primitive-admin 1.0.62 → 1.0.64

package/dist/src/lib/webhook-deliver.js

@@ -0,0 +1,519 @@
+/**
+ * Deliver a signed preview through a webhook's real receive path (#3321).
+ *
+ * `primitive webhooks test --deliver` adds no server dispatch surface. It
+ * composes two capabilities that already exist:
+ *
+ *   1. the admin-gated preview `POST /admin/api/apps/{appId}/webhooks/{id}/test`,
+ *      which signs a payload with the same rule the receiver verifies with, and
+ *   2. the public receive endpoint `POST /app/{appId}/webhook/{webhookKey}`,
+ *      the unauthenticated path a provider posts to.
+ *
+ * So the delivery is a real delivery: the body cap, the availability check, the
+ * IP allowlist, signature verification, handshake rules, deduplication, the run
+ * row and the delivery log all run exactly as they do for a provider. Nobody
+ * gains authority they did not have — only someone who can already administer
+ * the app can obtain a signature — and nothing bypasses verification, because
+ * the signature is checked for real at the receive endpoint.
+ *
+ * ── What this module owes the caller ──────────────────────────────────────
+ *
+ * An honest report. The receive endpoint answers `{received: true}` and
+ * discloses nothing else (it must not: it is unauthenticated), so "did the
+ * function actually run?" is answered from the delivery log and the runs
+ * surface, and only positive evidence may be reported as a dispatch:
+ *
+ *   - **Correlation is one rule.** A delivery-log row NEWER than a baseline
+ *     snapshot taken before the POST, whose `dedupKey` equals the one the
+ *     preview returned. That key hashes the whole signed payload including its
+ *     timestamp prefix, so it is unique to this request rather than a
+ *     heuristic; the baseline is what keeps a replay of the same signed bytes
+ *     from being attributed here. There is no body-hash fallback: identical
+ *     bodies collide, and attributing another request's row is worse than
+ *     declining to.
+ *   - **The key names dispatched deliveries only.** The receiver writes
+ *     `dedupKey` on an `accepted` row that really dispatched and OMITS it
+ *     everywhere else — on a handshake row, a duplicate, a rejection, a 202
+ *     non-dispatch, and on the `accepted` row of a delivery whose target was
+ *     not found (`webhook-receiver.ts`, `logEvent`). That omission is what
+ *     keeps the `eventsByDedupKey` index holding exactly the deliveries that
+ *     may suppress a later one, so it is load-bearing, not incidental. The
+ *     consequence here: a delivery the receiver did not dispatch has no row
+ *     this correlator can reach, and is reported as unconfirmed — with what
+ *     the absence of the key means — rather than named from a row.
+ *   - **A run is confirmed, not assumed.** An `accepted` row names a run id
+ *     before the run finishes, and the legacy workflow branch keeps its
+ *     `accepted` row and its HTTP 200 even when the launch is skipped or
+ *     throws. So the named run is looked up on the authenticated runs surface
+ *     before dispatch is claimed.
+ *   - **Everything else is named for what it was** — a suppressed replay, a
+ *     410/403/401 refusal, each of which the receive endpoint reports for
+ *     itself — or reported as "dispatch unconfirmed", which is where a
+ *     handshake short-circuit (it can legally answer 200 `{received:true}`
+ *     before any dispatch) and a 202 non-dispatch land, since neither records
+ *     a correlatable row. Only a confirmed dispatch exits `0`.
+ */
+import { fetchWithTLS } from "./fetch.js";
+/** ~5 attempts over ~4 s: the accepted row is written before execution ends. */
+export const DELIVER_POLL_ATTEMPTS = 5;
+export const DELIVER_POLL_INTERVAL_MS = 800;
+/** Cursor pages walked per attempt, so a busy log cannot outrun the poll. */
+export const DELIVER_PAGE_CAP = 10;
+export const DELIVER_PAGE_LIMIT = 25;
+/** The same bound on the runs surface, where runs start while this one waits. */
+export const DELIVER_RUN_PAGE_CAP = 5;
+export const DELIVER_RUN_PAGE_LIMIT = 50;
+/** Comfortably above the sync-function ceiling. */
+export const DELIVER_TIMEOUT_MS = 60_000;
+/**
+ * What the user is told before a delivery happens, in the terminal rather than
+ * only in the guide: a diagnostic that mutates the app has to say so where the
+ * user is looking (criterion 4).
+ */
+export function deliveryNotice(scheme) {
+    const lines = [
+        "This is a real delivery: the signed body is posted to the webhook's " +
+            "receive endpoint, a real event row is written to the delivery log, and " +
+            "the signed body's dedup key is spent — delivering these exact bytes " +
+            "again is suppressed as a replay.",
+    ];
+    if (scheme === "github") {
+        lines.push("On the 'github' scheme dedup entries never expire, so this body can " +
+            "never be delivered to this webhook again. Vary the payload between " +
+            "test deliveries.");
+    }
+    return lines;
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * The one correlation rule: the newest row above `baselineEventId` whose
+ * `dedupKey` equals this preview's.
+ *
+ * The walk is newest-first and follows `nextCursor`, stopping at the baseline
+ * row (every row below it predates this delivery) or at `pageCap`. A null
+ * baseline means the log was empty when the snapshot was taken, so every row
+ * walked is a candidate.
+ */
+export async function findDeliveryEvent(input) {
+    const pageCap = input.pageCap ?? DELIVER_PAGE_CAP;
+    const pageLimit = input.pageLimit ?? DELIVER_PAGE_LIMIT;
+    let cursor;
+    for (let page = 0; page < pageCap; page++) {
+        const result = await input.client.listWebhookEvents(input.appId, input.webhookId, { limit: pageLimit, ...(cursor ? { cursor } : {}) });
+        for (const row of result.items || []) {
+            if (input.baselineEventId && row.eventId === input.baselineEventId) {
+                return null;
+            }
+            if (row.dedupKey && row.dedupKey === input.dedupKey)
+                return row;
+        }
+        if (!result.nextCursor)
+            return null;
+        cursor = result.nextCursor;
+    }
+    return null;
+}
+/**
+ * Poll `findDeliveryEvent` within the budget — the row lands asynchronously.
+ *
+ * A failed read is retried rather than thrown: the delivery has already
+ * happened by the time this runs, so a network blip or an expired credential
+ * on the way to the log must not abort the command and lose the report of what
+ * was delivered. The last error is returned alongside an unresolved row so the
+ * caller can say why it is unconfirmed.
+ */
+async function pollForDeliveryEvent(input) {
+    let error = null;
+    for (let attempt = 0; attempt < input.attempts; attempt++) {
+        try {
+            const found = await findDeliveryEvent(input);
+            if (found)
+                return { event: found, error: null };
+            error = null;
+        }
+        catch (err) {
+            error = messageOf(err);
+        }
+        if (attempt < input.attempts - 1)
+            await input.sleep(input.intervalMs);
+    }
+    return { event: null, error };
+}
+function messageOf(err) {
+    return err?.message ? String(err.message) : String(err);
+}
+/**
+ * Confirm the run an `accepted` row names really exists.
+ *
+ * A function-owned row is confirmed on `functions/{id}/runs`, the only surface
+ * that lists a function run. A legacy row is confirmed on the workflow runs
+ * surface, which needs the webhook's `workflowId` — a legacy row is visible to
+ * `webhooks get`, so that read is available (a function-owned row's is not,
+ * which is why the preview publishes `functionId`).
+ */
+async function confirmRun(input) {
+    const { client, appId, event } = input;
+    const runId = (event.workflowRunId || event.workflowRunKey || null);
+    if (!runId) {
+        return {
+            runId: null,
+            confirmed: false,
+            surface: null,
+            reason: "the accepted delivery row names no run",
+        };
+    }
+    const matches = (row) => row?.runId === runId ||
+        row?.runKey === runId ||
+        (event.workflowRunKey && row?.runKey === event.workflowRunKey) ||
+        (event.workflowRunId && row?.runId === event.workflowRunId);
+    if (input.functionId) {
+        try {
+            const found = await findRun((params) => client.listFunctionRuns(appId, input.functionId, params), matches, input);
+            return {
+                runId,
+                confirmed: found,
+                surface: "function",
+                reason: found ? null : `run ${runId} is not on the function's runs`,
+            };
+        }
+        catch (err) {
+            return {
+                runId,
+                confirmed: false,
+                surface: "function",
+                reason: `the runs surface could not be read: ${messageOf(err)}`,
+            };
+        }
+    }
+    try {
+        const webhook = await client.getWebhook(appId, input.webhookId);
+        const workflowId = webhook?.workflowId;
+        if (!workflowId) {
+            return {
+                runId,
+                confirmed: false,
+                surface: null,
+                reason: "the webhook names no workflow to confirm the run against",
+            };
+        }
+        const found = await findRun((params) => client.listWorkflowRuns(appId, workflowId, params), matches, input);
+        return {
+            runId,
+            confirmed: found,
+            surface: "workflow",
+            reason: found ? null : `run ${runId} is not on the workflow's runs`,
+        };
+    }
+    catch (err) {
+        return {
+            runId,
+            confirmed: false,
+            surface: "workflow",
+            reason: `the runs surface could not be read: ${messageOf(err)}`,
+        };
+    }
+}
+/**
+ * Walk a runs listing, newest first, for the run the delivery row names.
+ *
+ * Both runs surfaces are cursor-paginated and newest-first, and a synchronous
+ * delivery holds this flow open while other runs start, so the newest page is
+ * not a safe place to stop looking: enough newer runs push this one off it and
+ * a real, inspectable run reads as unconfirmed. Following the cursor within a
+ * bounded page budget is the same shape the delivery log walk uses, and for the
+ * same reason.
+ */
+async function findRun(list, matches, bounds) {
+    const pageCap = bounds.runPageCap ?? DELIVER_RUN_PAGE_CAP;
+    const pageLimit = bounds.runPageLimit ?? DELIVER_RUN_PAGE_LIMIT;
+    let cursor;
+    for (let page = 0; page < pageCap; page++) {
+        const result = await list({
+            limit: pageLimit,
+            ...(cursor ? { cursor } : {}),
+        });
+        if ((result.items || []).some(matches))
+            return true;
+        if (!result.nextCursor)
+            return false;
+        cursor = result.nextCursor;
+    }
+    return false;
+}
+const eventsHint = (webhookId) => `Read the delivery log with \`primitive webhooks events ${webhookId}\`.`;
+/**
+ * The transport the delivery goes out on.
+ *
+ * The same one every other CLI request uses: a local dev server may speak
+ * HTTPS on localhost with a self-signed certificate, which `fetchWithTLS`
+ * accepts and bare `fetch` rejects. Sending the delivery on a different
+ * transport from the preview would fail exactly where this command is most
+ * used, and report it as "sent, dispatch unconfirmed" — the request never left.
+ * The receive endpoint is unauthenticated, so nothing else about the request
+ * changes: only the preview's bytes and its signature headers go out.
+ */
+const deliveryFetch = (url, init) => fetchWithTLS(url, init);
+/** POST the preview's bytes to the receive endpoint, verbatim. */
+async function postDelivery(input) {
+    const attempt = {
+        url: input.url,
+        sent: true,
+        status: null,
+        body: null,
+        duplicate: false,
+        error: null,
+    };
+    const controller = typeof AbortController === "function" ? new AbortController() : null;
+    // Two bounds, because the localhost-HTTPS transport issues its own request
+    // and honours no abort signal: the signal stops a `fetch`, and losing the
+    // race stops the wait either way.
+    let timer = null;
+    const expiry = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            controller?.abort();
+            reject(new Error(`no response within ${input.timeoutMs}ms`));
+        }, input.timeoutMs);
+    });
+    try {
+        const response = await Promise.race([
+            input.fetchImpl(input.url, {
+                method: "POST",
+                headers: { ...input.preview.signatureHeaders },
+                body: input.preview.rawBody,
+                ...(controller ? { signal: controller.signal } : {}),
+            }),
+            expiry,
+        ]);
+        attempt.status = response?.status ?? null;
+        const text = typeof response?.text === "function" ? await response.text() : "";
+        try {
+            attempt.body = text ? JSON.parse(text) : null;
+        }
+        catch {
+            attempt.body = text || null;
+        }
+        attempt.duplicate = attempt.body?.duplicate === true;
+    }
+    catch (err) {
+        attempt.error = messageOf(err);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+    return attempt;
+}
+/**
+ * Preview, deliver, correlate, confirm — the whole flow, as one result a caller
+ * renders however it likes.
+ */
+export async function deliverWebhookTest(input, deps) {
+    const client = deps.client;
+    const fetchImpl = deps.fetchImpl ?? deliveryFetch;
+    const sleep = deps.sleep ?? defaultSleep;
+    const base = {
+        outcome: "unconfirmed",
+        headline: "",
+        details: [],
+        notice: [],
+        preview: null,
+        refusal: null,
+        delivery: null,
+        event: null,
+        run: null,
+    };
+    // 1. The correlation baseline, BEFORE anything is delivered. Its job is to
+    //    scope the match to rows this delivery could have written, so a row left
+    //    by an earlier delivery of the same signed bytes is never claimed here.
+    //    Never the client clock: server and client clocks are not synchronized.
+    let baselineEventId = null;
+    try {
+        const page = await client.listWebhookEvents(input.appId, input.webhookId, {
+            limit: 1,
+        });
+        baselineEventId = page.items?.[0]?.eventId ?? null;
+    }
+    catch (err) {
+        return {
+            ...base,
+            outcome: "refused",
+            refusal: { message: messageOf(err), code: err?.code ?? null },
+            headline: "The delivery log could not be read, so a delivery could not be " +
+                `correlated to its event row. Nothing was delivered: ${messageOf(err)}`,
+        };
+    }
+    // 2. The preview, unchanged — every existing refusal propagates as it does
+    //    without `--deliver`, and refuses before anything is delivered.
+    let preview;
+    try {
+        preview = (await client.testWebhook(input.appId, input.webhookId, input.payload ?? {}));
+    }
+    catch (err) {
+        return {
+            ...base,
+            outcome: "refused",
+            refusal: { message: messageOf(err), code: err?.code ?? null },
+            headline: `The preview was refused, so nothing was delivered: ${messageOf(err)}`,
+        };
+    }
+    // 3. The receive path. `webhooks get` answers 404 for a function-owned
+    //    trigger row, so the preview is normally where the key comes from; the
+    //    fallback is for a server that predates #3321.
+    let webhookKey = preview.webhookKey ?? null;
+    if (!webhookKey) {
+        try {
+            const webhook = await client.getWebhook(input.appId, input.webhookId);
+            webhookKey = webhook?.webhookKey ?? null;
+        }
+        catch {
+            webhookKey = null;
+        }
+    }
+    if (!webhookKey) {
+        return {
+            ...base,
+            preview,
+            outcome: "refused",
+            refusal: {
+                message: "this server's webhook preview does not report the receive path " +
+                    "for this webhook, so --deliver cannot address it — upgrade the " +
+                    "platform, or post the signed body from `--json` to " +
+                    "`/app/{appId}/webhook/{webhookKey}` yourself",
+                code: "WEBHOOK_DELIVER_UNSUPPORTED",
+            },
+            headline: "Nothing was delivered: this server does not report the webhook's " +
+                "receive path, so --deliver cannot address it. Upgrade the platform.",
+        };
+    }
+    const notice = deliveryNotice(preview.verificationScheme);
+    deps.onBeforeDeliver?.(notice);
+    const url = `${input.serverUrl.replace(/\/$/, "")}/app/${input.appId}/webhook/${webhookKey}`;
+    const delivery = await postDelivery({
+        url,
+        preview,
+        fetchImpl,
+        timeoutMs: deps.timeoutMs ?? DELIVER_TIMEOUT_MS,
+    });
+    const resolved = { ...base, notice, preview, delivery };
+    // 4. The refusals the receive path reports for itself. Each is positive
+    //    evidence that nothing was dispatched, so none of them needs the log.
+    const refusalHeadline = (message, details = []) => ({
+        ...resolved,
+        outcome: "refused",
+        headline: message,
+        details,
+    });
+    if (delivery.status === 410) {
+        return refusalHeadline("The receive endpoint refused the delivery: this webhook is not in " +
+            "service (410), so nothing ran.", [
+            `Put it back in service with \`primitive webhooks enable ${input.webhookId}\`, ` +
+                "or, for a function's trigger, re-push its config.",
+        ]);
+    }
+    if (delivery.status === 403) {
+        return refusalHeadline("The receive endpoint refused the delivery (403): this client's IP is " +
+            "not on the webhook's IP allowlist, so nothing ran.");
+    }
+    if (delivery.status === 401) {
+        return refusalHeadline("The receive endpoint rejected the delivery's signature (401), so " +
+            "nothing ran.", [eventsHint(input.webhookId)]);
+    }
+    if (delivery.duplicate) {
+        return refusalHeadline("The delivery was suppressed as a replay (duplicate): these signed " +
+            "bytes were delivered to this webhook before, so nothing ran.", preview.verificationScheme === "github"
+            ? [
+                "On the 'github' scheme dedup entries never expire, so this body " +
+                    "can never be delivered to this webhook again — vary the payload.",
+                eventsHint(input.webhookId),
+            ]
+            : [eventsHint(input.webhookId)]);
+    }
+    // 5. Correlate. One rule, and it needs the preview's key: scheme `none`
+    //    derives one only from a caller-supplied `X-Webhook-Event-Id`, so a
+    //    `none` delivery is reported uncorrelated rather than guessed at.
+    const unconfirmed = (reason, details = []) => ({
+        ...resolved,
+        outcome: "unconfirmed",
+        headline: `The delivery was sent, but dispatch is unconfirmed: ${reason}`,
+        details: [...details, eventsHint(input.webhookId)],
+    });
+    const httpSummary = delivery.error
+        ? `the request was sent but no response was observed (${delivery.error})`
+        : `the receive endpoint answered ${delivery.status}`;
+    if (!preview.dedupKey) {
+        return unconfirmed(`the '${preview.verificationScheme}' scheme derives no dedup key, so ` +
+            `this delivery's event row cannot be identified — ${httpSummary}.`);
+    }
+    const { event, error: logError } = await pollForDeliveryEvent({
+        client,
+        appId: input.appId,
+        webhookId: input.webhookId,
+        dedupKey: preview.dedupKey,
+        baselineEventId,
+        attempts: deps.pollAttempts ?? DELIVER_POLL_ATTEMPTS,
+        intervalMs: deps.pollIntervalMs ?? DELIVER_POLL_INTERVAL_MS,
+        pageCap: deps.pageCap ?? DELIVER_PAGE_CAP,
+        pageLimit: deps.pageLimit ?? DELIVER_PAGE_LIMIT,
+        sleep,
+    });
+    if (!event) {
+        // The read itself failed — say that, rather than implying the receiver
+        // recorded nothing.
+        if (logError) {
+            return unconfirmed(`the delivery log could not be read (${logError}) — ${httpSummary}.`);
+        }
+        // The log was read and holds no row carrying this key. That is more than
+        // "not found": the receiver records the key ONLY on a delivery it accepted
+        // and dispatched, so this delivery was not dispatched — unless its row has
+        // yet to become visible, which is the one thing this cannot rule out.
+        return unconfirmed(`no dispatched-delivery row carrying this request's dedup key became ` +
+            `visible — ${httpSummary}.`, [
+            "The receiver records that key only on a delivery it accepted and " +
+                "dispatched, so this one was most likely short-circuited by a " +
+                "handshake rule, suppressed as a replay, or acknowledged without " +
+                "dispatch (a 202 with its reason). The delivery log names which.",
+        ]);
+    }
+    resolved.event = event;
+    // 6. Claim a dispatch only with a run behind it. A row carrying the key is
+    //    an `accepted`, dispatched row by the receiver's own contract; the guard
+    //    is here so a server that ever widened the key reads as unconfirmed
+    //    rather than as a dispatch nobody checked.
+    if (event.status !== "accepted") {
+        const reason = event.rejectionReason || event.status || "no reason recorded";
+        return unconfirmed(`the correlated row (event ${event.eventId}) is recorded as ` +
+            `'${event.status}', not as a dispatched delivery: ${reason}.`);
+    }
+    const run = await confirmRun({
+        client,
+        appId: input.appId,
+        webhookId: input.webhookId,
+        functionId: preview.functionId,
+        event,
+        ...(deps.runPageCap !== undefined ? { runPageCap: deps.runPageCap } : {}),
+        ...(deps.runPageLimit !== undefined
+            ? { runPageLimit: deps.runPageLimit }
+            : {}),
+    });
+    resolved.run = run;
+    if (!run.confirmed) {
+        return {
+            ...resolved,
+            outcome: "unconfirmed",
+            headline: `The delivery was accepted (event ${event.eventId}), but dispatch is ` +
+                `unconfirmed: ${run.reason}.`,
+            details: [eventsHint(input.webhookId)],
+        };
+    }
+    const inspect = preview.functionId
+        ? `Inspect it with \`primitive functions runs ${preview.functionId}\`.`
+        : "Inspect it with `primitive workflows runs <workflow-id>`.";
+    return {
+        ...resolved,
+        outcome: "dispatched",
+        headline: `Delivered through the real webhook path. Event ${event.eventId} ` +
+            `dispatched; run ${run.runId} records the outcome.`,
+        details: [inspect],
+    };
+}
+//# sourceMappingURL=webhook-deliver.js.map

package/dist/src/lib/webhook-deliver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-deliver.js","sourceRoot":"","sources":["../../../src/lib/webhook-deliver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAgI1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAC5C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,mDAAmD;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG;QACZ,sEAAsE;YACpE,yEAAyE;YACzE,sEAAsE;YACtE,kCAAkC;KACrC,CAAC;IACF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,sEAAsE;YACpE,qEAAqE;YACrE,kBAAkB,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,EAAE,CAClC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAQvC;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CACjD,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,SAAS,EACf,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACpD,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,eAAe,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,eAAe,EAAE,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,KAWnC;IACC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAChD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,CAAC,QAAQ,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,GAAQ;IACzB,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CAAC,KAQzB;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI,CAE1D,CAAC;IACT,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,wCAAwC;SACjD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAQ,EAAE,EAAE,CAC3B,GAAG,EAAE,KAAK,KAAK,KAAK;QACpB,GAAG,EAAE,MAAM,KAAK,KAAK;QACrB,CAAC,KAAK,CAAC,cAAc,IAAI,GAAG,EAAE,MAAM,KAAK,KAAK,CAAC,cAAc,CAAC;QAC9D,CAAC,KAAK,CAAC,aAAa,IAAI,GAAG,EAAE,KAAK,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC;IAE9D,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,UAAW,EAAE,MAAM,CAAC,EACrE,OAAO,EACP,KAAK,CACN,CAAC;YACF,OAAO;gBACL,KAAK;gBACL,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,gCAAgC;aACpE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,KAAK;gBACL,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,uCAAuC,SAAS,CAAC,GAAG,CAAC,EAAE;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,KAAK;gBACL,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,0DAA0D;aACnE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAC9D,OAAO,EACP,KAAK,CACN,CAAC;QACF,OAAO;YACL,KAAK;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,gCAAgC;SACpE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK;YACL,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,uCAAuC,SAAS,CAAC,GAAG,CAAC,EAAE;SAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,OAAO,CACpB,IAAsE,EACtE,OAA8B,EAC9B,MAAsD;IAEtD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,oBAAoB,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,IAAI,sBAAsB,CAAC;IAChE,IAAI,MAA0B,CAAC;IAC/B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,KAAK,EAAE,SAAS;YAChB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,EAAE,CACvC,0DAA0D,SAAS,KAAK,CAAC;AAE3E;;;;;;;;;;GAUG;AACH,MAAM,aAAa,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAExE,kEAAkE;AAClE,KAAK,UAAU,YAAY,CAAC,KAK3B;IACC,MAAM,OAAO,GAAoB;QAC/B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,IAAI;KACZ,CAAC;IACF,MAAM,UAAU,GACd,OAAO,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,2EAA2E;IAC3E,0EAA0E;IAC1E,kCAAkC;IAClC,IAAI,KAAK,GAAQ,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC9C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAClC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE;gBAC9C,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;gBAC3B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC;YACF,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,QAAQ,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAmB,EACnB,IAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAkB;QAC1B,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,IAAI;KACV,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE;YACxE,KAAK,EAAE,CAAC;SACT,CAAC,CAAC;QACH,eAAe,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAG,GAAW,EAAE,IAAI,IAAI,IAAI,EAAE;YACtE,QAAQ,EACN,iEAAiE;gBACjE,uDAAuD,SAAS,CAAC,GAAG,CAAC,EAAE;SAC1E,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,OAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CACjC,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,OAAO,IAAI,EAAE,CACpB,CAAmB,CAAC;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAG,GAAW,EAAE,IAAI,IAAI,IAAI,EAAE;YACtE,QAAQ,EAAE,sDAAsD,SAAS,CAAC,GAAG,CAAC,EAAE;SACjF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,2EAA2E;IAC3E,mDAAmD;IACnD,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACtE,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,GAAG,IAAI;YACP,OAAO;YACP,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE;gBACP,OAAO,EACL,iEAAiE;oBACjE,iEAAiE;oBACjE,qDAAqD;oBACrD,8CAA8C;gBAChD,IAAI,EAAE,6BAA6B;aACpC;YACD,QAAQ,EACN,mEAAmE;gBACnE,qEAAqE;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,KAAK,YAAY,UAAU,EAAE,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC;QAClC,GAAG;QACH,OAAO;QACP,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;KAChD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAEvE,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,UAAoB,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,GAAG,QAAQ;QACX,OAAO,EAAE,SAAkB;QAC3B,QAAQ,EAAE,OAAO;QACjB,OAAO;KACR,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,eAAe,CACpB,oEAAoE;YAClE,gCAAgC,EAClC;YACE,2DAA2D,KAAK,CAAC,SAAS,MAAM;gBAC9E,mDAAmD;SACtD,CACF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,eAAe,CACpB,uEAAuE;YACrE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,eAAe,CACpB,mEAAmE;YACjE,cAAc,EAChB,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAC9B,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,eAAe,CACpB,oEAAoE;YAClE,8DAA8D,EAChE,OAAO,CAAC,kBAAkB,KAAK,QAAQ;YACrC,CAAC,CAAC;gBACE,kEAAkE;oBAChE,kEAAkE;gBACpE,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;aAC5B;YACH,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAClC,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,UAAoB,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,GAAG,QAAQ;QACX,OAAO,EAAE,aAAsB;QAC/B,QAAQ,EAAE,uDAAuD,MAAM,EAAE;QACzE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;KACnD,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK;QAChC,CAAC,CAAC,sDAAsD,QAAQ,CAAC,KAAK,GAAG;QACzE,CAAC,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAEvD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,WAAW,CAChB,QAAQ,OAAO,CAAC,kBAAkB,oCAAoC;YACpE,oDAAoD,WAAW,GAAG,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,oBAAoB,CAAC;QAC5D,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe;QACf,QAAQ,EAAE,IAAI,CAAC,YAAY,IAAI,qBAAqB;QACpD,UAAU,EAAE,IAAI,CAAC,cAAc,IAAI,wBAAwB;QAC3D,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gBAAgB;QACzC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;QAC/C,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,uEAAuE;QACvE,oBAAoB;QACpB,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,WAAW,CAChB,uCAAuC,QAAQ,OAAO,WAAW,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,OAAO,WAAW,CAChB,sEAAsE;YACpE,aAAa,WAAW,GAAG,EAC7B;YACE,mEAAmE;gBACjE,+DAA+D;gBAC/D,kEAAkE;gBAClE,iEAAiE;SACpE,CACF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;IAEvB,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,MAAM,IAAI,oBAAoB,CAAC;QAC7E,OAAO,WAAW,CAChB,6BAA6B,KAAK,CAAC,OAAO,mBAAmB;YAC3D,IAAI,KAAK,CAAC,MAAM,oCAAoC,MAAM,GAAG,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;QAC3B,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC;IAEnB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO;YACL,GAAG,QAAQ;YACX,OAAO,EAAE,aAAa;YACtB,QAAQ,EACN,oCAAoC,KAAK,CAAC,OAAO,qBAAqB;gBACtE,gBAAgB,GAAG,CAAC,MAAM,GAAG;YAC/B,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU;QAChC,CAAC,CAAC,8CAA8C,OAAO,CAAC,UAAU,KAAK;QACvE,CAAC,CAAC,2DAA2D,CAAC;IAChE,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,YAAY;QACrB,QAAQ,EACN,kDAAkD,KAAK,CAAC,OAAO,GAAG;YAClE,mBAAmB,GAAG,CAAC,KAAK,uBAAuB;QACrD,OAAO,EAAE,CAAC,OAAO,CAAC;KACnB,CAAC;AACJ,CAAC"}

package/dist/src/lib/workflow-codegen/generator.d.ts

@@ -1,7 +1,7 @@
 /**
  * `workflows codegen` orchestrator (issue #1442).
  *
- * Reads synced workflow TOMLs (`.primitive/sync/<env>/<appId>/workflows/*.toml`)
+ * Reads synced workflow TOMLs (`primitive/<env>/workflows/*.toml`)
  * and emits ONE generated file per workflow —
  * `workflows/generated/<key>.generated.ts` — each containing the workflow's
  * `<Key>Input`/`<Key>Output` types plus a typed `<key>(client)` invoker factory

package/dist/src/lib/workflow-codegen/generator.js

@@ -1,7 +1,7 @@
 /**
  * `workflows codegen` orchestrator (issue #1442).
  *
- * Reads synced workflow TOMLs (`.primitive/sync/<env>/<appId>/workflows/*.toml`)
+ * Reads synced workflow TOMLs (`primitive/<env>/workflows/*.toml`)
  * and emits ONE generated file per workflow —
  * `workflows/generated/<key>.generated.ts` — each containing the workflow's
  * `<Key>Input`/`<Key>Output` types plus a typed `<key>(client)` invoker factory

package/dist/src/lib/workflow-toml-validator.d.ts

@@ -84,14 +84,23 @@ export type WorkflowTomlError = {
  * `runAs = "system"` + a non-empty `accessRule` is dead config: a system run
  * can only be started by the system and never evaluates its accessRule, so any
  * non-empty rule is inert. The server rejects this at save time (#1258,
- * `src/workflows/definition-store.ts:271-280`); catching it locally keeps
- * `config push` all-or-nothing instead of failing mid-push and leaving partial
- * server state (#1418 drift).
- *
- * Mirrors the server predicate byte-for-byte: returns the sentinel error only
- * when `runAs === "system"` AND `typeof accessRule === "string"` AND
- * `accessRule.trim() !== ""`. Default/unset/empty/whitespace-only runAs or
- * accessRule (and a bare non-string boolean accessRule) return `null`.
+ * `src/workflows/config/workflow-save-rules.ts`); catching it locally puts the
+ * refusal in the PREFLIGHT, which aborts before the first mutating call, rather
+ * than mid-apply after earlier entities have been written (#1418 drift).
+ *
+ * "All-or-nothing", which this comment used to claim, was never what push
+ * offers and is corrected here (#3320): the preflight is all-or-nothing, and
+ * the apply stage that follows it is incremental and convergent with no
+ * rollback. See `config push --help`.
+ *
+ * Delegates the decision to the server's own predicate,
+ * `checkWorkflowSystemAccessRule` (#3374, vendored from
+ * `src/config-surface/workflow-rules.ts`): the sentinel is returned exactly
+ * when it reports a violation — `runAs === "system"` with a non-empty string
+ * `accessRule`. Default/unset/empty/whitespace-only runAs or accessRule (and a
+ * bare non-string boolean accessRule) return `null`. Only the HINT is this
+ * module's: it names the preflight remedy, where the server's sentence names
+ * the save-time one.
  *
  * @param workflow The workflow-metadata object — the `[workflow]` table, or
  *   for commands that accept unwrapped root-level metadata, the root TOML

package/dist/src/lib/workflow-toml-validator.js

@@ -36,6 +36,10 @@ import { GENERATED_ALLOWLISTED_FIELDS, GENERATED_KNOWN_KINDS, } from "./generate
 // `cli/scripts/gen-template-lint.mjs`) so push-time and save-time verdicts are
 // produced by the same code rather than a hand mirror.
 import { lintWorkflowStepTemplates } from "./generated-template-lint.js";
+// #3374 — the `runAs = "system"` + `accessRule` predicate is the server's own,
+// vendored from `src/config-surface/workflow-rules.ts`; this module renders
+// the CLI's hint from its answer rather than restating the conjunction.
+import { checkWorkflowSystemAccessRule } from "./generated-config-surfaces.js";
 /**
  * Universal-and-consumed allowlist of top-level fields permitted on a step
  * (known kinds). Generated from the runners; see header.
@@ -70,14 +74,23 @@ export const KNOWN_KINDS_FOR_DRIFT_GUARD = KNOWN_KINDS;
  * `runAs = "system"` + a non-empty `accessRule` is dead config: a system run
  * can only be started by the system and never evaluates its accessRule, so any
  * non-empty rule is inert. The server rejects this at save time (#1258,
- * `src/workflows/definition-store.ts:271-280`); catching it locally keeps
- * `config push` all-or-nothing instead of failing mid-push and leaving partial
- * server state (#1418 drift).
+ * `src/workflows/config/workflow-save-rules.ts`); catching it locally puts the
+ * refusal in the PREFLIGHT, which aborts before the first mutating call, rather
+ * than mid-apply after earlier entities have been written (#1418 drift).
  *
- * Mirrors the server predicate byte-for-byte: returns the sentinel error only
- * when `runAs === "system"` AND `typeof accessRule === "string"` AND
- * `accessRule.trim() !== ""`. Default/unset/empty/whitespace-only runAs or
- * accessRule (and a bare non-string boolean accessRule) return `null`.
+ * "All-or-nothing", which this comment used to claim, was never what push
+ * offers and is corrected here (#3320): the preflight is all-or-nothing, and
+ * the apply stage that follows it is incremental and convergent with no
+ * rollback. See `config push --help`.
+ *
+ * Delegates the decision to the server's own predicate,
+ * `checkWorkflowSystemAccessRule` (#3374, vendored from
+ * `src/config-surface/workflow-rules.ts`): the sentinel is returned exactly
+ * when it reports a violation — `runAs === "system"` with a non-empty string
+ * `accessRule`. Default/unset/empty/whitespace-only runAs or accessRule (and a
+ * bare non-string boolean accessRule) return `null`. Only the HINT is this
+ * module's: it names the preflight remedy, where the server's sentence names
+ * the save-time one.
  *
  * @param workflow The workflow-metadata object — the `[workflow]` table, or
  *   for commands that accept unwrapped root-level metadata, the root TOML
@@ -89,11 +102,11 @@ export function validateWorkflowIdentity(workflow) {
         Array.isArray(workflow)) {
         return null;
     }
-    const runAs = workflow.runAs;
-    const accessRule = workflow.accessRule;
-    if (runAs === "system" &&
-        typeof accessRule === "string" &&
-        accessRule.trim() !== "") {
+    const violation = checkWorkflowSystemAccessRule({
+        runAs: workflow.runAs,
+        accessRule: workflow.accessRule,
+    });
+    if (violation) {
         return {
             stepIndex: -1,
             stepId: null,