@nlabs/reaktor 1.19.0 → 1.20.0-reactorbox.1

package/lib/actions/crmDeliveryEvents.d.ts

@@ -0,0 +1,24 @@
+import type { ApiContext } from '../types/auth.types.js';
+export interface CrmDeliveryEventInput {
+    appId: string;
+    bounceType?: 'Permanent' | 'Transient' | 'Undetermined';
+    eventId: string;
+    kind: 'delivered' | 'bounce' | 'complaint';
+    occurredAt: number;
+    providerMessageId: string;
+    receiptId: string;
+}
+export interface CrmDeliveryEventReceipt {
+    bounceType?: CrmDeliveryEventInput['bounceType'];
+    id: string;
+    kind: CrmDeliveryEventInput['kind'];
+    occurredAt: number;
+    receiptId: string;
+    suppressed: boolean;
+}
+/** Trusted server relay scope authenticates a deployed relay; it does not verify unsigned SNS claims. */
+export declare const ingestCrmDeliveryEvent: (context: ApiContext, input: CrmDeliveryEventInput, now?: () => number) => Promise<CrmDeliveryEventReceipt>;
+/** Native administrator privacy action; persistent minimized tombstone prevents prior accepted-message reingestion. */
+export declare const eraseCrmDeliveryEvidence: (context: ApiContext, appId: string, userId: string, now?: () => number) => Promise<{
+    erased: number;
+}>;

package/lib/actions/crmDeliveryEvents.js

@@ -0,0 +1,207 @@
+/* eslint-disable no-await-in-loop, no-underscore-dangle -- Sequential collection setup and native graph metadata. */ import { aql } from 'arangojs';
+import { createHash } from 'node:crypto';
+import { scopeContextToApp } from '../utils/appContext.js';
+import { useDb } from '../utils/arangodbUtils.js';
+import { requireCrmAdministrator } from './crm.js';
+import { crmDeliveryPrivacyKey } from './crmDeliveryEvidence.js';
+import { authorizeCrmExecutionGrant, ensureOwnerExecutionCollection } from './crmExecution.js';
+const digest = (value)=>createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const identifier = (value)=>typeof value === 'string' && /^[\w.-]{1,200}$/.test(value);
+const valid = (input, at)=>Boolean(input && identifier(input.appId) && input.appId.length <= 100 && identifier(input.eventId) && /^[a-f0-9]{64}$/.test(input.receiptId) && identifier(input.providerMessageId) && [
+        'delivered',
+        'bounce',
+        'complaint'
+    ].includes(input.kind) && Object.keys(input).every((key)=>[
+            'appId',
+            'bounceType',
+            'eventId',
+            'kind',
+            'occurredAt',
+            'providerMessageId',
+            'receiptId'
+        ].includes(key)) && (input.kind === 'bounce' ? [
+        'Permanent',
+        'Transient',
+        'Undetermined'
+    ].includes(input.bounceType || '') : input.bounceType === undefined) && Number.isSafeInteger(input.occurredAt) && input.occurredAt <= at + 60000 && input.occurredAt >= at - 30 * 86400000);
+/** Trusted server relay scope authenticates a deployed relay; it does not verify unsigned SNS claims. */ export const ingestCrmDeliveryEvent = async (context, input, now = Date.now)=>{
+    if (!valid(input, now())) {
+        throw new Error('invalid_crm_delivery_event');
+    }
+    const grant = await authorizeCrmExecutionGrant(context, input.appId, 'crm:delivery_events', now());
+    const db = useDb(grant.databaseName);
+    const documents = [
+        'crmDeliveryEvents',
+        'crmExecutionReceipts',
+        'crmDeliveryPrivacy',
+        'users'
+    ];
+    const edges = [
+        'hasCrmExecutionDelivery',
+        'hasUserCrmDelivery'
+    ];
+    for (const name of [
+        ...documents,
+        ...edges
+    ]){
+        await ensureOwnerExecutionCollection(db, name, edges.includes(name));
+    }
+    const tx = await db.beginTransaction({
+        exclusive: [
+            ...documents,
+            ...edges
+        ]
+    }, {
+        lockTimeout: 10
+    });
+    const query = (value)=>tx.step(()=>db.query(value));
+    try {
+        const receipt = await query(aql`RETURN DOCUMENT('crmExecutionReceipts', ${input.receiptId})`).then((cursor)=>cursor.next());
+        if (!receipt || receipt.appId !== input.appId || receipt.id !== input.receiptId || receipt.state !== 'applied' || ![
+            'crm_outreach',
+            'scheduling_reminder'
+        ].includes(receipt.kind) || receipt.providerMessageId !== input.providerMessageId || !Number.isSafeInteger(receipt.providerAcceptedAt) || receipt.providerAcceptedAt < receipt.createdAt || receipt.providerAcceptedAt > now() || input.occurredAt < receipt.providerAcceptedAt - 60000 || input.occurredAt > receipt.providerAcceptedAt + 30 * 86400000) {
+            throw new Error('crm_delivery_accepted_message_required');
+        }
+        const user = await query(aql`RETURN DOCUMENT('users', ${receipt.recipient.id})`).then((cursor)=>cursor.next());
+        if (!user || user.deleted === true || user.email !== receipt.recipient.email || user._key !== receipt.recipient.id) {
+            throw new Error('crm_delivery_recipient_changed');
+        }
+        const erased = await query(aql`RETURN DOCUMENT('crmDeliveryPrivacy', ${crmDeliveryPrivacyKey(input.appId, user._key)})`).then((cursor)=>cursor.next());
+        if (erased && receipt.providerAcceptedAt <= erased.erasedAt) {
+            throw new Error('crm_delivery_privacy_erased');
+        }
+        const id = digest([
+            input.appId,
+            input.eventId
+        ]);
+        const fingerprint = digest([
+            input.appId,
+            input.receiptId,
+            input.providerMessageId,
+            input.kind,
+            input.bounceType,
+            input.occurredAt
+        ]);
+        const previous = await query(aql`RETURN DOCUMENT('crmDeliveryEvents', ${id})`).then((cursor)=>cursor.next());
+        if (previous && previous.fingerprint !== fingerprint) {
+            throw new Error('crm_delivery_event_conflict');
+        }
+        const current = await authorizeCrmExecutionGrant(context, input.appId, 'crm:delivery_events', now());
+        if (current.id !== grant.id || current.hash !== grant.hash || current.databaseName !== grant.databaseName) {
+            throw new Error('crm_delivery_relay_changed');
+        }
+        const suppressed = input.kind !== 'delivered' || Boolean(user.emailDeliveryStatus && user.emailDeliveryStatus !== 'valid');
+        if (previous) {
+            await tx.commit();
+            return {
+                ...previous.receipt,
+                suppressed
+            };
+        }
+        const timeline = await query(aql`FOR event IN crmDeliveryEvents
+      FILTER event.appId == ${input.appId} AND event.receipt.receiptId == ${input.receiptId}
+      LIMIT 32 RETURN event._key`).then((cursor)=>cursor.all());
+        if (timeline.length >= 32) {
+            throw new Error('crm_delivery_timeline_limit');
+        }
+        const result = {
+            bounceType: input.bounceType,
+            id,
+            kind: input.kind,
+            occurredAt: input.occurredAt,
+            receiptId: input.receiptId,
+            suppressed
+        };
+        await query(aql`INSERT ${{
+            _key: id,
+            appId: input.appId,
+            fingerprint,
+            receipt: result,
+            receivedAt: now(),
+            relayGrantId: grant.id
+        }} INTO crmDeliveryEvents`);
+        if (input.kind !== 'delivered') {
+            // Any bounce holds sends; classification is evidence, not a claim that a transient bounce is permanent.
+            const status = input.kind === 'complaint' || user.emailDeliveryStatus === 'complaint' ? 'complaint' : 'bounce_hold';
+            await query(aql`UPDATE ${user._key} WITH {emailDeliveryStatus: ${status}, modified: ${now()}} IN users`);
+        }
+        await query(aql`INSERT ${{
+            _from: `crmExecutionReceipts/${input.receiptId}`,
+            _key: id,
+            _to: `crmDeliveryEvents/${id}`,
+            appId: input.appId
+        }} INTO hasCrmExecutionDelivery`);
+        await query(aql`INSERT ${{
+            _from: `users/${user._key}`,
+            _key: id,
+            _to: `crmDeliveryEvents/${id}`,
+            appId: input.appId
+        }} INTO hasUserCrmDelivery`);
+        const closing = await authorizeCrmExecutionGrant(context, input.appId, 'crm:delivery_events', now());
+        if (closing.id !== grant.id || closing.hash !== grant.hash || closing.databaseName !== grant.databaseName) {
+            throw new Error('crm_delivery_relay_changed');
+        }
+        await tx.commit();
+        return result;
+    } catch (error) {
+        await tx.abort();
+        throw error;
+    }
+};
+/** Native administrator privacy action; persistent minimized tombstone prevents prior accepted-message reingestion. */ export const eraseCrmDeliveryEvidence = async (context, appId, userId, now = Date.now)=>{
+    requireCrmAdministrator(context);
+    if (!identifier(appId) || appId.length > 100 || !identifier(userId) || userId.length > 100) {
+        throw new Error('invalid_crm_delivery_erasure');
+    }
+    const scoped = await scopeContextToApp(context, appId);
+    const db = useDb(scoped.databaseName);
+    const documents = [
+        'crmDeliveryEvents',
+        'crmDeliveryPrivacy'
+    ];
+    const edges = [
+        'hasCrmExecutionDelivery',
+        'hasUserCrmDelivery'
+    ];
+    for (const name of [
+        ...documents,
+        ...edges
+    ]){
+        await ensureOwnerExecutionCollection(db, name, edges.includes(name));
+    }
+    const tx = await db.beginTransaction({
+        exclusive: [
+            ...documents,
+            ...edges
+        ]
+    }, {
+        lockTimeout: 10
+    });
+    const query = (value)=>tx.step(()=>db.query(value));
+    try {
+        const ids = await query(aql`FOR edge IN hasUserCrmDelivery
+      FILTER edge.appId == ${appId} AND edge._from == ${`users/${userId}`}
+      RETURN PARSE_IDENTIFIER(edge._to).key`).then((cursor)=>cursor.all());
+        const id = crmDeliveryPrivacyKey(appId, userId);
+        await query(aql`UPSERT {_key: ${id}} INSERT ${{
+            _key: id,
+            erasedAt: now()
+        }}
+      UPDATE {erasedAt: MAX([OLD.erasedAt, ${now()}])} IN crmDeliveryPrivacy`);
+        await query(aql`FOR event IN crmDeliveryEvents FILTER event._key IN ${ids} REMOVE event IN crmDeliveryEvents`);
+        await query(aql`FOR edge IN hasCrmExecutionDelivery FILTER edge.appId == ${appId}
+      AND PARSE_IDENTIFIER(edge._to).key IN ${ids} REMOVE edge IN hasCrmExecutionDelivery`);
+        await query(aql`FOR edge IN hasUserCrmDelivery FILTER edge.appId == ${appId}
+      AND edge._from == ${`users/${userId}`} REMOVE edge IN hasUserCrmDelivery`);
+        await tx.commit();
+        return {
+            erased: ids.length
+        };
+    } catch (error) {
+        await tx.abort();
+        throw error;
+    }
+};
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9Vc2Vycy9uaXRyb2c3L0RldmVsb3BtZW50L3JlYWt0b3IvcGFja2FnZXMvcmVha3Rvci9zcmMvYWN0aW9ucy9jcm1EZWxpdmVyeUV2ZW50cy50cyJdLCJzb3VyY2VzQ29udGVudCI6WyIvKiBlc2xpbnQtZGlzYWJsZSBuby1hd2FpdC1pbi1sb29wLCBuby11bmRlcnNjb3JlLWRhbmdsZSAtLSBTZXF1ZW50aWFsIGNvbGxlY3Rpb24gc2V0dXAgYW5kIG5hdGl2ZSBncmFwaCBtZXRhZGF0YS4gKi9cbmltcG9ydCB7YXFsfSBmcm9tICdhcmFuZ29qcyc7XG5pbXBvcnQge2NyZWF0ZUhhc2h9IGZyb20gJ25vZGU6Y3J5cHRvJztcblxuaW1wb3J0IHtzY29wZUNvbnRleHRUb0FwcH0gZnJvbSAnLi4vdXRpbHMvYXBwQ29udGV4dC5qcyc7XG5pbXBvcnQge3VzZURifSBmcm9tICcuLi91dGlscy9hcmFuZ29kYlV0aWxzLmpzJztcbmltcG9ydCB7cmVxdWlyZUNybUFkbWluaXN0cmF0b3J9IGZyb20gJy4vY3JtLmpzJztcbmltcG9ydCB7Y3JtRGVsaXZlcnlQcml2YWN5S2V5fSBmcm9tICcuL2NybURlbGl2ZXJ5RXZpZGVuY2UuanMnO1xuaW1wb3J0IHthdXRob3JpemVDcm1FeGVjdXRpb25HcmFudCwgZW5zdXJlT3duZXJFeGVjdXRpb25Db2xsZWN0aW9ufSBmcm9tICcuL2NybUV4ZWN1dGlvbi5qcyc7XG5cbmltcG9ydCB0eXBlIHtBcGlDb250ZXh0fSBmcm9tICcuLi90eXBlcy9hdXRoLnR5cGVzLmpzJztcbmltcG9ydCB0eXBlIHtDcm1FeGVjdXRpb25SZWNlaXB0fSBmcm9tICcuL2NybUV4ZWN1dGlvbi5qcyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgQ3JtRGVsaXZlcnlFdmVudElucHV0IHtcbiAgYXBwSWQ6IHN0cmluZztcbiAgYm91bmNlVHlwZT86ICdQZXJtYW5lbnQnIHwgJ1RyYW5zaWVudCcgfCAnVW5kZXRlcm1pbmVkJztcbiAgZXZlbnRJZDogc3RyaW5nO1xuICBraW5kOiAnZGVsaXZlcmVkJyB8ICdib3VuY2UnIHwgJ2NvbXBsYWludCc7XG4gIG9jY3VycmVkQXQ6IG51bWJlcjtcbiAgcHJvdmlkZXJNZXNzYWdlSWQ6IHN0cmluZztcbiAgcmVjZWlwdElkOiBzdHJpbmc7XG59XG5leHBvcnQgaW50ZXJmYWNlIENybURlbGl2ZXJ5RXZlbnRSZWNlaXB0IHtcbiAgYm91bmNlVHlwZT86IENybURlbGl2ZXJ5RXZlbnRJbnB1dFsnYm91bmNlVHlwZSddO1xuICBpZDogc3RyaW5nO1xuICBraW5kOiBDcm1EZWxpdmVyeUV2ZW50SW5wdXRbJ2tpbmQnXTtcbiAgb2NjdXJyZWRBdDogbnVtYmVyO1xuICByZWNlaXB0SWQ6IHN0cmluZztcbiAgc3VwcHJlc3NlZDogYm9vbGVhbjtcbn1cbmNvbnN0IGRpZ2VzdCA9ICh2YWx1ZTogdW5rbm93bik6IHN0cmluZyA9PiBjcmVhdGVIYXNoKCdzaGEyNTYnKS51cGRhdGUoSlNPTi5zdHJpbmdpZnkodmFsdWUpKS5kaWdlc3QoJ2hleCcpO1xuY29uc3QgaWRlbnRpZmllciA9ICh2YWx1ZTogdW5rbm93bik6IHZhbHVlIGlzIHN0cmluZyA9PiB0eXBlb2YgdmFsdWUgPT09ICdzdHJpbmcnICYmIC9eW1xcdy4tXXsxLDIwMH0kLy50ZXN0KHZhbHVlKTtcbmNvbnN0IHZhbGlkID0gKGlucHV0OiBDcm1EZWxpdmVyeUV2ZW50SW5wdXQsIGF0OiBudW1iZXIpOiBib29sZWFuID0+IEJvb2xlYW4oaW5wdXQgJiYgaWRlbnRpZmllcihpbnB1dC5hcHBJZClcbiAgJiYgaW5wdXQuYXBwSWQubGVuZ3RoIDw9IDEwMCAmJiBpZGVudGlmaWVyKGlucHV0LmV2ZW50SWQpICYmIC9eW2EtZjAtOV17NjR9JC8udGVzdChpbnB1dC5yZWNlaXB0SWQpXG4gICYmIGlkZW50aWZpZXIoaW5wdXQucHJvdmlkZXJNZXNzYWdlSWQpICYmIFsnZGVsaXZlcmVkJywgJ2JvdW5jZScsICdjb21wbGFpbnQnXS5pbmNsdWRlcyhpbnB1dC5raW5kKVxuICAmJiBPYmplY3Qua2V5cyhpbnB1dCkuZXZlcnkoKGtleSkgPT4gWydhcHBJZCcsICdib3VuY2VUeXBlJywgJ2V2ZW50SWQnLCAna2luZCcsICdvY2N1cnJlZEF0JywgJ3Byb3ZpZGVyTWVzc2FnZUlkJywgJ3JlY2VpcHRJZCddLmluY2x1ZGVzKGtleSkpXG4gICYmIChpbnB1dC5raW5kID09PSAnYm91bmNlJyA/IFsnUGVybWFuZW50JywgJ1RyYW5zaWVudCcsICdVbmRldGVybWluZWQnXS5pbmNsdWRlcyhpbnB1dC5ib3VuY2VUeXBlIHx8ICcnKSA6IGlucHV0LmJvdW5jZVR5cGUgPT09IHVuZGVmaW5lZClcbiAgJiYgTnVtYmVyLmlzU2FmZUludGVnZXIoaW5wdXQub2NjdXJyZWRBdCkgJiYgaW5wdXQub2NjdXJyZWRBdCA8PSBhdCArIDYwMDAwXG4gICYmIGlucHV0Lm9jY3VycmVkQXQgPj0gYXQgLSAoMzAgKiA4NjQwMDAwMCkpO1xuXG4vKiogVHJ1c3RlZCBzZXJ2ZXIgcmVsYXkgc2NvcGUgYXV0aGVudGljYXRlcyBhIGRlcGxveWVkIHJlbGF5OyBpdCBkb2VzIG5vdCB2ZXJpZnkgdW5zaWduZWQgU05TIGNsYWltcy4gKi9cbmV4cG9ydCBjb25zdCBpbmdlc3RDcm1EZWxpdmVyeUV2ZW50ID0gYXN5bmMgKFxuICBjb250ZXh0OiBBcGlDb250ZXh0LCBpbnB1dDogQ3JtRGVsaXZlcnlFdmVudElucHV0LCBub3cgPSBEYXRlLm5vd1xuKTogUHJvbWlzZTxDcm1EZWxpdmVyeUV2ZW50UmVjZWlwdD4gPT4ge1xuICBpZighdmFsaWQoaW5wdXQsIG5vdygpKSkge1xuICAgIHRocm93IG5ldyBFcnJvcignaW52YWxpZF9jcm1fZGVsaXZlcnlfZXZlbnQnKTtcbiAgfVxuICBjb25zdCBncmFudCA9IGF3YWl0IGF1dGhvcml6ZUNybUV4ZWN1dGlvbkdyYW50KGNvbnRleHQsIGlucHV0LmFwcElkLCAnY3JtOmRlbGl2ZXJ5X2V2ZW50cycsIG5vdygpKTtcbiAgY29uc3QgZGIgPSB1c2VEYihncmFudC5kYXRhYmFzZU5hbWUpO1xuICBjb25zdCBkb2N1bWVudHMgPSBbJ2NybURlbGl2ZXJ5RXZlbnRzJywgJ2NybUV4ZWN1dGlvblJlY2VpcHRzJywgJ2NybURlbGl2ZXJ5UHJpdmFjeScsICd1c2VycyddO1xuICBjb25zdCBlZGdlcyA9IFsnaGFzQ3JtRXhlY3V0aW9uRGVsaXZlcnknLCAnaGFzVXNlckNybURlbGl2ZXJ5J107XG4gIGZvcihjb25zdCBuYW1lIG9mIFsuLi5kb2N1bWVudHMsIC4uLmVkZ2VzXSkge1xuICAgIGF3YWl0IGVuc3VyZU93bmVyRXhlY3V0aW9uQ29sbGVjdGlvbihkYiwgbmFtZSwgZWRnZXMuaW5jbHVkZXMobmFtZSkpO1xuICB9XG4gIGNvbnN0IHR4ID0gYXdhaXQgZGIuYmVnaW5UcmFuc2FjdGlvbih7ZXhjbHVzaXZlOiBbLi4uZG9jdW1lbnRzLCAuLi5lZGdlc119LCB7bG9ja1RpbWVvdXQ6IDEwfSk7XG4gIGNvbnN0IHF1ZXJ5ID0gKHZhbHVlOiBSZXR1cm5UeXBlPHR5cGVvZiBhcWw+KSA9PiB0eC5zdGVwKCgpID0+IGRiLnF1ZXJ5KHZhbHVlKSk7XG4gIHRyeSB7XG4gICAgY29uc3QgcmVjZWlwdCA9IGF3YWl0IHF1ZXJ5KGFxbGBSRVRVUk4gRE9DVU1FTlQoJ2NybUV4ZWN1dGlvblJlY2VpcHRzJywgJHtpbnB1dC5yZWNlaXB0SWR9KWApXG4gICAgICAudGhlbigoY3Vyc29yKSA9PiBjdXJzb3IubmV4dCgpKSBhcyBDcm1FeGVjdXRpb25SZWNlaXB0O1xuICAgIGlmKCFyZWNlaXB0IHx8IHJlY2VpcHQuYXBwSWQgIT09IGlucHV0LmFwcElkIHx8IHJlY2VpcHQuaWQgIT09IGlucHV0LnJlY2VpcHRJZCB8fCByZWNlaXB0LnN0YXRlICE9PSAnYXBwbGllZCdcbiAgICAgIHx8ICFbJ2NybV9vdXRyZWFjaCcsICdzY2hlZHVsaW5nX3JlbWluZGVyJ10uaW5jbHVkZXMocmVjZWlwdC5raW5kKSB8fCByZWNlaXB0LnByb3ZpZGVyTWVzc2FnZUlkICE9PSBpbnB1dC5wcm92aWRlck1lc3NhZ2VJZFxuICAgICAgfHwgIU51bWJlci5pc1NhZmVJbnRlZ2VyKHJlY2VpcHQucHJvdmlkZXJBY2NlcHRlZEF0KSB8fCByZWNlaXB0LnByb3ZpZGVyQWNjZXB0ZWRBdCEgPCByZWNlaXB0LmNyZWF0ZWRBdFxuICAgICAgfHwgcmVjZWlwdC5wcm92aWRlckFjY2VwdGVkQXQhID4gbm93KCkgfHwgaW5wdXQub2NjdXJyZWRBdCA8IHJlY2VpcHQucHJvdmlkZXJBY2NlcHRlZEF0ISAtIDYwMDAwXG4gICAgICB8fCBpbnB1dC5vY2N1cnJlZEF0ID4gcmVjZWlwdC5wcm92aWRlckFjY2VwdGVkQXQhICsgKDMwICogODY0MDAwMDApKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2NybV9kZWxpdmVyeV9hY2NlcHRlZF9tZXNzYWdlX3JlcXVpcmVkJyk7XG4gICAgfVxuICAgIGNvbnN0IHVzZXIgPSBhd2FpdCBxdWVyeShhcWxgUkVUVVJOIERPQ1VNRU5UKCd1c2VycycsICR7cmVjZWlwdC5yZWNpcGllbnQuaWR9KWApXG4gICAgICAudGhlbigoY3Vyc29yKSA9PiBjdXJzb3IubmV4dCgpKSBhcyB7XG4gICAgICBfa2V5OiBzdHJpbmc7IGRlbGV0ZWQ/OiBib29sZWFuOyBlbWFpbDogc3RyaW5nOyBlbWFpbERlbGl2ZXJ5U3RhdHVzPzogc3RyaW5nO1xuICAgIH07XG4gICAgaWYoIXVzZXIgfHwgdXNlci5kZWxldGVkID09PSB0cnVlIHx8IHVzZXIuZW1haWwgIT09IHJlY2VpcHQucmVjaXBpZW50LmVtYWlsIHx8IHVzZXIuX2tleSAhPT0gcmVjZWlwdC5yZWNpcGllbnQuaWQpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignY3JtX2RlbGl2ZXJ5X3JlY2lwaWVudF9jaGFuZ2VkJyk7XG4gICAgfVxuICAgIGNvbnN0IGVyYXNlZCA9IGF3YWl0IHF1ZXJ5KGFxbGBSRVRVUk4gRE9DVU1FTlQoJ2NybURlbGl2ZXJ5UHJpdmFjeScsICR7Y3JtRGVsaXZlcnlQcml2YWN5S2V5KGlucHV0LmFwcElkLCB1c2VyLl9rZXkpfSlgKVxuICAgICAgLnRoZW4oKGN1cnNvcikgPT4gY3Vyc29yLm5leHQoKSkgYXMge2VyYXNlZEF0OiBudW1iZXJ9IHwgdW5kZWZpbmVkO1xuICAgIGlmKGVyYXNlZCAmJiByZWNlaXB0LnByb3ZpZGVyQWNjZXB0ZWRBdCEgPD0gZXJhc2VkLmVyYXNlZEF0KSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2NybV9kZWxpdmVyeV9wcml2YWN5X2VyYXNlZCcpO1xuICAgIH1cbiAgICBjb25zdCBpZCA9IGRpZ2VzdChbaW5wdXQuYXBwSWQsIGlucHV0LmV2ZW50SWRdKTtcbiAgICBjb25zdCBmaW5nZXJwcmludCA9IGRpZ2VzdChbaW5wdXQuYXBwSWQsIGlucHV0LnJlY2VpcHRJZCwgaW5wdXQucHJvdmlkZXJNZXNzYWdlSWQsIGlucHV0LmtpbmQsXG4gICAgICBpbnB1dC5ib3VuY2VUeXBlLCBpbnB1dC5vY2N1cnJlZEF0XSk7XG4gICAgY29uc3QgcHJldmlvdXMgPSBhd2FpdCBxdWVyeShhcWxgUkVUVVJOIERPQ1VNRU5UKCdjcm1EZWxpdmVyeUV2ZW50cycsICR7aWR9KWApXG4gICAgICAudGhlbigoY3Vyc29yKSA9PiBjdXJzb3IubmV4dCgpKSBhcyB7ZmluZ2VycHJpbnQ6IHN0cmluZzsgcmVjZWlwdDogQ3JtRGVsaXZlcnlFdmVudFJlY2VpcHR9IHwgdW5kZWZpbmVkO1xuICAgIGlmKHByZXZpb3VzICYmIHByZXZpb3VzLmZpbmdlcnByaW50ICE9PSBmaW5nZXJwcmludCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdjcm1fZGVsaXZlcnlfZXZlbnRfY29uZmxpY3QnKTtcbiAgICB9XG4gICAgY29uc3QgY3VycmVudCA9IGF3YWl0IGF1dGhvcml6ZUNybUV4ZWN1dGlvbkdyYW50KGNvbnRleHQsIGlucHV0LmFwcElkLCAnY3JtOmRlbGl2ZXJ5X2V2ZW50cycsIG5vdygpKTtcbiAgICBpZihjdXJyZW50LmlkICE9PSBncmFudC5pZCB8fCBjdXJyZW50Lmhhc2ggIT09IGdyYW50Lmhhc2ggfHwgY3VycmVudC5kYXRhYmFzZU5hbWUgIT09IGdyYW50LmRhdGFiYXNlTmFtZSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdjcm1fZGVsaXZlcnlfcmVsYXlfY2hhbmdlZCcpO1xuICAgIH1cbiAgICBjb25zdCBzdXBwcmVzc2VkID0gaW5wdXQua2luZCAhPT0gJ2RlbGl2ZXJlZCcgfHwgQm9vbGVhbih1c2VyLmVtYWlsRGVsaXZlcnlTdGF0dXMgJiYgdXNlci5lbWFpbERlbGl2ZXJ5U3RhdHVzICE9PSAndmFsaWQnKTtcbiAgICBpZihwcmV2aW91cykge1xuICAgICAgYXdhaXQgdHguY29tbWl0KCk7XG4gICAgICByZXR1cm4gey4uLnByZXZpb3VzLnJlY2VpcHQsIHN1cHByZXNzZWR9O1xuICAgIH1cbiAgICBjb25zdCB0aW1lbGluZSA9IGF3YWl0IHF1ZXJ5KGFxbGBGT1IgZXZlbnQgSU4gY3JtRGVsaXZlcnlFdmVudHNcbiAgICAgIEZJTFRFUiBldmVudC5hcHBJZCA9PSAke2lucHV0LmFwcElkfSBBTkQgZXZlbnQucmVjZWlwdC5yZWNlaXB0SWQgPT0gJHtpbnB1dC5yZWNlaXB0SWR9XG4gICAgICBMSU1JVCAzMiBSRVRVUk4gZXZlbnQuX2tleWApLnRoZW4oKGN1cnNvcikgPT4gY3Vyc29yLmFsbCgpKSBhcyBzdHJpbmdbXTtcbiAgICBpZih0aW1lbGluZS5sZW5ndGggPj0gMzIpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcignY3JtX2RlbGl2ZXJ5X3RpbWVsaW5lX2xpbWl0Jyk7XG4gICAgfVxuICAgIGNvbnN0IHJlc3VsdDogQ3JtRGVsaXZlcnlFdmVudFJlY2VpcHQgPSB7Ym91bmNlVHlwZTogaW5wdXQuYm91bmNlVHlwZSwgaWQsIGtpbmQ6IGlucHV0LmtpbmQsXG4gICAgICBvY2N1cnJlZEF0OiBpbnB1dC5vY2N1cnJlZEF0LCByZWNlaXB0SWQ6IGlucHV0LnJlY2VpcHRJZCwgc3VwcHJlc3NlZH07XG4gICAgYXdhaXQgcXVlcnkoYXFsYElOU0VSVCAke3tfa2V5OiBpZCwgYXBwSWQ6IGlucHV0LmFwcElkLCBmaW5nZXJwcmludCwgcmVjZWlwdDogcmVzdWx0LCByZWNlaXZlZEF0OiBub3coKSxcbiAgICAgIHJlbGF5R3JhbnRJZDogZ3JhbnQuaWR9fSBJTlRPIGNybURlbGl2ZXJ5RXZlbnRzYCk7XG4gICAgaWYoaW5wdXQua2luZCAhPT0gJ2RlbGl2ZXJlZCcpIHtcbiAgICAgIC8vIEFueSBib3VuY2UgaG9sZHMgc2VuZHM7IGNsYXNzaWZpY2F0aW9uIGlzIGV2aWRlbmNlLCBub3QgYSBjbGFpbSB0aGF0IGEgdHJhbnNpZW50IGJvdW5jZSBpcyBwZXJtYW5lbnQuXG4gICAgICBjb25zdCBzdGF0dXMgPSBpbnB1dC5raW5kID09PSAnY29tcGxhaW50JyB8fCB1c2VyLmVtYWlsRGVsaXZlcnlTdGF0dXMgPT09ICdjb21wbGFpbnQnID8gJ2NvbXBsYWludCcgOiAnYm91bmNlX2hvbGQnO1xuICAgICAgYXdhaXQgcXVlcnkoYXFsYFVQREFURSAke3VzZXIuX2tleX0gV0lUSCB7ZW1haWxEZWxpdmVyeVN0YXR1czogJHtzdGF0dXN9LCBtb2RpZmllZDogJHtub3coKX19IElOIHVzZXJzYCk7XG4gICAgfVxuICAgIGF3YWl0IHF1ZXJ5KGFxbGBJTlNFUlQgJHt7X2Zyb206IGBjcm1FeGVjdXRpb25SZWNlaXB0cy8ke2lucHV0LnJlY2VpcHRJZH1gLCBfa2V5OiBpZCxcbiAgICAgIF90bzogYGNybURlbGl2ZXJ5RXZlbnRzLyR7aWR9YCwgYXBwSWQ6IGlucHV0LmFwcElkfX0gSU5UTyBoYXNDcm1FeGVjdXRpb25EZWxpdmVyeWApO1xuICAgIGF3YWl0IHF1ZXJ5KGFxbGBJTlNFUlQgJHt7X2Zyb206IGB1c2Vycy8ke3VzZXIuX2tleX1gLCBfa2V5OiBpZCxcbiAgICAgIF90bzogYGNybURlbGl2ZXJ5RXZlbnRzLyR7aWR9YCwgYXBwSWQ6IGlucHV0LmFwcElkfX0gSU5UTyBoYXNVc2VyQ3JtRGVsaXZlcnlgKTtcbiAgICBjb25zdCBjbG9zaW5nID0gYXdhaXQgYXV0aG9yaXplQ3JtRXhlY3V0aW9uR3JhbnQoY29udGV4dCwgaW5wdXQuYXBwSWQsICdjcm06ZGVsaXZlcnlfZXZlbnRzJywgbm93KCkpO1xuICAgIGlmKGNsb3NpbmcuaWQgIT09IGdyYW50LmlkIHx8IGNsb3NpbmcuaGFzaCAhPT0gZ3JhbnQuaGFzaCB8fCBjbG9zaW5nLmRhdGFiYXNlTmFtZSAhPT0gZ3JhbnQuZGF0YWJhc2VOYW1lKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2NybV9kZWxpdmVyeV9yZWxheV9jaGFuZ2VkJyk7XG4gICAgfVxuICAgIGF3YWl0IHR4LmNvbW1pdCgpO1xuICAgIHJldHVybiByZXN1bHQ7XG4gIH0gY2F0Y2goZXJyb3IpIHtcbiAgICBhd2FpdCB0eC5hYm9ydCgpO1xuICAgIHRocm93IGVycm9yO1xuICB9XG59O1xuXG5cbi8qKiBOYXRpdmUgYWRtaW5pc3RyYXRvciBwcml2YWN5IGFjdGlvbjsgcGVyc2lzdGVudCBtaW5pbWl6ZWQgdG9tYnN0b25lIHByZXZlbnRzIHByaW9yIGFjY2VwdGVkLW1lc3NhZ2UgcmVpbmdlc3Rpb24uICovXG5leHBvcnQgY29uc3QgZXJhc2VDcm1EZWxpdmVyeUV2aWRlbmNlID0gYXN5bmMgKFxuICBjb250ZXh0OiBBcGlDb250ZXh0LCBhcHBJZDogc3RyaW5nLCB1c2VySWQ6IHN0cmluZywgbm93ID0gRGF0ZS5ub3dcbik6IFByb21pc2U8e2VyYXNlZDogbnVtYmVyfT4gPT4ge1xuICByZXF1aXJlQ3JtQWRtaW5pc3RyYXRvcihjb250ZXh0KTtcbiAgaWYoIWlkZW50aWZpZXIoYXBwSWQpIHx8IGFwcElkLmxlbmd0aCA+IDEwMCB8fCAhaWRlbnRpZmllcih1c2VySWQpIHx8IHVzZXJJZC5sZW5ndGggPiAxMDApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2ludmFsaWRfY3JtX2RlbGl2ZXJ5X2VyYXN1cmUnKTtcbiAgfVxuICBjb25zdCBzY29wZWQgPSBhd2FpdCBzY29wZUNvbnRleHRUb0FwcChjb250ZXh0LCBhcHBJZCk7XG4gIGNvbnN0IGRiID0gdXNlRGIoc2NvcGVkLmRhdGFiYXNlTmFtZSk7XG4gIGNvbnN0IGRvY3VtZW50cyA9IFsnY3JtRGVsaXZlcnlFdmVudHMnLCAnY3JtRGVsaXZlcnlQcml2YWN5J107XG4gIGNvbnN0IGVkZ2VzID0gWydoYXNDcm1FeGVjdXRpb25EZWxpdmVyeScsICdoYXNVc2VyQ3JtRGVsaXZlcnknXTtcbiAgZm9yKGNvbnN0IG5hbWUgb2YgWy4uLmRvY3VtZW50cywgLi4uZWRnZXNdKSB7XG4gICAgYXdhaXQgZW5zdXJlT3duZXJFeGVjdXRpb25Db2xsZWN0aW9uKGRiLCBuYW1lLCBlZGdlcy5pbmNsdWRlcyhuYW1lKSk7XG4gIH1cbiAgY29uc3QgdHggPSBhd2FpdCBkYi5iZWdpblRyYW5zYWN0aW9uKHtleGNsdXNpdmU6IFsuLi5kb2N1bWVudHMsIC4uLmVkZ2VzXX0sIHtsb2NrVGltZW91dDogMTB9KTtcbiAgY29uc3QgcXVlcnkgPSAodmFsdWU6IFJldHVyblR5cGU8dHlwZW9mIGFxbD4pID0+IHR4LnN0ZXAoKCkgPT4gZGIucXVlcnkodmFsdWUpKTtcbiAgdHJ5IHtcbiAgICBjb25zdCBpZHMgPSBhd2FpdCBxdWVyeShhcWxgRk9SIGVkZ2UgSU4gaGFzVXNlckNybURlbGl2ZXJ5XG4gICAgICBGSUxURVIgZWRnZS5hcHBJZCA9PSAke2FwcElkfSBBTkQgZWRnZS5fZnJvbSA9PSAke2B1c2Vycy8ke3VzZXJJZH1gfVxuICAgICAgUkVUVVJOIFBBUlNFX0lERU5USUZJRVIoZWRnZS5fdG8pLmtleWApLnRoZW4oKGN1cnNvcikgPT4gY3Vyc29yLmFsbCgpKSBhcyBzdHJpbmdbXTtcbiAgICBjb25zdCBpZCA9IGNybURlbGl2ZXJ5UHJpdmFjeUtleShhcHBJZCwgdXNlcklkKTtcbiAgICBhd2FpdCBxdWVyeShhcWxgVVBTRVJUIHtfa2V5OiAke2lkfX0gSU5TRVJUICR7e19rZXk6IGlkLCBlcmFzZWRBdDogbm93KCl9fVxuICAgICAgVVBEQVRFIHtlcmFzZWRBdDogTUFYKFtPTEQuZXJhc2VkQXQsICR7bm93KCl9XSl9IElOIGNybURlbGl2ZXJ5UHJpdmFjeWApO1xuICAgIGF3YWl0IHF1ZXJ5KGFxbGBGT1IgZXZlbnQgSU4gY3JtRGVsaXZlcnlFdmVudHMgRklMVEVSIGV2ZW50Ll9rZXkgSU4gJHtpZHN9IFJFTU9WRSBldmVudCBJTiBjcm1EZWxpdmVyeUV2ZW50c2ApO1xuICAgIGF3YWl0IHF1ZXJ5KGFxbGBGT1IgZWRnZSBJTiBoYXNDcm1FeGVjdXRpb25EZWxpdmVyeSBGSUxURVIgZWRnZS5hcHBJZCA9PSAke2FwcElkfVxuICAgICAgQU5EIFBBUlNFX0lERU5USUZJRVIoZWRnZS5fdG8pLmtleSBJTiAke2lkc30gUkVNT1ZFIGVkZ2UgSU4gaGFzQ3JtRXhlY3V0aW9uRGVsaXZlcnlgKTtcbiAgICBhd2FpdCBxdWVyeShhcWxgRk9SIGVkZ2UgSU4gaGFzVXNlckNybURlbGl2ZXJ5IEZJTFRFUiBlZGdlLmFwcElkID09ICR7YXBwSWR9XG4gICAgICBBTkQgZWRnZS5fZnJvbSA9PSAke2B1c2Vycy8ke3VzZXJJZH1gfSBSRU1PVkUgZWRnZSBJTiBoYXNVc2VyQ3JtRGVsaXZlcnlgKTtcbiAgICBhd2FpdCB0eC5jb21taXQoKTtcbiAgICByZXR1cm4ge2VyYXNlZDogaWRzLmxlbmd0aH07XG4gIH0gY2F0Y2goZXJyb3IpIHtcbiAgICBhd2FpdCB0eC5hYm9ydCgpO1xuICAgIHRocm93IGVycm9yO1xuICB9XG59O1xuIl0sIm5hbWVzIjpbImFxbCIsImNyZWF0ZUhhc2giLCJzY29wZUNvbnRleHRUb0FwcCIsInVzZURiIiwicmVxdWlyZUNybUFkbWluaXN0cmF0b3IiLCJjcm1EZWxpdmVyeVByaXZhY3lLZXkiLCJhdXRob3JpemVDcm1FeGVjdXRpb25HcmFudCIsImVuc3VyZU93bmVyRXhlY3V0aW9uQ29sbGVjdGlvbiIsImRpZ2VzdCIsInZhbHVlIiwidXBkYXRlIiwiSlNPTiIsInN0cmluZ2lmeSIsImlkZW50aWZpZXIiLCJ0ZXN0IiwidmFsaWQiLCJpbnB1dCIsImF0IiwiQm9vbGVhbiIsImFwcElkIiwibGVuZ3RoIiwiZXZlbnRJZCIsInJlY2VpcHRJZCIsInByb3ZpZGVyTWVzc2FnZUlkIiwiaW5jbHVkZXMiLCJraW5kIiwiT2JqZWN0Iiwia2V5cyIsImV2ZXJ5Iiwia2V5IiwiYm91bmNlVHlwZSIsInVuZGVmaW5lZCIsIk51bWJlciIsImlzU2FmZUludGVnZXIiLCJvY2N1cnJlZEF0IiwiaW5nZXN0Q3JtRGVsaXZlcnlFdmVudCIsImNvbnRleHQiLCJub3ciLCJEYXRlIiwiRXJyb3IiLCJncmFudCIsImRiIiwiZGF0YWJhc2VOYW1lIiwiZG9jdW1lbnRzIiwiZWRnZXMiLCJuYW1lIiwidHgiLCJiZWdpblRyYW5zYWN0aW9uIiwiZXhjbHVzaXZlIiwibG9ja1RpbWVvdXQiLCJxdWVyeSIsInN0ZXAiLCJyZWNlaXB0IiwidGhlbiIsImN1cnNvciIsIm5leHQiLCJpZCIsInN0YXRlIiwicHJvdmlkZXJBY2NlcHRlZEF0IiwiY3JlYXRlZEF0IiwidXNlciIsInJlY2lwaWVudCIsImRlbGV0ZWQiLCJlbWFpbCIsIl9rZXkiLCJlcmFzZWQiLCJlcmFzZWRBdCIsImZpbmdlcnByaW50IiwicHJldmlvdXMiLCJjdXJyZW50IiwiaGFzaCIsInN1cHByZXNzZWQiLCJlbWFpbERlbGl2ZXJ5U3RhdHVzIiwiY29tbWl0IiwidGltZWxpbmUiLCJhbGwiLCJyZXN1bHQiLCJyZWNlaXZlZEF0IiwicmVsYXlHcmFudElkIiwic3RhdHVzIiwiX2Zyb20iLCJfdG8iLCJjbG9zaW5nIiwiZXJyb3IiLCJhYm9ydCIsImVyYXNlQ3JtRGVsaXZlcnlFdmlkZW5jZSIsInVzZXJJZCIsInNjb3BlZCIsImlkcyJdLCJtYXBwaW5ncyI6IkFBQUEsbUhBQW1ILEdBQ25ILFNBQVFBLEdBQUcsUUFBTyxXQUFXO0FBQzdCLFNBQVFDLFVBQVUsUUFBTyxjQUFjO0FBRXZDLFNBQVFDLGlCQUFpQixRQUFPLHlCQUF5QjtBQUN6RCxTQUFRQyxLQUFLLFFBQU8sNEJBQTRCO0FBQ2hELFNBQVFDLHVCQUF1QixRQUFPLFdBQVc7QUFDakQsU0FBUUMscUJBQXFCLFFBQU8sMkJBQTJCO0FBQy9ELFNBQVFDLDBCQUEwQixFQUFFQyw4QkFBOEIsUUFBTyxvQkFBb0I7QUFzQjdGLE1BQU1DLFNBQVMsQ0FBQ0MsUUFBMkJSLFdBQVcsVUFBVVMsTUFBTSxDQUFDQyxLQUFLQyxTQUFTLENBQUNILFFBQVFELE1BQU0sQ0FBQztBQUNyRyxNQUFNSyxhQUFhLENBQUNKLFFBQW9DLE9BQU9BLFVBQVUsWUFBWSxrQkFBa0JLLElBQUksQ0FBQ0w7QUFDNUcsTUFBTU0sUUFBUSxDQUFDQyxPQUE4QkMsS0FBd0JDLFFBQVFGLFNBQVNILFdBQVdHLE1BQU1HLEtBQUssS0FDdkdILE1BQU1HLEtBQUssQ0FBQ0MsTUFBTSxJQUFJLE9BQU9QLFdBQVdHLE1BQU1LLE9BQU8sS0FBSyxpQkFBaUJQLElBQUksQ0FBQ0UsTUFBTU0sU0FBUyxLQUMvRlQsV0FBV0csTUFBTU8saUJBQWlCLEtBQUs7UUFBQztRQUFhO1FBQVU7S0FBWSxDQUFDQyxRQUFRLENBQUNSLE1BQU1TLElBQUksS0FDL0ZDLE9BQU9DLElBQUksQ0FBQ1gsT0FBT1ksS0FBSyxDQUFDLENBQUNDLE1BQVE7WUFBQztZQUFTO1lBQWM7WUFBVztZQUFRO1lBQWM7WUFBcUI7U0FBWSxDQUFDTCxRQUFRLENBQUNLLFNBQ3JJYixDQUFBQSxNQUFNUyxJQUFJLEtBQUssV0FBVztRQUFDO1FBQWE7UUFBYTtLQUFlLENBQUNELFFBQVEsQ0FBQ1IsTUFBTWMsVUFBVSxJQUFJLE1BQU1kLE1BQU1jLFVBQVUsS0FBS0MsU0FBUSxLQUN0SUMsT0FBT0MsYUFBYSxDQUFDakIsTUFBTWtCLFVBQVUsS0FBS2xCLE1BQU1rQixVQUFVLElBQUlqQixLQUFLLFNBQ25FRCxNQUFNa0IsVUFBVSxJQUFJakIsS0FBTSxLQUFLO0FBRXBDLHVHQUF1RyxHQUN2RyxPQUFPLE1BQU1rQix5QkFBeUIsT0FDcENDLFNBQXFCcEIsT0FBOEJxQixNQUFNQyxLQUFLRCxHQUFHO0lBRWpFLElBQUcsQ0FBQ3RCLE1BQU1DLE9BQU9xQixRQUFRO1FBQ3ZCLE1BQU0sSUFBSUUsTUFBTTtJQUNsQjtJQUNBLE1BQU1DLFFBQVEsTUFBTWxDLDJCQUEyQjhCLFNBQVNwQixNQUFNRyxLQUFLLEVBQUUsdUJBQXVCa0I7SUFDNUYsTUFBTUksS0FBS3RDLE1BQU1xQyxNQUFNRSxZQUFZO0lBQ25DLE1BQU1DLFlBQVk7UUFBQztRQUFxQjtRQUF3QjtRQUFzQjtLQUFRO0lBQzlGLE1BQU1DLFFBQVE7UUFBQztRQUEyQjtLQUFxQjtJQUMvRCxLQUFJLE1BQU1DLFFBQVE7V0FBSUY7V0FBY0M7S0FBTSxDQUFFO1FBQzFDLE1BQU1yQywrQkFBK0JrQyxJQUFJSSxNQUFNRCxNQUFNcEIsUUFBUSxDQUFDcUI7SUFDaEU7SUFDQSxNQUFNQyxLQUFLLE1BQU1MLEdBQUdNLGdCQUFnQixDQUFDO1FBQUNDLFdBQVc7ZUFBSUw7ZUFBY0M7U0FBTTtJQUFBLEdBQUc7UUFBQ0ssYUFBYTtJQUFFO0lBQzVGLE1BQU1DLFFBQVEsQ0FBQ3pDLFFBQWtDcUMsR0FBR0ssSUFBSSxDQUFDLElBQU1WLEdBQUdTLEtBQUssQ0FBQ3pDO0lBQ3hFLElBQUk7UUFDRixNQUFNMkMsVUFBVSxNQUFNRixNQUFNbEQsR0FBRyxDQUFDLHdDQUF3QyxFQUFFZ0IsTUFBTU0sU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUN6RitCLElBQUksQ0FBQyxDQUFDQyxTQUFXQSxPQUFPQyxJQUFJO1FBQy9CLElBQUcsQ0FBQ0gsV0FBV0EsUUFBUWpDLEtBQUssS0FBS0gsTUFBTUcsS0FBSyxJQUFJaUMsUUFBUUksRUFBRSxLQUFLeEMsTUFBTU0sU0FBUyxJQUFJOEIsUUFBUUssS0FBSyxLQUFLLGFBQy9GLENBQUM7WUFBQztZQUFnQjtTQUFzQixDQUFDakMsUUFBUSxDQUFDNEIsUUFBUTNCLElBQUksS0FBSzJCLFFBQVE3QixpQkFBaUIsS0FBS1AsTUFBTU8saUJBQWlCLElBQ3hILENBQUNTLE9BQU9DLGFBQWEsQ0FBQ21CLFFBQVFNLGtCQUFrQixLQUFLTixRQUFRTSxrQkFBa0IsR0FBSU4sUUFBUU8sU0FBUyxJQUNwR1AsUUFBUU0sa0JBQWtCLEdBQUlyQixTQUFTckIsTUFBTWtCLFVBQVUsR0FBR2tCLFFBQVFNLGtCQUFrQixHQUFJLFNBQ3hGMUMsTUFBTWtCLFVBQVUsR0FBR2tCLFFBQVFNLGtCQUFrQixHQUFLLEtBQUssVUFBVztZQUNyRSxNQUFNLElBQUluQixNQUFNO1FBQ2xCO1FBQ0EsTUFBTXFCLE9BQU8sTUFBTVYsTUFBTWxELEdBQUcsQ0FBQyx5QkFBeUIsRUFBRW9ELFFBQVFTLFNBQVMsQ0FBQ0wsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUM1RUgsSUFBSSxDQUFDLENBQUNDLFNBQVdBLE9BQU9DLElBQUk7UUFHL0IsSUFBRyxDQUFDSyxRQUFRQSxLQUFLRSxPQUFPLEtBQUssUUFBUUYsS0FBS0csS0FBSyxLQUFLWCxRQUFRUyxTQUFTLENBQUNFLEtBQUssSUFBSUgsS0FBS0ksSUFBSSxLQUFLWixRQUFRUyxTQUFTLENBQUNMLEVBQUUsRUFBRTtZQUNqSCxNQUFNLElBQUlqQixNQUFNO1FBQ2xCO1FBQ0EsTUFBTTBCLFNBQVMsTUFBTWYsTUFBTWxELEdBQUcsQ0FBQyxzQ0FBc0MsRUFBRUssc0JBQXNCVyxNQUFNRyxLQUFLLEVBQUV5QyxLQUFLSSxJQUFJLEVBQUUsQ0FBQyxDQUFDLEVBQ3BIWCxJQUFJLENBQUMsQ0FBQ0MsU0FBV0EsT0FBT0MsSUFBSTtRQUMvQixJQUFHVSxVQUFVYixRQUFRTSxrQkFBa0IsSUFBS08sT0FBT0MsUUFBUSxFQUFFO1lBQzNELE1BQU0sSUFBSTNCLE1BQU07UUFDbEI7UUFDQSxNQUFNaUIsS0FBS2hELE9BQU87WUFBQ1EsTUFBTUcsS0FBSztZQUFFSCxNQUFNSyxPQUFPO1NBQUM7UUFDOUMsTUFBTThDLGNBQWMzRCxPQUFPO1lBQUNRLE1BQU1HLEtBQUs7WUFBRUgsTUFBTU0sU0FBUztZQUFFTixNQUFNTyxpQkFBaUI7WUFBRVAsTUFBTVMsSUFBSTtZQUMzRlQsTUFBTWMsVUFBVTtZQUFFZCxNQUFNa0IsVUFBVTtTQUFDO1FBQ3JDLE1BQU1rQyxXQUFXLE1BQU1sQixNQUFNbEQsR0FBRyxDQUFDLHFDQUFxQyxFQUFFd0QsR0FBRyxDQUFDLENBQUMsRUFDMUVILElBQUksQ0FBQyxDQUFDQyxTQUFXQSxPQUFPQyxJQUFJO1FBQy9CLElBQUdhLFlBQVlBLFNBQVNELFdBQVcsS0FBS0EsYUFBYTtZQUNuRCxNQUFNLElBQUk1QixNQUFNO1FBQ2xCO1FBQ0EsTUFBTThCLFVBQVUsTUFBTS9ELDJCQUEyQjhCLFNBQVNwQixNQUFNRyxLQUFLLEVBQUUsdUJBQXVCa0I7UUFDOUYsSUFBR2dDLFFBQVFiLEVBQUUsS0FBS2hCLE1BQU1nQixFQUFFLElBQUlhLFFBQVFDLElBQUksS0FBSzlCLE1BQU04QixJQUFJLElBQUlELFFBQVEzQixZQUFZLEtBQUtGLE1BQU1FLFlBQVksRUFBRTtZQUN4RyxNQUFNLElBQUlILE1BQU07UUFDbEI7UUFDQSxNQUFNZ0MsYUFBYXZELE1BQU1TLElBQUksS0FBSyxlQUFlUCxRQUFRMEMsS0FBS1ksbUJBQW1CLElBQUlaLEtBQUtZLG1CQUFtQixLQUFLO1FBQ2xILElBQUdKLFVBQVU7WUFDWCxNQUFNdEIsR0FBRzJCLE1BQU07WUFDZixPQUFPO2dCQUFDLEdBQUdMLFNBQVNoQixPQUFPO2dCQUFFbUI7WUFBVTtRQUN6QztRQUNBLE1BQU1HLFdBQVcsTUFBTXhCLE1BQU1sRCxHQUFHLENBQUM7NEJBQ1QsRUFBRWdCLE1BQU1HLEtBQUssQ0FBQyxnQ0FBZ0MsRUFBRUgsTUFBTU0sU0FBUyxDQUFDO2dDQUM1RCxDQUFDLEVBQUUrQixJQUFJLENBQUMsQ0FBQ0MsU0FBV0EsT0FBT3FCLEdBQUc7UUFDMUQsSUFBR0QsU0FBU3RELE1BQU0sSUFBSSxJQUFJO1lBQ3hCLE1BQU0sSUFBSW1CLE1BQU07UUFDbEI7UUFDQSxNQUFNcUMsU0FBa0M7WUFBQzlDLFlBQVlkLE1BQU1jLFVBQVU7WUFBRTBCO1lBQUkvQixNQUFNVCxNQUFNUyxJQUFJO1lBQ3pGUyxZQUFZbEIsTUFBTWtCLFVBQVU7WUFBRVosV0FBV04sTUFBTU0sU0FBUztZQUFFaUQ7UUFBVTtRQUN0RSxNQUFNckIsTUFBTWxELEdBQUcsQ0FBQyxPQUFPLEVBQUU7WUFBQ2dFLE1BQU1SO1lBQUlyQyxPQUFPSCxNQUFNRyxLQUFLO1lBQUVnRDtZQUFhZixTQUFTd0I7WUFBUUMsWUFBWXhDO1lBQ2hHeUMsY0FBY3RDLE1BQU1nQixFQUFFO1FBQUEsRUFBRSx1QkFBdUIsQ0FBQztRQUNsRCxJQUFHeEMsTUFBTVMsSUFBSSxLQUFLLGFBQWE7WUFDN0Isd0dBQXdHO1lBQ3hHLE1BQU1zRCxTQUFTL0QsTUFBTVMsSUFBSSxLQUFLLGVBQWVtQyxLQUFLWSxtQkFBbUIsS0FBSyxjQUFjLGNBQWM7WUFDdEcsTUFBTXRCLE1BQU1sRCxHQUFHLENBQUMsT0FBTyxFQUFFNEQsS0FBS0ksSUFBSSxDQUFDLDRCQUE0QixFQUFFZSxPQUFPLFlBQVksRUFBRTFDLE1BQU0sVUFBVSxDQUFDO1FBQ3pHO1FBQ0EsTUFBTWEsTUFBTWxELEdBQUcsQ0FBQyxPQUFPLEVBQUU7WUFBQ2dGLE9BQU8sQ0FBQyxxQkFBcUIsRUFBRWhFLE1BQU1NLFNBQVMsRUFBRTtZQUFFMEMsTUFBTVI7WUFDaEZ5QixLQUFLLENBQUMsa0JBQWtCLEVBQUV6QixJQUFJO1lBQUVyQyxPQUFPSCxNQUFNRyxLQUFLO1FBQUEsRUFBRSw2QkFBNkIsQ0FBQztRQUNwRixNQUFNK0IsTUFBTWxELEdBQUcsQ0FBQyxPQUFPLEVBQUU7WUFBQ2dGLE9BQU8sQ0FBQyxNQUFNLEVBQUVwQixLQUFLSSxJQUFJLEVBQUU7WUFBRUEsTUFBTVI7WUFDM0R5QixLQUFLLENBQUMsa0JBQWtCLEVBQUV6QixJQUFJO1lBQUVyQyxPQUFPSCxNQUFNRyxLQUFLO1FBQUEsRUFBRSx3QkFBd0IsQ0FBQztRQUMvRSxNQUFNK0QsVUFBVSxNQUFNNUUsMkJBQTJCOEIsU0FBU3BCLE1BQU1HLEtBQUssRUFBRSx1QkFBdUJrQjtRQUM5RixJQUFHNkMsUUFBUTFCLEVBQUUsS0FBS2hCLE1BQU1nQixFQUFFLElBQUkwQixRQUFRWixJQUFJLEtBQUs5QixNQUFNOEIsSUFBSSxJQUFJWSxRQUFReEMsWUFBWSxLQUFLRixNQUFNRSxZQUFZLEVBQUU7WUFDeEcsTUFBTSxJQUFJSCxNQUFNO1FBQ2xCO1FBQ0EsTUFBTU8sR0FBRzJCLE1BQU07UUFDZixPQUFPRztJQUNULEVBQUUsT0FBTU8sT0FBTztRQUNiLE1BQU1yQyxHQUFHc0MsS0FBSztRQUNkLE1BQU1EO0lBQ1I7QUFDRixFQUFFO0FBR0YscUhBQXFILEdBQ3JILE9BQU8sTUFBTUUsMkJBQTJCLE9BQ3RDakQsU0FBcUJqQixPQUFlbUUsUUFBZ0JqRCxNQUFNQyxLQUFLRCxHQUFHO0lBRWxFakMsd0JBQXdCZ0M7SUFDeEIsSUFBRyxDQUFDdkIsV0FBV00sVUFBVUEsTUFBTUMsTUFBTSxHQUFHLE9BQU8sQ0FBQ1AsV0FBV3lFLFdBQVdBLE9BQU9sRSxNQUFNLEdBQUcsS0FBSztRQUN6RixNQUFNLElBQUltQixNQUFNO0lBQ2xCO0lBQ0EsTUFBTWdELFNBQVMsTUFBTXJGLGtCQUFrQmtDLFNBQVNqQjtJQUNoRCxNQUFNc0IsS0FBS3RDLE1BQU1vRixPQUFPN0MsWUFBWTtJQUNwQyxNQUFNQyxZQUFZO1FBQUM7UUFBcUI7S0FBcUI7SUFDN0QsTUFBTUMsUUFBUTtRQUFDO1FBQTJCO0tBQXFCO0lBQy9ELEtBQUksTUFBTUMsUUFBUTtXQUFJRjtXQUFjQztLQUFNLENBQUU7UUFDMUMsTUFBTXJDLCtCQUErQmtDLElBQUlJLE1BQU1ELE1BQU1wQixRQUFRLENBQUNxQjtJQUNoRTtJQUNBLE1BQU1DLEtBQUssTUFBTUwsR0FBR00sZ0JBQWdCLENBQUM7UUFBQ0MsV0FBVztlQUFJTDtlQUFjQztTQUFNO0lBQUEsR0FBRztRQUFDSyxhQUFhO0lBQUU7SUFDNUYsTUFBTUMsUUFBUSxDQUFDekMsUUFBa0NxQyxHQUFHSyxJQUFJLENBQUMsSUFBTVYsR0FBR1MsS0FBSyxDQUFDekM7SUFDeEUsSUFBSTtRQUNGLE1BQU0rRSxNQUFNLE1BQU10QyxNQUFNbEQsR0FBRyxDQUFDOzJCQUNMLEVBQUVtQixNQUFNLG1CQUFtQixFQUFFLENBQUMsTUFBTSxFQUFFbUUsUUFBUSxDQUFDOzJDQUMvQixDQUFDLEVBQUVqQyxJQUFJLENBQUMsQ0FBQ0MsU0FBV0EsT0FBT3FCLEdBQUc7UUFDckUsTUFBTW5CLEtBQUtuRCxzQkFBc0JjLE9BQU9tRTtRQUN4QyxNQUFNcEMsTUFBTWxELEdBQUcsQ0FBQyxjQUFjLEVBQUV3RCxHQUFHLFNBQVMsRUFBRTtZQUFDUSxNQUFNUjtZQUFJVSxVQUFVN0I7UUFBSyxFQUFFOzJDQUNuQyxFQUFFQSxNQUFNLHlCQUF5QixDQUFDO1FBQ3pFLE1BQU1hLE1BQU1sRCxHQUFHLENBQUMsb0RBQW9ELEVBQUV3RixJQUFJLGtDQUFrQyxDQUFDO1FBQzdHLE1BQU10QyxNQUFNbEQsR0FBRyxDQUFDLHlEQUF5RCxFQUFFbUIsTUFBTTs0Q0FDekMsRUFBRXFFLElBQUksdUNBQXVDLENBQUM7UUFDdEYsTUFBTXRDLE1BQU1sRCxHQUFHLENBQUMsb0RBQW9ELEVBQUVtQixNQUFNO3dCQUN4RCxFQUFFLENBQUMsTUFBTSxFQUFFbUUsUUFBUSxDQUFDLGtDQUFrQyxDQUFDO1FBQzNFLE1BQU14QyxHQUFHMkIsTUFBTTtRQUNmLE9BQU87WUFBQ1IsUUFBUXVCLElBQUlwRSxNQUFNO1FBQUE7SUFDNUIsRUFBRSxPQUFNK0QsT0FBTztRQUNiLE1BQU1yQyxHQUFHc0MsS0FBSztRQUNkLE1BQU1EO0lBQ1I7QUFDRixFQUFFIn0=

package/lib/actions/crmDeliveryEvidence.d.ts

@@ -0,0 +1,17 @@
+import type { useDb } from '../utils/arangodbUtils.js';
+import type { CrmExecutionReceipt } from './crmExecution.js';
+export interface CrmDeliveryEvidence {
+    events: {
+        bounceType?: 'Permanent' | 'Transient' | 'Undetermined';
+        kind: 'delivered' | 'bounce' | 'complaint';
+        occurredAt: number;
+    }[];
+    generatedAt: number;
+    negativeHold: boolean | null;
+    schemaVersion: 'crm_delivery_evidence_v1';
+    status: 'available' | 'erased' | 'unavailable';
+    validUntil: number;
+}
+export declare const crmDeliveryPrivacyKey: (appId: string, userId: string) => string;
+/** Internal projection composed only after the ordinary exact native receipt-read authority check. */
+export declare const readCrmDeliveryEvidence: (db: ReturnType<typeof useDb>, receipt: CrmExecutionReceipt, now: number, expires: number) => Promise<CrmDeliveryEvidence>;

package/lib/actions/crmDeliveryEvidence.js

@@ -0,0 +1,58 @@
+/* eslint-disable no-underscore-dangle -- Native minimized owner recipient and ledger metadata. */ import { aql } from 'arangojs';
+import { createHash } from 'node:crypto';
+export const crmDeliveryPrivacyKey = (appId, userId)=>createHash('sha256').update(JSON.stringify([
+        appId,
+        userId
+    ])).digest('hex');
+/** Internal projection composed only after the ordinary exact native receipt-read authority check. */ export const readCrmDeliveryEvidence = async (db, receipt, now, expires)=>{
+    const base = {
+        events: [],
+        generatedAt: now,
+        negativeHold: null,
+        schemaVersion: 'crm_delivery_evidence_v1',
+        status: 'unavailable',
+        validUntil: Math.min(expires, now + 900000)
+    };
+    if (receipt.state !== 'applied' || !receipt.providerMessageId || !Number.isSafeInteger(receipt.providerAcceptedAt) || ![
+        'crm_outreach',
+        'scheduling_reminder'
+    ].includes(receipt.kind) || expires <= now || !await db.collection('crmDeliveryEvents').exists() || !await db.collection('crmDeliveryPrivacy').exists()) {
+        return base;
+    }
+    const row = await db.query(aql`LET user = DOCUMENT('users', ${receipt.recipient.id})
+    LET privacy = DOCUMENT('crmDeliveryPrivacy', ${crmDeliveryPrivacyKey(receipt.appId, receipt.recipient.id)})
+    LET events = (FOR event IN crmDeliveryEvents
+      FILTER event.appId == ${receipt.appId} AND event.receipt.receiptId == ${receipt.id}
+      SORT event.receipt.occurredAt ASC, event._key ASC LIMIT 33
+      RETURN KEEP(event.receipt, 'bounceType', 'kind', 'occurredAt'))
+    RETURN {events, privacy, user: user ? KEEP(user, '_key', 'deleted', 'email', 'emailDeliveryStatus') : null}`).then((cursor)=>cursor.next());
+    if (row?.privacy && receipt.providerAcceptedAt <= row.privacy.erasedAt) {
+        return {
+            ...base,
+            status: 'erased'
+        };
+    }
+    if (!row?.user || row.user.deleted === true || row.user._key !== receipt.recipient.id || row.user.email !== receipt.recipient.email || !Array.isArray(row.events) || row.events.length > 32 || row.events.some((event)=>![
+            'delivered',
+            'bounce',
+            'complaint'
+        ].includes(event.kind) || !Number.isSafeInteger(event.occurredAt) || event.occurredAt > now + 60000 || event.occurredAt < receipt.providerAcceptedAt - 60000 || (event.kind === 'bounce' ? ![
+            'Permanent',
+            'Transient',
+            'Undetermined'
+        ].includes(event.bounceType || '') : event.bounceType !== undefined))) {
+        return base;
+    }
+    return {
+        ...base,
+        events: row.events.map((event)=>({
+                bounceType: event.bounceType,
+                kind: event.kind,
+                occurredAt: event.occurredAt
+            })),
+        negativeHold: Boolean(row.user.emailDeliveryStatus && row.user.emailDeliveryStatus !== 'valid'),
+        status: 'available'
+    };
+};
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9Vc2Vycy9uaXRyb2c3L0RldmVsb3BtZW50L3JlYWt0b3IvcGFja2FnZXMvcmVha3Rvci9zcmMvYWN0aW9ucy9jcm1EZWxpdmVyeUV2aWRlbmNlLnRzIl0sInNvdXJjZXNDb250ZW50IjpbIi8qIGVzbGludC1kaXNhYmxlIG5vLXVuZGVyc2NvcmUtZGFuZ2xlIC0tIE5hdGl2ZSBtaW5pbWl6ZWQgb3duZXIgcmVjaXBpZW50IGFuZCBsZWRnZXIgbWV0YWRhdGEuICovXG5pbXBvcnQge2FxbH0gZnJvbSAnYXJhbmdvanMnO1xuaW1wb3J0IHtjcmVhdGVIYXNofSBmcm9tICdub2RlOmNyeXB0byc7XG5cbmltcG9ydCB0eXBlIHt1c2VEYn0gZnJvbSAnLi4vdXRpbHMvYXJhbmdvZGJVdGlscy5qcyc7XG5pbXBvcnQgdHlwZSB7Q3JtRXhlY3V0aW9uUmVjZWlwdH0gZnJvbSAnLi9jcm1FeGVjdXRpb24uanMnO1xuXG5leHBvcnQgaW50ZXJmYWNlIENybURlbGl2ZXJ5RXZpZGVuY2Uge1xuICBldmVudHM6IHtib3VuY2VUeXBlPzogJ1Blcm1hbmVudCcgfCAnVHJhbnNpZW50JyB8ICdVbmRldGVybWluZWQnOyBraW5kOiAnZGVsaXZlcmVkJyB8ICdib3VuY2UnIHwgJ2NvbXBsYWludCc7IG9jY3VycmVkQXQ6IG51bWJlcn1bXTtcbiAgZ2VuZXJhdGVkQXQ6IG51bWJlcjtcbiAgbmVnYXRpdmVIb2xkOiBib29sZWFuIHwgbnVsbDtcbiAgc2NoZW1hVmVyc2lvbjogJ2NybV9kZWxpdmVyeV9ldmlkZW5jZV92MSc7XG4gIHN0YXR1czogJ2F2YWlsYWJsZScgfCAnZXJhc2VkJyB8ICd1bmF2YWlsYWJsZSc7XG4gIHZhbGlkVW50aWw6IG51bWJlcjtcbn1cbmV4cG9ydCBjb25zdCBjcm1EZWxpdmVyeVByaXZhY3lLZXkgPSAoYXBwSWQ6IHN0cmluZywgdXNlcklkOiBzdHJpbmcpOiBzdHJpbmcgPT5cbiAgY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKEpTT04uc3RyaW5naWZ5KFthcHBJZCwgdXNlcklkXSkpLmRpZ2VzdCgnaGV4Jyk7XG5cbi8qKiBJbnRlcm5hbCBwcm9qZWN0aW9uIGNvbXBvc2VkIG9ubHkgYWZ0ZXIgdGhlIG9yZGluYXJ5IGV4YWN0IG5hdGl2ZSByZWNlaXB0LXJlYWQgYXV0aG9yaXR5IGNoZWNrLiAqL1xuZXhwb3J0IGNvbnN0IHJlYWRDcm1EZWxpdmVyeUV2aWRlbmNlID0gYXN5bmMgKFxuICBkYjogUmV0dXJuVHlwZTx0eXBlb2YgdXNlRGI+LCByZWNlaXB0OiBDcm1FeGVjdXRpb25SZWNlaXB0LCBub3c6IG51bWJlciwgZXhwaXJlczogbnVtYmVyXG4pOiBQcm9taXNlPENybURlbGl2ZXJ5RXZpZGVuY2U+ID0+IHtcbiAgY29uc3QgYmFzZTogQ3JtRGVsaXZlcnlFdmlkZW5jZSA9IHtldmVudHM6IFtdLCBnZW5lcmF0ZWRBdDogbm93LCBuZWdhdGl2ZUhvbGQ6IG51bGwsXG4gICAgc2NoZW1hVmVyc2lvbjogJ2NybV9kZWxpdmVyeV9ldmlkZW5jZV92MScsIHN0YXR1czogJ3VuYXZhaWxhYmxlJywgdmFsaWRVbnRpbDogTWF0aC5taW4oZXhwaXJlcywgbm93ICsgOTAwMDAwKX07XG4gIGlmKHJlY2VpcHQuc3RhdGUgIT09ICdhcHBsaWVkJyB8fCAhcmVjZWlwdC5wcm92aWRlck1lc3NhZ2VJZCB8fCAhTnVtYmVyLmlzU2FmZUludGVnZXIocmVjZWlwdC5wcm92aWRlckFjY2VwdGVkQXQpXG4gICAgfHwgIVsnY3JtX291dHJlYWNoJywgJ3NjaGVkdWxpbmdfcmVtaW5kZXInXS5pbmNsdWRlcyhyZWNlaXB0LmtpbmQpIHx8IGV4cGlyZXMgPD0gbm93XG4gICAgfHwgIWF3YWl0IGRiLmNvbGxlY3Rpb24oJ2NybURlbGl2ZXJ5RXZlbnRzJykuZXhpc3RzKCkgfHwgIWF3YWl0IGRiLmNvbGxlY3Rpb24oJ2NybURlbGl2ZXJ5UHJpdmFjeScpLmV4aXN0cygpKSB7XG4gICAgcmV0dXJuIGJhc2U7XG4gIH1cbiAgY29uc3Qgcm93ID0gYXdhaXQgZGIucXVlcnkoYXFsYExFVCB1c2VyID0gRE9DVU1FTlQoJ3VzZXJzJywgJHtyZWNlaXB0LnJlY2lwaWVudC5pZH0pXG4gICAgTEVUIHByaXZhY3kgPSBET0NVTUVOVCgnY3JtRGVsaXZlcnlQcml2YWN5JywgJHtjcm1EZWxpdmVyeVByaXZhY3lLZXkocmVjZWlwdC5hcHBJZCwgcmVjZWlwdC5yZWNpcGllbnQuaWQpfSlcbiAgICBMRVQgZXZlbnRzID0gKEZPUiBldmVudCBJTiBjcm1EZWxpdmVyeUV2ZW50c1xuICAgICAgRklMVEVSIGV2ZW50LmFwcElkID09ICR7cmVjZWlwdC5hcHBJZH0gQU5EIGV2ZW50LnJlY2VpcHQucmVjZWlwdElkID09ICR7cmVjZWlwdC5pZH1cbiAgICAgIFNPUlQgZXZlbnQucmVjZWlwdC5vY2N1cnJlZEF0IEFTQywgZXZlbnQuX2tleSBBU0MgTElNSVQgMzNcbiAgICAgIFJFVFVSTiBLRUVQKGV2ZW50LnJlY2VpcHQsICdib3VuY2VUeXBlJywgJ2tpbmQnLCAnb2NjdXJyZWRBdCcpKVxuICAgIFJFVFVSTiB7ZXZlbnRzLCBwcml2YWN5LCB1c2VyOiB1c2VyID8gS0VFUCh1c2VyLCAnX2tleScsICdkZWxldGVkJywgJ2VtYWlsJywgJ2VtYWlsRGVsaXZlcnlTdGF0dXMnKSA6IG51bGx9YClcbiAgICAudGhlbigoY3Vyc29yKSA9PiBjdXJzb3IubmV4dCgpKSBhcyB7ZXZlbnRzOiBDcm1EZWxpdmVyeUV2aWRlbmNlWydldmVudHMnXTsgcHJpdmFjeT86IHtlcmFzZWRBdDogbnVtYmVyfTtcbiAgICAgIHVzZXI/OiB7X2tleTogc3RyaW5nOyBkZWxldGVkPzogYm9vbGVhbjsgZW1haWw6IHN0cmluZzsgZW1haWxEZWxpdmVyeVN0YXR1cz86IHN0cmluZ307fSB8IHVuZGVmaW5lZDtcbiAgaWYocm93Py5wcml2YWN5ICYmIHJlY2VpcHQucHJvdmlkZXJBY2NlcHRlZEF0ISA8PSByb3cucHJpdmFjeS5lcmFzZWRBdCkge1xuICAgIHJldHVybiB7Li4uYmFzZSwgc3RhdHVzOiAnZXJhc2VkJ307XG4gIH1cbiAgaWYoIXJvdz8udXNlciB8fCByb3cudXNlci5kZWxldGVkID09PSB0cnVlIHx8IHJvdy51c2VyLl9rZXkgIT09IHJlY2VpcHQucmVjaXBpZW50LmlkXG4gICAgfHwgcm93LnVzZXIuZW1haWwgIT09IHJlY2VpcHQucmVjaXBpZW50LmVtYWlsIHx8ICFBcnJheS5pc0FycmF5KHJvdy5ldmVudHMpIHx8IHJvdy5ldmVudHMubGVuZ3RoID4gMzJcbiAgICB8fCByb3cuZXZlbnRzLnNvbWUoKGV2ZW50KSA9PiAhWydkZWxpdmVyZWQnLCAnYm91bmNlJywgJ2NvbXBsYWludCddLmluY2x1ZGVzKGV2ZW50LmtpbmQpXG4gICAgICB8fCAhTnVtYmVyLmlzU2FmZUludGVnZXIoZXZlbnQub2NjdXJyZWRBdCkgfHwgZXZlbnQub2NjdXJyZWRBdCA+IG5vdyArIDYwMDAwXG4gICAgICB8fCBldmVudC5vY2N1cnJlZEF0IDwgcmVjZWlwdC5wcm92aWRlckFjY2VwdGVkQXQhIC0gNjAwMDBcbiAgICAgIHx8IChldmVudC5raW5kID09PSAnYm91bmNlJyA/ICFbJ1Blcm1hbmVudCcsICdUcmFuc2llbnQnLCAnVW5kZXRlcm1pbmVkJ10uaW5jbHVkZXMoZXZlbnQuYm91bmNlVHlwZSB8fCAnJylcbiAgICAgICAgOiBldmVudC5ib3VuY2VUeXBlICE9PSB1bmRlZmluZWQpKSkge1xuICAgIHJldHVybiBiYXNlO1xuICB9XG4gIHJldHVybiB7Li4uYmFzZSwgZXZlbnRzOiByb3cuZXZlbnRzLm1hcCgoZXZlbnQpID0+ICh7Ym91bmNlVHlwZTogZXZlbnQuYm91bmNlVHlwZSxcbiAgICBraW5kOiBldmVudC5raW5kLCBvY2N1cnJlZEF0OiBldmVudC5vY2N1cnJlZEF0fSkpLFxuICBuZWdhdGl2ZUhvbGQ6IEJvb2xlYW4ocm93LnVzZXIuZW1haWxEZWxpdmVyeVN0YXR1cyAmJiByb3cudXNlci5lbWFpbERlbGl2ZXJ5U3RhdHVzICE9PSAndmFsaWQnKSwgc3RhdHVzOiAnYXZhaWxhYmxlJ307XG59O1xuIl0sIm5hbWVzIjpbImFxbCIsImNyZWF0ZUhhc2giLCJjcm1EZWxpdmVyeVByaXZhY3lLZXkiLCJhcHBJZCIsInVzZXJJZCIsInVwZGF0ZSIsIkpTT04iLCJzdHJpbmdpZnkiLCJkaWdlc3QiLCJyZWFkQ3JtRGVsaXZlcnlFdmlkZW5jZSIsImRiIiwicmVjZWlwdCIsIm5vdyIsImV4cGlyZXMiLCJiYXNlIiwiZXZlbnRzIiwiZ2VuZXJhdGVkQXQiLCJuZWdhdGl2ZUhvbGQiLCJzY2hlbWFWZXJzaW9uIiwic3RhdHVzIiwidmFsaWRVbnRpbCIsIk1hdGgiLCJtaW4iLCJzdGF0ZSIsInByb3ZpZGVyTWVzc2FnZUlkIiwiTnVtYmVyIiwiaXNTYWZlSW50ZWdlciIsInByb3ZpZGVyQWNjZXB0ZWRBdCIsImluY2x1ZGVzIiwia2luZCIsImNvbGxlY3Rpb24iLCJleGlzdHMiLCJyb3ciLCJxdWVyeSIsInJlY2lwaWVudCIsImlkIiwidGhlbiIsImN1cnNvciIsIm5leHQiLCJwcml2YWN5IiwiZXJhc2VkQXQiLCJ1c2VyIiwiZGVsZXRlZCIsIl9rZXkiLCJlbWFpbCIsIkFycmF5IiwiaXNBcnJheSIsImxlbmd0aCIsInNvbWUiLCJldmVudCIsIm9jY3VycmVkQXQiLCJib3VuY2VUeXBlIiwidW5kZWZpbmVkIiwibWFwIiwiQm9vbGVhbiIsImVtYWlsRGVsaXZlcnlTdGF0dXMiXSwibWFwcGluZ3MiOiJBQUFBLGdHQUFnRyxHQUNoRyxTQUFRQSxHQUFHLFFBQU8sV0FBVztBQUM3QixTQUFRQyxVQUFVLFFBQU8sY0FBYztBQWF2QyxPQUFPLE1BQU1DLHdCQUF3QixDQUFDQyxPQUFlQyxTQUNuREgsV0FBVyxVQUFVSSxNQUFNLENBQUNDLEtBQUtDLFNBQVMsQ0FBQztRQUFDSjtRQUFPQztLQUFPLEdBQUdJLE1BQU0sQ0FBQyxPQUFPO0FBRTdFLG9HQUFvRyxHQUNwRyxPQUFPLE1BQU1DLDBCQUEwQixPQUNyQ0MsSUFBOEJDLFNBQThCQyxLQUFhQztJQUV6RSxNQUFNQyxPQUE0QjtRQUFDQyxRQUFRLEVBQUU7UUFBRUMsYUFBYUo7UUFBS0ssY0FBYztRQUM3RUMsZUFBZTtRQUE0QkMsUUFBUTtRQUFlQyxZQUFZQyxLQUFLQyxHQUFHLENBQUNULFNBQVNELE1BQU07SUFBTztJQUMvRyxJQUFHRCxRQUFRWSxLQUFLLEtBQUssYUFBYSxDQUFDWixRQUFRYSxpQkFBaUIsSUFBSSxDQUFDQyxPQUFPQyxhQUFhLENBQUNmLFFBQVFnQixrQkFBa0IsS0FDM0csQ0FBQztRQUFDO1FBQWdCO0tBQXNCLENBQUNDLFFBQVEsQ0FBQ2pCLFFBQVFrQixJQUFJLEtBQUtoQixXQUFXRCxPQUM5RSxDQUFDLE1BQU1GLEdBQUdvQixVQUFVLENBQUMscUJBQXFCQyxNQUFNLE1BQU0sQ0FBQyxNQUFNckIsR0FBR29CLFVBQVUsQ0FBQyxzQkFBc0JDLE1BQU0sSUFBSTtRQUM5RyxPQUFPakI7SUFDVDtJQUNBLE1BQU1rQixNQUFNLE1BQU10QixHQUFHdUIsS0FBSyxDQUFDakMsR0FBRyxDQUFDLDZCQUE2QixFQUFFVyxRQUFRdUIsU0FBUyxDQUFDQyxFQUFFLENBQUM7aURBQ3BDLEVBQUVqQyxzQkFBc0JTLFFBQVFSLEtBQUssRUFBRVEsUUFBUXVCLFNBQVMsQ0FBQ0MsRUFBRSxFQUFFOzs0QkFFbEYsRUFBRXhCLFFBQVFSLEtBQUssQ0FBQyxnQ0FBZ0MsRUFBRVEsUUFBUXdCLEVBQUUsQ0FBQzs7OytHQUdzQixDQUFDLEVBQzNHQyxJQUFJLENBQUMsQ0FBQ0MsU0FBV0EsT0FBT0MsSUFBSTtJQUUvQixJQUFHTixLQUFLTyxXQUFXNUIsUUFBUWdCLGtCQUFrQixJQUFLSyxJQUFJTyxPQUFPLENBQUNDLFFBQVEsRUFBRTtRQUN0RSxPQUFPO1lBQUMsR0FBRzFCLElBQUk7WUFBRUssUUFBUTtRQUFRO0lBQ25DO0lBQ0EsSUFBRyxDQUFDYSxLQUFLUyxRQUFRVCxJQUFJUyxJQUFJLENBQUNDLE9BQU8sS0FBSyxRQUFRVixJQUFJUyxJQUFJLENBQUNFLElBQUksS0FBS2hDLFFBQVF1QixTQUFTLENBQUNDLEVBQUUsSUFDL0VILElBQUlTLElBQUksQ0FBQ0csS0FBSyxLQUFLakMsUUFBUXVCLFNBQVMsQ0FBQ1UsS0FBSyxJQUFJLENBQUNDLE1BQU1DLE9BQU8sQ0FBQ2QsSUFBSWpCLE1BQU0sS0FBS2lCLElBQUlqQixNQUFNLENBQUNnQyxNQUFNLEdBQUcsTUFDaEdmLElBQUlqQixNQUFNLENBQUNpQyxJQUFJLENBQUMsQ0FBQ0MsUUFBVSxDQUFDO1lBQUM7WUFBYTtZQUFVO1NBQVksQ0FBQ3JCLFFBQVEsQ0FBQ3FCLE1BQU1wQixJQUFJLEtBQ2xGLENBQUNKLE9BQU9DLGFBQWEsQ0FBQ3VCLE1BQU1DLFVBQVUsS0FBS0QsTUFBTUMsVUFBVSxHQUFHdEMsTUFBTSxTQUNwRXFDLE1BQU1DLFVBQVUsR0FBR3ZDLFFBQVFnQixrQkFBa0IsR0FBSSxTQUNoRHNCLENBQUFBLE1BQU1wQixJQUFJLEtBQUssV0FBVyxDQUFDO1lBQUM7WUFBYTtZQUFhO1NBQWUsQ0FBQ0QsUUFBUSxDQUFDcUIsTUFBTUUsVUFBVSxJQUFJLE1BQ25HRixNQUFNRSxVQUFVLEtBQUtDLFNBQVEsSUFBSztRQUN4QyxPQUFPdEM7SUFDVDtJQUNBLE9BQU87UUFBQyxHQUFHQSxJQUFJO1FBQUVDLFFBQVFpQixJQUFJakIsTUFBTSxDQUFDc0MsR0FBRyxDQUFDLENBQUNKLFFBQVcsQ0FBQTtnQkFBQ0UsWUFBWUYsTUFBTUUsVUFBVTtnQkFDL0V0QixNQUFNb0IsTUFBTXBCLElBQUk7Z0JBQUVxQixZQUFZRCxNQUFNQyxVQUFVO1lBQUEsQ0FBQTtRQUNoRGpDLGNBQWNxQyxRQUFRdEIsSUFBSVMsSUFBSSxDQUFDYyxtQkFBbUIsSUFBSXZCLElBQUlTLElBQUksQ0FBQ2MsbUJBQW1CLEtBQUs7UUFBVXBDLFFBQVE7SUFBVztBQUN0SCxFQUFFIn0=

package/lib/actions/crmExecution.d.ts

@@ -0,0 +1,125 @@
+import { useDb } from '../utils/arangodbUtils.js';
+import { sesSend } from './email.js';
+import type { ApiContext } from '../types/auth.types.js';
+import type { CrmCheckoutRecoveryBinding, CrmCheckoutRecoveryBounds } from './crmCheckoutRecoveryPolicy.js';
+import type { CrmDeliveryEvidence } from './crmDeliveryEvidence.js';
+import type { CrmLeadFollowupBinding, CrmLeadFollowupBounds } from './crmLeadFollowups.js';
+import type { CrmWinbackBinding } from './crmWinback.js';
+import type { CrmWinbackBounds } from './crmWinbackPolicy.js';
+import type { SupportManagement } from './supportPolicy.js';
+export type CrmExecutionScope = 'crm:checkout_recovery' | 'crm:delivery_events' | 'crm:lead_followup' | 'crm:outreach' | 'crm:winback' | 'support:commerce' | 'support:conversation' | 'support:summary' | 'support:email_reply' | 'support:delivery_events' | 'support:channel_ingest' | 'support:context' | 'support:read' | 'support:triage' | 'support:reply' | 'support:manage' | 'scheduling:calendar_sync' | 'scheduling:calendar_invite' | 'scheduling:read' | 'scheduling:book' | 'scheduling:remind' | 'finance:provider_read' | 'finance:read' | 'finance:invoice';
+export interface CrmExecutionGrantInput {
+    appId: string;
+    expiresAt: string;
+    followupBounds?: CrmLeadFollowupBounds;
+    recoveryBounds?: CrmCheckoutRecoveryBounds;
+    winbackBounds?: CrmWinbackBounds;
+    scopes: CrmExecutionScope[];
+    senderEmail: string;
+    unsubscribeUrl?: string;
+}
+export interface CrmExecutionInput {
+    appId: string;
+    body: string;
+    expectedSourceRevision: string;
+    includeVerifiedRecoveryLink?: boolean;
+    followup?: CrmLeadFollowupBinding;
+    recovery?: CrmCheckoutRecoveryBinding;
+    winback?: CrmWinbackBinding;
+    idempotencyKey: string;
+    kind: 'crm_outreach' | 'support_triage' | 'support_reply' | 'support_manage' | 'scheduling_reminder';
+    management?: SupportManagement;
+    status?: 'in_progress' | 'waiting_on_customer' | 'waiting_on_internal';
+    subject: string;
+    targetId: string;
+}
+export interface CrmExecutionReceipt {
+    appId: string;
+    body?: string;
+    contentStatus?: 'current' | 'redacted';
+    createdAt: number;
+    deliveryEvidence?: CrmDeliveryEvidence;
+    expiresAt: number;
+    followup?: CrmLeadFollowupBinding;
+    recovery?: CrmCheckoutRecoveryBinding;
+    winback?: CrmWinbackBinding;
+    grantId: string;
+    id: string;
+    kind: CrmExecutionInput['kind'];
+    management?: SupportManagement;
+    maxActions: 1;
+    notBefore?: number;
+    providerAcceptedAt?: number;
+    providerMessageId?: string;
+    recipient: {
+        email?: string;
+        id: string;
+    };
+    recoveryLinkHash?: string;
+    revision: string;
+    sourceRevision: string;
+    scheduled?: boolean;
+    scheduleStatus?: 'scheduled' | 'cancelled' | 'held' | 'completed';
+    scheduleUpdatedAt?: number;
+    state: 'pending' | 'approved' | 'rejected' | 'submitting' | 'unknown' | 'applied';
+    status?: CrmExecutionInput['status'];
+    subject?: string;
+    targetId: string;
+}
+interface Grant extends CrmExecutionGrantInput {
+    databaseName: string;
+    expires: number;
+    hash: string;
+    id: string;
+    ownerId: string;
+    revokedAt?: number;
+}
+interface Source {
+    email: string;
+    id: string;
+    revision: string;
+    notBefore?: number;
+    reminderConsentId?: string;
+    subject?: string;
+    ticketStatus?: string;
+}
+/** Native hosts can expire capability content in bounded maintenance without altering send claims. */
+export declare const retainCrmCheckoutRecoveryContent: (context: ApiContext, appId: string, now?: () => number) => Promise<number>;
+export declare const ensureOwnerExecutionCollection: (db: ReturnType<typeof useDb>, name: string, edge?: boolean) => Promise<void>;
+/** Grant writes are administrator-only; the secret is returned once and never stored. */
+export declare const createCrmExecutionKey: (context: ApiContext, input: CrmExecutionGrantInput, now?: () => number) => Promise<{
+    appId: string;
+    executionKey: string;
+    expiresAt: string;
+    followupBounds: CrmLeadFollowupBounds;
+    id: `${string}-${string}-${string}-${string}-${string}`;
+    recoveryBounds: CrmCheckoutRecoveryBounds;
+    scopes: CrmExecutionScope[];
+    winbackBounds: CrmWinbackBounds;
+}>;
+export declare const revokeCrmExecutionKey: (context: ApiContext, appId: string, id: string, now?: () => number) => Promise<boolean>;
+export declare const authorizeCrmExecutionGrant: (context: ApiContext, appId: string, scope: CrmExecutionScope, now: number) => Promise<Grant>;
+declare const source: (db: ReturnType<typeof useDb>, kind: CrmExecutionInput['kind'], targetId: string, query?: any, at?: number, appId?: string) => Promise<Source>;
+/** Source policy shared by already-authorized owner workflows; never exposed as an HTTP resolver. */
+export declare const readCrmExecutionTargetSource: typeof source;
+/** Minimized authorized target read; no ticket descriptions, history or unrelated customer fields. */
+export declare const readCrmExecutionTarget: (context: ApiContext, appId: string, kind: CrmExecutionInput['kind'], targetId: string, now?: () => number) => Promise<{
+    email: string;
+    id: string;
+    revision: string;
+    notBefore?: number;
+    reminderConsentId?: string;
+    subject?: string;
+    ticketStatus?: string;
+    appId: string;
+    targetId: string;
+}>;
+export declare const getCrmExecutionReceipt: (context: ApiContext, appId: string, id: string, now?: () => number) => Promise<CrmExecutionReceipt>;
+/** Freeze exactly one recipient and plain-text action. Approval is a separate revision-bound operation. */
+export declare const previewCrmExecution: (context: ApiContext, input: CrmExecutionInput, now?: () => number) => Promise<CrmExecutionReceipt>;
+export declare const decideCrmExecution: (context: ApiContext, appId: string, id: string, revision: string, decision: 'approved' | 'rejected', now?: () => number) => Promise<CrmExecutionReceipt>;
+/** Customer-facing Support reply/triage commits atomically. SES submissions are never blindly retried. */
+export declare const executeCrmExecution: (context: ApiContext, appId: string, id: string, revision: string, now?: () => number, send?: (params: Parameters<typeof sesSend>[0]) => Promise<import("@aws-sdk/client-ses").SendEmailCommandOutput>, scheduled?: boolean) => Promise<CrmExecutionReceipt>;
+/** Public opaque unsubscribe capability; only updates the exact consent-bound recipient. */
+export declare const unsubscribeCrmExecution: (context: ApiContext, appId: string, token: string, now?: () => number) => Promise<boolean>;
+export {};