batchwork 1.4.0 → 1.5.0

package/dist/{chunk-ka9d4t6v.js → chunk-k7n7k3et.js}

@@ -1,8 +1,13 @@
 import {
-  BatchworkError,
-  getAdapter,
-  isTerminalStatus
-} from "./chunk-vy4w8mpb.js";
+  BatchworkError2,
+  isTerminalStatus2,
+  getAdapter
+} from "./chunk-7y95mhvm.js";
+import {
+  parseJson,
+  asRecord,
+  asString
+} from "./chunk-6jgvqdpc.js";
 
 // src/server/events.ts
 var EVENT_BY_STATUS = {
@@ -21,10 +26,11 @@ var toEvent = (provider, snapshot) => ({
 });
 
 // src/server/signing.ts
-var SIGNATURE_VERSION = "v1";
+import { Webhook, WebhookVerificationError } from "standardwebhooks";
 var TOLERANCE_SECONDS = 300;
 var SECRET_PREFIX = "whsec_";
 var encoder = new TextEncoder;
+var createWebhook = (secret) => secret.startsWith(SECRET_PREFIX) ? new Webhook(secret) : new Webhook(encoder.encode(secret), { format: "raw" });
 var replayCache = new Map;
 var replayLocks = new WeakMap;
 var pruneReplayCache = (now) => {
@@ -73,33 +79,12 @@ var withReplayLock = async (store, id, task) => {
     }
   }
 };
-var base64ToBytes = (value) => Uint8Array.from(atob(value), (char) => char.codePointAt(0) ?? 0);
-var bytesToBase64 = (bytes) => {
-  let binary = "";
-  for (const byte of bytes) {
-    binary += String.fromCodePoint(byte);
-  }
-  return btoa(binary);
-};
-var importKey = (secret) => {
-  const raw = secret.startsWith(SECRET_PREFIX) ? base64ToBytes(secret.slice(SECRET_PREFIX.length)) : encoder.encode(secret);
-  return crypto.subtle.importKey("raw", raw, { hash: "SHA-256", name: "HMAC" }, false, ["sign", "verify"]);
-};
-var signContent = async (secret, content) => {
-  const key = await importKey(secret);
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(content));
-  return bytesToBase64(new Uint8Array(signature));
-};
-var verifyContent = async (secret, content, signature) => {
-  const key = await importKey(secret);
-  return crypto.subtle.verify("HMAC", key, base64ToBytes(signature), encoder.encode(content));
-};
 var rememberWebhookId = async (id, timestamp, now, store) => {
   const expiresAt = timestamp + TOLERANCE_SECONDS;
   if (store.claim) {
     const claimed = await store.claim(id, expiresAt, now);
     if (!claimed) {
-      throw new BatchworkError("batchwork: webhook replay detected.");
+      throw new BatchworkError2("batchwork: webhook replay detected.");
     }
     return;
   }
@@ -109,145 +94,81 @@ var rememberWebhookId = async (id, timestamp, now, store) => {
     }
     const existing = await store.get(id);
     if (existing && existing > now) {
-      throw new BatchworkError("batchwork: webhook replay detected.");
+      throw new BatchworkError2("batchwork: webhook replay detected.");
     }
     await store.set(id, expiresAt);
   });
 };
-var signWebhook = async (secret, id, body, timestampSeconds) => {
-  const timestamp = Math.floor(timestampSeconds).toString();
-  const signature = await signContent(secret, `${id}.${timestamp}.${body}`);
-  return {
+var signWebhook2 = (secret, id, body, timestampSeconds) => {
+  const timestamp = Math.floor(timestampSeconds);
+  const signature = createWebhook(secret).sign(id, new Date(timestamp * 1000), body);
+  return Promise.resolve({
     "webhook-id": id,
-    "webhook-signature": `${SIGNATURE_VERSION},${signature}`,
-    "webhook-timestamp": timestamp
-  };
+    "webhook-signature": signature,
+    "webhook-timestamp": timestamp.toString()
+  });
 };
-var verifyWebhook = async (request, secret, options) => {
+var verifyWebhook2 = async (request, secret, options) => {
   const id = request.headers.get("webhook-id");
   const timestamp = request.headers.get("webhook-timestamp");
   const signatureHeader = request.headers.get("webhook-signature");
   if (!(id && timestamp && signatureHeader)) {
-    throw new BatchworkError("batchwork: missing webhook signature headers.");
+    throw new BatchworkError2("batchwork: missing webhook signature headers.");
   }
   const seconds = Number(timestamp);
   const now = Date.now() / 1000;
   if (!Number.isFinite(seconds) || Math.abs(now - seconds) > TOLERANCE_SECONDS) {
-    throw new BatchworkError("batchwork: webhook timestamp outside tolerance.");
+    throw new BatchworkError2("batchwork: webhook timestamp outside tolerance.");
   }
   const body = await request.text();
-  const content = `${id}.${timestamp}.${body}`;
-  const signatures = signatureHeader.split(" ").map((part) => {
-    const comma = part.indexOf(",");
-    return comma === -1 ? part : part.slice(comma + 1);
-  });
-  let valid = false;
-  for (const signature of signatures) {
-    if (await verifyContent(secret, content, signature)) {
-      valid = true;
-      break;
+  try {
+    createWebhook(secret).verify(body, {
+      "webhook-id": id,
+      "webhook-signature": signatureHeader,
+      "webhook-timestamp": timestamp
+    });
+  } catch (error) {
+    if (error instanceof WebhookVerificationError) {
+      throw new BatchworkError2(error.message.toLowerCase().includes("timestamp") ? "batchwork: webhook timestamp outside tolerance." : "batchwork: webhook signature verification failed.", { cause: error });
     }
   }
-  if (!valid) {
-    throw new BatchworkError("batchwork: webhook signature verification failed.");
-  }
   await rememberWebhookId(id, seconds, now, options?.replayStore ?? defaultReplayStore);
   return { body, id, timestamp: seconds };
 };
-var verifyBatchWebhook = async (request, secret, options) => {
-  const { body } = await verifyWebhook(request, secret, options);
+var verifyBatchWebhook2 = async (request, secret, options) => {
+  const { body } = await verifyWebhook2(request, secret, options);
   return JSON.parse(body);
 };
 
 // src/server/poller.ts
-var parseIpv4 = (host) => {
-  if (!/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(host)) {
-    return;
-  }
-  const parts = host.split(".").map(Number);
-  const valid = parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255);
-  return valid ? parts : undefined;
-};
-var isPrivateIpv4 = (parts) => {
-  const [a = 0, b = 0] = parts;
-  if (a === 0 || a === 10 || a === 127 || a >= 224) {
-    return true;
-  }
-  switch (a) {
-    case 100: {
-      return b >= 64 && b <= 127;
-    }
-    case 169: {
-      return b === 254;
-    }
-    case 172: {
-      return b >= 16 && b <= 31;
-    }
-    case 192: {
-      return b === 168;
-    }
-    case 198: {
-      return b === 18 || b === 19;
-    }
-    default: {
-      return false;
-    }
-  }
-};
-var isHextet = (value) => Number.isInteger(value) && value >= 0 && value <= 65535;
-var parseIpv4MappedIpv6 = (host) => {
-  const normalized = host.replace(/^\[/u, "").replace(/\]$/u, "").toLowerCase();
-  if (!normalized.startsWith("::ffff:")) {
-    return;
-  }
-  const suffix = normalized.slice("::ffff:".length);
-  const dotted = parseIpv4(suffix);
-  if (dotted) {
-    return dotted;
-  }
-  const [high, low, extra] = suffix.split(":");
-  if (!(high && low) || extra !== undefined) {
-    return;
-  }
-  const highBits = Number.parseInt(high, 16);
-  const lowBits = Number.parseInt(low, 16);
-  if (!(isHextet(highBits) && isHextet(lowBits))) {
-    return;
-  }
-  return [
-    Math.floor(highBits / 256),
-    highBits % 256,
-    Math.floor(lowBits / 256),
-    lowBits % 256
-  ];
-};
-var isPrivateIpv6 = (host) => {
-  const normalized = host.replace(/^\[/u, "").replace(/\]$/u, "").toLowerCase();
-  if (!normalized.includes(":")) {
-    return false;
-  }
-  if (normalized === "::" || normalized === "::1") {
-    return true;
+import ipaddr from "ipaddr.js";
+var isCredentialFunction = (credentials) => typeof credentials === "function";
+var resolveProviderCredentials = (credentials, provider) => {
+  if (credentials === undefined) {
+    return {};
   }
-  return normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe80:");
+  return isCredentialFunction(credentials) ? credentials(provider) : credentials;
 };
 var isPrivateHost = (host) => {
   if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local")) {
     return true;
   }
-  const ipv4 = parseIpv4(host) ?? parseIpv4MappedIpv6(host);
-  return (ipv4 ? isPrivateIpv4(ipv4) : false) || isPrivateIpv6(host);
+  const literal = host.replace(/^\[/u, "").replace(/\]$/u, "");
+  if (!ipaddr.isValid(literal)) {
+    return false;
+  }
+  return ipaddr.process(literal).range() !== "unicast";
 };
 var isRedirectStatus = (status) => status >= 300 && status < 400;
 var assertSafeWebhookUrl = (url) => {
   if (url.protocol !== "https:") {
-    throw new BatchworkError("batchwork: webhookUrl must use https.");
+    throw new BatchworkError2("batchwork: webhookUrl must use https.");
   }
   if (url.username || url.password) {
-    throw new BatchworkError("batchwork: webhookUrl must not include credentials.");
+    throw new BatchworkError2("batchwork: webhookUrl must not include credentials.");
   }
   if (isPrivateHost(url.hostname.toLowerCase())) {
-    throw new BatchworkError("batchwork: webhookUrl must not target localhost or private networks.");
+    throw new BatchworkError2("batchwork: webhookUrl must not target localhost or private networks.");
   }
 };
 var validateWebhookUrl = async (rawUrl, validator) => {
@@ -255,7 +176,7 @@ var validateWebhookUrl = async (rawUrl, validator) => {
   try {
     url = new URL(rawUrl);
   } catch (error) {
-    throw new BatchworkError("batchwork: webhookUrl must be a valid URL.", {
+    throw new BatchworkError2("batchwork: webhookUrl must be a valid URL.", {
       cause: error
     });
   }
@@ -264,15 +185,13 @@ var validateWebhookUrl = async (rawUrl, validator) => {
 };
 var createWebhookSink = (validator) => async (record, snapshot) => {
   if (!record.webhookUrl) {
-    throw new BatchworkError("batchwork: tracked batch has no webhookUrl to deliver to.");
+    throw new BatchworkError2("batchwork: tracked batch has no webhookUrl to deliver to.");
   }
   const webhookUrl = await validateWebhookUrl(record.webhookUrl, validator);
   const body = JSON.stringify(toEvent(record.provider, snapshot));
-  const headers = {
-    "content-type": "application/json"
-  };
+  const headers = { "content-type": "application/json" };
   if (record.webhookSecret) {
-    Object.assign(headers, await signWebhook(record.webhookSecret, record.id, body, Date.now() / 1000));
+    Object.assign(headers, await signWebhook2(record.webhookSecret, record.id, body, Date.now() / 1000));
   }
   const response = await fetch(webhookUrl, {
     body,
@@ -281,19 +200,14 @@ var createWebhookSink = (validator) => async (record, snapshot) => {
     redirect: "manual"
   });
   if (isRedirectStatus(response.status)) {
-    throw new BatchworkError(`batchwork: webhook delivery to ${webhookUrl} redirected (${response.status}).`);
+    throw new BatchworkError2(`batchwork: webhook delivery to ${webhookUrl} redirected (${response.status}).`);
   }
   if (!response.ok) {
-    throw new BatchworkError(`batchwork: webhook delivery to ${webhookUrl} failed (${response.status}).`);
+    throw new BatchworkError2(`batchwork: webhook delivery to ${webhookUrl} failed (${response.status}).`);
   }
 };
-var createBatchPoller = (options) => {
-  const resolveCredentials = (provider) => {
-    if (typeof options.credentials === "function") {
-      return options.credentials(provider);
-    }
-    return options.credentials ?? {};
-  };
+var createBatchPoller2 = (options) => {
+  const resolveCredentials = (provider) => resolveProviderCredentials(options.credentials, provider);
   const webhookUrlValidator = options.validateWebhookUrl ?? assertSafeWebhookUrl;
   const sink = options.onComplete ?? createWebhookSink(webhookUrlValidator);
   const deliver = async (record, snapshot) => {
@@ -320,7 +234,7 @@ var createBatchPoller = (options) => {
   const process = async (record, delivered) => {
     const adapter = getAdapter(record.provider);
     const snapshot = await adapter.retrieve(record.id, resolveCredentials(record.provider));
-    if (isTerminalStatus(snapshot.status)) {
+    if (isTerminalStatus2(snapshot.status)) {
       await deliver(record, snapshot);
       delivered.push(record.id);
     } else if (snapshot.status !== record.status) {
@@ -350,15 +264,15 @@ var createBatchPoller = (options) => {
   const openaiWebhookHandler = (config) => async (request) => {
     let verified;
     try {
-      verified = await verifyWebhook(request, config.signingSecret);
+      verified = await verifyWebhook2(request, config.signingSecret);
     } catch {
       return new Response("invalid signature", { status: 400 });
     }
-    const payload = JSON.parse(verified.body);
-    if (!payload.type?.startsWith("batch.")) {
+    const payload = asRecord(parseJson(verified.body));
+    if (!asString(payload.type)?.startsWith("batch.")) {
       return new Response("ignored", { status: 202 });
     }
-    const id = payload.data?.id;
+    const id = asString(asRecord(payload.data).id);
     if (!id) {
       return new Response("missing batch id", { status: 400 });
     }
@@ -367,7 +281,7 @@ var createBatchPoller = (options) => {
       return new Response("ok", { status: 200 });
     }
     const snapshot = await getAdapter("openai").retrieve(id, resolveCredentials("openai"));
-    if (isTerminalStatus(snapshot.status)) {
+    if (isTerminalStatus2(snapshot.status)) {
       await deliver(record, snapshot);
     }
     return new Response("ok", { status: 200 });
@@ -376,7 +290,7 @@ var createBatchPoller = (options) => {
 };
 
 // src/server/store.ts
-var createMemoryStore = () => {
+var createMemoryStore2 = () => {
   const records = new Map;
   return {
     delete: (id) => {
@@ -399,7 +313,7 @@ var createMemoryStore = () => {
   };
 };
 
-export { toEvent, signWebhook, verifyWebhook, verifyBatchWebhook, createBatchPoller, createMemoryStore };
+export { toEvent, signWebhook2, verifyWebhook2, verifyBatchWebhook2, resolveProviderCredentials, createBatchPoller2, createMemoryStore2 };
 
-//# debugId=F1B4BA11C9A6AE3364756E2164756E21
-//# sourceMappingURL=chunk-ka9d4t6v.js.map
+//# debugId=A205BBC0AF616CBE64756E2164756E21
+//# sourceMappingURL=chunk-k7n7k3et.js.map

package/dist/chunk-k7n7k3et.js.map

@@ -0,0 +1,13 @@
+{
+  "version": 3,
+  "sources": ["../src/server/events.ts", "../src/server/signing.ts", "../src/server/poller.ts", "../src/server/store.ts"],
+  "sourcesContent": [
+    "import type { BatchProvider, BatchSnapshot, BatchStatus } from \"../types\";\nimport type { BatchWebhookEvent, BatchWebhookEventType } from \"./types\";\n\nconst EVENT_BY_STATUS: Partial<Record<BatchStatus, BatchWebhookEventType>> = {\n  cancelled: \"batch.cancelled\",\n  completed: \"batch.completed\",\n  expired: \"batch.expired\",\n  failed: \"batch.failed\",\n};\n\n/** Map a terminal snapshot to the unified webhook event batchwork delivers. */\nexport const toEvent = (\n  provider: BatchProvider,\n  snapshot: BatchSnapshot\n): BatchWebhookEvent => ({\n  completedAt: snapshot.completedAt?.toISOString(),\n  createdAt: snapshot.createdAt?.toISOString(),\n  id: snapshot.id,\n  provider,\n  requestCounts: snapshot.requestCounts,\n  type: EVENT_BY_STATUS[snapshot.status] ?? \"batch.completed\",\n});\n",
+    "import { Webhook, WebhookVerificationError } from \"standardwebhooks\";\n\nimport { BatchworkError } from \"../errors\";\nimport type { BatchWebhookEvent } from \"./types\";\n\n// Standard Webhooks HMAC-SHA256 signing via the reference `standardwebhooks`\n// implementation, compatible with OpenAI's webhook signatures (so the same\n// verifier handles inbound OpenAI events and batchwork's own outbound\n// deliveries). The library is pure JS, so it runs on edge runtimes.\n\nconst TOLERANCE_SECONDS = 300;\nconst SECRET_PREFIX = \"whsec_\";\nconst encoder = new TextEncoder();\n\n/**\n * A `whsec_` secret is base64-encoded key material (the library decodes it);\n * anything else is used as raw UTF-8 bytes, matching OpenAI's conventions.\n */\nconst createWebhook = (secret: string): Webhook =>\n  secret.startsWith(SECRET_PREFIX)\n    ? new Webhook(secret)\n    : new Webhook(encoder.encode(secret), { format: \"raw\" });\n\nexport interface WebhookReplayStore {\n  claim?: (\n    id: string,\n    expiresAt: number,\n    now: number\n  ) => boolean | Promise<boolean>;\n  get: (id: string) => number | Promise<number | undefined> | undefined;\n  set: (id: string, expiresAt: number) => Promise<void> | void;\n}\n\nexport interface VerifyWebhookOptions {\n  replayStore?: WebhookReplayStore;\n}\n\nconst replayCache = new Map<string, number>();\nconst replayLocks = new WeakMap<\n  WebhookReplayStore,\n  Map<string, Promise<void>>\n>();\n\nconst pruneReplayCache = (now: number): void => {\n  for (const [id, expiresAt] of replayCache) {\n    if (expiresAt <= now) {\n      replayCache.delete(id);\n    }\n  }\n};\n\nconst defaultReplayStore: WebhookReplayStore = {\n  claim: (id, expiresAt, now) => {\n    pruneReplayCache(now);\n    const existing = replayCache.get(id);\n    if (existing && existing > now) {\n      return false;\n    }\n    replayCache.set(id, expiresAt);\n    return true;\n  },\n  get: (id) => replayCache.get(id),\n  set: (id, expiresAt) => {\n    replayCache.set(id, expiresAt);\n  },\n};\n\nconst withReplayLock = async <Result>(\n  store: WebhookReplayStore,\n  id: string,\n  task: () => Promise<Result>\n): Promise<Result> => {\n  let locks = replayLocks.get(store);\n  if (!locks) {\n    locks = new Map();\n    replayLocks.set(store, locks);\n  }\n\n  const previous = locks.get(id);\n  let release!: () => void;\n  // oxlint-disable-next-line promise/avoid-new -- a per-id lock needs a deferred release signal.\n  const current = new Promise<void>((resolve) => {\n    release = resolve;\n  });\n  locks.set(id, current);\n\n  if (previous) {\n    await previous;\n  }\n  try {\n    return await task();\n  } finally {\n    release();\n    if (locks.get(id) === current) {\n      locks.delete(id);\n    }\n  }\n};\n\nconst rememberWebhookId = async (\n  id: string,\n  timestamp: number,\n  now: number,\n  store: WebhookReplayStore\n): Promise<void> => {\n  const expiresAt = timestamp + TOLERANCE_SECONDS;\n  if (store.claim) {\n    const claimed = await store.claim(id, expiresAt, now);\n    if (!claimed) {\n      throw new BatchworkError(\"batchwork: webhook replay detected.\");\n    }\n    return;\n  }\n\n  await withReplayLock(store, id, async () => {\n    if (store === defaultReplayStore) {\n      pruneReplayCache(now);\n    }\n    const existing = await store.get(id);\n    if (existing && existing > now) {\n      throw new BatchworkError(\"batchwork: webhook replay detected.\");\n    }\n    await store.set(id, expiresAt);\n  });\n};\n\n/** Build Standard Webhooks signature headers for an outbound delivery. */\nexport const signWebhook = (\n  secret: string,\n  id: string,\n  body: string,\n  timestampSeconds: number\n): Promise<Record<string, string>> => {\n  const timestamp = Math.floor(timestampSeconds);\n  // `sign` returns the already version-prefixed signature (`v1,…`).\n  const signature = createWebhook(secret).sign(\n    id,\n    new Date(timestamp * 1000),\n    body\n  );\n  return Promise.resolve({\n    \"webhook-id\": id,\n    \"webhook-signature\": signature,\n    \"webhook-timestamp\": timestamp.toString(),\n  });\n};\n\nexport interface VerifiedWebhook {\n  id: string;\n  timestamp: number;\n  body: string;\n}\n\n/**\n * Verify a Standard Webhooks-signed request and return its raw body. Throws if\n * headers are missing, the timestamp is outside tolerance, or no signature\n * matches. Consumes the request body.\n */\nexport const verifyWebhook = async (\n  request: Request,\n  secret: string,\n  options?: VerifyWebhookOptions\n): Promise<VerifiedWebhook> => {\n  const id = request.headers.get(\"webhook-id\");\n  const timestamp = request.headers.get(\"webhook-timestamp\");\n  const signatureHeader = request.headers.get(\"webhook-signature\");\n  if (!(id && timestamp && signatureHeader)) {\n    throw new BatchworkError(\"batchwork: missing webhook signature headers.\");\n  }\n\n  const seconds = Number(timestamp);\n  const now = Date.now() / 1000;\n  if (\n    !Number.isFinite(seconds) ||\n    Math.abs(now - seconds) > TOLERANCE_SECONDS\n  ) {\n    throw new BatchworkError(\"batchwork: webhook timestamp outside tolerance.\");\n  }\n\n  const body = await request.text();\n  try {\n    createWebhook(secret).verify(body, {\n      \"webhook-id\": id,\n      \"webhook-signature\": signatureHeader,\n      \"webhook-timestamp\": timestamp,\n    });\n  } catch (error) {\n    if (error instanceof WebhookVerificationError) {\n      // The library re-checks the timestamp with the same tolerance; map its\n      // failures onto the tolerance error above for a stable error surface.\n      throw new BatchworkError(\n        error.message.toLowerCase().includes(\"timestamp\")\n          ? \"batchwork: webhook timestamp outside tolerance.\"\n          : \"batchwork: webhook signature verification failed.\",\n        { cause: error }\n      );\n    }\n    // Any other error means the signature verified but the library's trailing\n    // `JSON.parse` of the payload failed. `verifyWebhook` returns the raw body\n    // and does not require JSON, so a non-JSON body is not an error here.\n  }\n\n  await rememberWebhookId(\n    id,\n    seconds,\n    now,\n    options?.replayStore ?? defaultReplayStore\n  );\n\n  return { body, id, timestamp: seconds };\n};\n\n/**\n * Verify and parse a batchwork webhook on your receiving endpoint. Returns the\n * unified {@link BatchWebhookEvent}.\n */\nexport const verifyBatchWebhook = async (\n  request: Request,\n  secret: string,\n  options?: VerifyWebhookOptions\n): Promise<BatchWebhookEvent> => {\n  const { body } = await verifyWebhook(request, secret, options);\n  // SAFETY: the signature just verified against the shared secret proves the\n  // body was produced by batchwork's own delivery, which serializes `toEvent`.\n  return JSON.parse(body) as BatchWebhookEvent;\n};\n",
+    "import ipaddr from \"ipaddr.js\";\n\nimport { BatchworkError } from \"../errors\";\nimport { isTerminalStatus } from \"../job\";\nimport { getAdapter } from \"../providers\";\nimport type {\n  BatchProvider,\n  BatchSnapshot,\n  BatchStatus,\n  HttpHeaders,\n  ProviderCredentials,\n} from \"../types\";\nimport { asRecord, asString, parseJson } from \"../util\";\nimport { toEvent } from \"./events\";\nimport { signWebhook, verifyWebhook } from \"./signing\";\nimport type { BatchStore, TrackedBatch } from \"./types\";\n\n/** Credentials for polling: a fixed config, or one resolved per provider. */\nexport type CredentialResolver =\n  | ProviderCredentials\n  | ((provider: BatchProvider) => ProviderCredentials);\n\nconst isCredentialFunction = (\n  credentials: CredentialResolver\n): credentials is (provider: BatchProvider) => ProviderCredentials =>\n  typeof credentials === \"function\";\n\n/** Resolve the credentials to poll a provider with; env vars when omitted. */\nexport const resolveProviderCredentials = (\n  credentials: CredentialResolver | undefined,\n  provider: BatchProvider\n): ProviderCredentials => {\n  if (credentials === undefined) {\n    return {};\n  }\n  return isCredentialFunction(credentials)\n    ? credentials(provider)\n    : credentials;\n};\n\n/**\n * Handles a batch reaching a terminal status. Replaces the default signed\n * webhook delivery — e.g. to invoke a callback instead (see `batchwork/next`).\n */\nexport type CompletionSink = (\n  record: TrackedBatch,\n  snapshot: BatchSnapshot\n) => Promise<void>;\n\nexport type WebhookUrlValidator = (url: URL) => void | Promise<void>;\n\nexport interface BatchPollerOptions {\n  store: BatchStore;\n  /** Falls back to provider env vars (e.g. `OPENAI_API_KEY`) when omitted. */\n  credentials?: CredentialResolver;\n  /** Replaces signed-webhook delivery when a batch finishes. */\n  onComplete?: CompletionSink;\n  /** Override the default webhook URL policy with an application allowlist. */\n  validateWebhookUrl?: WebhookUrlValidator;\n  /**\n   * Called with the thrown value when processing a single batch fails during\n   * `tick`. When provided, the tick reports the error and continues to the\n   * next batch; when omitted, the error propagates out of `tick`.\n   */\n  onError?: (record: TrackedBatch, cause: unknown) => void;\n}\n\nexport interface TrackTarget {\n  id: string;\n  provider: BatchProvider;\n  status?: BatchStatus;\n}\n\nexport interface TrackOptions {\n  /** Where to POST the completion webhook. Omit for callback-based delivery. */\n  webhookUrl?: string;\n  /** Signs the outbound webhook (Standard Webhooks HMAC) when provided. */\n  secret?: string;\n}\n\nexport interface TickResult {\n  checked: number;\n  delivered: string[];\n  /** Batches whose processing threw this tick (only when `onError` is set). */\n  failed?: { id: string; error: string }[];\n}\n\nexport interface OpenAIWebhookOptions {\n  /** The OpenAI webhook signing secret (`whsec_…`). */\n  signingSecret: string;\n}\n\nexport interface BatchPoller {\n  track: (target: TrackTarget, options: TrackOptions) => Promise<TrackedBatch>;\n  tick: () => Promise<TickResult>;\n  deliver: (record: TrackedBatch, snapshot: BatchSnapshot) => Promise<void>;\n  openaiWebhookHandler: (\n    options: OpenAIWebhookOptions\n  ) => (request: Request) => Promise<Response>;\n}\n\n/** Whether a hostname points at localhost or a private network. */\nconst isPrivateHost = (host: string): boolean => {\n  if (\n    host === \"localhost\" ||\n    host.endsWith(\".localhost\") ||\n    host.endsWith(\".local\")\n  ) {\n    return true;\n  }\n  // A URL hostname wraps IPv6 literals in brackets; ipaddr.js expects them bare.\n  const literal = host.replace(/^\\[/u, \"\").replace(/\\]$/u, \"\");\n  if (!ipaddr.isValid(literal)) {\n    // A DNS name; only literal addresses are classified here.\n    return false;\n  }\n  // `process` unwraps IPv4-mapped IPv6 (`::ffff:127.0.0.1`) to IPv4 first.\n  // Anything but plain public unicast (loopback, private, link-local, CGNAT,\n  // multicast, reserved, teredo/6to4 with embedded addresses, …) is refused.\n  return ipaddr.process(literal).range() !== \"unicast\";\n};\n\nconst isRedirectStatus = (status: number): boolean =>\n  status >= 300 && status < 400;\n\nconst assertSafeWebhookUrl: WebhookUrlValidator = (url) => {\n  if (url.protocol !== \"https:\") {\n    throw new BatchworkError(\"batchwork: webhookUrl must use https.\");\n  }\n  if (url.username || url.password) {\n    throw new BatchworkError(\n      \"batchwork: webhookUrl must not include credentials.\"\n    );\n  }\n\n  if (isPrivateHost(url.hostname.toLowerCase())) {\n    throw new BatchworkError(\n      \"batchwork: webhookUrl must not target localhost or private networks.\"\n    );\n  }\n};\n\nconst validateWebhookUrl = async (\n  rawUrl: string,\n  validator: WebhookUrlValidator\n): Promise<string> => {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch (error) {\n    throw new BatchworkError(\"batchwork: webhookUrl must be a valid URL.\", {\n      cause: error,\n    });\n  }\n  await validator(url);\n  return url.toString();\n};\n\n/** The default completion sink: POST a signed webhook to the tracked URL. */\nconst createWebhookSink =\n  (validator: WebhookUrlValidator): CompletionSink =>\n  async (record, snapshot) => {\n    if (!record.webhookUrl) {\n      throw new BatchworkError(\n        \"batchwork: tracked batch has no webhookUrl to deliver to.\"\n      );\n    }\n    const webhookUrl = await validateWebhookUrl(record.webhookUrl, validator);\n    const body = JSON.stringify(toEvent(record.provider, snapshot));\n    const headers: HttpHeaders = { \"content-type\": \"application/json\" };\n    if (record.webhookSecret) {\n      Object.assign(\n        headers,\n        await signWebhook(\n          record.webhookSecret,\n          record.id,\n          body,\n          Date.now() / 1000\n        )\n      );\n    }\n    const response = await fetch(webhookUrl, {\n      body,\n      headers,\n      method: \"POST\",\n      redirect: \"manual\",\n    });\n    if (isRedirectStatus(response.status)) {\n      throw new BatchworkError(\n        `batchwork: webhook delivery to ${webhookUrl} redirected (${response.status}).`\n      );\n    }\n    if (!response.ok) {\n      throw new BatchworkError(\n        `batchwork: webhook delivery to ${webhookUrl} failed (${response.status}).`\n      );\n    }\n  };\n\n/**\n * Create a managed poller: register submitted batches with `track`, then run\n * `tick` on a schedule (cron) to poll open batches and deliver one unified,\n * signed webhook per batch when it finishes. For OpenAI, mount\n * `openaiWebhookHandler` to skip polling and react to native webhooks instead.\n */\nexport const createBatchPoller = (options: BatchPollerOptions): BatchPoller => {\n  const resolveCredentials = (provider: BatchProvider): ProviderCredentials =>\n    resolveProviderCredentials(options.credentials, provider);\n\n  const webhookUrlValidator =\n    options.validateWebhookUrl ?? assertSafeWebhookUrl;\n  const sink = options.onComplete ?? createWebhookSink(webhookUrlValidator);\n\n  const deliver = async (\n    record: TrackedBatch,\n    snapshot: BatchSnapshot\n  ): Promise<void> => {\n    // Run the side effect before marking delivered: if it throws, the record\n    // stays pending and is retried on the next tick (at-least-once delivery).\n    await sink(record, snapshot);\n    await options.store.set({\n      ...record,\n      deliveredAt: new Date().toISOString(),\n      status: snapshot.status,\n    });\n  };\n\n  const track = async (\n    target: TrackTarget,\n    opts: TrackOptions\n  ): Promise<TrackedBatch> => {\n    const webhookUrl =\n      opts.webhookUrl && !options.onComplete\n        ? await validateWebhookUrl(opts.webhookUrl, webhookUrlValidator)\n        : opts.webhookUrl;\n    const record: TrackedBatch = {\n      createdAt: new Date().toISOString(),\n      id: target.id,\n      provider: target.provider,\n      status: target.status ?? \"in_progress\",\n      webhookSecret: opts.secret,\n      webhookUrl,\n    };\n    await options.store.set(record);\n    return record;\n  };\n\n  const process = async (\n    record: TrackedBatch,\n    delivered: string[]\n  ): Promise<void> => {\n    const adapter = getAdapter(record.provider);\n    const snapshot = await adapter.retrieve(\n      record.id,\n      resolveCredentials(record.provider)\n    );\n    if (isTerminalStatus(snapshot.status)) {\n      await deliver(record, snapshot);\n      delivered.push(record.id);\n    } else if (snapshot.status !== record.status) {\n      await options.store.set({ ...record, status: snapshot.status });\n    }\n  };\n\n  const tick = async (): Promise<TickResult> => {\n    const pending = await options.store.list({ delivered: false });\n    const delivered: string[] = [];\n    const failed: { id: string; error: string }[] = [];\n    for (const record of pending) {\n      // oxlint-disable-next-line no-await-in-loop -- batches are polled serially\n      // to avoid hammering provider rate limits; deliver before the next.\n      try {\n        // oxlint-disable-next-line no-await-in-loop, react-doctor/async-await-in-loop -- see above.\n        await process(record, delivered);\n      } catch (error) {\n        // Without an `onError` handler, preserve the propagate-the-throw\n        // behavior; with one, report and continue so a single failing batch\n        // can't starve the rest of the queue. Either way the record stays\n        // pending (it was never marked delivered) and retries next tick.\n        if (!options.onError) {\n          throw error;\n        }\n        options.onError(record, error);\n        failed.push({\n          error: error instanceof Error ? error.message : String(error),\n          id: record.id,\n        });\n      }\n    }\n    return failed.length > 0\n      ? { checked: pending.length, delivered, failed }\n      : { checked: pending.length, delivered };\n  };\n\n  const openaiWebhookHandler =\n    (config: OpenAIWebhookOptions) =>\n    async (request: Request): Promise<Response> => {\n      let verified: { body: string };\n      try {\n        verified = await verifyWebhook(request, config.signingSecret);\n      } catch {\n        return new Response(\"invalid signature\", { status: 400 });\n      }\n\n      const payload = asRecord(parseJson(verified.body));\n      if (!asString(payload.type)?.startsWith(\"batch.\")) {\n        return new Response(\"ignored\", { status: 202 });\n      }\n      const id = asString(asRecord(payload.data).id);\n      if (!id) {\n        return new Response(\"missing batch id\", { status: 400 });\n      }\n      const record = await options.store.get(id);\n      if (!record || record.deliveredAt) {\n        return new Response(\"ok\", { status: 200 });\n      }\n      const snapshot = await getAdapter(\"openai\").retrieve(\n        id,\n        resolveCredentials(\"openai\")\n      );\n      if (isTerminalStatus(snapshot.status)) {\n        await deliver(record, snapshot);\n      }\n      return new Response(\"ok\", { status: 200 });\n    };\n\n  return { deliver, openaiWebhookHandler, tick, track };\n};\n",
+    "import type { BatchStore, TrackedBatch } from \"./types\";\n\n/** An in-memory `BatchStore`. Suitable for development and single-process use. */\nexport const createMemoryStore = (): BatchStore => {\n  const records = new Map<string, TrackedBatch>();\n\n  return {\n    delete: (id) => {\n      records.delete(id);\n      return Promise.resolve();\n    },\n    get: (id) => Promise.resolve(records.get(id) ?? null),\n    list: (filter) => {\n      const all = [...records.values()];\n      if (filter?.delivered === undefined) {\n        return Promise.resolve(all);\n      }\n      const { delivered } = filter;\n      return Promise.resolve(\n        all.filter((record) => (record.deliveredAt !== undefined) === delivered)\n      );\n    },\n    set: (record) => {\n      records.set(record.id, record);\n      return Promise.resolve();\n    },\n  };\n};\n"
+  ],
+  "mappings": ";;;;;;;;;;;;AAGA,IAAM,kBAAuE;AAAA,EAC3E,WAAW;AAAA,EACX,WAAW;AAAA,EACX,SAAS;AAAA,EACT,QAAQ;AACV;AAGO,IAAM,UAAU,CACrB,UACA,cACuB;AAAA,EACvB,aAAa,SAAS,aAAa,YAAY;AAAA,EAC/C,WAAW,SAAS,WAAW,YAAY;AAAA,EAC3C,IAAI,SAAS;AAAA,EACb;AAAA,EACA,eAAe,SAAS;AAAA,EACxB,MAAM,gBAAgB,SAAS,WAAW;AAC5C;;;ACrBA;AAUA,IAAM,oBAAoB;AAC1B,IAAM,gBAAgB;AACtB,IAAM,UAAU,IAAI;AAMpB,IAAM,gBAAgB,CAAC,WACrB,OAAO,WAAW,aAAa,IAC3B,IAAI,QAAQ,MAAM,IAClB,IAAI,QAAQ,QAAQ,OAAO,MAAM,GAAG,EAAE,QAAQ,MAAM,CAAC;AAgB3D,IAAM,cAAc,IAAI;AACxB,IAAM,cAAc,IAAI;AAKxB,IAAM,mBAAmB,CAAC,QAAsB;AAAA,EAC9C,YAAY,IAAI,cAAc,aAAa;AAAA,IACzC,IAAI,aAAa,KAAK;AAAA,MACpB,YAAY,OAAO,EAAE;AAAA,IACvB;AAAA,EACF;AAAA;AAGF,IAAM,qBAAyC;AAAA,EAC7C,OAAO,CAAC,IAAI,WAAW,QAAQ;AAAA,IAC7B,iBAAiB,GAAG;AAAA,IACpB,MAAM,WAAW,YAAY,IAAI,EAAE;AAAA,IACnC,IAAI,YAAY,WAAW,KAAK;AAAA,MAC9B,OAAO;AAAA,IACT;AAAA,IACA,YAAY,IAAI,IAAI,SAAS;AAAA,IAC7B,OAAO;AAAA;AAAA,EAET,KAAK,CAAC,OAAO,YAAY,IAAI,EAAE;AAAA,EAC/B,KAAK,CAAC,IAAI,cAAc;AAAA,IACtB,YAAY,IAAI,IAAI,SAAS;AAAA;AAEjC;AAEA,IAAM,iBAAiB,OACrB,OACA,IACA,SACoB;AAAA,EACpB,IAAI,QAAQ,YAAY,IAAI,KAAK;AAAA,EACjC,IAAI,CAAC,OAAO;AAAA,IACV,QAAQ,IAAI;AAAA,IACZ,YAAY,IAAI,OAAO,KAAK;AAAA,EAC9B;AAAA,EAEA,MAAM,WAAW,MAAM,IAAI,EAAE;AAAA,EAC7B,IAAI;AAAA,EAEJ,MAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAAA,IAC7C,UAAU;AAAA,GACX;AAAA,EACD,MAAM,IAAI,IAAI,OAAO;AAAA,EAErB,IAAI,UAAU;AAAA,IACZ,MAAM;AAAA,EACR;AAAA,EACA,IAAI;AAAA,IACF,OAAO,MAAM,KAAK;AAAA,YAClB;AAAA,IACA,QAAQ;AAAA,IACR,IAAI,MAAM,IAAI,EAAE,MAAM,SAAS;AAAA,MAC7B,MAAM,OAAO,EAAE;AAAA,IACjB;AAAA;AAAA;AAIJ,IAAM,oBAAoB,OACxB,IACA,WACA,KACA,UACkB;AAAA,EAClB,MAAM,YAAY,YAAY;AAAA,EAC9B,IAAI,MAAM,OAAO;AAAA,IACf,MAAM,UAAU,MAAM,MAAM,MAAM,IAAI,WAAW,GAAG;AAAA,IACpD,IAAI,CAAC,SAAS;AAAA,MACZ,MAAM,IAAI,gBAAe,qCAAqC;AAAA,IAChE;AAAA,IACA;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,OAAO,IAAI,YAAY;AAAA,IAC1C,IAAI,UAAU,oBAAoB;AAAA,MAChC,iBAAiB,GAAG;AAAA,IACtB;AAAA,IACA,MAAM,WAAW,MAAM,MAAM,IAAI,EAAE;AAAA,IACnC,IAAI,YAAY,WAAW,KAAK;AAAA,MAC9B,MAAM,IAAI,gBAAe,qCAAqC;AAAA,IAChE;AAAA,IACA,MAAM,MAAM,IAAI,IAAI,SAAS;AAAA,GAC9B;AAAA;AAII,IAAM,eAAc,CACzB,QACA,IACA,MACA,qBACoC;AAAA,EACpC,MAAM,YAAY,KAAK,MAAM,gBAAgB;AAAA,EAE7C,MAAM,YAAY,cAAc,MAAM,EAAE,KACtC,IACA,IAAI,KAAK,YAAY,IAAI,GACzB,IACF;AAAA,EACA,OAAO,QAAQ,QAAQ;AAAA,IACrB,cAAc;AAAA,IACd,qBAAqB;AAAA,IACrB,qBAAqB,UAAU,SAAS;AAAA,EAC1C,CAAC;AAAA;AAcI,IAAM,iBAAgB,OAC3B,SACA,QACA,YAC6B;AAAA,EAC7B,MAAM,KAAK,QAAQ,QAAQ,IAAI,YAAY;AAAA,EAC3C,MAAM,YAAY,QAAQ,QAAQ,IAAI,mBAAmB;AAAA,EACzD,MAAM,kBAAkB,QAAQ,QAAQ,IAAI,mBAAmB;AAAA,EAC/D,IAAI,EAAE,MAAM,aAAa,kBAAkB;AAAA,IACzC,MAAM,IAAI,gBAAe,+CAA+C;AAAA,EAC1E;AAAA,EAEA,MAAM,UAAU,OAAO,SAAS;AAAA,EAChC,MAAM,MAAM,KAAK,IAAI,IAAI;AAAA,EACzB,IACE,CAAC,OAAO,SAAS,OAAO,KACxB,KAAK,IAAI,MAAM,OAAO,IAAI,mBAC1B;AAAA,IACA,MAAM,IAAI,gBAAe,iDAAiD;AAAA,EAC5E;AAAA,EAEA,MAAM,OAAO,MAAM,QAAQ,KAAK;AAAA,EAChC,IAAI;AAAA,IACF,cAAc,MAAM,EAAE,OAAO,MAAM;AAAA,MACjC,cAAc;AAAA,MACd,qBAAqB;AAAA,MACrB,qBAAqB;AAAA,IACvB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB,0BAA0B;AAAA,MAG7C,MAAM,IAAI,gBACR,MAAM,QAAQ,YAAY,EAAE,SAAS,WAAW,IAC5C,oDACA,qDACJ,EAAE,OAAO,MAAM,CACjB;AAAA,IACF;AAAA;AAAA,EAMF,MAAM,kBACJ,IACA,SACA,KACA,SAAS,eAAe,kBAC1B;AAAA,EAEA,OAAO,EAAE,MAAM,IAAI,WAAW,QAAQ;AAAA;AAOjC,IAAM,sBAAqB,OAChC,SACA,QACA,YAC+B;AAAA,EAC/B,QAAQ,SAAS,MAAM,eAAc,SAAS,QAAQ,OAAO;AAAA,EAG7D,OAAO,KAAK,MAAM,IAAI;AAAA;;;AChOxB;AAsBA,IAAM,uBAAuB,CAC3B,gBAEA,OAAO,gBAAgB;AAGlB,IAAM,6BAA6B,CACxC,aACA,aACwB;AAAA,EACxB,IAAI,gBAAgB,WAAW;AAAA,IAC7B,OAAO,CAAC;AAAA,EACV;AAAA,EACA,OAAO,qBAAqB,WAAW,IACnC,YAAY,QAAQ,IACpB;AAAA;AAiEN,IAAM,gBAAgB,CAAC,SAA0B;AAAA,EAC/C,IACE,SAAS,eACT,KAAK,SAAS,YAAY,KAC1B,KAAK,SAAS,QAAQ,GACtB;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAAA,EAC3D,IAAI,CAAC,OAAO,QAAQ,OAAO,GAAG;AAAA,IAE5B,OAAO;AAAA,EACT;AAAA,EAIA,OAAO,OAAO,QAAQ,OAAO,EAAE,MAAM,MAAM;AAAA;AAG7C,IAAM,mBAAmB,CAAC,WACxB,UAAU,OAAO,SAAS;AAE5B,IAAM,uBAA4C,CAAC,QAAQ;AAAA,EACzD,IAAI,IAAI,aAAa,UAAU;AAAA,IAC7B,MAAM,IAAI,gBAAe,uCAAuC;AAAA,EAClE;AAAA,EACA,IAAI,IAAI,YAAY,IAAI,UAAU;AAAA,IAChC,MAAM,IAAI,gBACR,qDACF;AAAA,EACF;AAAA,EAEA,IAAI,cAAc,IAAI,SAAS,YAAY,CAAC,GAAG;AAAA,IAC7C,MAAM,IAAI,gBACR,sEACF;AAAA,EACF;AAAA;AAGF,IAAM,qBAAqB,OACzB,QACA,cACoB;AAAA,EACpB,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,MAAM;AAAA,IACpB,OAAO,OAAO;AAAA,IACd,MAAM,IAAI,gBAAe,8CAA8C;AAAA,MACrE,OAAO;AAAA,IACT,CAAC;AAAA;AAAA,EAEH,MAAM,UAAU,GAAG;AAAA,EACnB,OAAO,IAAI,SAAS;AAAA;AAItB,IAAM,oBACJ,CAAC,cACD,OAAO,QAAQ,aAAa;AAAA,EAC1B,IAAI,CAAC,OAAO,YAAY;AAAA,IACtB,MAAM,IAAI,gBACR,2DACF;AAAA,EACF;AAAA,EACA,MAAM,aAAa,MAAM,mBAAmB,OAAO,YAAY,SAAS;AAAA,EACxE,MAAM,OAAO,KAAK,UAAU,QAAQ,OAAO,UAAU,QAAQ,CAAC;AAAA,EAC9D,MAAM,UAAuB,EAAE,gBAAgB,mBAAmB;AAAA,EAClE,IAAI,OAAO,eAAe;AAAA,IACxB,OAAO,OACL,SACA,MAAM,aACJ,OAAO,eACP,OAAO,IACP,MACA,KAAK,IAAI,IAAI,IACf,CACF;AAAA,EACF;AAAA,EACA,MAAM,WAAW,MAAM,MAAM,YAAY;AAAA,IACvC;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AAAA,EACD,IAAI,iBAAiB,SAAS,MAAM,GAAG;AAAA,IACrC,MAAM,IAAI,gBACR,kCAAkC,0BAA0B,SAAS,UACvE;AAAA,EACF;AAAA,EACA,IAAI,CAAC,SAAS,IAAI;AAAA,IAChB,MAAM,IAAI,gBACR,kCAAkC,sBAAsB,SAAS,UACnE;AAAA,EACF;AAAA;AASG,IAAM,qBAAoB,CAAC,YAA6C;AAAA,EAC7E,MAAM,qBAAqB,CAAC,aAC1B,2BAA2B,QAAQ,aAAa,QAAQ;AAAA,EAE1D,MAAM,sBACJ,QAAQ,sBAAsB;AAAA,EAChC,MAAM,OAAO,QAAQ,cAAc,kBAAkB,mBAAmB;AAAA,EAExE,MAAM,UAAU,OACd,QACA,aACkB;AAAA,IAGlB,MAAM,KAAK,QAAQ,QAAQ;AAAA,IAC3B,MAAM,QAAQ,MAAM,IAAI;AAAA,SACnB;AAAA,MACH,aAAa,IAAI,KAAK,EAAE,YAAY;AAAA,MACpC,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA;AAAA,EAGH,MAAM,QAAQ,OACZ,QACA,SAC0B;AAAA,IAC1B,MAAM,aACJ,KAAK,cAAc,CAAC,QAAQ,aACxB,MAAM,mBAAmB,KAAK,YAAY,mBAAmB,IAC7D,KAAK;AAAA,IACX,MAAM,SAAuB;AAAA,MAC3B,WAAW,IAAI,KAAK,EAAE,YAAY;AAAA,MAClC,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO,UAAU;AAAA,MACzB,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,MAAM,IAAI,MAAM;AAAA,IAC9B,OAAO;AAAA;AAAA,EAGT,MAAM,UAAU,OACd,QACA,cACkB;AAAA,IAClB,MAAM,UAAU,WAAW,OAAO,QAAQ;AAAA,IAC1C,MAAM,WAAW,MAAM,QAAQ,SAC7B,OAAO,IACP,mBAAmB,OAAO,QAAQ,CACpC;AAAA,IACA,IAAI,kBAAiB,SAAS,MAAM,GAAG;AAAA,MACrC,MAAM,QAAQ,QAAQ,QAAQ;AAAA,MAC9B,UAAU,KAAK,OAAO,EAAE;AAAA,IAC1B,EAAO,SAAI,SAAS,WAAW,OAAO,QAAQ;AAAA,MAC5C,MAAM,QAAQ,MAAM,IAAI,KAAK,QAAQ,QAAQ,SAAS,OAAO,CAAC;AAAA,IAChE;AAAA;AAAA,EAGF,MAAM,OAAO,YAAiC;AAAA,IAC5C,MAAM,UAAU,MAAM,QAAQ,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC;AAAA,IAC7D,MAAM,YAAsB,CAAC;AAAA,IAC7B,MAAM,SAA0C,CAAC;AAAA,IACjD,WAAW,UAAU,SAAS;AAAA,MAG5B,IAAI;AAAA,QAEF,MAAM,QAAQ,QAAQ,SAAS;AAAA,QAC/B,OAAO,OAAO;AAAA,QAKd,IAAI,CAAC,QAAQ,SAAS;AAAA,UACpB,MAAM;AAAA,QACR;AAAA,QACA,QAAQ,QAAQ,QAAQ,KAAK;AAAA,QAC7B,OAAO,KAAK;AAAA,UACV,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,UAC5D,IAAI,OAAO;AAAA,QACb,CAAC;AAAA;AAAA,IAEL;AAAA,IACA,OAAO,OAAO,SAAS,IACnB,EAAE,SAAS,QAAQ,QAAQ,WAAW,OAAO,IAC7C,EAAE,SAAS,QAAQ,QAAQ,UAAU;AAAA;AAAA,EAG3C,MAAM,uBACJ,CAAC,WACD,OAAO,YAAwC;AAAA,IAC7C,IAAI;AAAA,IACJ,IAAI;AAAA,MACF,WAAW,MAAM,eAAc,SAAS,OAAO,aAAa;AAAA,MAC5D,MAAM;AAAA,MACN,OAAO,IAAI,SAAS,qBAAqB,EAAE,QAAQ,IAAI,CAAC;AAAA;AAAA,IAG1D,MAAM,UAAU,SAAS,UAAU,SAAS,IAAI,CAAC;AAAA,IACjD,IAAI,CAAC,SAAS,QAAQ,IAAI,GAAG,WAAW,QAAQ,GAAG;AAAA,MACjD,OAAO,IAAI,SAAS,WAAW,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChD;AAAA,IACA,MAAM,KAAK,SAAS,SAAS,QAAQ,IAAI,EAAE,EAAE;AAAA,IAC7C,IAAI,CAAC,IAAI;AAAA,MACP,OAAO,IAAI,SAAS,oBAAoB,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzD;AAAA,IACA,MAAM,SAAS,MAAM,QAAQ,MAAM,IAAI,EAAE;AAAA,IACzC,IAAI,CAAC,UAAU,OAAO,aAAa;AAAA,MACjC,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C;AAAA,IACA,MAAM,WAAW,MAAM,WAAW,QAAQ,EAAE,SAC1C,IACA,mBAAmB,QAAQ,CAC7B;AAAA,IACA,IAAI,kBAAiB,SAAS,MAAM,GAAG;AAAA,MACrC,MAAM,QAAQ,QAAQ,QAAQ;AAAA,IAChC;AAAA,IACA,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA;AAAA,EAG7C,OAAO,EAAE,SAAS,sBAAsB,MAAM,MAAM;AAAA;;;ACnU/C,IAAM,qBAAoB,MAAkB;AAAA,EACjD,MAAM,UAAU,IAAI;AAAA,EAEpB,OAAO;AAAA,IACL,QAAQ,CAAC,OAAO;AAAA,MACd,QAAQ,OAAO,EAAE;AAAA,MACjB,OAAO,QAAQ,QAAQ;AAAA;AAAA,IAEzB,KAAK,CAAC,OAAO,QAAQ,QAAQ,QAAQ,IAAI,EAAE,KAAK,IAAI;AAAA,IACpD,MAAM,CAAC,WAAW;AAAA,MAChB,MAAM,MAAM,CAAC,GAAG,QAAQ,OAAO,CAAC;AAAA,MAChC,IAAI,QAAQ,cAAc,WAAW;AAAA,QACnC,OAAO,QAAQ,QAAQ,GAAG;AAAA,MAC5B;AAAA,MACA,QAAQ,cAAc;AAAA,MACtB,OAAO,QAAQ,QACb,IAAI,OAAO,CAAC,WAAY,OAAO,gBAAgB,cAAe,SAAS,CACzE;AAAA;AAAA,IAEF,KAAK,CAAC,WAAW;AAAA,MACf,QAAQ,IAAI,OAAO,IAAI,MAAM;AAAA,MAC7B,OAAO,QAAQ,QAAQ;AAAA;AAAA,EAE3B;AAAA;",
+  "debugId": "A205BBC0AF616CBE64756E2164756E21",
+  "names": []
+}