@usequeek/app-sdk 0.4.0

package/dist/app-auth.js

@@ -0,0 +1,205 @@
+import { createPrivateKey, createSign } from "node:crypto";
+/**
+ * The app credential (S1, SDK 0.2.0): ONE asymmetric RS256 key per app.
+ * Queek holds the PUBLIC keys (`apps.public_keys`, kid-capped); the app
+ * holds the PRIVATE key in `APP_PRIVATE_KEY` and signs short-lived app
+ * JWTs that mint per-installation tokens (`acquireToken()`).
+ *
+ * Wire contract (BINDING for B2 and S1): every call under `/api/v1/apps`
+ * carries `Authorization: Bearer <app JWT>` (RS256, header `kid`, claims
+ * `iss` = app slug, `iat`, `exp`, `exp − iat` ≤ 600 s). `node:crypto` only
+ * — no new dependency. The JWT and the private key are NEVER logged (the
+ * logger redacts `Bearer …` values; signers below never emit them).
+ */
+// ---------------------------------------------------------------------------
+// Wire-contract error codes. Each code the SDK reacts to lives in EXACTLY
+// one constant here, so a backend rename is a one-line change the parallel
+// B1/B2 build must confirm.
+// ---------------------------------------------------------------------------
+/** 401 on an app-credential call: bad/expired JWT or unknown kid. Fatal for the app. */
+export const INVALID_CLIENT_CODE = "invalid_client";
+/**
+ * 403 on an app-credential call: the app is disabled or its token epoch was
+ * bumped by `app:revoke-tokens` (kill switch). Confirmed against B1
+ * (`ApiError::APP_TOKEN_REVOKED`, returned in both cases); matched in
+ * exactly one place (`isAppTokenRevoked`).
+ */
+export const APP_TOKEN_REVOKED_CODE = "app_token_revoked";
+/** 404 on an installation-scoped app call: purge that installation locally. */
+export const APP_INSTALLATION_GONE_CODE = "app_installation_gone";
+/**
+ * 409 on an installation-scoped app call: the installation is PENDING
+ * (not yet active). Retry later with backoff — NEVER purge, NEVER halt.
+ * `GET installations` lists active installations only, so a pending row is
+ * absent from the list: resync's purge-absent step must keep local rows
+ * the app knows (via a 409) are pending.
+ */
+export const APP_INSTALLATION_PENDING_CODE = "app_installation_pending";
+/**
+ * 429 on a per-installation resync: the ≤1/hour rotation COOLDOWN. Skip
+ * that installation (recorded, no retry loop). Any OTHER resync 429 is the
+ * per-app bucket (`too_many_requests`): back off on `Retry-After`
+ * (jittered) and retry — never recorded as a cooldown skip.
+ */
+export const RESYNC_COOLDOWN_CODE = "resync_cooldown";
+/** 429 everywhere: honor `Retry-After`, jittered. */
+export const TOO_MANY_REQUESTS_CODE = "too_many_requests";
+/** True when a Queek error code is the kill-switch/disabled refusal. */
+export function isAppTokenRevoked(code) {
+    return code === APP_TOKEN_REVOKED_CODE;
+}
+/** True when a Queek error code is the fatal app-credential refusal. */
+export function isInvalidClient(code) {
+    return code === INVALID_CLIENT_CODE;
+}
+/** True when a Queek error code means the installation is gone server-side. */
+export function isInstallationGone(code) {
+    return code === APP_INSTALLATION_GONE_CODE;
+}
+/** True when a Queek error code means the installation is pending (409: retry later, never purge). */
+export function isInstallationPending(code) {
+    return code === APP_INSTALLATION_PENDING_CODE;
+}
+/** True when a resync 429 code is the per-installation rotation cooldown (skip, recorded). */
+export function isResyncCooldown(code) {
+    return code === RESYNC_COOLDOWN_CODE;
+}
+/**
+ * Merchant-API token-refusal codes (rev 7): a token in one of these states
+ * is dead — drop it, re-mint once, retry once. `api_key_revoked` covers the
+ * uninstalled store, the removed kid, and the replaced K-slot; the re-mint
+ * then answers 404 `app_installation_gone` (purge) or 401 `invalid_client`
+ * (halt) where applicable. Every OTHER merchant 403 (scope, plan, mode)
+ * propagates to the caller without a mint.
+ */
+export const API_KEY_REVOKED_CODE = "api_key_revoked";
+export const API_KEY_EXPIRED_CODE = "api_key_expired";
+export const INVALID_CLIENT_KEY_CODE = "invalid_client_key";
+/**
+ * True when a merchant-API refusal means the presented token is dead: any
+ * 401, or a 403 with a revoked/expired-key code. `app_token_revoked` is
+ * deliberately NOT here — that is the app-wide kill switch (drop all +
+ * halt), not a single dead token.
+ */
+export function isTokenRefusal(status, code) {
+    if (status === 401)
+        return true;
+    return (status === 403 &&
+        (code === API_KEY_REVOKED_CODE || code === API_KEY_EXPIRED_CODE || code === INVALID_CLIENT_KEY_CODE));
+}
+// ---------------------------------------------------------------------------
+// Timing bounds (all in the open, all injectable in tests).
+// ---------------------------------------------------------------------------
+/** App-JWT `iat` is backdated this far (clock skew, GitHub's recommendation). */
+export const APP_JWT_SKEW_SECONDS = 60;
+/** App-JWT lifetime: `exp = iat + 540`, so `exp − iat` (540 s) stays ≤ the 600 s wire bound. */
+export const APP_JWT_TTL_SECONDS = 540;
+/** A cached installation token counts as valid only while its expiry is more than this far away. */
+export const TOKEN_VALIDITY_SKEW_SECONDS = 300;
+/** Mint attempts per `acquireToken` before surfacing a 429/5xx (1 initial + retries). */
+export const MAX_MINT_ATTEMPTS = 3;
+/** 5xx backoff base (doubles per attempt); every sleep also carries uniform jitter (see below). */
+export const MINT_BACKOFF_BASE_MS = 250;
+/** 5xx backoff ceiling (a 429 `Retry-After` may exceed it — the server's word wins). */
+export const MINT_BACKOFF_MAX_MS = 5_000;
+/** Uniform jitter added to every mint/resync backoff sleep (0–1000 ms). */
+export const RETRY_JITTER_MAX_MS = 1_000;
+// ---------------------------------------------------------------------------
+// Credential.
+// ---------------------------------------------------------------------------
+/** Thrown when `APP_PRIVATE_KEY`/`APP_KEY_ID`/slug fail validation — before any fetch. */
+export class InvalidAppCredentialError extends Error {
+    code = "invalid_app_credential";
+    constructor(message) {
+        super(message);
+        this.name = "InvalidAppCredentialError";
+    }
+}
+/**
+ * Thrown (and cached in-process) when Queek refuses the app itself:
+ * `invalid_client` (bad/unknown key — fatal until the key is fixed) or the
+ * kill-switch 403 (disabled/epoch-revoked — fatal until the app is
+ * re-enabled). Minting STOPS: no retry loop. Clears on process restart;
+ * call `resumeMinting()` to clear it sooner (tests, or an operator who
+ * just re-enabled the app).
+ */
+export class AppMintHaltedError extends Error {
+    code = "app_mint_halted";
+    reason;
+    constructor(reason, detail) {
+        super(`Minting halted (${reason}): ${detail}`);
+        this.name = "AppMintHaltedError";
+        this.reason = reason;
+    }
+}
+/** Thrown when no installation row exists locally for an id. */
+export class UnknownInstallationError extends Error {
+    code = "unknown_installation";
+    constructor(installationId) {
+        super(`Unknown installation ${installationId}: no local row (resync or reinstall first).`);
+        this.name = "UnknownInstallationError";
+    }
+}
+/**
+ * Load the app credential: explicit options win, otherwise `APP_SLUG`,
+ * `APP_KEY_ID`, `APP_PRIVATE_KEY` from env. The PEM must parse as an RSA
+ * private key here, once, so a broken key fails at boot — never mid-mint.
+ * Throws `InvalidAppCredentialError` before any fetch.
+ */
+export function loadAppCredential(options = {}) {
+    const env = options.env ?? process.env;
+    const appSlug = (options.appSlug ?? env.APP_SLUG ?? "").trim();
+    if (appSlug === "") {
+        throw new InvalidAppCredentialError("Missing app slug for `iss`: pass appSlug or set APP_SLUG to the slug registered with Queek.");
+    }
+    const keyId = (options.keyId ?? env.APP_KEY_ID ?? "").trim();
+    if (keyId === "") {
+        throw new InvalidAppCredentialError("Missing APP_KEY_ID: set it to the kid registered with Queek (`php artisan app:register --public-key=…`).");
+    }
+    const privateKeyPem = (options.privateKeyPem ?? env.APP_PRIVATE_KEY ?? "").trim();
+    if (privateKeyPem === "") {
+        throw new InvalidAppCredentialError("Missing APP_PRIVATE_KEY: set it to the app's PEM-encoded RSA private key.");
+    }
+    try {
+        const key = createPrivateKey(privateKeyPem);
+        if (key.asymmetricKeyType !== "rsa") {
+            throw new InvalidAppCredentialError(`Invalid APP_PRIVATE_KEY: asymmetric key type is ${key.asymmetricKeyType ?? "unknown"}, need rsa.`);
+        }
+    }
+    catch (error) {
+        if (error instanceof InvalidAppCredentialError)
+            throw error;
+        throw new InvalidAppCredentialError(`Invalid APP_PRIVATE_KEY: not a parseable PEM private key (${error instanceof Error ? error.message : "undecodable"}).`);
+    }
+    // The PEM stays in this object only; callers must never log it (see
+    // `signAppJwt`: the only consumer, and it never emits the key).
+    return { appSlug, keyId, privateKeyPem };
+}
+function base64Url(input) {
+    return Buffer.from(input).toString("base64url");
+}
+/**
+ * Sign an app JWT (RS256, `node:crypto` only): header `{alg RS256, kid}`,
+ * claims `{iss = app slug, iat = now − 60 s, exp = iat + 540 s}` — the
+ * `exp − iat` window (540 s) stays under the 600 s wire bound. Returns the
+ * compact JWT; NEVER logs it or the private key.
+ */
+export function signAppJwt(options) {
+    const now = Math.floor(options.nowSeconds ?? Date.now() / 1000);
+    const iat = now - APP_JWT_SKEW_SECONDS;
+    const exp = iat + APP_JWT_TTL_SECONDS;
+    const header = base64Url(JSON.stringify({ alg: "RS256", typ: "JWT", kid: options.credential.keyId }));
+    const payload = base64Url(JSON.stringify({ iss: options.credential.appSlug, iat, exp }));
+    const signingInput = `${header}.${payload}`;
+    let signature;
+    try {
+        const signer = createSign("RSA-SHA256");
+        signer.update(signingInput, "utf8");
+        signature = signer.sign(options.credential.privateKeyPem);
+    }
+    catch (error) {
+        throw new InvalidAppCredentialError(`Could not sign the app JWT (is APP_PRIVATE_KEY the matching RSA key for kid ${JSON.stringify(options.credential.keyId)}?): ${error instanceof Error ? error.message : "signing failed"}`);
+    }
+    return `${signingInput}.${signature.toString("base64url")}`;
+}
+//# sourceMappingURL=app-auth.js.map

package/dist/app-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-auth.js","sourceRoot":"","sources":["../src/app-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE3D;;;;;;;;;;;GAWG;AAEH,8EAA8E;AAC9E,0EAA0E;AAC1E,2EAA2E;AAC3E,4BAA4B;AAC5B,8EAA8E;AAE9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAClE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AACxE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,qDAAqD;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,OAAO,IAAI,KAAK,sBAAsB,CAAC;AACzC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,OAAO,IAAI,KAAK,mBAAmB,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO,IAAI,KAAK,0BAA0B,CAAC;AAC7C,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,OAAO,IAAI,KAAK,6BAA6B,CAAC;AAChD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,IAAI,KAAK,oBAAoB,CAAC;AACvC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAwB;IACrE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CACL,MAAM,KAAK,GAAG;QACd,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,oBAAoB,IAAI,IAAI,KAAK,uBAAuB,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AACvC,oGAAoG;AACpG,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AACzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,0FAA0F;AAC1F,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IAEzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,iBAAiB,CAAC;IACzB,MAAM,CAA6D;IAE5E,YAAY,MAAoC,EAAE,MAAc;QAC9D,KAAK,CAAC,mBAAmB,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,sBAAsB,CAAC;IAEvC,YAAY,cAAsB;QAChC,KAAK,CAAC,wBAAwB,cAAc,6CAA6C,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAgC,EAAE;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAyB,CACjC,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,yBAAyB,CACjC,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CACjC,mDAAmD,GAAG,CAAC,iBAAiB,IAAI,SAAS,aAAa,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,yBAAyB;YAAE,MAAM,KAAK,CAAC;QAC5D,MAAM,IAAI,yBAAyB,CACjC,6DAA6D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,IAAI,CACxH,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,gEAAgE;IAChE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5D,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,GAAG,oBAAoB,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,GAAG,mBAAmB,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5C,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACpC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,yBAAyB,CACjC,+EAA+E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAC1L,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/background.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Lean in-process background work for one container: answer 200 first, then
+ * keep processing the event in this process (no queue, no Redis, no new
+ * infrastructure). A detached task that rejects reports through `onError`
+ * (usually the structured logger) instead of crashing the process or
+ * vanishing silently.
+ *
+ * Limits, stated plainly: in-flight work dies with the container (a deploy
+ * mid-processing loses it — the SENDER's retry redelivers, which is why
+ * every consumer must still dedupe), and two replicas would process the
+ * same redelivery twice (dedupe is per-container). Reach for a real queue
+ * when replicas or an outbound queue need shared state.
+ */
+export interface DetachOptions {
+    label: string;
+    onError: (error: unknown) => void;
+}
+export declare function detach(promise: Promise<unknown>, options: DetachOptions): void;
+/** How many background tasks are currently running (health/debug only). */
+export declare function backgroundTaskCount(): number;
+/**
+ * Jittered per-installation catch-up for one container (S1, SDK 0.2.0):
+ * iterate every stored installation and run `forInstallation` (a token
+ * proof-call, a resync batch, an inbox poll — whatever the app needs
+ * hourly), with:
+ *
+ * - one uniform `0–maxStartJitterMs` start sleep (default 600 s, matching
+ *   the mint bucket's /600 divisor so N containers spread over ~10 min),
+ * - per-installation error isolation (one failure never stops the run;
+ *   failures are collected in the returned summary),
+ * - at most `concurrency` installations in flight (default 2 — keep it ≤
+ *   the store pool size; the Postgres store runs max 2),
+ * - a 429 from `forInstallation` (a `QueekApiError` with `retryAfterMs`)
+ *   honored once per installation (sleep, retry once), then recorded as a
+ *   failure like any other error.
+ *
+ * Resolves to `{ ok, failed }` — it never throws for an installation's
+ * failure (only `listInstallations()` itself failing throws, since there
+ * is nothing to iterate).
+ */
+export interface CatchupInstallation {
+    installationId: string;
+    installationPid: string;
+}
+export interface CatchupFailure {
+    installationId: string;
+    error: unknown;
+}
+export interface CatchupResult {
+    ok: string[];
+    failed: CatchupFailure[];
+}
+export interface CatchupOptions {
+    /** Installations to visit. Defaults to the store's `listInstallations()`. */
+    installations?: CatchupInstallation[] | Promise<CatchupInstallation[]>;
+    store?: import("./store.js").InstallationStore;
+    forInstallation: (installation: CatchupInstallation) => Promise<void>;
+    /** Uniform start-jitter ceiling in ms (default 600_000). Set 0 in tests. */
+    maxStartJitterMs?: number;
+    /** Max in-flight installations (default 2; keep ≤ pool size). */
+    concurrency?: number;
+    onError?: (failure: CatchupFailure) => void;
+    sleep?: (ms: number) => Promise<void>;
+    /** Injectable uniform [0,1) for jitter. Defaults to `Math.random`. */
+    random?: () => number;
+}
+export declare function runInstallationCatchup(options: CatchupOptions): Promise<CatchupResult>;
+//# sourceMappingURL=background.d.ts.map

package/dist/background.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"background.d.ts","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACnC;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,aAAa,GAAG,IAAI,CAS9E;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,aAAa,CAAC,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACvE,KAAK,CAAC,EAAE,OAAO,YAAY,EAAE,iBAAiB,CAAC;IAC/C,eAAe,EAAE,CAAC,YAAY,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAMD,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA+C5F"}

package/dist/background.js

@@ -0,0 +1,78 @@
+/**
+ * Lean in-process background work for one container: answer 200 first, then
+ * keep processing the event in this process (no queue, no Redis, no new
+ * infrastructure). A detached task that rejects reports through `onError`
+ * (usually the structured logger) instead of crashing the process or
+ * vanishing silently.
+ *
+ * Limits, stated plainly: in-flight work dies with the container (a deploy
+ * mid-processing loses it — the SENDER's retry redelivers, which is why
+ * every consumer must still dedupe), and two replicas would process the
+ * same redelivery twice (dedupe is per-container). Reach for a real queue
+ * when replicas or an outbound queue need shared state.
+ */
+const inFlight = new Set();
+export function detach(promise, options) {
+    inFlight.add(promise);
+    promise
+        .catch((error) => {
+        options.onError(error);
+    })
+        .finally(() => {
+        inFlight.delete(promise);
+    });
+}
+/** How many background tasks are currently running (health/debug only). */
+export function backgroundTaskCount() {
+    return inFlight.size;
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function runInstallationCatchup(options) {
+    const sleep = options.sleep ?? defaultSleep;
+    const random = options.random ?? Math.random;
+    const maxStartJitterMs = options.maxStartJitterMs ?? 600_000;
+    const concurrency = Math.max(1, Math.floor(options.concurrency ?? 2));
+    if (maxStartJitterMs > 0) {
+        await sleep(Math.floor(random() * maxStartJitterMs));
+    }
+    const installations = options.installations ?? (await options.store?.listInstallations()) ?? [];
+    const resolved = await installations;
+    const result = { ok: [], failed: [] };
+    let next = 0;
+    async function worker() {
+        while (next < resolved.length) {
+            const installation = resolved[next];
+            next += 1;
+            try {
+                try {
+                    await options.forInstallation(installation);
+                }
+                catch (error) {
+                    // Honor ONE 429 per installation (the server's Retry-After when
+                    // present, else a 1 s breather), then treat a repeat like any
+                    // other failure.
+                    const fields = error !== null && typeof error === "object" ? error : null;
+                    if (fields?.isRateLimited === true) {
+                        const retryAfterMs = fields.retryAfterMs;
+                        await sleep(typeof retryAfterMs === "number" ? retryAfterMs : 1_000);
+                        await options.forInstallation(installation);
+                    }
+                    else {
+                        throw error;
+                    }
+                }
+                result.ok.push(installation.installationId);
+            }
+            catch (error) {
+                const failure = { installationId: installation.installationId, error };
+                result.failed.push(failure);
+                options.onError?.(failure);
+            }
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(concurrency, resolved.length) }, () => worker()));
+    return result;
+}
+//# sourceMappingURL=background.js.map

package/dist/background.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;AAO7C,MAAM,UAAU,MAAM,CAAC,OAAyB,EAAE,OAAsB;IACtE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO;SACJ,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACP,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAqDD,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAuB;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtE,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;IACrC,MAAM,MAAM,GAAkB,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACrD,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,KAAK,UAAU,MAAM;QACnB,OAAO,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAwB,CAAC;YAC3D,IAAI,IAAI,CAAC,CAAC;YACV,IAAI,CAAC;gBACH,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,gEAAgE;oBAChE,8DAA8D;oBAC9D,iBAAiB;oBACjB,MAAM,MAAM,GACV,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC1F,IAAI,MAAM,EAAE,aAAa,KAAK,IAAI,EAAE,CAAC;wBACnC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;wBACzC,MAAM,KAAK,CAAC,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;wBACrE,MAAM,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;oBAC9C,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC;gBACvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5B,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,148 @@
+import type { paths } from "./merchant-schema.js";
+/**
+ * Typed fetch client over Queek's public Merchant API.
+ *
+ * - Base URL comes from the install handoff (`api_base`). The backend sends
+ *   the BARE store host (`AppInstallService::installPayload()` passes
+ *   `rtrim(config('app.url'))` verbatim, e.g. `https://api.usequeek.com`);
+ *   the client appends `/api/v1/merchant` when it is absent, so a bare host
+ *   and a full merchant base both work. Never hardcoded otherwise, so test
+ *   stores ride their own host.
+ * - `apiBase` is validated at construction — https only, no credentials,
+ *   host on the allowlist — and throws BEFORE any fetch, so a
+ *   signed-but-stale or attacker-influenced handoff can never point
+ *   `X-Client-Key` at an arbitrary host.
+ * - Auth is the installation credential only: `X-Client-Key: sk_…`
+ *   (server-side; the key is bound to ONE store, so no vendor id is sent).
+ * - Writes (POST/PUT/PATCH/DELETE) carry an `Idempotency-Key` (generated
+ *   when the caller does not supply one) because Queek's `idempotent`
+ *   middleware replays same-key+same-body writes instead of duplicating
+ *   them. GET/HEAD never send one.
+ * - Errors are thrown as `QueekApiError`, typed from Queek's error envelope
+ *   (`{error: {code, message, field?, errors?, doc_url?, request_id?}}` plus
+ *   the legacy top-level `error_code`/`message`/`errors` keys — the contract
+ *   is additive, so both are read). Switch on `code`, never on `message`.
+ * - 429s expose `retryAfterMs` parsed from `Retry-After` (seconds or
+ *   HTTP-date). Plain `request()` never retries; `requestWithRetry()`
+ *   retries 429s and network errors with the SAME idempotency key.
+ *
+ * Typed surface: `getStore()` is typed from the generated Merchant API
+ * schema (`openapi/merchant.json` → `merchant-schema.ts` via
+ * `pnpm gen:merchant`); `request()` is the generic escape hatch.
+ */
+export type MerchantPaths = paths;
+/** 200 JSON body of `GET <P>` for operations shaped `{responses: {200: {content: {"application/json": T}}}}`. */
+export type OperationResponse<P extends keyof paths, M extends keyof paths[P]> = paths[P][M] extends {
+    responses: {
+        200: {
+            content: {
+                "application/json": infer T;
+            };
+        };
+    };
+} ? T : unknown;
+export type StoreProfile = OperationResponse<"/store", "get">;
+/** Path of the public Merchant API below the store host. */
+export declare const MERCHANT_API_PATH = "/api/v1/merchant";
+/** Hosts a handoff `api_base` may point at without extra configuration. */
+export declare const DEFAULT_API_HOSTS: string[];
+/** Thrown at client construction when `apiBase` fails validation — before any fetch. */
+export declare class InvalidApiBaseError extends Error {
+    readonly code = "invalid_api_base";
+    constructor(message: string);
+}
+/**
+ * Extra allowed `apiBase` hosts for test/local backends, from
+ * `QUEEK_API_HOSTS` (comma-separated bare hostnames). Parsed strictly: any
+ * entry that is not a bare hostname throws — nothing is silently skipped.
+ */
+export declare function apiHostsFromEnv(env?: NodeJS.ProcessEnv): string[];
+/**
+ * DEV-ONLY extra allowed hosts (e.g. an HTTPS tunnel to a local backend),
+ * from `QUEEK_DEV_API_HOSTS`. REFUSED when NODE_ENV=production: a dev
+ * tunnel host must never be allowlisted in production, even by accident.
+ * Throws at client construction, before any fetch.
+ */
+export declare function devApiHostsFromEnv(env?: NodeJS.ProcessEnv): string[];
+/**
+ * Validate the handoff `apiBase` and normalize it to the full merchant base.
+ * Throws `InvalidApiBaseError` on: unparseable URL, non-https scheme,
+ * embedded credentials, an explicit port on a DEFAULT host (production
+ * hosts are 443 — ports ride only on dev/test hosts), or a host outside
+ * `DEFAULT_API_HOSTS + allowedApiHosts + QUEEK_API_HOSTS +
+ * QUEEK_DEV_API_HOSTS`.
+ */
+export declare function resolveApiBase(raw: string, allowedApiHosts?: string[]): string;
+export interface QueekClientOptions {
+    /** Handoff `api_base` (bare store host or full merchant base). Validated at construction. */
+    apiBase: string;
+    apiKey: string;
+    fetchImpl?: typeof fetch;
+    /** Sent as User-Agent. Defaults to `queek-app/1.0`. */
+    userAgent?: string;
+    /** Extra allowed `apiBase` hosts (test/local backends). Production default always applies. */
+    allowedApiHosts?: string[];
+}
+export interface RequestOptions {
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+    /** Write idempotency (POST/PUT/PATCH/DELETE). Generated when omitted. */
+    idempotencyKey?: string;
+    requestId?: string;
+    signal?: AbortSignal;
+}
+export declare function newIdempotencyKey(): string;
+export interface QueekErrorDetails {
+    status: number;
+    code: string;
+    message: string;
+    field?: string;
+    errors?: unknown;
+    docUrl?: string;
+    requestId?: string;
+    retryAfterMs?: number;
+}
+export declare class QueekApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly field?: string;
+    readonly errors?: unknown;
+    readonly docUrl?: string;
+    readonly requestId?: string;
+    /** Set on 429s (and only there): how long to wait before retrying. */
+    readonly retryAfterMs?: number;
+    constructor(details: QueekErrorDetails);
+    get isRateLimited(): boolean;
+    get isAuthFailure(): boolean;
+}
+/**
+ * Build a `QueekApiError` from a status + parsed body + headers. Shared
+ * with the installation-token mint path (`tokens.ts`), so the merchant and
+ * app-credential endpoints parse errors identically.
+ */
+export declare function queekApiErrorFromResponse(status: number, body: unknown, headers: Headers): QueekApiError;
+export interface RetryOptions {
+    /** Total attempts including the first (default 3). Must be >= 1. */
+    maxAttempts?: number;
+    /** Base backoff between attempts in ms (default 250); doubles per attempt. */
+    baseDelayMs?: number;
+    /** Backoff ceiling in ms (default 5000). A 429 `Retry-After` can exceed it. */
+    maxDelayMs?: number;
+    /** Injectable clock for tests. Defaults to a real setTimeout sleep. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface QueekClient {
+    /** `GET /store` — the handed-off key proving itself. Typed from the Merchant API schema. */
+    getStore(signal?: AbortSignal): Promise<StoreProfile>;
+    /** Generic typed escape hatch: `request<T>("GET", "/orders", { query })`. Never retries. */
+    request<T>(method: string, path: string, options?: RequestOptions): Promise<T>;
+    /**
+     * `request()` with bounded retries on 429s and network errors. The SAME
+     * idempotency key is reused across attempts (generated once when the
+     * caller does not supply one), so a retry can never duplicate a write;
+     * a 429 `Retry-After` is honoured over the backoff schedule.
+     */
+    requestWithRetry<T>(method: string, path: string, options?: RequestOptions & RetryOptions): Promise<T>;
+}
+export declare function createQueekClient(clientOptions: QueekClientOptions): QueekClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC;AAElC,iHAAiH;AACjH,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,MAAM,KAAK,EAAE,CAAC,SAAS,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;IACnG,SAAS,EAAE;QAAE,GAAG,EAAE;YAAE,OAAO,EAAE;gBAAE,kBAAkB,EAAE,MAAM,CAAC,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,CAAC;CAClE,GACG,CAAC,GACD,OAAO,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAE9D,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,qBAAqB,CAAC;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,UAAuB,CAAC;AAEtD,wFAAwF;AACxF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,sBAAsB;gBAEvB,OAAO,EAAE,MAAM;CAI5B;AAmBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAI9E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CASjF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,GAAE,MAAM,EAAO,GAAG,MAAM,CAiClF;AAED,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAID,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAgBD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEnB,OAAO,EAAE,iBAAiB;IAYtC,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED,IAAI,aAAa,IAAI,OAAO,CAE3B;CACF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,CAiCxG;AAED,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,4FAA4F;IAC5F,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACxG;AAoBD,wBAAgB,iBAAiB,CAAC,aAAa,EAAE,kBAAkB,GAAG,WAAW,CA+EhF"}