whale-code 6.5.6 → 6.5.7

package/dist/server/server-routes-webchat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-routes-webchat.js","names":["randomUUID","createLogger","getServiceClient","checkPlanLimits","incrementUsage","jsonResponse","readBody","sendIpRateLimit","log","webchatAgentInvoker","setWebchatAgentInvoker","invoker","handleWebchatMessage","req","res","ctx","pathname","corsHeaders","webchatCors","webchatMsgMatch","match","method","clientIp","headers","toString","split","trim","socket","remoteAddress","rawBody","error","channelId","wcBody","JSON","parse","content","length","supabase","data","channel","from","select","eq","single","planCheck","store_id","allowed","reason","senderId","sender_id","conversationId","conversation_id","thirtyMinAgo","Date","now","toISOString","recent","gt","not","order","ascending","limit","message","msgErr","insert","channel_id","direction","sender_name","content_type","metadata","source","ip","widget_version","agent_id","messages_in","catch","rpc","p_channel_id","agentResponse","result","success","response","outMsg","auto_response","messages_out","agent_invocations","err","agent_response","handleWebchatHistory","url","webchatHistoryMatch","params","searchParams","get","reqConvId","wcChannel","query","test","in","messages","histErr","handleWebchatWidget","fs","path","possiblePaths","join","import","meta","dirname","__dirname","process","cwd","widgetJs","p","readFileSync","writeHead","end"],"sources":["../../src/server/server-routes-webchat.ts"],"sourcesContent":["// server/server-routes-webchat.ts — Webchat route handlers\n// Anonymous access for embedded chat widgets\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { randomUUID } from \"node:crypto\";\nimport type { SupabaseClient } from \"@supabase/supabase-js\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { checkPlanLimits, incrementUsage } from \"./handlers/billing.js\";\nimport { jsonResponse, readBody, type ServerContext } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\nimport type { SenderContext } from \"./handlers/nodes.js\";\n\nconst log = createLogger(\"server-routes-webchat\");\n\n// Webchat agent invoker — set later to avoid circular deps\nlet webchatAgentInvoker: ((\n  supabase: SupabaseClient,\n  agentId: string,\n  message: string,\n  storeId: string,\n  conversationId: string,\n  senderContext?: SenderContext,\n) => Promise<{ success: boolean; response?: string; error?: string }>) | null = null;\n\nexport function setWebchatAgentInvoker(invoker: typeof webchatAgentInvoker): void {\n  webchatAgentInvoker = invoker;\n}\n\n// ============================================================================\n// POST /webchat/channels/:id/messages — Send message (+ agent auto-reply)\n// ============================================================================\n\nexport async function handleWebchatMessage(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  // Webchat CORS: allow any origin (widget is embedded on customer sites)\n  const webchatCors = { ...corsHeaders, \"Access-Control-Allow-Origin\": \"*\" };\n\n  const webchatMsgMatch = pathname.match(/^\\/webchat\\/channels\\/([a-f0-9-]+)\\/messages$/);\n  if (!(webchatMsgMatch && req.method === \"POST\")) return false;\n\n  const clientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n  if (sendIpRateLimit(res, clientIp, webchatCors)) return true;\n\n  let rawBody: string;\n  try { rawBody = await readBody(req); } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, webchatCors);\n    return true;\n  }\n\n  const channelId = webchatMsgMatch[1];\n  let wcBody: any;\n  try { wcBody = JSON.parse(rawBody); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, webchatCors);\n    return true;\n  }\n\n  if (!wcBody.content || typeof wcBody.content !== \"string\") {\n    jsonResponse(res, 400, { error: \"content (string) is required\" }, webchatCors);\n    return true;\n  }\n  if (wcBody.content.length > 5000) {\n    jsonResponse(res, 400, { error: \"Message too long (max 5000 characters)\" }, webchatCors);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n\n  // Verify channel exists and is a webchat channel\n  const { data: channel } = await supabase\n    .from(\"channels\")\n    .select(\"id, store_id, node_id, agent_id, type, config\")\n    .eq(\"id\", channelId)\n    .eq(\"type\", \"webchat\")\n    .single();\n  if (!channel) {\n    jsonResponse(res, 404, { error: \"Webchat channel not found\" }, webchatCors);\n    return true;\n  }\n\n  // Rate limit per store (best-effort)\n  try {\n    const planCheck = await checkPlanLimits(supabase, channel.store_id, \"message\");\n    if (!planCheck.allowed) {\n      jsonResponse(res, 429, { error: planCheck.reason || \"Plan limit reached\" }, webchatCors);\n      return true;\n    }\n  } catch { /* billing tables may not exist yet */ }\n\n  const senderId = (wcBody.sender_id as string) || \"anonymous\";\n\n  // Resolve conversation: reuse if sender had activity < 30 min ago, else new UUID\n  let conversationId: string = (wcBody.conversation_id as string) || \"\";\n  if (!conversationId) {\n    const thirtyMinAgo = new Date(Date.now() - 30 * 60 * 1000).toISOString();\n    const { data: recent } = await supabase\n      .from(\"channel_messages\")\n      .select(\"conversation_id\")\n      .eq(\"channel_id\", channelId)\n      .eq(\"sender_id\", senderId)\n      .gt(\"created_at\", thirtyMinAgo)\n      .not(\"conversation_id\", \"is\", null)\n      .order(\"created_at\", { ascending: false })\n      .limit(1);\n    conversationId = (recent?.length && recent[0].conversation_id) || randomUUID();\n  }\n\n  // Insert inbound message\n  const { data: message, error: msgErr } = await supabase\n    .from(\"channel_messages\")\n    .insert({\n      store_id: channel.store_id,\n      channel_id: channelId,\n      direction: \"inbound\",\n      sender_id: senderId,\n      sender_name: wcBody.sender_name || \"Visitor\",\n      content: wcBody.content,\n      content_type: \"text\",\n      metadata: { source: \"webchat\", ip: clientIp, widget_version: \"1.0.0\" },\n      agent_id: channel.agent_id,\n      conversation_id: conversationId,\n    })\n    .select(\"id, direction, content, conversation_id, created_at\")\n    .single();\n\n  if (msgErr) {\n    jsonResponse(res, 500, { error: msgErr.message }, webchatCors);\n    return true;\n  }\n\n  // Track usage + channel stats (best-effort)\n  incrementUsage(supabase, channel.store_id, { messages_in: 1 }).catch(() => {});\n  try { await supabase.rpc(\"increment_channel_stats\", { p_channel_id: channelId }); } catch { /* ok */ }\n\n  // Auto-invoke agent if assigned\n  let agentResponse: any = null;\n  if (channel.agent_id && webchatAgentInvoker) {\n    try {\n      const result = await webchatAgentInvoker(supabase, channel.agent_id, wcBody.content, channel.store_id, conversationId);\n      if (result.success && result.response) {\n        const { data: outMsg } = await supabase\n          .from(\"channel_messages\")\n          .insert({\n            store_id: channel.store_id,\n            channel_id: channelId,\n            direction: \"outbound\",\n            sender_id: \"agent\",\n            sender_name: \"AI Agent\",\n            content: result.response,\n            content_type: \"text\",\n            metadata: { agent_id: channel.agent_id, auto_response: true, source: \"webchat\" },\n            agent_id: channel.agent_id,\n            conversation_id: conversationId,\n          })\n          .select(\"id, direction, content, conversation_id, created_at\")\n          .single();\n        agentResponse = outMsg;\n        incrementUsage(supabase, channel.store_id, { messages_out: 1, agent_invocations: 1 }).catch(() => {});\n      }\n    } catch (err) {\n      log.error({ err: (err as Error).message }, \"webchat agent error\");\n    }\n  }\n\n  jsonResponse(res, 201, { success: true, message, agent_response: agentResponse, conversation_id: conversationId }, webchatCors);\n  return true;\n}\n\n// ============================================================================\n// GET /webchat/channels/:id/history — Load conversation history for widget\n// ============================================================================\n\nexport async function handleWebchatHistory(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, url, corsHeaders } = ctx;\n\n  const webchatCors = { ...corsHeaders, \"Access-Control-Allow-Origin\": \"*\" };\n\n  const webchatHistoryMatch = pathname.match(/^\\/webchat\\/channels\\/([a-f0-9-]+)\\/history$/);\n  if (!(webchatHistoryMatch && req.method === \"GET\")) return false;\n\n  const clientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n  if (sendIpRateLimit(res, clientIp, webchatCors)) return true;\n\n  const channelId = webchatHistoryMatch[1];\n  const params = url.searchParams;\n  const senderId = params.get(\"sender_id\") || \"\";\n  const reqConvId = params.get(\"conversation_id\") || \"\";\n\n  if (!senderId) {\n    jsonResponse(res, 400, { error: \"sender_id query parameter required\" }, webchatCors);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n\n  // Verify channel is webchat type\n  const { data: wcChannel } = await supabase\n    .from(\"channels\")\n    .select(\"id, type\")\n    .eq(\"id\", channelId)\n    .eq(\"type\", \"webchat\")\n    .single();\n  if (!wcChannel) {\n    jsonResponse(res, 404, { error: \"Webchat channel not found\" }, webchatCors);\n    return true;\n  }\n\n  // Get messages — by conversation_id if available, or by sender\n  // P0 FIX: Always filter by sender_id to prevent cross-sender data leak\n  let query = supabase\n    .from(\"channel_messages\")\n    .select(\"id, direction, sender_id, sender_name, content, content_type, created_at\")\n    .eq(\"channel_id\", channelId);\n\n  // P0 FIX: Validate senderId against strict pattern to prevent PostgREST filter injection\n  // Only allow alphanumeric characters, hyphens, and underscores (blocks .eq., .neq., dots, etc.)\n  if (!/^[a-zA-Z0-9_-]+$/.test(senderId)) {\n    jsonResponse(res, 400, { error: \"Invalid sender_id format\" }, webchatCors);\n    return true;\n  }\n  if (reqConvId) {\n    // P0 FIX: Use parameterized .in() filter instead of string interpolation in .or()\n    query = query.eq(\"conversation_id\", reqConvId)\n      .in(\"sender_id\", [senderId, \"agent\"]);\n  } else {\n    query = query.in(\"sender_id\", [senderId, \"agent\"]);\n  }\n\n  const { data: messages, error: histErr } = await query\n    .order(\"created_at\", { ascending: true })\n    .limit(50);\n\n  if (histErr) {\n    jsonResponse(res, 500, { error: histErr.message }, webchatCors);\n    return true;\n  }\n\n  jsonResponse(res, 200, { success: true, messages: messages || [] }, webchatCors);\n  return true;\n}\n\n// ============================================================================\n// GET /webchat/widget.js — Serve compiled widget JavaScript\n// ============================================================================\n\nexport async function handleWebchatWidget(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  if (!(pathname === \"/webchat/widget.js\" && req.method === \"GET\")) return false;\n\n  const webchatCors = { ...corsHeaders, \"Access-Control-Allow-Origin\": \"*\" };\n\n  const fs = await import(\"node:fs\");\n  const path = await import(\"node:path\");\n  // Try multiple possible locations for the built widget file\n  const possiblePaths = [\n    path.join(import.meta.dirname || __dirname, \"../../dist/webchat/widget.js\"),\n    path.join(import.meta.dirname || __dirname, \"../../../dist/webchat/widget.js\"),\n    path.join(process.cwd(), \"dist/webchat/widget.js\"),\n  ];\n\n  let widgetJs: string | null = null;\n  for (const p of possiblePaths) {\n    try {\n      widgetJs = fs.readFileSync(p, \"utf-8\");\n      break;\n    } catch { /* try next */ }\n  }\n\n  if (widgetJs) {\n    res.writeHead(200, {\n      \"Content-Type\": \"application/javascript\",\n      \"Cache-Control\": \"public, max-age=3600\",\n      ...webchatCors,\n    });\n    res.end(widgetJs);\n  } else {\n    res.writeHead(200, {\n      \"Content-Type\": \"application/javascript\",\n      ...webchatCors,\n    });\n    res.end('console.warn(\"[WhaleChat] Widget JS not built. Run: npx esbuild src/webchat/widget.ts --bundle --minify --outfile=dist/webchat/widget.js\");');\n  }\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,UAAU,QAAQ,aAAa;AAExC,SAASC,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,eAAe,EAAEC,cAAc,QAAQ,uBAAuB;AACvE,SAASC,YAAY,EAAEC,QAAQ,QAA4B,qBAAqB;AAChF,SAASC,eAAe,QAAQ,wBAAwB;AAGxD,MAAMC,GAAG,GAAGP,YAAY,CAAC,uBAAuB,CAAC;;AAEjD;AACA,IAAIQ,mBAOyE,GAAG,IAAI;AAEpF,OAAO,SAASC,sBAAsBA,CAACC,OAAmC,EAAQ;EAChFF,mBAAmB,GAAGE,OAAO;AAC/B;;AAEA;AACA;AACA;;AAEA,OAAO,eAAeC,oBAAoBA,CACxCC,GAAyB,EACzBC,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;;EAErC;EACA,MAAMG,WAAW,GAAG;IAAE,GAAGD,WAAW;IAAE,6BAA6B,EAAE;EAAI,CAAC;EAE1E,MAAME,eAAe,GAAGH,QAAQ,CAACI,KAAK,CAAC,+CAA+C,CAAC;EACvF,IAAI,EAAED,eAAe,IAAIN,GAAG,CAACQ,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAE7D,MAAMC,QAAQ,GAAGT,GAAG,CAACU,OAAO,CAAC,iBAAiB,CAAC,EAAEC,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAIb,GAAG,CAACc,MAAM,CAACC,aAAa,IAAI,SAAS;EAC1H,IAAIrB,eAAe,CAACO,GAAG,EAAEQ,QAAQ,EAAEJ,WAAW,CAAC,EAAE,OAAO,IAAI;EAE5D,IAAIW,OAAe;EACnB,IAAI;IAAEA,OAAO,GAAG,MAAMvB,QAAQ,CAACO,GAAG,CAAC;EAAE,CAAC,CAAC,MAAM;IAC3CR,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAE;IAAyB,CAAC,EAAEZ,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,MAAMa,SAAS,GAAGZ,eAAe,CAAC,CAAC,CAAC;EACpC,IAAIa,MAAW;EACf,IAAI;IAAEA,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACL,OAAO,CAAC;EAAE,CAAC,CAAC,MAAM;IAC1CxB,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAE;IAAe,CAAC,EAAEZ,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EAEA,IAAI,CAACc,MAAM,CAACG,OAAO,IAAI,OAAOH,MAAM,CAACG,OAAO,KAAK,QAAQ,EAAE;IACzD9B,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAE;IAA+B,CAAC,EAAEZ,WAAW,CAAC;IAC9E,OAAO,IAAI;EACb;EACA,IAAIc,MAAM,CAACG,OAAO,CAACC,MAAM,GAAG,IAAI,EAAE;IAChC/B,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAE;IAAyC,CAAC,EAAEZ,WAAW,CAAC;IACxF,OAAO,IAAI;EACb;EAEA,MAAMmB,QAAQ,GAAGnC,gBAAgB,CAAC,CAAC;;EAEnC;EACA,MAAM;IAAEoC,IAAI,EAAEC;EAAQ,CAAC,GAAG,MAAMF,QAAQ,CACrCG,IAAI,CAAC,UAAU,CAAC,CAChBC,MAAM,CAAC,+CAA+C,CAAC,CACvDC,EAAE,CAAC,IAAI,EAAEX,SAAS,CAAC,CACnBW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CACrBC,MAAM,CAAC,CAAC;EACX,IAAI,CAACJ,OAAO,EAAE;IACZlC,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAE;IAA4B,CAAC,EAAEZ,WAAW,CAAC;IAC3E,OAAO,IAAI;EACb;;EAEA;EACA,IAAI;IACF,MAAM0B,SAAS,GAAG,MAAMzC,eAAe,CAACkC,QAAQ,EAAEE,OAAO,CAACM,QAAQ,EAAE,SAAS,CAAC;IAC9E,IAAI,CAACD,SAAS,CAACE,OAAO,EAAE;MACtBzC,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;QAAEgB,KAAK,EAAEc,SAAS,CAACG,MAAM,IAAI;MAAqB,CAAC,EAAE7B,WAAW,CAAC;MACxF,OAAO,IAAI;IACb;EACF,CAAC,CAAC,MAAM,CAAE;EAEV,MAAM8B,QAAQ,GAAIhB,MAAM,CAACiB,SAAS,IAAe,WAAW;;EAE5D;EACA,IAAIC,cAAsB,GAAIlB,MAAM,CAACmB,eAAe,IAAe,EAAE;EACrE,IAAI,CAACD,cAAc,EAAE;IACnB,MAAME,YAAY,GAAG,IAAIC,IAAI,CAACA,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAACC,WAAW,CAAC,CAAC;IACxE,MAAM;MAAEjB,IAAI,EAAEkB;IAAO,CAAC,GAAG,MAAMnB,QAAQ,CACpCG,IAAI,CAAC,kBAAkB,CAAC,CACxBC,MAAM,CAAC,iBAAiB,CAAC,CACzBC,EAAE,CAAC,YAAY,EAAEX,SAAS,CAAC,CAC3BW,EAAE,CAAC,WAAW,EAAEM,QAAQ,CAAC,CACzBS,EAAE,CAAC,YAAY,EAAEL,YAAY,CAAC,CAC9BM,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,CAClCC,KAAK,CAAC,YAAY,EAAE;MAAEC,SAAS,EAAE;IAAM,CAAC,CAAC,CACzCC,KAAK,CAAC,CAAC,CAAC;IACXX,cAAc,GAAIM,MAAM,EAAEpB,MAAM,IAAIoB,MAAM,CAAC,CAAC,CAAC,CAACL,eAAe,IAAKnD,UAAU,CAAC,CAAC;EAChF;;EAEA;EACA,MAAM;IAAEsC,IAAI,EAAEwB,OAAO;IAAEhC,KAAK,EAAEiC;EAAO,CAAC,GAAG,MAAM1B,QAAQ,CACpDG,IAAI,CAAC,kBAAkB,CAAC,CACxBwB,MAAM,CAAC;IACNnB,QAAQ,EAAEN,OAAO,CAACM,QAAQ;IAC1BoB,UAAU,EAAElC,SAAS;IACrBmC,SAAS,EAAE,SAAS;IACpBjB,SAAS,EAAED,QAAQ;IACnBmB,WAAW,EAAEnC,MAAM,CAACmC,WAAW,IAAI,SAAS;IAC5ChC,OAAO,EAAEH,MAAM,CAACG,OAAO;IACvBiC,YAAY,EAAE,MAAM;IACpBC,QAAQ,EAAE;MAAEC,MAAM,EAAE,SAAS;MAAEC,EAAE,EAAEjD,QAAQ;MAAEkD,cAAc,EAAE;IAAQ,CAAC;IACtEC,QAAQ,EAAElC,OAAO,CAACkC,QAAQ;IAC1BtB,eAAe,EAAED;EACnB,CAAC,CAAC,CACDT,MAAM,CAAC,qDAAqD,CAAC,CAC7DE,MAAM,CAAC,CAAC;EAEX,IAAIoB,MAAM,EAAE;IACV1D,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAEiC,MAAM,CAACD;IAAQ,CAAC,EAAE5C,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;;EAEA;EACAd,cAAc,CAACiC,QAAQ,EAAEE,OAAO,CAACM,QAAQ,EAAE;IAAE6B,WAAW,EAAE;EAAE,CAAC,CAAC,CAACC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;EAC9E,IAAI;IAAE,MAAMtC,QAAQ,CAACuC,GAAG,CAAC,yBAAyB,EAAE;MAAEC,YAAY,EAAE9C;IAAU,CAAC,CAAC;EAAE,CAAC,CAAC,MAAM,CAAE;;EAE5F;EACA,IAAI+C,aAAkB,GAAG,IAAI;EAC7B,IAAIvC,OAAO,CAACkC,QAAQ,IAAIhE,mBAAmB,EAAE;IAC3C,IAAI;MACF,MAAMsE,MAAM,GAAG,MAAMtE,mBAAmB,CAAC4B,QAAQ,EAAEE,OAAO,CAACkC,QAAQ,EAAEzC,MAAM,CAACG,OAAO,EAAEI,OAAO,CAACM,QAAQ,EAAEK,cAAc,CAAC;MACtH,IAAI6B,MAAM,CAACC,OAAO,IAAID,MAAM,CAACE,QAAQ,EAAE;QACrC,MAAM;UAAE3C,IAAI,EAAE4C;QAAO,CAAC,GAAG,MAAM7C,QAAQ,CACpCG,IAAI,CAAC,kBAAkB,CAAC,CACxBwB,MAAM,CAAC;UACNnB,QAAQ,EAAEN,OAAO,CAACM,QAAQ;UAC1BoB,UAAU,EAAElC,SAAS;UACrBmC,SAAS,EAAE,UAAU;UACrBjB,SAAS,EAAE,OAAO;UAClBkB,WAAW,EAAE,UAAU;UACvBhC,OAAO,EAAE4C,MAAM,CAACE,QAAQ;UACxBb,YAAY,EAAE,MAAM;UACpBC,QAAQ,EAAE;YAAEI,QAAQ,EAAElC,OAAO,CAACkC,QAAQ;YAAEU,aAAa,EAAE,IAAI;YAAEb,MAAM,EAAE;UAAU,CAAC;UAChFG,QAAQ,EAAElC,OAAO,CAACkC,QAAQ;UAC1BtB,eAAe,EAAED;QACnB,CAAC,CAAC,CACDT,MAAM,CAAC,qDAAqD,CAAC,CAC7DE,MAAM,CAAC,CAAC;QACXmC,aAAa,GAAGI,MAAM;QACtB9E,cAAc,CAACiC,QAAQ,EAAEE,OAAO,CAACM,QAAQ,EAAE;UAAEuC,YAAY,EAAE,CAAC;UAAEC,iBAAiB,EAAE;QAAE,CAAC,CAAC,CAACV,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;MACvG;IACF,CAAC,CAAC,OAAOW,GAAG,EAAE;MACZ9E,GAAG,CAACsB,KAAK,CAAC;QAAEwD,GAAG,EAAGA,GAAG,CAAWxB;MAAQ,CAAC,EAAE,qBAAqB,CAAC;IACnE;EACF;EAEAzD,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;IAAEkE,OAAO,EAAE,IAAI;IAAElB,OAAO;IAAEyB,cAAc,EAAET,aAAa;IAAE3B,eAAe,EAAED;EAAe,CAAC,EAAEhC,WAAW,CAAC;EAC/H,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAesE,oBAAoBA,CACxC3E,GAAyB,EACzBC,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEyE,GAAG;IAAExE;EAAY,CAAC,GAAGF,GAAG;EAE1C,MAAMG,WAAW,GAAG;IAAE,GAAGD,WAAW;IAAE,6BAA6B,EAAE;EAAI,CAAC;EAE1E,MAAMyE,mBAAmB,GAAG1E,QAAQ,CAACI,KAAK,CAAC,8CAA8C,CAAC;EAC1F,IAAI,EAAEsE,mBAAmB,IAAI7E,GAAG,CAACQ,MAAM,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;EAEhE,MAAMC,QAAQ,GAAGT,GAAG,CAACU,OAAO,CAAC,iBAAiB,CAAC,EAAEC,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAIb,GAAG,CAACc,MAAM,CAACC,aAAa,IAAI,SAAS;EAC1H,IAAIrB,eAAe,CAACO,GAAG,EAAEQ,QAAQ,EAAEJ,WAAW,CAAC,EAAE,OAAO,IAAI;EAE5D,MAAMa,SAAS,GAAG2D,mBAAmB,CAAC,CAAC,CAAC;EACxC,MAAMC,MAAM,GAAGF,GAAG,CAACG,YAAY;EAC/B,MAAM5C,QAAQ,GAAG2C,MAAM,CAACE,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;EAC9C,MAAMC,SAAS,GAAGH,MAAM,CAACE,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE;EAErD,IAAI,CAAC7C,QAAQ,EAAE;IACb3C,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAE;IAAqC,CAAC,EAAEZ,WAAW,CAAC;IACpF,OAAO,IAAI;EACb;EAEA,MAAMmB,QAAQ,GAAGnC,gBAAgB,CAAC,CAAC;;EAEnC;EACA,MAAM;IAAEoC,IAAI,EAAEyD;EAAU,CAAC,GAAG,MAAM1D,QAAQ,CACvCG,IAAI,CAAC,UAAU,CAAC,CAChBC,MAAM,CAAC,UAAU,CAAC,CAClBC,EAAE,CAAC,IAAI,EAAEX,SAAS,CAAC,CACnBW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,CACrBC,MAAM,CAAC,CAAC;EACX,IAAI,CAACoD,SAAS,EAAE;IACd1F,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAE;IAA4B,CAAC,EAAEZ,WAAW,CAAC;IAC3E,OAAO,IAAI;EACb;;EAEA;EACA;EACA,IAAI8E,KAAK,GAAG3D,QAAQ,CACjBG,IAAI,CAAC,kBAAkB,CAAC,CACxBC,MAAM,CAAC,0EAA0E,CAAC,CAClFC,EAAE,CAAC,YAAY,EAAEX,SAAS,CAAC;;EAE9B;EACA;EACA,IAAI,CAAC,kBAAkB,CAACkE,IAAI,CAACjD,QAAQ,CAAC,EAAE;IACtC3C,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAE;IAA2B,CAAC,EAAEZ,WAAW,CAAC;IAC1E,OAAO,IAAI;EACb;EACA,IAAI4E,SAAS,EAAE;IACb;IACAE,KAAK,GAAGA,KAAK,CAACtD,EAAE,CAAC,iBAAiB,EAAEoD,SAAS,CAAC,CAC3CI,EAAE,CAAC,WAAW,EAAE,CAAClD,QAAQ,EAAE,OAAO,CAAC,CAAC;EACzC,CAAC,MAAM;IACLgD,KAAK,GAAGA,KAAK,CAACE,EAAE,CAAC,WAAW,EAAE,CAAClD,QAAQ,EAAE,OAAO,CAAC,CAAC;EACpD;EAEA,MAAM;IAAEV,IAAI,EAAE6D,QAAQ;IAAErE,KAAK,EAAEsE;EAAQ,CAAC,GAAG,MAAMJ,KAAK,CACnDrC,KAAK,CAAC,YAAY,EAAE;IAAEC,SAAS,EAAE;EAAK,CAAC,CAAC,CACxCC,KAAK,CAAC,EAAE,CAAC;EAEZ,IAAIuC,OAAO,EAAE;IACX/F,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;MAAEgB,KAAK,EAAEsE,OAAO,CAACtC;IAAQ,CAAC,EAAE5C,WAAW,CAAC;IAC/D,OAAO,IAAI;EACb;EAEAb,YAAY,CAACS,GAAG,EAAE,GAAG,EAAE;IAAEkE,OAAO,EAAE,IAAI;IAAEmB,QAAQ,EAAEA,QAAQ,IAAI;EAAG,CAAC,EAAEjF,WAAW,CAAC;EAChF,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAemF,mBAAmBA,CACvCxF,GAAyB,EACzBC,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,IAAI,EAAEC,QAAQ,KAAK,oBAAoB,IAAIH,GAAG,CAACQ,MAAM,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;EAE9E,MAAMH,WAAW,GAAG;IAAE,GAAGD,WAAW;IAAE,6BAA6B,EAAE;EAAI,CAAC;EAE1E,MAAMqF,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC;EAClC,MAAMC,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;EACtC;EACA,MAAMC,aAAa,GAAG,CACpBD,IAAI,CAACE,IAAI,CAACC,MAAM,CAACC,IAAI,CAACC,OAAO,IAAIC,SAAS,EAAE,8BAA8B,CAAC,EAC3EN,IAAI,CAACE,IAAI,CAACC,MAAM,CAACC,IAAI,CAACC,OAAO,IAAIC,SAAS,EAAE,iCAAiC,CAAC,EAC9EN,IAAI,CAACE,IAAI,CAACK,OAAO,CAACC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CACnD;EAED,IAAIC,QAAuB,GAAG,IAAI;EAClC,KAAK,MAAMC,CAAC,IAAIT,aAAa,EAAE;IAC7B,IAAI;MACFQ,QAAQ,GAAGV,EAAE,CAACY,YAAY,CAACD,CAAC,EAAE,OAAO,CAAC;MACtC;IACF,CAAC,CAAC,MAAM,CAAE;EACZ;EAEA,IAAID,QAAQ,EAAE;IACZlG,GAAG,CAACqG,SAAS,CAAC,GAAG,EAAE;MACjB,cAAc,EAAE,wBAAwB;MACxC,eAAe,EAAE,sBAAsB;MACvC,GAAGjG;IACL,CAAC,CAAC;IACFJ,GAAG,CAACsG,GAAG,CAACJ,QAAQ,CAAC;EACnB,CAAC,MAAM;IACLlG,GAAG,CAACqG,SAAS,CAAC,GAAG,EAAE;MACjB,cAAc,EAAE,wBAAwB;MACxC,GAAGjG;IACL,CAAC,CAAC;IACFJ,GAAG,CAACsG,GAAG,CAAC,6IAA6I,CAAC;EACxJ;EACA,OAAO,IAAI;AACb","ignoreList":[]}

package/dist/server/server-routes-workflows.d.ts

@@ -0,0 +1,5 @@
+import http from "node:http";
+import { type ServerContext } from "./server-helpers.js";
+export declare function handleWorkflowSseStream(req: http.IncomingMessage, res: http.ServerResponse, ctx: ServerContext): Promise<boolean>;
+export declare function handleWorkflowProcess(req: http.IncomingMessage, res: http.ServerResponse, ctx: ServerContext): Promise<boolean>;
+export declare function handleWorkflowStart(req: http.IncomingMessage, res: http.ServerResponse, ctx: ServerContext): Promise<boolean>;

package/dist/server/server-routes-workflows.js

@@ -0,0 +1,289 @@
+// server/server-routes-workflows.ts — Workflow route handlers
+// SSE stream, workflow process, workflow start
+// Extracted from index.ts for domain-based modularity.
+
+import { createLogger } from "./lib/logger.js";
+import { getServiceClient } from "./lib/supabase-client.js";
+import { processWorkflowSteps, executeInlineChain } from "./handlers/workflows.js";
+import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { getSseClients, sendWorkflowSSE, safeSseWrite, MAX_SSE_CLIENTS_PER_RUN, MAX_SSE_TOTAL_CLIENTS, getTotalSseClients } from "./server-sse.js";
+const log = createLogger("server-routes-workflows");
+const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+const SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || "";
+const FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || "";
+
+// ============================================================================
+// HELPERS
+// ============================================================================
+
+function getToken(req) {
+  const authHeader = req.headers.authorization;
+  return authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : "";
+}
+function isInternalAuth(token) {
+  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);
+}
+
+// ============================================================================
+// GET /workflows/runs/:id/stream — SSE stream for workflow run progress
+// ============================================================================
+
+export async function handleWorkflowSseStream(req, res, ctx) {
+  const {
+    pathname,
+    corsHeaders
+  } = ctx;
+  if (!(req.method === "GET" && pathname.match(/^\/workflows\/runs\/[a-f0-9-]+\/stream$/))) return false;
+  const runId = pathname.split("/")[3];
+  const token = getToken(req);
+  const isInternal = isInternalAuth(token);
+  if (!isInternal && !token) {
+    jsonResponse(res, 401, {
+      error: "Missing authorization"
+    }, corsHeaders);
+    return true;
+  }
+  if (!isInternal) {
+    const sb = getServiceClient();
+    const {
+      data: {
+        user: authUser
+      },
+      error: authError
+    } = await sb.auth.getUser(token);
+    if (authError || !authUser) {
+      jsonResponse(res, 401, {
+        error: "Invalid or expired token"
+      }, corsHeaders);
+      return true;
+    }
+    // P1 FIX: Verify user belongs to the run's store (prevent cross-store SSE snooping)
+    const {
+      data: sseRun
+    } = await sb.from("workflow_runs").select("store_id").eq("id", runId).single();
+    if (sseRun) {
+      const {
+        data: membership
+      } = await sb.from("store_members").select("id").eq("store_id", sseRun.store_id).eq("user_id", authUser.id).single();
+      if (!membership) {
+        jsonResponse(res, 403, {
+          error: "Not authorized to view this run"
+        }, corsHeaders);
+        return true;
+      }
+    }
+  }
+
+  // H6 FIX: Enforce per-run and total client limits
+  const sseClients = getSseClients();
+  const existingClients = sseClients.get(runId)?.size || 0;
+  if (existingClients >= MAX_SSE_CLIENTS_PER_RUN) {
+    jsonResponse(res, 429, {
+      error: "Too many SSE clients for this run"
+    }, corsHeaders);
+    return true;
+  }
+  if (getTotalSseClients() >= MAX_SSE_TOTAL_CLIENTS) {
+    jsonResponse(res, 429, {
+      error: "Too many total SSE connections"
+    }, corsHeaders);
+    return true;
+  }
+
+  // Start SSE stream
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache",
+    Connection: "keep-alive",
+    ...corsHeaders
+  });
+
+  // Send snapshot
+  const sb = getServiceClient();
+  const {
+    data: run
+  } = await sb.from("workflow_runs").select("id, workflow_id, status, trigger_type, current_step_key, error_message, error_step_key, started_at, completed_at, duration_ms").eq("id", runId).single();
+  const {
+    data: stepRuns
+  } = await sb.from("workflow_step_runs").select("id, step_key, step_type, status, error_message, duration_ms, started_at, completed_at").eq("run_id", runId).order("created_at", {
+    ascending: true
+  });
+  sendWorkflowSSE(res, {
+    type: "snapshot",
+    run,
+    steps: stepRuns || []
+  });
+
+  // Register client
+  if (!sseClients.has(runId)) sseClients.set(runId, new Set());
+  sseClients.get(runId).add(res);
+
+  // Cleanup on disconnect
+  const cleanup = () => {
+    clearInterval(heartbeat);
+    const clients = sseClients.get(runId);
+    if (clients) {
+      clients.delete(res);
+      if (clients.size === 0) sseClients.delete(runId);
+    }
+  };
+
+  // Heartbeat — uses safeSseWrite so dead connections are cleaned up immediately
+  const heartbeat = setInterval(() => {
+    if (!safeSseWrite(res, `: heartbeat\n\n`, cleanup)) {
+      clearInterval(heartbeat);
+    }
+  }, 15_000);
+  req.on("close", cleanup);
+  req.on("error", cleanup);
+  return true;
+}
+
+// ============================================================================
+// POST /workflows/process — Internal workflow processing
+// ============================================================================
+
+export async function handleWorkflowProcess(req, res, ctx) {
+  const {
+    pathname,
+    corsHeaders
+  } = ctx;
+  if (!(pathname === "/workflows/process" && req.method === "POST")) return false;
+  const token = getToken(req);
+  if (!FLY_INTERNAL_SECRET || !safeCompare(token, FLY_INTERNAL_SECRET) && !safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) && !safeCompare(token, SERVICE_ROLE_JWT)) {
+    jsonResponse(res, 401, {
+      error: "Unauthorized"
+    }, corsHeaders);
+    return true;
+  }
+  let rawBody;
+  try {
+    rawBody = await readBody(req);
+  } catch {
+    rawBody = "{}";
+  }
+  let body;
+  try {
+    body = JSON.parse(rawBody || "{}");
+  } catch {
+    jsonResponse(res, 400, {
+      error: "Invalid JSON"
+    }, corsHeaders);
+    return true;
+  }
+  const supabase = getServiceClient();
+  const result = await processWorkflowSteps(supabase, body.batch_size || 10);
+  jsonResponse(res, 200, {
+    success: true,
+    ...result
+  }, corsHeaders);
+  return true;
+}
+
+// ============================================================================
+// POST /workflows/start — Start workflow run
+// ============================================================================
+
+export async function handleWorkflowStart(req, res, ctx) {
+  const {
+    pathname,
+    corsHeaders
+  } = ctx;
+  if (!(pathname === "/workflows/start" && req.method === "POST")) return false;
+  const token = getToken(req);
+  const isInternal = isInternalAuth(token);
+  if (!isInternal && !token) {
+    jsonResponse(res, 401, {
+      error: "Missing authorization"
+    }, corsHeaders);
+    return true;
+  }
+  const supabase = getServiceClient();
+
+  // Verify user auth if not internal
+  if (!isInternal) {
+    const {
+      data: {
+        user: authUser
+      },
+      error: authError
+    } = await supabase.auth.getUser(token);
+    if (authError || !authUser) {
+      jsonResponse(res, 401, {
+        error: "Invalid or expired token"
+      }, corsHeaders);
+      return true;
+    }
+  }
+  let rawBody;
+  try {
+    rawBody = await readBody(req);
+  } catch {
+    jsonResponse(res, 413, {
+      error: "Request body too large"
+    }, corsHeaders);
+    return true;
+  }
+  let body;
+  try {
+    body = JSON.parse(rawBody);
+  } catch {
+    jsonResponse(res, 400, {
+      error: "Invalid JSON"
+    }, corsHeaders);
+    return true;
+  }
+
+  // P0 FIX: Verify the workflow belongs to the requesting store before starting a run
+  if (body.workflow_id && body.store_id) {
+    const {
+      data: wfOwner,
+      error: wfOwnerErr
+    } = await supabase.from("workflows").select("id").eq("id", body.workflow_id).eq("store_id", body.store_id).single();
+    if (wfOwnerErr || !wfOwner) {
+      jsonResponse(res, 403, {
+        error: "Workflow does not belong to this store"
+      }, corsHeaders);
+      return true;
+    }
+  }
+  const {
+    data,
+    error
+  } = await supabase.rpc("start_workflow_run", {
+    p_workflow_id: body.workflow_id,
+    p_store_id: body.store_id,
+    p_trigger_type: body.trigger_type || "api",
+    p_trigger_payload: body.trigger_payload || {},
+    p_idempotency_key: body.idempotency_key || null
+  });
+  if (error) {
+    jsonResponse(res, 500, {
+      success: false,
+      error: error.message
+    }, corsHeaders);
+  } else {
+    // Phase 4: Set version_id if workflow has a published version
+    // Phase 1: Inline execution for API-triggered workflows
+    if (data?.success && data.run_id && !data.deduplicated) {
+      try {
+        const {
+          data: wf
+        } = await supabase.from("workflows").select("published_version_id").eq("id", body.workflow_id).single();
+        if (wf?.published_version_id) {
+          await supabase.from("workflow_runs").update({
+            version_id: wf.published_version_id
+          }).eq("id", data.run_id);
+        }
+        await executeInlineChain(supabase, data.run_id);
+      } catch (err) {
+        log.error({
+          err: err.message
+        }, "start-inline chain error");
+      }
+    }
+    jsonResponse(res, data?.success ? 200 : 422, data, corsHeaders);
+  }
+  return true;
+}
+//# sourceMappingURL=server-routes-workflows.js.map

package/dist/server/server-routes-workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-routes-workflows.js","names":["createLogger","getServiceClient","processWorkflowSteps","executeInlineChain","jsonResponse","readBody","safeCompare","getSseClients","sendWorkflowSSE","safeSseWrite","MAX_SSE_CLIENTS_PER_RUN","MAX_SSE_TOTAL_CLIENTS","getTotalSseClients","log","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","getToken","req","authHeader","headers","authorization","startsWith","substring","isInternalAuth","token","handleWorkflowSseStream","res","ctx","pathname","corsHeaders","method","match","runId","split","isInternal","error","sb","data","user","authUser","authError","auth","getUser","sseRun","from","select","eq","single","membership","store_id","id","sseClients","existingClients","get","size","writeHead","Connection","run","stepRuns","order","ascending","type","steps","has","set","Set","add","cleanup","clearInterval","heartbeat","clients","delete","setInterval","on","handleWorkflowProcess","rawBody","body","JSON","parse","supabase","result","batch_size","success","handleWorkflowStart","workflow_id","wfOwner","wfOwnerErr","rpc","p_workflow_id","p_store_id","p_trigger_type","trigger_type","p_trigger_payload","trigger_payload","p_idempotency_key","idempotency_key","message","run_id","deduplicated","wf","published_version_id","update","version_id","err"],"sources":["../../src/server/server-routes-workflows.ts"],"sourcesContent":["// server/server-routes-workflows.ts — Workflow route handlers\n// SSE stream, workflow process, workflow start\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { processWorkflowSteps, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, type ServerContext } from \"./server-helpers.js\";\nimport {\n  getSseClients, sendWorkflowSSE, safeSseWrite,\n  MAX_SSE_CLIENTS_PER_RUN, MAX_SSE_TOTAL_CLIENTS, getTotalSseClients,\n} from \"./server-sse.js\";\n\nconst log = createLogger(\"server-routes-workflows\");\n\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n\n// ============================================================================\n// GET /workflows/runs/:id/stream — SSE stream for workflow run progress\n// ============================================================================\n\nexport async function handleWorkflowSseStream(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  if (!(req.method === \"GET\" && pathname.match(/^\\/workflows\\/runs\\/[a-f0-9-]+\\/stream$/))) return false;\n\n  const runId = pathname.split(\"/\")[3];\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  if (!isInternal) {\n    const sb = getServiceClient();\n    const { data: { user: authUser }, error: authError } = await sb.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n    // P1 FIX: Verify user belongs to the run's store (prevent cross-store SSE snooping)\n    const { data: sseRun } = await sb.from(\"workflow_runs\")\n      .select(\"store_id\").eq(\"id\", runId).single();\n    if (sseRun) {\n      const { data: membership } = await sb.from(\"store_members\")\n        .select(\"id\").eq(\"store_id\", sseRun.store_id).eq(\"user_id\", authUser.id).single();\n      if (!membership) {\n        jsonResponse(res, 403, { error: \"Not authorized to view this run\" }, corsHeaders);\n        return true;\n      }\n    }\n  }\n\n  // H6 FIX: Enforce per-run and total client limits\n  const sseClients = getSseClients();\n  const existingClients = sseClients.get(runId)?.size || 0;\n  if (existingClients >= MAX_SSE_CLIENTS_PER_RUN) {\n    jsonResponse(res, 429, { error: \"Too many SSE clients for this run\" }, corsHeaders);\n    return true;\n  }\n  if (getTotalSseClients() >= MAX_SSE_TOTAL_CLIENTS) {\n    jsonResponse(res, 429, { error: \"Too many total SSE connections\" }, corsHeaders);\n    return true;\n  }\n\n  // Start SSE stream\n  res.writeHead(200, {\n    \"Content-Type\": \"text/event-stream\",\n    \"Cache-Control\": \"no-cache\",\n    Connection: \"keep-alive\",\n    ...corsHeaders,\n  });\n\n  // Send snapshot\n  const sb = getServiceClient();\n  const { data: run } = await sb.from(\"workflow_runs\")\n    .select(\"id, workflow_id, status, trigger_type, current_step_key, error_message, error_step_key, started_at, completed_at, duration_ms\")\n    .eq(\"id\", runId).single();\n  const { data: stepRuns } = await sb.from(\"workflow_step_runs\")\n    .select(\"id, step_key, step_type, status, error_message, duration_ms, started_at, completed_at\")\n    .eq(\"run_id\", runId).order(\"created_at\", { ascending: true });\n\n  sendWorkflowSSE(res, { type: \"snapshot\", run, steps: stepRuns || [] });\n\n  // Register client\n  if (!sseClients.has(runId)) sseClients.set(runId, new Set());\n  sseClients.get(runId)!.add(res);\n\n  // Cleanup on disconnect\n  const cleanup = () => {\n    clearInterval(heartbeat);\n    const clients = sseClients.get(runId);\n    if (clients) {\n      clients.delete(res);\n      if (clients.size === 0) sseClients.delete(runId);\n    }\n  };\n\n  // Heartbeat — uses safeSseWrite so dead connections are cleaned up immediately\n  const heartbeat = setInterval(() => {\n    if (!safeSseWrite(res, `: heartbeat\\n\\n`, cleanup)) {\n      clearInterval(heartbeat);\n    }\n  }, 15_000);\n\n  req.on(\"close\", cleanup);\n  req.on(\"error\", cleanup);\n  return true;\n}\n\n// ============================================================================\n// POST /workflows/process — Internal workflow processing\n// ============================================================================\n\nexport async function handleWorkflowProcess(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  if (!(pathname === \"/workflows/process\" && req.method === \"POST\")) return false;\n\n  const token = getToken(req);\n  if (!FLY_INTERNAL_SECRET || (!safeCompare(token, FLY_INTERNAL_SECRET) && !safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) && !safeCompare(token, SERVICE_ROLE_JWT))) {\n    jsonResponse(res, 401, { error: \"Unauthorized\" }, corsHeaders);\n    return true;\n  }\n\n  let rawBody: string;\n  try {\n    rawBody = await readBody(req);\n  } catch {\n    rawBody = \"{}\";\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody || \"{}\"); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n  const result = await processWorkflowSteps(supabase, body.batch_size || 10);\n  jsonResponse(res, 200, { success: true, ...result }, corsHeaders);\n  return true;\n}\n\n// ============================================================================\n// POST /workflows/start — Start workflow run\n// ============================================================================\n\nexport async function handleWorkflowStart(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  if (!(pathname === \"/workflows/start\" && req.method === \"POST\")) return false;\n\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n\n  // Verify user auth if not internal\n  if (!isInternal) {\n    const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  let rawBody: string;\n  try {\n    rawBody = await readBody(req);\n  } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n\n  // P0 FIX: Verify the workflow belongs to the requesting store before starting a run\n  if (body.workflow_id && body.store_id) {\n    const { data: wfOwner, error: wfOwnerErr } = await supabase\n      .from(\"workflows\")\n      .select(\"id\")\n      .eq(\"id\", body.workflow_id)\n      .eq(\"store_id\", body.store_id)\n      .single();\n    if (wfOwnerErr || !wfOwner) {\n      jsonResponse(res, 403, { error: \"Workflow does not belong to this store\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  const { data, error } = await supabase.rpc(\"start_workflow_run\", {\n    p_workflow_id: body.workflow_id,\n    p_store_id: body.store_id,\n    p_trigger_type: body.trigger_type || \"api\",\n    p_trigger_payload: body.trigger_payload || {},\n    p_idempotency_key: body.idempotency_key || null,\n  });\n\n  if (error) {\n    jsonResponse(res, 500, { success: false, error: error.message }, corsHeaders);\n  } else {\n    // Phase 4: Set version_id if workflow has a published version\n    // Phase 1: Inline execution for API-triggered workflows\n    if (data?.success && data.run_id && !data.deduplicated) {\n      try {\n        const { data: wf } = await supabase.from(\"workflows\")\n          .select(\"published_version_id\").eq(\"id\", body.workflow_id).single();\n        if (wf?.published_version_id) {\n          await supabase.from(\"workflow_runs\").update({ version_id: wf.published_version_id }).eq(\"id\", data.run_id);\n        }\n        await executeInlineChain(supabase, data.run_id);\n      } catch (err) {\n        log.error({ err: (err as Error).message }, \"start-inline chain error\");\n      }\n    }\n    jsonResponse(res, data?.success ? 200 : 422, data, corsHeaders);\n  }\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,oBAAoB,EAAEC,kBAAkB,QAAQ,yBAAyB;AAClF,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAA4B,qBAAqB;AAC7F,SACEC,aAAa,EAAEC,eAAe,EAAEC,YAAY,EAC5CC,uBAAuB,EAAEC,qBAAqB,EAAEC,kBAAkB,QAC7D,iBAAiB;AAExB,MAAMC,GAAG,GAAGb,YAAY,CAAC,yBAAyB,CAAC;AAEnD,MAAMc,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;;AAEA,SAASC,QAAQA,CAACC,GAAyB,EAAU;EACnD,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAACC,aAAa;EAC5C,OAAOF,UAAU,EAAEG,UAAU,CAAC,SAAS,CAAC,GAAGH,UAAU,CAACI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASC,cAAcA,CAACC,KAAa,EAAW;EAC9C,OAAOrB,WAAW,CAACqB,KAAK,EAAET,mBAAmB,CAAC,IAAIZ,WAAW,CAACqB,KAAK,EAAEb,yBAAyB,CAAC,IAAIR,WAAW,CAACqB,KAAK,EAAEV,gBAAgB,CAAC;AACzI;;AAEA;AACA;AACA;;AAEA,OAAO,eAAeW,uBAAuBA,CAC3CR,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,IAAI,EAAEV,GAAG,CAACa,MAAM,KAAK,KAAK,IAAIF,QAAQ,CAACG,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAAE,OAAO,KAAK;EAEtG,MAAMC,KAAK,GAAGJ,QAAQ,CAACK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;EACpC,MAAMT,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAMiB,UAAU,GAAGX,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAACU,UAAU,IAAI,CAACV,KAAK,EAAE;IACzBvB,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAES,KAAK,EAAE;IAAwB,CAAC,EAAEN,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,IAAI,CAACK,UAAU,EAAE;IACf,MAAME,EAAE,GAAGtC,gBAAgB,CAAC,CAAC;IAC7B,MAAM;MAAEuC,IAAI,EAAE;QAAEC,IAAI,EAAEC;MAAS,CAAC;MAAEJ,KAAK,EAAEK;IAAU,CAAC,GAAG,MAAMJ,EAAE,CAACK,IAAI,CAACC,OAAO,CAAClB,KAAK,CAAC;IACnF,IAAIgB,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1BtC,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;QAAES,KAAK,EAAE;MAA2B,CAAC,EAAEN,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;IACA;IACA,MAAM;MAAEQ,IAAI,EAAEM;IAAO,CAAC,GAAG,MAAMP,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CACpDC,MAAM,CAAC,UAAU,CAAC,CAACC,EAAE,CAAC,IAAI,EAAEd,KAAK,CAAC,CAACe,MAAM,CAAC,CAAC;IAC9C,IAAIJ,MAAM,EAAE;MACV,MAAM;QAAEN,IAAI,EAAEW;MAAW,CAAC,GAAG,MAAMZ,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CACxDC,MAAM,CAAC,IAAI,CAAC,CAACC,EAAE,CAAC,UAAU,EAAEH,MAAM,CAACM,QAAQ,CAAC,CAACH,EAAE,CAAC,SAAS,EAAEP,QAAQ,CAACW,EAAE,CAAC,CAACH,MAAM,CAAC,CAAC;MACnF,IAAI,CAACC,UAAU,EAAE;QACf/C,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;UAAES,KAAK,EAAE;QAAkC,CAAC,EAAEN,WAAW,CAAC;QACjF,OAAO,IAAI;MACb;IACF;EACF;;EAEA;EACA,MAAMsB,UAAU,GAAG/C,aAAa,CAAC,CAAC;EAClC,MAAMgD,eAAe,GAAGD,UAAU,CAACE,GAAG,CAACrB,KAAK,CAAC,EAAEsB,IAAI,IAAI,CAAC;EACxD,IAAIF,eAAe,IAAI7C,uBAAuB,EAAE;IAC9CN,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAES,KAAK,EAAE;IAAoC,CAAC,EAAEN,WAAW,CAAC;IACnF,OAAO,IAAI;EACb;EACA,IAAIpB,kBAAkB,CAAC,CAAC,IAAID,qBAAqB,EAAE;IACjDP,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAES,KAAK,EAAE;IAAiC,CAAC,EAAEN,WAAW,CAAC;IAChF,OAAO,IAAI;EACb;;EAEA;EACAH,GAAG,CAAC6B,SAAS,CAAC,GAAG,EAAE;IACjB,cAAc,EAAE,mBAAmB;IACnC,eAAe,EAAE,UAAU;IAC3BC,UAAU,EAAE,YAAY;IACxB,GAAG3B;EACL,CAAC,CAAC;;EAEF;EACA,MAAMO,EAAE,GAAGtC,gBAAgB,CAAC,CAAC;EAC7B,MAAM;IAAEuC,IAAI,EAAEoB;EAAI,CAAC,GAAG,MAAMrB,EAAE,CAACQ,IAAI,CAAC,eAAe,CAAC,CACjDC,MAAM,CAAC,+HAA+H,CAAC,CACvIC,EAAE,CAAC,IAAI,EAAEd,KAAK,CAAC,CAACe,MAAM,CAAC,CAAC;EAC3B,MAAM;IAAEV,IAAI,EAAEqB;EAAS,CAAC,GAAG,MAAMtB,EAAE,CAACQ,IAAI,CAAC,oBAAoB,CAAC,CAC3DC,MAAM,CAAC,uFAAuF,CAAC,CAC/FC,EAAE,CAAC,QAAQ,EAAEd,KAAK,CAAC,CAAC2B,KAAK,CAAC,YAAY,EAAE;IAAEC,SAAS,EAAE;EAAK,CAAC,CAAC;EAE/DvD,eAAe,CAACqB,GAAG,EAAE;IAAEmC,IAAI,EAAE,UAAU;IAAEJ,GAAG;IAAEK,KAAK,EAAEJ,QAAQ,IAAI;EAAG,CAAC,CAAC;;EAEtE;EACA,IAAI,CAACP,UAAU,CAACY,GAAG,CAAC/B,KAAK,CAAC,EAAEmB,UAAU,CAACa,GAAG,CAAChC,KAAK,EAAE,IAAIiC,GAAG,CAAC,CAAC,CAAC;EAC5Dd,UAAU,CAACE,GAAG,CAACrB,KAAK,CAAC,CAAEkC,GAAG,CAACxC,GAAG,CAAC;;EAE/B;EACA,MAAMyC,OAAO,GAAGA,CAAA,KAAM;IACpBC,aAAa,CAACC,SAAS,CAAC;IACxB,MAAMC,OAAO,GAAGnB,UAAU,CAACE,GAAG,CAACrB,KAAK,CAAC;IACrC,IAAIsC,OAAO,EAAE;MACXA,OAAO,CAACC,MAAM,CAAC7C,GAAG,CAAC;MACnB,IAAI4C,OAAO,CAAChB,IAAI,KAAK,CAAC,EAAEH,UAAU,CAACoB,MAAM,CAACvC,KAAK,CAAC;IAClD;EACF,CAAC;;EAED;EACA,MAAMqC,SAAS,GAAGG,WAAW,CAAC,MAAM;IAClC,IAAI,CAAClE,YAAY,CAACoB,GAAG,EAAE,iBAAiB,EAAEyC,OAAO,CAAC,EAAE;MAClDC,aAAa,CAACC,SAAS,CAAC;IAC1B;EACF,CAAC,EAAE,MAAM,CAAC;EAEVpD,GAAG,CAACwD,EAAE,CAAC,OAAO,EAAEN,OAAO,CAAC;EACxBlD,GAAG,CAACwD,EAAE,CAAC,OAAO,EAAEN,OAAO,CAAC;EACxB,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAeO,qBAAqBA,CACzCzD,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,IAAI,EAAEC,QAAQ,KAAK,oBAAoB,IAAIX,GAAG,CAACa,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAE/E,MAAMN,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,IAAI,CAACF,mBAAmB,IAAK,CAACZ,WAAW,CAACqB,KAAK,EAAET,mBAAmB,CAAC,IAAI,CAACZ,WAAW,CAACqB,KAAK,EAAEb,yBAAyB,CAAC,IAAI,CAACR,WAAW,CAACqB,KAAK,EAAEV,gBAAgB,CAAE,EAAE;IACjKb,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAES,KAAK,EAAE;IAAe,CAAC,EAAEN,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EAEA,IAAI8C,OAAe;EACnB,IAAI;IACFA,OAAO,GAAG,MAAMzE,QAAQ,CAACe,GAAG,CAAC;EAC/B,CAAC,CAAC,MAAM;IACN0D,OAAO,GAAG,IAAI;EAChB;EAEA,IAAIC,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,IAAI,IAAI,CAAC;EAAE,CAAC,CAAC,MAAM;IAChD1E,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAES,KAAK,EAAE;IAAe,CAAC,EAAEN,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EAEA,MAAMkD,QAAQ,GAAGjF,gBAAgB,CAAC,CAAC;EACnC,MAAMkF,MAAM,GAAG,MAAMjF,oBAAoB,CAACgF,QAAQ,EAAEH,IAAI,CAACK,UAAU,IAAI,EAAE,CAAC;EAC1EhF,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;IAAEwD,OAAO,EAAE,IAAI;IAAE,GAAGF;EAAO,CAAC,EAAEnD,WAAW,CAAC;EACjE,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAesD,mBAAmBA,CACvClE,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,IAAI,EAAEC,QAAQ,KAAK,kBAAkB,IAAIX,GAAG,CAACa,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAE7E,MAAMN,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAMiB,UAAU,GAAGX,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAACU,UAAU,IAAI,CAACV,KAAK,EAAE;IACzBvB,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAES,KAAK,EAAE;IAAwB,CAAC,EAAEN,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,MAAMkD,QAAQ,GAAGjF,gBAAgB,CAAC,CAAC;;EAEnC;EACA,IAAI,CAACoC,UAAU,EAAE;IACf,MAAM;MAAEG,IAAI,EAAE;QAAEC,IAAI,EAAEC;MAAS,CAAC;MAAEJ,KAAK,EAAEK;IAAU,CAAC,GAAG,MAAMuC,QAAQ,CAACtC,IAAI,CAACC,OAAO,CAAClB,KAAK,CAAC;IACzF,IAAIgB,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1BtC,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;QAAES,KAAK,EAAE;MAA2B,CAAC,EAAEN,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;EACF;EAEA,IAAI8C,OAAe;EACnB,IAAI;IACFA,OAAO,GAAG,MAAMzE,QAAQ,CAACe,GAAG,CAAC;EAC/B,CAAC,CAAC,MAAM;IACNhB,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAES,KAAK,EAAE;IAAyB,CAAC,EAAEN,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,IAAI+C,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,CAAC;EAAE,CAAC,CAAC,MAAM;IACxC1E,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAES,KAAK,EAAE;IAAe,CAAC,EAAEN,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;;EAEA;EACA,IAAI+C,IAAI,CAACQ,WAAW,IAAIR,IAAI,CAAC3B,QAAQ,EAAE;IACrC,MAAM;MAAEZ,IAAI,EAAEgD,OAAO;MAAElD,KAAK,EAAEmD;IAAW,CAAC,GAAG,MAAMP,QAAQ,CACxDnC,IAAI,CAAC,WAAW,CAAC,CACjBC,MAAM,CAAC,IAAI,CAAC,CACZC,EAAE,CAAC,IAAI,EAAE8B,IAAI,CAACQ,WAAW,CAAC,CAC1BtC,EAAE,CAAC,UAAU,EAAE8B,IAAI,CAAC3B,QAAQ,CAAC,CAC7BF,MAAM,CAAC,CAAC;IACX,IAAIuC,UAAU,IAAI,CAACD,OAAO,EAAE;MAC1BpF,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;QAAES,KAAK,EAAE;MAAyC,CAAC,EAAEN,WAAW,CAAC;MACxF,OAAO,IAAI;IACb;EACF;EAEA,MAAM;IAAEQ,IAAI;IAAEF;EAAM,CAAC,GAAG,MAAM4C,QAAQ,CAACQ,GAAG,CAAC,oBAAoB,EAAE;IAC/DC,aAAa,EAAEZ,IAAI,CAACQ,WAAW;IAC/BK,UAAU,EAAEb,IAAI,CAAC3B,QAAQ;IACzByC,cAAc,EAAEd,IAAI,CAACe,YAAY,IAAI,KAAK;IAC1CC,iBAAiB,EAAEhB,IAAI,CAACiB,eAAe,IAAI,CAAC,CAAC;IAC7CC,iBAAiB,EAAElB,IAAI,CAACmB,eAAe,IAAI;EAC7C,CAAC,CAAC;EAEF,IAAI5D,KAAK,EAAE;IACTlC,YAAY,CAACyB,GAAG,EAAE,GAAG,EAAE;MAAEwD,OAAO,EAAE,KAAK;MAAE/C,KAAK,EAAEA,KAAK,CAAC6D;IAAQ,CAAC,EAAEnE,WAAW,CAAC;EAC/E,CAAC,MAAM;IACL;IACA;IACA,IAAIQ,IAAI,EAAE6C,OAAO,IAAI7C,IAAI,CAAC4D,MAAM,IAAI,CAAC5D,IAAI,CAAC6D,YAAY,EAAE;MACtD,IAAI;QACF,MAAM;UAAE7D,IAAI,EAAE8D;QAAG,CAAC,GAAG,MAAMpB,QAAQ,CAACnC,IAAI,CAAC,WAAW,CAAC,CAClDC,MAAM,CAAC,sBAAsB,CAAC,CAACC,EAAE,CAAC,IAAI,EAAE8B,IAAI,CAACQ,WAAW,CAAC,CAACrC,MAAM,CAAC,CAAC;QACrE,IAAIoD,EAAE,EAAEC,oBAAoB,EAAE;UAC5B,MAAMrB,QAAQ,CAACnC,IAAI,CAAC,eAAe,CAAC,CAACyD,MAAM,CAAC;YAAEC,UAAU,EAAEH,EAAE,CAACC;UAAqB,CAAC,CAAC,CAACtD,EAAE,CAAC,IAAI,EAAET,IAAI,CAAC4D,MAAM,CAAC;QAC5G;QACA,MAAMjG,kBAAkB,CAAC+E,QAAQ,EAAE1C,IAAI,CAAC4D,MAAM,CAAC;MACjD,CAAC,CAAC,OAAOM,GAAG,EAAE;QACZ7F,GAAG,CAACyB,KAAK,CAAC;UAAEoE,GAAG,EAAGA,GAAG,CAAWP;QAAQ,CAAC,EAAE,0BAA0B,CAAC;MACxE;IACF;IACA/F,YAAY,CAACyB,GAAG,EAAEW,IAAI,EAAE6C,OAAO,GAAG,GAAG,GAAG,GAAG,EAAE7C,IAAI,EAAER,WAAW,CAAC;EACjE;EACA,OAAO,IAAI;AACb","ignoreList":[]}

package/dist/server/server-sse.d.ts

@@ -0,0 +1,13 @@
+import http from "node:http";
+export declare const MAX_SSE_CLIENTS_PER_RUN = 10;
+export declare const MAX_SSE_TOTAL_CLIENTS = 100;
+export declare function getSseClients(): Map<string, Set<http.ServerResponse>>;
+/** Safe SSE write — returns false and calls cleanup if the connection is dead */
+export declare function safeSseWrite(res: http.ServerResponse, data: string, cleanup: () => void): boolean;
+export declare function sendWorkflowSSE(res: http.ServerResponse, data: unknown): void;
+export declare function broadcastToRun(runId: string, data: unknown): void;
+export declare function getTotalSseClients(): number;
+export declare const sseCleanupInterval: NodeJS.Timeout;
+export declare let pgListenReady: boolean;
+export declare function setupPgListen(): Promise<void>;
+export declare function closePgClient(): void;

package/dist/server/server-sse.js

@@ -0,0 +1,197 @@
+// server/server-sse.ts — SSE streaming infrastructure for workflow run progress
+// Extracted from index.ts for modularity.
+
+import pg from "pg";
+import { createLogger } from "./lib/logger.js";
+import { getServiceClient } from "./lib/supabase-client.js";
+import { processWorkflowSteps, processEventTriggers } from "./handlers/workflows.js";
+const log = createLogger("server-sse");
+
+// ============================================================================
+// SSE CLIENT TRACKING
+// ============================================================================
+
+const sseClients = new Map();
+export const MAX_SSE_CLIENTS_PER_RUN = 10;
+export const MAX_SSE_TOTAL_CLIENTS = 100;
+export function getSseClients() {
+  return sseClients;
+}
+
+/** Safe SSE write — returns false and calls cleanup if the connection is dead */
+export function safeSseWrite(res, data, cleanup) {
+  try {
+    if (res.destroyed || res.writableEnded) {
+      cleanup();
+      return false;
+    }
+    res.write(data);
+    return true;
+  } catch {
+    cleanup();
+    return false;
+  }
+}
+export function sendWorkflowSSE(res, data) {
+  try {
+    if (res.destroyed || res.writableEnded) return;
+    res.write(`data: ${JSON.stringify(data)}\n\n`);
+  } catch {/* client disconnected — benign */}
+}
+export function broadcastToRun(runId, data) {
+  const clients = sseClients.get(runId);
+  if (!clients?.size) return;
+  for (const res of clients) {
+    if (res.destroyed || res.writableEnded) {
+      clients.delete(res);
+      continue;
+    }
+    sendWorkflowSSE(res, data);
+  }
+  if (clients.size === 0) sseClients.delete(runId);
+}
+export function getTotalSseClients() {
+  let total = 0;
+  for (const clients of sseClients.values()) total += clients.size;
+  return total;
+}
+
+// H6 FIX: Periodic stale connection cleanup (every 60s)
+export const sseCleanupInterval = setInterval(() => {
+  for (const [rid, clients] of sseClients) {
+    for (const res of clients) {
+      if (res.destroyed || res.writableEnded) {
+        clients.delete(res);
+      }
+    }
+    if (clients.size === 0) sseClients.delete(rid);
+  }
+}, 60_000);
+
+// ============================================================================
+// PG LISTEN — real-time notifications for SSE + instant step processing
+// ============================================================================
+
+const DATABASE_URL = process.env.DATABASE_URL || "";
+let pgClient = null;
+let pgReconnectAttempts = 0;
+const MAX_PG_RECONNECT_DELAY = 10_000;
+export let pgListenReady = false;
+export async function setupPgListen() {
+  if (!DATABASE_URL) {
+    log.info("DATABASE_URL not set — SSE streaming disabled, using worker-only mode");
+    return;
+  }
+  try {
+    const cleanUrl = DATABASE_URL.replace(/[?&]sslmode=[^&]*/g, "").replace(/\?$/, "");
+    pgClient = new pg.Client({
+      connectionString: cleanUrl,
+      ssl: {
+        rejectUnauthorized: false
+      }
+    });
+    await pgClient.connect();
+    await pgClient.query("LISTEN workflow_step_event");
+    await pgClient.query("LISTEN workflow_run_event");
+    await pgClient.query("LISTEN workflow_step_pending");
+    await pgClient.query("LISTEN workflow_event");
+    await pgClient.query("LISTEN automation_event");
+    pgReconnectAttempts = 0;
+    pgListenReady = true;
+
+    // Debounced event trigger processing — fires at most once per 100ms
+    let eventTriggerTimer = null;
+    function debouncedEventProcess() {
+      if (eventTriggerTimer) return;
+      eventTriggerTimer = setTimeout(async () => {
+        eventTriggerTimer = null;
+        try {
+          const sb = getServiceClient();
+          const count = await processEventTriggers(sb);
+          if (count > 0) log.info({
+            count
+          }, "instant event processing");
+        } catch (err) {
+          log.error({
+            err: err.message
+          }, "event trigger processing error");
+        }
+      }, 100);
+    }
+    pgClient.on("notification", msg => {
+      if (!msg.payload) return;
+      try {
+        const data = JSON.parse(msg.payload);
+        if (msg.channel === "automation_event") {
+          debouncedEventProcess();
+          return;
+        }
+        const runId = data.run_id;
+        if (!runId) return;
+        if (msg.channel === "workflow_step_event") {
+          broadcastToRun(runId, {
+            type: "step_update",
+            ...data
+          });
+        } else if (msg.channel === "workflow_run_event") {
+          broadcastToRun(runId, {
+            type: "run_update",
+            ...data
+          });
+        } else if (msg.channel === "workflow_event") {
+          broadcastToRun(runId, {
+            type: "event",
+            event_type: data.event_type,
+            ...data
+          });
+        } else if (msg.channel === "workflow_step_pending") {
+          const sb = getServiceClient();
+          processWorkflowSteps(sb, 1).catch(err => {
+            log.error({
+              err: err.message,
+              runId
+            }, "NOTIFY-driven step processing failed");
+          });
+        }
+      } catch (err) {
+        log.error({
+          err: err.message
+        }, "failed to parse pg notification");
+      }
+    });
+    pgClient.on("error", err => {
+      log.error({
+        err: err.message
+      }, "pg-listen connection error");
+      pgClient = null;
+      pgReconnectAttempts++;
+      const delay = Math.min(1000 * Math.pow(2, pgReconnectAttempts - 1), MAX_PG_RECONNECT_DELAY);
+      log.warn({
+        delayMs: delay,
+        attempt: pgReconnectAttempts
+      }, "pg-listen reconnecting");
+      setTimeout(() => setupPgListen(), delay);
+    });
+    log.info("pg-listen active on workflow_step_event, workflow_run_event, workflow_step_pending, workflow_event, automation_event");
+  } catch (err) {
+    log.error({
+      err: err.message
+    }, "pg-listen failed to connect");
+    pgClient = null;
+    pgReconnectAttempts++;
+    const delay = Math.min(1000 * Math.pow(2, pgReconnectAttempts - 1), MAX_PG_RECONNECT_DELAY);
+    log.warn({
+      delayMs: delay,
+      attempt: pgReconnectAttempts
+    }, "pg-listen reconnecting");
+    setTimeout(() => setupPgListen(), delay);
+  }
+}
+export function closePgClient() {
+  if (pgClient) {
+    pgClient.end().catch(() => {});
+    pgClient = null;
+    log.info("pg LISTEN connection closed");
+  }
+}
+//# sourceMappingURL=server-sse.js.map

package/dist/server/server-sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-sse.js","names":["pg","createLogger","getServiceClient","processWorkflowSteps","processEventTriggers","log","sseClients","Map","MAX_SSE_CLIENTS_PER_RUN","MAX_SSE_TOTAL_CLIENTS","getSseClients","safeSseWrite","res","data","cleanup","destroyed","writableEnded","write","sendWorkflowSSE","JSON","stringify","broadcastToRun","runId","clients","get","size","delete","getTotalSseClients","total","values","sseCleanupInterval","setInterval","rid","DATABASE_URL","process","env","pgClient","pgReconnectAttempts","MAX_PG_RECONNECT_DELAY","pgListenReady","setupPgListen","info","cleanUrl","replace","Client","connectionString","ssl","rejectUnauthorized","connect","query","eventTriggerTimer","debouncedEventProcess","setTimeout","sb","count","err","error","message","on","msg","payload","parse","channel","run_id","type","event_type","catch","delay","Math","min","pow","warn","delayMs","attempt","closePgClient","end"],"sources":["../../src/server/server-sse.ts"],"sourcesContent":["// server/server-sse.ts — SSE streaming infrastructure for workflow run progress\n// Extracted from index.ts for modularity.\n\nimport http from \"node:http\";\nimport pg from \"pg\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { processWorkflowSteps, processEventTriggers } from \"./handlers/workflows.js\";\n\nconst log = createLogger(\"server-sse\");\n\n// ============================================================================\n// SSE CLIENT TRACKING\n// ============================================================================\n\nconst sseClients = new Map<string, Set<http.ServerResponse>>();\nexport const MAX_SSE_CLIENTS_PER_RUN = 10;\nexport const MAX_SSE_TOTAL_CLIENTS = 100;\n\nexport function getSseClients(): Map<string, Set<http.ServerResponse>> {\n  return sseClients;\n}\n\n/** Safe SSE write — returns false and calls cleanup if the connection is dead */\nexport function safeSseWrite(res: http.ServerResponse, data: string, cleanup: () => void): boolean {\n  try {\n    if (res.destroyed || res.writableEnded) { cleanup(); return false; }\n    res.write(data);\n    return true;\n  } catch {\n    cleanup();\n    return false;\n  }\n}\n\nexport function sendWorkflowSSE(res: http.ServerResponse, data: unknown): void {\n  try {\n    if (res.destroyed || res.writableEnded) return;\n    res.write(`data: ${JSON.stringify(data)}\\n\\n`);\n  } catch { /* client disconnected — benign */ }\n}\n\nexport function broadcastToRun(runId: string, data: unknown): void {\n  const clients = sseClients.get(runId);\n  if (!clients?.size) return;\n  for (const res of clients) {\n    if (res.destroyed || res.writableEnded) {\n      clients.delete(res);\n      continue;\n    }\n    sendWorkflowSSE(res, data);\n  }\n  if (clients.size === 0) sseClients.delete(runId);\n}\n\nexport function getTotalSseClients(): number {\n  let total = 0;\n  for (const clients of sseClients.values()) total += clients.size;\n  return total;\n}\n\n// H6 FIX: Periodic stale connection cleanup (every 60s)\nexport const sseCleanupInterval = setInterval(() => {\n  for (const [rid, clients] of sseClients) {\n    for (const res of clients) {\n      if (res.destroyed || res.writableEnded) {\n        clients.delete(res);\n      }\n    }\n    if (clients.size === 0) sseClients.delete(rid);\n  }\n}, 60_000);\n\n// ============================================================================\n// PG LISTEN — real-time notifications for SSE + instant step processing\n// ============================================================================\n\nconst DATABASE_URL = process.env.DATABASE_URL || \"\";\nlet pgClient: pg.Client | null = null;\nlet pgReconnectAttempts = 0;\nconst MAX_PG_RECONNECT_DELAY = 10_000;\n\nexport let pgListenReady = false;\n\nexport async function setupPgListen(): Promise<void> {\n  if (!DATABASE_URL) {\n    log.info(\"DATABASE_URL not set — SSE streaming disabled, using worker-only mode\");\n    return;\n  }\n\n  try {\n    const cleanUrl = DATABASE_URL.replace(/[?&]sslmode=[^&]*/g, \"\").replace(/\\?$/, \"\");\n    pgClient = new pg.Client({ connectionString: cleanUrl, ssl: { rejectUnauthorized: false } });\n    await pgClient.connect();\n    await pgClient.query(\"LISTEN workflow_step_event\");\n    await pgClient.query(\"LISTEN workflow_run_event\");\n    await pgClient.query(\"LISTEN workflow_step_pending\");\n    await pgClient.query(\"LISTEN workflow_event\");\n    await pgClient.query(\"LISTEN automation_event\");\n\n    pgReconnectAttempts = 0;\n    pgListenReady = true;\n\n    // Debounced event trigger processing — fires at most once per 100ms\n    let eventTriggerTimer: ReturnType<typeof setTimeout> | null = null;\n    function debouncedEventProcess(): void {\n      if (eventTriggerTimer) return;\n      eventTriggerTimer = setTimeout(async () => {\n        eventTriggerTimer = null;\n        try {\n          const sb = getServiceClient();\n          const count = await processEventTriggers(sb);\n          if (count > 0) log.info({ count }, \"instant event processing\");\n        } catch (err) { log.error({ err: (err as Error).message }, \"event trigger processing error\"); }\n      }, 100);\n    }\n\n    pgClient.on(\"notification\", (msg) => {\n      if (!msg.payload) return;\n      try {\n        const data = JSON.parse(msg.payload);\n\n        if (msg.channel === \"automation_event\") {\n          debouncedEventProcess();\n          return;\n        }\n\n        const runId = data.run_id;\n        if (!runId) return;\n\n        if (msg.channel === \"workflow_step_event\") {\n          broadcastToRun(runId, { type: \"step_update\", ...data });\n        } else if (msg.channel === \"workflow_run_event\") {\n          broadcastToRun(runId, { type: \"run_update\", ...data });\n        } else if (msg.channel === \"workflow_event\") {\n          broadcastToRun(runId, { type: \"event\", event_type: data.event_type, ...data });\n        } else if (msg.channel === \"workflow_step_pending\") {\n          const sb = getServiceClient();\n          processWorkflowSteps(sb, 1).catch((err) => {\n            log.error({ err: (err as Error).message, runId }, \"NOTIFY-driven step processing failed\");\n          });\n        }\n      } catch (err) { log.error({ err: (err as Error).message }, \"failed to parse pg notification\"); }\n    });\n\n    pgClient.on(\"error\", (err) => {\n      log.error({ err: err.message }, \"pg-listen connection error\");\n      pgClient = null;\n      pgReconnectAttempts++;\n      const delay = Math.min(1000 * Math.pow(2, pgReconnectAttempts - 1), MAX_PG_RECONNECT_DELAY);\n      log.warn({ delayMs: delay, attempt: pgReconnectAttempts }, \"pg-listen reconnecting\");\n      setTimeout(() => setupPgListen(), delay);\n    });\n\n    log.info(\"pg-listen active on workflow_step_event, workflow_run_event, workflow_step_pending, workflow_event, automation_event\");\n  } catch (err) {\n    log.error({ err: (err as Error).message }, \"pg-listen failed to connect\");\n    pgClient = null;\n    pgReconnectAttempts++;\n    const delay = Math.min(1000 * Math.pow(2, pgReconnectAttempts - 1), MAX_PG_RECONNECT_DELAY);\n    log.warn({ delayMs: delay, attempt: pgReconnectAttempts }, \"pg-listen reconnecting\");\n    setTimeout(() => setupPgListen(), delay);\n  }\n}\n\nexport function closePgClient(): void {\n  if (pgClient) {\n    pgClient.end().catch(() => {});\n    pgClient = null;\n    log.info(\"pg LISTEN connection closed\");\n  }\n}\n"],"mappings":"AAAA;AACA;;AAGA,OAAOA,EAAE,MAAM,IAAI;AACnB,SAASC,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,oBAAoB,EAAEC,oBAAoB,QAAQ,yBAAyB;AAEpF,MAAMC,GAAG,GAAGJ,YAAY,CAAC,YAAY,CAAC;;AAEtC;AACA;AACA;;AAEA,MAAMK,UAAU,GAAG,IAAIC,GAAG,CAAmC,CAAC;AAC9D,OAAO,MAAMC,uBAAuB,GAAG,EAAE;AACzC,OAAO,MAAMC,qBAAqB,GAAG,GAAG;AAExC,OAAO,SAASC,aAAaA,CAAA,EAA0C;EACrE,OAAOJ,UAAU;AACnB;;AAEA;AACA,OAAO,SAASK,YAAYA,CAACC,GAAwB,EAAEC,IAAY,EAAEC,OAAmB,EAAW;EACjG,IAAI;IACF,IAAIF,GAAG,CAACG,SAAS,IAAIH,GAAG,CAACI,aAAa,EAAE;MAAEF,OAAO,CAAC,CAAC;MAAE,OAAO,KAAK;IAAE;IACnEF,GAAG,CAACK,KAAK,CAACJ,IAAI,CAAC;IACf,OAAO,IAAI;EACb,CAAC,CAAC,MAAM;IACNC,OAAO,CAAC,CAAC;IACT,OAAO,KAAK;EACd;AACF;AAEA,OAAO,SAASI,eAAeA,CAACN,GAAwB,EAAEC,IAAa,EAAQ;EAC7E,IAAI;IACF,IAAID,GAAG,CAACG,SAAS,IAAIH,GAAG,CAACI,aAAa,EAAE;IACxCJ,GAAG,CAACK,KAAK,CAAC,SAASE,IAAI,CAACC,SAAS,CAACP,IAAI,CAAC,MAAM,CAAC;EAChD,CAAC,CAAC,MAAM,CAAE;AACZ;AAEA,OAAO,SAASQ,cAAcA,CAACC,KAAa,EAAET,IAAa,EAAQ;EACjE,MAAMU,OAAO,GAAGjB,UAAU,CAACkB,GAAG,CAACF,KAAK,CAAC;EACrC,IAAI,CAACC,OAAO,EAAEE,IAAI,EAAE;EACpB,KAAK,MAAMb,GAAG,IAAIW,OAAO,EAAE;IACzB,IAAIX,GAAG,CAACG,SAAS,IAAIH,GAAG,CAACI,aAAa,EAAE;MACtCO,OAAO,CAACG,MAAM,CAACd,GAAG,CAAC;MACnB;IACF;IACAM,eAAe,CAACN,GAAG,EAAEC,IAAI,CAAC;EAC5B;EACA,IAAIU,OAAO,CAACE,IAAI,KAAK,CAAC,EAAEnB,UAAU,CAACoB,MAAM,CAACJ,KAAK,CAAC;AAClD;AAEA,OAAO,SAASK,kBAAkBA,CAAA,EAAW;EAC3C,IAAIC,KAAK,GAAG,CAAC;EACb,KAAK,MAAML,OAAO,IAAIjB,UAAU,CAACuB,MAAM,CAAC,CAAC,EAAED,KAAK,IAAIL,OAAO,CAACE,IAAI;EAChE,OAAOG,KAAK;AACd;;AAEA;AACA,OAAO,MAAME,kBAAkB,GAAGC,WAAW,CAAC,MAAM;EAClD,KAAK,MAAM,CAACC,GAAG,EAAET,OAAO,CAAC,IAAIjB,UAAU,EAAE;IACvC,KAAK,MAAMM,GAAG,IAAIW,OAAO,EAAE;MACzB,IAAIX,GAAG,CAACG,SAAS,IAAIH,GAAG,CAACI,aAAa,EAAE;QACtCO,OAAO,CAACG,MAAM,CAACd,GAAG,CAAC;MACrB;IACF;IACA,IAAIW,OAAO,CAACE,IAAI,KAAK,CAAC,EAAEnB,UAAU,CAACoB,MAAM,CAACM,GAAG,CAAC;EAChD;AACF,CAAC,EAAE,MAAM,CAAC;;AAEV;AACA;AACA;;AAEA,MAAMC,YAAY,GAAGC,OAAO,CAACC,GAAG,CAACF,YAAY,IAAI,EAAE;AACnD,IAAIG,QAA0B,GAAG,IAAI;AACrC,IAAIC,mBAAmB,GAAG,CAAC;AAC3B,MAAMC,sBAAsB,GAAG,MAAM;AAErC,OAAO,IAAIC,aAAa,GAAG,KAAK;AAEhC,OAAO,eAAeC,aAAaA,CAAA,EAAkB;EACnD,IAAI,CAACP,YAAY,EAAE;IACjB5B,GAAG,CAACoC,IAAI,CAAC,uEAAuE,CAAC;IACjF;EACF;EAEA,IAAI;IACF,MAAMC,QAAQ,GAAGT,YAAY,CAACU,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAACA,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAClFP,QAAQ,GAAG,IAAIpC,EAAE,CAAC4C,MAAM,CAAC;MAAEC,gBAAgB,EAAEH,QAAQ;MAAEI,GAAG,EAAE;QAAEC,kBAAkB,EAAE;MAAM;IAAE,CAAC,CAAC;IAC5F,MAAMX,QAAQ,CAACY,OAAO,CAAC,CAAC;IACxB,MAAMZ,QAAQ,CAACa,KAAK,CAAC,4BAA4B,CAAC;IAClD,MAAMb,QAAQ,CAACa,KAAK,CAAC,2BAA2B,CAAC;IACjD,MAAMb,QAAQ,CAACa,KAAK,CAAC,8BAA8B,CAAC;IACpD,MAAMb,QAAQ,CAACa,KAAK,CAAC,uBAAuB,CAAC;IAC7C,MAAMb,QAAQ,CAACa,KAAK,CAAC,yBAAyB,CAAC;IAE/CZ,mBAAmB,GAAG,CAAC;IACvBE,aAAa,GAAG,IAAI;;IAEpB;IACA,IAAIW,iBAAuD,GAAG,IAAI;IAClE,SAASC,qBAAqBA,CAAA,EAAS;MACrC,IAAID,iBAAiB,EAAE;MACvBA,iBAAiB,GAAGE,UAAU,CAAC,YAAY;QACzCF,iBAAiB,GAAG,IAAI;QACxB,IAAI;UACF,MAAMG,EAAE,GAAGnD,gBAAgB,CAAC,CAAC;UAC7B,MAAMoD,KAAK,GAAG,MAAMlD,oBAAoB,CAACiD,EAAE,CAAC;UAC5C,IAAIC,KAAK,GAAG,CAAC,EAAEjD,GAAG,CAACoC,IAAI,CAAC;YAAEa;UAAM,CAAC,EAAE,0BAA0B,CAAC;QAChE,CAAC,CAAC,OAAOC,GAAG,EAAE;UAAElD,GAAG,CAACmD,KAAK,CAAC;YAAED,GAAG,EAAGA,GAAG,CAAWE;UAAQ,CAAC,EAAE,gCAAgC,CAAC;QAAE;MAChG,CAAC,EAAE,GAAG,CAAC;IACT;IAEArB,QAAQ,CAACsB,EAAE,CAAC,cAAc,EAAGC,GAAG,IAAK;MACnC,IAAI,CAACA,GAAG,CAACC,OAAO,EAAE;MAClB,IAAI;QACF,MAAM/C,IAAI,GAAGM,IAAI,CAAC0C,KAAK,CAACF,GAAG,CAACC,OAAO,CAAC;QAEpC,IAAID,GAAG,CAACG,OAAO,KAAK,kBAAkB,EAAE;UACtCX,qBAAqB,CAAC,CAAC;UACvB;QACF;QAEA,MAAM7B,KAAK,GAAGT,IAAI,CAACkD,MAAM;QACzB,IAAI,CAACzC,KAAK,EAAE;QAEZ,IAAIqC,GAAG,CAACG,OAAO,KAAK,qBAAqB,EAAE;UACzCzC,cAAc,CAACC,KAAK,EAAE;YAAE0C,IAAI,EAAE,aAAa;YAAE,GAAGnD;UAAK,CAAC,CAAC;QACzD,CAAC,MAAM,IAAI8C,GAAG,CAACG,OAAO,KAAK,oBAAoB,EAAE;UAC/CzC,cAAc,CAACC,KAAK,EAAE;YAAE0C,IAAI,EAAE,YAAY;YAAE,GAAGnD;UAAK,CAAC,CAAC;QACxD,CAAC,MAAM,IAAI8C,GAAG,CAACG,OAAO,KAAK,gBAAgB,EAAE;UAC3CzC,cAAc,CAACC,KAAK,EAAE;YAAE0C,IAAI,EAAE,OAAO;YAAEC,UAAU,EAAEpD,IAAI,CAACoD,UAAU;YAAE,GAAGpD;UAAK,CAAC,CAAC;QAChF,CAAC,MAAM,IAAI8C,GAAG,CAACG,OAAO,KAAK,uBAAuB,EAAE;UAClD,MAAMT,EAAE,GAAGnD,gBAAgB,CAAC,CAAC;UAC7BC,oBAAoB,CAACkD,EAAE,EAAE,CAAC,CAAC,CAACa,KAAK,CAAEX,GAAG,IAAK;YACzClD,GAAG,CAACmD,KAAK,CAAC;cAAED,GAAG,EAAGA,GAAG,CAAWE,OAAO;cAAEnC;YAAM,CAAC,EAAE,sCAAsC,CAAC;UAC3F,CAAC,CAAC;QACJ;MACF,CAAC,CAAC,OAAOiC,GAAG,EAAE;QAAElD,GAAG,CAACmD,KAAK,CAAC;UAAED,GAAG,EAAGA,GAAG,CAAWE;QAAQ,CAAC,EAAE,iCAAiC,CAAC;MAAE;IACjG,CAAC,CAAC;IAEFrB,QAAQ,CAACsB,EAAE,CAAC,OAAO,EAAGH,GAAG,IAAK;MAC5BlD,GAAG,CAACmD,KAAK,CAAC;QAAED,GAAG,EAAEA,GAAG,CAACE;MAAQ,CAAC,EAAE,4BAA4B,CAAC;MAC7DrB,QAAQ,GAAG,IAAI;MACfC,mBAAmB,EAAE;MACrB,MAAM8B,KAAK,GAAGC,IAAI,CAACC,GAAG,CAAC,IAAI,GAAGD,IAAI,CAACE,GAAG,CAAC,CAAC,EAAEjC,mBAAmB,GAAG,CAAC,CAAC,EAAEC,sBAAsB,CAAC;MAC3FjC,GAAG,CAACkE,IAAI,CAAC;QAAEC,OAAO,EAAEL,KAAK;QAAEM,OAAO,EAAEpC;MAAoB,CAAC,EAAE,wBAAwB,CAAC;MACpFe,UAAU,CAAC,MAAMZ,aAAa,CAAC,CAAC,EAAE2B,KAAK,CAAC;IAC1C,CAAC,CAAC;IAEF9D,GAAG,CAACoC,IAAI,CAAC,sHAAsH,CAAC;EAClI,CAAC,CAAC,OAAOc,GAAG,EAAE;IACZlD,GAAG,CAACmD,KAAK,CAAC;MAAED,GAAG,EAAGA,GAAG,CAAWE;IAAQ,CAAC,EAAE,6BAA6B,CAAC;IACzErB,QAAQ,GAAG,IAAI;IACfC,mBAAmB,EAAE;IACrB,MAAM8B,KAAK,GAAGC,IAAI,CAACC,GAAG,CAAC,IAAI,GAAGD,IAAI,CAACE,GAAG,CAAC,CAAC,EAAEjC,mBAAmB,GAAG,CAAC,CAAC,EAAEC,sBAAsB,CAAC;IAC3FjC,GAAG,CAACkE,IAAI,CAAC;MAAEC,OAAO,EAAEL,KAAK;MAAEM,OAAO,EAAEpC;IAAoB,CAAC,EAAE,wBAAwB,CAAC;IACpFe,UAAU,CAAC,MAAMZ,aAAa,CAAC,CAAC,EAAE2B,KAAK,CAAC;EAC1C;AACF;AAEA,OAAO,SAASO,aAAaA,CAAA,EAAS;EACpC,IAAItC,QAAQ,EAAE;IACZA,QAAQ,CAACuC,GAAG,CAAC,CAAC,CAACT,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9B9B,QAAQ,GAAG,IAAI;IACf/B,GAAG,CAACoC,IAAI,CAAC,6BAA6B,CAAC;EACzC;AACF","ignoreList":[]}