@rytass/bpm-core-nestjs-module 0.13.3 → 0.13.5

package/src/lib/workflow-webhook/workflow-webhook.service.js

@@ -0,0 +1,221 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkflowWebhookService = void 0;
+exports.readRegistryDescriptorErrors = readRegistryDescriptorErrors;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const workflow_webhook_allowlist_1 = require("./workflow-webhook-allowlist");
+const workflow_graph_1 = require("@rytass/bpm-core-shared/workflow-graph");
+const workflow_webhook_database_source_1 = require("./workflow-webhook-database-source");
+const workflow_webhook_options_1 = require("./workflow-webhook-options");
+const workflow_webhook_types_1 = require("./workflow-webhook.types");
+/**
+ * Wraps the host's synchronous registry as an endpoint source so the catalog,
+ * the publish lint and (from P2) the delivery path only ever talk to the
+ * source interface. P6 adds the database source beside this one without
+ * touching any of them.
+ */
+class RegistryWorkflowWebhookEndpointSource {
+    constructor(registry) {
+        this.registry = registry;
+        this.kind = 'REGISTRY';
+    }
+    async get(key, version) {
+        return this.registry.get(key, version);
+    }
+    async list() {
+        return this.registry.list();
+    }
+}
+let WorkflowWebhookService = class WorkflowWebhookService {
+    constructor(registry, options = workflow_webhook_options_1.DEFAULT_BPM_WORKFLOW_WEBHOOK_OPTIONS, databaseSource) {
+        this.registry = registry;
+        this.options = options;
+        this.databaseSource = databaseSource;
+        this.sources = this.options.targetSources.flatMap((kind) => {
+            if (kind === 'REGISTRY') {
+                return this.registry
+                    ? [new RegistryWorkflowWebhookEndpointSource(this.registry)]
+                    : [];
+            }
+            return this.databaseSource ? [this.databaseSource] : [];
+        });
+    }
+    /**
+     * Whether administrators can manage endpoints in the database: requested
+     * in `workflowWebhookTargetSources` and guarded by an allowlist and an
+     * encryption key (otherwise the options resolution dropped it).
+     */
+    hasDatabaseSource() {
+        return this.sources.some((source) => source.kind === 'DATABASE');
+    }
+    /** Registered endpoints only; used to keep database keys from colliding. */
+    listRegistryEndpoints() {
+        return this.registry?.list() ?? [];
+    }
+    /**
+     * A descriptor that contradicts itself would only surface as a confusing
+     * publish error much later, so the registry is checked once at boot and the
+     * application refuses to start instead.
+     */
+    onModuleInit() {
+        const errors = readRegistryDescriptorErrors(this.registry);
+        if (errors.length) {
+            throw new Error(`Invalid BPM webhook endpoint registry: ${errors.join('; ')}`);
+        }
+    }
+    /**
+     * `false` when no source can ever answer, which is what a publish lint needs
+     * in order to refuse a template that references any endpoint at all.
+     */
+    hasEndpointSources() {
+        return this.sources.length > 0;
+    }
+    async listEndpoints(options = {}) {
+        const lists = await Promise.all(this.sources.map(async (source) => (await source.list()).map((endpoint) => ({
+            endpoint,
+            source: source.kind,
+        }))));
+        return lists
+            .flat()
+            .filter((entry, index, entries) => 
+        // Source order decides: an endpoint registered in code wins over a
+        // database row that claims the same key.
+        entries.findIndex((candidate) => (0, workflow_webhook_types_1.readWorkflowWebhookEndpointKey)(candidate.endpoint.descriptor) ===
+            (0, workflow_webhook_types_1.readWorkflowWebhookEndpointKey)(entry.endpoint.descriptor)) === index)
+            .filter((entry) => Boolean(options.includeDeprecated) ||
+            !entry.endpoint.descriptor.deprecated);
+    }
+    /**
+     * `manager` lets a caller already inside a transaction (the engine's
+     * enqueue) look endpoints up on its own connection, instead of waiting on
+     * a second one from a pool its peers may have exhausted.
+     */
+    async getEndpoint(key, version, manager) {
+        for (const source of this.sources) {
+            const endpoint = await source.get(key, version, manager);
+            if (endpoint) {
+                return { endpoint, source: source.kind };
+            }
+        }
+        return null;
+    }
+    readOptions() {
+        return this.options;
+    }
+    /**
+     * The publish-time allowlist check (ADR 18 §3.13 rule 3). Database
+     * endpoints only: calling host code while publishing would be a surprise,
+     * and registry URLs are checked before each delivery when enforcement is
+     * on. A URL that cannot be read here is left to the delivery path.
+     */
+    async isEndpointUrlAllowedAtPublish(entry) {
+        if (entry.source !== 'DATABASE') {
+            return true;
+        }
+        const url = await Promise.resolve()
+            .then(() => entry.endpoint.buildRequest(PUBLISH_CHECK_EVENT))
+            .then((request) => typeof request?.url === 'string' ? request.url : null, () => null);
+        return (url === null ||
+            (0, workflow_webhook_allowlist_1.isWorkflowWebhookUrlAllowed)(url, this.options.allowedUrlPatterns));
+    }
+};
+exports.WorkflowWebhookService = WorkflowWebhookService;
+exports.WorkflowWebhookService = WorkflowWebhookService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, common_1.Optional)()),
+    tslib_1.__param(0, (0, common_1.Inject)(workflow_webhook_types_1.BPM_WORKFLOW_WEBHOOK_REGISTRY)),
+    tslib_1.__param(1, (0, common_1.Optional)()),
+    tslib_1.__param(1, (0, common_1.Inject)(workflow_webhook_options_1.BPM_WORKFLOW_WEBHOOK_OPTIONS)),
+    tslib_1.__param(2, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [Object, Object, workflow_webhook_database_source_1.DatabaseWorkflowWebhookEndpointSource])
+], WorkflowWebhookService);
+/** Only used to read a database endpoint's URL; never sent anywhere. */
+const PUBLISH_CHECK_EVENT = {
+    attempt: 0,
+    deliveryId: 'publish-check',
+    endpoint: { key: 'publish-check', version: 1 },
+    eventType: 'workflow.notify',
+    initiator: { memberId: 'publish-check' },
+    instance: {
+        id: 'publish-check',
+        templateId: 'publish-check',
+        templateVersionId: 'publish-check',
+        title: 'publish-check',
+    },
+    node: { id: 'publish-check', label: 'publish-check' },
+    occurredAt: new Date(0).toISOString(),
+    parameters: {},
+};
+const PARAMETER_TYPES = [
+    'boolean',
+    'json',
+    'number',
+    'string',
+    'stringArray',
+];
+function readRegistryDescriptorErrors(registry) {
+    if (!registry) {
+        return [];
+    }
+    const endpoints = registry.list();
+    const seen = new Set();
+    return endpoints.flatMap((endpoint, index) => {
+        const descriptor = endpoint?.descriptor;
+        // A host-code mistake should fail the boot with a sentence, not with
+        // "cannot read properties of undefined".
+        if (!descriptor || typeof descriptor !== 'object') {
+            return [`endpoint #${index} has no descriptor`];
+        }
+        if (typeof descriptor.key !== 'string' ||
+            typeof descriptor.label !== 'string') {
+            return [`endpoint #${index} must have a string key and label`];
+        }
+        const id = (0, workflow_webhook_types_1.readWorkflowWebhookEndpointKey)(descriptor);
+        const duplicate = seen.has(id);
+        seen.add(id);
+        if (!Array.isArray(descriptor.parameters)) {
+            return [`${id} must declare parameters as an array`];
+        }
+        // Compared trimmed, like the template-side structural lint, so " a" and
+        // "a" cannot both be declared and then collide in a binding.
+        const parameterKeys = descriptor.parameters.map((parameter) => typeof parameter?.key === 'string' ? parameter.key.trim() : '');
+        return [
+            ...(descriptor.key?.trim() ? [] : ['an endpoint has an empty key']),
+            ...(descriptor.key !== descriptor.key?.trim()
+                ? [`${id} key must not have surrounding whitespace`]
+                : []),
+            // The catalog exposes `version` as a GraphQL Int: one value past the
+            // int32 range fails the whole query, not just this endpoint.
+            ...(Number.isInteger(descriptor.version) &&
+                descriptor.version >= 1 &&
+                descriptor.version <= workflow_graph_1.NOTIFY_WEBHOOK_ENDPOINT_VERSION_MAX
+                ? []
+                : [
+                    `${id} must have an integer version between 1 and ${workflow_graph_1.NOTIFY_WEBHOOK_ENDPOINT_VERSION_MAX}`,
+                ]),
+            ...(descriptor.label?.trim() ? [] : [`${id} must have a label`]),
+            ...(duplicate ? [`${id} is registered more than once`] : []),
+            ...(new Set(parameterKeys).size === parameterKeys.length
+                ? []
+                : [`${id} has duplicate parameter keys`]),
+            ...descriptor.parameters.flatMap((parameter, index) => [
+                ...(parameterKeys[index]
+                    ? []
+                    : [`${id} has a parameter with an empty key`]),
+                ...(typeof parameter?.key === 'string' &&
+                    parameter.key !== parameter.key.trim()
+                    ? [
+                        `${id} parameter "${parameter.key}" must not have surrounding whitespace`,
+                    ]
+                    : []),
+                ...(PARAMETER_TYPES.includes(parameter?.type)
+                    ? []
+                    : [
+                        `${id} parameter "${parameterKeys[index]}" has unsupported type "${String(parameter?.type)}"`,
+                    ]),
+            ]),
+        ];
+    });
+}
+//# sourceMappingURL=workflow-webhook.service.js.map

package/src/lib/workflow-webhook/workflow-webhook.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook.service.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook.service.ts"],"names":[],"mappings":";;;AA8NA,oEA8EC;;AA5SD,2CAA4E;AAE5E,6EAA2E;AAE3E,2EAA6F;AAC7F,yFAA2F;AAC3F,yEAIoC;AACpC,qEAQkC;AAElC;;;;;GAKG;AACH,MAAM,qCAAqC;IAGzC,YAA6B,QAAoC;QAApC,aAAQ,GAAR,QAAQ,CAA4B;QAFxD,SAAI,GAAG,UAAmB,CAAC;IAEgC,CAAC;IAErE,KAAK,CAAC,GAAG,CACP,GAAW,EACX,OAAe;QAEf,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;CACF;AAOM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAGjC,YAGmB,QAAgD,EAGhD,UAA6C,+DAAoC,EAEjF,cAAsD;QALtD,aAAQ,GAAR,QAAQ,CAAwC;QAGhD,YAAO,GAAP,OAAO,CAA0E;QAEjF,mBAAc,GAAd,cAAc,CAAwC;QAEvE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAC/C,CAAC,IAAI,EAA+C,EAAE;YACpD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,QAAQ;oBAClB,CAAC,CAAC,CAAC,IAAI,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC5D,CAAC,CAAC,EAAE,CAAC;YACT,CAAC;YAED,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACnE,CAAC;IAED,4EAA4E;IAC5E,qBAAqB;QACnB,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,UAA+C,EAAE;QAEjD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAChC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACvC,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,IAAI;SACpB,CAAC,CAAC,CACJ,CACF,CAAC;QAEF,OAAO,KAAK;aACT,IAAI,EAAE;aACN,MAAM,CACL,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,mEAAmE;QACnE,yCAAyC;QACzC,OAAO,CAAC,SAAS,CACf,CAAC,SAAS,EAAE,EAAE,CACZ,IAAA,uDAA8B,EAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7D,IAAA,uDAA8B,EAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC5D,KAAK,KAAK,CACd;aACA,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAClC,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CACxC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,GAAW,EACX,OAAe,EACf,OAAuB;QAEvB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAEzD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,6BAA6B,CACjC,KAAsC;QAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;aAChC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;aAC5D,IAAI,CACH,CAAC,OAAO,EAAiB,EAAE,CACzB,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EACvD,GAAS,EAAE,CAAC,IAAI,CACjB,CAAC;QAEJ,OAAO,CACL,GAAG,KAAK,IAAI;YACZ,IAAA,wDAA2B,EAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAClE,CAAC;IACJ,CAAC;CACF,CAAA;AAjJY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAKR,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,sDAA6B,CAAC,CAAA;IAErC,mBAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,eAAM,EAAC,uDAA4B,CAAC,CAAA;IAEpC,mBAAA,IAAA,iBAAQ,GAAE,CAAA;6DACuB,wEAAqC;GAX9D,sBAAsB,CAiJlC;AAED,wEAAwE;AACxE,MAAM,mBAAmB,GAA4B;IACnD,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,eAAe;IAC3B,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,EAAE;IAC9C,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;IACxC,QAAQ,EAAE;QACR,EAAE,EAAE,eAAe;QACnB,UAAU,EAAE,eAAe;QAC3B,iBAAiB,EAAE,eAAe;QAClC,KAAK,EAAE,eAAe;KACvB;IACD,IAAI,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE;IACrD,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;IACrC,UAAU,EAAE,EAAE;CACf,CAAC;AAEF,MAAM,eAAe,GAA0C;IAC7D,SAAS;IACT,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,aAAa;CACd,CAAC;AAEF,SAAgB,4BAA4B,CAC1C,QAAgD;IAEhD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,CAAC;QAExC,qEAAqE;QACrE,yCAAyC;QACzC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,CAAC,aAAa,KAAK,oBAAoB,CAAC,CAAC;QAClD,CAAC;QAED,IACE,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ;YAClC,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO,CAAC,aAAa,KAAK,mCAAmC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,EAAE,GAAG,IAAA,uDAA8B,EAAC,UAAU,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE/B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACvD,CAAC;QAED,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5D,OAAO,SAAS,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAC;QAEF,OAAO;YACL,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;YACnE,GAAG,CAAC,UAAU,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE;gBAC3C,CAAC,CAAC,CAAC,GAAG,EAAE,2CAA2C,CAAC;gBACpD,CAAC,CAAC,EAAE,CAAC;YACP,qEAAqE;YACrE,6DAA6D;YAC7D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;gBACxC,UAAU,CAAC,OAAO,IAAI,CAAC;gBACvB,UAAU,CAAC,OAAO,IAAI,oDAAmC;gBACvD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,GAAG,EAAE,+CAA+C,oDAAmC,EAAE;iBAC1F,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAChE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM;gBACtD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAC3C,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC;oBACtB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;gBAChD,GAAG,CAAC,OAAO,SAAS,EAAE,GAAG,KAAK,QAAQ;oBACtC,SAAS,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;oBACpC,CAAC,CAAC;wBACE,GAAG,EAAE,eAAe,SAAS,CAAC,GAAG,wCAAwC;qBAC1E;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;oBAC3C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,GAAG,EAAE,eAAe,aAAa,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG;qBAC9F,CAAC;aACP,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook.types.d.ts

@@ -0,0 +1,127 @@
+import { InjectionToken } from '@nestjs/common';
+import type { EntityManager } from 'typeorm';
+import { NotifyWebhookParameterType } from '@rytass/bpm-core-shared/workflow';
+/**
+ * Where an endpoint definition came from (ADR 18 §3.13).
+ *
+ * `REGISTRY` endpoints are registered by host code, so their URL has already
+ * been through code review. `DATABASE` endpoints are maintained by a BPM
+ * administrator and only exist once P6 ships; the catalog, the publish lint
+ * and the delivery path are written against this union from P1 so that phase
+ * adds a source rather than rewriting them.
+ */
+export type BPMWorkflowWebhookEndpointSourceKind = 'DATABASE' | 'REGISTRY';
+export interface BPMWorkflowWebhookParameter {
+    readonly description?: string;
+    readonly key: string;
+    readonly label: string;
+    readonly required: boolean;
+    readonly type: NotifyWebhookParameterType;
+}
+export interface BPMWorkflowWebhookEndpointDescriptor {
+    /**
+     * Hidden from the designer's endpoint picker, but still deliverable: a
+     * template that already references it keeps working.
+     */
+    readonly deprecated?: boolean;
+    readonly description?: string;
+    /**
+     * Switched off by an administrator (database endpoints, P6). Unlike
+     * `deprecated`, nothing is delivered any more: queued and new deliveries
+     * fail with `WEBHOOK_ENDPOINT_DISABLED`, and templates cannot publish it.
+     */
+    readonly disabled?: boolean;
+    readonly key: string;
+    readonly label: string;
+    readonly parameters: readonly BPMWorkflowWebhookParameter[];
+    readonly version: number;
+}
+/**
+ * One NOTIFY webhook event, as handed to the host's `buildRequest()` and, when
+ * the host supplies no body, serialized as the request body itself
+ * (ADR 18 §3.4).
+ */
+export interface BPMWorkflowWebhookEvent {
+    /** Which attempt this is, from 1. Does not affect idempotency. */
+    readonly attempt: number;
+    /** Stable across retries; the receiver's idempotency key. */
+    readonly deliveryId: string;
+    readonly endpoint: {
+        readonly key: string;
+        readonly version: number;
+    };
+    readonly eventType: 'workflow.notify';
+    readonly initiator: {
+        readonly memberId: string;
+    };
+    readonly instance: {
+        readonly id: string;
+        readonly templateId: string;
+        readonly templateVersionId: string;
+        readonly title: string;
+    };
+    readonly node: {
+        readonly id: string;
+        readonly label: string;
+    };
+    /** When the node ran, not when this attempt is being sent. */
+    readonly occurredAt: string;
+    /** Only the parameters the template bound; never the whole form. */
+    readonly parameters: Readonly<Record<string, unknown>>;
+}
+export interface BPMWorkflowWebhookRequest {
+    /** Omitted: BPM sends the JSON-serialized event. */
+    readonly body?: string;
+    readonly headers?: Readonly<Record<string, string>>;
+    /** Omitted: POST. */
+    readonly method?: 'PATCH' | 'POST' | 'PUT';
+    /** Set to have BPM add the signature headers (ADR 18 §3.6). */
+    readonly signingSecret?: string;
+    readonly timeoutMs?: number;
+    readonly url: string;
+}
+export interface BPMWorkflowWebhookEndpoint {
+    readonly descriptor: BPMWorkflowWebhookEndpointDescriptor;
+    /**
+     * Called once per delivery attempt, never at enqueue time, so a rotated
+     * credential or a moved URL takes effect on deliveries that are already
+     * queued and on in-flight instances.
+     */
+    buildRequest(event: BPMWorkflowWebhookEvent): Promise<BPMWorkflowWebhookRequest>;
+}
+/**
+ * The host-facing catalog: a plain, synchronous lookup so a host can back it
+ * with a literal list. Asynchronous sources (the database one) implement
+ * {@link BPMWorkflowWebhookEndpointSource} instead.
+ */
+export interface BPMWorkflowWebhookRegistry {
+    get(key: string, version: number): BPMWorkflowWebhookEndpoint | null;
+    list(): readonly BPMWorkflowWebhookEndpoint[];
+}
+export declare const BPM_WORKFLOW_WEBHOOK_REGISTRY: InjectionToken<BPMWorkflowWebhookRegistry>;
+/** One endpoint plus the source it was resolved from. */
+export interface BPMWorkflowWebhookEndpointEntry {
+    readonly endpoint: BPMWorkflowWebhookEndpoint;
+    readonly source: BPMWorkflowWebhookEndpointSourceKind;
+}
+/**
+ * Internal abstraction over "where endpoints come from". Asynchronous because
+ * the database source (P6) reads a table; the registry source resolves
+ * immediately.
+ */
+export interface BPMWorkflowWebhookEndpointSource {
+    readonly kind: BPMWorkflowWebhookEndpointSourceKind;
+    get(key: string, version: number, manager?: EntityManager): Promise<BPMWorkflowWebhookEndpoint | null>;
+    list(): Promise<readonly BPMWorkflowWebhookEndpoint[]>;
+}
+export declare class EmptyBPMWorkflowWebhookRegistry implements BPMWorkflowWebhookRegistry {
+    get(key: string, version: number): BPMWorkflowWebhookEndpoint | null;
+    list(): readonly BPMWorkflowWebhookEndpoint[];
+}
+export declare class StaticBPMWorkflowWebhookRegistry implements BPMWorkflowWebhookRegistry {
+    private readonly endpoints;
+    constructor(endpoints: readonly BPMWorkflowWebhookEndpoint[]);
+    get(key: string, version: number): BPMWorkflowWebhookEndpoint | null;
+    list(): readonly BPMWorkflowWebhookEndpoint[];
+}
+export declare function readWorkflowWebhookEndpointKey(descriptor: BPMWorkflowWebhookEndpointDescriptor): string;

package/src/lib/workflow-webhook/workflow-webhook.types.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaticBPMWorkflowWebhookRegistry = exports.EmptyBPMWorkflowWebhookRegistry = exports.BPM_WORKFLOW_WEBHOOK_REGISTRY = void 0;
+exports.readWorkflowWebhookEndpointKey = readWorkflowWebhookEndpointKey;
+exports.BPM_WORKFLOW_WEBHOOK_REGISTRY = Symbol('BPM_WORKFLOW_WEBHOOK_REGISTRY');
+class EmptyBPMWorkflowWebhookRegistry {
+    get(key, version) {
+        void key;
+        void version;
+        return null;
+    }
+    list() {
+        return [];
+    }
+}
+exports.EmptyBPMWorkflowWebhookRegistry = EmptyBPMWorkflowWebhookRegistry;
+class StaticBPMWorkflowWebhookRegistry {
+    constructor(endpoints) {
+        this.endpoints = [...endpoints];
+    }
+    get(key, version) {
+        return (this.endpoints.find((endpoint) => endpoint.descriptor.key === key &&
+            endpoint.descriptor.version === version) ?? null);
+    }
+    list() {
+        return this.endpoints;
+    }
+}
+exports.StaticBPMWorkflowWebhookRegistry = StaticBPMWorkflowWebhookRegistry;
+function readWorkflowWebhookEndpointKey(descriptor) {
+    return `${descriptor.key}@${descriptor.version}`;
+}
+//# sourceMappingURL=workflow-webhook.types.js.map

package/src/lib/workflow-webhook/workflow-webhook.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook.types.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook.types.ts"],"names":[],"mappings":";;;AA2KA,wEAIC;AAhEY,QAAA,6BAA6B,GACxC,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAwB1C,MAAa,+BAA+B;IAC1C,GAAG,CAAC,GAAW,EAAE,OAAe;QAC9B,KAAK,GAAG,CAAC;QACT,KAAK,OAAO,CAAC;QAEb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAXD,0EAWC;AAED,MAAa,gCAAgC;IAG3C,YAAY,SAAgD;QAC1D,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,OAAe;QAC9B,OAAO,CACL,IAAI,CAAC,SAAS,CAAC,IAAI,CACjB,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG;YAC/B,QAAQ,CAAC,UAAU,CAAC,OAAO,KAAK,OAAO,CAC1C,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF;AApBD,4EAoBC;AAED,SAAgB,8BAA8B,CAC5C,UAAgD;IAEhD,OAAO,GAAG,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;AACnD,CAAC"}

package/src/lib/workflow-webhook/workflow-webhook.validator.d.ts

@@ -0,0 +1,20 @@
+import { FormDefinitionSchema } from '@rytass/bpm-core-shared/form';
+import { WorkflowDefinition } from '@rytass/bpm-core-shared/workflow';
+import { BPMWorkflowWebhookEndpointEntry } from './workflow-webhook.types';
+export interface LintWorkflowWebhookTargetsInput {
+    readonly definition: WorkflowDefinition;
+    readonly formSchema: FormDefinitionSchema;
+    readonly hasEndpointSources: boolean;
+    readonly resolveEndpoint: (key: string, version: number) => Promise<BPMWorkflowWebhookEndpointEntry | null>;
+    /**
+     * Whether an endpoint's current URL is inside the allowlist (ADR 18 §3.13
+     * rule 3). Omitted: not checked at publish, only before each delivery.
+     */
+    readonly isEndpointUrlAllowed?: (entry: BPMWorkflowWebhookEndpointEntry) => Promise<boolean>;
+}
+/**
+ * The publish rules that need the endpoint catalog and the bound form
+ * (ADR 18 §4, items 2 and 5–8). The registry-independent shape rules run
+ * earlier, in the shared structural lint.
+ */
+export declare function lintWorkflowWebhookTargets(input: LintWorkflowWebhookTargetsInput): Promise<readonly string[]>;

package/src/lib/workflow-webhook/workflow-webhook.validator.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lintWorkflowWebhookTargets = lintWorkflowWebhookTargets;
+const workflow_graph_1 = require("@rytass/bpm-core-shared/workflow-graph");
+const workflow_webhook_errors_1 = require("./workflow-webhook.errors");
+/**
+ * The publish rules that need the endpoint catalog and the bound form
+ * (ADR 18 §4, items 2 and 5–8). The registry-independent shape rules run
+ * earlier, in the shared structural lint.
+ */
+async function lintWorkflowWebhookTargets(input) {
+    const nodes = input.definition.nodes.filter((node) => node.type === 'serviceTask' &&
+        (0, workflow_graph_1.readNotifyWebhookTargets)(node.data.action).length > 0);
+    if (!nodes.length) {
+        return [];
+    }
+    if (!input.hasEndpointSources) {
+        return nodes.map((node) => `workflow.nodes.${node.id}.action.webhooks cannot be published: no webhook endpoint source is configured (${workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.REGISTRY_MISSING})`);
+    }
+    const results = await Promise.all(nodes.flatMap((node) => {
+        const webhooks = node.data.action.type === 'NOTIFY' ? node.data.action.webhooks : [];
+        const issues = (0, workflow_graph_1.readNotifyWebhookStructureIssues)(webhooks);
+        // A list-level problem (not an array, over the limit) leaves no target
+        // worth resolving. Otherwise only the malformed targets are skipped:
+        // the shared structural lint already reports them, and reading parsed
+        // JSON nobody validated would throw instead of adding to that list.
+        if (issues.some((issue) => issue.targetIndex === null)) {
+            return [];
+        }
+        const malformedTargets = new Set(issues.map((issue) => issue.targetIndex));
+        return (0, workflow_graph_1.readNotifyWebhookTargets)(node.data.action).flatMap((target, targetIndex) => malformedTargets.has(targetIndex)
+            ? []
+            : [
+                lintTarget({
+                    formSchema: input.formSchema,
+                    isEndpointUrlAllowed: input.isEndpointUrlAllowed,
+                    nodeId: node.id,
+                    resolveEndpoint: input.resolveEndpoint,
+                    target,
+                    targetIndex,
+                }),
+            ]);
+    }));
+    return results.flat();
+}
+async function lintTarget({ formSchema, isEndpointUrlAllowed, nodeId, resolveEndpoint, target, targetIndex, }) {
+    const entry = await resolveEndpoint(target.endpoint.key, target.endpoint.version);
+    const path = `workflow.nodes.${nodeId}.action.webhooks[${targetIndex}]`;
+    const catalogIssues = (0, workflow_graph_1.readNotifyWebhookTargetCatalogIssues)({
+        endpoint: entry?.endpoint.descriptor ?? null,
+        formFields: formSchema.fields,
+        target,
+    }).map((issue) => readCatalogIssueMessage(issue, target, path));
+    // A saved endpoint whose URL a tightened allowlist no longer covers would
+    // fail every delivery; say so now rather than after the case runs.
+    const urlAllowed = !entry || catalogIssues.length || !isEndpointUrlAllowed
+        ? true
+        : await isEndpointUrlAllowed(entry);
+    return [
+        ...catalogIssues,
+        ...(urlAllowed
+            ? []
+            : [
+                `${path}.endpoint ${target.endpoint.key}@${target.endpoint.version} calls a URL outside workflowWebhookAllowedUrlPatterns (${workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES.URL_NOT_ALLOWED})`,
+            ]),
+    ];
+}
+/** The developer-facing, path-style wording of the shared catalog rules. */
+function readCatalogIssueMessage(issue, target, path) {
+    const endpoint = `${target.endpoint.key}@${target.endpoint.version}`;
+    const bindingPath = `${path}.bindings[${issue.bindingIndex ?? 0}]`;
+    const parameter = issue.parameter ?? '';
+    const codes = workflow_webhook_errors_1.BPM_WORKFLOW_WEBHOOK_ERROR_CODES;
+    switch (issue.code) {
+        case 'ENDPOINT_MISSING':
+            return `${path}.endpoint ${endpoint} is not registered (${codes.ENDPOINT_MISSING})`;
+        case 'ENDPOINT_DEPRECATED':
+            return `${path}.endpoint ${endpoint} is deprecated (${codes.ENDPOINT_DEPRECATED})`;
+        case 'ENDPOINT_DISABLED':
+            return `${path}.endpoint ${endpoint} is disabled (${codes.ENDPOINT_DISABLED})`;
+        case 'PARAMETER_REQUIRED':
+            return `${path}.bindings is missing required parameter "${parameter}" (${codes.PARAMETER_REQUIRED})`;
+        case 'PARAMETER_UNKNOWN':
+            return `${bindingPath}.parameter "${parameter}" is not declared by the endpoint (${codes.PARAMETER_UNKNOWN})`;
+        case 'FIELD_MISSING':
+            return `${bindingPath}.from.fieldKey "${issue.fieldKey ?? ''}" does not match a schema field (${codes.BINDING_INCOMPATIBLE})`;
+        case 'FIELD_INCOMPATIBLE':
+            return `${bindingPath}.from.fieldKey "${issue.fieldKey ?? ''}" (${issue.fieldType ?? ''}) cannot fill parameter "${parameter}" (${issue.parameterType ?? ''}) (${codes.BINDING_INCOMPATIBLE})`;
+        case 'CONSTANT_REQUIRED_NULL':
+            return `${bindingPath}.from.value cannot be null for required parameter "${parameter}" (${codes.BINDING_INCOMPATIBLE})`;
+        case 'CONSTANT_INCOMPATIBLE':
+            return `${bindingPath}.from.value does not fit parameter "${parameter}" (${issue.parameterType ?? ''}) (${codes.BINDING_INCOMPATIBLE})`;
+        case 'CONTEXT_INCOMPATIBLE':
+            return `${bindingPath}.from.path is a string and cannot fill parameter "${parameter}" (${issue.parameterType ?? ''}) (${codes.BINDING_INCOMPATIBLE})`;
+    }
+}
+//# sourceMappingURL=workflow-webhook.validator.js.map

package/src/lib/workflow-webhook/workflow-webhook.validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-webhook.validator.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/workflow-webhook/workflow-webhook.validator.ts"],"names":[],"mappings":";;AAqCA,gEAyDC;AAxFD,2EAKgD;AAChD,uEAA6E;AAoB7E;;;;GAIG;AACI,KAAK,UAAU,0BAA0B,CAC9C,KAAsC;IAEtC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CACzC,CAAC,IAAI,EAA0D,EAAE,CAC/D,IAAI,CAAC,IAAI,KAAK,aAAa;QAC3B,IAAA,yCAAwB,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CACxD,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,GAAG,CACd,CAAC,IAAI,EAAE,EAAE,CACP,kBAAkB,IAAI,CAAC,EAAE,mFAAmF,0DAAgC,CAAC,gBAAgB,GAAG,CACnK,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACrB,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,IAAA,iDAAgC,EAAC,QAAQ,CAAC,CAAC;QAE1D,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CACzC,CAAC;QAEF,OAAO,IAAA,yCAAwB,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CACvD,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CACtB,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,UAAU,CAAC;oBACT,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;oBAChD,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,eAAe,EAAE,KAAK,CAAC,eAAe;oBACtC,MAAM;oBACN,WAAW;iBACZ,CAAC;aACH,CACR,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EACxB,UAAU,EACV,oBAAoB,EACpB,MAAM,EACN,eAAe,EACf,MAAM,EACN,WAAW,GAQZ;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,EACnB,MAAM,CAAC,QAAQ,CAAC,OAAO,CACxB,CAAC;IAEF,MAAM,IAAI,GAAG,kBAAkB,MAAM,oBAAoB,WAAW,GAAG,CAAC;IACxE,MAAM,aAAa,GAAG,IAAA,qDAAoC,EAAC;QACzD,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;QAC5C,UAAU,EAAE,UAAU,CAAC,MAAM;QAC7B,MAAM;KACP,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAEhE,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,UAAU,GACd,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,IAAI,CAAC,oBAAoB;QACrD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAExC,OAAO;QACL,GAAG,aAAa;QAChB,GAAG,CAAC,UAAU;YACZ,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,GAAG,IAAI,aAAa,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,2DAA2D,0DAAgC,CAAC,eAAe,GAAG;aACjL,CAAC;KACP,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,uBAAuB,CAC9B,KAAgC,EAChC,MAA2B,EAC3B,IAAY;IAEZ,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrE,MAAM,WAAW,GAAG,GAAG,IAAI,aAAa,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC;IACnE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,0DAAgC,CAAC;IAE/C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,kBAAkB;YACrB,OAAO,GAAG,IAAI,aAAa,QAAQ,uBAAuB,KAAK,CAAC,gBAAgB,GAAG,CAAC;QACtF,KAAK,qBAAqB;YACxB,OAAO,GAAG,IAAI,aAAa,QAAQ,mBAAmB,KAAK,CAAC,mBAAmB,GAAG,CAAC;QACrF,KAAK,mBAAmB;YACtB,OAAO,GAAG,IAAI,aAAa,QAAQ,iBAAiB,KAAK,CAAC,iBAAiB,GAAG,CAAC;QACjF,KAAK,oBAAoB;YACvB,OAAO,GAAG,IAAI,4CAA4C,SAAS,MAAM,KAAK,CAAC,kBAAkB,GAAG,CAAC;QACvG,KAAK,mBAAmB;YACtB,OAAO,GAAG,WAAW,eAAe,SAAS,sCAAsC,KAAK,CAAC,iBAAiB,GAAG,CAAC;QAChH,KAAK,eAAe;YAClB,OAAO,GAAG,WAAW,mBAAmB,KAAK,CAAC,QAAQ,IAAI,EAAE,oCAAoC,KAAK,CAAC,oBAAoB,GAAG,CAAC;QAChI,KAAK,oBAAoB;YACvB,OAAO,GAAG,WAAW,mBAAmB,KAAK,CAAC,QAAQ,IAAI,EAAE,MAAM,KAAK,CAAC,SAAS,IAAI,EAAE,4BAA4B,SAAS,MAAM,KAAK,CAAC,aAAa,IAAI,EAAE,MAAM,KAAK,CAAC,oBAAoB,GAAG,CAAC;QACjM,KAAK,wBAAwB;YAC3B,OAAO,GAAG,WAAW,sDAAsD,SAAS,MAAM,KAAK,CAAC,oBAAoB,GAAG,CAAC;QAC1H,KAAK,uBAAuB;YAC1B,OAAO,GAAG,WAAW,uCAAuC,SAAS,MAAM,KAAK,CAAC,aAAa,IAAI,EAAE,MAAM,KAAK,CAAC,oBAAoB,GAAG,CAAC;QAC1I,KAAK,sBAAsB;YACzB,OAAO,GAAG,WAAW,qDAAqD,SAAS,MAAM,KAAK,CAAC,aAAa,IAAI,EAAE,MAAM,KAAK,CAAC,oBAAoB,GAAG,CAAC;IAC1J,CAAC;AACH,CAAC"}