@rytass/bpm-core-nestjs-module 0.13.3 → 0.13.5

package/src/lib/workflow-webhook/workflow-webhook-endpoint-admin.service.js

@@ -0,0 +1,464 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookEndpointAdminService = exports.WORKFLOW_WEBHOOK_TEST_MAX_PER_WINDOW = exports.WORKFLOW_WEBHOOK_TEST_WINDOW_MS = exports.WORKFLOW_WEBHOOK_TEST_MIN_INTERVAL_MS = void 0;
+exports.readWorkflowWebhookHeaderNames = readWorkflowWebhookHeaderNames;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const workflow_graph_1 = require("@rytass/bpm-core-shared/workflow-graph");
+const node_crypto_1 = require("node:crypto");
+const typeorm_2 = require("typeorm");
+const workflow_webhook_allowlist_1 = require("./workflow-webhook-allowlist");
+const workflow_webhook_database_source_1 = require("./workflow-webhook-database-source");
+const workflow_webhook_delivery_service_1 = require("./workflow-webhook-delivery.service");
+const workflow_webhook_endpoint_entity_1 = require("./workflow-webhook-endpoint.entity");
+const workflow_webhook_options_1 = require("./workflow-webhook-options");
+const workflow_webhook_secret_cipher_1 = require("./workflow-webhook-secret-cipher");
+const workflow_webhook_errors_1 = require("./workflow-webhook.errors");
+const workflow_webhook_service_1 = require("./workflow-webhook.service");
+const PARAMETER_TYPES = [
+    'boolean',
+    'json',
+    'number',
+    'string',
+    'stringArray',
+];
+const METHODS = ['PATCH', 'POST', 'PUT'];
+const KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$/u;
+const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,100}$/u;
+const MAX_HEADERS = 20;
+const MAX_SECRET_LENGTH = 1024;
+const MAX_HEADER_VALUE_LENGTH = 4096;
+/** Headers BPM sets itself or that describe the connection, not the call. */
+const RESERVED_HEADERS = new Set([
+    'connection',
+    'content-length',
+    'expect',
+    'host',
+    'keep-alive',
+    'proxy-connection',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+/**
+ * What `fetch` accepts in a header value: tab, visible ASCII and Latin-1.
+ * Anything else would only fail every delivery as a retryable network error.
+ */
+const HEADER_VALUE_PATTERN = /^[\t\x20-\x7e\x80-\xff]*$/u;
+/** One test send per endpoint every 10 s, at most 5 per 10 minutes. */
+exports.WORKFLOW_WEBHOOK_TEST_MIN_INTERVAL_MS = 10_000;
+exports.WORKFLOW_WEBHOOK_TEST_WINDOW_MS = 600_000;
+exports.WORKFLOW_WEBHOOK_TEST_MAX_PER_WINDOW = 5;
+/**
+ * Administrator management of database webhook endpoints (ADR 18 §3.13).
+ *
+ * Header values and the signing secret go in encrypted and never come back
+ * out: not in a response, an error message or a log. Every change writes an
+ * audit row naming the fields that changed, never their values.
+ */
+let WorkflowWebhookEndpointAdminService = class WorkflowWebhookEndpointAdminService {
+    constructor(endpointRepository, auditRepository, webhookService, deliveryService, databaseSource, options = workflow_webhook_options_1.DEFAULT_BPM_WORKFLOW_WEBHOOK_OPTIONS) {
+        this.endpointRepository = endpointRepository;
+        this.auditRepository = auditRepository;
+        this.webhookService = webhookService;
+        this.deliveryService = deliveryService;
+        this.databaseSource = databaseSource;
+        this.options = options;
+        // Per process: several API replicas each allow their own budget, which is
+        // acceptable for a manual test button and documented as such.
+        this.testSends = new Map();
+    }
+    isEnabled() {
+        return this.webhookService.hasDatabaseSource();
+    }
+    async list() {
+        return this.endpointRepository.find({
+            order: { key: 'ASC', version: 'DESC' },
+        });
+    }
+    async listAudits(endpointId) {
+        return this.auditRepository.find({
+            order: { createdAt: 'DESC' },
+            take: 100,
+            where: { endpointId },
+        });
+    }
+    async create(data, actorMemberId) {
+        const cipher = this.readCipher();
+        const key = data.key.trim();
+        assertEndpoint(KEY_PATTERN.test(key), 'key must be 1–100 letters, digits, ".", "_", ":" or "-"');
+        assertEndpoint(Number.isInteger(data.version) &&
+            data.version >= 1 &&
+            data.version <= workflow_graph_1.NOTIFY_WEBHOOK_ENDPOINT_VERSION_MAX, `version must be an integer between 1 and ${workflow_graph_1.NOTIFY_WEBHOOK_ENDPOINT_VERSION_MAX}`);
+        if (this.webhookService
+            .listRegistryEndpoints()
+            .some((endpoint) => endpoint.descriptor.key === key)) {
+            throw new workflow_webhook_errors_1.BPMWorkflowWebhookException(workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.ENDPOINT_KEY_CONFLICT, `"${key}" is already registered by the host application`);
+        }
+        const existing = await this.endpointRepository.find({ where: { key } });
+        const latestVersion = existing.reduce((latest, row) => Math.max(latest, row.version), 0);
+        assertEndpoint(data.version > latestVersion, latestVersion
+            ? `"${key}" already has version ${latestVersion}; a new contract needs a higher version`
+            : 'version is invalid');
+        const url = this.readUrl(data.url);
+        const saved = await this.endpointRepository
+            .save(this.endpointRepository.create({
+            createdByMemberId: actorMemberId,
+            deprecated: Boolean(data.deprecated),
+            description: readOptionalText(data.description, 'description', 2000),
+            encryptedHeaders: this.encryptHeaders(cipher, data.headers ?? []),
+            encryptedSigningSecret: this.encryptSecret(cipher, data.signingSecret),
+            isActive: true,
+            key,
+            label: readRequiredText(data.label, 'label', 200),
+            method: readMethod(data.method),
+            parameters: readParameters(data.parameters),
+            secretRotatedAt: null,
+            timeoutMs: readTimeout(data.timeoutMs),
+            updatedByMemberId: actorMemberId,
+            url,
+            version: data.version,
+        }))
+            .catch((error) => {
+            // Two administrators creating the same version at once: the unique
+            // constraint decides, and the loser gets a sentence, not a 500.
+            if (readDatabaseErrorCode(error) === '23505') {
+                throw new workflow_webhook_errors_1.BPMWorkflowWebhookException(workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.ENDPOINT_INVALID, `"${key}" version ${data.version} already exists`);
+            }
+            throw error;
+        });
+        await this.audit(saved.id, workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointAuditActionEnum.CREATED, [
+            'key',
+            'version',
+            'label',
+            'url',
+            'method',
+            'parameters',
+            ...(data.description ? ['description'] : []),
+            ...(data.headers?.length ? ['headers'] : []),
+            ...(data.signingSecret ? ['signingSecret'] : []),
+            ...(data.timeoutMs ? ['timeoutMs'] : []),
+            ...(data.deprecated ? ['deprecated'] : []),
+        ], actorMemberId);
+        return saved;
+    }
+    async update(id, data, actorMemberId) {
+        const cipher = this.readCipher();
+        const row = await this.readRow(id);
+        if (data.parameters &&
+            stableParameters(readParameters(data.parameters)) !==
+                stableParameters(row.parameters)) {
+            throw new workflow_webhook_errors_1.BPMWorkflowWebhookException(workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.ENDPOINT_CONTRACT_CHANGED, `the parameters of ${row.key}@${row.version} cannot change; create version ${row.version + 1} instead`);
+        }
+        const parameters = data.parameters ? readParameters(data.parameters) : null;
+        const url = isGiven(data.url) ? this.readUrl(data.url) : null;
+        // Pointing stored credentials at another host would let whoever controls
+        // that host read header values the admin view never returns, so a new
+        // origin needs the headers re-entered in the same request.
+        assertEndpoint(!url || readOrigin(url) === readOrigin(row.url) || Boolean(data.headers), 'changing the URL to another host requires entering the headers again');
+        const next = {
+            // Same contract, so only labels and descriptions can differ here.
+            ...(parameters &&
+                describeParameters(parameters) !== describeParameters(row.parameters)
+                ? { parameters }
+                : {}),
+            ...(isGiven(data.label)
+                ? { label: readRequiredText(data.label, 'label', 200) }
+                : {}),
+            ...(data.description !== undefined
+                ? {
+                    description: readOptionalText(data.description, 'description', 2000),
+                }
+                : {}),
+            ...(url ? { url } : {}),
+            ...(isGiven(data.method) ? { method: readMethod(data.method) } : {}),
+            ...(data.timeoutMs !== undefined
+                ? { timeoutMs: readTimeout(data.timeoutMs) }
+                : {}),
+            ...(typeof data.deprecated === 'boolean'
+                ? { deprecated: data.deprecated }
+                : {}),
+        };
+        const changes = Object.fromEntries(Object.entries(next).filter(([field, value]) => field === 'parameters' || row[field] !== value));
+        const changedFields = [
+            ...Object.keys(changes),
+            // Values are write-only, so giving headers at all counts as a change.
+            ...(data.headers ? ['headers'] : []),
+        ];
+        if (!changedFields.length) {
+            return row;
+        }
+        // Only the changed columns are written, so a concurrent secret rotation
+        // or header replacement is not reverted by this row's stale copy.
+        await this.endpointRepository.update({ id: row.id }, {
+            ...changes,
+            ...(data.headers
+                ? { encryptedHeaders: this.encryptHeaders(cipher, data.headers) }
+                : {}),
+            updatedByMemberId: actorMemberId,
+        });
+        await this.audit(row.id, workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointAuditActionEnum.UPDATED, changedFields, actorMemberId);
+        return this.readRow(row.id);
+    }
+    async setActive(id, active, actorMemberId) {
+        this.readCipher();
+        const row = await this.readRow(id);
+        if (row.isActive === active) {
+            return row;
+        }
+        // Re-enabling puts a URL back into use, so it must still pass today's
+        // allowlist.
+        if (active) {
+            this.readUrl(row.url);
+        }
+        await this.endpointRepository.update({ id: row.id }, { isActive: active, updatedByMemberId: actorMemberId });
+        await this.audit(row.id, active
+            ? workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointAuditActionEnum.ENABLED
+            : workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointAuditActionEnum.DISABLED, ['isActive'], actorMemberId);
+        return this.readRow(row.id);
+    }
+    /** `null` removes the secret, so BPM stops signing requests. */
+    async rotateSecret(id, signingSecret, actorMemberId) {
+        const cipher = this.readCipher();
+        const row = await this.readRow(id);
+        await this.endpointRepository.update({ id: row.id }, {
+            encryptedSigningSecret: this.encryptSecret(cipher, signingSecret),
+            secretRotatedAt: new Date(),
+            updatedByMemberId: actorMemberId,
+        });
+        await this.audit(row.id, workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointAuditActionEnum.SECRET_ROTATED, ['signingSecret'], actorMemberId);
+        return this.readRow(row.id);
+    }
+    /**
+     * Sends a sample event — placeholder ids and a sample value for every
+     * declared parameter, never a real case — through the normal delivery
+     * path, and reports what the receiver answered.
+     */
+    async testSend(id, actorMemberId, now = Date.now()) {
+        this.readCipher();
+        const row = await this.readRow(id);
+        this.acquireTestSend(row.id, now);
+        const outcome = await this.deliveryService.sendTestEvent({ endpoint: this.databaseSource.toEndpoint(row), source: 'DATABASE' }, readSampleEvent(row, new Date(now)));
+        await this.audit(row.id, workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointAuditActionEnum.TEST_SENT, [], actorMemberId);
+        return outcome;
+    }
+    acquireTestSend(endpointId, now) {
+        const recent = (this.testSends.get(endpointId) ?? []).filter((sentAt) => now - sentAt < exports.WORKFLOW_WEBHOOK_TEST_WINDOW_MS);
+        const last = recent[recent.length - 1];
+        if ((last !== undefined &&
+            now - last < exports.WORKFLOW_WEBHOOK_TEST_MIN_INTERVAL_MS) ||
+            recent.length >= exports.WORKFLOW_WEBHOOK_TEST_MAX_PER_WINDOW) {
+            throw new workflow_webhook_errors_1.BPMWorkflowWebhookException(workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.TEST_RATE_LIMITED, `wait before testing this endpoint again (at most one test every ${exports.WORKFLOW_WEBHOOK_TEST_MIN_INTERVAL_MS / 1000} s and ${exports.WORKFLOW_WEBHOOK_TEST_MAX_PER_WINDOW} per ${exports.WORKFLOW_WEBHOOK_TEST_WINDOW_MS / 60_000} minutes)`);
+        }
+        this.testSends.set(endpointId, [...recent, now]);
+    }
+    readCipher() {
+        if (!this.isEnabled() || !this.options.secretEncryptionKey) {
+            throw new workflow_webhook_errors_1.BPMWorkflowWebhookException(workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.DATABASE_SOURCE_DISABLED, 'database webhook endpoints are not enabled on this server');
+        }
+        return new workflow_webhook_secret_cipher_1.WorkflowWebhookSecretCipher(this.options.secretEncryptionKey);
+    }
+    async readRow(id) {
+        const row = await this.endpointRepository.findOne({ where: { id } });
+        if (!row) {
+            throw new common_1.NotFoundException(`Webhook endpoint ${id} was not found`);
+        }
+        return row;
+    }
+    readUrl(value) {
+        const url = value.trim();
+        const parsed = (() => {
+            try {
+                return new URL(url);
+            }
+            catch {
+                return null;
+            }
+        })();
+        assertEndpoint(parsed !== null &&
+            (parsed.protocol === 'https:' || parsed.protocol === 'http:'), 'url must be an absolute http(s) URL');
+        assertEndpoint(!parsed?.username && !parsed?.password, 'url must not carry credentials; use a header instead');
+        if (!(0, workflow_webhook_allowlist_1.isWorkflowWebhookUrlAllowed)(url, this.options.allowedUrlPatterns)) {
+            throw new workflow_webhook_errors_1.BPMWorkflowWebhookException(workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.URL_NOT_ALLOWED, 'url is not allowed by workflowWebhookAllowedUrlPatterns');
+        }
+        return url;
+    }
+    encryptHeaders(cipher, headers) {
+        assertEndpoint(headers.length <= MAX_HEADERS, `at most ${MAX_HEADERS} headers`);
+        const entries = headers.map((header) => {
+            const name = header.name.trim();
+            assertEndpoint(HEADER_NAME_PATTERN.test(name), 'a header name is invalid');
+            // Messages name the header, never its value.
+            assertEndpoint(!name.toLowerCase().startsWith('x-bpm-') &&
+                !RESERVED_HEADERS.has(name.toLowerCase()), `header "${name}" is set by BPM and cannot be configured`);
+            assertEndpoint(typeof header.value === 'string' &&
+                header.value.length <= MAX_HEADER_VALUE_LENGTH &&
+                HEADER_VALUE_PATTERN.test(header.value), `header "${name}" has an invalid value`);
+            return [name, header.value];
+        });
+        const names = entries.map(([name]) => name.toLowerCase());
+        assertEndpoint(new Set(names).size === names.length, 'header names must be unique');
+        return entries.length
+            ? cipher.encrypt(JSON.stringify(Object.fromEntries(entries)))
+            : null;
+    }
+    encryptSecret(cipher, secret) {
+        if (!secret) {
+            return null;
+        }
+        assertEndpoint(secret.length <= MAX_SECRET_LENGTH, `signingSecret must be at most ${MAX_SECRET_LENGTH} characters`);
+        return cipher.encrypt(secret);
+    }
+    async audit(endpointId, action, changedFields, actorMemberId) {
+        await this.auditRepository.save(this.auditRepository.create({
+            action,
+            actorMemberId,
+            changedFields: [...new Set(changedFields)].sort(),
+            endpointId,
+        }));
+    }
+};
+exports.WorkflowWebhookEndpointAdminService = WorkflowWebhookEndpointAdminService;
+exports.WorkflowWebhookEndpointAdminService = WorkflowWebhookEndpointAdminService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, typeorm_1.InjectRepository)(workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointEntity)),
+    tslib_1.__param(1, (0, typeorm_1.InjectRepository)(workflow_webhook_endpoint_entity_1.WorkflowWebhookEndpointAuditEntity)),
+    tslib_1.__param(5, (0, common_1.Optional)()),
+    tslib_1.__param(5, (0, common_1.Inject)(workflow_webhook_options_1.BPM_WORKFLOW_WEBHOOK_OPTIONS)),
+    tslib_1.__metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
+        workflow_webhook_service_1.WorkflowWebhookService,
+        workflow_webhook_delivery_service_1.WorkflowWebhookDeliveryService,
+        workflow_webhook_database_source_1.DatabaseWorkflowWebhookEndpointSource, Object])
+], WorkflowWebhookEndpointAdminService);
+/**
+ * The header names of a stored endpoint, for the admin view. Decrypting the
+ * envelope is the only way to know them; the values are dropped at once.
+ */
+function readWorkflowWebhookHeaderNames(row, secretEncryptionKey) {
+    if (!row.encryptedHeaders || !secretEncryptionKey) {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(new workflow_webhook_secret_cipher_1.WorkflowWebhookSecretCipher(secretEncryptionKey).decrypt(row.encryptedHeaders));
+        return typeof parsed === 'object' && parsed !== null
+            ? Object.keys(parsed).sort()
+            : [];
+    }
+    catch {
+        return [];
+    }
+}
+function assertEndpoint(condition, detail) {
+    if (!condition) {
+        throw new workflow_webhook_errors_1.BPMWorkflowWebhookException(workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.ENDPOINT_INVALID, detail);
+    }
+}
+function isGiven(value) {
+    return value !== undefined && value !== null;
+}
+function readRequiredText(value, field, max) {
+    const text = value.trim();
+    assertEndpoint(text.length > 0 && text.length <= max, `${field} must be 1–${max} characters`);
+    return text;
+}
+function readOptionalText(value, field, max) {
+    const text = value?.trim() ?? '';
+    assertEndpoint(text.length <= max, `${field} must be at most ${max} characters`);
+    return text || null;
+}
+function readMethod(value) {
+    const method = (value ?? 'POST').trim().toUpperCase();
+    assertEndpoint(METHODS.some((candidate) => candidate === method), 'method must be POST, PUT or PATCH');
+    return method;
+}
+function readTimeout(value) {
+    if (value === null || value === undefined) {
+        return null;
+    }
+    assertEndpoint(Number.isInteger(value) &&
+        value > 0 &&
+        value <= workflow_webhook_options_1.WORKFLOW_WEBHOOK_MAX_TIMEOUT_MS, `timeoutMs must be an integer between 1 and ${workflow_webhook_options_1.WORKFLOW_WEBHOOK_MAX_TIMEOUT_MS}`);
+    return value;
+}
+function readParameters(parameters) {
+    const stored = parameters.map((parameter) => {
+        const key = parameter.key.trim();
+        assertEndpoint(KEY_PATTERN.test(key), 'a parameter key must be 1–100 letters, digits, ".", "_", ":" or "-"');
+        assertEndpoint(PARAMETER_TYPES.includes(parameter.type), `parameter "${key}" has an unsupported type`);
+        return {
+            description: readOptionalText(parameter.description, `parameter "${key}" description`, 500),
+            key,
+            label: readRequiredText(parameter.label, `parameter "${key}" label`, 200),
+            required: Boolean(parameter.required),
+            type: parameter.type,
+        };
+    });
+    const keys = stored.map((parameter) => parameter.key);
+    assertEndpoint(new Set(keys).size === keys.length, 'parameter keys must be unique');
+    return stored;
+}
+/** Order-independent: jsonb does not keep an object's key order. */
+function describeParameters(parameters) {
+    return JSON.stringify([...parameters]
+        .sort((left, right) => left.key.localeCompare(right.key))
+        .map((parameter) => [
+        parameter.key,
+        parameter.type,
+        parameter.required,
+        parameter.label,
+        parameter.description ?? null,
+    ]));
+}
+function readOrigin(url) {
+    try {
+        return new URL(url).origin;
+    }
+    catch {
+        return url;
+    }
+}
+function readDatabaseErrorCode(error) {
+    const code = typeof error === 'object' && error !== null
+        ? (error.code ??
+            error
+                .driverError?.code)
+        : null;
+    return typeof code === 'string' ? code : null;
+}
+function stableParameters(parameters) {
+    return JSON.stringify([...parameters]
+        .sort((left, right) => left.key.localeCompare(right.key))
+        .map((parameter) => [parameter.key, parameter.type, parameter.required]));
+}
+function readSampleEvent(row, occurredAt) {
+    const samples = {
+        boolean: true,
+        json: { sample: true },
+        number: 1,
+        string: 'sample',
+        stringArray: ['sample'],
+    };
+    return {
+        attempt: 1,
+        deliveryId: `test-${(0, node_crypto_1.randomUUID)()}`,
+        endpoint: { key: row.key, version: row.version },
+        eventType: 'workflow.notify',
+        initiator: { memberId: 'test-member' },
+        instance: {
+            id: 'test-instance',
+            templateId: 'test-template',
+            templateVersionId: 'test-template-version',
+            title: 'BPM Webhook 測試送出',
+        },
+        node: { id: 'test-node', label: '測試送出' },
+        occurredAt: occurredAt.toISOString(),
+        parameters: Object.fromEntries(row.parameters.map((parameter) => [
+            parameter.key,
+            samples[parameter.type],
+        ])),
+    };
+}
+//# sourceMappingURL=workflow-webhook-endpoint-admin.service.js.map

package/src/lib/workflow-webhook/workflow-webhook-endpoint-admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook-endpoint-admin.service.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook-endpoint-admin.service.ts"],"names":[],"mappings":";;;AA0lBA,wEAqBC;;AA/mBD,2CAKwB;AACxB,6CAAmD;AAEnD,2EAA6F;AAC7F,6CAAyC;AACzC,qCAAqC;AACrC,6EAA2E;AAC3E,yFAA2F;AAC3F,2FAG6C;AAC7C,yFAK4C;AAC5C,yEAKoC;AACpC,qFAA+E;AAC/E,uEAGmC;AACnC,yEAAoE;AA8CpE,MAAM,eAAe,GAA0C;IAC7D,SAAS;IACT,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,aAAa;CACd,CAAC;AACF,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAClD,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AACnE,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,6EAA6E;AAC7E,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,YAAY;IACZ,gBAAgB;IAChB,QAAQ;IACR,MAAM;IACN,YAAY;IACZ,kBAAkB;IAClB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAE1D,uEAAuE;AAC1D,QAAA,qCAAqC,GAAG,MAAM,CAAC;AAC/C,QAAA,+BAA+B,GAAG,OAAO,CAAC;AAC1C,QAAA,oCAAoC,GAAG,CAAC,CAAC;AAEtD;;;;;;GAMG;AAEI,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAK9C,YAEE,kBAA8E,EAE9E,eAAgF,EAC/D,cAAsC,EACtC,eAA+C,EAC/C,cAAqD,EAGtE,UAA8D,+DAAoC;QARjF,uBAAkB,GAAlB,kBAAkB,CAA2C;QAE7D,oBAAe,GAAf,eAAe,CAAgD;QAC/D,mBAAc,GAAd,cAAc,CAAwB;QACtC,oBAAe,GAAf,eAAe,CAAgC;QAC/C,mBAAc,GAAd,cAAc,CAAuC;QAGrD,YAAO,GAAP,OAAO,CAA0E;QAdpG,0EAA0E;QAC1E,8DAA8D;QAC7C,cAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IAa/D,CAAC;IAEJ,SAAS;QACP,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAClC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CACd,UAAkB;QAElB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC/B,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5B,IAAI,EAAE,GAAG;YACT,KAAK,EAAE,EAAE,UAAU,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAuC,EACvC,aAA4B;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAE5B,cAAc,CACZ,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EACrB,yDAAyD,CAC1D,CAAC;QACF,cAAc,CACZ,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,OAAO,IAAI,CAAC;YACjB,IAAI,CAAC,OAAO,IAAI,oDAAmC,EACrD,4CAA4C,oDAAmC,EAAE,CAClF,CAAC;QAEF,IACE,IAAI,CAAC,cAAc;aAChB,qBAAqB,EAAE;aACvB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,EACtD,CAAC;YACD,MAAM,IAAI,qDAA2B,CACnC,0DAAgC,CAAC,qBAAqB,EACtD,IAAI,GAAG,iDAAiD,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CACnC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAC9C,CAAC,CACF,CAAC;QAEF,cAAc,CACZ,IAAI,CAAC,OAAO,GAAG,aAAa,EAC5B,aAAa;YACX,CAAC,CAAC,IAAI,GAAG,yBAAyB,aAAa,yCAAyC;YACxF,CAAC,CAAC,oBAAoB,CACzB,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB;aACxC,IAAI,CACH,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC7B,iBAAiB,EAAE,aAAa;YAChC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,WAAW,EAAE,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC;YACpE,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACjE,sBAAsB,EAAE,IAAI,CAAC,aAAa,CACxC,MAAM,EACN,IAAI,CAAC,aAAa,CACnB;YACD,QAAQ,EAAE,IAAI;YACd,GAAG;YACH,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;YACjD,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/B,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;YAC3C,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;YACtC,iBAAiB,EAAE,aAAa;YAChC,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CACH;aACA,KAAK,CAAC,CAAC,KAAc,EAAS,EAAE;YAC/B,mEAAmE;YACnE,gEAAgE;YAChE,IAAI,qBAAqB,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC7C,MAAM,IAAI,qDAA2B,CACnC,0DAAgC,CAAC,gBAAgB,EACjD,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,iBAAiB,CAClD,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QAEL,MAAM,IAAI,CAAC,KAAK,CACd,KAAK,CAAC,EAAE,EACR,yEAAsC,CAAC,OAAO,EAC9C;YACE,KAAK;YACL,SAAS;YACT,OAAO;YACP,KAAK;YACL,QAAQ;YACR,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,EACD,aAAa,CACd,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,IAAuC,EACvC,aAA4B;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEnC,IACE,IAAI,CAAC,UAAU;YACf,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/C,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,qDAA2B,CACnC,0DAAgC,CAAC,yBAAyB,EAC1D,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,kCAAkC,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,CACvG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE9D,yEAAyE;QACzE,sEAAsE;QACtE,2DAA2D;QAC3D,cAAc,CACZ,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EACxE,sEAAsE,CACvE,CAAC;QAEF,MAAM,IAAI,GAA2C;YACnD,kEAAkE;YAClE,GAAG,CAAC,UAAU;gBACd,kBAAkB,CAAC,UAAU,CAAC,KAAK,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;gBACnE,CAAC,CAAC,EAAE,UAAU,EAAE;gBAChB,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBACrB,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,CAAC;oBACE,WAAW,EAAE,gBAAgB,CAC3B,IAAI,CAAC,WAAW,EAChB,aAAa,EACb,IAAI,CACL;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;gBAC9B,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,MAAM,OAAO,GAA2C,MAAM,CAAC,WAAW,CACxE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CACzB,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CACjB,KAAK,KAAK,YAAY,IAAI,GAAG,CAAC,KAAyB,CAAC,KAAK,KAAK,CACrE,CACF,CAAC;QACF,MAAM,aAAa,GAAG;YACpB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACvB,sEAAsE;YACtE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrC,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC;QACb,CAAC;QAED,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAClC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EACd;YACE,GAAG,OAAO;YACV,GAAG,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACP,iBAAiB,EAAE,aAAa;SACjC,CACF,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CACd,GAAG,CAAC,EAAE,EACN,yEAAsC,CAAC,OAAO,EAC9C,aAAa,EACb,aAAa,CACd,CAAC;QAEF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS,CACb,EAAU,EACV,MAAe,EACf,aAA4B;QAE5B,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEnC,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QAED,sEAAsE;QACtE,aAAa;QACb,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAClC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EACd,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,CACvD,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CACd,GAAG,CAAC,EAAE,EACN,MAAM;YACJ,CAAC,CAAC,yEAAsC,CAAC,OAAO;YAChD,CAAC,CAAC,yEAAsC,CAAC,QAAQ,EACnD,CAAC,UAAU,CAAC,EACZ,aAAa,CACd,CAAC;QAEF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,YAAY,CAChB,EAAU,EACV,aAA4B,EAC5B,aAA4B;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAClC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EACd;YACE,sBAAsB,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC;YACjE,eAAe,EAAE,IAAI,IAAI,EAAE;YAC3B,iBAAiB,EAAE,aAAa;SACjC,CACF,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CACd,GAAG,CAAC,EAAE,EACN,yEAAsC,CAAC,cAAc,EACrD,CAAC,eAAe,CAAC,EACjB,aAAa,CACd,CAAC;QAEF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACZ,EAAU,EACV,aAA4B,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAEhB,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAElC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CACtD,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EACrE,eAAe,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CACpC,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CACd,GAAG,CAAC,EAAE,EACN,yEAAsC,CAAC,SAAS,EAChD,EAAE,EACF,aAAa,CACd,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,eAAe,CAAC,UAAkB,EAAE,GAAW;QACrD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC1D,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,GAAG,uCAA+B,CAC3D,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvC,IACE,CAAC,IAAI,KAAK,SAAS;YACjB,GAAG,GAAG,IAAI,GAAG,6CAAqC,CAAC;YACrD,MAAM,CAAC,MAAM,IAAI,4CAAoC,EACrD,CAAC;YACD,MAAM,IAAI,qDAA2B,CACnC,0DAAgC,CAAC,iBAAiB,EAClD,mEAAmE,6CAAqC,GAAG,IAAI,UAAU,4CAAoC,QAAQ,uCAA+B,GAAG,MAAM,WAAW,CACzN,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAC3D,MAAM,IAAI,qDAA2B,CACnC,0DAAgC,CAAC,wBAAwB,EACzD,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,4DAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,0BAAiB,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,GAAe,EAAE;YAC/B,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,cAAc,CACZ,MAAM,KAAK,IAAI;YACb,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,EAC/D,qCAAqC,CACtC,CAAC;QACF,cAAc,CACZ,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,EACtC,sDAAsD,CACvD,CAAC;QAEF,IAAI,CAAC,IAAA,wDAA2B,EAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,qDAA2B,CACnC,0DAAgC,CAAC,eAAe,EAChD,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,cAAc,CACpB,MAAmC,EACnC,OAAqD;QAErD,cAAc,CACZ,OAAO,CAAC,MAAM,IAAI,WAAW,EAC7B,WAAW,WAAW,UAAU,CACjC,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAoB,EAAE;YACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAEhC,cAAc,CACZ,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9B,0BAA0B,CAC3B,CAAC;YACF,6CAA6C;YAC7C,cAAc,CACZ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACtC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAC3C,WAAW,IAAI,0CAA0C,CAC1D,CAAC;YACF,cAAc,CACZ,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAC9B,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,uBAAuB;gBAC9C,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EACzC,WAAW,IAAI,wBAAwB,CACxC,CAAC;YAEF,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAE1D,cAAc,CACZ,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EACpC,6BAA6B,CAC9B,CAAC;QAEF,OAAO,OAAO,CAAC,MAAM;YACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAEO,aAAa,CACnB,MAAmC,EACnC,MAAiC;QAEjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc,CACZ,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAClC,iCAAiC,iBAAiB,aAAa,CAChE,CAAC;QAEF,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,UAAkB,EAClB,MAA8C,EAC9C,aAAgC,EAChC,aAA4B;QAE5B,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAC1B,MAAM;YACN,aAAa;YACb,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE;YACjD,UAAU;SACX,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AAvdY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;IAOR,mBAAA,IAAA,0BAAgB,EAAC,gEAA6B,CAAC,CAAA;IAE/C,mBAAA,IAAA,0BAAgB,EAAC,qEAAkC,CAAC,CAAA;IAKpD,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,uDAA4B,CAAC,CAAA;6CAPA,oBAAU;QAEb,oBAAU;QACX,iDAAsB;QACrB,kEAA8B;QAC/B,wEAAqC;GAZ7D,mCAAmC,CAud/C;AAED;;;GAGG;AACH,SAAgB,8BAA8B,CAC5C,GAAkC,EAClC,mBAAkC;IAElC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAChC,IAAI,4DAA2B,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAC1D,GAAG,CAAC,gBAAgB,CACrB,CACF,CAAC;QAEF,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YAC5B,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,SAAkB,EAAE,MAAc;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,qDAA2B,CACnC,0DAAgC,CAAC,gBAAgB,EACjD,MAAM,CACP,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAI,KAA2B;IAC7C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa,EAAE,GAAW;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE1B,cAAc,CACZ,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EACrC,GAAG,KAAK,cAAc,GAAG,aAAa,CACvC,CAAC;IAEF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAgC,EAChC,KAAa,EACb,GAAW;IAEX,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEjC,cAAc,CACZ,IAAI,CAAC,MAAM,IAAI,GAAG,EAClB,GAAG,KAAK,oBAAoB,GAAG,aAAa,CAC7C,CAAC;IAEF,OAAO,IAAI,IAAI,IAAI,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,KAAgC;IAClD,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAEtD,cAAc,CACZ,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,EACjD,mCAAmC,CACpC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CACZ,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QACrB,KAAK,GAAG,CAAC;QACT,KAAK,IAAI,0DAA+B,EAC1C,8CAA8C,0DAA+B,EAAE,CAChF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,UAA2D;IAE3D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjC,cAAc,CACZ,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EACrB,qEAAqE,CACtE,CAAC;QACF,cAAc,CACZ,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EACxC,cAAc,GAAG,2BAA2B,CAC7C,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,gBAAgB,CAC3B,SAAS,CAAC,WAAW,EACrB,cAAc,GAAG,eAAe,EAChC,GAAG,CACJ;YACD,GAAG;YACH,KAAK,EAAE,gBAAgB,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,EAAE,GAAG,CAAC;YACzE,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YACrC,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAEtD,cAAc,CACZ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAClC,+BAA+B,CAChC,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CACzB,UAAqD;IAErD,OAAO,IAAI,CAAC,SAAS,CACnB,CAAC,GAAG,UAAU,CAAC;SACZ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QAClB,SAAS,CAAC,GAAG;QACb,SAAS,CAAC,IAAI;QACd,SAAS,CAAC,QAAQ;QAClB,SAAS,CAAC,KAAK;QACf,SAAS,CAAC,WAAW,IAAI,IAAI;KAC9B,CAAC,CACL,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QACzC,CAAC,CAAC,CACE,KAID,CAAC,IAAI;YACL,KAAgE;iBAC9D,WAAW,EAAE,IAAI,CAAC;QACvB,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAqD;IAErD,OAAO,IAAI,CAAC,SAAS,CACnB,CAAC,GAAG,UAAU,CAAC;SACZ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,GAAkC,EAClC,UAAgB;IAEhB,MAAM,OAAO,GAA0D;QACrE,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACtB,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,QAAQ;QAChB,WAAW,EAAE,CAAC,QAAQ,CAAC;KACxB,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,QAAQ,IAAA,wBAAU,GAAE,EAAE;QAClC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QAChD,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE;QACtC,QAAQ,EAAE;YACR,EAAE,EAAE,eAAe;YACnB,UAAU,EAAE,eAAe;YAC3B,iBAAiB,EAAE,uBAAuB;YAC1C,KAAK,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;QACxC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,UAAU,EAAE,MAAM,CAAC,WAAW,CAC5B,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YAChC,SAAS,CAAC,GAAG;YACb,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;SACxB,CAAC,CACH;KACF,CAAC;AACJ,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook-endpoint.entity.d.ts

@@ -0,0 +1,52 @@
+import { NotifyWebhookParameterType } from '@rytass/bpm-core-shared/workflow';
+/** A parameter as stored on a database endpoint; same shape as the registry's. */
+export interface WorkflowWebhookStoredParameter {
+    readonly description: string | null;
+    readonly key: string;
+    readonly label: string;
+    readonly required: boolean;
+    readonly type: NotifyWebhookParameterType;
+}
+/**
+ * A NOTIFY webhook endpoint maintained by a BPM administrator (ADR 18
+ * §3.13). Not a GraphQL type: the admin view masks every header value and
+ * the signing secret, and only says whether they are set.
+ */
+export declare class WorkflowWebhookEndpointEntity {
+    id: string;
+    key: string;
+    version: number;
+    label: string;
+    description: string | null;
+    parameters: readonly WorkflowWebhookStoredParameter[];
+    url: string;
+    method: string;
+    /** Envelope of a JSON `{ name: value }` object; `null` for no headers. */
+    encryptedHeaders: string | null;
+    encryptedSigningSecret: string | null;
+    timeoutMs: number | null;
+    isActive: boolean;
+    deprecated: boolean;
+    secretRotatedAt: Date | null;
+    createdByMemberId: string | null;
+    updatedByMemberId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare enum WorkflowWebhookEndpointAuditActionEnum {
+    CREATED = "CREATED",
+    DISABLED = "DISABLED",
+    ENABLED = "ENABLED",
+    SECRET_ROTATED = "SECRET_ROTATED",
+    TEST_SENT = "TEST_SENT",
+    UPDATED = "UPDATED"
+}
+/** Who changed which fields of an endpoint, and when. Never a value. */
+export declare class WorkflowWebhookEndpointAuditEntity {
+    id: string;
+    endpointId: string;
+    action: WorkflowWebhookEndpointAuditActionEnum;
+    changedFields: readonly string[];
+    actorMemberId: string | null;
+    createdAt: Date;
+}