@open-mercato/core 0.6.5-develop.4384.1.ce2ec6eaaa → 0.6.5-develop.4393.1.de282b5dfd

package/dist/modules/communication_channels/api/post/webhook/[provider]/route.js

@@ -0,0 +1,175 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../../../../data/entities.js";
+import { getChannelAdapterRegistry } from "../../../../lib/adapter-registry-singleton.js";
+import {
+  COMMUNICATION_CHANNELS_QUEUES,
+  getCommunicationChannelsQueue
+} from "../../../../lib/queue.js";
+const metadata = {
+  path: "/communication_channels/webhook/[provider]",
+  POST: {
+    requireAuth: false,
+    // Unauthenticated by design (signature verification IS the auth), but the
+    // handler fans out an O(N) cross-tenant candidate scan, so bound per-IP
+    // request volume to limit abuse. Generous enough for real provider traffic;
+    // the dedicated gmail route carries its own matching limits.
+    rateLimit: { points: 120, duration: 60, keyPrefix: "cc_webhook_inbound" }
+  }
+};
+async function POST(req, { params }) {
+  const resolvedParams = await params;
+  const providerKey = resolvedParams.provider;
+  const registry = getChannelAdapterRegistry();
+  const adapter = registry?.get(providerKey);
+  if (!adapter) {
+    return NextResponse.json(
+      { error: `No ChannelAdapter for provider: ${providerKey}` },
+      { status: 404 }
+    );
+  }
+  const rawBody = await req.text();
+  const headers = {};
+  req.headers.forEach((value, key) => {
+    headers[key] = value;
+  });
+  const container = await createRequestContainer();
+  const em = container.resolve("em").fork();
+  let credentialsService = null;
+  try {
+    credentialsService = container.resolve("integrationCredentialsService");
+  } catch {
+    credentialsService = null;
+  }
+  try {
+    const candidates = await findWithDecryption(
+      em,
+      CommunicationChannel,
+      {
+        providerKey,
+        isActive: true,
+        deletedAt: null
+      },
+      { orderBy: { createdAt: "desc" } }
+    );
+    let matchedChannel = null;
+    let matchedScope = null;
+    let event = null;
+    let lastVerificationError = null;
+    for (const candidate of candidates) {
+      const candidateScope = {
+        tenantId: candidate.tenantId,
+        organizationId: candidate.organizationId ?? candidate.tenantId
+      };
+      const credentialsLookupScope = {
+        ...candidateScope,
+        userId: candidate.userId ?? null
+      };
+      let credentials = {};
+      if (candidate.credentialsRef && credentialsService) {
+        try {
+          credentials = await credentialsService.resolve(`channel_${providerKey}`, credentialsLookupScope) ?? {};
+        } catch {
+          credentials = {};
+        }
+      }
+      try {
+        event = await adapter.verifyWebhook({
+          rawBody,
+          headers,
+          credentials,
+          scope: candidateScope
+        });
+        matchedChannel = candidate;
+        matchedScope = candidateScope;
+        break;
+      } catch (error) {
+        lastVerificationError = error;
+      }
+    }
+    if (!event || !matchedChannel || !matchedScope) {
+      throw lastVerificationError ?? new Error("Webhook verification failed: no matching channel");
+    }
+    if (event.eventType === "reaction") {
+      if (typeof adapter.normalizeInboundReaction !== "function") {
+        return NextResponse.json(
+          {
+            received: true,
+            queued: false,
+            reason: `adapter '${providerKey}' does not implement normalizeInboundReaction`
+          },
+          { status: 202 }
+        );
+      }
+      const reactionEvent = await adapter.normalizeInboundReaction(event);
+      const reactionJob = {
+        kind: "inbound",
+        providerKey,
+        channelId: matchedChannel.id,
+        channelType: matchedChannel.channelType,
+        event: reactionEvent,
+        // Use the channel's REAL org (null when null), matching the poll and
+        // dedicated gmail webhook path — `candidateScope` falls org
+        // back to tenantId for credential/verify lookups, which must not leak
+        // into the ingest scope (it would diverge dedup for null-org channels).
+        scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },
+        attempt: 1
+      };
+      const reactionsQueue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions);
+      await reactionsQueue.enqueue(reactionJob);
+      return NextResponse.json({ received: true, queued: true, kind: "reaction" }, { status: 202 });
+    }
+    if (event.eventType && event.eventType !== "message") {
+      return NextResponse.json(
+        {
+          received: true,
+          queued: false,
+          reason: `event ${event.eventType} not yet handled`
+        },
+        { status: 202 }
+      );
+    }
+    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound);
+    const jobPayload = {
+      providerKey,
+      channelId: matchedChannel.id,
+      channelType: matchedChannel.channelType,
+      raw: event,
+      // Ingest scope uses the channel's REAL org (null when null) so dedup matches
+      // the poll + dedicated webhook paths; see the reaction branch above.
+      scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null }
+    };
+    await queue.enqueue(jobPayload);
+    return NextResponse.json({ received: true, queued: true, kind: "message" }, { status: 202 });
+  } catch (error) {
+    console.warn(
+      "[communication_channels] inbound webhook verification failed:",
+      error instanceof Error ? error.message : error
+    );
+    return NextResponse.json({ error: "verification_failed" }, { status: 401 });
+  }
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  summary: "Receive a communication channel webhook",
+  methods: {
+    POST: {
+      summary: "Process an inbound channel webhook (Slack, WhatsApp, Email, ...)",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 202, description: "Webhook accepted for async processing" },
+        { status: 401, description: "Signature verification failed against every candidate channel" },
+        { status: 404, description: "Unknown provider" }
+      ]
+    }
+  }
+};
+var route_default = POST;
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/communication_channels/api/post/webhook/[provider]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/communication_channels/api/post/webhook/%5Bprovider%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport { getChannelAdapterRegistry } from '../../../../lib/adapter-registry-singleton'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport type { InboundMessage } from '../../../../lib/adapter'\nimport type { InboundProcessorPayload } from '../../../../workers/inbound-processor'\nimport type { ReactionInboundJob } from '../../../../lib/reaction-processor-types'\n\n/**\n * Inbound webhook endpoint for the communication_channels hub.\n *\n * One endpoint per provider \u2014 provider key in the path. The hub iterates all\n * candidate `CommunicationChannel` rows for `(provider_key, is_active=true,\n * deleted_at IS NULL)` across tenants and asks each adapter to verify the\n * signature with that channel's credentials. The first successful verification\n * pins the request to that channel's tenant scope; we then enqueue an inbound\n * processor job and return 202.\n *\n * Fail-closed: if no candidate verifies, we return 401 \u2014 never 200. This mirrors\n * the per-tenant authentication model used by `shipping_carriers/api/webhook/[provider]`\n * and the security note in SPEC-045d \u00A713.\n *\n * No auth required at the route level \u2014 signature verification IS the auth.\n */\nexport const metadata = {\n  path: '/communication_channels/webhook/[provider]',\n  POST: {\n    requireAuth: false,\n    // Unauthenticated by design (signature verification IS the auth), but the\n    // handler fans out an O(N) cross-tenant candidate scan, so bound per-IP\n    // request volume to limit abuse. Generous enough for real provider traffic;\n    // the dedicated gmail route carries its own matching limits.\n    rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_inbound' },\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ provider: string }> | { provider: string }\n}\n\nexport async function POST(req: Request, { params }: RouteContext): Promise<Response> {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n\n  const registry = getChannelAdapterRegistry()\n  const adapter = registry?.get(providerKey)\n  if (!adapter) {\n    return NextResponse.json(\n      { error: `No ChannelAdapter for provider: ${providerKey}` },\n      { status: 404 },\n    )\n  }\n\n  const rawBody = await req.text()\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  type CredentialsServiceLike = {\n    resolve: (\n      providerOrIntegrationId: string,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<Record<string, unknown> | null>\n  }\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = container.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n\n  try {\n    // The webhook is unauthenticated. The TENANT MUST be derived from a channel whose\n    // per-tenant credentials successfully verify the inbound signature \u2014 NEVER from\n    // attacker-controlled payload headers or unsigned retries.\n    const candidates = await findWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        providerKey,\n        isActive: true,\n        deletedAt: null,\n      },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    let matchedChannel: CommunicationChannel | null = null\n    let matchedScope: { tenantId: string; organizationId: string } | null = null\n    let event: InboundMessage | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates as CommunicationChannel[]) {\n      const candidateScope = {\n        tenantId: candidate.tenantId,\n        organizationId: candidate.organizationId ?? candidate.tenantId,\n      }\n      // Per-user credential lookup: each candidate channel has its own user\n      // and therefore its own credentials row. See review R2-C1 / N1.\n      const credentialsLookupScope = {\n        ...candidateScope,\n        userId: candidate.userId ?? null,\n      }\n      let credentials: Record<string, unknown> = {}\n      if (candidate.credentialsRef && credentialsService) {\n        try {\n          credentials =\n            (await credentialsService.resolve(`channel_${providerKey}`, credentialsLookupScope)) ?? {}\n        } catch {\n          credentials = {}\n        }\n      }\n      try {\n        event = await adapter.verifyWebhook({\n          rawBody,\n          headers,\n          credentials,\n          scope: candidateScope,\n        })\n        matchedChannel = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !matchedChannel || !matchedScope) {\n      throw (\n        lastVerificationError ?? new Error('Webhook verification failed: no matching channel')\n      )\n    }\n\n    // Dispatch by event type:\n    //   - 'message' (default) \u2192 inbound-processor (slice 2b)\n    //   - 'reaction'           \u2192 reaction-processor (slice 2d)\n    //   - 'status_update' / 'other' \u2192 202 not handled (future slice)\n    if (event.eventType === 'reaction') {\n      if (typeof adapter.normalizeInboundReaction !== 'function') {\n        return NextResponse.json(\n          {\n            received: true,\n            queued: false,\n            reason: `adapter '${providerKey}' does not implement normalizeInboundReaction`,\n          },\n          { status: 202 },\n        )\n      }\n      const reactionEvent = await adapter.normalizeInboundReaction(event)\n      const reactionJob: ReactionInboundJob = {\n        kind: 'inbound',\n        providerKey,\n        channelId: matchedChannel.id,\n        channelType: matchedChannel.channelType,\n        event: reactionEvent,\n        // Use the channel's REAL org (null when null), matching the poll and\n        // dedicated gmail webhook path \u2014 `candidateScope` falls org\n        // back to tenantId for credential/verify lookups, which must not leak\n        // into the ingest scope (it would diverge dedup for null-org channels).\n        scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n        attempt: 1,\n      }\n      const reactionsQueue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)\n      await reactionsQueue.enqueue(reactionJob as unknown as Record<string, unknown>)\n      return NextResponse.json({ received: true, queued: true, kind: 'reaction' }, { status: 202 })\n    }\n\n    if (event.eventType && event.eventType !== 'message') {\n      return NextResponse.json(\n        {\n          received: true,\n          queued: false,\n          reason: `event ${event.eventType} not yet handled`,\n        },\n        { status: 202 },\n      )\n    }\n\n    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound)\n    const jobPayload: InboundProcessorPayload = {\n      providerKey,\n      channelId: matchedChannel.id,\n      channelType: matchedChannel.channelType,\n      raw: event,\n      // Ingest scope uses the channel's REAL org (null when null) so dedup matches\n      // the poll + dedicated webhook paths; see the reaction branch above.\n      scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n    }\n    await queue.enqueue(jobPayload as unknown as Record<string, unknown>)\n\n    return NextResponse.json({ received: true, queued: true, kind: 'message' }, { status: 202 })\n  } catch (error: unknown) {\n    // Do not echo adapter/verification internals to an unauthenticated caller;\n    // log the detail server-side and return a fixed, minimal message.\n    console.warn(\n      '[communication_channels] inbound webhook verification failed:',\n      error instanceof Error ? error.message : error,\n    )\n    return NextResponse.json({ error: 'verification_failed' }, { status: 401 })\n  }\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  summary: 'Receive a communication channel webhook',\n  methods: {\n    POST: {\n      summary: 'Process an inbound channel webhook (Slack, WhatsApp, Email, ...)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed against every candidate channel' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAqBA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,IAKb,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,qBAAqB;AAAA,EAC1E;AACF;AAMA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAoC;AACpF,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AAEnC,QAAM,WAAW,0BAA0B;AAC3C,QAAM,UAAU,UAAU,IAAI,WAAW;AACzC,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,mCAAmC,WAAW,GAAG;AAAA,MAC1D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAQ3D,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,UAAU,QAAgC,+BAA+B;AAAA,EAChG,QAAQ;AACN,yBAAqB;AAAA,EACvB;AAEA,MAAI;AAIF,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,QAAI,iBAA8C;AAClD,QAAI,eAAoE;AACxE,QAAI,QAA+B;AACnC,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAsC;AAC5D,YAAM,iBAAiB;AAAA,QACrB,UAAU,UAAU;AAAA,QACpB,gBAAgB,UAAU,kBAAkB,UAAU;AAAA,MACxD;AAGA,YAAM,yBAAyB;AAAA,QAC7B,GAAG;AAAA,QACH,QAAQ,UAAU,UAAU;AAAA,MAC9B;AACA,UAAI,cAAuC,CAAC;AAC5C,UAAI,UAAU,kBAAkB,oBAAoB;AAClD,YAAI;AACF,wBACG,MAAM,mBAAmB,QAAQ,WAAW,WAAW,IAAI,sBAAsB,KAAM,CAAC;AAAA,QAC7F,QAAQ;AACN,wBAAc,CAAC;AAAA,QACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,MAAM,QAAQ,cAAc;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,yBAAiB;AACjB,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,cAAc;AAC9C,YACE,yBAAyB,IAAI,MAAM,kDAAkD;AAAA,IAEzF;AAMA,QAAI,MAAM,cAAc,YAAY;AAClC,UAAI,OAAO,QAAQ,6BAA6B,YAAY;AAC1D,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,QAAQ,YAAY,WAAW;AAAA,UACjC;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,YAAM,gBAAgB,MAAM,QAAQ,yBAAyB,KAAK;AAClE,YAAM,cAAkC;AAAA,QACtC,MAAM;AAAA,QACN;AAAA,QACA,WAAW,eAAe;AAAA,QAC1B,aAAa,eAAe;AAAA,QAC5B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,QAKP,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,QAChG,SAAS;AAAA,MACX;AACA,YAAM,iBAAiB,8BAA8B,8BAA8B,SAAS;AAC5F,YAAM,eAAe,QAAQ,WAAiD;AAC9E,aAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AAEA,QAAI,MAAM,aAAa,MAAM,cAAc,WAAW;AACpD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,QAAQ,SAAS,MAAM,SAAS;AAAA,QAClC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,8BAA8B,8BAA8B,OAAO;AACjF,UAAM,aAAsC;AAAA,MAC1C;AAAA,MACA,WAAW,eAAe;AAAA,MAC1B,aAAa,eAAe;AAAA,MAC5B,KAAK;AAAA;AAAA;AAAA,MAGL,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,IAClG;AACA,UAAM,MAAM,QAAQ,UAAgD;AAEpE,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F,SAAS,OAAgB;AAGvB,YAAQ;AAAA,MACN;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gEAAgE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/api/post/webhooks/gmail/route.js

@@ -0,0 +1,123 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../../../../data/entities.js";
+import {
+  COMMUNICATION_CHANNELS_QUEUES,
+  getCommunicationChannelsQueue
+} from "../../../../lib/queue.js";
+import {
+  decodeGmailPubSubBody,
+  getGmailPubSubVerifier,
+  GmailPubSubJwtError
+} from "../../../../lib/gmail-pubsub-jwt.js";
+const metadata = {
+  path: "/communication_channels/webhooks/gmail",
+  // Unauthenticated at the platform layer (a Google-signed JWT is the auth).
+  // Rate-limited so a caller can't drive unbounded JWT-verification +
+  // cert-fetch work before the signature gate rejects them.
+  POST: { requireAuth: false, rateLimit: { points: 120, duration: 60, keyPrefix: "cc_webhook_gmail" } }
+};
+async function POST(req) {
+  const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE;
+  const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL;
+  if (!expectedAudience || !expectedEmail) {
+    console.error(
+      "[gmail-webhook] OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set"
+    );
+    return NextResponse.json({ error: "webhook not configured" }, { status: 503 });
+  }
+  const verifier = getGmailPubSubVerifier();
+  try {
+    await verifier.verify({
+      authorizationHeader: req.headers.get("authorization"),
+      expectedAudience,
+      expectedEmail
+    });
+  } catch (err) {
+    if (err instanceof GmailPubSubJwtError) {
+      const status = err.code === "wrong_audience" ? 403 : err.code === "fetch_certs_failed" ? 503 : 401;
+      return NextResponse.json({ error: err.code, message: err.message }, { status });
+    }
+    throw err;
+  }
+  let rawBody;
+  try {
+    rawBody = await req.text();
+  } catch {
+    return NextResponse.json({ error: "unreadable_body" }, { status: 400 });
+  }
+  let payload;
+  try {
+    payload = decodeGmailPubSubBody(rawBody);
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "invalid_payload" },
+      { status: 400 }
+    );
+  }
+  const container = await createRequestContainer();
+  const em = container.resolve("em").fork();
+  const channels = await findWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      providerKey: "gmail",
+      externalIdentifier: payload.emailAddress,
+      isActive: true,
+      deletedAt: null
+    }
+  );
+  if (channels.length === 0) {
+    return new NextResponse(null, { status: 204 });
+  }
+  const queue = getCommunicationChannelsQueue(
+    COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync
+  );
+  for (const channel of channels) {
+    const job = {
+      channelId: channel.id,
+      scope: {
+        tenantId: channel.tenantId,
+        organizationId: channel.organizationId ?? null
+      },
+      notification: {
+        emailAddress: payload.emailAddress,
+        historyId: String(payload.historyId)
+      }
+    };
+    try {
+      await queue.enqueue(job);
+    } catch (err) {
+      console.error(
+        `[gmail-webhook] failed to enqueue history-sync for channel ${channel.id}:`,
+        err
+      );
+    }
+  }
+  return new NextResponse(null, { status: 204 });
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  methods: {
+    POST: {
+      summary: "Gmail Pub/Sub push notification webhook (Spec C \xA7 Phase C2)",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 204, description: "Notification verified + history-sync job enqueued" },
+        { status: 400, description: "Body not a valid Pub/Sub envelope" },
+        { status: 401, description: "Invalid JWT or email claim" },
+        { status: 403, description: "Wrong audience" },
+        { status: 503, description: "Webhook not configured / Google certs unreachable" }
+      ]
+    }
+  }
+};
+var route_default = POST;
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/communication_channels/api/post/webhooks/gmail/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/communication_channels/api/post/webhooks/gmail/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport {\n  decodeGmailPubSubBody,\n  getGmailPubSubVerifier,\n  GmailPubSubJwtError,\n} from '../../../../lib/gmail-pubsub-jwt'\n\n/**\n * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push webhook.\n *\n * Auth model: NOT authenticated via the platform's session cookie. Pub/Sub\n * authenticates with a Google-signed JWT in the `Authorization: Bearer \u2026`\n * header, which we verify against Google's public certs.\n *\n * Validation pipeline:\n *   1. Verify JWT signature, audience (`OM_GMAIL_PUBSUB_AUDIENCE`), and\n *      email claim (`OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL`).\n *   2. Decode the Pub/Sub envelope \u2192 `{ emailAddress, historyId }`.\n *   3. Look up every active Gmail channel matching `emailAddress`. Multiple\n *      tenants may have the same mailbox connected \u2014 we enqueue one sync\n *      job per matching channel (each tenant sees their own data).\n *   4. Return `204 No Content` even when no channels match \u2014 returning 4xx\n *      would cause Pub/Sub to retry forever on a permanently-orphaned\n *      registration.\n */\nexport const metadata = {\n  path: '/communication_channels/webhooks/gmail',\n  // Unauthenticated at the platform layer (a Google-signed JWT is the auth).\n  // Rate-limited so a caller can't drive unbounded JWT-verification +\n  // cert-fetch work before the signature gate rejects them.\n  POST: { requireAuth: false, rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_gmail' } },\n}\n\ntype GmailHistorySyncJobPayload = {\n  channelId: string\n  scope: { tenantId: string; organizationId: string | null }\n  notification: { emailAddress: string; historyId: string }\n}\n\nexport async function POST(req: Request): Promise<Response> {\n  const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE\n  const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL\n  if (!expectedAudience || !expectedEmail) {\n    // Misconfiguration is operator-facing; log and 503 so Pub/Sub retries\n    // briefly and the operator notices.\n    console.error(\n      '[gmail-webhook] OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set',\n    )\n    return NextResponse.json({ error: 'webhook not configured' }, { status: 503 })\n  }\n\n  const verifier = getGmailPubSubVerifier()\n  try {\n    await verifier.verify({\n      authorizationHeader: req.headers.get('authorization'),\n      expectedAudience,\n      expectedEmail,\n    })\n  } catch (err) {\n    if (err instanceof GmailPubSubJwtError) {\n      const status =\n        err.code === 'wrong_audience' ? 403 :\n        err.code === 'fetch_certs_failed' ? 503 :\n        401\n      return NextResponse.json({ error: err.code, message: err.message }, { status })\n    }\n    throw err\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await req.text()\n  } catch {\n    return NextResponse.json({ error: 'unreadable_body' }, { status: 400 })\n  }\n\n  let payload: { emailAddress: string; historyId: string | number }\n  try {\n    payload = decodeGmailPubSubBody(rawBody)\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'invalid_payload' },\n      { status: 400 },\n    )\n  }\n\n  // Channel lookup is intentionally NOT tenant-scoped here \u2014 we don't have a\n  // tenant signal beyond the email address. We enumerate matching channels\n  // across all tenants and enqueue one sync job per match. Each job carries\n  // its own tenant scope, so downstream ingest stays tenant-isolated.\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n  const channels = await findWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      providerKey: 'gmail',\n      externalIdentifier: payload.emailAddress,\n      isActive: true,\n      deletedAt: null,\n    },\n  )\n  if (channels.length === 0) {\n    // Return 204 anyway \u2014 see route header comment.\n    return new NextResponse(null, { status: 204 })\n  }\n\n  const queue = getCommunicationChannelsQueue(\n    COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n  )\n  for (const channel of channels) {\n    const job: GmailHistorySyncJobPayload = {\n      channelId: channel.id,\n      scope: {\n        tenantId: channel.tenantId,\n        organizationId: channel.organizationId ?? null,\n      },\n      notification: {\n        emailAddress: payload.emailAddress,\n        historyId: String(payload.historyId),\n      },\n    }\n    try {\n      await queue.enqueue(job as unknown as Record<string, unknown>)\n    } catch (err) {\n      console.error(\n        `[gmail-webhook] failed to enqueue history-sync for channel ${channel.id}:`,\n        err,\n      )\n    }\n  }\n\n  return new NextResponse(null, { status: 204 })\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Gmail Pub/Sub push notification webhook (Spec C \u00A7 Phase C2)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 204, description: 'Notification verified + history-sync job enqueued' },\n        { status: 400, description: 'Body not a valid Pub/Sub envelope' },\n        { status: 401, description: 'Invalid JWT or email claim' },\n        { status: 403, description: 'Wrong audience' },\n        { status: 503, description: 'Webhook not configured / Google certs unreachable' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAoBA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA;AAAA;AAAA;AAAA,EAIN,MAAM,EAAE,aAAa,OAAO,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,mBAAmB,EAAE;AACtG;AAQA,eAAsB,KAAK,KAAiC;AAC1D,QAAM,mBAAmB,QAAQ,IAAI;AACrC,QAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,oBAAoB,CAAC,eAAe;AAGvC,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,WAAW,uBAAuB;AACxC,MAAI;AACF,UAAM,SAAS,OAAO;AAAA,MACpB,qBAAqB,IAAI,QAAQ,IAAI,eAAe;AAAA,MACpD;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,qBAAqB;AACtC,YAAM,SACJ,IAAI,SAAS,mBAAmB,MAChC,IAAI,SAAS,uBAAuB,MACpC;AACF,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG,EAAE,OAAO,CAAC;AAAA,IAChF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,sBAAsB,OAAO;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,kBAAkB;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAMA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,oBAAoB,QAAQ;AAAA,MAC5B,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,SAAS,WAAW,GAAG;AAEzB,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/C;AAEA,QAAM,QAAQ;AAAA,IACZ,8BAA8B;AAAA,EAChC;AACA,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAkC;AAAA,MACtC,WAAW,QAAQ;AAAA,MACnB,OAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,MACA,cAAc;AAAA,QACZ,cAAc,QAAQ;AAAA,QACtB,WAAW,OAAO,QAAQ,SAAS;AAAA,MACrC;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,QAAQ,GAAyC;AAAA,IAC/D,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,8DAA8D,QAAQ,EAAE;AAAA,QACxE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC/C;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oCAAoC;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/api/put/threads/[threadId]/assign/route.js

@@ -0,0 +1,117 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import {
+  COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID
+} from "../../../../../commands/reassign-conversation.js";
+import { validateRouteMutationGuard } from "../../../../../lib/route-mutation-guard.js";
+const metadata = {
+  path: "/communication_channels/threads/[threadId]/assign",
+  PUT: {
+    requireAuth: true,
+    requireFeatures: ["communication_channels.assign"]
+  }
+};
+const bodySchema = z.object({
+  assignedUserId: z.string().uuid().nullable()
+});
+async function PUT(req, context) {
+  const { threadId } = await context.params;
+  if (!z.string().uuid().safeParse(threadId).success) {
+    return NextResponse.json({ error: "Invalid threadId" }, { status: 400 });
+  }
+  const auth = await getAuthFromRequest(req);
+  if (!auth?.tenantId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  let body;
+  try {
+    const json = await readJsonSafe(req, null);
+    body = bodySchema.parse(json);
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Invalid request body" },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const guard = await validateRouteMutationGuard({
+    container,
+    req,
+    auth,
+    input: {
+      resourceKind: "communication_channels.thread",
+      resourceId: threadId,
+      operation: "custom",
+      mutationPayload: body
+    }
+  });
+  if ("response" in guard) return guard.response;
+  const commandBus = container.resolve("commandBus");
+  const input = {
+    threadId,
+    assignedUserId: body.assignedUserId,
+    scope: {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId ?? null
+    }
+  };
+  const { result } = await commandBus.execute(COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID, {
+    input,
+    ctx: {
+      container,
+      auth,
+      organizationScope: null,
+      selectedOrganizationId: auth.orgId ?? null,
+      organizationIds: auth.orgId ? [auth.orgId] : null
+    }
+  });
+  if (result.status === "no_channel_link") {
+    return NextResponse.json({ error: result.reason }, { status: 404 });
+  }
+  if (result.status === "invalid_assignee") {
+    return NextResponse.json({ error: result.reason }, { status: 422 });
+  }
+  if (result.status === "noop") {
+    return NextResponse.json(
+      { threadId, assignedUserId: body.assignedUserId, unchanged: true },
+      { status: 200 }
+    );
+  }
+  await guard.afterSuccess();
+  return NextResponse.json(
+    {
+      threadId: result.threadId,
+      conversationId: result.conversationId,
+      previousAssignedUserId: result.previousAssignedUserId,
+      assignedUserId: result.nextAssignedUserId
+    },
+    { status: 200 }
+  );
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  methods: {
+    PUT: {
+      summary: "Reassign a channel-linked conversation to a different owner",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 200, description: "Conversation reassigned (or unchanged)" },
+        { status: 400, description: "Invalid threadId" },
+        { status: 401, description: "Unauthorized" },
+        { status: 404, description: "Conversation not channel-linked" },
+        { status: 422, description: "Invalid request body" }
+      ]
+    }
+  }
+};
+var route_default = PUT;
+export {
+  PUT,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/communication_channels/api/put/threads/[threadId]/assign/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/communication_channels/api/put/threads/%5BthreadId%5D/assign/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID,\n  type ReassignConversationInput,\n  type ReassignConversationResult,\n} from '../../../../../commands/reassign-conversation'\nimport { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'\n\nexport const metadata = {\n  path: '/communication_channels/threads/[threadId]/assign',\n  PUT: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.assign'],\n  },\n}\n\nconst bodySchema = z.object({\n  assignedUserId: z.string().uuid().nullable(),\n})\n\ntype RouteContext = {\n  params: Promise<{ threadId: string }> | { threadId: string }\n}\n\nexport async function PUT(req: Request, context: RouteContext): Promise<Response> {\n  const { threadId } = await context.params\n  if (!z.string().uuid().safeParse(threadId).success) {\n    return NextResponse.json({ error: 'Invalid threadId' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    const json = await readJsonSafe(req, null)\n    body = bodySchema.parse(json)\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const guard = await validateRouteMutationGuard({\n    container,\n    req,\n    auth,\n    input: {\n      resourceKind: 'communication_channels.thread',\n      resourceId: threadId,\n      operation: 'custom',\n      mutationPayload: body,\n    },\n  })\n  if ('response' in guard) return guard.response\n\n  const commandBus = container.resolve('commandBus') as CommandBus\n\n  const input: ReassignConversationInput = {\n    threadId,\n    assignedUserId: body.assignedUserId,\n    scope: {\n      tenantId: auth.tenantId,\n      organizationId: (auth as { orgId?: string | null }).orgId ?? null,\n    },\n  }\n  const { result } = await commandBus.execute<\n    ReassignConversationInput,\n    ReassignConversationResult\n  >(COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID, {\n    input,\n    ctx: {\n      container,\n      auth: auth as never,\n      organizationScope: null,\n      selectedOrganizationId: (auth as { orgId?: string | null }).orgId ?? null,\n      organizationIds: (auth as { orgId?: string | null }).orgId\n        ? [(auth as { orgId?: string | null }).orgId!]\n        : null,\n    },\n  })\n\n  if (result.status === 'no_channel_link') {\n    return NextResponse.json({ error: result.reason }, { status: 404 })\n  }\n  if (result.status === 'invalid_assignee') {\n    return NextResponse.json({ error: result.reason }, { status: 422 })\n  }\n  if (result.status === 'noop') {\n    return NextResponse.json(\n      { threadId, assignedUserId: body.assignedUserId, unchanged: true },\n      { status: 200 },\n    )\n  }\n  await guard.afterSuccess()\n  return NextResponse.json(\n    {\n      threadId: result.threadId,\n      conversationId: result.conversationId,\n      previousAssignedUserId: result.previousAssignedUserId,\n      assignedUserId: result.nextAssignedUserId,\n    },\n    { status: 200 },\n  )\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    PUT: {\n      summary: 'Reassign a channel-linked conversation to a different owner',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 200, description: 'Conversation reassigned (or unchanged)' },\n        { status: 400, description: 'Invalid threadId' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Conversation not channel-linked' },\n        { status: 422, description: 'Invalid request body' },\n      ],\n    },\n  },\n}\nexport default PUT\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,OAGK;AACP,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,IACb,iBAAiB,CAAC,+BAA+B;AAAA,EACnD;AACF;AAEA,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAMD,eAAsB,IAAI,KAAc,SAA0C;AAChF,QAAM,EAAE,SAAS,IAAI,MAAM,QAAQ;AACnC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,OAAO,MAAM,aAAa,KAAK,IAAI;AACzC,WAAO,WAAW,MAAM,IAAI;AAAA,EAC9B,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACD,MAAI,cAAc,MAAO,QAAO,MAAM;AAEtC,QAAM,aAAa,UAAU,QAAQ,YAAY;AAEjD,QAAM,QAAmC;AAAA,IACvC;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,OAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,gBAAiB,KAAmC,SAAS;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,yDAAyD;AAAA,IACzD;AAAA,IACA,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAyB,KAAmC,SAAS;AAAA,MACrE,iBAAkB,KAAmC,QACjD,CAAE,KAAmC,KAAM,IAC3C;AAAA,IACN;AAAA,EACF,CAAC;AAED,MAAI,OAAO,WAAW,mBAAmB;AACvC,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACA,MAAI,OAAO,WAAW,oBAAoB;AACxC,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACA,MAAI,OAAO,WAAW,QAAQ;AAC5B,WAAO,aAAa;AAAA,MAClB,EAAE,UAAU,gBAAgB,KAAK,gBAAgB,WAAW,KAAK;AAAA,MACjE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,MAAM,aAAa;AACzB,SAAO,aAAa;AAAA,IAClB;AAAA,MACE,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,wBAAwB,OAAO;AAAA,MAC/B,gBAAgB,OAAO;AAAA,IACzB;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yCAAyC;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,kCAAkC;AAAA,QAC9D,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
+  "names": []
+}