@snagset/server 0.0.1

package/dist/keys.js

@@ -0,0 +1,77 @@
+import { createHash, hkdfSync, timingSafeEqual } from "node:crypto";
+import { SCHEMA_VERSION } from "./vendor/types/names.js";
+const PURPOSES = [
+    "reviewer-session",
+    "credential-enc",
+    "attachment-url",
+    "webhook-sign",
+    "unsubscribe",
+];
+/**
+ * The salt: the 32 RAW bytes of `sha256(SCHEMA_VERSION)`, not its hex text.
+ *
+ * Hex would be a 64-byte salt wearing a 32-byte name, and the difference is
+ * invisible until two builds disagree. Tying it to the schema id means the
+ * same secret under a future schema derives different keys, which is the point
+ * 08 §4.10 makes: keys do not leak across schema generations.
+ */
+const SALT = createHash("sha256").update(SCHEMA_VERSION).digest();
+/** 32 bytes for every purpose. HS256 wants ≥ 32; AES-256-GCM wants exactly 32. */
+const KEY_BYTES = 32;
+export class KeyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "KeyError";
+    }
+}
+/**
+ * `kid` — which key signed this, so verification does not have to guess.
+ *
+ * 05 §4.4 mandates it in the JWT header and defines it nowhere; 08 §4.10 now
+ * does. First 8 bytes of `sha256(secret)`, base64url, 11 characters. It is not
+ * a secret — it is a fingerprint of one, and 8 bytes is far more than enough to
+ * tell two keys apart while revealing nothing about either.
+ */
+export function keyId(secret) {
+    return createHash("sha256").update(secret).digest("base64url").slice(0, 11);
+}
+export function createKeyring(secret, previous) {
+    if (!secret)
+        throw new KeyError("no signing key — SNAGSET_SECRET_KEY is empty");
+    const cache = new Map();
+    const derive = (s, purpose) => {
+        if (!PURPOSES.includes(purpose)) {
+            // Unreachable through the type, reachable through JSON, a plugin, or a
+            // future edit. Loud, because the silent version signs with a real key.
+            throw new KeyError(`"${purpose}" is not a KeyPurpose. The union is closed (08 §4.10): ${PURPOSES.join(", ")}.`);
+        }
+        const memo = `${keyId(s)}:${purpose}`;
+        let k = cache.get(memo);
+        if (!k) {
+            // `info` is the UTF-8 bytes of the purpose literal — the only thing
+            // separating the four keys. A case or separator difference is a
+            // different key, and nothing anywhere would say so.
+            k = Buffer.from(hkdfSync("sha256", Buffer.from(s, "utf8"), SALT, Buffer.from(purpose, "utf8"), KEY_BYTES));
+            cache.set(memo, k);
+        }
+        return k;
+    };
+    const currentKid = keyId(secret);
+    const previousKid = previous ? keyId(previous) : null;
+    return {
+        kid: currentKid,
+        derive: (purpose) => derive(secret, purpose),
+        forKid(kid, purpose) {
+            // Constant-time on the kid too. It is not secret, but comparing it with
+            // `===` makes one more thing in the auth path timing-variable for no
+            // saving at all.
+            const eq = (a, b) => a.length === b.length && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+            if (eq(kid, currentKid))
+                return derive(secret, purpose);
+            if (previous && previousKid && eq(kid, previousKid))
+                return derive(previous, purpose);
+            return null;
+        },
+    };
+}
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgCtD,MAAM,QAAQ,GAA0B;IACtC,kBAAkB;IAClB,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,aAAa;CACd,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CAAC;AAElE,kFAAkF;AAClF,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,KAAK,CAAC,MAAc;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAkBD,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAA6B;IACzE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,QAAQ,CAAC,8CAA8C,CAAC,CAAC;IAEhF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,OAAmB,EAAU,EAAE;QACxD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,IAAI,QAAQ,CAChB,IAAI,OAAO,0DAA0D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,oEAAoE;YACpE,gEAAgE;YAChE,oDAAoD;YACpD,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAC3G,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtD,OAAO;QACL,GAAG,EAAE,UAAU;QACf,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAC5C,MAAM,CAAC,GAAG,EAAE,OAAO;YACjB,wEAAwE;YACxE,qEAAqE;YACrE,iBAAiB;YACjB,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAC3C,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3E,IAAI,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC;gBAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,QAAQ,IAAI,WAAW,IAAI,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC;gBAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mail/index.js

@@ -0,0 +1,75 @@
+import { createResendMailer } from "./resend.js";
+import { createSmtpMailer } from "./smtp.js";
+export { isConfigured } from "./mailer.js";
+/**
+ * Which transports this build can speak. Exported so the boot error can name
+ * them rather than describing them, and so a test can assert the list rather
+ * than a sentence about the list.
+ */
+export const MAIL_SCHEMES = ["smtp", "smtps", "resend"];
+/**
+ * Choose a transport from ONE variable, by its scheme — the only place that
+ * decision is made.
+ *
+ * ── WHY THE SCHEME AND NOT A VARIABLE PER VENDOR ──
+ *
+ * The first shape was `SNAGSET_RESEND_API_KEY` beside `SNAGSET_SMTP_URL`, and
+ * it was wrong for a reason that only shows up on the third provider: a
+ * vendor's name in the KEY means every new provider costs a new variable, a
+ * new precedence rule, and a new boot-time answer to "which one wins if two
+ * are set". The scheme puts that information in the value, where it belongs —
+ * `resend://re_…`, `smtp://user:pass@host:587` — so adding Postmark is a new
+ * case in one function and no new configuration at all. An operator moving
+ * from their own mail server to a provider edits one line.
+ *
+ * 08 §4.8's other rules, implemented rather than restated:
+ *
+ *   · Unset ⇒ notifications are **off and say so**. Not queued. A feature that
+ *     is off and visible is an operator's decision; one that queues rows
+ *     nobody will deliver is a bug that surfaces three weeks later as "did
+ *     that email ever send?".
+ *   · A transport without a From address is a BOOT failure, not a runtime one:
+ *     every send would fail identically, and the operator should learn that
+ *     now rather than from the first missing notification.
+ *   · An unknown scheme is also a boot failure. Falling back to "no mail"
+ *     would leave someone who configured mail believing it works, which is the
+ *     worst of the three outcomes.
+ */
+export function selectMailer(cfg) {
+    const raw = cfg.get("SNAGSET_MAIL_URL");
+    const from = cfg.get("SNAGSET_MAIL_FROM");
+    if (!raw) {
+        return {
+            kind: "none",
+            reason: "no mail transport is configured, so notifications are off. Set SNAGSET_MAIL_URL " +
+                "to resend://<api-key> (recommended — the provider owns SPF/DKIM) or to " +
+                "smtp://user:pass@host:587, together with SNAGSET_MAIL_FROM.",
+        };
+    }
+    // Parsed by hand rather than with `new URL`: a Resend key is the AUTHORITY
+    // component of `resend://re_abc123`, and WHATWG URL lower-cases hostnames.
+    // An API key is case-sensitive, so `new URL().hostname` would silently
+    // corrupt it and produce a 401 that looks like a bad key rather than a bad
+    // parser.
+    const at = raw.indexOf("://");
+    const scheme = at === -1 ? "" : raw.slice(0, at).toLowerCase();
+    const rest = at === -1 ? "" : raw.slice(at + 3);
+    if (!MAIL_SCHEMES.includes(scheme)) {
+        throw new Error(`SNAGSET_MAIL_URL has an unsupported scheme ${JSON.stringify(scheme || raw.slice(0, 12))}. ` +
+            `This build speaks: ${MAIL_SCHEMES.map((s) => `${s}://`).join(", ")}.`);
+    }
+    if (!from) {
+        throw new Error("SNAGSET_MAIL_URL is set but SNAGSET_MAIL_FROM is not. Every message needs a From " +
+            "address, so this would fail on the first send rather than here.");
+    }
+    if (scheme === "resend") {
+        if (!rest)
+            throw new Error("SNAGSET_MAIL_URL is resend:// with no API key after it.");
+        // A trailing slash is what a browser or a copy-paste adds; it is not part
+        // of the key, and a key with one on the end fails authentication in a way
+        // that reads as "wrong key".
+        return createResendMailer(rest.replace(/\/+$/, ""), from);
+    }
+    return createSmtpMailer({ url: raw, from });
+}
+//# sourceMappingURL=index.js.map

package/dist/mail/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mail/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAE1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EACJ,kFAAkF;gBAClF,yEAAyE;gBACzE,6DAA6D;SAChE,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,UAAU;IACV,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAEhD,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI;YAC1F,sBAAsB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACtF,0EAA0E;QAC1E,0EAA0E;QAC1E,6BAA6B;QAC7B,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC"}

package/dist/mail/mailer.js

@@ -0,0 +1,27 @@
+/**
+ * The `Mailer` seam — LOCK L7, and built BEFORE the first notification call
+ * site exists, which is the entire point of naming it in the lock.
+ *
+ * *"otherwise the transport gets imported in eight places, and the import lint
+ * is what catches the ninth."* Everything that sends mail depends on this
+ * interface; exactly one module per adapter touches a transport. `mail.test.ts`
+ * asserts that by grep, because a rule nothing checks is a rule that lasts
+ * until the next feature.
+ *
+ * ── WHY TWO ADAPTERS, WHEN ONE WOULD RUN ──
+ *
+ * They answer different questions. `http` (Resend) is the DELIVERABILITY
+ * answer: a provider owns SPF, DKIM and DMARC, and a self-hosted box mailing
+ * third-party addresses without them lands in spam — which no amount of
+ * retrying fixes, because the mail was accepted and then filed away. `smtp` is
+ * the SOVEREIGNTY answer: an operator who already runs a mail server should not
+ * have to add a vendor to a product whose pitch is that it self-hosts.
+ *
+ * Neither is required. `DATABASE_URL` remains the only mandatory variable
+ * (LOCK L5), and with no transport configured notifications are OFF AND SAY SO
+ * rather than queueing rows nobody will deliver.
+ */
+export function isConfigured(m) {
+    return m.kind !== "none";
+}
+//# sourceMappingURL=mailer.js.map

package/dist/mail/mailer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailer.js","sourceRoot":"","sources":["../../src/mail/mailer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAyDH,MAAM,UAAU,YAAY,CAAC,CAAe;IAC1C,OAAO,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;AAC3B,CAAC"}

package/dist/mail/notify.js

@@ -0,0 +1,405 @@
+import { createHash, randomUUID } from "node:crypto";
+import { sanitise, sanitiseWithRedactor } from "../vendor/adapters/index.js";
+import { redactText } from "../vendor/widget/predicates.js";
+import { isConfigured } from "./mailer.js";
+import { unsubscribeHeaders, unsubscribeToken } from "./unsubscribe.js";
+/**
+ * Notification email — L1.4, and deliberately ONE event.
+ *
+ * `comment.created` → the project owner, and nothing else. Not because the
+ * others are hard, but because of who they mail: `thread.created` and
+ * `thread.resolved` go to *reviewers*, whose addresses are self-declared and
+ * unverified, and a system that mails unverified third-party addresses on a
+ * stranger's trigger is an open relay with extra steps. The owner's address is
+ * one we verified at claim time, so with only owner mail that abuse surface
+ * does not exist yet. The rest lands with full M2-32, behind subscription and
+ * unsubscribe.
+ *
+ * ── HOW "A RETRY NEVER DOUBLE-SENDS" IS ACTUALLY ACHIEVED ──
+ *
+ * Two mechanisms, and both are needed:
+ *
+ *   1. **Enqueue is idempotent.** The row is inserted in the SAME transaction
+ *      as the comment, with `dedupe_key = 'comment.created:<commentId>'` and
+ *      `UNIQUE (provider, dedupe_key)` behind it. A retried request that
+ *      re-creates the same comment cannot create a second row.
+ *   2. **Claiming is atomic.** The delivery job moves a row `pending →
+ *      inflight` with `UPDATE … WHERE status = 'pending' … RETURNING` and
+ *      `SKIP LOCKED`, so two instances draining at once take disjoint sets.
+ *
+ * What neither can prevent is a crash between "the provider accepted it" and
+ * "we wrote `done`". That window is real and cannot be closed without a
+ * distributed transaction across an HTTP API; the honest posture is to make it
+ * SMALL and to fail toward not-sending rather than toward sending twice — so
+ * the row is marked `inflight` before the send and only a completed send
+ * writes `done`. A row stuck `inflight` is visible and is not retried
+ * automatically, because an automatic retry is exactly the duplicate.
+ */
+const TOPIC = "comment.created";
+/**
+ * Queue one notification, INSIDE the caller's transaction.
+ *
+ * Taking `tx` rather than a pool is the whole design: 07 §2.5 requires outbox
+ * rows to be inserted in the same transaction as the domain mutation, and the
+ * reason is not tidiness. A comment that commits without its notification row
+ * is a notification that never happens; a notification row that commits
+ * without its comment is mail about something that does not exist. Only one
+ * transaction can rule out both.
+ *
+ * `ON CONFLICT DO NOTHING` rather than an error: a duplicate here means the
+ * caller retried, which is the case the dedupe key exists to absorb quietly.
+ */
+export async function queueCommentNotice(tx, notice, id) {
+    const payload = {
+        threadKey: notice.threadKey,
+        authorName: notice.authorName,
+        body: notice.body,
+        pageUrl: notice.pageUrl,
+        commentId: notice.commentId,
+    };
+    // THE OWNER's row. No recipient in the event: the delivery job reads that
+    // absence as "the project owner", which is what every row queued before
+    // this fan-out existed also means. Backward compatibility by shape rather
+    // than by version flag.
+    await tx `
+    INSERT INTO outbox (id, org_id, project_id, thread_id, provider, topic, dedupe_key, event)
+    VALUES (
+      ${id}, ${notice.orgId}, ${notice.projectId}, ${notice.threadId},
+      'email', ${TOPIC}, ${`${TOPIC}:${notice.commentId}`}, ${tx.json(payload)}
+    )
+    ON CONFLICT (provider, dedupe_key) DO NOTHING
+  `;
+    /**
+     * …and ONE ROW PER PARTICIPANT — B2's "created or replied".
+     *
+     * Fanned out at enqueue rather than at send, because every guarantee this
+     * system has is per-row: `UNIQUE (provider, dedupe_key)` makes a retry a
+     * no-op for THAT recipient, and a provider rejecting one address cannot
+     * take the others down with it. One row addressed to N people would have
+     * neither property.
+     *
+     * The subscription rule is derived, not stored — a reviewer is subscribed to
+     * a thread because they wrote on it. There is deliberately no endpoint that
+     * subscribes an arbitrary address, because that endpoint is the one an
+     * abuser wants.
+     *
+     * Excluded: the author of this very comment (nobody needs mail about their
+     * own typing), anyone with no address, anyone who unsubscribed, and anyone
+     * blocked or erased.
+     */
+    await fanOut(tx, {
+        orgId: notice.orgId,
+        projectId: notice.projectId,
+        threadId: notice.threadId,
+        topic: TOPIC,
+        keyPrefix: `${TOPIC}:${notice.commentId}`,
+        exclude: notice.authorId,
+        payload,
+    });
+}
+/**
+ * Everyone who took part in a thread, minus one person, each in their own row.
+ *
+ * Shared by both topics because the SUBSCRIPTION RULE is the thing that must
+ * not drift: "created or replied" answered in two places is how the two
+ * answers diverge, and the divergence is always in the direction of mailing
+ * somebody who did not ask.
+ */
+async function fanOut(tx, o) {
+    const participants = await tx `
+    SELECT DISTINCT r.id
+      FROM comments c
+      JOIN reviewers r ON r.id = c.author_id
+     WHERE c.thread_id = ${o.threadId}
+       AND c.deleted_at IS NULL
+       AND r.id <> ${o.exclude}::uuid
+       AND r.email IS NOT NULL
+       AND r.notifications_off_at IS NULL
+       AND r.blocked_at IS NULL
+       AND r.erased_at IS NULL
+  `;
+    for (const p of participants) {
+        await tx `
+      INSERT INTO outbox (id, org_id, project_id, thread_id, provider, topic, dedupe_key, event)
+      VALUES (
+        ${randomUUID()}, ${o.orgId}, ${o.projectId}, ${o.threadId},
+        'email', ${o.topic}, ${`${o.keyPrefix}:${p.id}`},
+        ${tx.json({ ...o.payload, toReviewer: p.id })}
+      )
+      ON CONFLICT (provider, dedupe_key) DO NOTHING
+    `;
+    }
+}
+const RESOLVED = "thread.resolved";
+/**
+ * "Somebody marked your snag resolved" — B2's second topic.
+ *
+ * This one goes to PARTICIPANTS and not to the owner, which is the opposite of
+ * `comment.created` and deliberate: resolving is almost always the studio's own
+ * act, and mailing the owner about a button they just pressed is the noise that
+ * teaches people to filter the sender.
+ *
+ * The dedupe key carries `threads.version`, which is 05 §3's documented
+ * composition (`'<topic>:<entityId>:<threads.version>'`) and matters here more
+ * than anywhere else: a thread can be resolved, reopened and resolved again,
+ * and each of those is a real event that people should hear about. Keying on
+ * the thread id alone would send the first one and silently swallow every
+ * reopening after it.
+ */
+export async function queueResolvedNotice(tx, notice) {
+    await fanOut(tx, {
+        orgId: notice.orgId,
+        projectId: notice.projectId,
+        threadId: notice.threadId,
+        topic: RESOLVED,
+        keyPrefix: `${RESOLVED}:${notice.threadId}:${notice.version}`,
+        exclude: notice.actorId,
+        payload: {
+            threadKey: notice.threadKey,
+            actorName: notice.actorName,
+            pageUrl: notice.pageUrl,
+            resolved: true,
+        },
+    });
+}
+/** Retry ladder, in minutes. Five attempts over roughly an hour, then the row
+ *  is `failed` and stays for the dashboard's "these never sent" list — 05
+ *  §3.11 step 14 keeps failed rows until an operator dismisses them. */
+const BACKOFF_MIN = [1, 5, 15, 30, 60];
+/**
+ * The delivery job. Registered only when a mailer is configured — with none,
+ * there is nothing to drain and the absence is reported at boot instead.
+ */
+export function deliverEmail(mailer, baseUrl, keys) {
+    return {
+        name: "deliver-email",
+        everyMs: 30_000,
+        async run({ sql, now, log }) {
+            if (!isConfigured(mailer))
+                return { did: 0 };
+            // Claim ONE row at a time. A batch would be faster and would also mean
+            // that one provider timeout takes the whole batch's rows to `inflight`
+            // with nothing sent. One row per pass, `more: true` to drain — the
+            // engine's batching, reused rather than reinvented.
+            const [row] = await sql `
+        UPDATE outbox SET status = 'inflight', attempts = attempts + 1
+         WHERE id = (
+           SELECT id FROM outbox
+            WHERE provider = 'email'
+              AND status = 'pending'
+              AND next_attempt_at <= ${now}
+            ORDER BY next_attempt_at
+            FOR UPDATE SKIP LOCKED
+            LIMIT 1
+         )
+        RETURNING id, org_id, project_id, thread_id, attempts, event
+      `;
+            if (!row)
+                return { did: 0 };
+            /**
+             * WHO this row is for. Absent `toReviewer` means the project owner —
+             * which is also what every row queued before the fan-out existed means,
+             * so the absence is the compatibility story rather than a version flag.
+             */
+            const to = await recipient(sql, row, keys, baseUrl);
+            if (!to) {
+                // Nothing to send this to is not a transient failure and is not
+                // retried: it is `dropped`, the status 07 §2.5 has for exactly this.
+                // Reached when the owner is gone, or when a reviewer unsubscribed,
+                // was blocked or erased between enqueue and send — which is a real
+                // window, and re-checking here is what closes it.
+                await sql `UPDATE outbox SET status = 'dropped', last_error = 'no deliverable recipient', completed_at = ${now} WHERE id = ${row.id}`;
+                return { did: 0, more: true, note: "one notification had no recipient — dropped" };
+            }
+            /**
+             * PER-ADDRESS RATE LIMIT — B2's last piece.
+             *
+             * A busy round can produce a burst: five people replying on one thread
+             * inside a minute is four notifications each. That is not abuse, it is
+             * a lively review, and the remedy is not to drop mail but to slow it —
+             * so an address over its hourly allowance has the row DEFERRED to the
+             * end of its window rather than dropped. Nothing is lost; it arrives
+             * late, which is the correct trade for a notification.
+             *
+             * The bucket key is a HASH of the address, never the address itself.
+             * `rate_counters` is a durable table that outlives the mail it governs,
+             * and 08 §4.7's rule about not keeping raw identifiers applies to a
+             * counter as much as to a log.
+             */
+            const over = await overRateLimit(sql, row.org_id, to.email, now);
+            if (over) {
+                await sql `
+          UPDATE outbox
+             SET status = 'pending', next_attempt_at = ${over},
+                 last_error = 'rate limited for this address'
+           WHERE id = ${row.id}`;
+                return { did: 0, more: true, note: "one notification deferred — address over its hourly rate" };
+            }
+            try {
+                await mailer.send({ ...render(row, to.email, baseUrl), ...(to.headers ? { headers: to.headers } : {}) });
+                await sql `
+          UPDATE outbox SET status = 'done', completed_at = ${now}, last_error = NULL
+           WHERE id = ${row.id}`;
+                return { did: 1, more: true };
+            }
+            catch (e) {
+                const message = e instanceof Error ? e.message : String(e);
+                const wait = BACKOFF_MIN[Math.min(row.attempts - 1, BACKOFF_MIN.length - 1)];
+                const exhausted = row.attempts >= BACKOFF_MIN.length;
+                await sql `
+          UPDATE outbox
+             SET status = ${exhausted ? "failed" : "pending"},
+                 last_error = ${message},
+                 next_attempt_at = ${new Date(now.getTime() + wait * 60_000)}
+           WHERE id = ${row.id}`;
+                log(`jobs: deliver-email: attempt ${row.attempts} failed: ${message}`);
+                // `more` even on failure: the NEXT row may be fine, and one bad
+                // recipient must not stall the queue behind it.
+                return { did: 0, more: true };
+            }
+        },
+    };
+}
+/**
+ * How many notifications one address may receive per hour.
+ *
+ * A constant rather than a registered variable, on purpose: 08 §4's config is
+ * generated from the spec, and a number nobody has yet wanted to change is not
+ * worth a variable an operator has to read past. It becomes one the first time
+ * somebody asks — which is a better trigger than a guess.
+ *
+ * Twelve is roughly "a busy thread every five minutes" and well under what any
+ * provider treats as a pattern.
+ */
+const PER_ADDRESS_HOURLY = 12;
+const RATE_WINDOW_MS = 60 * 60 * 1000;
+/**
+ * Count this send against the address's hourly allowance.
+ *
+ * Returns null when it is within the allowance, or the time the window resets
+ * when it is not. The counter is incremented BEFORE the send, so a provider
+ * timeout still consumes the allowance — deliberately, because the alternative
+ * is a failing address retrying without limit.
+ */
+async function overRateLimit(sql, orgId, email, now) {
+    const key = `mail:${createHash("sha256").update(email.toLowerCase()).digest("base64url")}`;
+    const windowStart = new Date(now.getTime() - RATE_WINDOW_MS);
+    const [row] = await sql `
+    INSERT INTO rate_counters (org_id, bucket_key, window_start, count, expires_at)
+    VALUES (${orgId}, ${key}, ${now}, 1, ${new Date(now.getTime() + RATE_WINDOW_MS)})
+    ON CONFLICT (org_id, bucket_key) DO UPDATE
+      SET count = CASE WHEN rate_counters.window_start < ${windowStart} THEN 1
+                       ELSE rate_counters.count + 1 END,
+          window_start = CASE WHEN rate_counters.window_start < ${windowStart} THEN ${now}
+                              ELSE rate_counters.window_start END,
+          expires_at = CASE WHEN rate_counters.window_start < ${windowStart}
+                            THEN ${new Date(now.getTime() + RATE_WINDOW_MS)}
+                            ELSE rate_counters.expires_at END
+    RETURNING count::text, window_start
+  `;
+    if (!row)
+        return null;
+    if (Number(row.count) <= PER_ADDRESS_HOURLY)
+        return null;
+    return new Date(new Date(row.window_start).getTime() + RATE_WINDOW_MS);
+}
+/**
+ * The address this row goes to, and the headers that go with it.
+ *
+ * Returns null when there is nobody to send to — including the reviewer who
+ * unsubscribed AFTER the row was queued. That re-check is not belt-and-braces:
+ * the outbox retries over an hour, and "I clicked unsubscribe and then got
+ * another one" is precisely the complaint the feature exists to prevent.
+ *
+ * Only REVIEWER mail carries `List-Unsubscribe`. The owner is the operator of
+ * the instance: they did not receive a message from a stranger, they configured
+ * the mailer that sends it, and the control they need is a setting rather than
+ * a link. Giving them a one-click opt-out signed over a reviewer id they do not
+ * have would be a link that cannot work.
+ */
+async function recipient(sql, row, keys, baseUrl) {
+    const reviewerId = row.event.toReviewer;
+    if (reviewerId) {
+        const [r] = await sql `
+      SELECT email FROM reviewers
+       WHERE id = ${reviewerId}::uuid
+         AND notifications_off_at IS NULL
+         AND blocked_at IS NULL
+         AND erased_at IS NULL`;
+        if (!r?.email)
+            return null;
+        // No keyring means no signable link, and an unsubscribe header we cannot
+        // honour is worse than none: send the mail without it rather than mint a
+        // URL that 404s.
+        return keys
+            ? { email: r.email, headers: unsubscribeHeaders(baseUrl, unsubscribeToken(keys, reviewerId)) }
+            : { email: r.email };
+    }
+    const [owner] = await sql `
+    SELECT u.email
+      FROM memberships m
+      JOIN users u ON u.id = m.user_id
+     WHERE m.org_id = ${row.org_id} AND m.role = 'owner' AND u.deleted_at IS NULL
+     ORDER BY m.created_at
+     LIMIT 1`;
+    return owner ? { email: owner.email } : null;
+}
+/**
+ * The message.
+ *
+ * Every reviewer-supplied string goes through the sanitiser (L1.3) before it
+ * reaches a subject line or a body — this is a channel we do not control, and
+ * the name and body are exactly the Class R/P fields 07 §2.6 is about. The
+ * body additionally gets the redactor, because a comment can contain anything
+ * the reviewer typed, including an address or a token they pasted in.
+ *
+ * Text only, no HTML. An HTML part would need its own escaping rules on top of
+ * the ones above, and the message is four lines: who, where, what, and a link.
+ * There is nothing here that a `<div>` would make clearer.
+ */
+function render(row, to, baseUrl) {
+    const key = sanitise(row.event.threadKey ?? "a snag", "plain", { singleLine: true, max: 24 });
+    const author = sanitise(row.event.authorName ?? "Someone", "plain", { singleLine: true, max: 60 });
+    const body = sanitiseWithRedactor(row.event.body ?? "", "plain", redactText, { max: 2000 });
+    const page = row.event.pageUrl ?? "";
+    /**
+     * `thread.resolved` — a different message, not the comment one with a
+     * different noun. It carries NO body, because there is no new text: the
+     * event is a state change, and padding it with the original comment would
+     * re-send words the recipient already has.
+     */
+    if (row.event.resolved) {
+        const actor = sanitise(row.event.actorName ?? "Someone", "plain", { singleLine: true, max: 60 });
+        return {
+            to,
+            subject: `${key} was marked resolved`,
+            text: [
+                `${actor} marked ${key} resolved.`,
+                "",
+                page ? `On the page: ${page}` : "",
+                `See the round: ${baseUrl}/dashboard`,
+                "",
+                "— Snagset",
+            ]
+                .filter((line, i, all) => !(line === "" && all[i - 1] === ""))
+                .join("\n"),
+        };
+    }
+    return {
+        to,
+        subject: `${key}: new comment from ${author}`,
+        text: [
+            `${author} commented on ${key}:`,
+            "",
+            body,
+            "",
+            page ? `On the page: ${page}` : "",
+            `Open the review: ${baseUrl}/dashboard`,
+            "",
+            "— Snagset",
+        ]
+            .filter((line, i, all) => !(line === "" && all[i - 1] === ""))
+            .join("\n"),
+    };
+}
+//# sourceMappingURL=notify.js.map

package/dist/mail/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/mail/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAqB,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAgBhC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAA0C,EAC1C,MAAqB,EACrB,EAAU;IAEV,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IAEF,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,wBAAwB;IACxB,MAAM,EAAE,CAAA;;;QAGF,EAAE,KAAK,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ;iBACnD,KAAK,KAAK,GAAG,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;;GAG3E,CAAC;IAEF;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,MAAM,CAAC,EAAE,EAAE;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,GAAG,KAAK,IAAI,MAAM,CAAC,SAAS,EAAE;QACzC,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,MAAM,CACnB,EAA0C,EAC1C,CAUC;IAED,MAAM,YAAY,GAAG,MAAM,EAAE,CAAkB;;;;2BAItB,CAAC,CAAC,QAAQ;;qBAEhB,CAAC,CAAC,OAAO;;;;;GAK3B,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,EAAE,CAAA;;;UAGF,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,QAAQ;mBAC9C,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,EAAE;UAC7C,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;;;KAGhD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAenC;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAA0C,EAC1C,MAAsB;IAEtB,MAAM,MAAM,CAAC,EAAE,EAAE;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE;QAC7D,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE;YACP,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,IAAI;SACf;KACF,CAAC,CAAC;AACL,CAAC;AAqBD;;wEAEwE;AACxE,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,OAAe,EAAE,IAAc;IAChF,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,MAAM;QACf,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAc;YACrC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAE7C,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,oDAAoD;YACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAa;;;;;;uCAMH,GAAG;;;;;;OAMnC,CAAC;YACF,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAE5B;;;;eAIG;YACH,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,gEAAgE;gBAChE,qEAAqE;gBACrE,mEAAmE;gBACnE,mEAAmE;gBACnE,kDAAkD;gBAClD,MAAM,GAAG,CAAA,iGAAiG,GAAG,eAAe,GAAG,CAAC,EAAE,EAAE,CAAC;gBACrI,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,6CAA6C,EAAE,CAAC;YACrF,CAAC;YAED;;;;;;;;;;;;;;eAcG;YACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjE,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,CAAA;;yDAEwC,IAAI;;wBAErC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACzB,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,0DAA0D,EAAE,CAAC;YAClG,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACzG,MAAM,GAAG,CAAA;8DAC6C,GAAG;wBACzC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACzB,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAChC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAE,CAAC;gBAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAC,MAAM,CAAC;gBACrD,MAAM,GAAG,CAAA;;4BAEW,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gCAC5B,OAAO;qCACF,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC;wBACpD,GAAG,CAAC,EAAE,EAAE,CAAC;gBACzB,GAAG,CAAC,gCAAgC,GAAG,CAAC,QAAQ,YAAY,OAAO,EAAE,CAAC,CAAC;gBACvE,gEAAgE;gBAChE,gDAAgD;gBAChD,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,GAA2C,EAC3C,KAAa,EACb,KAAa,EACb,GAAS;IAET,MAAM,GAAG,GAAG,QAAQ,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3F,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC;IAE7D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAyC;;cAEpD,KAAK,KAAK,GAAG,KAAK,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;;2DAExB,WAAW;;kEAEJ,WAAW,SAAS,GAAG;;gEAEzB,WAAW;mCACxC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;;;GAGxE,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,SAAS,CACtB,GAA2C,EAC3C,GAAc,EACd,IAAyB,EACzB,OAAe;IAEf,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;IACxC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAA4B;;oBAEjC,UAAU;;;+BAGC,CAAC;QAC5B,IAAI,CAAC,CAAC,EAAE,KAAK;YAAE,OAAO,IAAI,CAAC;QAC3B,yEAAyE;QACzE,yEAAyE;QACzE,iBAAiB;QACjB,OAAO,IAAI;YACT,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,EAAE;YAC9F,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAqB;;;;wBAIxB,GAAG,CAAC,MAAM;;aAErB,CAAC;IACZ,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,MAAM,CAAC,GAAc,EAAE,EAAU,EAAE,OAAe;IAKzD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,SAAS,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IAErC;;;;;OAKG;IACH,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,SAAS,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO;YACL,EAAE;YACF,OAAO,EAAE,GAAG,GAAG,sBAAsB;YACrC,IAAI,EAAE;gBACJ,GAAG,KAAK,WAAW,GAAG,YAAY;gBAClC,EAAE;gBACF,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;gBAClC,kBAAkB,OAAO,YAAY;gBACrC,EAAE;gBACF,WAAW;aACZ;iBACE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;iBAC7D,IAAI,CAAC,IAAI,CAAC;SACd,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE;QACF,OAAO,EAAE,GAAG,GAAG,sBAAsB,MAAM,EAAE;QAC7C,IAAI,EAAE;YACJ,GAAG,MAAM,iBAAiB,GAAG,GAAG;YAChC,EAAE;YACF,IAAI;YACJ,EAAE;YACF,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;YAClC,oBAAoB,OAAO,YAAY;YACvC,EAAE;YACF,WAAW;SACZ;aACE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC;KACd,CAAC;AACJ,CAAC"}