happy2 0.0.5

package/packages/happy2-server/dist/modules/integrations/routes.test.js

@@ -0,0 +1,161 @@
+import Fastify from "fastify";
+import { describe, expect, it, vi } from "vitest";
+import { registerIntegrationRoutes } from "../../routes/integrations.js";
+describe("integration HTTP routes", () => {
+    it("requires a product user and maps admin creation results", async () => {
+        const change = {
+            sequence: "8",
+            kind: "bot.created",
+            entityId: "bot_1",
+        };
+        const repository = fakeRepository({
+            createBot: vi.fn(async () => ({
+                value: {
+                    id: "bot_1",
+                    name: "Build Bot",
+                    username: "build_bot",
+                    active: true,
+                    createdAt: "2026-01-01T00:00:00.000Z",
+                    updatedAt: "2026-01-01T00:00:00.000Z",
+                },
+                change,
+            })),
+        });
+        const onChange = vi.fn(async () => { });
+        const app = buildRouteServer(repository, { incomingWebhook: sink(), onChange });
+        expect((await app.inject({
+            method: "POST",
+            url: "/v0/admin/bots/createBot",
+            payload: { name: "Build Bot", username: "build_bot" },
+        })).statusCode).toBe(401);
+        const created = await app.inject({
+            method: "POST",
+            url: "/v0/admin/bots/createBot",
+            headers: { "x-test-user": "admin_1" },
+            payload: { name: "Build Bot", username: "build_bot" },
+        });
+        expect(created.statusCode).toBe(201);
+        expect(created.json()).toMatchObject({ bot: { id: "bot_1" }, sync: change });
+        expect(repository.createBot).toHaveBeenCalledWith({
+            actorUserId: "admin_1",
+            name: "Build Bot",
+            username: "build_bot",
+            description: undefined,
+            photoFileId: undefined,
+            ownerUserId: undefined,
+        });
+        expect(onChange).toHaveBeenCalledWith(change);
+        await app.close();
+    });
+    it("returns credentials once and rejects unexpected fields", async () => {
+        const repository = fakeRepository({
+            createApiCredential: vi.fn(async () => ({
+                credential: {
+                    id: "credential_1",
+                    integrationId: "integration_1",
+                    name: "CI",
+                    tokenPrefix: "happy2_api_abc",
+                    scopes: ["messages:write"],
+                    createdAt: "2026-01-01T00:00:00.000Z",
+                },
+                token: "happy2_api_secret_returned_once",
+            })),
+        });
+        const app = buildRouteServer(repository);
+        const created = await app.inject({
+            method: "POST",
+            url: "/v0/admin/integrations/integration_1/createCredential",
+            headers: { "x-test-user": "admin_1" },
+            payload: { name: "CI", scopes: ["messages:write"] },
+        });
+        expect(created.statusCode).toBe(201);
+        expect(created.json()).toMatchObject({
+            token: "happy2_api_secret_returned_once",
+            credential: { id: "credential_1" },
+        });
+        const unsafeSecretCache = await app.inject({
+            method: "POST",
+            url: "/v0/admin/integrations/integration_1/createCredential",
+            headers: { "x-test-user": "admin_1", "idempotency-key": "do-not-cache-secret" },
+            payload: { name: "CI", scopes: ["messages:write"] },
+        });
+        expect(unsafeSecretCache.statusCode).toBe(400);
+        expect(repository.createApiCredential).toHaveBeenCalledTimes(1);
+        const invalid = await app.inject({
+            method: "POST",
+            url: "/v0/admin/integrations/integration_1/createCredential",
+            headers: { "x-test-user": "admin_1" },
+            payload: { name: "CI", secret: "must-not-be-accepted" },
+        });
+        expect(invalid.statusCode).toBe(400);
+        expect(invalid.json()).toMatchObject({ error: "invalid_request" });
+        await app.close();
+    });
+    it("accepts incoming webhook secrets only in the dedicated header", async () => {
+        const incomingWebhook = sink();
+        const invokeIncomingWebhook = vi.fn(async (token, text, callback, idempotencyKey) => callback.sendMessage({
+            actorUserId: "admin_1",
+            integrationId: "integration_1",
+            subscriptionId: "subscription_1",
+            botId: "bot_1",
+            chatId: "chat_1",
+            text: `${token}:${text}`,
+            idempotencyKey,
+        }));
+        const repository = fakeRepository({ invokeIncomingWebhook });
+        const app = buildRouteServer(repository, { incomingWebhook });
+        const missing = await app.inject({
+            method: "POST",
+            url: "/v0/integrations/incomingWebhook",
+            payload: { text: "hello" },
+        });
+        expect(missing.statusCode).toBe(401);
+        const accepted = await app.inject({
+            method: "POST",
+            url: "/v0/integrations/incomingWebhook",
+            headers: {
+                "x-happy2-webhook-token": "happy2_hook_secret",
+                "idempotency-key": "deploy-event-42",
+            },
+            payload: { text: "hello" },
+        });
+        expect(accepted.statusCode).toBe(201);
+        expect(accepted.json()).toEqual({ messageId: "message_1" });
+        expect(invokeIncomingWebhook).toHaveBeenCalledWith("happy2_hook_secret", "hello", incomingWebhook, "deploy-event-42");
+        expect(incomingWebhook.sendMessage).toHaveBeenCalledWith(expect.objectContaining({
+            botId: "bot_1",
+            chatId: "chat_1",
+            text: "happy2_hook_secret:hello",
+            idempotencyKey: "deploy-event-42",
+        }));
+        const invalidKey = await app.inject({
+            method: "POST",
+            url: "/v0/integrations/incomingWebhook",
+            headers: {
+                "x-happy2-webhook-token": "happy2_hook_secret",
+                "idempotency-key": "contains spaces",
+            },
+            payload: { text: "hello" },
+        });
+        expect(invalidKey.statusCode).toBe(400);
+        await app.close();
+    });
+});
+function buildRouteServer(repository, callbacks = { incomingWebhook: sink() }) {
+    const app = Fastify({ logger: false });
+    const auth = {
+        authenticate: vi.fn(async (request) => {
+            const userId = request.headers["x-test-user"];
+            return typeof userId === "string" ? { user: { id: userId } } : undefined;
+        }),
+    };
+    registerIntegrationRoutes(app, auth, repository, callbacks);
+    return app;
+}
+function sink() {
+    return { sendMessage: vi.fn(async () => ({ messageId: "message_1" })) };
+}
+function fakeRepository(overrides) {
+    return overrides;
+}
+//# sourceMappingURL=routes.test.js.map

package/packages/happy2-server/dist/modules/integrations/routes.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.test.js","sourceRoot":"","sources":["../../../sources/modules/integrations/routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAIzE,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,MAAM,GAAsB;YAC9B,QAAQ,EAAE,GAAG;YACb,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,OAAO;SACpB,CAAC;QACF,MAAM,UAAU,GAAG,cAAc,CAAC;YAC9B,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC1B,KAAK,EAAE;oBACH,EAAE,EAAE,OAAO;oBACX,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,WAAW;oBACrB,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE,0BAA0B;oBACrC,SAAS,EAAE,0BAA0B;iBACxC;gBACD,MAAM;aACT,CAAC,CAAC;SACN,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEhF,MAAM,CACF,CACI,MAAM,GAAG,CAAC,MAAM,CAAC;YACb,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,0BAA0B;YAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE;SACxD,CAAC,CACL,CAAC,UAAU,CACf,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,0BAA0B;YAC/B,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE;SACxD,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC;YAC9C,WAAW,EAAE,SAAS;YACtB,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,WAAW;YACrB,WAAW,EAAE,SAAS;YACtB,WAAW,EAAE,SAAS;YACtB,WAAW,EAAE,SAAS;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,UAAU,GAAG,cAAc,CAAC;YAC9B,mBAAmB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBACpC,UAAU,EAAE;oBACR,EAAE,EAAE,cAAc;oBAClB,aAAa,EAAE,eAAe;oBAC9B,IAAI,EAAE,IAAI;oBACV,WAAW,EAAE,gBAAgB;oBAC7B,MAAM,EAAE,CAAC,gBAAgB,CAAC;oBAC1B,SAAS,EAAE,0BAA0B;iBACxC;gBACD,KAAK,EAAE,iCAAiC;aAC3C,CAAC,CAAC;SACN,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,uDAAuD;YAC5D,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC;YACjC,KAAK,EAAE,iCAAiC;YACxC,UAAU,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;SACrC,CAAC,CAAC;QAEH,MAAM,iBAAiB,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YACvC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,uDAAuD;YAC5D,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,qBAAqB,EAAE;YAC/E,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEhE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,uDAAuD;YAC5D,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE;YACrC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE;SAC1D,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACnE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,eAAe,GAAG,IAAI,EAAE,CAAC;QAC/B,MAAM,qBAAqB,GAAG,EAAE,CAAC,EAAE,CAC/B,KAAK,EACD,KAAa,EACb,IAAY,EACZ,QAAsD,EACtD,cAAuB,EACzB,EAAE,CACA,QAAQ,CAAC,WAAW,CAAC;YACjB,WAAW,EAAE,SAAS;YACtB,aAAa,EAAE,eAAe;YAC9B,cAAc,EAAE,gBAAgB;YAChC,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE;YACxB,cAAc;SACjB,CAAC,CACT,CAAC;QACF,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,gBAAgB,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,kCAAkC;YACvC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAErC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,kCAAkC;YACvC,OAAO,EAAE;gBACL,wBAAwB,EAAE,oBAAoB;gBAC9C,iBAAiB,EAAE,iBAAiB;aACvC;YACD,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,qBAAqB,CAAC,CAAC,oBAAoB,CAC9C,oBAAoB,EACpB,OAAO,EACP,eAAe,EACf,iBAAiB,CACpB,CAAC;QACF,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,oBAAoB,CACpD,MAAM,CAAC,gBAAgB,CAAC;YACpB,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,0BAA0B;YAChC,cAAc,EAAE,iBAAiB;SACpC,CAAC,CACL,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,kCAAkC;YACvC,OAAO,EAAE;gBACL,wBAAwB,EAAE,oBAAoB;gBAC9C,iBAAiB,EAAE,iBAAiB;aACvC;YACD,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CACrB,UAAiC,EACjC,SAAS,GAA8B,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE;IAElE,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG;QACT,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,OAA6C,EAAE,EAAE;YACxE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,CAAC,CAAC;KACqB,CAAC;IAC5B,yBAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,IAAI;IACT,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,SAAkC;IACtD,OAAO,SAA6C,CAAC;AACzD,CAAC"}

package/packages/happy2-server/dist/modules/integrations/secrets.d.ts

@@ -0,0 +1,19 @@
+export interface SecretProtector {
+    protect(secret: string): Promise<string>;
+    reveal(ciphertext: string): Promise<string>;
+}
+/** AES-GCM envelope used for signing secrets that must be recovered by delivery workers. */
+export declare class AesGcmSecretProtector implements SecretProtector {
+    private readonly key;
+    constructor(key: Uint8Array);
+    static fromBase64(value: string): AesGcmSecretProtector;
+    protect(secret: string): Promise<string>;
+    reveal(envelope: string): Promise<string>;
+}
+export declare function generateApiToken(): string;
+export declare function generateIncomingWebhookToken(): string;
+export declare function generateSigningSecret(): string;
+export declare function tokenPrefix(token: string): string;
+export declare function secretHash(secret: string): string;
+export declare function hashesEqual(left: string, right: string): boolean;
+//# sourceMappingURL=secrets.d.ts.map

package/packages/happy2-server/dist/modules/integrations/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../sources/modules/integrations/secrets.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC5B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,4FAA4F;AAC5F,qBAAa,qBAAsB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,GAAG,EAAE,UAAU,EAG1B;IAED,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAGtD;IAEK,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ7C;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyB9C;CACJ;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGhE"}

package/packages/happy2-server/dist/modules/integrations/secrets.js

@@ -0,0 +1,69 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual, } from "node:crypto";
+const CIPHER = "aes-256-gcm";
+const CONTEXT = Buffer.from("happy2:integration-signing-secret:v1", "utf8");
+/** AES-GCM envelope used for signing secrets that must be recovered by delivery workers. */
+export class AesGcmSecretProtector {
+    key;
+    constructor(key) {
+        if (key.byteLength !== 32)
+            throw new TypeError("Integration secret key must be 32 bytes");
+        this.key = Buffer.from(key);
+    }
+    static fromBase64(value) {
+        if (!value)
+            throw new TypeError("Integration secret key is required");
+        return new AesGcmSecretProtector(Buffer.from(value, "base64url"));
+    }
+    async protect(secret) {
+        if (!secret)
+            throw new TypeError("Secret must not be empty");
+        const nonce = randomBytes(12);
+        const cipher = createCipheriv(CIPHER, this.key, nonce);
+        cipher.setAAD(CONTEXT);
+        const ciphertext = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return `v1.${nonce.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
+    }
+    async reveal(envelope) {
+        const [version, nonceValue, ciphertextValue, tagValue, unexpected] = envelope.split(".");
+        if (version !== "v1" ||
+            !nonceValue ||
+            !ciphertextValue ||
+            !tagValue ||
+            unexpected !== undefined)
+            throw new Error("Invalid integration secret envelope");
+        try {
+            const decipher = createDecipheriv(CIPHER, this.key, Buffer.from(nonceValue, "base64url"));
+            decipher.setAAD(CONTEXT);
+            decipher.setAuthTag(Buffer.from(tagValue, "base64url"));
+            return Buffer.concat([
+                decipher.update(Buffer.from(ciphertextValue, "base64url")),
+                decipher.final(),
+            ]).toString("utf8");
+        }
+        catch {
+            throw new Error("Integration secret could not be authenticated");
+        }
+    }
+}
+export function generateApiToken() {
+    return `happy2_api_${randomBytes(32).toString("base64url")}`;
+}
+export function generateIncomingWebhookToken() {
+    return `happy2_hook_${randomBytes(32).toString("base64url")}`;
+}
+export function generateSigningSecret() {
+    return `happy2_sign_${randomBytes(32).toString("base64url")}`;
+}
+export function tokenPrefix(token) {
+    return token.slice(0, 20);
+}
+export function secretHash(secret) {
+    return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+export function hashesEqual(left, right) {
+    if (!/^[a-f0-9]{64}$/.test(left) || !/^[a-f0-9]{64}$/.test(right))
+        return false;
+    return timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex"));
+}
+//# sourceMappingURL=secrets.js.map

package/packages/happy2-server/dist/modules/integrations/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../sources/modules/integrations/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,eAAe,GAClB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,MAAM,CAAC,CAAC;AAO5E,4FAA4F;AAC5F,MAAM,OAAO,qBAAqB;IACb,GAAG,CAAS;IAE7B,YAAY,GAAe;QACvB,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC1F,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,KAAa;QAC3B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACtE,OAAO,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QACxB,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAChH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QACzB,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzF,IACI,OAAO,KAAK,IAAI;YAChB,CAAC,UAAU;YACX,CAAC,eAAe;YAChB,CAAC,QAAQ;YACT,UAAU,KAAK,SAAS;YAExB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3D,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,gBAAgB,CAC7B,MAAM,EACN,IAAI,CAAC,GAAG,EACR,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CACvC,CAAC;YACF,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACjB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;gBAC1D,QAAQ,CAAC,KAAK,EAAE;aACnB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;IACL,CAAC;CACJ;AAED,MAAM,UAAU,gBAAgB;IAC5B,OAAO,cAAc,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,4BAA4B;IACxC,OAAO,eAAe,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,qBAAqB;IACjC,OAAO,eAAe,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC"}

package/packages/happy2-server/dist/modules/integrations/ssrf.d.ts

@@ -0,0 +1,32 @@
+export interface ResolvedWebhookUrl {
+    url: string;
+    addresses: ReadonlyArray<{
+        address: string;
+        family: 4 | 6;
+    }>;
+}
+export interface WebhookUrlPolicy {
+    validateForStorage(value: string): string;
+    resolveForDelivery(value: string): Promise<ResolvedWebhookUrl>;
+}
+export interface StrictWebhookUrlPolicyOptions {
+    allowedPorts?: readonly number[];
+    resolve?: (hostname: string) => Promise<ReadonlyArray<{
+        address: string;
+        family: 4 | 6;
+    }>>;
+}
+/**
+ * Rejects credentials, non-HTTPS URLs, local hostnames, non-approved ports, and
+ * every non-public resolved address. Delivery transports must pin their socket to
+ * one of the returned addresses so DNS rebinding cannot bypass this decision.
+ */
+export declare class StrictWebhookUrlPolicy implements WebhookUrlPolicy {
+    private readonly allowedPorts;
+    private readonly resolve;
+    constructor(options?: StrictWebhookUrlPolicyOptions);
+    validateForStorage(value: string): string;
+    resolveForDelivery(value: string): Promise<ResolvedWebhookUrl>;
+}
+export declare function isPublicAddress(value: string): boolean;
+//# sourceMappingURL=ssrf.d.ts.map

package/packages/happy2-server/dist/modules/integrations/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../../sources/modules/integrations/ssrf.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,aAAa,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,gBAAgB;IAC7B,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,6BAA6B;IAC1C,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;CAC9F;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,gBAAgB;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAEwC;IAEhE,YAAY,OAAO,GAAE,6BAAkC,EAiBtD;IAED,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAwBxC;IAEK,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAUnE;CACJ;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKtD"}

package/packages/happy2-server/dist/modules/integrations/ssrf.js

@@ -0,0 +1,185 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { IntegrationError } from "./types.js";
+/**
+ * Rejects credentials, non-HTTPS URLs, local hostnames, non-approved ports, and
+ * every non-public resolved address. Delivery transports must pin their socket to
+ * one of the returned addresses so DNS rebinding cannot bypass this decision.
+ */
+export class StrictWebhookUrlPolicy {
+    allowedPorts;
+    resolve;
+    constructor(options = {}) {
+        const ports = options.allowedPorts ?? [443];
+        if (ports.length === 0 ||
+            ports.some((port) => !Number.isSafeInteger(port) || port < 1 || port > 65_535))
+            throw new TypeError("allowedPorts must contain valid TCP ports");
+        this.allowedPorts = new Set(ports);
+        this.resolve =
+            options.resolve ??
+                (async (hostname) => {
+                    const results = await lookup(hostname, { all: true, verbatim: true });
+                    return results.map(({ address, family }) => ({
+                        address,
+                        family: family === 6 ? 6 : 4,
+                    }));
+                });
+    }
+    validateForStorage(value) {
+        let url;
+        try {
+            url = new URL(value);
+        }
+        catch {
+            throw new IntegrationError("invalid", "Webhook URL must be an absolute HTTPS URL");
+        }
+        if (url.protocol !== "https:")
+            throw new IntegrationError("invalid", "Webhook URL must use HTTPS");
+        if (url.username || url.password)
+            throw new IntegrationError("invalid", "Webhook URL must not contain credentials");
+        if (url.hash)
+            throw new IntegrationError("invalid", "Webhook URL must not contain a fragment");
+        const port = url.port ? Number(url.port) : 443;
+        if (!this.allowedPorts.has(port))
+            throw new IntegrationError("invalid", "Webhook URL uses a disallowed port");
+        const hostname = unbracket(url.hostname).replace(/\.$/, "").toLowerCase();
+        const literalFamily = isIP(hostname);
+        if (!hostname || (!literalFamily && isLocalHostname(hostname)))
+            throw new IntegrationError("invalid", "Webhook URL hostname is not public");
+        if (literalFamily && !isPublicAddress(hostname))
+            throw new IntegrationError("invalid", "Webhook URL address is not public");
+        return url.toString();
+    }
+    async resolveForDelivery(value) {
+        const normalized = this.validateForStorage(value);
+        const hostname = unbracket(new URL(normalized).hostname);
+        const literalFamily = isIP(hostname);
+        const addresses = literalFamily
+            ? [{ address: hostname, family: literalFamily }]
+            : await this.resolve(hostname);
+        if (addresses.length === 0 || addresses.some(({ address }) => !isPublicAddress(address)))
+            throw new IntegrationError("forbidden", "Webhook URL resolved to a non-public address");
+        return { url: normalized, addresses: deduplicate(addresses) };
+    }
+}
+export function isPublicAddress(value) {
+    const family = isIP(value);
+    if (family === 4)
+        return isPublicIpv4(value);
+    if (family === 6)
+        return isPublicIpv6(value);
+    return false;
+}
+function isLocalHostname(hostname) {
+    if (!hostname.includes("."))
+        return true;
+    return (hostname === "localhost" ||
+        hostname.endsWith(".localhost") ||
+        hostname.endsWith(".local") ||
+        hostname.endsWith(".internal") ||
+        hostname.endsWith(".home.arpa"));
+}
+function isPublicIpv4(value) {
+    const octets = value.split(".").map(Number);
+    if (octets.length !== 4 || octets.some((octet) => octet < 0 || octet > 255))
+        return false;
+    const [a, b, c] = octets;
+    if (a === 0 || a === 10 || a === 127 || a >= 224)
+        return false;
+    if (a === 100 && b >= 64 && b <= 127)
+        return false;
+    if (a === 169 && b === 254)
+        return false;
+    if (a === 172 && b >= 16 && b <= 31)
+        return false;
+    if (a === 192 && b === 168)
+        return false;
+    if (a === 198 && (b === 18 || b === 19))
+        return false;
+    // IETF special-purpose/documentation networks are not valid callback targets.
+    if (a === 192 && b === 0 && c === 0)
+        return false;
+    if (a === 192 && b === 0 && c === 2)
+        return false;
+    if (a === 198 && b === 51 && c === 100)
+        return false;
+    if (a === 203 && b === 0 && c === 113)
+        return false;
+    return true;
+}
+function isPublicIpv6(value) {
+    const bytes = ipv6Bytes(value);
+    if (!bytes)
+        return false;
+    const mapped = bytes.subarray(0, 10).every((byte) => byte === 0) &&
+        bytes[10] === 0xff &&
+        bytes[11] === 0xff;
+    if (mapped)
+        return isPublicIpv4(`${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`);
+    // Restrict callbacks to global unicast 2000::/3 and reject special transition/docs ranges.
+    if ((bytes[0] & 0xe0) !== 0x20)
+        return false;
+    if (bytes[0] === 0x20 && bytes[1] === 0x01 && bytes[2] === 0x0d && bytes[3] === 0xb8)
+        return false;
+    if (bytes[0] === 0x20 && bytes[1] === 0x01 && bytes[2] === 0x00 && bytes[3] === 0x00)
+        return false;
+    if (bytes[0] === 0x20 && bytes[1] === 0x02)
+        return false;
+    return true;
+}
+function ipv6Bytes(value) {
+    const normalized = unbracket(value).split("%", 1)[0];
+    const halves = normalized.split("::");
+    if (halves.length > 2)
+        return undefined;
+    const left = parseIpv6Half(halves[0]);
+    const right = parseIpv6Half(halves[1] ?? "");
+    if (!left || !right)
+        return undefined;
+    const missing = 8 - left.length - right.length;
+    if ((halves.length === 1 && missing !== 0) || (halves.length === 2 && missing < 1))
+        return undefined;
+    const words = [...left, ...Array.from({ length: missing }, () => 0), ...right];
+    if (words.length !== 8)
+        return undefined;
+    const bytes = new Uint8Array(16);
+    words.forEach((word, index) => {
+        bytes[index * 2] = word >> 8;
+        bytes[index * 2 + 1] = word & 0xff;
+    });
+    return bytes;
+}
+function parseIpv6Half(value) {
+    if (!value)
+        return [];
+    const parts = value.split(":");
+    const words = [];
+    for (const [index, part] of parts.entries()) {
+        if (part.includes(".")) {
+            if (index !== parts.length - 1 || !isIP(part))
+                return undefined;
+            const octets = part.split(".").map(Number);
+            words.push((octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]);
+        }
+        else {
+            if (!/^[a-f0-9]{1,4}$/i.test(part))
+                return undefined;
+            words.push(Number.parseInt(part, 16));
+        }
+    }
+    return words;
+}
+function unbracket(hostname) {
+    return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function deduplicate(addresses) {
+    const seen = new Set();
+    return addresses.filter(({ address, family }) => {
+        const key = `${family}:${address}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+//# sourceMappingURL=ssrf.js.map

package/packages/happy2-server/dist/modules/integrations/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../../sources/modules/integrations/ssrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAiB9C;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IACd,YAAY,CAAc;IAC1B,OAAO,CAEwC;IAEhE,YAAY,OAAO,GAAkC,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,IACI,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC;YAE9E,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACrE,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO;YACR,OAAO,CAAC,OAAO;gBACf,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;oBAChB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;wBACzC,OAAO;wBACP,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;qBAC/B,CAAC,CAAC,CAAC;gBACR,CAAC,CAAC,CAAC;IACX,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC5B,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACD,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;QACxE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAC5B,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,IAAI;YACR,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,yCAAyC,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QAEhF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QAChF,IAAI,aAAa,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,aAAa;YAC3B,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAC;YACzD,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACpF,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,8CAA8C,CAAC,CAAC;QAC5F,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;IAClE,CAAC;CACJ;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACrC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,CACH,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC9B,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAClC,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,MAA0C,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,8EAA8E;IAC9E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GACR,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;QACjD,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI;QAClB,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IACvB,IAAI,MAAM;QAAE,OAAO,YAAY,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,2FAA2F;IAC3F,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAChF,OAAO,KAAK,CAAC;IACjB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAChF,OAAO,KAAK,CAAC;IACjB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IACrB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC1B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QAC7B,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/E,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IAC/B,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjG,CAAC;AAED,SAAS,WAAW,CAChB,SAA4D;IAE5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/integrations/ssrf.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ssrf.test.d.ts.map

package/packages/happy2-server/dist/modules/integrations/ssrf.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.test.d.ts","sourceRoot":"","sources":["../../../sources/modules/integrations/ssrf.test.ts"],"names":[],"mappings":""}

package/packages/happy2-server/dist/modules/integrations/ssrf.test.js

@@ -0,0 +1,56 @@
+import { describe, expect, it } from "vitest";
+import { isPublicAddress, StrictWebhookUrlPolicy } from "./ssrf.js";
+describe("StrictWebhookUrlPolicy", () => {
+    it("rejects non-HTTPS, credentials, local names, private addresses, and custom ports", () => {
+        const policy = new StrictWebhookUrlPolicy();
+        for (const url of [
+            "http://hooks.example.com/events",
+            "https://user:password@hooks.example.com/events",
+            "https://localhost/events",
+            "https://service.internal/events",
+            "https://127.0.0.1/events",
+            "https://10.1.2.3/events",
+            "https://[::1]/events",
+            "https://hooks.example.com:8443/events",
+        ]) {
+            expect(() => policy.validateForStorage(url), url).toThrow();
+        }
+        expect(policy.validateForStorage("https://hooks.example.com/events?version=1")).toBe("https://hooks.example.com/events?version=1");
+        expect(policy.validateForStorage("https://[2606:4700:4700::1111]/events")).toBe("https://[2606:4700:4700::1111]/events");
+    });
+    it("rejects DNS answers if any address is non-public and deduplicates safe answers", async () => {
+        const unsafe = new StrictWebhookUrlPolicy({
+            resolve: async () => [
+                { address: "8.8.8.8", family: 4 },
+                { address: "192.168.1.8", family: 4 },
+            ],
+        });
+        await expect(unsafe.resolveForDelivery("https://hooks.example.com/event")).rejects.toThrow("non-public");
+        const safe = new StrictWebhookUrlPolicy({
+            resolve: async () => [
+                { address: "8.8.8.8", family: 4 },
+                { address: "8.8.8.8", family: 4 },
+                { address: "2606:4700:4700::1111", family: 6 },
+            ],
+        });
+        await expect(safe.resolveForDelivery("https://hooks.example.com/event")).resolves.toEqual({
+            url: "https://hooks.example.com/event",
+            addresses: [
+                { address: "8.8.8.8", family: 4 },
+                { address: "2606:4700:4700::1111", family: 6 },
+            ],
+        });
+    });
+});
+describe("isPublicAddress", () => {
+    it("recognizes public addresses without allowing private or transition ranges", () => {
+        expect(isPublicAddress("8.8.8.8")).toBe(true);
+        expect(isPublicAddress("192.168.0.1")).toBe(false);
+        expect(isPublicAddress("203.0.113.1")).toBe(false);
+        expect(isPublicAddress("2606:4700:4700::1111")).toBe(true);
+        expect(isPublicAddress("fd00::1")).toBe(false);
+        expect(isPublicAddress("2001:db8::1")).toBe(false);
+        expect(isPublicAddress("::ffff:127.0.0.1")).toBe(false);
+    });
+});
+//# sourceMappingURL=ssrf.test.js.map

package/packages/happy2-server/dist/modules/integrations/ssrf.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.test.js","sourceRoot":"","sources":["../../../sources/modules/integrations/ssrf.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEpE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QACxF,MAAM,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI;YACd,iCAAiC;YACjC,gDAAgD;YAChD,0BAA0B;YAC1B,iCAAiC;YACjC,0BAA0B;YAC1B,yBAAyB;YACzB,sBAAsB;YACtB,uCAAuC;SAC1C,EAAE,CAAC;YACA,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,CAChF,4CAA4C,CAC/C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAC3E,uCAAuC,CAC1C,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,MAAM,GAAG,IAAI,sBAAsB,CAAC;YACtC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;gBACjB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE;gBACjC,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE;aACxC;SACJ,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACtF,YAAY,CACf,CAAC;QAEF,MAAM,IAAI,GAAG,IAAI,sBAAsB,CAAC;YACpC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;gBACjB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE;gBACjC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE;gBACjC,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,EAAE;aACjD;SACJ,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,iCAAiC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtF,GAAG,EAAE,iCAAiC;YACtC,SAAS,EAAE;gBACP,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE;gBACjC,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,EAAE;aACjD;SACJ,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,eAAe,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/packages/happy2-server/dist/modules/integrations/transport.d.ts

@@ -0,0 +1,21 @@
+import type { WebhookTransport, WebhookTransportRequest, WebhookTransportResponse } from "./types.js";
+export interface NodeWebhookTransportOptions {
+    timeoutMs?: number;
+    maximumRequestBytes?: number;
+    maximumResponseBytes?: number;
+    userAgent?: string;
+}
+/**
+ * Standard-library webhook transport. It never follows redirects and overrides
+ * DNS lookup with an address approved by StrictWebhookUrlPolicy, preserving the
+ * original hostname for Host and TLS certificate/SNI verification.
+ */
+export declare class NodeWebhookTransport implements WebhookTransport {
+    private readonly timeoutMs;
+    private readonly maximumRequestBytes;
+    private readonly maximumResponseBytes;
+    private readonly userAgent;
+    constructor(options?: NodeWebhookTransportOptions);
+    deliver(input: WebhookTransportRequest): Promise<WebhookTransportResponse>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/packages/happy2-server/dist/modules/integrations/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../../sources/modules/integrations/transport.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACR,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EAC3B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,2BAA2B;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,gBAAgB;IACzD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,OAAO,GAAE,2BAAgC,EAepD;IAEK,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAuF/E;CACJ"}