@relume_io/partner-node 2.0.0 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +9 -1
  3. package/dist/bin.cjs +34 -1
  4. package/dist/bin.cjs.map +1 -1
  5. package/dist/bin.js +34 -1
  6. package/dist/bin.js.map +1 -1
  7. package/dist/index.cjs +1 -1
  8. package/dist/index.cjs.map +1 -1
  9. package/dist/index.js +1 -1
  10. package/dist/index.js.map +1 -1
  11. package/package.json +2 -2
package/dist/bin.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/cli.ts","../src/check.ts","../src/bin.ts"],"sourcesContent":["// The package's command line: `npx @relume_io/partner-node check …`.\n// Kept apart from bin.ts so tests can run it without spawning a process.\n\nimport { parseArgs } from 'node:util';\n\nimport {\n CHECK_CHARGE_CREDITS,\n checkEndpoint,\n type CheckResult,\n} from './check.ts';\n\nexport const USAGE = `Usage: RELUME_SECRET_KEY=sk_test_… npx @relume_io/partner-node check --url <endpoint> --user <userId>\n\nChecks your partner endpoint against the Relume partner protocol: signatures,\nuser.get, credits.get, and the idempotency and decline rules for charges and\nreversals. It also checks that another site can't read your session route.\n\n --url The endpoint Relume calls, e.g. https://partner.example/relume/calls\n --user A user your wallet knows, with at least ${CHECK_CHARGE_CREDITS} credits. The check\n charges that user and gives every credit back.\n --session-url The session route your page's embed calls. Defaults to\n /session next to a --url ending in /calls.\n --secret-key Your test secret key. Prefer $RELUME_SECRET_KEY, the default:\n a key on the command line lands in your shell history, CI\n logs and the process list.\n --live Allow an sk_live_ key. The check then charges a real wallet.\n -h, --help Show this help.\n\nExits 0 when every check passes, 1 when any fails or can't run, and 2 for\nbad arguments.`;\n\nexport interface CliIo {\n log: (line: string) => void;\n error: (line: string) => void;\n env: Record<string, string | undefined>;\n fetch?: typeof fetch;\n}\n\nconst LABEL: Record<CheckResult['status'], string> = {\n pass: 'PASS',\n fail: 'FAIL',\n skip: 'SKIP',\n};\n\n/** Runs the command line and returns the exit code. */\nexport async function runCli(args: string[], io: CliIo): Promise<number> {\n const usageError = (message: string) => {\n io.error(`${message}\\n\\n${USAGE}`);\n return 2;\n };\n\n let parsed;\n try {\n parsed = parseArgs({\n args,\n allowPositionals: true,\n options: {\n url: { type: 'string' },\n user: { type: 'string' },\n 'session-url': { type: 'string' },\n 'secret-key': { type: 'string' },\n live: { type: 'boolean' },\n help: { type: 'boolean', short: 'h' },\n },\n });\n } catch (error) {\n return usageError(error instanceof Error ? error.message : String(error));\n }\n const { values, positionals } = parsed;\n if (values.help) {\n io.log(USAGE);\n return 0;\n }\n if (positionals.length !== 1 || positionals[0] !== 'check') {\n return usageError(\n positionals.length === 0\n ? 'Missing the command: check.'\n : `Unknown command: ${positionals.join(' ')}.`,\n );\n }\n\n const url = values.url?.trim() ?? '';\n let endpoint: URL;\n try {\n endpoint = new URL(url);\n } catch {\n return usageError(\n url === '' ? '--url is required.' : `--url isn't a URL: ${url}`,\n );\n }\n if (endpoint.protocol !== 'https:' && endpoint.protocol !== 'http:') {\n return usageError('--url must be an http or https URL.');\n }\n\n let sessionUrl: string | undefined;\n if (values['session-url'] !== undefined) {\n const value = values['session-url'].trim();\n let parsed: URL | null = null;\n try {\n parsed = new URL(value);\n } catch {\n // Refused below.\n }\n if (parsed?.protocol !== 'https:' && parsed?.protocol !== 'http:') {\n return usageError(`--session-url must be an http or https URL: ${value}`);\n }\n sessionUrl = parsed.href;\n }\n\n const userId = values.user ?? '';\n if (userId.length < 1 || userId.length > 128) {\n return usageError('--user is required: a user id of 1 to 128 characters.');\n }\n\n const secretKey = (\n values['secret-key'] ??\n io.env.RELUME_SECRET_KEY ??\n ''\n ).trim();\n if (secretKey === '') {\n return usageError('Pass --secret-key or set RELUME_SECRET_KEY.');\n }\n if (secretKey.startsWith('pk_')) {\n return usageError(\n 'That is a publishable key. Pass the secret key (sk_test_…).',\n );\n }\n if (secretKey.startsWith('sk_live_') && !values.live) {\n return usageError(\n 'That is a live key, and the check charges the user. Use your test key, or pass --live to run it against a live wallet.',\n );\n }\n\n io.log(`Checking ${endpoint.href} as user \"${userId}\"\\n`);\n const report = await checkEndpoint({\n url: endpoint.href,\n secretKey,\n userId,\n sessionUrl,\n fetch: io.fetch,\n onResult: (result) => {\n io.log(`${LABEL[result.status]} ${result.name}`);\n if (result.detail) io.log(` ${result.detail}`);\n },\n });\n\n const count = (status: CheckResult['status']) =>\n report.results.filter((result) => result.status === status).length;\n const skipped = count('skip');\n io.log(\n `\\n${count('pass')} passed, ${count('fail')} failed${skipped ? `, ${skipped} skipped` : ''}`,\n );\n for (const note of report.notes) io.log(`NOTE ${note}`);\n return report.ok ? 0 : 1;\n}\n","// The conformance checker behind `npx @relume_io/partner-node check`.\n// It calls a partner endpoint the way Relume does (docs/partner-protocol/v1.md\n// sections 5 and 6) and reports which rules of the contract it keeps, most of\n// all the two that protect real users: a repeated chargeId debits once, and a\n// reversal of a charge that was never debited changes nothing.\n//\n// It needs the endpoint URL, the secret key and a user whose wallet holds at\n// least CHECK_CHARGE_CREDITS. It charges that user and gives every credit\n// back, so run it against a test user on your test endpoint.\n//\n// It also asks the session route (section 4) for a session the way another\n// site's page would, fails a CORS setup that would let that page read it,\n// and checks the route refuses a request from another site or without the\n// embed's header.\n\nimport {\n absent,\n isEmail,\n isHttpsUrl,\n isRecord,\n isString,\n isWhole,\n} from './guards.ts';\nimport { EMBED_HEADER, EMBED_HEADER_VALUE } from './session.ts';\nimport { REQUEST_ID_HEADER, SIGNATURE_HEADER, signCall } from './signing.ts';\n\nexport interface CheckOptions {\n /** The endpoint Relume calls, e.g. `https://partner.example/relume/calls`. */\n url: string;\n secretKey: string;\n /** A user your wallet knows, with at least CHECK_CHARGE_CREDITS. */\n userId: string;\n /**\n * The session route the embed calls. Defaults to `session` next to a\n * `url` ending in `/calls`, where `@relume_io/partner-node` mounts it.\n */\n sessionUrl?: string;\n fetch?: typeof fetch;\n /** The clock, in milliseconds. For tests. */\n now?: () => number;\n /** Called as each check finishes, so the CLI can print as it goes. */\n onResult?: (result: CheckResult) => void;\n}\n\nexport type CheckStatus = 'pass' | 'fail' | 'skip';\n\nexport interface CheckResult {\n name: string;\n status: CheckStatus;\n /** Why it failed or didn't run. */\n detail?: string;\n}\n\nexport interface CheckReport {\n /** True when every check ran and passed. A skipped check is not a pass. */\n ok: boolean;\n results: CheckResult[];\n /** What the run left behind, e.g. a balance its reversals didn't restore. */\n notes: string[];\n}\n\n/**\n * What the checker charges. Two, so a reversal of one credit leaves one to\n * show whether a repeated reversalId credits again.\n */\nexport const CHECK_CHARGE_CREDITS = 2;\n\n// Relume's own timeouts (protocol section 5): an endpoint slower than these\n// fails for real users too.\nconst READ_TIMEOUT_MS = 4_000;\nconst CHARGE_TIMEOUT_MS = 4_000;\nconst REVERSE_TIMEOUT_MS = 10_000;\n\n/** Further than the 300 seconds a verifier allows, either way. */\nconst SKEW_SECONDS = 600;\n\n/** The page the session route is asked from. */\nexport const FOREIGN_ORIGIN = 'https://evil.example';\n\nconst SESSION_CORS = \"doesn't let another site read the session route\";\nconst SESSION_HEADER =\n 'refuses a session request without the Relume-Embed header';\nconst SESSION_CROSS_SITE = 'refuses a session request from another site';\nconst SESSION_CHECKS = [SESSION_CORS, SESSION_HEADER, SESSION_CROSS_SITE];\n\nconst ACCEPT = 'accepts a correctly signed call';\nconst ROTATION = 'accepts a key rotation header, with your key second';\nconst OTHER_KEY = 'rejects a signature made with another key';\nconst TAMPERED = 'rejects a body changed after signing';\nconst STALE = 'rejects a timestamp more than 5 minutes old';\nconst FUTURE = 'rejects a timestamp more than 5 minutes ahead';\nconst UNSIGNED = 'rejects a call with no signature';\nconst USER_GET = 'answers user.get with a valid profile';\nconst UNKNOWN_USER = \"answers user.get 404 for a user it doesn't know\";\nconst CREDITS_GET = 'answers credits.get with a valid balance';\nconst DEBIT = 'debits a charge';\nconst REPEAT_CHARGE = 'debits only once when the same charge is sent twice';\nconst DECLINE = \"answers 402 to a charge the user can't afford\";\nconst UNKNOWN_REVERSAL = 'changes nothing when an unknown charge is reversed';\nconst LATE_CHARGE = 'refuses a charge that arrives after its reversal';\nconst REVERSAL = 'credits back a reversal';\nconst REPEAT_REVERSAL = 'credits a repeated reversalId only once';\nconst WALLET = [\n DEBIT,\n REPEAT_CHARGE,\n DECLINE,\n UNKNOWN_REVERSAL,\n LATE_CHARGE,\n REVERSAL,\n REPEAT_REVERSAL,\n];\n\nconst MALFORMED = Symbol('malformed');\n\ntype Body = Record<string, unknown> | typeof MALFORMED;\n\ninterface Responded {\n answered: true;\n status: number;\n /** A 2xx. */\n ok: boolean;\n body: Body;\n}\n\ntype Answer = Responded | { answered: false; reason: string };\n\ntype Ok = Responded & { ok: true };\n\nfunction isOk(answer: Answer): answer is Ok {\n return answer.answered && answer.ok;\n}\n\n/** An empty body counts as `{}`; anything but a JSON object is malformed. */\nfunction parseBody(text: string): Body {\n if (text.trim() === '') return {};\n try {\n const value: unknown = JSON.parse(text);\n return isRecord(value) ? value : MALFORMED;\n } catch {\n return MALFORMED;\n }\n}\n\n/** `answered 500 (internal_error)`, `timed out after 4s`, … */\nfunction said(answer: Answer): string {\n if (!answer.answered) return answer.reason;\n const error =\n answer.body !== MALFORMED && isRecord(answer.body.error)\n ? answer.body.error.code\n : undefined;\n return typeof error === 'string'\n ? `answered ${answer.status} (${error})`\n : `answered ${answer.status}`;\n}\n\n/** The problem with a user.get body, or null when Relume would store it. */\nfunction profileProblem(body: Body): string | null {\n if (body === MALFORMED) return \"the body isn't a JSON object\";\n const { name, email, avatarUrl } = body;\n if (!absent(name) && !isString(name, 1, 200)) {\n return 'name must be a string of at most 200 characters';\n }\n if (!absent(email) && !isEmail(email)) {\n return 'email must be a valid email address';\n }\n if (!absent(avatarUrl) && !isHttpsUrl(avatarUrl)) {\n return 'avatarUrl must be an https URL';\n }\n return null;\n}\n\n/**\n * The problem with a 2xx charge or reversal body, or null. `balance` is\n * optional, but null isn't \"left out\": Relume reads it as a malformed\n * answer, which turns a charge into an unknown one.\n */\nfunction optionalBalanceProblem(body: Body): string | null {\n if (body === MALFORMED) return \"the body isn't a JSON object\";\n if (body.balance === undefined || isWhole(body.balance, 0)) return null;\n return `balance was ${JSON.stringify(body.balance)}; leave it out or send a whole number, zero or more`;\n}\n\nfunction bodyBalance(body: Body): number | undefined {\n return body !== MALFORMED && isWhole(body.balance, 0)\n ? body.balance\n : undefined;\n}\n\n/** The session route beside a calls route the SDK mounted, or null. */\nexport function sessionUrlFor(callsUrl: string): string | null {\n const url = new URL(callsUrl);\n if (!/\\/calls\\/?$/.test(url.pathname)) return null;\n url.pathname = url.pathname.replace(/calls\\/?$/, 'session');\n url.search = '';\n return url.href;\n}\n\nfunction randomId(prefix: string): string {\n return `${prefix}_${crypto.randomUUID().replaceAll('-', '')}`;\n}\n\nfunction networkReason(error: unknown): string {\n const cause = error instanceof Error ? error.cause : undefined;\n const code = isRecord(cause) ? cause.code : undefined;\n return typeof code === 'string'\n ? `couldn't connect (${code})`\n : `couldn't connect (${error instanceof Error ? error.message : String(error)})`;\n}\n\nexport async function checkEndpoint(\n options: CheckOptions,\n): Promise<CheckReport> {\n const { url, secretKey, userId } = options;\n const fetchImpl = options.fetch ?? ((...args) => fetch(...args));\n const now = options.now ?? Date.now;\n const nowSeconds = () => Math.floor(now() / 1000);\n const results: CheckResult[] = [];\n const notes: string[] = [];\n\n function record(result: CheckResult): void {\n results.push(result);\n options.onResult?.(result);\n }\n\n /** Runs one check: it returns why it failed, or null for a pass. */\n async function run(\n name: string,\n check: () => Promise<string | null>,\n ): Promise<boolean> {\n let failure: string | null;\n try {\n failure = await check();\n } catch (error) {\n failure = `the checker failed: ${error instanceof Error ? error.message : String(error)}`;\n }\n record(\n failure === null\n ? { name, status: 'pass' }\n : { name, status: 'fail', detail: failure },\n );\n return failure === null;\n }\n\n function skip(names: readonly string[], detail: string): void {\n for (const name of names) record({ name, status: 'skip', detail });\n }\n\n async function post(\n rawBody: string,\n header: string | null,\n timeoutMs: number,\n ): Promise<Answer> {\n const headers: Record<string, string> = {\n 'Content-Type': 'application/json',\n [REQUEST_ID_HEADER]: randomId('check'),\n };\n if (header !== null) headers[SIGNATURE_HEADER] = header;\n try {\n // Relume never follows redirects, so neither does the checker.\n const response = await fetchImpl(url, {\n method: 'POST',\n headers,\n body: rawBody,\n redirect: 'manual',\n signal: AbortSignal.timeout(timeoutMs),\n });\n const text = await response.text();\n if (response.status >= 300 && response.status < 400) {\n return {\n answered: false,\n reason: `redirected with ${response.status} (Relume never follows redirects)`,\n };\n }\n return {\n answered: true,\n status: response.status,\n ok: response.status >= 200 && response.status < 300,\n body: parseBody(text),\n };\n } catch (error) {\n return {\n answered: false,\n reason:\n error instanceof Error && error.name === 'TimeoutError'\n ? `timed out after ${timeoutMs / 1000}s`\n : networkReason(error),\n };\n }\n }\n\n async function signed(\n body: Record<string, unknown>,\n timeoutMs: number,\n ): Promise<Answer> {\n const rawBody = JSON.stringify(body);\n return post(\n rawBody,\n await signCall(secretKey, nowSeconds(), rawBody),\n timeoutMs,\n );\n }\n\n /** The balance from credits.get, or why it couldn't be read. */\n async function readBalance(): Promise<\n { balance: number } | { failure: string }\n > {\n const answer = await signed(\n { type: 'credits.get', userId },\n READ_TIMEOUT_MS,\n );\n if (!isOk(answer)) {\n return { failure: `credits.get ${said(answer)}; expected 200` };\n }\n if (answer.body === MALFORMED) {\n return {\n failure: `credits.get answered ${answer.status} with a body that isn't a JSON object`,\n };\n }\n if (!isWhole(answer.body.balance, 0)) {\n return {\n failure: `credits.get answered balance ${JSON.stringify(answer.body.balance)}; expected a whole number, zero or more`,\n };\n }\n return { balance: answer.body.balance };\n }\n\n /** One request to the session route, and the origin its CORS grants. */\n async function askSession(\n sessionUrl: string,\n init: RequestInit,\n ): Promise<{ answer: Answer; allowOrigin: string | null }> {\n try {\n const response = await fetchImpl(sessionUrl, {\n ...init,\n redirect: 'manual',\n signal: AbortSignal.timeout(READ_TIMEOUT_MS),\n });\n const text = await response.text();\n return {\n answer: {\n answered: true,\n status: response.status,\n ok: response.status >= 200 && response.status < 300,\n body: parseBody(text),\n },\n allowOrigin:\n response.headers.get('access-control-allow-origin')?.trim() ?? null,\n };\n } catch (error) {\n const reason =\n error instanceof Error && error.name === 'TimeoutError'\n ? `timed out after ${READ_TIMEOUT_MS / 1000}s`\n : networkReason(error);\n return { answer: { answered: false, reason }, allowOrigin: null };\n }\n }\n\n // Whether the session route answered at all, for the checks after the\n // first. A holder object, as for `found` below.\n const session = { answered: false };\n\n /**\n * The problem with the session route's CORS, or null. It asks the way a\n * page on another site would: the preflight for the embed's header, then\n * the GET. A route that grants that page's origin lets it read what the\n * route answers for a signed-in user, a client secret included.\n */\n async function sessionCorsProblem(\n sessionUrl: string,\n ): Promise<string | null> {\n const probes: [what: string, init: RequestInit][] = [\n [\n 'the preflight',\n {\n method: 'OPTIONS',\n headers: {\n Origin: FOREIGN_ORIGIN,\n 'Access-Control-Request-Method': 'GET',\n 'Access-Control-Request-Headers': EMBED_HEADER.toLowerCase(),\n },\n },\n ],\n [\n 'GET',\n {\n method: 'GET',\n headers: {\n Origin: FOREIGN_ORIGIN,\n [EMBED_HEADER]: EMBED_HEADER_VALUE,\n 'Sec-Fetch-Site': 'cross-site',\n 'Sec-Fetch-Mode': 'cors',\n },\n },\n ],\n ];\n // Both probes run even after a failure, so the GET says whether the\n // route is there for the checks after this one.\n let problem: string | null = null;\n for (const [what, init] of probes) {\n const { answer, allowOrigin } = await askSession(sessionUrl, init);\n if (!answer.answered) return `${what} to ${sessionUrl} ${answer.reason}`;\n if (allowOrigin === FOREIGN_ORIGIN) {\n problem ??= `${what} to ${sessionUrl} from ${FOREIGN_ORIGIN} answered Access-Control-Allow-Origin: ${FOREIGN_ORIGIN}, so a page on any site can read what this route answers for a signed-in user. Allow only your own page origins, never the request's Origin`;\n }\n if (init.method === 'GET') {\n session.answered = true;\n }\n }\n return problem;\n }\n\n /** Whether the session route is somewhere else: a 404 to the embed's request. */\n async function sessionRouteMissing(sessionUrl: string): Promise<boolean> {\n const { answer } = await askSession(sessionUrl, {\n method: 'GET',\n headers: { [EMBED_HEADER]: EMBED_HEADER_VALUE },\n });\n return answer.answered && answer.status === 404;\n }\n\n /** A session request the route must refuse with `status` and `code`. */\n async function sessionRefusalProblem(\n sessionUrl: string,\n headers: Record<string, string>,\n status: number,\n code: string,\n ): Promise<string | null> {\n const { answer } = await askSession(sessionUrl, {\n method: 'GET',\n headers,\n });\n if (answer.answered && answer.status === status) return null;\n if (answer.answered && answer.status === 401) {\n return `${said(answer)}: it looked for a signed-in user first. Answer ${status} ${code} before reading the user`;\n }\n return `${said(answer)}; expected ${status} ${code}`;\n }\n\n // The session route. It needs no key or user, so it runs whatever the\n // calls below find.\n const sessionUrl = options.sessionUrl ?? sessionUrlFor(url);\n const notFound = sessionUrl && (await sessionRouteMissing(sessionUrl));\n if (sessionUrl === null || notFound) {\n // Looked in the wrong place, which says nothing about the route.\n skip(\n SESSION_CHECKS,\n sessionUrl === null\n ? \"--url doesn't end in /calls; pass --session-url with the session route your page's embed calls\"\n : `GET ${sessionUrl} answered 404; pass --session-url with the session route your page's embed calls`,\n );\n } else {\n await run(SESSION_CORS, () => sessionCorsProblem(sessionUrl));\n if (!session.answered) {\n skip(SESSION_CHECKS.slice(1), 'needs the session route to answer');\n } else {\n await run(SESSION_HEADER, () =>\n sessionRefusalProblem(sessionUrl, {}, 400, 'embed_header_missing'),\n );\n await run(SESSION_CROSS_SITE, () =>\n sessionRefusalProblem(\n sessionUrl,\n {\n [EMBED_HEADER]: EMBED_HEADER_VALUE,\n 'Sec-Fetch-Site': 'cross-site',\n },\n 403,\n 'cross_site_request',\n ),\n );\n }\n }\n\n // What the checks find out for later ones. A holder object, because\n // TypeScript narrows a plain `let` assigned inside a callback to its\n // initial value.\n const found: {\n wrongKey: boolean;\n balance: number | null;\n charged: Ok | null;\n reversed: boolean;\n } = { wrongKey: false, balance: null, charged: null, reversed: false };\n\n // Signatures. Every probe is a credits.get, which changes nothing, so a\n // forged call that gets through does no harm here.\n const read = JSON.stringify({ type: 'credits.get', userId });\n // An unknown field, which the partner must ignore: only the signature\n // check can tell this body from the one that was signed.\n const tampered = JSON.stringify({\n type: 'credits.get',\n userId,\n note: 'changed after signing',\n });\n const otherKey = randomId('sk_test_relume_check');\n const t = nowSeconds();\n\n await run(ACCEPT, async () => {\n const answer = await post(\n read,\n await signCall(secretKey, t, read),\n READ_TIMEOUT_MS,\n );\n if (isOk(answer)) return null;\n if (answer.answered && answer.status === 401) {\n found.wrongKey = true;\n return `${said(answer)} to a signed credits.get: is --secret-key the key this endpoint verifies with?`;\n }\n return `${said(answer)} to a signed credits.get; expected 200`;\n });\n // Every other check would fail the same way, or pass for the wrong reason.\n if (found.wrongKey) {\n skip(\n [\n ROTATION,\n OTHER_KEY,\n TAMPERED,\n STALE,\n FUTURE,\n UNSIGNED,\n USER_GET,\n UNKNOWN_USER,\n CREDITS_GET,\n ...WALLET,\n ],\n 'needs the endpoint to accept a correctly signed call',\n );\n return { ok: false, results, notes };\n }\n\n await run(ROTATION, async () => {\n const answer = await post(\n read,\n await signCall([otherKey, secretKey], t, read),\n READ_TIMEOUT_MS,\n );\n return isOk(answer)\n ? null\n : `${said(answer)}; accept a call when any v1= value matches your key`;\n });\n\n const forgeries: [name: string, rawBody: string, header: string | null][] = [\n [OTHER_KEY, read, await signCall(otherKey, t, read)],\n [TAMPERED, tampered, await signCall(secretKey, t, read)],\n [STALE, read, await signCall(secretKey, t - SKEW_SECONDS, read)],\n [FUTURE, read, await signCall(secretKey, t + SKEW_SECONDS, read)],\n [UNSIGNED, read, null],\n ];\n for (const [name, rawBody, header] of forgeries) {\n await run(name, async () => {\n const answer = await post(rawBody, header, READ_TIMEOUT_MS);\n if (answer.answered && answer.status === 401) return null;\n if (isOk(answer)) {\n return `${said(answer)}: it acted on a call Relume didn't sign; answer 401 invalid_signature`;\n }\n return `${said(answer)}; expected 401 invalid_signature`;\n });\n }\n\n // The reads.\n await run(USER_GET, async () => {\n const answer = await signed({ type: 'user.get', userId }, READ_TIMEOUT_MS);\n if (answer.answered && answer.status === 404) {\n return `answered 404: it doesn't know user \"${userId}\". Pass a --user your wallet knows`;\n }\n if (!isOk(answer)) {\n return `${said(answer)}; expected 200 { name?, email?, avatarUrl? }`;\n }\n return profileProblem(answer.body);\n });\n // A 404 is how Relume refuses a session for someone without a wallet; a\n // profile for any id would open one.\n await run(UNKNOWN_USER, async () => {\n const answer = await signed(\n { type: 'user.get', userId: randomId('u_check_unknown') },\n READ_TIMEOUT_MS,\n );\n return answer.answered && answer.status === 404\n ? null\n : `${said(answer)} for a user id your wallet has never seen; expected 404`;\n });\n\n await run(CREDITS_GET, async () => {\n const result = await readBalance();\n if ('failure' in result) return result.failure;\n found.balance = result.balance;\n return null;\n });\n\n // The wallet. Each check compares against the balance the one before it\n // read, so one broken rule doesn't fail every check after it.\n const start = found.balance;\n if (start === null) {\n skip(WALLET, 'needs a working credits.get');\n return { ok: false, results, notes };\n }\n if (start < CHECK_CHARGE_CREDITS) {\n skip(\n WALLET,\n `user \"${userId}\" has a balance of ${start}; top it up to at least ${CHECK_CHARGE_CREDITS} (the check gives it back)`,\n );\n return { ok: false, results, notes };\n }\n\n let current = start;\n /** Charges the checker may have debited, and what's left of each to give back. */\n const toReverse = new Map<\n string,\n { partnerCredits: number; relumeCredits: number }\n >();\n\n /** Reads the balance and checks it moved by `delta`, or says how it didn't. */\n async function expectBalance(\n delta: number,\n what: string,\n ): Promise<string | null> {\n const result = await readBalance();\n if ('failure' in result) return result.failure;\n const before = current;\n current = result.balance;\n if (result.balance === before + delta) return null;\n return `${what} moved the balance from ${before} to ${result.balance}; expected ${before + delta}`;\n }\n\n /** Reverses a charge the checker made, the way Relume reverses one it can't finish. */\n async function giveBack(id: string): Promise<void> {\n const left = toReverse.get(id);\n if (left === undefined) return;\n toReverse.delete(id);\n const answer = await signed(\n {\n type: 'credits.reverse',\n userId,\n reversalId: randomId('rv_check'),\n ...left,\n chargeId: id,\n reason: 'work_failed',\n },\n REVERSE_TIMEOUT_MS,\n );\n if (!isOk(answer)) notes.push(`Giving back charge ${id} ${said(answer)}.`);\n }\n\n /**\n * Runs a wallet check, then re-reads the balance if it failed: a failure\n * can leave the balance anywhere, and the next check measures from here.\n */\n async function walletCheck(\n name: string,\n check: () => Promise<string | null>,\n ): Promise<void> {\n if (await run(name, check)) return;\n const result = await readBalance();\n if ('balance' in result) current = result.balance;\n }\n\n // The give-back runs whatever happens below, even if printing a result\n // throws (an EPIPE from `check | head`): the user must not be left short.\n try {\n const chargeId = randomId('ch_check');\n const charge = JSON.stringify({\n type: 'credits.charge',\n userId,\n chargeId,\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n action: 'chat.message',\n description: 'Relume conformance check (given back)',\n });\n\n await walletCheck(DEBIT, async () => {\n toReverse.set(chargeId, {\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n });\n const answer = await post(\n charge,\n await signCall(secretKey, nowSeconds(), charge),\n CHARGE_TIMEOUT_MS,\n );\n if (!isOk(answer)) {\n return `${said(answer)} to a charge of ${CHECK_CHARGE_CREDITS} from a balance of ${current}; expected 200`;\n }\n found.charged = answer;\n const problem =\n optionalBalanceProblem(answer.body) ??\n (await expectBalance(-CHECK_CHARGE_CREDITS, 'the charge'));\n if (problem) return problem;\n const reported = bodyBalance(answer.body);\n return reported === undefined || reported === current\n ? null\n : `the charge answered balance ${reported}, but credits.get says ${current}`;\n });\n\n const { charged } = found;\n if (charged === null) {\n skip([REPEAT_CHARGE], 'needs the first charge to succeed');\n } else {\n await walletCheck(REPEAT_CHARGE, async () => {\n // The same body, signed again: what an inline retry sends.\n const answer = await post(\n charge,\n await signCall(secretKey, nowSeconds(), charge),\n CHARGE_TIMEOUT_MS,\n );\n if (!answer.answered || answer.status !== charged.status) {\n return `the repeat ${said(answer)}, the first ${said(charged)}; answer a repeated chargeId with the first result`;\n }\n const moved = await expectBalance(0, 'the repeat');\n if (moved) return `${moved}: it debited the same chargeId twice`;\n const was = bodyBalance(charged.body);\n const again = bodyBalance(answer.body);\n return was === undefined || again === undefined || was === again\n ? null\n : `the repeat answered balance ${again}, the first ${was}; answer a repeated chargeId with the first result`;\n });\n }\n\n await walletCheck(DECLINE, async () => {\n const declinedId = randomId('ch_check');\n const amount = current + 1;\n toReverse.set(declinedId, {\n partnerCredits: amount,\n relumeCredits: CHECK_CHARGE_CREDITS,\n });\n const answer = await signed(\n {\n type: 'credits.charge',\n userId,\n chargeId: declinedId,\n partnerCredits: amount,\n relumeCredits: CHECK_CHARGE_CREDITS,\n action: 'chat.message',\n description: 'Relume conformance check (should be declined)',\n },\n CHARGE_TIMEOUT_MS,\n );\n if (isOk(answer)) {\n // Now, so the overdrawn balance doesn't fail the checks after this one.\n await giveBack(declinedId);\n return `${said(answer)}: it accepted a charge of ${amount} from a balance of ${current}; answer 402`;\n }\n if (!answer.answered || answer.status !== 402) {\n // A 4xx refused the charge, so there's nothing to give back. A 5xx or\n // a timeout may have debited first, so that stays queued.\n if (answer.answered && answer.status < 500)\n toReverse.delete(declinedId);\n return `${said(answer)} to a charge of ${amount} from a balance of ${current}; expected 402`;\n }\n // Relume never sends a reversal for a decline.\n toReverse.delete(declinedId);\n const moved = await expectBalance(0, 'the declined charge');\n if (moved) return moved;\n // A 402 body may be unreadable, but a balance it does give is shown.\n const said402 = bodyBalance(answer.body);\n return said402 === undefined || said402 === current\n ? null\n : `the 402 answered balance ${said402}, but credits.get says ${current}`;\n });\n\n // A charge Relume gave up on, reversed before the wallet saw it.\n const lateId = randomId('ch_check_never_sent');\n let reversedFirst = false;\n await walletCheck(UNKNOWN_REVERSAL, async () => {\n const answer = await signed(\n {\n type: 'credits.reverse',\n userId,\n reversalId: randomId('rv_check'),\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n chargeId: lateId,\n reason: 'charge_unknown',\n },\n REVERSE_TIMEOUT_MS,\n );\n if (!isOk(answer)) {\n return `${said(answer)}; expected 200, crediting nothing (Relume retries any other answer for 72 hours)`;\n }\n reversedFirst = true;\n const problem = optionalBalanceProblem(answer.body);\n if (problem) return problem;\n const moved = await expectBalance(0, 'the reversal');\n return moved && `${moved}: it credited a charge it never debited`;\n });\n\n if (!reversedFirst) {\n skip([LATE_CHARGE], 'needs the reversal of an unknown charge to succeed');\n } else {\n // The same charge, arriving late: an attempt from a wallet that\n // stalled and caught up after Relume gave up and reversed it.\n await walletCheck(LATE_CHARGE, async () => {\n toReverse.set(lateId, {\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n });\n const answer = await signed(\n {\n type: 'credits.charge',\n userId,\n chargeId: lateId,\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n action: 'chat.message',\n description: 'Relume conformance check (should be refused)',\n },\n CHARGE_TIMEOUT_MS,\n );\n const moved = await expectBalance(0, 'the late charge');\n if (moved) {\n return `${moved}: it debited a charge it had already answered a reversal for; record a reversed chargeId as declined`;\n }\n toReverse.delete(lateId);\n // Relume stopped waiting for this charge, so any refusal will do.\n return isOk(answer)\n ? `${said(answer)}; expected 402, debiting nothing`\n : null;\n });\n }\n\n // Half of the first charge, so a repeat that credits again shows.\n const reversal = JSON.stringify({\n type: 'credits.reverse',\n userId,\n reversalId: randomId('rv_check'),\n partnerCredits: 1,\n relumeCredits: 1,\n chargeId,\n reason: 'work_failed',\n });\n if (charged === null) {\n skip([REVERSAL, REPEAT_REVERSAL], 'needs the first charge to succeed');\n } else {\n await walletCheck(REVERSAL, async () => {\n const answer = await post(\n reversal,\n await signCall(secretKey, nowSeconds(), reversal),\n REVERSE_TIMEOUT_MS,\n );\n if (!isOk(answer)) return `${said(answer)}; expected 200`;\n found.reversed = true;\n toReverse.set(chargeId, {\n partnerCredits: CHECK_CHARGE_CREDITS - 1,\n relumeCredits: CHECK_CHARGE_CREDITS - 1,\n });\n return (\n optionalBalanceProblem(answer.body) ??\n (await expectBalance(1, 'a reversal of 1 credit'))\n );\n });\n if (!found.reversed) {\n skip([REPEAT_REVERSAL], 'needs the reversal to succeed');\n } else {\n await walletCheck(REPEAT_REVERSAL, async () => {\n const answer = await post(\n reversal,\n await signCall(secretKey, nowSeconds(), reversal),\n REVERSE_TIMEOUT_MS,\n );\n if (!isOk(answer)) return `the repeat ${said(answer)}; expected 200`;\n const moved = await expectBalance(0, 'the repeat');\n return moved && `${moved}: it credited the same reversalId twice`;\n });\n }\n }\n } finally {\n for (const id of [...toReverse.keys()]) await giveBack(id);\n }\n const end = await readBalance();\n if ('failure' in end) {\n notes.push(`Couldn't read the final balance: ${end.failure}.`);\n } else if (end.balance !== start) {\n notes.push(\n `User \"${userId}\" has a balance of ${end.balance}; it was ${start} before the check. Correct it in your wallet.`,\n );\n }\n\n const ok = results.every((result) => result.status === 'pass');\n return { ok, results, notes };\n}\n","#!/usr/bin/env node\nimport { runCli } from './cli.ts';\n\n// No top-level await: the CommonJS build runs this file too.\nvoid runCli(process.argv.slice(2), {\n log: (line) => console.log(line),\n error: (line) => console.error(line),\n env: process.env,\n}).then(\n (code) => {\n process.exitCode = code;\n },\n (error: unknown) => {\n console.error(\n `The check stopped: ${error instanceof Error ? error.message : String(error)}`,\n );\n process.exitCode = 1;\n },\n);\n"],"mappings":";;;;;;;;;;;;;;;;AAGA,SAAS,iBAAiB;;;AC8DnB,IAAM,uBAAuB;AAIpC,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAG3B,IAAM,eAAe;AAGd,IAAM,iBAAiB;AAE9B,IAAM,eAAe;AACrB,IAAM,iBACJ;AACF,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB,CAAC,cAAc,gBAAgB,kBAAkB;AAExE,IAAM,SAAS;AACf,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,QAAQ;AACd,IAAM,SAAS;AACf,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,eAAe;AACrB,IAAM,cAAc;AACpB,IAAM,QAAQ;AACd,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAChB,IAAM,mBAAmB;AACzB,IAAM,cAAc;AACpB,IAAM,WAAW;AACjB,IAAM,kBAAkB;AACxB,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,YAAY,OAAO,WAAW;AAgBpC,SAAS,KAAK,QAA8B;AAC1C,SAAO,OAAO,YAAY,OAAO;AACnC;AAGA,SAAS,UAAU,MAAoB;AACrC,MAAI,KAAK,KAAK,MAAM,GAAI,QAAO,CAAC;AAChC,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,WAAO,SAAS,KAAK,IAAI,QAAQ;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,KAAK,QAAwB;AACpC,MAAI,CAAC,OAAO,SAAU,QAAO,OAAO;AACpC,QAAM,QACJ,OAAO,SAAS,aAAa,SAAS,OAAO,KAAK,KAAK,IACnD,OAAO,KAAK,MAAM,OAClB;AACN,SAAO,OAAO,UAAU,WACpB,YAAY,OAAO,MAAM,KAAK,KAAK,MACnC,YAAY,OAAO,MAAM;AAC/B;AAGA,SAAS,eAAe,MAA2B;AACjD,MAAI,SAAS,UAAW,QAAO;AAC/B,QAAM,EAAE,MAAM,OAAO,UAAU,IAAI;AACnC,MAAI,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,MAAM,GAAG,GAAG,GAAG;AAC5C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,KAAK,GAAG;AACrC,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,SAAS,KAAK,CAAC,WAAW,SAAS,GAAG;AAChD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOA,SAAS,uBAAuB,MAA2B;AACzD,MAAI,SAAS,UAAW,QAAO;AAC/B,MAAI,KAAK,YAAY,UAAa,QAAQ,KAAK,SAAS,CAAC,EAAG,QAAO;AACnE,SAAO,eAAe,KAAK,UAAU,KAAK,OAAO,CAAC;AACpD;AAEA,SAAS,YAAY,MAAgC;AACnD,SAAO,SAAS,aAAa,QAAQ,KAAK,SAAS,CAAC,IAChD,KAAK,UACL;AACN;AAGO,SAAS,cAAc,UAAiC;AAC7D,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,MAAI,CAAC,cAAc,KAAK,IAAI,QAAQ,EAAG,QAAO;AAC9C,MAAI,WAAW,IAAI,SAAS,QAAQ,aAAa,SAAS;AAC1D,MAAI,SAAS;AACb,SAAO,IAAI;AACb;AAEA,SAAS,SAAS,QAAwB;AACxC,SAAO,GAAG,MAAM,IAAI,OAAO,WAAW,EAAE,WAAW,KAAK,EAAE,CAAC;AAC7D;AAEA,SAAS,cAAc,OAAwB;AAC7C,QAAM,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ;AACrD,QAAM,OAAO,SAAS,KAAK,IAAI,MAAM,OAAO;AAC5C,SAAO,OAAO,SAAS,WACnB,qBAAqB,IAAI,MACzB,qBAAqB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACjF;AAEA,eAAsB,cACpB,SACsB;AACtB,QAAM,EAAE,KAAK,WAAW,OAAO,IAAI;AACnC,QAAM,YAAY,QAAQ,UAAU,IAAI,SAAS,MAAM,GAAG,IAAI;AAC9D,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,aAAa,MAAM,KAAK,MAAM,IAAI,IAAI,GAAI;AAChD,QAAM,UAAyB,CAAC;AAChC,QAAM,QAAkB,CAAC;AAEzB,WAAS,OAAO,QAA2B;AACzC,YAAQ,KAAK,MAAM;AACnB,YAAQ,WAAW,MAAM;AAAA,EAC3B;AAGA,iBAAe,IACb,MACA,OACkB;AAClB,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,MAAM;AAAA,IACxB,SAAS,OAAO;AACd,gBAAU,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACzF;AACA;AAAA,MACE,YAAY,OACR,EAAE,MAAM,QAAQ,OAAO,IACvB,EAAE,MAAM,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,IAC9C;AACA,WAAO,YAAY;AAAA,EACrB;AAEA,WAAS,KAAK,OAA0B,QAAsB;AAC5D,eAAW,QAAQ,MAAO,QAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAAA,EACnE;AAEA,iBAAe,KACb,SACA,QACA,WACiB;AACjB,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,CAAC,iBAAiB,GAAG,SAAS,OAAO;AAAA,IACvC;AACA,QAAI,WAAW,KAAM,SAAQ,gBAAgB,IAAI;AACjD,QAAI;AAEF,YAAM,WAAW,MAAM,UAAU,KAAK;AAAA,QACpC,QAAQ;AAAA,QACR;AAAA,QACA,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ,YAAY,QAAQ,SAAS;AAAA,MACvC,CAAC;AACD,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,eAAO;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,mBAAmB,SAAS,MAAM;AAAA,QAC5C;AAAA,MACF;AACA,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ,SAAS;AAAA,QACjB,IAAI,SAAS,UAAU,OAAO,SAAS,SAAS;AAAA,QAChD,MAAM,UAAU,IAAI;AAAA,MACtB;AAAA,IACF,SAAS,OAAO;AACd,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QACE,iBAAiB,SAAS,MAAM,SAAS,iBACrC,mBAAmB,YAAY,GAAI,MACnC,cAAc,KAAK;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OACb,MACA,WACiB;AACjB,UAAM,UAAU,KAAK,UAAU,IAAI;AACnC,WAAO;AAAA,MACL;AAAA,MACA,MAAM,SAAS,WAAW,WAAW,GAAG,OAAO;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAGA,iBAAe,cAEb;AACA,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,MAAM,eAAe,OAAO;AAAA,MAC9B;AAAA,IACF;AACA,QAAI,CAAC,KAAK,MAAM,GAAG;AACjB,aAAO,EAAE,SAAS,eAAe,KAAK,MAAM,CAAC,iBAAiB;AAAA,IAChE;AACA,QAAI,OAAO,SAAS,WAAW;AAC7B,aAAO;AAAA,QACL,SAAS,wBAAwB,OAAO,MAAM;AAAA,MAChD;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,OAAO,KAAK,SAAS,CAAC,GAAG;AACpC,aAAO;AAAA,QACL,SAAS,gCAAgC,KAAK,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,WAAO,EAAE,SAAS,OAAO,KAAK,QAAQ;AAAA,EACxC;AAGA,iBAAe,WACbA,aACA,MACyD;AACzD,QAAI;AACF,YAAM,WAAW,MAAM,UAAUA,aAAY;AAAA,QAC3C,GAAG;AAAA,QACH,UAAU;AAAA,QACV,QAAQ,YAAY,QAAQ,eAAe;AAAA,MAC7C,CAAC;AACD,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,UAAU;AAAA,UACV,QAAQ,SAAS;AAAA,UACjB,IAAI,SAAS,UAAU,OAAO,SAAS,SAAS;AAAA,UAChD,MAAM,UAAU,IAAI;AAAA,QACtB;AAAA,QACA,aACE,SAAS,QAAQ,IAAI,6BAA6B,GAAG,KAAK,KAAK;AAAA,MACnE;AAAA,IACF,SAAS,OAAO;AACd,YAAM,SACJ,iBAAiB,SAAS,MAAM,SAAS,iBACrC,mBAAmB,kBAAkB,GAAI,MACzC,cAAc,KAAK;AACzB,aAAO,EAAE,QAAQ,EAAE,UAAU,OAAO,OAAO,GAAG,aAAa,KAAK;AAAA,IAClE;AAAA,EACF;AAIA,QAAM,UAAU,EAAE,UAAU,MAAM;AAQlC,iBAAe,mBACbA,aACwB;AACxB,UAAM,SAA8C;AAAA,MAClD;AAAA,QACE;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,QAAQ;AAAA,YACR,iCAAiC;AAAA,YACjC,kCAAkC,aAAa,YAAY;AAAA,UAC7D;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,QAAQ;AAAA,YACR,CAAC,YAAY,GAAG;AAAA,YAChB,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,UAAyB;AAC7B,eAAW,CAAC,MAAM,IAAI,KAAK,QAAQ;AACjC,YAAM,EAAE,QAAQ,YAAY,IAAI,MAAM,WAAWA,aAAY,IAAI;AACjE,UAAI,CAAC,OAAO,SAAU,QAAO,GAAG,IAAI,OAAOA,WAAU,IAAI,OAAO,MAAM;AACtE,UAAI,gBAAgB,gBAAgB;AAClC,oBAAY,GAAG,IAAI,OAAOA,WAAU,SAAS,cAAc,0CAA0C,cAAc;AAAA,MACrH;AACA,UAAI,KAAK,WAAW,OAAO;AACzB,gBAAQ,WAAW;AAAA,MACrB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,iBAAe,oBAAoBA,aAAsC;AACvE,UAAM,EAAE,OAAO,IAAI,MAAM,WAAWA,aAAY;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,EAAE,CAAC,YAAY,GAAG,mBAAmB;AAAA,IAChD,CAAC;AACD,WAAO,OAAO,YAAY,OAAO,WAAW;AAAA,EAC9C;AAGA,iBAAe,sBACbA,aACA,SACA,QACA,MACwB;AACxB,UAAM,EAAE,OAAO,IAAI,MAAM,WAAWA,aAAY;AAAA,MAC9C,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AACD,QAAI,OAAO,YAAY,OAAO,WAAW,OAAQ,QAAO;AACxD,QAAI,OAAO,YAAY,OAAO,WAAW,KAAK;AAC5C,aAAO,GAAG,KAAK,MAAM,CAAC,kDAAkD,MAAM,IAAI,IAAI;AAAA,IACxF;AACA,WAAO,GAAG,KAAK,MAAM,CAAC,cAAc,MAAM,IAAI,IAAI;AAAA,EACpD;AAIA,QAAM,aAAa,QAAQ,cAAc,cAAc,GAAG;AAC1D,QAAM,WAAW,cAAe,MAAM,oBAAoB,UAAU;AACpE,MAAI,eAAe,QAAQ,UAAU;AAEnC;AAAA,MACE;AAAA,MACA,eAAe,OACX,mGACA,OAAO,UAAU;AAAA,IACvB;AAAA,EACF,OAAO;AACL,UAAM,IAAI,cAAc,MAAM,mBAAmB,UAAU,CAAC;AAC5D,QAAI,CAAC,QAAQ,UAAU;AACrB,WAAK,eAAe,MAAM,CAAC,GAAG,mCAAmC;AAAA,IACnE,OAAO;AACL,YAAM;AAAA,QAAI;AAAA,QAAgB,MACxB,sBAAsB,YAAY,CAAC,GAAG,KAAK,sBAAsB;AAAA,MACnE;AACA,YAAM;AAAA,QAAI;AAAA,QAAoB,MAC5B;AAAA,UACE;AAAA,UACA;AAAA,YACE,CAAC,YAAY,GAAG;AAAA,YAChB,kBAAkB;AAAA,UACpB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA,QAAM,QAKF,EAAE,UAAU,OAAO,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM;AAIrE,QAAM,OAAO,KAAK,UAAU,EAAE,MAAM,eAAe,OAAO,CAAC;AAG3D,QAAM,WAAW,KAAK,UAAU;AAAA,IAC9B,MAAM;AAAA,IACN;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,WAAW,SAAS,sBAAsB;AAChD,QAAM,IAAI,WAAW;AAErB,QAAM,IAAI,QAAQ,YAAY;AAC5B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,MAAM,SAAS,WAAW,GAAG,IAAI;AAAA,MACjC;AAAA,IACF;AACA,QAAI,KAAK,MAAM,EAAG,QAAO;AACzB,QAAI,OAAO,YAAY,OAAO,WAAW,KAAK;AAC5C,YAAM,WAAW;AACjB,aAAO,GAAG,KAAK,MAAM,CAAC;AAAA,IACxB;AACA,WAAO,GAAG,KAAK,MAAM,CAAC;AAAA,EACxB,CAAC;AAED,MAAI,MAAM,UAAU;AAClB;AAAA,MACE;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AAAA,EACrC;AAEA,QAAM,IAAI,UAAU,YAAY;AAC9B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,MAAM,SAAS,CAAC,UAAU,SAAS,GAAG,GAAG,IAAI;AAAA,MAC7C;AAAA,IACF;AACA,WAAO,KAAK,MAAM,IACd,OACA,GAAG,KAAK,MAAM,CAAC;AAAA,EACrB,CAAC;AAED,QAAM,YAAsE;AAAA,IAC1E,CAAC,WAAW,MAAM,MAAM,SAAS,UAAU,GAAG,IAAI,CAAC;AAAA,IACnD,CAAC,UAAU,UAAU,MAAM,SAAS,WAAW,GAAG,IAAI,CAAC;AAAA,IACvD,CAAC,OAAO,MAAM,MAAM,SAAS,WAAW,IAAI,cAAc,IAAI,CAAC;AAAA,IAC/D,CAAC,QAAQ,MAAM,MAAM,SAAS,WAAW,IAAI,cAAc,IAAI,CAAC;AAAA,IAChE,CAAC,UAAU,MAAM,IAAI;AAAA,EACvB;AACA,aAAW,CAAC,MAAM,SAAS,MAAM,KAAK,WAAW;AAC/C,UAAM,IAAI,MAAM,YAAY;AAC1B,YAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,eAAe;AAC1D,UAAI,OAAO,YAAY,OAAO,WAAW,IAAK,QAAO;AACrD,UAAI,KAAK,MAAM,GAAG;AAChB,eAAO,GAAG,KAAK,MAAM,CAAC;AAAA,MACxB;AACA,aAAO,GAAG,KAAK,MAAM,CAAC;AAAA,IACxB,CAAC;AAAA,EACH;AAGA,QAAM,IAAI,UAAU,YAAY;AAC9B,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,YAAY,OAAO,GAAG,eAAe;AACzE,QAAI,OAAO,YAAY,OAAO,WAAW,KAAK;AAC5C,aAAO,uCAAuC,MAAM;AAAA,IACtD;AACA,QAAI,CAAC,KAAK,MAAM,GAAG;AACjB,aAAO,GAAG,KAAK,MAAM,CAAC;AAAA,IACxB;AACA,WAAO,eAAe,OAAO,IAAI;AAAA,EACnC,CAAC;AAGD,QAAM,IAAI,cAAc,YAAY;AAClC,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,MAAM,YAAY,QAAQ,SAAS,iBAAiB,EAAE;AAAA,MACxD;AAAA,IACF;AACA,WAAO,OAAO,YAAY,OAAO,WAAW,MACxC,OACA,GAAG,KAAK,MAAM,CAAC;AAAA,EACrB,CAAC;AAED,QAAM,IAAI,aAAa,YAAY;AACjC,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,aAAa,OAAQ,QAAO,OAAO;AACvC,UAAM,UAAU,OAAO;AACvB,WAAO;AAAA,EACT,CAAC;AAID,QAAM,QAAQ,MAAM;AACpB,MAAI,UAAU,MAAM;AAClB,SAAK,QAAQ,6BAA6B;AAC1C,WAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AAAA,EACrC;AACA,MAAI,QAAQ,sBAAsB;AAChC;AAAA,MACE;AAAA,MACA,SAAS,MAAM,sBAAsB,KAAK,2BAA2B,oBAAoB;AAAA,IAC3F;AACA,WAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AAAA,EACrC;AAEA,MAAI,UAAU;AAEd,QAAM,YAAY,oBAAI,IAGpB;AAGF,iBAAe,cACb,OACA,MACwB;AACxB,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,aAAa,OAAQ,QAAO,OAAO;AACvC,UAAM,SAAS;AACf,cAAU,OAAO;AACjB,QAAI,OAAO,YAAY,SAAS,MAAO,QAAO;AAC9C,WAAO,GAAG,IAAI,2BAA2B,MAAM,OAAO,OAAO,OAAO,cAAc,SAAS,KAAK;AAAA,EAClG;AAGA,iBAAe,SAAS,IAA2B;AACjD,UAAM,OAAO,UAAU,IAAI,EAAE;AAC7B,QAAI,SAAS,OAAW;AACxB,cAAU,OAAO,EAAE;AACnB,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,QACE,MAAM;AAAA,QACN;AAAA,QACA,YAAY,SAAS,UAAU;AAAA,QAC/B,GAAG;AAAA,QACH,UAAU;AAAA,QACV,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,KAAK,MAAM,EAAG,OAAM,KAAK,sBAAsB,EAAE,IAAI,KAAK,MAAM,CAAC,GAAG;AAAA,EAC3E;AAMA,iBAAe,YACb,MACA,OACe;AACf,QAAI,MAAM,IAAI,MAAM,KAAK,EAAG;AAC5B,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,aAAa,OAAQ,WAAU,OAAO;AAAA,EAC5C;AAIA,MAAI;AACF,UAAM,WAAW,SAAS,UAAU;AACpC,UAAM,SAAS,KAAK,UAAU;AAAA,MAC5B,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AAED,UAAM,YAAY,OAAO,YAAY;AACnC,gBAAU,IAAI,UAAU;AAAA,QACtB,gBAAgB;AAAA,QAChB,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,MAAM,SAAS,WAAW,WAAW,GAAG,MAAM;AAAA,QAC9C;AAAA,MACF;AACA,UAAI,CAAC,KAAK,MAAM,GAAG;AACjB,eAAO,GAAG,KAAK,MAAM,CAAC,mBAAmB,oBAAoB,sBAAsB,OAAO;AAAA,MAC5F;AACA,YAAM,UAAU;AAChB,YAAM,UACJ,uBAAuB,OAAO,IAAI,KACjC,MAAM,cAAc,CAAC,sBAAsB,YAAY;AAC1D,UAAI,QAAS,QAAO;AACpB,YAAM,WAAW,YAAY,OAAO,IAAI;AACxC,aAAO,aAAa,UAAa,aAAa,UAC1C,OACA,+BAA+B,QAAQ,0BAA0B,OAAO;AAAA,IAC9E,CAAC;AAED,UAAM,EAAE,QAAQ,IAAI;AACpB,QAAI,YAAY,MAAM;AACpB,WAAK,CAAC,aAAa,GAAG,mCAAmC;AAAA,IAC3D,OAAO;AACL,YAAM,YAAY,eAAe,YAAY;AAE3C,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA,MAAM,SAAS,WAAW,WAAW,GAAG,MAAM;AAAA,UAC9C;AAAA,QACF;AACA,YAAI,CAAC,OAAO,YAAY,OAAO,WAAW,QAAQ,QAAQ;AACxD,iBAAO,cAAc,KAAK,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC;AAAA,QAC/D;AACA,cAAM,QAAQ,MAAM,cAAc,GAAG,YAAY;AACjD,YAAI,MAAO,QAAO,GAAG,KAAK;AAC1B,cAAM,MAAM,YAAY,QAAQ,IAAI;AACpC,cAAM,QAAQ,YAAY,OAAO,IAAI;AACrC,eAAO,QAAQ,UAAa,UAAU,UAAa,QAAQ,QACvD,OACA,+BAA+B,KAAK,eAAe,GAAG;AAAA,MAC5D,CAAC;AAAA,IACH;AAEA,UAAM,YAAY,SAAS,YAAY;AACrC,YAAM,aAAa,SAAS,UAAU;AACtC,YAAM,SAAS,UAAU;AACzB,gBAAU,IAAI,YAAY;AAAA,QACxB,gBAAgB;AAAA,QAChB,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,UACE,MAAM;AAAA,UACN;AAAA,UACA,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,eAAe;AAAA,UACf,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,QACA;AAAA,MACF;AACA,UAAI,KAAK,MAAM,GAAG;AAEhB,cAAM,SAAS,UAAU;AACzB,eAAO,GAAG,KAAK,MAAM,CAAC,6BAA6B,MAAM,sBAAsB,OAAO;AAAA,MACxF;AACA,UAAI,CAAC,OAAO,YAAY,OAAO,WAAW,KAAK;AAG7C,YAAI,OAAO,YAAY,OAAO,SAAS;AACrC,oBAAU,OAAO,UAAU;AAC7B,eAAO,GAAG,KAAK,MAAM,CAAC,mBAAmB,MAAM,sBAAsB,OAAO;AAAA,MAC9E;AAEA,gBAAU,OAAO,UAAU;AAC3B,YAAM,QAAQ,MAAM,cAAc,GAAG,qBAAqB;AAC1D,UAAI,MAAO,QAAO;AAElB,YAAM,UAAU,YAAY,OAAO,IAAI;AACvC,aAAO,YAAY,UAAa,YAAY,UACxC,OACA,4BAA4B,OAAO,0BAA0B,OAAO;AAAA,IAC1E,CAAC;AAGD,UAAM,SAAS,SAAS,qBAAqB;AAC7C,QAAI,gBAAgB;AACpB,UAAM,YAAY,kBAAkB,YAAY;AAC9C,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,UACE,MAAM;AAAA,UACN;AAAA,UACA,YAAY,SAAS,UAAU;AAAA,UAC/B,gBAAgB;AAAA,UAChB,eAAe;AAAA,UACf,UAAU;AAAA,UACV,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,KAAK,MAAM,GAAG;AACjB,eAAO,GAAG,KAAK,MAAM,CAAC;AAAA,MACxB;AACA,sBAAgB;AAChB,YAAM,UAAU,uBAAuB,OAAO,IAAI;AAClD,UAAI,QAAS,QAAO;AACpB,YAAM,QAAQ,MAAM,cAAc,GAAG,cAAc;AACnD,aAAO,SAAS,GAAG,KAAK;AAAA,IAC1B,CAAC;AAED,QAAI,CAAC,eAAe;AAClB,WAAK,CAAC,WAAW,GAAG,oDAAoD;AAAA,IAC1E,OAAO;AAGL,YAAM,YAAY,aAAa,YAAY;AACzC,kBAAU,IAAI,QAAQ;AAAA,UACpB,gBAAgB;AAAA,UAChB,eAAe;AAAA,QACjB,CAAC;AACD,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,YACE,MAAM;AAAA,YACN;AAAA,YACA,UAAU;AAAA,YACV,gBAAgB;AAAA,YAChB,eAAe;AAAA,YACf,QAAQ;AAAA,YACR,aAAa;AAAA,UACf;AAAA,UACA;AAAA,QACF;AACA,cAAM,QAAQ,MAAM,cAAc,GAAG,iBAAiB;AACtD,YAAI,OAAO;AACT,iBAAO,GAAG,KAAK;AAAA,QACjB;AACA,kBAAU,OAAO,MAAM;AAEvB,eAAO,KAAK,MAAM,IACd,GAAG,KAAK,MAAM,CAAC,qCACf;AAAA,MACN,CAAC;AAAA,IACH;AAGA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B,MAAM;AAAA,MACN;AAAA,MACA,YAAY,SAAS,UAAU;AAAA,MAC/B,gBAAgB;AAAA,MAChB,eAAe;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,YAAY,MAAM;AACpB,WAAK,CAAC,UAAU,eAAe,GAAG,mCAAmC;AAAA,IACvE,OAAO;AACL,YAAM,YAAY,UAAU,YAAY;AACtC,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA,MAAM,SAAS,WAAW,WAAW,GAAG,QAAQ;AAAA,UAChD;AAAA,QACF;AACA,YAAI,CAAC,KAAK,MAAM,EAAG,QAAO,GAAG,KAAK,MAAM,CAAC;AACzC,cAAM,WAAW;AACjB,kBAAU,IAAI,UAAU;AAAA,UACtB,gBAAgB,uBAAuB;AAAA,UACvC,eAAe,uBAAuB;AAAA,QACxC,CAAC;AACD,eACE,uBAAuB,OAAO,IAAI,KACjC,MAAM,cAAc,GAAG,wBAAwB;AAAA,MAEpD,CAAC;AACD,UAAI,CAAC,MAAM,UAAU;AACnB,aAAK,CAAC,eAAe,GAAG,+BAA+B;AAAA,MACzD,OAAO;AACL,cAAM,YAAY,iBAAiB,YAAY;AAC7C,gBAAM,SAAS,MAAM;AAAA,YACnB;AAAA,YACA,MAAM,SAAS,WAAW,WAAW,GAAG,QAAQ;AAAA,YAChD;AAAA,UACF;AACA,cAAI,CAAC,KAAK,MAAM,EAAG,QAAO,cAAc,KAAK,MAAM,CAAC;AACpD,gBAAM,QAAQ,MAAM,cAAc,GAAG,YAAY;AACjD,iBAAO,SAAS,GAAG,KAAK;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,UAAE;AACA,eAAW,MAAM,CAAC,GAAG,UAAU,KAAK,CAAC,EAAG,OAAM,SAAS,EAAE;AAAA,EAC3D;AACA,QAAM,MAAM,MAAM,YAAY;AAC9B,MAAI,aAAa,KAAK;AACpB,UAAM,KAAK,oCAAoC,IAAI,OAAO,GAAG;AAAA,EAC/D,WAAW,IAAI,YAAY,OAAO;AAChC,UAAM;AAAA,MACJ,SAAS,MAAM,sBAAsB,IAAI,OAAO,YAAY,KAAK;AAAA,IACnE;AAAA,EACF;AAEA,QAAM,KAAK,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,MAAM;AAC7D,SAAO,EAAE,IAAI,SAAS,MAAM;AAC9B;;;ADl2BO,IAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2DAOsC,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoB/E,IAAM,QAA+C;AAAA,EACnD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AACR;AAGA,eAAsB,OAAO,MAAgB,IAA4B;AACvE,QAAM,aAAa,CAAC,YAAoB;AACtC,OAAG,MAAM,GAAG,OAAO;AAAA;AAAA,EAAO,KAAK,EAAE;AACjC,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,UAAU;AAAA,MACjB;AAAA,MACA,kBAAkB;AAAA,MAClB,SAAS;AAAA,QACP,KAAK,EAAE,MAAM,SAAS;AAAA,QACtB,MAAM,EAAE,MAAM,SAAS;AAAA,QACvB,eAAe,EAAE,MAAM,SAAS;AAAA,QAChC,cAAc,EAAE,MAAM,SAAS;AAAA,QAC/B,MAAM,EAAE,MAAM,UAAU;AAAA,QACxB,MAAM,EAAE,MAAM,WAAW,OAAO,IAAI;AAAA,MACtC;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,EAC1E;AACA,QAAM,EAAE,QAAQ,YAAY,IAAI;AAChC,MAAI,OAAO,MAAM;AACf,OAAG,IAAI,KAAK;AACZ,WAAO;AAAA,EACT;AACA,MAAI,YAAY,WAAW,KAAK,YAAY,CAAC,MAAM,SAAS;AAC1D,WAAO;AAAA,MACL,YAAY,WAAW,IACnB,gCACA,oBAAoB,YAAY,KAAK,GAAG,CAAC;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAClC,MAAI;AACJ,MAAI;AACF,eAAW,IAAI,IAAI,GAAG;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,MACL,QAAQ,KAAK,uBAAuB,sBAAsB,GAAG;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,SAAS,aAAa,YAAY,SAAS,aAAa,SAAS;AACnE,WAAO,WAAW,qCAAqC;AAAA,EACzD;AAEA,MAAI;AACJ,MAAI,OAAO,aAAa,MAAM,QAAW;AACvC,UAAM,QAAQ,OAAO,aAAa,EAAE,KAAK;AACzC,QAAIC,UAAqB;AACzB,QAAI;AACF,MAAAA,UAAS,IAAI,IAAI,KAAK;AAAA,IACxB,QAAQ;AAAA,IAER;AACA,QAAIA,SAAQ,aAAa,YAAYA,SAAQ,aAAa,SAAS;AACjE,aAAO,WAAW,+CAA+C,KAAK,EAAE;AAAA,IAC1E;AACA,iBAAaA,QAAO;AAAA,EACtB;AAEA,QAAM,SAAS,OAAO,QAAQ;AAC9B,MAAI,OAAO,SAAS,KAAK,OAAO,SAAS,KAAK;AAC5C,WAAO,WAAW,uDAAuD;AAAA,EAC3E;AAEA,QAAM,aACJ,OAAO,YAAY,KACnB,GAAG,IAAI,qBACP,IACA,KAAK;AACP,MAAI,cAAc,IAAI;AACpB,WAAO,WAAW,6CAA6C;AAAA,EACjE;AACA,MAAI,UAAU,WAAW,KAAK,GAAG;AAC/B,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,UAAU,KAAK,CAAC,OAAO,MAAM;AACpD,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAEA,KAAG,IAAI,YAAY,SAAS,IAAI,aAAa,MAAM;AAAA,CAAK;AACxD,QAAM,SAAS,MAAM,cAAc;AAAA,IACjC,KAAK,SAAS;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,GAAG;AAAA,IACV,UAAU,CAAC,WAAW;AACpB,SAAG,IAAI,GAAG,MAAM,OAAO,MAAM,CAAC,KAAK,OAAO,IAAI,EAAE;AAChD,UAAI,OAAO,OAAQ,IAAG,IAAI,SAAS,OAAO,MAAM,EAAE;AAAA,IACpD;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,CAAC,WACb,OAAO,QAAQ,OAAO,CAAC,WAAW,OAAO,WAAW,MAAM,EAAE;AAC9D,QAAM,UAAU,MAAM,MAAM;AAC5B,KAAG;AAAA,IACD;AAAA,EAAK,MAAM,MAAM,CAAC,YAAY,MAAM,MAAM,CAAC,UAAU,UAAU,KAAK,OAAO,aAAa,EAAE;AAAA,EAC5F;AACA,aAAW,QAAQ,OAAO,MAAO,IAAG,IAAI,SAAS,IAAI,EAAE;AACvD,SAAO,OAAO,KAAK,IAAI;AACzB;;;AEtJA,KAAK,OAAO,QAAQ,KAAK,MAAM,CAAC,GAAG;AAAA,EACjC,KAAK,CAAC,SAAS,QAAQ,IAAI,IAAI;AAAA,EAC/B,OAAO,CAAC,SAAS,QAAQ,MAAM,IAAI;AAAA,EACnC,KAAK,QAAQ;AACf,CAAC,EAAE;AAAA,EACD,CAAC,SAAS;AACR,YAAQ,WAAW;AAAA,EACrB;AAAA,EACA,CAAC,UAAmB;AAClB,YAAQ;AAAA,MACN,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC9E;AACA,YAAQ,WAAW;AAAA,EACrB;AACF;","names":["sessionUrl","parsed"]}
1
+ {"version":3,"sources":["../src/cli.ts","../src/check.ts","../src/bin.ts"],"sourcesContent":["// The package's command line: `npx @relume_io/partner-node check …`.\n// Kept apart from bin.ts so tests can run it without spawning a process.\n\nimport { parseArgs } from 'node:util';\n\nimport {\n CHECK_CHARGE_CREDITS,\n checkEndpoint,\n type CheckResult,\n} from './check.ts';\n\nexport const USAGE = `Usage: RELUME_SECRET_KEY=sk_test_… npx @relume_io/partner-node check --url <endpoint> --user <userId>\n\nChecks your partner endpoint against the Relume partner protocol: signatures,\nuser.get, credits.get, and the idempotency and decline rules for charges and\nreversals. It also checks that another site can't read your session route.\n\n --url The endpoint Relume calls, e.g. https://partner.example/relume/calls\n --user A user your wallet knows, with at least ${CHECK_CHARGE_CREDITS} credits. The check\n charges that user and gives every credit back.\n --session-url The session route your page's embed calls. Defaults to\n /session next to a --url ending in /calls.\n --session-header\n A header for every request to the session route, as\n \"Name: value\". Repeatable. Pass a test user's cookie when a\n login answers that route before the SDK does. Prefer\n $RELUME_SESSION_HEADERS, one header a line: a cookie is a\n credential too.\n --secret-key Your test secret key. Prefer $RELUME_SECRET_KEY, the default:\n a key on the command line lands in your shell history, CI\n logs and the process list.\n --live Allow an sk_live_ key. The check then charges a real wallet.\n -h, --help Show this help.\n\nExits 0 when every check passes, 1 when any fails or can't run, and 2 for\nbad arguments.`;\n\n/** An HTTP header name (RFC 9110 token). */\nconst HEADER_NAME = /^[!#$%&'*+.^`|~\\w-]+$/;\n/** A value fetch can send (RFC 9110 field-value). */\nconst HEADER_VALUE = /^[\\t\\x20-\\x7e\\x80-\\xff]*$/;\n/** The headers the session checks vary, which --session-header can't fix. */\nconst PROBE_HEADERS =\n /^(relume-embed|origin|sec-fetch-.*|access-control-request-.*)$/i;\n\nexport interface CliIo {\n log: (line: string) => void;\n error: (line: string) => void;\n env: Record<string, string | undefined>;\n fetch?: typeof fetch;\n}\n\nconst LABEL: Record<CheckResult['status'], string> = {\n pass: 'PASS',\n fail: 'FAIL',\n skip: 'SKIP',\n};\n\n/** Runs the command line and returns the exit code. */\nexport async function runCli(args: string[], io: CliIo): Promise<number> {\n const usageError = (message: string) => {\n io.error(`${message}\\n\\n${USAGE}`);\n return 2;\n };\n\n let parsed;\n try {\n parsed = parseArgs({\n args,\n allowPositionals: true,\n options: {\n url: { type: 'string' },\n user: { type: 'string' },\n 'session-url': { type: 'string' },\n 'session-header': { type: 'string', multiple: true },\n 'secret-key': { type: 'string' },\n live: { type: 'boolean' },\n help: { type: 'boolean', short: 'h' },\n },\n });\n } catch (error) {\n return usageError(error instanceof Error ? error.message : String(error));\n }\n const { values, positionals } = parsed;\n if (values.help) {\n io.log(USAGE);\n return 0;\n }\n if (positionals.length !== 1 || positionals[0] !== 'check') {\n return usageError(\n positionals.length === 0\n ? 'Missing the command: check.'\n : `Unknown command: ${positionals.join(' ')}.`,\n );\n }\n\n const url = values.url?.trim() ?? '';\n let endpoint: URL;\n try {\n endpoint = new URL(url);\n } catch {\n return usageError(\n url === '' ? '--url is required.' : `--url isn't a URL: ${url}`,\n );\n }\n if (endpoint.protocol !== 'https:' && endpoint.protocol !== 'http:') {\n return usageError('--url must be an http or https URL.');\n }\n\n let sessionUrl: string | undefined;\n if (values['session-url'] !== undefined) {\n const value = values['session-url'].trim();\n let parsed: URL | null = null;\n try {\n parsed = new URL(value);\n } catch {\n // Refused below.\n }\n if (parsed?.protocol !== 'https:' && parsed?.protocol !== 'http:') {\n return usageError(`--session-url must be an http or https URL: ${value}`);\n }\n sessionUrl = parsed.href;\n }\n\n // Errors name the header but never echo its value, a cookie, say.\n const headerLines =\n values['session-header'] ??\n (io.env.RELUME_SESSION_HEADERS ?? '')\n .split('\\n')\n .filter((line) => line.trim() !== '');\n let sessionHeaders: Record<string, string> | undefined;\n for (const header of headerLines) {\n const colon = header.indexOf(':');\n const name = header.slice(0, colon).trim();\n const value = header.slice(colon + 1).trim();\n if (colon < 0 || !HEADER_NAME.test(name)) {\n return usageError('Each session header must be \"Name: value\".');\n }\n if (!HEADER_VALUE.test(value)) {\n return usageError(\n `The ${name} session header's value has characters a header can't carry.`,\n );\n }\n if (PROBE_HEADERS.test(name)) {\n return usageError(\n `A session header can't set ${name}: the check sets it to test the route.`,\n );\n }\n sessionHeaders = { ...sessionHeaders, [name]: value };\n }\n\n const userId = values.user ?? '';\n if (userId.length < 1 || userId.length > 128) {\n return usageError('--user is required: a user id of 1 to 128 characters.');\n }\n\n const secretKey = (\n values['secret-key'] ??\n io.env.RELUME_SECRET_KEY ??\n ''\n ).trim();\n if (secretKey === '') {\n return usageError('Pass --secret-key or set RELUME_SECRET_KEY.');\n }\n if (secretKey.startsWith('pk_')) {\n return usageError(\n 'That is a publishable key. Pass the secret key (sk_test_…).',\n );\n }\n if (secretKey.startsWith('sk_live_') && !values.live) {\n return usageError(\n 'That is a live key, and the check charges the user. Use your test key, or pass --live to run it against a live wallet.',\n );\n }\n\n io.log(`Checking ${endpoint.href} as user \"${userId}\"\\n`);\n const report = await checkEndpoint({\n url: endpoint.href,\n secretKey,\n userId,\n sessionUrl,\n sessionHeaders,\n fetch: io.fetch,\n onResult: (result) => {\n io.log(`${LABEL[result.status]} ${result.name}`);\n if (result.detail) io.log(` ${result.detail}`);\n },\n });\n\n const count = (status: CheckResult['status']) =>\n report.results.filter((result) => result.status === status).length;\n const skipped = count('skip');\n io.log(\n `\\n${count('pass')} passed, ${count('fail')} failed${skipped ? `, ${skipped} skipped` : ''}`,\n );\n for (const note of report.notes) io.log(`NOTE ${note}`);\n return report.ok ? 0 : 1;\n}\n","// The conformance checker behind `npx @relume_io/partner-node check`.\n// It calls a partner endpoint the way Relume does (docs/partner-protocol/v1.md\n// sections 5 and 6) and reports which rules of the contract it keeps, most of\n// all the two that protect real users: a repeated chargeId debits once, and a\n// reversal of a charge that was never debited changes nothing.\n//\n// It needs the endpoint URL, the secret key and a user whose wallet holds at\n// least CHECK_CHARGE_CREDITS. It charges that user and gives every credit\n// back, so run it against a test user on your test endpoint.\n//\n// It also asks the session route (section 4) for a session the way another\n// site's page would, fails a CORS setup that would let that page read it,\n// and checks the route refuses a request from another site or without the\n// embed's header.\n\nimport {\n absent,\n isEmail,\n isHttpsUrl,\n isRecord,\n isString,\n isWhole,\n} from './guards.ts';\nimport { EMBED_HEADER, EMBED_HEADER_VALUE } from './session.ts';\nimport { REQUEST_ID_HEADER, SIGNATURE_HEADER, signCall } from './signing.ts';\n\nexport interface CheckOptions {\n /** The endpoint Relume calls, e.g. `https://partner.example/relume/calls`. */\n url: string;\n secretKey: string;\n /** A user your wallet knows, with at least CHECK_CHARGE_CREDITS. */\n userId: string;\n /**\n * The session route the embed calls. Defaults to `session` next to a\n * `url` ending in `/calls`, where `@relume_io/partner-node` mounts it.\n */\n sessionUrl?: string;\n /**\n * Headers sent on every request to the session route, for a login in front\n * of it: a test user's cookie, say. Without them the refusal checks can only\n * see that login's 401.\n */\n sessionHeaders?: Record<string, string>;\n fetch?: typeof fetch;\n /** The clock, in milliseconds. For tests. */\n now?: () => number;\n /** Called as each check finishes, so the CLI can print as it goes. */\n onResult?: (result: CheckResult) => void;\n}\n\n/** A request the checker makes to the session route. */\ninterface SessionProbe {\n method: 'GET' | 'OPTIONS';\n headers: Record<string, string>;\n}\n\nexport type CheckStatus = 'pass' | 'fail' | 'skip';\n\nexport interface CheckResult {\n name: string;\n status: CheckStatus;\n /** Why it failed or didn't run. */\n detail?: string;\n}\n\nexport interface CheckReport {\n /** True when every check ran and passed. A skipped check is not a pass. */\n ok: boolean;\n results: CheckResult[];\n /** What the run left behind, e.g. a balance its reversals didn't restore. */\n notes: string[];\n}\n\n/**\n * What the checker charges. Two, so a reversal of one credit leaves one to\n * show whether a repeated reversalId credits again.\n */\nexport const CHECK_CHARGE_CREDITS = 2;\n\n// Relume's own timeouts (protocol section 5): an endpoint slower than these\n// fails for real users too.\nconst READ_TIMEOUT_MS = 4_000;\nconst CHARGE_TIMEOUT_MS = 4_000;\nconst REVERSE_TIMEOUT_MS = 10_000;\n\n/** Further than the 300 seconds a verifier allows, either way. */\nconst SKEW_SECONDS = 600;\n\n/** The page the session route is asked from. */\nexport const FOREIGN_ORIGIN = 'https://evil.example';\n\nconst SESSION_CORS = \"doesn't let another site read the session route\";\nconst SESSION_HEADER =\n 'refuses a session request without the Relume-Embed header';\nconst SESSION_CROSS_SITE = 'refuses a session request from another site';\nconst SESSION_CHECKS = [SESSION_CORS, SESSION_HEADER, SESSION_CROSS_SITE];\n\nconst ACCEPT = 'accepts a correctly signed call';\nconst ROTATION = 'accepts a key rotation header, with your key second';\nconst OTHER_KEY = 'rejects a signature made with another key';\nconst TAMPERED = 'rejects a body changed after signing';\nconst STALE = 'rejects a timestamp more than 5 minutes old';\nconst FUTURE = 'rejects a timestamp more than 5 minutes ahead';\nconst UNSIGNED = 'rejects a call with no signature';\nconst USER_GET = 'answers user.get with a valid profile';\nconst UNKNOWN_USER = \"answers user.get 404 for a user it doesn't know\";\nconst CREDITS_GET = 'answers credits.get with a valid balance';\nconst DEBIT = 'debits a charge';\nconst REPEAT_CHARGE = 'debits only once when the same charge is sent twice';\nconst DECLINE = \"answers 402 to a charge the user can't afford\";\nconst UNKNOWN_REVERSAL = 'changes nothing when an unknown charge is reversed';\nconst LATE_CHARGE = 'refuses a charge that arrives after its reversal';\nconst REVERSAL = 'credits back a reversal';\nconst REPEAT_REVERSAL = 'credits a repeated reversalId only once';\nconst WALLET = [\n DEBIT,\n REPEAT_CHARGE,\n DECLINE,\n UNKNOWN_REVERSAL,\n LATE_CHARGE,\n REVERSAL,\n REPEAT_REVERSAL,\n];\n\nconst MALFORMED = Symbol('malformed');\n\ntype Body = Record<string, unknown> | typeof MALFORMED;\n\ninterface Responded {\n answered: true;\n status: number;\n /** A 2xx. */\n ok: boolean;\n body: Body;\n}\n\ntype Answer = Responded | { answered: false; reason: string };\n\ntype Ok = Responded & { ok: true };\n\nfunction isOk(answer: Answer): answer is Ok {\n return answer.answered && answer.ok;\n}\n\n/** An empty body counts as `{}`; anything but a JSON object is malformed. */\nfunction parseBody(text: string): Body {\n if (text.trim() === '') return {};\n try {\n const value: unknown = JSON.parse(text);\n return isRecord(value) ? value : MALFORMED;\n } catch {\n return MALFORMED;\n }\n}\n\n/** `answered 500 (internal_error)`, `timed out after 4s`, … */\nfunction said(answer: Answer): string {\n if (!answer.answered) return answer.reason;\n const error =\n answer.body !== MALFORMED && isRecord(answer.body.error)\n ? answer.body.error.code\n : undefined;\n return typeof error === 'string'\n ? `answered ${answer.status} (${error})`\n : `answered ${answer.status}`;\n}\n\n/** The problem with a user.get body, or null when Relume would store it. */\nfunction profileProblem(body: Body): string | null {\n if (body === MALFORMED) return \"the body isn't a JSON object\";\n const { name, email, avatarUrl } = body;\n if (!absent(name) && !isString(name, 1, 200)) {\n return 'name must be a string of at most 200 characters';\n }\n if (!absent(email) && !isEmail(email)) {\n return 'email must be a valid email address';\n }\n if (!absent(avatarUrl) && !isHttpsUrl(avatarUrl)) {\n return 'avatarUrl must be an https URL';\n }\n return null;\n}\n\n/**\n * The problem with a 2xx charge or reversal body, or null. `balance` is\n * optional, but null isn't \"left out\": Relume reads it as a malformed\n * answer, which turns a charge into an unknown one.\n */\nfunction optionalBalanceProblem(body: Body): string | null {\n if (body === MALFORMED) return \"the body isn't a JSON object\";\n if (body.balance === undefined || isWhole(body.balance, 0)) return null;\n return `balance was ${JSON.stringify(body.balance)}; leave it out or send a whole number, zero or more`;\n}\n\nfunction bodyBalance(body: Body): number | undefined {\n return body !== MALFORMED && isWhole(body.balance, 0)\n ? body.balance\n : undefined;\n}\n\n/** The session route beside a calls route the SDK mounted, or null. */\nexport function sessionUrlFor(callsUrl: string): string | null {\n const url = new URL(callsUrl);\n if (!/\\/calls\\/?$/.test(url.pathname)) return null;\n url.pathname = url.pathname.replace(/calls\\/?$/, 'session');\n url.search = '';\n return url.href;\n}\n\nfunction randomId(prefix: string): string {\n return `${prefix}_${crypto.randomUUID().replaceAll('-', '')}`;\n}\n\nfunction networkReason(error: unknown): string {\n const cause = error instanceof Error ? error.cause : undefined;\n const code = isRecord(cause) ? cause.code : undefined;\n return typeof code === 'string'\n ? `couldn't connect (${code})`\n : `couldn't connect (${error instanceof Error ? error.message : String(error)})`;\n}\n\nexport async function checkEndpoint(\n options: CheckOptions,\n): Promise<CheckReport> {\n const { url, secretKey, userId } = options;\n const fetchImpl = options.fetch ?? ((...args) => fetch(...args));\n const now = options.now ?? Date.now;\n const nowSeconds = () => Math.floor(now() / 1000);\n const results: CheckResult[] = [];\n const notes: string[] = [];\n\n function record(result: CheckResult): void {\n results.push(result);\n options.onResult?.(result);\n }\n\n /** Runs one check: it returns why it failed, or null for a pass. */\n async function run(\n name: string,\n check: () => Promise<string | null>,\n ): Promise<boolean> {\n let failure: string | null;\n try {\n failure = await check();\n } catch (error) {\n failure = `the checker failed: ${error instanceof Error ? error.message : String(error)}`;\n }\n record(\n failure === null\n ? { name, status: 'pass' }\n : { name, status: 'fail', detail: failure },\n );\n return failure === null;\n }\n\n function skip(names: readonly string[], detail: string): void {\n for (const name of names) record({ name, status: 'skip', detail });\n }\n\n async function post(\n rawBody: string,\n header: string | null,\n timeoutMs: number,\n ): Promise<Answer> {\n const headers: Record<string, string> = {\n 'Content-Type': 'application/json',\n [REQUEST_ID_HEADER]: randomId('check'),\n };\n if (header !== null) headers[SIGNATURE_HEADER] = header;\n try {\n // Relume never follows redirects, so neither does the checker.\n const response = await fetchImpl(url, {\n method: 'POST',\n headers,\n body: rawBody,\n redirect: 'manual',\n signal: AbortSignal.timeout(timeoutMs),\n });\n const text = await response.text();\n if (response.status >= 300 && response.status < 400) {\n return {\n answered: false,\n reason: `redirected with ${response.status} (Relume never follows redirects)`,\n };\n }\n return {\n answered: true,\n status: response.status,\n ok: response.status >= 200 && response.status < 300,\n body: parseBody(text),\n };\n } catch (error) {\n return {\n answered: false,\n reason:\n error instanceof Error && error.name === 'TimeoutError'\n ? `timed out after ${timeoutMs / 1000}s`\n : networkReason(error),\n };\n }\n }\n\n async function signed(\n body: Record<string, unknown>,\n timeoutMs: number,\n ): Promise<Answer> {\n const rawBody = JSON.stringify(body);\n return post(\n rawBody,\n await signCall(secretKey, nowSeconds(), rawBody),\n timeoutMs,\n );\n }\n\n /** The balance from credits.get, or why it couldn't be read. */\n async function readBalance(): Promise<\n { balance: number } | { failure: string }\n > {\n const answer = await signed(\n { type: 'credits.get', userId },\n READ_TIMEOUT_MS,\n );\n if (!isOk(answer)) {\n return { failure: `credits.get ${said(answer)}; expected 200` };\n }\n if (answer.body === MALFORMED) {\n return {\n failure: `credits.get answered ${answer.status} with a body that isn't a JSON object`,\n };\n }\n if (!isWhole(answer.body.balance, 0)) {\n return {\n failure: `credits.get answered balance ${JSON.stringify(answer.body.balance)}; expected a whole number, zero or more`,\n };\n }\n return { balance: answer.body.balance };\n }\n\n /** One request to the session route, and the origin its CORS grants. */\n async function askSession(\n sessionUrl: string,\n init: SessionProbe,\n ): Promise<{ answer: Answer; allowOrigin: string | null }> {\n try {\n const response = await fetchImpl(sessionUrl, {\n ...init,\n headers: { ...options.sessionHeaders, ...init.headers },\n redirect: 'manual',\n signal: AbortSignal.timeout(READ_TIMEOUT_MS),\n });\n const text = await response.text();\n return {\n answer: {\n answered: true,\n status: response.status,\n ok: response.status >= 200 && response.status < 300,\n body: parseBody(text),\n },\n allowOrigin:\n response.headers.get('access-control-allow-origin')?.trim() ?? null,\n };\n } catch (error) {\n const reason =\n error instanceof Error && error.name === 'TimeoutError'\n ? `timed out after ${READ_TIMEOUT_MS / 1000}s`\n : networkReason(error);\n return { answer: { answered: false, reason }, allowOrigin: null };\n }\n }\n\n // Whether the session route answered at all, for the checks after the\n // first. A holder object, as for `found` below.\n const session = { answered: false };\n\n /**\n * The problem with the session route's CORS, or null. It asks the way a\n * page on another site would: the preflight for the embed's header, then\n * the GET. A route that grants that page's origin lets it read what the\n * route answers for a signed-in user, a client secret included.\n */\n async function sessionCorsProblem(\n sessionUrl: string,\n ): Promise<string | null> {\n const probes: [what: string, init: SessionProbe][] = [\n [\n 'the preflight',\n {\n method: 'OPTIONS',\n headers: {\n Origin: FOREIGN_ORIGIN,\n 'Access-Control-Request-Method': 'GET',\n 'Access-Control-Request-Headers': EMBED_HEADER.toLowerCase(),\n },\n },\n ],\n [\n 'GET',\n {\n method: 'GET',\n headers: {\n Origin: FOREIGN_ORIGIN,\n [EMBED_HEADER]: EMBED_HEADER_VALUE,\n 'Sec-Fetch-Site': 'cross-site',\n 'Sec-Fetch-Mode': 'cors',\n },\n },\n ],\n ];\n // Both probes run even after a failure, so the GET says whether the\n // route is there for the checks after this one.\n let problem: string | null = null;\n for (const [what, init] of probes) {\n const { answer, allowOrigin } = await askSession(sessionUrl, init);\n if (!answer.answered) return `${what} to ${sessionUrl} ${answer.reason}`;\n if (allowOrigin === FOREIGN_ORIGIN) {\n problem ??= `${what} to ${sessionUrl} from ${FOREIGN_ORIGIN} answered Access-Control-Allow-Origin: ${FOREIGN_ORIGIN}, so a page on any site can read what this route answers for a signed-in user. Allow only your own page origins, never the request's Origin`;\n }\n if (init.method === 'GET') {\n session.answered = true;\n }\n }\n return problem;\n }\n\n /** Whether the session route is somewhere else: a 404 to the embed's request. */\n async function sessionRouteMissing(sessionUrl: string): Promise<boolean> {\n const { answer } = await askSession(sessionUrl, {\n method: 'GET',\n headers: { [EMBED_HEADER]: EMBED_HEADER_VALUE },\n });\n return answer.answered && answer.status === 404;\n }\n\n /** A session request the route must refuse with `status` and `code`. */\n async function sessionRefusalProblem(\n sessionUrl: string,\n headers: Record<string, string>,\n status: number,\n code: string,\n ): Promise<string | null> {\n const { answer } = await askSession(sessionUrl, {\n method: 'GET',\n headers,\n });\n if (answer.answered && answer.status === status) return null;\n if (answer.answered && answer.status === 401) {\n // The SDK refuses before it reads the user, so a 401 is a login in\n // front of the route, or a route that reads the user first.\n return options.sessionHeaders\n ? `${said(answer)} with the session headers: they didn't get past the login (an expired cookie?), or the route looked for a signed-in user first. Answer ${status} ${code} before reading the user`\n : `${said(answer)}: something asked for a signed-in user first. If that's a login in front of the route, pass --session-header with a test user's cookie so the check gets past it; otherwise answer ${status} ${code} before reading the user`;\n }\n return `${said(answer)}; expected ${status} ${code}`;\n }\n\n // The session route. It needs no key or user, so it runs whatever the\n // calls below find.\n const sessionUrl = options.sessionUrl ?? sessionUrlFor(url);\n const notFound = sessionUrl && (await sessionRouteMissing(sessionUrl));\n if (sessionUrl === null || notFound) {\n // Looked in the wrong place, which says nothing about the route.\n skip(\n SESSION_CHECKS,\n sessionUrl === null\n ? \"--url doesn't end in /calls; pass --session-url with the session route your page's embed calls\"\n : `GET ${sessionUrl} answered 404; pass --session-url with the session route your page's embed calls`,\n );\n } else {\n await run(SESSION_CORS, () => sessionCorsProblem(sessionUrl));\n if (!session.answered) {\n skip(SESSION_CHECKS.slice(1), 'needs the session route to answer');\n } else {\n await run(SESSION_HEADER, () =>\n sessionRefusalProblem(sessionUrl, {}, 400, 'embed_header_missing'),\n );\n await run(SESSION_CROSS_SITE, () =>\n sessionRefusalProblem(\n sessionUrl,\n {\n [EMBED_HEADER]: EMBED_HEADER_VALUE,\n 'Sec-Fetch-Site': 'cross-site',\n },\n 403,\n 'cross_site_request',\n ),\n );\n }\n }\n\n // What the checks find out for later ones. A holder object, because\n // TypeScript narrows a plain `let` assigned inside a callback to its\n // initial value.\n const found: {\n wrongKey: boolean;\n balance: number | null;\n charged: Ok | null;\n reversed: boolean;\n } = { wrongKey: false, balance: null, charged: null, reversed: false };\n\n // Signatures. Every probe is a credits.get, which changes nothing, so a\n // forged call that gets through does no harm here.\n const read = JSON.stringify({ type: 'credits.get', userId });\n // An unknown field, which the partner must ignore: only the signature\n // check can tell this body from the one that was signed.\n const tampered = JSON.stringify({\n type: 'credits.get',\n userId,\n note: 'changed after signing',\n });\n const otherKey = randomId('sk_test_relume_check');\n const t = nowSeconds();\n\n await run(ACCEPT, async () => {\n const answer = await post(\n read,\n await signCall(secretKey, t, read),\n READ_TIMEOUT_MS,\n );\n if (isOk(answer)) return null;\n if (answer.answered && answer.status === 401) {\n found.wrongKey = true;\n return `${said(answer)} to a signed credits.get: is --secret-key the key this endpoint verifies with?`;\n }\n return `${said(answer)} to a signed credits.get; expected 200`;\n });\n // Every other check would fail the same way, or pass for the wrong reason.\n if (found.wrongKey) {\n skip(\n [\n ROTATION,\n OTHER_KEY,\n TAMPERED,\n STALE,\n FUTURE,\n UNSIGNED,\n USER_GET,\n UNKNOWN_USER,\n CREDITS_GET,\n ...WALLET,\n ],\n 'needs the endpoint to accept a correctly signed call',\n );\n return { ok: false, results, notes };\n }\n\n await run(ROTATION, async () => {\n const answer = await post(\n read,\n await signCall([otherKey, secretKey], t, read),\n READ_TIMEOUT_MS,\n );\n return isOk(answer)\n ? null\n : `${said(answer)}; accept a call when any v1= value matches your key`;\n });\n\n const forgeries: [name: string, rawBody: string, header: string | null][] = [\n [OTHER_KEY, read, await signCall(otherKey, t, read)],\n [TAMPERED, tampered, await signCall(secretKey, t, read)],\n [STALE, read, await signCall(secretKey, t - SKEW_SECONDS, read)],\n [FUTURE, read, await signCall(secretKey, t + SKEW_SECONDS, read)],\n [UNSIGNED, read, null],\n ];\n for (const [name, rawBody, header] of forgeries) {\n await run(name, async () => {\n const answer = await post(rawBody, header, READ_TIMEOUT_MS);\n if (answer.answered && answer.status === 401) return null;\n if (isOk(answer)) {\n return `${said(answer)}: it acted on a call Relume didn't sign; answer 401 invalid_signature`;\n }\n return `${said(answer)}; expected 401 invalid_signature`;\n });\n }\n\n // The reads.\n await run(USER_GET, async () => {\n const answer = await signed({ type: 'user.get', userId }, READ_TIMEOUT_MS);\n if (answer.answered && answer.status === 404) {\n return `answered 404: it doesn't know user \"${userId}\". Pass a --user your wallet knows`;\n }\n if (!isOk(answer)) {\n return `${said(answer)}; expected 200 { name?, email?, avatarUrl? }`;\n }\n return profileProblem(answer.body);\n });\n // A 404 is how Relume refuses a session for someone without a wallet; a\n // profile for any id would open one.\n await run(UNKNOWN_USER, async () => {\n const answer = await signed(\n { type: 'user.get', userId: randomId('u_check_unknown') },\n READ_TIMEOUT_MS,\n );\n return answer.answered && answer.status === 404\n ? null\n : `${said(answer)} for a user id your wallet has never seen; expected 404`;\n });\n\n await run(CREDITS_GET, async () => {\n const result = await readBalance();\n if ('failure' in result) return result.failure;\n found.balance = result.balance;\n return null;\n });\n\n // The wallet. Each check compares against the balance the one before it\n // read, so one broken rule doesn't fail every check after it.\n const start = found.balance;\n if (start === null) {\n skip(WALLET, 'needs a working credits.get');\n return { ok: false, results, notes };\n }\n if (start < CHECK_CHARGE_CREDITS) {\n skip(\n WALLET,\n `user \"${userId}\" has a balance of ${start}; top it up to at least ${CHECK_CHARGE_CREDITS} (the check gives it back)`,\n );\n return { ok: false, results, notes };\n }\n\n let current = start;\n /** Charges the checker may have debited, and what's left of each to give back. */\n const toReverse = new Map<\n string,\n { partnerCredits: number; relumeCredits: number }\n >();\n\n /** Reads the balance and checks it moved by `delta`, or says how it didn't. */\n async function expectBalance(\n delta: number,\n what: string,\n ): Promise<string | null> {\n const result = await readBalance();\n if ('failure' in result) return result.failure;\n const before = current;\n current = result.balance;\n if (result.balance === before + delta) return null;\n return `${what} moved the balance from ${before} to ${result.balance}; expected ${before + delta}`;\n }\n\n /** Reverses a charge the checker made, the way Relume reverses one it can't finish. */\n async function giveBack(id: string): Promise<void> {\n const left = toReverse.get(id);\n if (left === undefined) return;\n toReverse.delete(id);\n const answer = await signed(\n {\n type: 'credits.reverse',\n userId,\n reversalId: randomId('rv_check'),\n ...left,\n chargeId: id,\n reason: 'work_failed',\n },\n REVERSE_TIMEOUT_MS,\n );\n if (!isOk(answer)) notes.push(`Giving back charge ${id} ${said(answer)}.`);\n }\n\n /**\n * Runs a wallet check, then re-reads the balance if it failed: a failure\n * can leave the balance anywhere, and the next check measures from here.\n */\n async function walletCheck(\n name: string,\n check: () => Promise<string | null>,\n ): Promise<void> {\n if (await run(name, check)) return;\n const result = await readBalance();\n if ('balance' in result) current = result.balance;\n }\n\n // The give-back runs whatever happens below, even if printing a result\n // throws (an EPIPE from `check | head`): the user must not be left short.\n try {\n const chargeId = randomId('ch_check');\n const charge = JSON.stringify({\n type: 'credits.charge',\n userId,\n chargeId,\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n action: 'chat.message',\n description: 'Relume conformance check (given back)',\n });\n\n await walletCheck(DEBIT, async () => {\n toReverse.set(chargeId, {\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n });\n const answer = await post(\n charge,\n await signCall(secretKey, nowSeconds(), charge),\n CHARGE_TIMEOUT_MS,\n );\n if (!isOk(answer)) {\n return `${said(answer)} to a charge of ${CHECK_CHARGE_CREDITS} from a balance of ${current}; expected 200`;\n }\n found.charged = answer;\n const problem =\n optionalBalanceProblem(answer.body) ??\n (await expectBalance(-CHECK_CHARGE_CREDITS, 'the charge'));\n if (problem) return problem;\n const reported = bodyBalance(answer.body);\n return reported === undefined || reported === current\n ? null\n : `the charge answered balance ${reported}, but credits.get says ${current}`;\n });\n\n const { charged } = found;\n if (charged === null) {\n skip([REPEAT_CHARGE], 'needs the first charge to succeed');\n } else {\n await walletCheck(REPEAT_CHARGE, async () => {\n // The same body, signed again: what an inline retry sends.\n const answer = await post(\n charge,\n await signCall(secretKey, nowSeconds(), charge),\n CHARGE_TIMEOUT_MS,\n );\n if (!answer.answered || answer.status !== charged.status) {\n return `the repeat ${said(answer)}, the first ${said(charged)}; answer a repeated chargeId with the first result`;\n }\n const moved = await expectBalance(0, 'the repeat');\n if (moved) return `${moved}: it debited the same chargeId twice`;\n const was = bodyBalance(charged.body);\n const again = bodyBalance(answer.body);\n return was === undefined || again === undefined || was === again\n ? null\n : `the repeat answered balance ${again}, the first ${was}; answer a repeated chargeId with the first result`;\n });\n }\n\n await walletCheck(DECLINE, async () => {\n const declinedId = randomId('ch_check');\n const amount = current + 1;\n toReverse.set(declinedId, {\n partnerCredits: amount,\n relumeCredits: CHECK_CHARGE_CREDITS,\n });\n const answer = await signed(\n {\n type: 'credits.charge',\n userId,\n chargeId: declinedId,\n partnerCredits: amount,\n relumeCredits: CHECK_CHARGE_CREDITS,\n action: 'chat.message',\n description: 'Relume conformance check (should be declined)',\n },\n CHARGE_TIMEOUT_MS,\n );\n if (isOk(answer)) {\n // Now, so the overdrawn balance doesn't fail the checks after this one.\n await giveBack(declinedId);\n return `${said(answer)}: it accepted a charge of ${amount} from a balance of ${current}; answer 402`;\n }\n if (!answer.answered || answer.status !== 402) {\n // A 4xx refused the charge, so there's nothing to give back. A 5xx or\n // a timeout may have debited first, so that stays queued.\n if (answer.answered && answer.status < 500)\n toReverse.delete(declinedId);\n return `${said(answer)} to a charge of ${amount} from a balance of ${current}; expected 402`;\n }\n // Relume never sends a reversal for a decline.\n toReverse.delete(declinedId);\n const moved = await expectBalance(0, 'the declined charge');\n if (moved) return moved;\n // A 402 body may be unreadable, but a balance it does give is shown.\n const said402 = bodyBalance(answer.body);\n return said402 === undefined || said402 === current\n ? null\n : `the 402 answered balance ${said402}, but credits.get says ${current}`;\n });\n\n // A charge Relume gave up on, reversed before the wallet saw it.\n const lateId = randomId('ch_check_never_sent');\n let reversedFirst = false;\n await walletCheck(UNKNOWN_REVERSAL, async () => {\n const answer = await signed(\n {\n type: 'credits.reverse',\n userId,\n reversalId: randomId('rv_check'),\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n chargeId: lateId,\n reason: 'charge_unknown',\n },\n REVERSE_TIMEOUT_MS,\n );\n if (!isOk(answer)) {\n return `${said(answer)}; expected 200, crediting nothing (Relume retries any other answer for 72 hours)`;\n }\n reversedFirst = true;\n const problem = optionalBalanceProblem(answer.body);\n if (problem) return problem;\n const moved = await expectBalance(0, 'the reversal');\n return moved && `${moved}: it credited a charge it never debited`;\n });\n\n if (!reversedFirst) {\n skip([LATE_CHARGE], 'needs the reversal of an unknown charge to succeed');\n } else {\n // The same charge, arriving late: an attempt from a wallet that\n // stalled and caught up after Relume gave up and reversed it.\n await walletCheck(LATE_CHARGE, async () => {\n toReverse.set(lateId, {\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n });\n const answer = await signed(\n {\n type: 'credits.charge',\n userId,\n chargeId: lateId,\n partnerCredits: CHECK_CHARGE_CREDITS,\n relumeCredits: CHECK_CHARGE_CREDITS,\n action: 'chat.message',\n description: 'Relume conformance check (should be refused)',\n },\n CHARGE_TIMEOUT_MS,\n );\n const moved = await expectBalance(0, 'the late charge');\n if (moved) {\n return `${moved}: it debited a charge it had already answered a reversal for; record a reversed chargeId as declined`;\n }\n toReverse.delete(lateId);\n // Relume stopped waiting for this charge, so any refusal will do.\n return isOk(answer)\n ? `${said(answer)}; expected 402, debiting nothing`\n : null;\n });\n }\n\n // Half of the first charge, so a repeat that credits again shows.\n const reversal = JSON.stringify({\n type: 'credits.reverse',\n userId,\n reversalId: randomId('rv_check'),\n partnerCredits: 1,\n relumeCredits: 1,\n chargeId,\n reason: 'work_failed',\n });\n if (charged === null) {\n skip([REVERSAL, REPEAT_REVERSAL], 'needs the first charge to succeed');\n } else {\n await walletCheck(REVERSAL, async () => {\n const answer = await post(\n reversal,\n await signCall(secretKey, nowSeconds(), reversal),\n REVERSE_TIMEOUT_MS,\n );\n if (!isOk(answer)) return `${said(answer)}; expected 200`;\n found.reversed = true;\n toReverse.set(chargeId, {\n partnerCredits: CHECK_CHARGE_CREDITS - 1,\n relumeCredits: CHECK_CHARGE_CREDITS - 1,\n });\n return (\n optionalBalanceProblem(answer.body) ??\n (await expectBalance(1, 'a reversal of 1 credit'))\n );\n });\n if (!found.reversed) {\n skip([REPEAT_REVERSAL], 'needs the reversal to succeed');\n } else {\n await walletCheck(REPEAT_REVERSAL, async () => {\n const answer = await post(\n reversal,\n await signCall(secretKey, nowSeconds(), reversal),\n REVERSE_TIMEOUT_MS,\n );\n if (!isOk(answer)) return `the repeat ${said(answer)}; expected 200`;\n const moved = await expectBalance(0, 'the repeat');\n return moved && `${moved}: it credited the same reversalId twice`;\n });\n }\n }\n } finally {\n for (const id of [...toReverse.keys()]) await giveBack(id);\n }\n const end = await readBalance();\n if ('failure' in end) {\n notes.push(`Couldn't read the final balance: ${end.failure}.`);\n } else if (end.balance !== start) {\n notes.push(\n `User \"${userId}\" has a balance of ${end.balance}; it was ${start} before the check. Correct it in your wallet.`,\n );\n }\n\n const ok = results.every((result) => result.status === 'pass');\n return { ok, results, notes };\n}\n","#!/usr/bin/env node\nimport { runCli } from './cli.ts';\n\n// No top-level await: the CommonJS build runs this file too.\nvoid runCli(process.argv.slice(2), {\n log: (line) => console.log(line),\n error: (line) => console.error(line),\n env: process.env,\n}).then(\n (code) => {\n process.exitCode = code;\n },\n (error: unknown) => {\n console.error(\n `The check stopped: ${error instanceof Error ? error.message : String(error)}`,\n );\n process.exitCode = 1;\n },\n);\n"],"mappings":";;;;;;;;;;;;;;;;AAGA,SAAS,iBAAiB;;;AC0EnB,IAAM,uBAAuB;AAIpC,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAG3B,IAAM,eAAe;AAGd,IAAM,iBAAiB;AAE9B,IAAM,eAAe;AACrB,IAAM,iBACJ;AACF,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB,CAAC,cAAc,gBAAgB,kBAAkB;AAExE,IAAM,SAAS;AACf,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,WAAW;AACjB,IAAM,QAAQ;AACd,IAAM,SAAS;AACf,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,eAAe;AACrB,IAAM,cAAc;AACpB,IAAM,QAAQ;AACd,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAChB,IAAM,mBAAmB;AACzB,IAAM,cAAc;AACpB,IAAM,WAAW;AACjB,IAAM,kBAAkB;AACxB,IAAM,SAAS;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,YAAY,OAAO,WAAW;AAgBpC,SAAS,KAAK,QAA8B;AAC1C,SAAO,OAAO,YAAY,OAAO;AACnC;AAGA,SAAS,UAAU,MAAoB;AACrC,MAAI,KAAK,KAAK,MAAM,GAAI,QAAO,CAAC;AAChC,MAAI;AACF,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,WAAO,SAAS,KAAK,IAAI,QAAQ;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,KAAK,QAAwB;AACpC,MAAI,CAAC,OAAO,SAAU,QAAO,OAAO;AACpC,QAAM,QACJ,OAAO,SAAS,aAAa,SAAS,OAAO,KAAK,KAAK,IACnD,OAAO,KAAK,MAAM,OAClB;AACN,SAAO,OAAO,UAAU,WACpB,YAAY,OAAO,MAAM,KAAK,KAAK,MACnC,YAAY,OAAO,MAAM;AAC/B;AAGA,SAAS,eAAe,MAA2B;AACjD,MAAI,SAAS,UAAW,QAAO;AAC/B,QAAM,EAAE,MAAM,OAAO,UAAU,IAAI;AACnC,MAAI,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,MAAM,GAAG,GAAG,GAAG;AAC5C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,KAAK,GAAG;AACrC,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,SAAS,KAAK,CAAC,WAAW,SAAS,GAAG;AAChD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAOA,SAAS,uBAAuB,MAA2B;AACzD,MAAI,SAAS,UAAW,QAAO;AAC/B,MAAI,KAAK,YAAY,UAAa,QAAQ,KAAK,SAAS,CAAC,EAAG,QAAO;AACnE,SAAO,eAAe,KAAK,UAAU,KAAK,OAAO,CAAC;AACpD;AAEA,SAAS,YAAY,MAAgC;AACnD,SAAO,SAAS,aAAa,QAAQ,KAAK,SAAS,CAAC,IAChD,KAAK,UACL;AACN;AAGO,SAAS,cAAc,UAAiC;AAC7D,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,MAAI,CAAC,cAAc,KAAK,IAAI,QAAQ,EAAG,QAAO;AAC9C,MAAI,WAAW,IAAI,SAAS,QAAQ,aAAa,SAAS;AAC1D,MAAI,SAAS;AACb,SAAO,IAAI;AACb;AAEA,SAAS,SAAS,QAAwB;AACxC,SAAO,GAAG,MAAM,IAAI,OAAO,WAAW,EAAE,WAAW,KAAK,EAAE,CAAC;AAC7D;AAEA,SAAS,cAAc,OAAwB;AAC7C,QAAM,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ;AACrD,QAAM,OAAO,SAAS,KAAK,IAAI,MAAM,OAAO;AAC5C,SAAO,OAAO,SAAS,WACnB,qBAAqB,IAAI,MACzB,qBAAqB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACjF;AAEA,eAAsB,cACpB,SACsB;AACtB,QAAM,EAAE,KAAK,WAAW,OAAO,IAAI;AACnC,QAAM,YAAY,QAAQ,UAAU,IAAI,SAAS,MAAM,GAAG,IAAI;AAC9D,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,aAAa,MAAM,KAAK,MAAM,IAAI,IAAI,GAAI;AAChD,QAAM,UAAyB,CAAC;AAChC,QAAM,QAAkB,CAAC;AAEzB,WAAS,OAAO,QAA2B;AACzC,YAAQ,KAAK,MAAM;AACnB,YAAQ,WAAW,MAAM;AAAA,EAC3B;AAGA,iBAAe,IACb,MACA,OACkB;AAClB,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,MAAM;AAAA,IACxB,SAAS,OAAO;AACd,gBAAU,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACzF;AACA;AAAA,MACE,YAAY,OACR,EAAE,MAAM,QAAQ,OAAO,IACvB,EAAE,MAAM,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,IAC9C;AACA,WAAO,YAAY;AAAA,EACrB;AAEA,WAAS,KAAK,OAA0B,QAAsB;AAC5D,eAAW,QAAQ,MAAO,QAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAAA,EACnE;AAEA,iBAAe,KACb,SACA,QACA,WACiB;AACjB,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,CAAC,iBAAiB,GAAG,SAAS,OAAO;AAAA,IACvC;AACA,QAAI,WAAW,KAAM,SAAQ,gBAAgB,IAAI;AACjD,QAAI;AAEF,YAAM,WAAW,MAAM,UAAU,KAAK;AAAA,QACpC,QAAQ;AAAA,QACR;AAAA,QACA,MAAM;AAAA,QACN,UAAU;AAAA,QACV,QAAQ,YAAY,QAAQ,SAAS;AAAA,MACvC,CAAC;AACD,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,eAAO;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,mBAAmB,SAAS,MAAM;AAAA,QAC5C;AAAA,MACF;AACA,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QAAQ,SAAS;AAAA,QACjB,IAAI,SAAS,UAAU,OAAO,SAAS,SAAS;AAAA,QAChD,MAAM,UAAU,IAAI;AAAA,MACtB;AAAA,IACF,SAAS,OAAO;AACd,aAAO;AAAA,QACL,UAAU;AAAA,QACV,QACE,iBAAiB,SAAS,MAAM,SAAS,iBACrC,mBAAmB,YAAY,GAAI,MACnC,cAAc,KAAK;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OACb,MACA,WACiB;AACjB,UAAM,UAAU,KAAK,UAAU,IAAI;AACnC,WAAO;AAAA,MACL;AAAA,MACA,MAAM,SAAS,WAAW,WAAW,GAAG,OAAO;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAGA,iBAAe,cAEb;AACA,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,MAAM,eAAe,OAAO;AAAA,MAC9B;AAAA,IACF;AACA,QAAI,CAAC,KAAK,MAAM,GAAG;AACjB,aAAO,EAAE,SAAS,eAAe,KAAK,MAAM,CAAC,iBAAiB;AAAA,IAChE;AACA,QAAI,OAAO,SAAS,WAAW;AAC7B,aAAO;AAAA,QACL,SAAS,wBAAwB,OAAO,MAAM;AAAA,MAChD;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,OAAO,KAAK,SAAS,CAAC,GAAG;AACpC,aAAO;AAAA,QACL,SAAS,gCAAgC,KAAK,UAAU,OAAO,KAAK,OAAO,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,WAAO,EAAE,SAAS,OAAO,KAAK,QAAQ;AAAA,EACxC;AAGA,iBAAe,WACbA,aACA,MACyD;AACzD,QAAI;AACF,YAAM,WAAW,MAAM,UAAUA,aAAY;AAAA,QAC3C,GAAG;AAAA,QACH,SAAS,EAAE,GAAG,QAAQ,gBAAgB,GAAG,KAAK,QAAQ;AAAA,QACtD,UAAU;AAAA,QACV,QAAQ,YAAY,QAAQ,eAAe;AAAA,MAC7C,CAAC;AACD,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,UAAU;AAAA,UACV,QAAQ,SAAS;AAAA,UACjB,IAAI,SAAS,UAAU,OAAO,SAAS,SAAS;AAAA,UAChD,MAAM,UAAU,IAAI;AAAA,QACtB;AAAA,QACA,aACE,SAAS,QAAQ,IAAI,6BAA6B,GAAG,KAAK,KAAK;AAAA,MACnE;AAAA,IACF,SAAS,OAAO;AACd,YAAM,SACJ,iBAAiB,SAAS,MAAM,SAAS,iBACrC,mBAAmB,kBAAkB,GAAI,MACzC,cAAc,KAAK;AACzB,aAAO,EAAE,QAAQ,EAAE,UAAU,OAAO,OAAO,GAAG,aAAa,KAAK;AAAA,IAClE;AAAA,EACF;AAIA,QAAM,UAAU,EAAE,UAAU,MAAM;AAQlC,iBAAe,mBACbA,aACwB;AACxB,UAAM,SAA+C;AAAA,MACnD;AAAA,QACE;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,QAAQ;AAAA,YACR,iCAAiC;AAAA,YACjC,kCAAkC,aAAa,YAAY;AAAA,UAC7D;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,QAAQ;AAAA,YACR,CAAC,YAAY,GAAG;AAAA,YAChB,kBAAkB;AAAA,YAClB,kBAAkB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,UAAyB;AAC7B,eAAW,CAAC,MAAM,IAAI,KAAK,QAAQ;AACjC,YAAM,EAAE,QAAQ,YAAY,IAAI,MAAM,WAAWA,aAAY,IAAI;AACjE,UAAI,CAAC,OAAO,SAAU,QAAO,GAAG,IAAI,OAAOA,WAAU,IAAI,OAAO,MAAM;AACtE,UAAI,gBAAgB,gBAAgB;AAClC,oBAAY,GAAG,IAAI,OAAOA,WAAU,SAAS,cAAc,0CAA0C,cAAc;AAAA,MACrH;AACA,UAAI,KAAK,WAAW,OAAO;AACzB,gBAAQ,WAAW;AAAA,MACrB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,iBAAe,oBAAoBA,aAAsC;AACvE,UAAM,EAAE,OAAO,IAAI,MAAM,WAAWA,aAAY;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,EAAE,CAAC,YAAY,GAAG,mBAAmB;AAAA,IAChD,CAAC;AACD,WAAO,OAAO,YAAY,OAAO,WAAW;AAAA,EAC9C;AAGA,iBAAe,sBACbA,aACA,SACA,QACA,MACwB;AACxB,UAAM,EAAE,OAAO,IAAI,MAAM,WAAWA,aAAY;AAAA,MAC9C,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AACD,QAAI,OAAO,YAAY,OAAO,WAAW,OAAQ,QAAO;AACxD,QAAI,OAAO,YAAY,OAAO,WAAW,KAAK;AAG5C,aAAO,QAAQ,iBACX,GAAG,KAAK,MAAM,CAAC,0IAA0I,MAAM,IAAI,IAAI,6BACvK,GAAG,KAAK,MAAM,CAAC,sLAAsL,MAAM,IAAI,IAAI;AAAA,IACzN;AACA,WAAO,GAAG,KAAK,MAAM,CAAC,cAAc,MAAM,IAAI,IAAI;AAAA,EACpD;AAIA,QAAM,aAAa,QAAQ,cAAc,cAAc,GAAG;AAC1D,QAAM,WAAW,cAAe,MAAM,oBAAoB,UAAU;AACpE,MAAI,eAAe,QAAQ,UAAU;AAEnC;AAAA,MACE;AAAA,MACA,eAAe,OACX,mGACA,OAAO,UAAU;AAAA,IACvB;AAAA,EACF,OAAO;AACL,UAAM,IAAI,cAAc,MAAM,mBAAmB,UAAU,CAAC;AAC5D,QAAI,CAAC,QAAQ,UAAU;AACrB,WAAK,eAAe,MAAM,CAAC,GAAG,mCAAmC;AAAA,IACnE,OAAO;AACL,YAAM;AAAA,QAAI;AAAA,QAAgB,MACxB,sBAAsB,YAAY,CAAC,GAAG,KAAK,sBAAsB;AAAA,MACnE;AACA,YAAM;AAAA,QAAI;AAAA,QAAoB,MAC5B;AAAA,UACE;AAAA,UACA;AAAA,YACE,CAAC,YAAY,GAAG;AAAA,YAChB,kBAAkB;AAAA,UACpB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAKA,QAAM,QAKF,EAAE,UAAU,OAAO,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM;AAIrE,QAAM,OAAO,KAAK,UAAU,EAAE,MAAM,eAAe,OAAO,CAAC;AAG3D,QAAM,WAAW,KAAK,UAAU;AAAA,IAC9B,MAAM;AAAA,IACN;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,QAAM,WAAW,SAAS,sBAAsB;AAChD,QAAM,IAAI,WAAW;AAErB,QAAM,IAAI,QAAQ,YAAY;AAC5B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,MAAM,SAAS,WAAW,GAAG,IAAI;AAAA,MACjC;AAAA,IACF;AACA,QAAI,KAAK,MAAM,EAAG,QAAO;AACzB,QAAI,OAAO,YAAY,OAAO,WAAW,KAAK;AAC5C,YAAM,WAAW;AACjB,aAAO,GAAG,KAAK,MAAM,CAAC;AAAA,IACxB;AACA,WAAO,GAAG,KAAK,MAAM,CAAC;AAAA,EACxB,CAAC;AAED,MAAI,MAAM,UAAU;AAClB;AAAA,MACE;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AAAA,EACrC;AAEA,QAAM,IAAI,UAAU,YAAY;AAC9B,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,MAAM,SAAS,CAAC,UAAU,SAAS,GAAG,GAAG,IAAI;AAAA,MAC7C;AAAA,IACF;AACA,WAAO,KAAK,MAAM,IACd,OACA,GAAG,KAAK,MAAM,CAAC;AAAA,EACrB,CAAC;AAED,QAAM,YAAsE;AAAA,IAC1E,CAAC,WAAW,MAAM,MAAM,SAAS,UAAU,GAAG,IAAI,CAAC;AAAA,IACnD,CAAC,UAAU,UAAU,MAAM,SAAS,WAAW,GAAG,IAAI,CAAC;AAAA,IACvD,CAAC,OAAO,MAAM,MAAM,SAAS,WAAW,IAAI,cAAc,IAAI,CAAC;AAAA,IAC/D,CAAC,QAAQ,MAAM,MAAM,SAAS,WAAW,IAAI,cAAc,IAAI,CAAC;AAAA,IAChE,CAAC,UAAU,MAAM,IAAI;AAAA,EACvB;AACA,aAAW,CAAC,MAAM,SAAS,MAAM,KAAK,WAAW;AAC/C,UAAM,IAAI,MAAM,YAAY;AAC1B,YAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,eAAe;AAC1D,UAAI,OAAO,YAAY,OAAO,WAAW,IAAK,QAAO;AACrD,UAAI,KAAK,MAAM,GAAG;AAChB,eAAO,GAAG,KAAK,MAAM,CAAC;AAAA,MACxB;AACA,aAAO,GAAG,KAAK,MAAM,CAAC;AAAA,IACxB,CAAC;AAAA,EACH;AAGA,QAAM,IAAI,UAAU,YAAY;AAC9B,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,YAAY,OAAO,GAAG,eAAe;AACzE,QAAI,OAAO,YAAY,OAAO,WAAW,KAAK;AAC5C,aAAO,uCAAuC,MAAM;AAAA,IACtD;AACA,QAAI,CAAC,KAAK,MAAM,GAAG;AACjB,aAAO,GAAG,KAAK,MAAM,CAAC;AAAA,IACxB;AACA,WAAO,eAAe,OAAO,IAAI;AAAA,EACnC,CAAC;AAGD,QAAM,IAAI,cAAc,YAAY;AAClC,UAAM,SAAS,MAAM;AAAA,MACnB,EAAE,MAAM,YAAY,QAAQ,SAAS,iBAAiB,EAAE;AAAA,MACxD;AAAA,IACF;AACA,WAAO,OAAO,YAAY,OAAO,WAAW,MACxC,OACA,GAAG,KAAK,MAAM,CAAC;AAAA,EACrB,CAAC;AAED,QAAM,IAAI,aAAa,YAAY;AACjC,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,aAAa,OAAQ,QAAO,OAAO;AACvC,UAAM,UAAU,OAAO;AACvB,WAAO;AAAA,EACT,CAAC;AAID,QAAM,QAAQ,MAAM;AACpB,MAAI,UAAU,MAAM;AAClB,SAAK,QAAQ,6BAA6B;AAC1C,WAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AAAA,EACrC;AACA,MAAI,QAAQ,sBAAsB;AAChC;AAAA,MACE;AAAA,MACA,SAAS,MAAM,sBAAsB,KAAK,2BAA2B,oBAAoB;AAAA,IAC3F;AACA,WAAO,EAAE,IAAI,OAAO,SAAS,MAAM;AAAA,EACrC;AAEA,MAAI,UAAU;AAEd,QAAM,YAAY,oBAAI,IAGpB;AAGF,iBAAe,cACb,OACA,MACwB;AACxB,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,aAAa,OAAQ,QAAO,OAAO;AACvC,UAAM,SAAS;AACf,cAAU,OAAO;AACjB,QAAI,OAAO,YAAY,SAAS,MAAO,QAAO;AAC9C,WAAO,GAAG,IAAI,2BAA2B,MAAM,OAAO,OAAO,OAAO,cAAc,SAAS,KAAK;AAAA,EAClG;AAGA,iBAAe,SAAS,IAA2B;AACjD,UAAM,OAAO,UAAU,IAAI,EAAE;AAC7B,QAAI,SAAS,OAAW;AACxB,cAAU,OAAO,EAAE;AACnB,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,QACE,MAAM;AAAA,QACN;AAAA,QACA,YAAY,SAAS,UAAU;AAAA,QAC/B,GAAG;AAAA,QACH,UAAU;AAAA,QACV,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,KAAK,MAAM,EAAG,OAAM,KAAK,sBAAsB,EAAE,IAAI,KAAK,MAAM,CAAC,GAAG;AAAA,EAC3E;AAMA,iBAAe,YACb,MACA,OACe;AACf,QAAI,MAAM,IAAI,MAAM,KAAK,EAAG;AAC5B,UAAM,SAAS,MAAM,YAAY;AACjC,QAAI,aAAa,OAAQ,WAAU,OAAO;AAAA,EAC5C;AAIA,MAAI;AACF,UAAM,WAAW,SAAS,UAAU;AACpC,UAAM,SAAS,KAAK,UAAU;AAAA,MAC5B,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AAED,UAAM,YAAY,OAAO,YAAY;AACnC,gBAAU,IAAI,UAAU;AAAA,QACtB,gBAAgB;AAAA,QAChB,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,MAAM,SAAS,WAAW,WAAW,GAAG,MAAM;AAAA,QAC9C;AAAA,MACF;AACA,UAAI,CAAC,KAAK,MAAM,GAAG;AACjB,eAAO,GAAG,KAAK,MAAM,CAAC,mBAAmB,oBAAoB,sBAAsB,OAAO;AAAA,MAC5F;AACA,YAAM,UAAU;AAChB,YAAM,UACJ,uBAAuB,OAAO,IAAI,KACjC,MAAM,cAAc,CAAC,sBAAsB,YAAY;AAC1D,UAAI,QAAS,QAAO;AACpB,YAAM,WAAW,YAAY,OAAO,IAAI;AACxC,aAAO,aAAa,UAAa,aAAa,UAC1C,OACA,+BAA+B,QAAQ,0BAA0B,OAAO;AAAA,IAC9E,CAAC;AAED,UAAM,EAAE,QAAQ,IAAI;AACpB,QAAI,YAAY,MAAM;AACpB,WAAK,CAAC,aAAa,GAAG,mCAAmC;AAAA,IAC3D,OAAO;AACL,YAAM,YAAY,eAAe,YAAY;AAE3C,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA,MAAM,SAAS,WAAW,WAAW,GAAG,MAAM;AAAA,UAC9C;AAAA,QACF;AACA,YAAI,CAAC,OAAO,YAAY,OAAO,WAAW,QAAQ,QAAQ;AACxD,iBAAO,cAAc,KAAK,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC;AAAA,QAC/D;AACA,cAAM,QAAQ,MAAM,cAAc,GAAG,YAAY;AACjD,YAAI,MAAO,QAAO,GAAG,KAAK;AAC1B,cAAM,MAAM,YAAY,QAAQ,IAAI;AACpC,cAAM,QAAQ,YAAY,OAAO,IAAI;AACrC,eAAO,QAAQ,UAAa,UAAU,UAAa,QAAQ,QACvD,OACA,+BAA+B,KAAK,eAAe,GAAG;AAAA,MAC5D,CAAC;AAAA,IACH;AAEA,UAAM,YAAY,SAAS,YAAY;AACrC,YAAM,aAAa,SAAS,UAAU;AACtC,YAAM,SAAS,UAAU;AACzB,gBAAU,IAAI,YAAY;AAAA,QACxB,gBAAgB;AAAA,QAChB,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,UACE,MAAM;AAAA,UACN;AAAA,UACA,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,eAAe;AAAA,UACf,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,QACA;AAAA,MACF;AACA,UAAI,KAAK,MAAM,GAAG;AAEhB,cAAM,SAAS,UAAU;AACzB,eAAO,GAAG,KAAK,MAAM,CAAC,6BAA6B,MAAM,sBAAsB,OAAO;AAAA,MACxF;AACA,UAAI,CAAC,OAAO,YAAY,OAAO,WAAW,KAAK;AAG7C,YAAI,OAAO,YAAY,OAAO,SAAS;AACrC,oBAAU,OAAO,UAAU;AAC7B,eAAO,GAAG,KAAK,MAAM,CAAC,mBAAmB,MAAM,sBAAsB,OAAO;AAAA,MAC9E;AAEA,gBAAU,OAAO,UAAU;AAC3B,YAAM,QAAQ,MAAM,cAAc,GAAG,qBAAqB;AAC1D,UAAI,MAAO,QAAO;AAElB,YAAM,UAAU,YAAY,OAAO,IAAI;AACvC,aAAO,YAAY,UAAa,YAAY,UACxC,OACA,4BAA4B,OAAO,0BAA0B,OAAO;AAAA,IAC1E,CAAC;AAGD,UAAM,SAAS,SAAS,qBAAqB;AAC7C,QAAI,gBAAgB;AACpB,UAAM,YAAY,kBAAkB,YAAY;AAC9C,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,UACE,MAAM;AAAA,UACN;AAAA,UACA,YAAY,SAAS,UAAU;AAAA,UAC/B,gBAAgB;AAAA,UAChB,eAAe;AAAA,UACf,UAAU;AAAA,UACV,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,KAAK,MAAM,GAAG;AACjB,eAAO,GAAG,KAAK,MAAM,CAAC;AAAA,MACxB;AACA,sBAAgB;AAChB,YAAM,UAAU,uBAAuB,OAAO,IAAI;AAClD,UAAI,QAAS,QAAO;AACpB,YAAM,QAAQ,MAAM,cAAc,GAAG,cAAc;AACnD,aAAO,SAAS,GAAG,KAAK;AAAA,IAC1B,CAAC;AAED,QAAI,CAAC,eAAe;AAClB,WAAK,CAAC,WAAW,GAAG,oDAAoD;AAAA,IAC1E,OAAO;AAGL,YAAM,YAAY,aAAa,YAAY;AACzC,kBAAU,IAAI,QAAQ;AAAA,UACpB,gBAAgB;AAAA,UAChB,eAAe;AAAA,QACjB,CAAC;AACD,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,YACE,MAAM;AAAA,YACN;AAAA,YACA,UAAU;AAAA,YACV,gBAAgB;AAAA,YAChB,eAAe;AAAA,YACf,QAAQ;AAAA,YACR,aAAa;AAAA,UACf;AAAA,UACA;AAAA,QACF;AACA,cAAM,QAAQ,MAAM,cAAc,GAAG,iBAAiB;AACtD,YAAI,OAAO;AACT,iBAAO,GAAG,KAAK;AAAA,QACjB;AACA,kBAAU,OAAO,MAAM;AAEvB,eAAO,KAAK,MAAM,IACd,GAAG,KAAK,MAAM,CAAC,qCACf;AAAA,MACN,CAAC;AAAA,IACH;AAGA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B,MAAM;AAAA,MACN;AAAA,MACA,YAAY,SAAS,UAAU;AAAA,MAC/B,gBAAgB;AAAA,MAChB,eAAe;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,YAAY,MAAM;AACpB,WAAK,CAAC,UAAU,eAAe,GAAG,mCAAmC;AAAA,IACvE,OAAO;AACL,YAAM,YAAY,UAAU,YAAY;AACtC,cAAM,SAAS,MAAM;AAAA,UACnB;AAAA,UACA,MAAM,SAAS,WAAW,WAAW,GAAG,QAAQ;AAAA,UAChD;AAAA,QACF;AACA,YAAI,CAAC,KAAK,MAAM,EAAG,QAAO,GAAG,KAAK,MAAM,CAAC;AACzC,cAAM,WAAW;AACjB,kBAAU,IAAI,UAAU;AAAA,UACtB,gBAAgB,uBAAuB;AAAA,UACvC,eAAe,uBAAuB;AAAA,QACxC,CAAC;AACD,eACE,uBAAuB,OAAO,IAAI,KACjC,MAAM,cAAc,GAAG,wBAAwB;AAAA,MAEpD,CAAC;AACD,UAAI,CAAC,MAAM,UAAU;AACnB,aAAK,CAAC,eAAe,GAAG,+BAA+B;AAAA,MACzD,OAAO;AACL,cAAM,YAAY,iBAAiB,YAAY;AAC7C,gBAAM,SAAS,MAAM;AAAA,YACnB;AAAA,YACA,MAAM,SAAS,WAAW,WAAW,GAAG,QAAQ;AAAA,YAChD;AAAA,UACF;AACA,cAAI,CAAC,KAAK,MAAM,EAAG,QAAO,cAAc,KAAK,MAAM,CAAC;AACpD,gBAAM,QAAQ,MAAM,cAAc,GAAG,YAAY;AACjD,iBAAO,SAAS,GAAG,KAAK;AAAA,QAC1B,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,UAAE;AACA,eAAW,MAAM,CAAC,GAAG,UAAU,KAAK,CAAC,EAAG,OAAM,SAAS,EAAE;AAAA,EAC3D;AACA,QAAM,MAAM,MAAM,YAAY;AAC9B,MAAI,aAAa,KAAK;AACpB,UAAM,KAAK,oCAAoC,IAAI,OAAO,GAAG;AAAA,EAC/D,WAAW,IAAI,YAAY,OAAO;AAChC,UAAM;AAAA,MACJ,SAAS,MAAM,sBAAsB,IAAI,OAAO,YAAY,KAAK;AAAA,IACnE;AAAA,EACF;AAEA,QAAM,KAAK,QAAQ,MAAM,CAAC,WAAW,OAAO,WAAW,MAAM;AAC7D,SAAO,EAAE,IAAI,SAAS,MAAM;AAC9B;;;ADn3BO,IAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2DAOsC,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoB/E,IAAM,cAAc;AAEpB,IAAM,eAAe;AAErB,IAAM,gBACJ;AASF,IAAM,QAA+C;AAAA,EACnD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AACR;AAGA,eAAsB,OAAO,MAAgB,IAA4B;AACvE,QAAM,aAAa,CAAC,YAAoB;AACtC,OAAG,MAAM,GAAG,OAAO;AAAA;AAAA,EAAO,KAAK,EAAE;AACjC,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,UAAU;AAAA,MACjB;AAAA,MACA,kBAAkB;AAAA,MAClB,SAAS;AAAA,QACP,KAAK,EAAE,MAAM,SAAS;AAAA,QACtB,MAAM,EAAE,MAAM,SAAS;AAAA,QACvB,eAAe,EAAE,MAAM,SAAS;AAAA,QAChC,kBAAkB,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,QACnD,cAAc,EAAE,MAAM,SAAS;AAAA,QAC/B,MAAM,EAAE,MAAM,UAAU;AAAA,QACxB,MAAM,EAAE,MAAM,WAAW,OAAO,IAAI;AAAA,MACtC;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,WAAW,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,EAC1E;AACA,QAAM,EAAE,QAAQ,YAAY,IAAI;AAChC,MAAI,OAAO,MAAM;AACf,OAAG,IAAI,KAAK;AACZ,WAAO;AAAA,EACT;AACA,MAAI,YAAY,WAAW,KAAK,YAAY,CAAC,MAAM,SAAS;AAC1D,WAAO;AAAA,MACL,YAAY,WAAW,IACnB,gCACA,oBAAoB,YAAY,KAAK,GAAG,CAAC;AAAA,IAC/C;AAAA,EACF;AAEA,QAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAClC,MAAI;AACJ,MAAI;AACF,eAAW,IAAI,IAAI,GAAG;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,MACL,QAAQ,KAAK,uBAAuB,sBAAsB,GAAG;AAAA,IAC/D;AAAA,EACF;AACA,MAAI,SAAS,aAAa,YAAY,SAAS,aAAa,SAAS;AACnE,WAAO,WAAW,qCAAqC;AAAA,EACzD;AAEA,MAAI;AACJ,MAAI,OAAO,aAAa,MAAM,QAAW;AACvC,UAAM,QAAQ,OAAO,aAAa,EAAE,KAAK;AACzC,QAAIC,UAAqB;AACzB,QAAI;AACF,MAAAA,UAAS,IAAI,IAAI,KAAK;AAAA,IACxB,QAAQ;AAAA,IAER;AACA,QAAIA,SAAQ,aAAa,YAAYA,SAAQ,aAAa,SAAS;AACjE,aAAO,WAAW,+CAA+C,KAAK,EAAE;AAAA,IAC1E;AACA,iBAAaA,QAAO;AAAA,EACtB;AAGA,QAAM,cACJ,OAAO,gBAAgB,MACtB,GAAG,IAAI,0BAA0B,IAC/B,MAAM,IAAI,EACV,OAAO,CAAC,SAAS,KAAK,KAAK,MAAM,EAAE;AACxC,MAAI;AACJ,aAAW,UAAU,aAAa;AAChC,UAAM,QAAQ,OAAO,QAAQ,GAAG;AAChC,UAAM,OAAO,OAAO,MAAM,GAAG,KAAK,EAAE,KAAK;AACzC,UAAM,QAAQ,OAAO,MAAM,QAAQ,CAAC,EAAE,KAAK;AAC3C,QAAI,QAAQ,KAAK,CAAC,YAAY,KAAK,IAAI,GAAG;AACxC,aAAO,WAAW,4CAA4C;AAAA,IAChE;AACA,QAAI,CAAC,aAAa,KAAK,KAAK,GAAG;AAC7B,aAAO;AAAA,QACL,OAAO,IAAI;AAAA,MACb;AAAA,IACF;AACA,QAAI,cAAc,KAAK,IAAI,GAAG;AAC5B,aAAO;AAAA,QACL,8BAA8B,IAAI;AAAA,MACpC;AAAA,IACF;AACA,qBAAiB,EAAE,GAAG,gBAAgB,CAAC,IAAI,GAAG,MAAM;AAAA,EACtD;AAEA,QAAM,SAAS,OAAO,QAAQ;AAC9B,MAAI,OAAO,SAAS,KAAK,OAAO,SAAS,KAAK;AAC5C,WAAO,WAAW,uDAAuD;AAAA,EAC3E;AAEA,QAAM,aACJ,OAAO,YAAY,KACnB,GAAG,IAAI,qBACP,IACA,KAAK;AACP,MAAI,cAAc,IAAI;AACpB,WAAO,WAAW,6CAA6C;AAAA,EACjE;AACA,MAAI,UAAU,WAAW,KAAK,GAAG;AAC/B,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,UAAU,KAAK,CAAC,OAAO,MAAM;AACpD,WAAO;AAAA,MACL;AAAA,IACF;AAAA,EACF;AAEA,KAAG,IAAI,YAAY,SAAS,IAAI,aAAa,MAAM;AAAA,CAAK;AACxD,QAAM,SAAS,MAAM,cAAc;AAAA,IACjC,KAAK,SAAS;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,GAAG;AAAA,IACV,UAAU,CAAC,WAAW;AACpB,SAAG,IAAI,GAAG,MAAM,OAAO,MAAM,CAAC,KAAK,OAAO,IAAI,EAAE;AAChD,UAAI,OAAO,OAAQ,IAAG,IAAI,SAAS,OAAO,MAAM,EAAE;AAAA,IACpD;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,CAAC,WACb,OAAO,QAAQ,OAAO,CAAC,WAAW,OAAO,WAAW,MAAM,EAAE;AAC9D,QAAM,UAAU,MAAM,MAAM;AAC5B,KAAG;AAAA,IACD;AAAA,EAAK,MAAM,MAAM,CAAC,YAAY,MAAM,MAAM,CAAC,UAAU,UAAU,KAAK,OAAO,aAAa,EAAE;AAAA,EAC5F;AACA,aAAW,QAAQ,OAAO,MAAO,IAAG,IAAI,SAAS,IAAI,EAAE;AACvD,SAAO,OAAO,KAAK,IAAI;AACzB;;;AEjMA,KAAK,OAAO,QAAQ,KAAK,MAAM,CAAC,GAAG;AAAA,EACjC,KAAK,CAAC,SAAS,QAAQ,IAAI,IAAI;AAAA,EAC/B,OAAO,CAAC,SAAS,QAAQ,MAAM,IAAI;AAAA,EACnC,KAAK,QAAQ;AACf,CAAC,EAAE;AAAA,EACD,CAAC,SAAS;AACR,YAAQ,WAAW;AAAA,EACrB;AAAA,EACA,CAAC,UAAmB;AAClB,YAAQ;AAAA,MACN,sBAAsB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC9E;AACA,YAAQ,WAAW;AAAA,EACrB;AACF;","names":["sessionUrl","parsed"]}
package/dist/index.cjs CHANGED
@@ -419,7 +419,7 @@ function isHttpsUrl(value) {
419
419
 
420
420
  // src/api.ts
421
421
  var DEFAULT_API_BASE_URL = "https://apis.relume.io/nova/partner/v1";
422
- var SDK_VERSION = "2.0.0";
422
+ var SDK_VERSION = "2.0.1";
423
423
  var USER_AGENT = `relume-partner-node/${SDK_VERSION}`;
424
424
  var DEFAULT_API_TIMEOUT_MS = 15e3;
425
425
  var DEFAULT_MAX_RETRIES = 2;