@crowdsource.you/core 1.2.0

package/dist/esm/express/middleware.js

@@ -0,0 +1,293 @@
+/**
+ * The webhook receiver.
+ *
+ * ```ts
+ * app.post('/webhooks/crowdsource', crowdsourceWebhooks({
+ *   on: {
+ *     'case.decided': async (event) => { await moderationQueue.add(event.id, event.data); },
+ *   },
+ * }));
+ * ```
+ *
+ * No `express.raw`, no body-parser ordering to get right, no secret to plumb
+ * through — the secret comes from the environment and the handler reads the
+ * request stream itself. That is not convenience for its own sake. The single
+ * most likely way to ship a broken CrowdSource integration is to verify a
+ * signature over `JSON.stringify(req.body)`, which succeeds on every test
+ * payload a developer writes by hand and fails on the first real delivery whose
+ * key order or unicode escaping differs — or, far worse, succeeds on a forged
+ * body that happens to re-serialise identically. This middleware makes that
+ * unreachable: it verifies the bytes it read, and if something upstream already
+ * consumed them it REFUSES rather than reconstructing them.
+ *
+ * What it guarantees, in order:
+ *
+ *   1. The signature is checked over the bytes that arrived (§10.8).
+ *   2. A timestamp outside the five-minute window is rejected before anything
+ *      is dispatched, in both directions.
+ *   3. An event id already claimed is acknowledged without running the handler
+ *      again (§10.8), and a handler that throws releases the claim so the
+ *      retry in §10.9 still works.
+ *   4. An event type this integration does not handle — including one that did
+ *      not exist when it was written — is acknowledged and ignored (§10.11). A
+ *      new event type never breaks an existing integration.
+ *   5. Nothing sensitive is logged. The `onRejected` hook is given the reason
+ *      and never the body (§10.8's last line).
+ */
+import { KnownWebhookEventSchema, WEBHOOK_EVENT_ID_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_TIMESTAMP_HEADER, WebhookEventEnvelopeSchema, } from '@crowdsource.you/contracts';
+import { memoryProcessedEventStore } from './store.js';
+import { verifyWebhookDelivery } from './verify.js';
+/** The active signing secret. */
+export const WEBHOOK_SECRET_ENV_VAR = 'CROWDSOURCE_WEBHOOK_SECRET';
+/** The secret being retired, during the overlap §10.8 requires for rotation. */
+export const WEBHOOK_PREVIOUS_SECRET_ENV_VAR = 'CROWDSOURCE_WEBHOOK_SECRET_PREVIOUS';
+/** Matches the backend's own `express.json` limit. */
+const DEFAULT_MAX_BODY_BYTES = 1048576;
+/**
+ * Thrown when the request cannot be verified because of how the application is
+ * assembled, not because of anything the sender did.
+ *
+ * Passed to `next()` so it reaches the application's error handler and is
+ * impossible to miss. The alternative — falling back to `req.body` — is the bug
+ * this whole package exists to prevent.
+ */
+export class CrowdSourceWebhookConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CrowdSourceWebhookConfigurationError';
+    }
+}
+export function crowdsourceWebhooks(options = {}) {
+    const store = options.store ?? memoryProcessedEventStore();
+    const handlers = options.on ?? {};
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    return (request, response, next) => {
+        void handleDelivery({
+            request,
+            response,
+            next,
+            store,
+            handlers,
+            maxBodyBytes,
+            options,
+        });
+    };
+}
+async function handleDelivery(context) {
+    const { request, response, next, options } = context;
+    let rawBody;
+    try {
+        rawBody = await readRawBody(request, context.maxBodyBytes);
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError) {
+            options.onRejected?.('payload_too_large');
+            response.status(413).json({ received: false, rejection: 'payload_too_large' });
+            return;
+        }
+        next(error);
+        return;
+    }
+    const verification = verifyWebhookDelivery({
+        eventIdHeader: request.get(WEBHOOK_EVENT_ID_HEADER),
+        timestampHeader: request.get(WEBHOOK_TIMESTAMP_HEADER),
+        signatureHeader: request.get(WEBHOOK_SIGNATURE_HEADER),
+        rawBody,
+        secrets: configuredSecrets(options),
+        nowMs: Date.now(),
+        ...(options.toleranceSeconds === undefined
+            ? {}
+            : { toleranceSeconds: options.toleranceSeconds }),
+    });
+    if (!verification.ok) {
+        options.onRejected?.(verification.rejection);
+        /**
+         * 401, not 400. A refused delivery is an authentication failure from the
+         * sender's point of view, and §10.9 keeps retrying 4xx a bounded number of
+         * times either way — what matters is that it is never a 2xx, because a 2xx
+         * would retire the delivery as successfully processed.
+         *
+         * `no_secret_configured` is the one case that is OUR fault, and it still
+         * answers 401 rather than 500: a receiver with no secret must not tell the
+         * world it is running unconfigured, and answering non-2xx keeps the event on
+         * the sender's retry schedule until somebody fixes it.
+         */
+        response.status(401).json({ received: false, rejection: verification.rejection });
+        return;
+    }
+    const parsed = WebhookEventEnvelopeSchema.safeParse(parseJson(rawBody));
+    if (!parsed.success) {
+        options.onRejected?.('malformed_event');
+        response.status(400).json({ received: false, rejection: 'malformed_event' });
+        return;
+    }
+    const envelope = parsed.data;
+    /**
+     * The signed header and the signed body must name the same event. They are
+     * both inside the signature, so a disagreement is not an attack — it is a
+     * sender defect — but a receiver that deduped on the header while handling the
+     * body would process one event under another's id.
+     */
+    if (envelope.id !== verification.eventId) {
+        options.onRejected?.('event_id_mismatch');
+        response.status(400).json({ received: false, rejection: 'event_id_mismatch' });
+        return;
+    }
+    const claimed = await context.store.claim(envelope.id);
+    if (!claimed) {
+        response.status(200).json({ received: true, eventId: envelope.id, duplicate: true });
+        return;
+    }
+    try {
+        const handled = await dispatch(context.handlers, envelope, options.onUnhandled);
+        response.status(200).json({ received: true, eventId: envelope.id, duplicate: false, handled });
+    }
+    catch (error) {
+        // The claim goes back so §10.9's retry schedule can deliver it again. Losing
+        // a decision because a queue was briefly down is not an acceptable outcome.
+        await context.store.release(envelope.id);
+        next(error);
+    }
+}
+/**
+ * Dispatches a verified event, and returns whether anything handled it.
+ *
+ * The switch is exhaustive over the contract's event types on purpose: adding an
+ * event to `WEBHOOK_EVENT_TYPES` stops this file compiling until it is handled
+ * here, which is the right failure for the SDK. For an INTEGRATION it is the
+ * opposite — the `default` branch means an unrecognised type is acknowledged and
+ * ignored, so a newer CrowdSource never breaks an older receiver (§10.11).
+ *
+ * The payload is only parsed against the known-event schema when a handler is
+ * actually registered for that type. An integration handling `case.decided` is
+ * therefore unaffected by a later change to what `appeal.created` carries.
+ */
+async function dispatch(handlers, envelope, onUnhandled) {
+    const known = KnownWebhookEventSchema.safeParse(envelope);
+    if (known.success && (await invoke(handlers, known.data)))
+        return true;
+    if (onUnhandled) {
+        await onUnhandled(envelope);
+        return true;
+    }
+    return false;
+}
+/** Calls `handler` with `event` if there is one, and says whether there was. */
+async function call(handler, event) {
+    if (handler === undefined)
+        return false;
+    await handler(event);
+    return true;
+}
+/**
+ * The exhaustive half of `dispatch`, written out rather than looked up.
+ *
+ * Indexing the handler map with `event.type` while `event.type` is still a union
+ * would need a cast to call the result, and a cast is exactly what must not sit
+ * between a signed event and the code that acts on it. Narrowing per case is
+ * what makes each call provably well-typed, and it means adding an event to the
+ * contract stops this file compiling until it is handled.
+ */
+async function invoke(handlers, event) {
+    switch (event.type) {
+        case 'report.received':
+            return await call(handlers['report.received'], event);
+        case 'case.created':
+            return await call(handlers['case.created'], event);
+        case 'case.escalated':
+            return await call(handlers['case.escalated'], event);
+        case 'case.decided':
+            return await call(handlers['case.decided'], event);
+        case 'decision.corrected':
+            return await call(handlers['decision.corrected'], event);
+        case 'appeal.created':
+            return await call(handlers['appeal.created'], event);
+        case 'appeal.decided':
+            return await call(handlers['appeal.decided'], event);
+        case 'case.closed':
+            return await call(handlers['case.closed'], event);
+        case 'community_note.status_changed':
+            return await call(handlers['community_note.status_changed'], event);
+        default:
+            return false;
+    }
+}
+function configuredSecrets(options) {
+    const active = options.secret ?? process.env[WEBHOOK_SECRET_ENV_VAR];
+    const previous = options.previousSecret ?? process.env[WEBHOOK_PREVIOUS_SECRET_ENV_VAR];
+    return [active, previous].filter((secret) => typeof secret === 'string' && secret.length > 0);
+}
+function parseJson(rawBody) {
+    try {
+        return JSON.parse(rawBody.toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+class BodyTooLargeError extends Error {
+}
+/**
+ * The bytes as they arrived.
+ *
+ * Three sources, in the order that keeps the guarantee:
+ *
+ *   1. `req.body` is already a Buffer — `express.raw()` is mounted ahead of this
+ *      handler, which is correct and supported.
+ *   2. `req.rawBody` is a Buffer — the `express.json({ verify })` idiom, also
+ *      correct.
+ *   3. Nothing has touched the request — read the stream.
+ *
+ * Anything else REFUSES. A parsed `req.body` means a JSON parser ran first and
+ * the original bytes are gone; re-serialising them would produce a different
+ * value from the one that was signed, and the only way to make that "work"
+ * would be to verify a signature over bytes CrowdSource never sent.
+ */
+async function readRawBody(request, maxBodyBytes) {
+    const carried = Reflect.get(request, 'rawBody');
+    if (Buffer.isBuffer(carried))
+        return carried;
+    const parsedBody = request.body;
+    if (Buffer.isBuffer(parsedBody))
+        return parsedBody;
+    if (parsedBody !== undefined && parsedBody !== null) {
+        throw new CrowdSourceWebhookConfigurationError('A body parser ran before the CrowdSource webhook handler, so the signed bytes no longer exist. Mount this handler before express.json(), scope express.json() away from the webhook route, or use express.json({ verify }) to keep the raw body.');
+    }
+    if (request.readableEnded) {
+        throw new CrowdSourceWebhookConfigurationError('The request body was already consumed before the CrowdSource webhook handler ran, so the signed bytes no longer exist.');
+    }
+    return await new Promise((resolve, reject) => {
+        const chunks = [];
+        let received = 0;
+        let settled = false;
+        request.on('data', (chunk) => {
+            if (settled)
+                return;
+            received += chunk.length;
+            if (received > maxBodyBytes) {
+                settled = true;
+                // Paused rather than destroyed: destroying the request takes the socket
+                // with it, and the 413 the caller is about to write would never reach
+                // the sender — which would turn a clear refusal into a connection reset
+                // that a delivery worker can only report as "unknown".
+                request.pause();
+                reject(new BodyTooLargeError());
+                return;
+            }
+            chunks.push(chunk);
+        });
+        request.on('end', () => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(Buffer.concat(chunks));
+        });
+        request.on('error', (error) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        });
+    });
+}
+//# sourceMappingURL=middleware.js.map

package/dist/esm/express/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/express/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,GAI3B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,yBAAyB,EAA4B,MAAM,YAAY,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAyB,MAAM,aAAa,CAAC;AAE3E,iCAAiC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAEnE,gFAAgF;AAChF,MAAM,CAAC,MAAM,+BAA+B,GAAG,qCAAqC,CAAC;AAErF,sDAAsD;AACtD,MAAM,sBAAsB,GAAG,OAAS,CAAC;AA4CzC;;;;;;;GAOG;AACH,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IAC7D,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,yBAAyB,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAEpE,OAAO,CAAC,OAAgB,EAAE,QAAkB,EAAE,IAAkB,EAAQ,EAAE;QACxE,KAAK,cAAc,CAAC;YAClB,OAAO;YACP,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,YAAY;YACZ,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAYD,KAAK,UAAU,cAAc,CAAC,OAAwB;IACpD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAErD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,OAAO,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,CAAC;YAC1C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,CAAC;QACzC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACnD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACtD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACtD,OAAO;QACP,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;QACnC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;QACjB,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC7C;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,UAAU,EAAE,CAAC,iBAAiB,CAAC,CAAC;QACxC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAE7B;;;;;OAKG;IACH,IAAI,QAAQ,CAAC,EAAE,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;QACzC,OAAO,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC1C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAChF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,QAAQ,CACrB,QAA8B,EAC9B,QAA8B,EAC9B,WAAsD;IAEtD,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,IAAI,CACjB,OAAyD,EACzD,KAAQ;IAER,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,MAAM,CACnB,QAA8B,EAC9B,KAAwB;IAExB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,iBAAiB;YACpB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;QACxD,KAAK,cAAc;YACjB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,KAAK,gBAAgB;YACnB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,KAAK,cAAc;YACjB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,KAAK,oBAAoB;YACvB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,gBAAgB;YACnB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,KAAK,gBAAgB;YACnB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,KAAK,aAAa;YAChB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,+BAA+B;YAClC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,KAAK,CAAC,CAAC;QACtE;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAmC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACxF,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,iBAAkB,SAAQ,KAAK;CAAG;AAExC;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,YAAoB;IAC/D,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE7C,MAAM,UAAU,GAAY,OAAO,CAAC,IAAI,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAEnD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,oCAAoC,CAC5C,kPAAkP,CACnP,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,oCAAoC,CAC5C,wHAAwH,CACzH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO;YACpB,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;gBAC5B,OAAO,GAAG,IAAI,CAAC;gBACf,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,uDAAuD;gBACvD,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,iBAAiB,EAAE,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/express/store.js

@@ -0,0 +1,69 @@
+/**
+ * Idempotency by event id (§10.8: "store the processed event id").
+ *
+ * A delivery is retried on the schedule in §10.9 — six times over 24 hours —
+ * and a retry can also happen because the receiver's 2xx was lost rather than
+ * because it failed. So the same event WILL arrive twice at a healthy receiver,
+ * and "did I already do this?" is the only thing standing between that and a
+ * piece of content being removed twice or a user being suspended twice.
+ *
+ * The interface is claim/release rather than a "seen?" check, because the
+ * obvious design is wrong in a way that is hard to see. Recording the id BEFORE
+ * the handler runs makes a handler failure permanent: every retry is deduped
+ * away and the work is lost silently, which is the worst possible outcome for a
+ * moderation decision. Recording it AFTER lets two concurrent deliveries of the
+ * same event both run. Claiming before and releasing on failure gets both: one
+ * in flight, and a failure still retryable.
+ */
+/** The retry schedule of §10.9 ends at 24 hours; a claim outlives it. */
+const DEFAULT_TTL_MS = 25 * 60 * 60 * 1000;
+const DEFAULT_MAX_ENTRIES = 10000;
+/**
+ * The default store: an in-process map with a TTL.
+ *
+ * **Per process.** Two instances behind a load balancer each keep their own,
+ * so a redelivery that lands on the other instance is NOT deduped. That is
+ * usually fine — the handlers a receiver should be writing are idempotent
+ * anyway, because §7.6 makes the application responsible for recording what it
+ * did about a decision — but an application whose enforcement is not idempotent
+ * must pass a shared store (Redis, its own database) instead. Saying so here is
+ * the point: a dedupe that silently only works on one instance is exactly the
+ * kind of thing that looks correct in staging.
+ *
+ * There is no timer. Expiry is evaluated on read and the map is pruned on
+ * insert, so nothing here keeps a Node event loop alive — a module-level
+ * `setInterval` in a library is how a consumer's test run stops exiting.
+ */
+export function memoryProcessedEventStore(options = {}) {
+    const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    const maxEntries = options.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    const claims = new Map();
+    const prune = (now) => {
+        for (const [eventId, expiresAt] of claims) {
+            if (expiresAt <= now)
+                claims.delete(eventId);
+        }
+        // Insertion-ordered, so the oldest claims go first once the cap is hit.
+        while (claims.size >= maxEntries) {
+            const oldest = claims.keys().next();
+            if (oldest.done === true)
+                break;
+            claims.delete(oldest.value);
+        }
+    };
+    return {
+        claim(eventId) {
+            const now = Date.now();
+            const held = claims.get(eventId);
+            if (held !== undefined && held > now)
+                return false;
+            prune(now);
+            claims.set(eventId, now + ttlMs);
+            return true;
+        },
+        release(eventId) {
+            claims.delete(eventId);
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/esm/express/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/express/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,yEAAyE;AACzE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAK,CAAC;AAE5C,MAAM,mBAAmB,GAAG,KAAM,CAAC;AAcnC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAA4C,EAAE;IAE9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;YAC1C,IAAI,SAAS,IAAI,GAAG;gBAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,wEAAwE;QACxE,OAAO,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAe;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEnD,KAAK,CAAC,GAAG,CAAC,CAAC;YACX,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,OAAe;YACrB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/express/verify.js

@@ -0,0 +1,133 @@
+/**
+ * Webhook signature verification (§10.8), as a pure function.
+ *
+ * Kept free of Express, of I/O and of the clock so that the security-critical
+ * decision — do these bytes carry a valid, fresh signature from a secret we
+ * hold? — can be attacked directly by a test rather than through a request. A
+ * signature check that cannot be made to fail is worse than no check at all, so
+ * the corpus in `__tests__/verify.test.ts` is mutation-tested: each deliberately
+ * weakened verifier must be CAUGHT by at least one case, and a case that no
+ * mutant fails is a case that proves nothing.
+ *
+ * §10.8 in full, and where each line lands:
+ *
+ *   * `signedPayload = timestamp + "." + rawBody` — `buildWebhookSignedPayload`
+ *     in the contracts package, so the signer and the verifier cannot disagree
+ *     about what gets signed. This module works on the BYTES of that value (see
+ *     `signedPayloadBytes`).
+ *   * "reject timestamps more than five minutes away" — `TOLERANCE`, applied in
+ *     BOTH directions. A future timestamp is as much a replay signal as an old
+ *     one, and only checking the past accepts a signature minted for a clock
+ *     nobody controls.
+ *   * "compare signatures in constant time" — `timingSafeEqual` over the decoded
+ *     digests. Never `===`: it returns on the first differing byte, which is a
+ *     forgery oracle with enough attempts.
+ *   * "store the processed event id" — `store.ts`, not here. Freshness and
+ *     authenticity are decidable from the request; whether it was already
+ *     handled is not.
+ *   * "allow two secrets during rotation" — `secrets` is a list, every entry is
+ *     tried, and the result names WHICH one matched so an operator can see the
+ *     old secret going quiet before they retire it.
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { WEBHOOK_SIGNATURE_VERSION, WEBHOOK_TIMESTAMP_TOLERANCE_SECONDS, WebhookSignatureHeaderSchema, WebhookTimestampHeaderSchema, buildWebhookSignedPayload, } from '@crowdsource.you/contracts';
+/**
+ * Why a delivery was refused. Terse on purpose: it goes back on the wire, into
+ * the sender's delivery log, and into `onRejected`.
+ *
+ * The first eight are what verification itself decides; the last three are the
+ * middleware's. They share one vocabulary so the reason a receiver reports and
+ * the reason it answers with are always the same string — two lists would drift
+ * the first time one of them grew.
+ */
+export const WEBHOOK_REJECTIONS = [
+    'missing_event_id',
+    'missing_timestamp',
+    'missing_signature',
+    'malformed_timestamp',
+    'malformed_signature',
+    'timestamp_out_of_window',
+    'signature_mismatch',
+    'no_secret_configured',
+    'malformed_event',
+    'event_id_mismatch',
+    'payload_too_large',
+];
+/**
+ * The exact bytes signed, without a UTF-8 round trip.
+ *
+ * §10.8 defines the signed payload as a STRING, and
+ * `buildWebhookSignedPayload` is that definition. Decoding the body to a string
+ * to rebuild it would map any invalid UTF-8 byte to U+FFFD — which is lossy, so
+ * two different bodies could produce the same signed payload. Concatenating the
+ * prefix bytes with the body bytes is the same value for every well-formed
+ * (UTF-8) JSON body and is not lossy for anything else. `verify.test.ts` asserts
+ * the two agree.
+ */
+export function signedPayloadBytes(timestamp, rawBody) {
+    // The prefix is taken FROM the contract's own function rather than restated
+    // as `${timestamp}.`, so a change to the separator follows automatically
+    // instead of leaving two definitions to drift.
+    const prefix = buildWebhookSignedPayload(timestamp, '');
+    return Buffer.concat([Buffer.from(prefix, 'utf8'), rawBody]);
+}
+function digestsMatch(expectedHex, presentedHex) {
+    const expected = Buffer.from(expectedHex, 'hex');
+    const presented = Buffer.from(presentedHex, 'hex');
+    // The header schema fixes the length at 64 hex characters, so this is never
+    // the branch that rejects a real delivery — it is what stops `timingSafeEqual`
+    // from throwing if that ever stops being true.
+    if (expected.length !== presented.length)
+        return false;
+    return timingSafeEqual(expected, presented);
+}
+/**
+ * Verifies one delivery.
+ *
+ * Order matters: everything cheap and decidable from the headers is checked
+ * BEFORE any HMAC is computed, so a flood of malformed deliveries cannot be
+ * turned into a CPU cost. The one thing that must not be reordered is the
+ * timestamp window, which §10.8 puts before the comparison — a signature that
+ * was valid last week is still cryptographically valid, and freshness is the
+ * only thing that makes it a replay.
+ */
+export function verifyWebhookDelivery(input) {
+    if (input.secrets.length === 0)
+        return { ok: false, rejection: 'no_secret_configured' };
+    const eventId = input.eventIdHeader?.trim();
+    if (!eventId)
+        return { ok: false, rejection: 'missing_event_id' };
+    if (input.timestampHeader === undefined)
+        return { ok: false, rejection: 'missing_timestamp' };
+    if (input.signatureHeader === undefined)
+        return { ok: false, rejection: 'missing_signature' };
+    if (!WebhookTimestampHeaderSchema.safeParse(input.timestampHeader).success) {
+        return { ok: false, rejection: 'malformed_timestamp' };
+    }
+    if (!WebhookSignatureHeaderSchema.safeParse(input.signatureHeader).success) {
+        return { ok: false, rejection: 'malformed_signature' };
+    }
+    const tolerance = input.toleranceSeconds ?? WEBHOOK_TIMESTAMP_TOLERANCE_SECONDS;
+    const skewSeconds = Math.abs(input.nowMs / 1000 - Number(input.timestampHeader));
+    if (skewSeconds > tolerance)
+        return { ok: false, rejection: 'timestamp_out_of_window' };
+    const presentedHex = input.signatureHeader.slice(`${WEBHOOK_SIGNATURE_VERSION}=`.length);
+    const payload = signedPayloadBytes(input.timestampHeader, input.rawBody);
+    /**
+     * Every secret is tried and the loop does not break early. Breaking would make
+     * "the active secret matched" measurably faster than "the previous one did",
+     * which tells a caller how far through a rotation the receiver is — small, but
+     * free to avoid.
+     */
+    let matchedIndex = -1;
+    input.secrets.forEach((secret, index) => {
+        const expected = createHmac('sha256', secret).update(payload).digest('hex');
+        if (digestsMatch(expected, presentedHex) && matchedIndex === -1) {
+            matchedIndex = index;
+        }
+    });
+    if (matchedIndex === -1)
+        return { ok: false, rejection: 'signature_mismatch' };
+    return { ok: true, eventId, secretIndex: matchedIndex };
+}
+//# sourceMappingURL=verify.js.map

package/dist/esm/express/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/express/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EACL,yBAAyB,EACzB,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,kBAAkB;IAClB,mBAAmB;IACnB,mBAAmB;IACnB,qBAAqB;IACrB,qBAAqB;IACrB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;CACX,CAAC;AAyBX;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,OAAe;IACnE,4EAA4E;IAC5E,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,YAAoB;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACnD,4EAA4E;IAC5E,+EAA+E;IAC/E,+CAA+C;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA+B;IACnE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;IAExF,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IAC9F,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IAE9F,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,mCAAmC,CAAC;IAChF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAK,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAClF,IAAI,WAAW,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;IAExF,MAAM,YAAY,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,yBAAyB,GAAG,CAAC,MAAM,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAEzE;;;;;OAKG;IACH,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC1D,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,57 @@
+/**
+ * `@crowdsource.you/core` — the TypeScript client for the CrowdSource moderation
+ * API.
+ *
+ * The smallest integration this package supports, in full:
+ *
+ * ```ts
+ * import { CrowdSource } from '@crowdsource.you/core';
+ *
+ * const crowdsource = new CrowdSource();
+ *
+ * await crowdsource.reports.create({
+ *   externalReportId: report.id,
+ *   reportedBy: { oxyUserId: session.sub },
+ *   subject: {
+ *     externalId: post.id,
+ *     type: 'social.post',
+ *     author: { oxyUserId: post.authorId },
+ *   },
+ *   content: post.text,
+ *   allegations: ['harassment.targeted_abuse'],
+ * });
+ * ```
+ *
+ * One environment variable (`CROWDSOURCE_SERVICE_KEY`) and the object being
+ * reported. The Case Envelope, its resource ids, its digests, its relations, its
+ * principal bindings, the identity binding proof, the policy version, the
+ * retention terms and the idempotency key are all composed from that — see
+ * `envelope.ts` for what each one is derived from and why it cannot be left to
+ * the caller.
+ *
+ * Types come from `@crowdsource.you/contracts`. This package re-exports none
+ * of them: an integrator imports the contract from the contract package, so a
+ * `Decision` or a `TaxonomyCode` has exactly one definition.
+ */
+export { CrowdSource, SERVICE_KEY_ENV_VAR, BASE_URL_ENV_VAR } from './client.js';
+export { formatServiceKey, parseServiceKey } from './credential.js';
+export { COMMUNITY_REVIEW_FORBIDDEN_ALLEGATIONS, DEFAULT_BASE_URL, DEFAULT_POLICY, DEFAULT_RETENTION_DAYS, } from './defaults.js';
+export { canonicalJson, resourceDigest, sha256Digest } from './digest.js';
+/**
+ * `composeCaseEnvelope` is deliberately NOT exported.
+ *
+ * It is the one function in this package that takes an `applicationId`, and it
+ * takes it from `Reports`, which got it from the credential. Exporting it would
+ * put an `applicationId` parameter on the public surface — which is the thing
+ * Appendix F says must not exist, however carefully the doc comment above it
+ * were worded. The envelope a report produces is reachable by reading what
+ * `reports.create` sends, not by building one yourself.
+ */
+export { CrowdSourceReportInputError, defaultIdempotencyKey } from './envelope.js';
+export { CROWDSOURCE_API_ERROR_CODES, CrowdSourceApiError, CrowdSourceConfigurationError, CrowdSourceError, CrowdSourceTransportError, isCrowdSourceApiError, isCrowdSourceApiErrorCode, isCrowdSourceError, } from './errors.js';
+export { Reports } from './reports.js';
+export { Cases, Decisions } from './cases.js';
+export { CommunityNotes } from './communityNotes.js';
+export { WebhookEndpoints } from './webhookEndpoints.js';
+export { DEFAULT_MAX_ATTEMPTS, DEFAULT_TIMEOUT_MS } from './transport.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGpE,OAAO,EACL,sCAAsC,EACtC,gBAAgB,EAChB,cAAc,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG1E;;;;;;;;;GASG;AACH,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAWnF,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAUzD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/esm/outbox/client.js

@@ -0,0 +1,43 @@
+import { CrowdSource } from '../index.js';
+export function createClientProvider(input) {
+    let client = null;
+    let configurationError = null;
+    return {
+        get() {
+            if (!input.config.enabled)
+                return undefined;
+            if (client)
+                return client;
+            if (configurationError !== null)
+                return undefined;
+            const serviceKey = input.config.serviceKey;
+            if (!serviceKey) {
+                configurationError = 'no CrowdSource service key is configured';
+                input.logger.error('[CrowdSource] enabled but not configured', {
+                    reason: configurationError,
+                });
+                return undefined;
+            }
+            try {
+                client = new CrowdSource({
+                    serviceKey,
+                    ...(input.config.baseUrl === undefined ? {} : { baseUrl: input.config.baseUrl }),
+                });
+                input.logger.info('[CrowdSource] client ready', {
+                    applicationId: client.applicationId,
+                });
+                return client;
+            }
+            catch (error) {
+                // The SDK's configuration errors name which part of the key is wrong and
+                // never echo the secret, so the message is safe to log.
+                configurationError = error instanceof Error ? error.message : String(error);
+                input.logger.error('[CrowdSource] service key rejected', {
+                    reason: configurationError,
+                });
+                return undefined;
+            }
+        },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/esm/outbox/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/outbox/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgC1C,MAAM,UAAU,oBAAoB,CAAC,KAGpC;IACC,IAAI,MAAM,GAAuB,IAAI,CAAC;IACtC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAE7C,OAAO;QACL,GAAG;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC5C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,IAAI,kBAAkB,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YAElD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,kBAAkB,GAAG,0CAA0C,CAAC;gBAChE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;oBAC7D,MAAM,EAAE,kBAAkB;iBAC3B,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,WAAW,CAAC;oBACvB,UAAU;oBACV,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;iBACjF,CAAC,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;oBAC9C,aAAa,EAAE,MAAM,CAAC,aAAa;iBACpC,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,yEAAyE;gBACzE,wDAAwD;gBACxD,kBAAkB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5E,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;oBACvD,MAAM,EAAE,kBAAkB;iBAC3B,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}