@happyvertical/smrt-webhooks 0.0.0-stage → 0.55.10

package/AGENTS.md

@@ -0,0 +1,23 @@
+# @happyvertical/smrt-webhooks
+
+Server-only outbound webhooks. `change-feed.ts` owns durable model publication
+with tenant/runtime cursors and retained-history recovery; `events.ts` is the
+optional non-atomic hook path. Never enable both for the same models. `store.ts` owns tenant-bound SQL and atomic
+outbox/job enqueue; `dispatcher.ts` owns signing and job execution. Always use
+`requireTenant()` plus explicit tenant predicates, including raw CAS writes.
+
+`security.ts` validates every DNS result, pins HTTPS lookup, disables pooling,
+and bounds DNS/request time. Never substitute a preflight DNS check followed by
+fetch, follow redirects, or persist raw transport errors. Preserve exact stored
+payload bytes for signing. HTTP is at-least-once; receivers deduplicate the
+stable delivery ID. Do not promise exactly-once network effects.
+
+Admin projections are allowlists. Secrets and payloads are sensitive fields;
+generated API/CLI/MCP access is disabled. The host authorizes administrators via
+`WebhookAdminService`; Svelte callbacks must use authenticated, CSRF-protected
+host routes. No credentials in the browser read model.
+
+Validate: `pnpm test`, `pnpm typecheck`, `pnpm check`, `pnpm test:e2e` within this
+package after building its dependencies. E2E uses the maintained Playwright
+harness under `e2e/`; no external webhook server or network credential is needed.
+See README.md for migration, lifecycle-hook boundaries and worker setup.

package/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/LICENSE

@@ -0,0 +1,7 @@
+Copyright <2025> <Happy Vertical Corporation>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,142 @@
-# Temporary Holding Version
+# Outbound webhooks
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`@happyvertical/smrt-webhooks` delivers tenant-scoped create, update, delete and
+custom events to public HTTPS endpoints, with an HMAC signature, a durable jobs
+queue, retry/backoff, and a safe delivery log.
+
+## Server setup
+
+Migrate the package models and jobs system tables with the normal application
+migration flow before starting workers. Runtime code never creates application
+schema. Run this only in a Node server; import the UI from `/svelte` separately.
+
+```ts
+import {
+  WebhookDispatcher, WebhookAdminService,
+  registerWebhookRuntime, WebhookChangeFeed,
+} from '@happyvertical/smrt-webhooks';
+import { TaskRunner } from '@happyvertical/smrt-jobs';
+
+const webhooks = new WebhookDispatcher({ db, runtime: 'application-webhooks' });
+registerWebhookRuntime('application-webhooks', webhooks);
+const events = new WebhookChangeFeed(webhooks, { orders: '@example/app:Order' });
+// Poll from a host scheduler inside each authenticated tenant context.
+await events.poll();
+const admin = new WebhookAdminService(webhooks.store, async () =>
+  currentUserHasPermission('webhooks:admin'));
+const runner = new TaskRunner({ queues: ['webhooks'] });
+await runner.initialize(db);
+await runner.start();
+```
+
+Register the same runtime name in every worker process before starting jobs.
+The runner restores captured tenant context; all service calls require the
+host's authenticated `withTenant` context. Do not derive that context from a
+client-supplied tenant ID. Unregister optional hooks and call `unregisterWebhookRuntime()` on shutdown. The server entry is intentionally not browser-safe.
+
+Lifecycle subscriptions use qualified model names. The recommended durable path is
+`WebhookChangeFeed`: map physical application tables to model names and poll in
+each tenant context. It reads s-m-r-t's committed change feed (including delete
+tombstones), publishes identity-only `{ id }` payloads, and advances a persisted
+tenant/runtime cursor only after outbox/jobs are durable. Partial failure or
+process death before cursor advancement replays stable change-sequence IDs,
+which deduplicate against already enqueued deliveries. Global records and other
+tenants are excluded. Shared STI tables must map to their base model: the feed
+does not encode a child discriminator. Custom SQL that bypasses s-m-r-t persistence
+must explicitly append its domain event or core change-feed entry.
+
+Poll more frequently than core change-feed retention. A pruned cursor raises
+`WebhookHistoryExpiredError` and stops rather than silently dropping history.
+After an operator reconciles source state and publishes any recoverable missing
+events, call `resumeAfterResync(error.resumeCursor)`. Lost historical transitions
+cannot be reconstructed from a current-state snapshot alone; retain domain event
+history if that guarantee is required. Keep one stable model mapping per runtime;
+adding tables after its cursor has advanced does not backfill their older events.
+
+`registerWebhookModelEvents` is an alternative low-latency hook binding with an
+explicit model allowlist. It also publishes only identities, but source writes
+and hooks are not atomic: a crash between source commit and hook enqueue can
+miss an event. Use the durable change-feed path when that gap is unacceptable.
+Do not enable both paths for the same models: their event IDs represent different
+publication streams. Neither path promises atomic network effects with source
+writes. Hooks propagate enqueue failures; re-saving a source object does not
+reconstruct a missing historical create/update event.
+
+For custom events, authorize the data projection on the server:
+
+```ts
+await webhooks.dispatch({
+  id: durableDomainEventId, event: 'custom.paid', model: '@example/app:Invoice',
+  occurredAt: new Date().toISOString(), data: { id: invoiceId },
+});
+```
+
+Empty event/model filters mean all events/models. Unknown nonempty custom names
+are supported; malformed envelopes and bodies over 256 KiB are rejected.
+
+## Delivery and recovery
+
+A unique `(tenant, subscription, event ID)` outbox row and its jobs enqueue commit
+in one database transaction. Repeated dispatch is a no-op for that identity.
+Jobs contain only runtime, opaque tenant/delivery IDs, and a replay generation. Five attempts use jobs'
+exponential retry (1 second initial delay, multiplier 2, 5 minute cap). A delivery
+lease prevents overlapping HTTP attempts; an expired lease permits recovery
+after worker death. Terminal writes require the current lease token. Disabled
+subscriptions cancel unsent deliveries. Secrets are read at delivery time, so
+rotation applies to subsequent attempts.
+
+Call `store.reconcile()` from a tenant-scoped operator sweep to turn exhausted
+or cancelled jobs into replayable failed deliveries. Admin refresh also runs
+reconciliation. `admin.replay(id)` atomically creates a new job only for a failed
+delivery; repeated replay is a no-op. Delivered events are never replayed by this
+API. Receivers **must deduplicate `x-smrt-delivery`**: if HTTP succeeds and the
+process dies before the outcome commits, recovery can send the same request
+again. The package does not claim exactly-once HTTP effects.
+
+## Security contract
+
+Only HTTPS port 443 is allowed, without credentials or fragments. Every resolved
+DNS address must be public unicast. The socket lookup is pinned to a validated
+answer while TLS still verifies the original hostname. Redirects and connection
+pooling are disabled. DNS and request deadlines are 5 and 10 seconds. Special,
+private, mapped, transition and documentation IP ranges are conservatively
+rejected. Response bodies are never buffered or logged. A transport override is
+a **trusted server-only integration seam** and must preserve those requirements.
+
+`x-smrt-signature` is `sha256=<hex HMAC-SHA256(secret, timestamp + '.' + body)>`,
+where timestamp is the exact `x-smrt-timestamp` header and body is the exact
+persisted UTF-8 request body. Verify in constant time, bound timestamp age, and
+deduplicate the delivery ID. Keys require at least 32 bytes of entropy-bearing
+secret material (generate them cryptographically; length alone is not entropy).
+
+Secrets and payloads are durable sensitive data: use protected database access,
+backups and encryption at rest. Never serialize model instances with `toJSON`
+for clients; use the admin service or `toPublicJSON`. The admin view omits secrets,
+payloads and lease tokens, and transport errors are fixed safe strings.
+
+## Admin UI and recipe
+
+`WebhookAdmin` from `/svelte` uses smrt-ui Button, Card, Input and Alert primitives.
+Supply `subscriptions`, `deliveries`, and async `onCreate`, `onToggle`, `onReplay`
+callbacks backed by `WebhookAdminService`. Refresh the view after mutations.
+The host owns login, administrator permissions, and CSRF protection. The component
+has busy/error states and never receives persisted signing secrets.
+
+The `integrations.webhooks` recipe declares `runtime: 'server'` and the
+`@happyvertical/smrt-webhooks/svelte#WebhookAdmin` settings panel in the
+Integrations group. The host resolves that export and supplies the authenticated
+callbacks and safe read models described above. It intentionally declares no
+model navigation: generated CRUD is disabled for these sensitive internal
+models. It declares no provider or demo seed because transport configuration and
+signing secrets belong to the server; selecting the recipe does not configure a
+worker or authorize a browser to dispatch webhooks. The browser capability gate
+records this intentional server-only root against #3717; the separate `/svelte`
+export contains the administration component, not the delivery transport.
+
+## Validation
+
+`pnpm test` exercises persistence, rollback, tenancy, retries, lease fencing,
+lifecycle events, redaction, HMAC and DNS pinning. `pnpm check` and
+`pnpm typecheck` check public TypeScript/Svelte contracts. `pnpm test:e2e` runs the
+maintained Chromium admin interaction harness. Build with
+`pnpm exec turbo build --filter=@happyvertical/smrt-webhooks...` from the root.

package/dist/__smrt-register__.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=__smrt-register__.d.ts.map

package/dist/__smrt-register__.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"__smrt-register__.d.ts","sourceRoot":"","sources":["../src/__smrt-register__.ts"],"names":[],"mappings":""}

package/dist/admin.d.ts

@@ -0,0 +1,25 @@
+import type { WebhookStore } from './store.js';
+import type { WebhookDeliveryRecord, WebhookSubscriptionRecord } from './types.js';
+export interface WebhookAdminView {
+    subscriptions: WebhookSubscriptionRecord[];
+    deliveries: WebhookDeliveryRecord[];
+}
+/** Allowlisted projection; never spread persistence objects into a browser response. */
+export declare function webhookAdminView(subscriptions: WebhookSubscriptionRecord[], deliveries: WebhookDeliveryRecord[]): WebhookAdminView;
+/** Host supplies its administrator permission check and authenticated tenant context. */
+export declare class WebhookAdminService {
+    private readonly store;
+    private readonly authorize;
+    constructor(store: WebhookStore, authorize: () => Promise<boolean>);
+    private guard;
+    view(): Promise<WebhookAdminView>;
+    create(input: {
+        url: string;
+        events: string[];
+        models: string[];
+        secret: string;
+    }): Promise<void>;
+    toggle(id: string, enabled: boolean): Promise<void>;
+    replay(id: string): Promise<boolean>;
+}
+//# sourceMappingURL=admin.d.ts.map

package/dist/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EACV,qBAAqB,EACrB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AACpB,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,yBAAyB,EAAE,CAAC;IAC3C,UAAU,EAAE,qBAAqB,EAAE,CAAC;CACrC;AACD,wFAAwF;AACxF,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,yBAAyB,EAAE,EAC1C,UAAU,EAAE,qBAAqB,EAAE,GAClC,gBAAgB,CAqBlB;AACD,yFAAyF;AACzF,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,KAAK,EAAE,YAAY,EACnB,SAAS,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC;YAEtC,KAAK;IAKb,IAAI,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAUjC,MAAM,CAAC,KAAK,EAAE;QAClB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,IAAI,CAAC;IAeX,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI3C"}

package/dist/admin.js

@@ -0,0 +1,2 @@
+import { n as webhookAdminView, t as WebhookAdminService } from "./chunks/admin-413jve1I.js";
+export { WebhookAdminService, webhookAdminView };

package/dist/change-feed.d.ts

@@ -0,0 +1,25 @@
+import type { WebhookDispatcher } from './dispatcher.js';
+export declare class WebhookHistoryExpiredError extends Error {
+    readonly resumeCursor: number;
+    constructor(resumeCursor: number);
+}
+/** Durable, replayable lifecycle publication from SMRT's committed change feed.
+ * Host scheduling calls poll() in each authenticated tenant context. The mapping
+ * is an explicit physical-table allowlist; shared STI tables represent the base model.
+ */
+export declare class WebhookChangeFeed {
+    private readonly dispatcher;
+    private readonly models;
+    constructor(dispatcher: WebhookDispatcher, models: Readonly<Record<string, string>>);
+    /** Cursor only advances after all matched changes have durable outbox/jobs.
+     * A crash or partial failure replays the same stable identities on the next poll.
+     * History pruning fails loudly: the host must reconcile source state before reset.
+     */
+    poll(): Promise<{
+        cursor: number;
+        published: number;
+    }>;
+    /** Operator-only recovery: call after reconciling retained source state externally. */
+    resumeAfterResync(cursor: number): Promise<void>;
+}
+//# sourceMappingURL=change-feed.d.ts.map

package/dist/change-feed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-feed.d.ts","sourceRoot":"","sources":["../src/change-feed.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,qBAAa,0BAA2B,SAAQ,KAAK;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAK1C;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,UAAU,EAAE,iBAAiB,EAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAS3D;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAyD5D,uFAAuF;IACjF,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYvD"}

package/dist/chunks/admin-413jve1I.js

@@ -0,0 +1,318 @@
+import { SmrtCollection, SmrtObject, field, foreignKey, smrt } from "@happyvertical/smrt-core";
+import { TenantScoped, requireTenant, tenantId } from "@happyvertical/smrt-tenancy";
+import { backgroundEligible } from "@happyvertical/smrt-jobs";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { isIP } from "node:net";
+//#region src/security.ts
+function isPublicAddress(address) {
+	if (isIP(address) === 4) {
+		const [a, b, c] = address.split(".").map(Number);
+		return !(a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168 || b === 88 && c === 99) || a === 198 && (b === 18 || b === 19 || b === 51 && c === 100) || a === 203 && b === 0 && c === 113);
+	}
+	if (isIP(address) !== 6) return false;
+	const normalized = new URL(`https://[${address}]/`).hostname.slice(1, -1);
+	const first = Number.parseInt(normalized.split(":")[0], 16);
+	return first >= 8192 && first < 16384 && first !== 8194 && !(first === 8193 && Number.parseInt(normalized.split(":")[1] || "0", 16) < 512) && !normalized.startsWith("2001:db8:") && first !== 16383;
+}
+function assertWebhookUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("Webhook URL must be an absolute HTTPS URL.");
+	}
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	if (url.protocol !== "https:" || url.username || url.password || url.hash || url.port && url.port !== "443" || host === "localhost" || host.endsWith(".localhost") || isIP(host) && !isPublicAddress(host)) throw new Error("Webhook URL must use public HTTPS on port 443 without credentials or a fragment.");
+	return url;
+}
+function assertHmacSecret(secret) {
+	if (typeof secret !== "string" || Buffer.byteLength(secret) < 32 || Buffer.byteLength(secret) > 4096) throw new Error("Webhook signing secret must contain 32 to 4096 bytes.");
+}
+var sendPublicWebhook = async ({ url, body, headers }) => {
+	const target = assertWebhookUrl(url);
+	const host = target.hostname.replace(/^\[|\]$/g, "");
+	let dnsTimer;
+	const answers = isIP(host) ? [{
+		address: host,
+		family: isIP(host)
+	}] : await Promise.race([lookup(host, {
+		all: true,
+		verbatim: true
+	}), new Promise((_, reject) => {
+		dnsTimer = setTimeout(() => reject(/* @__PURE__ */ new Error("Webhook DNS timeout.")), 5e3);
+		dnsTimer.unref();
+	})]).finally(() => clearTimeout(dnsTimer));
+	if (!answers.length || answers.some(({ address }) => !isPublicAddress(address))) throw new Error("Webhook destination is not public.");
+	const pinned = answers[0];
+	return new Promise((resolve, reject) => {
+		const req = request(target, {
+			method: "POST",
+			agent: false,
+			headers: {
+				...headers,
+				"content-length": Buffer.byteLength(body).toString()
+			},
+			lookup: (_hostname, options, callback) => {
+				if (options.all) callback(null, [pinned]);
+				else callback(null, pinned.address, pinned.family);
+			}
+		}, (response) => {
+			const status = response.statusCode ?? 0;
+			response.destroy();
+			resolve(status);
+		});
+		const timer = setTimeout(() => req.destroy(/* @__PURE__ */ new Error("Webhook request timeout.")), 1e4);
+		req.on("close", () => clearTimeout(timer));
+		req.on("error", () => reject(/* @__PURE__ */ new Error("Webhook transport failed.")));
+		req.end(body);
+	});
+};
+//#endregion
+//#region src/models.ts
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __decorateClass = (decorators, target, key, kind) => {
+	var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+	for (var i = decorators.length - 1, decorator; i >= 0; i--) if (decorator = decorators[i]) result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+	if (kind && result) __defProp(target, key, result);
+	return result;
+};
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+var WebhookSubscription = class extends SmrtObject {
+	tenantId = "";
+	url = "";
+	events = [];
+	models = [];
+	secret = "";
+	enabled = true;
+	async save() {
+		assertWebhookUrl(this.url);
+		assertHmacSecret(this.secret);
+		for (const values of [this.events, this.models]) if (!Array.isArray(values) || values.length > 100 || values.some((v) => typeof v !== "string" || !v || v.length > 200)) throw new Error("Webhook filters must be lists of nonempty names.");
+		return super.save();
+	}
+};
+__publicField(WebhookSubscription, "__smrtPackage__", "@happyvertical/smrt-webhooks");
+__decorateClass([tenantId()], WebhookSubscription.prototype, "tenantId", 2);
+__decorateClass([field({
+	type: "text",
+	required: true
+})], WebhookSubscription.prototype, "url", 2);
+__decorateClass([field({ type: "json" })], WebhookSubscription.prototype, "events", 2);
+__decorateClass([field({ type: "json" })], WebhookSubscription.prototype, "models", 2);
+__decorateClass([field({
+	type: "text",
+	sensitive: true,
+	required: true
+})], WebhookSubscription.prototype, "secret", 2);
+__decorateClass([field({
+	type: "boolean",
+	default: true
+})], WebhookSubscription.prototype, "enabled", 2);
+WebhookSubscription = __decorateClass([smrt({
+	tableName: "_smrt_webhook_subscriptions",
+	api: false,
+	cli: false,
+	mcp: false
+}), TenantScoped({ mode: "required" })], WebhookSubscription);
+var WebhookSubscriptionCollection = class extends SmrtCollection {
+	static _itemClass = WebhookSubscription;
+};
+var WebhookDelivery = class extends SmrtObject {
+	tenantId = "";
+	subscriptionId = "";
+	eventId = "";
+	payload = "";
+	status = "pending";
+	generation = 0;
+	attempts = 0;
+	responseStatus = null;
+	error = null;
+	leaseToken = null;
+	leaseUntil = null;
+};
+__publicField(WebhookDelivery, "__smrtPackage__", "@happyvertical/smrt-webhooks");
+__decorateClass([tenantId()], WebhookDelivery.prototype, "tenantId", 2);
+__decorateClass([foreignKey(WebhookSubscription, {
+	onUpdate: "RESTRICT",
+	onDelete: "RESTRICT"
+})], WebhookDelivery.prototype, "subscriptionId", 2);
+__decorateClass([field({
+	type: "text",
+	required: true
+})], WebhookDelivery.prototype, "eventId", 2);
+__decorateClass([field({
+	type: "text",
+	required: true,
+	sensitive: true
+})], WebhookDelivery.prototype, "payload", 2);
+__decorateClass([field({
+	type: "text",
+	default: "pending"
+})], WebhookDelivery.prototype, "status", 2);
+__decorateClass([field({
+	type: "integer",
+	default: 0
+})], WebhookDelivery.prototype, "generation", 2);
+__decorateClass([field({
+	type: "integer",
+	default: 0
+})], WebhookDelivery.prototype, "attempts", 2);
+__decorateClass([field({
+	type: "integer",
+	nullable: true
+})], WebhookDelivery.prototype, "responseStatus", 2);
+__decorateClass([field({
+	type: "text",
+	nullable: true
+})], WebhookDelivery.prototype, "error", 2);
+__decorateClass([field({
+	type: "text",
+	nullable: true,
+	sensitive: true
+})], WebhookDelivery.prototype, "leaseToken", 2);
+__decorateClass([field({
+	type: "datetime",
+	nullable: true
+})], WebhookDelivery.prototype, "leaseUntil", 2);
+WebhookDelivery = __decorateClass([smrt({
+	tableName: "_smrt_webhook_deliveries",
+	api: false,
+	cli: false,
+	mcp: false,
+	indexes: [{
+		name: "_smrt_webhook_delivery_identity",
+		columns: [
+			"tenantId",
+			"subscriptionId",
+			"eventId"
+		],
+		unique: true
+	}]
+}), TenantScoped({ mode: "required" })], WebhookDelivery);
+var WebhookDeliveryCollection = class extends SmrtCollection {
+	static _itemClass = WebhookDelivery;
+};
+var WebhookDeliveryTask = class extends SmrtObject {
+	async deliver(args = {}, _context) {
+		const { runWebhookDeliveryJob } = await import("./dispatcher-C5AqtgtK.js").then((n) => n.r);
+		await runWebhookDeliveryJob(args);
+	}
+};
+__publicField(WebhookDeliveryTask, "__smrtPackage__", "@happyvertical/smrt-webhooks");
+__decorateClass([backgroundEligible()], WebhookDeliveryTask.prototype, "deliver", 1);
+WebhookDeliveryTask = __decorateClass([smrt({
+	tableName: "_smrt_webhook_delivery_tasks",
+	api: false,
+	cli: false,
+	mcp: false
+})], WebhookDeliveryTask);
+var WebhookCursor = class extends SmrtObject {
+	tenantId = "";
+	runtime = "";
+	position = 0;
+};
+__publicField(WebhookCursor, "__smrtPackage__", "@happyvertical/smrt-webhooks");
+__decorateClass([tenantId()], WebhookCursor.prototype, "tenantId", 2);
+__decorateClass([field({
+	type: "text",
+	required: true
+})], WebhookCursor.prototype, "runtime", 2);
+__decorateClass([field({
+	type: "integer",
+	default: 0
+})], WebhookCursor.prototype, "position", 2);
+WebhookCursor = __decorateClass([smrt({
+	tableName: "_smrt_webhook_cursors",
+	api: false,
+	cli: false,
+	mcp: false,
+	indexes: [{
+		name: "_smrt_webhook_cursor_identity",
+		columns: ["tenantId", "runtime"],
+		unique: true
+	}]
+}), TenantScoped({ mode: "required" })], WebhookCursor);
+//#endregion
+//#region src/admin.ts
+function webhookAdminView(subscriptions, deliveries) {
+	return {
+		subscriptions: subscriptions.map((s) => ({
+			id: s.id,
+			tenantId: s.tenantId,
+			url: s.url,
+			models: s.models,
+			events: s.events,
+			enabled: s.enabled
+		})),
+		deliveries: deliveries.map((d) => ({
+			id: d.id,
+			tenantId: d.tenantId,
+			subscriptionId: d.subscriptionId,
+			eventId: d.eventId,
+			status: d.status,
+			attempts: d.attempts,
+			responseStatus: d.responseStatus,
+			error: d.error
+		}))
+	};
+}
+var WebhookAdminService = class {
+	constructor(store, authorize) {
+		this.store = store;
+		this.authorize = authorize;
+	}
+	store;
+	authorize;
+	async guard() {
+		requireTenant();
+		if (!await this.authorize()) throw new Error("Webhook administration forbidden.");
+	}
+	async view() {
+		await this.guard();
+		await this.store.reconcile();
+		const subscriptions = await this.store.subscriptions();
+		const deliveries = await this.store.deliveries();
+		return webhookAdminView(subscriptions.map((s) => ({
+			...s,
+			id: s.id ?? ""
+		})), deliveries.map((d) => ({
+			...d,
+			id: d.id ?? ""
+		})));
+	}
+	async create(input) {
+		await this.guard();
+		await (await (await WebhookSubscriptionCollection.create({ db: this.store.db })).create({
+			tenantId: requireTenant().tenantId,
+			url: input.url,
+			events: input.events,
+			models: input.models,
+			secret: input.secret,
+			enabled: true
+		})).save();
+	}
+	async toggle(id, enabled) {
+		await this.guard();
+		if (typeof enabled !== "boolean") throw new Error("Invalid enabled value.");
+		const sub = await this.store.subscription(id);
+		if (!sub) throw new Error("Webhook subscription not found.");
+		sub.enabled = enabled;
+		await sub.save();
+	}
+	async replay(id) {
+		await this.guard();
+		return this.store.replay(id);
+	}
+};
+//#endregion
+export { WebhookDeliveryCollection as a, WebhookSubscriptionCollection as c, isPublicAddress as d, sendPublicWebhook as f, WebhookDelivery as i, assertHmacSecret as l, webhookAdminView as n, WebhookDeliveryTask as o, WebhookCursor as r, WebhookSubscription as s, WebhookAdminService as t, assertWebhookUrl as u };
+
+//# sourceMappingURL=admin-413jve1I.js.map

package/dist/chunks/admin-413jve1I.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-413jve1I.js","names":[],"sources":["../../src/security.ts","../../src/models.ts","../../src/admin.ts"],"sourcesContent":["import { lookup } from 'node:dns/promises';\nimport { request } from 'node:https';\nimport { isIP } from 'node:net';\n\n/** Conservative public-unicast allowlist. Transition/mapped IPv6 is excluded. */\nexport function isPublicAddress(address: string): boolean {\n  if (isIP(address) === 4) {\n    const [a, b, c] = address.split('.').map(Number);\n    return !(\n      a === 0 ||\n      a === 10 ||\n      a === 127 ||\n      a >= 224 ||\n      (a === 100 && b >= 64 && b <= 127) ||\n      (a === 169 && b === 254) ||\n      (a === 172 && b >= 16 && b <= 31) ||\n      (a === 192 && (b === 0 || b === 168 || (b === 88 && c === 99))) ||\n      (a === 198 && (b === 18 || b === 19 || (b === 51 && c === 100))) ||\n      (a === 203 && b === 0 && c === 113)\n    );\n  }\n  if (isIP(address) !== 6) return false;\n  const normalized = new URL(`https://[${address}]/`).hostname.slice(1, -1);\n  // Only global unicast 2000::/3; exclude IETF special-purpose, documentation,\n  // 6to4, and the newer documentation block (3fff::/20).\n  const first = Number.parseInt(normalized.split(':')[0], 16);\n  return (\n    first >= 0x2000 &&\n    first < 0x4000 &&\n    first !== 0x2002 &&\n    !(\n      first === 0x2001 &&\n      Number.parseInt(normalized.split(':')[1] || '0', 16) < 0x200\n    ) &&\n    !normalized.startsWith('2001:db8:') &&\n    first !== 0x3fff\n  );\n}\n\nexport function assertWebhookUrl(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error('Webhook URL must be an absolute HTTPS URL.');\n  }\n  const host = url.hostname.replace(/^\\[|\\]$/g, '');\n  if (\n    url.protocol !== 'https:' ||\n    url.username ||\n    url.password ||\n    url.hash ||\n    (url.port && url.port !== '443') ||\n    host === 'localhost' ||\n    host.endsWith('.localhost') ||\n    (isIP(host) && !isPublicAddress(host))\n  ) {\n    throw new Error(\n      'Webhook URL must use public HTTPS on port 443 without credentials or a fragment.',\n    );\n  }\n  return url;\n}\n\nexport function assertHmacSecret(secret: string): void {\n  if (\n    typeof secret !== 'string' ||\n    Buffer.byteLength(secret) < 32 ||\n    Buffer.byteLength(secret) > 4096\n  ) {\n    throw new Error('Webhook signing secret must contain 32 to 4096 bytes.');\n  }\n}\n\nexport interface WebhookRequest {\n  url: string;\n  body: string;\n  headers: Record<string, string>;\n}\nexport type WebhookTransport = (request: WebhookRequest) => Promise<number>;\n\n/** Validate every DNS answer, then pin the socket lookup; TLS still verifies the hostname.\n * No proxy, redirects, pooled sockets, response body buffering, or second DNS lookup.\n */\nexport const sendPublicWebhook: WebhookTransport = async ({\n  url,\n  body,\n  headers,\n}) => {\n  const target = assertWebhookUrl(url);\n  const host = target.hostname.replace(/^\\[|\\]$/g, '');\n  let dnsTimer: ReturnType<typeof setTimeout> | undefined;\n  const answers = isIP(host)\n    ? [{ address: host, family: isIP(host) }]\n    : await Promise.race([\n        lookup(host, { all: true, verbatim: true }),\n        new Promise<never>((_, reject) => {\n          dnsTimer = setTimeout(\n            () => reject(new Error('Webhook DNS timeout.')),\n            5000,\n          );\n          dnsTimer.unref();\n        }),\n      ]).finally(() => clearTimeout(dnsTimer));\n  if (\n    !answers.length ||\n    answers.some(({ address }) => !isPublicAddress(address))\n  ) {\n    throw new Error('Webhook destination is not public.');\n  }\n  const pinned = answers[0];\n  return new Promise<number>((resolve, reject) => {\n    const req = request(\n      target,\n      {\n        method: 'POST',\n        agent: false,\n        headers: {\n          ...headers,\n          'content-length': Buffer.byteLength(body).toString(),\n        },\n        lookup: (_hostname, options, callback) => {\n          if (options.all) callback(null, [pinned]);\n          else callback(null, pinned.address, pinned.family);\n        },\n      },\n      (response) => {\n        const status = response.statusCode ?? 0;\n        response.destroy();\n        resolve(status);\n      },\n    );\n    const timer = setTimeout(\n      () => req.destroy(new Error('Webhook request timeout.')),\n      10000,\n    );\n    req.on('close', () => clearTimeout(timer));\n    req.on('error', () => reject(new Error('Webhook transport failed.')));\n    req.end(body);\n  });\n};\n","import {\n  field,\n  foreignKey,\n  SmrtCollection,\n  SmrtObject,\n  smrt,\n} from '@happyvertical/smrt-core';\nimport {\n  backgroundEligible,\n  type JobExecutionContext,\n} from '@happyvertical/smrt-jobs';\nimport { TenantScoped, tenantId } from '@happyvertical/smrt-tenancy';\nimport { assertHmacSecret, assertWebhookUrl } from './security.js';\n\n/** Server-only subscription. Hosts authorize administration before accessing it. */\n@smrt({\n  tableName: '_smrt_webhook_subscriptions',\n  api: false,\n  cli: false,\n  mcp: false,\n})\n@TenantScoped({ mode: 'required' })\nexport class WebhookSubscription extends SmrtObject { static __smrtPackage__ = \"@happyvertical/smrt-webhooks\";\n  @tenantId() tenantId: string = '';\n  @field({ type: 'text', required: true }) url: string = '';\n  @field({ type: 'json' }) events: string[] = [];\n  @field({ type: 'json' }) models: string[] = [];\n  @field({ type: 'text', sensitive: true, required: true }) secret: string = '';\n  @field({ type: 'boolean', default: true }) enabled: boolean = true;\n\n  override async save(): Promise<this> {\n    assertWebhookUrl(this.url);\n    assertHmacSecret(this.secret);\n    for (const values of [this.events, this.models]) {\n      if (\n        !Array.isArray(values) ||\n        values.length > 100 ||\n        values.some((v) => typeof v !== 'string' || !v || v.length > 200)\n      ) {\n        throw new Error('Webhook filters must be lists of nonempty names.');\n      }\n    }\n    return super.save();\n  }\n}\nexport class WebhookSubscriptionCollection extends SmrtCollection<WebhookSubscription> {\n  static readonly _itemClass = WebhookSubscription;\n}\n\n/** Durable outbox and safe outcome metadata; payload never appears in public projections. */\n@smrt({\n  tableName: '_smrt_webhook_deliveries',\n  api: false,\n  cli: false,\n  mcp: false,\n  indexes: [\n    {\n      name: '_smrt_webhook_delivery_identity',\n      columns: ['tenantId', 'subscriptionId', 'eventId'],\n      unique: true,\n    },\n  ],\n})\n@TenantScoped({ mode: 'required' })\nexport class WebhookDelivery extends SmrtObject { static __smrtPackage__ = \"@happyvertical/smrt-webhooks\";\n  @tenantId() tenantId: string = '';\n  @foreignKey(WebhookSubscription, {\n    onUpdate: 'RESTRICT',\n    onDelete: 'RESTRICT',\n  })\n  subscriptionId: string = '';\n  @field({ type: 'text', required: true }) eventId: string = '';\n  @field({ type: 'text', required: true, sensitive: true }) payload: string =\n    '';\n  @field({ type: 'text', default: 'pending' }) status: string = 'pending';\n  @field({ type: 'integer', default: 0 }) generation: number = 0;\n  @field({ type: 'integer', default: 0 }) attempts: number = 0;\n  @field({ type: 'integer', nullable: true }) responseStatus: number | null =\n    null;\n  @field({ type: 'text', nullable: true }) error: string | null = null;\n  @field({ type: 'text', nullable: true, sensitive: true }) leaseToken:\n    | string\n    | null = null;\n  @field({ type: 'datetime', nullable: true }) leaseUntil: Date | null = null;\n}\nexport class WebhookDeliveryCollection extends SmrtCollection<WebhookDelivery> {\n  static readonly _itemClass = WebhookDelivery;\n}\n\n/** Jobs queue entry point; persisted arguments contain IDs only. */\n@smrt({\n  tableName: '_smrt_webhook_delivery_tasks',\n  api: false,\n  cli: false,\n  mcp: false,\n})\nexport class WebhookDeliveryTask extends SmrtObject { static __smrtPackage__ = \"@happyvertical/smrt-webhooks\";\n  @backgroundEligible()\n  async deliver(\n    args: Record<string, unknown> = {},\n    _context?: JobExecutionContext,\n  ): Promise<void> {\n    const { runWebhookDeliveryJob } = await import('./dispatcher.js');\n    await runWebhookDeliveryJob(args);\n  }\n}\n\n/** Tenant-bound durable cursor for replayable model change-feed publication. */\n@smrt({\n  tableName: '_smrt_webhook_cursors',\n  api: false,\n  cli: false,\n  mcp: false,\n  indexes: [\n    {\n      name: '_smrt_webhook_cursor_identity',\n      columns: ['tenantId', 'runtime'],\n      unique: true,\n    },\n  ],\n})\n@TenantScoped({ mode: 'required' })\nexport class WebhookCursor extends SmrtObject { static __smrtPackage__ = \"@happyvertical/smrt-webhooks\";\n  @tenantId() tenantId: string = '';\n  @field({ type: 'text', required: true }) runtime: string = '';\n  @field({ type: 'integer', default: 0 }) position: number = 0;\n}\n","import { requireTenant } from '@happyvertical/smrt-tenancy';\nimport { WebhookSubscriptionCollection } from './models.js';\nimport type { WebhookStore } from './store.js';\nimport type {\n  WebhookDeliveryRecord,\n  WebhookSubscriptionRecord,\n} from './types.js';\nexport interface WebhookAdminView {\n  subscriptions: WebhookSubscriptionRecord[];\n  deliveries: WebhookDeliveryRecord[];\n}\n/** Allowlisted projection; never spread persistence objects into a browser response. */\nexport function webhookAdminView(\n  subscriptions: WebhookSubscriptionRecord[],\n  deliveries: WebhookDeliveryRecord[],\n): WebhookAdminView {\n  return {\n    subscriptions: subscriptions.map((s) => ({\n      id: s.id,\n      tenantId: s.tenantId,\n      url: s.url,\n      models: s.models,\n      events: s.events,\n      enabled: s.enabled,\n    })),\n    deliveries: deliveries.map((d) => ({\n      id: d.id,\n      tenantId: d.tenantId,\n      subscriptionId: d.subscriptionId,\n      eventId: d.eventId,\n      status: d.status,\n      attempts: d.attempts,\n      responseStatus: d.responseStatus,\n      error: d.error,\n    })),\n  };\n}\n/** Host supplies its administrator permission check and authenticated tenant context. */\nexport class WebhookAdminService {\n  constructor(\n    private readonly store: WebhookStore,\n    private readonly authorize: () => Promise<boolean>,\n  ) {}\n  private async guard() {\n    requireTenant();\n    if (!(await this.authorize()))\n      throw new Error('Webhook administration forbidden.');\n  }\n  async view(): Promise<WebhookAdminView> {\n    await this.guard();\n    await this.store.reconcile();\n    const subscriptions = await this.store.subscriptions();\n    const deliveries = await this.store.deliveries();\n    return webhookAdminView(\n      subscriptions.map((s) => ({ ...s, id: s.id ?? '' })),\n      deliveries.map((d) => ({ ...d, id: d.id ?? '' })),\n    );\n  }\n  async create(input: {\n    url: string;\n    events: string[];\n    models: string[];\n    secret: string;\n  }): Promise<void> {\n    await this.guard();\n    const collection = await WebhookSubscriptionCollection.create({\n      db: this.store.db,\n    });\n    const sub = await collection.create({\n      tenantId: requireTenant().tenantId,\n      url: input.url,\n      events: input.events,\n      models: input.models,\n      secret: input.secret,\n      enabled: true,\n    });\n    await sub.save();\n  }\n  async toggle(id: string, enabled: boolean): Promise<void> {\n    await this.guard();\n    if (typeof enabled !== 'boolean') throw new Error('Invalid enabled value.');\n    const sub = await this.store.subscription(id);\n    if (!sub) throw new Error('Webhook subscription not found.');\n    sub.enabled = enabled;\n    await sub.save();\n  }\n  async replay(id: string): Promise<boolean> {\n    await this.guard();\n    return this.store.replay(id);\n  }\n}\n"],"mappings":";;;;;;;AAKO,SAAS,gBAAgB,SAA0B;CACxD,IAAI,KAAK,OAAO,MAAM,GAAG;EACvB,MAAM,CAAC,GAAG,GAAG,KAAK,QAAQ,MAAM,GAAG,CAAA,CAAE,IAAI,MAAM;EAC/C,OAAO,EACL,MAAM,KACN,MAAM,MACN,MAAM,OACN,KAAK,OACJ,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,QAAQ,MAAM,KAAK,MAAM,OAAQ,MAAM,MAAM,MAAM,OACzD,MAAM,QAAQ,MAAM,MAAM,MAAM,MAAO,MAAM,MAAM,MAAM,QACzD,MAAM,OAAO,MAAM,KAAK,MAAM;CAEnC;CACA,IAAI,KAAK,OAAO,MAAM,GAAG,OAAO;CAChC,MAAM,aAAa,IAAI,IAAI,YAAY,QAAO,GAAI,CAAA,CAAE,SAAS,MAAM,GAAG,EAAE;CAGxE,MAAM,QAAQ,OAAO,SAAS,WAAW,MAAM,GAAG,CAAA,CAAE,IAAI,EAAE;CAC1D,OACE,SAAS,QACT,QAAQ,SACR,UAAU,QACV,EACE,UAAU,QACV,OAAO,SAAS,WAAW,MAAM,GAAG,CAAA,CAAE,MAAM,KAAK,EAAE,IAAI,QAEzD,CAAC,WAAW,WAAW,WAAW,KAClC,UAAU;AAEd;AAEO,SAAS,iBAAiB,OAAoB;CACnD,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,MAAM,OAAO,IAAI,SAAS,QAAQ,YAAY,EAAE;CAChD,IACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,QACH,IAAI,QAAQ,IAAI,SAAS,SAC1B,SAAS,eACT,KAAK,SAAS,YAAY,KACzB,KAAK,IAAI,KAAK,CAAC,gBAAgB,IAAI,GAEpC,MAAM,IAAI,MACR,kFACF;CAEF,OAAO;AACT;AAEO,SAAS,iBAAiB,QAAsB;CACrD,IACE,OAAO,WAAW,YAClB,OAAO,WAAW,MAAM,IAAI,MAC5B,OAAO,WAAW,MAAM,IAAI,MAE5B,MAAM,IAAI,MAAM,uDAAuD;AAE3E;AAYO,IAAM,oBAAsC,OAAO,EACxD,KACA,MACA,cACI;CACJ,MAAM,SAAS,iBAAiB,GAAG;CACnC,MAAM,OAAO,OAAO,SAAS,QAAQ,YAAY,EAAE;CACnD,IAAI;CACJ,MAAM,UAAU,KAAK,IAAI,IACrB,CAAC;EAAE,SAAS;EAAM,QAAQ,KAAK,IAAI;CAAE,CAAC,IACtC,MAAM,QAAQ,KAAK,CACjB,OAAO,MAAM;EAAE,KAAK;EAAM,UAAU;CAAK,CAAC,GAC1C,IAAI,SAAgB,GAAG,WAAW;EAChC,WAAW,iBACH,uBAAO,IAAI,MAAM,sBAAsB,CAAC,GAC9C,GACF;EACA,SAAS,MAAM;CACjB,CAAC,CACH,CAAC,CAAA,CAAE,cAAc,aAAa,QAAQ,CAAC;CAC3C,IACE,CAAC,QAAQ,UACT,QAAQ,MAAM,EAAE,cAAc,CAAC,gBAAgB,OAAO,CAAC,GAEvD,MAAM,IAAI,MAAM,oCAAoC;CAEtD,MAAM,SAAS,QAAQ;CACvB,OAAO,IAAI,SAAiB,SAAS,WAAW;EAC9C,MAAM,MAAM,QACV,QACA;GACE,QAAQ;GACR,OAAO;GACP,SAAS;IACP,GAAG;IACH,kBAAkB,OAAO,WAAW,IAAI,CAAA,CAAE,SAAS;GACrD;GACA,SAAS,WAAW,SAAS,aAAa;IACxC,IAAI,QAAQ,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC;SACnC,SAAS,MAAM,OAAO,SAAS,OAAO,MAAM;GACnD;EACF,IACC,aAAa;GACZ,MAAM,SAAS,SAAS,cAAc;GACtC,SAAS,QAAQ;GACjB,QAAQ,MAAM;EAChB,CACF;EACA,MAAM,QAAQ,iBACN,IAAI,wBAAQ,IAAI,MAAM,0BAA0B,CAAC,GACvD,GACF;EACA,IAAI,GAAG,eAAe,aAAa,KAAK,CAAC;EACzC,IAAI,GAAG,eAAe,uBAAO,IAAI,MAAM,2BAA2B,CAAC,CAAC;EACpE,IAAI,IAAI,IAAI;CACd,CAAC;AACH;;;;;;;;;;;;;;;;;;ACtHO,IAAM,sBAAN,cAAkC,WAAW;CACtC,WAAmB;CACU,MAAc;CAC9B,SAAmB,CAAC;CACpB,SAAmB,CAAC;CACa,SAAiB;CAChC,UAAmB;CAE9D,MAAe,OAAsB;EACnC,iBAAiB,KAAK,GAAG;EACzB,iBAAiB,KAAK,MAAM;EAC5B,KAAA,MAAW,UAAU,CAAC,KAAK,QAAQ,KAAK,MAAM,GAC5C,IACE,CAAC,MAAM,QAAQ,MAAM,KACrB,OAAO,SAAS,OAChB,OAAO,MAAM,MAAM,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,GAEhE,MAAM,IAAI,MAAM,kDAAkD;EAGtE,OAAO,MAAM,KAAK;CACpB;AACF;AAtBsD,cAAzC,qBAAgD,mBAAkB,8BAAA;AACjE,gBAAA,CAAX,SAAS,CAAA,GADC,oBACC,WAAA,YAAA,CAAA;AAC6B,gBAAA,CAAxC,MAAM;CAAE,MAAM;CAAQ,UAAU;AAAK,CAAC,CAAA,GAF5B,oBAE8B,WAAA,OAAA,CAAA;AAChB,gBAAA,CAAxB,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAHZ,oBAGc,WAAA,UAAA,CAAA;AACA,gBAAA,CAAxB,MAAM,EAAE,MAAM,OAAO,CAAC,CAAA,GAJZ,oBAIc,WAAA,UAAA,CAAA;AACiC,gBAAA,CAAzD,MAAM;CAAE,MAAM;CAAQ,WAAW;CAAM,UAAU;AAAK,CAAC,CAAA,GAL7C,oBAK+C,WAAA,UAAA,CAAA;AACf,gBAAA,CAA1C,MAAM;CAAE,MAAM;CAAW,SAAS;AAAK,CAAC,CAAA,GAN9B,oBAMgC,WAAA,WAAA,CAAA;AANhC,sBAAN,gBAAA,CAPN,KAAK;CACJ,WAAW;CACX,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,GACA,aAAa,EAAE,MAAM,WAAW,CAAC,CAAA,GACrB,mBAAA;AAuBN,IAAM,gCAAN,cAA4C,eAAoC;CACrF,OAAgB,aAAa;AAC/B;AAiBO,IAAM,kBAAN,cAA8B,WAAW;CAClC,WAAmB;CAK/B,iBAAyB;CACgB,UAAkB;CACD,UACxD;CAC2C,SAAiB;CACtB,aAAqB;CACrB,WAAmB;CACf,iBAC1C;CACuC,QAAuB;CACN,aAE/C;CACkC,aAA0B;AACzE;AApBkD,cAArC,iBAA4C,mBAAkB,8BAAA;AAC7D,gBAAA,CAAX,SAAS,CAAA,GADC,gBACC,WAAA,YAAA,CAAA;AAKZ,gBAAA,CAJC,WAAW,qBAAqB;CAC/B,UAAU;CACV,UAAU;AACZ,CAAC,CAAA,GALU,gBAMX,WAAA,kBAAA,CAAA;AACyC,gBAAA,CAAxC,MAAM;CAAE,MAAM;CAAQ,UAAU;AAAK,CAAC,CAAA,GAP5B,gBAO8B,WAAA,WAAA,CAAA;AACiB,gBAAA,CAAzD,MAAM;CAAE,MAAM;CAAQ,UAAU;CAAM,WAAW;AAAK,CAAC,CAAA,GAR7C,gBAQ+C,WAAA,WAAA,CAAA;AAEb,gBAAA,CAA5C,MAAM;CAAE,MAAM;CAAQ,SAAS;AAAU,CAAC,CAAA,GAVhC,gBAUkC,WAAA,UAAA,CAAA;AACL,gBAAA,CAAvC,MAAM;CAAE,MAAM;CAAW,SAAS;AAAE,CAAC,CAAA,GAX3B,gBAW6B,WAAA,cAAA,CAAA;AACA,gBAAA,CAAvC,MAAM;CAAE,MAAM;CAAW,SAAS;AAAE,CAAC,CAAA,GAZ3B,gBAY6B,WAAA,YAAA,CAAA;AACI,gBAAA,CAA3C,MAAM;CAAE,MAAM;CAAW,UAAU;AAAK,CAAC,CAAA,GAb/B,gBAaiC,WAAA,kBAAA,CAAA;AAEH,gBAAA,CAAxC,MAAM;CAAE,MAAM;CAAQ,UAAU;AAAK,CAAC,CAAA,GAf5B,gBAe8B,WAAA,SAAA,CAAA;AACiB,gBAAA,CAAzD,MAAM;CAAE,MAAM;CAAQ,UAAU;CAAM,WAAW;AAAK,CAAC,CAAA,GAhB7C,gBAgB+C,WAAA,cAAA,CAAA;AAGb,gBAAA,CAA5C,MAAM;CAAE,MAAM;CAAY,UAAU;AAAK,CAAC,CAAA,GAnBhC,gBAmBkC,WAAA,cAAA,CAAA;AAnBlC,kBAAN,gBAAA,CAdN,KAAK;CACJ,WAAW;CACX,KAAK;CACL,KAAK;CACL,KAAK;CACL,SAAS,CACP;EACE,MAAM;EACN,SAAS;GAAC;GAAY;GAAkB;EAAS;EACjD,QAAQ;CACV,CACF;AACF,CAAC,GACA,aAAa,EAAE,MAAM,WAAW,CAAC,CAAA,GACrB,eAAA;AAqBN,IAAM,4BAAN,cAAwC,eAAgC;CAC7E,OAAgB,aAAa;AAC/B;AASO,IAAM,sBAAN,cAAkC,WAAW;CAElD,MAAM,QACJ,OAAgC,CAAC,GACjC,UACe;EACf,MAAM,EAAE,0BAA0B,MAAM,OAAO,2BAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EAC/C,MAAM,sBAAsB,IAAI;CAClC;AACF;AATsD,cAAzC,qBAAgD,mBAAkB,8BAAA;AAEvE,gBAAA,CADL,mBAAmB,CAAA,GADT,oBAEL,WAAA,WAAA,CAAA;AAFK,sBAAN,gBAAA,CANN,KAAK;CACJ,WAAW;CACX,KAAK;CACL,KAAK;CACL,KAAK;AACP,CAAC,CAAA,GACY,mBAAA;AA0BN,IAAM,gBAAN,cAA4B,WAAW;CAChC,WAAmB;CACU,UAAkB;CACnB,WAAmB;AAC7D;AAJgD,cAAnC,eAA0C,mBAAkB,8BAAA;AAC3D,gBAAA,CAAX,SAAS,CAAA,GADC,cACC,WAAA,YAAA,CAAA;AAC6B,gBAAA,CAAxC,MAAM;CAAE,MAAM;CAAQ,UAAU;AAAK,CAAC,CAAA,GAF5B,cAE8B,WAAA,WAAA,CAAA;AACD,gBAAA,CAAvC,MAAM;CAAE,MAAM;CAAW,SAAS;AAAE,CAAC,CAAA,GAH3B,cAG6B,WAAA,YAAA,CAAA;AAH7B,gBAAN,gBAAA,CAdN,KAAK;CACJ,WAAW;CACX,KAAK;CACL,KAAK;CACL,KAAK;CACL,SAAS,CACP;EACE,MAAM;EACN,SAAS,CAAC,YAAY,SAAS;EAC/B,QAAQ;CACV,CACF;AACF,CAAC,GACA,aAAa,EAAE,MAAM,WAAW,CAAC,CAAA,GACrB,aAAA;;;AC9GN,SAAS,iBACd,eACA,YACkB;CAClB,OAAO;EACL,eAAe,cAAc,KAAK,OAAO;GACvC,IAAI,EAAE;GACN,UAAU,EAAE;GACZ,KAAK,EAAE;GACP,QAAQ,EAAE;GACV,QAAQ,EAAE;GACV,SAAS,EAAE;EACb,EAAE;EACF,YAAY,WAAW,KAAK,OAAO;GACjC,IAAI,EAAE;GACN,UAAU,EAAE;GACZ,gBAAgB,EAAE;GAClB,SAAS,EAAE;GACX,QAAQ,EAAE;GACV,UAAU,EAAE;GACZ,gBAAgB,EAAE;GAClB,OAAO,EAAE;EACX,EAAE;CACJ;AACF;AAEO,IAAM,sBAAN,MAA0B;CAC/B,YACmB,OACA,WACjB;EAFiB,KAAA,QAAA;EACA,KAAA,YAAA;CAChB;CAFgB;CACA;CAEnB,MAAc,QAAQ;EACpB,cAAc;EACd,IAAI,CAAE,MAAM,KAAK,UAAU,GACzB,MAAM,IAAI,MAAM,mCAAmC;CACvD;CACA,MAAM,OAAkC;EACtC,MAAM,KAAK,MAAM;EACjB,MAAM,KAAK,MAAM,UAAU;EAC3B,MAAM,gBAAgB,MAAM,KAAK,MAAM,cAAc;EACrD,MAAM,aAAa,MAAM,KAAK,MAAM,WAAW;EAC/C,OAAO,iBACL,cAAc,KAAK,OAAO;GAAE,GAAG;GAAG,IAAI,EAAE,MAAM;EAAG,EAAE,GACnD,WAAW,KAAK,OAAO;GAAE,GAAG;GAAG,IAAI,EAAE,MAAM;EAAG,EAAE,CAClD;CACF;CACA,MAAM,OAAO,OAKK;EAChB,MAAM,KAAK,MAAM;EAYjB,OAAM,OARY,MAHO,8BAA8B,OAAO,EAC5D,IAAI,KAAK,MAAM,GACjB,CAAC,EAAA,CAC4B,OAAO;GAClC,UAAU,cAAc,CAAA,CAAE;GAC1B,KAAK,MAAM;GACX,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,QAAQ,MAAM;GACd,SAAS;EACX,CAAC,EAAA,CACS,KAAK;CACjB;CACA,MAAM,OAAO,IAAY,SAAiC;EACxD,MAAM,KAAK,MAAM;EACjB,IAAI,OAAO,YAAY,WAAW,MAAM,IAAI,MAAM,wBAAwB;EAC1E,MAAM,MAAM,MAAM,KAAK,MAAM,aAAa,EAAE;EAC5C,IAAI,CAAC,KAAK,MAAM,IAAI,MAAM,iCAAiC;EAC3D,IAAI,UAAU;EACd,MAAM,IAAI,KAAK;CACjB;CACA,MAAM,OAAO,IAA8B;EACzC,MAAM,KAAK,MAAM;EACjB,OAAO,KAAK,MAAM,OAAO,EAAE;CAC7B;AACF"}