primitive-admin 1.1.0-alpha.8 → 1.1.0-alpha.81

package/dist/src/commands/webhooks.js

@@ -0,0 +1,626 @@
+import { readFileSync, statSync } from "fs";
+import { ApiClient } from "../lib/api-client.js";
+import { resolveAppId, getServerUrl } from "../lib/config.js";
+import { deliverWebhookTest, } from "../lib/webhook-deliver.js";
+import { success, error, info, keyValue, result as printResult, formatTable, formatId, formatDate, formatStatus, json, divider, dim, warn, } from "../lib/output.js";
+import { assertSupportedFlags, buildWebhookEnvelope, } from "../lib/log-inspection.js";
+import { confirmPrompt } from "../lib/confirm-prompt.js";
+import { parseStatusFilter } from "../lib/object-status-filter.js";
+import { signingSecretStatusWarning, signingSecretHealthWarning, previousSigningSecretWarning, formatGracePeriodMs, } from "../lib/signing-secret-status.js";
+import { fetchAll } from "./sync.js";
+/**
+ * Platform ceiling on a webhook body (`MAX_WEBHOOK_BODY_BYTES_LIMIT`, 25 MiB).
+ * A per-webhook cap can be lower — that one is the server's call and comes back
+ * as a `body_too_large` verdict. This bound only stops the CLI from reading and
+ * encoding a file no webhook could ever accept.
+ */
+const MAX_VERIFY_BODY_BYTES = 25 * 1024 * 1024;
+export function registerWebhooksCommands(program) {
+    const webhooks = program
+        .command("webhooks")
+        .description("Manage inbound webhooks that trigger workflows")
+        .addHelpText("after", `
+Examples:
+  $ primitive webhooks list
+  $ primitive secrets set STRIPE_WEBHOOK_SECRET --value whsec_...
+  $ primitive config create webhook stripe-events   # then edit webhooks/stripe-events.toml and: primitive config push
+  $ primitive webhooks get 01HXY...
+  $ primitive webhooks rotate-secret 01HXY... --secret "{{secrets.STRIPE_WEBHOOK_SECRET_NEXT}}"
+  $ primitive webhooks events 01HXY...
+  $ primitive webhooks archive 01HXY...   # retire it (soft delete)
+  $ primitive webhooks test 01HXY... --payload '{"event":"test"}'
+  $ primitive webhooks verify 01HXY... --header 'Stripe-Signature: t=...,v1=...' --body-file captured.json
+`);
+    // Server-side configuration is authored in TOML and applied with `config push`
+    // (issue #2645) — this group no longer carries config-setting flags.
+    webhooks.addHelpText("after", `
+Configuration lives in webhooks/<key>.toml:
+  $ primitive config fields webhook        # the file's keys, types and defaults
+  $ primitive config create webhook <key>  # scaffold one locally
+  $ primitive config set webhook/<key> <path>=<value>
+  $ primitive config push --only webhook/<key>
+`);
+    // List webhooks
+    webhooks
+        .command("list")
+        .description("List webhooks")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .option("--app <app-id>", "App ID")
+        .option("--status <status>", "Filter by status: active, inactive, archived")
+        .option("--json", "Output as JSON")
+        .action(async (appId, options) => {
+        const resolvedAppId = resolveAppId(appId, options);
+        const client = new ApiClient();
+        try {
+            // #2803 — `paused` is gone; refuse it by name rather than returning the
+            // empty list a canonical filter would produce.
+            const status = parseStatusFilter("webhooks", options.status, [
+                "active",
+                "inactive",
+                "archived",
+            ]);
+            // Drain every page (#2232). The admin list endpoint pages at 25 by
+            // default, so an app anywhere near the per-app webhook cap of 50 was
+            // silently truncated here — and this is the command an operator uses to
+            // find a webhook to hard-delete when a create is refused at the cap.
+            const items = await fetchAll((params) => client.listWebhooks(resolvedAppId, {
+                ...params,
+                status,
+            }));
+            if (options.json) {
+                json(items);
+                return;
+            }
+            if (!items || items.length === 0) {
+                info("No webhooks found.");
+                return;
+            }
+            console.log(formatTable(items, [
+                { header: "KEY", key: "webhookKey" },
+                { header: "NAME", key: "displayName" },
+                { header: "SCHEME", key: "verificationScheme" },
+                { header: "WORKFLOW", key: "workflowKey" },
+                { header: "STATUS", key: "status", format: formatStatus },
+                { header: "LAST TRIGGERED", key: "lastTriggeredAt", format: formatDate },
+            ]));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    webhooks
+        .command("get")
+        .description("Get webhook details")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.getWebhook(resolvedAppId, webhookId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            printResult("Webhook ID", result.webhookId);
+            printResult("Key", result.webhookKey);
+            printResult("Name", result.displayName);
+            printResult("Description", result.description || "-");
+            printResult("Status", formatStatus(result.status));
+            printResult("Workflow Key", result.workflowKey);
+            printResult("Verification Scheme", result.verificationScheme);
+            printResult("Signing Secret", result.signingSecret || "-");
+            printResult("Previous Signing Secret", result.previousSigningSecret || "-");
+            // The grace slot's own status, so an operator can tell "no previous
+            // key" from "a raw value is still live there" — both print the previous
+            // secret as `-`, because a withheld value is never echoed (#2383).
+            printResult("Previous Signing Secret Status", result.previousSigningSecretStatus || "-");
+            // A stored value that is not a reference is never echoed, so say what
+            // it is here rather than showing an empty field: a legacy literal from
+            // before reference-only still verifies deliveries, a malformed
+            // reference does not (#2332). Same wording as `config pull`.
+            const signingSecretWarning = signingSecretStatusWarning(result.signingSecretStatus, {
+                subject: "Signing secret",
+                blocks: "this webhook cannot be updated or rotated",
+            });
+            if (signingSecretWarning)
+                warn(signingSecretWarning);
+            // The grace slot gets its own line: a raw value there keeps verifying
+            // deliveries even though the row's current slot reads as migrated
+            // (#2383). The lever is the grace period, not a migration.
+            const previousWarning = previousSigningSecretWarning(result.previousSigningSecretStatus, { subject: "Previous signing secret" });
+            if (previousWarning)
+                warn(previousWarning);
+            // The health axis, per slot — anything that is not `ok`.
+            const healthWarning = signingSecretHealthWarning(result.signingSecretHealth, { subject: "Signing secret" });
+            if (healthWarning)
+                warn(healthWarning);
+            const previousHealthWarning = signingSecretHealthWarning(result.previousSigningSecretHealth, { subject: "Previous signing secret" });
+            if (previousHealthWarning)
+                warn(previousHealthWarning);
+            divider();
+            info("Configuration:");
+            printResult("  Tolerance Seconds", String(result.toleranceSeconds ?? "-"));
+            printResult("  Deduplication", result.deduplicationEnabled ? "enabled" : "disabled");
+            printResult("  Dedup Window", result.deduplicationWindowMs ? `${result.deduplicationWindowMs}ms` : "-");
+            printResult("  Max Body Bytes", result.maxBodyBytes ? `${result.maxBodyBytes}` : "default (5 MiB)");
+            // Not a truthiness test: a stored `0` means immediate cutover, which is
+            // the opposite of the unset case's 24 h default (#2383).
+            printResult("  Grace Period", formatGracePeriodMs(result.secretGracePeriodMs));
+            printResult("  Allowed IPs", result.allowedIpCidrs || "-");
+            printResult("  Input Mapping", result.inputMapping || "-");
+            divider();
+            printResult("Last Triggered", result.lastTriggeredAt ? formatDate(result.lastTriggeredAt) : "never");
+            printResult("Created", formatDate(result.createdAt));
+            printResult("Modified", formatDate(result.modifiedAt));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // #2645 criterion 9 / #2803 — the operational verbs. They are the only
+    // writers of `status`, which is server-owned and no longer a `[webhook]`
+    // TOML key: `config push` can neither set nor clear it, so pushing a file
+    // pulled before a pause no longer puts the endpoint back in service.
+    webhooks
+        .command("disable")
+        .description("Take a webhook out of service now. Inbound deliveries are refused with a 410; the committed configuration is unchanged.")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.setWebhookAvailability(resolvedAppId, webhookId, "disable");
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Webhook disabled: ${result.webhookKey || webhookId}`);
+            info("Deliveries are refused with a 410 — `primitive webhooks enable` puts it back.");
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    webhooks
+        .command("enable")
+        .description("Put a webhook back in service.")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.setWebhookAvailability(resolvedAppId, webhookId, "enable");
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Webhook enabled: ${result.webhookKey || webhookId}`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // #2907 — the delete flow's CLI spelling. Not a second writer of `status`:
+    // this is the plain `DELETE` the server has always answered by writing the
+    // tombstone, which until now only the admin API and the console could reach.
+    // Named `archive`, not `delete`, because a configuration noun gets no
+    // `delete` verb (docs/cli-design.md) and prune-by-push stays the only CLI
+    // hard-delete path.
+    webhooks
+        .command("archive")
+        .description("Retire a webhook (soft delete). Delete-lifecycle, not `disable`: the row is kept, keeps its key and its capped slot, and there is no un-archive.")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+What archiving a webhook costs:
+  Inbound deliveries are refused, as they are for a disabled webhook.
+  The archived row still holds its webhookKey AND its slot under the per-app
+  webhook cap (50) — archiving frees neither, which is why an archived row a
+  delivery still reaches is not free.
+  \`primitive webhooks enable\` refuses an archived webhook; there is no
+  un-archive.
+
+Reclaiming the key and the slot means hard-deleting the row:
+  $ rm webhooks/<key>.toml
+  $ primitive config push --prune     # confirmed; hard-deletes the row
+  # or hard-delete it in the console, then re-add the file and push.
+`)
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (!options.yes) {
+            let confirmed;
+            try {
+                confirmed = await confirmPrompt(`Archive webhook ${webhookId}? Deliveries stop, the row keeps its key ` +
+                    `and its capped slot, and there is no un-archive.`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
+            if (!confirmed) {
+                info("Cancelled.");
+                return;
+            }
+        }
+        const client = new ApiClient();
+        try {
+            // The soft delete: no `hard`, so the server writes the tombstone. The
+            // `--hard` path stays out of the CLI surface — prune-by-push owns it.
+            const result = await client.deleteWebhook(resolvedAppId, webhookId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Webhook archived: ${webhookId}`);
+            info("Deliveries are refused. The row still holds its key and its capped slot — reclaim both by removing its file and running a confirmed `primitive config push --prune`.");
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    webhooks
+        .command("rotate-secret")
+        .description("Rotate the signing secret for a webhook")
+        .argument("<webhook-id>", "Webhook ID")
+        .requiredOption("--secret <ref>", "New signing secret, as a {{secrets.KEY}} reference to an app secret")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.rotateWebhookSecret(resolvedAppId, webhookId, {
+                signingSecret: options.secret,
+            });
+            if (options.json) {
+                json(result);
+                return;
+            }
+            // Rotation now returns the serialized webhook on both surfaces, and
+            // both references are plain text (the secret values live only in the
+            // secret store), so print them rather than a masked value.
+            success("Signing secret rotated.");
+            if (result.signingSecret) {
+                keyValue("Signing Secret", result.signingSecret);
+            }
+            if (result.previousSigningSecret) {
+                keyValue("Previous Signing Secret", result.previousSigningSecret);
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // List webhook events
+    webhooks
+        .command("events")
+        .description("View webhook event history")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--limit <n>", "Number of events to show", "20")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page")
+        // Declared so they can be rejected with a clear message instead of being
+        // silently ignored — status/time filtering on webhook events is deferred to
+        // Phase B (issue #1967). See assertSupportedFlags below.
+        .option("--status <status>", "(not supported yet — deferred to Phase B)")
+        .option("--from <iso>", "(not supported yet — deferred to Phase B)")
+        .option("--to <iso>", "(not supported yet — deferred to Phase B)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            // The webhook-events route serves limit + cursor only; reject the
+            // Phase B filters cleanly rather than dropping them silently.
+            assertSupportedFlags("webhook events", { status: options.status, from: options.from, to: options.to }, ["limit", "cursor"]);
+            const page = await client.listWebhookEvents(resolvedAppId, webhookId, {
+                limit: parseInt(options.limit),
+                ...(options.cursor && { cursor: options.cursor }),
+            });
+            if (options.json) {
+                json(buildWebhookEnvelope(page.items, page));
+                return;
+            }
+            const printCursorHint = () => {
+                if (!page.nextCursor)
+                    return;
+                console.log();
+                dim(`More events. Use --cursor ${page.nextCursor} for the next page.`);
+            };
+            if (!page.items || page.items.length === 0) {
+                info("No events found.");
+                printCursorHint();
+                return;
+            }
+            console.log(formatTable(page.items, [
+                { header: "EVENT ID", key: "eventId", format: formatId },
+                { header: "EXTERNAL ID", key: "externalEventId" },
+                { header: "STATUS", key: "status", format: formatStatus },
+                { header: "HTTP", key: "httpStatus" },
+                { header: "REASON", key: "rejectionReason" },
+                { header: "CREATED", key: "createdAt", format: formatDate },
+            ]));
+            printCursorHint();
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Test webhook
+    webhooks
+        .command("test")
+        .description("Sign a test payload for a webhook (returns body + headers)")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--payload <json>", "Test payload as JSON, signed verbatim. Pass the event " +
+        "object directly (e.g. '{\"type\":\"event\",\"data\":{…}}'); it is used " +
+        "as-is. Omit it to sign a canned webhook.test ping.")
+        .option("--deliver", "Post the signed payload to the webhook's real receive endpoint, " +
+        "firing the function (or workflow) for real and reporting the run")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+By default this command only SIGNS: it prints the signature headers and the
+signed body, posts nothing, and so starts no run and records no delivery.
+
+--deliver posts that signed body to the webhook's receive endpoint,
+POST /app/{appId}/webhook/{webhookKey} — the same unauthenticated path a
+provider uses, so signature verification, handshake rules, deduplication and
+dispatch all run for real. That is a real delivery: a real event row is written
+and the signed body's dedup key is spent (permanently on the 'github' scheme).
+It reports the delivery's event id and the run id, and exits non-zero unless a
+dispatch was positively confirmed; --json carries an outcome of
+"dispatched" | "refused" | "unconfirmed".
+
+The value of --payload is signed exactly as given (WYSIWYG). A JSON object is
+used as the test body verbatim, so a wrapped payload such as '{"payload":{…}}'
+signs the literal wrapper — do not wrap the event. Omitting --payload (or
+passing a non-object such as an array) signs the canned
+{"type":"webhook.test", …} ping.
+`)
+        .action(async (webhookId, options) => {
+        const code = await runWebhooksTest(webhookId, options);
+        if (code !== 0)
+            process.exit(code);
+    });
+    // Verify a captured delivery's signature
+    webhooks
+        .command("verify")
+        .description("Check whether signature headers you captured verify against a webhook")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--header <name: value>", "A header from the captured delivery. Repeatable.", (value, previous) => [...(previous || []), value], [])
+        .option("--body <text>", "The captured delivery body, as text")
+        .option("--body-file <path>", "Read the captured delivery body from a file")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+Runs the webhook's configured verifier over the body and headers you supply and
+reports whether that signature checks out — the useful question when a real
+delivery was rejected 401, and the only way to check a scheme the platform holds
+only public key material for (discord, jwt, plaid), which \`webhooks test\`
+cannot preview.
+
+Nothing is delivered: no workflow runs, and no delivery is recorded (this check
+never appears in \`primitive webhooks events\`).
+
+It answers SIGNATURE verification only. A real delivery is also subject to the
+webhook's status and IP allowlist before verification, and to handshake rules
+and deduplication after it.
+
+Exits 0 when the signature verifies and non-zero otherwise, so it composes in a
+script.
+
+  $ primitive webhooks verify 01HXY... \\
+      --header 'Stripe-Signature: t=1754...,v1=abc...' \\
+      --body-file captured-delivery.json
+`)
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (options.body !== undefined && options.bodyFile !== undefined) {
+            error("Pass --body or --body-file, not both.");
+            process.exit(1);
+        }
+        let rawBody;
+        let bodyBase64;
+        if (options.bodyFile !== undefined) {
+            let bytes;
+            try {
+                // Size first: a mistakenly-passed large file should be a clear CLI
+                // error rather than a buffer the command tries to base64 and ship.
+                const { size } = statSync(options.bodyFile);
+                if (size > MAX_VERIFY_BODY_BYTES) {
+                    error(`--body-file is ${size} bytes, over the ${MAX_VERIFY_BODY_BYTES}-byte platform maximum for a webhook body. A delivery that large is refused before its signature is checked.`);
+                    process.exit(1);
+                    return;
+                }
+                bytes = readFileSync(options.bodyFile);
+            }
+            catch (err) {
+                error(`Could not read --body-file: ${err.message}`);
+                process.exit(1);
+                return;
+            }
+            // A signature is over BYTES. Decoding a capture that is not valid
+            // UTF-8 replaces each bad byte with U+FFFD, so sending it as `rawBody`
+            // would check the signature against bytes the provider never sent and
+            // report a confident `sig_invalid` — the wrong answer in exactly the
+            // case this command exists for. `bodyBase64` carries those bytes
+            // intact, so only a body that round-trips losslessly goes as text.
+            const asText = bytes.toString("utf-8");
+            if (Buffer.from(asText, "utf-8").equals(bytes)) {
+                rawBody = asText;
+            }
+            else {
+                bodyBase64 = bytes.toString("base64");
+            }
+        }
+        else {
+            // An empty body is a legitimate delivery, so an omitted --body means
+            // "the delivery carried no body" rather than "no body was supplied".
+            rawBody = options.body ?? "";
+        }
+        // Ordered pairs, not an object: a real capture can carry the same field
+        // name on more than one line, which an object cannot represent.
+        const headers = [];
+        for (const entry of (options.header || [])) {
+            const separator = entry.indexOf(":");
+            if (separator <= 0) {
+                error(`Invalid --header '${entry}'. Use 'Name: value'.`);
+                process.exit(1);
+            }
+            headers.push([
+                entry.slice(0, separator).trim(),
+                entry.slice(separator + 1).trim(),
+            ]);
+        }
+        const client = new ApiClient();
+        try {
+            const result = await client.verifyWebhook(resolvedAppId, webhookId, {
+                headers,
+                // Exactly one body form — the server refuses a request naming both.
+                ...(bodyBase64 !== undefined ? { bodyBase64 } : { rawBody }),
+            });
+            if (options.json) {
+                json(result);
+            }
+            else if (result.verified) {
+                success("Signature verified.");
+                keyValue("  Scheme", String(result.verificationScheme));
+                if (result.dedupKey)
+                    keyValue("  Dedup key", String(result.dedupKey));
+                if (result.externalEventId) {
+                    keyValue("  Event ID", String(result.externalEventId));
+                }
+            }
+            else {
+                error("Signature did NOT verify.");
+                keyValue("  Scheme", String(result.verificationScheme));
+                keyValue("  Reason", String(result.rejectionReason || "unknown"));
+            }
+            if (result.webhookStatus && result.webhookStatus !== "active") {
+                warn(`This webhook is ${result.webhookStatus} — a live delivery would be refused before its signature was checked.`);
+            }
+            if (!result.verified)
+                process.exit(1);
+        }
+        catch (err) {
+            error(err?.code ? `${err.message} (${err.code})` : err.message);
+            process.exit(1);
+        }
+    });
+}
+/**
+ * `primitive webhooks test [--deliver]` — the command body, exported so its
+ * wiring and its outcome mapping are testable without a network (#3321).
+ *
+ * Returns the process exit code rather than calling `process.exit` itself:
+ * `0` for a signed preview, and in delivered mode `0` only when a dispatch was
+ * positively confirmed.
+ */
+export async function runWebhooksTest(webhookId, options, deps = {}) {
+    const resolvedAppId = resolveAppId(undefined, options);
+    let payload = {};
+    if (options.payload) {
+        try {
+            payload = JSON.parse(options.payload);
+        }
+        catch {
+            error("Invalid JSON in --payload");
+            return 1;
+        }
+    }
+    const client = (deps.client ?? new ApiClient());
+    if (options.deliver) {
+        const result = await deliverWebhookTest({
+            appId: resolvedAppId,
+            webhookId,
+            payload,
+            serverUrl: (deps.serverUrl ?? getServerUrl)(),
+        }, {
+            client,
+            ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+            ...(deps.sleep ? { sleep: deps.sleep } : {}),
+            // Said before anything is delivered, and in the terminal rather than
+            // only in the guide: a diagnostic that mutates the app has to announce
+            // it where the user is looking (#3321 criterion 4). It goes to stderr,
+            // so `--json` keeps one clean object on stdout.
+            onBeforeDeliver: (notice) => notice.forEach((line) => warn(line)),
+        });
+        if (options.json) {
+            json(result);
+        }
+        else if (result.outcome === "dispatched") {
+            success(result.headline);
+            result.details.forEach((line) => info(line));
+        }
+        else {
+            // A refusal the server explained keeps the established convention: the
+            // prose explains, the code is what an operator searches for (#2445).
+            if (result.refusal) {
+                error(result.refusal.code
+                    ? `${result.refusal.message} (${result.refusal.code})`
+                    : result.refusal.message);
+                if (result.delivery === null)
+                    info("Nothing was delivered.");
+            }
+            else {
+                error(result.headline);
+            }
+            result.details.forEach((line) => info(line));
+        }
+        return result.outcome === "dispatched" ? 0 : 1;
+    }
+    try {
+        const result = await client.testWebhook(resolvedAppId, webhookId, payload);
+        if (options.json) {
+            json(result);
+            return 0;
+        }
+        if (result.success) {
+            success("Test payload signed. Nothing was delivered — re-run with --deliver " +
+                "to post it to the receive endpoint for real, or post the signed " +
+                "body (--json shows the exact rawBody) with these headers yourself.");
+            if (result.signatureHeaders) {
+                divider();
+                info("Generated Signature Headers:");
+                for (const [header, value] of Object.entries(result.signatureHeaders)) {
+                    keyValue(`  ${header}`, String(value));
+                }
+            }
+            if (result.payload) {
+                divider();
+                info("Test Payload:");
+                console.log(JSON.stringify(result.payload, null, 2));
+            }
+        }
+        else {
+            error(`Test failed: ${result.message || result.errorCode || "unknown error"}`);
+        }
+        return 0;
+    }
+    catch (err) {
+        // The server refuses a preview it cannot sign with a coded 400 — the
+        // scheme holds only public key material, the row still stores a raw
+        // secret, the signing secret is unset or unresolvable (#2445). Print
+        // the machine-readable code alongside the message, the established
+        // convention here: the prose explains, the code is what an operator
+        // searches for or reports.
+        error(err?.code ? `${err.message} (${err.code})` : err.message);
+        return 1;
+    }
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/src/commands/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../src/commands/webhooks.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EACL,kBAAkB,GAGnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,OAAO,EACP,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,MAAM,IAAI,WAAW,EACrB,WAAW,EACX,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,GAAG,EACH,IAAI,GACL,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;CAWzB,CAAC,CAAC;IAED,+EAA+E;IAC/E,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAClB,OAAO,EACP;;;;;;CAMH,CACE,CAAC;IAGF,gBAAgB;IAChB,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,eAAe,CAAC;SAC5B,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC;SAClC,MAAM,CACL,mBAAmB,EACnB,8CAA8C,CAC/C;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,wEAAwE;YACxE,+CAA+C;YAC/C,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE;gBAC3D,QAAQ;gBACR,UAAU;gBACV,UAAU;aACX,CAAC,CAAC;YAEH,mEAAmE;YACnE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CACtC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE;gBACjC,GAAG,MAAM;gBACT,MAAM;aACP,CAAC,CACH,CAAC;YAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,KAAK,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3B,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,KAAK,EAAE;gBACjB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE;gBACpC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE;gBACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,oBAAoB,EAAE;gBAC/C,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,EAAE;gBAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;gBACzD,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,EAAE;aACzE,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACL,QAAQ;SACL,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,qBAAqB,CAAC;SAClC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAEjE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5C,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACtC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACxC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;YACtD,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,WAAW,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAChD,WAAW,CAAC,qBAAqB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC9D,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC;YAC3D,WAAW,CACT,yBAAyB,EACzB,MAAM,CAAC,qBAAqB,IAAI,GAAG,CACpC,CAAC;YACF,oEAAoE;YACpE,wEAAwE;YACxE,mEAAmE;YACnE,WAAW,CACT,gCAAgC,EAChC,MAAM,CAAC,2BAA2B,IAAI,GAAG,CAC1C,CAAC;YACF,sEAAsE;YACtE,uEAAuE;YACvE,+DAA+D;YAC/D,6DAA6D;YAC7D,MAAM,oBAAoB,GAAG,0BAA0B,CACrD,MAAM,CAAC,mBAAmB,EAC1B;gBACE,OAAO,EAAE,gBAAgB;gBACzB,MAAM,EAAE,2CAA2C;aACpD,CACF,CAAC;YACF,IAAI,oBAAoB;gBAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACrD,sEAAsE;YACtE,kEAAkE;YAClE,2DAA2D;YAC3D,MAAM,eAAe,GAAG,4BAA4B,CAClD,MAAM,CAAC,2BAA2B,EAClC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACvC,CAAC;YACF,IAAI,eAAe;gBAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3C,yDAAyD;YACzD,MAAM,aAAa,GAAG,0BAA0B,CAC9C,MAAM,CAAC,mBAAmB,EAC1B,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAC9B,CAAC;YACF,IAAI,aAAa;gBAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACvC,MAAM,qBAAqB,GAAG,0BAA0B,CACtD,MAAM,CAAC,2BAA2B,EAClC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CACvC,CAAC;YACF,IAAI,qBAAqB;gBAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAEvD,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvB,WAAW,CAAC,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC,CAAC;YAC3E,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACrF,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,qBAAqB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxG,WAAW,CAAC,kBAAkB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACpG,wEAAwE;YACxE,yDAAyD;YACzD,WAAW,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC/E,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;YAC3D,WAAW,CAAC,iBAAiB,EAAE,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC,CAAC;YAE3D,OAAO,EAAE,CAAC;YACV,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACrG,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACrD,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACL,uEAAuE;IACvE,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,QAAQ;SACL,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,yHAAyH,CAC1H;SACA,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAChD,aAAa,EACb,SAAS,EACT,SAAS,CACV,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YACD,OAAO,CAAC,qBAAqB,MAAM,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,+EAA+E,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAChD,aAAa,EACb,SAAS,EACT,QAAQ,CACT,CAAC;YACF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YACD,OAAO,CAAC,oBAAoB,MAAM,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,0EAA0E;IAC1E,oBAAoB;IACpB,QAAQ;SACL,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,kJAAkJ,CACnJ;SACA,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;CAaL,CACI;SACA,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,IAAI,SAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,aAAa,CAC7B,mBAAmB,SAAS,2CAA2C;oBACrE,kDAAkD,CACrD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,YAAY,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YACD,OAAO,CAAC,qBAAqB,SAAS,EAAE,CAAC,CAAC;YAC1C,IAAI,CACF,sKAAsK,CACvK,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,yCAAyC,CAAC;SACtD,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,cAAc,CACb,gBAAgB,EAChB,qEAAqE,CACtE;SACA,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,SAAS,EAAE;gBACxE,aAAa,EAAE,OAAO,CAAC,MAAM;aAC9B,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,OAAO;YACT,CAAC;YAED,oEAAoE;YACpE,qEAAqE;YACrE,2DAA2D;YAC3D,OAAO,CAAC,yBAAyB,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBACjC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,sBAAsB;IACtB,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4BAA4B,CAAC;SACzC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,aAAa,EAAE,0BAA0B,EAAE,IAAI,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;QACtE,yEAAyE;QACzE,4EAA4E;QAC5E,yDAAyD;SACxD,MAAM,CAAC,mBAAmB,EAAE,2CAA2C,CAAC;SACxE,MAAM,CAAC,cAAc,EAAE,2CAA2C,CAAC;SACnE,MAAM,CAAC,YAAY,EAAE,2CAA2C,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,kEAAkE;YAClE,8DAA8D;YAC9D,oBAAoB,CAClB,gBAAgB,EAChB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAC9D,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,aAAa,EAAE,SAAS,EAAE;gBACpE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC9B,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;aAClD,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YAED,MAAM,eAAe,GAAG,GAAG,EAAE;gBAC3B,IAAI,CAAC,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAC7B,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,GAAG,CAAC,6BAA6B,IAAI,CAAC,UAAU,qBAAqB,CAAC,CAAC;YACzE,CAAC,CAAC;YAEF,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACzB,eAAe,EAAE,CAAC;gBAClB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE;gBACtB,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACxD,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,iBAAiB,EAAE;gBACjD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;gBACzD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE;gBACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE;gBAC5C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE;aAC5D,CAAC,CACH,CAAC;YAEF,eAAe,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,eAAe;IACf,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CACL,kBAAkB,EAClB,wDAAwD;QACtD,yEAAyE;QACzE,oDAAoD,CACvD;SACA,MAAM,CACL,WAAW,EACX,kEAAkE;QAChE,kEAAkE,CACrE;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;CAkBL,CACI;SACA,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,yCAAyC;IACzC,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,uEAAuE,CACxE;SACA,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;SACtC,MAAM,CAAC,gBAAgB,EAAE,4CAA4C,CAAC;SACtE,MAAM,CACL,wBAAwB,EACxB,kDAAkD,EAClD,CAAC,KAAa,EAAE,QAAkB,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,EACnE,EAAc,CACf;SACA,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;SAC9D,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;CAoBL,CACI;SACA,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEvD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjE,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAA2B,CAAC;QAChC,IAAI,UAA8B,CAAC;QACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,mEAAmE;gBACnE,mEAAmE;gBACnE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC5C,IAAI,IAAI,GAAG,qBAAqB,EAAE,CAAC;oBACjC,KAAK,CACH,kBAAkB,IAAI,oBAAoB,qBAAqB,8GAA8G,CAC9K,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO;gBACT,CAAC;gBACD,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,KAAK,CAAC,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,kEAAkE;YAClE,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,iEAAiE;YACjE,mEAAmE;YACnE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,OAAO,GAAG,MAAM,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,qEAAqE;YACrE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/B,CAAC;QAED,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAa,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,KAAK,CAAC,qBAAqB,KAAK,uBAAuB,CAAC,CAAC;gBACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE;gBAChC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;aAClC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,EAAE,SAAS,EAAE;gBAClE,OAAO;gBACP,oEAAoE;gBACpE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC7D,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;YACf,CAAC;iBAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC3B,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACxD,IAAI,MAAM,CAAC,QAAQ;oBAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACtE,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;oBAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,IAAI,SAAS,CAAC,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBAC9D,IAAI,CACF,mBAAmB,MAAM,CAAC,aAAa,uEAAuE,CAC/G,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAiBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,OAKC,EACD,OAAyB,EAAE;IAE3B,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEvD,IAAI,OAAO,GAAQ,EAAE,CAAC;IACtB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,SAAS,EAAE,CAAyB,CAAC;IAExE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC;YACE,KAAK,EAAE,aAAa;YACpB,SAAS;YACT,OAAO;YACP,SAAS,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC,EAAE;SAC9C,EACD;YACE,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,gDAAgD;YAChD,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClE,CACF,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,qEAAqE;YACrE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,KAAK,CACH,MAAM,CAAC,OAAO,CAAC,IAAI;oBACjB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG;oBACtD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAC3B,CAAC;gBACF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAE3E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CACL,qEAAqE;gBACnE,kEAAkE;gBAClE,oEAAoE,CACvE,CAAC;YACF,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,8BAA8B,CAAC,CAAC;gBACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBACtE,QAAQ,CAAC,KAAK,MAAM,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,eAAe,CAAC,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CACH,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,eAAe,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,2BAA2B;QAC3B,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}