@wascartech/devbot 0.0.0-stage → 2.1.0

package/dist/outbound-webhook-store.js

@@ -0,0 +1,229 @@
+import { db } from "./db.js";
+import { log } from "./logger.js";
+import { encrypt, decryptOrPlaintext } from "./crypto-util.js";
+import { randomBytes } from "node:crypto";
+import { WebhookEndpointSchema, } from "./types/outbound-webhook.js";
+// Outbound webhook endpoints + their delivery queue. Same DB file as the other
+// stores (devbot.db, 0600). Endpoints are keyed by (project_id, name); global
+// endpoints reuse the sentinel scope id 0 (GLOBAL_SCOPE_ID), exactly like
+// global MCP servers. The signing secret is encrypted at rest with SESSION_KEY.
+//
+// Deliveries are durable rows: emit() inserts one per matching endpoint, a
+// worker claims due rows (atomic pending→delivering CAS), and settles them.
+// A failed delivery is re-queued with a backoff until retries are exhausted.
+const SEC = () => Math.floor(Date.now() / 1000);
+export function initOutboundWebhookTables() {
+    // Belt-and-braces: migration 0020 is authoritative; keep the idempotent
+    // CREATE so a test DB opened without migrate() still works.
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS outbound_webhooks (
+      project_id  INTEGER NOT NULL,
+      name        TEXT    NOT NULL,
+      url         TEXT    NOT NULL,
+      events      TEXT    NOT NULL,
+      headers     TEXT    NOT NULL DEFAULT '{}',
+      enabled     INTEGER NOT NULL DEFAULT 1,
+      secret      TEXT    NOT NULL,
+      created_at  INTEGER NOT NULL,
+      updated_at  INTEGER NOT NULL,
+      PRIMARY KEY (project_id, name)
+    )
+  `);
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS outbound_webhook_deliveries (
+      id              INTEGER PRIMARY KEY AUTOINCREMENT,
+      project_id      INTEGER NOT NULL,
+      webhook_name    TEXT    NOT NULL,
+      event           TEXT    NOT NULL,
+      payload         TEXT    NOT NULL,
+      status          TEXT    NOT NULL DEFAULT 'pending',
+      attempts        INTEGER NOT NULL DEFAULT 0,
+      next_attempt_at INTEGER NOT NULL,
+      response_status INTEGER,
+      response_body   TEXT    NOT NULL DEFAULT '',
+      last_error      TEXT    NOT NULL DEFAULT '',
+      created_at      INTEGER NOT NULL,
+      updated_at      INTEGER NOT NULL
+    )
+  `);
+    db.exec("CREATE INDEX IF NOT EXISTS idx_outbound_deliveries_due ON outbound_webhook_deliveries(status, next_attempt_at)");
+    db.exec("CREATE INDEX IF NOT EXISTS idx_outbound_deliveries_webhook ON outbound_webhook_deliveries(project_id, webhook_name)");
+}
+export function newWebhookSecret() {
+    return `whsec_${randomBytes(32).toString("base64url")}`;
+}
+function parseEvents(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+function parseHeaders(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+function toStored(r) {
+    return {
+        projectId: r.project_id,
+        name: r.name,
+        url: r.url,
+        events: parseEvents(r.events),
+        headers: parseHeaders(r.headers),
+        enabled: r.enabled === 1,
+        secret: decryptOrPlaintext(r.secret),
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+    };
+}
+export function upsertWebhook(projectId, name, endpoint, secret) {
+    // Re-validate at the store boundary — the API layer validates too, but this
+    // is the trust boundary for the delivery worker.
+    const v = WebhookEndpointSchema.safeParse(endpoint);
+    if (!v.success)
+        throw new Error("invalid webhook endpoint");
+    const now = SEC();
+    db.prepare(`INSERT OR REPLACE INTO outbound_webhooks
+       (project_id, name, url, events, headers, enabled, secret, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?,
+       COALESCE((SELECT created_at FROM outbound_webhooks WHERE project_id = ? AND name = ?), ?),
+       ?)`).run(projectId, name, v.data.url, JSON.stringify(v.data.events), JSON.stringify(v.data.headers), v.data.enabled ? 1 : 0, encrypt(secret), projectId, name, now, now);
+}
+export function getWebhook(projectId, name) {
+    const row = db
+        .prepare("SELECT * FROM outbound_webhooks WHERE project_id = ? AND name = ?")
+        .get(projectId, name);
+    return row ? toStored(row) : null;
+}
+export function listWebhooks(projectId) {
+    const rows = db
+        .prepare("SELECT * FROM outbound_webhooks WHERE project_id = ? ORDER BY name")
+        .all(projectId);
+    return rows.map(toStored);
+}
+export function deleteWebhook(projectId, name) {
+    const r = db
+        .prepare("DELETE FROM outbound_webhooks WHERE project_id = ? AND name = ?")
+        .run(projectId, name);
+    return r.changes > 0;
+}
+export function deleteAllOutboundWebhooksForProject(projectId) {
+    db.prepare("DELETE FROM outbound_webhooks WHERE project_id = ?").run(projectId);
+    db.prepare("DELETE FROM outbound_webhook_deliveries WHERE project_id = ?").run(projectId);
+}
+// Enabled endpoints in this project's scope (project + global) subscribed to
+// `event`. Global endpoints use scope id 0, which is never a real project id.
+export function matchingWebhooks(projectId, event) {
+    const rows = db
+        .prepare("SELECT * FROM outbound_webhooks WHERE enabled = 1 AND project_id IN (?, 0) ORDER BY project_id, name")
+        .all(projectId);
+    return rows.map(toStored).filter((w) => w.events.includes(event));
+}
+// ---- Delivery queue --------------------------------------------------------
+export function enqueueDelivery(projectId, webhookName, event, payload) {
+    const now = SEC();
+    const r = db
+        .prepare(`INSERT INTO outbound_webhook_deliveries
+         (project_id, webhook_name, event, payload, status, attempts, next_attempt_at, created_at, updated_at)
+       VALUES (?, ?, ?, ?, 'pending', 0, ?, ?, ?)`)
+        .run(projectId, webhookName, event, payload, Date.now(), now, now);
+    return Number(r.lastInsertRowid);
+}
+function toDeliverySummary(r) {
+    return {
+        id: r.id,
+        projectId: r.project_id,
+        webhookName: r.webhook_name,
+        event: r.event,
+        status: r.status,
+        attempts: r.attempts,
+        nextAttemptAt: r.next_attempt_at,
+        responseStatus: r.response_status,
+        lastError: r.last_error,
+        createdAt: r.created_at,
+        updatedAt: r.updated_at,
+    };
+}
+function toDeliveryRow(r) {
+    return { ...toDeliverySummary(r), payload: r.payload, responseBody: r.response_body };
+}
+// Claim due pending rows (atomic pending→delivering CAS). Returns the claimed
+// rows so the worker can deliver them. `nowMs` is explicit for testability.
+export function claimDueDeliveries(limit, nowMs) {
+    const rows = db
+        .prepare(`SELECT * FROM outbound_webhook_deliveries
+        WHERE status = 'pending' AND next_attempt_at <= ?
+        ORDER BY id ASC LIMIT ?`)
+        .all(nowMs, limit);
+    const claimed = [];
+    const upd = db.prepare("UPDATE outbound_webhook_deliveries SET status = 'delivering', updated_at = ? WHERE id = ? AND status = 'pending'");
+    for (const r of rows) {
+        if (upd.run(SEC(), r.id).changes === 0)
+            continue; // CAS lost
+        claimed.push(toDeliveryRow({ ...r, status: "delivering" }));
+    }
+    return claimed;
+}
+export function settleDeliverySucceeded(id, responseStatus, responseBody) {
+    db.prepare(`UPDATE outbound_webhook_deliveries
+        SET status = 'succeeded', attempts = attempts + 1, response_status = ?, response_body = ?,
+            last_error = '', updated_at = ?
+      WHERE id = ?`).run(responseStatus, responseBody.slice(0, 2000), SEC(), id);
+}
+// Settle a failed attempt. `retryAt` non-null re-queues as pending for that
+// time; null marks the delivery terminally failed (retries exhausted).
+export function settleDeliveryFailed(id, input) {
+    db.prepare(`UPDATE outbound_webhook_deliveries
+        SET status = ?, attempts = attempts + 1, response_status = ?, response_body = ?,
+            last_error = ?, next_attempt_at = ?, updated_at = ?
+      WHERE id = ?`).run(input.retryAt === null ? "failed" : "pending", input.responseStatus, input.responseBody.slice(0, 2000), input.error.slice(0, 2000), input.retryAt ?? Date.now(), SEC(), id);
+}
+// Crash recovery: a delivery claimed but never settled goes back to pending.
+export function resetStuckDeliveries() {
+    const r = db
+        .prepare("UPDATE outbound_webhook_deliveries SET status = 'pending', updated_at = ? WHERE status = 'delivering'")
+        .run(SEC());
+    return Number(r.changes);
+}
+export function listDeliveries(projectId, webhookName, limit, offset) {
+    const rows = db
+        .prepare(`SELECT * FROM outbound_webhook_deliveries
+        WHERE project_id = ? AND webhook_name = ?
+        ORDER BY id DESC LIMIT ? OFFSET ?`)
+        .all(projectId, webhookName, limit, offset);
+    return rows.map(toDeliverySummary);
+}
+export function countDeliveries(projectId, webhookName) {
+    const row = db
+        .prepare("SELECT COUNT(*) AS c FROM outbound_webhook_deliveries WHERE project_id = ? AND webhook_name = ?")
+        .get(projectId, webhookName);
+    return row.c;
+}
+export function getDelivery(id) {
+    const row = db.prepare("SELECT * FROM outbound_webhook_deliveries WHERE id = ?").get(id);
+    return row ? toDeliveryRow(row) : null;
+}
+// Re-queue a terminal delivery for another attempt (manual replay from the UI).
+export function replayDelivery(id) {
+    const r = db
+        .prepare("UPDATE outbound_webhook_deliveries SET status = 'pending', next_attempt_at = ?, updated_at = ? WHERE id = ?")
+        .run(Date.now(), SEC(), id);
+    return r.changes > 0;
+}
+export function purgeDeliveriesOlderThan(days) {
+    const cutoff = SEC() - days * 24 * 3600;
+    const r = db.prepare("DELETE FROM outbound_webhook_deliveries WHERE created_at < ?").run(cutoff);
+    if (r.changes > 0)
+        log.debug("outbound delivery purge", { purged: r.changes, days });
+    return Number(r.changes);
+}
+//# sourceMappingURL=outbound-webhook-store.js.map

package/dist/outbound-webhook-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-webhook-store.js","sourceRoot":"","sources":["../src/outbound-webhook-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,qBAAqB,GAKtB,MAAM,6BAA6B,CAAC;AAErC,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAE7E,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEhD,MAAM,UAAU,yBAAyB;IACvC,wEAAwE;IACxE,4DAA4D;IAC5D,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;GAaP,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,gHAAgH,CAAC,CAAC;IAC1H,EAAE,CAAC,IAAI,CAAC,qHAAqH,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC1D,CAAC;AA0BD,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAiC;YACpC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAe;IAC/B,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7B,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;QAChC,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC;QACxB,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY,EAAE,QAAyB,EAAE,MAAc;IACtG,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,CAAC,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC;IAClB,EAAE,CAAC,OAAO,CACR;;;;UAIM,CACP,CAAC,GAAG,CACH,SAAS,EACT,IAAI,EACJ,CAAC,CAAC,IAAI,CAAC,GAAG,EACV,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAC9B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtB,OAAO,CAAC,MAAM,CAAC,EACf,SAAS,EACT,IAAI,EACJ,GAAG,EACH,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,mEAAmE,CAAC;SAC5E,GAAG,CAAC,SAAS,EAAE,IAAI,CAA6B,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,oEAAoE,CAAC;SAC7E,GAAG,CAAC,SAAS,CAA8B,CAAC;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY;IAC3D,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CAAC,iEAAiE,CAAC;SAC1E,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,SAAiB;IACnE,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChF,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,KAAoB;IACtE,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN,sGAAsG,CACvG;SACA,GAAG,CAAC,SAAS,CAA8B,CAAC;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,WAAmB,EAAE,KAAa,EAAE,OAAe;IACpG,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CACN;;kDAE4C,CAC7C;SACA,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAkBD,SAAS,iBAAiB,CAAC,CAAgB;IACzC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,KAAK,EAAE,CAAC,CAAC,KAAsB;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA0C;QACpD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa,EAAE,CAAC,CAAC,eAAe;QAChC,cAAc,EAAE,CAAC,CAAC,eAAe;QACjC,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,CAAgB;IACrC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;AACxF,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;gCAE0B,CAC3B;SACA,GAAG,CAAC,KAAK,EAAE,KAAK,CAA+B,CAAC;IACnD,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,kHAAkH,CACnH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC;YAAE,SAAS,CAAC,WAAW;QAC7D,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAU,EAAE,cAA6B,EAAE,YAAoB;IACrG,EAAE,CAAC,OAAO,CACR;;;mBAGe,CAChB,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAClC,EAAU,EACV,KAAqG;IAErG,EAAE,CAAC,OAAO,CACR;;;mBAGe,CAChB,CAAC,GAAG,CACH,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAC7C,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EACjC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAC1B,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAC3B,GAAG,EAAE,EACL,EAAE,CACH,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB;IAClC,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CAAC,uGAAuG,CAAC;SAChH,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACd,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,WAAmB,EAAE,KAAa,EAAE,MAAc;IAClG,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;0CAEoC,CACrC;SACA,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAA+B,CAAC;IAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,WAAmB;IACpE,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,iGAAiG,CAAC;SAC1G,GAAG,CAAC,SAAS,EAAE,WAAW,CAAkB,CAAC;IAChD,OAAO,GAAG,CAAC,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,CAAC,EAAE,CAE1E,CAAC;IACd,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CACN,6GAA6G,CAC9G;SACA,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjG,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;QAAE,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC"}

package/dist/outbound-webhook.js

@@ -0,0 +1,314 @@
+import { createHmac, randomUUID } from "node:crypto";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { config } from "./config.js";
+import { log } from "./logger.js";
+import { matchingWebhooks, enqueueDelivery, getWebhook, claimDueDeliveries, settleDeliverySucceeded, settleDeliveryFailed, resetStuckDeliveries, purgeDeliveriesOlderThan, } from "./outbound-webhook-store.js";
+import { getProject } from "./token-store.js";
+import { getPlatform } from "./platform/index.js";
+// Outbound webhook emitter + delivery worker. Forge-agnostic by construction:
+// the only platform call is the neutral links.workItemUrl. emit* is a purely
+// local DB write (one row per matching endpoint); the worker does all network
+// I/O, so a webhook can never block or fail a run.
+const SIGNATURE_HEADER = "X-DevBot-Signature-256";
+export function signPayload(secret, body) {
+    return "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
+}
+// The delivery id carried in the payload; used for the X-DevBot-Delivery header
+// so a receiver can dedupe on the same value it sees in the body.
+function deliveryIdOf(payload) {
+    try {
+        const parsed = JSON.parse(payload);
+        return typeof parsed.delivery === "string" ? parsed.delivery : "";
+    }
+    catch {
+        return "";
+    }
+}
+// ---- SSRF guard ------------------------------------------------------------
+// Outbound URLs are admin-configured, but a URL like http://169.254.169.254/
+// can reach cloud metadata. Block loopback/link-local/private/CGNAT/ULA/
+// multicast/broadcast by default; WEBHOOK_ALLOW_PRIVATE_HOSTS=true opts in to
+// internal CI/messaging endpoints (see docs/outbound-webhooks.md).
+function ipv4Blocked(ip) {
+    const parts = ip.split(".").map((n) => Number(n));
+    const [a, b] = parts;
+    if (a === 0 || a === 10 || a === 127)
+        return true;
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // CGNAT 100.64/10
+    if (a === 169 && b === 254)
+        return true; // link-local
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // private
+    if (a === 192 && b === 168)
+        return true; // private
+    if (a === 192 && b === 0)
+        return true; // 192.0.0.0/24 + 192.0.2.0/24
+    if (a >= 224)
+        return true; // multicast + reserved + broadcast
+    return false;
+}
+function ipv6Blocked(ip) {
+    const v = ip.toLowerCase().split("%")[0];
+    if (v === "::1" || v === "::")
+        return true;
+    if (v.startsWith("fe80"))
+        return true; // link-local
+    const first = v.split(":")[0];
+    const n = parseInt(first || "0", 16);
+    if ((n & 0xfe00) === 0xfc00)
+        return true; // ULA fc00::/7
+    if ((n & 0xff00) === 0xff00)
+        return true; // multicast ff00::/8
+    // IPv4-mapped (::ffff:a.b.c.d) — classify on the embedded v4.
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(v);
+    if (mapped)
+        return ipv4Blocked(mapped[1]);
+    return false;
+}
+export function isBlockedAddress(addr) {
+    const v = isIP(addr);
+    if (v === 4)
+        return ipv4Blocked(addr);
+    if (v === 6)
+        return ipv6Blocked(addr);
+    return true; // not an IP literal → treat as blocked/unknown
+}
+// Resolve a URL's host and reject when any resolved address is blocked (unless
+// private hosts are explicitly allowed). Returns an error string, or null when
+// the target is safe to call.
+export async function checkTargetAllowed(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return "invalid url";
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return "url must be http(s)";
+    if (config.WEBHOOK_ALLOW_PRIVATE_HOSTS)
+        return null;
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    if (isIP(host))
+        return isBlockedAddress(host) ? "blocked address" : null;
+    let addrs;
+    try {
+        addrs = await lookup(host, { all: true, verbatim: true });
+    }
+    catch {
+        return "dns resolution failed";
+    }
+    if (addrs.length === 0)
+        return "dns resolution failed";
+    if (addrs.some((a) => isBlockedAddress(a.address)))
+        return "blocked address";
+    return null;
+}
+export function buildRunOutcomePayload(event) {
+    return JSON.stringify(event);
+}
+export function buildMrPayload(event) {
+    return JSON.stringify(event);
+}
+function workItemUrl(projectId, workItemNumber) {
+    const projectPath = getProject(projectId)?.projectPath ?? "";
+    try {
+        return getPlatform().links.workItemUrl(projectPath, workItemNumber);
+    }
+    catch {
+        return "";
+    }
+}
+function projectPath(projectId) {
+    return getProject(projectId)?.projectPath ?? "";
+}
+// Resolve the concrete endpoints (project + global) an event should be sent to.
+// Kept exported for tests and the "test delivery" route.
+export function resolveMatchingEndpoints(projectId, event) {
+    return matchingWebhooks(projectId, event);
+}
+// Persist one delivery row per matching endpoint. Best-effort: a store failure
+// is logged and never propagates into the run.
+export function emitEvent(projectId, event, payloadFor) {
+    let count = 0;
+    try {
+        for (const endpoint of resolveMatchingEndpoints(projectId, event)) {
+            const eventPayload = payloadFor();
+            eventPayload.delivery = randomUUID();
+            enqueueDelivery(projectId, endpoint.name, event, buildRunOutcomePayload(eventPayload));
+            count++;
+        }
+    }
+    catch (e) {
+        log.warn("outbound webhook emit failed", { projectId, event, err: e });
+    }
+    return count;
+}
+// A run emits `run.started` once per task lifecycle — only on the first
+// attempt. A transient failure requeues the row with attempts++, so retries
+// don't re-notify subscribers; a crash-replayed row keeps attempts 0 and does.
+export function shouldEmitRunStarted(attempts) {
+    return attempts === 0;
+}
+// Emit `run.started` for a task that is about to execute. `run.status` is
+// "running" with no failure detail (none exists yet).
+export function emitRunStarted(input) {
+    emitEvent(input.projectId, "run.started", () => baseEvent(input, "run.started", "running", {}));
+}
+export function emitRunOutcome(input, outcome) {
+    const event = outcome.kind === "ok" ? "run.succeeded" : outcome.kind === "cancelled" ? "run.cancelled" : "run.failed";
+    const failure = outcome.failure;
+    emitEvent(input.projectId, event, () => baseEvent(input, event, outcome.kind, {
+        reason: outcome.reason ?? failure?.message ?? "",
+        phase: failure?.phase ?? "",
+        kind: failure?.kind ?? "",
+    }));
+}
+export function emitMrEvent(input, changeRequest, created) {
+    const event = created ? "mr.created" : "mr.updated";
+    emitEvent(input.projectId, event, () => ({
+        ...baseEvent(input, event, "ok", {}),
+        changeRequest: { number: changeRequest.number, url: changeRequest.webUrl, created },
+    }));
+}
+function baseEvent(input, event, status, opts) {
+    return {
+        event,
+        delivery: "",
+        timestamp: new Date().toISOString(),
+        project: { id: input.projectId, path: projectPath(input.projectId) },
+        workItem: {
+            id: input.workItemId,
+            number: input.workItemNumber,
+            url: workItemUrl(input.projectId, input.workItemNumber),
+        },
+        run: {
+            mode: input.mode,
+            model: input.model,
+            variant: input.variant,
+            status,
+            phase: opts.phase ?? "",
+            kind: opts.kind ?? "",
+            reason: opts.reason ?? "",
+        },
+    };
+}
+// ---- Delivery worker -------------------------------------------------------
+async function deliverOnce(endpoint, event, delivery, payload) {
+    const blocked = await checkTargetAllowed(endpoint.url);
+    if (blocked)
+        return { ok: false, responseStatus: null, responseBody: "", error: blocked };
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), config.WEBHOOK_DELIVERY_TIMEOUT_MS);
+    try {
+        const res = await fetch(endpoint.url, {
+            method: "POST",
+            redirect: "manual",
+            signal: controller.signal,
+            headers: {
+                "Content-Type": "application/json",
+                "User-Agent": "DevBot-Webhook/1.0",
+                "X-DevBot-Event": event,
+                "X-DevBot-Delivery": delivery,
+                [SIGNATURE_HEADER]: signPayload(endpoint.secret, payload),
+                ...endpoint.headers,
+            },
+            body: payload,
+        });
+        const body = await res.text().catch(() => "");
+        if (res.status >= 200 && res.status < 300) {
+            return { ok: true, responseStatus: res.status, responseBody: body, error: "" };
+        }
+        if (res.status >= 300 && res.status < 400) {
+            return { ok: false, responseStatus: res.status, responseBody: body, error: `redirect not followed (${res.status})` };
+        }
+        return { ok: false, responseStatus: res.status, responseBody: body, error: `http ${res.status}` };
+    }
+    catch (e) {
+        const msg = e instanceof Error && e.name === "AbortError" ? "timeout" : e instanceof Error ? e.message : String(e);
+        return { ok: false, responseStatus: null, responseBody: "", error: msg };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// Deliver every due row once. Exported so tests can drive it without timers.
+export async function processDueDeliveries(deps = {}) {
+    const now = deps.now ? deps.now() : Date.now();
+    const due = claimDueDeliveries(deps.limit ?? 20, now);
+    for (const delivery of due) {
+        const endpoint = getWebhook(delivery.projectId, delivery.webhookName);
+        if (!endpoint) {
+            // Endpoint removed after enqueue — nothing to deliver.
+            settleDeliveryFailed(delivery.id, {
+                responseStatus: null,
+                responseBody: "",
+                error: "endpoint removed",
+                retryAt: null,
+            });
+            continue;
+        }
+        const result = await deliverOnce(endpoint, delivery.event, deliveryIdOf(delivery.payload), delivery.payload);
+        if (result.ok) {
+            settleDeliverySucceeded(delivery.id, result.responseStatus, result.responseBody);
+            continue;
+        }
+        const willRetry = delivery.attempts + 1 < config.WEBHOOK_RETRY_MAX;
+        settleDeliveryFailed(delivery.id, {
+            responseStatus: result.responseStatus,
+            responseBody: result.responseBody,
+            error: result.error,
+            retryAt: willRetry ? Date.now() + config.WEBHOOK_RETRY_BACKOFF_MS * (delivery.attempts + 1) : null,
+        });
+        log.warn("outbound webhook delivery failed", {
+            projectId: delivery.projectId,
+            webhook: delivery.webhookName,
+            event: delivery.event,
+            status: result.responseStatus,
+            willRetry,
+            error: result.error,
+        });
+    }
+    return due.length;
+}
+let workerTimer = null;
+export function startWebhookWorker() {
+    if (workerTimer)
+        return;
+    const stuck = resetStuckDeliveries();
+    if (stuck > 0)
+        log.info("reset stuck outbound deliveries", { count: stuck });
+    workerTimer = setInterval(() => {
+        void processDueDeliveries().catch((e) => log.warn("outbound webhook worker failed", { err: e }));
+    }, config.WEBHOOK_POLL_INTERVAL_MS);
+    workerTimer.unref();
+    log.info("outbound webhook worker scheduled", {
+        intervalMs: config.WEBHOOK_POLL_INTERVAL_MS,
+        retryMax: config.WEBHOOK_RETRY_MAX,
+    });
+}
+export function stopWebhookWorker() {
+    if (workerTimer) {
+        clearInterval(workerTimer);
+        workerTimer = null;
+    }
+}
+// Test helper: deliver one endpoint synchronously (the UI "Test" button).
+export async function testDelivery(endpoint) {
+    const deliveryId = randomUUID();
+    const payload = buildRunOutcomePayload({
+        event: endpoint.events[0] ?? "run.succeeded",
+        delivery: deliveryId,
+        timestamp: new Date().toISOString(),
+        project: { id: endpoint.projectId, path: projectPath(endpoint.projectId) },
+        workItem: { id: 0, number: 0, url: "" },
+        run: { mode: "test", model: "", variant: "", status: "test", phase: "", kind: "", reason: "test delivery" },
+    });
+    const result = await deliverOnce(endpoint, endpoint.events[0] ?? "run.succeeded", deliveryId, payload);
+    return { ok: result.ok, status: result.responseStatus, error: result.error };
+}
+// Re-export for the delivery-log route.
+export { purgeDeliveriesOlderThan };
+//# sourceMappingURL=outbound-webhook.js.map

package/dist/outbound-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-webhook.js","sourceRoot":"","sources":["../src/outbound-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,GAEzB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,mDAAmD;AAEnD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY;IACtD,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,gFAAgF;AAChF,kEAAkE;AAClE,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA2B,CAAC;QAC7D,OAAO,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,mEAAmE;AAEnE,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAyC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;IACrE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,mCAAmC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1C,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IACzD,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC/D,8DAA8D;IAC9D,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM;QAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,CAAC,+CAA+C;AAC9D,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,8BAA8B;AAC9B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,qBAAqB,CAAC;IACxF,IAAI,MAAM,CAAC,2BAA2B;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAsBD,MAAM,UAAU,sBAAsB,CAAC,KAAsB;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAsB;IACnD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAaD,SAAS,WAAW,CAAC,SAAiB,EAAE,cAAsB;IAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC;QACH,OAAO,WAAW,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,UAAU,CAAC,SAAS,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,yDAAyD;AACzD,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,KAAoB;IAC9E,OAAO,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,KAAoB,EAAE,UAAiC;IAClG,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,wBAAwB,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;YAClC,YAAY,CAAC,QAAQ,GAAG,UAAU,EAAE,CAAC;YACrC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;YACvF,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,0EAA0E;AAC1E,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAAC,KAAmB;IAChD,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAmB,EACnB,OAAsG;IAEtG,MAAM,KAAK,GACT,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1G,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CACrC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,EAAE,OAAO,IAAI,EAAE;QAChD,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;QAC3B,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE;KAC1B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,KAAmB,EACnB,aAAiD,EACjD,OAAgB;IAEhB,MAAM,KAAK,GAAkB,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;IACnE,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE;KACpF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,SAAS,CAChB,KAAmB,EACnB,KAAoB,EACpB,MAAc,EACd,IAAwD;IAExD,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;QACpE,QAAQ,EAAE;YACR,EAAE,EAAE,KAAK,CAAC,UAAU;YACpB,MAAM,EAAE,KAAK,CAAC,cAAc;YAC5B,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC;SACxD;QACD,GAAG,EAAE;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,WAAW,CAAC,QAAuB,EAAE,KAAa,EAAE,QAAgB,EAAE,OAAe;IAMlG,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAE1F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,oBAAoB;gBAClC,gBAAgB,EAAE,KAAK;gBACvB,mBAAmB,EAAE,QAAQ;gBAC7B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;gBACzD,GAAG,QAAQ,CAAC,OAAO;aACpB;YACD,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QACvH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACpG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAC3E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAOD,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA0B,EAAE;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACtD,KAAK,MAAM,QAAQ,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,uDAAuD;YACvD,oBAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAChC,cAAc,EAAE,IAAI;gBACpB,YAAY,EAAE,EAAE;gBAChB,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7G,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,uBAAuB,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACnE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,wBAAwB,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;SACnG,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC3C,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,WAAW;YAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,MAAM,CAAC,cAAc;YAC7B,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,IAAI,WAAW,GAA0C,IAAI,CAAC;AAE9D,MAAM,UAAU,kBAAkB;IAChC,IAAI,WAAW;QAAE,OAAO;IACxB,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,KAAK,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACpC,WAAW,CAAC,KAAK,EAAE,CAAC;IACpB,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;QAC5C,UAAU,EAAE,MAAM,CAAC,wBAAwB;QAC3C,QAAQ,EAAE,MAAM,CAAC,iBAAiB;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,WAAW,EAAE,CAAC;QAChB,aAAa,CAAC,WAAW,CAAC,CAAC;QAC3B,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAuB;IACxD,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,sBAAsB,CAAC;QACrC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,eAAe;QAC5C,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAC1E,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;QACvC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE;KAC5G,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACvG,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED,wCAAwC;AACxC,OAAO,EAAE,wBAAwB,EAAE,CAAC"}