@relaycast/engine 12.2.1 → 12.3.0

package/dist/engine/file.js

@@ -2,9 +2,20 @@ import { eq, and, ne, sql } from 'drizzle-orm';
 import { files, agents } from '../db/schema.js';
 import { generateId } from './snowflake.js';
 import { codedError } from '../lib/httpError.js';
+/**
+ * The object name of a file in storage: its id plus at most a short
+ * alphanumeric extension from the client filename. Storage keys are
+ * `<workspace_id>/<file_id>/<object_name>`; the client's filename never
+ * appears in them (it lives only in file metadata), so a key cannot traverse,
+ * exceed a filesystem name limit, or depend on the filename's encoding.
+ */
+export function storageObjectName(fileId, filename) {
+    const extension = /\.([A-Za-z0-9]{1,10})$/.exec(filename)?.[1]?.toLowerCase();
+    return extension ? `${fileId}.${extension}` : fileId;
+}
 export async function createUpload(db, storage, workspaceId, agentId, data) {
     const id = generateId();
-    const storageKey = `${workspaceId}/${id}/${data.filename}`;
+    const storageKey = `${workspaceId}/${id}/${storageObjectName(id, data.filename)}`;
     // Sign the upload URL before persisting, so a storage error doesn't leave an
     // orphaned `pending` row behind.
     const { uploadUrl, expiresAt } = await storage.createUploadUrl({
@@ -41,15 +52,17 @@ export async function completeUpload(db, storage, workspaceId, fileId, agentId)
     if (!file || file.uploadedBy !== agentId || file.status !== 'pending') {
         return null;
     }
-    // A completed file is attachable, so its bytes must actually be stored.
-    // Recipients see the stored size, whatever the upload request declared.
-    let sizeBytes = file.sizeBytes;
+    // A completed file is attachable, so its bytes must actually be stored, and
+    // exactly as many as the upload declared.
+    const sizeBytes = file.sizeBytes;
     if (storage.statObject) {
         const stored = await storage.statObject({ storageKey: file.storageKey });
         if (!stored || stored.sizeBytes === 0) {
             throw codedError('Upload not received: PUT the file bytes to upload_url before completing', 'upload_incomplete', 409);
         }
-        sizeBytes = stored.sizeBytes;
+        if (stored.sizeBytes !== sizeBytes) {
+            throw codedError(`Stored ${stored.sizeBytes} bytes, but the upload declared ${sizeBytes}`, 'upload_size_mismatch', 409);
+        }
     }
     // Generate the URL before flipping status, so a transient storage error keeps
     // completeUpload retry-safe (the row stays `pending` rather than `complete`).

package/dist/engine/file.js.map

@@ -1 +1 @@
-{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/engine/file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,OAAoB,EACpB,WAAmB,EACnB,OAAe,EACf,IAAoE;IAEpE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,GAAG,WAAW,IAAI,EAAE,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;IAE3D,6EAA6E;IAC7E,iCAAiC;IACjC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC;QAC7D,UAAU;QACV,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAC5B,EAAE;QACF,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,UAAU;QACV,eAAe;QACf,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,OAAO;QACL,EAAE;QACF,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,OAAoB,EACpB,WAAmB,EACnB,MAAc,EACd,OAAe;IAEf,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAExE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,UAAU,CACd,yEAAyE,EACzE,mBAAmB,EACnB,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC/B,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAErF,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;SACtC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/B,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAM,EAAE,OAAoB,EAAE,WAAmB,EAAE,MAAc;IAC7F,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EACpB,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,EAClC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAC5B,CACF,CAAC;IACJ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAErF,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,WAAW,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS;QACrC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAM,EACN,WAAmB,EACnB,MAAc,EACd,OAAe;IAEf,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAEpD,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;SAC1B,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAM,EACN,WAAmB,EACnB,IAA+C;IAE/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG;QACjB,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;KAC5B,CAAC;IAEF,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,SAAS,OAAO,CAAC;SACrC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEhB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,WAAW;QAC3B,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC,CAAC;AACN,CAAC"}
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/engine/file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG5C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAIjD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,QAAgB;IAChE,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9E,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,OAAoB,EACpB,WAAmB,EACnB,OAAe,EACf,IAAoE;IAEpE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,GAAG,WAAW,IAAI,EAAE,IAAI,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAElF,6EAA6E;IAC7E,iCAAiC;IACjC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC;QAC7D,UAAU;QACV,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;QAC5B,EAAE;QACF,WAAW;QACX,UAAU,EAAE,OAAO;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,UAAU;QACV,eAAe;QACf,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,OAAO;QACL,EAAE;QACF,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,OAAoB,EACpB,WAAmB,EACnB,MAAc,EACd,OAAe;IAEf,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAExE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,UAAU,CACd,yEAAyE,EACzE,mBAAmB,EACnB,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,UAAU,CACd,UAAU,MAAM,CAAC,SAAS,mCAAmC,SAAS,EAAE,EACxE,sBAAsB,EACtB,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAErF,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;SACtC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/B,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAM,EAAE,OAAoB,EAAE,WAAmB,EAAE,MAAc;IAC7F,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EACpB,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,EAClC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAC5B,CACF,CAAC;IACJ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAErF,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,WAAW,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS;QACrC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAM,EACN,WAAmB,EACnB,MAAc,EACd,OAAe;IAEf,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,WAAW,CAAC;IAEpD,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;SAC1B,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAM,EACN,WAAmB,EACnB,IAA+C;IAE/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG;QACjB,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC;QAClC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;KAC5B,CAAC;IAEF,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,SAAS,OAAO,CAAC;SACrC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEhB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,WAAW;QAC3B,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/engine/inboundWebhook.d.ts

@@ -55,6 +55,8 @@ export declare function triggerWebhook(db: Db, webhookId: string, token: string
 }): Promise<{
     _deliveries: import("./deliveryWrites.js").DeliveryFanoutRecord[];
     _delivery_rejections: import("./deliveryWrites.js").DeliveryRejectionRecord[];
+    /** Whether the bearer token authenticated the call (the webhook requires one). */
+    _token_verified: boolean;
     message_id: string;
     agent_id: string;
     webhook_id: string;

package/dist/engine/inboundWebhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inboundWebhook.d.ts","sourceRoot":"","sources":["../../src/engine/inboundWebhook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAS5C,OAAO,EAAwF,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC9I,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAG5E,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAwCnC,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACvB,SAAS,CAAC,EAAE,MAAM;;;;;;;;GAkCnB;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM;;;;;;;;;;;KA4B7D;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;;;UAyB9E;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,oBAOjF;AAUD,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAGnD,kGAAkG;AAClG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQ5E;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,EACD,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC;IACnE,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,uBAAuB,GAAG,SAAS,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC,CAAC;CAC9J;;;;;;;;;;;;;;UA8HP;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB,EACD,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,aAAa,CAAC;IAAC,uBAAuB,CAAC,EAAE,uBAAuB,CAAA;CAAO;;;;;;;;;;;;GAoG7F"}
+{"version":3,"file":"inboundWebhook.d.ts","sourceRoot":"","sources":["../../src/engine/inboundWebhook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAS5C,OAAO,EAAwF,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC9I,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAK5E,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAwCnC,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACvB,SAAS,CAAC,EAAE,MAAM;;;;;;;;GAkCnB;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM;;;;;;;;;;;KA4B7D;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;;;;;;;UAyB9E;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,oBAOjF;AAUD,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAGnD,kGAAkG;AAClG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQ5E;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,EACD,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC;IACnE,uBAAuB,CAAC,EAAE,uBAAuB,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,uBAAuB,GAAG,SAAS,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC,CAAC;CAC9J;;;IAoHJ,kFAAkF;;;;;;;;;;;;;UAcrF;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB,EACD,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,aAAa,CAAC;IAAC,uBAAuB,CAAC,EAAE,uBAAuB,CAAA;CAAO;;;;;;;;;;;;GAoG7F"}

package/dist/engine/inboundWebhook.js

@@ -2,7 +2,7 @@ import { prepareAuthorityFanout } from './deliveryWrites.js';
 import { eq, and } from 'drizzle-orm';
 import { webhooks, channels, messages, agents, workspaces } from '../db/schema.js';
 import { isWorkspaceExpired } from '../auth/workspaceExpiry.js';
-import { randomHex, sha256Hex } from '../lib/crypto.js';
+import { sha256Hex } from '../lib/crypto.js';
 import { codedError } from '../lib/httpError.js';
 import { generateId } from './snowflake.js';
 import { inboundWebhookMessageMetadata, sanitizeUserMessageMetadata, WEBHOOK_AGENT_NAME } from './messageMetadata.js';
@@ -10,6 +10,8 @@ import { runAtomicWrites, databaseConstraintKind } from '../ports/database.js';
 import { buildChannelDeliveryWrite, fetchChannelDeliveryOutcomes } from './deliveryWrites.js';
 import { DEFAULT_MAILBOX_DEPTH_CAP, DEFAULT_MAILBOX_TTL_MS, DEFAULT_OFFLINE_FANOUT_EXCLUDE_MS } from './mailboxConfig.js';
 import { buildMessageSessionWrite, requireSessionRefFromMetadata } from './sessionMessages.js';
+import { issueCredential } from '../auth/credentials.js';
+import { upgradedLegacyCredential } from './credentialUpgrade.js';
 async function ensureWebhookAgent(db, workspaceId) {
     const [existing] = await db
         .select({ id: agents.id })
@@ -17,7 +19,7 @@ async function ensureWebhookAgent(db, workspaceId) {
         .where(and(eq(agents.workspaceId, workspaceId), eq(agents.name, WEBHOOK_AGENT_NAME)));
     if (existing)
         return existing.id;
-    const token = `at_live_${randomHex(16)}`;
+    const token = await issueCredential(db, 'agent', workspaceId);
     const tokenHash = await sha256Hex(token);
     const agentId = generateId();
     await db
@@ -44,7 +46,7 @@ async function ensureWebhookAgent(db, workspaceId) {
 }
 export async function createWebhook(db, workspaceId, channelId, data, createdBy) {
     const id = `wh_${generateId()}`;
-    const token = `wh_live_${randomHex(24)}`;
+    const token = await issueCredential(db, 'webhook', workspaceId);
     const tokenHash = await sha256Hex(token);
     const postingAgentId = createdBy ?? await ensureWebhookAgent(db, workspaceId);
     const [webhook] = await db
@@ -177,7 +179,9 @@ export async function triggerWebhook(db, webhookId, token, data, options = {}) {
             throw codedError('Webhook bearer token required', 'webhook_token_required', 401);
         }
         const tokenHash = await sha256Hex(token);
-        if (tokenHash !== webhook.tokenHash) {
+        // An upgraded legacy token works during its grace (`POST /v1/credentials/upgrade`).
+        if (tokenHash !== webhook.tokenHash
+            && (await upgradedLegacyCredential(db, 'webhook', tokenHash))?.principalId !== webhook.id) {
             throw codedError('Invalid webhook bearer token', 'webhook_token_invalid', 401);
         }
     }
@@ -259,6 +263,8 @@ export async function triggerWebhook(db, webhookId, token, data, options = {}) {
     return {
         _deliveries: outcomes.deliveries,
         _delivery_rejections: outcomes.rejections,
+        /** Whether the bearer token authenticated the call (the webhook requires one). */
+        _token_verified: webhook.tokenHash !== null,
         message_id: message.id,
         agent_id: message.agentId,
         webhook_id: webhook.id,

package/dist/engine/inboundWebhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"inboundWebhook.js","sourceRoot":"","sources":["../../src/engine/inboundWebhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAoB,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,iCAAiC,EAAsB,MAAM,oBAAoB,CAAC;AAE9I,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAI/F,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,WAAmB;IAC3D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;SACzB,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAExF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;IAEjC,MAAM,KAAK,GAAG,WAAW,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,CAAC;QACN,EAAE,EAAE,OAAO;QACX,WAAW;QACX,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,QAAQ;QACd,SAAS;QACT,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE;KACvD,CAAC;SACD,mBAAmB,EAAE,CAAC;IAEzB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;SACzB,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAExF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,UAAU,CAAC,oDAAoD,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAChH,CAAC;IAED,OAAO,OAAO,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,WAAmB,EACnB,SAAiB,EACjB,IAAuB,EACvB,SAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,WAAW,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,SAAS,IAAI,MAAM,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAE9E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC;QACN,EAAE;QACF,WAAW;QACX,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,SAAS,EAAE,cAAc;QACzB,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,gCAAgC;IAChC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SAC/B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAErC,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;QAC5B,GAAG,EAAE,aAAa,OAAO,CAAC,EAAE,EAAE;QAC9B,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,WAAmB;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC;SACd,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;SACxD,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,YAAY,EAAE,CAAC,CAAC,WAAW;QAC3B,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,2DAA2D;QAC3D,OAAO,EAAE,CAAC,CAAC,WAAW;QACtB,GAAG,EAAE,aAAa,CAAC,CAAC,EAAE,EAAE;QACxB,SAAS,EAAE,CAAC,CAAC,QAAQ;QACrB,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAiB;IAC7E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC;SACd,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAEjF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,WAAW;QACxB,GAAG,EAAE,aAAa,GAAG,CAAC,EAAE,EAAE;QAC1B,SAAS,EAAE,GAAG,CAAC,QAAQ;QACvB,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAiB;IAChF,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,QAAQ,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;SAC7E,SAAS,EAAE,CAAC;IAEf,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,MAAM,UAAU,CAAC,gFAAgF,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AACnD,MAAM,kCAAkC,GAAG,eAAe,CAAC;AAE3D,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CAAC,KAA8B;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,4BAA4B;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,GAAG,GAAG,4BAA4B,GAAG,kCAAkC,CAAC,MAAM,CAAC;IACnF,iCAAiC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;QAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,kCAAkC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,SAAiB,EACjB,KAAoB,EACpB,IAWC,EACD,UAGI,EAAE;IAEN,kBAAkB;IAClB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;SAC3C,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,CAAC,+BAA+B,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,UAAU,CAAC,8BAA8B,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,IAAI,GACR,IAAI,CAAC,IAAI;QACT,CAAC,IAAI,CAAC,OAAO;YACX,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC5D,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACb,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACpE,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAE1D,qDAAqD;IACrD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,0DAA0D,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IAEzC,2EAA2E;IAC3E,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG;QACf,GAAG,6BAA6B,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,MAAM;SACP,CAAC;QACF,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;KAC7C,CAAC;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI;QAChH,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,iCAAiC;KACxH,CAAC;IACF,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,uBAAuB,KAAK,UAAU;QAC3E,CAAC,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5D,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACpC,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAChH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;QACpD,MAAM,MAAM,GAAkB;YAC5B,OAAO;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC;gBACN,EAAE,EAAE,SAAS;gBACb,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,IAAI;gBACV,QAAQ;gBACR,UAAU;gBACV,SAAS;aACV,CAAC;iBACD,SAAS,EAAE;SACf,CAAC;QACF,MAAM,YAAY,GAAG,wBAAwB,CAC3C,OAAO,EACP,OAAO,CAAC,WAAW,EACnB,UAAU,EACV,SAAS,CACV,CAAC;QACF,IAAI,YAAY;YAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE;YAC7C,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;YACzE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW;YAChD,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1F,eAAe,EAAE,gBAAgB,EAAE,IAAI;YACzC,eAAe;SAChB,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAqC,CAAC;IAEjE,mBAAmB;IACnB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SAC/B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE;QACtD,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,cAAc;QACtE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QACtC,eAAe;KACpB,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,UAAU;QAChC,oBAAoB,EAAE,QAAQ,CAAC,UAAU;QACzC,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;QAC3C,QAAQ,EAAE,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAM,EACN,WAAmB,EACnB,SAAiB,EACjB,IAQC,EACD,UAA0F,EAAE;IAE5F,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC;IACpD,MAAM,QAAQ,GAAG;QACf,GAAG,6BAA6B,CAAC;YAC/B,SAAS;YACT,WAAW;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QACF,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;KAC7C,CAAC;IACF,MAAM,UAAU,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI;QACjC,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,yBAAyB;QACnC,gBAAgB,EAAE,iCAAiC;KACpD,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;QACpD,MAAM,MAAM,GAAkB;YAC5B,OAAO;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC;gBACN,EAAE,EAAE,SAAS;gBACb,WAAW;gBACX,SAAS;gBACT,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ;gBACR,UAAU;gBACV,SAAS;aACV,CAAC;iBACD,SAAS,EAAE;SACf,CAAC;QAEF,MAAM,YAAY,GAAG,wBAAwB,CAC3C,OAAO,EACP,WAAW,EACX,UAAU,EACV,SAAS,CACV,CAAC;QACF,IAAI,YAAY;YAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE5C,MAAM,CAAC,IAAI,CACT,yBAAyB,CAAC,OAAO,EAAE;YACjC,WAAW;YACX,SAAS;YACT,SAAS;YACT,aAAa,EAAE,cAAc;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW;YAC5D,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,eAAe;YACf,gBAAgB,EAAE,IAAI;YACtB,eAAe,EAAE,OAAO,CAAC,uBAAuB;SACjD,CAAC,CACH,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAqC,CAAC;IAEjE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SAC/B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE;QACtD,SAAS;QACT,SAAS;QACT,aAAa,EAAE,cAAc;QAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QACtC,eAAe;KACpB,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;QAC3C,QAAQ,EAAE,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;QACnD,WAAW,EAAE,QAAQ,CAAC,UAAU;QAChC,oBAAoB,EAAE,QAAQ,CAAC,UAAU;KAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"inboundWebhook.js","sourceRoot":"","sources":["../../src/engine/inboundWebhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAoB,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,iCAAiC,EAAsB,MAAM,oBAAoB,CAAC;AAE9I,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,WAAmB;IAC3D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;SACzB,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAExF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;IAEjC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC;SACd,MAAM,CAAC;QACN,EAAE,EAAE,OAAO;QACX,WAAW;QACX,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,QAAQ;QACd,SAAS;QACT,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,8CAA8C;QACvD,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE;KACvD,CAAC;SACD,mBAAmB,EAAE,CAAC;IAEzB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;SACzB,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAExF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,UAAU,CAAC,oDAAoD,EAAE,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAChH,CAAC;IAED,OAAO,OAAO,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,WAAmB,EACnB,SAAiB,EACjB,IAAuB,EACvB,SAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,SAAS,IAAI,MAAM,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAE9E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC;QACN,EAAE;QACF,WAAW;QACX,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,SAAS,EAAE,cAAc;QACzB,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,gCAAgC;IAChC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SAC/B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAErC,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;QAC5B,GAAG,EAAE,aAAa,OAAO,CAAC,EAAE,EAAE;QAC9B,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,WAAmB;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC;SACd,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;SACxD,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,YAAY,EAAE,WAAW;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,YAAY,EAAE,CAAC,CAAC,WAAW;QAC3B,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,2DAA2D;QAC3D,OAAO,EAAE,CAAC,CAAC,WAAW;QACtB,GAAG,EAAE,aAAa,CAAC,CAAC,EAAE,EAAE;QACxB,SAAS,EAAE,CAAC,CAAC,QAAQ;QACrB,UAAU,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAiB;IAC7E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;SACD,IAAI,CAAC,QAAQ,CAAC;SACd,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAEjF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,WAAW;QACxB,GAAG,EAAE,aAAa,GAAG,CAAC,EAAE,EAAE;QAC1B,SAAS,EAAE,GAAG,CAAC,QAAQ;QACvB,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAiB;IAChF,MAAM,MAAM,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,QAAQ,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;SAC7E,SAAS,EAAE,CAAC;IAEf,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,MAAM,UAAU,CAAC,gFAAgF,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AACnD,MAAM,kCAAkC,GAAG,eAAe,CAAC;AAE3D,kGAAkG;AAClG,MAAM,UAAU,qBAAqB,CAAC,KAA8B;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,4BAA4B;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,GAAG,GAAG,4BAA4B,GAAG,kCAAkC,CAAC,MAAM,CAAC;IACnF,iCAAiC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;QAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,kCAAkC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,SAAiB,EACjB,KAAoB,EACpB,IAWC,EACD,UAGI,EAAE;IAEN,kBAAkB;IAClB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAEvE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;SACzB,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;SAC3C,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,CAAC,+BAA+B,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,oFAAoF;QACpF,IAAI,SAAS,KAAK,OAAO,CAAC,SAAS;eAC9B,CAAC,MAAM,wBAAwB,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YAC5F,MAAM,UAAU,CAAC,8BAA8B,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,IAAI,GACR,IAAI,CAAC,IAAI;QACT,CAAC,IAAI,CAAC,OAAO;YACX,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC5D,CAAC,CAAC,IAAI,CAAC,QAAQ;gBACb,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACpE,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAE1D,qDAAqD;IACrD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,0DAA0D,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IAEzC,2EAA2E;IAC3E,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG;QACf,GAAG,6BAA6B,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,MAAM;SACP,CAAC;QACF,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;KAC7C,CAAC;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI;QAChH,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,iCAAiC;KACxH,CAAC;IACF,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,uBAAuB,KAAK,UAAU;QAC3E,CAAC,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5D,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACpC,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAChH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;QACpD,MAAM,MAAM,GAAkB;YAC5B,OAAO;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC;gBACN,EAAE,EAAE,SAAS;gBACb,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,IAAI;gBACV,QAAQ;gBACR,UAAU;gBACV,SAAS;aACV,CAAC;iBACD,SAAS,EAAE;SACf,CAAC;QACF,MAAM,YAAY,GAAG,wBAAwB,CAC3C,OAAO,EACP,OAAO,CAAC,WAAW,EACnB,UAAU,EACV,SAAS,CACV,CAAC;QACF,IAAI,YAAY;YAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE;YAC7C,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;YACzE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW;YAChD,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1F,eAAe,EAAE,gBAAgB,EAAE,IAAI;YACzC,eAAe;SAChB,CAAC,CAAC,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAqC,CAAC;IAEjE,mBAAmB;IACnB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SAC/B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE;QACtD,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,cAAc;QACtE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QACtC,eAAe;KACpB,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,UAAU;QAChC,oBAAoB,EAAE,QAAQ,CAAC,UAAU;QACzC,kFAAkF;QAClF,eAAe,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI;QAC3C,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;QAC3C,QAAQ,EAAE,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAM,EACN,WAAmB,EACnB,SAAiB,EACjB,IAQC,EACD,UAA0F,EAAE;IAE5F,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC;IACpD,MAAM,QAAQ,GAAG;QACf,GAAG,6BAA6B,CAAC;YAC/B,SAAS;YACT,WAAW;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QACF,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;KAC7C,CAAC;IACF,MAAM,UAAU,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI;QACjC,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,yBAAyB;QACnC,gBAAgB,EAAE,iCAAiC;KACpD,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,eAAe,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;QACpD,MAAM,MAAM,GAAkB;YAC5B,OAAO;iBACJ,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC;gBACN,EAAE,EAAE,SAAS;gBACb,WAAW;gBACX,SAAS;gBACT,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ;gBACR,UAAU;gBACV,SAAS;aACV,CAAC;iBACD,SAAS,EAAE;SACf,CAAC;QAEF,MAAM,YAAY,GAAG,wBAAwB,CAC3C,OAAO,EACP,WAAW,EACX,UAAU,EACV,SAAS,CACV,CAAC;QACF,IAAI,YAAY;YAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE5C,MAAM,CAAC,IAAI,CACT,yBAAyB,CAAC,OAAO,EAAE;YACjC,WAAW;YACX,SAAS;YACT,SAAS;YACT,aAAa,EAAE,cAAc;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW;YAC5D,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,eAAe;YACf,gBAAgB,EAAE,IAAI;YACtB,eAAe,EAAE,OAAO,CAAC,uBAAuB;SACjD,CAAC,CACH,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvD,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,CAAqC,CAAC;IAEjE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SAC/B,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE;QACtD,SAAS;QACT,SAAS;QACT,aAAa,EAAE,cAAc;QAC7B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QACtC,eAAe;KACpB,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,EAAE;QACtB,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;QAC3C,QAAQ,EAAE,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;QACnD,WAAW,EAAE,QAAQ,CAAC,UAAU;QAChC,oBAAoB,EAAE,QAAQ,CAAC,UAAU;KAC1C,CAAC;AACJ,CAAC"}

package/dist/engine/internalAdmin.d.ts

@@ -0,0 +1,80 @@
+import type { getDb } from '../db/index.js';
+type Db = ReturnType<typeof getDb>;
+/**
+ * Capability advertisement for a control plane driving the internal admin API.
+ *
+ * The `workspace_key_push` block is the hosted gateway's contract verbatim, so
+ * a control plane's pre-rotation capability gate passes unchanged. On the
+ * self-host engine every key fence lives in the same SQLite row and there is
+ * no auth cache, so `revocation_markers` is satisfied by the previous-key slot
+ * itself: a superseded key stops authenticating the moment its slot expires,
+ * with no KV marker to arm or repair.
+ *
+ * `workspace_admin` is a self-host extension (absent on the hosted gateway):
+ * `create` advertises POST /internal/workspaces and `server_minted_key` that
+ * POST /internal/workspaces/:id/api-key may omit `api_key` to have the engine
+ * mint the replacement.
+ */
+export declare const INTERNAL_CAPABILITIES: {
+    readonly workspace_key_push: {
+        readonly generation_cas: true;
+        readonly generation_required_once_fenced: true;
+        readonly grace_ms: true;
+        readonly max_grace_ms: 3600000;
+        readonly revocation_markers: true;
+        readonly previous_key_slot: true;
+    };
+    readonly workspace_admin: {
+        readonly create: true;
+        readonly delete: true;
+        readonly server_minted_key: true;
+    };
+};
+export interface InternalWorkspaceDeletionFence {
+    commit(): void;
+    release(): void;
+}
+export declare function beginInternalWorkspaceDeletion(db: Db, workspaceId: string): InternalWorkspaceDeletionFence;
+/** Minimum length of `config.internalSecret` (e.g. `openssl rand -hex 32` is 64). */
+export declare const MIN_INTERNAL_SECRET_LENGTH = 32;
+/**
+ * Throw when a configured internal secret is too short to be a credential.
+ * Unset/empty is fine (the admin API stays disabled).
+ */
+export declare function assertInternalSecretStrength(secret: string | undefined): void;
+export interface PushWorkspaceKeyInput {
+    /** Caller-minted `rk_live_` key. Omitted → the engine mints one (self-host extension). */
+    apiKey?: string;
+    keyGeneration?: number;
+    graceMs?: number;
+}
+export interface PushWorkspaceKeyResult {
+    created: boolean;
+    workspaceId: string;
+    apiKeyGeneration: number;
+    /** Present only when the engine minted the key; returned exactly once. */
+    mintedApiKey?: string;
+}
+/**
+ * Register or rotate a workspace's API key on behalf of a trusted control
+ * plane — the self-host port of the hosted gateway's
+ * `POST /internal/workspaces/:id/api-key`.
+ *
+ * Semantics (identical to hosted where they overlap):
+ * - UPSERT: a missing workspace is created with `id = name = :id` (plus its
+ *   `#general` channel) when the caller supplies the key. A server-minted
+ *   rotation of a missing workspace is 404 instead — create it explicitly.
+ * - Re-pushing the live key is idempotent at any generation; a higher
+ *   generation bumps the stored fence.
+ * - A hash-changing push carrying `key_generation` commits only through a CAS
+ *   on (current hash, generation < N); a stale or out-of-order write is 409
+ *   `stale_key_generation`. The superseded key keeps authenticating for
+ *   `grace_ms` (default 0: dead immediately).
+ * - Once fenced (generation > 0), generationless hash changes are 409
+ *   `key_generation_required`.
+ * - Server-minted rotation (no `api_key`) always fences: it uses
+ *   `key_generation` when given, otherwise stored generation + 1.
+ */
+export declare function pushWorkspaceKey(db: Db, workspaceId: string, input: PushWorkspaceKeyInput): Promise<PushWorkspaceKeyResult>;
+export {};
+//# sourceMappingURL=internalAdmin.d.ts.map

package/dist/engine/internalAdmin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internalAdmin.d.ts","sourceRoot":"","sources":["../../src/engine/internalAdmin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAS5C,KAAK,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAEnC;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;CAcxB,CAAC;AAuBX,MAAM,WAAW,8BAA8B;IAC7C,MAAM,IAAI,IAAI,CAAC;IACf,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,GAClB,8BAA8B,CAiBhC;AAQD,qFAAqF;AACrF,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAY7E;AAED,MAAM,WAAW,qBAAqB;IACpC,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkGD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CA0KjC"}

package/dist/engine/internalAdmin.js

@@ -0,0 +1,329 @@
+import { and, eq, exists, gt, lt, ne, notExists, or, sql } from 'drizzle-orm';
+import { alias } from 'drizzle-orm/sqlite-core';
+import { channels, workspaces } from '../db/schema.js';
+import { sha256Hex } from '../lib/crypto.js';
+import { issueCredential } from '../auth/credentials.js';
+import { codedError } from '../lib/httpError.js';
+import { runAtomicWrites } from '../ports/database.js';
+import { generateId } from './snowflake.js';
+import { WORKSPACE_KEY_MAX_GRACE_MS } from './tokenRotate.js';
+/**
+ * Capability advertisement for a control plane driving the internal admin API.
+ *
+ * The `workspace_key_push` block is the hosted gateway's contract verbatim, so
+ * a control plane's pre-rotation capability gate passes unchanged. On the
+ * self-host engine every key fence lives in the same SQLite row and there is
+ * no auth cache, so `revocation_markers` is satisfied by the previous-key slot
+ * itself: a superseded key stops authenticating the moment its slot expires,
+ * with no KV marker to arm or repair.
+ *
+ * `workspace_admin` is a self-host extension (absent on the hosted gateway):
+ * `create` advertises POST /internal/workspaces and `server_minted_key` that
+ * POST /internal/workspaces/:id/api-key may omit `api_key` to have the engine
+ * mint the replacement.
+ */
+export const INTERNAL_CAPABILITIES = {
+    workspace_key_push: {
+        generation_cas: true,
+        generation_required_once_fenced: true,
+        grace_ms: true,
+        max_grace_ms: WORKSPACE_KEY_MAX_GRACE_MS,
+        revocation_markers: true,
+        previous_key_slot: true,
+    },
+    workspace_admin: {
+        create: true,
+        delete: true,
+        server_minted_key: true,
+    },
+};
+const internalDeletionFences = new WeakMap();
+function deletionFences(db) {
+    const key = db;
+    const existing = internalDeletionFences.get(key);
+    if (existing)
+        return existing;
+    const created = new Map();
+    internalDeletionFences.set(key, created);
+    return created;
+}
+export function beginInternalWorkspaceDeletion(db, workspaceId) {
+    const fences = deletionFences(db);
+    const state = fences.get(workspaceId) ?? { active: 0, tombstoned: false };
+    state.active += 1;
+    fences.set(workspaceId, state);
+    let settled = false;
+    const settle = (committed) => {
+        if (settled)
+            return;
+        settled = true;
+        state.active -= 1;
+        if (committed)
+            state.tombstoned = true;
+        if (state.active === 0 && !state.tombstoned)
+            fences.delete(workspaceId);
+    };
+    return {
+        commit: () => settle(true),
+        release: () => settle(false),
+    };
+}
+function assertInternalWorkspaceWritable(db, workspaceId) {
+    if (deletionFences(db).has(workspaceId)) {
+        throw codedError('Workspace is being deleted', 'workspace_deleted', 410);
+    }
+}
+/** Minimum length of `config.internalSecret` (e.g. `openssl rand -hex 32` is 64). */
+export const MIN_INTERNAL_SECRET_LENGTH = 32;
+/**
+ * Throw when a configured internal secret is too short to be a credential.
+ * Unset/empty is fine (the admin API stays disabled).
+ */
+export function assertInternalSecretStrength(secret) {
+    if (secret === undefined || secret === '')
+        return;
+    if (secret !== secret.trim()) {
+        // The route trims the presented bearer, so a padded secret could never match.
+        throw new Error('RELAYCAST_INTERNAL_SECRET must not have leading or trailing whitespace');
+    }
+    if (secret.length < MIN_INTERNAL_SECRET_LENGTH) {
+        throw new Error(`RELAYCAST_INTERNAL_SECRET must be at least ${MIN_INTERNAL_SECRET_LENGTH} characters ` +
+            '(generate one with `openssl rand -hex 32`)');
+    }
+}
+function staleGeneration(workspaceId, requested, stored) {
+    return codedError(`key_generation ${requested} does not beat the stored generation ${stored} for workspace ` +
+        `${workspaceId}; the push is stale and was not applied`, 'stale_key_generation', 409);
+}
+function isUniqueConstraintError(err) {
+    const seen = new Set();
+    let cause = err;
+    while (cause && typeof cause === 'object' && !seen.has(cause)) {
+        seen.add(cause);
+        const e = cause;
+        if (e.code === 'SQLITE_CONSTRAINT_UNIQUE' || e.code === 'SQLITE_CONSTRAINT_PRIMARYKEY')
+            return true;
+        if (typeof e.message === 'string' && e.message.toLowerCase().includes('unique constraint failed'))
+            return true;
+        cause = e.cause;
+    }
+    return false;
+}
+/**
+ * A server-minted key in the deployment's credential family. A deployment
+ * that mints `ar_` credentials admits only snowflake workspace ids (the route
+ * checks before writing; `issueCredential` refuses as the backstop).
+ */
+function mintWorkspaceKey(db, workspaceId) {
+    return issueCredential(db, 'workspace', workspaceId);
+}
+/** The create batch's ownership guard tripped (see pushWorkspaceKey). */
+function isKeyGuardViolation(err) {
+    const seen = new Set();
+    let cause = err;
+    while (cause && typeof cause === 'object' && !seen.has(cause)) {
+        seen.add(cause);
+        const e = cause;
+        if (typeof e.message === 'string' && /NOT NULL constraint failed: channels\.workspace_id/i.test(e.message))
+            return true;
+        cause = e.cause;
+    }
+    return false;
+}
+async function readKeyRow(db, workspaceId) {
+    const [row] = await db
+        .select({ id: workspaces.id, apiKeyHash: workspaces.apiKeyHash, apiKeyGeneration: workspaces.apiKeyGeneration })
+        .from(workspaces)
+        .where(eq(workspaces.id, workspaceId));
+    return row;
+}
+/**
+ * Rows of *other* workspaces that hold `apiKeyHash` as a credential that still
+ * authenticates — their current key, or a previous key inside its grace
+ * window. Authentication resolves current-slot matches before previous-slot
+ * matches, so binding a key that is live in another workspace's grace slot
+ * would silently move that workspace's callers onto this one.
+ */
+function liveElsewhereQuery(db, apiKeyHash, workspaceId) {
+    const other = alias(workspaces, 'other_workspace');
+    return db
+        .select({ id: other.id })
+        .from(other)
+        .where(and(ne(other.id, workspaceId), or(eq(other.apiKeyHash, apiKeyHash), and(eq(other.previousApiKeyHash, apiKeyHash), gt(other.previousApiKeyExpiresAt, new Date())))));
+}
+async function keyOwnedElsewhere(db, apiKeyHash, workspaceId) {
+    const [owner] = await liveElsewhereQuery(db, apiKeyHash, workspaceId).limit(1);
+    return Boolean(owner);
+}
+/**
+ * The same ownership invariant as a guard on the key-changing UPDATE, so a
+ * concurrent rotation elsewhere cannot slip in between the pre-check and the
+ * write.
+ */
+function keyFreeElsewhere(db, apiKeyHash, workspaceId) {
+    return notExists(liveElsewhereQuery(db, apiKeyHash, workspaceId));
+}
+function keyConflict() {
+    return codedError('api_key is already bound to a different workspace', 'api_key_conflict', 409);
+}
+/**
+ * Register or rotate a workspace's API key on behalf of a trusted control
+ * plane — the self-host port of the hosted gateway's
+ * `POST /internal/workspaces/:id/api-key`.
+ *
+ * Semantics (identical to hosted where they overlap):
+ * - UPSERT: a missing workspace is created with `id = name = :id` (plus its
+ *   `#general` channel) when the caller supplies the key. A server-minted
+ *   rotation of a missing workspace is 404 instead — create it explicitly.
+ * - Re-pushing the live key is idempotent at any generation; a higher
+ *   generation bumps the stored fence.
+ * - A hash-changing push carrying `key_generation` commits only through a CAS
+ *   on (current hash, generation < N); a stale or out-of-order write is 409
+ *   `stale_key_generation`. The superseded key keeps authenticating for
+ *   `grace_ms` (default 0: dead immediately).
+ * - Once fenced (generation > 0), generationless hash changes are 409
+ *   `key_generation_required`.
+ * - Server-minted rotation (no `api_key`) always fences: it uses
+ *   `key_generation` when given, otherwise stored generation + 1.
+ */
+export async function pushWorkspaceKey(db, workspaceId, input) {
+    assertInternalWorkspaceWritable(db, workspaceId);
+    const minted = input.apiKey === undefined;
+    const apiKey = input.apiKey ?? await mintWorkspaceKey(db, workspaceId);
+    const apiKeyHash = await sha256Hex(apiKey);
+    const { graceMs } = input;
+    let keyGeneration = input.keyGeneration;
+    // A server-minted rotation without key_generation fences at stored + 1,
+    // re-derived from each fresh read so a lost race retries instead of
+    // reporting a stale generation the caller never sent.
+    const derivedGeneration = minted && input.keyGeneration === undefined;
+    let row = await readKeyRow(db, workspaceId);
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        assertInternalWorkspaceWritable(db, workspaceId);
+        if (!row) {
+            if (minted)
+                throw codedError('Workspace not found', 'workspace_not_found', 404);
+            if (await keyOwnedElsewhere(db, apiKeyHash, workspaceId))
+                throw keyConflict();
+            const generation = keyGeneration ?? 0;
+            // Re-check after the awaits above: a delete may have claimed the id.
+            assertInternalWorkspaceWritable(db, workspaceId);
+            try {
+                await runAtomicWrites(db, (writeDb) => [
+                    writeDb.insert(workspaces).values({
+                        id: workspaceId,
+                        name: workspaceId,
+                        apiKeyHash,
+                        apiKeyGeneration: generation,
+                    }),
+                    // Ownership guard inside the batch: if another workspace took this
+                    // key (current slot, or a previous slot still in grace) after the
+                    // pre-check, the NULL workspace_id fails NOT NULL and the whole
+                    // batch, including the workspace insert, rolls back.
+                    writeDb.insert(channels).values({
+                        id: generateId(),
+                        workspaceId: sql `(CASE WHEN ${exists(liveElsewhereQuery(writeDb, apiKeyHash, workspaceId))} THEN NULL ELSE ${workspaceId} END)`,
+                        name: 'general',
+                        topic: 'General discussion',
+                    }),
+                ], { requireAtomic: true });
+                return { created: true, workspaceId, apiKeyGeneration: generation };
+            }
+            catch (error) {
+                if (isKeyGuardViolation(error))
+                    throw keyConflict();
+                if (!isUniqueConstraintError(error))
+                    throw error;
+                // A concurrent push created the row — re-decide against it. Otherwise
+                // the key hash collided with another workspace.
+                const fresh = await readKeyRow(db, workspaceId);
+                if (!fresh)
+                    throw keyConflict();
+                row = fresh;
+                continue;
+            }
+        }
+        const stored = row.apiKeyGeneration ?? 0;
+        if (row.apiKeyHash === apiKeyHash) {
+            // Idempotent re-push of the live key; a higher generation bumps the fence.
+            if (keyGeneration !== undefined && keyGeneration > stored) {
+                assertInternalWorkspaceWritable(db, workspaceId);
+                const bumped = await db
+                    .update(workspaces)
+                    .set({ apiKeyGeneration: keyGeneration })
+                    .where(and(eq(workspaces.id, row.id), eq(workspaces.apiKeyHash, apiKeyHash), lt(workspaces.apiKeyGeneration, keyGeneration)))
+                    .returning({ id: workspaces.id });
+                if (bumped.length === 0) {
+                    row = await readKeyRow(db, workspaceId);
+                    continue;
+                }
+                return { created: false, workspaceId, apiKeyGeneration: keyGeneration };
+            }
+            return { created: false, workspaceId, apiKeyGeneration: stored };
+        }
+        if (await keyOwnedElsewhere(db, apiKeyHash, workspaceId))
+            throw keyConflict();
+        if (derivedGeneration) {
+            if (stored >= Number.MAX_SAFE_INTEGER) {
+                throw codedError(`workspace ${workspaceId} is at the maximum api_key_generation; it cannot be rotated further`, 'key_generation_exhausted', 409);
+            }
+            keyGeneration = stored + 1;
+        }
+        if (keyGeneration === undefined) {
+            if (stored > 0) {
+                throw codedError(`workspace ${workspaceId} is fenced at api_key_generation ${stored}; ` +
+                    'pushes that change the key must carry key_generation greater than that', 'key_generation_required', 409);
+            }
+            assertInternalWorkspaceWritable(db, workspaceId);
+            const applied = await db
+                .update(workspaces)
+                .set({ apiKeyHash })
+                .where(and(eq(workspaces.id, row.id), eq(workspaces.apiKeyHash, row.apiKeyHash), eq(workspaces.apiKeyGeneration, 0), keyFreeElsewhere(db, apiKeyHash, row.id)))
+                .returning({ id: workspaces.id });
+            if (applied.length === 0) {
+                row = await readKeyRow(db, workspaceId);
+                continue;
+            }
+            return { created: false, workspaceId, apiKeyGeneration: 0 };
+        }
+        if (keyGeneration <= stored)
+            throw staleGeneration(workspaceId, keyGeneration, stored);
+        const grace = graceMs ?? 0;
+        // Zero grace (compromise) leaves no authenticatable previous slot: the
+        // auth lookup requires a strictly-future expiry, and null never matches.
+        const previousExpiresAt = grace === 0 ? null : new Date(Date.now() + grace);
+        assertInternalWorkspaceWritable(db, workspaceId);
+        const applied = await db
+            .update(workspaces)
+            .set({
+            apiKeyHash,
+            apiKeyGeneration: keyGeneration,
+            previousApiKeyHash: row.apiKeyHash,
+            previousApiKeyExpiresAt: previousExpiresAt,
+        })
+            .where(and(eq(workspaces.id, row.id), eq(workspaces.apiKeyHash, row.apiKeyHash), lt(workspaces.apiKeyGeneration, keyGeneration), keyFreeElsewhere(db, apiKeyHash, row.id)))
+            .returning({ id: workspaces.id });
+        if (applied.length === 0) {
+            const fresh = await readKeyRow(db, workspaceId);
+            // A concurrent push of the same key won. Done only if its generation
+            // already covers ours; otherwise loop so the idempotent branch bumps
+            // the fence to the requested generation.
+            if (fresh && fresh.apiKeyHash === apiKeyHash && keyGeneration <= fresh.apiKeyGeneration) {
+                return { created: false, workspaceId, apiKeyGeneration: fresh.apiKeyGeneration };
+            }
+            if (fresh && !derivedGeneration && keyGeneration <= fresh.apiKeyGeneration) {
+                throw staleGeneration(workspaceId, keyGeneration, fresh.apiKeyGeneration);
+            }
+            row = fresh;
+            continue;
+        }
+        return {
+            created: false,
+            workspaceId,
+            apiKeyGeneration: keyGeneration,
+            ...(minted ? { mintedApiKey: apiKey } : {}),
+        };
+    }
+    throw codedError(`Concurrent key writes are contending workspace ${workspaceId}; retry`, 'key_write_conflict', 409);
+}
+//# sourceMappingURL=internalAdmin.js.map