@stratusagent/gateway 0.13.6 → 0.14.0

package/dist/event-intake.d.ts

@@ -0,0 +1,141 @@
+import { type JsonObject } from '@stratusagent/core';
+import { type EventFilter, type InboundEvent } from '@stratusagent/agents';
+import type { EventSourceConfig } from '@stratusagent/state';
+import { type EventSourceActivity, type SqliteEventStore } from './events.ts';
+export type { EventSourceConfig };
+/** A trigger as matching sees it: the schedule's id, its agent, and its event cadence's source and filter. */
+export interface EventTrigger {
+    triggerId: string;
+    agentId: string;
+    source: string;
+    filter: EventFilter;
+}
+export interface EventIntakeRequest {
+    /** The `<source>` in `/events/<source>`. */
+    sourceId: string;
+    /** As node:http gives them: lowercase names. */
+    headers: Readonly<Record<string, string | string[] | undefined>>;
+    /** The raw body, read no further than one byte past `maxBodyBytes`. */
+    body: Buffer;
+}
+export interface EventIntakeResponse {
+    status: number;
+    body: JsonObject;
+}
+export interface EventSourceCounters {
+    tooLarge: number;
+    badSignature: number;
+    rateLimited: number;
+    notReady: number;
+    lastRefusal?: {
+        at: string;
+        reason: string;
+    };
+}
+export interface EventIntakeCounters {
+    /** Requests to a path no source is configured for, all paths together. */
+    unknownSource: number;
+    /** Per configured source: requests refused before they could leave a row. */
+    sources: Record<string, EventSourceCounters>;
+}
+/** One configured source in the events summary (`stratus events`, `/health`). */
+export interface EventSourceSummary extends Omit<EventSourceActivity, 'lastRefused'> {
+    /** Requests refused before they could leave a row, since this daemon started. */
+    refusedBeforeRow: Omit<EventSourceCounters, 'lastRefusal'>;
+    /** The newest refusal of any kind: a refused row, or one this daemon refused before a row. */
+    lastRefusal?: {
+        at: string;
+        reason: string;
+    };
+}
+export interface EventsSummary {
+    /** Where the row counts start: 24 hours before the summary. */
+    since: string;
+    /** Every configured source, with or without activity. */
+    sources: Record<string, EventSourceSummary>;
+    /** Requests to a path no source is configured for, since this daemon started. */
+    unknownSource: number;
+}
+/**
+ * The rows' view (it survives restarts) and the listener's counters (they
+ * hold what never got a row) as one answer per configured source.
+ */
+export declare const summarizeEvents: (input: {
+    sourceIds: readonly string[];
+    since: string;
+    activity: Readonly<Record<string, EventSourceActivity>>;
+    counters: EventIntakeCounters;
+}) => EventsSummary;
+export interface EventIntakeOptions {
+    store: Pick<SqliteEventStore, 'accept' | 'refuse'>;
+    /** The configured sources, read per request. */
+    sources(): Readonly<Record<string, EventSourceConfig>>;
+    /**
+     * A stored credential's value by name, or undefined when it is not set.
+     * Asked per request, so `stratus credential set` takes effect on the next
+     * delivery, with no restart.
+     */
+    secret(name: string): Promise<string | undefined>;
+    /** The event triggers on a source, read per delivery. Empty until triggers exist. */
+    triggers(sourceId: string): readonly EventTrigger[];
+    maxBodyBytes?: number;
+    now?(): Date;
+    warn(line: string): void;
+}
+export interface EventIntake {
+    receive(request: EventIntakeRequest): Promise<EventIntakeResponse>;
+    counters(): EventIntakeCounters;
+}
+export declare const DEFAULT_EVENT_MAX_BODY_BYTES = 1048576;
+/** Signed requests a source may make in any minute before it hears 429. */
+export declare const EVENT_SOURCE_REQUESTS_PER_MINUTE = 120;
+/**
+ * Standard Webhooks 1.0 symmetric verification: `v1,<base64 HMAC-SHA256 of
+ * "id.timestamp.body">` keyed with the base64 secret (the `whsec_` prefix is
+ * optional). The header may carry several space-separated signatures, and any
+ * one valid `v1` under any one secret passes, which is how a sender rotates
+ * keys. Does not check the timestamp's age; the intake does.
+ */
+export declare const verifyStandardWebhookSignature: (input: {
+    id: string;
+    timestamp: string;
+    body: Buffer;
+    signature: string | undefined;
+}, secrets: readonly string[]) => boolean;
+/** GitHub's `X-Hub-Signature-256: sha256=<hex HMAC-SHA256 of the raw body>`, keyed with the secret as text. */
+export declare const verifyGithubSignature: (input: {
+    body: Buffer;
+    signature: string | undefined;
+}, secrets: readonly string[]) => boolean;
+/**
+ * A Standard Webhooks body as an event. A structured CloudEvent (it has
+ * `specversion`) keeps its attributes, and its `id` must be the `webhook-id`
+ * it was signed under, or one signed delivery could be replayed as another
+ * event. A plain `{ type, timestamp?, data? }` payload takes its id from
+ * `webhook-id` and its source from the configured source. Extension
+ * attributes keep only valid names with scalar values, as strings; anything
+ * else is dropped, not refused. An empty `webhook-id` and `data_base64` are
+ * refused: one would make every such delivery share a dedup key, the other
+ * would arrive with its payload gone.
+ */
+export declare const parseStandardWebhookEvent: (input: {
+    sourceId: string;
+    webhookId: string;
+    body: Buffer | string;
+}) => InboundEvent;
+/**
+ * A GitHub webhook delivery as a CloudEvent. The subject is `pull/<n>` for
+ * anything on a PR, an issue comment on a PR included, so a review and a
+ * comment on one PR share a session; `issues/<n>` for an issue. `actor` is
+ * who acted, `author` who owns the PR or issue: what a trigger names to wake
+ * only the PR's owner. GitHub sends no event time, so `time` is when it
+ * arrived.
+ */
+export declare const mapGithubDelivery: (input: {
+    event: string;
+    delivery: string;
+    payload: unknown;
+    receivedAt: string;
+}) => InboundEvent;
+export declare const createEventIntake: (options: EventIntakeOptions) => EventIntake;
+//# sourceMappingURL=event-intake.d.ts.map

package/dist/event-intake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-intake.d.ts","sourceRoot":"","sources":["../src/event-intake.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,KAAK,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAsB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,OAAO,EAKL,KAAK,mBAAmB,EAExB,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AAYrB,YAAY,EAAE,iBAAiB,EAAE,CAAC;AAElC,8GAA8G;AAC9G,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,gDAAgD;IAChD,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;IACjE,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC9C;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC;IAClF,iFAAiF;IACjF,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;IAC3D,8FAA8F;IAC9F,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AAED,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC5C,iFAAiF;IACjF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO;IACrC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACxD,QAAQ,EAAE,mBAAmB,CAAC;CAC/B,KAAG,aAWF,CAAC;AAEH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACnD,gDAAgD;IAChD,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACvD;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,YAAY,EAAE,CAAC;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,IAAI,IAAI,CAAC;IACb,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnE,QAAQ,IAAI,mBAAmB,CAAC;CACjC;AAED,eAAO,MAAM,4BAA4B,UAAY,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,MAAM,CAAC;AAepD;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,GACzC,OAAO;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACrF,SAAS,SAAS,MAAM,EAAE,KACzB,OAiBF,CAAC;AAEF,+GAA+G;AAC/G,eAAO,MAAM,qBAAqB,GAChC,OAAO;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EACtD,SAAS,SAAS,MAAM,EAAE,KACzB,OAQF,CAAC;AA4BF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACpC,OAAO;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,KACpE,YAiDF,CAAC;AAwBF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAC/E,YA0BF,CAAC;AAKF,eAAO,MAAM,iBAAiB,GAAI,SAAS,kBAAkB,KAAG,WA4K/D,CAAC"}

package/dist/event-intake.js

@@ -0,0 +1,369 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { escapeControlCharacters } from '@stratusagent/core';
+import { matchesEventFilter } from '@stratusagent/agents';
+import { eventCoalescingKey, eventDispatchKey, eventSessionId, renderEventBlock, } from "./events.js";
+/**
+ * The rows' view (it survives restarts) and the listener's counters (they
+ * hold what never got a row) as one answer per configured source.
+ */
+export const summarizeEvents = (input) => ({
+    since: input.since,
+    unknownSource: input.counters.unknownSource,
+    sources: Object.fromEntries(input.sourceIds.map((sourceId) => {
+        const { lastRefused, ...rows } = input.activity[sourceId] ?? { deliveries: {}, firings: {} };
+        const { lastRefusal: counted, ...refusedBeforeRow } = input.counters.sources[sourceId]
+            ?? { tooLarge: 0, badSignature: 0, rateLimited: 0, notReady: 0 };
+        // ISO instants compare as strings.
+        const lastRefusal = lastRefused !== undefined && (counted === undefined || lastRefused.at > counted.at) ? lastRefused : counted;
+        return [sourceId, { ...rows, refusedBeforeRow, ...(lastRefusal !== undefined ? { lastRefusal: { ...lastRefusal } } : {}) }];
+    })),
+});
+export const DEFAULT_EVENT_MAX_BODY_BYTES = 1_048_576;
+/** Signed requests a source may make in any minute before it hears 429. */
+export const EVENT_SOURCE_REQUESTS_PER_MINUTE = 120;
+/** How far a Standard Webhooks timestamp may be from our clock: the replay window. */
+const TIMESTAMP_TOLERANCE_MS = 5 * 60 * 1_000;
+/** A refusal is warned in the daemon log at most this often per source. */
+const REFUSAL_WARN_INTERVAL_MS = 10 * 60 * 1_000;
+const headerOf = (headers, name) => {
+    const value = headers[name];
+    return Array.isArray(value) ? value.join(', ') : value;
+};
+const constantTimeEqual = (a, b) => a.length === b.length && timingSafeEqual(a, b);
+/**
+ * Standard Webhooks 1.0 symmetric verification: `v1,<base64 HMAC-SHA256 of
+ * "id.timestamp.body">` keyed with the base64 secret (the `whsec_` prefix is
+ * optional). The header may carry several space-separated signatures, and any
+ * one valid `v1` under any one secret passes, which is how a sender rotates
+ * keys. Does not check the timestamp's age; the intake does.
+ */
+export const verifyStandardWebhookSignature = (input, secrets) => {
+    const offered = (input.signature ?? '')
+        .split(' ')
+        .filter((entry) => entry.startsWith('v1,'))
+        .map((entry) => Buffer.from(entry.slice(3), 'base64'));
+    if (offered.length === 0) {
+        return false;
+    }
+    const signed = Buffer.concat([Buffer.from(`${input.id}.${input.timestamp}.`), input.body]);
+    return secrets.some((secret) => {
+        const key = Buffer.from(secret.startsWith('whsec_') ? secret.slice(6) : secret, 'base64');
+        if (key.length === 0) {
+            return false;
+        }
+        const expected = createHmac('sha256', key).update(signed).digest();
+        return offered.some((candidate) => constantTimeEqual(candidate, expected));
+    });
+};
+/** GitHub's `X-Hub-Signature-256: sha256=<hex HMAC-SHA256 of the raw body>`, keyed with the secret as text. */
+export const verifyGithubSignature = (input, secrets) => {
+    const signature = input.signature ?? '';
+    if (!signature.startsWith('sha256=')) {
+        return false;
+    }
+    const offered = Buffer.from(signature.slice('sha256='.length), 'utf8');
+    return secrets.some((secret) => secret.length > 0
+        && constantTimeEqual(offered, Buffer.from(createHmac('sha256', secret).update(input.body).digest('hex'), 'utf8')));
+};
+/** A body that parsed but isn't an event; its message is the 400's. */
+class MalformedEventError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'MalformedEventError';
+    }
+}
+const isPlainObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const parseJsonObject = (body) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(typeof body === 'string' ? body : body.toString('utf8'));
+    }
+    catch {
+        throw new MalformedEventError('The body is not JSON.');
+    }
+    if (!isPlainObject(parsed)) {
+        throw new MalformedEventError('The body must be a JSON object.');
+    }
+    return parsed;
+};
+const ATTRIBUTE_NAME = /^[a-z0-9]+$/;
+/**
+ * A Standard Webhooks body as an event. A structured CloudEvent (it has
+ * `specversion`) keeps its attributes, and its `id` must be the `webhook-id`
+ * it was signed under, or one signed delivery could be replayed as another
+ * event. A plain `{ type, timestamp?, data? }` payload takes its id from
+ * `webhook-id` and its source from the configured source. Extension
+ * attributes keep only valid names with scalar values, as strings; anything
+ * else is dropped, not refused. An empty `webhook-id` and `data_base64` are
+ * refused: one would make every such delivery share a dedup key, the other
+ * would arrive with its payload gone.
+ */
+export const parseStandardWebhookEvent = (input) => {
+    if (input.webhookId.length === 0) {
+        throw new MalformedEventError('The webhook-id header is empty; every delivery needs its own id.');
+    }
+    const object = parseJsonObject(input.body);
+    if (object.specversion === undefined) {
+        if (typeof object.type !== 'string' || object.type.length === 0) {
+            throw new MalformedEventError('A Standard Webhooks payload needs a string "type".');
+        }
+        return {
+            attributes: {
+                specversion: '1.0',
+                id: input.webhookId,
+                source: `stratus:source/${input.sourceId}`,
+                type: object.type,
+                ...(typeof object.timestamp === 'string' ? { time: object.timestamp } : {}),
+            },
+            ...(object.data !== undefined ? { data: object.data } : {}),
+        };
+    }
+    if (object.specversion !== '1.0') {
+        throw new MalformedEventError(`CloudEvents specversion "${String(object.specversion)}" is not supported; send "1.0".`);
+    }
+    for (const required of ['id', 'source', 'type']) {
+        const value = object[required];
+        if (typeof value !== 'string' || value.length === 0) {
+            throw new MalformedEventError(`A CloudEvent needs a non-empty string "${required}".`);
+        }
+    }
+    if (object.id !== input.webhookId) {
+        throw new MalformedEventError('The CloudEvent id must equal the webhook-id header it was signed under.');
+    }
+    // Refused, not dropped: accepting it would hand triggers an event whose
+    // payload silently vanished. Events here are JSON.
+    if (object.data_base64 !== undefined) {
+        throw new MalformedEventError('data_base64 is not supported; send the payload as JSON in "data".');
+    }
+    const attributes = {};
+    for (const [name, value] of Object.entries(object)) {
+        if (name === 'data' || !ATTRIBUTE_NAME.test(name)) {
+            continue;
+        }
+        if (typeof value === 'string') {
+            attributes[name] = value;
+        }
+        else if (typeof value === 'number' || typeof value === 'boolean') {
+            attributes[name] = String(value);
+        }
+    }
+    return { attributes, ...(object.data !== undefined ? { data: object.data } : {}) };
+};
+const stringAt = (value, ...path) => {
+    let cursor = value;
+    for (const key of path) {
+        if (!isPlainObject(cursor)) {
+            return undefined;
+        }
+        cursor = cursor[key];
+    }
+    return typeof cursor === 'string' && cursor.length > 0 ? cursor : undefined;
+};
+const numberAt = (value, ...path) => {
+    let cursor = value;
+    for (const key of path) {
+        if (!isPlainObject(cursor)) {
+            return undefined;
+        }
+        cursor = cursor[key];
+    }
+    return typeof cursor === 'number' && Number.isSafeInteger(cursor) ? cursor : undefined;
+};
+/**
+ * A GitHub webhook delivery as a CloudEvent. The subject is `pull/<n>` for
+ * anything on a PR, an issue comment on a PR included, so a review and a
+ * comment on one PR share a session; `issues/<n>` for an issue. `actor` is
+ * who acted, `author` who owns the PR or issue: what a trigger names to wake
+ * only the PR's owner. GitHub sends no event time, so `time` is when it
+ * arrived.
+ */
+export const mapGithubDelivery = (input) => {
+    const payload = (isPlainObject(input.payload) ? input.payload : {});
+    const action = stringAt(payload, 'action');
+    const repository = stringAt(payload, 'repository', 'full_name');
+    const organization = stringAt(payload, 'organization', 'login');
+    const pullNumber = numberAt(payload, 'pull_request', 'number');
+    const issueNumber = numberAt(payload, 'issue', 'number');
+    const issueIsPull = isPlainObject(payload.issue) && payload.issue.pull_request !== undefined;
+    const subject = pullNumber !== undefined
+        ? `pull/${pullNumber}`
+        : issueNumber !== undefined ? `${issueIsPull ? 'pull' : 'issues'}/${issueNumber}` : undefined;
+    const actor = stringAt(payload, 'sender', 'login');
+    const author = stringAt(payload, 'pull_request', 'user', 'login') ?? stringAt(payload, 'issue', 'user', 'login');
+    return {
+        attributes: {
+            specversion: '1.0',
+            id: input.delivery,
+            source: `https://github.com${repository ? `/${repository}` : organization ? `/${organization}` : ''}`,
+            type: `com.github.${input.event}${action ? `.${action}` : ''}`,
+            ...(subject !== undefined ? { subject } : {}),
+            time: input.receivedAt,
+            ...(actor !== undefined ? { actor } : {}),
+            ...(author !== undefined ? { author } : {}),
+        },
+        data: payload,
+    };
+};
+const mediaType = (contentType) => (contentType ?? '').split(';')[0].trim().toLowerCase();
+export const createEventIntake = (options) => {
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_EVENT_MAX_BODY_BYTES;
+    const now = options.now ?? (() => new Date());
+    let unknownSource = 0;
+    const counters = new Map();
+    const signedRequests = new Map();
+    const lastWarned = new Map();
+    const countersFor = (sourceId) => {
+        let entry = counters.get(sourceId);
+        if (!entry) {
+            entry = { tooLarge: 0, badSignature: 0, rateLimited: 0, notReady: 0 };
+            counters.set(sourceId, entry);
+        }
+        return entry;
+    };
+    const refusal = (sourceId, reason) => {
+        const at = now();
+        countersFor(sourceId).lastRefusal = { at: at.toISOString(), reason };
+        const last = lastWarned.get(sourceId);
+        if (last === undefined || at.getTime() - last >= REFUSAL_WARN_INTERVAL_MS) {
+            lastWarned.set(sourceId, at.getTime());
+            // Escaped: a reason can quote a sender's content type or field, and a
+            // raw control character there would forge or recolor a log line.
+            options.warn(`events: refused a request to source "${sourceId}": ${escapeControlCharacters(reason)}`);
+        }
+    };
+    const answer = (status, body) => ({ status, body });
+    /** Count a signed request against its source's minute; false when the minute is full. */
+    const admitSigned = (sourceId) => {
+        const at = now().getTime();
+        const recent = (signedRequests.get(sourceId) ?? []).filter((time) => at - time < 60_000);
+        if (recent.length >= EVENT_SOURCE_REQUESTS_PER_MINUTE) {
+            signedRequests.set(sourceId, recent);
+            return false;
+        }
+        recent.push(at);
+        signedRequests.set(sourceId, recent);
+        return true;
+    };
+    const receive = async (request) => {
+        const { sourceId, headers, body } = request;
+        const sources = options.sources();
+        const source = Object.hasOwn(sources, sourceId) ? sources[sourceId] : undefined;
+        if (!source) {
+            unknownSource += 1;
+            return answer(404, { error: 'unknown_source', message: 'No event source is configured at this path.' });
+        }
+        const count = countersFor(sourceId);
+        if (body.length > maxBodyBytes) {
+            count.tooLarge += 1;
+            refusal(sourceId, `body over ${maxBodyBytes} bytes`);
+            return answer(413, { error: 'too_large', message: `The body is over ${maxBodyBytes} bytes.` });
+        }
+        const secrets = (await Promise.all(source.secrets.map((name) => options.secret(name))))
+            .filter((value) => typeof value === 'string' && value.length > 0);
+        if (secrets.length === 0) {
+            count.notReady += 1;
+            const reason = `No secret is set for event source "${sourceId}". Run \`stratus credential set ${source.secrets[0] ?? `events.${sourceId}`}\` on the daemon's host.`;
+            refusal(sourceId, reason);
+            return answer(503, { error: 'source_not_ready', message: reason });
+        }
+        const receivedAt = now().toISOString();
+        let eventId;
+        let signatureProblem;
+        if (source.verify === 'github') {
+            eventId = headerOf(headers, 'x-github-delivery');
+            if (!verifyGithubSignature({ body, signature: headerOf(headers, 'x-hub-signature-256') }, secrets)) {
+                signatureProblem = 'missing or wrong X-Hub-Signature-256 signature';
+            }
+        }
+        else {
+            eventId = headerOf(headers, 'webhook-id');
+            const timestamp = headerOf(headers, 'webhook-timestamp');
+            if (eventId === undefined || timestamp === undefined
+                || !verifyStandardWebhookSignature({ id: eventId, timestamp, body, signature: headerOf(headers, 'webhook-signature') }, secrets)) {
+                signatureProblem = 'missing or wrong webhook-signature (Standard Webhooks v1)';
+            }
+            else if (!/^\d+$/.test(timestamp) || Math.abs(now().getTime() - Number(timestamp) * 1_000) > TIMESTAMP_TOLERANCE_MS) {
+                signatureProblem = 'webhook-timestamp is more than 5 minutes from this host\'s clock';
+            }
+        }
+        if (signatureProblem !== undefined) {
+            count.badSignature += 1;
+            refusal(sourceId, signatureProblem);
+            return answer(401, { error: 'bad_signature', message: `Refused: ${signatureProblem}.` });
+        }
+        if (!admitSigned(sourceId)) {
+            count.rateLimited += 1;
+            refusal(sourceId, `over ${EVENT_SOURCE_REQUESTS_PER_MINUTE} signed requests a minute`);
+            return answer(429, { error: 'rate_limited', message: `Over ${EVENT_SOURCE_REQUESTS_PER_MINUTE} requests a minute for this source.` });
+        }
+        // Signed from here on: refusals leave a row, without a tombstone, so the
+        // sender can fix the request and retry under the same id.
+        const refuse = (status, error, reason, type) => {
+            options.store.refuse({ source: sourceId, eventId: eventId ?? '', ...(type !== undefined ? { type } : {}), reason, receivedAt });
+            refusal(sourceId, reason);
+            return answer(status, { error, message: reason });
+        };
+        const type = mediaType(headerOf(headers, 'content-type'));
+        let event;
+        try {
+            if (source.verify === 'github') {
+                const githubEvent = headerOf(headers, 'x-github-event');
+                if (type !== 'application/json') {
+                    return refuse(415, 'unsupported_content_type', `Content type "${type || 'none'}" is not supported. In the GitHub webhook's settings, set Content type to application/json.`, githubEvent !== undefined ? `com.github.${githubEvent}` : undefined);
+                }
+                if (githubEvent === undefined || githubEvent.length === 0 || eventId === undefined || eventId.length === 0) {
+                    throw new MalformedEventError('A GitHub delivery needs X-GitHub-Event and X-GitHub-Delivery headers.');
+                }
+                event = mapGithubDelivery({ event: githubEvent, delivery: eventId, payload: parseJsonObject(body), receivedAt });
+            }
+            else {
+                if (type !== 'application/json' && type !== 'application/cloudevents+json') {
+                    return refuse(415, 'unsupported_content_type', `Content type "${type || 'none'}" is not supported. Send application/cloudevents+json or application/json.`);
+                }
+                event = parseStandardWebhookEvent({ sourceId, webhookId: eventId, body });
+            }
+        }
+        catch (error) {
+            if (error instanceof MalformedEventError) {
+                return refuse(400, 'malformed', error.message);
+            }
+            throw error;
+        }
+        // The rule filter, before anything that could cost a model call.
+        const matched = options.triggers(sourceId)
+            .filter((trigger) => trigger.source === sourceId && matchesEventFilter(trigger.filter, event));
+        const coalescingKey = eventCoalescingKey(sourceId, event);
+        const block = matched.length > 0 ? renderEventBlock(sourceId, event) : '';
+        const firings = matched.map((trigger) => ({
+            triggerId: trigger.triggerId,
+            agentId: trigger.agentId,
+            coalescingKey,
+            sessionId: eventSessionId(trigger.triggerId, coalescingKey),
+            dispatchKey: eventDispatchKey(trigger.triggerId, sourceId, event.attributes.id ?? ''),
+            block,
+        }));
+        const accepted = options.store.accept({
+            source: sourceId,
+            eventId: event.attributes.id ?? '',
+            type: event.attributes.type ?? '',
+            ...(event.attributes.subject !== undefined ? { subject: event.attributes.subject } : {}),
+            receivedAt,
+            firings,
+        });
+        return answer(200, { status: accepted.status });
+    };
+    return {
+        receive,
+        counters: () => ({
+            unknownSource,
+            sources: Object.fromEntries(Object.keys(options.sources()).map((sourceId) => {
+                const entry = countersFor(sourceId);
+                return [sourceId, {
+                        ...entry,
+                        ...(entry.lastRefusal ? { lastRefusal: { ...entry.lastRefusal } } : {}),
+                    }];
+            })),
+        }),
+    };
+};
+//# sourceMappingURL=event-intake.js.map

package/dist/event-intake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-intake.js","sourceRoot":"","sources":["../src/event-intake.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,uBAAuB,EAAmC,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAuC,MAAM,sBAAsB,CAAC;AAG/F,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,GAIjB,MAAM,aAAa,CAAC;AAoErB;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAK/B,EAAiB,EAAE,CAAC,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;IAC3C,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC3D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7F,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;eACjF,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACnE,mCAAmC;QACnC,MAAM,WAAW,GAAG,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAChI,OAAO,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC,CAAC,CAAC;CACJ,CAAC,CAAC;AAwBH,MAAM,CAAC,MAAM,4BAA4B,GAAG,SAAS,CAAC;AAEtD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAEpD,sFAAsF;AACtF,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AAE9C,2EAA2E;AAC3E,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAEjD,MAAM,QAAQ,GAAG,CAAC,OAAsC,EAAE,IAAY,EAAsB,EAAE;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE5G;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAC5C,KAAqF,EACrF,OAA0B,EACjB,EAAE;IACX,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;SACpC,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,+GAA+G;AAC/G,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,KAAsD,EACtD,OAA0B,EACjB,EAAE;IACX,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;WAC5C,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvH,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,aAAa,GAAG,CAAC,KAAc,EAAsC,EAAE,CAC3E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAM,eAAe,GAAG,CAAC,IAAqB,EAA6B,EAAE;IAC3E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,KAAqE,EACvD,EAAE;IAChB,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAAC,kEAAkE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,mBAAmB,CAAC,oDAAoD,CAAC,CAAC;QACtF,CAAC;QACD,OAAO;YACL,UAAU,EAAE;gBACV,WAAW,EAAE,KAAK;gBAClB,EAAE,EAAE,KAAK,CAAC,SAAS;gBACnB,MAAM,EAAE,kBAAkB,KAAK,CAAC,QAAQ,EAAE;gBAC1C,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,CAAC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;YACD,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,iCAAiC,CAAC,CAAC;IACzH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,QAAQ,IAAI,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,mBAAmB,CAAC,yEAAyE,CAAC,CAAC;IAC3G,CAAC;IACD,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAAC,mEAAmE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YACnE,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,KAA4B,EAAE,GAAG,IAAc,EAAsB,EAAE;IACvF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,KAA4B,EAAE,GAAG,IAAc,EAAsB,EAAE;IACvF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,KAAgF,EAClE,EAAE;IAChB,MAAM,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAe,CAAC;IAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC;IAC7F,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS;QACtC,CAAC,CAAC,QAAQ,UAAU,EAAE;QACtB,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjH,OAAO;QACL,UAAU,EAAE;YACV,WAAW,EAAE,KAAK;YAClB,EAAE,EAAE,KAAK,CAAC,QAAQ;YAClB,MAAM,EAAE,qBAAqB,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACrG,IAAI,EAAE,cAAc,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9D,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,IAAI,EAAE,KAAK,CAAC,UAAU;YACtB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C;QACD,IAAI,EAAE,OAAO;KACd,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,WAA+B,EAAU,EAAE,CAC5D,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAe,EAAE;IAC5E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,4BAA4B,CAAC;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7C,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAuB,EAAE;QAC5D,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAQ,EAAE;QACzD,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,wBAAwB,EAAE,CAAC;YAC1E,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,sEAAsE;YACtE,iEAAiE;YACjE,OAAO,CAAC,IAAI,CAAC,wCAAwC,QAAQ,MAAM,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,IAAgB,EAAuB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7F,yFAAyF;IACzF,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAW,EAAE;QAChD,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,MAAM,IAAI,gCAAgC,EAAE,CAAC;YACtD,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,OAA2B,EAAgC,EAAE;QAClF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,aAAa,IAAI,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAEpC,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;YAC/B,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,QAAQ,EAAE,aAAa,YAAY,QAAQ,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,YAAY,SAAS,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACpF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,sCAAsC,QAAQ,mCAAmC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,QAAQ,EAAE,0BAA0B,CAAC;YACpK,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,OAA2B,CAAC;QAChC,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACjD,IAAI,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;gBACnG,gBAAgB,GAAG,gDAAgD,CAAC;YACtE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YACzD,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;mBAC/C,CAAC,8BAA8B,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;gBACnI,gBAAgB,GAAG,2DAA2D,CAAC;YACjF,CAAC;iBAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,sBAAsB,EAAE,CAAC;gBACtH,gBAAgB,GAAG,kEAAkE,CAAC;YACxF,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;YACxB,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,gBAAgB,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;YACvB,OAAO,CAAC,QAAQ,EAAE,QAAQ,gCAAgC,2BAA2B,CAAC,CAAC;YACvF,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,gCAAgC,qCAAqC,EAAE,CAAC,CAAC;QACxI,CAAC;QAED,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,IAAa,EAAuB,EAAE;YACnG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAChI,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;QAC1D,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;gBACxD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAChC,OAAO,MAAM,CAAC,GAAG,EAAE,0BAA0B,EAC3C,iBAAiB,IAAI,IAAI,MAAM,6FAA6F,EAC5H,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACzE,CAAC;gBACD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC3G,MAAM,IAAI,mBAAmB,CAAC,uEAAuE,CAAC,CAAC;gBACzG,CAAC;gBACD,KAAK,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;YACnH,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,8BAA8B,EAAE,CAAC;oBAC3E,OAAO,MAAM,CAAC,GAAG,EAAE,0BAA0B,EAC3C,iBAAiB,IAAI,IAAI,MAAM,4EAA4E,CAAC,CAAC;gBACjH,CAAC;gBACD,KAAK,GAAG,yBAAyB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,iEAAiE;QACjE,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACvC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAqB,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1D,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa;YACb,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC;YAC3D,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;YACrF,KAAK;SACN,CAAC,CAAC,CAAC;QACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACpC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;YAClC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE;YACjC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACf,aAAa;YACb,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACpC,OAAO,CAAC,QAAQ,EAAE;wBAChB,GAAG,KAAK;wBACR,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACxE,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;SACJ,CAAC;KACH,CAAC;AACJ,CAAC,CAAC"}