@burdenoff/be-sdk 2026.1008.2 → 2026.1008.3

package/dist/index.js

@@ -45,8 +45,8 @@ export { cache_exports as Cache } from './chunk-PVNNVIIA.js';
 import { disposeAll } from './chunk-KO2ZXZ7W.js';
 export { lifecycle_exports as Lifecycle, disposeAll, getRegisteredDisposableCount, registerDisposable, unregisterDisposable } from './chunk-KO2ZXZ7W.js';
 import './chunk-A5F6Z5UE.js';
-export { captcha_exports as Captcha, isCaptchaEnabled, verifyCaptcha, verifyCaptchaIfEnabled } from './chunk-YMZEUTD2.js';
 export { createInternalClient, createInternalClientForTenant, createInternalClientForWorkspaces } from './chunk-KJOSPVB2.js';
+export { captcha_exports as Captcha, isCaptchaEnabled, verifyCaptcha, verifyCaptchaIfEnabled } from './chunk-YMZEUTD2.js';
 export { crypto_exports as Crypto } from './chunk-SBS4S2PJ.js';
 import { DatabaseModule } from './chunk-UD5PPGVU.js';
 export { DatabaseModule } from './chunk-UD5PPGVU.js';

package/dist/server/index.js

@@ -1,7 +1,7 @@
 import { createHumanReadableErrorPlugin, formatHttpError, normalizeGraphQLResponse, createHttpErrorResponse } from '../chunk-6GL4SLU7.js';
 export { UserFacingGraphQLError, createHttpErrorResponse, createHumanReadableErrorPlugin, createWorkspaceGuardPlugin, formatHttpError, normalizeError, normalizeExecutionResultErrors, normalizeGraphQLResponse, normalizeGraphQLResponsePayload, toUserFacingGraphQLError } from '../chunk-6GL4SLU7.js';
 import { getWorkspaceQuotaRegistry } from '../chunk-WTEHAVBX.js';
-import { setWorkspaceContext } from '../chunk-CYY4VIRK.js';
+import { setWorkspaceContext, withWorkspaceContext } from '../chunk-CYY4VIRK.js';
 import { I18n } from '../chunk-EBDHIL7V.js';
 import { getMetricsRegistry } from '../chunk-AWPNRV3L.js';
 import { ContextManager } from '../chunk-RZOFS2BQ.js';
@@ -501,6 +501,71 @@ function getContextOptions() {
 }
 __name(getContextOptions, "getContextOptions");
 
+// src/server/workspace-execution-context.ts
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(record, "record");
+function string(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+__name(string, "string");
+function id(value) {
+  return record(value) ? string(value["id"]) : void 0;
+}
+__name(id, "id");
+function executionContext(value) {
+  if (!record(value)) return {};
+  return {
+    workspaceId: id(value["workspace"]),
+    tenantId: id(value["tenant"]),
+    organizationId: id(value["organization"]),
+    projectId: id(value["project"]),
+    actorId: id(value["actor"]),
+    actorType: record(value["actor"]) ? string(value["actor"]["type"]) : void 0,
+    onBehalfOf: string(value["onBehalfOf"])
+  };
+}
+__name(executionContext, "executionContext");
+function scopedIterable(source, scope) {
+  return {
+    [Symbol.asyncIterator]() {
+      const iterator = source[Symbol.asyncIterator]();
+      const finish = iterator.return?.bind(iterator);
+      const fail = iterator.throw?.bind(iterator);
+      return {
+        next: /* @__PURE__ */ __name((...args) => withWorkspaceContext(scope, async () => iterator.next(...args)), "next"),
+        return: finish ? (value) => withWorkspaceContext(scope, async () => finish(value)) : void 0,
+        throw: fail ? (error) => withWorkspaceContext(scope, async () => fail(error)) : void 0
+      };
+    }
+  };
+}
+__name(scopedIterable, "scopedIterable");
+function createWorkspaceExecutionContextPlugin() {
+  return {
+    onExecute({ executeFn, setExecuteFn }) {
+      setExecuteFn((args) => {
+        const scope = executionContext(args.contextValue);
+        return withWorkspaceContext(scope, async () => {
+          const result = await executeFn(args);
+          return Symbol.asyncIterator in result ? scopedIterable(result, scope) : result;
+        });
+      });
+    },
+    onSubscribe({ subscribeFn, setSubscribeFn }) {
+      setSubscribeFn((args) => {
+        const scope = executionContext(args.contextValue);
+        return withWorkspaceContext(scope, async () => {
+          const result = await subscribeFn(args);
+          return Symbol.asyncIterator in result ? scopedIterable(result, scope) : result;
+        });
+      });
+    }
+  };
+}
+__name(createWorkspaceExecutionContextPlugin, "createWorkspaceExecutionContextPlugin");
+
 // src/server/security.ts
 var LOCALHOST_ORIGINS = [
   "http://localhost:3000",
@@ -818,7 +883,9 @@ async function createServer(definition) {
       }),
       ...workspaceGuardPlugins,
       responseHeadersPlugin,
-      ...yogaPlugins || []
+      ...yogaPlugins || [],
+      // Consumers such as GraphQL Modules replace execute/subscribe; bind their final functions.
+      createWorkspaceExecutionContextPlugin()
     ],
     context: /* @__PURE__ */ __name(async ({ request }) => {
       const defaultContext = await buildContext(request);

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/auth.ts","../../src/server/verified-delegation.ts","../../src/server/context.ts","../../src/server/security.ts","../../src/server/quotaGaugeRefresh.ts","../../src/server/readiness.ts","../../src/server/server.ts"],"names":["getDbFn","getDb","prismaModule","joseModule","jwtModule","getJose","getJwt","jwt","default","authConfig","configureAuth","config","logger","debug","fetchWorkspaceSecret","workspaceId","db","workspace","client","findUnique","where","id","jwtSecret","JSON","parse","stringify","error","warn","configureDefaultAuth","generateSymmetricSecret","joseLib","secret","generateSecret","jwk","exportJWK","verifyJWT","token","options","decoded","decode","complete","payload","verifiedJwt","verify","mapPayloadToActor","decodedJwt","decodeJwt","workspace_id","workspaceSecret","keyLikeSecret","importJWK","jwtVerify","err","decodeJWT","sub","type","actor_type","tenant_id","org_id","isAdmin","authCheck","actor","Error","workspaceCheck","context","actorId","requireWorkspace","orgCheck","organization","orgId","tenantCheck","tenant","object","value","Array","isArray","identifier","from","every","character","charCodeAt","list","instant","time","Date","Number","isFinite","toISOString","decodeVerifiedDelegation","header","trustedGateway","now","provenance","includes","undefined","invalid","raw","tokenExpiresAt","getTime","length","consent","facts","grantedAt","expiresAt","grantedBy","representedUserId","originatingAppId","delegationId","scopes","allowedWorkspaceIds","contextOptions","configureContext","getHeader","request","key","headers","get","toLowerCase","compareSecret","provided","expected","providedBuffer","Buffer","expectedBuffer","crypto","timingSafeEqual","shouldTrustActorHeaders","nodeEnv","process","env","expectedGatewayToken","providedGatewayToken","extractTracking","forwardedFor","realIp","ip","split","trim","userAgent","actorProvenance","extractActor","actorType","userRole","authHeader","startsWith","substring","extractTenant","tenantId","tenantEndpoint","endpoint","defaultTenant","extractOrganization","extractWorkspace","extractProject","projectId","extractProduct","productId","extractGeography","country","currency","timezone","toUpperCase","extractConsentContext","scopesHeader","grantedAtHeader","expiresAtHeader","map","s","buildContext","project","product","tracking","consentContext","verifiedDelegation","i18n","createContextFromRequest","geo","locale","language","t","tp","formatNumber","String","formatCurrency","formatDate","date","formatRelativeTime","unit","onBehalfOf","wsCtxPayload","organizationId","rawHeader","setWorkspaceContext","ContextManager","setCfAccessContext","responseHeaders","Headers","getContextOptions","LOCALHOST_ORIGINS","normalizeCorsOrigins","origins","environment","normalized","origin","filter","Boolean","resolveAllowedCorsOrigin","requestOrigin","allowedOrigins","canAccessGraphExport","envMs","name","fallback","parsed","parseInt","QUOTA_GAUGE_TTL_MS","QUOTA_GAUGE_REFRESH_TIMEOUT_MS","createQuotaGaugeRefresher","opts","ttlMs","timeoutMs","refreshedAt","inFlight","refresh","timer","Promise","race","resolve","collect","then","setTimeout","clearTimeout","lastRefreshedAt","READINESS_CACHE_MS","READINESS_PROBE_TIMEOUT_MS","DEFAULT_REQUIRED","withTimeout","work","ms","label","_","reject","runCheck","required","started","ok","latencyMs","message","createReadinessProbe","deps","Set","requiredDependencies","cache","probe","checks","jobs","prisma","push","has","$queryRaw","r","postgres","valkey","ping","eventQueue","q","isConnected","connected","healthCheck","res","all","results","Object","values","ready","c","healthy","getReadiness","at","snapshot","finally","readinessStatusCode","readinessBody","service","version","timestamp","uptimeSeconds","status","livenessBody","serverStartTime","quotaGaugeRefresher","getWorkspaceQuotaRegistry","collectAll","createServer","definition","prismaClient","schema","moduleGraph","restEndpoints","yogaPlugins","customBuildContext","workspaceExtensionConfig","disableWorkspaceExtension","onShutdown","Elysia","BunAdapter","cors","createYoga","initializeDatabase","getDatabaseManager","createSecurityPlugin","createMetricsPlugin","createWorkspaceGuardPlugin","info","serviceName","boundary","shouldEnableWorkspaceExtension","workspaceExtension","connect","registerShutdownHandlers","enableWorkspaceExtension","i18nInstance","enabled","localesPath","I18n","defaultLocale","fallbackLocale","supportedLocales","namespace","lazyLoad","logMissing","enableCache","returnKeyOnMissing","initialize","getSupportedLocales","join","isDev","enablePlayground","batching","workspaceGuardEnabled","workspaceGuard","workspaceGuardPlugins","whitelistedOperations","graphqlEndpoint","responseHeadersPlugin","onResponse","response","serverContext","yogaContext","forEach","append","yoga","graphiql","logging","args","plugins","createHumanReadableErrorPlugin","defaultContext","app","adapter","corsOrigins","use","credentials","allowedHeaders","methods","rawBodyEndpoints","ep","rawBody","rawBodyPaths","Map","path","rawBodyMatchers","regexPattern","replace","regex","RegExp","matchRawBodyEndpoint","pathname","exactMatch","isMatch","test","onRequest","url","URL","method","isHealthRoute","buildCorsHeaders","allowedOrigin","rawBodyEndpoint","corsHeaders","Response","text","result","handler","entries","set","body","statusText","formatted","formatHttpError","promClientMod","prom","collectDefaultMetrics","register","promBody","metrics","sdkBody","getMetricsRegistry","toPrometheusFormat","combined","contentType","yogaRoutes","shouldHandleByYoga","yogaResponse","normalizeGraphQLResponse","fetch","csrfSkipRoutes","loginEndpoints","enableCSRF","enableSessionSecurity","serviceVersion","getValkeyClient","health","shallow","deep","ctx","ctxWithSet","code","Math","round","uptime","getSchema","query","exportAll","types","entityTypes","exportEntities","exportRelationships","createHttpErrorResponse","post","put","patch","delete","host","port","serverInstance","server","start","listen","hostname","elysiaApp","stop","shutdown","disconnect","getInfo","floor","startedAt","gracefulShutdown","signal","exit","on","configureServerAuth"],"mappings":";;;;;;;;;;;;AA4BA,IAAIA,OAAAA,GAAmC,IAAA;AAEvC,eAAeC,KAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,IAAA,MAAME,YAAAA,GAAe,MAAM,OAAO,oBAAA,CAAA;AAElCF,IAAAA,OAAAA,GAAUE,YAAAA,CAAaD,KAAAA;AACzB,EAAA;AACA,EAAA,OAAOD,OAAAA,EAAAA;AACT;AAPeC,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAgBf,IAAIE,UAAAA,GAAiC,IAAA;AACrC,IAAIC,SAAAA,GAA8B,IAAA;AAElC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeE,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOf,eAAeC,MAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,SAAAA,EAAW;AACd,IAAA,MAAMG,GAAAA,GAAM,MAAM,OAAO,cAAA,CAAA;AAEzBH,IAAAA,SAAAA,GAAaG,IAAgCC,OAAAA,IAAWD,GAAAA;AAC1D,EAAA;AACA,EAAA,OAAOH,SAAAA;AACT;AAPeE,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAsBf,IAAIG,UAAAA,GAAgC,IAAA;AAK7B,SAASC,cAAcC,MAAAA,EAAkB;AAC9CF,EAAAA,UAAAA,GAAaE,MAAAA;AACbC,EAAAA,MAAAA,CAAOC,MAAM,8BAAA,CAAA;AACf;AAHgBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAchB,eAAsBI,qBAAqBC,WAAAA,EAAmB;AAC5D,EAAA,IAAI;AACF,IAAA,MAAMC,EAAAA,GAAK,MAAMf,KAAAA,EAAAA;AACjB,IAAA,MAAMgB,SAAAA,GAAY,MAAMD,EAAAA,CAAGE,MAAAA,CAAOD,UAAUE,UAAAA,CAAW;MACrDC,KAAAA,EAAO;QAAEC,EAAAA,EAAIN;AAAY;KAC3B,CAAA;AAEA,IAAA,IAAI,CAACE,WAAWK,SAAAA,EAAW;AACzBV,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;AAAEE,QAAAA;OAAY,CAAA;AAC7E,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOQ,KAAKC,KAAAA,CAAMD,IAAAA,CAAKE,SAAAA,CAAUR,SAAAA,CAAUK,SAAS,CAAA,CAAA;AACtD,EAAA,CAAA,CAAA,OAASI,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,KAAK,8CAAA,EAAgD;AAAEZ,MAAAA,WAAAA;AAAaW,MAAAA;KAAM,CAAA;AACjF,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAjBsBZ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwBf,SAASc,oBAAAA,GAAAA;AACd,EAAA,IAAI,CAACnB,UAAAA,EAAY;AACfC,IAAAA,aAAAA,CAAc;AAAEI,MAAAA;KAAqB,CAAA;AACrCF,IAAAA,MAAAA,CAAOC,MAAM,6EAAA,CAAA;AACf,EAAA;AACF;AALgBe,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWhB,eAAsBC,uBAAAA,GAAAA;AACpB,EAAA,MAAMC,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,EAAA,MAAM0B,MAAAA,GAAS,MAAMD,OAAAA,CAAQE,cAAAA,CAAe,OAAA,CAAA;AAC5C,EAAA,MAAMC,GAAAA,GAAM,MAAMH,OAAAA,CAAQI,SAAAA,CAAUH,MAAAA,CAAAA;AACpC,EAAA,OAAOE,GAAAA;AACT;AALsBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAetB,eAAsBM,SAAAA,CAAUC,KAAAA,EAAeL,MAAAA,EAAiBM,OAAAA,GAAyB,EAAC,EAAC;AACzF,EAAA,IAAI;AACF,IAAA,MAAM9B,GAAAA,GAAM,MAAMD,MAAAA,EAAAA;AAClB,IAAA,MAAMwB,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AAGtB,IAAA,MAAMiC,OAAAA,GAAU/B,GAAAA,CAAIgC,MAAAA,CAAOH,KAAAA,EAAO;MAAEI,QAAAA,EAAU;KAAK,CAAA;AAEnD,IAAA,IAAI,CAACF,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,IAAY,CAACA,OAAAA,CAAQG,OAAAA,IAAW,OAAOH,OAAAA,CAAQG,OAAAA,KAAY,QAAA,EAAU;AACtG7B,MAAAA,MAAAA,CAAOe,KAAK,mCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,IAAII,MAAAA,EAAQ;AAEV,MAAA,MAAMW,YAAAA,GAAcnC,GAAAA,CAAIoC,MAAAA,CAAOP,KAAAA,EAAOL,QAAQM,OAAAA,CAAAA;AAC9C,MAAA,OAAOO,kBAAkBF,YAAAA,CAAAA;AAC3B,IAAA;AAGA,IAAA,MAAMG,UAAAA,GAAaf,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;AACrC,IAAA,IAAI,CAACS,WAAWE,YAAAA,EAAc;AAC5BnC,MAAAA,MAAAA,CAAOe,KAAK,6CAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAAClB,YAAYK,oBAAAA,EAAsB;AACrCF,MAAAA,MAAAA,CAAOc,MAAM,+DAAA,CAAA;AACb,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,eAAAA,GAAkB,MAAMvC,UAAAA,CAAWK,oBAAAA,CAAqB+B,WAAWE,YAAY,CAAA;AACrF,IAAA,IAAI,CAACC,eAAAA,EAAiB;AACpBpC,MAAAA,MAAAA,CAAOe,KAAK,yCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,aAAAA,GAAgB,MAAMnB,OAAAA,CAAQoB,SAAAA,CAAUF,iBAAiB,OAAA,CAAA;AAC/D,IAAA,MAAMN,cAAc,MAAMZ,OAAAA,CAAQqB,SAAAA,CAAUf,KAAAA,EAAOa,eAAeZ,OAAAA,CAAAA;AAClE,IAAA,OAAOO,iBAAAA,CAAkBF,YAAYD,OAAO,CAAA;AAC9C,EAAA,CAAA,CAAA,OAASW,GAAAA,EAAK;AACZxC,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,qCAAqCyB,GAAAA,CAAAA;AACjD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA7CsBjB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkDtB,eAAsBkB,UAAUjB,KAAAA,EAAa;AAC3C,EAAA,IAAI;AACF,IAAA,MAAMN,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,IAAA,OAAOyB,OAAAA,CAAQgB,UAAUV,KAAAA,CAAAA;EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAPsBiB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAYtB,SAAST,kBAAkBH,OAAAA,EAAmB;AAC5C,EAAA,OAAO;AACLpB,IAAAA,EAAAA,EAAIoB,OAAAA,CAAQa,GAAAA;AACZC,IAAAA,IAAAA,EAAMd,QAAQe,UAAAA,IAAc,MAAA;AAC5BT,IAAAA,YAAAA,EAAcN,OAAAA,CAAQM,YAAAA;AACtBU,IAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBC,IAAAA,MAAAA,EAAQjB,OAAAA,CAAQiB,MAAAA;AAChBC,IAAAA,OAAAA,EAASlB,QAAQ,SAAA;AACnB,GAAA;AACF;AATSG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAcF,SAASgB,UAAUC,KAAAA,EAAoB;AAC5C,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,MAAM,IAAIC,MAAM,gBAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOD,KAAAA;AACT;AALgBD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAUT,SAASG,eAAeC,OAAAA,EAAmE;AAIhG,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfN,IAAAA,WAAAA,EAAaiD,QAAQ/C,SAAAA,CAAUI;AACjC,GAAA;AACF;AAdgB0C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,SAASG,iBACdF,OAAAA,EAAU;AAGVJ,EAAAA,SAAAA,CAAUI,QAAQH,KAAK,CAAA;AAEvB,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAGA,EAAA,OAAOE,OAAAA;AACT;AAZgBE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,SAASC,SAASH,OAAAA,EAAsE;AAI7F,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQI,YAAAA,EAAc/C,EAAAA,EAAI;AAC7B,IAAA,MAAM,IAAIyC,MAAM,kCAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfgD,IAAAA,KAAAA,EAAOL,QAAQI,YAAAA,CAAa/C;AAC9B,GAAA;AACF;AAdgB8C,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAmBT,SAASG,YAAYN,OAAAA,EAA0C;AACpE,EAAA,IAAI,CAACA,OAAAA,CAAQO,MAAAA,EAAQlD,EAAAA,EAAI;AACvB,IAAA,MAAM,IAAIyC,MAAM,4BAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOE,QAAQO,MAAAA,CAAOlD,EAAAA;AACxB;AALgBiD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;;;AC7ShB,SAASE,OAAOC,KAAAA,EAAc;AAC5B,EAAA,OAAOA,KAAAA,KAAU,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,IAAY,CAACC,KAAAA,CAAMC,OAAAA,CAAQF,KAAAA,CAAAA,GAChEA,KAAAA,GACD,IAAA;AACN;AAJSD,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAMT,SAASI,WAAWH,KAAAA,EAAc;AAChC,EAAA,OACE,OAAOA,KAAAA,KAAU,QAAA,IACjBA,KAAAA,CAAM,QAAA,CAAA,GAAY,CAAA,IAClBA,KAAAA,CAAM,QAAA,CAAA,IAAa,GAAA,IACnBA,KAAAA,CAAM,MAAA,GAAO,KAAOA,KAAAA,IACpBC,KAAAA,CAAMG,IAAAA,CAAKJ,KAAAA,CAAAA,CAAOK,KAAAA,CAAM,CAACC,cAAcA,SAAAA,CAAUC,UAAAA,CAAW,CAAA,CAAA,IAAM,EAAA,IAAMD,SAAAA,CAAUC,UAAAA,CAAW,CAAA,MAAO,GAAA,CAAA;AAExG;AARSJ,MAAAA,CAAAA,UAAAA,EAAAA,YAAAA,CAAAA;AAUT,SAASK,KAAKR,KAAAA,EAAc;AAC1B,EAAA,OAAOC,KAAAA,CAAMC,OAAAA,CAAQF,KAAAA,CAAAA,IAAUA,KAAAA,CAAM,QAAA,CAAA,IAAa,GAAA,IAAQA,KAAAA,CAAM,OAAA,CAAA,CAASG,UAAAA,CAAAA;AAC3E;AAFSK,MAAAA,CAAAA,IAAAA,EAAAA,MAAAA,CAAAA;AAIT,SAASC,QAAQT,KAAAA,EAAc;AAC7B,EAAA,IAAI,OAAOA,KAAAA,KAAU,QAAA,EAAU,OAAO,IAAA;AACtC,EAAA,MAAMU,IAAAA,GAAOC,IAAAA,CAAK5D,KAAAA,CAAMiD,KAAAA,CAAAA;AACxB,EAAA,OAAOY,MAAAA,CAAOC,QAAAA,CAASH,IAAAA,CAAAA,IAAS,IAAIC,IAAAA,CAAKD,IAAAA,CAAAA,CAAMI,WAAAA,EAAW,KAAOd,KAAAA,GAAQ,IAAIW,IAAAA,CAAKD,IAAAA,CAAAA,GAAQ,IAAA;AAC5F;AAJSD,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOF,SAASM,wBAAAA,CACdC,QACA5B,KAAAA,EACA9C,WAAAA,EACA2E,gBACAC,GAAAA,GAAMP,IAAAA,CAAKO,KAAG,EAAE;AAEhB,EAAA,IACE,CAACD,cAAAA,IACD,CAAC7B,SACDA,KAAAA,CAAM+B,UAAAA,KAAe,eACrB,CAAC;AAAC,IAAA,MAAA;AAAQ,IAAA;AAAeC,GAAAA,CAAAA,QAAAA,CAAShC,KAAAA,CAAMN,IAAI,CAAA,IAC5CkC,MAAAA,KAAWK,QAEX,OAAOA,MAAAA;AACT,EAAA,MAAMC,OAAAA,mBAAU,MAAA,CAAA,MAAM,IAAIjC,KAAAA,CAAM,qCAAA,CAAA,EAAhB,SAAA,CAAA;AAChB,EAAA,IAAIkC,GAAAA;AACJ,EAAA,IAAI;AACFA,IAAAA,GAAAA,GAAMzE,IAAAA,CAAKC,MAAMiE,MAAAA,CAAAA;EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAMM,OAAAA,EAAAA;AACR,EAAA;AACA,EAAA,MAAMtB,KAAAA,GAAQD,OAAOwB,GAAAA,CAAAA;AACrB,EAAA,MAAMC,cAAAA,GAAiBf,OAAAA,CAAQT,KAAAA,GAAQ,gBAAA,CAAiB,CAAA;AACxD,EAAA,IACE,CAACA,KAAAA,IACD,CAACG,UAAAA,CAAWH,KAAAA,CAAM,mBAAA,CAAoB,CAAA,IACtCA,KAAAA,CAAM,mBAAA,CAAA,KAAyBZ,KAAAA,CAAMxC,EAAAA,IACrC,CAACuD,UAAAA,CAAWH,KAAAA,CAAM,kBAAA,CAAmB,CAAA,IACrC,CAACG,UAAAA,CAAWH,KAAAA,CAAM,cAAA,CAAe,CAAA,IACjC,CAACQ,IAAAA,CAAKR,KAAAA,CAAM,QAAA,CAAS,CAAA,IACrB,CAACQ,IAAAA,CAAKR,KAAAA,CAAM,qBAAA,CAAsB,CAAA,IAClC,CAACwB,cAAAA,IACDA,cAAAA,CAAeC,OAAAA,EAAO,IAAMP,GAAAA,IAC3B5E,WAAAA,IAAe0D,KAAAA,CAAM,qBAAA,CAAA,CAAuB0B,MAAAA,GAAS,CAAA,IAAK,CAAC1B,KAAAA,CAAM,qBAAA,CAAA,CAAuBoB,QAAAA,CAAS9E,WAAAA,CAAAA,EAElG,MAAMgF,OAAAA,EAAAA;AACR,EAAA,IAAIK,OAAAA,GAAgD,IAAA;AACpD,EAAA,IAAI3B,KAAAA,CAAM,SAAA,CAAA,KAAe,IAAA,EAAM;AAC7B,IAAA,MAAM4B,KAAAA,GAAQ7B,MAAAA,CAAOC,KAAAA,CAAM,SAAA,CAAU,CAAA;AACrC,IAAA,MAAM6B,SAAAA,GAAYpB,OAAAA,CAAQmB,KAAAA,GAAQ,WAAA,CAAY,CAAA;AAC9C,IAAA,MAAME,SAAAA,GAAYF,QAAQ,WAAA,CAAA,KAAiB,OAAO,IAAA,GAAOnB,OAAAA,CAAQmB,KAAAA,GAAQ,WAAA,CAAY,CAAA;AACrF,IAAA,IACE,CAACA,KAAAA,IACD,CAACzB,UAAAA,CAAWyB,MAAM,WAAA,CAAY,CAAA,IAC9B,CAACC,SAAAA,IACDA,SAAAA,CAAUJ,OAAAA,EAAO,GAAKP,OACrBU,KAAAA,CAAM,WAAA,CAAA,KAAiB,IAAA,KACrB,CAACE,SAAAA,IAAaA,SAAAA,CAAUL,OAAAA,MAAaI,SAAAA,CAAUJ,OAAAA,EAAO,IAAMD,cAAAA,CAAeC,SAAO,GAAKK,SAAAA,CAAUL,OAAAA,EAAO,CAAA,QAErGH,OAAAA,EAAAA;AACRK,IAAAA,OAAAA,GAAU;AAAEI,MAAAA,SAAAA,EAAWH,MAAM,WAAA,CAAA;AAAcC,MAAAA,SAAAA;AAAWC,MAAAA;AAAU,KAAA;AAClE,EAAA;AACA,EAAA,OAAO;AACLE,IAAAA,iBAAAA,EAAmBhC,MAAM,mBAAA,CAAA;AACzBiC,IAAAA,gBAAAA,EAAkBjC,MAAM,kBAAA,CAAA;AACxBkC,IAAAA,YAAAA,EAAclC,MAAM,cAAA,CAAA;IACpBmC,MAAAA,EAAQ;AAAInC,MAAAA,GAAAA,KAAAA,CAAM,QAAA;;IAClBoC,mBAAAA,EAAqB;AAAIpC,MAAAA,GAAAA,KAAAA,CAAM,qBAAA;;AAC/BwB,IAAAA,cAAAA;AACAG,IAAAA;AACF,GAAA;AACF;AA9DgBZ,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;;;ACchB,IAAIsB,cAAAA,GAA+C,IAAA;AAK5C,SAASC,iBAAiB1E,OAAAA,EAA8B;AAC7DyE,EAAAA,cAAAA,GAAiBzE,OAAAA;AACjBzB,EAAAA,MAAAA,CAAOC,MAAM,4CAAA,CAAA;AACf;AAHgBkG,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAQhB,SAASC,SAAAA,CAAUC,SAAkBC,GAAAA,EAAW;AAC9C,EAAA,OAAOD,QAAQE,OAAAA,CAAQC,GAAAA,CAAIF,GAAAA,CAAIG,WAAAA,EAAW,CAAA,IAAOvB,MAAAA;AACnD;AAFSkB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAIT,SAASM,aAAAA,CAAcC,UAAkBC,QAAAA,EAAgB;AACvD,EAAA,MAAMC,cAAAA,GAAiBC,MAAAA,CAAO7C,IAAAA,CAAK0C,QAAAA,CAAAA;AACnC,EAAA,MAAMI,cAAAA,GAAiBD,MAAAA,CAAO7C,IAAAA,CAAK2C,QAAAA,CAAAA;AAEnC,EAAA,IAAIC,cAAAA,CAAetB,MAAAA,KAAWwB,cAAAA,CAAexB,MAAAA,EAAQ;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOyB,MAAAA,CAAOC,eAAAA,CAAgBJ,cAAAA,EAAgBE,cAAAA,CAAAA;AAChD;AATSL,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWF,SAASQ,uBAAAA,CACdb,OAAAA,EACAc,OAAAA,GAA8BC,OAAAA,CAAQC,IAAI,UAAA,CAAA,EAC1CC,oBAAAA,GAA2CF,OAAAA,CAAQC,IAAI,uBAAA,CAAA,IACrDD,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEvC,EAAA,IAAI,CAACjB,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA,EAAe;AACrC,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIc,YAAY,YAAA,EAAc;AAC5B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMI,uBACJnB,SAAAA,CAAUC,OAAAA,EAAS,0BAAA,CAAA,IAA+BD,SAAAA,CAAUC,SAAS,sBAAA,CAAA;AACvE,EAAA,IAAI,CAACiB,oBAAAA,IAAwB,CAACC,oBAAAA,EAAsB;AAClD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOb,aAAAA,CAAca,sBAAsBD,oBAAAA,CAAAA;AAC7C;AArBgBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA0BhB,SAASM,gBAAgBnB,OAAAA,EAAgB;AAEvC,EAAA,MAAMoB,YAAAA,GAAerB,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMqB,MAAAA,GAAStB,SAAAA,CAAUC,OAAAA,EAAS,WAAA,CAAA;AAClC,EAAA,MAAMsB,EAAAA,GAAKF,cAAcG,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,IAAAA,EAAAA,IAAUH,MAAAA,IAAUxC,MAAAA;AAE5D,EAAA,OAAO;AACLyC,IAAAA,EAAAA;IACAG,SAAAA,EAAW1B,SAAAA,CAAUC,SAAS,YAAA;AAChC,GAAA;AACF;AAVSmB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAwBT,SAASO,gBAAgB1B,OAAAA,EAAgB;AACvC,EAAA,MAAMxC,KAAAA,GAAQuC,SAAAA,CAAUC,OAAAA,EAAS,6BAAA,CAAA;AACjC,EAAA,OAAOxC,UAAU,cAAA,IAAkBA,KAAAA,KAAU,WAAA,IAAeA,KAAAA,KAAU,cAAcA,KAAAA,GAAQ,SAAA;AAC9F;AAHSkE,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAKT,eAAeC,aAAa3B,OAAAA,EAAgB;AAE1C,EAAA,MAAMhD,OAAAA,GAAU+C,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAIhD,OAAAA,IAAW6D,uBAAAA,CAAwBb,OAAAA,CAAAA,EAAU;AAG/CrG,IAAAA,MAAAA,CAAOC,MAAM,gEAAA,CAAA;AAEb,IAAA,MAAMgI,SAAAA,GAAY7B,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA,IAAmB,MAAA;AACxD,IAAA,MAAM6B,QAAAA,GAAW9B,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AAEpC,IAAA,OAAO;MACL5F,EAAAA,EAAI4C,OAAAA;MACJV,IAAAA,EAAMsF,SAAAA;AACNjD,MAAAA,UAAAA,EAAY+C,gBAAgB1B,OAAAA,CAAAA;MAC5BlE,YAAAA,EAAciE,SAAAA,CAAUC,SAAS,gBAAA,CAAA;MACjCxD,SAAAA,EAAWuD,SAAAA,CAAUC,SAAS,aAAA,CAAA;AAC9BvD,MAAAA,MAAAA,EAAQsD,UAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAC7DtD,MAAAA,OAAAA,EACEkF,cAAc,aAAA,IACdC,QAAAA,KAAa,cAAA,IACbA,QAAAA,KAAa,iBACbA,QAAAA,KAAa;AACjB,KAAA;AACF,EAAA;AAEA,EAAA,IAAI7E,OAAAA,EAAS;AACXrD,IAAAA,MAAAA,CAAOe,KAAK,uFAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAMoH,UAAAA,GAAa/B,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AAEtC,EAAA,IAAI,CAAC8B,UAAAA,EAAYC,UAAAA,CAAW,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAM5G,KAAAA,GAAQ2G,UAAAA,CAAWE,SAAAA,CAAU,CAAA,CAAA;AAEnC,EAAA,IAAI;AACFrI,IAAAA,MAAAA,CAAOC,MAAM,iFAAA,CAAA;AACb,IAAA,MAAM4B,OAAAA,GAAU,MAAMN,SAAAA,CAAUC,KAAAA,CAAAA;AAEhC,IAAA,IAAI,CAACK,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLpB,MAAAA,EAAAA,EAAIoB,OAAAA,CAAQpB,EAAAA;MACZkC,IAAAA,EAAM,MAAA;MACNqC,UAAAA,EAAY,SAAA;AACZ7C,MAAAA,YAAAA,EAAcN,OAAAA,CAAQM;AACxB,KAAA;AACF,EAAA,CAAA,CAAA,OAASrB,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,sCAAsCD,KAAAA,CAAAA;AAClD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA3DekH,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAgEf,SAASM,cAAcjC,OAAAA,EAAgB;AAErC,EAAA,MAAMkC,QAAAA,GAAWnC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AACpC,EAAA,MAAMmC,cAAAA,GAAiBpC,SAAAA,CAAUC,OAAAA,EAAS,mBAAA,CAAA;AAE1C,EAAA,IAAIkC,QAAAA,EAAU;AACZ,IAAA,OAAO;MACL9H,EAAAA,EAAI8H,QAAAA;AACJE,MAAAA,QAAAA,EAAUD,cAAAA,IAAkB;AAC9B,KAAA;AACF,EAAA;AAGA,EAAA,OAAOtC,gBAAgBwC,aAAAA,IAAiB,IAAA;AAC1C;AAdSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASK,oBAAoBtC,OAAAA,EAAgB;AAC3C,EAAA,MAAM5C,QAAQ2C,SAAAA,CAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAEnE,EAAA,IAAI5C,KAAAA,EAAO;AACT,IAAA,OAAO;MAAEhD,EAAAA,EAAIgD;AAAM,KAAA;AACrB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSkF,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASC,gBAAAA,CAAiBvC,SAAkBpD,KAAAA,EAAoB;AAE9D,EAAA,MAAM9C,WAAAA,GAAciG,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEvC,EAAA,IAAIlG,WAAAA,EAAa;AACf,IAAA,OAAO;MAAEM,EAAAA,EAAIN;AAAY,KAAA;AAC3B,EAAA;AAGA,EAAA,IAAI8C,OAAOd,YAAAA,EAAc;AACvB,IAAA,OAAO;AAAE1B,MAAAA,EAAAA,EAAIwC,KAAAA,CAAMd;AAAa,KAAA;AAClC,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAdSyG,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAmBT,SAASC,eAAexC,OAAAA,EAAgB;AACtC,EAAA,MAAMyC,SAAAA,GAAY1C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAIyC,SAAAA,EAAW;AACb,IAAA,OAAO;MAAErI,EAAAA,EAAIqI;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaT,SAASE,eAAe1C,OAAAA,EAAgB;AACtC,EAAA,MAAM2C,SAAAA,GAAY5C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI2C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEvI,EAAAA,EAAIuI;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASE,iBAAiB5C,OAAAA,EAAgB;AACxC,EAAA,MAAM6C,OAAAA,GAAU9C,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACnC,EAAA,MAAM8C,QAAAA,GAAW/C,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AACpC,EAAA,MAAM+C,QAAAA,GAAWhD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEpC,EAAA,OAAO;IACL6C,OAAAA,EAASA,OAAAA,EAASG,aAAAA,IAAiBnE,MAAAA;IACnCiE,QAAAA,EAAUA,QAAAA,EAAUE,aAAAA,IAAiBnE,MAAAA;AACrCkE,IAAAA,QAAAA,EAAUA,QAAAA,IAAYlE;AACxB,GAAA;AACF;AAVS+D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAwBT,SAASK,sBAAsBjD,OAAAA,EAAgB;AAC7C,EAAA,MAAMT,SAAAA,GAAYQ,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAGrC,EAAA,IAAI,CAACT,SAAAA,EAAW;AACd,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAM2D,YAAAA,GAAenD,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMmD,eAAAA,GAAkBpD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAC3C,EAAA,MAAMoD,eAAAA,GAAkBrD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAE3C,EAAA,OAAO;AACLT,IAAAA,SAAAA;IACAI,MAAAA,EAAQuD,YAAAA,GAAeA,YAAAA,CAAa3B,KAAAA,CAAM,GAAA,CAAA,CAAK8B,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAE9B,IAAAA,EAAI,CAAA,GAAM3C,MAAAA;AACtEQ,IAAAA,SAAAA,EAAW8D,eAAAA,GAAkB,IAAIhF,IAAAA,CAAKgF,eAAAA,CAAAA,GAAmBtE,MAAAA;AACzDS,IAAAA,SAAAA,EAAW8D,eAAAA,GAAkB,IAAIjF,IAAAA,CAAKiF,eAAAA,CAAAA,GAAmBvE;AAC3D,GAAA;AACF;AAlBSoE,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA0BT,eAAsBM,aAAavD,OAAAA,EAAgB;AACjD,EAAA,IAAI,CAACH,cAAAA,EAAgB;AACnB,IAAA,MAAM,IAAIhD,MAAM,wEAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMD,KAAAA,GAAQ,MAAM+E,YAAAA,CAAa3B,OAAAA,CAAAA;AAGjC,EAAA,MAAM1C,MAAAA,GAAS2E,cAAcjC,OAAAA,CAAAA;AAC7B,EAAA,MAAM7C,YAAAA,GAAemF,oBAAoBtC,OAAAA,CAAAA;AACzC,EAAA,MAAMhG,SAAAA,GAAYuI,gBAAAA,CAAiBvC,OAAAA,EAASpD,KAAAA,CAAAA;AAC5C,EAAA,MAAM4G,OAAAA,GAAUhB,eAAexC,OAAAA,CAAAA;AAC/B,EAAA,MAAMyD,OAAAA,GAAUf,eAAe1C,OAAAA,CAAAA;AAC/B,EAAA,MAAM0D,QAAAA,GAAWvC,gBAAgBnB,OAAAA,CAAAA;AACjC,EAAA,MAAM2D,cAAAA,GAAiBV,sBAAsBjD,OAAAA,CAAAA;AAC7C,EAAA,MAAM4D,kBAAAA,GAAqBrF,wBAAAA,CACzBwB,SAAAA,CAAUC,OAAAA,EAAS,uBAAA,CAAA,EACnBpD,KAAAA,EACA5C,SAAAA,EAAWI,EAAAA,EACXyG,uBAAAA,CAAwBb,OAAAA,CAAAA,CAAAA;AAI1B,EAAA,IAAI6D,IAAAA;AACJ,EAAA,IAAIhE,eAAegE,IAAAA,EAAM;AACvBA,IAAAA,IAAAA,GAAOhE,cAAAA,CAAegE,IAAAA,CAAKC,wBAAAA,CAAyB9D,OAAAA,CAAAA;AACtD,EAAA;AAGA,EAAA,MAAM+D,GAAAA,GAAMnB,iBAAiB5C,OAAAA,CAAAA;AAC7B,EAAA,IAAI+D,GAAAA,CAAIlB,OAAAA,IAAWkB,GAAAA,CAAIjB,QAAAA,IAAYiB,IAAIhB,QAAAA,EAAU;AAC/C,IAAA,IAAIc,IAAAA,EAAM;AAER,MAAA,IAAIE,GAAAA,CAAIlB,OAAAA,EAASgB,IAAAA,CAAKhB,OAAAA,GAAUkB,GAAAA,CAAIlB,OAAAA;AACpC,MAAA,IAAIkB,GAAAA,CAAIjB,QAAAA,EAAUe,IAAAA,CAAKf,QAAAA,GAAWiB,GAAAA,CAAIjB,QAAAA;AACtC,MAAA,IAAIiB,GAAAA,CAAIhB,QAAAA,EAAUc,IAAAA,CAAKd,QAAAA,GAAWgB,GAAAA,CAAIhB,QAAAA;IACxC,CAAA,MAAO;AAELc,MAAAA,IAAAA,GAAO;QACLG,MAAAA,EAAQ,OAAA;QACRC,QAAAA,EAAU,IAAA;AACVpB,QAAAA,OAAAA,EAASkB,GAAAA,CAAIlB,OAAAA;AACbC,QAAAA,QAAAA,EAAUiB,GAAAA,CAAIjB,QAAAA;AACdC,QAAAA,QAAAA,EAAUgB,GAAAA,CAAIhB,QAAAA;QACdmB,CAAAA,kBAAG,MAAA,CAAA,CAACjE,QAAgBA,GAAAA,EAAjB,GAAA,CAAA;QACHkE,EAAAA,kBAAI,MAAA,CAAA,CAAClE,QAAgBA,GAAAA,EAAjB,IAAA,CAAA;AACJmE,QAAAA,YAAAA,kBAAc,MAAA,CAAA,CAAC5G,KAAAA,KAAkB6G,MAAAA,CAAO7G,KAAAA,CAAAA,EAA1B,cAAA,CAAA;AACd8G,QAAAA,cAAAA,0BAAiB9G,KAAAA,EAAesF,QAAAA,KAAqB,GAAGA,QAAAA,CAAAA,CAAAA,EAAYtF,KAAAA,CAAAA,CAAAA,EAApD,gBAAA,CAAA;AAChB+G,QAAAA,UAAAA,kBAAY,MAAA,CAAA,CAACC,IAAAA,KAAwBH,MAAAA,CAAOG,IAAAA,CAAAA,EAAhC,YAAA,CAAA;AACZC,QAAAA,kBAAAA,0BAAqBjH,KAAAA,EAAekH,IAAAA,KAAsC,GAAGlH,KAAAA,CAAAA,CAAAA,EAASkH,IAAAA,CAAAA,CAAAA,EAAlE,oBAAA;AACtB,OAAA;AACF,IAAA;AACF,EAAA;AAKA,EAAA,MAAMC,UAAAA,GAAAA,CACH/H,KAAAA,EAAON,IAAAA,KAAS,KAAA,IAASM,OAAON,IAAAA,KAAS,SAAA,IAAaM,KAAAA,EAAON,IAAAA,KAAS,iBAAA,KACvEqH,cAAAA,EAAgBpE,SAAAA,GACZoE,cAAAA,CAAepE,YACf3C,KAAAA,EAAOxC,EAAAA;AAIb,EAAA,MAAMwK,YAAAA,GAAe;AACnB9K,IAAAA,WAAAA,EAAaE,SAAAA,EAAWI,EAAAA;AACxB8H,IAAAA,QAAAA,EAAU5E,MAAAA,EAAQlD,EAAAA;AAClB4C,IAAAA,OAAAA,EAASJ,KAAAA,EAAOxC,EAAAA;AAChBwH,IAAAA,SAAAA,EAAWhF,KAAAA,EAAON,IAAAA;AAClBuI,IAAAA,cAAAA,EAAgB1H,YAAAA,EAAc/C,EAAAA;AAC9BqI,IAAAA,SAAAA,EAAWe,OAAAA,EAASpJ,EAAAA;AACpBuK,IAAAA;AACF,GAAA;AAEAhL,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxDE,IAAAA,WAAAA,EAAa8K,aAAa9K,WAAAA,IAAe,MAAA;AACzCkD,IAAAA,OAAAA,EAAS4H,aAAa5H,OAAAA,IAAW,MAAA;IACjC8H,SAAAA,EAAW/E,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA,IAAqB;GACrD,CAAA;AAEA+E,EAAAA,mBAAAA,CAAoBH,YAAAA,CAAAA;AASpBI,EAAAA,cAAAA,CAAeC,kBAAAA,CACblF,SAAAA,CAAUC,OAAAA,EAAS,qBAAA,CAAA,EACnBD,SAAAA,CAAUC,OAAAA,EAAS,yBAAA,CAAA,EACnBD,SAAAA,CAAUC,OAAAA,EAAS,oBAAA,CAAA,CAAA;AAGrB,EAAA,OAAO;AACLA,IAAAA,OAAAA;AACApD,IAAAA,KAAAA;AACAU,IAAAA,MAAAA;AACAH,IAAAA,YAAAA;AACAnD,IAAAA,SAAAA;AACAwJ,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,cAAAA,EAAgBA,cAAAA,IAAkB9E,MAAAA;AAClC+E,IAAAA,kBAAAA;IACAe,UAAAA,EAAYA,UAAAA,IAAc/H,OAAOxC,EAAAA,IAAM,EAAA;AACvCL,IAAAA,EAAAA,EAAI8F,eAAe7G,KAAAA,EAAK;AACxB6K,IAAAA,IAAAA;AACAqB,IAAAA,eAAAA,EAAiB,IAAIC,OAAAA;AACvB,GAAA;AACF;AAjHsB5B,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAsHf,SAAS6B,iBAAAA,GAAAA;AACd,EAAA,OAAOvF,cAAAA;AACT;AAFgBuF,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;AC3bhB,IAAMC,iBAAAA,GAAoB;AACxB,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA;;AAGK,SAASC,oBAAAA,CACdC,SACAC,WAAAA,EAAiE;AAEjE,EAAA,MAAMC,UAAAA,GAAAA,CAAchI,MAAMC,OAAAA,CAAQ6H,OAAAA,IAAWA,OAAAA,GAAUA,OAAAA,EAAShE,MAAM,GAAA,CAAA,IAAQ,EAAA,EAC3E8B,GAAAA,CAAI,CAACqC,MAAAA,KAAWA,MAAAA,CAAOlE,MAAI,CAAA,CAC3BmE,OAAOC,OAAAA,CAAAA;AAEV,EAAA,IAAIH,UAAAA,CAAWvG,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAOsG,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,IAAII,UAAAA,CAAW7G,QAAAA,CAAS,GAAA,CAAA,EAAM;AAC5B,IAAA,OAAO4G,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,OAAOI,UAAAA;AACT;AAjBgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAmBT,SAASO,wBAAAA,CAAyBC,eAA8BC,cAAAA,EAAwB;AAC7F,EAAA,IAAI,CAACD,aAAAA,EAAe;AAClB,IAAA,OAAOC,cAAAA,CAAe,CAAA,CAAA,IAAM,IAAA;AAC9B,EAAA;AAEA,EAAA,OAAOA,cAAAA,CAAenH,QAAAA,CAASkH,aAAAA,CAAAA,GAAiBA,aAAAA,GAAgB,IAAA;AAClE;AANgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASG,qBAAqBpJ,KAAAA,EAAoB;AACvD,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOA,KAAAA,CAAMF,YAAY,IAAA,IAAQ;AAAC,IAAA,SAAA;AAAW,IAAA;AAAekC,GAAAA,CAAAA,QAAAA,CAAShC,MAAMN,IAAI,CAAA;AACjF;AANgB0J,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;;;ACfT,SAASC,KAAAA,CAAMC,MAAcC,QAAAA,EAAgB;AAClD,EAAA,MAAMpH,GAAAA,GAAMgC,OAAAA,CAAQC,GAAAA,CAAIkF,IAAAA,CAAAA;AACxB,EAAA,IAAI,CAACnH,KAAK,OAAOoH,QAAAA;AACjB,EAAA,MAAMC,MAAAA,GAAShI,MAAAA,CAAOiI,QAAAA,CAAStH,GAAAA,EAAK,EAAA,CAAA;AACpC,EAAA,OAAOX,OAAOC,QAAAA,CAAS+H,MAAAA,CAAAA,IAAWA,MAAAA,GAAS,IAAIA,MAAAA,GAASD,QAAAA;AAC1D;AALgBF,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAaT,IAAMK,kBAAAA,GAAqBL,KAAAA,CAAM,yBAAA,EAA2B,GAAA,CAAA;AAQ5D,IAAMM,8BAAAA,GAAiCN,KAAAA,CAAM,6BAAA,EAA+B,GAAA,CAAA;AAyB5E,SAASO,0BAA0BC,IAAAA,EAAgC;AACxE,EAAA,MAAMC,KAAAA,GAAQD,KAAKC,KAAAA,IAASJ,kBAAAA;AAC5B,EAAA,MAAMK,SAAAA,GAAYF,KAAKE,SAAAA,IAAaJ,8BAAAA;AACpC,EAAA,MAAM7H,GAAAA,GAAM+H,IAAAA,CAAK/H,GAAAA,KAAQ,MAAcP,KAAKO,GAAAA,EAAG,CAAA;AAE/C,EAAA,IAAIkI,WAAAA,GAAc,CAAA;AAClB,EAAA,IAAIC,QAAAA,GAAiC,IAAA;AAErC,EAAA,MAAMC,0BAAU,MAAA,CAAA,YAAA;AACd,IAAA,IAAIF,WAAAA,KAAgB,CAAA,IAAKlI,GAAAA,EAAAA,GAAQkI,cAAcF,KAAAA,EAAO;AAEtD,IAAA,IAAI,CAACG,QAAAA,EAAU;AACbA,MAAAA,QAAAA,GAAAA,CAAY,YAAA;AACV,QAAA,IAAIE,KAAAA;AACJ,QAAA,IAAI;AACF,UAAA,MAAMC,QAAQC,IAAAA,CAAK;AACjBD,YAAAA,OAAAA,CAAQE,QAAQT,IAAAA,CAAKU,OAAAA,EAAO,CAAA,CAAIC,IAAAA,CAAK,MAAMvI,KAAAA,CAAAA,CAAAA;YAC3C,IAAImI,OAAAA,CAAc,CAACE,OAAAA,KAAAA;AACjBH,cAAAA,KAAAA,GAAQM,UAAAA,CAAWH,SAASP,SAAAA,CAAAA;YAC9B,CAAA;AACD,WAAA,CAAA;AAIDC,UAAAA,WAAAA,GAAclI,GAAAA,EAAAA;QAChB,CAAA,CAAA,MAAQ;QAER,CAAA,SAAA;AACE,UAAA,IAAIqI,KAAAA,KAAUlI,MAAAA,EAAWyI,YAAAA,CAAaP,KAAAA,CAAAA;AACtCF,UAAAA,QAAAA,GAAW,IAAA;AACb,QAAA;MACF,CAAA,GAAA;AACF,IAAA;AAEA,IAAA,MAAMA,QAAAA;EACR,CAAA,EA3BgB,SAAA,CAAA;AA6BhB,EAAA,OAAO;AAAEC,IAAAA,OAAAA;AAASS,IAAAA,eAAAA,+BAA+BX,WAAAA,EAAd,iBAAA;AAA0B,GAAA;AAC/D;AAtCgBJ,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;;;ACWT,IAAMgB,kBAAAA,GAAqB,GAAA;AAG3B,IAAMC,0BAAAA,GAA6B,GAAA;AAE1C,IAAMC,gBAAAA,GAAqC;AAAC,EAAA;;AAE5C,eAAeC,WAAAA,CAAeC,IAAAA,EAAkBC,EAAAA,EAAYC,KAAAA,EAAa;AACvE,EAAA,IAAIf,KAAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAO,MAAMC,QAAQC,IAAAA,CAAK;AACxBW,MAAAA,IAAAA;MACA,IAAIZ,OAAAA,CAAe,CAACe,CAAAA,EAAGC,MAAAA,KAAAA;AACrBjB,QAAAA,KAAAA,GAAQM,UAAAA,CAAW,MAAMW,MAAAA,CAAO,IAAInL,KAAAA,CAAM,CAAA,EAAGiL,KAAAA,CAAAA,uBAAAA,EAA+BD,EAAAA,CAAAA,EAAAA,CAAM,CAAA,CAAA,EAAIA,EAAAA,CAAAA;MACxF,CAAA;AACD,KAAA,CAAA;EACH,CAAA,SAAA;AACE,IAAA,IAAId,KAAAA,eAAoBA,KAAAA,CAAAA;AAC1B,EAAA;AACF;AAZeY,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAcf,eAAeM,QAAAA,CACb/B,IAAAA,EACAgC,QAAAA,EACAN,IAAAA,EACAlJ,GAAAA,EAAiB;AAEjB,EAAA,MAAMyJ,UAAUzJ,GAAAA,EAAAA;AAChB,EAAA,IAAI;AACF,IAAA,MAAMiJ,YAAYX,OAAAA,CAAQE,OAAAA,CAAQU,MAAAA,CAAAA,EAASH,4BAA4BvB,IAAAA,CAAAA;AACvE,IAAA,OAAO;MAAEkC,EAAAA,EAAI,IAAA;AAAMF,MAAAA,QAAAA;AAAUG,MAAAA,SAAAA,EAAW3J,KAAAA,GAAQyJ;AAAQ,KAAA;AAC1D,EAAA,CAAA,CAAA,OAAShM,GAAAA,EAAK;AACZ,IAAA,OAAO;MACLiM,EAAAA,EAAI,KAAA;AACJF,MAAAA,QAAAA;AACAzN,MAAAA,KAAAA,EAAO0B,GAAAA,YAAeU,KAAAA,GAAQV,GAAAA,CAAImM,OAAAA,GAAUjE,OAAOlI,GAAAA,CAAAA;AACnDkM,MAAAA,SAAAA,EAAW3J,KAAAA,GAAQyJ;AACrB,KAAA;AACF,EAAA;AACF;AAlBeF,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAwBR,SAASM,oBAAAA,CACdC,IAAAA,EACA9J,GAAAA,GAAoBP,IAAAA,CAAKO,GAAAA,EAAG;AAE5B,EAAA,MAAMwJ,QAAAA,GAAW,IAAIO,GAAAA,CAAoBD,IAAAA,CAAKE,wBAAwBhB,gBAAAA,CAAAA;AACtE,EAAA,IAAIiB,KAAAA,GAA4D,IAAA;AAChE,EAAA,IAAI9B,QAAAA,GAA8C,IAAA;AAElD,EAAA,eAAe+B,KAAAA,GAAAA;AACb,IAAA,MAAMC,SAA4D,EAAC;AAEnE,IAAA,MAAMC,OAA6B,EAAA;AAEnC,IAAA,IAAIN,KAAKO,MAAAA,EAAQ;AACfD,MAAAA,IAAAA,CAAKE,KACHf,QAAAA,CACE,UAAA,EACAC,SAASe,GAAAA,CAAI,UAAA,GACb,YAAA;AACE,QAAA,MAAMhP,MAAAA,GAASuO,KAAKO,MAAAA,IAAM;AAC1B,QAAA,IAAI,CAAC9O,MAAAA,EAAQ,MAAM,IAAI4C,MAAM,+BAAA,CAAA;AAC7B,QAAA,MAAM5C,MAAAA,CAAOiP,SAAAA,CAAAA,QAAAA,CAAAA;AACf,MAAA,CAAA,EACAxK,GAAAA,CAAAA,CACA0I,IAAAA,CAAK,CAAC+B,CAAAA,KAAAA;AACNN,QAAAA,MAAAA,CAAOO,QAAAA,GAAWD,CAAAA;AACpB,MAAA,CAAA,CAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAIX,KAAKa,MAAAA,EAAQ;AACfP,MAAAA,IAAAA,CAAKE,KACHf,QAAAA,CACE,QAAA,EACAC,SAASe,GAAAA,CAAI,QAAA,GACb,YAAA;AACE,QAAA,MAAMhP,MAAAA,GAAS,MAAMuO,IAAAA,CAAKa,MAAAA,IAAM;AAChC,QAAA,IAAI,CAACpP,MAAAA,EAAQ,MAAM,IAAI4C,MAAM,+BAAA,CAAA;AAC7B,QAAA,MAAM5C,OAAOqP,IAAAA,EAAI;AACnB,MAAA,CAAA,EACA5K,GAAAA,CAAAA,CACA0I,IAAAA,CAAK,CAAC+B,CAAAA,KAAAA;AACNN,QAAAA,MAAAA,CAAOQ,MAAAA,GAASF,CAAAA;AAClB,MAAA,CAAA,CAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAIX,KAAKe,UAAAA,EAAY;AACnBT,MAAAA,IAAAA,CAAKE,KACHf,QAAAA,CACE,YAAA,EACAC,SAASe,GAAAA,CAAI,YAAA,GACb,YAAA;AACE,QAAA,MAAMO,CAAAA,GAAIhB,KAAKe,UAAAA,IAAU;AACzB,QAAA,IAAI,CAACC,CAAAA,EAAG,MAAM,IAAI3M,MAAM,6BAAA,CAAA;AACxB,QAAA,IAAI,OAAO2M,CAAAA,CAAEC,WAAAA,KAAgB,UAAA,EAAY;AACvC,UAAA,MAAMC,YAAY,MAAM1C,OAAAA,CAAQE,OAAAA,CAAQsC,CAAAA,CAAEC,aAAW,CAAA;AACrD,UAAA,IAAI,CAACC,SAAAA,EAAW,MAAM,IAAI7M,MAAM,kCAAA,CAAA;AAChC,UAAA;AACF,QAAA;AACA,QAAA,IAAI,OAAO2M,CAAAA,CAAEG,WAAAA,KAAgB,UAAA,EAAY;AACvC,UAAA,MAAMC,GAAAA,GAAM,MAAMJ,CAAAA,CAAEG,WAAAA,EAAW;AAC/B,UAAA,IAAI,CAACC,GAAAA,CAAIxB,EAAAA,EAAI,MAAM,IAAIvL,MAAM,iCAAA,CAAA;AAC/B,QAAA;AAIF,MAAA,CAAA,EACA6B,GAAAA,CAAAA,CACA0I,IAAAA,CAAK,CAAC+B,CAAAA,KAAAA;AACNN,QAAAA,MAAAA,CAAOU,UAAAA,GAAaJ,CAAAA;AACtB,MAAA,CAAA,CAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,MAAMnC,OAAAA,CAAQ6C,IAAIf,IAAAA,CAAAA;AAElB,IAAA,MAAMgB,OAAAA,GAAUC,MAAAA,CAAOC,MAAAA,CAAOnB,MAAAA,CAAAA;AAC9B,IAAA,OAAO;MACLoB,KAAAA,EAAOH,OAAAA,CAAQjM,MAAM,CAACqM,CAAAA,KAAMA,EAAE9B,EAAAA,IAAM,CAAC8B,EAAEhC,QAAQ,CAAA;AAC/CiC,MAAAA,OAAAA,EAASL,OAAAA,CAAQjM,KAAAA,CAAM,CAACqM,CAAAA,KAAMA,EAAE9B,EAAE,CAAA;AAClCS,MAAAA;AACF,KAAA;AACF,EAAA;AA3EeD,EAAAA,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AA6Ef,EAAA,6CAAsBwB,YAAAA,GAAAA;AACpB,IAAA,MAAMC,KAAK3L,GAAAA,EAAAA;AACX,IAAA,IAAIiK,SAAS0B,EAAAA,GAAK1B,KAAAA,CAAM0B,EAAAA,GAAK7C,kBAAAA,SAA2BmB,KAAAA,CAAM2B,QAAAA;AAE9D,IAAA,IAAIzD,UAAU,OAAOA,QAAAA;AACrBA,IAAAA,QAAAA,GAAW+B,KAAAA,EAAAA,CACRxB,IAAAA,CAAK,CAACkD,QAAAA,KAAAA;AACL3B,MAAAA,KAAAA,GAAQ;AAAE2B,QAAAA,QAAAA;AAAUD,QAAAA,EAAAA,EAAI3L,GAAAA;AAAM,OAAA;AAC9B,MAAA,OAAO4L,QAAAA;IACT,CAAA,CAAA,CACCC,QAAQ,MAAA;AACP1D,MAAAA,QAAAA,GAAW,IAAA;IACb,CAAA,CAAA;AACF,IAAA,OAAOA,QAAAA;EACT,CAAA,EAdO,cAAA,CAAA;AAeT;AApGgB0B,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAgHT,SAASiC,oBAAoBF,QAAAA,EAA2B;AAC7D,EAAA,OAAOA,QAAAA,CAASL,QAAQ,GAAA,GAAM,GAAA;AAChC;AAFgBO,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAIT,SAASC,aAAAA,CACdH,QAAAA,EACAI,OAAAA,EACAC,OAAAA,EACAC,WACAC,aAAAA,EAAsB;AAEtB,EAAA,MAAMC,SAA+B,CAACR,QAAAA,CAASL,QAAQ,aAAA,GAAgBK,QAAAA,CAASH,UAAU,SAAA,GAAY,UAAA;AACtG,EAAA,OAAO;AACLW,IAAAA,MAAAA;AACAJ,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,SAAAA;AACA/B,IAAAA,MAAAA,EAAQyB,QAAAA,CAASzB,MAAAA;IACjB,GAAIgC,aAAAA,KAAkBhM,MAAAA,GAAY,EAAC,GAAI;AAAEgM,MAAAA;AAAc;AACzD,GAAA;AACF;AAhBgBJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASM,YAAAA,CAAaL,OAAAA,EAAiBC,OAAAA,EAAiBC,SAAAA,EAAiB;AAC9E,EAAA,OAAO;IAAEE,MAAAA,EAAQ,SAAA;AAAWJ,IAAAA,OAAAA;AAASC,IAAAA,OAAAA;AAASC,IAAAA;AAAU,GAAA;AAC1D;AAFgBG,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;;;AC3NhB,IAAIC,eAAAA,GAA+B,IAAA;AAInC,IAAMC,sBAAsBzE,yBAAAA,CAA0B;AACpDW,EAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAM+D,yBAAAA,EAAAA,CAA4BC,UAAAA,EAAU,EAA5C,SAAA;AACX,CAAA,CAAA;AAKA,eAAsBC,aAAaC,UAAAA,EAA4B;AAC7D,EAAA,MAAM,EACJ3R,MAAAA,EACA4R,YAAAA,EACAC,MAAAA,EACAC,WAAAA,EACAC,aAAAA,EACAC,WAAAA,EACAnI,YAAAA,EAAcoI,kBAAAA,EACdC,wBAAAA,EACAC,yBAAAA,EACAC,UAAAA,EAAU,GACRT,UAAAA;AAGJ,EAAA,MAAM,EAAEU,MAAAA,EAAM,GAAK,MAAM,OAAO,QAAA,CAAA;AAChC,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,oBAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,IAAAA,EAAI,GAAK,MAAM,OAAO,gBAAA,CAAA;AAC9B,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,cAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,oBAAoBnT,KAAAA,EAAAA,MAAAA,EAAOoT,oBAAkB,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvE,EAAA,MAAM,EAAEC,oBAAAA,EAAoB,GAAK,MAAM,OAAO,wBAAA,CAAA;AAC9C,EAAA,MAAM,EAAEC,mBAAAA,EAAmB,GAAK,MAAM,OAAO,2BAAA,CAAA;AAC7C,EAAA,MAAM,EAAEC,0BAAAA,EAAAA,2BAAAA,EAA0B,GAAK,MAAM,OAAO,gCAAA,CAAA;AAEpD5S,EAAAA,MAAAA,CAAO6S,IAAAA,CAAK,CAAA,sBAAA,EAAyB9S,MAAAA,CAAO+S,WAAW,CAAA,GAAA,CAAK,CAAA;AAG5D,EAAA,MAAMC,QAAAA,GACJhT,MAAAA,CAAOgT,QAAAA,KACNhT,MAAAA,CAAO+S,YAAY1K,UAAAA,CAAW,SAAA,CAAA,GAC3B,QAAA,GACArI,MAAAA,CAAO+S,WAAAA,CAAY1K,UAAAA,CAAW,SAAA,IAC5B,QAAA,GACA,QAAA,CAAA;AAIR,EAAA,MAAM4K,iCACJd,yBAAAA,KAA8B,IAAA,GAAO,QAAQA,yBAAAA,KAA8B,KAAA,GAAQ,OAAOa,QAAAA,KAAa,QAAA;AAEzG/S,EAAAA,MAAAA,CAAO6S,KAAK,mCAAA,EAAqC;AAC/CE,IAAAA,QAAAA;IACAE,kBAAAA,EAAoBD;GACtB,CAAA;AAEA,EAAA,MAAM,EAAEE,OAAAA,EAAO,GAAKV,kBAAAA,CAAmBb,YAAAA,EAAc5R,OAAO+S,WAAAA,EAAa;IACvEK,wBAAAA,EAA0B,KAAA;IAC1BC,wBAAAA,EAA0BJ,8BAAAA;AAC1B,IAAA,GAAIf,wBAAAA,GAA2B;AAAEA,MAAAA;AAAyB,KAAA,GAAI;GAChE,CAAA;AACA,EAAA,MAAMiB,OAAAA,EAAAA;AAGN,EAAA,IAAIG,YAAAA;AACJ,EAAA,IAAItT,MAAAA,CAAOmK,IAAAA,EAAMoJ,OAAAA,IAAWvT,MAAAA,CAAOmK,KAAKqJ,WAAAA,EAAa;AACnDvT,IAAAA,MAAAA,CAAO6S,KAAK,+BAAA,CAAA;AACZQ,IAAAA,YAAAA,GAAe,IAAIG,IAAAA,CAAK;MACtBC,aAAAA,EAAe1T,MAAAA,CAAOmK,KAAKuJ,aAAAA,IAAiB,OAAA;MAC5CC,cAAAA,EAAgB3T,MAAAA,CAAOmK,KAAKwJ,cAAAA,IAAkB,OAAA;AAC9CH,MAAAA,WAAAA,EAAaxT,OAAOmK,IAAAA,CAAKqJ,WAAAA;AACzBI,MAAAA,gBAAAA,EAAkB5T,OAAOmK,IAAAA,CAAKyJ,gBAAAA;MAC9BC,SAAAA,EAAW7T,MAAAA,CAAOmK,IAAAA,CAAK0J,SAAAA,IAAa7T,MAAAA,CAAO+S,WAAAA;AAC3Ce,MAAAA,QAAAA,EAAU9T,OAAOmK,IAAAA,CAAK2J,QAAAA;MACtBC,UAAAA,EAAY/T,MAAAA,CAAOmK,KAAK4J,UAAAA,IAAc,IAAA;MACtCC,WAAAA,EAAa,IAAA;MACbC,kBAAAA,EAAoB;KACtB,CAAA;AACA,IAAA,MAAMX,aAAaY,UAAAA,EAAU;AAC7BjU,IAAAA,MAAAA,CAAO6S,IAAAA,CAAK,2CAA2CQ,YAAAA,CAAaa,mBAAAA,GAAsBC,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAO,CAAA;AACxG,EAAA;AAGAhO,EAAAA,gBAAAA,CAAiB;IACf9G,KAAAA,kBAAO,MAAA,CAAA,MAAMA,QAAAA,EAAN,OAAA,CAAA;IACP6K,IAAAA,EAAMmJ;GACR,CAAA;AAGArS,EAAAA,oBAAAA,EAAAA;AAGA,EAAA,IAAI6Q,WAAAA,EAAa;AACf7R,IAAAA,MAAAA,CAAO6S,KAAK,uCAAA,CAAA;AACZ,IAAA,MAAMhB,YAAYoC,UAAAA,EAAU;AAC9B,EAAA;AAGA,EAAA,MAAMG,KAAAA,GAAQrU,OAAO8L,WAAAA,KAAgB,YAAA;AACrC,EAAA,MAAMwI,gBAAAA,GAAmBtU,OAAOsU,gBAAAA,IAAoBD,KAAAA;AAKpD,EAAA,MAAME,QAAAA,GAAWvU,OAAOuU,QAAAA,IAAY,IAAA;AAGpC,EAAA,MAAMC,qBAAAA,GAAwBxU,MAAAA,CAAOyU,cAAAA,EAAgBlB,OAAAA,IAAWP,QAAAA,KAAa,QAAA;AAC7E/S,EAAAA,MAAAA,CAAO6S,KAAK,CAAA,mBAAA,EAAsBE,QAAAA,sBAA8BwB,qBAAAA,GAAwB,SAAA,GAAY,UAAA,CAAA,CAAY,CAAA;AAEhH,EAAA,MAAME,wBAAwBF,qBAAAA,GAC1B;IACE3B,2BAAAA,CAA2B;MACzBU,OAAAA,EAAS,IAAA;AACToB,MAAAA,qBAAAA,EAAuB3U,OAAOyU,cAAAA,EAAgBE;KAChD;MAEF,EAAA;AAGJ,EAAA,MAAMC,eAAAA,GAAkB5U,OAAO4U,eAAAA,IAAmB,UAAA;AAClD3U,EAAAA,MAAAA,CAAO6S,KAAK,0DAAA,EAA4D;AACtEyB,IAAAA;GACF,CAAA;AAEA,EAAA,MAAMM,qBAAAA,GAAoC;AACxCC,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEC,QAAAA,EAAUC,aAAAA,EAAa,KAAkD;AACtF,MAAA,MAAMC,WAAAA,GAAcD,aAAAA;AACpB,MAAA,IAAIC,aAAazJ,eAAAA,EAAiB;AAChCyJ,QAAAA,WAAAA,CAAYzJ,eAAAA,CAAgB0J,OAAAA,CAAQ,CAACpR,KAAAA,EAAeyC,GAAAA,KAAAA;AAClDwO,UAAAA,QAAAA,CAASvO,OAAAA,CAAQ2O,MAAAA,CAAO5O,GAAAA,EAAKzC,KAAAA,CAAAA;QAC/B,CAAA,CAAA;AACF,MAAA;IACF,CAAA,EAPY,YAAA;AAQd,GAAA;AAEA,EAAA,MAAMsR,OAAO5C,UAAAA,CAAiC;AAC5CoC,IAAAA,eAAAA;AACA/C,IAAAA,MAAAA;IACAwD,QAAAA,EAAUf,gBAAAA;AACVC,IAAAA,QAAAA;IACAe,OAAAA,EAAS;AACPpV,MAAAA,KAAAA,6BAAWqV,IAAAA,KAAStV,MAAAA,CAAOC,MAAM,WAAA,EAAA,GAAgBqV,IAAAA,CAAAA,EAA1C,OAAA,CAAA;AACPzC,MAAAA,IAAAA,6BAAUyC,IAAAA,KAAStV,MAAAA,CAAO6S,KAAK,WAAA,EAAA,GAAgByC,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNvU,MAAAA,IAAAA,6BAAUuU,IAAAA,KAAStV,MAAAA,CAAOe,KAAK,WAAA,EAAA,GAAgBuU,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNxU,MAAAA,KAAAA,6BAAWwU,IAAAA,KAAStV,MAAAA,CAAOc,MAAM,WAAA,EAAA,GAAgBwU,IAAAA,CAAAA,EAA1C,OAAA;AACT,KAAA;IACAC,OAAAA,EAAS;MACPC,8BAAAA,CAA+B;AAAE1C,QAAAA,WAAAA,EAAa/S,MAAAA,CAAO+S,WAAAA;AAAajH,QAAAA,WAAAA,EAAa9L,MAAAA,CAAO8L;OAAY,CAAA;AAC/F4I,MAAAA,GAAAA,qBAAAA;AACHG,MAAAA,qBAAAA;AACI7C,MAAAA,GAAAA,WAAAA,IAAe;;IAErB3O,OAAAA,kBAAS,MAAA,CAAA,OAAO,EAAEiD,OAAAA,EAAO,KAAE;AAEzB,MAAA,MAAMoP,cAAAA,GAAiB,MAAM7L,YAAAA,CAAavD,OAAAA,CAAAA;AAG1C,MAAA,IAAI2L,kBAAAA,EAAoB;AACtB,QAAA,OAAOA,mBAAmByD,cAAAA,CAAAA;AAC5B,MAAA;AAEA,MAAA,OAAOA,cAAAA;IACT,CAAA,EAVS,SAAA;GAWX,CAAA;AAGA,EAAA,MAAMC,GAAAA,GAAM,IAAItD,MAAAA,CAAO;IAAEuD,OAAAA,EAAStD;GAAW,CAAA;AAG7C,EAAA,MAAMuD,WAAAA,GAAcjK,oBAAAA,CAAqB5L,MAAAA,CAAO6V,WAAAA,EAAa7V,OAAO8L,WAAW,CAAA;AAE/E6J,EAAAA,GAAAA,CAAIG,IACFvD,IAAAA,CAAK;IACHvG,MAAAA,EAAQ6J,WAAAA;AACRE,IAAAA,WAAAA,EAAaF,YAAYrQ,MAAAA,GAAS,CAAA;IAClCwQ,cAAAA,EAAgB;AACd,MAAA,cAAA;AACA,MAAA,eAAA;AACA,MAAA,aAAA;AACA,MAAA,gBAAA;AACA,MAAA,UAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,gBAAA;AACA,MAAA,iBAAA;AACA,MAAA,UAAA;AACA,MAAA,YAAA;AACA,MAAA,eAAA;AACA,MAAA,gBAAA;AACA,MAAA,gBAAA;;AAEA,MAAA,YAAA;AACA,MAAA,cAAA;AACA,MAAA,0BAAA;AACA,MAAA;;IAEFC,OAAAA,EAAS;AAAC,MAAA,KAAA;AAAO,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,OAAA;AAAS,MAAA,QAAA;AAAU,MAAA;;AACrD,GAAA,CAAA,CAAA;AAIF,EAAA,MAAMC,gBAAAA,GAAAA,CAAoBnE,iBAAiB,EAAA,EAAI9F,OAAO,CAACkK,EAAAA,KAAOA,GAAGC,OAAO,CAAA;AACxE,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIJ,gBAAAA,CAAiBvM,GAAAA,CAAI,CAACwM,EAAAA,KAAO;IAACA,EAAAA,CAAGI,IAAAA;AAAMJ,IAAAA;GAAG,CAAA,CAAA;AACvE,EAAA,MAAMK,eAAAA,GAAkBN,gBAAAA,CAAiBvM,GAAAA,CAAI,CAACjB,QAAAA,KAAAA;AAC5C,IAAA,MAAM+N,YAAAA,GAAe/N,QAAAA,CAAS6N,IAAAA,CAAKG,OAAAA,CAAQ,WAAW,OAAA,CAAA;AACtD,IAAA,OAAO;AACLhO,MAAAA,QAAAA;AACA+N,MAAAA,YAAAA;AACAE,MAAAA,KAAAA,EAAO,IAAIC,MAAAA,CAAO,CAAA,CAAA,EAAIH,YAAAA,CAAAA,CAAAA,CAAe;AACvC,KAAA;EACF,CAAA,CAAA;AAGA,EAAA,MAAMI,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAE5B,IAAA,MAAMC,UAAAA,GAAaV,YAAAA,CAAa5P,GAAAA,CAAIqQ,QAAAA,CAAAA;AACpC,IAAA,IAAIC,YAAY,OAAOA,UAAAA;AAGvB,IAAA,KAAA,MAAW,EAAErO,QAAAA,EAAUiO,KAAAA,EAAOF,YAAAA,MAAkBD,eAAAA,EAAiB;AAC/D,MAAA,MAAMQ,OAAAA,GAAUL,KAAAA,CAAMM,IAAAA,CAAKH,QAAAA,CAAAA;AAC3B7W,MAAAA,MAAAA,CAAOC,KAAAA,CACL,CAAA,kBAAA,EAAqB4W,QAAAA,CAAAA,iBAAAA,EAA4BpO,QAAAA,CAAS6N,IAAI,CAAA,SAAA,EAAYE,YAAAA,CAAAA,UAAAA,EAAyBO,OAAAA,CAAAA,CAAS,CAAA;AAE9G,MAAA,IAAIA,OAAAA,EAAS;AACX/W,QAAAA,MAAAA,CAAOC,MAAM,CAAA,iBAAA,EAAoB4W,QAAAA,CAAAA,YAAAA,EAAuBpO,QAAAA,CAAS6N,IAAI,CAAA,CAAE,CAAA;AACvE,QAAA,OAAO7N,QAAAA;AACT,MAAA;AACF,IAAA;AAEAzI,IAAAA,MAAAA,CAAOC,MAAM,CAAA,wCAAA,EAA2C4W,QAAAA,CAAAA,oBAAAA,EAA+BZ,gBAAAA,CAAiB1Q,MAAM,CAAA,CAAE,CAAA;AAChH,IAAA,OAAOL,MAAAA;EACT,CAAA,EAnB6B,sBAAA,CAAA;AAyB7BwQ,EAAAA,GAAAA,CAAIuB,SAAAA,CAAU,OAAO,EAAE5Q,OAAAA,EAAO,KAAE;AAC9B,IAAA,MAAM6Q,GAAAA,GAAM,IAAIC,GAAAA,CAAI9Q,OAAAA,CAAQ6Q,GAAG,CAAA;AAC/B,IAAA,MAAML,WAAWK,GAAAA,CAAIL,QAAAA;AACrB7W,IAAAA,MAAAA,CAAOC,MAAM,CAAA,oBAAA,EAAuBoG,OAAAA,CAAQ+Q,MAAM,CAAA,CAAA,EAAIP,QAAAA,CAAAA,CAAU,CAAA;AAChE,IAAA,MAAMQ,aAAAA,GAAgBR,QAAAA,KAAa,SAAA,IAAaA,QAAAA,CAASzO,WAAW,UAAA,CAAA;AAGpE,IAAA,MAAMkP,mCAAmB,MAAA,CAAA,MAAA;AACvB,MAAA,MAAMvL,MAAAA,GAAS1F,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA,IAAa,GAAA;AAChD,MAAA,MAAM+Q,gBAAgBrL,wBAAAA,CAAyBH,MAAAA,KAAW,GAAA,GAAM,IAAA,GAAOA,QAAQ6J,WAAAA,CAAAA;AAC/E,MAAA,MAAMrP,OAAAA,GAAkC;QACtC,8BAAA,EAAgC,wCAAA;QAChC,8BAAA,EACE;AACJ,OAAA;AAEA,MAAA,IAAIgR,aAAAA,EAAe;AACjBhR,QAAAA,OAAAA,CAAQ,6BAAA,CAAA,GAAiCgR,aAAAA;AACzChR,QAAAA,OAAAA,CAAQ,kCAAA,CAAA,GAAsC,MAAA;AAChD,MAAA;AAEA,MAAA,OAAOA,OAAAA;IACT,CAAA,EAfyB,kBAAA,CAAA;AAkBzB,IAAA,MAAMiR,eAAAA,GAAkBH,aAAAA,GAAgBnS,MAAAA,GAAY0R,oBAAAA,CAAqBC,QAAAA,CAAAA;AACzE,IAAA,IAAIW,eAAAA,EAAiB;AACnBxX,MAAAA,MAAAA,CAAOC,MAAM,CAAA,oCAAA,EAAuC4W,QAAAA,CAAAA,IAAAA,EAAeW,eAAAA,CAAgBlB,IAAI,CAAA,CAAE,CAAA;AACzF,MAAA,MAAMmB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIjR,OAAAA,CAAQ+Q,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBvG,MAAAA,EAAQ,GAAA;UACR5K,OAAAA,EAASkR;SACX,CAAA;AACF,MAAA;AAGA,MAAA,IAAIpR,OAAAA,CAAQ+Q,MAAAA,KAAWI,eAAAA,CAAgBJ,MAAAA,EAAQ;AAC7C,QAAA,OAAOlS,MAAAA;AACT,MAAA;AAEA,MAAA,IAAI;AAEF,QAAA,MAAMiR,OAAAA,GAAU,MAAM9P,OAAAA,CAAQsR,IAAAA,EAAI;AAGlC,QAAA,MAAMvU,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AAGnC,QAAA,MAAMuR,SAAS,MAAMJ,eAAAA,CAAgBK,OAAAA,CAAQxR,OAAAA,EAASjD,SAAS+S,OAAAA,CAAAA;AAG/D,QAAA,IAAIyB,kBAAkBF,QAAAA,EAAU;AAE9B,UAAA,MAAMnR,QAAAA,GAAU,IAAIiF,OAAAA,CAAQoM,MAAAA,CAAOrR,OAAO,CAAA;AAC1C,UAAA,KAAA,MAAW,CAACD,GAAAA,EAAKzC,KAAAA,KAAUuM,MAAAA,CAAO0H,OAAAA,CAAQL,WAAAA,CAAAA,EAAc;AACtDlR,YAAAA,QAAAA,CAAQwR,GAAAA,CAAIzR,GAAAA,EAAKzC,KAAAA,CAAAA;AACnB,UAAA;AACA,UAAA,OAAO,IAAI6T,QAAAA,CAASE,MAAAA,CAAOI,IAAAA,EAAM;AAC/B7G,YAAAA,MAAAA,EAAQyG,MAAAA,CAAOzG,MAAAA;AACf8G,YAAAA,UAAAA,EAAYL,MAAAA,CAAOK,UAAAA;YACnB1R,OAAAA,EAAAA;WACF,CAAA;AACF,QAAA;AAGA,QAAA,MAAMA,OAAAA,GAAU,IAAIiF,OAAAA,CAAQ;UAC1B,cAAA,EAAgB,kBAAA;UAChB,GAAGiM;SACL,CAAA;AAEA,QAAA,OAAO,IAAIC,QAAAA,CAAS/W,IAAAA,CAAKE,SAAAA,CAAU+W,MAAAA,CAAAA,EAAS;UAC1CzG,MAAAA,EAAQ,GAAA;AACR5K,UAAAA;SACF,CAAA;AACF,MAAA,CAAA,CAAA,OAASzF,KAAAA,EAAO;AACdd,QAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,kCAAA,EAAqC+V,QAAAA,CAAAA,EAAAA,CAAAA,EAAc/V,KAAAA,CAAAA;AAChE,QAAA,MAAM2W,eAAcH,gBAAAA,EAAAA;AACpB,QAAA,MAAMY,SAAAA,GAAYC,gBAAgBrX,KAAAA,EAAO;AACvCgS,UAAAA,WAAAA,EAAa/S,MAAAA,CAAO+S,WAAAA;AACpBjH,UAAAA,WAAAA,EAAa9L,MAAAA,CAAO8L;SACtB,CAAA;AACA,QAAA,OAAO,IAAI6L,QAAAA,CAAS/W,IAAAA,CAAKE,SAAAA,CAAUqX,SAAAA,CAAUF,IAAI,CAAA,EAAG;AAClD7G,UAAAA,MAAAA,EAAQ+G,SAAAA,CAAU/G,MAAAA;UAClB5K,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;YAChB,GAAGkR;AACL;SACF,CAAA;AACF,MAAA;AACF,IAAA;AAUA,IAAA,IAAIZ,QAAAA,KAAa,UAAA,IAAcxQ,OAAAA,CAAQ+Q,MAAAA,KAAW,KAAA,EAAO;AACvD,MAAA,IAAI;AACF,QAAA,MAAMgB,aAAAA,GAAgB,aAAA;AACtB,QAAA,MAAMC,IAAAA,GAAQ,MAAM,OAAOD,aAAAA,CAAAA;AAI3B,QAAA,IAAI;AACFC,UAAAA,IAAAA,CAAKC,qBAAAA,CAAsB;AAAEC,YAAAA,QAAAA,EAAUF,IAAAA,CAAKE;WAAS,CAAA;QACvD,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,MAAMC,QAAAA,GAAW,MAAMH,IAAAA,CAAKE,QAAAA,CAASE,OAAAA,EAAO;AAa5C,QAAA,IAAIC,OAAAA,GAAU,EAAA;AACd,QAAA,MAAMpH,oBAAoBnE,OAAAA,EAAO;AACjC,QAAA,IAAI;AACFuL,UAAAA,OAAAA,GAAUC,kBAAAA,GAAqBC,kBAAAA,EAAkB;QACnD,CAAA,CAAA,MAAQ;AAER,QAAA;AAEA,QAAA,MAAMC,QAAAA,GAAWH,OAAAA,GAAU,CAAA,EAAGF,QAAAA;AAAaE,EAAAA,OAAAA,CAAAA,CAAAA,GAAYF,QAAAA;AACvD,QAAA,OAAO,IAAId,SAASmB,QAAAA,EAAU;UAC5B1H,MAAAA,EAAQ,GAAA;UACR5K,OAAAA,EAAS;YACP,cAAA,EAAgB8R,IAAAA,CAAKE,SAASO,WAAAA,IAAe;AAC/C;SACF,CAAA;MACF,CAAA,CAAA,MAAQ;AAER,MAAA;AACF,IAAA;AAGA,IAAA,MAAMC,UAAAA,GAAa;AAACpE,MAAAA,eAAAA;AAAiB,MAAA,CAAA,EAAGA,eAAAA,CAAAA,CAAAA,CAAAA;AAAoB,MAAA;;AAC5D,IAAA,MAAMqE,kBAAAA,GAAqBD,UAAAA,CAAW9T,QAAAA,CAAS4R,QAAAA,CAAAA;AAE/C,IAAA,IAAImC,kBAAAA,EAAoB;AACtB,MAAA,MAAMvB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIjR,OAAAA,CAAQ+Q,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBvG,MAAAA,EAAQ,GAAA;UACR5K,OAAAA,EAASkR;SACX,CAAA;AACF,MAAA;AAGA,MAAA,MAAMwB,eAAe,MAAMC,wBAAAA,CAAyB,MAAM/D,IAAAA,CAAKgE,KAAAA,CAAM9S,OAAAA,CAAAA,EAAU;AAC7EyM,QAAAA,WAAAA,EAAa/S,MAAAA,CAAO+S,WAAAA;AACpBjH,QAAAA,WAAAA,EAAa9L,MAAAA,CAAO8L;OACtB,CAAA;AAGA,MAAA,MAAMtF,OAAAA,GAAU,IAAIiF,OAAAA,CAAQyN,YAAAA,CAAa1S,OAAO,CAAA;AAChD,MAAA,KAAA,MAAW,CAACD,GAAAA,EAAKzC,KAAAA,KAAUuM,MAAAA,CAAO0H,OAAAA,CAAQL,WAAAA,CAAAA,EAAc;AACtDlR,QAAAA,OAAAA,CAAQwR,GAAAA,CAAIzR,KAAKzC,KAAAA,CAAAA;AACnB,MAAA;AAGA,MAAA,OAAO,IAAI6T,QAAAA,CAASuB,YAAAA,CAAajB,IAAAA,EAAM;AACrC7G,QAAAA,MAAAA,EAAQ8H,YAAAA,CAAa9H,MAAAA;AACrB8G,QAAAA,UAAAA,EAAYgB,YAAAA,CAAahB,UAAAA;AACzB1R,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,OAAOrB,MAAAA;EACT,CAAA,CAAA;AAGAwQ,EAAAA,GAAAA,CAAIG,GAAAA,CAAIlD,qBAAAA,CAAAA;AAGR+C,EAAAA,GAAAA,CAAIG,IACFnD,oBAAAA,CAAqB;AACnB0G,IAAAA,cAAAA,EAAgBrZ,OAAOqZ,cAAAA,IAAkB;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW,MAAA;;IACjEC,cAAAA,EAAgBtZ,MAAAA,CAAOsZ,kBAAkB,EAAA;AACzCC,IAAAA,UAAAA,EAAYvZ,OAAOuZ,UAAAA,IAAc,KAAA;AACjCC,IAAAA,qBAAAA,EAAuBxZ,OAAOwZ,qBAAAA,IAAyB;AACzD,GAAA,CAAA,CAAA;AAWF,EAAA,MAAMC,cAAAA,GAAiBzZ,OAAOyZ,cAAAA,IAAkB,OAAA;AAChD,EAAA,MAAM/I,eAAe7B,oBAAAA,CAAqB;IACxCQ,MAAAA,kBAAQ,MAAA,CAAA,MAAM/P,QAAAA,EAAN,QAAA,CAAA;AACRqQ,IAAAA,MAAAA,kBAAQ,MAAA,CAAA,YAAA;AAGN,MAAA,IAAI;AACF,QAAA,MAAM,EAAE+J,eAAAA,EAAe,GAAK,MAAM,OAAO,mBAAA,CAAA;AACzC,QAAA,OAAO,MAAMA,eAAAA,EAAAA;MACf,CAAA,CAAA,MAAQ;AACN,QAAA,OAAOvU,MAAAA;AACT,MAAA;IACF,CAAA,EATQ,QAAA,CAAA;IAUR,GAAInF,MAAAA,CAAO2Z,QAAQ3K,oBAAAA,GAAuB;AAAEA,MAAAA,oBAAAA,EAAsBhP,OAAO2Z,MAAAA,CAAO3K;AAAqB,KAAA,GAAI;GAC3G,CAAA;AAEA,EAAA,MAAM4K,OAAAA,mBAAU,MAAA,CAAA,MAAevI,YAAAA,CAAarR,MAAAA,CAAO+S,WAAAA,EAAa0G,cAAAA,EAAAA,iBAAgB,IAAIhV,IAAAA,EAAAA,EAAOG,WAAAA,EAAW,CAAA,EAAtF,SAAA,CAAA;AAEhB,EAAA,MAAMiV,IAAAA,iCAAcC,GAAAA,KAAAA;AAClB,IAAA,MAAMlJ,QAAAA,GAAW,MAAMF,YAAAA,EAAAA;AACvB,IAAA,MAAMqJ,UAAAA,GAAaD,GAAAA;AACnB,IAAA,MAAME,IAAAA,GAAOlJ,oBAAoBF,QAAAA,CAAAA;AACjC,IAAA,IAAImJ,UAAAA,CAAW/B,GAAAA,EAAK+B,UAAAA,CAAW/B,GAAAA,CAAI5G,MAAAA,GAAS4I,IAAAA;AAC5C,IAAA,OAAOjJ,aAAAA,CACLH,QAAAA,EACA5Q,MAAAA,CAAO+S,WAAAA,EACP0G,iCACA,IAAIhV,IAAAA,EAAAA,EAAOG,WAAAA,IACXqV,IAAAA,CAAKC,KAAAA,CAAM7S,OAAAA,CAAQ8S,MAAAA,EAAM,CAAA,CAAA;EAE7B,CAAA,EAZa,MAAA,CAAA;AAcbxE,EAAAA,GAAAA,CAAIlP,GAAAA,CAAI,WAAWoT,IAAAA,CAAAA;AACnBlE,EAAAA,GAAAA,CAAIlP,GAAAA,CAAI,gBAAgBmT,OAAAA,CAAAA;AACxBjE,EAAAA,GAAAA,CAAIlP,GAAAA,CAAI,iBAAiBoT,IAAAA,CAAAA;AACzBlE,EAAAA,GAAAA,CAAIlP,GAAAA,CAAI,mBAAmBmT,OAAAA,CAAAA;AAG3B,EAAA,IAAI9H,WAAAA,EAAa;AAEf6D,IAAAA,GAAAA,CAAIlP,IAAI,mBAAA,EAAqB,OAAO,EAAEH,OAAAA,EAAS0R,KAAG,KAAE;AAClD,MAAA,MAAM3U,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACgG,oBAAAA,CAAqBjJ,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8U,QAAAA,GAAAA,CAAI5G,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAErQ,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,OAAO+Q,YAAYsI,SAAAA,EAAS;IAC9B,CAAA,CAAA;AAGAzE,IAAAA,GAAAA,CAAIlP,IAAI,mBAAA,EAAqB,OAAO,EAAE4T,KAAAA,EAAO/T,OAAAA,EAAS0R,KAAG,KAAE;AACzD,MAAA,MAAM3U,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACgG,oBAAAA,CAAqBjJ,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8U,QAAAA,GAAAA,CAAI5G,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAErQ,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEoK,cAAAA,EAAgB/K,WAAAA,EAAW,GAAKia,KAAAA;AACxC,MAAA,OAAOvI,WAAAA,CAAYwI,SAAAA,CAAUnP,cAAAA,EAAgB/K,WAAAA,CAAAA;IAC/C,CAAA,CAAA;AAGAuV,IAAAA,GAAAA,CAAIlP,IAAI,qBAAA,EAAuB,OAAO,EAAE4T,KAAAA,EAAO/T,OAAAA,EAAS0R,KAAG,KAAE;AAC3D,MAAA,MAAM3U,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACgG,oBAAAA,CAAqBjJ,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8U,QAAAA,GAAAA,CAAI5G,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAErQ,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEoK,cAAAA,EAAgB/K,WAAAA,EAAama,KAAAA,EAAK,GAAKF,KAAAA;AAK/C,MAAA,MAAMG,WAAAA,GAAcD,KAAAA,EAAO1S,KAAAA,CAAM,GAAA,CAAA,CAAK8B,IAAI,CAACa,CAAAA,KAAMA,CAAAA,CAAE1C,IAAAA,EAAI,CAAA;AACvD,MAAA,OAAOgK,WAAAA,CAAY2I,cAAAA,CAAetP,cAAAA,EAAgB/K,WAAAA,EAAaoa,WAAAA,CAAAA;IACjE,CAAA,CAAA;AAGA7E,IAAAA,GAAAA,CAAIlP,IAAI,0BAAA,EAA4B,OAAO,EAAE4T,KAAAA,EAAO/T,OAAAA,EAAS0R,KAAG,KAAE;AAChE,MAAA,MAAM3U,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACgG,oBAAAA,CAAqBjJ,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8U,QAAAA,GAAAA,CAAI5G,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAErQ,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEoK,cAAAA,EAAgB/K,WAAAA,EAAW,GAAKia,KAAAA;AACxC,MAAA,OAAOvI,WAAAA,CAAY4I,mBAAAA,CAAoBvP,cAAAA,EAAgB/K,WAAAA,CAAAA;IACzD,CAAA,CAAA;AACF,EAAA;AAGA,EAAA,IAAI2R,aAAAA,IAAiBA,aAAAA,CAAcvM,MAAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,KAAA,MAAWkD,YAAYqJ,aAAAA,EAAe;AAEpC,MAAA,IAAIrJ,SAAS0N,OAAAA,EAAS;AACpBnW,QAAAA,MAAAA,CAAO6S,KAAK,CAAA,uCAAA,EAA0CpK,QAAAA,CAAS2O,MAAM,CAAA,CAAA,EAAI3O,QAAAA,CAAS6N,IAAI,CAAA,CAAE,CAAA;AACxF,QAAA;AACF,MAAA;AAEA,MAAA,MAAMuB,OAAAA,mBAAU,MAAA,CAAA,OAAO,EAAExR,OAAAA,EAAO,KAAwB;AACtD,QAAA,IAAI;AACF,UAAA,MAAMjD,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,UAAA,OAAO,MAAMoC,QAAAA,CAASoP,OAAAA,CAAQxR,OAAAA,EAASjD,OAAAA,CAAAA;AACzC,QAAA,CAAA,CAAA,OAAStC,KAAAA,EAAO;AACdd,UAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,8BAAA,EAAiC2H,QAAAA,CAAS6N,IAAI,MAAMxV,KAAAA,CAAAA;AACjE,UAAA,OAAO4Z,wBAAwB5Z,KAAAA,EAAO;AACpCgS,YAAAA,WAAAA,EAAa/S,MAAAA,CAAO+S,WAAAA;AACpBjH,YAAAA,WAAAA,EAAa9L,MAAAA,CAAO8L;WACtB,CAAA;AACF,QAAA;MACF,CAAA,EAXgB,SAAA,CAAA;AAahB,MAAA,QAAQpD,SAAS2O,MAAAA;QACf,KAAK,KAAA;AACH1B,UAAAA,GAAAA,CAAIlP,GAAAA,CAAIiC,QAAAA,CAAS6N,IAAAA,EAAMuB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,MAAA;AACHnC,UAAAA,GAAAA,CAAIiF,IAAAA,CAAKlS,QAAAA,CAAS6N,IAAAA,EAAMuB,OAAAA,CAAAA;AACxB,UAAA;QACF,KAAK,KAAA;AACHnC,UAAAA,GAAAA,CAAIkF,GAAAA,CAAInS,QAAAA,CAAS6N,IAAAA,EAAMuB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,OAAA;AACHnC,UAAAA,GAAAA,CAAImF,KAAAA,CAAMpS,QAAAA,CAAS6N,IAAAA,EAAMuB,OAAAA,CAAAA;AACzB,UAAA;QACF,KAAK,QAAA;AACHnC,UAAAA,GAAAA,CAAIoF,MAAAA,CAAOrS,QAAAA,CAAS6N,IAAAA,EAAMuB,OAAAA,CAAAA;AAC1B,UAAA;AACJ;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAMkD,IAAAA,GAAOhb,OAAOgb,IAAAA,IAAQ,SAAA;AAC5B,EAAA,MAAMC,OAAOjb,MAAAA,CAAOib,IAAAA;AAGpB,EAAA,MAAMC,cAAAA,GAAiC;AACrCvF,IAAAA,GAAAA;IACAwF,MAAAA,EAAQ,IAAA;AACRC,IAAAA,KAAAA,kBAAO,MAAA,CAAA,YAAA;AACL9J,MAAAA,eAAAA,uBAAsB7M,IAAAA,EAAAA;AAGtBkR,MAAAA,GAAAA,CAAI0F,MAAAA,CAAO;AACTJ,QAAAA,IAAAA;QACAK,QAAAA,EAAUN;OACZ,CAAA;AAIA,MAAA,MAAMO,SAAAA,GAAY5F,GAAAA;AAClBuF,MAAAA,cAAAA,CAAeC,SAASI,SAAAA,CAAUJ,MAAAA;AAElClb,MAAAA,MAAAA,CAAO6S,IAAAA,CAAK,CAAA,UAAA,EAAM9S,MAAAA,CAAO+S,WAAW,CAAA,sBAAA,EAAyBiI,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,CAAAA,EAAOrG,eAAAA,CAAAA,CAAiB,CAAA;IAC/F,CAAA,EAfO,OAAA,CAAA;AAgBP4G,IAAAA,IAAAA,kBAAM,MAAA,CAAA,YAAA;AACJvb,MAAAA,MAAAA,CAAO6S,IAAAA,CAAK,CAAA,kBAAA,EAAqB9S,MAAAA,CAAO+S,WAAW,CAAA,GAAA,CAAK,CAAA;AAExD,MAAA,IAAIX,UAAAA,EAAY;AACd,QAAA,MAAMA,UAAAA,EAAAA;AACR,MAAA;AAEA,MAAA,IAAIN,WAAAA,EAAa;AACf,QAAA,MAAMA,YAAY2J,QAAAA,EAAQ;AAC5B,MAAA;AAEA,MAAA,MAAM/I,kBAAAA,GAAqBgJ,UAAAA,EAAU;AAErC,MAAA,IAAIR,eAAeC,MAAAA,EAAQ;AACzBD,QAAAA,cAAAA,CAAeC,OAAOK,IAAAA,EAAI;AAC5B,MAAA;AAEAvb,MAAAA,MAAAA,CAAO6S,IAAAA,CAAK,CAAA,SAAA,EAAY9S,MAAAA,CAAO+S,WAAW,CAAA,QAAA,CAAU,CAAA;IACtD,CAAA,EAlBM,MAAA,CAAA;AAmBN4I,IAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAA;AACP,MAAA,MAAMxB,MAAAA,GAAS7I,eAAAA,GAAkB2I,IAAAA,CAAK2B,KAAAA,CAAAA,CAAOnX,IAAAA,CAAKO,GAAAA,EAAG,GAAKsM,eAAAA,CAAgB/L,OAAAA,EAAO,IAAM,GAAA,CAAA,GAAQ,CAAA;AAE/F,MAAA,OAAO;AACLwN,QAAAA,WAAAA,EAAa/S,MAAAA,CAAO+S,WAAAA;AACpB0G,QAAAA,cAAAA,EAAgBzZ,OAAOyZ,cAAAA,IAAkB,OAAA;AACzC3N,QAAAA,WAAAA,EAAa9L,OAAO8L,WAAAA,IAAe,aAAA;AACnCmP,QAAAA,IAAAA;AACAD,QAAAA,IAAAA;AACApG,QAAAA,eAAAA;QACAiH,SAAAA,EAAWvK,eAAAA,EAAiB1M,aAAAA,IAAiB,EAAA;AAC7CuV,QAAAA;AACF,OAAA;IACF,CAAA,EAbS,SAAA;AAcX,GAAA;AAGA,EAAA,MAAM2B,gBAAAA,iCAA0BC,MAAAA,KAAAA;AAC9B9b,IAAAA,MAAAA,CAAO6S,IAAAA,CAAK,CAAA,SAAA,EAAYiJ,MAAAA,CAAAA,sCAAAA,CAA8C,CAAA;AACtE,IAAA,MAAMb,eAAeM,IAAAA,EAAI;AACzBnU,IAAAA,OAAAA,CAAQ2U,KAAK,CAAA,CAAA;EACf,CAAA,EAJyB,kBAAA,CAAA;AAMzB3U,EAAAA,OAAAA,CAAQ4U,EAAAA,CAAG,WAAW,MAAA;AACpB,IAAA,KAAKH,iBAAiB,SAAA,CAAA;EACxB,CAAA,CAAA;AACAzU,EAAAA,OAAAA,CAAQ4U,EAAAA,CAAG,UAAU,MAAA;AACnB,IAAA,KAAKH,iBAAiB,QAAA,CAAA;EACxB,CAAA,CAAA;AAEA,EAAA,OAAOZ,cAAAA;AACT;AAloBsBxJ,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAyoBf,SAASwK,oBAAoB/b,qBAAAA,EAA4C;AAC9EJ,EAAAA,aAAAA,CAAc;IAAEI,oBAAAA,EAAAA;GAAqB,CAAA;AACvC;AAFgB+b,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * Server Auth Module\n *\n * JWT verification with workspace secret fetching for microservices.\n * Handles HS256 tokens with secrets stored in workspace database.\n */\n\nimport { logger } from '../logger/index.js';\nimport type { IActor, JWTPayload, WorkspaceSecret } from './types.js';\n\n// Type imports from packages\nimport type * as jose from 'jose';\nimport type { VerifyOptions, Jwt, JwtPayload } from 'jsonwebtoken';\n\n/**\n * Workspace model interface for fetching JWT secrets\n */\ninterface WorkspaceModel {\n  findUnique: (args: { where: { id: string } }) => Promise<{ jwtSecret?: unknown } | null>;\n}\n\ninterface DbClient {\n  client: {\n    workspace: WorkspaceModel;\n  };\n}\n\n// Import getDb dynamically to avoid circular dependencies\nlet getDbFn: (() => DbClient) | null = null;\n\nasync function getDb(): Promise<DbClient> {\n  if (!getDbFn) {\n    const prismaModule = await import('../prisma/index.js');\n    // Use unknown first then cast to avoid type inference issues\n    getDbFn = prismaModule.getDb as unknown as () => DbClient;\n  }\n  return getDbFn();\n}\n\n// Interface for the subset of jsonwebtoken we use\ninterface JwtModule {\n  decode(token: string, options?: { complete?: boolean }): string | Jwt | JwtPayload | null;\n  verify(token: string, secretOrPublicKey: string, options?: VerifyOptions): string | JwtPayload;\n}\n\n// Module cache for dynamic imports\nlet joseModule: typeof jose | null = null;\nlet jwtModule: JwtModule | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\nasync function getJwt(): Promise<JwtModule> {\n  if (!jwtModule) {\n    const jwt = await import('jsonwebtoken');\n    // Handle both ESM and CJS module formats\n    jwtModule = (jwt as { default?: JwtModule }).default ?? jwt;\n  }\n  return jwtModule;\n}\n\n/**\n * Fetch workspace secret callback type\n */\nexport type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig {\n  /** Function to fetch workspace JWT secret from database */\n  fetchWorkspaceSecret: FetchWorkspaceSecretFn;\n}\n\nlet authConfig: AuthConfig | null = null;\n\n/**\n * Configure auth module with workspace secret fetching\n */\nexport function configureAuth(config: AuthConfig): void {\n  authConfig = config;\n  logger.debug('[ServerAuth] Auth configured');\n}\n\n/**\n * Default workspace secret fetcher\n *\n * Fetches JWT secret from workspace database. This is the standard implementation\n * that works with any microservice that has access to the workspace model.\n *\n * @param workspaceId - Workspace ID from JWT\n * @returns WorkspaceSecret or null if not found\n */\nexport async function fetchWorkspaceSecret(workspaceId: string): Promise<WorkspaceSecret | null> {\n  try {\n    const db = await getDb();\n    const workspace = await db.client.workspace.findUnique({\n      where: { id: workspaceId },\n    });\n\n    if (!workspace?.jwtSecret) {\n      logger.debug('[ServerAuth] No JWT secret found for workspace', { workspaceId });\n      return null;\n    }\n\n    return JSON.parse(JSON.stringify(workspace.jwtSecret)) as WorkspaceSecret;\n  } catch (error) {\n    logger.warn('[ServerAuth] Error fetching workspace secret', { workspaceId, error });\n    return null;\n  }\n}\n\n/**\n * Configure auth with default workspace secret fetcher\n *\n * This is automatically called by createServer if no custom auth is configured.\n */\nexport function configureDefaultAuth(): void {\n  if (!authConfig) {\n    configureAuth({ fetchWorkspaceSecret });\n    logger.debug('[ServerAuth] Default auth configured with built-in workspace secret fetcher');\n  }\n}\n\n/**\n * Generate a symmetric secret key for JWT signing\n * @returns JWK object with the generated key\n */\nexport async function generateSymmetricSecret(): Promise<jose.JWK> {\n  const joseLib = await getJose();\n  const secret = await joseLib.generateSecret('HS256');\n  const jwk = await joseLib.exportJWK(secret);\n  return jwk;\n}\n\n/**\n * Verify JWT token for workspace-scoped authentication\n *\n * @param token - JWT token to verify\n * @param secret - Optional secret for verification (if not provided, fetches from workspace)\n * @param options - JWT verification options\n * @returns Verified actor information or null if invalid\n */\nexport async function verifyJWT(token: string, secret?: string, options: VerifyOptions = {}): Promise<IActor | null> {\n  try {\n    const jwt = await getJwt();\n    const joseLib = await getJose();\n\n    // Decode to check algorithm and extract workspace_id\n    const decoded = jwt.decode(token, { complete: true });\n\n    if (!decoded || typeof decoded === 'string' || !decoded.payload || typeof decoded.payload !== 'object') {\n      logger.warn('[ServerAuth] Invalid token format');\n      return null;\n    }\n\n    // For workspace-scoped HS256 tokens\n    if (secret) {\n      // Use provided secret\n      const verifiedJwt = jwt.verify(token, secret, options) as JWTPayload;\n      return mapPayloadToActor(verifiedJwt);\n    }\n\n    // Fetch secret from workspace database\n    const decodedJwt = joseLib.decodeJwt(token) as JWTPayload;\n    if (!decodedJwt.workspace_id) {\n      logger.warn('[ServerAuth] No workspace_id found in token');\n      return null;\n    }\n\n    if (!authConfig?.fetchWorkspaceSecret) {\n      logger.error('[ServerAuth] Auth not configured - call configureAuth() first');\n      return null;\n    }\n\n    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);\n    if (!workspaceSecret) {\n      logger.warn('[ServerAuth] Workspace secret not found');\n      return null;\n    }\n\n    const keyLikeSecret = await joseLib.importJWK(workspaceSecret, 'HS256');\n    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options as jose.JWTVerifyOptions);\n    return mapPayloadToActor(verifiedJwt.payload as unknown as JWTPayload);\n  } catch (err) {\n    logger.warn('[ServerAuth] Error verifying JWT:', err);\n    return null;\n  }\n}\n\n/**\n * Decode JWT without verification (for extracting claims)\n */\nexport async function decodeJWT(token: string): Promise<JWTPayload | null> {\n  try {\n    const joseLib = await getJose();\n    return joseLib.decodeJwt(token);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Map JWT payload to IActor interface\n */\nfunction mapPayloadToActor(payload: JWTPayload): IActor {\n  return {\n    id: payload.sub,\n    type: payload.actor_type ?? 'user',\n    workspace_id: payload.workspace_id,\n    tenant_id: payload.tenant_id,\n    org_id: payload.org_id,\n    isAdmin: payload['isAdmin'] as boolean | undefined,\n  };\n}\n\n/**\n * Check if actor is authenticated\n */\nexport function authCheck(actor: IActor | null): IActor {\n  if (!actor) {\n    throw new Error('Please sign in');\n  }\n  return actor;\n}\n\n/**\n * Check workspace context and return actor ID and workspace ID\n */\nexport function workspaceCheck(context: { actor: IActor | null; workspace: { id: string } | null }): {\n  actorId: string;\n  workspaceId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  return {\n    actorId: actor.id,\n    workspaceId: context.workspace.id,\n  };\n}\n\n/**\n * Require workspace context - type narrowing guard for wspace layer services\n *\n * Validates that both actor and workspace are present in the context,\n * and returns a type-narrowed context where workspace and actor are guaranteed non-null.\n * Use this at the start of resolvers in wspace services to get typed access\n * to workspace context without optional chaining.\n *\n * @throws Error if actor is not authenticated\n * @throws Error if workspace context is missing\n *\n * @example\n * ```typescript\n * // In a resolver:\n * const ctx = requireWorkspace(context);\n * const workspaceId = ctx.workspace.id;  // no optional chaining needed\n * const actorId = ctx.actor.id;          // no optional chaining needed\n * ```\n */\nexport function requireWorkspace<T extends { actor: IActor | null; workspace: { id: string } | null }>(\n  context: T\n): T & { actor: IActor; workspace: { id: string } } {\n  // Validate actor is authenticated (throws if null)\n  authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  // Return the same context object with narrowed types\n  return context as T & { actor: IActor; workspace: { id: string } };\n}\n\n/**\n * Check organization context and return actor ID and org ID\n */\nexport function orgCheck(context: { actor: IActor | null; organization: { id: string } | null }): {\n  actorId: string;\n  orgId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.organization?.id) {\n    throw new Error('Please switch to an organization');\n  }\n\n  return {\n    actorId: actor.id,\n    orgId: context.organization.id,\n  };\n}\n\n/**\n * Check tenant context and return tenant ID\n */\nexport function tenantCheck(context: { tenant: { id: string } | null }): string {\n  if (!context.tenant?.id) {\n    throw new Error('Tenant context is required');\n  }\n  return context.tenant.id;\n}\n\n/**\n * Get effective actor ID for \"on behalf of\" tracking\n *\n * When an app or service acts with user consent, returns the delegating user's ID.\n * Otherwise returns the direct actor ID.\n *\n * This is used to determine the `onBehalfOf` field in database audit trails:\n * - If actor is user → returns user ID (self-action)\n * - If actor is app/service with consent → returns grantedBy user ID\n * - If actor is app/service without consent → returns actor ID (self-action)\n *\n * @param context - GraphQL context with actor and optional consent context\n * @returns Effective actor ID (the responsible principal)\n *\n * @example\n * ```typescript\n * // User acting directly\n * context.actor = { id: \"user-123\", type: \"user\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"user-123\"\n *\n * // Bot acting on behalf of user\n * context.actor = { id: \"bot-456\", type: \"service\" }\n * context.consentContext = { grantedBy: \"user-789\" }\n * getEffectiveActorId(context) // → \"user-789\"\n *\n * // App acting without consent (self-action)\n * context.actor = { id: \"app-abc\", type: \"app\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"app-abc\"\n * ```\n */\nexport function getEffectiveActorId(context: {\n  actor: IActor | null;\n  consentContext?: { grantedBy: string } | null;\n}): string | null {\n  if (!context.actor) {\n    return null;\n  }\n\n  // If actor is app or service acting with user consent, return the delegating user\n  if (\n    (context.actor.type === 'app' || context.actor.type === 'service' || context.actor.type === 'service_account') &&\n    context.consentContext?.grantedBy\n  ) {\n    return context.consentContext.grantedBy;\n  }\n\n  // Otherwise return the direct actor (user self-action or app/service self-action)\n  return context.actor.id;\n}\n","import type { IActor, VerifiedDelegationContext } from './types.js';\n\n// Structural narrowing permits inspecting unknown properties without trusting their values.\nfunction object(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction identifier(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value['length'] > 0 &&\n    value['length'] <= 200 &&\n    value['trim']() === value &&\n    Array.from(value).every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127)\n  );\n}\n\nfunction list(value: unknown): value is string[] {\n  return Array.isArray(value) && value['length'] <= 1000 && value['every'](identifier);\n}\n\nfunction instant(value: unknown): Date | null {\n  if (typeof value !== 'string') return null;\n  const time = Date.parse(value);\n  return Number.isFinite(time) && new Date(time).toISOString() === value ? new Date(time) : null;\n}\n\n/** Decodes transport only; JWT verification remains the gateway's responsibility. */\nexport function decodeVerifiedDelegation(\n  header: string | undefined,\n  actor: IActor | null,\n  workspaceId: string | undefined,\n  trustedGateway: boolean,\n  now = Date.now()\n): VerifiedDelegationContext | undefined {\n  if (\n    !trustedGateway ||\n    !actor ||\n    actor.provenance !== 'delegated' ||\n    !['user', 'super_admin'].includes(actor.type) ||\n    header === undefined\n  )\n    return undefined;\n  const invalid = () => new Error('Invalid verified delegation context');\n  let raw: unknown;\n  try {\n    raw = JSON.parse(header);\n  } catch {\n    throw invalid();\n  }\n  const value = object(raw);\n  const tokenExpiresAt = instant(value?.['tokenExpiresAt']);\n  if (\n    !value ||\n    !identifier(value['representedUserId']) ||\n    value['representedUserId'] !== actor.id ||\n    !identifier(value['originatingAppId']) ||\n    !identifier(value['delegationId']) ||\n    !list(value['scopes']) ||\n    !list(value['allowedWorkspaceIds']) ||\n    !tokenExpiresAt ||\n    tokenExpiresAt.getTime() <= now ||\n    (workspaceId && value['allowedWorkspaceIds'].length > 0 && !value['allowedWorkspaceIds'].includes(workspaceId))\n  )\n    throw invalid();\n  let consent: VerifiedDelegationContext['consent'] = null;\n  if (value['consent'] !== null) {\n    const facts = object(value['consent']);\n    const grantedAt = instant(facts?.['grantedAt']);\n    const expiresAt = facts?.['expiresAt'] === null ? null : instant(facts?.['expiresAt']);\n    if (\n      !facts ||\n      !identifier(facts['grantedBy']) ||\n      !grantedAt ||\n      grantedAt.getTime() > now ||\n      (facts['expiresAt'] !== null &&\n        (!expiresAt || expiresAt.getTime() <= grantedAt.getTime() || tokenExpiresAt.getTime() > expiresAt.getTime()))\n    )\n      throw invalid();\n    consent = { grantedBy: facts['grantedBy'], grantedAt, expiresAt };\n  }\n  return {\n    representedUserId: value['representedUserId'],\n    originatingAppId: value['originatingAppId'],\n    delegationId: value['delegationId'],\n    scopes: [...value['scopes']],\n    allowedWorkspaceIds: [...value['allowedWorkspaceIds']],\n    tokenExpiresAt,\n    consent,\n  };\n}\n","/**\n * Server Context Module\n *\n * Builds GraphQL context from request headers, JWT, and configuration.\n * Automatically populates actor, tenant, workspace, and tracking information.\n *\n * **Actor-Based Authentication:**\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Services verify JWT directly and build actor from payload\n *\n * Uses standard Web API Request (compatible with Bun/Elysia).\n */\n\nimport { logger } from '../logger/index.js';\nimport crypto from 'node:crypto';\nimport { verifyJWT } from './auth.js';\nimport { decodeVerifiedDelegation } from './verified-delegation.js';\nimport type {\n  GraphQLContext,\n  ActorProvenance,\n  IActor,\n  ITenant,\n  IOrganization,\n  IWorkspace,\n  IProject,\n  IProduct,\n  ITracking,\n} from './types.js';\nimport type { I18n, I18nContext } from '../i18n/index.js';\nimport { setWorkspaceContext } from '../prisma/workspace-extension.js';\nimport { ContextManager } from '../context/index.js';\n\n/**\n * Context builder options\n */\nexport interface ContextBuilderOptions {\n  /** Database getter function */\n  getDb: () => unknown;\n  /** Default tenant info (optional) */\n  defaultTenant?: ITenant;\n  /** I18n instance (optional) */\n  i18n?: I18n;\n}\n\nlet contextOptions: ContextBuilderOptions | null = null;\n\n/**\n * Configure context builder\n */\nexport function configureContext(options: ContextBuilderOptions): void {\n  contextOptions = options;\n  logger.debug('[ServerContext] Context builder configured');\n}\n\n/**\n * Extract header value from standard Web API Request\n */\nfunction getHeader(request: Request, key: string): string | undefined {\n  return request.headers.get(key.toLowerCase()) ?? undefined;\n}\n\nfunction compareSecret(provided: string, expected: string): boolean {\n  const providedBuffer = Buffer.from(provided);\n  const expectedBuffer = Buffer.from(expected);\n\n  if (providedBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);\n}\n\nexport function shouldTrustActorHeaders(\n  request: Request,\n  nodeEnv: string | undefined = process.env['NODE_ENV'],\n  expectedGatewayToken: string | undefined = process.env['TRUSTED_GATEWAY_TOKEN'] ??\n    process.env['INTERNAL_SERVICE_TOKEN']\n): boolean {\n  if (!getHeader(request, 'x-actor-id')) {\n    return false;\n  }\n\n  if (nodeEnv === 'production') {\n    return true;\n  }\n\n  const providedGatewayToken =\n    getHeader(request, 'x-internal-service-token') || getHeader(request, 'x-gateway-auth-token');\n  if (!expectedGatewayToken || !providedGatewayToken) {\n    return false;\n  }\n\n  return compareSecret(providedGatewayToken, expectedGatewayToken);\n}\n\n/**\n * Extract tracking information from request\n */\nfunction extractTracking(request: Request): ITracking {\n  // Get IP from various possible headers\n  const forwardedFor = getHeader(request, 'x-forwarded-for');\n  const realIp = getHeader(request, 'x-real-ip');\n  const ip = forwardedFor?.split(',')[0]?.trim() || realIp || undefined;\n\n  return {\n    ip,\n    userAgent: getHeader(request, 'user-agent'),\n  };\n}\n\n/**\n * Extract actor from gateway-injected headers or authorization header\n *\n * **Actor-Based Authentication:**\n * - If x-actor-id header exists, trust it (gateway-authenticated)\n * - Otherwise fall back to JWT verification (direct access in dev)\n *\n * This allows:\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Direct service access with JWT → service verifies JWT itself\n * - Development testing: Direct headers → service trusts headers\n */\nfunction actorProvenance(request: Request): ActorProvenance {\n  const value = getHeader(request, 'x-verified-actor-provenance');\n  return value === 'direct_human' || value === 'delegated' || value === 'non_human' ? value : 'unknown';\n}\n\nasync function extractActor(request: Request): Promise<IActor | null> {\n  // Check for gateway-injected actor headers first\n  const actorId = getHeader(request, 'x-actor-id');\n\n  if (actorId && shouldTrustActorHeaders(request)) {\n    // Gateway has already verified JWT and populated context headers\n    // Trust the headers (gateway is the security perimeter)\n    logger.debug('[ServerContext] Using gateway-authenticated actor from headers');\n\n    const actorType = getHeader(request, 'x-actor-type') || 'user';\n    const userRole = getHeader(request, 'x-user-role');\n\n    return {\n      id: actorId,\n      type: actorType,\n      provenance: actorProvenance(request),\n      workspace_id: getHeader(request, 'x-workspace-id'),\n      tenant_id: getHeader(request, 'x-tenant-id'),\n      org_id: getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id'),\n      isAdmin:\n        actorType === 'super_admin' ||\n        userRole === 'TENANT_ADMIN' ||\n        userRole === 'SUPER_ADMIN' ||\n        userRole === 'PLATFORM_ADMIN',\n    };\n  }\n\n  if (actorId) {\n    logger.warn('[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification');\n  }\n\n  // FALLBACK: No gateway headers, verify JWT directly (dev/testing mode)\n  const authHeader = getHeader(request, 'authorization');\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.substring(7);\n\n  try {\n    logger.debug('[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)');\n    const payload = await verifyJWT(token);\n\n    if (!payload) {\n      return null;\n    }\n\n    // Build actor from JWT payload\n    return {\n      id: payload.id,\n      type: 'user', // Default to 'user' if not specified\n      provenance: 'unknown', // Development fallback does not attest gateway provenance.\n      workspace_id: payload.workspace_id,\n    };\n  } catch (error) {\n    logger.warn('[ServerContext] Invalid JWT token:', error);\n    return null;\n  }\n}\n\n/**\n * Extract tenant from headers\n */\nfunction extractTenant(request: Request): ITenant | null {\n  // Check headers\n  const tenantId = getHeader(request, 'x-tenant-id');\n  const tenantEndpoint = getHeader(request, 'x-tenant-endpoint');\n\n  if (tenantId) {\n    return {\n      id: tenantId,\n      endpoint: tenantEndpoint || '',\n    };\n  }\n\n  // Fall back to default tenant if configured\n  return contextOptions?.defaultTenant || null;\n}\n\n/**\n * Extract organization from headers\n */\nfunction extractOrganization(request: Request): IOrganization | null {\n  const orgId = getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id');\n\n  if (orgId) {\n    return { id: orgId };\n  }\n\n  return null;\n}\n\n/**\n * Extract workspace from headers or actor\n */\nfunction extractWorkspace(request: Request, actor: IActor | null): IWorkspace | null {\n  // Check headers first\n  const workspaceId = getHeader(request, 'x-workspace-id');\n\n  if (workspaceId) {\n    return { id: workspaceId };\n  }\n\n  // Fall back to workspace_id from actor\n  if (actor?.workspace_id) {\n    return { id: actor.workspace_id };\n  }\n\n  return null;\n}\n\n/**\n * Extract project from headers\n */\nfunction extractProject(request: Request): IProject | null {\n  const projectId = getHeader(request, 'x-project-id');\n\n  if (projectId) {\n    return { id: projectId };\n  }\n\n  return null;\n}\n\n/**\n * Extract product from headers\n */\nfunction extractProduct(request: Request): IProduct | null {\n  const productId = getHeader(request, 'x-product-id');\n\n  if (productId) {\n    return { id: productId };\n  }\n\n  return null;\n}\n\n/**\n * Extract geography context from headers\n *\n * Geography headers carry the user's selected location context,\n * used for currency defaults, tax calculations, payment routing,\n * data residency, and regional support.\n *\n * Headers:\n * - x-geo-country: ISO 3166-1 alpha-2 country code (e.g., 'IN', 'US', 'DE')\n * - x-geo-currency: ISO 4217 currency code (e.g., 'INR', 'USD', 'EUR')\n * - x-geo-timezone: IANA timezone (e.g., 'Asia/Kolkata', 'America/New_York')\n */\nfunction extractGeography(request: Request): { country?: string; currency?: string; timezone?: string } {\n  const country = getHeader(request, 'x-geo-country');\n  const currency = getHeader(request, 'x-geo-currency');\n  const timezone = getHeader(request, 'x-geo-timezone');\n\n  return {\n    country: country?.toUpperCase() || undefined,\n    currency: currency?.toUpperCase() || undefined,\n    timezone: timezone || undefined,\n  };\n}\n\n/**\n * Extract consent context from headers\n *\n * When an app or service acts on behalf of a user (with user consent),\n * the gateway forwards consent headers. This function extracts them.\n *\n * Headers:\n * - x-consent-granted-by: Actor ID who granted consent (delegating user)\n * - x-consent-scope: Comma-separated scopes\n * - x-consent-granted-at: ISO timestamp when consent was granted\n * - x-consent-expires-at: ISO timestamp when consent expires\n */\nfunction extractConsentContext(request: Request): import('./types.js').ConsentContext | null {\n  const grantedBy = getHeader(request, 'x-consent-granted-by');\n\n  // If no grantedBy, there's no consent delegation\n  if (!grantedBy) {\n    return null;\n  }\n\n  const scopesHeader = getHeader(request, 'x-consent-scope');\n  const grantedAtHeader = getHeader(request, 'x-consent-granted-at');\n  const expiresAtHeader = getHeader(request, 'x-consent-expires-at');\n\n  return {\n    grantedBy,\n    scopes: scopesHeader ? scopesHeader.split(',').map((s) => s.trim()) : undefined,\n    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : undefined,\n    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : undefined,\n  };\n}\n\n/**\n * Build GraphQL context from standard Web Request\n *\n * Also sets the workspace context in AsyncLocalStorage for automatic\n * Prisma workspaceId injection via the workspace extension.\n */\nexport async function buildContext(request: Request): Promise<GraphQLContext> {\n  if (!contextOptions) {\n    throw new Error('[ServerContext] Context not configured - call configureContext() first');\n  }\n\n  // Extract actor from headers/JWT\n  const actor = await extractActor(request);\n\n  // Extract all context parts\n  const tenant = extractTenant(request);\n  const organization = extractOrganization(request);\n  const workspace = extractWorkspace(request, actor);\n  const project = extractProject(request);\n  const product = extractProduct(request);\n  const tracking = extractTracking(request);\n  const consentContext = extractConsentContext(request);\n  const verifiedDelegation = decodeVerifiedDelegation(\n    getHeader(request, 'x-verified-delegation'),\n    actor,\n    workspace?.id,\n    shouldTrustActorHeaders(request)\n  );\n\n  // Build i18n context if configured\n  let i18n: I18nContext | undefined;\n  if (contextOptions.i18n) {\n    i18n = contextOptions.i18n.createContextFromRequest(request);\n  }\n\n  // Merge geography context from x-geo-* headers into i18n\n  const geo = extractGeography(request);\n  if (geo.country || geo.currency || geo.timezone) {\n    if (i18n) {\n      // Merge geography fields into existing i18n context\n      if (geo.country) i18n.country = geo.country;\n      if (geo.currency) i18n.currency = geo.currency;\n      if (geo.timezone) i18n.timezone = geo.timezone;\n    } else {\n      // Create minimal i18n context with geography only (when i18n module not configured)\n      i18n = {\n        locale: 'en-US',\n        language: 'en',\n        country: geo.country,\n        currency: geo.currency,\n        timezone: geo.timezone,\n        t: (key: string) => key,\n        tp: (key: string) => key,\n        formatNumber: (value: number) => String(value),\n        formatCurrency: (value: number, currency: string) => `${currency} ${value}`,\n        formatDate: (date: Date | string) => String(date),\n        formatRelativeTime: (value: number, unit: Intl.RelativeTimeFormatUnit) => `${value} ${unit}`,\n      };\n    }\n  }\n\n  // Determine onBehalfOf for audit trails\n  // If actor is app/service with consent → use grantedBy (delegating user)\n  // Otherwise → use actor.id (self-action)\n  const onBehalfOf =\n    (actor?.type === 'app' || actor?.type === 'service' || actor?.type === 'service_account') &&\n    consentContext?.grantedBy\n      ? consentContext.grantedBy\n      : actor?.id;\n\n  // Set workspace context in AsyncLocalStorage for Prisma workspace extension\n  // This enables automatic workspaceId injection on create/update operations\n  const wsCtxPayload = {\n    workspaceId: workspace?.id,\n    tenantId: tenant?.id,\n    actorId: actor?.id,\n    actorType: actor?.type,\n    organizationId: organization?.id,\n    projectId: project?.id,\n    onBehalfOf,\n  };\n\n  logger.debug('[ServerContext] Setting workspace context', {\n    workspaceId: wsCtxPayload.workspaceId ?? 'NONE',\n    actorId: wsCtxPayload.actorId ?? 'NONE',\n    rawHeader: getHeader(request, 'x-workspace-id') ?? 'MISSING',\n  });\n\n  setWorkspaceContext(wsCtxPayload);\n\n  // Capture the Cloudflare Access service token for cross-layer calls.\n  // NOTE: this path populates the Prisma workspace store (above), NOT the\n  // general ContextManager ALS — so cross-layer clients reading\n  // ContextManager.getCfAccessHeaders() would otherwise see nothing here.\n  // Record it explicitly (module-level fallback) so resolver-initiated\n  // cross-layer calls re-present it. No-op unless the gateway forwarded the\n  // headers (alpha only; gated upstream on cf-ray).\n  ContextManager.setCfAccessContext(\n    getHeader(request, 'cf-access-client-id'),\n    getHeader(request, 'cf-access-client-secret'),\n    getHeader(request, 'x-cf-authorization')\n  );\n\n  return {\n    request,\n    actor,\n    tenant,\n    organization,\n    workspace,\n    project,\n    product,\n    tracking,\n    consentContext: consentContext || undefined,\n    verifiedDelegation,\n    onBehalfOf: onBehalfOf || actor?.id || '',\n    db: contextOptions.getDb(),\n    i18n,\n    responseHeaders: new Headers(),\n  };\n}\n\n/**\n * Get context options\n */\nexport function getContextOptions(): ContextBuilderOptions | null {\n  return contextOptions;\n}\n","import type { IActor } from './types.js';\n\nconst LOCALHOST_ORIGINS = [\n  'http://localhost:3000',\n  'http://localhost:4000',\n  'http://localhost:5173',\n  'http://127.0.0.1:3000',\n  'http://127.0.0.1:4000',\n  'http://127.0.0.1:5173',\n];\n\nexport function normalizeCorsOrigins(\n  origins: string | string[] | undefined,\n  environment: 'development' | 'staging' | 'production' | undefined\n): string[] {\n  const normalized = (Array.isArray(origins) ? origins : origins?.split(',') || [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\n  if (normalized.length === 0) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  if (normalized.includes('*')) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  return normalized;\n}\n\nexport function resolveAllowedCorsOrigin(requestOrigin: string | null, allowedOrigins: string[]): string | null {\n  if (!requestOrigin) {\n    return allowedOrigins[0] ?? null;\n  }\n\n  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;\n}\n\nexport function canAccessGraphExport(actor: IActor | null): boolean {\n  if (!actor) {\n    return false;\n  }\n\n  return actor.isAdmin === true || ['service', 'super_admin'].includes(actor.type);\n}\n","/**\n * Workspace quota gauge refresh throttling for the `/metrics` route.\n *\n * `WorkspaceQuotaRegistry.collectAll()` issues Prisma groupBy queries. Running\n * it inline on every Prometheus scrape made `/metrics` exactly as slow as the\n * database: services that registered quota collectors routinely exceeded a 30s\n * `scrape_timeout` and were recorded as down, even though the endpoint itself\n * was healthy.\n *\n * Scrapes are far more frequent than these values meaningfully change, so\n * refresh on a TTL, bound each refresh, and let concurrent scrapes share one\n * in-flight attempt. A slow or unavailable database then degrades gauge\n * freshness instead of failing the scrape.\n *\n * @module server/quotaGaugeRefresh\n */\n\n/**\n * Read a positive-integer millisecond setting from the environment.\n *\n * Anything unset, non-numeric, or <= 0 falls back to the default: an operator\n * typo must not silently disable the throttle that keeps `/metrics` fast.\n */\nexport function envMs(name: string, fallback: number): number {\n  const raw = process.env[name];\n  if (!raw) return fallback;\n  const parsed = Number.parseInt(raw, 10);\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\n/**\n * How long a gauge snapshot is considered fresh.\n *\n * Override with `BOFF_QUOTA_GAUGE_TTL_MS` — raise it when the database is under\n * load and quota freshness matters less than scrape latency.\n */\nexport const QUOTA_GAUGE_TTL_MS = envMs('BOFF_QUOTA_GAUGE_TTL_MS', 60_000);\n\n/**\n * Upper bound on a single refresh, so a slow database cannot stall a scrape.\n *\n * Override with `BOFF_QUOTA_GAUGE_TIMEOUT_MS`. Keep it comfortably below the\n * Prometheus `scrape_timeout`, or a slow refresh still fails the scrape.\n */\nexport const QUOTA_GAUGE_REFRESH_TIMEOUT_MS = envMs('BOFF_QUOTA_GAUGE_TIMEOUT_MS', 5_000);\n\nexport interface QuotaGaugeRefresherOptions {\n  /** Performs the actual (expensive) collection. */\n  collect: () => Promise<unknown>;\n  ttlMs?: number;\n  timeoutMs?: number;\n  /** Injectable clock, for tests. */\n  now?: () => number;\n}\n\nexport interface QuotaGaugeRefresher {\n  /** Refresh if stale. Never rejects. */\n  refresh: () => Promise<void>;\n  /** Epoch ms of the last completed attempt (0 when never run). */\n  lastRefreshedAt: () => number;\n}\n\n/**\n * Build a TTL-throttled, timeout-bounded, single-flight refresher.\n *\n * `refresh()` never rejects — `/metrics` must keep serving prom-client and SDK\n * registry output even when the quota registry is unconfigured or erroring.\n * A failed attempt does not advance the TTL, so the next scrape retries.\n */\nexport function createQuotaGaugeRefresher(opts: QuotaGaugeRefresherOptions): QuotaGaugeRefresher {\n  const ttlMs = opts.ttlMs ?? QUOTA_GAUGE_TTL_MS;\n  const timeoutMs = opts.timeoutMs ?? QUOTA_GAUGE_REFRESH_TIMEOUT_MS;\n  const now = opts.now ?? ((): number => Date.now());\n\n  let refreshedAt = 0;\n  let inFlight: Promise<void> | null = null;\n\n  const refresh = async (): Promise<void> => {\n    if (refreshedAt !== 0 && now() - refreshedAt < ttlMs) return;\n\n    if (!inFlight) {\n      inFlight = (async (): Promise<void> => {\n        let timer: ReturnType<typeof setTimeout> | undefined;\n        try {\n          await Promise.race([\n            Promise.resolve(opts.collect()).then(() => undefined),\n            new Promise<void>((resolve) => {\n              timer = setTimeout(resolve, timeoutMs);\n            }),\n          ]);\n          // Stamp only on a completed attempt; a throw leaves the TTL expired\n          // so the next scrape retries rather than serving a stale snapshot\n          // forever.\n          refreshedAt = now();\n        } catch {\n          /* unconfigured registry or failed query — keep the previous snapshot */\n        } finally {\n          if (timer !== undefined) clearTimeout(timer);\n          inFlight = null;\n        }\n      })();\n    }\n\n    await inFlight;\n  };\n\n  return { refresh, lastRefreshedAt: (): number => refreshedAt };\n}\n","/**\n * Dependency-aware readiness for `createServer`.\n *\n * WHY THIS EXISTS\n * `createServer` used to answer `/health`, `/health/live`, `/health/ready` and\n * `/health/startup` with a hardcoded `{ status: 'healthy' }`. Nothing was ever\n * checked. Combined with gitops pointing BOTH Kubernetes probes at `/health`,\n * that meant a pod whose database or cache had gone away stayed in the Service\n * endpoints and kept answering requests with errors, and a rolling deploy could\n * report success while every replica was broken.\n *\n * gitops now splits the probes — liveness on `/health/live`, readiness on\n * `/health/ready` — and this module is what makes readiness mean something.\n *\n * THE REQUIRED / OPTIONAL SPLIT IS THE WHOLE DESIGN\n * Postgres is REQUIRED: a subgraph that cannot reach its database can serve\n * nothing, so it should leave rotation and let its siblings take the traffic.\n * Valkey and the event queue are OPTIONAL by default: they are a cache and an\n * async publisher, the service degrades rather than fails without them, and\n * making them required would take the entire fleet out of rotation\n * simultaneously the moment one shared ElastiCache cluster blinked — turning a\n * cache incident into a total outage. A service that genuinely cannot function\n * without one can promote it via `requiredDependencies`.\n *\n * Liveness deliberately checks NOTHING. If liveness were deep, a shared\n * dependency blip would restart every pod in the fleet at once, which is\n * strictly worse than serving degraded.\n */\n\n/** Minimal Prisma surface used for the readiness query — keeps this testable. */\nexport interface ReadinessPrisma {\n  $queryRaw: (strings: TemplateStringsArray, ...values: unknown[]) => Promise<unknown>;\n}\n\n/** Minimal Valkey/Redis surface. */\nexport interface ReadinessCache {\n  ping: () => Promise<unknown>;\n}\n\n/** Minimal event-queue surface (be-sdk `IEventPublisher` implementations). */\nexport interface ReadinessEventQueue {\n  isConnected?: () => boolean | Promise<boolean>;\n  healthCheck?: () => Promise<{ ok: boolean }>;\n}\n\nexport type DependencyName = 'postgres' | 'valkey' | 'eventQueue';\n\nexport interface ReadinessDeps {\n  prisma?: () => ReadinessPrisma | undefined;\n  valkey?: () => Promise<ReadinessCache | undefined> | ReadinessCache | undefined;\n  eventQueue?: () => ReadinessEventQueue | undefined;\n  /**\n   * Dependencies whose failure makes the pod NOT ready. Defaults to\n   * `['postgres']`. Anything checked but not listed here is reported and\n   * degrades `status`, but still answers 200 so the pod stays in rotation.\n   */\n  requiredDependencies?: DependencyName[];\n}\n\nexport interface DependencyResult {\n  ok: boolean;\n  required: boolean;\n  error?: string;\n  /** Milliseconds the check took — surfaces a slow dependency before it fails. */\n  latencyMs: number;\n}\n\nexport interface ReadinessSnapshot {\n  /** True when every REQUIRED dependency is healthy. Drives the HTTP status. */\n  ready: boolean;\n  /** True when every checked dependency is healthy, required or not. */\n  healthy: boolean;\n  checks: Partial<Record<DependencyName, DependencyResult>>;\n}\n\n/**\n * Result cache TTL. Kubernetes probes every 10s across N replicas, Gatus every\n * 300s, plus any load balancer — without this each of them becomes a `SELECT 1`\n * on a connection from the same bounded pool the application needs.\n */\nexport const READINESS_CACHE_MS = 1000;\n\n/** Hard ceiling on a single dependency check, so readiness cannot hang. */\nexport const READINESS_PROBE_TIMEOUT_MS = 2000;\n\nconst DEFAULT_REQUIRED: DependencyName[] = ['postgres'];\n\nasync function withTimeout<T>(work: Promise<T>, ms: number, label: string): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      work,\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => reject(new Error(`${label} check timed out after ${ms}ms`)), ms);\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nasync function runCheck(\n  name: DependencyName,\n  required: boolean,\n  work: () => Promise<unknown>,\n  now: () => number\n): Promise<DependencyResult> {\n  const started = now();\n  try {\n    await withTimeout(Promise.resolve(work()), READINESS_PROBE_TIMEOUT_MS, name);\n    return { ok: true, required, latencyMs: now() - started };\n  } catch (err) {\n    return {\n      ok: false,\n      required,\n      error: err instanceof Error ? err.message : String(err),\n      latencyMs: now() - started,\n    };\n  }\n}\n\n/**\n * Build a cached readiness prober. Each call site gets its own cache so tests\n * never share state with a running server.\n */\nexport function createReadinessProbe(\n  deps: ReadinessDeps,\n  now: () => number = Date.now\n): () => Promise<ReadinessSnapshot> {\n  const required = new Set<DependencyName>(deps.requiredDependencies ?? DEFAULT_REQUIRED);\n  let cache: { snapshot: ReadinessSnapshot; at: number } | null = null;\n  let inFlight: Promise<ReadinessSnapshot> | null = null;\n\n  async function probe(): Promise<ReadinessSnapshot> {\n    const checks: Partial<Record<DependencyName, DependencyResult>> = {};\n\n    const jobs: Array<Promise<void>> = [];\n\n    if (deps.prisma) {\n      jobs.push(\n        runCheck(\n          'postgres',\n          required.has('postgres'),\n          async () => {\n            const client = deps.prisma?.();\n            if (!client) throw new Error('prisma client not initialised');\n            await client.$queryRaw`SELECT 1`;\n          },\n          now\n        ).then((r) => {\n          checks.postgres = r;\n        })\n      );\n    }\n\n    if (deps.valkey) {\n      jobs.push(\n        runCheck(\n          'valkey',\n          required.has('valkey'),\n          async () => {\n            const client = await deps.valkey?.();\n            if (!client) throw new Error('valkey client not initialised');\n            await client.ping();\n          },\n          now\n        ).then((r) => {\n          checks.valkey = r;\n        })\n      );\n    }\n\n    if (deps.eventQueue) {\n      jobs.push(\n        runCheck(\n          'eventQueue',\n          required.has('eventQueue'),\n          async () => {\n            const q = deps.eventQueue?.();\n            if (!q) throw new Error('event queue not initialised');\n            if (typeof q.isConnected === 'function') {\n              const connected = await Promise.resolve(q.isConnected());\n              if (!connected) throw new Error('event queue reports disconnected');\n              return;\n            }\n            if (typeof q.healthCheck === 'function') {\n              const res = await q.healthCheck();\n              if (!res.ok) throw new Error('event queue health check failed');\n            }\n            // A queue exposing neither hook is treated as healthy rather than\n            // failed — inventing a failure would take pods out of rotation for\n            // a dependency we cannot actually interrogate.\n          },\n          now\n        ).then((r) => {\n          checks.eventQueue = r;\n        })\n      );\n    }\n\n    await Promise.all(jobs);\n\n    const results = Object.values(checks);\n    return {\n      ready: results.every((c) => c.ok || !c.required),\n      healthy: results.every((c) => c.ok),\n      checks,\n    };\n  }\n\n  return async function getReadiness(): Promise<ReadinessSnapshot> {\n    const at = now();\n    if (cache && at - cache.at < READINESS_CACHE_MS) return cache.snapshot;\n    // Collapse concurrent probes (three probes can land in the same tick).\n    if (inFlight) return inFlight;\n    inFlight = probe()\n      .then((snapshot) => {\n        cache = { snapshot, at: now() };\n        return snapshot;\n      })\n      .finally(() => {\n        inFlight = null;\n      });\n    return inFlight;\n  };\n}\n\nexport interface HealthBody {\n  status: 'healthy' | 'degraded' | 'unavailable';\n  service: string;\n  version: string;\n  timestamp: string;\n  checks?: Partial<Record<DependencyName, DependencyResult>>;\n  uptimeSeconds?: number;\n}\n\n/** HTTP status for the readiness and aggregate endpoints. */\nexport function readinessStatusCode(snapshot: ReadinessSnapshot): 200 | 503 {\n  return snapshot.ready ? 200 : 503;\n}\n\nexport function readinessBody(\n  snapshot: ReadinessSnapshot,\n  service: string,\n  version: string,\n  timestamp: string,\n  uptimeSeconds?: number\n): HealthBody {\n  const status: HealthBody['status'] = !snapshot.ready ? 'unavailable' : snapshot.healthy ? 'healthy' : 'degraded';\n  return {\n    status,\n    service,\n    version,\n    timestamp,\n    checks: snapshot.checks,\n    ...(uptimeSeconds === undefined ? {} : { uptimeSeconds }),\n  };\n}\n\n/** Liveness body — deliberately free of any dependency information. */\nexport function livenessBody(service: string, version: string, timestamp: string): HealthBody {\n  return { status: 'healthy', service, version, timestamp };\n}\n","/**\n * Server Module\n *\n * Main server bootstrapping with Elysia, GraphQL Yoga, and middleware.\n * Uses Bun runtime for high-performance GraphQL services.\n *\n * Provides a simple API for microservices to start a fully configured server.\n */\n\nimport { logger } from '../logger/index.js';\nimport { configureAuth, configureDefaultAuth, type FetchWorkspaceSecretFn } from './auth.js';\nimport { configureContext, buildContext } from './context.js';\nimport type {\n  ServerDefinition,\n  ServerInstance,\n  ServerInfo,\n  ElysiaApp,\n  BunServerHandle,\n  YogaPlugin,\n  GraphQLContext,\n} from './types.js';\nimport { I18n } from '../i18n/index.js';\nimport { canAccessGraphExport, normalizeCorsOrigins, resolveAllowedCorsOrigin } from './security.js';\nimport { getMetricsRegistry } from '../instrumentation/metrics-collector.js';\nimport { getWorkspaceQuotaRegistry } from '../metrics/index.js';\nimport { createQuotaGaugeRefresher } from './quotaGaugeRefresh.js';\nimport {\n  createReadinessProbe,\n  livenessBody,\n  readinessBody,\n  readinessStatusCode,\n  type ReadinessDeps,\n} from './readiness.js';\nimport {\n  createHttpErrorResponse,\n  createHumanReadableErrorPlugin,\n  formatHttpError,\n  normalizeGraphQLResponse,\n} from './errors.js';\n\n// Store startup time for uptime calculation\nlet serverStartTime: Date | null = null;\n\n// Workspace quota gauges cost Prisma groupBy queries, so /metrics refreshes\n// them on a TTL rather than on every scrape. See ./quotaGaugeRefresh.ts.\nconst quotaGaugeRefresher = createQuotaGaugeRefresher({\n  collect: () => getWorkspaceQuotaRegistry().collectAll(),\n});\n\n/**\n * Create and configure a server instance using Elysia + GraphQL Yoga\n */\nexport async function createServer(definition: ServerDefinition): Promise<ServerInstance> {\n  const {\n    config,\n    prismaClient,\n    schema,\n    moduleGraph,\n    restEndpoints,\n    yogaPlugins,\n    buildContext: customBuildContext,\n    workspaceExtensionConfig,\n    disableWorkspaceExtension,\n    onShutdown,\n  } = definition;\n\n  // Dynamic imports to avoid requiring these as hard dependencies\n  const { Elysia } = await import('elysia');\n  const { BunAdapter } = await import('elysia/adapter/bun');\n  const { cors } = await import('@elysiajs/cors');\n  const { createYoga } = await import('graphql-yoga');\n  const { initializeDatabase, getDb, getDatabaseManager } = await import('../prisma/index.js');\n  const { createSecurityPlugin } = await import('../middleware/index.js');\n  const { createMetricsPlugin } = await import('../observability/index.js');\n  const { createWorkspaceGuardPlugin } = await import('./workspace-guard.js');\n\n  logger.info(`[Server] Initializing ${config.serviceName}...`);\n\n  // Detect boundary from config or service name — needed before database and guard setup\n  const boundary =\n    config.boundary ??\n    (config.serviceName.startsWith('wspace-')\n      ? 'wspace'\n      : config.serviceName.startsWith('global-')\n        ? 'global'\n        : 'wspace'); // fail-closed: default to wspace (stricter)\n\n  // Initialize database\n  // Workspace extension is auto-disabled for global boundary services unless explicitly enabled\n  const shouldEnableWorkspaceExtension =\n    disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === 'wspace'; // auto-detect: enabled for wspace, disabled for global\n\n  logger.info('[Server] Initializing database...', {\n    boundary,\n    workspaceExtension: shouldEnableWorkspaceExtension,\n  });\n\n  const { connect } = initializeDatabase(prismaClient, config.serviceName, {\n    registerShutdownHandlers: false, // Server manages shutdown handlers itself\n    enableWorkspaceExtension: shouldEnableWorkspaceExtension,\n    ...(workspaceExtensionConfig ? { workspaceExtensionConfig } : {}),\n  });\n  await connect();\n\n  // Initialize i18n if configured\n  let i18nInstance: I18n | undefined;\n  if (config.i18n?.enabled && config.i18n.localesPath) {\n    logger.info('[Server] Initializing i18n...');\n    i18nInstance = new I18n({\n      defaultLocale: config.i18n.defaultLocale || 'en-US',\n      fallbackLocale: config.i18n.fallbackLocale || 'en-US',\n      localesPath: config.i18n.localesPath,\n      supportedLocales: config.i18n.supportedLocales,\n      namespace: config.i18n.namespace || config.serviceName,\n      lazyLoad: config.i18n.lazyLoad,\n      logMissing: config.i18n.logMissing ?? true,\n      enableCache: true,\n      returnKeyOnMissing: true,\n    });\n    await i18nInstance.initialize();\n    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(', ')}`);\n  }\n\n  // Configure context builder\n  configureContext({\n    getDb: () => getDb(),\n    i18n: i18nInstance,\n  });\n\n  // Auto-configure auth with default workspace secret fetcher if not already configured\n  configureDefaultAuth();\n\n  // Initialize module graph if provided\n  if (moduleGraph) {\n    logger.info('[Server] Initializing module graph...');\n    await moduleGraph.initialize();\n  }\n\n  // Determine if playground/introspection should be enabled\n  const isDev = config.environment !== 'production';\n  const enablePlayground = config.enablePlayground ?? isDev;\n\n  // Enable GraphQL-over-HTTP batching by default so subgraphs accept the batched\n  // array POSTs the federation gateway forwards from Apollo Client BatchHttpLink.\n  // The default limit (10) matches the workspace gateway's batching limit.\n  const batching = config.batching ?? true;\n\n  // Build workspace guard plugin — auto-enabled for wspace boundary only\n  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === 'wspace';\n  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? 'enabled' : 'disabled'}`);\n\n  const workspaceGuardPlugins = workspaceGuardEnabled\n    ? [\n        createWorkspaceGuardPlugin({\n          enabled: true,\n          whitelistedOperations: config.workspaceGuard?.whitelistedOperations,\n        }),\n      ]\n    : [];\n\n  // Create GraphQL Yoga instance\n  const graphqlEndpoint = config.graphqlEndpoint || '/graphql';\n  logger.info('[Server] Setting up GraphQL Yoga with provided schema...', {\n    batching,\n  });\n\n  const responseHeadersPlugin: YogaPlugin = {\n    onResponse: ({ response, serverContext }: { response: Response; serverContext: unknown }) => {\n      const yogaContext = serverContext as GraphQLContext;\n      if (yogaContext?.responseHeaders) {\n        yogaContext.responseHeaders.forEach((value: string, key: string) => {\n          response.headers.append(key, value);\n        });\n      }\n    },\n  };\n\n  const yoga = createYoga<{ request: Request }>({\n    graphqlEndpoint,\n    schema, // Use the schema provided by microservice\n    graphiql: enablePlayground,\n    batching,\n    logging: {\n      debug: (...args) => logger.debug('[GraphQL]', ...args),\n      info: (...args) => logger.info('[GraphQL]', ...args),\n      warn: (...args) => logger.warn('[GraphQL]', ...args),\n      error: (...args) => logger.error('[GraphQL]', ...args),\n    },\n    plugins: [\n      createHumanReadableErrorPlugin({ serviceName: config.serviceName, environment: config.environment }),\n      ...workspaceGuardPlugins,\n      responseHeadersPlugin,\n      ...(yogaPlugins || []),\n    ],\n    context: async ({ request }) => {\n      // Build default context\n      const defaultContext = await buildContext(request);\n\n      // Apply custom context builder if provided\n      if (customBuildContext) {\n        return customBuildContext(defaultContext);\n      }\n\n      return defaultContext;\n    },\n  });\n\n  // Create Elysia instance with Bun adapter\n  const app = new Elysia({ adapter: BunAdapter });\n\n  // Register CORS middleware\n  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);\n\n  app.use(\n    cors({\n      origin: corsOrigins,\n      credentials: corsOrigins.length > 0,\n      allowedHeaders: [\n        'Content-Type',\n        'Authorization',\n        'X-Tenant-ID',\n        'X-Workspace-ID',\n        'X-Org-ID',\n        'X-Project-ID',\n        'X-Product-ID',\n        'X-CSRF-Token',\n        'X-Service-Name',\n        'Accept-Language',\n        'X-Locale',\n        'X-Language',\n        'X-Geo-Country',\n        'X-Geo-Currency',\n        'X-Geo-Timezone',\n        // Actor headers (gateway-injected or dev mode)\n        'X-Actor-ID',\n        'X-Actor-Type',\n        'X-Internal-Service-Token',\n        'X-Gateway-Auth-Token',\n      ],\n      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n    })\n  );\n\n  // Collect raw body endpoints for early interception\n  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);\n  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [ep.path, ep]));\n  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {\n    const regexPattern = endpoint.path.replace(/:[^/]+/g, '[^/]+');\n    return {\n      endpoint,\n      regexPattern,\n      regex: new RegExp(`^${regexPattern}$`),\n    };\n  });\n\n  // Helper to match pathname against endpoint patterns (including :param placeholders)\n  const matchRawBodyEndpoint = (pathname: string): (typeof rawBodyEndpoints)[0] | undefined => {\n    // First try exact match (for non-parameterized paths)\n    const exactMatch = rawBodyPaths.get(pathname);\n    if (exactMatch) return exactMatch;\n\n    // Try pattern matching for parameterized paths like /webhooks/slack/:channelId\n    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {\n      const isMatch = regex.test(pathname);\n      logger.debug(\n        `[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`\n      );\n      if (isMatch) {\n        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);\n        return endpoint;\n      }\n    }\n\n    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);\n    return undefined;\n  };\n\n  // Handle GraphQL, metrics, and raw body requests BEFORE any middleware that consumes the body\n  // This is critical because Yoga needs the raw request body stream\n  // and webhook endpoints need raw body for signature verification\n  // onRequest runs before onParse (body parsing) and onBeforeHandle\n  app.onRequest(async ({ request }) => {\n    const url = new URL(request.url);\n    const pathname = url.pathname;\n    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);\n    const isHealthRoute = pathname === '/health' || pathname.startsWith('/health/');\n\n    // Build CORS headers helper\n    const buildCorsHeaders = (): Record<string, string> => {\n      const origin = request.headers.get('origin') || '*';\n      const allowedOrigin = resolveAllowedCorsOrigin(origin === '*' ? null : origin, corsOrigins);\n      const headers: Record<string, string> = {\n        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n        'Access-Control-Allow-Headers':\n          'Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token',\n      };\n\n      if (allowedOrigin) {\n        headers['Access-Control-Allow-Origin'] = allowedOrigin;\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n\n      return headers;\n    };\n\n    // Check if this is a raw body endpoint (webhooks) - now supports parameterized paths\n    const rawBodyEndpoint = isHealthRoute ? undefined : matchRawBodyEndpoint(pathname);\n    if (rawBodyEndpoint) {\n      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight for raw body endpoints\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Only process if method matches\n      if (request.method !== rawBodyEndpoint.method) {\n        return undefined; // Let other handlers deal with it\n      }\n\n      try {\n        // Read raw body BEFORE any parsing\n        const rawBody = await request.text();\n\n        // Build context without consuming body (body already read)\n        const context = await buildContext(request);\n\n        // Call the handler with raw body\n        const result = await rawBodyEndpoint.handler(request, context, rawBody);\n\n        // If handler returns a Response, use it directly\n        if (result instanceof Response) {\n          // Add CORS headers\n          const headers = new Headers(result.headers);\n          for (const [key, value] of Object.entries(corsHeaders)) {\n            headers.set(key, value);\n          }\n          return new Response(result.body, {\n            status: result.status,\n            statusText: result.statusText,\n            headers,\n          });\n        }\n\n        // Otherwise, serialize as JSON\n        const headers = new Headers({\n          'Content-Type': 'application/json',\n          ...corsHeaders,\n        });\n\n        return new Response(JSON.stringify(result), {\n          status: 200,\n          headers,\n        });\n      } catch (error) {\n        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);\n        const corsHeaders = buildCorsHeaders();\n        const formatted = formatHttpError(error, {\n          serviceName: config.serviceName,\n          environment: config.environment,\n        });\n        return new Response(JSON.stringify(formatted.body), {\n          status: formatted.status,\n          headers: {\n            'Content-Type': 'application/json',\n            ...corsHeaders,\n          },\n        });\n      }\n    }\n\n    // Serve Prometheus metrics via prom-client at /metrics.\n    // The graphql-yoga prometheus plugin populates the same default registry,\n    // so GraphQL-level metrics (operation durations, error counts, etc.) are\n    // included automatically without needing Yoga to handle this route.\n    //\n    // Also includes SDK MetricsRegistry metrics (business counters/histograms\n    // created via @burdenoff/be-sdk/instrumentation factories) so that custom\n    // service metrics are available without a separate /api/metrics endpoint.\n    if (pathname === '/metrics' && request.method === 'GET') {\n      try {\n        const promClientMod = 'prom-client';\n        const prom = (await import(promClientMod)) as unknown as {\n          register: { metrics: () => Promise<string> | string; contentType?: string };\n          collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n        };\n        try {\n          prom.collectDefaultMetrics({ register: prom.register });\n        } catch {\n          /* already called */\n        }\n        const promBody = await prom.register.metrics();\n\n        // Append SDK MetricsRegistry metrics (business counters, histograms,\n        // gauges) that are created via @burdenoff/be-sdk/instrumentation\n        // factories. The toPrometheusFormat() method is deliberately not cached\n        // — each scrape gets a fresh snapshot including dynamic label values.\n        //\n        // Workspace quota gauges are different: collectAll() issues Prisma\n        // groupBy queries, so running it inline on every scrape made /metrics\n        // as slow as the database. Services registering quota collectors\n        // routinely blew a 30s Prometheus scrape_timeout and reported as down.\n        // Refresh on a TTL and bound each refresh, so a slow or unavailable\n        // database degrades gauge freshness instead of failing the scrape.\n        let sdkBody = '';\n        await quotaGaugeRefresher.refresh();\n        try {\n          sdkBody = getMetricsRegistry().toPrometheusFormat();\n        } catch {\n          /* MetricsRegistry not initialised; serve prom-client output alone */\n        }\n\n        const combined = sdkBody ? `${promBody}\\n${sdkBody}` : promBody;\n        return new Response(combined, {\n          status: 200,\n          headers: {\n            'Content-Type': prom.register.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n          },\n        });\n      } catch {\n        // fall through — prom-client not installed; let Yoga handle as fallback\n      }\n    }\n\n    // Routes that should be handled by Yoga (GraphQL endpoint only)\n    const yogaRoutes = [graphqlEndpoint, `${graphqlEndpoint}/`, '/metrics'];\n    const shouldHandleByYoga = yogaRoutes.includes(pathname);\n\n    if (shouldHandleByYoga) {\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Get response from Yoga\n      const yogaResponse = await normalizeGraphQLResponse(await yoga.fetch(request), {\n        serviceName: config.serviceName,\n        environment: config.environment,\n      });\n\n      // Add CORS headers to Yoga response\n      const headers = new Headers(yogaResponse.headers);\n      for (const [key, value] of Object.entries(corsHeaders)) {\n        headers.set(key, value);\n      }\n\n      // Return response with CORS headers\n      return new Response(yogaResponse.body, {\n        status: yogaResponse.status,\n        statusText: yogaResponse.statusText,\n        headers,\n      });\n    }\n    // Return undefined to continue to next handlers for non-GraphQL requests\n    return undefined;\n  });\n\n  // Register metrics middleware (after GraphQL interception)\n  app.use(createMetricsPlugin());\n\n  // Register security middleware (after GraphQL interception)\n  app.use(\n    createSecurityPlugin({\n      csrfSkipRoutes: config.csrfSkipRoutes || ['/graphql', '/health', '/api/graph/'],\n      loginEndpoints: config.loginEndpoints || [],\n      enableCSRF: config.enableCSRF ?? false, // Disabled by default for GraphQL services\n      enableSessionSecurity: config.enableSessionSecurity ?? false,\n    })\n  );\n\n  // Health check endpoints. Rationale for the required/optional split and for\n  // keeping liveness shallow lives in ./readiness.ts — read it before changing\n  // which dependency is required.\n  //\n  //   /health         aggregate: 200 healthy / 200 degraded / 503 unavailable\n  //   /health/live    Kubernetes liveness  — process only, never a dependency\n  //   /health/ready   Kubernetes readiness — 503 when a REQUIRED dep is down\n  //   /health/startup Kubernetes startup   — process only, same as liveness\n  const serviceVersion = config.serviceVersion || '1.0.0';\n  const getReadiness = createReadinessProbe({\n    prisma: () => getDb(),\n    valkey: async () => {\n      // Optional: services that never configured Valkey must not be marked\n      // degraded for not having one, so an unconfigured client is not an error.\n      try {\n        const { getValkeyClient } = await import('../cache/index.js');\n        return await getValkeyClient();\n      } catch {\n        return undefined;\n      }\n    },\n    ...(config.health?.requiredDependencies ? { requiredDependencies: config.health.requiredDependencies } : {}),\n  } satisfies ReadinessDeps);\n\n  const shallow = (): unknown => livenessBody(config.serviceName, serviceVersion, new Date().toISOString());\n\n  const deep = async (ctx: unknown): Promise<unknown> => {\n    const snapshot = await getReadiness();\n    const ctxWithSet = ctx as { set?: { status?: number } };\n    const code = readinessStatusCode(snapshot);\n    if (ctxWithSet.set) ctxWithSet.set.status = code;\n    return readinessBody(\n      snapshot,\n      config.serviceName,\n      serviceVersion,\n      new Date().toISOString(),\n      Math.round(process.uptime())\n    );\n  };\n\n  app.get('/health', deep);\n  app.get('/health/live', shallow);\n  app.get('/health/ready', deep);\n  app.get('/health/startup', shallow);\n\n  // Graph API endpoints (if moduleGraph provided)\n  if (moduleGraph) {\n    // Get graph configuration schema\n    app.get('/api/graph/schema', async ({ request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      return moduleGraph.getSchema();\n    });\n\n    // Export all graph data\n    app.get('/api/graph/export', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportAll(organizationId, workspaceId);\n    });\n\n    // Export entities only\n    app.get('/api/graph/entities', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId, types } = query as {\n        organizationId?: string;\n        workspaceId?: string;\n        types?: string;\n      };\n      const entityTypes = types?.split(',').map((t) => t.trim());\n      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);\n    });\n\n    // Export relationships only\n    app.get('/api/graph/relationships', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportRelationships(organizationId, workspaceId);\n    });\n  }\n\n  // Register custom REST endpoints (skip rawBody endpoints - they're handled in onRequest)\n  if (restEndpoints && restEndpoints.length > 0) {\n    for (const endpoint of restEndpoints) {\n      // Skip rawBody endpoints - they're intercepted in onRequest before body parsing\n      if (endpoint.rawBody) {\n        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);\n        continue;\n      }\n\n      const handler = async ({ request }: { request: Request }): Promise<unknown> => {\n        try {\n          const context = await buildContext(request);\n          return await endpoint.handler(request, context);\n        } catch (error) {\n          logger.error(`[Server] REST endpoint error (${endpoint.path}):`, error);\n          return createHttpErrorResponse(error, {\n            serviceName: config.serviceName,\n            environment: config.environment,\n          });\n        }\n      };\n\n      switch (endpoint.method) {\n        case 'GET':\n          app.get(endpoint.path, handler);\n          break;\n        case 'POST':\n          app.post(endpoint.path, handler);\n          break;\n        case 'PUT':\n          app.put(endpoint.path, handler);\n          break;\n        case 'PATCH':\n          app.patch(endpoint.path, handler);\n          break;\n        case 'DELETE':\n          app.delete(endpoint.path, handler);\n          break;\n      }\n    }\n  }\n\n  const host = config.host || '0.0.0.0';\n  const port = config.port;\n\n  // Create server instance\n  const serverInstance: ServerInstance = {\n    app: app as unknown as ElysiaApp,\n    server: null,\n    start: async () => {\n      serverStartTime = new Date();\n\n      // Call listen() which starts the server and makes app.server available\n      app.listen({\n        port,\n        hostname: host,\n      });\n\n      // Access the Bun server instance from the app\n      // Cast through unknown to satisfy TypeScript since Elysia's types are complex\n      const elysiaApp = app as unknown as { server: BunServerHandle | null };\n      serverInstance.server = elysiaApp.server;\n\n      logger.info(`🚀 ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);\n    },\n    stop: async () => {\n      logger.info(`[Server] Stopping ${config.serviceName}...`);\n\n      if (onShutdown) {\n        await onShutdown();\n      }\n\n      if (moduleGraph) {\n        await moduleGraph.shutdown();\n      }\n\n      await getDatabaseManager().disconnect();\n\n      if (serverInstance.server) {\n        serverInstance.server.stop();\n      }\n\n      logger.info(`[Server] ${config.serviceName} stopped`);\n    },\n    getInfo: (): ServerInfo => {\n      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1000) : 0;\n\n      return {\n        serviceName: config.serviceName,\n        serviceVersion: config.serviceVersion || '1.0.0',\n        environment: config.environment || 'development',\n        port,\n        host,\n        graphqlEndpoint,\n        startedAt: serverStartTime?.toISOString() || '',\n        uptime,\n      };\n    },\n  };\n\n  // Setup graceful shutdown handlers\n  const gracefulShutdown = async (signal: string): Promise<never> => {\n    logger.info(`[Server] ${signal} received, shutting down gracefully...`);\n    await serverInstance.stop();\n    process.exit(0);\n  };\n\n  process.on('SIGTERM', () => {\n    void gracefulShutdown('SIGTERM');\n  });\n  process.on('SIGINT', () => {\n    void gracefulShutdown('SIGINT');\n  });\n\n  return serverInstance;\n}\n\n/**\n * Configure auth with workspace secret fetcher\n *\n * This should be called before creating the server if using workspace-scoped JWT\n */\nexport function configureServerAuth(fetchWorkspaceSecret: FetchWorkspaceSecretFn): void {\n  configureAuth({ fetchWorkspaceSecret });\n}\n"]}
+{"version":3,"sources":["../../src/server/auth.ts","../../src/server/verified-delegation.ts","../../src/server/context.ts","../../src/server/workspace-execution-context.ts","../../src/server/security.ts","../../src/server/quotaGaugeRefresh.ts","../../src/server/readiness.ts","../../src/server/server.ts"],"names":["getDbFn","getDb","prismaModule","joseModule","jwtModule","getJose","getJwt","jwt","default","authConfig","configureAuth","config","logger","debug","fetchWorkspaceSecret","workspaceId","db","workspace","client","findUnique","where","id","jwtSecret","JSON","parse","stringify","error","warn","configureDefaultAuth","generateSymmetricSecret","joseLib","secret","generateSecret","jwk","exportJWK","verifyJWT","token","options","decoded","decode","complete","payload","verifiedJwt","verify","mapPayloadToActor","decodedJwt","decodeJwt","workspace_id","workspaceSecret","keyLikeSecret","importJWK","jwtVerify","err","decodeJWT","sub","type","actor_type","tenant_id","org_id","isAdmin","authCheck","actor","Error","workspaceCheck","context","actorId","requireWorkspace","orgCheck","organization","orgId","tenantCheck","tenant","object","value","Array","isArray","identifier","from","every","character","charCodeAt","list","instant","time","Date","Number","isFinite","toISOString","decodeVerifiedDelegation","header","trustedGateway","now","provenance","includes","undefined","invalid","raw","tokenExpiresAt","getTime","length","consent","facts","grantedAt","expiresAt","grantedBy","representedUserId","originatingAppId","delegationId","scopes","allowedWorkspaceIds","contextOptions","configureContext","getHeader","request","key","headers","get","toLowerCase","compareSecret","provided","expected","providedBuffer","Buffer","expectedBuffer","crypto","timingSafeEqual","shouldTrustActorHeaders","nodeEnv","process","env","expectedGatewayToken","providedGatewayToken","extractTracking","forwardedFor","realIp","ip","split","trim","userAgent","actorProvenance","extractActor","actorType","userRole","authHeader","startsWith","substring","extractTenant","tenantId","tenantEndpoint","endpoint","defaultTenant","extractOrganization","extractWorkspace","extractProject","projectId","extractProduct","productId","extractGeography","country","currency","timezone","toUpperCase","extractConsentContext","scopesHeader","grantedAtHeader","expiresAtHeader","map","s","buildContext","project","product","tracking","consentContext","verifiedDelegation","i18n","createContextFromRequest","geo","locale","language","t","tp","formatNumber","String","formatCurrency","formatDate","date","formatRelativeTime","unit","onBehalfOf","wsCtxPayload","organizationId","rawHeader","setWorkspaceContext","ContextManager","setCfAccessContext","responseHeaders","Headers","getContextOptions","record","string","executionContext","scopedIterable","source","scope","Symbol","asyncIterator","iterator","finish","return","bind","fail","throw","next","args","withWorkspaceContext","createWorkspaceExecutionContextPlugin","onExecute","executeFn","setExecuteFn","contextValue","result","onSubscribe","subscribeFn","setSubscribeFn","LOCALHOST_ORIGINS","normalizeCorsOrigins","origins","environment","normalized","origin","filter","Boolean","resolveAllowedCorsOrigin","requestOrigin","allowedOrigins","canAccessGraphExport","envMs","name","fallback","parsed","parseInt","QUOTA_GAUGE_TTL_MS","QUOTA_GAUGE_REFRESH_TIMEOUT_MS","createQuotaGaugeRefresher","opts","ttlMs","timeoutMs","refreshedAt","inFlight","refresh","timer","Promise","race","resolve","collect","then","setTimeout","clearTimeout","lastRefreshedAt","READINESS_CACHE_MS","READINESS_PROBE_TIMEOUT_MS","DEFAULT_REQUIRED","withTimeout","work","ms","label","_","reject","runCheck","required","started","ok","latencyMs","message","createReadinessProbe","deps","Set","requiredDependencies","cache","probe","checks","jobs","prisma","push","has","$queryRaw","r","postgres","valkey","ping","eventQueue","q","isConnected","connected","healthCheck","res","all","results","Object","values","ready","c","healthy","getReadiness","at","snapshot","finally","readinessStatusCode","readinessBody","service","version","timestamp","uptimeSeconds","status","livenessBody","serverStartTime","quotaGaugeRefresher","getWorkspaceQuotaRegistry","collectAll","createServer","definition","prismaClient","schema","moduleGraph","restEndpoints","yogaPlugins","customBuildContext","workspaceExtensionConfig","disableWorkspaceExtension","onShutdown","Elysia","BunAdapter","cors","createYoga","initializeDatabase","getDatabaseManager","createSecurityPlugin","createMetricsPlugin","createWorkspaceGuardPlugin","info","serviceName","boundary","shouldEnableWorkspaceExtension","workspaceExtension","connect","registerShutdownHandlers","enableWorkspaceExtension","i18nInstance","enabled","localesPath","I18n","defaultLocale","fallbackLocale","supportedLocales","namespace","lazyLoad","logMissing","enableCache","returnKeyOnMissing","initialize","getSupportedLocales","join","isDev","enablePlayground","batching","workspaceGuardEnabled","workspaceGuard","workspaceGuardPlugins","whitelistedOperations","graphqlEndpoint","responseHeadersPlugin","onResponse","response","serverContext","yogaContext","forEach","append","yoga","graphiql","logging","plugins","createHumanReadableErrorPlugin","defaultContext","app","adapter","corsOrigins","use","credentials","allowedHeaders","methods","rawBodyEndpoints","ep","rawBody","rawBodyPaths","Map","path","rawBodyMatchers","regexPattern","replace","regex","RegExp","matchRawBodyEndpoint","pathname","exactMatch","isMatch","test","onRequest","url","URL","method","isHealthRoute","buildCorsHeaders","allowedOrigin","rawBodyEndpoint","corsHeaders","Response","text","handler","entries","set","body","statusText","formatted","formatHttpError","promClientMod","prom","collectDefaultMetrics","register","promBody","metrics","sdkBody","getMetricsRegistry","toPrometheusFormat","combined","contentType","yogaRoutes","shouldHandleByYoga","yogaResponse","normalizeGraphQLResponse","fetch","csrfSkipRoutes","loginEndpoints","enableCSRF","enableSessionSecurity","serviceVersion","getValkeyClient","health","shallow","deep","ctx","ctxWithSet","code","Math","round","uptime","getSchema","query","exportAll","types","entityTypes","exportEntities","exportRelationships","createHttpErrorResponse","post","put","patch","delete","host","port","serverInstance","server","start","listen","hostname","elysiaApp","stop","shutdown","disconnect","getInfo","floor","startedAt","gracefulShutdown","signal","exit","on","configureServerAuth"],"mappings":";;;;;;;;;;;;AA4BA,IAAIA,OAAAA,GAAmC,IAAA;AAEvC,eAAeC,KAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,IAAA,MAAME,YAAAA,GAAe,MAAM,OAAO,oBAAA,CAAA;AAElCF,IAAAA,OAAAA,GAAUE,YAAAA,CAAaD,KAAAA;AACzB,EAAA;AACA,EAAA,OAAOD,OAAAA,EAAAA;AACT;AAPeC,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAgBf,IAAIE,UAAAA,GAAiC,IAAA;AACrC,IAAIC,SAAAA,GAA8B,IAAA;AAElC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeE,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOf,eAAeC,MAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,SAAAA,EAAW;AACd,IAAA,MAAMG,GAAAA,GAAM,MAAM,OAAO,cAAA,CAAA;AAEzBH,IAAAA,SAAAA,GAAaG,IAAgCC,OAAAA,IAAWD,GAAAA;AAC1D,EAAA;AACA,EAAA,OAAOH,SAAAA;AACT;AAPeE,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAsBf,IAAIG,UAAAA,GAAgC,IAAA;AAK7B,SAASC,cAAcC,MAAAA,EAAkB;AAC9CF,EAAAA,UAAAA,GAAaE,MAAAA;AACbC,EAAAA,MAAAA,CAAOC,MAAM,8BAAA,CAAA;AACf;AAHgBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAchB,eAAsBI,qBAAqBC,WAAAA,EAAmB;AAC5D,EAAA,IAAI;AACF,IAAA,MAAMC,EAAAA,GAAK,MAAMf,KAAAA,EAAAA;AACjB,IAAA,MAAMgB,SAAAA,GAAY,MAAMD,EAAAA,CAAGE,MAAAA,CAAOD,UAAUE,UAAAA,CAAW;MACrDC,KAAAA,EAAO;QAAEC,EAAAA,EAAIN;AAAY;KAC3B,CAAA;AAEA,IAAA,IAAI,CAACE,WAAWK,SAAAA,EAAW;AACzBV,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;AAAEE,QAAAA;OAAY,CAAA;AAC7E,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOQ,KAAKC,KAAAA,CAAMD,IAAAA,CAAKE,SAAAA,CAAUR,SAAAA,CAAUK,SAAS,CAAA,CAAA;AACtD,EAAA,CAAA,CAAA,OAASI,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,KAAK,8CAAA,EAAgD;AAAEZ,MAAAA,WAAAA;AAAaW,MAAAA;KAAM,CAAA;AACjF,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAjBsBZ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwBf,SAASc,oBAAAA,GAAAA;AACd,EAAA,IAAI,CAACnB,UAAAA,EAAY;AACfC,IAAAA,aAAAA,CAAc;AAAEI,MAAAA;KAAqB,CAAA;AACrCF,IAAAA,MAAAA,CAAOC,MAAM,6EAAA,CAAA;AACf,EAAA;AACF;AALgBe,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWhB,eAAsBC,uBAAAA,GAAAA;AACpB,EAAA,MAAMC,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,EAAA,MAAM0B,MAAAA,GAAS,MAAMD,OAAAA,CAAQE,cAAAA,CAAe,OAAA,CAAA;AAC5C,EAAA,MAAMC,GAAAA,GAAM,MAAMH,OAAAA,CAAQI,SAAAA,CAAUH,MAAAA,CAAAA;AACpC,EAAA,OAAOE,GAAAA;AACT;AALsBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAetB,eAAsBM,SAAAA,CAAUC,KAAAA,EAAeL,MAAAA,EAAiBM,OAAAA,GAAyB,EAAC,EAAC;AACzF,EAAA,IAAI;AACF,IAAA,MAAM9B,GAAAA,GAAM,MAAMD,MAAAA,EAAAA;AAClB,IAAA,MAAMwB,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AAGtB,IAAA,MAAMiC,OAAAA,GAAU/B,GAAAA,CAAIgC,MAAAA,CAAOH,KAAAA,EAAO;MAAEI,QAAAA,EAAU;KAAK,CAAA;AAEnD,IAAA,IAAI,CAACF,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,IAAY,CAACA,OAAAA,CAAQG,OAAAA,IAAW,OAAOH,OAAAA,CAAQG,OAAAA,KAAY,QAAA,EAAU;AACtG7B,MAAAA,MAAAA,CAAOe,KAAK,mCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,IAAII,MAAAA,EAAQ;AAEV,MAAA,MAAMW,YAAAA,GAAcnC,GAAAA,CAAIoC,MAAAA,CAAOP,KAAAA,EAAOL,QAAQM,OAAAA,CAAAA;AAC9C,MAAA,OAAOO,kBAAkBF,YAAAA,CAAAA;AAC3B,IAAA;AAGA,IAAA,MAAMG,UAAAA,GAAaf,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;AACrC,IAAA,IAAI,CAACS,WAAWE,YAAAA,EAAc;AAC5BnC,MAAAA,MAAAA,CAAOe,KAAK,6CAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAAClB,YAAYK,oBAAAA,EAAsB;AACrCF,MAAAA,MAAAA,CAAOc,MAAM,+DAAA,CAAA;AACb,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,eAAAA,GAAkB,MAAMvC,UAAAA,CAAWK,oBAAAA,CAAqB+B,WAAWE,YAAY,CAAA;AACrF,IAAA,IAAI,CAACC,eAAAA,EAAiB;AACpBpC,MAAAA,MAAAA,CAAOe,KAAK,yCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,aAAAA,GAAgB,MAAMnB,OAAAA,CAAQoB,SAAAA,CAAUF,iBAAiB,OAAA,CAAA;AAC/D,IAAA,MAAMN,cAAc,MAAMZ,OAAAA,CAAQqB,SAAAA,CAAUf,KAAAA,EAAOa,eAAeZ,OAAAA,CAAAA;AAClE,IAAA,OAAOO,iBAAAA,CAAkBF,YAAYD,OAAO,CAAA;AAC9C,EAAA,CAAA,CAAA,OAASW,GAAAA,EAAK;AACZxC,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,qCAAqCyB,GAAAA,CAAAA;AACjD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA7CsBjB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkDtB,eAAsBkB,UAAUjB,KAAAA,EAAa;AAC3C,EAAA,IAAI;AACF,IAAA,MAAMN,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,IAAA,OAAOyB,OAAAA,CAAQgB,UAAUV,KAAAA,CAAAA;EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAPsBiB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAYtB,SAAST,kBAAkBH,OAAAA,EAAmB;AAC5C,EAAA,OAAO;AACLpB,IAAAA,EAAAA,EAAIoB,OAAAA,CAAQa,GAAAA;AACZC,IAAAA,IAAAA,EAAMd,QAAQe,UAAAA,IAAc,MAAA;AAC5BT,IAAAA,YAAAA,EAAcN,OAAAA,CAAQM,YAAAA;AACtBU,IAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBC,IAAAA,MAAAA,EAAQjB,OAAAA,CAAQiB,MAAAA;AAChBC,IAAAA,OAAAA,EAASlB,QAAQ,SAAA;AACnB,GAAA;AACF;AATSG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAcF,SAASgB,UAAUC,KAAAA,EAAoB;AAC5C,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,MAAM,IAAIC,MAAM,gBAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOD,KAAAA;AACT;AALgBD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAUT,SAASG,eAAeC,OAAAA,EAAmE;AAIhG,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfN,IAAAA,WAAAA,EAAaiD,QAAQ/C,SAAAA,CAAUI;AACjC,GAAA;AACF;AAdgB0C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,SAASG,iBACdF,OAAAA,EAAU;AAGVJ,EAAAA,SAAAA,CAAUI,QAAQH,KAAK,CAAA;AAEvB,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAGA,EAAA,OAAOE,OAAAA;AACT;AAZgBE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,SAASC,SAASH,OAAAA,EAAsE;AAI7F,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQI,YAAAA,EAAc/C,EAAAA,EAAI;AAC7B,IAAA,MAAM,IAAIyC,MAAM,kCAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfgD,IAAAA,KAAAA,EAAOL,QAAQI,YAAAA,CAAa/C;AAC9B,GAAA;AACF;AAdgB8C,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAmBT,SAASG,YAAYN,OAAAA,EAA0C;AACpE,EAAA,IAAI,CAACA,OAAAA,CAAQO,MAAAA,EAAQlD,EAAAA,EAAI;AACvB,IAAA,MAAM,IAAIyC,MAAM,4BAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOE,QAAQO,MAAAA,CAAOlD,EAAAA;AACxB;AALgBiD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;;;AC7ShB,SAASE,OAAOC,KAAAA,EAAc;AAC5B,EAAA,OAAOA,KAAAA,KAAU,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,IAAY,CAACC,KAAAA,CAAMC,OAAAA,CAAQF,KAAAA,CAAAA,GAChEA,KAAAA,GACD,IAAA;AACN;AAJSD,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAMT,SAASI,WAAWH,KAAAA,EAAc;AAChC,EAAA,OACE,OAAOA,KAAAA,KAAU,QAAA,IACjBA,KAAAA,CAAM,QAAA,CAAA,GAAY,CAAA,IAClBA,KAAAA,CAAM,QAAA,CAAA,IAAa,GAAA,IACnBA,KAAAA,CAAM,MAAA,GAAO,KAAOA,KAAAA,IACpBC,KAAAA,CAAMG,IAAAA,CAAKJ,KAAAA,CAAAA,CAAOK,KAAAA,CAAM,CAACC,cAAcA,SAAAA,CAAUC,UAAAA,CAAW,CAAA,CAAA,IAAM,EAAA,IAAMD,SAAAA,CAAUC,UAAAA,CAAW,CAAA,MAAO,GAAA,CAAA;AAExG;AARSJ,MAAAA,CAAAA,UAAAA,EAAAA,YAAAA,CAAAA;AAUT,SAASK,KAAKR,KAAAA,EAAc;AAC1B,EAAA,OAAOC,KAAAA,CAAMC,OAAAA,CAAQF,KAAAA,CAAAA,IAAUA,KAAAA,CAAM,QAAA,CAAA,IAAa,GAAA,IAAQA,KAAAA,CAAM,OAAA,CAAA,CAASG,UAAAA,CAAAA;AAC3E;AAFSK,MAAAA,CAAAA,IAAAA,EAAAA,MAAAA,CAAAA;AAIT,SAASC,QAAQT,KAAAA,EAAc;AAC7B,EAAA,IAAI,OAAOA,KAAAA,KAAU,QAAA,EAAU,OAAO,IAAA;AACtC,EAAA,MAAMU,IAAAA,GAAOC,IAAAA,CAAK5D,KAAAA,CAAMiD,KAAAA,CAAAA;AACxB,EAAA,OAAOY,MAAAA,CAAOC,QAAAA,CAASH,IAAAA,CAAAA,IAAS,IAAIC,IAAAA,CAAKD,IAAAA,CAAAA,CAAMI,WAAAA,EAAW,KAAOd,KAAAA,GAAQ,IAAIW,IAAAA,CAAKD,IAAAA,CAAAA,GAAQ,IAAA;AAC5F;AAJSD,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOF,SAASM,wBAAAA,CACdC,QACA5B,KAAAA,EACA9C,WAAAA,EACA2E,gBACAC,GAAAA,GAAMP,IAAAA,CAAKO,KAAG,EAAE;AAEhB,EAAA,IACE,CAACD,cAAAA,IACD,CAAC7B,SACDA,KAAAA,CAAM+B,UAAAA,KAAe,eACrB,CAAC;AAAC,IAAA,MAAA;AAAQ,IAAA;AAAeC,GAAAA,CAAAA,QAAAA,CAAShC,KAAAA,CAAMN,IAAI,CAAA,IAC5CkC,MAAAA,KAAWK,QAEX,OAAOA,MAAAA;AACT,EAAA,MAAMC,OAAAA,mBAAU,MAAA,CAAA,MAAM,IAAIjC,KAAAA,CAAM,qCAAA,CAAA,EAAhB,SAAA,CAAA;AAChB,EAAA,IAAIkC,GAAAA;AACJ,EAAA,IAAI;AACFA,IAAAA,GAAAA,GAAMzE,IAAAA,CAAKC,MAAMiE,MAAAA,CAAAA;EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAMM,OAAAA,EAAAA;AACR,EAAA;AACA,EAAA,MAAMtB,KAAAA,GAAQD,OAAOwB,GAAAA,CAAAA;AACrB,EAAA,MAAMC,cAAAA,GAAiBf,OAAAA,CAAQT,KAAAA,GAAQ,gBAAA,CAAiB,CAAA;AACxD,EAAA,IACE,CAACA,KAAAA,IACD,CAACG,UAAAA,CAAWH,KAAAA,CAAM,mBAAA,CAAoB,CAAA,IACtCA,KAAAA,CAAM,mBAAA,CAAA,KAAyBZ,KAAAA,CAAMxC,EAAAA,IACrC,CAACuD,UAAAA,CAAWH,KAAAA,CAAM,kBAAA,CAAmB,CAAA,IACrC,CAACG,UAAAA,CAAWH,KAAAA,CAAM,cAAA,CAAe,CAAA,IACjC,CAACQ,IAAAA,CAAKR,KAAAA,CAAM,QAAA,CAAS,CAAA,IACrB,CAACQ,IAAAA,CAAKR,KAAAA,CAAM,qBAAA,CAAsB,CAAA,IAClC,CAACwB,cAAAA,IACDA,cAAAA,CAAeC,OAAAA,EAAO,IAAMP,GAAAA,IAC3B5E,WAAAA,IAAe0D,KAAAA,CAAM,qBAAA,CAAA,CAAuB0B,MAAAA,GAAS,CAAA,IAAK,CAAC1B,KAAAA,CAAM,qBAAA,CAAA,CAAuBoB,QAAAA,CAAS9E,WAAAA,CAAAA,EAElG,MAAMgF,OAAAA,EAAAA;AACR,EAAA,IAAIK,OAAAA,GAAgD,IAAA;AACpD,EAAA,IAAI3B,KAAAA,CAAM,SAAA,CAAA,KAAe,IAAA,EAAM;AAC7B,IAAA,MAAM4B,KAAAA,GAAQ7B,MAAAA,CAAOC,KAAAA,CAAM,SAAA,CAAU,CAAA;AACrC,IAAA,MAAM6B,SAAAA,GAAYpB,OAAAA,CAAQmB,KAAAA,GAAQ,WAAA,CAAY,CAAA;AAC9C,IAAA,MAAME,SAAAA,GAAYF,QAAQ,WAAA,CAAA,KAAiB,OAAO,IAAA,GAAOnB,OAAAA,CAAQmB,KAAAA,GAAQ,WAAA,CAAY,CAAA;AACrF,IAAA,IACE,CAACA,KAAAA,IACD,CAACzB,UAAAA,CAAWyB,MAAM,WAAA,CAAY,CAAA,IAC9B,CAACC,SAAAA,IACDA,SAAAA,CAAUJ,OAAAA,EAAO,GAAKP,OACrBU,KAAAA,CAAM,WAAA,CAAA,KAAiB,IAAA,KACrB,CAACE,SAAAA,IAAaA,SAAAA,CAAUL,OAAAA,MAAaI,SAAAA,CAAUJ,OAAAA,EAAO,IAAMD,cAAAA,CAAeC,SAAO,GAAKK,SAAAA,CAAUL,OAAAA,EAAO,CAAA,QAErGH,OAAAA,EAAAA;AACRK,IAAAA,OAAAA,GAAU;AAAEI,MAAAA,SAAAA,EAAWH,MAAM,WAAA,CAAA;AAAcC,MAAAA,SAAAA;AAAWC,MAAAA;AAAU,KAAA;AAClE,EAAA;AACA,EAAA,OAAO;AACLE,IAAAA,iBAAAA,EAAmBhC,MAAM,mBAAA,CAAA;AACzBiC,IAAAA,gBAAAA,EAAkBjC,MAAM,kBAAA,CAAA;AACxBkC,IAAAA,YAAAA,EAAclC,MAAM,cAAA,CAAA;IACpBmC,MAAAA,EAAQ;AAAInC,MAAAA,GAAAA,KAAAA,CAAM,QAAA;;IAClBoC,mBAAAA,EAAqB;AAAIpC,MAAAA,GAAAA,KAAAA,CAAM,qBAAA;;AAC/BwB,IAAAA,cAAAA;AACAG,IAAAA;AACF,GAAA;AACF;AA9DgBZ,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;;;ACchB,IAAIsB,cAAAA,GAA+C,IAAA;AAK5C,SAASC,iBAAiB1E,OAAAA,EAA8B;AAC7DyE,EAAAA,cAAAA,GAAiBzE,OAAAA;AACjBzB,EAAAA,MAAAA,CAAOC,MAAM,4CAAA,CAAA;AACf;AAHgBkG,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAQhB,SAASC,SAAAA,CAAUC,SAAkBC,GAAAA,EAAW;AAC9C,EAAA,OAAOD,QAAQE,OAAAA,CAAQC,GAAAA,CAAIF,GAAAA,CAAIG,WAAAA,EAAW,CAAA,IAAOvB,MAAAA;AACnD;AAFSkB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAIT,SAASM,aAAAA,CAAcC,UAAkBC,QAAAA,EAAgB;AACvD,EAAA,MAAMC,cAAAA,GAAiBC,MAAAA,CAAO7C,IAAAA,CAAK0C,QAAAA,CAAAA;AACnC,EAAA,MAAMI,cAAAA,GAAiBD,MAAAA,CAAO7C,IAAAA,CAAK2C,QAAAA,CAAAA;AAEnC,EAAA,IAAIC,cAAAA,CAAetB,MAAAA,KAAWwB,cAAAA,CAAexB,MAAAA,EAAQ;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOyB,MAAAA,CAAOC,eAAAA,CAAgBJ,cAAAA,EAAgBE,cAAAA,CAAAA;AAChD;AATSL,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWF,SAASQ,uBAAAA,CACdb,OAAAA,EACAc,OAAAA,GAA8BC,OAAAA,CAAQC,IAAI,UAAA,CAAA,EAC1CC,oBAAAA,GAA2CF,OAAAA,CAAQC,IAAI,uBAAA,CAAA,IACrDD,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEvC,EAAA,IAAI,CAACjB,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA,EAAe;AACrC,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIc,YAAY,YAAA,EAAc;AAC5B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMI,uBACJnB,SAAAA,CAAUC,OAAAA,EAAS,0BAAA,CAAA,IAA+BD,SAAAA,CAAUC,SAAS,sBAAA,CAAA;AACvE,EAAA,IAAI,CAACiB,oBAAAA,IAAwB,CAACC,oBAAAA,EAAsB;AAClD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOb,aAAAA,CAAca,sBAAsBD,oBAAAA,CAAAA;AAC7C;AArBgBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA0BhB,SAASM,gBAAgBnB,OAAAA,EAAgB;AAEvC,EAAA,MAAMoB,YAAAA,GAAerB,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMqB,MAAAA,GAAStB,SAAAA,CAAUC,OAAAA,EAAS,WAAA,CAAA;AAClC,EAAA,MAAMsB,EAAAA,GAAKF,cAAcG,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,IAAAA,EAAAA,IAAUH,MAAAA,IAAUxC,MAAAA;AAE5D,EAAA,OAAO;AACLyC,IAAAA,EAAAA;IACAG,SAAAA,EAAW1B,SAAAA,CAAUC,SAAS,YAAA;AAChC,GAAA;AACF;AAVSmB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAwBT,SAASO,gBAAgB1B,OAAAA,EAAgB;AACvC,EAAA,MAAMxC,KAAAA,GAAQuC,SAAAA,CAAUC,OAAAA,EAAS,6BAAA,CAAA;AACjC,EAAA,OAAOxC,UAAU,cAAA,IAAkBA,KAAAA,KAAU,WAAA,IAAeA,KAAAA,KAAU,cAAcA,KAAAA,GAAQ,SAAA;AAC9F;AAHSkE,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAKT,eAAeC,aAAa3B,OAAAA,EAAgB;AAE1C,EAAA,MAAMhD,OAAAA,GAAU+C,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAIhD,OAAAA,IAAW6D,uBAAAA,CAAwBb,OAAAA,CAAAA,EAAU;AAG/CrG,IAAAA,MAAAA,CAAOC,MAAM,gEAAA,CAAA;AAEb,IAAA,MAAMgI,SAAAA,GAAY7B,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA,IAAmB,MAAA;AACxD,IAAA,MAAM6B,QAAAA,GAAW9B,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AAEpC,IAAA,OAAO;MACL5F,EAAAA,EAAI4C,OAAAA;MACJV,IAAAA,EAAMsF,SAAAA;AACNjD,MAAAA,UAAAA,EAAY+C,gBAAgB1B,OAAAA,CAAAA;MAC5BlE,YAAAA,EAAciE,SAAAA,CAAUC,SAAS,gBAAA,CAAA;MACjCxD,SAAAA,EAAWuD,SAAAA,CAAUC,SAAS,aAAA,CAAA;AAC9BvD,MAAAA,MAAAA,EAAQsD,UAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAC7DtD,MAAAA,OAAAA,EACEkF,cAAc,aAAA,IACdC,QAAAA,KAAa,cAAA,IACbA,QAAAA,KAAa,iBACbA,QAAAA,KAAa;AACjB,KAAA;AACF,EAAA;AAEA,EAAA,IAAI7E,OAAAA,EAAS;AACXrD,IAAAA,MAAAA,CAAOe,KAAK,uFAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAMoH,UAAAA,GAAa/B,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AAEtC,EAAA,IAAI,CAAC8B,UAAAA,EAAYC,UAAAA,CAAW,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAM5G,KAAAA,GAAQ2G,UAAAA,CAAWE,SAAAA,CAAU,CAAA,CAAA;AAEnC,EAAA,IAAI;AACFrI,IAAAA,MAAAA,CAAOC,MAAM,iFAAA,CAAA;AACb,IAAA,MAAM4B,OAAAA,GAAU,MAAMN,SAAAA,CAAUC,KAAAA,CAAAA;AAEhC,IAAA,IAAI,CAACK,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLpB,MAAAA,EAAAA,EAAIoB,OAAAA,CAAQpB,EAAAA;MACZkC,IAAAA,EAAM,MAAA;MACNqC,UAAAA,EAAY,SAAA;AACZ7C,MAAAA,YAAAA,EAAcN,OAAAA,CAAQM;AACxB,KAAA;AACF,EAAA,CAAA,CAAA,OAASrB,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,sCAAsCD,KAAAA,CAAAA;AAClD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA3DekH,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAgEf,SAASM,cAAcjC,OAAAA,EAAgB;AAErC,EAAA,MAAMkC,QAAAA,GAAWnC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AACpC,EAAA,MAAMmC,cAAAA,GAAiBpC,SAAAA,CAAUC,OAAAA,EAAS,mBAAA,CAAA;AAE1C,EAAA,IAAIkC,QAAAA,EAAU;AACZ,IAAA,OAAO;MACL9H,EAAAA,EAAI8H,QAAAA;AACJE,MAAAA,QAAAA,EAAUD,cAAAA,IAAkB;AAC9B,KAAA;AACF,EAAA;AAGA,EAAA,OAAOtC,gBAAgBwC,aAAAA,IAAiB,IAAA;AAC1C;AAdSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASK,oBAAoBtC,OAAAA,EAAgB;AAC3C,EAAA,MAAM5C,QAAQ2C,SAAAA,CAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAEnE,EAAA,IAAI5C,KAAAA,EAAO;AACT,IAAA,OAAO;MAAEhD,EAAAA,EAAIgD;AAAM,KAAA;AACrB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSkF,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASC,gBAAAA,CAAiBvC,SAAkBpD,KAAAA,EAAoB;AAE9D,EAAA,MAAM9C,WAAAA,GAAciG,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEvC,EAAA,IAAIlG,WAAAA,EAAa;AACf,IAAA,OAAO;MAAEM,EAAAA,EAAIN;AAAY,KAAA;AAC3B,EAAA;AAGA,EAAA,IAAI8C,OAAOd,YAAAA,EAAc;AACvB,IAAA,OAAO;AAAE1B,MAAAA,EAAAA,EAAIwC,KAAAA,CAAMd;AAAa,KAAA;AAClC,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAdSyG,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAmBT,SAASC,eAAexC,OAAAA,EAAgB;AACtC,EAAA,MAAMyC,SAAAA,GAAY1C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAIyC,SAAAA,EAAW;AACb,IAAA,OAAO;MAAErI,EAAAA,EAAIqI;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaT,SAASE,eAAe1C,OAAAA,EAAgB;AACtC,EAAA,MAAM2C,SAAAA,GAAY5C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI2C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEvI,EAAAA,EAAIuI;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASE,iBAAiB5C,OAAAA,EAAgB;AACxC,EAAA,MAAM6C,OAAAA,GAAU9C,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACnC,EAAA,MAAM8C,QAAAA,GAAW/C,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AACpC,EAAA,MAAM+C,QAAAA,GAAWhD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEpC,EAAA,OAAO;IACL6C,OAAAA,EAASA,OAAAA,EAASG,aAAAA,IAAiBnE,MAAAA;IACnCiE,QAAAA,EAAUA,QAAAA,EAAUE,aAAAA,IAAiBnE,MAAAA;AACrCkE,IAAAA,QAAAA,EAAUA,QAAAA,IAAYlE;AACxB,GAAA;AACF;AAVS+D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAwBT,SAASK,sBAAsBjD,OAAAA,EAAgB;AAC7C,EAAA,MAAMT,SAAAA,GAAYQ,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAGrC,EAAA,IAAI,CAACT,SAAAA,EAAW;AACd,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAM2D,YAAAA,GAAenD,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMmD,eAAAA,GAAkBpD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAC3C,EAAA,MAAMoD,eAAAA,GAAkBrD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAE3C,EAAA,OAAO;AACLT,IAAAA,SAAAA;IACAI,MAAAA,EAAQuD,YAAAA,GAAeA,YAAAA,CAAa3B,KAAAA,CAAM,GAAA,CAAA,CAAK8B,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAE9B,IAAAA,EAAI,CAAA,GAAM3C,MAAAA;AACtEQ,IAAAA,SAAAA,EAAW8D,eAAAA,GAAkB,IAAIhF,IAAAA,CAAKgF,eAAAA,CAAAA,GAAmBtE,MAAAA;AACzDS,IAAAA,SAAAA,EAAW8D,eAAAA,GAAkB,IAAIjF,IAAAA,CAAKiF,eAAAA,CAAAA,GAAmBvE;AAC3D,GAAA;AACF;AAlBSoE,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA0BT,eAAsBM,aAAavD,OAAAA,EAAgB;AACjD,EAAA,IAAI,CAACH,cAAAA,EAAgB;AACnB,IAAA,MAAM,IAAIhD,MAAM,wEAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMD,KAAAA,GAAQ,MAAM+E,YAAAA,CAAa3B,OAAAA,CAAAA;AAGjC,EAAA,MAAM1C,MAAAA,GAAS2E,cAAcjC,OAAAA,CAAAA;AAC7B,EAAA,MAAM7C,YAAAA,GAAemF,oBAAoBtC,OAAAA,CAAAA;AACzC,EAAA,MAAMhG,SAAAA,GAAYuI,gBAAAA,CAAiBvC,OAAAA,EAASpD,KAAAA,CAAAA;AAC5C,EAAA,MAAM4G,OAAAA,GAAUhB,eAAexC,OAAAA,CAAAA;AAC/B,EAAA,MAAMyD,OAAAA,GAAUf,eAAe1C,OAAAA,CAAAA;AAC/B,EAAA,MAAM0D,QAAAA,GAAWvC,gBAAgBnB,OAAAA,CAAAA;AACjC,EAAA,MAAM2D,cAAAA,GAAiBV,sBAAsBjD,OAAAA,CAAAA;AAC7C,EAAA,MAAM4D,kBAAAA,GAAqBrF,wBAAAA,CACzBwB,SAAAA,CAAUC,OAAAA,EAAS,uBAAA,CAAA,EACnBpD,KAAAA,EACA5C,SAAAA,EAAWI,EAAAA,EACXyG,uBAAAA,CAAwBb,OAAAA,CAAAA,CAAAA;AAI1B,EAAA,IAAI6D,IAAAA;AACJ,EAAA,IAAIhE,eAAegE,IAAAA,EAAM;AACvBA,IAAAA,IAAAA,GAAOhE,cAAAA,CAAegE,IAAAA,CAAKC,wBAAAA,CAAyB9D,OAAAA,CAAAA;AACtD,EAAA;AAGA,EAAA,MAAM+D,GAAAA,GAAMnB,iBAAiB5C,OAAAA,CAAAA;AAC7B,EAAA,IAAI+D,GAAAA,CAAIlB,OAAAA,IAAWkB,GAAAA,CAAIjB,QAAAA,IAAYiB,IAAIhB,QAAAA,EAAU;AAC/C,IAAA,IAAIc,IAAAA,EAAM;AAER,MAAA,IAAIE,GAAAA,CAAIlB,OAAAA,EAASgB,IAAAA,CAAKhB,OAAAA,GAAUkB,GAAAA,CAAIlB,OAAAA;AACpC,MAAA,IAAIkB,GAAAA,CAAIjB,QAAAA,EAAUe,IAAAA,CAAKf,QAAAA,GAAWiB,GAAAA,CAAIjB,QAAAA;AACtC,MAAA,IAAIiB,GAAAA,CAAIhB,QAAAA,EAAUc,IAAAA,CAAKd,QAAAA,GAAWgB,GAAAA,CAAIhB,QAAAA;IACxC,CAAA,MAAO;AAELc,MAAAA,IAAAA,GAAO;QACLG,MAAAA,EAAQ,OAAA;QACRC,QAAAA,EAAU,IAAA;AACVpB,QAAAA,OAAAA,EAASkB,GAAAA,CAAIlB,OAAAA;AACbC,QAAAA,QAAAA,EAAUiB,GAAAA,CAAIjB,QAAAA;AACdC,QAAAA,QAAAA,EAAUgB,GAAAA,CAAIhB,QAAAA;QACdmB,CAAAA,kBAAG,MAAA,CAAA,CAACjE,QAAgBA,GAAAA,EAAjB,GAAA,CAAA;QACHkE,EAAAA,kBAAI,MAAA,CAAA,CAAClE,QAAgBA,GAAAA,EAAjB,IAAA,CAAA;AACJmE,QAAAA,YAAAA,kBAAc,MAAA,CAAA,CAAC5G,KAAAA,KAAkB6G,MAAAA,CAAO7G,KAAAA,CAAAA,EAA1B,cAAA,CAAA;AACd8G,QAAAA,cAAAA,0BAAiB9G,KAAAA,EAAesF,QAAAA,KAAqB,GAAGA,QAAAA,CAAAA,CAAAA,EAAYtF,KAAAA,CAAAA,CAAAA,EAApD,gBAAA,CAAA;AAChB+G,QAAAA,UAAAA,kBAAY,MAAA,CAAA,CAACC,IAAAA,KAAwBH,MAAAA,CAAOG,IAAAA,CAAAA,EAAhC,YAAA,CAAA;AACZC,QAAAA,kBAAAA,0BAAqBjH,KAAAA,EAAekH,IAAAA,KAAsC,GAAGlH,KAAAA,CAAAA,CAAAA,EAASkH,IAAAA,CAAAA,CAAAA,EAAlE,oBAAA;AACtB,OAAA;AACF,IAAA;AACF,EAAA;AAKA,EAAA,MAAMC,UAAAA,GAAAA,CACH/H,KAAAA,EAAON,IAAAA,KAAS,KAAA,IAASM,OAAON,IAAAA,KAAS,SAAA,IAAaM,KAAAA,EAAON,IAAAA,KAAS,iBAAA,KACvEqH,cAAAA,EAAgBpE,SAAAA,GACZoE,cAAAA,CAAepE,YACf3C,KAAAA,EAAOxC,EAAAA;AAIb,EAAA,MAAMwK,YAAAA,GAAe;AACnB9K,IAAAA,WAAAA,EAAaE,SAAAA,EAAWI,EAAAA;AACxB8H,IAAAA,QAAAA,EAAU5E,MAAAA,EAAQlD,EAAAA;AAClB4C,IAAAA,OAAAA,EAASJ,KAAAA,EAAOxC,EAAAA;AAChBwH,IAAAA,SAAAA,EAAWhF,KAAAA,EAAON,IAAAA;AAClBuI,IAAAA,cAAAA,EAAgB1H,YAAAA,EAAc/C,EAAAA;AAC9BqI,IAAAA,SAAAA,EAAWe,OAAAA,EAASpJ,EAAAA;AACpBuK,IAAAA;AACF,GAAA;AAEAhL,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxDE,IAAAA,WAAAA,EAAa8K,aAAa9K,WAAAA,IAAe,MAAA;AACzCkD,IAAAA,OAAAA,EAAS4H,aAAa5H,OAAAA,IAAW,MAAA;IACjC8H,SAAAA,EAAW/E,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA,IAAqB;GACrD,CAAA;AAEA+E,EAAAA,mBAAAA,CAAoBH,YAAAA,CAAAA;AASpBI,EAAAA,cAAAA,CAAeC,kBAAAA,CACblF,SAAAA,CAAUC,OAAAA,EAAS,qBAAA,CAAA,EACnBD,SAAAA,CAAUC,OAAAA,EAAS,yBAAA,CAAA,EACnBD,SAAAA,CAAUC,OAAAA,EAAS,oBAAA,CAAA,CAAA;AAGrB,EAAA,OAAO;AACLA,IAAAA,OAAAA;AACApD,IAAAA,KAAAA;AACAU,IAAAA,MAAAA;AACAH,IAAAA,YAAAA;AACAnD,IAAAA,SAAAA;AACAwJ,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,cAAAA,EAAgBA,cAAAA,IAAkB9E,MAAAA;AAClC+E,IAAAA,kBAAAA;IACAe,UAAAA,EAAYA,UAAAA,IAAc/H,OAAOxC,EAAAA,IAAM,EAAA;AACvCL,IAAAA,EAAAA,EAAI8F,eAAe7G,KAAAA,EAAK;AACxB6K,IAAAA,IAAAA;AACAqB,IAAAA,eAAAA,EAAiB,IAAIC,OAAAA;AACvB,GAAA;AACF;AAjHsB5B,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAsHf,SAAS6B,iBAAAA,GAAAA;AACd,EAAA,OAAOvF,cAAAA;AACT;AAFgBuF,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;ACzbhB,SAASC,OAAO7H,KAAAA,EAAc;AAC5B,EAAA,OAAO,OAAOA,UAAU,QAAA,IAAYA,KAAAA,KAAU,QAAQ,CAACC,KAAAA,CAAMC,QAAQF,KAAAA,CAAAA;AACvE;AAFS6H,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAIT,SAASC,OAAO9H,KAAAA,EAAc;AAC5B,EAAA,OAAO,OAAOA,KAAAA,KAAU,QAAA,IAAYA,KAAAA,CAAM0B,MAAAA,GAAS,IAAI1B,KAAAA,GAAQqB,MAAAA;AACjE;AAFSyG,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAIT,SAASlL,GAAGoD,KAAAA,EAAc;AACxB,EAAA,OAAO6H,OAAO7H,KAAAA,CAAAA,GAAS8H,OAAO9H,KAAAA,CAAM,IAAA,CAAK,CAAA,GAAIqB,MAAAA;AAC/C;AAFSzE,MAAAA,CAAAA,EAAAA,EAAAA,IAAAA,CAAAA;AAIT,SAASmL,iBAAiB/H,KAAAA,EAAc;AACtC,EAAA,IAAI,CAAC6H,MAAAA,CAAO7H,KAAAA,CAAAA,SAAe,EAAC;AAC5B,EAAA,OAAO;IACL1D,WAAAA,EAAaM,EAAAA,CAAGoD,KAAAA,CAAM,WAAA,CAAY,CAAA;IAClC0E,QAAAA,EAAU9H,EAAAA,CAAGoD,KAAAA,CAAM,QAAA,CAAS,CAAA;IAC5BqH,cAAAA,EAAgBzK,EAAAA,CAAGoD,KAAAA,CAAM,cAAA,CAAe,CAAA;IACxCiF,SAAAA,EAAWrI,EAAAA,CAAGoD,KAAAA,CAAM,SAAA,CAAU,CAAA;IAC9BR,OAAAA,EAAS5C,EAAAA,CAAGoD,KAAAA,CAAM,OAAA,CAAQ,CAAA;IAC1BoE,SAAAA,EAAWyD,MAAAA,CAAO7H,KAAAA,CAAM,OAAA,CAAQ,CAAA,GAAI8H,MAAAA,CAAO9H,KAAAA,CAAM,OAAA,CAAA,CAAS,MAAA,CAAO,CAAA,GAAIqB,MAAAA;IACrE8F,UAAAA,EAAYW,MAAAA,CAAO9H,KAAAA,CAAM,YAAA,CAAa;AACxC,GAAA;AACF;AAXS+H,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAaT,SAASC,cAAAA,CAAkBC,QAA0BC,KAAAA,EAAuB;AAC1E,EAAA,OAAO;IACL,CAACC,MAAAA,CAAOC,aAAa,CAAA,GAAC;AACpB,MAAA,MAAMC,QAAAA,GAAWJ,MAAAA,CAAOE,MAAAA,CAAOC,aAAa,CAAA,EAAC;AAC7C,MAAA,MAAME,MAAAA,GAASD,QAAAA,CAASE,MAAAA,EAAQC,IAAAA,CAAKH,QAAAA,CAAAA;AACrC,MAAA,MAAMI,IAAAA,GAAOJ,QAAAA,CAASK,KAAAA,EAAOF,IAAAA,CAAKH,QAAAA,CAAAA;AAClC,MAAA,OAAO;QACLM,IAAAA,kBAAM,MAAA,CAAA,CAAA,GAAIC,IAAAA,KAAyBC,oBAAAA,CAAqBX,KAAAA,EAAO,YAAYG,SAASM,IAAAA,CAAI,GAAIC,IAAAA,CAAAA,CAAAA,EAAtF,MAAA,CAAA;QACNL,MAAAA,EAAQD,MAAAA,GAAS,CAACtI,KAAAA,KAAoB6I,oBAAAA,CAAqBX,OAAO,YAAYI,MAAAA,CAAOtI,KAAAA,CAAAA,CAAAA,GAAUqB,MAAAA;QAC/FqH,KAAAA,EAAOD,IAAAA,GAAO,CAACxL,KAAAA,KAAoB4L,oBAAAA,CAAqBX,OAAO,YAAYO,IAAAA,CAAKxL,KAAAA,CAAAA,CAAAA,GAAUoE;AAC5F,OAAA;AACF,IAAA;AACF,GAAA;AACF;AAbS2G,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAkBF,SAASc,qCAAAA,GAAAA;AACd,EAAA,OAAO;IACLC,SAAAA,CAAU,EAAEC,SAAAA,EAAWC,YAAAA,EAAY,EAAE;AACnCA,MAAAA,YAAAA,CAAa,CAACL,IAAAA,KAAAA;AACZ,QAAA,MAAMV,KAAAA,GAAQH,gBAAAA,CAAiBa,IAAAA,CAAKM,YAAY,CAAA;AAChD,QAAA,OAAOL,oBAAAA,CAAqBX,OAAO,YAAA;AACjC,UAAA,MAAMiB,MAAAA,GAAS,MAAMH,SAAAA,CAAUJ,IAAAA,CAAAA;AAC/B,UAAA,OAAOT,OAAOC,aAAAA,IAAiBe,MAAAA,GAASnB,cAAAA,CAAemB,MAAAA,EAAQjB,KAAAA,CAAAA,GAASiB,MAAAA;QAC1E,CAAA,CAAA;MACF,CAAA,CAAA;AACF,IAAA,CAAA;IACAC,WAAAA,CAAY,EAAEC,WAAAA,EAAaC,cAAAA,EAAc,EAAE;AACzCA,MAAAA,cAAAA,CAAe,CAACV,IAAAA,KAAAA;AACd,QAAA,MAAMV,KAAAA,GAAQH,gBAAAA,CAAiBa,IAAAA,CAAKM,YAAY,CAAA;AAChD,QAAA,OAAOL,oBAAAA,CAAqBX,OAAO,YAAA;AACjC,UAAA,MAAMiB,MAAAA,GAAS,MAAME,WAAAA,CAAYT,IAAAA,CAAAA;AACjC,UAAA,OAAOT,OAAOC,aAAAA,IAAiBe,MAAAA,GAASnB,cAAAA,CAAemB,MAAAA,EAAQjB,KAAAA,CAAAA,GAASiB,MAAAA;QAC1E,CAAA,CAAA;MACF,CAAA,CAAA;AACF,IAAA;AACF,GAAA;AACF;AArBgBL,MAAAA,CAAAA,qCAAAA,EAAAA,uCAAAA,CAAAA;;;AC7ChB,IAAMS,iBAAAA,GAAoB;AACxB,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA;;AAGK,SAASC,oBAAAA,CACdC,SACAC,WAAAA,EAAiE;AAEjE,EAAA,MAAMC,UAAAA,GAAAA,CAAc1J,MAAMC,OAAAA,CAAQuJ,OAAAA,IAAWA,OAAAA,GAAUA,OAAAA,EAAS1F,MAAM,GAAA,CAAA,IAAQ,EAAA,EAC3E8B,GAAAA,CAAI,CAAC+D,MAAAA,KAAWA,MAAAA,CAAO5F,MAAI,CAAA,CAC3B6F,OAAOC,OAAAA,CAAAA;AAEV,EAAA,IAAIH,UAAAA,CAAWjI,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAOgI,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,IAAII,UAAAA,CAAWvI,QAAAA,CAAS,GAAA,CAAA,EAAM;AAC5B,IAAA,OAAOsI,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,OAAOI,UAAAA;AACT;AAjBgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAmBT,SAASO,wBAAAA,CAAyBC,eAA8BC,cAAAA,EAAwB;AAC7F,EAAA,IAAI,CAACD,aAAAA,EAAe;AAClB,IAAA,OAAOC,cAAAA,CAAe,CAAA,CAAA,IAAM,IAAA;AAC9B,EAAA;AAEA,EAAA,OAAOA,cAAAA,CAAe7I,QAAAA,CAAS4I,aAAAA,CAAAA,GAAiBA,aAAAA,GAAgB,IAAA;AAClE;AANgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASG,qBAAqB9K,KAAAA,EAAoB;AACvD,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOA,KAAAA,CAAMF,YAAY,IAAA,IAAQ;AAAC,IAAA,SAAA;AAAW,IAAA;AAAekC,GAAAA,CAAAA,QAAAA,CAAShC,MAAMN,IAAI,CAAA;AACjF;AANgBoL,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;;;ACfT,SAASC,KAAAA,CAAMC,MAAcC,QAAAA,EAAgB;AAClD,EAAA,MAAM9I,GAAAA,GAAMgC,OAAAA,CAAQC,GAAAA,CAAI4G,IAAAA,CAAAA;AACxB,EAAA,IAAI,CAAC7I,KAAK,OAAO8I,QAAAA;AACjB,EAAA,MAAMC,MAAAA,GAAS1J,MAAAA,CAAO2J,QAAAA,CAAShJ,GAAAA,EAAK,EAAA,CAAA;AACpC,EAAA,OAAOX,OAAOC,QAAAA,CAASyJ,MAAAA,CAAAA,IAAWA,MAAAA,GAAS,IAAIA,MAAAA,GAASD,QAAAA;AAC1D;AALgBF,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAaT,IAAMK,kBAAAA,GAAqBL,KAAAA,CAAM,yBAAA,EAA2B,GAAA,CAAA;AAQ5D,IAAMM,8BAAAA,GAAiCN,KAAAA,CAAM,6BAAA,EAA+B,GAAA,CAAA;AAyB5E,SAASO,0BAA0BC,IAAAA,EAAgC;AACxE,EAAA,MAAMC,KAAAA,GAAQD,KAAKC,KAAAA,IAASJ,kBAAAA;AAC5B,EAAA,MAAMK,SAAAA,GAAYF,KAAKE,SAAAA,IAAaJ,8BAAAA;AACpC,EAAA,MAAMvJ,GAAAA,GAAMyJ,IAAAA,CAAKzJ,GAAAA,KAAQ,MAAcP,KAAKO,GAAAA,EAAG,CAAA;AAE/C,EAAA,IAAI4J,WAAAA,GAAc,CAAA;AAClB,EAAA,IAAIC,QAAAA,GAAiC,IAAA;AAErC,EAAA,MAAMC,0BAAU,MAAA,CAAA,YAAA;AACd,IAAA,IAAIF,WAAAA,KAAgB,CAAA,IAAK5J,GAAAA,EAAAA,GAAQ4J,cAAcF,KAAAA,EAAO;AAEtD,IAAA,IAAI,CAACG,QAAAA,EAAU;AACbA,MAAAA,QAAAA,GAAAA,CAAY,YAAA;AACV,QAAA,IAAIE,KAAAA;AACJ,QAAA,IAAI;AACF,UAAA,MAAMC,QAAQC,IAAAA,CAAK;AACjBD,YAAAA,OAAAA,CAAQE,QAAQT,IAAAA,CAAKU,OAAAA,EAAO,CAAA,CAAIC,IAAAA,CAAK,MAAMjK,KAAAA,CAAAA,CAAAA;YAC3C,IAAI6J,OAAAA,CAAc,CAACE,OAAAA,KAAAA;AACjBH,cAAAA,KAAAA,GAAQM,UAAAA,CAAWH,SAASP,SAAAA,CAAAA;YAC9B,CAAA;AACD,WAAA,CAAA;AAIDC,UAAAA,WAAAA,GAAc5J,GAAAA,EAAAA;QAChB,CAAA,CAAA,MAAQ;QAER,CAAA,SAAA;AACE,UAAA,IAAI+J,KAAAA,KAAU5J,MAAAA,EAAWmK,YAAAA,CAAaP,KAAAA,CAAAA;AACtCF,UAAAA,QAAAA,GAAW,IAAA;AACb,QAAA;MACF,CAAA,GAAA;AACF,IAAA;AAEA,IAAA,MAAMA,QAAAA;EACR,CAAA,EA3BgB,SAAA,CAAA;AA6BhB,EAAA,OAAO;AAAEC,IAAAA,OAAAA;AAASS,IAAAA,eAAAA,+BAA+BX,WAAAA,EAAd,iBAAA;AAA0B,GAAA;AAC/D;AAtCgBJ,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;;;ACWT,IAAMgB,kBAAAA,GAAqB,GAAA;AAG3B,IAAMC,0BAAAA,GAA6B,GAAA;AAE1C,IAAMC,gBAAAA,GAAqC;AAAC,EAAA;;AAE5C,eAAeC,WAAAA,CAAeC,IAAAA,EAAkBC,EAAAA,EAAYC,KAAAA,EAAa;AACvE,EAAA,IAAIf,KAAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAO,MAAMC,QAAQC,IAAAA,CAAK;AACxBW,MAAAA,IAAAA;MACA,IAAIZ,OAAAA,CAAe,CAACe,CAAAA,EAAGC,MAAAA,KAAAA;AACrBjB,QAAAA,KAAAA,GAAQM,UAAAA,CAAW,MAAMW,MAAAA,CAAO,IAAI7M,KAAAA,CAAM,CAAA,EAAG2M,KAAAA,CAAAA,uBAAAA,EAA+BD,EAAAA,CAAAA,EAAAA,CAAM,CAAA,CAAA,EAAIA,EAAAA,CAAAA;MACxF,CAAA;AACD,KAAA,CAAA;EACH,CAAA,SAAA;AACE,IAAA,IAAId,KAAAA,eAAoBA,KAAAA,CAAAA;AAC1B,EAAA;AACF;AAZeY,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAcf,eAAeM,QAAAA,CACb/B,IAAAA,EACAgC,QAAAA,EACAN,IAAAA,EACA5K,GAAAA,EAAiB;AAEjB,EAAA,MAAMmL,UAAUnL,GAAAA,EAAAA;AAChB,EAAA,IAAI;AACF,IAAA,MAAM2K,YAAYX,OAAAA,CAAQE,OAAAA,CAAQU,MAAAA,CAAAA,EAASH,4BAA4BvB,IAAAA,CAAAA;AACvE,IAAA,OAAO;MAAEkC,EAAAA,EAAI,IAAA;AAAMF,MAAAA,QAAAA;AAAUG,MAAAA,SAAAA,EAAWrL,KAAAA,GAAQmL;AAAQ,KAAA;AAC1D,EAAA,CAAA,CAAA,OAAS1N,GAAAA,EAAK;AACZ,IAAA,OAAO;MACL2N,EAAAA,EAAI,KAAA;AACJF,MAAAA,QAAAA;AACAnP,MAAAA,KAAAA,EAAO0B,GAAAA,YAAeU,KAAAA,GAAQV,GAAAA,CAAI6N,OAAAA,GAAU3F,OAAOlI,GAAAA,CAAAA;AACnD4N,MAAAA,SAAAA,EAAWrL,KAAAA,GAAQmL;AACrB,KAAA;AACF,EAAA;AACF;AAlBeF,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAwBR,SAASM,oBAAAA,CACdC,IAAAA,EACAxL,GAAAA,GAAoBP,IAAAA,CAAKO,GAAAA,EAAG;AAE5B,EAAA,MAAMkL,QAAAA,GAAW,IAAIO,GAAAA,CAAoBD,IAAAA,CAAKE,wBAAwBhB,gBAAAA,CAAAA;AACtE,EAAA,IAAIiB,KAAAA,GAA4D,IAAA;AAChE,EAAA,IAAI9B,QAAAA,GAA8C,IAAA;AAElD,EAAA,eAAe+B,KAAAA,GAAAA;AACb,IAAA,MAAMC,SAA4D,EAAC;AAEnE,IAAA,MAAMC,OAA6B,EAAA;AAEnC,IAAA,IAAIN,KAAKO,MAAAA,EAAQ;AACfD,MAAAA,IAAAA,CAAKE,KACHf,QAAAA,CACE,UAAA,EACAC,SAASe,GAAAA,CAAI,UAAA,GACb,YAAA;AACE,QAAA,MAAM1Q,MAAAA,GAASiQ,KAAKO,MAAAA,IAAM;AAC1B,QAAA,IAAI,CAACxQ,MAAAA,EAAQ,MAAM,IAAI4C,MAAM,+BAAA,CAAA;AAC7B,QAAA,MAAM5C,MAAAA,CAAO2Q,SAAAA,CAAAA,QAAAA,CAAAA;AACf,MAAA,CAAA,EACAlM,GAAAA,CAAAA,CACAoK,IAAAA,CAAK,CAAC+B,CAAAA,KAAAA;AACNN,QAAAA,MAAAA,CAAOO,QAAAA,GAAWD,CAAAA;AACpB,MAAA,CAAA,CAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAIX,KAAKa,MAAAA,EAAQ;AACfP,MAAAA,IAAAA,CAAKE,KACHf,QAAAA,CACE,QAAA,EACAC,SAASe,GAAAA,CAAI,QAAA,GACb,YAAA;AACE,QAAA,MAAM1Q,MAAAA,GAAS,MAAMiQ,IAAAA,CAAKa,MAAAA,IAAM;AAChC,QAAA,IAAI,CAAC9Q,MAAAA,EAAQ,MAAM,IAAI4C,MAAM,+BAAA,CAAA;AAC7B,QAAA,MAAM5C,OAAO+Q,IAAAA,EAAI;AACnB,MAAA,CAAA,EACAtM,GAAAA,CAAAA,CACAoK,IAAAA,CAAK,CAAC+B,CAAAA,KAAAA;AACNN,QAAAA,MAAAA,CAAOQ,MAAAA,GAASF,CAAAA;AAClB,MAAA,CAAA,CAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,IAAIX,KAAKe,UAAAA,EAAY;AACnBT,MAAAA,IAAAA,CAAKE,KACHf,QAAAA,CACE,YAAA,EACAC,SAASe,GAAAA,CAAI,YAAA,GACb,YAAA;AACE,QAAA,MAAMO,CAAAA,GAAIhB,KAAKe,UAAAA,IAAU;AACzB,QAAA,IAAI,CAACC,CAAAA,EAAG,MAAM,IAAIrO,MAAM,6BAAA,CAAA;AACxB,QAAA,IAAI,OAAOqO,CAAAA,CAAEC,WAAAA,KAAgB,UAAA,EAAY;AACvC,UAAA,MAAMC,YAAY,MAAM1C,OAAAA,CAAQE,OAAAA,CAAQsC,CAAAA,CAAEC,aAAW,CAAA;AACrD,UAAA,IAAI,CAACC,SAAAA,EAAW,MAAM,IAAIvO,MAAM,kCAAA,CAAA;AAChC,UAAA;AACF,QAAA;AACA,QAAA,IAAI,OAAOqO,CAAAA,CAAEG,WAAAA,KAAgB,UAAA,EAAY;AACvC,UAAA,MAAMC,GAAAA,GAAM,MAAMJ,CAAAA,CAAEG,WAAAA,EAAW;AAC/B,UAAA,IAAI,CAACC,GAAAA,CAAIxB,EAAAA,EAAI,MAAM,IAAIjN,MAAM,iCAAA,CAAA;AAC/B,QAAA;AAIF,MAAA,CAAA,EACA6B,GAAAA,CAAAA,CACAoK,IAAAA,CAAK,CAAC+B,CAAAA,KAAAA;AACNN,QAAAA,MAAAA,CAAOU,UAAAA,GAAaJ,CAAAA;AACtB,MAAA,CAAA,CAAA,CAAA;AAEJ,IAAA;AAEA,IAAA,MAAMnC,OAAAA,CAAQ6C,IAAIf,IAAAA,CAAAA;AAElB,IAAA,MAAMgB,OAAAA,GAAUC,MAAAA,CAAOC,MAAAA,CAAOnB,MAAAA,CAAAA;AAC9B,IAAA,OAAO;MACLoB,KAAAA,EAAOH,OAAAA,CAAQ3N,MAAM,CAAC+N,CAAAA,KAAMA,EAAE9B,EAAAA,IAAM,CAAC8B,EAAEhC,QAAQ,CAAA;AAC/CiC,MAAAA,OAAAA,EAASL,OAAAA,CAAQ3N,KAAAA,CAAM,CAAC+N,CAAAA,KAAMA,EAAE9B,EAAE,CAAA;AAClCS,MAAAA;AACF,KAAA;AACF,EAAA;AA3EeD,EAAAA,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AA6Ef,EAAA,6CAAsBwB,YAAAA,GAAAA;AACpB,IAAA,MAAMC,KAAKrN,GAAAA,EAAAA;AACX,IAAA,IAAI2L,SAAS0B,EAAAA,GAAK1B,KAAAA,CAAM0B,EAAAA,GAAK7C,kBAAAA,SAA2BmB,KAAAA,CAAM2B,QAAAA;AAE9D,IAAA,IAAIzD,UAAU,OAAOA,QAAAA;AACrBA,IAAAA,QAAAA,GAAW+B,KAAAA,EAAAA,CACRxB,IAAAA,CAAK,CAACkD,QAAAA,KAAAA;AACL3B,MAAAA,KAAAA,GAAQ;AAAE2B,QAAAA,QAAAA;AAAUD,QAAAA,EAAAA,EAAIrN,GAAAA;AAAM,OAAA;AAC9B,MAAA,OAAOsN,QAAAA;IACT,CAAA,CAAA,CACCC,QAAQ,MAAA;AACP1D,MAAAA,QAAAA,GAAW,IAAA;IACb,CAAA,CAAA;AACF,IAAA,OAAOA,QAAAA;EACT,CAAA,EAdO,cAAA,CAAA;AAeT;AApGgB0B,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAgHT,SAASiC,oBAAoBF,QAAAA,EAA2B;AAC7D,EAAA,OAAOA,QAAAA,CAASL,QAAQ,GAAA,GAAM,GAAA;AAChC;AAFgBO,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAIT,SAASC,aAAAA,CACdH,QAAAA,EACAI,OAAAA,EACAC,OAAAA,EACAC,WACAC,aAAAA,EAAsB;AAEtB,EAAA,MAAMC,SAA+B,CAACR,QAAAA,CAASL,QAAQ,aAAA,GAAgBK,QAAAA,CAASH,UAAU,SAAA,GAAY,UAAA;AACtG,EAAA,OAAO;AACLW,IAAAA,MAAAA;AACAJ,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,SAAAA;AACA/B,IAAAA,MAAAA,EAAQyB,QAAAA,CAASzB,MAAAA;IACjB,GAAIgC,aAAAA,KAAkB1N,MAAAA,GAAY,EAAC,GAAI;AAAE0N,MAAAA;AAAc;AACzD,GAAA;AACF;AAhBgBJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASM,YAAAA,CAAaL,OAAAA,EAAiBC,OAAAA,EAAiBC,SAAAA,EAAiB;AAC9E,EAAA,OAAO;IAAEE,MAAAA,EAAQ,SAAA;AAAWJ,IAAAA,OAAAA;AAASC,IAAAA,OAAAA;AAASC,IAAAA;AAAU,GAAA;AAC1D;AAFgBG,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;;;AC1NhB,IAAIC,eAAAA,GAA+B,IAAA;AAInC,IAAMC,sBAAsBzE,yBAAAA,CAA0B;AACpDW,EAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAM+D,yBAAAA,EAAAA,CAA4BC,UAAAA,EAAU,EAA5C,SAAA;AACX,CAAA,CAAA;AAKA,eAAsBC,aAAaC,UAAAA,EAA4B;AAC7D,EAAA,MAAM,EACJrT,MAAAA,EACAsT,YAAAA,EACAC,MAAAA,EACAC,WAAAA,EACAC,aAAAA,EACAC,WAAAA,EACA7J,YAAAA,EAAc8J,kBAAAA,EACdC,wBAAAA,EACAC,yBAAAA,EACAC,UAAAA,EAAU,GACRT,UAAAA;AAGJ,EAAA,MAAM,EAAEU,MAAAA,EAAM,GAAK,MAAM,OAAO,QAAA,CAAA;AAChC,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,oBAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,IAAAA,EAAI,GAAK,MAAM,OAAO,gBAAA,CAAA;AAC9B,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,cAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,oBAAoB7U,KAAAA,EAAAA,MAAAA,EAAO8U,oBAAkB,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvE,EAAA,MAAM,EAAEC,oBAAAA,EAAoB,GAAK,MAAM,OAAO,wBAAA,CAAA;AAC9C,EAAA,MAAM,EAAEC,mBAAAA,EAAmB,GAAK,MAAM,OAAO,2BAAA,CAAA;AAC7C,EAAA,MAAM,EAAEC,0BAAAA,EAAAA,2BAAAA,EAA0B,GAAK,MAAM,OAAO,gCAAA,CAAA;AAEpDtU,EAAAA,MAAAA,CAAOuU,IAAAA,CAAK,CAAA,sBAAA,EAAyBxU,MAAAA,CAAOyU,WAAW,CAAA,GAAA,CAAK,CAAA;AAG5D,EAAA,MAAMC,QAAAA,GACJ1U,MAAAA,CAAO0U,QAAAA,KACN1U,MAAAA,CAAOyU,YAAYpM,UAAAA,CAAW,SAAA,CAAA,GAC3B,QAAA,GACArI,MAAAA,CAAOyU,WAAAA,CAAYpM,UAAAA,CAAW,SAAA,IAC5B,QAAA,GACA,QAAA,CAAA;AAIR,EAAA,MAAMsM,iCACJd,yBAAAA,KAA8B,IAAA,GAAO,QAAQA,yBAAAA,KAA8B,KAAA,GAAQ,OAAOa,QAAAA,KAAa,QAAA;AAEzGzU,EAAAA,MAAAA,CAAOuU,KAAK,mCAAA,EAAqC;AAC/CE,IAAAA,QAAAA;IACAE,kBAAAA,EAAoBD;GACtB,CAAA;AAEA,EAAA,MAAM,EAAEE,OAAAA,EAAO,GAAKV,kBAAAA,CAAmBb,YAAAA,EAActT,OAAOyU,WAAAA,EAAa;IACvEK,wBAAAA,EAA0B,KAAA;IAC1BC,wBAAAA,EAA0BJ,8BAAAA;AAC1B,IAAA,GAAIf,wBAAAA,GAA2B;AAAEA,MAAAA;AAAyB,KAAA,GAAI;GAChE,CAAA;AACA,EAAA,MAAMiB,OAAAA,EAAAA;AAGN,EAAA,IAAIG,YAAAA;AACJ,EAAA,IAAIhV,MAAAA,CAAOmK,IAAAA,EAAM8K,OAAAA,IAAWjV,MAAAA,CAAOmK,KAAK+K,WAAAA,EAAa;AACnDjV,IAAAA,MAAAA,CAAOuU,KAAK,+BAAA,CAAA;AACZQ,IAAAA,YAAAA,GAAe,IAAIG,IAAAA,CAAK;MACtBC,aAAAA,EAAepV,MAAAA,CAAOmK,KAAKiL,aAAAA,IAAiB,OAAA;MAC5CC,cAAAA,EAAgBrV,MAAAA,CAAOmK,KAAKkL,cAAAA,IAAkB,OAAA;AAC9CH,MAAAA,WAAAA,EAAalV,OAAOmK,IAAAA,CAAK+K,WAAAA;AACzBI,MAAAA,gBAAAA,EAAkBtV,OAAOmK,IAAAA,CAAKmL,gBAAAA;MAC9BC,SAAAA,EAAWvV,MAAAA,CAAOmK,IAAAA,CAAKoL,SAAAA,IAAavV,MAAAA,CAAOyU,WAAAA;AAC3Ce,MAAAA,QAAAA,EAAUxV,OAAOmK,IAAAA,CAAKqL,QAAAA;MACtBC,UAAAA,EAAYzV,MAAAA,CAAOmK,KAAKsL,UAAAA,IAAc,IAAA;MACtCC,WAAAA,EAAa,IAAA;MACbC,kBAAAA,EAAoB;KACtB,CAAA;AACA,IAAA,MAAMX,aAAaY,UAAAA,EAAU;AAC7B3V,IAAAA,MAAAA,CAAOuU,IAAAA,CAAK,2CAA2CQ,YAAAA,CAAaa,mBAAAA,GAAsBC,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAO,CAAA;AACxG,EAAA;AAGA1P,EAAAA,gBAAAA,CAAiB;IACf9G,KAAAA,kBAAO,MAAA,CAAA,MAAMA,QAAAA,EAAN,OAAA,CAAA;IACP6K,IAAAA,EAAM6K;GACR,CAAA;AAGA/T,EAAAA,oBAAAA,EAAAA;AAGA,EAAA,IAAIuS,WAAAA,EAAa;AACfvT,IAAAA,MAAAA,CAAOuU,KAAK,uCAAA,CAAA;AACZ,IAAA,MAAMhB,YAAYoC,UAAAA,EAAU;AAC9B,EAAA;AAGA,EAAA,MAAMG,KAAAA,GAAQ/V,OAAOwN,WAAAA,KAAgB,YAAA;AACrC,EAAA,MAAMwI,gBAAAA,GAAmBhW,OAAOgW,gBAAAA,IAAoBD,KAAAA;AAKpD,EAAA,MAAME,QAAAA,GAAWjW,OAAOiW,QAAAA,IAAY,IAAA;AAGpC,EAAA,MAAMC,qBAAAA,GAAwBlW,MAAAA,CAAOmW,cAAAA,EAAgBlB,OAAAA,IAAWP,QAAAA,KAAa,QAAA;AAC7EzU,EAAAA,MAAAA,CAAOuU,KAAK,CAAA,mBAAA,EAAsBE,QAAAA,sBAA8BwB,qBAAAA,GAAwB,SAAA,GAAY,UAAA,CAAA,CAAY,CAAA;AAEhH,EAAA,MAAME,wBAAwBF,qBAAAA,GAC1B;IACE3B,2BAAAA,CAA2B;MACzBU,OAAAA,EAAS,IAAA;AACToB,MAAAA,qBAAAA,EAAuBrW,OAAOmW,cAAAA,EAAgBE;KAChD;MAEF,EAAA;AAGJ,EAAA,MAAMC,eAAAA,GAAkBtW,OAAOsW,eAAAA,IAAmB,UAAA;AAClDrW,EAAAA,MAAAA,CAAOuU,KAAK,0DAAA,EAA4D;AACtEyB,IAAAA;GACF,CAAA;AAEA,EAAA,MAAMM,qBAAAA,GAAoC;AACxCC,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEC,QAAAA,EAAUC,aAAAA,EAAa,KAAkD;AACtF,MAAA,MAAMC,WAAAA,GAAcD,aAAAA;AACpB,MAAA,IAAIC,aAAanL,eAAAA,EAAiB;AAChCmL,QAAAA,WAAAA,CAAYnL,eAAAA,CAAgBoL,OAAAA,CAAQ,CAAC9S,KAAAA,EAAeyC,GAAAA,KAAAA;AAClDkQ,UAAAA,QAAAA,CAASjQ,OAAAA,CAAQqQ,MAAAA,CAAOtQ,GAAAA,EAAKzC,KAAAA,CAAAA;QAC/B,CAAA,CAAA;AACF,MAAA;IACF,CAAA,EAPY,YAAA;AAQd,GAAA;AAEA,EAAA,MAAMgT,OAAO5C,UAAAA,CAAiC;AAC5CoC,IAAAA,eAAAA;AACA/C,IAAAA,MAAAA;IACAwD,QAAAA,EAAUf,gBAAAA;AACVC,IAAAA,QAAAA;IACAe,OAAAA,EAAS;AACP9W,MAAAA,KAAAA,6BAAWwM,IAAAA,KAASzM,MAAAA,CAAOC,MAAM,WAAA,EAAA,GAAgBwM,IAAAA,CAAAA,EAA1C,OAAA,CAAA;AACP8H,MAAAA,IAAAA,6BAAU9H,IAAAA,KAASzM,MAAAA,CAAOuU,KAAK,WAAA,EAAA,GAAgB9H,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACN1L,MAAAA,IAAAA,6BAAU0L,IAAAA,KAASzM,MAAAA,CAAOe,KAAK,WAAA,EAAA,GAAgB0L,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACN3L,MAAAA,KAAAA,6BAAW2L,IAAAA,KAASzM,MAAAA,CAAOc,MAAM,WAAA,EAAA,GAAgB2L,IAAAA,CAAAA,EAA1C,OAAA;AACT,KAAA;IACAuK,OAAAA,EAAS;MACPC,8BAAAA,CAA+B;AAAEzC,QAAAA,WAAAA,EAAazU,MAAAA,CAAOyU,WAAAA;AAAajH,QAAAA,WAAAA,EAAaxN,MAAAA,CAAOwN;OAAY,CAAA;AAC/F4I,MAAAA,GAAAA,qBAAAA;AACHG,MAAAA,qBAAAA;AACI7C,MAAAA,GAAAA,WAAAA,IAAe,EAAA;;MAEnB9G,qCAAAA;;IAEFvJ,OAAAA,kBAAS,MAAA,CAAA,OAAO,EAAEiD,OAAAA,EAAO,KAAE;AAEzB,MAAA,MAAM6Q,cAAAA,GAAiB,MAAMtN,YAAAA,CAAavD,OAAAA,CAAAA;AAG1C,MAAA,IAAIqN,kBAAAA,EAAoB;AACtB,QAAA,OAAOA,mBAAmBwD,cAAAA,CAAAA;AAC5B,MAAA;AAEA,MAAA,OAAOA,cAAAA;IACT,CAAA,EAVS,SAAA;GAWX,CAAA;AAGA,EAAA,MAAMC,GAAAA,GAAM,IAAIrD,MAAAA,CAAO;IAAEsD,OAAAA,EAASrD;GAAW,CAAA;AAG7C,EAAA,MAAMsD,WAAAA,GAAchK,oBAAAA,CAAqBtN,MAAAA,CAAOsX,WAAAA,EAAatX,OAAOwN,WAAW,CAAA;AAE/E4J,EAAAA,GAAAA,CAAIG,IACFtD,IAAAA,CAAK;IACHvG,MAAAA,EAAQ4J,WAAAA;AACRE,IAAAA,WAAAA,EAAaF,YAAY9R,MAAAA,GAAS,CAAA;IAClCiS,cAAAA,EAAgB;AACd,MAAA,cAAA;AACA,MAAA,eAAA;AACA,MAAA,aAAA;AACA,MAAA,gBAAA;AACA,MAAA,UAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,gBAAA;AACA,MAAA,iBAAA;AACA,MAAA,UAAA;AACA,MAAA,YAAA;AACA,MAAA,eAAA;AACA,MAAA,gBAAA;AACA,MAAA,gBAAA;;AAEA,MAAA,YAAA;AACA,MAAA,cAAA;AACA,MAAA,0BAAA;AACA,MAAA;;IAEFC,OAAAA,EAAS;AAAC,MAAA,KAAA;AAAO,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,OAAA;AAAS,MAAA,QAAA;AAAU,MAAA;;AACrD,GAAA,CAAA,CAAA;AAIF,EAAA,MAAMC,gBAAAA,GAAAA,CAAoBlE,iBAAiB,EAAA,EAAI9F,OAAO,CAACiK,EAAAA,KAAOA,GAAGC,OAAO,CAAA;AACxE,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIJ,gBAAAA,CAAiBhO,GAAAA,CAAI,CAACiO,EAAAA,KAAO;IAACA,EAAAA,CAAGI,IAAAA;AAAMJ,IAAAA;GAAG,CAAA,CAAA;AACvE,EAAA,MAAMK,eAAAA,GAAkBN,gBAAAA,CAAiBhO,GAAAA,CAAI,CAACjB,QAAAA,KAAAA;AAC5C,IAAA,MAAMwP,YAAAA,GAAexP,QAAAA,CAASsP,IAAAA,CAAKG,OAAAA,CAAQ,WAAW,OAAA,CAAA;AACtD,IAAA,OAAO;AACLzP,MAAAA,QAAAA;AACAwP,MAAAA,YAAAA;AACAE,MAAAA,KAAAA,EAAO,IAAIC,MAAAA,CAAO,CAAA,CAAA,EAAIH,YAAAA,CAAAA,CAAAA,CAAe;AACvC,KAAA;EACF,CAAA,CAAA;AAGA,EAAA,MAAMI,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAE5B,IAAA,MAAMC,UAAAA,GAAaV,YAAAA,CAAarR,GAAAA,CAAI8R,QAAAA,CAAAA;AACpC,IAAA,IAAIC,YAAY,OAAOA,UAAAA;AAGvB,IAAA,KAAA,MAAW,EAAE9P,QAAAA,EAAU0P,KAAAA,EAAOF,YAAAA,MAAkBD,eAAAA,EAAiB;AAC/D,MAAA,MAAMQ,OAAAA,GAAUL,KAAAA,CAAMM,IAAAA,CAAKH,QAAAA,CAAAA;AAC3BtY,MAAAA,MAAAA,CAAOC,KAAAA,CACL,CAAA,kBAAA,EAAqBqY,QAAAA,CAAAA,iBAAAA,EAA4B7P,QAAAA,CAASsP,IAAI,CAAA,SAAA,EAAYE,YAAAA,CAAAA,UAAAA,EAAyBO,OAAAA,CAAAA,CAAS,CAAA;AAE9G,MAAA,IAAIA,OAAAA,EAAS;AACXxY,QAAAA,MAAAA,CAAOC,MAAM,CAAA,iBAAA,EAAoBqY,QAAAA,CAAAA,YAAAA,EAAuB7P,QAAAA,CAASsP,IAAI,CAAA,CAAE,CAAA;AACvE,QAAA,OAAOtP,QAAAA;AACT,MAAA;AACF,IAAA;AAEAzI,IAAAA,MAAAA,CAAOC,MAAM,CAAA,wCAAA,EAA2CqY,QAAAA,CAAAA,oBAAAA,EAA+BZ,gBAAAA,CAAiBnS,MAAM,CAAA,CAAE,CAAA;AAChH,IAAA,OAAOL,MAAAA;EACT,CAAA,EAnB6B,sBAAA,CAAA;AAyB7BiS,EAAAA,GAAAA,CAAIuB,SAAAA,CAAU,OAAO,EAAErS,OAAAA,EAAO,KAAE;AAC9B,IAAA,MAAMsS,GAAAA,GAAM,IAAIC,GAAAA,CAAIvS,OAAAA,CAAQsS,GAAG,CAAA;AAC/B,IAAA,MAAML,WAAWK,GAAAA,CAAIL,QAAAA;AACrBtY,IAAAA,MAAAA,CAAOC,MAAM,CAAA,oBAAA,EAAuBoG,OAAAA,CAAQwS,MAAM,CAAA,CAAA,EAAIP,QAAAA,CAAAA,CAAU,CAAA;AAChE,IAAA,MAAMQ,aAAAA,GAAgBR,QAAAA,KAAa,SAAA,IAAaA,QAAAA,CAASlQ,WAAW,UAAA,CAAA;AAGpE,IAAA,MAAM2Q,mCAAmB,MAAA,CAAA,MAAA;AACvB,MAAA,MAAMtL,MAAAA,GAASpH,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA,IAAa,GAAA;AAChD,MAAA,MAAMwS,gBAAgBpL,wBAAAA,CAAyBH,MAAAA,KAAW,GAAA,GAAM,IAAA,GAAOA,QAAQ4J,WAAAA,CAAAA;AAC/E,MAAA,MAAM9Q,OAAAA,GAAkC;QACtC,8BAAA,EAAgC,wCAAA;QAChC,8BAAA,EACE;AACJ,OAAA;AAEA,MAAA,IAAIyS,aAAAA,EAAe;AACjBzS,QAAAA,OAAAA,CAAQ,6BAAA,CAAA,GAAiCyS,aAAAA;AACzCzS,QAAAA,OAAAA,CAAQ,kCAAA,CAAA,GAAsC,MAAA;AAChD,MAAA;AAEA,MAAA,OAAOA,OAAAA;IACT,CAAA,EAfyB,kBAAA,CAAA;AAkBzB,IAAA,MAAM0S,eAAAA,GAAkBH,aAAAA,GAAgB5T,MAAAA,GAAYmT,oBAAAA,CAAqBC,QAAAA,CAAAA;AACzE,IAAA,IAAIW,eAAAA,EAAiB;AACnBjZ,MAAAA,MAAAA,CAAOC,MAAM,CAAA,oCAAA,EAAuCqY,QAAAA,CAAAA,IAAAA,EAAeW,eAAAA,CAAgBlB,IAAI,CAAA,CAAE,CAAA;AACzF,MAAA,MAAMmB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAI1S,OAAAA,CAAQwS,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBtG,MAAAA,EAAQ,GAAA;UACRtM,OAAAA,EAAS2S;SACX,CAAA;AACF,MAAA;AAGA,MAAA,IAAI7S,OAAAA,CAAQwS,MAAAA,KAAWI,eAAAA,CAAgBJ,MAAAA,EAAQ;AAC7C,QAAA,OAAO3T,MAAAA;AACT,MAAA;AAEA,MAAA,IAAI;AAEF,QAAA,MAAM0S,OAAAA,GAAU,MAAMvR,OAAAA,CAAQ+S,IAAAA,EAAI;AAGlC,QAAA,MAAMhW,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AAGnC,QAAA,MAAM2G,SAAS,MAAMiM,eAAAA,CAAgBI,OAAAA,CAAQhT,OAAAA,EAASjD,SAASwU,OAAAA,CAAAA;AAG/D,QAAA,IAAI5K,kBAAkBmM,QAAAA,EAAU;AAE9B,UAAA,MAAM5S,QAAAA,GAAU,IAAIiF,OAAAA,CAAQwB,MAAAA,CAAOzG,OAAO,CAAA;AAC1C,UAAA,KAAA,MAAW,CAACD,GAAAA,EAAKzC,KAAAA,KAAUiO,MAAAA,CAAOwH,OAAAA,CAAQJ,WAAAA,CAAAA,EAAc;AACtD3S,YAAAA,QAAAA,CAAQgT,GAAAA,CAAIjT,GAAAA,EAAKzC,KAAAA,CAAAA;AACnB,UAAA;AACA,UAAA,OAAO,IAAIsV,QAAAA,CAASnM,MAAAA,CAAOwM,IAAAA,EAAM;AAC/B3G,YAAAA,MAAAA,EAAQ7F,MAAAA,CAAO6F,MAAAA;AACf4G,YAAAA,UAAAA,EAAYzM,MAAAA,CAAOyM,UAAAA;YACnBlT,OAAAA,EAAAA;WACF,CAAA;AACF,QAAA;AAGA,QAAA,MAAMA,OAAAA,GAAU,IAAIiF,OAAAA,CAAQ;UAC1B,cAAA,EAAgB,kBAAA;UAChB,GAAG0N;SACL,CAAA;AAEA,QAAA,OAAO,IAAIC,QAAAA,CAASxY,IAAAA,CAAKE,SAAAA,CAAUmM,MAAAA,CAAAA,EAAS;UAC1C6F,MAAAA,EAAQ,GAAA;AACRtM,UAAAA;SACF,CAAA;AACF,MAAA,CAAA,CAAA,OAASzF,KAAAA,EAAO;AACdd,QAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,kCAAA,EAAqCwX,QAAAA,CAAAA,EAAAA,CAAAA,EAAcxX,KAAAA,CAAAA;AAChE,QAAA,MAAMoY,eAAcH,gBAAAA,EAAAA;AACpB,QAAA,MAAMW,SAAAA,GAAYC,gBAAgB7Y,KAAAA,EAAO;AACvC0T,UAAAA,WAAAA,EAAazU,MAAAA,CAAOyU,WAAAA;AACpBjH,UAAAA,WAAAA,EAAaxN,MAAAA,CAAOwN;SACtB,CAAA;AACA,QAAA,OAAO,IAAI4L,QAAAA,CAASxY,IAAAA,CAAKE,SAAAA,CAAU6Y,SAAAA,CAAUF,IAAI,CAAA,EAAG;AAClD3G,UAAAA,MAAAA,EAAQ6G,SAAAA,CAAU7G,MAAAA;UAClBtM,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;YAChB,GAAG2S;AACL;SACF,CAAA;AACF,MAAA;AACF,IAAA;AAUA,IAAA,IAAIZ,QAAAA,KAAa,UAAA,IAAcjS,OAAAA,CAAQwS,MAAAA,KAAW,KAAA,EAAO;AACvD,MAAA,IAAI;AACF,QAAA,MAAMe,aAAAA,GAAgB,aAAA;AACtB,QAAA,MAAMC,IAAAA,GAAQ,MAAM,OAAOD,aAAAA,CAAAA;AAI3B,QAAA,IAAI;AACFC,UAAAA,IAAAA,CAAKC,qBAAAA,CAAsB;AAAEC,YAAAA,QAAAA,EAAUF,IAAAA,CAAKE;WAAS,CAAA;QACvD,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,MAAMC,QAAAA,GAAW,MAAMH,IAAAA,CAAKE,QAAAA,CAASE,OAAAA,EAAO;AAa5C,QAAA,IAAIC,OAAAA,GAAU,EAAA;AACd,QAAA,MAAMlH,oBAAoBnE,OAAAA,EAAO;AACjC,QAAA,IAAI;AACFqL,UAAAA,OAAAA,GAAUC,kBAAAA,GAAqBC,kBAAAA,EAAkB;QACnD,CAAA,CAAA,MAAQ;AAER,QAAA;AAEA,QAAA,MAAMC,QAAAA,GAAWH,OAAAA,GAAU,CAAA,EAAGF,QAAAA;AAAaE,EAAAA,OAAAA,CAAAA,CAAAA,GAAYF,QAAAA;AACvD,QAAA,OAAO,IAAIb,SAASkB,QAAAA,EAAU;UAC5BxH,MAAAA,EAAQ,GAAA;UACRtM,OAAAA,EAAS;YACP,cAAA,EAAgBsT,IAAAA,CAAKE,SAASO,WAAAA,IAAe;AAC/C;SACF,CAAA;MACF,CAAA,CAAA,MAAQ;AAER,MAAA;AACF,IAAA;AAGA,IAAA,MAAMC,UAAAA,GAAa;AAAClE,MAAAA,eAAAA;AAAiB,MAAA,CAAA,EAAGA,eAAAA,CAAAA,CAAAA,CAAAA;AAAoB,MAAA;;AAC5D,IAAA,MAAMmE,kBAAAA,GAAqBD,UAAAA,CAAWtV,QAAAA,CAASqT,QAAAA,CAAAA;AAE/C,IAAA,IAAIkC,kBAAAA,EAAoB;AACtB,MAAA,MAAMtB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAI1S,OAAAA,CAAQwS,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBtG,MAAAA,EAAQ,GAAA;UACRtM,OAAAA,EAAS2S;SACX,CAAA;AACF,MAAA;AAGA,MAAA,MAAMuB,eAAe,MAAMC,wBAAAA,CAAyB,MAAM7D,IAAAA,CAAK8D,KAAAA,CAAMtU,OAAAA,CAAAA,EAAU;AAC7EmO,QAAAA,WAAAA,EAAazU,MAAAA,CAAOyU,WAAAA;AACpBjH,QAAAA,WAAAA,EAAaxN,MAAAA,CAAOwN;OACtB,CAAA;AAGA,MAAA,MAAMhH,OAAAA,GAAU,IAAIiF,OAAAA,CAAQiP,YAAAA,CAAalU,OAAO,CAAA;AAChD,MAAA,KAAA,MAAW,CAACD,GAAAA,EAAKzC,KAAAA,KAAUiO,MAAAA,CAAOwH,OAAAA,CAAQJ,WAAAA,CAAAA,EAAc;AACtD3S,QAAAA,OAAAA,CAAQgT,GAAAA,CAAIjT,KAAKzC,KAAAA,CAAAA;AACnB,MAAA;AAGA,MAAA,OAAO,IAAIsV,QAAAA,CAASsB,YAAAA,CAAajB,IAAAA,EAAM;AACrC3G,QAAAA,MAAAA,EAAQ4H,YAAAA,CAAa5H,MAAAA;AACrB4G,QAAAA,UAAAA,EAAYgB,YAAAA,CAAahB,UAAAA;AACzBlT,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,OAAOrB,MAAAA;EACT,CAAA,CAAA;AAGAiS,EAAAA,GAAAA,CAAIG,GAAAA,CAAIjD,qBAAAA,CAAAA;AAGR8C,EAAAA,GAAAA,CAAIG,IACFlD,oBAAAA,CAAqB;AACnBwG,IAAAA,cAAAA,EAAgB7a,OAAO6a,cAAAA,IAAkB;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW,MAAA;;IACjEC,cAAAA,EAAgB9a,MAAAA,CAAO8a,kBAAkB,EAAA;AACzCC,IAAAA,UAAAA,EAAY/a,OAAO+a,UAAAA,IAAc,KAAA;AACjCC,IAAAA,qBAAAA,EAAuBhb,OAAOgb,qBAAAA,IAAyB;AACzD,GAAA,CAAA,CAAA;AAWF,EAAA,MAAMC,cAAAA,GAAiBjb,OAAOib,cAAAA,IAAkB,OAAA;AAChD,EAAA,MAAM7I,eAAe7B,oBAAAA,CAAqB;IACxCQ,MAAAA,kBAAQ,MAAA,CAAA,MAAMzR,QAAAA,EAAN,QAAA,CAAA;AACR+R,IAAAA,MAAAA,kBAAQ,MAAA,CAAA,YAAA;AAGN,MAAA,IAAI;AACF,QAAA,MAAM,EAAE6J,eAAAA,EAAe,GAAK,MAAM,OAAO,mBAAA,CAAA;AACzC,QAAA,OAAO,MAAMA,eAAAA,EAAAA;MACf,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO/V,MAAAA;AACT,MAAA;IACF,CAAA,EATQ,QAAA,CAAA;IAUR,GAAInF,MAAAA,CAAOmb,QAAQzK,oBAAAA,GAAuB;AAAEA,MAAAA,oBAAAA,EAAsB1Q,OAAOmb,MAAAA,CAAOzK;AAAqB,KAAA,GAAI;GAC3G,CAAA;AAEA,EAAA,MAAM0K,OAAAA,mBAAU,MAAA,CAAA,MAAerI,YAAAA,CAAa/S,MAAAA,CAAOyU,WAAAA,EAAawG,cAAAA,EAAAA,iBAAgB,IAAIxW,IAAAA,EAAAA,EAAOG,WAAAA,EAAW,CAAA,EAAtF,SAAA,CAAA;AAEhB,EAAA,MAAMyW,IAAAA,iCAAcC,GAAAA,KAAAA;AAClB,IAAA,MAAMhJ,QAAAA,GAAW,MAAMF,YAAAA,EAAAA;AACvB,IAAA,MAAMmJ,UAAAA,GAAaD,GAAAA;AACnB,IAAA,MAAME,IAAAA,GAAOhJ,oBAAoBF,QAAAA,CAAAA;AACjC,IAAA,IAAIiJ,UAAAA,CAAW/B,GAAAA,EAAK+B,UAAAA,CAAW/B,GAAAA,CAAI1G,MAAAA,GAAS0I,IAAAA;AAC5C,IAAA,OAAO/I,aAAAA,CACLH,QAAAA,EACAtS,MAAAA,CAAOyU,WAAAA,EACPwG,iCACA,IAAIxW,IAAAA,EAAAA,EAAOG,WAAAA,IACX6W,IAAAA,CAAKC,KAAAA,CAAMrU,OAAAA,CAAQsU,MAAAA,EAAM,CAAA,CAAA;EAE7B,CAAA,EAZa,MAAA,CAAA;AAcbvE,EAAAA,GAAAA,CAAI3Q,GAAAA,CAAI,WAAW4U,IAAAA,CAAAA;AACnBjE,EAAAA,GAAAA,CAAI3Q,GAAAA,CAAI,gBAAgB2U,OAAAA,CAAAA;AACxBhE,EAAAA,GAAAA,CAAI3Q,GAAAA,CAAI,iBAAiB4U,IAAAA,CAAAA;AACzBjE,EAAAA,GAAAA,CAAI3Q,GAAAA,CAAI,mBAAmB2U,OAAAA,CAAAA;AAG3B,EAAA,IAAI5H,WAAAA,EAAa;AAEf4D,IAAAA,GAAAA,CAAI3Q,IAAI,mBAAA,EAAqB,OAAO,EAAEH,OAAAA,EAASkT,KAAG,KAAE;AAClD,MAAA,MAAMnW,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0H,oBAAAA,CAAqB3K,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCsW,QAAAA,GAAAA,CAAI1G,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE/R,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,OAAOyS,YAAYoI,SAAAA,EAAS;IAC9B,CAAA,CAAA;AAGAxE,IAAAA,GAAAA,CAAI3Q,IAAI,mBAAA,EAAqB,OAAO,EAAEoV,KAAAA,EAAOvV,OAAAA,EAASkT,KAAG,KAAE;AACzD,MAAA,MAAMnW,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0H,oBAAAA,CAAqB3K,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCsW,QAAAA,GAAAA,CAAI1G,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE/R,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEoK,cAAAA,EAAgB/K,WAAAA,EAAW,GAAKyb,KAAAA;AACxC,MAAA,OAAOrI,WAAAA,CAAYsI,SAAAA,CAAU3Q,cAAAA,EAAgB/K,WAAAA,CAAAA;IAC/C,CAAA,CAAA;AAGAgX,IAAAA,GAAAA,CAAI3Q,IAAI,qBAAA,EAAuB,OAAO,EAAEoV,KAAAA,EAAOvV,OAAAA,EAASkT,KAAG,KAAE;AAC3D,MAAA,MAAMnW,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0H,oBAAAA,CAAqB3K,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCsW,QAAAA,GAAAA,CAAI1G,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE/R,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEoK,cAAAA,EAAgB/K,WAAAA,EAAa2b,KAAAA,EAAK,GAAKF,KAAAA;AAK/C,MAAA,MAAMG,WAAAA,GAAcD,KAAAA,EAAOlU,KAAAA,CAAM,GAAA,CAAA,CAAK8B,IAAI,CAACa,CAAAA,KAAMA,CAAAA,CAAE1C,IAAAA,EAAI,CAAA;AACvD,MAAA,OAAO0L,WAAAA,CAAYyI,cAAAA,CAAe9Q,cAAAA,EAAgB/K,WAAAA,EAAa4b,WAAAA,CAAAA;IACjE,CAAA,CAAA;AAGA5E,IAAAA,GAAAA,CAAI3Q,IAAI,0BAAA,EAA4B,OAAO,EAAEoV,KAAAA,EAAOvV,OAAAA,EAASkT,KAAG,KAAE;AAChE,MAAA,MAAMnW,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0H,oBAAAA,CAAqB3K,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCsW,QAAAA,GAAAA,CAAI1G,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE/R,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEoK,cAAAA,EAAgB/K,WAAAA,EAAW,GAAKyb,KAAAA;AACxC,MAAA,OAAOrI,WAAAA,CAAY0I,mBAAAA,CAAoB/Q,cAAAA,EAAgB/K,WAAAA,CAAAA;IACzD,CAAA,CAAA;AACF,EAAA;AAGA,EAAA,IAAIqT,aAAAA,IAAiBA,aAAAA,CAAcjO,MAAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,KAAA,MAAWkD,YAAY+K,aAAAA,EAAe;AAEpC,MAAA,IAAI/K,SAASmP,OAAAA,EAAS;AACpB5X,QAAAA,MAAAA,CAAOuU,KAAK,CAAA,uCAAA,EAA0C9L,QAAAA,CAASoQ,MAAM,CAAA,CAAA,EAAIpQ,QAAAA,CAASsP,IAAI,CAAA,CAAE,CAAA;AACxF,QAAA;AACF,MAAA;AAEA,MAAA,MAAMsB,OAAAA,mBAAU,MAAA,CAAA,OAAO,EAAEhT,OAAAA,EAAO,KAAwB;AACtD,QAAA,IAAI;AACF,UAAA,MAAMjD,OAAAA,GAAU,MAAMwG,YAAAA,CAAavD,OAAAA,CAAAA;AACnC,UAAA,OAAO,MAAMoC,QAAAA,CAAS4Q,OAAAA,CAAQhT,OAAAA,EAASjD,OAAAA,CAAAA;AACzC,QAAA,CAAA,CAAA,OAAStC,KAAAA,EAAO;AACdd,UAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,8BAAA,EAAiC2H,QAAAA,CAASsP,IAAI,MAAMjX,KAAAA,CAAAA;AACjE,UAAA,OAAOob,wBAAwBpb,KAAAA,EAAO;AACpC0T,YAAAA,WAAAA,EAAazU,MAAAA,CAAOyU,WAAAA;AACpBjH,YAAAA,WAAAA,EAAaxN,MAAAA,CAAOwN;WACtB,CAAA;AACF,QAAA;MACF,CAAA,EAXgB,SAAA,CAAA;AAahB,MAAA,QAAQ9E,SAASoQ,MAAAA;QACf,KAAK,KAAA;AACH1B,UAAAA,GAAAA,CAAI3Q,GAAAA,CAAIiC,QAAAA,CAASsP,IAAAA,EAAMsB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,MAAA;AACHlC,UAAAA,GAAAA,CAAIgF,IAAAA,CAAK1T,QAAAA,CAASsP,IAAAA,EAAMsB,OAAAA,CAAAA;AACxB,UAAA;QACF,KAAK,KAAA;AACHlC,UAAAA,GAAAA,CAAIiF,GAAAA,CAAI3T,QAAAA,CAASsP,IAAAA,EAAMsB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,OAAA;AACHlC,UAAAA,GAAAA,CAAIkF,KAAAA,CAAM5T,QAAAA,CAASsP,IAAAA,EAAMsB,OAAAA,CAAAA;AACzB,UAAA;QACF,KAAK,QAAA;AACHlC,UAAAA,GAAAA,CAAImF,MAAAA,CAAO7T,QAAAA,CAASsP,IAAAA,EAAMsB,OAAAA,CAAAA;AAC1B,UAAA;AACJ;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAMkD,IAAAA,GAAOxc,OAAOwc,IAAAA,IAAQ,SAAA;AAC5B,EAAA,MAAMC,OAAOzc,MAAAA,CAAOyc,IAAAA;AAGpB,EAAA,MAAMC,cAAAA,GAAiC;AACrCtF,IAAAA,GAAAA;IACAuF,MAAAA,EAAQ,IAAA;AACRC,IAAAA,KAAAA,kBAAO,MAAA,CAAA,YAAA;AACL5J,MAAAA,eAAAA,uBAAsBvO,IAAAA,EAAAA;AAGtB2S,MAAAA,GAAAA,CAAIyF,MAAAA,CAAO;AACTJ,QAAAA,IAAAA;QACAK,QAAAA,EAAUN;OACZ,CAAA;AAIA,MAAA,MAAMO,SAAAA,GAAY3F,GAAAA;AAClBsF,MAAAA,cAAAA,CAAeC,SAASI,SAAAA,CAAUJ,MAAAA;AAElC1c,MAAAA,MAAAA,CAAOuU,IAAAA,CAAK,CAAA,UAAA,EAAMxU,MAAAA,CAAOyU,WAAW,CAAA,sBAAA,EAAyB+H,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,CAAAA,EAAOnG,eAAAA,CAAAA,CAAiB,CAAA;IAC/F,CAAA,EAfO,OAAA,CAAA;AAgBP0G,IAAAA,IAAAA,kBAAM,MAAA,CAAA,YAAA;AACJ/c,MAAAA,MAAAA,CAAOuU,IAAAA,CAAK,CAAA,kBAAA,EAAqBxU,MAAAA,CAAOyU,WAAW,CAAA,GAAA,CAAK,CAAA;AAExD,MAAA,IAAIX,UAAAA,EAAY;AACd,QAAA,MAAMA,UAAAA,EAAAA;AACR,MAAA;AAEA,MAAA,IAAIN,WAAAA,EAAa;AACf,QAAA,MAAMA,YAAYyJ,QAAAA,EAAQ;AAC5B,MAAA;AAEA,MAAA,MAAM7I,kBAAAA,GAAqB8I,UAAAA,EAAU;AAErC,MAAA,IAAIR,eAAeC,MAAAA,EAAQ;AACzBD,QAAAA,cAAAA,CAAeC,OAAOK,IAAAA,EAAI;AAC5B,MAAA;AAEA/c,MAAAA,MAAAA,CAAOuU,IAAAA,CAAK,CAAA,SAAA,EAAYxU,MAAAA,CAAOyU,WAAW,CAAA,QAAA,CAAU,CAAA;IACtD,CAAA,EAlBM,MAAA,CAAA;AAmBN0I,IAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAA;AACP,MAAA,MAAMxB,MAAAA,GAAS3I,eAAAA,GAAkByI,IAAAA,CAAK2B,KAAAA,CAAAA,CAAO3Y,IAAAA,CAAKO,GAAAA,EAAG,GAAKgO,eAAAA,CAAgBzN,OAAAA,EAAO,IAAM,GAAA,CAAA,GAAQ,CAAA;AAE/F,MAAA,OAAO;AACLkP,QAAAA,WAAAA,EAAazU,MAAAA,CAAOyU,WAAAA;AACpBwG,QAAAA,cAAAA,EAAgBjb,OAAOib,cAAAA,IAAkB,OAAA;AACzCzN,QAAAA,WAAAA,EAAaxN,OAAOwN,WAAAA,IAAe,aAAA;AACnCiP,QAAAA,IAAAA;AACAD,QAAAA,IAAAA;AACAlG,QAAAA,eAAAA;QACA+G,SAAAA,EAAWrK,eAAAA,EAAiBpO,aAAAA,IAAiB,EAAA;AAC7C+W,QAAAA;AACF,OAAA;IACF,CAAA,EAbS,SAAA;AAcX,GAAA;AAGA,EAAA,MAAM2B,gBAAAA,iCAA0BC,MAAAA,KAAAA;AAC9Btd,IAAAA,MAAAA,CAAOuU,IAAAA,CAAK,CAAA,SAAA,EAAY+I,MAAAA,CAAAA,sCAAAA,CAA8C,CAAA;AACtE,IAAA,MAAMb,eAAeM,IAAAA,EAAI;AACzB3V,IAAAA,OAAAA,CAAQmW,KAAK,CAAA,CAAA;EACf,CAAA,EAJyB,kBAAA,CAAA;AAMzBnW,EAAAA,OAAAA,CAAQoW,EAAAA,CAAG,WAAW,MAAA;AACpB,IAAA,KAAKH,iBAAiB,SAAA,CAAA;EACxB,CAAA,CAAA;AACAjW,EAAAA,OAAAA,CAAQoW,EAAAA,CAAG,UAAU,MAAA;AACnB,IAAA,KAAKH,iBAAiB,QAAA,CAAA;EACxB,CAAA,CAAA;AAEA,EAAA,OAAOZ,cAAAA;AACT;AApoBsBtJ,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA2oBf,SAASsK,oBAAoBvd,qBAAAA,EAA4C;AAC9EJ,EAAAA,aAAAA,CAAc;IAAEI,oBAAAA,EAAAA;GAAqB,CAAA;AACvC;AAFgBud,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * Server Auth Module\n *\n * JWT verification with workspace secret fetching for microservices.\n * Handles HS256 tokens with secrets stored in workspace database.\n */\n\nimport { logger } from '../logger/index.js';\nimport type { IActor, JWTPayload, WorkspaceSecret } from './types.js';\n\n// Type imports from packages\nimport type * as jose from 'jose';\nimport type { VerifyOptions, Jwt, JwtPayload } from 'jsonwebtoken';\n\n/**\n * Workspace model interface for fetching JWT secrets\n */\ninterface WorkspaceModel {\n  findUnique: (args: { where: { id: string } }) => Promise<{ jwtSecret?: unknown } | null>;\n}\n\ninterface DbClient {\n  client: {\n    workspace: WorkspaceModel;\n  };\n}\n\n// Import getDb dynamically to avoid circular dependencies\nlet getDbFn: (() => DbClient) | null = null;\n\nasync function getDb(): Promise<DbClient> {\n  if (!getDbFn) {\n    const prismaModule = await import('../prisma/index.js');\n    // Use unknown first then cast to avoid type inference issues\n    getDbFn = prismaModule.getDb as unknown as () => DbClient;\n  }\n  return getDbFn();\n}\n\n// Interface for the subset of jsonwebtoken we use\ninterface JwtModule {\n  decode(token: string, options?: { complete?: boolean }): string | Jwt | JwtPayload | null;\n  verify(token: string, secretOrPublicKey: string, options?: VerifyOptions): string | JwtPayload;\n}\n\n// Module cache for dynamic imports\nlet joseModule: typeof jose | null = null;\nlet jwtModule: JwtModule | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\nasync function getJwt(): Promise<JwtModule> {\n  if (!jwtModule) {\n    const jwt = await import('jsonwebtoken');\n    // Handle both ESM and CJS module formats\n    jwtModule = (jwt as { default?: JwtModule }).default ?? jwt;\n  }\n  return jwtModule;\n}\n\n/**\n * Fetch workspace secret callback type\n */\nexport type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig {\n  /** Function to fetch workspace JWT secret from database */\n  fetchWorkspaceSecret: FetchWorkspaceSecretFn;\n}\n\nlet authConfig: AuthConfig | null = null;\n\n/**\n * Configure auth module with workspace secret fetching\n */\nexport function configureAuth(config: AuthConfig): void {\n  authConfig = config;\n  logger.debug('[ServerAuth] Auth configured');\n}\n\n/**\n * Default workspace secret fetcher\n *\n * Fetches JWT secret from workspace database. This is the standard implementation\n * that works with any microservice that has access to the workspace model.\n *\n * @param workspaceId - Workspace ID from JWT\n * @returns WorkspaceSecret or null if not found\n */\nexport async function fetchWorkspaceSecret(workspaceId: string): Promise<WorkspaceSecret | null> {\n  try {\n    const db = await getDb();\n    const workspace = await db.client.workspace.findUnique({\n      where: { id: workspaceId },\n    });\n\n    if (!workspace?.jwtSecret) {\n      logger.debug('[ServerAuth] No JWT secret found for workspace', { workspaceId });\n      return null;\n    }\n\n    return JSON.parse(JSON.stringify(workspace.jwtSecret)) as WorkspaceSecret;\n  } catch (error) {\n    logger.warn('[ServerAuth] Error fetching workspace secret', { workspaceId, error });\n    return null;\n  }\n}\n\n/**\n * Configure auth with default workspace secret fetcher\n *\n * This is automatically called by createServer if no custom auth is configured.\n */\nexport function configureDefaultAuth(): void {\n  if (!authConfig) {\n    configureAuth({ fetchWorkspaceSecret });\n    logger.debug('[ServerAuth] Default auth configured with built-in workspace secret fetcher');\n  }\n}\n\n/**\n * Generate a symmetric secret key for JWT signing\n * @returns JWK object with the generated key\n */\nexport async function generateSymmetricSecret(): Promise<jose.JWK> {\n  const joseLib = await getJose();\n  const secret = await joseLib.generateSecret('HS256');\n  const jwk = await joseLib.exportJWK(secret);\n  return jwk;\n}\n\n/**\n * Verify JWT token for workspace-scoped authentication\n *\n * @param token - JWT token to verify\n * @param secret - Optional secret for verification (if not provided, fetches from workspace)\n * @param options - JWT verification options\n * @returns Verified actor information or null if invalid\n */\nexport async function verifyJWT(token: string, secret?: string, options: VerifyOptions = {}): Promise<IActor | null> {\n  try {\n    const jwt = await getJwt();\n    const joseLib = await getJose();\n\n    // Decode to check algorithm and extract workspace_id\n    const decoded = jwt.decode(token, { complete: true });\n\n    if (!decoded || typeof decoded === 'string' || !decoded.payload || typeof decoded.payload !== 'object') {\n      logger.warn('[ServerAuth] Invalid token format');\n      return null;\n    }\n\n    // For workspace-scoped HS256 tokens\n    if (secret) {\n      // Use provided secret\n      const verifiedJwt = jwt.verify(token, secret, options) as JWTPayload;\n      return mapPayloadToActor(verifiedJwt);\n    }\n\n    // Fetch secret from workspace database\n    const decodedJwt = joseLib.decodeJwt(token) as JWTPayload;\n    if (!decodedJwt.workspace_id) {\n      logger.warn('[ServerAuth] No workspace_id found in token');\n      return null;\n    }\n\n    if (!authConfig?.fetchWorkspaceSecret) {\n      logger.error('[ServerAuth] Auth not configured - call configureAuth() first');\n      return null;\n    }\n\n    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);\n    if (!workspaceSecret) {\n      logger.warn('[ServerAuth] Workspace secret not found');\n      return null;\n    }\n\n    const keyLikeSecret = await joseLib.importJWK(workspaceSecret, 'HS256');\n    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options as jose.JWTVerifyOptions);\n    return mapPayloadToActor(verifiedJwt.payload as unknown as JWTPayload);\n  } catch (err) {\n    logger.warn('[ServerAuth] Error verifying JWT:', err);\n    return null;\n  }\n}\n\n/**\n * Decode JWT without verification (for extracting claims)\n */\nexport async function decodeJWT(token: string): Promise<JWTPayload | null> {\n  try {\n    const joseLib = await getJose();\n    return joseLib.decodeJwt(token);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Map JWT payload to IActor interface\n */\nfunction mapPayloadToActor(payload: JWTPayload): IActor {\n  return {\n    id: payload.sub,\n    type: payload.actor_type ?? 'user',\n    workspace_id: payload.workspace_id,\n    tenant_id: payload.tenant_id,\n    org_id: payload.org_id,\n    isAdmin: payload['isAdmin'] as boolean | undefined,\n  };\n}\n\n/**\n * Check if actor is authenticated\n */\nexport function authCheck(actor: IActor | null): IActor {\n  if (!actor) {\n    throw new Error('Please sign in');\n  }\n  return actor;\n}\n\n/**\n * Check workspace context and return actor ID and workspace ID\n */\nexport function workspaceCheck(context: { actor: IActor | null; workspace: { id: string } | null }): {\n  actorId: string;\n  workspaceId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  return {\n    actorId: actor.id,\n    workspaceId: context.workspace.id,\n  };\n}\n\n/**\n * Require workspace context - type narrowing guard for wspace layer services\n *\n * Validates that both actor and workspace are present in the context,\n * and returns a type-narrowed context where workspace and actor are guaranteed non-null.\n * Use this at the start of resolvers in wspace services to get typed access\n * to workspace context without optional chaining.\n *\n * @throws Error if actor is not authenticated\n * @throws Error if workspace context is missing\n *\n * @example\n * ```typescript\n * // In a resolver:\n * const ctx = requireWorkspace(context);\n * const workspaceId = ctx.workspace.id;  // no optional chaining needed\n * const actorId = ctx.actor.id;          // no optional chaining needed\n * ```\n */\nexport function requireWorkspace<T extends { actor: IActor | null; workspace: { id: string } | null }>(\n  context: T\n): T & { actor: IActor; workspace: { id: string } } {\n  // Validate actor is authenticated (throws if null)\n  authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  // Return the same context object with narrowed types\n  return context as T & { actor: IActor; workspace: { id: string } };\n}\n\n/**\n * Check organization context and return actor ID and org ID\n */\nexport function orgCheck(context: { actor: IActor | null; organization: { id: string } | null }): {\n  actorId: string;\n  orgId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.organization?.id) {\n    throw new Error('Please switch to an organization');\n  }\n\n  return {\n    actorId: actor.id,\n    orgId: context.organization.id,\n  };\n}\n\n/**\n * Check tenant context and return tenant ID\n */\nexport function tenantCheck(context: { tenant: { id: string } | null }): string {\n  if (!context.tenant?.id) {\n    throw new Error('Tenant context is required');\n  }\n  return context.tenant.id;\n}\n\n/**\n * Get effective actor ID for \"on behalf of\" tracking\n *\n * When an app or service acts with user consent, returns the delegating user's ID.\n * Otherwise returns the direct actor ID.\n *\n * This is used to determine the `onBehalfOf` field in database audit trails:\n * - If actor is user → returns user ID (self-action)\n * - If actor is app/service with consent → returns grantedBy user ID\n * - If actor is app/service without consent → returns actor ID (self-action)\n *\n * @param context - GraphQL context with actor and optional consent context\n * @returns Effective actor ID (the responsible principal)\n *\n * @example\n * ```typescript\n * // User acting directly\n * context.actor = { id: \"user-123\", type: \"user\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"user-123\"\n *\n * // Bot acting on behalf of user\n * context.actor = { id: \"bot-456\", type: \"service\" }\n * context.consentContext = { grantedBy: \"user-789\" }\n * getEffectiveActorId(context) // → \"user-789\"\n *\n * // App acting without consent (self-action)\n * context.actor = { id: \"app-abc\", type: \"app\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"app-abc\"\n * ```\n */\nexport function getEffectiveActorId(context: {\n  actor: IActor | null;\n  consentContext?: { grantedBy: string } | null;\n}): string | null {\n  if (!context.actor) {\n    return null;\n  }\n\n  // If actor is app or service acting with user consent, return the delegating user\n  if (\n    (context.actor.type === 'app' || context.actor.type === 'service' || context.actor.type === 'service_account') &&\n    context.consentContext?.grantedBy\n  ) {\n    return context.consentContext.grantedBy;\n  }\n\n  // Otherwise return the direct actor (user self-action or app/service self-action)\n  return context.actor.id;\n}\n","import type { IActor, VerifiedDelegationContext } from './types.js';\n\n// Structural narrowing permits inspecting unknown properties without trusting their values.\nfunction object(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction identifier(value: unknown): value is string {\n  return (\n    typeof value === 'string' &&\n    value['length'] > 0 &&\n    value['length'] <= 200 &&\n    value['trim']() === value &&\n    Array.from(value).every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127)\n  );\n}\n\nfunction list(value: unknown): value is string[] {\n  return Array.isArray(value) && value['length'] <= 1000 && value['every'](identifier);\n}\n\nfunction instant(value: unknown): Date | null {\n  if (typeof value !== 'string') return null;\n  const time = Date.parse(value);\n  return Number.isFinite(time) && new Date(time).toISOString() === value ? new Date(time) : null;\n}\n\n/** Decodes transport only; JWT verification remains the gateway's responsibility. */\nexport function decodeVerifiedDelegation(\n  header: string | undefined,\n  actor: IActor | null,\n  workspaceId: string | undefined,\n  trustedGateway: boolean,\n  now = Date.now()\n): VerifiedDelegationContext | undefined {\n  if (\n    !trustedGateway ||\n    !actor ||\n    actor.provenance !== 'delegated' ||\n    !['user', 'super_admin'].includes(actor.type) ||\n    header === undefined\n  )\n    return undefined;\n  const invalid = () => new Error('Invalid verified delegation context');\n  let raw: unknown;\n  try {\n    raw = JSON.parse(header);\n  } catch {\n    throw invalid();\n  }\n  const value = object(raw);\n  const tokenExpiresAt = instant(value?.['tokenExpiresAt']);\n  if (\n    !value ||\n    !identifier(value['representedUserId']) ||\n    value['representedUserId'] !== actor.id ||\n    !identifier(value['originatingAppId']) ||\n    !identifier(value['delegationId']) ||\n    !list(value['scopes']) ||\n    !list(value['allowedWorkspaceIds']) ||\n    !tokenExpiresAt ||\n    tokenExpiresAt.getTime() <= now ||\n    (workspaceId && value['allowedWorkspaceIds'].length > 0 && !value['allowedWorkspaceIds'].includes(workspaceId))\n  )\n    throw invalid();\n  let consent: VerifiedDelegationContext['consent'] = null;\n  if (value['consent'] !== null) {\n    const facts = object(value['consent']);\n    const grantedAt = instant(facts?.['grantedAt']);\n    const expiresAt = facts?.['expiresAt'] === null ? null : instant(facts?.['expiresAt']);\n    if (\n      !facts ||\n      !identifier(facts['grantedBy']) ||\n      !grantedAt ||\n      grantedAt.getTime() > now ||\n      (facts['expiresAt'] !== null &&\n        (!expiresAt || expiresAt.getTime() <= grantedAt.getTime() || tokenExpiresAt.getTime() > expiresAt.getTime()))\n    )\n      throw invalid();\n    consent = { grantedBy: facts['grantedBy'], grantedAt, expiresAt };\n  }\n  return {\n    representedUserId: value['representedUserId'],\n    originatingAppId: value['originatingAppId'],\n    delegationId: value['delegationId'],\n    scopes: [...value['scopes']],\n    allowedWorkspaceIds: [...value['allowedWorkspaceIds']],\n    tokenExpiresAt,\n    consent,\n  };\n}\n","/**\n * Server Context Module\n *\n * Builds GraphQL context from request headers, JWT, and configuration.\n * Automatically populates actor, tenant, workspace, and tracking information.\n *\n * **Actor-Based Authentication:**\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Services verify JWT directly and build actor from payload\n *\n * Uses standard Web API Request (compatible with Bun/Elysia).\n */\n\nimport { logger } from '../logger/index.js';\nimport crypto from 'node:crypto';\nimport { verifyJWT } from './auth.js';\nimport { decodeVerifiedDelegation } from './verified-delegation.js';\nimport type {\n  GraphQLContext,\n  ActorProvenance,\n  IActor,\n  ITenant,\n  IOrganization,\n  IWorkspace,\n  IProject,\n  IProduct,\n  ITracking,\n} from './types.js';\nimport type { I18n, I18nContext } from '../i18n/index.js';\nimport { setWorkspaceContext } from '../prisma/workspace-extension.js';\nimport { ContextManager } from '../context/index.js';\n\n/**\n * Context builder options\n */\nexport interface ContextBuilderOptions {\n  /** Database getter function */\n  getDb: () => unknown;\n  /** Default tenant info (optional) */\n  defaultTenant?: ITenant;\n  /** I18n instance (optional) */\n  i18n?: I18n;\n}\n\nlet contextOptions: ContextBuilderOptions | null = null;\n\n/**\n * Configure context builder\n */\nexport function configureContext(options: ContextBuilderOptions): void {\n  contextOptions = options;\n  logger.debug('[ServerContext] Context builder configured');\n}\n\n/**\n * Extract header value from standard Web API Request\n */\nfunction getHeader(request: Request, key: string): string | undefined {\n  return request.headers.get(key.toLowerCase()) ?? undefined;\n}\n\nfunction compareSecret(provided: string, expected: string): boolean {\n  const providedBuffer = Buffer.from(provided);\n  const expectedBuffer = Buffer.from(expected);\n\n  if (providedBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);\n}\n\nexport function shouldTrustActorHeaders(\n  request: Request,\n  nodeEnv: string | undefined = process.env['NODE_ENV'],\n  expectedGatewayToken: string | undefined = process.env['TRUSTED_GATEWAY_TOKEN'] ??\n    process.env['INTERNAL_SERVICE_TOKEN']\n): boolean {\n  if (!getHeader(request, 'x-actor-id')) {\n    return false;\n  }\n\n  if (nodeEnv === 'production') {\n    return true;\n  }\n\n  const providedGatewayToken =\n    getHeader(request, 'x-internal-service-token') || getHeader(request, 'x-gateway-auth-token');\n  if (!expectedGatewayToken || !providedGatewayToken) {\n    return false;\n  }\n\n  return compareSecret(providedGatewayToken, expectedGatewayToken);\n}\n\n/**\n * Extract tracking information from request\n */\nfunction extractTracking(request: Request): ITracking {\n  // Get IP from various possible headers\n  const forwardedFor = getHeader(request, 'x-forwarded-for');\n  const realIp = getHeader(request, 'x-real-ip');\n  const ip = forwardedFor?.split(',')[0]?.trim() || realIp || undefined;\n\n  return {\n    ip,\n    userAgent: getHeader(request, 'user-agent'),\n  };\n}\n\n/**\n * Extract actor from gateway-injected headers or authorization header\n *\n * **Actor-Based Authentication:**\n * - If x-actor-id header exists, trust it (gateway-authenticated)\n * - Otherwise fall back to JWT verification (direct access in dev)\n *\n * This allows:\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Direct service access with JWT → service verifies JWT itself\n * - Development testing: Direct headers → service trusts headers\n */\nfunction actorProvenance(request: Request): ActorProvenance {\n  const value = getHeader(request, 'x-verified-actor-provenance');\n  return value === 'direct_human' || value === 'delegated' || value === 'non_human' ? value : 'unknown';\n}\n\nasync function extractActor(request: Request): Promise<IActor | null> {\n  // Check for gateway-injected actor headers first\n  const actorId = getHeader(request, 'x-actor-id');\n\n  if (actorId && shouldTrustActorHeaders(request)) {\n    // Gateway has already verified JWT and populated context headers\n    // Trust the headers (gateway is the security perimeter)\n    logger.debug('[ServerContext] Using gateway-authenticated actor from headers');\n\n    const actorType = getHeader(request, 'x-actor-type') || 'user';\n    const userRole = getHeader(request, 'x-user-role');\n\n    return {\n      id: actorId,\n      type: actorType,\n      provenance: actorProvenance(request),\n      workspace_id: getHeader(request, 'x-workspace-id'),\n      tenant_id: getHeader(request, 'x-tenant-id'),\n      org_id: getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id'),\n      isAdmin:\n        actorType === 'super_admin' ||\n        userRole === 'TENANT_ADMIN' ||\n        userRole === 'SUPER_ADMIN' ||\n        userRole === 'PLATFORM_ADMIN',\n    };\n  }\n\n  if (actorId) {\n    logger.warn('[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification');\n  }\n\n  // FALLBACK: No gateway headers, verify JWT directly (dev/testing mode)\n  const authHeader = getHeader(request, 'authorization');\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.substring(7);\n\n  try {\n    logger.debug('[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)');\n    const payload = await verifyJWT(token);\n\n    if (!payload) {\n      return null;\n    }\n\n    // Build actor from JWT payload\n    return {\n      id: payload.id,\n      type: 'user', // Default to 'user' if not specified\n      provenance: 'unknown', // Development fallback does not attest gateway provenance.\n      workspace_id: payload.workspace_id,\n    };\n  } catch (error) {\n    logger.warn('[ServerContext] Invalid JWT token:', error);\n    return null;\n  }\n}\n\n/**\n * Extract tenant from headers\n */\nfunction extractTenant(request: Request): ITenant | null {\n  // Check headers\n  const tenantId = getHeader(request, 'x-tenant-id');\n  const tenantEndpoint = getHeader(request, 'x-tenant-endpoint');\n\n  if (tenantId) {\n    return {\n      id: tenantId,\n      endpoint: tenantEndpoint || '',\n    };\n  }\n\n  // Fall back to default tenant if configured\n  return contextOptions?.defaultTenant || null;\n}\n\n/**\n * Extract organization from headers\n */\nfunction extractOrganization(request: Request): IOrganization | null {\n  const orgId = getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id');\n\n  if (orgId) {\n    return { id: orgId };\n  }\n\n  return null;\n}\n\n/**\n * Extract workspace from headers or actor\n */\nfunction extractWorkspace(request: Request, actor: IActor | null): IWorkspace | null {\n  // Check headers first\n  const workspaceId = getHeader(request, 'x-workspace-id');\n\n  if (workspaceId) {\n    return { id: workspaceId };\n  }\n\n  // Fall back to workspace_id from actor\n  if (actor?.workspace_id) {\n    return { id: actor.workspace_id };\n  }\n\n  return null;\n}\n\n/**\n * Extract project from headers\n */\nfunction extractProject(request: Request): IProject | null {\n  const projectId = getHeader(request, 'x-project-id');\n\n  if (projectId) {\n    return { id: projectId };\n  }\n\n  return null;\n}\n\n/**\n * Extract product from headers\n */\nfunction extractProduct(request: Request): IProduct | null {\n  const productId = getHeader(request, 'x-product-id');\n\n  if (productId) {\n    return { id: productId };\n  }\n\n  return null;\n}\n\n/**\n * Extract geography context from headers\n *\n * Geography headers carry the user's selected location context,\n * used for currency defaults, tax calculations, payment routing,\n * data residency, and regional support.\n *\n * Headers:\n * - x-geo-country: ISO 3166-1 alpha-2 country code (e.g., 'IN', 'US', 'DE')\n * - x-geo-currency: ISO 4217 currency code (e.g., 'INR', 'USD', 'EUR')\n * - x-geo-timezone: IANA timezone (e.g., 'Asia/Kolkata', 'America/New_York')\n */\nfunction extractGeography(request: Request): { country?: string; currency?: string; timezone?: string } {\n  const country = getHeader(request, 'x-geo-country');\n  const currency = getHeader(request, 'x-geo-currency');\n  const timezone = getHeader(request, 'x-geo-timezone');\n\n  return {\n    country: country?.toUpperCase() || undefined,\n    currency: currency?.toUpperCase() || undefined,\n    timezone: timezone || undefined,\n  };\n}\n\n/**\n * Extract consent context from headers\n *\n * When an app or service acts on behalf of a user (with user consent),\n * the gateway forwards consent headers. This function extracts them.\n *\n * Headers:\n * - x-consent-granted-by: Actor ID who granted consent (delegating user)\n * - x-consent-scope: Comma-separated scopes\n * - x-consent-granted-at: ISO timestamp when consent was granted\n * - x-consent-expires-at: ISO timestamp when consent expires\n */\nfunction extractConsentContext(request: Request): import('./types.js').ConsentContext | null {\n  const grantedBy = getHeader(request, 'x-consent-granted-by');\n\n  // If no grantedBy, there's no consent delegation\n  if (!grantedBy) {\n    return null;\n  }\n\n  const scopesHeader = getHeader(request, 'x-consent-scope');\n  const grantedAtHeader = getHeader(request, 'x-consent-granted-at');\n  const expiresAtHeader = getHeader(request, 'x-consent-expires-at');\n\n  return {\n    grantedBy,\n    scopes: scopesHeader ? scopesHeader.split(',').map((s) => s.trim()) : undefined,\n    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : undefined,\n    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : undefined,\n  };\n}\n\n/**\n * Build GraphQL context from standard Web Request\n *\n * Also sets the workspace context in AsyncLocalStorage for automatic\n * Prisma workspaceId injection via the workspace extension.\n */\nexport async function buildContext(request: Request): Promise<GraphQLContext> {\n  if (!contextOptions) {\n    throw new Error('[ServerContext] Context not configured - call configureContext() first');\n  }\n\n  // Extract actor from headers/JWT\n  const actor = await extractActor(request);\n\n  // Extract all context parts\n  const tenant = extractTenant(request);\n  const organization = extractOrganization(request);\n  const workspace = extractWorkspace(request, actor);\n  const project = extractProject(request);\n  const product = extractProduct(request);\n  const tracking = extractTracking(request);\n  const consentContext = extractConsentContext(request);\n  const verifiedDelegation = decodeVerifiedDelegation(\n    getHeader(request, 'x-verified-delegation'),\n    actor,\n    workspace?.id,\n    shouldTrustActorHeaders(request)\n  );\n\n  // Build i18n context if configured\n  let i18n: I18nContext | undefined;\n  if (contextOptions.i18n) {\n    i18n = contextOptions.i18n.createContextFromRequest(request);\n  }\n\n  // Merge geography context from x-geo-* headers into i18n\n  const geo = extractGeography(request);\n  if (geo.country || geo.currency || geo.timezone) {\n    if (i18n) {\n      // Merge geography fields into existing i18n context\n      if (geo.country) i18n.country = geo.country;\n      if (geo.currency) i18n.currency = geo.currency;\n      if (geo.timezone) i18n.timezone = geo.timezone;\n    } else {\n      // Create minimal i18n context with geography only (when i18n module not configured)\n      i18n = {\n        locale: 'en-US',\n        language: 'en',\n        country: geo.country,\n        currency: geo.currency,\n        timezone: geo.timezone,\n        t: (key: string) => key,\n        tp: (key: string) => key,\n        formatNumber: (value: number) => String(value),\n        formatCurrency: (value: number, currency: string) => `${currency} ${value}`,\n        formatDate: (date: Date | string) => String(date),\n        formatRelativeTime: (value: number, unit: Intl.RelativeTimeFormatUnit) => `${value} ${unit}`,\n      };\n    }\n  }\n\n  // Determine onBehalfOf for audit trails\n  // If actor is app/service with consent → use grantedBy (delegating user)\n  // Otherwise → use actor.id (self-action)\n  const onBehalfOf =\n    (actor?.type === 'app' || actor?.type === 'service' || actor?.type === 'service_account') &&\n    consentContext?.grantedBy\n      ? consentContext.grantedBy\n      : actor?.id;\n\n  // Set workspace context in AsyncLocalStorage for Prisma workspace extension\n  // This enables automatic workspaceId injection on create/update operations\n  const wsCtxPayload = {\n    workspaceId: workspace?.id,\n    tenantId: tenant?.id,\n    actorId: actor?.id,\n    actorType: actor?.type,\n    organizationId: organization?.id,\n    projectId: project?.id,\n    onBehalfOf,\n  };\n\n  logger.debug('[ServerContext] Setting workspace context', {\n    workspaceId: wsCtxPayload.workspaceId ?? 'NONE',\n    actorId: wsCtxPayload.actorId ?? 'NONE',\n    rawHeader: getHeader(request, 'x-workspace-id') ?? 'MISSING',\n  });\n\n  setWorkspaceContext(wsCtxPayload);\n\n  // Capture the Cloudflare Access service token for cross-layer calls.\n  // NOTE: this path populates the Prisma workspace store (above), NOT the\n  // general ContextManager ALS — so cross-layer clients reading\n  // ContextManager.getCfAccessHeaders() would otherwise see nothing here.\n  // Record it explicitly (module-level fallback) so resolver-initiated\n  // cross-layer calls re-present it. No-op unless the gateway forwarded the\n  // headers (alpha only; gated upstream on cf-ray).\n  ContextManager.setCfAccessContext(\n    getHeader(request, 'cf-access-client-id'),\n    getHeader(request, 'cf-access-client-secret'),\n    getHeader(request, 'x-cf-authorization')\n  );\n\n  return {\n    request,\n    actor,\n    tenant,\n    organization,\n    workspace,\n    project,\n    product,\n    tracking,\n    consentContext: consentContext || undefined,\n    verifiedDelegation,\n    onBehalfOf: onBehalfOf || actor?.id || '',\n    db: contextOptions.getDb(),\n    i18n,\n    responseHeaders: new Headers(),\n  };\n}\n\n/**\n * Get context options\n */\nexport function getContextOptions(): ContextBuilderOptions | null {\n  return contextOptions;\n}\n","import type { Plugin } from 'graphql-yoga';\n\nimport { withWorkspaceContext, type WorkspaceContext } from '../prisma/workspace-extension.js';\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction string(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction id(value: unknown): string | undefined {\n  return record(value) ? string(value['id']) : undefined;\n}\n\nfunction executionContext(value: unknown): WorkspaceContext {\n  if (!record(value)) return {};\n  return {\n    workspaceId: id(value['workspace']),\n    tenantId: id(value['tenant']),\n    organizationId: id(value['organization']),\n    projectId: id(value['project']),\n    actorId: id(value['actor']),\n    actorType: record(value['actor']) ? string(value['actor']['type']) : undefined,\n    onBehalfOf: string(value['onBehalfOf']),\n  };\n}\n\nfunction scopedIterable<T>(source: AsyncIterable<T>, scope: WorkspaceContext): AsyncIterable<T> {\n  return {\n    [Symbol.asyncIterator]() {\n      const iterator = source[Symbol.asyncIterator]();\n      const finish = iterator.return?.bind(iterator);\n      const fail = iterator.throw?.bind(iterator);\n      return {\n        next: (...args: [] | [unknown]) => withWorkspaceContext(scope, async () => iterator.next(...args)),\n        return: finish ? (value?: unknown) => withWorkspaceContext(scope, async () => finish(value)) : undefined,\n        throw: fail ? (error?: unknown) => withWorkspaceContext(scope, async () => fail(error)) : undefined,\n      };\n    },\n  };\n}\n\n/** Context creation and GraphQL execution may run in different async chains.\n * Bind execution to its own verified context instead of the most recent request's fallback.\n */\nexport function createWorkspaceExecutionContextPlugin(): Plugin {\n  return {\n    onExecute({ executeFn, setExecuteFn }) {\n      setExecuteFn((args) => {\n        const scope = executionContext(args.contextValue);\n        return withWorkspaceContext(scope, async () => {\n          const result = await executeFn(args);\n          return Symbol.asyncIterator in result ? scopedIterable(result, scope) : result;\n        });\n      });\n    },\n    onSubscribe({ subscribeFn, setSubscribeFn }) {\n      setSubscribeFn((args) => {\n        const scope = executionContext(args.contextValue);\n        return withWorkspaceContext(scope, async () => {\n          const result = await subscribeFn(args);\n          return Symbol.asyncIterator in result ? scopedIterable(result, scope) : result;\n        });\n      });\n    },\n  };\n}\n","import type { IActor } from './types.js';\n\nconst LOCALHOST_ORIGINS = [\n  'http://localhost:3000',\n  'http://localhost:4000',\n  'http://localhost:5173',\n  'http://127.0.0.1:3000',\n  'http://127.0.0.1:4000',\n  'http://127.0.0.1:5173',\n];\n\nexport function normalizeCorsOrigins(\n  origins: string | string[] | undefined,\n  environment: 'development' | 'staging' | 'production' | undefined\n): string[] {\n  const normalized = (Array.isArray(origins) ? origins : origins?.split(',') || [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\n  if (normalized.length === 0) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  if (normalized.includes('*')) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  return normalized;\n}\n\nexport function resolveAllowedCorsOrigin(requestOrigin: string | null, allowedOrigins: string[]): string | null {\n  if (!requestOrigin) {\n    return allowedOrigins[0] ?? null;\n  }\n\n  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;\n}\n\nexport function canAccessGraphExport(actor: IActor | null): boolean {\n  if (!actor) {\n    return false;\n  }\n\n  return actor.isAdmin === true || ['service', 'super_admin'].includes(actor.type);\n}\n","/**\n * Workspace quota gauge refresh throttling for the `/metrics` route.\n *\n * `WorkspaceQuotaRegistry.collectAll()` issues Prisma groupBy queries. Running\n * it inline on every Prometheus scrape made `/metrics` exactly as slow as the\n * database: services that registered quota collectors routinely exceeded a 30s\n * `scrape_timeout` and were recorded as down, even though the endpoint itself\n * was healthy.\n *\n * Scrapes are far more frequent than these values meaningfully change, so\n * refresh on a TTL, bound each refresh, and let concurrent scrapes share one\n * in-flight attempt. A slow or unavailable database then degrades gauge\n * freshness instead of failing the scrape.\n *\n * @module server/quotaGaugeRefresh\n */\n\n/**\n * Read a positive-integer millisecond setting from the environment.\n *\n * Anything unset, non-numeric, or <= 0 falls back to the default: an operator\n * typo must not silently disable the throttle that keeps `/metrics` fast.\n */\nexport function envMs(name: string, fallback: number): number {\n  const raw = process.env[name];\n  if (!raw) return fallback;\n  const parsed = Number.parseInt(raw, 10);\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\n/**\n * How long a gauge snapshot is considered fresh.\n *\n * Override with `BOFF_QUOTA_GAUGE_TTL_MS` — raise it when the database is under\n * load and quota freshness matters less than scrape latency.\n */\nexport const QUOTA_GAUGE_TTL_MS = envMs('BOFF_QUOTA_GAUGE_TTL_MS', 60_000);\n\n/**\n * Upper bound on a single refresh, so a slow database cannot stall a scrape.\n *\n * Override with `BOFF_QUOTA_GAUGE_TIMEOUT_MS`. Keep it comfortably below the\n * Prometheus `scrape_timeout`, or a slow refresh still fails the scrape.\n */\nexport const QUOTA_GAUGE_REFRESH_TIMEOUT_MS = envMs('BOFF_QUOTA_GAUGE_TIMEOUT_MS', 5_000);\n\nexport interface QuotaGaugeRefresherOptions {\n  /** Performs the actual (expensive) collection. */\n  collect: () => Promise<unknown>;\n  ttlMs?: number;\n  timeoutMs?: number;\n  /** Injectable clock, for tests. */\n  now?: () => number;\n}\n\nexport interface QuotaGaugeRefresher {\n  /** Refresh if stale. Never rejects. */\n  refresh: () => Promise<void>;\n  /** Epoch ms of the last completed attempt (0 when never run). */\n  lastRefreshedAt: () => number;\n}\n\n/**\n * Build a TTL-throttled, timeout-bounded, single-flight refresher.\n *\n * `refresh()` never rejects — `/metrics` must keep serving prom-client and SDK\n * registry output even when the quota registry is unconfigured or erroring.\n * A failed attempt does not advance the TTL, so the next scrape retries.\n */\nexport function createQuotaGaugeRefresher(opts: QuotaGaugeRefresherOptions): QuotaGaugeRefresher {\n  const ttlMs = opts.ttlMs ?? QUOTA_GAUGE_TTL_MS;\n  const timeoutMs = opts.timeoutMs ?? QUOTA_GAUGE_REFRESH_TIMEOUT_MS;\n  const now = opts.now ?? ((): number => Date.now());\n\n  let refreshedAt = 0;\n  let inFlight: Promise<void> | null = null;\n\n  const refresh = async (): Promise<void> => {\n    if (refreshedAt !== 0 && now() - refreshedAt < ttlMs) return;\n\n    if (!inFlight) {\n      inFlight = (async (): Promise<void> => {\n        let timer: ReturnType<typeof setTimeout> | undefined;\n        try {\n          await Promise.race([\n            Promise.resolve(opts.collect()).then(() => undefined),\n            new Promise<void>((resolve) => {\n              timer = setTimeout(resolve, timeoutMs);\n            }),\n          ]);\n          // Stamp only on a completed attempt; a throw leaves the TTL expired\n          // so the next scrape retries rather than serving a stale snapshot\n          // forever.\n          refreshedAt = now();\n        } catch {\n          /* unconfigured registry or failed query — keep the previous snapshot */\n        } finally {\n          if (timer !== undefined) clearTimeout(timer);\n          inFlight = null;\n        }\n      })();\n    }\n\n    await inFlight;\n  };\n\n  return { refresh, lastRefreshedAt: (): number => refreshedAt };\n}\n","/**\n * Dependency-aware readiness for `createServer`.\n *\n * WHY THIS EXISTS\n * `createServer` used to answer `/health`, `/health/live`, `/health/ready` and\n * `/health/startup` with a hardcoded `{ status: 'healthy' }`. Nothing was ever\n * checked. Combined with gitops pointing BOTH Kubernetes probes at `/health`,\n * that meant a pod whose database or cache had gone away stayed in the Service\n * endpoints and kept answering requests with errors, and a rolling deploy could\n * report success while every replica was broken.\n *\n * gitops now splits the probes — liveness on `/health/live`, readiness on\n * `/health/ready` — and this module is what makes readiness mean something.\n *\n * THE REQUIRED / OPTIONAL SPLIT IS THE WHOLE DESIGN\n * Postgres is REQUIRED: a subgraph that cannot reach its database can serve\n * nothing, so it should leave rotation and let its siblings take the traffic.\n * Valkey and the event queue are OPTIONAL by default: they are a cache and an\n * async publisher, the service degrades rather than fails without them, and\n * making them required would take the entire fleet out of rotation\n * simultaneously the moment one shared ElastiCache cluster blinked — turning a\n * cache incident into a total outage. A service that genuinely cannot function\n * without one can promote it via `requiredDependencies`.\n *\n * Liveness deliberately checks NOTHING. If liveness were deep, a shared\n * dependency blip would restart every pod in the fleet at once, which is\n * strictly worse than serving degraded.\n */\n\n/** Minimal Prisma surface used for the readiness query — keeps this testable. */\nexport interface ReadinessPrisma {\n  $queryRaw: (strings: TemplateStringsArray, ...values: unknown[]) => Promise<unknown>;\n}\n\n/** Minimal Valkey/Redis surface. */\nexport interface ReadinessCache {\n  ping: () => Promise<unknown>;\n}\n\n/** Minimal event-queue surface (be-sdk `IEventPublisher` implementations). */\nexport interface ReadinessEventQueue {\n  isConnected?: () => boolean | Promise<boolean>;\n  healthCheck?: () => Promise<{ ok: boolean }>;\n}\n\nexport type DependencyName = 'postgres' | 'valkey' | 'eventQueue';\n\nexport interface ReadinessDeps {\n  prisma?: () => ReadinessPrisma | undefined;\n  valkey?: () => Promise<ReadinessCache | undefined> | ReadinessCache | undefined;\n  eventQueue?: () => ReadinessEventQueue | undefined;\n  /**\n   * Dependencies whose failure makes the pod NOT ready. Defaults to\n   * `['postgres']`. Anything checked but not listed here is reported and\n   * degrades `status`, but still answers 200 so the pod stays in rotation.\n   */\n  requiredDependencies?: DependencyName[];\n}\n\nexport interface DependencyResult {\n  ok: boolean;\n  required: boolean;\n  error?: string;\n  /** Milliseconds the check took — surfaces a slow dependency before it fails. */\n  latencyMs: number;\n}\n\nexport interface ReadinessSnapshot {\n  /** True when every REQUIRED dependency is healthy. Drives the HTTP status. */\n  ready: boolean;\n  /** True when every checked dependency is healthy, required or not. */\n  healthy: boolean;\n  checks: Partial<Record<DependencyName, DependencyResult>>;\n}\n\n/**\n * Result cache TTL. Kubernetes probes every 10s across N replicas, Gatus every\n * 300s, plus any load balancer — without this each of them becomes a `SELECT 1`\n * on a connection from the same bounded pool the application needs.\n */\nexport const READINESS_CACHE_MS = 1000;\n\n/** Hard ceiling on a single dependency check, so readiness cannot hang. */\nexport const READINESS_PROBE_TIMEOUT_MS = 2000;\n\nconst DEFAULT_REQUIRED: DependencyName[] = ['postgres'];\n\nasync function withTimeout<T>(work: Promise<T>, ms: number, label: string): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      work,\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => reject(new Error(`${label} check timed out after ${ms}ms`)), ms);\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nasync function runCheck(\n  name: DependencyName,\n  required: boolean,\n  work: () => Promise<unknown>,\n  now: () => number\n): Promise<DependencyResult> {\n  const started = now();\n  try {\n    await withTimeout(Promise.resolve(work()), READINESS_PROBE_TIMEOUT_MS, name);\n    return { ok: true, required, latencyMs: now() - started };\n  } catch (err) {\n    return {\n      ok: false,\n      required,\n      error: err instanceof Error ? err.message : String(err),\n      latencyMs: now() - started,\n    };\n  }\n}\n\n/**\n * Build a cached readiness prober. Each call site gets its own cache so tests\n * never share state with a running server.\n */\nexport function createReadinessProbe(\n  deps: ReadinessDeps,\n  now: () => number = Date.now\n): () => Promise<ReadinessSnapshot> {\n  const required = new Set<DependencyName>(deps.requiredDependencies ?? DEFAULT_REQUIRED);\n  let cache: { snapshot: ReadinessSnapshot; at: number } | null = null;\n  let inFlight: Promise<ReadinessSnapshot> | null = null;\n\n  async function probe(): Promise<ReadinessSnapshot> {\n    const checks: Partial<Record<DependencyName, DependencyResult>> = {};\n\n    const jobs: Array<Promise<void>> = [];\n\n    if (deps.prisma) {\n      jobs.push(\n        runCheck(\n          'postgres',\n          required.has('postgres'),\n          async () => {\n            const client = deps.prisma?.();\n            if (!client) throw new Error('prisma client not initialised');\n            await client.$queryRaw`SELECT 1`;\n          },\n          now\n        ).then((r) => {\n          checks.postgres = r;\n        })\n      );\n    }\n\n    if (deps.valkey) {\n      jobs.push(\n        runCheck(\n          'valkey',\n          required.has('valkey'),\n          async () => {\n            const client = await deps.valkey?.();\n            if (!client) throw new Error('valkey client not initialised');\n            await client.ping();\n          },\n          now\n        ).then((r) => {\n          checks.valkey = r;\n        })\n      );\n    }\n\n    if (deps.eventQueue) {\n      jobs.push(\n        runCheck(\n          'eventQueue',\n          required.has('eventQueue'),\n          async () => {\n            const q = deps.eventQueue?.();\n            if (!q) throw new Error('event queue not initialised');\n            if (typeof q.isConnected === 'function') {\n              const connected = await Promise.resolve(q.isConnected());\n              if (!connected) throw new Error('event queue reports disconnected');\n              return;\n            }\n            if (typeof q.healthCheck === 'function') {\n              const res = await q.healthCheck();\n              if (!res.ok) throw new Error('event queue health check failed');\n            }\n            // A queue exposing neither hook is treated as healthy rather than\n            // failed — inventing a failure would take pods out of rotation for\n            // a dependency we cannot actually interrogate.\n          },\n          now\n        ).then((r) => {\n          checks.eventQueue = r;\n        })\n      );\n    }\n\n    await Promise.all(jobs);\n\n    const results = Object.values(checks);\n    return {\n      ready: results.every((c) => c.ok || !c.required),\n      healthy: results.every((c) => c.ok),\n      checks,\n    };\n  }\n\n  return async function getReadiness(): Promise<ReadinessSnapshot> {\n    const at = now();\n    if (cache && at - cache.at < READINESS_CACHE_MS) return cache.snapshot;\n    // Collapse concurrent probes (three probes can land in the same tick).\n    if (inFlight) return inFlight;\n    inFlight = probe()\n      .then((snapshot) => {\n        cache = { snapshot, at: now() };\n        return snapshot;\n      })\n      .finally(() => {\n        inFlight = null;\n      });\n    return inFlight;\n  };\n}\n\nexport interface HealthBody {\n  status: 'healthy' | 'degraded' | 'unavailable';\n  service: string;\n  version: string;\n  timestamp: string;\n  checks?: Partial<Record<DependencyName, DependencyResult>>;\n  uptimeSeconds?: number;\n}\n\n/** HTTP status for the readiness and aggregate endpoints. */\nexport function readinessStatusCode(snapshot: ReadinessSnapshot): 200 | 503 {\n  return snapshot.ready ? 200 : 503;\n}\n\nexport function readinessBody(\n  snapshot: ReadinessSnapshot,\n  service: string,\n  version: string,\n  timestamp: string,\n  uptimeSeconds?: number\n): HealthBody {\n  const status: HealthBody['status'] = !snapshot.ready ? 'unavailable' : snapshot.healthy ? 'healthy' : 'degraded';\n  return {\n    status,\n    service,\n    version,\n    timestamp,\n    checks: snapshot.checks,\n    ...(uptimeSeconds === undefined ? {} : { uptimeSeconds }),\n  };\n}\n\n/** Liveness body — deliberately free of any dependency information. */\nexport function livenessBody(service: string, version: string, timestamp: string): HealthBody {\n  return { status: 'healthy', service, version, timestamp };\n}\n","/**\n * Server Module\n *\n * Main server bootstrapping with Elysia, GraphQL Yoga, and middleware.\n * Uses Bun runtime for high-performance GraphQL services.\n *\n * Provides a simple API for microservices to start a fully configured server.\n */\n\nimport { logger } from '../logger/index.js';\nimport { configureAuth, configureDefaultAuth, type FetchWorkspaceSecretFn } from './auth.js';\nimport { configureContext, buildContext } from './context.js';\nimport { createWorkspaceExecutionContextPlugin } from './workspace-execution-context.js';\nimport type {\n  ServerDefinition,\n  ServerInstance,\n  ServerInfo,\n  ElysiaApp,\n  BunServerHandle,\n  YogaPlugin,\n  GraphQLContext,\n} from './types.js';\nimport { I18n } from '../i18n/index.js';\nimport { canAccessGraphExport, normalizeCorsOrigins, resolveAllowedCorsOrigin } from './security.js';\nimport { getMetricsRegistry } from '../instrumentation/metrics-collector.js';\nimport { getWorkspaceQuotaRegistry } from '../metrics/index.js';\nimport { createQuotaGaugeRefresher } from './quotaGaugeRefresh.js';\nimport {\n  createReadinessProbe,\n  livenessBody,\n  readinessBody,\n  readinessStatusCode,\n  type ReadinessDeps,\n} from './readiness.js';\nimport {\n  createHttpErrorResponse,\n  createHumanReadableErrorPlugin,\n  formatHttpError,\n  normalizeGraphQLResponse,\n} from './errors.js';\n\n// Store startup time for uptime calculation\nlet serverStartTime: Date | null = null;\n\n// Workspace quota gauges cost Prisma groupBy queries, so /metrics refreshes\n// them on a TTL rather than on every scrape. See ./quotaGaugeRefresh.ts.\nconst quotaGaugeRefresher = createQuotaGaugeRefresher({\n  collect: () => getWorkspaceQuotaRegistry().collectAll(),\n});\n\n/**\n * Create and configure a server instance using Elysia + GraphQL Yoga\n */\nexport async function createServer(definition: ServerDefinition): Promise<ServerInstance> {\n  const {\n    config,\n    prismaClient,\n    schema,\n    moduleGraph,\n    restEndpoints,\n    yogaPlugins,\n    buildContext: customBuildContext,\n    workspaceExtensionConfig,\n    disableWorkspaceExtension,\n    onShutdown,\n  } = definition;\n\n  // Dynamic imports to avoid requiring these as hard dependencies\n  const { Elysia } = await import('elysia');\n  const { BunAdapter } = await import('elysia/adapter/bun');\n  const { cors } = await import('@elysiajs/cors');\n  const { createYoga } = await import('graphql-yoga');\n  const { initializeDatabase, getDb, getDatabaseManager } = await import('../prisma/index.js');\n  const { createSecurityPlugin } = await import('../middleware/index.js');\n  const { createMetricsPlugin } = await import('../observability/index.js');\n  const { createWorkspaceGuardPlugin } = await import('./workspace-guard.js');\n\n  logger.info(`[Server] Initializing ${config.serviceName}...`);\n\n  // Detect boundary from config or service name — needed before database and guard setup\n  const boundary =\n    config.boundary ??\n    (config.serviceName.startsWith('wspace-')\n      ? 'wspace'\n      : config.serviceName.startsWith('global-')\n        ? 'global'\n        : 'wspace'); // fail-closed: default to wspace (stricter)\n\n  // Initialize database\n  // Workspace extension is auto-disabled for global boundary services unless explicitly enabled\n  const shouldEnableWorkspaceExtension =\n    disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === 'wspace'; // auto-detect: enabled for wspace, disabled for global\n\n  logger.info('[Server] Initializing database...', {\n    boundary,\n    workspaceExtension: shouldEnableWorkspaceExtension,\n  });\n\n  const { connect } = initializeDatabase(prismaClient, config.serviceName, {\n    registerShutdownHandlers: false, // Server manages shutdown handlers itself\n    enableWorkspaceExtension: shouldEnableWorkspaceExtension,\n    ...(workspaceExtensionConfig ? { workspaceExtensionConfig } : {}),\n  });\n  await connect();\n\n  // Initialize i18n if configured\n  let i18nInstance: I18n | undefined;\n  if (config.i18n?.enabled && config.i18n.localesPath) {\n    logger.info('[Server] Initializing i18n...');\n    i18nInstance = new I18n({\n      defaultLocale: config.i18n.defaultLocale || 'en-US',\n      fallbackLocale: config.i18n.fallbackLocale || 'en-US',\n      localesPath: config.i18n.localesPath,\n      supportedLocales: config.i18n.supportedLocales,\n      namespace: config.i18n.namespace || config.serviceName,\n      lazyLoad: config.i18n.lazyLoad,\n      logMissing: config.i18n.logMissing ?? true,\n      enableCache: true,\n      returnKeyOnMissing: true,\n    });\n    await i18nInstance.initialize();\n    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(', ')}`);\n  }\n\n  // Configure context builder\n  configureContext({\n    getDb: () => getDb(),\n    i18n: i18nInstance,\n  });\n\n  // Auto-configure auth with default workspace secret fetcher if not already configured\n  configureDefaultAuth();\n\n  // Initialize module graph if provided\n  if (moduleGraph) {\n    logger.info('[Server] Initializing module graph...');\n    await moduleGraph.initialize();\n  }\n\n  // Determine if playground/introspection should be enabled\n  const isDev = config.environment !== 'production';\n  const enablePlayground = config.enablePlayground ?? isDev;\n\n  // Enable GraphQL-over-HTTP batching by default so subgraphs accept the batched\n  // array POSTs the federation gateway forwards from Apollo Client BatchHttpLink.\n  // The default limit (10) matches the workspace gateway's batching limit.\n  const batching = config.batching ?? true;\n\n  // Build workspace guard plugin — auto-enabled for wspace boundary only\n  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === 'wspace';\n  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? 'enabled' : 'disabled'}`);\n\n  const workspaceGuardPlugins = workspaceGuardEnabled\n    ? [\n        createWorkspaceGuardPlugin({\n          enabled: true,\n          whitelistedOperations: config.workspaceGuard?.whitelistedOperations,\n        }),\n      ]\n    : [];\n\n  // Create GraphQL Yoga instance\n  const graphqlEndpoint = config.graphqlEndpoint || '/graphql';\n  logger.info('[Server] Setting up GraphQL Yoga with provided schema...', {\n    batching,\n  });\n\n  const responseHeadersPlugin: YogaPlugin = {\n    onResponse: ({ response, serverContext }: { response: Response; serverContext: unknown }) => {\n      const yogaContext = serverContext as GraphQLContext;\n      if (yogaContext?.responseHeaders) {\n        yogaContext.responseHeaders.forEach((value: string, key: string) => {\n          response.headers.append(key, value);\n        });\n      }\n    },\n  };\n\n  const yoga = createYoga<{ request: Request }>({\n    graphqlEndpoint,\n    schema, // Use the schema provided by microservice\n    graphiql: enablePlayground,\n    batching,\n    logging: {\n      debug: (...args) => logger.debug('[GraphQL]', ...args),\n      info: (...args) => logger.info('[GraphQL]', ...args),\n      warn: (...args) => logger.warn('[GraphQL]', ...args),\n      error: (...args) => logger.error('[GraphQL]', ...args),\n    },\n    plugins: [\n      createHumanReadableErrorPlugin({ serviceName: config.serviceName, environment: config.environment }),\n      ...workspaceGuardPlugins,\n      responseHeadersPlugin,\n      ...(yogaPlugins || []),\n      // Consumers such as GraphQL Modules replace execute/subscribe; bind their final functions.\n      createWorkspaceExecutionContextPlugin(),\n    ],\n    context: async ({ request }) => {\n      // Build default context\n      const defaultContext = await buildContext(request);\n\n      // Apply custom context builder if provided\n      if (customBuildContext) {\n        return customBuildContext(defaultContext);\n      }\n\n      return defaultContext;\n    },\n  });\n\n  // Create Elysia instance with Bun adapter\n  const app = new Elysia({ adapter: BunAdapter });\n\n  // Register CORS middleware\n  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);\n\n  app.use(\n    cors({\n      origin: corsOrigins,\n      credentials: corsOrigins.length > 0,\n      allowedHeaders: [\n        'Content-Type',\n        'Authorization',\n        'X-Tenant-ID',\n        'X-Workspace-ID',\n        'X-Org-ID',\n        'X-Project-ID',\n        'X-Product-ID',\n        'X-CSRF-Token',\n        'X-Service-Name',\n        'Accept-Language',\n        'X-Locale',\n        'X-Language',\n        'X-Geo-Country',\n        'X-Geo-Currency',\n        'X-Geo-Timezone',\n        // Actor headers (gateway-injected or dev mode)\n        'X-Actor-ID',\n        'X-Actor-Type',\n        'X-Internal-Service-Token',\n        'X-Gateway-Auth-Token',\n      ],\n      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n    })\n  );\n\n  // Collect raw body endpoints for early interception\n  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);\n  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [ep.path, ep]));\n  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {\n    const regexPattern = endpoint.path.replace(/:[^/]+/g, '[^/]+');\n    return {\n      endpoint,\n      regexPattern,\n      regex: new RegExp(`^${regexPattern}$`),\n    };\n  });\n\n  // Helper to match pathname against endpoint patterns (including :param placeholders)\n  const matchRawBodyEndpoint = (pathname: string): (typeof rawBodyEndpoints)[0] | undefined => {\n    // First try exact match (for non-parameterized paths)\n    const exactMatch = rawBodyPaths.get(pathname);\n    if (exactMatch) return exactMatch;\n\n    // Try pattern matching for parameterized paths like /webhooks/slack/:channelId\n    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {\n      const isMatch = regex.test(pathname);\n      logger.debug(\n        `[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`\n      );\n      if (isMatch) {\n        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);\n        return endpoint;\n      }\n    }\n\n    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);\n    return undefined;\n  };\n\n  // Handle GraphQL, metrics, and raw body requests BEFORE any middleware that consumes the body\n  // This is critical because Yoga needs the raw request body stream\n  // and webhook endpoints need raw body for signature verification\n  // onRequest runs before onParse (body parsing) and onBeforeHandle\n  app.onRequest(async ({ request }) => {\n    const url = new URL(request.url);\n    const pathname = url.pathname;\n    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);\n    const isHealthRoute = pathname === '/health' || pathname.startsWith('/health/');\n\n    // Build CORS headers helper\n    const buildCorsHeaders = (): Record<string, string> => {\n      const origin = request.headers.get('origin') || '*';\n      const allowedOrigin = resolveAllowedCorsOrigin(origin === '*' ? null : origin, corsOrigins);\n      const headers: Record<string, string> = {\n        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n        'Access-Control-Allow-Headers':\n          'Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token',\n      };\n\n      if (allowedOrigin) {\n        headers['Access-Control-Allow-Origin'] = allowedOrigin;\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n\n      return headers;\n    };\n\n    // Check if this is a raw body endpoint (webhooks) - now supports parameterized paths\n    const rawBodyEndpoint = isHealthRoute ? undefined : matchRawBodyEndpoint(pathname);\n    if (rawBodyEndpoint) {\n      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight for raw body endpoints\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Only process if method matches\n      if (request.method !== rawBodyEndpoint.method) {\n        return undefined; // Let other handlers deal with it\n      }\n\n      try {\n        // Read raw body BEFORE any parsing\n        const rawBody = await request.text();\n\n        // Build context without consuming body (body already read)\n        const context = await buildContext(request);\n\n        // Call the handler with raw body\n        const result = await rawBodyEndpoint.handler(request, context, rawBody);\n\n        // If handler returns a Response, use it directly\n        if (result instanceof Response) {\n          // Add CORS headers\n          const headers = new Headers(result.headers);\n          for (const [key, value] of Object.entries(corsHeaders)) {\n            headers.set(key, value);\n          }\n          return new Response(result.body, {\n            status: result.status,\n            statusText: result.statusText,\n            headers,\n          });\n        }\n\n        // Otherwise, serialize as JSON\n        const headers = new Headers({\n          'Content-Type': 'application/json',\n          ...corsHeaders,\n        });\n\n        return new Response(JSON.stringify(result), {\n          status: 200,\n          headers,\n        });\n      } catch (error) {\n        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);\n        const corsHeaders = buildCorsHeaders();\n        const formatted = formatHttpError(error, {\n          serviceName: config.serviceName,\n          environment: config.environment,\n        });\n        return new Response(JSON.stringify(formatted.body), {\n          status: formatted.status,\n          headers: {\n            'Content-Type': 'application/json',\n            ...corsHeaders,\n          },\n        });\n      }\n    }\n\n    // Serve Prometheus metrics via prom-client at /metrics.\n    // The graphql-yoga prometheus plugin populates the same default registry,\n    // so GraphQL-level metrics (operation durations, error counts, etc.) are\n    // included automatically without needing Yoga to handle this route.\n    //\n    // Also includes SDK MetricsRegistry metrics (business counters/histograms\n    // created via @burdenoff/be-sdk/instrumentation factories) so that custom\n    // service metrics are available without a separate /api/metrics endpoint.\n    if (pathname === '/metrics' && request.method === 'GET') {\n      try {\n        const promClientMod = 'prom-client';\n        const prom = (await import(promClientMod)) as unknown as {\n          register: { metrics: () => Promise<string> | string; contentType?: string };\n          collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n        };\n        try {\n          prom.collectDefaultMetrics({ register: prom.register });\n        } catch {\n          /* already called */\n        }\n        const promBody = await prom.register.metrics();\n\n        // Append SDK MetricsRegistry metrics (business counters, histograms,\n        // gauges) that are created via @burdenoff/be-sdk/instrumentation\n        // factories. The toPrometheusFormat() method is deliberately not cached\n        // — each scrape gets a fresh snapshot including dynamic label values.\n        //\n        // Workspace quota gauges are different: collectAll() issues Prisma\n        // groupBy queries, so running it inline on every scrape made /metrics\n        // as slow as the database. Services registering quota collectors\n        // routinely blew a 30s Prometheus scrape_timeout and reported as down.\n        // Refresh on a TTL and bound each refresh, so a slow or unavailable\n        // database degrades gauge freshness instead of failing the scrape.\n        let sdkBody = '';\n        await quotaGaugeRefresher.refresh();\n        try {\n          sdkBody = getMetricsRegistry().toPrometheusFormat();\n        } catch {\n          /* MetricsRegistry not initialised; serve prom-client output alone */\n        }\n\n        const combined = sdkBody ? `${promBody}\\n${sdkBody}` : promBody;\n        return new Response(combined, {\n          status: 200,\n          headers: {\n            'Content-Type': prom.register.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n          },\n        });\n      } catch {\n        // fall through — prom-client not installed; let Yoga handle as fallback\n      }\n    }\n\n    // Routes that should be handled by Yoga (GraphQL endpoint only)\n    const yogaRoutes = [graphqlEndpoint, `${graphqlEndpoint}/`, '/metrics'];\n    const shouldHandleByYoga = yogaRoutes.includes(pathname);\n\n    if (shouldHandleByYoga) {\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Get response from Yoga\n      const yogaResponse = await normalizeGraphQLResponse(await yoga.fetch(request), {\n        serviceName: config.serviceName,\n        environment: config.environment,\n      });\n\n      // Add CORS headers to Yoga response\n      const headers = new Headers(yogaResponse.headers);\n      for (const [key, value] of Object.entries(corsHeaders)) {\n        headers.set(key, value);\n      }\n\n      // Return response with CORS headers\n      return new Response(yogaResponse.body, {\n        status: yogaResponse.status,\n        statusText: yogaResponse.statusText,\n        headers,\n      });\n    }\n    // Return undefined to continue to next handlers for non-GraphQL requests\n    return undefined;\n  });\n\n  // Register metrics middleware (after GraphQL interception)\n  app.use(createMetricsPlugin());\n\n  // Register security middleware (after GraphQL interception)\n  app.use(\n    createSecurityPlugin({\n      csrfSkipRoutes: config.csrfSkipRoutes || ['/graphql', '/health', '/api/graph/'],\n      loginEndpoints: config.loginEndpoints || [],\n      enableCSRF: config.enableCSRF ?? false, // Disabled by default for GraphQL services\n      enableSessionSecurity: config.enableSessionSecurity ?? false,\n    })\n  );\n\n  // Health check endpoints. Rationale for the required/optional split and for\n  // keeping liveness shallow lives in ./readiness.ts — read it before changing\n  // which dependency is required.\n  //\n  //   /health         aggregate: 200 healthy / 200 degraded / 503 unavailable\n  //   /health/live    Kubernetes liveness  — process only, never a dependency\n  //   /health/ready   Kubernetes readiness — 503 when a REQUIRED dep is down\n  //   /health/startup Kubernetes startup   — process only, same as liveness\n  const serviceVersion = config.serviceVersion || '1.0.0';\n  const getReadiness = createReadinessProbe({\n    prisma: () => getDb(),\n    valkey: async () => {\n      // Optional: services that never configured Valkey must not be marked\n      // degraded for not having one, so an unconfigured client is not an error.\n      try {\n        const { getValkeyClient } = await import('../cache/index.js');\n        return await getValkeyClient();\n      } catch {\n        return undefined;\n      }\n    },\n    ...(config.health?.requiredDependencies ? { requiredDependencies: config.health.requiredDependencies } : {}),\n  } satisfies ReadinessDeps);\n\n  const shallow = (): unknown => livenessBody(config.serviceName, serviceVersion, new Date().toISOString());\n\n  const deep = async (ctx: unknown): Promise<unknown> => {\n    const snapshot = await getReadiness();\n    const ctxWithSet = ctx as { set?: { status?: number } };\n    const code = readinessStatusCode(snapshot);\n    if (ctxWithSet.set) ctxWithSet.set.status = code;\n    return readinessBody(\n      snapshot,\n      config.serviceName,\n      serviceVersion,\n      new Date().toISOString(),\n      Math.round(process.uptime())\n    );\n  };\n\n  app.get('/health', deep);\n  app.get('/health/live', shallow);\n  app.get('/health/ready', deep);\n  app.get('/health/startup', shallow);\n\n  // Graph API endpoints (if moduleGraph provided)\n  if (moduleGraph) {\n    // Get graph configuration schema\n    app.get('/api/graph/schema', async ({ request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      return moduleGraph.getSchema();\n    });\n\n    // Export all graph data\n    app.get('/api/graph/export', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportAll(organizationId, workspaceId);\n    });\n\n    // Export entities only\n    app.get('/api/graph/entities', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId, types } = query as {\n        organizationId?: string;\n        workspaceId?: string;\n        types?: string;\n      };\n      const entityTypes = types?.split(',').map((t) => t.trim());\n      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);\n    });\n\n    // Export relationships only\n    app.get('/api/graph/relationships', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportRelationships(organizationId, workspaceId);\n    });\n  }\n\n  // Register custom REST endpoints (skip rawBody endpoints - they're handled in onRequest)\n  if (restEndpoints && restEndpoints.length > 0) {\n    for (const endpoint of restEndpoints) {\n      // Skip rawBody endpoints - they're intercepted in onRequest before body parsing\n      if (endpoint.rawBody) {\n        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);\n        continue;\n      }\n\n      const handler = async ({ request }: { request: Request }): Promise<unknown> => {\n        try {\n          const context = await buildContext(request);\n          return await endpoint.handler(request, context);\n        } catch (error) {\n          logger.error(`[Server] REST endpoint error (${endpoint.path}):`, error);\n          return createHttpErrorResponse(error, {\n            serviceName: config.serviceName,\n            environment: config.environment,\n          });\n        }\n      };\n\n      switch (endpoint.method) {\n        case 'GET':\n          app.get(endpoint.path, handler);\n          break;\n        case 'POST':\n          app.post(endpoint.path, handler);\n          break;\n        case 'PUT':\n          app.put(endpoint.path, handler);\n          break;\n        case 'PATCH':\n          app.patch(endpoint.path, handler);\n          break;\n        case 'DELETE':\n          app.delete(endpoint.path, handler);\n          break;\n      }\n    }\n  }\n\n  const host = config.host || '0.0.0.0';\n  const port = config.port;\n\n  // Create server instance\n  const serverInstance: ServerInstance = {\n    app: app as unknown as ElysiaApp,\n    server: null,\n    start: async () => {\n      serverStartTime = new Date();\n\n      // Call listen() which starts the server and makes app.server available\n      app.listen({\n        port,\n        hostname: host,\n      });\n\n      // Access the Bun server instance from the app\n      // Cast through unknown to satisfy TypeScript since Elysia's types are complex\n      const elysiaApp = app as unknown as { server: BunServerHandle | null };\n      serverInstance.server = elysiaApp.server;\n\n      logger.info(`🚀 ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);\n    },\n    stop: async () => {\n      logger.info(`[Server] Stopping ${config.serviceName}...`);\n\n      if (onShutdown) {\n        await onShutdown();\n      }\n\n      if (moduleGraph) {\n        await moduleGraph.shutdown();\n      }\n\n      await getDatabaseManager().disconnect();\n\n      if (serverInstance.server) {\n        serverInstance.server.stop();\n      }\n\n      logger.info(`[Server] ${config.serviceName} stopped`);\n    },\n    getInfo: (): ServerInfo => {\n      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1000) : 0;\n\n      return {\n        serviceName: config.serviceName,\n        serviceVersion: config.serviceVersion || '1.0.0',\n        environment: config.environment || 'development',\n        port,\n        host,\n        graphqlEndpoint,\n        startedAt: serverStartTime?.toISOString() || '',\n        uptime,\n      };\n    },\n  };\n\n  // Setup graceful shutdown handlers\n  const gracefulShutdown = async (signal: string): Promise<never> => {\n    logger.info(`[Server] ${signal} received, shutting down gracefully...`);\n    await serverInstance.stop();\n    process.exit(0);\n  };\n\n  process.on('SIGTERM', () => {\n    void gracefulShutdown('SIGTERM');\n  });\n  process.on('SIGINT', () => {\n    void gracefulShutdown('SIGINT');\n  });\n\n  return serverInstance;\n}\n\n/**\n * Configure auth with workspace secret fetcher\n *\n * This should be called before creating the server if using workspace-scoped JWT\n */\nexport function configureServerAuth(fetchWorkspaceSecret: FetchWorkspaceSecretFn): void {\n  configureAuth({ fetchWorkspaceSecret });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/be-sdk",
-  "version": "2026.1008.2",
+  "version": "2026.1008.3",
   "description": "Backend SDK for Burdenoff products providing unified access to notifications, RBAC, activity tracking, usage monitoring, and more",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -199,16 +199,16 @@
   "devDependencies": {
     "@clickhouse/client": "^1.23.1",
     "@elysiajs/cors": "^1.4.2",
-    "@temporalio/client": "^1.24.0",
-    "@temporalio/common": "^1.24.0",
-    "@temporalio/worker": "^1.24.0",
-    "graphql": "16.12.0",
+    "@envelop/graphql-modules": "9.1.1",
     "@eslint/js": "^9.39.5",
     "@graphql-yoga/plugin-apollo-inline-trace": "^3.24.1",
     "@graphql-yoga/plugin-prometheus": "^6.19.1",
     "@prisma/adapter-pg": "^7.10.0",
     "@prisma/client": "^7.10.0",
     "@swc/core": "^1.16.13",
+    "@temporalio/client": "^1.24.0",
+    "@temporalio/common": "^1.24.0",
+    "@temporalio/worker": "^1.24.0",
     "@types/bun": "^1.4.2",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^25.9.9",
@@ -221,9 +221,11 @@
     "eslint-plugin-security": "^3.0.1",
     "eslint-plugin-sonarjs": "4.2.2",
     "globals": "^16.5.0",
+    "graphql": "16.12.0",
+    "graphql-modules": "3.1.1",
+    "ioredis": "^5.11.1",
     "jose": "^6.2.12",
     "lefthook": "^2.1.16",
-    "ioredis": "^5.11.1",
     "pg": "^8.23.1",
     "prettier": "3.8.3",
     "prisma": "^7.10.0",