whale-code 6.5.5 → 6.5.7

package/dist/server/server-routes-approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-routes-approvals.js","names":["createLogger","getServiceClient","verifyGuestApprovalSignature","executeInlineChain","jsonResponse","readBody","safeCompare","sendIpRateLimit","log","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","getToken","req","authHeader","headers","authorization","startsWith","substring","isInternalAuth","token","handleGuestApproval","res","ctx","pathname","corsHeaders","guestApprovalMatch","match","method","clientIp","toString","split","trim","socket","remoteAddress","stepRunId","urlParams","URL","url","host","searchParams","action","get","expires","sig","error","Date","guestSupabase","data","approval","from","select","eq","limit","length","status","isApprove","guestResult","guestErr","rpc","p_approval_id","id","p_store_id","store_id","p_response","p_response_data","guest","p_responded_by","success","message","run_id","err","runId","writeHead","end","handleApprovalRespond","approvalMatch","approvalId","isInternal","supabase","userId","user","authUser","authError","auth","getUser","rawBody","body","JSON","parse","single","approvalMembership","result","response_data","responded_by"],"sources":["../../src/server/server-routes-approvals.ts"],"sourcesContent":["// server/server-routes-approvals.ts — Approval route handlers\n// Guest approval GET and authenticated approval respond POST\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { verifyGuestApprovalSignature, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, type ServerContext } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\n\nconst log = createLogger(\"server-routes-approvals\");\n\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n\n// ============================================================================\n// GET /approvals/guest/:id — Guest approval via signed URL (no auth required)\n// GET /approvals/guest/:id?action=approve&expires=...&sig=...\n// ============================================================================\n\nexport async function handleGuestApproval(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const guestApprovalMatch = pathname.match(/^\\/approvals\\/guest\\/([a-f0-9-]+)$/);\n  if (!(guestApprovalMatch && req.method === \"GET\")) return false;\n\n  const clientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n  if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;\n\n  const stepRunId = guestApprovalMatch[1];\n  const urlParams = new URL(req.url || \"\", `http://${req.headers.host}`).searchParams;\n  const action = urlParams.get(\"action\") || \"\";\n  const expires = urlParams.get(\"expires\") || \"\";\n  const sig = urlParams.get(\"sig\") || \"\";\n\n  if (!action || !expires || !sig) {\n    jsonResponse(res, 400, { error: \"Missing action, expires, or sig parameter\" }, corsHeaders);\n    return true;\n  }\n  if (new Date(expires) < new Date()) {\n    jsonResponse(res, 410, { error: \"This approval link has expired\" }, corsHeaders);\n    return true;\n  }\n  if (!verifyGuestApprovalSignature(stepRunId, action, expires, sig)) {\n    jsonResponse(res, 403, { error: \"Invalid signature\" }, corsHeaders);\n    return true;\n  }\n\n  const guestSupabase = getServiceClient();\n\n  const { data: approval } = await guestSupabase.from(\"workflow_approval_requests\")\n    .select(\"id, store_id, run_id, status\").eq(\"step_run_id\", stepRunId).limit(1);\n  if (!approval?.length) {\n    jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders);\n    return true;\n  }\n  if (approval[0].status !== \"pending\") {\n    jsonResponse(res, 409, { error: `Approval already ${approval[0].status}` }, corsHeaders);\n    return true;\n  }\n\n  const isApprove = action === \"approve\" || action === \"approved\";\n  const { data: guestResult, error: guestErr } = await guestSupabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approval[0].id,\n    p_store_id: approval[0].store_id,\n    p_response: isApprove ? \"approved\" : \"rejected\",\n    p_response_data: { guest: true, action },\n    p_responded_by: null,\n  });\n\n  if (guestErr) {\n    jsonResponse(res, 500, { success: false, error: guestErr.message }, corsHeaders);\n    return true;\n  }\n\n  if (guestResult?.success && approval[0].run_id) {\n    try {\n      await executeInlineChain(guestSupabase, approval[0].run_id);\n    } catch (err) {\n      log.error({ err: (err as Error).message, runId: approval[0].run_id }, \"inline chain failed after guest approval\");\n    }\n  }\n\n  res.writeHead(200, { \"Content-Type\": \"text/html\", ...corsHeaders });\n  res.end(`<!DOCTYPE html><html><body style=\"font-family:system-ui;text-align:center;padding:40px\">\n    <h2>${isApprove ? \"Approved\" : \"Rejected\"}</h2>\n    <p>Your response has been recorded. You can close this window.</p>\n  </body></html>`);\n  return true;\n}\n\n// ============================================================================\n// POST /approvals/:id/respond — Authenticated approval response\n// ============================================================================\n\nexport async function handleApprovalRespond(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const approvalMatch = pathname.match(/^\\/approvals\\/([a-f0-9-]+)\\/respond$/);\n  if (!approvalMatch || req.method !== \"POST\") return false;\n\n  const approvalId = approvalMatch[1];\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n  let userId: string | null = null;\n\n  if (!isInternal) {\n    const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n    userId = authUser.id;\n  }\n\n  let rawBody: string;\n  try { rawBody = await readBody(req); } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n  if (!body.status) {\n    jsonResponse(res, 400, { error: \"status required (approved/rejected)\" }, corsHeaders);\n    return true;\n  }\n\n  // Get store_id from approval\n  const { data: approval } = await supabase.from(\"workflow_approval_requests\")\n    .select(\"store_id, run_id\").eq(\"id\", approvalId).single();\n  if (!approval) {\n    jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders);\n    return true;\n  }\n\n  // P1 FIX: Verify user has access to the approval's store\n  if (!isInternal && userId) {\n    const { data: approvalMembership } = await supabase.from(\"store_members\")\n      .select(\"id\").eq(\"store_id\", approval.store_id).eq(\"user_id\", userId).single();\n    if (!approvalMembership) {\n      jsonResponse(res, 403, { error: \"Not authorized to respond to this approval\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  const { data: result, error } = await supabase.rpc(\"respond_to_approval\", {\n    p_approval_id: approvalId,\n    p_store_id: approval.store_id,\n    p_response: body.status,\n    p_response_data: body.response_data || {},\n    p_responded_by: userId || body.responded_by || null,\n  });\n\n  if (error) {\n    jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders);\n    return true;\n  }\n\n  // Inline resume — execute next step immediately\n  if (result?.success && approval.run_id) {\n    try {\n      await executeInlineChain(supabase, approval.run_id);\n    } catch (err) {\n      log.error({ err: (err as Error).message }, \"inline chain failed after approval\");\n    }\n  }\n\n  jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,4BAA4B,EAAEC,kBAAkB,QAAQ,yBAAyB;AAC1F,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAA4B,qBAAqB;AAC7F,SAASC,eAAe,QAAQ,wBAAwB;AAExD,MAAMC,GAAG,GAAGR,YAAY,CAAC,yBAAyB,CAAC;AAEnD,MAAMS,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;;AAEA,SAASC,QAAQA,CAACC,GAAyB,EAAU;EACnD,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAACC,aAAa;EAC5C,OAAOF,UAAU,EAAEG,UAAU,CAAC,SAAS,CAAC,GAAGH,UAAU,CAACI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASC,cAAcA,CAACC,KAAa,EAAW;EAC9C,OAAOhB,WAAW,CAACgB,KAAK,EAAET,mBAAmB,CAAC,IAAIP,WAAW,CAACgB,KAAK,EAAEb,yBAAyB,CAAC,IAAIH,WAAW,CAACgB,KAAK,EAAEV,gBAAgB,CAAC;AACzI;;AAEA;AACA;AACA;AACA;;AAEA,OAAO,eAAeW,mBAAmBA,CACvCR,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMG,kBAAkB,GAAGF,QAAQ,CAACG,KAAK,CAAC,oCAAoC,CAAC;EAC/E,IAAI,EAAED,kBAAkB,IAAIb,GAAG,CAACe,MAAM,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;EAE/D,MAAMC,QAAQ,GAAGhB,GAAG,CAACE,OAAO,CAAC,iBAAiB,CAAC,EAAEe,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAInB,GAAG,CAACoB,MAAM,CAACC,aAAa,IAAI,SAAS;EAC1H,IAAI7B,eAAe,CAACiB,GAAG,EAAEO,QAAQ,EAAEJ,WAAW,CAAC,EAAE,OAAO,IAAI;EAE5D,MAAMU,SAAS,GAAGT,kBAAkB,CAAC,CAAC,CAAC;EACvC,MAAMU,SAAS,GAAG,IAAIC,GAAG,CAACxB,GAAG,CAACyB,GAAG,IAAI,EAAE,EAAE,UAAUzB,GAAG,CAACE,OAAO,CAACwB,IAAI,EAAE,CAAC,CAACC,YAAY;EACnF,MAAMC,MAAM,GAAGL,SAAS,CAACM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;EAC5C,MAAMC,OAAO,GAAGP,SAAS,CAACM,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;EAC9C,MAAME,GAAG,GAAGR,SAAS,CAACM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;EAEtC,IAAI,CAACD,MAAM,IAAI,CAACE,OAAO,IAAI,CAACC,GAAG,EAAE;IAC/B1C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAA4C,CAAC,EAAEpB,WAAW,CAAC;IAC3F,OAAO,IAAI;EACb;EACA,IAAI,IAAIqB,IAAI,CAACH,OAAO,CAAC,GAAG,IAAIG,IAAI,CAAC,CAAC,EAAE;IAClC5C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAiC,CAAC,EAAEpB,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;EACA,IAAI,CAACzB,4BAA4B,CAACmC,SAAS,EAAEM,MAAM,EAAEE,OAAO,EAAEC,GAAG,CAAC,EAAE;IAClE1C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAoB,CAAC,EAAEpB,WAAW,CAAC;IACnE,OAAO,IAAI;EACb;EAEA,MAAMsB,aAAa,GAAGhD,gBAAgB,CAAC,CAAC;EAExC,MAAM;IAAEiD,IAAI,EAAEC;EAAS,CAAC,GAAG,MAAMF,aAAa,CAACG,IAAI,CAAC,4BAA4B,CAAC,CAC9EC,MAAM,CAAC,8BAA8B,CAAC,CAACC,EAAE,CAAC,aAAa,EAAEjB,SAAS,CAAC,CAACkB,KAAK,CAAC,CAAC,CAAC;EAC/E,IAAI,CAACJ,QAAQ,EAAEK,MAAM,EAAE;IACrBpD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAqB,CAAC,EAAEpB,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;EACA,IAAIwB,QAAQ,CAAC,CAAC,CAAC,CAACM,MAAM,KAAK,SAAS,EAAE;IACpCrD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE,oBAAoBI,QAAQ,CAAC,CAAC,CAAC,CAACM,MAAM;IAAG,CAAC,EAAE9B,WAAW,CAAC;IACxF,OAAO,IAAI;EACb;EAEA,MAAM+B,SAAS,GAAGf,MAAM,KAAK,SAAS,IAAIA,MAAM,KAAK,UAAU;EAC/D,MAAM;IAAEO,IAAI,EAAES,WAAW;IAAEZ,KAAK,EAAEa;EAAS,CAAC,GAAG,MAAMX,aAAa,CAACY,GAAG,CAAC,qBAAqB,EAAE;IAC5FC,aAAa,EAAEX,QAAQ,CAAC,CAAC,CAAC,CAACY,EAAE;IAC7BC,UAAU,EAAEb,QAAQ,CAAC,CAAC,CAAC,CAACc,QAAQ;IAChCC,UAAU,EAAER,SAAS,GAAG,UAAU,GAAG,UAAU;IAC/CS,eAAe,EAAE;MAAEC,KAAK,EAAE,IAAI;MAAEzB;IAAO,CAAC;IACxC0B,cAAc,EAAE;EAClB,CAAC,CAAC;EAEF,IAAIT,QAAQ,EAAE;IACZxD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE8C,OAAO,EAAE,KAAK;MAAEvB,KAAK,EAAEa,QAAQ,CAACW;IAAQ,CAAC,EAAE5C,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;EAEA,IAAIgC,WAAW,EAAEW,OAAO,IAAInB,QAAQ,CAAC,CAAC,CAAC,CAACqB,MAAM,EAAE;IAC9C,IAAI;MACF,MAAMrE,kBAAkB,CAAC8C,aAAa,EAAEE,QAAQ,CAAC,CAAC,CAAC,CAACqB,MAAM,CAAC;IAC7D,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZjE,GAAG,CAACuC,KAAK,CAAC;QAAE0B,GAAG,EAAGA,GAAG,CAAWF,OAAO;QAAEG,KAAK,EAAEvB,QAAQ,CAAC,CAAC,CAAC,CAACqB;MAAO,CAAC,EAAE,0CAA0C,CAAC;IACnH;EACF;EAEAhD,GAAG,CAACmD,SAAS,CAAC,GAAG,EAAE;IAAE,cAAc,EAAE,WAAW;IAAE,GAAGhD;EAAY,CAAC,CAAC;EACnEH,GAAG,CAACoD,GAAG,CAAC;AACV,UAAUlB,SAAS,GAAG,UAAU,GAAG,UAAU;AAC7C;AACA,iBAAiB,CAAC;EAChB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAemB,qBAAqBA,CACzC9D,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMqD,aAAa,GAAGpD,QAAQ,CAACG,KAAK,CAAC,sCAAsC,CAAC;EAC5E,IAAI,CAACiD,aAAa,IAAI/D,GAAG,CAACe,MAAM,KAAK,MAAM,EAAE,OAAO,KAAK;EAEzD,MAAMiD,UAAU,GAAGD,aAAa,CAAC,CAAC,CAAC;EACnC,MAAMxD,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAMiE,UAAU,GAAG3D,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAAC0D,UAAU,IAAI,CAAC1D,KAAK,EAAE;IACzBlB,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAwB,CAAC,EAAEpB,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,MAAMsD,QAAQ,GAAGhF,gBAAgB,CAAC,CAAC;EACnC,IAAIiF,MAAqB,GAAG,IAAI;EAEhC,IAAI,CAACF,UAAU,EAAE;IACf,MAAM;MAAE9B,IAAI,EAAE;QAAEiC,IAAI,EAAEC;MAAS,CAAC;MAAErC,KAAK,EAAEsC;IAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACjE,KAAK,CAAC;IACzF,IAAI+D,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1BhF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAEuB,KAAK,EAAE;MAA2B,CAAC,EAAEpB,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;IACAuD,MAAM,GAAGE,QAAQ,CAACrB,EAAE;EACtB;EAEA,IAAIyB,OAAe;EACnB,IAAI;IAAEA,OAAO,GAAG,MAAMnF,QAAQ,CAACU,GAAG,CAAC;EAAE,CAAC,CAAC,MAAM;IAC3CX,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAyB,CAAC,EAAEpB,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,IAAI8D,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,CAAC;EAAE,CAAC,CAAC,MAAM;IACxCpF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAe,CAAC,EAAEpB,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EACA,IAAI,CAAC8D,IAAI,CAAChC,MAAM,EAAE;IAChBrD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAsC,CAAC,EAAEpB,WAAW,CAAC;IACrF,OAAO,IAAI;EACb;;EAEA;EACA,MAAM;IAAEuB,IAAI,EAAEC;EAAS,CAAC,GAAG,MAAM8B,QAAQ,CAAC7B,IAAI,CAAC,4BAA4B,CAAC,CACzEC,MAAM,CAAC,kBAAkB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEyB,UAAU,CAAC,CAACa,MAAM,CAAC,CAAC;EAC3D,IAAI,CAACzC,QAAQ,EAAE;IACb/C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEuB,KAAK,EAAE;IAAqB,CAAC,EAAEpB,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;;EAEA;EACA,IAAI,CAACqD,UAAU,IAAIE,MAAM,EAAE;IACzB,MAAM;MAAEhC,IAAI,EAAE2C;IAAmB,CAAC,GAAG,MAAMZ,QAAQ,CAAC7B,IAAI,CAAC,eAAe,CAAC,CACtEC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,QAAQ,CAACc,QAAQ,CAAC,CAACX,EAAE,CAAC,SAAS,EAAE4B,MAAM,CAAC,CAACU,MAAM,CAAC,CAAC;IAChF,IAAI,CAACC,kBAAkB,EAAE;MACvBzF,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAEuB,KAAK,EAAE;MAA6C,CAAC,EAAEpB,WAAW,CAAC;MAC5F,OAAO,IAAI;IACb;EACF;EAEA,MAAM;IAAEuB,IAAI,EAAE4C,MAAM;IAAE/C;EAAM,CAAC,GAAG,MAAMkC,QAAQ,CAACpB,GAAG,CAAC,qBAAqB,EAAE;IACxEC,aAAa,EAAEiB,UAAU;IACzBf,UAAU,EAAEb,QAAQ,CAACc,QAAQ;IAC7BC,UAAU,EAAEuB,IAAI,CAAChC,MAAM;IACvBU,eAAe,EAAEsB,IAAI,CAACM,aAAa,IAAI,CAAC,CAAC;IACzC1B,cAAc,EAAEa,MAAM,IAAIO,IAAI,CAACO,YAAY,IAAI;EACjD,CAAC,CAAC;EAEF,IAAIjD,KAAK,EAAE;IACT3C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE8C,OAAO,EAAE,KAAK;MAAEvB,KAAK,EAAEA,KAAK,CAACwB;IAAQ,CAAC,EAAE5C,WAAW,CAAC;IAC7E,OAAO,IAAI;EACb;;EAEA;EACA,IAAImE,MAAM,EAAExB,OAAO,IAAInB,QAAQ,CAACqB,MAAM,EAAE;IACtC,IAAI;MACF,MAAMrE,kBAAkB,CAAC8E,QAAQ,EAAE9B,QAAQ,CAACqB,MAAM,CAAC;IACrD,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZjE,GAAG,CAACuC,KAAK,CAAC;QAAE0B,GAAG,EAAGA,GAAG,CAAWF;MAAQ,CAAC,EAAE,oCAAoC,CAAC;IAClF;EACF;EAEAnE,YAAY,CAACoB,GAAG,EAAEsE,MAAM,EAAExB,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEwB,MAAM,EAAEnE,WAAW,CAAC;EACnE,OAAO,IAAI;AACb","ignoreList":[]}

package/dist/server/server-routes-auth.d.ts

@@ -0,0 +1,7 @@
+import http from "node:http";
+/**
+ * Handle all authenticated POST/PUT/DELETE routes.
+ * Called after public routes have been checked.
+ * Returns true if route was handled, false otherwise.
+ */
+export declare function handleAuthenticatedRoutes(req: http.IncomingMessage, res: http.ServerResponse, pathname: string, url: URL, corsHeaders: Record<string, string>): Promise<boolean>;

package/dist/server/server-routes-auth.js

@@ -0,0 +1,532 @@
+// server/server-routes-auth.ts — Authenticated POST route handlers
+// Resume, approvals, waitpoints, webhooks, events, workflows, tool exec, telemetry, etc.
+// Extracted from index.ts for modularity.
+
+import { createLogger } from "./lib/logger.js";
+import { sanitizeError } from "../shared/agent-core.js";
+import { getServiceClient } from "./lib/supabase-client.js";
+import { loadCheckpoint } from "./lib/session-checkpoint.js";
+import { processWorkflowSteps, handleWebhookIngestion, executeInlineChain } from "./handlers/workflows.js";
+import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { sendIpRateLimit } from "./server-rate-limit.js";
+const log = createLogger("server-routes-auth");
+const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
+const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+const SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || "";
+const FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || "";
+
+/**
+ * Handle all authenticated POST/PUT/DELETE routes.
+ * Called after public routes have been checked.
+ * Returns true if route was handled, false otherwise.
+ */
+export async function handleAuthenticatedRoutes(req, res, pathname, url, corsHeaders) {
+  if (req.method !== "POST" && req.method !== "DELETE" && req.method !== "PUT") {
+    jsonResponse(res, 405, {
+      error: "Method not allowed"
+    }, corsHeaders);
+    return true;
+  }
+  try {
+    // Resume conversation from checkpoint
+    const resumeMatch = pathname.match(/^\/conversations\/([a-f0-9-]+)\/resume$/);
+    if (resumeMatch && req.method === "POST") {
+      const convId = resumeMatch[1];
+      const token = getToken(req);
+      const isInternal = isInternalAuth(token);
+      if (!isInternal && !token) {
+        jsonResponse(res, 401, {
+          error: "Missing authorization"
+        }, corsHeaders);
+        return true;
+      }
+      const supabase = getServiceClient();
+      if (!isInternal) {
+        const {
+          data: {
+            user: authUser
+          },
+          error: authError
+        } = await supabase.auth.getUser(token);
+        if (authError || !authUser) {
+          jsonResponse(res, 401, {
+            error: "Invalid or expired token"
+          }, corsHeaders);
+          return true;
+        }
+      }
+      try {
+        await readBody(req);
+      } catch {/* body not needed */}
+      const checkpoint = await loadCheckpoint(supabase, convId);
+      if (!checkpoint) {
+        jsonResponse(res, 404, {
+          error: "No checkpoint found for this conversation"
+        }, corsHeaders);
+        return true;
+      }
+      let parsedMessages;
+      try {
+        parsedMessages = JSON.parse(checkpoint.messages);
+      } catch {
+        jsonResponse(res, 422, {
+          error: "Checkpoint messages corrupted"
+        }, corsHeaders);
+        return true;
+      }
+      jsonResponse(res, 200, {
+        success: true,
+        conversation_id: checkpoint.conversation_id,
+        turn: checkpoint.turn,
+        messages: parsedMessages,
+        tokens_used: checkpoint.tokens_used,
+        cost_so_far: checkpoint.cost_so_far,
+        tools_used: checkpoint.tools_used,
+        checkpointed_at: checkpoint.created_at
+      }, corsHeaders);
+      return true;
+    }
+
+    // Approval response
+    const approvalMatch = pathname.match(/^\/approvals\/([a-f0-9-]+)\/respond$/);
+    if (approvalMatch) {
+      const approvalId = approvalMatch[1];
+      const token = getToken(req);
+      const isInternal = isInternalAuth(token);
+      if (!isInternal && !token) {
+        jsonResponse(res, 401, {
+          error: "Missing authorization"
+        }, corsHeaders);
+        return true;
+      }
+      const supabase = getServiceClient();
+      let userId = null;
+      if (!isInternal) {
+        const {
+          data: {
+            user: authUser
+          },
+          error: authError
+        } = await supabase.auth.getUser(token);
+        if (authError || !authUser) {
+          jsonResponse(res, 401, {
+            error: "Invalid or expired token"
+          }, corsHeaders);
+          return true;
+        }
+        userId = authUser.id;
+      }
+      let rawBody;
+      try {
+        rawBody = await readBody(req);
+      } catch {
+        jsonResponse(res, 413, {
+          error: "Request body too large"
+        }, corsHeaders);
+        return true;
+      }
+      let body;
+      try {
+        body = JSON.parse(rawBody);
+      } catch {
+        jsonResponse(res, 400, {
+          error: "Invalid JSON"
+        }, corsHeaders);
+        return true;
+      }
+      if (!body.status) {
+        jsonResponse(res, 400, {
+          error: "status required (approved/rejected)"
+        }, corsHeaders);
+        return true;
+      }
+      const {
+        data: approval
+      } = await supabase.from("workflow_approval_requests").select("store_id, run_id").eq("id", approvalId).single();
+      if (!approval) {
+        jsonResponse(res, 404, {
+          error: "Approval not found"
+        }, corsHeaders);
+        return true;
+      }
+      if (!isInternal && userId) {
+        const {
+          data: approvalMembership
+        } = await supabase.from("store_members").select("id").eq("store_id", approval.store_id).eq("user_id", userId).single();
+        if (!approvalMembership) {
+          jsonResponse(res, 403, {
+            error: "Not authorized to respond to this approval"
+          }, corsHeaders);
+          return true;
+        }
+      }
+      const {
+        data: result,
+        error
+      } = await supabase.rpc("respond_to_approval", {
+        p_approval_id: approvalId,
+        p_store_id: approval.store_id,
+        p_response: body.status,
+        p_response_data: body.response_data || {},
+        p_responded_by: userId || body.responded_by || null
+      });
+      if (error) {
+        jsonResponse(res, 500, {
+          success: false,
+          error: error.message
+        }, corsHeaders);
+        return true;
+      }
+      if (result?.success && approval.run_id) {
+        try {
+          await executeInlineChain(supabase, approval.run_id);
+        } catch (err) {
+          log.error({
+            err: err.message
+          }, "inline chain failed after approval");
+        }
+      }
+      jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);
+      return true;
+    }
+
+    // Waitpoint completion
+    const waitpointMatch = pathname.match(/^\/waitpoints\/([a-f0-9-]+)\/complete$/);
+    if (waitpointMatch) {
+      const wpToken = waitpointMatch[1];
+      const authToken = getToken(req);
+      const isInternal = isInternalAuth(authToken);
+      if (!isInternal && !authToken) {
+        jsonResponse(res, 401, {
+          error: "Missing authorization"
+        }, corsHeaders);
+        return true;
+      }
+      const supabase = getServiceClient();
+      let rawBody;
+      try {
+        rawBody = await readBody(req);
+      } catch {
+        jsonResponse(res, 413, {
+          error: "Request body too large"
+        }, corsHeaders);
+        return true;
+      }
+      let body;
+      try {
+        body = JSON.parse(rawBody || "{}");
+      } catch {
+        jsonResponse(res, 400, {
+          error: "Invalid JSON"
+        }, corsHeaders);
+        return true;
+      }
+      const {
+        data: wp
+      } = await supabase.from("waitpoint_tokens").select("id, run_id, step_run_id, store_id, expires_at, status").eq("token", wpToken).single();
+      if (!wp) {
+        jsonResponse(res, 404, {
+          error: "Waitpoint token not found"
+        }, corsHeaders);
+        return true;
+      }
+      if (wp.status === "completed") {
+        jsonResponse(res, 409, {
+          error: "Waitpoint already completed"
+        }, corsHeaders);
+        return true;
+      }
+      if (new Date(wp.expires_at) < new Date()) {
+        jsonResponse(res, 410, {
+          error: "Waitpoint expired"
+        }, corsHeaders);
+        return true;
+      }
+      await supabase.from("waitpoint_tokens").update({
+        status: "completed",
+        completion_data: body.data || {},
+        completed_at: new Date().toISOString()
+      }).eq("id", wp.id);
+      await supabase.from("workflow_step_runs").update({
+        status: "pending",
+        input: {
+          waitpoint_completed: true,
+          waitpoint_data: body.data || {}
+        }
+      }).eq("id", wp.step_run_id).eq("status", "waiting");
+      try {
+        await executeInlineChain(supabase, wp.run_id);
+      } catch (err) {
+        log.error({
+          err: err.message,
+          runId: wp.run_id
+        }, "inline chain failed after waitpoint");
+      }
+      jsonResponse(res, 200, {
+        success: true,
+        run_id: wp.run_id
+      }, corsHeaders);
+      return true;
+    }
+
+    // Webhook ingestion
+    const webhookMatch = pathname.match(/^\/webhooks\/([a-zA-Z0-9_-]+)$/);
+    if (webhookMatch) {
+      const whClientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+      if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;
+      const slug = webhookMatch[1];
+      let rawBody;
+      try {
+        rawBody = await readBody(req);
+      } catch {
+        jsonResponse(res, 413, {
+          error: "Request body too large"
+        }, corsHeaders);
+        return true;
+      }
+      const supabase = getServiceClient();
+      const headers = {};
+      for (const [k, v] of Object.entries(req.headers)) {
+        if (typeof v === "string") headers[k] = v;
+      }
+      const result = await handleWebhookIngestion(supabase, slug, rawBody, headers);
+      if (result.body.run_id && result.status === 200) {
+        try {
+          await executeInlineChain(supabase, result.body.run_id);
+        } catch (err) {
+          log.error({
+            err: err.message
+          }, "webhook inline chain error");
+        }
+      }
+      jsonResponse(res, result.status, result.body, corsHeaders);
+      return true;
+    }
+
+    // Fire event
+    if (pathname === "/events") {
+      const token = getToken(req);
+      const isInternal = isInternalAuth(token);
+      if (!isInternal && !token) {
+        jsonResponse(res, 401, {
+          error: "Missing authorization"
+        }, corsHeaders);
+        return true;
+      }
+      const supabase = getServiceClient();
+      if (!isInternal) {
+        const {
+          data: {
+            user: authUser
+          },
+          error: authError
+        } = await supabase.auth.getUser(token);
+        if (authError || !authUser) {
+          jsonResponse(res, 401, {
+            error: "Invalid or expired token"
+          }, corsHeaders);
+          return true;
+        }
+      }
+      let rawBody;
+      try {
+        rawBody = await readBody(req);
+      } catch {
+        jsonResponse(res, 413, {
+          error: "Request body too large"
+        }, corsHeaders);
+        return true;
+      }
+      let body;
+      try {
+        body = JSON.parse(rawBody || "{}");
+      } catch {
+        jsonResponse(res, 400, {
+          error: "Invalid JSON"
+        }, corsHeaders);
+        return true;
+      }
+      if (!body.store_id || !body.event_type) {
+        jsonResponse(res, 400, {
+          error: "store_id and event_type required"
+        }, corsHeaders);
+        return true;
+      }
+      if (body.idempotency_key) {
+        const {
+          data: existing
+        } = await supabase.from("workflow_events").select("id").eq("idempotency_key", body.idempotency_key).limit(1);
+        if (existing && existing.length > 0) {
+          jsonResponse(res, 200, {
+            success: true,
+            event_id: existing[0].id,
+            deduplicated: true
+          }, corsHeaders);
+          return true;
+        }
+      }
+      const {
+        data: eventId,
+        error: fireErr
+      } = await supabase.rpc("fire_event", {
+        p_store_id: body.store_id,
+        p_event_type: body.event_type,
+        p_event_payload: body.payload || {},
+        p_source: body.source || "api"
+      });
+      if (fireErr) jsonResponse(res, 500, {
+        success: false,
+        error: fireErr.message
+      }, corsHeaders);else jsonResponse(res, 200, {
+        success: true,
+        event_id: eventId
+      }, corsHeaders);
+      return true;
+    }
+
+    // Workflow process (internal)
+    if (pathname === "/workflows/process") {
+      const token = getToken(req);
+      if (!FLY_INTERNAL_SECRET || !safeCompare(token, FLY_INTERNAL_SECRET) && !safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) && !safeCompare(token, SERVICE_ROLE_JWT)) {
+        jsonResponse(res, 401, {
+          error: "Unauthorized"
+        }, corsHeaders);
+        return true;
+      }
+      let rawBody;
+      try {
+        rawBody = await readBody(req);
+      } catch {
+        rawBody = "{}";
+      }
+      let body;
+      try {
+        body = JSON.parse(rawBody || "{}");
+      } catch {
+        jsonResponse(res, 400, {
+          error: "Invalid JSON"
+        }, corsHeaders);
+        return true;
+      }
+      const supabase = getServiceClient();
+      const result = await processWorkflowSteps(supabase, body.batch_size || 10);
+      jsonResponse(res, 200, {
+        success: true,
+        ...result
+      }, corsHeaders);
+      return true;
+    }
+
+    // Start workflow run
+    if (pathname === "/workflows/start") {
+      const token = getToken(req);
+      const isInternal = isInternalAuth(token);
+      if (!isInternal && !token) {
+        jsonResponse(res, 401, {
+          error: "Missing authorization"
+        }, corsHeaders);
+        return true;
+      }
+      const supabase = getServiceClient();
+      if (!isInternal) {
+        const {
+          data: {
+            user: authUser
+          },
+          error: authError
+        } = await supabase.auth.getUser(token);
+        if (authError || !authUser) {
+          jsonResponse(res, 401, {
+            error: "Invalid or expired token"
+          }, corsHeaders);
+          return true;
+        }
+      }
+      let rawBody;
+      try {
+        rawBody = await readBody(req);
+      } catch {
+        jsonResponse(res, 413, {
+          error: "Request body too large"
+        }, corsHeaders);
+        return true;
+      }
+      let body;
+      try {
+        body = JSON.parse(rawBody);
+      } catch {
+        jsonResponse(res, 400, {
+          error: "Invalid JSON"
+        }, corsHeaders);
+        return true;
+      }
+      if (body.workflow_id && body.store_id) {
+        const {
+          data: wfOwner,
+          error: wfOwnerErr
+        } = await supabase.from("workflows").select("id").eq("id", body.workflow_id).eq("store_id", body.store_id).single();
+        if (wfOwnerErr || !wfOwner) {
+          jsonResponse(res, 403, {
+            error: "Workflow does not belong to this store"
+          }, corsHeaders);
+          return true;
+        }
+      }
+      const {
+        data,
+        error
+      } = await supabase.rpc("start_workflow_run", {
+        p_workflow_id: body.workflow_id,
+        p_store_id: body.store_id,
+        p_trigger_type: body.trigger_type || "api",
+        p_trigger_payload: body.trigger_payload || {},
+        p_idempotency_key: body.idempotency_key || null
+      });
+      if (error) {
+        jsonResponse(res, 500, {
+          success: false,
+          error: error.message
+        }, corsHeaders);
+      } else {
+        if (data?.success && data.run_id && !data.deduplicated) {
+          try {
+            const {
+              data: wf
+            } = await supabase.from("workflows").select("published_version_id").eq("id", body.workflow_id).single();
+            if (wf?.published_version_id) await supabase.from("workflow_runs").update({
+              version_id: wf.published_version_id
+            }).eq("id", data.run_id);
+            await executeInlineChain(supabase, data.run_id);
+          } catch (err) {
+            log.error({
+              err: err.message
+            }, "start-inline chain error");
+          }
+        }
+        jsonResponse(res, data?.success ? 200 : 422, data, corsHeaders);
+      }
+      return true;
+    }
+
+    // If none of the above matched, return false — caller handles auth gate + mode dispatch
+    return false;
+  } catch (err) {
+    if (!res.headersSent) jsonResponse(res, 500, {
+      error: sanitizeError(err)
+    }, corsHeaders);
+    return true;
+  }
+}
+
+// ============================================================================
+// HELPERS
+// ============================================================================
+
+function getToken(req) {
+  const authHeader = req.headers.authorization;
+  return authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : "";
+}
+function isInternalAuth(token) {
+  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);
+}
+//# sourceMappingURL=server-routes-auth.js.map

package/dist/server/server-routes-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-routes-auth.js","names":["createLogger","sanitizeError","getServiceClient","loadCheckpoint","processWorkflowSteps","handleWebhookIngestion","executeInlineChain","jsonResponse","readBody","safeCompare","sendIpRateLimit","log","ANTHROPIC_API_KEY","process","env","SUPABASE_SERVICE_ROLE_KEY","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","handleAuthenticatedRoutes","req","res","pathname","url","corsHeaders","method","error","resumeMatch","match","convId","token","getToken","isInternal","isInternalAuth","supabase","data","user","authUser","authError","auth","getUser","checkpoint","parsedMessages","JSON","parse","messages","success","conversation_id","turn","tokens_used","cost_so_far","tools_used","checkpointed_at","created_at","approvalMatch","approvalId","userId","id","rawBody","body","status","approval","from","select","eq","single","approvalMembership","store_id","result","rpc","p_approval_id","p_store_id","p_response","p_response_data","response_data","p_responded_by","responded_by","message","run_id","err","waitpointMatch","wpToken","authToken","wp","Date","expires_at","update","completion_data","completed_at","toISOString","input","waitpoint_completed","waitpoint_data","step_run_id","runId","webhookMatch","whClientIp","headers","toString","split","trim","socket","remoteAddress","slug","k","v","Object","entries","event_type","idempotency_key","existing","limit","length","event_id","deduplicated","eventId","fireErr","p_event_type","p_event_payload","payload","p_source","source","batch_size","workflow_id","wfOwner","wfOwnerErr","p_workflow_id","p_trigger_type","trigger_type","p_trigger_payload","trigger_payload","p_idempotency_key","wf","published_version_id","version_id","headersSent","authHeader","authorization","startsWith","substring"],"sources":["../../src/server/server-routes-auth.ts"],"sourcesContent":["// server/server-routes-auth.ts — Authenticated POST route handlers\n// Resume, approvals, waitpoints, webhooks, events, workflows, tool exec, telemetry, etc.\n// Extracted from index.ts for modularity.\n\nimport http from \"node:http\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport Anthropic from \"@anthropic-ai/sdk\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { sanitizeError } from \"../shared/agent-core.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { handleProxy } from \"./proxy-handlers.js\";\nimport { handleTranscribe } from \"./handlers/transcription.js\";\nimport { generateCompaction } from \"./lib/compaction-service.js\";\nimport { loadCheckpoint } from \"./lib/session-checkpoint.js\";\nimport { rateLimiter } from \"./lib/rate-limiter.js\";\nimport { sanitizeAndLog } from \"./lib/prompt-sanitizer.js\";\nimport {\n  processWorkflowSteps, handleWebhookIngestion, executeInlineChain,\n} from \"./handlers/workflows.js\";\nimport {\n  loadUserTools, executeTool, type UserToolRow,\n} from \"./tool-router.js\";\nimport { queueSpan, auditRowToSpan } from \"./lib/clickhouse-buffer.js\";\nimport { jsonResponse, readBody, safeCompare } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\nimport { resolveAndValidateStoreId } from \"./server-store.js\";\nimport { handleAgentChat } from \"./server-chat.js\";\n\nconst log = createLogger(\"server-routes-auth\");\n\nconst ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY!;\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n/**\n * Handle all authenticated POST/PUT/DELETE routes.\n * Called after public routes have been checked.\n * Returns true if route was handled, false otherwise.\n */\nexport async function handleAuthenticatedRoutes(\n  req: http.IncomingMessage, res: http.ServerResponse,\n  pathname: string, url: URL, corsHeaders: Record<string, string>,\n): Promise<boolean> {\n  if (req.method !== \"POST\" && req.method !== \"DELETE\" && req.method !== \"PUT\") {\n    jsonResponse(res, 405, { error: \"Method not allowed\" }, corsHeaders);\n    return true;\n  }\n\n  try {\n    // Resume conversation from checkpoint\n    const resumeMatch = pathname.match(/^\\/conversations\\/([a-f0-9-]+)\\/resume$/);\n    if (resumeMatch && req.method === \"POST\") {\n      const convId = resumeMatch[1];\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      try { await readBody(req); } catch { /* body not needed */ }\n      const checkpoint = await loadCheckpoint(supabase, convId);\n      if (!checkpoint) { jsonResponse(res, 404, { error: \"No checkpoint found for this conversation\" }, corsHeaders); return true; }\n      let parsedMessages: unknown[];\n      try { parsedMessages = JSON.parse(checkpoint.messages); } catch { jsonResponse(res, 422, { error: \"Checkpoint messages corrupted\" }, corsHeaders); return true; }\n      jsonResponse(res, 200, { success: true, conversation_id: checkpoint.conversation_id, turn: checkpoint.turn, messages: parsedMessages, tokens_used: checkpoint.tokens_used, cost_so_far: checkpoint.cost_so_far, tools_used: checkpoint.tools_used, checkpointed_at: checkpoint.created_at }, corsHeaders);\n      return true;\n    }\n\n    // Approval response\n    const approvalMatch = pathname.match(/^\\/approvals\\/([a-f0-9-]+)\\/respond$/);\n    if (approvalMatch) {\n      const approvalId = approvalMatch[1];\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      let userId: string | null = null;\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n        userId = authUser.id;\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (!body.status) { jsonResponse(res, 400, { error: \"status required (approved/rejected)\" }, corsHeaders); return true; }\n      const { data: approval } = await supabase.from(\"workflow_approval_requests\").select(\"store_id, run_id\").eq(\"id\", approvalId).single();\n      if (!approval) { jsonResponse(res, 404, { error: \"Approval not found\" }, corsHeaders); return true; }\n      if (!isInternal && userId) {\n        const { data: approvalMembership } = await supabase.from(\"store_members\").select(\"id\").eq(\"store_id\", approval.store_id).eq(\"user_id\", userId).single();\n        if (!approvalMembership) { jsonResponse(res, 403, { error: \"Not authorized to respond to this approval\" }, corsHeaders); return true; }\n      }\n      const { data: result, error } = await supabase.rpc(\"respond_to_approval\", { p_approval_id: approvalId, p_store_id: approval.store_id, p_response: body.status, p_response_data: body.response_data || {}, p_responded_by: userId || body.responded_by || null });\n      if (error) { jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders); return true; }\n      if (result?.success && approval.run_id) { try { await executeInlineChain(supabase, approval.run_id); } catch (err) { log.error({ err: (err as Error).message }, \"inline chain failed after approval\"); } }\n      jsonResponse(res, result?.success ? 200 : 422, result, corsHeaders);\n      return true;\n    }\n\n    // Waitpoint completion\n    const waitpointMatch = pathname.match(/^\\/waitpoints\\/([a-f0-9-]+)\\/complete$/);\n    if (waitpointMatch) {\n      const wpToken = waitpointMatch[1];\n      const authToken = getToken(req);\n      const isInternal = isInternalAuth(authToken);\n      if (!isInternal && !authToken) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      const { data: wp } = await supabase.from(\"waitpoint_tokens\").select(\"id, run_id, step_run_id, store_id, expires_at, status\").eq(\"token\", wpToken).single();\n      if (!wp) { jsonResponse(res, 404, { error: \"Waitpoint token not found\" }, corsHeaders); return true; }\n      if (wp.status === \"completed\") { jsonResponse(res, 409, { error: \"Waitpoint already completed\" }, corsHeaders); return true; }\n      if (new Date(wp.expires_at) < new Date()) { jsonResponse(res, 410, { error: \"Waitpoint expired\" }, corsHeaders); return true; }\n      await supabase.from(\"waitpoint_tokens\").update({ status: \"completed\", completion_data: body.data || {}, completed_at: new Date().toISOString() }).eq(\"id\", wp.id);\n      await supabase.from(\"workflow_step_runs\").update({ status: \"pending\", input: { waitpoint_completed: true, waitpoint_data: body.data || {} } }).eq(\"id\", wp.step_run_id).eq(\"status\", \"waiting\");\n      try { await executeInlineChain(supabase, wp.run_id); } catch (err) { log.error({ err: (err as Error).message, runId: wp.run_id }, \"inline chain failed after waitpoint\"); }\n      jsonResponse(res, 200, { success: true, run_id: wp.run_id }, corsHeaders);\n      return true;\n    }\n\n    // Webhook ingestion\n    const webhookMatch = pathname.match(/^\\/webhooks\\/([a-zA-Z0-9_-]+)$/);\n    if (webhookMatch) {\n      const whClientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n      if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;\n      const slug = webhookMatch[1];\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      const headers: Record<string, string> = {};\n      for (const [k, v] of Object.entries(req.headers)) { if (typeof v === \"string\") headers[k] = v; }\n      const result = await handleWebhookIngestion(supabase, slug, rawBody, headers);\n      if (result.body.run_id && result.status === 200) {\n        try { await executeInlineChain(supabase, result.body.run_id as string); } catch (err) { log.error({ err: (err as Error).message }, \"webhook inline chain error\"); }\n      }\n      jsonResponse(res, result.status, result.body, corsHeaders);\n      return true;\n    }\n\n    // Fire event\n    if (pathname === \"/events\") {\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (!body.store_id || !body.event_type) { jsonResponse(res, 400, { error: \"store_id and event_type required\" }, corsHeaders); return true; }\n      if (body.idempotency_key) {\n        const { data: existing } = await supabase.from(\"workflow_events\").select(\"id\").eq(\"idempotency_key\", body.idempotency_key).limit(1);\n        if (existing && existing.length > 0) { jsonResponse(res, 200, { success: true, event_id: existing[0].id, deduplicated: true }, corsHeaders); return true; }\n      }\n      const { data: eventId, error: fireErr } = await supabase.rpc(\"fire_event\", { p_store_id: body.store_id, p_event_type: body.event_type, p_event_payload: body.payload || {}, p_source: body.source || \"api\" });\n      if (fireErr) jsonResponse(res, 500, { success: false, error: fireErr.message }, corsHeaders);\n      else jsonResponse(res, 200, { success: true, event_id: eventId }, corsHeaders);\n      return true;\n    }\n\n    // Workflow process (internal)\n    if (pathname === \"/workflows/process\") {\n      const token = getToken(req);\n      if (!FLY_INTERNAL_SECRET || (!safeCompare(token, FLY_INTERNAL_SECRET) && !safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) && !safeCompare(token, SERVICE_ROLE_JWT))) { jsonResponse(res, 401, { error: \"Unauthorized\" }, corsHeaders); return true; }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { rawBody = \"{}\"; }\n      let body: any;\n      try { body = JSON.parse(rawBody || \"{}\"); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      const result = await processWorkflowSteps(supabase, body.batch_size || 10);\n      jsonResponse(res, 200, { success: true, ...result }, corsHeaders);\n      return true;\n    }\n\n    // Start workflow run\n    if (pathname === \"/workflows/start\") {\n      const token = getToken(req);\n      const isInternal = isInternalAuth(token);\n      if (!isInternal && !token) { jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders); return true; }\n      const supabase = getServiceClient();\n      if (!isInternal) {\n        const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n        if (authError || !authUser) { jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders); return true; }\n      }\n      let rawBody: string;\n      try { rawBody = await readBody(req); } catch { jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders); return true; }\n      let body: any;\n      try { body = JSON.parse(rawBody); } catch { jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders); return true; }\n      if (body.workflow_id && body.store_id) {\n        const { data: wfOwner, error: wfOwnerErr } = await supabase.from(\"workflows\").select(\"id\").eq(\"id\", body.workflow_id).eq(\"store_id\", body.store_id).single();\n        if (wfOwnerErr || !wfOwner) { jsonResponse(res, 403, { error: \"Workflow does not belong to this store\" }, corsHeaders); return true; }\n      }\n      const { data, error } = await supabase.rpc(\"start_workflow_run\", { p_workflow_id: body.workflow_id, p_store_id: body.store_id, p_trigger_type: body.trigger_type || \"api\", p_trigger_payload: body.trigger_payload || {}, p_idempotency_key: body.idempotency_key || null });\n      if (error) { jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders); }\n      else {\n        if (data?.success && data.run_id && !data.deduplicated) {\n          try {\n            const { data: wf } = await supabase.from(\"workflows\").select(\"published_version_id\").eq(\"id\", body.workflow_id).single();\n            if (wf?.published_version_id) await supabase.from(\"workflow_runs\").update({ version_id: wf.published_version_id }).eq(\"id\", data.run_id);\n            await executeInlineChain(supabase, data.run_id);\n          } catch (err) { log.error({ err: (err as Error).message }, \"start-inline chain error\"); }\n        }\n        jsonResponse(res, data?.success ? 200 : 422, data, corsHeaders);\n      }\n      return true;\n    }\n\n    // If none of the above matched, return false — caller handles auth gate + mode dispatch\n    return false;\n  } catch (err) {\n    if (!res.headersSent) jsonResponse(res, 500, { error: sanitizeError(err) }, corsHeaders);\n    return true;\n  }\n}\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n"],"mappings":"AAAA;AACA;AACA;;AAKA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,aAAa,QAAQ,yBAAyB;AACvD,SAASC,gBAAgB,QAAQ,0BAA0B;AAI3D,SAASC,cAAc,QAAQ,6BAA6B;AAG5D,SACEC,oBAAoB,EAAEC,sBAAsB,EAAEC,kBAAkB,QAC3D,yBAAyB;AAKhC,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAAQ,qBAAqB;AACzE,SAASC,eAAe,QAAQ,wBAAwB;AAIxD,MAAMC,GAAG,GAAGX,YAAY,CAAC,oBAAoB,CAAC;AAE9C,MAAMY,iBAAiB,GAAGC,OAAO,CAACC,GAAG,CAACF,iBAAkB;AACxD,MAAMG,yBAAyB,GAAGF,OAAO,CAACC,GAAG,CAACC,yBAA0B;AACxE,MAAMC,gBAAgB,GAAGH,OAAO,CAACC,GAAG,CAACE,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGJ,OAAO,CAACC,GAAG,CAACG,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,yBAAyBA,CAC7CC,GAAyB,EAAEC,GAAwB,EACnDC,QAAgB,EAAEC,GAAQ,EAAEC,WAAmC,EAC7C;EAClB,IAAIJ,GAAG,CAACK,MAAM,KAAK,MAAM,IAAIL,GAAG,CAACK,MAAM,KAAK,QAAQ,IAAIL,GAAG,CAACK,MAAM,KAAK,KAAK,EAAE;IAC5EjB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;MAAEK,KAAK,EAAE;IAAqB,CAAC,EAAEF,WAAW,CAAC;IACpE,OAAO,IAAI;EACb;EAEA,IAAI;IACF;IACA,MAAMG,WAAW,GAAGL,QAAQ,CAACM,KAAK,CAAC,yCAAyC,CAAC;IAC7E,IAAID,WAAW,IAAIP,GAAG,CAACK,MAAM,KAAK,MAAM,EAAE;MACxC,MAAMI,MAAM,GAAGF,WAAW,CAAC,CAAC,CAAC;MAC7B,MAAMG,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEtB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC6B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE7B,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAI;QAAE,MAAMf,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM,CAAE;MACrC,MAAMqB,UAAU,GAAG,MAAMrC,cAAc,CAAC8B,QAAQ,EAAEL,MAAM,CAAC;MACzD,IAAI,CAACY,UAAU,EAAE;QAAEjC,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA4C,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC7H,IAAIkB,cAAyB;MAC7B,IAAI;QAAEA,cAAc,GAAGC,IAAI,CAACC,KAAK,CAACH,UAAU,CAACI,QAAQ,CAAC;MAAE,CAAC,CAAC,MAAM;QAAErC,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAgC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAChKhB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAEC,eAAe,EAAEN,UAAU,CAACM,eAAe;QAAEC,IAAI,EAAEP,UAAU,CAACO,IAAI;QAAEH,QAAQ,EAAEH,cAAc;QAAEO,WAAW,EAAER,UAAU,CAACQ,WAAW;QAAEC,WAAW,EAAET,UAAU,CAACS,WAAW;QAAEC,UAAU,EAAEV,UAAU,CAACU,UAAU;QAAEC,eAAe,EAAEX,UAAU,CAACY;MAAW,CAAC,EAAE7B,WAAW,CAAC;MACzS,OAAO,IAAI;IACb;;IAEA;IACA,MAAM8B,aAAa,GAAGhC,QAAQ,CAACM,KAAK,CAAC,sCAAsC,CAAC;IAC5E,IAAI0B,aAAa,EAAE;MACjB,MAAMC,UAAU,GAAGD,aAAa,CAAC,CAAC,CAAC;MACnC,MAAMxB,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEtB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAIqD,MAAqB,GAAG,IAAI;MAChC,IAAI,CAACxB,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE7B,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;QACvHgC,MAAM,GAAGnB,QAAQ,CAACoB,EAAE;MACtB;MACA,IAAIC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzH,IAAI,CAACmC,IAAI,CAACC,MAAM,EAAE;QAAEpD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAsC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACxH,MAAM;QAAEW,IAAI,EAAE0B;MAAS,CAAC,GAAG,MAAM3B,QAAQ,CAAC4B,IAAI,CAAC,4BAA4B,CAAC,CAACC,MAAM,CAAC,kBAAkB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAET,UAAU,CAAC,CAACU,MAAM,CAAC,CAAC;MACrI,IAAI,CAACJ,QAAQ,EAAE;QAAErD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAqB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACpG,IAAI,CAACQ,UAAU,IAAIwB,MAAM,EAAE;QACzB,MAAM;UAAErB,IAAI,EAAE+B;QAAmB,CAAC,GAAG,MAAMhC,QAAQ,CAAC4B,IAAI,CAAC,eAAe,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,QAAQ,CAACM,QAAQ,CAAC,CAACH,EAAE,CAAC,SAAS,EAAER,MAAM,CAAC,CAACS,MAAM,CAAC,CAAC;QACvJ,IAAI,CAACC,kBAAkB,EAAE;UAAE1D,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA6C,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACxI;MACA,MAAM;QAAEW,IAAI,EAAEiC,MAAM;QAAE1C;MAAM,CAAC,GAAG,MAAMQ,QAAQ,CAACmC,GAAG,CAAC,qBAAqB,EAAE;QAAEC,aAAa,EAAEf,UAAU;QAAEgB,UAAU,EAAEV,QAAQ,CAACM,QAAQ;QAAEK,UAAU,EAAEb,IAAI,CAACC,MAAM;QAAEa,eAAe,EAAEd,IAAI,CAACe,aAAa,IAAI,CAAC,CAAC;QAAEC,cAAc,EAAEnB,MAAM,IAAIG,IAAI,CAACiB,YAAY,IAAI;MAAK,CAAC,CAAC;MAChQ,IAAIlD,KAAK,EAAE;QAAElB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEyB,OAAO,EAAE,KAAK;UAAEpB,KAAK,EAAEA,KAAK,CAACmD;QAAQ,CAAC,EAAErD,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzG,IAAI4C,MAAM,EAAEtB,OAAO,IAAIe,QAAQ,CAACiB,MAAM,EAAE;QAAE,IAAI;UAAE,MAAMvE,kBAAkB,CAAC2B,QAAQ,EAAE2B,QAAQ,CAACiB,MAAM,CAAC;QAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;UAAEnE,GAAG,CAACc,KAAK,CAAC;YAAEqD,GAAG,EAAGA,GAAG,CAAWF;UAAQ,CAAC,EAAE,oCAAoC,CAAC;QAAE;MAAE;MACzMrE,YAAY,CAACa,GAAG,EAAE+C,MAAM,EAAEtB,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEsB,MAAM,EAAE5C,WAAW,CAAC;MACnE,OAAO,IAAI;IACb;;IAEA;IACA,MAAMwD,cAAc,GAAG1D,QAAQ,CAACM,KAAK,CAAC,wCAAwC,CAAC;IAC/E,IAAIoD,cAAc,EAAE;MAClB,MAAMC,OAAO,GAAGD,cAAc,CAAC,CAAC,CAAC;MACjC,MAAME,SAAS,GAAGnD,QAAQ,CAACX,GAAG,CAAC;MAC/B,MAAMY,UAAU,GAAGC,cAAc,CAACiD,SAAS,CAAC;MAC5C,IAAI,CAAClD,UAAU,IAAI,CAACkD,SAAS,EAAE;QAAE1E,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACvH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAIuD,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,MAAM;QAAEW,IAAI,EAAEgD;MAAG,CAAC,GAAG,MAAMjD,QAAQ,CAAC4B,IAAI,CAAC,kBAAkB,CAAC,CAACC,MAAM,CAAC,uDAAuD,CAAC,CAACC,EAAE,CAAC,OAAO,EAAEiB,OAAO,CAAC,CAAChB,MAAM,CAAC,CAAC;MAC1J,IAAI,CAACkB,EAAE,EAAE;QAAE3E,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA4B,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACrG,IAAI2D,EAAE,CAACvB,MAAM,KAAK,WAAW,EAAE;QAAEpD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAA8B,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC7H,IAAI,IAAI4D,IAAI,CAACD,EAAE,CAACE,UAAU,CAAC,GAAG,IAAID,IAAI,CAAC,CAAC,EAAE;QAAE5E,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAoB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC9H,MAAMU,QAAQ,CAAC4B,IAAI,CAAC,kBAAkB,CAAC,CAACwB,MAAM,CAAC;QAAE1B,MAAM,EAAE,WAAW;QAAE2B,eAAe,EAAE5B,IAAI,CAACxB,IAAI,IAAI,CAAC,CAAC;QAAEqD,YAAY,EAAE,IAAIJ,IAAI,CAAC,CAAC,CAACK,WAAW,CAAC;MAAE,CAAC,CAAC,CAACzB,EAAE,CAAC,IAAI,EAAEmB,EAAE,CAAC1B,EAAE,CAAC;MACjK,MAAMvB,QAAQ,CAAC4B,IAAI,CAAC,oBAAoB,CAAC,CAACwB,MAAM,CAAC;QAAE1B,MAAM,EAAE,SAAS;QAAE8B,KAAK,EAAE;UAAEC,mBAAmB,EAAE,IAAI;UAAEC,cAAc,EAAEjC,IAAI,CAACxB,IAAI,IAAI,CAAC;QAAE;MAAE,CAAC,CAAC,CAAC6B,EAAE,CAAC,IAAI,EAAEmB,EAAE,CAACU,WAAW,CAAC,CAAC7B,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;MAC/L,IAAI;QAAE,MAAMzD,kBAAkB,CAAC2B,QAAQ,EAAEiD,EAAE,CAACL,MAAM,CAAC;MAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;QAAEnE,GAAG,CAACc,KAAK,CAAC;UAAEqD,GAAG,EAAGA,GAAG,CAAWF,OAAO;UAAEiB,KAAK,EAAEX,EAAE,CAACL;QAAO,CAAC,EAAE,qCAAqC,CAAC;MAAE;MAC1KtE,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAEgC,MAAM,EAAEK,EAAE,CAACL;MAAO,CAAC,EAAEtD,WAAW,CAAC;MACzE,OAAO,IAAI;IACb;;IAEA;IACA,MAAMuE,YAAY,GAAGzE,QAAQ,CAACM,KAAK,CAAC,gCAAgC,CAAC;IACrE,IAAImE,YAAY,EAAE;MAChB,MAAMC,UAAU,GAAG5E,GAAG,CAAC6E,OAAO,CAAC,iBAAiB,CAAC,EAAEC,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAIhF,GAAG,CAACiF,MAAM,CAACC,aAAa,IAAI,SAAS;MAC5H,IAAI3F,eAAe,CAACU,GAAG,EAAE2E,UAAU,EAAExE,WAAW,CAAC,EAAE,OAAO,IAAI;MAC9D,MAAM+E,IAAI,GAAGR,YAAY,CAAC,CAAC,CAAC;MAC5B,IAAIrC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,MAAM8F,OAA+B,GAAG,CAAC,CAAC;MAC1C,KAAK,MAAM,CAACO,CAAC,EAAEC,CAAC,CAAC,IAAIC,MAAM,CAACC,OAAO,CAACvF,GAAG,CAAC6E,OAAO,CAAC,EAAE;QAAE,IAAI,OAAOQ,CAAC,KAAK,QAAQ,EAAER,OAAO,CAACO,CAAC,CAAC,GAAGC,CAAC;MAAE;MAC/F,MAAMrC,MAAM,GAAG,MAAM9D,sBAAsB,CAAC4B,QAAQ,EAAEqE,IAAI,EAAE7C,OAAO,EAAEuC,OAAO,CAAC;MAC7E,IAAI7B,MAAM,CAACT,IAAI,CAACmB,MAAM,IAAIV,MAAM,CAACR,MAAM,KAAK,GAAG,EAAE;QAC/C,IAAI;UAAE,MAAMrD,kBAAkB,CAAC2B,QAAQ,EAAEkC,MAAM,CAACT,IAAI,CAACmB,MAAgB,CAAC;QAAE,CAAC,CAAC,OAAOC,GAAG,EAAE;UAAEnE,GAAG,CAACc,KAAK,CAAC;YAAEqD,GAAG,EAAGA,GAAG,CAAWF;UAAQ,CAAC,EAAE,4BAA4B,CAAC;QAAE;MACpK;MACArE,YAAY,CAACa,GAAG,EAAE+C,MAAM,CAACR,MAAM,EAAEQ,MAAM,CAACT,IAAI,EAAEnC,WAAW,CAAC;MAC1D,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,SAAS,EAAE;MAC1B,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEtB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC6B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE7B,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,IAAI,CAACmC,IAAI,CAACQ,QAAQ,IAAI,CAACR,IAAI,CAACiD,UAAU,EAAE;QAAEpG,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAmC,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAC3I,IAAImC,IAAI,CAACkD,eAAe,EAAE;QACxB,MAAM;UAAE1E,IAAI,EAAE2E;QAAS,CAAC,GAAG,MAAM5E,QAAQ,CAAC4B,IAAI,CAAC,iBAAiB,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,iBAAiB,EAAEL,IAAI,CAACkD,eAAe,CAAC,CAACE,KAAK,CAAC,CAAC,CAAC;QACnI,IAAID,QAAQ,IAAIA,QAAQ,CAACE,MAAM,GAAG,CAAC,EAAE;UAAExG,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEyB,OAAO,EAAE,IAAI;YAAEmE,QAAQ,EAAEH,QAAQ,CAAC,CAAC,CAAC,CAACrD,EAAE;YAAEyD,YAAY,EAAE;UAAK,CAAC,EAAE1F,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MAC5J;MACA,MAAM;QAAEW,IAAI,EAAEgF,OAAO;QAAEzF,KAAK,EAAE0F;MAAQ,CAAC,GAAG,MAAMlF,QAAQ,CAACmC,GAAG,CAAC,YAAY,EAAE;QAAEE,UAAU,EAAEZ,IAAI,CAACQ,QAAQ;QAAEkD,YAAY,EAAE1D,IAAI,CAACiD,UAAU;QAAEU,eAAe,EAAE3D,IAAI,CAAC4D,OAAO,IAAI,CAAC,CAAC;QAAEC,QAAQ,EAAE7D,IAAI,CAAC8D,MAAM,IAAI;MAAM,CAAC,CAAC;MAC7M,IAAIL,OAAO,EAAE5G,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,KAAK;QAAEpB,KAAK,EAAE0F,OAAO,CAACvC;MAAQ,CAAC,EAAErD,WAAW,CAAC,CAAC,KACxFhB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAEmE,QAAQ,EAAEE;MAAQ,CAAC,EAAE3F,WAAW,CAAC;MAC9E,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,oBAAoB,EAAE;MACrC,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,IAAI,CAACF,mBAAmB,IAAK,CAACR,WAAW,CAACoB,KAAK,EAAEZ,mBAAmB,CAAC,IAAI,CAACR,WAAW,CAACoB,KAAK,EAAEd,yBAAyB,CAAC,IAAI,CAACN,WAAW,CAACoB,KAAK,EAAEb,gBAAgB,CAAE,EAAE;QAAET,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MAClP,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEsC,OAAO,GAAG,IAAI;MAAE;MAC/D,IAAIC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,IAAI,IAAI,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACjI,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,MAAMiE,MAAM,GAAG,MAAM/D,oBAAoB,CAAC6B,QAAQ,EAAEyB,IAAI,CAAC+D,UAAU,IAAI,EAAE,CAAC;MAC1ElH,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;QAAEyB,OAAO,EAAE,IAAI;QAAE,GAAGsB;MAAO,CAAC,EAAE5C,WAAW,CAAC;MACjE,OAAO,IAAI;IACb;;IAEA;IACA,IAAIF,QAAQ,KAAK,kBAAkB,EAAE;MACnC,MAAMQ,KAAK,GAAGC,QAAQ,CAACX,GAAG,CAAC;MAC3B,MAAMY,UAAU,GAAGC,cAAc,CAACH,KAAK,CAAC;MACxC,IAAI,CAACE,UAAU,IAAI,CAACF,KAAK,EAAE;QAAEtB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAwB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACnH,MAAMU,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;MACnC,IAAI,CAAC6B,UAAU,EAAE;QACf,MAAM;UAAEG,IAAI,EAAE;YAAEC,IAAI,EAAEC;UAAS,CAAC;UAAEX,KAAK,EAAEY;QAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACV,KAAK,CAAC;QACzF,IAAIQ,SAAS,IAAI,CAACD,QAAQ,EAAE;UAAE7B,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAA2B,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACzH;MACA,IAAIkC,OAAe;MACnB,IAAI;QAAEA,OAAO,GAAG,MAAMjD,QAAQ,CAACW,GAAG,CAAC;MAAE,CAAC,CAAC,MAAM;QAAEZ,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAyB,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACtI,IAAImC,IAAS;MACb,IAAI;QAAEA,IAAI,GAAGhB,IAAI,CAACC,KAAK,CAACc,OAAO,CAAC;MAAE,CAAC,CAAC,MAAM;QAAElD,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEK,KAAK,EAAE;QAAe,CAAC,EAAEF,WAAW,CAAC;QAAE,OAAO,IAAI;MAAE;MACzH,IAAImC,IAAI,CAACgE,WAAW,IAAIhE,IAAI,CAACQ,QAAQ,EAAE;QACrC,MAAM;UAAEhC,IAAI,EAAEyF,OAAO;UAAElG,KAAK,EAAEmG;QAAW,CAAC,GAAG,MAAM3F,QAAQ,CAAC4B,IAAI,CAAC,WAAW,CAAC,CAACC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEL,IAAI,CAACgE,WAAW,CAAC,CAAC3D,EAAE,CAAC,UAAU,EAAEL,IAAI,CAACQ,QAAQ,CAAC,CAACF,MAAM,CAAC,CAAC;QAC5J,IAAI4D,UAAU,IAAI,CAACD,OAAO,EAAE;UAAEpH,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;YAAEK,KAAK,EAAE;UAAyC,CAAC,EAAEF,WAAW,CAAC;UAAE,OAAO,IAAI;QAAE;MACvI;MACA,MAAM;QAAEW,IAAI;QAAET;MAAM,CAAC,GAAG,MAAMQ,QAAQ,CAACmC,GAAG,CAAC,oBAAoB,EAAE;QAAEyD,aAAa,EAAEnE,IAAI,CAACgE,WAAW;QAAEpD,UAAU,EAAEZ,IAAI,CAACQ,QAAQ;QAAE4D,cAAc,EAAEpE,IAAI,CAACqE,YAAY,IAAI,KAAK;QAAEC,iBAAiB,EAAEtE,IAAI,CAACuE,eAAe,IAAI,CAAC,CAAC;QAAEC,iBAAiB,EAAExE,IAAI,CAACkD,eAAe,IAAI;MAAK,CAAC,CAAC;MAC5Q,IAAInF,KAAK,EAAE;QAAElB,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;UAAEyB,OAAO,EAAE,KAAK;UAAEpB,KAAK,EAAEA,KAAK,CAACmD;QAAQ,CAAC,EAAErD,WAAW,CAAC;MAAE,CAAC,MACxF;QACH,IAAIW,IAAI,EAAEW,OAAO,IAAIX,IAAI,CAAC2C,MAAM,IAAI,CAAC3C,IAAI,CAAC+E,YAAY,EAAE;UACtD,IAAI;YACF,MAAM;cAAE/E,IAAI,EAAEiG;YAAG,CAAC,GAAG,MAAMlG,QAAQ,CAAC4B,IAAI,CAAC,WAAW,CAAC,CAACC,MAAM,CAAC,sBAAsB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEL,IAAI,CAACgE,WAAW,CAAC,CAAC1D,MAAM,CAAC,CAAC;YACxH,IAAImE,EAAE,EAAEC,oBAAoB,EAAE,MAAMnG,QAAQ,CAAC4B,IAAI,CAAC,eAAe,CAAC,CAACwB,MAAM,CAAC;cAAEgD,UAAU,EAAEF,EAAE,CAACC;YAAqB,CAAC,CAAC,CAACrE,EAAE,CAAC,IAAI,EAAE7B,IAAI,CAAC2C,MAAM,CAAC;YACxI,MAAMvE,kBAAkB,CAAC2B,QAAQ,EAAEC,IAAI,CAAC2C,MAAM,CAAC;UACjD,CAAC,CAAC,OAAOC,GAAG,EAAE;YAAEnE,GAAG,CAACc,KAAK,CAAC;cAAEqD,GAAG,EAAGA,GAAG,CAAWF;YAAQ,CAAC,EAAE,0BAA0B,CAAC;UAAE;QAC1F;QACArE,YAAY,CAACa,GAAG,EAAEc,IAAI,EAAEW,OAAO,GAAG,GAAG,GAAG,GAAG,EAAEX,IAAI,EAAEX,WAAW,CAAC;MACjE;MACA,OAAO,IAAI;IACb;;IAEA;IACA,OAAO,KAAK;EACd,CAAC,CAAC,OAAOuD,GAAG,EAAE;IACZ,IAAI,CAAC1D,GAAG,CAACkH,WAAW,EAAE/H,YAAY,CAACa,GAAG,EAAE,GAAG,EAAE;MAAEK,KAAK,EAAExB,aAAa,CAAC6E,GAAG;IAAE,CAAC,EAAEvD,WAAW,CAAC;IACxF,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;;AAEA,SAASO,QAAQA,CAACX,GAAyB,EAAU;EACnD,MAAMoH,UAAU,GAAGpH,GAAG,CAAC6E,OAAO,CAACwC,aAAa;EAC5C,OAAOD,UAAU,EAAEE,UAAU,CAAC,SAAS,CAAC,GAAGF,UAAU,CAACG,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAAS1G,cAAcA,CAACH,KAAa,EAAW;EAC9C,OAAOpB,WAAW,CAACoB,KAAK,EAAEZ,mBAAmB,CAAC,IAAIR,WAAW,CAACoB,KAAK,EAAEd,yBAAyB,CAAC,IAAIN,WAAW,CAACoB,KAAK,EAAEb,gBAAgB,CAAC;AACzI","ignoreList":[]}

package/dist/server/server-routes-events.d.ts

@@ -0,0 +1,4 @@
+import http from "node:http";
+import { type ServerContext } from "./server-helpers.js";
+export declare function handleFireEvent(req: http.IncomingMessage, res: http.ServerResponse, ctx: ServerContext): Promise<boolean>;
+export declare function handleWebhookRoute(req: http.IncomingMessage, res: http.ServerResponse, ctx: ServerContext): Promise<boolean>;