createInboundService<TTx>(input: {
+    transaction: ModerationTransactionRunner<TTx>;
+    events: ModerationEventStore<TTx>;
+    outbox: OutboxService<TTx>;
+}): InboundService;
+//# sourceMappingURL=inbound.d.ts.map

package/dist/outbox/inbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.d.ts","sourceRoot":"","sources":["../../src/outbox/inbound.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAE1F;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAC3C,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAChC,mBAAmB,CAerB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE;QACxB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE;IAC/C,WAAW,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;CAC5B,GAAG,cAAc,CAwCjB"}

package/dist/outbox/inbound.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProcessedEventStore = createProcessedEventStore;
+exports.createInboundService = createInboundService;
+const service_js_1 = require("./outbox/service.js");
+const retention_js_1 = require("./retention.js");
+/**
+ * What happens between "a signed decision arrived" and "2xx".
+ *
+ * The receiver's contract is to answer quickly and queue the processing. So
+ * exactly two writes happen here, in ONE transaction — the event's audit row is
+ * completed and a durable `decision.apply` event is created — and the dispatcher
+ * does the rest.
+ *
+ * The transaction is what makes the dedupe safe. The middleware has already
+ * claimed the event id by inserting the row (see {@link createProcessedEventStore});
+ * if completing that row and queueing the work were two operations, a crash
+ * between them would leave an event that is permanently deduplicated with no
+ * work queued — a decision silently lost, with a row that says it arrived.
+ * Committing both together means the only two possible outcomes are "recorded
+ * and queued" or "neither", and "neither" releases the claim and gets
+ * redelivered.
+ */
+/**
+ * The webhook dedupe store, backed by the moderation event log.
+ *
+ * `@crowdsource.you/core/express` defaults to an in-process store and says exactly
+ * when that is not enough: two instances behind a load balancer each keep their
+ * own, so a redelivery landing on the other instance is not deduplicated. Every
+ * Oxy backend runs several tasks behind one load balancer, so this is that case.
+ *
+ * The claim/release contract is the SDK's, and it is the right one. A row
+ * inserted BEFORE the handler runs means a concurrent redelivery cannot also run
+ * it; deleting that row when the handler THROWS means the sender's retry
+ * schedule can still deliver the event later. Recording the id only after
+ * success would let two copies run at once; recording it before and never
+ * releasing would make a transient failure permanent and lose a decision
+ * silently.
+ *
+ * The retention window is computed HERE rather than in a store, so both backends
+ * keep an audit row for the same length of time.
+ */
+function createProcessedEventStore(events) {
+    return {
+        async claim(eventId) {
+            const now = new Date();
+            return await events.claim({
+                eventId,
+                receivedAt: now,
+                expiresAt: new Date(now.getTime() + retention_js_1.MODERATION_EVENT_RETENTION_SECONDS * 1000),
+            });
+        },
+        async release(eventId) {
+            await events.release(eventId);
+        },
+    };
+}
+function createInboundService(input) {
+    return {
+        async recordDecisionEvent(event) {
+            await input.transaction.run(async (tx) => {
+                const now = new Date();
+                await input.events.markQueued({
+                    eventId: event.eventId,
+                    type: event.type,
+                    caseId: event.caseId,
+                    payload: { caseId: event.caseId, decision: event.decision },
+                    now,
+                }, tx);
+                await input.outbox.enqueue({
+                    eventId: (0, service_js_1.decisionApplyEventId)(event.eventId),
+                    kind: 'decision.apply',
+                    payload: {
+                        eventId: event.eventId,
+                        caseId: event.caseId,
+                        decision: event.decision,
+                    },
+                }, tx);
+            });
+        },
+        async recordIgnoredEvent(event) {
+            await input.events.markIgnored({
+                eventId: event.eventId,
+                type: event.type,
+                ...(event.caseId === undefined ? {} : { caseId: event.caseId }),
+                now: new Date(),
+            });
+        },
+    };
+}
+//# sourceMappingURL=inbound.js.map

package/dist/outbox/inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../src/outbox/inbound.ts"],"names":[],"mappings":";;AA0CA,8DAiBC;AAoCD,oDA4CC;AA1ID,oDAA+E;AAC/E,iDAAoE;AAGpE;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,yBAAyB,CACvC,MAAiC;IAEjC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAe;YACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC;gBACxB,OAAO;gBACP,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,iDAAkC,GAAG,IAAK,CAAC;aAChF,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAe;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAoCD,SAAgB,oBAAoB,CAAM,KAIzC;IACC,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,MAAM,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAC3B;oBACE,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;oBAC3D,GAAG;iBACJ,EACD,EAAE,CACH,CAAC;gBAEF,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CACxB;oBACE,OAAO,EAAE,IAAA,iCAAoB,EAAC,KAAK,CAAC,OAAO,CAAC;oBAC5C,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE;wBACP,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBACzB;iBACF,EACD,EAAE,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC5B,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC/D,GAAG,EAAE,IAAI,IAAI,EAAE;aAChB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/outbox/index.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `@crowdsource.you/core/outbox` — the application half of a CrowdSource integration.
+ *
+ * An application that adopts CrowdSource has to solve the same six problems
+ * every other application does: store a report and its promise of delivery
+ * atomically, deliver it with retries and a dead-letter path, receive signed
+ * decisions without a body parser destroying the signature, deduplicate
+ * redeliveries across several tasks, apply a decision without a stale revision
+ * overwriting a fresh one, and carry out consequences exactly once and
+ * reversibly. None of that has anything to do with what the application's
+ * objects are.
+ *
+ * So all of it is here, and an application supplies four things: its subjects,
+ * its category mapping, its enforcement tables, and a STORE built by the
+ * PostgreSQL store factory.
+ *
+ * ```ts
+ * import { createModerationIntegration } from '@crowdsource.you/core/outbox';
+ * import { postgresModerationStore } from '@crowdsource.you/core/outbox/postgres';
+ *
+ * const moderation = createModerationIntegration({
+ *   store,
+ *   crowdSource: { enabled: true, serviceKey, webhookSecret, enforcementMode: 'observe' },
+ *   subjects: [listingSubjectProvider(), reviewSubjectProvider()],
+ *   taxonomy: { version: '2026.07', allegationsFor },
+ *   enforcement: commerceEnforcement,
+ *   logger,
+ * });
+ *
+ * // Indexes before the first write: the unique ones ARE the exactly-once
+ * // mechanism, and an index that does not exist yet refuses nothing.
+ * await store.ensureSchema();
+ *
+ * // BEFORE express.json() — the signature covers the bytes that arrived.
+ * app.use('/webhooks', moderation.webhookRouter());
+ * app.use(express.json());
+ *
+ * moderation.dispatcher.start();
+ * ```
+ *
+ * Two invariants are ENFORCED here rather than documented, because both fail
+ * silently and neither shows up in a test that only asserts the happy path:
+ *
+ * 1. Nothing can be enqueued that is not already recorded in the outbox, in the
+ *    same transaction. {@link ModerationOutboxTransactionError} is thrown by the
+ *    only writer of that collection when the transaction it was handed is not
+ *    open.
+ * 2. The webhook receiver reads raw bytes. Mounted after a JSON parser it
+ *    refuses rather than verifying a signature over a re-serialisation.
+ *
+ * Types come from `@crowdsource.you/contracts` and `@crowdsource.you/core`. This
+ * package re-exports none of them: a `Decision` or a `TaxonomyCode` has exactly
+ * one definition.
+ */
+export { createModerationIntegration } from './integration.js';
+export type { ModerationIntegration } from './integration.js';
+/**
+ * The retention windows are storage-independent policy, so they stay here while
+ * PostgreSQL-specific tables and stores live behind the `/postgres` subpath.
+ */
+export { MODERATION_EVENT_RETENTION_SECONDS, MODERATION_OUTBOX_RETENTION_SECONDS, } from './retention.js';
+export { ModerationOutboxTransactionError, decisionApplyEventId, isRetryableDeliveryError, reportSubmitEventId, } from './outbox/service.js';
+export type { ModerationOutboxFailure, ModerationOutboxHandler, OutboxDrain, OutboxService, } from './outbox/service.js';
+export type { ModerationEnforcementInsert, ModerationEnforcementKey, ModerationEnforcementStore, ModerationEventStore, ModerationOutboxStore, ModerationReportDecisionUpdate, ModerationReportInsert, ModerationReportRef, ModerationReportStore, ModerationStore, ModerationTransactionRunner, } from './store/types.js';
+export { ModerationOutboxDispatcher } from './outbox/dispatcher.js';
+export { ModerationReconciliationJob } from './reconciliation.js';
+export type { ReconcileModerationReports } from './reconciliation.js';
+export { DuplicateReportError } from './intake.js';
+export { CrowdSourceUnavailableError, ModerationDeliveryRejectedError, } from './delivery.js';
+export { ModerationDecisionDeferredError, ModerationDecisionRejectedError, } from './decision.js';
+export { ModerationSubjectUnsupportedError, ModerationTaxonomyError, createSubjectRegistry, snapshotHash, } from './evidence.js';
+export type { ModerationReportInput, SubjectRegistry } from './evidence.js';
+export { ModerationRestoreDirectionError, assertRestoreDirection, planEnforcement, primaryAction, } from './enforcement/planner.js';
+export type { EnforcementExecutor } from './enforcement/executor.js';
+export { localStatusForDecision } from './reportStatus.js';
+export { createProcessedEventStore } from './inbound.js';
+export type { InboundService, RecordDecisionEventInput } from './inbound.js';
+export type { CreateReportInput, CreateReportResult, CrowdSourceConnectionConfig, EnforcementEffect, EnforcementOutcome, EnforcementPreviousState, EnforcementSubject, ModerationContextResource, ModerationDispatchResult, ModerationEnforcementConfig, ModerationEnforcementMode, ModerationIntegrationConfig, ModerationLocalStatus, ModerationLogger, ModerationMetrics, ModerationOutboxEvent, ModerationOutboxKind, ModerationOutboxPayload, ModerationOutboxStatus, ModerationReconciliationResult, ModerationReportFields, ModerationResource, ModerationSubjectProvider, ModerationSubjectSnapshot, ModerationTaxonomy, PlannedEnforcementAction, ReportDecisionExtraFields, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/outbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/outbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9D;;;GAGG;AACH,OAAO,EACL,kCAAkC,EAClC,mCAAmC,GACpC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,uBAAuB,EACvB,uBAAuB,EACvB,WAAW,EACX,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,qBAAqB,EACrB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE5E,OAAO,EACL,+BAA+B,EAC/B,sBAAsB,EACtB,eAAe,EACf,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,YAAY,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAE7E,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,YAAY,CAAC"}

package/dist/outbox/index.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * `@crowdsource.you/core/outbox` — the application half of a CrowdSource integration.
+ *
+ * An application that adopts CrowdSource has to solve the same six problems
+ * every other application does: store a report and its promise of delivery
+ * atomically, deliver it with retries and a dead-letter path, receive signed
+ * decisions without a body parser destroying the signature, deduplicate
+ * redeliveries across several tasks, apply a decision without a stale revision
+ * overwriting a fresh one, and carry out consequences exactly once and
+ * reversibly. None of that has anything to do with what the application's
+ * objects are.
+ *
+ * So all of it is here, and an application supplies four things: its subjects,
+ * its category mapping, its enforcement tables, and a STORE built by the
+ * PostgreSQL store factory.
+ *
+ * ```ts
+ * import { createModerationIntegration } from '@crowdsource.you/core/outbox';
+ * import { postgresModerationStore } from '@crowdsource.you/core/outbox/postgres';
+ *
+ * const moderation = createModerationIntegration({
+ *   store,
+ *   crowdSource: { enabled: true, serviceKey, webhookSecret, enforcementMode: 'observe' },
+ *   subjects: [listingSubjectProvider(), reviewSubjectProvider()],
+ *   taxonomy: { version: '2026.07', allegationsFor },
+ *   enforcement: commerceEnforcement,
+ *   logger,
+ * });
+ *
+ * // Indexes before the first write: the unique ones ARE the exactly-once
+ * // mechanism, and an index that does not exist yet refuses nothing.
+ * await store.ensureSchema();
+ *
+ * // BEFORE express.json() — the signature covers the bytes that arrived.
+ * app.use('/webhooks', moderation.webhookRouter());
+ * app.use(express.json());
+ *
+ * moderation.dispatcher.start();
+ * ```
+ *
+ * Two invariants are ENFORCED here rather than documented, because both fail
+ * silently and neither shows up in a test that only asserts the happy path:
+ *
+ * 1. Nothing can be enqueued that is not already recorded in the outbox, in the
+ *    same transaction. {@link ModerationOutboxTransactionError} is thrown by the
+ *    only writer of that collection when the transaction it was handed is not
+ *    open.
+ * 2. The webhook receiver reads raw bytes. Mounted after a JSON parser it
+ *    refuses rather than verifying a signature over a re-serialisation.
+ *
+ * Types come from `@crowdsource.you/contracts` and `@crowdsource.you/core`. This
+ * package re-exports none of them: a `Decision` or a `TaxonomyCode` has exactly
+ * one definition.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProcessedEventStore = exports.localStatusForDecision = exports.primaryAction = exports.planEnforcement = exports.assertRestoreDirection = exports.ModerationRestoreDirectionError = exports.snapshotHash = exports.createSubjectRegistry = exports.ModerationTaxonomyError = exports.ModerationSubjectUnsupportedError = exports.ModerationDecisionRejectedError = exports.ModerationDecisionDeferredError = exports.ModerationDeliveryRejectedError = exports.CrowdSourceUnavailableError = exports.DuplicateReportError = exports.ModerationReconciliationJob = exports.ModerationOutboxDispatcher = exports.reportSubmitEventId = exports.isRetryableDeliveryError = exports.decisionApplyEventId = exports.ModerationOutboxTransactionError = exports.MODERATION_OUTBOX_RETENTION_SECONDS = exports.MODERATION_EVENT_RETENTION_SECONDS = exports.createModerationIntegration = void 0;
+var integration_js_1 = require("./integration.js");
+Object.defineProperty(exports, "createModerationIntegration", { enumerable: true, get: function () { return integration_js_1.createModerationIntegration; } });
+/**
+ * The retention windows are storage-independent policy, so they stay here while
+ * PostgreSQL-specific tables and stores live behind the `/postgres` subpath.
+ */
+var retention_js_1 = require("./retention.js");
+Object.defineProperty(exports, "MODERATION_EVENT_RETENTION_SECONDS", { enumerable: true, get: function () { return retention_js_1.MODERATION_EVENT_RETENTION_SECONDS; } });
+Object.defineProperty(exports, "MODERATION_OUTBOX_RETENTION_SECONDS", { enumerable: true, get: function () { return retention_js_1.MODERATION_OUTBOX_RETENTION_SECONDS; } });
+var service_js_1 = require("./outbox/service.js");
+Object.defineProperty(exports, "ModerationOutboxTransactionError", { enumerable: true, get: function () { return service_js_1.ModerationOutboxTransactionError; } });
+Object.defineProperty(exports, "decisionApplyEventId", { enumerable: true, get: function () { return service_js_1.decisionApplyEventId; } });
+Object.defineProperty(exports, "isRetryableDeliveryError", { enumerable: true, get: function () { return service_js_1.isRetryableDeliveryError; } });
+Object.defineProperty(exports, "reportSubmitEventId", { enumerable: true, get: function () { return service_js_1.reportSubmitEventId; } });
+var dispatcher_js_1 = require("./outbox/dispatcher.js");
+Object.defineProperty(exports, "ModerationOutboxDispatcher", { enumerable: true, get: function () { return dispatcher_js_1.ModerationOutboxDispatcher; } });
+var reconciliation_js_1 = require("./reconciliation.js");
+Object.defineProperty(exports, "ModerationReconciliationJob", { enumerable: true, get: function () { return reconciliation_js_1.ModerationReconciliationJob; } });
+var intake_js_1 = require("./intake.js");
+Object.defineProperty(exports, "DuplicateReportError", { enumerable: true, get: function () { return intake_js_1.DuplicateReportError; } });
+var delivery_js_1 = require("./delivery.js");
+Object.defineProperty(exports, "CrowdSourceUnavailableError", { enumerable: true, get: function () { return delivery_js_1.CrowdSourceUnavailableError; } });
+Object.defineProperty(exports, "ModerationDeliveryRejectedError", { enumerable: true, get: function () { return delivery_js_1.ModerationDeliveryRejectedError; } });
+var decision_js_1 = require("./decision.js");
+Object.defineProperty(exports, "ModerationDecisionDeferredError", { enumerable: true, get: function () { return decision_js_1.ModerationDecisionDeferredError; } });
+Object.defineProperty(exports, "ModerationDecisionRejectedError", { enumerable: true, get: function () { return decision_js_1.ModerationDecisionRejectedError; } });
+var evidence_js_1 = require("./evidence.js");
+Object.defineProperty(exports, "ModerationSubjectUnsupportedError", { enumerable: true, get: function () { return evidence_js_1.ModerationSubjectUnsupportedError; } });
+Object.defineProperty(exports, "ModerationTaxonomyError", { enumerable: true, get: function () { return evidence_js_1.ModerationTaxonomyError; } });
+Object.defineProperty(exports, "createSubjectRegistry", { enumerable: true, get: function () { return evidence_js_1.createSubjectRegistry; } });
+Object.defineProperty(exports, "snapshotHash", { enumerable: true, get: function () { return evidence_js_1.snapshotHash; } });
+var planner_js_1 = require("./enforcement/planner.js");
+Object.defineProperty(exports, "ModerationRestoreDirectionError", { enumerable: true, get: function () { return planner_js_1.ModerationRestoreDirectionError; } });
+Object.defineProperty(exports, "assertRestoreDirection", { enumerable: true, get: function () { return planner_js_1.assertRestoreDirection; } });
+Object.defineProperty(exports, "planEnforcement", { enumerable: true, get: function () { return planner_js_1.planEnforcement; } });
+Object.defineProperty(exports, "primaryAction", { enumerable: true, get: function () { return planner_js_1.primaryAction; } });
+var reportStatus_js_1 = require("./reportStatus.js");
+Object.defineProperty(exports, "localStatusForDecision", { enumerable: true, get: function () { return reportStatus_js_1.localStatusForDecision; } });
+var inbound_js_1 = require("./inbound.js");
+Object.defineProperty(exports, "createProcessedEventStore", { enumerable: true, get: function () { return inbound_js_1.createProcessedEventStore; } });
+//# sourceMappingURL=index.js.map

package/dist/outbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/outbox/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;;;AAEH,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AAGpC;;;GAGG;AACH,+CAGwB;AAFtB,kIAAA,kCAAkC,OAAA;AAClC,mIAAA,mCAAmC,OAAA;AAGrC,kDAK6B;AAJ3B,8HAAA,gCAAgC,OAAA;AAChC,kHAAA,oBAAoB,OAAA;AACpB,sHAAA,wBAAwB,OAAA;AACxB,iHAAA,mBAAmB,OAAA;AAuBrB,wDAAoE;AAA3D,2HAAA,0BAA0B,OAAA;AACnC,yDAAkE;AAAzD,gIAAA,2BAA2B,OAAA;AAGpC,yCAAmD;AAA1C,iHAAA,oBAAoB,OAAA;AAE7B,6CAGuB;AAFrB,0HAAA,2BAA2B,OAAA;AAC3B,8HAAA,+BAA+B,OAAA;AAGjC,6CAGuB;AAFrB,8HAAA,+BAA+B,OAAA;AAC/B,8HAAA,+BAA+B,OAAA;AAGjC,6CAKuB;AAJrB,gIAAA,iCAAiC,OAAA;AACjC,sHAAA,uBAAuB,OAAA;AACvB,oHAAA,qBAAqB,OAAA;AACrB,2GAAA,YAAY,OAAA;AAId,uDAKkC;AAJhC,6HAAA,+BAA+B,OAAA;AAC/B,oHAAA,sBAAsB,OAAA;AACtB,6GAAA,eAAe,OAAA;AACf,2GAAA,aAAa,OAAA;AAIf,qDAA2D;AAAlD,yHAAA,sBAAsB,OAAA;AAE/B,2CAAyD;AAAhD,uHAAA,yBAAyB,OAAA"}

package/dist/outbox/intake.d.ts

@@ -0,0 +1,62 @@
+import type { SubjectRegistry } from './evidence.js';
+import { type OutboxService } from './outbox/service.js';
+import type { ModerationReportStore, ModerationTransactionRunner } from './store/types.js';
+import type { CreateReportInput, CreateReportResult, ModerationReportFields } from './types.js';
+/**
+ * Storing a report and, when there is somewhere to send it, the promise to
+ * deliver it — in one operation.
+ *
+ * This is the only thing in the integration that a user waits for. A 201 from an
+ * application's report route means the report row and its outbox event committed
+ * together. It does NOT mean CrowdSource accepted anything — CrowdSource may be
+ * unreachable, mid-deploy or not yet configured, and the reporter is told their
+ * report was received either way, because it was.
+ *
+ * The transaction is the whole mechanism. Two writes outside one would give two
+ * failure modes that are both silent: a report with no delivery event (the
+ * report exists, nothing will ever send it, and nobody finds out until somebody
+ * asks why a case never opened) or a delivery event with no report (a delivery
+ * worker looking up an id that was rolled back). Neither surfaces as an error at
+ * the moment it happens, which is exactly why this has to be atomic rather than
+ * carefully ordered.
+ *
+ * The one report with NO delivery event is the one whose type has no subject
+ * provider, and that is a different claim entirely: not "delivery failed" but
+ * "there was never a route out of this application for this kind of object".
+ * Those two must not be conflated, which is why they are different `localStatus`
+ * values and why the absent route is written down as a reason rather than
+ * inferred from a missing row.
+ */
+export declare class DuplicateReportError<TReport> extends Error {
+    readonly existing: TReport;
+    constructor(existing: TReport);
+}
+/**
+ * Store the report, and queue its delivery in the same transaction.
+ *
+ * Delivery is queued when — and only when — the reported type has a subject
+ * provider. A type without one is stored at `received` with the reason recorded,
+ * which is the behaviour the application had before CrowdSource existed: the
+ * report is a receipt and a local record, and nothing else ever happens to it.
+ *
+ * That branch is the reason the two writes stay in one transaction rather than
+ * being ordered carefully. The condition is read BEFORE the transaction body
+ * decides anything, so `localStatus` and the presence of an outbox row are
+ * decided together from one fact — a report can never commit as `queued` with
+ * nothing to deliver it, nor as `received` with a delivery event that will try
+ * anyway.
+ *
+ * Intake deliberately does not read whether the integration is enabled. A report
+ * taken while it is off still gets its delivery event, so turning the flag on
+ * delivers the backlog instead of stranding it — the dispatcher is what is
+ * gated, not the durable record. Nothing here is conditional on a third party's
+ * state; only on whether this application knows how to describe the object at
+ * all.
+ */
+export declare function createIntake<TReport extends ModerationReportFields, TTx>(input: {
+    transaction: ModerationTransactionRunner<TTx>;
+    reports: ModerationReportStore<TReport, TTx>;
+    registry: SubjectRegistry;
+    outbox: OutboxService<TTx>;
+}): (report: CreateReportInput) => Promise<CreateReportResult<TReport>>;
+//# sourceMappingURL=intake.d.ts.map

package/dist/outbox/intake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intake.d.ts","sourceRoot":"","sources":["../../src/outbox/intake.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EACV,qBAAqB,EACrB,2BAA2B,EAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,qBAAa,oBAAoB,CAAC,OAAO,CAAE,SAAQ,KAAK;IACtD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;gBAEf,QAAQ,EAAE,OAAO;CAK9B;AAqDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,OAAO,SAAS,sBAAsB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC/E,WAAW,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;CAC5B,GAAG,CAAC,MAAM,EAAE,iBAAiB,KAAK,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAgDtE"}