@axiom-lattice/gateway 8.3.0 → 9.0.0

package/dist/chunk-NYYSBNDG.mjs

@@ -0,0 +1,575 @@
+import {
+  A2AAuthError
+} from "./chunk-LCM4OQTI.mjs";
+
+// src/routes/a2a.ts
+import { getStoreLattice, getReplicaId } from "@axiom-lattice/core";
+
+// src/services/a2aKeySync.ts
+var A2A_KEY_CHANGED_TOPIC = "a2a-key-changed";
+async function publishA2AKeyChanged(outbox, owner, tenantId) {
+  if (!tenantId) return;
+  try {
+    await outbox.append({
+      topic: A2A_KEY_CHANGED_TOPIC,
+      payload: { tenantId },
+      originReplicaId: owner
+    });
+  } catch {
+  }
+}
+async function handleA2AKeyChanged(payload, reload) {
+  const tenantId = payload?.tenantId;
+  if (typeof tenantId !== "string" || tenantId.length === 0) return;
+  await reload();
+}
+
+// src/services/collaboration/ProjectAccessService.ts
+import { randomUUID } from "crypto";
+var ProjectCollaborationError = class extends Error {
+  /** Creates a project collaboration error. */
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "ProjectCollaborationError";
+  }
+};
+var allowedRoles = {
+  read: /* @__PURE__ */ new Set(["owner", "admin", "member", "viewer"]),
+  send: /* @__PURE__ */ new Set(["owner", "admin", "member"]),
+  manage: /* @__PURE__ */ new Set(["owner", "admin"])
+};
+var membershipConflictNames = /* @__PURE__ */ new Set([
+  "DuplicateProjectMembershipError",
+  "ProjectMembershipIdConflictError"
+]);
+function isProjectMembershipConflict(error) {
+  return error instanceof Error && membershipConflictNames.has(error.name);
+}
+var ProjectAccessService = class {
+  /** Creates a project access service from explicitly injected stores. */
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? randomUUID;
+  }
+  /** Returns the project and active membership when the user has the requested capability. */
+  async requireProjectAccess(input) {
+    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
+    if (!project) {
+      throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    }
+    if (project.kind === "public") {
+      return this.requirePublicProjectAccess(project, input);
+    }
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (project.kind === "personal") {
+      if (!this.isActiveMembership(membership, input)) this.accessDenied();
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    if (this.isActiveMembership(membership, input) && this.hasCapability(membership, input.capability)) {
+      return { project, membership };
+    }
+    const tenantAdmin = await this.tenantAdminMembership(project, input);
+    if (this.isActiveMembership(membership, input)) {
+      if (tenantAdmin) return { project, membership: tenantAdmin };
+      this.requireCapability(membership, input.capability);
+    }
+    const memberships = await this.deps.membershipStore.list(input.tenantId, input.projectId);
+    if (memberships.length !== 0) {
+      if (tenantAdmin) return { project, membership: tenantAdmin };
+      this.accessDenied();
+    }
+    if (!tenantAdmin) this.accessDenied();
+    let claim;
+    try {
+      claim = await this.deps.membershipStore.createInitialOwner({
+        id: this.idFactory(),
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        userId: input.userId
+      });
+    } catch (error) {
+      if (isProjectMembershipConflict(error)) {
+        throw new ProjectCollaborationError(
+          "PROJECT_MEMBERSHIP_CONFLICT",
+          409,
+          "Project membership could not be initialized"
+        );
+      }
+      throw error;
+    }
+    if (claim.kind === "created" || claim.kind === "existing") {
+      return { project, membership: claim.membership };
+    }
+    const racedMembership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (racedMembership?.status !== "active") this.accessDenied();
+    this.requireCapability(racedMembership, input.capability);
+    return { project, membership: racedMembership };
+  }
+  /** Authorizes an already-existing membership, or any tenant member for public rooms; never mutates persistence. */
+  async requireExistingProjectAccess(input) {
+    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
+    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    if (project.kind === "public") {
+      return this.requireExistingPublicProjectAccess(project, input);
+    }
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    const activeMembership = this.isActiveMembership(membership, input) ? membership : void 0;
+    if (project.kind === "personal") {
+      if (!activeMembership) this.accessDenied();
+      this.requireCapability(activeMembership, input.capability);
+      return { project, membership: activeMembership };
+    }
+    if (activeMembership && this.hasCapability(activeMembership, input.capability)) {
+      return { project, membership: activeMembership };
+    }
+    const tenantAdmin = await this.tenantAdminMembership(project, input);
+    if (tenantAdmin) return { project, membership: tenantAdmin };
+    if (activeMembership) this.requireCapability(activeMembership, input.capability);
+    this.accessDenied();
+  }
+  /**
+   * Authorizes roster visibility for any active participant (owner/admin/member/viewer).
+   * Mutating the roster requires `manage` separately; reading it never does, because every
+   * room participant needs the member list to render the room and derive their own capabilities.
+   */
+  async requireRosterAccess(input) {
+    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
+    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    return this.requireProjectAccess({
+      ...input,
+      capability: "read"
+    });
+  }
+  /** Returns projects in a workspace that the user may read. */
+  async listReadableProjects(input) {
+    const [tenantLink, projects] = await Promise.all([
+      this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId),
+      this.deps.projectStore.getProjectsByWorkspace(input.tenantId, input.workspaceId)
+    ]);
+    const filtered = input.kind ? projects.filter((project) => (project.kind ?? "business") === input.kind) : projects;
+    const isTenantAdmin = tenantLink?.role === "owner" || tenantLink?.role === "admin";
+    const visible = [];
+    for (const project of filtered) {
+      if (project.kind === "public") {
+        if (tenantLink || await this.hasActiveMembership(input.tenantId, project.id, input.userId)) {
+          visible.push(project);
+        }
+        continue;
+      }
+      if (project.kind === "personal") {
+        if (await this.hasActiveMembership(input.tenantId, project.id, input.userId)) {
+          visible.push(project);
+        }
+        continue;
+      }
+      if (isTenantAdmin || await this.hasActiveMembership(input.tenantId, project.id, input.userId)) {
+        visible.push(project);
+      }
+    }
+    return visible;
+  }
+  async hasActiveMembership(tenantId, projectId, userId) {
+    const membership = await this.deps.membershipStore.findByUser(tenantId, projectId, userId);
+    return this.matchesActiveMembership(membership, tenantId, projectId, userId);
+  }
+  matchesActiveMembership(membership, tenantId, projectId, userId) {
+    return membership != null && membership.tenantId === tenantId && membership.projectId === projectId && membership.userId === userId && membership.status === "active";
+  }
+  async requirePublicProjectAccess(project, input) {
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      if (this.hasCapability(membership, input.capability)) return { project, membership };
+      const tenantAdmin = await this.tenantAdminMembership(project, input);
+      if (tenantAdmin) return { project, membership: tenantAdmin };
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    const materialized = await this.materializePublicMembership(input);
+    this.requireCapability(materialized, input.capability);
+    return { project, membership: materialized };
+  }
+  async requireExistingPublicProjectAccess(project, input) {
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      if (this.hasCapability(membership, input.capability)) return { project, membership };
+      const tenantAdmin = await this.tenantAdminMembership(project, input);
+      if (tenantAdmin) return { project, membership: tenantAdmin };
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (!tenantLink) this.accessDenied();
+    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
+    const synthetic = {
+      id: `public:${input.userId}`,
+      tenantId: input.tenantId,
+      projectId: input.projectId,
+      userId: input.userId,
+      role,
+      status: "active",
+      joinedAt: project.createdAt,
+      updatedAt: project.updatedAt
+    };
+    this.requireCapability(synthetic, input.capability);
+    return { project, membership: synthetic };
+  }
+  async materializePublicMembership(input) {
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (!tenantLink) this.accessDenied();
+    const existing = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (existing) this.accessDenied();
+    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
+    try {
+      return await this.deps.membershipStore.create({
+        id: this.idFactory(),
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        userId: input.userId,
+        role,
+        status: "active"
+      });
+    } catch (error) {
+      if (isProjectMembershipConflict(error)) {
+        const raced = await this.deps.membershipStore.findByUser(
+          input.tenantId,
+          input.projectId,
+          input.userId
+        );
+        if (raced?.status === "active") return raced;
+      }
+      throw error;
+    }
+  }
+  hasCapability(membership, capability) {
+    return allowedRoles[capability].has(membership.role);
+  }
+  requireCapability(membership, capability) {
+    if (!this.hasCapability(membership, capability)) this.accessDenied();
+  }
+  async tenantAdminMembership(project, input) {
+    if (project.kind === "personal") return void 0;
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (tenantLink?.role !== "owner" && tenantLink?.role !== "admin") return void 0;
+    return {
+      id: `tenant-admin:${input.userId}`,
+      tenantId: input.tenantId,
+      projectId: project.id,
+      userId: input.userId,
+      role: "admin",
+      status: "active",
+      joinedAt: project.createdAt,
+      updatedAt: project.updatedAt
+    };
+  }
+  isActiveMembership(membership, input) {
+    return this.matchesActiveMembership(
+      membership,
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+  }
+  accessDenied() {
+    throw new ProjectCollaborationError("PROJECT_ACCESS_DENIED", 403, "Project access denied");
+  }
+};
+
+// src/routes/a2a.ts
+var _a2aKeyStore = null;
+var _a2aAuthService = null;
+var _a2aProjectAccess = null;
+function setA2AProjectAccess(authorizer) {
+  _a2aProjectAccess = authorizer;
+}
+function setA2AKeyStore(store) {
+  _a2aKeyStore = store;
+}
+function setA2AAuthService(service) {
+  _a2aAuthService = service;
+}
+async function refreshStoreKeyMap() {
+  if (_a2aAuthService) await _a2aAuthService.refresh();
+}
+function broadcastA2AKeyChanged(tenantId) {
+  if (!tenantId) return;
+  try {
+    const outbox = getStoreLattice("default", "outbox").store;
+    void publishA2AKeyChanged(outbox, getReplicaId(), tenantId);
+  } catch {
+  }
+}
+async function requireTenantSession(request, reply) {
+  if (!getUserTenantId(request) || !getUserId(request)) {
+    await reply.status(401).send({
+      success: false,
+      code: "UNAUTHORIZED",
+      error: "Unauthorized"
+    });
+  }
+}
+async function authorizeProjectBinding(request, reply, projectId) {
+  const tenantId = getUserTenantId(request);
+  const userId = getUserId(request);
+  if (!tenantId || !userId) {
+    await reply.status(401).send({
+      success: false,
+      code: "UNAUTHORIZED",
+      error: "Unauthorized"
+    });
+    return false;
+  }
+  if (!_a2aProjectAccess) {
+    await reply.status(500).send({ success: false, error: "Project access not configured" });
+    return false;
+  }
+  try {
+    await _a2aProjectAccess.requireExistingProjectAccess({
+      tenantId,
+      userId,
+      projectId,
+      capability: "read"
+    });
+    return true;
+  } catch (error) {
+    if (error instanceof ProjectCollaborationError) {
+      await reply.status(404).send({
+        success: false,
+        code: "PROJECT_NOT_FOUND",
+        error: "Project not found"
+      });
+      return false;
+    }
+    throw error;
+  }
+}
+async function authorizeKeyMutation(request, reply) {
+  if (!_a2aKeyStore) {
+    await reply.status(501).send({ error: "Key store not configured" });
+    return null;
+  }
+  const record = await _a2aKeyStore.findById(request.params.id);
+  if (!record) {
+    await reply.status(404).send({ success: false, error: "A2A API key not found" });
+    return null;
+  }
+  if (record.tenantId !== getUserTenantId(request)) {
+    await reply.status(403).send({ success: false, error: "Forbidden" });
+    return null;
+  }
+  return record;
+}
+function getUserTenantId(request) {
+  return request.user?.tenantId;
+}
+function getUserId(request) {
+  return request.user?.id;
+}
+async function handleApiKeyList(request, reply) {
+  if (!_a2aKeyStore) {
+    reply.status(501).send({ error: "Key store not configured" });
+    return;
+  }
+  const records = await _a2aKeyStore.list({
+    tenantId: getUserTenantId(request),
+    limit: request.query.limit ? parseInt(request.query.limit, 10) : void 0,
+    offset: request.query.offset ? parseInt(request.query.offset, 10) : void 0
+  });
+  reply.status(200).send({
+    success: true,
+    data: {
+      records: records.map((r) => ({ ...r, key: r.key.slice(0, 8) + "..." })),
+      total: records.length
+    }
+  });
+}
+async function handleApiKeyCreate(request, reply) {
+  if (!_a2aKeyStore || !_a2aAuthService) {
+    reply.status(501).send({ error: "Key store not configured" });
+    return;
+  }
+  const body = request.body;
+  if (body.projectId === "") {
+    reply.status(400).send({ success: false, error: "projectId is required" });
+    return;
+  }
+  const tenantId = getUserTenantId(request);
+  if (body.projectId && !await authorizeProjectBinding(request, reply, body.projectId)) {
+    return;
+  }
+  try {
+    const record = await _a2aAuthService.createKeyScoped({
+      tenantId,
+      projectId: body.projectId,
+      assistantIds: body.assistantIds,
+      grants: body.grants,
+      label: body.label
+    });
+    await refreshStoreKeyMap();
+    broadcastA2AKeyChanged(tenantId);
+    reply.status(201).send({ success: true, data: record });
+  } catch (err) {
+    if (err instanceof A2AAuthError) {
+      reply.status(err.statusCode).send({ success: false, error: err.message });
+      return;
+    }
+    request.log.error({ err }, "a2a:keys:create");
+    reply.status(500).send({ success: false, error: "Failed to create key" });
+  }
+}
+async function handleApiKeyUpdate(request, reply) {
+  if (!_a2aKeyStore || !_a2aAuthService) {
+    reply.status(501).send({ error: "Key store not configured" });
+    return;
+  }
+  const existing = await authorizeKeyMutation(request, reply);
+  if (!existing) return;
+  const body = request.body;
+  if (body.projectId === "") {
+    reply.status(400).send({ success: false, error: "projectId must not be empty" });
+    return;
+  }
+  const projectChanged = body.projectId !== void 0 && body.projectId !== existing.projectId;
+  const permissionsChanged = body.assistantIds !== void 0 || body.grants !== void 0;
+  if (projectChanged || permissionsChanged) {
+    const targetProjectId = projectChanged ? body.projectId : existing.projectId;
+    if (!await authorizeProjectBinding(request, reply, targetProjectId)) return;
+  }
+  const tenantId = getUserTenantId(request);
+  try {
+    const record = await _a2aAuthService.updateKeyScoped(
+      request.params.id,
+      tenantId,
+      {
+        label: body.label,
+        projectId: body.projectId,
+        assistantIds: body.assistantIds,
+        grants: body.grants
+      }
+    );
+    await refreshStoreKeyMap();
+    broadcastA2AKeyChanged(tenantId);
+    reply.status(200).send({ success: true, data: record });
+  } catch (err) {
+    if (err instanceof A2AAuthError) {
+      reply.status(err.statusCode).send({ success: false, error: err.message });
+      return;
+    }
+    request.log.error({ err }, "a2a:keys:update");
+    reply.status(500).send({ success: false, error: "Failed to update key" });
+  }
+}
+async function handleApiKeyDelete(request, reply) {
+  const record = await authorizeKeyMutation(request, reply);
+  if (!record) return;
+  await _a2aKeyStore.delete(request.params.id);
+  await refreshStoreKeyMap();
+  broadcastA2AKeyChanged(record.tenantId);
+  reply.status(200).send({ success: true });
+}
+async function handleApiKeyDisable(request, reply) {
+  const record = await authorizeKeyMutation(request, reply);
+  if (!record) return;
+  await _a2aKeyStore.disable(request.params.id);
+  await refreshStoreKeyMap();
+  broadcastA2AKeyChanged(record.tenantId);
+  reply.status(200).send({ success: true });
+}
+async function handleApiKeyEnable(request, reply) {
+  const record = await authorizeKeyMutation(request, reply);
+  if (!record) return;
+  await _a2aKeyStore.enable(request.params.id);
+  await refreshStoreKeyMap();
+  broadcastA2AKeyChanged(record.tenantId);
+  reply.status(200).send({ success: true });
+}
+async function handleApiKeyRotate(request, reply) {
+  const record = await authorizeKeyMutation(request, reply);
+  if (!record) return;
+  if (!await authorizeProjectBinding(request, reply, record.projectId)) return;
+  const rotated = await _a2aKeyStore.rotate(request.params.id);
+  await refreshStoreKeyMap();
+  broadcastA2AKeyChanged(record.tenantId);
+  reply.status(200).send({ success: true, data: rotated });
+}
+function registerA2ARoutes(app) {
+  const options = { preHandler: requireTenantSession };
+  for (const base of ["/api/keys", "/api/a2a/keys"]) {
+    app.get(
+      base,
+      options,
+      handleApiKeyList
+    );
+    app.post(
+      base,
+      options,
+      handleApiKeyCreate
+    );
+    app.delete(
+      `${base}/:id`,
+      options,
+      handleApiKeyDelete
+    );
+    app.post(
+      `${base}/:id/disable`,
+      options,
+      handleApiKeyDisable
+    );
+    app.post(
+      `${base}/:id/enable`,
+      options,
+      handleApiKeyEnable
+    );
+    app.post(
+      `${base}/:id/rotate`,
+      options,
+      handleApiKeyRotate
+    );
+    app.patch(
+      `${base}/:id`,
+      options,
+      handleApiKeyUpdate
+    );
+  }
+}
+
+export {
+  ProjectCollaborationError,
+  ProjectAccessService,
+  A2A_KEY_CHANGED_TOPIC,
+  publishA2AKeyChanged,
+  handleA2AKeyChanged,
+  setA2AProjectAccess,
+  setA2AKeyStore,
+  setA2AAuthService,
+  refreshStoreKeyMap,
+  broadcastA2AKeyChanged,
+  registerA2ARoutes
+};
+//# sourceMappingURL=chunk-NYYSBNDG.mjs.map

package/dist/chunk-NYYSBNDG.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/routes/a2a.ts","../src/services/a2aKeySync.ts","../src/services/collaboration/ProjectAccessService.ts"],"sourcesContent":["import type { FastifyInstance, FastifyRequest, FastifyReply } from \"fastify\";\nimport type {\n  A2AApiKeyRecord,\n  A2AApiKeyStore,\n  CreateA2AApiKeyInput,\n  OutboxStore,\n} from \"@axiom-lattice/protocols\";\nimport { getStoreLattice, getReplicaId } from \"@axiom-lattice/core\";\nimport { A2AAuthError } from \"../services/a2a/A2AAuthService\";\nimport type { A2AAuthService } from \"../services/a2a/A2AAuthService\";\nimport { publishA2AKeyChanged } from \"../services/a2aKeySync\";\nimport { ProjectCollaborationError } from \"../services/collaboration/ProjectAccessService\";\n\n// ─── Key Store ────────────────────────────────────────────────────────────\n\nlet _a2aKeyStore: A2AApiKeyStore | null = null;\nlet _a2aAuthService: A2AAuthService | null = null;\n\n/** Authorizer contract used by A2A key project binding mutations. */\nexport type ProjectReadAuthorizer = {\n  requireExistingProjectAccess(input: {\n    tenantId: string;\n    userId: string;\n    projectId: string;\n    capability: \"read\";\n  }): Promise<unknown>;\n};\n\nlet _a2aProjectAccess: ProjectReadAuthorizer | null = null;\n\n/** Inject the workspace project authorizer used by key binding mutations. */\nexport function setA2AProjectAccess(authorizer: ProjectReadAuthorizer): void {\n  _a2aProjectAccess = authorizer;\n}\n\n/** Inject the A2A key store used by the keys management routes. */\nexport function setA2AKeyStore(store: A2AApiKeyStore): void {\n  _a2aKeyStore = store;\n}\n\n/** Inject the A2A auth service used to create keys and refresh the key cache. */\nexport function setA2AAuthService(service: A2AAuthService): void {\n  _a2aAuthService = service;\n}\n\n/**\n * Reload cached key maps after a keys CRUD mutation. Delegates to the auth\n * service's key-map cache so authentication reflects the latest keys without\n * hitting the store on every request.\n */\nexport async function refreshStoreKeyMap(): Promise<void> {\n  if (_a2aAuthService) await _a2aAuthService.refresh();\n}\n\n/**\n * Best-effort broadcast of an A2A key change so peer replicas reload their key map.\n *\n * @param tenantId Tenant whose keys changed.\n * @remarks Fire-and-forget; never affects the request outcome.\n */\nexport function broadcastA2AKeyChanged(tenantId: string | undefined): void {\n  if (!tenantId) return;\n  try {\n    const outbox = getStoreLattice(\"default\", \"outbox\").store as OutboxStore;\n    void publishA2AKeyChanged(outbox, getReplicaId(), tenantId);\n  } catch {\n    // Best-effort: startup load / the next change corrects a miss.\n  }\n}\n\ninterface RequestWithUser extends FastifyRequest {\n  user?: { id: string; tenantId?: string };\n}\n\nasync function requireTenantSession(\n  request: FastifyRequest,\n  reply: FastifyReply,\n): Promise<void> {\n  if (!getUserTenantId(request) || !getUserId(request)) {\n    await reply.status(401).send({\n      success: false,\n      code: \"UNAUTHORIZED\",\n      error: \"Unauthorized\",\n    });\n  }\n}\n\nasync function authorizeProjectBinding(\n  request: FastifyRequest,\n  reply: FastifyReply,\n  projectId: string,\n): Promise<boolean> {\n  const tenantId = getUserTenantId(request);\n  const userId = getUserId(request);\n  if (!tenantId || !userId) {\n    await reply.status(401).send({\n      success: false,\n      code: \"UNAUTHORIZED\",\n      error: \"Unauthorized\",\n    });\n    return false;\n  }\n  if (!_a2aProjectAccess) {\n    await reply.status(500).send({ success: false, error: \"Project access not configured\" });\n    return false;\n  }\n  try {\n    await _a2aProjectAccess.requireExistingProjectAccess({\n      tenantId,\n      userId,\n      projectId,\n      capability: \"read\",\n    });\n    return true;\n  } catch (error) {\n    if (error instanceof ProjectCollaborationError) {\n      await reply.status(404).send({\n        success: false,\n        code: \"PROJECT_NOT_FOUND\",\n        error: \"Project not found\",\n      });\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function authorizeKeyMutation(\n  request: FastifyRequest<{ Params: { id: string } }>,\n  reply: FastifyReply,\n): Promise<A2AApiKeyRecord | null> {\n  if (!_a2aKeyStore) {\n    await reply.status(501).send({ error: \"Key store not configured\" });\n    return null;\n  }\n  const record = await _a2aKeyStore.findById(request.params.id);\n  if (!record) {\n    await reply.status(404).send({ success: false, error: \"A2A API key not found\" });\n    return null;\n  }\n  if (record.tenantId !== getUserTenantId(request)) {\n    await reply.status(403).send({ success: false, error: \"Forbidden\" });\n    return null;\n  }\n  return record;\n}\n\nfunction getUserTenantId(request: FastifyRequest): string | undefined {\n  return (request as RequestWithUser).user?.tenantId;\n}\n\nfunction getUserId(request: FastifyRequest): string | undefined {\n  return (request as RequestWithUser).user?.id;\n}\n\n// ─── API Key Management Handlers ─────────────────────────────────────────\n\nasync function handleApiKeyList(\n  request: FastifyRequest<{ Querystring: { tenantId?: string; limit?: string; offset?: string } }>,\n  reply: FastifyReply,\n): Promise<void> {\n  if (!_a2aKeyStore) {\n    reply.status(501).send({ error: \"Key store not configured\" });\n    return;\n  }\n\n  const records = await _a2aKeyStore.list({\n    tenantId: getUserTenantId(request),\n    limit: request.query.limit ? parseInt(request.query.limit, 10) : undefined,\n    offset: request.query.offset ? parseInt(request.query.offset, 10) : undefined,\n  });\n\n  reply.status(200).send({\n    success: true,\n    data: {\n      records: records.map((r) => ({ ...r, key: r.key.slice(0, 8) + \"...\" })),\n      total: records.length,\n    },\n  });\n}\n\nasync function handleApiKeyCreate(\n  request: FastifyRequest<{ Body: Partial<CreateA2AApiKeyInput> }>,\n  reply: FastifyReply,\n): Promise<void> {\n  if (!_a2aKeyStore || !_a2aAuthService) {\n    reply.status(501).send({ error: \"Key store not configured\" });\n    return;\n  }\n\n  const body = request.body as Partial<CreateA2AApiKeyInput>;\n  if (body.projectId === \"\") {\n    reply.status(400).send({ success: false, error: \"projectId is required\" });\n    return;\n  }\n  const tenantId = getUserTenantId(request)!;\n  if (body.projectId && !(await authorizeProjectBinding(request, reply, body.projectId))) {\n    return;\n  }\n\n  try {\n    const record = await _a2aAuthService.createKeyScoped({\n      tenantId,\n      projectId: body.projectId,\n      assistantIds: body.assistantIds,\n      grants: body.grants,\n      label: body.label,\n    });\n    await refreshStoreKeyMap();\n    broadcastA2AKeyChanged(tenantId);\n    reply.status(201).send({ success: true, data: record });\n  } catch (err) {\n    if (err instanceof A2AAuthError) {\n      reply.status(err.statusCode).send({ success: false, error: err.message });\n      return;\n    }\n    request.log.error({ err }, \"a2a:keys:create\");\n    reply.status(500).send({ success: false, error: \"Failed to create key\" });\n  }\n}\n\nasync function handleApiKeyUpdate(\n  request: FastifyRequest<{ Params: { id: string }; Body: Partial<CreateA2AApiKeyInput> }>,\n  reply: FastifyReply,\n): Promise<void> {\n  if (!_a2aKeyStore || !_a2aAuthService) {\n    reply.status(501).send({ error: \"Key store not configured\" });\n    return;\n  }\n\n  const existing = await authorizeKeyMutation(request, reply);\n  if (!existing) return;\n\n  const body = request.body as Partial<CreateA2AApiKeyInput>;\n  if (body.projectId === \"\") {\n    reply.status(400).send({ success: false, error: \"projectId must not be empty\" });\n    return;\n  }\n  const projectChanged = body.projectId !== undefined && body.projectId !== existing.projectId;\n  const permissionsChanged = body.assistantIds !== undefined || body.grants !== undefined;\n  if (projectChanged || permissionsChanged) {\n    const targetProjectId = projectChanged ? body.projectId! : existing.projectId;\n    if (!(await authorizeProjectBinding(request, reply, targetProjectId))) return;\n  }\n  const tenantId = getUserTenantId(request)!;\n  try {\n    const record = await _a2aAuthService.updateKeyScoped(\n      request.params.id,\n      tenantId,\n      {\n        label: body.label,\n        projectId: body.projectId,\n        assistantIds: body.assistantIds,\n        grants: body.grants,\n      },\n    );\n    await refreshStoreKeyMap();\n    broadcastA2AKeyChanged(tenantId);\n    reply.status(200).send({ success: true, data: record });\n  } catch (err) {\n    if (err instanceof A2AAuthError) {\n      reply.status(err.statusCode).send({ success: false, error: err.message });\n      return;\n    }\n    request.log.error({ err }, \"a2a:keys:update\");\n    reply.status(500).send({ success: false, error: \"Failed to update key\" });\n  }\n}\n\nasync function handleApiKeyDelete(\n  request: FastifyRequest<{ Params: { id: string } }>,\n  reply: FastifyReply,\n): Promise<void> {\n  const record = await authorizeKeyMutation(request, reply);\n  if (!record) return;\n\n  await _a2aKeyStore!.delete(request.params.id);\n  await refreshStoreKeyMap();\n  broadcastA2AKeyChanged(record.tenantId);\n\n  reply.status(200).send({ success: true });\n}\n\nasync function handleApiKeyDisable(\n  request: FastifyRequest<{ Params: { id: string } }>,\n  reply: FastifyReply,\n): Promise<void> {\n  const record = await authorizeKeyMutation(request, reply);\n  if (!record) return;\n\n  await _a2aKeyStore!.disable(request.params.id);\n  await refreshStoreKeyMap();\n  broadcastA2AKeyChanged(record.tenantId);\n\n  reply.status(200).send({ success: true });\n}\n\nasync function handleApiKeyEnable(\n  request: FastifyRequest<{ Params: { id: string } }>,\n  reply: FastifyReply,\n): Promise<void> {\n  const record = await authorizeKeyMutation(request, reply);\n  if (!record) return;\n\n  await _a2aKeyStore!.enable(request.params.id);\n  await refreshStoreKeyMap();\n  broadcastA2AKeyChanged(record.tenantId);\n\n  reply.status(200).send({ success: true });\n}\n\nasync function handleApiKeyRotate(\n  request: FastifyRequest<{ Params: { id: string } }>,\n  reply: FastifyReply,\n): Promise<void> {\n  const record = await authorizeKeyMutation(request, reply);\n  if (!record) return;\n  if (!(await authorizeProjectBinding(request, reply, record.projectId))) return;\n\n  const rotated = await _a2aKeyStore!.rotate(request.params.id);\n  await refreshStoreKeyMap();\n  broadcastA2AKeyChanged(record.tenantId);\n\n  reply.status(200).send({ success: true, data: rotated });\n}\n\n// ─── Route Registration ───────────────────────────────────────────────────\n\n/**\n * Register the API key management routes.\n *\n * `/api/keys` is the canonical unified surface; `/api/a2a/keys` remains as a\n * backward-compatible alias for existing clients.\n */\nexport function registerA2ARoutes(app: FastifyInstance): void {\n  const options = { preHandler: requireTenantSession };\n  for (const base of [\"/api/keys\", \"/api/a2a/keys\"]) {\n    app.get<{ Querystring: { tenantId?: string; limit?: string; offset?: string } }>(\n      base,\n      options,\n      handleApiKeyList,\n    );\n\n    app.post<{ Body: Partial<CreateA2AApiKeyInput> }>(\n      base,\n      options,\n      handleApiKeyCreate,\n    );\n\n    app.delete<{ Params: { id: string } }>(\n      `${base}/:id`,\n      options,\n      handleApiKeyDelete,\n    );\n\n    app.post<{ Params: { id: string } }>(\n      `${base}/:id/disable`,\n      options,\n      handleApiKeyDisable,\n    );\n\n    app.post<{ Params: { id: string } }>(\n      `${base}/:id/enable`,\n      options,\n      handleApiKeyEnable,\n    );\n\n    app.post<{ Params: { id: string } }>(\n      `${base}/:id/rotate`,\n      options,\n      handleApiKeyRotate,\n    );\n    app.patch<{ Params: { id: string }; Body: Partial<CreateA2AApiKeyInput> }>(\n      `${base}/:id`,\n      options,\n      handleApiKeyUpdate,\n    );\n  }\n}\n","import type { OutboxStore } from \"@axiom-lattice/protocols\";\n\n/** Outbox topic carrying cross-replica A2A API-key invalidation. */\nexport const A2A_KEY_CHANGED_TOPIC = \"a2a-key-changed\";\n\n/**\n * Best-effort publish of an A2A key change to the durable outbox.\n *\n * @param outbox Shared outbox store.\n * @param owner This replica id (recorded as the event origin).\n * @param tenantId Tenant whose keys changed.\n * @remarks Never throws; peers fall back to startup load / the next change.\n */\nexport async function publishA2AKeyChanged(\n  outbox: OutboxStore,\n  owner: string,\n  tenantId: string,\n): Promise<void> {\n  if (!tenantId) return;\n  try {\n    await outbox.append({\n      topic: A2A_KEY_CHANGED_TOPIC,\n      payload: { tenantId },\n      originReplicaId: owner,\n    });\n  } catch {\n    // Best-effort: startup load / the next change corrects a miss.\n  }\n}\n\n/**\n * Reloads this replica's key map after a foreign key change.\n *\n * @param payload Outbox payload, expected to carry a non-empty `tenantId`.\n * @param reload Store-backed reload callback (refreshes the global key map).\n */\nexport async function handleA2AKeyChanged(\n  payload: unknown,\n  reload: () => Promise<void>,\n): Promise<void> {\n  const tenantId = (payload as { tenantId?: unknown } | null)?.tenantId;\n  if (typeof tenantId !== \"string\" || tenantId.length === 0) return;\n  await reload();\n}\n","import { randomUUID } from \"node:crypto\";\nimport type {\n  Project,\n  ProjectKind,\n  ProjectMembership,\n  ProjectMembershipStore,\n  ProjectStore,\n  UserTenantLinkStore,\n} from \"@axiom-lattice/protocols\";\n\n/** Capabilities enforced by project collaboration services. */\nexport type ProjectCapability = \"read\" | \"send\" | \"manage\";\n\n/** Stable error codes returned by project collaboration services. */\nexport type ProjectCollaborationErrorCode =\n  | \"PROJECT_NOT_FOUND\"\n  | \"PROJECT_ACCESS_DENIED\"\n  | \"PROJECT_MEMBERSHIP_CONFLICT\";\n\n/** Typed service error with stable machine-readable code and HTTP status. */\nexport class ProjectCollaborationError extends Error {\n  /** Creates a project collaboration error. */\n  constructor(\n    public readonly code: ProjectCollaborationErrorCode,\n    public readonly statusCode: 403 | 404 | 409,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"ProjectCollaborationError\";\n  }\n}\n\n/** Trusted project scope and capability checked by the access service. */\nexport interface RequireProjectAccessInput {\n  tenantId: string;\n  userId: string;\n  projectId: string;\n  capability: ProjectCapability;\n}\n\n/** Input for bulk project visibility filtering. */\nexport interface ListReadableProjectsInput {\n  tenantId: string;\n  userId: string;\n  workspaceId: string;\n  kind?: ProjectKind;\n}\n\n/** Authorized project scope together with the active membership granting access. */\nexport interface ProjectAccessResult {\n  project: Project;\n  membership: ProjectMembership;\n}\n\n/** Narrow persistence dependencies needed to authorize project collaboration. */\nexport interface ProjectAccessServiceDependencies {\n  projectStore: Pick<ProjectStore, \"getProjectById\" | \"getProjectsByWorkspace\">;\n  membershipStore: Pick<ProjectMembershipStore, \"list\" | \"findByUser\" | \"create\" | \"createInitialOwner\">;\n  userTenantLinkStore: Pick<UserTenantLinkStore, \"getLink\">;\n  idFactory?: () => string;\n}\n\nconst allowedRoles = {\n  read: new Set([\"owner\", \"admin\", \"member\", \"viewer\"]),\n  send: new Set([\"owner\", \"admin\", \"member\"]),\n  manage: new Set([\"owner\", \"admin\"]),\n} satisfies Record<ProjectCapability, ReadonlySet<ProjectMembership[\"role\"]>>;\n\nconst membershipConflictNames = new Set([\n  \"DuplicateProjectMembershipError\",\n  \"ProjectMembershipIdConflictError\",\n]);\n\nfunction isProjectMembershipConflict(error: unknown): boolean {\n  return error instanceof Error && membershipConflictNames.has(error.name);\n}\n\n/** Authorizes project collaboration and initializes eligible legacy projects. */\nexport class ProjectAccessService {\n  private readonly idFactory: () => string;\n\n  /** Creates a project access service from explicitly injected stores. */\n  constructor(private readonly deps: ProjectAccessServiceDependencies) {\n    this.idFactory = deps.idFactory ?? randomUUID;\n  }\n\n  /** Returns the project and active membership when the user has the requested capability. */\n  async requireProjectAccess(input: RequireProjectAccessInput): Promise<ProjectAccessResult> {\n    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);\n    if (!project) {\n      throw new ProjectCollaborationError(\"PROJECT_NOT_FOUND\", 404, \"Project not found\");\n    }\n\n    if (project.kind === \"public\") {\n      return this.requirePublicProjectAccess(project, input);\n    }\n\n    const membership = await this.deps.membershipStore.findByUser(\n      input.tenantId,\n      input.projectId,\n      input.userId,\n    );\n\n    if (project.kind === \"personal\") {\n      if (!this.isActiveMembership(membership, input)) this.accessDenied();\n      this.requireCapability(membership, input.capability);\n      return { project, membership };\n    }\n\n    if (this.isActiveMembership(membership, input) && this.hasCapability(membership, input.capability)) {\n      return { project, membership };\n    }\n\n    const tenantAdmin = await this.tenantAdminMembership(project, input);\n    if (this.isActiveMembership(membership, input)) {\n      if (tenantAdmin) return { project, membership: tenantAdmin };\n      this.requireCapability(membership, input.capability);\n    }\n\n    const memberships = await this.deps.membershipStore.list(input.tenantId, input.projectId);\n    if (memberships.length !== 0) {\n      if (tenantAdmin) return { project, membership: tenantAdmin };\n      this.accessDenied();\n    }\n    // A tenant admin may claim a legacy project that has no memberships at all.\n    if (!tenantAdmin) this.accessDenied();\n\n    let claim: Awaited<ReturnType<ProjectMembershipStore[\"createInitialOwner\"]>>;\n    try {\n      claim = await this.deps.membershipStore.createInitialOwner({\n        id: this.idFactory(),\n        tenantId: input.tenantId,\n        projectId: input.projectId,\n        userId: input.userId,\n      });\n    } catch (error) {\n      if (isProjectMembershipConflict(error)) {\n        throw new ProjectCollaborationError(\n          \"PROJECT_MEMBERSHIP_CONFLICT\",\n          409,\n          \"Project membership could not be initialized\",\n        );\n      }\n      throw error;\n    }\n    if (claim.kind === \"created\" || claim.kind === \"existing\") {\n      return { project, membership: claim.membership };\n    }\n\n    const racedMembership = await this.deps.membershipStore.findByUser(\n      input.tenantId,\n      input.projectId,\n      input.userId,\n    );\n    if (racedMembership?.status !== \"active\") this.accessDenied();\n    this.requireCapability(racedMembership, input.capability);\n    return { project, membership: racedMembership };\n  }\n\n  /** Authorizes an already-existing membership, or any tenant member for public rooms; never mutates persistence. */\n  async requireExistingProjectAccess(input: RequireProjectAccessInput): Promise<ProjectAccessResult> {\n    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);\n    if (!project) throw new ProjectCollaborationError(\"PROJECT_NOT_FOUND\", 404, \"Project not found\");\n    if (project.kind === \"public\") {\n      return this.requireExistingPublicProjectAccess(project, input);\n    }\n\n    const membership = await this.deps.membershipStore.findByUser(\n      input.tenantId,\n      input.projectId,\n      input.userId,\n    );\n    const activeMembership = this.isActiveMembership(membership, input) ? membership : undefined;\n\n    if (project.kind === \"personal\") {\n      if (!activeMembership) this.accessDenied();\n      this.requireCapability(activeMembership, input.capability);\n      return { project, membership: activeMembership };\n    }\n\n    if (activeMembership && this.hasCapability(activeMembership, input.capability)) {\n      return { project, membership: activeMembership };\n    }\n\n    const tenantAdmin = await this.tenantAdminMembership(project, input);\n    if (tenantAdmin) return { project, membership: tenantAdmin };\n\n    if (activeMembership) this.requireCapability(activeMembership, input.capability);\n    this.accessDenied();\n  }\n\n  /**\n   * Authorizes roster visibility for any active participant (owner/admin/member/viewer).\n   * Mutating the roster requires `manage` separately; reading it never does, because every\n   * room participant needs the member list to render the room and derive their own capabilities.\n   */\n  async requireRosterAccess(\n    input: Omit<RequireProjectAccessInput, \"capability\">,\n  ): Promise<ProjectAccessResult> {\n    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);\n    if (!project) throw new ProjectCollaborationError(\"PROJECT_NOT_FOUND\", 404, \"Project not found\");\n    return this.requireProjectAccess({\n      ...input,\n      capability: \"read\",\n    });\n  }\n\n  /** Returns projects in a workspace that the user may read. */\n  async listReadableProjects(input: ListReadableProjectsInput): Promise<Project[]> {\n    const [tenantLink, projects] = await Promise.all([\n      this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId),\n      this.deps.projectStore.getProjectsByWorkspace(input.tenantId, input.workspaceId),\n    ]);\n    const filtered = input.kind\n      ? projects.filter((project) => (project.kind ?? \"business\") === input.kind)\n      : projects;\n    const isTenantAdmin = tenantLink?.role === \"owner\" || tenantLink?.role === \"admin\";\n\n    const visible: Project[] = [];\n    for (const project of filtered) {\n      if (project.kind === \"public\") {\n        if (tenantLink || await this.hasActiveMembership(input.tenantId, project.id, input.userId)) {\n          visible.push(project);\n        }\n        continue;\n      }\n      if (project.kind === \"personal\") {\n        if (await this.hasActiveMembership(input.tenantId, project.id, input.userId)) {\n          visible.push(project);\n        }\n        continue;\n      }\n      if (isTenantAdmin || await this.hasActiveMembership(input.tenantId, project.id, input.userId)) {\n        visible.push(project);\n      }\n    }\n    return visible;\n  }\n\n  private async hasActiveMembership(\n    tenantId: string,\n    projectId: string,\n    userId: string,\n  ): Promise<boolean> {\n    const membership = await this.deps.membershipStore.findByUser(tenantId, projectId, userId);\n    return this.matchesActiveMembership(membership, tenantId, projectId, userId);\n  }\n\n  private matchesActiveMembership(\n    membership: ProjectMembership | null,\n    tenantId: string,\n    projectId: string,\n    userId: string,\n  ): membership is ProjectMembership {\n    return membership != null\n      && membership.tenantId === tenantId\n      && membership.projectId === projectId\n      && membership.userId === userId\n      && membership.status === \"active\";\n  }\n\n  private async requirePublicProjectAccess(\n    project: Project,\n    input: RequireProjectAccessInput,\n  ): Promise<ProjectAccessResult> {\n    const membership = await this.deps.membershipStore.findByUser(\n      input.tenantId, input.projectId, input.userId,\n    );\n    if (membership?.status === \"active\") {\n      if (this.hasCapability(membership, input.capability)) return { project, membership };\n      const tenantAdmin = await this.tenantAdminMembership(project, input);\n      if (tenantAdmin) return { project, membership: tenantAdmin };\n      this.requireCapability(membership, input.capability);\n      return { project, membership };\n    }\n    const materialized = await this.materializePublicMembership(input);\n    this.requireCapability(materialized, input.capability);\n    return { project, membership: materialized };\n  }\n\n  private async requireExistingPublicProjectAccess(\n    project: Project,\n    input: RequireProjectAccessInput,\n  ): Promise<ProjectAccessResult> {\n    const membership = await this.deps.membershipStore.findByUser(\n      input.tenantId, input.projectId, input.userId,\n    );\n    if (membership?.status === \"active\") {\n      if (this.hasCapability(membership, input.capability)) return { project, membership };\n      const tenantAdmin = await this.tenantAdminMembership(project, input);\n      if (tenantAdmin) return { project, membership: tenantAdmin };\n      this.requireCapability(membership, input.capability);\n      return { project, membership };\n    }\n    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);\n    if (!tenantLink) this.accessDenied();\n    const role: ProjectMembership[\"role\"] =\n      tenantLink.role === \"owner\" || tenantLink.role === \"admin\" ? \"admin\" : \"member\";\n    // Read-only authorization artifact — never persisted; callers must not\n    // treat `id` as a store key or `updatedAt` as a CAS token.\n    const synthetic: ProjectMembership = {\n      id: `public:${input.userId}`,\n      tenantId: input.tenantId,\n      projectId: input.projectId,\n      userId: input.userId,\n      role,\n      status: \"active\",\n      joinedAt: project.createdAt,\n      updatedAt: project.updatedAt,\n    };\n    this.requireCapability(synthetic, input.capability);\n    return { project, membership: synthetic };\n  }\n\n  private async materializePublicMembership(\n    input: RequireProjectAccessInput,\n  ): Promise<ProjectMembership> {\n    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);\n    if (!tenantLink) this.accessDenied();\n    const existing = await this.deps.membershipStore.findByUser(\n      input.tenantId, input.projectId, input.userId,\n    );\n    if (existing) this.accessDenied();\n    const role: ProjectMembership[\"role\"] =\n      tenantLink.role === \"owner\" || tenantLink.role === \"admin\" ? \"admin\" : \"member\";\n    try {\n      return await this.deps.membershipStore.create({\n        id: this.idFactory(),\n        tenantId: input.tenantId,\n        projectId: input.projectId,\n        userId: input.userId,\n        role,\n        status: \"active\",\n      });\n    } catch (error) {\n      if (isProjectMembershipConflict(error)) {\n        const raced = await this.deps.membershipStore.findByUser(\n          input.tenantId, input.projectId, input.userId,\n        );\n        if (raced?.status === \"active\") return raced;\n      }\n      throw error;\n    }\n  }\n\n  private hasCapability(membership: ProjectMembership, capability: ProjectCapability): boolean {\n    return (allowedRoles[capability] as ReadonlySet<ProjectMembership[\"role\"]>).has(membership.role);\n  }\n\n  private requireCapability(membership: ProjectMembership, capability: ProjectCapability): void {\n    if (!this.hasCapability(membership, capability)) this.accessDenied();\n  }\n\n  private async tenantAdminMembership(\n    project: Project,\n    input: RequireProjectAccessInput,\n  ): Promise<ProjectMembership | undefined> {\n    if (project.kind === \"personal\") return undefined;\n    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);\n    if (tenantLink?.role !== \"owner\" && tenantLink?.role !== \"admin\") return undefined;\n    // Authorization artifact — never persisted; callers must not use `id` or\n    // `updatedAt` as a store key or CAS token.\n    return {\n      id: `tenant-admin:${input.userId}`,\n      tenantId: input.tenantId,\n      projectId: project.id,\n      userId: input.userId,\n      role: \"admin\",\n      status: \"active\",\n      joinedAt: project.createdAt,\n      updatedAt: project.updatedAt,\n    };\n  }\n\n  private isActiveMembership(\n    membership: ProjectMembership | null,\n    input: RequireProjectAccessInput,\n  ): membership is ProjectMembership {\n    return this.matchesActiveMembership(\n      membership,\n      input.tenantId,\n      input.projectId,\n      input.userId,\n    );\n  }\n\n  private accessDenied(): never {\n    throw new ProjectCollaborationError(\"PROJECT_ACCESS_DENIED\", 403, \"Project access denied\");\n  }\n}\n"],"mappings":";;;;;AAOA,SAAS,iBAAiB,oBAAoB;;;ACJvC,IAAM,wBAAwB;AAUrC,eAAsB,qBACpB,QACA,OACA,UACe;AACf,MAAI,CAAC,SAAU;AACf,MAAI;AACF,UAAM,OAAO,OAAO;AAAA,MAClB,OAAO;AAAA,MACP,SAAS,EAAE,SAAS;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACF;AAQA,eAAsB,oBACpB,SACA,QACe;AACf,QAAM,WAAY,SAA2C;AAC7D,MAAI,OAAO,aAAa,YAAY,SAAS,WAAW,EAAG;AAC3D,QAAM,OAAO;AACf;;;AC3CA,SAAS,kBAAkB;AAoBpB,IAAM,4BAAN,cAAwC,MAAM;AAAA;AAAA,EAEnD,YACkB,MACA,YAChB,SACA;AACA,UAAM,OAAO;AAJG;AACA;AAIhB,SAAK,OAAO;AAAA,EACd;AACF;AAgCA,IAAM,eAAe;AAAA,EACnB,MAAM,oBAAI,IAAI,CAAC,SAAS,SAAS,UAAU,QAAQ,CAAC;AAAA,EACpD,MAAM,oBAAI,IAAI,CAAC,SAAS,SAAS,QAAQ,CAAC;AAAA,EAC1C,QAAQ,oBAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AACpC;AAEA,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AACF,CAAC;AAED,SAAS,4BAA4B,OAAyB;AAC5D,SAAO,iBAAiB,SAAS,wBAAwB,IAAI,MAAM,IAAI;AACzE;AAGO,IAAM,uBAAN,MAA2B;AAAA;AAAA,EAIhC,YAA6B,MAAwC;AAAxC;AAC3B,SAAK,YAAY,KAAK,aAAa;AAAA,EACrC;AAAA;AAAA,EAGA,MAAM,qBAAqB,OAAgE;AACzF,UAAM,UAAU,MAAM,KAAK,KAAK,aAAa,eAAe,MAAM,UAAU,MAAM,SAAS;AAC3F,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,0BAA0B,qBAAqB,KAAK,mBAAmB;AAAA,IACnF;AAEA,QAAI,QAAQ,SAAS,UAAU;AAC7B,aAAO,KAAK,2BAA2B,SAAS,KAAK;AAAA,IACvD;AAEA,UAAM,aAAa,MAAM,KAAK,KAAK,gBAAgB;AAAA,MACjD,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,QAAI,QAAQ,SAAS,YAAY;AAC/B,UAAI,CAAC,KAAK,mBAAmB,YAAY,KAAK,EAAG,MAAK,aAAa;AACnE,WAAK,kBAAkB,YAAY,MAAM,UAAU;AACnD,aAAO,EAAE,SAAS,WAAW;AAAA,IAC/B;AAEA,QAAI,KAAK,mBAAmB,YAAY,KAAK,KAAK,KAAK,cAAc,YAAY,MAAM,UAAU,GAAG;AAClG,aAAO,EAAE,SAAS,WAAW;AAAA,IAC/B;AAEA,UAAM,cAAc,MAAM,KAAK,sBAAsB,SAAS,KAAK;AACnE,QAAI,KAAK,mBAAmB,YAAY,KAAK,GAAG;AAC9C,UAAI,YAAa,QAAO,EAAE,SAAS,YAAY,YAAY;AAC3D,WAAK,kBAAkB,YAAY,MAAM,UAAU;AAAA,IACrD;AAEA,UAAM,cAAc,MAAM,KAAK,KAAK,gBAAgB,KAAK,MAAM,UAAU,MAAM,SAAS;AACxF,QAAI,YAAY,WAAW,GAAG;AAC5B,UAAI,YAAa,QAAO,EAAE,SAAS,YAAY,YAAY;AAC3D,WAAK,aAAa;AAAA,IACpB;AAEA,QAAI,CAAC,YAAa,MAAK,aAAa;AAEpC,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,KAAK,KAAK,gBAAgB,mBAAmB;AAAA,QACzD,IAAI,KAAK,UAAU;AAAA,QACnB,UAAU,MAAM;AAAA,QAChB,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,4BAA4B,KAAK,GAAG;AACtC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,QAAI,MAAM,SAAS,aAAa,MAAM,SAAS,YAAY;AACzD,aAAO,EAAE,SAAS,YAAY,MAAM,WAAW;AAAA,IACjD;AAEA,UAAM,kBAAkB,MAAM,KAAK,KAAK,gBAAgB;AAAA,MACtD,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,QAAI,iBAAiB,WAAW,SAAU,MAAK,aAAa;AAC5D,SAAK,kBAAkB,iBAAiB,MAAM,UAAU;AACxD,WAAO,EAAE,SAAS,YAAY,gBAAgB;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,6BAA6B,OAAgE;AACjG,UAAM,UAAU,MAAM,KAAK,KAAK,aAAa,eAAe,MAAM,UAAU,MAAM,SAAS;AAC3F,QAAI,CAAC,QAAS,OAAM,IAAI,0BAA0B,qBAAqB,KAAK,mBAAmB;AAC/F,QAAI,QAAQ,SAAS,UAAU;AAC7B,aAAO,KAAK,mCAAmC,SAAS,KAAK;AAAA,IAC/D;AAEA,UAAM,aAAa,MAAM,KAAK,KAAK,gBAAgB;AAAA,MACjD,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AACA,UAAM,mBAAmB,KAAK,mBAAmB,YAAY,KAAK,IAAI,aAAa;AAEnF,QAAI,QAAQ,SAAS,YAAY;AAC/B,UAAI,CAAC,iBAAkB,MAAK,aAAa;AACzC,WAAK,kBAAkB,kBAAkB,MAAM,UAAU;AACzD,aAAO,EAAE,SAAS,YAAY,iBAAiB;AAAA,IACjD;AAEA,QAAI,oBAAoB,KAAK,cAAc,kBAAkB,MAAM,UAAU,GAAG;AAC9E,aAAO,EAAE,SAAS,YAAY,iBAAiB;AAAA,IACjD;AAEA,UAAM,cAAc,MAAM,KAAK,sBAAsB,SAAS,KAAK;AACnE,QAAI,YAAa,QAAO,EAAE,SAAS,YAAY,YAAY;AAE3D,QAAI,iBAAkB,MAAK,kBAAkB,kBAAkB,MAAM,UAAU;AAC/E,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,oBACJ,OAC8B;AAC9B,UAAM,UAAU,MAAM,KAAK,KAAK,aAAa,eAAe,MAAM,UAAU,MAAM,SAAS;AAC3F,QAAI,CAAC,QAAS,OAAM,IAAI,0BAA0B,qBAAqB,KAAK,mBAAmB;AAC/F,WAAO,KAAK,qBAAqB;AAAA,MAC/B,GAAG;AAAA,MACH,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,qBAAqB,OAAsD;AAC/E,UAAM,CAAC,YAAY,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC/C,KAAK,KAAK,oBAAoB,QAAQ,MAAM,QAAQ,MAAM,QAAQ;AAAA,MAClE,KAAK,KAAK,aAAa,uBAAuB,MAAM,UAAU,MAAM,WAAW;AAAA,IACjF,CAAC;AACD,UAAM,WAAW,MAAM,OACnB,SAAS,OAAO,CAAC,aAAa,QAAQ,QAAQ,gBAAgB,MAAM,IAAI,IACxE;AACJ,UAAM,gBAAgB,YAAY,SAAS,WAAW,YAAY,SAAS;AAE3E,UAAM,UAAqB,CAAC;AAC5B,eAAW,WAAW,UAAU;AAC9B,UAAI,QAAQ,SAAS,UAAU;AAC7B,YAAI,cAAc,MAAM,KAAK,oBAAoB,MAAM,UAAU,QAAQ,IAAI,MAAM,MAAM,GAAG;AAC1F,kBAAQ,KAAK,OAAO;AAAA,QACtB;AACA;AAAA,MACF;AACA,UAAI,QAAQ,SAAS,YAAY;AAC/B,YAAI,MAAM,KAAK,oBAAoB,MAAM,UAAU,QAAQ,IAAI,MAAM,MAAM,GAAG;AAC5E,kBAAQ,KAAK,OAAO;AAAA,QACtB;AACA;AAAA,MACF;AACA,UAAI,iBAAiB,MAAM,KAAK,oBAAoB,MAAM,UAAU,QAAQ,IAAI,MAAM,MAAM,GAAG;AAC7F,gBAAQ,KAAK,OAAO;AAAA,MACtB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,oBACZ,UACA,WACA,QACkB;AAClB,UAAM,aAAa,MAAM,KAAK,KAAK,gBAAgB,WAAW,UAAU,WAAW,MAAM;AACzF,WAAO,KAAK,wBAAwB,YAAY,UAAU,WAAW,MAAM;AAAA,EAC7E;AAAA,EAEQ,wBACN,YACA,UACA,WACA,QACiC;AACjC,WAAO,cAAc,QAChB,WAAW,aAAa,YACxB,WAAW,cAAc,aACzB,WAAW,WAAW,UACtB,WAAW,WAAW;AAAA,EAC7B;AAAA,EAEA,MAAc,2BACZ,SACA,OAC8B;AAC9B,UAAM,aAAa,MAAM,KAAK,KAAK,gBAAgB;AAAA,MACjD,MAAM;AAAA,MAAU,MAAM;AAAA,MAAW,MAAM;AAAA,IACzC;AACA,QAAI,YAAY,WAAW,UAAU;AACnC,UAAI,KAAK,cAAc,YAAY,MAAM,UAAU,EAAG,QAAO,EAAE,SAAS,WAAW;AACnF,YAAM,cAAc,MAAM,KAAK,sBAAsB,SAAS,KAAK;AACnE,UAAI,YAAa,QAAO,EAAE,SAAS,YAAY,YAAY;AAC3D,WAAK,kBAAkB,YAAY,MAAM,UAAU;AACnD,aAAO,EAAE,SAAS,WAAW;AAAA,IAC/B;AACA,UAAM,eAAe,MAAM,KAAK,4BAA4B,KAAK;AACjE,SAAK,kBAAkB,cAAc,MAAM,UAAU;AACrD,WAAO,EAAE,SAAS,YAAY,aAAa;AAAA,EAC7C;AAAA,EAEA,MAAc,mCACZ,SACA,OAC8B;AAC9B,UAAM,aAAa,MAAM,KAAK,KAAK,gBAAgB;AAAA,MACjD,MAAM;AAAA,MAAU,MAAM;AAAA,MAAW,MAAM;AAAA,IACzC;AACA,QAAI,YAAY,WAAW,UAAU;AACnC,UAAI,KAAK,cAAc,YAAY,MAAM,UAAU,EAAG,QAAO,EAAE,SAAS,WAAW;AACnF,YAAM,cAAc,MAAM,KAAK,sBAAsB,SAAS,KAAK;AACnE,UAAI,YAAa,QAAO,EAAE,SAAS,YAAY,YAAY;AAC3D,WAAK,kBAAkB,YAAY,MAAM,UAAU;AACnD,aAAO,EAAE,SAAS,WAAW;AAAA,IAC/B;AACA,UAAM,aAAa,MAAM,KAAK,KAAK,oBAAoB,QAAQ,MAAM,QAAQ,MAAM,QAAQ;AAC3F,QAAI,CAAC,WAAY,MAAK,aAAa;AACnC,UAAM,OACJ,WAAW,SAAS,WAAW,WAAW,SAAS,UAAU,UAAU;AAGzE,UAAM,YAA+B;AAAA,MACnC,IAAI,UAAU,MAAM,MAAM;AAAA,MAC1B,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,WAAW,QAAQ;AAAA,IACrB;AACA,SAAK,kBAAkB,WAAW,MAAM,UAAU;AAClD,WAAO,EAAE,SAAS,YAAY,UAAU;AAAA,EAC1C;AAAA,EAEA,MAAc,4BACZ,OAC4B;AAC5B,UAAM,aAAa,MAAM,KAAK,KAAK,oBAAoB,QAAQ,MAAM,QAAQ,MAAM,QAAQ;AAC3F,QAAI,CAAC,WAAY,MAAK,aAAa;AACnC,UAAM,WAAW,MAAM,KAAK,KAAK,gBAAgB;AAAA,MAC/C,MAAM;AAAA,MAAU,MAAM;AAAA,MAAW,MAAM;AAAA,IACzC;AACA,QAAI,SAAU,MAAK,aAAa;AAChC,UAAM,OACJ,WAAW,SAAS,WAAW,WAAW,SAAS,UAAU,UAAU;AACzE,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,gBAAgB,OAAO;AAAA,QAC5C,IAAI,KAAK,UAAU;AAAA,QACnB,UAAU,MAAM;AAAA,QAChB,WAAW,MAAM;AAAA,QACjB,QAAQ,MAAM;AAAA,QACd;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,4BAA4B,KAAK,GAAG;AACtC,cAAM,QAAQ,MAAM,KAAK,KAAK,gBAAgB;AAAA,UAC5C,MAAM;AAAA,UAAU,MAAM;AAAA,UAAW,MAAM;AAAA,QACzC;AACA,YAAI,OAAO,WAAW,SAAU,QAAO;AAAA,MACzC;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,cAAc,YAA+B,YAAwC;AAC3F,WAAQ,aAAa,UAAU,EAA6C,IAAI,WAAW,IAAI;AAAA,EACjG;AAAA,EAEQ,kBAAkB,YAA+B,YAAqC;AAC5F,QAAI,CAAC,KAAK,cAAc,YAAY,UAAU,EAAG,MAAK,aAAa;AAAA,EACrE;AAAA,EAEA,MAAc,sBACZ,SACA,OACwC;AACxC,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,aAAa,MAAM,KAAK,KAAK,oBAAoB,QAAQ,MAAM,QAAQ,MAAM,QAAQ;AAC3F,QAAI,YAAY,SAAS,WAAW,YAAY,SAAS,QAAS,QAAO;AAGzE,WAAO;AAAA,MACL,IAAI,gBAAgB,MAAM,MAAM;AAAA,MAChC,UAAU,MAAM;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,QAAQ,MAAM;AAAA,MACd,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,WAAW,QAAQ;AAAA,IACrB;AAAA,EACF;AAAA,EAEQ,mBACN,YACA,OACiC;AACjC,WAAO,KAAK;AAAA,MACV;AAAA,MACA,MAAM;AAAA,MACN,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEQ,eAAsB;AAC5B,UAAM,IAAI,0BAA0B,yBAAyB,KAAK,uBAAuB;AAAA,EAC3F;AACF;;;AFtXA,IAAI,eAAsC;AAC1C,IAAI,kBAAyC;AAY7C,IAAI,oBAAkD;AAG/C,SAAS,oBAAoB,YAAyC;AAC3E,sBAAoB;AACtB;AAGO,SAAS,eAAe,OAA6B;AAC1D,iBAAe;AACjB;AAGO,SAAS,kBAAkB,SAA+B;AAC/D,oBAAkB;AACpB;AAOA,eAAsB,qBAAoC;AACxD,MAAI,gBAAiB,OAAM,gBAAgB,QAAQ;AACrD;AAQO,SAAS,uBAAuB,UAAoC;AACzE,MAAI,CAAC,SAAU;AACf,MAAI;AACF,UAAM,SAAS,gBAAgB,WAAW,QAAQ,EAAE;AACpD,SAAK,qBAAqB,QAAQ,aAAa,GAAG,QAAQ;AAAA,EAC5D,QAAQ;AAAA,EAER;AACF;AAMA,eAAe,qBACb,SACA,OACe;AACf,MAAI,CAAC,gBAAgB,OAAO,KAAK,CAAC,UAAU,OAAO,GAAG;AACpD,UAAM,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,MAC3B,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,wBACb,SACA,OACA,WACkB;AAClB,QAAM,WAAW,gBAAgB,OAAO;AACxC,QAAM,SAAS,UAAU,OAAO;AAChC,MAAI,CAAC,YAAY,CAAC,QAAQ;AACxB,UAAM,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,MAC3B,SAAS;AAAA,MACT,MAAM;AAAA,MACN,OAAO;AAAA,IACT,CAAC;AACD,WAAO;AAAA,EACT;AACA,MAAI,CAAC,mBAAmB;AACtB,UAAM,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,gCAAgC,CAAC;AACvF,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,kBAAkB,6BAA6B;AAAA,MACnD;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,IACd,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,2BAA2B;AAC9C,YAAM,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,QAC3B,SAAS;AAAA,QACT,MAAM;AAAA,QACN,OAAO;AAAA,MACT,CAAC;AACD,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,qBACb,SACA,OACiC;AACjC,MAAI,CAAC,cAAc;AACjB,UAAM,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAC;AAClE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,aAAa,SAAS,QAAQ,OAAO,EAAE;AAC5D,MAAI,CAAC,QAAQ;AACX,UAAM,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,wBAAwB,CAAC;AAC/E,WAAO;AAAA,EACT;AACA,MAAI,OAAO,aAAa,gBAAgB,OAAO,GAAG;AAChD,UAAM,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,YAAY,CAAC;AACnE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAA6C;AACpE,SAAQ,QAA4B,MAAM;AAC5C;AAEA,SAAS,UAAU,SAA6C;AAC9D,SAAQ,QAA4B,MAAM;AAC5C;AAIA,eAAe,iBACb,SACA,OACe;AACf,MAAI,CAAC,cAAc;AACjB,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAC;AAC5D;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,aAAa,KAAK;AAAA,IACtC,UAAU,gBAAgB,OAAO;AAAA,IACjC,OAAO,QAAQ,MAAM,QAAQ,SAAS,QAAQ,MAAM,OAAO,EAAE,IAAI;AAAA,IACjE,QAAQ,QAAQ,MAAM,SAAS,SAAS,QAAQ,MAAM,QAAQ,EAAE,IAAI;AAAA,EACtE,CAAC;AAED,QAAM,OAAO,GAAG,EAAE,KAAK;AAAA,IACrB,SAAS;AAAA,IACT,MAAM;AAAA,MACJ,SAAS,QAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,EAAE,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,EAAE;AAAA,MACtE,OAAO,QAAQ;AAAA,IACjB;AAAA,EACF,CAAC;AACH;AAEA,eAAe,mBACb,SACA,OACe;AACf,MAAI,CAAC,gBAAgB,CAAC,iBAAiB;AACrC,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAC;AAC5D;AAAA,EACF;AAEA,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,cAAc,IAAI;AACzB,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,wBAAwB,CAAC;AACzE;AAAA,EACF;AACA,QAAM,WAAW,gBAAgB,OAAO;AACxC,MAAI,KAAK,aAAa,CAAE,MAAM,wBAAwB,SAAS,OAAO,KAAK,SAAS,GAAI;AACtF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,gBAAgB,gBAAgB;AAAA,MACnD;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK;AAAA,IACd,CAAC;AACD,UAAM,mBAAmB;AACzB,2BAAuB,QAAQ;AAC/B,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,cAAc;AAC/B,YAAM,OAAO,IAAI,UAAU,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,IAAI,QAAQ,CAAC;AACxE;AAAA,IACF;AACA,YAAQ,IAAI,MAAM,EAAE,IAAI,GAAG,iBAAiB;AAC5C,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,uBAAuB,CAAC;AAAA,EAC1E;AACF;AAEA,eAAe,mBACb,SACA,OACe;AACf,MAAI,CAAC,gBAAgB,CAAC,iBAAiB;AACrC,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,2BAA2B,CAAC;AAC5D;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,qBAAqB,SAAS,KAAK;AAC1D,MAAI,CAAC,SAAU;AAEf,QAAM,OAAO,QAAQ;AACrB,MAAI,KAAK,cAAc,IAAI;AACzB,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,8BAA8B,CAAC;AAC/E;AAAA,EACF;AACA,QAAM,iBAAiB,KAAK,cAAc,UAAa,KAAK,cAAc,SAAS;AACnF,QAAM,qBAAqB,KAAK,iBAAiB,UAAa,KAAK,WAAW;AAC9E,MAAI,kBAAkB,oBAAoB;AACxC,UAAM,kBAAkB,iBAAiB,KAAK,YAAa,SAAS;AACpE,QAAI,CAAE,MAAM,wBAAwB,SAAS,OAAO,eAAe,EAAI;AAAA,EACzE;AACA,QAAM,WAAW,gBAAgB,OAAO;AACxC,MAAI;AACF,UAAM,SAAS,MAAM,gBAAgB;AAAA,MACnC,QAAQ,OAAO;AAAA,MACf;AAAA,MACA;AAAA,QACE,OAAO,KAAK;AAAA,QACZ,WAAW,KAAK;AAAA,QAChB,cAAc,KAAK;AAAA,QACnB,QAAQ,KAAK;AAAA,MACf;AAAA,IACF;AACA,UAAM,mBAAmB;AACzB,2BAAuB,QAAQ;AAC/B,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,MAAM,MAAM,OAAO,CAAC;AAAA,EACxD,SAAS,KAAK;AACZ,QAAI,eAAe,cAAc;AAC/B,YAAM,OAAO,IAAI,UAAU,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,IAAI,QAAQ,CAAC;AACxE;AAAA,IACF;AACA,YAAQ,IAAI,MAAM,EAAE,IAAI,GAAG,iBAAiB;AAC5C,UAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,uBAAuB,CAAC;AAAA,EAC1E;AACF;AAEA,eAAe,mBACb,SACA,OACe;AACf,QAAM,SAAS,MAAM,qBAAqB,SAAS,KAAK;AACxD,MAAI,CAAC,OAAQ;AAEb,QAAM,aAAc,OAAO,QAAQ,OAAO,EAAE;AAC5C,QAAM,mBAAmB;AACzB,yBAAuB,OAAO,QAAQ;AAEtC,QAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAC1C;AAEA,eAAe,oBACb,SACA,OACe;AACf,QAAM,SAAS,MAAM,qBAAqB,SAAS,KAAK;AACxD,MAAI,CAAC,OAAQ;AAEb,QAAM,aAAc,QAAQ,QAAQ,OAAO,EAAE;AAC7C,QAAM,mBAAmB;AACzB,yBAAuB,OAAO,QAAQ;AAEtC,QAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAC1C;AAEA,eAAe,mBACb,SACA,OACe;AACf,QAAM,SAAS,MAAM,qBAAqB,SAAS,KAAK;AACxD,MAAI,CAAC,OAAQ;AAEb,QAAM,aAAc,OAAO,QAAQ,OAAO,EAAE;AAC5C,QAAM,mBAAmB;AACzB,yBAAuB,OAAO,QAAQ;AAEtC,QAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAC1C;AAEA,eAAe,mBACb,SACA,OACe;AACf,QAAM,SAAS,MAAM,qBAAqB,SAAS,KAAK;AACxD,MAAI,CAAC,OAAQ;AACb,MAAI,CAAE,MAAM,wBAAwB,SAAS,OAAO,OAAO,SAAS,EAAI;AAExE,QAAM,UAAU,MAAM,aAAc,OAAO,QAAQ,OAAO,EAAE;AAC5D,QAAM,mBAAmB;AACzB,yBAAuB,OAAO,QAAQ;AAEtC,QAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,MAAM,MAAM,QAAQ,CAAC;AACzD;AAUO,SAAS,kBAAkB,KAA4B;AAC5D,QAAM,UAAU,EAAE,YAAY,qBAAqB;AACnD,aAAW,QAAQ,CAAC,aAAa,eAAe,GAAG;AACjD,QAAI;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI;AAAA,MACF,GAAG,IAAI;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAEA,QAAI;AAAA,MACF,GAAG,IAAI;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAEA,QAAI;AAAA,MACF,GAAG,IAAI;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAEA,QAAI;AAAA,MACF,GAAG,IAAI;AAAA,MACP;AAAA,MACA;AAAA,IACF;AACA,QAAI;AAAA,MACF,GAAG,IAAI;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;","names":[]}