@crowdsource.you/core 1.2.0

package/dist/outbox/types.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * The public surface an application implements.
+ *
+ * Everything in this file is a seam. Nothing in it knows what a post, a listing,
+ * a message or a property is — that knowledge belongs to the application and
+ * reaches this package through exactly four ports:
+ *
+ * 1. {@link ModerationSubjectProvider} — "given one of MY nouns and its id,
+ *    describe the material".
+ * 2. {@link ModerationTaxonomy} — "what my reporters can pick, as universal
+ *    allegation codes".
+ * 3. {@link ModerationEnforcementConfig} — "what I can do about a decision, and
+ *    how to do and undo it".
+ * 4. {@link ModerationStore} — where its reports and this package's own rows are
+ *    kept, built by the backend factory it chose and passed in whole.
+ *
+ * Everything else — the outbox, the transaction coupling, delivery, the webhook
+ * receiver, deduplication, decision application, enforcement idempotency and
+ * reversibility, reconciliation — is identical in every application and is
+ * imported, not written.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/outbox/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/outbox/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG"}

package/dist/outbox/webhook.d.ts

@@ -0,0 +1,15 @@
+import { Router } from 'express';
+import { type ProcessedEventStore } from '../express/index.js';
+import type { InboundService } from './inbound.js';
+import type { ModerationLogger, ModerationMetrics } from './types.js';
+export declare function createWebhookRouter(input: {
+    inbound: InboundService;
+    store: ProcessedEventStore;
+    secret?: string;
+    previousSecret?: string;
+    logger: ModerationLogger;
+    metrics?: ModerationMetrics;
+    /** Defaults to `/crowdsource`. */
+    path?: string;
+}): Router;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/outbox/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/outbox/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAiDtE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,cAAc,CAAC;IACxB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAuGT"}

package/dist/outbox/webhook.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWebhookRouter = createWebhookRouter;
+const express_1 = require("express");
+const index_js_1 = require("../express/index.js");
+/**
+ * `POST /crowdsource` — where decisions come back.
+ *
+ * ## The mount is part of the correctness
+ *
+ * This router MUST be mounted BEFORE `express.json()`. The signature covers
+ * `timestamp + "." + rawBody` — the bytes that arrived — and once a JSON parser
+ * has run, those bytes are gone. `@crowdsource.you/core/express` looks for a raw
+ * Buffer; handed a parsed `req.body` it refuses and raises a configuration error
+ * rather than verifying a signature over a re-serialisation. That refusal is the
+ * correct behaviour and it is also why the mount order cannot be got wrong
+ * silently.
+ *
+ * The property to TEST is not the mount order — that only proves the order. It
+ * is that no parser ran: assert `typeof req.body === 'undefined'` from inside
+ * the route.
+ *
+ * ## What this handler does and does not do
+ *
+ * It records and returns. A receiver should answer 2xx quickly and queue the
+ * processing, and the reason is not latency: applying a decision means reading
+ * objects, planning enforcement and writing several collections, and a receiver
+ * that did all that inline would time out under a burst and be retried while the
+ * first attempt was still running. So the event and a durable `decision.apply`
+ * outbox row commit in ONE transaction, and the dispatcher does the work.
+ *
+ * Nothing here is authenticated by Oxy. The HMAC IS the authentication, and an
+ * Oxy session must never satisfy this route — it is not a user endpoint.
+ */
+/**
+ * One string field out of an event payload this version does not know.
+ *
+ * A webhook envelope's `data` is deliberately OPAQUE in the contract: an
+ * unrecognised event's payload is whatever a newer CrowdSource decided to send,
+ * and the exported type says so — property access on it does not compile. That
+ * is the contract being honest rather than an obstacle, so this reads the key
+ * defensively instead of asserting a shape nobody has verified. Anything that is
+ * not a string is treated as absent, which is the only safe reading of a field
+ * this deployment has never seen.
+ */
+function stringField(source, key) {
+    if (typeof source !== 'object' || source === null)
+        return undefined;
+    const value = Reflect.get(source, key);
+    return typeof value === 'string' ? value : undefined;
+}
+function createWebhookRouter(input) {
+    const router = (0, express_1.Router)();
+    if (!input.secret) {
+        /**
+         * Not mounted, rather than mounted and permissive.
+         *
+         * A route that answers anything at all without a secret is a route that will
+         * one day be reasoned about as if it verified something. An unconfigured
+         * deployment 404s here, which is indistinguishable from not having the
+         * feature — which is exactly what it is.
+         */
+        input.logger.info('[CrowdSource] webhook route not mounted: no webhook secret is configured');
+        return router;
+    }
+    router.post(input.path ?? '/crowdsource', (0, index_js_1.crowdsourceWebhooks)({
+        secret: input.secret,
+        ...(input.previousSecret === undefined
+            ? {}
+            : { previousSecret: input.previousSecret }),
+        // Shared across tasks: the in-process default would dedupe only the
+        // instance that happened to receive both copies of a redelivery.
+        store: input.store,
+        on: {
+            /**
+             * A decision, provisional or final. Both are queued: a provisional
+             * decision is real and is recorded; what may be ACTED on is decided by
+             * the enforcement mode, not by discarding the event here.
+             */
+            'case.decided': async (event) => {
+                await input.inbound.recordDecisionEvent({
+                    eventId: event.id,
+                    type: event.type,
+                    caseId: event.data.caseId,
+                    decision: event.data.decision,
+                });
+            },
+            /**
+             * A later revision replacing an earlier one. The SAME path: the decision
+             * worker compares revisions and the enforcement executor reverses what
+             * the superseded revision did. A correction is not a special case with
+             * its own code — it is an ordinary decision that supersedes another, and
+             * giving it a separate path is how a restore ends up not being
+             * idempotent.
+             */
+            'decision.corrected': async (event) => {
+                await input.inbound.recordDecisionEvent({
+                    eventId: event.id,
+                    type: event.type,
+                    caseId: event.data.caseId,
+                    decision: event.data.decision,
+                });
+            },
+            /**
+             * An appeal's outcome carries a decision too, and it is the current
+             * answer for the case, so it takes the same path.
+             */
+            'appeal.decided': async (event) => {
+                await input.inbound.recordDecisionEvent({
+                    eventId: event.id,
+                    type: event.type,
+                    caseId: event.data.caseId,
+                    decision: event.data.decision,
+                });
+            },
+        },
+        /**
+         * Every other event type — including one this version of the contracts
+         * package has never heard of.
+         *
+         * Recorded rather than dropped. `case.created`, `case.escalated` and
+         * `case.closed` carry no decision and nothing to enforce, but "did
+         * CrowdSource tell us about this case, and when" is the first question
+         * asked when a report appears stuck, and the answer has to exist
+         * somewhere.
+         */
+        onUnhandled: async (event) => {
+            const caseId = stringField(event.data, 'caseId');
+            await input.inbound.recordIgnoredEvent({
+                eventId: event.id,
+                type: event.type,
+                ...(caseId === undefined ? {} : { caseId }),
+            });
+        },
+        /**
+         * A refusal reason and nothing else — never a body, a header or a
+         * signature. It is a bounded label, so it can be a metric.
+         */
+        onRejected: (rejection) => {
+            input.metrics?.incrementCounter('crowdsource_webhook_rejected_total', 1, {
+                rejection,
+            });
+            input.logger.warn('[CrowdSource] webhook delivery refused', { rejection });
+        },
+    }));
+    return router;
+}
+//# sourceMappingURL=webhook.js.map

package/dist/outbox/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/outbox/webhook.ts"],"names":[],"mappings":";;AAoDA,kDAgHC;AApKD,qCAAiC;AACjC,kDAAoF;AAIpF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,MAAe,EAAE,GAAW;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,KAAK,GAAY,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAgB,mBAAmB,CAAC,KASnC;IACC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB;;;;;;;WAOG;QACH,KAAK,CAAC,MAAM,CAAC,IAAI,CACf,0EAA0E,CAC3E,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,IAAI,IAAI,cAAc,EAC5B,IAAA,8BAAmB,EAAC;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;QAC7C,oEAAoE;QACpE,iEAAiE;QACjE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE,EAAE;YACF;;;;eAIG;YACH,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;oBACtC,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;oBACzB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD;;;;;;;eAOG;YACH,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACpC,MAAM,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;oBACtC,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;oBACzB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD;;;eAGG;YACH,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBAChC,MAAM,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;oBACtC,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;oBACzB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;iBAC9B,CAAC,CAAC;YACL,CAAC;SACF;QACD;;;;;;;;;WASG;QACH,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACjD,MAAM,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC;gBACrC,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE;YACxB,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,oCAAoC,EAAE,CAAC,EAAE;gBACvE,SAAS;aACV,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/reports.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `POST /v1/reports` and `GET /v1/reports/{id}` (§10.2, §10.4).
+ *
+ * The 202 this returns means what §7.1 says it means: the report is stored and
+ * durable rows exist for everything that happens next. It does not mean a jury
+ * exists, a decision exists, or that any downstream call succeeded — and an
+ * application that treats it as "moderation is done" has misread the contract.
+ * The decision comes back later, over a webhook.
+ */
+import { type CreateReportResponse, type ReportStatus } from '@crowdsource.you/contracts';
+import { type ReportInput } from './envelope.js';
+import type { Transport } from './transport.js';
+/**
+ * `GET /v1/reports/{id}` (§10.2 "receipt, caseId and limited status").
+ *
+ * Declared here because `@crowdsource.you/contracts` publishes the DOCUMENTS
+ * that travel over the API and not every HTTP response shape. The receipt and
+ * the case view below both belong in contracts; until they move, these are the
+ * types integrators compile against and the loose parse is what keeps a newer
+ * server from breaking an older client (§10.11).
+ */
+export interface ReportReceipt {
+    readonly reportId: string;
+    readonly externalReportId: string;
+    readonly caseId: string;
+    /**
+     * §3.2's report states, kept open. §10.11 requires a newer server not to break
+     * an older client, and a state added to §3.2 is exactly that case: the union
+     * still autocompletes the four this version knows and still type-checks the
+     * fifth when it arrives.
+     */
+    readonly status: ReportStatus | (string & {});
+    /** ISO-8601 UTC, as the API sends it. */
+    readonly receivedAt: string;
+}
+export interface ReportRequestOptions {
+    readonly signal?: AbortSignal;
+}
+export declare class Reports {
+    private readonly transport;
+    /**
+     * Awaited rather than read: with an Oxy service token the client has no
+     * credential to read an application id off, so the id is resolved from
+     * CrowdSource once and this holds that answer (settled or still in flight).
+     * A service key resolves to a plain string, and awaiting one costs nothing.
+     */
+    private readonly applicationId;
+    private readonly environment;
+    constructor(input: {
+        transport: Transport;
+        applicationId: string | Promise<string>;
+        environment: 'production' | 'sandbox';
+    });
+    /**
+     * Delivers a report.
+     *
+     * Call this from a delivery worker draining the application's own outbox, not
+     * from the request handler that answered the user (§7.1). The user is told
+     * their report was received the moment it is stored locally; this call is what
+     * eventually makes it CrowdSource's problem, and it is allowed to fail and be
+     * retried without the user ever knowing.
+     *
+     * Re-delivering the same report is safe and returns the same `reportId`. What
+     * is NOT safe is re-delivering the same `externalReportId` with a CHANGED
+     * body: §10.5 answers 409 and this client surfaces it as
+     * `CrowdSourceApiError` with `isPayloadConflict` and `retryable: false`,
+     * because no number of retries makes two different payloads one report.
+     */
+    create(input: ReportInput, options?: ReportRequestOptions): Promise<CreateReportResponse>;
+    /** Reads back the receipt for a report this application delivered. */
+    get(reportId: string, options?: ReportRequestOptions): Promise<ReportReceipt>;
+}
+//# sourceMappingURL=reports.d.ts.map

package/dist/reports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reports.d.ts","sourceRoot":"","sources":["../src/reports.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAA8C,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAE7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9C,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAUD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2B;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;gBAE3C,KAAK,EAAE;QACjB,SAAS,EAAE,SAAS,CAAC;QACrB,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,WAAW,EAAE,YAAY,GAAG,SAAS,CAAC;KACvC;IAMD;;;;;;;;;;;;;;OAcG;IACG,MAAM,CACV,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,oBAAoB,CAAC;IAwBhC,sEAAsE;IAChE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,aAAa,CAAC;CAgBxF"}

package/dist/reports.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * `POST /v1/reports` and `GET /v1/reports/{id}` (§10.2, §10.4).
+ *
+ * The 202 this returns means what §7.1 says it means: the report is stored and
+ * durable rows exist for everything that happens next. It does not mean a jury
+ * exists, a decision exists, or that any downstream call succeeded — and an
+ * application that treats it as "moderation is done" has misread the contract.
+ * The decision comes back later, over a webhook.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Reports = void 0;
+const contracts_1 = require("@crowdsource.you/contracts");
+const zod_1 = require("zod");
+const envelope_js_1 = require("./envelope.js");
+const errors_js_1 = require("./errors.js");
+const ReportReceiptSchema = zod_1.z.looseObject({
+    reportId: zod_1.z.string(),
+    externalReportId: zod_1.z.string(),
+    caseId: zod_1.z.string(),
+    status: zod_1.z.string(),
+    receivedAt: zod_1.z.string(),
+});
+class Reports {
+    constructor(input) {
+        this.transport = input.transport;
+        this.applicationId = input.applicationId;
+        this.environment = input.environment;
+    }
+    /**
+     * Delivers a report.
+     *
+     * Call this from a delivery worker draining the application's own outbox, not
+     * from the request handler that answered the user (§7.1). The user is told
+     * their report was received the moment it is stored locally; this call is what
+     * eventually makes it CrowdSource's problem, and it is allowed to fail and be
+     * retried without the user ever knowing.
+     *
+     * Re-delivering the same report is safe and returns the same `reportId`. What
+     * is NOT safe is re-delivering the same `externalReportId` with a CHANGED
+     * body: §10.5 answers 409 and this client surfaces it as
+     * `CrowdSourceApiError` with `isPayloadConflict` and `retryable: false`,
+     * because no number of retries makes two different payloads one report.
+     */
+    async create(input, options = {}) {
+        const envelope = (0, envelope_js_1.composeCaseEnvelope)(input, {
+            applicationId: await this.applicationId,
+            environment: this.environment,
+        });
+        const response = await this.transport.request({
+            method: 'POST',
+            path: '/v1/reports',
+            body: { externalReportId: input.externalReportId, envelope },
+            idempotencyKey: input.idempotencyKey ?? (0, envelope_js_1.defaultIdempotencyKey)(input.externalReportId),
+            signal: options.signal,
+        });
+        const parsed = contracts_1.CreateReportResponseSchema.safeParse(response);
+        if (!parsed.success) {
+            throw new errors_js_1.CrowdSourceTransportError('CrowdSource accepted the report but answered with a body this client does not recognise.', { retryable: false, cause: parsed.error });
+        }
+        return parsed.data;
+    }
+    /** Reads back the receipt for a report this application delivered. */
+    async get(reportId, options = {}) {
+        const response = await this.transport.request({
+            method: 'GET',
+            path: `/v1/reports/${encodeURIComponent(reportId)}`,
+            signal: options.signal,
+        });
+        const parsed = ReportReceiptSchema.safeParse(response);
+        if (!parsed.success) {
+            throw new errors_js_1.CrowdSourceTransportError('CrowdSource answered with a report receipt this client does not recognise.', { retryable: false, cause: parsed.error });
+        }
+        return parsed.data;
+    }
+}
+exports.Reports = Reports;
+//# sourceMappingURL=reports.js.map

package/dist/reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reports.js","sourceRoot":"","sources":["../src/reports.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,0DAIoC;AACpC,6BAAwB;AAExB,+CAA6F;AAC7F,2CAAwD;AA2BxD,MAAM,mBAAmB,GAAG,OAAC,CAAC,WAAW,CAAC;IACxC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE;IACpB,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE;IAC5B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAMH,MAAa,OAAO;IAWlB,YAAY,KAIX;QACC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CACV,KAAkB,EAClB,UAAgC,EAAE;QAElC,MAAM,QAAQ,GAAG,IAAA,iCAAmB,EAAC,KAAK,EAAE;YAC1C,aAAa,EAAE,MAAM,IAAI,CAAC,aAAa;YACvC,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAU;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,QAAQ,EAAE;YAC5D,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAA,mCAAqB,EAAC,KAAK,CAAC,gBAAgB,CAAC;YACrF,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,sCAA0B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qCAAyB,CACjC,0FAA0F,EAC1F,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,UAAgC,EAAE;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAU;YACrD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,eAAe,kBAAkB,CAAC,QAAQ,CAAC,EAAE;YACnD,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qCAAyB,CACjC,4EAA4E,EAC5E,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAhFD,0BAgFC"}

package/dist/testing/fixtures.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Fixtures.
+ *
+ * Every builder below runs its result through the published contract before
+ * returning it. A fixture that does not validate is a failing test, not
+ * something to loosen — it is how an integrator finds out a contract moved, and
+ * it is the only mechanism that stops this package from teaching a shape
+ * CrowdSource will refuse.
+ *
+ * Everything here is synthetic. No real reported material, no real evidence, no
+ * real reviewer or reporter identity ever ships in a test package: §13.5
+ * minimises what exists at all, and a fixture file is forever.
+ */
+import { type CaseEnvelope, type Decision, type KnownWebhookEvent, type TaxonomyCode } from '@crowdsource.you/contracts';
+export interface CaseEnvelopeFixtureOptions {
+    readonly applicationId?: string;
+    readonly externalReportId?: string;
+    readonly externalSubjectId?: string;
+    readonly text?: string;
+    readonly allegations?: readonly TaxonomyCode[];
+    /** An `oxy_user` binding carries a proof; §11.14 admits no effect without one. */
+    readonly authorOxyUserId?: string;
+    readonly allowCommunityReview?: boolean;
+}
+/**
+ * A minimal valid Case Envelope: one text resource, one allegation, one author.
+ *
+ * Deliberately the SMALLEST thing the contract accepts rather than a showcase of
+ * every field. A fixture that exercises everything hides which field a test
+ * actually depends on, and every optional field it carries is one more thing a
+ * contract change can break for a reason unrelated to the test.
+ */
+export declare function caseEnvelopeFixture(options?: CaseEnvelopeFixtureOptions): CaseEnvelope;
+export interface DecisionFixtureOptions {
+    readonly id?: string;
+    readonly caseId?: string;
+    readonly revision?: number;
+    readonly outcome?: Decision['outcome'];
+    readonly status?: Decision['status'];
+    readonly findingCode?: TaxonomyCode;
+    readonly supersedesDecisionId?: string;
+}
+/**
+ * A published decision (Appendix B).
+ *
+ * The jury arithmetic is real, not decorative: `agreement` must equal
+ * `winningVotes / decisiveVotes` or the contract refuses the document. That
+ * check is the auditable trace of "one qualified person, one vote", so a fixture
+ * that faked it would teach a shape the service will never emit.
+ */
+export declare function decisionFixture(options?: DecisionFixtureOptions): Decision;
+export interface WebhookEventFixtureOptions {
+    readonly id?: string;
+    readonly organizationId?: string;
+    readonly applicationId?: string;
+    readonly createdAt?: string;
+    readonly caseId?: string;
+    readonly decision?: Decision;
+}
+/** A `case.decided` delivery (§10.7) — the one event §10.7 specifies in full. */
+export declare function caseDecidedEventFixture(options?: WebhookEventFixtureOptions): KnownWebhookEvent;
+//# sourceMappingURL=fixtures.d.ts.map

package/dist/testing/fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures.d.ts","sourceRoot":"","sources":["../../src/testing/fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAML,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAQpC,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC/C,kFAAkF;IAClF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,0BAA+B,GAAG,YAAY,CAyC1F;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,QAAQ,CA6C9E;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,0BAA+B,GACvC,iBAAiB,CAWnB"}

package/dist/testing/fixtures.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Fixtures.
+ *
+ * Every builder below runs its result through the published contract before
+ * returning it. A fixture that does not validate is a failing test, not
+ * something to loosen — it is how an integrator finds out a contract moved, and
+ * it is the only mechanism that stops this package from teaching a shape
+ * CrowdSource will refuse.
+ *
+ * Everything here is synthetic. No real reported material, no real evidence, no
+ * real reviewer or reporter identity ever ships in a test package: §13.5
+ * minimises what exists at all, and a fixture file is forever.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.caseEnvelopeFixture = caseEnvelopeFixture;
+exports.decisionFixture = decisionFixture;
+exports.caseDecidedEventFixture = caseDecidedEventFixture;
+const contracts_1 = require("@crowdsource.you/contracts");
+const node_crypto_1 = require("node:crypto");
+/** Deterministic, so a fixture used twice produces the same bytes. */
+function digestOf(value) {
+    return `sha256:${(0, node_crypto_1.createHash)('sha256').update(JSON.stringify(value)).digest('hex')}`;
+}
+/**
+ * A minimal valid Case Envelope: one text resource, one allegation, one author.
+ *
+ * Deliberately the SMALLEST thing the contract accepts rather than a showcase of
+ * every field. A fixture that exercises everything hides which field a test
+ * actually depends on, and every optional field it carries is one more thing a
+ * contract change can break for a reason unrelated to the test.
+ */
+function caseEnvelopeFixture(options = {}) {
+    const text = options.text ?? 'Synthetic reported text for an integration test.';
+    const authorOxyUserId = options.authorOxyUserId ?? 'oxy_test_author';
+    return contracts_1.CaseEnvelopeSchema.parse({
+        schemaVersion: contracts_1.CASE_ENVELOPE_SCHEMA_VERSION,
+        applicationId: options.applicationId ?? 'app_test',
+        externalReportId: options.externalReportId ?? 'report_test_1',
+        source: { environment: 'sandbox', submittedAt: '2026-07-29T00:00:00.000Z' },
+        subject: {
+            externalId: options.externalSubjectId ?? 'post_test_1',
+            type: 'social.post',
+            primaryResourceId: 'res_subject',
+        },
+        principalBindings: [
+            {
+                principalRef: 'p_author',
+                type: 'oxy_user',
+                externalPrincipalId: authorOxyUserId,
+                bindingProofId: authorOxyUserId,
+            },
+        ],
+        resources: [
+            {
+                id: 'res_subject',
+                type: 'text',
+                role: 'subject',
+                language: 'en',
+                data: { text },
+                sha256: digestOf({ type: 'text', data: { text } }),
+                authorPrincipalRef: 'p_author',
+            },
+        ],
+        relations: [],
+        allegations: (options.allegations ?? ['harassment.targeted_abuse']).map((code) => ({ code })),
+        policy: { policySetId: 'crowdsource.baseline', version: '2026.07' },
+        privacy: {
+            retentionDays: 30,
+            allowCommunityReview: options.allowCommunityReview ?? true,
+        },
+    });
+}
+/**
+ * A published decision (Appendix B).
+ *
+ * The jury arithmetic is real, not decorative: `agreement` must equal
+ * `winningVotes / decisiveVotes` or the contract refuses the document. That
+ * check is the auditable trace of "one qualified person, one vote", so a fixture
+ * that faked it would teach a shape the service will never emit.
+ */
+function decisionFixture(options = {}) {
+    const outcome = options.outcome ?? 'violation';
+    const revision = options.revision ?? 1;
+    return contracts_1.DecisionSchema.parse({
+        id: options.id ?? 'dec_test_1',
+        caseId: options.caseId ?? 'case_test_1',
+        revision,
+        status: options.status ?? 'final',
+        outcome,
+        contextSufficiency: 'sufficient',
+        confidence: 1,
+        findings: outcome === 'violation'
+            ? [
+                {
+                    code: options.findingCode ?? 'harassment.targeted_abuse',
+                    resourceIds: ['res_subject'],
+                    severity: 'medium',
+                    scope: 'application_local',
+                    attribution: 'author',
+                },
+            ]
+            : [],
+        recommendedActions: outcome === 'violation'
+            ? [{ action: 'remove_or_restrict', targetResourceIds: ['res_subject'] }]
+            : [{ action: 'no_action' }],
+        jury: {
+            size: 3,
+            decisiveVotes: 3,
+            winningVotes: 3,
+            agreement: 1,
+            specialistPresent: false,
+        },
+        policyVersions: {
+            taxonomy: contracts_1.UNIVERSAL_TAXONOMY_VERSION,
+            application: '2026.07',
+            oxyConduct: '2026.07',
+        },
+        ...(options.supersedesDecisionId === undefined
+            ? {}
+            : { supersedesDecisionId: options.supersedesDecisionId }),
+        publishedAt: '2026-07-29T12:00:00.000Z',
+    });
+}
+/** A `case.decided` delivery (§10.7) — the one event §10.7 specifies in full. */
+function caseDecidedEventFixture(options = {}) {
+    const decision = options.decision ?? decisionFixture({ caseId: options.caseId });
+    return contracts_1.KnownWebhookEventSchema.parse({
+        id: options.id ?? 'evt_test_1',
+        type: 'case.decided',
+        createdAt: options.createdAt ?? '2026-07-29T12:00:00.000Z',
+        organizationId: options.organizationId ?? 'org_test',
+        applicationId: options.applicationId ?? 'app_test',
+        data: { caseId: options.caseId ?? decision.caseId, decision },
+    });
+}
+//# sourceMappingURL=fixtures.js.map

package/dist/testing/fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixtures.js","sourceRoot":"","sources":["../../src/testing/fixtures.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAuCH,kDAyCC;AAoBD,0CA6CC;AAYD,0DAaC;AAxKD,0DAUoC;AACpC,6CAAyC;AAEzC,sEAAsE;AACtE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,UAAU,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtF,CAAC;AAaD;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kDAAkD,CAAC;IAChF,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,iBAAiB,CAAC;IAErE,OAAO,8BAAkB,CAAC,KAAK,CAAC;QAC9B,aAAa,EAAE,wCAA4B;QAC3C,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,UAAU;QAClD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,eAAe;QAC7D,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,0BAA0B,EAAE;QAC3E,OAAO,EAAE;YACP,UAAU,EAAE,OAAO,CAAC,iBAAiB,IAAI,aAAa;YACtD,IAAI,EAAE,aAAa;YACnB,iBAAiB,EAAE,aAAa;SACjC;QACD,iBAAiB,EAAE;YACjB;gBACE,YAAY,EAAE,UAAU;gBACxB,IAAI,EAAE,UAAU;gBAChB,mBAAmB,EAAE,eAAe;gBACpC,cAAc,EAAE,eAAe;aAChC;SACF;QACD,SAAS,EAAE;YACT;gBACE,EAAE,EAAE,aAAa;gBACjB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,EAAE,IAAI,EAAE;gBACd,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;gBAClD,kBAAkB,EAAE,UAAU;aAC/B;SACF;QACD,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,OAAO,EAAE,SAAS,EAAE;QACnE,OAAO,EAAE;YACP,aAAa,EAAE,EAAE;YACjB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,IAAI;SAC3D;KACF,CAAC,CAAC;AACL,CAAC;AAYD;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IAEvC,OAAO,0BAAc,CAAC,KAAK,CAAC;QAC1B,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;QACvC,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;QACjC,OAAO;QACP,kBAAkB,EAAE,YAAY;QAChC,UAAU,EAAE,CAAC;QACb,QAAQ,EACN,OAAO,KAAK,WAAW;YACrB,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,2BAA2B;oBACxD,WAAW,EAAE,CAAC,aAAa,CAAC;oBAC5B,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,mBAAmB;oBAC1B,WAAW,EAAE,QAAQ;iBACtB;aACF;YACH,CAAC,CAAC,EAAE;QACR,kBAAkB,EAChB,OAAO,KAAK,WAAW;YACrB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;YACxE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/B,IAAI,EAAE;YACJ,IAAI,EAAE,CAAC;YACP,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,CAAC;YACZ,iBAAiB,EAAE,KAAK;SACzB;QACD,cAAc,EAAE;YACd,QAAQ,EAAE,sCAA0B;YACpC,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,SAAS;SACtB;QACD,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAC3D,WAAW,EAAE,0BAA0B;KACxC,CAAC,CAAC;AACL,CAAC;AAWD,iFAAiF;AACjF,SAAgB,uBAAuB,CACrC,UAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjF,OAAO,mCAAuB,CAAC,KAAK,CAAC;QACnC,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY;QAC9B,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,0BAA0B;QAC1D,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,UAAU;QACpD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,UAAU;QAClD,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE;KAC9D,CAAC,CAAC;AACL,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `@crowdsource.you/core/testing` — integrate against CrowdSource before a jury
+ * exists.
+ *
+ * ```ts
+ * import { createCrowdSourceSandbox } from '@crowdsource.you/core/testing';
+ * import { CrowdSource } from '@crowdsource.you/core';
+ *
+ * const sandbox = createCrowdSourceSandbox();
+ * const crowdsource = new CrowdSource({
+ *   serviceKey: sandbox.serviceKey,
+ *   baseUrl: sandbox.baseUrl,
+ *   fetch: sandbox.fetch,
+ * });
+ *
+ * const { caseId } = await crowdsource.reports.create({ ... });
+ * const decision = sandbox.decide(caseId, { outcome: 'violation' });
+ * await sandbox.deliver('http://localhost:3000/webhooks/crowdsource', sandbox.eventFor(decision));
+ * ```
+ *
+ * The report goes through the real client, the sandbox applies the real rules
+ * (tenant from the credential, idempotency, 409 on a changed body, one case per
+ * reported version), and the webhook that comes back is genuinely signed — so
+ * the receiver being tested is the receiver that will run in production.
+ *
+ * The simulator can also deliver a stale, forged or tampered event on purpose.
+ * Asserting that a receiver REFUSES those is the half of a webhook test that
+ * actually proves something.
+ */
+export { caseDecidedEventFixture, caseEnvelopeFixture, decisionFixture, } from './fixtures.js';
+export type { CaseEnvelopeFixtureOptions, DecisionFixtureOptions, WebhookEventFixtureOptions, } from './fixtures.js';
+export { CrowdSourceSandbox, createCrowdSourceSandbox } from './sandbox.js';
+export type { CrowdSourceSandboxOptions, SandboxCase, SandboxDecisionInput, SandboxReport, } from './sandbox.js';
+export { WebhookSimulator, signWebhookDelivery } from './webhook-simulator.js';
+export type { SignWebhookInput, SignedWebhookDelivery, WebhookDeliveryOverrides, WebhookDeliveryResult, WebhookSimulatorOptions, } from './webhook-simulator.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EACV,yBAAyB,EACzB,WAAW,EACX,oBAAoB,EACpB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC/E,YAAY,EACV,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC"}