@adcp/sdk 5.23.0

package/dist/lib/server/pin-and-bind-fetch.js

@@ -0,0 +1,244 @@
+"use strict";
+/**
+ * Pin-and-bind fetch — DNS-rebinding-resistant `fetch` for outbound webhook
+ * delivery and other callbacks where the destination is buyer-supplied.
+ *
+ * The problem: validating a `push_notification_config.url`'s LITERAL hostname
+ * against an SSRF deny list does not protect against a DNS-rebinding attack.
+ * A buyer can register `https://rebind.attacker.com/`, pass the literal-host
+ * check, and then flip the A-record TTL to `169.254.169.254` (cloud metadata)
+ * or `127.0.0.1` (loopback) before the webhook fires. Node's `fetch` resolves
+ * the host fresh at request time, gets the rebound IP, and posts the
+ * signed payload to the attacker-controlled destination.
+ *
+ * The fix: control DNS resolution and connect-target inside the fetch itself.
+ *   1. Resolve the hostname.
+ *   2. Validate every resolved IP against the SSRF policy (CIDR deny lists,
+ *      metadata-host names, scheme rules).
+ *   3. Pin the connection to the validated IP — undici opens TCP/TLS to that
+ *      specific address, but the original hostname is preserved for TLS SNI
+ *      and the `Host:` header so HTTPS routing still works.
+ *
+ * Implementation note: undici's `Agent` accepts a `connect.lookup` callback
+ * with the same signature as `dns.lookup`. We hook the callback, resolve via
+ * `dns.lookup({ all: true })` to see EVERY address the host can reach, run
+ * the resolved IPs through {@link enforceSsrfPolicyResolved}, and only return
+ * a pinned address when every resolved IP is in an allowed range. This
+ * matches the AdCP substitution-observer SSRF contract — a host that
+ * resolves to *any* denied IP is treated as suspect and rejected wholesale.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOOPBACK_OK_WEBHOOK_SSRF_POLICY = exports.WEBHOOK_SSRF_POLICY = void 0;
+exports.createPinAndBindFetch = createPinAndBindFetch;
+const undici_1 = require("undici");
+const node_dns_1 = require("node:dns");
+const node_net_1 = require("node:net");
+const ssrf_1 = require("../substitution/observer/ssrf");
+/**
+ * Default SSRF policy for outbound webhook delivery. Stricter than
+ * `DEFAULT_SSRF_POLICY` (substitution observer) only in that it allows
+ * `host_literal_policy: 'allow'` — webhook URLs MAY use IP literals
+ * (e.g. `https://203.0.113.10/cb`) as long as the IP is not in a denied
+ * CIDR range. Schemes restricted to https; signed webhooks SHOULD be
+ * delivered over TLS.
+ *
+ * For storyboard / in-process tests where the receiver runs on
+ * `http://127.0.0.1:port`, use {@link LOOPBACK_OK_WEBHOOK_SSRF_POLICY}
+ * instead. That preset relaxes only the loopback + http rules and keeps
+ * every other deny range — adopters get most of the SSRF protection
+ * during tests without disabling pin-and-bind entirely.
+ */
+exports.WEBHOOK_SSRF_POLICY = Object.freeze({
+    schemes_allowed: Object.freeze(['https']),
+    schemes_denied: Object.freeze(['http', 'file', 'gopher', 'ftp', 'ftps', 'data', 'javascript', 'about', 'ws', 'wss']),
+    hosts_denied_ipv4_cidrs: Object.freeze([
+        '0.0.0.0/8',
+        '10.0.0.0/8',
+        '100.64.0.0/10',
+        '127.0.0.0/8',
+        '169.254.0.0/16',
+        '172.16.0.0/12',
+        '192.0.0.0/24',
+        '192.168.0.0/16',
+        '224.0.0.0/4',
+        '240.0.0.0/4',
+    ]),
+    hosts_denied_ipv6_cidrs: Object.freeze([
+        '::1/128',
+        '::/128',
+        '::ffff:0:0/96',
+        '64:ff9b::/96',
+        'fc00::/7',
+        'fe80::/10',
+        'ff00::/8',
+    ]),
+    hosts_denied_metadata: Object.freeze([
+        'metadata.google.internal',
+        'metadata',
+        'metadata.packet.net',
+        'fd00:ec2::254',
+    ]),
+    host_literal_policy: 'allow',
+});
+/**
+ * Pin-and-bind policy that allows http URLs and IPv4/IPv6 loopback so
+ * adopters can enable pin-and-bind for production webhook delivery while
+ * keeping storyboard / in-process tests working — `createWebhookReceiver`
+ * listens on `http://127.0.0.1:port`. Every other private CIDR, metadata
+ * host, and link-local range is still denied, so loopback is the only
+ * relaxation. Pass to `createPinAndBindFetch({ policy })` from your test
+ * fixture or storyboard runner harness; do NOT use in production.
+ */
+exports.LOOPBACK_OK_WEBHOOK_SSRF_POLICY = Object.freeze({
+    schemes_allowed: Object.freeze(['http', 'https']),
+    schemes_denied: Object.freeze(['file', 'gopher', 'ftp', 'ftps', 'data', 'javascript', 'about', 'ws', 'wss']),
+    hosts_denied_ipv4_cidrs: Object.freeze([
+        '0.0.0.0/8',
+        '10.0.0.0/8',
+        '100.64.0.0/10',
+        // 127.0.0.0/8 omitted — loopback allowed for tests.
+        '169.254.0.0/16',
+        '172.16.0.0/12',
+        '192.0.0.0/24',
+        '192.168.0.0/16',
+        '224.0.0.0/4',
+        '240.0.0.0/4',
+    ]),
+    hosts_denied_ipv6_cidrs: Object.freeze([
+        // ::1/128 and ::/128 omitted — IPv6 loopback allowed for tests.
+        '::ffff:0:0/96',
+        '64:ff9b::/96',
+        'fc00::/7',
+        'fe80::/10',
+        'ff00::/8',
+    ]),
+    hosts_denied_metadata: Object.freeze([
+        'metadata.google.internal',
+        'metadata',
+        'metadata.packet.net',
+        'fd00:ec2::254',
+    ]),
+    host_literal_policy: 'allow',
+});
+const DEFAULT_LOOKUP_ALL = (hostname, options, callback) => {
+    (0, node_dns_1.lookup)(hostname, { ...options, all: true }, (err, addresses) => {
+        callback(err, addresses);
+    });
+};
+/**
+ * Build a `fetch` that pins outbound connections to the IPs the SSRF policy
+ * allows, defeating DNS-rebinding attacks against per-attempt DNS resolution.
+ *
+ * Pass as the `fetch` argument to `createWebhookEmitter` /
+ * `createAdcpServer({ webhooks: { fetch } })` to enable rebinding protection
+ * on outbound webhook delivery. Recommended for production. The default
+ * `fetch` for `createWebhookEmitter` remains `globalThis.fetch` until v6 —
+ * see `docs/guides/SIGNING-GUIDE.md` § Webhook SSRF defense for the
+ * migration plan and {@link LOOPBACK_OK_WEBHOOK_SSRF_POLICY} for storyboard
+ * tests that need loopback http delivery.
+ *
+ * Construct once per emitter and reuse — each call instantiates a fresh
+ * `undici.Agent` with its own connection pool.
+ *
+ * @example
+ * ```ts
+ * import { createWebhookEmitter, createPinAndBindFetch } from '@adcp/sdk/server';
+ *
+ * const emitter = createWebhookEmitter({
+ *   signerKey: webhookKey,
+ *   fetch: createPinAndBindFetch(),
+ * });
+ * ```
+ */
+function createPinAndBindFetch(options = {}) {
+    const policy = options.policy ?? exports.WEBHOOK_SSRF_POLICY;
+    const lookupImpl = options.lookup ?? DEFAULT_LOOKUP_ALL;
+    const guardedLookup = (hostname, opts, callback) => {
+        const wantsAll = opts?.all === true;
+        lookupImpl(hostname, { ...(opts ?? {}), all: true }, (err, addresses) => {
+            if (err) {
+                callback(err);
+                return;
+            }
+            if (!Array.isArray(addresses) || addresses.length === 0) {
+                callback(makeSsrfError(`DNS resolution returned no addresses for ${hostname}`, 'dns_revalidation:no_addresses'));
+                return;
+            }
+            // The URL passed in here only matters for scheme + hostname checks,
+            // both of which were already validated synchronously by undici when
+            // the request started. We re-build a placeholder URL to feed the
+            // resolved-address rule, which is the load-bearing check for
+            // rebinding defense.
+            const url = new URL(`https://${bracketIfV6(hostname)}`);
+            const ips = addresses.map(a => a.address);
+            const result = (0, ssrf_1.enforceSsrfPolicyResolved)(url, ips, policy);
+            if (!result.allowed) {
+                callback(makeSsrfError(result.message ?? 'SSRF policy denied resolved address', result.rule ?? 'ssrf'));
+                return;
+            }
+            if (wantsAll) {
+                callback(null, addresses);
+                return;
+            }
+            // Pin to the first resolved address. enforceSsrfPolicyResolved is
+            // all-or-none: if it allowed the resolution, every entry passed.
+            const first = addresses[0];
+            callback(null, first.address, first.family);
+        });
+    };
+    const dispatcher = new undici_1.Agent({
+        ...(options.agentOptions ?? {}),
+        connect: {
+            ...(options.agentOptions?.connect ?? {}),
+            // undici's connect type accepts a lookup with the dns.lookup signature.
+            lookup: guardedLookup,
+        },
+    });
+    const wrapped = async (input, init) => {
+        // Synchronous pre-check for the URL's literal scheme + (if it's an IP)
+        // its CIDR membership. undici skips `connect.lookup` for IP-literal
+        // hostnames, so the resolved-IP path below would never see them.
+        // This pre-check enforces the same SSRF policy on URLs like
+        // `https://127.0.0.1/cb` or `https://[::1]/cb`.
+        const url = resolveRequestUrl(input);
+        if (url) {
+            const sync = (0, ssrf_1.enforceSsrfPolicy)(url, policy);
+            if (!sync.allowed) {
+                throw makeSsrfError(sync.message ?? 'SSRF policy denied URL', sync.rule ?? 'ssrf');
+            }
+        }
+        return (0, undici_1.fetch)(input, {
+            ...init,
+            dispatcher: dispatcher,
+        });
+    };
+    return wrapped;
+}
+function resolveRequestUrl(input) {
+    try {
+        if (typeof input === 'string')
+            return new URL(input);
+        if (input instanceof URL)
+            return input;
+        if (typeof input === 'object' &&
+            input !== null &&
+            'url' in input &&
+            typeof input.url === 'string') {
+            return new URL(input.url);
+        }
+    }
+    catch {
+        // Let undici surface the parse error in its own shape.
+        return null;
+    }
+    return null;
+}
+function bracketIfV6(host) {
+    return (0, node_net_1.isIPv6)(host) ? `[${host}]` : host;
+}
+function makeSsrfError(message, rule) {
+    const err = new Error(`pin-and-bind: ${rule}: ${message}`);
+    err.code = 'EADCP_SSRF_BLOCKED';
+    return err;
+}
+//# sourceMappingURL=pin-and-bind-fetch.js.map

package/dist/lib/server/pin-and-bind-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin-and-bind-fetch.js","sourceRoot":"","sources":["../../../src/lib/server/pin-and-bind-fetch.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AAiKH,sDA+EC;AA9OD,mCAAsE;AACtE,uCAAyE;AACzE,uCAAkC;AAElC,wDAA6F;AAG7F;;;;;;;;;;;;;GAaG;AACU,QAAA,mBAAmB,GAAe,MAAM,CAAC,MAAM,CAAC;IAC3D,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpH,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,WAAW;QACX,YAAY;QACZ,eAAe;QACf,aAAa;QACb,gBAAgB;QAChB,eAAe;QACf,cAAc;QACd,gBAAgB;QAChB,aAAa;QACb,aAAa;KACd,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,SAAS;QACT,QAAQ;QACR,eAAe;QACf,cAAc;QACd,UAAU;QACV,WAAW;QACX,UAAU;KACX,CAAC;IACF,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC;QACnC,0BAA0B;QAC1B,UAAU;QACV,qBAAqB;QACrB,eAAe;KAChB,CAAC;IACF,mBAAmB,EAAE,OAAO;CAC7B,CAAe,CAAC;AAEjB;;;;;;;;GAQG;AACU,QAAA,+BAA+B,GAAe,MAAM,CAAC,MAAM,CAAC;IACvE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5G,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,WAAW;QACX,YAAY;QACZ,eAAe;QACf,oDAAoD;QACpD,gBAAgB;QAChB,eAAe;QACf,cAAc;QACd,gBAAgB;QAChB,aAAa;QACb,aAAa;KACd,CAAC;IACF,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC;QACrC,gEAAgE;QAChE,eAAe;QACf,cAAc;QACd,UAAU;QACV,WAAW;QACX,UAAU;KACX,CAAC;IACF,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC;QACnC,0BAA0B;QAC1B,UAAU;QACV,qBAAqB;QACrB,eAAe;KAChB,CAAC;IACF,mBAAmB,EAAE,OAAO;CAC7B,CAAe,CAAC;AAmCjB,MAAM,kBAAkB,GAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IACvE,IAAA,iBAAe,EAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QACtE,QAAQ,CAAC,GAAG,EAAE,SAA4B,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,2BAAmB,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC;IAExD,MAAM,aAAa,GAAG,CACpB,QAAgB,EAChB,IAAwF,EACxF,QAA+G,EACzG,EAAE;QACR,MAAM,QAAQ,GAAG,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;QACpC,UAAU,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YACtE,IAAI,GAAG,EAAE,CAAC;gBACR,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,QAAQ,CACN,aAAa,CAAC,4CAA4C,QAAQ,EAAE,EAAE,+BAA+B,CAAC,CACvG,CAAC;gBACF,OAAO;YACT,CAAC;YAED,oEAAoE;YACpE,oEAAoE;YACpE,iEAAiE;YACjE,6DAA6D;YAC7D,qBAAqB;YACrB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,IAAA,gCAAyB,EAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,IAAI,qCAAqC,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;gBACxG,OAAO;YACT,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,kEAAkE;YAClE,iEAAiE;YACjE,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,cAAK,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/B,OAAO,EAAE;YACP,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,IAAI,EAAE,CAAC;YACxC,wEAAwE;YACxE,MAAM,EAAE,aAIC;SACV;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,KAAK,EAAE,KAAkC,EAAE,IAAkC,EAAqB,EAAE;QAClH,uEAAuE;QACvE,oEAAoE;QACpE,iEAAiE;QACjE,4DAA4D;QAC5D,gDAAgD;QAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,IAAA,wBAAiB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,wBAAwB,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,OAAO,IAAA,cAAW,EAAC,KAA0C,EAAE;YAC7D,GAAI,IAA0C;YAC9C,UAAU,EAAE,UAAmC;SAChD,CAAwB,CAAC;IAC5B,CAAC,CAAC;IAEF,OAAO,OAAuB,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAkC;IAC3D,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,KAAK,YAAY,GAAG;YAAE,OAAO,KAAK,CAAC;QACvC,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,KAAK,IAAI,KAAK;YACd,OAAQ,KAA0B,CAAC,GAAG,KAAK,QAAQ,EACnD,CAAC;YACD,OAAO,IAAI,GAAG,CAAE,KAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAA,iBAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,IAAY;IAClD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,OAAO,EAAE,CAA0B,CAAC;IACpF,GAAG,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/server/postgres-state-store.d.ts

@@ -0,0 +1,76 @@
+/**
+ * PostgreSQL-backed state store for distributed AdCP servers.
+ *
+ * Replaces InMemoryStateStore when running multiple server instances behind
+ * a load balancer. Domain objects are stored in a shared JSONB table so any
+ * instance can read or write state regardless of which instance handled
+ * the original request.
+ *
+ * @example
+ * ```typescript
+ * import { Pool } from 'pg';
+ * import { PostgresStateStore, createAdcpServer, serve } from '@adcp/sdk';
+ *
+ * const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+ * const stateStore = new PostgresStateStore(pool);
+ *
+ * // Run migration once at startup
+ * await pool.query(getAdcpStateMigration());
+ *
+ * serve(() => createAdcpServer({
+ *   name: 'My Publisher', version: '1.0.0',
+ *   stateStore,
+ *   mediaBuy: {
+ *     createMediaBuy: async (params, ctx) => {
+ *       const buy = { media_buy_id: 'mb_1', status: 'active', packages: [] };
+ *       await ctx.store.put('media_buys', buy.media_buy_id, buy);
+ *       return buy;
+ *     },
+ *   },
+ * }));
+ * ```
+ */
+import type { PgQueryable } from './postgres-task-store';
+import { type AdcpStateStore, type ListOptions, type ListResult, type PutIfMatchResult, type VersionedDocument } from './state-store';
+export interface PostgresStateStoreOptions {
+    /** Table name. Must contain only lowercase letters, digits, and underscores. Defaults to `"adcp_state"`. */
+    tableName?: string;
+    /** Max bytes per document. Defaults to {@link DEFAULT_MAX_DOCUMENT_BYTES}. */
+    maxDocumentBytes?: number;
+}
+/**
+ * Generate the SQL DDL for the state store table.
+ *
+ * Idempotent: safe to run on existing tables. The `ADD COLUMN IF NOT EXISTS`
+ * clause upgrades databases created by earlier SDK versions (no `version`
+ * column) without rewriting data — existing rows start at version 1. A seller's
+ * first `putIfMatch` against an existing (pre-migration) row will see
+ * `currentVersion: 1` — same as a freshly inserted row. Treat version as opaque.
+ *
+ * Do not attach triggers that suppress `UPDATE` or return `OLD` for this table —
+ * `putIfMatch` relies on affected-row count to detect conflicts, and a trigger
+ * that drops the update will be reported as a CAS conflict. RLS policies that
+ * silently reject writes have the same problem.
+ */
+export declare function getAdcpStateMigration(tableName?: string): string;
+/** The migration SQL as a constant for the default table name. */
+export declare const ADCP_STATE_MIGRATION: string;
+export declare class PostgresStateStore implements AdcpStateStore {
+    private readonly db;
+    private readonly table;
+    private readonly maxDocumentBytes;
+    constructor(db: PgQueryable, options?: PostgresStateStoreOptions);
+    get<T extends Record<string, unknown> = Record<string, unknown>>(collection: string, id: string): Promise<T | null>;
+    getWithVersion<T extends Record<string, unknown> = Record<string, unknown>>(collection: string, id: string): Promise<VersionedDocument<T> | null>;
+    put(collection: string, id: string, data: Record<string, unknown>): Promise<void>;
+    putIfMatch(collection: string, id: string, data: Record<string, unknown>, expectedVersion: number | null): Promise<PutIfMatchResult>;
+    patch(collection: string, id: string, partial: Record<string, unknown>): Promise<void>;
+    delete(collection: string, id: string): Promise<boolean>;
+    list<T extends Record<string, unknown> = Record<string, unknown>>(collection: string, options?: ListOptions): Promise<ListResult<T>>;
+    /**
+     * Delete all documents in a collection.
+     */
+    clearCollection(collection: string): Promise<number>;
+    scoped(sessionKey: string): AdcpStateStore;
+}
+//# sourceMappingURL=postgres-state-store.d.ts.map

package/dist/lib/server/postgres-state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-state-store.d.ts","sourceRoot":"","sources":["../../../src/lib/server/postgres-state-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,yBAAyB;IACxC,4GAA4G;IAC5G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,SAAgB,GAAG,MAAM,CA0BvE;AAED,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,QAA0B,CAAC;AAE5D,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAE9B,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,yBAAyB;IAS1D,GAAG,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnE,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAWd,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9E,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAYjC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAWjF,UAAU,CACd,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,eAAe,EAAE,MAAM,GAAG,IAAI,GAC7B,OAAO,CAAC,gBAAgB,CAAC;IAqCtB,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtF,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxD,IAAI,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpE,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAoDzB;;OAEG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK1D,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc;CAG3C"}

package/dist/lib/server/postgres-state-store.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * PostgreSQL-backed state store for distributed AdCP servers.
+ *
+ * Replaces InMemoryStateStore when running multiple server instances behind
+ * a load balancer. Domain objects are stored in a shared JSONB table so any
+ * instance can read or write state regardless of which instance handled
+ * the original request.
+ *
+ * @example
+ * ```typescript
+ * import { Pool } from 'pg';
+ * import { PostgresStateStore, createAdcpServer, serve } from '@adcp/sdk';
+ *
+ * const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+ * const stateStore = new PostgresStateStore(pool);
+ *
+ * // Run migration once at startup
+ * await pool.query(getAdcpStateMigration());
+ *
+ * serve(() => createAdcpServer({
+ *   name: 'My Publisher', version: '1.0.0',
+ *   stateStore,
+ *   mediaBuy: {
+ *     createMediaBuy: async (params, ctx) => {
+ *       const buy = { media_buy_id: 'mb_1', status: 'active', packages: [] };
+ *       await ctx.store.put('media_buys', buy.media_buy_id, buy);
+ *       return buy;
+ *     },
+ *   },
+ * }));
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostgresStateStore = exports.ADCP_STATE_MIGRATION = void 0;
+exports.getAdcpStateMigration = getAdcpStateMigration;
+const state_store_1 = require("./state-store");
+const DEFAULT_TABLE = 'adcp_state';
+const VALID_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
+const PAGE_SIZE = 50;
+const MAX_PAGE_SIZE = 500;
+/**
+ * Generate the SQL DDL for the state store table.
+ *
+ * Idempotent: safe to run on existing tables. The `ADD COLUMN IF NOT EXISTS`
+ * clause upgrades databases created by earlier SDK versions (no `version`
+ * column) without rewriting data — existing rows start at version 1. A seller's
+ * first `putIfMatch` against an existing (pre-migration) row will see
+ * `currentVersion: 1` — same as a freshly inserted row. Treat version as opaque.
+ *
+ * Do not attach triggers that suppress `UPDATE` or return `OLD` for this table —
+ * `putIfMatch` relies on affected-row count to detect conflicts, and a trigger
+ * that drops the update will be reported as a CAS conflict. RLS policies that
+ * silently reject writes have the same problem.
+ */
+function getAdcpStateMigration(tableName = DEFAULT_TABLE) {
+    if (!VALID_IDENTIFIER.test(tableName)) {
+        throw new Error(`Invalid table name: "${tableName}". Must match /^[a-z_][a-z0-9_]*$/.`);
+    }
+    return `
+    CREATE TABLE IF NOT EXISTS ${tableName} (
+      collection    TEXT NOT NULL,
+      id            TEXT NOT NULL,
+      data          JSONB NOT NULL,
+      version       INTEGER NOT NULL DEFAULT 1,
+      created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+      PRIMARY KEY (collection, id)
+    );
+
+    ALTER TABLE ${tableName}
+      ADD COLUMN IF NOT EXISTS version INTEGER NOT NULL DEFAULT 1;
+
+    CREATE INDEX IF NOT EXISTS idx_${tableName}_collection
+      ON ${tableName}(collection);
+
+    CREATE INDEX IF NOT EXISTS idx_${tableName}_updated
+      ON ${tableName}(updated_at);
+  `;
+}
+/** The migration SQL as a constant for the default table name. */
+exports.ADCP_STATE_MIGRATION = getAdcpStateMigration();
+class PostgresStateStore {
+    db;
+    table;
+    maxDocumentBytes;
+    constructor(db, options) {
+        this.db = db;
+        this.table = options?.tableName ?? DEFAULT_TABLE;
+        this.maxDocumentBytes = options?.maxDocumentBytes ?? state_store_1.DEFAULT_MAX_DOCUMENT_BYTES;
+        if (!VALID_IDENTIFIER.test(this.table)) {
+            throw new Error(`Invalid table name: "${this.table}". Must match /^[a-z_][a-z0-9_]*$/.`);
+        }
+    }
+    async get(collection, id) {
+        (0, state_store_1.validateCollection)(collection);
+        (0, state_store_1.validateId)(id);
+        const { rows } = await this.db.query(`SELECT data FROM ${this.table} WHERE collection = $1 AND id = $2`, [
+            collection,
+            id,
+        ]);
+        if (rows.length === 0)
+            return null;
+        return rows[0].data;
+    }
+    async getWithVersion(collection, id) {
+        (0, state_store_1.validateCollection)(collection);
+        (0, state_store_1.validateId)(id);
+        const { rows } = await this.db.query(`SELECT data, version FROM ${this.table} WHERE collection = $1 AND id = $2`, [
+            collection,
+            id,
+        ]);
+        if (rows.length === 0)
+            return null;
+        const row = rows[0];
+        return { data: row.data, version: row.version };
+    }
+    async put(collection, id, data) {
+        const serialized = (0, state_store_1.validateWrite)(collection, id, data, this.maxDocumentBytes);
+        await this.db.query(`INSERT INTO ${this.table} (collection, id, data, version)
+       VALUES ($1, $2, $3, 1)
+       ON CONFLICT (collection, id)
+       DO UPDATE SET data = $3, version = ${this.table}.version + 1, updated_at = NOW()`, [collection, id, serialized]);
+    }
+    async putIfMatch(collection, id, data, expectedVersion) {
+        const serialized = (0, state_store_1.validateWrite)(collection, id, data, this.maxDocumentBytes);
+        if (expectedVersion === null) {
+            // Insert-only path: succeed iff no row exists. Returns version on success,
+            // nothing on conflict (then we re-read to report the current version).
+            const { rows } = await this.db.query(`INSERT INTO ${this.table} (collection, id, data, version)
+         VALUES ($1, $2, $3, 1)
+         ON CONFLICT (collection, id) DO NOTHING
+         RETURNING version`, [collection, id, serialized]);
+            if (rows.length > 0)
+                return { ok: true, version: rows[0].version };
+            const { rows: existing } = await this.db.query(`SELECT version FROM ${this.table} WHERE collection = $1 AND id = $2`, [collection, id]);
+            return { ok: false, currentVersion: existing[0]?.version ?? null };
+        }
+        const { rows } = await this.db.query(`UPDATE ${this.table}
+       SET data = $3, version = version + 1, updated_at = NOW()
+       WHERE collection = $1 AND id = $2 AND version = $4
+       RETURNING version`, [collection, id, serialized, expectedVersion]);
+        if (rows.length > 0)
+            return { ok: true, version: rows[0].version };
+        const { rows: existing } = await this.db.query(`SELECT version FROM ${this.table} WHERE collection = $1 AND id = $2`, [collection, id]);
+        return { ok: false, currentVersion: existing[0]?.version ?? null };
+    }
+    async patch(collection, id, partial) {
+        const serialized = (0, state_store_1.validateWrite)(collection, id, partial, this.maxDocumentBytes);
+        await this.db.query(`INSERT INTO ${this.table} (collection, id, data, version)
+       VALUES ($1, $2, $3, 1)
+       ON CONFLICT (collection, id)
+       DO UPDATE SET data = ${this.table}.data || $3, version = ${this.table}.version + 1, updated_at = NOW()`, [collection, id, serialized]);
+    }
+    async delete(collection, id) {
+        (0, state_store_1.validateCollection)(collection);
+        (0, state_store_1.validateId)(id);
+        const { rowCount } = await this.db.query(`DELETE FROM ${this.table} WHERE collection = $1 AND id = $2`, [
+            collection,
+            id,
+        ]);
+        return (rowCount ?? 0) > 0;
+    }
+    async list(collection, options) {
+        (0, state_store_1.validateCollection)(collection);
+        const limit = Math.min(options?.limit ?? PAGE_SIZE, MAX_PAGE_SIZE);
+        const conditions = ['collection = $1'];
+        const values = [collection];
+        let paramIndex = 2;
+        // Filter by JSONB containment
+        if (options?.filter && Object.keys(options.filter).length > 0) {
+            conditions.push(`data @> $${paramIndex}`);
+            values.push(JSON.stringify(options.filter));
+            paramIndex++;
+        }
+        // Cursor-based pagination (cursor = "updated_at|id")
+        if (options?.cursor) {
+            const parts = options.cursor.split('|', 2);
+            if (parts.length !== 2 || !parts[0] || !parts[1]) {
+                throw new Error(`Invalid cursor format: expected "timestamp|id"`);
+            }
+            const [cursorTime, cursorId] = parts;
+            conditions.push(`(updated_at, id) > ($${paramIndex}::timestamptz, $${paramIndex + 1})`);
+            values.push(cursorTime, cursorId);
+            paramIndex += 2;
+        }
+        const where = conditions.join(' AND ');
+        // Fetch one extra to detect hasMore
+        values.push(limit + 1);
+        const { rows } = await this.db.query(`SELECT id, data, updated_at::text AS updated_at_raw
+       FROM ${this.table}
+       WHERE ${where}
+       ORDER BY updated_at, id
+       LIMIT $${paramIndex}`, values);
+        const hasMore = rows.length > limit;
+        const resultRows = hasMore ? rows.slice(0, limit) : rows;
+        const items = resultRows.map(r => r.data);
+        let nextCursor;
+        if (hasMore && resultRows.length > 0) {
+            const last = resultRows[resultRows.length - 1];
+            nextCursor = `${last.updated_at_raw}|${last.id}`;
+        }
+        return { items, nextCursor };
+    }
+    /**
+     * Delete all documents in a collection.
+     */
+    async clearCollection(collection) {
+        const { rowCount } = await this.db.query(`DELETE FROM ${this.table} WHERE collection = $1`, [collection]);
+        return rowCount ?? 0;
+    }
+    scoped(sessionKey) {
+        return (0, state_store_1.createSessionedStore)(this, sessionKey);
+    }
+}
+exports.PostgresStateStore = PostgresStateStore;
+//# sourceMappingURL=postgres-state-store.js.map

package/dist/lib/server/postgres-state-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-state-store.js","sourceRoot":"","sources":["../../../src/lib/server/postgres-state-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AA0CH,sDA0BC;AAjED,+CAWuB;AASvB,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAC9C,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;;;;;;;;;;GAaG;AACH,SAAgB,qBAAqB,CAAC,SAAS,GAAG,aAAa;IAC7D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,qCAAqC,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO;iCACwB,SAAS;;;;;;;;;;;kBAWxB,SAAS;;;qCAGU,SAAS;WACnC,SAAS;;qCAEiB,SAAS;WACnC,SAAS;GACjB,CAAC;AACJ,CAAC;AAED,kEAAkE;AACrD,QAAA,oBAAoB,GAAG,qBAAqB,EAAE,CAAC;AAE5D,MAAa,kBAAkB;IACZ,EAAE,CAAc;IAChB,KAAK,CAAS;IACd,gBAAgB,CAAS;IAE1C,YAAY,EAAe,EAAE,OAAmC;QAC9D,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,SAAS,IAAI,aAAa,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,OAAO,EAAE,gBAAgB,IAAI,wCAA0B,CAAC;QAChF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,KAAK,qCAAqC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CACP,UAAkB,EAClB,EAAU;QAEV,IAAA,gCAAkB,EAAC,UAAU,CAAC,CAAC;QAC/B,IAAA,wBAAU,EAAC,EAAE,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,KAAK,oCAAoC,EAAE;YACvG,UAAU;YACV,EAAE;SACH,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC,IAAS,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,UAAkB,EAClB,EAAU;QAEV,IAAA,gCAAkB,EAAC,UAAU,CAAC,CAAC;QAC/B,IAAA,wBAAU,EAAC,EAAE,CAAC,CAAC;QACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,6BAA6B,IAAI,CAAC,KAAK,oCAAoC,EAAE;YAChH,UAAU;YACV,EAAE;SACH,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAiB,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAkB,EAAE,EAAU,EAAE,IAA6B;QACrE,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9E,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,eAAe,IAAI,CAAC,KAAK;;;4CAGa,IAAI,CAAC,KAAK,kCAAkC,EAClF,CAAC,UAAU,EAAE,EAAE,EAAE,UAAU,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CACd,UAAkB,EAClB,EAAU,EACV,IAA6B,EAC7B,eAA8B;QAE9B,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAE9E,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,2EAA2E;YAC3E,uEAAuE;YACvE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAClC,eAAe,IAAI,CAAC,KAAK;;;2BAGN,EACnB,CAAC,UAAU,EAAE,EAAE,EAAE,UAAU,CAAC,CAC7B,CAAC;YACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,OAAiB,EAAE,CAAC;YAC9E,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC5C,uBAAuB,IAAI,CAAC,KAAK,oCAAoC,EACrE,CAAC,UAAU,EAAE,EAAE,CAAC,CACjB,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,OAA8B,IAAI,IAAI,EAAE,CAAC;QAC7F,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAClC,UAAU,IAAI,CAAC,KAAK;;;yBAGD,EACnB,CAAC,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,eAAe,CAAC,CAC9C,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,OAAiB,EAAE,CAAC;QAE9E,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAC5C,uBAAuB,IAAI,CAAC,KAAK,oCAAoC,EACrE,CAAC,UAAU,EAAE,EAAE,CAAC,CACjB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,OAA8B,IAAI,IAAI,EAAE,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,EAAU,EAAE,OAAgC;QAC1E,MAAM,UAAU,GAAG,IAAA,2BAAa,EAAC,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CACjB,eAAe,IAAI,CAAC,KAAK;;;8BAGD,IAAI,CAAC,KAAK,0BAA0B,IAAI,CAAC,KAAK,kCAAkC,EACxG,CAAC,UAAU,EAAE,EAAE,EAAE,UAAU,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,EAAU;QACzC,IAAA,gCAAkB,EAAC,UAAU,CAAC,CAAC;QAC/B,IAAA,wBAAU,EAAC,EAAE,CAAC,CAAC;QACf,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,oCAAoC,EAAE;YACtG,UAAU;YACV,EAAE;SACH,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,UAAkB,EAClB,OAAqB;QAErB,IAAA,gCAAkB,EAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,aAAa,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACvC,MAAM,MAAM,GAAc,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,8BAA8B;QAC9B,IAAI,OAAO,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,UAAU,EAAE,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC,wBAAwB,UAAU,mBAAmB,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;YACxF,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAClC,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,oCAAoC;QACpC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAClC;cACQ,IAAI,CAAC,KAAK;eACT,KAAK;;gBAEJ,UAAU,EAAE,EACtB,MAAM,CACP,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAS,CAAC,CAAC;QAE/C,IAAI,UAA8B,CAAC;QACnC,IAAI,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;YAChD,UAAU,GAAG,GAAG,IAAI,CAAC,cAAwB,IAAI,IAAI,CAAC,EAAY,EAAE,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,wBAAwB,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1G,OAAO,QAAQ,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,UAAkB;QACvB,OAAO,IAAA,kCAAoB,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChD,CAAC;CACF;AAvLD,gDAuLC"}