@adonis-agora/payments 0.2.0 → 0.4.0

package/dist/src/client/define_config.js

@@ -0,0 +1,98 @@
+/**
+ * The user behind a request, or `null`.
+ *
+ * A throwing `getUser()` (some guards throw rather than return `null` for an anonymous
+ * request) is a denial, not a `500`.
+ */
+export async function resolveRequestUser(ctx) {
+    const auth = ctx?.auth;
+    if (!auth)
+        return null;
+    try {
+        return (await auth.getUser?.()) ?? auth.user ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The default {@link PaymentsClientConfig.authorize}: there must be a resolved user. */
+export async function defaultAuthorize(ctx) {
+    return (await resolveRequestUser(ctx)) !== null;
+}
+/** The default {@link PaymentsClientConfig.owner}: `{ type: 'User', id: String(user.id) }`. */
+export async function defaultOwner(ctx) {
+    const user = (await resolveRequestUser(ctx));
+    const id = user?.id;
+    if (id === undefined || id === null || id === '')
+        return null;
+    return { type: 'User', id: String(id) };
+}
+/**
+ * The default ownership check: the payment's gateway customer must be the one this owner
+ * holds at that gateway, per `billing_customers`.
+ *
+ * Every branch that cannot PROVE ownership denies. In particular an app that never called
+ * `ensureCustomer({ store, owner })` has an empty registry, and an empty registry means
+ * "unknown", not "allowed" — the failure mode of the opposite choice is that every
+ * authenticated user can read every payment by guessing a reference.
+ */
+export const registryReferenceGuard = async ({ payment, owner, store }) => {
+    if (!payment.customerId) {
+        return {
+            allowed: false,
+            reason: `[payments] Payment ${payment.gatewayId} has no customer recorded, so no owner can be proven for it. Charge through a gateway customer, or supply your own \`authorizeReference\` in config/payments_client.ts.`,
+        };
+    }
+    const mapping = (await store.findCustomerByOwner(owner.type, owner.id, payment.provider));
+    const heldGatewayId = typeof mapping?.gatewayId === 'string' ? mapping.gatewayId : null;
+    if (!heldGatewayId) {
+        return {
+            allowed: false,
+            reason: `[payments] No billing_customers mapping for ${owner.type}:${owner.id} at "${payment.provider}", so ownership of this payment cannot be proven and the request was denied. Record the mapping with \`ensureCustomer(driver, id, input, { store, owner })\`, or supply your own \`authorizeReference\` in config/payments_client.ts.`,
+        };
+    }
+    if (heldGatewayId !== payment.customerId) {
+        return {
+            allowed: false,
+            reason: `[payments] ${owner.type}:${owner.id} holds customer ${heldGatewayId} at "${payment.provider}", but payment ${payment.gatewayId} belongs to ${payment.customerId}.`,
+        };
+    }
+    return { allowed: true };
+};
+/**
+ * Adapt an app-supplied `authorizeReference` into the internal {@link ReferenceGuard}.
+ *
+ * The hook only ever sees `(ctx, reference)` — the payment stays behind this adapter.
+ */
+function adaptAuthorizeReference(hook) {
+    return async ({ ctx, reference }) => {
+        if (await hook(ctx, reference))
+            return { allowed: true };
+        return {
+            allowed: false,
+            reason: `[payments] authorizeReference denied reference "${reference}".`,
+        };
+    };
+}
+/** Apply defaults to a partial config, producing a fully-resolved one. */
+export function resolveConfig(config = {}) {
+    const rawPath = config.path ?? '/payments/client';
+    // Normalize: a single leading slash, no trailing slash (root collapses to '').
+    const trimmed = `/${rawPath.replace(/^\/+/, '').replace(/\/+$/, '')}`;
+    return {
+        // Opt-in, unlike the dashboard: this one is reachable by every logged-in browser.
+        enabled: config.enabled ?? false,
+        path: trimmed === '/' ? '' : trimmed,
+        authorize: config.authorize ?? defaultAuthorize,
+        owner: config.owner ?? defaultOwner,
+        resolveReference: config.resolveReference ?? null,
+        guard: config.authorizeReference
+            ? adaptAuthorizeReference(config.authorizeReference)
+            : registryReferenceGuard,
+    };
+}
+/** Identity helper giving `config/payments_client.ts` full type-checking. */
+export function defineConfig(config = {}) {
+    return config;
+}
+//# sourceMappingURL=define_config.js.map

package/dist/src/client/define_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define_config.js","sourceRoot":"","sources":["../../../src/client/define_config.ts"],"names":[],"mappings":"AA2JA;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAY;IACnD,MAAM,IAAI,GAAI,GAA8C,EAAE,IAAI,CAAC;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAgB;IACrD,OAAO,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;AAClD,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAgB;IACjD,MAAM,IAAI,GAAG,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAA4B,CAAC;IACxE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;IACpB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE;IACxF,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,sBAAsB,OAAO,CAAC,SAAS,yKAAyK;SACzN,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAEhF,CAAC;IACT,MAAM,aAAa,GAAG,OAAO,OAAO,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+CAA+C,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,QAAQ,OAAO,CAAC,QAAQ,uOAAuO;SAC7U,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,cAAc,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,mBAAmB,aAAa,QAAQ,OAAO,CAAC,QAAQ,kBAAkB,OAAO,CAAC,SAAS,eAAe,OAAO,CAAC,UAAU,GAAG;SAC5K,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,IAAkC;IACjE,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;QAClC,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mDAAmD,SAAS,IAAI;SACzE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,MAAM,GAAyB,EAAE;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAClD,+EAA+E;IAC/E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,kFAAkF;QAClF,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;QAChC,IAAI,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;QACpC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,gBAAgB;QAC/C,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY;QACnC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;QACjD,KAAK,EAAE,MAAM,CAAC,kBAAkB;YAC9B,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACpD,CAAC,CAAC,sBAAsB;KAC3B,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,MAAM,GAAyB,EAAE;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/client/handlers.d.ts

@@ -0,0 +1,71 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { BillingStore } from '../billing/billing_store.js';
+import type { ClientPayment, ResolvedPaymentsClientConfig } from './define_config.js';
+/**
+ * The one framework-light handler behind `GET <path>/status`.
+ *
+ * It answers exactly one question — "where does the payment behind this reference stand" —
+ * for a caller that has been proven to own it, and it is built so the unsafe shape of that
+ * answer is not expressible:
+ *
+ * 1. the caller is resolved BEFORE the reference is looked at (`authorize`, then `owner`);
+ * 2. the payment is loaded, but the response is only ever constructed AFTER the ownership
+ *    guard has returned `allowed`, inside this function — there is no branch that reaches
+ *    a body without passing it;
+ * 3. the body is assembled from four NAMED fields. Nothing spreads the row, so a column
+ *    added to `billing_payments` later (a payload, a customer, a gateway id) cannot start
+ *    appearing in a browser because somebody forgot to exclude it.
+ *
+ * Reads one indexed row (`billing_payments_external_reference_idx`, then the unique
+ * `billing_payments.gateway_id` when nothing carries that reference) plus, for the default
+ * guard, one more (`billing_customers_owner_idx`). It never calls a gateway: this endpoint
+ * is polled, and a gateway call per poll is a rate-limit incident waiting for its first
+ * busy afternoon.
+ */
+/** What the handler needs to answer a request. */
+export interface PaymentStatusDeps {
+    store: BillingStore;
+    config: ResolvedPaymentsClientConfig;
+    /**
+     * Called with the developer-facing reason a reference was refused. The browser gets a
+     * bare `403` either way — this is how "you never recorded a customer mapping" reaches a
+     * log instead of dying silently.
+     */
+    onDeny?: (reason: string) => void;
+}
+/** A plain JSON response: an HTTP status and a serializable body. */
+export interface ClientApiResponse {
+    status: number;
+    body: unknown;
+}
+/**
+ * The entire success body. Deliberately four fields.
+ *
+ * Not the payload, not the customer, not the gateway ids: even the rightful owner's browser
+ * has no business holding a raw gateway payload, and a body this small cannot leak a field
+ * somebody adds to the row later without thinking.
+ *
+ * `amount` is integer minor units, as stored. Format at the edge.
+ */
+export interface PaymentStatusBody {
+    status: string;
+    amount: number;
+    currency: string;
+    /** ISO 8601, or `null` while the payment has not settled. */
+    paidAt: string | null;
+}
+/**
+ * Read a store row into {@link ClientPayment} by NAMED column.
+ *
+ * The store is generic over its row type — a Lucid model instance in one implementation, a
+ * plain object in the other — so this reads structurally, exactly as `listPayments` does.
+ * `amount` goes through `Number` because Postgres hands `bigint` back as a string.
+ */
+export declare function normalizePayment(row: unknown): ClientPayment | null;
+/**
+ * `GET <path>/status?reference=<reference>`.
+ *
+ * See the module note above for the order the guards run in and why.
+ */
+export declare function paymentStatus(deps: PaymentStatusDeps, ctx: HttpContext, reference: string | undefined): Promise<ClientApiResponse>;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/src/client/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/client/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,4BAA4B,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAyBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAwBnE;AAmCD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,iBAAiB,CAAC,CA+B5B"}

package/dist/src/client/handlers.js

@@ -0,0 +1,119 @@
+const badRequest = (message) => ({
+    status: 400,
+    body: { error: message },
+});
+/** No caller could be resolved. Terminal for the browser — retrying will not grow a user. */
+const unauthorized = () => ({ status: 401, body: { error: 'unauthorized' } });
+/** A caller was resolved and does not own this reference. Also terminal. */
+const forbidden = () => ({ status: 403, body: { error: 'forbidden' } });
+/**
+ * No payment row for that reference — which is the NORMAL state of a Pix charge that has
+ * not been paid yet: `billing_payments` is written by the webhook, so nothing exists until
+ * the gateway calls. The browser keeps polling on this one.
+ */
+const notFound = () => ({ status: 404, body: { error: 'unknown reference' } });
+/** `Date`, Luxon `DateTime` (Lucid) or nothing → a `Date` or `null`. */
+function toDate(value) {
+    if (value instanceof Date)
+        return value;
+    const asLuxon = value;
+    if (asLuxon && typeof asLuxon.toJSDate === 'function')
+        return asLuxon.toJSDate();
+    return null;
+}
+/**
+ * Read a store row into {@link ClientPayment} by NAMED column.
+ *
+ * The store is generic over its row type — a Lucid model instance in one implementation, a
+ * plain object in the other — so this reads structurally, exactly as `listPayments` does.
+ * `amount` goes through `Number` because Postgres hands `bigint` back as a string.
+ */
+export function normalizePayment(row) {
+    const record = row;
+    if (!record)
+        return null;
+    const gatewayId = record.gatewayId;
+    const provider = record.provider;
+    const status = record.status;
+    const currency = record.currency;
+    if (typeof gatewayId !== 'string' ||
+        typeof provider !== 'string' ||
+        typeof status !== 'string' ||
+        typeof currency !== 'string') {
+        return null;
+    }
+    return {
+        gatewayId,
+        provider,
+        status,
+        amount: Number(record.amount ?? 0),
+        currency,
+        customerId: typeof record.customerId === 'string' ? record.customerId : null,
+        paidAt: toDate(record.paidAt),
+    };
+}
+/**
+ * The payment behind the reference the browser sent.
+ *
+ * Two lookups, in this order, and both indexed:
+ *
+ * 1. `external_reference` — the app's OWN id for the charge. This is the routing key: a
+ *    checkout page polls for `order-1042`, not for `pi_3Qx...`, and the column exists so it
+ *    can. Answers `null` for every row an install wrote before it ran the
+ *    an earlier schema migration, which is exactly why (2) is still here.
+ * 2. `gateway_id` — the old behaviour, kept because several Pix gateways make the two equal
+ *    (Woovi's `correlationID`, Efí's `txid`) and because a not-yet-migrated install has
+ *    nothing else to match on.
+ *
+ * An app-supplied `resolveReference` REPLACES both: it says "my reference is neither of
+ * those, here is the gateway id", and second-guessing that with a fallback would be the
+ * endpoint quietly answering a question the app already said it owns.
+ */
+async function findPayment(store, config, ctx, reference) {
+    if (config.resolveReference) {
+        const gatewayId = await config.resolveReference(ctx, reference);
+        if (typeof gatewayId !== 'string' || gatewayId === '')
+            return null;
+        return normalizePayment(await store.findPaymentByGatewayId(gatewayId));
+    }
+    const byReference = normalizePayment(await store.findPaymentByExternalReference(reference));
+    if (byReference)
+        return byReference;
+    return normalizePayment(await store.findPaymentByGatewayId(reference));
+}
+/**
+ * `GET <path>/status?reference=<reference>`.
+ *
+ * See the module note above for the order the guards run in and why.
+ */
+export async function paymentStatus(deps, ctx, reference) {
+    const { store, config } = deps;
+    if (typeof reference !== 'string' || reference.trim() === '') {
+        return badRequest('reference is required');
+    }
+    const trimmed = reference.trim();
+    // ── 1. The caller, before the reference. ───────────────────────────────────────────
+    if (!(await config.authorize(ctx)))
+        return unauthorized();
+    const owner = await config.owner(ctx);
+    if (!owner)
+        return unauthorized();
+    // ── 2. The payment. ────────────────────────────────────────────────────────────────
+    const payment = await findPayment(store, config, ctx, trimmed);
+    if (!payment)
+        return notFound();
+    // ── 3. Ownership. Nothing below this line is reachable without it. ─────────────────
+    const outcome = await config.guard({ ctx, reference: trimmed, payment, owner, store });
+    if (!outcome.allowed) {
+        deps.onDeny?.(outcome.reason);
+        return forbidden();
+    }
+    const body = {
+        status: payment.status,
+        amount: payment.amount,
+        currency: payment.currency,
+        paidAt: payment.paidAt ? payment.paidAt.toISOString() : null,
+    };
+    return { status: 200, body };
+}
+//# sourceMappingURL=handlers.js.map

package/dist/src/client/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/client/handlers.ts"],"names":[],"mappings":"AA6DA,MAAM,UAAU,GAAG,CAAC,OAAe,EAAqB,EAAE,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC;AACH,6FAA6F;AAC7F,MAAM,YAAY,GAAG,GAAsB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;AACjG,4EAA4E;AAC5E,MAAM,SAAS,GAAG,GAAsB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;AAC3F;;;;GAIG;AACH,MAAM,QAAQ,GAAG,GAAsB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;AAElG,wEAAwE;AACxE,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,KAAqD,CAAC;IACtE,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,MAAM,GAAG,GAAiD,CAAC;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,QAAQ,KAAK,QAAQ,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,SAAS;QACT,QAAQ;QACR,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAClC,QAAQ;QACR,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC5E,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,WAAW,CACxB,KAAmB,EACnB,MAAoC,EACpC,GAAgB,EAChB,SAAiB;IAEjB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,gBAAgB,CAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5F,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,OAAO,gBAAgB,CAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAuB,EACvB,GAAgB,EAChB,SAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE/B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAEjC,sFAAsF;IACtF,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,YAAY,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,EAAE,CAAC;IAElC,sFAAsF;IACtF,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,EAAE,CAAC;IAEhC,sFAAsF;IACtF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAsB;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC7D,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC"}

package/dist/src/client/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The browser-facing half of `@adonis-agora/payments`: one polled, opt-in endpoint that
+ * answers "has this payment settled yet" for a caller proven to own it.
+ *
+ * Mounted by `@adonis-agora/payments/payments_client_provider` from
+ * `config/payments_client.ts`. The React hook that polls it lives in
+ * `@adonis-agora/payments-react`.
+ */
+export type { ClientAuthorizeHook, ClientAuthorizeReferenceHook, ClientOwnerHook, ClientPayment, ClientResolveReferenceHook, PaymentOwner, PaymentsClientConfig, ReferenceDenied, ReferenceGuard, ReferenceGuardRequest, ReferenceOutcome, ResolvedPaymentsClientConfig, } from './define_config.js';
+export { defaultAuthorize, defaultOwner, defineConfig, registryReferenceGuard, resolveConfig, resolveRequestUser, } from './define_config.js';
+export type { ClientApiResponse, PaymentStatusBody, PaymentStatusDeps } from './handlers.js';
+export { normalizePayment, paymentStatus } from './handlers.js';
+export type { PaymentStatus, PaymentStatusesAreExhaustive, TerminalPaymentStatus, } from './statuses.js';
+export { isTerminalPaymentStatus, PAYMENT_STATUSES, PAYMENT_STATUSES_ARE_EXHAUSTIVE, TERMINAL_PAYMENT_STATUSES, } from './statuses.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,mBAAmB,EACnB,4BAA4B,EAC5B,eAAe,EACf,aAAa,EACb,0BAA0B,EAC1B,YAAY,EACZ,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAChE,YAAY,EACV,aAAa,EACb,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,yBAAyB,GAC1B,MAAM,eAAe,CAAC"}

package/dist/src/client/index.js

@@ -0,0 +1,12 @@
+/**
+ * The browser-facing half of `@adonis-agora/payments`: one polled, opt-in endpoint that
+ * answers "has this payment settled yet" for a caller proven to own it.
+ *
+ * Mounted by `@adonis-agora/payments/payments_client_provider` from
+ * `config/payments_client.ts`. The React hook that polls it lives in
+ * `@adonis-agora/payments-react`.
+ */
+export { defaultAuthorize, defaultOwner, defineConfig, registryReferenceGuard, resolveConfig, resolveRequestUser, } from './define_config.js';
+export { normalizePayment, paymentStatus } from './handlers.js';
+export { isTerminalPaymentStatus, PAYMENT_STATUSES, PAYMENT_STATUSES_ARE_EXHAUSTIVE, TERMINAL_PAYMENT_STATUSES, } from './statuses.js';
+//# sourceMappingURL=index.js.map

package/dist/src/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAMhE,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,+BAA+B,EAC/B,yBAAyB,GAC1B,MAAM,eAAe,CAAC"}

package/dist/src/client/statuses.d.ts

@@ -0,0 +1,38 @@
+import type { BillingStatus } from '../types.js';
+/**
+ * The payment statuses the client endpoint can report, in the order a payment moves
+ * through them.
+ *
+ * This is the canonical {@link BillingStatus} union restated as a VALUE, because the
+ * browser half of this feature (`@adonis-agora/payments-react`) needs the same set at
+ * runtime and cannot import a server package to get it. `test/client/status_parity.spec.ts`
+ * asserts the two lists are still the same list.
+ */
+export declare const PAYMENT_STATUSES: readonly ["pending", "authorized", "paid", "failed", "refunded", "canceled", "disputed"];
+export type PaymentStatus = (typeof PAYMENT_STATUSES)[number];
+/**
+ * `true` only while {@link PAYMENT_STATUSES} lists every member of {@link BillingStatus}.
+ *
+ * `as const satisfies readonly BillingStatus[]` above proves each listed status is real; it
+ * cannot prove none is MISSING. A status added to `BillingStatus` and forgotten here would
+ * reach a consumer's exhaustive `switch` as a string outside the union — so the omission is
+ * made a compile error instead.
+ */
+export type PaymentStatusesAreExhaustive = [Exclude<BillingStatus, PaymentStatus>] extends [never] ? true : never;
+/** Exported so the assertion above is a real reference rather than dead code. */
+export declare const PAYMENT_STATUSES_ARE_EXHAUSTIVE: PaymentStatusesAreExhaustive;
+/**
+ * The statuses a payment does not move out of — where the browser stops asking.
+ *
+ * `pending` and `authorized` are deliberately absent: a Pix that has not been paid is
+ * `pending`, and authorized card money is held, not captured. Both can still change.
+ */
+export declare const TERMINAL_PAYMENT_STATUSES: readonly ["paid", "failed", "refunded", "canceled", "disputed"];
+export type TerminalPaymentStatus = (typeof TERMINAL_PAYMENT_STATUSES)[number];
+/**
+ * Whether a status is terminal. Takes a plain `string` on purpose: the store's `status`
+ * column is a free string (a gateway may write its own), so an unrecognized value must
+ * answer "not terminal" rather than fail a narrowing.
+ */
+export declare function isTerminalPaymentStatus(status: string): status is TerminalPaymentStatus;
+//# sourceMappingURL=statuses.d.ts.map

package/dist/src/client/statuses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuses.d.ts","sourceRoot":"","sources":["../../../src/client/statuses.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,0FAQgB,CAAC;AAE9C,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAC9F,IAAI,GACJ,KAAK,CAAC;AAEV,iFAAiF;AACjF,eAAO,MAAM,+BAA+B,EAAE,4BAAmC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,iEAMO,CAAC;AAE9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/E;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,qBAAqB,CAEvF"}

package/dist/src/client/statuses.js

@@ -0,0 +1,42 @@
+/**
+ * The payment statuses the client endpoint can report, in the order a payment moves
+ * through them.
+ *
+ * This is the canonical {@link BillingStatus} union restated as a VALUE, because the
+ * browser half of this feature (`@adonis-agora/payments-react`) needs the same set at
+ * runtime and cannot import a server package to get it. `test/client/status_parity.spec.ts`
+ * asserts the two lists are still the same list.
+ */
+export const PAYMENT_STATUSES = [
+    'pending',
+    'authorized',
+    'paid',
+    'failed',
+    'refunded',
+    'canceled',
+    'disputed',
+];
+/** Exported so the assertion above is a real reference rather than dead code. */
+export const PAYMENT_STATUSES_ARE_EXHAUSTIVE = true;
+/**
+ * The statuses a payment does not move out of — where the browser stops asking.
+ *
+ * `pending` and `authorized` are deliberately absent: a Pix that has not been paid is
+ * `pending`, and authorized card money is held, not captured. Both can still change.
+ */
+export const TERMINAL_PAYMENT_STATUSES = [
+    'paid',
+    'failed',
+    'refunded',
+    'canceled',
+    'disputed',
+];
+/**
+ * Whether a status is terminal. Takes a plain `string` on purpose: the store's `status`
+ * column is a free string (a gateway may write its own), so an unrecognized value must
+ * answer "not terminal" rather than fail a narrowing.
+ */
+export function isTerminalPaymentStatus(status) {
+    return TERMINAL_PAYMENT_STATUSES.includes(status);
+}
+//# sourceMappingURL=statuses.js.map

package/dist/src/client/statuses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statuses.js","sourceRoot":"","sources":["../../../src/client/statuses.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,SAAS;IACT,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,UAAU;IACV,UAAU;IACV,UAAU;CACiC,CAAC;AAgB9C,iFAAiF;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAiC,IAAI,CAAC;AAElF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,MAAM;IACN,QAAQ;IACR,UAAU;IACV,UAAU;IACV,UAAU;CACiC,CAAC;AAI9C;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAQ,yBAA+C,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC"}

package/dist/src/dashboard/actions.d.ts

@@ -0,0 +1,143 @@
+import type { BillingStore } from '../billing/billing_store.js';
+/**
+ * The dashboard's two WRITE actions, as framework-light ports.
+ *
+ * Everything else this console does is a store read. These two are not: a refund moves money at
+ * the gateway, and a retry re-runs an app's webhook handlers. Both need things the handlers
+ * deliberately do not know about (a `PaymentsDriver`, a `WebhookProcessor`), so they cross the
+ * boundary as narrow function types the provider supplies and a test can fake — the same shape
+ * `@adonis-agora/durable`'s dashboard uses for its engine port.
+ *
+ * Every failure mode is a VALUE here, never a thrown error: an operator who clicks "Refund" and
+ * gets nothing back has no way to tell "the gateway said no" from "the button is broken", so each
+ * outcome carries the message that names which one happened.
+ */
+/** The slice of `PaymentsDriver` a refund needs. Structural on purpose: the real driver satisfies
+ *  it, and a test can hand over eight lines instead of a gateway. */
+export interface RefundCapableDriver {
+    readonly provider: string;
+    readonly capabilities?: {
+        refunds?: boolean;
+    };
+    refund(paymentGatewayId: string, amount?: number, options?: {
+        idempotencyKey?: string;
+    }): Promise<{
+        gatewayId: string;
+        provider: string;
+        amount: {
+            amount: number;
+            currency: string;
+        };
+        status: string;
+        createdAt: string;
+    }>;
+}
+/** What the operator gets back from the refund button. */
+export type RefundOutcome = {
+    kind: 'ok';
+    /** Integer minor units, as the gateway reported them back. */
+    refund: {
+        gatewayId: string;
+        amount: number;
+        currency: string;
+        status: string;
+    };
+}
+/** The provider that took this payment is not in `config/payments.ts` any more, or the app has
+ *  no manager at all. Nothing was attempted. */
+ | {
+    kind: 'unavailable';
+    message: string;
+}
+/** The gateway has no refund API (Woovi/OpenPix). Nothing was attempted. */
+ | {
+    kind: 'unsupported';
+    message: string;
+}
+/** The gateway refused. `message` is ITS message, verbatim — a silent failure here is worse
+ *  than no button. */
+ | {
+    kind: 'gateway-error';
+    message: string;
+};
+export type RefundAction = (input: {
+    provider: string;
+    gatewayId: string;
+    /** Integer minor units. Omitted = refund the whole payment. */
+    amount?: number;
+}) => Promise<RefundOutcome>;
+/**
+ * Build the refund action over a driver resolver (the app's `PaymentsManager.driver`).
+ *
+ * The capability check happens BEFORE the call, matching `PaymentsManager.assertCapability`: a
+ * driver that declares `refunds: false` implements `refund()` only to throw, and discovering that
+ * from a gateway round-trip reads to the operator like a network failure.
+ */
+export declare function createRefundAction(resolveDriver: (provider: string) => RefundCapableDriver | Promise<RefundCapableDriver>): RefundAction;
+/** The normalized webhook event the replay rebuilds and re-runs. Structurally `WebhookEvent`. */
+export interface ReplayableWebhookEvent {
+    id: string;
+    provider: string;
+    type: string;
+    data: unknown;
+    raw: Record<string, unknown>;
+}
+/** What the operator gets back from the retry button. */
+export type ReplayOutcome = 
+/** The handlers ran to completion; the ledger row is `processed`. */
+{
+    kind: 'processed';
+}
+/** Something else claimed the row between the read and the write — it is no longer `failed`. */
+ | {
+    kind: 'conflict';
+}
+/**
+ * The ledger row carries no normalized event, so there is nothing to replay. That means the
+ * row was written before this install ran the `the schema this package now creates itself` migration —
+ * the raw payload alone is not replayable, because turning it back into an event would mean
+ * calling `parseWebhook`, which re-verifies a signature computed from headers the ledger
+ * never kept. The row is put back exactly as it was, original error and all.
+ */
+ | {
+    kind: 'undeliverable';
+    message: string;
+}
+/** The handlers threw again. The ledger row carries the NEW error (the processor wrote it). */
+ | {
+    kind: 'failed';
+    message: string;
+};
+export type ReplayAction = (input: {
+    gatewayEventId: string;
+    provider: string;
+    type: string;
+    /** The error the row carried before we touched it, so a driver refusal can restore it verbatim. */
+    previousError: string | null;
+}) => Promise<ReplayOutcome>;
+/**
+ * Build the retry action over the store plus the app's webhook processor.
+ *
+ * The ledger dance is the fiddly part and it lives here, once:
+ *
+ * 1. `recordWebhookEvent` re-claims a `failed` row and hands the ORIGINAL delivery back — both
+ *    the raw payload and the NORMALIZED event recorded beside it. That is the only way to read
+ *    a stored delivery through the `BillingStore` contract.
+ * 2. The event is rebuilt from those two columns. It is NEVER re-parsed: `parseWebhook`
+ *    re-verifies a signature computed over headers the ledger does not keep, so rebuilding that
+ *    way answered `422` on Stripe, Adyen and every other gateway that signs — a retry that
+ *    worked for a minority of gateways, and only for the ones an attacker would not need to
+ *    forge. A row with no `normalized` (written before the migration) is `undeliverable`,
+ *    stated plainly, rather than half-replayed.
+ * 3. The row is put BACK to `failed` before `process` runs, because `WebhookProcessor.process`
+ *    claims through `recordWebhookEvent` itself, and a row sitting at `received` reads to it as
+ *    "in flight" — it would return `false` and run nothing at all. This is the one place that
+ *    subtlety is written down.
+ * 4. `process` claims it properly and marks it `processed` or `failed` with the real reason.
+ */
+export declare function createReplayAction(deps: {
+    store: BillingStore;
+    /** Run it through the app's `WebhookProcessor` (built-in sync + the app's own handlers). */
+    process: (event: ReplayableWebhookEvent) => Promise<unknown>;
+}): ReplayAction;
+//# sourceMappingURL=actions.d.ts.map

package/dist/src/dashboard/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/dashboard/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE;;;;;;;;;;;;GAYG;AAEH;qEACqE;AACrE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9C,MAAM,CACJ,gBAAgB,EAAE,MAAM,EACxB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;CACJ;AAED,0DAA0D;AAC1D,MAAM,MAAM,aAAa,GACrB;IACE,IAAI,EAAE,IAAI,CAAC;IACX,8DAA8D;IAC9D,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AACH;gDACgD;GAC9C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC1C,4EAA4E;GAC1E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC1C;sBACsB;GACpB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,GACtF,YAAY,CA+Bd;AAED,iGAAiG;AACjG,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,yDAAyD;AACzD,MAAM,MAAM,aAAa;AACvB,qEAAqE;AACnE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE;AACvB,gGAAgG;GAC9F;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE;AACtB;;;;;;GAMG;GACD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC5C,+FAA+F;GAC7F;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,EAAE,YAAY,CAAC;IACpB,4FAA4F;IAC5F,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9D,GAAG,YAAY,CAgDf"}