@rapidmx/crm-plugin 0.1.0

package/dist/lib/util/PropertyValues.js

@@ -0,0 +1,145 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ModelUtils } from "@rapidrest/service-core";
+import { PropertyType } from "../models/types.js";
+import { MAX_LONG_TEXT, badRequest, isObject, parseDate } from "./Validation.js";
+/** The `PropertyValue.key` tags are stored under. Never a custom property's key: those can't be one of a record's own fields. */
+export const TAGS_KEY = "tags";
+/** How many custom property values one request may set. */
+export const MAX_PROPERTIES_PER_WRITE = 200;
+/**
+ * The stored rows for a `properties` object from a request: for each key, the rows to write in place of the record's current ones
+ * (none, to clear it with `null`). Every key must name one of `definitions` for `objectType`, and every value must suit its type.
+ */
+export function readProperties(raw, definitions, objectType) {
+    const result = new Map();
+    if (raw === undefined) {
+        return result;
+    }
+    if (!isObject(raw)) {
+        throw badRequest("'properties' must be an object.");
+    }
+    const entries = Object.entries(raw);
+    if (entries.length > MAX_PROPERTIES_PER_WRITE) {
+        throw badRequest(`At most ${MAX_PROPERTIES_PER_WRITE} properties may be set at once.`);
+    }
+    for (const [key, value] of entries) {
+        const definition = definitions.find((entry) => entry.objectType === objectType && entry.key === key);
+        if (!definition) {
+            throw badRequest(`There is no ${objectType} property '${key}'.`);
+        }
+        result.set(key, value === null || value === "" ? [] : storedValues(definition, value));
+    }
+    return result;
+}
+/** The rows one property value is stored as, or a 400. */
+export function storedValues(definition, value) {
+    const where = `The '${definition.key}' property`;
+    const options = definition.options.map((option) => option.value);
+    switch (definition.type) {
+        case PropertyType.NUMBER:
+            if (typeof value === "number" && Number.isFinite(value)) {
+                return [{ numberValue: value }];
+            }
+            throw badRequest(`${where} must be a number.`);
+        case PropertyType.BOOLEAN:
+            if (typeof value === "boolean") {
+                return [{ numberValue: value ? 1 : 0 }];
+            }
+            throw badRequest(`${where} must be true or false.`);
+        case PropertyType.DATE: {
+            const date = parseDate(value);
+            if (date) {
+                return [{ dateValue: date }];
+            }
+            throw badRequest(`${where} must be a date.`);
+        }
+        case PropertyType.SELECT:
+            if (typeof value === "string" && options.includes(value)) {
+                return [{ stringValue: value }];
+            }
+            throw badRequest(`${where} must be one of: ${options.join(", ")}.`);
+        case PropertyType.MULTI_SELECT: {
+            if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || !options.includes(entry))) {
+                throw badRequest(`${where} must be a list of: ${options.join(", ")}.`);
+            }
+            return [...new Set(value)].map((entry) => ({ stringValue: entry }));
+        }
+        default:
+            if (typeof value === "string" && value.trim().length <= MAX_LONG_TEXT) {
+                return [{ stringValue: value.trim() }];
+            }
+            throw badRequest(`${where} must be text of at most ${MAX_LONG_TEXT} characters.`);
+    }
+}
+/** Replaces the rows of one key of one record with `values`. */
+export async function writeValues(repo, valueClass, record, key, values) {
+    await repo.truncate({ objectUid: ModelUtils.literal(record.objectUid), key: ModelUtils.literal(key) }, { ignoreACL: true });
+    for (const value of values) {
+        await repo.create(new valueClass({ ...record, key, ...value }), { ignoreACL: true, skipPush: true });
+    }
+}
+/** Deletes every custom property value and tag of the records `objectUids`. */
+export async function deleteValues(repo, objectUids) {
+    if (objectUids.length > 0) {
+        await repo.truncate({ objectUid: ModelUtils.literal([...objectUids], "in") }, { ignoreACL: true });
+    }
+}
+/** Every stored value of each of `objectUids`, grouped by record and then by key. */
+export async function readValues(repo, objectUids) {
+    var _a;
+    const result = new Map();
+    for (let start = 0; start < objectUids.length; start += 500) {
+        const batch = objectUids.slice(start, start + 500);
+        for (let page = 0;; page++) {
+            const rows = await repo.find({ objectUid: ModelUtils.literal(batch, "in") }, { ignoreACL: true, limit: 1000, page, skipCache: true });
+            for (const row of rows) {
+                const byKey = result.get(row.objectUid) ?? {};
+                (byKey[_a = row.key] ?? (byKey[_a] = [])).push(row);
+                result.set(row.objectUid, byKey);
+            }
+            if (rows.length < 1000) {
+                break;
+            }
+        }
+    }
+    return result;
+}
+/** The API view of one record's stored values: `{ key: value }` for each custom property that has one (tags are left out). */
+export function propertiesView(values, definitions) {
+    const view = {};
+    for (const [key, rows] of Object.entries(values ?? {})) {
+        const definition = definitions.find((entry) => entry.key === key);
+        if (!definition || rows.length === 0) {
+            continue;
+        }
+        switch (definition.type) {
+            case PropertyType.NUMBER:
+                view[key] = Number(rows[0].numberValue);
+                break;
+            case PropertyType.BOOLEAN:
+                view[key] = Number(rows[0].numberValue) === 1;
+                break;
+            case PropertyType.DATE:
+                view[key] = new Date(rows[0].dateValue).toISOString();
+                break;
+            case PropertyType.MULTI_SELECT:
+                view[key] = rows.map((row) => row.stringValue).sort();
+                break;
+            default:
+                view[key] = rows[0].stringValue;
+        }
+    }
+    return view;
+}
+/** The stored values of one record as `evaluateFilter()` takes them: `{ key: [value, ...] }`, dates as `Date`s. */
+export function filterValues(values) {
+    const result = {};
+    for (const [key, rows] of Object.entries(values ?? {})) {
+        result[key] = rows.map((row) => row.stringValue ?? (row.numberValue !== undefined && row.numberValue !== null ? Number(row.numberValue) : row.dateValue));
+    }
+    return result;
+}
+//# sourceMappingURL=PropertyValues.js.map

package/dist/lib/util/PropertyValues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PropertyValues.js","sourceRoot":"","sources":["../../../src/util/PropertyValues.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,UAAU,EAAkB,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAqC,YAAY,EAAiB,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjF,iIAAiI;AACjI,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAQ5C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC1B,GAAY,EACZ,WAA0C,EAC1C,UAAyB;IAEzB,MAAM,MAAM,GAA+B,IAAI,GAAG,EAAE,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjB,MAAM,UAAU,CAAC,iCAAiC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC5C,MAAM,UAAU,CAAC,WAAW,wBAAwB,iCAAiC,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,UAAU,GAAmC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACrI,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,eAAe,UAAU,cAAc,GAAG,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,UAA8B,EAAE,KAAc;IACvE,MAAM,KAAK,GAAW,QAAQ,UAAU,CAAC,GAAG,YAAY,CAAC;IACzD,MAAM,OAAO,GAAa,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,YAAY,CAAC,MAAM;YACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,UAAU,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QACnD,KAAK,YAAY,CAAC,OAAO;YACrB,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,UAAU,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;QACxD,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GAAqB,SAAS,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,IAAI,EAAE,CAAC;gBACP,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,UAAU,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,YAAY,CAAC,MAAM;YACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,UAAU,CAAC,GAAG,KAAK,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,KAAK,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxG,MAAM,UAAU,CAAC,GAAG,KAAK,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QACD;YACI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;gBACpE,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,UAAU,CAAC,GAAG,KAAK,4BAA4B,aAAa,cAAc,CAAC,CAAC;IAC1F,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,IAAoB,EACpB,UAAe,EACf,MAA8E,EAC9E,GAAW,EACX,MAA8B;IAE9B,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzG,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAoB,EAAE,UAA6B;IAClF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAoB,EAAE,UAA6B;;IAChF,MAAM,MAAM,GAAiD,IAAI,GAAG,EAAE,CAAC;IACvE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAa,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;QAC7D,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAoB,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAoC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC/E,CAAC,KAAK,MAAC,GAAG,CAAC,GAAG,MAAb,KAAK,OAAc,EAAE,EAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBACrB,MAAM;YACV,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,cAAc,CAAC,MAAmD,EAAE,WAA0C;IAC1H,MAAM,IAAI,GAAsC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAmC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAClG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,SAAS;QACb,CAAC;QACD,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,YAAY,CAAC,MAAM;gBACpB,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACxC,MAAM;YACV,KAAK,YAAY,CAAC,OAAO;gBACrB,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM;YACV,KAAK,YAAY,CAAC,IAAI;gBAClB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9D,MAAM;YACV,KAAK,YAAY,CAAC,YAAY;gBAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAqB,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChE,MAAM;YACV;gBACI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAqB,CAAC;QAClD,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,YAAY,CAAC,MAAmD;IAC5E,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9J,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/lib/util/Secrets.js

@@ -0,0 +1,31 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import * as crypto from "crypto";
+import { ModelUtils } from "@rapidrest/service-core";
+/** The `CrmSetting` key of the generated token key. */
+export const TOKEN_SECRET_KEY = "token-secret";
+/**
+ * The generated key tokens and tracking links are signed with, kept as a `CrmSetting` so every server copy (routes and jobs alike)
+ * signs and checks with the same key: read, or generated and saved on first use. Two copies generating one at once both read back
+ * whichever was saved first (the key is unique).
+ */
+export async function readOrCreateTokenSecret(repo, settingClass) {
+    const find = async () => (await repo.find({ key: ModelUtils.literal(TOKEN_SECRET_KEY) }, { ignoreACL: true, limit: 1, skipCache: true }))[0];
+    let setting = await find();
+    if (!setting) {
+        try {
+            setting = await repo.create(new settingClass({ key: TOKEN_SECRET_KEY, value: crypto.randomBytes(32).toString("base64url") }), {
+                ignoreACL: true,
+                skipPush: true,
+            });
+        }
+        catch {
+            // Another copy saved one first: use theirs.
+            setting = await find();
+        }
+    }
+    return setting.value;
+}
+//# sourceMappingURL=Secrets.js.map

package/dist/lib/util/Secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Secrets.js","sourceRoot":"","sources":["../../../src/util/Secrets.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,UAAU,EAAa,MAAM,yBAAyB,CAAC;AAGhE,uDAAuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAA2B,EAAE,YAAiB;IACxF,MAAM,IAAI,GAAG,KAAK,IAAqC,EAAE,CACrD,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,IAAI,OAAO,GAA2B,MAAM,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;gBAC1H,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;aACjB,CAAC,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACL,4CAA4C;YAC5C,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,OAAQ,CAAC,KAAK,CAAC;AAC1B,CAAC"}

package/dist/lib/util/Tokens.js

@@ -0,0 +1,58 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import * as crypto from "crypto";
+/** The longest token accepted, so a huge string is refused before any work. */
+export const MAX_TOKEN_LENGTH = 2048;
+function base64url(data) {
+    return Buffer.from(data).toString("base64url");
+}
+function mac(secret, body) {
+    return crypto.createHmac("sha256", secret).update(body).digest("base64url");
+}
+/**
+ * A token carrying `payload`, signed with `secret` (HMAC-SHA256): `<base64url JSON>.<base64url MAC>`. The link in every email a
+ * contact gets carries one, so the preference center and one-click unsubscribe work without an account - and without the link's
+ * contact or workspace being guessable or changeable.
+ */
+export function signToken(payload, secret) {
+    const body = base64url(JSON.stringify(payload));
+    return `${body}.${mac(secret, body)}`;
+}
+/**
+ * The payload of a token signed with `secret` for `purpose`, or `undefined` for anything else: malformed, forged, for another
+ * purpose, or expired. The signature is compared in constant time.
+ */
+export function verifyToken(token, secret, purpose, now = new Date()) {
+    if (typeof token !== "string" || token.length > MAX_TOKEN_LENGTH) {
+        return undefined;
+    }
+    const dot = token.indexOf(".");
+    if (dot <= 0 || dot !== token.lastIndexOf(".")) {
+        return undefined;
+    }
+    const body = token.slice(0, dot);
+    const expected = Buffer.from(mac(secret, body));
+    const given = Buffer.from(token.slice(dot + 1));
+    if (given.length !== expected.length || !crypto.timingSafeEqual(given, expected)) {
+        return undefined;
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(body, "base64url").toString("utf-8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (payload?.p !== purpose ||
+        typeof payload.w !== "string" ||
+        typeof payload.c !== "string" ||
+        (payload.l !== undefined && (!Array.isArray(payload.l) || payload.l.some((uid) => typeof uid !== "string"))) ||
+        (payload.s !== undefined && typeof payload.s !== "string") ||
+        (payload.x !== undefined && (typeof payload.x !== "number" || payload.x * 1000 < now.getTime()))) {
+        return undefined;
+    }
+    return payload;
+}
+//# sourceMappingURL=Tokens.js.map

package/dist/lib/util/Tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tokens.js","sourceRoot":"","sources":["../../../src/util/Tokens.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAqBjC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,SAAS,SAAS,CAAC,IAAqB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,IAAY;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,OAAqB,EAAE,MAAc;IAC3D,MAAM,IAAI,GAAW,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,MAAc,EAAE,OAAqB,EAAE,MAAY,IAAI,IAAI,EAAE;IACrG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAW,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAW,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAW,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAW,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/E,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,OAAqB,CAAC;IAC1B,IAAI,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IACI,OAAO,EAAE,CAAC,KAAK,OAAO;QACtB,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ;QAC7B,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ;QAC7B,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC;QAC5G,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC;QAC1D,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAClG,CAAC;QACC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/dist/lib/util/Validation.js

@@ -0,0 +1,194 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError } from "@rapidrest/core";
+import { ApiErrors } from "@rapidrest/service-core";
+/** The longest one-line text field (a name, a title, a job title...). */
+export const MAX_SHORT_TEXT = 256;
+/** The longest multi-line text field (a note, a description). */
+export const MAX_LONG_TEXT = 20000;
+/** The longest email address (RFC 5321). */
+export const MAX_EMAIL_LENGTH = 254;
+/** How many tags one record may carry, and how long one may be. */
+export const MAX_TAGS = 50;
+export const MAX_TAG_LENGTH = 64;
+/** One address: something before and after a single `@`, no whitespace, and nothing a query could read as an operator. */
+const EMAIL_PATTERN = /^[^\s()@,<>"';]+@[^\s()@,<>"';]+\.[^\s()@,<>"';.]+$/;
+/** A 400 `ApiError` with `message`. */
+export function badRequest(message) {
+    return new ApiError(ApiErrors.INVALID_REQUEST, 400, message);
+}
+/** A 409 `ApiError` with `message`. */
+export function conflict(message) {
+    return new ApiError(ApiErrors.IDENTIFIER_EXISTS, 409, message);
+}
+/** Whether `body` is a plain JSON object. */
+export function isObject(body) {
+    return typeof body === "object" && body !== null && !Array.isArray(body);
+}
+/** `body` as a plain object, or a 400. */
+export function requireObject(body) {
+    if (!isObject(body)) {
+        throw badRequest("The request body must be a JSON object.");
+    }
+    return body;
+}
+/**
+ * A text field: trimmed, at most `max` characters. `undefined` when absent; `null` when explicitly cleared (`null` or empty),
+ * which only an optional field allows. A required field that is missing or empty is a 400.
+ */
+export function readText(body, field, options = {}) {
+    const raw = body[field];
+    if (raw === undefined) {
+        if (options.required) {
+            throw badRequest(`'${field}' is required.`);
+        }
+        return undefined;
+    }
+    if (raw !== null && typeof raw !== "string") {
+        throw badRequest(`'${field}' must be a string.`);
+    }
+    const value = (raw ?? "").trim();
+    if (value.length === 0) {
+        if (options.required) {
+            throw badRequest(`'${field}' is required.`);
+        }
+        return null;
+    }
+    const max = options.max ?? MAX_SHORT_TEXT;
+    if (value.length > max) {
+        throw badRequest(`'${field}' must be at most ${max} characters.`);
+    }
+    return value;
+}
+/** An email address, lowercased. The same absent/cleared/required rules as `readText()`. */
+export function readEmail(body, field, options = {}) {
+    const value = readText(body, field, { ...options, max: MAX_EMAIL_LENGTH });
+    if (typeof value === "string") {
+        const email = value.toLowerCase();
+        if (!isEmail(email)) {
+            throw badRequest(`'${field}' must be an email address.`);
+        }
+        return email;
+    }
+    return value;
+}
+/** Whether `value` looks like one email address. */
+export function isEmail(value) {
+    return value.length <= MAX_EMAIL_LENGTH && EMAIL_PATTERN.test(value);
+}
+/** One of `allowed`. `undefined` when absent; `null` when explicitly cleared, which only an optional field allows. */
+export function readEnum(body, field, allowed, options = {}) {
+    const raw = body[field];
+    if (raw === undefined || raw === null) {
+        if (options.required) {
+            throw badRequest(`'${field}' is required.`);
+        }
+        return raw;
+    }
+    if (typeof raw !== "string" || !allowed.includes(raw)) {
+        throw badRequest(`'${field}' must be one of: ${allowed.join(", ")}.`);
+    }
+    return raw;
+}
+/** A finite number, optionally an integer within `[min, max]`. `undefined` when absent; `null` when cleared. */
+export function readNumber(body, field, options = {}) {
+    const raw = body[field];
+    if (raw === undefined || raw === null) {
+        return raw;
+    }
+    if (typeof raw !== "number" || !Number.isFinite(raw) || (options.integer && !Number.isInteger(raw))) {
+        throw badRequest(`'${field}' must be ${options.integer ? "a whole number" : "a number"}.`);
+    }
+    if ((options.min !== undefined && raw < options.min) || (options.max !== undefined && raw > options.max)) {
+        throw badRequest(`'${field}' must be between ${options.min ?? "-infinity"} and ${options.max ?? "infinity"}.`);
+    }
+    return raw;
+}
+/** A boolean. `undefined` when absent. */
+export function readBoolean(body, field) {
+    const raw = body[field];
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (typeof raw !== "boolean") {
+        throw badRequest(`'${field}' must be true or false.`);
+    }
+    return raw;
+}
+/** A date from an ISO 8601 string. `undefined` when absent; `null` when cleared. */
+export function readDate(body, field) {
+    const raw = body[field];
+    if (raw === undefined || raw === null || raw === "") {
+        return raw === "" ? null : (raw);
+    }
+    const date = parseDate(raw);
+    if (!date) {
+        throw badRequest(`'${field}' must be a date.`);
+    }
+    return date;
+}
+/** `raw` as a valid date, from an ISO 8601 string or a `Date`, or `undefined`. */
+export function parseDate(raw) {
+    const date = raw instanceof Date ? raw : typeof raw === "string" && raw.length <= 64 ? new Date(raw) : new Date(NaN);
+    return Number.isNaN(date.getTime()) ? undefined : date;
+}
+/** One tag, normalized: trimmed, lowercased, inner whitespace collapsed. `undefined` when it is empty or too long. */
+export function normalizeTag(raw) {
+    if (typeof raw !== "string") {
+        return undefined;
+    }
+    const tag = raw.trim().toLowerCase().replace(/\s+/g, " ");
+    return tag.length > 0 && tag.length <= MAX_TAG_LENGTH ? tag : undefined;
+}
+/** A list of tags, normalized and de-duplicated. `undefined` when absent. */
+export function readTags(body, field = "tags") {
+    const raw = body[field];
+    if (raw === undefined) {
+        return undefined;
+    }
+    if (raw === null) {
+        return [];
+    }
+    if (!Array.isArray(raw)) {
+        throw badRequest(`'${field}' must be a list of strings.`);
+    }
+    const tags = [];
+    for (const entry of raw) {
+        const tag = normalizeTag(entry);
+        if (tag === undefined) {
+            throw badRequest(`Each of '${field}' must be text of 1 to ${MAX_TAG_LENGTH} characters.`);
+        }
+        if (!tags.includes(tag)) {
+            tags.push(tag);
+        }
+    }
+    if (tags.length > MAX_TAGS) {
+        throw badRequest(`A record may have at most ${MAX_TAGS} tags.`);
+    }
+    return tags;
+}
+/** A page of a list: `limit` between 1 and `maxLimit` (default 50), `page` from 0. */
+export function readPaging(limit, page, maxLimit = 200) {
+    const parsedLimit = limit === undefined || limit === "" ? 50 : Number(limit);
+    const parsedPage = page === undefined || page === "" ? 0 : Number(page);
+    if (!Number.isInteger(parsedLimit) || parsedLimit < 1 || parsedLimit > maxLimit) {
+        throw badRequest(`'limit' must be a whole number from 1 to ${maxLimit}.`);
+    }
+    if (!Number.isInteger(parsedPage) || parsedPage < 0 || parsedPage > 100000) {
+        throw badRequest("'page' must be a whole number from 0.");
+    }
+    return { limit: parsedLimit, page: parsedPage };
+}
+/** A company's web domain from a domain, a URL or an email address: lowercase, without scheme, path, port or `www.`. */
+export function normalizeDomain(raw) {
+    let value = raw.trim().toLowerCase();
+    const at = value.lastIndexOf("@");
+    if (at >= 0) {
+        value = value.slice(at + 1);
+    }
+    value = value.replace(/^[a-z][a-z0-9+.-]*:\/\//, "").split(/[/?#]/)[0].split(":")[0].replace(/^www\./, "").replace(/\.$/, "");
+    return /^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(value) && value.length <= 253 ? value : undefined;
+}
+//# sourceMappingURL=Validation.js.map

package/dist/lib/util/Validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Validation.js","sourceRoot":"","sources":["../../../src/util/Validation.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,iEAAiE;AACjE,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACnC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AACpC,mEAAmE;AACnE,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAC3B,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,0HAA0H;AAC1H,MAAM,aAAa,GAAG,qDAAqD,CAAC;AAE5E,uCAAuC;AACvC,MAAM,UAAU,UAAU,CAAC,OAAe;IACtC,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,QAAQ,CAAC,OAAe;IACpC,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,IAAa;IAClC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,aAAa,CAAC,IAAa;IACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClB,MAAM,UAAU,CAAC,yCAAyC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAA6B,EAAE,KAAa,EAAE,UAAgD,EAAE;IACrH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,UAAU,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,KAAK,GAAW,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,IAAI,KAAK,qBAAqB,GAAG,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,IAA6B,EAAE,KAAa,EAAE,UAAkC,EAAE;IACxG,MAAM,KAAK,GAA8B,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACtG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAW,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,MAAM,UAAU,CAAC,IAAI,KAAK,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,OAAO,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,MAAM,IAAI,gBAAgB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,QAAQ,CACpB,IAA6B,EAC7B,KAAa,EACb,OAAqB,EACrB,UAAkC,EAAE;IAEpC,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAQ,CAAC,EAAE,CAAC;QACzD,MAAM,UAAU,CAAC,IAAI,KAAK,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAQ,CAAC;AACpB,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,UAAU,CACtB,IAA6B,EAC7B,KAAa,EACb,UAA6D,EAAE;IAE/D,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,GAAG,CAAC;IACf,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAClG,MAAM,UAAU,CAAC,IAAI,KAAK,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvG,MAAM,UAAU,CAAC,IAAI,KAAK,qBAAqB,OAAO,CAAC,GAAG,IAAI,WAAW,QAAQ,OAAO,CAAC,GAAG,IAAI,UAAU,GAAG,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAA6B,EAAE,KAAa;IACpE,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,UAAU,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,QAAQ,CAAC,IAA6B,EAAE,KAAa;IACjE,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAClD,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAqB,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,UAAU,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,SAAS,CAAC,GAAY;IAClC,MAAM,IAAI,GAAS,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3H,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,YAAY,CAAC,GAAY;IACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAW,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,IAA6B,EAAE,QAAgB,MAAM;IAC1E,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,UAAU,CAAC,IAAI,KAAK,8BAA8B,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,GAAuB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,UAAU,CAAC,YAAY,KAAK,0BAA0B,cAAc,cAAc,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,UAAU,CAAC,6BAA6B,QAAQ,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,IAAa,EAAE,WAAmB,GAAG;IAC5E,MAAM,WAAW,GAAW,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,UAAU,GAAW,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,QAAQ,EAAE,CAAC;QAC9E,MAAM,UAAU,CAAC,4CAA4C,QAAQ,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC;QACzE,MAAM,UAAU,CAAC,uCAAuC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,eAAe,CAAC,GAAW;IACvC,IAAI,KAAK,GAAW,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,EAAE,GAAW,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACV,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9H,OAAO,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC"}

package/dist/lib/util/WorkspaceAccess.js

@@ -0,0 +1,55 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError } from "@rapidrest/core";
+import { ApiErrorMessages, ApiErrors } from "@rapidrest/service-core";
+import { stripTrustedRoles } from "@rapidmx/restapi";
+import { WorkspaceAction, WorkspaceRole } from "../models/types.js";
+/** The actions each role is granted on its workspace's `AccessControlList`. An owner holds `FULL` (`*`), which includes them all. */
+export const ROLE_ACTIONS = {
+    [WorkspaceRole.OWNER]: ["*"],
+    [WorkspaceRole.ADMIN]: [WorkspaceAction.READ, WorkspaceAction.WRITE, WorkspaceAction.MANAGE],
+    [WorkspaceRole.EDITOR]: [WorkspaceAction.READ, WorkspaceAction.WRITE],
+    [WorkspaceRole.VIEWER]: [WorkspaceAction.READ],
+};
+/** The roles from the most to the least privileged. */
+export const ROLE_ORDER = [WorkspaceRole.OWNER, WorkspaceRole.ADMIN, WorkspaceRole.EDITOR, WorkspaceRole.VIEWER];
+/** Whether `value` is a `WorkspaceRole`. */
+export function isWorkspaceRole(value) {
+    return typeof value === "string" && ROLE_ORDER.includes(value);
+}
+/** The ACL record granting `userUid` the actions of `role`. */
+export function memberRecord(userUid, role) {
+    return { userOrRoleId: userUid, actions: [...ROLE_ACTIONS[role]] };
+}
+/**
+ * Rejects a caller who doesn't hold `action` on the workspace with a 404 - the same answer a workspace that doesn't exist gets, so a
+ * stranger can't tell which workspace uids are real. A member who can read the workspace but not do `action` gets a 403.
+ *
+ * Trusted roles are stripped first (`stripTrustedRoles()`): `ACLUtils.hasPermission()` answers `true` for an administrator on
+ * anything, and a deployment administrator has no business in a workspace they aren't a member of - the same rule restapi applies to
+ * mailboxes.
+ */
+export async function assertWorkspaceAccess(aclUtils, trustedRoles, user, workspaceUid, action) {
+    const caller = stripTrustedRoles(user, trustedRoles);
+    if (!caller?.uid || typeof workspaceUid !== "string" || workspaceUid.length === 0 || workspaceUid.length > 64) {
+        throw notFound();
+    }
+    if (await aclUtils.hasPermission(caller, workspaceUid, action)) {
+        return;
+    }
+    if (action !== WorkspaceAction.READ && (await aclUtils.hasPermission(caller, workspaceUid, WorkspaceAction.READ))) {
+        throw new ApiError(ApiErrors.AUTH_PERMISSION_FAILURE, 403, ApiErrorMessages.AUTH_PERMISSION_FAILURE);
+    }
+    throw notFound();
+}
+/** A 404 `ApiError`. */
+export function notFound() {
+    return new ApiError(ApiErrors.NOT_FOUND, 404, ApiErrorMessages.NOT_FOUND);
+}
+/** A 403 `ApiError`. */
+export function forbidden() {
+    return new ApiError(ApiErrors.AUTH_PERMISSION_FAILURE, 403, ApiErrorMessages.AUTH_PERMISSION_FAILURE);
+}
+//# sourceMappingURL=WorkspaceAccess.js.map

package/dist/lib/util/WorkspaceAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WorkspaceAccess.js","sourceRoot":"","sources":["../../../src/util/WorkspaceAccess.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAgB,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAA4B,gBAAgB,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEpE,qIAAqI;AACrI,MAAM,CAAC,MAAM,YAAY,GAAuD;IAC5E,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;IAC5B,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC;IAC5F,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC;IACrE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;CACjD,CAAC;AAEF,uDAAuD;AACvD,MAAM,CAAC,MAAM,UAAU,GAA6B,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;AAE3I,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,IAAmB;IAC7D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,QAAkB,EAClB,YAA+B,EAC/B,IAAyB,EACzB,YAAoB,EACpB,MAAuB;IAEvB,MAAM,MAAM,GAAwB,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC5G,MAAM,QAAQ,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7D,OAAO;IACX,CAAC;IACD,IAAI,MAAM,KAAK,eAAe,CAAC,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,QAAQ,EAAE,CAAC;AACrB,CAAC;AAED,wBAAwB;AACxB,MAAM,UAAU,QAAQ;IACpB,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAC9E,CAAC;AAED,wBAAwB;AACxB,MAAM,UAAU,SAAS;IACrB,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,uBAAuB,EAAE,GAAG,EAAE,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;AAC1G,CAAC"}

package/dist/lib/webhooks/Deliveries.js

@@ -0,0 +1,47 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import * as crypto from "crypto";
+import { ModelUtils } from "@rapidrest/service-core";
+import { WebhookDeliveryStatus } from "../models/types.js";
+/** Whether `endpoint` takes events of `type`. */
+export function wants(endpoint, type) {
+    return endpoint.enabled && (endpoint.events.includes("*") || endpoint.events.includes(type));
+}
+/** The body of `event`'s webhooks. */
+export async function eventPayload(repos, event) {
+    const contact = await (await repos.get("contact")).findOne(event.contactUid, { ignoreACL: true, skipCache: true });
+    return {
+        id: event.uid,
+        type: event.type,
+        occurredAt: new Date(event.occurredAt).toISOString(),
+        workspaceUid: event.workspaceUid,
+        ...(contact ? { contact: { uid: contact.uid, email: contact.email, firstName: contact.firstName ?? undefined, lastName: contact.lastName ?? undefined } } : {}),
+        data: event.data ?? {},
+    };
+}
+/** Queues `payload` for each of `endpoints` (`WebhookDeliveryJob` posts it). */
+export async function enqueueDeliveries(repos, classes, endpoints, payload) {
+    const deliveries = await repos.get("webhookDelivery");
+    for (const endpoint of endpoints) {
+        await deliveries.create(new classes.webhookDelivery({
+            workspaceUid: endpoint.workspaceUid,
+            endpointUid: endpoint.uid,
+            eventType: payload.type,
+            payload,
+            status: WebhookDeliveryStatus.PENDING,
+            nextAttemptAt: new Date(),
+        }), { ignoreACL: true, skipPush: true });
+    }
+    return endpoints.length;
+}
+/** The workspace's enabled endpoints. */
+export async function enabledEndpoints(repos, workspaceUid) {
+    return await (await repos.get("webhookEndpoint")).find({ workspaceUid: ModelUtils.literal(workspaceUid), enabled: ModelUtils.literal(true) }, { ignoreACL: true, limit: 100, skipCache: true });
+}
+/** A made-up id, for payloads that aren't a stored event (a test ping, an automation's webhook step). */
+export function payloadId() {
+    return crypto.randomUUID();
+}
+//# sourceMappingURL=Deliveries.js.map

package/dist/lib/webhooks/Deliveries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Deliveries.js","sourceRoot":"","sources":["../../../src/webhooks/Deliveries.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,EAAwB,qBAAqB,EAAmB,MAAM,oBAAoB,CAAC;AAYlG,iDAAiD;AACjD,MAAM,UAAU,KAAK,CAAC,QAAqD,EAAE,IAAY;IACrF,OAAO,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,sCAAsC;AACtC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAe,EAAE,KAAe;IAC/D,MAAM,OAAO,GAA2B,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAa,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvJ,OAAO;QACH,EAAE,EAAE,KAAK,CAAC,GAAG;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;QACpD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/J,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;KACzB,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAe,EAAE,OAAwB,EAAE,SAA4B,EAAE,OAAuB;IACpI,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACtD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,UAAU,CAAC,MAAM,CACnB,IAAI,OAAO,CAAC,eAAe,CAAC;YACxB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,WAAW,EAAE,QAAQ,CAAC,GAAG;YACzB,SAAS,EAAE,OAAO,CAAC,IAAI;YACvB,OAAO;YACP,MAAM,EAAE,qBAAqB,CAAC,OAAO;YACrC,aAAa,EAAE,IAAI,IAAI,EAAE;SAC5B,CAAC,EACF,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CACtC,CAAC;IACN,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAe,EAAE,YAAoB;IACxE,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAkB,iBAAiB,CAAC,CAAC,CAAC,IAAI,CACnE,EAAE,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EACrF,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CACnD,CAAC;AACN,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,SAAS;IACrB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC/B,CAAC"}