daemora 1.0.0-alpha.0

package/dist/webhooks/WebhookHandler.js

@@ -0,0 +1,264 @@
+/**
+ * WebhookHandler — HTTP ingress for external events, with per-watcher
+ * bearer tokens + optional HMAC signature verification.
+ *
+ * Routes (all under `mountPath`, default `/hooks`):
+ *   POST /agent              enqueue a full agent turn     [auth: user session]
+ *   POST /wake               lightweight agent trigger      [auth: user session]
+ *   POST /watch/:id          fire one watcher by id/name    [auth: bearer OR HMAC]
+ *   POST /github/:id         GitHub-shaped HMAC ingress    [auth: X-Hub-Signature-256]
+ *   POST /stripe/:id         Stripe-shaped HMAC ingress     [auth: Stripe-Signature]
+ *   POST /event              fan-out to all matching        [auth: user session]
+ *
+ * /agent, /wake, /event are user-facing — authenticated by the normal
+ * session JWT (requireAuth middleware upstream). Per-watcher endpoints
+ * use the watcher's own tokens so external providers don't need the
+ * user's session.
+ *
+ * Per-watcher auth: caller can present EITHER a valid bearer OR a valid
+ * HMAC signature. Mismatch on both → 401. Missing both → 401.
+ *
+ * Rate limit: per watcher id (60/min). Prevents a compromised bearer
+ * from burning through API quota before the user can rotate.
+ */
+import { verifyGeneric, verifyGithub, verifyStripe } from "./hmac.js";
+import { createLogger } from "../util/logger.js";
+const log = createLogger("webhooks");
+const PER_WATCHER_RATE_LIMIT = 60;
+const RATE_WINDOW_MS = 60_000;
+export function mountWebhookRoutes(app, deps, mountPath = "/hooks") {
+    const perWatcherBuckets = new Map();
+    const touchRateLimit = (watcherId) => {
+        const now = Date.now();
+        let b = perWatcherBuckets.get(watcherId);
+        if (!b || now > b.resetAt) {
+            b = { count: 0, resetAt: now + RATE_WINDOW_MS };
+            perWatcherBuckets.set(watcherId, b);
+        }
+        b.count++;
+        return b.count <= PER_WATCHER_RATE_LIMIT;
+    };
+    // User-facing endpoints rely on upstream `requireAuth` middleware —
+    // they sit under /hooks but the auth gate runs before us.
+    app.post(`${mountPath}/agent`, (req, res) => {
+        if (!req.auth)
+            return res.status(401).json({ error: "Unauthorized" });
+        const body = req.body;
+        const message = body?.message;
+        if (!message || typeof message !== "string")
+            return res.status(400).json({ error: "`message` required" });
+        const handle = deps.runner.run({
+            input: message,
+            channel: "webhook",
+            ...(body?.sessionId ? { sessionId: body.sessionId } : { sessionId: "main" }),
+            ...(body?.model ? { model: body.model } : {}),
+        });
+        res.status(202).json({ taskId: handle.taskId, sessionId: handle.sessionId, status: "queued" });
+    });
+    app.post(`${mountPath}/wake`, (req, res) => {
+        if (!req.auth)
+            return res.status(401).json({ error: "Unauthorized" });
+        const body = req.body;
+        const text = body?.text;
+        if (!text || typeof text !== "string")
+            return res.status(400).json({ error: "`text` required" });
+        const handle = deps.runner.run({
+            input: `[Webhook wake] ${text}`,
+            channel: "webhook",
+            sessionId: "main",
+        });
+        res.status(202).json({ taskId: handle.taskId, status: "queued" });
+    });
+    app.post(`${mountPath}/event`, (req, res) => {
+        if (!req.auth)
+            return res.status(401).json({ error: "Unauthorized" });
+        const payload = (req.body ?? {});
+        const all = deps.watchers.list().filter((w) => w.enabled && w.triggerType === "webhook");
+        let matched = 0;
+        let triggered = 0;
+        const taskIds = [];
+        for (const watcher of all) {
+            const pattern = parsePattern(watcher.pattern);
+            if (!matchesPattern(payload, pattern))
+                continue;
+            matched++;
+            if (cooldownLeft(watcher) > 0)
+                continue;
+            const taskId = fireWatcher(deps, watcher, payload);
+            deps.watchers.markTriggered(watcher.id);
+            taskIds.push(taskId);
+            triggered++;
+        }
+        res.json({ matched, triggered, taskIds });
+    });
+    // ── Per-watcher endpoints (external providers) ──────────────────────────
+    app.post(`${mountPath}/watch/:id`, (req, res) => {
+        const watcher = resolveWatcher(deps.watchers, req.params.id ?? "");
+        if (!watcher)
+            return res.status(404).json({ error: "Watcher not found" });
+        if (!watcher.enabled)
+            return res.status(403).json({ error: "Watcher disabled" });
+        if (!touchRateLimit(watcher.id))
+            return res.status(429).json({ error: "Rate limited" });
+        const authed = authenticateWatcher({
+            req,
+            watcher,
+            deps,
+            provider: "generic",
+        });
+        if (!authed.ok) {
+            deps.authStore.audit({ userId: "webhook", event: "login.fail", ip: req.socket.remoteAddress ?? null, detail: `watcher=${watcher.id} reason=${authed.reason}` });
+            return res.status(401).json({ error: "Unauthorized", reason: authed.reason });
+        }
+        if (cooldownLeft(watcher) > 0)
+            return res.status(429).json({ error: "Cooldown", retryAfter: cooldownLeft(watcher) });
+        const taskId = fireWatcher(deps, watcher, req.body);
+        deps.watchers.markTriggered(watcher.id);
+        res.status(202).json({ triggered: true, taskId, watcher: watcher.name });
+    });
+    app.post(`${mountPath}/github/:id`, (req, res) => {
+        const watcher = resolveWatcher(deps.watchers, req.params.id ?? "");
+        if (!watcher || !watcher.enabled)
+            return res.status(404).json({ error: "Not found" });
+        if (!touchRateLimit(watcher.id))
+            return res.status(429).json({ error: "Rate limited" });
+        const authed = authenticateWatcher({ req, watcher, deps, provider: "github" });
+        if (!authed.ok) {
+            deps.authStore.audit({ userId: "webhook", event: "login.fail", ip: req.socket.remoteAddress ?? null, detail: `github watcher=${watcher.id} reason=${authed.reason}` });
+            return res.status(401).json({ error: "Unauthorized", reason: authed.reason });
+        }
+        if (cooldownLeft(watcher) > 0)
+            return res.status(429).json({ error: "Cooldown" });
+        const taskId = fireWatcher(deps, watcher, req.body);
+        deps.watchers.markTriggered(watcher.id);
+        res.status(202).json({ triggered: true, taskId });
+    });
+    app.post(`${mountPath}/stripe/:id`, (req, res) => {
+        const watcher = resolveWatcher(deps.watchers, req.params.id ?? "");
+        if (!watcher || !watcher.enabled)
+            return res.status(404).json({ error: "Not found" });
+        if (!touchRateLimit(watcher.id))
+            return res.status(429).json({ error: "Rate limited" });
+        const authed = authenticateWatcher({ req, watcher, deps, provider: "stripe" });
+        if (!authed.ok) {
+            deps.authStore.audit({ userId: "webhook", event: "login.fail", ip: req.socket.remoteAddress ?? null, detail: `stripe watcher=${watcher.id} reason=${authed.reason}` });
+            return res.status(401).json({ error: "Unauthorized", reason: authed.reason });
+        }
+        if (cooldownLeft(watcher) > 0)
+            return res.status(429).json({ error: "Cooldown" });
+        const taskId = fireWatcher(deps, watcher, req.body);
+        deps.watchers.markTriggered(watcher.id);
+        res.status(202).json({ triggered: true, taskId });
+    });
+    log.info({ mountPath, routes: ["agent", "wake", "event", "watch/:id", "github/:id", "stripe/:id"] }, "webhook routes mounted");
+}
+function authenticateWatcher(opts) {
+    const { req, watcher, deps, provider } = opts;
+    // Watcher must have tokens issued. If not, reject — prevents accepting
+    // any request to an unconfigured watcher.
+    const row = deps.webhookTokens.getRow(watcher.id);
+    if (!row || row.revokedAt !== null)
+        return { ok: false, reason: "no_token_for_watcher" };
+    // 1. Bearer path (generic endpoint + optional header on provider endpoints)
+    const auth = req.headers.authorization;
+    if (typeof auth === "string" && auth.startsWith("Bearer ")) {
+        const bearer = auth.slice(7);
+        if (deps.webhookTokens.verifyBearer(watcher.id, bearer))
+            return { ok: true };
+        // fall through — maybe HMAC is also present
+    }
+    // 2. HMAC path
+    const rawBody = req.rawBody ?? "";
+    const secret = deps.webhookTokens.hmacSecretFor(watcher.id);
+    if (!secret) {
+        // can't verify HMAC without the secret — bail with bad_bearer since bearer also failed
+        return { ok: false, reason: "bad_bearer" };
+    }
+    if (provider === "github") {
+        const sig = headerOne(req, "x-hub-signature-256");
+        const r = verifyGithub(rawBody, sig, secret);
+        return r.ok ? { ok: true } : { ok: false, reason: r.reason };
+    }
+    if (provider === "stripe") {
+        const sig = headerOne(req, "stripe-signature");
+        const r = verifyStripe(rawBody, sig, secret);
+        return r.ok ? { ok: true } : { ok: false, reason: r.reason };
+    }
+    // generic: check X-Webhook-Signature (+ optional X-Webhook-Timestamp)
+    const sig = headerOne(req, "x-webhook-signature");
+    const tsHeaderRaw = headerOne(req, "x-webhook-timestamp");
+    const r = verifyGeneric(rawBody, sig, secret, tsHeaderRaw ? { timestampHeader: tsHeaderRaw } : {});
+    return r.ok ? { ok: true } : { ok: false, reason: r.reason };
+}
+function headerOne(req, name) {
+    const v = req.headers[name];
+    if (typeof v === "string")
+        return v;
+    if (Array.isArray(v))
+        return v[0];
+    return undefined;
+}
+// ── helpers (pattern / cooldown / firing — unchanged) ──────────────────────
+function resolveWatcher(store, idOrName) {
+    const byId = store.get(idOrName);
+    if (byId)
+        return byId;
+    return store.list().find((w) => w.name === idOrName) ?? null;
+}
+function cooldownLeft(watcher) {
+    const parsed = parsePattern(watcher.pattern);
+    const cooldown = typeof parsed.__cooldownSeconds === "number" ? parsed.__cooldownSeconds : 0;
+    if (cooldown <= 0 || !watcher.lastTriggeredAt)
+        return 0;
+    const elapsed = (Date.now() - watcher.lastTriggeredAt) / 1000;
+    return elapsed < cooldown ? Math.ceil(cooldown - elapsed) : 0;
+}
+function parsePattern(raw) {
+    if (!raw)
+        return {};
+    try {
+        const obj = JSON.parse(raw);
+        return typeof obj === "object" && obj !== null ? obj : {};
+    }
+    catch {
+        return {};
+    }
+}
+function matchesPattern(payload, pattern) {
+    for (const [key, expected] of Object.entries(pattern)) {
+        if (key.startsWith("__"))
+            continue;
+        const actual = payload[key];
+        if (actual === undefined)
+            return false;
+        if (typeof expected === "string" && expected.startsWith("/") && expected.length > 1) {
+            const lastSlash = expected.lastIndexOf("/");
+            const body = lastSlash > 0 ? expected.slice(1, lastSlash) : expected.slice(1);
+            const flags = lastSlash > 0 ? expected.slice(lastSlash + 1) : "";
+            try {
+                const re = new RegExp(body, flags);
+                if (!re.test(String(actual)))
+                    return false;
+                continue;
+            }
+            catch {
+                if (String(actual) !== expected)
+                    return false;
+                continue;
+            }
+        }
+        if (String(actual) !== String(expected))
+            return false;
+    }
+    return true;
+}
+function fireWatcher(deps, watcher, payload) {
+    const input = `[Watcher: ${watcher.name}] ${watcher.action}\n\nPayload:\n${JSON.stringify(payload, null, 2)}`;
+    const handle = deps.runner.run({
+        input,
+        channel: watcher.channel ?? "webhook",
+        sessionId: "main",
+    });
+    return handle.taskId;
+}
+//# sourceMappingURL=WebhookHandler.js.map

package/dist/webhooks/WebhookHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookHandler.js","sourceRoot":"","sources":["../../src/webhooks/WebhookHandler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AAErC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,cAAc,GAAG,MAAM,CAAC;AAS9B,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,IAAiB,EAAE,SAAS,GAAG,QAAQ;IACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA8C,CAAC;IAEhF,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAW,EAAE;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,cAAc,EAAE,CAAC;YAChD,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,CAAC,CAAC,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,CAAC,KAAK,IAAI,sBAAsB,CAAC;IAC3C,CAAC,CAAC;IAEF,oEAAoE;IACpE,0DAA0D;IAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAA4E,CAAC;QAC9F,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAC7B,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,SAAS;YAClB,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YAC5E,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAqC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAC7B,KAAK,EAAE,kBAAkB,IAAI,EAAE;YAC/B,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC;QACzF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,GAAG,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,SAAS;YAChD,OAAO,EAAE,CAAC;YACV,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,SAAS;YACxC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,SAAS,EAAE,CAAC;QACd,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAE3E,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAExF,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,GAAG;YACH,OAAO;YACP,IAAI;YACJ,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChK,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrH,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,MAAM,EAAE,kBAAkB,OAAO,CAAC,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvK,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,aAAa,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,EAAE,MAAM,EAAE,kBAAkB,OAAO,CAAC,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvK,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC;AACjI,CAAC;AAMD,SAAS,mBAAmB,CAAC,IAAyG;IACpI,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE9C,uEAAuE;IACvE,0CAA0C;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAEzF,4EAA4E;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7E,4CAA4C;IAC9C,CAAC;IAED,eAAe;IACf,MAAM,OAAO,GAAI,GAAsC,CAAC,OAAO,IAAI,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uFAAuF;QACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/D,CAAC;IACD,sEAAsE;IACtE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,IAAY;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAE9E,SAAS,cAAc,CAAC,KAAmB,EAAE,QAAgB;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,OAAmB;IACvC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe;QAAE,OAAO,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAC9D,OAAO,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAOD,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAgC,EAAE,OAAsB;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC9E,MAAM,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC3C,SAAS;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC9C,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAiB,EAAE,OAAmB,EAAE,OAAgB;IAC3E,MAAM,KAAK,GAAG,aAAa,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,iBAAiB,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;QAC7B,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;QACrC,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC"}

package/dist/webhooks/WebhookTokenStore.d.ts

@@ -0,0 +1,48 @@
+/**
+ * WebhookTokenStore — per-watcher bearer token + HMAC secret.
+ *
+ * Two secrets per watcher, different storage models because they're
+ * used differently:
+ *
+ *   bearer:    compared against an incoming `Authorization: Bearer`.
+ *              One-way sha256 hashed — DB leak can't replay.
+ *
+ *   hmacSecret: required to COMPUTE HMAC signatures on every incoming
+ *              payload (for GitHub/Stripe/generic). Must be reversible.
+ *              Stored AES-256-GCM-encrypted with a sub-key derived from
+ *              the auth signing key. DB leak without the key file = no
+ *              plaintext recovery.
+ *
+ * Plaintext is shown to the user ONCE on issue/rotate — they must
+ * paste it into the provider's dashboard at that moment. After that
+ * the server can decrypt it internally but the UI never exposes it.
+ */
+import type Database from "better-sqlite3";
+export interface WebhookTokenRow {
+    readonly watcherId: string;
+    readonly bearerHash: string;
+    readonly hmacCipher: string;
+    readonly createdAt: number;
+    readonly rotatedAt: number | null;
+    readonly revokedAt: number | null;
+}
+export interface IssuedWebhookTokens {
+    readonly bearer: string;
+    readonly hmacSecret: string;
+}
+export declare class WebhookTokenStore {
+    private readonly db;
+    private readonly encryptionKey;
+    private readonly stmts;
+    constructor(db: Database.Database, encryptionKey: Buffer);
+    issue(watcherId: string): IssuedWebhookTokens;
+    revoke(watcherId: string): boolean;
+    remove(watcherId: string): void;
+    getRow(watcherId: string): WebhookTokenRow | null;
+    /** Constant-time bearer check. */
+    verifyBearer(watcherId: string, supplied: string): boolean;
+    /** Returns the plaintext HMAC secret for a watcher, or null if absent/revoked. */
+    hmacSecretFor(watcherId: string): string | null;
+    private prepare;
+}
+//# sourceMappingURL=WebhookTokenStore.d.ts.map

package/dist/webhooks/WebhookTokenStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookTokenStore.d.ts","sourceRoot":"","sources":["../../src/webhooks/WebhookTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAqB3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAAqB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAFlF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2C;gBAEpC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAmB,aAAa,EAAE,MAAM;IAM1F,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,mBAAmB;IAiB7C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIlC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI/B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAIjD,kCAAkC;IAClC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAS1D,kFAAkF;IAClF,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAa/C,OAAO,CAAC,OAAO;CAmBhB"}

package/dist/webhooks/WebhookTokenStore.js

@@ -0,0 +1,136 @@
+/**
+ * WebhookTokenStore — per-watcher bearer token + HMAC secret.
+ *
+ * Two secrets per watcher, different storage models because they're
+ * used differently:
+ *
+ *   bearer:    compared against an incoming `Authorization: Bearer`.
+ *              One-way sha256 hashed — DB leak can't replay.
+ *
+ *   hmacSecret: required to COMPUTE HMAC signatures on every incoming
+ *              payload (for GitHub/Stripe/generic). Must be reversible.
+ *              Stored AES-256-GCM-encrypted with a sub-key derived from
+ *              the auth signing key. DB leak without the key file = no
+ *              plaintext recovery.
+ *
+ * Plaintext is shown to the user ONCE on issue/rotate — they must
+ * paste it into the provider's dashboard at that moment. After that
+ * the server can decrypt it internally but the UI never exposes it.
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createLogger } from "../util/logger.js";
+const log = createLogger("webhook.tokens");
+const ALGO = "aes-256-gcm";
+const IV_LEN = 12;
+const TAG_LEN = 16;
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS webhook_tokens (
+  watcher_id     TEXT PRIMARY KEY,
+  bearer_hash    TEXT NOT NULL,
+  hmac_cipher    TEXT NOT NULL,
+  created_at     INTEGER NOT NULL,
+  rotated_at     INTEGER,
+  revoked_at     INTEGER
+);
+`;
+export class WebhookTokenStore {
+    db;
+    encryptionKey;
+    stmts;
+    constructor(db, encryptionKey) {
+        this.db = db;
+        this.encryptionKey = encryptionKey;
+        if (encryptionKey.length !== 32)
+            throw new Error("WebhookTokenStore encryption key must be 32 bytes");
+        this.db.exec(SCHEMA);
+        this.stmts = this.prepare();
+    }
+    issue(watcherId) {
+        const bearer = randomBytes(24).toString("base64url");
+        const hmacSecret = randomBytes(24).toString("base64url");
+        const bearerHash = sha256Hex(bearer);
+        const hmacCipher = encrypt(hmacSecret, this.encryptionKey);
+        const now = Date.now();
+        const existing = this.stmts.selectByWatcher.get(watcherId);
+        if (existing) {
+            this.stmts.rotate.run(bearerHash, hmacCipher, now, watcherId);
+            log.info({ watcherId }, "webhook tokens rotated");
+        }
+        else {
+            this.stmts.insert.run(watcherId, bearerHash, hmacCipher, now);
+            log.info({ watcherId }, "webhook tokens issued");
+        }
+        return { bearer, hmacSecret };
+    }
+    revoke(watcherId) {
+        return this.stmts.revoke.run(Date.now(), watcherId).changes > 0;
+    }
+    remove(watcherId) {
+        this.stmts.remove.run(watcherId);
+    }
+    getRow(watcherId) {
+        return this.stmts.selectByWatcher.get(watcherId) ?? null;
+    }
+    /** Constant-time bearer check. */
+    verifyBearer(watcherId, supplied) {
+        const row = this.getRow(watcherId);
+        if (!row || row.revokedAt !== null)
+            return false;
+        const a = Buffer.from(sha256Hex(supplied), "hex");
+        const b = Buffer.from(row.bearerHash, "hex");
+        if (a.length !== b.length)
+            return false;
+        return timingSafeEqual(a, b);
+    }
+    /** Returns the plaintext HMAC secret for a watcher, or null if absent/revoked. */
+    hmacSecretFor(watcherId) {
+        const row = this.getRow(watcherId);
+        if (!row || row.revokedAt !== null)
+            return null;
+        try {
+            return decrypt(row.hmacCipher, this.encryptionKey);
+        }
+        catch (e) {
+            log.error({ watcherId, err: e.message }, "hmac decrypt failed — wrong encryption key?");
+            return null;
+        }
+    }
+    // ── Internal ────────────────────────────────────────────────────────────
+    prepare() {
+        return {
+            insert: this.db.prepare(`INSERT INTO webhook_tokens (watcher_id, bearer_hash, hmac_cipher, created_at) VALUES (?, ?, ?, ?)`),
+            rotate: this.db.prepare(`UPDATE webhook_tokens SET bearer_hash=?, hmac_cipher=?, rotated_at=?, revoked_at=NULL WHERE watcher_id=?`),
+            revoke: this.db.prepare(`UPDATE webhook_tokens SET revoked_at=? WHERE watcher_id=? AND revoked_at IS NULL`),
+            remove: this.db.prepare(`DELETE FROM webhook_tokens WHERE watcher_id=?`),
+            selectByWatcher: this.db.prepare(`SELECT watcher_id AS watcherId, bearer_hash AS bearerHash, hmac_cipher AS hmacCipher,
+                created_at AS createdAt, rotated_at AS rotatedAt, revoked_at AS revokedAt
+         FROM webhook_tokens WHERE watcher_id = ?`),
+        };
+    }
+}
+// ── crypto helpers ─────────────────────────────────────────────────────────
+function sha256Hex(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function encrypt(plaintext, key) {
+    const iv = randomBytes(IV_LEN);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${iv.toString("base64")}.${tag.toString("base64")}.${ct.toString("base64")}`;
+}
+function decrypt(blob, key) {
+    const parts = blob.split(".");
+    if (parts.length !== 3)
+        throw new Error("malformed cipher");
+    const [ivB, tagB, ctB] = parts;
+    const iv = Buffer.from(ivB, "base64");
+    const tag = Buffer.from(tagB, "base64");
+    const ct = Buffer.from(ctB, "base64");
+    if (iv.length !== IV_LEN || tag.length !== TAG_LEN)
+        throw new Error("malformed cipher");
+    const d = createDecipheriv(ALGO, key, iv);
+    d.setAuthTag(tag);
+    return Buffer.concat([d.update(ct), d.final()]).toString("utf-8");
+}
+//# sourceMappingURL=WebhookTokenStore.js.map

package/dist/webhooks/WebhookTokenStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebhookTokenStore.js","sourceRoot":"","sources":["../../src/webhooks/WebhookTokenStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGzG,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE3C,MAAM,IAAI,GAAG,aAAa,CAAC;AAC3B,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,MAAM,MAAM,GAAG;;;;;;;;;CASd,CAAC;AAgBF,MAAM,OAAO,iBAAiB;IAGC;IAAwC;IAFpD,KAAK,CAA2C;IAEjE,YAA6B,EAAqB,EAAmB,aAAqB;QAA7D,OAAE,GAAF,EAAE,CAAmB;QAAmB,kBAAa,GAAb,aAAa,CAAQ;QACxF,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACtG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAiB;QACrB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAgC,CAAC;QAC1F,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,OAAQ,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAiC,IAAI,IAAI,CAAC;IAC5F,CAAC;IAED,kCAAkC;IAClC,YAAY,CAAC,SAAiB,EAAE,QAAgB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,kFAAkF;IAClF,aAAa,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,6CAA6C,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,2EAA2E;IAEnE,OAAO;QACb,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACrB,mGAAmG,CACpG;YACD,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACrB,0GAA0G,CAC3G;YACD,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CACrB,kFAAkF,CACnF;YACD,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC;YACxE,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAC9B;;kDAE0C,CAC3C;SACF,CAAC;IACJ,CAAC;CACF;AAED,8EAA8E;AAE9E,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB,EAAE,GAAW;IAC7C,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,KAAiC,CAAC;IAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACxF,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC"}

package/dist/webhooks/hmac.d.ts

@@ -0,0 +1,43 @@
+/**
+ * HMAC webhook signature verifiers — GitHub, Stripe, and a generic one.
+ *
+ * All three use HMAC-SHA256 but differ in:
+ *   - Which header carries the signature
+ *   - Whether a timestamp is part of the signed payload (replay defense)
+ *   - Encoding (hex vs base64 vs "sha256=<hex>" form)
+ *
+ * Every verifier uses `timingSafeEqual` on Buffer-of-expected-length to
+ * avoid timing attacks. Every verifier returns a structured result so
+ * the caller can log the *kind* of failure without logging the signature.
+ */
+export type HmacProvider = "github" | "stripe" | "generic";
+export type VerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "missing" | "malformed" | "mismatch" | "stale";
+};
+/**
+ * GitHub: `X-Hub-Signature-256: sha256=<hex>` where signature =
+ * HMAC-SHA256(secret, rawBody). Hex, lower-case.
+ */
+export declare function verifyGithub(rawBody: string, signatureHeader: string | undefined, secret: string): VerifyResult;
+/**
+ * Stripe: `Stripe-Signature: t=<unixTs>,v1=<hex>[,v1=<hex>...]`
+ * Signed payload is `${t}.${body}`. Also enforce a timestamp window
+ * (default 5 minutes) to defeat replay of captured signatures.
+ */
+export declare function verifyStripe(rawBody: string, signatureHeader: string | undefined, secret: string, opts?: {
+    toleranceSeconds?: number;
+    now?: number;
+}): VerifyResult;
+/**
+ * Generic: `X-Webhook-Signature: <hex>` = HMAC-SHA256(secret, rawBody).
+ * Optional `X-Webhook-Timestamp: <unix>` enforces replay window when present.
+ */
+export declare function verifyGeneric(rawBody: string, signatureHeader: string | undefined, secret: string, opts?: {
+    timestampHeader?: string | undefined;
+    toleranceSeconds?: number;
+    now?: number;
+}): VerifyResult;
+//# sourceMappingURL=hmac.d.ts.map

package/dist/webhooks/hmac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.d.ts","sourceRoot":"","sources":["../../src/webhooks/hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3D,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,OAAO,CAAA;CAAE,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAM/G;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,YAAY,CAwBvK;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,YAAY,CAU9M"}

package/dist/webhooks/hmac.js

@@ -0,0 +1,98 @@
+/**
+ * HMAC webhook signature verifiers — GitHub, Stripe, and a generic one.
+ *
+ * All three use HMAC-SHA256 but differ in:
+ *   - Which header carries the signature
+ *   - Whether a timestamp is part of the signed payload (replay defense)
+ *   - Encoding (hex vs base64 vs "sha256=<hex>" form)
+ *
+ * Every verifier uses `timingSafeEqual` on Buffer-of-expected-length to
+ * avoid timing attacks. Every verifier returns a structured result so
+ * the caller can log the *kind* of failure without logging the signature.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * GitHub: `X-Hub-Signature-256: sha256=<hex>` where signature =
+ * HMAC-SHA256(secret, rawBody). Hex, lower-case.
+ */
+export function verifyGithub(rawBody, signatureHeader, secret) {
+    if (!signatureHeader)
+        return { ok: false, reason: "missing" };
+    const prefix = "sha256=";
+    if (!signatureHeader.startsWith(prefix))
+        return { ok: false, reason: "malformed" };
+    const sigHex = signatureHeader.slice(prefix.length);
+    return compareHex(hmacHex(secret, rawBody), sigHex);
+}
+/**
+ * Stripe: `Stripe-Signature: t=<unixTs>,v1=<hex>[,v1=<hex>...]`
+ * Signed payload is `${t}.${body}`. Also enforce a timestamp window
+ * (default 5 minutes) to defeat replay of captured signatures.
+ */
+export function verifyStripe(rawBody, signatureHeader, secret, opts = {}) {
+    if (!signatureHeader)
+        return { ok: false, reason: "missing" };
+    const tolerance = opts.toleranceSeconds ?? 300;
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    const parts = Object.create(null);
+    for (const pair of signatureHeader.split(",")) {
+        const [k, v] = pair.trim().split("=");
+        if (!k || v === undefined)
+            continue;
+        (parts[k] ??= []).push(v);
+    }
+    const tsRaw = parts["t"]?.[0];
+    const candidates = parts["v1"] ?? [];
+    if (!tsRaw || candidates.length === 0)
+        return { ok: false, reason: "malformed" };
+    const ts = Number.parseInt(tsRaw, 10);
+    if (!Number.isFinite(ts))
+        return { ok: false, reason: "malformed" };
+    if (Math.abs(now - ts) > tolerance)
+        return { ok: false, reason: "stale" };
+    const expected = hmacHex(secret, `${ts}.${rawBody}`);
+    for (const candidate of candidates) {
+        if (constantTimeHexEq(expected, candidate))
+            return { ok: true };
+    }
+    return { ok: false, reason: "mismatch" };
+}
+/**
+ * Generic: `X-Webhook-Signature: <hex>` = HMAC-SHA256(secret, rawBody).
+ * Optional `X-Webhook-Timestamp: <unix>` enforces replay window when present.
+ */
+export function verifyGeneric(rawBody, signatureHeader, secret, opts = {}) {
+    if (!signatureHeader)
+        return { ok: false, reason: "missing" };
+    const tolerance = opts.toleranceSeconds ?? 300;
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    if (opts.timestampHeader) {
+        const ts = Number.parseInt(opts.timestampHeader, 10);
+        if (!Number.isFinite(ts))
+            return { ok: false, reason: "malformed" };
+        if (Math.abs(now - ts) > tolerance)
+            return { ok: false, reason: "stale" };
+    }
+    return compareHex(hmacHex(secret, rawBody), signatureHeader);
+}
+// ── helpers ────────────────────────────────────────────────────────────────
+function hmacHex(secret, data) {
+    return createHmac("sha256", secret).update(data).digest("hex");
+}
+function compareHex(expected, actual) {
+    if (!/^[0-9a-f]+$/i.test(actual))
+        return { ok: false, reason: "malformed" };
+    if (!constantTimeHexEq(expected, actual))
+        return { ok: false, reason: "mismatch" };
+    return { ok: true };
+}
+function constantTimeHexEq(aHex, bHex) {
+    if (aHex.length !== bHex.length)
+        return false;
+    const a = Buffer.from(aHex, "hex");
+    const b = Buffer.from(bHex, "hex");
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+//# sourceMappingURL=hmac.js.map

package/dist/webhooks/hmac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hmac.js","sourceRoot":"","sources":["../../src/webhooks/hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAQ1D;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,eAAmC,EAAE,MAAc;IAC/F,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,eAAmC,EAAE,MAAc,EAAE,OAAoD,EAAE;IACvJ,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC;IAC9D,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QACpC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjF,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEpE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IACrD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,eAAmC,EAAE,MAAc,EAAE,OAA0F,EAAE;IAC9L,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACpE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAE9E,SAAS,OAAO,CAAC,MAAc,EAAE,IAAY;IAC3C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,MAAc;IAClD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACnF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,IAAY;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC"}