@fragno-dev/backoffice-api 0.0.0-stage → 0.0.0

package/dist/v0/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","names":[],"sources":["../../src/v0/api.ts"],"mappings":";;;;;;cAwBa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCAAA"}

package/dist/v0/api.js

@@ -0,0 +1,52 @@
+import { organizationOperations } from "./organization.js";
+import { accountOperations } from "./account.js";
+import { appsOperations } from "./apps.js";
+import { automationRouterOperations } from "./automation.js";
+import { capabilitiesOperations } from "./capabilities.js";
+import { eventsOperations } from "./events.js";
+import { formsOperations } from "./forms.js";
+import { hooksOperations } from "./hooks.js";
+import { identityOperations } from "./identity.js";
+import { integrationsOperations } from "./integrations.js";
+import { javascriptOperations } from "./javascript.js";
+import { marketplaceOperations, packagesOperations } from "./marketplace.js";
+import { otpOperations } from "./otp.js";
+import { piOperations } from "./pi.js";
+import { sandboxOperations } from "./sandbox.js";
+import { stateOperations } from "./state.js";
+import { storeOperations } from "./store.js";
+import { uploadOperations } from "./upload.js";
+import { webOperations } from "./web.js";
+import { workflowOperations } from "./workflow.js";
+//#region src/v0/api.ts
+/** v0 is unstable: operations and schemas may change without a new version. */
+const backofficeApiV0 = {
+	version: "v0",
+	operations: {
+		...accountOperations,
+		...appsOperations,
+		...automationRouterOperations,
+		...capabilitiesOperations,
+		...eventsOperations,
+		...formsOperations,
+		...hooksOperations,
+		...identityOperations,
+		...integrationsOperations,
+		...javascriptOperations,
+		...marketplaceOperations,
+		...organizationOperations,
+		...otpOperations,
+		...packagesOperations,
+		...piOperations,
+		...sandboxOperations,
+		...stateOperations,
+		...storeOperations,
+		...uploadOperations,
+		...webOperations,
+		...workflowOperations
+	}
+};
+//#endregion
+export { backofficeApiV0 };
+
+//# sourceMappingURL=api.js.map

package/dist/v0/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","names":[],"sources":["../../src/v0/api.ts"],"sourcesContent":["import type { BackofficeApi } from \"../api\";\nimport { accountOperations } from \"./account\";\nimport { appsOperations } from \"./apps\";\nimport { automationRouterOperations } from \"./automation\";\nimport { capabilitiesOperations } from \"./capabilities\";\nimport { eventsOperations } from \"./events\";\nimport { formsOperations } from \"./forms\";\nimport { hooksOperations } from \"./hooks\";\nimport { identityOperations } from \"./identity\";\nimport { integrationsOperations } from \"./integrations\";\nimport { javascriptOperations } from \"./javascript\";\nimport { marketplaceOperations } from \"./marketplace\";\nimport { packagesOperations } from \"./marketplace\";\nimport { organizationOperations } from \"./organization\";\nimport { otpOperations } from \"./otp\";\nimport { piOperations } from \"./pi\";\nimport { sandboxOperations } from \"./sandbox\";\nimport { stateOperations } from \"./state\";\nimport { storeOperations } from \"./store\";\nimport { uploadOperations } from \"./upload\";\nimport { webOperations } from \"./web\";\nimport { workflowOperations } from \"./workflow\";\n\n/** v0 is unstable: operations and schemas may change without a new version. */\nexport const backofficeApiV0 = {\n  version: \"v0\",\n  operations: {\n    ...accountOperations,\n    ...appsOperations,\n    ...automationRouterOperations,\n    ...capabilitiesOperations,\n    ...eventsOperations,\n    ...formsOperations,\n    ...hooksOperations,\n    ...identityOperations,\n    ...integrationsOperations,\n    ...javascriptOperations,\n    ...marketplaceOperations,\n    ...organizationOperations,\n    ...otpOperations,\n    ...packagesOperations,\n    ...piOperations,\n    ...sandboxOperations,\n    ...stateOperations,\n    ...storeOperations,\n    ...uploadOperations,\n    ...webOperations,\n    ...workflowOperations,\n  },\n} satisfies BackofficeApi;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,kBAAkB;CAC7B,SAAS;CACT,YAAY;EACV,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;EACH,GAAG;CACL;AACF"}

package/dist/v0/app-actions.d.ts

@@ -0,0 +1,105 @@
+import { JsonValue } from "./shared/json.js";
+import { z } from "zod";
+//#region src/v0/app-actions.d.ts
+/** Issuer of every token Backoffice's auth server signs. */
+declare const BACKOFFICE_TOKEN_ISSUER = "fragno-backoffice-auth";
+/** Short enough that a captured request cannot be replayed later. */
+declare const APP_ACTION_TOKEN_LIFETIME_SECONDS = 60;
+/** The JSON body Backoffice POSTs to an app's action endpoint. */
+declare const appActionRequestSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+  type: z.ZodLiteral<"ping">;
+}, z.core.$strict>, z.ZodObject<{
+  type: z.ZodLiteral<"action">;
+  actionId: z.ZodString;
+  input: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+}, z.core.$strict>], "type">>;
+type AppActionRequest = z.infer<typeof appActionRequestSchema>;
+/**
+ * The bearer token on every action request. Its audience is the app's endpoint URL, so a request
+ * sent to one app cannot be replayed against another.
+ */
+declare const appActionTokenClaimsSchema: z.ZodLazy<z.ZodObject<{
+  iss: z.ZodLiteral<"fragno-backoffice-auth">;
+  aud: z.ZodString;
+  iat: z.ZodNumber;
+  exp: z.ZodNumber;
+  jti: z.ZodString;
+  sub: z.ZodString;
+  actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"user">;
+    userId: z.ZodString;
+  }, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"installation">;
+  }, z.core.$strict>], "kind">;
+  installation: z.ZodObject<{
+    appId: z.ZodString;
+    activation: z.ZodNumber;
+    externalAccount: z.ZodLazy<z.ZodObject<{
+      id: z.ZodString;
+      label: z.ZodString;
+    }, z.core.$strict>>;
+  }, z.core.$strict>;
+  scopeRestriction: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"org">;
+    orgId: z.ZodString;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"user">;
+    userId: z.ZodString;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"app">;
+    owner: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"org">;
+      orgId: z.ZodString;
+    }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"user">;
+      userId: z.ZodString;
+    }, z.core.$strict>>], "kind">>;
+    appId: z.ZodString;
+  }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+    kind: z.ZodLiteral<"project">;
+    owner: z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"org">;
+      orgId: z.ZodString;
+    }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"user">;
+      userId: z.ZodString;
+    }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+      kind: z.ZodLiteral<"app">;
+      owner: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"org">;
+        orgId: z.ZodString;
+      }, z.core.$strict>>, z.ZodLazy<z.ZodObject<{
+        kind: z.ZodLiteral<"user">;
+        userId: z.ZodString;
+      }, z.core.$strict>>], "kind">>;
+      appId: z.ZodString;
+    }, z.core.$strict>>], "kind">;
+    projectId: z.ZodString;
+  }, z.core.$strict>>], "kind">>;
+  bodySha256: z.ZodString;
+}, z.core.$strip>>;
+type AppActionTokenClaims = z.infer<typeof appActionTokenClaimsSchema>;
+/** Binds a token to one body; Backoffice signs it and the app's verifier recomputes it. */
+declare function appActionBodySha256(body: string): Promise<string>;
+/** A request the endpoint must refuse; `status` is the HTTP status to answer with. */
+declare class AppActionRequestError extends Error {
+  readonly status: 400 | 401 | 405;
+  constructor(status: 400 | 401 | 405, message: string);
+}
+type VerifiedAppActionRequest = {
+  claims: AppActionTokenClaims;
+  request: AppActionRequest;
+};
+/**
+ * Creates the verifier for an app's action endpoint. It checks Backoffice's signature, that the
+ * token is addressed to `endpointUrl` and unexpired, and that it signs this exact body. Signing keys
+ * come from `<backofficeOrigin>/api/auth/jwks` through `fetch` and are cached between requests.
+ */
+declare function createAppActionVerifier({ backofficeOrigin, endpointUrl, fetch }: {
+  backofficeOrigin: string;
+  endpointUrl: string;
+  fetch: typeof globalThis.fetch;
+}): (request: Request) => Promise<VerifiedAppActionRequest>;
+//#endregion
+export { APP_ACTION_TOKEN_LIFETIME_SECONDS, AppActionRequest, AppActionRequestError, AppActionTokenClaims, BACKOFFICE_TOKEN_ISSUER, VerifiedAppActionRequest, appActionBodySha256, appActionRequestSchema, appActionTokenClaimsSchema, createAppActionVerifier };
+//# sourceMappingURL=app-actions.d.ts.map

package/dist/v0/app-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-actions.d.ts","names":[],"sources":["../../src/v0/app-actions.ts"],"mappings":";;;;cAQa;;cAGA;;cAGA,wBAAsB,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;;KAWvB,mBAAmB,EAAE,aAAa;;;;;cAMjC,4BAA0B,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAwB3B,uBAAuB,EAAE,aAAa;;iBAG5B,oBAAoB,eAAe;;cAY5C,8BAA8B;WAChC;cAEG,yBAAyB;;KAO3B;EACV,QAAQ;EACR,SAAS;;;;;;;iBAQK,0BACd,kBACA,aACA;EAEA;EACA;EACA,cAAc,WAAW;KACtB,SAAS,YAAY,QAAQ"}

package/dist/v0/app-actions.js

@@ -0,0 +1,100 @@
+import { backofficeRoutableScopeSchema } from "./shared/scope.js";
+import { appInstallationExternalAccountSchema } from "./apps.js";
+import { jsonValueSchema } from "./shared/json.js";
+import { z } from "zod";
+import { createRemoteJWKSet, customFetch, errors, jwtVerify } from "jose";
+//#region src/v0/app-actions.ts
+/** Issuer of every token Backoffice's auth server signs. */
+const BACKOFFICE_TOKEN_ISSUER = "fragno-backoffice-auth";
+/** Short enough that a captured request cannot be replayed later. */
+const APP_ACTION_TOKEN_LIFETIME_SECONDS = 60;
+/** The JSON body Backoffice POSTs to an app's action endpoint. */
+const appActionRequestSchema = z.lazy(() => z.discriminatedUnion("type", [z.strictObject({ type: z.literal("ping") }), z.strictObject({
+	type: z.literal("action"),
+	actionId: z.string().min(1),
+	input: jsonValueSchema.describe("Validated against the action's declared input schema.")
+})]));
+/**
+* The bearer token on every action request. Its audience is the app's endpoint URL, so a request
+* sent to one app cannot be replayed against another.
+*/
+const appActionTokenClaimsSchema = z.lazy(() => z.object({
+	iss: z.literal(BACKOFFICE_TOKEN_ISSUER),
+	aud: z.string().min(1),
+	iat: z.number().int().nonnegative(),
+	exp: z.number().int().positive(),
+	/** Unique per request; apps may use it as an idempotency key. */
+	jti: z.string().min(1),
+	sub: z.string().min(1),
+	/** The Backoffice user behind the call, or the installation itself for automated calls. */
+	actor: z.discriminatedUnion("kind", [z.strictObject({
+		kind: z.literal("user"),
+		userId: z.string().min(1)
+	}), z.strictObject({ kind: z.literal("installation") })]),
+	installation: z.strictObject({
+		appId: z.string().min(1),
+		activation: z.number().int().positive(),
+		externalAccount: appInstallationExternalAccountSchema
+	}),
+	scopeRestriction: backofficeRoutableScopeSchema,
+	/** Base64url SHA-256 of the exact request body bytes. */
+	bodySha256: z.string().min(1)
+}));
+/** Binds a token to one body; Backoffice signs it and the app's verifier recomputes it. */
+async function appActionBodySha256(body) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)));
+	let binary = "";
+	for (const byte of digest) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** A request the endpoint must refuse; `status` is the HTTP status to answer with. */
+var AppActionRequestError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.name = "AppActionRequestError";
+		this.status = status;
+	}
+};
+/**
+* Creates the verifier for an app's action endpoint. It checks Backoffice's signature, that the
+* token is addressed to `endpointUrl` and unexpired, and that it signs this exact body. Signing keys
+* come from `<backofficeOrigin>/api/auth/jwks` through `fetch` and are cached between requests.
+*/
+function createAppActionVerifier({ backofficeOrigin, endpointUrl, fetch }) {
+	const jwks = createRemoteJWKSet(new URL("/api/auth/jwks", backofficeOrigin), { [customFetch]: fetch });
+	return async function verifyAppActionRequest(request) {
+		if (request.method !== "POST") throw new AppActionRequestError(405, "App action requests use POST.");
+		const token = /^Bearer (\S+)$/.exec(request.headers.get("authorization") ?? "")?.[1];
+		if (!token) throw new AppActionRequestError(401, "App action request is missing its bearer token.");
+		const body = await request.text();
+		let claims;
+		try {
+			const verified = await jwtVerify(token, jwks, {
+				issuer: BACKOFFICE_TOKEN_ISSUER,
+				audience: endpointUrl
+			});
+			claims = appActionTokenClaimsSchema.parse(verified.payload);
+		} catch (error) {
+			throw new AppActionRequestError(401, error instanceof errors.JWTExpired ? "App action token expired." : "App action token is invalid.");
+		}
+		if (claims.exp - claims.iat > 60) throw new AppActionRequestError(401, "App action token lives longer than allowed.");
+		if (await appActionBodySha256(body) !== claims.bodySha256) throw new AppActionRequestError(401, "App action token does not sign this request body.");
+		let json;
+		try {
+			json = JSON.parse(body);
+		} catch {
+			throw new AppActionRequestError(400, "App action request body is not JSON.");
+		}
+		const parsed = appActionRequestSchema.safeParse(json);
+		if (!parsed.success) throw new AppActionRequestError(400, "App action request body is malformed.");
+		return {
+			claims,
+			request: parsed.data
+		};
+	};
+}
+//#endregion
+export { APP_ACTION_TOKEN_LIFETIME_SECONDS, AppActionRequestError, BACKOFFICE_TOKEN_ISSUER, appActionBodySha256, appActionRequestSchema, appActionTokenClaimsSchema, createAppActionVerifier };
+
+//# sourceMappingURL=app-actions.js.map

package/dist/v0/app-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-actions.js","names":[],"sources":["../../src/v0/app-actions.ts"],"sourcesContent":["import { createRemoteJWKSet, customFetch, errors, jwtVerify } from \"jose\";\nimport { z } from \"zod\";\n\nimport { appInstallationExternalAccountSchema } from \"./apps\";\nimport { jsonValueSchema } from \"./shared/json\";\nimport { backofficeRoutableScopeSchema } from \"./shared/scope\";\n\n/** Issuer of every token Backoffice's auth server signs. */\nexport const BACKOFFICE_TOKEN_ISSUER = \"fragno-backoffice-auth\";\n\n/** Short enough that a captured request cannot be replayed later. */\nexport const APP_ACTION_TOKEN_LIFETIME_SECONDS = 60;\n\n/** The JSON body Backoffice POSTs to an app's action endpoint. */\nexport const appActionRequestSchema = z.lazy(() =>\n  z.discriminatedUnion(\"type\", [\n    // integrations.verify proves the endpoint accepts Backoffice's signature without running an action.\n    z.strictObject({ type: z.literal(\"ping\") }),\n    z.strictObject({\n      type: z.literal(\"action\"),\n      actionId: z.string().min(1),\n      input: jsonValueSchema.describe(\"Validated against the action's declared input schema.\"),\n    }),\n  ]),\n);\nexport type AppActionRequest = z.infer<typeof appActionRequestSchema>;\n\n/**\n * The bearer token on every action request. Its audience is the app's endpoint URL, so a request\n * sent to one app cannot be replayed against another.\n */\nexport const appActionTokenClaimsSchema = z.lazy(() =>\n  z.object({\n    iss: z.literal(BACKOFFICE_TOKEN_ISSUER),\n    aud: z.string().min(1),\n    iat: z.number().int().nonnegative(),\n    exp: z.number().int().positive(),\n    /** Unique per request; apps may use it as an idempotency key. */\n    jti: z.string().min(1),\n    sub: z.string().min(1),\n    /** The Backoffice user behind the call, or the installation itself for automated calls. */\n    actor: z.discriminatedUnion(\"kind\", [\n      z.strictObject({ kind: z.literal(\"user\"), userId: z.string().min(1) }),\n      z.strictObject({ kind: z.literal(\"installation\") }),\n    ]),\n    installation: z.strictObject({\n      appId: z.string().min(1),\n      activation: z.number().int().positive(),\n      externalAccount: appInstallationExternalAccountSchema,\n    }),\n    scopeRestriction: backofficeRoutableScopeSchema,\n    /** Base64url SHA-256 of the exact request body bytes. */\n    bodySha256: z.string().min(1),\n  }),\n);\nexport type AppActionTokenClaims = z.infer<typeof appActionTokenClaimsSchema>;\n\n/** Binds a token to one body; Backoffice signs it and the app's verifier recomputes it. */\nexport async function appActionBodySha256(body: string): Promise<string> {\n  const digest = new Uint8Array(\n    await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(body)),\n  );\n  let binary = \"\";\n  for (const byte of digest) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/** A request the endpoint must refuse; `status` is the HTTP status to answer with. */\nexport class AppActionRequestError extends Error {\n  readonly status: 400 | 401 | 405;\n\n  constructor(status: 400 | 401 | 405, message: string) {\n    super(message);\n    this.name = \"AppActionRequestError\";\n    this.status = status;\n  }\n}\n\nexport type VerifiedAppActionRequest = {\n  claims: AppActionTokenClaims;\n  request: AppActionRequest;\n};\n\n/**\n * Creates the verifier for an app's action endpoint. It checks Backoffice's signature, that the\n * token is addressed to `endpointUrl` and unexpired, and that it signs this exact body. Signing keys\n * come from `<backofficeOrigin>/api/auth/jwks` through `fetch` and are cached between requests.\n */\nexport function createAppActionVerifier({\n  backofficeOrigin,\n  endpointUrl,\n  fetch,\n}: {\n  backofficeOrigin: string;\n  endpointUrl: string;\n  fetch: typeof globalThis.fetch;\n}): (request: Request) => Promise<VerifiedAppActionRequest> {\n  const jwks = createRemoteJWKSet(new URL(\"/api/auth/jwks\", backofficeOrigin), {\n    [customFetch]: fetch,\n  });\n  return async function verifyAppActionRequest(request) {\n    if (request.method !== \"POST\") {\n      throw new AppActionRequestError(405, \"App action requests use POST.\");\n    }\n    const token = /^Bearer (\\S+)$/.exec(request.headers.get(\"authorization\") ?? \"\")?.[1];\n    if (!token) {\n      throw new AppActionRequestError(401, \"App action request is missing its bearer token.\");\n    }\n    const body = await request.text();\n    let claims: AppActionTokenClaims;\n    try {\n      const verified = await jwtVerify(token, jwks, {\n        issuer: BACKOFFICE_TOKEN_ISSUER,\n        audience: endpointUrl,\n      });\n      claims = appActionTokenClaimsSchema.parse(verified.payload);\n    } catch (error) {\n      throw new AppActionRequestError(\n        401,\n        error instanceof errors.JWTExpired\n          ? \"App action token expired.\"\n          : \"App action token is invalid.\",\n      );\n    }\n    if (claims.exp - claims.iat > APP_ACTION_TOKEN_LIFETIME_SECONDS) {\n      throw new AppActionRequestError(401, \"App action token lives longer than allowed.\");\n    }\n    if ((await appActionBodySha256(body)) !== claims.bodySha256) {\n      throw new AppActionRequestError(401, \"App action token does not sign this request body.\");\n    }\n    let json: unknown;\n    try {\n      json = JSON.parse(body);\n    } catch {\n      throw new AppActionRequestError(400, \"App action request body is not JSON.\");\n    }\n    const parsed = appActionRequestSchema.safeParse(json);\n    if (!parsed.success) {\n      throw new AppActionRequestError(400, \"App action request body is malformed.\");\n    }\n    return { claims, request: parsed.data };\n  };\n}\n"],"mappings":";;;;;;;AAQA,MAAa,0BAA0B;;AAGvC,MAAa,oCAAoC;;AAGjD,MAAa,yBAAyB,EAAE,WACtC,EAAE,mBAAmB,QAAQ,CAE3B,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC,GAC1C,EAAE,aAAa;CACb,MAAM,EAAE,QAAQ,QAAQ;CACxB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,OAAO,gBAAgB,SAAS,uDAAuD;AACzF,CAAC,CACH,CAAC,CACH;;;;;AAOA,MAAa,6BAA6B,EAAE,WAC1C,EAAE,OAAO;CACP,KAAK,EAAE,QAAQ,uBAAuB;CACtC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACrB,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CAClC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;;CAE/B,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACrB,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAErB,OAAO,EAAE,mBAAmB,QAAQ,CAClC,EAAE,aAAa;EAAE,MAAM,EAAE,QAAQ,MAAM;EAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC,GACrE,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,cAAc,EAAE,CAAC,CACpD,CAAC;CACD,cAAc,EAAE,aAAa;EAC3B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;EACtC,iBAAiB;CACnB,CAAC;CACD,kBAAkB;;CAElB,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC,CACH;;AAIA,eAAsB,oBAAoB,MAA+B;CACvE,MAAM,SAAS,IAAI,WACjB,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CACtE;CACA,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,QACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;AAGA,IAAa,wBAAb,cAA2C,MAAM;CAC/C;CAEA,YAAY,QAAyB,SAAiB;EACpD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,SAAS;CAChB;AACF;;;;;;AAYA,SAAgB,wBAAwB,EACtC,kBACA,aACA,SAK0D;CAC1D,MAAM,OAAO,mBAAmB,IAAI,IAAI,kBAAkB,gBAAgB,GAAG,GAC1E,cAAc,MACjB,CAAC;CACD,OAAO,eAAe,uBAAuB,SAAS;EACpD,IAAI,QAAQ,WAAW,QACrB,MAAM,IAAI,sBAAsB,KAAK,+BAA+B;EAEtE,MAAM,QAAQ,iBAAiB,KAAK,QAAQ,QAAQ,IAAI,eAAe,KAAK,EAAE,CAAC,GAAG;EAClF,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB,KAAK,iDAAiD;EAExF,MAAM,OAAO,MAAM,QAAQ,KAAK;EAChC,IAAI;EACJ,IAAI;GACF,MAAM,WAAW,MAAM,UAAU,OAAO,MAAM;IAC5C,QAAQ;IACR,UAAU;GACZ,CAAC;GACD,SAAS,2BAA2B,MAAM,SAAS,OAAO;EAC5D,SAAS,OAAO;GACd,MAAM,IAAI,sBACR,KACA,iBAAiB,OAAO,aACpB,8BACA,8BACN;EACF;EACA,IAAI,OAAO,MAAM,OAAO,MAAA,IACtB,MAAM,IAAI,sBAAsB,KAAK,6CAA6C;EAEpF,IAAK,MAAM,oBAAoB,IAAI,MAAO,OAAO,YAC/C,MAAM,IAAI,sBAAsB,KAAK,mDAAmD;EAE1F,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,MAAM,IAAI;EACxB,QAAQ;GACN,MAAM,IAAI,sBAAsB,KAAK,sCAAsC;EAC7E;EACA,MAAM,SAAS,uBAAuB,UAAU,IAAI;EACpD,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,sBAAsB,KAAK,uCAAuC;EAE9E,OAAO;GAAE;GAAQ,SAAS,OAAO;EAAK;CACxC;AACF"}