🛡️ Secure Payment API

Nonce-based security • Rate limiting • CORS validation • SQL injection prevention

Frontend: https://client.zenithpayments.support

\n \n \n \n \n\n`;\n\n return new Response(html, {\n status: 200,\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" }\n });\n }\n\n /**\n * Get database instance for external access if needed\n */\n getDatabase(): Database {\n return this.db;\n }\n\n /**\n * Cleanup resources when shutting down\n */\n async cleanup(): Promise {\n logger.info(\"🔄 Shutting down API Gateway\");\n await this.db.cleanup();\n logger.info(\"Gateway cleanup complete\");\n }\n}",[],[150,222,229],[150,222],{"_107":238,"_100":239,"_151":240,"_153":152,"_154":138,"_155":241,"_157":158,"_109":242,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":243,"_103":280},"9e69c58e-58a9-11f0-b6a5-f69ea79377d9","handlers","9e69c64c-58a9-11f0-b6a5-f69ea79377d9",5,["D",1751614597888],[244,253,262,271],{"_107":245,"_100":246,"_151":247,"_153":240,"_154":138,"_155":248,"_157":158,"_109":249,"_104":31,"_160":180,"_162":250,"_163":27,"_164":-5,"_165":251,"_103":252},"9fb68cce-58a9-11f0-b33c-f69ea79377d9","bookingHandler.ts","9fb68df0-58a9-11f0-b33c-f69ea79377d9",22,["D",1751614600068],"import { Database } from \"../database/database.ts\";\nimport { ValidationService } from \"../services/validationService.ts\";\nimport { AuthService } from \"../services/authService.ts\";\nimport { addCorsHeaders } from \"../middleware/cors.ts\";\nimport { logger } from \"../utils/logger.ts\";\n\nexport interface BookingInfo {\n id: string;\n title: string;\n description: string;\n amount: number;\n currency: string;\n status: string;\n}\n\nclass BookingHandler {\n /**\n * Get booking information using secure token-based authentication\n * Industry standard: URL path contains token, not booking ID for security\n */\n async getBooking(request: Request, db: Database): Promise {\n try {\n const url = new URL(request.url);\n const token = url.pathname.split('/')[2]; // Extract token from /booking/:token\n\n // Validate token format\n if (!token || token.length < 32) {\n logger.warn(\"Invalid booking token format\", { token: token?.substring(0, 8) + \"...\" });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Invalid booking token\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n\n // Validate booking token\n const tokenValidation = await AuthService.validateBookingToken(db, token);\n if (!tokenValidation.valid) {\n logger.warn(\"Invalid or expired booking token\", { \n token: token.substring(0, 8) + \"...\", \n error: tokenValidation.error \n });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: tokenValidation.error }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n\n // Query booking from database using validated booking ID\n const booking = await db.queryOne(\n \"SELECT * FROM bookings WHERE id = ?\",\n [tokenValidation.bookingId]\n );\n\n if (!booking) {\n logger.warn(\"Booking not found\", { bookingId: tokenValidation.bookingId });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Booking not found\" }), {\n status: 404,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n\n // Prepare booking response (no PII exposure)\n const bookingInfo: BookingInfo = {\n id: booking.id,\n title: booking.title,\n description: booking.description || \"\",\n amount: parseFloat(booking.amount),\n currency: booking.currency || \"USD\",\n status: booking.status || \"pending\"\n };\n\n logger.info(\"Booking retrieved successfully\", { \n bookingId: tokenValidation.bookingId,\n token: token.substring(0, 8) + \"...\"\n });\n\n return addCorsHeaders(\n new Response(JSON.stringify({\n success: true,\n booking: bookingInfo\n }), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n\n } catch (error) {\n logger.error(\"Error retrieving booking\", { error: error.message });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n }\n\n /**\n * Generate a new booking token for sharing (admin/API use)\n */\n async generateBookingToken(request: Request, db: Database): Promise {\n try {\n // Validate API key for token generation\n const apiValidation = AuthService.validateApiKey(request);\n if (!apiValidation.valid) {\n logger.warn(\"Unauthorized token generation attempt\", {\n ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\n error: apiValidation.error\n });\n \n return addCorsHeaders(\n new Response(JSON.stringify({ error: apiValidation.error }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n\n const { bookingId } = await request.json();\n \n // Validate booking exists\n const validation = ValidationService.validateBookingId(bookingId);\n if (!validation.valid) {\n return addCorsHeaders(\n new Response(JSON.stringify({ error: validation.error }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n\n const booking = await db.queryOne(\"SELECT id FROM bookings WHERE id = ?\", [bookingId]);\n if (!booking) {\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Booking not found\" }), {\n status: 404,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n\n // Generate booking token\n const token = await AuthService.createBookingToken(\n db,\n bookingId,\n request.headers.get(\"x-forwarded-for\") || \"unknown\",\n request.headers.get(\"user-agent\") || undefined\n );\n\n return addCorsHeaders(\n new Response(JSON.stringify({\n success: true,\n token,\n bookingId,\n shareableUrl: `/booking/${token}`,\n expiresIn: 24 * 60 * 60 // 24 hours in seconds\n }), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n\n } catch (error) {\n logger.error(\"Error generating booking token\", { error: error.message });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n }\n}\n\nexport const bookingHandler = new BookingHandler();\n",[],[150,239,246],{"_107":254,"_100":255,"_151":256,"_153":240,"_154":138,"_155":257,"_157":158,"_109":258,"_104":31,"_160":180,"_162":259,"_163":27,"_164":-5,"_165":260,"_103":261},"9fc33186-58a9-11f0-a255-f69ea79377d9","paymentHandler.ts","9fc33230-58a9-11f0-a255-f69ea79377d9",23,["D",1751614600152],"import { Database } from \"../database/database.ts\";\nimport { NonceService } from \"../services/nonceService.ts\";\nimport { PaymentService, PaymentHashRequest } from \"../services/paymentService.ts\";\nimport { ValidationService } from \"../services/validationService.ts\";\nimport { AuthService } from \"../services/authService.ts\";\nimport { addCorsHeaders } from \"../middleware/cors.ts\";\nimport { logger } from \"../utils/logger.ts\";\n\nclass PaymentHandler {\n async createPaymentNonce(request: Request, db: Database): Promise {\n try {\n const ip = request.headers.get(\"cf-connecting-ip\") || \n request.headers.get(\"x-forwarded-for\") || \n \"unknown\";\n const userAgent = request.headers.get(\"user-agent\") || \"\";\n const origin = request.headers.get(\"origin\") || \"\";\n\n // Parse request body\n const body = await request.json();\n const { bookingId } = body;\n\n // Validate booking ID\n const validation = ValidationService.validateBookingId(bookingId);\n if (!validation.valid) {\n logger.warn(\"Invalid booking ID in nonce request\", { bookingId, ip, error: validation.error });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: validation.error }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Check if booking exists\n const booking = await db.queryOne(\n \"SELECT id FROM bookings WHERE id = ?\",\n [bookingId]\n );\n\n if (!booking) {\n logger.warn(\"Booking not found for nonce request\", { bookingId, ip });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Booking not found\" }), {\n status: 404,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Generate nonce\n const { nonce, expiresIn } = await NonceService.generateNonce(\n db,\n bookingId,\n ip,\n userAgent,\n origin\n );\n\n return addCorsHeaders(\n new Response(JSON.stringify({\n success: true,\n nonce,\n expiresIn\n }), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n\n } catch (error) {\n logger.error(\"Error creating payment nonce\", { error: error.message });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n }\n\n async createPaymentHash(request: Request, db: Database): Promise {\n try {\n const ip = request.headers.get(\"cf-connecting-ip\") || \n request.headers.get(\"x-forwarded-for\") || \n \"unknown\";\n const nonce = request.headers.get(\"x-payment-nonce\");\n const origin = request.headers.get(\"origin\") || \"\";\n\n // Validate API key first (critical security - payment credentials involved)\n const apiValidation = AuthService.validateApiKey(request);\n if (!apiValidation.valid) {\n logger.warn(\"Unauthorized payment hash creation attempt\", {\n ip,\n error: apiValidation.error,\n userAgent: request.headers.get(\"user-agent\") || \"unknown\"\n });\n \n return addCorsHeaders(\n new Response(JSON.stringify({ error: apiValidation.error }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Validate nonce header\n if (!nonce) {\n logger.warn(\"Missing nonce header in payment hash request\", { ip });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Nonce required\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Validate nonce format\n const nonceValidation = ValidationService.validateNonceFormat(nonce);\n if (!nonceValidation.valid) {\n logger.warn(\"Invalid nonce format in payment hash request\", { ip, error: nonceValidation.error });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: nonceValidation.error }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Parse request body\n const body = await request.json();\n\n // Validate payment request\n const paymentValidation = PaymentService.validatePaymentRequest(body);\n if (!paymentValidation.valid) {\n logger.warn(\"Invalid payment request\", { ip, errors: paymentValidation.errors });\n return addCorsHeaders(\n new Response(JSON.stringify({ \n error: \"Invalid payment request\", \n details: paymentValidation.errors \n }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // We need to infer the booking ID from the nonce\n // First, let's get the nonce data to extract the booking ID\n const nonceData = await db.queryOne(\n \"SELECT booking_id FROM payment_nonces WHERE nonce = ?\",\n [nonce]\n );\n\n if (!nonceData) {\n logger.warn(\"Nonce not found for payment hash request\", { ip });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Invalid or expired session\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Validate nonce\n const validation = await NonceService.validateNonce(\n db,\n nonce,\n nonceData.booking_id,\n ip\n );\n\n if (!validation.valid) {\n logger.warn(\"Nonce validation failed for payment hash\", { ip, error: validation.error });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: validation.error }), {\n status: validation.error === \"Session expired\" ? 410 : 403,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Mark nonce as used\n await NonceService.markNonceUsed(db, nonce);\n\n // Generate payment hash\n const paymentRequest: PaymentHashRequest = {\n apikey: body.apikey,\n mode: body.mode,\n paymentAmount: body.paymentAmount,\n merchantUniquePaymentId: body.merchantUniquePaymentId,\n timestamp: body.timestamp\n };\n\n const paymentHash = PaymentService.generatePaymentHash(paymentRequest);\n\n return addCorsHeaders(\n new Response(JSON.stringify({\n success: true,\n ...paymentHash\n }), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n\n } catch (error) {\n logger.error(\"Error creating payment hash\", { error: error.message });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n }\n\n async refreshPayment(request: Request, db: Database): Promise {\n try {\n const ip = request.headers.get(\"cf-connecting-ip\") || \n request.headers.get(\"x-forwarded-for\") || \n \"unknown\";\n const origin = request.headers.get(\"origin\") || \"\";\n\n // Parse request body\n const body = await request.json();\n const { bookingId } = body;\n\n // Validate booking ID\n const validation = ValidationService.validateBookingId(bookingId);\n if (!validation.valid) {\n logger.warn(\"Invalid booking ID in payment refresh request\", { bookingId, ip, error: validation.error });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: validation.error }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Check if booking exists\n const booking = await db.queryOne(\n \"SELECT * FROM bookings WHERE id = ?\",\n [bookingId]\n );\n\n if (!booking) {\n logger.warn(\"Booking not found for payment refresh\", { bookingId, ip });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Booking not found\" }), {\n status: 404,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Mark any existing unused nonces for this booking/IP as expired\n await db.execute(`\n UPDATE payment_nonces \n SET used = 1 \n WHERE booking_id = ? AND ip_address = ? AND used = 0\n `, [bookingId, ip]);\n\n // Generate new payment session data\n const merchantUniquePaymentId = PaymentService.generateMerchantUniquePaymentId();\n const timestamp = PaymentService.generateTimestamp();\n\n logger.info(\"Payment session refreshed\", { bookingId, ip, merchantUniquePaymentId });\n\n return addCorsHeaders(\n new Response(JSON.stringify({\n success: true,\n message: \"Payment session refreshed\",\n booking: {\n id: booking.id,\n title: booking.title,\n description: booking.description,\n amount: parseFloat(booking.amount),\n currency: booking.currency\n },\n paymentData: {\n merchantUniquePaymentId,\n timestamp,\n paymentAmount: booking.amount\n }\n }), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n\n } catch (error) {\n logger.error(\"Error refreshing payment\", { error: error.message });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n }\n\n async generatePublicPaymentHash(request: Request, db: Database): Promise {\n try {\n const ip = request.headers.get(\"cf-connecting-ip\") || \n request.headers.get(\"x-forwarded-for\") || \n \"unknown\";\n const origin = request.headers.get(\"origin\") || \"\";\n\n // Parse request body\n const body = await request.json();\n const { apikey, username, password, mode, paymentAmount, merchantUniquePaymentId, timestamp } = body;\n\n // Validate all required parameters\n const requiredFields = ['apikey', 'username', 'password', 'mode', 'paymentAmount', 'merchantUniquePaymentId', 'timestamp'];\n const missingFields = requiredFields.filter(field => !body[field]);\n\n if (missingFields.length > 0) {\n logger.warn(\"Missing required fields in public hash request\", { ip, missingFields });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: `Missing required fields: ${missingFields.join(', ')}` }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Create payment request with custom credentials\n const paymentRequest: PaymentHashRequest = {\n apikey,\n mode,\n paymentAmount,\n merchantUniquePaymentId,\n timestamp\n };\n\n // Validate payment request format\n const validation = PaymentService.validatePaymentRequest(paymentRequest);\n if (!validation.valid) {\n logger.warn(\"Invalid payment request in public hash generation\", { ip, errors: validation.errors });\n return addCorsHeaders(\n new Response(JSON.stringify({ \n error: \"Invalid payment data\", \n details: validation.errors \n }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Generate payment hash using custom credentials (override environment values)\n const originalUsername = Deno.env.get(\"PAYMENT_USERNAME\");\n const originalPassword = Deno.env.get(\"PAYMENT_PASSWORD\");\n \n // Temporarily set custom credentials\n Deno.env.set(\"PAYMENT_USERNAME\", username);\n Deno.env.set(\"PAYMENT_PASSWORD\", password);\n\n try {\n const paymentResponse = PaymentService.generatePaymentHash(paymentRequest);\n\n // Log successful hash generation\n logger.info(\"Public payment hash generated\", {\n merchantUniquePaymentId,\n paymentAmount,\n mode,\n timestamp,\n ip\n });\n\n return addCorsHeaders(\n new Response(JSON.stringify({ success: true, ...paymentResponse }), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n } finally {\n // Restore original environment credentials\n if (originalUsername) Deno.env.set(\"PAYMENT_USERNAME\", originalUsername);\n if (originalPassword) Deno.env.set(\"PAYMENT_PASSWORD\", originalPassword);\n }\n\n } catch (error) {\n const errorMessage = error instanceof Error ? error.message : \"Unknown error\";\n logger.error(\"Public payment hash generation failed\", { error: errorMessage });\n\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Failed to generate payment hash\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || \"\"\n );\n }\n }\n}\n\nexport const paymentHandler = new PaymentHandler();\n",[],[150,239,255],{"_107":263,"_100":264,"_151":265,"_153":240,"_154":138,"_155":266,"_157":158,"_109":267,"_104":31,"_160":180,"_162":268,"_163":27,"_164":-5,"_165":269,"_103":270},"9fcbed58-58a9-11f0-9ead-f69ea79377d9","turnstileHandler.ts","9fcbee3e-58a9-11f0-9ead-f69ea79377d9",24,["D",1751614600208],"import { ValidationService } from \"../services/validationService.ts\";\nimport { addCorsHeaders } from \"../middleware/cors.ts\";\nimport { logger } from \"../utils/logger.ts\";\nimport { environment } from \"../config/environment.ts\";\n\nclass TurnstileHandler {\n async verifyTurnstile(request: Request): Promise {\n try {\n const ip = request.headers.get(\"cf-connecting-ip\") || \n request.headers.get(\"x-forwarded-for\") || \n \"unknown\";\n const origin = request.headers.get(\"origin\") || \"\";\n\n // Parse request body\n const body = await request.json();\n const { token } = body;\n\n // Validate token format\n const validation = ValidationService.validateTurnstileToken(token);\n if (!validation.valid) {\n logger.warn(\"Invalid Turnstile token format\", { ip, error: validation.error });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: validation.error }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n // Verify token with Cloudflare Turnstile API\n const turnstileSecret = environment.TURNSTILE_SECRET_KEY;\n if (!turnstileSecret) {\n logger.error(\"Turnstile secret key not configured\");\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Turnstile verification not configured\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n const verificationResponse = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/x-www-form-urlencoded',\n },\n body: new URLSearchParams({\n secret: turnstileSecret,\n response: token,\n remoteip: ip\n })\n });\n\n const verificationResult = await verificationResponse.json();\n\n if (!verificationResult.success) {\n logger.warn(\"Turnstile verification failed\", { \n ip, \n errors: verificationResult['error-codes'] || [] \n });\n \n return addCorsHeaders(\n new Response(JSON.stringify({ \n success: false,\n error: \"Turnstile verification failed\",\n details: verificationResult['error-codes'] || []\n }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n }\n\n logger.info(\"Turnstile verification successful\", { ip });\n\n return addCorsHeaders(\n new Response(JSON.stringify({\n success: true,\n message: \"Turnstile verification successful\"\n }), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n origin\n );\n\n } catch (error) {\n logger.error(\"Error verifying Turnstile token\", { error: error.message });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n }\n}\n\nexport const turnstileHandler = new TurnstileHandler();\n",[],[150,239,264],{"_107":272,"_100":273,"_151":274,"_153":240,"_154":138,"_155":275,"_157":158,"_109":276,"_104":31,"_160":180,"_162":277,"_163":27,"_164":-5,"_165":278,"_103":279},"9fcf3648-58a9-11f0-bc15-f69ea79377d9","webhookHandler.ts","9fcf371a-58a9-11f0-bc15-f69ea79377d9",25,["D",1751614600232],"import { Database } from \"../database/database.ts\";\nimport { AuthService } from \"../services/authService.ts\";\nimport { addCorsHeaders } from \"../middleware/cors.ts\";\nimport { logger } from \"../utils/logger.ts\";\n\nexport interface WebhookResponse {\n id: string;\n timestamp: string;\n status: string;\n message: string;\n receivedAt: string;\n payloadSize: number;\n headers: Record;\n}\n\nclass WebhookHandler {\n /**\n * Generic webhook endpoint that accepts any JSON payload\n * Requires API key authentication via header or query parameter\n */\n async handleWebhook(request: Request, db: Database): Promise {\n try {\n // Validate API key\n const apiValidation = AuthService.validateApiKey(request);\n if (!apiValidation.valid) {\n logger.warn(\"Webhook unauthorized access attempt\", {\n ip: request.headers.get(\"x-forwarded-for\") || \"unknown\",\n userAgent: request.headers.get(\"user-agent\") || \"unknown\",\n error: apiValidation.error\n });\n \n return addCorsHeaders(\n new Response(JSON.stringify({ error: apiValidation.error }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n\n // Parse JSON payload\n let payload: any;\n try {\n payload = await request.json();\n } catch (error) {\n logger.warn(\"Webhook invalid JSON payload\", { error: error.message });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Invalid JSON payload\" }), {\n status: 400,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n\n // Generate webhook response\n const webhookId = crypto.randomUUID();\n const timestamp = new Date().toISOString();\n const payloadSize = JSON.stringify(payload).length;\n \n // Extract relevant headers for logging\n const relevantHeaders: Record = {};\n request.headers.forEach((value, key) => {\n if (key.toLowerCase().includes('content-') || \n key.toLowerCase().includes('x-') ||\n key.toLowerCase() === 'user-agent') {\n relevantHeaders[key] = value;\n }\n });\n\n // Log webhook receipt\n logger.info(\"Webhook received\", {\n id: webhookId,\n payloadSize,\n headers: relevantHeaders,\n ip: request.headers.get(\"x-forwarded-for\") || \"unknown\"\n });\n\n // Store webhook data (optional - for audit purposes)\n await db.execute(\n \"INSERT INTO webhook_logs (id, payload, headers, ip_address, timestamp) VALUES (?, ?, ?, ?, ?)\",\n [\n webhookId,\n JSON.stringify(payload),\n JSON.stringify(relevantHeaders),\n request.headers.get(\"x-forwarded-for\") || \"unknown\",\n timestamp\n ]\n );\n\n // Prepare response\n const response: WebhookResponse = {\n id: webhookId,\n timestamp,\n status: \"received\",\n message: \"Webhook processed successfully\",\n receivedAt: timestamp,\n payloadSize,\n headers: relevantHeaders\n };\n\n return addCorsHeaders(\n new Response(JSON.stringify(response), {\n status: 200,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n\n } catch (error) {\n logger.error(\"Webhook processing error\", { error: error.message });\n return addCorsHeaders(\n new Response(JSON.stringify({ error: \"Internal server error\" }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n }),\n request.headers.get(\"origin\") || undefined\n );\n }\n }\n\n /**\n * Generic callback endpoint - identical to webhook for flexibility\n */\n async handleCallback(request: Request, db: Database): Promise {\n // Callback is identical to webhook for maximum flexibility\n return this.handleWebhook(request, db);\n }\n}\n\nexport const webhookHandler = new WebhookHandler();",[],[150,239,273],[150,239],{"_107":282,"_100":283,"_151":284,"_153":152,"_154":138,"_155":285,"_157":158,"_109":286,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":287,"_103":315},"9e985f7a-58a9-11f0-bc5c-f69ea79377d9","middleware","9e986038-58a9-11f0-bc5c-f69ea79377d9",6,["D",1751614598193],[288,297,306],{"_107":289,"_100":290,"_151":291,"_153":284,"_154":138,"_155":292,"_157":158,"_109":293,"_104":31,"_160":180,"_162":294,"_163":27,"_164":-5,"_165":295,"_103":296},"9fe0a522-58a9-11f0-b6a5-f69ea79377d9","cors.ts","9fe0a658-58a9-11f0-b6a5-f69ea79377d9",26,["D",1751614600346],"import { environment } from \"../config/environment.ts\";\nimport { logger } from \"../utils/logger.ts\";\n\nconst ALLOWED_ORIGINS = environment.ALLOWED_ORIGINS;\nconst ALLOWED_METHODS = [\"GET\", \"POST\", \"OPTIONS\"];\nconst ALLOWED_HEADERS = [\"Content-Type\", \"X-Payment-Nonce\", \"Authorization\"];\n\nexport async function corsMiddleware(request: Request): Promise {\n const origin = request.headers.get(\"origin\");\n const method = request.method;\n\n // Handle preflight requests\n if (method === \"OPTIONS\") {\n const headers = new Headers();\n \n // Check if origin is allowed\n if (origin && ALLOWED_ORIGINS.includes(origin)) {\n headers.set(\"Access-Control-Allow-Origin\", origin);\n } else {\n headers.set(\"Access-Control-Allow-Origin\", ALLOWED_ORIGINS[0]); // Default to first allowed origin\n }\n \n headers.set(\"Access-Control-Allow-Methods\", ALLOWED_METHODS.join(\", \"));\n headers.set(\"Access-Control-Allow-Headers\", ALLOWED_HEADERS.join(\", \"));\n headers.set(\"Access-Control-Allow-Credentials\", \"true\");\n headers.set(\"Access-Control-Max-Age\", \"86400\"); // 24 hours\n\n return new Response(null, {\n status: 200,\n headers\n });\n }\n\n // Validate origin for non-preflight requests\n if (origin && !ALLOWED_ORIGINS.includes(origin)) {\n logger.warn(\"CORS violation - invalid origin\", { \n origin, \n ip: request.headers.get(\"cf-connecting-ip\") || \"unknown\" \n });\n \n return new Response(JSON.stringify({ error: \"CORS policy violation\" }), {\n status: 403,\n headers: { \"Content-Type\": \"application/json\" }\n });\n }\n\n // Allow the request to continue\n return null;\n}\n\nexport function addCorsHeaders(response: Response, origin?: string): Response {\n const headers = new Headers(response.headers);\n \n if (origin && ALLOWED_ORIGINS.includes(origin)) {\n headers.set(\"Access-Control-Allow-Origin\", origin);\n } else {\n headers.set(\"Access-Control-Allow-Origin\", ALLOWED_ORIGINS[0]);\n }\n \n headers.set(\"Access-Control-Allow-Credentials\", \"true\");\n\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers\n });\n}\n",[],[150,283,290],{"_107":298,"_100":299,"_151":300,"_153":284,"_154":138,"_155":301,"_157":158,"_109":302,"_104":31,"_160":180,"_162":303,"_163":27,"_164":-5,"_165":304,"_103":305},"9fea38da-58a9-11f0-b67c-f69ea79377d9","rateLimit.ts","9fea39ac-58a9-11f0-b67c-f69ea79377d9",27,["D",1751614600407],"import { Database } from \"../database/database.ts\";\nimport { logger } from \"../utils/logger.ts\";\n\ninterface RateLimitConfig {\n [endpoint: string]: {\n requests: number;\n windowMs: number;\n };\n}\n\nconst RATE_LIMITS: RateLimitConfig = {\n \"/api/create-payment-nonce\": {\n requests: 5,\n windowMs: 60 * 1000 // 1 minute\n },\n \"/api/create-payment-hash\": {\n requests: 10,\n windowMs: 60 * 1000 // 1 minute\n },\n \"/api/v1/payment/refresh\": {\n requests: 10,\n windowMs: 60 * 1000 // 1 minute\n },\n \"/api/v1/turnstile/verify\": {\n requests: 20,\n windowMs: 60 * 1000 // 1 minute\n }\n};\n\n// In-memory rate limiting for better performance\nconst rateLimitCache = new Map();\n\nexport async function rateLimitMiddleware(request: Request): Promise {\n const url = new URL(request.url);\n const endpoint = url.pathname;\n const ip = request.headers.get(\"cf-connecting-ip\") || \n request.headers.get(\"x-forwarded-for\") || \n request.headers.get(\"x-real-ip\") || \n \"unknown\";\n\n // Check if endpoint has rate limiting configured\n const limitConfig = RATE_LIMITS[endpoint];\n if (!limitConfig) {\n return null; // No rate limiting for this endpoint\n }\n\n const key = `${ip}:${endpoint}`;\n const now = Date.now();\n const currentWindow = Math.floor(now / limitConfig.windowMs);\n\n // Get or create rate limit entry\n let rateLimitEntry = rateLimitCache.get(key);\n \n if (!rateLimitEntry || rateLimitEntry.resetTime !== currentWindow) {\n // Create new window\n rateLimitEntry = {\n count: 0,\n resetTime: currentWindow\n };\n rateLimitCache.set(key, rateLimitEntry);\n }\n\n // Increment request count\n rateLimitEntry.count++;\n\n // Check if limit exceeded\n if (rateLimitEntry.count > limitConfig.requests) {\n logger.warn(\"Rate limit exceeded\", {\n ip,\n endpoint,\n count: rateLimitEntry.count,\n limit: limitConfig.requests\n });\n\n const resetTime = (currentWindow + 1) * limitConfig.windowMs;\n const retryAfter = Math.ceil((resetTime - now) / 1000);\n\n return new Response(JSON.stringify({\n error: \"Too many requests\",\n message: \"Rate limit exceeded. Please try again later.\",\n retryAfter\n }), {\n status: 429,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Retry-After\": retryAfter.toString(),\n \"X-RateLimit-Limit\": limitConfig.requests.toString(),\n \"X-RateLimit-Remaining\": Math.max(0, limitConfig.requests - rateLimitEntry.count).toString(),\n \"X-RateLimit-Reset\": resetTime.toString()\n }\n });\n }\n\n // Clean up old entries periodically\n if (Math.random() < 0.01) { // 1% chance to trigger cleanup\n cleanupRateLimitCache();\n }\n\n return null; // Allow request to continue\n}\n\nfunction cleanupRateLimitCache(): void {\n const now = Date.now();\n const cutoff = now - (60 * 60 * 1000); // 1 hour ago\n\n for (const [key, entry] of rateLimitCache.entries()) {\n const entryTime = entry.resetTime * Math.max(...Object.values(RATE_LIMITS).map(c => c.windowMs));\n if (entryTime < cutoff) {\n rateLimitCache.delete(key);\n }\n }\n}\n",[],[150,283,299],{"_107":307,"_100":308,"_151":309,"_153":284,"_154":138,"_155":310,"_157":158,"_109":311,"_104":31,"_160":180,"_162":312,"_163":27,"_164":-5,"_165":313,"_103":314},"9ff4ea5a-58a9-11f0-b33c-f69ea79377d9","security.ts","9ff4eb18-58a9-11f0-b33c-f69ea79377d9",28,["D",1751614600477],"import { logger } from \"../utils/logger.ts\";\nimport { environment } from \"../config/environment.ts\";\n\nexport async function securityMiddleware(request: Request): Promise {\n const url = new URL(request.url);\n const ip = request.headers.get(\"cf-connecting-ip\") || \n request.headers.get(\"x-forwarded-for\") || \n \"unknown\";\n const userAgent = request.headers.get(\"user-agent\") || \"\";\n const referer = request.headers.get(\"referer\") || \"\";\n const origin = request.headers.get(\"origin\") || \"\";\n\n // Basic security headers validation\n const securityViolations: string[] = [];\n\n // Check for suspicious user agents\n const suspiciousPatterns = [\n /bot/i,\n /crawler/i,\n /spider/i,\n /scraper/i,\n /hack/i,\n /exploit/i\n ];\n\n if (suspiciousPatterns.some(pattern => pattern.test(userAgent))) {\n securityViolations.push(\"suspicious_user_agent\");\n }\n\n // Validate referer for sensitive endpoints\n const sensitiveEndpoints = [\n \"/api/create-payment-nonce\",\n \"/api/create-payment-hash\"\n ];\n\n if (sensitiveEndpoints.includes(url.pathname)) {\n if (referer && !environment.ALLOWED_ORIGINS.some(allowedOrigin => \n referer.startsWith(allowedOrigin)\n )) {\n securityViolations.push(\"invalid_referer\");\n }\n\n if (origin && !environment.ALLOWED_ORIGINS.includes(origin)) {\n securityViolations.push(\"invalid_origin\");\n }\n }\n\n // Check for common attack patterns in headers\n const dangerousPatterns = [\n /\n \n \n\n\n

\n \n\n\n\n`,\n {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n },\n },\n );\n}",[],[488],"files",[148,167,174,184,194,201,210,220,227,237,244,253,262,271,281,288,297,306,316,323,332,341,350,359,369,376,386,393,402,411,422,432,441,450,459,468,477,486],"counts",{"_499":31,"_500":156,"_501":31,"_502":156},"pulls","branches","forks","envVars","contents",[505,508,511,514,517,520,523,526,529],{"_107":149,"_100":150,"_151":152,"_153":-5,"_154":138,"_155":156,"_157":158,"_109":506,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":507},["D",1751614596799],[150],{"_107":423,"_100":424,"_151":425,"_153":-5,"_154":138,"_155":426,"_157":158,"_109":509,"_104":31,"_160":428,"_162":429,"_163":27,"_164":-5,"_103":510},["D",1751614599270],[424],{"_107":433,"_100":434,"_151":435,"_153":-5,"_154":138,"_155":436,"_157":158,"_109":512,"_104":31,"_160":428,"_162":438,"_163":27,"_164":-5,"_103":513},["D",1751614599490],[434],{"_107":442,"_100":443,"_151":444,"_153":-5,"_154":138,"_155":445,"_157":158,"_109":515,"_104":31,"_160":428,"_162":447,"_163":27,"_164":-5,"_103":516},["D",1751614599269],[443],{"_107":451,"_100":452,"_151":453,"_153":-5,"_154":138,"_155":454,"_157":158,"_109":518,"_104":31,"_160":428,"_162":456,"_163":27,"_164":-5,"_103":519},["D",1751614599606],[452],{"_107":460,"_100":461,"_151":462,"_153":-5,"_154":138,"_155":463,"_157":158,"_109":521,"_104":31,"_160":428,"_162":465,"_163":27,"_164":-5,"_103":522},["D",1751614599273],[461],{"_107":469,"_100":470,"_151":471,"_153":-5,"_154":138,"_155":137,"_157":158,"_109":524,"_104":156,"_160":473,"_162":474,"_163":27,"_164":-5,"_103":525},["D",1751614652240],[470],{"_107":478,"_100":479,"_151":480,"_153":-5,"_154":138,"_155":481,"_157":158,"_109":527,"_104":31,"_160":428,"_162":483,"_163":27,"_164":-5,"_103":528},["D",1751614599561],[479],{"_107":487,"_100":488,"_151":489,"_153":-5,"_154":138,"_155":490,"_157":158,"_109":530,"_104":31,"_160":180,"_162":492,"_163":27,"_164":-5,"_103":531},["D",1751614601128],[488],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","routes/_app.x.$handle.$name.code.$",{"_98":99,"_100":101,"_102":42,"_104":-7,"_103":73,"_105":538,"_146":542,"_495":657,"_428":-7,"_503":658,"_677":-5,"_678":27,"_679":-5,"_680":-5,"_681":-5,"_682":683},{"_107":108,"_100":101,"_109":539,"_111":-5,"_112":27,"_113":114,"_115":73,"_116":-5,"_12":117,"_118":-5,"_119":27,"_120":-5,"_121":31,"_122":123,"_124":123,"_125":126,"_127":126,"_128":126,"_129":123,"_130":123,"_131":27,"_21":540,"_135":541},["D",1751614495896],{"_98":99,"_133":134},{"_104":137,"_100":42,"_107":138,"_139":108,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":101,"_145":99},[543,633,636,639,642,645,648,651,654],{"_107":149,"_100":150,"_151":152,"_153":-5,"_154":138,"_155":156,"_157":158,"_109":159,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":544,"_103":632},[545,554,563,569,584,596,614,620],{"_107":168,"_100":169,"_151":170,"_153":152,"_154":138,"_155":171,"_157":158,"_109":172,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":546,"_103":553},[547,550],{"_107":175,"_100":176,"_151":177,"_153":170,"_154":138,"_155":178,"_157":158,"_109":179,"_104":31,"_160":180,"_162":181,"_163":27,"_164":-5,"_165":548,"_103":549},[],[150,169,176],{"_107":185,"_100":186,"_151":187,"_153":170,"_154":138,"_155":188,"_157":158,"_109":189,"_104":31,"_160":180,"_162":190,"_163":27,"_164":-5,"_165":551,"_103":552},[],[150,169,186],[150,169],{"_107":195,"_100":196,"_151":197,"_153":152,"_154":138,"_155":198,"_157":158,"_109":199,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":555,"_103":562},[556,559],{"_107":202,"_100":203,"_151":204,"_153":197,"_154":138,"_155":205,"_157":158,"_109":206,"_104":31,"_160":180,"_162":207,"_163":27,"_164":-5,"_165":557,"_103":558},[],[150,196,203],{"_107":211,"_100":212,"_151":213,"_153":197,"_154":138,"_155":214,"_157":158,"_109":215,"_104":31,"_160":180,"_162":216,"_163":27,"_164":-5,"_165":560,"_103":561},[],[150,196,212],[150,196],{"_107":221,"_100":222,"_151":223,"_153":152,"_154":138,"_155":224,"_157":158,"_109":225,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":564,"_103":568},[565],{"_107":228,"_100":229,"_151":230,"_153":223,"_154":138,"_155":231,"_157":158,"_109":232,"_104":31,"_160":180,"_162":233,"_163":27,"_164":-5,"_165":566,"_103":567},[],[150,222,229],[150,222],{"_107":238,"_100":239,"_151":240,"_153":152,"_154":138,"_155":241,"_157":158,"_109":242,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":570,"_103":583},[571,574,577,580],{"_107":245,"_100":246,"_151":247,"_153":240,"_154":138,"_155":248,"_157":158,"_109":249,"_104":31,"_160":180,"_162":250,"_163":27,"_164":-5,"_165":572,"_103":573},[],[150,239,246],{"_107":254,"_100":255,"_151":256,"_153":240,"_154":138,"_155":257,"_157":158,"_109":258,"_104":31,"_160":180,"_162":259,"_163":27,"_164":-5,"_165":575,"_103":576},[],[150,239,255],{"_107":263,"_100":264,"_151":265,"_153":240,"_154":138,"_155":266,"_157":158,"_109":267,"_104":31,"_160":180,"_162":268,"_163":27,"_164":-5,"_165":578,"_103":579},[],[150,239,264],{"_107":272,"_100":273,"_151":274,"_153":240,"_154":138,"_155":275,"_157":158,"_109":276,"_104":31,"_160":180,"_162":277,"_163":27,"_164":-5,"_165":581,"_103":582},[],[150,239,273],[150,239],{"_107":282,"_100":283,"_151":284,"_153":152,"_154":138,"_155":285,"_157":158,"_109":286,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":585,"_103":595},[586,589,592],{"_107":289,"_100":290,"_151":291,"_153":284,"_154":138,"_155":292,"_157":158,"_109":293,"_104":31,"_160":180,"_162":294,"_163":27,"_164":-5,"_165":587,"_103":588},[],[150,283,290],{"_107":298,"_100":299,"_151":300,"_153":284,"_154":138,"_155":301,"_157":158,"_109":302,"_104":31,"_160":180,"_162":303,"_163":27,"_164":-5,"_165":590,"_103":591},[],[150,283,299],{"_107":307,"_100":308,"_151":309,"_153":284,"_154":138,"_155":310,"_157":158,"_109":311,"_104":31,"_160":180,"_162":312,"_163":27,"_164":-5,"_165":593,"_103":594},[],[150,283,308],[150,283],{"_107":317,"_100":318,"_151":319,"_153":152,"_154":138,"_155":320,"_157":158,"_109":321,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":597,"_103":613},[598,601,604,607,610],{"_107":324,"_100":325,"_151":326,"_153":319,"_154":138,"_155":327,"_157":158,"_109":328,"_104":31,"_160":180,"_162":329,"_163":27,"_164":-5,"_165":599,"_103":600},[],[150,318,325],{"_107":333,"_100":334,"_151":335,"_153":319,"_154":138,"_155":336,"_157":158,"_109":337,"_104":31,"_160":180,"_162":338,"_163":27,"_164":-5,"_165":602,"_103":603},[],[150,318,334],{"_107":342,"_100":343,"_151":344,"_153":319,"_154":138,"_155":345,"_157":158,"_109":346,"_104":31,"_160":180,"_162":347,"_163":27,"_164":-5,"_165":605,"_103":606},[],[150,318,343],{"_107":351,"_100":352,"_151":353,"_153":319,"_154":138,"_155":354,"_157":158,"_109":355,"_104":31,"_160":180,"_162":356,"_163":27,"_164":-5,"_165":608,"_103":609},[],[150,318,352],{"_107":360,"_100":361,"_151":362,"_153":319,"_154":138,"_155":363,"_157":158,"_109":364,"_104":31,"_160":180,"_162":365,"_163":27,"_164":-5,"_165":611,"_103":612},[],[150,318,361],[150,318],{"_107":370,"_100":371,"_151":372,"_153":152,"_154":138,"_155":373,"_157":158,"_109":374,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":615,"_103":619},[616],{"_107":377,"_100":378,"_151":379,"_153":372,"_154":138,"_155":380,"_157":158,"_109":381,"_104":31,"_160":180,"_162":382,"_163":27,"_164":-5,"_165":617,"_103":618},[],[150,371,378],[150,371],{"_107":387,"_100":388,"_151":389,"_153":152,"_154":138,"_155":390,"_157":158,"_109":391,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_165":621,"_103":631},[622,625,628],{"_107":394,"_100":395,"_151":396,"_153":389,"_154":138,"_155":397,"_157":158,"_109":398,"_104":31,"_160":180,"_162":399,"_163":27,"_164":-5,"_165":623,"_103":624},[],[150,388,395],{"_107":403,"_100":404,"_151":405,"_153":389,"_154":138,"_155":406,"_157":158,"_109":407,"_104":31,"_160":180,"_162":408,"_163":27,"_164":-5,"_165":626,"_103":627},[],[150,388,404],{"_107":412,"_100":413,"_151":414,"_153":389,"_154":138,"_155":415,"_157":158,"_109":416,"_104":31,"_160":180,"_162":417,"_163":27,"_164":-5,"_165":629,"_103":630},[],[150,388,413],[150,388],[150],{"_107":423,"_100":424,"_151":425,"_153":-5,"_154":138,"_155":426,"_157":158,"_109":427,"_104":31,"_160":428,"_162":429,"_163":27,"_164":-5,"_165":634,"_103":635},[],[424],{"_107":433,"_100":434,"_151":435,"_153":-5,"_154":138,"_155":436,"_157":158,"_109":437,"_104":31,"_160":428,"_162":438,"_163":27,"_164":-5,"_165":637,"_103":638},[],[434],{"_107":442,"_100":443,"_151":444,"_153":-5,"_154":138,"_155":445,"_157":158,"_109":446,"_104":31,"_160":428,"_162":447,"_163":27,"_164":-5,"_165":640,"_103":641},[],[443],{"_107":451,"_100":452,"_151":453,"_153":-5,"_154":138,"_155":454,"_157":158,"_109":455,"_104":31,"_160":428,"_162":456,"_163":27,"_164":-5,"_165":643,"_103":644},[],[452],{"_107":460,"_100":461,"_151":462,"_153":-5,"_154":138,"_155":463,"_157":158,"_109":464,"_104":31,"_160":428,"_162":465,"_163":27,"_164":-5,"_165":646,"_103":647},[],[461],{"_107":469,"_100":470,"_151":471,"_153":-5,"_154":138,"_155":137,"_157":158,"_109":472,"_104":156,"_160":473,"_162":474,"_163":27,"_164":-5,"_165":649,"_103":650},[],[470],{"_107":478,"_100":479,"_151":480,"_153":-5,"_154":138,"_155":481,"_157":158,"_109":482,"_104":31,"_160":428,"_162":483,"_163":27,"_164":-5,"_165":652,"_103":653},[],[479],{"_107":487,"_100":488,"_151":489,"_153":-5,"_154":138,"_155":490,"_157":158,"_109":491,"_104":31,"_160":180,"_162":492,"_163":27,"_164":-5,"_165":655,"_103":656},[],[488],[543,545,547,550,554,556,559,563,565,569,571,574,577,580,584,586,589,592,596,598,601,604,607,610,614,616,620,622,625,628,633,636,639,642,645,648,651,654],[659,661,663,665,667,669,671,673,675],{"_107":149,"_100":150,"_151":152,"_153":-5,"_154":138,"_155":156,"_157":158,"_109":506,"_104":31,"_160":161,"_162":-5,"_163":27,"_164":-5,"_103":660},[150],{"_107":423,"_100":424,"_151":425,"_153":-5,"_154":138,"_155":426,"_157":158,"_109":509,"_104":31,"_160":428,"_162":429,"_163":27,"_164":-5,"_103":662},[424],{"_107":433,"_100":434,"_151":435,"_153":-5,"_154":138,"_155":436,"_157":158,"_109":512,"_104":31,"_160":428,"_162":438,"_163":27,"_164":-5,"_103":664},[434],{"_107":442,"_100":443,"_151":444,"_153":-5,"_154":138,"_155":445,"_157":158,"_109":515,"_104":31,"_160":428,"_162":447,"_163":27,"_164":-5,"_103":666},[443],{"_107":451,"_100":452,"_151":453,"_153":-5,"_154":138,"_155":454,"_157":158,"_109":518,"_104":31,"_160":428,"_162":456,"_163":27,"_164":-5,"_103":668},[452],{"_107":460,"_100":461,"_151":462,"_153":-5,"_154":138,"_155":463,"_157":158,"_109":521,"_104":31,"_160":428,"_162":465,"_163":27,"_164":-5,"_103":670},[461],{"_107":469,"_100":470,"_151":471,"_153":-5,"_154":138,"_155":137,"_157":158,"_109":524,"_104":156,"_160":473,"_162":474,"_163":27,"_164":-5,"_103":672},[470],{"_107":478,"_100":479,"_151":480,"_153":-5,"_154":138,"_155":481,"_157":158,"_109":527,"_104":31,"_160":428,"_162":483,"_163":27,"_164":-5,"_103":674},[479],{"_107":487,"_100":488,"_151":489,"_153":-5,"_154":138,"_155":490,"_157":158,"_109":530,"_104":31,"_160":180,"_162":492,"_163":27,"_164":-5,"_103":676},[488],"upstream","showCompareCallout","pull","ahead","behind","templates",[],"routes/_app","actionData","errors"]