primitive-admin 1.1.0-alpha.6 → 1.1.0-alpha.60

package/dist/src/commands/vars.js

@@ -0,0 +1,96 @@
+import { ApiClient } from "../lib/api-client.js";
+import { resolveAppId } from "../lib/config.js";
+import { error, info, keyValue, formatTable, formatDate, json, } from "../lib/output.js";
+/**
+ * `primitive vars` — non-secret per-app config scalars (issue #1364). The
+ * plaintext twin of `primitive secrets`: same key format and limits, but
+ * values are NOT secret — `list` shows them, and they appear unmasked in
+ * debug traces. Never store a credential in a var; use `primitive secrets`.
+ */
+export function registerVarsCommands(program) {
+    const vars = program
+        .command("vars")
+        .description("Manage non-secret app config vars (values are visible; use secrets for credentials)")
+        .addHelpText("after", `
+Configuration lives in vars.toml — a flat KEY = "value" table at the root of
+the sync slot — and is applied with \`sync push\` (issue #2645):
+  $ primitive vars list
+  $ primitive config set vars ADMIN_GROUP_ID=grp_01ABC
+  $ primitive sync push --only var/ADMIN_GROUP_ID
+  # Remove a var by deleting its line and running: primitive sync push
+
+Vars bind into CEL rules via the declared \`vars.*\` namespace — declare them
+with \`vars = ["ADMIN_GROUP_ID"]\` in the config's access manifest.
+`);
+    // Get one var. Under TOML-only authoring `vars.toml` says what a var SHOULD
+    // be; this says what the server has, which is the question `sync diff`
+    // answers for a whole slot and nobody could ask about a single key.
+    vars
+        .command("get")
+        .description("Show one config var as the server has it")
+        .argument("<key>", "Var key, e.g. ADMIN_GROUP_ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (key, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const varsList = await client.listAppConfigVars(resolvedAppId);
+            // Exact-key match only: the vars API is app-scoped and keys are
+            // case-sensitive (^[A-Z][A-Z0-9_]{0,63}$), so a fuzzy match could show
+            // the operator a different var than the one they asked about.
+            const found = (varsList ?? []).find((v) => v.key === key);
+            if (!found) {
+                error(`No config var '${key}' in this app. Run 'primitive vars list' to see them.`);
+                process.exit(1);
+            }
+            if (options.json) {
+                json(found);
+                return;
+            }
+            keyValue("Key", found.key);
+            keyValue("Value", String(found.value ?? ""));
+            if (found.summary)
+                keyValue("Summary", found.summary);
+            keyValue("Created", formatDate(found.createdAt));
+            keyValue("Updated", formatDate(found.updatedAt));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // List vars (values shown — non-secret)
+    vars
+        .command("list")
+        .description("List all config vars for an app (values are shown)")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const varsList = await client.listAppConfigVars(resolvedAppId);
+            if (options.json) {
+                json(varsList);
+                return;
+            }
+            if (!varsList || varsList.length === 0) {
+                info("No vars found.");
+                return;
+            }
+            console.log(formatTable(varsList, [
+                { header: "KEY", key: "key" },
+                { header: "VALUE", key: "value" },
+                { header: "SUMMARY", key: "summary" },
+                { header: "CREATED", key: "createdAt", format: formatDate },
+                { header: "UPDATED", key: "updatedAt", format: formatDate },
+            ]));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=vars.js.map

package/dist/src/commands/vars.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vars.js","sourceRoot":"","sources":["../../../src/commands/vars.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,IAAI,GACL,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,qFAAqF,CAAC;SAClG,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;CAUzB,CAAC,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,IAAI;SACD,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,0CAA0C,CAAC;SACvD,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC;SACjD,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YAC/D,gEAAgE;YAChE,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,KAAK,CACH,kBAAkB,GAAG,uDAAuD,CAC7E,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,KAAK,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YAED,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,OAAO;gBAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACtD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACjD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,wCAAwC;IACxC,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oDAAoD,CAAC;SACjE,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YAE/D,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,QAAQ,EAAE;gBACpB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;gBAC7B,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE;gBACjC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE;gBACrC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;gBAC3D,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;aAC5D,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/waitlist.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerWaitlistCommands(program: Command): void;

package/dist/src/commands/waitlist.js

@@ -1,6 +1,7 @@
 import { ApiClient } from "../lib/api-client.js";
 import { resolveAppId } from "../lib/config.js";
 import { success, error, info, formatTable, formatId, formatDate, json, } from "../lib/output.js";
+import { confirmPrompt } from "../lib/confirm-prompt.js";
 export function registerWaitlistCommands(program) {
     const waitlist = program
         .command("waitlist")
@@ -92,7 +93,7 @@ Examples:
         .description("Invite multiple waitlist entries")
         .argument("[app-id]", "App ID (uses current app if not specified)")
         .option("--app <app-id>", "App ID")
-        .option("--count <n>", "Number of entries to invite", "10")
+        .option("-n, --count <n>", "Number of entries to invite", "10")
         .option("--send-email", "Send invitation emails")
         .option("--signup-url <url>", "Custom signup URL")
         .option("--json", "Output as JSON")
@@ -140,15 +141,14 @@ Examples:
             process.exit(1);
         }
         if (!options.yes) {
-            const inquirer = await import("inquirer");
-            const { confirm } = await inquirer.default.prompt([
-                {
-                    type: "confirm",
-                    name: "confirm",
-                    message: `Remove waitlist entry ${waitlistId}?`,
-                    default: false,
-                },
-            ]);
+            let confirm;
+            try {
+                confirm = await confirmPrompt(`Remove waitlist entry ${waitlistId}?`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
             if (!confirm) {
                 info("Cancelled.");
                 return;

package/dist/src/commands/waitlist.js.map

@@ -1 +1 @@
-{"version":3,"file":"waitlist.js","sourceRoot":"","sources":["../../../src/commands/waitlist.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EAEJ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,IAAI,GACL,MAAM,kBAAkB,CAAC;AAE1B,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,mDAAmD,CAAC;SAChE,WAAW,CAAC,OAAO,EAAE;;;;;CAKzB,CAAC,CAAC;IAED,wBAAwB;IACxB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uBAAuB,CAAC;SACpC,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,OAAO,EAAE;gBACnB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACrD,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE;gBACjC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE;gBACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;gBACnC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE;aAChE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,wBAAwB;IACxB,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;SAC9C,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;SAC/C,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE;QAClE,IAAI,aAAqB,CAAC;QAC1B,IAAI,UAAkB,CAAC;QAEvB,IAAI,qBAAqB,EAAE,CAAC;YAC1B,aAAa,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACzD,UAAU,GAAG,qBAAqB,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjD,UAAU,GAAG,iBAAiB,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,UAAU,EAAE;gBACzE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,OAAO,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,cAAc;IACd,QAAQ;SACL,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,aAAa,EAAE,6BAA6B,EAAE,IAAI,CAAC;SAC1D,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC;SAChD,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE;gBAC5D,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,OAAO,CAAC,WAAW,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,mBAAmB,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,wBAAwB;IACxB,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yBAAyB,CAAC;SACtC,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;SAC9C,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE;QAClE,IAAI,aAAqB,CAAC;QAC1B,IAAI,UAAkB,CAAC;QAEvB,IAAI,qBAAqB,EAAE,CAAC;YAC1B,aAAa,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACzD,UAAU,GAAG,qBAAqB,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjD,UAAU,GAAG,iBAAiB,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;gBAChD;oBACE,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,yBAAyB,UAAU,GAAG;oBAC/C,OAAO,EAAE,KAAK;iBACf;aACF,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,YAAY,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,CAAC,kBAAkB,UAAU,WAAW,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"waitlist.js","sourceRoot":"","sources":["../../../src/commands/waitlist.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EAEJ,WAAW,EACX,QAAQ,EACR,UAAU,EACV,IAAI,GACL,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,mDAAmD,CAAC;SAChE,WAAW,CAAC,OAAO,EAAE;;;;;CAKzB,CAAC,CAAC;IAED,wBAAwB;IACxB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uBAAuB,CAAC;SACpC,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YAEzD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YAED,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,OAAO,EAAE;gBACnB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACrD,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE;gBACjC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE;gBACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE;gBACnC,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE;aAChE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,wBAAwB;IACxB,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;SAC9C,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC;SAC/C,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE;QAClE,IAAI,aAAqB,CAAC;QAC1B,IAAI,UAAkB,CAAC;QAEvB,IAAI,qBAAqB,EAAE,CAAC;YAC1B,aAAa,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACzD,UAAU,GAAG,qBAAqB,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjD,UAAU,GAAG,iBAAiB,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,UAAU,EAAE;gBACzE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,OAAO,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,cAAc;IACd,QAAQ;SACL,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,iBAAiB,EAAE,6BAA6B,EAAE,IAAI,CAAC;SAC9D,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC;SAChD,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,aAAa,EAAE;gBAC5D,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;gBACrC,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,OAAO,CAAC,WAAW,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,mBAAmB,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,wBAAwB;IACxB,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yBAAyB,CAAC;SACtC,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC;SAC9C,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE;QAClE,IAAI,aAAqB,CAAC;QAC1B,IAAI,UAAkB,CAAC;QAEvB,IAAI,qBAAqB,EAAE,CAAC;YAC1B,aAAa,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACzD,UAAU,GAAG,qBAAqB,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjD,UAAU,GAAG,iBAAiB,CAAC;QACjC,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,aAAa,CAAC,yBAAyB,UAAU,GAAG,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,YAAY,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC5D,OAAO,CAAC,kBAAkB,UAAU,WAAW,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/webhooks.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerWebhooksCommands(program: Command): void;

package/dist/src/commands/webhooks.js

@@ -0,0 +1,442 @@
+import { readFileSync, statSync } from "fs";
+import { ApiClient } from "../lib/api-client.js";
+import { resolveAppId } from "../lib/config.js";
+import { success, error, info, keyValue, result as printResult, formatTable, formatId, formatDate, formatStatus, json, divider, dim, warn, } from "../lib/output.js";
+import { assertSupportedFlags, buildWebhookEnvelope, } from "../lib/log-inspection.js";
+import { signingSecretStatusWarning, signingSecretHealthWarning, previousSigningSecretWarning, formatGracePeriodMs, } from "../lib/signing-secret-status.js";
+import { fetchAll } from "./sync.js";
+/**
+ * Platform ceiling on a webhook body (`MAX_WEBHOOK_BODY_BYTES_LIMIT`, 25 MiB).
+ * A per-webhook cap can be lower — that one is the server's call and comes back
+ * as a `body_too_large` verdict. This bound only stops the CLI from reading and
+ * encoding a file no webhook could ever accept.
+ */
+const MAX_VERIFY_BODY_BYTES = 25 * 1024 * 1024;
+export function registerWebhooksCommands(program) {
+    const webhooks = program
+        .command("webhooks")
+        .description("Manage inbound webhooks that trigger workflows")
+        .addHelpText("after", `
+Examples:
+  $ primitive webhooks list
+  $ primitive secrets set STRIPE_WEBHOOK_SECRET --value whsec_...
+  $ primitive config new webhook stripe-events   # then edit webhooks/stripe-events.toml and: primitive sync push
+  $ primitive webhooks get 01HXY...
+  $ primitive webhooks rotate-secret 01HXY... --secret "{{secrets.STRIPE_WEBHOOK_SECRET_NEXT}}"
+  $ primitive webhooks events 01HXY...
+  $ primitive webhooks test 01HXY... --payload '{"event":"test"}'
+  $ primitive webhooks verify 01HXY... --header 'Stripe-Signature: t=...,v1=...' --body-file captured.json
+`);
+    // Server-side configuration is authored in TOML and applied with `sync push`
+    // (issue #2645) — this group no longer carries config-setting flags.
+    webhooks.addHelpText("after", `
+Configuration lives in webhooks/<key>.toml:
+  $ primitive config fields webhook          # the file's keys, types and defaults
+  $ primitive config new webhook <key>       # scaffold one locally
+  $ primitive config set webhook/<key> <path>=<value>
+  $ primitive sync push --only webhook/<key>
+`);
+    // List webhooks
+    webhooks
+        .command("list")
+        .description("List webhooks")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .option("--app <app-id>", "App ID")
+        .option("--status <status>", "Filter by status: active, paused, archived")
+        .option("--json", "Output as JSON")
+        .action(async (appId, options) => {
+        const resolvedAppId = resolveAppId(appId, options);
+        const client = new ApiClient();
+        try {
+            // Drain every page (#2232). The admin list endpoint pages at 25 by
+            // default, so an app anywhere near the per-app webhook cap of 50 was
+            // silently truncated here — and this is the command an operator uses to
+            // find a webhook to hard-delete when a create is refused at the cap.
+            const items = await fetchAll((params) => client.listWebhooks(resolvedAppId, {
+                ...params,
+                status: options.status,
+            }));
+            if (options.json) {
+                json(items);
+                return;
+            }
+            if (!items || items.length === 0) {
+                info("No webhooks found.");
+                return;
+            }
+            console.log(formatTable(items, [
+                { header: "KEY", key: "webhookKey" },
+                { header: "NAME", key: "displayName" },
+                { header: "SCHEME", key: "verificationScheme" },
+                { header: "WORKFLOW", key: "workflowKey" },
+                { header: "STATUS", key: "status", format: formatStatus },
+                { header: "LAST TRIGGERED", key: "lastTriggeredAt", format: formatDate },
+            ]));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    webhooks
+        .command("get")
+        .description("Get webhook details")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.getWebhook(resolvedAppId, webhookId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            printResult("Webhook ID", result.webhookId);
+            printResult("Key", result.webhookKey);
+            printResult("Name", result.displayName);
+            printResult("Description", result.description || "-");
+            printResult("Status", formatStatus(result.status));
+            printResult("Workflow Key", result.workflowKey);
+            printResult("Verification Scheme", result.verificationScheme);
+            printResult("Signing Secret", result.signingSecret || "-");
+            printResult("Previous Signing Secret", result.previousSigningSecret || "-");
+            // The grace slot's own status, so an operator can tell "no previous
+            // key" from "a raw value is still live there" — both print the previous
+            // secret as `-`, because a withheld value is never echoed (#2383).
+            printResult("Previous Signing Secret Status", result.previousSigningSecretStatus || "-");
+            // A stored value that is not a reference is never echoed, so say what
+            // it is here rather than showing an empty field: a legacy literal from
+            // before reference-only still verifies deliveries, a malformed
+            // reference does not (#2332). Same wording as `sync pull`.
+            const signingSecretWarning = signingSecretStatusWarning(result.signingSecretStatus, {
+                subject: "Signing secret",
+                blocks: "this webhook cannot be updated or rotated",
+            });
+            if (signingSecretWarning)
+                warn(signingSecretWarning);
+            // The grace slot gets its own line: a raw value there keeps verifying
+            // deliveries even though the row's current slot reads as migrated
+            // (#2383). The lever is the grace period, not a migration.
+            const previousWarning = previousSigningSecretWarning(result.previousSigningSecretStatus, { subject: "Previous signing secret" });
+            if (previousWarning)
+                warn(previousWarning);
+            // The health axis, per slot — anything that is not `ok`.
+            const healthWarning = signingSecretHealthWarning(result.signingSecretHealth, { subject: "Signing secret" });
+            if (healthWarning)
+                warn(healthWarning);
+            const previousHealthWarning = signingSecretHealthWarning(result.previousSigningSecretHealth, { subject: "Previous signing secret" });
+            if (previousHealthWarning)
+                warn(previousHealthWarning);
+            divider();
+            info("Configuration:");
+            printResult("  Tolerance Seconds", String(result.toleranceSeconds ?? "-"));
+            printResult("  Deduplication", result.deduplicationEnabled ? "enabled" : "disabled");
+            printResult("  Dedup Window", result.deduplicationWindowMs ? `${result.deduplicationWindowMs}ms` : "-");
+            printResult("  Max Body Bytes", result.maxBodyBytes ? `${result.maxBodyBytes}` : "default (5 MiB)");
+            // Not a truthiness test: a stored `0` means immediate cutover, which is
+            // the opposite of the unset case's 24 h default (#2383).
+            printResult("  Grace Period", formatGracePeriodMs(result.secretGracePeriodMs));
+            printResult("  Allowed IPs", result.allowedIpCidrs || "-");
+            printResult("  Input Mapping", result.inputMapping || "-");
+            divider();
+            printResult("Last Triggered", result.lastTriggeredAt ? formatDate(result.lastTriggeredAt) : "never");
+            printResult("Created", formatDate(result.createdAt));
+            printResult("Modified", formatDate(result.modifiedAt));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    webhooks
+        .command("rotate-secret")
+        .description("Rotate the signing secret for a webhook")
+        .argument("<webhook-id>", "Webhook ID")
+        .requiredOption("--secret <ref>", "New signing secret, as a {{secrets.KEY}} reference to an app secret")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.rotateWebhookSecret(resolvedAppId, webhookId, {
+                signingSecret: options.secret,
+            });
+            if (options.json) {
+                json(result);
+                return;
+            }
+            // Rotation now returns the serialized webhook on both surfaces, and
+            // both references are plain text (the secret values live only in the
+            // secret store), so print them rather than a masked value.
+            success("Signing secret rotated.");
+            if (result.signingSecret) {
+                keyValue("Signing Secret", result.signingSecret);
+            }
+            if (result.previousSigningSecret) {
+                keyValue("Previous Signing Secret", result.previousSigningSecret);
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // List webhook events
+    webhooks
+        .command("events")
+        .description("View webhook event history")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--limit <n>", "Number of events to show", "20")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page")
+        // Declared so they can be rejected with a clear message instead of being
+        // silently ignored — status/time filtering on webhook events is deferred to
+        // Phase B (issue #1967). See assertSupportedFlags below.
+        .option("--status <status>", "(not supported yet — deferred to Phase B)")
+        .option("--from <iso>", "(not supported yet — deferred to Phase B)")
+        .option("--to <iso>", "(not supported yet — deferred to Phase B)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            // The webhook-events route serves limit + cursor only; reject the
+            // Phase B filters cleanly rather than dropping them silently.
+            assertSupportedFlags("webhook events", { status: options.status, from: options.from, to: options.to }, ["limit", "cursor"]);
+            const page = await client.listWebhookEvents(resolvedAppId, webhookId, {
+                limit: parseInt(options.limit),
+                ...(options.cursor && { cursor: options.cursor }),
+            });
+            if (options.json) {
+                json(buildWebhookEnvelope(page.items, page));
+                return;
+            }
+            const printCursorHint = () => {
+                if (!page.nextCursor)
+                    return;
+                console.log();
+                dim(`More events. Use --cursor ${page.nextCursor} for the next page.`);
+            };
+            if (!page.items || page.items.length === 0) {
+                info("No events found.");
+                printCursorHint();
+                return;
+            }
+            console.log(formatTable(page.items, [
+                { header: "EVENT ID", key: "eventId", format: formatId },
+                { header: "EXTERNAL ID", key: "externalEventId" },
+                { header: "STATUS", key: "status", format: formatStatus },
+                { header: "HTTP", key: "httpStatus" },
+                { header: "REASON", key: "rejectionReason" },
+                { header: "CREATED", key: "createdAt", format: formatDate },
+            ]));
+            printCursorHint();
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Test webhook
+    webhooks
+        .command("test")
+        .description("Sign a test payload for a webhook (returns body + headers)")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--payload <json>", "Test payload as JSON, signed verbatim. Pass the event " +
+        "object directly (e.g. '{\"type\":\"event\",\"data\":{…}}'); it is used " +
+        "as-is. Omit it to sign a canned webhook.test ping.")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+This command signs a payload and prints the signature headers and the signed
+body. It does NOT post them to the webhook's receive endpoint, so no workflow
+runs and no delivery is recorded — send the returned body with the returned
+headers to POST /app/{appId}/webhook/{webhookKey} yourself to do that.
+
+The value of --payload is signed exactly as given (WYSIWYG). A JSON object is
+used as the test body verbatim, so a wrapped payload such as '{"payload":{…}}'
+signs the literal wrapper — do not wrap the event. Omitting --payload (or
+passing a non-object such as an array) signs the canned
+{"type":"webhook.test", …} ping.
+`)
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        let payload = {};
+        if (options.payload) {
+            try {
+                payload = JSON.parse(options.payload);
+            }
+            catch {
+                error("Invalid JSON in --payload");
+                process.exit(1);
+            }
+        }
+        const client = new ApiClient();
+        try {
+            const result = await client.testWebhook(resolvedAppId, webhookId, payload);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            if (result.success) {
+                success("Test payload signed. Nothing was delivered — post the signed body " +
+                    "(--json shows the exact rawBody) with these headers to the " +
+                    "receive endpoint to trigger the workflow.");
+                if (result.signatureHeaders) {
+                    divider();
+                    info("Generated Signature Headers:");
+                    for (const [header, value] of Object.entries(result.signatureHeaders)) {
+                        keyValue(`  ${header}`, String(value));
+                    }
+                }
+                if (result.payload) {
+                    divider();
+                    info("Test Payload:");
+                    console.log(JSON.stringify(result.payload, null, 2));
+                }
+            }
+            else {
+                error(`Test failed: ${result.message || result.errorCode || "unknown error"}`);
+            }
+        }
+        catch (err) {
+            // The server refuses a preview it cannot sign with a coded 400 — the
+            // scheme holds only public key material, the row still stores a raw
+            // secret, the signing secret is unset or unresolvable (#2445). Print
+            // the machine-readable code alongside the message, the established
+            // convention here: the prose explains, the code is what an operator
+            // searches for or reports.
+            error(err?.code ? `${err.message} (${err.code})` : err.message);
+            process.exit(1);
+        }
+    });
+    // Verify a captured delivery's signature
+    webhooks
+        .command("verify")
+        .description("Check whether signature headers you captured verify against a webhook")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--header <name: value>", "A header from the captured delivery. Repeatable.", (value, previous) => [...(previous || []), value], [])
+        .option("--body <text>", "The captured delivery body, as text")
+        .option("--body-file <path>", "Read the captured delivery body from a file")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+Runs the webhook's configured verifier over the body and headers you supply and
+reports whether that signature checks out — the useful question when a real
+delivery was rejected 401, and the only way to check a scheme the platform holds
+only public key material for (discord, jwt, plaid), which \`webhooks test\`
+cannot preview.
+
+Nothing is delivered: no workflow runs, and no delivery is recorded (this check
+never appears in \`primitive webhooks events\`).
+
+It answers SIGNATURE verification only. A real delivery is also subject to the
+webhook's status and IP allowlist before verification, and to handshake rules
+and deduplication after it.
+
+Exits 0 when the signature verifies and non-zero otherwise, so it composes in a
+script.
+
+  $ primitive webhooks verify 01HXY... \\
+      --header 'Stripe-Signature: t=1754...,v1=abc...' \\
+      --body-file captured-delivery.json
+`)
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (options.body !== undefined && options.bodyFile !== undefined) {
+            error("Pass --body or --body-file, not both.");
+            process.exit(1);
+        }
+        let rawBody;
+        let bodyBase64;
+        if (options.bodyFile !== undefined) {
+            let bytes;
+            try {
+                // Size first: a mistakenly-passed large file should be a clear CLI
+                // error rather than a buffer the command tries to base64 and ship.
+                const { size } = statSync(options.bodyFile);
+                if (size > MAX_VERIFY_BODY_BYTES) {
+                    error(`--body-file is ${size} bytes, over the ${MAX_VERIFY_BODY_BYTES}-byte platform maximum for a webhook body. A delivery that large is refused before its signature is checked.`);
+                    process.exit(1);
+                    return;
+                }
+                bytes = readFileSync(options.bodyFile);
+            }
+            catch (err) {
+                error(`Could not read --body-file: ${err.message}`);
+                process.exit(1);
+                return;
+            }
+            // A signature is over BYTES. Decoding a capture that is not valid
+            // UTF-8 replaces each bad byte with U+FFFD, so sending it as `rawBody`
+            // would check the signature against bytes the provider never sent and
+            // report a confident `sig_invalid` — the wrong answer in exactly the
+            // case this command exists for. `bodyBase64` carries those bytes
+            // intact, so only a body that round-trips losslessly goes as text.
+            const asText = bytes.toString("utf-8");
+            if (Buffer.from(asText, "utf-8").equals(bytes)) {
+                rawBody = asText;
+            }
+            else {
+                bodyBase64 = bytes.toString("base64");
+            }
+        }
+        else {
+            // An empty body is a legitimate delivery, so an omitted --body means
+            // "the delivery carried no body" rather than "no body was supplied".
+            rawBody = options.body ?? "";
+        }
+        // Ordered pairs, not an object: a real capture can carry the same field
+        // name on more than one line, which an object cannot represent.
+        const headers = [];
+        for (const entry of (options.header || [])) {
+            const separator = entry.indexOf(":");
+            if (separator <= 0) {
+                error(`Invalid --header '${entry}'. Use 'Name: value'.`);
+                process.exit(1);
+            }
+            headers.push([
+                entry.slice(0, separator).trim(),
+                entry.slice(separator + 1).trim(),
+            ]);
+        }
+        const client = new ApiClient();
+        try {
+            const result = await client.verifyWebhook(resolvedAppId, webhookId, {
+                headers,
+                // Exactly one body form — the server refuses a request naming both.
+                ...(bodyBase64 !== undefined ? { bodyBase64 } : { rawBody }),
+            });
+            if (options.json) {
+                json(result);
+            }
+            else if (result.verified) {
+                success("Signature verified.");
+                keyValue("  Scheme", String(result.verificationScheme));
+                if (result.dedupKey)
+                    keyValue("  Dedup key", String(result.dedupKey));
+                if (result.externalEventId) {
+                    keyValue("  Event ID", String(result.externalEventId));
+                }
+            }
+            else {
+                error("Signature did NOT verify.");
+                keyValue("  Scheme", String(result.verificationScheme));
+                keyValue("  Reason", String(result.rejectionReason || "unknown"));
+            }
+            if (result.webhookStatus && result.webhookStatus !== "active") {
+                warn(`This webhook is ${result.webhookStatus} — a live delivery would be refused before its signature was checked.`);
+            }
+            if (!result.verified)
+                process.exit(1);
+        }
+        catch (err) {
+            error(err?.code ? `${err.message} (${err.code})` : err.message);
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/src/commands/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/commands/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,MAAM,IAAI,WAAW,EACrB,WAAW,EACX,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,GAAG,EACH,IAAI,GACL,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;CAUzB,CAAC,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAClB,OAAO,EACP;;;;;;CAMH,CACE,CAAC;IAGF,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,eAAe,CAAC;SAC5B,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;SACzE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,mEAAmE;YACnE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CACtC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE;gBACjC,GAAG,MAAM;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CACH,CAAC;YAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,KAAK,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,KAAK,EAAE;gBACjB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE;gBACpC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE;gBACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,oBAAoB,EAAE;gBAC/C,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE;gBAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;gBACzD,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE;aACzE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACL,QAAQ;SACL,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,qBAAqB,CAAC;SAClC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAEjE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACtC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACxC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;YACtD,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAChD,WAAW,CAAC,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC9D,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;YAC3D,WAAW,CACT,yBAAyB,EACzB,MAAM,CAAC,qBAAqB,IAAI,GAAG,CACpC,CAAC;YACF,oEAAoE;YACpE,wEAAwE;YACxE,mEAAmE;YACnE,WAAW,CACT,gCAAgC,EAChC,MAAM,CAAC,2BAA2B,IAAI,GAAG,CAC1C,CAAC;YACF,sEAAsE;YACtE,uEAAuE;YACvE,+DAA+D;YAC/D,2DAA2D;YAC3D,MAAM,oBAAoB,GAAG,0BAA0B,CACrD,MAAM,CAAC,mBAAmB,EAC1B;gBACE,OAAO,EAAE,gBAAgB;gBACzB,MAAM,EAAE,2CAA2C;aACpD,CACF,CAAC;YACF,IAAI,oBAAoB;gBAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACrD,sEAAsE;YACtE,kEAAkE;YAClE,2DAA2D;YAC3D,MAAM,eAAe,GAAG,4BAA4B,CAClD,MAAM,CAAC,2BAA2B,EAClC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACvC,CAAC;YACF,IAAI,eAAe;gBAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3C,yDAAyD;YACzD,MAAM,aAAa,GAAG,0BAA0B,CAC9C,MAAM,CAAC,mBAAmB,EAC1B,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAC9B,CAAC;YACF,IAAI,aAAa;gBAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACvC,MAAM,qBAAqB,GAAG,0BAA0B,CACtD,MAAM,CAAC,2BAA2B,EAClC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACvC,CAAC;YACF,IAAI,qBAAqB;gBAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAEvD,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvB,WAAW,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC,CAAC;YAC3E,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACrF,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,qBAAqB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxG,WAAW,CAAC,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACpG,wEAAwE;YACxE,yDAAyD;YACzD,WAAW,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC/E,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;YAC3D,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC;YAE3D,OAAO,EAAE,CAAC;YACV,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACrG,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACrD,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACL,QAAQ;SACL,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,yCAAyC,CAAC;SACtD,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,cAAc,CACb,gBAAgB,EAChB,qEAAqE,CACtE;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,SAAS,EAAE;gBACxE,aAAa,EAAE,OAAO,CAAC,MAAM;aAC9B,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,oEAAoE;YACpE,qEAAqE;YACrE,2DAA2D;YAC3D,OAAO,CAAC,yBAAyB,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBACjC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,sBAAsB;IACtB,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4BAA4B,CAAC;SACzC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,aAAa,EAAE,0BAA0B,EAAE,IAAI,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,yDAAyD;SACxD,MAAM,CAAC,mBAAmB,EAAE,2CAA2C,CAAC;SACxE,MAAM,CAAC,cAAc,EAAE,2CAA2C,CAAC;SACnE,MAAM,CAAC,YAAY,EAAE,2CAA2C,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,kEAAkE;YAClE,8DAA8D;YAC9D,oBAAoB,CAClB,gBAAgB,EAChB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAC9D,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,aAAa,EAAE,SAAS,EAAE;gBACpE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC9B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAClD,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YAED,MAAM,eAAe,GAAG,GAAG,EAAE;gBAC3B,IAAI,CAAC,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAC7B,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,6BAA6B,IAAI,CAAC,UAAU,qBAAqB,CAAC,CAAC;YACzE,CAAC,CAAC;YAEF,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACzB,eAAe,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;gBACtB,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACxD,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,iBAAiB,EAAE;gBACjD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;gBACzD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE;gBACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE;gBAC5C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;aAC5D,CAAC,CACH,CAAC;YAEF,eAAe,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,eAAe;IACf,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CACL,kBAAkB,EAClB,wDAAwD;QACtD,yEAAyE;QACzE,oDAAoD,CACvD;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CACV,OAAO,EACP;;;;;;;;;;;CAWL,CACI;SACA,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,OAAO,GAAQ,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,CACL,oEAAoE;oBAClE,6DAA6D;oBAC7D,2CAA2C,CAC9C,CAAC;gBACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC5B,OAAO,EAAE,CAAC;oBACV,IAAI,CAAC,8BAA8B,CAAC,CAAC;oBACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBACtE,QAAQ,CAAC,KAAK,MAAM,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,EAAE,CAAC;oBACV,IAAI,CAAC,eAAe,CAAC,CAAC;oBACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,2BAA2B;YAC3B,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,yCAAyC;IACzC,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,uEAAuE,CACxE;SACA,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CACL,wBAAwB,EACxB,kDAAkD,EAClD,CAAC,KAAa,EAAE,QAAkB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EACnE,EAAc,CACf;SACA,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;SAC9D,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;CAoBL,CACI;SACA,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjE,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAA2B,CAAC;QAChC,IAAI,UAA8B,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,mEAAmE;gBACnE,mEAAmE;gBACnE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,IAAI,GAAG,qBAAqB,EAAE,CAAC;oBACjC,KAAK,CACH,kBAAkB,IAAI,oBAAoB,qBAAqB,8GAA8G,CAC9K,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,KAAK,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,kEAAkE;YAClE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,iEAAiE;YACjE,mEAAmE;YACnE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,OAAO,GAAG,MAAM,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,qEAAqE;YACrE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,CAAC;QAED,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAa,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,KAAK,CAAC,qBAAqB,KAAK,uBAAuB,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE;gBAChC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;aAClC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,EAAE;gBAClE,OAAO;gBACP,oEAAoE;gBACpE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC7D,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;YACf,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC3B,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACxD,IAAI,MAAM,CAAC,QAAQ;oBAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACtE,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;oBAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAC9D,IAAI,CACF,mBAAmB,MAAM,CAAC,aAAa,uEAAuE,CAC/G,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}