whale-code 6.5.10 → 6.6.0

package/dist/server/server-routes-approvals.js

@@ -5,7 +5,7 @@
 import { createLogger } from "./lib/logger.js";
 import { getServiceClient } from "./lib/supabase-client.js";
 import { verifyGuestApprovalSignature, executeInlineChain } from "./handlers/workflows.js";
-import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { jsonResponse, readBody, safeCompare, getClientIp } from "./server-helpers.js";
 import { sendIpRateLimit } from "./server-rate-limit.js";
 const log = createLogger("server-routes-approvals");
 const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
@@ -36,7 +36,7 @@ export async function handleGuestApproval(req, res, ctx) {
   } = ctx;
   const guestApprovalMatch = pathname.match(/^\/approvals\/guest\/([a-f0-9-]+)$/);
   if (!(guestApprovalMatch && req.method === "GET")) return false;
-  const clientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+  const clientIp = getClientIp(req);
   if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;
   const stepRunId = guestApprovalMatch[1];
   const urlParams = new URL(req.url || "", `http://${req.headers.host}`).searchParams;

package/dist/server/server-routes-approvals.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-routes-approvals.js","names":["createLogger","getServiceClient","verifyGuestApprovalSignature","executeInlineChain","jsonResponse","readBody","safeCompare","sendIpRateLimit","log","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","getToken","req","authHeader","headers","authorization","startsWith","substring","isInternalAuth","token","handleGuestApproval","res","ctx","pathname","corsHeaders","guestApprovalMatch","match","method","clientIp","toString","split","trim","socket","remoteAddress","stepRunId","urlParams","URL","url","host","searchParams","action","get","expires","sig","error","Date","guestSupabase","data","approval","from","select","eq","limit","length","status","isApprove","guestResult","guestErr","rpc","p_approval_id","id","p_store_id","store_id","p_response","p_response_data","guest","p_responded_by","success","message","run_id","err","runId","writeHead","end","handleApprovalRespond","approvalMatch","approvalId","isInternal","supabase","userId","user","authUser","authError","auth","getUser","rawBody","body","JSON","parse","single","approvalMembership","result","response_data","responded_by"],"sources":["../../src/server/server-routes-approvals.ts"],"sourcesContent":["// server/server-routes-approvals.ts — Approval route handlers\n// Guest approval GET and authenticated approval respond POST\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { verifyGuestApprovalSignature, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, type ServerContext } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\n\nconst log = createLogger(\"server-routes-approvals\");\n\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n\n// ============================================================================\n// GET /approvals/guest/:id — Guest approval via signed URL (no auth required)\n// GET /approvals/guest/:id?action=approve&expires=...&sig=...\n// ============================================================================\n\nexport async function handleGuestApproval(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const guestApprovalMatch = pathname.match(/^\\/approvals\\/guest\\/([a-f0-9-]+)$/);\n  if (!(guestApprovalMatch && req.method === \"GET\")) return false;\n\n  const clientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n  if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;\n\n  const stepRunId = guestApprovalMatch[1];\n  const urlParams = new URL(req.url || \"\", `http://${req.headers.host}`).searchParams;\n  const action = urlParams.get(\"action\") || \"\";\n  const expires = urlParams.get(\"expires\") || \"\";\n  const sig = urlParams.get(\"sig\") || \"\";\n\n  if (!action || !expires || !sig) {\n    jsonResponse(res, 400, { error: \"Missing action, expires, or sig parameter\" }, corsHeaders);\n    return true;\n  }\n  if (new Date(expires) < new Date()) {\n    jsonResponse(res, 410, { error: \"This approval link has expired\" }, corsHeaders);\n    return true;\n  }\n  if (!verifyGuestApprovalSignature(stepRunId, action, expires, sig)) {\n    jsonResponse(res, 403, { error: \"Invalid signature\" }, corsHeaders);\n    return true;\n  }\n\n  const guestSupabase = getServiceClient();\n\n  const { data: approval } = await guestSupabase.from(\"workflow_approval_requests\")\n    .select(\"id, store_id, run_id, status\").eq(\"step_run_id\", stepRunId).limit(1);\n  if (!approval?.length) {\n    jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders);\n    return true;\n  }\n  if (approval[0].status !== \"pending\") {\n    jsonResponse(res, 409, { error: `Approval already ${approval[0].status}` }, corsHeaders);\n    return true;\n  }\n\n  const isApprove = action === \"approve\" || action === \"approved\";\n  const { data: guestResult, error: guestErr } = await guestSupabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approval[0].id,\n    p_store_id: approval[0].store_id,\n    p_response: isApprove ? \"approved\" : \"rejected\",\n    p_response_data: { guest: true, action },\n    p_responded_by: null,\n  });\n\n  if (guestErr) {\n    jsonResponse(res, 500, { success: false, error: guestErr.message }, corsHeaders);\n    return true;\n  }\n\n  if (guestResult?.success && approval[0].run_id) {\n    try {\n      await executeInlineChain(guestSupabase, approval[0].run_id);\n    } catch (err) {\n      log.error({ err: (err as Error).message, runId: approval[0].run_id }, \"inline chain failed after guest approval\");\n    }\n  }\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\", ...corsHeaders });\n  res.end(`<!DOCTYPE html><html><body style=\"font-family:system-ui;text-align:center;padding:40px\">\n    <h2>${isApprove ? \"Approved\" : \"Rejected\"}</h2>\n    <p>Your response has been recorded. You can close this window.</p>\n  </body></html>`);\n  return true;\n}\n\n// ============================================================================\n// POST /approvals/:id/respond — Authenticated approval response\n// ============================================================================\n\nexport async function handleApprovalRespond(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const approvalMatch = pathname.match(/^\\/approvals\\/([a-f0-9-]+)\\/respond$/);\n  if (!approvalMatch || req.method !== \"POST\") return false;\n\n  const approvalId = approvalMatch[1];\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n  let userId: string | null = null;\n\n  if (!isInternal) {\n    const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n    userId = authUser.id;\n  }\n\n  let rawBody: string;\n  try { rawBody = await readBody(req); } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n  if (!body.status) {\n    jsonResponse(res, 400, { error: \"status required (approved/rejected)\" }, corsHeaders);\n    return true;\n  }\n\n  // Get store_id from approval\n  const { data: approval } = await supabase.from(\"workflow_approval_requests\")\n    .select(\"store_id, run_id\").eq(\"id\", approvalId).single();\n  if (!approval) {\n    jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders);\n    return true;\n  }\n\n  // P1 FIX: Verify user has access to the approval's store\n  if (!isInternal && userId) {\n    const { data: approvalMembership } = await supabase.from(\"store_members\")\n      .select(\"id\").eq(\"store_id\", approval.store_id).eq(\"user_id\", userId).single();\n    if (!approvalMembership) {\n      jsonResponse(res, 403, { error: \"Not authorized to respond to this approval\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  const { data: result, error } = await supabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approvalId,\n    p_store_id: approval.store_id,\n    p_response: body.status,\n    p_response_data: body.response_data || {},\n    p_responded_by: userId || body.responded_by || null,\n  });\n\n  if (error) {\n    jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders);\n    return true;\n  }\n\n  // Inline resume — execute next step immediately\n  if (result?.success && approval.run_id) {\n    try {\n      await executeInlineChain(supabase, approval.run_id);\n    } catch (err) {\n      log.error({ err: (err as Error).message }, \"inline chain failed after approval\");\n    }\n  }\n\n  jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,4BAA4B,EAAEC,kBAAkB,QAAQ,yBAAyB;AAC1F,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAA4B,qBAAqB;AAC7F,SAASC,eAAe,QAAQ,wBAAwB;AAExD,MAAMC,GAAG,GAAGR,YAAY,CAAC,yBAAyB,CAAC;AAEnD,MAAMS,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;;AAEA,SAASC,QAAQA,CAACC,GAAyB,EAAU;EACnD,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAACC,aAAa;EAC5C,OAAOF,UAAU,EAAEG,UAAU,CAAC,SAAS,CAAC,GAAGH,UAAU,CAACI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASC,cAAcA,CAACC,KAAa,EAAW;EAC9C,OAAOhB,WAAW,CAACgB,KAAK,EAAET,mBAAmB,CAAC,IAAIP,WAAW,CAACgB,KAAK,EAAEb,yBAAyB,CAAC,IAAIH,WAAW,CAACgB,KAAK,EAAEV,gBAAgB,CAAC;AACzI;;AAEA;AACA;AACA;AACA;;AAEA,OAAO,eAAeW,mBAAmBA,CACvCR,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMG,kBAAkB,GAAGF,QAAQ,CAACG,KAAK,CAAC,oCAAoC,CAAC;EAC/E,IAAI,EAAED,kBAAkB,IAAIb,GAAG,CAACe,MAAM,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;EAE/D,MAAMC,QAAQ,GAAGhB,GAAG,CAACE,OAAO,CAAC,iBAAiB,CAAC,EAAEe,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAInB,GAAG,CAACoB,MAAM,CAACC,aAAa,IAAI,SAAS;EAC1H,IAAI7B,eAAe,CAACiB,GAAG,EAAEO,QAAQ,EAAEJ,WAAW,CAAC,EAAE,OAAO,IAAI;EAE5D,MAAMU,SAAS,GAAGT,kBAAkB,CAAC,CAAC,CAAC;EACvC,MAAMU,SAAS,GAAG,IAAIC,GAAG,CAACxB,GAAG,CAACyB,GAAG,IAAI,EAAE,EAAE,UAAUzB,GAAG,CAACE,OAAO,CAACwB,IAAI,EAAE,CAAC,CAACC,YAAY;EACnF,MAAMC,MAAM,GAAGL,SAAS,CAACM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;EAC5C,MAAMC,OAAO,GAAGP,SAAS,CAACM,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;EAC9C,MAAME,GAAG,GAAGR,SAAS,CAACM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;EAEtC,IAAI,CAACD,MAAM,IAAI,CAACE,OAAO,IAAI,CAACC,GAAG,EAAE;IAC/B1C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAA4C,CAAC,EAAEpB,WAAW,CAAC;IAC3F,OAAO,IAAI;EACb;EACA,IAAI,IAAIqB,IAAI,CAACH,OAAO,CAAC,GAAG,IAAIG,IAAI,CAAC,CAAC,EAAE;IAClC5C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAiC,CAAC,EAAEpB,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;EACA,IAAI,CAACzB,4BAA4B,CAACmC,SAAS,EAAEM,MAAM,EAAEE,OAAO,EAAEC,GAAG,CAAC,EAAE;IAClE1C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAoB,CAAC,EAAEpB,WAAW,CAAC;IACnE,OAAO,IAAI;EACb;EAEA,MAAMsB,aAAa,GAAGhD,gBAAgB,CAAC,CAAC;EAExC,MAAM;IAAEiD,IAAI,EAAEC;EAAS,CAAC,GAAG,MAAMF,aAAa,CAACG,IAAI,CAAC,4BAA4B,CAAC,CAC9EC,MAAM,CAAC,8BAA8B,CAAC,CAACC,EAAE,CAAC,aAAa,EAAEjB,SAAS,CAAC,CAACkB,KAAK,CAAC,CAAC,CAAC;EAC/E,IAAI,CAACJ,QAAQ,EAAEK,MAAM,EAAE;IACrBpD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAqB,CAAC,EAAEpB,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;EACA,IAAIwB,QAAQ,CAAC,CAAC,CAAC,CAACM,MAAM,KAAK,SAAS,EAAE;IACpCrD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE,oBAAoBI,QAAQ,CAAC,CAAC,CAAC,CAACM,MAAM;IAAG,CAAC,EAAE9B,WAAW,CAAC;IACxF,OAAO,IAAI;EACb;EAEA,MAAM+B,SAAS,GAAGf,MAAM,KAAK,SAAS,IAAIA,MAAM,KAAK,UAAU;EAC/D,MAAM;IAAEO,IAAI,EAAES,WAAW;IAAEZ,KAAK,EAAEa;EAAS,CAAC,GAAG,MAAMX,aAAa,CAACY,GAAG,CAAC,qBAAqB,EAAE;IAC5FC,aAAa,EAAEX,QAAQ,CAAC,CAAC,CAAC,CAACY,EAAE;IAC7BC,UAAU,EAAEb,QAAQ,CAAC,CAAC,CAAC,CAACc,QAAQ;IAChCC,UAAU,EAAER,SAAS,GAAG,UAAU,GAAG,UAAU;IAC/CS,eAAe,EAAE;MAAEC,KAAK,EAAE,IAAI;MAAEzB;IAAO,CAAC;IACxC0B,cAAc,EAAE;EAClB,CAAC,CAAC;EAEF,IAAIT,QAAQ,EAAE;IACZxD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE8C,OAAO,EAAE,KAAK;MAAEvB,KAAK,EAAEa,QAAQ,CAACW;IAAQ,CAAC,EAAE5C,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;EAEA,IAAIgC,WAAW,EAAEW,OAAO,IAAInB,QAAQ,CAAC,CAAC,CAAC,CAACqB,MAAM,EAAE;IAC9C,IAAI;MACF,MAAMrE,kBAAkB,CAAC8C,aAAa,EAAEE,QAAQ,CAAC,CAAC,CAAC,CAACqB,MAAM,CAAC;IAC7D,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZjE,GAAG,CAACuC,KAAK,CAAC;QAAE0B,GAAG,EAAGA,GAAG,CAAWF,OAAO;QAAEG,KAAK,EAAEvB,QAAQ,CAAC,CAAC,CAAC,CAACqB;MAAO,CAAC,EAAE,0CAA0C,CAAC;IACnH;EACF;EAEAhD,GAAG,CAACmD,SAAS,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,WAAW;IAAE,GAAGhD;EAAY,CAAC,CAAC;EACnEH,GAAG,CAACoD,GAAG,CAAC;AACV,UAAUlB,SAAS,GAAG,UAAU,GAAG,UAAU;AAC7C;AACA,iBAAiB,CAAC;EAChB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAemB,qBAAqBA,CACzC9D,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMqD,aAAa,GAAGpD,QAAQ,CAACG,KAAK,CAAC,sCAAsC,CAAC;EAC5E,IAAI,CAACiD,aAAa,IAAI/D,GAAG,CAACe,MAAM,KAAK,MAAM,EAAE,OAAO,KAAK;EAEzD,MAAMiD,UAAU,GAAGD,aAAa,CAAC,CAAC,CAAC;EACnC,MAAMxD,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAMiE,UAAU,GAAG3D,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAAC0D,UAAU,IAAI,CAAC1D,KAAK,EAAE;IACzBlB,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAwB,CAAC,EAAEpB,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,MAAMsD,QAAQ,GAAGhF,gBAAgB,CAAC,CAAC;EACnC,IAAIiF,MAAqB,GAAG,IAAI;EAEhC,IAAI,CAACF,UAAU,EAAE;IACf,MAAM;MAAE9B,IAAI,EAAE;QAAEiC,IAAI,EAAEC;MAAS,CAAC;MAAErC,KAAK,EAAEsC;IAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACjE,KAAK,CAAC;IACzF,IAAI+D,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1BhF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAEuB,KAAK,EAAE;MAA2B,CAAC,EAAEpB,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;IACAuD,MAAM,GAAGE,QAAQ,CAACrB,EAAE;EACtB;EAEA,IAAIyB,OAAe;EACnB,IAAI;IAAEA,OAAO,GAAG,MAAMnF,QAAQ,CAACU,GAAG,CAAC;EAAE,CAAC,CAAC,MAAM;IAC3CX,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAyB,CAAC,EAAEpB,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,IAAI8D,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,CAAC;EAAE,CAAC,CAAC,MAAM;IACxCpF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAe,CAAC,EAAEpB,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EACA,IAAI,CAAC8D,IAAI,CAAChC,MAAM,EAAE;IAChBrD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAsC,CAAC,EAAEpB,WAAW,CAAC;IACrF,OAAO,IAAI;EACb;;EAEA;EACA,MAAM;IAAEuB,IAAI,EAAEC;EAAS,CAAC,GAAG,MAAM8B,QAAQ,CAAC7B,IAAI,CAAC,4BAA4B,CAAC,CACzEC,MAAM,CAAC,kBAAkB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEyB,UAAU,CAAC,CAACa,MAAM,CAAC,CAAC;EAC3D,IAAI,CAACzC,QAAQ,EAAE;IACb/C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAqB,CAAC,EAAEpB,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;;EAEA;EACA,IAAI,CAACqD,UAAU,IAAIE,MAAM,EAAE;IACzB,MAAM;MAAEhC,IAAI,EAAE2C;IAAmB,CAAC,GAAG,MAAMZ,QAAQ,CAAC7B,IAAI,CAAC,eAAe,CAAC,CACtEC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,QAAQ,CAACc,QAAQ,CAAC,CAACX,EAAE,CAAC,SAAS,EAAE4B,MAAM,CAAC,CAACU,MAAM,CAAC,CAAC;IAChF,IAAI,CAACC,kBAAkB,EAAE;MACvBzF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAEuB,KAAK,EAAE;MAA6C,CAAC,EAAEpB,WAAW,CAAC;MAC5F,OAAO,IAAI;IACb;EACF;EAEA,MAAM;IAAEuB,IAAI,EAAE4C,MAAM;IAAE/C;EAAM,CAAC,GAAG,MAAMkC,QAAQ,CAACpB,GAAG,CAAC,qBAAqB,EAAE;IACxEC,aAAa,EAAEiB,UAAU;IACzBf,UAAU,EAAEb,QAAQ,CAACc,QAAQ;IAC7BC,UAAU,EAAEuB,IAAI,CAAChC,MAAM;IACvBU,eAAe,EAAEsB,IAAI,CAACM,aAAa,IAAI,CAAC,CAAC;IACzC1B,cAAc,EAAEa,MAAM,IAAIO,IAAI,CAACO,YAAY,IAAI;EACjD,CAAC,CAAC;EAEF,IAAIjD,KAAK,EAAE;IACT3C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE8C,OAAO,EAAE,KAAK;MAAEvB,KAAK,EAAEA,KAAK,CAACwB;IAAQ,CAAC,EAAE5C,WAAW,CAAC;IAC7E,OAAO,IAAI;EACb;;EAEA;EACA,IAAImE,MAAM,EAAExB,OAAO,IAAInB,QAAQ,CAACqB,MAAM,EAAE;IACtC,IAAI;MACF,MAAMrE,kBAAkB,CAAC8E,QAAQ,EAAE9B,QAAQ,CAACqB,MAAM,CAAC;IACrD,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZjE,GAAG,CAACuC,KAAK,CAAC;QAAE0B,GAAG,EAAGA,GAAG,CAAWF;MAAQ,CAAC,EAAE,oCAAoC,CAAC;IAClF;EACF;EAEAnE,YAAY,CAACoB,GAAG,EAAEsE,MAAM,EAAExB,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEwB,MAAM,EAAEnE,WAAW,CAAC;EACnE,OAAO,IAAI;AACb","ignoreList":[]}
+{"version":3,"file":"server-routes-approvals.js","names":["createLogger","getServiceClient","verifyGuestApprovalSignature","executeInlineChain","jsonResponse","readBody","safeCompare","getClientIp","sendIpRateLimit","log","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","getToken","req","authHeader","headers","authorization","startsWith","substring","isInternalAuth","token","handleGuestApproval","res","ctx","pathname","corsHeaders","guestApprovalMatch","match","method","clientIp","stepRunId","urlParams","URL","url","host","searchParams","action","get","expires","sig","error","Date","guestSupabase","data","approval","from","select","eq","limit","length","status","isApprove","guestResult","guestErr","rpc","p_approval_id","id","p_store_id","store_id","p_response","p_response_data","guest","p_responded_by","success","message","run_id","err","runId","writeHead","end","handleApprovalRespond","approvalMatch","approvalId","isInternal","supabase","userId","user","authUser","authError","auth","getUser","rawBody","body","JSON","parse","single","approvalMembership","result","response_data","responded_by"],"sources":["../../src/server/server-routes-approvals.ts"],"sourcesContent":["// server/server-routes-approvals.ts — Approval route handlers\n// Guest approval GET and authenticated approval respond POST\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { verifyGuestApprovalSignature, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, getClientIp, type ServerContext } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\n\nconst log = createLogger(\"server-routes-approvals\");\n\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n\n// ============================================================================\n// GET /approvals/guest/:id — Guest approval via signed URL (no auth required)\n// GET /approvals/guest/:id?action=approve&expires=...&sig=...\n// ============================================================================\n\nexport async function handleGuestApproval(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const guestApprovalMatch = pathname.match(/^\\/approvals\\/guest\\/([a-f0-9-]+)$/);\n  if (!(guestApprovalMatch && req.method === \"GET\")) return false;\n\n  const clientIp = getClientIp(req);\n  if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;\n\n  const stepRunId = guestApprovalMatch[1];\n  const urlParams = new URL(req.url || \"\", `http://${req.headers.host}`).searchParams;\n  const action = urlParams.get(\"action\") || \"\";\n  const expires = urlParams.get(\"expires\") || \"\";\n  const sig = urlParams.get(\"sig\") || \"\";\n\n  if (!action || !expires || !sig) {\n    jsonResponse(res, 400, { error: \"Missing action, expires, or sig parameter\" }, corsHeaders);\n    return true;\n  }\n  if (new Date(expires) < new Date()) {\n    jsonResponse(res, 410, { error: \"This approval link has expired\" }, corsHeaders);\n    return true;\n  }\n  if (!verifyGuestApprovalSignature(stepRunId, action, expires, sig)) {\n    jsonResponse(res, 403, { error: \"Invalid signature\" }, corsHeaders);\n    return true;\n  }\n\n  const guestSupabase = getServiceClient();\n\n  const { data: approval } = await guestSupabase.from(\"workflow_approval_requests\")\n    .select(\"id, store_id, run_id, status\").eq(\"step_run_id\", stepRunId).limit(1);\n  if (!approval?.length) {\n    jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders);\n    return true;\n  }\n  if (approval[0].status !== \"pending\") {\n    jsonResponse(res, 409, { error: `Approval already ${approval[0].status}` }, corsHeaders);\n    return true;\n  }\n\n  const isApprove = action === \"approve\" || action === \"approved\";\n  const { data: guestResult, error: guestErr } = await guestSupabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approval[0].id,\n    p_store_id: approval[0].store_id,\n    p_response: isApprove ? \"approved\" : \"rejected\",\n    p_response_data: { guest: true, action },\n    p_responded_by: null,\n  });\n\n  if (guestErr) {\n    jsonResponse(res, 500, { success: false, error: guestErr.message }, corsHeaders);\n    return true;\n  }\n\n  if (guestResult?.success && approval[0].run_id) {\n    try {\n      await executeInlineChain(guestSupabase, approval[0].run_id);\n    } catch (err) {\n      log.error({ err: (err as Error).message, runId: approval[0].run_id }, \"inline chain failed after guest approval\");\n    }\n  }\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\", ...corsHeaders });\n  res.end(`<!DOCTYPE html><html><body style=\"font-family:system-ui;text-align:center;padding:40px\">\n    <h2>${isApprove ? \"Approved\" : \"Rejected\"}</h2>\n    <p>Your response has been recorded. You can close this window.</p>\n  </body></html>`);\n  return true;\n}\n\n// ============================================================================\n// POST /approvals/:id/respond — Authenticated approval response\n// ============================================================================\n\nexport async function handleApprovalRespond(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const approvalMatch = pathname.match(/^\\/approvals\\/([a-f0-9-]+)\\/respond$/);\n  if (!approvalMatch || req.method !== \"POST\") return false;\n\n  const approvalId = approvalMatch[1];\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n  let userId: string | null = null;\n\n  if (!isInternal) {\n    const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n    userId = authUser.id;\n  }\n\n  let rawBody: string;\n  try { rawBody = await readBody(req); } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n  if (!body.status) {\n    jsonResponse(res, 400, { error: \"status required (approved/rejected)\" }, corsHeaders);\n    return true;\n  }\n\n  // Get store_id from approval\n  const { data: approval } = await supabase.from(\"workflow_approval_requests\")\n    .select(\"store_id, run_id\").eq(\"id\", approvalId).single();\n  if (!approval) {\n    jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders);\n    return true;\n  }\n\n  // P1 FIX: Verify user has access to the approval's store\n  if (!isInternal && userId) {\n    const { data: approvalMembership } = await supabase.from(\"store_members\")\n      .select(\"id\").eq(\"store_id\", approval.store_id).eq(\"user_id\", userId).single();\n    if (!approvalMembership) {\n      jsonResponse(res, 403, { error: \"Not authorized to respond to this approval\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  const { data: result, error } = await supabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approvalId,\n    p_store_id: approval.store_id,\n    p_response: body.status,\n    p_response_data: body.response_data || {},\n    p_responded_by: userId || body.responded_by || null,\n  });\n\n  if (error) {\n    jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders);\n    return true;\n  }\n\n  // Inline resume — execute next step immediately\n  if (result?.success && approval.run_id) {\n    try {\n      await executeInlineChain(supabase, approval.run_id);\n    } catch (err) {\n      log.error({ err: (err as Error).message }, \"inline chain failed after approval\");\n    }\n  }\n\n  jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,4BAA4B,EAAEC,kBAAkB,QAAQ,yBAAyB;AAC1F,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,QAA4B,qBAAqB;AAC1G,SAASC,eAAe,QAAQ,wBAAwB;AAExD,MAAMC,GAAG,GAAGT,YAAY,CAAC,yBAAyB,CAAC;AAEnD,MAAMU,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;;AAEA,SAASC,QAAQA,CAACC,GAAyB,EAAU;EACnD,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAACC,aAAa;EAC5C,OAAOF,UAAU,EAAEG,UAAU,CAAC,SAAS,CAAC,GAAGH,UAAU,CAACI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASC,cAAcA,CAACC,KAAa,EAAW;EAC9C,OAAOjB,WAAW,CAACiB,KAAK,EAAET,mBAAmB,CAAC,IAAIR,WAAW,CAACiB,KAAK,EAAEb,yBAAyB,CAAC,IAAIJ,WAAW,CAACiB,KAAK,EAAEV,gBAAgB,CAAC;AACzI;;AAEA;AACA;AACA;AACA;;AAEA,OAAO,eAAeW,mBAAmBA,CACvCR,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMG,kBAAkB,GAAGF,QAAQ,CAACG,KAAK,CAAC,oCAAoC,CAAC;EAC/E,IAAI,EAAED,kBAAkB,IAAIb,GAAG,CAACe,MAAM,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;EAE/D,MAAMC,QAAQ,GAAGzB,WAAW,CAACS,GAAG,CAAC;EACjC,IAAIR,eAAe,CAACiB,GAAG,EAAEO,QAAQ,EAAEJ,WAAW,CAAC,EAAE,OAAO,IAAI;EAE5D,MAAMK,SAAS,GAAGJ,kBAAkB,CAAC,CAAC,CAAC;EACvC,MAAMK,SAAS,GAAG,IAAIC,GAAG,CAACnB,GAAG,CAACoB,GAAG,IAAI,EAAE,EAAE,UAAUpB,GAAG,CAACE,OAAO,CAACmB,IAAI,EAAE,CAAC,CAACC,YAAY;EACnF,MAAMC,MAAM,GAAGL,SAAS,CAACM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;EAC5C,MAAMC,OAAO,GAAGP,SAAS,CAACM,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;EAC9C,MAAME,GAAG,GAAGR,SAAS,CAACM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;EAEtC,IAAI,CAACD,MAAM,IAAI,CAACE,OAAO,IAAI,CAACC,GAAG,EAAE;IAC/BtC,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAA4C,CAAC,EAAEf,WAAW,CAAC;IAC3F,OAAO,IAAI;EACb;EACA,IAAI,IAAIgB,IAAI,CAACH,OAAO,CAAC,GAAG,IAAIG,IAAI,CAAC,CAAC,EAAE;IAClCxC,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAAiC,CAAC,EAAEf,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;EACA,IAAI,CAAC1B,4BAA4B,CAAC+B,SAAS,EAAEM,MAAM,EAAEE,OAAO,EAAEC,GAAG,CAAC,EAAE;IAClEtC,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAAoB,CAAC,EAAEf,WAAW,CAAC;IACnE,OAAO,IAAI;EACb;EAEA,MAAMiB,aAAa,GAAG5C,gBAAgB,CAAC,CAAC;EAExC,MAAM;IAAE6C,IAAI,EAAEC;EAAS,CAAC,GAAG,MAAMF,aAAa,CAACG,IAAI,CAAC,4BAA4B,CAAC,CAC9EC,MAAM,CAAC,8BAA8B,CAAC,CAACC,EAAE,CAAC,aAAa,EAAEjB,SAAS,CAAC,CAACkB,KAAK,CAAC,CAAC,CAAC;EAC/E,IAAI,CAACJ,QAAQ,EAAEK,MAAM,EAAE;IACrBhD,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAAqB,CAAC,EAAEf,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;EACA,IAAImB,QAAQ,CAAC,CAAC,CAAC,CAACM,MAAM,KAAK,SAAS,EAAE;IACpCjD,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE,oBAAoBI,QAAQ,CAAC,CAAC,CAAC,CAACM,MAAM;IAAG,CAAC,EAAEzB,WAAW,CAAC;IACxF,OAAO,IAAI;EACb;EAEA,MAAM0B,SAAS,GAAGf,MAAM,KAAK,SAAS,IAAIA,MAAM,KAAK,UAAU;EAC/D,MAAM;IAAEO,IAAI,EAAES,WAAW;IAAEZ,KAAK,EAAEa;EAAS,CAAC,GAAG,MAAMX,aAAa,CAACY,GAAG,CAAC,qBAAqB,EAAE;IAC5FC,aAAa,EAAEX,QAAQ,CAAC,CAAC,CAAC,CAACY,EAAE;IAC7BC,UAAU,EAAEb,QAAQ,CAAC,CAAC,CAAC,CAACc,QAAQ;IAChCC,UAAU,EAAER,SAAS,GAAG,UAAU,GAAG,UAAU;IAC/CS,eAAe,EAAE;MAAEC,KAAK,EAAE,IAAI;MAAEzB;IAAO,CAAC;IACxC0B,cAAc,EAAE;EAClB,CAAC,CAAC;EAEF,IAAIT,QAAQ,EAAE;IACZpD,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEyC,OAAO,EAAE,KAAK;MAAEvB,KAAK,EAAEa,QAAQ,CAACW;IAAQ,CAAC,EAAEvC,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;EAEA,IAAI2B,WAAW,EAAEW,OAAO,IAAInB,QAAQ,CAAC,CAAC,CAAC,CAACqB,MAAM,EAAE;IAC9C,IAAI;MACF,MAAMjE,kBAAkB,CAAC0C,aAAa,EAAEE,QAAQ,CAAC,CAAC,CAAC,CAACqB,MAAM,CAAC;IAC7D,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ5D,GAAG,CAACkC,KAAK,CAAC;QAAE0B,GAAG,EAAGA,GAAG,CAAWF,OAAO;QAAEG,KAAK,EAAEvB,QAAQ,CAAC,CAAC,CAAC,CAACqB;MAAO,CAAC,EAAE,0CAA0C,CAAC;IACnH;EACF;EAEA3C,GAAG,CAAC8C,SAAS,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,WAAW;IAAE,GAAG3C;EAAY,CAAC,CAAC;EACnEH,GAAG,CAAC+C,GAAG,CAAC;AACV,UAAUlB,SAAS,GAAG,UAAU,GAAG,UAAU;AAC7C;AACA,iBAAiB,CAAC;EAChB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAemB,qBAAqBA,CACzCzD,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMgD,aAAa,GAAG/C,QAAQ,CAACG,KAAK,CAAC,sCAAsC,CAAC;EAC5E,IAAI,CAAC4C,aAAa,IAAI1D,GAAG,CAACe,MAAM,KAAK,MAAM,EAAE,OAAO,KAAK;EAEzD,MAAM4C,UAAU,GAAGD,aAAa,CAAC,CAAC,CAAC;EACnC,MAAMnD,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAM4D,UAAU,GAAGtD,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAACqD,UAAU,IAAI,CAACrD,KAAK,EAAE;IACzBnB,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAAwB,CAAC,EAAEf,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,MAAMiD,QAAQ,GAAG5E,gBAAgB,CAAC,CAAC;EACnC,IAAI6E,MAAqB,GAAG,IAAI;EAEhC,IAAI,CAACF,UAAU,EAAE;IACf,MAAM;MAAE9B,IAAI,EAAE;QAAEiC,IAAI,EAAEC;MAAS,CAAC;MAAErC,KAAK,EAAEsC;IAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAAC5D,KAAK,CAAC;IACzF,IAAI0D,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1B5E,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEkB,KAAK,EAAE;MAA2B,CAAC,EAAEf,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;IACAkD,MAAM,GAAGE,QAAQ,CAACrB,EAAE;EACtB;EAEA,IAAIyB,OAAe;EACnB,IAAI;IAAEA,OAAO,GAAG,MAAM/E,QAAQ,CAACW,GAAG,CAAC;EAAE,CAAC,CAAC,MAAM;IAC3CZ,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAAyB,CAAC,EAAEf,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,IAAIyD,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,CAAC;EAAE,CAAC,CAAC,MAAM;IACxChF,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAAe,CAAC,EAAEf,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EACA,IAAI,CAACyD,IAAI,CAAChC,MAAM,EAAE;IAChBjD,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAAsC,CAAC,EAAEf,WAAW,CAAC;IACrF,OAAO,IAAI;EACb;;EAEA;EACA,MAAM;IAAEkB,IAAI,EAAEC;EAAS,CAAC,GAAG,MAAM8B,QAAQ,CAAC7B,IAAI,CAAC,4BAA4B,CAAC,CACzEC,MAAM,CAAC,kBAAkB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEyB,UAAU,CAAC,CAACa,MAAM,CAAC,CAAC;EAC3D,IAAI,CAACzC,QAAQ,EAAE;IACb3C,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEkB,KAAK,EAAE;IAAqB,CAAC,EAAEf,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;;EAEA;EACA,IAAI,CAACgD,UAAU,IAAIE,MAAM,EAAE;IACzB,MAAM;MAAEhC,IAAI,EAAE2C;IAAmB,CAAC,GAAG,MAAMZ,QAAQ,CAAC7B,IAAI,CAAC,eAAe,CAAC,CACtEC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,QAAQ,CAACc,QAAQ,CAAC,CAACX,EAAE,CAAC,SAAS,EAAE4B,MAAM,CAAC,CAACU,MAAM,CAAC,CAAC;IAChF,IAAI,CAACC,kBAAkB,EAAE;MACvBrF,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEkB,KAAK,EAAE;MAA6C,CAAC,EAAEf,WAAW,CAAC;MAC5F,OAAO,IAAI;IACb;EACF;EAEA,MAAM;IAAEkB,IAAI,EAAE4C,MAAM;IAAE/C;EAAM,CAAC,GAAG,MAAMkC,QAAQ,CAACpB,GAAG,CAAC,qBAAqB,EAAE;IACxEC,aAAa,EAAEiB,UAAU;IACzBf,UAAU,EAAEb,QAAQ,CAACc,QAAQ;IAC7BC,UAAU,EAAEuB,IAAI,CAAChC,MAAM;IACvBU,eAAe,EAAEsB,IAAI,CAACM,aAAa,IAAI,CAAC,CAAC;IACzC1B,cAAc,EAAEa,MAAM,IAAIO,IAAI,CAACO,YAAY,IAAI;EACjD,CAAC,CAAC;EAEF,IAAIjD,KAAK,EAAE;IACTvC,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEyC,OAAO,EAAE,KAAK;MAAEvB,KAAK,EAAEA,KAAK,CAACwB;IAAQ,CAAC,EAAEvC,WAAW,CAAC;IAC7E,OAAO,IAAI;EACb;;EAEA;EACA,IAAI8D,MAAM,EAAExB,OAAO,IAAInB,QAAQ,CAACqB,MAAM,EAAE;IACtC,IAAI;MACF,MAAMjE,kBAAkB,CAAC0E,QAAQ,EAAE9B,QAAQ,CAACqB,MAAM,CAAC;IACrD,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ5D,GAAG,CAACkC,KAAK,CAAC;QAAE0B,GAAG,EAAGA,GAAG,CAAWF;MAAQ,CAAC,EAAE,oCAAoC,CAAC;IAClF;EACF;EAEA/D,YAAY,CAACqB,GAAG,EAAEiE,MAAM,EAAExB,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEwB,MAAM,EAAE9D,WAAW,CAAC;EACnE,OAAO,IAAI;AACb","ignoreList":[]}

package/dist/server/server-routes-auth.js

@@ -7,7 +7,7 @@ import { sanitizeError } from "../shared/agent-core.js";
 import { getServiceClient } from "./lib/supabase-client.js";
 import { loadCheckpoint } from "./lib/session-checkpoint.js";
 import { processWorkflowSteps, handleWebhookIngestion, executeInlineChain } from "./handlers/workflows.js";
-import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { jsonResponse, readBody, safeCompare, getClientIp } from "./server-helpers.js";
 import { sendIpRateLimit } from "./server-rate-limit.js";
 const log = createLogger("server-routes-auth");
 const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
@@ -272,7 +272,7 @@ export async function handleAuthenticatedRoutes(req, res, pathname, url, corsHea
     // Webhook ingestion
     const webhookMatch = pathname.match(/^\/webhooks\/([a-zA-Z0-9_-]+)$/);
     if (webhookMatch) {
-      const whClientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+      const whClientIp = getClientIp(req);
       if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;
       const slug = webhookMatch[1];
       let rawBody;

package/dist/server/server-routes-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-routes-auth.js","names":["createLogger","sanitizeError","getServiceClient","loadCheckpoint","processWorkflowSteps","handleWebhookIngestion","executeInlineChain","jsonResponse","readBody","safeCompare","sendIpRateLimit","log","ANTHROPIC_API_KEY","process","env","SUPABASE_SERVICE_ROLE_KEY","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","handleAuthenticatedRoutes","req","res","pathname","url","corsHeaders","method","error","resumeMatch","match","convId","token","getToken","isInternal","isInternalAuth","supabase","data","user","authUser","authError","auth","getUser","checkpoint","parsedMessages","JSON","parse","messages","success","conversation_id","turn","tokens_used","cost_so_far","tools_used","checkpointed_at","created_at","approvalMatch","approvalId","userId","id","rawBody","body","status","approval","from","select","eq","single","approvalMembership","store_id","result","rpc","p_approval_id","p_store_id","p_response","p_response_data","response_data","p_responded_by","responded_by","message","run_id","err","waitpointMatch","wpToken","authToken","wp","Date","expires_at","update","completion_data","completed_at","toISOString","input","waitpoint_completed","waitpoint_data","step_run_id","runId","webhookMatch","whClientIp","headers","toString","split","trim","socket","remoteAddress","slug","k","v","Object","entries","event_type","idempotency_key","existing","limit","length","event_id","deduplicated","eventId","fireErr","p_event_type","p_event_payload","payload","p_source","source","batch_size","workflow_id","wfOwner","wfOwnerErr","p_workflow_id","p_trigger_type","trigger_type","p_trigger_payload","trigger_payload","p_idempotency_key","wf","published_version_id","version_id","headersSent","authHeader","authorization","startsWith","substring"],"sources":["../../src/server/server-routes-auth.ts"],"sourcesContent":["// server/server-routes-auth.ts — Authenticated POST route handlers\n// Resume, approvals, waitpoints, webhooks, events, workflows, tool exec, telemetry, etc.\n// Extracted from index.ts for modularity.\n\nimport http from \"node:http\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport Anthropic from \"@anthropic-ai/sdk\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { sanitizeError } from \"../shared/agent-core.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { handleProxy } from \"./proxy-handlers.js\";\nimport { handleTranscribe } from \"./handlers/transcription.js\";\nimport { generateCompaction } from \"./lib/compaction-service.js\";\nimport { loadCheckpoint } from \"./lib/session-checkpoint.js\";\nimport { rateLimiter } from \"./lib/rate-limiter.js\";\nimport { sanitizeAndLog } from \"./lib/prompt-sanitizer.js\";\nimport {\n  processWorkflowSteps, handleWebhookIngestion, executeInlineChain,\n} from \"./handlers/workflows.js\";\nimport {\n  loadUserTools, executeTool, type UserToolRow,\n} from \"./tool-router.js\";\nimport { queueSpan, auditRowToSpan } from \"./lib/clickhouse-buffer.js\";\nimport { jsonResponse, readBody, safeCompare } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\nimport { resolveAndValidateStoreId } from \"./server-store.js\";\nimport { handleAgentChat } from \"./server-chat.js\";\n\nconst log = createLogger(\"server-routes-auth\");\n\nconst ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY!;\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n/**\n * Handle all authenticated POST/PUT/DELETE routes.\n * Called after public routes have been checked.\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleAuthenticatedRoutes(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, url: URL, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  if (req.method !== \"POST\" && req.method !== \"DELETE\" && req.method !== \"PUT\") {\n    jsonResponse(res, 405, { error: \"Method not allowed\" }, corsHeaders);\n    return true;\n  }\n\n  try {\n    // Resume conversation from checkpoint\n    const resumeMatch = pathname.match(/^\\/conversations\\/([a-f0-9-]+)\\/resume$/);\n    if (resumeMatch && req.method === \"POST\") {\n      const convId = resumeMatch[1];\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      try { await readBody(req); } catch { /* body not needed */ }\n      const checkpoint = await loadCheckpoint(supabase, convId);\n      if (!checkpoint) { jsonResponse(res, 404, { error: \"No checkpoint found for this conversation\" }, corsHeaders); return true; }\n      let parsedMessages: unknown[];\n      try { parsedMessages = JSON.parse(checkpoint.messages); } catch { jsonResponse(res, 422, { error: \"Checkpoint messages corrupted\" }, corsHeaders); return true; }\n      jsonResponse(res, 200, { success: true, conversation_id: checkpoint.conversation_id, turn: checkpoint.turn, messages: parsedMessages, tokens_used: checkpoint.tokens_used, cost_so_far: checkpoint.cost_so_far, tools_used: checkpoint.tools_used, checkpointed_at: checkpoint.created_at }, corsHeaders);\n      return true;\n    }\n\n    // Approval response\n    const approvalMatch = pathname.match(/^\\/approvals\\/([a-f0-9-]+)\\/respond$/);\n    if (approvalMatch) {\n      const approvalId = approvalMatch[1];\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      let userId: string | null = null;\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n        userId = authUser.id;\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (!body.status) { jsonResponse(res, 400, { error: \"status required (approved/rejected)\" }, corsHeaders); return true; }\n      const { data: approval } = await supabase.from(\"workflow_approval_requests\").select(\"store_id, run_id\").eq(\"id\", approvalId).single();\n      if (!approval) { jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders); return true; }\n      if (!isInternal && userId) {\n        const { data: approvalMembership } = await supabase.from(\"store_members\").select(\"id\").eq(\"store_id\", approval.store_id).eq(\"user_id\", userId).single();\n        if (!approvalMembership) { jsonResponse(res, 403, { error: \"Not authorized to respond to this approval\" }, corsHeaders); return true; }\n      }\n      const { data: result, error } = await supabase.rpc(\"respond_to_approval\", { p_approval_id: approvalId, p_store_id: approval.store_id, p_response: body.status, p_response_data: body.response_data || {}, p_responded_by: userId || body.responded_by || null });\n      if (error) { jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders); return true; }\n      if (result?.success && approval.run_id) { try { await executeInlineChain(supabase, approval.run_id); } catch (err) { log.error({ err: (err as Error).message }, \"inline chain failed after approval\"); } }\n      jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);\n      return true;\n    }\n\n    // Waitpoint completion\n    const waitpointMatch = pathname.match(/^\\/waitpoints\\/([a-f0-9-]+)\\/complete$/);\n    if (waitpointMatch) {\n      const wpToken = waitpointMatch[1];\n      const authToken = getToken(req);\n      const isInternal = isInternalAuth(authToken);\n      if (!isInternal && !authToken) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      const { data: wp } = await supabase.from(\"waitpoint_tokens\").select(\"id, run_id, step_run_id, store_id, expires_at, status\").eq(\"token\", wpToken).single();\n      if (!wp) { jsonResponse(res, 404, { error: \"Waitpoint token not found\" }, corsHeaders); return true; }\n      if (wp.status === \"completed\") { jsonResponse(res, 409, { error: \"Waitpoint already completed\" }, corsHeaders); return true; }\n      if (new Date(wp.expires_at) < new Date()) { jsonResponse(res, 410, { error: \"Waitpoint expired\" }, corsHeaders); return true; }\n      await supabase.from(\"waitpoint_tokens\").update({ status: \"completed\", completion_data: body.data || {}, completed_at: new Date().toISOString() }).eq(\"id\", wp.id);\n      await supabase.from(\"workflow_step_runs\").update({ status: \"pending\", input: { waitpoint_completed: true, waitpoint_data: body.data || {} } }).eq(\"id\", wp.step_run_id).eq(\"status\", \"waiting\");\n      try { await executeInlineChain(supabase, wp.run_id); } catch (err) { log.error({ err: (err as Error).message, runId: wp.run_id }, \"inline chain failed after waitpoint\"); }\n      jsonResponse(res, 200, { success: true, run_id: wp.run_id }, corsHeaders);\n      return true;\n    }\n\n    // Webhook ingestion\n    const webhookMatch = pathname.match(/^\\/webhooks\\/([a-zA-Z0-9_-]+)$/);\n    if (webhookMatch) {\n      const whClientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n      if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;\n      const slug = webhookMatch[1];\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      const headers: Record<string, string> = {};\n      for (const [k, v] of Object.entries(req.headers)) { if (typeof v === \"string\") headers[k] = v; }\n      const result = await handleWebhookIngestion(supabase, slug, rawBody, headers);\n      if (result.body.run_id && result.status === 200) {\n        try { await executeInlineChain(supabase, result.body.run_id as string); } catch (err) { log.error({ err: (err as Error).message }, \"webhook inline chain error\"); }\n      }\n      jsonResponse(res, result.status, result.body, corsHeaders);\n      return true;\n    }\n\n    // Fire event\n    if (pathname === \"/events\") {\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (!body.store_id || !body.event_type) { jsonResponse(res, 400, { error: \"store_id and event_type required\" }, corsHeaders); return true; }\n      if (body.idempotency_key) {\n        const { data: existing } = await supabase.from(\"workflow_events\").select(\"id\").eq(\"idempotency_key\", body.idempotency_key).limit(1);\n        if (existing && existing.length > 0) { jsonResponse(res, 200, { success: true, event_id: existing[0].id, deduplicated: true }, corsHeaders); return true; }\n      }\n      const { data: eventId, error: fireErr } = await supabase.rpc(\"fire_event\", { p_store_id: body.store_id, p_event_type: body.event_type, p_event_payload: body.payload || {}, p_source: body.source || \"api\" });\n      if (fireErr) jsonResponse(res, 500, { success: false, error: fireErr.message }, corsHeaders);\n      else jsonResponse(res, 200, { success: true, event_id: eventId }, corsHeaders);\n      return true;\n    }\n\n    // Workflow process (internal)\n    if (pathname === \"/workflows/process\") {\n      const token = getToken(req);\n      if (!FLY_INTERNAL_SECRET || (!safeCompare(token, FLY_INTERNAL_SECRET) && !safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) && !safeCompare(token, SERVICE_ROLE_JWT))) { jsonResponse(res, 401, { error: \"Unauthorized\" }, corsHeaders); return true; }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { rawBody = \"{}\"; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      const result = await processWorkflowSteps(supabase, body.batch_size || 10);\n      jsonResponse(res, 200, { success: true, ...result }, corsHeaders);\n      return true;\n    }\n\n    // Start workflow run\n    if (pathname === \"/workflows/start\") {\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (body.workflow_id && body.store_id) {\n        const { data: wfOwner, error: wfOwnerErr } = await supabase.from(\"workflows\").select(\"id\").eq(\"id\", body.workflow_id).eq(\"store_id\", body.store_id).single();\n        if (wfOwnerErr || !wfOwner) { jsonResponse(res, 403, { error: \"Workflow does not belong to this store\" }, corsHeaders); return true; }\n      }\n      const { data, error } = await supabase.rpc(\"start_workflow_run\", { p_workflow_id: body.workflow_id, p_store_id: body.store_id, p_trigger_type: body.trigger_type || \"api\", p_trigger_payload: body.trigger_payload || {}, p_idempotency_key: body.idempotency_key || null });\n      if (error) { jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders); }\n      else {\n        if (data?.success && data.run_id && !data.deduplicated) {\n          try {\n            const { data: wf } = await supabase.from(\"workflows\").select(\"published_version_id\").eq(\"id\", body.workflow_id).single();\n            if (wf?.published_version_id) await supabase.from(\"workflow_runs\").update({ version_id: wf.published_version_id }).eq(\"id\", data.run_id);\n            await executeInlineChain(supabase, data.run_id);\n          } catch (err) { log.error({ err: (err as Error).message }, \"start-inline chain error\"); }\n        }\n        jsonResponse(res, data?.success ? 200 : 422, data, corsHeaders);\n      }\n      return true;\n    }\n\n    // If none of the above matched, return false — caller handles auth gate + mode dispatch\n    return false;\n  } catch (err) {\n    if (!res.headersSent) jsonResponse(res, 500, { error: sanitizeError(err) }, corsHeaders);\n    return true;\n  }\n}\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n"],"mappings":"AAAA;AACA;AACA;;AAKA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,aAAa,QAAQ,yBAAyB;AACvD,SAASC,gBAAgB,QAAQ,0BAA0B;AAI3D,SAASC,cAAc,QAAQ,6BAA6B;AAG5D,SACEC,oBAAoB,EAAEC,sBAAsB,EAAEC,kBAAkB,QAC3D,yBAAyB;AAKhC,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAAQ,qBAAqB;AACzE,SAASC,eAAe,QAAQ,wBAAwB;AAIxD,MAAMC,GAAG,GAAGX,YAAY,CAAC,oBAAoB,CAAC;AAE9C,MAAMY,iBAAiB,GAAGC,OAAO,CAACC,GAAG,CAACF,iBAAkB;AACxD,MAAMG,yBAAyB,GAAGF,OAAO,CAACC,GAAG,CAACC,yBAA0B;AACxE,MAAMC,gBAAgB,GAAGH,OAAO,CAACC,GAAG,CAACE,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGJ,OAAO,CAACC,GAAG,CAACG,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAC7CC,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAEC,GAAQ,EAAEC,WAAmC,EAC7C;EAClB,IAAIJ,GAAG,CAACK,MAAM,KAAK,MAAM,IAAIL,GAAG,CAACK,MAAM,KAAK,QAAQ,IAAIL,GAAG,CAACK,MAAM,KAAK,KAAK,EAAE;IAC5EjB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;MAAEK,KAAK,EAAE;IAAqB,CAAC,EAAEF,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;EAEA,IAAI;IACF;IACA,MAAMG,WAAW,GAAGL,QAAQ,CAACM,KAAK,CAAC,yCAAyC,CAAC;IAC7E,IAAID,WAAW,IAAIP,GAAG,CAACK,MAAM,KAAK,MAAM,EAAE;MACxC,MAAMI,MAAM,GAAGF,WAAW,CAAC,CAAC,CAAC;MAC7B,MAAMG,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEtB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC6B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE7B,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAI;QAAE,MAAMf,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM,CAAE;MACrC,MAAMqB,UAAU,GAAG,MAAMrC,cAAc,CAAC8B,QAAQ,EAAEL,MAAM,CAAC;MACzD,IAAI,CAACY,UAAU,EAAE;QAAEjC,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA4C,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC7H,IAAIkB,cAAyB;MAC7B,IAAI;QAAEA,cAAc,GAAGC,IAAI,CAACC,KAAK,CAACH,UAAU,CAACI,QAAQ,CAAC;MAAE,CAAC,CAAC,MAAM;QAAErC,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAgC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAChKhB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAEC,eAAe,EAAEN,UAAU,CAACM,eAAe;QAAEC,IAAI,EAAEP,UAAU,CAACO,IAAI;QAAEH,QAAQ,EAAEH,cAAc;QAAEO,WAAW,EAAER,UAAU,CAACQ,WAAW;QAAEC,WAAW,EAAET,UAAU,CAACS,WAAW;QAAEC,UAAU,EAAEV,UAAU,CAACU,UAAU;QAAEC,eAAe,EAAEX,UAAU,CAACY;MAAW,CAAC,EAAE7B,WAAW,CAAC;MACzS,OAAO,IAAI;IACb;;IAEA;IACA,MAAM8B,aAAa,GAAGhC,QAAQ,CAACM,KAAK,CAAC,sCAAsC,CAAC;IAC5E,IAAI0B,aAAa,EAAE;MACjB,MAAMC,UAAU,GAAGD,aAAa,CAAC,CAAC,CAAC;MACnC,MAAMxB,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEtB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAIqD,MAAqB,GAAG,IAAI;MAChC,IAAI,CAACxB,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE7B,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;QACvHgC,MAAM,GAAGnB,QAAQ,CAACoB,EAAE;MACtB;MACA,IAAIC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzH,IAAI,CAACmC,IAAI,CAACC,MAAM,EAAE;QAAEpD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAsC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACxH,MAAM;QAAEW,IAAI,EAAE0B;MAAS,CAAC,GAAG,MAAM3B,QAAQ,CAAC4B,IAAI,CAAC,4BAA4B,CAAC,CAACC,MAAM,CAAC,kBAAkB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAET,UAAU,CAAC,CAACU,MAAM,CAAC,CAAC;MACrI,IAAI,CAACJ,QAAQ,EAAE;QAAErD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAqB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACpG,IAAI,CAACQ,UAAU,IAAIwB,MAAM,EAAE;QACzB,MAAM;UAAErB,IAAI,EAAE+B;QAAmB,CAAC,GAAG,MAAMhC,QAAQ,CAAC4B,IAAI,CAAC,eAAe,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,QAAQ,CAACM,QAAQ,CAAC,CAACH,EAAE,CAAC,SAAS,EAAER,MAAM,CAAC,CAACS,MAAM,CAAC,CAAC;QACvJ,IAAI,CAACC,kBAAkB,EAAE;UAAE1D,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA6C,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACxI;MACA,MAAM;QAAEW,IAAI,EAAEiC,MAAM;QAAE1C;MAAM,CAAC,GAAG,MAAMQ,QAAQ,CAACmC,GAAG,CAAC,qBAAqB,EAAE;QAAEC,aAAa,EAAEf,UAAU;QAAEgB,UAAU,EAAEV,QAAQ,CAACM,QAAQ;QAAEK,UAAU,EAAEb,IAAI,CAACC,MAAM;QAAEa,eAAe,EAAEd,IAAI,CAACe,aAAa,IAAI,CAAC,CAAC;QAAEC,cAAc,EAAEnB,MAAM,IAAIG,IAAI,CAACiB,YAAY,IAAI;MAAK,CAAC,CAAC;MAChQ,IAAIlD,KAAK,EAAE;QAAElB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEyB,OAAO,EAAE,KAAK;UAAEpB,KAAK,EAAEA,KAAK,CAACmD;QAAQ,CAAC,EAAErD,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzG,IAAI4C,MAAM,EAAEtB,OAAO,IAAIe,QAAQ,CAACiB,MAAM,EAAE;QAAE,IAAI;UAAE,MAAMvE,kBAAkB,CAAC2B,QAAQ,EAAE2B,QAAQ,CAACiB,MAAM,CAAC;QAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;UAAEnE,GAAG,CAACc,KAAK,CAAC;YAAEqD,GAAG,EAAGA,GAAG,CAAWF;UAAQ,CAAC,EAAE,oCAAoC,CAAC;QAAE;MAAE;MACzMrE,YAAY,CAACa,GAAG,EAAE+C,MAAM,EAAEtB,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEsB,MAAM,EAAE5C,WAAW,CAAC;MACnE,OAAO,IAAI;IACb;;IAEA;IACA,MAAMwD,cAAc,GAAG1D,QAAQ,CAACM,KAAK,CAAC,wCAAwC,CAAC;IAC/E,IAAIoD,cAAc,EAAE;MAClB,MAAMC,OAAO,GAAGD,cAAc,CAAC,CAAC,CAAC;MACjC,MAAME,SAAS,GAAGnD,QAAQ,CAACX,GAAG,CAAC;MAC/B,MAAMY,UAAU,GAAGC,cAAc,CAACiD,SAAS,CAAC;MAC5C,IAAI,CAAClD,UAAU,IAAI,CAACkD,SAAS,EAAE;QAAE1E,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACvH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAIuD,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,MAAM;QAAEW,IAAI,EAAEgD;MAAG,CAAC,GAAG,MAAMjD,QAAQ,CAAC4B,IAAI,CAAC,kBAAkB,CAAC,CAACC,MAAM,CAAC,uDAAuD,CAAC,CAACC,EAAE,CAAC,OAAO,EAAEiB,OAAO,CAAC,CAAChB,MAAM,CAAC,CAAC;MAC1J,IAAI,CAACkB,EAAE,EAAE;QAAE3E,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA4B,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACrG,IAAI2D,EAAE,CAACvB,MAAM,KAAK,WAAW,EAAE;QAAEpD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA8B,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC7H,IAAI,IAAI4D,IAAI,CAACD,EAAE,CAACE,UAAU,CAAC,GAAG,IAAID,IAAI,CAAC,CAAC,EAAE;QAAE5E,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAoB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC9H,MAAMU,QAAQ,CAAC4B,IAAI,CAAC,kBAAkB,CAAC,CAACwB,MAAM,CAAC;QAAE1B,MAAM,EAAE,WAAW;QAAE2B,eAAe,EAAE5B,IAAI,CAACxB,IAAI,IAAI,CAAC,CAAC;QAAEqD,YAAY,EAAE,IAAIJ,IAAI,CAAC,CAAC,CAACK,WAAW,CAAC;MAAE,CAAC,CAAC,CAACzB,EAAE,CAAC,IAAI,EAAEmB,EAAE,CAAC1B,EAAE,CAAC;MACjK,MAAMvB,QAAQ,CAAC4B,IAAI,CAAC,oBAAoB,CAAC,CAACwB,MAAM,CAAC;QAAE1B,MAAM,EAAE,SAAS;QAAE8B,KAAK,EAAE;UAAEC,mBAAmB,EAAE,IAAI;UAAEC,cAAc,EAAEjC,IAAI,CAACxB,IAAI,IAAI,CAAC;QAAE;MAAE,CAAC,CAAC,CAAC6B,EAAE,CAAC,IAAI,EAAEmB,EAAE,CAACU,WAAW,CAAC,CAAC7B,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;MAC/L,IAAI;QAAE,MAAMzD,kBAAkB,CAAC2B,QAAQ,EAAEiD,EAAE,CAACL,MAAM,CAAC;MAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;QAAEnE,GAAG,CAACc,KAAK,CAAC;UAAEqD,GAAG,EAAGA,GAAG,CAAWF,OAAO;UAAEiB,KAAK,EAAEX,EAAE,CAACL;QAAO,CAAC,EAAE,qCAAqC,CAAC;MAAE;MAC1KtE,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAEgC,MAAM,EAAEK,EAAE,CAACL;MAAO,CAAC,EAAEtD,WAAW,CAAC;MACzE,OAAO,IAAI;IACb;;IAEA;IACA,MAAMuE,YAAY,GAAGzE,QAAQ,CAACM,KAAK,CAAC,gCAAgC,CAAC;IACrE,IAAImE,YAAY,EAAE;MAChB,MAAMC,UAAU,GAAG5E,GAAG,CAAC6E,OAAO,CAAC,iBAAiB,CAAC,EAAEC,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAIhF,GAAG,CAACiF,MAAM,CAACC,aAAa,IAAI,SAAS;MAC5H,IAAI3F,eAAe,CAACU,GAAG,EAAE2E,UAAU,EAAExE,WAAW,CAAC,EAAE,OAAO,IAAI;MAC9D,MAAM+E,IAAI,GAAGR,YAAY,CAAC,CAAC,CAAC;MAC5B,IAAIrC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,MAAM8F,OAA+B,GAAG,CAAC,CAAC;MAC1C,KAAK,MAAM,CAACO,CAAC,EAAEC,CAAC,CAAC,IAAIC,MAAM,CAACC,OAAO,CAACvF,GAAG,CAAC6E,OAAO,CAAC,EAAE;QAAE,IAAI,OAAOQ,CAAC,KAAK,QAAQ,EAAER,OAAO,CAACO,CAAC,CAAC,GAAGC,CAAC;MAAE;MAC/F,MAAMrC,MAAM,GAAG,MAAM9D,sBAAsB,CAAC4B,QAAQ,EAAEqE,IAAI,EAAE7C,OAAO,EAAEuC,OAAO,CAAC;MAC7E,IAAI7B,MAAM,CAACT,IAAI,CAACmB,MAAM,IAAIV,MAAM,CAACR,MAAM,KAAK,GAAG,EAAE;QAC/C,IAAI;UAAE,MAAMrD,kBAAkB,CAAC2B,QAAQ,EAAEkC,MAAM,CAACT,IAAI,CAACmB,MAAgB,CAAC;QAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;UAAEnE,GAAG,CAACc,KAAK,CAAC;YAAEqD,GAAG,EAAGA,GAAG,CAAWF;UAAQ,CAAC,EAAE,4BAA4B,CAAC;QAAE;MACpK;MACArE,YAAY,CAACa,GAAG,EAAE+C,MAAM,CAACR,MAAM,EAAEQ,MAAM,CAACT,IAAI,EAAEnC,WAAW,CAAC;MAC1D,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,SAAS,EAAE;MAC1B,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEtB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC6B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE7B,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,IAAI,CAACmC,IAAI,CAACQ,QAAQ,IAAI,CAACR,IAAI,CAACiD,UAAU,EAAE;QAAEpG,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAmC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC3I,IAAImC,IAAI,CAACkD,eAAe,EAAE;QACxB,MAAM;UAAE1E,IAAI,EAAE2E;QAAS,CAAC,GAAG,MAAM5E,QAAQ,CAAC4B,IAAI,CAAC,iBAAiB,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,iBAAiB,EAAEL,IAAI,CAACkD,eAAe,CAAC,CAACE,KAAK,CAAC,CAAC,CAAC;QACnI,IAAID,QAAQ,IAAIA,QAAQ,CAACE,MAAM,GAAG,CAAC,EAAE;UAAExG,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEyB,OAAO,EAAE,IAAI;YAAEmE,QAAQ,EAAEH,QAAQ,CAAC,CAAC,CAAC,CAACrD,EAAE;YAAEyD,YAAY,EAAE;UAAK,CAAC,EAAE1F,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MAC5J;MACA,MAAM;QAAEW,IAAI,EAAEgF,OAAO;QAAEzF,KAAK,EAAE0F;MAAQ,CAAC,GAAG,MAAMlF,QAAQ,CAACmC,GAAG,CAAC,YAAY,EAAE;QAAEE,UAAU,EAAEZ,IAAI,CAACQ,QAAQ;QAAEkD,YAAY,EAAE1D,IAAI,CAACiD,UAAU;QAAEU,eAAe,EAAE3D,IAAI,CAAC4D,OAAO,IAAI,CAAC,CAAC;QAAEC,QAAQ,EAAE7D,IAAI,CAAC8D,MAAM,IAAI;MAAM,CAAC,CAAC;MAC7M,IAAIL,OAAO,EAAE5G,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,KAAK;QAAEpB,KAAK,EAAE0F,OAAO,CAACvC;MAAQ,CAAC,EAAErD,WAAW,CAAC,CAAC,KACxFhB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAEmE,QAAQ,EAAEE;MAAQ,CAAC,EAAE3F,WAAW,CAAC;MAC9E,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,oBAAoB,EAAE;MACrC,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,IAAI,CAACF,mBAAmB,IAAK,CAACR,WAAW,CAACoB,KAAK,EAAEZ,mBAAmB,CAAC,IAAI,CAACR,WAAW,CAACoB,KAAK,EAAEd,yBAAyB,CAAC,IAAI,CAACN,WAAW,CAACoB,KAAK,EAAEb,gBAAgB,CAAE,EAAE;QAAET,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAClP,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEsC,OAAO,GAAG,IAAI;MAAE;MAC/D,IAAIC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,MAAMiE,MAAM,GAAG,MAAM/D,oBAAoB,CAAC6B,QAAQ,EAAEyB,IAAI,CAAC+D,UAAU,IAAI,EAAE,CAAC;MAC1ElH,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAE,GAAGsB;MAAO,CAAC,EAAE5C,WAAW,CAAC;MACjE,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,kBAAkB,EAAE;MACnC,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEtB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC6B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE7B,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzH,IAAImC,IAAI,CAACgE,WAAW,IAAIhE,IAAI,CAACQ,QAAQ,EAAE;QACrC,MAAM;UAAEhC,IAAI,EAAEyF,OAAO;UAAElG,KAAK,EAAEmG;QAAW,CAAC,GAAG,MAAM3F,QAAQ,CAAC4B,IAAI,CAAC,WAAW,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEL,IAAI,CAACgE,WAAW,CAAC,CAAC3D,EAAE,CAAC,UAAU,EAAEL,IAAI,CAACQ,QAAQ,CAAC,CAACF,MAAM,CAAC,CAAC;QAC5J,IAAI4D,UAAU,IAAI,CAACD,OAAO,EAAE;UAAEpH,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAAyC,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACvI;MACA,MAAM;QAAEW,IAAI;QAAET;MAAM,CAAC,GAAG,MAAMQ,QAAQ,CAACmC,GAAG,CAAC,oBAAoB,EAAE;QAAEyD,aAAa,EAAEnE,IAAI,CAACgE,WAAW;QAAEpD,UAAU,EAAEZ,IAAI,CAACQ,QAAQ;QAAE4D,cAAc,EAAEpE,IAAI,CAACqE,YAAY,IAAI,KAAK;QAAEC,iBAAiB,EAAEtE,IAAI,CAACuE,eAAe,IAAI,CAAC,CAAC;QAAEC,iBAAiB,EAAExE,IAAI,CAACkD,eAAe,IAAI;MAAK,CAAC,CAAC;MAC5Q,IAAInF,KAAK,EAAE;QAAElB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEyB,OAAO,EAAE,KAAK;UAAEpB,KAAK,EAAEA,KAAK,CAACmD;QAAQ,CAAC,EAAErD,WAAW,CAAC;MAAE,CAAC,MACxF;QACH,IAAIW,IAAI,EAAEW,OAAO,IAAIX,IAAI,CAAC2C,MAAM,IAAI,CAAC3C,IAAI,CAAC+E,YAAY,EAAE;UACtD,IAAI;YACF,MAAM;cAAE/E,IAAI,EAAEiG;YAAG,CAAC,GAAG,MAAMlG,QAAQ,CAAC4B,IAAI,CAAC,WAAW,CAAC,CAACC,MAAM,CAAC,sBAAsB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEL,IAAI,CAACgE,WAAW,CAAC,CAAC1D,MAAM,CAAC,CAAC;YACxH,IAAImE,EAAE,EAAEC,oBAAoB,EAAE,MAAMnG,QAAQ,CAAC4B,IAAI,CAAC,eAAe,CAAC,CAACwB,MAAM,CAAC;cAAEgD,UAAU,EAAEF,EAAE,CAACC;YAAqB,CAAC,CAAC,CAACrE,EAAE,CAAC,IAAI,EAAE7B,IAAI,CAAC2C,MAAM,CAAC;YACxI,MAAMvE,kBAAkB,CAAC2B,QAAQ,EAAEC,IAAI,CAAC2C,MAAM,CAAC;UACjD,CAAC,CAAC,OAAOC,GAAG,EAAE;YAAEnE,GAAG,CAACc,KAAK,CAAC;cAAEqD,GAAG,EAAGA,GAAG,CAAWF;YAAQ,CAAC,EAAE,0BAA0B,CAAC;UAAE;QAC1F;QACArE,YAAY,CAACa,GAAG,EAAEc,IAAI,EAAEW,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEX,IAAI,EAAEX,WAAW,CAAC;MACjE;MACA,OAAO,IAAI;IACb;;IAEA;IACA,OAAO,KAAK;EACd,CAAC,CAAC,OAAOuD,GAAG,EAAE;IACZ,IAAI,CAAC1D,GAAG,CAACkH,WAAW,EAAE/H,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;MAAEK,KAAK,EAAExB,aAAa,CAAC6E,GAAG;IAAE,CAAC,EAAEvD,WAAW,CAAC;IACxF,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;;AAEA,SAASO,QAAQA,CAACX,GAAyB,EAAU;EACnD,MAAMoH,UAAU,GAAGpH,GAAG,CAAC6E,OAAO,CAACwC,aAAa;EAC5C,OAAOD,UAAU,EAAEE,UAAU,CAAC,SAAS,CAAC,GAAGF,UAAU,CAACG,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAAS1G,cAAcA,CAACH,KAAa,EAAW;EAC9C,OAAOpB,WAAW,CAACoB,KAAK,EAAEZ,mBAAmB,CAAC,IAAIR,WAAW,CAACoB,KAAK,EAAEd,yBAAyB,CAAC,IAAIN,WAAW,CAACoB,KAAK,EAAEb,gBAAgB,CAAC;AACzI","ignoreList":[]}
+{"version":3,"file":"server-routes-auth.js","names":["createLogger","sanitizeError","getServiceClient","loadCheckpoint","processWorkflowSteps","handleWebhookIngestion","executeInlineChain","jsonResponse","readBody","safeCompare","getClientIp","sendIpRateLimit","log","ANTHROPIC_API_KEY","process","env","SUPABASE_SERVICE_ROLE_KEY","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","handleAuthenticatedRoutes","req","res","pathname","url","corsHeaders","method","error","resumeMatch","match","convId","token","getToken","isInternal","isInternalAuth","supabase","data","user","authUser","authError","auth","getUser","checkpoint","parsedMessages","JSON","parse","messages","success","conversation_id","turn","tokens_used","cost_so_far","tools_used","checkpointed_at","created_at","approvalMatch","approvalId","userId","id","rawBody","body","status","approval","from","select","eq","single","approvalMembership","store_id","result","rpc","p_approval_id","p_store_id","p_response","p_response_data","response_data","p_responded_by","responded_by","message","run_id","err","waitpointMatch","wpToken","authToken","wp","Date","expires_at","update","completion_data","completed_at","toISOString","input","waitpoint_completed","waitpoint_data","step_run_id","runId","webhookMatch","whClientIp","slug","headers","k","v","Object","entries","event_type","idempotency_key","existing","limit","length","event_id","deduplicated","eventId","fireErr","p_event_type","p_event_payload","payload","p_source","source","batch_size","workflow_id","wfOwner","wfOwnerErr","p_workflow_id","p_trigger_type","trigger_type","p_trigger_payload","trigger_payload","p_idempotency_key","wf","published_version_id","version_id","headersSent","authHeader","authorization","startsWith","substring"],"sources":["../../src/server/server-routes-auth.ts"],"sourcesContent":["// server/server-routes-auth.ts — Authenticated POST route handlers\n// Resume, approvals, waitpoints, webhooks, events, workflows, tool exec, telemetry, etc.\n// Extracted from index.ts for modularity.\n\nimport http from \"node:http\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport Anthropic from \"@anthropic-ai/sdk\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { sanitizeError } from \"../shared/agent-core.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { handleProxy } from \"./proxy-handlers.js\";\nimport { handleTranscribe } from \"./handlers/transcription.js\";\nimport { generateCompaction } from \"./lib/compaction-service.js\";\nimport { loadCheckpoint } from \"./lib/session-checkpoint.js\";\nimport { rateLimiter } from \"./lib/rate-limiter.js\";\nimport { sanitizeAndLog } from \"./lib/prompt-sanitizer.js\";\nimport {\n  processWorkflowSteps, handleWebhookIngestion, executeInlineChain,\n} from \"./handlers/workflows.js\";\nimport {\n  loadUserTools, executeTool, type UserToolRow,\n} from \"./tool-router.js\";\nimport { queueSpan, auditRowToSpan } from \"./lib/clickhouse-buffer.js\";\nimport { jsonResponse, readBody, safeCompare, getClientIp } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\nimport { resolveAndValidateStoreId } from \"./server-store.js\";\nimport { handleAgentChat } from \"./server-chat.js\";\n\nconst log = createLogger(\"server-routes-auth\");\n\nconst ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY!;\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n/**\n * Handle all authenticated POST/PUT/DELETE routes.\n * Called after public routes have been checked.\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleAuthenticatedRoutes(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, url: URL, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  if (req.method !== \"POST\" && req.method !== \"DELETE\" && req.method !== \"PUT\") {\n    jsonResponse(res, 405, { error: \"Method not allowed\" }, corsHeaders);\n    return true;\n  }\n\n  try {\n    // Resume conversation from checkpoint\n    const resumeMatch = pathname.match(/^\\/conversations\\/([a-f0-9-]+)\\/resume$/);\n    if (resumeMatch && req.method === \"POST\") {\n      const convId = resumeMatch[1];\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      try { await readBody(req); } catch { /* body not needed */ }\n      const checkpoint = await loadCheckpoint(supabase, convId);\n      if (!checkpoint) { jsonResponse(res, 404, { error: \"No checkpoint found for this conversation\" }, corsHeaders); return true; }\n      let parsedMessages: unknown[];\n      try { parsedMessages = JSON.parse(checkpoint.messages); } catch { jsonResponse(res, 422, { error: \"Checkpoint messages corrupted\" }, corsHeaders); return true; }\n      jsonResponse(res, 200, { success: true, conversation_id: checkpoint.conversation_id, turn: checkpoint.turn, messages: parsedMessages, tokens_used: checkpoint.tokens_used, cost_so_far: checkpoint.cost_so_far, tools_used: checkpoint.tools_used, checkpointed_at: checkpoint.created_at }, corsHeaders);\n      return true;\n    }\n\n    // Approval response\n    const approvalMatch = pathname.match(/^\\/approvals\\/([a-f0-9-]+)\\/respond$/);\n    if (approvalMatch) {\n      const approvalId = approvalMatch[1];\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      let userId: string | null = null;\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n        userId = authUser.id;\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (!body.status) { jsonResponse(res, 400, { error: \"status required (approved/rejected)\" }, corsHeaders); return true; }\n      const { data: approval } = await supabase.from(\"workflow_approval_requests\").select(\"store_id, run_id\").eq(\"id\", approvalId).single();\n      if (!approval) { jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders); return true; }\n      if (!isInternal && userId) {\n        const { data: approvalMembership } = await supabase.from(\"store_members\").select(\"id\").eq(\"store_id\", approval.store_id).eq(\"user_id\", userId).single();\n        if (!approvalMembership) { jsonResponse(res, 403, { error: \"Not authorized to respond to this approval\" }, corsHeaders); return true; }\n      }\n      const { data: result, error } = await supabase.rpc(\"respond_to_approval\", { p_approval_id: approvalId, p_store_id: approval.store_id, p_response: body.status, p_response_data: body.response_data || {}, p_responded_by: userId || body.responded_by || null });\n      if (error) { jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders); return true; }\n      if (result?.success && approval.run_id) { try { await executeInlineChain(supabase, approval.run_id); } catch (err) { log.error({ err: (err as Error).message }, \"inline chain failed after approval\"); } }\n      jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);\n      return true;\n    }\n\n    // Waitpoint completion\n    const waitpointMatch = pathname.match(/^\\/waitpoints\\/([a-f0-9-]+)\\/complete$/);\n    if (waitpointMatch) {\n      const wpToken = waitpointMatch[1];\n      const authToken = getToken(req);\n      const isInternal = isInternalAuth(authToken);\n      if (!isInternal && !authToken) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      const { data: wp } = await supabase.from(\"waitpoint_tokens\").select(\"id, run_id, step_run_id, store_id, expires_at, status\").eq(\"token\", wpToken).single();\n      if (!wp) { jsonResponse(res, 404, { error: \"Waitpoint token not found\" }, corsHeaders); return true; }\n      if (wp.status === \"completed\") { jsonResponse(res, 409, { error: \"Waitpoint already completed\" }, corsHeaders); return true; }\n      if (new Date(wp.expires_at) < new Date()) { jsonResponse(res, 410, { error: \"Waitpoint expired\" }, corsHeaders); return true; }\n      await supabase.from(\"waitpoint_tokens\").update({ status: \"completed\", completion_data: body.data || {}, completed_at: new Date().toISOString() }).eq(\"id\", wp.id);\n      await supabase.from(\"workflow_step_runs\").update({ status: \"pending\", input: { waitpoint_completed: true, waitpoint_data: body.data || {} } }).eq(\"id\", wp.step_run_id).eq(\"status\", \"waiting\");\n      try { await executeInlineChain(supabase, wp.run_id); } catch (err) { log.error({ err: (err as Error).message, runId: wp.run_id }, \"inline chain failed after waitpoint\"); }\n      jsonResponse(res, 200, { success: true, run_id: wp.run_id }, corsHeaders);\n      return true;\n    }\n\n    // Webhook ingestion\n    const webhookMatch = pathname.match(/^\\/webhooks\\/([a-zA-Z0-9_-]+)$/);\n    if (webhookMatch) {\n      const whClientIp = getClientIp(req);\n      if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;\n      const slug = webhookMatch[1];\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      const headers: Record<string, string> = {};\n      for (const [k, v] of Object.entries(req.headers)) { if (typeof v === \"string\") headers[k] = v; }\n      const result = await handleWebhookIngestion(supabase, slug, rawBody, headers);\n      if (result.body.run_id && result.status === 200) {\n        try { await executeInlineChain(supabase, result.body.run_id as string); } catch (err) { log.error({ err: (err as Error).message }, \"webhook inline chain error\"); }\n      }\n      jsonResponse(res, result.status, result.body, corsHeaders);\n      return true;\n    }\n\n    // Fire event\n    if (pathname === \"/events\") {\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (!body.store_id || !body.event_type) { jsonResponse(res, 400, { error: \"store_id and event_type required\" }, corsHeaders); return true; }\n      if (body.idempotency_key) {\n        const { data: existing } = await supabase.from(\"workflow_events\").select(\"id\").eq(\"idempotency_key\", body.idempotency_key).limit(1);\n        if (existing && existing.length > 0) { jsonResponse(res, 200, { success: true, event_id: existing[0].id, deduplicated: true }, corsHeaders); return true; }\n      }\n      const { data: eventId, error: fireErr } = await supabase.rpc(\"fire_event\", { p_store_id: body.store_id, p_event_type: body.event_type, p_event_payload: body.payload || {}, p_source: body.source || \"api\" });\n      if (fireErr) jsonResponse(res, 500, { success: false, error: fireErr.message }, corsHeaders);\n      else jsonResponse(res, 200, { success: true, event_id: eventId }, corsHeaders);\n      return true;\n    }\n\n    // Workflow process (internal)\n    if (pathname === \"/workflows/process\") {\n      const token = getToken(req);\n      if (!FLY_INTERNAL_SECRET || (!safeCompare(token, FLY_INTERNAL_SECRET) && !safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) && !safeCompare(token, SERVICE_ROLE_JWT))) { jsonResponse(res, 401, { error: \"Unauthorized\" }, corsHeaders); return true; }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { rawBody = \"{}\"; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      const result = await processWorkflowSteps(supabase, body.batch_size || 10);\n      jsonResponse(res, 200, { success: true, ...result }, corsHeaders);\n      return true;\n    }\n\n    // Start workflow run\n    if (pathname === \"/workflows/start\") {\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (body.workflow_id && body.store_id) {\n        const { data: wfOwner, error: wfOwnerErr } = await supabase.from(\"workflows\").select(\"id\").eq(\"id\", body.workflow_id).eq(\"store_id\", body.store_id).single();\n        if (wfOwnerErr || !wfOwner) { jsonResponse(res, 403, { error: \"Workflow does not belong to this store\" }, corsHeaders); return true; }\n      }\n      const { data, error } = await supabase.rpc(\"start_workflow_run\", { p_workflow_id: body.workflow_id, p_store_id: body.store_id, p_trigger_type: body.trigger_type || \"api\", p_trigger_payload: body.trigger_payload || {}, p_idempotency_key: body.idempotency_key || null });\n      if (error) { jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders); }\n      else {\n        if (data?.success && data.run_id && !data.deduplicated) {\n          try {\n            const { data: wf } = await supabase.from(\"workflows\").select(\"published_version_id\").eq(\"id\", body.workflow_id).single();\n            if (wf?.published_version_id) await supabase.from(\"workflow_runs\").update({ version_id: wf.published_version_id }).eq(\"id\", data.run_id);\n            await executeInlineChain(supabase, data.run_id);\n          } catch (err) { log.error({ err: (err as Error).message }, \"start-inline chain error\"); }\n        }\n        jsonResponse(res, data?.success ? 200 : 422, data, corsHeaders);\n      }\n      return true;\n    }\n\n    // If none of the above matched, return false — caller handles auth gate + mode dispatch\n    return false;\n  } catch (err) {\n    if (!res.headersSent) jsonResponse(res, 500, { error: sanitizeError(err) }, corsHeaders);\n    return true;\n  }\n}\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n"],"mappings":"AAAA;AACA;AACA;;AAKA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,aAAa,QAAQ,yBAAyB;AACvD,SAASC,gBAAgB,QAAQ,0BAA0B;AAI3D,SAASC,cAAc,QAAQ,6BAA6B;AAG5D,SACEC,oBAAoB,EAAEC,sBAAsB,EAAEC,kBAAkB,QAC3D,yBAAyB;AAKhC,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,QAAQ,qBAAqB;AACtF,SAASC,eAAe,QAAQ,wBAAwB;AAIxD,MAAMC,GAAG,GAAGZ,YAAY,CAAC,oBAAoB,CAAC;AAE9C,MAAMa,iBAAiB,GAAGC,OAAO,CAACC,GAAG,CAACF,iBAAkB;AACxD,MAAMG,yBAAyB,GAAGF,OAAO,CAACC,GAAG,CAACC,yBAA0B;AACxE,MAAMC,gBAAgB,GAAGH,OAAO,CAACC,GAAG,CAACE,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGJ,OAAO,CAACC,GAAG,CAACG,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAC7CC,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAEC,GAAQ,EAAEC,WAAmC,EAC7C;EAClB,IAAIJ,GAAG,CAACK,MAAM,KAAK,MAAM,IAAIL,GAAG,CAACK,MAAM,KAAK,QAAQ,IAAIL,GAAG,CAACK,MAAM,KAAK,KAAK,EAAE;IAC5ElB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;MAAEK,KAAK,EAAE;IAAqB,CAAC,EAAEF,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;EAEA,IAAI;IACF;IACA,MAAMG,WAAW,GAAGL,QAAQ,CAACM,KAAK,CAAC,yCAAyC,CAAC;IAC7E,IAAID,WAAW,IAAIP,GAAG,CAACK,MAAM,KAAK,MAAM,EAAE;MACxC,MAAMI,MAAM,GAAGF,WAAW,CAAC,CAAC,CAAC;MAC7B,MAAMG,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEvB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC8B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE9B,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAI;QAAE,MAAMhB,QAAQ,CAACY,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM,CAAE;MACrC,MAAMqB,UAAU,GAAG,MAAMtC,cAAc,CAAC+B,QAAQ,EAAEL,MAAM,CAAC;MACzD,IAAI,CAACY,UAAU,EAAE;QAAElC,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA4C,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC7H,IAAIkB,cAAyB;MAC7B,IAAI;QAAEA,cAAc,GAAGC,IAAI,CAACC,KAAK,CAACH,UAAU,CAACI,QAAQ,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEtC,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAgC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAChKjB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAEC,eAAe,EAAEN,UAAU,CAACM,eAAe;QAAEC,IAAI,EAAEP,UAAU,CAACO,IAAI;QAAEH,QAAQ,EAAEH,cAAc;QAAEO,WAAW,EAAER,UAAU,CAACQ,WAAW;QAAEC,WAAW,EAAET,UAAU,CAACS,WAAW;QAAEC,UAAU,EAAEV,UAAU,CAACU,UAAU;QAAEC,eAAe,EAAEX,UAAU,CAACY;MAAW,CAAC,EAAE7B,WAAW,CAAC;MACzS,OAAO,IAAI;IACb;;IAEA;IACA,MAAM8B,aAAa,GAAGhC,QAAQ,CAACM,KAAK,CAAC,sCAAsC,CAAC;IAC5E,IAAI0B,aAAa,EAAE;MACjB,MAAMC,UAAU,GAAGD,aAAa,CAAC,CAAC,CAAC;MACnC,MAAMxB,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEvB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;MACnC,IAAIsD,MAAqB,GAAG,IAAI;MAChC,IAAI,CAACxB,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE9B,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;QACvHgC,MAAM,GAAGnB,QAAQ,CAACoB,EAAE;MACtB;MACA,IAAIC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMlD,QAAQ,CAACY,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEb,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEnD,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzH,IAAI,CAACmC,IAAI,CAACC,MAAM,EAAE;QAAErD,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAsC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACxH,MAAM;QAAEW,IAAI,EAAE0B;MAAS,CAAC,GAAG,MAAM3B,QAAQ,CAAC4B,IAAI,CAAC,4BAA4B,CAAC,CAACC,MAAM,CAAC,kBAAkB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAET,UAAU,CAAC,CAACU,MAAM,CAAC,CAAC;MACrI,IAAI,CAACJ,QAAQ,EAAE;QAAEtD,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAqB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACpG,IAAI,CAACQ,UAAU,IAAIwB,MAAM,EAAE;QACzB,MAAM;UAAErB,IAAI,EAAE+B;QAAmB,CAAC,GAAG,MAAMhC,QAAQ,CAAC4B,IAAI,CAAC,eAAe,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,QAAQ,CAACM,QAAQ,CAAC,CAACH,EAAE,CAAC,SAAS,EAAER,MAAM,CAAC,CAACS,MAAM,CAAC,CAAC;QACvJ,IAAI,CAACC,kBAAkB,EAAE;UAAE3D,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA6C,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACxI;MACA,MAAM;QAAEW,IAAI,EAAEiC,MAAM;QAAE1C;MAAM,CAAC,GAAG,MAAMQ,QAAQ,CAACmC,GAAG,CAAC,qBAAqB,EAAE;QAAEC,aAAa,EAAEf,UAAU;QAAEgB,UAAU,EAAEV,QAAQ,CAACM,QAAQ;QAAEK,UAAU,EAAEb,IAAI,CAACC,MAAM;QAAEa,eAAe,EAAEd,IAAI,CAACe,aAAa,IAAI,CAAC,CAAC;QAAEC,cAAc,EAAEnB,MAAM,IAAIG,IAAI,CAACiB,YAAY,IAAI;MAAK,CAAC,CAAC;MAChQ,IAAIlD,KAAK,EAAE;QAAEnB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEyB,OAAO,EAAE,KAAK;UAAEpB,KAAK,EAAEA,KAAK,CAACmD;QAAQ,CAAC,EAAErD,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzG,IAAI4C,MAAM,EAAEtB,OAAO,IAAIe,QAAQ,CAACiB,MAAM,EAAE;QAAE,IAAI;UAAE,MAAMxE,kBAAkB,CAAC4B,QAAQ,EAAE2B,QAAQ,CAACiB,MAAM,CAAC;QAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;UAAEnE,GAAG,CAACc,KAAK,CAAC;YAAEqD,GAAG,EAAGA,GAAG,CAAWF;UAAQ,CAAC,EAAE,oCAAoC,CAAC;QAAE;MAAE;MACzMtE,YAAY,CAACc,GAAG,EAAE+C,MAAM,EAAEtB,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEsB,MAAM,EAAE5C,WAAW,CAAC;MACnE,OAAO,IAAI;IACb;;IAEA;IACA,MAAMwD,cAAc,GAAG1D,QAAQ,CAACM,KAAK,CAAC,wCAAwC,CAAC;IAC/E,IAAIoD,cAAc,EAAE;MAClB,MAAMC,OAAO,GAAGD,cAAc,CAAC,CAAC,CAAC;MACjC,MAAME,SAAS,GAAGnD,QAAQ,CAACX,GAAG,CAAC;MAC/B,MAAMY,UAAU,GAAGC,cAAc,CAACiD,SAAS,CAAC;MAC5C,IAAI,CAAClD,UAAU,IAAI,CAACkD,SAAS,EAAE;QAAE3E,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACvH,MAAMU,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;MACnC,IAAIwD,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMlD,QAAQ,CAACY,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEb,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEnD,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,MAAM;QAAEW,IAAI,EAAEgD;MAAG,CAAC,GAAG,MAAMjD,QAAQ,CAAC4B,IAAI,CAAC,kBAAkB,CAAC,CAACC,MAAM,CAAC,uDAAuD,CAAC,CAACC,EAAE,CAAC,OAAO,EAAEiB,OAAO,CAAC,CAAChB,MAAM,CAAC,CAAC;MAC1J,IAAI,CAACkB,EAAE,EAAE;QAAE5E,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA4B,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACrG,IAAI2D,EAAE,CAACvB,MAAM,KAAK,WAAW,EAAE;QAAErD,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA8B,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC7H,IAAI,IAAI4D,IAAI,CAACD,EAAE,CAACE,UAAU,CAAC,GAAG,IAAID,IAAI,CAAC,CAAC,EAAE;QAAE7E,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAoB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC9H,MAAMU,QAAQ,CAAC4B,IAAI,CAAC,kBAAkB,CAAC,CAACwB,MAAM,CAAC;QAAE1B,MAAM,EAAE,WAAW;QAAE2B,eAAe,EAAE5B,IAAI,CAACxB,IAAI,IAAI,CAAC,CAAC;QAAEqD,YAAY,EAAE,IAAIJ,IAAI,CAAC,CAAC,CAACK,WAAW,CAAC;MAAE,CAAC,CAAC,CAACzB,EAAE,CAAC,IAAI,EAAEmB,EAAE,CAAC1B,EAAE,CAAC;MACjK,MAAMvB,QAAQ,CAAC4B,IAAI,CAAC,oBAAoB,CAAC,CAACwB,MAAM,CAAC;QAAE1B,MAAM,EAAE,SAAS;QAAE8B,KAAK,EAAE;UAAEC,mBAAmB,EAAE,IAAI;UAAEC,cAAc,EAAEjC,IAAI,CAACxB,IAAI,IAAI,CAAC;QAAE;MAAE,CAAC,CAAC,CAAC6B,EAAE,CAAC,IAAI,EAAEmB,EAAE,CAACU,WAAW,CAAC,CAAC7B,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;MAC/L,IAAI;QAAE,MAAM1D,kBAAkB,CAAC4B,QAAQ,EAAEiD,EAAE,CAACL,MAAM,CAAC;MAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;QAAEnE,GAAG,CAACc,KAAK,CAAC;UAAEqD,GAAG,EAAGA,GAAG,CAAWF,OAAO;UAAEiB,KAAK,EAAEX,EAAE,CAACL;QAAO,CAAC,EAAE,qCAAqC,CAAC;MAAE;MAC1KvE,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAEgC,MAAM,EAAEK,EAAE,CAACL;MAAO,CAAC,EAAEtD,WAAW,CAAC;MACzE,OAAO,IAAI;IACb;;IAEA;IACA,MAAMuE,YAAY,GAAGzE,QAAQ,CAACM,KAAK,CAAC,gCAAgC,CAAC;IACrE,IAAImE,YAAY,EAAE;MAChB,MAAMC,UAAU,GAAGtF,WAAW,CAACU,GAAG,CAAC;MACnC,IAAIT,eAAe,CAACU,GAAG,EAAE2E,UAAU,EAAExE,WAAW,CAAC,EAAE,OAAO,IAAI;MAC9D,MAAMyE,IAAI,GAAGF,YAAY,CAAC,CAAC,CAAC;MAC5B,IAAIrC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMlD,QAAQ,CAACY,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEb,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,MAAMU,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;MACnC,MAAMgG,OAA+B,GAAG,CAAC,CAAC;MAC1C,KAAK,MAAM,CAACC,CAAC,EAAEC,CAAC,CAAC,IAAIC,MAAM,CAACC,OAAO,CAAClF,GAAG,CAAC8E,OAAO,CAAC,EAAE;QAAE,IAAI,OAAOE,CAAC,KAAK,QAAQ,EAAEF,OAAO,CAACC,CAAC,CAAC,GAAGC,CAAC;MAAE;MAC/F,MAAMhC,MAAM,GAAG,MAAM/D,sBAAsB,CAAC6B,QAAQ,EAAE+D,IAAI,EAAEvC,OAAO,EAAEwC,OAAO,CAAC;MAC7E,IAAI9B,MAAM,CAACT,IAAI,CAACmB,MAAM,IAAIV,MAAM,CAACR,MAAM,KAAK,GAAG,EAAE;QAC/C,IAAI;UAAE,MAAMtD,kBAAkB,CAAC4B,QAAQ,EAAEkC,MAAM,CAACT,IAAI,CAACmB,MAAgB,CAAC;QAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;UAAEnE,GAAG,CAACc,KAAK,CAAC;YAAEqD,GAAG,EAAGA,GAAG,CAAWF;UAAQ,CAAC,EAAE,4BAA4B,CAAC;QAAE;MACpK;MACAtE,YAAY,CAACc,GAAG,EAAE+C,MAAM,CAACR,MAAM,EAAEQ,MAAM,CAACT,IAAI,EAAEnC,WAAW,CAAC;MAC1D,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,SAAS,EAAE;MAC1B,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEvB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC8B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE9B,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMlD,QAAQ,CAACY,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEb,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEnD,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,IAAI,CAACmC,IAAI,CAACQ,QAAQ,IAAI,CAACR,IAAI,CAAC4C,UAAU,EAAE;QAAEhG,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAmC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC3I,IAAImC,IAAI,CAAC6C,eAAe,EAAE;QACxB,MAAM;UAAErE,IAAI,EAAEsE;QAAS,CAAC,GAAG,MAAMvE,QAAQ,CAAC4B,IAAI,CAAC,iBAAiB,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,iBAAiB,EAAEL,IAAI,CAAC6C,eAAe,CAAC,CAACE,KAAK,CAAC,CAAC,CAAC;QACnI,IAAID,QAAQ,IAAIA,QAAQ,CAACE,MAAM,GAAG,CAAC,EAAE;UAAEpG,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;YAAEyB,OAAO,EAAE,IAAI;YAAE8D,QAAQ,EAAEH,QAAQ,CAAC,CAAC,CAAC,CAAChD,EAAE;YAAEoD,YAAY,EAAE;UAAK,CAAC,EAAErF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MAC5J;MACA,MAAM;QAAEW,IAAI,EAAE2E,OAAO;QAAEpF,KAAK,EAAEqF;MAAQ,CAAC,GAAG,MAAM7E,QAAQ,CAACmC,GAAG,CAAC,YAAY,EAAE;QAAEE,UAAU,EAAEZ,IAAI,CAACQ,QAAQ;QAAE6C,YAAY,EAAErD,IAAI,CAAC4C,UAAU;QAAEU,eAAe,EAAEtD,IAAI,CAACuD,OAAO,IAAI,CAAC,CAAC;QAAEC,QAAQ,EAAExD,IAAI,CAACyD,MAAM,IAAI;MAAM,CAAC,CAAC;MAC7M,IAAIL,OAAO,EAAExG,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,KAAK;QAAEpB,KAAK,EAAEqF,OAAO,CAAClC;MAAQ,CAAC,EAAErD,WAAW,CAAC,CAAC,KACxFjB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAE8D,QAAQ,EAAEE;MAAQ,CAAC,EAAEtF,WAAW,CAAC;MAC9E,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,oBAAoB,EAAE;MACrC,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,IAAI,CAACF,mBAAmB,IAAK,CAACT,WAAW,CAACqB,KAAK,EAAEZ,mBAAmB,CAAC,IAAI,CAACT,WAAW,CAACqB,KAAK,EAAEd,yBAAyB,CAAC,IAAI,CAACP,WAAW,CAACqB,KAAK,EAAEb,gBAAgB,CAAE,EAAE;QAAEV,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAClP,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMlD,QAAQ,CAACY,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEsC,OAAO,GAAG,IAAI;MAAE;MAC/D,IAAIC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEnD,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,MAAMU,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;MACnC,MAAMkE,MAAM,GAAG,MAAMhE,oBAAoB,CAAC8B,QAAQ,EAAEyB,IAAI,CAAC0D,UAAU,IAAI,EAAE,CAAC;MAC1E9G,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAE,GAAGsB;MAAO,CAAC,EAAE5C,WAAW,CAAC;MACjE,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,kBAAkB,EAAE;MACnC,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEvB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC8B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE9B,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMlD,QAAQ,CAACY,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEb,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEnD,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzH,IAAImC,IAAI,CAAC2D,WAAW,IAAI3D,IAAI,CAACQ,QAAQ,EAAE;QACrC,MAAM;UAAEhC,IAAI,EAAEoF,OAAO;UAAE7F,KAAK,EAAE8F;QAAW,CAAC,GAAG,MAAMtF,QAAQ,CAAC4B,IAAI,CAAC,WAAW,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEL,IAAI,CAAC2D,WAAW,CAAC,CAACtD,EAAE,CAAC,UAAU,EAAEL,IAAI,CAACQ,QAAQ,CAAC,CAACF,MAAM,CAAC,CAAC;QAC5J,IAAIuD,UAAU,IAAI,CAACD,OAAO,EAAE;UAAEhH,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAAyC,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACvI;MACA,MAAM;QAAEW,IAAI;QAAET;MAAM,CAAC,GAAG,MAAMQ,QAAQ,CAACmC,GAAG,CAAC,oBAAoB,EAAE;QAAEoD,aAAa,EAAE9D,IAAI,CAAC2D,WAAW;QAAE/C,UAAU,EAAEZ,IAAI,CAACQ,QAAQ;QAAEuD,cAAc,EAAE/D,IAAI,CAACgE,YAAY,IAAI,KAAK;QAAEC,iBAAiB,EAAEjE,IAAI,CAACkE,eAAe,IAAI,CAAC,CAAC;QAAEC,iBAAiB,EAAEnE,IAAI,CAAC6C,eAAe,IAAI;MAAK,CAAC,CAAC;MAC5Q,IAAI9E,KAAK,EAAE;QAAEnB,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;UAAEyB,OAAO,EAAE,KAAK;UAAEpB,KAAK,EAAEA,KAAK,CAACmD;QAAQ,CAAC,EAAErD,WAAW,CAAC;MAAE,CAAC,MACxF;QACH,IAAIW,IAAI,EAAEW,OAAO,IAAIX,IAAI,CAAC2C,MAAM,IAAI,CAAC3C,IAAI,CAAC0E,YAAY,EAAE;UACtD,IAAI;YACF,MAAM;cAAE1E,IAAI,EAAE4F;YAAG,CAAC,GAAG,MAAM7F,QAAQ,CAAC4B,IAAI,CAAC,WAAW,CAAC,CAACC,MAAM,CAAC,sBAAsB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEL,IAAI,CAAC2D,WAAW,CAAC,CAACrD,MAAM,CAAC,CAAC;YACxH,IAAI8D,EAAE,EAAEC,oBAAoB,EAAE,MAAM9F,QAAQ,CAAC4B,IAAI,CAAC,eAAe,CAAC,CAACwB,MAAM,CAAC;cAAE2C,UAAU,EAAEF,EAAE,CAACC;YAAqB,CAAC,CAAC,CAAChE,EAAE,CAAC,IAAI,EAAE7B,IAAI,CAAC2C,MAAM,CAAC;YACxI,MAAMxE,kBAAkB,CAAC4B,QAAQ,EAAEC,IAAI,CAAC2C,MAAM,CAAC;UACjD,CAAC,CAAC,OAAOC,GAAG,EAAE;YAAEnE,GAAG,CAACc,KAAK,CAAC;cAAEqD,GAAG,EAAGA,GAAG,CAAWF;YAAQ,CAAC,EAAE,0BAA0B,CAAC;UAAE;QAC1F;QACAtE,YAAY,CAACc,GAAG,EAAEc,IAAI,EAAEW,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEX,IAAI,EAAEX,WAAW,CAAC;MACjE;MACA,OAAO,IAAI;IACb;;IAEA;IACA,OAAO,KAAK;EACd,CAAC,CAAC,OAAOuD,GAAG,EAAE;IACZ,IAAI,CAAC1D,GAAG,CAAC6G,WAAW,EAAE3H,YAAY,CAACc,GAAG,EAAE,GAAG,EAAE;MAAEK,KAAK,EAAEzB,aAAa,CAAC8E,GAAG;IAAE,CAAC,EAAEvD,WAAW,CAAC;IACxF,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;;AAEA,SAASO,QAAQA,CAACX,GAAyB,EAAU;EACnD,MAAM+G,UAAU,GAAG/G,GAAG,CAAC8E,OAAO,CAACkC,aAAa;EAC5C,OAAOD,UAAU,EAAEE,UAAU,CAAC,SAAS,CAAC,GAAGF,UAAU,CAACG,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASrG,cAAcA,CAACH,KAAa,EAAW;EAC9C,OAAOrB,WAAW,CAACqB,KAAK,EAAEZ,mBAAmB,CAAC,IAAIT,WAAW,CAACqB,KAAK,EAAEd,yBAAyB,CAAC,IAAIP,WAAW,CAACqB,KAAK,EAAEb,gBAAgB,CAAC;AACzI","ignoreList":[]}

package/dist/server/server-routes-events.js

@@ -5,7 +5,7 @@
 import { createLogger } from "./lib/logger.js";
 import { getServiceClient } from "./lib/supabase-client.js";
 import { handleWebhookIngestion as processWebhook, executeInlineChain } from "./handlers/workflows.js";
-import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { jsonResponse, readBody, safeCompare, getClientIp } from "./server-helpers.js";
 import { sendIpRateLimit } from "./server-rate-limit.js";
 const log = createLogger("server-routes-events");
 const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
@@ -132,7 +132,7 @@ export async function handleWebhookRoute(req, res, ctx) {
   } = ctx;
   const webhookMatch = pathname.match(/^\/webhooks\/([a-zA-Z0-9_-]+)$/);
   if (!(webhookMatch && req.method === "POST")) return false;
-  const whClientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+  const whClientIp = getClientIp(req);
   if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;
   const slug = webhookMatch[1];
   let rawBody;

package/dist/server/server-routes-events.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-routes-events.js","names":["createLogger","getServiceClient","handleWebhookIngestion","processWebhook","executeInlineChain","jsonResponse","readBody","safeCompare","sendIpRateLimit","log","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","getToken","req","authHeader","headers","authorization","startsWith","substring","isInternalAuth","token","handleFireEvent","res","ctx","pathname","corsHeaders","method","isInternal","error","supabase","data","user","authUser","authError","auth","getUser","rawBody","body","JSON","parse","store_id","event_type","idempotency_key","existing","from","select","eq","limit","length","success","event_id","id","deduplicated","eventId","fireErr","rpc","p_store_id","p_event_type","p_event_payload","payload","p_source","source","message","handleWebhookRoute","webhookMatch","match","whClientIp","toString","split","trim","socket","remoteAddress","slug","k","v","Object","entries","result","run_id","status","err"],"sources":["../../src/server/server-routes-events.ts"],"sourcesContent":["// server/server-routes-events.ts — Event and webhook route handlers\n// Events POST and webhook POST\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { handleWebhookIngestion as processWebhook, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, type ServerContext } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\n\nconst log = createLogger(\"server-routes-events\");\n\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n\n// ============================================================================\n// POST /events — Fire event (service-role or internal auth)\n// ============================================================================\n\nexport async function handleFireEvent(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  if (!(pathname === \"/events\" && req.method === \"POST\")) return false;\n\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n\n  // Verify user auth if not internal\n  if (!isInternal) {\n    const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  let rawBody: string;\n  try {\n    rawBody = await readBody(req);\n  } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody || \"{}\"); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n  if (!body.store_id || !body.event_type) {\n    jsonResponse(res, 400, { error: \"store_id and event_type required\" }, corsHeaders);\n    return true;\n  }\n\n  // Idempotency: if client provides idempotency_key, check for duplicate\n  if (body.idempotency_key) {\n    const { data: existing } = await supabase.from(\"workflow_events\")\n      .select(\"id\")\n      .eq(\"idempotency_key\", body.idempotency_key)\n      .limit(1);\n    if (existing && existing.length > 0) {\n      jsonResponse(res, 200, { success: true, event_id: existing[0].id, deduplicated: true }, corsHeaders);\n      return true;\n    }\n  }\n\n  const { data: eventId, error: fireErr } = await supabase.rpc(\"fire_event\", {\n    p_store_id: body.store_id,\n    p_event_type: body.event_type,\n    p_event_payload: body.payload || {},\n    p_source: body.source || \"api\",\n  });\n\n  if (fireErr) {\n    jsonResponse(res, 500, { success: false, error: fireErr.message }, corsHeaders);\n  } else {\n    jsonResponse(res, 200, { success: true, event_id: eventId }, corsHeaders);\n  }\n  return true;\n}\n\n// ============================================================================\n// POST /webhooks/:slug — Webhook ingestion (no auth — uses HMAC verification)\n// ============================================================================\n\nexport async function handleWebhookRoute(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const webhookMatch = pathname.match(/^\\/webhooks\\/([a-zA-Z0-9_-]+)$/);\n  if (!(webhookMatch && req.method === \"POST\")) return false;\n\n  const whClientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n  if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;\n\n  const slug = webhookMatch[1];\n  let rawBody: string;\n  try {\n    rawBody = await readBody(req);\n  } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n  const headers: Record<string, string> = {};\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (typeof v === \"string\") headers[k] = v;\n  }\n\n  const result = await processWebhook(supabase, slug, rawBody, headers);\n\n  // Phase 1: Inline execution for webhook-triggered workflows\n  if (result.body.run_id && result.status === 200) {\n    try {\n      await executeInlineChain(supabase, result.body.run_id as string);\n    } catch (err) {\n      log.error({ err: (err as Error).message }, \"webhook inline chain error\");\n    }\n  }\n\n  jsonResponse(res, result.status, result.body, corsHeaders);\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,sBAAsB,IAAIC,cAAc,EAAEC,kBAAkB,QAAQ,yBAAyB;AACtG,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAA4B,qBAAqB;AAC7F,SAASC,eAAe,QAAQ,wBAAwB;AAExD,MAAMC,GAAG,GAAGT,YAAY,CAAC,sBAAsB,CAAC;AAEhD,MAAMU,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;;AAEA,SAASC,QAAQA,CAACC,GAAyB,EAAU;EACnD,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAACC,aAAa;EAC5C,OAAOF,UAAU,EAAEG,UAAU,CAAC,SAAS,CAAC,GAAGH,UAAU,CAACI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASC,cAAcA,CAACC,KAAa,EAAW;EAC9C,OAAOhB,WAAW,CAACgB,KAAK,EAAET,mBAAmB,CAAC,IAAIP,WAAW,CAACgB,KAAK,EAAEb,yBAAyB,CAAC,IAAIH,WAAW,CAACgB,KAAK,EAAEV,gBAAgB,CAAC;AACzI;;AAEA;AACA;AACA;;AAEA,OAAO,eAAeW,eAAeA,CACnCR,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,IAAI,EAAEC,QAAQ,KAAK,SAAS,IAAIX,GAAG,CAACa,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAEpE,MAAMN,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAMc,UAAU,GAAGR,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAACO,UAAU,IAAI,CAACP,KAAK,EAAE;IACzBlB,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAwB,CAAC,EAAEH,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,MAAMI,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;;EAEnC;EACA,IAAI,CAAC6B,UAAU,EAAE;IACf,MAAM;MAAEG,IAAI,EAAE;QAAEC,IAAI,EAAEC;MAAS,CAAC;MAAEJ,KAAK,EAAEK;IAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACf,KAAK,CAAC;IACzF,IAAIa,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1B9B,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAEM,KAAK,EAAE;MAA2B,CAAC,EAAEH,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;EACF;EAEA,IAAIW,OAAe;EACnB,IAAI;IACFA,OAAO,GAAG,MAAMjC,QAAQ,CAACU,GAAG,CAAC;EAC/B,CAAC,CAAC,MAAM;IACNX,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAyB,CAAC,EAAEH,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,IAAIY,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,IAAI,IAAI,CAAC;EAAE,CAAC,CAAC,MAAM;IAChDlC,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAe,CAAC,EAAEH,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EACA,IAAI,CAACY,IAAI,CAACG,QAAQ,IAAI,CAACH,IAAI,CAACI,UAAU,EAAE;IACtCvC,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAmC,CAAC,EAAEH,WAAW,CAAC;IAClF,OAAO,IAAI;EACb;;EAEA;EACA,IAAIY,IAAI,CAACK,eAAe,EAAE;IACxB,MAAM;MAAEZ,IAAI,EAAEa;IAAS,CAAC,GAAG,MAAMd,QAAQ,CAACe,IAAI,CAAC,iBAAiB,CAAC,CAC9DC,MAAM,CAAC,IAAI,CAAC,CACZC,EAAE,CAAC,iBAAiB,EAAET,IAAI,CAACK,eAAe,CAAC,CAC3CK,KAAK,CAAC,CAAC,CAAC;IACX,IAAIJ,QAAQ,IAAIA,QAAQ,CAACK,MAAM,GAAG,CAAC,EAAE;MACnC9C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAE2B,OAAO,EAAE,IAAI;QAAEC,QAAQ,EAAEP,QAAQ,CAAC,CAAC,CAAC,CAACQ,EAAE;QAAEC,YAAY,EAAE;MAAK,CAAC,EAAE3B,WAAW,CAAC;MACpG,OAAO,IAAI;IACb;EACF;EAEA,MAAM;IAAEK,IAAI,EAAEuB,OAAO;IAAEzB,KAAK,EAAE0B;EAAQ,CAAC,GAAG,MAAMzB,QAAQ,CAAC0B,GAAG,CAAC,YAAY,EAAE;IACzEC,UAAU,EAAEnB,IAAI,CAACG,QAAQ;IACzBiB,YAAY,EAAEpB,IAAI,CAACI,UAAU;IAC7BiB,eAAe,EAAErB,IAAI,CAACsB,OAAO,IAAI,CAAC,CAAC;IACnCC,QAAQ,EAAEvB,IAAI,CAACwB,MAAM,IAAI;EAC3B,CAAC,CAAC;EAEF,IAAIP,OAAO,EAAE;IACXpD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE2B,OAAO,EAAE,KAAK;MAAErB,KAAK,EAAE0B,OAAO,CAACQ;IAAQ,CAAC,EAAErC,WAAW,CAAC;EACjF,CAAC,MAAM;IACLvB,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE2B,OAAO,EAAE,IAAI;MAAEC,QAAQ,EAAEG;IAAQ,CAAC,EAAE5B,WAAW,CAAC;EAC3E;EACA,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAesC,kBAAkBA,CACtClD,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMyC,YAAY,GAAGxC,QAAQ,CAACyC,KAAK,CAAC,gCAAgC,CAAC;EACrE,IAAI,EAAED,YAAY,IAAInD,GAAG,CAACa,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAE1D,MAAMwC,UAAU,GAAGrD,GAAG,CAACE,OAAO,CAAC,iBAAiB,CAAC,EAAEoD,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAIxD,GAAG,CAACyD,MAAM,CAACC,aAAa,IAAI,SAAS;EAC5H,IAAIlE,eAAe,CAACiB,GAAG,EAAE4C,UAAU,EAAEzC,WAAW,CAAC,EAAE,OAAO,IAAI;EAE9D,MAAM+C,IAAI,GAAGR,YAAY,CAAC,CAAC,CAAC;EAC5B,IAAI5B,OAAe;EACnB,IAAI;IACFA,OAAO,GAAG,MAAMjC,QAAQ,CAACU,GAAG,CAAC;EAC/B,CAAC,CAAC,MAAM;IACNX,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAyB,CAAC,EAAEH,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,MAAMI,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;EACnC,MAAMiB,OAA+B,GAAG,CAAC,CAAC;EAC1C,KAAK,MAAM,CAAC0D,CAAC,EAAEC,CAAC,CAAC,IAAIC,MAAM,CAACC,OAAO,CAAC/D,GAAG,CAACE,OAAO,CAAC,EAAE;IAChD,IAAI,OAAO2D,CAAC,KAAK,QAAQ,EAAE3D,OAAO,CAAC0D,CAAC,CAAC,GAAGC,CAAC;EAC3C;EAEA,MAAMG,MAAM,GAAG,MAAM7E,cAAc,CAAC6B,QAAQ,EAAE2C,IAAI,EAAEpC,OAAO,EAAErB,OAAO,CAAC;;EAErE;EACA,IAAI8D,MAAM,CAACxC,IAAI,CAACyC,MAAM,IAAID,MAAM,CAACE,MAAM,KAAK,GAAG,EAAE;IAC/C,IAAI;MACF,MAAM9E,kBAAkB,CAAC4B,QAAQ,EAAEgD,MAAM,CAACxC,IAAI,CAACyC,MAAgB,CAAC;IAClE,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZ1E,GAAG,CAACsB,KAAK,CAAC;QAAEoD,GAAG,EAAGA,GAAG,CAAWlB;MAAQ,CAAC,EAAE,4BAA4B,CAAC;IAC1E;EACF;EAEA5D,YAAY,CAACoB,GAAG,EAAEuD,MAAM,CAACE,MAAM,EAAEF,MAAM,CAACxC,IAAI,EAAEZ,WAAW,CAAC;EAC1D,OAAO,IAAI;AACb","ignoreList":[]}
+{"version":3,"file":"server-routes-events.js","names":["createLogger","getServiceClient","handleWebhookIngestion","processWebhook","executeInlineChain","jsonResponse","readBody","safeCompare","getClientIp","sendIpRateLimit","log","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","getToken","req","authHeader","headers","authorization","startsWith","substring","isInternalAuth","token","handleFireEvent","res","ctx","pathname","corsHeaders","method","isInternal","error","supabase","data","user","authUser","authError","auth","getUser","rawBody","body","JSON","parse","store_id","event_type","idempotency_key","existing","from","select","eq","limit","length","success","event_id","id","deduplicated","eventId","fireErr","rpc","p_store_id","p_event_type","p_event_payload","payload","p_source","source","message","handleWebhookRoute","webhookMatch","match","whClientIp","slug","k","v","Object","entries","result","run_id","status","err"],"sources":["../../src/server/server-routes-events.ts"],"sourcesContent":["// server/server-routes-events.ts — Event and webhook route handlers\n// Events POST and webhook POST\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { handleWebhookIngestion as processWebhook, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, getClientIp, type ServerContext } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\n\nconst log = createLogger(\"server-routes-events\");\n\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n\n// ============================================================================\n// POST /events — Fire event (service-role or internal auth)\n// ============================================================================\n\nexport async function handleFireEvent(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  if (!(pathname === \"/events\" && req.method === \"POST\")) return false;\n\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n\n  // Verify user auth if not internal\n  if (!isInternal) {\n    const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  let rawBody: string;\n  try {\n    rawBody = await readBody(req);\n  } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody || \"{}\"); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n  if (!body.store_id || !body.event_type) {\n    jsonResponse(res, 400, { error: \"store_id and event_type required\" }, corsHeaders);\n    return true;\n  }\n\n  // Idempotency: if client provides idempotency_key, check for duplicate\n  if (body.idempotency_key) {\n    const { data: existing } = await supabase.from(\"workflow_events\")\n      .select(\"id\")\n      .eq(\"idempotency_key\", body.idempotency_key)\n      .limit(1);\n    if (existing && existing.length > 0) {\n      jsonResponse(res, 200, { success: true, event_id: existing[0].id, deduplicated: true }, corsHeaders);\n      return true;\n    }\n  }\n\n  const { data: eventId, error: fireErr } = await supabase.rpc(\"fire_event\", {\n    p_store_id: body.store_id,\n    p_event_type: body.event_type,\n    p_event_payload: body.payload || {},\n    p_source: body.source || \"api\",\n  });\n\n  if (fireErr) {\n    jsonResponse(res, 500, { success: false, error: fireErr.message }, corsHeaders);\n  } else {\n    jsonResponse(res, 200, { success: true, event_id: eventId }, corsHeaders);\n  }\n  return true;\n}\n\n// ============================================================================\n// POST /webhooks/:slug — Webhook ingestion (no auth — uses HMAC verification)\n// ============================================================================\n\nexport async function handleWebhookRoute(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const webhookMatch = pathname.match(/^\\/webhooks\\/([a-zA-Z0-9_-]+)$/);\n  if (!(webhookMatch && req.method === \"POST\")) return false;\n\n  const whClientIp = getClientIp(req);\n  if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;\n\n  const slug = webhookMatch[1];\n  let rawBody: string;\n  try {\n    rawBody = await readBody(req);\n  } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n  const headers: Record<string, string> = {};\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (typeof v === \"string\") headers[k] = v;\n  }\n\n  const result = await processWebhook(supabase, slug, rawBody, headers);\n\n  // Phase 1: Inline execution for webhook-triggered workflows\n  if (result.body.run_id && result.status === 200) {\n    try {\n      await executeInlineChain(supabase, result.body.run_id as string);\n    } catch (err) {\n      log.error({ err: (err as Error).message }, \"webhook inline chain error\");\n    }\n  }\n\n  jsonResponse(res, result.status, result.body, corsHeaders);\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,sBAAsB,IAAIC,cAAc,EAAEC,kBAAkB,QAAQ,yBAAyB;AACtG,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,QAA4B,qBAAqB;AAC1G,SAASC,eAAe,QAAQ,wBAAwB;AAExD,MAAMC,GAAG,GAAGV,YAAY,CAAC,sBAAsB,CAAC;AAEhD,MAAMW,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;;AAEA,SAASC,QAAQA,CAACC,GAAyB,EAAU;EACnD,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAACC,aAAa;EAC5C,OAAOF,UAAU,EAAEG,UAAU,CAAC,SAAS,CAAC,GAAGH,UAAU,CAACI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASC,cAAcA,CAACC,KAAa,EAAW;EAC9C,OAAOjB,WAAW,CAACiB,KAAK,EAAET,mBAAmB,CAAC,IAAIR,WAAW,CAACiB,KAAK,EAAEb,yBAAyB,CAAC,IAAIJ,WAAW,CAACiB,KAAK,EAAEV,gBAAgB,CAAC;AACzI;;AAEA;AACA;AACA;;AAEA,OAAO,eAAeW,eAAeA,CACnCR,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,IAAI,EAAEC,QAAQ,KAAK,SAAS,IAAIX,GAAG,CAACa,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAEpE,MAAMN,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAMc,UAAU,GAAGR,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAACO,UAAU,IAAI,CAACP,KAAK,EAAE;IACzBnB,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAwB,CAAC,EAAEH,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,MAAMI,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;;EAEnC;EACA,IAAI,CAAC8B,UAAU,EAAE;IACf,MAAM;MAAEG,IAAI,EAAE;QAAEC,IAAI,EAAEC;MAAS,CAAC;MAAEJ,KAAK,EAAEK;IAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACf,KAAK,CAAC;IACzF,IAAIa,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1B/B,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEM,KAAK,EAAE;MAA2B,CAAC,EAAEH,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;EACF;EAEA,IAAIW,OAAe;EACnB,IAAI;IACFA,OAAO,GAAG,MAAMlC,QAAQ,CAACW,GAAG,CAAC;EAC/B,CAAC,CAAC,MAAM;IACNZ,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAyB,CAAC,EAAEH,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,IAAIY,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,IAAI,IAAI,CAAC;EAAE,CAAC,CAAC,MAAM;IAChDnC,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAe,CAAC,EAAEH,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EACA,IAAI,CAACY,IAAI,CAACG,QAAQ,IAAI,CAACH,IAAI,CAACI,UAAU,EAAE;IACtCxC,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAmC,CAAC,EAAEH,WAAW,CAAC;IAClF,OAAO,IAAI;EACb;;EAEA;EACA,IAAIY,IAAI,CAACK,eAAe,EAAE;IACxB,MAAM;MAAEZ,IAAI,EAAEa;IAAS,CAAC,GAAG,MAAMd,QAAQ,CAACe,IAAI,CAAC,iBAAiB,CAAC,CAC9DC,MAAM,CAAC,IAAI,CAAC,CACZC,EAAE,CAAC,iBAAiB,EAAET,IAAI,CAACK,eAAe,CAAC,CAC3CK,KAAK,CAAC,CAAC,CAAC;IACX,IAAIJ,QAAQ,IAAIA,QAAQ,CAACK,MAAM,GAAG,CAAC,EAAE;MACnC/C,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAE2B,OAAO,EAAE,IAAI;QAAEC,QAAQ,EAAEP,QAAQ,CAAC,CAAC,CAAC,CAACQ,EAAE;QAAEC,YAAY,EAAE;MAAK,CAAC,EAAE3B,WAAW,CAAC;MACpG,OAAO,IAAI;IACb;EACF;EAEA,MAAM;IAAEK,IAAI,EAAEuB,OAAO;IAAEzB,KAAK,EAAE0B;EAAQ,CAAC,GAAG,MAAMzB,QAAQ,CAAC0B,GAAG,CAAC,YAAY,EAAE;IACzEC,UAAU,EAAEnB,IAAI,CAACG,QAAQ;IACzBiB,YAAY,EAAEpB,IAAI,CAACI,UAAU;IAC7BiB,eAAe,EAAErB,IAAI,CAACsB,OAAO,IAAI,CAAC,CAAC;IACnCC,QAAQ,EAAEvB,IAAI,CAACwB,MAAM,IAAI;EAC3B,CAAC,CAAC;EAEF,IAAIP,OAAO,EAAE;IACXrD,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAE2B,OAAO,EAAE,KAAK;MAAErB,KAAK,EAAE0B,OAAO,CAACQ;IAAQ,CAAC,EAAErC,WAAW,CAAC;EACjF,CAAC,MAAM;IACLxB,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAE2B,OAAO,EAAE,IAAI;MAAEC,QAAQ,EAAEG;IAAQ,CAAC,EAAE5B,WAAW,CAAC;EAC3E;EACA,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAesC,kBAAkBA,CACtClD,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMyC,YAAY,GAAGxC,QAAQ,CAACyC,KAAK,CAAC,gCAAgC,CAAC;EACrE,IAAI,EAAED,YAAY,IAAInD,GAAG,CAACa,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAE1D,MAAMwC,UAAU,GAAG9D,WAAW,CAACS,GAAG,CAAC;EACnC,IAAIR,eAAe,CAACiB,GAAG,EAAE4C,UAAU,EAAEzC,WAAW,CAAC,EAAE,OAAO,IAAI;EAE9D,MAAM0C,IAAI,GAAGH,YAAY,CAAC,CAAC,CAAC;EAC5B,IAAI5B,OAAe;EACnB,IAAI;IACFA,OAAO,GAAG,MAAMlC,QAAQ,CAACW,GAAG,CAAC;EAC/B,CAAC,CAAC,MAAM;IACNZ,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAyB,CAAC,EAAEH,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,MAAMI,QAAQ,GAAGhC,gBAAgB,CAAC,CAAC;EACnC,MAAMkB,OAA+B,GAAG,CAAC,CAAC;EAC1C,KAAK,MAAM,CAACqD,CAAC,EAAEC,CAAC,CAAC,IAAIC,MAAM,CAACC,OAAO,CAAC1D,GAAG,CAACE,OAAO,CAAC,EAAE;IAChD,IAAI,OAAOsD,CAAC,KAAK,QAAQ,EAAEtD,OAAO,CAACqD,CAAC,CAAC,GAAGC,CAAC;EAC3C;EAEA,MAAMG,MAAM,GAAG,MAAMzE,cAAc,CAAC8B,QAAQ,EAAEsC,IAAI,EAAE/B,OAAO,EAAErB,OAAO,CAAC;;EAErE;EACA,IAAIyD,MAAM,CAACnC,IAAI,CAACoC,MAAM,IAAID,MAAM,CAACE,MAAM,KAAK,GAAG,EAAE;IAC/C,IAAI;MACF,MAAM1E,kBAAkB,CAAC6B,QAAQ,EAAE2C,MAAM,CAACnC,IAAI,CAACoC,MAAgB,CAAC;IAClE,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZrE,GAAG,CAACsB,KAAK,CAAC;QAAE+C,GAAG,EAAGA,GAAG,CAAWb;MAAQ,CAAC,EAAE,4BAA4B,CAAC;IAC1E;EACF;EAEA7D,YAAY,CAACqB,GAAG,EAAEkD,MAAM,CAACE,MAAM,EAAEF,MAAM,CAACnC,IAAI,EAAEZ,WAAW,CAAC;EAC1D,OAAO,IAAI;AACb","ignoreList":[]}

package/dist/server/server-routes-public.js

@@ -7,7 +7,7 @@ import { createLogger } from "./lib/logger.js";
 import { getServiceClient } from "./lib/supabase-client.js";
 import { checkPlanLimits, incrementUsage } from "./handlers/billing.js";
 import { verifyGuestApprovalSignature, executeInlineChain } from "./handlers/workflows.js";
-import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { jsonResponse, readBody, safeCompare, getClientIp } from "./server-helpers.js";
 import { sendIpRateLimit } from "./server-rate-limit.js";
 import { getSseClients, sendWorkflowSSE, safeSseWrite, MAX_SSE_CLIENTS_PER_RUN, MAX_SSE_TOTAL_CLIENTS, getTotalSseClients } from "./server-sse.js";
 const log = createLogger("server-routes-public");
@@ -127,7 +127,7 @@ export async function handleSseStreamRoute(req, res, pathname, corsHeaders) {
 export async function handleGuestApprovalRoute(req, res, pathname, corsHeaders) {
   const guestApprovalMatch = pathname.match(/^\/approvals\/guest\/([a-f0-9-]+)$/);
   if (!(guestApprovalMatch && req.method === "GET")) return false;
-  const clientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+  const clientIp = getClientIp(req);
   if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;
   const stepRunId = guestApprovalMatch[1];
   const urlParams = new URL(req.url || "", `http://${req.headers.host}`).searchParams;
@@ -223,7 +223,7 @@ export async function handleWebchatRoutes(req, res, pathname, url, corsHeaders)
   // POST /webchat/channels/:id/messages
   const webchatMsgMatch = pathname.match(/^\/webchat\/channels\/([a-f0-9-]+)\/messages$/);
   if (webchatMsgMatch && req.method === "POST") {
-    const clientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+    const clientIp = getClientIp(req);
     if (sendIpRateLimit(res, clientIp, webchatCors)) return true;
     let rawBody;
     try {
@@ -366,7 +366,7 @@ export async function handleWebchatRoutes(req, res, pathname, url, corsHeaders)
   // GET /webchat/channels/:id/history
   const webchatHistoryMatch = pathname.match(/^\/webchat\/channels\/([a-f0-9-]+)\/history$/);
   if (webchatHistoryMatch && req.method === "GET") {
-    const clientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+    const clientIp = getClientIp(req);
     if (sendIpRateLimit(res, clientIp, webchatCors)) return true;
     const channelId = webchatHistoryMatch[1];
     const senderId = url.searchParams.get("sender_id") || "";

package/dist/server/server-routes-public.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-routes-public.js","names":["randomUUID","createLogger","getServiceClient","checkPlanLimits","incrementUsage","verifyGuestApprovalSignature","executeInlineChain","jsonResponse","readBody","safeCompare","sendIpRateLimit","getSseClients","sendWorkflowSSE","safeSseWrite","MAX_SSE_CLIENTS_PER_RUN","MAX_SSE_TOTAL_CLIENTS","getTotalSseClients","log","webchatAgentInvoker","setWebchatAgentInvoker","invoker","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","handleSseStreamRoute","req","res","pathname","corsHeaders","method","match","runId","split","authHeader","headers","authorization","token","startsWith","substring","isInternal","error","sb","data","user","authUser","authError","auth","getUser","sseRun","from","select","eq","single","membership","store_id","id","sseClients","existingClients","get","size","writeHead","Connection","run","stepRuns","order","ascending","type","steps","has","set","Set","add","cleanup","clearInterval","heartbeat","clients","delete","setInterval","on","handleGuestApprovalRoute","guestApprovalMatch","clientIp","toString","trim","socket","remoteAddress","stepRunId","urlParams","URL","url","host","searchParams","action","expires","sig","Date","guestSupabase","approval","limit","length","status","isApprove","guestResult","guestErr","rpc","p_approval_id","p_store_id","p_response","p_response_data","guest","p_responded_by","success","message","run_id","err","end","handleWebchatRoutes","webchatCors","webchatMsgMatch","rawBody","channelId","wcBody","JSON","parse","content","supabase","channel","planCheck","allowed","reason","senderId","sender_id","conversationId","conversation_id","thirtyMinAgo","now","toISOString","recent","gt","not","msgErr","insert","channel_id","direction","sender_name","content_type","metadata","source","ip","widget_version","agent_id","messages_in","catch","p_channel_id","agentResponse","result","response","outMsg","auto_response","messages_out","agent_invocations","agent_response","webchatHistoryMatch","reqConvId","wcChannel","test","query","in","messages","histErr","fs","path","possiblePaths","join","import","meta","dirname","__dirname","cwd","widgetJs","p","readFileSync"],"sources":["../../src/server/server-routes-public.ts"],"sourcesContent":["// server/server-routes-public.ts — Public/unauthenticated route handlers\n// SSE streaming, guest approvals, webchat, billing, node routes\n// Extracted from index.ts for modularity.\n\nimport http from \"node:http\";\nimport { randomUUID } from \"node:crypto\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { checkPlanLimits, incrementUsage } from \"./handlers/billing.js\";\nimport { handleBillingRoutes } from \"./handlers/billing.js\";\nimport { handleNodeRoutes } from \"./handlers/nodes.js\";\nimport { verifyGuestApprovalSignature, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\nimport { getSseClients, sendWorkflowSSE, safeSseWrite, MAX_SSE_CLIENTS_PER_RUN, MAX_SSE_TOTAL_CLIENTS, getTotalSseClients } from \"./server-sse.js\";\n\nconst log = createLogger(\"server-routes-public\");\n\n// Webchat agent invoker — set later to avoid circular deps\nlet webchatAgentInvoker: ((\n  supabase: SupabaseClient, agentId: string, message: string, storeId: string, conversationId: string, senderContext?: any,\n) => Promise<{ success: boolean; response?: string; error?: string }>) | null = null;\n\nexport function setWebchatAgentInvoker(invoker: typeof webchatAgentInvoker): void {\n  webchatAgentInvoker = invoker;\n}\n\n// Env secrets (needed for auth checks)\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n/**\n * Handle SSE workflow stream route.\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleSseStreamRoute(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  if (!(req.method === \"GET\" && pathname.match(/^\\/workflows\\/runs\\/[a-f0-9-]+\\/stream$/))) return false;\n\n  const runId = pathname.split(\"/\")[3];\n  const authHeader = req.headers.authorization;\n  const token = authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n  const isInternal = safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n\n  if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n\n  if (!isInternal) {\n    const sb = getServiceClient();\n    const { data: { user: authUser }, error: authError } = await sb.auth.getUser(token);\n    if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n    const { data: sseRun } = await sb.from(\"workflow_runs\").select(\"store_id\").eq(\"id\", runId).single();\n    if (sseRun) {\n      const { data: membership } = await sb.from(\"store_members\").select(\"id\").eq(\"store_id\", sseRun.store_id).eq(\"user_id\", authUser.id).single();\n      if (!membership) { jsonResponse(res, 403, { error: \"Not authorized to view this run\" }, corsHeaders); return true; }\n    }\n  }\n\n  const sseClients = getSseClients();\n  const existingClients = sseClients.get(runId)?.size || 0;\n  if (existingClients >= MAX_SSE_CLIENTS_PER_RUN) { jsonResponse(res, 429, { error: \"Too many SSE clients for this run\" }, corsHeaders); return true; }\n  if (getTotalSseClients() >= MAX_SSE_TOTAL_CLIENTS) { jsonResponse(res, 429, { error: \"Too many total SSE connections\" }, corsHeaders); return true; }\n\n  res.writeHead(200, { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", Connection: \"keep-alive\", ...corsHeaders });\n\n  const sb = getServiceClient();\n  const { data: run } = await sb.from(\"workflow_runs\")\n    .select(\"id, workflow_id, status, trigger_type, current_step_key, error_message, error_step_key, started_at, completed_at, duration_ms\")\n    .eq(\"id\", runId).single();\n  const { data: stepRuns } = await sb.from(\"workflow_step_runs\")\n    .select(\"id, step_key, step_type, status, error_message, duration_ms, started_at, completed_at\")\n    .eq(\"run_id\", runId).order(\"created_at\", { ascending: true });\n\n  sendWorkflowSSE(res, { type: \"snapshot\", run, steps: stepRuns || [] });\n\n  if (!sseClients.has(runId)) sseClients.set(runId, new Set());\n  sseClients.get(runId)!.add(res);\n\n  const cleanup = () => {\n    clearInterval(heartbeat);\n    const clients = sseClients.get(runId);\n    if (clients) { clients.delete(res); if (clients.size === 0) sseClients.delete(runId); }\n  };\n\n  const heartbeat = setInterval(() => {\n    if (!safeSseWrite(res, `: heartbeat\\n\\n`, cleanup)) clearInterval(heartbeat);\n  }, 15_000);\n\n  req.on(\"close\", cleanup);\n  req.on(\"error\", cleanup);\n  return true;\n}\n\n/**\n * Handle guest approval route.\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleGuestApprovalRoute(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  const guestApprovalMatch = pathname.match(/^\\/approvals\\/guest\\/([a-f0-9-]+)$/);\n  if (!(guestApprovalMatch && req.method === \"GET\")) return false;\n\n  const clientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n  if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;\n\n  const stepRunId = guestApprovalMatch[1];\n  const urlParams = new URL(req.url || \"\", `http://${req.headers.host}`).searchParams;\n  const action = urlParams.get(\"action\") || \"\";\n  const expires = urlParams.get(\"expires\") || \"\";\n  const sig = urlParams.get(\"sig\") || \"\";\n\n  if (!action || !expires || !sig) { jsonResponse(res, 400, { error: \"Missing action, expires, or sig parameter\" }, corsHeaders); return true; }\n  if (new Date(expires) < new Date()) { jsonResponse(res, 410, { error: \"This approval link has expired\" }, corsHeaders); return true; }\n  if (!verifyGuestApprovalSignature(stepRunId, action, expires, sig)) { jsonResponse(res, 403, { error: \"Invalid signature\" }, corsHeaders); return true; }\n\n  const guestSupabase = getServiceClient();\n  const { data: approval } = await guestSupabase.from(\"workflow_approval_requests\").select(\"id, store_id, run_id, status\").eq(\"step_run_id\", stepRunId).limit(1);\n  if (!approval?.length) { jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders); return true; }\n  if (approval[0].status !== \"pending\") { jsonResponse(res, 409, { error: `Approval already ${approval[0].status}` }, corsHeaders); return true; }\n\n  const isApprove = action === \"approve\" || action === \"approved\";\n  const { data: guestResult, error: guestErr } = await guestSupabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approval[0].id, p_store_id: approval[0].store_id,\n    p_response: isApprove ? \"approved\" : \"rejected\", p_response_data: { guest: true, action }, p_responded_by: null,\n  });\n\n  if (guestErr) { jsonResponse(res, 500, { success: false, error: guestErr.message }, corsHeaders); return true; }\n\n  if (guestResult?.success && approval[0].run_id) {\n    try { await executeInlineChain(guestSupabase, approval[0].run_id); } catch (err) { log.error({ err: (err as Error).message, runId: approval[0].run_id }, \"inline chain failed after guest approval\"); }\n  }\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\", ...corsHeaders });\n  res.end(`<!DOCTYPE html><html><body style=\"font-family:system-ui;text-align:center;padding:40px\">\n    <h2>${isApprove ? \"Approved\" : \"Rejected\"}</h2>\n    <p>Your response has been recorded. You can close this window.</p>\n  </body></html>`);\n  return true;\n}\n\n/**\n * Handle webchat routes (messages, history, widget.js).\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleWebchatRoutes(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, url: URL, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  const webchatCors = { ...corsHeaders, \"Access-Control-Allow-Origin\": \"*\" };\n\n  // POST /webchat/channels/:id/messages\n  const webchatMsgMatch = pathname.match(/^\\/webchat\\/channels\\/([a-f0-9-]+)\\/messages$/);\n  if (webchatMsgMatch && req.method === \"POST\") {\n    const clientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n    if (sendIpRateLimit(res, clientIp, webchatCors)) return true;\n\n    let rawBody: string;\n    try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, webchatCors); return true; }\n\n    const channelId = webchatMsgMatch[1];\n    let wcBody: any;\n    try { wcBody = JSON.parse(rawBody); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, webchatCors); return true; }\n    if (!wcBody.content || typeof wcBody.content !== \"string\") { jsonResponse(res, 400, { error: \"content (string) is required\" }, webchatCors); return true; }\n    if (wcBody.content.length > 5000) { jsonResponse(res, 400, { error: \"Message too long (max 5000 characters)\" }, webchatCors); return true; }\n\n    const supabase = getServiceClient();\n    const { data: channel } = await supabase.from(\"channels\").select(\"id, store_id, node_id, agent_id, type, config\").eq(\"id\", channelId).eq(\"type\", \"webchat\").single();\n    if (!channel) { jsonResponse(res, 404, { error: \"Webchat channel not found\" }, webchatCors); return true; }\n\n    try {\n      const planCheck = await checkPlanLimits(supabase, channel.store_id, \"message\");\n      if (!planCheck.allowed) { jsonResponse(res, 429, { error: planCheck.reason || \"Plan limit reached\" }, webchatCors); return true; }\n    } catch { /* billing tables may not exist yet */ }\n\n    const senderId = (wcBody.sender_id as string) || \"anonymous\";\n    let conversationId: string = (wcBody.conversation_id as string) || \"\";\n    if (!conversationId) {\n      const thirtyMinAgo = new Date(Date.now() - 30 * 60 * 1000).toISOString();\n      const { data: recent } = await supabase.from(\"channel_messages\").select(\"conversation_id\")\n        .eq(\"channel_id\", channelId).eq(\"sender_id\", senderId).gt(\"created_at\", thirtyMinAgo)\n        .not(\"conversation_id\", \"is\", null).order(\"created_at\", { ascending: false }).limit(1);\n      conversationId = (recent?.length && recent[0].conversation_id) || randomUUID();\n    }\n\n    const { data: message, error: msgErr } = await supabase.from(\"channel_messages\").insert({\n      store_id: channel.store_id, channel_id: channelId, direction: \"inbound\",\n      sender_id: senderId, sender_name: wcBody.sender_name || \"Visitor\",\n      content: wcBody.content, content_type: \"text\",\n      metadata: { source: \"webchat\", ip: clientIp, widget_version: \"1.0.0\" },\n      agent_id: channel.agent_id, conversation_id: conversationId,\n    }).select(\"id, direction, content, conversation_id, created_at\").single();\n    if (msgErr) { jsonResponse(res, 500, { error: msgErr.message }, webchatCors); return true; }\n\n    incrementUsage(supabase, channel.store_id, { messages_in: 1 }).catch(() => {});\n    try { await supabase.rpc(\"increment_channel_stats\", { p_channel_id: channelId }); } catch { /* ok */ }\n\n    let agentResponse: any = null;\n    if (channel.agent_id && webchatAgentInvoker) {\n      try {\n        const result = await webchatAgentInvoker(supabase, channel.agent_id, wcBody.content, channel.store_id, conversationId);\n        if (result.success && result.response) {\n          const { data: outMsg } = await supabase.from(\"channel_messages\").insert({\n            store_id: channel.store_id, channel_id: channelId, direction: \"outbound\",\n            sender_id: \"agent\", sender_name: \"AI Agent\",\n            content: result.response, content_type: \"text\",\n            metadata: { agent_id: channel.agent_id, auto_response: true, source: \"webchat\" },\n            agent_id: channel.agent_id, conversation_id: conversationId,\n          }).select(\"id, direction, content, conversation_id, created_at\").single();\n          agentResponse = outMsg;\n          incrementUsage(supabase, channel.store_id, { messages_out: 1, agent_invocations: 1 }).catch(() => {});\n        }\n      } catch (err) { log.error({ err: (err as Error).message }, \"webchat agent error\"); }\n    }\n\n    jsonResponse(res, 201, { success: true, message, agent_response: agentResponse, conversation_id: conversationId }, webchatCors);\n    return true;\n  }\n\n  // GET /webchat/channels/:id/history\n  const webchatHistoryMatch = pathname.match(/^\\/webchat\\/channels\\/([a-f0-9-]+)\\/history$/);\n  if (webchatHistoryMatch && req.method === \"GET\") {\n    const clientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n    if (sendIpRateLimit(res, clientIp, webchatCors)) return true;\n\n    const channelId = webchatHistoryMatch[1];\n    const senderId = url.searchParams.get(\"sender_id\") || \"\";\n    const reqConvId = url.searchParams.get(\"conversation_id\") || \"\";\n    if (!senderId) { jsonResponse(res, 400, { error: \"sender_id query parameter required\" }, webchatCors); return true; }\n\n    const supabase = getServiceClient();\n    const { data: wcChannel } = await supabase.from(\"channels\").select(\"id, type\").eq(\"id\", channelId).eq(\"type\", \"webchat\").single();\n    if (!wcChannel) { jsonResponse(res, 404, { error: \"Webchat channel not found\" }, webchatCors); return true; }\n\n    if (!/^[a-zA-Z0-9_-]+$/.test(senderId)) { jsonResponse(res, 400, { error: \"Invalid sender_id format\" }, webchatCors); return true; }\n    let query = supabase.from(\"channel_messages\")\n      .select(\"id, direction, sender_id, sender_name, content, content_type, created_at\")\n      .eq(\"channel_id\", channelId);\n    if (reqConvId) { query = query.eq(\"conversation_id\", reqConvId).in(\"sender_id\", [senderId, \"agent\"]); }\n    else { query = query.in(\"sender_id\", [senderId, \"agent\"]); }\n\n    const { data: messages, error: histErr } = await query.order(\"created_at\", { ascending: true }).limit(50);\n    if (histErr) { jsonResponse(res, 500, { error: histErr.message }, webchatCors); return true; }\n    jsonResponse(res, 200, { success: true, messages: messages || [] }, webchatCors);\n    return true;\n  }\n\n  // GET /webchat/widget.js\n  if (pathname === \"/webchat/widget.js\" && req.method === \"GET\") {\n    const fs = await import(\"node:fs\");\n    const path = await import(\"node:path\");\n    const possiblePaths = [\n      path.join(import.meta.dirname || __dirname, \"../../dist/webchat/widget.js\"),\n      path.join(import.meta.dirname || __dirname, \"../../../dist/webchat/widget.js\"),\n      path.join(process.cwd(), \"dist/webchat/widget.js\"),\n    ];\n    let widgetJs: string | null = null;\n    for (const p of possiblePaths) { try { widgetJs = fs.readFileSync(p, \"utf-8\"); break; } catch { /* try next */ } }\n    if (widgetJs) {\n      res.writeHead(200, { \"Content-Type\": \"application/javascript\", \"Cache-Control\": \"public, max-age=3600\", ...webchatCors });\n      res.end(widgetJs);\n    } else {\n      res.writeHead(200, { \"Content-Type\": \"application/javascript\", ...webchatCors });\n      res.end('console.warn(\"[WhaleChat] Widget JS not built. Run: npx esbuild src/webchat/widget.ts --bundle --minify --outfile=dist/webchat/widget.js\");');\n    }\n    return true;\n  }\n\n  return false;\n}\n\n// Billing and node route handling is in the main index.ts to keep this file under 300 lines\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,UAAU,QAAQ,aAAa;AAExC,SAASC,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,eAAe,EAAEC,cAAc,QAAQ,uBAAuB;AAGvE,SAASC,4BAA4B,EAAEC,kBAAkB,QAAQ,yBAAyB;AAC1F,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAAQ,qBAAqB;AACzE,SAASC,eAAe,QAAQ,wBAAwB;AACxD,SAASC,aAAa,EAAEC,eAAe,EAAEC,YAAY,EAAEC,uBAAuB,EAAEC,qBAAqB,EAAEC,kBAAkB,QAAQ,iBAAiB;AAElJ,MAAMC,GAAG,GAAGhB,YAAY,CAAC,sBAAsB,CAAC;;AAEhD;AACA,IAAIiB,mBAEyE,GAAG,IAAI;AAEpF,OAAO,SAASC,sBAAsBA,CAACC,OAAmC,EAAQ;EAChFF,mBAAmB,GAAGE,OAAO;AAC/B;;AAEA;AACA,MAAMC,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;AACA;AACA,OAAO,eAAeC,oBAAoBA,CACxCC,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAEC,WAAmC,EACnC;EAClB,IAAI,EAAEH,GAAG,CAACI,MAAM,KAAK,KAAK,IAAIF,QAAQ,CAACG,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAAE,OAAO,KAAK;EAEtG,MAAMC,KAAK,GAAGJ,QAAQ,CAACK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;EACpC,MAAMC,UAAU,GAAGR,GAAG,CAACS,OAAO,CAACC,aAAa;EAC5C,MAAMC,KAAK,GAAGH,UAAU,EAAEI,UAAU,CAAC,SAAS,CAAC,GAAGJ,UAAU,CAACK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;EAC9E,MAAMC,UAAU,GAAGhC,WAAW,CAAC6B,KAAK,EAAEb,mBAAmB,CAAC,IAAIhB,WAAW,CAAC6B,KAAK,EAAEjB,yBAAyB,CAAC,IAAIZ,WAAW,CAAC6B,KAAK,EAAEd,gBAAgB,CAAC;EAEnJ,IAAI,CAACiB,UAAU,IAAI,CAACH,KAAK,EAAE;IAAE/B,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAwB,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAEnH,IAAI,CAACW,UAAU,EAAE;IACf,MAAME,EAAE,GAAGzC,gBAAgB,CAAC,CAAC;IAC7B,MAAM;MAAE0C,IAAI,EAAE;QAAEC,IAAI,EAAEC;MAAS,CAAC;MAAEJ,KAAK,EAAEK;IAAU,CAAC,GAAG,MAAMJ,EAAE,CAACK,IAAI,CAACC,OAAO,CAACX,KAAK,CAAC;IACnF,IAAIS,SAAS,IAAI,CAACD,QAAQ,EAAE;MAAEvC,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA2B,CAAC,EAAEZ,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IACvH,MAAM;MAAEc,IAAI,EAAEM;IAAO,CAAC,GAAG,MAAMP,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CAACC,MAAM,CAAC,UAAU,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEpB,KAAK,CAAC,CAACqB,MAAM,CAAC,CAAC;IACnG,IAAIJ,MAAM,EAAE;MACV,MAAM;QAAEN,IAAI,EAAEW;MAAW,CAAC,GAAG,MAAMZ,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,MAAM,CAACM,QAAQ,CAAC,CAACH,EAAE,CAAC,SAAS,EAAEP,QAAQ,CAACW,EAAE,CAAC,CAACH,MAAM,CAAC,CAAC;MAC5I,IAAI,CAACC,UAAU,EAAE;QAAEhD,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;UAAEc,KAAK,EAAE;QAAkC,CAAC,EAAEZ,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;IACrH;EACF;EAEA,MAAM4B,UAAU,GAAG/C,aAAa,CAAC,CAAC;EAClC,MAAMgD,eAAe,GAAGD,UAAU,CAACE,GAAG,CAAC3B,KAAK,CAAC,EAAE4B,IAAI,IAAI,CAAC;EACxD,IAAIF,eAAe,IAAI7C,uBAAuB,EAAE;IAAEP,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAoC,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EACpJ,IAAId,kBAAkB,CAAC,CAAC,IAAID,qBAAqB,EAAE;IAAER,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAiC,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAEpJF,GAAG,CAACkC,SAAS,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,mBAAmB;IAAE,eAAe,EAAE,UAAU;IAAEC,UAAU,EAAE,YAAY;IAAE,GAAGjC;EAAY,CAAC,CAAC;EAElI,MAAMa,EAAE,GAAGzC,gBAAgB,CAAC,CAAC;EAC7B,MAAM;IAAE0C,IAAI,EAAEoB;EAAI,CAAC,GAAG,MAAMrB,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CACjDC,MAAM,CAAC,+HAA+H,CAAC,CACvIC,EAAE,CAAC,IAAI,EAAEpB,KAAK,CAAC,CAACqB,MAAM,CAAC,CAAC;EAC3B,MAAM;IAAEV,IAAI,EAAEqB;EAAS,CAAC,GAAG,MAAMtB,EAAE,CAACQ,IAAI,CAAC,oBAAoB,CAAC,CAC3DC,MAAM,CAAC,uFAAuF,CAAC,CAC/FC,EAAE,CAAC,QAAQ,EAAEpB,KAAK,CAAC,CAACiC,KAAK,CAAC,YAAY,EAAE;IAAEC,SAAS,EAAE;EAAK,CAAC,CAAC;EAE/DvD,eAAe,CAACgB,GAAG,EAAE;IAAEwC,IAAI,EAAE,UAAU;IAAEJ,GAAG;IAAEK,KAAK,EAAEJ,QAAQ,IAAI;EAAG,CAAC,CAAC;EAEtE,IAAI,CAACP,UAAU,CAACY,GAAG,CAACrC,KAAK,CAAC,EAAEyB,UAAU,CAACa,GAAG,CAACtC,KAAK,EAAE,IAAIuC,GAAG,CAAC,CAAC,CAAC;EAC5Dd,UAAU,CAACE,GAAG,CAAC3B,KAAK,CAAC,CAAEwC,GAAG,CAAC7C,GAAG,CAAC;EAE/B,MAAM8C,OAAO,GAAGA,CAAA,KAAM;IACpBC,aAAa,CAACC,SAAS,CAAC;IACxB,MAAMC,OAAO,GAAGnB,UAAU,CAACE,GAAG,CAAC3B,KAAK,CAAC;IACrC,IAAI4C,OAAO,EAAE;MAAEA,OAAO,CAACC,MAAM,CAAClD,GAAG,CAAC;MAAE,IAAIiD,OAAO,CAAChB,IAAI,KAAK,CAAC,EAAEH,UAAU,CAACoB,MAAM,CAAC7C,KAAK,CAAC;IAAE;EACxF,CAAC;EAED,MAAM2C,SAAS,GAAGG,WAAW,CAAC,MAAM;IAClC,IAAI,CAAClE,YAAY,CAACe,GAAG,EAAE,iBAAiB,EAAE8C,OAAO,CAAC,EAAEC,aAAa,CAACC,SAAS,CAAC;EAC9E,CAAC,EAAE,MAAM,CAAC;EAEVjD,GAAG,CAACqD,EAAE,CAAC,OAAO,EAAEN,OAAO,CAAC;EACxB/C,GAAG,CAACqD,EAAE,CAAC,OAAO,EAAEN,OAAO,CAAC;EACxB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;AACA;AACA,OAAO,eAAeO,wBAAwBA,CAC5CtD,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAEC,WAAmC,EACnC;EAClB,MAAMoD,kBAAkB,GAAGrD,QAAQ,CAACG,KAAK,CAAC,oCAAoC,CAAC;EAC/E,IAAI,EAAEkD,kBAAkB,IAAIvD,GAAG,CAACI,MAAM,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;EAE/D,MAAMoD,QAAQ,GAAGxD,GAAG,CAACS,OAAO,CAAC,iBAAiB,CAAC,EAAEgD,QAAQ,CAAC,CAAC,CAAClD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEmD,IAAI,CAAC,CAAC,IAAI1D,GAAG,CAAC2D,MAAM,CAACC,aAAa,IAAI,SAAS;EAC1H,IAAI7E,eAAe,CAACkB,GAAG,EAAEuD,QAAQ,EAAErD,WAAW,CAAC,EAAE,OAAO,IAAI;EAE5D,MAAM0D,SAAS,GAAGN,kBAAkB,CAAC,CAAC,CAAC;EACvC,MAAMO,SAAS,GAAG,IAAIC,GAAG,CAAC/D,GAAG,CAACgE,GAAG,IAAI,EAAE,EAAE,UAAUhE,GAAG,CAACS,OAAO,CAACwD,IAAI,EAAE,CAAC,CAACC,YAAY;EACnF,MAAMC,MAAM,GAAGL,SAAS,CAAC7B,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;EAC5C,MAAMmC,OAAO,GAAGN,SAAS,CAAC7B,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;EAC9C,MAAMoC,GAAG,GAAGP,SAAS,CAAC7B,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;EAEtC,IAAI,CAACkC,MAAM,IAAI,CAACC,OAAO,IAAI,CAACC,GAAG,EAAE;IAAEzF,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAA4C,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAC7I,IAAI,IAAImE,IAAI,CAACF,OAAO,CAAC,GAAG,IAAIE,IAAI,CAAC,CAAC,EAAE;IAAE1F,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAiC,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EACrI,IAAI,CAACzB,4BAA4B,CAACmF,SAAS,EAAEM,MAAM,EAAEC,OAAO,EAAEC,GAAG,CAAC,EAAE;IAAEzF,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAoB,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAExJ,MAAMoE,aAAa,GAAGhG,gBAAgB,CAAC,CAAC;EACxC,MAAM;IAAE0C,IAAI,EAAEuD;EAAS,CAAC,GAAG,MAAMD,aAAa,CAAC/C,IAAI,CAAC,4BAA4B,CAAC,CAACC,MAAM,CAAC,8BAA8B,CAAC,CAACC,EAAE,CAAC,aAAa,EAAEmC,SAAS,CAAC,CAACY,KAAK,CAAC,CAAC,CAAC;EAC9J,IAAI,CAACD,QAAQ,EAAEE,MAAM,EAAE;IAAE9F,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAqB,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAC5G,IAAIqE,QAAQ,CAAC,CAAC,CAAC,CAACG,MAAM,KAAK,SAAS,EAAE;IAAE/F,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE,oBAAoByD,QAAQ,CAAC,CAAC,CAAC,CAACG,MAAM;IAAG,CAAC,EAAExE,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAE/I,MAAMyE,SAAS,GAAGT,MAAM,KAAK,SAAS,IAAIA,MAAM,KAAK,UAAU;EAC/D,MAAM;IAAElD,IAAI,EAAE4D,WAAW;IAAE9D,KAAK,EAAE+D;EAAS,CAAC,GAAG,MAAMP,aAAa,CAACQ,GAAG,CAAC,qBAAqB,EAAE;IAC5FC,aAAa,EAAER,QAAQ,CAAC,CAAC,CAAC,CAAC1C,EAAE;IAAEmD,UAAU,EAAET,QAAQ,CAAC,CAAC,CAAC,CAAC3C,QAAQ;IAC/DqD,UAAU,EAAEN,SAAS,GAAG,UAAU,GAAG,UAAU;IAAEO,eAAe,EAAE;MAAEC,KAAK,EAAE,IAAI;MAAEjB;IAAO,CAAC;IAAEkB,cAAc,EAAE;EAC7G,CAAC,CAAC;EAEF,IAAIP,QAAQ,EAAE;IAAElG,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEqF,OAAO,EAAE,KAAK;MAAEvE,KAAK,EAAE+D,QAAQ,CAACS;IAAQ,CAAC,EAAEpF,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAE/G,IAAI0E,WAAW,EAAES,OAAO,IAAId,QAAQ,CAAC,CAAC,CAAC,CAACgB,MAAM,EAAE;IAC9C,IAAI;MAAE,MAAM7G,kBAAkB,CAAC4F,aAAa,EAAEC,QAAQ,CAAC,CAAC,CAAC,CAACgB,MAAM,CAAC;IAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;MAAEnG,GAAG,CAACyB,KAAK,CAAC;QAAE0E,GAAG,EAAGA,GAAG,CAAWF,OAAO;QAAEjF,KAAK,EAAEkE,QAAQ,CAAC,CAAC,CAAC,CAACgB;MAAO,CAAC,EAAE,0CAA0C,CAAC;IAAE;EACxM;EAEAvF,GAAG,CAACkC,SAAS,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,WAAW;IAAE,GAAGhC;EAAY,CAAC,CAAC;EACnEF,GAAG,CAACyF,GAAG,CAAC;AACV,UAAUd,SAAS,GAAG,UAAU,GAAG,UAAU;AAC7C;AACA,iBAAiB,CAAC;EAChB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;AACA;AACA,OAAO,eAAee,mBAAmBA,CACvC3F,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAE8D,GAAQ,EAAE7D,WAAmC,EAC7C;EAClB,MAAMyF,WAAW,GAAG;IAAE,GAAGzF,WAAW;IAAE,6BAA6B,EAAE;EAAI,CAAC;;EAE1E;EACA,MAAM0F,eAAe,GAAG3F,QAAQ,CAACG,KAAK,CAAC,+CAA+C,CAAC;EACvF,IAAIwF,eAAe,IAAI7F,GAAG,CAACI,MAAM,KAAK,MAAM,EAAE;IAC5C,MAAMoD,QAAQ,GAAGxD,GAAG,CAACS,OAAO,CAAC,iBAAiB,CAAC,EAAEgD,QAAQ,CAAC,CAAC,CAAClD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEmD,IAAI,CAAC,CAAC,IAAI1D,GAAG,CAAC2D,MAAM,CAACC,aAAa,IAAI,SAAS;IAC1H,IAAI7E,eAAe,CAACkB,GAAG,EAAEuD,QAAQ,EAAEoC,WAAW,CAAC,EAAE,OAAO,IAAI;IAE5D,IAAIE,OAAe;IACnB,IAAI;MAAEA,OAAO,GAAG,MAAMjH,QAAQ,CAACmB,GAAG,CAAC;IAAE,CAAC,CAAC,MAAM;MAAEpB,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAAyB,CAAC,EAAE6E,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAEtI,MAAMG,SAAS,GAAGF,eAAe,CAAC,CAAC,CAAC;IACpC,IAAIG,MAAW;IACf,IAAI;MAAEA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACJ,OAAO,CAAC;IAAE,CAAC,CAAC,MAAM;MAAElH,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAAe,CAAC,EAAE6E,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAC3H,IAAI,CAACI,MAAM,CAACG,OAAO,IAAI,OAAOH,MAAM,CAACG,OAAO,KAAK,QAAQ,EAAE;MAAEvH,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA+B,CAAC,EAAE6E,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAC1J,IAAII,MAAM,CAACG,OAAO,CAACzB,MAAM,GAAG,IAAI,EAAE;MAAE9F,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAAyC,CAAC,EAAE6E,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAE3I,MAAMQ,QAAQ,GAAG7H,gBAAgB,CAAC,CAAC;IACnC,MAAM;MAAE0C,IAAI,EAAEoF;IAAQ,CAAC,GAAG,MAAMD,QAAQ,CAAC5E,IAAI,CAAC,UAAU,CAAC,CAACC,MAAM,CAAC,+CAA+C,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEqE,SAAS,CAAC,CAACrE,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAACC,MAAM,CAAC,CAAC;IACpK,IAAI,CAAC0E,OAAO,EAAE;MAAEzH,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA4B,CAAC,EAAE6E,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAE1G,IAAI;MACF,MAAMU,SAAS,GAAG,MAAM9H,eAAe,CAAC4H,QAAQ,EAAEC,OAAO,CAACxE,QAAQ,EAAE,SAAS,CAAC;MAC9E,IAAI,CAACyE,SAAS,CAACC,OAAO,EAAE;QAAE3H,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;UAAEc,KAAK,EAAEuF,SAAS,CAACE,MAAM,IAAI;QAAqB,CAAC,EAAEZ,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;IACnI,CAAC,CAAC,MAAM,CAAE;IAEV,MAAMa,QAAQ,GAAIT,MAAM,CAACU,SAAS,IAAe,WAAW;IAC5D,IAAIC,cAAsB,GAAIX,MAAM,CAACY,eAAe,IAAe,EAAE;IACrE,IAAI,CAACD,cAAc,EAAE;MACnB,MAAME,YAAY,GAAG,IAAIvC,IAAI,CAACA,IAAI,CAACwC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAACC,WAAW,CAAC,CAAC;MACxE,MAAM;QAAE9F,IAAI,EAAE+F;MAAO,CAAC,GAAG,MAAMZ,QAAQ,CAAC5E,IAAI,CAAC,kBAAkB,CAAC,CAACC,MAAM,CAAC,iBAAiB,CAAC,CACvFC,EAAE,CAAC,YAAY,EAAEqE,SAAS,CAAC,CAACrE,EAAE,CAAC,WAAW,EAAE+E,QAAQ,CAAC,CAACQ,EAAE,CAAC,YAAY,EAAEJ,YAAY,CAAC,CACpFK,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC3E,KAAK,CAAC,YAAY,EAAE;QAAEC,SAAS,EAAE;MAAM,CAAC,CAAC,CAACiC,KAAK,CAAC,CAAC,CAAC;MACxFkC,cAAc,GAAIK,MAAM,EAAEtC,MAAM,IAAIsC,MAAM,CAAC,CAAC,CAAC,CAACJ,eAAe,IAAKvI,UAAU,CAAC,CAAC;IAChF;IAEA,MAAM;MAAE4C,IAAI,EAAEsE,OAAO;MAAExE,KAAK,EAAEoG;IAAO,CAAC,GAAG,MAAMf,QAAQ,CAAC5E,IAAI,CAAC,kBAAkB,CAAC,CAAC4F,MAAM,CAAC;MACtFvF,QAAQ,EAAEwE,OAAO,CAACxE,QAAQ;MAAEwF,UAAU,EAAEtB,SAAS;MAAEuB,SAAS,EAAE,SAAS;MACvEZ,SAAS,EAAED,QAAQ;MAAEc,WAAW,EAAEvB,MAAM,CAACuB,WAAW,IAAI,SAAS;MACjEpB,OAAO,EAAEH,MAAM,CAACG,OAAO;MAAEqB,YAAY,EAAE,MAAM;MAC7CC,QAAQ,EAAE;QAAEC,MAAM,EAAE,SAAS;QAAEC,EAAE,EAAEnE,QAAQ;QAAEoE,cAAc,EAAE;MAAQ,CAAC;MACtEC,QAAQ,EAAExB,OAAO,CAACwB,QAAQ;MAAEjB,eAAe,EAAED;IAC/C,CAAC,CAAC,CAAClF,MAAM,CAAC,qDAAqD,CAAC,CAACE,MAAM,CAAC,CAAC;IACzE,IAAIwF,MAAM,EAAE;MAAEvI,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAEoG,MAAM,CAAC5B;MAAQ,CAAC,EAAEK,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAE3FnH,cAAc,CAAC2H,QAAQ,EAAEC,OAAO,CAACxE,QAAQ,EAAE;MAAEiG,WAAW,EAAE;IAAE,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,IAAI;MAAE,MAAM3B,QAAQ,CAACrB,GAAG,CAAC,yBAAyB,EAAE;QAAEiD,YAAY,EAAEjC;MAAU,CAAC,CAAC;IAAE,CAAC,CAAC,MAAM,CAAE;IAE5F,IAAIkC,aAAkB,GAAG,IAAI;IAC7B,IAAI5B,OAAO,CAACwB,QAAQ,IAAItI,mBAAmB,EAAE;MAC3C,IAAI;QACF,MAAM2I,MAAM,GAAG,MAAM3I,mBAAmB,CAAC6G,QAAQ,EAAEC,OAAO,CAACwB,QAAQ,EAAE7B,MAAM,CAACG,OAAO,EAAEE,OAAO,CAACxE,QAAQ,EAAE8E,cAAc,CAAC;QACtH,IAAIuB,MAAM,CAAC5C,OAAO,IAAI4C,MAAM,CAACC,QAAQ,EAAE;UACrC,MAAM;YAAElH,IAAI,EAAEmH;UAAO,CAAC,GAAG,MAAMhC,QAAQ,CAAC5E,IAAI,CAAC,kBAAkB,CAAC,CAAC4F,MAAM,CAAC;YACtEvF,QAAQ,EAAEwE,OAAO,CAACxE,QAAQ;YAAEwF,UAAU,EAAEtB,SAAS;YAAEuB,SAAS,EAAE,UAAU;YACxEZ,SAAS,EAAE,OAAO;YAAEa,WAAW,EAAE,UAAU;YAC3CpB,OAAO,EAAE+B,MAAM,CAACC,QAAQ;YAAEX,YAAY,EAAE,MAAM;YAC9CC,QAAQ,EAAE;cAAEI,QAAQ,EAAExB,OAAO,CAACwB,QAAQ;cAAEQ,aAAa,EAAE,IAAI;cAAEX,MAAM,EAAE;YAAU,CAAC;YAChFG,QAAQ,EAAExB,OAAO,CAACwB,QAAQ;YAAEjB,eAAe,EAAED;UAC/C,CAAC,CAAC,CAAClF,MAAM,CAAC,qDAAqD,CAAC,CAACE,MAAM,CAAC,CAAC;UACzEsG,aAAa,GAAGG,MAAM;UACtB3J,cAAc,CAAC2H,QAAQ,EAAEC,OAAO,CAACxE,QAAQ,EAAE;YAAEyG,YAAY,EAAE,CAAC;YAAEC,iBAAiB,EAAE;UAAE,CAAC,CAAC,CAACR,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACvG;MACF,CAAC,CAAC,OAAOtC,GAAG,EAAE;QAAEnG,GAAG,CAACyB,KAAK,CAAC;UAAE0E,GAAG,EAAGA,GAAG,CAAWF;QAAQ,CAAC,EAAE,qBAAqB,CAAC;MAAE;IACrF;IAEA3G,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEqF,OAAO,EAAE,IAAI;MAAEC,OAAO;MAAEiD,cAAc,EAAEP,aAAa;MAAErB,eAAe,EAAED;IAAe,CAAC,EAAEf,WAAW,CAAC;IAC/H,OAAO,IAAI;EACb;;EAEA;EACA,MAAM6C,mBAAmB,GAAGvI,QAAQ,CAACG,KAAK,CAAC,8CAA8C,CAAC;EAC1F,IAAIoI,mBAAmB,IAAIzI,GAAG,CAACI,MAAM,KAAK,KAAK,EAAE;IAC/C,MAAMoD,QAAQ,GAAGxD,GAAG,CAACS,OAAO,CAAC,iBAAiB,CAAC,EAAEgD,QAAQ,CAAC,CAAC,CAAClD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEmD,IAAI,CAAC,CAAC,IAAI1D,GAAG,CAAC2D,MAAM,CAACC,aAAa,IAAI,SAAS;IAC1H,IAAI7E,eAAe,CAACkB,GAAG,EAAEuD,QAAQ,EAAEoC,WAAW,CAAC,EAAE,OAAO,IAAI;IAE5D,MAAMG,SAAS,GAAG0C,mBAAmB,CAAC,CAAC,CAAC;IACxC,MAAMhC,QAAQ,GAAGzC,GAAG,CAACE,YAAY,CAACjC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;IACxD,MAAMyG,SAAS,GAAG1E,GAAG,CAACE,YAAY,CAACjC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;IAC/D,IAAI,CAACwE,QAAQ,EAAE;MAAE7H,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAAqC,CAAC,EAAE6E,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAEpH,MAAMQ,QAAQ,GAAG7H,gBAAgB,CAAC,CAAC;IACnC,MAAM;MAAE0C,IAAI,EAAE0H;IAAU,CAAC,GAAG,MAAMvC,QAAQ,CAAC5E,IAAI,CAAC,UAAU,CAAC,CAACC,MAAM,CAAC,UAAU,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEqE,SAAS,CAAC,CAACrE,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAACC,MAAM,CAAC,CAAC;IACjI,IAAI,CAACgH,SAAS,EAAE;MAAE/J,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA4B,CAAC,EAAE6E,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAE5G,IAAI,CAAC,kBAAkB,CAACgD,IAAI,CAACnC,QAAQ,CAAC,EAAE;MAAE7H,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA2B,CAAC,EAAE6E,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IACnI,IAAIiD,KAAK,GAAGzC,QAAQ,CAAC5E,IAAI,CAAC,kBAAkB,CAAC,CAC1CC,MAAM,CAAC,0EAA0E,CAAC,CAClFC,EAAE,CAAC,YAAY,EAAEqE,SAAS,CAAC;IAC9B,IAAI2C,SAAS,EAAE;MAAEG,KAAK,GAAGA,KAAK,CAACnH,EAAE,CAAC,iBAAiB,EAAEgH,SAAS,CAAC,CAACI,EAAE,CAAC,WAAW,EAAE,CAACrC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAE,CAAC,MAClG;MAAEoC,KAAK,GAAGA,KAAK,CAACC,EAAE,CAAC,WAAW,EAAE,CAACrC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAE;IAE3D,MAAM;MAAExF,IAAI,EAAE8H,QAAQ;MAAEhI,KAAK,EAAEiI;IAAQ,CAAC,GAAG,MAAMH,KAAK,CAACtG,KAAK,CAAC,YAAY,EAAE;MAAEC,SAAS,EAAE;IAAK,CAAC,CAAC,CAACiC,KAAK,CAAC,EAAE,CAAC;IACzG,IAAIuE,OAAO,EAAE;MAAEpK,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAEiI,OAAO,CAACzD;MAAQ,CAAC,EAAEK,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAC7FhH,YAAY,CAACqB,GAAG,EAAE,GAAG,EAAE;MAAEqF,OAAO,EAAE,IAAI;MAAEyD,QAAQ,EAAEA,QAAQ,IAAI;IAAG,CAAC,EAAEnD,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;;EAEA;EACA,IAAI1F,QAAQ,KAAK,oBAAoB,IAAIF,GAAG,CAACI,MAAM,KAAK,KAAK,EAAE;IAC7D,MAAM6I,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;IAClC,MAAMC,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;IACtC,MAAMC,aAAa,GAAG,CACpBD,IAAI,CAACE,IAAI,CAACC,MAAM,CAACC,IAAI,CAACC,OAAO,IAAIC,SAAS,EAAE,8BAA8B,CAAC,EAC3EN,IAAI,CAACE,IAAI,CAACC,MAAM,CAACC,IAAI,CAACC,OAAO,IAAIC,SAAS,EAAE,iCAAiC,CAAC,EAC9EN,IAAI,CAACE,IAAI,CAACzJ,OAAO,CAAC8J,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CACnD;IACD,IAAIC,QAAuB,GAAG,IAAI;IAClC,KAAK,MAAMC,CAAC,IAAIR,aAAa,EAAE;MAAE,IAAI;QAAEO,QAAQ,GAAGT,EAAE,CAACW,YAAY,CAACD,CAAC,EAAE,OAAO,CAAC;QAAE;MAAO,CAAC,CAAC,MAAM,CAAE;IAAiB;IACjH,IAAID,QAAQ,EAAE;MACZzJ,GAAG,CAACkC,SAAS,CAAC,GAAG,EAAE;QAAE,cAAc,EAAE,wBAAwB;QAAE,eAAe,EAAE,sBAAsB;QAAE,GAAGyD;MAAY,CAAC,CAAC;MACzH3F,GAAG,CAACyF,GAAG,CAACgE,QAAQ,CAAC;IACnB,CAAC,MAAM;MACLzJ,GAAG,CAACkC,SAAS,CAAC,GAAG,EAAE;QAAE,cAAc,EAAE,wBAAwB;QAAE,GAAGyD;MAAY,CAAC,CAAC;MAChF3F,GAAG,CAACyF,GAAG,CAAC,6IAA6I,CAAC;IACxJ;IACA,OAAO,IAAI;EACb;EAEA,OAAO,KAAK;AACd;;AAEA","ignoreList":[]}
+{"version":3,"file":"server-routes-public.js","names":["randomUUID","createLogger","getServiceClient","checkPlanLimits","incrementUsage","verifyGuestApprovalSignature","executeInlineChain","jsonResponse","readBody","safeCompare","getClientIp","sendIpRateLimit","getSseClients","sendWorkflowSSE","safeSseWrite","MAX_SSE_CLIENTS_PER_RUN","MAX_SSE_TOTAL_CLIENTS","getTotalSseClients","log","webchatAgentInvoker","setWebchatAgentInvoker","invoker","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","handleSseStreamRoute","req","res","pathname","corsHeaders","method","match","runId","split","authHeader","headers","authorization","token","startsWith","substring","isInternal","error","sb","data","user","authUser","authError","auth","getUser","sseRun","from","select","eq","single","membership","store_id","id","sseClients","existingClients","get","size","writeHead","Connection","run","stepRuns","order","ascending","type","steps","has","set","Set","add","cleanup","clearInterval","heartbeat","clients","delete","setInterval","on","handleGuestApprovalRoute","guestApprovalMatch","clientIp","stepRunId","urlParams","URL","url","host","searchParams","action","expires","sig","Date","guestSupabase","approval","limit","length","status","isApprove","guestResult","guestErr","rpc","p_approval_id","p_store_id","p_response","p_response_data","guest","p_responded_by","success","message","run_id","err","end","handleWebchatRoutes","webchatCors","webchatMsgMatch","rawBody","channelId","wcBody","JSON","parse","content","supabase","channel","planCheck","allowed","reason","senderId","sender_id","conversationId","conversation_id","thirtyMinAgo","now","toISOString","recent","gt","not","msgErr","insert","channel_id","direction","sender_name","content_type","metadata","source","ip","widget_version","agent_id","messages_in","catch","p_channel_id","agentResponse","result","response","outMsg","auto_response","messages_out","agent_invocations","agent_response","webchatHistoryMatch","reqConvId","wcChannel","test","query","in","messages","histErr","fs","path","possiblePaths","join","import","meta","dirname","__dirname","cwd","widgetJs","p","readFileSync"],"sources":["../../src/server/server-routes-public.ts"],"sourcesContent":["// server/server-routes-public.ts — Public/unauthenticated route handlers\n// SSE streaming, guest approvals, webchat, billing, node routes\n// Extracted from index.ts for modularity.\n\nimport http from \"node:http\";\nimport { randomUUID } from \"node:crypto\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { checkPlanLimits, incrementUsage } from \"./handlers/billing.js\";\nimport { handleBillingRoutes } from \"./handlers/billing.js\";\nimport { handleNodeRoutes } from \"./handlers/nodes.js\";\nimport { verifyGuestApprovalSignature, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, getClientIp } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\nimport { getSseClients, sendWorkflowSSE, safeSseWrite, MAX_SSE_CLIENTS_PER_RUN, MAX_SSE_TOTAL_CLIENTS, getTotalSseClients } from \"./server-sse.js\";\n\nconst log = createLogger(\"server-routes-public\");\n\n// Webchat agent invoker — set later to avoid circular deps\nlet webchatAgentInvoker: ((\n  supabase: SupabaseClient, agentId: string, message: string, storeId: string, conversationId: string, senderContext?: any,\n) => Promise<{ success: boolean; response?: string; error?: string }>) | null = null;\n\nexport function setWebchatAgentInvoker(invoker: typeof webchatAgentInvoker): void {\n  webchatAgentInvoker = invoker;\n}\n\n// Env secrets (needed for auth checks)\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n/**\n * Handle SSE workflow stream route.\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleSseStreamRoute(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  if (!(req.method === \"GET\" && pathname.match(/^\\/workflows\\/runs\\/[a-f0-9-]+\\/stream$/))) return false;\n\n  const runId = pathname.split(\"/\")[3];\n  const authHeader = req.headers.authorization;\n  const token = authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n  const isInternal = safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n\n  if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n\n  if (!isInternal) {\n    const sb = getServiceClient();\n    const { data: { user: authUser }, error: authError } = await sb.auth.getUser(token);\n    if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n    const { data: sseRun } = await sb.from(\"workflow_runs\").select(\"store_id\").eq(\"id\", runId).single();\n    if (sseRun) {\n      const { data: membership } = await sb.from(\"store_members\").select(\"id\").eq(\"store_id\", sseRun.store_id).eq(\"user_id\", authUser.id).single();\n      if (!membership) { jsonResponse(res, 403, { error: \"Not authorized to view this run\" }, corsHeaders); return true; }\n    }\n  }\n\n  const sseClients = getSseClients();\n  const existingClients = sseClients.get(runId)?.size || 0;\n  if (existingClients >= MAX_SSE_CLIENTS_PER_RUN) { jsonResponse(res, 429, { error: \"Too many SSE clients for this run\" }, corsHeaders); return true; }\n  if (getTotalSseClients() >= MAX_SSE_TOTAL_CLIENTS) { jsonResponse(res, 429, { error: \"Too many total SSE connections\" }, corsHeaders); return true; }\n\n  res.writeHead(200, { \"Content-Type\": \"text/event-stream\", \"Cache-Control\": \"no-cache\", Connection: \"keep-alive\", ...corsHeaders });\n\n  const sb = getServiceClient();\n  const { data: run } = await sb.from(\"workflow_runs\")\n    .select(\"id, workflow_id, status, trigger_type, current_step_key, error_message, error_step_key, started_at, completed_at, duration_ms\")\n    .eq(\"id\", runId).single();\n  const { data: stepRuns } = await sb.from(\"workflow_step_runs\")\n    .select(\"id, step_key, step_type, status, error_message, duration_ms, started_at, completed_at\")\n    .eq(\"run_id\", runId).order(\"created_at\", { ascending: true });\n\n  sendWorkflowSSE(res, { type: \"snapshot\", run, steps: stepRuns || [] });\n\n  if (!sseClients.has(runId)) sseClients.set(runId, new Set());\n  sseClients.get(runId)!.add(res);\n\n  const cleanup = () => {\n    clearInterval(heartbeat);\n    const clients = sseClients.get(runId);\n    if (clients) { clients.delete(res); if (clients.size === 0) sseClients.delete(runId); }\n  };\n\n  const heartbeat = setInterval(() => {\n    if (!safeSseWrite(res, `: heartbeat\\n\\n`, cleanup)) clearInterval(heartbeat);\n  }, 15_000);\n\n  req.on(\"close\", cleanup);\n  req.on(\"error\", cleanup);\n  return true;\n}\n\n/**\n * Handle guest approval route.\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleGuestApprovalRoute(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  const guestApprovalMatch = pathname.match(/^\\/approvals\\/guest\\/([a-f0-9-]+)$/);\n  if (!(guestApprovalMatch && req.method === \"GET\")) return false;\n\n  const clientIp = getClientIp(req);\n  if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;\n\n  const stepRunId = guestApprovalMatch[1];\n  const urlParams = new URL(req.url || \"\", `http://${req.headers.host}`).searchParams;\n  const action = urlParams.get(\"action\") || \"\";\n  const expires = urlParams.get(\"expires\") || \"\";\n  const sig = urlParams.get(\"sig\") || \"\";\n\n  if (!action || !expires || !sig) { jsonResponse(res, 400, { error: \"Missing action, expires, or sig parameter\" }, corsHeaders); return true; }\n  if (new Date(expires) < new Date()) { jsonResponse(res, 410, { error: \"This approval link has expired\" }, corsHeaders); return true; }\n  if (!verifyGuestApprovalSignature(stepRunId, action, expires, sig)) { jsonResponse(res, 403, { error: \"Invalid signature\" }, corsHeaders); return true; }\n\n  const guestSupabase = getServiceClient();\n  const { data: approval } = await guestSupabase.from(\"workflow_approval_requests\").select(\"id, store_id, run_id, status\").eq(\"step_run_id\", stepRunId).limit(1);\n  if (!approval?.length) { jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders); return true; }\n  if (approval[0].status !== \"pending\") { jsonResponse(res, 409, { error: `Approval already ${approval[0].status}` }, corsHeaders); return true; }\n\n  const isApprove = action === \"approve\" || action === \"approved\";\n  const { data: guestResult, error: guestErr } = await guestSupabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approval[0].id, p_store_id: approval[0].store_id,\n    p_response: isApprove ? \"approved\" : \"rejected\", p_response_data: { guest: true, action }, p_responded_by: null,\n  });\n\n  if (guestErr) { jsonResponse(res, 500, { success: false, error: guestErr.message }, corsHeaders); return true; }\n\n  if (guestResult?.success && approval[0].run_id) {\n    try { await executeInlineChain(guestSupabase, approval[0].run_id); } catch (err) { log.error({ err: (err as Error).message, runId: approval[0].run_id }, \"inline chain failed after guest approval\"); }\n  }\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\", ...corsHeaders });\n  res.end(`<!DOCTYPE html><html><body style=\"font-family:system-ui;text-align:center;padding:40px\">\n    <h2>${isApprove ? \"Approved\" : \"Rejected\"}</h2>\n    <p>Your response has been recorded. You can close this window.</p>\n  </body></html>`);\n  return true;\n}\n\n/**\n * Handle webchat routes (messages, history, widget.js).\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleWebchatRoutes(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, url: URL, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  const webchatCors = { ...corsHeaders, \"Access-Control-Allow-Origin\": \"*\" };\n\n  // POST /webchat/channels/:id/messages\n  const webchatMsgMatch = pathname.match(/^\\/webchat\\/channels\\/([a-f0-9-]+)\\/messages$/);\n  if (webchatMsgMatch && req.method === \"POST\") {\n    const clientIp = getClientIp(req);\n    if (sendIpRateLimit(res, clientIp, webchatCors)) return true;\n\n    let rawBody: string;\n    try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, webchatCors); return true; }\n\n    const channelId = webchatMsgMatch[1];\n    let wcBody: any;\n    try { wcBody = JSON.parse(rawBody); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, webchatCors); return true; }\n    if (!wcBody.content || typeof wcBody.content !== \"string\") { jsonResponse(res, 400, { error: \"content (string) is required\" }, webchatCors); return true; }\n    if (wcBody.content.length > 5000) { jsonResponse(res, 400, { error: \"Message too long (max 5000 characters)\" }, webchatCors); return true; }\n\n    const supabase = getServiceClient();\n    const { data: channel } = await supabase.from(\"channels\").select(\"id, store_id, node_id, agent_id, type, config\").eq(\"id\", channelId).eq(\"type\", \"webchat\").single();\n    if (!channel) { jsonResponse(res, 404, { error: \"Webchat channel not found\" }, webchatCors); return true; }\n\n    try {\n      const planCheck = await checkPlanLimits(supabase, channel.store_id, \"message\");\n      if (!planCheck.allowed) { jsonResponse(res, 429, { error: planCheck.reason || \"Plan limit reached\" }, webchatCors); return true; }\n    } catch { /* billing tables may not exist yet */ }\n\n    const senderId = (wcBody.sender_id as string) || \"anonymous\";\n    let conversationId: string = (wcBody.conversation_id as string) || \"\";\n    if (!conversationId) {\n      const thirtyMinAgo = new Date(Date.now() - 30 * 60 * 1000).toISOString();\n      const { data: recent } = await supabase.from(\"channel_messages\").select(\"conversation_id\")\n        .eq(\"channel_id\", channelId).eq(\"sender_id\", senderId).gt(\"created_at\", thirtyMinAgo)\n        .not(\"conversation_id\", \"is\", null).order(\"created_at\", { ascending: false }).limit(1);\n      conversationId = (recent?.length && recent[0].conversation_id) || randomUUID();\n    }\n\n    const { data: message, error: msgErr } = await supabase.from(\"channel_messages\").insert({\n      store_id: channel.store_id, channel_id: channelId, direction: \"inbound\",\n      sender_id: senderId, sender_name: wcBody.sender_name || \"Visitor\",\n      content: wcBody.content, content_type: \"text\",\n      metadata: { source: \"webchat\", ip: clientIp, widget_version: \"1.0.0\" },\n      agent_id: channel.agent_id, conversation_id: conversationId,\n    }).select(\"id, direction, content, conversation_id, created_at\").single();\n    if (msgErr) { jsonResponse(res, 500, { error: msgErr.message }, webchatCors); return true; }\n\n    incrementUsage(supabase, channel.store_id, { messages_in: 1 }).catch(() => {});\n    try { await supabase.rpc(\"increment_channel_stats\", { p_channel_id: channelId }); } catch { /* ok */ }\n\n    let agentResponse: any = null;\n    if (channel.agent_id && webchatAgentInvoker) {\n      try {\n        const result = await webchatAgentInvoker(supabase, channel.agent_id, wcBody.content, channel.store_id, conversationId);\n        if (result.success && result.response) {\n          const { data: outMsg } = await supabase.from(\"channel_messages\").insert({\n            store_id: channel.store_id, channel_id: channelId, direction: \"outbound\",\n            sender_id: \"agent\", sender_name: \"AI Agent\",\n            content: result.response, content_type: \"text\",\n            metadata: { agent_id: channel.agent_id, auto_response: true, source: \"webchat\" },\n            agent_id: channel.agent_id, conversation_id: conversationId,\n          }).select(\"id, direction, content, conversation_id, created_at\").single();\n          agentResponse = outMsg;\n          incrementUsage(supabase, channel.store_id, { messages_out: 1, agent_invocations: 1 }).catch(() => {});\n        }\n      } catch (err) { log.error({ err: (err as Error).message }, \"webchat agent error\"); }\n    }\n\n    jsonResponse(res, 201, { success: true, message, agent_response: agentResponse, conversation_id: conversationId }, webchatCors);\n    return true;\n  }\n\n  // GET /webchat/channels/:id/history\n  const webchatHistoryMatch = pathname.match(/^\\/webchat\\/channels\\/([a-f0-9-]+)\\/history$/);\n  if (webchatHistoryMatch && req.method === \"GET\") {\n    const clientIp = getClientIp(req);\n    if (sendIpRateLimit(res, clientIp, webchatCors)) return true;\n\n    const channelId = webchatHistoryMatch[1];\n    const senderId = url.searchParams.get(\"sender_id\") || \"\";\n    const reqConvId = url.searchParams.get(\"conversation_id\") || \"\";\n    if (!senderId) { jsonResponse(res, 400, { error: \"sender_id query parameter required\" }, webchatCors); return true; }\n\n    const supabase = getServiceClient();\n    const { data: wcChannel } = await supabase.from(\"channels\").select(\"id, type\").eq(\"id\", channelId).eq(\"type\", \"webchat\").single();\n    if (!wcChannel) { jsonResponse(res, 404, { error: \"Webchat channel not found\" }, webchatCors); return true; }\n\n    if (!/^[a-zA-Z0-9_-]+$/.test(senderId)) { jsonResponse(res, 400, { error: \"Invalid sender_id format\" }, webchatCors); return true; }\n    let query = supabase.from(\"channel_messages\")\n      .select(\"id, direction, sender_id, sender_name, content, content_type, created_at\")\n      .eq(\"channel_id\", channelId);\n    if (reqConvId) { query = query.eq(\"conversation_id\", reqConvId).in(\"sender_id\", [senderId, \"agent\"]); }\n    else { query = query.in(\"sender_id\", [senderId, \"agent\"]); }\n\n    const { data: messages, error: histErr } = await query.order(\"created_at\", { ascending: true }).limit(50);\n    if (histErr) { jsonResponse(res, 500, { error: histErr.message }, webchatCors); return true; }\n    jsonResponse(res, 200, { success: true, messages: messages || [] }, webchatCors);\n    return true;\n  }\n\n  // GET /webchat/widget.js\n  if (pathname === \"/webchat/widget.js\" && req.method === \"GET\") {\n    const fs = await import(\"node:fs\");\n    const path = await import(\"node:path\");\n    const possiblePaths = [\n      path.join(import.meta.dirname || __dirname, \"../../dist/webchat/widget.js\"),\n      path.join(import.meta.dirname || __dirname, \"../../../dist/webchat/widget.js\"),\n      path.join(process.cwd(), \"dist/webchat/widget.js\"),\n    ];\n    let widgetJs: string | null = null;\n    for (const p of possiblePaths) { try { widgetJs = fs.readFileSync(p, \"utf-8\"); break; } catch { /* try next */ } }\n    if (widgetJs) {\n      res.writeHead(200, { \"Content-Type\": \"application/javascript\", \"Cache-Control\": \"public, max-age=3600\", ...webchatCors });\n      res.end(widgetJs);\n    } else {\n      res.writeHead(200, { \"Content-Type\": \"application/javascript\", ...webchatCors });\n      res.end('console.warn(\"[WhaleChat] Widget JS not built. Run: npx esbuild src/webchat/widget.ts --bundle --minify --outfile=dist/webchat/widget.js\");');\n    }\n    return true;\n  }\n\n  return false;\n}\n\n// Billing and node route handling is in the main index.ts to keep this file under 300 lines\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,UAAU,QAAQ,aAAa;AAExC,SAASC,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,eAAe,EAAEC,cAAc,QAAQ,uBAAuB;AAGvE,SAASC,4BAA4B,EAAEC,kBAAkB,QAAQ,yBAAyB;AAC1F,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,EAAEC,WAAW,QAAQ,qBAAqB;AACtF,SAASC,eAAe,QAAQ,wBAAwB;AACxD,SAASC,aAAa,EAAEC,eAAe,EAAEC,YAAY,EAAEC,uBAAuB,EAAEC,qBAAqB,EAAEC,kBAAkB,QAAQ,iBAAiB;AAElJ,MAAMC,GAAG,GAAGjB,YAAY,CAAC,sBAAsB,CAAC;;AAEhD;AACA,IAAIkB,mBAEyE,GAAG,IAAI;AAEpF,OAAO,SAASC,sBAAsBA,CAACC,OAAmC,EAAQ;EAChFF,mBAAmB,GAAGE,OAAO;AAC/B;;AAEA;AACA,MAAMC,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;AACA;AACA,OAAO,eAAeC,oBAAoBA,CACxCC,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAEC,WAAmC,EACnC;EAClB,IAAI,EAAEH,GAAG,CAACI,MAAM,KAAK,KAAK,IAAIF,QAAQ,CAACG,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAAE,OAAO,KAAK;EAEtG,MAAMC,KAAK,GAAGJ,QAAQ,CAACK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;EACpC,MAAMC,UAAU,GAAGR,GAAG,CAACS,OAAO,CAACC,aAAa;EAC5C,MAAMC,KAAK,GAAGH,UAAU,EAAEI,UAAU,CAAC,SAAS,CAAC,GAAGJ,UAAU,CAACK,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;EAC9E,MAAMC,UAAU,GAAGjC,WAAW,CAAC8B,KAAK,EAAEb,mBAAmB,CAAC,IAAIjB,WAAW,CAAC8B,KAAK,EAAEjB,yBAAyB,CAAC,IAAIb,WAAW,CAAC8B,KAAK,EAAEd,gBAAgB,CAAC;EAEnJ,IAAI,CAACiB,UAAU,IAAI,CAACH,KAAK,EAAE;IAAEhC,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAwB,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAEnH,IAAI,CAACW,UAAU,EAAE;IACf,MAAME,EAAE,GAAG1C,gBAAgB,CAAC,CAAC;IAC7B,MAAM;MAAE2C,IAAI,EAAE;QAAEC,IAAI,EAAEC;MAAS,CAAC;MAAEJ,KAAK,EAAEK;IAAU,CAAC,GAAG,MAAMJ,EAAE,CAACK,IAAI,CAACC,OAAO,CAACX,KAAK,CAAC;IACnF,IAAIS,SAAS,IAAI,CAACD,QAAQ,EAAE;MAAExC,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA2B,CAAC,EAAEZ,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IACvH,MAAM;MAAEc,IAAI,EAAEM;IAAO,CAAC,GAAG,MAAMP,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CAACC,MAAM,CAAC,UAAU,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEpB,KAAK,CAAC,CAACqB,MAAM,CAAC,CAAC;IACnG,IAAIJ,MAAM,EAAE;MACV,MAAM;QAAEN,IAAI,EAAEW;MAAW,CAAC,GAAG,MAAMZ,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,MAAM,CAACM,QAAQ,CAAC,CAACH,EAAE,CAAC,SAAS,EAAEP,QAAQ,CAACW,EAAE,CAAC,CAACH,MAAM,CAAC,CAAC;MAC5I,IAAI,CAACC,UAAU,EAAE;QAAEjD,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;UAAEc,KAAK,EAAE;QAAkC,CAAC,EAAEZ,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;IACrH;EACF;EAEA,MAAM4B,UAAU,GAAG/C,aAAa,CAAC,CAAC;EAClC,MAAMgD,eAAe,GAAGD,UAAU,CAACE,GAAG,CAAC3B,KAAK,CAAC,EAAE4B,IAAI,IAAI,CAAC;EACxD,IAAIF,eAAe,IAAI7C,uBAAuB,EAAE;IAAER,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAoC,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EACpJ,IAAId,kBAAkB,CAAC,CAAC,IAAID,qBAAqB,EAAE;IAAET,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAiC,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAEpJF,GAAG,CAACkC,SAAS,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,mBAAmB;IAAE,eAAe,EAAE,UAAU;IAAEC,UAAU,EAAE,YAAY;IAAE,GAAGjC;EAAY,CAAC,CAAC;EAElI,MAAMa,EAAE,GAAG1C,gBAAgB,CAAC,CAAC;EAC7B,MAAM;IAAE2C,IAAI,EAAEoB;EAAI,CAAC,GAAG,MAAMrB,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CACjDC,MAAM,CAAC,+HAA+H,CAAC,CACvIC,EAAE,CAAC,IAAI,EAAEpB,KAAK,CAAC,CAACqB,MAAM,CAAC,CAAC;EAC3B,MAAM;IAAEV,IAAI,EAAEqB;EAAS,CAAC,GAAG,MAAMtB,EAAE,CAACQ,IAAI,CAAC,oBAAoB,CAAC,CAC3DC,MAAM,CAAC,uFAAuF,CAAC,CAC/FC,EAAE,CAAC,QAAQ,EAAEpB,KAAK,CAAC,CAACiC,KAAK,CAAC,YAAY,EAAE;IAAEC,SAAS,EAAE;EAAK,CAAC,CAAC;EAE/DvD,eAAe,CAACgB,GAAG,EAAE;IAAEwC,IAAI,EAAE,UAAU;IAAEJ,GAAG;IAAEK,KAAK,EAAEJ,QAAQ,IAAI;EAAG,CAAC,CAAC;EAEtE,IAAI,CAACP,UAAU,CAACY,GAAG,CAACrC,KAAK,CAAC,EAAEyB,UAAU,CAACa,GAAG,CAACtC,KAAK,EAAE,IAAIuC,GAAG,CAAC,CAAC,CAAC;EAC5Dd,UAAU,CAACE,GAAG,CAAC3B,KAAK,CAAC,CAAEwC,GAAG,CAAC7C,GAAG,CAAC;EAE/B,MAAM8C,OAAO,GAAGA,CAAA,KAAM;IACpBC,aAAa,CAACC,SAAS,CAAC;IACxB,MAAMC,OAAO,GAAGnB,UAAU,CAACE,GAAG,CAAC3B,KAAK,CAAC;IACrC,IAAI4C,OAAO,EAAE;MAAEA,OAAO,CAACC,MAAM,CAAClD,GAAG,CAAC;MAAE,IAAIiD,OAAO,CAAChB,IAAI,KAAK,CAAC,EAAEH,UAAU,CAACoB,MAAM,CAAC7C,KAAK,CAAC;IAAE;EACxF,CAAC;EAED,MAAM2C,SAAS,GAAGG,WAAW,CAAC,MAAM;IAClC,IAAI,CAAClE,YAAY,CAACe,GAAG,EAAE,iBAAiB,EAAE8C,OAAO,CAAC,EAAEC,aAAa,CAACC,SAAS,CAAC;EAC9E,CAAC,EAAE,MAAM,CAAC;EAEVjD,GAAG,CAACqD,EAAE,CAAC,OAAO,EAAEN,OAAO,CAAC;EACxB/C,GAAG,CAACqD,EAAE,CAAC,OAAO,EAAEN,OAAO,CAAC;EACxB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;AACA;AACA,OAAO,eAAeO,wBAAwBA,CAC5CtD,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAEC,WAAmC,EACnC;EAClB,MAAMoD,kBAAkB,GAAGrD,QAAQ,CAACG,KAAK,CAAC,oCAAoC,CAAC;EAC/E,IAAI,EAAEkD,kBAAkB,IAAIvD,GAAG,CAACI,MAAM,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;EAE/D,MAAMoD,QAAQ,GAAG1E,WAAW,CAACkB,GAAG,CAAC;EACjC,IAAIjB,eAAe,CAACkB,GAAG,EAAEuD,QAAQ,EAAErD,WAAW,CAAC,EAAE,OAAO,IAAI;EAE5D,MAAMsD,SAAS,GAAGF,kBAAkB,CAAC,CAAC,CAAC;EACvC,MAAMG,SAAS,GAAG,IAAIC,GAAG,CAAC3D,GAAG,CAAC4D,GAAG,IAAI,EAAE,EAAE,UAAU5D,GAAG,CAACS,OAAO,CAACoD,IAAI,EAAE,CAAC,CAACC,YAAY;EACnF,MAAMC,MAAM,GAAGL,SAAS,CAACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;EAC5C,MAAM+B,OAAO,GAAGN,SAAS,CAACzB,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;EAC9C,MAAMgC,GAAG,GAAGP,SAAS,CAACzB,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;EAEtC,IAAI,CAAC8B,MAAM,IAAI,CAACC,OAAO,IAAI,CAACC,GAAG,EAAE;IAAEtF,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAA4C,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAC7I,IAAI,IAAI+D,IAAI,CAACF,OAAO,CAAC,GAAG,IAAIE,IAAI,CAAC,CAAC,EAAE;IAAEvF,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAiC,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EACrI,IAAI,CAAC1B,4BAA4B,CAACgF,SAAS,EAAEM,MAAM,EAAEC,OAAO,EAAEC,GAAG,CAAC,EAAE;IAAEtF,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAoB,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAExJ,MAAMgE,aAAa,GAAG7F,gBAAgB,CAAC,CAAC;EACxC,MAAM;IAAE2C,IAAI,EAAEmD;EAAS,CAAC,GAAG,MAAMD,aAAa,CAAC3C,IAAI,CAAC,4BAA4B,CAAC,CAACC,MAAM,CAAC,8BAA8B,CAAC,CAACC,EAAE,CAAC,aAAa,EAAE+B,SAAS,CAAC,CAACY,KAAK,CAAC,CAAC,CAAC;EAC9J,IAAI,CAACD,QAAQ,EAAEE,MAAM,EAAE;IAAE3F,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE;IAAqB,CAAC,EAAEZ,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAC5G,IAAIiE,QAAQ,CAAC,CAAC,CAAC,CAACG,MAAM,KAAK,SAAS,EAAE;IAAE5F,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEc,KAAK,EAAE,oBAAoBqD,QAAQ,CAAC,CAAC,CAAC,CAACG,MAAM;IAAG,CAAC,EAAEpE,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAE/I,MAAMqE,SAAS,GAAGT,MAAM,KAAK,SAAS,IAAIA,MAAM,KAAK,UAAU;EAC/D,MAAM;IAAE9C,IAAI,EAAEwD,WAAW;IAAE1D,KAAK,EAAE2D;EAAS,CAAC,GAAG,MAAMP,aAAa,CAACQ,GAAG,CAAC,qBAAqB,EAAE;IAC5FC,aAAa,EAAER,QAAQ,CAAC,CAAC,CAAC,CAACtC,EAAE;IAAE+C,UAAU,EAAET,QAAQ,CAAC,CAAC,CAAC,CAACvC,QAAQ;IAC/DiD,UAAU,EAAEN,SAAS,GAAG,UAAU,GAAG,UAAU;IAAEO,eAAe,EAAE;MAAEC,KAAK,EAAE,IAAI;MAAEjB;IAAO,CAAC;IAAEkB,cAAc,EAAE;EAC7G,CAAC,CAAC;EAEF,IAAIP,QAAQ,EAAE;IAAE/F,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEiF,OAAO,EAAE,KAAK;MAAEnE,KAAK,EAAE2D,QAAQ,CAACS;IAAQ,CAAC,EAAEhF,WAAW,CAAC;IAAE,OAAO,IAAI;EAAE;EAE/G,IAAIsE,WAAW,EAAES,OAAO,IAAId,QAAQ,CAAC,CAAC,CAAC,CAACgB,MAAM,EAAE;IAC9C,IAAI;MAAE,MAAM1G,kBAAkB,CAACyF,aAAa,EAAEC,QAAQ,CAAC,CAAC,CAAC,CAACgB,MAAM,CAAC;IAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;MAAE/F,GAAG,CAACyB,KAAK,CAAC;QAAEsE,GAAG,EAAGA,GAAG,CAAWF,OAAO;QAAE7E,KAAK,EAAE8D,QAAQ,CAAC,CAAC,CAAC,CAACgB;MAAO,CAAC,EAAE,0CAA0C,CAAC;IAAE;EACxM;EAEAnF,GAAG,CAACkC,SAAS,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,WAAW;IAAE,GAAGhC;EAAY,CAAC,CAAC;EACnEF,GAAG,CAACqF,GAAG,CAAC;AACV,UAAUd,SAAS,GAAG,UAAU,GAAG,UAAU;AAC7C;AACA,iBAAiB,CAAC;EAChB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;AACA;AACA,OAAO,eAAee,mBAAmBA,CACvCvF,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAE0D,GAAQ,EAAEzD,WAAmC,EAC7C;EAClB,MAAMqF,WAAW,GAAG;IAAE,GAAGrF,WAAW;IAAE,6BAA6B,EAAE;EAAI,CAAC;;EAE1E;EACA,MAAMsF,eAAe,GAAGvF,QAAQ,CAACG,KAAK,CAAC,+CAA+C,CAAC;EACvF,IAAIoF,eAAe,IAAIzF,GAAG,CAACI,MAAM,KAAK,MAAM,EAAE;IAC5C,MAAMoD,QAAQ,GAAG1E,WAAW,CAACkB,GAAG,CAAC;IACjC,IAAIjB,eAAe,CAACkB,GAAG,EAAEuD,QAAQ,EAAEgC,WAAW,CAAC,EAAE,OAAO,IAAI;IAE5D,IAAIE,OAAe;IACnB,IAAI;MAAEA,OAAO,GAAG,MAAM9G,QAAQ,CAACoB,GAAG,CAAC;IAAE,CAAC,CAAC,MAAM;MAAErB,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAAyB,CAAC,EAAEyE,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAEtI,MAAMG,SAAS,GAAGF,eAAe,CAAC,CAAC,CAAC;IACpC,IAAIG,MAAW;IACf,IAAI;MAAEA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACJ,OAAO,CAAC;IAAE,CAAC,CAAC,MAAM;MAAE/G,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAAe,CAAC,EAAEyE,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAC3H,IAAI,CAACI,MAAM,CAACG,OAAO,IAAI,OAAOH,MAAM,CAACG,OAAO,KAAK,QAAQ,EAAE;MAAEpH,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA+B,CAAC,EAAEyE,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAC1J,IAAII,MAAM,CAACG,OAAO,CAACzB,MAAM,GAAG,IAAI,EAAE;MAAE3F,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAAyC,CAAC,EAAEyE,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAE3I,MAAMQ,QAAQ,GAAG1H,gBAAgB,CAAC,CAAC;IACnC,MAAM;MAAE2C,IAAI,EAAEgF;IAAQ,CAAC,GAAG,MAAMD,QAAQ,CAACxE,IAAI,CAAC,UAAU,CAAC,CAACC,MAAM,CAAC,+CAA+C,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEiE,SAAS,CAAC,CAACjE,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAACC,MAAM,CAAC,CAAC;IACpK,IAAI,CAACsE,OAAO,EAAE;MAAEtH,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA4B,CAAC,EAAEyE,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAE1G,IAAI;MACF,MAAMU,SAAS,GAAG,MAAM3H,eAAe,CAACyH,QAAQ,EAAEC,OAAO,CAACpE,QAAQ,EAAE,SAAS,CAAC;MAC9E,IAAI,CAACqE,SAAS,CAACC,OAAO,EAAE;QAAExH,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;UAAEc,KAAK,EAAEmF,SAAS,CAACE,MAAM,IAAI;QAAqB,CAAC,EAAEZ,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;IACnI,CAAC,CAAC,MAAM,CAAE;IAEV,MAAMa,QAAQ,GAAIT,MAAM,CAACU,SAAS,IAAe,WAAW;IAC5D,IAAIC,cAAsB,GAAIX,MAAM,CAACY,eAAe,IAAe,EAAE;IACrE,IAAI,CAACD,cAAc,EAAE;MACnB,MAAME,YAAY,GAAG,IAAIvC,IAAI,CAACA,IAAI,CAACwC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAACC,WAAW,CAAC,CAAC;MACxE,MAAM;QAAE1F,IAAI,EAAE2F;MAAO,CAAC,GAAG,MAAMZ,QAAQ,CAACxE,IAAI,CAAC,kBAAkB,CAAC,CAACC,MAAM,CAAC,iBAAiB,CAAC,CACvFC,EAAE,CAAC,YAAY,EAAEiE,SAAS,CAAC,CAACjE,EAAE,CAAC,WAAW,EAAE2E,QAAQ,CAAC,CAACQ,EAAE,CAAC,YAAY,EAAEJ,YAAY,CAAC,CACpFK,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,CAACvE,KAAK,CAAC,YAAY,EAAE;QAAEC,SAAS,EAAE;MAAM,CAAC,CAAC,CAAC6B,KAAK,CAAC,CAAC,CAAC;MACxFkC,cAAc,GAAIK,MAAM,EAAEtC,MAAM,IAAIsC,MAAM,CAAC,CAAC,CAAC,CAACJ,eAAe,IAAKpI,UAAU,CAAC,CAAC;IAChF;IAEA,MAAM;MAAE6C,IAAI,EAAEkE,OAAO;MAAEpE,KAAK,EAAEgG;IAAO,CAAC,GAAG,MAAMf,QAAQ,CAACxE,IAAI,CAAC,kBAAkB,CAAC,CAACwF,MAAM,CAAC;MACtFnF,QAAQ,EAAEoE,OAAO,CAACpE,QAAQ;MAAEoF,UAAU,EAAEtB,SAAS;MAAEuB,SAAS,EAAE,SAAS;MACvEZ,SAAS,EAAED,QAAQ;MAAEc,WAAW,EAAEvB,MAAM,CAACuB,WAAW,IAAI,SAAS;MACjEpB,OAAO,EAAEH,MAAM,CAACG,OAAO;MAAEqB,YAAY,EAAE,MAAM;MAC7CC,QAAQ,EAAE;QAAEC,MAAM,EAAE,SAAS;QAAEC,EAAE,EAAE/D,QAAQ;QAAEgE,cAAc,EAAE;MAAQ,CAAC;MACtEC,QAAQ,EAAExB,OAAO,CAACwB,QAAQ;MAAEjB,eAAe,EAAED;IAC/C,CAAC,CAAC,CAAC9E,MAAM,CAAC,qDAAqD,CAAC,CAACE,MAAM,CAAC,CAAC;IACzE,IAAIoF,MAAM,EAAE;MAAEpI,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAEgG,MAAM,CAAC5B;MAAQ,CAAC,EAAEK,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAE3FhH,cAAc,CAACwH,QAAQ,EAAEC,OAAO,CAACpE,QAAQ,EAAE;MAAE6F,WAAW,EAAE;IAAE,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,IAAI;MAAE,MAAM3B,QAAQ,CAACrB,GAAG,CAAC,yBAAyB,EAAE;QAAEiD,YAAY,EAAEjC;MAAU,CAAC,CAAC;IAAE,CAAC,CAAC,MAAM,CAAE;IAE5F,IAAIkC,aAAkB,GAAG,IAAI;IAC7B,IAAI5B,OAAO,CAACwB,QAAQ,IAAIlI,mBAAmB,EAAE;MAC3C,IAAI;QACF,MAAMuI,MAAM,GAAG,MAAMvI,mBAAmB,CAACyG,QAAQ,EAAEC,OAAO,CAACwB,QAAQ,EAAE7B,MAAM,CAACG,OAAO,EAAEE,OAAO,CAACpE,QAAQ,EAAE0E,cAAc,CAAC;QACtH,IAAIuB,MAAM,CAAC5C,OAAO,IAAI4C,MAAM,CAACC,QAAQ,EAAE;UACrC,MAAM;YAAE9G,IAAI,EAAE+G;UAAO,CAAC,GAAG,MAAMhC,QAAQ,CAACxE,IAAI,CAAC,kBAAkB,CAAC,CAACwF,MAAM,CAAC;YACtEnF,QAAQ,EAAEoE,OAAO,CAACpE,QAAQ;YAAEoF,UAAU,EAAEtB,SAAS;YAAEuB,SAAS,EAAE,UAAU;YACxEZ,SAAS,EAAE,OAAO;YAAEa,WAAW,EAAE,UAAU;YAC3CpB,OAAO,EAAE+B,MAAM,CAACC,QAAQ;YAAEX,YAAY,EAAE,MAAM;YAC9CC,QAAQ,EAAE;cAAEI,QAAQ,EAAExB,OAAO,CAACwB,QAAQ;cAAEQ,aAAa,EAAE,IAAI;cAAEX,MAAM,EAAE;YAAU,CAAC;YAChFG,QAAQ,EAAExB,OAAO,CAACwB,QAAQ;YAAEjB,eAAe,EAAED;UAC/C,CAAC,CAAC,CAAC9E,MAAM,CAAC,qDAAqD,CAAC,CAACE,MAAM,CAAC,CAAC;UACzEkG,aAAa,GAAGG,MAAM;UACtBxJ,cAAc,CAACwH,QAAQ,EAAEC,OAAO,CAACpE,QAAQ,EAAE;YAAEqG,YAAY,EAAE,CAAC;YAAEC,iBAAiB,EAAE;UAAE,CAAC,CAAC,CAACR,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACvG;MACF,CAAC,CAAC,OAAOtC,GAAG,EAAE;QAAE/F,GAAG,CAACyB,KAAK,CAAC;UAAEsE,GAAG,EAAGA,GAAG,CAAWF;QAAQ,CAAC,EAAE,qBAAqB,CAAC;MAAE;IACrF;IAEAxG,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEiF,OAAO,EAAE,IAAI;MAAEC,OAAO;MAAEiD,cAAc,EAAEP,aAAa;MAAErB,eAAe,EAAED;IAAe,CAAC,EAAEf,WAAW,CAAC;IAC/H,OAAO,IAAI;EACb;;EAEA;EACA,MAAM6C,mBAAmB,GAAGnI,QAAQ,CAACG,KAAK,CAAC,8CAA8C,CAAC;EAC1F,IAAIgI,mBAAmB,IAAIrI,GAAG,CAACI,MAAM,KAAK,KAAK,EAAE;IAC/C,MAAMoD,QAAQ,GAAG1E,WAAW,CAACkB,GAAG,CAAC;IACjC,IAAIjB,eAAe,CAACkB,GAAG,EAAEuD,QAAQ,EAAEgC,WAAW,CAAC,EAAE,OAAO,IAAI;IAE5D,MAAMG,SAAS,GAAG0C,mBAAmB,CAAC,CAAC,CAAC;IACxC,MAAMhC,QAAQ,GAAGzC,GAAG,CAACE,YAAY,CAAC7B,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;IACxD,MAAMqG,SAAS,GAAG1E,GAAG,CAACE,YAAY,CAAC7B,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;IAC/D,IAAI,CAACoE,QAAQ,EAAE;MAAE1H,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAAqC,CAAC,EAAEyE,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAEpH,MAAMQ,QAAQ,GAAG1H,gBAAgB,CAAC,CAAC;IACnC,MAAM;MAAE2C,IAAI,EAAEsH;IAAU,CAAC,GAAG,MAAMvC,QAAQ,CAACxE,IAAI,CAAC,UAAU,CAAC,CAACC,MAAM,CAAC,UAAU,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEiE,SAAS,CAAC,CAACjE,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CAACC,MAAM,CAAC,CAAC;IACjI,IAAI,CAAC4G,SAAS,EAAE;MAAE5J,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA4B,CAAC,EAAEyE,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAE5G,IAAI,CAAC,kBAAkB,CAACgD,IAAI,CAACnC,QAAQ,CAAC,EAAE;MAAE1H,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE;MAA2B,CAAC,EAAEyE,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IACnI,IAAIiD,KAAK,GAAGzC,QAAQ,CAACxE,IAAI,CAAC,kBAAkB,CAAC,CAC1CC,MAAM,CAAC,0EAA0E,CAAC,CAClFC,EAAE,CAAC,YAAY,EAAEiE,SAAS,CAAC;IAC9B,IAAI2C,SAAS,EAAE;MAAEG,KAAK,GAAGA,KAAK,CAAC/G,EAAE,CAAC,iBAAiB,EAAE4G,SAAS,CAAC,CAACI,EAAE,CAAC,WAAW,EAAE,CAACrC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAE,CAAC,MAClG;MAAEoC,KAAK,GAAGA,KAAK,CAACC,EAAE,CAAC,WAAW,EAAE,CAACrC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAAE;IAE3D,MAAM;MAAEpF,IAAI,EAAE0H,QAAQ;MAAE5H,KAAK,EAAE6H;IAAQ,CAAC,GAAG,MAAMH,KAAK,CAAClG,KAAK,CAAC,YAAY,EAAE;MAAEC,SAAS,EAAE;IAAK,CAAC,CAAC,CAAC6B,KAAK,CAAC,EAAE,CAAC;IACzG,IAAIuE,OAAO,EAAE;MAAEjK,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;QAAEc,KAAK,EAAE6H,OAAO,CAACzD;MAAQ,CAAC,EAAEK,WAAW,CAAC;MAAE,OAAO,IAAI;IAAE;IAC7F7G,YAAY,CAACsB,GAAG,EAAE,GAAG,EAAE;MAAEiF,OAAO,EAAE,IAAI;MAAEyD,QAAQ,EAAEA,QAAQ,IAAI;IAAG,CAAC,EAAEnD,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;;EAEA;EACA,IAAItF,QAAQ,KAAK,oBAAoB,IAAIF,GAAG,CAACI,MAAM,KAAK,KAAK,EAAE;IAC7D,MAAMyI,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;IAClC,MAAMC,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;IACtC,MAAMC,aAAa,GAAG,CACpBD,IAAI,CAACE,IAAI,CAACC,MAAM,CAACC,IAAI,CAACC,OAAO,IAAIC,SAAS,EAAE,8BAA8B,CAAC,EAC3EN,IAAI,CAACE,IAAI,CAACC,MAAM,CAACC,IAAI,CAACC,OAAO,IAAIC,SAAS,EAAE,iCAAiC,CAAC,EAC9EN,IAAI,CAACE,IAAI,CAACrJ,OAAO,CAAC0J,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CACnD;IACD,IAAIC,QAAuB,GAAG,IAAI;IAClC,KAAK,MAAMC,CAAC,IAAIR,aAAa,EAAE;MAAE,IAAI;QAAEO,QAAQ,GAAGT,EAAE,CAACW,YAAY,CAACD,CAAC,EAAE,OAAO,CAAC;QAAE;MAAO,CAAC,CAAC,MAAM,CAAE;IAAiB;IACjH,IAAID,QAAQ,EAAE;MACZrJ,GAAG,CAACkC,SAAS,CAAC,GAAG,EAAE;QAAE,cAAc,EAAE,wBAAwB;QAAE,eAAe,EAAE,sBAAsB;QAAE,GAAGqD;MAAY,CAAC,CAAC;MACzHvF,GAAG,CAACqF,GAAG,CAACgE,QAAQ,CAAC;IACnB,CAAC,MAAM;MACLrJ,GAAG,CAACkC,SAAS,CAAC,GAAG,EAAE;QAAE,cAAc,EAAE,wBAAwB;QAAE,GAAGqD;MAAY,CAAC,CAAC;MAChFvF,GAAG,CAACqF,GAAG,CAAC,6IAA6I,CAAC;IACxJ;IACA,OAAO,IAAI;EACb;EAEA,OAAO,KAAK;AACd;;AAEA","ignoreList":[]}