@betterportal/auth-workos 0.0.1

package/lib/plugins/service-betterportal-auth-workos/index.js

@@ -0,0 +1,575 @@
+import { createConfigSchema, createEventSchemas } from "@bsb/base";
+import * as av from "anyvali";
+import { BetterPortalConfigSchema, BPService } from "@betterportal/plugin-bsb";
+import { WorkOS } from "@workos-inc/node";
+import { htmlResponse, jsonResponse, createBpTokenIssuer, loadOrGenerateKeyPair, publicKeyToJwk } from "@betterportal/framework";
+import { resolve } from "node:path";
+import { registry } from "./.bp-generated/registry.js";
+const SERVICE_ID = "service.betterportal.auth.workos";
+const PluginConfigSchema = av.object({
+    host: av.string().minLength(1).default("0.0.0.0"),
+    port: av.int().min(1).default(3213),
+    issuer: av.string().minLength(1),
+    audience: av.string().minLength(1).default("betterportal-runtime"),
+    accessTokenSeconds: av.int().min(1).default(60 * 15),
+    refreshTokenSeconds: av.int().min(1).default(60 * 60 * 24 * 7),
+    keyStorePath: av.string().minLength(1).default("./.bp-workos-state/keys.json"),
+    betterportal: BetterPortalConfigSchema
+}, { unknownKeys: "strip" });
+const Config = createConfigSchema({
+    name: SERVICE_ID,
+    description: "BetterPortal WorkOS auth service",
+    tags: ["betterportal", "auth", "workos"],
+    documentation: ["./README.md"],
+    image: "./betterportal-logo.png"
+}, PluginConfigSchema);
+const EventSchemas = createEventSchemas({
+    emitEvents: {},
+    onEvents: {},
+    emitReturnableEvents: {},
+    onReturnableEvents: {},
+    emitBroadcast: {},
+    onBroadcast: {}
+});
+function nonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+export function resolveWorkOSAppConfig(raw) {
+    const clientId = nonEmptyString(raw?.clientId);
+    const apiKey = nonEmptyString(raw?.apiKey);
+    if (!clientId || !apiKey)
+        return null;
+    return {
+        clientId,
+        apiKey,
+        provider: nonEmptyString(raw?.provider) ?? "authkit",
+        ...(nonEmptyString(raw?.connectionId) ? { connectionId: nonEmptyString(raw?.connectionId) } : {}),
+        ...(nonEmptyString(raw?.organizationId) ? { organizationId: nonEmptyString(raw?.organizationId) } : {}),
+        ...(nonEmptyString(raw?.domainHint) ? { domainHint: nonEmptyString(raw?.domainHint) } : {}),
+        ...(nonEmptyString(raw?.scopes) ? { scopes: nonEmptyString(raw?.scopes) } : {}),
+        ...(nonEmptyString(raw?.loginRedirectPath) ? { loginRedirectPath: nonEmptyString(raw?.loginRedirectPath) } : {}),
+        ...(nonEmptyString(raw?.logoutRedirectPath) ? { logoutRedirectPath: nonEmptyString(raw?.logoutRedirectPath) } : {}),
+        ...(nonEmptyString(raw?.roleClaimPath) ? { roleClaimPath: nonEmptyString(raw?.roleClaimPath) } : {}),
+        ...(nonEmptyString(raw?.webhookSecret) ? { webhookSecret: nonEmptyString(raw?.webhookSecret) } : {})
+    };
+}
+export function resolveWorkOSBrowserConfig(raw) {
+    const config = resolveWorkOSAppConfig(raw);
+    if (!config)
+        return null;
+    const { apiKey: _apiKey, ...browserConfig } = config;
+    return browserConfig;
+}
+export const WorkOSConfigSchemas = [
+    {
+        id: "workos.app",
+        title: "WorkOS App Config",
+        description: "App-scoped WorkOS AuthKit settings.",
+        scope: "app",
+        jsonSchema: {
+            clientId: "string",
+            apiKey: "string",
+            provider: "string",
+            connectionId: "string",
+            organizationId: "string",
+            domainHint: "string",
+            scopes: "string",
+            loginRedirectPath: "string",
+            logoutRedirectPath: "string",
+            roleClaimPath: "string",
+            webhookSecret: "string"
+        },
+        groups: [
+            { id: "connection", title: "Connection", description: "WorkOS AuthKit application credentials.", order: 10, optional: false },
+            { id: "login", title: "Login", description: "Provider routing and post-login routes.", order: 20, optional: true },
+            { id: "claims", title: "Claims", description: "WorkOS access-token claim paths mapped into BP roles.", order: 30, optional: true },
+            { id: "sync", title: "Role Sync", description: "WorkOS webhook + BP role sync settings.", order: 40, optional: true }
+        ],
+        fields: [
+            { key: "clientId", title: "Client ID", description: "WorkOS client ID for this BP app.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "connection", order: 10, required: true },
+            { key: "apiKey", title: "API Key", description: "WorkOS API key used server-side for code exchange and refresh.", scope: "app", visibility: "secret", ownership: "bp", sourceOfTruth: "bp", groupId: "connection", order: 20, required: true },
+            { key: "provider", title: "Provider", description: "WorkOS provider, usually authkit.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 10, defaultValue: "authkit", required: false },
+            { key: "connectionId", title: "Connection ID", description: "Optional WorkOS connection to force.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 20, required: false },
+            { key: "organizationId", title: "Organization ID", description: "Optional WorkOS organization to force.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 30, required: false },
+            { key: "domainHint", title: "Domain Hint", description: "Optional WorkOS domain hint.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 40, required: false },
+            { key: "scopes", title: "Scopes", description: "Space-separated provider scopes.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 50, defaultValue: "openid profile email", required: false },
+            { key: "loginRedirectPath", title: "Logged In Route", description: "Tenant route shown after signing in when no next path is supplied.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 60, defaultValue: "/", ui: { control: "select", optionsSource: "app.routes" }, required: false },
+            { key: "logoutRedirectPath", title: "Logged Out Route", description: "Tenant route shown after signing out.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "login", order: 70, defaultValue: "/", ui: { control: "select", optionsSource: "app.routes" }, required: false },
+            { key: "roleClaimPath", title: "Role Claim Path", description: "Dot path to roles in the WorkOS access token.", scope: "app", visibility: "protected", ownership: "bp", sourceOfTruth: "bp", groupId: "claims", order: 10, defaultValue: "roles", required: false },
+            { key: "webhookSecret", title: "Webhook Secret", description: "WorkOS webhook signing secret for role sync events.", scope: "app", visibility: "secret", ownership: "bp", sourceOfTruth: "bp", groupId: "sync", order: 10, required: false }
+        ]
+    }
+];
+const BP_PERMISSION_PREFIX = "bp:";
+const STALE_PERMISSION_PREFIX = "DEL: ";
+const ROLE_EVENTS = new Set([
+    "role.created",
+    "role.updated",
+    "role.deleted",
+    "organization_role.created",
+    "organization_role.updated",
+    "organization_role.deleted"
+]);
+export class Plugin extends BPService {
+    static Config = Config;
+    static EventSchemas = EventSchemas;
+    keyPair;
+    constructor(cfg) {
+        super({ ...cfg, eventSchemas: EventSchemas });
+    }
+    async init(obs) {
+        this.keyPair = loadOrGenerateKeyPair(resolve(this.config.keyStorePath));
+        await super.init(obs);
+        const jwk = publicKeyToJwk(this.keyPair.publicKeyPem, this.keyPair.kid);
+        this.registerAsAuthProvider({
+            issuer: this.config.issuer,
+            audience: this.config.audience,
+            jwksUri: `${this.config.issuer.replace(/\/+$/, "")}/.well-known/jwks.json`,
+            jwks: { keys: [jwk] }
+        });
+    }
+    definition() {
+        return {
+            manifest: {
+                pluginId: SERVICE_ID,
+                title: "BetterPortal WorkOS",
+                description: "WorkOS-backed auth service for BetterPortal apps.",
+                capabilities: ["auth", "auth.roles.sync"],
+                configSchemas: WorkOSConfigSchemas
+            },
+            registry
+        };
+    }
+    onRegistered() {
+        this.app.get("/.well-known/bp/config/workos-role-sync", (event) => this.renderRoleSyncFragment(event));
+        this.app.post("/.well-known/bp/config/workos-role-sync/permissions", (event) => this.handlePermissionSync(event));
+        this.app.post("/.well-known/bp/config/workos-role-sync/roles", (event) => this.handleRoleSync(event));
+        this.app.post("/.well-known/workos/webhooks", (event) => this.handleWorkOSWebhook(event));
+    }
+    getJwtVerifier(tenantId, appId) {
+        void tenantId;
+        void appId;
+        return this.tokenIssuer().verifier("access");
+    }
+    async validateTenantApp(tenantId, appId) {
+        if (await this.validateConfigScope(tenantId, appId))
+            return { allowed: true };
+        return {
+            allowed: false,
+            reason: `WorkOS auth service is not activated for tenant ${tenantId} app ${appId}.`
+        };
+    }
+    getWorkOSAppConfig(tenantId, appId) {
+        return resolveWorkOSAppConfig(this.getWorkOSRawConfig(tenantId, appId));
+    }
+    getAuthorizationUrl(config, input) {
+        return this.client(config).userManagement.getAuthorizationUrl({
+            provider: config.provider ?? "authkit",
+            clientId: config.clientId,
+            redirectUri: input.redirectUri,
+            state: input.state,
+            ...(config.connectionId ? { connectionId: config.connectionId } : {}),
+            ...(config.organizationId ? { organizationId: config.organizationId } : {}),
+            ...(config.domainHint ? { domainHint: config.domainHint } : {}),
+            ...(config.scopes ? { providerScopes: splitScopes(config.scopes) } : {})
+        });
+    }
+    authenticateWithCode(config, code) {
+        return this.client(config).userManagement.authenticateWithCode({
+            clientId: config.clientId,
+            code
+        });
+    }
+    refreshWorkOSToken(config, refreshToken) {
+        return this.client(config).userManagement.authenticateWithRefreshToken({
+            clientId: config.clientId,
+            refreshToken
+        });
+    }
+    async syncPermissionsToWorkOS(tenantId, appId) {
+        const config = this.getWorkOSAppConfig(tenantId, appId);
+        if (!config)
+            throw new Error("WorkOS app config is missing clientId or apiKey.");
+        const catalog = this.bpPermissionCatalog(appId);
+        const currentSlugs = new Set(catalog.map((entry) => entry.slug));
+        const client = this.client(config);
+        const [permissions, roles] = await Promise.all([
+            client.authorization.listPermissions().then((list) => list.autoPagination()),
+            this.listWorkOSRoles(config)
+        ]);
+        const rolePermissionSlugs = new Set(roles.flatMap((role) => role.permissions));
+        const bySlug = new Map(permissions.map((permission) => [permission.slug, permission]));
+        let created = 0;
+        let updated = 0;
+        let deleted = 0;
+        let deprecated = 0;
+        for (const entry of catalog) {
+            const existing = bySlug.get(entry.slug);
+            if (!existing) {
+                await client.authorization.createPermission({
+                    slug: entry.slug,
+                    name: entry.title,
+                    description: entry.description
+                });
+                created++;
+            }
+            else if (existing.name !== entry.title || existing.description !== entry.description) {
+                await client.authorization.updatePermission(entry.slug, {
+                    name: entry.title,
+                    description: entry.description
+                });
+                updated++;
+            }
+        }
+        for (const permission of permissions) {
+            if (!permission.slug.startsWith(BP_PERMISSION_PREFIX) || currentSlugs.has(permission.slug))
+                continue;
+            if (rolePermissionSlugs.has(permission.slug)) {
+                const nextName = permission.name.startsWith(STALE_PERMISSION_PREFIX)
+                    ? permission.name
+                    : `${STALE_PERMISSION_PREFIX}${permission.name}`;
+                if (permission.name !== nextName) {
+                    await client.authorization.updatePermission(permission.slug, {
+                        name: nextName,
+                        description: permission.description ?? "Removed BetterPortal permission; remove from roles before deletion."
+                    });
+                    deprecated++;
+                }
+            }
+            else {
+                await client.authorization.deletePermission(permission.slug);
+                deleted++;
+            }
+        }
+        return { created, updated, deleted, deprecated, current: catalog.length };
+    }
+    async syncRolesFromWorkOS(tenantId, appId) {
+        const config = this.getWorkOSAppConfig(tenantId, appId);
+        if (!config)
+            throw new Error("WorkOS app config is missing clientId or apiKey.");
+        const currentSlugs = new Set(this.bpPermissionCatalog(appId).map((entry) => entry.slug));
+        const roles = (await this.listWorkOSRoles(config))
+            .map((role) => this.toBpRole(role, currentSlugs))
+            .filter((role) => Boolean(role));
+        await this.pushRolesToConfigManager(appId, roles);
+        return {
+            roles: roles.length,
+            grants: roles.reduce((sum, role) => sum + role.permissions.length, 0)
+        };
+    }
+    issueTokenPair(input, options) {
+        return this.tokenIssuer().issueTokenPair(input, options);
+    }
+    getWorkOSRawConfig(tenantId, appId) {
+        const ticket = this.workosConfigReadTicket(tenantId);
+        const state = this.configStore.read(ticket);
+        return { ...state.tenant, ...(state.app[appId] ?? {}) };
+    }
+    workosConfigReadTicket(tenantId) {
+        const now = Math.floor(Date.now() / 1000);
+        return {
+            iss: SERVICE_ID,
+            aud: SERVICE_ID,
+            sub: SERVICE_ID,
+            iat: now,
+            exp: now + 60,
+            jti: `${tenantId}:${now}`,
+            realm: "control-plane",
+            tenantId,
+            serviceId: SERVICE_ID,
+            actions: ["config.read"]
+        };
+    }
+    client(config) {
+        return new WorkOS({ apiKey: config.apiKey, clientId: config.clientId });
+    }
+    async listWorkOSRoles(config) {
+        const authorization = this.client(config).authorization;
+        if (config.organizationId) {
+            const list = await authorization.listOrganizationRoles(config.organizationId);
+            return (list.data ?? []);
+        }
+        const list = await authorization.listEnvironmentRoles();
+        return (list.data ?? []);
+    }
+    bpPermissionCatalog(appId) {
+        const portal = this.getPortalConfig();
+        const app = portal?.apps.find((candidate) => candidate.id === appId);
+        if (!app)
+            return [];
+        return app.routes
+            .filter((route) => route.enabled !== false)
+            .flatMap((route) => permissionCatalogForRoute(route, app));
+    }
+    toBpRole(role, currentSlugs) {
+        const byTarget = new Map();
+        for (const slug of role.permissions) {
+            if (!currentSlugs.has(slug))
+                continue;
+            const parsed = parseBpPermissionSlug(slug);
+            if (!parsed)
+                continue;
+            const key = `${parsed.serviceId}\n${parsed.viewId}`;
+            const grant = byTarget.get(key) ?? { serviceId: parsed.serviceId, viewId: parsed.viewId, permissions: [] };
+            if (!grant.permissions.includes(parsed.action))
+                grant.permissions.push(parsed.action);
+            byTarget.set(key, grant);
+        }
+        const permissions = Array.from(byTarget.values());
+        if (permissions.length === 0)
+            return null;
+        return {
+            id: role.slug,
+            title: role.name ?? role.slug,
+            ...(role.description ? { description: role.description } : {}),
+            permissions
+        };
+    }
+    async pushRolesToConfigManager(appId, roles) {
+        const cpUrl = this.bp.controlPlaneUrl?.replace(/\/+$/, "");
+        const apiKey = this.bp.serviceApiKey;
+        if (!cpUrl || !apiKey)
+            throw new Error("BetterPortal controlPlaneUrl and serviceApiKey are required for role sync.");
+        const response = await fetch(`${cpUrl}/.well-known/bp/admin/apps/${encodeURIComponent(appId)}/auth/roles/sync`, {
+            method: "PUT",
+            headers: {
+                Accept: "application/json",
+                "content-type": "application/json",
+                Authorization: `Bearer ${apiKey}`
+            },
+            body: JSON.stringify({ roles })
+        });
+        if (!response.ok) {
+            const body = await response.text().catch(() => "");
+            throw new Error(`Config Manager role sync failed: ${response.status} ${body}`);
+        }
+    }
+    matchingConfiguredApps(event) {
+        const portal = this.getPortalConfig();
+        if (!portal)
+            return [];
+        const eventOrgId = event && typeof event === "object"
+            ? readNestedString(event, ["data", "organizationId"]) ?? readNestedString(event, ["data", "organization_id"])
+            : undefined;
+        return portal.apps.flatMap((app) => {
+            const config = this.getWorkOSAppConfig(app.tenantId, app.id);
+            if (!config)
+                return [];
+            if (eventOrgId && config.organizationId && config.organizationId !== eventOrgId)
+                return [];
+            return [{ tenantId: app.tenantId, appId: app.id, config }];
+        });
+    }
+    async renderRoleSyncFragment(event) {
+        const url = new URL(event.req.url, "http://betterportal.invalid");
+        const tenantId = url.searchParams.get("tenantId") ?? "";
+        const appId = url.searchParams.get("appId") ?? "";
+        if (!tenantId || !appId)
+            return htmlResponse(`<div class="alert alert-danger">tenantId and appId are required.</div>`, 400, "text/html; mode=fragment");
+        const config = this.getWorkOSAppConfig(tenantId, appId);
+        if (!config)
+            return htmlResponse(`<div class="alert alert-warning">WorkOS app config is missing clientId or apiKey.</div>`, 409, "text/html; mode=fragment");
+        const portal = this.getPortalConfig();
+        const app = portal?.apps.find((candidate) => candidate.id === appId);
+        const selfBase = requestBaseUrl(event.req);
+        const bpRoles = (app?.auth?.roles ?? []);
+        let workosRoles = [];
+        let error = "";
+        try {
+            workosRoles = await this.listWorkOSRoles(config);
+        }
+        catch (err) {
+            error = err instanceof Error ? err.message : String(err);
+        }
+        const currentSlugs = new Set(this.bpPermissionCatalog(appId).map((entry) => entry.slug));
+        const syncedIds = new Set(bpRoles.map((role) => role.id));
+        const roleRows = workosRoles
+            .filter((role) => role.permissions.some((permission) => currentSlugs.has(permission)))
+            .map((role) => `<tr><td><code>${escapeHtml(role.slug)}</code></td><td>${escapeHtml(role.name ?? role.slug)}</td><td>${role.permissions.filter((permission) => currentSlugs.has(permission)).length}</td><td>${syncedIds.has(role.slug) ? "Synced" : "Pending"}</td></tr>`)
+            .join("");
+        return htmlResponse(`
+      <div class="card border-0 shadow-sm">
+        <div class="card-body">
+          <div class="d-flex justify-content-between align-items-start gap-3 mb-3">
+            <div>
+              <h5 class="card-title mb-1">WorkOS Role Sync</h5>
+              <div class="text-secondary small">BP permissions sync to WorkOS; WorkOS roles mirror back to this app.</div>
+            </div>
+            <div class="btn-group btn-group-sm">
+              <button class="btn btn-outline-primary" hx-post="${selfBase}/.well-known/bp/config/workos-role-sync/permissions?tenantId=${encodeURIComponent(tenantId)}&appId=${encodeURIComponent(appId)}" hx-target="closest .card" hx-swap="outerHTML">Sync permissions</button>
+              <button class="btn btn-outline-primary" hx-post="${selfBase}/.well-known/bp/config/workos-role-sync/roles?tenantId=${encodeURIComponent(tenantId)}&appId=${encodeURIComponent(appId)}" hx-target="closest .card" hx-swap="outerHTML">Sync roles</button>
+            </div>
+          </div>
+          ${error ? `<div class="alert alert-danger">${escapeHtml(error)}</div>` : ""}
+          <div class="mb-2 small"><strong>BP permissions:</strong> ${currentSlugs.size} <span class="text-secondary">|</span> <strong>Mirrored BP roles:</strong> ${bpRoles.length}</div>
+          <div class="table-responsive">
+            <table class="table table-sm align-middle mb-0">
+              <thead><tr><th>Role slug</th><th>Name</th><th>Current BP grants</th><th>Status</th></tr></thead>
+              <tbody>${roleRows || `<tr><td colspan="4" class="text-secondary">No WorkOS roles with current BP permissions.</td></tr>`}</tbody>
+            </table>
+          </div>
+        </div>
+      </div>
+    `, 200, "text/html; mode=fragment");
+    }
+    async handlePermissionSync(event) {
+        const url = new URL(event.req.url, "http://betterportal.invalid");
+        const tenantId = url.searchParams.get("tenantId") ?? "";
+        const appId = url.searchParams.get("appId") ?? "";
+        try {
+            const result = await this.syncPermissionsToWorkOS(tenantId, appId);
+            const fragment = await this.renderRoleSyncFragment(event);
+            fragment.headers.set("HX-Trigger", JSON.stringify({ "bp:toast": `WorkOS permissions synced (${result.created} created, ${result.updated} updated).` }));
+            return fragment;
+        }
+        catch (err) {
+            return htmlResponse(`<div class="alert alert-danger">${escapeHtml(err instanceof Error ? err.message : String(err))}</div>`, 500, "text/html; mode=fragment");
+        }
+    }
+    async handleRoleSync(event) {
+        const url = new URL(event.req.url, "http://betterportal.invalid");
+        const tenantId = url.searchParams.get("tenantId") ?? "";
+        const appId = url.searchParams.get("appId") ?? "";
+        try {
+            const result = await this.syncRolesFromWorkOS(tenantId, appId);
+            const fragment = await this.renderRoleSyncFragment(event);
+            fragment.headers.set("HX-Trigger", JSON.stringify({ "bp:toast": `WorkOS roles synced (${result.roles} roles).` }));
+            return fragment;
+        }
+        catch (err) {
+            return htmlResponse(`<div class="alert alert-danger">${escapeHtml(err instanceof Error ? err.message : String(err))}</div>`, 500, "text/html; mode=fragment");
+        }
+    }
+    async handleWorkOSWebhook(event) {
+        const payload = await event.req.text();
+        const sigHeader = event.req.headers.get("workos-signature");
+        if (!sigHeader)
+            return jsonResponse({ error: "Missing WorkOS signature" }, 401);
+        for (const candidate of this.matchingConfiguredApps()) {
+            if (!candidate.config.webhookSecret)
+                continue;
+            try {
+                const workosEvent = await this.client(candidate.config).webhooks.constructEvent({
+                    payload,
+                    sigHeader,
+                    secret: candidate.config.webhookSecret
+                });
+                if (!ROLE_EVENTS.has(workosEvent.event))
+                    return jsonResponse({ ok: true, ignored: true });
+                const apps = this.matchingConfiguredApps(workosEvent);
+                for (const app of apps) {
+                    await this.syncRolesFromWorkOS(app.tenantId, app.appId);
+                }
+                return jsonResponse({ ok: true, synced: apps.length });
+            }
+            catch {
+                // Try the next configured webhook secret.
+            }
+        }
+        return jsonResponse({ error: "Invalid WorkOS signature" }, 401);
+    }
+    tokenIssuer() {
+        return createBpTokenIssuer({
+            keyPair: this.keyPair,
+            issuer: this.config.issuer,
+            audience: this.config.audience,
+            accessTokenSeconds: this.config.accessTokenSeconds,
+            refreshTokenSeconds: this.config.refreshTokenSeconds
+        });
+    }
+}
+export { Config, EventSchemas };
+export function rolesFromWorkOSAccessToken(token, roleClaimPath = "roles") {
+    const [, payload] = token.split(".");
+    if (!payload)
+        return [];
+    try {
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return readStringArrayClaim(claims, roleClaimPath);
+    }
+    catch {
+        return [];
+    }
+}
+export function secondsUntilJwtExpiry(token) {
+    const [, payload] = token.split(".");
+    if (!payload)
+        return undefined;
+    try {
+        const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        if (typeof parsed.exp !== "number")
+            return undefined;
+        return Math.max(1, Math.floor(parsed.exp - Date.now() / 1000));
+    }
+    catch {
+        return undefined;
+    }
+}
+function splitScopes(value) {
+    return value.split(/\s+/).map((entry) => entry.trim()).filter(Boolean);
+}
+function readStringArrayClaim(claims, path) {
+    const value = path.split(".").reduce((current, segment) => {
+        if (!current || typeof current !== "object")
+            return undefined;
+        return current[segment];
+    }, claims);
+    if (Array.isArray(value))
+        return value.filter((entry) => typeof entry === "string" && entry.length > 0);
+    return typeof value === "string" && value.length > 0 ? [value] : [];
+}
+function permissionCatalogForRoute(route, app) {
+    const title = route.title ?? route.viewId;
+    return ["read", "create", "update", "delete"].map((action) => ({
+        slug: bpPermissionSlug(route.serviceId, route.viewId, action),
+        serviceId: route.serviceId,
+        viewId: route.viewId,
+        action,
+        title: `${title}: ${action}`,
+        description: `${app.title} ${title} ${action} permission`
+    }));
+}
+export function bpPermissionSlug(serviceId, viewId, action) {
+    return `${BP_PERMISSION_PREFIX}${serviceId}:${viewId}:${action}`;
+}
+export function parseBpPermissionSlug(slug) {
+    if (!slug.startsWith(BP_PERMISSION_PREFIX))
+        return null;
+    const parts = slug.slice(BP_PERMISSION_PREFIX.length).split(":");
+    if (parts.length !== 3)
+        return null;
+    const [serviceId, viewId, action] = parts;
+    if (!serviceId || !viewId || !isPermissionAction(action))
+        return null;
+    return { serviceId, viewId, action };
+}
+function isPermissionAction(value) {
+    return value === "read" || value === "create" || value === "update" || value === "delete";
+}
+function readNestedString(value, path) {
+    let current = value;
+    for (const segment of path) {
+        if (!current || typeof current !== "object")
+            return undefined;
+        current = current[segment];
+    }
+    return typeof current === "string" && current.length > 0 ? current : undefined;
+}
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (char) => ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&#39;"
+    }[char]));
+}
+function requestBaseUrl(req) {
+    const url = new URL(req.url, "http://betterportal.invalid");
+    if (url.origin !== "http://betterportal.invalid")
+        return url.origin;
+    const host = req.headers.get("x-forwarded-host") ?? req.headers.get("host") ?? "betterportal.invalid";
+    const proto = req.headers.get("x-forwarded-proto") ?? "https";
+    return `${proto}://${host}`;
+}
+//# sourceMappingURL=index.js.map

package/lib/plugins/service-betterportal-auth-workos/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-workos/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,SAAS,EAEV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,MAAM,EAA+B,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EAaf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,MAAM,UAAU,GAAG,kCAAkC,CAAC;AAEtD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACjD,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClE,kBAAkB,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACpD,mBAAmB,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC;IAC9E,YAAY,EAAE,wBAAwB;CACvC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AAG7B,MAAM,MAAM,GAAG,kBAAkB,CAC/B;IACE,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,kCAAkC;IAC/C,IAAI,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC;IACxC,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,KAAK,EAAE,yBAAyB;CACjC,EACD,kBAAkB,CACnB,CAAC;AAEF,MAAM,YAAY,GAAG,kBAAkB,CAAC;IACtC,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE;IACtB,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;CAChB,CAAC,CAAC;AAkBH,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAwC;IAC7E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO;QACL,QAAQ;QACR,MAAM;QACN,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,SAAS;QACpD,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAwC;IACjF,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC;IACrD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAA6B;IAC3D;QACE,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,qCAAqC;QAClD,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE;YACV,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,QAAQ;YACtB,cAAc,EAAE,QAAQ;YACxB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,QAAQ;YAChB,iBAAiB,EAAE,QAAQ;YAC3B,kBAAkB,EAAE,QAAQ;YAC5B,aAAa,EAAE,QAAQ;YACvB,aAAa,EAAE,QAAQ;SACxB;QACD,MAAM,EAAE;YACN,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,yCAAyC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC7H,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,yCAAyC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YAClH,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,uDAAuD,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YAClI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yCAAyC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SACtH;QACD,MAAM,EAAE;YACN,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxN,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,gEAAgE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9O,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,mCAAmC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC5O,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,sCAAsC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC/N,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,wCAAwC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACrO,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,8BAA8B,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACnN,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,kCAAkC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE;YACpP,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,oEAAoE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC/U,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,uCAAuC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACpT,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,+CAA+C,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;YACnQ,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,qDAAqD,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC7O;KACF;CACF,CAAC;AAwBF,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AACxC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,cAAc;IACd,cAAc;IACd,cAAc;IACd,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC,CAAC;AAEH,MAAM,OAAO,MAAO,SAAQ,SAA2D;IACrF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAC3B,OAAO,CAAc;IAE7B,YAAY,GAA4E;QACtF,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,sBAAsB,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;YAC1E,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAyC,CAAC,EAAE;SAC5D,CAAC,CAAC;IACL,CAAC;IAES,UAAU;QAClB,OAAO;YACL,QAAQ,EAAE;gBACR,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,qBAAqB;gBAC5B,WAAW,EAAE,mDAAmD;gBAChE,YAAY,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC;gBACzC,aAAa,EAAE,mBAAmB;aACnC;YACD,QAAQ;SACT,CAAC;IACJ,CAAC;IAES,YAAY;QACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;QAClH,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5F,CAAC;IAES,cAAc,CAAC,QAAgB,EAAE,KAAa;QACtD,KAAK,QAAQ,CAAC;QACd,KAAK,KAAK,CAAC;QACX,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,KAAa;QAC/D,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,mDAAmD,QAAQ,QAAQ,KAAK,GAAG;SACpF,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,QAAgB,EAAE,KAAa;QAChD,OAAO,sBAAsB,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,mBAAmB,CAAC,MAAuB,EAAE,KAA6C;QACxF,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAC;YAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB,CAAC,MAAuB,EAAE,IAAY;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC;YAC7D,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB,CAAC,MAAuB,EAAE,YAAoB;QAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,4BAA4B,CAAC;YACrE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,QAAgB,EAAE,KAAa;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,MAAM,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5E,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAE,WAAkC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;oBAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,KAAK;oBACjB,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvF,MAAM,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE;oBACtD,IAAI,EAAE,KAAK,CAAC,KAAK;oBACjB,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,WAAiC,EAAE,CAAC;YAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YACrG,IAAI,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;oBAClE,CAAC,CAAC,UAAU,CAAC,IAAI;oBACjB,CAAC,CAAC,GAAG,uBAAuB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;gBACnD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE;wBAC3D,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,qEAAqE;qBAC7G,CAAC,CAAC;oBACH,UAAU,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC7D,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,KAAa;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;aAChD,MAAM,CAAC,CAAC,IAAI,EAAuB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,KAWd,EAAE,OAA2C;QAC5C,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAEO,kBAAkB,CAAC,QAAgB,EAAE,KAAa;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IAEO,sBAAsB,CAAC,QAAgB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,OAAO;YACL,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,EAAE;YACb,GAAG,EAAE,GAAG,QAAQ,IAAI,GAAG,EAAE;YACzB,KAAK,EAAE,eAAe;YACtB,QAAQ;YACR,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,CAAC,aAAa,CAAC;SACzB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,MAAuB;QACpC,OAAO,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAuB;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC;QACxD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAiB,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,oBAAoB,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAiB,CAAC;IAC3C,CAAC;IAEO,mBAAmB,CAAC,KAAa;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,MAAM;aACd,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;aAC1C,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,yBAAyB,CAAC,KAA+B,EAAE,GAAsB,CAAC,CAAC,CAAC;IAC5G,CAAC;IAEO,QAAQ,CAAC,IAAgB,EAAE,YAAyB;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAC;QACvE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;YAC3G,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAClD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,IAAI;YACb,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;YAC7B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,WAAW;SACZ,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAC,KAAa,EAAE,KAAoB;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC;QACrC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,KAAK,8BAA8B,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,EAAE;YAC9G,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,KAAe;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YACnD,CAAC,CAAC,gBAAgB,CAAC,KAAgC,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,IAAI,gBAAgB,CAAC,KAAgC,EAAE,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YACnK,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,CAAC;YACvB,IAAI,UAAU,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU;gBAAE,OAAO,EAAE,CAAC;YAC3F,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,KAAuB;QAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,wEAAwE,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACxJ,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC,yFAAyF,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAC7J,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAI,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAmB,CAAC;QAC5D,IAAI,WAAW,GAAiB,EAAE,CAAC;QACnC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,WAAW;aACzB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;aACrF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,YAAY,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,YAAY,CAAC;aACzQ,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,YAAY,CAAC;;;;;;;;;iEASyC,QAAQ,gEAAgE,kBAAkB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC;iEACvI,QAAQ,0DAA0D,kBAAkB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC;;;YAGtL,KAAK,CAAC,CAAC,CAAC,mCAAmC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;qEAChB,YAAY,CAAC,IAAI,8EAA8E,OAAO,CAAC,MAAM;;;;uBAI3J,QAAQ,IAAI,mGAAmG;;;;;KAKjI,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,KAAuB;QACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,8BAA8B,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,OAAO,YAAY,EAAE,CAAC,CAAC,CAAC;YACxJ,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,mCAAmC,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChK,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAuB;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,wBAAwB,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC;YACnH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,mCAAmC,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChK,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAuB;QACvD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;QAChF,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa;gBAAE,SAAS;YAC9C,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;oBAC9E,OAAO;oBACP,SAAS;oBACT,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,aAAa;iBACvC,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC;oBAAE,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC;gBACtD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAe,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IAEO,WAAW;QACjB,OAAO,mBAAmB,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SACrD,CAAC,CAAC;IACL,CAAC;;AAGH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAEhC,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,aAAa,GAAG,OAAO;IAC/E,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;QACzG,OAAO,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;QACnG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA+B,EAAE,IAAY;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAU,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9D,OAAQ,OAAmC,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC,EAAE,MAAM,CAAC,CAAC;IACX,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzH,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,yBAAyB,CAAC,KAA6B,EAAE,GAAoB;IACpF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;IAC1C,OAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QAC7D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,KAAK,EAAE,GAAG,KAAK,KAAK,MAAM,EAAE;QAC5B,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,KAAK,IAAI,MAAM,aAAa;KAC1D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc,EAAE,MAA+B;IACjG,OAAO,GAAG,oBAAoB,GAAG,SAAS,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAC1C,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,CAAC;AAC5F,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA8B,EAAE,IAAc;IACtE,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9D,OAAO,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,OAAO;KACb,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,6BAA6B;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC;IACtG,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC;IAC9D,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC"}