@iann29/rastro 0.10.8 → 0.11.0

package/dist/component/leadFormStore.js

@@ -0,0 +1,92 @@
+import { labelChoices } from "./leadFormRules.js";
+/*
+ * Reads and clean-up of a form lead's record (`formLeads`), shared by the
+ * lead journey (leads.ts) and the Lead Ads module (metaLeads.ts).
+ */
+/** Where a form lead came from, with the names Rastro knows. */
+export async function formLeadOrigin(ctx, row) {
+    const link = await ctx.db
+        .query("sitePages")
+        .withIndex("by_pageId", (range) => range.eq("pageId", row.pageId))
+        .first();
+    const page = link ??
+        (await ctx.db
+            .query("metaPages")
+            .withIndex("by_pageId", (range) => range.eq("pageId", row.pageId))
+            .first());
+    const form = await ctx.db
+        .query("metaForms")
+        .withIndex("by_formId", (range) => range.eq("formId", row.formId))
+        .first();
+    const catalog = row.adId
+        ? await ctx.db
+            .query("adCatalog")
+            .withIndex("by_siteId_and_adId", (range) => range.eq("siteId", row.siteId).eq("adId", row.adId))
+            .unique()
+        : null;
+    return {
+        pageId: row.pageId,
+        pageName: page?.name ?? null,
+        formId: row.formId,
+        formName: form?.name ?? null,
+        adId: row.adId ?? null,
+        adName: catalog?.adName ?? null,
+        adsetId: row.adsetId ?? catalog?.adsetId ?? null,
+        adsetName: catalog?.adsetName ?? null,
+        campaignId: row.campaignId ?? catalog?.campaignId ?? null,
+        campaignName: catalog?.campaignName ?? null,
+        platform: row.platform ?? null,
+        isOrganic: row.isOrganic,
+    };
+}
+/** A form lead's answers, origin and path, for the lead journey. */
+export async function formLeadDetail(ctx, lead) {
+    const row = await ctx.db
+        .query("formLeads")
+        .withIndex("by_leadId", (range) => range.eq("leadId", lead._id))
+        .first();
+    if (!row)
+        return null;
+    const form = await ctx.db
+        .query("metaForms")
+        .withIndex("by_formId", (range) => range.eq("formId", row.formId))
+        .first();
+    return {
+        leadgenId: row.leadgenId,
+        receivedAt: row.receivedAt,
+        origin: await formLeadOrigin(ctx, row),
+        answers: labelChoices(form?.questions ?? [], row.answers),
+        decision: row.decision,
+        rulePath: row.rulePath,
+        ruleIndex: row.ruleIndex ?? null,
+        returned: row.returned ?? null,
+    };
+}
+/**
+ * Deletes a removed lead's ingestion record and leaves its leadgen id behind
+ * (nothing else), so the same Meta lead is never ingested again.
+ */
+export async function forgetFormLead(ctx, leadId) {
+    const rows = await ctx.db
+        .query("formLeads")
+        .withIndex("by_leadId", (range) => range.eq("leadId", leadId))
+        .take(10);
+    const now = Date.now();
+    for (const row of rows) {
+        await ctx.db.delete("formLeads", row._id);
+        if (!(await isForgottenFormLead(ctx, row.leadgenId))) {
+            await ctx.db.insert("formLeadTombstones", {
+                leadgenId: row.leadgenId,
+                removedAt: now,
+            });
+        }
+    }
+}
+/** Whether the host removed the lead Meta knows by this leadgen id. */
+export async function isForgottenFormLead(ctx, leadgenId) {
+    return ((await ctx.db
+        .query("formLeadTombstones")
+        .withIndex("by_leadgenId", (range) => range.eq("leadgenId", leadgenId))
+        .first()) !== null);
+}
+//# sourceMappingURL=leadFormStore.js.map

package/dist/component/leadFormStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leadFormStore.js","sourceRoot":"","sources":["../../src/component/leadFormStore.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;GAGG;AAEH,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAa,EACb,GAUC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE;SACtB,KAAK,CAAC,WAAW,CAAC;SAClB,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;SACjE,KAAK,EAAE,CAAC;IACX,MAAM,IAAI,GACR,IAAI;QACJ,CAAC,MAAM,GAAG,CAAC,EAAE;aACV,KAAK,CAAC,WAAW,CAAC;aAClB,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;aACjE,KAAK,EAAE,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE;SACtB,KAAK,CAAC,WAAW,CAAC;SAClB,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;SACjE,KAAK,EAAE,CAAC;IACX,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI;QACtB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;aACT,KAAK,CAAC,WAAW,CAAC;aAClB,SAAS,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,IAAK,CAAC,CACrD;aACA,MAAM,EAAE;QACb,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;QAC/B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO,EAAE,OAAO,IAAI,IAAI;QAChD,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;QACrC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,OAAO,EAAE,UAAU,IAAI,IAAI;QACzD,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,IAAI;QAC3C,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAa,EACb,IAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;SACrB,KAAK,CAAC,WAAW,CAAC;SAClB,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;SAC/D,KAAK,EAAE,CAAC;IACX,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE;SACtB,KAAK,CAAC,WAAW,CAAC;SAClB,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;SACjE,KAAK,EAAE,CAAC;IACX,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM,EAAE,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;QACtC,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC;QACzD,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAgB,EAChB,MAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE;SACtB,KAAK,CAAC,WAAW,CAAC;SAClB,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;SAC7D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE;gBACxC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAa,EACb,SAAiB;IAEjB,OAAO,CACL,CAAC,MAAM,GAAG,CAAC,EAAE;SACV,KAAK,CAAC,oBAAoB,CAAC;SAC3B,SAAS,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;SACtE,KAAK,EAAE,CAAC,KAAK,IAAI,CACrB,CAAC;AACJ,CAAC"}

package/dist/component/leadgenToken.d.ts

@@ -0,0 +1,56 @@
+export declare class LeadgenTokenError extends Error {
+    readonly reason: string;
+    readonly transient: boolean;
+    /**
+     * `transient`: the token could not be checked because the issuer's keys
+     * could not be read right now (unreachable, 5xx, 429, not JSON). The route
+     * answers 503 then, which the control plane retries; any other refusal is a
+     * 401, which it does not.
+     */
+    constructor(reason: string, transient?: boolean);
+}
+type Fetch = typeof fetch;
+/**
+ * The production dashboard's federation issuer: what the leadgen route trusts
+ * when the host passes no `RASTRO_FEDERATION_ISSUER`, as a host's federation
+ * API does. The audience has no default: it is the host's own functions URL.
+ */
+export declare const DEFAULT_FEDERATION_ISSUER = "https://site.api.amagerastro.com/federation";
+/**
+ * The issuer and audience the leadgen route checks forwards against, from the
+ * component's env. `audience` null means the route refuses every forward
+ * (`FEDERATION_NOT_CONFIGURED`), so a Page must not be linked or routed here.
+ */
+export declare function leadgenTrust(env: {
+    RASTRO_FEDERATION_ISSUER?: string;
+    RASTRO_FEDERATION_AUDIENCE?: string;
+}): {
+    issuer: string;
+    audience: string | null;
+};
+/** For tests: forget the cached keys. */
+export declare function clearLeadgenKeyCache(): void;
+export interface LeadgenTokenClaims {
+    connectionId: string;
+    organizationId: string;
+    version: number;
+    pageId: string;
+    leadgenId: string;
+}
+/**
+ * Checks a forwarding token: RS256 under one of the issuer's keys, the
+ * issuer and audience the host trusts, alive and short-lived, for the
+ * leadgen purpose, and bound to exactly this Page and leadgen id. Throws a
+ * `LeadgenTokenError` (no secret in its reason) when anything is off.
+ */
+export declare function verifyLeadgenToken(token: string, expected: {
+    issuer: string;
+    audience: string;
+    pageId: string;
+    leadgenId: string;
+}, options?: {
+    now?: number;
+    fetch?: Fetch;
+}): Promise<LeadgenTokenClaims>;
+export {};
+//# sourceMappingURL=leadgenToken.d.ts.map

package/dist/component/leadgenToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leadgenToken.d.ts","sourceRoot":"","sources":["../../src/component/leadgenToken.ts"],"names":[],"mappings":"AAyBA,qBAAa,iBAAkB,SAAQ,KAAK;IAQxC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,SAAS;IARpB;;;;;OAKG;IACH,YACW,MAAM,EAAE,MAAM,EACd,SAAS,UAAQ,EAI3B;CACF;AAGD,KAAK,KAAK,GAAG,OAAO,KAAK,CAAC;AAoC1B;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,gDACS,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAO9C;AAsFD,yCAAyC;AACzC,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE;IACR,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,EACD,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC5C,OAAO,CAAC,kBAAkB,CAAC,CAoI7B"}

package/dist/component/leadgenToken.js

@@ -0,0 +1,262 @@
+/*
+ * The control plane's word that Meta announced a lead: a short-lived RS256
+ * JWT signed with the federation issuer's key (the one the host already
+ * trusts for its dashboard connections), audience = the host's federation
+ * audience, bound to one Page and one leadgen id. A component has no
+ * `ctx.auth`, so the HTTP route checks it here against the issuer's published
+ * keys (`<issuer>/.well-known/openid-configuration` → `jwks_uri`). The token
+ * only says "go read this lead from Meta": the lead itself is always read
+ * from Meta with the Page's own token, so a replay at most repeats an
+ * idempotent read.
+ */
+import { META_LEADGEN_TOKEN } from "./constants.js";
+// The claim names, purpose, subject and lifetime come from
+// `META_LEADGEN_TOKEN` (constants.ts, contract §12.3): the control plane signs
+// with the same object.
+const CLAIMS = META_LEADGEN_TOKEN.claims;
+const CLOCK_SKEW_SECONDS = 60;
+const JWKS_TTL_MS = 5 * 60_000;
+const JWKS_REFRESH_MIN_MS = 60_000;
+const MAX_TOKEN = 8_192;
+const GRAPH_ID = /^\d{1,32}$/u;
+export class LeadgenTokenError extends Error {
+    reason;
+    transient;
+    /**
+     * `transient`: the token could not be checked because the issuer's keys
+     * could not be read right now (unreachable, 5xx, 429, not JSON). The route
+     * answers 503 then, which the control plane retries; any other refusal is a
+     * 401, which it does not.
+     */
+    constructor(reason, transient = false) {
+        super(reason);
+        this.reason = reason;
+        this.transient = transient;
+        this.name = "LeadgenTokenError";
+    }
+}
+const jwksCache = new Map();
+function base64UrlBytes(value) {
+    if (!/^[A-Za-z0-9_-]*$/u.test(value)) {
+        throw new LeadgenTokenError("token is not base64url");
+    }
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+    const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    return bytes;
+}
+function jsonPart(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(base64UrlBytes(value)));
+    }
+    catch (error) {
+        if (error instanceof LeadgenTokenError)
+            throw error;
+        throw new LeadgenTokenError("token part is not JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new LeadgenTokenError("token part is not an object");
+    }
+    return parsed;
+}
+const trimSlash = (value) => value.replace(/\/+$/u, "");
+/**
+ * The production dashboard's federation issuer: what the leadgen route trusts
+ * when the host passes no `RASTRO_FEDERATION_ISSUER`, as a host's federation
+ * API does. The audience has no default: it is the host's own functions URL.
+ */
+export const DEFAULT_FEDERATION_ISSUER = "https://site.api.amagerastro.com/federation";
+/**
+ * The issuer and audience the leadgen route checks forwards against, from the
+ * component's env. `audience` null means the route refuses every forward
+ * (`FEDERATION_NOT_CONFIGURED`), so a Page must not be linked or routed here.
+ */
+export function leadgenTrust(env) {
+    return {
+        issuer: trimSlash(env.RASTRO_FEDERATION_ISSUER?.trim() ?? "") ||
+            DEFAULT_FEDERATION_ISSUER,
+        audience: trimSlash(env.RASTRO_FEDERATION_AUDIENCE?.trim() ?? "") || null,
+    };
+}
+function sameOriginHttps(base, target) {
+    try {
+        const from = new URL(base);
+        const to = new URL(target);
+        const local = to.hostname === "localhost" || to.hostname === "127.0.0.1";
+        return (from.origin === to.origin &&
+            (to.protocol === "https:" || (to.protocol === "http:" && local)));
+    }
+    catch {
+        return false;
+    }
+}
+async function fetchJson(fetchImpl, target) {
+    let response;
+    try {
+        response = await fetchImpl(target, {
+            headers: { Accept: "application/json" },
+        });
+    }
+    catch {
+        throw new LeadgenTokenError("the issuer is unreachable", true);
+    }
+    if (!response.ok) {
+        throw new LeadgenTokenError(`the issuer answered ${response.status}`, response.status >= 500 || response.status === 429);
+    }
+    try {
+        return await response.json();
+    }
+    catch {
+        throw new LeadgenTokenError("the issuer answered something else than JSON", true);
+    }
+}
+/**
+ * The issuer's signing keys, cached for five minutes; `fetched` says whether
+ * they were read from the issuer just now (a forced refresh within a minute
+ * of the last read answers from the cache).
+ */
+async function issuerKeys(issuer, fetchImpl, now, refresh) {
+    const cached = jwksCache.get(issuer);
+    if (cached &&
+        now - cached.fetchedAt < JWKS_TTL_MS &&
+        !(refresh && now - cached.refreshedAt >= JWKS_REFRESH_MIN_MS)) {
+        return { keys: cached.keys, fetched: false };
+    }
+    const discovery = await fetchJson(fetchImpl, `${issuer}/.well-known/openid-configuration`);
+    const jwksUri = discovery &&
+        typeof discovery === "object" &&
+        typeof discovery.jwks_uri === "string"
+        ? discovery.jwks_uri
+        : `${issuer}/jwks.json`;
+    if (!sameOriginHttps(issuer, jwksUri)) {
+        throw new LeadgenTokenError("the issuer's jwks_uri is not its own");
+    }
+    const jwks = await fetchJson(fetchImpl, jwksUri);
+    const keys = jwks &&
+        typeof jwks === "object" &&
+        Array.isArray(jwks.keys)
+        ? jwks.keys.filter((key) => key && typeof key === "object")
+        : [];
+    jwksCache.set(issuer, { keys, fetchedAt: now, refreshedAt: now });
+    return { keys, fetched: true };
+}
+/** For tests: forget the cached keys. */
+export function clearLeadgenKeyCache() {
+    jwksCache.clear();
+}
+/**
+ * Checks a forwarding token: RS256 under one of the issuer's keys, the
+ * issuer and audience the host trusts, alive and short-lived, for the
+ * leadgen purpose, and bound to exactly this Page and leadgen id. Throws a
+ * `LeadgenTokenError` (no secret in its reason) when anything is off.
+ */
+export async function verifyLeadgenToken(token, expected, options = {}) {
+    const now = options.now ?? Date.now();
+    const fetchImpl = options.fetch ?? ((...args) => fetch(...args));
+    const issuer = trimSlash(expected.issuer.trim());
+    const audience = trimSlash(expected.audience.trim());
+    if (!issuer || !audience) {
+        throw new LeadgenTokenError("the host has no federation issuer");
+    }
+    if (token.length > MAX_TOKEN)
+        throw new LeadgenTokenError("token too long");
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        throw new LeadgenTokenError("token is not a JWT");
+    const [headerPart, payloadPart, signaturePart] = parts;
+    const header = jsonPart(headerPart);
+    if (header.alg !== "RS256") {
+        throw new LeadgenTokenError("token is not RS256");
+    }
+    const claims = jsonPart(payloadPart);
+    // The cheap checks first: a token for something else costs no key fetch.
+    const seconds = Math.floor(now / 1000);
+    const aud = claims.aud;
+    const audiences = (Array.isArray(aud) ? aud : [aud]).map((value) => typeof value === "string" ? trimSlash(value) : "");
+    const exp = claims.exp;
+    const iat = claims.iat;
+    if (typeof claims.iss !== "string" || trimSlash(claims.iss) !== issuer) {
+        throw new LeadgenTokenError("token issuer is not trusted");
+    }
+    if (!audiences.includes(audience)) {
+        throw new LeadgenTokenError("token audience is not this host");
+    }
+    if (typeof exp !== "number" || exp + CLOCK_SKEW_SECONDS < seconds) {
+        throw new LeadgenTokenError("token expired");
+    }
+    if (typeof iat !== "number" ||
+        iat - CLOCK_SKEW_SECONDS > seconds ||
+        exp - iat > META_LEADGEN_TOKEN.maxLifetimeSeconds) {
+        throw new LeadgenTokenError("token lifetime is not a forwarding one");
+    }
+    if (claims[CLAIMS.purpose] !== META_LEADGEN_TOKEN.purpose ||
+        claims.sub !== META_LEADGEN_TOKEN.subject) {
+        throw new LeadgenTokenError("token is not for a leadgen");
+    }
+    const organizationId = claims[CLAIMS.organizationId];
+    const version = claims[CLAIMS.version];
+    if (typeof organizationId !== "string" ||
+        organizationId.length === 0 ||
+        organizationId.length > 128 ||
+        typeof version !== "number" ||
+        !Number.isSafeInteger(version) ||
+        version < 0) {
+        throw new LeadgenTokenError("token names no organization");
+    }
+    const connectionId = claims[CLAIMS.connectionId];
+    if (typeof connectionId !== "string" ||
+        connectionId.length === 0 ||
+        connectionId.length > 128) {
+        throw new LeadgenTokenError("token names no connection");
+    }
+    if (claims[CLAIMS.pageId] !== expected.pageId ||
+        claims[CLAIMS.leadgenId] !== expected.leadgenId ||
+        !GRAPH_ID.test(expected.pageId) ||
+        !GRAPH_ID.test(expected.leadgenId)) {
+        throw new LeadgenTokenError("token is for another lead");
+    }
+    const kid = typeof header.kid === "string" ? header.kid : null;
+    const pick = (keys) => keys.filter((key) => key.kty === "RSA" &&
+        typeof key.n === "string" &&
+        typeof key.e === "string" &&
+        (kid === null || key.kid === undefined || key.kid === kid));
+    let candidates = pick((await issuerKeys(issuer, fetchImpl, now, false)).keys);
+    if (candidates.length === 0) {
+        // A rotated key: read the issuer again (at most once a minute).
+        const again = await issuerKeys(issuer, fetchImpl, now, true);
+        candidates = pick(again.keys);
+        if (candidates.length === 0) {
+            // Keys read a moment ago may predate the rotation: transient (503,
+            // retried) until the issuer has been read again.
+            throw new LeadgenTokenError(again.fetched
+                ? "no issuer key matches the token"
+                : "no issuer key matches the token yet", !again.fetched);
+        }
+    }
+    const data = new TextEncoder().encode(`${headerPart}.${payloadPart}`);
+    const signature = base64UrlBytes(signaturePart);
+    for (const jwk of candidates) {
+        let key;
+        try {
+            key = await crypto.subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e, ext: true }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+        }
+        catch {
+            continue;
+        }
+        if (await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, signature, data)) {
+            return {
+                connectionId,
+                organizationId,
+                version,
+                pageId: expected.pageId,
+                leadgenId: expected.leadgenId,
+            };
+        }
+    }
+    throw new LeadgenTokenError("token signature is invalid");
+}
+//# sourceMappingURL=leadgenToken.js.map

package/dist/component/leadgenToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leadgenToken.js","sourceRoot":"","sources":["../../src/component/leadgenToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,2DAA2D;AAC3D,+EAA+E;AAC/E,wBAAwB;AACxB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC;AAEzC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC;AAC/B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,QAAQ,GAAG,aAAa,CAAC;AAE/B,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAQ/B,MAAM;IACN,SAAS;IARpB;;;;;OAKG;IACH,YACW,MAAc,EACd,SAAS,GAAG,KAAK;QAE1B,KAAK,CAAC,MAAM,CAAC,CAAC;sBAHL,MAAM;yBACN,SAAS;QAGlB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAKD,MAAM,SAAS,GAAG,IAAI,GAAG,EAGtB,CAAC;AAEJ,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAC;QACpD,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,6CAA6C,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAG5B;IACC,OAAO;QACL,MAAM,EACJ,SAAS,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACrD,yBAAyB;QAC3B,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,MAAc;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,KAAK,WAAW,IAAI,EAAE,CAAC,QAAQ,KAAK,WAAW,CAAC;QACzE,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;YACzB,CAAC,EAAE,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,SAAgB,EAAE,MAAc;IACvD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;YACjC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,QAAQ,CAAC,MAAM,EAAE,EACxC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,EAC9C,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,MAAc,EACd,SAAgB,EAChB,GAAW,EACX,OAAgB;IAEhB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IACE,MAAM;QACN,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,WAAW;QACpC,CAAC,CAAC,OAAO,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC,EAC7D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,SAAS,EACT,GAAG,MAAM,mCAAmC,CAC7C,CAAC;IACF,MAAM,OAAO,GACX,SAAS;QACT,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAQ,SAAoC,CAAC,QAAQ,KAAK,QAAQ;QAChE,CAAC,CAAE,SAAkC,CAAC,QAAQ;QAC9C,CAAC,CAAC,GAAG,MAAM,YAAY,CAAC;IAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,sCAAsC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,IAAI,GACR,IAAI;QACJ,OAAO,IAAI,KAAK,QAAQ;QACxB,KAAK,CAAC,OAAO,CAAE,IAA2B,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAG,IAA4B,CAAC,IAAI,CAAC,MAAM,CACxC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAC9B;QACb,CAAC,CAAC,EAAE,CAAC;IACT,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,oBAAoB;IAClC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,QAKC,EACD,OAAO,GAAoC,EAAE;IAE7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IAC1E,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAIhD,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAErC,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACjE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAClD,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;QACvE,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,kBAAkB,GAAG,OAAO,EAAE,CAAC;QAClE,MAAM,IAAI,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IACD,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,GAAG,kBAAkB,GAAG,OAAO;QAClC,GAAG,GAAG,GAAG,GAAG,kBAAkB,CAAC,kBAAkB,EACjD,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,CAAC,CAAC;IACxE,CAAC;IACD,IACE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,kBAAkB,CAAC,OAAO;QACrD,MAAM,CAAC,GAAG,KAAK,kBAAkB,CAAC,OAAO,EACzC,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,IACE,OAAO,cAAc,KAAK,QAAQ;QAClC,cAAc,CAAC,MAAM,KAAK,CAAC;QAC3B,cAAc,CAAC,MAAM,GAAG,GAAG;QAC3B,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC,EACX,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,IACE,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,GAAG,EACzB,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,MAAM;QACzC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,SAAS;QAC/C,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAClC,CAAC;QACD,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAG,CAAC,IAAW,EAAE,EAAE,CAC3B,IAAI,CAAC,MAAM,CACT,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,GAAG,KAAK,KAAK;QACjB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzB,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAC7D,CAAC;IACJ,IAAI,UAAU,GAAG,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,gEAAgE;QAChE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7D,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,mEAAmE;YACnE,iDAAiD;YACjD,MAAM,IAAI,iBAAiB,CACzB,KAAK,CAAC,OAAO;gBACX,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,qCAAqC,EACzC,CAAC,KAAK,CAAC,OAAO,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,WAAW,EAAE,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAc,CAAC;QACnB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACjC,KAAK,EACL,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAW,EAAE,CAAC,EAAE,GAAG,CAAC,CAAW,EAAE,GAAG,EAAE,IAAI,EAAE,EACjE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1E,OAAO;gBACL,YAAY;gBACZ,cAAc;gBACd,OAAO;gBACP,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;AAC5D,CAAC"}

package/dist/component/leads.d.ts

@@ -1,8 +1,19 @@
-import type { Id } from "./_generated/dataModel.js";
+import { type Infer } from "convex/values";
+import type { Doc, Id } from "./_generated/dataModel.js";
+import { type MutationCtx } from "./_generated/server.js";
+import { leadAdValidator } from "./validators.js";
 /** Every lead from any ad falls in this origin bucket, whatever its entry point. */
 export declare const AD_ORIGIN = "ctwa_ad";
 /** The bucket for a lead the channel gave no entry point for. */
 export declare const NO_ORIGIN = "none";
+/**
+ * A Meta instant form's leads (since 0.11.0): `lead_form` when an ad brought
+ * them, so they count as paid next to `ctwa_ad`; `lead_form_organic` when the
+ * form was filled without an ad.
+ */
+export declare const LEAD_FORM_ORIGIN = "lead_form";
+export declare const LEAD_FORM_ORGANIC_ORIGIN = "lead_form_organic";
+type LeadAd = Infer<typeof leadAdValidator>;
 type Counters = {
     leads: number;
     qualified: number;
@@ -22,7 +33,7 @@ export declare const record: import("convex/server").RegisteredMutation<"public"
         sourceUrl?: string | undefined;
         title?: string | undefined;
     } | undefined;
-    channel: "whatsapp";
+    channel: "form" | "whatsapp";
     column?: string | undefined;
     entryPoint?: string | undefined;
     label?: string | undefined;
@@ -32,9 +43,32 @@ export declare const record: import("convex/server").RegisteredMutation<"public"
     siteId: import("convex/values").GenericId<"sites">;
     visitorId?: string | undefined;
 }, Promise<{
-    leadId: import("convex/values").GenericId<"leads">;
+    leadId: Id<"leads">;
     created: boolean;
 }>>;
+/**
+ * `record`'s body, shared with the Lead Ads ingestion (metaLeads.ts), which
+ * also files the lead under its instant form (`form`).
+ */
+export declare function recordLeadCore(ctx: MutationCtx, args: {
+    siteId: Id<"sites">;
+    leadKey: string;
+    channel: Doc<"leads">["channel"];
+    entryPoint?: string | undefined;
+    ad?: LeadAd | undefined;
+    label?: string | undefined;
+    visitorId?: string | undefined;
+    column?: string | undefined;
+    occurredAt: number;
+    meta?: unknown;
+    form?: {
+        formId: string;
+        pageId: string;
+    } | undefined;
+}): Promise<{
+    leadId: Id<"leads">;
+    created: boolean;
+}>;
 /**
  * Moves a lead through the host's pipeline, idempotent by `eventId`. A lead the
  * host never recorded (a conversation older than the integration) is not
@@ -171,8 +205,9 @@ export declare const report: import("convex/server").RegisteredQuery<"public", {
 /**
  * The lead funnel per cohort day, for sparklines and the sales × spend chart:
  * every UTC day in the range, empty days included. With `adId`, only that
- * ad's leads; with `origin`, only that origin's (`ctwa_ad` for the leads the
- * ads bought). Spend is the day's Meta spend for the same scope, null where
+ * ad's leads; with `origin`, only that origin's (`ctwa_ad` for the
+ * click-to-WhatsApp ads, `paid` for every lead an ad bought: `ctwa_ad` and
+ * `lead_form`). Spend is the day's Meta spend for the same scope, null where
  * no synced ad account covers it, for an organic origin, or when the sites'
  * accounts bill in more than one currency.
  */
@@ -203,7 +238,7 @@ export declare const list: import("convex/server").RegisteredQuery<"public", {
     to: number;
 }, Promise<{
     adId: string | null;
-    channel: "whatsapp";
+    channel: "form" | "whatsapp";
     entryPoint: string | null;
     firstAt: number;
     hasVisitor: boolean;
@@ -223,7 +258,7 @@ export declare const journey: import("convex/server").RegisteredQuery<"public",
 }, Promise<{
     lead: {
         adId: string | null;
-        channel: "whatsapp";
+        channel: "form" | "whatsapp";
         entryPoint: string | null;
         firstAt: number;
         hasVisitor: boolean;
@@ -246,6 +281,40 @@ export declare const journey: import("convex/server").RegisteredQuery<"public",
         title: string | null;
     } | null;
     visitorId: string | null;
+    form?: {
+        answers: {
+            label: string;
+            questionKey: string;
+            values: string[];
+        }[];
+        decision: {
+            column: string | null;
+        } | {
+            discard: string;
+        };
+        leadgenId: string;
+        origin: {
+            adId: string | null;
+            adName: string | null;
+            adsetId: string | null;
+            adsetName: string | null;
+            campaignId: string | null;
+            campaignName: string | null;
+            formId: string;
+            formName: string | null;
+            isOrganic: boolean;
+            pageId: string;
+            pageName: string | null;
+            platform: string | null;
+        };
+        receivedAt: number;
+        returned: {
+            at: number;
+            reason: string;
+        } | null;
+        ruleIndex: number | null;
+        rulePath: number[];
+    } | null | undefined;
     events: {
         type: "created" | "lost" | "open" | "qualified" | "won";
         at: number;

package/dist/component/leads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"leads.d.ts","sourceRoot":"","sources":["../../src/component/leads.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAO,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAoEzD,oFAAoF;AACpF,eAAO,MAAM,SAAS,YAAY,CAAC;AACnC,iEAAiE;AACjE,eAAO,MAAM,SAAS,SAAS,CAAC;AAGhC,KAAK,QAAQ,GAAG;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAoIF;;;;GAIG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;GAoGjB,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;GAuInB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,MAAM;;;;;GA0BjB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;GAgE1B,CAAC;AAgNH;;;GAGG;AACH,eAAO,MAAM,MAAM;;;;;;;;;eA3rBV,MAAM;mBACF,MAAM;aACZ,MAAM;sBACG,MAAM;;;;;;eAHb,MAAM;mBACF,MAAM;aACZ,MAAM;sBACG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAHb,MAAM;mBACF,MAAM;aACZ,MAAM;sBACG,MAAM;;;;;;;;;;GAs+BpB,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK;;;;;;;WAn/BT,MAAM;eACF,MAAM;SACZ,MAAM;kBACG,MAAM;;;KA+lCpB,CAAC;AAsBH;;;GAGG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;KAsDf,CAAC;AAEH,+CAA+C;AAC/C,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAyClB,CAAC"}
+{"version":3,"file":"leads.d.ts","sourceRoot":"","sources":["../../src/component/leads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAK,KAAK,KAAK,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAGL,KAAK,WAAW,EAEjB,MAAM,wBAAwB,CAAC;AA8BhC,OAAO,EAEL,eAAe,EAShB,MAAM,iBAAiB,CAAC;AAuBzB,oFAAoF;AACpF,eAAO,MAAM,SAAS,YAAY,CAAC;AACnC,iEAAiE;AACjE,eAAO,MAAM,SAAS,SAAS,CAAC;AAChC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAC5C,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAS5D,KAAK,MAAM,GAAG,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAC5C,KAAK,QAAQ,GAAG;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAwIF;;;;GAIG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;YA2CE,EAAE,CAAC,OAAO,CAAC;aAAW,OAAO;GArBhD,CAAC;AAEH;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE;IACJ,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACvD,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA+EpD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;GAuInB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,MAAM;;;;;GA2BjB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;GAgE1B,CAAC;AAgNH;;;GAGG;AACH,eAAO,MAAM,MAAM;;;;;;;;;eAttBV,MAAM;mBACF,MAAM;aACZ,MAAM;sBACG,MAAM;;;;;;eAHb,MAAM;mBACF,MAAM;aACZ,MAAM;sBACG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAHb,MAAM;mBACF,MAAM;aACZ,MAAM;sBACG,MAAM;;;;;;;;;;GAigCpB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,KAAK;;;;;;;WA/gCT,MAAM;eACF,MAAM;SACZ,MAAM;kBACG,MAAM;;;KAioCpB,CAAC;AAsBH;;;GAGG;AACH,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;KAsDf,CAAC;AAEH,+CAA+C;AAC/C,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA2ClB,CAAC"}