ab-ecosystem-cpass 1.0.5 → 1.0.7

package/dist/internal/md5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"md5.js","sourceRoot":"","sources":["../../src/internal/md5.ts"],"names":[],"mappings":";;;AAAA,mCAAsC;AAEtC;;;;;;;;;;;;;;;;GAgBG;AAEH,uCAAuC;AACvC,MAAM,MAAM,GAAG;IACb,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAC1D,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IACtD,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAC1D,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;CAC3D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;IACd,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAEhG,2CAA2C;AACpC,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAU,EAAE;IACpD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAEnC,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAE5B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAE/E,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IAEpB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAElC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,GAAG,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAEhF,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QAEX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAS,CAAC;YACd,IAAI,CAAS,CAAC;YAEd,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACX,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvB,CAAC,GAAG,CAAC,CAAC;YACR,CAAC;iBAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACvB,CAAC;iBAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACnB,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;YAClE,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAE1D,OAAO,IAAA,aAAK,EAAC,MAAM,CAAC,CAAC;AACvB,CAAC,CAAC;AApEW,QAAA,QAAQ,YAoEnB;AAEF,4FAA4F;AACrF,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAA,gBAAQ,EAAC,IAAA,YAAI,EAAC,KAAK,CAAC,CAAC,CAAC;AAAvD,QAAA,GAAG,OAAoD"}

package/dist/internal/receiver-file.d.ts

@@ -0,0 +1,106 @@
+/** One recipient and the variables their message is rendered with. */
+export interface CampaignReceiver {
+    /** The recipient's number, digits only, no `+` and no separators. */
+    waba: string;
+    /**
+     * Per-recipient template variables, as the manager expects them: a flat list of
+     * `{id, value}` rather than an object, because the ids come from CSV headers
+     * and are not safe as object keys.
+     */
+    custom_fields: {
+        id: string;
+        value: string;
+    }[];
+}
+/** An encrypted receiver file, ready to upload. */
+export interface ReceiverFile {
+    /** Base64 AES ciphertext. This is the entire file body. */
+    body: string;
+    /** The secret the file was encrypted under. Stored on the campaign as `hash`. */
+    secret: string;
+    filename: string;
+    contentType: 'text/plain';
+    /** Byte length of `body`, which the upload ticket is signed against. */
+    size: number;
+    /** How many recipients the file contains. */
+    receivers: number;
+}
+/**
+ * A fresh secret for one receiver file.
+ *
+ * Sixteen random bytes as hex -- thirty-two characters, which is the shape
+ * already in the field and what the `hash` field on a stored campaign holds.
+ *
+ * The legacy frontend generated this as 16 random bytes, hex-encoded, then
+ * applied `.toString('base64url').replace(/_/gi,'U').replace(/-/gi,'D')`. That
+ * chain is a **no-op**: `String.prototype.toString` ignores its argument and
+ * returns the string unchanged, and the hex alphabet contains no `_` or `-` for
+ * the replacements to find. So the value that reaches the manager has always been
+ * plain hex, and this produces the identical thing without the dead code.
+ *
+ * One secret per file, never reused. That is what keeps the fixed IV above from
+ * being the flaw it would otherwise be.
+ */
+export declare const generateReceiverSecret: () => string;
+/**
+ * Encrypts the receiver list exactly as the campaign manager expects to read it.
+ *
+ * ```
+ * key        = md5(secret)                     -- 32 lower-case hex characters
+ * key bytes  = the ASCII bytes of that hex     -- 32 bytes, so AES-256
+ * iv         = ASCII bytes of '678025308de70905'
+ * ciphertext = AES-256-CBC, PKCS#7 padded
+ * file body  = base64(ciphertext)
+ * ```
+ *
+ * Two parts of that are counter-intuitive and both are deliberate, because they
+ * mirror what `CryptoJS.AES.encrypt(text, keyWordArray, {iv})` does:
+ *
+ * - **The key is the hex *text*, not the digest bytes.** `md5()` returns a
+ *   32-character string and it is parsed as UTF-8, which lands on 32 bytes and
+ *   therefore AES-256. Using the 16 raw digest bytes instead would be AES-128 and
+ *   would not decrypt.
+ * - **There is no `Salted__` header.** CryptoJS only writes one when it derives a
+ *   key from a passphrase. Given a key directly, as here, its default formatter
+ *   emits bare base64 of the ciphertext.
+ *
+ * Web Crypto applies PKCS#7 padding to AES-CBC itself, which is the same padding
+ * CryptoJS defaults to -- so the outputs are byte-identical.
+ */
+export declare const encryptReceivers: (plaintext: string, secret: string) => Promise<string>;
+/**
+ * The two plaintext encodings a receiver file can hold.
+ *
+ * They are not interchangeable and the reading side picks by campaign type, so
+ * the wrong one produces a file that decrypts cleanly and then parses to
+ * nothing:
+ *
+ * - **`json`** -- `[{waba, custom_fields: [{id, value}]}, …]`. What a bulk
+ *   campaign's single file holds.
+ * - **`table`** -- a `||`-delimited table with a header row. What each bucket of
+ *   a group campaign holds:
+ *
+ *   ```
+ *   waba||first_name||amount
+ *   919000000001||Priya||1299
+ *   919000000002||Ravi||499
+ *   ```
+ *
+ * The table form is narrower than the JSON one: every row has to carry the same
+ * columns in the same order, and a value cannot contain a newline -- so newlines
+ * are stripped from values rather than escaped, which is what the panel did.
+ * Columns are taken from the first receiver, because a header can only be
+ * written once.
+ */
+export type ReceiverEncoding = 'json' | 'table';
+/** The `||` table a group campaign's bucket file holds. */
+export declare const encodeReceiverTable: (receivers: readonly CampaignReceiver[]) => string;
+/**
+ * Turns a receiver list into the encrypted file that gets uploaded.
+ *
+ * The filename is cosmetic: the media service stores the object under a uuid and
+ * keeps only the extension and the display name. The `im_` prefix and `.txt`
+ * extension match what is already in the bucket, so an operator browsing storage
+ * sees one consistent kind of object.
+ */
+export declare const buildReceiverFile: (receivers: CampaignReceiver[], encoding?: ReceiverEncoding) => Promise<ReceiverFile>;

package/dist/internal/receiver-file.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReceiverFile = exports.encodeReceiverTable = exports.encryptReceivers = exports.generateReceiverSecret = void 0;
+const bytes_1 = require("./bytes");
+const md5_1 = require("./md5");
+/**
+ * The fixed initialisation vector the receiver file format uses.
+ *
+ * A constant IV is a real weakness -- it means two files encrypted under the same
+ * secret have identical leading blocks, so an observer can tell that two
+ * campaigns share a prefix of recipients. It is here because **the reading side
+ * is fixed**: the campaign manager decrypts with exactly this IV, and a file
+ * encrypted any other way is a file nothing can read.
+ *
+ * What makes it tolerable rather than merely unavoidable is that the secret is
+ * fresh per file (see {@link generateReceiverSecret}), so the IV is never reused
+ * under the same key -- which is the specific attack a static IV usually enables.
+ *
+ * If the format is ever revised, the fix is a random IV prepended to the
+ * ciphertext, and it has to land on the manager before it lands here.
+ */
+const FIXED_IV = '678025308de70905';
+/**
+ * A fresh secret for one receiver file.
+ *
+ * Sixteen random bytes as hex -- thirty-two characters, which is the shape
+ * already in the field and what the `hash` field on a stored campaign holds.
+ *
+ * The legacy frontend generated this as 16 random bytes, hex-encoded, then
+ * applied `.toString('base64url').replace(/_/gi,'U').replace(/-/gi,'D')`. That
+ * chain is a **no-op**: `String.prototype.toString` ignores its argument and
+ * returns the string unchanged, and the hex alphabet contains no `_` or `-` for
+ * the replacements to find. So the value that reaches the manager has always been
+ * plain hex, and this produces the identical thing without the dead code.
+ *
+ * One secret per file, never reused. That is what keeps the fixed IV above from
+ * being the flaw it would otherwise be.
+ */
+const generateReceiverSecret = () => (0, bytes_1.toHex)((0, bytes_1.randomBytes)(16));
+exports.generateReceiverSecret = generateReceiverSecret;
+/**
+ * Encrypts the receiver list exactly as the campaign manager expects to read it.
+ *
+ * ```
+ * key        = md5(secret)                     -- 32 lower-case hex characters
+ * key bytes  = the ASCII bytes of that hex     -- 32 bytes, so AES-256
+ * iv         = ASCII bytes of '678025308de70905'
+ * ciphertext = AES-256-CBC, PKCS#7 padded
+ * file body  = base64(ciphertext)
+ * ```
+ *
+ * Two parts of that are counter-intuitive and both are deliberate, because they
+ * mirror what `CryptoJS.AES.encrypt(text, keyWordArray, {iv})` does:
+ *
+ * - **The key is the hex *text*, not the digest bytes.** `md5()` returns a
+ *   32-character string and it is parsed as UTF-8, which lands on 32 bytes and
+ *   therefore AES-256. Using the 16 raw digest bytes instead would be AES-128 and
+ *   would not decrypt.
+ * - **There is no `Salted__` header.** CryptoJS only writes one when it derives a
+ *   key from a passphrase. Given a key directly, as here, its default formatter
+ *   emits bare base64 of the ciphertext.
+ *
+ * Web Crypto applies PKCS#7 padding to AES-CBC itself, which is the same padding
+ * CryptoJS defaults to -- so the outputs are byte-identical.
+ */
+const encryptReceivers = async (plaintext, secret) => {
+    const crypto = (0, bytes_1.subtle)();
+    const key = await crypto.importKey('raw', (0, bytes_1.toArrayBuffer)((0, bytes_1.utf8)((0, md5_1.md5)(secret))), { name: 'AES-CBC' }, false, [
+        'encrypt',
+    ]);
+    const ciphertext = await crypto.encrypt({ name: 'AES-CBC', iv: (0, bytes_1.toArrayBuffer)((0, bytes_1.utf8)(FIXED_IV)) }, key, (0, bytes_1.toArrayBuffer)((0, bytes_1.utf8)(plaintext)));
+    return (0, bytes_1.toBase64)(new Uint8Array(ciphertext));
+};
+exports.encryptReceivers = encryptReceivers;
+const COLUMN_SEPARATOR = '||';
+/** The `||` table a group campaign's bucket file holds. */
+const encodeReceiverTable = (receivers) => {
+    const first = receivers[0];
+    if (!first)
+        return '';
+    const columns = first.custom_fields.map((field) => field.id);
+    const header = ['waba', ...columns].join(COLUMN_SEPARATOR);
+    const rows = receivers.map((receiver) => {
+        // Addressed by column rather than by position: a row whose variables arrived
+        // in a different order would otherwise silently shift every value one place.
+        const byId = new Map(receiver.custom_fields.map((field) => [field.id, field.value]));
+        return [receiver.waba, ...columns.map((column) => flatten(byId.get(column) ?? ''))].join(COLUMN_SEPARATOR);
+    });
+    // Trailing newline: the panel's writer ended every row with one, so the last
+    // line is terminated rather than merely ending.
+    return `${[header, ...rows].join('\n')}\n`;
+};
+exports.encodeReceiverTable = encodeReceiverTable;
+/**
+ * A value as a table cell: no newlines, no separator.
+ *
+ * Newlines are stripped because the format has no escape for them -- one would
+ * end the row early and shift every later value into the wrong column. The
+ * separator is stripped for the same reason. Both are replaced by a space rather
+ * than removed, so two words do not run together.
+ */
+const flatten = (value) => value.replace(/[\r\n]+/g, ' ').split(COLUMN_SEPARATOR).join(' ');
+/**
+ * Turns a receiver list into the encrypted file that gets uploaded.
+ *
+ * The filename is cosmetic: the media service stores the object under a uuid and
+ * keeps only the extension and the display name. The `im_` prefix and `.txt`
+ * extension match what is already in the bucket, so an operator browsing storage
+ * sees one consistent kind of object.
+ */
+const buildReceiverFile = async (receivers, encoding = 'json') => {
+    const secret = (0, exports.generateReceiverSecret)();
+    const plaintext = encoding === 'table' ? (0, exports.encodeReceiverTable)(receivers) : JSON.stringify(receivers);
+    const body = await (0, exports.encryptReceivers)(plaintext, secret);
+    return {
+        body,
+        secret,
+        filename: `im_${Date.now().toString(36)}${(0, bytes_1.toHex)((0, bytes_1.randomBytes)(4))}.txt`,
+        contentType: 'text/plain',
+        // The ciphertext is base64, so every character is one byte. Measuring the
+        // string rather than re-encoding it is exact here, and the upload signature
+        // covers this number.
+        size: body.length,
+        receivers: receivers.length,
+    };
+};
+exports.buildReceiverFile = buildReceiverFile;
+//# sourceMappingURL=receiver-file.js.map

package/dist/internal/receiver-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-file.js","sourceRoot":"","sources":["../../src/internal/receiver-file.ts"],"names":[],"mappings":";;;AAAA,mCAAoF;AACpF,+BAA4B;AAE5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AA4BpC;;;;;;;;;;;;;;;GAeG;AACI,MAAM,sBAAsB,GAAG,GAAW,EAAE,CAAC,IAAA,aAAK,EAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC;AAA9D,QAAA,sBAAsB,0BAAwC;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACI,MAAM,gBAAgB,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAc,EAAmB,EAAE;IAC3F,MAAM,MAAM,GAAG,IAAA,cAAM,GAAE,CAAC;IAExB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,qBAAa,EAAC,IAAA,YAAI,EAAC,IAAA,SAAG,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QACtG,SAAS;KACV,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO,CACrC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAA,qBAAa,EAAC,IAAA,YAAI,EAAC,QAAQ,CAAC,CAAC,EAAE,EACtD,GAAG,EACH,IAAA,qBAAa,EAAC,IAAA,YAAI,EAAC,SAAS,CAAC,CAAC,CAC/B,CAAC;IAEF,OAAO,IAAA,gBAAQ,EAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC;AAbW,QAAA,gBAAgB,oBAa3B;AA4BF,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,2DAA2D;AACpD,MAAM,mBAAmB,GAAG,CAAC,SAAsC,EAAU,EAAE;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAErF,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,gDAAgD;IAChD,OAAO,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7C,CAAC,CAAC;AAlBW,QAAA,mBAAmB,uBAkB9B;AAEF;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5G;;;;;;;GAOG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,SAA6B,EAC7B,WAA6B,MAAM,EACZ,EAAE;IACzB,MAAM,MAAM,GAAG,IAAA,8BAAsB,GAAE,CAAC;IACxC,MAAM,SAAS,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAA,2BAAmB,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,MAAM,IAAA,wBAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO;QACL,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,IAAA,aAAK,EAAC,IAAA,mBAAW,EAAC,CAAC,CAAC,CAAC,MAAM;QACrE,WAAW,EAAE,YAAY;QACzB,0EAA0E;QAC1E,4EAA4E;QAC5E,sBAAsB;QACtB,IAAI,EAAE,IAAI,CAAC,MAAM;QACjB,SAAS,EAAE,SAAS,CAAC,MAAM;KAC5B,CAAC;AACJ,CAAC,CAAC;AAnBW,QAAA,iBAAiB,qBAmB5B"}

package/dist/resources/audience/notifications.d.ts

@@ -0,0 +1,171 @@
+import type { Device, ListDevicesQuery, Paginated, SubscribeNotificationsInput } from '../../types';
+import type { HttpClient } from '../../http';
+/**
+ * Push notification subscriptions: which browsers and apps a user wants
+ * notifications delivered to.
+ *
+ * ```ts
+ * // after the browser has granted permission and Firebase has a token
+ * await crm.notifications.subscribe({ token });
+ *
+ * // logout, or the user turning notifications off
+ * await crm.notifications.unsubscribe(token);
+ *
+ * // what the user sees in "notification settings"
+ * const { data } = await crm.notifications.devices();
+ * ```
+ *
+ * ## What this does and does not cover
+ *
+ * A push subscription has two halves and only one of them is an API call:
+ *
+ * 1. **In the browser** -- ask for permission (`Notification.requestPermission()`),
+ *    then get a registration token for this instance
+ *    (`getToken(messaging, { vapidKey })` from `firebase/messaging`). This SDK
+ *    deliberately does none of that: it would mean a hard dependency on
+ *    `firebase/*`, in a package that also runs on Node, to wrap two calls whose
+ *    arguments come from your own Firebase project.
+ * 2. **Here** -- hand that token to the platform so the send path can reach it,
+ *    which is what {@link subscribe} does, and withdraw it on logout, which is
+ *    {@link unsubscribe}.
+ *
+ * ## Where a subscription lives
+ *
+ * On the platform, against the acting user, in this product -- not in the core
+ * platform. Core owns identity and the agency's Firebase credentials; messages
+ * arrive here, so the tokens and the sending live here too, and core is not on
+ * the delivery path. Nothing in the subscription call names the Firebase project:
+ * the platform resolves it from the client the call arrives on and stamps it onto
+ * the row, because a token is only sendable through the project that minted it
+ * and nothing in the token says which.
+ */
+export declare class Notifications {
+    private readonly http;
+    constructor(http: HttpClient);
+    /**
+     * Subscribes this browser or app instance to notifications.
+     *
+     * ```http
+     * POST /v1/audience/devices
+     * authorization: Bearer <ecosystem token>
+     * client-id: tpc_8Kd3mXp7qR2wL9zB
+     * content-type: application/json
+     *
+     * {
+     *   "token": "fNx8...:APA91bH...",
+     *   "platform": "web",
+     *   "device_label": "Chrome on Windows",
+     *   "tpc_id": "tpc_8Kd3mXp7qR2wL9zB"
+     * }
+     * ```
+     *
+     * Answers `201` with the stored {@link Device}, token omitted. Of those four
+     * fields the SDK fills in two for you: `platform` defaults to `'web'` when it
+     * can see a DOM, and `device_label` to something like `Chrome on Windows` from
+     * the user agent.
+     *
+     * ## Call it on every app load, not once
+     *
+     * It is an idempotent upsert keyed on the token, so re-sending one the platform
+     * already holds costs a single indexed update. That is the intended usage,
+     * because two things change underneath you:
+     *
+     * - FCM rotates registration tokens on its own schedule, and the old one stops
+     *   being delivered to without anyone being told.
+     * - A device unseen for 60 days is pruned, and "seen" means a successful send
+     *   or a call to this method. A user who receives no notifications for two
+     *   months would otherwise fall off the list.
+     *
+     * Re-registering a token that is already on file against **another** user
+     * moves it rather than duplicating it: one browser has one person signed in,
+     * and the previous owner's notifications must stop reaching it the moment
+     * someone else logs in there.
+     *
+     * ## Identity
+     *
+     * The user comes from the verified token this client was built with, and there
+     * is no field that could say otherwise. `tpc_id` is the one tenant field
+     * accepted, because it is not an identity claim -- it says which reseller
+     * frontend is registering, which decides whose Firebase project and which deep
+     * link host apply. It is cross-checked against the verified `client-id`, so it
+     * can confirm the surface but never move the device to another tenant: a value
+     * that contradicts the token is refused with `403` rather than ignored.
+     *
+     * ## Failures worth handling
+     *
+     * - `400 validation_failed` -- the token is missing or implausible, or
+     *   `platform` could not be defaulted (see {@link SubscribeNotificationsInput}).
+     * - `403 forbidden` -- `tpc_id` names a different client than the token was
+     *   issued for.
+     * - `503 push_not_configured` -- the agency has no Firebase notification
+     *   resource set up. Nothing the caller can fix; notifications are simply off
+     *   for this account.
+     * - `503 push_unavailable` -- the platform could not reach core to read the
+     *   configuration. Transient.
+     *
+     * Both `503`s deserve the same handling as a successful call: try again on the
+     * next app load, which the advice above means you are doing anyway.
+     *
+     * Scope: `devices:write`.
+     */
+    subscribe(input: SubscribeNotificationsInput): Promise<Device>;
+    /**
+     * Stops notifications reaching one device. What logout calls.
+     *
+     * ```http
+     * POST /v1/audience/devices/unregister
+     * { "token": "fNx8...:APA91bH..." }
+     * ```
+     *
+     * `204`, no body, whether or not a row went -- the caller is asking for a
+     * guarantee about the future, and a token that is already gone provides it. So
+     * this is safe to call unconditionally on logout without first checking whether
+     * the device was ever subscribed.
+     *
+     * Scoped to the caller's own devices. A token identifies a browser rather than
+     * a person, so by the time one user logs out the row may already belong to
+     * whoever logged in after them; an unscoped delete would cut off the person now
+     * holding it.
+     *
+     * A `POST` with the token in the body, not `DELETE /devices/:token`: a
+     * registration token is hundreds of characters and may contain `:` and `/`, and
+     * putting one in a path would invite proxy length limits and write a live send
+     * credential into every access log on the way.
+     *
+     * ## Also delete it on the device
+     *
+     * This revokes the platform's permission to send to the token. If the user is
+     * turning notifications *off* -- rather than logging out -- also call
+     * `deleteToken(messaging)` in the browser, otherwise the next `getToken()`
+     * hands back the same token and the subscription can come back by accident.
+     *
+     * Scope: `devices:write`.
+     */
+    unsubscribe(token: string): Promise<void>;
+    /**
+     * The caller's own subscribed devices, newest contact first.
+     *
+     * ```http
+     * GET /v1/audience/devices?page=1&rows=25
+     * ```
+     *
+     * Offset paginated, `rows` 1..100 and default 25, sorted by `lastSeenAt`
+     * descending. This is what a "notification settings" screen lists, and the 20
+     * most recently seen devices are also the only ones a notification is sent to,
+     * so a longer list is itself the answer to "why did my old laptop stop
+     * buzzing".
+     *
+     * Only ever the acting user's own devices -- there is no account-wide view and
+     * no device id in the path. A device is one person's browser, and the only
+     * party with a reason to see or revoke it is that person.
+     *
+     * Tokens are not included, so this cannot tell you whether *this* browser is
+     * subscribed. Decide that locally: the browser knows its own
+     * `Notification.permission` and its own token, and {@link subscribe} being
+     * idempotent means the cheap answer to "am I still subscribed" is to subscribe
+     * again.
+     *
+     * Scope: `devices:read`.
+     */
+    devices(query?: Partial<ListDevicesQuery>): Promise<Paginated<Device>>;
+}

package/dist/resources/audience/notifications.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Notifications = void 0;
+const errors_1 = require("../../errors");
+const device_1 = require("../../internal/device");
+const paths_1 = require("../paths");
+const BASE = `${paths_1.AUDIENCE}/devices`;
+/** The bounds the server applies, checked here so a bad token fails without a round trip. */
+const TOKEN_LENGTH = { min: 20, max: 4096 };
+/** What the server accepts as a label, so a long one is trimmed rather than refused. */
+const MAX_LABEL = 200;
+/**
+ * Push notification subscriptions: which browsers and apps a user wants
+ * notifications delivered to.
+ *
+ * ```ts
+ * // after the browser has granted permission and Firebase has a token
+ * await crm.notifications.subscribe({ token });
+ *
+ * // logout, or the user turning notifications off
+ * await crm.notifications.unsubscribe(token);
+ *
+ * // what the user sees in "notification settings"
+ * const { data } = await crm.notifications.devices();
+ * ```
+ *
+ * ## What this does and does not cover
+ *
+ * A push subscription has two halves and only one of them is an API call:
+ *
+ * 1. **In the browser** -- ask for permission (`Notification.requestPermission()`),
+ *    then get a registration token for this instance
+ *    (`getToken(messaging, { vapidKey })` from `firebase/messaging`). This SDK
+ *    deliberately does none of that: it would mean a hard dependency on
+ *    `firebase/*`, in a package that also runs on Node, to wrap two calls whose
+ *    arguments come from your own Firebase project.
+ * 2. **Here** -- hand that token to the platform so the send path can reach it,
+ *    which is what {@link subscribe} does, and withdraw it on logout, which is
+ *    {@link unsubscribe}.
+ *
+ * ## Where a subscription lives
+ *
+ * On the platform, against the acting user, in this product -- not in the core
+ * platform. Core owns identity and the agency's Firebase credentials; messages
+ * arrive here, so the tokens and the sending live here too, and core is not on
+ * the delivery path. Nothing in the subscription call names the Firebase project:
+ * the platform resolves it from the client the call arrives on and stamps it onto
+ * the row, because a token is only sendable through the project that minted it
+ * and nothing in the token says which.
+ */
+class Notifications {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    /**
+     * Subscribes this browser or app instance to notifications.
+     *
+     * ```http
+     * POST /v1/audience/devices
+     * authorization: Bearer <ecosystem token>
+     * client-id: tpc_8Kd3mXp7qR2wL9zB
+     * content-type: application/json
+     *
+     * {
+     *   "token": "fNx8...:APA91bH...",
+     *   "platform": "web",
+     *   "device_label": "Chrome on Windows",
+     *   "tpc_id": "tpc_8Kd3mXp7qR2wL9zB"
+     * }
+     * ```
+     *
+     * Answers `201` with the stored {@link Device}, token omitted. Of those four
+     * fields the SDK fills in two for you: `platform` defaults to `'web'` when it
+     * can see a DOM, and `device_label` to something like `Chrome on Windows` from
+     * the user agent.
+     *
+     * ## Call it on every app load, not once
+     *
+     * It is an idempotent upsert keyed on the token, so re-sending one the platform
+     * already holds costs a single indexed update. That is the intended usage,
+     * because two things change underneath you:
+     *
+     * - FCM rotates registration tokens on its own schedule, and the old one stops
+     *   being delivered to without anyone being told.
+     * - A device unseen for 60 days is pruned, and "seen" means a successful send
+     *   or a call to this method. A user who receives no notifications for two
+     *   months would otherwise fall off the list.
+     *
+     * Re-registering a token that is already on file against **another** user
+     * moves it rather than duplicating it: one browser has one person signed in,
+     * and the previous owner's notifications must stop reaching it the moment
+     * someone else logs in there.
+     *
+     * ## Identity
+     *
+     * The user comes from the verified token this client was built with, and there
+     * is no field that could say otherwise. `tpc_id` is the one tenant field
+     * accepted, because it is not an identity claim -- it says which reseller
+     * frontend is registering, which decides whose Firebase project and which deep
+     * link host apply. It is cross-checked against the verified `client-id`, so it
+     * can confirm the surface but never move the device to another tenant: a value
+     * that contradicts the token is refused with `403` rather than ignored.
+     *
+     * ## Failures worth handling
+     *
+     * - `400 validation_failed` -- the token is missing or implausible, or
+     *   `platform` could not be defaulted (see {@link SubscribeNotificationsInput}).
+     * - `403 forbidden` -- `tpc_id` names a different client than the token was
+     *   issued for.
+     * - `503 push_not_configured` -- the agency has no Firebase notification
+     *   resource set up. Nothing the caller can fix; notifications are simply off
+     *   for this account.
+     * - `503 push_unavailable` -- the platform could not reach core to read the
+     *   configuration. Transient.
+     *
+     * Both `503`s deserve the same handling as a successful call: try again on the
+     * next app load, which the advice above means you are doing anyway.
+     *
+     * Scope: `devices:write`.
+     */
+    subscribe(input) {
+        const token = (input.token ?? '').trim();
+        if (token.length < TOKEN_LENGTH.min || token.length > TOKEN_LENGTH.max) {
+            throw new errors_1.CrmApiError(400, 'validation_failed', `token must be a Firebase registration token of ${TOKEN_LENGTH.min}..${TOKEN_LENGTH.max} characters`);
+        }
+        const platform = input.platform ?? (0, device_1.detectPlatform)();
+        if (!platform) {
+            // Not defaulted to 'web' outside a browser on purpose: a mobile runtime
+            // registered as web gets the webpush half of the payload, which FCM
+            // accepts and the device never displays.
+            throw new errors_1.CrmApiError(400, 'validation_failed', 'platform is required outside a browser: pass "android", "ios", or "web" explicitly');
+        }
+        const label = (input.device_label ?? (0, device_1.describeDevice)() ?? '').trim().slice(0, MAX_LABEL);
+        return this.http.request('POST', BASE, {
+            body: {
+                token,
+                platform,
+                // Both omitted when empty rather than sent as '': the server treats an
+                // absent optional and an empty one the same way, and a body carrying only
+                // what it means is easier to read in a log.
+                ...(label ? { device_label: label } : {}),
+                ...(input.tpc_id ? { tpc_id: input.tpc_id.trim() } : {}),
+            },
+        });
+    }
+    /**
+     * Stops notifications reaching one device. What logout calls.
+     *
+     * ```http
+     * POST /v1/audience/devices/unregister
+     * { "token": "fNx8...:APA91bH..." }
+     * ```
+     *
+     * `204`, no body, whether or not a row went -- the caller is asking for a
+     * guarantee about the future, and a token that is already gone provides it. So
+     * this is safe to call unconditionally on logout without first checking whether
+     * the device was ever subscribed.
+     *
+     * Scoped to the caller's own devices. A token identifies a browser rather than
+     * a person, so by the time one user logs out the row may already belong to
+     * whoever logged in after them; an unscoped delete would cut off the person now
+     * holding it.
+     *
+     * A `POST` with the token in the body, not `DELETE /devices/:token`: a
+     * registration token is hundreds of characters and may contain `:` and `/`, and
+     * putting one in a path would invite proxy length limits and write a live send
+     * credential into every access log on the way.
+     *
+     * ## Also delete it on the device
+     *
+     * This revokes the platform's permission to send to the token. If the user is
+     * turning notifications *off* -- rather than logging out -- also call
+     * `deleteToken(messaging)` in the browser, otherwise the next `getToken()`
+     * hands back the same token and the subscription can come back by accident.
+     *
+     * Scope: `devices:write`.
+     */
+    unsubscribe(token) {
+        const value = (token ?? '').trim();
+        if (!value)
+            throw new errors_1.CrmApiError(400, 'validation_failed', 'token is required');
+        return this.http.request('POST', `${BASE}/unregister`, { body: { token: value } });
+    }
+    /**
+     * The caller's own subscribed devices, newest contact first.
+     *
+     * ```http
+     * GET /v1/audience/devices?page=1&rows=25
+     * ```
+     *
+     * Offset paginated, `rows` 1..100 and default 25, sorted by `lastSeenAt`
+     * descending. This is what a "notification settings" screen lists, and the 20
+     * most recently seen devices are also the only ones a notification is sent to,
+     * so a longer list is itself the answer to "why did my old laptop stop
+     * buzzing".
+     *
+     * Only ever the acting user's own devices -- there is no account-wide view and
+     * no device id in the path. A device is one person's browser, and the only
+     * party with a reason to see or revoke it is that person.
+     *
+     * Tokens are not included, so this cannot tell you whether *this* browser is
+     * subscribed. Decide that locally: the browser knows its own
+     * `Notification.permission` and its own token, and {@link subscribe} being
+     * idempotent means the cheap answer to "am I still subscribed" is to subscribe
+     * again.
+     *
+     * Scope: `devices:read`.
+     */
+    devices(query = {}) {
+        return this.http.request('GET', BASE, { query });
+    }
+}
+exports.Notifications = Notifications;
+//# sourceMappingURL=notifications.js.map

package/dist/resources/audience/notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../../src/resources/audience/notifications.ts"],"names":[],"mappings":";;;AAEA,yCAA2C;AAC3C,kDAAuE;AACvE,oCAAoC;AAEpC,MAAM,IAAI,GAAG,GAAG,gBAAQ,UAAU,CAAC;AAEnC,6FAA6F;AAC7F,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAE5C,wFAAwF;AACxF,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAa,aAAa;IACK;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiEG;IACH,SAAS,CAAC,KAAkC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzC,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC;YACvE,MAAM,IAAI,oBAAW,CACnB,GAAG,EACH,mBAAmB,EACnB,kDAAkD,YAAY,CAAC,GAAG,KAAK,YAAY,CAAC,GAAG,aAAa,CACrG,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAA,uBAAc,GAAE,CAAC;QAEpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,wEAAwE;YACxE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,IAAI,oBAAW,CACnB,GAAG,EACH,mBAAmB,EACnB,oFAAoF,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,IAAA,uBAAc,GAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAExF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAS,MAAM,EAAE,IAAI,EAAE;YAC7C,IAAI,EAAE;gBACJ,KAAK;gBACL,QAAQ;gBACR,uEAAuE;gBACvE,0EAA0E;gBAC1E,4CAA4C;gBAC5C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,WAAW,CAAC,KAAa;QACvB,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEnC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,oBAAW,CAAC,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QAEjF,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAO,MAAM,EAAE,GAAG,IAAI,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,QAAmC,EAAE;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAoB,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;CACF;AAhLD,sCAgLC"}