@burdenoff/be-sdk 2026.518.2 → 2026.521.1

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/auth.ts","../../src/server/context.ts","../../src/server/security.ts","../../src/server/server.ts"],"names":["getDbFn","getDb","prismaModule","joseModule","jwtModule","getJose","getJwt","jwt","default","authConfig","configureAuth","config","logger","debug","fetchWorkspaceSecret","workspaceId","db","workspace","client","findUnique","where","id","jwtSecret","JSON","parse","stringify","error","warn","configureDefaultAuth","generateSymmetricSecret","joseLib","secret","generateSecret","jwk","exportJWK","verifyJWT","token","options","decoded","decode","complete","payload","verifiedJwt","verify","mapPayloadToActor","decodedJwt","decodeJwt","workspace_id","workspaceSecret","keyLikeSecret","importJWK","jwtVerify","err","decodeJWT","sub","type","actor_type","tenant_id","org_id","isAdmin","authCheck","actor","Error","workspaceCheck","context","actorId","requireWorkspace","orgCheck","organization","orgId","tenantCheck","tenant","contextOptions","configureContext","getHeader","request","key","headers","get","toLowerCase","undefined","compareSecret","provided","expected","providedBuffer","Buffer","from","expectedBuffer","length","crypto","timingSafeEqual","shouldTrustActorHeaders","nodeEnv","process","env","expectedGatewayToken","providedGatewayToken","extractTracking","forwardedFor","realIp","ip","split","trim","userAgent","extractActor","actorType","userRole","authHeader","startsWith","substring","extractTenant","tenantId","tenantEndpoint","endpoint","defaultTenant","extractOrganization","extractWorkspace","extractProject","projectId","extractProduct","productId","extractGeography","country","currency","timezone","toUpperCase","extractConsentContext","grantedBy","scopesHeader","grantedAtHeader","expiresAtHeader","scopes","map","s","grantedAt","Date","expiresAt","buildContext","project","product","tracking","consentContext","i18n","createContextFromRequest","geo","locale","language","t","tp","formatNumber","value","String","formatCurrency","formatDate","date","formatRelativeTime","unit","onBehalfOf","wsCtxPayload","organizationId","rawHeader","setWorkspaceContext","responseHeaders","Headers","getContextOptions","LOCALHOST_ORIGINS","normalizeCorsOrigins","origins","environment","normalized","Array","isArray","origin","filter","Boolean","includes","resolveAllowedCorsOrigin","requestOrigin","allowedOrigins","canAccessGraphExport","serverStartTime","createServer","definition","prismaClient","schema","moduleGraph","restEndpoints","yogaPlugins","customBuildContext","workspaceExtensionConfig","disableWorkspaceExtension","onShutdown","Elysia","BunAdapter","cors","createYoga","initializeDatabase","getDatabaseManager","createSecurityPlugin","createMetricsPlugin","createWorkspaceGuardPlugin","info","serviceName","boundary","shouldEnableWorkspaceExtension","workspaceExtension","connect","registerShutdownHandlers","enableWorkspaceExtension","i18nInstance","enabled","localesPath","I18n","defaultLocale","fallbackLocale","supportedLocales","namespace","lazyLoad","logMissing","enableCache","returnKeyOnMissing","initialize","getSupportedLocales","join","isDev","enablePlayground","workspaceGuardEnabled","workspaceGuard","workspaceGuardPlugins","whitelistedOperations","graphqlEndpoint","responseHeadersPlugin","onResponse","response","serverContext","yogaContext","forEach","append","yoga","graphiql","logging","args","plugins","defaultContext","app","adapter","corsOrigins","use","credentials","allowedHeaders","methods","rawBodyEndpoints","ep","rawBody","rawBodyPaths","Map","path","rawBodyMatchers","regexPattern","replace","regex","RegExp","matchRawBodyEndpoint","pathname","exactMatch","isMatch","test","onRequest","url","URL","method","isHealthRoute","buildCorsHeaders","allowedOrigin","rawBodyEndpoint","corsHeaders","Response","status","text","result","handler","Object","entries","set","body","statusText","message","promClientMod","prom","collectDefaultMetrics","register","metrics","contentType","yogaRoutes","shouldHandleByYoga","yogaResponse","fetch","csrfSkipRoutes","loginEndpoints","enableCSRF","enableSessionSecurity","healthResponse","service","version","serviceVersion","timestamp","toISOString","getSchema","query","exportAll","types","entityTypes","exportEntities","exportRelationships","post","put","patch","delete","host","port","serverInstance","server","start","listen","hostname","elysiaApp","stop","shutdown","disconnect","getInfo","uptime","Math","floor","now","getTime","startedAt","gracefulShutdown","signal","exit","on","configureServerAuth"],"mappings":";;;;;;;;AA4BA,IAAIA,OAAAA,GAAmC,IAAA;AAEvC,eAAeC,KAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,IAAA,MAAME,YAAAA,GAAe,MAAM,OAAO,oBAAA,CAAA;AAElCF,IAAAA,OAAAA,GAAUE,YAAAA,CAAaD,KAAAA;AACzB,EAAA;AACA,EAAA,OAAOD,OAAAA,EAAAA;AACT;AAPeC,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAgBf,IAAIE,UAAAA,GAAiC,IAAA;AACrC,IAAIC,SAAAA,GAA8B,IAAA;AAElC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeE,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOf,eAAeC,MAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,SAAAA,EAAW;AACd,IAAA,MAAMG,GAAAA,GAAM,MAAM,OAAO,cAAA,CAAA;AAEzBH,IAAAA,SAAAA,GAAaG,IAAgCC,OAAAA,IAAYD,GAAAA;AAC3D,EAAA;AACA,EAAA,OAAOH,SAAAA;AACT;AAPeE,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAsBf,IAAIG,UAAAA,GAAgC,IAAA;AAK7B,SAASC,cAAcC,MAAAA,EAAkB;AAC9CF,EAAAA,UAAAA,GAAaE,MAAAA;AACbC,EAAAA,MAAAA,CAAOC,MAAM,8BAAA,CAAA;AACf;AAHgBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAchB,eAAsBI,qBAAqBC,WAAAA,EAAmB;AAC5D,EAAA,IAAI;AACF,IAAA,MAAMC,EAAAA,GAAK,MAAMf,KAAAA,EAAAA;AACjB,IAAA,MAAMgB,SAAAA,GAAY,MAAMD,EAAAA,CAAGE,MAAAA,CAAOD,UAAUE,UAAAA,CAAW;MACrDC,KAAAA,EAAO;QAAEC,EAAAA,EAAIN;AAAY;KAC3B,CAAA;AAEA,IAAA,IAAI,CAACE,WAAWK,SAAAA,EAAW;AACzBV,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;AAAEE,QAAAA;OAAY,CAAA;AAC7E,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOQ,KAAKC,KAAAA,CAAMD,IAAAA,CAAKE,SAAAA,CAAUR,SAAAA,CAAUK,SAAS,CAAA,CAAA;AACtD,EAAA,CAAA,CAAA,OAASI,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,KAAK,8CAAA,EAAgD;AAAEZ,MAAAA,WAAAA;AAAaW,MAAAA;KAAM,CAAA;AACjF,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAjBsBZ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwBf,SAASc,oBAAAA,GAAAA;AACd,EAAA,IAAI,CAACnB,UAAAA,EAAY;AACfC,IAAAA,aAAAA,CAAc;AAAEI,MAAAA;KAAqB,CAAA;AACrCF,IAAAA,MAAAA,CAAOC,MAAM,6EAAA,CAAA;AACf,EAAA;AACF;AALgBe,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWhB,eAAsBC,uBAAAA,GAAAA;AACpB,EAAA,MAAMC,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,EAAA,MAAM0B,MAAAA,GAAS,MAAMD,OAAAA,CAAQE,cAAAA,CAAe,OAAA,CAAA;AAC5C,EAAA,MAAMC,GAAAA,GAAM,MAAMH,OAAAA,CAAQI,SAAAA,CAAUH,MAAAA,CAAAA;AACpC,EAAA,OAAOE,GAAAA;AACT;AALsBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAetB,eAAsBM,SAAAA,CAAUC,KAAAA,EAAeL,MAAAA,EAAiBM,OAAAA,GAAyB,EAAC,EAAC;AACzF,EAAA,IAAI;AACF,IAAA,MAAM9B,GAAAA,GAAM,MAAMD,MAAAA,EAAAA;AAClB,IAAA,MAAMwB,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AAGtB,IAAA,MAAMiC,OAAAA,GAAU/B,GAAAA,CAAIgC,MAAAA,CAAOH,KAAAA,EAAO;MAAEI,QAAAA,EAAU;KAAK,CAAA;AAEnD,IAAA,IAAI,CAACF,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,IAAY,CAACA,OAAAA,CAAQG,OAAAA,IAAW,OAAOH,OAAAA,CAAQG,OAAAA,KAAY,QAAA,EAAU;AACtG7B,MAAAA,MAAAA,CAAOe,KAAK,mCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,IAAII,MAAAA,EAAQ;AAEV,MAAA,MAAMW,YAAAA,GAAcnC,GAAAA,CAAIoC,MAAAA,CAAOP,KAAAA,EAAOL,QAAQM,OAAAA,CAAAA;AAC9C,MAAA,OAAOO,kBAAkBF,YAAAA,CAAAA;AAC3B,IAAA;AAGA,IAAA,MAAMG,UAAAA,GAAaf,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;AACrC,IAAA,IAAI,CAACS,WAAWE,YAAAA,EAAc;AAC5BnC,MAAAA,MAAAA,CAAOe,KAAK,6CAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAAClB,YAAYK,oBAAAA,EAAsB;AACrCF,MAAAA,MAAAA,CAAOc,MAAM,+DAAA,CAAA;AACb,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,eAAAA,GAAkB,MAAMvC,UAAAA,CAAWK,oBAAAA,CAAqB+B,WAAWE,YAAY,CAAA;AACrF,IAAA,IAAI,CAACC,eAAAA,EAAiB;AACpBpC,MAAAA,MAAAA,CAAOe,KAAK,yCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,aAAAA,GAAgB,MAAMnB,OAAAA,CAAQoB,SAAAA,CAAUF,iBAA6B,OAAA,CAAA;AAC3E,IAAA,MAAMN,cAAc,MAAMZ,OAAAA,CAAQqB,SAAAA,CAAUf,KAAAA,EAAOa,eAAeZ,OAAAA,CAAAA;AAClE,IAAA,OAAOO,iBAAAA,CAAkBF,YAAYD,OAAO,CAAA;AAC9C,EAAA,CAAA,CAAA,OAASW,GAAAA,EAAK;AACZxC,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,qCAAqCyB,GAAAA,CAAAA;AACjD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA7CsBjB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkDtB,eAAsBkB,UAAUjB,KAAAA,EAAa;AAC3C,EAAA,IAAI;AACF,IAAA,MAAMN,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,IAAA,OAAOyB,OAAAA,CAAQgB,UAAUV,KAAAA,CAAAA;EAC3B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAPsBiB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAYtB,SAAST,kBAAkBH,OAAAA,EAAmB;AAC5C,EAAA,OAAO;AACLpB,IAAAA,EAAAA,EAAIoB,OAAAA,CAAQa,GAAAA;AACZC,IAAAA,IAAAA,EAAMd,QAAQe,UAAAA,IAAc,MAAA;AAC5BT,IAAAA,YAAAA,EAAcN,OAAAA,CAAQM,YAAAA;AACtBU,IAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBC,IAAAA,MAAAA,EAAQjB,OAAAA,CAAQiB,MAAAA;AAChBC,IAAAA,OAAAA,EAASlB,QAAQ,SAAA;AACnB,GAAA;AACF;AATSG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAcF,SAASgB,UAAUC,KAAAA,EAAoB;AAC5C,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,MAAM,IAAIC,MAAM,gBAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOD,KAAAA;AACT;AALgBD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAUT,SAASG,eAAeC,OAAAA,EAAmE;AAIhG,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfN,IAAAA,WAAAA,EAAaiD,QAAQ/C,SAAAA,CAAUI;AACjC,GAAA;AACF;AAdgB0C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,SAASG,iBACdF,OAAAA,EAAU;AAGVJ,EAAAA,SAAAA,CAAUI,QAAQH,KAAK,CAAA;AAEvB,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAGA,EAAA,OAAOE,OAAAA;AACT;AAZgBE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,SAASC,SAASH,OAAAA,EAAsE;AAI7F,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQI,YAAAA,EAAc/C,EAAAA,EAAI;AAC7B,IAAA,MAAM,IAAIyC,MAAM,kCAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfgD,IAAAA,KAAAA,EAAOL,QAAQI,YAAAA,CAAa/C;AAC9B,GAAA;AACF;AAdgB8C,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAmBT,SAASG,YAAYN,OAAAA,EAA0C;AACpE,EAAA,IAAI,CAACA,OAAAA,CAAQO,MAAAA,EAAQlD,EAAAA,EAAI;AACvB,IAAA,MAAM,IAAIyC,MAAM,4BAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOE,QAAQO,MAAAA,CAAOlD,EAAAA;AACxB;AALgBiD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;ACvQhB,IAAIE,cAAAA,GAA+C,IAAA;AAK5C,SAASC,iBAAiBpC,OAAAA,EAA8B;AAC7DmC,EAAAA,cAAAA,GAAiBnC,OAAAA;AACjBzB,EAAAA,MAAAA,CAAOC,MAAM,4CAAA,CAAA;AACf;AAHgB4D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAQhB,SAASC,SAAAA,CAAUC,SAAkBC,GAAAA,EAAW;AAC9C,EAAA,OAAOD,QAAQE,OAAAA,CAAQC,GAAAA,CAAIF,GAAAA,CAAIG,WAAAA,EAAW,CAAA,IAAOC,MAAAA;AACnD;AAFSN,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAIT,SAASO,aAAAA,CAAcC,UAAkBC,QAAAA,EAAgB;AACvD,EAAA,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAAA,CAAKJ,QAAAA,CAAAA;AACnC,EAAA,MAAMK,cAAAA,GAAiBF,MAAAA,CAAOC,IAAAA,CAAKH,QAAAA,CAAAA;AAEnC,EAAA,IAAIC,cAAAA,CAAeI,MAAAA,KAAWD,cAAAA,CAAeC,MAAAA,EAAQ;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOC,MAAAA,CAAOC,eAAAA,CAAgBN,cAAAA,EAAgBG,cAAAA,CAAAA;AAChD;AATSN,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWF,SAASU,uBAAAA,CACdhB,OAAAA,EACAiB,OAAAA,GAA8BC,OAAAA,CAAQC,IAAI,UAAA,CAAA,EAC1CC,oBAAAA,GAA2CF,OAAAA,CAAQC,IAAI,uBAAA,CAAA,IACrDD,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEvC,EAAA,IAAI,CAACpB,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA,EAAe;AACrC,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIiB,YAAY,YAAA,EAAc;AAC5B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMI,uBACJtB,SAAAA,CAAUC,OAAAA,EAAS,0BAAA,CAAA,IAA+BD,SAAAA,CAAUC,SAAS,sBAAA,CAAA;AACvE,EAAA,IAAI,CAACoB,oBAAAA,IAAwB,CAACC,oBAAAA,EAAsB;AAClD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOf,aAAAA,CAAce,sBAAsBD,oBAAAA,CAAAA;AAC7C;AArBgBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA0BhB,SAASM,gBAAgBtB,OAAAA,EAAgB;AAEvC,EAAA,MAAMuB,YAAAA,GAAexB,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMwB,MAAAA,GAASzB,SAAAA,CAAUC,OAAAA,EAAS,WAAA,CAAA;AAClC,EAAA,MAAMyB,EAAAA,GAAKF,cAAcG,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,IAAAA,EAAAA,IAAUH,MAAAA,IAAUnB,MAAAA;AAE5D,EAAA,OAAO;AACLoB,IAAAA,EAAAA;IACAG,SAAAA,EAAW7B,SAAAA,CAAUC,SAAS,YAAA;AAChC,GAAA;AACF;AAVSsB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAwBT,eAAeO,aAAa7B,OAAAA,EAAgB;AAE1C,EAAA,MAAMV,OAAAA,GAAUS,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAIV,OAAAA,IAAW0B,uBAAAA,CAAwBhB,OAAAA,CAAAA,EAAU;AAG/C/D,IAAAA,MAAAA,CAAOC,MAAM,gEAAA,CAAA;AAEb,IAAA,MAAM4F,SAAAA,GAAY/B,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA,IAAmB,MAAA;AACxD,IAAA,MAAM+B,QAAAA,GAAWhC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AAEpC,IAAA,OAAO;MACLtD,EAAAA,EAAI4C,OAAAA;MACJV,IAAAA,EAAMkD,SAAAA;MACN1D,YAAAA,EAAc2B,SAAAA,CAAUC,SAAS,gBAAA,CAAA;MACjClB,SAAAA,EAAWiB,SAAAA,CAAUC,SAAS,aAAA,CAAA;AAC9BjB,MAAAA,MAAAA,EAAQgB,UAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAC7DhB,MAAAA,OAAAA,EACE8C,cAAc,aAAA,IACdC,QAAAA,KAAa,cAAA,IACbA,QAAAA,KAAa,iBACbA,QAAAA,KAAa;AACjB,KAAA;AACF,EAAA;AAEA,EAAA,IAAIzC,OAAAA,EAAS;AACXrD,IAAAA,MAAAA,CAAOe,KAAK,uFAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAMgF,UAAAA,GAAajC,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AAEtC,EAAA,IAAI,CAACgC,UAAAA,EAAYC,UAAAA,CAAW,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMxE,KAAAA,GAAQuE,UAAAA,CAAWE,SAAAA,CAAU,CAAA,CAAA;AAEnC,EAAA,IAAI;AACFjG,IAAAA,MAAAA,CAAOC,MAAM,iFAAA,CAAA;AACb,IAAA,MAAM4B,OAAAA,GAAU,MAAMN,SAAAA,CAAUC,KAAAA,CAAAA;AAEhC,IAAA,IAAI,CAACK,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLpB,MAAAA,EAAAA,EAAIoB,OAAAA,CAAQpB,EAAAA;MACZkC,IAAAA,EAAM,MAAA;AACNR,MAAAA,YAAAA,EAAcN,OAAAA,CAAQM;AACxB,KAAA;AACF,EAAA,CAAA,CAAA,OAASrB,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,sCAAsCD,KAAAA,CAAAA;AAClD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAzDe8E,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA8Df,SAASM,cAAcnC,OAAAA,EAAgB;AAErC,EAAA,MAAMoC,QAAAA,GAAWrC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AACpC,EAAA,MAAMqC,cAAAA,GAAiBtC,SAAAA,CAAUC,OAAAA,EAAS,mBAAA,CAAA;AAE1C,EAAA,IAAIoC,QAAAA,EAAU;AACZ,IAAA,OAAO;MACL1F,EAAAA,EAAI0F,QAAAA;AACJE,MAAAA,QAAAA,EAAUD,cAAAA,IAAkB;AAC9B,KAAA;AACF,EAAA;AAGA,EAAA,OAAOxC,gBAAgB0C,aAAAA,IAAiB,IAAA;AAC1C;AAdSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASK,oBAAoBxC,OAAAA,EAAgB;AAC3C,EAAA,MAAMN,QAAQK,SAAAA,CAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAEnE,EAAA,IAAIN,KAAAA,EAAO;AACT,IAAA,OAAO;MAAEhD,EAAAA,EAAIgD;AAAM,KAAA;AACrB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARS8C,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASC,gBAAAA,CAAiBzC,SAAkBd,KAAAA,EAAoB;AAE9D,EAAA,MAAM9C,WAAAA,GAAc2D,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEvC,EAAA,IAAI5D,WAAAA,EAAa;AACf,IAAA,OAAO;MAAEM,EAAAA,EAAIN;AAAY,KAAA;AAC3B,EAAA;AAGA,EAAA,IAAI8C,OAAOd,YAAAA,EAAc;AACvB,IAAA,OAAO;AAAE1B,MAAAA,EAAAA,EAAIwC,KAAAA,CAAMd;AAAa,KAAA;AAClC,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAdSqE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAmBT,SAASC,eAAe1C,OAAAA,EAAgB;AACtC,EAAA,MAAM2C,SAAAA,GAAY5C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI2C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEjG,EAAAA,EAAIiG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaT,SAASE,eAAe5C,OAAAA,EAAgB;AACtC,EAAA,MAAM6C,SAAAA,GAAY9C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI6C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEnG,EAAAA,EAAImG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASE,iBAAiB9C,OAAAA,EAAgB;AACxC,EAAA,MAAM+C,OAAAA,GAAUhD,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACnC,EAAA,MAAMgD,QAAAA,GAAWjD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AACpC,EAAA,MAAMiD,QAAAA,GAAWlD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEpC,EAAA,OAAO;IACL+C,OAAAA,EAASA,OAAAA,EAASG,aAAAA,IAAiB7C,MAAAA;IACnC2C,QAAAA,EAAUA,QAAAA,EAAUE,aAAAA,IAAiB7C,MAAAA;AACrC4C,IAAAA,QAAAA,EAAUA,QAAAA,IAAY5C;AACxB,GAAA;AACF;AAVSyC,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAwBT,SAASK,sBAAsBnD,OAAAA,EAAgB;AAC7C,EAAA,MAAMoD,SAAAA,GAAYrD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAGrC,EAAA,IAAI,CAACoD,SAAAA,EAAW;AACd,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMC,YAAAA,GAAetD,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMsD,eAAAA,GAAkBvD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAC3C,EAAA,MAAMuD,eAAAA,GAAkBxD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAE3C,EAAA,OAAO;AACLoD,IAAAA,SAAAA;IACAI,MAAAA,EAAQH,YAAAA,GAAeA,YAAAA,CAAa3B,KAAAA,CAAM,GAAA,CAAA,CAAK+B,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAE/B,IAAAA,EAAI,CAAA,GAAMtB,MAAAA;AACtEsD,IAAAA,SAAAA,EAAWL,eAAAA,GAAkB,IAAIM,IAAAA,CAAKN,eAAAA,CAAAA,GAAmBjD,MAAAA;AACzDwD,IAAAA,SAAAA,EAAWN,eAAAA,GAAkB,IAAIK,IAAAA,CAAKL,eAAAA,CAAAA,GAAmBlD;AAC3D,GAAA;AACF;AAlBS8C,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA0BT,eAAsBW,aAAa9D,OAAAA,EAAgB;AACjD,EAAA,IAAI,CAACH,cAAAA,EAAgB;AACnB,IAAA,MAAM,IAAIV,MAAM,wEAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMD,KAAAA,GAAQ,MAAM2C,YAAAA,CAAa7B,OAAAA,CAAAA;AAGjC,EAAA,MAAMJ,MAAAA,GAASuC,cAAcnC,OAAAA,CAAAA;AAC7B,EAAA,MAAMP,YAAAA,GAAe+C,oBAAoBxC,OAAAA,CAAAA;AACzC,EAAA,MAAM1D,SAAAA,GAAYmG,gBAAAA,CAAiBzC,OAAAA,EAASd,KAAAA,CAAAA;AAC5C,EAAA,MAAM6E,OAAAA,GAAUrB,eAAe1C,OAAAA,CAAAA;AAC/B,EAAA,MAAMgE,OAAAA,GAAUpB,eAAe5C,OAAAA,CAAAA;AAC/B,EAAA,MAAMiE,QAAAA,GAAW3C,gBAAgBtB,OAAAA,CAAAA;AACjC,EAAA,MAAMkE,cAAAA,GAAiBf,sBAAsBnD,OAAAA,CAAAA;AAG7C,EAAA,IAAImE,IAAAA;AACJ,EAAA,IAAItE,eAAesE,IAAAA,EAAM;AACvBA,IAAAA,IAAAA,GAAOtE,cAAAA,CAAesE,IAAAA,CAAKC,wBAAAA,CAAyBpE,OAAAA,CAAAA;AACtD,EAAA;AAGA,EAAA,MAAMqE,GAAAA,GAAMvB,iBAAiB9C,OAAAA,CAAAA;AAC7B,EAAA,IAAIqE,GAAAA,CAAItB,OAAAA,IAAWsB,GAAAA,CAAIrB,QAAAA,IAAYqB,IAAIpB,QAAAA,EAAU;AAC/C,IAAA,IAAIkB,IAAAA,EAAM;AAER,MAAA,IAAIE,GAAAA,CAAItB,OAAAA,EAASoB,IAAAA,CAAKpB,OAAAA,GAAUsB,GAAAA,CAAItB,OAAAA;AACpC,MAAA,IAAIsB,GAAAA,CAAIrB,QAAAA,EAAUmB,IAAAA,CAAKnB,QAAAA,GAAWqB,GAAAA,CAAIrB,QAAAA;AACtC,MAAA,IAAIqB,GAAAA,CAAIpB,QAAAA,EAAUkB,IAAAA,CAAKlB,QAAAA,GAAWoB,GAAAA,CAAIpB,QAAAA;IACxC,CAAA,MAAO;AAELkB,MAAAA,IAAAA,GAAO;QACLG,MAAAA,EAAQ,OAAA;QACRC,QAAAA,EAAU,IAAA;AACVxB,QAAAA,OAAAA,EAASsB,GAAAA,CAAItB,OAAAA;AACbC,QAAAA,QAAAA,EAAUqB,GAAAA,CAAIrB,QAAAA;AACdC,QAAAA,QAAAA,EAAUoB,GAAAA,CAAIpB,QAAAA;QACduB,CAAAA,kBAAG,MAAA,CAAA,CAACvE,QAAgBA,GAAAA,EAAjB,GAAA,CAAA;QACHwE,EAAAA,kBAAI,MAAA,CAAA,CAACxE,QAAgBA,GAAAA,EAAjB,IAAA,CAAA;AACJyE,QAAAA,YAAAA,kBAAc,MAAA,CAAA,CAACC,KAAAA,KAAkBC,MAAAA,CAAOD,KAAAA,CAAAA,EAA1B,cAAA,CAAA;AACdE,QAAAA,cAAAA,0BAAiBF,KAAAA,EAAe3B,QAAAA,KAAqB,GAAGA,QAAAA,CAAAA,CAAAA,EAAY2B,KAAAA,CAAAA,CAAAA,EAApD,gBAAA,CAAA;AAChBG,QAAAA,UAAAA,kBAAY,MAAA,CAAA,CAACC,IAAAA,KAAwBH,MAAAA,CAAOG,IAAAA,CAAAA,EAAhC,YAAA,CAAA;AACZC,QAAAA,kBAAAA,0BAAqBL,KAAAA,EAAeM,IAAAA,KAAsC,GAAGN,KAAAA,CAAAA,CAAAA,EAASM,IAAAA,CAAAA,CAAAA,EAAlE,oBAAA;AACtB,OAAA;AACF,IAAA;AACF,EAAA;AAKA,EAAA,MAAMC,UAAAA,GAAAA,CACHhG,KAAAA,EAAON,IAAAA,KAAS,KAAA,IAASM,OAAON,IAAAA,KAAS,SAAA,IAAaM,KAAAA,EAAON,IAAAA,KAAS,iBAAA,KACvEsF,cAAAA,EAAgBd,SAAAA,GACZc,cAAAA,CAAed,YACflE,KAAAA,EAAOxC,EAAAA;AAIb,EAAA,MAAMyI,YAAAA,GAAe;AACnB/I,IAAAA,WAAAA,EAAaE,SAAAA,EAAWI,EAAAA;AACxB0F,IAAAA,QAAAA,EAAUxC,MAAAA,EAAQlD,EAAAA;AAClB4C,IAAAA,OAAAA,EAASJ,KAAAA,EAAOxC,EAAAA;AAChBoF,IAAAA,SAAAA,EAAW5C,KAAAA,EAAON,IAAAA;AAClBwG,IAAAA,cAAAA,EAAgB3F,YAAAA,EAAc/C,EAAAA;AAC9BiG,IAAAA,SAAAA,EAAWoB,OAAAA,EAASrH,EAAAA;AACpBwI,IAAAA;AACF,GAAA;AAEAjJ,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxDE,IAAAA,WAAAA,EAAa+I,aAAa/I,WAAAA,IAAe,MAAA;AACzCkD,IAAAA,OAAAA,EAAS6F,aAAa7F,OAAAA,IAAW,MAAA;IACjC+F,SAAAA,EAAWtF,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA,IAAqB;GACrD,CAAA;AAEAsF,EAAAA,mBAAAA,CAAoBH,YAAAA,CAAAA;AAEpB,EAAA,OAAO;AACLnF,IAAAA,OAAAA;AACAd,IAAAA,KAAAA;AACAU,IAAAA,MAAAA;AACAH,IAAAA,YAAAA;AACAnD,IAAAA,SAAAA;AACAyH,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,cAAAA,EAAgBA,cAAAA,IAAkB7D,MAAAA;IAClC6E,UAAAA,EAAYA,UAAAA,IAAchG,OAAOxC,EAAAA,IAAM,EAAA;AACvCL,IAAAA,EAAAA,EAAIwD,eAAevE,KAAAA,EAAK;AACxB6I,IAAAA,IAAAA;AACAoB,IAAAA,eAAAA,EAAiB,IAAIC,OAAAA;AACvB,GAAA;AACF;AA7FsB1B,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAkGf,SAAS2B,iBAAAA,GAAAA;AACd,EAAA,OAAO5F,cAAAA;AACT;AAFgB4F,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;AC7ZhB,IAAMC,iBAAAA,GAAoB;AACxB,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA;;AAGK,SAASC,oBAAAA,CACdC,SACAC,WAAAA,EAAiE;AAEjE,EAAA,MAAMC,UAAAA,GAAAA,CAAcC,MAAMC,OAAAA,CAAQJ,OAAAA,IAAWA,OAAAA,GAAUA,OAAAA,EAASlE,MAAM,GAAA,CAAA,IAAQ,EAAA,EAC3E+B,GAAAA,CAAI,CAACwC,MAAAA,KAAWA,MAAAA,CAAOtE,MAAI,CAAA,CAC3BuE,OAAOC,OAAAA,CAAAA;AAEV,EAAA,IAAIL,UAAAA,CAAWjF,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAOgF,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,IAAII,UAAAA,CAAWM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAC5B,IAAA,OAAOP,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,OAAOI,UAAAA;AACT;AAjBgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAmBT,SAASU,wBAAAA,CAAyBC,eAA8BC,cAAAA,EAAwB;AAC7F,EAAA,IAAI,CAACD,aAAAA,EAAe;AAClB,IAAA,OAAOC,cAAAA,CAAe,CAAA,CAAA,IAAM,IAAA;AAC9B,EAAA;AAEA,EAAA,OAAOA,cAAAA,CAAeH,QAAAA,CAASE,aAAAA,CAAAA,GAAiBA,aAAAA,GAAgB,IAAA;AAClE;AANgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASG,qBAAqBtH,KAAAA,EAAoB;AACvD,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOA,KAAAA,CAAMF,YAAY,IAAA,IAAQ;AAAC,IAAA,SAAA;AAAW,IAAA;AAAeoH,GAAAA,CAAAA,QAAAA,CAASlH,MAAMN,IAAI,CAAA;AACjF;AANgB4H,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;;;ACbhB,IAAIC,eAAAA,GAA+B,IAAA;AAKnC,eAAsBC,aAAaC,UAAAA,EAA4B;AAC7D,EAAA,MAAM,EACJ3K,MAAAA,EACA4K,YAAAA,EACAC,MAAAA,EACAC,WAAAA,EACAC,aAAAA,EACAC,WAAAA,EACAlD,YAAAA,EAAcmD,kBAAAA,EACdC,wBAAAA,EACAC,yBAAAA,EACAC,UAAAA,EAAU,GACRT,UAAAA;AAGJ,EAAA,MAAM,EAAEU,MAAAA,EAAM,GAAK,MAAM,OAAO,QAAA,CAAA;AAChC,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,oBAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,IAAAA,EAAI,GAAK,MAAM,OAAO,gBAAA,CAAA;AAC9B,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,cAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,oBAAoBnM,KAAAA,EAAAA,MAAAA,EAAOoM,oBAAkB,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvE,EAAA,MAAM,EAAEC,oBAAAA,EAAoB,GAAK,MAAM,OAAO,wBAAA,CAAA;AAC9C,EAAA,MAAM,EAAEC,mBAAAA,EAAmB,GAAK,MAAM,OAAO,2BAAA,CAAA;AAC7C,EAAA,MAAM,EAAEC,0BAAAA,EAAAA,2BAAAA,EAA0B,GAAK,MAAM,OAAO,gCAAA,CAAA;AAEpD5L,EAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,sBAAA,EAAyB9L,MAAAA,CAAO+L,WAAW,CAAA,GAAA,CAAK,CAAA;AAG5D,EAAA,MAAMC,QAAAA,GACJhM,MAAAA,CAAOgM,QAAAA,KACNhM,MAAAA,CAAO+L,YAAY9F,UAAAA,CAAW,SAAA,CAAA,GAC3B,QAAA,GACAjG,MAAAA,CAAO+L,WAAAA,CAAY9F,UAAAA,CAAW,SAAA,IAC5B,QAAA,GACA,QAAA,CAAA;AAIR,EAAA,MAAMgG,iCACJd,yBAAAA,KAA8B,IAAA,GAAO,QAAQA,yBAAAA,KAA8B,KAAA,GAAQ,OAAOa,QAAAA,KAAa,QAAA;AAEzG/L,EAAAA,MAAAA,CAAO6L,KAAK,mCAAA,EAAqC;AAC/CE,IAAAA,QAAAA;IACAE,kBAAAA,EAAoBD;GACtB,CAAA;AAEA,EAAA,MAAM,EAAEE,OAAAA,EAAO,GAAKV,kBAAAA,CAAmBb,YAAAA,EAAc5K,OAAO+L,WAAAA,EAAa;IACvEK,wBAAAA,EAA0B,KAAA;IAC1BC,wBAAAA,EAA0BJ,8BAAAA;AAC1B,IAAA,GAAIf,wBAAAA,GAA2B;AAAEA,MAAAA;AAAyB,KAAA,GAAI;GAChE,CAAA;AACA,EAAA,MAAMiB,OAAAA,EAAAA;AAGN,EAAA,IAAIG,YAAAA;AACJ,EAAA,IAAItM,MAAAA,CAAOmI,IAAAA,EAAMoE,OAAAA,IAAWvM,MAAAA,CAAOmI,KAAKqE,WAAAA,EAAa;AACnDvM,IAAAA,MAAAA,CAAO6L,KAAK,+BAAA,CAAA;AACZQ,IAAAA,YAAAA,GAAe,IAAIG,IAAAA,CAAK;MACtBC,aAAAA,EAAe1M,MAAAA,CAAOmI,KAAKuE,aAAAA,IAAiB,OAAA;MAC5CC,cAAAA,EAAgB3M,MAAAA,CAAOmI,KAAKwE,cAAAA,IAAkB,OAAA;AAC9CH,MAAAA,WAAAA,EAAaxM,OAAOmI,IAAAA,CAAKqE,WAAAA;AACzBI,MAAAA,gBAAAA,EAAkB5M,OAAOmI,IAAAA,CAAKyE,gBAAAA;MAC9BC,SAAAA,EAAW7M,MAAAA,CAAOmI,IAAAA,CAAK0E,SAAAA,IAAa7M,MAAAA,CAAO+L,WAAAA;AAC3Ce,MAAAA,QAAAA,EAAU9M,OAAOmI,IAAAA,CAAK2E,QAAAA;MACtBC,UAAAA,EAAY/M,MAAAA,CAAOmI,KAAK4E,UAAAA,IAAc,IAAA;MACtCC,WAAAA,EAAa,IAAA;MACbC,kBAAAA,EAAoB;KACtB,CAAA;AACA,IAAA,MAAMX,aAAaY,UAAAA,EAAU;AAC7BjN,IAAAA,MAAAA,CAAO6L,IAAAA,CAAK,2CAA2CQ,YAAAA,CAAaa,mBAAAA,GAAsBC,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAO,CAAA;AACxG,EAAA;AAGAtJ,EAAAA,gBAAAA,CAAiB;IACfxE,KAAAA,kBAAO,MAAA,CAAA,MAAMA,QAAAA,EAAN,OAAA,CAAA;IACP6I,IAAAA,EAAMmE;GACR,CAAA;AAGArL,EAAAA,oBAAAA,EAAAA;AAGA,EAAA,IAAI6J,WAAAA,EAAa;AACf7K,IAAAA,MAAAA,CAAO6L,KAAK,uCAAA,CAAA;AACZ,IAAA,MAAMhB,YAAYoC,UAAAA,EAAU;AAC9B,EAAA;AAGA,EAAA,MAAMG,KAAAA,GAAQrN,OAAO6J,WAAAA,KAAgB,YAAA;AACrC,EAAA,MAAMyD,gBAAAA,GAAmBtN,OAAOsN,gBAAAA,IAAoBD,KAAAA;AAGpD,EAAA,MAAME,qBAAAA,GAAwBvN,MAAAA,CAAOwN,cAAAA,EAAgBjB,OAAAA,IAAWP,QAAAA,KAAa,QAAA;AAC7E/L,EAAAA,MAAAA,CAAO6L,KAAK,CAAA,mBAAA,EAAsBE,QAAAA,sBAA8BuB,qBAAAA,GAAwB,SAAA,GAAY,UAAA,CAAA,CAAY,CAAA;AAEhH,EAAA,MAAME,wBAAwBF,qBAAAA,GAC1B;IACE1B,2BAAAA,CAA2B;MACzBU,OAAAA,EAAS,IAAA;AACTmB,MAAAA,qBAAAA,EAAuB1N,OAAOwN,cAAAA,EAAgBE;KAChD;MAEF,EAAA;AAGJ,EAAA,MAAMC,eAAAA,GAAkB3N,OAAO2N,eAAAA,IAAmB,UAAA;AAClD1N,EAAAA,MAAAA,CAAO6L,KAAK,0DAAA,CAAA;AAEZ,EAAA,MAAM8B,qBAAAA,GAAoC;AACxCC,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEC,QAAAA,EAAUC,aAAAA,EAAa,KAAkD;AACtF,MAAA,MAAMC,WAAAA,GAAcD,aAAAA;AACpB,MAAA,IAAIC,aAAazE,eAAAA,EAAiB;AAChCyE,QAAAA,WAAAA,CAAYzE,eAAAA,CAAgB0E,OAAAA,CAAQ,CAACtF,KAAAA,EAAe1E,GAAAA,KAAAA;AAClD6J,UAAAA,QAAAA,CAAS5J,OAAAA,CAAQgK,MAAAA,CAAOjK,GAAAA,EAAK0E,KAAAA,CAAAA;QAC/B,CAAA,CAAA;AACF,MAAA;IACF,CAAA,EAPY,YAAA;AAQd,GAAA;AAEA,EAAA,MAAMwF,OAAO3C,UAAAA,CAAiC;AAC5CmC,IAAAA,eAAAA;AACA9C,IAAAA,MAAAA;IACAuD,QAAAA,EAAUd,gBAAAA;IACVe,OAAAA,EAAS;AACPnO,MAAAA,KAAAA,6BAAWoO,IAAAA,KAASrO,MAAAA,CAAOC,MAAM,WAAA,EAAA,GAAgBoO,IAAAA,CAAAA,EAA1C,OAAA,CAAA;AACPxC,MAAAA,IAAAA,6BAAUwC,IAAAA,KAASrO,MAAAA,CAAO6L,KAAK,WAAA,EAAA,GAAgBwC,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNtN,MAAAA,IAAAA,6BAAUsN,IAAAA,KAASrO,MAAAA,CAAOe,KAAK,WAAA,EAAA,GAAgBsN,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNvN,MAAAA,KAAAA,6BAAWuN,IAAAA,KAASrO,MAAAA,CAAOc,MAAM,WAAA,EAAA,GAAgBuN,IAAAA,CAAAA,EAA1C,OAAA;AACT,KAAA;IACAC,OAAAA,EAAS;AAAId,MAAAA,GAAAA,qBAAAA;AAAuBG,MAAAA,qBAAAA;AAA2B5C,MAAAA,GAAAA,WAAAA,IAAe;;IAC9E3H,OAAAA,kBAAS,MAAA,CAAA,OAAO,EAAEW,OAAAA,EAAO,KAAE;AAEzB,MAAA,MAAMwK,cAAAA,GAAiB,MAAM1G,YAAAA,CAAa9D,OAAAA,CAAAA;AAG1C,MAAA,IAAIiH,kBAAAA,EAAoB;AACtB,QAAA,OAAOA,mBAAmBuD,cAAAA,CAAAA;AAC5B,MAAA;AAEA,MAAA,OAAOA,cAAAA;IACT,CAAA,EAVS,SAAA;GAWX,CAAA;AAGA,EAAA,MAAMC,GAAAA,GAAM,IAAIpD,MAAAA,CAAO;IAAEqD,OAAAA,EAASpD;GAAW,CAAA;AAG7C,EAAA,MAAMqD,WAAAA,GAAchF,oBAAAA,CAAqB3J,MAAAA,CAAO2O,WAAAA,EAAa3O,OAAO6J,WAAW,CAAA;AAE/E4E,EAAAA,GAAAA,CAAIG,IACFrD,IAAAA,CAAK;IACHtB,MAAAA,EAAQ0E,WAAAA;AACRE,IAAAA,WAAAA,EAAaF,YAAY9J,MAAAA,GAAS,CAAA;IAClCiK,cAAAA,EAAgB;AACd,MAAA,cAAA;AACA,MAAA,eAAA;AACA,MAAA,aAAA;AACA,MAAA,gBAAA;AACA,MAAA,UAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,gBAAA;AACA,MAAA,iBAAA;AACA,MAAA,UAAA;AACA,MAAA,YAAA;AACA,MAAA,eAAA;AACA,MAAA,gBAAA;AACA,MAAA,gBAAA;;AAEA,MAAA,YAAA;AACA,MAAA,cAAA;AACA,MAAA,0BAAA;AACA,MAAA;;IAEFC,OAAAA,EAAS;AAAC,MAAA,KAAA;AAAO,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,OAAA;AAAS,MAAA,QAAA;AAAU,MAAA;;AACrD,GAAA,CAAA,CAAA;AAIF,EAAA,MAAMC,gBAAAA,GAAAA,CAAoBjE,iBAAiB,EAAA,EAAIb,OAAO,CAAC+E,EAAAA,KAAOA,GAAGC,OAAO,CAAA;AACxE,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIJ,gBAAAA,CAAiBvH,GAAAA,CAAI,CAACwH,EAAAA,KAAO;IAACA,EAAAA,CAAGI,IAAAA;AAAMJ,IAAAA;GAAG,CAAA,CAAA;AACvE,EAAA,MAAMK,eAAAA,GAAkBN,gBAAAA,CAAiBvH,GAAAA,CAAI,CAACnB,QAAAA,KAAAA;AAC5C,IAAA,MAAMiJ,YAAAA,GAAejJ,QAAAA,CAAS+I,IAAAA,CAAKG,OAAAA,CAAQ,WAAW,OAAA,CAAA;AACtD,IAAA,OAAO;AACLlJ,MAAAA,QAAAA;AACAiJ,MAAAA,YAAAA;AACAE,MAAAA,KAAAA,EAAO,IAAIC,MAAAA,CAAO,CAAA,CAAA,EAAIH,YAAAA,CAAAA,CAAAA,CAAe;AACvC,KAAA;EACF,CAAA,CAAA;AAGA,EAAA,MAAMI,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAE5B,IAAA,MAAMC,UAAAA,GAAaV,YAAAA,CAAahL,GAAAA,CAAIyL,QAAAA,CAAAA;AACpC,IAAA,IAAIC,YAAY,OAAOA,UAAAA;AAGvB,IAAA,KAAA,MAAW,EAAEvJ,QAAAA,EAAUmJ,KAAAA,EAAOF,YAAAA,MAAkBD,eAAAA,EAAiB;AAC/D,MAAA,MAAMQ,OAAAA,GAAUL,KAAAA,CAAMM,IAAAA,CAAKH,QAAAA,CAAAA;AAC3B3P,MAAAA,MAAAA,CAAOC,KAAAA,CACL,CAAA,kBAAA,EAAqB0P,QAAAA,CAAAA,iBAAAA,EAA4BtJ,QAAAA,CAAS+I,IAAI,CAAA,SAAA,EAAYE,YAAAA,CAAAA,UAAAA,EAAyBO,OAAAA,CAAAA,CAAS,CAAA;AAE9G,MAAA,IAAIA,OAAAA,EAAS;AACX7P,QAAAA,MAAAA,CAAOC,MAAM,CAAA,iBAAA,EAAoB0P,QAAAA,CAAAA,YAAAA,EAAuBtJ,QAAAA,CAAS+I,IAAI,CAAA,CAAE,CAAA;AACvE,QAAA,OAAO/I,QAAAA;AACT,MAAA;AACF,IAAA;AAEArG,IAAAA,MAAAA,CAAOC,MAAM,CAAA,wCAAA,EAA2C0P,QAAAA,CAAAA,oBAAAA,EAA+BZ,gBAAAA,CAAiBnK,MAAM,CAAA,CAAE,CAAA;AAChH,IAAA,OAAOR,MAAAA;EACT,CAAA,EAnB6B,sBAAA,CAAA;AAyB7BoK,EAAAA,GAAAA,CAAIuB,SAAAA,CAAU,OAAO,EAAEhM,OAAAA,EAAO,KAAE;AAC9B,IAAA,MAAMiM,GAAAA,GAAM,IAAIC,GAAAA,CAAIlM,OAAAA,CAAQiM,GAAG,CAAA;AAC/B,IAAA,MAAML,WAAWK,GAAAA,CAAIL,QAAAA;AACrB3P,IAAAA,MAAAA,CAAOC,MAAM,CAAA,oBAAA,EAAuB8D,OAAAA,CAAQmM,MAAM,CAAA,CAAA,EAAIP,QAAAA,CAAAA,CAAU,CAAA;AAChE,IAAA,MAAMQ,aAAAA,GAAgBR,QAAAA,KAAa,SAAA,IAAaA,QAAAA,CAAS3J,WAAW,UAAA,CAAA;AAGpE,IAAA,MAAMoK,mCAAmB,MAAA,CAAA,MAAA;AACvB,MAAA,MAAMpG,MAAAA,GAASjG,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA,IAAa,GAAA;AAChD,MAAA,MAAMmM,gBAAgBjG,wBAAAA,CAAyBJ,MAAAA,KAAW,GAAA,GAAM,IAAA,GAAOA,QAAQ0E,WAAAA,CAAAA;AAC/E,MAAA,MAAMzK,OAAAA,GAAkC;QACtC,8BAAA,EAAgC,wCAAA;QAChC,8BAAA,EACE;AACJ,OAAA;AAEA,MAAA,IAAIoM,aAAAA,EAAe;AACjBpM,QAAAA,OAAAA,CAAQ,6BAAA,CAAA,GAAiCoM,aAAAA;AACzCpM,QAAAA,OAAAA,CAAQ,kCAAA,CAAA,GAAsC,MAAA;AAChD,MAAA;AAEA,MAAA,OAAOA,OAAAA;IACT,CAAA,EAfyB,kBAAA,CAAA;AAkBzB,IAAA,MAAMqM,eAAAA,GAAkBH,aAAAA,GAAgB/L,MAAAA,GAAYsL,oBAAAA,CAAqBC,QAAAA,CAAAA;AACzE,IAAA,IAAIW,eAAAA,EAAiB;AACnBtQ,MAAAA,MAAAA,CAAOC,MAAM,CAAA,oCAAA,EAAuC0P,QAAAA,CAAAA,IAAAA,EAAeW,eAAAA,CAAgBlB,IAAI,CAAA,CAAE,CAAA;AACzF,MAAA,MAAMmB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIrM,OAAAA,CAAQmM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAASsM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,IAAIxM,OAAAA,CAAQmM,MAAAA,KAAWI,eAAAA,CAAgBJ,MAAAA,EAAQ;AAC7C,QAAA,OAAO9L,MAAAA;AACT,MAAA;AAEA,MAAA,IAAI;AAEF,QAAA,MAAM6K,OAAAA,GAAU,MAAMlL,OAAAA,CAAQ2M,IAAAA,EAAI;AAGlC,QAAA,MAAMtN,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AAGnC,QAAA,MAAM4M,SAAS,MAAML,eAAAA,CAAgBM,OAAAA,CAAQ7M,OAAAA,EAASX,SAAS6L,OAAAA,CAAAA;AAG/D,QAAA,IAAI0B,kBAAkBH,QAAAA,EAAU;AAE9B,UAAA,MAAMvM,QAAAA,GAAU,IAAIsF,OAAAA,CAAQoH,MAAAA,CAAO1M,OAAO,CAAA;AAC1C,UAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUmI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDtM,YAAAA,QAAAA,CAAQ8M,GAAAA,CAAI/M,GAAAA,EAAK0E,KAAAA,CAAAA;AACnB,UAAA;AACA,UAAA,OAAO,IAAI8H,QAAAA,CAASG,MAAAA,CAAOK,IAAAA,EAAM;AAC/BP,YAAAA,MAAAA,EAAQE,MAAAA,CAAOF,MAAAA;AACfQ,YAAAA,UAAAA,EAAYN,MAAAA,CAAOM,UAAAA;YACnBhN,OAAAA,EAAAA;WACF,CAAA;AACF,QAAA;AAGA,QAAA,MAAMA,OAAAA,GAAU,IAAIsF,OAAAA,CAAQ;UAC1B,cAAA,EAAgB,kBAAA;UAChB,GAAGgH;SACL,CAAA;AAEA,QAAA,OAAO,IAAIC,QAAAA,CAAS7P,IAAAA,CAAKE,SAAAA,CAAU8P,MAAAA,CAAAA,EAAS;UAC1CF,MAAAA,EAAQ,GAAA;AACRxM,UAAAA;SACF,CAAA;AACF,MAAA,CAAA,CAAA,OAASnD,KAAAA,EAAO;AACdd,QAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,kCAAA,EAAqC6O,QAAAA,CAAAA,EAAAA,CAAAA,EAAc7O,KAAAA,CAAAA;AAChE,QAAA,MAAMyP,eAAcH,gBAAAA,EAAAA;AACpB,QAAA,OAAO,IAAII,QAAAA,CACT7P,IAAAA,CAAKE,SAAAA,CAAU;UACbC,KAAAA,EAAOA,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMoQ,OAAAA,GAAU;AAClD,SAAA,CAAA,EACA;UACET,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;YAChB,GAAGsM;AACL;SACF,CAAA;AAEJ,MAAA;AACF,IAAA;AAMA,IAAA,IAAIZ,QAAAA,KAAa,UAAA,IAAc5L,OAAAA,CAAQmM,MAAAA,KAAW,KAAA,EAAO;AACvD,MAAA,IAAI;AACF,QAAA,MAAMiB,aAAAA,GAAgB,aAAA;AACtB,QAAA,MAAMC,IAAAA,GAAQ,MAAM,OAAOD,aAAAA,CAAAA;AAI3B,QAAA,IAAI;AAAEC,UAAAA,IAAAA,CAAKC,qBAAAA,CAAsB;AAAEC,YAAAA,QAAAA,EAAUF,IAAAA,CAAKE;WAAS,CAAA;QAAI,CAAA,CAAA,MAAQ;AAAuB,QAAA;AAC9F,QAAA,MAAMN,IAAAA,GAAO,MAAMI,IAAAA,CAAKE,QAAAA,CAASC,OAAAA,EAAO;AACxC,QAAA,OAAO,IAAIf,SAASQ,IAAAA,EAAM;UACxBP,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAAS;YACP,cAAA,EAAgBmN,IAAAA,CAAKE,SAASE,WAAAA,IAAe;AAC/C;SACF,CAAA;MACF,CAAA,CAAA,MAAQ;AAER,MAAA;AACF,IAAA;AAGA,IAAA,MAAMC,UAAAA,GAAa;AAAC/D,MAAAA,eAAAA;AAAiB,MAAA,CAAA,EAAGA,eAAAA,CAAAA,CAAAA,CAAAA;AAAoB,MAAA;;AAC5D,IAAA,MAAMgE,kBAAAA,GAAqBD,UAAAA,CAAWtH,QAAAA,CAASwF,QAAAA,CAAAA;AAE/C,IAAA,IAAI+B,kBAAAA,EAAoB;AACtB,MAAA,MAAMnB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIrM,OAAAA,CAAQmM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAASsM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,MAAMoB,YAAAA,GAAe,MAAMzD,IAAAA,CAAK0D,KAAAA,CAAM7N,OAAAA,CAAAA;AAGtC,MAAA,MAAME,OAAAA,GAAU,IAAIsF,OAAAA,CAAQoI,YAAAA,CAAa1N,OAAO,CAAA;AAChD,MAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUmI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDtM,QAAAA,OAAAA,CAAQ8M,GAAAA,CAAI/M,KAAK0E,KAAAA,CAAAA;AACnB,MAAA;AAGA,MAAA,OAAO,IAAI8H,QAAAA,CAASmB,YAAAA,CAAaX,IAAAA,EAAM;AACrCP,QAAAA,MAAAA,EAAQkB,YAAAA,CAAalB,MAAAA;AACrBQ,QAAAA,UAAAA,EAAYU,YAAAA,CAAaV,UAAAA;AACzBhN,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,OAAOG,MAAAA;EACT,CAAA,CAAA;AAGAoK,EAAAA,GAAAA,CAAIG,GAAAA,CAAIhD,qBAAAA,CAAAA;AAGR6C,EAAAA,GAAAA,CAAIG,IACFjD,oBAAAA,CAAqB;AACnBmG,IAAAA,cAAAA,EAAgB9R,OAAO8R,cAAAA,IAAkB;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW,MAAA;;IACjEC,cAAAA,EAAgB/R,MAAAA,CAAO+R,kBAAkB,EAAA;AACzCC,IAAAA,UAAAA,EAAYhS,OAAOgS,UAAAA,IAAc,KAAA;AACjCC,IAAAA,qBAAAA,EAAuBjS,OAAOiS,qBAAAA,IAAyB;AACzD,GAAA,CAAA,CAAA;AAQF,EAAA,MAAMC,iCAAiB,MAAA,CAAA,OAAO;IAC5BxB,MAAAA,EAAQ,SAAA;AACRyB,IAAAA,OAAAA,EAASnS,MAAAA,CAAO+L,WAAAA;AAChBqG,IAAAA,OAAAA,EAASpS,OAAOqS,cAAAA,IAAkB,OAAA;IAClCC,SAAAA,EAAAA,iBAAW,IAAI1K,IAAAA,EAAAA,EAAO2K,WAAAA;GACxB,CAAA,EALuB,gBAAA,CAAA;AAOvB9D,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,WAAW+N,cAAAA,CAAAA;AACnBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,gBAAgB+N,cAAAA,CAAAA;AACxBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,iBAAiB+N,cAAAA,CAAAA;AACzBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,mBAAmB+N,cAAAA,CAAAA;AAG3B,EAAA,IAAIpH,WAAAA,EAAa;AAEf2D,IAAAA,GAAAA,CAAItK,IAAI,mBAAA,EAAqB,OAAO,EAAEH,OAAAA,EAASgN,KAAG,KAAE;AAClD,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,OAAO+J,YAAY0H,SAAAA,EAAS;IAC9B,CAAA,CAAA;AAGA/D,IAAAA,GAAAA,CAAItK,IAAI,mBAAA,EAAqB,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AACzD,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKqS,KAAAA;AACxC,MAAA,OAAO3H,WAAAA,CAAY4H,SAAAA,CAAUtJ,cAAAA,EAAgBhJ,WAAAA,CAAAA;IAC/C,CAAA,CAAA;AAGAqO,IAAAA,GAAAA,CAAItK,IAAI,qBAAA,EAAuB,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AAC3D,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAauS,KAAAA,EAAK,GAAKF,KAAAA;AAK/C,MAAA,MAAMG,WAAAA,GAAcD,KAAAA,EAAOjN,KAAAA,CAAM,GAAA,CAAA,CAAK+B,IAAI,CAACe,CAAAA,KAAMA,CAAAA,CAAE7C,IAAAA,EAAI,CAAA;AACvD,MAAA,OAAOmF,WAAAA,CAAY+H,cAAAA,CAAezJ,cAAAA,EAAgBhJ,WAAAA,EAAawS,WAAAA,CAAAA;IACjE,CAAA,CAAA;AAGAnE,IAAAA,GAAAA,CAAItK,IAAI,0BAAA,EAA4B,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AAChE,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKqS,KAAAA;AACxC,MAAA,OAAO3H,WAAAA,CAAYgI,mBAAAA,CAAoB1J,cAAAA,EAAgBhJ,WAAAA,CAAAA;IACzD,CAAA,CAAA;AACF,EAAA;AAGA,EAAA,IAAI2K,aAAAA,IAAiBA,aAAAA,CAAclG,MAAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,KAAA,MAAWyB,YAAYyE,aAAAA,EAAe;AAEpC,MAAA,IAAIzE,SAAS4I,OAAAA,EAAS;AACpBjP,QAAAA,MAAAA,CAAO6L,KAAK,CAAA,uCAAA,EAA0CxF,QAAAA,CAAS6J,MAAM,CAAA,CAAA,EAAI7J,QAAAA,CAAS+I,IAAI,CAAA,CAAE,CAAA;AACxF,QAAA;AACF,MAAA;AAEA,MAAA,MAAMwB,OAAAA,mBAAU,MAAA,CAAA,OAAO,EAAE7M,OAAAA,EAAO,KAAwB;AACtD,QAAA,MAAMX,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,QAAA,OAAOsC,QAAAA,CAASuK,OAAAA,CAAQ7M,OAAAA,EAASX,OAAAA,CAAAA;MACnC,CAAA,EAHgB,SAAA,CAAA;AAKhB,MAAA,QAAQiD,SAAS6J,MAAAA;QACf,KAAK,KAAA;AACH1B,UAAAA,GAAAA,CAAItK,GAAAA,CAAImC,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,MAAA;AACHpC,UAAAA,GAAAA,CAAIsE,IAAAA,CAAKzM,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACxB,UAAA;QACF,KAAK,KAAA;AACHpC,UAAAA,GAAAA,CAAIuE,GAAAA,CAAI1M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,OAAA;AACHpC,UAAAA,GAAAA,CAAIwE,KAAAA,CAAM3M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACzB,UAAA;QACF,KAAK,QAAA;AACHpC,UAAAA,GAAAA,CAAIyE,MAAAA,CAAO5M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AAC1B,UAAA;AACJ;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAMsC,IAAAA,GAAOnT,OAAOmT,IAAAA,IAAQ,SAAA;AAC5B,EAAA,MAAMC,OAAOpT,MAAAA,CAAOoT,IAAAA;AAGpB,EAAA,MAAMC,cAAAA,GAAiC;AACrC5E,IAAAA,GAAAA;IACA6E,MAAAA,EAAQ,IAAA;AACRC,IAAAA,KAAAA,kBAAO,MAAA,CAAA,YAAA;AACL9I,MAAAA,eAAAA,uBAAsB7C,IAAAA,EAAAA;AAGtB6G,MAAAA,GAAAA,CAAI+E,MAAAA,CAAO;AACTJ,QAAAA,IAAAA;QACAK,QAAAA,EAAUN;OACZ,CAAA;AAIA,MAAA,MAAMO,SAAAA,GAAYjF,GAAAA;AAClB4E,MAAAA,cAAAA,CAAeC,SAASI,SAAAA,CAAUJ,MAAAA;AAElCrT,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,UAAA,EAAM9L,MAAAA,CAAO+L,WAAW,CAAA,sBAAA,EAAyBoH,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,CAAAA,EAAOzF,eAAAA,CAAAA,CAAiB,CAAA;IAC/F,CAAA,EAfO,OAAA,CAAA;AAgBPgG,IAAAA,IAAAA,kBAAM,MAAA,CAAA,YAAA;AACJ1T,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,kBAAA,EAAqB9L,MAAAA,CAAO+L,WAAW,CAAA,GAAA,CAAK,CAAA;AAExD,MAAA,IAAIX,UAAAA,EAAY;AACd,QAAA,MAAMA,UAAAA,EAAAA;AACR,MAAA;AAEA,MAAA,IAAIN,WAAAA,EAAa;AACf,QAAA,MAAMA,YAAY8I,QAAAA,EAAQ;AAC5B,MAAA;AAEA,MAAA,MAAMlI,kBAAAA,GAAqBmI,UAAAA,EAAU;AAErC,MAAA,IAAIR,eAAeC,MAAAA,EAAQ;AACzBD,QAAAA,cAAAA,CAAeC,OAAOK,IAAAA,EAAI;AAC5B,MAAA;AAEA1T,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,SAAA,EAAY9L,MAAAA,CAAO+L,WAAW,CAAA,QAAA,CAAU,CAAA;IACtD,CAAA,EAlBM,MAAA,CAAA;AAmBN+H,IAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAA;AACP,MAAA,MAAMC,MAAAA,GAAStJ,eAAAA,GAAkBuJ,IAAAA,CAAKC,KAAAA,CAAAA,CAAOrM,IAAAA,CAAKsM,GAAAA,EAAG,GAAKzJ,eAAAA,CAAgB0J,OAAAA,EAAO,IAAM,GAAA,CAAA,GAAQ,CAAA;AAE/F,MAAA,OAAO;AACLpI,QAAAA,WAAAA,EAAa/L,MAAAA,CAAO+L,WAAAA;AACpBsG,QAAAA,cAAAA,EAAgBrS,OAAOqS,cAAAA,IAAkB,OAAA;AACzCxI,QAAAA,WAAAA,EAAa7J,OAAO6J,WAAAA,IAAe,aAAA;AACnCuJ,QAAAA,IAAAA;AACAD,QAAAA,IAAAA;AACAxF,QAAAA,eAAAA;QACAyG,SAAAA,EAAW3J,eAAAA,EAAiB8H,aAAAA,IAAiB,EAAA;AAC7CwB,QAAAA;AACF,OAAA;IACF,CAAA,EAbS,SAAA;AAcX,GAAA;AAGA,EAAA,MAAMM,gBAAAA,iCAA0BC,MAAAA,KAAAA;AAC9BrU,IAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,SAAA,EAAYwI,MAAAA,CAAAA,sCAAAA,CAA8C,CAAA;AACtE,IAAA,MAAMjB,eAAeM,IAAAA,EAAI;AACzBzO,IAAAA,OAAAA,CAAQqP,KAAK,CAAA,CAAA;EACf,CAAA,EAJyB,kBAAA,CAAA;AAMzBrP,EAAAA,OAAAA,CAAQsP,EAAAA,CAAG,WAAW,MAAA;AACpB,IAAA,KAAKH,iBAAiB,SAAA,CAAA;EACxB,CAAA,CAAA;AACAnP,EAAAA,OAAAA,CAAQsP,EAAAA,CAAG,UAAU,MAAA;AACnB,IAAA,KAAKH,iBAAiB,QAAA,CAAA;EACxB,CAAA,CAAA;AAEA,EAAA,OAAOhB,cAAAA;AACT;AAljBsB3I,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAyjBf,SAAS+J,oBAAoBtU,qBAAAA,EAA4C;AAC9EJ,EAAAA,aAAAA,CAAc;IAAEI,oBAAAA,EAAAA;GAAqB,CAAA;AACvC;AAFgBsU,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * Server Auth Module\n *\n * JWT verification with workspace secret fetching for microservices.\n * Handles HS256 tokens with secrets stored in workspace database.\n */\n\nimport { logger } from '../logger/index.js';\nimport type { IActor, JWTPayload, WorkspaceSecret } from './types.js';\n\n// Type imports from packages\nimport type * as jose from 'jose';\nimport type { VerifyOptions, Jwt, JwtPayload } from 'jsonwebtoken';\n\n/**\n * Workspace model interface for fetching JWT secrets\n */\ninterface WorkspaceModel {\n  findUnique: (args: { where: { id: string } }) => Promise<{ jwtSecret?: unknown } | null>;\n}\n\ninterface DbClient {\n  client: {\n    workspace: WorkspaceModel;\n  };\n}\n\n// Import getDb dynamically to avoid circular dependencies\nlet getDbFn: (() => DbClient) | null = null;\n\nasync function getDb(): Promise<DbClient> {\n  if (!getDbFn) {\n    const prismaModule = await import('../prisma/index.js');\n    // Use unknown first then cast to avoid type inference issues\n    getDbFn = prismaModule.getDb as unknown as () => DbClient;\n  }\n  return getDbFn();\n}\n\n// Interface for the subset of jsonwebtoken we use\ninterface JwtModule {\n  decode(token: string, options?: { complete?: boolean }): string | Jwt | JwtPayload | null;\n  verify(token: string, secretOrPublicKey: string, options?: VerifyOptions): string | JwtPayload;\n}\n\n// Module cache for dynamic imports\nlet joseModule: typeof jose | null = null;\nlet jwtModule: JwtModule | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\nasync function getJwt(): Promise<JwtModule> {\n  if (!jwtModule) {\n    const jwt = await import('jsonwebtoken');\n    // Handle both ESM and CJS module formats\n    jwtModule = (jwt as { default?: JwtModule }).default ?? (jwt as unknown as JwtModule);\n  }\n  return jwtModule;\n}\n\n/**\n * Fetch workspace secret callback type\n */\nexport type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig {\n  /** Function to fetch workspace JWT secret from database */\n  fetchWorkspaceSecret: FetchWorkspaceSecretFn;\n}\n\nlet authConfig: AuthConfig | null = null;\n\n/**\n * Configure auth module with workspace secret fetching\n */\nexport function configureAuth(config: AuthConfig): void {\n  authConfig = config;\n  logger.debug('[ServerAuth] Auth configured');\n}\n\n/**\n * Default workspace secret fetcher\n *\n * Fetches JWT secret from workspace database. This is the standard implementation\n * that works with any microservice that has access to the workspace model.\n *\n * @param workspaceId - Workspace ID from JWT\n * @returns WorkspaceSecret or null if not found\n */\nexport async function fetchWorkspaceSecret(workspaceId: string): Promise<WorkspaceSecret | null> {\n  try {\n    const db = await getDb();\n    const workspace = await db.client.workspace.findUnique({\n      where: { id: workspaceId },\n    });\n\n    if (!workspace?.jwtSecret) {\n      logger.debug('[ServerAuth] No JWT secret found for workspace', { workspaceId });\n      return null;\n    }\n\n    return JSON.parse(JSON.stringify(workspace.jwtSecret)) as WorkspaceSecret;\n  } catch (error) {\n    logger.warn('[ServerAuth] Error fetching workspace secret', { workspaceId, error });\n    return null;\n  }\n}\n\n/**\n * Configure auth with default workspace secret fetcher\n *\n * This is automatically called by createServer if no custom auth is configured.\n */\nexport function configureDefaultAuth(): void {\n  if (!authConfig) {\n    configureAuth({ fetchWorkspaceSecret });\n    logger.debug('[ServerAuth] Default auth configured with built-in workspace secret fetcher');\n  }\n}\n\n/**\n * Generate a symmetric secret key for JWT signing\n * @returns JWK object with the generated key\n */\nexport async function generateSymmetricSecret(): Promise<jose.JWK> {\n  const joseLib = await getJose();\n  const secret = await joseLib.generateSecret('HS256');\n  const jwk = await joseLib.exportJWK(secret);\n  return jwk;\n}\n\n/**\n * Verify JWT token for workspace-scoped authentication\n *\n * @param token - JWT token to verify\n * @param secret - Optional secret for verification (if not provided, fetches from workspace)\n * @param options - JWT verification options\n * @returns Verified actor information or null if invalid\n */\nexport async function verifyJWT(token: string, secret?: string, options: VerifyOptions = {}): Promise<IActor | null> {\n  try {\n    const jwt = await getJwt();\n    const joseLib = await getJose();\n\n    // Decode to check algorithm and extract workspace_id\n    const decoded = jwt.decode(token, { complete: true });\n\n    if (!decoded || typeof decoded === 'string' || !decoded.payload || typeof decoded.payload !== 'object') {\n      logger.warn('[ServerAuth] Invalid token format');\n      return null;\n    }\n\n    // For workspace-scoped HS256 tokens\n    if (secret) {\n      // Use provided secret\n      const verifiedJwt = jwt.verify(token, secret, options) as JWTPayload;\n      return mapPayloadToActor(verifiedJwt);\n    }\n\n    // Fetch secret from workspace database\n    const decodedJwt = joseLib.decodeJwt(token) as JWTPayload;\n    if (!decodedJwt.workspace_id) {\n      logger.warn('[ServerAuth] No workspace_id found in token');\n      return null;\n    }\n\n    if (!authConfig?.fetchWorkspaceSecret) {\n      logger.error('[ServerAuth] Auth not configured - call configureAuth() first');\n      return null;\n    }\n\n    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);\n    if (!workspaceSecret) {\n      logger.warn('[ServerAuth] Workspace secret not found');\n      return null;\n    }\n\n    const keyLikeSecret = await joseLib.importJWK(workspaceSecret as jose.JWK, 'HS256');\n    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options as jose.JWTVerifyOptions);\n    return mapPayloadToActor(verifiedJwt.payload as unknown as JWTPayload);\n  } catch (err) {\n    logger.warn('[ServerAuth] Error verifying JWT:', err);\n    return null;\n  }\n}\n\n/**\n * Decode JWT without verification (for extracting claims)\n */\nexport async function decodeJWT(token: string): Promise<JWTPayload | null> {\n  try {\n    const joseLib = await getJose();\n    return joseLib.decodeJwt(token) as JWTPayload;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Map JWT payload to IActor interface\n */\nfunction mapPayloadToActor(payload: JWTPayload): IActor {\n  return {\n    id: payload.sub,\n    type: payload.actor_type ?? 'user',\n    workspace_id: payload.workspace_id,\n    tenant_id: payload.tenant_id,\n    org_id: payload.org_id,\n    isAdmin: payload['isAdmin'] as boolean | undefined,\n  };\n}\n\n/**\n * Check if actor is authenticated\n */\nexport function authCheck(actor: IActor | null): IActor {\n  if (!actor) {\n    throw new Error('Please sign in');\n  }\n  return actor;\n}\n\n/**\n * Check workspace context and return actor ID and workspace ID\n */\nexport function workspaceCheck(context: { actor: IActor | null; workspace: { id: string } | null }): {\n  actorId: string;\n  workspaceId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  return {\n    actorId: actor.id,\n    workspaceId: context.workspace.id,\n  };\n}\n\n/**\n * Require workspace context - type narrowing guard for wspace layer services\n *\n * Validates that both actor and workspace are present in the context,\n * and returns a type-narrowed context where workspace and actor are guaranteed non-null.\n * Use this at the start of resolvers in wspace services to get typed access\n * to workspace context without optional chaining.\n *\n * @throws Error if actor is not authenticated\n * @throws Error if workspace context is missing\n *\n * @example\n * ```typescript\n * // In a resolver:\n * const ctx = requireWorkspace(context);\n * const workspaceId = ctx.workspace.id;  // no optional chaining needed\n * const actorId = ctx.actor.id;          // no optional chaining needed\n * ```\n */\nexport function requireWorkspace<T extends { actor: IActor | null; workspace: { id: string } | null }>(\n  context: T\n): T & { actor: IActor; workspace: { id: string } } {\n  // Validate actor is authenticated (throws if null)\n  authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  // Return the same context object with narrowed types\n  return context as T & { actor: IActor; workspace: { id: string } };\n}\n\n/**\n * Check organization context and return actor ID and org ID\n */\nexport function orgCheck(context: { actor: IActor | null; organization: { id: string } | null }): {\n  actorId: string;\n  orgId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.organization?.id) {\n    throw new Error('Please switch to an organization');\n  }\n\n  return {\n    actorId: actor.id,\n    orgId: context.organization.id,\n  };\n}\n\n/**\n * Check tenant context and return tenant ID\n */\nexport function tenantCheck(context: { tenant: { id: string } | null }): string {\n  if (!context.tenant?.id) {\n    throw new Error('Tenant context is required');\n  }\n  return context.tenant.id;\n}\n\n/**\n * Get effective actor ID for \"on behalf of\" tracking\n *\n * When an app or service acts with user consent, returns the delegating user's ID.\n * Otherwise returns the direct actor ID.\n *\n * This is used to determine the `onBehalfOf` field in database audit trails:\n * - If actor is user → returns user ID (self-action)\n * - If actor is app/service with consent → returns grantedBy user ID\n * - If actor is app/service without consent → returns actor ID (self-action)\n *\n * @param context - GraphQL context with actor and optional consent context\n * @returns Effective actor ID (the responsible principal)\n *\n * @example\n * ```typescript\n * // User acting directly\n * context.actor = { id: \"user-123\", type: \"user\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"user-123\"\n *\n * // Bot acting on behalf of user\n * context.actor = { id: \"bot-456\", type: \"service\" }\n * context.consentContext = { grantedBy: \"user-789\" }\n * getEffectiveActorId(context) // → \"user-789\"\n *\n * // App acting without consent (self-action)\n * context.actor = { id: \"app-abc\", type: \"app\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"app-abc\"\n * ```\n */\nexport function getEffectiveActorId(context: {\n  actor: IActor | null;\n  consentContext?: { grantedBy: string } | null;\n}): string | null {\n  if (!context.actor) {\n    return null;\n  }\n\n  // If actor is app or service acting with user consent, return the delegating user\n  if (\n    (context.actor.type === 'app' || context.actor.type === 'service' || context.actor.type === 'service_account') &&\n    context.consentContext?.grantedBy\n  ) {\n    return context.consentContext.grantedBy;\n  }\n\n  // Otherwise return the direct actor (user self-action or app/service self-action)\n  return context.actor.id;\n}\n","/**\n * Server Context Module\n *\n * Builds GraphQL context from request headers, JWT, and configuration.\n * Automatically populates actor, tenant, workspace, and tracking information.\n *\n * **Actor-Based Authentication:**\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Services verify JWT directly and build actor from payload\n *\n * Uses standard Web API Request (compatible with Bun/Elysia).\n */\n\nimport { logger } from '../logger/index.js';\nimport crypto from 'node:crypto';\nimport { verifyJWT } from './auth.js';\nimport type {\n  GraphQLContext,\n  IActor,\n  ITenant,\n  IOrganization,\n  IWorkspace,\n  IProject,\n  IProduct,\n  ITracking,\n} from './types.js';\nimport type { I18n, I18nContext } from '../i18n/index.js';\nimport { setWorkspaceContext } from '../prisma/workspace-extension.js';\n\n/**\n * Context builder options\n */\nexport interface ContextBuilderOptions {\n  /** Database getter function */\n  getDb: () => unknown;\n  /** Default tenant info (optional) */\n  defaultTenant?: ITenant;\n  /** I18n instance (optional) */\n  i18n?: I18n;\n}\n\nlet contextOptions: ContextBuilderOptions | null = null;\n\n/**\n * Configure context builder\n */\nexport function configureContext(options: ContextBuilderOptions): void {\n  contextOptions = options;\n  logger.debug('[ServerContext] Context builder configured');\n}\n\n/**\n * Extract header value from standard Web API Request\n */\nfunction getHeader(request: Request, key: string): string | undefined {\n  return request.headers.get(key.toLowerCase()) ?? undefined;\n}\n\nfunction compareSecret(provided: string, expected: string): boolean {\n  const providedBuffer = Buffer.from(provided);\n  const expectedBuffer = Buffer.from(expected);\n\n  if (providedBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);\n}\n\nexport function shouldTrustActorHeaders(\n  request: Request,\n  nodeEnv: string | undefined = process.env['NODE_ENV'],\n  expectedGatewayToken: string | undefined = process.env['TRUSTED_GATEWAY_TOKEN'] ??\n    process.env['INTERNAL_SERVICE_TOKEN']\n): boolean {\n  if (!getHeader(request, 'x-actor-id')) {\n    return false;\n  }\n\n  if (nodeEnv === 'production') {\n    return true;\n  }\n\n  const providedGatewayToken =\n    getHeader(request, 'x-internal-service-token') || getHeader(request, 'x-gateway-auth-token');\n  if (!expectedGatewayToken || !providedGatewayToken) {\n    return false;\n  }\n\n  return compareSecret(providedGatewayToken, expectedGatewayToken);\n}\n\n/**\n * Extract tracking information from request\n */\nfunction extractTracking(request: Request): ITracking {\n  // Get IP from various possible headers\n  const forwardedFor = getHeader(request, 'x-forwarded-for');\n  const realIp = getHeader(request, 'x-real-ip');\n  const ip = forwardedFor?.split(',')[0]?.trim() || realIp || undefined;\n\n  return {\n    ip,\n    userAgent: getHeader(request, 'user-agent'),\n  };\n}\n\n/**\n * Extract actor from gateway-injected headers or authorization header\n *\n * **Actor-Based Authentication:**\n * - If x-actor-id header exists, trust it (gateway-authenticated)\n * - Otherwise fall back to JWT verification (direct access in dev)\n *\n * This allows:\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Direct service access with JWT → service verifies JWT itself\n * - Development testing: Direct headers → service trusts headers\n */\nasync function extractActor(request: Request): Promise<IActor | null> {\n  // Check for gateway-injected actor headers first\n  const actorId = getHeader(request, 'x-actor-id');\n\n  if (actorId && shouldTrustActorHeaders(request)) {\n    // Gateway has already verified JWT and populated context headers\n    // Trust the headers (gateway is the security perimeter)\n    logger.debug('[ServerContext] Using gateway-authenticated actor from headers');\n\n    const actorType = getHeader(request, 'x-actor-type') || 'user';\n    const userRole = getHeader(request, 'x-user-role');\n\n    return {\n      id: actorId,\n      type: actorType,\n      workspace_id: getHeader(request, 'x-workspace-id'),\n      tenant_id: getHeader(request, 'x-tenant-id'),\n      org_id: getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id'),\n      isAdmin:\n        actorType === 'super_admin' ||\n        userRole === 'TENANT_ADMIN' ||\n        userRole === 'SUPER_ADMIN' ||\n        userRole === 'PLATFORM_ADMIN',\n    };\n  }\n\n  if (actorId) {\n    logger.warn('[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification');\n  }\n\n  // FALLBACK: No gateway headers, verify JWT directly (dev/testing mode)\n  const authHeader = getHeader(request, 'authorization');\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.substring(7);\n\n  try {\n    logger.debug('[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)');\n    const payload = await verifyJWT(token);\n\n    if (!payload) {\n      return null;\n    }\n\n    // Build actor from JWT payload\n    return {\n      id: payload.id,\n      type: 'user', // Default to 'user' if not specified\n      workspace_id: payload.workspace_id,\n    };\n  } catch (error) {\n    logger.warn('[ServerContext] Invalid JWT token:', error);\n    return null;\n  }\n}\n\n/**\n * Extract tenant from headers\n */\nfunction extractTenant(request: Request): ITenant | null {\n  // Check headers\n  const tenantId = getHeader(request, 'x-tenant-id');\n  const tenantEndpoint = getHeader(request, 'x-tenant-endpoint');\n\n  if (tenantId) {\n    return {\n      id: tenantId,\n      endpoint: tenantEndpoint || '',\n    };\n  }\n\n  // Fall back to default tenant if configured\n  return contextOptions?.defaultTenant || null;\n}\n\n/**\n * Extract organization from headers\n */\nfunction extractOrganization(request: Request): IOrganization | null {\n  const orgId = getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id');\n\n  if (orgId) {\n    return { id: orgId };\n  }\n\n  return null;\n}\n\n/**\n * Extract workspace from headers or actor\n */\nfunction extractWorkspace(request: Request, actor: IActor | null): IWorkspace | null {\n  // Check headers first\n  const workspaceId = getHeader(request, 'x-workspace-id');\n\n  if (workspaceId) {\n    return { id: workspaceId };\n  }\n\n  // Fall back to workspace_id from actor\n  if (actor?.workspace_id) {\n    return { id: actor.workspace_id };\n  }\n\n  return null;\n}\n\n/**\n * Extract project from headers\n */\nfunction extractProject(request: Request): IProject | null {\n  const projectId = getHeader(request, 'x-project-id');\n\n  if (projectId) {\n    return { id: projectId };\n  }\n\n  return null;\n}\n\n/**\n * Extract product from headers\n */\nfunction extractProduct(request: Request): IProduct | null {\n  const productId = getHeader(request, 'x-product-id');\n\n  if (productId) {\n    return { id: productId };\n  }\n\n  return null;\n}\n\n/**\n * Extract geography context from headers\n *\n * Geography headers carry the user's selected location context,\n * used for currency defaults, tax calculations, payment routing,\n * data residency, and regional support.\n *\n * Headers:\n * - x-geo-country: ISO 3166-1 alpha-2 country code (e.g., 'IN', 'US', 'DE')\n * - x-geo-currency: ISO 4217 currency code (e.g., 'INR', 'USD', 'EUR')\n * - x-geo-timezone: IANA timezone (e.g., 'Asia/Kolkata', 'America/New_York')\n */\nfunction extractGeography(request: Request): { country?: string; currency?: string; timezone?: string } {\n  const country = getHeader(request, 'x-geo-country');\n  const currency = getHeader(request, 'x-geo-currency');\n  const timezone = getHeader(request, 'x-geo-timezone');\n\n  return {\n    country: country?.toUpperCase() || undefined,\n    currency: currency?.toUpperCase() || undefined,\n    timezone: timezone || undefined,\n  };\n}\n\n/**\n * Extract consent context from headers\n *\n * When an app or service acts on behalf of a user (with user consent),\n * the gateway forwards consent headers. This function extracts them.\n *\n * Headers:\n * - x-consent-granted-by: Actor ID who granted consent (delegating user)\n * - x-consent-scope: Comma-separated scopes\n * - x-consent-granted-at: ISO timestamp when consent was granted\n * - x-consent-expires-at: ISO timestamp when consent expires\n */\nfunction extractConsentContext(request: Request): import('./types.js').ConsentContext | null {\n  const grantedBy = getHeader(request, 'x-consent-granted-by');\n\n  // If no grantedBy, there's no consent delegation\n  if (!grantedBy) {\n    return null;\n  }\n\n  const scopesHeader = getHeader(request, 'x-consent-scope');\n  const grantedAtHeader = getHeader(request, 'x-consent-granted-at');\n  const expiresAtHeader = getHeader(request, 'x-consent-expires-at');\n\n  return {\n    grantedBy,\n    scopes: scopesHeader ? scopesHeader.split(',').map((s) => s.trim()) : undefined,\n    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : undefined,\n    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : undefined,\n  };\n}\n\n/**\n * Build GraphQL context from standard Web Request\n *\n * Also sets the workspace context in AsyncLocalStorage for automatic\n * Prisma workspaceId injection via the workspace extension.\n */\nexport async function buildContext(request: Request): Promise<GraphQLContext> {\n  if (!contextOptions) {\n    throw new Error('[ServerContext] Context not configured - call configureContext() first');\n  }\n\n  // Extract actor from headers/JWT\n  const actor = await extractActor(request);\n\n  // Extract all context parts\n  const tenant = extractTenant(request);\n  const organization = extractOrganization(request);\n  const workspace = extractWorkspace(request, actor);\n  const project = extractProject(request);\n  const product = extractProduct(request);\n  const tracking = extractTracking(request);\n  const consentContext = extractConsentContext(request);\n\n  // Build i18n context if configured\n  let i18n: I18nContext | undefined;\n  if (contextOptions.i18n) {\n    i18n = contextOptions.i18n.createContextFromRequest(request);\n  }\n\n  // Merge geography context from x-geo-* headers into i18n\n  const geo = extractGeography(request);\n  if (geo.country || geo.currency || geo.timezone) {\n    if (i18n) {\n      // Merge geography fields into existing i18n context\n      if (geo.country) i18n.country = geo.country;\n      if (geo.currency) i18n.currency = geo.currency;\n      if (geo.timezone) i18n.timezone = geo.timezone;\n    } else {\n      // Create minimal i18n context with geography only (when i18n module not configured)\n      i18n = {\n        locale: 'en-US' as import('../i18n/types.js').LocaleCode,\n        language: 'en' as import('../i18n/types.js').LanguageCode,\n        country: geo.country,\n        currency: geo.currency,\n        timezone: geo.timezone,\n        t: (key: string) => key,\n        tp: (key: string) => key,\n        formatNumber: (value: number) => String(value),\n        formatCurrency: (value: number, currency: string) => `${currency} ${value}`,\n        formatDate: (date: Date | string) => String(date),\n        formatRelativeTime: (value: number, unit: Intl.RelativeTimeFormatUnit) => `${value} ${unit}`,\n      };\n    }\n  }\n\n  // Determine onBehalfOf for audit trails\n  // If actor is app/service with consent → use grantedBy (delegating user)\n  // Otherwise → use actor.id (self-action)\n  const onBehalfOf =\n    (actor?.type === 'app' || actor?.type === 'service' || actor?.type === 'service_account') &&\n    consentContext?.grantedBy\n      ? consentContext.grantedBy\n      : actor?.id;\n\n  // Set workspace context in AsyncLocalStorage for Prisma workspace extension\n  // This enables automatic workspaceId injection on create/update operations\n  const wsCtxPayload = {\n    workspaceId: workspace?.id,\n    tenantId: tenant?.id,\n    actorId: actor?.id,\n    actorType: actor?.type,\n    organizationId: organization?.id,\n    projectId: project?.id,\n    onBehalfOf,\n  };\n\n  logger.debug('[ServerContext] Setting workspace context', {\n    workspaceId: wsCtxPayload.workspaceId ?? 'NONE',\n    actorId: wsCtxPayload.actorId ?? 'NONE',\n    rawHeader: getHeader(request, 'x-workspace-id') ?? 'MISSING',\n  });\n\n  setWorkspaceContext(wsCtxPayload);\n\n  return {\n    request,\n    actor,\n    tenant,\n    organization,\n    workspace,\n    project,\n    product,\n    tracking,\n    consentContext: consentContext || undefined,\n    onBehalfOf: onBehalfOf || actor?.id || '',\n    db: contextOptions.getDb(),\n    i18n,\n    responseHeaders: new Headers(),\n  };\n}\n\n/**\n * Get context options\n */\nexport function getContextOptions(): ContextBuilderOptions | null {\n  return contextOptions;\n}\n","import type { IActor } from './types.js';\n\nconst LOCALHOST_ORIGINS = [\n  'http://localhost:3000',\n  'http://localhost:4000',\n  'http://localhost:5173',\n  'http://127.0.0.1:3000',\n  'http://127.0.0.1:4000',\n  'http://127.0.0.1:5173',\n];\n\nexport function normalizeCorsOrigins(\n  origins: string | string[] | undefined,\n  environment: 'development' | 'staging' | 'production' | undefined\n): string[] {\n  const normalized = (Array.isArray(origins) ? origins : origins?.split(',') || [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\n  if (normalized.length === 0) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  if (normalized.includes('*')) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  return normalized;\n}\n\nexport function resolveAllowedCorsOrigin(requestOrigin: string | null, allowedOrigins: string[]): string | null {\n  if (!requestOrigin) {\n    return allowedOrigins[0] ?? null;\n  }\n\n  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;\n}\n\nexport function canAccessGraphExport(actor: IActor | null): boolean {\n  if (!actor) {\n    return false;\n  }\n\n  return actor.isAdmin === true || ['service', 'super_admin'].includes(actor.type);\n}\n","/**\n * Server Module\n *\n * Main server bootstrapping with Elysia, GraphQL Yoga, and middleware.\n * Uses Bun runtime for high-performance GraphQL services.\n *\n * Provides a simple API for microservices to start a fully configured server.\n */\n\nimport { logger } from '../logger/index.js';\nimport { configureAuth, configureDefaultAuth, type FetchWorkspaceSecretFn } from './auth.js';\nimport { configureContext, buildContext } from './context.js';\nimport type {\n  ServerDefinition,\n  ServerInstance,\n  ServerInfo,\n  ElysiaApp,\n  BunServerHandle,\n  YogaPlugin,\n  GraphQLContext,\n} from './types.js';\nimport { I18n } from '../i18n/index.js';\nimport { canAccessGraphExport, normalizeCorsOrigins, resolveAllowedCorsOrigin } from './security.js';\n\n// Store startup time for uptime calculation\nlet serverStartTime: Date | null = null;\n\n/**\n * Create and configure a server instance using Elysia + GraphQL Yoga\n */\nexport async function createServer(definition: ServerDefinition): Promise<ServerInstance> {\n  const {\n    config,\n    prismaClient,\n    schema,\n    moduleGraph,\n    restEndpoints,\n    yogaPlugins,\n    buildContext: customBuildContext,\n    workspaceExtensionConfig,\n    disableWorkspaceExtension,\n    onShutdown,\n  } = definition;\n\n  // Dynamic imports to avoid requiring these as hard dependencies\n  const { Elysia } = await import('elysia');\n  const { BunAdapter } = await import('elysia/adapter/bun');\n  const { cors } = await import('@elysiajs/cors');\n  const { createYoga } = await import('graphql-yoga');\n  const { initializeDatabase, getDb, getDatabaseManager } = await import('../prisma/index.js');\n  const { createSecurityPlugin } = await import('../middleware/index.js');\n  const { createMetricsPlugin } = await import('../observability/index.js');\n  const { createWorkspaceGuardPlugin } = await import('./workspace-guard.js');\n\n  logger.info(`[Server] Initializing ${config.serviceName}...`);\n\n  // Detect boundary from config or service name — needed before database and guard setup\n  const boundary =\n    config.boundary ??\n    (config.serviceName.startsWith('wspace-')\n      ? 'wspace'\n      : config.serviceName.startsWith('global-')\n        ? 'global'\n        : 'wspace'); // fail-closed: default to wspace (stricter)\n\n  // Initialize database\n  // Workspace extension is auto-disabled for global boundary services unless explicitly enabled\n  const shouldEnableWorkspaceExtension =\n    disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === 'wspace'; // auto-detect: enabled for wspace, disabled for global\n\n  logger.info('[Server] Initializing database...', {\n    boundary,\n    workspaceExtension: shouldEnableWorkspaceExtension,\n  });\n\n  const { connect } = initializeDatabase(prismaClient, config.serviceName, {\n    registerShutdownHandlers: false, // Server manages shutdown handlers itself\n    enableWorkspaceExtension: shouldEnableWorkspaceExtension,\n    ...(workspaceExtensionConfig ? { workspaceExtensionConfig } : {}),\n  });\n  await connect();\n\n  // Initialize i18n if configured\n  let i18nInstance: I18n | undefined;\n  if (config.i18n?.enabled && config.i18n.localesPath) {\n    logger.info('[Server] Initializing i18n...');\n    i18nInstance = new I18n({\n      defaultLocale: config.i18n.defaultLocale || 'en-US',\n      fallbackLocale: config.i18n.fallbackLocale || 'en-US',\n      localesPath: config.i18n.localesPath,\n      supportedLocales: config.i18n.supportedLocales,\n      namespace: config.i18n.namespace || config.serviceName,\n      lazyLoad: config.i18n.lazyLoad,\n      logMissing: config.i18n.logMissing ?? true,\n      enableCache: true,\n      returnKeyOnMissing: true,\n    });\n    await i18nInstance.initialize();\n    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(', ')}`);\n  }\n\n  // Configure context builder\n  configureContext({\n    getDb: () => getDb(),\n    i18n: i18nInstance,\n  });\n\n  // Auto-configure auth with default workspace secret fetcher if not already configured\n  configureDefaultAuth();\n\n  // Initialize module graph if provided\n  if (moduleGraph) {\n    logger.info('[Server] Initializing module graph...');\n    await moduleGraph.initialize();\n  }\n\n  // Determine if playground/introspection should be enabled\n  const isDev = config.environment !== 'production';\n  const enablePlayground = config.enablePlayground ?? isDev;\n\n  // Build workspace guard plugin — auto-enabled for wspace boundary only\n  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === 'wspace';\n  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? 'enabled' : 'disabled'}`);\n\n  const workspaceGuardPlugins = workspaceGuardEnabled\n    ? [\n        createWorkspaceGuardPlugin({\n          enabled: true,\n          whitelistedOperations: config.workspaceGuard?.whitelistedOperations,\n        }),\n      ]\n    : [];\n\n  // Create GraphQL Yoga instance\n  const graphqlEndpoint = config.graphqlEndpoint || '/graphql';\n  logger.info('[Server] Setting up GraphQL Yoga with provided schema...');\n\n  const responseHeadersPlugin: YogaPlugin = {\n    onResponse: ({ response, serverContext }: { response: Response; serverContext: unknown }) => {\n      const yogaContext = serverContext as GraphQLContext;\n      if (yogaContext?.responseHeaders) {\n        yogaContext.responseHeaders.forEach((value: string, key: string) => {\n          response.headers.append(key, value);\n        });\n      }\n    },\n  };\n\n  const yoga = createYoga<{ request: Request }>({\n    graphqlEndpoint,\n    schema, // Use the schema provided by microservice\n    graphiql: enablePlayground,\n    logging: {\n      debug: (...args) => logger.debug('[GraphQL]', ...args),\n      info: (...args) => logger.info('[GraphQL]', ...args),\n      warn: (...args) => logger.warn('[GraphQL]', ...args),\n      error: (...args) => logger.error('[GraphQL]', ...args),\n    },\n    plugins: [...workspaceGuardPlugins, responseHeadersPlugin, ...(yogaPlugins || [])],\n    context: async ({ request }) => {\n      // Build default context\n      const defaultContext = await buildContext(request);\n\n      // Apply custom context builder if provided\n      if (customBuildContext) {\n        return customBuildContext(defaultContext);\n      }\n\n      return defaultContext;\n    },\n  });\n\n  // Create Elysia instance with Bun adapter\n  const app = new Elysia({ adapter: BunAdapter });\n\n  // Register CORS middleware\n  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);\n\n  app.use(\n    cors({\n      origin: corsOrigins,\n      credentials: corsOrigins.length > 0,\n      allowedHeaders: [\n        'Content-Type',\n        'Authorization',\n        'X-Tenant-ID',\n        'X-Workspace-ID',\n        'X-Org-ID',\n        'X-Project-ID',\n        'X-Product-ID',\n        'X-CSRF-Token',\n        'X-Service-Name',\n        'Accept-Language',\n        'X-Locale',\n        'X-Language',\n        'X-Geo-Country',\n        'X-Geo-Currency',\n        'X-Geo-Timezone',\n        // Actor headers (gateway-injected or dev mode)\n        'X-Actor-ID',\n        'X-Actor-Type',\n        'X-Internal-Service-Token',\n        'X-Gateway-Auth-Token',\n      ],\n      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n    })\n  );\n\n  // Collect raw body endpoints for early interception\n  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);\n  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [ep.path, ep]));\n  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {\n    const regexPattern = endpoint.path.replace(/:[^/]+/g, '[^/]+');\n    return {\n      endpoint,\n      regexPattern,\n      regex: new RegExp(`^${regexPattern}$`),\n    };\n  });\n\n  // Helper to match pathname against endpoint patterns (including :param placeholders)\n  const matchRawBodyEndpoint = (pathname: string): (typeof rawBodyEndpoints)[0] | undefined => {\n    // First try exact match (for non-parameterized paths)\n    const exactMatch = rawBodyPaths.get(pathname);\n    if (exactMatch) return exactMatch;\n\n    // Try pattern matching for parameterized paths like /webhooks/slack/:channelId\n    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {\n      const isMatch = regex.test(pathname);\n      logger.debug(\n        `[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`\n      );\n      if (isMatch) {\n        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);\n        return endpoint;\n      }\n    }\n\n    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);\n    return undefined;\n  };\n\n  // Handle GraphQL, metrics, and raw body requests BEFORE any middleware that consumes the body\n  // This is critical because Yoga needs the raw request body stream\n  // and webhook endpoints need raw body for signature verification\n  // onRequest runs before onParse (body parsing) and onBeforeHandle\n  app.onRequest(async ({ request }) => {\n    const url = new URL(request.url);\n    const pathname = url.pathname;\n    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);\n    const isHealthRoute = pathname === '/health' || pathname.startsWith('/health/');\n\n    // Build CORS headers helper\n    const buildCorsHeaders = (): Record<string, string> => {\n      const origin = request.headers.get('origin') || '*';\n      const allowedOrigin = resolveAllowedCorsOrigin(origin === '*' ? null : origin, corsOrigins);\n      const headers: Record<string, string> = {\n        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n        'Access-Control-Allow-Headers':\n          'Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token',\n      };\n\n      if (allowedOrigin) {\n        headers['Access-Control-Allow-Origin'] = allowedOrigin;\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n\n      return headers;\n    };\n\n    // Check if this is a raw body endpoint (webhooks) - now supports parameterized paths\n    const rawBodyEndpoint = isHealthRoute ? undefined : matchRawBodyEndpoint(pathname);\n    if (rawBodyEndpoint) {\n      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight for raw body endpoints\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Only process if method matches\n      if (request.method !== rawBodyEndpoint.method) {\n        return undefined; // Let other handlers deal with it\n      }\n\n      try {\n        // Read raw body BEFORE any parsing\n        const rawBody = await request.text();\n\n        // Build context without consuming body (body already read)\n        const context = await buildContext(request);\n\n        // Call the handler with raw body\n        const result = await rawBodyEndpoint.handler(request, context, rawBody);\n\n        // If handler returns a Response, use it directly\n        if (result instanceof Response) {\n          // Add CORS headers\n          const headers = new Headers(result.headers);\n          for (const [key, value] of Object.entries(corsHeaders)) {\n            headers.set(key, value);\n          }\n          return new Response(result.body, {\n            status: result.status,\n            statusText: result.statusText,\n            headers,\n          });\n        }\n\n        // Otherwise, serialize as JSON\n        const headers = new Headers({\n          'Content-Type': 'application/json',\n          ...corsHeaders,\n        });\n\n        return new Response(JSON.stringify(result), {\n          status: 200,\n          headers,\n        });\n      } catch (error) {\n        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);\n        const corsHeaders = buildCorsHeaders();\n        return new Response(\n          JSON.stringify({\n            error: error instanceof Error ? error.message : 'Internal server error',\n          }),\n          {\n            status: 500,\n            headers: {\n              'Content-Type': 'application/json',\n              ...corsHeaders,\n            },\n          }\n        );\n      }\n    }\n\n    // Serve Prometheus metrics via prom-client at /metrics.\n    // The graphql-yoga prometheus plugin populates the same default registry,\n    // so GraphQL-level metrics (operation durations, error counts, etc.) are\n    // included automatically without needing Yoga to handle this route.\n    if (pathname === '/metrics' && request.method === 'GET') {\n      try {\n        const promClientMod = 'prom-client';\n        const prom = (await import(promClientMod)) as unknown as {\n          register: { metrics: () => Promise<string> | string; contentType?: string };\n          collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n        };\n        try { prom.collectDefaultMetrics({ register: prom.register }); } catch { /* already called */ }\n        const body = await prom.register.metrics();\n        return new Response(body, {\n          status: 200,\n          headers: {\n            'Content-Type': prom.register.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n          },\n        });\n      } catch {\n        // fall through — prom-client not installed; let Yoga handle as fallback\n      }\n    }\n\n    // Routes that should be handled by Yoga (GraphQL endpoint only)\n    const yogaRoutes = [graphqlEndpoint, `${graphqlEndpoint}/`, '/metrics'];\n    const shouldHandleByYoga = yogaRoutes.includes(pathname);\n\n    if (shouldHandleByYoga) {\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Get response from Yoga\n      const yogaResponse = await yoga.fetch(request);\n\n      // Add CORS headers to Yoga response\n      const headers = new Headers(yogaResponse.headers);\n      for (const [key, value] of Object.entries(corsHeaders)) {\n        headers.set(key, value);\n      }\n\n      // Return response with CORS headers\n      return new Response(yogaResponse.body, {\n        status: yogaResponse.status,\n        statusText: yogaResponse.statusText,\n        headers,\n      });\n    }\n    // Return undefined to continue to next handlers for non-GraphQL requests\n    return undefined;\n  });\n\n  // Register metrics middleware (after GraphQL interception)\n  app.use(createMetricsPlugin());\n\n  // Register security middleware (after GraphQL interception)\n  app.use(\n    createSecurityPlugin({\n      csrfSkipRoutes: config.csrfSkipRoutes || ['/graphql', '/health', '/api/graph/'],\n      loginEndpoints: config.loginEndpoints || [],\n      enableCSRF: config.enableCSRF ?? false, // Disabled by default for GraphQL services\n      enableSessionSecurity: config.enableSessionSecurity ?? false,\n    })\n  );\n\n  // Health check endpoints\n  // /health - General health check\n  // /health/live - Kubernetes liveness probe\n  // /health/ready - Kubernetes readiness probe\n  // /health/startup - Kubernetes startup probe\n  const healthResponse = () => ({\n    status: 'healthy',\n    service: config.serviceName,\n    version: config.serviceVersion || '1.0.0',\n    timestamp: new Date().toISOString(),\n  });\n\n  app.get('/health', healthResponse);\n  app.get('/health/live', healthResponse);\n  app.get('/health/ready', healthResponse);\n  app.get('/health/startup', healthResponse);\n\n  // Graph API endpoints (if moduleGraph provided)\n  if (moduleGraph) {\n    // Get graph configuration schema\n    app.get('/api/graph/schema', async ({ request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      return moduleGraph.getSchema();\n    });\n\n    // Export all graph data\n    app.get('/api/graph/export', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportAll(organizationId, workspaceId);\n    });\n\n    // Export entities only\n    app.get('/api/graph/entities', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId, types } = query as {\n        organizationId?: string;\n        workspaceId?: string;\n        types?: string;\n      };\n      const entityTypes = types?.split(',').map((t) => t.trim());\n      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);\n    });\n\n    // Export relationships only\n    app.get('/api/graph/relationships', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportRelationships(organizationId, workspaceId);\n    });\n  }\n\n  // Register custom REST endpoints (skip rawBody endpoints - they're handled in onRequest)\n  if (restEndpoints && restEndpoints.length > 0) {\n    for (const endpoint of restEndpoints) {\n      // Skip rawBody endpoints - they're intercepted in onRequest before body parsing\n      if (endpoint.rawBody) {\n        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);\n        continue;\n      }\n\n      const handler = async ({ request }: { request: Request }): Promise<unknown> => {\n        const context = await buildContext(request);\n        return endpoint.handler(request, context);\n      };\n\n      switch (endpoint.method) {\n        case 'GET':\n          app.get(endpoint.path, handler);\n          break;\n        case 'POST':\n          app.post(endpoint.path, handler);\n          break;\n        case 'PUT':\n          app.put(endpoint.path, handler);\n          break;\n        case 'PATCH':\n          app.patch(endpoint.path, handler);\n          break;\n        case 'DELETE':\n          app.delete(endpoint.path, handler);\n          break;\n      }\n    }\n  }\n\n  const host = config.host || '0.0.0.0';\n  const port = config.port;\n\n  // Create server instance\n  const serverInstance: ServerInstance = {\n    app: app as unknown as ElysiaApp,\n    server: null,\n    start: async () => {\n      serverStartTime = new Date();\n\n      // Call listen() which starts the server and makes app.server available\n      app.listen({\n        port,\n        hostname: host,\n      });\n\n      // Access the Bun server instance from the app\n      // Cast through unknown to satisfy TypeScript since Elysia's types are complex\n      const elysiaApp = app as unknown as { server: BunServerHandle | null };\n      serverInstance.server = elysiaApp.server;\n\n      logger.info(`🚀 ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);\n    },\n    stop: async () => {\n      logger.info(`[Server] Stopping ${config.serviceName}...`);\n\n      if (onShutdown) {\n        await onShutdown();\n      }\n\n      if (moduleGraph) {\n        await moduleGraph.shutdown();\n      }\n\n      await getDatabaseManager().disconnect();\n\n      if (serverInstance.server) {\n        serverInstance.server.stop();\n      }\n\n      logger.info(`[Server] ${config.serviceName} stopped`);\n    },\n    getInfo: (): ServerInfo => {\n      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1000) : 0;\n\n      return {\n        serviceName: config.serviceName,\n        serviceVersion: config.serviceVersion || '1.0.0',\n        environment: config.environment || 'development',\n        port,\n        host,\n        graphqlEndpoint,\n        startedAt: serverStartTime?.toISOString() || '',\n        uptime,\n      };\n    },\n  };\n\n  // Setup graceful shutdown handlers\n  const gracefulShutdown = async (signal: string): Promise<never> => {\n    logger.info(`[Server] ${signal} received, shutting down gracefully...`);\n    await serverInstance.stop();\n    process.exit(0);\n  };\n\n  process.on('SIGTERM', () => {\n    void gracefulShutdown('SIGTERM');\n  });\n  process.on('SIGINT', () => {\n    void gracefulShutdown('SIGINT');\n  });\n\n  return serverInstance;\n}\n\n/**\n * Configure auth with workspace secret fetcher\n *\n * This should be called before creating the server if using workspace-scoped JWT\n */\nexport function configureServerAuth(fetchWorkspaceSecret: FetchWorkspaceSecretFn): void {\n  configureAuth({ fetchWorkspaceSecret });\n}\n"]}
+{"version":3,"sources":["../../src/server/auth.ts","../../src/server/context.ts","../../src/server/security.ts","../../src/server/server.ts"],"names":["getDbFn","getDb","prismaModule","joseModule","jwtModule","getJose","getJwt","jwt","default","authConfig","configureAuth","config","logger","debug","fetchWorkspaceSecret","workspaceId","db","workspace","client","findUnique","where","id","jwtSecret","JSON","parse","stringify","error","warn","configureDefaultAuth","generateSymmetricSecret","joseLib","secret","generateSecret","jwk","exportJWK","verifyJWT","token","options","decoded","decode","complete","payload","verifiedJwt","verify","mapPayloadToActor","decodedJwt","decodeJwt","workspace_id","workspaceSecret","keyLikeSecret","importJWK","jwtVerify","err","decodeJWT","sub","type","actor_type","tenant_id","org_id","isAdmin","authCheck","actor","Error","workspaceCheck","context","actorId","requireWorkspace","orgCheck","organization","orgId","tenantCheck","tenant","contextOptions","configureContext","getHeader","request","key","headers","get","toLowerCase","undefined","compareSecret","provided","expected","providedBuffer","Buffer","from","expectedBuffer","length","crypto","timingSafeEqual","shouldTrustActorHeaders","nodeEnv","process","env","expectedGatewayToken","providedGatewayToken","extractTracking","forwardedFor","realIp","ip","split","trim","userAgent","extractActor","actorType","userRole","authHeader","startsWith","substring","extractTenant","tenantId","tenantEndpoint","endpoint","defaultTenant","extractOrganization","extractWorkspace","extractProject","projectId","extractProduct","productId","extractGeography","country","currency","timezone","toUpperCase","extractConsentContext","grantedBy","scopesHeader","grantedAtHeader","expiresAtHeader","scopes","map","s","grantedAt","Date","expiresAt","buildContext","project","product","tracking","consentContext","i18n","createContextFromRequest","geo","locale","language","t","tp","formatNumber","value","String","formatCurrency","formatDate","date","formatRelativeTime","unit","onBehalfOf","wsCtxPayload","organizationId","rawHeader","setWorkspaceContext","responseHeaders","Headers","getContextOptions","LOCALHOST_ORIGINS","normalizeCorsOrigins","origins","environment","normalized","Array","isArray","origin","filter","Boolean","includes","resolveAllowedCorsOrigin","requestOrigin","allowedOrigins","canAccessGraphExport","serverStartTime","createServer","definition","prismaClient","schema","moduleGraph","restEndpoints","yogaPlugins","customBuildContext","workspaceExtensionConfig","disableWorkspaceExtension","onShutdown","Elysia","BunAdapter","cors","createYoga","initializeDatabase","getDatabaseManager","createSecurityPlugin","createMetricsPlugin","createWorkspaceGuardPlugin","info","serviceName","boundary","shouldEnableWorkspaceExtension","workspaceExtension","connect","registerShutdownHandlers","enableWorkspaceExtension","i18nInstance","enabled","localesPath","I18n","defaultLocale","fallbackLocale","supportedLocales","namespace","lazyLoad","logMissing","enableCache","returnKeyOnMissing","initialize","getSupportedLocales","join","isDev","enablePlayground","workspaceGuardEnabled","workspaceGuard","workspaceGuardPlugins","whitelistedOperations","graphqlEndpoint","responseHeadersPlugin","onResponse","response","serverContext","yogaContext","forEach","append","yoga","graphiql","logging","args","plugins","defaultContext","app","adapter","corsOrigins","use","credentials","allowedHeaders","methods","rawBodyEndpoints","ep","rawBody","rawBodyPaths","Map","path","rawBodyMatchers","regexPattern","replace","regex","RegExp","matchRawBodyEndpoint","pathname","exactMatch","isMatch","test","onRequest","url","URL","method","isHealthRoute","buildCorsHeaders","allowedOrigin","rawBodyEndpoint","corsHeaders","Response","status","text","result","handler","Object","entries","set","body","statusText","message","promClientMod","prom","collectDefaultMetrics","register","metrics","contentType","yogaRoutes","shouldHandleByYoga","yogaResponse","fetch","csrfSkipRoutes","loginEndpoints","enableCSRF","enableSessionSecurity","healthResponse","service","version","serviceVersion","timestamp","toISOString","getSchema","query","exportAll","types","entityTypes","exportEntities","exportRelationships","post","put","patch","delete","host","port","serverInstance","server","start","listen","hostname","elysiaApp","stop","shutdown","disconnect","getInfo","uptime","Math","floor","now","getTime","startedAt","gracefulShutdown","signal","exit","on","configureServerAuth"],"mappings":";;;;;;;;AA4BA,IAAIA,OAAAA,GAAmC,IAAA;AAEvC,eAAeC,KAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,IAAA,MAAME,YAAAA,GAAe,MAAM,OAAO,oBAAA,CAAA;AAElCF,IAAAA,OAAAA,GAAUE,YAAAA,CAAaD,KAAAA;AACzB,EAAA;AACA,EAAA,OAAOD,OAAAA,EAAAA;AACT;AAPeC,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAgBf,IAAIE,UAAAA,GAAiC,IAAA;AACrC,IAAIC,SAAAA,GAA8B,IAAA;AAElC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeE,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOf,eAAeC,MAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,SAAAA,EAAW;AACd,IAAA,MAAMG,GAAAA,GAAM,MAAM,OAAO,cAAA,CAAA;AAEzBH,IAAAA,SAAAA,GAAaG,IAAgCC,OAAAA,IAAWD,GAAAA;AAC1D,EAAA;AACA,EAAA,OAAOH,SAAAA;AACT;AAPeE,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAsBf,IAAIG,UAAAA,GAAgC,IAAA;AAK7B,SAASC,cAAcC,MAAAA,EAAkB;AAC9CF,EAAAA,UAAAA,GAAaE,MAAAA;AACbC,EAAAA,MAAAA,CAAOC,MAAM,8BAAA,CAAA;AACf;AAHgBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAchB,eAAsBI,qBAAqBC,WAAAA,EAAmB;AAC5D,EAAA,IAAI;AACF,IAAA,MAAMC,EAAAA,GAAK,MAAMf,KAAAA,EAAAA;AACjB,IAAA,MAAMgB,SAAAA,GAAY,MAAMD,EAAAA,CAAGE,MAAAA,CAAOD,UAAUE,UAAAA,CAAW;MACrDC,KAAAA,EAAO;QAAEC,EAAAA,EAAIN;AAAY;KAC3B,CAAA;AAEA,IAAA,IAAI,CAACE,WAAWK,SAAAA,EAAW;AACzBV,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;AAAEE,QAAAA;OAAY,CAAA;AAC7E,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOQ,KAAKC,KAAAA,CAAMD,IAAAA,CAAKE,SAAAA,CAAUR,SAAAA,CAAUK,SAAS,CAAA,CAAA;AACtD,EAAA,CAAA,CAAA,OAASI,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,KAAK,8CAAA,EAAgD;AAAEZ,MAAAA,WAAAA;AAAaW,MAAAA;KAAM,CAAA;AACjF,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAjBsBZ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwBf,SAASc,oBAAAA,GAAAA;AACd,EAAA,IAAI,CAACnB,UAAAA,EAAY;AACfC,IAAAA,aAAAA,CAAc;AAAEI,MAAAA;KAAqB,CAAA;AACrCF,IAAAA,MAAAA,CAAOC,MAAM,6EAAA,CAAA;AACf,EAAA;AACF;AALgBe,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWhB,eAAsBC,uBAAAA,GAAAA;AACpB,EAAA,MAAMC,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,EAAA,MAAM0B,MAAAA,GAAS,MAAMD,OAAAA,CAAQE,cAAAA,CAAe,OAAA,CAAA;AAC5C,EAAA,MAAMC,GAAAA,GAAM,MAAMH,OAAAA,CAAQI,SAAAA,CAAUH,MAAAA,CAAAA;AACpC,EAAA,OAAOE,GAAAA;AACT;AALsBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAetB,eAAsBM,SAAAA,CAAUC,KAAAA,EAAeL,MAAAA,EAAiBM,OAAAA,GAAyB,EAAC,EAAC;AACzF,EAAA,IAAI;AACF,IAAA,MAAM9B,GAAAA,GAAM,MAAMD,MAAAA,EAAAA;AAClB,IAAA,MAAMwB,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AAGtB,IAAA,MAAMiC,OAAAA,GAAU/B,GAAAA,CAAIgC,MAAAA,CAAOH,KAAAA,EAAO;MAAEI,QAAAA,EAAU;KAAK,CAAA;AAEnD,IAAA,IAAI,CAACF,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,IAAY,CAACA,OAAAA,CAAQG,OAAAA,IAAW,OAAOH,OAAAA,CAAQG,OAAAA,KAAY,QAAA,EAAU;AACtG7B,MAAAA,MAAAA,CAAOe,KAAK,mCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,IAAII,MAAAA,EAAQ;AAEV,MAAA,MAAMW,YAAAA,GAAcnC,GAAAA,CAAIoC,MAAAA,CAAOP,KAAAA,EAAOL,QAAQM,OAAAA,CAAAA;AAC9C,MAAA,OAAOO,kBAAkBF,YAAAA,CAAAA;AAC3B,IAAA;AAGA,IAAA,MAAMG,UAAAA,GAAaf,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;AACrC,IAAA,IAAI,CAACS,WAAWE,YAAAA,EAAc;AAC5BnC,MAAAA,MAAAA,CAAOe,KAAK,6CAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAAClB,YAAYK,oBAAAA,EAAsB;AACrCF,MAAAA,MAAAA,CAAOc,MAAM,+DAAA,CAAA;AACb,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,eAAAA,GAAkB,MAAMvC,UAAAA,CAAWK,oBAAAA,CAAqB+B,WAAWE,YAAY,CAAA;AACrF,IAAA,IAAI,CAACC,eAAAA,EAAiB;AACpBpC,MAAAA,MAAAA,CAAOe,KAAK,yCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,aAAAA,GAAgB,MAAMnB,OAAAA,CAAQoB,SAAAA,CAAUF,iBAAiB,OAAA,CAAA;AAC/D,IAAA,MAAMN,cAAc,MAAMZ,OAAAA,CAAQqB,SAAAA,CAAUf,KAAAA,EAAOa,eAAeZ,OAAAA,CAAAA;AAClE,IAAA,OAAOO,iBAAAA,CAAkBF,YAAYD,OAAO,CAAA;AAC9C,EAAA,CAAA,CAAA,OAASW,GAAAA,EAAK;AACZxC,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,qCAAqCyB,GAAAA,CAAAA;AACjD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA7CsBjB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkDtB,eAAsBkB,UAAUjB,KAAAA,EAAa;AAC3C,EAAA,IAAI;AACF,IAAA,MAAMN,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,IAAA,OAAO,MAAMyB,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAPsBiB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAYtB,SAAST,kBAAkBH,OAAAA,EAAmB;AAC5C,EAAA,OAAO;AACLpB,IAAAA,EAAAA,EAAIoB,OAAAA,CAAQa,GAAAA;AACZC,IAAAA,IAAAA,EAAMd,QAAQe,UAAAA,IAAc,MAAA;AAC5BT,IAAAA,YAAAA,EAAcN,OAAAA,CAAQM,YAAAA;AACtBU,IAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBC,IAAAA,MAAAA,EAAQjB,OAAAA,CAAQiB,MAAAA;AAChBC,IAAAA,OAAAA,EAASlB,QAAQ,SAAA;AACnB,GAAA;AACF;AATSG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAcF,SAASgB,UAAUC,KAAAA,EAAoB;AAC5C,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,MAAM,IAAIC,MAAM,gBAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOD,KAAAA;AACT;AALgBD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAUT,SAASG,eAAeC,OAAAA,EAAmE;AAIhG,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfN,IAAAA,WAAAA,EAAaiD,QAAQ/C,SAAAA,CAAUI;AACjC,GAAA;AACF;AAdgB0C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,SAASG,iBACdF,OAAAA,EAAU;AAGVJ,EAAAA,SAAAA,CAAUI,QAAQH,KAAK,CAAA;AAEvB,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAGA,EAAA,OAAOE,OAAAA;AACT;AAZgBE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,SAASC,SAASH,OAAAA,EAAsE;AAI7F,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQI,YAAAA,EAAc/C,EAAAA,EAAI;AAC7B,IAAA,MAAM,IAAIyC,MAAM,kCAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfgD,IAAAA,KAAAA,EAAOL,QAAQI,YAAAA,CAAa/C;AAC9B,GAAA;AACF;AAdgB8C,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAmBT,SAASG,YAAYN,OAAAA,EAA0C;AACpE,EAAA,IAAI,CAACA,OAAAA,CAAQO,MAAAA,EAAQlD,EAAAA,EAAI;AACvB,IAAA,MAAM,IAAIyC,MAAM,4BAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOE,QAAQO,MAAAA,CAAOlD,EAAAA;AACxB;AALgBiD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;ACvQhB,IAAIE,cAAAA,GAA+C,IAAA;AAK5C,SAASC,iBAAiBpC,OAAAA,EAA8B;AAC7DmC,EAAAA,cAAAA,GAAiBnC,OAAAA;AACjBzB,EAAAA,MAAAA,CAAOC,MAAM,4CAAA,CAAA;AACf;AAHgB4D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAQhB,SAASC,SAAAA,CAAUC,SAAkBC,GAAAA,EAAW;AAC9C,EAAA,OAAOD,QAAQE,OAAAA,CAAQC,GAAAA,CAAIF,GAAAA,CAAIG,WAAAA,EAAW,CAAA,IAAOC,MAAAA;AACnD;AAFSN,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAIT,SAASO,aAAAA,CAAcC,UAAkBC,QAAAA,EAAgB;AACvD,EAAA,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAAA,CAAKJ,QAAAA,CAAAA;AACnC,EAAA,MAAMK,cAAAA,GAAiBF,MAAAA,CAAOC,IAAAA,CAAKH,QAAAA,CAAAA;AAEnC,EAAA,IAAIC,cAAAA,CAAeI,MAAAA,KAAWD,cAAAA,CAAeC,MAAAA,EAAQ;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOC,MAAAA,CAAOC,eAAAA,CAAgBN,cAAAA,EAAgBG,cAAAA,CAAAA;AAChD;AATSN,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWF,SAASU,uBAAAA,CACdhB,OAAAA,EACAiB,OAAAA,GAA8BC,OAAAA,CAAQC,IAAI,UAAA,CAAA,EAC1CC,oBAAAA,GAA2CF,OAAAA,CAAQC,IAAI,uBAAA,CAAA,IACrDD,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEvC,EAAA,IAAI,CAACpB,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA,EAAe;AACrC,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIiB,YAAY,YAAA,EAAc;AAC5B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMI,uBACJtB,SAAAA,CAAUC,OAAAA,EAAS,0BAAA,CAAA,IAA+BD,SAAAA,CAAUC,SAAS,sBAAA,CAAA;AACvE,EAAA,IAAI,CAACoB,oBAAAA,IAAwB,CAACC,oBAAAA,EAAsB;AAClD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOf,aAAAA,CAAce,sBAAsBD,oBAAAA,CAAAA;AAC7C;AArBgBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA0BhB,SAASM,gBAAgBtB,OAAAA,EAAgB;AAEvC,EAAA,MAAMuB,YAAAA,GAAexB,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMwB,MAAAA,GAASzB,SAAAA,CAAUC,OAAAA,EAAS,WAAA,CAAA;AAClC,EAAA,MAAMyB,EAAAA,GAAKF,cAAcG,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,IAAAA,EAAAA,IAAUH,MAAAA,IAAUnB,MAAAA;AAE5D,EAAA,OAAO;AACLoB,IAAAA,EAAAA;IACAG,SAAAA,EAAW7B,SAAAA,CAAUC,SAAS,YAAA;AAChC,GAAA;AACF;AAVSsB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAwBT,eAAeO,aAAa7B,OAAAA,EAAgB;AAE1C,EAAA,MAAMV,OAAAA,GAAUS,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAIV,OAAAA,IAAW0B,uBAAAA,CAAwBhB,OAAAA,CAAAA,EAAU;AAG/C/D,IAAAA,MAAAA,CAAOC,MAAM,gEAAA,CAAA;AAEb,IAAA,MAAM4F,SAAAA,GAAY/B,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA,IAAmB,MAAA;AACxD,IAAA,MAAM+B,QAAAA,GAAWhC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AAEpC,IAAA,OAAO;MACLtD,EAAAA,EAAI4C,OAAAA;MACJV,IAAAA,EAAMkD,SAAAA;MACN1D,YAAAA,EAAc2B,SAAAA,CAAUC,SAAS,gBAAA,CAAA;MACjClB,SAAAA,EAAWiB,SAAAA,CAAUC,SAAS,aAAA,CAAA;AAC9BjB,MAAAA,MAAAA,EAAQgB,UAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAC7DhB,MAAAA,OAAAA,EACE8C,cAAc,aAAA,IACdC,QAAAA,KAAa,cAAA,IACbA,QAAAA,KAAa,iBACbA,QAAAA,KAAa;AACjB,KAAA;AACF,EAAA;AAEA,EAAA,IAAIzC,OAAAA,EAAS;AACXrD,IAAAA,MAAAA,CAAOe,KAAK,uFAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAMgF,UAAAA,GAAajC,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AAEtC,EAAA,IAAI,CAACgC,UAAAA,EAAYC,UAAAA,CAAW,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMxE,KAAAA,GAAQuE,UAAAA,CAAWE,SAAAA,CAAU,CAAA,CAAA;AAEnC,EAAA,IAAI;AACFjG,IAAAA,MAAAA,CAAOC,MAAM,iFAAA,CAAA;AACb,IAAA,MAAM4B,OAAAA,GAAU,MAAMN,SAAAA,CAAUC,KAAAA,CAAAA;AAEhC,IAAA,IAAI,CAACK,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLpB,MAAAA,EAAAA,EAAIoB,OAAAA,CAAQpB,EAAAA;MACZkC,IAAAA,EAAM,MAAA;AACNR,MAAAA,YAAAA,EAAcN,OAAAA,CAAQM;AACxB,KAAA;AACF,EAAA,CAAA,CAAA,OAASrB,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,sCAAsCD,KAAAA,CAAAA;AAClD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAzDe8E,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA8Df,SAASM,cAAcnC,OAAAA,EAAgB;AAErC,EAAA,MAAMoC,QAAAA,GAAWrC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AACpC,EAAA,MAAMqC,cAAAA,GAAiBtC,SAAAA,CAAUC,OAAAA,EAAS,mBAAA,CAAA;AAE1C,EAAA,IAAIoC,QAAAA,EAAU;AACZ,IAAA,OAAO;MACL1F,EAAAA,EAAI0F,QAAAA;AACJE,MAAAA,QAAAA,EAAUD,cAAAA,IAAkB;AAC9B,KAAA;AACF,EAAA;AAGA,EAAA,OAAOxC,gBAAgB0C,aAAAA,IAAiB,IAAA;AAC1C;AAdSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASK,oBAAoBxC,OAAAA,EAAgB;AAC3C,EAAA,MAAMN,QAAQK,SAAAA,CAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAEnE,EAAA,IAAIN,KAAAA,EAAO;AACT,IAAA,OAAO;MAAEhD,EAAAA,EAAIgD;AAAM,KAAA;AACrB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARS8C,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASC,gBAAAA,CAAiBzC,SAAkBd,KAAAA,EAAoB;AAE9D,EAAA,MAAM9C,WAAAA,GAAc2D,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEvC,EAAA,IAAI5D,WAAAA,EAAa;AACf,IAAA,OAAO;MAAEM,EAAAA,EAAIN;AAAY,KAAA;AAC3B,EAAA;AAGA,EAAA,IAAI8C,OAAOd,YAAAA,EAAc;AACvB,IAAA,OAAO;AAAE1B,MAAAA,EAAAA,EAAIwC,KAAAA,CAAMd;AAAa,KAAA;AAClC,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAdSqE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAmBT,SAASC,eAAe1C,OAAAA,EAAgB;AACtC,EAAA,MAAM2C,SAAAA,GAAY5C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI2C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEjG,EAAAA,EAAIiG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaT,SAASE,eAAe5C,OAAAA,EAAgB;AACtC,EAAA,MAAM6C,SAAAA,GAAY9C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI6C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEnG,EAAAA,EAAImG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASE,iBAAiB9C,OAAAA,EAAgB;AACxC,EAAA,MAAM+C,OAAAA,GAAUhD,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACnC,EAAA,MAAMgD,QAAAA,GAAWjD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AACpC,EAAA,MAAMiD,QAAAA,GAAWlD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEpC,EAAA,OAAO;IACL+C,OAAAA,EAASA,OAAAA,EAASG,aAAAA,IAAiB7C,MAAAA;IACnC2C,QAAAA,EAAUA,QAAAA,EAAUE,aAAAA,IAAiB7C,MAAAA;AACrC4C,IAAAA,QAAAA,EAAUA,QAAAA,IAAY5C;AACxB,GAAA;AACF;AAVSyC,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAwBT,SAASK,sBAAsBnD,OAAAA,EAAgB;AAC7C,EAAA,MAAMoD,SAAAA,GAAYrD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAGrC,EAAA,IAAI,CAACoD,SAAAA,EAAW;AACd,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMC,YAAAA,GAAetD,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMsD,eAAAA,GAAkBvD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAC3C,EAAA,MAAMuD,eAAAA,GAAkBxD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAE3C,EAAA,OAAO;AACLoD,IAAAA,SAAAA;IACAI,MAAAA,EAAQH,YAAAA,GAAeA,YAAAA,CAAa3B,KAAAA,CAAM,GAAA,CAAA,CAAK+B,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAE/B,IAAAA,EAAI,CAAA,GAAMtB,MAAAA;AACtEsD,IAAAA,SAAAA,EAAWL,eAAAA,GAAkB,IAAIM,IAAAA,CAAKN,eAAAA,CAAAA,GAAmBjD,MAAAA;AACzDwD,IAAAA,SAAAA,EAAWN,eAAAA,GAAkB,IAAIK,IAAAA,CAAKL,eAAAA,CAAAA,GAAmBlD;AAC3D,GAAA;AACF;AAlBS8C,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA0BT,eAAsBW,aAAa9D,OAAAA,EAAgB;AACjD,EAAA,IAAI,CAACH,cAAAA,EAAgB;AACnB,IAAA,MAAM,IAAIV,MAAM,wEAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMD,KAAAA,GAAQ,MAAM2C,YAAAA,CAAa7B,OAAAA,CAAAA;AAGjC,EAAA,MAAMJ,MAAAA,GAASuC,cAAcnC,OAAAA,CAAAA;AAC7B,EAAA,MAAMP,YAAAA,GAAe+C,oBAAoBxC,OAAAA,CAAAA;AACzC,EAAA,MAAM1D,SAAAA,GAAYmG,gBAAAA,CAAiBzC,OAAAA,EAASd,KAAAA,CAAAA;AAC5C,EAAA,MAAM6E,OAAAA,GAAUrB,eAAe1C,OAAAA,CAAAA;AAC/B,EAAA,MAAMgE,OAAAA,GAAUpB,eAAe5C,OAAAA,CAAAA;AAC/B,EAAA,MAAMiE,QAAAA,GAAW3C,gBAAgBtB,OAAAA,CAAAA;AACjC,EAAA,MAAMkE,cAAAA,GAAiBf,sBAAsBnD,OAAAA,CAAAA;AAG7C,EAAA,IAAImE,IAAAA;AACJ,EAAA,IAAItE,eAAesE,IAAAA,EAAM;AACvBA,IAAAA,IAAAA,GAAOtE,cAAAA,CAAesE,IAAAA,CAAKC,wBAAAA,CAAyBpE,OAAAA,CAAAA;AACtD,EAAA;AAGA,EAAA,MAAMqE,GAAAA,GAAMvB,iBAAiB9C,OAAAA,CAAAA;AAC7B,EAAA,IAAIqE,GAAAA,CAAItB,OAAAA,IAAWsB,GAAAA,CAAIrB,QAAAA,IAAYqB,IAAIpB,QAAAA,EAAU;AAC/C,IAAA,IAAIkB,IAAAA,EAAM;AAER,MAAA,IAAIE,GAAAA,CAAItB,OAAAA,EAASoB,IAAAA,CAAKpB,OAAAA,GAAUsB,GAAAA,CAAItB,OAAAA;AACpC,MAAA,IAAIsB,GAAAA,CAAIrB,QAAAA,EAAUmB,IAAAA,CAAKnB,QAAAA,GAAWqB,GAAAA,CAAIrB,QAAAA;AACtC,MAAA,IAAIqB,GAAAA,CAAIpB,QAAAA,EAAUkB,IAAAA,CAAKlB,QAAAA,GAAWoB,GAAAA,CAAIpB,QAAAA;IACxC,CAAA,MAAO;AAELkB,MAAAA,IAAAA,GAAO;QACLG,MAAAA,EAAQ,OAAA;QACRC,QAAAA,EAAU,IAAA;AACVxB,QAAAA,OAAAA,EAASsB,GAAAA,CAAItB,OAAAA;AACbC,QAAAA,QAAAA,EAAUqB,GAAAA,CAAIrB,QAAAA;AACdC,QAAAA,QAAAA,EAAUoB,GAAAA,CAAIpB,QAAAA;QACduB,CAAAA,kBAAG,MAAA,CAAA,CAACvE,QAAgBA,GAAAA,EAAjB,GAAA,CAAA;QACHwE,EAAAA,kBAAI,MAAA,CAAA,CAACxE,QAAgBA,GAAAA,EAAjB,IAAA,CAAA;AACJyE,QAAAA,YAAAA,kBAAc,MAAA,CAAA,CAACC,KAAAA,KAAkBC,MAAAA,CAAOD,KAAAA,CAAAA,EAA1B,cAAA,CAAA;AACdE,QAAAA,cAAAA,0BAAiBF,KAAAA,EAAe3B,QAAAA,KAAqB,GAAGA,QAAAA,CAAAA,CAAAA,EAAY2B,KAAAA,CAAAA,CAAAA,EAApD,gBAAA,CAAA;AAChBG,QAAAA,UAAAA,kBAAY,MAAA,CAAA,CAACC,IAAAA,KAAwBH,MAAAA,CAAOG,IAAAA,CAAAA,EAAhC,YAAA,CAAA;AACZC,QAAAA,kBAAAA,0BAAqBL,KAAAA,EAAeM,IAAAA,KAAsC,GAAGN,KAAAA,CAAAA,CAAAA,EAASM,IAAAA,CAAAA,CAAAA,EAAlE,oBAAA;AACtB,OAAA;AACF,IAAA;AACF,EAAA;AAKA,EAAA,MAAMC,UAAAA,GAAAA,CACHhG,KAAAA,EAAON,IAAAA,KAAS,KAAA,IAASM,OAAON,IAAAA,KAAS,SAAA,IAAaM,KAAAA,EAAON,IAAAA,KAAS,iBAAA,KACvEsF,cAAAA,EAAgBd,SAAAA,GACZc,cAAAA,CAAed,YACflE,KAAAA,EAAOxC,EAAAA;AAIb,EAAA,MAAMyI,YAAAA,GAAe;AACnB/I,IAAAA,WAAAA,EAAaE,SAAAA,EAAWI,EAAAA;AACxB0F,IAAAA,QAAAA,EAAUxC,MAAAA,EAAQlD,EAAAA;AAClB4C,IAAAA,OAAAA,EAASJ,KAAAA,EAAOxC,EAAAA;AAChBoF,IAAAA,SAAAA,EAAW5C,KAAAA,EAAON,IAAAA;AAClBwG,IAAAA,cAAAA,EAAgB3F,YAAAA,EAAc/C,EAAAA;AAC9BiG,IAAAA,SAAAA,EAAWoB,OAAAA,EAASrH,EAAAA;AACpBwI,IAAAA;AACF,GAAA;AAEAjJ,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxDE,IAAAA,WAAAA,EAAa+I,aAAa/I,WAAAA,IAAe,MAAA;AACzCkD,IAAAA,OAAAA,EAAS6F,aAAa7F,OAAAA,IAAW,MAAA;IACjC+F,SAAAA,EAAWtF,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA,IAAqB;GACrD,CAAA;AAEAsF,EAAAA,mBAAAA,CAAoBH,YAAAA,CAAAA;AAEpB,EAAA,OAAO;AACLnF,IAAAA,OAAAA;AACAd,IAAAA,KAAAA;AACAU,IAAAA,MAAAA;AACAH,IAAAA,YAAAA;AACAnD,IAAAA,SAAAA;AACAyH,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,cAAAA,EAAgBA,cAAAA,IAAkB7D,MAAAA;IAClC6E,UAAAA,EAAYA,UAAAA,IAAchG,OAAOxC,EAAAA,IAAM,EAAA;AACvCL,IAAAA,EAAAA,EAAIwD,eAAevE,KAAAA,EAAK;AACxB6I,IAAAA,IAAAA;AACAoB,IAAAA,eAAAA,EAAiB,IAAIC,OAAAA;AACvB,GAAA;AACF;AA7FsB1B,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAkGf,SAAS2B,iBAAAA,GAAAA;AACd,EAAA,OAAO5F,cAAAA;AACT;AAFgB4F,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;AC7ZhB,IAAMC,iBAAAA,GAAoB;AACxB,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA;;AAGK,SAASC,oBAAAA,CACdC,SACAC,WAAAA,EAAiE;AAEjE,EAAA,MAAMC,UAAAA,GAAAA,CAAcC,MAAMC,OAAAA,CAAQJ,OAAAA,IAAWA,OAAAA,GAAUA,OAAAA,EAASlE,MAAM,GAAA,CAAA,IAAQ,EAAA,EAC3E+B,GAAAA,CAAI,CAACwC,MAAAA,KAAWA,MAAAA,CAAOtE,MAAI,CAAA,CAC3BuE,OAAOC,OAAAA,CAAAA;AAEV,EAAA,IAAIL,UAAAA,CAAWjF,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAOgF,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,IAAII,UAAAA,CAAWM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAC5B,IAAA,OAAOP,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,OAAOI,UAAAA;AACT;AAjBgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAmBT,SAASU,wBAAAA,CAAyBC,eAA8BC,cAAAA,EAAwB;AAC7F,EAAA,IAAI,CAACD,aAAAA,EAAe;AAClB,IAAA,OAAOC,cAAAA,CAAe,CAAA,CAAA,IAAM,IAAA;AAC9B,EAAA;AAEA,EAAA,OAAOA,cAAAA,CAAeH,QAAAA,CAASE,aAAAA,CAAAA,GAAiBA,aAAAA,GAAgB,IAAA;AAClE;AANgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASG,qBAAqBtH,KAAAA,EAAoB;AACvD,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOA,KAAAA,CAAMF,YAAY,IAAA,IAAQ;AAAC,IAAA,SAAA;AAAW,IAAA;AAAeoH,GAAAA,CAAAA,QAAAA,CAASlH,MAAMN,IAAI,CAAA;AACjF;AANgB4H,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;;;ACbhB,IAAIC,eAAAA,GAA+B,IAAA;AAKnC,eAAsBC,aAAaC,UAAAA,EAA4B;AAC7D,EAAA,MAAM,EACJ3K,MAAAA,EACA4K,YAAAA,EACAC,MAAAA,EACAC,WAAAA,EACAC,aAAAA,EACAC,WAAAA,EACAlD,YAAAA,EAAcmD,kBAAAA,EACdC,wBAAAA,EACAC,yBAAAA,EACAC,UAAAA,EAAU,GACRT,UAAAA;AAGJ,EAAA,MAAM,EAAEU,MAAAA,EAAM,GAAK,MAAM,OAAO,QAAA,CAAA;AAChC,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,oBAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,IAAAA,EAAI,GAAK,MAAM,OAAO,gBAAA,CAAA;AAC9B,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,cAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,oBAAoBnM,KAAAA,EAAAA,MAAAA,EAAOoM,oBAAkB,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvE,EAAA,MAAM,EAAEC,oBAAAA,EAAoB,GAAK,MAAM,OAAO,wBAAA,CAAA;AAC9C,EAAA,MAAM,EAAEC,mBAAAA,EAAmB,GAAK,MAAM,OAAO,2BAAA,CAAA;AAC7C,EAAA,MAAM,EAAEC,0BAAAA,EAAAA,2BAAAA,EAA0B,GAAK,MAAM,OAAO,gCAAA,CAAA;AAEpD5L,EAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,sBAAA,EAAyB9L,MAAAA,CAAO+L,WAAW,CAAA,GAAA,CAAK,CAAA;AAG5D,EAAA,MAAMC,QAAAA,GACJhM,MAAAA,CAAOgM,QAAAA,KACNhM,MAAAA,CAAO+L,YAAY9F,UAAAA,CAAW,SAAA,CAAA,GAC3B,QAAA,GACAjG,MAAAA,CAAO+L,WAAAA,CAAY9F,UAAAA,CAAW,SAAA,IAC5B,QAAA,GACA,QAAA,CAAA;AAIR,EAAA,MAAMgG,iCACJd,yBAAAA,KAA8B,IAAA,GAAO,QAAQA,yBAAAA,KAA8B,KAAA,GAAQ,OAAOa,QAAAA,KAAa,QAAA;AAEzG/L,EAAAA,MAAAA,CAAO6L,KAAK,mCAAA,EAAqC;AAC/CE,IAAAA,QAAAA;IACAE,kBAAAA,EAAoBD;GACtB,CAAA;AAEA,EAAA,MAAM,EAAEE,OAAAA,EAAO,GAAKV,kBAAAA,CAAmBb,YAAAA,EAAc5K,OAAO+L,WAAAA,EAAa;IACvEK,wBAAAA,EAA0B,KAAA;IAC1BC,wBAAAA,EAA0BJ,8BAAAA;AAC1B,IAAA,GAAIf,wBAAAA,GAA2B;AAAEA,MAAAA;AAAyB,KAAA,GAAI;GAChE,CAAA;AACA,EAAA,MAAMiB,OAAAA,EAAAA;AAGN,EAAA,IAAIG,YAAAA;AACJ,EAAA,IAAItM,MAAAA,CAAOmI,IAAAA,EAAMoE,OAAAA,IAAWvM,MAAAA,CAAOmI,KAAKqE,WAAAA,EAAa;AACnDvM,IAAAA,MAAAA,CAAO6L,KAAK,+BAAA,CAAA;AACZQ,IAAAA,YAAAA,GAAe,IAAIG,IAAAA,CAAK;MACtBC,aAAAA,EAAe1M,MAAAA,CAAOmI,KAAKuE,aAAAA,IAAiB,OAAA;MAC5CC,cAAAA,EAAgB3M,MAAAA,CAAOmI,KAAKwE,cAAAA,IAAkB,OAAA;AAC9CH,MAAAA,WAAAA,EAAaxM,OAAOmI,IAAAA,CAAKqE,WAAAA;AACzBI,MAAAA,gBAAAA,EAAkB5M,OAAOmI,IAAAA,CAAKyE,gBAAAA;MAC9BC,SAAAA,EAAW7M,MAAAA,CAAOmI,IAAAA,CAAK0E,SAAAA,IAAa7M,MAAAA,CAAO+L,WAAAA;AAC3Ce,MAAAA,QAAAA,EAAU9M,OAAOmI,IAAAA,CAAK2E,QAAAA;MACtBC,UAAAA,EAAY/M,MAAAA,CAAOmI,KAAK4E,UAAAA,IAAc,IAAA;MACtCC,WAAAA,EAAa,IAAA;MACbC,kBAAAA,EAAoB;KACtB,CAAA;AACA,IAAA,MAAMX,aAAaY,UAAAA,EAAU;AAC7BjN,IAAAA,MAAAA,CAAO6L,IAAAA,CAAK,2CAA2CQ,YAAAA,CAAaa,mBAAAA,GAAsBC,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAO,CAAA;AACxG,EAAA;AAGAtJ,EAAAA,gBAAAA,CAAiB;IACfxE,KAAAA,kBAAO,MAAA,CAAA,MAAMA,QAAAA,EAAN,OAAA,CAAA;IACP6I,IAAAA,EAAMmE;GACR,CAAA;AAGArL,EAAAA,oBAAAA,EAAAA;AAGA,EAAA,IAAI6J,WAAAA,EAAa;AACf7K,IAAAA,MAAAA,CAAO6L,KAAK,uCAAA,CAAA;AACZ,IAAA,MAAMhB,YAAYoC,UAAAA,EAAU;AAC9B,EAAA;AAGA,EAAA,MAAMG,KAAAA,GAAQrN,OAAO6J,WAAAA,KAAgB,YAAA;AACrC,EAAA,MAAMyD,gBAAAA,GAAmBtN,OAAOsN,gBAAAA,IAAoBD,KAAAA;AAGpD,EAAA,MAAME,qBAAAA,GAAwBvN,MAAAA,CAAOwN,cAAAA,EAAgBjB,OAAAA,IAAWP,QAAAA,KAAa,QAAA;AAC7E/L,EAAAA,MAAAA,CAAO6L,KAAK,CAAA,mBAAA,EAAsBE,QAAAA,sBAA8BuB,qBAAAA,GAAwB,SAAA,GAAY,UAAA,CAAA,CAAY,CAAA;AAEhH,EAAA,MAAME,wBAAwBF,qBAAAA,GAC1B;IACE1B,2BAAAA,CAA2B;MACzBU,OAAAA,EAAS,IAAA;AACTmB,MAAAA,qBAAAA,EAAuB1N,OAAOwN,cAAAA,EAAgBE;KAChD;MAEF,EAAA;AAGJ,EAAA,MAAMC,eAAAA,GAAkB3N,OAAO2N,eAAAA,IAAmB,UAAA;AAClD1N,EAAAA,MAAAA,CAAO6L,KAAK,0DAAA,CAAA;AAEZ,EAAA,MAAM8B,qBAAAA,GAAoC;AACxCC,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEC,QAAAA,EAAUC,aAAAA,EAAa,KAAkD;AACtF,MAAA,MAAMC,WAAAA,GAAcD,aAAAA;AACpB,MAAA,IAAIC,aAAazE,eAAAA,EAAiB;AAChCyE,QAAAA,WAAAA,CAAYzE,eAAAA,CAAgB0E,OAAAA,CAAQ,CAACtF,KAAAA,EAAe1E,GAAAA,KAAAA;AAClD6J,UAAAA,QAAAA,CAAS5J,OAAAA,CAAQgK,MAAAA,CAAOjK,GAAAA,EAAK0E,KAAAA,CAAAA;QAC/B,CAAA,CAAA;AACF,MAAA;IACF,CAAA,EAPY,YAAA;AAQd,GAAA;AAEA,EAAA,MAAMwF,OAAO3C,UAAAA,CAAiC;AAC5CmC,IAAAA,eAAAA;AACA9C,IAAAA,MAAAA;IACAuD,QAAAA,EAAUd,gBAAAA;IACVe,OAAAA,EAAS;AACPnO,MAAAA,KAAAA,6BAAWoO,IAAAA,KAASrO,MAAAA,CAAOC,MAAM,WAAA,EAAA,GAAgBoO,IAAAA,CAAAA,EAA1C,OAAA,CAAA;AACPxC,MAAAA,IAAAA,6BAAUwC,IAAAA,KAASrO,MAAAA,CAAO6L,KAAK,WAAA,EAAA,GAAgBwC,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNtN,MAAAA,IAAAA,6BAAUsN,IAAAA,KAASrO,MAAAA,CAAOe,KAAK,WAAA,EAAA,GAAgBsN,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNvN,MAAAA,KAAAA,6BAAWuN,IAAAA,KAASrO,MAAAA,CAAOc,MAAM,WAAA,EAAA,GAAgBuN,IAAAA,CAAAA,EAA1C,OAAA;AACT,KAAA;IACAC,OAAAA,EAAS;AAAId,MAAAA,GAAAA,qBAAAA;AAAuBG,MAAAA,qBAAAA;AAA2B5C,MAAAA,GAAAA,WAAAA,IAAe;;IAC9E3H,OAAAA,kBAAS,MAAA,CAAA,OAAO,EAAEW,OAAAA,EAAO,KAAE;AAEzB,MAAA,MAAMwK,cAAAA,GAAiB,MAAM1G,YAAAA,CAAa9D,OAAAA,CAAAA;AAG1C,MAAA,IAAIiH,kBAAAA,EAAoB;AACtB,QAAA,OAAOA,mBAAmBuD,cAAAA,CAAAA;AAC5B,MAAA;AAEA,MAAA,OAAOA,cAAAA;IACT,CAAA,EAVS,SAAA;GAWX,CAAA;AAGA,EAAA,MAAMC,GAAAA,GAAM,IAAIpD,MAAAA,CAAO;IAAEqD,OAAAA,EAASpD;GAAW,CAAA;AAG7C,EAAA,MAAMqD,WAAAA,GAAchF,oBAAAA,CAAqB3J,MAAAA,CAAO2O,WAAAA,EAAa3O,OAAO6J,WAAW,CAAA;AAE/E4E,EAAAA,GAAAA,CAAIG,IACFrD,IAAAA,CAAK;IACHtB,MAAAA,EAAQ0E,WAAAA;AACRE,IAAAA,WAAAA,EAAaF,YAAY9J,MAAAA,GAAS,CAAA;IAClCiK,cAAAA,EAAgB;AACd,MAAA,cAAA;AACA,MAAA,eAAA;AACA,MAAA,aAAA;AACA,MAAA,gBAAA;AACA,MAAA,UAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,gBAAA;AACA,MAAA,iBAAA;AACA,MAAA,UAAA;AACA,MAAA,YAAA;AACA,MAAA,eAAA;AACA,MAAA,gBAAA;AACA,MAAA,gBAAA;;AAEA,MAAA,YAAA;AACA,MAAA,cAAA;AACA,MAAA,0BAAA;AACA,MAAA;;IAEFC,OAAAA,EAAS;AAAC,MAAA,KAAA;AAAO,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,OAAA;AAAS,MAAA,QAAA;AAAU,MAAA;;AACrD,GAAA,CAAA,CAAA;AAIF,EAAA,MAAMC,gBAAAA,GAAAA,CAAoBjE,iBAAiB,EAAA,EAAIb,OAAO,CAAC+E,EAAAA,KAAOA,GAAGC,OAAO,CAAA;AACxE,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIJ,gBAAAA,CAAiBvH,GAAAA,CAAI,CAACwH,EAAAA,KAAO;IAACA,EAAAA,CAAGI,IAAAA;AAAMJ,IAAAA;GAAG,CAAA,CAAA;AACvE,EAAA,MAAMK,eAAAA,GAAkBN,gBAAAA,CAAiBvH,GAAAA,CAAI,CAACnB,QAAAA,KAAAA;AAC5C,IAAA,MAAMiJ,YAAAA,GAAejJ,QAAAA,CAAS+I,IAAAA,CAAKG,OAAAA,CAAQ,WAAW,OAAA,CAAA;AACtD,IAAA,OAAO;AACLlJ,MAAAA,QAAAA;AACAiJ,MAAAA,YAAAA;AACAE,MAAAA,KAAAA,EAAO,IAAIC,MAAAA,CAAO,CAAA,CAAA,EAAIH,YAAAA,CAAAA,CAAAA,CAAe;AACvC,KAAA;EACF,CAAA,CAAA;AAGA,EAAA,MAAMI,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAE5B,IAAA,MAAMC,UAAAA,GAAaV,YAAAA,CAAahL,GAAAA,CAAIyL,QAAAA,CAAAA;AACpC,IAAA,IAAIC,YAAY,OAAOA,UAAAA;AAGvB,IAAA,KAAA,MAAW,EAAEvJ,QAAAA,EAAUmJ,KAAAA,EAAOF,YAAAA,MAAkBD,eAAAA,EAAiB;AAC/D,MAAA,MAAMQ,OAAAA,GAAUL,KAAAA,CAAMM,IAAAA,CAAKH,QAAAA,CAAAA;AAC3B3P,MAAAA,MAAAA,CAAOC,KAAAA,CACL,CAAA,kBAAA,EAAqB0P,QAAAA,CAAAA,iBAAAA,EAA4BtJ,QAAAA,CAAS+I,IAAI,CAAA,SAAA,EAAYE,YAAAA,CAAAA,UAAAA,EAAyBO,OAAAA,CAAAA,CAAS,CAAA;AAE9G,MAAA,IAAIA,OAAAA,EAAS;AACX7P,QAAAA,MAAAA,CAAOC,MAAM,CAAA,iBAAA,EAAoB0P,QAAAA,CAAAA,YAAAA,EAAuBtJ,QAAAA,CAAS+I,IAAI,CAAA,CAAE,CAAA;AACvE,QAAA,OAAO/I,QAAAA;AACT,MAAA;AACF,IAAA;AAEArG,IAAAA,MAAAA,CAAOC,MAAM,CAAA,wCAAA,EAA2C0P,QAAAA,CAAAA,oBAAAA,EAA+BZ,gBAAAA,CAAiBnK,MAAM,CAAA,CAAE,CAAA;AAChH,IAAA,OAAOR,MAAAA;EACT,CAAA,EAnB6B,sBAAA,CAAA;AAyB7BoK,EAAAA,GAAAA,CAAIuB,SAAAA,CAAU,OAAO,EAAEhM,OAAAA,EAAO,KAAE;AAC9B,IAAA,MAAMiM,GAAAA,GAAM,IAAIC,GAAAA,CAAIlM,OAAAA,CAAQiM,GAAG,CAAA;AAC/B,IAAA,MAAML,WAAWK,GAAAA,CAAIL,QAAAA;AACrB3P,IAAAA,MAAAA,CAAOC,MAAM,CAAA,oBAAA,EAAuB8D,OAAAA,CAAQmM,MAAM,CAAA,CAAA,EAAIP,QAAAA,CAAAA,CAAU,CAAA;AAChE,IAAA,MAAMQ,aAAAA,GAAgBR,QAAAA,KAAa,SAAA,IAAaA,QAAAA,CAAS3J,WAAW,UAAA,CAAA;AAGpE,IAAA,MAAMoK,mCAAmB,MAAA,CAAA,MAAA;AACvB,MAAA,MAAMpG,MAAAA,GAASjG,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA,IAAa,GAAA;AAChD,MAAA,MAAMmM,gBAAgBjG,wBAAAA,CAAyBJ,MAAAA,KAAW,GAAA,GAAM,IAAA,GAAOA,QAAQ0E,WAAAA,CAAAA;AAC/E,MAAA,MAAMzK,OAAAA,GAAkC;QACtC,8BAAA,EAAgC,wCAAA;QAChC,8BAAA,EACE;AACJ,OAAA;AAEA,MAAA,IAAIoM,aAAAA,EAAe;AACjBpM,QAAAA,OAAAA,CAAQ,6BAAA,CAAA,GAAiCoM,aAAAA;AACzCpM,QAAAA,OAAAA,CAAQ,kCAAA,CAAA,GAAsC,MAAA;AAChD,MAAA;AAEA,MAAA,OAAOA,OAAAA;IACT,CAAA,EAfyB,kBAAA,CAAA;AAkBzB,IAAA,MAAMqM,eAAAA,GAAkBH,aAAAA,GAAgB/L,MAAAA,GAAYsL,oBAAAA,CAAqBC,QAAAA,CAAAA;AACzE,IAAA,IAAIW,eAAAA,EAAiB;AACnBtQ,MAAAA,MAAAA,CAAOC,MAAM,CAAA,oCAAA,EAAuC0P,QAAAA,CAAAA,IAAAA,EAAeW,eAAAA,CAAgBlB,IAAI,CAAA,CAAE,CAAA;AACzF,MAAA,MAAMmB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIrM,OAAAA,CAAQmM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAASsM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,IAAIxM,OAAAA,CAAQmM,MAAAA,KAAWI,eAAAA,CAAgBJ,MAAAA,EAAQ;AAC7C,QAAA,OAAO9L,MAAAA;AACT,MAAA;AAEA,MAAA,IAAI;AAEF,QAAA,MAAM6K,OAAAA,GAAU,MAAMlL,OAAAA,CAAQ2M,IAAAA,EAAI;AAGlC,QAAA,MAAMtN,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AAGnC,QAAA,MAAM4M,SAAS,MAAML,eAAAA,CAAgBM,OAAAA,CAAQ7M,OAAAA,EAASX,SAAS6L,OAAAA,CAAAA;AAG/D,QAAA,IAAI0B,kBAAkBH,QAAAA,EAAU;AAE9B,UAAA,MAAMvM,QAAAA,GAAU,IAAIsF,OAAAA,CAAQoH,MAAAA,CAAO1M,OAAO,CAAA;AAC1C,UAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUmI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDtM,YAAAA,QAAAA,CAAQ8M,GAAAA,CAAI/M,GAAAA,EAAK0E,KAAAA,CAAAA;AACnB,UAAA;AACA,UAAA,OAAO,IAAI8H,QAAAA,CAASG,MAAAA,CAAOK,IAAAA,EAAM;AAC/BP,YAAAA,MAAAA,EAAQE,MAAAA,CAAOF,MAAAA;AACfQ,YAAAA,UAAAA,EAAYN,MAAAA,CAAOM,UAAAA;YACnBhN,OAAAA,EAAAA;WACF,CAAA;AACF,QAAA;AAGA,QAAA,MAAMA,OAAAA,GAAU,IAAIsF,OAAAA,CAAQ;UAC1B,cAAA,EAAgB,kBAAA;UAChB,GAAGgH;SACL,CAAA;AAEA,QAAA,OAAO,IAAIC,QAAAA,CAAS7P,IAAAA,CAAKE,SAAAA,CAAU8P,MAAAA,CAAAA,EAAS;UAC1CF,MAAAA,EAAQ,GAAA;AACRxM,UAAAA;SACF,CAAA;AACF,MAAA,CAAA,CAAA,OAASnD,KAAAA,EAAO;AACdd,QAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,kCAAA,EAAqC6O,QAAAA,CAAAA,EAAAA,CAAAA,EAAc7O,KAAAA,CAAAA;AAChE,QAAA,MAAMyP,eAAcH,gBAAAA,EAAAA;AACpB,QAAA,OAAO,IAAII,QAAAA,CACT7P,IAAAA,CAAKE,SAAAA,CAAU;UACbC,KAAAA,EAAOA,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMoQ,OAAAA,GAAU;AAClD,SAAA,CAAA,EACA;UACET,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;YAChB,GAAGsM;AACL;SACF,CAAA;AAEJ,MAAA;AACF,IAAA;AAMA,IAAA,IAAIZ,QAAAA,KAAa,UAAA,IAAc5L,OAAAA,CAAQmM,MAAAA,KAAW,KAAA,EAAO;AACvD,MAAA,IAAI;AACF,QAAA,MAAMiB,aAAAA,GAAgB,aAAA;AACtB,QAAA,MAAMC,IAAAA,GAAQ,MAAM,OAAOD,aAAAA,CAAAA;AAI3B,QAAA,IAAI;AACFC,UAAAA,IAAAA,CAAKC,qBAAAA,CAAsB;AAAEC,YAAAA,QAAAA,EAAUF,IAAAA,CAAKE;WAAS,CAAA;QACvD,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,MAAMN,IAAAA,GAAO,MAAMI,IAAAA,CAAKE,QAAAA,CAASC,OAAAA,EAAO;AACxC,QAAA,OAAO,IAAIf,SAASQ,IAAAA,EAAM;UACxBP,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAAS;YACP,cAAA,EAAgBmN,IAAAA,CAAKE,SAASE,WAAAA,IAAe;AAC/C;SACF,CAAA;MACF,CAAA,CAAA,MAAQ;AAER,MAAA;AACF,IAAA;AAGA,IAAA,MAAMC,UAAAA,GAAa;AAAC/D,MAAAA,eAAAA;AAAiB,MAAA,CAAA,EAAGA,eAAAA,CAAAA,CAAAA,CAAAA;AAAoB,MAAA;;AAC5D,IAAA,MAAMgE,kBAAAA,GAAqBD,UAAAA,CAAWtH,QAAAA,CAASwF,QAAAA,CAAAA;AAE/C,IAAA,IAAI+B,kBAAAA,EAAoB;AACtB,MAAA,MAAMnB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIrM,OAAAA,CAAQmM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAASsM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,MAAMoB,YAAAA,GAAe,MAAMzD,IAAAA,CAAK0D,KAAAA,CAAM7N,OAAAA,CAAAA;AAGtC,MAAA,MAAME,OAAAA,GAAU,IAAIsF,OAAAA,CAAQoI,YAAAA,CAAa1N,OAAO,CAAA;AAChD,MAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUmI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDtM,QAAAA,OAAAA,CAAQ8M,GAAAA,CAAI/M,KAAK0E,KAAAA,CAAAA;AACnB,MAAA;AAGA,MAAA,OAAO,IAAI8H,QAAAA,CAASmB,YAAAA,CAAaX,IAAAA,EAAM;AACrCP,QAAAA,MAAAA,EAAQkB,YAAAA,CAAalB,MAAAA;AACrBQ,QAAAA,UAAAA,EAAYU,YAAAA,CAAaV,UAAAA;AACzBhN,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,OAAOG,MAAAA;EACT,CAAA,CAAA;AAGAoK,EAAAA,GAAAA,CAAIG,GAAAA,CAAIhD,qBAAAA,CAAAA;AAGR6C,EAAAA,GAAAA,CAAIG,IACFjD,oBAAAA,CAAqB;AACnBmG,IAAAA,cAAAA,EAAgB9R,OAAO8R,cAAAA,IAAkB;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW,MAAA;;IACjEC,cAAAA,EAAgB/R,MAAAA,CAAO+R,kBAAkB,EAAA;AACzCC,IAAAA,UAAAA,EAAYhS,OAAOgS,UAAAA,IAAc,KAAA;AACjCC,IAAAA,qBAAAA,EAAuBjS,OAAOiS,qBAAAA,IAAyB;AACzD,GAAA,CAAA,CAAA;AAQF,EAAA,MAAMC,iCAAiB,MAAA,CAAA,OAAO;IAC5BxB,MAAAA,EAAQ,SAAA;AACRyB,IAAAA,OAAAA,EAASnS,MAAAA,CAAO+L,WAAAA;AAChBqG,IAAAA,OAAAA,EAASpS,OAAOqS,cAAAA,IAAkB,OAAA;IAClCC,SAAAA,EAAAA,iBAAW,IAAI1K,IAAAA,EAAAA,EAAO2K,WAAAA;GACxB,CAAA,EALuB,gBAAA,CAAA;AAOvB9D,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,WAAW+N,cAAAA,CAAAA;AACnBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,gBAAgB+N,cAAAA,CAAAA;AACxBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,iBAAiB+N,cAAAA,CAAAA;AACzBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,mBAAmB+N,cAAAA,CAAAA;AAG3B,EAAA,IAAIpH,WAAAA,EAAa;AAEf2D,IAAAA,GAAAA,CAAItK,IAAI,mBAAA,EAAqB,OAAO,EAAEH,OAAAA,EAASgN,KAAG,KAAE;AAClD,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,OAAO+J,YAAY0H,SAAAA,EAAS;IAC9B,CAAA,CAAA;AAGA/D,IAAAA,GAAAA,CAAItK,IAAI,mBAAA,EAAqB,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AACzD,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKqS,KAAAA;AACxC,MAAA,OAAO3H,WAAAA,CAAY4H,SAAAA,CAAUtJ,cAAAA,EAAgBhJ,WAAAA,CAAAA;IAC/C,CAAA,CAAA;AAGAqO,IAAAA,GAAAA,CAAItK,IAAI,qBAAA,EAAuB,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AAC3D,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAauS,KAAAA,EAAK,GAAKF,KAAAA;AAK/C,MAAA,MAAMG,WAAAA,GAAcD,KAAAA,EAAOjN,KAAAA,CAAM,GAAA,CAAA,CAAK+B,IAAI,CAACe,CAAAA,KAAMA,CAAAA,CAAE7C,IAAAA,EAAI,CAAA;AACvD,MAAA,OAAOmF,WAAAA,CAAY+H,cAAAA,CAAezJ,cAAAA,EAAgBhJ,WAAAA,EAAawS,WAAAA,CAAAA;IACjE,CAAA,CAAA;AAGAnE,IAAAA,GAAAA,CAAItK,IAAI,0BAAA,EAA4B,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AAChE,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKqS,KAAAA;AACxC,MAAA,OAAO3H,WAAAA,CAAYgI,mBAAAA,CAAoB1J,cAAAA,EAAgBhJ,WAAAA,CAAAA;IACzD,CAAA,CAAA;AACF,EAAA;AAGA,EAAA,IAAI2K,aAAAA,IAAiBA,aAAAA,CAAclG,MAAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,KAAA,MAAWyB,YAAYyE,aAAAA,EAAe;AAEpC,MAAA,IAAIzE,SAAS4I,OAAAA,EAAS;AACpBjP,QAAAA,MAAAA,CAAO6L,KAAK,CAAA,uCAAA,EAA0CxF,QAAAA,CAAS6J,MAAM,CAAA,CAAA,EAAI7J,QAAAA,CAAS+I,IAAI,CAAA,CAAE,CAAA;AACxF,QAAA;AACF,MAAA;AAEA,MAAA,MAAMwB,OAAAA,mBAAU,MAAA,CAAA,OAAO,EAAE7M,OAAAA,EAAO,KAAwB;AACtD,QAAA,MAAMX,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,QAAA,OAAOsC,QAAAA,CAASuK,OAAAA,CAAQ7M,OAAAA,EAASX,OAAAA,CAAAA;MACnC,CAAA,EAHgB,SAAA,CAAA;AAKhB,MAAA,QAAQiD,SAAS6J,MAAAA;QACf,KAAK,KAAA;AACH1B,UAAAA,GAAAA,CAAItK,GAAAA,CAAImC,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,MAAA;AACHpC,UAAAA,GAAAA,CAAIsE,IAAAA,CAAKzM,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACxB,UAAA;QACF,KAAK,KAAA;AACHpC,UAAAA,GAAAA,CAAIuE,GAAAA,CAAI1M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,OAAA;AACHpC,UAAAA,GAAAA,CAAIwE,KAAAA,CAAM3M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACzB,UAAA;QACF,KAAK,QAAA;AACHpC,UAAAA,GAAAA,CAAIyE,MAAAA,CAAO5M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AAC1B,UAAA;AACJ;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAMsC,IAAAA,GAAOnT,OAAOmT,IAAAA,IAAQ,SAAA;AAC5B,EAAA,MAAMC,OAAOpT,MAAAA,CAAOoT,IAAAA;AAGpB,EAAA,MAAMC,cAAAA,GAAiC;AACrC5E,IAAAA,GAAAA;IACA6E,MAAAA,EAAQ,IAAA;AACRC,IAAAA,KAAAA,kBAAO,MAAA,CAAA,YAAA;AACL9I,MAAAA,eAAAA,uBAAsB7C,IAAAA,EAAAA;AAGtB6G,MAAAA,GAAAA,CAAI+E,MAAAA,CAAO;AACTJ,QAAAA,IAAAA;QACAK,QAAAA,EAAUN;OACZ,CAAA;AAIA,MAAA,MAAMO,SAAAA,GAAYjF,GAAAA;AAClB4E,MAAAA,cAAAA,CAAeC,SAASI,SAAAA,CAAUJ,MAAAA;AAElCrT,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,UAAA,EAAM9L,MAAAA,CAAO+L,WAAW,CAAA,sBAAA,EAAyBoH,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,CAAAA,EAAOzF,eAAAA,CAAAA,CAAiB,CAAA;IAC/F,CAAA,EAfO,OAAA,CAAA;AAgBPgG,IAAAA,IAAAA,kBAAM,MAAA,CAAA,YAAA;AACJ1T,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,kBAAA,EAAqB9L,MAAAA,CAAO+L,WAAW,CAAA,GAAA,CAAK,CAAA;AAExD,MAAA,IAAIX,UAAAA,EAAY;AACd,QAAA,MAAMA,UAAAA,EAAAA;AACR,MAAA;AAEA,MAAA,IAAIN,WAAAA,EAAa;AACf,QAAA,MAAMA,YAAY8I,QAAAA,EAAQ;AAC5B,MAAA;AAEA,MAAA,MAAMlI,kBAAAA,GAAqBmI,UAAAA,EAAU;AAErC,MAAA,IAAIR,eAAeC,MAAAA,EAAQ;AACzBD,QAAAA,cAAAA,CAAeC,OAAOK,IAAAA,EAAI;AAC5B,MAAA;AAEA1T,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,SAAA,EAAY9L,MAAAA,CAAO+L,WAAW,CAAA,QAAA,CAAU,CAAA;IACtD,CAAA,EAlBM,MAAA,CAAA;AAmBN+H,IAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAA;AACP,MAAA,MAAMC,MAAAA,GAAStJ,eAAAA,GAAkBuJ,IAAAA,CAAKC,KAAAA,CAAAA,CAAOrM,IAAAA,CAAKsM,GAAAA,EAAG,GAAKzJ,eAAAA,CAAgB0J,OAAAA,EAAO,IAAM,GAAA,CAAA,GAAQ,CAAA;AAE/F,MAAA,OAAO;AACLpI,QAAAA,WAAAA,EAAa/L,MAAAA,CAAO+L,WAAAA;AACpBsG,QAAAA,cAAAA,EAAgBrS,OAAOqS,cAAAA,IAAkB,OAAA;AACzCxI,QAAAA,WAAAA,EAAa7J,OAAO6J,WAAAA,IAAe,aAAA;AACnCuJ,QAAAA,IAAAA;AACAD,QAAAA,IAAAA;AACAxF,QAAAA,eAAAA;QACAyG,SAAAA,EAAW3J,eAAAA,EAAiB8H,aAAAA,IAAiB,EAAA;AAC7CwB,QAAAA;AACF,OAAA;IACF,CAAA,EAbS,SAAA;AAcX,GAAA;AAGA,EAAA,MAAMM,gBAAAA,iCAA0BC,MAAAA,KAAAA;AAC9BrU,IAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,SAAA,EAAYwI,MAAAA,CAAAA,sCAAAA,CAA8C,CAAA;AACtE,IAAA,MAAMjB,eAAeM,IAAAA,EAAI;AACzBzO,IAAAA,OAAAA,CAAQqP,KAAK,CAAA,CAAA;EACf,CAAA,EAJyB,kBAAA,CAAA;AAMzBrP,EAAAA,OAAAA,CAAQsP,EAAAA,CAAG,WAAW,MAAA;AACpB,IAAA,KAAKH,iBAAiB,SAAA,CAAA;EACxB,CAAA,CAAA;AACAnP,EAAAA,OAAAA,CAAQsP,EAAAA,CAAG,UAAU,MAAA;AACnB,IAAA,KAAKH,iBAAiB,QAAA,CAAA;EACxB,CAAA,CAAA;AAEA,EAAA,OAAOhB,cAAAA;AACT;AAtjBsB3I,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA6jBf,SAAS+J,oBAAoBtU,qBAAAA,EAA4C;AAC9EJ,EAAAA,aAAAA,CAAc;IAAEI,oBAAAA,EAAAA;GAAqB,CAAA;AACvC;AAFgBsU,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * Server Auth Module\n *\n * JWT verification with workspace secret fetching for microservices.\n * Handles HS256 tokens with secrets stored in workspace database.\n */\n\nimport { logger } from '../logger/index.js';\nimport type { IActor, JWTPayload, WorkspaceSecret } from './types.js';\n\n// Type imports from packages\nimport type * as jose from 'jose';\nimport type { VerifyOptions, Jwt, JwtPayload } from 'jsonwebtoken';\n\n/**\n * Workspace model interface for fetching JWT secrets\n */\ninterface WorkspaceModel {\n  findUnique: (args: { where: { id: string } }) => Promise<{ jwtSecret?: unknown } | null>;\n}\n\ninterface DbClient {\n  client: {\n    workspace: WorkspaceModel;\n  };\n}\n\n// Import getDb dynamically to avoid circular dependencies\nlet getDbFn: (() => DbClient) | null = null;\n\nasync function getDb(): Promise<DbClient> {\n  if (!getDbFn) {\n    const prismaModule = await import('../prisma/index.js');\n    // Use unknown first then cast to avoid type inference issues\n    getDbFn = prismaModule.getDb as unknown as () => DbClient;\n  }\n  return getDbFn();\n}\n\n// Interface for the subset of jsonwebtoken we use\ninterface JwtModule {\n  decode(token: string, options?: { complete?: boolean }): string | Jwt | JwtPayload | null;\n  verify(token: string, secretOrPublicKey: string, options?: VerifyOptions): string | JwtPayload;\n}\n\n// Module cache for dynamic imports\nlet joseModule: typeof jose | null = null;\nlet jwtModule: JwtModule | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\nasync function getJwt(): Promise<JwtModule> {\n  if (!jwtModule) {\n    const jwt = await import('jsonwebtoken');\n    // Handle both ESM and CJS module formats\n    jwtModule = (jwt as { default?: JwtModule }).default ?? jwt;\n  }\n  return jwtModule;\n}\n\n/**\n * Fetch workspace secret callback type\n */\nexport type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig {\n  /** Function to fetch workspace JWT secret from database */\n  fetchWorkspaceSecret: FetchWorkspaceSecretFn;\n}\n\nlet authConfig: AuthConfig | null = null;\n\n/**\n * Configure auth module with workspace secret fetching\n */\nexport function configureAuth(config: AuthConfig): void {\n  authConfig = config;\n  logger.debug('[ServerAuth] Auth configured');\n}\n\n/**\n * Default workspace secret fetcher\n *\n * Fetches JWT secret from workspace database. This is the standard implementation\n * that works with any microservice that has access to the workspace model.\n *\n * @param workspaceId - Workspace ID from JWT\n * @returns WorkspaceSecret or null if not found\n */\nexport async function fetchWorkspaceSecret(workspaceId: string): Promise<WorkspaceSecret | null> {\n  try {\n    const db = await getDb();\n    const workspace = await db.client.workspace.findUnique({\n      where: { id: workspaceId },\n    });\n\n    if (!workspace?.jwtSecret) {\n      logger.debug('[ServerAuth] No JWT secret found for workspace', { workspaceId });\n      return null;\n    }\n\n    return JSON.parse(JSON.stringify(workspace.jwtSecret)) as WorkspaceSecret;\n  } catch (error) {\n    logger.warn('[ServerAuth] Error fetching workspace secret', { workspaceId, error });\n    return null;\n  }\n}\n\n/**\n * Configure auth with default workspace secret fetcher\n *\n * This is automatically called by createServer if no custom auth is configured.\n */\nexport function configureDefaultAuth(): void {\n  if (!authConfig) {\n    configureAuth({ fetchWorkspaceSecret });\n    logger.debug('[ServerAuth] Default auth configured with built-in workspace secret fetcher');\n  }\n}\n\n/**\n * Generate a symmetric secret key for JWT signing\n * @returns JWK object with the generated key\n */\nexport async function generateSymmetricSecret(): Promise<jose.JWK> {\n  const joseLib = await getJose();\n  const secret = await joseLib.generateSecret('HS256');\n  const jwk = await joseLib.exportJWK(secret);\n  return jwk;\n}\n\n/**\n * Verify JWT token for workspace-scoped authentication\n *\n * @param token - JWT token to verify\n * @param secret - Optional secret for verification (if not provided, fetches from workspace)\n * @param options - JWT verification options\n * @returns Verified actor information or null if invalid\n */\nexport async function verifyJWT(token: string, secret?: string, options: VerifyOptions = {}): Promise<IActor | null> {\n  try {\n    const jwt = await getJwt();\n    const joseLib = await getJose();\n\n    // Decode to check algorithm and extract workspace_id\n    const decoded = jwt.decode(token, { complete: true });\n\n    if (!decoded || typeof decoded === 'string' || !decoded.payload || typeof decoded.payload !== 'object') {\n      logger.warn('[ServerAuth] Invalid token format');\n      return null;\n    }\n\n    // For workspace-scoped HS256 tokens\n    if (secret) {\n      // Use provided secret\n      const verifiedJwt = jwt.verify(token, secret, options) as JWTPayload;\n      return mapPayloadToActor(verifiedJwt);\n    }\n\n    // Fetch secret from workspace database\n    const decodedJwt = joseLib.decodeJwt(token) as JWTPayload;\n    if (!decodedJwt.workspace_id) {\n      logger.warn('[ServerAuth] No workspace_id found in token');\n      return null;\n    }\n\n    if (!authConfig?.fetchWorkspaceSecret) {\n      logger.error('[ServerAuth] Auth not configured - call configureAuth() first');\n      return null;\n    }\n\n    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);\n    if (!workspaceSecret) {\n      logger.warn('[ServerAuth] Workspace secret not found');\n      return null;\n    }\n\n    const keyLikeSecret = await joseLib.importJWK(workspaceSecret, 'HS256');\n    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options as jose.JWTVerifyOptions);\n    return mapPayloadToActor(verifiedJwt.payload as unknown as JWTPayload);\n  } catch (err) {\n    logger.warn('[ServerAuth] Error verifying JWT:', err);\n    return null;\n  }\n}\n\n/**\n * Decode JWT without verification (for extracting claims)\n */\nexport async function decodeJWT(token: string): Promise<JWTPayload | null> {\n  try {\n    const joseLib = await getJose();\n    return await joseLib.decodeJwt(token);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Map JWT payload to IActor interface\n */\nfunction mapPayloadToActor(payload: JWTPayload): IActor {\n  return {\n    id: payload.sub,\n    type: payload.actor_type ?? 'user',\n    workspace_id: payload.workspace_id,\n    tenant_id: payload.tenant_id,\n    org_id: payload.org_id,\n    isAdmin: payload['isAdmin'] as boolean | undefined,\n  };\n}\n\n/**\n * Check if actor is authenticated\n */\nexport function authCheck(actor: IActor | null): IActor {\n  if (!actor) {\n    throw new Error('Please sign in');\n  }\n  return actor;\n}\n\n/**\n * Check workspace context and return actor ID and workspace ID\n */\nexport function workspaceCheck(context: { actor: IActor | null; workspace: { id: string } | null }): {\n  actorId: string;\n  workspaceId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  return {\n    actorId: actor.id,\n    workspaceId: context.workspace.id,\n  };\n}\n\n/**\n * Require workspace context - type narrowing guard for wspace layer services\n *\n * Validates that both actor and workspace are present in the context,\n * and returns a type-narrowed context where workspace and actor are guaranteed non-null.\n * Use this at the start of resolvers in wspace services to get typed access\n * to workspace context without optional chaining.\n *\n * @throws Error if actor is not authenticated\n * @throws Error if workspace context is missing\n *\n * @example\n * ```typescript\n * // In a resolver:\n * const ctx = requireWorkspace(context);\n * const workspaceId = ctx.workspace.id;  // no optional chaining needed\n * const actorId = ctx.actor.id;          // no optional chaining needed\n * ```\n */\nexport function requireWorkspace<T extends { actor: IActor | null; workspace: { id: string } | null }>(\n  context: T\n): T & { actor: IActor; workspace: { id: string } } {\n  // Validate actor is authenticated (throws if null)\n  authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  // Return the same context object with narrowed types\n  return context as T & { actor: IActor; workspace: { id: string } };\n}\n\n/**\n * Check organization context and return actor ID and org ID\n */\nexport function orgCheck(context: { actor: IActor | null; organization: { id: string } | null }): {\n  actorId: string;\n  orgId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.organization?.id) {\n    throw new Error('Please switch to an organization');\n  }\n\n  return {\n    actorId: actor.id,\n    orgId: context.organization.id,\n  };\n}\n\n/**\n * Check tenant context and return tenant ID\n */\nexport function tenantCheck(context: { tenant: { id: string } | null }): string {\n  if (!context.tenant?.id) {\n    throw new Error('Tenant context is required');\n  }\n  return context.tenant.id;\n}\n\n/**\n * Get effective actor ID for \"on behalf of\" tracking\n *\n * When an app or service acts with user consent, returns the delegating user's ID.\n * Otherwise returns the direct actor ID.\n *\n * This is used to determine the `onBehalfOf` field in database audit trails:\n * - If actor is user → returns user ID (self-action)\n * - If actor is app/service with consent → returns grantedBy user ID\n * - If actor is app/service without consent → returns actor ID (self-action)\n *\n * @param context - GraphQL context with actor and optional consent context\n * @returns Effective actor ID (the responsible principal)\n *\n * @example\n * ```typescript\n * // User acting directly\n * context.actor = { id: \"user-123\", type: \"user\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"user-123\"\n *\n * // Bot acting on behalf of user\n * context.actor = { id: \"bot-456\", type: \"service\" }\n * context.consentContext = { grantedBy: \"user-789\" }\n * getEffectiveActorId(context) // → \"user-789\"\n *\n * // App acting without consent (self-action)\n * context.actor = { id: \"app-abc\", type: \"app\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"app-abc\"\n * ```\n */\nexport function getEffectiveActorId(context: {\n  actor: IActor | null;\n  consentContext?: { grantedBy: string } | null;\n}): string | null {\n  if (!context.actor) {\n    return null;\n  }\n\n  // If actor is app or service acting with user consent, return the delegating user\n  if (\n    (context.actor.type === 'app' || context.actor.type === 'service' || context.actor.type === 'service_account') &&\n    context.consentContext?.grantedBy\n  ) {\n    return context.consentContext.grantedBy;\n  }\n\n  // Otherwise return the direct actor (user self-action or app/service self-action)\n  return context.actor.id;\n}\n","/**\n * Server Context Module\n *\n * Builds GraphQL context from request headers, JWT, and configuration.\n * Automatically populates actor, tenant, workspace, and tracking information.\n *\n * **Actor-Based Authentication:**\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Services verify JWT directly and build actor from payload\n *\n * Uses standard Web API Request (compatible with Bun/Elysia).\n */\n\nimport { logger } from '../logger/index.js';\nimport crypto from 'node:crypto';\nimport { verifyJWT } from './auth.js';\nimport type {\n  GraphQLContext,\n  IActor,\n  ITenant,\n  IOrganization,\n  IWorkspace,\n  IProject,\n  IProduct,\n  ITracking,\n} from './types.js';\nimport type { I18n, I18nContext } from '../i18n/index.js';\nimport { setWorkspaceContext } from '../prisma/workspace-extension.js';\n\n/**\n * Context builder options\n */\nexport interface ContextBuilderOptions {\n  /** Database getter function */\n  getDb: () => unknown;\n  /** Default tenant info (optional) */\n  defaultTenant?: ITenant;\n  /** I18n instance (optional) */\n  i18n?: I18n;\n}\n\nlet contextOptions: ContextBuilderOptions | null = null;\n\n/**\n * Configure context builder\n */\nexport function configureContext(options: ContextBuilderOptions): void {\n  contextOptions = options;\n  logger.debug('[ServerContext] Context builder configured');\n}\n\n/**\n * Extract header value from standard Web API Request\n */\nfunction getHeader(request: Request, key: string): string | undefined {\n  return request.headers.get(key.toLowerCase()) ?? undefined;\n}\n\nfunction compareSecret(provided: string, expected: string): boolean {\n  const providedBuffer = Buffer.from(provided);\n  const expectedBuffer = Buffer.from(expected);\n\n  if (providedBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);\n}\n\nexport function shouldTrustActorHeaders(\n  request: Request,\n  nodeEnv: string | undefined = process.env['NODE_ENV'],\n  expectedGatewayToken: string | undefined = process.env['TRUSTED_GATEWAY_TOKEN'] ??\n    process.env['INTERNAL_SERVICE_TOKEN']\n): boolean {\n  if (!getHeader(request, 'x-actor-id')) {\n    return false;\n  }\n\n  if (nodeEnv === 'production') {\n    return true;\n  }\n\n  const providedGatewayToken =\n    getHeader(request, 'x-internal-service-token') || getHeader(request, 'x-gateway-auth-token');\n  if (!expectedGatewayToken || !providedGatewayToken) {\n    return false;\n  }\n\n  return compareSecret(providedGatewayToken, expectedGatewayToken);\n}\n\n/**\n * Extract tracking information from request\n */\nfunction extractTracking(request: Request): ITracking {\n  // Get IP from various possible headers\n  const forwardedFor = getHeader(request, 'x-forwarded-for');\n  const realIp = getHeader(request, 'x-real-ip');\n  const ip = forwardedFor?.split(',')[0]?.trim() || realIp || undefined;\n\n  return {\n    ip,\n    userAgent: getHeader(request, 'user-agent'),\n  };\n}\n\n/**\n * Extract actor from gateway-injected headers or authorization header\n *\n * **Actor-Based Authentication:**\n * - If x-actor-id header exists, trust it (gateway-authenticated)\n * - Otherwise fall back to JWT verification (direct access in dev)\n *\n * This allows:\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Direct service access with JWT → service verifies JWT itself\n * - Development testing: Direct headers → service trusts headers\n */\nasync function extractActor(request: Request): Promise<IActor | null> {\n  // Check for gateway-injected actor headers first\n  const actorId = getHeader(request, 'x-actor-id');\n\n  if (actorId && shouldTrustActorHeaders(request)) {\n    // Gateway has already verified JWT and populated context headers\n    // Trust the headers (gateway is the security perimeter)\n    logger.debug('[ServerContext] Using gateway-authenticated actor from headers');\n\n    const actorType = getHeader(request, 'x-actor-type') || 'user';\n    const userRole = getHeader(request, 'x-user-role');\n\n    return {\n      id: actorId,\n      type: actorType,\n      workspace_id: getHeader(request, 'x-workspace-id'),\n      tenant_id: getHeader(request, 'x-tenant-id'),\n      org_id: getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id'),\n      isAdmin:\n        actorType === 'super_admin' ||\n        userRole === 'TENANT_ADMIN' ||\n        userRole === 'SUPER_ADMIN' ||\n        userRole === 'PLATFORM_ADMIN',\n    };\n  }\n\n  if (actorId) {\n    logger.warn('[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification');\n  }\n\n  // FALLBACK: No gateway headers, verify JWT directly (dev/testing mode)\n  const authHeader = getHeader(request, 'authorization');\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.substring(7);\n\n  try {\n    logger.debug('[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)');\n    const payload = await verifyJWT(token);\n\n    if (!payload) {\n      return null;\n    }\n\n    // Build actor from JWT payload\n    return {\n      id: payload.id,\n      type: 'user', // Default to 'user' if not specified\n      workspace_id: payload.workspace_id,\n    };\n  } catch (error) {\n    logger.warn('[ServerContext] Invalid JWT token:', error);\n    return null;\n  }\n}\n\n/**\n * Extract tenant from headers\n */\nfunction extractTenant(request: Request): ITenant | null {\n  // Check headers\n  const tenantId = getHeader(request, 'x-tenant-id');\n  const tenantEndpoint = getHeader(request, 'x-tenant-endpoint');\n\n  if (tenantId) {\n    return {\n      id: tenantId,\n      endpoint: tenantEndpoint || '',\n    };\n  }\n\n  // Fall back to default tenant if configured\n  return contextOptions?.defaultTenant || null;\n}\n\n/**\n * Extract organization from headers\n */\nfunction extractOrganization(request: Request): IOrganization | null {\n  const orgId = getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id');\n\n  if (orgId) {\n    return { id: orgId };\n  }\n\n  return null;\n}\n\n/**\n * Extract workspace from headers or actor\n */\nfunction extractWorkspace(request: Request, actor: IActor | null): IWorkspace | null {\n  // Check headers first\n  const workspaceId = getHeader(request, 'x-workspace-id');\n\n  if (workspaceId) {\n    return { id: workspaceId };\n  }\n\n  // Fall back to workspace_id from actor\n  if (actor?.workspace_id) {\n    return { id: actor.workspace_id };\n  }\n\n  return null;\n}\n\n/**\n * Extract project from headers\n */\nfunction extractProject(request: Request): IProject | null {\n  const projectId = getHeader(request, 'x-project-id');\n\n  if (projectId) {\n    return { id: projectId };\n  }\n\n  return null;\n}\n\n/**\n * Extract product from headers\n */\nfunction extractProduct(request: Request): IProduct | null {\n  const productId = getHeader(request, 'x-product-id');\n\n  if (productId) {\n    return { id: productId };\n  }\n\n  return null;\n}\n\n/**\n * Extract geography context from headers\n *\n * Geography headers carry the user's selected location context,\n * used for currency defaults, tax calculations, payment routing,\n * data residency, and regional support.\n *\n * Headers:\n * - x-geo-country: ISO 3166-1 alpha-2 country code (e.g., 'IN', 'US', 'DE')\n * - x-geo-currency: ISO 4217 currency code (e.g., 'INR', 'USD', 'EUR')\n * - x-geo-timezone: IANA timezone (e.g., 'Asia/Kolkata', 'America/New_York')\n */\nfunction extractGeography(request: Request): { country?: string; currency?: string; timezone?: string } {\n  const country = getHeader(request, 'x-geo-country');\n  const currency = getHeader(request, 'x-geo-currency');\n  const timezone = getHeader(request, 'x-geo-timezone');\n\n  return {\n    country: country?.toUpperCase() || undefined,\n    currency: currency?.toUpperCase() || undefined,\n    timezone: timezone || undefined,\n  };\n}\n\n/**\n * Extract consent context from headers\n *\n * When an app or service acts on behalf of a user (with user consent),\n * the gateway forwards consent headers. This function extracts them.\n *\n * Headers:\n * - x-consent-granted-by: Actor ID who granted consent (delegating user)\n * - x-consent-scope: Comma-separated scopes\n * - x-consent-granted-at: ISO timestamp when consent was granted\n * - x-consent-expires-at: ISO timestamp when consent expires\n */\nfunction extractConsentContext(request: Request): import('./types.js').ConsentContext | null {\n  const grantedBy = getHeader(request, 'x-consent-granted-by');\n\n  // If no grantedBy, there's no consent delegation\n  if (!grantedBy) {\n    return null;\n  }\n\n  const scopesHeader = getHeader(request, 'x-consent-scope');\n  const grantedAtHeader = getHeader(request, 'x-consent-granted-at');\n  const expiresAtHeader = getHeader(request, 'x-consent-expires-at');\n\n  return {\n    grantedBy,\n    scopes: scopesHeader ? scopesHeader.split(',').map((s) => s.trim()) : undefined,\n    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : undefined,\n    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : undefined,\n  };\n}\n\n/**\n * Build GraphQL context from standard Web Request\n *\n * Also sets the workspace context in AsyncLocalStorage for automatic\n * Prisma workspaceId injection via the workspace extension.\n */\nexport async function buildContext(request: Request): Promise<GraphQLContext> {\n  if (!contextOptions) {\n    throw new Error('[ServerContext] Context not configured - call configureContext() first');\n  }\n\n  // Extract actor from headers/JWT\n  const actor = await extractActor(request);\n\n  // Extract all context parts\n  const tenant = extractTenant(request);\n  const organization = extractOrganization(request);\n  const workspace = extractWorkspace(request, actor);\n  const project = extractProject(request);\n  const product = extractProduct(request);\n  const tracking = extractTracking(request);\n  const consentContext = extractConsentContext(request);\n\n  // Build i18n context if configured\n  let i18n: I18nContext | undefined;\n  if (contextOptions.i18n) {\n    i18n = contextOptions.i18n.createContextFromRequest(request);\n  }\n\n  // Merge geography context from x-geo-* headers into i18n\n  const geo = extractGeography(request);\n  if (geo.country || geo.currency || geo.timezone) {\n    if (i18n) {\n      // Merge geography fields into existing i18n context\n      if (geo.country) i18n.country = geo.country;\n      if (geo.currency) i18n.currency = geo.currency;\n      if (geo.timezone) i18n.timezone = geo.timezone;\n    } else {\n      // Create minimal i18n context with geography only (when i18n module not configured)\n      i18n = {\n        locale: 'en-US',\n        language: 'en',\n        country: geo.country,\n        currency: geo.currency,\n        timezone: geo.timezone,\n        t: (key: string) => key,\n        tp: (key: string) => key,\n        formatNumber: (value: number) => String(value),\n        formatCurrency: (value: number, currency: string) => `${currency} ${value}`,\n        formatDate: (date: Date | string) => String(date),\n        formatRelativeTime: (value: number, unit: Intl.RelativeTimeFormatUnit) => `${value} ${unit}`,\n      };\n    }\n  }\n\n  // Determine onBehalfOf for audit trails\n  // If actor is app/service with consent → use grantedBy (delegating user)\n  // Otherwise → use actor.id (self-action)\n  const onBehalfOf =\n    (actor?.type === 'app' || actor?.type === 'service' || actor?.type === 'service_account') &&\n    consentContext?.grantedBy\n      ? consentContext.grantedBy\n      : actor?.id;\n\n  // Set workspace context in AsyncLocalStorage for Prisma workspace extension\n  // This enables automatic workspaceId injection on create/update operations\n  const wsCtxPayload = {\n    workspaceId: workspace?.id,\n    tenantId: tenant?.id,\n    actorId: actor?.id,\n    actorType: actor?.type,\n    organizationId: organization?.id,\n    projectId: project?.id,\n    onBehalfOf,\n  };\n\n  logger.debug('[ServerContext] Setting workspace context', {\n    workspaceId: wsCtxPayload.workspaceId ?? 'NONE',\n    actorId: wsCtxPayload.actorId ?? 'NONE',\n    rawHeader: getHeader(request, 'x-workspace-id') ?? 'MISSING',\n  });\n\n  setWorkspaceContext(wsCtxPayload);\n\n  return {\n    request,\n    actor,\n    tenant,\n    organization,\n    workspace,\n    project,\n    product,\n    tracking,\n    consentContext: consentContext || undefined,\n    onBehalfOf: onBehalfOf || actor?.id || '',\n    db: contextOptions.getDb(),\n    i18n,\n    responseHeaders: new Headers(),\n  };\n}\n\n/**\n * Get context options\n */\nexport function getContextOptions(): ContextBuilderOptions | null {\n  return contextOptions;\n}\n","import type { IActor } from './types.js';\n\nconst LOCALHOST_ORIGINS = [\n  'http://localhost:3000',\n  'http://localhost:4000',\n  'http://localhost:5173',\n  'http://127.0.0.1:3000',\n  'http://127.0.0.1:4000',\n  'http://127.0.0.1:5173',\n];\n\nexport function normalizeCorsOrigins(\n  origins: string | string[] | undefined,\n  environment: 'development' | 'staging' | 'production' | undefined\n): string[] {\n  const normalized = (Array.isArray(origins) ? origins : origins?.split(',') || [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\n  if (normalized.length === 0) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  if (normalized.includes('*')) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  return normalized;\n}\n\nexport function resolveAllowedCorsOrigin(requestOrigin: string | null, allowedOrigins: string[]): string | null {\n  if (!requestOrigin) {\n    return allowedOrigins[0] ?? null;\n  }\n\n  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;\n}\n\nexport function canAccessGraphExport(actor: IActor | null): boolean {\n  if (!actor) {\n    return false;\n  }\n\n  return actor.isAdmin === true || ['service', 'super_admin'].includes(actor.type);\n}\n","/**\n * Server Module\n *\n * Main server bootstrapping with Elysia, GraphQL Yoga, and middleware.\n * Uses Bun runtime for high-performance GraphQL services.\n *\n * Provides a simple API for microservices to start a fully configured server.\n */\n\nimport { logger } from '../logger/index.js';\nimport { configureAuth, configureDefaultAuth, type FetchWorkspaceSecretFn } from './auth.js';\nimport { configureContext, buildContext } from './context.js';\nimport type {\n  ServerDefinition,\n  ServerInstance,\n  ServerInfo,\n  ElysiaApp,\n  BunServerHandle,\n  YogaPlugin,\n  GraphQLContext,\n} from './types.js';\nimport { I18n } from '../i18n/index.js';\nimport { canAccessGraphExport, normalizeCorsOrigins, resolveAllowedCorsOrigin } from './security.js';\n\n// Store startup time for uptime calculation\nlet serverStartTime: Date | null = null;\n\n/**\n * Create and configure a server instance using Elysia + GraphQL Yoga\n */\nexport async function createServer(definition: ServerDefinition): Promise<ServerInstance> {\n  const {\n    config,\n    prismaClient,\n    schema,\n    moduleGraph,\n    restEndpoints,\n    yogaPlugins,\n    buildContext: customBuildContext,\n    workspaceExtensionConfig,\n    disableWorkspaceExtension,\n    onShutdown,\n  } = definition;\n\n  // Dynamic imports to avoid requiring these as hard dependencies\n  const { Elysia } = await import('elysia');\n  const { BunAdapter } = await import('elysia/adapter/bun');\n  const { cors } = await import('@elysiajs/cors');\n  const { createYoga } = await import('graphql-yoga');\n  const { initializeDatabase, getDb, getDatabaseManager } = await import('../prisma/index.js');\n  const { createSecurityPlugin } = await import('../middleware/index.js');\n  const { createMetricsPlugin } = await import('../observability/index.js');\n  const { createWorkspaceGuardPlugin } = await import('./workspace-guard.js');\n\n  logger.info(`[Server] Initializing ${config.serviceName}...`);\n\n  // Detect boundary from config or service name — needed before database and guard setup\n  const boundary =\n    config.boundary ??\n    (config.serviceName.startsWith('wspace-')\n      ? 'wspace'\n      : config.serviceName.startsWith('global-')\n        ? 'global'\n        : 'wspace'); // fail-closed: default to wspace (stricter)\n\n  // Initialize database\n  // Workspace extension is auto-disabled for global boundary services unless explicitly enabled\n  const shouldEnableWorkspaceExtension =\n    disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === 'wspace'; // auto-detect: enabled for wspace, disabled for global\n\n  logger.info('[Server] Initializing database...', {\n    boundary,\n    workspaceExtension: shouldEnableWorkspaceExtension,\n  });\n\n  const { connect } = initializeDatabase(prismaClient, config.serviceName, {\n    registerShutdownHandlers: false, // Server manages shutdown handlers itself\n    enableWorkspaceExtension: shouldEnableWorkspaceExtension,\n    ...(workspaceExtensionConfig ? { workspaceExtensionConfig } : {}),\n  });\n  await connect();\n\n  // Initialize i18n if configured\n  let i18nInstance: I18n | undefined;\n  if (config.i18n?.enabled && config.i18n.localesPath) {\n    logger.info('[Server] Initializing i18n...');\n    i18nInstance = new I18n({\n      defaultLocale: config.i18n.defaultLocale || 'en-US',\n      fallbackLocale: config.i18n.fallbackLocale || 'en-US',\n      localesPath: config.i18n.localesPath,\n      supportedLocales: config.i18n.supportedLocales,\n      namespace: config.i18n.namespace || config.serviceName,\n      lazyLoad: config.i18n.lazyLoad,\n      logMissing: config.i18n.logMissing ?? true,\n      enableCache: true,\n      returnKeyOnMissing: true,\n    });\n    await i18nInstance.initialize();\n    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(', ')}`);\n  }\n\n  // Configure context builder\n  configureContext({\n    getDb: () => getDb(),\n    i18n: i18nInstance,\n  });\n\n  // Auto-configure auth with default workspace secret fetcher if not already configured\n  configureDefaultAuth();\n\n  // Initialize module graph if provided\n  if (moduleGraph) {\n    logger.info('[Server] Initializing module graph...');\n    await moduleGraph.initialize();\n  }\n\n  // Determine if playground/introspection should be enabled\n  const isDev = config.environment !== 'production';\n  const enablePlayground = config.enablePlayground ?? isDev;\n\n  // Build workspace guard plugin — auto-enabled for wspace boundary only\n  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === 'wspace';\n  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? 'enabled' : 'disabled'}`);\n\n  const workspaceGuardPlugins = workspaceGuardEnabled\n    ? [\n        createWorkspaceGuardPlugin({\n          enabled: true,\n          whitelistedOperations: config.workspaceGuard?.whitelistedOperations,\n        }),\n      ]\n    : [];\n\n  // Create GraphQL Yoga instance\n  const graphqlEndpoint = config.graphqlEndpoint || '/graphql';\n  logger.info('[Server] Setting up GraphQL Yoga with provided schema...');\n\n  const responseHeadersPlugin: YogaPlugin = {\n    onResponse: ({ response, serverContext }: { response: Response; serverContext: unknown }) => {\n      const yogaContext = serverContext as GraphQLContext;\n      if (yogaContext?.responseHeaders) {\n        yogaContext.responseHeaders.forEach((value: string, key: string) => {\n          response.headers.append(key, value);\n        });\n      }\n    },\n  };\n\n  const yoga = createYoga<{ request: Request }>({\n    graphqlEndpoint,\n    schema, // Use the schema provided by microservice\n    graphiql: enablePlayground,\n    logging: {\n      debug: (...args) => logger.debug('[GraphQL]', ...args),\n      info: (...args) => logger.info('[GraphQL]', ...args),\n      warn: (...args) => logger.warn('[GraphQL]', ...args),\n      error: (...args) => logger.error('[GraphQL]', ...args),\n    },\n    plugins: [...workspaceGuardPlugins, responseHeadersPlugin, ...(yogaPlugins || [])],\n    context: async ({ request }) => {\n      // Build default context\n      const defaultContext = await buildContext(request);\n\n      // Apply custom context builder if provided\n      if (customBuildContext) {\n        return customBuildContext(defaultContext);\n      }\n\n      return defaultContext;\n    },\n  });\n\n  // Create Elysia instance with Bun adapter\n  const app = new Elysia({ adapter: BunAdapter });\n\n  // Register CORS middleware\n  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);\n\n  app.use(\n    cors({\n      origin: corsOrigins,\n      credentials: corsOrigins.length > 0,\n      allowedHeaders: [\n        'Content-Type',\n        'Authorization',\n        'X-Tenant-ID',\n        'X-Workspace-ID',\n        'X-Org-ID',\n        'X-Project-ID',\n        'X-Product-ID',\n        'X-CSRF-Token',\n        'X-Service-Name',\n        'Accept-Language',\n        'X-Locale',\n        'X-Language',\n        'X-Geo-Country',\n        'X-Geo-Currency',\n        'X-Geo-Timezone',\n        // Actor headers (gateway-injected or dev mode)\n        'X-Actor-ID',\n        'X-Actor-Type',\n        'X-Internal-Service-Token',\n        'X-Gateway-Auth-Token',\n      ],\n      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n    })\n  );\n\n  // Collect raw body endpoints for early interception\n  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);\n  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [ep.path, ep]));\n  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {\n    const regexPattern = endpoint.path.replace(/:[^/]+/g, '[^/]+');\n    return {\n      endpoint,\n      regexPattern,\n      regex: new RegExp(`^${regexPattern}$`),\n    };\n  });\n\n  // Helper to match pathname against endpoint patterns (including :param placeholders)\n  const matchRawBodyEndpoint = (pathname: string): (typeof rawBodyEndpoints)[0] | undefined => {\n    // First try exact match (for non-parameterized paths)\n    const exactMatch = rawBodyPaths.get(pathname);\n    if (exactMatch) return exactMatch;\n\n    // Try pattern matching for parameterized paths like /webhooks/slack/:channelId\n    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {\n      const isMatch = regex.test(pathname);\n      logger.debug(\n        `[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`\n      );\n      if (isMatch) {\n        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);\n        return endpoint;\n      }\n    }\n\n    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);\n    return undefined;\n  };\n\n  // Handle GraphQL, metrics, and raw body requests BEFORE any middleware that consumes the body\n  // This is critical because Yoga needs the raw request body stream\n  // and webhook endpoints need raw body for signature verification\n  // onRequest runs before onParse (body parsing) and onBeforeHandle\n  app.onRequest(async ({ request }) => {\n    const url = new URL(request.url);\n    const pathname = url.pathname;\n    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);\n    const isHealthRoute = pathname === '/health' || pathname.startsWith('/health/');\n\n    // Build CORS headers helper\n    const buildCorsHeaders = (): Record<string, string> => {\n      const origin = request.headers.get('origin') || '*';\n      const allowedOrigin = resolveAllowedCorsOrigin(origin === '*' ? null : origin, corsOrigins);\n      const headers: Record<string, string> = {\n        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n        'Access-Control-Allow-Headers':\n          'Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token',\n      };\n\n      if (allowedOrigin) {\n        headers['Access-Control-Allow-Origin'] = allowedOrigin;\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n\n      return headers;\n    };\n\n    // Check if this is a raw body endpoint (webhooks) - now supports parameterized paths\n    const rawBodyEndpoint = isHealthRoute ? undefined : matchRawBodyEndpoint(pathname);\n    if (rawBodyEndpoint) {\n      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight for raw body endpoints\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Only process if method matches\n      if (request.method !== rawBodyEndpoint.method) {\n        return undefined; // Let other handlers deal with it\n      }\n\n      try {\n        // Read raw body BEFORE any parsing\n        const rawBody = await request.text();\n\n        // Build context without consuming body (body already read)\n        const context = await buildContext(request);\n\n        // Call the handler with raw body\n        const result = await rawBodyEndpoint.handler(request, context, rawBody);\n\n        // If handler returns a Response, use it directly\n        if (result instanceof Response) {\n          // Add CORS headers\n          const headers = new Headers(result.headers);\n          for (const [key, value] of Object.entries(corsHeaders)) {\n            headers.set(key, value);\n          }\n          return new Response(result.body, {\n            status: result.status,\n            statusText: result.statusText,\n            headers,\n          });\n        }\n\n        // Otherwise, serialize as JSON\n        const headers = new Headers({\n          'Content-Type': 'application/json',\n          ...corsHeaders,\n        });\n\n        return new Response(JSON.stringify(result), {\n          status: 200,\n          headers,\n        });\n      } catch (error) {\n        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);\n        const corsHeaders = buildCorsHeaders();\n        return new Response(\n          JSON.stringify({\n            error: error instanceof Error ? error.message : 'Internal server error',\n          }),\n          {\n            status: 500,\n            headers: {\n              'Content-Type': 'application/json',\n              ...corsHeaders,\n            },\n          }\n        );\n      }\n    }\n\n    // Serve Prometheus metrics via prom-client at /metrics.\n    // The graphql-yoga prometheus plugin populates the same default registry,\n    // so GraphQL-level metrics (operation durations, error counts, etc.) are\n    // included automatically without needing Yoga to handle this route.\n    if (pathname === '/metrics' && request.method === 'GET') {\n      try {\n        const promClientMod = 'prom-client';\n        const prom = (await import(promClientMod)) as unknown as {\n          register: { metrics: () => Promise<string> | string; contentType?: string };\n          collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n        };\n        try {\n          prom.collectDefaultMetrics({ register: prom.register });\n        } catch {\n          /* already called */\n        }\n        const body = await prom.register.metrics();\n        return new Response(body, {\n          status: 200,\n          headers: {\n            'Content-Type': prom.register.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n          },\n        });\n      } catch {\n        // fall through — prom-client not installed; let Yoga handle as fallback\n      }\n    }\n\n    // Routes that should be handled by Yoga (GraphQL endpoint only)\n    const yogaRoutes = [graphqlEndpoint, `${graphqlEndpoint}/`, '/metrics'];\n    const shouldHandleByYoga = yogaRoutes.includes(pathname);\n\n    if (shouldHandleByYoga) {\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Get response from Yoga\n      const yogaResponse = await yoga.fetch(request);\n\n      // Add CORS headers to Yoga response\n      const headers = new Headers(yogaResponse.headers);\n      for (const [key, value] of Object.entries(corsHeaders)) {\n        headers.set(key, value);\n      }\n\n      // Return response with CORS headers\n      return new Response(yogaResponse.body, {\n        status: yogaResponse.status,\n        statusText: yogaResponse.statusText,\n        headers,\n      });\n    }\n    // Return undefined to continue to next handlers for non-GraphQL requests\n    return undefined;\n  });\n\n  // Register metrics middleware (after GraphQL interception)\n  app.use(createMetricsPlugin());\n\n  // Register security middleware (after GraphQL interception)\n  app.use(\n    createSecurityPlugin({\n      csrfSkipRoutes: config.csrfSkipRoutes || ['/graphql', '/health', '/api/graph/'],\n      loginEndpoints: config.loginEndpoints || [],\n      enableCSRF: config.enableCSRF ?? false, // Disabled by default for GraphQL services\n      enableSessionSecurity: config.enableSessionSecurity ?? false,\n    })\n  );\n\n  // Health check endpoints\n  // /health - General health check\n  // /health/live - Kubernetes liveness probe\n  // /health/ready - Kubernetes readiness probe\n  // /health/startup - Kubernetes startup probe\n  const healthResponse = () => ({\n    status: 'healthy',\n    service: config.serviceName,\n    version: config.serviceVersion || '1.0.0',\n    timestamp: new Date().toISOString(),\n  });\n\n  app.get('/health', healthResponse);\n  app.get('/health/live', healthResponse);\n  app.get('/health/ready', healthResponse);\n  app.get('/health/startup', healthResponse);\n\n  // Graph API endpoints (if moduleGraph provided)\n  if (moduleGraph) {\n    // Get graph configuration schema\n    app.get('/api/graph/schema', async ({ request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      return moduleGraph.getSchema();\n    });\n\n    // Export all graph data\n    app.get('/api/graph/export', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportAll(organizationId, workspaceId);\n    });\n\n    // Export entities only\n    app.get('/api/graph/entities', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId, types } = query as {\n        organizationId?: string;\n        workspaceId?: string;\n        types?: string;\n      };\n      const entityTypes = types?.split(',').map((t) => t.trim());\n      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);\n    });\n\n    // Export relationships only\n    app.get('/api/graph/relationships', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportRelationships(organizationId, workspaceId);\n    });\n  }\n\n  // Register custom REST endpoints (skip rawBody endpoints - they're handled in onRequest)\n  if (restEndpoints && restEndpoints.length > 0) {\n    for (const endpoint of restEndpoints) {\n      // Skip rawBody endpoints - they're intercepted in onRequest before body parsing\n      if (endpoint.rawBody) {\n        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);\n        continue;\n      }\n\n      const handler = async ({ request }: { request: Request }): Promise<unknown> => {\n        const context = await buildContext(request);\n        return endpoint.handler(request, context);\n      };\n\n      switch (endpoint.method) {\n        case 'GET':\n          app.get(endpoint.path, handler);\n          break;\n        case 'POST':\n          app.post(endpoint.path, handler);\n          break;\n        case 'PUT':\n          app.put(endpoint.path, handler);\n          break;\n        case 'PATCH':\n          app.patch(endpoint.path, handler);\n          break;\n        case 'DELETE':\n          app.delete(endpoint.path, handler);\n          break;\n      }\n    }\n  }\n\n  const host = config.host || '0.0.0.0';\n  const port = config.port;\n\n  // Create server instance\n  const serverInstance: ServerInstance = {\n    app: app as unknown as ElysiaApp,\n    server: null,\n    start: async () => {\n      serverStartTime = new Date();\n\n      // Call listen() which starts the server and makes app.server available\n      app.listen({\n        port,\n        hostname: host,\n      });\n\n      // Access the Bun server instance from the app\n      // Cast through unknown to satisfy TypeScript since Elysia's types are complex\n      const elysiaApp = app as unknown as { server: BunServerHandle | null };\n      serverInstance.server = elysiaApp.server;\n\n      logger.info(`🚀 ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);\n    },\n    stop: async () => {\n      logger.info(`[Server] Stopping ${config.serviceName}...`);\n\n      if (onShutdown) {\n        await onShutdown();\n      }\n\n      if (moduleGraph) {\n        await moduleGraph.shutdown();\n      }\n\n      await getDatabaseManager().disconnect();\n\n      if (serverInstance.server) {\n        serverInstance.server.stop();\n      }\n\n      logger.info(`[Server] ${config.serviceName} stopped`);\n    },\n    getInfo: (): ServerInfo => {\n      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1000) : 0;\n\n      return {\n        serviceName: config.serviceName,\n        serviceVersion: config.serviceVersion || '1.0.0',\n        environment: config.environment || 'development',\n        port,\n        host,\n        graphqlEndpoint,\n        startedAt: serverStartTime?.toISOString() || '',\n        uptime,\n      };\n    },\n  };\n\n  // Setup graceful shutdown handlers\n  const gracefulShutdown = async (signal: string): Promise<never> => {\n    logger.info(`[Server] ${signal} received, shutting down gracefully...`);\n    await serverInstance.stop();\n    process.exit(0);\n  };\n\n  process.on('SIGTERM', () => {\n    void gracefulShutdown('SIGTERM');\n  });\n  process.on('SIGINT', () => {\n    void gracefulShutdown('SIGINT');\n  });\n\n  return serverInstance;\n}\n\n/**\n * Configure auth with workspace secret fetcher\n *\n * This should be called before creating the server if using workspace-scoped JWT\n */\nexport function configureServerAuth(fetchWorkspaceSecret: FetchWorkspaceSecretFn): void {\n  configureAuth({ fetchWorkspaceSecret });\n}\n"]}

package/dist/telemetry/index.js

@@ -1,6 +1,7 @@
-export { DEFAULT_REDACT_PATHS, createPinoLogger } from '../chunk-SNEOLWXT.js';
-import { setActiveTelemetryLogger, setupInstrumentation } from '../chunk-4XAEES25.js';
-export { initializeInstrumentation, setupInstrumentation } from '../chunk-4XAEES25.js';
+export { DEFAULT_REDACT_PATHS, createPinoLogger } from '../chunk-E5USZ2MR.js';
+import { setActiveTelemetryLogger, setupInstrumentation } from '../chunk-ACYGOENW.js';
+export { initializeInstrumentation, setupInstrumentation } from '../chunk-ACYGOENW.js';
+import '../chunk-REF7PANB.js';
 import { redactSensitiveFields, logger } from '../chunk-CBZNP6RF.js';
 import { __name } from '../chunk-XE4OXN2W.js';
 
@@ -131,7 +132,7 @@ async function bootstrapTelemetry(cfg) {
   const serviceVersion = resolveVersion(cfg.serviceVersion);
   const otlpEndpoint = resolveEndpoint(cfg.otlpEndpoint);
   const sampleRatio = resolveSampling(cfg.sampleRatio, env);
-  const { createPinoLogger: createPinoLogger2 } = await import('../pino-logger-RYLGXPHZ.js');
+  const { createPinoLogger: createPinoLogger2 } = await import('../pino-logger-NVZXQPWO.js');
   const logger2 = await createPinoLogger2({
     serviceName: cfg.serviceName,
     env,
@@ -153,7 +154,7 @@ async function bootstrapTelemetry(cfg) {
   let otelSdk;
   if (resolveOtelSdkEnabled()) {
     try {
-      const { createOtelSdk } = await import('../sdk-THO3IWEE.js');
+      const { createOtelSdk } = await import('../sdk-UWFH5PY7.js');
       otelSdk = await createOtelSdk({
         serviceName: cfg.serviceName,
         serviceVersion,

package/dist/telemetry/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/telemetry/health.ts","../../src/telemetry/metrics-endpoint.ts","../../src/telemetry/prisma-logging.ts","../../src/telemetry/index.ts"],"names":["createHealthRoutes","_deps","Proxy","get","_target","prop","undefined","loadDefaultRegistry","mod","collectDefaultMetrics","register","createMetricsRoutesImpl","app","opts","path","ctx","registry","ctxWithSet","set","status","headers","contentType","metrics","createMetricsRoutes","createPrismaLoggingExtension","logger","name","query","$allOperations","model","operation","args","start","Date","now","result","debug","duration_ms","redactSensitiveFields","err","error","Error","message","String","resolveEnv","explicit","fromEnv","process","env","resolveVersion","resolveEndpoint","proto","resolveSampling","Number","isFinite","Math","min","max","parsed","resolveOtelSdkEnabled","sdkDisabled","otelEnabled","bootstrapTelemetry","cfg","serviceVersion","otlpEndpoint","sampleRatio","createPinoLogger","serviceName","version","setActiveTelemetryLogger","instrumentation","setupInstrumentation","tracing","samplingRate","otelSdk","createOtelSdk","boundary","module","info","metricsEnabled","metricsDropReason","warn","reason","shutdown","defaultLogger","setLevel","getLevel"],"mappings":";;;;;;;AAmFO,SAASA,kBAAAA,CAAmBC,KAAAA,GAAoB,EAAC,EAAC;AAEvD,EAAA,OAAO,IAAIC,KAAAA,CACT,EAAC,EACD;AACEC,IAAAA,GAAAA,CAAIC,SAASC,IAAAA,EAAI;AAIf,MAAA,IAAIA,IAAAA,KAAS,KAAA,IAASA,IAAAA,KAAS,MAAA,EAAQ,OAAOC,MAAAA;AAC9C,MAAA,OAAOA,MAAAA;AACT,IAAA;GACF,CAAA;AAEJ;AAdgBN,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;;;ACnEhB,eAAsBO,mBAAAA,GAAAA;AACpB,EAAA,IAAI;AACF,IAAA,MAAMC,GAAAA,GAAO,MAAM,OAAO,aAAA,CAAA;AAK1B,IAAA,IAAI;AACFA,MAAAA,GAAAA,CAAIC,qBAAAA,CAAsB;AAAEC,QAAAA,QAAAA,EAAUF,GAAAA,CAAIE;OAAS,CAAA;IACrD,CAAA,CAAA,MAAQ;AAER,IAAA;AACA,IAAA,OAAOF,GAAAA,CAAIE,QAAAA;EACb,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAhBsBH,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAkBf,SAASI,uBAAAA,CAIdC,GAAAA,EAAUC,IAAAA,GAA4B,EAAC,EAAC;AACxC,EAAA,MAAMC,IAAAA,GAAOD,KAAKC,IAAAA,IAAQ,UAAA;AAE1BF,EAAAA,GAAAA,CAAIT,GAAAA,CAAIW,IAAAA,EAAM,OAAOC,GAAAA,KAAAA;AACnB,IAAA,MAAMC,QAAAA,GAAWH,IAAAA,CAAKG,QAAAA,IAAa,MAAMT,mBAAAA,EAAAA;AACzC,IAAA,MAAMU,UAAAA,GAAaF,GAAAA;AACnB,IAAA,IAAI,CAACC,QAAAA,EAAU;AACb,MAAA,IAAIC,UAAAA,CAAWC,GAAAA,EAAKD,UAAAA,CAAWC,GAAAA,CAAIC,MAAAA,GAAS,GAAA;AAC5C,MAAA,OAAO,+BAAA;AACT,IAAA;AACA,IAAA,IAAIF,WAAWC,GAAAA,EAAK;AAClBD,MAAAA,UAAAA,CAAWC,IAAIC,MAAAA,GAAS,GAAA;AACxBF,MAAAA,UAAAA,CAAWC,IAAIE,OAAAA,GAAU;AACvB,QAAA,cAAA,EAAgBJ,SAASK,WAAAA,IAAe;AAC1C,OAAA;AACF,IAAA;AACA,IAAA,OAAOL,SAASM,OAAAA,EAAO;EACzB,CAAA,CAAA;AAEA,EAAA,OAAOV,GAAAA;AACT;AAxBgBD,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA8BT,SAASY,mBAAAA,CAAoBV,IAAAA,GAA4B,EAAC,EAAC;AAChE,EAAA,OAAO,CAACD,GAAAA,KAAgED,uBAAAA,CAAwBC,GAAAA,EAAKC,IAAAA,CAAAA;AACvG;AAFgBU,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;;;ACtCT,SAASC,6BAA6BC,OAAAA,EAAc;AAMzD,EAAA,OAAO;IACLC,IAAAA,EAAM,wBAAA;IACNC,KAAAA,EAAO;AACL,MAAA,MAAMC,eAAe,EAAEC,KAAAA,EAAOC,SAAAA,EAAWC,IAAAA,EAAMJ,OAAK,EAAmB;AACrE,QAAA,MAAMK,KAAAA,GAAQC,KAAKC,GAAAA,EAAG;AACtB,QAAA,IAAI;AACF,UAAA,MAAMC,MAAAA,GAAS,MAAMR,KAAAA,CAAMI,IAAAA,CAAAA;AAC3BN,UAAAA,OAAAA,CAAOW,MAAM,cAAA,EAAgB;AAC3BP,YAAAA,KAAAA;AACAC,YAAAA,SAAAA;YACAO,WAAAA,EAAaJ,IAAAA,CAAKC,KAAG,GAAKF,KAAAA;AAC1BD,YAAAA,IAAAA,EAAMO,sBAAsBP,IAAAA;WAC9B,CAAA;AACA,UAAA,OAAOI,MAAAA;AACT,QAAA,CAAA,CAAA,OAASI,GAAAA,EAAK;AACZd,UAAAA,OAAAA,CAAOe,MAAM,cAAA,EAAgB;AAC3BX,YAAAA,KAAAA;AACAC,YAAAA,SAAAA;YACAO,WAAAA,EAAaJ,IAAAA,CAAKC,KAAG,GAAKF,KAAAA;AAC1BQ,YAAAA,KAAAA,EAAOD,GAAAA,YAAeE,KAAAA,GAAQF,GAAAA,CAAIG,OAAAA,GAAUC,OAAOJ,GAAAA;WACrD,CAAA;AACA,UAAA,MAAMA,GAAAA;AACR,QAAA;AACF,MAAA;AACF;AACF,GAAA;AACF;AAhCgBf,MAAAA,CAAAA,4BAAAA,EAAAA,8BAAAA,CAAAA;;;ACmDhB,SAASoB,WAAWC,QAAAA,EAAc;AAChC,EAAA,IAAIA,UAAU,OAAOA,QAAAA;AACrB,EAAA,MAAMC,OAAAA,GAAUC,QAAQC,GAAAA,CAAI,YAAA,KAAiBD,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,IAAe,EAAA;AACxE,EAAA,IAAIF,OAAAA,KAAY,YAAA,IAAgBA,OAAAA,KAAY,MAAA,EAAQ,OAAO,MAAA;AAC3D,EAAA,IAAIA,OAAAA,KAAY,aAAA,IAAiBA,OAAAA,KAAY,KAAA,EAAO,OAAO,KAAA;AAC3D,EAAA,OAAO,OAAA;AACT;AANSF,MAAAA,CAAAA,UAAAA,EAAAA,YAAAA,CAAAA;AAQT,SAASK,eAAeJ,QAAAA,EAAiB;AACvC,EAAA,IAAIA,UAAU,OAAOA,QAAAA;AACrB,EAAA,OAAOE,QAAQC,GAAAA,CAAI,qBAAA,KAA0BD,OAAAA,CAAQC,GAAAA,CAAI,iBAAA,CAAA,IAAsB,OAAA;AACjF;AAHSC,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAKT,SAASC,gBAAgBL,QAAAA,EAAiB;AACxC,EAAA,IAAIA,UAAU,OAAOA,QAAAA;AACrB,EAAA,MAAMM,KAAAA,GAAQ,MAAA;AACd,EAAA,OAAOJ,OAAAA,CAAQC,GAAAA,CAAI,6BAAA,CAAA,IAAkC,GAAGG,KAAAA,CAAAA,mCAAAA,CAAAA;AAC1D;AAJSD,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAMT,SAASE,eAAAA,CAAgBP,UAA8BG,GAAAA,EAAQ;AAC7D,EAAA,IAAI,OAAOH,QAAAA,KAAa,QAAA,IAAYQ,MAAAA,CAAOC,SAAST,QAAAA,CAAAA,EAAW,OAAOU,IAAAA,CAAKC,IAAI,CAAA,EAAGD,IAAAA,CAAKE,GAAAA,CAAI,CAAA,EAAGZ,QAAAA,CAAAA,CAAAA;AAC9F,EAAA,MAAMC,OAAAA,GAAUC,OAAAA,CAAQC,GAAAA,CAAI,yBAAA,CAAA;AAC5B,EAAA,IAAIF,OAAAA,EAAS;AACX,IAAA,MAAMY,MAAAA,GAASL,OAAOP,OAAAA,CAAAA;AACtB,IAAA,IAAIO,MAAAA,CAAOC,QAAAA,CAASI,MAAAA,CAAAA,EAAS,OAAOH,IAAAA,CAAKC,GAAAA,CAAI,CAAA,EAAGD,IAAAA,CAAKE,GAAAA,CAAI,CAAA,EAAGC,MAAAA,CAAAA,CAAAA;AAC9D,EAAA;AACA,EAAA,IAAIV,GAAAA,KAAQ,QAAQ,OAAO,GAAA;AAC3B,EAAA,OAAO,CAAA;AACT;AATSI,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAWT,SAASO,qBAAAA,GAAAA;AACP,EAAA,MAAMC,WAAAA,GAAcb,OAAAA,CAAQC,GAAAA,CAAI,mBAAA,CAAA;AAChC,EAAA,IAAIY,WAAAA,KAAgB,MAAA,IAAUA,WAAAA,KAAgB,GAAA,EAAK,OAAO,KAAA;AAC1D,EAAA,MAAMC,WAAAA,GAAcd,OAAAA,CAAQC,GAAAA,CAAI,cAAA,CAAA;AAChC,EAAA,IAAIa,WAAAA,KAAgB,OAAA,IAAWA,WAAAA,KAAgB,GAAA,EAAK,OAAO,KAAA;AAC3D,EAAA,OAAO,IAAA;AACT;AANSF,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA2BT,eAAsBG,mBAAmBC,GAAAA,EAAoB;AAC3D,EAAA,MAAMf,GAAAA,GAAMJ,UAAAA,CAAWmB,GAAAA,CAAIf,GAAG,CAAA;AAC9B,EAAA,MAAMgB,cAAAA,GAAiBf,cAAAA,CAAec,GAAAA,CAAIC,cAAc,CAAA;AACxD,EAAA,MAAMC,YAAAA,GAAef,eAAAA,CAAgBa,GAAAA,CAAIE,YAAY,CAAA;AACrD,EAAA,MAAMC,WAAAA,GAAcd,eAAAA,CAAgBW,GAAAA,CAAIG,WAAAA,EAAalB,GAAAA,CAAAA;AAOrD,EAAA,MAAM,EAAEmB,gBAAAA,EAAAA,iBAAAA,EAAgB,GAAK,MAAM,OAAO,4BAAA,CAAA;AAC1C,EAAA,MAAM1C,OAAAA,GAAS,MAAM0C,iBAAAA,CAAiB;AACpCC,IAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBpB,IAAAA,GAAAA;IACAqB,OAAAA,EAASL;GACX,CAAA;AACAM,EAAAA,wBAAAA,CAAyB7C,OAAAA,CAAAA;AAIzB,EAAA,MAAM8C,eAAAA,GAAkBC,oBAAAA,CAAqBT,GAAAA,CAAIK,WAAAA,EAAa;AAC5D,IAAA,GAAGL,GAAAA,CAAIQ,eAAAA;IACPE,OAAAA,EAAS;AACPL,MAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;MACjB,GAAIL,GAAAA,CAAIQ,eAAAA,EAAiBE,OAAAA,IAAW,EAAC;MACrCC,YAAAA,EAAcR;AAChB,KAAA;IACA5C,OAAAA,EAAS;AACP8C,MAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;MACjB,GAAIL,GAAAA,CAAIQ,eAAAA,EAAiBjD,OAAAA,IAAW;AACtC;GACF,CAAA;AAGA,EAAA,IAAIqD,OAAAA;AACJ,EAAA,IAAIhB,uBAAAA,EAAyB;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAEiB,aAAAA,EAAa,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvCD,MAAAA,OAAAA,GAAU,MAAMC,aAAAA,CAAc;AAC5BR,QAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBJ,QAAAA,cAAAA;AACAa,QAAAA,QAAAA,EAAUd,GAAAA,CAAIc,QAAAA;AACdC,QAAAA,MAAAA,EAAQf,GAAAA,CAAIe,MAAAA;AACZ9B,QAAAA,GAAAA;AACAiB,QAAAA,YAAAA;AACAC,QAAAA;OACF,CAAA;AAGAzC,MAAAA,OAAAA,CAAOsD,KAAK,qDAAA,EAAuD;AACjEX,QAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBH,QAAAA,YAAAA,EAAcA,eAAe,cAAA,GAAiB,WAAA;AAC9CC,QAAAA,WAAAA;AACAc,QAAAA,cAAAA,EAAgBL,OAAAA,CAAQK;OAC1B,CAAA;AAEA,MAAA,IAAI,CAACL,OAAAA,CAAQK,cAAAA,IAAkBL,OAAAA,CAAQM,iBAAAA,EAAmB;AACxDxD,QAAAA,OAAAA,CAAOyD,KAAK,gFAAA,EAAkF;AAC5Fd,UAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBe,UAAAA,MAAAA,EAAQR,OAAAA,CAAQM;SAClB,CAAA;AACF,MAAA;AACF,IAAA,CAAA,CAAA,OAAS1C,GAAAA,EAAK;AACZd,MAAAA,OAAAA,CAAOyD,KAAK,wFAAA,EAA0F;AACpG1C,QAAAA,KAAAA,EAAOD,GAAAA,YAAeE,KAAAA,GAAQF,GAAAA,CAAIG,OAAAA,GAAUC,OAAOJ,GAAAA;OACrD,CAAA;AACF,IAAA;EACF,CAAA,MAAO;AACLd,IAAAA,OAAAA,CAAOsD,KAAK,+CAAA,CAAA;AACd,EAAA;AAEA,EAAA,MAAMK,2BAAW,MAAA,CAAA,YAAA;AACf,IAAA,IAAI;AACF,MAAA,IAAIT,OAAAA,EAASS,QAAAA,EAAU,MAAMT,OAAAA,CAAQS,QAAAA,EAAQ;AAC/C,IAAA,CAAA,CAAA,OAAS7C,GAAAA,EAAK;AACXd,MAAAA,OAAAA,CAAiCyD,KAAK,sCAAA,EAAwC;AAC7E1C,QAAAA,KAAAA,EAAOD,GAAAA,YAAeE,KAAAA,GAAQF,GAAAA,CAAIG,OAAAA,GAAUC,OAAOJ,GAAAA;OACrD,CAAA;AACF,IAAA;EACF,CAAA,EARiB,UAAA,CAAA;AAWjB8C,EAAAA,MAAAA,CAAcC,QAAAA,CAAS7D,OAAAA,CAAO8D,QAAAA,IAAQ,IAAQ,MAAA,CAAA;AAE9C,EAAA,OAAO;AACLnB,IAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBJ,IAAAA,cAAAA;AACAhB,IAAAA,GAAAA;IACAvB,MAAAA,EAAQA,OAAAA;AACR8C,IAAAA,eAAAA;AACAa,IAAAA;AACF,GAAA;AACF;AA7FsBtB,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * `/health`, `/health/live`, `/health/ready` Elysia routes with a 1s\n * result cache so readiness checks can't stampede Postgres.\n *\n * Dependencies (prisma, eventQueue, valkey) are optional — omit any client and\n * the readiness check simply skips it.\n */\n\ninterface PrismaLike {\n  $queryRaw: (strings: TemplateStringsArray) => Promise<unknown>;\n}\ninterface EventQueueLike {\n  isConnected?: () => boolean | Promise<boolean>;\n  healthCheck?: () => Promise<{ ok: boolean }>;\n}\ninterface ValkeyLike {\n  ping: () => Promise<unknown>;\n}\n\nexport interface HealthDeps {\n  prisma?: PrismaLike;\n  eventQueue?: EventQueueLike;\n  valkey?: ValkeyLike;\n  /** Service version reported on /health. */\n  version?: string;\n  /** Service name reported on /health. */\n  serviceName?: string;\n}\n\ninterface CachedStatus {\n  ready: boolean;\n  checked: Record<string, { ok: boolean; error?: string }>;\n  at: number;\n}\n\nconst CACHE_TTL_MS = 1000;\n\nasync function probeReady(deps: HealthDeps): Promise<CachedStatus> {\n  const checked: Record<string, { ok: boolean; error?: string }> = {};\n\n  if (deps.prisma) {\n    try {\n      await deps.prisma.$queryRaw`SELECT 1`;\n      checked['postgres'] = { ok: true };\n    } catch (err) {\n      checked['postgres'] = {\n        ok: false,\n        error: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (deps.eventQueue) {\n    try {\n      const connected =\n        typeof deps.eventQueue.isConnected === 'function'\n          ? await Promise.resolve(deps.eventQueue.isConnected())\n          : ((await deps.eventQueue.healthCheck?.())?.ok ?? true);\n      checked['eventQueue'] = { ok: Boolean(connected) };\n    } catch (err) {\n      checked['eventQueue'] = {\n        ok: false,\n        error: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (deps.valkey) {\n    try {\n      await deps.valkey.ping();\n      checked['valkey'] = { ok: true };\n    } catch (err) {\n      checked['valkey'] = {\n        ok: false,\n        error: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  const ready = Object.values(checked).every((c) => c.ok);\n  return { ready, checked, at: Date.now() };\n}\n\nexport function createHealthRoutes(_deps: HealthDeps = {}): unknown {\n  // Return an Elysia app lazily so be-sdk doesn't hard-require elysia.\n  return new Proxy(\n    {},\n    {\n      get(_target, prop): unknown {\n        // Tell TypeScript consumers the returned object is an Elysia plugin;\n        // the actual mount happens via `createHealthRoutesImpl`. Services\n        // that prefer direct use can call `createHealthRoutesImpl(elysia, deps)`.\n        if (prop === 'use' || prop === 'then') return undefined;\n        return undefined;\n      },\n    }\n  );\n}\n\n/**\n * Mount health routes on an existing Elysia app. Callers hold a reference\n * to Elysia themselves; be-sdk stays decoupled.\n */\nexport function createHealthRoutesImpl<\n  App extends {\n    get: (path: string, handler: (ctx: unknown) => unknown) => App;\n  },\n>(app: App, deps: HealthDeps = {}): App {\n  let cache: CachedStatus | null = null;\n\n  const getStatus = async (): Promise<CachedStatus> => {\n    if (cache && Date.now() - cache.at < CACHE_TTL_MS) return cache;\n    cache = await probeReady(deps);\n    return cache;\n  };\n\n  app.get('/health/live', () => ({\n    status: 'ok',\n    serviceName: deps.serviceName,\n    version: deps.version,\n  }));\n\n  app.get('/health/ready', async (ctx: unknown): Promise<unknown> => {\n    const status = await getStatus();\n    const ctxWithSet = ctx as { set?: { status?: number } };\n    if (!status.ready && ctxWithSet.set) ctxWithSet.set.status = 503;\n    return {\n      status: status.ready ? 'ok' : 'degraded',\n      serviceName: deps.serviceName,\n      version: deps.version,\n      checks: status.checked,\n    };\n  });\n\n  app.get('/health', async (ctx: unknown): Promise<unknown> => {\n    const status = await getStatus();\n    const ctxWithSet = ctx as { set?: { status?: number } };\n    if (!status.ready && ctxWithSet.set) ctxWithSet.set.status = 503;\n    return {\n      status: status.ready ? 'ok' : 'degraded',\n      serviceName: deps.serviceName,\n      version: deps.version,\n      checks: status.checked,\n      uptime_s: Math.round(process.uptime()),\n    };\n  });\n\n  return app;\n}\n","/**\n * Prometheus `/metrics` route mounter. Uses the shared `prom-client`\n * default registry so all instrumentation (GraphQL Envelop, Prisma,\n * runtime) shows up on a single endpoint.\n */\n\ninterface PromRegistryLike {\n  metrics: () => Promise<string> | string;\n  contentType?: string;\n}\n\nexport interface MetricsMountOptions {\n  registry?: PromRegistryLike;\n  path?: string;\n}\n\nexport async function loadDefaultRegistry(): Promise<PromRegistryLike | null> {\n  try {\n    const mod = (await import('prom-client')) as unknown as {\n      register: PromRegistryLike;\n      collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n    };\n    // Kick runtime metrics into the default registry if not already.\n    try {\n      mod.collectDefaultMetrics({ register: mod.register });\n    } catch {\n      // Already registered — ignore duplicate-metric errors.\n    }\n    return mod.register;\n  } catch {\n    return null;\n  }\n}\n\nexport function createMetricsRoutesImpl<\n  App extends {\n    get: (path: string, handler: (ctx: unknown) => unknown) => App;\n  },\n>(app: App, opts: MetricsMountOptions = {}): App {\n  const path = opts.path ?? '/metrics';\n\n  app.get(path, async (ctx: unknown): Promise<unknown> => {\n    const registry = opts.registry ?? (await loadDefaultRegistry());\n    const ctxWithSet = ctx as { set?: { status?: number; headers?: Record<string, string> } };\n    if (!registry) {\n      if (ctxWithSet.set) ctxWithSet.set.status = 503;\n      return '# prom-client not installed\\n';\n    }\n    if (ctxWithSet.set) {\n      ctxWithSet.set.status = 200;\n      ctxWithSet.set.headers = {\n        'content-type': registry.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n      };\n    }\n    return registry.metrics();\n  });\n\n  return app;\n}\n\n/**\n * Legacy export name used by the service template. Composes the Elysia\n * plugin-style function that `new Elysia().use(...)` accepts.\n */\nexport function createMetricsRoutes(opts: MetricsMountOptions = {}): unknown {\n  return (app: Parameters<typeof createMetricsRoutesImpl>[0]): unknown => createMetricsRoutesImpl(app, opts);\n}\n","/**\n * Prisma client extension that pipes query events through the SDK logger\n * with trace/span correlation fields auto-injected. The\n * `@prisma/instrumentation` peer provides the spans\n * themselves; this extension only adds structured log events on top.\n */\nimport type { Logger } from '../logger/index.js';\nimport { redactSensitiveFields } from '../logger/index.js';\n\ntype PrismaQueryArgs = {\n  model?: string;\n  operation: string;\n  args: unknown;\n  query: (args: unknown) => Promise<unknown>;\n};\n\n/**\n * Returns a Prisma Client extension object compatible with the\n * `$extends()` API (Prisma v5+).\n *\n * ```ts\n * export const prisma = new PrismaClient().$extends(\n *   createPrismaLoggingExtension(logger)\n * );\n * ```\n */\nexport function createPrismaLoggingExtension(logger: Logger): {\n  name: string;\n  query: {\n    $allOperations: (args: PrismaQueryArgs) => Promise<unknown>;\n  };\n} {\n  return {\n    name: 'burdenoff-pino-logging',\n    query: {\n      async $allOperations({ model, operation, args, query }: PrismaQueryArgs): Promise<unknown> {\n        const start = Date.now();\n        try {\n          const result = await query(args);\n          logger.debug('prisma.query', {\n            model,\n            operation,\n            duration_ms: Date.now() - start,\n            args: redactSensitiveFields(args),\n          });\n          return result;\n        } catch (err) {\n          logger.error('prisma.error', {\n            model,\n            operation,\n            duration_ms: Date.now() - start,\n            error: err instanceof Error ? err.message : String(err),\n          });\n          throw err;\n        }\n      },\n    },\n  };\n}\n","/**\n * Unified telemetry bootstrap for Burdenoff services.\n *\n * Composes the existing `instrumentation/` + `observability/` + `logger/`\n * modules and adds:\n *   - `bootstrapTelemetry({ serviceName, boundary, module, env })` — single\n *     call that initializes OTel, wires Pino logger with trace fields,\n *     exposes GraphQL Yoga plugins, registers process exit hooks.\n *   - `createHealthRoutes({ prisma, nats, valkey, version })` — `/health`,\n *     `/health/live`, `/health/ready` Elysia routes.\n *   - `createMetricsRoutes(registry?)` — `/metrics` Prometheus exposition.\n *   - `createPrismaLoggingExtension(logger)` — Prisma extension that pipes\n *     query events through Pino with trace/span correlation ids.\n *\n * The module does not pull in `@opentelemetry/sdk-node` or `pino` as direct\n * deps — services install those as optional peers, and imports are lazy so\n * services that don't install them still load.\n */\n\nimport type { Logger as BaseLogger } from '../logger/index.js';\nimport { logger as defaultLogger } from '../logger/index.js';\nimport {\n  initializeInstrumentation,\n  setupInstrumentation,\n  type SetupInstrumentationOptions,\n  type InstrumentationSetupResult,\n} from '../instrumentation/index.js';\nimport { setActiveTelemetryLogger } from './logger-state.js';\nimport type { OtelSdkHandle } from './sdk.js';\n\nexport { createHealthRoutes } from './health.js';\nexport { createMetricsRoutes } from './metrics-endpoint.js';\nexport { createPrismaLoggingExtension } from './prisma-logging.js';\nexport { DEFAULT_REDACT_PATHS } from './pino-redaction.js';\nexport { createPinoLogger } from './pino-logger.js';\n\nexport type Boundary = 'wspace' | 'global' | 'gateway';\nexport type Env = 'alpha' | 'prod' | 'dev';\n\nexport interface TelemetryConfig {\n  /** Full service name, e.g. \"wspace-auth-svc\". */\n  serviceName: string;\n  /** Semver of the service deployment; defaults to `process.env.npm_package_version`. */\n  serviceVersion?: string;\n  /** Monorepo boundary: `wspace`, `global`, or `gateway`. */\n  boundary: Boundary;\n  /** Module slug, e.g. `auth` (omit for gateways). */\n  module?: string;\n  /** Deployment environment; defaults to alpha for non-production NODE_ENV. */\n  env?: Env;\n  /**\n   * OTLP endpoint for spans/metrics/logs. Defaults to\n   * `$OTEL_EXPORTER_OTLP_ENDPOINT` or\n   * `http://alloy.sre.svc.cluster.local:4318`.\n   */\n  otlpEndpoint?: string;\n  /** Head-based sampling ratio. Default: alpha=1.0, prod=0.1. */\n  sampleRatio?: number;\n  /** Extra options forwarded to `setupInstrumentation`. */\n  instrumentation?: SetupInstrumentationOptions;\n}\n\nexport interface TelemetryHandle {\n  /** The configured service name (for use in health routes, etc.). */\n  serviceName: string;\n  /** The resolved service version. */\n  serviceVersion: string;\n  /** Environment. */\n  env: Env;\n  /** The Pino-backed logger. */\n  logger: BaseLogger;\n  /** Initialized instrumentation (tracer + metrics + plugins). */\n  instrumentation: InstrumentationSetupResult;\n  /** Cleanup hook; services call on SIGTERM. */\n  shutdown: () => Promise<void>;\n}\n\nfunction resolveEnv(explicit?: Env): Env {\n  if (explicit) return explicit;\n  const fromEnv = process.env['DEPLOY_ENV'] ?? process.env['NODE_ENV'] ?? '';\n  if (fromEnv === 'production' || fromEnv === 'prod') return 'prod';\n  if (fromEnv === 'development' || fromEnv === 'dev') return 'dev';\n  return 'alpha';\n}\n\nfunction resolveVersion(explicit?: string): string {\n  if (explicit) return explicit;\n  return process.env['npm_package_version'] ?? process.env['SERVICE_VERSION'] ?? '0.0.0';\n}\n\nfunction resolveEndpoint(explicit?: string): string {\n  if (explicit) return explicit;\n  const proto = 'http';\n  return process.env['OTEL_EXPORTER_OTLP_ENDPOINT'] ?? `${proto}://alloy.sre.svc.cluster.local:4318`;\n}\n\nfunction resolveSampling(explicit: number | undefined, env: Env): number {\n  if (typeof explicit === 'number' && Number.isFinite(explicit)) return Math.min(1, Math.max(0, explicit));\n  const fromEnv = process.env['OTEL_TRACES_SAMPLER_ARG'];\n  if (fromEnv) {\n    const parsed = Number(fromEnv);\n    if (Number.isFinite(parsed)) return Math.min(1, Math.max(0, parsed));\n  }\n  if (env === 'prod') return 0.1;\n  return 1.0;\n}\n\nfunction resolveOtelSdkEnabled(): boolean {\n  const sdkDisabled = process.env['OTEL_SDK_DISABLED'];\n  if (sdkDisabled === 'true' || sdkDisabled === '1') return false;\n  const otelEnabled = process.env['OTEL_ENABLED'];\n  if (otelEnabled === 'false' || otelEnabled === '0') return false;\n  return true;\n}\n\n/**\n * Bootstrap the full telemetry stack for a service.\n *\n * Services call this ONCE at startup **before** importing Prisma / GraphQL\n * Yoga / NATS so OTel can auto-instrument their dependencies.\n *\n * ```ts\n * // src/telemetry.ts\n * import { bootstrapTelemetry } from '@burdenoff/be-sdk/telemetry';\n * export const telemetry = await bootstrapTelemetry({\n *   serviceName: 'wspace-auth-svc',\n *   boundary: 'wspace',\n *   module: 'auth',\n * });\n *\n * // src/index.ts — must be the FIRST import line.\n * import './telemetry.js';\n * ```\n */\nexport async function bootstrapTelemetry(cfg: TelemetryConfig): Promise<TelemetryHandle> {\n  const env = resolveEnv(cfg.env);\n  const serviceVersion = resolveVersion(cfg.serviceVersion);\n  const otlpEndpoint = resolveEndpoint(cfg.otlpEndpoint);\n  const sampleRatio = resolveSampling(cfg.sampleRatio, env);\n\n  // Pino logger with trace/span correlation + redaction.\n  // createPinoLogger is async (loads pino via dynamic import); awaiting it\n  // is required — without await, `logger` is a Promise and calls like\n  // logger.warn(...) crash with \"logger.warn is not a function\" during the\n  // sdk-node fallback path.\n  const { createPinoLogger } = await import('./pino-logger.js');\n  const logger = await createPinoLogger({\n    serviceName: cfg.serviceName,\n    env,\n    version: serviceVersion,\n  });\n  setActiveTelemetryLogger(logger);\n\n  // Initialize core instrumentation (tracer, metrics registry, envelop plugins).\n  // `setupInstrumentation` internally calls `initializeInstrumentation`.\n  const instrumentation = setupInstrumentation(cfg.serviceName, {\n    ...cfg.instrumentation,\n    tracing: {\n      serviceName: cfg.serviceName,\n      ...(cfg.instrumentation?.tracing ?? {}),\n      samplingRate: sampleRatio,\n    },\n    metrics: {\n      serviceName: cfg.serviceName,\n      ...(cfg.instrumentation?.metrics ?? {}),\n    },\n  });\n\n  // Start the NodeSDK exporter pipeline if sdk-node is present (optional).\n  let otelSdk: OtelSdkHandle | undefined;\n  if (resolveOtelSdkEnabled()) {\n    try {\n      const { createOtelSdk } = await import('./sdk.js');\n      otelSdk = await createOtelSdk({\n        serviceName: cfg.serviceName,\n        serviceVersion,\n        boundary: cfg.boundary,\n        module: cfg.module,\n        env,\n        otlpEndpoint,\n        sampleRatio,\n      });\n      // Explicit success log includes metrics path status so an operator can\n      // distinguish traces-only startup from full traces+metrics startup.\n      logger.info('[telemetry] OpenTelemetry exporter pipeline started', {\n        serviceName: cfg.serviceName,\n        otlpEndpoint: otlpEndpoint ? '<configured>' : '<not set>',\n        sampleRatio,\n        metricsEnabled: otelSdk.metricsEnabled,\n      });\n\n      if (!otelSdk.metricsEnabled && otelSdk.metricsDropReason) {\n        logger.warn('[telemetry] OpenTelemetry metrics reader disabled; continuing with traces only', {\n          serviceName: cfg.serviceName,\n          reason: otelSdk.metricsDropReason,\n        });\n      }\n    } catch (err) {\n      logger.warn('[telemetry] OpenTelemetry exporter pipeline failed to start; continuing with logs only', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  } else {\n    logger.info('[telemetry] OTel SDK exporter disabled by env');\n  }\n\n  const shutdown = async (): Promise<void> => {\n    try {\n      if (otelSdk?.shutdown) await otelSdk.shutdown();\n    } catch (err) {\n      (logger as unknown as BaseLogger).warn('[telemetry] shutdown error (ignored)', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  };\n\n  // Mirror defaultLogger so services that still use the singleton get trace-enriched output.\n  defaultLogger.setLevel(logger.getLevel?.() ?? 'info');\n\n  return {\n    serviceName: cfg.serviceName,\n    serviceVersion,\n    env,\n    logger: logger as unknown as BaseLogger,\n    instrumentation,\n    shutdown,\n  };\n}\n\n// Re-export what services typically import.\nexport { initializeInstrumentation, setupInstrumentation };\n"]}
+{"version":3,"sources":["../../src/telemetry/health.ts","../../src/telemetry/metrics-endpoint.ts","../../src/telemetry/prisma-logging.ts","../../src/telemetry/index.ts"],"names":["createHealthRoutes","_deps","Proxy","get","_target","prop","undefined","loadDefaultRegistry","mod","collectDefaultMetrics","register","createMetricsRoutesImpl","app","opts","path","ctx","registry","ctxWithSet","set","status","headers","contentType","metrics","createMetricsRoutes","createPrismaLoggingExtension","logger","name","query","$allOperations","model","operation","args","start","Date","now","result","debug","duration_ms","redactSensitiveFields","err","error","Error","message","String","resolveEnv","explicit","fromEnv","process","env","resolveVersion","resolveEndpoint","proto","resolveSampling","Number","isFinite","Math","min","max","parsed","resolveOtelSdkEnabled","sdkDisabled","otelEnabled","bootstrapTelemetry","cfg","serviceVersion","otlpEndpoint","sampleRatio","createPinoLogger","serviceName","version","setActiveTelemetryLogger","instrumentation","setupInstrumentation","tracing","samplingRate","otelSdk","createOtelSdk","boundary","module","info","metricsEnabled","metricsDropReason","warn","reason","shutdown","defaultLogger","setLevel","getLevel"],"mappings":";;;;;;;;AAmFO,SAASA,kBAAAA,CAAmBC,KAAAA,GAAoB,EAAC,EAAC;AAEvD,EAAA,OAAO,IAAIC,KAAAA,CACT,EAAC,EACD;AACEC,IAAAA,GAAAA,CAAIC,SAASC,IAAAA,EAAI;AAIf,MAAA,IAAIA,IAAAA,KAAS,KAAA,IAASA,IAAAA,KAAS,MAAA,EAAQ,OAAOC,MAAAA;AAC9C,MAAA,OAAOA,MAAAA;AACT,IAAA;GACF,CAAA;AAEJ;AAdgBN,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;;;ACnEhB,eAAsBO,mBAAAA,GAAAA;AACpB,EAAA,IAAI;AACF,IAAA,MAAMC,GAAAA,GAAO,MAAM,OAAO,aAAA,CAAA;AAK1B,IAAA,IAAI;AACFA,MAAAA,GAAAA,CAAIC,qBAAAA,CAAsB;AAAEC,QAAAA,QAAAA,EAAUF,GAAAA,CAAIE;OAAS,CAAA;IACrD,CAAA,CAAA,MAAQ;AAER,IAAA;AACA,IAAA,OAAOF,GAAAA,CAAIE,QAAAA;EACb,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAhBsBH,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAkBf,SAASI,uBAAAA,CAIdC,GAAAA,EAAUC,IAAAA,GAA4B,EAAC,EAAC;AACxC,EAAA,MAAMC,IAAAA,GAAOD,KAAKC,IAAAA,IAAQ,UAAA;AAE1BF,EAAAA,GAAAA,CAAIT,GAAAA,CAAIW,IAAAA,EAAM,OAAOC,GAAAA,KAAAA;AACnB,IAAA,MAAMC,QAAAA,GAAWH,IAAAA,CAAKG,QAAAA,IAAa,MAAMT,mBAAAA,EAAAA;AACzC,IAAA,MAAMU,UAAAA,GAAaF,GAAAA;AACnB,IAAA,IAAI,CAACC,QAAAA,EAAU;AACb,MAAA,IAAIC,UAAAA,CAAWC,GAAAA,EAAKD,UAAAA,CAAWC,GAAAA,CAAIC,MAAAA,GAAS,GAAA;AAC5C,MAAA,OAAO,+BAAA;AACT,IAAA;AACA,IAAA,IAAIF,WAAWC,GAAAA,EAAK;AAClBD,MAAAA,UAAAA,CAAWC,IAAIC,MAAAA,GAAS,GAAA;AACxBF,MAAAA,UAAAA,CAAWC,IAAIE,OAAAA,GAAU;AACvB,QAAA,cAAA,EAAgBJ,SAASK,WAAAA,IAAe;AAC1C,OAAA;AACF,IAAA;AACA,IAAA,OAAOL,SAASM,OAAAA,EAAO;EACzB,CAAA,CAAA;AAEA,EAAA,OAAOV,GAAAA;AACT;AAxBgBD,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA8BT,SAASY,mBAAAA,CAAoBV,IAAAA,GAA4B,EAAC,EAAC;AAChE,EAAA,OAAO,CAACD,GAAAA,KAAgED,uBAAAA,CAAwBC,GAAAA,EAAKC,IAAAA,CAAAA;AACvG;AAFgBU,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;;;ACtCT,SAASC,6BAA6BC,OAAAA,EAAc;AAMzD,EAAA,OAAO;IACLC,IAAAA,EAAM,wBAAA;IACNC,KAAAA,EAAO;AACL,MAAA,MAAMC,eAAe,EAAEC,KAAAA,EAAOC,SAAAA,EAAWC,IAAAA,EAAMJ,OAAK,EAAmB;AACrE,QAAA,MAAMK,KAAAA,GAAQC,KAAKC,GAAAA,EAAG;AACtB,QAAA,IAAI;AACF,UAAA,MAAMC,MAAAA,GAAS,MAAMR,KAAAA,CAAMI,IAAAA,CAAAA;AAC3BN,UAAAA,OAAAA,CAAOW,MAAM,cAAA,EAAgB;AAC3BP,YAAAA,KAAAA;AACAC,YAAAA,SAAAA;YACAO,WAAAA,EAAaJ,IAAAA,CAAKC,KAAG,GAAKF,KAAAA;AAC1BD,YAAAA,IAAAA,EAAMO,sBAAsBP,IAAAA;WAC9B,CAAA;AACA,UAAA,OAAOI,MAAAA;AACT,QAAA,CAAA,CAAA,OAASI,GAAAA,EAAK;AACZd,UAAAA,OAAAA,CAAOe,MAAM,cAAA,EAAgB;AAC3BX,YAAAA,KAAAA;AACAC,YAAAA,SAAAA;YACAO,WAAAA,EAAaJ,IAAAA,CAAKC,KAAG,GAAKF,KAAAA;AAC1BQ,YAAAA,KAAAA,EAAOD,GAAAA,YAAeE,KAAAA,GAAQF,GAAAA,CAAIG,OAAAA,GAAUC,OAAOJ,GAAAA;WACrD,CAAA;AACA,UAAA,MAAMA,GAAAA;AACR,QAAA;AACF,MAAA;AACF;AACF,GAAA;AACF;AAhCgBf,MAAAA,CAAAA,4BAAAA,EAAAA,8BAAAA,CAAAA;;;ACmDhB,SAASoB,WAAWC,QAAAA,EAAc;AAChC,EAAA,IAAIA,UAAU,OAAOA,QAAAA;AACrB,EAAA,MAAMC,OAAAA,GAAUC,QAAQC,GAAAA,CAAI,YAAA,KAAiBD,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,IAAe,EAAA;AACxE,EAAA,IAAIF,OAAAA,KAAY,YAAA,IAAgBA,OAAAA,KAAY,MAAA,EAAQ,OAAO,MAAA;AAC3D,EAAA,IAAIA,OAAAA,KAAY,aAAA,IAAiBA,OAAAA,KAAY,KAAA,EAAO,OAAO,KAAA;AAC3D,EAAA,OAAO,OAAA;AACT;AANSF,MAAAA,CAAAA,UAAAA,EAAAA,YAAAA,CAAAA;AAQT,SAASK,eAAeJ,QAAAA,EAAiB;AACvC,EAAA,IAAIA,UAAU,OAAOA,QAAAA;AACrB,EAAA,OAAOE,QAAQC,GAAAA,CAAI,qBAAA,KAA0BD,OAAAA,CAAQC,GAAAA,CAAI,iBAAA,CAAA,IAAsB,OAAA;AACjF;AAHSC,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAKT,SAASC,gBAAgBL,QAAAA,EAAiB;AACxC,EAAA,IAAIA,UAAU,OAAOA,QAAAA;AACrB,EAAA,MAAMM,KAAAA,GAAQ,MAAA;AACd,EAAA,OAAOJ,OAAAA,CAAQC,GAAAA,CAAI,6BAAA,CAAA,IAAkC,GAAGG,KAAAA,CAAAA,mCAAAA,CAAAA;AAC1D;AAJSD,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAMT,SAASE,eAAAA,CAAgBP,UAA8BG,GAAAA,EAAQ;AAC7D,EAAA,IAAI,OAAOH,QAAAA,KAAa,QAAA,IAAYQ,MAAAA,CAAOC,SAAST,QAAAA,CAAAA,EAAW,OAAOU,IAAAA,CAAKC,IAAI,CAAA,EAAGD,IAAAA,CAAKE,GAAAA,CAAI,CAAA,EAAGZ,QAAAA,CAAAA,CAAAA;AAC9F,EAAA,MAAMC,OAAAA,GAAUC,OAAAA,CAAQC,GAAAA,CAAI,yBAAA,CAAA;AAC5B,EAAA,IAAIF,OAAAA,EAAS;AACX,IAAA,MAAMY,MAAAA,GAASL,OAAOP,OAAAA,CAAAA;AACtB,IAAA,IAAIO,MAAAA,CAAOC,QAAAA,CAASI,MAAAA,CAAAA,EAAS,OAAOH,IAAAA,CAAKC,GAAAA,CAAI,CAAA,EAAGD,IAAAA,CAAKE,GAAAA,CAAI,CAAA,EAAGC,MAAAA,CAAAA,CAAAA;AAC9D,EAAA;AACA,EAAA,IAAIV,GAAAA,KAAQ,QAAQ,OAAO,GAAA;AAC3B,EAAA,OAAO,CAAA;AACT;AATSI,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAWT,SAASO,qBAAAA,GAAAA;AACP,EAAA,MAAMC,WAAAA,GAAcb,OAAAA,CAAQC,GAAAA,CAAI,mBAAA,CAAA;AAChC,EAAA,IAAIY,WAAAA,KAAgB,MAAA,IAAUA,WAAAA,KAAgB,GAAA,EAAK,OAAO,KAAA;AAC1D,EAAA,MAAMC,WAAAA,GAAcd,OAAAA,CAAQC,GAAAA,CAAI,cAAA,CAAA;AAChC,EAAA,IAAIa,WAAAA,KAAgB,OAAA,IAAWA,WAAAA,KAAgB,GAAA,EAAK,OAAO,KAAA;AAC3D,EAAA,OAAO,IAAA;AACT;AANSF,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA2BT,eAAsBG,mBAAmBC,GAAAA,EAAoB;AAC3D,EAAA,MAAMf,GAAAA,GAAMJ,UAAAA,CAAWmB,GAAAA,CAAIf,GAAG,CAAA;AAC9B,EAAA,MAAMgB,cAAAA,GAAiBf,cAAAA,CAAec,GAAAA,CAAIC,cAAc,CAAA;AACxD,EAAA,MAAMC,YAAAA,GAAef,eAAAA,CAAgBa,GAAAA,CAAIE,YAAY,CAAA;AACrD,EAAA,MAAMC,WAAAA,GAAcd,eAAAA,CAAgBW,GAAAA,CAAIG,WAAAA,EAAalB,GAAAA,CAAAA;AAOrD,EAAA,MAAM,EAAEmB,gBAAAA,EAAAA,iBAAAA,EAAgB,GAAK,MAAM,OAAO,4BAAA,CAAA;AAC1C,EAAA,MAAM1C,OAAAA,GAAS,MAAM0C,iBAAAA,CAAiB;AACpCC,IAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBpB,IAAAA,GAAAA;IACAqB,OAAAA,EAASL;GACX,CAAA;AACAM,EAAAA,wBAAAA,CAAyB7C,OAAAA,CAAAA;AAIzB,EAAA,MAAM8C,eAAAA,GAAkBC,oBAAAA,CAAqBT,GAAAA,CAAIK,WAAAA,EAAa;AAC5D,IAAA,GAAGL,GAAAA,CAAIQ,eAAAA;IACPE,OAAAA,EAAS;AACPL,MAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;MACjB,GAAIL,GAAAA,CAAIQ,eAAAA,EAAiBE,OAAAA,IAAW,EAAC;MACrCC,YAAAA,EAAcR;AAChB,KAAA;IACA5C,OAAAA,EAAS;AACP8C,MAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;MACjB,GAAIL,GAAAA,CAAIQ,eAAAA,EAAiBjD,OAAAA,IAAW;AACtC;GACF,CAAA;AAGA,EAAA,IAAIqD,OAAAA;AACJ,EAAA,IAAIhB,uBAAAA,EAAyB;AAC3B,IAAA,IAAI;AACF,MAAA,MAAM,EAAEiB,aAAAA,EAAa,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvCD,MAAAA,OAAAA,GAAU,MAAMC,aAAAA,CAAc;AAC5BR,QAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBJ,QAAAA,cAAAA;AACAa,QAAAA,QAAAA,EAAUd,GAAAA,CAAIc,QAAAA;AACdC,QAAAA,MAAAA,EAAQf,GAAAA,CAAIe,MAAAA;AACZ9B,QAAAA,GAAAA;AACAiB,QAAAA,YAAAA;AACAC,QAAAA;OACF,CAAA;AAGAzC,MAAAA,OAAAA,CAAOsD,KAAK,qDAAA,EAAuD;AACjEX,QAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBH,QAAAA,YAAAA,EAAcA,eAAe,cAAA,GAAiB,WAAA;AAC9CC,QAAAA,WAAAA;AACAc,QAAAA,cAAAA,EAAgBL,OAAAA,CAAQK;OAC1B,CAAA;AAEA,MAAA,IAAI,CAACL,OAAAA,CAAQK,cAAAA,IAAkBL,OAAAA,CAAQM,iBAAAA,EAAmB;AACxDxD,QAAAA,OAAAA,CAAOyD,KAAK,gFAAA,EAAkF;AAC5Fd,UAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBe,UAAAA,MAAAA,EAAQR,OAAAA,CAAQM;SAClB,CAAA;AACF,MAAA;AACF,IAAA,CAAA,CAAA,OAAS1C,GAAAA,EAAK;AACZd,MAAAA,OAAAA,CAAOyD,KAAK,wFAAA,EAA0F;AACpG1C,QAAAA,KAAAA,EAAOD,GAAAA,YAAeE,KAAAA,GAAQF,GAAAA,CAAIG,OAAAA,GAAUC,OAAOJ,GAAAA;OACrD,CAAA;AACF,IAAA;EACF,CAAA,MAAO;AACLd,IAAAA,OAAAA,CAAOsD,KAAK,+CAAA,CAAA;AACd,EAAA;AAEA,EAAA,MAAMK,2BAAW,MAAA,CAAA,YAAA;AACf,IAAA,IAAI;AACF,MAAA,IAAIT,OAAAA,EAASS,QAAAA,EAAU,MAAMT,OAAAA,CAAQS,QAAAA,EAAQ;AAC/C,IAAA,CAAA,CAAA,OAAS7C,GAAAA,EAAK;AACZd,MAAAA,OAAAA,CAAOyD,KAAK,sCAAA,EAAwC;AAClD1C,QAAAA,KAAAA,EAAOD,GAAAA,YAAeE,KAAAA,GAAQF,GAAAA,CAAIG,OAAAA,GAAUC,OAAOJ,GAAAA;OACrD,CAAA;AACF,IAAA;EACF,CAAA,EARiB,UAAA,CAAA;AAWjB8C,EAAAA,MAAAA,CAAcC,QAAAA,CAAS7D,OAAAA,CAAO8D,QAAAA,IAAQ,IAAQ,MAAA,CAAA;AAE9C,EAAA,OAAO;AACLnB,IAAAA,WAAAA,EAAaL,GAAAA,CAAIK,WAAAA;AACjBJ,IAAAA,cAAAA;AACAhB,IAAAA,GAAAA;IACAvB,MAAAA,EAAQA,OAAAA;AACR8C,IAAAA,eAAAA;AACAa,IAAAA;AACF,GAAA;AACF;AA7FsBtB,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * `/health`, `/health/live`, `/health/ready` Elysia routes with a 1s\n * result cache so readiness checks can't stampede Postgres.\n *\n * Dependencies (prisma, eventQueue, valkey) are optional — omit any client and\n * the readiness check simply skips it.\n */\n\ninterface PrismaLike {\n  $queryRaw: (strings: TemplateStringsArray) => Promise<unknown>;\n}\ninterface EventQueueLike {\n  isConnected?: () => boolean | Promise<boolean>;\n  healthCheck?: () => Promise<{ ok: boolean }>;\n}\ninterface ValkeyLike {\n  ping: () => Promise<unknown>;\n}\n\nexport interface HealthDeps {\n  prisma?: PrismaLike;\n  eventQueue?: EventQueueLike;\n  valkey?: ValkeyLike;\n  /** Service version reported on /health. */\n  version?: string;\n  /** Service name reported on /health. */\n  serviceName?: string;\n}\n\ninterface CachedStatus {\n  ready: boolean;\n  checked: Record<string, { ok: boolean; error?: string }>;\n  at: number;\n}\n\nconst CACHE_TTL_MS = 1000;\n\nasync function probeReady(deps: HealthDeps): Promise<CachedStatus> {\n  const checked: Record<string, { ok: boolean; error?: string }> = {};\n\n  if (deps.prisma) {\n    try {\n      await deps.prisma.$queryRaw`SELECT 1`;\n      checked['postgres'] = { ok: true };\n    } catch (err) {\n      checked['postgres'] = {\n        ok: false,\n        error: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (deps.eventQueue) {\n    try {\n      const connected =\n        typeof deps.eventQueue.isConnected === 'function'\n          ? await Promise.resolve(deps.eventQueue.isConnected())\n          : ((await deps.eventQueue.healthCheck?.())?.ok ?? true);\n      checked['eventQueue'] = { ok: Boolean(connected) };\n    } catch (err) {\n      checked['eventQueue'] = {\n        ok: false,\n        error: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  if (deps.valkey) {\n    try {\n      await deps.valkey.ping();\n      checked['valkey'] = { ok: true };\n    } catch (err) {\n      checked['valkey'] = {\n        ok: false,\n        error: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  const ready = Object.values(checked).every((c) => c.ok);\n  return { ready, checked, at: Date.now() };\n}\n\nexport function createHealthRoutes(_deps: HealthDeps = {}): unknown {\n  // Return an Elysia app lazily so be-sdk doesn't hard-require elysia.\n  return new Proxy(\n    {},\n    {\n      get(_target, prop): unknown {\n        // Tell TypeScript consumers the returned object is an Elysia plugin;\n        // the actual mount happens via `createHealthRoutesImpl`. Services\n        // that prefer direct use can call `createHealthRoutesImpl(elysia, deps)`.\n        if (prop === 'use' || prop === 'then') return undefined;\n        return undefined;\n      },\n    }\n  );\n}\n\n/**\n * Mount health routes on an existing Elysia app. Callers hold a reference\n * to Elysia themselves; be-sdk stays decoupled.\n */\nexport function createHealthRoutesImpl<\n  App extends {\n    get: (path: string, handler: (ctx: unknown) => unknown) => App;\n  },\n>(app: App, deps: HealthDeps = {}): App {\n  let cache: CachedStatus | null = null;\n\n  const getStatus = async (): Promise<CachedStatus> => {\n    if (cache && Date.now() - cache.at < CACHE_TTL_MS) return cache;\n    cache = await probeReady(deps);\n    return cache;\n  };\n\n  app.get('/health/live', () => ({\n    status: 'ok',\n    serviceName: deps.serviceName,\n    version: deps.version,\n  }));\n\n  app.get('/health/ready', async (ctx: unknown): Promise<unknown> => {\n    const status = await getStatus();\n    const ctxWithSet = ctx as { set?: { status?: number } };\n    if (!status.ready && ctxWithSet.set) ctxWithSet.set.status = 503;\n    return {\n      status: status.ready ? 'ok' : 'degraded',\n      serviceName: deps.serviceName,\n      version: deps.version,\n      checks: status.checked,\n    };\n  });\n\n  app.get('/health', async (ctx: unknown): Promise<unknown> => {\n    const status = await getStatus();\n    const ctxWithSet = ctx as { set?: { status?: number } };\n    if (!status.ready && ctxWithSet.set) ctxWithSet.set.status = 503;\n    return {\n      status: status.ready ? 'ok' : 'degraded',\n      serviceName: deps.serviceName,\n      version: deps.version,\n      checks: status.checked,\n      uptime_s: Math.round(process.uptime()),\n    };\n  });\n\n  return app;\n}\n","/**\n * Prometheus `/metrics` route mounter. Uses the shared `prom-client`\n * default registry so all instrumentation (GraphQL Envelop, Prisma,\n * runtime) shows up on a single endpoint.\n */\n\ninterface PromRegistryLike {\n  metrics: () => Promise<string> | string;\n  contentType?: string;\n}\n\nexport interface MetricsMountOptions {\n  registry?: PromRegistryLike;\n  path?: string;\n}\n\nexport async function loadDefaultRegistry(): Promise<PromRegistryLike | null> {\n  try {\n    const mod = (await import('prom-client')) as unknown as {\n      register: PromRegistryLike;\n      collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n    };\n    // Kick runtime metrics into the default registry if not already.\n    try {\n      mod.collectDefaultMetrics({ register: mod.register });\n    } catch {\n      // Already registered — ignore duplicate-metric errors.\n    }\n    return mod.register;\n  } catch {\n    return null;\n  }\n}\n\nexport function createMetricsRoutesImpl<\n  App extends {\n    get: (path: string, handler: (ctx: unknown) => unknown) => App;\n  },\n>(app: App, opts: MetricsMountOptions = {}): App {\n  const path = opts.path ?? '/metrics';\n\n  app.get(path, async (ctx: unknown): Promise<unknown> => {\n    const registry = opts.registry ?? (await loadDefaultRegistry());\n    const ctxWithSet = ctx as { set?: { status?: number; headers?: Record<string, string> } };\n    if (!registry) {\n      if (ctxWithSet.set) ctxWithSet.set.status = 503;\n      return '# prom-client not installed\\n';\n    }\n    if (ctxWithSet.set) {\n      ctxWithSet.set.status = 200;\n      ctxWithSet.set.headers = {\n        'content-type': registry.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n      };\n    }\n    return registry.metrics();\n  });\n\n  return app;\n}\n\n/**\n * Legacy export name used by the service template. Composes the Elysia\n * plugin-style function that `new Elysia().use(...)` accepts.\n */\nexport function createMetricsRoutes(opts: MetricsMountOptions = {}): unknown {\n  return (app: Parameters<typeof createMetricsRoutesImpl>[0]): unknown => createMetricsRoutesImpl(app, opts);\n}\n","/**\n * Prisma client extension that pipes query events through the SDK logger\n * with trace/span correlation fields auto-injected. The\n * `@prisma/instrumentation` peer provides the spans\n * themselves; this extension only adds structured log events on top.\n */\nimport type { Logger } from '../logger/index.js';\nimport { redactSensitiveFields } from '../logger/index.js';\n\ntype PrismaQueryArgs = {\n  model?: string;\n  operation: string;\n  args: unknown;\n  query: (args: unknown) => Promise<unknown>;\n};\n\n/**\n * Returns a Prisma Client extension object compatible with the\n * `$extends()` API (Prisma v5+).\n *\n * ```ts\n * export const prisma = new PrismaClient().$extends(\n *   createPrismaLoggingExtension(logger)\n * );\n * ```\n */\nexport function createPrismaLoggingExtension(logger: Logger): {\n  name: string;\n  query: {\n    $allOperations: (args: PrismaQueryArgs) => Promise<unknown>;\n  };\n} {\n  return {\n    name: 'burdenoff-pino-logging',\n    query: {\n      async $allOperations({ model, operation, args, query }: PrismaQueryArgs): Promise<unknown> {\n        const start = Date.now();\n        try {\n          const result = await query(args);\n          logger.debug('prisma.query', {\n            model,\n            operation,\n            duration_ms: Date.now() - start,\n            args: redactSensitiveFields(args),\n          });\n          return result;\n        } catch (err) {\n          logger.error('prisma.error', {\n            model,\n            operation,\n            duration_ms: Date.now() - start,\n            error: err instanceof Error ? err.message : String(err),\n          });\n          throw err;\n        }\n      },\n    },\n  };\n}\n","/**\n * Unified telemetry bootstrap for Burdenoff services.\n *\n * Composes the existing `instrumentation/` + `observability/` + `logger/`\n * modules and adds:\n *   - `bootstrapTelemetry({ serviceName, boundary, module, env })` — single\n *     call that initializes OTel, wires Pino logger with trace fields,\n *     exposes GraphQL Yoga plugins, registers process exit hooks.\n *   - `createHealthRoutes({ prisma, nats, valkey, version })` — `/health`,\n *     `/health/live`, `/health/ready` Elysia routes.\n *   - `createMetricsRoutes(registry?)` — `/metrics` Prometheus exposition.\n *   - `createPrismaLoggingExtension(logger)` — Prisma extension that pipes\n *     query events through Pino with trace/span correlation ids.\n *\n * The module does not pull in `@opentelemetry/sdk-node` or `pino` as direct\n * deps — services install those as optional peers, and imports are lazy so\n * services that don't install them still load.\n */\n\nimport type { Logger as BaseLogger } from '../logger/index.js';\nimport { logger as defaultLogger } from '../logger/index.js';\nimport {\n  initializeInstrumentation,\n  setupInstrumentation,\n  type SetupInstrumentationOptions,\n  type InstrumentationSetupResult,\n} from '../instrumentation/index.js';\nimport { setActiveTelemetryLogger } from './logger-state.js';\nimport type { OtelSdkHandle } from './sdk.js';\n\nexport { createHealthRoutes } from './health.js';\nexport { createMetricsRoutes } from './metrics-endpoint.js';\nexport { createPrismaLoggingExtension } from './prisma-logging.js';\nexport { DEFAULT_REDACT_PATHS } from './pino-redaction.js';\nexport { createPinoLogger } from './pino-logger.js';\n\nexport type Boundary = 'wspace' | 'global' | 'gateway';\nexport type Env = 'alpha' | 'prod' | 'dev';\n\nexport interface TelemetryConfig {\n  /** Full service name, e.g. \"wspace-auth-svc\". */\n  serviceName: string;\n  /** Semver of the service deployment; defaults to `process.env.npm_package_version`. */\n  serviceVersion?: string;\n  /** Monorepo boundary: `wspace`, `global`, or `gateway`. */\n  boundary: Boundary;\n  /** Module slug, e.g. `auth` (omit for gateways). */\n  module?: string;\n  /** Deployment environment; defaults to alpha for non-production NODE_ENV. */\n  env?: Env;\n  /**\n   * OTLP endpoint for spans/metrics/logs. Defaults to\n   * `$OTEL_EXPORTER_OTLP_ENDPOINT` or\n   * `http://alloy.sre.svc.cluster.local:4318`.\n   */\n  otlpEndpoint?: string;\n  /** Head-based sampling ratio. Default: alpha=1.0, prod=0.1. */\n  sampleRatio?: number;\n  /** Extra options forwarded to `setupInstrumentation`. */\n  instrumentation?: SetupInstrumentationOptions;\n}\n\nexport interface TelemetryHandle {\n  /** The configured service name (for use in health routes, etc.). */\n  serviceName: string;\n  /** The resolved service version. */\n  serviceVersion: string;\n  /** Environment. */\n  env: Env;\n  /** The Pino-backed logger. */\n  logger: BaseLogger;\n  /** Initialized instrumentation (tracer + metrics + plugins). */\n  instrumentation: InstrumentationSetupResult;\n  /** Cleanup hook; services call on SIGTERM. */\n  shutdown: () => Promise<void>;\n}\n\nfunction resolveEnv(explicit?: Env): Env {\n  if (explicit) return explicit;\n  const fromEnv = process.env['DEPLOY_ENV'] ?? process.env['NODE_ENV'] ?? '';\n  if (fromEnv === 'production' || fromEnv === 'prod') return 'prod';\n  if (fromEnv === 'development' || fromEnv === 'dev') return 'dev';\n  return 'alpha';\n}\n\nfunction resolveVersion(explicit?: string): string {\n  if (explicit) return explicit;\n  return process.env['npm_package_version'] ?? process.env['SERVICE_VERSION'] ?? '0.0.0';\n}\n\nfunction resolveEndpoint(explicit?: string): string {\n  if (explicit) return explicit;\n  const proto = 'http';\n  return process.env['OTEL_EXPORTER_OTLP_ENDPOINT'] ?? `${proto}://alloy.sre.svc.cluster.local:4318`;\n}\n\nfunction resolveSampling(explicit: number | undefined, env: Env): number {\n  if (typeof explicit === 'number' && Number.isFinite(explicit)) return Math.min(1, Math.max(0, explicit));\n  const fromEnv = process.env['OTEL_TRACES_SAMPLER_ARG'];\n  if (fromEnv) {\n    const parsed = Number(fromEnv);\n    if (Number.isFinite(parsed)) return Math.min(1, Math.max(0, parsed));\n  }\n  if (env === 'prod') return 0.1;\n  return 1.0;\n}\n\nfunction resolveOtelSdkEnabled(): boolean {\n  const sdkDisabled = process.env['OTEL_SDK_DISABLED'];\n  if (sdkDisabled === 'true' || sdkDisabled === '1') return false;\n  const otelEnabled = process.env['OTEL_ENABLED'];\n  if (otelEnabled === 'false' || otelEnabled === '0') return false;\n  return true;\n}\n\n/**\n * Bootstrap the full telemetry stack for a service.\n *\n * Services call this ONCE at startup **before** importing Prisma / GraphQL\n * Yoga / NATS so OTel can auto-instrument their dependencies.\n *\n * ```ts\n * // src/telemetry.ts\n * import { bootstrapTelemetry } from '@burdenoff/be-sdk/telemetry';\n * export const telemetry = await bootstrapTelemetry({\n *   serviceName: 'wspace-auth-svc',\n *   boundary: 'wspace',\n *   module: 'auth',\n * });\n *\n * // src/index.ts — must be the FIRST import line.\n * import './telemetry.js';\n * ```\n */\nexport async function bootstrapTelemetry(cfg: TelemetryConfig): Promise<TelemetryHandle> {\n  const env = resolveEnv(cfg.env);\n  const serviceVersion = resolveVersion(cfg.serviceVersion);\n  const otlpEndpoint = resolveEndpoint(cfg.otlpEndpoint);\n  const sampleRatio = resolveSampling(cfg.sampleRatio, env);\n\n  // Pino logger with trace/span correlation + redaction.\n  // createPinoLogger is async (loads pino via dynamic import); awaiting it\n  // is required — without await, `logger` is a Promise and calls like\n  // logger.warn(...) crash with \"logger.warn is not a function\" during the\n  // sdk-node fallback path.\n  const { createPinoLogger } = await import('./pino-logger.js');\n  const logger = await createPinoLogger({\n    serviceName: cfg.serviceName,\n    env,\n    version: serviceVersion,\n  });\n  setActiveTelemetryLogger(logger);\n\n  // Initialize core instrumentation (tracer, metrics registry, envelop plugins).\n  // `setupInstrumentation` internally calls `initializeInstrumentation`.\n  const instrumentation = setupInstrumentation(cfg.serviceName, {\n    ...cfg.instrumentation,\n    tracing: {\n      serviceName: cfg.serviceName,\n      ...(cfg.instrumentation?.tracing ?? {}),\n      samplingRate: sampleRatio,\n    },\n    metrics: {\n      serviceName: cfg.serviceName,\n      ...(cfg.instrumentation?.metrics ?? {}),\n    },\n  });\n\n  // Start the NodeSDK exporter pipeline if sdk-node is present (optional).\n  let otelSdk: OtelSdkHandle | undefined;\n  if (resolveOtelSdkEnabled()) {\n    try {\n      const { createOtelSdk } = await import('./sdk.js');\n      otelSdk = await createOtelSdk({\n        serviceName: cfg.serviceName,\n        serviceVersion,\n        boundary: cfg.boundary,\n        module: cfg.module,\n        env,\n        otlpEndpoint,\n        sampleRatio,\n      });\n      // Explicit success log includes metrics path status so an operator can\n      // distinguish traces-only startup from full traces+metrics startup.\n      logger.info('[telemetry] OpenTelemetry exporter pipeline started', {\n        serviceName: cfg.serviceName,\n        otlpEndpoint: otlpEndpoint ? '<configured>' : '<not set>',\n        sampleRatio,\n        metricsEnabled: otelSdk.metricsEnabled,\n      });\n\n      if (!otelSdk.metricsEnabled && otelSdk.metricsDropReason) {\n        logger.warn('[telemetry] OpenTelemetry metrics reader disabled; continuing with traces only', {\n          serviceName: cfg.serviceName,\n          reason: otelSdk.metricsDropReason,\n        });\n      }\n    } catch (err) {\n      logger.warn('[telemetry] OpenTelemetry exporter pipeline failed to start; continuing with logs only', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  } else {\n    logger.info('[telemetry] OTel SDK exporter disabled by env');\n  }\n\n  const shutdown = async (): Promise<void> => {\n    try {\n      if (otelSdk?.shutdown) await otelSdk.shutdown();\n    } catch (err) {\n      logger.warn('[telemetry] shutdown error (ignored)', {\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  };\n\n  // Mirror defaultLogger so services that still use the singleton get trace-enriched output.\n  defaultLogger.setLevel(logger.getLevel?.() ?? 'info');\n\n  return {\n    serviceName: cfg.serviceName,\n    serviceVersion,\n    env,\n    logger: logger,\n    instrumentation,\n    shutdown,\n  };\n}\n\n// Re-export what services typically import.\nexport { initializeInstrumentation, setupInstrumentation };\n"]}