@marinoscar/platform-api 0.1.0-next.19 → 0.1.0-next.20

package/dist/webhooks/testing/conformance.js

@@ -0,0 +1,316 @@
+"use strict";
+// =============================================================================
+// The `webhooks` conformance suite (issue #1046)
+// =============================================================================
+//
+// Importing `@marinoscar/platform-api/webhooks/testing` registers it with
+// `runPlatformConformance`. It drives the REAL services over the in-memory
+// ports (`./kit.ts`), so an app proves the invariants the slice promises
+// without a database or a network:
+//
+//   routes   every route of the three controllers is authenticated and enforces
+//            exactly its tier's permission string (read for GET, write for the rest);
+//   signing  a delivery's signature verifies with the contract's
+//            `verifyWebhookSignature`; during a rotation overlap it carries two;
+//   egress   loopback, private, link-local (metadata), CGNAT, multicast and
+//            IPv4-mapped targets are refused at create AND at send, and a name
+//            that resolves to a public address at create time but a private one
+//            at send time (DNS rebinding) is refused at send;
+//   secrecy  the signing secret appears in no response but create and rotate,
+//            and in no delivery row, audit row or log line;
+//   queue    no route and no listener makes an outbound request: create, test,
+//            redeliver and emit produce rows and jobs only, and only the slice's
+//            transport touches `node:http`/`node:https`;
+//   authz    an endpoint is invisible (404) across owners, scopes and
+//            organizations, and an owner who lost the permission has the
+//            endpoint switched off at the next event.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webhooksConformanceSuite = void 0;
+exports.discoverWebhookRoutes = discoverWebhookRoutes;
+exports.registerWebhooksConformance = registerWebhooksConformance;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const webhooks_1 = require("@marinoscar/platform-contract/webhooks");
+const index_1 = require("../../identity/index");
+const index_2 = require("../../testing/index");
+const admin_webhooks_controller_1 = require("../http/admin-webhooks.controller");
+const org_webhooks_controller_1 = require("../http/org-webhooks.controller");
+const webhooks_controller_1 = require("../http/webhooks.controller");
+const webhook_views_1 = require("../webhook-views");
+const webhooks_errors_1 = require("../webhooks.errors");
+const kit_1 = require("./kit");
+const in_memory_1 = require("./in-memory");
+const BLOCKED_ADDRESSES = [
+    '127.0.0.1',
+    '10.0.0.5',
+    '172.16.0.1',
+    '172.31.255.254',
+    '192.168.1.1',
+    '169.254.169.254',
+    '100.64.0.1',
+    '0.0.0.0',
+    '224.0.0.1',
+    '255.255.255.255',
+    '::1',
+    '::',
+    'fe80::1',
+    'fd00::1',
+    'fc00::1',
+    'ff02::1',
+    '::ffff:10.0.0.1',
+    '::ffff:127.0.0.1',
+    '::ffff:169.254.169.254',
+    '64:ff9b::a00:1',
+    '2002:a00:1::1',
+];
+const CONTROLLERS = [
+    { controller: webhooks_controller_1.WebhooksController, read: webhooks_1.WEBHOOK_PERMISSIONS.READ, write: webhooks_1.WEBHOOK_PERMISSIONS.WRITE },
+    { controller: org_webhooks_controller_1.OrgWebhooksController, read: webhooks_1.WEBHOOK_PERMISSIONS.ORG_READ, write: webhooks_1.WEBHOOK_PERMISSIONS.ORG_WRITE },
+    { controller: admin_webhooks_controller_1.AdminWebhooksController, read: webhooks_1.WEBHOOK_PERMISSIONS.SYSTEM_READ, write: webhooks_1.WEBHOOK_PERMISSIONS.SYSTEM_WRITE },
+];
+/**
+ * The routes of the three controllers, read from their metadata.
+ *
+ * @returns every handler, with the tier it belongs to.
+ *
+ * @stability experimental
+ */
+function discoverWebhookRoutes() {
+    const routes = [];
+    for (const { controller, read, write } of CONTROLLERS) {
+        const prototype = controller.prototype;
+        for (const name of Object.getOwnPropertyNames(prototype)) {
+            const handler = prototype[name];
+            if (name === 'constructor' || typeof handler !== 'function')
+                continue;
+            const method = Reflect.getMetadata(constants_1.METHOD_METADATA, handler);
+            if (method === undefined || Reflect.getMetadata(constants_1.PATH_METADATA, handler) === undefined)
+                continue;
+            const guards = [...(Reflect.getMetadata(constants_1.GUARDS_METADATA, controller) ?? []), ...(Reflect.getMetadata(constants_1.GUARDS_METADATA, handler) ?? [])];
+            routes.push({
+                id: `${controller.name}#${name}`,
+                method: common_1.RequestMethod[method] ?? String(method),
+                isPublic: Reflect.getMetadata(index_1.IS_PUBLIC_KEY, handler) === true || Reflect.getMetadata(index_1.IS_PUBLIC_KEY, controller) === true,
+                authenticated: guards.length > 0,
+                permissions: [...(Reflect.getMetadata(index_1.PERMISSIONS_KEY, handler) ?? [])],
+                read,
+                write,
+            });
+        }
+    }
+    return routes;
+}
+function sourceFiles(dir) {
+    return (0, node_fs_1.readdirSync)(dir).flatMap((entry) => {
+        const full = (0, node_path_1.join)(dir, entry);
+        if ((0, node_fs_1.statSync)(full).isDirectory())
+            return entry === 'testing' ? [] : sourceFiles(full);
+        return /\.(ts|js)$/.test(entry) && !/\.(d\.ts|spec\.ts)$/.test(entry) ? [full] : [];
+    });
+}
+/** The error a call rejects with, or `undefined` when it resolved. */
+async function rejection(fn) {
+    try {
+        await fn();
+        return undefined;
+    }
+    catch (error) {
+        return error;
+    }
+}
+async function withCapturedLogs(fn) {
+    const logs = [];
+    const proto = common_1.Logger.prototype;
+    const names = ['log', 'warn', 'error', 'debug', 'verbose', 'fatal'];
+    const originals = names.map((name) => proto[name]);
+    for (const name of names)
+        proto[name] = (...args) => void logs.push(args.map((arg) => (typeof arg === 'string' ? arg : JSON.stringify(arg))).join(' '));
+    try {
+        return { result: await fn(), logs };
+    }
+    finally {
+        names.forEach((name, index) => (proto[name] = originals[index]));
+    }
+}
+/**
+ * Registers the suite's cases with the test API.
+ *
+ * @param api - the runner's test API.
+ * @param options - the suite's options.
+ *
+ * @stability experimental
+ */
+function registerWebhooksConformance(api, options) {
+    const { describe, it, expect } = api;
+    const url = 'https://receiver.example.test/hooks/in?token=abc';
+    const eventKeys = ['nodes.*'];
+    describe('webhooks slice conformance (#1046)', () => {
+        it('routes: every route is authenticated and enforces exactly its tier permission', () => {
+            const routes = discoverWebhookRoutes();
+            expect(routes.length).toBeGreaterThanOrEqual(30);
+            const problems = [];
+            for (const route of routes) {
+                if (route.isPublic)
+                    problems.push(`${route.id} is public`);
+                if (!route.authenticated)
+                    problems.push(`${route.id} declares no @Auth(...)`);
+                const wanted = route.method === 'GET' ? route.read : route.write;
+                if (route.permissions.length !== 1 || route.permissions[0] !== wanted)
+                    problems.push(`${route.id} must require exactly ${wanted} (got ${route.permissions.join(', ') || 'none'})`);
+            }
+            expect(problems).toEqual([]);
+        });
+        it('signing: a delivery verifies with verifyWebhookSignature, and a rotation overlap signs twice', async () => {
+            const kit = (0, kit_1.createWebhooksTestKit)();
+            const ctx = kit.context('system');
+            const created = await kit.endpoints.create(ctx, { name: 'sig', url, eventKeys, enabled: true });
+            const send = async () => {
+                const { deliveryId } = await kit.endpoints.test(ctx, created.endpoint.id);
+                await kit.runDeliveryJob(deliveryId, null);
+                const request = kit.receiver.requests[kit.receiver.requests.length - 1];
+                return { request, deliveryId };
+            };
+            const first = await send();
+            const header = first.request.headers[webhooks_1.WEBHOOK_HEADERS.SIGNATURE];
+            expect(header.split(' ').length).toEqual(1);
+            expect(await (0, webhooks_1.verifyWebhookSignature)({ secret: created.secret, id: first.request.headers[webhooks_1.WEBHOOK_HEADERS.ID], timestamp: first.request.headers[webhooks_1.WEBHOOK_HEADERS.TIMESTAMP], body: first.request.body, signatureHeader: header })).toEqual(true);
+            const rotated = await kit.endpoints.rotateSecret(ctx, created.endpoint.id);
+            const second = await send();
+            const both = second.request.headers[webhooks_1.WEBHOOK_HEADERS.SIGNATURE];
+            expect(both.split(' ').length).toEqual(2);
+            for (const secret of [created.secret, rotated.secret]) {
+                expect(await (0, webhooks_1.verifyWebhookSignature)({ secret, id: second.request.headers[webhooks_1.WEBHOOK_HEADERS.ID], timestamp: second.request.headers[webhooks_1.WEBHOOK_HEADERS.TIMESTAMP], body: second.request.body, signatureHeader: both })).toEqual(true);
+            }
+        });
+        it('egress: private, loopback, link-local and metadata targets are refused at create and at send; DNS rebinding is caught at send', async () => {
+            const kit = (0, kit_1.createWebhooksTestKit)();
+            const ctx = kit.context('system');
+            const refused = [];
+            for (const address of [...BLOCKED_ADDRESSES, ...(options.extraBlockedAddresses ?? [])]) {
+                kit.resolver.set('bad.example.test', address);
+                try {
+                    await kit.endpoints.create(ctx, { name: 'bad', url: 'https://bad.example.test/x', eventKeys, enabled: true });
+                    refused.push(`${address} was accepted at create`);
+                }
+                catch (error) {
+                    if (!(error instanceof Error) || error.getStatus?.() !== 422)
+                        refused.push(`${address} failed with ${String(error)}`);
+                }
+            }
+            for (const literal of ['https://127.0.0.1/x', 'https://[::1]/x', 'https://169.254.169.254/latest', 'http://receiver.example.test/x', 'https://user:pw@receiver.example.test/x', 'https://receiver.example.test:22/x']) {
+                try {
+                    await kit.endpoints.create(ctx, { name: 'bad', url: literal, eventKeys, enabled: true });
+                    refused.push(`${literal} was accepted at create`);
+                }
+                catch {
+                    // refused, as required
+                }
+            }
+            expect(refused).toEqual([]);
+            const created = await kit.endpoints.create(ctx, { name: 'ok', url, eventKeys, enabled: true });
+            kit.resolver.set('receiver.example.test', '10.1.2.3');
+            const { deliveryId } = await kit.endpoints.test(ctx, created.endpoint.id);
+            await kit.runDeliveryJob(deliveryId, null);
+            expect(kit.receiver.requests.length).toEqual(0);
+            expect((await kit.repository.deliveries.get(deliveryId))?.errorCode).toEqual('ssrf_blocked');
+        });
+        it('secrecy: the signing secret appears only in the create and rotate responses', async () => {
+            const kit = (0, kit_1.createWebhooksTestKit)();
+            const ctx = kit.context('system');
+            const { result, logs } = await withCapturedLogs(async () => {
+                const created = await kit.endpoints.create(ctx, { name: 'secret', url, eventKeys, enabled: true });
+                const rotated = await kit.endpoints.rotateSecret(ctx, created.endpoint.id);
+                const { deliveryId } = await kit.endpoints.test(ctx, created.endpoint.id);
+                await kit.runDeliveryJob(deliveryId, null);
+                return { created, rotated, deliveryId };
+            });
+            const secrets = [result.created.secret, result.rotated.secret];
+            const exposed = JSON.stringify([
+                await kit.endpoints.list(ctx),
+                await kit.endpoints.get(ctx, result.created.endpoint.id),
+                await kit.endpoints.listDeliveries(ctx, result.created.endpoint.id, { page: 1, pageSize: 20 }),
+                await kit.endpoints.getDelivery(ctx, result.deliveryId),
+                (0, webhook_views_1.toEndpointView)([...kit.repository.endpoints.values()][0]),
+                (0, webhook_views_1.toDeliveryDetail)(kit.repository.deliveries.get(result.deliveryId), 'x'),
+                [...kit.repository.deliveries.values()],
+                kit.audit,
+                logs,
+            ]);
+            for (const secret of secrets)
+                expect(exposed.includes(secret)).toEqual(false);
+            expect(exposed.includes('webhook-signature')).toEqual(false);
+            // The URL is the owner's own data (the API returns it); the logs and the audit trail carry the host only.
+            expect(JSON.stringify([logs, kit.audit]).includes('token=abc')).toEqual(false);
+            expect(JSON.stringify([logs, kit.audit]).includes('/hooks/in')).toEqual(false);
+        });
+        it('queue: creating, testing, redelivering and emitting make no request; only the transport touches node:http', async () => {
+            const kit = (0, kit_1.createWebhooksTestKit)();
+            const ctx = kit.context('system');
+            const created = await kit.endpoints.create(ctx, { name: 'queue', url, eventKeys: ['nodes.*'], enabled: true });
+            const { deliveryId } = await kit.endpoints.test(ctx, created.endpoint.id);
+            kit.repository.setOwner((0, in_memory_1.makeWebhookOwner)({ id: kit_1.KIT_USER_A, permissions: [], systemPermissions: [webhooks_1.WEBHOOK_PERMISSIONS.SYSTEM_READ] }));
+            const emitted = await kit.webhooks.emit('nodes.node.offline', { nodeId: 'n', nodeName: 'n', lastHeartbeatAt: null, markedOfflineAt: new Date().toISOString(), staleAfterMinutes: 5 }, { orgId: null });
+            expect(emitted.queued).toEqual(1);
+            expect(kit.receiver.requests.length).toEqual(0);
+            await kit.runDeliveryJob(deliveryId, null);
+            await kit.endpoints.redeliver(ctx, deliveryId);
+            expect(kit.receiver.requests.length).toEqual(1);
+            const offenders = [];
+            const root = (0, node_path_1.join)(__dirname, '..');
+            for (const file of sourceFiles(root)) {
+                const text = (0, node_fs_1.readFileSync)(file, 'utf8');
+                const isTransport = /egress[\\/]transport\.(ts|js)$/.test(file);
+                if (!isTransport && /node:https?['"]|require\(['"]https?['"]\)|\bfetch\(|undici/.test(text))
+                    offenders.push(file.slice(root.length + 1));
+            }
+            expect(offenders).toEqual([]);
+        });
+        it('authz: endpoints are invisible across owners, scopes and organizations; a lost permission disables the endpoint', async () => {
+            const kit = (0, kit_1.createWebhooksTestKit)();
+            const { endpoint } = await kit.seedEndpoint({ scope: 'user', ownerUserId: kit_1.KIT_USER_A, eventKeys: ['webhooks.ping'] });
+            const crossings = [
+                () => kit.endpoints.get(kit.context('user', kit_1.KIT_USER_B), endpoint.id),
+                () => kit.endpoints.get(kit.context('user', kit_1.KIT_USER_A, undefined, kit_1.KIT_OTHER_ORG_ID), endpoint.id),
+                () => kit.endpoints.get(kit.context('org', kit_1.KIT_USER_A), endpoint.id),
+                () => kit.endpoints.get(kit.context('system', kit_1.KIT_USER_A), endpoint.id),
+                () => kit.endpoints.update(kit.context('user', kit_1.KIT_USER_B), endpoint.id, { name: 'x' }),
+                () => kit.endpoints.remove(kit.context('user', kit_1.KIT_USER_B), endpoint.id),
+                () => kit.endpoints.rotateSecret(kit.context('user', kit_1.KIT_USER_B), endpoint.id),
+                () => kit.endpoints.test(kit.context('user', kit_1.KIT_USER_B), endpoint.id),
+            ];
+            for (const attempt of crossings)
+                expect((await rejection(attempt)) instanceof webhooks_errors_1.WebhookNotFoundError).toEqual(true);
+            expect((await kit.endpoints.list(kit.context('user', kit_1.KIT_USER_B))).length).toEqual(0);
+            expect((await kit.endpoints.list(kit.context('user', kit_1.KIT_USER_A))).length).toEqual(1);
+            const ping = { message: 'm', endpointId: endpoint.id };
+            kit.repository.setOwner((0, in_memory_1.makeWebhookOwner)({ id: kit_1.KIT_USER_A, orgId: kit_1.KIT_ORG_ID, permissions: [webhooks_1.WEBHOOK_PERMISSIONS.READ] }));
+            const allowed = await kit.webhooks.emit('webhooks.ping', ping, { orgId: kit_1.KIT_ORG_ID, userId: kit_1.KIT_USER_A });
+            expect(allowed.queued).toEqual(1);
+            kit.repository.setOwner((0, in_memory_1.makeWebhookOwner)({ id: kit_1.KIT_USER_A, orgId: kit_1.KIT_ORG_ID, permissions: [] }));
+            const lost = await kit.webhooks.emit('webhooks.ping', ping, { orgId: kit_1.KIT_ORG_ID, userId: kit_1.KIT_USER_A });
+            expect(lost.queued).toEqual(0);
+            expect(kit.repository.endpoints.get(endpoint.id)?.enabled).toEqual(false);
+            expect(kit.repository.endpoints.get(endpoint.id)?.disabledReason).toEqual('owner_lost_access');
+        });
+    });
+}
+/**
+ * The `webhooks` conformance suite.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+exports.webhooksConformanceSuite = {
+    id: 'webhooks',
+    title: 'the webhooks slice keeps its invariants',
+    description: 'Routes enforce exact permissions, signatures verify and rotate, private targets are refused at create and send (including DNS rebinding), secrets stay out of responses, rows, audit and logs, nothing sends inline, and endpoints are invisible across owners and organizations.',
+    register(api, _context, options) {
+        registerWebhooksConformance(api, options);
+    },
+};
+if (!index_2.conformanceSuites.has(exports.webhooksConformanceSuite.id))
+    index_2.conformanceSuites.register(exports.webhooksConformanceSuite);
+//# sourceMappingURL=conformance.js.map

package/dist/webhooks/testing/conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.js","sourceRoot":"","sources":["../../../src/webhooks/testing/conformance.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,iDAAiD;AACjD,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,mCAAmC;AACnC,EAAE;AACF,gFAAgF;AAChF,sFAAsF;AACtF,iEAAiE;AACjE,iFAAiF;AACjF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,8DAA8D;AAC9D,8EAA8E;AAC9E,4DAA4D;AAC5D,+EAA+E;AAC/E,iFAAiF;AACjF,yDAAyD;AACzD,sEAAsE;AACtE,yEAAyE;AACzE,sDAAsD;AACtD,gFAAgF;;;AAgGhF,sDAsBC;AAyCD,kEAiKC;AA9TD,qCAA8D;AAC9D,yCAAiC;AAEjC,2CAAuD;AACvD,wDAA2F;AAC3F,qEAAsH;AAEtH,gDAAsE;AACtE,+CAAwD;AAExD,iFAA4E;AAC5E,6EAAwE;AACxE,qEAAiE;AACjE,oDAAoE;AACpE,wDAA0D;AAC1D,+BAAoG;AACpG,2CAA+C;AAyC/C,MAAM,iBAAiB,GAAG;IACxB,WAAW;IACX,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,iBAAiB;IACjB,YAAY;IACZ,SAAS;IACT,WAAW;IACX,iBAAiB;IACjB,KAAK;IACL,IAAI;IACJ,SAAS;IACT,SAAS;IACT,SAAS;IACT,SAAS;IACT,iBAAiB;IACjB,kBAAkB;IAClB,wBAAwB;IACxB,gBAAgB;IAChB,eAAe;CAChB,CAAC;AAEF,MAAM,WAAW,GAA8E;IAC7F,EAAE,UAAU,EAAE,wCAAkB,EAAE,IAAI,EAAE,8BAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,8BAAmB,CAAC,KAAK,EAAE;IACpG,EAAE,UAAU,EAAE,+CAAqB,EAAE,IAAI,EAAE,8BAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,8BAAmB,CAAC,SAAS,EAAE;IAC/G,EAAE,UAAU,EAAE,mDAAuB,EAAE,IAAI,EAAE,8BAAmB,CAAC,WAAW,EAAE,KAAK,EAAE,8BAAmB,CAAC,YAAY,EAAE;CACxH,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,qBAAqB;IACnC,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,WAAW,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAoC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,aAAa,IAAI,OAAO,OAAO,KAAK,UAAU;gBAAE,SAAS;YACtE,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,2BAAe,EAAE,OAAO,CAA8B,CAAC;YAC1F,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,yBAAa,EAAE,OAAO,CAAC,KAAK,SAAS;gBAAE,SAAS;YAChG,MAAM,MAAM,GAAG,CAAC,GAAI,CAAC,OAAO,CAAC,WAAW,CAAC,2BAAe,EAAE,UAAU,CAAC,IAAI,EAAE,CAAe,EAAE,GAAI,CAAC,OAAO,CAAC,WAAW,CAAC,2BAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAe,CAAC,CAAC;YACrK,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,IAAI,EAAE;gBAChC,MAAM,EAAE,sBAAa,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC;gBAC/C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,qBAAa,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,qBAAa,EAAE,UAAU,CAAC,KAAK,IAAI;gBACzH,aAAa,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;gBAChC,WAAW,EAAE,CAAC,GAAI,CAAC,OAAO,CAAC,WAAW,CAAC,uBAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAc,CAAC;gBACrF,IAAI;gBACJ,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,EAA0B;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAI,EAAoB;IACrD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,eAAM,CAAC,SAAoE,CAAC;IAC1F,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACnK,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAiC,CAAC,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,GAAuB,EAAE,OAAmC;IACtG,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACrC,MAAM,GAAG,GAAG,kDAAkD,CAAC;IAC/D,MAAM,SAAS,GAAG,CAAC,SAAS,CAAC,CAAC;IAE9B,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAClD,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;YACvF,MAAM,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,aAAa;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;gBACjE,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM;oBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,yBAAyB,MAAM,SAAS,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;YACrL,CAAC;YACD,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;YAC5G,MAAM,GAAG,GAAG,IAAA,2BAAqB,GAAE,CAAC;YACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;gBACtB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1E,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;gBACzE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YACjC,CAAC,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAe,CAAC,SAAS,CAAW,CAAC;YAC1E,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM,CACJ,MAAM,IAAA,iCAAsB,EAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAe,CAAC,EAAE,CAAE,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAe,CAAC,SAAS,CAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAC1N,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAEhB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAe,CAAC,SAAS,CAAW,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1C,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,MAAM,CACJ,MAAM,IAAA,iCAAsB,EAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAe,CAAC,EAAE,CAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,0BAAe,CAAC,SAAS,CAAE,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAC3M,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+HAA+H,EAAE,KAAK,IAAI,EAAE;YAC7I,MAAM,GAAG,GAAG,IAAA,2BAAqB,GAAE,CAAC;YACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,4BAA4B,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC9G,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,yBAAyB,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAK,KAAsC,CAAC,SAAS,EAAE,EAAE,KAAK,GAAG;wBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,gBAAgB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC1J,CAAC;YACH,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,gCAAgC,EAAE,gCAAgC,EAAE,yCAAyC,EAAE,oCAAoC,CAAC,EAAE,CAAC;gBACtN,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBACzF,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,yBAAyB,CAAC,CAAC;gBACpD,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1E,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChD,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;YAC3F,MAAM,GAAG,GAAG,IAAA,2BAAqB,GAAE,CAAC;YACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE;gBACzD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnG,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC3E,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1E,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBAC3C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YAC1C,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC7B,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC7B,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxD,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;gBAC9F,MAAM,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;gBACvD,IAAA,8BAAc,EAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;gBAC1D,IAAA,gCAAgB,EAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAE,EAAE,GAAG,CAAC;gBACxE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK;gBACT,IAAI;aACL,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9E,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7D,0GAA0G;YAC1G,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2GAA2G,EAAE,KAAK,IAAI,EAAE;YACzH,MAAM,GAAG,GAAG,IAAA,2BAAqB,GAAE,CAAC;YACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/G,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC1E,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAA,4BAAgB,EAAC,EAAE,EAAE,EAAE,gBAAU,EAAE,WAAW,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,8BAAmB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;YACrI,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChD,MAAM,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC3C,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEhD,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChE,IAAI,CAAC,WAAW,IAAI,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3I,CAAC;YACD,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iHAAiH,EAAE,KAAK,IAAI,EAAE;YAC/H,MAAM,GAAG,GAAG,IAAA,2BAAqB,GAAE,CAAC;YACpC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAU,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAEtH,MAAM,SAAS,GAAG;gBAChB,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACrE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAU,EAAE,SAAS,EAAE,sBAAgB,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClG,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACvE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvF,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACxE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC9E,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;aACvE,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,SAAS;gBAAE,MAAM,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,YAAY,sCAAoB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClH,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtF,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAEtF,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;YACvD,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAA,4BAAgB,EAAC,EAAE,EAAE,EAAE,gBAAU,EAAE,KAAK,EAAE,gBAAU,EAAE,WAAW,EAAE,CAAC,8BAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1H,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAU,EAAE,MAAM,EAAE,gBAAU,EAAE,CAAC,CAAC;YAC1G,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAElC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAA,4BAAgB,EAAC,EAAE,EAAE,EAAE,gBAAU,EAAE,KAAK,EAAE,gBAAU,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAClG,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAU,EAAE,MAAM,EAAE,gBAAU,EAAE,CAAC,CAAC;YACvG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1E,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACU,QAAA,wBAAwB,GAAoD;IACvF,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,yCAAyC;IAChD,WAAW,EACT,mRAAmR;IACrR,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO;QAC7B,2BAA2B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF,CAAC;AAEF,IAAI,CAAC,yBAAiB,CAAC,GAAG,CAAC,gCAAwB,CAAC,EAAE,CAAC;IAAE,yBAAiB,CAAC,QAAQ,CAAC,gCAAwB,CAAC,CAAC"}

package/dist/webhooks/testing/in-memory.d.ts

@@ -0,0 +1,156 @@
+import type { Job, JobsTx } from '../../jobs/index';
+import type { WebhookDeliveryRow, WebhookEndpointRow, WebhookUserRow } from '../data/webhooks-db';
+import type { HostResolver, ResolvedAddress } from '../egress/egress-guard';
+import { type WebhookTransport, type WebhookTransportRequest, type WebhookTransportResponse } from '../egress/transport';
+import { WebhookSecrets, type SecretAddress } from '../webhook-secrets.service';
+import { WebhooksRepository, type AttemptOutcome, type DeliveryPage, type DeliveryQuery, type LoadedDelivery, type EndpointFilter, type EndpointPatch, type NewDelivery, type NewEndpoint, type SettledAttempt } from '../webhooks.repository';
+/** A job the in-memory repository "enqueued". @stability experimental */
+export interface EnqueuedDeliveryJob {
+    /** Delivery id. */
+    readonly deliveryId: string;
+    /** Org id. */
+    readonly orgId: string | null;
+    /** Reason. */
+    readonly reason: 'upload' | 'rerun';
+    /** Scheduled for. */
+    readonly scheduledFor: Date | null;
+}
+/**
+ * The data port in memory. Emulates the unique `(endpointId, eventId)` key, the
+ * cascade on endpoint delete and the organization/owner pinning of every query.
+ *
+ * @stability experimental
+ */
+export declare class InMemoryWebhooksRepository extends WebhooksRepository {
+    /** Endpoints by id. */
+    readonly endpoints: Map<string, WebhookEndpointRow>;
+    /** Deliveries by id. */
+    readonly deliveries: Map<string, WebhookDeliveryRow>;
+    /** Users by id, for the owner re-check; set with {@link InMemoryWebhooksRepository.setOwner}. */
+    readonly owners: Map<string, WebhookUserRow>;
+    /** Every delivery job enqueued. */
+    readonly enqueued: EnqueuedDeliveryJob[];
+    /** Clock. */
+    now: () => Date;
+    /** Sets what the owner re-check will see. */
+    setOwner(user: WebhookUserRow): void;
+    private matches;
+    listEndpoints(orgId: string | null, filter: EndpointFilter): Promise<WebhookEndpointRow[]>;
+    findEndpoint(orgId: string | null, id: string, filter: EndpointFilter): Promise<WebhookEndpointRow | null>;
+    countEndpoints(orgId: string | null, filter: EndpointFilter): Promise<number>;
+    createEndpoint(orgId: string | null, data: NewEndpoint): Promise<WebhookEndpointRow>;
+    updateEndpoint(orgId: string | null, id: string, patch: EndpointPatch): Promise<WebhookEndpointRow>;
+    deleteEndpoint(orgId: string | null, id: string): Promise<void>;
+    enabledEndpoints(orgId: string | null, filter: EndpointFilter): Promise<WebhookEndpointRow[]>;
+    disableEndpoint(orgId: string | null, id: string, reason: string): Promise<boolean>;
+    loadOwner(_orgId: string | null, userId: string): Promise<WebhookUserRow | null>;
+    insertDeliveries(orgId: string | null, rows: readonly NewDelivery[]): Promise<WebhookDeliveryRow[]>;
+    findDelivery(orgId: string | null, id: string, filter: EndpointFilter): Promise<WebhookDeliveryRow | null>;
+    loadDeliveryForJob(orgId: string | null, id: string): Promise<LoadedDelivery | null>;
+    listDeliveries(orgId: string | null, endpointId: string, query: DeliveryQuery): Promise<DeliveryPage>;
+    markDelivering(orgId: string | null, id: string): Promise<WebhookDeliveryRow>;
+    settleAttempt(orgId: string | null, deliveryId: string, endpointId: string, outcome: AttemptOutcome): Promise<SettledAttempt>;
+    resetForRedelivery(orgId: string | null, id: string): Promise<WebhookDeliveryRow>;
+    purgeDeliveriesBefore(cutoff: Date): Promise<number>;
+}
+/**
+ * The signing-secret store in memory.
+ *
+ * @stability experimental
+ */
+export declare class InMemoryWebhookSecrets extends WebhookSecrets {
+    /** `<scope>/<owner or org>/<name>` to secret. */
+    readonly stored: Map<string, string>;
+    private key;
+    put(endpoint: SecretAddress, version: number, secret: string): Promise<void>;
+    get(endpoint: SecretAddress, version: number): Promise<string | null>;
+    remove(endpoint: SecretAddress, version: number): Promise<void>;
+    removeAll(endpoint: SecretAddress, upTo: number): Promise<void>;
+}
+/** One scripted answer of the fake receiver. @stability experimental */
+export type FakeReceiverAnswer = FakeReceiverResponse | FakeReceiverFailure;
+/** The receiver answers with an HTTP status. @stability experimental */
+export interface FakeReceiverResponse {
+    /** The status. */
+    readonly status: number;
+    /** The `Retry-After` header, raw. */
+    readonly retryAfter?: string;
+    /** The body kept as the snippet. */
+    readonly snippet?: string;
+}
+/** The request fails before an answer. @stability experimental */
+export interface FakeReceiverFailure {
+    /** `timeout` or `network`. */
+    readonly fail: 'timeout' | 'network';
+}
+/**
+ * A fake receiver: records every request and answers from a script (the last
+ * answer repeats; the default is `200 ok`).
+ *
+ * @stability experimental
+ */
+export declare class FakeWebhookReceiver implements WebhookTransport {
+    /** Every request received. */
+    readonly requests: WebhookTransportRequest[];
+    private script;
+    /** Sets the answers, in order. */
+    answerWith(...answers: FakeReceiverAnswer[]): this;
+    send(request: WebhookTransportRequest): Promise<WebhookTransportResponse>;
+}
+/**
+ * A DNS resolver whose answers a test scripts per host name (and changes
+ * between calls, to model DNS rebinding).
+ *
+ * @stability experimental
+ */
+export declare class ScriptedHostResolver implements HostResolver {
+    private readonly answers;
+    /** Every name resolved, in order. */
+    readonly lookups: string[];
+    /** Sets the addresses of `hostname`; an empty list means "does not resolve". */
+    set(hostname: string, ...addresses: string[]): this;
+    resolveAll(hostname: string): Promise<ResolvedAddress[]>;
+}
+/** What {@link RecordingJobs} keeps of an enqueue. @stability experimental */
+export interface RecordedJob {
+    /** The job type. */
+    type: string;
+    /** The subject id. */
+    subjectId?: string | null;
+    /** The organization. */
+    orgId?: string | null;
+    /** The payload. */
+    payload?: unknown;
+}
+/** One `notifyNow` call the kit recorded. @stability experimental */
+export interface RecordedNotification {
+    /** The notification event key. */
+    eventKey: string;
+    /** The recipient. */
+    userId: string;
+    /** The event data. */
+    data: unknown;
+}
+/** A fake `JobsService` that records what it was asked to enqueue. @stability experimental */
+export declare class RecordingJobs {
+    /** Every `enqueue` input. */
+    readonly enqueued: RecordedJob[];
+    /** Every `enqueueWithin` input. */
+    readonly enqueuedWithin: RecordedJob[];
+    /** Records the input. */
+    enqueue(input: RecordedJob): Promise<Job>;
+    /** Records the input. */
+    enqueueWithin(_tx: JobsTx, input: RecordedJob): Promise<Job>;
+}
+/** Builds a user with the given permissions, as `loadOwner` returns it. @stability experimental */
+export declare function makeWebhookOwner(input: {
+    id: string;
+    /** The permissions of the organization role (and none of the system roles). */
+    permissions: readonly string[];
+    /** The organization the membership is in; omit for a system-only user. */
+    orgId?: string;
+    /** System-role permissions (an administrator). */
+    systemPermissions?: readonly string[];
+    isActive?: boolean;
+}): WebhookUserRow;
+//# sourceMappingURL=in-memory.d.ts.map

package/dist/webhooks/testing/in-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory.d.ts","sourceRoot":"","sources":["../../../src/webhooks/testing/in-memory.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAyB,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAChJ,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAc,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EACL,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAEhC,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,mBAAmB;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,cAAc;IACd,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc;IACd,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC;IACpC,qBAAqB;IACrB,QAAQ,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,kBAAkB;IAChE,uBAAuB;IACvB,QAAQ,CAAC,SAAS,kCAAyC;IAC3D,wBAAwB;IACxB,QAAQ,CAAC,UAAU,kCAAyC;IAC5D,iGAAiG;IACjG,QAAQ,CAAC,MAAM,8BAAqC;IACpD,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAM;IAC9C,aAAa;IACb,GAAG,EAAE,MAAM,IAAI,CAAoB;IAEnC,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAIpC,OAAO,CAAC,OAAO;IAIT,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAI1F,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAK1G,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAI7E,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0BpF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOnG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAI7F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQnF,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAIhF,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA6BnG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAO1G,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOpF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IASrG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS7E,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IA0B7H,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQjF,qBAAqB,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;CAU3D;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,cAAc;IACxD,iDAAiD;IACjD,QAAQ,CAAC,MAAM,sBAA6B;IAE5C,OAAO,CAAC,GAAG;IAIL,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5E,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D,SAAS,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtE;AAED,wEAAwE;AACxE,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,GAAG,mBAAmB,CAAC;AAE5E,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,kBAAkB;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,gBAAgB;IAC1D,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,EAAE,CAAM;IAClD,OAAO,CAAC,MAAM,CAA4B;IAE1C,kCAAkC;IAClC,UAAU,CAAC,GAAG,OAAO,EAAE,kBAAkB,EAAE,GAAG,IAAI;IAK5C,IAAI,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAMhF;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,qCAAqC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAM;IAEhC,gFAAgF;IAChF,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAK7C,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;CAM/D;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mBAAmB;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,8FAA8F;AAC9F,qBAAa,aAAa;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAM;IACtC,mCAAmC;IACnC,QAAQ,CAAC,cAAc,EAAE,WAAW,EAAE,CAAM;IAE5C,yBAAyB;IACnB,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAK/C,yBAAyB;IACnB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;CAInE;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,+EAA+E;IAC/E,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,cAAc,CAWjB"}