@formancy/server-core 0.2.0 → 0.4.0

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { CHALLENGE_TTL_SECONDS, Challenge, DEFAULT_MAX_NUMBER, Solution, VerifyOutcome, decodeSolution, encodeSolution, hashOf, mintChallenge, solveChallenge, verifySolution } from "@formancy/challenge";
 import { Change, FormSchema } from "@formancy/spec";
+import { CapabilitySource, Check } from "@formancy/core";
 import { SchemaError } from "@formancy/spec/validate";
-import { CapabilitySource } from "@formancy/core";
 //#region src/options-membership.d.ts
 /**
  * Checking that a sourced answer is one the deployment's own source offers.
@@ -606,53 +606,172 @@ interface WebhookHealth {
 }
 export declare function healthOf(webhook: WebhookRecord, now: Date): WebhookHealth;
 //#endregion
-//#region src/redos.d.ts
+//#region src/uploads.d.ts
 /**
- * Refuse a form whose `pattern` values can be made to backtrack.
+ * The file lifecycle: offered, stored, claimed, collected.
  *
- * A form author supplies these, and the server runs them against whatever a
- * submitter typed. That makes a regular expression an author-side denial of
- * service vector: one bad pattern, published once, and every submission after
- * it can be turned into unbounded CPU by anyone who can reach the form.
+ * **Bytes are not the submission's problem.** A submission stores what each
+ * file is and where it went, never the bytes themselves, so a submission read
+ * back years later is small, self-describing, and still says what was attached
+ * even if the object store has since been emptied.
  *
- * Checked at PUBLISH time rather than at match time, because there is no way
- * to time out a JavaScript regular expression once it has started. The only
- * moment the cost can be refused is before the pattern is stored.
+ * **The claim happens inside the submission's transaction.** A submission
+ * exists if and only if the files it names are claimed against it. Anything
+ * looser gives one of the two failures nobody can debug: a rolled-back
+ * submission leaving files claimed against nothing, or an accepted submission
+ * referencing files the collector is about to delete.
  *
- * The check is static — `recheck` analyses the expression rather than running
- * it — so it costs nothing per submission, and it found a polynomial case in
- * formancy's own built-in email format before it was ever pointed at a user's.
+ * **Nothing here touches a disk.** This package has no filesystem and no
+ * object store; it decides what is rubbish and the host deletes it. That is
+ * the same split every other port here makes, and it is why the whole
+ * lifecycle is testable without either.
  */
-interface UnsafePattern {
-  /** Data path of the field carrying it, e.g. `contacts[].code`. */
-  path: string;
-  pattern: string;
-  /** `exponential` or `polynomial`, with the degree where there is one. */
-  complexity: string;
+interface OfferDeps {
+  storage: Storage;
+  now: () => Date;
+  newId: () => string;
+}
+interface OfferInput {
+  schema: FormSchema;
+  /** The form, for the access check — the same one a submission passes. */
+  form: FormRecord;
+  actor: 'anonymous' | 'authenticated';
+  origin: string | undefined;
+  /** The field the file is for, as a data path: `evidence`, `people[].passport`. */
+  field: string;
+  name: string;
+  size: number;
+  contentType: string;
 }
+type OfferOutcome = {
+  ok: true;
+  file: FileRecord;
+} | {
+  ok: false;
+  reason: 'not_allowed' | 'unknown_field' | 'not_a_file_field' | 'too_large' | 'not_accepted';
+};
 /**
- * The patterns in this schema that an attacker could exploit, or an empty array
- * when there are none.
+ * Agree where a file will go, and refuse it before a byte is sent.
  *
- * A pattern `recheck` cannot decide about is ACCEPTED. Refusing on `unknown`
- * would make publishing depend on an analysis timeout, which is a worse failure
- * than the one being prevented — an author whose legitimate form stops
- * publishing intermittently has no way to act on that.
+ * Checking here rather than after the upload is the difference between
+ * refusing a 2 GB file and receiving one first. The browser's own `accept` and
+ * size limits are a convenience for the person filling the form in; these are
+ * the rule, because somebody posting to the endpoint directly has neither.
  */
-export declare function unsafePatterns(schema: FormSchema): Promise<UnsafePattern[]>;
+export declare function offerUpload(deps: OfferDeps, input: OfferInput): Promise<OfferOutcome>;
+/** What a deployment's scanner says about an upload's bytes. */
+type ScanVerdict = {
+  clean: true;
+} | {
+  clean: false;
+  finding: string;
+};
+/**
+ * A deployment's virus scanner, asked about an upload's bytes before they are kept.
+ *
+ * A port because the deployment supplies it and there are two: the ClamAV adapter in
+ * `@formancy/server`, and the doubles that test this decision. **Throwing means it could
+ * not be asked** — a connection refused, a timeout — and never that the file is clean.
+ */
+interface Scanner {
+  scan(file: {
+    name: string;
+    contentType: string;
+    size: number;
+  }, bytes: Uint8Array): Promise<ScanVerdict>;
+}
+type ScreenOutcome = {
+  ok: true;
+} | {
+  ok: false;
+  reason: 'refused';
+  finding: string;
+} |
+/** `cause` is for the operator's log, never for the client: it can name an address. */
+{
+  ok: false;
+  reason: 'scanner_unavailable';
+  cause: string;
+};
+/**
+ * Whether an upload's bytes may be kept.
+ *
+ * **Fail closed.** A scanner that cannot be asked refuses the file, the same as one that
+ * found something: a deployment that configured a scanner did so to keep unscanned files
+ * out, and its being down is not a reason to let one in. The person is told to try again,
+ * and the field offers exactly that. Without a scanner every upload is kept, as it was
+ * before there was one — a supported state, said in the documentation rather than here
+ * ([0131](../../../docs/decisions/0131-an-upload-is-scanned-before-it-is-kept.md)).
+ */
+export declare function screenUpload(scanner: Scanner | undefined, file: {
+  name: string;
+  contentType: string;
+  size: number;
+}, bytes: Uint8Array): Promise<ScreenOutcome>;
+type ClaimOutcome = {
+  ok: true;
+  ids: readonly string[];
+} | {
+  ok: false;
+  unknown: readonly string[];
+};
+/**
+ * Which files a submission may claim, checked but not yet claimed.
+ *
+ * The claiming itself is `insertSubmission`'s job, in the same call that
+ * stores the submission, so one COMMIT decides both — the same reasoning
+ * that put the webhook queue there. A submission exists if and only if the
+ * files it names belong to it. Claiming separately gives the two failures
+ * nobody can debug: a rolled-back submission leaving files claimed against
+ * nothing, or an accepted submission referencing bytes the collector is about
+ * to delete.
+ *
+ * Refuses rather than skips. A submission naming a file that does not exist,
+ * belongs to another form, or is already claimed is not a submission to fix up
+ * quietly: the first is a bug or somebody guessing ids; the second is how an
+ * id from a form you may submit to would let you attach a file from one you
+ * may not; the third would make deleting a submission either leak bytes or
+ * break a different one.
+ */
+export declare function filesToClaim(storage: Storage, input: {
+  schema: FormSchema;
+  formId: string;
+  data: unknown;
+}): Promise<ClaimOutcome>;
+/**
+ * Files nobody claimed, old enough that nobody is going to.
+ *
+ * Returns the rows rather than deleting anything: the host removes the bytes
+ * and then the rows, in that order, because a row without bytes is a broken
+ * reference and bytes without a row are invisible rubbish. Of the two, the
+ * second is the one you never find out about.
+ */
+export declare function collectAbandonedFiles(storage: Storage, now: Date, afterHours: number): Promise<FileRecord[]>;
+/** Re-exported so a host can see which paths a schema's file fields live at. */
+export declare function fileFieldPaths(schema: FormSchema): string[];
 //#endregion
-//#region src/use-cases.d.ts
+//#region src/deps.d.ts
 /**
- * The backend's use-cases, framework-free.
+ * What a deployment supplies to the use-cases: storage, identity, time, and the
+ * answers a document may only name — checks, lists and a scanner.
  *
- * Identity and time are injected like every other capability: the server pins
- * one clock per request, so a submission can be replayed later and produce the
- * same computed values byte for byte. Nothing here reads Date.now or crypto.
+ * Its own file because it is the one contract every use-case family shares, and
+ * `use-cases.ts` is where the families used to live; it moved when that file's size
+ * budget refused the scanner.
  */
 interface ServerDeps {
   storage: Storage;
   newId(): string;
   nowIso(): string;
+  /**
+   * Validators this deployment answers, by the name a `check` rule gives.
+   *
+   * The same shape `optionsSources` takes, and the same rule: the document names
+   * a check, the deployment says how to answer it, and nothing in the engine
+   * fetches anything. A check a document names and a deployment has not supplied
+   * fails the field closed.
+   */
+  checks?: Record<string, Check>;
   /** The clock/randomness the ENGINE sees during replay. */
   capabilities: CapabilitySource;
   /**
@@ -680,46 +799,21 @@ interface ServerDeps {
    * legitimate configuration, and the reason the guarantee is written down.
    */
   optionsSources?: ServerOptionsSources;
+  /**
+   * The deployment's virus scanner, asked about every upload's bytes before they are
+   * kept. Absent means none is asked — a supported state, and the documented one.
+   */
+  scanner?: Scanner;
 }
-type PublishOutcome = {
-  ok: true;
-  formId: string;
-  versionId: string;
-  version: number;
-  schemaHash: string;
-} | {
-  ok: false;
-  kind: 'invalid_schema';
-  errors?: SchemaError[];
-} | {
-  ok: false;
-  kind: 'invalid_logic';
-  message: string;
-} | {
-  ok: false;
-  kind: 'unsafe_pattern';
-  patterns: UnsafePattern[];
-} |
-/** The document names a list this deployment has never heard of. */
-{
-  ok: false;
-  kind: 'unknown_options_source';
-  sources: string[];
-};
+//#endregion
+//#region src/use-cases.d.ts
 /**
- * Publish a schema as a form's next version.
+ * The backend's use-cases, framework-free.
  *
- * This is the save gate: structural validation, then the ENGINE's own compile
- * — type-checked expressions, kind policies and the cycle graph — so a form
- * that can loop or read a ghost field is refused here and never persisted.
- * Republishing the identical document is idempotent, because "deploy again"
- * must never manufacture a version.
+ * Identity and time are injected like every other capability: the server pins
+ * one clock per request, so a submission can be replayed later and produce the
+ * same computed values byte for byte. Nothing here reads Date.now or crypto.
  */
-export declare function publishForm(deps: ServerDeps, input: {
-  path: string;
-  schema: unknown;
-  actor?: Actor;
-}): Promise<PublishOutcome>;
 interface ResolvedForm {
   formId: string;
   versionId: string;
@@ -889,6 +983,41 @@ interface ListedVersion {
  *  view rendering fifty full schemas would be its own denial of service. */
 export declare function listVersions(deps: ServerDeps, path: string): Promise<ListedVersion[] | undefined>;
 //#endregion
+//#region src/redos.d.ts
+/**
+ * Refuse a form whose `pattern` values can be made to backtrack.
+ *
+ * A form author supplies these, and the server runs them against whatever a
+ * submitter typed. That makes a regular expression an author-side denial of
+ * service vector: one bad pattern, published once, and every submission after
+ * it can be turned into unbounded CPU by anyone who can reach the form.
+ *
+ * Checked at PUBLISH time rather than at match time, because there is no way
+ * to time out a JavaScript regular expression once it has started. The only
+ * moment the cost can be refused is before the pattern is stored.
+ *
+ * The check is static — `recheck` analyses the expression rather than running
+ * it — so it costs nothing per submission, and it found a polynomial case in
+ * formancy's own built-in email format before it was ever pointed at a user's.
+ */
+interface UnsafePattern {
+  /** Data path of the field carrying it, e.g. `contacts[].code`. */
+  path: string;
+  pattern: string;
+  /** `exponential` or `polynomial`, with the degree where there is one. */
+  complexity: string;
+}
+/**
+ * The patterns in this schema that an attacker could exploit, or an empty array
+ * when there are none.
+ *
+ * A pattern `recheck` cannot decide about is ACCEPTED. Refusing on `unknown`
+ * would make publishing depend on an analysis timeout, which is a worse failure
+ * than the one being prevented — an author whose legitimate form stops
+ * publishing intermittently has no way to act on that.
+ */
+export declare function unsafePatterns(schema: FormSchema): Promise<UnsafePattern[]>;
+//#endregion
 //#region src/testing/memory-storage.d.ts
 /**
  * The in-memory Storage — the second implementation that keeps the port
@@ -998,100 +1127,101 @@ export declare function retryDelayMs(attempt: number, random: () => number): num
 /** Eight attempts reach roughly 24 hours with this schedule. */
 export declare const MAX_ATTEMPTS = 8;
 //#endregion
-//#region src/uploads.d.ts
+//#region src/publishing.d.ts
 /**
- * The file lifecycle: offered, stored, claimed, collected.
+ * Publishing a form: the save gate, and who may overwrite whom.
  *
- * **Bytes are not the submission's problem.** A submission stores what each
- * file is and where it went, never the bytes themselves, so a submission read
- * back years later is small, self-describing, and still says what was attached
- * even if the object store has since been emptied.
- *
- * **The claim happens inside the submission's transaction.** A submission
- * exists if and only if the files it names are claimed against it. Anything
- * looser gives one of the two failures nobody can debug: a rolled-back
- * submission leaving files claimed against nothing, or an accepted submission
- * referencing files the collector is about to delete.
- *
- * **Nothing here touches a disk.** This package has no filesystem and no
- * object store; it decides what is rubbish and the host deletes it. That is
- * the same split every other port here makes, and it is why the whole
- * lifecycle is testable without either.
+ * Its own file because `use-cases.ts` had become the place every family went,
+ * and the size budget refused the next thing added to it — the entry already
+ * said the seam was one use-case family per file, and this is the family.
  */
-interface OfferDeps {
-  storage: Storage;
-  now: () => Date;
-  newId: () => string;
-}
-interface OfferInput {
-  schema: FormSchema;
-  /** The form, for the access check — the same one a submission passes. */
-  form: FormRecord;
-  actor: 'anonymous' | 'authenticated';
-  origin: string | undefined;
-  /** The field the file is for, as a data path: `evidence`, `people[].passport`. */
-  field: string;
-  name: string;
-  size: number;
-  contentType: string;
-}
-type OfferOutcome = {
+type PublishOutcome = {
   ok: true;
-  file: FileRecord;
+  formId: string;
+  versionId: string;
+  version: number;
+  schemaHash: string;
+  /**
+   * Things worth telling the publisher that are not grounds to refuse.
+   *
+   * Always present, empty when there is nothing to say, so a caller reads a
+   * list rather than branching on whether there is one. Sentences rather
+   * than codes: the only consumers are a person reading a CLI, an admin
+   * screen or a log, and a code would need a catalogue nobody would write
+   * ([0097](../../../docs/decisions/0097-a-publish-may-warn.md)).
+   */
+  warnings: readonly string[];
 } | {
   ok: false;
-  reason: 'not_allowed' | 'unknown_field' | 'not_a_file_field' | 'too_large' | 'not_accepted';
-};
+  kind: 'invalid_schema';
+  errors?: SchemaError[];
+} | {
+  ok: false;
+  kind: 'invalid_logic';
+  message: string;
+} | {
+  ok: false;
+  kind: 'unsafe_pattern';
+  patterns: UnsafePattern[];
+} |
+/** The document names a list this deployment has never heard of. */
+{
+  ok: false;
+  kind: 'unknown_options_source';
+  sources: string[];
+} |
 /**
- * Agree where a file will go, and refuse it before a byte is sent.
+ * Somebody else published while this editor was editing.
  *
- * Checking here rather than after the upload is the difference between
- * refusing a 2 GB file and receiving one first. The browser's own `accept` and
- * size limits are a convenience for the person filling the form in; these are
- * the rule, because somebody posting to the endpoint directly has neither.
+ * The same kind and the same body the submission path uses, deliberately: a
+ * client that already knows how to handle one stale version handles both.
  */
-export declare function offerUpload(deps: OfferDeps, input: OfferInput): Promise<OfferOutcome>;
-type ClaimOutcome = {
-  ok: true;
-  ids: readonly string[];
-} | {
+{
   ok: false;
-  unknown: readonly string[];
-};
+  kind: 'version_changed';
+  current?: ResolvedForm;
+} |
 /**
- * Which files a submission may claim, checked but not yet claimed.
+ * This exact document is already a version of this form, and not the current
+ * one — somebody republishing an older version to undo a bad publish.
  *
- * The claiming itself is `insertSubmission`'s job, in the same call that
- * stores the submission, so one COMMIT decides both — the same reasoning
- * that put the webhook queue there. A submission exists if and only if the
- * files it names belong to it. Claiming separately gives the two failures
- * nobody can debug: a rolled-back submission leaving files claimed against
- * nothing, or an accepted submission referencing bytes the collector is about
- * to delete.
- *
- * Refuses rather than skips. A submission naming a file that does not exist,
- * belongs to another form, or is already claimed is not a submission to fix up
- * quietly: the first is a bug or somebody guessing ids; the second is how an
- * id from a form you may submit to would let you attach a file from one you
- * may not; the third would make deleting a submission either leak bytes or
- * break a different one.
+ * `UNIQUE (form_id, schema_hash)` is what makes republishing the CURRENT
+ * document idempotent rather than a version factory, and it refuses this too:
+ * without this branch the insert raised and the route answered **500**. A
+ * published version is immutable and cannot be published twice
+ * ([0025](../../../docs/decisions/0025-immutability-in-the-database.md)), so
+ * the honest answer names the version it already is.
  */
-export declare function filesToClaim(storage: Storage, input: {
-  schema: FormSchema;
-  formId: string;
-  data: unknown;
-}): Promise<ClaimOutcome>;
+{
+  ok: false;
+  kind: 'already_published';
+  version: number;
+};
 /**
- * Files nobody claimed, old enough that nobody is going to.
+ * Publish a schema as a form's next version.
  *
- * Returns the rows rather than deleting anything: the host removes the bytes
- * and then the rows, in that order, because a row without bytes is a broken
- * reference and bytes without a row are invisible rubbish. Of the two, the
- * second is the one you never find out about.
+ * This is the save gate: structural validation, then the ENGINE's own compile
+ * — type-checked expressions, kind policies and the cycle graph — so a form
+ * that can loop or read a ghost field is refused here and never persisted.
+ * Republishing the identical document is idempotent, because "deploy again"
+ * must never manufacture a version.
  */
-export declare function collectAbandonedFiles(storage: Storage, now: Date, afterHours: number): Promise<FileRecord[]>;
-/** Re-exported so a host can see which paths a schema's file fields live at. */
-export declare function fileFieldPaths(schema: FormSchema): string[];
+export declare function publishForm(deps: ServerDeps, input: {
+  path: string;
+  schema: unknown;
+  actor?: Actor;
+  /**
+   * The hash of the version this edit started from, when there was one.
+   *
+   * **Optional, and that is the decision.** A script, the CLI and an agent
+   * publish a document they composed rather than one they opened, and have
+   * nothing to declare; requiring it would make every one of them read the
+   * current version first to satisfy a rule about editors. What declares is
+   * the thing that OPENED a version — the builder — and declaring is how it
+   * asks to be told it has been overtaken.
+   */
+  basedOnSchemaHash?: string;
+}): Promise<PublishOutcome>;
 //#endregion
-export { type Action, type Actor, type AttemptOutcome, type AuditAction, type AuditDraft, type AuditEntry, type AuthDeps, type AuthOutcome, type BreakerState, CHALLENGE_TTL_SECONDS, type Challenge, type ClaimOutcome, DEFAULT_MAX_NUMBER, type DeliveryHeaders, type DeliveryRecord, type DraftMigration, type DraftRecord, type FileRecord, type FormRecord, type FormVersionRecord, type ListedForm, type ListedSubmission, type ListedVersion, type MembershipOutcome, type OfferDeps, type OfferInput, type OfferOutcome, type OutboxDeps, type PublishOutcome, type ReplayOutcome, type ResolvedForm, type ResumeOutcome, type Role, type ServerDeps, type ServerOptionsSource, type ServerOptionsSources, type Solution, type Storage, type SubmissionOutcome, type SubmissionRecord, type UnsafePattern, type VerifyOutcome, type WebhookHealth, type WebhookRecord, decodeSolution, encodeSolution, hashOf, mintChallenge, solveChallenge, verifySolution };
+export { type Action, type Actor, type AttemptOutcome, type AuditAction, type AuditDraft, type AuditEntry, type AuthDeps, type AuthOutcome, type BreakerState, CHALLENGE_TTL_SECONDS, type Challenge, type ClaimOutcome, DEFAULT_MAX_NUMBER, type DeliveryHeaders, type DeliveryRecord, type DraftMigration, type DraftRecord, type FileRecord, type FormRecord, type FormVersionRecord, type ListedForm, type ListedSubmission, type ListedVersion, type MembershipOutcome, type OfferDeps, type OfferInput, type OfferOutcome, type OutboxDeps, type PublishOutcome, type ReplayOutcome, type ResolvedForm, type ResumeOutcome, type Role, type ScanVerdict, type Scanner, type ScreenOutcome, type ServerDeps, type ServerOptionsSource, type ServerOptionsSources, type Solution, type Storage, type SubmissionOutcome, type SubmissionRecord, type UnsafePattern, type VerifyOutcome, type WebhookHealth, type WebhookRecord, decodeSolution, encodeSolution, hashOf, mintChallenge, solveChallenge, verifySolution };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/options-membership.ts","../src/ports.ts","../src/auth.ts","../src/audit.ts","../src/outbox.ts","../src/breaker.ts","../src/redos.ts","../src/use-cases.ts","../src/testing/memory-storage.ts","../src/address.ts","../src/webhook.ts","../src/uploads.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;UAoBiB;;;;;;;;;;;;EAYf,SAAS,4BAA4B;;KAG3B,uBAAuB,SAAS,eAAe;;;;;;;;;wBAU3C,eACd,QAAQ,YACR,iBACC;EAAgB;EAAc;EAAgB;;;KAmCrC;EACN;;;;EAEA;EAAW;EAAiB,QAAQ;;;;;;;;;;EAQpC;EAAW;EAA4B;;;;;;;;wBAQvB,gBACpB,QAAQ,YACR,gBACA,SAAS,mCACR,QAAQ;;;;;;wBA8CK,cAAc,QAAQ;;;;;;;;UC/IrB;EACf;EACA;EACA;;;;;;;;;;EAUA;;;;;;EAMA;;UAGe;EACf;EACA;EACA;EACA,QAAQ;EACR;;UAGe;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,MAAM;EACN;;UAGe;EACf;EACA;;EAEA;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;;;UAIe;EACf;EACA;EACA;;EAEA;;;;;;;;;EASA;;EAEA;;;;;;;;;;;UAYe;EACf;EACA;EACA;;EAEA;EACA;EACA;;EAEA;;EAEA;EACA;;;;;;;;;;;;;;;;;;UAmBe;EACf;EACA;;EAEA;EACA;EACA;;EAEA;EACA;EACA;;EAEA;;UAGe;EACf,cAAc,eAAe,QAAQ;EACrC,aAAa,QAAQ;EACrB,WAAW,QAAQ,aAAa;EAChC,iBACE,gBACA,QAAQ,KAAK,iDACZ;EACH,kBAAkB,gBAAgB,oBAAoB;EACtD,cAAc,QAAQ,oBAAoB;;;;;;;;;;;;;;;;;;;EAoB1C,eAAe;IACb,OAAO;IACP,SAAS;IACT,QAAQ;MACN;EACJ,eAAe,aAAa,QAAQ;EACpC,kBAAkB,gBAAgB,qBAAqB,QAAQ;EAC/D,oBAAoB,iBAAiB;;;;;;;;;;;;;;;;;EAiBrC,iBACE,QAAQ,kBACR,sBAAsB,kBACtB,kCACA,QAAQ,aACP;;;;;;;;;;;;;;EAeH,YAAY,OAAO,aAAa;;EAGhC,UAAU,gBAAgB,QAAQ;;;;;;;;;;;;;;;EAgBlC,eAAe,mBAAmB,uBAAuB;;EAGzD,wBAAwB,oBAAoB;EAE5C,WAAW,QAAQ,aAAa;EAChC,QAAQ,aAAa,QAAQ;EAC7B,WAAW,QAAQ,aAAa;;EAEhC,eAAe,oBAAoB,QAAQ;EAC3C,YAAY,yBAAyB;EACrC,gBAAgB,iBAAiB,QAAQ;EACzC,cAAc,QAAQ,gBAAgB;;EAEtC,cAAc,QAAQ,gBAAgB;EACtC,gBAAgB,QAAQ;;;;;;;;EAQxB,eAAe,gBAAgB,QAAQ;EACvC,YAAY,aAAa,QAAQ;;EAEjC,mBAAmB,gBAAgB,gBAAgB,QAAQ;EAC3D,eAAe,QAAQ,iBAAiB;EACxC,mBAAmB,QAAQ;;EAE3B,sBAAsB,iBAAiB,QAAQ;EAC/C,mBAAmB,iBAAiB,QAAQ;EAC5C,YAAY,QAAQ,cAAc;EAClC,SAAS,gBAAgB,kBAAkB,QAAQ;EACnD,WAAW,QAAQ,aAAa;EAChC,eAAe,gBAAgB,QAAQ;EACvC,aAAa,QAAQ,eAAe;EACpC,eAAe,QAAQ;EACvB,oBAAoB,iBAAiB,QAAQ;EAC7C,aAAa,YAAY,gBAAgB;;;;;;;;;;;;KC9Q/B;UAEK;EACf;EACA;EACA,MAAM;;UAGS;EACf,SAAS;EACT;EACA;;EAEA;EACA,WAAW,iBAAiB;EAC5B,aAAa,gBAAgB,eAAe;;KAKlC;EACN;EAAU;;EACV;EAAW;;wBAEK,gBACpB,MAAM,UACN;EAAS;EAAe;EAAkB,MAAM;IAC/C,QAAQ;KAmBC;EAAgB;EAAU,OAAO;;EAAY;;;;;;;wBAOnC,kBACpB,MAAM,UACN;EAAS;EAAe;IACvB,QAAQ;KAYC;EACN;EAAU;EAAY;;EACtB;EAAW;;wBAEK,aACpB,MAAM,UACN;EAAS;EAAc,MAAM;IAC5B,QAAQ;wBAmBW,mBAAmB,MAAM,UAAU,oBAAoB,QAAQ;;;;;;;;KAkBzE;wBAwBI,IAAI,OAAO,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;qBCzH7B;KAiBD,sBAAsB;UAEjB;WACN;WACA;WACA,QAAQ;;;;;WAKR;WACA;;;;;;WAMA;;;;;WAKA;;WAEA,SAAS,SAAS;;;KAIjB,aAAa,KAAK;;;;;;;;wBASd,UAAU,OAAO,mBAAmB,OAAO,KAAK,uCAAuC;;;;;;;;;;UCnEtF;EACf;EACA;EACA;;wBAGc,aACd,UAAU,gBACV,SAAS,gBACT,KAAK,MACL,uBACC;UAyBc;EACf,SAAS;;EAET,OACE,UAAU,gBACV,SAAS,eACT,uBACG,QAAQ;EACb,WAAW;EACX;;;;;;;;;;;;;;;wBAgBoB,YAAY,MAAM,YAAY,iBAAa;;;;;;;;;;;;;;;;;;;KAqFrD;EACN;EAAU,UAAU;;EACpB;EAAW;EAA8B,QAAQ;;wBAEjC,eACpB;EAAQ,SAAS;EAAS,WAAW;GACrC,aACC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC1IE;;;;;;;;;qBAUA;;KAGD;wBAEI,aAAa,SAAS,eAAe,KAAK,OAAO;;wBAYjD,WAAW,SAAS,eAAe,KAAK;;;;;;;;wBAWxC,oBACd,SAAS,eACT,aACA,KAAK,OACJ;;;;;;;;UAuBc;EACf;EACA;EACA,OAAO;EACP;;EAEA;;wBAGc,SAAS,SAAS,eAAe,KAAK,OAAO;;;;;;;;;;;;;;;;;;;UC1E5C;;EAEf;EACA;;EAEA;;;;;;;;;;;wBAqCoB,eAAe,QAAQ,aAAa,QAAQ;;;;;;;;;;UC3CjD;EACf,SAAS;EACT;EACA;;EAEA,cAAc;;;;;;;;;;EAUd;;;;;;;;;;;;;;;EAeA,iBAAiB;;KAGP;EACN;EAAU;EAAgB;EAAmB;EAAiB;;EAC9D;EAAW;EAAwB,SAAS;;EAC5C;EAAW;EAAuB;;EAClC;EAAW;EAAwB,UAAU;;;;EAE7C;EAAW;EAAgC;;;;;;;;;;;wBAW3B,YACpB,MAAM,YACN;EAAS;EAAc;EAAiB,QAAQ;IAC/C,QAAQ;UAwJM;EACf;EACA;EACA;EACA,QAAQ;EACR;;wBAGoB,YAAY,MAAM,YAAY,eAAe,QAAQ;KAc/D;EACN;EAAU;EAAY;;EACtB;EAAW;;EACX;EAAW;EAAyB,UAAU;;EAC9C;EAAW;EAAiB,QAAQ;;;;EAEpC;EAAW;;;;;;;;;;EAQX;EAAW;EAA4B;;;;;;;;;;;;;;;;;;wBAkBvB,cACpB,MAAM,YACN;EAAS;EAAc;EAAoC;IAC1D;EAAU;;wBAYS,iBACpB,MAAM,YACN;EACE;EACA;EACA;;EAEA;EACA;IAED,QAAQ;UAiHM;EACf;EACA;EACA;EACA;;;;;wBAMoB,gBACpB,MAAM,YACN,eACC,QAAQ;;;;;;;;;;;wBA0BW,UAAU,MAAM,YAAY,eAAe;;;;;;;;wBA4G3C,WACpB,MAAM,YACN;EAAS;IACR;EAAU;EAAiB;;wBAQR,UACpB,MAAM,YACN;EAAS;EAAc;EAAiB;EAAe;IACtD;EAAU;EAAiB;;UAqBb;EACf;EACA,SAAS;;KAGC;EAEN;EACA;EACA,QAAQ;EACR;EACA;;EAEA,YAAY;;;;EAKZ;EACA;EACA,QAAQ;EACR;;;;;;;;;;;;;;wBAegB,YACpB,MAAM,YACN;EAAS;EAAc;EAAiB;IACvC,QAAQ;UAkIM;EACf;EACA;EACA;EACA;;;wBAIoB,UAAU,MAAM,aAAa,QAAQ;UAiB1C;EACf;EACA;EACA;;;;wBAKoB,aACpB,MAAM,YACN,eACC,QAAQ;;;;;;;;wBChyBK,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBCgCvB,iBAAiB;;;;;;;;;wBAkDjB,YAAY;;;;;;;;;;;qBC/Ef;qBACA;UAEI;GACd;;;;;;;;;;wBAWa,cAAc,0BAA0B;;wBAKxC,SAAS,gBAAgB,0BAA0B;;;;;;;;wBAWnD,gBAAgB;EAC9B;EACA;EACA;EACA;EACA;IACE;;;;;;;wBAiBY,gBAAgB;EAC9B;EACA;EACA;EACA;EACA;;;;;;;;;;wBA4Cc,aAAa,iBAAiB;;qBAQjC;;;;;;;;;;;;;;;;;;;;;;UCnGI;EACf,SAAS;EACT,WAAW;EACX;;UAGe;EACf,QAAQ;;EAER,MAAM;EACN;EACA;;EAEA;EACA;EACA;EACA;;KAGU;EACN;EAAU,MAAM;;EAEhB;EACA;;;;;;;;;;wBAWgB,YAAY,MAAM,WAAW,OAAO,aAAa,QAAQ;KAqCnE;EACN;EAAU;;EACV;EAAW;;;;;;;;;;;;;;;;;;;;wBAoBK,aACpB,SAAS,SACT;EAAS,QAAQ;EAAY;EAAgB;IAC5C,QAAQ;;;;;;;;;wBA6BW,sBACpB,SAAS,SACT,KAAK,MACL,qBACC,QAAQ;;wBAkGK,eAAe,QAAQ"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/options-membership.ts","../src/ports.ts","../src/auth.ts","../src/audit.ts","../src/outbox.ts","../src/breaker.ts","../src/uploads.ts","../src/deps.ts","../src/use-cases.ts","../src/redos.ts","../src/testing/memory-storage.ts","../src/address.ts","../src/webhook.ts","../src/publishing.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;UAoBiB;;;;;;;;;;;;EAYf,SAAS,4BAA4B;;KAG3B,uBAAuB,SAAS,eAAe;;;;;;;;;wBAU3C,eACd,QAAQ,YACR,iBACC;EAAgB;EAAc;EAAgB;;;KAiDrC;EACN;;;;EAEA;EAAW;EAAiB,QAAQ;;;;;;;;;;EAQpC;EAAW;EAA4B;;;;;;;;wBAQvB,gBACpB,QAAQ,YACR,gBACA,SAAS,mCACR,QAAQ;;;;;;wBA8CK,cAAc,QAAQ;;;;;;;;UC7JrB;EACf;EACA;EACA;;;;;;;;;;EAUA;;;;;;EAMA;;UAGe;EACf;EACA;EACA;EACA,QAAQ;EACR;;UAGe;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA,MAAM;EACN;;UAGe;EACf;EACA;;EAEA;EACA;EACA,MAAM;EACN;EACA;;UAGe;EACf;EACA;EACA;EACA;EACA;;;UAIe;EACf;EACA;EACA;;EAEA;;;;;;;;;EASA;;EAEA;;;;;;;;;;;UAYe;EACf;EACA;EACA;;EAEA;EACA;EACA;;EAEA;;EAEA;EACA;;;;;;;;;;;;;;;;;;UAmBe;EACf;EACA;;EAEA;EACA;EACA;;EAEA;EACA;EACA;;EAEA;;UAGe;EACf,cAAc,eAAe,QAAQ;EACrC,aAAa,QAAQ;EACrB,WAAW,QAAQ,aAAa;EAChC,iBACE,gBACA,QAAQ,KAAK,iDACZ;EACH,kBAAkB,gBAAgB,oBAAoB;EACtD,cAAc,QAAQ,oBAAoB;;;;;;;;;;;;;;;;;;;EAoB1C,eAAe;IACb,OAAO;IACP,SAAS;IACT,QAAQ;MACN;EACJ,eAAe,aAAa,QAAQ;EACpC,kBAAkB,gBAAgB,qBAAqB,QAAQ;EAC/D,oBAAoB,iBAAiB;;;;;;;;;;;;;;;;;EAiBrC,iBACE,QAAQ,kBACR,sBAAsB,kBACtB,kCACA,QAAQ,aACP;;;;;;;;;;;;;;EAeH,YAAY,OAAO,aAAa;;EAGhC,UAAU,gBAAgB,QAAQ;;;;;;;;;;;;;;;EAgBlC,eAAe,mBAAmB,uBAAuB;;EAGzD,wBAAwB,oBAAoB;EAE5C,WAAW,QAAQ,aAAa;EAChC,QAAQ,aAAa,QAAQ;EAC7B,WAAW,QAAQ,aAAa;;EAEhC,eAAe,oBAAoB,QAAQ;EAC3C,YAAY,yBAAyB;EACrC,gBAAgB,iBAAiB,QAAQ;EACzC,cAAc,QAAQ,gBAAgB;;EAEtC,cAAc,QAAQ,gBAAgB;EACtC,gBAAgB,QAAQ;;;;;;;;EAQxB,eAAe,gBAAgB,QAAQ;EACvC,YAAY,aAAa,QAAQ;;EAEjC,mBAAmB,gBAAgB,gBAAgB,QAAQ;EAC3D,eAAe,QAAQ,iBAAiB;EACxC,mBAAmB,QAAQ;;EAE3B,sBAAsB,iBAAiB,QAAQ;EAC/C,mBAAmB,iBAAiB,QAAQ;EAC5C,YAAY,QAAQ,cAAc;EAClC,SAAS,gBAAgB,kBAAkB,QAAQ;EACnD,WAAW,QAAQ,aAAa;EAChC,eAAe,gBAAgB,QAAQ;EACvC,aAAa,QAAQ,eAAe;EACpC,eAAe,QAAQ;EACvB,oBAAoB,iBAAiB,QAAQ;EAC7C,aAAa,YAAY,gBAAgB;;;;;;;;;;;;KC9Q/B;UAEK;EACf;EACA;EACA,MAAM;;UAGS;EACf,SAAS;EACT;EACA;;EAEA;EACA,WAAW,iBAAiB;EAC5B,aAAa,gBAAgB,eAAe;;KAKlC;EACN;EAAU;;EACV;EAAW;;wBAEK,gBACpB,MAAM,UACN;EAAS;EAAe;EAAkB,MAAM;IAC/C,QAAQ;KAmBC;EAAgB;EAAU,OAAO;;EAAY;;;;;;;wBAOnC,kBACpB,MAAM,UACN;EAAS;EAAe;IACvB,QAAQ;KAYC;EACN;EAAU;EAAY;;EACtB;EAAW;;wBAEK,aACpB,MAAM,UACN;EAAS;EAAc,MAAM;IAC5B,QAAQ;wBAmBW,mBAAmB,MAAM,UAAU,oBAAoB,QAAQ;;;;;;;;KAkBzE;wBAwBI,IAAI,OAAO,OAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;qBCzH7B;KAiBD,sBAAsB;UAEjB;WACN;WACA;WACA,QAAQ;;;;;WAKR;WACA;;;;;;WAMA;;;;;WAKA;;WAEA,SAAS,SAAS;;;KAIjB,aAAa,KAAK;;;;;;;;wBASd,UAAU,OAAO,mBAAmB,OAAO,KAAK,uCAAuC;;;;;;;;;;UCnEtF;EACf;EACA;EACA;;wBAGc,aACd,UAAU,gBACV,SAAS,gBACT,KAAK,MACL,uBACC;UAyBc;EACf,SAAS;;EAET,OACE,UAAU,gBACV,SAAS,eACT,uBACG,QAAQ;EACb,WAAW;EACX;;;;;;;;;;;;;;;wBAgBoB,YAAY,MAAM,YAAY,iBAAa;;;;;;;;;;;;;;;;;;;KAqFrD;EACN;EAAU,UAAU;;EACpB;EAAW;EAA8B,QAAQ;;wBAEjC,eACpB;EAAQ,SAAS;EAAS,WAAW;GACrC,aACC,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC1IE;;;;;;;;;qBAUA;;KAGD;wBAEI,aAAa,SAAS,eAAe,KAAK,OAAO;;wBAYjD,WAAW,SAAS,eAAe,KAAK;;;;;;;;wBAWxC,oBACd,SAAS,eACT,aACA,KAAK,OACJ;;;;;;;;UAuBc;EACf;EACA;EACA,OAAO;EACP;;EAEA;;wBAGc,SAAS,SAAS,eAAe,KAAK,OAAO;;;;;;;;;;;;;;;;;;;;;;UC5E5C;EACf,SAAS;EACT,WAAW;EACX;;UAGe;EACf,QAAQ;;EAER,MAAM;EACN;EACA;;EAEA;EACA;EACA;EACA;;KAGU;EACN;EAAU,MAAM;;EAEhB;EACA;;;;;;;;;;wBAWgB,YAAY,MAAM,WAAW,OAAO,aAAa,QAAQ;;KAsCnE;EAAgB;;EAAkB;EAAc;;;;;;;;;UAS3C;EACf,KACE;IAAQ;IAAc;IAAqB;KAC3C,OAAO,aACN,QAAQ;;KAGD;EACN;;EACA;EAAW;EAAmB;;;;EAE9B;EAAW;EAA+B;;;;;;;;;;;;wBAY1B,aACpB,SAAS,qBACT;EAAQ;EAAc;EAAqB;GAC3C,OAAO,aACN,QAAQ;KAkBC;EACN;EAAU;;EACV;EAAW;;;;;;;;;;;;;;;;;;;;wBAoBK,aACpB,SAAS,SACT;EAAS,QAAQ;EAAY;EAAgB;IAC5C,QAAQ;;;;;;;;;wBA6BW,sBACpB,SAAS,SACT,KAAK,MACL,qBACC,QAAQ;;wBAkGK,eAAe,QAAQ;;;;;;;;;;;UCtStB;EACf,SAAS;EACT;EACA;;;;;;;;;EASA,SAAS,eAAe;;EAExB,cAAc;;;;;;;;;;EAUd;;;;;;;;;;;;;;;EAeA,iBAAiB;;;;;EAKjB,UAAU;;;;;;;;;;;UCtCK;EACf;EACA;EACA;EACA,QAAQ;EACR;;wBAGoB,YAAY,MAAM,YAAY,eAAe,QAAQ;KAc/D;EACN;EAAU;EAAY;;EACtB;EAAW;;EACX;EAAW;EAAyB,UAAU;;EAC9C;EAAW;EAAiB,QAAQ;;;;EAEpC;EAAW;;;;;;;;;;EAQX;EAAW;EAA4B;;;;;;;;;;;;;;;;;;wBAkBvB,cACpB,MAAM,YACN;EAAS;EAAc;EAAoC;IAC1D;EAAU;;wBAYS,iBACpB,MAAM,YACN;EACE;EACA;EACA;;EAEA;EACA;IAED,QAAQ;UA4HM;EACf;EACA;EACA;EACA;;;;;wBAMoB,gBACpB,MAAM,YACN,eACC,QAAQ;;;;;;;;;;;wBA0BW,UAAU,MAAM,YAAY,eAAe;;;;;;;;wBA4G3C,WACpB,MAAM,YACN;EAAS;IACR;EAAU;EAAiB;;wBAQR,UACpB,MAAM,YACN;EAAS;EAAc;EAAiB;EAAe;IACtD;EAAU;EAAiB;;UAqBb;EACf;EACA,SAAS;;KAGC;EAEN;EACA;EACA,QAAQ;EACR;EACA;;EAEA,YAAY;;;;EAKZ;EACA;EACA,QAAQ;EACR;;;;;;;;;;;;;;wBAegB,YACpB,MAAM,YACN;EAAS;EAAc;EAAiB;IACvC,QAAQ;UAkIM;EACf;EACA;EACA;EACA;;;wBAIoB,UAAU,MAAM,aAAa,QAAQ;UAiB1C;EACf;EACA;EACA;;;;wBAKoB,aACpB,MAAM,YACN,eACC,QAAQ;;;;;;;;;;;;;;;;;;;UCtkBM;;EAEf;EACA;;EAEA;;;;;;;;;;;wBAqCoB,eAAe,QAAQ,aAAa,QAAQ;;;;;;;;wBC3DlD,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBCgCvB,iBAAiB;;;;;;;;;wBAkDjB,YAAY;;;;;;;;;;;qBC/Ef;qBACA;UAEI;GACd;;;;;;;;;;wBAWa,cAAc,0BAA0B;;wBAKxC,SAAS,gBAAgB,0BAA0B;;;;;;;;wBAWnD,gBAAgB;EAC9B;EACA;EACA;EACA;EACA;IACE;;;;;;;wBAiBY,gBAAgB;EAC9B;EACA;EACA;EACA;EACA;;;;;;;;;;wBA4Cc,aAAa,iBAAiB;;qBAQjC;;;;;;;;;;KCvGD;EAEN;EACA;EACA;EACA;EACA;;;;;;;;;;EAUA;;EAEA;EAAW;EAAwB,SAAS;;EAC5C;EAAW;EAAuB;;EAClC;EAAW;EAAwB,UAAU;;;;EAE7C;EAAW;EAAgC;;;;;;;;;EAO3C;EAAW;EAAyB,UAAU;;;;;;;;;;;;;;EAY9C;EAAW;EAA2B;;;;;;;;;;;wBAWtB,YACpB,MAAM,YACN;EACE;EACA;EACA,QAAQ;;;;;;;;;;;EAWR;IAED,QAAQ"}