@dszp/netsapiens-lib 0.1.0

package/dist/nsClient.js

@@ -0,0 +1,205 @@
+/**
+ * Portable NetSapiens API read client — the seed of the eventual "NS API for Worker/Node"
+ * library (see CLAUDE.md → North star). Ported from NetSapiens-Onboarding-Backup (`src/api/client.ts`
+ * NsClient + `src/backup/snapshot.ts` backupDomain), trimmed to the READ-ONLY routing subset the
+ * resolver needs, and kept Node-free (fetch/URL only) so it runs in a Cloudflare Worker unchanged.
+ *
+ * `fetchDomainSnapshot()` assembles the same `Snapshot` shape the resolver already consumes, so a
+ * live domain flows end-to-end: domain + token → Snapshot → resolveFlow → FlowGraph.
+ *
+ * This tool never writes to NetSapiens — only GET is exposed.
+ */
+export class NsApiError extends Error {
+    status;
+    path;
+    body;
+    constructor(message, status, path, body) {
+        super(message);
+        this.status = status;
+        this.path = path;
+        this.body = body;
+        this.name = 'NsApiError';
+    }
+}
+/**
+ * NS API v2 client — READ-ONLY BY DESIGN (the central gate for this whole tool).
+ *
+ * The ONLY method is `get()`, which hardcodes `method: 'GET'`. There is deliberately no
+ * post/put/delete/patch — the viewer must never mutate NetSapiens. Keep it that way: do not add a
+ * mutating method here. Any write capability must be a separate, explicitly-reviewed client, not a
+ * quiet addition to this one. This is the single choke point every NS call in the Worker flows through.
+ */
+export class NsClient {
+    baseUrl;
+    token;
+    fetchImpl;
+    constructor(cfg) {
+        this.baseUrl = `https://${cfg.server.replace(/\/+$/, '')}/ns-api/v2`;
+        this.token = cfg.token;
+        this.fetchImpl = cfg.fetchImpl ?? fetch;
+    }
+    async get(path, query) {
+        const url = new URL(this.baseUrl + path);
+        for (const [k, v] of Object.entries(query ?? {}))
+            url.searchParams.set(k, String(v));
+        // Call via a local, NOT `this.fetchImpl(...)`: invoking the global fetch as a method of this
+        // instance throws "Illegal invocation" in workerd (the global fetch requires a global `this`).
+        const doFetch = this.fetchImpl;
+        const res = await doFetch(url.toString(), {
+            method: 'GET',
+            headers: { Authorization: `Bearer ${this.token}`, Accept: 'application/json' },
+        });
+        const text = await res.text();
+        let parsed = text;
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                /* some endpoints return empty / plain bodies */
+            }
+        }
+        if (!res.ok) {
+            const detail = typeof parsed === 'object' && parsed !== null ? JSON.stringify(parsed) : String(parsed).slice(0, 500);
+            const hint = res.status === 401 ? ' (token expired/invalid or domain out of scope)' : res.status === 403 ? ' (token lacks permission)' : '';
+            throw new NsApiError(`GET ${path} → ${res.status}${hint}: ${detail}`, res.status, path, parsed);
+        }
+        return parsed;
+    }
+}
+/** Normalize a v2 response to an array of records (endpoints return an array or a bare object). */
+export function asArray(res) {
+    if (Array.isArray(res))
+        return res;
+    if (res && typeof res === 'object')
+        return [res];
+    return [];
+}
+/** Map with bounded concurrency — keeps per-user/queue/AA fan-out from hammering the API. */
+async function mapLimit(items, limit, fn) {
+    let i = 0;
+    const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (i < items.length) {
+            const idx = i++;
+            await fn(items[idx], idx);
+        }
+    });
+    await Promise.all(workers);
+}
+const enc = encodeURIComponent;
+/** List domains the token can read (for the internal viewer's domain browser). `locked` is set only
+ *  for domains flagged `is-domain-locked: yes` (config-locked in NetSapiens). */
+export async function listDomains(client) {
+    const recs = asArray(await client.get('/domains'));
+    return recs
+        .map((r) => ({
+        domain: String(r.domain ?? ''),
+        ...(r.description ? { description: String(r.description) } : {}),
+        ...(r['is-domain-locked'] === 'yes' ? { locked: true } : {}),
+    }))
+        .filter((d) => d.domain);
+}
+/**
+ * Read a live domain into the `Snapshot` shape the resolver consumes. Routing subset only:
+ * domain, timeframes, users, callqueues, phonenumbers, autoattendants, per-user answerrules,
+ * per-queue agents, and (by default) per-AA menu detail.
+ *
+ * A per-item read that fails is treated as "absent" (empty) so one missing child never aborts the
+ * whole flow — the resolver tolerates gaps. A failing top-level read (e.g. 401) DOES throw.
+ */
+export async function fetchDomainSnapshot(client, domain, opts = {}) {
+    const conc = opts.concurrency ?? 5;
+    const base = `/domains/${enc(domain)}`;
+    const soft = async (p) => {
+        try {
+            return asArray(await client.get(p));
+        }
+        catch (err) {
+            if (err instanceof NsApiError && err.status === 404)
+                return [];
+            throw err;
+        }
+    };
+    const domainRec = asArray(await client.get(base))[0] ?? { domain };
+    const [timeframes, users, callqueues, phonenumbers, autoattendants] = await Promise.all([
+        soft(`${base}/timeframes`),
+        soft(`${base}/users`),
+        soft(`${base}/callqueues`),
+        soft(`${base}/phonenumbers`),
+        soft(`${base}/autoattendants`),
+    ]);
+    // Shallow mode stops here — enough for listEntities() (the picker).
+    if (opts.shallow) {
+        let answerrulesByUser;
+        if (opts.includeDidDestRules) {
+            const dests = [...new Set(phonenumbers.map((p) => String(p['dial-rule-translation-destination-user'] ?? '')).filter(Boolean))];
+            answerrulesByUser = {};
+            await mapLimit(dests, conc, async (u) => {
+                const rules = await soft(`${base}/users/${enc(u)}/answerrules`).catch(() => []);
+                if (rules.length)
+                    answerrulesByUser[u] = rules;
+            });
+        }
+        return { meta: { domain }, domain: domainRec, timeframes, users, callqueues, phonenumbers, autoattendants, ...(answerrulesByUser ? { answerrulesByUser } : {}) };
+    }
+    const answerrulesByUser = {};
+    await mapLimit(users, conc, async (u) => {
+        const ext = String(u.user ?? '');
+        if (!ext)
+            return;
+        const rules = await soft(`${base}/users/${enc(ext)}/answerrules`).catch(() => []);
+        if (rules.length)
+            answerrulesByUser[ext] = rules;
+    });
+    const agentsByQueue = {};
+    await mapLimit(callqueues, conc, async (q) => {
+        const ext = String(q.callqueue ?? '');
+        if (!ext)
+            return;
+        const ags = await soft(`${base}/callqueues/${enc(ext)}/agents`).catch(() => []);
+        if (ags.length)
+            agentsByQueue[ext] = ags;
+    });
+    // One list row per (user, prompt); an AA may have several (multi-timeframe). Collect ALL detail
+    // records per user (array) so the resolver can flag multi-prompt deviations, not just last-wins.
+    // Also fetch each AA's OWN dialplan dialrules ({domain}_{ext}) — the authoritative menu/default
+    // routing the /autoattendants detail omits (no-key/star/option). See CLAUDE.md → API notes.
+    let attendantDetailsByUser;
+    let attendantDialrulesByExt;
+    if (opts.includeAttendantMenus ?? true) {
+        const rows = autoattendants.map((aa) => ({ ext: String(aa.user ?? ''), prompt: String(aa['starting-prompt'] ?? '') })).filter((r) => r.ext && r.prompt);
+        attendantDetailsByUser = {};
+        for (const r of rows)
+            attendantDetailsByUser[r.ext] ??= []; // pre-init (avoid concurrent-init race)
+        await mapLimit(rows, conc, async (r) => {
+            const detail = (await soft(`${base}/users/${enc(r.ext)}/autoattendants/${enc(r.prompt)}`).catch(() => []))[0];
+            if (detail)
+                attendantDetailsByUser[r.ext].push(detail);
+        });
+        attendantDialrulesByExt = {};
+        await mapLimit([...new Set(rows.map((r) => r.ext))], conc, async (ext) => {
+            const dr = await soft(`${base}/dialplans/${enc(`${domain}_${ext}`)}/dialrules`).catch(() => []);
+            if (dr.length)
+                attendantDialrulesByExt[ext] = dr;
+        });
+    }
+    let dialrulesByPlan;
+    if (opts.includeDialrules) {
+        dialrulesByPlan = { [domain]: await soft(`${base}/dialplans/${enc(domain)}/dialrules`).catch(() => []) };
+    }
+    return {
+        meta: { domain },
+        domain: domainRec,
+        timeframes,
+        users,
+        callqueues,
+        phonenumbers,
+        autoattendants,
+        answerrulesByUser,
+        agentsByQueue,
+        ...(attendantDetailsByUser && Object.keys(attendantDetailsByUser).length ? { attendantDetailsByUser } : {}),
+        ...(attendantDialrulesByExt && Object.keys(attendantDialrulesByExt).length ? { attendantDialrulesByExt } : {}),
+        ...(dialrulesByPlan ? { dialrulesByPlan } : {}),
+    };
+}
+//# sourceMappingURL=nsClient.js.map

package/dist/policy.d.ts

@@ -0,0 +1,49 @@
+/**
+ * A small, declarative allow-list policy engine over `Principal` — the extensible knob for gating
+ * features by who's asking. Designed so new gates are one object, not new code.
+ *
+ * A `Policy` is a list of `PolicyRule`s; a principal is granted the feature if **any** rule matches
+ * (default DENY — an empty policy or an unknown feature denies). Within a rule, every specified
+ * condition must hold (AND); an omitted condition is a wildcard. All string comparisons are
+ * case-insensitive.
+ *
+ * Conditions, and the shapes they're meant to express:
+ *  - by scope, per-domain:            { scopes: ['Office Manager'] }            // + domain-locked elsewhere
+ *  - one reseller vs all resellers:   { scopes:['Reseller'], users:['admin@0000.12345.service'] }  vs  { scopes:['Reseller'] }
+ *  - all users in some domains:       { domains: ['acme','acme42'] }
+ *  - …optionally with scopes:         { domains:['acme'], scopes:['Office Manager','Basic User'] }
+ *  - specific users:                  { users: ['100@acme','101@acme'] }
+ *  - only when a given operator is masked in: { operators: ['admin@0000.12345.service'] }
+ *  - only while (not) masking:        { masking: true }  /  { masking: false }
+ *
+ * Matching considers the EFFECTIVE principal (scope/domain/id = the masked user when masking);
+ * `operators` matches the mask_chain operator, so you can gate on the real reseller behind a mask.
+ *
+ * Portable (no Node). Pure functions.
+ */
+import type { Principal } from './principal.js';
+export interface PolicyRule {
+    /** Effective scope must be one of these (case-insensitive). */
+    scopes?: string[];
+    /** Effective domain must be one of these. Use '*' to match any domain. */
+    domains?: string[];
+    /** Effective identity (`user@domain`) must be one of these. */
+    users?: string[];
+    /** Requires masking, AND the operator's `user@domain` (mask_chain) is one of these. */
+    operators?: string[];
+    /** Require the masking state to equal this (true = masked, false = not masked). */
+    masking?: boolean;
+    /** Optional human note (documentation / audit; ignored by matching). */
+    description?: string;
+}
+/** ANY rule matching grants the feature; `[]` denies. */
+export type Policy = PolicyRule[];
+/** Named features → their policy. Unknown feature ⇒ deny (see `can`). */
+export type FeaturePolicies = Record<string, Policy>;
+/** Does the principal satisfy every condition in this single rule? */
+export declare function ruleMatches(p: Principal, rule: PolicyRule): boolean;
+/** Allowed if any rule matches. Empty/absent policy ⇒ deny (fail closed). */
+export declare function isAllowed(p: Principal, policy: Policy | undefined): boolean;
+/** Check a named feature against a registry. Unknown feature ⇒ deny (fail closed). */
+export declare function can(p: Principal, feature: string, policies: FeaturePolicies): boolean;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.js

@@ -0,0 +1,39 @@
+const lc = (s) => s.trim().toLowerCase();
+const inList = (value, list) => {
+    const v = lc(value);
+    return list.some((x) => lc(x) === v);
+};
+/** Does the principal satisfy every condition in this single rule? */
+export function ruleMatches(p, rule) {
+    // A rule with NO matchable condition (e.g. `{}` or only `description`) is NOT allow-all — that would
+    // silently grant everyone. Require at least one real condition; a conditionless rule never matches.
+    const hasCondition = rule.scopes !== undefined ||
+        rule.domains !== undefined ||
+        rule.users !== undefined ||
+        rule.operators !== undefined ||
+        rule.masking !== undefined;
+    if (!hasCondition)
+        return false;
+    if (rule.scopes && !inList(p.scope, rule.scopes))
+        return false;
+    if (rule.domains && !(rule.domains.includes('*') || inList(p.domain, rule.domains)))
+        return false;
+    if (rule.users && !inList(p.id, rule.users))
+        return false;
+    if (rule.operators) {
+        if (!p.operator || !inList(p.operator.id, rule.operators))
+            return false;
+    }
+    if (rule.masking !== undefined && p.masking !== rule.masking)
+        return false;
+    return true;
+}
+/** Allowed if any rule matches. Empty/absent policy ⇒ deny (fail closed). */
+export function isAllowed(p, policy) {
+    return !!policy && policy.some((rule) => ruleMatches(p, rule));
+}
+/** Check a named feature against a registry. Unknown feature ⇒ deny (fail closed). */
+export function can(p, feature, policies) {
+    return isAllowed(p, policies[feature]);
+}
+//# sourceMappingURL=policy.js.map

package/dist/principal.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Normalize an ns_t JWT's claims into a `Principal` — the identity + role the portal authorizes
+ * against. Handles NetSapiens **masking** (impersonation): when a reseller/admin is masked-in as a
+ * domain user, the token's `domain`/`user`/`scope`/`sub` describe the MASKED user, while `mask_chain`
+ * names the real operator. `Principal` keeps both, plus a `masking` flag.
+ *
+ * Two things the caller must keep straight (see policy.ts):
+ *  - **Auth scope** (what data is reachable) follows the EFFECTIVE identity: a masked token is
+ *    NS-scoped to the masked user's domain; only an un-masked reseller/super-user reads cross-domain.
+ *  - **Role gating** may consider the OPERATOR (mask_chain) too — e.g. "allow my reseller while
+ *    developing" — since the effective scope reads "Office Manager" while masked.
+ *
+ * Portable (no Node). Pure functions.
+ */
+import type { JwtContext } from './jwt.js';
+/** Known NetSapiens user scopes (the string is open — unknown scopes pass through as-is). */
+export type Scope = 'Super User' | 'Reseller' | 'Office Manager' | 'Site Manager' | 'Call Center Supervisor' | 'Call Center Agent' | 'Basic User' | (string & {});
+/** The real operator behind a mask (parsed from `mask_chain`). */
+export interface Operator {
+    /** `user@domain` (verbatim mask_chain, lowercased id below). */
+    raw: string;
+    user: string;
+    domain: string;
+    /** Lowercased `user@domain` for comparisons. */
+    id: string;
+}
+export interface Principal {
+    /** Effective domain — the masked user's when masking; the token is NS-scoped to it. */
+    domain: string;
+    /** Effective user / extension. */
+    user: string;
+    /** Effective identity `user@domain`, lowercased (from sub, or user+domain). */
+    id: string;
+    /** Effective user_scope (the masked user's scope when masking). */
+    scope: string;
+    email?: string;
+    displayName?: string;
+    territory?: string;
+    /** True when a mask is in effect (mask_chain present). */
+    masking: boolean;
+    /** The real operator behind the mask, or null when not masking. */
+    operator: Operator | null;
+}
+/** Reseller / super-user — the only scopes that legitimately read cross-domain. */
+export declare function isResellerScope(scope: string | undefined): boolean;
+/** Domain-admin-or-higher (office manager / site manager / supervisor / reseller / super user). */
+export declare function isAdminScope(scope: string | undefined): boolean;
+/** Parse a `mask_chain` value ("user@domain") into an Operator, or null if empty/malformed. */
+export declare function parseOperator(maskChain: string | undefined): Operator | null;
+/** Build a Principal from decoded ns_t context (a JwtContext / JwtVerdict — both carry the claims). */
+export declare function toPrincipal(ctx: JwtContext): Principal;
+//# sourceMappingURL=principal.d.ts.map

package/dist/principal.js

@@ -0,0 +1,45 @@
+const lc = (s) => (s ?? '').trim().toLowerCase();
+/** Scopes that can read/act across the whole reseller/fleet (cross-domain). */
+const RESELLER_SCOPES = new Set(['reseller', 'super user', 'superuser', 'super-user']);
+/** Scopes with domain-admin authority (a superset that includes reseller-level). */
+const ADMIN_SCOPES = new Set([...RESELLER_SCOPES, 'office manager', 'site manager', 'call center supervisor']);
+/** Reseller / super-user — the only scopes that legitimately read cross-domain. */
+export function isResellerScope(scope) {
+    return RESELLER_SCOPES.has(lc(scope));
+}
+/** Domain-admin-or-higher (office manager / site manager / supervisor / reseller / super user). */
+export function isAdminScope(scope) {
+    return ADMIN_SCOPES.has(lc(scope));
+}
+/** Parse a `mask_chain` value ("user@domain") into an Operator, or null if empty/malformed. */
+export function parseOperator(maskChain) {
+    const raw = (maskChain ?? '').trim();
+    if (!raw || !raw.includes('@'))
+        return null;
+    const at = raw.lastIndexOf('@');
+    const user = raw.slice(0, at);
+    const domain = raw.slice(at + 1);
+    if (!user || !domain)
+        return null;
+    return { raw, user, domain, id: `${user}@${domain}`.toLowerCase() };
+}
+/** Build a Principal from decoded ns_t context (a JwtContext / JwtVerdict — both carry the claims). */
+export function toPrincipal(ctx) {
+    const domain = (ctx.domain ?? '').trim();
+    const user = (ctx.user ?? '').trim();
+    const sub = (ctx.sub ?? '').trim();
+    const id = (sub.includes('@') ? sub : user && domain ? `${user}@${domain}` : sub || user).toLowerCase();
+    const operator = parseOperator(ctx.maskChain);
+    return {
+        domain,
+        user,
+        id,
+        scope: (ctx.scope ?? '').trim(),
+        ...(ctx.email ? { email: ctx.email } : {}),
+        ...(ctx.displayName ? { displayName: ctx.displayName } : {}),
+        ...(ctx.territory ? { territory: ctx.territory } : {}),
+        masking: operator != null,
+        operator,
+    };
+}
+//# sourceMappingURL=principal.js.map

package/dist/raster.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Browser PNG rasterizer for call-flow diagrams — Node-free, Web-APIs-only. The library never holds
+ * an SVG (Mermaid renders it client-side), so this is a BROWSER helper: `resolveSvgSize` is a pure,
+ * testable size reader, and `rasterizerScript()` returns injectable JS defining `svgToPngBlob`.
+ * A host page (dia today; the lib's gallery HTML later) injects the script and calls the global.
+ */
+/** Intrinsic pixel size of an SVG string: explicit px width/height, else viewBox, else a default. */
+export declare function resolveSvgSize(svgString: string): {
+    width: number;
+    height: number;
+};
+/**
+ * Injectable browser JS (a function declaration) defining `svgToPngBlob(svgEl, { scale, background })`.
+ * A host injects this string into an inline <script> (no bundler needed) and calls the function.
+ * Rasterizes a LIVE, already-rendered <svg>: clone → force explicit px size (from the same algorithm
+ * as resolveSvgSize) → data-URL into an Image → draw onto a scaled canvas (optional opaque background)
+ * → PNG Blob. Scale is clamped so the larger dimension stays ≤ 8192px (browser canvas caps). CSP-safe
+ * (no eval/new Function; uses a data: image URL — ensure any host CSP allows `img-src data:`).
+ */
+export declare function rasterizerScript(): string;
+//# sourceMappingURL=raster.d.ts.map

package/dist/raster.js

@@ -0,0 +1,81 @@
+/**
+ * Browser PNG rasterizer for call-flow diagrams — Node-free, Web-APIs-only. The library never holds
+ * an SVG (Mermaid renders it client-side), so this is a BROWSER helper: `resolveSvgSize` is a pure,
+ * testable size reader, and `rasterizerScript()` returns injectable JS defining `svgToPngBlob`.
+ * A host page (dia today; the lib's gallery HTML later) injects the script and calls the global.
+ */
+/** Intrinsic pixel size of an SVG string: explicit px width/height, else viewBox, else a default. */
+export function resolveSvgSize(svgString) {
+    const DEFAULT = { width: 800, height: 600 };
+    const attr = (name) => {
+        const m = new RegExp(`\\b${name}\\s*=\\s*["']([^"']*)["']`).exec(svgString);
+        return m ? m[1] : undefined;
+    };
+    const px = (s) => {
+        if (!s || s.includes('%'))
+            return null; // reject "100%" etc.
+        const n = parseFloat(s); // "120px" → 120
+        return Number.isFinite(n) && n > 0 ? n : null;
+    };
+    const w = px(attr('width'));
+    const h = px(attr('height'));
+    if (w && h)
+        return { width: w, height: h };
+    const vb = attr('viewBox');
+    if (vb) {
+        const p = vb.trim().split(/[\s,]+/).map(Number);
+        if (p.length === 4 && p[2] > 0 && p[3] > 0)
+            return { width: w ?? p[2], height: h ?? p[3] };
+    }
+    return { width: w ?? DEFAULT.width, height: h ?? DEFAULT.height };
+}
+/**
+ * Injectable browser JS (a function declaration) defining `svgToPngBlob(svgEl, { scale, background })`.
+ * A host injects this string into an inline <script> (no bundler needed) and calls the function.
+ * Rasterizes a LIVE, already-rendered <svg>: clone → force explicit px size (from the same algorithm
+ * as resolveSvgSize) → data-URL into an Image → draw onto a scaled canvas (optional opaque background)
+ * → PNG Blob. Scale is clamped so the larger dimension stays ≤ 8192px (browser canvas caps). CSP-safe
+ * (no eval/new Function; uses a data: image URL — ensure any host CSP allows `img-src data:`).
+ */
+export function rasterizerScript() {
+    return `
+// size reader mirroring resolveSvgSize (viewBox is authoritative for Mermaid). Top-level so it is
+// unit-testable outside a browser (see raster.selftest.ts) — the DOM path below is browser-only.
+function __svgSize(str) {
+  function attr(name){ var m = new RegExp('\\\\b'+name+'\\\\s*=\\\\s*["\\']([^"\\']*)["\\']').exec(str); return m ? m[1] : undefined; }
+  function px(s){ if(!s || s.indexOf('%')>=0) return null; var n=parseFloat(s); return (isFinite(n)&&n>0)?n:null; }
+  var w=px(attr('width')), h=px(attr('height'));
+  if(w&&h) return {width:w,height:h};
+  var vb=attr('viewBox');
+  if(vb){ var p=vb.trim().split(new RegExp('[\\\\s,]+')).map(Number); if(p.length===4&&p[2]>0&&p[3]>0) return {width:(w||p[2]),height:(h||p[3])}; }
+  return {width:(w||800),height:(h||600)};
+}
+async function svgToPngBlob(svg, opts) {
+  opts = opts || {};
+  var scale = opts.scale || 2;
+  var background = (opts.background == null) ? null : opts.background;
+  var clone = svg.cloneNode(true);
+  if(!clone.getAttribute('xmlns')) clone.setAttribute('xmlns','http://www.w3.org/2000/svg');
+  var size = __svgSize(new XMLSerializer().serializeToString(clone));
+  var W = size.width, H = size.height;
+  clone.setAttribute('width', W);
+  clone.setAttribute('height', H);
+  var str = new XMLSerializer().serializeToString(clone);
+  // --- clamp effective scale to the canvas cap ---
+  var eff = scale, MAX = 8192, big = Math.max(W, H);
+  if (big * eff > MAX) eff = MAX / big;
+  // --- SVG → Image → canvas → PNG ---
+  var url = 'data:image/svg+xml;charset=utf-8,' + encodeURIComponent(str);
+  var img = new Image();
+  await new Promise(function(res, rej){ img.onload = res; img.onerror = function(){ rej(new Error('SVG failed to load for rasterization')); }; img.src = url; });
+  var canvas = document.createElement('canvas');
+  canvas.width = Math.max(1, Math.round(W * eff));
+  canvas.height = Math.max(1, Math.round(H * eff));
+  var ctx = canvas.getContext('2d');
+  if (background) { ctx.fillStyle = background; ctx.fillRect(0, 0, canvas.width, canvas.height); }
+  ctx.drawImage(img, 0, 0, canvas.width, canvas.height);
+  return await new Promise(function(res, rej){ canvas.toBlob(function(b){ b ? res(b) : rej(new Error('canvas.toBlob returned null')); }, 'image/png'); });
+}
+`.trim();
+}
+//# sourceMappingURL=raster.js.map

package/dist/resolver.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Flow resolver — deterministic walker over a NetSapiens domain snapshot that emits a
+ * normalized FlowGraph. Rule-set driven; no Node-only deps (runtime-portable).
+ *
+ * NetSapiens routing model, as decoded from real snapshots:
+ *   - An inbound DID (phonenumber) has a `dial-rule-application` (to-user[-residential],
+ *     to-callqueue, to-voicemail, to-connection) + a destination extension/host.
+ *   - Every "extension" is a user record. Some users are virtual: a queue (in callqueues),
+ *     an auto attendant (in autoattendants), a time-of-day router (TOD), or a shared mailbox.
+ *   - A user's routing is its answer rules, one per time-frame, ordered by ordinal-priority:
+ *       forward-always (unconditional) | simultaneous-ring/<OwnDevices> then
+ *       forward-no-answer (RNA timeout) | forward-on-busy | forward-when-unregistered.
+ *   - Answer-rule / dial-rule params speak an alias language:
+ *       <did>_callqueue_<ext>, queue_<ext>        -> queue
+ *       <did>_attendant_<ext>                     -> auto attendant
+ *       user_<ext>                                -> user
+ *       vmail_<ext> / <did>_voicemail_<ext>       -> voicemail box
+ *       <did>_pstn_<num> / bare 10-11 digits      -> external / off-net
+ *       Prompt_<id>                               -> played greeting
+ *       <OwnDevices>                              -> ring the user's registered devices
+ *   - A queue dispatches to its agents (dispatch-type) then overflows via its own answer
+ *     rule (forward-no-answer -> if-unanswered, forward-on-busy -> if-unavailable).
+ *   - Auto-attendant keypress menus are NOT in the backup (inventory-only) — flagged as a gap.
+ */
+import type { FlowGraph, Snapshot } from './model.js';
+export interface EntityRef {
+    kind: 'did' | 'user' | 'queue' | 'attendant';
+    ref: string;
+}
+export declare function resolveFlow(snap: Snapshot, entity: EntityRef): FlowGraph;
+/** DID action categories for the entity picker, in display order. */
+export declare const DID_ACTIONS: Record<string, {
+    order: number;
+    label: string;
+}>;
+export declare function listEntities(snap: Snapshot): {
+    dids: {
+        ref: string;
+        label: string;
+        desc: string;
+        action: string;
+        actionLabel: string;
+        order: number;
+    }[];
+    users: {
+        ref: string;
+        label: string;
+    }[];
+    queues: {
+        ref: string;
+        label: string;
+    }[];
+    attendants: {
+        ref: string;
+        label: string;
+    }[];
+};
+//# sourceMappingURL=resolver.d.ts.map