@tangle-network/agent-integrations 0.73.0 → 0.74.1

package/dist/webhooks-FsjqRN_0.js

@@ -1,117 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-//#region src/connectors/webhooks.ts
-/**
-* Inbound webhook signature verifiers — provider-specific HMAC schemes.
-*
-* Each signature scheme is a pure function:
-*   (rawBody: string, headers, secret, now?) → boolean
-*
-* Constant-time comparison via `crypto.timingSafeEqual`. Timestamps are
-* checked against a configurable tolerance to bound replay risk; the default
-* mirrors the upstream provider's documented window (Stripe: 5 min, Slack: 5 min).
-*
-* These verifiers are the building blocks for any inbound-webhook receiver
-* (a route + a `verify` call + a per-event handler). They live in this
-* package so every consumer of the integration substrate gets correct
-* verification — not just one product reimplementing it.
-*/
-/** Default replay-protection window. Providers commonly use 5 minutes. */
-const DEFAULT_SIGNATURE_TOLERANCE_SECONDS = 300;
-function parseStripeSignatureHeader(header) {
-	const acc = { sigs: [] };
-	for (const part of header.split(",")) {
-		const idx = part.indexOf("=");
-		if (idx < 0) continue;
-		const key = part.slice(0, idx).trim();
-		const val = part.slice(idx + 1).trim();
-		if (key === "t") {
-			const n = Number(val);
-			if (Number.isFinite(n)) acc.ts = n;
-		} else if (key === "v1") acc.sigs.push(val);
-	}
-	if (acc.ts === void 0 || acc.sigs.length === 0) return null;
-	return {
-		t: acc.ts,
-		sigs: acc.sigs
-	};
-}
-/** Verify a Stripe webhook signature against the raw request body. */
-function verifyStripeSignature(rawBody, signatureHeader, secret, options = {}) {
-	const parsed = parseStripeSignatureHeader(signatureHeader);
-	if (!parsed) return false;
-	const tolerance = options.toleranceSeconds ?? 300;
-	const now = options.now ?? Math.floor(Date.now() / 1e3);
-	if (Math.abs(now - parsed.t) > tolerance) return false;
-	const expected = createHmac("sha256", secret).update(`${parsed.t}.${rawBody}`).digest("hex");
-	const expectedBuf = Buffer.from(expected, "utf8");
-	for (const sig of parsed.sigs) {
-		const sigBuf = Buffer.from(sig, "utf8");
-		if (sigBuf.length !== expectedBuf.length) continue;
-		if (timingSafeEqual(sigBuf, expectedBuf)) return true;
-	}
-	return false;
-}
-function verifySlackSignature(rawBody, signatureHeader, timestampHeader, secret, options = {}) {
-	if (!signatureHeader.startsWith("v0=")) return false;
-	const ts = Number(timestampHeader);
-	if (!Number.isFinite(ts)) return false;
-	const tolerance = options.toleranceSeconds ?? 300;
-	const now = options.now ?? Math.floor(Date.now() / 1e3);
-	if (Math.abs(now - ts) > tolerance) return false;
-	const expected = "v0=" + createHmac("sha256", secret).update(`v0:${ts}:${rawBody}`).digest("hex");
-	const expectedBuf = Buffer.from(expected, "utf8");
-	const sigBuf = Buffer.from(signatureHeader, "utf8");
-	if (sigBuf.length !== expectedBuf.length) return false;
-	return timingSafeEqual(sigBuf, expectedBuf);
-}
-function verifyHmacSignature(rawBody, signatureHeader, secret, options = {}) {
-	const algorithm = options.algorithm ?? "sha256";
-	const prefix = options.signaturePrefix ?? "";
-	const lower = options.lowercaseHex ?? true;
-	let candidate = signatureHeader;
-	if (prefix) {
-		if (!candidate.startsWith(prefix)) return false;
-		candidate = candidate.slice(prefix.length);
-	}
-	if (lower) candidate = candidate.toLowerCase();
-	const expected = createHmac(algorithm, secret).update(rawBody).digest("hex");
-	const expectedBuf = Buffer.from(expected, "utf8");
-	const sigBuf = Buffer.from(candidate, "utf8");
-	if (sigBuf.length !== expectedBuf.length) return false;
-	return timingSafeEqual(sigBuf, expectedBuf);
-}
-/** Verify a Twilio webhook signature. */
-function verifyTwilioSignature(input, options = {}) {
-	if (!input.authToken) return options.skipWhenAuthTokenMissing === true;
-	const signature = input.signatureHeader;
-	if (!signature || Array.isArray(signature)) return false;
-	if (!input.fullUrl) return false;
-	const data = options.bodyAsRaw === true ? input.fullUrl + (options.rawBody ?? "") : Object.keys(input.params ?? {}).sort().reduce((acc, key) => acc + key + (input.params[key] ?? ""), input.fullUrl);
-	const expected = createHmac("sha1", input.authToken).update(data).digest("base64");
-	const expectedBuf = Buffer.from(expected);
-	const sigBuf = Buffer.from(signature);
-	if (expectedBuf.length !== sigBuf.length) return false;
-	return timingSafeEqual(expectedBuf, sigBuf);
-}
-/** Verify a Tangle inbound-email signature against the raw request body. */
-function verifyEmailSignature(rawBody, signatureHeader, timestampHeader, secret, options = {}) {
-	const ts = Number(timestampHeader);
-	if (!Number.isFinite(ts)) return false;
-	const tolerance = options.toleranceSeconds ?? 300;
-	const now = options.now ?? Math.floor(Date.now() / 1e3);
-	if (Math.abs(now - ts) > tolerance) return false;
-	const expected = createHmac("sha256", secret).update(`${ts}.${rawBody}`).digest("hex");
-	const expectedBuf = Buffer.from(expected, "utf8");
-	const sigBuf = Buffer.from(signatureHeader.toLowerCase(), "utf8");
-	if (sigBuf.length !== expectedBuf.length) return false;
-	return timingSafeEqual(sigBuf, expectedBuf);
-}
-function firstHeader(headers, name) {
-	const v = headers[name] ?? headers[name.toLowerCase()] ?? Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1];
-	if (Array.isArray(v)) return v[0];
-	return typeof v === "string" ? v : void 0;
-}
-//#endregion
-export { verifyHmacSignature as a, verifyTwilioSignature as c, verifyEmailSignature as i, firstHeader as n, verifySlackSignature as o, parseStripeSignatureHeader as r, verifyStripeSignature as s, DEFAULT_SIGNATURE_TOLERANCE_SECONDS as t };
-
-//# sourceMappingURL=webhooks-FsjqRN_0.js.map

package/dist/webhooks-FsjqRN_0.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webhooks-FsjqRN_0.js","names":[],"sources":["../src/connectors/webhooks.ts"],"sourcesContent":["/**\n * Inbound webhook signature verifiers — provider-specific HMAC schemes.\n *\n * Each signature scheme is a pure function:\n *   (rawBody: string, headers, secret, now?) → boolean\n *\n * Constant-time comparison via `crypto.timingSafeEqual`. Timestamps are\n * checked against a configurable tolerance to bound replay risk; the default\n * mirrors the upstream provider's documented window (Stripe: 5 min, Slack: 5 min).\n *\n * These verifiers are the building blocks for any inbound-webhook receiver\n * (a route + a `verify` call + a per-event handler). They live in this\n * package so every consumer of the integration substrate gets correct\n * verification — not just one product reimplementing it.\n */\n\nimport { createHmac, timingSafeEqual } from 'node:crypto'\n\n/** Default replay-protection window. Providers commonly use 5 minutes. */\nexport const DEFAULT_SIGNATURE_TOLERANCE_SECONDS = 5 * 60\n\n// ─── Stripe ─────────────────────────────────────────────────────────────\n//\n// Stripe signs webhooks with a single header `Stripe-Signature` of the form\n//\n//   t=<timestamp>,v1=<sig1>,v1=<sig2>,...\n//\n// where `t` is the Unix timestamp the event was generated, and each `v1`\n// is `HMAC-SHA256(secret, \"<t>.<rawBody>\")`. Multiple `v1` entries appear\n// during secret rotation — any one matching is sufficient.\n//\n// https://stripe.com/docs/webhooks/signatures\n\nexport interface ParsedStripeSignatureHeader {\n  t: number\n  sigs: string[]\n}\n\nexport function parseStripeSignatureHeader(header: string): ParsedStripeSignatureHeader | null {\n  const acc: { ts?: number; sigs: string[] } = { sigs: [] }\n  for (const part of header.split(',')) {\n    const idx = part.indexOf('=')\n    if (idx < 0) continue\n    const key = part.slice(0, idx).trim()\n    const val = part.slice(idx + 1).trim()\n    if (key === 't') {\n      const n = Number(val)\n      if (Number.isFinite(n)) acc.ts = n\n    } else if (key === 'v1') {\n      acc.sigs.push(val)\n    }\n  }\n  if (acc.ts === undefined || acc.sigs.length === 0) return null\n  return { t: acc.ts, sigs: acc.sigs }\n}\n\nexport interface StripeVerifyOptions {\n  /** Replay-protection window in seconds. Default 300. */\n  toleranceSeconds?: number\n  /** Override `now()` for tests. UTC seconds. */\n  now?: number\n}\n\n/** Verify a Stripe webhook signature against the raw request body. */\nexport function verifyStripeSignature(\n  rawBody: string,\n  signatureHeader: string,\n  secret: string,\n  options: StripeVerifyOptions = {},\n): boolean {\n  const parsed = parseStripeSignatureHeader(signatureHeader)\n  if (!parsed) return false\n  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS\n  const now = options.now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(now - parsed.t) > tolerance) return false\n  const expected = createHmac('sha256', secret).update(`${parsed.t}.${rawBody}`).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  for (const sig of parsed.sigs) {\n    const sigBuf = Buffer.from(sig, 'utf8')\n    if (sigBuf.length !== expectedBuf.length) continue\n    if (timingSafeEqual(sigBuf, expectedBuf)) return true\n  }\n  return false\n}\n\n// ─── Slack ──────────────────────────────────────────────────────────────\n//\n// Slack signs request bodies with two headers:\n//\n//   X-Slack-Signature:         v0=<HMAC-SHA256(secret, \"v0:<ts>:<body>\")>\n//   X-Slack-Request-Timestamp: <ts>\n//\n// https://api.slack.com/authentication/verifying-requests-from-slack\n\nexport interface SlackVerifyOptions {\n  toleranceSeconds?: number\n  now?: number\n}\n\nexport function verifySlackSignature(\n  rawBody: string,\n  signatureHeader: string,\n  timestampHeader: string,\n  secret: string,\n  options: SlackVerifyOptions = {},\n): boolean {\n  if (!signatureHeader.startsWith('v0=')) return false\n  const ts = Number(timestampHeader)\n  if (!Number.isFinite(ts)) return false\n  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS\n  const now = options.now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(now - ts) > tolerance) return false\n  const expected = 'v0=' + createHmac('sha256', secret).update(`v0:${ts}:${rawBody}`).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  const sigBuf = Buffer.from(signatureHeader, 'utf8')\n  if (sigBuf.length !== expectedBuf.length) return false\n  return timingSafeEqual(sigBuf, expectedBuf)\n}\n\n// ─── Generic HMAC ───────────────────────────────────────────────────────\n//\n// For \"we shipped a webhook URL with a shared HMAC secret\" patterns —\n// covers any custom integration where the operator picks the message\n// format. The signed message is the literal `rawBody` (no timestamp\n// prefix); replay protection is the caller's responsibility (use a\n// nonce header + a small dedup cache).\n\nexport interface GenericHmacVerifyOptions {\n  /** sha256 (default) | sha1 | sha512 — matches the algorithm the receiver\n   *  computed at sign time. */\n  algorithm?: 'sha256' | 'sha1' | 'sha512'\n  /** Optional prefix the receiver prepends to the signature in the header\n   *  (e.g., `'sha256='`). Stripped before constant-time comparison. */\n  signaturePrefix?: string\n  /** Lowercase comparison (most providers emit hex-lowercase). Default true. */\n  lowercaseHex?: boolean\n}\n\nexport function verifyHmacSignature(\n  rawBody: string,\n  signatureHeader: string,\n  secret: string,\n  options: GenericHmacVerifyOptions = {},\n): boolean {\n  const algorithm = options.algorithm ?? 'sha256'\n  const prefix = options.signaturePrefix ?? ''\n  const lower = options.lowercaseHex ?? true\n  let candidate = signatureHeader\n  if (prefix) {\n    if (!candidate.startsWith(prefix)) return false\n    candidate = candidate.slice(prefix.length)\n  }\n  if (lower) candidate = candidate.toLowerCase()\n  const expected = createHmac(algorithm, secret).update(rawBody).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  const sigBuf = Buffer.from(candidate, 'utf8')\n  if (sigBuf.length !== expectedBuf.length) return false\n  return timingSafeEqual(sigBuf, expectedBuf)\n}\n\n// ─── Twilio ─────────────────────────────────────────────────────────────\n//\n// Twilio's webhook signature scheme is unlike Stripe/Slack — it doesn't\n// sign the raw body. It signs the concatenation of:\n//\n//     fullUrl + sortedConcatenatedParams\n//\n// where `fullUrl` is the public URL Twilio called (scheme + host + path\n// + query, exactly as Twilio constructed it from your console config),\n// and `sortedConcatenatedParams` is `key1+value1+key2+value2+...` over\n// the alphabetically-sorted keys of the POST body params (form-encoded).\n//\n// For JSON-bodied Twilio webhooks (Conversations API), the body is signed\n// as raw bytes — pass `{ bodyAsRaw: true, rawBody }` for that path.\n//\n// HMAC-SHA1, base64-encoded. Header: `X-Twilio-Signature`.\n//\n// https://www.twilio.com/docs/usage/webhooks/webhooks-security\n\nexport interface TwilioVerifyOptions {\n  /** Skip verification when the auth token isn't configured. Useful in\n   *  dev where the receiver wants to accept any payload. Default `false`\n   *  — production should always require a configured token. */\n  skipWhenAuthTokenMissing?: boolean\n  /** When true, sign the raw body instead of the URL-encoded sorted-params\n   *  reduction. Twilio uses raw-body signing for `application/json`\n   *  webhook bodies. Default `false`. */\n  bodyAsRaw?: boolean\n  /** When `bodyAsRaw` is true, the raw body to sign. Ignored otherwise. */\n  rawBody?: string\n}\n\n/** Verify a Twilio webhook signature. */\nexport function verifyTwilioSignature(\n  input: {\n    authToken: string | null | undefined\n    signatureHeader: string | string[] | undefined\n    fullUrl: string | null | undefined\n    params: Record<string, string> | undefined\n  },\n  options: TwilioVerifyOptions = {},\n): boolean {\n  if (!input.authToken) {\n    return options.skipWhenAuthTokenMissing === true\n  }\n  const signature = input.signatureHeader\n  if (!signature || Array.isArray(signature)) return false\n  if (!input.fullUrl) return false\n\n  const data = options.bodyAsRaw === true\n    ? input.fullUrl + (options.rawBody ?? '')\n    : Object.keys(input.params ?? {})\n        .sort()\n        .reduce((acc, key) => acc + key + (input.params![key] ?? ''), input.fullUrl)\n\n  const expected = createHmac('sha1', input.authToken).update(data).digest('base64')\n  const expectedBuf = Buffer.from(expected)\n  const sigBuf = Buffer.from(signature)\n  if (expectedBuf.length !== sigBuf.length) return false\n  return timingSafeEqual(expectedBuf, sigBuf)\n}\n\n// ─── Inbound email ──────────────────────────────────────────────────────\n//\n// Tangle's own inbound-email edge (a Cloudflare Email Routing worker) receives\n// a message, serializes the parsed MIME to a JSON body, and signs it with the\n// connection's per-connection secret before POSTing it to the hub. There is no\n// upstream mail-vendor signature to trust — WE are both signer and verifier —\n// so the scheme is a timestamped HMAC (Slack/Stripe-style) to get replay\n// protection on the captured webhook:\n//\n//   X-Tangle-Email-Signature: <HMAC-SHA256(secret, \"<ts>.<rawBody>\") hex>\n//   X-Tangle-Email-Timestamp: <unix seconds>\n\nexport interface EmailVerifyOptions {\n  /** Replay-protection window in seconds. Default 300. */\n  toleranceSeconds?: number\n  /** Override `now()` for tests. UTC seconds. */\n  now?: number\n}\n\n/** Verify a Tangle inbound-email signature against the raw request body. */\nexport function verifyEmailSignature(\n  rawBody: string,\n  signatureHeader: string,\n  timestampHeader: string,\n  secret: string,\n  options: EmailVerifyOptions = {},\n): boolean {\n  const ts = Number(timestampHeader)\n  if (!Number.isFinite(ts)) return false\n  const tolerance = options.toleranceSeconds ?? DEFAULT_SIGNATURE_TOLERANCE_SECONDS\n  const now = options.now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(now - ts) > tolerance) return false\n  const expected = createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'utf8')\n  const sigBuf = Buffer.from(signatureHeader.toLowerCase(), 'utf8')\n  if (sigBuf.length !== expectedBuf.length) return false\n  return timingSafeEqual(sigBuf, expectedBuf)\n}\n\n// ─── Header helper ──────────────────────────────────────────────────────\n//\n// Most fastify/express adapters expose request headers as\n// `Record<string, string | string[] | undefined>`. This helper picks the\n// first canonical value for a given name (case-insensitive).\n\nexport function firstHeader(\n  headers: Record<string, string | string[] | undefined>,\n  name: string,\n): string | undefined {\n  const v = headers[name]\n    ?? headers[name.toLowerCase()]\n    ?? Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1]\n  if (Array.isArray(v)) return v[0]\n  return typeof v === 'string' ? v : undefined\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,MAAa,sCAAsC;AAmBnD,SAAgB,2BAA2B,QAAoD;CAC7F,MAAM,MAAuC,EAAE,MAAM,CAAC,EAAE;CACxD,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,MAAM,KAAK,QAAQ,GAAG;EAC5B,IAAI,MAAM,GAAG;EACb,MAAM,MAAM,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK;EACpC,MAAM,MAAM,KAAK,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK;EACrC,IAAI,QAAQ,KAAK;GACf,MAAM,IAAI,OAAO,GAAG;GACpB,IAAI,OAAO,SAAS,CAAC,GAAG,IAAI,KAAK;EACnC,OAAO,IAAI,QAAQ,MACjB,IAAI,KAAK,KAAK,GAAG;CAErB;CACA,IAAI,IAAI,OAAO,KAAA,KAAa,IAAI,KAAK,WAAW,GAAG,OAAO;CAC1D,OAAO;EAAE,GAAG,IAAI;EAAI,MAAM,IAAI;CAAK;AACrC;;AAUA,SAAgB,sBACd,SACA,iBACA,QACA,UAA+B,CAAC,GACvB;CACT,MAAM,SAAS,2BAA2B,eAAe;CACzD,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,YAAY,QAAQ,oBAAA;CAC1B,MAAM,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CACvD,IAAI,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,WAAW,OAAO;CACjD,MAAM,WAAW,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,KAAK;CAC3F,MAAM,cAAc,OAAO,KAAK,UAAU,MAAM;CAChD,KAAK,MAAM,OAAO,OAAO,MAAM;EAC7B,MAAM,SAAS,OAAO,KAAK,KAAK,MAAM;EACtC,IAAI,OAAO,WAAW,YAAY,QAAQ;EAC1C,IAAI,gBAAgB,QAAQ,WAAW,GAAG,OAAO;CACnD;CACA,OAAO;AACT;AAgBA,SAAgB,qBACd,SACA,iBACA,iBACA,QACA,UAA8B,CAAC,GACtB;CACT,IAAI,CAAC,gBAAgB,WAAW,KAAK,GAAG,OAAO;CAC/C,MAAM,KAAK,OAAO,eAAe;CACjC,IAAI,CAAC,OAAO,SAAS,EAAE,GAAG,OAAO;CACjC,MAAM,YAAY,QAAQ,oBAAA;CAC1B,MAAM,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CACvD,IAAI,KAAK,IAAI,MAAM,EAAE,IAAI,WAAW,OAAO;CAC3C,MAAM,WAAW,QAAQ,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,OAAO,KAAK;CAChG,MAAM,cAAc,OAAO,KAAK,UAAU,MAAM;CAChD,MAAM,SAAS,OAAO,KAAK,iBAAiB,MAAM;CAClD,IAAI,OAAO,WAAW,YAAY,QAAQ,OAAO;CACjD,OAAO,gBAAgB,QAAQ,WAAW;AAC5C;AAqBA,SAAgB,oBACd,SACA,iBACA,QACA,UAAoC,CAAC,GAC5B;CACT,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,SAAS,QAAQ,mBAAmB;CAC1C,MAAM,QAAQ,QAAQ,gBAAgB;CACtC,IAAI,YAAY;CAChB,IAAI,QAAQ;EACV,IAAI,CAAC,UAAU,WAAW,MAAM,GAAG,OAAO;EAC1C,YAAY,UAAU,MAAM,OAAO,MAAM;CAC3C;CACA,IAAI,OAAO,YAAY,UAAU,YAAY;CAC7C,MAAM,WAAW,WAAW,WAAW,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CAC3E,MAAM,cAAc,OAAO,KAAK,UAAU,MAAM;CAChD,MAAM,SAAS,OAAO,KAAK,WAAW,MAAM;CAC5C,IAAI,OAAO,WAAW,YAAY,QAAQ,OAAO;CACjD,OAAO,gBAAgB,QAAQ,WAAW;AAC5C;;AAmCA,SAAgB,sBACd,OAMA,UAA+B,CAAC,GACvB;CACT,IAAI,CAAC,MAAM,WACT,OAAO,QAAQ,6BAA6B;CAE9C,MAAM,YAAY,MAAM;CACxB,IAAI,CAAC,aAAa,MAAM,QAAQ,SAAS,GAAG,OAAO;CACnD,IAAI,CAAC,MAAM,SAAS,OAAO;CAE3B,MAAM,OAAO,QAAQ,cAAc,OAC/B,MAAM,WAAW,QAAQ,WAAW,MACpC,OAAO,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,CAC5B,KAAK,CAAC,CACN,QAAQ,KAAK,QAAQ,MAAM,OAAO,MAAM,OAAQ,QAAQ,KAAK,MAAM,OAAO;CAEjF,MAAM,WAAW,WAAW,QAAQ,MAAM,SAAS,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,QAAQ;CACjF,MAAM,cAAc,OAAO,KAAK,QAAQ;CACxC,MAAM,SAAS,OAAO,KAAK,SAAS;CACpC,IAAI,YAAY,WAAW,OAAO,QAAQ,OAAO;CACjD,OAAO,gBAAgB,aAAa,MAAM;AAC5C;;AAsBA,SAAgB,qBACd,SACA,iBACA,iBACA,QACA,UAA8B,CAAC,GACtB;CACT,MAAM,KAAK,OAAO,eAAe;CACjC,IAAI,CAAC,OAAO,SAAS,EAAE,GAAG,OAAO;CACjC,MAAM,YAAY,QAAQ,oBAAA;CAC1B,MAAM,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CACvD,IAAI,KAAK,IAAI,MAAM,EAAE,IAAI,WAAW,OAAO;CAC3C,MAAM,WAAW,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,GAAG,GAAG,GAAG,SAAS,CAAC,CAAC,OAAO,KAAK;CACrF,MAAM,cAAc,OAAO,KAAK,UAAU,MAAM;CAChD,MAAM,SAAS,OAAO,KAAK,gBAAgB,YAAY,GAAG,MAAM;CAChE,IAAI,OAAO,WAAW,YAAY,QAAQ,OAAO;CACjD,OAAO,gBAAgB,QAAQ,WAAW;AAC5C;AAQA,SAAgB,YACd,SACA,MACoB;CACpB,MAAM,IAAI,QAAQ,SACb,QAAQ,KAAK,YAAY,MACzB,OAAO,QAAQ,OAAO,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,YAAY,MAAM,KAAK,YAAY,CAAC,CAAC,GAAG;CACzF,IAAI,MAAM,QAAQ,CAAC,GAAG,OAAO,EAAE;CAC/B,OAAO,OAAO,MAAM,WAAW,IAAI,KAAA;AACrC"}