clarion-shared-types 1.0.98 → 1.0.99

package/README.md

@@ -70,3 +70,50 @@ detection are delivered in later phases and should build on these types.
 ```bash
 npm test   # compiles src/modules/country and runs the country/currency suite
 ```
+
+## Organization notification settings
+
+`src/modules/notification` mirrors the backend contract for an organization's
+notification settings (branding, email senders, SMS senders) that clarion-admin's
+**Notification Settings** page renders. The backend source of truth is
+`grm-shared-library/src/modules/notification`; clarion-notification owns the data.
+
+- Enums: `SmsSenderType`, `NotificationSenderStatus`, `EmailSenderVerificationStatus` /
+  `Method`, `NotificationSenderSource`, `NotificationBrandingSource`.
+- Shapes: `OrganizationNotificationSettings`, `ResolvedNotificationBranding` (with the
+  per-field `sources` the page uses to say "inherited from…"), `OrganizationEmailSender`,
+  `OrganizationSmsSender`, `SmsProviderDescriptor`, and plain request interfaces in
+  place of the backend's class-validator DTOs.
+- Rules: `validateSmsSenderId`, `SMS_SENDER_ID_PATTERNS` / `_HINTS`,
+  `BRAND_COLOUR_PATTERN`, `contrastRatioWithWhite` with `MIN_PRIMARY_COLOUR_CONTRAST`
+  and `MIN_ACCENT_COLOUR_CONTRAST`.
+
+**The rules must stay byte-identical to the backend's.** The form validates with
+these so the user is told before they submit; the API validates with its own copy and
+is the one that counts. `notification-settings.spec.ts` pins the regex sources and
+thresholds so a drift fails here rather than as a form that accepts what the API
+rejects.
+
+## Alert intake (SMS / WhatsApp / email channels)
+
+`src/modules/alert-intake` mirrors the backend contract for how the public reaches an
+organization without the app, which clarion-admin's **Alert Channels** page renders.
+The backend source of truth is `grm-shared-library/src/modules/alert-intake`;
+clarion-alerts owns the data.
+
+- Enums: `AlertIntakeChannel`, `AlertIntakeProvider`, `AlertIntakeSecretSource`,
+  `AlertIntakeEmergencyPolicy`, `AlertIntakeRouteMatch`, `AlertIntakeWebhookVerification`,
+  `AlertIntakeRejectionReason`.
+- Shapes: `OrganizationAlertIntakeSettings`, `AlertIntakeConnection` (never carries a
+  credential - `secretsConfigured` says which secrets exist), `AlertIntakeRoute`,
+  `AlertIntakePlatformFallback`, `AlertIntakeProviderDescriptor` (the server-driven
+  form), `AlertIntakePlatformConnection`, and plain request interfaces
+  (`CreateAlertIntakeConnection`, `UpdateAlertIntakeConnection`, `CreateAlertIntakeRoute`,
+  `UpdateAlertIntakeRoute`) in place of the backend's class-validator DTOs.
+- Rules: `ALERT_INTAKE_KEYWORD_PATTERN`, `normaliseAlertIntakeKeyword`,
+  `extractAlertIntakeKeyword`, `stripAlertIntakeKeyword` and the `MAX_ALERT_INTAKE_*` limits.
+
+The enum file and the util file are byte-identical copies of the backend's;
+`alert-intake.spec.ts` pins the values so a drift fails here rather than as a form the
+API refuses. Permission actions `read:alert-intake`, `manage:alert-intake` and
+`manage:alert-intake-platform` (Super-Admin only) are mirrored in `PermissionActions`.

package/dist/cjs/index.js

@@ -36,6 +36,7 @@ __exportStar(require("./modules/country/index"), exports);
 __exportStar(require("./modules/tracking/index"), exports);
 __exportStar(require("./modules/entitlement/index"), exports);
 __exportStar(require("./modules/alert-dispatch/index"), exports);
+__exportStar(require("./modules/alert-intake/index"), exports);
 __exportStar(require("./modules/partner/index"), exports);
 __exportStar(require("./modules/support/index"), exports);
 // Interfaces

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,UAAU;AACV,uDAAqC;AACrC,+DAA6C;AAC7C,yDAAuC;AACvC,6DAA2C;AAC3C,uDAAqC;AACrC,uDAAqC;AACrC,iEAA+C;AAC/C,gEAA8C;AAC9C,2DAAyC;AACzC,2DAAyC;AACzC,sDAAoC;AACpC,sDAAoC;AACpC,sDAAoC;AACpC,yDAAuC;AACvC,mEAAiD;AACjD,+DAA6C;AAC7C,uDAAqC;AACrC,0DAAwC;AACxC,2DAAyC;AACzC,8DAA4C;AAC5C,iEAA+C;AAC/C,0DAAwC;AACxC,0DAAwC;AAExC,aAAa;AACb,6EAA2D;AAC3D,yEAAuD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,UAAU;AACV,uDAAqC;AACrC,+DAA6C;AAC7C,yDAAuC;AACvC,6DAA2C;AAC3C,uDAAqC;AACrC,uDAAqC;AACrC,iEAA+C;AAC/C,gEAA8C;AAC9C,2DAAyC;AACzC,2DAAyC;AACzC,sDAAoC;AACpC,sDAAoC;AACpC,sDAAoC;AACpC,yDAAuC;AACvC,mEAAiD;AACjD,+DAA6C;AAC7C,uDAAqC;AACrC,0DAAwC;AACxC,2DAAyC;AACzC,8DAA4C;AAC5C,iEAA+C;AAC/C,+DAA6C;AAC7C,0DAAwC;AACxC,0DAAwC;AAExC,aAAa;AACb,6EAA2D;AAC3D,yEAAuD"}

package/dist/cjs/modules/alert-intake/enums/alert-intake.enum.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Alert intake: how a member of the public reaches an organization WITHOUT the app -
+ * an SMS, a WhatsApp message or an email that clarion-alerts turns into an incident.
+ *
+ * Not to be confused with `alert-dispatch`, which is about who an SOS raised IN the
+ * app is sent to.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AlertIntakeRejectionReason = exports.AlertIntakeWebhookVerification = exports.AlertIntakeRouteMatch = exports.AlertIntakeEmergencyPolicy = exports.AlertIntakeSecretSource = exports.AlertIntakeProvider = exports.AlertIntakeChannel = void 0;
+/** The channel a message arrived on. */
+var AlertIntakeChannel;
+(function (AlertIntakeChannel) {
+    AlertIntakeChannel["SMS"] = "SMS";
+    AlertIntakeChannel["WHATSAPP"] = "WHATSAPP";
+    AlertIntakeChannel["EMAIL"] = "EMAIL";
+})(AlertIntakeChannel || (exports.AlertIntakeChannel = AlertIntakeChannel = {}));
+/**
+ * The provider a connection talks to.
+ *
+ * A code here only RESERVES the name. Whether a provider can be connected is
+ * answered by clarion-alerts' provider catalogue (`AlertIntakeProviderDescriptor`),
+ * which lists only providers with a registered adapter. UWAZII and CELCOM are
+ * reserved without an adapter on purpose: their inbound callback formats have not
+ * been confirmed, and until they are, GENERIC_SMS connects them by configuration.
+ */
+var AlertIntakeProvider;
+(function (AlertIntakeProvider) {
+    // SMS
+    AlertIntakeProvider["AFRICASTALKING"] = "africastalking";
+    AlertIntakeProvider["UWAZII"] = "uwazii";
+    AlertIntakeProvider["CELCOM"] = "celcom";
+    /** Any gateway that POSTs flat JSON or form fields; the field names are configured. */
+    AlertIntakeProvider["GENERIC_SMS"] = "generic_sms";
+    // WhatsApp
+    AlertIntakeProvider["WHATSAPP_CLOUD"] = "whatsapp_cloud";
+    // Email
+    AlertIntakeProvider["IMAP"] = "imap";
+    /** An inbound-parse webhook (Mailgun routes, SendGrid Inbound Parse, or a generic JSON post). */
+    AlertIntakeProvider["EMAIL_WEBHOOK"] = "email_webhook";
+})(AlertIntakeProvider || (exports.AlertIntakeProvider = AlertIntakeProvider = {}));
+/**
+ * Where a connection's credentials live. Never in a plaintext column.
+ *
+ *   ENCRYPTED         entered by the organization, encrypted at rest by clarion-alerts
+ *                     (AES-256-GCM, bound to the connection and the field). Write-only:
+ *                     the API never returns them.
+ *   SECRET_REFERENCE  the NAME of a secret the platform operator provisioned (Secret
+ *                     Manager / environment). How the legacy per-tenant credentials
+ *                     keep working, and the option for an operator who does not want
+ *                     a credential in the database at all.
+ */
+var AlertIntakeSecretSource;
+(function (AlertIntakeSecretSource) {
+    AlertIntakeSecretSource["ENCRYPTED"] = "ENCRYPTED";
+    AlertIntakeSecretSource["SECRET_REFERENCE"] = "SECRET_REFERENCE";
+})(AlertIntakeSecretSource || (exports.AlertIntakeSecretSource = AlertIntakeSecretSource = {}));
+/**
+ * How the emergency type of an incident raised from a message is decided.
+ * AUTO derives it from the organization: a grievance desk never raises an
+ * emergency; an incident desk decides from the message's category and priority.
+ */
+var AlertIntakeEmergencyPolicy;
+(function (AlertIntakeEmergencyPolicy) {
+    AlertIntakeEmergencyPolicy["AUTO"] = "AUTO";
+    AlertIntakeEmergencyPolicy["ALWAYS_EMERGENCY"] = "ALWAYS_EMERGENCY";
+    AlertIntakeEmergencyPolicy["ALWAYS_NON_EMERGENCY"] = "ALWAYS_NON_EMERGENCY";
+})(AlertIntakeEmergencyPolicy || (exports.AlertIntakeEmergencyPolicy = AlertIntakeEmergencyPolicy = {}));
+/** How a message on a PLATFORM connection finds its organization. */
+var AlertIntakeRouteMatch;
+(function (AlertIntakeRouteMatch) {
+    /** The first word of the message, e.g. `G4S fire at ...` on a shared short code. */
+    AlertIntakeRouteMatch["KEYWORD"] = "KEYWORD";
+    /** Everything no other route claimed. At most one per connection. */
+    AlertIntakeRouteMatch["DEFAULT"] = "DEFAULT";
+})(AlertIntakeRouteMatch || (exports.AlertIntakeRouteMatch = AlertIntakeRouteMatch = {}));
+/** How a provider proves a webhook call really came from it. */
+var AlertIntakeWebhookVerification;
+(function (AlertIntakeWebhookVerification) {
+    /** The unguessable URL is the only proof (Africa's Talking signs nothing). */
+    AlertIntakeWebhookVerification["SECRET_URL"] = "SECRET_URL";
+    /** A shared secret the gateway sends in a header, compared in constant time. */
+    AlertIntakeWebhookVerification["SHARED_SECRET_HEADER"] = "SHARED_SECRET_HEADER";
+    /** `X-Hub-Signature-256`: HMAC-SHA256 of the raw body with the Meta app secret. */
+    AlertIntakeWebhookVerification["META_SIGNATURE"] = "META_SIGNATURE";
+})(AlertIntakeWebhookVerification || (exports.AlertIntakeWebhookVerification = AlertIntakeWebhookVerification = {}));
+/** Why a message that arrived did not become an incident. Stored; shown to operators. */
+var AlertIntakeRejectionReason;
+(function (AlertIntakeRejectionReason) {
+    AlertIntakeRejectionReason["UNKNOWN_CONNECTION"] = "UNKNOWN_CONNECTION";
+    AlertIntakeRejectionReason["CONNECTION_DISABLED"] = "CONNECTION_DISABLED";
+    AlertIntakeRejectionReason["VERIFICATION_FAILED"] = "VERIFICATION_FAILED";
+    AlertIntakeRejectionReason["NO_ORGANIZATION"] = "NO_ORGANIZATION";
+    AlertIntakeRejectionReason["ORGANIZATION_INACTIVE"] = "ORGANIZATION_INACTIVE";
+    AlertIntakeRejectionReason["RATE_LIMITED"] = "RATE_LIMITED";
+})(AlertIntakeRejectionReason || (exports.AlertIntakeRejectionReason = AlertIntakeRejectionReason = {}));
+//# sourceMappingURL=alert-intake.enum.js.map

package/dist/cjs/modules/alert-intake/enums/alert-intake.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-intake.enum.js","sourceRoot":"","sources":["../../../../../src/modules/alert-intake/enums/alert-intake.enum.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,wCAAwC;AACxC,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC1B,iCAAW,CAAA;IACX,2CAAqB,CAAA;IACrB,qCAAe,CAAA;AACnB,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAED;;;;;;;;GAQG;AACH,IAAY,mBAaX;AAbD,WAAY,mBAAmB;IAC3B,MAAM;IACN,wDAAiC,CAAA;IACjC,wCAAiB,CAAA;IACjB,wCAAiB,CAAA;IACjB,uFAAuF;IACvF,kDAA2B,CAAA;IAC3B,WAAW;IACX,wDAAiC,CAAA;IACjC,QAAQ;IACR,oCAAa,CAAA;IACb,iGAAiG;IACjG,sDAA+B,CAAA;AACnC,CAAC,EAbW,mBAAmB,mCAAnB,mBAAmB,QAa9B;AAED;;;;;;;;;;GAUG;AACH,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IAC/B,kDAAuB,CAAA;IACvB,gEAAqC,CAAA;AACzC,CAAC,EAHW,uBAAuB,uCAAvB,uBAAuB,QAGlC;AAED;;;;GAIG;AACH,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IAClC,2CAAa,CAAA;IACb,mEAAqC,CAAA;IACrC,2EAA6C,CAAA;AACjD,CAAC,EAJW,0BAA0B,0CAA1B,0BAA0B,QAIrC;AAED,qEAAqE;AACrE,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC7B,oFAAoF;IACpF,4CAAmB,CAAA;IACnB,qEAAqE;IACrE,4CAAmB,CAAA;AACvB,CAAC,EALW,qBAAqB,qCAArB,qBAAqB,QAKhC;AAED,gEAAgE;AAChE,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACtC,8EAA8E;IAC9E,2DAAyB,CAAA;IACzB,gFAAgF;IAChF,+EAA6C,CAAA;IAC7C,mFAAmF;IACnF,mEAAiC,CAAA;AACrC,CAAC,EAPW,8BAA8B,8CAA9B,8BAA8B,QAOzC;AAED,yFAAyF;AACzF,IAAY,0BAOX;AAPD,WAAY,0BAA0B;IAClC,uEAAyC,CAAA;IACzC,yEAA2C,CAAA;IAC3C,yEAA2C,CAAA;IAC3C,iEAAmC,CAAA;IACnC,6EAA+C,CAAA;IAC/C,2DAA6B,CAAA;AACjC,CAAC,EAPW,0BAA0B,0CAA1B,0BAA0B,QAOrC"}

package/dist/cjs/modules/alert-intake/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Enums
+__exportStar(require("./enums/alert-intake.enum"), exports);
+// Response shapes + plain request interfaces
+__exportStar(require("./interfaces/alert-intake"), exports);
+// Utilities
+__exportStar(require("./utils/alert-intake.util"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/modules/alert-intake/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/alert-intake/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,QAAQ;AACR,4DAA0C;AAE1C,6CAA6C;AAC7C,4DAA0C;AAE1C,YAAY;AACZ,4DAA0C"}

package/dist/cjs/modules/alert-intake/interfaces/alert-intake.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=alert-intake.js.map

package/dist/cjs/modules/alert-intake/interfaces/alert-intake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-intake.js","sourceRoot":"","sources":["../../../../../src/modules/alert-intake/interfaces/alert-intake.ts"],"names":[],"mappings":""}

package/dist/cjs/modules/alert-intake/utils/alert-intake.util.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_ALERT_INTAKE_SETTING_LENGTH = exports.MAX_ALERT_INTAKE_ROUTES_PER_CONNECTION = exports.MAX_ALERT_INTAKE_CONNECTIONS_PER_ORGANIZATION = exports.ALERT_INTAKE_KEYWORD_PATTERN = void 0;
+exports.normaliseAlertIntakeKeyword = normaliseAlertIntakeKeyword;
+exports.extractAlertIntakeKeyword = extractAlertIntakeKeyword;
+exports.stripAlertIntakeKeyword = stripAlertIntakeKeyword;
+/** A routing keyword: 2-20 letters or digits, stored upper-cased. */
+exports.ALERT_INTAKE_KEYWORD_PATTERN = /^[A-Z0-9]{2,20}$/;
+/** Upper bounds that keep one organization's settings a form rather than a list to page through. */
+exports.MAX_ALERT_INTAKE_CONNECTIONS_PER_ORGANIZATION = 20;
+exports.MAX_ALERT_INTAKE_ROUTES_PER_CONNECTION = 200;
+/** One settings value (config or secret). An access token is the longest thing that goes here. */
+exports.MAX_ALERT_INTAKE_SETTING_LENGTH = 4096;
+/** Normalises what an operator typed into the stored form. Null when it is not a valid keyword. */
+function normaliseAlertIntakeKeyword(value) {
+    const keyword = (value !== null && value !== void 0 ? value : '').trim().toUpperCase();
+    return exports.ALERT_INTAKE_KEYWORD_PATTERN.test(keyword) ? keyword : null;
+}
+/**
+ * The routing keyword of a message: its first word, upper-cased, punctuation
+ * stripped - `g4s, fire at the gate` and `G4S: fire` both give `G4S`.
+ * Null when the first word could not be a keyword.
+ *
+ * Deliberately only the FIRST word. Matching a keyword anywhere in the text would
+ * route "I was robbed near the G4S office" to G4S.
+ */
+function extractAlertIntakeKeyword(text) {
+    var _a;
+    const first = (_a = (text !== null && text !== void 0 ? text : '').trim().split(/\s+/)[0]) !== null && _a !== void 0 ? _a : '';
+    return normaliseAlertIntakeKeyword(first.replace(/^[^A-Za-z0-9]+|[^A-Za-z0-9]+$/g, ''));
+}
+/**
+ * The message with its routing keyword removed, so "G4S fire at the gate" is
+ * analysed as "fire at the gate". Returns the text unchanged when it does not start
+ * with that keyword.
+ */
+function stripAlertIntakeKeyword(text, keyword) {
+    const trimmed = (text !== null && text !== void 0 ? text : '').trim();
+    // Keywords are [A-Z0-9] by construction; escaping keeps this safe for a caller that skipped normalising.
+    const literal = keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const match = new RegExp(`^[^A-Za-z0-9]*${literal}(?![A-Za-z0-9])[^A-Za-z0-9]*`, 'i').exec(trimmed);
+    if (!match)
+        return text;
+    const rest = trimmed.slice(match[0].length).trim();
+    // A message that was ONLY the keyword is still a message; do not turn it into nothing.
+    return rest.length > 0 ? rest : trimmed;
+}
+//# sourceMappingURL=alert-intake.util.js.map

package/dist/cjs/modules/alert-intake/utils/alert-intake.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-intake.util.js","sourceRoot":"","sources":["../../../../../src/modules/alert-intake/utils/alert-intake.util.ts"],"names":[],"mappings":";;;AAUA,kEAGC;AAUD,8DAGC;AAOD,0DASC;AA1CD,qEAAqE;AACxD,QAAA,4BAA4B,GAAG,kBAAkB,CAAC;AAE/D,oGAAoG;AACvF,QAAA,6CAA6C,GAAG,EAAE,CAAC;AACnD,QAAA,sCAAsC,GAAG,GAAG,CAAC;AAC1D,kGAAkG;AACrF,QAAA,+BAA+B,GAAG,IAAI,CAAC;AAEpD,mGAAmG;AACnG,SAAgB,2BAA2B,CAAC,KAAgC;IACxE,MAAM,OAAO,GAAG,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,oCAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,IAA+B;;IACrE,MAAM,KAAK,GAAG,MAAA,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAC;IACxD,OAAO,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,IAAY,EAAE,OAAe;IACjE,MAAM,OAAO,GAAG,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,yGAAyG;IACzG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,OAAO,8BAA8B,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,uFAAuF;IACvF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5C,CAAC"}

package/dist/cjs/modules/permission/enums/permission-actions.enum.js

@@ -118,5 +118,13 @@ var PermissionActions;
     // Confirming that an SMS sender ID really is registered with the provider.
     // Granted to NO role on the backend: only Super-Admin ('*') passes it.
     PermissionActions["APPROVE_NOTIFICATION_SENDER"] = "approve:notification-sender";
+    // Module: Alert Intake
+    // The channels the PUBLIC reaches an organization on without the app - its SMS
+    // short code, WhatsApp number and mailbox (clarion-alerts). Mirrors grm-shared-library.
+    PermissionActions["READ_ALERT_INTAKE"] = "read:alert-intake";
+    PermissionActions["MANAGE_ALERT_INTAKE"] = "manage:alert-intake";
+    // PLATFORM connections and their routes (which keyword sends a message to which
+    // organization). Granted to NO role on the backend: only Super-Admin ('*') passes it.
+    PermissionActions["MANAGE_ALERT_INTAKE_PLATFORM"] = "manage:alert-intake-platform";
 })(PermissionActions || (exports.PermissionActions = PermissionActions = {}));
 //# sourceMappingURL=permission-actions.enum.js.map

package/dist/cjs/modules/permission/enums/permission-actions.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-actions.enum.js","sourceRoot":"","sources":["../../../../../src/modules/permission/enums/permission-actions.enum.ts"],"names":[],"mappings":";;;AAAA,IAAY,iBA6HX;AA7HD,WAAY,iBAAiB;IACzB,uBAAuB;IACvB,gEAA2C,CAAA;IAC3C,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAC3C,gEAA2C,CAAA;IAE3C,kBAAkB;IAClB,sDAAiC,CAAA;IACjC,kDAA6B,CAAA;IAC7B,sDAAiC,CAAA;IACjC,sDAAiC,CAAA;IACjC,wEAAwE;IACxE,mEAAmE;IACnE,oEAA+C,CAAA;IAC/C,0EAAqD,CAAA;IACrD,wEAAmD,CAAA;IACnD,wEAAmD,CAAA;IACnD,wEAAmD,CAAA;IACnD,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,uDAAuD;IACvD,wEAAmD,CAAA;IACnD,4EAAuD,CAAA;IAEvD,wBAAwB;IACxB,oEAA+C,CAAA;IAC/C,gEAA2C,CAAA;IAC3C,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAE/C,eAAe;IACf,gDAA2B,CAAA;IAC3B,4CAAuB,CAAA;IACvB,gDAA2B,CAAA;IAC3B,gDAA2B,CAAA;IAE3B,eAAe;IACf,gDAA2B,CAAA;IAC3B,4CAAuB,CAAA;IACvB,gDAA2B,CAAA;IAC3B,gDAA2B,CAAA;IAE3B,mBAAmB;IACnB,wDAAmC,CAAA;IACnC,oDAA+B,CAAA;IAC/B,wDAAmC,CAAA;IACnC,wDAAmC,CAAA;IACnC,oFAA+D,CAAA;IAC/D,gFAA2D,CAAA;IAC3D,oFAA+D,CAAA;IAC/D,oFAA+D,CAAA;IAE/D,uBAAuB;IACvB,kEAA6C,CAAA;IAC7C,8DAAyC,CAAA;IACzC,kEAA6C,CAAA;IAC7C,kEAA6C,CAAA;IAE7C,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,qDAAqD;IACrD,gGAA2E,CAAA;IAC3E,4FAAuE,CAAA;IACvE,gGAA2E,CAAA;IAC3E,gGAA2E,CAAA;IAC3E,sFAAiE,CAAA;IACjE,kFAA6D,CAAA;IAC7D,sFAAiE,CAAA;IACjE,sFAAiE,CAAA;IACjE,sEAAiD,CAAA;IACjD,oEAA+C,CAAA;IAC/C,0EAAqD,CAAA;IACrD,8EAAyD,CAAA;IAEzD,kBAAkB;IAClB,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,+BAA+B;IAC/B,oEAA+C,CAAA;IAC/C,gEAA2C,CAAA;IAC3C,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAC/C,kEAA6C,CAAA;IAC7C,gEAA2C,CAAA;IAC3C,kFAA6D,CAAA;IAC7D,sFAAiE,CAAA;IACjE,kEAA6C,CAAA;IAC7C,oEAA+C,CAAA;IAC/C,yEAAyE;IACzE,gEAA2C,CAAA;IAC3C;;;OAGG;IACH,8DAAyC,CAAA;IACzC,mFAAmF;IACnF,wEAAmD,CAAA;IACnD,oEAA+C,CAAA;IAC/C,gFAAgF;IAChF,sEAAiD,CAAA;IACjD,wEAAmD,CAAA;IACnD,0EAAqD,CAAA;IACrD,0EAAqD,CAAA;IACrD,kEAA6C,CAAA;IAC7C,gEAA2C,CAAA;IAC3C,8DAAyC,CAAA;IACzC,kFAA6D,CAAA;IAC7D,gEAA2C,CAAA;IAC3C,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAE3C,uBAAuB;IACvB,0EAA0E;IAC1E,4EAA4E;IAC5E,gDAAgD;IAChD,8EAAyD,CAAA;IACzD,kFAA6D,CAAA;IAC7D,2EAA2E;IAC3E,uEAAuE;IACvE,gFAA2D,CAAA;AAC/D,CAAC,EA7HW,iBAAiB,iCAAjB,iBAAiB,QA6H5B"}
+{"version":3,"file":"permission-actions.enum.js","sourceRoot":"","sources":["../../../../../src/modules/permission/enums/permission-actions.enum.ts"],"names":[],"mappings":";;;AAAA,IAAY,iBAsIX;AAtID,WAAY,iBAAiB;IACzB,uBAAuB;IACvB,gEAA2C,CAAA;IAC3C,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAC3C,gEAA2C,CAAA;IAE3C,kBAAkB;IAClB,sDAAiC,CAAA;IACjC,kDAA6B,CAAA;IAC7B,sDAAiC,CAAA;IACjC,sDAAiC,CAAA;IACjC,wEAAwE;IACxE,mEAAmE;IACnE,oEAA+C,CAAA;IAC/C,0EAAqD,CAAA;IACrD,wEAAmD,CAAA;IACnD,wEAAmD,CAAA;IACnD,wEAAmD,CAAA;IACnD,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,uDAAuD;IACvD,wEAAmD,CAAA;IACnD,4EAAuD,CAAA;IAEvD,wBAAwB;IACxB,oEAA+C,CAAA;IAC/C,gEAA2C,CAAA;IAC3C,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAE/C,eAAe;IACf,gDAA2B,CAAA;IAC3B,4CAAuB,CAAA;IACvB,gDAA2B,CAAA;IAC3B,gDAA2B,CAAA;IAE3B,eAAe;IACf,gDAA2B,CAAA;IAC3B,4CAAuB,CAAA;IACvB,gDAA2B,CAAA;IAC3B,gDAA2B,CAAA;IAE3B,mBAAmB;IACnB,wDAAmC,CAAA;IACnC,oDAA+B,CAAA;IAC/B,wDAAmC,CAAA;IACnC,wDAAmC,CAAA;IACnC,oFAA+D,CAAA;IAC/D,gFAA2D,CAAA;IAC3D,oFAA+D,CAAA;IAC/D,oFAA+D,CAAA;IAE/D,uBAAuB;IACvB,kEAA6C,CAAA;IAC7C,8DAAyC,CAAA;IACzC,kEAA6C,CAAA;IAC7C,kEAA6C,CAAA;IAE7C,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,qDAAqD;IACrD,gGAA2E,CAAA;IAC3E,4FAAuE,CAAA;IACvE,gGAA2E,CAAA;IAC3E,gGAA2E,CAAA;IAC3E,sFAAiE,CAAA;IACjE,kFAA6D,CAAA;IAC7D,sFAAiE,CAAA;IACjE,sFAAiE,CAAA;IACjE,sEAAiD,CAAA;IACjD,oEAA+C,CAAA;IAC/C,0EAAqD,CAAA;IACrD,8EAAyD,CAAA;IAEzD,kBAAkB;IAClB,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,+BAA+B;IAC/B,oEAA+C,CAAA;IAC/C,gEAA2C,CAAA;IAC3C,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAC/C,kEAA6C,CAAA;IAC7C,gEAA2C,CAAA;IAC3C,kFAA6D,CAAA;IAC7D,sFAAiE,CAAA;IACjE,kEAA6C,CAAA;IAC7C,oEAA+C,CAAA;IAC/C,yEAAyE;IACzE,gEAA2C,CAAA;IAC3C;;;OAGG;IACH,8DAAyC,CAAA;IACzC,mFAAmF;IACnF,wEAAmD,CAAA;IACnD,oEAA+C,CAAA;IAC/C,gFAAgF;IAChF,sEAAiD,CAAA;IACjD,wEAAmD,CAAA;IACnD,0EAAqD,CAAA;IACrD,0EAAqD,CAAA;IACrD,kEAA6C,CAAA;IAC7C,gEAA2C,CAAA;IAC3C,8DAAyC,CAAA;IACzC,kFAA6D,CAAA;IAC7D,gEAA2C,CAAA;IAC3C,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAE3C,uBAAuB;IACvB,0EAA0E;IAC1E,4EAA4E;IAC5E,gDAAgD;IAChD,8EAAyD,CAAA;IACzD,kFAA6D,CAAA;IAC7D,2EAA2E;IAC3E,uEAAuE;IACvE,gFAA2D,CAAA;IAE3D,uBAAuB;IACvB,+EAA+E;IAC/E,wFAAwF;IACxF,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAC3C,gFAAgF;IAChF,sFAAsF;IACtF,kFAA6D,CAAA;AACjE,CAAC,EAtIW,iBAAiB,iCAAjB,iBAAiB,QAsI5B"}

package/dist/cjs/modules/permission/enums/permissions-moudule.enum.js

@@ -14,5 +14,6 @@ var PermissionsModule;
     PermissionsModule["TRACKING"] = "Tracking";
     PermissionsModule["SUPPORT"] = "Support";
     PermissionsModule["NOTIFICATION"] = "Notification";
+    PermissionsModule["ALERT_INTAKE"] = "Alert Intake";
 })(PermissionsModule || (exports.PermissionsModule = PermissionsModule = {}));
 //# sourceMappingURL=permissions-moudule.enum.js.map

package/dist/cjs/modules/permission/enums/permissions-moudule.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-moudule.enum.js","sourceRoot":"","sources":["../../../../../src/modules/permission/enums/permissions-moudule.enum.ts"],"names":[],"mappings":";;;AAAA,IAAY,iBAYX;AAZD,WAAY,iBAAiB;IACzB,kDAA6B,CAAA;IAC7B,wCAAmB,CAAA;IACnB,sDAAiC,CAAA;IACjC,kCAAa,CAAA;IACb,kCAAa,CAAA;IACb,kCAAa,CAAA;IACb,2CAAsB,CAAA;IACtB,oDAA+B,CAAA;IAC/B,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;IACnB,kDAA6B,CAAA;AACjC,CAAC,EAZW,iBAAiB,iCAAjB,iBAAiB,QAY5B"}
+{"version":3,"file":"permissions-moudule.enum.js","sourceRoot":"","sources":["../../../../../src/modules/permission/enums/permissions-moudule.enum.ts"],"names":[],"mappings":";;;AAAA,IAAY,iBAaX;AAbD,WAAY,iBAAiB;IACzB,kDAA6B,CAAA;IAC7B,wCAAmB,CAAA;IACnB,sDAAiC,CAAA;IACjC,kCAAa,CAAA;IACb,kCAAa,CAAA;IACb,kCAAa,CAAA;IACb,2CAAsB,CAAA;IACtB,oDAA+B,CAAA;IAC/B,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;IACnB,kDAA6B,CAAA;IAC7B,kDAA6B,CAAA;AACjC,CAAC,EAbW,iBAAiB,iCAAjB,iBAAiB,QAa5B"}

package/dist/esm/index.js

@@ -20,6 +20,7 @@ export * from './modules/country/index';
 export * from './modules/tracking/index';
 export * from './modules/entitlement/index';
 export * from './modules/alert-dispatch/index';
+export * from './modules/alert-intake/index';
 export * from './modules/partner/index';
 export * from './modules/support/index';
 // Interfaces

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,UAAU;AACV,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AAExC,aAAa;AACb,cAAc,4CAA4C,CAAC;AAC3D,cAAc,wCAAwC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,UAAU;AACV,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AAExC,aAAa;AACb,cAAc,4CAA4C,CAAC;AAC3D,cAAc,wCAAwC,CAAC"}

package/dist/esm/modules/alert-intake/enums/alert-intake.enum.js

@@ -0,0 +1,94 @@
+/**
+ * Alert intake: how a member of the public reaches an organization WITHOUT the app -
+ * an SMS, a WhatsApp message or an email that clarion-alerts turns into an incident.
+ *
+ * Not to be confused with `alert-dispatch`, which is about who an SOS raised IN the
+ * app is sent to.
+ */
+/** The channel a message arrived on. */
+export var AlertIntakeChannel;
+(function (AlertIntakeChannel) {
+    AlertIntakeChannel["SMS"] = "SMS";
+    AlertIntakeChannel["WHATSAPP"] = "WHATSAPP";
+    AlertIntakeChannel["EMAIL"] = "EMAIL";
+})(AlertIntakeChannel || (AlertIntakeChannel = {}));
+/**
+ * The provider a connection talks to.
+ *
+ * A code here only RESERVES the name. Whether a provider can be connected is
+ * answered by clarion-alerts' provider catalogue (`AlertIntakeProviderDescriptor`),
+ * which lists only providers with a registered adapter. UWAZII and CELCOM are
+ * reserved without an adapter on purpose: their inbound callback formats have not
+ * been confirmed, and until they are, GENERIC_SMS connects them by configuration.
+ */
+export var AlertIntakeProvider;
+(function (AlertIntakeProvider) {
+    // SMS
+    AlertIntakeProvider["AFRICASTALKING"] = "africastalking";
+    AlertIntakeProvider["UWAZII"] = "uwazii";
+    AlertIntakeProvider["CELCOM"] = "celcom";
+    /** Any gateway that POSTs flat JSON or form fields; the field names are configured. */
+    AlertIntakeProvider["GENERIC_SMS"] = "generic_sms";
+    // WhatsApp
+    AlertIntakeProvider["WHATSAPP_CLOUD"] = "whatsapp_cloud";
+    // Email
+    AlertIntakeProvider["IMAP"] = "imap";
+    /** An inbound-parse webhook (Mailgun routes, SendGrid Inbound Parse, or a generic JSON post). */
+    AlertIntakeProvider["EMAIL_WEBHOOK"] = "email_webhook";
+})(AlertIntakeProvider || (AlertIntakeProvider = {}));
+/**
+ * Where a connection's credentials live. Never in a plaintext column.
+ *
+ *   ENCRYPTED         entered by the organization, encrypted at rest by clarion-alerts
+ *                     (AES-256-GCM, bound to the connection and the field). Write-only:
+ *                     the API never returns them.
+ *   SECRET_REFERENCE  the NAME of a secret the platform operator provisioned (Secret
+ *                     Manager / environment). How the legacy per-tenant credentials
+ *                     keep working, and the option for an operator who does not want
+ *                     a credential in the database at all.
+ */
+export var AlertIntakeSecretSource;
+(function (AlertIntakeSecretSource) {
+    AlertIntakeSecretSource["ENCRYPTED"] = "ENCRYPTED";
+    AlertIntakeSecretSource["SECRET_REFERENCE"] = "SECRET_REFERENCE";
+})(AlertIntakeSecretSource || (AlertIntakeSecretSource = {}));
+/**
+ * How the emergency type of an incident raised from a message is decided.
+ * AUTO derives it from the organization: a grievance desk never raises an
+ * emergency; an incident desk decides from the message's category and priority.
+ */
+export var AlertIntakeEmergencyPolicy;
+(function (AlertIntakeEmergencyPolicy) {
+    AlertIntakeEmergencyPolicy["AUTO"] = "AUTO";
+    AlertIntakeEmergencyPolicy["ALWAYS_EMERGENCY"] = "ALWAYS_EMERGENCY";
+    AlertIntakeEmergencyPolicy["ALWAYS_NON_EMERGENCY"] = "ALWAYS_NON_EMERGENCY";
+})(AlertIntakeEmergencyPolicy || (AlertIntakeEmergencyPolicy = {}));
+/** How a message on a PLATFORM connection finds its organization. */
+export var AlertIntakeRouteMatch;
+(function (AlertIntakeRouteMatch) {
+    /** The first word of the message, e.g. `G4S fire at ...` on a shared short code. */
+    AlertIntakeRouteMatch["KEYWORD"] = "KEYWORD";
+    /** Everything no other route claimed. At most one per connection. */
+    AlertIntakeRouteMatch["DEFAULT"] = "DEFAULT";
+})(AlertIntakeRouteMatch || (AlertIntakeRouteMatch = {}));
+/** How a provider proves a webhook call really came from it. */
+export var AlertIntakeWebhookVerification;
+(function (AlertIntakeWebhookVerification) {
+    /** The unguessable URL is the only proof (Africa's Talking signs nothing). */
+    AlertIntakeWebhookVerification["SECRET_URL"] = "SECRET_URL";
+    /** A shared secret the gateway sends in a header, compared in constant time. */
+    AlertIntakeWebhookVerification["SHARED_SECRET_HEADER"] = "SHARED_SECRET_HEADER";
+    /** `X-Hub-Signature-256`: HMAC-SHA256 of the raw body with the Meta app secret. */
+    AlertIntakeWebhookVerification["META_SIGNATURE"] = "META_SIGNATURE";
+})(AlertIntakeWebhookVerification || (AlertIntakeWebhookVerification = {}));
+/** Why a message that arrived did not become an incident. Stored; shown to operators. */
+export var AlertIntakeRejectionReason;
+(function (AlertIntakeRejectionReason) {
+    AlertIntakeRejectionReason["UNKNOWN_CONNECTION"] = "UNKNOWN_CONNECTION";
+    AlertIntakeRejectionReason["CONNECTION_DISABLED"] = "CONNECTION_DISABLED";
+    AlertIntakeRejectionReason["VERIFICATION_FAILED"] = "VERIFICATION_FAILED";
+    AlertIntakeRejectionReason["NO_ORGANIZATION"] = "NO_ORGANIZATION";
+    AlertIntakeRejectionReason["ORGANIZATION_INACTIVE"] = "ORGANIZATION_INACTIVE";
+    AlertIntakeRejectionReason["RATE_LIMITED"] = "RATE_LIMITED";
+})(AlertIntakeRejectionReason || (AlertIntakeRejectionReason = {}));
+//# sourceMappingURL=alert-intake.enum.js.map

package/dist/esm/modules/alert-intake/enums/alert-intake.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-intake.enum.js","sourceRoot":"","sources":["../../../../../src/modules/alert-intake/enums/alert-intake.enum.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,wCAAwC;AACxC,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC1B,iCAAW,CAAA;IACX,2CAAqB,CAAA;IACrB,qCAAe,CAAA;AACnB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,mBAaX;AAbD,WAAY,mBAAmB;IAC3B,MAAM;IACN,wDAAiC,CAAA;IACjC,wCAAiB,CAAA;IACjB,wCAAiB,CAAA;IACjB,uFAAuF;IACvF,kDAA2B,CAAA;IAC3B,WAAW;IACX,wDAAiC,CAAA;IACjC,QAAQ;IACR,oCAAa,CAAA;IACb,iGAAiG;IACjG,sDAA+B,CAAA;AACnC,CAAC,EAbW,mBAAmB,KAAnB,mBAAmB,QAa9B;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IAC/B,kDAAuB,CAAA;IACvB,gEAAqC,CAAA;AACzC,CAAC,EAHW,uBAAuB,KAAvB,uBAAuB,QAGlC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IAClC,2CAAa,CAAA;IACb,mEAAqC,CAAA;IACrC,2EAA6C,CAAA;AACjD,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,qBAKX;AALD,WAAY,qBAAqB;IAC7B,oFAAoF;IACpF,4CAAmB,CAAA;IACnB,qEAAqE;IACrE,4CAAmB,CAAA;AACvB,CAAC,EALW,qBAAqB,KAArB,qBAAqB,QAKhC;AAED,gEAAgE;AAChE,MAAM,CAAN,IAAY,8BAOX;AAPD,WAAY,8BAA8B;IACtC,8EAA8E;IAC9E,2DAAyB,CAAA;IACzB,gFAAgF;IAChF,+EAA6C,CAAA;IAC7C,mFAAmF;IACnF,mEAAiC,CAAA;AACrC,CAAC,EAPW,8BAA8B,KAA9B,8BAA8B,QAOzC;AAED,yFAAyF;AACzF,MAAM,CAAN,IAAY,0BAOX;AAPD,WAAY,0BAA0B;IAClC,uEAAyC,CAAA;IACzC,yEAA2C,CAAA;IAC3C,yEAA2C,CAAA;IAC3C,iEAAmC,CAAA;IACnC,6EAA+C,CAAA;IAC/C,2DAA6B,CAAA;AACjC,CAAC,EAPW,0BAA0B,KAA1B,0BAA0B,QAOrC"}

package/dist/esm/modules/alert-intake/index.js

@@ -0,0 +1,7 @@
+// Enums
+export * from './enums/alert-intake.enum';
+// Response shapes + plain request interfaces
+export * from './interfaces/alert-intake';
+// Utilities
+export * from './utils/alert-intake.util';
+//# sourceMappingURL=index.js.map

package/dist/esm/modules/alert-intake/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/alert-intake/index.ts"],"names":[],"mappings":"AAAA,QAAQ;AACR,cAAc,2BAA2B,CAAC;AAE1C,6CAA6C;AAC7C,cAAc,2BAA2B,CAAC;AAE1C,YAAY;AACZ,cAAc,2BAA2B,CAAC"}

package/dist/esm/modules/alert-intake/interfaces/alert-intake.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=alert-intake.js.map

package/dist/esm/modules/alert-intake/interfaces/alert-intake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-intake.js","sourceRoot":"","sources":["../../../../../src/modules/alert-intake/interfaces/alert-intake.ts"],"names":[],"mappings":""}

package/dist/esm/modules/alert-intake/utils/alert-intake.util.js

@@ -0,0 +1,42 @@
+/** A routing keyword: 2-20 letters or digits, stored upper-cased. */
+export const ALERT_INTAKE_KEYWORD_PATTERN = /^[A-Z0-9]{2,20}$/;
+/** Upper bounds that keep one organization's settings a form rather than a list to page through. */
+export const MAX_ALERT_INTAKE_CONNECTIONS_PER_ORGANIZATION = 20;
+export const MAX_ALERT_INTAKE_ROUTES_PER_CONNECTION = 200;
+/** One settings value (config or secret). An access token is the longest thing that goes here. */
+export const MAX_ALERT_INTAKE_SETTING_LENGTH = 4096;
+/** Normalises what an operator typed into the stored form. Null when it is not a valid keyword. */
+export function normaliseAlertIntakeKeyword(value) {
+    const keyword = (value !== null && value !== void 0 ? value : '').trim().toUpperCase();
+    return ALERT_INTAKE_KEYWORD_PATTERN.test(keyword) ? keyword : null;
+}
+/**
+ * The routing keyword of a message: its first word, upper-cased, punctuation
+ * stripped - `g4s, fire at the gate` and `G4S: fire` both give `G4S`.
+ * Null when the first word could not be a keyword.
+ *
+ * Deliberately only the FIRST word. Matching a keyword anywhere in the text would
+ * route "I was robbed near the G4S office" to G4S.
+ */
+export function extractAlertIntakeKeyword(text) {
+    var _a;
+    const first = (_a = (text !== null && text !== void 0 ? text : '').trim().split(/\s+/)[0]) !== null && _a !== void 0 ? _a : '';
+    return normaliseAlertIntakeKeyword(first.replace(/^[^A-Za-z0-9]+|[^A-Za-z0-9]+$/g, ''));
+}
+/**
+ * The message with its routing keyword removed, so "G4S fire at the gate" is
+ * analysed as "fire at the gate". Returns the text unchanged when it does not start
+ * with that keyword.
+ */
+export function stripAlertIntakeKeyword(text, keyword) {
+    const trimmed = (text !== null && text !== void 0 ? text : '').trim();
+    // Keywords are [A-Z0-9] by construction; escaping keeps this safe for a caller that skipped normalising.
+    const literal = keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const match = new RegExp(`^[^A-Za-z0-9]*${literal}(?![A-Za-z0-9])[^A-Za-z0-9]*`, 'i').exec(trimmed);
+    if (!match)
+        return text;
+    const rest = trimmed.slice(match[0].length).trim();
+    // A message that was ONLY the keyword is still a message; do not turn it into nothing.
+    return rest.length > 0 ? rest : trimmed;
+}
+//# sourceMappingURL=alert-intake.util.js.map

package/dist/esm/modules/alert-intake/utils/alert-intake.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alert-intake.util.js","sourceRoot":"","sources":["../../../../../src/modules/alert-intake/utils/alert-intake.util.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAE/D,oGAAoG;AACpG,MAAM,CAAC,MAAM,6CAA6C,GAAG,EAAE,CAAC;AAChE,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAC1D,kGAAkG;AAClG,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAEpD,mGAAmG;AACnG,MAAM,UAAU,2BAA2B,CAAC,KAAgC;IACxE,MAAM,OAAO,GAAG,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAA+B;;IACrE,MAAM,KAAK,GAAG,MAAA,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAC;IACxD,OAAO,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,OAAe;IACjE,MAAM,OAAO,GAAG,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,yGAAyG;IACzG,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,OAAO,8BAA8B,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,uFAAuF;IACvF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AAC5C,CAAC"}

package/dist/esm/modules/permission/enums/permission-actions.enum.js

@@ -115,5 +115,13 @@ export var PermissionActions;
     // Confirming that an SMS sender ID really is registered with the provider.
     // Granted to NO role on the backend: only Super-Admin ('*') passes it.
     PermissionActions["APPROVE_NOTIFICATION_SENDER"] = "approve:notification-sender";
+    // Module: Alert Intake
+    // The channels the PUBLIC reaches an organization on without the app - its SMS
+    // short code, WhatsApp number and mailbox (clarion-alerts). Mirrors grm-shared-library.
+    PermissionActions["READ_ALERT_INTAKE"] = "read:alert-intake";
+    PermissionActions["MANAGE_ALERT_INTAKE"] = "manage:alert-intake";
+    // PLATFORM connections and their routes (which keyword sends a message to which
+    // organization). Granted to NO role on the backend: only Super-Admin ('*') passes it.
+    PermissionActions["MANAGE_ALERT_INTAKE_PLATFORM"] = "manage:alert-intake-platform";
 })(PermissionActions || (PermissionActions = {}));
 //# sourceMappingURL=permission-actions.enum.js.map

package/dist/esm/modules/permission/enums/permission-actions.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-actions.enum.js","sourceRoot":"","sources":["../../../../../src/modules/permission/enums/permission-actions.enum.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,iBA6HX;AA7HD,WAAY,iBAAiB;IACzB,uBAAuB;IACvB,gEAA2C,CAAA;IAC3C,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAC3C,gEAA2C,CAAA;IAE3C,kBAAkB;IAClB,sDAAiC,CAAA;IACjC,kDAA6B,CAAA;IAC7B,sDAAiC,CAAA;IACjC,sDAAiC,CAAA;IACjC,wEAAwE;IACxE,mEAAmE;IACnE,oEAA+C,CAAA;IAC/C,0EAAqD,CAAA;IACrD,wEAAmD,CAAA;IACnD,wEAAmD,CAAA;IACnD,wEAAmD,CAAA;IACnD,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,uDAAuD;IACvD,wEAAmD,CAAA;IACnD,4EAAuD,CAAA;IAEvD,wBAAwB;IACxB,oEAA+C,CAAA;IAC/C,gEAA2C,CAAA;IAC3C,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAE/C,eAAe;IACf,gDAA2B,CAAA;IAC3B,4CAAuB,CAAA;IACvB,gDAA2B,CAAA;IAC3B,gDAA2B,CAAA;IAE3B,eAAe;IACf,gDAA2B,CAAA;IAC3B,4CAAuB,CAAA;IACvB,gDAA2B,CAAA;IAC3B,gDAA2B,CAAA;IAE3B,mBAAmB;IACnB,wDAAmC,CAAA;IACnC,oDAA+B,CAAA;IAC/B,wDAAmC,CAAA;IACnC,wDAAmC,CAAA;IACnC,oFAA+D,CAAA;IAC/D,gFAA2D,CAAA;IAC3D,oFAA+D,CAAA;IAC/D,oFAA+D,CAAA;IAE/D,uBAAuB;IACvB,kEAA6C,CAAA;IAC7C,8DAAyC,CAAA;IACzC,kEAA6C,CAAA;IAC7C,kEAA6C,CAAA;IAE7C,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,qDAAqD;IACrD,gGAA2E,CAAA;IAC3E,4FAAuE,CAAA;IACvE,gGAA2E,CAAA;IAC3E,gGAA2E,CAAA;IAC3E,sFAAiE,CAAA;IACjE,kFAA6D,CAAA;IAC7D,sFAAiE,CAAA;IACjE,sFAAiE,CAAA;IACjE,sEAAiD,CAAA;IACjD,oEAA+C,CAAA;IAC/C,0EAAqD,CAAA;IACrD,8EAAyD,CAAA;IAEzD,kBAAkB;IAClB,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,+BAA+B;IAC/B,oEAA+C,CAAA;IAC/C,gEAA2C,CAAA;IAC3C,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAC/C,kEAA6C,CAAA;IAC7C,gEAA2C,CAAA;IAC3C,kFAA6D,CAAA;IAC7D,sFAAiE,CAAA;IACjE,kEAA6C,CAAA;IAC7C,oEAA+C,CAAA;IAC/C,yEAAyE;IACzE,gEAA2C,CAAA;IAC3C;;;OAGG;IACH,8DAAyC,CAAA;IACzC,mFAAmF;IACnF,wEAAmD,CAAA;IACnD,oEAA+C,CAAA;IAC/C,gFAAgF;IAChF,sEAAiD,CAAA;IACjD,wEAAmD,CAAA;IACnD,0EAAqD,CAAA;IACrD,0EAAqD,CAAA;IACrD,kEAA6C,CAAA;IAC7C,gEAA2C,CAAA;IAC3C,8DAAyC,CAAA;IACzC,kFAA6D,CAAA;IAC7D,gEAA2C,CAAA;IAC3C,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAE3C,uBAAuB;IACvB,0EAA0E;IAC1E,4EAA4E;IAC5E,gDAAgD;IAChD,8EAAyD,CAAA;IACzD,kFAA6D,CAAA;IAC7D,2EAA2E;IAC3E,uEAAuE;IACvE,gFAA2D,CAAA;AAC/D,CAAC,EA7HW,iBAAiB,KAAjB,iBAAiB,QA6H5B"}
+{"version":3,"file":"permission-actions.enum.js","sourceRoot":"","sources":["../../../../../src/modules/permission/enums/permission-actions.enum.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,iBAsIX;AAtID,WAAY,iBAAiB;IACzB,uBAAuB;IACvB,gEAA2C,CAAA;IAC3C,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAC3C,gEAA2C,CAAA;IAE3C,kBAAkB;IAClB,sDAAiC,CAAA;IACjC,kDAA6B,CAAA;IAC7B,sDAAiC,CAAA;IACjC,sDAAiC,CAAA;IACjC,wEAAwE;IACxE,mEAAmE;IACnE,oEAA+C,CAAA;IAC/C,0EAAqD,CAAA;IACrD,wEAAmD,CAAA;IACnD,wEAAmD,CAAA;IACnD,wEAAmD,CAAA;IACnD,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,uDAAuD;IACvD,wEAAmD,CAAA;IACnD,4EAAuD,CAAA;IAEvD,wBAAwB;IACxB,oEAA+C,CAAA;IAC/C,gEAA2C,CAAA;IAC3C,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAE/C,eAAe;IACf,gDAA2B,CAAA;IAC3B,4CAAuB,CAAA;IACvB,gDAA2B,CAAA;IAC3B,gDAA2B,CAAA;IAE3B,eAAe;IACf,gDAA2B,CAAA;IAC3B,4CAAuB,CAAA;IACvB,gDAA2B,CAAA;IAC3B,gDAA2B,CAAA;IAE3B,mBAAmB;IACnB,wDAAmC,CAAA;IACnC,oDAA+B,CAAA;IAC/B,wDAAmC,CAAA;IACnC,wDAAmC,CAAA;IACnC,oFAA+D,CAAA;IAC/D,gFAA2D,CAAA;IAC3D,oFAA+D,CAAA;IAC/D,oFAA+D,CAAA;IAE/D,uBAAuB;IACvB,kEAA6C,CAAA;IAC7C,8DAAyC,CAAA;IACzC,kEAA6C,CAAA;IAC7C,kEAA6C,CAAA;IAE7C,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,qDAAqD;IACrD,gGAA2E,CAAA;IAC3E,4FAAuE,CAAA;IACvE,gGAA2E,CAAA;IAC3E,gGAA2E,CAAA;IAC3E,sFAAiE,CAAA;IACjE,kFAA6D,CAAA;IAC7D,sFAAiE,CAAA;IACjE,sFAAiE,CAAA;IACjE,sEAAiD,CAAA;IACjD,oEAA+C,CAAA;IAC/C,0EAAqD,CAAA;IACrD,8EAAyD,CAAA;IAEzD,kBAAkB;IAClB,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,+BAA+B;IAC/B,oEAA+C,CAAA;IAC/C,gEAA2C,CAAA;IAC3C,oEAA+C,CAAA;IAC/C,oEAA+C,CAAA;IAC/C,kEAA6C,CAAA;IAC7C,gEAA2C,CAAA;IAC3C,kFAA6D,CAAA;IAC7D,sFAAiE,CAAA;IACjE,kEAA6C,CAAA;IAC7C,oEAA+C,CAAA;IAC/C,yEAAyE;IACzE,gEAA2C,CAAA;IAC3C;;;OAGG;IACH,8DAAyC,CAAA;IACzC,mFAAmF;IACnF,wEAAmD,CAAA;IACnD,oEAA+C,CAAA;IAC/C,gFAAgF;IAChF,sEAAiD,CAAA;IACjD,wEAAmD,CAAA;IACnD,0EAAqD,CAAA;IACrD,0EAAqD,CAAA;IACrD,kEAA6C,CAAA;IAC7C,gEAA2C,CAAA;IAC3C,8DAAyC,CAAA;IACzC,kFAA6D,CAAA;IAC7D,gEAA2C,CAAA;IAC3C,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAE3C,uBAAuB;IACvB,0EAA0E;IAC1E,4EAA4E;IAC5E,gDAAgD;IAChD,8EAAyD,CAAA;IACzD,kFAA6D,CAAA;IAC7D,2EAA2E;IAC3E,uEAAuE;IACvE,gFAA2D,CAAA;IAE3D,uBAAuB;IACvB,+EAA+E;IAC/E,wFAAwF;IACxF,4DAAuC,CAAA;IACvC,gEAA2C,CAAA;IAC3C,gFAAgF;IAChF,sFAAsF;IACtF,kFAA6D,CAAA;AACjE,CAAC,EAtIW,iBAAiB,KAAjB,iBAAiB,QAsI5B"}

package/dist/esm/modules/permission/enums/permissions-moudule.enum.js

@@ -11,5 +11,6 @@ export var PermissionsModule;
     PermissionsModule["TRACKING"] = "Tracking";
     PermissionsModule["SUPPORT"] = "Support";
     PermissionsModule["NOTIFICATION"] = "Notification";
+    PermissionsModule["ALERT_INTAKE"] = "Alert Intake";
 })(PermissionsModule || (PermissionsModule = {}));
 //# sourceMappingURL=permissions-moudule.enum.js.map

package/dist/esm/modules/permission/enums/permissions-moudule.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-moudule.enum.js","sourceRoot":"","sources":["../../../../../src/modules/permission/enums/permissions-moudule.enum.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,iBAYX;AAZD,WAAY,iBAAiB;IACzB,kDAA6B,CAAA;IAC7B,wCAAmB,CAAA;IACnB,sDAAiC,CAAA;IACjC,kCAAa,CAAA;IACb,kCAAa,CAAA;IACb,kCAAa,CAAA;IACb,2CAAsB,CAAA;IACtB,oDAA+B,CAAA;IAC/B,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;IACnB,kDAA6B,CAAA;AACjC,CAAC,EAZW,iBAAiB,KAAjB,iBAAiB,QAY5B"}
+{"version":3,"file":"permissions-moudule.enum.js","sourceRoot":"","sources":["../../../../../src/modules/permission/enums/permissions-moudule.enum.ts"],"names":[],"mappings":"AAAA,MAAM,CAAN,IAAY,iBAaX;AAbD,WAAY,iBAAiB;IACzB,kDAA6B,CAAA;IAC7B,wCAAmB,CAAA;IACnB,sDAAiC,CAAA;IACjC,kCAAa,CAAA;IACb,kCAAa,CAAA;IACb,kCAAa,CAAA;IACb,2CAAsB,CAAA;IACtB,oDAA+B,CAAA;IAC/B,0CAAqB,CAAA;IACrB,wCAAmB,CAAA;IACnB,kDAA6B,CAAA;IAC7B,kDAA6B,CAAA;AACjC,CAAC,EAbW,iBAAiB,KAAjB,iBAAiB,QAa5B"}

package/dist/types/index.d.ts

@@ -19,6 +19,7 @@ export * from './modules/country/index';
 export * from './modules/tracking/index';
 export * from './modules/entitlement/index';
 export * from './modules/alert-dispatch/index';
+export * from './modules/alert-intake/index';
 export * from './modules/partner/index';
 export * from './modules/support/index';
 export * from './modules/common/interfaces/server-message';

package/dist/types/modules/alert-intake/enums/alert-intake.enum.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Alert intake: how a member of the public reaches an organization WITHOUT the app -
+ * an SMS, a WhatsApp message or an email that clarion-alerts turns into an incident.
+ *
+ * Not to be confused with `alert-dispatch`, which is about who an SOS raised IN the
+ * app is sent to.
+ */
+/** The channel a message arrived on. */
+export declare enum AlertIntakeChannel {
+    SMS = "SMS",
+    WHATSAPP = "WHATSAPP",
+    EMAIL = "EMAIL"
+}
+/**
+ * The provider a connection talks to.
+ *
+ * A code here only RESERVES the name. Whether a provider can be connected is
+ * answered by clarion-alerts' provider catalogue (`AlertIntakeProviderDescriptor`),
+ * which lists only providers with a registered adapter. UWAZII and CELCOM are
+ * reserved without an adapter on purpose: their inbound callback formats have not
+ * been confirmed, and until they are, GENERIC_SMS connects them by configuration.
+ */
+export declare enum AlertIntakeProvider {
+    AFRICASTALKING = "africastalking",
+    UWAZII = "uwazii",
+    CELCOM = "celcom",
+    /** Any gateway that POSTs flat JSON or form fields; the field names are configured. */
+    GENERIC_SMS = "generic_sms",
+    WHATSAPP_CLOUD = "whatsapp_cloud",
+    IMAP = "imap",
+    /** An inbound-parse webhook (Mailgun routes, SendGrid Inbound Parse, or a generic JSON post). */
+    EMAIL_WEBHOOK = "email_webhook"
+}
+/**
+ * Where a connection's credentials live. Never in a plaintext column.
+ *
+ *   ENCRYPTED         entered by the organization, encrypted at rest by clarion-alerts
+ *                     (AES-256-GCM, bound to the connection and the field). Write-only:
+ *                     the API never returns them.
+ *   SECRET_REFERENCE  the NAME of a secret the platform operator provisioned (Secret
+ *                     Manager / environment). How the legacy per-tenant credentials
+ *                     keep working, and the option for an operator who does not want
+ *                     a credential in the database at all.
+ */
+export declare enum AlertIntakeSecretSource {
+    ENCRYPTED = "ENCRYPTED",
+    SECRET_REFERENCE = "SECRET_REFERENCE"
+}
+/**
+ * How the emergency type of an incident raised from a message is decided.
+ * AUTO derives it from the organization: a grievance desk never raises an
+ * emergency; an incident desk decides from the message's category and priority.
+ */
+export declare enum AlertIntakeEmergencyPolicy {
+    AUTO = "AUTO",
+    ALWAYS_EMERGENCY = "ALWAYS_EMERGENCY",
+    ALWAYS_NON_EMERGENCY = "ALWAYS_NON_EMERGENCY"
+}
+/** How a message on a PLATFORM connection finds its organization. */
+export declare enum AlertIntakeRouteMatch {
+    /** The first word of the message, e.g. `G4S fire at ...` on a shared short code. */
+    KEYWORD = "KEYWORD",
+    /** Everything no other route claimed. At most one per connection. */
+    DEFAULT = "DEFAULT"
+}
+/** How a provider proves a webhook call really came from it. */
+export declare enum AlertIntakeWebhookVerification {
+    /** The unguessable URL is the only proof (Africa's Talking signs nothing). */
+    SECRET_URL = "SECRET_URL",
+    /** A shared secret the gateway sends in a header, compared in constant time. */
+    SHARED_SECRET_HEADER = "SHARED_SECRET_HEADER",
+    /** `X-Hub-Signature-256`: HMAC-SHA256 of the raw body with the Meta app secret. */
+    META_SIGNATURE = "META_SIGNATURE"
+}
+/** Why a message that arrived did not become an incident. Stored; shown to operators. */
+export declare enum AlertIntakeRejectionReason {
+    UNKNOWN_CONNECTION = "UNKNOWN_CONNECTION",
+    CONNECTION_DISABLED = "CONNECTION_DISABLED",
+    VERIFICATION_FAILED = "VERIFICATION_FAILED",
+    NO_ORGANIZATION = "NO_ORGANIZATION",
+    ORGANIZATION_INACTIVE = "ORGANIZATION_INACTIVE",
+    RATE_LIMITED = "RATE_LIMITED"
+}

package/dist/types/modules/alert-intake/index.d.ts

@@ -0,0 +1,3 @@
+export * from './enums/alert-intake.enum';
+export * from './interfaces/alert-intake';
+export * from './utils/alert-intake.util';

package/dist/types/modules/alert-intake/interfaces/alert-intake.d.ts

@@ -0,0 +1,202 @@
+import { CountryCode } from '../../country/enums/country-code.enum';
+import { AlertIntakeChannel, AlertIntakeEmergencyPolicy, AlertIntakeProvider, AlertIntakeRouteMatch, AlertIntakeSecretSource, AlertIntakeWebhookVerification } from '../enums/alert-intake.enum';
+/**
+ * Alert intake settings.
+ *
+ * `organizationId` is the single source of truth. A CONNECTION is one
+ * organization's link to one provider on one channel (its short code, its WhatsApp
+ * number, its mailbox). A message that arrives on a connection belongs to the
+ * connection's organization, and everything the incident needs - app id, incident
+ * class, workflow queue, country - is read from that organization's record in
+ * clarion-organization rather than from a table in code.
+ *
+ * The fallback is a PLATFORM connection (no organization): a shared short code or a
+ * shared mailbox whose messages are routed to an organization by keyword, or to a
+ * default organization.
+ *
+ * Owned by clarion-alerts, proxied by the gateway, rendered by the admin. No shape
+ * here ever carries a credential: secrets are write-only.
+ *
+ * MIRRORS grm-shared-library (`modules/alert-intake/interfaces` and `dtos`). The
+ * response shapes are interfaces on both sides; the request shapes are class-validator
+ * DTOs on the backend and plain interfaces here (see the end of this file).
+ */
+export type AlertIntakeFieldType = 'text' | 'number' | 'boolean' | 'select';
+/** One value a provider needs from the operator. */
+export interface AlertIntakeProviderFieldDescriptor {
+    key: string;
+    label: string;
+    type: AlertIntakeFieldType;
+    required: boolean;
+    /** Secret fields are write-only, and are stored encrypted or as a reference. */
+    secret: boolean;
+    placeholder?: string;
+    description?: string;
+    defaultValue?: string | number | boolean;
+    options?: Array<{
+        value: string;
+        label: string;
+    }>;
+    /** `text` fields only. */
+    maxLength?: number;
+    /** `number` fields only; inclusive. */
+    min?: number;
+    max?: number;
+    /** Only a platform operator may set this (e.g. switching off TLS verification). */
+    operatorOnly?: boolean;
+}
+/**
+ * Self-description of an intake provider, published by clarion-alerts. Same idea as
+ * the tracking and SMS provider descriptors: the service that owns the adapter is
+ * the source of truth for what it needs, so adding a provider changes no client code.
+ * Static metadata - never a credential, never anything tenant-specific.
+ */
+export interface AlertIntakeProviderDescriptor {
+    provider: AlertIntakeProvider;
+    channel: AlertIntakeChannel;
+    displayName: string;
+    description: string;
+    /** What identifies the connection to the provider: the number people text, the mailbox. */
+    address: {
+        label: string;
+        placeholder?: string;
+        description?: string;
+    };
+    fields: AlertIntakeProviderFieldDescriptor[];
+    /** Null for a provider that is polled rather than called (IMAP). */
+    webhook: {
+        verification: AlertIntakeWebhookVerification;
+        /** Steps the operator performs in the PROVIDER's console, in order. */
+        setup: string[];
+    } | null;
+    /** Whether `POST .../test` does something for this provider. */
+    testable: boolean;
+    documentationUrl?: string;
+}
+export interface AlertIntakeConnection {
+    id: string;
+    /** Null = a platform connection, shared between organizations through routes. */
+    organizationId: number | null;
+    channel: AlertIntakeChannel;
+    provider: AlertIntakeProvider;
+    name: string;
+    /** The short code / number / WhatsApp phone-number id / mailbox messages are sent TO. */
+    address: string;
+    enabled: boolean;
+    /** Non-secret provider settings, as described by the provider's descriptor. */
+    config: Record<string, string | number | boolean>;
+    secretSource: AlertIntakeSecretSource;
+    /** Which secret fields have a value. The values themselves are never returned. */
+    secretsConfigured: Record<string, boolean>;
+    emergencyPolicy: AlertIntakeEmergencyPolicy;
+    /**
+     * The URL to paste into the provider's console. Null for a polled provider.
+     * It embeds an unguessable key: treat it as a credential.
+     */
+    webhookUrl: string | null;
+    /** When the provider last completed its verification handshake (WhatsApp). */
+    webhookVerifiedAt: string | null;
+    lastReceivedAt: string | null;
+    lastError: string | null;
+    lastErrorAt: string | null;
+    /** Set on the connections created from the pre-organization, per-tenant setup. */
+    legacyKey: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Sends the messages of a PLATFORM connection to an organization. */
+export interface AlertIntakeRoute {
+    id: string;
+    connectionId: string;
+    match: AlertIntakeRouteMatch;
+    /** Upper-cased. Null for the DEFAULT route. */
+    keyword: string | null;
+    organizationId: number;
+    enabled: boolean;
+    createdAt: string;
+}
+/** What the incident will be created with, derived from the organization record. */
+export interface AlertIntakeOrganizationContext {
+    organizationId: number;
+    name: string;
+    appId: string;
+    incidentClass: string;
+    workflowTaskQueueName: string;
+    countryCode: CountryCode;
+    /** False when the organization is not ACTIVE: its messages are held, not raised. */
+    active: boolean;
+}
+/** What an organization without a connection of its own falls back to, per channel. */
+export interface AlertIntakePlatformFallback {
+    channel: AlertIntakeChannel;
+    /** The shared address to publish, e.g. the platform short code. */
+    address: string;
+    provider: AlertIntakeProvider;
+    /** The keyword that routes to this organization, when it has one. */
+    keyword: string | null;
+    /** True when this organization is the connection's DEFAULT route. */
+    isDefault: boolean;
+}
+/** Everything the settings page needs, in one read. */
+export interface OrganizationAlertIntakeSettings {
+    organizationId: number;
+    /** Null when clarion-organization could not be reached or the id is unknown. */
+    organization: AlertIntakeOrganizationContext | null;
+    connections: AlertIntakeConnection[];
+    platformFallbacks: AlertIntakePlatformFallback[];
+    /** False when the service has no key to encrypt credentials with: only secret references can be used. */
+    encryptedSecretsAvailable: boolean;
+}
+export interface AlertIntakeConnectionTestResult {
+    success: boolean;
+    /** Operator-facing. Never contains a credential. */
+    message: string;
+    latencyMs?: number;
+}
+export interface CreateAlertIntakeConnection {
+    channel: AlertIntakeChannel;
+    provider: AlertIntakeProvider;
+    /** 2-100 characters, single line. */
+    name: string;
+    /** What people send to: the short code or number, the WhatsApp phone-number id, the mailbox address. */
+    address: string;
+    enabled?: boolean;
+    /** Non-secret provider settings, as the provider descriptor declares them. */
+    config?: Record<string, string | number | boolean>;
+    /** Credentials. WRITE-ONLY: encrypted at rest and never returned. Keys are the descriptor's secret fields. */
+    secrets?: Record<string, string>;
+    /** Platform operators only. NAMES of provisioned secrets, used instead of `secrets` - never both. */
+    secretReferences?: Record<string, string>;
+    emergencyPolicy?: AlertIntakeEmergencyPolicy;
+}
+/**
+ * Channel and provider cannot change: a connection IS its provider link. `config`
+ * is merged over the stored settings and only the `secrets` sent are replaced; a key
+ * sent as "" is removed.
+ */
+export interface UpdateAlertIntakeConnection {
+    name?: string;
+    address?: string;
+    enabled?: boolean;
+    config?: Record<string, string | number | boolean>;
+    secrets?: Record<string, string>;
+    /** Platform operators only. */
+    secretReferences?: Record<string, string>;
+    emergencyPolicy?: AlertIntakeEmergencyPolicy;
+}
+/** Platform operators only: sends a PLATFORM connection's messages to an organization. */
+export interface CreateAlertIntakeRoute {
+    match: AlertIntakeRouteMatch;
+    /** Required for KEYWORD; must be absent for DEFAULT. */
+    keyword?: string;
+    organizationId: number;
+    enabled?: boolean;
+}
+export interface UpdateAlertIntakeRoute {
+    organizationId?: number;
+    enabled?: boolean;
+}
+/** A platform connection as the operator list returns it: the connection plus its routes. */
+export type AlertIntakePlatformConnection = AlertIntakeConnection & {
+    routes: AlertIntakeRoute[];
+};

package/dist/types/modules/alert-intake/utils/alert-intake.util.d.ts

@@ -0,0 +1,24 @@
+/** A routing keyword: 2-20 letters or digits, stored upper-cased. */
+export declare const ALERT_INTAKE_KEYWORD_PATTERN: RegExp;
+/** Upper bounds that keep one organization's settings a form rather than a list to page through. */
+export declare const MAX_ALERT_INTAKE_CONNECTIONS_PER_ORGANIZATION = 20;
+export declare const MAX_ALERT_INTAKE_ROUTES_PER_CONNECTION = 200;
+/** One settings value (config or secret). An access token is the longest thing that goes here. */
+export declare const MAX_ALERT_INTAKE_SETTING_LENGTH = 4096;
+/** Normalises what an operator typed into the stored form. Null when it is not a valid keyword. */
+export declare function normaliseAlertIntakeKeyword(value: string | null | undefined): string | null;
+/**
+ * The routing keyword of a message: its first word, upper-cased, punctuation
+ * stripped - `g4s, fire at the gate` and `G4S: fire` both give `G4S`.
+ * Null when the first word could not be a keyword.
+ *
+ * Deliberately only the FIRST word. Matching a keyword anywhere in the text would
+ * route "I was robbed near the G4S office" to G4S.
+ */
+export declare function extractAlertIntakeKeyword(text: string | null | undefined): string | null;
+/**
+ * The message with its routing keyword removed, so "G4S fire at the gate" is
+ * analysed as "fire at the gate". Returns the text unchanged when it does not start
+ * with that keyword.
+ */
+export declare function stripAlertIntakeKeyword(text: string, keyword: string): string;

package/dist/types/modules/permission/enums/permission-actions.enum.d.ts

@@ -84,5 +84,8 @@ export declare enum PermissionActions {
     MANAGE_SUPPORT_SYNC = "manage:support-sync",
     READ_NOTIFICATION_SETTINGS = "read:notification-settings",
     MANAGE_NOTIFICATION_SETTINGS = "manage:notification-settings",
-    APPROVE_NOTIFICATION_SENDER = "approve:notification-sender"
+    APPROVE_NOTIFICATION_SENDER = "approve:notification-sender",
+    READ_ALERT_INTAKE = "read:alert-intake",
+    MANAGE_ALERT_INTAKE = "manage:alert-intake",
+    MANAGE_ALERT_INTAKE_PLATFORM = "manage:alert-intake-platform"
 }

package/dist/types/modules/permission/enums/permissions-moudule.enum.d.ts

@@ -9,5 +9,6 @@ export declare enum PermissionsModule {
     RESPONSE_UNIT = "Response Unit",
     TRACKING = "Tracking",
     SUPPORT = "Support",
-    NOTIFICATION = "Notification"
+    NOTIFICATION = "Notification",
+    ALERT_INTAKE = "Alert Intake"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clarion-shared-types",
-  "version": "1.0.98",
+  "version": "1.0.99",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
   "types": "dist/types/index.d.ts",