@antasphere/chassis-server 1.1.0 → 1.2.0

package/dist/webhooks/service.d.ts

@@ -0,0 +1,245 @@
+import type PgBoss from 'pg-boss';
+import { Counter } from 'prom-client';
+import { type Db, type DbConn, type WebhookDeliveryRow, type WebhookEndpointRow } from '@antasphere/chassis-db';
+import type { ToolIdentity, WebhookDelivery, WebhookEndpoint, WebhookEndpointCreate, WebhookEndpointUpdate } from '@antasphere/chassis-contract';
+import type { Logger } from '../logger.js';
+import type { EmailDriver } from '../email/driver.js';
+import type { MailBrand } from '../email/shell.js';
+import type { EventBus } from '../platform/events.js';
+import { type WebhookCatalogIndex, type WebhookSubjectValue } from './catalog.js';
+import { type SafeFetchOptions, type SafeFetchPolicy } from './safe-fetch.js';
+/**
+ * Outbound webhooks (PRDCT-3482): the chassis's machinery, tool-neutral.
+ *
+ * EMIT: a domain write calls `emit(tx, …)` INSIDE its own transaction; one
+ * pg-boss job (the event's envelope) is written by the same connection, so
+ * the event is durable with the write and never exists for a rolled-back
+ * one. A per-replica cache of "does any enabled endpoint of this workspace
+ * want this type" (`listenerTtlMs`) makes an emit nobody listens to cost
+ * one map lookup: a view with no endpoint costs no job.
+ *
+ * FAN-OUT (`webhook-events`): the event is matched against the workspace's
+ * enabled endpoints (type, then filters); one `webhook_deliveries` row and
+ * one delivery job per match, in one transaction.
+ *
+ * DELIVERY (`webhook-deliveries`): the envelope is signed (Standard
+ * Webhooks, two signatures during a rotation overlap) and POSTed through the
+ * guarded fetch. A 2xx is `delivered`; anything else fails the job, which
+ * pg-boss retries on the queue's budget (ten retries from thirty seconds,
+ * about eight and a half hours), then moves to `webhook-deliveries-held`:
+ * the row is marked `held`, logged, counted, and queued again an hour later
+ * with the whole budget once more, round after round, until the receiver
+ * takes it or the endpoint is disabled. A streak of
+ * `disableAfterFailures` failures spanning `disableAfterMs` switches the
+ * endpoint off and mails its creator once.
+ *
+ * The secret is stored sealed (`secret-box.ts`, info `chassis:webhook-endpoint`)
+ * and shown once, at creation and at rotation.
+ */
+export declare const WEBHOOK_EVENTS_QUEUE = "webhook-events";
+export declare const WEBHOOK_DELIVERIES_QUEUE = "webhook-deliveries";
+export declare const WEBHOOK_DELIVERIES_HELD_QUEUE = "webhook-deliveries-held";
+export declare const WEBHOOK_PURGE_QUEUE = "webhook-purge";
+/** The HKDF info of the endpoints' secret box: never the idempotency one. */
+export declare const WEBHOOK_SECRET_BOX_INFO = "chassis:webhook-endpoint";
+export interface WebhookDials {
+    /** Delivery retries before a hold (pg-boss `retryLimit`). */
+    retryLimit: number;
+    /** The first retry's delay in seconds, doubled each time. */
+    retryDelaySeconds: number;
+    /** How long a held delivery waits before its next round. */
+    heldDelaySeconds: number;
+    /** The failure streak that switches an endpoint off… */
+    disableAfterFailures: number;
+    /** …once it has lasted this long. */
+    disableAfterMs: number;
+    /** How long "anyone listening?" is remembered per workspace and replica. */
+    listenerTtlMs: number;
+    /** How long the previous secret keeps signing after a rotation. */
+    previousSecretOverlapMs: number;
+    /** The guarded fetch's timeout. */
+    timeoutMs: number;
+}
+export declare const DEFAULT_WEBHOOK_DIALS: WebhookDials;
+/** What `emit` takes: the workspace, the type, the subjects by KEY, the data. */
+export interface WebhookEmit {
+    workspaceId: string;
+    type: string;
+    subjects?: Readonly<Record<string, WebhookSubjectValue>>;
+    data: Record<string, unknown>;
+}
+/** The job the fan-out queue carries: the event as the envelope will say it (minus `attempt`). */
+export interface WebhookEventJob {
+    id: string;
+    type: string;
+    occurredAt: string;
+    workspaceId: string;
+    /** By subject KEY (`project`), the envelope writes them under each subject's FIELD. */
+    subjects: Record<string, WebhookSubjectValue>;
+    data: Record<string, unknown>;
+}
+export interface WebhookDeliveryJob {
+    deliveryId: string;
+}
+/** The emitter a tool's services receive (`ServiceCore.webhooks`). */
+export interface WebhookEmitter {
+    /**
+     * Record that something happened, inside the caller's transaction (or on
+     * a plain handle, for a write the chassis does not own). Answers the
+     * event id, or null when no endpoint of the workspace listens to the type,
+     * or the data does not match the declared schema (logged, never thrown:
+     * a webhook must never break the write it reports).
+     */
+    emit(conn: DbConn, event: WebhookEmit): Promise<string | null>;
+    /**
+     * Whether any enabled endpoint of the workspace subscribes to the type:
+     * the cheap exit a tool takes BEFORE it computes the facts of an event
+     * that is frequent and costs something to describe (a view). Cached per
+     * replica; `emit` runs the same check itself.
+     */
+    wants(workspaceId: string, type: string): Promise<boolean>;
+}
+export interface WebhookServiceDeps {
+    db: Db;
+    logger: Logger;
+    authSecret: string;
+    identity: ToolIdentity;
+    version: string;
+    policy: SafeFetchPolicy;
+    email: EmailDriver;
+    brand: MailBrand;
+    publicBaseUrl: string;
+    catalog: WebhookCatalogIndex;
+    dials?: Partial<WebhookDials> | undefined;
+    /** Test seams of the guarded fetch (a lookup, a transport). */
+    fetchOptions?: SafeFetchOptions | undefined;
+    now?: () => Date;
+}
+export declare class WebhookRefusedError extends Error {
+    readonly code: 'url_refused' | 'not_found' | 'unknown_event' | 'unknown_subject';
+    constructor(code: 'url_refused' | 'not_found' | 'unknown_event' | 'unknown_subject', message: string);
+}
+/**
+ * Thrown by an attempt that did not run because the endpoint already holds
+ * its share of this replica's pollers (`MAX_IN_FLIGHT_PER_ENDPOINT`): the
+ * worker puts the job back in the queue a moment later, its retry budget
+ * untouched, so one dead receiver can never take every slot (verifier
+ * round 2, MJ-R2-1).
+ */
+export declare class WebhookDeliveryDeferred extends Error {
+    readonly deliveryId: string;
+    constructor(deliveryId: string);
+}
+/** How many attempts one endpoint may have in flight on one replica at once. */
+export declare const MAX_IN_FLIGHT_PER_ENDPOINT = 2;
+/** Thrown by a retryable attempt that failed, so pg-boss retries the job. */
+export declare class WebhookDeliveryFailed extends Error {
+    readonly deliveryId: string;
+    constructor(deliveryId: string, message: string);
+}
+export declare class WebhookService implements WebhookEmitter {
+    private readonly deps;
+    readonly dials: WebhookDials;
+    readonly promMetrics: Counter<string>[];
+    private readonly box;
+    private readonly listeners;
+    private readonly deliveries;
+    private readonly held;
+    private readonly disabled;
+    private readonly now;
+    /** Filled by boot once pg-boss exists (`attach`); the jobs are declared before it. */
+    private boss;
+    /** Attempts in flight per endpoint on this replica (the per-endpoint bound). */
+    private readonly inFlight;
+    constructor(deps: WebhookServiceDeps);
+    attach(boss: PgBoss): void;
+    get catalog(): WebhookCatalogIndex;
+    emit(conn: DbConn, event: WebhookEmit): Promise<string | null>;
+    /** Does any enabled endpoint of the workspace subscribe to this type? Cached per replica. */
+    wants(workspaceId: string, type: string): Promise<boolean>;
+    private loadListeners;
+    /** Forget the cached answer of a workspace (every write of its endpoints calls it). */
+    invalidateListeners(workspaceId: string): void;
+    /**
+     * The chassis's own events, bridged from the in-process bus: fired after
+     * the write committed, so never for a rolled-back one, and at most once
+     * per replica that saw it. The events emitted inside a transaction the
+     * chassis owns (projects) do not pass here.
+     */
+    bindBus(events: EventBus): void;
+    /** One delivery row and one delivery job per endpoint that wants the event; answers how many. */
+    fanOut(job: WebhookEventJob): Promise<number>;
+    /** The envelope as the receiver reads it (without `attempt`, stamped at each send). */
+    private envelopeOf;
+    private queueDelivery;
+    /**
+     * One attempt of a delivery. `retryable` (the queue's worker): a failure
+     * throws `WebhookDeliveryFailed` so pg-boss retries. Not retryable (the
+     * test ping, run inline): a failure marks the row `failed` and answers it.
+     * Answers the row as it is after the attempt.
+     */
+    attempt(deliveryId: string, opts: {
+        retryable: boolean;
+    }): Promise<WebhookDeliveryRow | null>;
+    private finish;
+    /** Put a delivery back in the queue after `inSeconds` (a deferred attempt). */
+    requeue(deliveryId: string, inSeconds: number): Promise<void>;
+    /**
+     * The held queue's work: mark the row held and queue it again after the
+     * hold, in ONE transaction, so a re-send that fails leaves the row pending
+     * and the held job's own retry finds it again (the chassis suite's round 1:
+     * a row marked held outside the transaction was never re-driven once its
+     * send had failed). A row already delivered, failed or gone is left alone.
+     */
+    hold(deliveryId: string): Promise<void>;
+    private mailDisabled;
+    /** The nightly purge: deliveries older than `retentionDays`, in bounded batches. */
+    purge(retentionDays: number): Promise<number>;
+    /** The URL rule at registration (the address itself is judged at every delivery). */
+    checkUrl(url: string): void;
+    /**
+     * The subscription is checked against the catalog at registration
+     * (verifier round 1, MN1): an exact type must be declared, a family must
+     * have at least one declared type, `*` is always right; every filter key
+     * must be a declared subject. A typo would otherwise subscribe to nothing,
+     * silently.
+     */
+    checkSubscription(events: readonly string[] | undefined, filters: Record<string, string[]> | undefined): void;
+    create(workspaceId: string, createdBy: string, input: WebhookEndpointCreate): Promise<{
+        endpoint: WebhookEndpoint;
+        secret: string;
+    }>;
+    get(workspaceId: string, id: string): Promise<WebhookEndpoint | null>;
+    list(workspaceId: string, cursor: string | undefined, limit: number): Promise<{
+        webhooks: WebhookEndpoint[];
+        nextCursor: string | null;
+    }>;
+    /** Endpoints of the workspace, for the plan limit's count hook. */
+    count(workspaceId: string): Promise<number>;
+    update(workspaceId: string, id: string, patch: WebhookEndpointUpdate): Promise<WebhookEndpoint | null>;
+    remove(workspaceId: string, id: string): Promise<WebhookEndpoint | null>;
+    rotateSecret(workspaceId: string, id: string): Promise<{
+        endpoint: WebhookEndpoint;
+        secret: string;
+        previousSecretExpiresAt: string;
+    } | null>;
+    /** A signed `webhook.ping`, attempted inline, once; the row says how it went. */
+    test(workspaceId: string, id: string, sentBy: string | null): Promise<WebhookDelivery | null>;
+    listDeliveries(workspaceId: string, id: string, query: {
+        cursor?: string | undefined;
+        limit: number;
+        status?: WebhookDeliveryRow['status'] | undefined;
+    }): Promise<{
+        deliveries: WebhookDelivery[];
+        nextCursor: string | null;
+    } | null>;
+    getDelivery(workspaceId: string, id: string, deliveryId: string): Promise<WebhookDelivery | null>;
+    /** The same event queued again for the endpoint, as a new row (the event id unchanged: the receiver's dedupe key). */
+    redeliver(workspaceId: string, id: string, deliveryId: string): Promise<WebhookDelivery | null>;
+    private row;
+    private deliveryRow;
+    private requireBoss;
+}
+export declare function endpointToWire(row: WebhookEndpointRow): WebhookEndpoint;
+export declare function deliveryToWire(row: WebhookDeliveryRow): WebhookDelivery;
+//# sourceMappingURL=service.d.ts.map

package/dist/webhooks/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/webhooks/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAML,KAAK,EAAE,EACP,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAsB,KAAK,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGtG,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AAIzB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AACrD,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAC7D,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AACvE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAElE,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,uBAAuB,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,qBAAqB,EAAE,YASnC,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACzD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B;;;;;;OAMG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/D;;;;;OAKG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;IAC1C,+DAA+D;IAC/D,YAAY,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,WAAW,GAAG,eAAe,GAAG,iBAAiB;gBAAvE,IAAI,EAAE,aAAa,GAAG,WAAW,GAAG,eAAe,GAAG,iBAAiB,EAChF,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAIxC;AAED,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,6EAA6E;AAC7E,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM,EAC3B,OAAO,EAAE,MAAM;CAKlB;AAMD,qBAAa,cAAe,YAAW,cAAc;IAcvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAbjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,sFAAsF;IACtF,OAAO,CAAC,IAAI,CAAuB;IACnC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;gBAEzB,IAAI,EAAE,kBAAkB;IAuBrD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI1B,IAAI,OAAO,IAAI,mBAAmB,CAEjC;IAIK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAyDpE,6FAA6F;IACvF,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YASlD,aAAa;IAU3B,uFAAuF;IACvF,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAI9C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,EAAE,QAAQ,GAAG,IAAI;IA2B/B,iGAAiG;IAC3F,MAAM,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IA6BnD,uFAAuF;IACvF,OAAO,CAAC,UAAU;YAgBJ,aAAa;IAkB3B;;;;;OAKG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;YA+KrF,MAAM;IA4BpB,+EAA+E;IACzE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInE;;;;;;OAMG;IACG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAyB/B,YAAY;IAqC1B,oFAAoF;IAC9E,KAAK,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBnD,qFAAqF;IACrF,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAS3B;;;;;;OAMG;IACH,iBAAiB,CACf,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,GAC5C,IAAI;IAuBD,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC;QAAE,QAAQ,EAAE,eAAe,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBnD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKrE,IAAI,CACR,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IA6BtE,mEAAmE;IAC7D,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ3C,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAyB5B,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IASxE,YAAY,CAChB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,QAAQ,EAAE,eAAe,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,uBAAuB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAuBjG,iFAAiF;IAC3E,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA0B7F,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAA;KAAE,GACvG,OAAO,CAAC;QAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAgCzE,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKvG,sHAAsH;IAChH,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;YAqBvF,GAAG;YASH,WAAW;IAmBzB,OAAO,CAAC,WAAW;CAIpB;AASD,wBAAgB,cAAc,CAAC,GAAG,EAAE,kBAAkB,GAAG,eAAe,CAkBvE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,kBAAkB,GAAG,eAAe,CAgBvE"}