@marinoscar/platform-web 0.1.0-next.3 → 0.1.0-next.4

package/dist/notifications/headless/notificationStream.js

@@ -0,0 +1,186 @@
+/**
+ * The notification stream — `GET /api/notifications/stream`, over the
+ * fetch-based SSE client.
+ *
+ * Issue #127, epic #109. Thin by design: everything about SSE framing,
+ * reconnection and backoff lives in core's `connectSse` (`core/http/sse.ts`), and everything about
+ * what a notification IS lives in `types/index.ts`. What is left here is the
+ * three things that are specific to this one stream — its URL, its frame name,
+ * and how a frame's `data` becomes something the notification centre can hold.
+ *
+ * =============================================================================
+ * ⚠️ THE STREAM IS NOT A DELIVERY GUARANTEE. READ THIS BEFORE RELYING ON IT.
+ * =============================================================================
+ *
+ * There is no replay. The API buffers nothing, honours no `Last-Event-ID`, and
+ * keeps no log — anything published while this connection is down is simply
+ * never seen by this tab. `NotificationStreamService`'s own header says so, and
+ * it is a design decision rather than a gap to be filled later: the
+ * `notifications` TABLE is the source of truth, and one indexed query after a
+ * gap is strictly more reliable than any cursor built on top of a stream.
+ *
+ * Two consequences, and the second is the one that gets forgotten:
+ *
+ *   1. THE CALLER MUST REFETCH THE LIST AND THE UNREAD COUNT ON EVERY `onOpen`,
+ *      not merely on mount. `onOpen` fires on the first connection AND on every
+ *      reconnection, which is exactly the signal "there may have been a gap;
+ *      re-read the truth". `NotificationProvider` does this — see its
+ *      `handleOpen`. Delete that and the bell goes stale after the first
+ *      network blip, permanently, with nothing in any log to say why.
+ *
+ *   2. Even a connection that never drops can miss events. The API's stream
+ *      registry is PER PROCESS: with more than one API replica, a tab connected
+ *      to pod A receives nothing for an event published on pod B. The
+ *      notification is not lost — the row was written before the publish — but
+ *      the live nudge is. The same refetch-on-connect covers this, which is why
+ *      no separate mechanism exists for it.
+ *
+ * So: a missed frame is a missing TOAST, never a missing notification. Keep it
+ * that way. Anything that makes the centre's contents depend on having received
+ * a frame turns a degradation into a defect.
+ */
+import { apiBaseUrl, api } from './api.js';
+import { connectSse } from './sse.js';
+/**
+ * The `event:` name the API publishes notifications under.
+ *
+ * MUST MATCH `NOTIFICATION_SSE_EVENT` in
+ * `apps/api/src/notifications/notification-stream.service.ts`. The API names its
+ * frames rather than using the default `message` precisely so this client can
+ * ignore anything else the stream ever carries; the cost is that the string is
+ * declared in two repositories-worth of code and a rename must touch both. A
+ * mismatch fails SILENTLY — frames arrive, no listener matches, the bell simply
+ * never updates live — which is why it is a named constant here and compared
+ * explicitly rather than inlined into a condition.
+ */
+export const NOTIFICATION_SSE_EVENT = 'notification';
+/** The stream's URL, resolved against the same base as every other API call. */
+export function notificationStreamUrl() {
+    return `${apiBaseUrl()}/notifications/stream`;
+}
+/**
+ * Parse one frame's `data` into a stream event, or `null` if it is not one.
+ *
+ * VALIDATED, NOT CAST. `JSON.parse` returns `any`, and a bare
+ * `as NotificationStreamEvent` would let a malformed or truncated frame through
+ * to a component that then renders `undefined` as a title — or worse, calls
+ * `new Notification(undefined)`. The check is cheap and this is untrusted input
+ * in the only sense that matters: it arrived over a socket and this code cannot
+ * see what produced it.
+ *
+ * Returns `null` rather than throwing, because a bad frame must not kill the
+ * read loop. One unparseable event should cost one notification, not the
+ * connection.
+ *
+ * Exported for tests: the framing is verifiable without a network.
+ */
+export function parseNotificationEvent(data) {
+    let raw;
+    try {
+        raw = JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+    if (typeof raw !== 'object' || raw === null)
+        return null;
+    const value = raw;
+    // Every field the centre actually renders is required. `link` is checked for
+    // `string | null` specifically — `undefined` is not acceptable, because the
+    // API always sends the key and its absence means the payload is not what this
+    // client thinks it is.
+    //
+    // `toast` (#226) is held to the same standard rather than defaulted, and the
+    // choice is deliberate. Defaulting a missing flag to `true` would let a frame
+    // this client cannot fully understand re-enable a notification an
+    // administrator switched off; defaulting it to `false` would silently drop
+    // toasts against a server that is sending them. Requiring it makes the
+    // contract explicit — the API always sends the key — and a frame that lacks
+    // it is treated like any other malformed frame: dropped here, still present
+    // in the table, picked up by the next refetch.
+    if (typeof value.id !== 'string' ||
+        typeof value.eventKey !== 'string' ||
+        typeof value.title !== 'string' ||
+        typeof value.body !== 'string' ||
+        typeof value.createdAt !== 'string' ||
+        typeof value.toast !== 'boolean' ||
+        !(typeof value.link === 'string' || value.link === null)) {
+        return null;
+    }
+    return {
+        id: value.id,
+        eventKey: value.eventKey,
+        title: value.title,
+        body: value.body,
+        link: value.link,
+        createdAt: value.createdAt,
+        toast: value.toast,
+        // #625: optional and NOT validated like `toast`. An older server omits it,
+        // and anything but a literal `true` reads as "not pushed", which keeps the
+        // page's own toast — the fail-safe direction.
+        pushed: value.pushed === true,
+    };
+}
+/**
+ * Widen a streamed event into a full notification row.
+ *
+ * TWO DIFFERENCES, AND BOTH ARE RECONCILED HERE. `readAt: null` is not a guess:
+ * the API omits the field from the stream because a notification is unread BY
+ * DEFINITION at the instant it is published. And `toast` is DROPPED: it is an
+ * instruction about this one live delivery ("may the OS bubble be raised?"),
+ * not a property of the stored row, and the same notification fetched from
+ * `GET /api/notifications` has no such field.
+ *
+ * Keeping it would make a streamed notification and a fetched one two subtly
+ * different objects in the same list — precisely the divergence the API avoided
+ * by giving the stream the row's shape in the first place. `pushed` (#625) is
+ * dropped for the same reason. A caller that needs
+ * the flags reads them off the stream event, before this conversion; `onFrame`
+ * below holds both.
+ */
+export function streamEventToNotification(event) {
+    const { toast: _toast, pushed: _pushed, ...notification } = event;
+    return { ...notification, readAt: null };
+}
+/**
+ * Connect to this user's notification stream.
+ *
+ * NO USER ID ARGUMENT, and there is no way to add one: the recipient is the
+ * bearer of the token, resolved server-side. That is the isolation property the
+ * whole feature rests on — a stream selected by a client-supplied id would be
+ * an IDOR, and the API deliberately exposes no parameter that could carry one.
+ *
+ * Credentials are read through `api` on every attempt rather than captured, so
+ * a connection that outlives its 15-minute access token reconnects with the
+ * current one; a 401 renews through the same `refreshToken` path every other
+ * request uses, so the stream and the REST calls can never disagree about
+ * whether the session is alive.
+ */
+export function connectNotificationStream(handlers) {
+    return connectSse({
+        url: notificationStreamUrl(),
+        authorization: () => {
+            const token = api.getAccessToken?.() ?? null;
+            return token ? `Bearer ${token}` : null;
+        },
+        reauthenticate: () => api.refreshToken?.() ?? Promise.resolve(false),
+        onOpen: handlers.onOpen,
+        onStateChange: handlers.onStateChange,
+        onFrame: (frame) => {
+            // Compared by NAME, so anything the stream grows later is ignored rather
+            // than mis-parsed as a notification. An unrecognised frame is not an
+            // error — it is a newer server talking to an older bundle.
+            if (frame.event !== NOTIFICATION_SSE_EVENT)
+                return;
+            const event = parseNotificationEvent(frame.data);
+            // A malformed frame is dropped silently. The row still exists server-side
+            // and the next refetch — on the next reconnect, or the next time the bell
+            // is opened — picks it up, so dropping it here costs liveness and nothing
+            // more.
+            if (!event)
+                return;
+            handlers.onNotification(streamEventToNotification(event), event.toast, event.pushed === true);
+        },
+    });
+}
+//# sourceMappingURL=notificationStream.js.map

package/dist/notifications/headless/notificationStream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notificationStream.js","sourceRoot":"","sources":["../../../src/notifications/headless/notificationStream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAqC,MAAM,UAAU,CAAC;AAGzE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAErD,gFAAgF;AAChF,MAAM,UAAU,qBAAqB;IACnC,OAAO,GAAG,UAAU,EAAE,uBAAuB,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,GAA8B,CAAC;IAE7C,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,uBAAuB;IACvB,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,kEAAkE;IAClE,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,+CAA+C;IAC/C,IACE,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS;QAChC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,2EAA2E;QAC3E,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAA8B;IAE9B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC;IAElE,OAAO,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAqCD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAoC;IAEpC,OAAO,UAAU,CAAC;QAChB,GAAG,EAAE,qBAAqB,EAAE;QAE5B,aAAa,EAAE,GAAG,EAAE;YAClB,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI,CAAC;YAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,CAAC;QAED,cAAc,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAEpE,MAAM,EAAE,QAAQ,CAAC,MAAM;QAEvB,aAAa,EAAE,QAAQ,CAAC,aAAa;QAErC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,yEAAyE;YACzE,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,sBAAsB;gBAAE,OAAO;YAEnD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjD,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,QAAQ;YACR,IAAI,CAAC,KAAK;gBAAE,OAAO;YAEnB,QAAQ,CAAC,cAAc,CACrB,yBAAyB,CAAC,KAAK,CAAC,EAChC,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,MAAM,KAAK,IAAI,CACtB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/notifications/headless/pushConfig.d.ts

@@ -0,0 +1,190 @@
+/**
+ * The runtime-configurable Web Push (VAPID) admin API, as the web app sees it.
+ *
+ * Issue #355 — see `docs/specs/browser-notifications.md` and the parallel
+ * backend work in `apps/api/src/notifications/push-config.*`. Shaped after
+ * `services/dbBackup.ts`: `services/api.ts` stays the transport (the
+ * `ApiService` instance, the refresh dance, the maintenance recogniser), and
+ * this module holds the five `/admin/push-config` calls next to the types
+ * they produce.
+ *
+ * =============================================================================
+ * THE PRIVATE KEY IS NEVER ON THE WIRE, IN EITHER DIRECTION
+ * =============================================================================
+ *
+ * No endpoint below ever returns plaintext key material — only
+ * `PrivateKeyStatus`, a masked hint mirroring `SmtpPasswordStatus`
+ * (`types/index.ts`). Nothing in this module, or in any component built on
+ * it, should ever grow a field that could hold the real private key.
+ *
+ * =============================================================================
+ * TWO CONFIRMATION LITERALS, DELIBERATELY DIFFERENT WORDS
+ * =============================================================================
+ *
+ * `ROTATE` and `REMOVE` are Zod literals on the API's DTOs, exactly like
+ * `RESTORE`/`ROLLBACK` in `services/dbBackup.ts` — two different words so a
+ * confirmation typed for one destructive action can never accidentally
+ * satisfy the other. The dialog compares what an admin typed against these
+ * constants rather than a string re-typed a second time in a component.
+ */
+/**
+ * What the UI may know about the stored private key. Mirrors
+ * `SmtpPasswordStatus` field for field: never the plaintext, only enough to
+ * say WHICH key is live and when it was last set.
+ */
+export interface PrivateKeyStatus {
+    /** Is a private key stored at all? */
+    configured: boolean;
+    /** A masked hint (e.g. `"••••ab12"`), or `null` when nothing is stored. NEVER the real key. */
+    hint: string | null;
+    /** When the stored key was last written. `null` when nothing is stored. */
+    updatedAt: string | null;
+    /** Who last wrote it. `null` when nothing is stored, or that user was deleted. */
+    updatedByUserId: string | null;
+}
+/**
+ * `GET /api/admin/push-config`, and the body every write below returns.
+ *
+ * `publicKey` is the ONE piece of key material this view carries in full —
+ * it is not secret, and an admin needs to be able to read and copy it (it is
+ * what a client-side `pushManager.subscribe` call is given). The private key
+ * never appears here or anywhere else; see {@link PrivateKeyStatus}.
+ */
+export interface PushConfigAdminView {
+    enabled: boolean;
+    configured: boolean;
+    publicKey: string | null;
+    subject: string | null;
+    privateKeyStatus: PrivateKeyStatus;
+    /**
+     * Set when the stored row could not be read — mirrors
+     * `EmailSettings.settingsError`. When present, the fields above are
+     * defaults, not this deployment's real configuration.
+     */
+    settingsError?: string | null;
+    /** Bumped on every write. Pass back as `If-Match` on the next `PUT`. */
+    version: number;
+    updatedAt: string | null;
+    /**
+     * Who last wrote the settings row — an object, NOT a string (issue #618:
+     * the page used to interpolate it and print `[object Object]`). `null` when
+     * nobody has, or that user was deleted.
+     */
+    updatedBy?: PushConfigUpdatedBy | null;
+}
+/** The user who last wrote the push settings row. */
+export interface PushConfigUpdatedBy {
+    id: string;
+    email: string;
+}
+/** `PUT /api/admin/push-config` — non-destructive; keys are retained either way. */
+export interface UpdatePushConfigInput {
+    enabled: boolean;
+    subject: string | null;
+}
+/** `POST /api/admin/push-config/generate` and `/rotate` both take an optional subject. */
+export interface PushConfigSubjectInput {
+    subject?: string | null;
+}
+/** The exact strings the API's Zod literals require. Two different words, deliberately. */
+export declare const ROTATE_CONFIRMATION = "ROTATE";
+export declare const REMOVE_CONFIRMATION = "REMOVE";
+/** `GET` — `push:read`. */
+export declare function getPushConfig(): Promise<PushConfigAdminView>;
+/**
+ * `PUT` — `push:write`. Full replacement of `{ enabled, subject }`, with
+ * `If-Match` for optimistic concurrency, copied from `updateEmailSettings`
+ * in `services/api.ts`. `409` on a version conflict, or when `enabled: true`
+ * is requested with nothing configured yet.
+ *
+ * `expectedVersion` is passed through as-is, including `0` — the check on
+ * the header is `undefined`, never a truthiness test, so the very first save
+ * on a fresh deployment is still guarded.
+ */
+export declare function updatePushConfig(input: UpdatePushConfigInput, expectedVersion?: number): Promise<PushConfigAdminView>;
+/**
+ * `POST /generate` — `push:write`. First-time setup only: `409` if a key
+ * pair is already configured.
+ */
+export declare function generatePushConfig(input?: PushConfigSubjectInput): Promise<PushConfigAdminView>;
+/**
+ * `POST /rotate` — `push:write`, DESTRUCTIVE. Every existing push
+ * subscriber goes dark until their client re-subscribes; see the confirm
+ * dialog for the full consequence. The confirmation literal comes from the
+ * constant above rather than being typed here a second time.
+ */
+export declare function rotatePushConfig(input?: PushConfigSubjectInput): Promise<PushConfigAdminView>;
+/**
+ * `DELETE` — `push:write`, DESTRUCTIVE. Deletes both the credential and the
+ * settings row; the public key disappears entirely, so this is strictly
+ * worse for existing subscribers than a rotation.
+ */
+export declare function removePushConfig(): Promise<PushConfigAdminView>;
+/** `POST /admin/push-config/test` body. Both fields optional. */
+export interface PushTestInput {
+    /** This browser's subscription endpoint, so the server can flag "this browser". */
+    endpoint?: string;
+    /** base64url (no padding) of the subscription's `options.applicationServerKey`. */
+    applicationServerKey?: string;
+}
+export type PushTestOverall = 'sent' | 'partial' | 'failed' | 'not_configured' | 'no_subscriptions';
+export type PushTestSubscriptionStatus = 'sent' | 'failed' | 'pruned' | 'skipped';
+export interface PushTestConfigCheck {
+    source: 'admin' | 'env' | 'none';
+    enabled: boolean | null;
+    active: boolean;
+    publicKey: string | null;
+    publicKeyValid: boolean;
+    privateKeyMatchesPublicKey: boolean | null;
+    subject: string | null;
+    subjectValid: boolean;
+    problems: string[];
+}
+export interface PushTestBrowserCheck {
+    endpointProvided: boolean;
+    endpointRegistered: boolean | null;
+    keyMatchesServer: boolean | null;
+}
+export interface PushTestEventCheck {
+    eventKey: string;
+    label: string;
+    mandatory: boolean;
+    policyAllows: boolean;
+    preferenceAllows: boolean;
+}
+export interface PushTestSubscriptionResult {
+    id: string;
+    pushService: string;
+    endpointPreview: string;
+    isThisBrowser: boolean;
+    userAgent: string | null;
+    createdAt: string;
+    lastSuccessAt: string | null;
+    failureCount: number;
+    result: {
+        status: PushTestSubscriptionStatus;
+        statusCode: number | null;
+        message: string | null;
+        responseBody: string | null;
+        durationMs: number;
+    };
+}
+/** `POST /admin/push-config/test` response. */
+export interface PushTestResult {
+    ranAt: string;
+    durationMs: number;
+    overall: PushTestOverall;
+    /** `push-test-<uuid>` — also the `id` of the push payload the worker receives. */
+    testId: string;
+    config: PushTestConfigCheck;
+    browser: PushTestBrowserCheck;
+    events: PushTestEventCheck[];
+    subscriptions: PushTestSubscriptionResult[];
+    hints: string[];
+}
+/**
+ * `POST /test` — `push:write`. Sends a test push to every subscription the
+ * CALLER holds and reports, per subscription, what the push service said.
+ */
+export declare function sendPushTest(input?: PushTestInput): Promise<PushTestResult>;
+//# sourceMappingURL=pushConfig.d.ts.map

package/dist/notifications/headless/pushConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pushConfig.d.ts","sourceRoot":"","sources":["../../../src/notifications/headless/pushConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,UAAU,EAAE,OAAO,CAAC;IACpB,+FAA+F;IAC/F,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kFAAkF;IAClF,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACxC;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,2FAA2F;AAC3F,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAC5C,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAI5C,2BAA2B;AAC3B,wBAAsB,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAElE;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,qBAAqB,EAC5B,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,mBAAmB,CAAC,CAI9B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,GAAE,sBAA2B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,GAAE,sBAA2B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAK9B;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAIrE;AAMD,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;AAEpG,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElF,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACjC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,0BAA0B,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE;QACN,MAAM,EAAE,0BAA0B,CAAC;QACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;IACzB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,aAAa,EAAE,0BAA0B,EAAE,CAAC;IAC5C,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAErF"}

package/dist/notifications/headless/pushConfig.js

@@ -0,0 +1,90 @@
+/**
+ * The runtime-configurable Web Push (VAPID) admin API, as the web app sees it.
+ *
+ * Issue #355 — see `docs/specs/browser-notifications.md` and the parallel
+ * backend work in `apps/api/src/notifications/push-config.*`. Shaped after
+ * `services/dbBackup.ts`: `services/api.ts` stays the transport (the
+ * `ApiService` instance, the refresh dance, the maintenance recogniser), and
+ * this module holds the five `/admin/push-config` calls next to the types
+ * they produce.
+ *
+ * =============================================================================
+ * THE PRIVATE KEY IS NEVER ON THE WIRE, IN EITHER DIRECTION
+ * =============================================================================
+ *
+ * No endpoint below ever returns plaintext key material — only
+ * `PrivateKeyStatus`, a masked hint mirroring `SmtpPasswordStatus`
+ * (`types/index.ts`). Nothing in this module, or in any component built on
+ * it, should ever grow a field that could hold the real private key.
+ *
+ * =============================================================================
+ * TWO CONFIRMATION LITERALS, DELIBERATELY DIFFERENT WORDS
+ * =============================================================================
+ *
+ * `ROTATE` and `REMOVE` are Zod literals on the API's DTOs, exactly like
+ * `RESTORE`/`ROLLBACK` in `services/dbBackup.ts` — two different words so a
+ * confirmation typed for one destructive action can never accidentally
+ * satisfy the other. The dialog compares what an admin typed against these
+ * constants rather than a string re-typed a second time in a component.
+ */
+import { api } from './api.js';
+/** The exact strings the API's Zod literals require. Two different words, deliberately. */
+export const ROTATE_CONFIRMATION = 'ROTATE';
+export const REMOVE_CONFIRMATION = 'REMOVE';
+const BASE = '/admin/push-config';
+/** `GET` — `push:read`. */
+export async function getPushConfig() {
+    return api.get(BASE);
+}
+/**
+ * `PUT` — `push:write`. Full replacement of `{ enabled, subject }`, with
+ * `If-Match` for optimistic concurrency, copied from `updateEmailSettings`
+ * in `services/api.ts`. `409` on a version conflict, or when `enabled: true`
+ * is requested with nothing configured yet.
+ *
+ * `expectedVersion` is passed through as-is, including `0` — the check on
+ * the header is `undefined`, never a truthiness test, so the very first save
+ * on a fresh deployment is still guarded.
+ */
+export async function updatePushConfig(input, expectedVersion) {
+    return api.put(BASE, input, {
+        headers: expectedVersion === undefined ? undefined : { 'If-Match': String(expectedVersion) },
+    });
+}
+/**
+ * `POST /generate` — `push:write`. First-time setup only: `409` if a key
+ * pair is already configured.
+ */
+export async function generatePushConfig(input = {}) {
+    return api.post(`${BASE}/generate`, input);
+}
+/**
+ * `POST /rotate` — `push:write`, DESTRUCTIVE. Every existing push
+ * subscriber goes dark until their client re-subscribes; see the confirm
+ * dialog for the full consequence. The confirmation literal comes from the
+ * constant above rather than being typed here a second time.
+ */
+export async function rotatePushConfig(input = {}) {
+    return api.post(`${BASE}/rotate`, {
+        confirmation: ROTATE_CONFIRMATION,
+        ...input,
+    });
+}
+/**
+ * `DELETE` — `push:write`, DESTRUCTIVE. Deletes both the credential and the
+ * settings row; the public key disappears entirely, so this is strictly
+ * worse for existing subscribers than a rotation.
+ */
+export async function removePushConfig() {
+    return api.delete(BASE, {
+        body: JSON.stringify({ confirmation: REMOVE_CONFIRMATION }),
+    });
+}
+/**
+ * `POST /test` — `push:write`. Sends a test push to every subscription the
+ * CALLER holds and reports, per subscription, what the push service said.
+ */
+export async function sendPushTest(input = {}) {
+    return api.post(`${BASE}/test`, input);
+}
+//# sourceMappingURL=pushConfig.js.map

package/dist/notifications/headless/pushConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pushConfig.js","sourceRoot":"","sources":["../../../src/notifications/headless/pushConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAkE/B,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,MAAM,IAAI,GAAG,oBAAoB,CAAC;AAElC,2BAA2B;AAC3B,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,OAAO,GAAG,CAAC,GAAG,CAAsB,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA4B,EAC5B,eAAwB;IAExB,OAAO,GAAG,CAAC,GAAG,CAAsB,IAAI,EAAE,KAAK,EAAE;QAC/C,OAAO,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE;KAC7F,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgC,EAAE;IAElC,OAAO,GAAG,CAAC,IAAI,CAAsB,GAAG,IAAI,WAAW,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgC,EAAE;IAElC,OAAO,GAAG,CAAC,IAAI,CAAsB,GAAG,IAAI,SAAS,EAAE;QACrD,YAAY,EAAE,mBAAmB;QACjC,GAAG,KAAK;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,OAAO,GAAG,CAAC,MAAM,CAAsB,IAAI,EAAE;QAC3C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;KAC5D,CAAC,CAAC;AACL,CAAC;AA4ED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAuB,EAAE;IAC1D,OAAO,GAAG,CAAC,IAAI,CAAiB,GAAG,IAAI,OAAO,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/notifications/headless/pushDiagnostics.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Web Push test & diagnostics, page side — issue #618.
+ *
+ * `/admin/settings/push` can be "enabled" while nothing ever reaches a phone,
+ * and every link in the chain fails silently: the permission, the service
+ * worker, the browser's push subscription, the server's copy of it, the
+ * VAPID key pair, the push service (FCM, Mozilla autopush, APNs), the device
+ * and finally the worker's `push` handler. This module walks that chain one
+ * explicit step at a time so the panel can point at the link that broke.
+ *
+ * NOTHING EXPORTED HERE THROWS. Every public function returns a structured
+ * result; a failure is data (`status: 'fail'`, a `detail`), not an exception.
+ *
+ * NOTHING SECRET LEAVES THIS MODULE. A subscription's `p256dh`/`auth` keys are
+ * never read into a result, and endpoints are only ever reported as a preview
+ * (`host/…last8`). `buildDiagnosticsReport` is safe to paste into an issue.
+ *
+ * THE ACK. A test push carries `test: true`; `sw.ts` then always shows it and
+ * posts `{ type: 'push-test-received', id, … }` to every window. The listener
+ * is attached BEFORE the API call, because on a fast connection the push can
+ * arrive before the HTTP response does.
+ */
+import { type PushTestResult } from './pushConfig.js';
+export type BrowserPermissionState = 'granted' | 'denied' | 'default' | 'unsupported';
+export interface ServiceWorkerSnapshot {
+    /** The page is controlled by a service worker (`navigator.serviceWorker.controller`). */
+    controlled: boolean;
+    registration: {
+        scope: string;
+        activeState: string | null;
+        waiting: boolean;
+        installing: boolean;
+        scriptURL: string | null;
+    } | null;
+    /** `navigator.serviceWorker.ready` settled within the timeout. */
+    readyWithinTimeout: boolean;
+}
+export interface SubscriptionSnapshot {
+    exists: boolean;
+    /** Host of the push service, e.g. `fcm.googleapis.com`. */
+    pushService: string | null;
+    /** `host/…last8` — never the full endpoint. */
+    endpointPreview: string | null;
+    expirationTime: number | null;
+    /** base64url of `options.applicationServerKey`, or `null` when the browser does not expose it. */
+    applicationServerKey: string | null;
+    /** `null` when either side is unknown. */
+    keyMatchesServer: boolean | null;
+}
+export interface BrowserSnapshot {
+    collectedAt: string;
+    userAgent: string;
+    isSecureContext: boolean;
+    origin: string;
+    hasNotificationApi: boolean;
+    hasServiceWorkerApi: boolean;
+    hasPushManager: boolean;
+    isIos: boolean;
+    isStandalone: boolean;
+    permission: BrowserPermissionState;
+    /** `navigator.permissions.query({ name: 'notifications' })`, or `null` when unavailable. */
+    permissionsApiState: string | null;
+    serviceWorker: ServiceWorkerSnapshot;
+    subscription: SubscriptionSnapshot;
+    /** Set when a probe itself failed unexpectedly. */
+    errors: string[];
+}
+export type DiagnosticStepId = 'support' | 'permission' | 'service-worker' | 'subscription' | 'register' | 'server-test' | 'delivery';
+export type DiagnosticStepStatus = 'pending' | 'running' | 'ok' | 'warn' | 'fail' | 'skipped';
+export interface DiagnosticStep {
+    id: DiagnosticStepId;
+    label: string;
+    status: DiagnosticStepStatus;
+    detail?: string;
+    startedAt: number;
+    durationMs: number;
+}
+/** The worker's `push-test-received` message, plus page-side timing. */
+export interface PushTestAck {
+    id: string;
+    /** Worker clock, epoch ms. */
+    receivedAt: number;
+    shown: boolean;
+    error?: string;
+    hadFocusedClient: boolean;
+    /** Page clock: from just before the API call to the ack arriving. */
+    latencyMs: number;
+}
+export interface PushTestRun {
+    steps: DiagnosticStep[];
+    server: PushTestResult | null;
+    ack: PushTestAck | null;
+    snapshot: BrowserSnapshot;
+    /** Extra client-side hints derived from the run. */
+    hints: string[];
+}
+export interface LocalNotificationResult {
+    ok: boolean;
+    via: 'service-worker' | 'page' | 'none';
+    error?: string;
+}
+export interface RunPushTestOptions {
+    /** How long to wait for `navigator.serviceWorker.ready`. Default 10s. */
+    serviceWorkerTimeoutMs?: number;
+    /** How long to wait for the worker's ack. Default 20s. */
+    ackTimeoutMs?: number;
+}
+export declare const SERVICE_WORKER_TIMEOUT_MS = 10000;
+export declare const ACK_TIMEOUT_MS = 20000;
+export declare const PUSH_TEST_ACK_MESSAGE = "push-test-received";
+export declare const STEP_ORDER: DiagnosticStepId[];
+export declare const DENIED_RECOVERY: string;
+/** base64url, no padding. */
+export declare function bufferToBase64Url(input: ArrayBuffer | ArrayBufferView | null | undefined): string | null;
+export declare function endpointHost(endpoint: string | null | undefined): string | null;
+/** `host/…last8`. Never the full endpoint — it is a bearer capability for the push service. */
+export declare function endpointPreview(endpoint: string | null | undefined): string | null;
+/** `Name: message` for DOMExceptions and Errors, which is what makes Android failures legible. */
+export declare function describeError(error: unknown): string;
+/**
+ * Everything this browser can say about push, read without side effects
+ * (never prompts, never subscribes). `serverPublicKey` enables the key check.
+ */
+export declare function collectBrowserSnapshot(serverPublicKey?: string | null): Promise<BrowserSnapshot>;
+export declare function showLocalTestNotification(): Promise<LocalNotificationResult>;
+/**
+ * Walk the whole chain, reporting every step through `onStep` (called with a
+ * fresh copy of the step each time it changes). Never throws.
+ */
+export declare function runPushTest(vapidPublicKey: string | null, onStep?: (step: DiagnosticStep) => void, options?: RunPushTestOptions): Promise<PushTestRun>;
+export interface DiagnosticsReportInput {
+    snapshot: BrowserSnapshot | null;
+    run?: PushTestRun | null;
+    adminConfig?: {
+        configured: boolean;
+        enabled: boolean;
+        publicKey: string | null;
+        subject: string | null;
+    } | null;
+    clientConfig?: {
+        browserEnabled: boolean;
+        pushEnabled: boolean;
+        vapidPublicKey: string | null;
+    } | null;
+    localNotification?: LocalNotificationResult | null;
+    clientWarnings?: string[];
+}
+/**
+ * A JSON-serialisable report for the Copy button. Carries no subscription
+ * keys (`p256dh`/`auth`) and no full endpoints — only previews.
+ */
+export declare function buildDiagnosticsReport(input: DiagnosticsReportInput): Record<string, unknown>;
+//# sourceMappingURL=pushDiagnostics.d.ts.map

package/dist/notifications/headless/pushDiagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pushDiagnostics.d.ts","sourceRoot":"","sources":["../../../src/notifications/headless/pushDiagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAcpE,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAEtF,MAAM,WAAW,qBAAqB;IACpC,yFAAyF;IACzF,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,IAAI,CAAC;IACT,kEAAkE;IAClE,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,+CAA+C;IAC/C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kGAAkG;IAClG,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,0CAA0C;IAC1C,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,sBAAsB,CAAC;IACnC,4FAA4F;IAC5F,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,aAAa,EAAE,qBAAqB,CAAC;IACrC,YAAY,EAAE,oBAAoB,CAAC;IACnC,mDAAmD;IACnD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,YAAY,GACZ,gBAAgB,GAChB,cAAc,GACd,UAAU,GACV,aAAa,GACb,UAAU,CAAC;AAEf,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE9F,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,gBAAgB,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE,WAAW,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,eAAe,CAAC;IAC1B,oDAAoD;IACpD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,MAAM,CAAC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,eAAO,MAAM,cAAc,QAAS,CAAC;AAErC,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAY1D,eAAO,MAAM,UAAU,EAAE,gBAAgB,EAQxC,CAAC;AAEF,eAAO,MAAM,eAAe,QAGF,CAAC;AAM3B,6BAA6B;AAC7B,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAaxG;AAOD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAO/E;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIlF;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CASpD;AAwDD;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC9B,OAAO,CAAC,eAAe,CAAC,CAwF1B;AAMD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAkDlF;AAmED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,MAAM,GAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAe,EACjD,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,WAAW,CAAC,CA8VtB;AAMD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,GAAG,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE;QACZ,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,GAAG,IAAI,CAAC;IACT,YAAY,CAAC,EAAE;QACb,cAAc,EAAE,OAAO,CAAC;QACxB,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,GAAG,IAAI,CAAC;IACT,iBAAiB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACnD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyB7F"}