@antasphere/chassis-server 1.0.2 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (189) hide show
  1. package/dist/api/apikeys.d.ts +4 -1
  2. package/dist/api/apikeys.d.ts.map +1 -1
  3. package/dist/api/apikeys.js +11 -1
  4. package/dist/api/apikeys.js.map +1 -1
  5. package/dist/api/cli-package.d.ts +58 -0
  6. package/dist/api/cli-package.d.ts.map +1 -0
  7. package/dist/api/cli-package.js +83 -0
  8. package/dist/api/cli-package.js.map +1 -0
  9. package/dist/api/create-api.d.ts +3 -0
  10. package/dist/api/create-api.d.ts.map +1 -1
  11. package/dist/api/create-api.js +33 -4
  12. package/dist/api/create-api.js.map +1 -1
  13. package/dist/api/index.d.ts +1 -0
  14. package/dist/api/index.d.ts.map +1 -1
  15. package/dist/api/index.js +1 -0
  16. package/dist/api/index.js.map +1 -1
  17. package/dist/api/invitations.d.ts.map +1 -1
  18. package/dist/api/invitations.js +6 -0
  19. package/dist/api/invitations.js.map +1 -1
  20. package/dist/api/members.d.ts +5 -2
  21. package/dist/api/members.d.ts.map +1 -1
  22. package/dist/api/members.js +1 -0
  23. package/dist/api/members.js.map +1 -1
  24. package/dist/api/projects.d.ts +3 -0
  25. package/dist/api/projects.d.ts.map +1 -1
  26. package/dist/api/projects.js +13 -1
  27. package/dist/api/projects.js.map +1 -1
  28. package/dist/api/webhooks.d.ts +24 -0
  29. package/dist/api/webhooks.d.ts.map +1 -0
  30. package/dist/api/webhooks.js +170 -0
  31. package/dist/api/webhooks.js.map +1 -0
  32. package/dist/boot.d.ts.map +1 -1
  33. package/dist/boot.js +47 -4
  34. package/dist/boot.js.map +1 -1
  35. package/dist/cli-package/index.d.ts +44 -0
  36. package/dist/cli-package/index.d.ts.map +1 -0
  37. package/dist/cli-package/index.js +60 -0
  38. package/dist/cli-package/index.js.map +1 -0
  39. package/dist/email/index.d.ts +1 -0
  40. package/dist/email/index.d.ts.map +1 -1
  41. package/dist/email/index.js +1 -0
  42. package/dist/email/index.js.map +1 -1
  43. package/dist/env.d.ts +11 -0
  44. package/dist/env.d.ts.map +1 -1
  45. package/dist/env.js +24 -0
  46. package/dist/env.js.map +1 -1
  47. package/dist/identity/demo-pass-rules.d.ts.map +1 -1
  48. package/dist/identity/demo-pass-rules.js +6 -1
  49. package/dist/identity/demo-pass-rules.js.map +1 -1
  50. package/dist/identity/hub-reconcile.d.ts +2 -2
  51. package/dist/identity/hub-reconcile.d.ts.map +1 -1
  52. package/dist/identity/hub-reconcile.js.map +1 -1
  53. package/dist/index.d.ts +2 -1
  54. package/dist/index.d.ts.map +1 -1
  55. package/dist/jobs/index.d.ts +1 -1
  56. package/dist/jobs/index.d.ts.map +1 -1
  57. package/dist/jobs/index.js.map +1 -1
  58. package/dist/jobs/pgboss.d.ts +34 -0
  59. package/dist/jobs/pgboss.d.ts.map +1 -1
  60. package/dist/jobs/pgboss.js +32 -9
  61. package/dist/jobs/pgboss.js.map +1 -1
  62. package/dist/mcp/index.d.ts +1 -0
  63. package/dist/mcp/index.d.ts.map +1 -1
  64. package/dist/mcp/index.js +1 -0
  65. package/dist/mcp/index.js.map +1 -1
  66. package/dist/mcp/server.d.ts +1 -1
  67. package/dist/mcp/server.d.ts.map +1 -1
  68. package/dist/mcp/server.js +11 -2
  69. package/dist/mcp/server.js.map +1 -1
  70. package/dist/mcp/tool-kit.d.ts +2 -0
  71. package/dist/mcp/tool-kit.d.ts.map +1 -1
  72. package/dist/mcp/tool-kit.js +5 -1
  73. package/dist/mcp/tool-kit.js.map +1 -1
  74. package/dist/mcp/webhooks.d.ts +16 -0
  75. package/dist/mcp/webhooks.d.ts.map +1 -0
  76. package/dist/mcp/webhooks.js +226 -0
  77. package/dist/mcp/webhooks.js.map +1 -0
  78. package/dist/members/removal.d.ts +10 -2
  79. package/dist/members/removal.d.ts.map +1 -1
  80. package/dist/members/removal.js +3 -0
  81. package/dist/members/removal.js.map +1 -1
  82. package/dist/middleware/idempotency.d.ts.map +1 -1
  83. package/dist/middleware/idempotency.js +3 -1
  84. package/dist/middleware/idempotency.js.map +1 -1
  85. package/dist/middleware/scopes.d.ts +9 -1
  86. package/dist/middleware/scopes.d.ts.map +1 -1
  87. package/dist/middleware/scopes.js +8 -1
  88. package/dist/middleware/scopes.js.map +1 -1
  89. package/dist/secret-box.d.ts +10 -0
  90. package/dist/secret-box.d.ts.map +1 -0
  91. package/dist/secret-box.js +87 -0
  92. package/dist/secret-box.js.map +1 -0
  93. package/dist/testing/helpers.d.ts +8 -0
  94. package/dist/testing/helpers.d.ts.map +1 -1
  95. package/dist/testing/helpers.js.map +1 -1
  96. package/dist/tool-definition.d.ts +24 -0
  97. package/dist/tool-definition.d.ts.map +1 -1
  98. package/dist/tool-definition.js.map +1 -1
  99. package/dist/webhooks/catalog.d.ts +80 -0
  100. package/dist/webhooks/catalog.d.ts.map +1 -0
  101. package/dist/webhooks/catalog.js +134 -0
  102. package/dist/webhooks/catalog.js.map +1 -0
  103. package/dist/webhooks/index.d.ts +9 -0
  104. package/dist/webhooks/index.d.ts.map +1 -0
  105. package/dist/webhooks/index.js +9 -0
  106. package/dist/webhooks/index.js.map +1 -0
  107. package/dist/webhooks/jobs.d.ts +12 -0
  108. package/dist/webhooks/jobs.d.ts.map +1 -0
  109. package/dist/webhooks/jobs.js +77 -0
  110. package/dist/webhooks/jobs.js.map +1 -0
  111. package/dist/webhooks/mail.d.ts +24 -0
  112. package/dist/webhooks/mail.d.ts.map +1 -0
  113. package/dist/webhooks/mail.js +21 -0
  114. package/dist/webhooks/mail.js.map +1 -0
  115. package/dist/webhooks/match.d.ts +22 -0
  116. package/dist/webhooks/match.d.ts.map +1 -0
  117. package/dist/webhooks/match.js +40 -0
  118. package/dist/webhooks/match.js.map +1 -0
  119. package/dist/webhooks/safe-fetch.d.ts +94 -0
  120. package/dist/webhooks/safe-fetch.d.ts.map +1 -0
  121. package/dist/webhooks/safe-fetch.js +263 -0
  122. package/dist/webhooks/safe-fetch.js.map +1 -0
  123. package/dist/webhooks/service.d.ts +245 -0
  124. package/dist/webhooks/service.d.ts.map +1 -0
  125. package/dist/webhooks/service.js +861 -0
  126. package/dist/webhooks/service.js.map +1 -0
  127. package/dist/webhooks/signing.d.ts +40 -0
  128. package/dist/webhooks/signing.d.ts.map +1 -0
  129. package/dist/webhooks/signing.js +108 -0
  130. package/dist/webhooks/signing.js.map +1 -0
  131. package/dist/webhooks/tx-send.d.ts +31 -0
  132. package/dist/webhooks/tx-send.d.ts.map +1 -0
  133. package/dist/webhooks/tx-send.js +22 -0
  134. package/dist/webhooks/tx-send.js.map +1 -0
  135. package/package.json +11 -3
  136. package/src/api/apikeys.ts +12 -1
  137. package/src/api/cli-package.ts +151 -0
  138. package/src/api/create-api.ts +42 -4
  139. package/src/api/index.ts +1 -0
  140. package/src/api/invitations.ts +6 -0
  141. package/src/api/members.ts +6 -2
  142. package/src/api/projects.ts +16 -1
  143. package/src/api/webhooks.ts +205 -0
  144. package/src/boot.ts +48 -4
  145. package/src/cli-package/index.ts +88 -0
  146. package/src/email/index.ts +1 -0
  147. package/src/env.ts +25 -0
  148. package/src/identity/demo-pass-rules.ts +6 -1
  149. package/src/identity/hub-reconcile.ts +2 -2
  150. package/src/index.ts +13 -1
  151. package/src/jobs/index.ts +1 -0
  152. package/src/jobs/pgboss.ts +71 -9
  153. package/src/mcp/index.ts +1 -0
  154. package/src/mcp/server.ts +10 -2
  155. package/src/mcp/tool-kit.ts +7 -1
  156. package/src/mcp/webhooks.ts +370 -0
  157. package/src/members/removal.ts +21 -1
  158. package/src/middleware/idempotency.ts +3 -1
  159. package/src/middleware/scopes.ts +14 -0
  160. package/src/secret-box.ts +93 -0
  161. package/src/testing/helpers.ts +8 -0
  162. package/src/tool-definition.ts +29 -0
  163. package/src/webhooks/catalog.ts +205 -0
  164. package/src/webhooks/index.ts +58 -0
  165. package/src/webhooks/jobs.ts +92 -0
  166. package/src/webhooks/mail.ts +48 -0
  167. package/src/webhooks/match.ts +52 -0
  168. package/src/webhooks/safe-fetch.ts +335 -0
  169. package/src/webhooks/service.ts +1089 -0
  170. package/src/webhooks/signing.ts +132 -0
  171. package/src/webhooks/tx-send.ts +53 -0
  172. package/test/host/drizzle/0002_webhooks.sql +49 -0
  173. package/test/host/drizzle/meta/0002_snapshot.json +3952 -0
  174. package/test/host/drizzle/meta/_journal.json +8 -1
  175. package/test/host/identity.ts +6 -1
  176. package/test/host/minimal-host.ts +2 -1
  177. package/test/host/minimal-tool.ts +32 -4
  178. package/test/integration/cli-package.test.ts +403 -0
  179. package/test/integration/mcp-webhooks.test.ts +360 -0
  180. package/test/integration/webhooks.test.ts +1684 -0
  181. package/test/unit/cli-package.test.ts +93 -0
  182. package/test/unit/secret-box.test.ts +124 -0
  183. package/test/unit/tx-send.test.ts +23 -0
  184. package/test/unit/webhook-catalog.test.ts +151 -0
  185. package/test/unit/webhook-env.test.ts +60 -0
  186. package/test/unit/webhook-jobs.test.ts +92 -0
  187. package/test/unit/webhook-match.test.ts +81 -0
  188. package/test/unit/webhook-safe-fetch.test.ts +330 -0
  189. package/test/unit/webhook-signing.test.ts +169 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/webhooks/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,IAAI,IAAI,SAAS,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EAKX,MAAM,wBAAwB,CAAC;AAYhC,OAAO,EAAE,eAAe,EAAkB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,kBAAkB,EAAsD,MAAM,cAAc,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,sBAAsB,EAGvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAC7D,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AACnD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAqBlE,MAAM,CAAC,MAAM,qBAAqB,GAAiB;IACjD,UAAU,EAAE,EAAE;IACd,iBAAiB,EAAE,EAAE;IACrB,gBAAgB,EAAE,IAAI;IACtB,oBAAoB,EAAE,EAAE;IACxB,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;IACpC,aAAa,EAAE,MAAM;IACrB,uBAAuB,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IACzC,SAAS,EAAE,MAAM;CAClB,CAAC;AA6DF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,IAAuE,EAChF,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAmE;QAIhF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,UAAkB;QACrC,KAAK,CAAC,UAAU,CAAC,CAAC;QADC,eAAU,GAAV,UAAU,CAAQ;QAErC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,6EAA6E;AAC7E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEnC;IADX,YACW,UAAkB,EAC3B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,eAAU,GAAV,UAAU,CAAQ;QAI3B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAID,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,OAAO,cAAc;IAcI;IAbpB,KAAK,CAAe;IACpB,WAAW,CAAoB;IACvB,GAAG,CAAY;IACf,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,UAAU,CAAkB;IAC5B,IAAI,CAAkB;IACtB,QAAQ,CAAkB;IAC1B,GAAG,CAAa;IACjC,sFAAsF;IAC9E,IAAI,GAAkB,IAAI,CAAC;IACnC,gFAAgF;IAC/D,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtD,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,qBAAqB,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,OAAO,CAAC;YAC5B,IAAI,EAAE,iCAAiC;YACvC,IAAI,EAAE,yHAAyH;YAC/H,UAAU,EAAE,CAAC,SAAS,CAAU;YAChC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC;YACtB,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,iFAAiF;YACvF,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,OAAO,CAAC;YAC1B,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,uDAAuD;YAC7D,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,KAAkB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,oFAAoF;YACpF,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,gCAAgC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAC7D,sEAAsE,CACvE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAwC,EAAE,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAClC,yDAAyD,CAC1D,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,eAAe,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;gBACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;YACnE,CAAC;iBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACrC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAClC,0EAA0E,CAC3E,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,GAAG,GAAoB;YAC3B,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAA+B;SAC7C,CAAC;QACF,0EAA0E;QAC1E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE;YACjE,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,oBAAoB,iBAAiB,CAAC,CAAC;QACjG,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,IAAY;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,QAAQ,GACZ,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa;YACnE,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,WAAmB;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,CAAC;aAC3C,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,uFAAuF;IACvF,mBAAmB,CAAC,WAAmB;QACrC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAgB;QACtB,MAAM,IAAI,GAAG,KAAK,EAAE,KAAkB,EAAiB,EAAE;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAC3D,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CACrE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CACtD,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAChE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAC9D,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CACxE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CACxD,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAClE,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CACxD,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,iGAAiG;IACjG,KAAK,CAAC,MAAM,CAAC,GAAoB;QAC/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACjC,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CACpG,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1C,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;qBACnB,MAAM,CAAC,iBAAiB,CAAC;qBACzB,MAAM,CAAC;oBACN,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,GAAG,CAAC,EAAE;oBACf,SAAS,EAAE,GAAG,CAAC,IAAI;oBACnB,OAAO;oBACP,MAAM,EAAE,SAAS;iBAClB,CAAC;qBACD,SAAS,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,GAAI,CAAC,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,uFAAuF;IAC/E,UAAU,CAAC,GAAoB;QACrC,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,GAAG,CAAC;YAC5D,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,QAAQ;YACR,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,UAAkB,EAAE,iBAAiB,GAAG,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,CAAC,WAAW,EAAE,EAClB,IAAI,EACJ,wBAAwB,EACxB,EAAE,UAAU,EAA+B,EAC3C;YACE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YACjC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB;YACxC,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CACF,CAAC;QACF,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,wBAAwB,iBAAiB,CAAC,CAAC;IACvG,CAAC;IAED,6EAA6E;IAE7E;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,IAA4B;QAC5D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAClC,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;aAC3C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,CAAC,uCAAuC;QACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,QAAQ,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAClC,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC3B,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,mBAAmB;gBAC9B,cAAc,EAAE,IAAI;gBACpB,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,iBAAiB;QACjB,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,IACE,QAAQ,CAAC,cAAc;gBACvB,QAAQ,CAAC,uBAAuB;gBAChC,QAAQ,CAAC,uBAAuB,GAAG,GAAG,EACtC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,GAAG;gBACR,GAAG,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC;gBACpF,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;aACzE,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAC5D,yGAAyG,CAC1G,CAAC;YACF,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;iBACf,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBAC7F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC3B,MAAM,EAAE,QAAQ;gBAChB,OAAO;gBACP,SAAS,EAAE,mBAAmB;gBAC9B,cAAc,EAAE,IAAI;gBACpB,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B,EAAE,CAAC;YAC1F,MAAM,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBACxE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;gBAC/B,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY;aAC1B,CAAC,CAAC;YACH,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,KAAK,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK;gBACH,CAAC,YAAY,sBAAsB;oBACjC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE;oBACzB,CAAC,CAAE,CAAW,CAAC,IAAI,KAAK,cAAc,IAAK,CAAW,CAAC,IAAI,KAAK,YAAY;wBAC1E,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,MAAM,CAAE,CAAW,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACrE,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,IAAI,IAAI,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;;gBAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;iBACf,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC;gBACH,mBAAmB,EAAE,CAAC;gBACtB,cAAc,EAAE,IAAI;gBACpB,cAAc,EAAE,GAAG;gBACnB,kBAAkB,EAAE,WAAW;gBAC/B,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC3B,MAAM,EAAE,WAAW;gBACnB,OAAO;gBACP,cAAc,EAAE,UAAU;gBAC1B,SAAS,EAAE,IAAI;gBACf,GAAG;gBACH,WAAW,EAAE,GAAG;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,oEAAoE;QACpE,yEAAyE;QACzE,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACjC,MAAM,CAAC,gBAAgB,CAAC;aACxB,GAAG,CAAC;YACH,mBAAmB,EAAE,GAAG,CAAA,GAAG,gBAAgB,CAAC,mBAAmB,MAAM;YACrE,cAAc,EAAE,GAAG,CAAA,YAAY,gBAAgB,CAAC,cAAc,KAAK,GAAG,GAAG;YACzE,cAAc,EAAE,GAAG;YACnB,kBAAkB,EAAE,QAAQ;YAC5B,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC3C,SAAS,CAAC;YACT,MAAM,EAAE,gBAAgB,CAAC,mBAAmB;YAC5C,cAAc,EAAE,gBAAgB,CAAC,cAAc;SAChD,CAAC,CAAC;QACL,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,QAAQ,CAAC,mBAAmB,GAAG,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,GAAG,CAAC;QACtD,IAAI,OAAO,GACT,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,oBAAoB;YACzC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QACxE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,gBAAgB,CAAC;iBACxB,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,cAAc,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBAC7F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;iBACpF,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB;gBACE,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,MAAM;gBACN,KAAK,EAAE,cAAc,CAAC,WAAW,EAAE;aACpC,EACD,kGAAkG,CACnG,CAAC;YACF,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACtE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,wCAAwC,CAAC,CACnG,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GACjB,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;YAChD,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;YACpF,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACtC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YAC7C,OAAO;YACP,cAAc,EAAE,UAAU;YAC1B,SAAS,EAAE,KAAK;YAChB,aAAa;YACb,GAAG;SACJ,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,QAA4B,EAC5B,KAQC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,iBAAiB,CAAC;aACzB,GAAG,CAAC;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC5C,SAAS,EAAE,CAAC;QACf,OAAO,GAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAiB;QACjD,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,UAAkB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC;gBACH,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAC3E,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;iBACzF,SAAS,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,UAAU,EAAE,CAAC,CAAC;YACrF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACtE,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,6EAA6E;QAC7E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAC1F,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAA4B,EAAE,MAAc,EAAE,KAAW;QAClF,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO;QAC7D,mEAAmE;QACnE,iEAAiE;QACjE,2BAA2B;QAC3B,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACjC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;aACxD,IAAI,CAAC,SAAS,CAAC;aACf,SAAS,CACR,gBAAgB,EAChB,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,EACzC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,EACtD,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;aACA,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;aAC3C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aACnC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;aACjC,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;aAC9C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,yBAAyB,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YACtB,aAAa,EAAE,OAAO,CAAC,IAAI;YAC3B,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,aAAa,EAAE,SAAS,EAAE,IAAI,IAAI,gBAAgB;YAClD,mBAAmB,EAAE,MAAM;YAC3B,cAAc,EAAE,KAAK;YACrB,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,sBAAsB,QAAQ,CAAC,EAAE,EAAE;SACzE,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,KAAK,CAAC,aAAqB;QAC/B,IAAI,aAAa,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;6DAIa,aAAa;;kBAExD,KAAK;;OAEhB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;YAClC,KAAK,IAAI,OAAO,CAAC;YACjB,IAAI,OAAO,GAAG,KAAK;gBAAE,MAAM;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6EAA6E;IAE7E,qFAAqF;IACrF,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC;YACH,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,sBAAsB;gBAAE,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACjG,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CACf,MAAqC,EACrC,OAA6C;QAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,OAAO,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,GAAG;gBAAE,SAAS;YAC9B,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,mBAAmB,CAC3B,eAAe,EACf,IAAI,OAAO,4CAA4C,CACxD,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,IAAI,OAAO,yCAAyC,CAAC,CAAC;YACvG,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,IAAI,GAAG,qCAAqC,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,SAAiB,EACjB,KAA4B;QAE5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,gBAAgB,CAAC;aACxB,MAAM,CAAC;YACN,WAAW;YACX,SAAS;YACT,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;YACpC,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;YAC9B,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;SAC9B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,GAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI,CACR,WAAmB,EACnB,MAA0B,EAC1B,KAAa;QAEb,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5B,MAAM,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;aAC3F,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,CAAC;oBAChB,EAAE,EAAE,gBAAgB,CAAC,EAAE;oBACvB,SAAS,EAAE,gBAAgB,CAAC,SAAS;oBACrC,MAAM,EAAE,KAAK;iBACd,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;aACpE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAChD,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;SACrG,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,CAAQ,eAAe,EAAE,CAAC;aACzC,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,EAAU,EACV,KAA4B;QAE5B,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,gBAAgB,CAAC;aACxB,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,wEAAwE;YACxE,GAAG,CAAC,SAAS;gBACX,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;gBAC1F,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;aACtF,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,EAAU;QAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,gBAAgB,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;aACtF,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,EAAU;QAEV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACvC,MAAM,uBAAuB,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,gBAAgB,CAAC;aACxB,GAAG,CAAC;YACH,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7B,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,uBAAuB;YACvB,SAAS,EAAE,GAAG;SACf,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAClC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,cAAc,CAAC,GAAI,CAAC;YAC9B,MAAM;YACN,uBAAuB,EAAE,uBAAuB,CAAC,WAAW,EAAE;SAC/D,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,EAAU,EAAE,MAAqB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAoB;YAC3B,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW;YACX,QAAQ,EAAE,EAAE;YACZ,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE;SACjC,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,iBAAiB,CAAC;aACzB,MAAM,CAAC;YACN,UAAU,EAAE,EAAE;YACd,WAAW;YACX,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,SAAS,EAAE,GAAG,CAAC,IAAI;YACnB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAC7B,MAAM,EAAE,SAAS;SAClB,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,EAAU,EACV,KAAwG;QAExG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5B,MAAM,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;aAC7F,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC,EACpC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EACrE,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,CAAC;oBAChB,EAAE,EAAE,iBAAiB,CAAC,EAAE;oBACxB,SAAS,EAAE,iBAAiB,CAAC,SAAS;oBACtC,MAAM,EAAE,KAAK;iBACd,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;aACtE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAClD,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;SACrG,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,EAAU,EAAE,UAAkB;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,sHAAsH;IACtH,KAAK,CAAC,SAAS,CAAC,WAAmB,EAAE,EAAU,EAAE,UAAkB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACtD,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;iBACxB,MAAM,CAAC,iBAAiB,CAAC;iBACzB,MAAM,CAAC;gBACN,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,SAAS;aAClB,CAAC;iBACD,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,QAAS,CAAC,EAAE,CAAC,CAAC;YAC3C,OAAO,QAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,EAAU;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;aACtF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,WAAmB,EACnB,EAAU,EACV,UAAkB;QAElB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,iBAAiB,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,EACpC,EAAE,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,CAAC,EACpC,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CAC/C,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF;AAED,0FAA0F;AAC1F,SAAS,gBAAgB,CAAC,OAA6C;IACrE,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;QACjD,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,WAAW,EAAE,IAAI,IAAI;QACzD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,EAAE,WAAW,EAAE,IAAI,IAAI;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,IAAI;QACvD,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QACnD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC"}
@@ -0,0 +1,40 @@
1
+ /**
2
+ * Standard Webhooks signing (https://www.standardwebhooks.com/, the symmetric
3
+ * `v1` scheme): the signed content is `${id}.${timestamp}.${body}`, HMAC-SHA256
4
+ * keyed with the secret's raw bytes (the standard base64 after the `whsec_`
5
+ * prefix), the timestamp in unix SECONDS. A delivery carries three headers:
6
+ * `webhook-id`, `webhook-timestamp`, and `webhook-signature`, a space-separated
7
+ * list of `v1,<standard base64>` entries (one per live secret, so a receiver
8
+ * holding either the old or the new secret verifies during a rotation).
9
+ *
10
+ * The body is signed exactly as it is sent: the caller serialises once and
11
+ * passes the same string here and to the request.
12
+ */
13
+ export declare const WEBHOOK_SECRET_PREFIX = "whsec_";
14
+ export declare class SigningError extends Error {
15
+ readonly code: 'malformed_secret' | 'no_secret';
16
+ constructor(code: 'malformed_secret' | 'no_secret', message: string);
17
+ }
18
+ /** A new secret: the prefix + 24 random bytes, standard base64. */
19
+ export declare function generateWebhookSecret(): string;
20
+ /** The raw key bytes of a secret; throws SigningError('malformed_secret') when the prefix or the base64 is wrong. */
21
+ export declare function webhookSecretKey(secret: string): Buffer;
22
+ /** The `webhook-signature` header value: one `v1,<b64>` entry per secret, space-separated (two during a rotation overlap). */
23
+ export declare function signWebhook(secrets: readonly string[], id: string, timestampSeconds: number, body: string): string;
24
+ /** The three Standard Webhooks headers plus content-type: { 'webhook-id', 'webhook-timestamp', 'webhook-signature', 'content-type': 'application/json' }. */
25
+ export declare function webhookHeaders(secrets: readonly string[], id: string, timestampSeconds: number, body: string): Record<string, string>;
26
+ /**
27
+ * A receiver's check, used by the tests and quoted in the docs: any `v1,` entry of the header verifies
28
+ * under this secret (constant-time compare), and the timestamp is within `toleranceSeconds` (default 300)
29
+ * of `now` (default Date.now()/1000). A malformed secret throws (a configuration error); anything wrong
30
+ * with the headers or the body answers false.
31
+ */
32
+ export declare function verifyWebhookSignature(secret: string, headers: {
33
+ id: string;
34
+ timestamp: string;
35
+ signature: string;
36
+ }, body: string, opts?: {
37
+ nowSeconds?: number;
38
+ toleranceSeconds?: number;
39
+ }): boolean;
40
+ //# sourceMappingURL=signing.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/webhooks/signing.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAS9C,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CAAC;gBACpC,IAAI,EAAE,kBAAkB,GAAG,WAAW,EAAE,OAAO,EAAE,MAAM;CAKpE;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,qHAAqH;AACrH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAoBvD;AAYD,8HAA8H;AAC9H,wBAAgB,WAAW,CACzB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,MAAM,EACxB,IAAI,EAAE,MAAM,GACX,MAAM,CAQR;AAED,6JAA6J;AAC7J,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,MAAM,EACxB,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5D,OAAO,CAkBT"}
@@ -0,0 +1,108 @@
1
+ import { createHmac, randomBytes } from 'node:crypto';
2
+ import { constantTimeEquals } from '../constant-time.js';
3
+ /**
4
+ * Standard Webhooks signing (https://www.standardwebhooks.com/, the symmetric
5
+ * `v1` scheme): the signed content is `${id}.${timestamp}.${body}`, HMAC-SHA256
6
+ * keyed with the secret's raw bytes (the standard base64 after the `whsec_`
7
+ * prefix), the timestamp in unix SECONDS. A delivery carries three headers:
8
+ * `webhook-id`, `webhook-timestamp`, and `webhook-signature`, a space-separated
9
+ * list of `v1,<standard base64>` entries (one per live secret, so a receiver
10
+ * holding either the old or the new secret verifies during a rotation).
11
+ *
12
+ * The body is signed exactly as it is sent: the caller serialises once and
13
+ * passes the same string here and to the request.
14
+ */
15
+ export const WEBHOOK_SECRET_PREFIX = 'whsec_';
16
+ /** The spec's bounds on a secret's raw length. */
17
+ const MIN_SECRET_BYTES = 24;
18
+ const MAX_SECRET_BYTES = 64;
19
+ const GENERATED_SECRET_BYTES = 24;
20
+ const DEFAULT_TOLERANCE_SECONDS = 300;
21
+ const STANDARD_BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
22
+ export class SigningError extends Error {
23
+ code;
24
+ constructor(code, message) {
25
+ super(message);
26
+ this.name = 'SigningError';
27
+ this.code = code;
28
+ }
29
+ }
30
+ /** A new secret: the prefix + 24 random bytes, standard base64. */
31
+ export function generateWebhookSecret() {
32
+ return WEBHOOK_SECRET_PREFIX + randomBytes(GENERATED_SECRET_BYTES).toString('base64');
33
+ }
34
+ /** The raw key bytes of a secret; throws SigningError('malformed_secret') when the prefix or the base64 is wrong. */
35
+ export function webhookSecretKey(secret) {
36
+ if (typeof secret !== 'string' || !secret.startsWith(WEBHOOK_SECRET_PREFIX)) {
37
+ throw new SigningError('malformed_secret', `a webhook secret starts with ${WEBHOOK_SECRET_PREFIX}`);
38
+ }
39
+ const encoded = secret.slice(WEBHOOK_SECRET_PREFIX.length);
40
+ if (encoded.length % 4 !== 0 || !STANDARD_BASE64.test(encoded)) {
41
+ throw new SigningError('malformed_secret', 'a webhook secret is standard base64 after its prefix');
42
+ }
43
+ const key = Buffer.from(encoded, 'base64');
44
+ // Buffer.from tolerates non-canonical padding bits: only the one spelling passes.
45
+ if (key.toString('base64') !== encoded) {
46
+ throw new SigningError('malformed_secret', 'a webhook secret is canonical standard base64');
47
+ }
48
+ if (key.length < MIN_SECRET_BYTES || key.length > MAX_SECRET_BYTES) {
49
+ throw new SigningError('malformed_secret', `a webhook secret holds ${MIN_SECRET_BYTES} to ${MAX_SECRET_BYTES} bytes`);
50
+ }
51
+ return key;
52
+ }
53
+ function signature(key, id, timestamp, body) {
54
+ return createHmac('sha256', key).update(`${id}.${timestamp}.${body}`, 'utf8').digest('base64');
55
+ }
56
+ function assertTimestamp(timestampSeconds) {
57
+ if (!Number.isSafeInteger(timestampSeconds) || timestampSeconds < 0) {
58
+ throw new RangeError('a webhook timestamp is a whole number of unix seconds');
59
+ }
60
+ }
61
+ /** The `webhook-signature` header value: one `v1,<b64>` entry per secret, space-separated (two during a rotation overlap). */
62
+ export function signWebhook(secrets, id, timestampSeconds, body) {
63
+ if (secrets.length === 0) {
64
+ throw new SigningError('no_secret', 'a webhook is signed with at least one secret');
65
+ }
66
+ assertTimestamp(timestampSeconds);
67
+ return secrets
68
+ .map((secret) => `v1,${signature(webhookSecretKey(secret), id, timestampSeconds, body)}`)
69
+ .join(' ');
70
+ }
71
+ /** The three Standard Webhooks headers plus content-type: { 'webhook-id', 'webhook-timestamp', 'webhook-signature', 'content-type': 'application/json' }. */
72
+ export function webhookHeaders(secrets, id, timestampSeconds, body) {
73
+ return {
74
+ 'webhook-id': id,
75
+ 'webhook-timestamp': String(timestampSeconds),
76
+ 'webhook-signature': signWebhook(secrets, id, timestampSeconds, body),
77
+ 'content-type': 'application/json'
78
+ };
79
+ }
80
+ /**
81
+ * A receiver's check, used by the tests and quoted in the docs: any `v1,` entry of the header verifies
82
+ * under this secret (constant-time compare), and the timestamp is within `toleranceSeconds` (default 300)
83
+ * of `now` (default Date.now()/1000). A malformed secret throws (a configuration error); anything wrong
84
+ * with the headers or the body answers false.
85
+ */
86
+ export function verifyWebhookSignature(secret, headers, body, opts = {}) {
87
+ const key = webhookSecretKey(secret);
88
+ if (!/^\d{1,15}$/.test(headers.timestamp))
89
+ return false;
90
+ const timestamp = Number(headers.timestamp);
91
+ const now = opts.nowSeconds ?? Date.now() / 1000;
92
+ const tolerance = opts.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
93
+ if (!(Math.abs(now - timestamp) <= tolerance))
94
+ return false;
95
+ // The receiver signs the header's own text, as the sender did.
96
+ const expected = signature(key, headers.id, headers.timestamp, body);
97
+ let verified = false;
98
+ for (const entry of headers.signature.split(' ')) {
99
+ const comma = entry.indexOf(',');
100
+ if (comma === -1 || entry.slice(0, comma) !== 'v1')
101
+ continue;
102
+ // Every entry is compared, so the answer's timing does not tell which one matched.
103
+ if (constantTimeEquals(entry.slice(comma + 1), expected))
104
+ verified = true;
105
+ }
106
+ return verified;
107
+ }
108
+ //# sourceMappingURL=signing.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/webhooks/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,kDAAkD;AAClD,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmC;IAChD,YAAY,IAAsC,EAAE,OAAe;QACjE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,UAAU,qBAAqB;IACnC,OAAO,qBAAqB,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,gCAAgC,qBAAqB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,kFAAkF;IAClF,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,gBAAgB,IAAI,GAAG,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACnE,MAAM,IAAI,YAAY,CACpB,kBAAkB,EAClB,0BAA0B,gBAAgB,OAAO,gBAAgB,QAAQ,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,EAAU,EAAE,SAA0B,EAAE,IAAY;IAClF,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,eAAe,CAAC,gBAAwB;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,WAAW,CACzB,OAA0B,EAC1B,EAAU,EACV,gBAAwB,EACxB,IAAY;IAEZ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,8CAA8C,CAAC,CAAC;IACtF,CAAC;IACD,eAAe,CAAC,gBAAgB,CAAC,CAAC;IAClC,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC;SACxF,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,6JAA6J;AAC7J,MAAM,UAAU,cAAc,CAC5B,OAA0B,EAC1B,EAAU,EACV,gBAAwB,EACxB,IAAY;IAEZ,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC;QAC7C,mBAAmB,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC;QACrE,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,OAA6D,EAC7D,IAAY,EACZ,OAA2D,EAAE;IAE7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;IACrE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5D,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI;YAAE,SAAS;QAC7D,mFAAmF;QACnF,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
@@ -0,0 +1,31 @@
1
+ import type PgBoss from 'pg-boss';
2
+ import type { DbConn } from '@antasphere/chassis-db';
3
+ /**
4
+ * A pg-boss send INSIDE a drizzle transaction (or on a plain handle): the job
5
+ * row is written by the same connection as the caller's own rows, so it
6
+ * commits with them and never exists for a rolled-back write. pg-boss takes
7
+ * an executor (`db.executeSql(text, values)`), and the executor here is the
8
+ * connection drizzle's handle wraps: a `pg` PoolClient inside a transaction,
9
+ * the Pool outside one. The statement runs exactly as pg-boss wrote it, its
10
+ * `$n` placeholders untouched: a placeholder pg-boss reuses three times with
11
+ * three casts (`right($5,1)`, `CAST($5 as timestamptz)`, `COALESCE($5,'0')`)
12
+ * keeps its one type, where a rebinding into drizzle's own parameters gave
13
+ * each occurrence a type of its own and refused a `startAfter` in seconds
14
+ * (the chassis suite, scenario 8).
15
+ *
16
+ * The connection is reached through drizzle's node-postgres session
17
+ * (`session.client`), an internal of the driver binding; `tx-send.test.ts`
18
+ * pins the shape against the installed version. A drizzle bump re-verifies it.
19
+ */
20
+ interface QueryClient {
21
+ query(text: string, values: unknown[]): Promise<{
22
+ rows: unknown[];
23
+ }>;
24
+ }
25
+ /** The pg client (or pool) behind a drizzle handle or transaction. */
26
+ export declare function connectionOf(conn: DbConn): QueryClient;
27
+ export declare function drizzleExecutor(conn: DbConn): PgBoss.Db;
28
+ /** Send one job through `conn`; answers the job id (null when the queue does not exist). */
29
+ export declare function sendInTx(boss: PgBoss, conn: DbConn, queue: string, data: object, options?: PgBoss.SendOptions): Promise<string | null>;
30
+ export {};
31
+ //# sourceMappingURL=tx-send.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"tx-send.d.ts","sourceRoot":"","sources":["../../src/webhooks/tx-send.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;;;;;;;;;;GAgBG;AACH,UAAU,WAAW;IACnB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAMtD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,CAQvD;AAED,4FAA4F;AAC5F,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,CAAC,WAAgB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB"}
@@ -0,0 +1,22 @@
1
+ /** The pg client (or pool) behind a drizzle handle or transaction. */
2
+ export function connectionOf(conn) {
3
+ const client = conn.session?.client;
4
+ if (!client || typeof client.query !== 'function') {
5
+ throw new Error('tx-send: the drizzle handle exposes no node-postgres client (session.client)');
6
+ }
7
+ return client;
8
+ }
9
+ export function drizzleExecutor(conn) {
10
+ const client = connectionOf(conn);
11
+ return {
12
+ executeSql: async (text, values) => {
13
+ const res = await client.query(text, values);
14
+ return { rows: res.rows };
15
+ }
16
+ };
17
+ }
18
+ /** Send one job through `conn`; answers the job id (null when the queue does not exist). */
19
+ export function sendInTx(boss, conn, queue, data, options = {}) {
20
+ return boss.send(queue, data, { ...options, db: drizzleExecutor(conn) });
21
+ }
22
+ //# sourceMappingURL=tx-send.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"tx-send.js","sourceRoot":"","sources":["../../src/webhooks/tx-send.ts"],"names":[],"mappings":"AAwBA,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,MAAM,GAAI,IAAmE,CAAC,OAAO,EAAE,MAAM,CAAC;IACpG,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,IAAY,EAAE,MAAiB,EAAE,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAiC,EAAE,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,QAAQ,CACtB,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,IAAY,EACZ,UAA8B,EAAE;IAEhC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@antasphere/chassis-server",
3
- "version": "1.0.2",
3
+ "version": "1.2.0",
4
4
  "license": "SEE LICENSE IN LICENSE",
5
5
  "repository": {
6
6
  "type": "git",
@@ -54,6 +54,10 @@
54
54
  "types": "./dist/apikeys/index.d.ts",
55
55
  "default": "./dist/apikeys/index.js"
56
56
  },
57
+ "./cli-package": {
58
+ "types": "./dist/cli-package/index.d.ts",
59
+ "default": "./dist/cli-package/index.js"
60
+ },
57
61
  "./accounts": {
58
62
  "types": "./dist/accounts/index.d.ts",
59
63
  "default": "./dist/accounts/index.js"
@@ -101,6 +105,10 @@
101
105
  "./testing": {
102
106
  "types": "./dist/testing/index.d.ts",
103
107
  "default": "./dist/testing/index.js"
108
+ },
109
+ "./webhooks": {
110
+ "types": "./dist/webhooks/index.d.ts",
111
+ "default": "./dist/webhooks/index.js"
104
112
  }
105
113
  },
106
114
  "dependencies": {
@@ -131,8 +139,8 @@
131
139
  "ulid": "^3.0.2",
132
140
  "yazl": "^3.3.1",
133
141
  "zod": "^4.1.0",
134
- "@antasphere/chassis-contract": "1.0.2",
135
- "@antasphere/chassis-db": "1.0.2"
142
+ "@antasphere/chassis-contract": "1.2.0",
143
+ "@antasphere/chassis-db": "1.2.0"
136
144
  },
137
145
  "devDependencies": {
138
146
  "@better-auth/core": "1.6.22",
@@ -6,6 +6,7 @@ import { sql } from 'drizzle-orm';
6
6
  import type { ApiKeyService } from '../apikeys/service.js';
7
7
  import { cursorRowId, keysetBefore, pageOf } from '../pagination.js';
8
8
  import { requireAuth } from '../middleware/auth-context.js';
9
+ import type { EventBus } from '../platform/events.js';
9
10
 
10
11
  const err = (code: string, message: string) => ({ error: { code, message } });
11
12
 
@@ -34,7 +35,9 @@ export function registerApiKeyRoutes(
34
35
  api: OpenAPIHono,
35
36
  db: Db,
36
37
  service: ApiKeyService,
37
- routes: Pick<ScopeRoutes, 'apiKeysListRoute' | 'apiKeyCreateRoute' | 'apiKeyRevokeRoute'>
38
+ routes: Pick<ScopeRoutes, 'apiKeysListRoute' | 'apiKeyCreateRoute' | 'apiKeyRevokeRoute'>,
39
+ /** The bus, for `apikey.created` and `apikey.revoked` after the write (the webhooks bridge them). */
40
+ events?: EventBus
38
41
  ): void {
39
42
  const { apiKeysListRoute, apiKeyCreateRoute, apiKeyRevokeRoute } = routes;
40
43
  api.use('/api-keys', requireAuth());
@@ -109,6 +112,10 @@ export function registerApiKeyRoutes(
109
112
  expiresAt
110
113
  });
111
114
  const [row] = await db.select().from(apiKeys).where(eq(apiKeys.id, minted.id)).limit(1);
115
+ events?.emit('apikey.created', {
116
+ workspaceId: body.workspaceId ?? principal.workspaceId,
117
+ apiKeyId: minted.id
118
+ });
112
119
  c.set('audit', {
113
120
  action: 'apikey.create',
114
121
  resourceType: 'api_key',
@@ -141,6 +148,10 @@ export function registerApiKeyRoutes(
141
148
  .where(eq(apiKeys.id, key.id));
142
149
  }
143
150
  const [updated] = await db.select().from(apiKeys).where(eq(apiKeys.id, key.id)).limit(1);
151
+ events?.emit('apikey.revoked', {
152
+ workspaceId: key.workspaceId ?? principal.workspaceId,
153
+ apiKeyId: key.id
154
+ });
144
155
  c.set('audit', { action: 'apikey.revoke', resourceType: 'api_key', resourceId: key.id });
145
156
  return c.json(toWire(updated!), 200);
146
157
  });
@@ -0,0 +1,151 @@
1
+ import { createReadStream, statSync, type Stats } from 'node:fs';
2
+ import { Readable } from 'node:stream';
3
+ import type { OpenAPIHono } from '@hono/zod-openapi';
4
+ import { lt, sql } from 'drizzle-orm';
5
+ import type { cliPackageRoute } from '@antasphere/chassis-contract/routes';
6
+ import { ssoConnectJtis, type Db } from '@antasphere/chassis-db';
7
+ import type { HubConnectAssertion, HubSsoService } from '../identity/hub-sso.js';
8
+ import type { CliPackage } from '../cli-package/index.js';
9
+ import type { Logger } from '../logger.js';
10
+
11
+ const err = (code: string, message: string) => ({ error: { code, message } });
12
+
13
+ /**
14
+ * The tool's own CLI package (cloud edition ONLY, PRDCT-3312):
15
+ *
16
+ * POST /cli/package → verify a hub-minted 120 s exchange JWT (the same H3
17
+ * token `/sso/cli-connect` takes), burn its jti, stream the tarball the
18
+ * release packed (`CLI_PACKAGE_DIR`, cli-package/index.ts)
19
+ *
20
+ * The public `team` command installs each internal tool's private CLI from
21
+ * here: the hub mints the token only for a member it lets into the tool
22
+ * (its 403 `tool_access_denied` otherwise), so holding a valid one IS the
23
+ * access decision, and this route adds none of its own.
24
+ *
25
+ * Registered by create-api.ts ONLY when the instance boots EDITION=cloud,
26
+ * beside `/sso/cli-connect` and for the same reason: an oss boot never
27
+ * mounts this module, so the path answers the JSON 404 terminator there
28
+ * (zero hub surface). Rate-limited on the CLI-connect wall (the same hub
29
+ * token, the same cost).
30
+ *
31
+ * NOT a public path and unlisted in the machine scope allowlist, on
32
+ * purpose: the token rides in the BODY, never in `Authorization` (a
33
+ * three-part bearer reads as an OAuth token to the scope gate). A request
34
+ * carrying no credential reaches this handler with no principal; an API key
35
+ * or an OAuth bearer meets the fail-closed 403 `endpoint_not_allowed` before
36
+ * it (middleware/scopes.ts).
37
+ *
38
+ * Verification discipline is sso-connect.ts's, unchanged:
39
+ *
40
+ * - the token passes `HubSsoService.verifyConnectToken` — hub-JWKS
41
+ * signature, iss pinned to the hub, aud pinned to OUR resource URL,
42
+ * RS256 only, expiry, `purpose: 'sso-connect'` required, `jti` required;
43
+ * - the `jti` is consumed ONE-TIME-USE in the SAME `sso_connect_jtis`
44
+ * ledger, insert-first: a token spent here cannot then mint a key at
45
+ * `/sso/cli-connect`, and the other way round;
46
+ * - every verification failure (signature, iss, aud, purpose, expiry,
47
+ * replay) answers ONE uniform 401 — no oracle for probing tokens.
48
+ *
49
+ * Only after the token is spent does the route say whether a package
50
+ * exists (404 `cli_not_packaged`): an unverified caller learns nothing
51
+ * about the instance's release.
52
+ */
53
+
54
+ export interface CliPackageRouteDeps {
55
+ db: Db;
56
+ hubSso: HubSsoService;
57
+ /** What the boot read off `CLI_PACKAGE_DIR`; null = released without its CLI package. */
58
+ cliPackage: CliPackage | null;
59
+ logger: Logger;
60
+ routes: { cliPackageRoute: typeof cliPackageRoute };
61
+ }
62
+
63
+ export function registerCliPackageRoutes(api: OpenAPIHono, deps: CliPackageRouteDeps): void {
64
+ const { db, hubSso, cliPackage, logger } = deps;
65
+ const { cliPackageRoute } = deps.routes;
66
+
67
+ api.openapi(cliPackageRoute, async (c) => {
68
+ const body = c.req.valid('json');
69
+
70
+ // 1. Verify hard. One uniform 401 for every rejection reason.
71
+ let assertion: HubConnectAssertion;
72
+ try {
73
+ assertion = await hubSso.verifyConnectToken(body.token);
74
+ } catch (cause) {
75
+ logger.warn({ err: cause }, 'cli package: exchange token rejected');
76
+ return c.json(err('invalid_token', 'The exchange token is invalid, expired, or already used'), 401);
77
+ }
78
+
79
+ // 2. Burn the jti (one-time-use, G8), in the ledger /sso/cli-connect
80
+ // burns into. Insert-first: the claim precedes any effect, so a replay —
81
+ // even a concurrent one — downloads nothing. The sweep keeps the ledger
82
+ // tiny; best-effort, never correctness-bearing (expired rows only shadow
83
+ // jtis of already-expired tokens).
84
+ void db
85
+ .delete(ssoConnectJtis)
86
+ .where(lt(ssoConnectJtis.expiresAt, sql`now() - interval '1 minute'`))
87
+ .catch(() => {});
88
+ const claimed = await db
89
+ .insert(ssoConnectJtis)
90
+ .values({ jti: assertion.jti, expiresAt: assertion.expiresAt })
91
+ .onConflictDoNothing()
92
+ .returning({ jti: ssoConnectJtis.jti });
93
+ if (claimed.length === 0) {
94
+ logger.warn({ jti: assertion.jti }, 'cli package: replayed jti rejected');
95
+ return c.json(err('invalid_token', 'The exchange token is invalid, expired, or already used'), 401);
96
+ }
97
+
98
+ // 3. Released without its CLI package: say so, with a sentence the
99
+ // `team` command can print as it is. The boot's read names what the
100
+ // image packed; the file is statted again HERE, after the burn, so a
101
+ // folder changed under a running instance answers the same 404 instead
102
+ // of a 200 whose body and length disagree.
103
+ const notPackaged = () =>
104
+ c.json(
105
+ err(
106
+ 'cli_not_packaged',
107
+ 'This instance was released without its CLI package, so it has none to serve'
108
+ ),
109
+ 404
110
+ );
111
+ if (cliPackage === null) return notPackaged();
112
+ let stat: Stats;
113
+ try {
114
+ stat = statSync(cliPackage.path);
115
+ } catch (cause) {
116
+ logger.error({ err: cause, path: cliPackage.path }, 'cli package: the tarball read at boot is gone');
117
+ return notPackaged();
118
+ }
119
+ if (!stat.isFile()) {
120
+ logger.error({ path: cliPackage.path }, 'cli package: the tarball read at boot is no longer a file');
121
+ return notPackaged();
122
+ }
123
+
124
+ // 4. Stream the tarball. The bytes are the release's, never a person's,
125
+ // but they are served as an attachment and never sniffed all the same;
126
+ // no-store, so a shared cache never answers the next exchange.
127
+ logger.info(
128
+ {
129
+ hubSub: assertion.sub,
130
+ email: assertion.email,
131
+ package: cliPackage.name,
132
+ version: cliPackage.version
133
+ },
134
+ 'cli package: served'
135
+ );
136
+ const nodeStream = createReadStream(cliPackage.path);
137
+ // Backpressure rides Readable.toWeb; a client abort must destroy the
138
+ // source or every abandoned download leaks a descriptor (files/serve.ts).
139
+ c.req.raw.signal.addEventListener('abort', () => nodeStream.destroy());
140
+ const web = Readable.toWeb(nodeStream) as unknown as ReadableStream;
141
+ return c.body(web, 200, {
142
+ 'content-type': 'application/gzip',
143
+ 'content-disposition': `attachment; filename="${cliPackage.filename}"`,
144
+ // The size statted now, never the boot's: the header and the bytes agree.
145
+ 'content-length': String(stat.size),
146
+ // Also set on every response by the global security-headers middleware.
147
+ 'x-content-type-options': 'nosniff',
148
+ 'cache-control': 'no-store'
149
+ });
150
+ });
151
+ }