@xtandard/webhooks 0.1.0

package/dist/index.d.mts

@@ -0,0 +1,366 @@
+import { _ as WebhookEnvelope, a as AuditEntry, c as DeliveryStatus, d as EndpointSecret, f as EventType, g as WebhookDuration, h as SCHEMA_VERSION, i as AuditAction, l as Endpoint, m as Message, n as Application, o as Delivery, p as JsonValue, r as AttemptTrigger, s as DeliveryAttempt, t as Actor, u as EndpointDisabledReason, v as isTerminalDeliveryStatus } from "./schema-mo__wv4P.mjs";
+import { A as BuildSignedRequestInput, C as createDispatcher, D as emitDelivery, E as DeliveryListener, F as attemptDelivery, I as buildSignedRequest, M as DEFAULT_RESPONSE_BODY_LIMIT, N as SignedRequest, O as AttemptDeliveryInput, P as activeSecrets, S as DispatcherOptions, T as DeliveryEvent, _ as WebhooksCore, a as ListDeliveriesOptions, b as DEFAULT_RETRY_SCHEDULE, c as PayloadTooLargeError, d as ReadonlyError, f as RecordAttemptInput, g as SendExampleResult, h as RetentionRule, i as IdempotencyConflictError, j as DEFAULT_ATTEMPT_TIMEOUT_MS, k as AttemptOutcome, l as PublishInput, m as RetentionOptions, n as ClaimInput, o as ListMessagesOptions, p as RecoverResult, r as ConflictError, s as NotFoundError, t as ActorOptions, u as PublishResult, v as WebhooksCoreOptions, w as DeliveryErrorReporter, x as Dispatcher, y as createWebhooksCore } from "./core-DT4ppWh8.mjs";
+import { a as WatchableWebhooksStorage, c as isCompareAndSwap, d as requirePeer, i as TransactionalWebhooksStorage, l as isTransactional, n as DeliveryQueueStorage, o as WebhooksStorage, r as StorageChangeEvent, s as hasDeliveryQueue, t as CompareAndSwapWebhooksStorage, u as isWatchable } from "./contract-DhQ4JjGG.mjs";
+import { a as HookDeniedError, c as WebhooksHooksInput, d as runAfter, f as runBefore, i as BeforeEventType, l as defaultHookErrorReporter, n as AfterEventType, o as HookErrorReporter, r as BeforeEvent, s as WebhooksHooks, t as AfterEvent, u as normalizeHooks } from "./contract-T1kcZNdG.mjs";
+import { n as Principal, t as AuthProvider } from "./contract-lETlIuXo.mjs";
+import { a as WebhooksResource, i as WebhooksAction, n as AuthorizeInput, o as isMutatingAction, r as MUTATING_ACTIONS, t as AuthorizationProvider } from "./contract-C2r2Xzwp.mjs";
+import { a as WebhooksPortalOptions, i as DEFAULT_PORTAL_ACTIONS, n as WebhooksPanelOptions, o as WebhooksCorsOptions, r as createFetchHandler, t as CreateFetchHandlerResult } from "./create-fetch-handler-jy3hy5nZ.mjs";
+import { SECRET_PREFIX, VerifyInput, WebhookVerificationError, generateSecret, sign, signatureHeader, verify } from "./signing.mjs";
+
+//#region src/version.d.ts
+/**
+ * Package version, used for the default dispatcher `user-agent`. Bumped by the
+ * release flow alongside `package.json`.
+ *
+ * @module
+ */
+/** The published package version. */
+declare const VERSION = "0.1.0";
+declare namespace keys_d_exports {
+  export { DueEntry, RESERVED_APPLICATION_KEYS, ROOT, applicationMetaKey, applicationPrefix, applicationsKey, attemptKey, attemptsPrefix, auditLogKey, byEndpointKey, byEndpointPrefix, byMessageKey, byMessagePrefix, deliveriesPrefix, deliveryKey, dueKey, duePrefix, endpointKey, endpointsKey, eventTypeKey, eventTypesKey, globalAuditLogKey, idempotencyKey, lastSegment, messageKey, messagesPrefix, parseDueKey };
+}
+/**
+ * Storage key layout for `@xtandard/webhooks`.
+ *
+ * Keys are namespaced by application so a single storage backend can host the
+ * whole control plane. Pure string helpers — no dependencies.
+ *
+ * ```txt
+ * whk/applications                                 -> string[] index
+ * whk/{app}/metadata                               -> Application
+ * whk/event-types                                  -> string[] index (global)
+ * whk/event-types/{name}                           -> EventType
+ * whk/{app}/endpoints                              -> string[] index
+ * whk/{app}/endpoints/{id}                         -> Endpoint
+ * whk/{app}/messages/{id}                          -> Message
+ * whk/{app}/idempotency/{key}                      -> message id
+ * whk/{app}/deliveries/{id}                        -> Delivery
+ * whk/{app}/attempts/{deliveryId}/{n}              -> DeliveryAttempt (n zero-padded)
+ * whk/{app}/due/{dueAtMillis}~{deliveryId}         -> DueEntry (13-digit zero-padded millis)
+ * whk/{app}/by-message/{messageId}/{deliveryId}    -> 1 (reverse index)
+ * whk/{app}/by-endpoint/{endpointId}/{deliveryId}  -> 1 (reverse index)
+ * whk/{app}/audit-log                              -> AuditEntry[] (single ordered array)
+ * ```
+ *
+ * The due index is the dispatcher's generic work queue: 13-digit zero-padded
+ * milliseconds make lexicographic key order chronological, so a sorted
+ * `getKeys(duePrefix(app))` scan yields deliveries in due order.
+ *
+ * @module
+ */
+/** Root namespace segment for all keys. */
+declare const ROOT = "whk";
+/**
+ * Application keys that would collide with global index keys under the shared
+ * root. Rejected by validation.
+ */
+declare const RESERVED_APPLICATION_KEYS: readonly ["applications", "event-types", "audit-log"];
+/** Global audit log (event-type actions, which are not application-scoped). */
+declare const globalAuditLogKey: () => string;
+/** Index key listing all known application keys. */
+declare const applicationsKey: () => string;
+/** Metadata for a single application. */
+declare const applicationMetaKey: (applicationKey: string) => string;
+/** Index key listing all event type names (global catalog). */
+declare const eventTypesKey: () => string;
+/** A single event type record. */
+declare const eventTypeKey: (name: string) => string;
+/** Index key listing an application's endpoint ids. */
+declare const endpointsKey: (applicationKey: string) => string;
+/** A single endpoint record. */
+declare const endpointKey: (applicationKey: string, endpointId: string) => string;
+/** Prefix under which an application's messages live. */
+declare const messagesPrefix: (applicationKey: string) => string;
+/** A single message record. */
+declare const messageKey: (applicationKey: string, messageId: string) => string;
+/** Maps a caller-supplied idempotency key to the message id it produced. */
+declare const idempotencyKey: (applicationKey: string, key: string) => string;
+/** Prefix under which an application's deliveries live. */
+declare const deliveriesPrefix: (applicationKey: string) => string;
+/** A single delivery record. */
+declare const deliveryKey: (applicationKey: string, deliveryId: string) => string;
+/** Prefix under which one delivery's attempts live. */
+declare const attemptsPrefix: (applicationKey: string, deliveryId: string) => string;
+/**
+ * A single attempt record. The attempt number is zero-padded to four digits so
+ * lexicographic key order equals attempt order.
+ */
+declare const attemptKey: (applicationKey: string, deliveryId: string, attemptNumber: number) => string;
+/** Prefix of an application's due index (the dispatcher's work queue). */
+declare const duePrefix: (applicationKey: string) => string;
+/** Value stored at a due-index key. */
+interface DueEntry {
+  app: string;
+  deliveryId: string;
+}
+/**
+ * A due-index entry: 13-digit zero-padded epoch milliseconds, then the delivery
+ * id, `~`-separated. Sorting keys lexicographically sorts entries chronologically.
+ */
+declare const dueKey: (applicationKey: string, dueAtMillis: number, deliveryId: string) => string;
+/** Parse a due-index key back into its due-time and delivery id. */
+declare const parseDueKey: (key: string) => {
+  dueAtMillis: number;
+  deliveryId: string;
+} | null;
+/** Prefix of the message → deliveries reverse index. */
+declare const byMessagePrefix: (applicationKey: string, messageId: string) => string;
+/** One entry in the message → deliveries reverse index. */
+declare const byMessageKey: (applicationKey: string, messageId: string, deliveryId: string) => string;
+/** Prefix of the endpoint → deliveries reverse index. */
+declare const byEndpointPrefix: (applicationKey: string, endpointId: string) => string;
+/** One entry in the endpoint → deliveries reverse index. */
+declare const byEndpointKey: (applicationKey: string, endpointId: string, deliveryId: string) => string;
+/** Append-only audit log for an application, stored as an ordered `AuditEntry[]`. */
+declare const auditLogKey: (applicationKey: string) => string;
+/** Prefix under which everything belonging to one application lives. */
+declare const applicationPrefix: (applicationKey: string) => string;
+/** Extract the trailing segment (endpoint id / message id / …) from a key. */
+declare const lastSegment: (key: string) => string;
+//#endregion
+//#region src/id.d.ts
+/**
+ * Entity id generation: `{prefix}_{22-char base62}`. Zero dependencies — base62
+ * over `crypto.getRandomValues`, no ULID. 22 base62 characters encode ~131 bits;
+ * ids are generated from 16 random bytes (128 bits) and left-padded to a fixed
+ * length so ids are uniform and lexicographically well-behaved.
+ *
+ * @module
+ */
+/** Prefixes for the four generated entity id kinds. */
+type IdPrefix = "msg" | "ep" | "dlv" | "atp";
+/**
+ * Generate a new entity id, e.g. `newId("msg")` → `"msg_0uK9…"` (22-char base62
+ * suffix).
+ *
+ * @example
+ * ```ts
+ * import { newId } from "@xtandard/webhooks";
+ *
+ * const id = newId("ep"); // "ep_…"
+ * ```
+ */
+declare function newId(prefix: IdPrefix): string;
+/** Regex an id of the given prefix must match. */
+declare function idPattern(prefix: IdPrefix): RegExp;
+//#endregion
+//#region src/duration.d.ts
+/**
+ * Convert a {@link WebhookDuration} (`5000`, `"5s"`, `"30m"`, `"2h"`, `"5d"`)
+ * to milliseconds. Throws on malformed strings or negative numbers.
+ *
+ * @example
+ * ```ts
+ * import { durationToMs } from "@xtandard/webhooks";
+ *
+ * durationToMs("5m"); // 300000
+ * durationToMs(250); // 250
+ * ```
+ */
+declare function durationToMs(duration: WebhookDuration): number;
+/**
+ * Parse a comma-separated duration list (the `RETRY_SCHEDULE` env var format,
+ * e.g. `"0s,5s,5m,30m,2h,5h,10h"`) into a {@link WebhookDuration} array.
+ */
+declare function parseDurationList(input: string): WebhookDuration[];
+//#endregion
+//#region src/storage/watch.d.ts
+/**
+ * A change source. Called with a `notify` callback — wire your source to invoke
+ * it (optionally with the changed key) on every change — and return an
+ * unsubscribe function (sync or async).
+ */
+type WatchSubscribe = (notify: (key?: string) => void) => (() => void | Promise<void>) | Promise<() => void | Promise<void>>;
+/**
+ * Wrap a storage so it implements {@link WatchableWebhooksStorage} using
+ * `subscribe` as the change source. The wrapper delegates all reads/writes to
+ * `storage` and only adds `watch`; keys not under the watched `prefix` are
+ * filtered out. A notification without a key is delivered as a change to the
+ * prefix itself (enough to trigger a refresh).
+ */
+declare function withWatch<S extends WebhooksStorage>(storage: S, subscribe: WatchSubscribe): S & WatchableWebhooksStorage;
+/**
+ * A dedicated notification client for {@link pgListenNotify} — satisfied by a
+ * `pg` `Client`. `Pool` won't do (it rotates connections); use a `Client` you
+ * `connect()`.
+ */
+interface PgNotificationClient {
+  query(sql: string): Promise<unknown>;
+  on(event: "notification", listener: (msg: {
+    channel: string;
+    payload?: string;
+  }) => void): void;
+  removeListener(event: "notification", listener: (msg: {
+    channel: string;
+    payload?: string;
+  }) => void): void;
+}
+/**
+ * A {@link WatchSubscribe} backed by Postgres `LISTEN`/`NOTIFY`. Pair with
+ * {@link withWatch} for the postgres or drizzle-over-pg adapters. Your migration
+ * owns the trigger that `pg_notify`s `channel` with the changed key as payload;
+ * this only `LISTEN`s.
+ *
+ * @example
+ * ```ts
+ * import { Client } from "pg";
+ * const listener = new Client({ connectionString: process.env.DATABASE_URL });
+ * await listener.connect();
+ * const storage = withWatch(base, pgListenNotify(listener, "xtandard_webhooks"));
+ * ```
+ */
+declare function pgListenNotify(client: PgNotificationClient, channel?: string): WatchSubscribe;
+//#endregion
+//#region src/validation.d.ts
+/**
+ * Runtime validation for control-plane inputs, built on `valibot`.
+ *
+ * This is the **admin path** only — `publish()` performs its own minimal
+ * checks and the wire/receiver path never imports this module, so `valibot`
+ * stays off the hot paths. Validation combines structural parsing (valibot)
+ * with semantic checks (URL policy, reserved header names, reserved keys).
+ *
+ * @module
+ */
+/** Allowed characters for application keys and event type names. */
+declare const KEY_REGEX: RegExp;
+/**
+ * Header names owned by the Standard Webhooks wire contract. Endpoints may not
+ * override them via static headers.
+ */
+declare const RESERVED_HEADERS: readonly ["webhook-id", "webhook-timestamp", "webhook-signature"];
+/** A single validation problem with a dotted path into the offending data. */
+interface ValidationIssue {
+  path: string;
+  message: string;
+}
+/** Result of the `validate*` functions. */
+interface ValidationResult {
+  valid: boolean;
+  errors: ValidationIssue[];
+}
+/** Raised by {@link assertValid} when an input fails validation. Maps to HTTP 422. */
+declare class ValidationError extends Error {
+  readonly errors: ValidationIssue[];
+  constructor(errors: ValidationIssue[]);
+}
+/** Throw a {@link ValidationError} when `result` is invalid. */
+declare function assertValid(result: ValidationResult): void;
+/**
+ * Validate an {@link Application}: structure + reserved-key check.
+ *
+ * @example
+ * ```ts
+ * import { validateApplication } from "@xtandard/webhooks";
+ *
+ * const result = validateApplication({ key: "acme" });
+ * // result.valid === true
+ * ```
+ */
+declare function validateApplication(input: unknown, basePath?: string): ValidationResult;
+/** Validate an {@link EventType}: structural only (the name regex carries the semantics). */
+declare function validateEventType(input: unknown, basePath?: string): ValidationResult;
+/** Options that relax/extend the endpoint URL policy. */
+interface UrlPolicyOptions {
+  /** Allow `http:` for non-localhost hosts (dev only; default `false`). */
+  allowInsecureUrls?: boolean;
+  /** Extra host-supplied gate; return `false` to reject (e.g. an SSRF denylist). */
+  urlPolicy?: (url: string) => boolean;
+}
+/**
+ * Validate an endpoint destination URL: parseable, `https:` (or `http:` for
+ * localhost, or anywhere when `allowInsecureUrls`), no embedded credentials,
+ * and passing the host's optional `urlPolicy` gate.
+ */
+declare function validateEndpointUrl(url: string, options?: UrlPolicyOptions, basePath?: string): ValidationResult;
+/**
+ * Validate an {@link Endpoint} input: structure, URL policy, and static-header
+ * restrictions (the Standard Webhooks headers are reserved).
+ *
+ * @example
+ * ```ts
+ * import { validateEndpoint } from "@xtandard/webhooks";
+ *
+ * const result = validateEndpoint({ url: "https://api.example.com/hooks" });
+ * // result.valid === true
+ * ```
+ */
+declare function validateEndpoint(input: unknown, options?: UrlPolicyOptions, basePath?: string): ValidationResult;
+//#endregion
+//#region src/portal.d.ts
+/** Prefix of every portal token. */
+declare const PORTAL_TOKEN_PREFIX = "whpt_";
+/**
+ * Thrown by {@link verifyPortalToken} for any invalid token — malformed,
+ * bad signature, or expired. Maps to HTTP 401 at the API layer.
+ */
+declare class PortalTokenError extends Error {
+  constructor(message: string);
+}
+/** Options for {@link createPortalToken}. */
+interface PortalTokenOptions {
+  /** Token lifetime. Default `"7d"`. */
+  expiresIn?: WebhookDuration;
+}
+/**
+ * Mint a portal token granting access to `applicationKey` until `expiresIn`
+ * elapses (default 7 days). Call this **server-side** — anyone holding the
+ * portal secret can mint tokens for any application.
+ *
+ * @example
+ * ```ts
+ * import { createPortalToken } from "@xtandard/webhooks";
+ *
+ * // In the host app's session-guarded route:
+ * const token = await createPortalToken(process.env.PORTAL_SECRET!, "acme", {
+ *   expiresIn: "1h",
+ * });
+ * // Hand `token` to the frontend for <WebhooksPortal token={token} />.
+ * ```
+ */
+declare function createPortalToken(secret: string, applicationKey: string, options?: PortalTokenOptions): Promise<string>;
+/**
+ * Verify a portal token: format, signature (constant time), then expiry.
+ * Returns the granted application key on success; throws
+ * {@link PortalTokenError} otherwise.
+ *
+ * @example
+ * ```ts
+ * import { verifyPortalToken } from "@xtandard/webhooks";
+ *
+ * const { applicationKey } = await verifyPortalToken(secret, token);
+ * ```
+ */
+declare function verifyPortalToken(secret: string, token: string): Promise<{
+  applicationKey: string;
+}>;
+//#endregion
+//#region src/server/openapi.d.ts
+/**
+ * OpenAPI 3.1 description of the admin JSON API.
+ *
+ * Exposed two ways, mirroring the flags panel:
+ *  - served at `GET {basePath}/api/openapi.json` for standalone tools (Scalar,
+ *    Swagger UI, Postman, codegen);
+ *  - returned by `createFetchHandler(...).openapi()` so you can MERGE it into
+ *    your host app's OpenAPI document (e.g. Elysia `@elysiajs/openapi`
+ *    `references`, or Hono's OpenAPI).
+ *
+ * Hand-authored — no generation dependency (flags precedent).
+ *
+ * @module
+ */
+/** Options for {@link buildOpenApiDocument}. */
+interface OpenApiOptions {
+  /** Mount prefix used in the `servers` url (e.g. `"/webhooks"`). */
+  basePath?: string;
+  /** Document title. */
+  title?: string;
+  /** Document version (defaults to the package's API version). */
+  version?: string;
+}
+/** Build the OpenAPI 3.1 document for the admin API. Pure — safe to call anywhere. */
+declare function buildOpenApiDocument(options?: OpenApiOptions): Record<string, unknown>;
+//#endregion
+export { Actor, ActorOptions, type AfterEvent, type AfterEventType, Application, type AttemptDeliveryInput, type AttemptOutcome, AttemptTrigger, AuditAction, AuditEntry, type AuthProvider, type AuthorizationProvider, type AuthorizeInput, type BeforeEvent, type BeforeEventType, type BuildSignedRequestInput, ClaimInput, type CompareAndSwapWebhooksStorage, ConflictError, type CreateFetchHandlerResult, DEFAULT_ATTEMPT_TIMEOUT_MS, DEFAULT_PORTAL_ACTIONS, DEFAULT_RESPONSE_BODY_LIMIT, DEFAULT_RETRY_SCHEDULE, Delivery, DeliveryAttempt, type DeliveryErrorReporter, type DeliveryEvent, type DeliveryListener, type DeliveryQueueStorage, DeliveryStatus, type Dispatcher, type DispatcherOptions, Endpoint, EndpointDisabledReason, EndpointSecret, EventType, HookDeniedError, type HookErrorReporter, type IdPrefix, IdempotencyConflictError, JsonValue, KEY_REGEX, ListDeliveriesOptions, ListMessagesOptions, MUTATING_ACTIONS, Message, NotFoundError, type OpenApiOptions, PORTAL_TOKEN_PREFIX, PayloadTooLargeError, type PgNotificationClient, PortalTokenError, type PortalTokenOptions, type Principal, PublishInput, PublishResult, RESERVED_HEADERS, ReadonlyError, RecordAttemptInput, RecoverResult, RetentionOptions, RetentionRule, SCHEMA_VERSION, SECRET_PREFIX, SendExampleResult, type SignedRequest, type StorageChangeEvent, type TransactionalWebhooksStorage, type UrlPolicyOptions, VERSION, ValidationError, type ValidationIssue, type ValidationResult, type VerifyInput, type WatchSubscribe, type WatchableWebhooksStorage, WebhookDuration, WebhookEnvelope, WebhookVerificationError, type WebhooksAction, WebhooksCore, WebhooksCoreOptions, type WebhooksCorsOptions, type WebhooksHooks, type WebhooksHooksInput, type WebhooksPanelOptions, type WebhooksPortalOptions, type WebhooksResource, type WebhooksStorage, activeSecrets, assertValid, attemptDelivery, buildOpenApiDocument, buildSignedRequest, createDispatcher, createFetchHandler, createPortalToken, createWebhooksCore, defaultHookErrorReporter, durationToMs, emitDelivery, generateSecret, hasDeliveryQueue, idPattern, isCompareAndSwap, isMutatingAction, isTerminalDeliveryStatus, isTransactional, isWatchable, keys_d_exports as keys, newId, normalizeHooks, parseDurationList, pgListenNotify, requirePeer, runAfter, runBefore, sign, signatureHeader, validateApplication, validateEndpoint, validateEndpointUrl, validateEventType, verify, verifyPortalToken, withWatch };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -0,0 +1,61 @@
+import { SCHEMA_VERSION, isTerminalDeliveryStatus } from "./schema.mjs";
+import { SECRET_PREFIX, WebhookVerificationError, generateSecret, sign, signatureHeader, verify } from "./signing.mjs";
+import { A as attemptDelivery, C as newId, D as DEFAULT_ATTEMPT_TIMEOUT_MS, E as emitDelivery, O as DEFAULT_RESPONSE_BODY_LIMIT, T as parseDurationList, _ as normalizeHooks, a as ReadonlyError, b as VERSION, c as RESERVED_HEADERS, d as validateApplication, f as validateEndpoint, g as defaultHookErrorReporter, h as HookDeniedError, i as PayloadTooLargeError, j as buildSignedRequest, k as activeSecrets, l as ValidationError, m as validateEventType, n as IdempotencyConflictError, o as createWebhooksCore, p as validateEndpointUrl, r as NotFoundError, s as KEY_REGEX, t as ConflictError, u as assertValid, v as runAfter, w as durationToMs, x as idPattern, y as runBefore } from "./core-CMpnmI5Q.mjs";
+import { x as keys_exports } from "./keys-Byyj4quQ.mjs";
+import { a as requirePeer, i as isWatchable, n as isCompareAndSwap, r as isTransactional, t as hasDeliveryQueue } from "./contract-BEhDcd_5.mjs";
+import { n as createDispatcher, t as DEFAULT_RETRY_SCHEDULE } from "./dispatcher-Coubwrka.mjs";
+import { n as isMutatingAction, t as MUTATING_ACTIONS } from "./contract-9XpcwcCn.mjs";
+import { a as PORTAL_TOKEN_PREFIX, c as verifyPortalToken, i as buildOpenApiDocument, o as PortalTokenError, r as DEFAULT_PORTAL_ACTIONS, s as createPortalToken, t as createFetchHandler } from "./create-fetch-handler-BIdk9P30.mjs";
+//#region src/storage/watch.ts
+/**
+* Wrap a storage so it implements {@link WatchableWebhooksStorage} using
+* `subscribe` as the change source. The wrapper delegates all reads/writes to
+* `storage` and only adds `watch`; keys not under the watched `prefix` are
+* filtered out. A notification without a key is delivered as a change to the
+* prefix itself (enough to trigger a refresh).
+*/
+function withWatch(storage, subscribe) {
+	const watchable = Object.create(storage);
+	watchable.watch = (prefix, callback) => {
+		const notify = (key) => {
+			if (key !== void 0 && key !== "" && !key.startsWith(prefix)) return;
+			callback({
+				type: "update",
+				key: key && key !== "" ? key : prefix
+			});
+		};
+		return Promise.resolve(subscribe(notify));
+	};
+	return watchable;
+}
+/**
+* A {@link WatchSubscribe} backed by Postgres `LISTEN`/`NOTIFY`. Pair with
+* {@link withWatch} for the postgres or drizzle-over-pg adapters. Your migration
+* owns the trigger that `pg_notify`s `channel` with the changed key as payload;
+* this only `LISTEN`s.
+*
+* @example
+* ```ts
+* import { Client } from "pg";
+* const listener = new Client({ connectionString: process.env.DATABASE_URL });
+* await listener.connect();
+* const storage = withWatch(base, pgListenNotify(listener, "xtandard_webhooks"));
+* ```
+*/
+function pgListenNotify(client, channel = "xtandard_webhooks") {
+	return async (notify) => {
+		const listener = (msg) => {
+			if (msg.channel === channel) notify(msg.payload);
+		};
+		client.on("notification", listener);
+		await client.query(`LISTEN "${channel.replace(/"/g, "\"\"")}"`);
+		return async () => {
+			client.removeListener("notification", listener);
+			await client.query(`UNLISTEN "${channel.replace(/"/g, "\"\"")}"`);
+		};
+	};
+}
+//#endregion
+export { ConflictError, DEFAULT_ATTEMPT_TIMEOUT_MS, DEFAULT_PORTAL_ACTIONS, DEFAULT_RESPONSE_BODY_LIMIT, DEFAULT_RETRY_SCHEDULE, HookDeniedError, IdempotencyConflictError, KEY_REGEX, MUTATING_ACTIONS, NotFoundError, PORTAL_TOKEN_PREFIX, PayloadTooLargeError, PortalTokenError, RESERVED_HEADERS, ReadonlyError, SCHEMA_VERSION, SECRET_PREFIX, VERSION, ValidationError, WebhookVerificationError, activeSecrets, assertValid, attemptDelivery, buildOpenApiDocument, buildSignedRequest, createDispatcher, createFetchHandler, createPortalToken, createWebhooksCore, defaultHookErrorReporter, durationToMs, emitDelivery, generateSecret, hasDeliveryQueue, idPattern, isCompareAndSwap, isMutatingAction, isTerminalDeliveryStatus, isTransactional, isWatchable, keys_exports as keys, newId, normalizeHooks, parseDurationList, pgListenNotify, requirePeer, runAfter, runBefore, sign, signatureHeader, validateApplication, validateEndpoint, validateEndpointUrl, validateEventType, verify, verifyPortalToken, withWatch };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/storage/watch.ts"],"sourcesContent":["/**\n * Composable change-notifications. `watch` is **orthogonal** to which storage\n * you use, so rather than bake it into each adapter, {@link withWatch} wraps\n * *any* {@link WebhooksStorage} with a {@link WatchSubscribe} source you provide\n * — Postgres `LISTEN`/`NOTIFY`, Redis pub/sub, an ORM after-write hook, a\n * websocket, an `EventEmitter`, etc.\n *\n * This gives `watch` to adapters that don't implement it themselves (postgres,\n * drizzle, mongodb, unstorage, cloudflare-kv, …), driven by whatever change\n * signal your infrastructure already has.\n *\n * @example\n * ```ts\n * import { withWatch } from \"@xtandard/webhooks\";\n * import { createDrizzleStorage } from \"@xtandard/webhooks/storage/drizzle\";\n *\n * const storage = withWatch(createDrizzleStorage({ db, table }), (notify) => {\n *   const sub = redis.subscribe(\"webhook-changes\", (m) => notify(m.key));\n *   return () => sub.unsubscribe();\n * });\n * ```\n *\n * @module\n */\n\nimport type { StorageChangeEvent, WatchableWebhooksStorage, WebhooksStorage } from \"./contract.ts\";\n\n/**\n * A change source. Called with a `notify` callback — wire your source to invoke\n * it (optionally with the changed key) on every change — and return an\n * unsubscribe function (sync or async).\n */\nexport type WatchSubscribe = (\n  notify: (key?: string) => void,\n) => (() => void | Promise<void>) | Promise<() => void | Promise<void>>;\n\n/**\n * Wrap a storage so it implements {@link WatchableWebhooksStorage} using\n * `subscribe` as the change source. The wrapper delegates all reads/writes to\n * `storage` and only adds `watch`; keys not under the watched `prefix` are\n * filtered out. A notification without a key is delivered as a change to the\n * prefix itself (enough to trigger a refresh).\n */\nexport function withWatch<S extends WebhooksStorage>(\n  storage: S,\n  subscribe: WatchSubscribe,\n): S & WatchableWebhooksStorage {\n  const watchable = Object.create(storage) as S & WatchableWebhooksStorage;\n  watchable.watch = (prefix, callback) => {\n    const notify = (key?: string): void => {\n      if (key !== undefined && key !== \"\" && !key.startsWith(prefix)) return;\n      callback({\n        type: \"update\",\n        key: key && key !== \"\" ? key : prefix,\n      } satisfies StorageChangeEvent);\n    };\n    return Promise.resolve(subscribe(notify));\n  };\n  return watchable;\n}\n\n/**\n * A dedicated notification client for {@link pgListenNotify} — satisfied by a\n * `pg` `Client`. `Pool` won't do (it rotates connections); use a `Client` you\n * `connect()`.\n */\nexport interface PgNotificationClient {\n  query(sql: string): Promise<unknown>;\n  on(event: \"notification\", listener: (msg: { channel: string; payload?: string }) => void): void;\n  removeListener(\n    event: \"notification\",\n    listener: (msg: { channel: string; payload?: string }) => void,\n  ): void;\n}\n\n/**\n * A {@link WatchSubscribe} backed by Postgres `LISTEN`/`NOTIFY`. Pair with\n * {@link withWatch} for the postgres or drizzle-over-pg adapters. Your migration\n * owns the trigger that `pg_notify`s `channel` with the changed key as payload;\n * this only `LISTEN`s.\n *\n * @example\n * ```ts\n * import { Client } from \"pg\";\n * const listener = new Client({ connectionString: process.env.DATABASE_URL });\n * await listener.connect();\n * const storage = withWatch(base, pgListenNotify(listener, \"xtandard_webhooks\"));\n * ```\n */\nexport function pgListenNotify(\n  client: PgNotificationClient,\n  channel = \"xtandard_webhooks\",\n): WatchSubscribe {\n  return async (notify) => {\n    const listener = (msg: { channel: string; payload?: string }): void => {\n      if (msg.channel === channel) notify(msg.payload);\n    };\n    client.on(\"notification\", listener);\n    await client.query(`LISTEN \"${channel.replace(/\"/g, '\"\"')}\"`);\n    return async () => {\n      client.removeListener(\"notification\", listener);\n      await client.query(`UNLISTEN \"${channel.replace(/\"/g, '\"\"')}\"`);\n    };\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2CA,SAAgB,UACd,SACA,WAC8B;CAC9B,MAAM,YAAY,OAAO,OAAO,OAAO;CACvC,UAAU,SAAS,QAAQ,aAAa;EACtC,MAAM,UAAU,QAAuB;GACrC,IAAI,QAAQ,KAAA,KAAa,QAAQ,MAAM,CAAC,IAAI,WAAW,MAAM,GAAG;GAChE,SAAS;IACP,MAAM;IACN,KAAK,OAAO,QAAQ,KAAK,MAAM;GACjC,CAA8B;EAChC;EACA,OAAO,QAAQ,QAAQ,UAAU,MAAM,CAAC;CAC1C;CACA,OAAO;AACT;;;;;;;;;;;;;;;AA8BA,SAAgB,eACd,QACA,UAAU,qBACM;CAChB,OAAO,OAAO,WAAW;EACvB,MAAM,YAAY,QAAqD;GACrE,IAAI,IAAI,YAAY,SAAS,OAAO,IAAI,OAAO;EACjD;EACA,OAAO,GAAG,gBAAgB,QAAQ;EAClC,MAAM,OAAO,MAAM,WAAW,QAAQ,QAAQ,MAAM,MAAI,EAAE,EAAE;EAC5D,OAAO,YAAY;GACjB,OAAO,eAAe,gBAAgB,QAAQ;GAC9C,MAAM,OAAO,MAAM,aAAa,QAAQ,QAAQ,MAAM,MAAI,EAAE,EAAE;EAChE;CACF;AACF"}

package/dist/keys-Byyj4quQ.mjs

@@ -0,0 +1,111 @@
+import { t as __exportAll } from "./chunk-D7D4PA-g.mjs";
+//#region src/keys.ts
+var keys_exports = /* @__PURE__ */ __exportAll({
+	RESERVED_APPLICATION_KEYS: () => RESERVED_APPLICATION_KEYS,
+	ROOT: () => "whk",
+	applicationMetaKey: () => applicationMetaKey,
+	applicationPrefix: () => applicationPrefix,
+	applicationsKey: () => applicationsKey,
+	attemptKey: () => attemptKey,
+	attemptsPrefix: () => attemptsPrefix,
+	auditLogKey: () => auditLogKey,
+	byEndpointKey: () => byEndpointKey,
+	byEndpointPrefix: () => byEndpointPrefix,
+	byMessageKey: () => byMessageKey,
+	byMessagePrefix: () => byMessagePrefix,
+	deliveriesPrefix: () => deliveriesPrefix,
+	deliveryKey: () => deliveryKey,
+	dueKey: () => dueKey,
+	duePrefix: () => duePrefix,
+	endpointKey: () => endpointKey,
+	endpointsKey: () => endpointsKey,
+	eventTypeKey: () => eventTypeKey,
+	eventTypesKey: () => eventTypesKey,
+	globalAuditLogKey: () => globalAuditLogKey,
+	idempotencyKey: () => idempotencyKey,
+	lastSegment: () => lastSegment,
+	messageKey: () => messageKey,
+	messagesPrefix: () => messagesPrefix,
+	parseDueKey: () => parseDueKey
+});
+/**
+* Application keys that would collide with global index keys under the shared
+* root. Rejected by validation.
+*/
+const RESERVED_APPLICATION_KEYS = [
+	"applications",
+	"event-types",
+	"audit-log"
+];
+/** Global audit log (event-type actions, which are not application-scoped). */
+const globalAuditLogKey = () => `whk/audit-log`;
+/** Index key listing all known application keys. */
+const applicationsKey = () => `whk/applications`;
+/** Metadata for a single application. */
+const applicationMetaKey = (applicationKey) => `whk/${applicationKey}/metadata`;
+/** Index key listing all event type names (global catalog). */
+const eventTypesKey = () => `whk/event-types`;
+/** A single event type record. */
+const eventTypeKey = (name) => `whk/event-types/${name}`;
+/** Index key listing an application's endpoint ids. */
+const endpointsKey = (applicationKey) => `whk/${applicationKey}/endpoints`;
+/** A single endpoint record. */
+const endpointKey = (applicationKey, endpointId) => `whk/${applicationKey}/endpoints/${endpointId}`;
+/** Prefix under which an application's messages live. */
+const messagesPrefix = (applicationKey) => `whk/${applicationKey}/messages/`;
+/** A single message record. */
+const messageKey = (applicationKey, messageId) => `${messagesPrefix(applicationKey)}${messageId}`;
+/** Maps a caller-supplied idempotency key to the message id it produced. */
+const idempotencyKey = (applicationKey, key) => `whk/${applicationKey}/idempotency/${key}`;
+/** Prefix under which an application's deliveries live. */
+const deliveriesPrefix = (applicationKey) => `whk/${applicationKey}/deliveries/`;
+/** A single delivery record. */
+const deliveryKey = (applicationKey, deliveryId) => `${deliveriesPrefix(applicationKey)}${deliveryId}`;
+/** Prefix under which one delivery's attempts live. */
+const attemptsPrefix = (applicationKey, deliveryId) => `whk/${applicationKey}/attempts/${deliveryId}/`;
+/**
+* A single attempt record. The attempt number is zero-padded to four digits so
+* lexicographic key order equals attempt order.
+*/
+const attemptKey = (applicationKey, deliveryId, attemptNumber) => `${attemptsPrefix(applicationKey, deliveryId)}${String(attemptNumber).padStart(4, "0")}`;
+/** Prefix of an application's due index (the dispatcher's work queue). */
+const duePrefix = (applicationKey) => `whk/${applicationKey}/due/`;
+/**
+* A due-index entry: 13-digit zero-padded epoch milliseconds, then the delivery
+* id, `~`-separated. Sorting keys lexicographically sorts entries chronologically.
+*/
+const dueKey = (applicationKey, dueAtMillis, deliveryId) => `${duePrefix(applicationKey)}${String(dueAtMillis).padStart(13, "0")}~${deliveryId}`;
+/** Parse a due-index key back into its due-time and delivery id. */
+const parseDueKey = (key) => {
+	const last = lastSegment(key);
+	const sep = last.indexOf("~");
+	if (sep === -1) return null;
+	const millis = Number(last.slice(0, sep));
+	const deliveryId = last.slice(sep + 1);
+	if (!Number.isFinite(millis) || deliveryId.length === 0) return null;
+	return {
+		dueAtMillis: millis,
+		deliveryId
+	};
+};
+/** Prefix of the message → deliveries reverse index. */
+const byMessagePrefix = (applicationKey, messageId) => `whk/${applicationKey}/by-message/${messageId}/`;
+/** One entry in the message → deliveries reverse index. */
+const byMessageKey = (applicationKey, messageId, deliveryId) => `${byMessagePrefix(applicationKey, messageId)}${deliveryId}`;
+/** Prefix of the endpoint → deliveries reverse index. */
+const byEndpointPrefix = (applicationKey, endpointId) => `whk/${applicationKey}/by-endpoint/${endpointId}/`;
+/** One entry in the endpoint → deliveries reverse index. */
+const byEndpointKey = (applicationKey, endpointId, deliveryId) => `${byEndpointPrefix(applicationKey, endpointId)}${deliveryId}`;
+/** Append-only audit log for an application, stored as an ordered `AuditEntry[]`. */
+const auditLogKey = (applicationKey) => `whk/${applicationKey}/audit-log`;
+/** Prefix under which everything belonging to one application lives. */
+const applicationPrefix = (applicationKey) => `whk/${applicationKey}/`;
+/** Extract the trailing segment (endpoint id / message id / …) from a key. */
+const lastSegment = (key) => {
+	const parts = key.split("/");
+	return parts[parts.length - 1] ?? "";
+};
+//#endregion
+export { messageKey as C, lastSegment as S, parseDueKey as T, eventTypeKey as _, attemptKey as a, idempotencyKey as b, byEndpointKey as c, byMessagePrefix as d, deliveriesPrefix as f, endpointsKey as g, endpointKey as h, applicationsKey as i, byEndpointPrefix as l, dueKey as m, applicationMetaKey as n, attemptsPrefix as o, deliveryKey as p, applicationPrefix as r, auditLogKey as s, RESERVED_APPLICATION_KEYS as t, byMessageKey as u, eventTypesKey as v, messagesPrefix as w, keys_exports as x, globalAuditLogKey as y };
+
+//# sourceMappingURL=keys-Byyj4quQ.mjs.map

package/dist/keys-Byyj4quQ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-Byyj4quQ.mjs","names":[],"sources":["../src/keys.ts"],"sourcesContent":["/**\n * Storage key layout for `@xtandard/webhooks`.\n *\n * Keys are namespaced by application so a single storage backend can host the\n * whole control plane. Pure string helpers — no dependencies.\n *\n * ```txt\n * whk/applications                                 -> string[] index\n * whk/{app}/metadata                               -> Application\n * whk/event-types                                  -> string[] index (global)\n * whk/event-types/{name}                           -> EventType\n * whk/{app}/endpoints                              -> string[] index\n * whk/{app}/endpoints/{id}                         -> Endpoint\n * whk/{app}/messages/{id}                          -> Message\n * whk/{app}/idempotency/{key}                      -> message id\n * whk/{app}/deliveries/{id}                        -> Delivery\n * whk/{app}/attempts/{deliveryId}/{n}              -> DeliveryAttempt (n zero-padded)\n * whk/{app}/due/{dueAtMillis}~{deliveryId}         -> DueEntry (13-digit zero-padded millis)\n * whk/{app}/by-message/{messageId}/{deliveryId}    -> 1 (reverse index)\n * whk/{app}/by-endpoint/{endpointId}/{deliveryId}  -> 1 (reverse index)\n * whk/{app}/audit-log                              -> AuditEntry[] (single ordered array)\n * ```\n *\n * The due index is the dispatcher's generic work queue: 13-digit zero-padded\n * milliseconds make lexicographic key order chronological, so a sorted\n * `getKeys(duePrefix(app))` scan yields deliveries in due order.\n *\n * @module\n */\n\n/** Root namespace segment for all keys. */\nexport const ROOT = \"whk\";\n\n/**\n * Application keys that would collide with global index keys under the shared\n * root. Rejected by validation.\n */\nexport const RESERVED_APPLICATION_KEYS = [\"applications\", \"event-types\", \"audit-log\"] as const;\n\n/** Global audit log (event-type actions, which are not application-scoped). */\nexport const globalAuditLogKey = () => `${ROOT}/audit-log`;\n\n/** Index key listing all known application keys. */\nexport const applicationsKey = () => `${ROOT}/applications`;\n\n/** Metadata for a single application. */\nexport const applicationMetaKey = (applicationKey: string) => `${ROOT}/${applicationKey}/metadata`;\n\n/** Index key listing all event type names (global catalog). */\nexport const eventTypesKey = () => `${ROOT}/event-types`;\n\n/** A single event type record. */\nexport const eventTypeKey = (name: string) => `${ROOT}/event-types/${name}`;\n\n/** Index key listing an application's endpoint ids. */\nexport const endpointsKey = (applicationKey: string) => `${ROOT}/${applicationKey}/endpoints`;\n\n/** A single endpoint record. */\nexport const endpointKey = (applicationKey: string, endpointId: string) =>\n  `${ROOT}/${applicationKey}/endpoints/${endpointId}`;\n\n/** Prefix under which an application's messages live. */\nexport const messagesPrefix = (applicationKey: string) => `${ROOT}/${applicationKey}/messages/`;\n\n/** A single message record. */\nexport const messageKey = (applicationKey: string, messageId: string) =>\n  `${messagesPrefix(applicationKey)}${messageId}`;\n\n/** Maps a caller-supplied idempotency key to the message id it produced. */\nexport const idempotencyKey = (applicationKey: string, key: string) =>\n  `${ROOT}/${applicationKey}/idempotency/${key}`;\n\n/** Prefix under which an application's deliveries live. */\nexport const deliveriesPrefix = (applicationKey: string) => `${ROOT}/${applicationKey}/deliveries/`;\n\n/** A single delivery record. */\nexport const deliveryKey = (applicationKey: string, deliveryId: string) =>\n  `${deliveriesPrefix(applicationKey)}${deliveryId}`;\n\n/** Prefix under which one delivery's attempts live. */\nexport const attemptsPrefix = (applicationKey: string, deliveryId: string) =>\n  `${ROOT}/${applicationKey}/attempts/${deliveryId}/`;\n\n/**\n * A single attempt record. The attempt number is zero-padded to four digits so\n * lexicographic key order equals attempt order.\n */\nexport const attemptKey = (applicationKey: string, deliveryId: string, attemptNumber: number) =>\n  `${attemptsPrefix(applicationKey, deliveryId)}${String(attemptNumber).padStart(4, \"0\")}`;\n\n/** Prefix of an application's due index (the dispatcher's work queue). */\nexport const duePrefix = (applicationKey: string) => `${ROOT}/${applicationKey}/due/`;\n\n/** Value stored at a due-index key. */\nexport interface DueEntry {\n  app: string;\n  deliveryId: string;\n}\n\n/**\n * A due-index entry: 13-digit zero-padded epoch milliseconds, then the delivery\n * id, `~`-separated. Sorting keys lexicographically sorts entries chronologically.\n */\nexport const dueKey = (applicationKey: string, dueAtMillis: number, deliveryId: string) =>\n  `${duePrefix(applicationKey)}${String(dueAtMillis).padStart(13, \"0\")}~${deliveryId}`;\n\n/** Parse a due-index key back into its due-time and delivery id. */\nexport const parseDueKey = (key: string): { dueAtMillis: number; deliveryId: string } | null => {\n  const last = lastSegment(key);\n  const sep = last.indexOf(\"~\");\n  if (sep === -1) return null;\n  const millis = Number(last.slice(0, sep));\n  const deliveryId = last.slice(sep + 1);\n  if (!Number.isFinite(millis) || deliveryId.length === 0) return null;\n  return { dueAtMillis: millis, deliveryId };\n};\n\n/** Prefix of the message → deliveries reverse index. */\nexport const byMessagePrefix = (applicationKey: string, messageId: string) =>\n  `${ROOT}/${applicationKey}/by-message/${messageId}/`;\n\n/** One entry in the message → deliveries reverse index. */\nexport const byMessageKey = (applicationKey: string, messageId: string, deliveryId: string) =>\n  `${byMessagePrefix(applicationKey, messageId)}${deliveryId}`;\n\n/** Prefix of the endpoint → deliveries reverse index. */\nexport const byEndpointPrefix = (applicationKey: string, endpointId: string) =>\n  `${ROOT}/${applicationKey}/by-endpoint/${endpointId}/`;\n\n/** One entry in the endpoint → deliveries reverse index. */\nexport const byEndpointKey = (applicationKey: string, endpointId: string, deliveryId: string) =>\n  `${byEndpointPrefix(applicationKey, endpointId)}${deliveryId}`;\n\n/** Append-only audit log for an application, stored as an ordered `AuditEntry[]`. */\nexport const auditLogKey = (applicationKey: string) => `${ROOT}/${applicationKey}/audit-log`;\n\n/** Prefix under which everything belonging to one application lives. */\nexport const applicationPrefix = (applicationKey: string) => `${ROOT}/${applicationKey}/`;\n\n/** Extract the trailing segment (endpoint id / message id / …) from a key. */\nexport const lastSegment = (key: string): string => {\n  const parts = key.split(\"/\");\n  return parts[parts.length - 1] ?? \"\";\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,MAAa,4BAA4B;CAAC;CAAgB;CAAe;AAAW;;AAGpF,MAAa,0BAA0B;;AAGvC,MAAa,wBAAwB;;AAGrC,MAAa,sBAAsB,mBAA2B,OAAW,eAAe;;AAGxF,MAAa,sBAAsB;;AAGnC,MAAa,gBAAgB,SAAiB,mBAAuB;;AAGrE,MAAa,gBAAgB,mBAA2B,OAAW,eAAe;;AAGlF,MAAa,eAAe,gBAAwB,eAClD,OAAW,eAAe,aAAa;;AAGzC,MAAa,kBAAkB,mBAA2B,OAAW,eAAe;;AAGpF,MAAa,cAAc,gBAAwB,cACjD,GAAG,eAAe,cAAc,IAAI;;AAGtC,MAAa,kBAAkB,gBAAwB,QACrD,OAAW,eAAe,eAAe;;AAG3C,MAAa,oBAAoB,mBAA2B,OAAW,eAAe;;AAGtF,MAAa,eAAe,gBAAwB,eAClD,GAAG,iBAAiB,cAAc,IAAI;;AAGxC,MAAa,kBAAkB,gBAAwB,eACrD,OAAW,eAAe,YAAY,WAAW;;;;;AAMnD,MAAa,cAAc,gBAAwB,YAAoB,kBACrE,GAAG,eAAe,gBAAgB,UAAU,IAAI,OAAO,aAAa,EAAE,SAAS,GAAG,GAAG;;AAGvF,MAAa,aAAa,mBAA2B,OAAW,eAAe;;;;;AAY/E,MAAa,UAAU,gBAAwB,aAAqB,eAClE,GAAG,UAAU,cAAc,IAAI,OAAO,WAAW,EAAE,SAAS,IAAI,GAAG,EAAE,GAAG;;AAG1E,MAAa,eAAe,QAAoE;CAC9F,MAAM,OAAO,YAAY,GAAG;CAC5B,MAAM,MAAM,KAAK,QAAQ,GAAG;CAC5B,IAAI,QAAQ,IAAI,OAAO;CACvB,MAAM,SAAS,OAAO,KAAK,MAAM,GAAG,GAAG,CAAC;CACxC,MAAM,aAAa,KAAK,MAAM,MAAM,CAAC;CACrC,IAAI,CAAC,OAAO,SAAS,MAAM,KAAK,WAAW,WAAW,GAAG,OAAO;CAChE,OAAO;EAAE,aAAa;EAAQ;CAAW;AAC3C;;AAGA,MAAa,mBAAmB,gBAAwB,cACtD,OAAW,eAAe,cAAc,UAAU;;AAGpD,MAAa,gBAAgB,gBAAwB,WAAmB,eACtE,GAAG,gBAAgB,gBAAgB,SAAS,IAAI;;AAGlD,MAAa,oBAAoB,gBAAwB,eACvD,OAAW,eAAe,eAAe,WAAW;;AAGtD,MAAa,iBAAiB,gBAAwB,YAAoB,eACxE,GAAG,iBAAiB,gBAAgB,UAAU,IAAI;;AAGpD,MAAa,eAAe,mBAA2B,OAAW,eAAe;;AAGjF,MAAa,qBAAqB,mBAA2B,OAAW,eAAe;;AAGvF,MAAa,eAAe,QAAwB;CAClD,MAAM,QAAQ,IAAI,MAAM,GAAG;CAC3B,OAAO,MAAM,MAAM,SAAS,MAAM;AACpC"}