@antasphere/chassis-server 1.0.2 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/api/apikeys.d.ts +4 -1
- package/dist/api/apikeys.d.ts.map +1 -1
- package/dist/api/apikeys.js +11 -1
- package/dist/api/apikeys.js.map +1 -1
- package/dist/api/cli-package.d.ts +58 -0
- package/dist/api/cli-package.d.ts.map +1 -0
- package/dist/api/cli-package.js +83 -0
- package/dist/api/cli-package.js.map +1 -0
- package/dist/api/create-api.d.ts +3 -0
- package/dist/api/create-api.d.ts.map +1 -1
- package/dist/api/create-api.js +33 -4
- package/dist/api/create-api.js.map +1 -1
- package/dist/api/index.d.ts +1 -0
- package/dist/api/index.d.ts.map +1 -1
- package/dist/api/index.js +1 -0
- package/dist/api/index.js.map +1 -1
- package/dist/api/invitations.d.ts.map +1 -1
- package/dist/api/invitations.js +6 -0
- package/dist/api/invitations.js.map +1 -1
- package/dist/api/members.d.ts +5 -2
- package/dist/api/members.d.ts.map +1 -1
- package/dist/api/members.js +1 -0
- package/dist/api/members.js.map +1 -1
- package/dist/api/projects.d.ts +3 -0
- package/dist/api/projects.d.ts.map +1 -1
- package/dist/api/projects.js +13 -1
- package/dist/api/projects.js.map +1 -1
- package/dist/api/webhooks.d.ts +24 -0
- package/dist/api/webhooks.d.ts.map +1 -0
- package/dist/api/webhooks.js +170 -0
- package/dist/api/webhooks.js.map +1 -0
- package/dist/boot.d.ts.map +1 -1
- package/dist/boot.js +47 -4
- package/dist/boot.js.map +1 -1
- package/dist/cli-package/index.d.ts +44 -0
- package/dist/cli-package/index.d.ts.map +1 -0
- package/dist/cli-package/index.js +60 -0
- package/dist/cli-package/index.js.map +1 -0
- package/dist/email/index.d.ts +1 -0
- package/dist/email/index.d.ts.map +1 -1
- package/dist/email/index.js +1 -0
- package/dist/email/index.js.map +1 -1
- package/dist/env.d.ts +11 -0
- package/dist/env.d.ts.map +1 -1
- package/dist/env.js +24 -0
- package/dist/env.js.map +1 -1
- package/dist/identity/demo-pass-rules.d.ts.map +1 -1
- package/dist/identity/demo-pass-rules.js +6 -1
- package/dist/identity/demo-pass-rules.js.map +1 -1
- package/dist/identity/hub-reconcile.d.ts +2 -2
- package/dist/identity/hub-reconcile.d.ts.map +1 -1
- package/dist/identity/hub-reconcile.js.map +1 -1
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/jobs/index.d.ts +1 -1
- package/dist/jobs/index.d.ts.map +1 -1
- package/dist/jobs/index.js.map +1 -1
- package/dist/jobs/pgboss.d.ts +34 -0
- package/dist/jobs/pgboss.d.ts.map +1 -1
- package/dist/jobs/pgboss.js +32 -9
- package/dist/jobs/pgboss.js.map +1 -1
- package/dist/mcp/index.d.ts +1 -0
- package/dist/mcp/index.d.ts.map +1 -1
- package/dist/mcp/index.js +1 -0
- package/dist/mcp/index.js.map +1 -1
- package/dist/mcp/server.d.ts +1 -1
- package/dist/mcp/server.d.ts.map +1 -1
- package/dist/mcp/server.js +11 -2
- package/dist/mcp/server.js.map +1 -1
- package/dist/mcp/tool-kit.d.ts +2 -0
- package/dist/mcp/tool-kit.d.ts.map +1 -1
- package/dist/mcp/tool-kit.js +5 -1
- package/dist/mcp/tool-kit.js.map +1 -1
- package/dist/mcp/webhooks.d.ts +16 -0
- package/dist/mcp/webhooks.d.ts.map +1 -0
- package/dist/mcp/webhooks.js +226 -0
- package/dist/mcp/webhooks.js.map +1 -0
- package/dist/members/removal.d.ts +10 -2
- package/dist/members/removal.d.ts.map +1 -1
- package/dist/members/removal.js +3 -0
- package/dist/members/removal.js.map +1 -1
- package/dist/middleware/idempotency.d.ts.map +1 -1
- package/dist/middleware/idempotency.js +3 -1
- package/dist/middleware/idempotency.js.map +1 -1
- package/dist/middleware/scopes.d.ts +9 -1
- package/dist/middleware/scopes.d.ts.map +1 -1
- package/dist/middleware/scopes.js +8 -1
- package/dist/middleware/scopes.js.map +1 -1
- package/dist/secret-box.d.ts +10 -0
- package/dist/secret-box.d.ts.map +1 -0
- package/dist/secret-box.js +87 -0
- package/dist/secret-box.js.map +1 -0
- package/dist/testing/helpers.d.ts +8 -0
- package/dist/testing/helpers.d.ts.map +1 -1
- package/dist/testing/helpers.js.map +1 -1
- package/dist/tool-definition.d.ts +24 -0
- package/dist/tool-definition.d.ts.map +1 -1
- package/dist/tool-definition.js.map +1 -1
- package/dist/webhooks/catalog.d.ts +80 -0
- package/dist/webhooks/catalog.d.ts.map +1 -0
- package/dist/webhooks/catalog.js +134 -0
- package/dist/webhooks/catalog.js.map +1 -0
- package/dist/webhooks/index.d.ts +9 -0
- package/dist/webhooks/index.d.ts.map +1 -0
- package/dist/webhooks/index.js +9 -0
- package/dist/webhooks/index.js.map +1 -0
- package/dist/webhooks/jobs.d.ts +12 -0
- package/dist/webhooks/jobs.d.ts.map +1 -0
- package/dist/webhooks/jobs.js +77 -0
- package/dist/webhooks/jobs.js.map +1 -0
- package/dist/webhooks/mail.d.ts +24 -0
- package/dist/webhooks/mail.d.ts.map +1 -0
- package/dist/webhooks/mail.js +21 -0
- package/dist/webhooks/mail.js.map +1 -0
- package/dist/webhooks/match.d.ts +22 -0
- package/dist/webhooks/match.d.ts.map +1 -0
- package/dist/webhooks/match.js +40 -0
- package/dist/webhooks/match.js.map +1 -0
- package/dist/webhooks/safe-fetch.d.ts +94 -0
- package/dist/webhooks/safe-fetch.d.ts.map +1 -0
- package/dist/webhooks/safe-fetch.js +263 -0
- package/dist/webhooks/safe-fetch.js.map +1 -0
- package/dist/webhooks/service.d.ts +245 -0
- package/dist/webhooks/service.d.ts.map +1 -0
- package/dist/webhooks/service.js +861 -0
- package/dist/webhooks/service.js.map +1 -0
- package/dist/webhooks/signing.d.ts +40 -0
- package/dist/webhooks/signing.d.ts.map +1 -0
- package/dist/webhooks/signing.js +108 -0
- package/dist/webhooks/signing.js.map +1 -0
- package/dist/webhooks/tx-send.d.ts +31 -0
- package/dist/webhooks/tx-send.d.ts.map +1 -0
- package/dist/webhooks/tx-send.js +22 -0
- package/dist/webhooks/tx-send.js.map +1 -0
- package/package.json +11 -3
- package/src/api/apikeys.ts +12 -1
- package/src/api/cli-package.ts +151 -0
- package/src/api/create-api.ts +42 -4
- package/src/api/index.ts +1 -0
- package/src/api/invitations.ts +6 -0
- package/src/api/members.ts +6 -2
- package/src/api/projects.ts +16 -1
- package/src/api/webhooks.ts +205 -0
- package/src/boot.ts +48 -4
- package/src/cli-package/index.ts +88 -0
- package/src/email/index.ts +1 -0
- package/src/env.ts +25 -0
- package/src/identity/demo-pass-rules.ts +6 -1
- package/src/identity/hub-reconcile.ts +2 -2
- package/src/index.ts +13 -1
- package/src/jobs/index.ts +1 -0
- package/src/jobs/pgboss.ts +71 -9
- package/src/mcp/index.ts +1 -0
- package/src/mcp/server.ts +10 -2
- package/src/mcp/tool-kit.ts +7 -1
- package/src/mcp/webhooks.ts +370 -0
- package/src/members/removal.ts +21 -1
- package/src/middleware/idempotency.ts +3 -1
- package/src/middleware/scopes.ts +14 -0
- package/src/secret-box.ts +93 -0
- package/src/testing/helpers.ts +8 -0
- package/src/tool-definition.ts +29 -0
- package/src/webhooks/catalog.ts +205 -0
- package/src/webhooks/index.ts +58 -0
- package/src/webhooks/jobs.ts +92 -0
- package/src/webhooks/mail.ts +48 -0
- package/src/webhooks/match.ts +52 -0
- package/src/webhooks/safe-fetch.ts +335 -0
- package/src/webhooks/service.ts +1089 -0
- package/src/webhooks/signing.ts +132 -0
- package/src/webhooks/tx-send.ts +53 -0
- package/test/host/drizzle/0002_webhooks.sql +49 -0
- package/test/host/drizzle/meta/0002_snapshot.json +3952 -0
- package/test/host/drizzle/meta/_journal.json +8 -1
- package/test/host/identity.ts +6 -1
- package/test/host/minimal-host.ts +2 -1
- package/test/host/minimal-tool.ts +32 -4
- package/test/integration/cli-package.test.ts +403 -0
- package/test/integration/mcp-webhooks.test.ts +360 -0
- package/test/integration/webhooks.test.ts +1684 -0
- package/test/unit/cli-package.test.ts +93 -0
- package/test/unit/secret-box.test.ts +124 -0
- package/test/unit/tx-send.test.ts +23 -0
- package/test/unit/webhook-catalog.test.ts +151 -0
- package/test/unit/webhook-env.test.ts +60 -0
- package/test/unit/webhook-jobs.test.ts +92 -0
- package/test/unit/webhook-match.test.ts +81 -0
- package/test/unit/webhook-safe-fetch.test.ts +330 -0
- package/test/unit/webhook-signing.test.ts +169 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/webhooks/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,IAAI,IAAI,SAAS,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EAKX,MAAM,wBAAwB,CAAC;AAYhC,OAAO,EAAE,eAAe,EAAkB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,kBAAkB,EAAsD,MAAM,cAAc,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,sBAAsB,EAGvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAC7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AACnD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAqBlE,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,UAAU,EAAE,EAAE;IACd,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,IAAI;IACtB,oBAAoB,EAAE,EAAE;IACxB,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;IACpC,aAAa,EAAE,MAAM;IACrB,uBAAuB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IACzC,SAAS,EAAE,MAAM;CAClB,CAAC;AA6DF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,IAAuE,EAChF,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAmE;QAIhF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,UAAkB;QACrC,KAAK,CAAC,UAAU,CAAC,CAAC;QADC,eAAU,GAAV,UAAU,CAAQ;QAErC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IADX,YACW,UAAkB,EAC3B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,eAAU,GAAV,UAAU,CAAQ;QAI3B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAID,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,OAAO,cAAc;IAcI;IAbpB,KAAK,CAAe;IACpB,WAAW,CAAoB;IACvB,GAAG,CAAY;IACf,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,UAAU,CAAkB;IAC5B,IAAI,CAAkB;IACtB,QAAQ,CAAkB;IAC1B,GAAG,CAAa;IACjC,sFAAsF;IAC9E,IAAI,GAAkB,IAAI,CAAC;IACnC,gFAAgF;IAC/D,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtD,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,qBAAqB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,OAAO,CAAC;YAC5B,IAAI,EAAE,iCAAiC;YACvC,IAAI,EAAE,yHAAyH;YAC/H,UAAU,EAAE,CAAC,SAAS,CAAU;YAChC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC;YACtB,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,iFAAiF;YACvF,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,OAAO,CAAC;YAC1B,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,uDAAuD;YAC7D,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,KAAkB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,gCAAgC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAC7D,sEAAsE,CACvE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAwC,EAAE,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAClC,yDAAyD,CAC1D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,eAAe,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;YACnE,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAClC,0EAA0E,CAC3E,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,GAAG,GAAoB;YAC3B,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAA+B;SAC7C,CAAC;QACF,0EAA0E;QAC1E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE;YACjE,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,oBAAoB,iBAAiB,CAAC,CAAC;QACjG,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,IAAY;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,QAAQ,GACZ,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa;YACnE,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,WAAmB;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC;aAC3C,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,uFAAuF;IACvF,mBAAmB,CAAC,WAAmB;QACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAgB;QACtB,MAAM,IAAI,GAAG,KAAK,EAAE,KAAkB,EAAiB,EAAE;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAC3D,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CACrE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CACtD,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAChE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAC9D,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CACxE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CACxD,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAClE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CACxD,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,iGAAiG;IACjG,KAAK,CAAC,MAAM,CAAC,GAAoB;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACjC,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CACpG,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1C,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;qBACnB,MAAM,CAAC,iBAAiB,CAAC;qBACzB,MAAM,CAAC;oBACN,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,GAAG,CAAC,EAAE;oBACf,SAAS,EAAE,GAAG,CAAC,IAAI;oBACnB,OAAO;oBACP,MAAM,EAAE,SAAS;iBAClB,CAAC;qBACD,SAAS,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,GAAI,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,uFAAuF;IAC/E,UAAU,CAAC,GAAoB;QACrC,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,GAAG,CAAC;YAC5D,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,QAAQ;YACR,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,UAAkB,EAAE,iBAAiB,GAAG,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,CAAC,WAAW,EAAE,EAClB,IAAI,EACJ,wBAAwB,EACxB,EAAE,UAAU,EAA+B,EAC3C;YACE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YACjC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;YACxC,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CACF,CAAC;QACF,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,wBAAwB,iBAAiB,CAAC,CAAC;IACvG,CAAC;IAED,6EAA6E;IAE7E;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,IAA4B;QAC5D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAClC,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;aAC3C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,uCAAuC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,QAAQ,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAClC,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC3B,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,mBAAmB;gBAC9B,cAAc,EAAE,IAAI;gBACpB,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,iBAAiB;QACjB,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,IACE,QAAQ,CAAC,cAAc;gBACvB,QAAQ,CAAC,uBAAuB;gBAChC,QAAQ,CAAC,uBAAuB,GAAG,GAAG,EACtC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,GAAG;gBACR,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC;gBACpF,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;aACzE,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAC5D,yGAAyG,CAC1G,CAAC;YACF,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;iBACf,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBAC7F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC3B,MAAM,EAAE,QAAQ;gBAChB,OAAO;gBACP,SAAS,EAAE,mBAAmB;gBAC9B,cAAc,EAAE,IAAI;gBACpB,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B,EAAE,CAAC;YAC1F,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACxE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;gBAC/B,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY;aAC1B,CAAC,CAAC;YACH,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,KAAK,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK;gBACH,CAAC,YAAY,sBAAsB;oBACjC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE;oBACzB,CAAC,CAAE,CAAW,CAAC,IAAI,KAAK,cAAc,IAAK,CAAW,CAAC,IAAI,KAAK,YAAY;wBAC1E,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,MAAM,CAAE,CAAW,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACrE,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,IAAI,IAAI,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;;gBAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;iBACf,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC;gBACH,mBAAmB,EAAE,CAAC;gBACtB,cAAc,EAAE,IAAI;gBACpB,cAAc,EAAE,GAAG;gBACnB,kBAAkB,EAAE,WAAW;gBAC/B,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC3B,MAAM,EAAE,WAAW;gBACnB,OAAO;gBACP,cAAc,EAAE,UAAU;gBAC1B,SAAS,EAAE,IAAI;gBACf,GAAG;gBACH,WAAW,EAAE,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,oEAAoE;QACpE,yEAAyE;QACzE,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACjC,MAAM,CAAC,gBAAgB,CAAC;aACxB,GAAG,CAAC;YACH,mBAAmB,EAAE,GAAG,CAAA,GAAG,gBAAgB,CAAC,mBAAmB,MAAM;YACrE,cAAc,EAAE,GAAG,CAAA,YAAY,gBAAgB,CAAC,cAAc,KAAK,GAAG,GAAG;YACzE,cAAc,EAAE,GAAG;YACnB,kBAAkB,EAAE,QAAQ;YAC5B,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC3C,SAAS,CAAC;YACT,MAAM,EAAE,gBAAgB,CAAC,mBAAmB;YAC5C,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD,CAAC,CAAC;QACL,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,GAAG,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,GAAG,CAAC;QACtD,IAAI,OAAO,GACT,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,oBAAoB;YACzC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QACxE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBAC7F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;iBACpF,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB;gBACE,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,MAAM;gBACN,KAAK,EAAE,cAAc,CAAC,WAAW,EAAE;aACpC,EACD,kGAAkG,CACnG,CAAC;YACF,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACtE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,wCAAwC,CAAC,CACnG,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GACjB,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;YAChD,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YACpF,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACtC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YAC7C,OAAO;YACP,cAAc,EAAE,UAAU;YAC1B,SAAS,EAAE,KAAK;YAChB,aAAa;YACb,GAAG;SACJ,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,QAA4B,EAC5B,KAQC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC5C,SAAS,EAAE,CAAC;QACf,OAAO,GAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAiB;QACjD,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,UAAkB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC;gBACH,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAC3E,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;iBACzF,SAAS,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACtE,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,6EAA6E;QAC7E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAC1F,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAA4B,EAAE,MAAc,EAAE,KAAW;QAClF,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO;QAC7D,mEAAmE;QACnE,iEAAiE;QACjE,2BAA2B;QAC3B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACjC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;aACxD,IAAI,CAAC,SAAS,CAAC;aACf,SAAS,CACR,gBAAgB,EAChB,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,EACzC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,EACtD,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;aACA,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;aAC3C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACnC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;aACjC,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,yBAAyB,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,aAAa,EAAE,OAAO,CAAC,IAAI;YAC3B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,gBAAgB;YAClD,mBAAmB,EAAE,MAAM;YAC3B,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,sBAAsB,QAAQ,CAAC,EAAE,EAAE;SACzE,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,KAAK,CAAC,aAAqB;QAC/B,IAAI,aAAa,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;6DAIa,aAAa;;kBAExD,KAAK;;OAEhB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI,OAAO,CAAC;YACjB,IAAI,OAAO,GAAG,KAAK;gBAAE,MAAM;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IAE7E,qFAAqF;IACrF,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC;YACH,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,sBAAsB;gBAAE,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACjG,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CACf,MAAqC,EACrC,OAA6C;QAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,OAAO,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,GAAG;gBAAE,SAAS;YAC9B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,mBAAmB,CAC3B,eAAe,EACf,IAAI,OAAO,4CAA4C,CACxD,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,OAAO,yCAAyC,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,GAAG,qCAAqC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,SAAiB,EACjB,KAA4B;QAE5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,CAAC;YACN,WAAW;YACX,SAAS;YACT,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;YACpC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;YAC9B,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;SAC9B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,GAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,WAAmB,EACnB,MAA0B,EAC1B,KAAa;QAEb,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5B,MAAM,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;aAC3F,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,CAAC;oBAChB,EAAE,EAAE,gBAAgB,CAAC,EAAE;oBACvB,SAAS,EAAE,gBAAgB,CAAC,SAAS;oBACrC,MAAM,EAAE,KAAK;iBACd,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;aACpE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChD,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;SACrG,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC;aACzC,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,EAAU,EACV,KAA4B;QAE5B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,gBAAgB,CAAC;aACxB,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,wEAAwE;YACxE,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;gBAC1F,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;aACtF,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,gBAAgB,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;aACtF,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,EAAU;QAEV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,uBAAuB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,gBAAgB,CAAC;aACxB,GAAG,CAAC;YACH,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7B,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,uBAAuB;YACvB,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAClC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,GAAI,CAAC;YAC9B,MAAM;YACN,uBAAuB,EAAE,uBAAuB,CAAC,WAAW,EAAE;SAC/D,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,EAAU,EAAE,MAAqB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAoB;YAC3B,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW;YACX,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE;SACjC,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,UAAU,EAAE,EAAE;YACd,WAAW;YACX,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,SAAS,EAAE,GAAG,CAAC,IAAI;YACnB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAC7B,MAAM,EAAE,SAAS;SAClB,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,EAAU,EACV,KAAwG;QAExG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5B,MAAM,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;aAC7F,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC,EACpC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EACrE,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,CAAC;oBAChB,EAAE,EAAE,iBAAiB,CAAC,EAAE;oBACxB,SAAS,EAAE,iBAAiB,CAAC,SAAS;oBACtC,MAAM,EAAE,KAAK;iBACd,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;aACtE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAClD,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;SACrG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,EAAU,EAAE,UAAkB;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,sHAAsH;IACtH,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,EAAU,EAAE,UAAkB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;iBACxB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,MAAM,CAAC;gBACN,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,SAAS;aAClB,CAAC;iBACD,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,QAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,OAAO,QAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;aACtF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,WAAmB,EACnB,EAAU,EACV,UAAkB;QAElB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,EACpC,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC,EACpC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CAC/C,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF;AAED,0FAA0F;AAC1F,SAAS,gBAAgB,CAAC,OAA6C;IACrE,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;QACjD,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,IAAI;QACzD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,EAAE,WAAW,EAAE,IAAI,IAAI;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,IAAI;QACvD,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QACnD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Standard Webhooks signing (https://www.standardwebhooks.com/, the symmetric
|
|
3
|
+
* `v1` scheme): the signed content is `${id}.${timestamp}.${body}`, HMAC-SHA256
|
|
4
|
+
* keyed with the secret's raw bytes (the standard base64 after the `whsec_`
|
|
5
|
+
* prefix), the timestamp in unix SECONDS. A delivery carries three headers:
|
|
6
|
+
* `webhook-id`, `webhook-timestamp`, and `webhook-signature`, a space-separated
|
|
7
|
+
* list of `v1,<standard base64>` entries (one per live secret, so a receiver
|
|
8
|
+
* holding either the old or the new secret verifies during a rotation).
|
|
9
|
+
*
|
|
10
|
+
* The body is signed exactly as it is sent: the caller serialises once and
|
|
11
|
+
* passes the same string here and to the request.
|
|
12
|
+
*/
|
|
13
|
+
export declare const WEBHOOK_SECRET_PREFIX = "whsec_";
|
|
14
|
+
export declare class SigningError extends Error {
|
|
15
|
+
readonly code: 'malformed_secret' | 'no_secret';
|
|
16
|
+
constructor(code: 'malformed_secret' | 'no_secret', message: string);
|
|
17
|
+
}
|
|
18
|
+
/** A new secret: the prefix + 24 random bytes, standard base64. */
|
|
19
|
+
export declare function generateWebhookSecret(): string;
|
|
20
|
+
/** The raw key bytes of a secret; throws SigningError('malformed_secret') when the prefix or the base64 is wrong. */
|
|
21
|
+
export declare function webhookSecretKey(secret: string): Buffer;
|
|
22
|
+
/** The `webhook-signature` header value: one `v1,<b64>` entry per secret, space-separated (two during a rotation overlap). */
|
|
23
|
+
export declare function signWebhook(secrets: readonly string[], id: string, timestampSeconds: number, body: string): string;
|
|
24
|
+
/** The three Standard Webhooks headers plus content-type: { 'webhook-id', 'webhook-timestamp', 'webhook-signature', 'content-type': 'application/json' }. */
|
|
25
|
+
export declare function webhookHeaders(secrets: readonly string[], id: string, timestampSeconds: number, body: string): Record<string, string>;
|
|
26
|
+
/**
|
|
27
|
+
* A receiver's check, used by the tests and quoted in the docs: any `v1,` entry of the header verifies
|
|
28
|
+
* under this secret (constant-time compare), and the timestamp is within `toleranceSeconds` (default 300)
|
|
29
|
+
* of `now` (default Date.now()/1000). A malformed secret throws (a configuration error); anything wrong
|
|
30
|
+
* with the headers or the body answers false.
|
|
31
|
+
*/
|
|
32
|
+
export declare function verifyWebhookSignature(secret: string, headers: {
|
|
33
|
+
id: string;
|
|
34
|
+
timestamp: string;
|
|
35
|
+
signature: string;
|
|
36
|
+
}, body: string, opts?: {
|
|
37
|
+
nowSeconds?: number;
|
|
38
|
+
toleranceSeconds?: number;
|
|
39
|
+
}): boolean;
|
|
40
|
+
//# sourceMappingURL=signing.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/webhooks/signing.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAS9C,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CAAC;gBACpC,IAAI,EAAE,kBAAkB,GAAG,WAAW,EAAE,OAAO,EAAE,MAAM;CAKpE;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,qHAAqH;AACrH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAoBvD;AAYD,8HAA8H;AAC9H,wBAAgB,WAAW,CACzB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,MAAM,EACxB,IAAI,EAAE,MAAM,GACX,MAAM,CAQR;AAED,6JAA6J;AAC7J,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,MAAM,EACxB,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,OAAO,CAkBT"}
|
|
@@ -0,0 +1,108 @@
|
|
|
1
|
+
import { createHmac, randomBytes } from 'node:crypto';
|
|
2
|
+
import { constantTimeEquals } from '../constant-time.js';
|
|
3
|
+
/**
|
|
4
|
+
* Standard Webhooks signing (https://www.standardwebhooks.com/, the symmetric
|
|
5
|
+
* `v1` scheme): the signed content is `${id}.${timestamp}.${body}`, HMAC-SHA256
|
|
6
|
+
* keyed with the secret's raw bytes (the standard base64 after the `whsec_`
|
|
7
|
+
* prefix), the timestamp in unix SECONDS. A delivery carries three headers:
|
|
8
|
+
* `webhook-id`, `webhook-timestamp`, and `webhook-signature`, a space-separated
|
|
9
|
+
* list of `v1,<standard base64>` entries (one per live secret, so a receiver
|
|
10
|
+
* holding either the old or the new secret verifies during a rotation).
|
|
11
|
+
*
|
|
12
|
+
* The body is signed exactly as it is sent: the caller serialises once and
|
|
13
|
+
* passes the same string here and to the request.
|
|
14
|
+
*/
|
|
15
|
+
export const WEBHOOK_SECRET_PREFIX = 'whsec_';
|
|
16
|
+
/** The spec's bounds on a secret's raw length. */
|
|
17
|
+
const MIN_SECRET_BYTES = 24;
|
|
18
|
+
const MAX_SECRET_BYTES = 64;
|
|
19
|
+
const GENERATED_SECRET_BYTES = 24;
|
|
20
|
+
const DEFAULT_TOLERANCE_SECONDS = 300;
|
|
21
|
+
const STANDARD_BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
|
|
22
|
+
export class SigningError extends Error {
|
|
23
|
+
code;
|
|
24
|
+
constructor(code, message) {
|
|
25
|
+
super(message);
|
|
26
|
+
this.name = 'SigningError';
|
|
27
|
+
this.code = code;
|
|
28
|
+
}
|
|
29
|
+
}
|
|
30
|
+
/** A new secret: the prefix + 24 random bytes, standard base64. */
|
|
31
|
+
export function generateWebhookSecret() {
|
|
32
|
+
return WEBHOOK_SECRET_PREFIX + randomBytes(GENERATED_SECRET_BYTES).toString('base64');
|
|
33
|
+
}
|
|
34
|
+
/** The raw key bytes of a secret; throws SigningError('malformed_secret') when the prefix or the base64 is wrong. */
|
|
35
|
+
export function webhookSecretKey(secret) {
|
|
36
|
+
if (typeof secret !== 'string' || !secret.startsWith(WEBHOOK_SECRET_PREFIX)) {
|
|
37
|
+
throw new SigningError('malformed_secret', `a webhook secret starts with ${WEBHOOK_SECRET_PREFIX}`);
|
|
38
|
+
}
|
|
39
|
+
const encoded = secret.slice(WEBHOOK_SECRET_PREFIX.length);
|
|
40
|
+
if (encoded.length % 4 !== 0 || !STANDARD_BASE64.test(encoded)) {
|
|
41
|
+
throw new SigningError('malformed_secret', 'a webhook secret is standard base64 after its prefix');
|
|
42
|
+
}
|
|
43
|
+
const key = Buffer.from(encoded, 'base64');
|
|
44
|
+
// Buffer.from tolerates non-canonical padding bits: only the one spelling passes.
|
|
45
|
+
if (key.toString('base64') !== encoded) {
|
|
46
|
+
throw new SigningError('malformed_secret', 'a webhook secret is canonical standard base64');
|
|
47
|
+
}
|
|
48
|
+
if (key.length < MIN_SECRET_BYTES || key.length > MAX_SECRET_BYTES) {
|
|
49
|
+
throw new SigningError('malformed_secret', `a webhook secret holds ${MIN_SECRET_BYTES} to ${MAX_SECRET_BYTES} bytes`);
|
|
50
|
+
}
|
|
51
|
+
return key;
|
|
52
|
+
}
|
|
53
|
+
function signature(key, id, timestamp, body) {
|
|
54
|
+
return createHmac('sha256', key).update(`${id}.${timestamp}.${body}`, 'utf8').digest('base64');
|
|
55
|
+
}
|
|
56
|
+
function assertTimestamp(timestampSeconds) {
|
|
57
|
+
if (!Number.isSafeInteger(timestampSeconds) || timestampSeconds < 0) {
|
|
58
|
+
throw new RangeError('a webhook timestamp is a whole number of unix seconds');
|
|
59
|
+
}
|
|
60
|
+
}
|
|
61
|
+
/** The `webhook-signature` header value: one `v1,<b64>` entry per secret, space-separated (two during a rotation overlap). */
|
|
62
|
+
export function signWebhook(secrets, id, timestampSeconds, body) {
|
|
63
|
+
if (secrets.length === 0) {
|
|
64
|
+
throw new SigningError('no_secret', 'a webhook is signed with at least one secret');
|
|
65
|
+
}
|
|
66
|
+
assertTimestamp(timestampSeconds);
|
|
67
|
+
return secrets
|
|
68
|
+
.map((secret) => `v1,${signature(webhookSecretKey(secret), id, timestampSeconds, body)}`)
|
|
69
|
+
.join(' ');
|
|
70
|
+
}
|
|
71
|
+
/** The three Standard Webhooks headers plus content-type: { 'webhook-id', 'webhook-timestamp', 'webhook-signature', 'content-type': 'application/json' }. */
|
|
72
|
+
export function webhookHeaders(secrets, id, timestampSeconds, body) {
|
|
73
|
+
return {
|
|
74
|
+
'webhook-id': id,
|
|
75
|
+
'webhook-timestamp': String(timestampSeconds),
|
|
76
|
+
'webhook-signature': signWebhook(secrets, id, timestampSeconds, body),
|
|
77
|
+
'content-type': 'application/json'
|
|
78
|
+
};
|
|
79
|
+
}
|
|
80
|
+
/**
|
|
81
|
+
* A receiver's check, used by the tests and quoted in the docs: any `v1,` entry of the header verifies
|
|
82
|
+
* under this secret (constant-time compare), and the timestamp is within `toleranceSeconds` (default 300)
|
|
83
|
+
* of `now` (default Date.now()/1000). A malformed secret throws (a configuration error); anything wrong
|
|
84
|
+
* with the headers or the body answers false.
|
|
85
|
+
*/
|
|
86
|
+
export function verifyWebhookSignature(secret, headers, body, opts = {}) {
|
|
87
|
+
const key = webhookSecretKey(secret);
|
|
88
|
+
if (!/^\d{1,15}$/.test(headers.timestamp))
|
|
89
|
+
return false;
|
|
90
|
+
const timestamp = Number(headers.timestamp);
|
|
91
|
+
const now = opts.nowSeconds ?? Date.now() / 1000;
|
|
92
|
+
const tolerance = opts.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
|
|
93
|
+
if (!(Math.abs(now - timestamp) <= tolerance))
|
|
94
|
+
return false;
|
|
95
|
+
// The receiver signs the header's own text, as the sender did.
|
|
96
|
+
const expected = signature(key, headers.id, headers.timestamp, body);
|
|
97
|
+
let verified = false;
|
|
98
|
+
for (const entry of headers.signature.split(' ')) {
|
|
99
|
+
const comma = entry.indexOf(',');
|
|
100
|
+
if (comma === -1 || entry.slice(0, comma) !== 'v1')
|
|
101
|
+
continue;
|
|
102
|
+
// Every entry is compared, so the answer's timing does not tell which one matched.
|
|
103
|
+
if (constantTimeEquals(entry.slice(comma + 1), expected))
|
|
104
|
+
verified = true;
|
|
105
|
+
}
|
|
106
|
+
return verified;
|
|
107
|
+
}
|
|
108
|
+
//# sourceMappingURL=signing.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/webhooks/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmC;IAChD,YAAY,IAAsC,EAAE,OAAe;QACjE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,UAAU,qBAAqB;IACnC,OAAO,qBAAqB,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,gCAAgC,qBAAqB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,kFAAkF;IAClF,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACnE,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,0BAA0B,gBAAgB,OAAO,gBAAgB,QAAQ,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,EAAU,EAAE,SAA0B,EAAE,IAAY;IAClF,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CAAC,gBAAwB;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,WAAW,CACzB,OAA0B,EAC1B,EAAU,EACV,gBAAwB,EACxB,IAAY;IAEZ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,8CAA8C,CAAC,CAAC;IACtF,CAAC;IACD,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAClC,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC;SACxF,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,6JAA6J;AAC7J,MAAM,UAAU,cAAc,CAC5B,OAA0B,EAC1B,EAAU,EACV,gBAAwB,EACxB,IAAY;IAEZ,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC;QAC7C,mBAAmB,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC;QACrE,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,OAA6D,EAC7D,IAAY,EACZ,OAA2D,EAAE;IAE7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;IACrE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5D,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI;YAAE,SAAS;QAC7D,mFAAmF;QACnF,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -0,0 +1,31 @@
|
|
|
1
|
+
import type PgBoss from 'pg-boss';
|
|
2
|
+
import type { DbConn } from '@antasphere/chassis-db';
|
|
3
|
+
/**
|
|
4
|
+
* A pg-boss send INSIDE a drizzle transaction (or on a plain handle): the job
|
|
5
|
+
* row is written by the same connection as the caller's own rows, so it
|
|
6
|
+
* commits with them and never exists for a rolled-back write. pg-boss takes
|
|
7
|
+
* an executor (`db.executeSql(text, values)`), and the executor here is the
|
|
8
|
+
* connection drizzle's handle wraps: a `pg` PoolClient inside a transaction,
|
|
9
|
+
* the Pool outside one. The statement runs exactly as pg-boss wrote it, its
|
|
10
|
+
* `$n` placeholders untouched: a placeholder pg-boss reuses three times with
|
|
11
|
+
* three casts (`right($5,1)`, `CAST($5 as timestamptz)`, `COALESCE($5,'0')`)
|
|
12
|
+
* keeps its one type, where a rebinding into drizzle's own parameters gave
|
|
13
|
+
* each occurrence a type of its own and refused a `startAfter` in seconds
|
|
14
|
+
* (the chassis suite, scenario 8).
|
|
15
|
+
*
|
|
16
|
+
* The connection is reached through drizzle's node-postgres session
|
|
17
|
+
* (`session.client`), an internal of the driver binding; `tx-send.test.ts`
|
|
18
|
+
* pins the shape against the installed version. A drizzle bump re-verifies it.
|
|
19
|
+
*/
|
|
20
|
+
interface QueryClient {
|
|
21
|
+
query(text: string, values: unknown[]): Promise<{
|
|
22
|
+
rows: unknown[];
|
|
23
|
+
}>;
|
|
24
|
+
}
|
|
25
|
+
/** The pg client (or pool) behind a drizzle handle or transaction. */
|
|
26
|
+
export declare function connectionOf(conn: DbConn): QueryClient;
|
|
27
|
+
export declare function drizzleExecutor(conn: DbConn): PgBoss.Db;
|
|
28
|
+
/** Send one job through `conn`; answers the job id (null when the queue does not exist). */
|
|
29
|
+
export declare function sendInTx(boss: PgBoss, conn: DbConn, queue: string, data: object, options?: PgBoss.SendOptions): Promise<string | null>;
|
|
30
|
+
export {};
|
|
31
|
+
//# sourceMappingURL=tx-send.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tx-send.d.ts","sourceRoot":"","sources":["../../src/webhooks/tx-send.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,UAAU,WAAW;IACnB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAMtD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,CAQvD;AAED,4FAA4F;AAC5F,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,CAAC,WAAgB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB"}
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
/** The pg client (or pool) behind a drizzle handle or transaction. */
|
|
2
|
+
export function connectionOf(conn) {
|
|
3
|
+
const client = conn.session?.client;
|
|
4
|
+
if (!client || typeof client.query !== 'function') {
|
|
5
|
+
throw new Error('tx-send: the drizzle handle exposes no node-postgres client (session.client)');
|
|
6
|
+
}
|
|
7
|
+
return client;
|
|
8
|
+
}
|
|
9
|
+
export function drizzleExecutor(conn) {
|
|
10
|
+
const client = connectionOf(conn);
|
|
11
|
+
return {
|
|
12
|
+
executeSql: async (text, values) => {
|
|
13
|
+
const res = await client.query(text, values);
|
|
14
|
+
return { rows: res.rows };
|
|
15
|
+
}
|
|
16
|
+
};
|
|
17
|
+
}
|
|
18
|
+
/** Send one job through `conn`; answers the job id (null when the queue does not exist). */
|
|
19
|
+
export function sendInTx(boss, conn, queue, data, options = {}) {
|
|
20
|
+
return boss.send(queue, data, { ...options, db: drizzleExecutor(conn) });
|
|
21
|
+
}
|
|
22
|
+
//# sourceMappingURL=tx-send.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"tx-send.js","sourceRoot":"","sources":["../../src/webhooks/tx-send.ts"],"names":[],"mappings":"AAwBA,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,MAAM,GAAI,IAAmE,CAAC,OAAO,EAAE,MAAM,CAAC;IACpG,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAiC,EAAE,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,QAAQ,CACtB,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,IAAY,EACZ,UAA8B,EAAE;IAEhC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@antasphere/chassis-server",
|
|
3
|
-
"version": "1.0
|
|
3
|
+
"version": "1.2.0",
|
|
4
4
|
"license": "SEE LICENSE IN LICENSE",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -54,6 +54,10 @@
|
|
|
54
54
|
"types": "./dist/apikeys/index.d.ts",
|
|
55
55
|
"default": "./dist/apikeys/index.js"
|
|
56
56
|
},
|
|
57
|
+
"./cli-package": {
|
|
58
|
+
"types": "./dist/cli-package/index.d.ts",
|
|
59
|
+
"default": "./dist/cli-package/index.js"
|
|
60
|
+
},
|
|
57
61
|
"./accounts": {
|
|
58
62
|
"types": "./dist/accounts/index.d.ts",
|
|
59
63
|
"default": "./dist/accounts/index.js"
|
|
@@ -101,6 +105,10 @@
|
|
|
101
105
|
"./testing": {
|
|
102
106
|
"types": "./dist/testing/index.d.ts",
|
|
103
107
|
"default": "./dist/testing/index.js"
|
|
108
|
+
},
|
|
109
|
+
"./webhooks": {
|
|
110
|
+
"types": "./dist/webhooks/index.d.ts",
|
|
111
|
+
"default": "./dist/webhooks/index.js"
|
|
104
112
|
}
|
|
105
113
|
},
|
|
106
114
|
"dependencies": {
|
|
@@ -131,8 +139,8 @@
|
|
|
131
139
|
"ulid": "^3.0.2",
|
|
132
140
|
"yazl": "^3.3.1",
|
|
133
141
|
"zod": "^4.1.0",
|
|
134
|
-
"@antasphere/chassis-contract": "1.0
|
|
135
|
-
"@antasphere/chassis-db": "1.0
|
|
142
|
+
"@antasphere/chassis-contract": "1.2.0",
|
|
143
|
+
"@antasphere/chassis-db": "1.2.0"
|
|
136
144
|
},
|
|
137
145
|
"devDependencies": {
|
|
138
146
|
"@better-auth/core": "1.6.22",
|
package/src/api/apikeys.ts
CHANGED
|
@@ -6,6 +6,7 @@ import { sql } from 'drizzle-orm';
|
|
|
6
6
|
import type { ApiKeyService } from '../apikeys/service.js';
|
|
7
7
|
import { cursorRowId, keysetBefore, pageOf } from '../pagination.js';
|
|
8
8
|
import { requireAuth } from '../middleware/auth-context.js';
|
|
9
|
+
import type { EventBus } from '../platform/events.js';
|
|
9
10
|
|
|
10
11
|
const err = (code: string, message: string) => ({ error: { code, message } });
|
|
11
12
|
|
|
@@ -34,7 +35,9 @@ export function registerApiKeyRoutes(
|
|
|
34
35
|
api: OpenAPIHono,
|
|
35
36
|
db: Db,
|
|
36
37
|
service: ApiKeyService,
|
|
37
|
-
routes: Pick<ScopeRoutes, 'apiKeysListRoute' | 'apiKeyCreateRoute' | 'apiKeyRevokeRoute'
|
|
38
|
+
routes: Pick<ScopeRoutes, 'apiKeysListRoute' | 'apiKeyCreateRoute' | 'apiKeyRevokeRoute'>,
|
|
39
|
+
/** The bus, for `apikey.created` and `apikey.revoked` after the write (the webhooks bridge them). */
|
|
40
|
+
events?: EventBus
|
|
38
41
|
): void {
|
|
39
42
|
const { apiKeysListRoute, apiKeyCreateRoute, apiKeyRevokeRoute } = routes;
|
|
40
43
|
api.use('/api-keys', requireAuth());
|
|
@@ -109,6 +112,10 @@ export function registerApiKeyRoutes(
|
|
|
109
112
|
expiresAt
|
|
110
113
|
});
|
|
111
114
|
const [row] = await db.select().from(apiKeys).where(eq(apiKeys.id, minted.id)).limit(1);
|
|
115
|
+
events?.emit('apikey.created', {
|
|
116
|
+
workspaceId: body.workspaceId ?? principal.workspaceId,
|
|
117
|
+
apiKeyId: minted.id
|
|
118
|
+
});
|
|
112
119
|
c.set('audit', {
|
|
113
120
|
action: 'apikey.create',
|
|
114
121
|
resourceType: 'api_key',
|
|
@@ -141,6 +148,10 @@ export function registerApiKeyRoutes(
|
|
|
141
148
|
.where(eq(apiKeys.id, key.id));
|
|
142
149
|
}
|
|
143
150
|
const [updated] = await db.select().from(apiKeys).where(eq(apiKeys.id, key.id)).limit(1);
|
|
151
|
+
events?.emit('apikey.revoked', {
|
|
152
|
+
workspaceId: key.workspaceId ?? principal.workspaceId,
|
|
153
|
+
apiKeyId: key.id
|
|
154
|
+
});
|
|
144
155
|
c.set('audit', { action: 'apikey.revoke', resourceType: 'api_key', resourceId: key.id });
|
|
145
156
|
return c.json(toWire(updated!), 200);
|
|
146
157
|
});
|
|
@@ -0,0 +1,151 @@
|
|
|
1
|
+
import { createReadStream, statSync, type Stats } from 'node:fs';
|
|
2
|
+
import { Readable } from 'node:stream';
|
|
3
|
+
import type { OpenAPIHono } from '@hono/zod-openapi';
|
|
4
|
+
import { lt, sql } from 'drizzle-orm';
|
|
5
|
+
import type { cliPackageRoute } from '@antasphere/chassis-contract/routes';
|
|
6
|
+
import { ssoConnectJtis, type Db } from '@antasphere/chassis-db';
|
|
7
|
+
import type { HubConnectAssertion, HubSsoService } from '../identity/hub-sso.js';
|
|
8
|
+
import type { CliPackage } from '../cli-package/index.js';
|
|
9
|
+
import type { Logger } from '../logger.js';
|
|
10
|
+
|
|
11
|
+
const err = (code: string, message: string) => ({ error: { code, message } });
|
|
12
|
+
|
|
13
|
+
/**
|
|
14
|
+
* The tool's own CLI package (cloud edition ONLY, PRDCT-3312):
|
|
15
|
+
*
|
|
16
|
+
* POST /cli/package → verify a hub-minted 120 s exchange JWT (the same H3
|
|
17
|
+
* token `/sso/cli-connect` takes), burn its jti, stream the tarball the
|
|
18
|
+
* release packed (`CLI_PACKAGE_DIR`, cli-package/index.ts)
|
|
19
|
+
*
|
|
20
|
+
* The public `team` command installs each internal tool's private CLI from
|
|
21
|
+
* here: the hub mints the token only for a member it lets into the tool
|
|
22
|
+
* (its 403 `tool_access_denied` otherwise), so holding a valid one IS the
|
|
23
|
+
* access decision, and this route adds none of its own.
|
|
24
|
+
*
|
|
25
|
+
* Registered by create-api.ts ONLY when the instance boots EDITION=cloud,
|
|
26
|
+
* beside `/sso/cli-connect` and for the same reason: an oss boot never
|
|
27
|
+
* mounts this module, so the path answers the JSON 404 terminator there
|
|
28
|
+
* (zero hub surface). Rate-limited on the CLI-connect wall (the same hub
|
|
29
|
+
* token, the same cost).
|
|
30
|
+
*
|
|
31
|
+
* NOT a public path and unlisted in the machine scope allowlist, on
|
|
32
|
+
* purpose: the token rides in the BODY, never in `Authorization` (a
|
|
33
|
+
* three-part bearer reads as an OAuth token to the scope gate). A request
|
|
34
|
+
* carrying no credential reaches this handler with no principal; an API key
|
|
35
|
+
* or an OAuth bearer meets the fail-closed 403 `endpoint_not_allowed` before
|
|
36
|
+
* it (middleware/scopes.ts).
|
|
37
|
+
*
|
|
38
|
+
* Verification discipline is sso-connect.ts's, unchanged:
|
|
39
|
+
*
|
|
40
|
+
* - the token passes `HubSsoService.verifyConnectToken` — hub-JWKS
|
|
41
|
+
* signature, iss pinned to the hub, aud pinned to OUR resource URL,
|
|
42
|
+
* RS256 only, expiry, `purpose: 'sso-connect'` required, `jti` required;
|
|
43
|
+
* - the `jti` is consumed ONE-TIME-USE in the SAME `sso_connect_jtis`
|
|
44
|
+
* ledger, insert-first: a token spent here cannot then mint a key at
|
|
45
|
+
* `/sso/cli-connect`, and the other way round;
|
|
46
|
+
* - every verification failure (signature, iss, aud, purpose, expiry,
|
|
47
|
+
* replay) answers ONE uniform 401 — no oracle for probing tokens.
|
|
48
|
+
*
|
|
49
|
+
* Only after the token is spent does the route say whether a package
|
|
50
|
+
* exists (404 `cli_not_packaged`): an unverified caller learns nothing
|
|
51
|
+
* about the instance's release.
|
|
52
|
+
*/
|
|
53
|
+
|
|
54
|
+
export interface CliPackageRouteDeps {
|
|
55
|
+
db: Db;
|
|
56
|
+
hubSso: HubSsoService;
|
|
57
|
+
/** What the boot read off `CLI_PACKAGE_DIR`; null = released without its CLI package. */
|
|
58
|
+
cliPackage: CliPackage | null;
|
|
59
|
+
logger: Logger;
|
|
60
|
+
routes: { cliPackageRoute: typeof cliPackageRoute };
|
|
61
|
+
}
|
|
62
|
+
|
|
63
|
+
export function registerCliPackageRoutes(api: OpenAPIHono, deps: CliPackageRouteDeps): void {
|
|
64
|
+
const { db, hubSso, cliPackage, logger } = deps;
|
|
65
|
+
const { cliPackageRoute } = deps.routes;
|
|
66
|
+
|
|
67
|
+
api.openapi(cliPackageRoute, async (c) => {
|
|
68
|
+
const body = c.req.valid('json');
|
|
69
|
+
|
|
70
|
+
// 1. Verify hard. One uniform 401 for every rejection reason.
|
|
71
|
+
let assertion: HubConnectAssertion;
|
|
72
|
+
try {
|
|
73
|
+
assertion = await hubSso.verifyConnectToken(body.token);
|
|
74
|
+
} catch (cause) {
|
|
75
|
+
logger.warn({ err: cause }, 'cli package: exchange token rejected');
|
|
76
|
+
return c.json(err('invalid_token', 'The exchange token is invalid, expired, or already used'), 401);
|
|
77
|
+
}
|
|
78
|
+
|
|
79
|
+
// 2. Burn the jti (one-time-use, G8), in the ledger /sso/cli-connect
|
|
80
|
+
// burns into. Insert-first: the claim precedes any effect, so a replay —
|
|
81
|
+
// even a concurrent one — downloads nothing. The sweep keeps the ledger
|
|
82
|
+
// tiny; best-effort, never correctness-bearing (expired rows only shadow
|
|
83
|
+
// jtis of already-expired tokens).
|
|
84
|
+
void db
|
|
85
|
+
.delete(ssoConnectJtis)
|
|
86
|
+
.where(lt(ssoConnectJtis.expiresAt, sql`now() - interval '1 minute'`))
|
|
87
|
+
.catch(() => {});
|
|
88
|
+
const claimed = await db
|
|
89
|
+
.insert(ssoConnectJtis)
|
|
90
|
+
.values({ jti: assertion.jti, expiresAt: assertion.expiresAt })
|
|
91
|
+
.onConflictDoNothing()
|
|
92
|
+
.returning({ jti: ssoConnectJtis.jti });
|
|
93
|
+
if (claimed.length === 0) {
|
|
94
|
+
logger.warn({ jti: assertion.jti }, 'cli package: replayed jti rejected');
|
|
95
|
+
return c.json(err('invalid_token', 'The exchange token is invalid, expired, or already used'), 401);
|
|
96
|
+
}
|
|
97
|
+
|
|
98
|
+
// 3. Released without its CLI package: say so, with a sentence the
|
|
99
|
+
// `team` command can print as it is. The boot's read names what the
|
|
100
|
+
// image packed; the file is statted again HERE, after the burn, so a
|
|
101
|
+
// folder changed under a running instance answers the same 404 instead
|
|
102
|
+
// of a 200 whose body and length disagree.
|
|
103
|
+
const notPackaged = () =>
|
|
104
|
+
c.json(
|
|
105
|
+
err(
|
|
106
|
+
'cli_not_packaged',
|
|
107
|
+
'This instance was released without its CLI package, so it has none to serve'
|
|
108
|
+
),
|
|
109
|
+
404
|
|
110
|
+
);
|
|
111
|
+
if (cliPackage === null) return notPackaged();
|
|
112
|
+
let stat: Stats;
|
|
113
|
+
try {
|
|
114
|
+
stat = statSync(cliPackage.path);
|
|
115
|
+
} catch (cause) {
|
|
116
|
+
logger.error({ err: cause, path: cliPackage.path }, 'cli package: the tarball read at boot is gone');
|
|
117
|
+
return notPackaged();
|
|
118
|
+
}
|
|
119
|
+
if (!stat.isFile()) {
|
|
120
|
+
logger.error({ path: cliPackage.path }, 'cli package: the tarball read at boot is no longer a file');
|
|
121
|
+
return notPackaged();
|
|
122
|
+
}
|
|
123
|
+
|
|
124
|
+
// 4. Stream the tarball. The bytes are the release's, never a person's,
|
|
125
|
+
// but they are served as an attachment and never sniffed all the same;
|
|
126
|
+
// no-store, so a shared cache never answers the next exchange.
|
|
127
|
+
logger.info(
|
|
128
|
+
{
|
|
129
|
+
hubSub: assertion.sub,
|
|
130
|
+
email: assertion.email,
|
|
131
|
+
package: cliPackage.name,
|
|
132
|
+
version: cliPackage.version
|
|
133
|
+
},
|
|
134
|
+
'cli package: served'
|
|
135
|
+
);
|
|
136
|
+
const nodeStream = createReadStream(cliPackage.path);
|
|
137
|
+
// Backpressure rides Readable.toWeb; a client abort must destroy the
|
|
138
|
+
// source or every abandoned download leaks a descriptor (files/serve.ts).
|
|
139
|
+
c.req.raw.signal.addEventListener('abort', () => nodeStream.destroy());
|
|
140
|
+
const web = Readable.toWeb(nodeStream) as unknown as ReadableStream;
|
|
141
|
+
return c.body(web, 200, {
|
|
142
|
+
'content-type': 'application/gzip',
|
|
143
|
+
'content-disposition': `attachment; filename="${cliPackage.filename}"`,
|
|
144
|
+
// The size statted now, never the boot's: the header and the bytes agree.
|
|
145
|
+
'content-length': String(stat.size),
|
|
146
|
+
// Also set on every response by the global security-headers middleware.
|
|
147
|
+
'x-content-type-options': 'nosniff',
|
|
148
|
+
'cache-control': 'no-store'
|
|
149
|
+
});
|
|
150
|
+
});
|
|
151
|
+
}
|