@usequeek/app-sdk 0.4.0

package/dist/store.js

@@ -0,0 +1,610 @@
+import { DatabaseSync } from "node:sqlite";
+import { Pool } from "pg";
+import { decryptSecret, encryptSecret, parseStoreKey } from "./crypto.js";
+const SEEN_TTL_SECONDS = 24 * 60 * 60;
+const INSTALLATIONS_TABLE_SQLITE = `
+      CREATE TABLE IF NOT EXISTS installations (
+        installation_id TEXT PRIMARY KEY,
+        installation_pid TEXT NOT NULL,
+        vendor_id TEXT NOT NULL,
+        store_pid TEXT,
+        store_name TEXT NOT NULL,
+        api_base TEXT NOT NULL,
+        token_enc TEXT,
+        token_expires_at TEXT,
+        token_kid TEXT,
+        pending INTEGER NOT NULL DEFAULT 0,
+        scopes_json TEXT NOT NULL,
+        settings_json TEXT NOT NULL,
+        webhook_secret_enc TEXT,
+        proxy_secret_enc TEXT,
+        embed_secret_enc TEXT,
+        app_id TEXT,
+        webhook_url TEXT,
+        webhook_topics_json TEXT NOT NULL,
+        installed_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS seen_webhook_ids (
+        webhook_id TEXT PRIMARY KEY,
+        seen_at INTEGER NOT NULL
+      );
+`;
+/**
+ * Default local/dev/test `InstallationStore`: SQLite through the Node 22
+ * built-in `node:sqlite` (`DatabaseSync` — synchronous, file-backed, WAL
+ * mode).
+ *
+ * Why not better-sqlite3: its prebuilt binary segfaults on the project's
+ * Node 22.12 runtime (observed, not theorised), and building from source
+ * would force a C++ toolchain into every environment — dev Macs, CI, and
+ * the slim alpine app images. `node:sqlite` is dependency-free with an
+ * identical synchronous shape.
+ *
+ * `node:sqlite` needs no flag since Node 22.13.0 (pinned runtime 22.23.3;
+ * an ExperimentalWarning on stderr remains — Stability 1.1). Devs on an
+ * older 22 minor set `NODE_OPTIONS=--experimental-sqlite` in their shell.
+ * Revisit when the apps run on a Node line where it is fully stable — the
+ * swap is contained here, behind `InstallationStore`.
+ *
+ * 0.1.x → 0.2.0 upgrade: databases created by SDK 0.1.x carry a legacy
+ * `api_key_enc` column (the handoff no longer delivers that key, so its
+ * value is dead — minted tokens replace it; resync restores connectivity).
+ * Opening such a database adds the token-cache columns and drops
+ * `api_key_enc`; the legacy ciphertext is discarded, never decrypted.
+ */
+export class SqliteInstallationStore {
+    db;
+    key;
+    constructor(options) {
+        this.key = parseStoreKey(options.storeKey);
+        this.db = new DatabaseSync(options.path);
+        this.db.exec("PRAGMA journal_mode = WAL;");
+        this.db.exec(INSTALLATIONS_TABLE_SQLITE);
+        this.migrateFromApiKeySchema();
+    }
+    migrateFromApiKeySchema() {
+        const columns = this.db.prepare(`PRAGMA table_info(installations)`).all();
+        const names = new Set(columns.map((column) => column.name));
+        if (names.has("api_key_enc")) {
+            for (const column of ["token_enc", "token_expires_at", "token_kid"]) {
+                if (!names.has(column))
+                    this.db.exec(`ALTER TABLE installations ADD COLUMN ${column} TEXT;`);
+            }
+            // The 0.1.x handoff key is superseded by minted installation tokens:
+            // its ciphertext is dropped, never decrypted or re-encrypted.
+            this.db.exec(`ALTER TABLE installations DROP COLUMN api_key_enc;`);
+        }
+        // Schema v2 (B2 review r2): the persisted 409-pending mark. Existing
+        // rows backfill to 0 (not pending); fresh tables already carry the
+        // column via the CREATE above, so this is a no-op for them.
+        const live = new Set(this.db.prepare(`PRAGMA table_info(installations)`).all().map((column) => column.name));
+        if (!live.has("pending")) {
+            this.db.exec(`ALTER TABLE installations ADD COLUMN pending INTEGER NOT NULL DEFAULT 0;`);
+        }
+        // Schema v3 (FA1): the installation proxy secret for slot-claim
+        // signing. Existing rows backfill to NULL (no proxy secret known
+        // until the next install/resync handoff); fresh tables already carry
+        // the column via the CREATE above, so this is a no-op for them.
+        if (!live.has("proxy_secret_enc")) {
+            this.db.exec(`ALTER TABLE installations ADD COLUMN proxy_secret_enc TEXT;`);
+        }
+        // Schema v4 (S4): the embed secret + app id that verify dashboard
+        // session tokens. Existing rows backfill to NULL until the next
+        // install/resync handoff delivers them.
+        if (!live.has("embed_secret_enc")) {
+            this.db.exec(`ALTER TABLE installations ADD COLUMN embed_secret_enc TEXT;`);
+        }
+        if (!live.has("app_id")) {
+            this.db.exec(`ALTER TABLE installations ADD COLUMN app_id TEXT;`);
+        }
+    }
+    saveInstallation(record) {
+        const now = new Date().toISOString();
+        this.db
+            .prepare(`INSERT INTO installations (
+          installation_id, installation_pid, vendor_id, store_pid, store_name,
+          api_base, token_enc, token_expires_at, token_kid, pending,
+          scopes_json, settings_json,
+          webhook_secret_enc, proxy_secret_enc, embed_secret_enc, app_id, webhook_url, webhook_topics_json,
+          installed_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(installation_id) DO UPDATE SET
+          installation_pid = excluded.installation_pid,
+          vendor_id = excluded.vendor_id,
+          store_pid = excluded.store_pid,
+          store_name = excluded.store_name,
+          api_base = excluded.api_base,
+          token_enc = excluded.token_enc,
+          token_expires_at = excluded.token_expires_at,
+          token_kid = excluded.token_kid,
+          pending = excluded.pending,
+          scopes_json = excluded.scopes_json,
+          settings_json = excluded.settings_json,
+          webhook_secret_enc = excluded.webhook_secret_enc,
+          proxy_secret_enc = excluded.proxy_secret_enc,
+          embed_secret_enc = excluded.embed_secret_enc,
+          app_id = excluded.app_id,
+          webhook_url = excluded.webhook_url,
+          webhook_topics_json = excluded.webhook_topics_json,
+          updated_at = excluded.updated_at`)
+            .run(record.installationId, record.installationPid, record.vendorId, record.storePid, record.storeName, record.apiBase, record.token === null ? null : encryptSecret(record.token, this.key), record.tokenExpiresAt, record.tokenKid, record.pending ? 1 : 0, JSON.stringify(record.scopes), encryptSecret(JSON.stringify(record.settings), this.key), record.webhookSecret === null ? null : encryptSecret(record.webhookSecret, this.key), record.proxySecret === null || record.proxySecret === undefined
+            ? null
+            : encryptSecret(record.proxySecret, this.key), record.embedSecret === null || record.embedSecret === undefined
+            ? null
+            : encryptSecret(record.embedSecret, this.key), record.appId ?? null, record.webhookUrl, JSON.stringify(record.webhookTopics), record.installedAt, now);
+    }
+    getInstallation(installationId) {
+        const row = this.db
+            .prepare(`SELECT * FROM installations WHERE installation_id = ?`)
+            .get(installationId);
+        if (!row)
+            return null;
+        return rowToRecord(row, this.key);
+    }
+    listInstallations() {
+        const rows = this.db.prepare(`SELECT * FROM installations ORDER BY installation_id`).all();
+        return rows.map((row) => rowToRecord(row, this.key));
+    }
+    clearCachedToken(installationId) {
+        this.db
+            .prepare(`UPDATE installations SET token_enc = NULL, token_expires_at = NULL, token_kid = NULL
+         WHERE installation_id = ?`)
+            .run(installationId);
+    }
+    clearAllCachedTokens() {
+        this.db
+            .prepare(`UPDATE installations SET token_enc = NULL, token_expires_at = NULL, token_kid = NULL`)
+            .run();
+    }
+    deleteInstallation(installationId) {
+        this.db.prepare(`DELETE FROM installations WHERE installation_id = ?`).run(installationId);
+    }
+    markInstallationPending(installationId) {
+        this.db.prepare(`UPDATE installations SET pending = 1 WHERE installation_id = ?`).run(installationId);
+    }
+    clearInstallationPending(installationId) {
+        this.db.prepare(`UPDATE installations SET pending = 0 WHERE installation_id = ?`).run(installationId);
+    }
+    isKnownPending(installationId) {
+        const row = this.db
+            .prepare(`SELECT pending FROM installations WHERE installation_id = ?`)
+            .get(installationId);
+        if (!row)
+            return false;
+        return toPendingFlag(row.pending);
+    }
+    listWebhookSecrets() {
+        const rows = this.db
+            .prepare(`SELECT installation_id, webhook_secret_enc FROM installations WHERE webhook_secret_enc IS NOT NULL`)
+            .all();
+        return rows.map((row) => ({
+            installationId: row.installation_id,
+            secret: decryptSecret(row.webhook_secret_enc, this.key),
+        }));
+    }
+    hasSeenWebhookId(webhookId) {
+        this.pruneSeenIds();
+        return (this.db.prepare(`SELECT 1 AS one FROM seen_webhook_ids WHERE webhook_id = ?`).get(webhookId) !==
+            undefined);
+    }
+    markWebhookSeen(webhookId) {
+        this.db
+            .prepare(`INSERT OR IGNORE INTO seen_webhook_ids (webhook_id, seen_at) VALUES (?, ?)`)
+            .run(webhookId, Date.now());
+    }
+    claimWebhookId(webhookId) {
+        this.pruneSeenIds();
+        const result = this.db
+            .prepare(`INSERT OR IGNORE INTO seen_webhook_ids (webhook_id, seen_at) VALUES (?, ?)`)
+            .run(webhookId, Date.now());
+        return Number(result.changes) === 1;
+    }
+    releaseWebhookId(webhookId) {
+        this.db.prepare(`DELETE FROM seen_webhook_ids WHERE webhook_id = ?`).run(webhookId);
+    }
+    pruneSeenIds() {
+        this.db
+            .prepare(`DELETE FROM seen_webhook_ids WHERE seen_at < ?`)
+            .run(Date.now() - SEEN_TTL_SECONDS * 1000);
+    }
+    close() {
+        this.db.close();
+    }
+}
+function rowToRecord(row, key) {
+    return {
+        installationId: column(row.installation_id),
+        installationPid: column(row.installation_pid),
+        vendorId: column(row.vendor_id),
+        storePid: row.store_pid ?? null,
+        storeName: column(row.store_name),
+        apiBase: column(row.api_base),
+        token: row.token_enc === null ? null : decryptSecret(column(row.token_enc), key),
+        tokenExpiresAt: row.token_expires_at ?? null,
+        tokenKid: row.token_kid ?? null,
+        pending: toPendingFlag(row.pending),
+        scopes: JSON.parse(column(row.scopes_json)),
+        settings: JSON.parse(decryptSecret(column(row.settings_json), key)),
+        webhookSecret: row.webhook_secret_enc === null ? null : decryptSecret(column(row.webhook_secret_enc), key),
+        proxySecret: row.proxy_secret_enc === null || row.proxy_secret_enc === undefined
+            ? null
+            : decryptSecret(column(row.proxy_secret_enc), key),
+        embedSecret: row.embed_secret_enc === null || row.embed_secret_enc === undefined
+            ? null
+            : decryptSecret(column(row.embed_secret_enc), key),
+        appId: row.app_id ?? null,
+        webhookUrl: row.webhook_url ?? null,
+        webhookTopics: JSON.parse(column(row.webhook_topics_json)),
+        installedAt: column(row.installed_at),
+        updatedAt: column(row.updated_at),
+    };
+}
+function column(value) {
+    if (typeof value !== "string")
+        throw new Error("Unexpected non-string column in installations table.");
+    return value;
+}
+/**
+ * Read the persisted pending flag across drivers: SQLite stores
+ * `INTEGER 0/1`, Postgres `BOOLEAN`. Anything unrecognised (including
+ * NULL on a pre-migration row, which cannot happen — the column is NOT
+ * NULL with a default — but belt-and-braces) reads as not pending.
+ */
+function toPendingFlag(value) {
+    return value === true || value === 1 || value === "1" || value === "t" || value === "true";
+}
+/**
+ * Current schema revision, stored as exactly one row in `schema_version`
+ * (Postgres) and enforced by column-presence migration (SQLite).
+ * v2 adds the persisted 409-pending mark (`pending`, NOT NULL DEFAULT
+ * false on both drivers); v3 the proxy secret; v4 the embed secret and
+ * app id that verify dashboard session tokens (all nullable).
+ */
+export const INSTALLATION_SCHEMA_VERSION = 4;
+/**
+ * Build one shared `pg` Pool for a process (the SDK store and the app's
+ * own store both run on it — total connections per app stay small: one
+ * pool of N per process instead of one pool per store). Attaches the same
+ * idle-client error guard the store constructors use, so a dropped idle
+ * connection never surfaces as an uncaught exception.
+ */
+export function createPostgresPool(connectionString, max = 2) {
+    const pool = new Pool({ connectionString, max });
+    pool.on("error", () => {
+        // Idle-client errors have no request to fail: without this listener
+        // they throw as uncaught exceptions. Query errors still reject their
+        // own promises. (Deliberately no logging here: the store owns no
+        // logger, and logging pool internals would risk leaking the DSN.)
+    });
+    return pool;
+}
+const SCHEMA_ADVISORY_LOCK = "queek-app-sdk:installations-schema-v1";
+/**
+ * Production `InstallationStore`: Postgres through `pg` (`Pool`, max 2).
+ *
+ * Schema safety when two containers boot together: the first statement of
+ * `ensureSchema()` takes a Postgres advisory lock, then creates the tables
+ * plus exactly one `schema_version` row, then releases the lock — so
+ * concurrent boots serialize instead of racing DDL. Every store method
+ * awaits the same cached init promise, so no query runs before the schema
+ * exists. The AES-256-GCM envelope is byte-identical to the SQLite store
+ * (same `encryptSecret`/`decryptSecret`, same `APP_ENCRYPTION_KEY`).
+ */
+export class PostgresInstallationStore {
+    pool;
+    ownsPool;
+    key;
+    ready;
+    constructor(options) {
+        this.key = parseStoreKey(options.storeKey);
+        if (options.pool) {
+            this.pool = options.pool;
+            this.ownsPool = false;
+        }
+        else if (options.connectionString) {
+            this.pool = createPostgresPool(options.connectionString, options.poolMax ?? 2);
+            this.ownsPool = true;
+        }
+        else {
+            throw new Error("PostgresInstallationStore needs a connectionString or a shared pool.");
+        }
+        this.ready = this.ensureSchema();
+        // Methods awaiting `ready` surface a connection failure themselves;
+        // this preempts an unhandled rejection when Postgres is unreachable at
+        // construction (the first call still throws the real error).
+        this.ready.catch(() => undefined);
+    }
+    async ensureSchema() {
+        const client = await this.pool.connect();
+        try {
+            await client.query(`SELECT pg_advisory_lock(hashtext($1))`, [SCHEMA_ADVISORY_LOCK]);
+            try {
+                await client.query(`
+          CREATE TABLE IF NOT EXISTS schema_version (
+            version INTEGER PRIMARY KEY,
+            applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+          );
+          CREATE TABLE IF NOT EXISTS installations (
+            installation_id TEXT PRIMARY KEY,
+            installation_pid TEXT NOT NULL,
+            vendor_id TEXT NOT NULL,
+            store_pid TEXT,
+            store_name TEXT NOT NULL,
+            api_base TEXT NOT NULL,
+            token_enc TEXT,
+            token_expires_at TIMESTAMPTZ,
+            token_kid TEXT,
+            pending BOOLEAN NOT NULL DEFAULT FALSE,
+            scopes_json TEXT NOT NULL,
+            settings_json TEXT NOT NULL,
+            webhook_secret_enc TEXT,
+            proxy_secret_enc TEXT,
+            embed_secret_enc TEXT,
+            app_id TEXT,
+            webhook_url TEXT,
+            webhook_topics_json TEXT NOT NULL,
+            installed_at TIMESTAMPTZ NOT NULL,
+            updated_at TIMESTAMPTZ NOT NULL
+          );
+          CREATE TABLE IF NOT EXISTS seen_webhook_ids (
+            webhook_id TEXT PRIMARY KEY,
+            seen_at BIGINT NOT NULL
+          );
+          -- Schema v2 (B2 review r2): the persisted 409-pending mark.
+          -- Fresh tables already carry the column; this migrates v1
+          -- databases in place (existing rows backfill to FALSE).
+          ALTER TABLE installations
+          ADD COLUMN IF NOT EXISTS pending BOOLEAN NOT NULL DEFAULT FALSE;
+          -- Schema v3 (FA1): the installation proxy secret for slot-claim
+          -- signing. Existing rows backfill to NULL (unknown until the
+          -- next install/resync handoff).
+          ALTER TABLE installations
+          ADD COLUMN IF NOT EXISTS proxy_secret_enc TEXT;
+          -- Schema v4 (S4): the embed secret + app id that verify
+          -- dashboard session tokens (NULL until the next handoff).
+          ALTER TABLE installations
+          ADD COLUMN IF NOT EXISTS embed_secret_enc TEXT;
+          ALTER TABLE installations
+          ADD COLUMN IF NOT EXISTS app_id TEXT;
+          -- The guard row always converges to exactly one row at the
+          -- current version: v1 databases gain the v2 row and lose the v1
+          -- row; fresh databases insert it directly.
+          INSERT INTO schema_version (version) VALUES (${INSTALLATION_SCHEMA_VERSION})
+          ON CONFLICT (version) DO NOTHING;
+          DELETE FROM schema_version WHERE version < ${INSTALLATION_SCHEMA_VERSION};
+        `);
+            }
+            finally {
+                await client.query(`SELECT pg_advisory_unlock(hashtext($1))`, [SCHEMA_ADVISORY_LOCK]);
+            }
+        }
+        finally {
+            client.release();
+        }
+    }
+    async saveInstallation(record) {
+        await this.ready;
+        const now = new Date().toISOString();
+        await this.pool.query(`INSERT INTO installations (
+         installation_id, installation_pid, vendor_id, store_pid, store_name,
+         api_base, token_enc, token_expires_at, token_kid, pending,
+         scopes_json, settings_json,
+         webhook_secret_enc, proxy_secret_enc, embed_secret_enc, app_id, webhook_url, webhook_topics_json,
+         installed_at, updated_at
+       ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)
+       ON CONFLICT (installation_id) DO UPDATE SET
+         installation_pid = excluded.installation_pid,
+         vendor_id = excluded.vendor_id,
+         store_pid = excluded.store_pid,
+         store_name = excluded.store_name,
+         api_base = excluded.api_base,
+         token_enc = excluded.token_enc,
+         token_expires_at = excluded.token_expires_at,
+         token_kid = excluded.token_kid,
+         pending = excluded.pending,
+         scopes_json = excluded.scopes_json,
+         settings_json = excluded.settings_json,
+         webhook_secret_enc = excluded.webhook_secret_enc,
+         proxy_secret_enc = excluded.proxy_secret_enc,
+         embed_secret_enc = excluded.embed_secret_enc,
+         app_id = excluded.app_id,
+         webhook_url = excluded.webhook_url,
+         webhook_topics_json = excluded.webhook_topics_json,
+         updated_at = excluded.updated_at`, [
+            record.installationId,
+            record.installationPid,
+            record.vendorId,
+            record.storePid,
+            record.storeName,
+            record.apiBase,
+            record.token === null ? null : encryptSecret(record.token, this.key),
+            record.tokenExpiresAt,
+            record.tokenKid,
+            record.pending,
+            JSON.stringify(record.scopes),
+            encryptSecret(JSON.stringify(record.settings), this.key),
+            record.webhookSecret === null ? null : encryptSecret(record.webhookSecret, this.key),
+            record.proxySecret === null || record.proxySecret === undefined
+                ? null
+                : encryptSecret(record.proxySecret, this.key),
+            record.embedSecret === null || record.embedSecret === undefined
+                ? null
+                : encryptSecret(record.embedSecret, this.key),
+            record.appId ?? null,
+            record.webhookUrl,
+            JSON.stringify(record.webhookTopics),
+            record.installedAt,
+            now,
+        ]);
+    }
+    async getInstallation(installationId) {
+        await this.ready;
+        const result = await this.pool.query(`SELECT * FROM installations WHERE installation_id = $1`, [
+            installationId,
+        ]);
+        const row = result.rows[0];
+        if (!row)
+            return null;
+        return pgRowToRecord(row, this.key);
+    }
+    async listInstallations() {
+        await this.ready;
+        const result = await this.pool.query(`SELECT * FROM installations ORDER BY installation_id`);
+        return result.rows.map((row) => pgRowToRecord(row, this.key));
+    }
+    async clearCachedToken(installationId) {
+        await this.ready;
+        await this.pool.query(`UPDATE installations SET token_enc = NULL, token_expires_at = NULL, token_kid = NULL
+       WHERE installation_id = $1`, [installationId]);
+    }
+    async clearAllCachedTokens() {
+        await this.ready;
+        await this.pool.query(`UPDATE installations SET token_enc = NULL, token_expires_at = NULL, token_kid = NULL`);
+    }
+    async deleteInstallation(installationId) {
+        await this.ready;
+        await this.pool.query(`DELETE FROM installations WHERE installation_id = $1`, [installationId]);
+    }
+    async markInstallationPending(installationId) {
+        await this.ready;
+        await this.pool.query(`UPDATE installations SET pending = TRUE WHERE installation_id = $1`, [
+            installationId,
+        ]);
+    }
+    async clearInstallationPending(installationId) {
+        await this.ready;
+        await this.pool.query(`UPDATE installations SET pending = FALSE WHERE installation_id = $1`, [
+            installationId,
+        ]);
+    }
+    async isKnownPending(installationId) {
+        await this.ready;
+        const result = await this.pool.query(`SELECT pending FROM installations WHERE installation_id = $1`, [
+            installationId,
+        ]);
+        const row = result.rows[0];
+        if (!row)
+            return false;
+        return toPendingFlag(row.pending);
+    }
+    async listWebhookSecrets() {
+        await this.ready;
+        const result = await this.pool.query(`SELECT installation_id, webhook_secret_enc FROM installations WHERE webhook_secret_enc IS NOT NULL`);
+        return result.rows.map((row) => ({
+            installationId: row.installation_id,
+            secret: decryptSecret(row.webhook_secret_enc, this.key),
+        }));
+    }
+    async hasSeenWebhookId(webhookId) {
+        await this.ready;
+        await this.pruneSeenIds();
+        const result = await this.pool.query(`SELECT 1 AS one FROM seen_webhook_ids WHERE webhook_id = $1`, [
+            webhookId,
+        ]);
+        return result.rowCount !== 0;
+    }
+    async markWebhookSeen(webhookId) {
+        await this.ready;
+        await this.pool.query(`INSERT INTO seen_webhook_ids (webhook_id, seen_at) VALUES ($1, $2) ON CONFLICT DO NOTHING`, [webhookId, Date.now()]);
+    }
+    async claimWebhookId(webhookId) {
+        await this.ready;
+        await this.pruneSeenIds();
+        const result = await this.pool.query(`INSERT INTO seen_webhook_ids (webhook_id, seen_at) VALUES ($1, $2)
+       ON CONFLICT (webhook_id) DO NOTHING RETURNING webhook_id`, [webhookId, Date.now()]);
+        return (result.rowCount ?? 0) === 1;
+    }
+    async releaseWebhookId(webhookId) {
+        await this.ready;
+        await this.pool.query(`DELETE FROM seen_webhook_ids WHERE webhook_id = $1`, [webhookId]);
+    }
+    async pruneSeenIds() {
+        await this.pool.query(`DELETE FROM seen_webhook_ids WHERE seen_at < $1`, [
+            Date.now() - SEEN_TTL_SECONDS * 1000,
+        ]);
+    }
+    /**
+     * Drain the pool (tests and graceful shutdown). A no-op when the store
+     * runs on a shared pool it does not own — the pool owner ends it.
+     */
+    async close() {
+        if (this.ownsPool)
+            await this.pool.end();
+    }
+}
+function pgText(value, name) {
+    if (typeof value !== "string")
+        throw new Error(`Unexpected non-string column ${name}.`);
+    return value;
+}
+function pgRowToRecord(row, key) {
+    const tokenEnc = row.token_enc;
+    const webhookSecretEnc = row.webhook_secret_enc;
+    const expires = row.token_expires_at;
+    return {
+        installationId: pgText(row.installation_id, "installation_id"),
+        installationPid: pgText(row.installation_pid, "installation_pid"),
+        vendorId: pgText(row.vendor_id, "vendor_id"),
+        storePid: row.store_pid ?? null,
+        storeName: pgText(row.store_name, "store_name"),
+        apiBase: pgText(row.api_base, "api_base"),
+        token: tokenEnc === null ? null : decryptSecret(tokenEnc, key),
+        tokenExpiresAt: expires === null
+            ? null
+            : expires instanceof Date
+                ? expires.toISOString()
+                : new Date(expires).toISOString(),
+        tokenKid: row.token_kid ?? null,
+        pending: toPendingFlag(row.pending),
+        scopes: JSON.parse(pgText(row.scopes_json, "scopes_json")),
+        settings: JSON.parse(decryptSecret(pgText(row.settings_json, "settings_json"), key)),
+        webhookSecret: webhookSecretEnc === null ? null : decryptSecret(webhookSecretEnc, key),
+        proxySecret: (() => {
+            const enc = row.proxy_secret_enc;
+            return enc === null || enc === undefined ? null : decryptSecret(enc, key);
+        })(),
+        embedSecret: (() => {
+            const enc = row.embed_secret_enc;
+            return enc === null || enc === undefined ? null : decryptSecret(enc, key);
+        })(),
+        appId: row.app_id ?? null,
+        webhookUrl: row.webhook_url ?? null,
+        webhookTopics: JSON.parse(pgText(row.webhook_topics_json, "webhook_topics_json")),
+        installedAt: toIso(row.installed_at),
+        updatedAt: toIso(row.updated_at),
+    };
+}
+function toIso(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    return new Date(pgText(value, "timestamp")).toISOString();
+}
+/**
+ * Pick the installation store: `DATABASE_URL` set (or a shared `pool`
+ * given) → Postgres; otherwise SQLite — which production REFUSES (fail
+ * fast with a clear message: a live app must never run on a
+ * container-local database).
+ */
+export function createInstallationStore(options) {
+    if (options.pool) {
+        return new PostgresInstallationStore({ storeKey: options.storeKey, pool: options.pool });
+    }
+    const databaseUrl = (options.databaseUrl ?? process.env.DATABASE_URL ?? "").trim();
+    if (databaseUrl !== "") {
+        return new PostgresInstallationStore({
+            connectionString: databaseUrl,
+            storeKey: options.storeKey,
+            poolMax: options.poolMax,
+        });
+    }
+    if ((process.env.NODE_ENV ?? "") === "production") {
+        throw new Error("Refusing to start on SQLite in production: set DATABASE_URL to the app's Postgres database " +
+            "(one database per app; SQLite is local/dev/test only).");
+    }
+    return new SqliteInstallationStore({
+        path: options.sqlitePath ?? process.env.QUEEK_DB_PATH ?? "./data/installations.db",
+        storeKey: options.storeKey,
+    });
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuI1E,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEtC,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BlC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,uBAAuB;IACjB,EAAE,CAAe;IACjB,GAAG,CAAS;IAE7B,YAAY,OAA2B;QACrC,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzC,IAAI,CAAC,uBAAuB,EAAE,CAAC;IACjC,CAAC;IAEO,uBAAuB;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,GAAG,EAA6B,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,MAAM,IAAI,CAAC,WAAW,EAAE,kBAAkB,EAAE,WAAW,CAAU,EAAE,CAAC;gBAC7E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,wCAAwC,MAAM,QAAQ,CAAC,CAAC;YAC/F,CAAC;YACD,qEAAqE;YACrE,8DAA8D;YAC9D,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACrE,CAAC;QACD,qEAAqE;QACrE,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,CACjB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CACxF,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CACxB,CACF,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC3F,CAAC;QACD,gEAAgE;QAChE,iEAAiE;QACjE,qEAAqE;QACrE,gEAAgE;QAChE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC9E,CAAC;QACD,kEAAkE;QAClE,gEAAgE;QAChE,wCAAwC;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,MAA0B;QACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;;;;;;;;;;;;;;;;;;;;;;;;;2CAyBmC,CACpC;aACA,GAAG,CACF,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EACpE,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7B,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EACxD,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,EACpF,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAC7D,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,EAC/C,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;YAC7D,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,EAC/C,MAAM,CAAC,KAAK,IAAI,IAAI,EACpB,MAAM,CAAC,UAAU,EACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EACpC,MAAM,CAAC,WAAW,EAClB,GAAG,CACJ,CAAC;IACN,CAAC;IAED,eAAe,CAAC,cAAsB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,cAAc,CAA8C,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,iBAAiB;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,EAEvF,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,gBAAgB,CAAC,cAAsB;QACrC,IAAI,CAAC,EAAE;aACJ,OAAO,CACN;mCAC2B,CAC5B;aACA,GAAG,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IAED,oBAAoB;QAClB,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,sFAAsF,CAAC;aAC/F,GAAG,EAAE,CAAC;IACX,CAAC;IAED,kBAAkB,CAAC,cAAsB;QACvC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7F,CAAC;IAED,uBAAuB,CAAC,cAAsB;QAC5C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxG,CAAC;IAED,wBAAwB,CAAC,cAAsB;QAC7C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxG,CAAC;IAED,cAAc,CAAC,cAAsB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,OAAO,CAAC,6DAA6D,CAAC;aACtE,GAAG,CAAC,cAAc,CAAqC,CAAC;QAC3D,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,kBAAkB;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACN,oGAAoG,CACrG;aACA,GAAG,EAAoE,CAAC;QAC3E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,cAAc,EAAE,GAAG,CAAC,eAAe;YACnC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,CACL,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAC5F,SAAS,CACV,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,4EAA4E,CAAC;aACrF,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACnB,OAAO,CAAC,4EAA4E,CAAC;aACrF,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAA4C,CAAC;QACzE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,gDAAgD,CAAC;aACzD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAAkC,EAAE,GAAW;IAClE,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC7C,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,KAAK,EAAE,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QAChF,cAAc,EAAG,GAAG,CAAC,gBAAkC,IAAI,IAAI;QAC/D,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAa;QACvD,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAA4B;QAC9F,aAAa,EACX,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,GAAG,CAAC;QAC7F,WAAW,EACT,GAAG,CAAC,gBAAgB,KAAK,IAAI,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS;YACjE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC;QACtD,WAAW,EACT,GAAG,CAAC,gBAAgB,KAAK,IAAI,IAAI,GAAG,CAAC,gBAAgB,KAAK,SAAS;YACjE,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC;QACtD,KAAK,EAAG,GAAG,CAAC,MAAoC,IAAI,IAAI;QACxD,UAAU,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACtD,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAa;QACtE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACvG,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AA0B7C;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAAwB,EAAE,GAAG,GAAG,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACpB,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,kEAAkE;IACpE,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,oBAAoB,GAAG,uCAAuC,CAAC;AAErE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yBAAyB;IACnB,IAAI,CAAO;IACX,QAAQ,CAAU;IAClB,GAAG,CAAS;IACZ,KAAK,CAAgB;IAEtC,YAAY,OAA6B;QACvC,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;aAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,oEAAoE;QACpE,uEAAuE;QACvE,6DAA6D;QAC7D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDAkD8B,2BAA2B;;uDAE7B,2BAA2B;SACzE,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAA0B;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;;;;;;;;;;;;;;;;;;;;;;;;;0CAyBoC,EACpC;YACE,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,eAAe;YACtB,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,SAAS;YAChB,MAAM,CAAC,OAAO;YACd,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;YACpE,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,OAAO;YACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC;YACxD,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC;YACpF,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;gBAC7D,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/C,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;gBAC7D,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC;YAC/C,MAAM,CAAC,KAAK,IAAI,IAAI;YACpB,MAAM,CAAC,UAAU;YACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC;YACpC,MAAM,CAAC,WAAW;YAClB,GAAG;SACJ,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,cAAsB;QAC1C,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,wDAAwD,EAAE;YAC7F,cAAc;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAwC,CAAC;QAClE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC7F,OAAQ,MAAM,CAAC,IAAuC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,cAAsB;QAC3C,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB;kCAC4B,EAC5B,CAAC,cAAc,CAAC,CACjB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,cAAsB;QAC7C,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,cAAsB;QAClD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oEAAoE,EAAE;YAC1F,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,cAAsB;QACnD,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,qEAAqE,EAAE;YAC3F,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,cAAsB;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,8DAA8D,EAAE;YACnG,cAAc;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAqC,CAAC;QAC/D,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC,oGAAoG,CACrG,CAAC;QACF,OAAQ,MAAM,CAAC,IAAuE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnG,cAAc,EAAE,GAAG,CAAC,eAAe;YACnC,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,6DAA6D,EAAE;YAClG,SAAS;SACV,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,2FAA2F,EAC3F,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC;gEAC0D,EAC1D,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CACxB,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oDAAoD,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,iDAAiD,EAAE;YACvE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI;SACrC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,GAAG,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,GAAW;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,SAA0B,CAAC;IAChD,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAmC,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAwC,CAAC;IAC7D,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC9D,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC;QAC5C,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC;QAC/C,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACzC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC9D,cAAc,EACZ,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,YAAY,IAAI;gBACvB,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE;gBACvB,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;QACvC,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAa;QACtE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,CAGlF;QACD,aAAa,EAAE,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,EAAE,GAAG,CAAC;QACtF,WAAW,EAAE,CAAC,GAAG,EAAE;YACjB,MAAM,GAAG,GAAG,GAAG,CAAC,gBAA6C,CAAC;YAC9D,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC,CAAC,EAAE;QACJ,WAAW,EAAE,CAAC,GAAG,EAAE;YACjB,MAAM,GAAG,GAAG,GAAG,CAAC,gBAA6C,CAAC;YAC9D,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC,CAAC,EAAE;QACJ,KAAK,EAAG,GAAG,CAAC,MAAoC,IAAI,IAAI;QACxD,UAAU,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACtD,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAa;QAC7F,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5D,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkC;IACxE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,IAAI,yBAAyB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,OAAO,IAAI,yBAAyB,CAAC;YACnC,gBAAgB,EAAE,WAAW;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,6FAA6F;YAC3F,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC;QACjC,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,yBAAyB;QAClF,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;AACL,CAAC"}