@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/routes/v1/api/review.js

@@ -0,0 +1,302 @@
+/**
+ * A claim's review, its erasure and its report (go-prod spec §3.4, §4.2, §6.3, §10). The review and
+ * erase routes find the claim through `claimOf` — another source's, one outside a member's
+ * `nb.protocols`, or a linked collection's chain claim (its body is not ours to show or erase) is
+ * `404`, never `403` (§14); the report, a read, through `readableClaimOf`.
+ *
+ * `GET …/review` is the ONLY read that returns a claim's answers (§3.4 `claims/review`), and only
+ * while the claim awaits review: every successful read is a `claim.review_viewed` audit row, and
+ * neither the answers nor the file URLs ever go in a log line or an audit `details`. The POST's
+ * checks are `answerApiReview`'s (lib/api-lane/review.ts), which answers refusals as values; this
+ * file only puts them in the envelope. The report is the engine's, proxied under the oracle's UCAN.
+ */
+import { and, eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { accepts } from "hono/accepts";
+import { Attachment, covers, ReviewRequest, } from "../../../contracts/index.js";
+import { apiClaims, apiUploads, claimAttachmentCids, decisions } from "../../../db/schema.js";
+import { apiScopeId } from "../../../lib/api-lane/ids.js";
+import { claimRecord } from "../../../lib/api-lane/record.js";
+import { eraseClaimBody } from "../../../lib/api-lane/retention.js";
+import { answerApiReview } from "../../../lib/api-lane/review.js";
+import { createEngineClient } from "../../../lib/engine/client.js";
+import { EngineError, Verdict, } from "../../../lib/engine/types.js";
+import { oracleOwnerDid } from "../../../lib/review/reviewer-grant.js";
+import { reportError } from "../../../lib/sentry.js";
+import { validate } from "../../../lib/validator.js";
+import { audit } from "../../../middleware/api/audit.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { idempotent } from "../../../middleware/api/idempotency.js";
+import { ClaimParam, claimOf, readableClaimOf } from "./claims-read.js";
+import { signedFileUrl } from "./uploads.js";
+export const review = new Hono();
+const notPending = () => new ApiError("NOT_PENDING_REVIEW", "This claim isn't waiting for review answers; it may already be decided. Reload it to see its current status.");
+review.get("/claims/:claimId/review", access({ op: "getClaimReview", scope: "claims:write", capability: "claims/review" }), async (c) => {
+    const claim = await claimOf(c, c.req.param("claimId"));
+    const db = await c.var.db();
+    const [row, decision, record] = await Promise.all([
+        db.query.apiClaims.findFirst({
+            columns: { body: true, attachments: true, bodyErasedAt: true },
+            where: eq(apiClaims.claimId, claim.claimId),
+        }),
+        db.query.decisions.findFirst({
+            columns: { status: true, resultDigest: true, pendingTaskDetails: true },
+            where: eq(decisions.claimId, claim.claimId),
+        }),
+        // The record's tasks: the latest `review_required` event's, as the reviewer was asked them
+        // (record.ts) — never a fresh manifest read.
+        claimRecord(db, claim.claimId),
+    ]);
+    const block = await reviewBlockOf(c, sourceOf(c));
+    // Answered but not yet folded is still `pending_review`: the fold flips the status and stamps
+    // `foldedAt` in one batch. An erased body can never fold (retention.ts), so it is not pending.
+    if (decision?.status !== "pending_review" ||
+        !decision.resultDigest ||
+        !row?.body ||
+        row.bodyErasedAt ||
+        !record?.review) {
+        throw notPending();
+    }
+    const files = (await filesOf(c, claim.claimId, row.attachments)).map(({ file }) => file);
+    const duplicates = await duplicatesOf(c, claim, decision.pendingTaskDetails);
+    // Before the answers leave: a view the audit log does not hold must not have happened.
+    await audit(c, "claim.review_viewed", claim.claimId);
+    return c.json({
+        claimId: claim.claimId,
+        protocolDid: claim.protocolDid,
+        resultDigest: decision.resultDigest,
+        pendingTasks: record.review.pendingTasks,
+        answers: row.body,
+        files,
+        submittedAt: claim.receivedAt.toISOString(),
+        // Past it the claim still shows (the console marks it closed); an answer is `REVIEW_EXPIRED`.
+        answerBy: record.review.answerBy,
+        canAnswer: block ? { ok: false, reason: block } : { ok: true },
+        ...(record.decision?.erroredFacts ? { erroredFacts: record.decision.erroredFacts } : {}),
+        ...(duplicates.length > 0 ? { duplicates } : {}),
+    });
+});
+/**
+ * A claim's files as a reviewer opens them, each with the CID it was registered under when it has
+ * one. The stored descriptors are the accepted request's; an upload is a short-lived signed read,
+ * typed by what the upload route sniffed (the request's `mediaType` is a claim, usually absent).
+ * A URL's type was filled at accept (api-lane/media-type.ts). The claim's own upload rows
+ * (`api_uploads_claim_idx`), as the evaluate step reads them (api-lane/source.ts) — never an `IN`
+ * of up to 100 ids against D1's 100 bound parameters.
+ */
+async function filesOf(c, claimId, stored) {
+    const db = await c.var.db();
+    const uploads = await db.query.apiUploads.findMany({
+        columns: { uploadId: true, mediaType: true },
+        where: eq(apiUploads.claimId, claimId),
+    });
+    const sniffed = new Map(uploads.map((u) => [u.uploadId, u.mediaType]));
+    const attachments = (stored ?? []).flatMap((raw) => {
+        const a = Attachment.safeParse(raw);
+        return a.success ? [a.data] : [];
+    });
+    return Promise.all(attachments.map(async (a) => ({
+        cid: a.cid ?? null,
+        file: {
+            question: a.question,
+            name: a.name ?? null,
+            mediaType: ("uploadId" in a ? sniffed.get(a.uploadId) : undefined) ?? a.mediaType ?? null,
+            url: "url" in a ? a.url : await signedFileUrl(c, a.uploadId),
+        },
+    })));
+}
+/**
+ * The review view's `duplicates` (1.24.0): one per pending `unique:` task the engine detailed. The
+ * prior's outcome is this oracle's own decision on it. Its id, date and files only when it is this
+ * source's claim under the same protocol — the registry scope (`apiScopeId`) the duplicate lane
+ * matched in, so another organisation's claim never shows. Its files are the ones whose CID this
+ * claim also registered (`claim_attachment_cids`); a near-image match shares no CID, and then the
+ * prior's images are the evidence.
+ */
+async function duplicatesOf(c, claim, details) {
+    const db = await c.var.db();
+    const scope = apiScopeId(claim.sourceId, claim.protocolDid);
+    const out = [];
+    for (const [taskId, d] of Object.entries(details ?? {})) {
+        if (d.kind !== "duplicate" || !taskId.startsWith("unique:"))
+            continue;
+        const priorId = d.priorClaimId;
+        const [decided, prior] = priorId
+            ? await Promise.all([
+                db.query.decisions.findFirst({
+                    columns: { verdict: true },
+                    where: eq(decisions.claimId, priorId),
+                }),
+                db.query.apiClaims.findFirst({
+                    columns: { sourceId: true, protocolDid: true, attachments: true, receivedAt: true },
+                    where: eq(apiClaims.claimId, priorId),
+                }),
+            ])
+            : [undefined, undefined];
+        const outcome = Verdict.safeParse(decided?.verdict).data ?? null;
+        const sameOrg = priorId && prior?.sourceId === claim.sourceId && prior.protocolDid === claim.protocolDid;
+        let same = null;
+        if (sameOrg) {
+            const cidsOf = async (id) => new Set((await db
+                .select({ cid: claimAttachmentCids.cid })
+                .from(claimAttachmentCids)
+                .where(and(eq(claimAttachmentCids.collectionId, scope), eq(claimAttachmentCids.claimId, id)))).map((r) => r.cid));
+            const [mine, theirs] = await Promise.all([cidsOf(claim.claimId), cidsOf(priorId)]);
+            const files = await filesOf(c, priorId, prior.attachments);
+            const matched = files.filter((f) => f.cid && mine.has(f.cid) && theirs.has(f.cid));
+            const shown = matched.length > 0 ? matched : files.filter((f) => f.file.mediaType?.startsWith("image/"));
+            same = {
+                claimId: priorId,
+                submittedAt: prior.receivedAt.toISOString(),
+                files: shown.map(({ file }) => file),
+            };
+        }
+        out.push({
+            taskId,
+            ruleId: d.ruleId,
+            ...(d.score !== undefined ? { score: d.score } : {}),
+            prior: { outcome, ...same },
+        });
+    }
+    return out;
+}
+/**
+ * Why `caller` can answer no review on its source (`ReviewBlock`), or null — the console's hint on
+ * the review read and `/me`, so it disables the form instead of meeting a 403. Only the cheap and
+ * certain cases: the answer itself runs every check (`answerApiReview`) whatever this said. A key
+ * signs nothing (it may relay a member's signed answer); an AI app needs `claims:write` too. The
+ * protocol limit needs no check here: the review read already 404s a claim outside it.
+ */
+export async function reviewBlockOf(c, caller) {
+    if (caller.kind === "key")
+        return "not-reviewer";
+    if (caller.did === (await hintOwner(c)))
+        return "oracle-owner";
+    const reviews = covers(caller.capabilities, "claims/review") &&
+        (caller.kind !== "oauth" || caller.scopes.includes("claims:write"));
+    return reviews ? null : "not-reviewer";
+}
+/** The owner for a HINT: a broken `OWNER_DELEGATION_CAR` must not take the console down with it —
+ *  reported, and read as no owner. The answer and the fold stay loud (`assertNotOracle`), and
+ *  `/health/ready` fails its `owner-delegation` check. */
+async function hintOwner(c) {
+    try {
+        return await oracleOwnerDid(c.get("config"));
+    }
+    catch (err) {
+        reportError(err, { lane: "api", step: "review-hint" });
+        return null;
+    }
+}
+review.post("/claims/:claimId/review", access({ op: "submitReview", scope: "claims:write", capability: "claims/review" }), idempotent(), validate("json", ReviewRequest), async (c) => {
+    const caller = sourceOf(c);
+    const claim = await claimOf(c, c.req.param("claimId"));
+    const result = await answerApiReview(c.env, {
+        sourceId: caller.source.sourceId,
+        claimId: claim.claimId,
+        request: c.req.valid("json"),
+        // A root (a current controller invoking as itself) answers in its own name (owner 2026-10-10).
+        ...(caller.kind === "member" && caller.controller ? { controllerDid: caller.did } : {}),
+    });
+    if (!result.ok)
+        throw new ApiError(result.code, result.message, result.details);
+    // The task ids only: an answer value never outlives the body in the 2-year log.
+    await audit(c, "claim.review_answered", claim.claimId, {
+        tasks: Object.keys(result.review.answers),
+    });
+    return c.json(result.review, 202);
+});
+review.delete("/claims/:claimId/body", access({ op: "eraseClaimBody", scope: "claims:write", capability: "settings/manage" }), idempotent(), async (c) => {
+    const claim = await claimOf(c, c.req.param("claimId"));
+    const db = await c.var.db();
+    // A run that already pulled the body would write its transcripts and registry text back after
+    // the erase. A `queued` claim is safe: its pull reads the erased body and fails closed.
+    const ingest = await db.query.claimIngests.findFirst({
+        columns: { status: true },
+        where: (t, { eq: eqOp }) => eqOp(t.claimId, claim.claimId),
+    });
+    if (ingest?.status === "processing") {
+        throw new ApiError("CONFLICT", `Claim ${claim.claimId} is still being decided; erase it once it's decided.`);
+    }
+    // Already erased is the same 204 (the op is idempotent); only the erase itself is audited.
+    if (await eraseClaimBody(db, c.env.API_UPLOADS, claim.claimId)) {
+        await audit(c, "claim.body_erased", claim.claimId);
+        c.get("metrics").count("claims.erased", 1, { op: "api" });
+    }
+    return c.body(null, 204);
+});
+review.get("/claims/:claimId/report", access({ op: "getClaimReport", scope: "claims:read", capability: "claims/read" }), validate("param", ClaimParam), async (c) => {
+    const claim = await readableClaimOf(c, c.req.valid("param").claimId);
+    return reportResponse(c, claim.claimId);
+});
+/**
+ * The claim's report as the caller's `Accept` asks — JSON, or a self-contained HTML page. Shared
+ * with the operator view (admin-claims.ts); the caller has already proved it may see the claim.
+ */
+export async function reportResponse(c, claimId) {
+    const db = await c.var.db();
+    const row = await db.query.decisions.findFirst({
+        columns: { receiptCid: true },
+        where: eq(decisions.claimId, claimId),
+    });
+    // The report is read off the signed receipt: none yet (pending review, a facts-lane outcome)
+    // ⇒ nothing to report, as on the receipt route.
+    const noReport = () => new ApiError("NOT_FOUND", `Claim ${claimId} has no report yet: it is still being decided or is waiting for review. Check again once it has a decision.`);
+    if (!row?.receiptCid)
+        throw noReport();
+    const report = await engineReport(c, row.receiptCid);
+    if (!report)
+        throw noReport();
+    const type = accepts(c, {
+        header: "Accept",
+        supports: ["application/json", "text/html"],
+        default: "application/json",
+    });
+    if (type !== "text/html")
+        return c.json({ claimId, ...report });
+    c.header("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'");
+    return c.html(reportHtml(claimId, report));
+}
+/** The engine's report, or null; its 403 (not our decision — cannot happen for our own row, but
+ *  never leaks as one) is a 404 too, and an engine outage is `503 UNAVAILABLE`. */
+async function engineReport(c, cid) {
+    const engine = createEngineClient({
+        config: c.get("config"),
+        logger: c.get("logger"),
+        trace: c.get("trace"),
+        cache: c.env.CACHE_KV,
+    });
+    try {
+        return await engine.report(cid);
+    }
+    catch (err) {
+        if (err instanceof EngineError) {
+            if (err.status === 403 || err.status === 404)
+                return null;
+            if (err.retryable)
+                throw new ApiError("UNAVAILABLE", "The decision engine is unavailable right now. Nothing was lost — retry in a moment.");
+        }
+        throw err;
+    }
+}
+// --- the HTML view ---------------------------------------------------------------------------------
+const HEADLINE = {
+    approve: "Approved",
+    partial: "Partially approved",
+    reject: "Rejected",
+    review: "Awaiting review",
+};
+/** Every interpolated value goes through this — the engine's explanation is text, never markup. */
+const esc = (v) => String(v).replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+const table = (head, rows) => rows.length === 0
+    ? ""
+    : `<table><tr>${head.map((h) => `<th>${esc(h)}</th>`).join("")}</tr>${rows
+        .map((r) => `<tr>${r.map((v) => `<td>${esc(v)}</td>`).join("")}</tr>`)
+        .join("")}</table>`;
+const pct = (bps) => (bps == null ? "—" : `${(bps / 100).toFixed(2)}%`);
+/** A self-contained page: no script, no external asset, inline styles only (the CSP above). */
+function reportHtml(claimId, r) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Decision ${esc(claimId)}</title><style>body{font:15px/1.5 system-ui,sans-serif;max-width:48rem;margin:2rem auto;padding:0 1rem;color:#1a1a1a}table{border-collapse:collapse;width:100%;margin:.5rem 0 1.5rem}th,td{text-align:left;padding:.3rem .5rem;border-bottom:1px solid #ddd}code{font-size:.85em}</style></head><body><h1>${esc(HEADLINE[r.verdict])}</h1><p><code>${esc(claimId)}</code></p><p>${esc(r.explanation)}</p><h2>Gates</h2>${table(["Gate", "Outcome"], r.gates.map((g) => [g.code, g.outcome]))}<h2>Criteria</h2>${table(["Criterion", "Score", "Weight", "Pending"], r.criteria.map((k) => [k.code, pct(k.scoreBps), pct(k.weightBps), k.pending ? "yes" : "no"]))}</body></html>`;
+}
+//# sourceMappingURL=review.js.map

package/dist/routes/v1/api/review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EACL,UAAU,EACV,MAAM,EAEN,aAAa,GAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,WAAW,EAGX,OAAO,GACR,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,IAAI,EAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,GAAG,EAAE,CACtB,IAAI,QAAQ,CACV,oBAAoB,EACpB,8GAA8G,CAC/G,CAAC;AAEJ,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,EACpF,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YAC9D,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;SAC5C,CAAC;QACF,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE;YACvE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;SAC5C,CAAC;QACF,2FAA2F;QAC3F,6CAA6C;QAC7C,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,8FAA8F;IAC9F,+FAA+F;IAC/F,IACE,QAAQ,EAAE,MAAM,KAAK,gBAAgB;QACrC,CAAC,QAAQ,CAAC,YAAY;QACtB,CAAC,GAAG,EAAE,IAAI;QACV,GAAG,CAAC,YAAY;QAChB,CAAC,MAAM,EAAE,MAAM,EACf,CAAC;QACD,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC7E,uFAAuF;IACvF,MAAM,KAAK,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY;QACxC,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,KAAK;QACL,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;QAC3C,8FAA8F;QAC9F,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QAChC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;QAC9D,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AAC1B,CAAC,CACF,CAAC;AAIF;;;;;;;GAOG;AACH,KAAK,UAAU,OAAO,CACpB,CAAa,EACb,OAAe,EACf,MAAwB;IAExB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QACjD,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;QAC5C,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACjD,MAAM,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,GAAG,CAChB,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI;QAClB,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;YACpB,SAAS,EAAE,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI;YACzF,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;SAC7D;KACF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CACzB,CAAa,EACb,KAAiE,EACjE,OAAiD;IAEjD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,GAAG,GAA0C,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACtE,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC;QAC/B,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO;YAC9B,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;oBAC3B,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;oBAC1B,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;iBACtC,CAAC;gBACF,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;oBAC3B,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;oBACnF,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;iBACtC,CAAC;aACH,CAAC;YACJ,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;QACjE,MAAM,OAAO,GACX,OAAO,IAAI,KAAK,EAAE,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC;QAC3F,IAAI,IAAI,GAAyE,IAAI,CAAC;QACtF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE,CAClC,IAAI,GAAG,CACL,CACE,MAAM,EAAE;iBACL,MAAM,CAAC,EAAE,GAAG,EAAE,mBAAmB,CAAC,GAAG,EAAE,CAAC;iBACxC,IAAI,CAAC,mBAAmB,CAAC;iBACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,KAAK,CAAC,EAC3C,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC,CACpC,CACF,CACJ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CACpB,CAAC;YACJ,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACnF,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7F,IAAI,GAAG;gBACL,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC3C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC;aACrC,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,CAAa,EACb,MAAoB;IAEpB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,cAAc,CAAC;IACjD,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IAC/D,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;QAC5C,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;AACzC,CAAC;AAED;;0DAE0D;AAC1D,KAAK,UAAU,SAAS,CAAC,CAAa;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,EAClF,UAAU,EAAE,EACZ,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,EAC/B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE;QAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5B,+FAA+F;QAC/F,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAChF,gFAAgF;IAChF,MAAM,KAAK,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,OAAO,EAAE;QACrD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;KAC1C,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,CACX,uBAAuB,EACvB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,EACtF,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;QACnD,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACzB,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,MAAM,EAAE,MAAM,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,SAAS,KAAK,CAAC,OAAO,sDAAsD,CAC7E,CAAC;IACJ,CAAC;IACD,2FAA2F;IAC3F,IAAI,MAAM,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,MAAM,KAAK,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,GAAG,CACR,yBAAyB,EACzB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EACjF,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,CAAa,EAAE,OAAe;IACjE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;QAC7C,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QAC7B,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;KACtC,CAAC,CAAC;IACH,6FAA6F;IAC7F,gDAAgD;IAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,IAAI,QAAQ,CACV,WAAW,EACX,SAAS,OAAO,6GAA6G,CAC9H,CAAC;IACJ,IAAI,CAAC,GAAG,EAAE,UAAU;QAAE,MAAM,QAAQ,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,MAAM,QAAQ,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,EAAE;QACtB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,CAAC,kBAAkB,EAAE,WAAW,CAAC;QAC3C,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,MAAM,CACN,yBAAyB,EACzB,uEAAuE,CACxE,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;mFACmF;AACnF,KAAK,UAAU,YAAY,CAAC,CAAa,EAAE,GAAW;IACpD,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;KACtB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC1D,IAAI,GAAG,CAAC,SAAS;gBACf,MAAM,IAAI,QAAQ,CAChB,aAAa,EACb,qFAAqF,CACtF,CAAC;QACN,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,sGAAsG;AAEtG,MAAM,QAAQ,GAAsC;IAClD,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,iBAAiB;CAC1B,CAAC;AAEF,mGAAmG;AACnG,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE5F,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,IAAiB,EAAE,EAAE,CAClD,IAAI,CAAC,MAAM,KAAK,CAAC;IACf,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;SACrE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC;AAE5B,MAAM,GAAG,GAAG,CAAC,GAA8B,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEnG,+FAA+F;AAC/F,SAAS,UAAU,CAAC,OAAe,EAAE,CAAS;IAC5C,OAAO,iJAAiJ,GAAG,CAAC,OAAO,CAAC,6SAA6S,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,GAAG,CAAC,OAAO,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,qBAAqB,KAAK,CACjkB,CAAC,MAAM,EAAE,SAAS,CAAC,EACnB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CACxC,oBAAoB,KAAK,CACxB,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAC3C,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC7F,gBAAgB,CAAC;AACpB,CAAC"}

package/dist/routes/v1/api/sources.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A source's own account routes (go-prod spec §3.2, §12.2–12.3): sign-up, the signed-in account's
+ * sources, an organisation's sources, the settings, the source's webhook signing secret, and the
+ * company sync (D1). The allow-list and the billing mode are not here — they are commercial terms,
+ * the operator's (`admin.ts`).
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const sources: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=sources.d.ts.map

package/dist/routes/v1/api/sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/sources.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA4B5B,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAIxE,eAAO,MAAM,OAAO,qDAAqB,CAAC"}

package/dist/routes/v1/api/sources.js

@@ -0,0 +1,293 @@
+/**
+ * A source's own account routes (go-prod spec §3.2, §12.2–12.3): sign-up, the signed-in account's
+ * sources, an organisation's sources, the settings, the source's webhook signing secret, and the
+ * company sync (D1). The allow-list and the billing mode are not here — they are commercial terms,
+ * the operator's (`admin.ts`).
+ */
+import { and, asc, desc, eq, isNotNull, isNull, lt, lte, or, sql } from "drizzle-orm";
+import { Hono } from "hono";
+import { z } from "zod";
+import { CreateSourceRequest, EntityDid, ListOrganisationSourcesQuery, SourceId, SourceSettings, } from "../../../contracts/index.js";
+import { apiMembers, apiSources } from "../../../db/schema.js";
+import { entityControllers, mirrorCompanyLink, sourceLogId, sourceRoots, } from "../../../lib/api-lane/company.js";
+import { newId } from "../../../lib/api-lane/ids.js";
+import { deleteSourceCascade } from "../../../lib/api-lane/source-delete.js";
+import { encryptWebhookSecret, newWebhookSecret } from "../../../lib/api-lane/webhook-crypto.js";
+import { decodeCursor, encodeCursor } from "../../../lib/cursor.js";
+import { createEngineClient } from "../../../lib/engine/client.js";
+import { reportAlert } from "../../../lib/sentry.js";
+import { validate } from "../../../lib/validator.js";
+import { audit } from "../../../middleware/api/audit.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { chainOf } from "../../../middleware/api/console.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { idempotent } from "../../../middleware/api/idempotency.js";
+import { getOracle } from "../../../oracle.js";
+import { memberView, sourceView } from "./views.js";
+export const sources = new Hono();
+/** The rotated-out secret keeps signing beside the new one this long (§4.5), as an endpoint's. */
+const ROTATION_OVERLAP_MS = 86_400_000;
+/** The signed-in account of an `account` route — `access()` guarantees one. */
+function accountDid(c) {
+    const caller = c.get("caller");
+    if (caller.kind !== "account")
+        throw new ApiError("UNAUTHORIZED", "Sign in to the Decision Console with your IXO account to do this.");
+    return caller.did;
+}
+/** config.ts refuses `API_LANE` without it, and no lane route runs without `API_LANE`. */
+function encryptionKey(c) {
+    const key = c.get("config").WEBHOOK_ENCRYPTION_KEY;
+    if (!key)
+        throw new Error("WEBHOOK_ENCRYPTION_KEY is not set");
+    return key;
+}
+// --- POST /v1/api/sources — add this oracle to an organisation -----------------------------------
+sources.post("/sources", access({ op: "createSource", scope: "none", capability: "account" }), idempotent({ secretFields: ["webhookSecret"] }), validate("json", CreateSourceRequest), async (c) => {
+    const did = accountDid(c);
+    const { name, contactEmail, entityDid } = c.req.valid("json");
+    // D10: a source is the organisation's, so only its current controller adds it (live, fail
+    // closed — Blocksync trouble is a 503, never a yes). As a controller the invoker is root: no
+    // membership is written.
+    if (!(await entityControllers(chainOf(c), entityDid)).includes(did)) {
+        throw new ApiError("FORBIDDEN", "Only a current controller (admin) of this organisation can add an oracle to it, and your account is not one.");
+    }
+    const now = new Date();
+    const sourceId = newId("src", now);
+    const webhookSecret = newWebhookSecret();
+    const db = await c.var.db();
+    const [source] = await db
+        .insert(apiSources)
+        .values({
+        sourceId,
+        name,
+        ownerDid: did,
+        contactEmail,
+        companyEntityDid: entityDid,
+        // No claims, keys, invites or webhooks until the company sync reads the organisation's
+        // link from the engine.
+        status: "pending-link",
+        // Spec delta (§17 has an operator enable each protocol): the oracle's published catalogue,
+        // so a self-serve sign-up from the marketplace can submit once active; an operator narrows
+        // it with `PUT /admin/sources/:id/protocols`. An oracle that publishes none gives an empty
+        // list — which on this lane allows NOTHING (schema) until an operator enables one.
+        allowedProtocols: [...getOracle().config.supportedProtocols],
+        webhookSecretCiphertext: await encryptWebhookSecret(webhookSecret, encryptionKey(c)),
+        createdAt: now,
+        updatedAt: now,
+    })
+        .returning();
+    if (!source)
+        throw new Error("sign-up: the insert returned no row");
+    // The D1 audit row keeps the id; no log line does until the source goes active (sourceLogId).
+    await audit(c, "source.created", sourceId, { name, entityDid }, sourceId);
+    c.get("logger").info("api.source.created", { ...(await sourceLogId(source)), entityDid });
+    return c.json({ source: sourceView(source), webhookSecret }, 201);
+});
+// --- GET /v1/api/sources — the account's memberships ---------------------------------------------
+sources.get("/sources", access({ op: "listMySources", scope: "none", capability: "account" }), async (c) => {
+    const did = accountDid(c);
+    // 1.17.0 moved the organisation's list to its own route: a stale `?entity=` call fails loudly
+    // rather than reading a page of memberships as the organisation's sources.
+    if (c.req.query("entity") !== undefined) {
+        throw new ApiError("VALIDATION", "GET /v1/api/sources no longer takes `entity`: list an organisation's sources with GET /v1/api/organisations/{entityDid}/sources.");
+    }
+    const db = await c.var.db();
+    // One read over the member rows (`api_members_did_idx`). Revoked and expired memberships are
+    // listed with their status — the console shows why — and no capabilities. No pagination: a
+    // person belongs to few sources. A controller with no membership finds its organisation's
+    // sources by entity; every source carries its `companyEntityDid`, so the console groups them.
+    const rows = await db
+        .select({ member: apiMembers, source: apiSources })
+        .from(apiMembers)
+        .innerJoin(apiSources, eq(apiSources.sourceId, apiMembers.sourceId))
+        .where(and(eq(apiMembers.did, did), isNotNull(apiMembers.acceptedAt)))
+        .orderBy(asc(apiSources.createdAt), asc(apiSources.sourceId));
+    const now = new Date();
+    // One controllers read per organisation, however many of its sources the account is in.
+    const rootsBy = new Map();
+    const rootsOf = (source) => {
+        const key = source.companyEntityDid ?? "";
+        const known = rootsBy.get(key);
+        if (known)
+            return known;
+        const roots = sourceRoots(chainOf(c), source);
+        rootsBy.set(key, roots);
+        return roots;
+    };
+    const items = [];
+    for (const { member, source } of rows) {
+        const roots = await rootsOf(source);
+        const view = memberView(member, roots, now);
+        items.push({
+            source: sourceView(source),
+            memberId: view.memberId,
+            role: view.role,
+            status: view.status,
+            capabilities: view.capabilities,
+            protocols: view.protocols,
+            expiresAt: view.expiresAt,
+            // A controller invokes as root with no proof; a member attaches its stored grant.
+            delegation: member.did !== null && roots.includes(member.did) ? null : member.delegation,
+            delegationCid: view.delegationCid,
+        });
+    }
+    return c.json({ items });
+});
+// --- GET /v1/api/organisations/:entityDid/sources — an organisation's sources -------------------
+/**
+ * An organisation's sources on this oracle (D10): those of `entityDid` in EVERY state, newest first,
+ * keyset-paged like the operator list. Only a CURRENT controller of the entity (Blocksync, live) may
+ * list them — a 403 otherwise, which says nothing about any source. A never-active source is shown
+ * to them too: they are its roots already (sync, delete), and it is how a controller finds the
+ * source an abandoned "Add oracle" or a CLI sign-up left `pending-link`. Nobody else learns its id.
+ */
+sources.get("/organisations/:entityDid/sources", access({ op: "listOrganisationSources", scope: "none", capability: "account" }), validate("param", z.object({ entityDid: EntityDid })), validate("query", ListOrganisationSourcesQuery), async (c) => {
+    const did = accountDid(c);
+    const { entityDid } = c.req.valid("param");
+    const { limit, cursor } = c.req.valid("query");
+    if (!(await entityControllers(chainOf(c), entityDid)).includes(did)) {
+        throw new ApiError("FORBIDDEN", "Only a current controller (admin) of this organisation can list its sources, and your account is not one.");
+    }
+    // The shared cursor names its id `claimId`; here it carries the sourceId.
+    const after = cursor ? decodeCursor(cursor) : null;
+    const rows = await (await c.var.db())
+        .select()
+        .from(apiSources)
+        .where(and(eq(apiSources.companyEntityDid, entityDid), after
+        ? or(lt(apiSources.createdAt, after.createdAt), and(eq(apiSources.createdAt, after.createdAt), lt(apiSources.sourceId, after.claimId)))
+        : undefined))
+        .orderBy(desc(apiSources.createdAt), desc(apiSources.sourceId))
+        .limit(limit + 1);
+    const page = rows.slice(0, limit);
+    const last = page.at(-1);
+    return c.json({
+        items: page.map(sourceView),
+        nextCursor: rows.length > limit && last ? encodeCursor(last.createdAt, last.sourceId) : null,
+    });
+});
+/** The source of a controller-only route, which must be the path's: root, invoking as itself. */
+function controlledSource(c, sourceId) {
+    const caller = sourceOf(c);
+    if (caller.source.sourceId !== sourceId) {
+        throw new ApiError("FORBIDDEN", "This request names a different source in its path than in X-Source-Id. Reload the console and try again.");
+    }
+    if (caller.kind !== "member" || !caller.controller) {
+        throw new ApiError("FORBIDDEN", "Only a current controller (admin) of the source's organisation can do this.");
+    }
+    return caller.source;
+}
+// --- POST /v1/api/sources/:sourceId/company/sync — mirror the organisation's link ---------------
+/**
+ * After the Console PUTs the controller-signed link to the engine (the link's only home), this reads
+ * the engine's stored state and mirrors it (`mirrorCompanyLink`): the source's own entity ⇒ `active`;
+ * another entity, or the engine's `disputed` ⇒ `disputed` (alerted); nothing stored ⇒ it stays
+ * `pending-link`. A controller only — root, no membership. A failed engine read changes nothing (a
+ * 404 included: never read as "unlinked").
+ */
+sources.post("/sources/:sourceId/company/sync", access({ op: "syncSourceCompany", scope: "none", capability: "source/*" }), validate("param", z.object({ sourceId: SourceId })), async (c) => {
+    const source = controlledSource(c, c.req.valid("param").sourceId);
+    const { sourceId } = source;
+    const link = await createEngineClient({
+        config: c.get("config"),
+        logger: c.get("logger"),
+        trace: c.get("trace"),
+        cache: c.env.CACHE_KV,
+    }).getCompanyLink(sourceId);
+    const db = await c.var.db();
+    const mirrored = await mirrorCompanyLink(db, source, link);
+    if (!mirrored)
+        throw new ApiError("NOT_FOUND", "This source was not found.");
+    // Hashed while the source has never been active: it must not be named outside the oracle.
+    const logged = await sourceLogId(mirrored);
+    c.get("logger").info("api.source.company-synced", {
+        ...logged,
+        state: link.state,
+        status: mirrored.status,
+    });
+    const alert = { config: c.get("config"), cache: c.env.CACHE_KV, logger: c.get("logger") };
+    if (mirrored.status === "disputed") {
+        await reportAlert(alert, "api.company-link.disputed", logged);
+    }
+    else if (link.state === "unlinked" && mirrored.status !== "pending-link") {
+        // A linked source the engine reads as unlinked: transient at the engine (nothing changed
+        // here), but a link that stays gone is a person's to look at.
+        c.get("logger").warn("api.source.company-unlinked", { ...logged, status: mirrored.status });
+        await reportAlert(alert, "api.company-link.unlinked", logged);
+    }
+    await audit(c, "source.company_synced", sourceId, { state: link.state, status: mirrored.status }, sourceId);
+    const members = await db.query.apiMembers.findMany({
+        where: eq(apiMembers.sourceId, sourceId),
+        orderBy: (m, { asc: up }) => [up(m.invitedAt), up(m.memberId)],
+    });
+    const roots = await sourceRoots(chainOf(c), mirrored);
+    return c.json({
+        source: sourceView(mirrored),
+        members: members.map((m) => memberView(m, roots)),
+    });
+});
+// --- DELETE /v1/api/sources/:sourceId — remove this oracle from the organisation -----------------
+/**
+ * The source and every row hanging off it (`deleteSourceCascade`) — "disputed: delete it and add the
+ * oracle again" (D10). A controller only. Nothing on chain or at the engine changes.
+ */
+sources.delete("/sources/:sourceId", access({ op: "deleteSource", scope: "none", capability: "source/*" }), validate("param", z.object({ sourceId: SourceId })), async (c) => {
+    const source = controlledSource(c, c.req.valid("param").sourceId);
+    await deleteSourceCascade(await c.var.db(), source.sourceId);
+    // The audit rows went with the source: the log line is the record (hashed while pending).
+    c.get("logger").info("api.source.deleted", {
+        ...(await sourceLogId(source)),
+        by: c.get("caller").did,
+    });
+    return c.body(null, 204);
+});
+// --- PATCH /v1/api/source — settings -------------------------------------------------------------
+sources.patch("/source", access({ op: "updateSourceSettings", scope: "none", capability: "settings/manage" }), idempotent(), validate("json", SourceSettings), async (c) => {
+    const { sourceId } = sourceOf(c).source;
+    const { defaultWebhookUrl, ...rest } = c.req.valid("json");
+    const db = await c.var.db();
+    const [row] = await db
+        .update(apiSources)
+        .set({ ...rest, ...(defaultWebhookUrl !== undefined && { webhookUrl: defaultWebhookUrl }) })
+        .where(eq(apiSources.sourceId, sourceId))
+        .returning();
+    if (!row)
+        throw new ApiError("NOT_FOUND", `Source ${sourceId} was not found.`);
+    // The field names only: the log outlives the values (a contact email is personal data).
+    await audit(c, "source.settings_updated", sourceId, {
+        fields: Object.keys(c.req.valid("json")),
+    });
+    return c.json(sourceView(row));
+});
+// --- POST /v1/api/source/webhook-secret — rotate ------------------------------------------------
+sources.post("/source/webhook-secret", access({ op: "rotateSourceWebhookSecret", scope: "none", capability: "webhooks/manage" }), idempotent({ secretFields: ["webhookSecret"] }), async (c) => {
+    const { sourceId } = sourceOf(c).source;
+    const webhookSecret = newWebhookSecret();
+    const now = new Date();
+    const previousExpiresAt = new Date(now.getTime() + ROTATION_OVERLAP_MS);
+    const db = await c.var.db();
+    // ONE statement: SQLite's SET reads the row as it was, so the current secret moves to the
+    // previous slot with no read a concurrent rotation could race. A rotation while the last one's
+    // previous secret still signs would drop it before its 24 h — refused in the same WHERE (a
+    // pre-v1.1 source's first rotation moved no secret, so it blocks nothing).
+    const [row] = await db
+        .update(apiSources)
+        .set({
+        webhookSecretCiphertext: await encryptWebhookSecret(webhookSecret, encryptionKey(c)),
+        previousWebhookSecretCiphertext: sql `${apiSources.webhookSecretCiphertext}`,
+        previousWebhookSecretExpiresAt: previousExpiresAt,
+    })
+        .where(and(eq(apiSources.sourceId, sourceId), or(isNull(apiSources.previousWebhookSecretCiphertext), isNull(apiSources.previousWebhookSecretExpiresAt), lte(apiSources.previousWebhookSecretExpiresAt, now))))
+        .returning({ sourceId: apiSources.sourceId });
+    if (!row) {
+        const exists = await db.query.apiSources.findFirst({
+            columns: { sourceId: true },
+            where: eq(apiSources.sourceId, sourceId),
+        });
+        if (!exists)
+            throw new ApiError("NOT_FOUND", `Source ${sourceId} was not found.`);
+        throw new ApiError("CONFLICT", "The previous webhook secret still works for 24 hours after a rotation; rotate again once that overlap ends.", { reason: "rotation_in_progress" });
+    }
+    await audit(c, "source.webhook_secret_rotated", sourceId);
+    return c.json({ webhookSecret, previousExpiresAt: previousExpiresAt.toISOString() });
+});
+//# sourceMappingURL=sources.js.map