@antasphere/chassis-server 1.0.2 → 1.2.0

package/dist/mcp/webhooks.js

@@ -0,0 +1,226 @@
+import { z } from 'zod';
+import { webhookDeliveryStatusSchema, webhookEventPatternSchema, webhookFiltersSchema, webhookUrlSchema } from '@antasphere/chassis-contract';
+import { mcpInputs } from './inputs.js';
+import { deny, jsonText, wrapToolErrors } from './errors.js';
+import { callApi, forWorkspace, pageQuery } from './tool-kit.js';
+/**
+ * The eleven WEBHOOK tools (PRDCT-3482), registered by the chassis right after
+ * the team reads and only when the tool declares a webhooks scope: a webhook
+ * is a chassis concept (a URL a workspace registers to be told, by a signed
+ * POST, when one of the tool's events happens), so the tools over it are the
+ * chassis'. Thin shims over the instance's own /api/v1/webhooks called
+ * IN-PROCESS with the caller's bearer forwarded verbatim: the API's
+ * fail-closed scope allowlist, its owner-or-admin rule and its 404 for an
+ * endpoint of another workspace apply unchanged.
+ *
+ * Every tool pre-checks the tool's webhooks scope, except the catalog, which
+ * is a read (every non-guest member's, under the read scope). Nothing here
+ * names a tool, a brand or a domain: the prefix arrives as
+ * `identity.toolPrefix`, the event types as the instance's catalog.
+ */
+/** What a webhook IS, opening the descriptions. */
+const WHAT_IS_A_WEBHOOK = 'A webhook is a URL an organization registers to be told, by a signed HTTP POST, when something ' +
+    'happens (for example `thing.created`).';
+/** Who manages them. */
+const WHO_MANAGES = 'Only an owner or an admin of the organization manages webhooks, reads included.';
+/** How the `events` list of an endpoint reads. */
+const EVENT_PATTERNS = 'Each entry of `events` is an exact event type (`thing.created`), a family (`thing.*`) or ' +
+    'everything (`*`).';
+/**
+ * The webhook code only the webhook routes answer, merged into the instance's
+ * hint table by `composeErrorHints` like the project hints. The codes the
+ * webhook routes SHARE with the rest of the instance (`forbidden`,
+ * `demo_session`, `plan_required`) are worded for webhooks on the webhook
+ * tools alone ({@link webhookToolHints}): in the instance's table they would
+ * misread every other route's refusal.
+ */
+export function webhookErrorHints(toolPrefix) {
+    return {
+        url_refused: 'This instance does not deliver to that address. Refused: a scheme other than http or https ' +
+            '(https only on the cloud), a URL carrying a user name or password, a port other than the ' +
+            'scheme’s default, and an address that is not on the public internet (localhost, a private or ' +
+            'link-local network), unless the operator of a self-hosted instance opened private networks. ' +
+            `Use a public address of the receiver, then call ${toolPrefix}create_webhook or ` +
+            `${toolPrefix}update_webhook again.`,
+        unknown_event: 'One of the `events` entries is not an event type or family this instance delivers. ' +
+            `Read ${toolPrefix}webhook_events for the exact types; a family is its first word plus \`.*\`.`,
+        unknown_subject: 'One of the `filters` keys is not a subject this instance declares. ' +
+            `The subject keys are in ${toolPrefix}webhook_events (for example \`project\`).`
+    };
+}
+/** The shared codes, worded for the webhook tools only (layered over the instance's table there). */
+function webhookToolHints(toolPrefix) {
+    return {
+        forbidden: 'Only an owner or an admin of the organization manages webhooks, reads included. Ask one of ' +
+            `them to make the change, or to read the endpoints (${toolPrefix}webhook_events stays open to ` +
+            'every member).',
+        demo_session: 'This connection was opened by a demonstration link, which may not set up webhooks. A person ' +
+            'signed in with their own account must do it.',
+        plan_required: 'The organization’s plan does not include this — the upgrade link in this message is where a ' +
+            'human raises it; nothing was created.'
+    };
+}
+const webhookIdInput = z
+    .uuid()
+    .describe('The webhook id, from the webhook list or the create answer (never its URL).');
+const deliveryIdInput = z.uuid().describe('The delivery id, from the delivery list of this webhook.');
+const urlInput = webhookUrlSchema.describe('Where the deliveries go: a public http or https URL without credentials (https only on the cloud).');
+const eventsInput = z
+    .array(webhookEventPatternSchema)
+    .min(1)
+    .max(50)
+    .describe(`What the endpoint subscribes to. ${EVENT_PATTERNS}`);
+const descriptionInput = z.string().max(200).describe('A short note on what the endpoint is for.');
+const filtersInput = webhookFiltersSchema.describe('Narrows the subscription by subject: a subject key of the catalog (its `subjects[].key`) mapped to ' +
+    'the ids it accepts, AND across keys, OR within a key; an event that does not carry a filtered ' +
+    'subject does not match. An empty object filters nothing.');
+const enabledInput = z.boolean().describe('false pauses the deliveries without deleting the endpoint.');
+/** Register the eleven webhook tools on a server, after the team reads. */
+export function registerWebhookTools(server, ctx, identity, scopes, checkScope, hints) {
+    const webhooksScope = scopes.webhooks;
+    if (!webhooksScope)
+        return;
+    const { workspaceInput, cursorInput, limitInput } = mcpInputs(identity);
+    const prefix = identity.toolPrefix;
+    const t = (name) => `${prefix}${name}`;
+    const toolHints = { ...hints, ...webhookToolHints(prefix) };
+    const run = (scope, workspace, body) => {
+        const denied = checkScope(ctx.principal, scope);
+        if (denied)
+            return Promise.resolve(denied);
+        const c = forWorkspace(ctx, workspace);
+        return wrapToolErrors(async () => jsonText(await body(c)), toolHints);
+    };
+    const send = (method, value) => value === undefined
+        ? { method }
+        : { method, headers: { 'content-type': 'application/json' }, body: JSON.stringify(value) };
+    const base = '/api/v1/webhooks';
+    // ── The catalog: a read ──────────────────────────────────────────────────
+    server.registerTool(t('webhook_events'), {
+        description: `The event catalog of this instance: every event type it delivers to webhooks. ${WHAT_IS_A_WEBHOOK} ` +
+            'Returns { subjects: [{ key, field, description }], events: [{ type, description, subjects, ' +
+            'schema }] } — `subjects` are what an event is about (the key a filter uses, and the field of ' +
+            'the envelope’s `subjects` its value is written under: one id or a list of ids), `schema` is ' +
+            'the JSON Schema of the event’s `data`. ' +
+            `${EVENT_PATTERNS} Read this before ${t('create_webhook')}. Every member may read it.`,
+        inputSchema: { workspace: workspaceInput },
+        annotations: { readOnlyHint: true }
+    }, async ({ workspace }) => run(scopes.read, workspace, (c) => callApi(c, `${base}/events`)));
+    // ── Endpoints ────────────────────────────────────────────────────────────
+    server.registerTool(t('list_webhooks'), {
+        description: `List the organization’s webhooks, newest first. ${WHAT_IS_A_WEBHOOK} ${WHO_MANAGES} Returns ` +
+            '{ webhooks: [{ id, url, description, events, filters, enabled, createdBy, createdAt, ' +
+            'updatedAt, disabledAt, disabledReason, consecutiveFailures, lastDeliveryAt, ' +
+            'lastDeliveryStatus, previousSecretExpiresAt }], nextCursor } — never a signing secret. ' +
+            '`disabledAt` is set when the instance switched the endpoint off after failing too long. When ' +
+            'nextCursor is non-null, call again with cursor set to it.',
+        inputSchema: { workspace: workspaceInput, limit: limitInput, cursor: cursorInput },
+        annotations: { readOnlyHint: true }
+    }, async ({ workspace, limit, cursor }) => run(webhooksScope, workspace, (c) => callApi(c, pageQuery(base, { cursor, limit }))));
+    server.registerTool(t('create_webhook'), {
+        description: `Register a webhook — confirm with the user first (URL and events included). ${WHAT_IS_A_WEBHOOK} ` +
+            `${WHO_MANAGES} ${EVENT_PATTERNS} The types are checked against ${t('webhook_events')}, and ` +
+            'the keys of `filters` are the catalog’s subject keys. The answer is the endpoint plus its ' +
+            'signing `secret` (`whsec_…`), shown ONCE and never again: give it to the receiver, which ' +
+            'verifies every delivery’s Standard Webhooks signature with it, and never store it anywhere ' +
+            `else. A lost secret is replaced by ${t('rotate_webhook_secret')}.`,
+        inputSchema: {
+            workspace: workspaceInput,
+            url: urlInput,
+            events: eventsInput,
+            description: descriptionInput.optional(),
+            filters: filtersInput.optional(),
+            enabled: enabledInput.optional()
+        }
+    }, async ({ workspace, url, events, description, filters, enabled }) => run(webhooksScope, workspace, (c) => callApi(c, base, send('POST', {
+        url,
+        events,
+        ...(description !== undefined ? { description } : {}),
+        ...(filters !== undefined ? { filters } : {}),
+        ...(enabled !== undefined ? { enabled } : {})
+    }))));
+    server.registerTool(t('get_webhook'), {
+        description: `Read one webhook, without its secret. ${WHO_MANAGES} Returns the endpoint as ` +
+            `${t('list_webhooks')} shows it. A webhook of another organization answers not found.`,
+        inputSchema: { workspace: workspaceInput, webhookId: webhookIdInput },
+        annotations: { readOnlyHint: true }
+    }, async ({ workspace, webhookId }) => run(webhooksScope, workspace, (c) => callApi(c, `${base}/${webhookId}`)));
+    server.registerTool(t('update_webhook'), {
+        description: 'Change a webhook’s URL, description, events, filters or enabled switch — confirm with the ' +
+            `user first. ${WHO_MANAGES} Send only the fields you are changing; \`events\` and \`filters\` ` +
+            `REPLACE the whole list or object. ${EVENT_PATTERNS} Setting enabled back to true resumes an ` +
+            'endpoint the instance switched off. The secret is unchanged. Returns the endpoint as it now is.',
+        inputSchema: {
+            workspace: workspaceInput,
+            webhookId: webhookIdInput,
+            url: urlInput.optional(),
+            description: descriptionInput.optional(),
+            events: eventsInput.optional(),
+            filters: filtersInput.optional(),
+            enabled: enabledInput.optional()
+        }
+    }, async ({ workspace, webhookId, url, description, events, filters, enabled }) => {
+        const patch = { url, description, events, filters, enabled };
+        if (Object.values(patch).every((v) => v === undefined)) {
+            return deny('Nothing to change: pass at least one of url, description, events, filters or enabled. ' +
+                `Read the webhook first (${t('get_webhook')}) if you need its current values.`);
+        }
+        const body = Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== undefined));
+        return run(webhooksScope, workspace, (c) => callApi(c, `${base}/${webhookId}`, send('PATCH', body)));
+    });
+    server.registerTool(t('delete_webhook'), {
+        description: 'Delete a webhook and its whole delivery history — confirm with the user first; nothing more ' +
+            `is sent to it and this cannot be undone. ${WHO_MANAGES} To pause it instead, call ` +
+            `${t('update_webhook')} with enabled set to false. Returns a last snapshot of the deleted endpoint.`,
+        inputSchema: { workspace: workspaceInput, webhookId: webhookIdInput },
+        annotations: { destructiveHint: true }
+    }, async ({ workspace, webhookId }) => run(webhooksScope, workspace, (c) => callApi(c, `${base}/${webhookId}`, send('DELETE'))));
+    server.registerTool(t('rotate_webhook_secret'), {
+        description: 'Replace a webhook’s signing secret — confirm with the user first. ' +
+            `${WHO_MANAGES} The answer is the endpoint plus its new \`secret\` (\`whsec_…\`), shown ONCE: ` +
+            'give it to the receiver and never store it anywhere else. The previous secret keeps signing ' +
+            'until `previousSecretExpiresAt`, so the receiver can switch without a gap.',
+        inputSchema: { workspace: workspaceInput, webhookId: webhookIdInput }
+    }, async ({ workspace, webhookId }) => run(webhooksScope, workspace, (c) => callApi(c, `${base}/${webhookId}/rotate-secret`, send('POST'))));
+    server.registerTool(t('test_webhook'), {
+        description: 'Send a signed `webhook.ping` to a webhook now, once, and answer how it went. ' +
+            `${WHO_MANAGES} Returns { delivery: { id, eventId, eventType, status, attempt, ` +
+            'lastStatusCode, lastError, … } } — `status` is `delivered` when the receiver answered 2xx, ' +
+            '`failed` otherwise, with `lastStatusCode` and `lastError` saying why. A ping is never retried.',
+        inputSchema: { workspace: workspaceInput, webhookId: webhookIdInput }
+    }, async ({ workspace, webhookId }) => run(webhooksScope, workspace, (c) => callApi(c, `${base}/${webhookId}/test`, send('POST'))));
+    // ── Deliveries ───────────────────────────────────────────────────────────
+    server.registerTool(t('list_webhook_deliveries'), {
+        description: `List a webhook’s deliveries, newest first, optionally by status. ${WHO_MANAGES} A delivery ` +
+            'is one event sent to this endpoint, with its attempts. Returns { deliveries: [{ id, ' +
+            'endpointId, eventId, eventType, status, attempt, lastStatusCode, lastError, nextAttemptAt, ' +
+            'deliveredAt, createdAt, updatedAt, payload }], nextCursor } — `eventId` is the receiver’s ' +
+            'dedupe key, `lastStatusCode` and `lastError` describe the latest attempt only. When ' +
+            'nextCursor is non-null, call again with cursor set to it.',
+        inputSchema: {
+            workspace: workspaceInput,
+            webhookId: webhookIdInput,
+            status: webhookDeliveryStatusSchema
+                .optional()
+                .describe('`pending` (waiting for an attempt or a retry), `delivered`, `failed`, or `held` (out of ' +
+                'retries, kept for a redelivery).'),
+            limit: limitInput,
+            cursor: cursorInput
+        },
+        annotations: { readOnlyHint: true }
+    }, async ({ workspace, webhookId, status, limit, cursor }) => run(webhooksScope, workspace, (c) => callApi(c, pageQuery(`${base}/${webhookId}/deliveries`, { cursor, limit }, { status }))));
+    server.registerTool(t('get_webhook_delivery'), {
+        description: `Read one delivery of a webhook, with the payload as sent and its latest attempt. ${WHO_MANAGES} ` +
+            `Returns the delivery as ${t('list_webhook_deliveries')} shows it.`,
+        inputSchema: { workspace: workspaceInput, webhookId: webhookIdInput, deliveryId: deliveryIdInput },
+        annotations: { readOnlyHint: true }
+    }, async ({ workspace, webhookId, deliveryId }) => run(webhooksScope, workspace, (c) => callApi(c, `${base}/${webhookId}/deliveries/${deliveryId}`)));
+    server.registerTool(t('redeliver_webhook'), {
+        description: 'Send one delivery’s event to its webhook again, as a new delivery — confirm with the user ' +
+            `first. ${WHO_MANAGES} The new delivery carries the same \`eventId\` (the receiver’s dedupe key) ` +
+            'and the same payload, and is queued: read its outcome later with ' +
+            `${t('get_webhook_delivery')}. Returns the new delivery.`,
+        inputSchema: { workspace: workspaceInput, webhookId: webhookIdInput, deliveryId: deliveryIdInput }
+    }, async ({ workspace, webhookId, deliveryId }) => run(webhooksScope, workspace, (c) => callApi(c, `${base}/${webhookId}/deliveries/${deliveryId}/redeliver`, send('POST'))));
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/mcp/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/mcp/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAwC,MAAM,aAAa,CAAC;AACnG,OAAO,EACL,OAAO,EACP,YAAY,EACZ,SAAS,EAIV,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;;;GAcG;AAEH,mDAAmD;AACnD,MAAM,iBAAiB,GACrB,iGAAiG;IACjG,wCAAwC,CAAC;AAE3C,wBAAwB;AACxB,MAAM,WAAW,GAAG,iFAAiF,CAAC;AAEtG,kDAAkD;AAClD,MAAM,cAAc,GAClB,2FAA2F;IAC3F,mBAAmB,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO;QACL,WAAW,EACT,6FAA6F;YAC7F,2FAA2F;YAC3F,+FAA+F;YAC/F,8FAA8F;YAC9F,mDAAmD,UAAU,oBAAoB;YACjF,GAAG,UAAU,uBAAuB;QACtC,aAAa,EACX,qFAAqF;YACrF,QAAQ,UAAU,6EAA6E;QACjG,eAAe,EACb,qEAAqE;YACrE,2BAA2B,UAAU,2CAA2C;KACnF,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO;QACL,SAAS,EACP,6FAA6F;YAC7F,sDAAsD,UAAU,+BAA+B;YAC/F,gBAAgB;QAClB,YAAY,EACV,8FAA8F;YAC9F,8CAA8C;QAChD,aAAa,EACX,8FAA8F;YAC9F,uCAAuC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC;KACrB,IAAI,EAAE;KACN,QAAQ,CAAC,6EAA6E,CAAC,CAAC;AAE3F,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC,CAAC;AAEtG,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CACxC,oGAAoG,CACrG,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC;KAClB,KAAK,CAAC,yBAAyB,CAAC;KAChC,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,QAAQ,CAAC,oCAAoC,cAAc,EAAE,CAAC,CAAC;AAElE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAEnG,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAChD,qGAAqG;IACnG,gGAAgG;IAChG,0DAA0D,CAC7D,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC,CAAC;AAExG,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAClC,MAAiB,EACjB,GAAmB,EACnB,QAAqB,EACrB,MAAiB,EACjB,UAA8B,EAC9B,KAAiB;IAEjB,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IACtC,IAAI,CAAC,aAAa;QAAE,OAAO;IAC3B,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAe,EAAE,GAAG,KAAK,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;IAExE,MAAM,GAAG,GAAG,CACV,KAAa,EACb,SAA6B,EAC7B,IAA6C,EACpB,EAAE;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACvC,OAAO,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAe,EAAe,EAAE,CAC5D,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,EAAE,MAAM,EAAE;QACZ,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IAE/F,MAAM,IAAI,GAAG,kBAAkB,CAAC;IAEhC,4EAA4E;IAE5E,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,gBAAgB,CAAC,EACnB;QACE,WAAW,EACT,iFAAiF,iBAAiB,GAAG;YACrG,6FAA6F;YAC7F,+FAA+F;YAC/F,8FAA8F;YAC9F,yCAAyC;YACzC,GAAG,cAAc,qBAAqB,CAAC,CAAC,gBAAgB,CAAC,6BAA6B;QACxF,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE;QAC1C,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC,CAC1F,CAAC;IAEF,4EAA4E;IAE5E,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,eAAe,CAAC,EAClB;QACE,WAAW,EACT,mDAAmD,iBAAiB,IAAI,WAAW,WAAW;YAC9F,uFAAuF;YACvF,8EAA8E;YAC9E,yFAAyF;YACzF,+FAA+F;YAC/F,2DAA2D;QAC7D,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE;QAClF,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CACrC,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CACvF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,gBAAgB,CAAC,EACnB;QACE,WAAW,EACT,+EAA+E,iBAAiB,GAAG;YACnG,GAAG,WAAW,IAAI,cAAc,kCAAkC,CAAC,CAAC,gBAAgB,CAAC,QAAQ;YAC7F,4FAA4F;YAC5F,2FAA2F;YAC3F,6FAA6F;YAC7F,sCAAsC,CAAC,CAAC,uBAAuB,CAAC,GAAG;QACrE,WAAW,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;YACxC,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE;YAChC,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE;SACjC;KACF,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAClE,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAClC,OAAO,CACL,CAAC,EACD,IAAI,EACJ,IAAI,CAAC,MAAM,EAAE;QACX,GAAG;QACH,MAAM;QACN,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CACH,CACF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,aAAa,CAAC,EAChB;QACE,WAAW,EACT,yCAAyC,WAAW,2BAA2B;YAC/E,GAAG,CAAC,CAAC,eAAe,CAAC,iEAAiE;QACxF,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE;QACrE,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CACjC,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,CAC3E,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,gBAAgB,CAAC,EACnB;QACE,WAAW,EACT,4FAA4F;YAC5F,eAAe,WAAW,qEAAqE;YAC/F,qCAAqC,cAAc,2CAA2C;YAC9F,iGAAiG;QACnG,WAAW,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,cAAc;YACzB,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;YACxB,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;YACxC,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;YAC9B,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE;YAChC,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE;SACjC;KACF,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC7E,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CACT,wFAAwF;gBACtF,2BAA2B,CAAC,CAAC,aAAa,CAAC,mCAAmC,CACjF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QAC1F,OAAO,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,gBAAgB,CAAC,EACnB;QACE,WAAW,EACT,8FAA8F;YAC9F,4CAA4C,WAAW,6BAA6B;YACpF,GAAG,CAAC,CAAC,gBAAgB,CAAC,8EAA8E;QACtG,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE;QACrE,WAAW,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;KACvC,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CACjC,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC3F,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,uBAAuB,CAAC,EAC1B;QACE,WAAW,EACT,oEAAoE;YACpE,GAAG,WAAW,iFAAiF;YAC/F,8FAA8F;YAC9F,4EAA4E;QAC9E,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE;KACtE,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CACjC,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,SAAS,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CACvG,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,cAAc,CAAC,EACjB;QACE,WAAW,EACT,+EAA+E;YAC/E,GAAG,WAAW,kEAAkE;YAChF,6FAA6F;YAC7F,gGAAgG;QAClG,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE;KACtE,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CACjC,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,SAAS,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAC9F,CAAC;IAEF,4EAA4E;IAE5E,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,yBAAyB,CAAC,EAC5B;QACE,WAAW,EACT,oEAAoE,WAAW,cAAc;YAC7F,sFAAsF;YACtF,6FAA6F;YAC7F,4FAA4F;YAC5F,sFAAsF;YACtF,2DAA2D;QAC7D,WAAW,EAAE;YACX,SAAS,EAAE,cAAc;YACzB,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,2BAA2B;iBAChC,QAAQ,EAAE;iBACV,QAAQ,CACP,0FAA0F;gBACxF,kCAAkC,CACrC;YACH,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,WAAW;SACpB;QACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CACxD,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAClC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,IAAI,IAAI,SAAS,aAAa,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CACxF,CACJ,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,sBAAsB,CAAC,EACzB;QACE,WAAW,EACT,oFAAoF,WAAW,GAAG;YAClG,2BAA2B,CAAC,CAAC,yBAAyB,CAAC,YAAY;QACrE,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE;QAClG,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;KACpC,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAC7C,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,SAAS,eAAe,UAAU,EAAE,CAAC,CAAC,CACpG,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,CAAC,CAAC,mBAAmB,CAAC,EACtB;QACE,WAAW,EACT,4FAA4F;YAC5F,UAAU,WAAW,6EAA6E;YAClG,mEAAmE;YACnE,GAAG,CAAC,CAAC,sBAAsB,CAAC,6BAA6B;QAC3D,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE;KACnG,EACD,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAC7C,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAClC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,SAAS,eAAe,UAAU,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CACpF,CACJ,CAAC;AACJ,CAAC"}

package/dist/members/removal.d.ts

@@ -1,4 +1,5 @@
 import { type DbConn } from '@antasphere/chassis-db';
+import type { WebhookEmitter } from '../webhooks/service.js';
 /**
  * The membership an ADD hangs a right on, re-read inside the add's own
  * transaction and held FOR SHARE until it commits: true when the row is
@@ -36,7 +37,14 @@ export interface RemovedMembership {
  * removal's own transaction and answers what it ended, by name, for the
  * audit record.
  */
-export type MembershipRemovalHook = (tx: DbConn, removed: readonly RemovedMembership[]) => Promise<Record<string, number>>;
+export type MembershipRemovalHook = (tx: DbConn, removed: readonly RemovedMembership[], ctx: MembershipRemovalContext) => Promise<Record<string, number>>;
+/** What the tool's hook receives beside the rows: the webhooks' emitter, to report what it ended inside the same transaction (PRDCT-3483). */
+export interface MembershipRemovalContext {
+    webhooks: WebhookEmitter;
+}
+/** The hook as the chassis calls it, the context bound at boot (`bindMembershipRemoval`). */
+export type BoundMembershipRemoval = (tx: DbConn, removed: readonly RemovedMembership[]) => Promise<Record<string, number>>;
+export declare function bindMembershipRemoval(hook: MembershipRemovalHook | undefined, ctx: MembershipRemovalContext): BoundMembershipRemoval | undefined;
 export interface RemovalCounts {
     projectGrants: number;
     teamSeats: number;
@@ -89,7 +97,7 @@ export interface RemovalCounts {
  * are by membership, the revokes filter on what is still open. The removal
  * route does (a second pass after the row is off, `mergeRemovalCounts`).
  */
-export declare function deleteMembershipGrants(tx: DbConn, removed: readonly RemovedMembership[], toolHook?: MembershipRemovalHook): Promise<RemovalCounts>;
+export declare function deleteMembershipGrants(tx: DbConn, removed: readonly RemovedMembership[], toolHook?: BoundMembershipRemoval): Promise<RemovalCounts>;
 /** Two passes of `deleteMembershipGrants` as one record: every count summed, the tool's by name. */
 export declare function mergeRemovalCounts(a: RemovalCounts, b: RemovalCounts): RemovalCounts;
 //# sourceMappingURL=removal.d.ts.map

package/dist/members/removal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"removal.d.ts","sourceRoot":"","sources":["../../src/members/removal.ts"],"names":[],"mappings":"AACA,OAAO,EAWL,KAAK,MAAM,EACZ,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAclB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,SAAS,iBAAiB,EAAE,KAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;IACpB,4GAA4G;IAC5G,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,QAAQ,CAAC,EAAE,qBAAqB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAwExB;AAED,oGAAoG;AACpG,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,aAAa,CAUpF"}
+{"version":3,"file":"removal.d.ts","sourceRoot":"","sources":["../../src/members/removal.ts"],"names":[],"mappings":"AACA,OAAO,EAWL,KAAK,MAAM,EACZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAclB;AAED,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,GAAG,EAAE,wBAAwB,KAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAErC,8IAA8I;AAC9I,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,6FAA6F;AAC7F,MAAM,MAAM,sBAAsB,GAAG,CACnC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,SAAS,iBAAiB,EAAE,KAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAErC,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAAG,SAAS,EACvC,GAAG,EAAE,wBAAwB,GAC5B,sBAAsB,GAAG,SAAS,CAEpC;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;IACpB,4GAA4G;IAC5G,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,QAAQ,CAAC,EAAE,sBAAsB,GAChC,OAAO,CAAC,aAAa,CAAC,CAwExB;AAED,oGAAoG;AACpG,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,aAAa,CAUpF"}

package/dist/members/removal.js

@@ -27,6 +27,9 @@ export async function holdLiveMembership(tx, workspaceId, who) {
         .limit(1);
     return row !== undefined;
 }
+export function bindMembershipRemoval(hook, ctx) {
+    return hook ? (tx, removed) => hook(tx, removed, ctx) : undefined;
+}
 /**
  * What a REMOVAL takes away beside the membership itself, stated once for
  * both editions (PRDCT-2816): the person's project grants, their team seats

package/dist/members/removal.js.map

@@ -1 +1 @@
-{"version":3,"file":"removal.js","sourceRoot":"","sources":["../../src/members/removal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,OAAO,IAAI,YAAY,EACvB,IAAI,IAAI,SAAS,EACjB,gBAAgB,EAChB,oBAAoB,EAErB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,WAAmB,EACnB,GAA8C;IAE9C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;SACnC,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CACJ,GAAG,CACD,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EACnG,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;SACA,GAAG,CAAC,OAAO,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAU,EACV,OAAqC,EACrC,QAAgC;IAEhC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,cAAc,CAAC;SACtB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;SAC5C,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,oBAAoB,CAAC;SAC5B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;SAClD,SAAS,CAAC,EAAE,EAAE,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EACvC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAC5B,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CACpE,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,CACf,MAAM,EAAE;iBACL,MAAM,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,CAAC;iBACjD,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CACpD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACvF,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACzF,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACvF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC1E,CAAC;YACD,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC;QACjC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;aAClC,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC/B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAC9B,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,EAC7B,MAAM;YACJ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,CAAA,SAAS,WAAW,CAAC,KAAK,aAAa,MAAM,CAAC,KAAK,GAAG,CAAC;YAClG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CACtC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,WAAW,EAAE,kBAAkB;QAC/B,UAAU,EAAE,aAAa;QACzB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAAC,CAAgB,EAAE,CAAgB;IACnE,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa;QAChD,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;QACpC,WAAW,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW;QAC1C,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;QACvC,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"removal.js","sourceRoot":"","sources":["../../src/members/removal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,OAAO,IAAI,YAAY,EACvB,IAAI,IAAI,SAAS,EACjB,gBAAgB,EAChB,oBAAoB,EAErB,MAAM,wBAAwB,CAAC;AAGhC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,WAAmB,EACnB,GAA8C;IAE9C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;SACnC,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CACJ,GAAG,CACD,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EACnG,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;SACA,GAAG,CAAC,OAAO,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAkCD,MAAM,UAAU,qBAAqB,CACnC,IAAuC,EACvC,GAA6B;IAE7B,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAU,EACV,OAAqC,EACrC,QAAiC;IAEjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,cAAc,CAAC;SACtB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;SAC5C,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,oBAAoB,CAAC;SAC5B,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;SAClD,SAAS,CAAC,EAAE,EAAE,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EACvC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAC5B,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CACpE,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,CACf,MAAM,EAAE;iBACL,MAAM,CAAC,EAAE,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,CAAC;iBACjD,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CACpD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACvF,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACzF,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACvF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC1E,CAAC;YACD,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC;QACjC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;aAClC,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC/B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,WAAW,CAAC;aACnB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,EACxC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAC9B,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,EAC7B,MAAM;YACJ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,CAAA,SAAS,WAAW,CAAC,KAAK,aAAa,MAAM,CAAC,KAAK,GAAG,CAAC;YAClG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CACtC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO;QACL,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,WAAW,EAAE,kBAAkB;QAC/B,UAAU,EAAE,aAAa;QACzB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAAC,CAAgB,EAAE,CAAgB;IACnE,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa;QAChD,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;QACpC,WAAW,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW;QAC1C,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;QACvC,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/middleware/idempotency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,EAAmB,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAkGlE,kFAAkF;AAClF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,sFAAsF;AACtF,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYtE;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACzC;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,eAAe,GAAG,iBAAiB,CAmI/F"}
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAG9C,OAAO,EAAmB,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAoGlE,kFAAkF;AAClF,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,sFAAsF;AACtF,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYtE;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACzC;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,eAAe,GAAG,iBAAiB,CAmI/F"}

package/dist/middleware/idempotency.js

@@ -63,7 +63,9 @@ const TARGET_PATHS = new Set([
     '/api/v1/api-keys',
     '/api/v1/invitations',
     '/api/v1/workspaces',
-    '/api/v1/projects'
+    '/api/v1/projects',
+    // A retried registration answers the first one's secret, never a second endpoint (PRDCT-3482).
+    '/api/v1/webhooks'
 ]);
 // The two member routes that MINT a credential for another user. Both are
 // covered (FUZZ-7): a replayed mint hands out a second live secret, and the

package/dist/middleware/idempotency.js.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGxF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAW,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,qFAAqF;AACrF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,kBAAkB;IAClB,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;CACnB,CAAC,CAAC;AACH,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAChE,MAAM,oBAAoB,GAAG,gDAAgD,CAAC;AAC9E,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AAEnE,SAAS,QAAQ,CACf,MAAc,EACd,IAAY,EACZ,WAAoD;IAEpD,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YACrB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,KAAK,CAAC,UAAkB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC;SACnC,MAAM,EAAE,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,UAAkB;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACxH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,UAAkB;IACrD,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAClG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CACtG,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,MAAM,UAAU,WAAW,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAmB;IAC1E,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACpD,uEAAuE;YACvE,uEAAuE;YACvE,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC,CAAC,iCAAiC;QAEhE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpC,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;aACrD,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,MAAM,KAAK,GAAG,GAAG,CACf,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACtD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAC5C,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAC7B,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,IAA4B,EAAE;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,eAAe,CAAC;iBACvB,MAAM,CAAC;gBACN,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,GAAG;gBACH,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC;iBACD,mBAAmB,CAAC;gBACnB,MAAM,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;aACnF,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAC7B,CAAC,CAAC;QAEF,IAAI,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;QAE5B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,gEAAgE;gBAChE,uEAAuE;gBACvE,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;gBACxB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,kEAAkE,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBAChD,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,gEAAgE,CACjE,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;gBACjF,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,yDAAyD,CAC1D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACzD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,gEAAgE;oBAChE,2DAA2D;oBAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC5E,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;oBACxB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACrB,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,kEAAkE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;oBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,cAAsC,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,YAAY,GAAG,OAAO,CAAC;QAC7B,qEAAqE;QACrE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,EAAE;iBACL,MAAM,CAAC,eAAe,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;iBAC3C,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC9C,oEAAoE;YACpE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,EAAE;qBACL,MAAM,CAAC,eAAe,CAAC;qBACvB,GAAG,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;qBAC9E,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,iEAAiE;gBACjE,gEAAgE;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGxF,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAW,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,qFAAqF;AACrF,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,kBAAkB;IAClB,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;IAClB,+FAA+F;IAC/F,kBAAkB;CACnB,CAAC,CAAC;AACH,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAChE,MAAM,oBAAoB,GAAG,gDAAgD,CAAC;AAC9E,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AAEnE,SAAS,QAAQ,CACf,MAAc,EACd,IAAY,EACZ,WAAoD;IAEpD,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YACrB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,KAAK,CAAC,UAAkB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC;SACnC,MAAM,EAAE,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,UAAkB;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACxH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,UAAkB;IACrD,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QAClG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CACtG,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,MAAM,UAAU,WAAW,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAmB;IAC1E,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACpD,uEAAuE;YACvE,uEAAuE;YACvE,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC,CAAC,iCAAiC;QAEhE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACpC,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;aACrD,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,MAAM,KAAK,GAAG,GAAG,CACf,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACtD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAC5C,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAC7B,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,IAA4B,EAAE;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,eAAe,CAAC;iBACvB,MAAM,CAAC;gBACN,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,GAAG;gBACH,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC;iBACD,mBAAmB,CAAC;gBACnB,MAAM,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC;aACnF,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAC7B,CAAC,CAAC;QAEF,IAAI,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;QAE5B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,gEAAgE;YAChE,gEAAgE;YAChE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,gEAAgE;gBAChE,uEAAuE;gBACvE,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;gBACxB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,kEAAkE,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBAChD,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,gEAAgE,CACjE,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;gBACjF,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,yDAAyD,CAC1D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACzD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,gEAAgE;oBAChE,2DAA2D;oBAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC5E,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;oBACxB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;wBACrB,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,uBAAuB,EACvB,kEAAkE,CACnE,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;oBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,cAAsC,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,YAAY,GAAG,OAAO,CAAC;QAC7B,qEAAqE;QACrE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,EAAE;iBACL,MAAM,CAAC,eAAe,CAAC;iBACvB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;iBAC3C,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,CAAC;QACV,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC9C,oEAAoE;YACpE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,EAAE;qBACL,MAAM,CAAC,eAAe,CAAC;qBACvB,GAAG,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;qBAC9E,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;gBAC9D,iEAAiE;gBACjE,gEAAgE;YAClE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,EAAE,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/scopes.d.ts

@@ -26,8 +26,16 @@ export interface ScopeAllowlistOptions<S extends string> {
     write: S;
     /** The tool's dedicated opt-in scope for the full-workspace export. */
     dataExport: S;
+    /**
+     * The tool's dedicated opt-in scope for the webhooks family (PRDCT-3482):
+     * registering an endpoint is a standing read of the workspace to a URL of
+     * the caller's choice, so no read or write key opens it. Absent: no
+     * machine principal reaches `/webhooks` at all (the catalog read stays
+     * under the read scope).
+     */
+    webhooks?: S | undefined;
     /** The tool's own rules, asked in order AFTER the chassis rules. */
     rules: ReadonlyArray<ScopeRule<S>>;
 }
-export declare function createScopeAllowlist<S extends string>({ read, write, dataExport, rules }: ScopeAllowlistOptions<S>): (path: string, method: string) => S | null;
+export declare function createScopeAllowlist<S extends string>({ read, write, dataExport, webhooks, rules }: ScopeAllowlistOptions<S>): (path: string, method: string) => S | null;
 //# sourceMappingURL=scopes.d.ts.map

package/dist/middleware/scopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/middleware/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC;AAEtG,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,MAAM;IACrD,kFAAkF;IAClF,IAAI,EAAE,CAAC,CAAC;IACR,6FAA6F;IAC7F,KAAK,EAAE,CAAC,CAAC;IACT,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC;IACd,oEAAoE;IACpE,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACpC;AAqDD,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,EACrD,IAAI,EACJ,KAAK,EACL,UAAU,EACV,KAAK,EACN,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,IAAI,CAyDvE"}
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/middleware/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC;AAEtG,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,MAAM;IACrD,kFAAkF;IAClF,IAAI,EAAE,CAAC,CAAC;IACR,6FAA6F;IAC7F,KAAK,EAAE,CAAC,CAAC;IACT,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;IACzB,oEAAoE;IACpE,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACpC;AAqDD,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,EACrD,IAAI,EACJ,KAAK,EACL,UAAU,EACV,QAAQ,EACR,KAAK,EACN,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,IAAI,CA8DvE"}

package/dist/middleware/scopes.js

@@ -71,7 +71,7 @@ function teamAccess(path, method) {
         return method === 'DELETE' ? 'write' : null;
     return null;
 }
-export function createScopeAllowlist({ read, write, dataExport, rules }) {
+export function createScopeAllowlist({ read, write, dataExport, webhooks, rules }) {
     return function requiredScopeFor(path, method) {
         const isRead = method === 'GET' || method === 'HEAD';
         if (path === '/api/v1/me' && isRead)
@@ -117,6 +117,13 @@ export function createScopeAllowlist({ read, write, dataExport, rules }) {
         const team = teamAccess(path, method);
         if (team !== null)
             return team === 'read' ? read : write;
+        // Webhooks (PRDCT-3482): the catalog is a read any key may make; the
+        // family itself, reads included, needs the tool's dedicated scope, and
+        // closes entirely when the tool declares none.
+        if (path === '/api/v1/webhooks/events' && isRead)
+            return read;
+        if (path === '/api/v1/webhooks' || path.startsWith('/api/v1/webhooks/'))
+            return webhooks ?? null;
         for (const rule of rules) {
             const needed = rule(path, method, isRead);
             if (needed !== null)

package/dist/middleware/scopes.js.map

@@ -1 +1 @@
-{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/middleware/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAoBD;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;AAClE,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,yBAAyB,CAAC,CAAC;AAChG,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,WAAW,CAAC,CAAC;AAClF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,iBAAiB,CAAC,CAAC;AACvF,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,UAAU,UAAU,GAAG,CAAC,CAAC;AAE3F,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,GAAG,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,WAAW,CAAC,CAAC;AAC5E,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,iBAAiB,CAAC,CAAC;AAEjF,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAmB,EACrD,IAAI,EACJ,KAAK,EACL,UAAU,EACV,KAAK,EACoB;IACzB,OAAO,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAc;QAC3D,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;QACrD,IAAI,IAAI,KAAK,YAAY,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QACjD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,IAAI,KAAK,sBAAsB,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,IAAI,IAAI,KAAK,8BAA8B,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9E,8EAA8E;QAC9E,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,IAAI,KAAK,0BAA0B,IAAI,MAAM;YAAE,OAAO,UAAU,CAAC;QACrE,qEAAqE;QACrE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,sCAAsC;QACtC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC;QACrC,CAAC;QACD,8DAA8D;QAC9D,kCAAkC;QAClC,qEAAqE;QACrE,qEAAqE;QACrE,cAAc;QACd,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,mDAAmD;QACnD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/middleware/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AA4BD;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;AAClE,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,yBAAyB,CAAC,CAAC;AAChG,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,WAAW,CAAC,CAAC;AAClF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,iBAAiB,CAAC,CAAC;AACvF,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,UAAU,UAAU,GAAG,CAAC,CAAC;AAE3F,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,GAAG,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,WAAW,CAAC,CAAC;AAC5E,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,iBAAiB,CAAC,CAAC;AAEjF,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAmB,EACrD,IAAI,EACJ,KAAK,EACL,UAAU,EACV,QAAQ,EACR,KAAK,EACoB;IACzB,OAAO,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAc;QAC3D,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;QACrD,IAAI,IAAI,KAAK,YAAY,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QACjD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,IAAI,KAAK,sBAAsB,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,IAAI,IAAI,KAAK,8BAA8B,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9E,8EAA8E;QAC9E,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,IAAI,KAAK,0BAA0B,IAAI,MAAM;YAAE,OAAO,UAAU,CAAC;QACrE,qEAAqE;QACrE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,sCAAsC;QACtC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,qEAAqE;QACrE,uEAAuE;QACvE,+CAA+C;QAC/C,IAAI,IAAI,KAAK,yBAAyB,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAAE,OAAO,QAAQ,IAAI,IAAI,CAAC;QACjG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC;QACrC,CAAC;QACD,8DAA8D;QAC9D,kCAAkC;QAClC,qEAAqE;QACrE,qEAAqE;QACrE,cAAc;QACd,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,mDAAmD;QACnD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/secret-box.d.ts

@@ -0,0 +1,10 @@
+export declare class SecretBoxError extends Error {
+    constructor(message: string);
+}
+export interface SecretBox {
+    seal(plain: string): string;
+    open(sealed: string): string;
+}
+/** `info` separates the boxes: two boxes of one instance with different infos never open each other's values. */
+export declare function createSecretBox(authSecret: string, info: string): SecretBox;
+//# sourceMappingURL=secret-box.d.ts.map

package/dist/secret-box.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.d.ts","sourceRoot":"","sources":["../src/secret-box.ts"],"names":[],"mappings":"AA4BA,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,iHAAiH;AACjH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAmD3E"}

package/dist/secret-box.js

@@ -0,0 +1,87 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes } from 'node:crypto';
+/**
+ * A box for secrets the instance must read back (a signing secret it hands to
+ * a receiver, a refresh token it presents later): AES-256-GCM under a key
+ * derived from the instance's auth secret by HKDF-SHA256 with a caller-given
+ * `info`, so the database never holds them in the clear and a copy of the
+ * database alone opens nothing. A one-way secret (a password, an API key the
+ * instance only compares) never goes in here: it is hashed, not sealed.
+ *
+ * `info` separates the boxes: two boxes of one instance with different infos
+ * derive different keys, so a value sealed for one purpose never opens under
+ * another. Name it `<area>:<purpose>` and never change it once values are
+ * stored under it (they would no longer open).
+ *
+ * A sealed value reads `v1.<iv>.<tag>.<ciphertext>`, each part base64url: a
+ * fresh 12-byte IV per seal (two seals of one value differ), the 16-byte GCM
+ * tag, which `open` checks before it answers anything (a changed byte
+ * anywhere is refused, never decrypted to garbage). The version prefix lets a
+ * later key or cipher change read the old rows. Every refusal, a malformed
+ * string included, is a `SecretBoxError` and nothing else.
+ */
+const VERSION = 'v1';
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+const BASE64URL = /^[A-Za-z0-9_-]*$/;
+export class SecretBoxError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SecretBoxError';
+    }
+}
+/** `info` separates the boxes: two boxes of one instance with different infos never open each other's values. */
+export function createSecretBox(authSecret, info) {
+    if (typeof authSecret !== 'string' || authSecret.length === 0) {
+        throw new SecretBoxError('the secret box needs the auth secret');
+    }
+    if (typeof info !== 'string' || info.length === 0) {
+        throw new SecretBoxError('the secret box needs an info string that names its purpose');
+    }
+    const key = Buffer.from(hkdfSync('sha256', authSecret, Buffer.alloc(0), info, KEY_BYTES));
+    return {
+        seal(plain) {
+            if (typeof plain !== 'string')
+                throw new SecretBoxError('the secret box seals strings only');
+            const iv = randomBytes(IV_BYTES);
+            const cipher = createCipheriv('aes-256-gcm', key, iv, { authTagLength: TAG_BYTES });
+            const ciphertext = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+            const tag = cipher.getAuthTag();
+            return [
+                VERSION,
+                iv.toString('base64url'),
+                tag.toString('base64url'),
+                ciphertext.toString('base64url')
+            ].join('.');
+        },
+        open(sealed) {
+            if (typeof sealed !== 'string')
+                throw new SecretBoxError('not a sealed value');
+            const parts = sealed.split('.');
+            if (parts.length !== 4 || parts[0] !== VERSION) {
+                throw new SecretBoxError('not a sealed value of this version');
+            }
+            const [, ivPart, tagPart, ciphertextPart] = parts;
+            // Buffer.from skips characters outside the alphabet silently: refuse them
+            // here, so only the one spelling of a sealed value opens.
+            if (!BASE64URL.test(ivPart) || !BASE64URL.test(tagPart) || !BASE64URL.test(ciphertextPart)) {
+                throw new SecretBoxError('a sealed value with a part that is not base64url');
+            }
+            const iv = Buffer.from(ivPart, 'base64url');
+            const tag = Buffer.from(tagPart, 'base64url');
+            const ciphertext = Buffer.from(ciphertextPart, 'base64url');
+            if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) {
+                throw new SecretBoxError('a sealed value with a malformed iv or tag');
+            }
+            try {
+                const decipher = createDecipheriv('aes-256-gcm', key, iv, { authTagLength: TAG_BYTES });
+                decipher.setAuthTag(tag);
+                return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+            }
+            catch {
+                throw new SecretBoxError('the sealed value does not open under this key');
+            }
+        }
+    };
+}
+//# sourceMappingURL=secret-box.js.map

package/dist/secret-box.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-box.js","sourceRoot":"","sources":["../src/secret-box.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAOD,iHAAiH;AACjH,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,IAAY;IAC9D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,cAAc,CAAC,sCAAsC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,cAAc,CAAC,4DAA4D,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAE1F,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC;YAC7F,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;YACpF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO;gBACP,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACzB,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;aACjC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAc;YACjB,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,cAAc,CAAC,oBAAoB,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,cAAc,CAAC,oCAAoC,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,GAAG,KAAyC,CAAC;YACtF,0EAA0E;YAC1E,0DAA0D;YAC1D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3F,MAAM,IAAI,cAAc,CAAC,kDAAkD,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC5D,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvD,MAAM,IAAI,cAAc,CAAC,2CAA2C,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxF,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,cAAc,CAAC,+CAA+C,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/testing/helpers.d.ts

@@ -79,6 +79,14 @@ export interface ChassisTestHost<TResult extends BootResultLike, TOverrides> {
      * scope) that answers 200 to any principal the gates let through.
      */
     probeRoute: string;
+    /**
+     * The host's tool is the chassis's minimal test tool, which declares the
+     * `thing` subject and the `thing.created` / `thing.deleted` events the
+     * webhooks suite emits (PRDCT-3482). A real tool leaves it unset: the
+     * suite's delivery scenarios skip under its host, and the tool proves its
+     * own events in its own suite.
+     */
+    webhooks?: boolean;
 }
 /**
  * End a pool and wait until every one of its clients has REALLY closed

package/dist/testing/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/testing/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAIlG,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,WAAW;IACtD,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAU;IAChC,QAAQ,CAAC,QAAQ,QAAQ;IACzB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,CAAM;IAC7B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,iCAAiC,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,QAAQ,2BAA2B,CAAC;AAEjD,wBAAsB,aAAa,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAEzE;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,IAAI,CAAC;IACV,EAAE,EAAE;QAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAA;KAAE,CAAC;IACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CACrC;AAED,2EAA2E;AAC3E,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,cAAc,EAAE,UAAU,IAAI,CAC/D,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,EAC1B,SAAS,CAAC,EAAE,UAAU,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,OAAO,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc,IAAI,OAAO,GAAG;IAC/E,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,eAAe,CAAC,OAAO,SAAS,cAAc,EAAE,UAAU;IACzE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,QAAQ,EAAE,YAAY,CAAC;IACvB,wGAAwG;IACxG,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,2EAA2E;QAC3E,IAAI,EAAE,MAAM,CAAC;QACb,8CAA8C;QAC9C,KAAK,EAAE,MAAM,CAAC;QACd,0DAA0D;QAC1D,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAQD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,GAAE,MAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,SAAS,cAAc,EAAE,UAAU,EAC1E,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAChC,CACD,gBAAgB,EAAE,MAAM,EACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,SAAS,CAAC,EAAE,UAAU,KACnB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAgC7B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzF;AAED,kEAAkE;AAClE,wBAAsB,cAAc,CAAC,SAAS,EAAE,0BAA0B,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQzG;AAED,kEAAkE;AAClE,wBAAsB,WAAW,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAczE;AAED,8EAA8E;AAE9E,wBAAsB,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAE1D;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAQnD"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/testing/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAIlG,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,WAAW;IACtD,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAU;IAChC,QAAQ,CAAC,QAAQ,QAAQ;IACzB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,CAAM;IAC7B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,iCAAiC,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,QAAQ,2BAA2B,CAAC;AAEjD,wBAAsB,aAAa,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAEzE;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,IAAI,CAAC;IACV,EAAE,EAAE;QAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAA;KAAE,CAAC;IACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CACrC;AAED,2EAA2E;AAC3E,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,cAAc,EAAE,UAAU,IAAI,CAC/D,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,EAC1B,SAAS,CAAC,EAAE,UAAU,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,OAAO,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc,IAAI,OAAO,GAAG;IAC/E,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,eAAe,CAAC,OAAO,SAAS,cAAc,EAAE,UAAU;IACzE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,QAAQ,EAAE,YAAY,CAAC;IACvB,wGAAwG;IACxG,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,2EAA2E;QAC3E,IAAI,EAAE,MAAM,CAAC;QACb,8CAA8C;QAC9C,KAAK,EAAE,MAAM,CAAC;QACd,0DAA0D;QAC1D,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAQD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,GAAE,MAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBrG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,SAAS,cAAc,EAAE,UAAU,EAC1E,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAChC,CACD,gBAAgB,EAAE,MAAM,EACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,SAAS,CAAC,EAAE,UAAU,KACnB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAgC7B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzF;AAED,kEAAkE;AAClE,wBAAsB,cAAc,CAAC,SAAS,EAAE,0BAA0B,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQzG;AAED,kEAAkE;AAClE,wBAAsB,WAAW,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAczE;AAED,8EAA8E;AAE9E,wBAAsB,QAAQ,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAE1D;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAQnD"}