@burdenoff/be-sdk 2026.518.3 → 2026.521.2

package/dist/chunk-O2MEBPDT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rbac/directive.ts","../src/rbac/index.ts"],"names":["LRUCache","cache","Map","maxSize","ttl","get","key","entry","undefined","Date","now","expiry","delete","set","value","size","firstKey","keys","next","clear","invalidateByPrefix","prefix","count","startsWith","RBACClient","client","config","GraphQLClient","rbacServiceUrl","failClosed","layer","enableCaching","cacheMaxSize","cacheTTL","parsePermission","permission","colonIndex","indexOf","resourceType","action","substring","checkPermission","actorId","actorType","scopeId","resourceId","cacheKey","cached","logger","debug","hasPermission","reason","CHECK_PERMISSION_QUERY","input","result","request","allowed","decisionPath","error","warn","clearCache","invalidateForActor","info","entriesRemoved","getLayer","getValueAtPath","obj","path","parts","split","current","part","getDirectiveArgument","directive","name","arg","arguments","find","a","kind","parseFieldArguments","field","variableValues","args","argName","argValue","parseObjectValue","fields","fieldName","fieldValue","toActorId","userId","sanitizeHeadersForLogging","headers","sanitized","Object","entries","lowerKey","toLowerCase","includes","getHeader","context","requestHeaders","contextHeaders","validateBypassTimestamp","timestamp","timestampMs","parseInt","isNaN","age","MAX_AGE","errorMessage","Error","message","checkBypassHeaders","shouldBypass","hasRequest","hasRequestHeaders","hasContextHeaders","requestHeadersType","contextHeadersType","allHeaders","forEach","sanitizedHeaders","contextHeadersObj","bypassHeader","bypassSource","bypassTimestamp","bypassAttempted","hasRbacBypass","hasBypassSource","hasBypassTimestamp","bypassContext","bypassFailureReason","source","verifyAuthentication","contextValue","ctx","user","actor","id","email","workspace_id","workspace","hasUser","GraphQLError","extensions","code","resolveResourceId","resourceIdField","selection","_rbacClient","_ctx","fieldArgs","availableArgs","hint","defaultPaths","contextWorkspaceId","triedPaths","join","resourceResolver","resolved","originalResourceId","resolvedResourceId","extractScopeId","workspaceId","tenantId","tenant","extractActorType","actorTypeHeader","upperType","toUpperCase","checkAndEnforcePermission","rbacClient","reasonSuffix","createRBACDirective","skipRbac","process","env","isProduction","onExecute","document","operation","definitions","def","operationName","schema","typeName","type","getType","getFields","selectionSet","selections","fieldDef","astNode","directives","d","bypassCheckResult","resource","operationType","buildRBACServiceUrl","routing","DEFAULT_GATEWAY_ROUTING","gateway","internalGateway","crossLayerGateway","host","port","graphqlPath","createRBACDirectiveForLayer","envPrefix","rbacLayer","timeout","createRBACDirectiveFromEnv","serviceName","createRBACClientFromEnv","options","DEFAULT_LAYER_RESOURCES","rbacGatewayUrl","RBACModule","requirePermission","ValidationError","query","variables","response","tenantQuery","PermissionDeniedError","getUserRoles","contextWithWorkspace","actorRoleAssignments","map","assignment","role","description","defaultPermissions","assignRoleToUser","roleId","mutation","removeRoleFromUser","findQuery","findResponse","assignmentId","createRole","permissionCount","length","createRoleMutation","createRoleVariables","scopeType","createResponse","normalizedPermissions","perm","level","permMap","levelPriority","ADMIN","EDITOR","VIEWER","NONE","existing","setPermissionMutation","failedPermissions","errorMsg","String","push","failedTypes","p","roleQuery","roleResponse","getAvailablePermissions","resourceTypesQuery","hasWorkspace","resourceTypesResponse","permissions","actionsQuery","resourceTypes","actionsResponse","actionDefinitions","checkMultiplePermissions","checks","inputs","check","some","c","checkPermissions","getEffectivePermissions","effectivePermissions","initializeWorkspaceRoles","ownerId","updateRole","updates","deleteRole","reassignToRoleId","success","listRoles","filter","includeSystem","pagination","limit","offset","roles","getRole"],"mappings":";;;;;;;AAqLA,IAAMA,QAAAA,GAAN,MAAMA,SAAAA,CAAAA;EArLN;;;AAsLUC,EAAAA,KAAAA,uBAAYC,GAAAA,EAAAA;AACZC,EAAAA,OAAAA;AACAC,EAAAA,GAAAA;AAER,EAAA,WAAA,CAAYD,SAAiBC,GAAAA,EAAa;AACxC,IAAA,IAAA,CAAKD,OAAAA,GAAUA,OAAAA;AACf,IAAA,IAAA,CAAKC,GAAAA,GAAMA,GAAAA;AACb,EAAA;AAEAC,EAAAA,GAAAA,CAAIC,GAAAA,EAAuB;AACzB,IAAA,MAAMC,KAAAA,GAAQ,IAAA,CAAKN,KAAAA,CAAMI,GAAAA,CAAIC,GAAAA,CAAAA;AAC7B,IAAA,IAAI,CAACC,OAAO,OAAOC,MAAAA;AAEnB,IAAA,IAAIC,IAAAA,CAAKC,GAAAA,EAAG,GAAKH,KAAAA,CAAMI,MAAAA,EAAQ;AAC7B,MAAA,IAAA,CAAKV,KAAAA,CAAMW,OAAON,GAAAA,CAAAA;AAClB,MAAA,OAAOE,MAAAA;AACT,IAAA;AAGA,IAAA,IAAA,CAAKP,KAAAA,CAAMW,OAAON,GAAAA,CAAAA;AAClB,IAAA,IAAA,CAAKL,KAAAA,CAAMY,GAAAA,CAAIP,GAAAA,EAAKC,KAAAA,CAAAA;AAEpB,IAAA,OAAOA,KAAAA,CAAMO,KAAAA;AACf,EAAA;AAEAD,EAAAA,GAAAA,CAAIP,KAAQQ,KAAAA,EAAgB;AAE1B,IAAA,IAAI,IAAA,CAAKb,KAAAA,CAAMc,IAAAA,IAAQ,IAAA,CAAKZ,OAAAA,EAAS;AACnC,MAAA,MAAMa,WAAW,IAAA,CAAKf,KAAAA,CAAMgB,IAAAA,EAAI,CAAGC,MAAI,CAAGJ,KAAAA;AAC1C,MAAA,IAAIE,aAAaR,MAAAA,EAAW;AAC1B,QAAA,IAAA,CAAKP,KAAAA,CAAMW,OAAOI,QAAAA,CAAAA;AACpB,MAAA;AACF,IAAA;AAEA,IAAA,IAAA,CAAKf,KAAAA,CAAMY,IAAIP,GAAAA,EAAK;AAClBQ,MAAAA,KAAAA;MACAH,MAAAA,EAAQF,IAAAA,CAAKC,GAAAA,EAAG,GAAK,IAAA,CAAKN;KAC5B,CAAA;AACF,EAAA;EAEAe,KAAAA,GAAc;AACZ,IAAA,IAAA,CAAKlB,MAAMkB,KAAAA,EAAK;AAClB,EAAA;;;;;AAMAC,EAAAA,kBAAAA,CAAmBC,MAAAA,EAAwB;AACzC,IAAA,IAAIC,KAAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAWhB,GAAAA,IAAO;AAAI,MAAA,GAAA,IAAA,CAAKL,MAAMgB,IAAAA;AAAS,KAAA,EAAA;AACxC,MAAA,IAAI,OAAOX,GAAAA,KAAQ,QAAA,IAAYA,GAAAA,CAAIiB,UAAAA,CAAWF,MAAAA,CAAAA,EAAS;AACrD,QAAA,IAAA,CAAKpB,KAAAA,CAAMW,OAAON,GAAAA,CAAAA;AAClBgB,QAAAA,KAAAA,EAAAA;AACF,MAAA;AACF,IAAA;AACA,IAAA,OAAOA,KAAAA;AACT,EAAA;AACF,CAAA;AAiBA,IAAME,UAAAA,GAAN,MAAMA,WAAAA,CAAAA;EAjQN;;;AAkQUC,EAAAA,MAAAA;AACAxB,EAAAA,KAAAA;AACAyB,EAAAA,MAAAA;AAER,EAAA,WAAA,CAAYA,MAAAA,EAA6B;AACvC,IAAA,IAAA,CAAKD,MAAAA,GAAS,IAAIE,aAAAA,CAAcD,MAAAA,CAAOE,cAAc,CAAA;AAErD,IAAA,IAAA,CAAKF,MAAAA,GAAS;AACZG,MAAAA,UAAAA,EAAYH,OAAOG,UAAAA,KAAe,KAAA;AAClCC,MAAAA,KAAAA,EAAOJ,OAAOI,KAAAA,IAAS;AACzB,KAAA;AAEA,IAAA,IAAIJ,MAAAA,CAAOK,kBAAkB,KAAA,EAAO;AAClC,MAAA,IAAA,CAAK9B,QAAQ,IAAID,QAAAA;AACf0B,QAAAA,MAAAA,CAAOM,YAAAA,IAAgB,GAAA;AACvBN,QAAAA,MAAAA,CAAOO,QAAAA,IAAY;;;AAEvB,IAAA;AACF,EAAA;;;;;;AAOQC,EAAAA,eAAAA,CAAgBC,UAAAA,EAA8D;AACpF,IAAA,MAAMC,UAAAA,GAAaD,UAAAA,CAAWE,OAAAA,CAAQ,GAAA,CAAA;AACtC,IAAA,IAAID,eAAe,EAAA,EAAI;AAErB,MAAA,OAAO;QAAEE,YAAAA,EAAcH,UAAAA;QAAYI,MAAAA,EAAQ;AAAO,OAAA;AACpD,IAAA;AACA,IAAA,OAAO;MACLD,YAAAA,EAAcH,UAAAA,CAAWK,SAAAA,CAAU,CAAA,EAAGJ,UAAAA,CAAAA;MACtCG,MAAAA,EAAQJ,UAAAA,CAAWK,SAAAA,CAAUJ,UAAAA,GAAa,CAAA;AAC5C,KAAA;AACF,EAAA;;;;AAKA,EAAA,MAAMK,eAAAA,CACJC,OAAAA,EACAC,SAAAA,EACAC,OAAAA,EACAT,YACAU,UAAAA,EACgC;AAChC,IAAA,MAAM,EAAEP,YAAAA,EAAcC,MAAAA,EAAM,GAAK,IAAA,CAAKL,gBAAgBC,UAAAA,CAAAA;AACtD,IAAA,MAAMW,QAAAA,GAAW,CAAA,EAAGJ,OAAAA,CAAAA,CAAAA,EAAWC,SAAAA,CAAAA,CAAAA,EAAaC,OAAAA,CAAAA,CAAAA,EAAWN,YAAAA,CAAAA,CAAAA,EAAgBC,MAAAA,CAAAA,CAAAA,EAAUM,cAAc,EAAA,CAAA,CAAA;AAG/F,IAAA,IAAI,KAAK5C,KAAAA,EAAO;AACd,MAAA,MAAM8C,MAAAA,GAAS,IAAA,CAAK9C,KAAAA,CAAMI,GAAAA,CAAIyC,QAAAA,CAAAA;AAC9B,MAAA,IAAIC,WAAWvC,MAAAA,EAAW;AACxBwC,QAAAA,MAAAA,CAAOC,MAAM,4BAAA,EAA8B;AACzCP,UAAAA,OAAAA;AACAC,UAAAA,SAAAA;AACAC,UAAAA,OAAAA;AACAN,UAAAA,YAAAA;AACAC,UAAAA,MAAAA;AACAM,UAAAA,UAAAA;UACAK,aAAAA,EAAeH;SACjB,CAAA;AACA,QAAA,OAAO;UACLG,aAAAA,EAAeH,MAAAA;AACfI,UAAAA,MAAAA,EAAQJ,SAAS,4BAAA,GAA+B;AAClD,SAAA;AACF,MAAA;AACF,IAAA;AAGA,IAAA,MAAMK,sBAAAA,GAAyB;;;;;;;;;;;AAY/B,IAAA,MAAMC,KAAAA,GAA8B;AAClCX,MAAAA,OAAAA;AACAC,MAAAA,SAAAA;AACAC,MAAAA,OAAAA;AACAN,MAAAA,YAAAA;AACAC,MAAAA,MAAAA;AACAM,MAAAA;AACF,KAAA;AAEA,IAAA,IAAI;AACFG,MAAAA,MAAAA,CAAOC,MAAM,8DAAA,EAAgE;AAC3EI,QAAAA,KAAAA;AACAvB,QAAAA,KAAAA,EAAO,KAAKJ,MAAAA,CAAOI;OACrB,CAAA;AAEA,MAAA,MAAMwB,MAAAA,GAAS,MAAM,IAAA,CAAK7B,MAAAA,CAAO8B,QAQ9BH,sBAAAA,EAAwB;AAAEC,QAAAA;OAAM,CAAA;AAEnC,MAAA,MAAMH,aAAAA,GAAgBI,OAAOb,eAAAA,CAAgBe,OAAAA;AAC7C,MAAA,MAAMC,YAAAA,GAAeH,OAAOb,eAAAA,CAAgBgB,YAAAA;AAG5C,MAAA,IAAI,KAAKxD,KAAAA,EAAO;AACd,QAAA,IAAA,CAAKA,KAAAA,CAAMY,GAAAA,CAAIiC,QAAAA,EAAUI,aAAAA,CAAAA;AAC3B,MAAA;AAEAF,MAAAA,MAAAA,CAAOC,MAAM,0CAAA,EAA4C;AACvDP,QAAAA,OAAAA;AACAJ,QAAAA,YAAAA;AACAC,QAAAA,MAAAA;AACAW,QAAAA,aAAAA;AACAO,QAAAA;OACF,CAAA;AAEA,MAAA,OAAO;AACLP,QAAAA,aAAAA;QACAC,MAAAA,EAAQM;AACV,OAAA;AACF,IAAA,CAAA,CAAA,OAASC,KAAAA,EAAO;AACdV,MAAAA,MAAAA,CAAOU,MAAM,qCAAA,EAAuC;AAClDA,QAAAA,KAAAA;AACAL,QAAAA,KAAAA;AACAvB,QAAAA,KAAAA,EAAO,KAAKJ,MAAAA,CAAOI;OACrB,CAAA;AAGA,MAAA,IAAI,IAAA,CAAKJ,OAAOG,UAAAA,EAAY;AAC1B,QAAA,OAAO;UACLqB,aAAAA,EAAe,KAAA;UACfC,MAAAA,EAAQ;AACV,SAAA;MACF,CAAA,MAAO;AACLH,QAAAA,MAAAA,CAAOW,KAAK,qEAAA,CAAA;AACZ,QAAA,OAAO;UACLT,aAAAA,EAAe,IAAA;UACfC,MAAAA,EAAQ;AACV,SAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;;;;EAKAS,UAAAA,GAAmB;AACjB,IAAA,IAAA,CAAK3D,OAAOkB,KAAAA,EAAAA;AACd,EAAA;;;;;;;;AASA0C,EAAAA,kBAAAA,CAAmBnB,OAAAA,EAAyB;AAC1C,IAAA,IAAI,CAAC,IAAA,CAAKzC,KAAAA,EAAO,OAAO,CAAA;AACxB,IAAA,MAAMqB,QAAQ,IAAA,CAAKrB,KAAAA,CAAMmB,kBAAAA,CAAmB,CAAA,EAAGsB,OAAAA,CAAAA,CAAAA,CAAU,CAAA;AACzD,IAAA,IAAIpB,QAAQ,CAAA,EAAG;AACb0B,MAAAA,MAAAA,CAAOc,KAAK,2DAAA,EAA6D;AAAEpB,QAAAA,OAAAA;QAASqB,cAAAA,EAAgBzC;OAAM,CAAA;AAC5G,IAAA;AACA,IAAA,OAAOA,KAAAA;AACT,EAAA;;;;EAKA0C,QAAAA,GAAsB;AACpB,IAAA,OAAO,KAAKtC,MAAAA,CAAOI,KAAAA;AACrB,EAAA;AACF;AAMA,SAASmC,cAAAA,CAAeC,KAA8BC,IAAAA,EAAY;AAChE,EAAA,MAAMC,KAAAA,GAAQD,IAAAA,CAAKE,KAAAA,CAAM,GAAA,CAAA;AACzB,EAAA,IAAIC,OAAAA,GAAmBJ,GAAAA;AAEvB,EAAA,KAAA,MAAWK,QAAQH,KAAAA,EAAO;AACxB,IAAA,IAAIE,OAAAA,KAAY,IAAA,IAAQA,OAAAA,KAAY9D,MAAAA,EAAW;AAC7C,MAAA,OAAOA,MAAAA;AACT,IAAA;AAEA,IAAA,IAAI,OAAO8D,YAAY,QAAA,EAAU;AAC/B,MAAA,OAAO9D,MAAAA;AACT,IAAA;AACA8D,IAAAA,OAAAA,GAAWA,QAAoCC,IAAAA,CAAAA;AACjD,EAAA;AAEA,EAAA,OAAO,OAAOD,OAAAA,KAAY,QAAA,GAAWA,OAAAA,GAAU9D,MAAAA;AACjD;AAhBSyD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAqBT,SAASO,oBAAAA,CAAqBC,WAAoDC,IAAAA,EAAY;AAC5F,EAAA,MAAMC,GAAAA,GAAMF,UAAUG,SAAAA,EAAWC,IAAAA,CAAK,CAACC,CAAAA,KAAoBA,CAAAA,CAAEJ,IAAAA,CAAK5D,KAAAA,KAAU4D,IAAAA,CAAAA;AAC5E,EAAA,IAAIC,GAAAA,IAAOA,GAAAA,CAAI7D,KAAAA,CAAMiE,IAAAA,KAAS,aAAA,EAAe;AAC3C,IAAA,OAAOJ,IAAI7D,KAAAA,CAAMA,KAAAA;AACnB,EAAA;AACA,EAAA,OAAON,MAAAA;AACT;AANSgE,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWT,SAASQ,mBAAAA,CAAoBC,OAAkBC,cAAAA,EAAuC;AACpF,EAAA,MAAMC,OAAgC,EAAC;AAEvC,EAAA,KAAA,MAAWR,GAAAA,IAAOM,KAAAA,CAAML,SAAAA,IAAa,EAAA,EAAI;AACvC,IAAA,MAAMQ,OAAAA,GAAUT,IAAID,IAAAA,CAAK5D,KAAAA;AACzB,IAAA,MAAMuE,WAAWV,GAAAA,CAAI7D,KAAAA;AAErB,IAAA,IAAIuE,QAAAA,CAASN,SAAS,UAAA,EAAY;AAChCI,MAAAA,IAAAA,CAAKC,OAAAA,CAAAA,GAAWF,cAAAA,CAAeG,QAAAA,CAASX,KAAK5D,KAAK,CAAA;IACpD,CAAA,MAAA,IAAWuE,QAAAA,CAASN,SAAS,aAAA,EAAe;AAC1CI,MAAAA,IAAAA,CAAKC,OAAAA,CAAAA,GAAWE,gBAAAA,CAAiBD,QAAAA,EAAUH,cAAAA,CAAAA;AAC7C,IAAA,CAAA,MAAA,IAAW,WAAWG,QAAAA,EAAU;AAC9BF,MAAAA,IAAAA,CAAKC,OAAAA,IAAWC,QAAAA,CAASvE,KAAAA;AAC3B,IAAA;AACF,EAAA;AAEA,EAAA,OAAOqE,IAAAA;AACT;AAjBSH,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAsBT,SAASM,gBAAAA,CAAiBpB,KAAsBgB,cAAAA,EAAuC;AACrF,EAAA,MAAM5B,SAAkC,EAAC;AAEzC,EAAA,KAAA,MAAW2B,KAAAA,IAASf,GAAAA,CAAIqB,MAAAA,IAAU,EAAA,EAAI;AACpC,IAAA,MAAMC,SAAAA,GAAYP,MAAMP,IAAAA,CAAK5D,KAAAA;AAC7B,IAAA,MAAM2E,aAAaR,KAAAA,CAAMnE,KAAAA;AAEzB,IAAA,IAAI2E,UAAAA,CAAWV,SAAS,UAAA,EAAY;AAClCzB,MAAAA,MAAAA,CAAOkC,SAAAA,CAAAA,GAAaN,cAAAA,CAAeO,UAAAA,CAAWf,KAAK5D,KAAK,CAAA;IAC1D,CAAA,MAAA,IAAW2E,UAAAA,CAAWV,SAAS,aAAA,EAAe;AAC5CzB,MAAAA,MAAAA,CAAOkC,SAAAA,CAAAA,GAAaF,gBAAAA,CAAiBG,UAAAA,EAAYP,cAAAA,CAAAA;AACnD,IAAA,CAAA,MAAA,IAAW,WAAWO,UAAAA,EAAY;AAChCnC,MAAAA,MAAAA,CAAOkC,SAAAA,IAAaC,UAAAA,CAAW3E,KAAAA;AACjC,IAAA;AACF,EAAA;AAEA,EAAA,OAAOwC,MAAAA;AACT;AAjBSgC,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAqCT,SAASI,UAAUC,MAAAA,EAAc;AAC/B,EAAA,OAAOA,MAAAA;AACT;AAFSD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAST,SAASE,0BAA0BC,OAAAA,EAA+B;AAChE,EAAA,MAAMC,YAAoC,EAAC;AAE3C,EAAA,KAAA,MAAW,CAACxF,GAAAA,EAAKQ,KAAAA,KAAUiF,MAAAA,CAAOC,OAAAA,CAAQH,OAAAA,CAAAA,EAAU;AAClD,IAAA,MAAMI,QAAAA,GAAW3F,IAAI4F,WAAAA,EAAW;AAGhC,IAAA,IACED,QAAAA,CAASE,SAAS,MAAA,CAAA,IAClBF,SAASE,QAAAA,CAAS,OAAA,CAAA,IAClBF,QAAAA,CAASE,QAAAA,CAAS,UAAA,KAClBF,QAAAA,CAASE,QAAAA,CAAS,QAAA,CAAA,IAClBF,QAAAA,CAASE,QAAAA,CAAS,KAAA,CAAA,IAClBF,QAAAA,CAASE,QAAAA,CAAS,YAAA,CAAA,EAClB;AACAL,MAAAA,SAAAA,CAAUxF,GAAAA,CAAAA,GAAO,gBAAA;IACnB,CAAA,MAAO;AACLwF,MAAAA,SAAAA,CAAUxF,GAAAA,CAAAA,GAAOQ,KAAAA;AACnB,IAAA;AACF,EAAA;AAEA,EAAA,OAAOgF,SAAAA;AACT;AAtBSF,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AA2BT,SAASQ,SAAAA,CAAUC,SAAsB/F,GAAAA,EAAW;AAElD,EAAA,IAAI+F,OAAAA,CAAQ9C,SAASsC,OAAAA,EAAS;AAE5B,IAAA,IAAI,OAAOQ,OAAAA,CAAQ9C,OAAAA,CAAQsC,OAAAA,CAAQxF,QAAQ,UAAA,EAAY;AACrD,MAAA,MAAMS,MAAAA,GAAQuF,OAAAA,CAAQ9C,OAAAA,CAAQsC,OAAAA,CAAQxF,IAAIC,GAAAA,CAAAA;AAC1C,MAAA,IAAIQ,QAAO,OAAOA,MAAAA;AACpB,IAAA;AAEA,IAAA,MAAMwF,cAAAA,GAAiBD,QAAQ9C,OAAAA,CAAQsC,OAAAA;AACvC,IAAA,MAAM/E,KAAAA,GAAQwF,eAAehG,GAAAA,CAAAA;AAC7B,IAAA,IAAIQ,OAAO,OAAOA,KAAAA;AACpB,EAAA;AAGA,EAAA,IAAIuF,QAAQR,OAAAA,EAAS;AACnB,IAAA,MAAMU,iBAAiBF,OAAAA,CAAQR,OAAAA;AAC/B,IAAA,MAAM/E,KAAAA,GAAQyF,eAAejG,GAAAA,CAAAA;AAC7B,IAAA,IAAIQ,OAAO,OAAOA,KAAAA;AACpB,EAAA;AAEA,EAAA,OAAON,MAAAA;AACT;AAtBS4F,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AA6BT,SAASI,wBAAwBC,SAAAA,EAAiB;AAChD,EAAA,IAAI;AACF,IAAA,MAAMC,WAAAA,GAAcC,QAAAA,CAASF,SAAAA,EAAW,EAAA,CAAA;AACxC,IAAA,IAAIG,KAAAA,CAAMF,WAAAA,CAAAA,EAAc;AACtB,MAAA,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,MAAMhG,GAAAA,GAAMD,KAAKC,GAAAA,EAAG;AACpB,IAAA,MAAMmG,MAAMnG,GAAAA,GAAMgG,WAAAA;AAClB,IAAA,MAAMI,UAAU,EAAA,GAAK,GAAA;AAErB,IAAA,IAAID,GAAAA,GAAMC,OAAAA,IAAWD,GAAAA,GAAM,CAAA,EAAG;AAC5B7D,MAAAA,MAAAA,CAAOW,KAAK,yCAAA,EAA2C;AACrDkD,QAAAA,GAAAA;QACAJ,SAAAA,EAAWC,WAAAA;AACXhG,QAAAA;OACF,CAAA;AACA,MAAA,OAAO,KAAA;AACT,IAAA;AAEA,IAAA,OAAO,IAAA;AACT,EAAA,CAAA,CAAA,OAASgD,KAAAA,EAAgB;AACvB,IAAA,MAAMqD,YAAAA,GAAerD,KAAAA,YAAiBsD,KAAAA,GAAQtD,KAAAA,CAAMuD,OAAAA,GAAU,eAAA;AAC9DjE,IAAAA,MAAAA,CAAOW,KAAK,kDAAA,EAAoD;AAC9D8C,MAAAA,SAAAA;MACA/C,KAAAA,EAAOqD;KACT,CAAA;AACA,IAAA,OAAO,KAAA;AACT,EAAA;AACF;AA7BSP,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAyET,SAASU,mBAAmBb,OAAAA,EAAoB;AAE9C,EAAA,MAAM1D,SAAAA,GAAYyD,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AACrC,EAAA,MAAM3D,OAAAA,GAAU0D,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAI1D,SAAAA,KAAc,SAAA,IAAaA,SAAAA,KAAc,aAAA,EAAe;AAC1DK,IAAAA,MAAAA,CAAOC,MAAM,0DAAA,EAA4D;AACvEN,MAAAA,SAAAA;AACAD,MAAAA;KACF,CAAA;AACA,IAAA,OAAO;MAAEyE,YAAAA,EAAc;AAAK,KAAA;AAC9B,EAAA;AAGAnE,EAAAA,MAAAA,CAAOC,MAAM,8DAAA,EAAgE;IAC3EmE,UAAAA,EAAY,CAAC,CAACf,OAAAA,CAAQ9C,OAAAA;IACtB8D,iBAAAA,EAAmB,CAAC,CAAChB,OAAAA,CAAQ9C,OAAAA,EAASsC,OAAAA;IACtCyB,iBAAAA,EAAmB,CAAC,CAACjB,OAAAA,CAAQR,OAAAA;AAC7B0B,IAAAA,kBAAAA,EAAoBlB,QAAQ9C,OAAAA,EAASsC,OAAAA,GAAU,OAAOQ,OAAAA,CAAQ9C,QAAQsC,OAAAA,GAAU,WAAA;AAChF2B,IAAAA,kBAAAA,EAAoBnB,OAAAA,CAAQR,OAAAA,GAAU,OAAOQ,OAAAA,CAAQR,OAAAA,GAAU,WAAA;AAC/DlD,IAAAA,SAAAA;AACAD,IAAAA;GACF,CAAA;AAGA,EAAA,MAAM+E,aAAqC,EAAC;AAC5C,EAAA,IAAIpB,OAAAA,CAAQ9C,SAASsC,OAAAA,EAAS;AAC5B,IAAA,IAAI,OAAOQ,OAAAA,CAAQ9C,OAAAA,CAAQsC,OAAAA,CAAQxF,QAAQ,UAAA,EAAY;AAErD2C,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,CAAA;IACf,CAAA,MAAO;AAEL,MAAA,MAAM4C,OAAAA,GAAUQ,QAAQ9C,OAAAA,CAAQsC,OAAAA;AAChCE,MAAAA,MAAAA,CAAO9E,IAAAA,CAAK4E,OAAAA,CAAAA,CAAS6B,OAAAA,CAAQ,CAACpH,GAAAA,KAAAA;AAC5B,QAAA,MAAMQ,KAAAA,GAAQ+E,QAAQvF,GAAAA,CAAAA;AACtB,QAAA,IAAIQ,KAAAA,EAAO2G,UAAAA,CAAWnH,GAAAA,CAAAA,GAAOQ,KAAAA;MAC/B,CAAA,CAAA;AACA,MAAA,MAAM6G,gBAAAA,GAAmB/B,0BAA0B6B,UAAAA,CAAAA;AACnDzE,MAAAA,MAAAA,CAAOC,MAAM,iDAAA,EAAmD;QAAE4C,OAAAA,EAAS8B;OAAiB,CAAA;AAC9F,IAAA;AACF,EAAA;AACA,EAAA,IAAItB,QAAQR,OAAAA,EAAS;AACnB,IAAA,MAAMA,UAAUQ,OAAAA,CAAQR,OAAAA;AACxB,IAAA,MAAM+B,oBAA4C,EAAC;AACnD7B,IAAAA,MAAAA,CAAO9E,IAAAA,CAAK4E,OAAAA,CAAAA,CAAS6B,OAAAA,CAAQ,CAACpH,GAAAA,KAAAA;AAC5B,MAAA,MAAMQ,KAAAA,GAAQ+E,QAAQvF,GAAAA,CAAAA;AACtB,MAAA,IAAIQ,KAAAA,EAAO8G,iBAAAA,CAAkBtH,GAAAA,CAAAA,GAAOQ,KAAAA;IACtC,CAAA,CAAA;AACA,IAAA,MAAM6G,gBAAAA,GAAmB/B,0BAA0BgC,iBAAAA,CAAAA;AACnD5E,IAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;MAAE4C,OAAAA,EAAS8B;KAAiB,CAAA;AAC/E,EAAA;AAEA,EAAA,MAAME,YAAAA,GAAezB,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACxC,EAAA,MAAMyB,YAAAA,GAAe1B,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAM0B,eAAAA,GAAkB3B,SAAAA,CAAUC,OAAAA,EAAS,oBAAA,CAAA;AAE3CrD,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxD4E,IAAAA,YAAAA;AACAC,IAAAA,YAAAA;AACAC,IAAAA;GACF,CAAA;AAGA,EAAA,MAAMC,eAAAA,GAAkB,CAAC,EAAEH,YAAAA,IAAgBC,YAAAA,IAAgBC,eAAAA,CAAAA;AAG3D,EAAA,IAAI,CAACF,YAAAA,IAAgB,CAACC,YAAAA,IAAgB,CAACC,eAAAA,EAAiB;AACtD/E,IAAAA,MAAAA,CAAOC,MAAM,8DAAA,EAAgE;AAC3EgF,MAAAA,aAAAA,EAAe,CAAC,CAACJ,YAAAA;AACjBK,MAAAA,eAAAA,EAAiB,CAAC,CAACJ,YAAAA;AACnBK,MAAAA,kBAAAA,EAAoB,CAAC,CAACJ;KACxB,CAAA;AAEA,IAAA,IAAIC,eAAAA,EAAiB;AACnB,MAAA,OAAO;QACLb,YAAAA,EAAc,KAAA;QACdiB,aAAAA,EAAe;UACbJ,eAAAA,EAAiB,IAAA;AACjBF,UAAAA,YAAAA;AACAC,UAAAA,eAAAA;UACAM,mBAAAA,EAAqB;AACvB;AACF,OAAA;AACF,IAAA;AAEA,IAAA,OAAO;MAAElB,YAAAA,EAAc;AAAM,KAAA;AAC/B,EAAA;AAGA,EAAA,IAAIU,iBAAiB,MAAA,EAAQ;AAC3B7E,IAAAA,MAAAA,CAAOW,KAAK,8CAAA,EAAgD;MAAE7C,KAAAA,EAAO+G;KAAa,CAAA;AAClF,IAAA,OAAO;MACLV,YAAAA,EAAc,KAAA;MACdiB,aAAAA,EAAe;QACbJ,eAAAA,EAAiB,IAAA;AACjBF,QAAAA,YAAAA;AACAC,QAAAA,eAAAA;AACAM,QAAAA,mBAAAA,EAAqB,gCAAgCR,YAAAA,CAAAA;AACvD;AACF,KAAA;AACF,EAAA;AAGA,EAAA,IAAI,CAACrB,uBAAAA,CAAwBuB,eAAAA,CAAAA,EAAkB;AAC7C/E,IAAAA,MAAAA,CAAOW,KAAK,mDAAA,EAAqD;MAC/D2E,MAAAA,EAAQR,YAAAA;MACRrB,SAAAA,EAAWsB;KACb,CAAA;AACA,IAAA,OAAO;MACLZ,YAAAA,EAAc,KAAA;MACdiB,aAAAA,EAAe;QACbJ,eAAAA,EAAiB,IAAA;AACjBF,QAAAA,YAAAA;AACAC,QAAAA,eAAAA;QACAM,mBAAAA,EAAqB;AACvB;AACF,KAAA;AACF,EAAA;AAGArF,EAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;IAC7DqF,MAAAA,EAAQR,YAAAA;IACRrB,SAAAA,EAAWsB;GACb,CAAA;AAEA,EAAA,OAAO;IAAEZ,YAAAA,EAAc;AAAK,GAAA;AAC9B;AA9HSD,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAmIT,SAASqB,oBAAAA,CAAqBC,YAAAA,EAAuBhD,SAAAA,EAAmBrD,UAAAA,EAAkB;AACxF,EAAA,MAAMsG,GAAAA,GAAMD,YAAAA;AACZ,EAAA,MAAME,IAAAA,GACJD,GAAAA,CAAIC,IAAAA,KACHD,GAAAA,CAAIE,OAAOC,EAAAA,GACR;AACEA,IAAAA,EAAAA,EAAIH,IAAIE,KAAAA,CAAMC,EAAAA;AACdC,IAAAA,KAAAA,EAAOJ,IAAIE,KAAAA,CAAME,KAAAA;AACjBC,IAAAA,YAAAA,EAAcL,IAAIM,SAAAA,EAAWH;AAC/B,GAAA,GACAH,IAAI/F,OAAAA,GACF;AACEkG,IAAAA,EAAAA,EAAIH,GAAAA,CAAI/F,OAAAA;AACRoG,IAAAA,YAAAA,EAAcL,IAAIM,SAAAA,EAAWH;GAC/B,GACApI,MAAAA,CAAAA;AAERwC,EAAAA,MAAAA,CAAOC,MAAM,0CAAA,EAA4C;AACvD+F,IAAAA,OAAAA,EAAS,CAAC,CAACN,IAAAA;AACX/C,IAAAA,MAAAA,EAAQ+C,IAAAA,EAAME,EAAAA;AACdpD,IAAAA;GACF,CAAA;AAEA,EAAA,IAAI,CAACkD,MAAME,EAAAA,EAAI;AACb5F,IAAAA,MAAAA,CAAOW,KAAK,6DAAA,EAA+D;AACzE6B,MAAAA,SAAAA;AACArD,MAAAA;KACF,CAAA;AACA,IAAA,MAAM,IAAI8G,aAAa,yBAAA,EAA2B;MAChDC,UAAAA,EAAY;QACVC,IAAAA,EAAM,iBAAA;QACNlE,KAAAA,EAAOO,SAAAA;AACPrD,QAAAA;AACF;KACF,CAAA;AACF,EAAA;AAEA,EAAA,OAAOuG,IAAAA;AACT;AAtCSH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AA2CT,eAAea,iBAAAA,CACbC,iBACAC,SAAAA,EACApE,cAAAA,EACAxD,QACA6H,WAAAA,EACAC,IAAAA,EACArH,YACAqD,SAAAA,EAAiB;AAEjB,EAAA,IAAI3C,UAAAA;AAGJ,EAAA,MAAM4G,SAAAA,GAAYzE,mBAAAA,CAAoBsE,SAAAA,EAAWpE,cAAAA,IAAkB,EAAC,CAAA;AAEpE,EAAA,IAAImE,eAAAA,EAAiB;AAEnBxG,IAAAA,UAAAA,GAAaoB,cAAAA,CAAewF,WAAWJ,eAAAA,CAAAA;AAEvC,IAAA,IAAI,CAACxG,UAAAA,EAAY;AACfG,MAAAA,MAAAA,CAAOU,MAAM,0DAAA,EAA4D;AACvE2F,QAAAA,eAAAA;AACA7D,QAAAA,SAAAA;AACArD,QAAAA,UAAAA;QACAuH,aAAAA,EAAe3D,MAAAA,CAAO9E,KAAKwI,SAAAA;OAC7B,CAAA;AAEA,MAAA,MAAM,IAAIR,YAAAA,CACR,CAAA,yCAAA,EAA4CI,eAAAA,CAAAA,kBAAAA,EAAoClH,UAAAA,CAAAA,CAAAA,CAAAA,EAChF;QACE+G,UAAAA,EAAY;UACVC,IAAAA,EAAM,gCAAA;UACNlE,KAAAA,EAAOO,SAAAA;AACPrD,UAAAA,UAAAA;AACAkH,UAAAA,eAAAA;AACAM,UAAAA,IAAAA,EAAM,8BAA8BN,eAAAA,CAAAA,0BAAAA;AACtC;OACF,CAAA;AAEJ,IAAA;AAEArG,IAAAA,MAAAA,CAAOC,MAAM,iDAAA,EAAmD;AAC9DoG,MAAAA,eAAAA;AACAxG,MAAAA,UAAAA;AACA2C,MAAAA;KACF,CAAA;EACF,CAAA,MAAO;AAEL,IAAA,MAAMoE,YAAAA,GAAe;AAAC,MAAA,IAAA;AAAM,MAAA;;AAE5B,IAAA,KAAA,MAAWzF,QAAQyF,YAAAA,EAAc;AAC/B/G,MAAAA,UAAAA,GAAaoB,cAAAA,CAAewF,WAAWtF,IAAAA,CAAAA;AACvC,MAAA,IAAItB,UAAAA,EAAY;AACdG,QAAAA,MAAAA,CAAOC,MAAM,4DAAA,EAA8D;AACzEkB,UAAAA,IAAAA;AACAtB,UAAAA,UAAAA;AACA2C,UAAAA,SAAAA;AACArD,UAAAA;SACF,CAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA,IAAI,CAACU,UAAAA,EAAY;AAGf,MAAA,MAAMgH,kBAAAA,GAAqBL,KAAKT,SAAAA,EAAWH,EAAAA;AAE3C,MAAA,IAAIiB,kBAAAA,EAAoB;AACtBhH,QAAAA,UAAAA,GAAagH,kBAAAA;AACb7G,QAAAA,MAAAA,CAAOC,MAAM,0DAAA,EAA4D;AACvEJ,UAAAA,UAAAA;AACA2C,UAAAA,SAAAA;AACArD,UAAAA;SACF,CAAA;MACF,CAAA,MAAO;AACLa,QAAAA,MAAAA,CAAOU,MAAM,gEAAA,EAAkE;AAC7EvB,UAAAA,UAAAA;AACAqD,UAAAA,SAAAA;UACAsE,UAAAA,EAAYF,YAAAA;UACZF,aAAAA,EAAe3D,MAAAA,CAAO9E,KAAKwI,SAAAA;SAC7B,CAAA;AAEA,QAAA,MAAM,IAAIR,aACR,CAAA,yBAAA,EAA4B9G,UAAAA,qDACFyH,YAAAA,CAAaG,IAAAA,CAAK,IAAA,CAAA,CAAA,gIAAA,CAAA,EAE5C;UACEb,UAAAA,EAAY;YACVC,IAAAA,EAAM,gCAAA;YACNlE,KAAAA,EAAOO,SAAAA;AACPrD,YAAAA,UAAAA;YACA2H,UAAAA,EAAYF,YAAAA;YACZD,IAAAA,EAAM;AACR;SACF,CAAA;AAEJ,MAAA;AACF,IAAA;AACF,EAAA;AAGA,EAAA,IAAI9G,UAAAA,IAAcnB,OAAOsI,gBAAAA,EAAkB;AACzC,IAAA,MAAMC,QAAAA,GAAW,MAAMvI,MAAAA,CAAOsI,gBAAAA,CAAiBnH,UAAAA,EAAYV,WAAWkC,KAAAA,CAAM,GAAA,CAAA,CAAK,CAAA,CAAE,CAAA;AAEnF,IAAA,IAAI,CAAC4F,QAAAA,EAAU;AACbjH,MAAAA,MAAAA,CAAOW,KAAK,yDAAA,EAA2D;QACrEuG,kBAAAA,EAAoBrH,UAAAA;AACpBV,QAAAA,UAAAA;AACAqD,QAAAA;OACF,CAAA;AAEA,MAAA,MAAM,IAAIyD,aAAa,+BAAA,EAAiC;QACtDC,UAAAA,EAAY;UACVC,IAAAA,EAAM,WAAA;UACNlE,KAAAA,EAAOO,SAAAA;AACPrD,UAAAA,UAAAA;AACAU,UAAAA,UAAAA;UACA8G,IAAAA,EAAM;AACR;OACF,CAAA;AACF,IAAA;AAEA3G,IAAAA,MAAAA,CAAOC,MAAM,mDAAA,EAAqD;MAChEiH,kBAAAA,EAAoBrH,UAAAA;MACpBsH,kBAAAA,EAAoBF,QAAAA;AACpBzE,MAAAA;KACF,CAAA;AAEA,IAAA,OAAOyE,QAAAA;AACT,EAAA;AAGA,EAAA,OAAOpH,UAAAA;AACT;AAtIeuG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AA2If,SAASgB,cAAAA,CAAe3B,KAAkB3G,KAAAA,EAAgB;AACxD,EAAA,IAAIA,UAAU,QAAA,EAAU;AAEtB,IAAA,MAAMuI,cAAcjE,SAAAA,CAAUqC,GAAAA,EAAK,gBAAA,CAAA,IAAqBA,IAAIM,SAAAA,EAAWH,EAAAA;AAEvE,IAAA,IAAI,CAACyB,WAAAA,EAAa;AAChB,MAAA,MAAM,IAAIpB,aAAa,gDAAA,EAAkD;QACvEC,UAAAA,EAAY;UAAEC,IAAAA,EAAM,aAAA;UAAeQ,IAAAA,EAAM;AAAgE;OAC3G,CAAA;AACF,IAAA;AACA,IAAA,OAAOU,WAAAA;EACT,CAAA,MAAO;AAEL,IAAA,MAAMC,WAAWlE,SAAAA,CAAUqC,GAAAA,EAAK,aAAA,CAAA,IAAkBA,GAAAA,CAAI8B,QAAQ3B,EAAAA,IAAM,QAAA;AAEpE,IAAA,OAAO0B,QAAAA;AACT,EAAA;AACF;AAjBSF,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASI,iBAAiB/B,GAAAA,EAAgB;AACxC,EAAA,MAAMgC,eAAAA,GAAkBrE,SAAAA,CAAUqC,GAAAA,EAAK,cAAA,CAAA;AAEvC,EAAA,IAAIgC,eAAAA,EAAiB;AACnB,IAAA,MAAMC,SAAAA,GAAYD,gBAAgBE,WAAAA,EAAW;AAC7C,IAAA,IAAI;AAAC,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,aAAA;AAAe,MAAA;AAAmBxE,KAAAA,CAAAA,QAAAA,CAASuE,SAAAA,CAAAA,EAAY;AACzE,MAAA,OAAOA,SAAAA;AACT,IAAA;AACF,EAAA;AAGA,EAAA,OAAO,MAAA;AACT;AAZSF,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,eAAeI,yBAAAA,CACbC,YACApC,GAAAA,EACA/F,OAAAA,EACAP,YACAgI,kBAAAA,EACAxE,MAAAA,EACAH,WACA4C,aAAAA,EAKC;AAED,EAAA,MAAMtG,KAAAA,GAAQ+I,WAAW7G,QAAAA,EAAQ;AACjC,EAAA,MAAMrB,SAAAA,GAAY6H,iBAAiB/B,GAAAA,CAAAA;AACnC,EAAA,MAAM7F,OAAAA,GAAUwH,cAAAA,CAAe3B,GAAAA,EAAK3G,KAAAA,CAAAA;AAEpCkB,EAAAA,MAAAA,CAAOc,KAAK,sCAAA,EAAwC;AAClD6B,IAAAA,MAAAA;AACAjD,IAAAA,OAAAA;AACAC,IAAAA,SAAAA;AACAC,IAAAA,OAAAA;AACAT,IAAAA,UAAAA;IACAU,UAAAA,EAAYsH,kBAAAA;AACZ3E,IAAAA,SAAAA;AACA1D,IAAAA,KAAAA;AACAkG,IAAAA,eAAAA,EAAiBI,eAAeJ,eAAAA,IAAmB;GACrD,CAAA;AAEA,EAAA,MAAM,EAAE9E,aAAAA,EAAeC,MAAAA,EAAM,GAAK,MAAM0H,UAAAA,CAAWpI,eAAAA,CACjDC,OAAAA,EACAC,SAAAA,EACAC,OAAAA,EACAT,UAAAA,EACAgI,kBAAAA,CAAAA;AAGF,EAAA,IAAI,CAACjH,aAAAA,EAAe;AAClBF,IAAAA,MAAAA,CAAOW,KAAK,oCAAA,EAAsC;AAChDgC,MAAAA,MAAAA;AACAhD,MAAAA,SAAAA;AACAC,MAAAA,OAAAA;AACAT,MAAAA,UAAAA;AACAgB,MAAAA,MAAAA;AACAqC,MAAAA,SAAAA;AACA4C,MAAAA;KACF,CAAA;AAEA,IAAA,MAAM0C,YAAAA,GAAe3H,MAAAA,GAAS,CAAA,GAAA,EAAMA,MAAAA,CAAAA,CAAAA,GAAW,EAAA;AAC/C,IAAA,MAAM4D,YAAAA,GAAe,CAAA,+BAAA,EAAkC5E,UAAAA,CAAAA,CAAAA,EAAc2I,YAAAA,CAAAA,CAAAA;AAGrE,IAAA,MAAM5B,UAAAA,GAAsC;MAC1CC,IAAAA,EAAM,WAAA;AACNhH,MAAAA,UAAAA;AACAgB,MAAAA,MAAAA;MACA8B,KAAAA,EAAOO,SAAAA;MACP3C,UAAAA,EAAYsH,kBAAAA;AACZvH,MAAAA,OAAAA;AACAd,MAAAA;AACF,KAAA;AAGA,IAAA,IAAIsG,eAAeJ,eAAAA,EAAiB;AAClCkB,MAAAA,UAAAA,CAAW,iBAAA,CAAA,GAAqB,IAAA;AAChCA,MAAAA,UAAAA,CAAW,cAAA,IAAkBd,aAAAA,CAAcN,YAAAA;AAC3CoB,MAAAA,UAAAA,CAAW,iBAAA,IAAqBd,aAAAA,CAAcL,eAAAA;AAC9CmB,MAAAA,UAAAA,CAAW,qBAAA,IAAyBd,aAAAA,CAAcC,mBAAAA;AACpD,IAAA;AAEA,IAAA,MAAM,IAAIY,aAAalC,YAAAA,EAAc;AAAEmC,MAAAA;KAAW,CAAA;AACpD,EAAA;AAEAlG,EAAAA,MAAAA,CAAOc,KAAK,qCAAA,EAAuC;AACjD6B,IAAAA,MAAAA;AACAxD,IAAAA,UAAAA;AACAqD,IAAAA,SAAAA;AACArC,IAAAA;GACF,CAAA;AACF;AAjFeyH,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAkHR,SAASG,oBAAoBrJ,MAAAA,EAA2B;AAE7D,EAAA,MAAMsJ,WAAWC,OAAAA,CAAQC,GAAAA,CAAI,WAAA,CAAA,KAAiB,MAAA,IAAUxJ,OAAOsJ,QAAAA,KAAa,IAAA;AAE5E,EAAA,IAAIA,QAAAA,EAAU;AACZ,IAAA,MAAMG,YAAAA,GAAeF,OAAAA,CAAQC,GAAAA,CAAI,UAAA,CAAA,KAAgB,YAAA;AAGjD,IAAA,IAAIC,YAAAA,EAAc;AAChB,MAAA,MAAM,IAAInE,MACR,iOAEE,CAAA;AAEN,IAAA;AAEAhE,IAAAA,MAAAA,CAAOW,KAAK,qGAAA,CAAA;AACZ,IAAA,OAAO;MACL,MAAMyH,SAAAA,CAAU,EAAEjG,IAAAA,EAAI,EAAE;AAEtB,QAAA,MAAM,EAAEkG,UAAQ,GAAKlG,IAAAA;AACrB,QAAA,MAAMmG,SAAAA,GAAYD,SAASE,WAAAA,CAAY1G,IAAAA,CACrC,CAAC2G,GAAAA,KAAwDA,GAAAA,CAAIzG,SAAS,qBAAA,CAAA;AAExE,QAAA,MAAM0G,aAAAA,GAAgBH,SAAAA,EAAW5G,IAAAA,EAAM5D,KAAAA,IAAS,WAAA;AAChDkC,QAAAA,MAAAA,CAAOW,KAAK,mDAAA,EAAqD;AAAE8H,UAAAA;SAAc,CAAA;AACnF,MAAA;AACF,KAAA;AACF,EAAA;AAEA,EAAA,MAAMZ,UAAAA,GAAa,IAAIrJ,UAAAA,CAAWE,MAAAA,CAAAA;AAElC,EAAA,OAAO;;IAEL,MAAM0J,SAAAA,CAAU,EAAEjG,IAAAA,EAAI,EAAE;AACtBnC,MAAAA,MAAAA,CAAOC,MAAM,mCAAA,CAAA;AACb,MAAA,MAAM,EAAEyI,MAAAA,EAAQL,QAAAA,EAAU7C,YAAAA,EAActD,gBAAc,GAAKC,IAAAA;AAG3D,MAAA,MAAMmG,SAAAA,GAAYD,SAASE,WAAAA,CAAY1G,IAAAA,CACrC,CAAC2G,GAAAA,KAAwDA,GAAAA,CAAIzG,SAAS,qBAAA,CAAA;AAGxE,MAAA,IAAI,CAACuG,SAAAA,EAAW;AACdtI,QAAAA,MAAAA,CAAOC,MAAM,0DAAA,CAAA;AACb,QAAA;AACF,MAAA;AAGA,MAAA,MAAM0I,QAAAA,GAAWL,SAAAA,CAAUA,SAAAA,KAAc,UAAA,GAAa,UAAA,GAAa,OAAA;AACnE,MAAA,MAAMM,IAAAA,GAAOF,MAAAA,CAAOG,OAAAA,CAAQF,QAAAA,CAAAA;AAE5B,MAAA,IAAI,CAACC,IAAAA,IAAQ,EAAE,WAAA,IAAeA,IAAAA,CAAAA,EAAO;AACnC5I,QAAAA,MAAAA,CAAOC,KAAAA,CAAM,CAAA,sBAAA,EAAyB0I,QAAAA,CAAAA,oBAAAA,CAA8B,CAAA;AACpE,QAAA;AACF,MAAA;AAEA,MAAA,MAAMpG,MAAAA,GAASqG,KAAKE,SAAAA,EAAS;AAG7B,MAAA,KAAA,MAAWxC,SAAAA,IAAagC,SAAAA,CAAUS,YAAAA,CAAaC,UAAAA,EAAY;AACzD,QAAA,IAAI1C,SAAAA,CAAUvE,SAAS,OAAA,EAAS;AAC9B,UAAA;AACF,QAAA;AAEA,QAAA,MAAMS,SAAAA,GAAY8D,UAAU5E,IAAAA,CAAK5D,KAAAA;AACjC,QAAA,MAAMmL,QAAAA,GAAW1G,OAAOC,SAAAA,CAAAA;AAExB,QAAA,IAAI,CAACyG,UAAUC,OAAAA,EAAS;AACtB,UAAA;AACF,QAAA;AAGA,QAAA,MAAMzH,SAAAA,GAAYwH,QAAAA,CAASC,OAAAA,CAAQC,UAAAA,EAAYtH,IAAAA,CAC7C,CAACuH,CAAAA,KAAqBA,CAAAA,CAAE1H,IAAAA,CAAK5D,KAAAA,KAAU,oBAAA,CAAA;AAGzC,QAAA,IAAI,CAAC2D,SAAAA,EAAW;AAEd,UAAA;AACF,QAAA;AAGA,QAAA,MAAMtC,UAAAA,GAAaqC,oBAAAA,CAAqBC,SAAAA,EAAW,YAAA,CAAA;AACnD,QAAA,MAAM4E,eAAAA,GAAkB7E,oBAAAA,CAAqBC,SAAAA,EAAW,iBAAA,CAAA;AAExD,QAAA,IAAI,CAACtC,UAAAA,EAAY;AACf,UAAA,MAAM,IAAI8G,aACR,6FAAA,EACA;YACEC,UAAAA,EAAY;cAAEC,IAAAA,EAAM,uBAAA;cAAyBlE,KAAAA,EAAOO;AAAU;WAChE,CAAA;AAEJ,QAAA;AAGA,QAAA,MAAMiD,GAAAA,GAAMD,YAAAA;AACZ,QAAA,MAAM6D,iBAAAA,GAAoBnF,mBAAmBuB,GAAAA,CAAAA;AAE7C,QAAA,IAAI4D,kBAAkBlF,YAAAA,EAAc;AAElC,UAAA,MAAMW,YAAAA,GAAe1B,SAAAA,CAAUqC,GAAAA,EAAK,iBAAA,CAAA;AACpC,UAAA,MAAMV,eAAAA,GAAkB3B,SAAAA,CAAUqC,GAAAA,EAAK,oBAAA,CAAA;AAEvCzF,UAAAA,MAAAA,CAAOc,KAAK,0DAAA,EAA4D;YACtEmB,KAAAA,EAAOO,SAAAA;AACPrD,YAAAA,UAAAA;YACAmK,QAAAA,EAAUjD,eAAAA;AACVvB,YAAAA,YAAAA;AACAC,YAAAA,eAAAA;AACAwE,YAAAA,aAAAA,EAAejB,SAAAA,CAAUA;WAC3B,CAAA;AAGA,UAAA;AACF,QAAA;AAMA,QAAA,MAAM5C,IAAAA,GAAOH,oBAAAA,CAAqBC,YAAAA,EAAchD,SAAAA,EAAWrD,UAAAA,CAAAA;AAG3D,QAAA,IAAIgI,kBAAAA;AACJ,QAAA,IAAI;AACFA,UAAAA,kBAAAA,GAAqB,MAAMf,kBACzBC,eAAAA,EACAC,SAAAA,EACApE,gBACAxD,MAAAA,EACAmJ,UAAAA,EACApC,GAAAA,EACAtG,UAAAA,EACAqD,SAAAA,CAAAA;AAEJ,QAAA,CAAA,CAAA,OAAS9B,KAAAA,EAAO;AAGd,UAAA,IAAI,CAAC2F,eAAAA,EAAiB;AACpBrG,YAAAA,MAAAA,CAAOC,MAAM,8EAAA,EAAgF;AAC3FuC,cAAAA,SAAAA;AACArD,cAAAA;aACF,CAAA;UACF,CAAA,MAAO;AAEL,YAAA,MAAMuB,KAAAA;AACR,UAAA;AACF,QAAA;AAGA,QAAA,MAAMhB,OAAAA,GAAUgD,SAAAA,CAAUgD,IAAAA,CAAKE,EAAE,CAAA;AACjC,QAAA,MAAMgC,yBAAAA,CACJC,UAAAA,EACApC,GAAAA,EACA/F,OAAAA,EACAP,UAAAA,EACAgI,oBACAzB,IAAAA,CAAKE,EAAAA,EACLpD,SAAAA,EACA6G,iBAAAA,CAAkBjE,aAAa,CAAA;AAEnC,MAAA;AAGF,IAAA;AACF,GAAA;AACF;AAvKgB2C,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAmMhB,SAASyB,oBAAoB1K,KAAAA,EAAmB;AAC9C,EAAA,MAAM2K,OAAAA,GAAUC,wBAAwB5K,KAAAA,CAAAA;AAKxC,EAAA,MAAM6K,OAAAA,GAAU7K,KAAAA,KAAU,QAAA,GAAW2K,OAAAA,CAAQG,kBAAkBH,OAAAA,CAAQI,iBAAAA;AAEvE,EAAA,OAAO,CAAA,OAAA,EAAUF,QAAQG,IAAI,CAAA,CAAA,EAAIH,QAAQI,IAAI,CAAA,EAAGJ,QAAQK,WAAW,CAAA,CAAA;AACrE;AATSR,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAmCF,SAASS,2BAAAA,CAA4BnL,OAAqBJ,MAAAA,EAA6B;AAC5F,EAAA,MAAMwL,SAAAA,GAAYpL,MAAM6I,WAAAA,EAAW;AAOnC,EAAA,MAAM/I,cAAAA,GACJF,MAAAA,EAAQE,cAAAA,IACRqJ,OAAAA,CAAQC,IAAI,CAAA,EAAGgC,SAAAA,CAAAA,iBAAAA,CAA4B,CAAA,IAC3CjC,OAAAA,CAAQC,GAAAA,CAAI,kBAAA,CAAA,IACZsB,oBAAoB1K,KAAAA,CAAAA;AAGtB,EAAA,MAAMqL,SAAAA,GAAuBrL,KAAAA;AAE7BkB,EAAAA,MAAAA,CAAOc,KAAK,sDAAA,EAAwD;IAClEhC,KAAAA,EAAOqL,SAAAA;AACPvL,IAAAA,cAAAA;AACAG,IAAAA,aAAAA,EAAeL,QAAQK,aAAAA,IAAiB;GAC1C,CAAA;AAEA,EAAA,OAAOgJ,mBAAAA,CAAoB;AACzBnJ,IAAAA,cAAAA;IACAE,KAAAA,EAAOqL,SAAAA;AACPpL,IAAAA,aAAAA,EAAeL,QAAQK,aAAAA,IAAiB,IAAA;AACxCE,IAAAA,QAAAA,EAAUP,MAAAA,EAAQO,QAAAA;AAClBD,IAAAA,YAAAA,EAAcN,MAAAA,EAAQM,YAAAA;AACtBoL,IAAAA,OAAAA,EAAS1L,MAAAA,EAAQ0L,OAAAA;AACjBvL,IAAAA,UAAAA,EAAYH,MAAAA,EAAQG,UAAAA;AACpBmI,IAAAA,gBAAAA,EAAkBtI,MAAAA,EAAQsI,gBAAAA;AAC1BgB,IAAAA,QAAAA,EAAUtJ,MAAAA,EAAQsJ;GACpB,CAAA;AACF;AAlCgBiC,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA;AA2CT,SAASI,0BAAAA,CAA2BC,aAAqB5L,MAAAA,EAA6B;AAE3F,EAAA,MAAMI,KAAAA,GACHmJ,QAAQC,GAAAA,CAAI,eAAA,MAAsCoC,WAAAA,CAAY/L,UAAAA,CAAW,SAAA,CAAA,GAAa,QAAA,GAAW,QAAA,CAAA;AAEpG,EAAA,OAAO0L,2BAAAA,CAA4BnL,OAAOJ,MAAAA,CAAAA;AAC5C;AANgB2L,MAAAA,CAAAA,0BAAAA,EAAAA,4BAAAA,CAAAA;;;ACn2CT,SAASE,uBAAAA,CACdC,OAAAA,GAAmF,EAAC,EAAC;AAErF,EAAA,MAAM1L,QACJ0L,OAAAA,CAAQ1L,KAAAA,KAAWmJ,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA,IAAqC,QAAA,CAAA;AACtE,EAAA,MAAMgC,SAAAA,GAAYpL,MAAM6I,WAAAA,EAAW;AACnC,EAAA,MAAM/I,cAAAA,GACJ4L,OAAAA,CAAQ5L,cAAAA,IACRqJ,OAAAA,CAAQC,IAAI,CAAA,EAAGgC,SAAAA,CAAAA,iBAAAA,CAA4B,CAAA,IAC3CjC,QAAQC,GAAAA,CAAI,kBAAA,CAAA,IACZuC,uBAAAA,CAAwB3L,KAAAA,CAAAA,CAAO4L,cAAAA;AACjC,EAAA,OAAO,IAAIlM,UAAAA,CAAW;AACpBI,IAAAA,cAAAA;AACAE,IAAAA,KAAAA;AACAD,IAAAA,UAAAA,EAAY2L,OAAAA,CAAQ3L;GACtB,CAAA;AACF;AAhBgB0L,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA8DT,IAAMI,aAAN,MAAMA;EA/Fb;;;;;AAgGE,EAAA,WAAA,CACUlM,QACA4E,OAAAA,EACR;SAFQ5E,MAAAA,GAAAA,MAAAA;SACA4E,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAa5D,gBAAgB+K,OAAAA,EAAmD;AAC9E,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAKI,kBAAkBJ,OAAAA,CAAAA;AAC7B,MAAA,OAAO,IAAA;IACT,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKA,EAAA,MAAaI,kBAAkBJ,OAAAA,EAAgD;AAC7E,IAAA,IAAI,CAACA,QAAQ7H,MAAAA,EAAQ;AACnB,MAAA,MAAM,IAAIkI,gBAAgB,qBAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,IAAI,CAACL,QAAQjL,MAAAA,EAAQ;AACnB,MAAA,MAAM,IAAIsL,gBAAgB,oBAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,IAAI,CAACL,QAAQlL,YAAAA,EAAc;AACzB,MAAA,MAAM,IAAIuL,gBAAgB,2BAAA,CAAA;AAC5B,IAAA;AAEA7K,IAAAA,MAAAA,CAAOC,KAAAA,CAAM,8BAA8BuK,OAAAA,CAAAA;AAI3C,IAAA,MAAMM,KAAAA,GAAQ;;;;;;;;AASd,IAAA,MAAMC,SAAAA,GAAY;MAChB1K,KAAAA,EAAO;AACLX,QAAAA,OAAAA,EAAS8K,OAAAA,CAAQ7H,MAAAA;AACjBhD,QAAAA,SAAAA,EAAW6K,QAAQ7K,SAAAA,IAAa,MAAA;AAChCC,QAAAA,OAAAA,EAAS4K,QAAQnD,WAAAA,IAAe,IAAA,CAAKhE,QAAQgE,WAAAA,IAAe,IAAA,CAAKhE,QAAQiE,QAAAA,IAAY,EAAA;AACrFhI,QAAAA,YAAAA,EAAckL,OAAAA,CAAQlL,YAAAA;AACtBC,QAAAA,MAAAA,EAAQiL,OAAAA,CAAQjL,MAAAA;AAChBM,QAAAA,UAAAA,EAAY2K,OAAAA,CAAQ3K;AACtB;AACF,KAAA;AAIA,IAAA,MAAMmL,QAAAA,GACJR,QAAQnD,WAAAA,IAAe,IAAA,CAAKhE,QAAQgE,WAAAA,GAChC,MAAM,IAAA,CAAK5I,MAAAA,CAAOqM,KAAAA,CAEfA,KAAAA,EAAOC,WAAW,IAAA,CAAK1H,OAAO,IACjC,MAAM,IAAA,CAAK5E,OAAOwM,WAAAA,CAEfH,KAAAA,EAAOC,SAAAA,EAAW,IAAA,CAAK1H,OAAO,CAAA;AAEvC,IAAA,IAAI,CAAC2H,QAAAA,CAASvL,eAAAA,CAAgBe,OAAAA,EAAS;AACrC,MAAA,MAAM,IAAI0K,qBAAAA,CAAsB,CAAA,mBAAA,EAAsBF,QAAAA,CAASvL,eAAAA,CAAgBgB,YAAY,CAAA,CAAA,EAAI;AAC7FlB,QAAAA,MAAAA,EAAQiL,OAAAA,CAAQjL,MAAAA;AAChBD,QAAAA,YAAAA,EAAckL,OAAAA,CAAQlL,YAAAA;AACtBO,QAAAA,UAAAA,EAAY2K,OAAAA,CAAQ3K,UAAAA;AACpB8C,QAAAA,MAAAA,EAAQ6H,OAAAA,CAAQ7H;OAClB,CAAA;AACF,IAAA;AAEA3C,IAAAA,MAAAA,CAAOC,MAAM,2BAAA,EAA6B;MACxC,GAAGuK,OAAAA;AACH/J,MAAAA,YAAAA,EAAcuK,SAASvL,eAAAA,CAAgBgB;KACzC,CAAA;AACF,EAAA;;;;;EAMA,MAAa0K,YAAAA,CAAaxI,QAAgB0E,WAAAA,EAAsC;AAC9ErH,IAAAA,MAAAA,CAAOC,MAAM,2BAAA,EAA6B;AAAE0C,MAAAA,MAAAA;AAAQ0E,MAAAA;KAAY,CAAA;AAGhE,IAAA,MAAMyD,KAAAA,GAAQ;;;;;;;;;;;;;;;;AAiBd,IAAA,MAAMC,SAAAA,GAAY;MAChBrL,OAAAA,EAASiD,MAAAA;MACT/C,OAAAA,EAASyH;AACX,KAAA;AAEA,IAAA,MAAM+D,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAGA,IAAA,MAAM2D,WAAW,MAAM,IAAA,CAAKvM,OAAOqM,KAAAA,CAUhCA,KAAAA,EAAOC,WAAWK,oBAAAA,CAAAA;AAGrB,IAAA,OAAOJ,QAAAA,CAASK,oBAAAA,CAAqBC,GAAAA,CAAI,CAACC,UAAAA,MAAgB;AACxD3F,MAAAA,EAAAA,EAAI2F,WAAWC,IAAAA,CAAK5F,EAAAA;AACpBlE,MAAAA,IAAAA,EAAM6J,WAAWC,IAAAA,CAAK9J,IAAAA;AACtB+J,MAAAA,WAAAA,EAAaF,WAAWC,IAAAA,CAAKC,WAAAA;AAC7BC,MAAAA,kBAAAA,EAAoBH,WAAWC,IAAAA,CAAKE;KACtC,CAAA,CAAA;AACF,EAAA;;;;;AAMA,EAAA,MAAaC,gBAAAA,CACXhJ,MAAAA,EACAiJ,MAAAA,EACAvE,WAAAA,EACA1H,YAAgE,MAAA,EAC9C;AAClBK,IAAAA,MAAAA,CAAOC,MAAM,+BAAA,EAAiC;AAAE0C,MAAAA,MAAAA;AAAQiJ,MAAAA,MAAAA;AAAQvE,MAAAA,WAAAA;AAAa1H,MAAAA;KAAU,CAAA;AAGvF,IAAA,MAAMkM,QAAAA,GAAW;;;;;;;;;;AAWjB,IAAA,MAAMd,SAAAA,GAAY;MAChB1K,KAAAA,EAAO;QACLX,OAAAA,EAASiD,MAAAA;AACThD,QAAAA,SAAAA;AACAiM,QAAAA,MAAAA;QACAhM,OAAAA,EAASyH;AACX;AACF,KAAA;AAEA,IAAA,MAAM+D,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAGA,IAAA,MAAM,IAAA,CAAK5I,MAAAA,CAAOqM,KAAAA,CAAMe,QAAAA,EAAUd,WAAWK,oBAAAA,CAAAA;AAE7CpL,IAAAA,MAAAA,CAAOc,KAAK,+BAAA,EAAiC;AAAE6B,MAAAA,MAAAA;AAAQiJ,MAAAA,MAAAA;AAAQvE,MAAAA;KAAY,CAAA;AAE3E,IAAA,OAAO,IAAA;AACT,EAAA;;;;;;EAOA,MAAayE,kBAAAA,CAAmBnJ,MAAAA,EAAgBiJ,MAAAA,EAAgBvE,WAAAA,EAAuC;AACrGrH,IAAAA,MAAAA,CAAOC,MAAM,gCAAA,EAAkC;AAAE0C,MAAAA,MAAAA;AAAQiJ,MAAAA,MAAAA;AAAQvE,MAAAA;KAAY,CAAA;AAE7E,IAAA,MAAM+D,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAGA,IAAA,MAAM0E,SAAAA,GAAY;;;;;;;;AASlB,IAAA,MAAMC,YAAAA,GAAe,MAAM,IAAA,CAAKvN,MAAAA,CAAOqM,MAEpCiB,SAAAA,EAAW;MAAErM,OAAAA,EAASiD,MAAAA;MAAQ/C,OAAAA,EAASyH;AAAY,KAAA,EAAG+D,oBAAAA,CAAAA;AAEzD,IAAA,MAAMG,UAAAA,GAAaS,aAAaX,oBAAAA,CAAqBxJ,IAAAA,CAAK,CAACC,CAAAA,KAAMA,CAAAA,CAAE8J,WAAWA,MAAAA,CAAAA;AAE9E,IAAA,IAAI,CAACL,UAAAA,EAAY;AACfvL,MAAAA,MAAAA,CAAOW,KAAK,2CAAA,EAA6C;AAAEgC,QAAAA,MAAAA;AAAQiJ,QAAAA,MAAAA;AAAQvE,QAAAA;OAAY,CAAA;AACvF,MAAA,OAAO,KAAA;AACT,IAAA;AAGA,IAAA,MAAMwE,QAAAA,GAAW;;;;;AAMjB,IAAA,MAAM,IAAA,CAAKpN,MAAAA,CAAOqM,KAAAA,CAAMe,QAAAA,EAAU;AAAEI,MAAAA,YAAAA,EAAcV,UAAAA,CAAW3F;AAAG,KAAA,EAAGwF,oBAAAA,CAAAA;AAEnEpL,IAAAA,MAAAA,CAAOc,KAAK,gCAAA,EAAkC;AAAE6B,MAAAA,MAAAA;AAAQiJ,MAAAA,MAAAA;AAAQvE,MAAAA,WAAAA;AAAa4E,MAAAA,YAAAA,EAAcV,UAAAA,CAAW3F;KAAG,CAAA;AAEzG,IAAA,OAAO,IAAA;AACT,EAAA;;;;;;;;;;;;;AAcA,EAAA,MAAasG,UAAAA,CACXxK,IAAAA,EACA+J,WAAAA,EACAC,kBAAAA,EACArE,WAAAA,EACe;AACfrH,IAAAA,MAAAA,CAAOC,MAAM,sBAAA,EAAwB;AAAEyB,MAAAA,IAAAA;AAAM2F,MAAAA,WAAAA;AAAa8E,MAAAA,eAAAA,EAAiBT,kBAAAA,CAAmBU;KAAO,CAAA;AAErG,IAAA,MAAMhB,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAGA,IAAA,MAAMgF,kBAAAA,GAAqB;;;;;;;;;;;;;AAc3B,IAAA,MAAMC,mBAAAA,GAAsB;MAC1BjM,KAAAA,EAAO;AACLqB,QAAAA,IAAAA;AACA+J,QAAAA,WAAAA;QACA7L,OAAAA,EAASyH,WAAAA;QACTkF,SAAAA,EAAW;AACb;AACF,KAAA;AAGA,IAAA,MAAMC,iBAAiB,MAAM,IAAA,CAAK/N,OAAOqM,KAAAA,CAOtCuB,kBAAAA,EAAoBC,qBAAqBlB,oBAAAA,CAAAA;AAE5C,IAAA,MAAMQ,MAAAA,GAASY,eAAeN,UAAAA,CAAWtG,EAAAA;AACzC5F,IAAAA,MAAAA,CAAOc,KAAK,qBAAA,EAAuB;AAAEY,MAAAA,IAAAA;AAAMkK,MAAAA;KAAO,CAAA;AAGlD,IAAA,IAAIF,kBAAAA,CAAmBU,SAAS,CAAA,EAAG;AACjCpM,MAAAA,MAAAA,CAAOC,MAAM,6CAAA,EAA+C;AAAE2L,QAAAA,MAAAA;AAAQtN,QAAAA,KAAAA,EAAOoN,kBAAAA,CAAmBU;OAAO,CAAA;AAGvG,MAAA,MAAMK,qBAAAA,GAAiDf,kBAAAA,CAAmBJ,GAAAA,CAAI,CAACoB,IAAAA,KAAAA;AAC7E,QAAA,IAAI,OAAOA,SAAS,QAAA,EAAU;AAE5B,UAAA,MAAMpN,eAAeoN,IAAAA,CAAKrL,KAAAA,CAAM,GAAA,CAAA,CAAK,CAAA,CAAA,IAAMqL,IAAAA;AAC3C,UAAA,OAAO;AAAEpN,YAAAA,YAAAA;YAAcqN,KAAAA,EAAO;AAA+B,WAAA;AAC/D,QAAA;AACA,QAAA,OAAOD,IAAAA;MACT,CAAA,CAAA;AAGA,MAAA,MAAME,OAAAA,uBAAc1P,GAAAA,EAAAA;AACpB,MAAA,MAAM2P,aAAAA,GAAqD;QAAEC,KAAAA,EAAO,CAAA;QAAGC,MAAAA,EAAQ,CAAA;QAAGC,MAAAA,EAAQ,CAAA;QAAGC,IAAAA,EAAM;AAAE,OAAA;AAErG,MAAA,KAAA,MAAWP,QAAQD,qBAAAA,EAAuB;AACxC,QAAA,MAAMS,QAAAA,GAAWN,OAAAA,CAAQvP,GAAAA,CAAIqP,IAAAA,CAAKpN,YAAY,CAAA;AAC9C,QAAA,IAAI,CAAC4N,YAAYL,aAAAA,CAAcH,IAAAA,CAAKC,KAAK,CAAA,GAAIE,aAAAA,CAAcK,QAAAA,CAAAA,EAAW;AACpEN,UAAAA,OAAAA,CAAQ/O,GAAAA,CAAI6O,IAAAA,CAAKpN,YAAAA,EAAcoN,IAAAA,CAAKC,KAAK,CAAA;AAC3C,QAAA;AACF,MAAA;AAGA,MAAA,MAAMQ,qBAAAA,GAAwB;;;;;;;;;;;AAa9B,MAAA,MAAMC,oBAAmF,EAAA;AAEzF,MAAA,KAAA,MAAW,CAAC9N,YAAAA,EAAcqN,KAAAA,CAAAA,IAAUC,OAAAA,EAAS;AAC3C,QAAA,IAAI;AACF,UAAA,MAAM,IAAA,CAAKnO,MAAAA,CAAOqM,KAAAA,CAChBqC,qBAAAA,EACA;YACE9M,KAAAA,EAAO;AACLuL,cAAAA,MAAAA;AACAtM,cAAAA,YAAAA;AACAqN,cAAAA;AACF;AACF,WAAA,EACAvB,oBAAAA,CAAAA;AAEFpL,UAAAA,MAAAA,CAAOC,MAAM,+BAAA,EAAiC;AAAE2L,YAAAA,MAAAA;AAAQtM,YAAAA,YAAAA;AAAcqN,YAAAA;WAAM,CAAA;AAC9E,QAAA,CAAA,CAAA,OAASjM,KAAAA,EAAO;AACd,UAAA,MAAM2M,WAAW3M,KAAAA,YAAiBsD,KAAAA,GAAQtD,KAAAA,CAAMuD,OAAAA,GAAUqJ,OAAO5M,KAAAA,CAAAA;AACjEV,UAAAA,MAAAA,CAAOU,MAAM,yCAAA,EAA2C;AACtDkL,YAAAA,MAAAA;AACAtM,YAAAA,YAAAA;AACAqN,YAAAA,KAAAA;YACAjM,KAAAA,EAAO2M;WACT,CAAA;AACAD,UAAAA,iBAAAA,CAAkBG,IAAAA,CAAK;AAAEjO,YAAAA,YAAAA;AAAcqN,YAAAA,KAAAA;YAAOjM,KAAAA,EAAO2M;WAAS,CAAA;AAChE,QAAA;AACF,MAAA;AAGA,MAAA,IAAID,iBAAAA,CAAkBhB,SAAS,CAAA,EAAG;AAChC,QAAA,MAAMoB,WAAAA,GAAcJ,kBAAkB9B,GAAAA,CAAI,CAACmC,MAAMA,CAAAA,CAAEnO,YAAY,CAAA,CAAEyH,IAAAA,CAAK,IAAA,CAAA;AACtE,QAAA,MAAM,IAAI8D,gBACR,CAAA,+BAAA,EAAkCuC,iBAAAA,CAAkBhB,MAAM,CAAA,wBAAA,EAA2BoB,WAAAA,CAAAA,WAAAA,EACvE5B,MAAAA,CAAAA,yBAAAA,CAAiC,CAAA;AAEnD,MAAA;AAEA5L,MAAAA,MAAAA,CAAOc,KAAK,yCAAA,EAA2C;AAAE8K,QAAAA,MAAAA;AAAQtN,QAAAA,KAAAA,EAAOsO,OAAAA,CAAQ7O;OAAK,CAAA;AACvF,IAAA;AAGA,IAAA,MAAM2P,SAAAA,GAAY;;;;;;;;;;;;;AAclB,IAAA,MAAMC,YAAAA,GAAe,MAAM,IAAA,CAAKlP,MAAAA,CAAOqM,MAOpC4C,SAAAA,EAAW;MAAE9H,EAAAA,EAAIgG;AAAO,KAAA,EAAGR,oBAAAA,CAAAA;AAE9B,IAAA,MAAMI,IAAAA,GAAOmC,YAAAA,CAAanC,IAAAA,IAAQgB,cAAAA,CAAeN,UAAAA;AAGjD,IAAA,OAAO;AACLtG,MAAAA,EAAAA,EAAI4F,IAAAA,CAAK5F,EAAAA;AACTlE,MAAAA,IAAAA,EAAM8J,IAAAA,CAAK9J,IAAAA;AACX+J,MAAAA,WAAAA,EAAaD,IAAAA,CAAKC,WAAAA;AAClBC,MAAAA,kBAAAA,EAAoBF,IAAAA,CAAKE;AAC3B,KAAA;AACF,EAAA;;;;;AAMA,EAAA,MAAakC,uBAAAA,GAAiD;AAC5D5N,IAAAA,MAAAA,CAAOC,MAAM,6CAAA,CAAA;AAGb,IAAA,MAAM4N,kBAAAA,GAAqB;;;;;AAO3B,IAAA,MAAMC,YAAAA,GAAe,CAAC,CAAC,IAAA,CAAKzK,OAAAA,CAAQgE,WAAAA;AAEpC,IAAA,MAAM0G,qBAAAA,GAAwBD,eAC1B,MAAM,IAAA,CAAKrP,OAAOqM,KAAAA,CAAmC+C,kBAAAA,EAAoB,EAAC,EAAG,IAAA,CAAKxK,OAAO,CAAA,GACzF,MAAM,KAAK5E,MAAAA,CAAOwM,WAAAA,CAAyC4C,oBAAoB,EAAC,EAAG,KAAKxK,OAAO,CAAA;AAEnG,IAAA,MAAM2K,cAA4B,EAAA;AAGlC,IAAA,MAAMC,YAAAA,GAAe;;;;;;;;;;AAWrB,IAAA,KAAA,MAAW3O,YAAAA,IAAgByO,sBAAsBG,aAAAA,EAAe;AAC9D,MAAA,MAAMC,kBAAkBL,YAAAA,GACpB,MAAM,IAAA,CAAKrP,MAAAA,CAAOqM,MAEfmD,YAAAA,EAAc;AAAE3O,QAAAA;AAAa,OAAA,EAAG,KAAK+D,OAAO,CAAA,GAC/C,MAAM,IAAA,CAAK5E,MAAAA,CAAOwM,YAEfgD,YAAAA,EAAc;AAAE3O,QAAAA;AAAa,OAAA,EAAG,KAAK+D,OAAO,CAAA;AAEnD,MAAA,KAAA,MAAW9D,MAAAA,IAAU4O,gBAAgBC,iBAAAA,EAAmB;AACtDJ,QAAAA,WAAAA,CAAYT,IAAAA,CAAK;AACf3H,UAAAA,EAAAA,EAAIrG,MAAAA,CAAOqG,EAAAA;AACXrG,UAAAA,MAAAA,EAAQA,MAAAA,CAAOA,MAAAA;AACfD,UAAAA,YAAAA,EAAcC,MAAAA,CAAOD,YAAAA;AACrBmM,UAAAA,WAAAA,EAAalM,MAAAA,CAAOkM;SACtB,CAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA,OAAOuC,WAAAA;AACT,EAAA;;;;;AAMA,EAAA,MAAaK,yBACXC,MAAAA,EACuD;AACvDtO,IAAAA,MAAAA,CAAOC,MAAM,sCAAA,EAAwC;AAAE3B,MAAAA,KAAAA,EAAOgQ,MAAAA,CAAOlC;KAAO,CAAA;AAG5E,IAAA,MAAMtB,KAAAA,GAAQ;;;;;;;;AAUd,IAAA,MAAMyD,MAAAA,GAASD,MAAAA,CAAOhD,GAAAA,CAAI,CAACkD,KAAAA,MAAW;AACpC9O,MAAAA,OAAAA,EAAS8O,KAAAA,CAAM7L,MAAAA;AACfhD,MAAAA,SAAAA,EAAW6O,MAAM7O,SAAAA,IAAa,MAAA;AAC9BC,MAAAA,OAAAA,EAAS4O,MAAMnH,WAAAA,IAAe,IAAA,CAAKhE,QAAQgE,WAAAA,IAAe,IAAA,CAAKhE,QAAQiE,QAAAA,IAAY,EAAA;AACnFhI,MAAAA,YAAAA,EAAckP,KAAAA,CAAMlP,YAAAA;AACpBC,MAAAA,MAAAA,EAAQiP,KAAAA,CAAMjP,MAAAA;AACdM,MAAAA,UAAAA,EAAY2O,KAAAA,CAAM3O;KACpB,CAAA,CAAA;AAGA,IAAA,MAAMiO,YAAAA,GAAeQ,MAAAA,CAAOG,IAAAA,CAAK,CAACC,CAAAA,KAAMA,CAAAA,CAAErH,WAAW,CAAA,IAAK,CAAC,CAAC,IAAA,CAAKhE,OAAAA,CAAQgE,WAAAA;AAEzE,IAAA,MAAM2D,WAAW8C,YAAAA,GACb,MAAM,IAAA,CAAKrP,MAAAA,CAAOqM,MAEfA,KAAAA,EAAO;AAAEyD,MAAAA;AAAO,KAAA,EAAG,KAAKlL,OAAO,CAAA,GAClC,MAAM,IAAA,CAAK5E,MAAAA,CAAOwM,YAEfH,KAAAA,EAAO;AAAEyD,MAAAA;AAAO,KAAA,EAAG,KAAKlL,OAAO,CAAA;AAGtC,IAAA,OAAO2H,QAAAA,CAAS2D,gBAAAA,CAAiBrD,GAAAA,CAAI,CAAChL,MAAAA,MAAY;AAChDE,MAAAA,OAAAA,EAASF,MAAAA,CAAOE,OAAAA;AAChBL,MAAAA,MAAAA,EAAQG,MAAAA,CAAOG;KACjB,CAAA,CAAA;AACF,EAAA;;;;;AAMA,EAAA,MAAamO,uBAAAA,CACXjM,MAAAA,EACA0E,WAAAA,EACA1H,SAAAA,GAAgE,MAAA,EAK/D;AACDK,IAAAA,MAAAA,CAAOC,MAAM,sCAAA,EAAwC;AAAE0C,MAAAA,MAAAA;AAAQ0E,MAAAA,WAAAA;AAAa1H,MAAAA;KAAU,CAAA;AAEtF,IAAA,MAAMmL,KAAAA,GAAQ;;;;;;;;;;;;;;AAed,IAAA,MAAMC,SAAAA,GAAY;MAChBrL,OAAAA,EAASiD,MAAAA;AACThD,MAAAA,SAAAA;MACAC,OAAAA,EAASyH;AACX,KAAA;AAEA,IAAA,MAAM+D,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAEA,IAAA,MAAM2D,WAAW,MAAM,IAAA,CAAKvM,OAAOqM,KAAAA,CAMhCA,KAAAA,EAAOC,WAAWK,oBAAAA,CAAAA;AAErB,IAAA,OAAOJ,QAAAA,CAAS6D,oBAAAA;AAClB,EAAA;;;;;EAMA,MAAaC,wBAAAA,CACXzH,aACA0H,OAAAA,EAOC;AACD/O,IAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAAEoH,MAAAA,WAAAA;AAAa0H,MAAAA;KAAQ,CAAA;AAE3E,IAAA,MAAMlD,QAAAA,GAAW;;;;;;;;;;;AAYjB,IAAA,MAAMT,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAEA,IAAA,MAAM2D,QAAAA,GAAW,MAAM,IAAA,CAAKvM,MAAAA,CAAOqM,MAQhCe,QAAAA,EAAU;AAAExE,MAAAA,WAAAA;AAAa0H,MAAAA;AAAQ,KAAA,EAAG3D,oBAAAA,CAAAA;AAEvCpL,IAAAA,MAAAA,CAAOc,IAAAA,CAAK,oCAAA,EAAsCkK,QAAAA,CAAS8D,wBAAwB,CAAA;AAEnF,IAAA,OAAO9D,QAAAA,CAAS8D,wBAAAA;AAClB,EAAA;;;;;;;;;EAUA,MAAaE,UAAAA,CACXpD,MAAAA,EACAqD,OAAAA,EAKA5H,WAAAA,EACe;AACfrH,IAAAA,MAAAA,CAAOC,MAAM,sBAAA,EAAwB;AAAE2L,MAAAA,MAAAA;AAAQqD,MAAAA,OAAAA;AAAS5H,MAAAA;KAAY,CAAA;AAEpE,IAAA,MAAM+D,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAEA,IAAA,MAAMwE,QAAAA,GAAW;;;;;;;;;;;;;;AAejB,IAAA,MAAMb,QAAAA,GAAW,MAAM,IAAA,CAAKvM,MAAAA,CAAOqM,MAQhCe,QAAAA,EAAU;MAAEjG,EAAAA,EAAIgG,MAAAA;MAAQvL,KAAAA,EAAO4O;AAAQ,KAAA,EAAG7D,oBAAAA,CAAAA;AAE7CpL,IAAAA,MAAAA,CAAOc,KAAK,qBAAA,EAAuB;AAAE8K,MAAAA,MAAAA;AAAQlK,MAAAA,IAAAA,EAAMsJ,SAASgE,UAAAA,CAAWtN;KAAK,CAAA;AAG5E,IAAA,OAAO;AACLkE,MAAAA,EAAAA,EAAIoF,SAASgE,UAAAA,CAAWpJ,EAAAA;AACxBlE,MAAAA,IAAAA,EAAMsJ,SAASgE,UAAAA,CAAWtN,IAAAA;AAC1B+J,MAAAA,WAAAA,EAAaT,SAASgE,UAAAA,CAAWvD,WAAAA;AACjCC,MAAAA,kBAAAA,EAAoBV,SAASgE,UAAAA,CAAWtD;AAC1C,KAAA;AACF,EAAA;;;;;;;;;EAUA,MAAawD,UAAAA,CAAWtD,MAAAA,EAAgBvE,WAAAA,EAAqB8H,gBAAAA,EAA6C;AACxGnP,IAAAA,MAAAA,CAAOC,MAAM,sBAAA,EAAwB;AAAE2L,MAAAA,MAAAA;AAAQvE,MAAAA,WAAAA;AAAa8H,MAAAA;KAAiB,CAAA;AAE7E,IAAA,MAAM/D,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAEA,IAAA,MAAMwE,QAAAA,GAAW;;;;;AAMjB,IAAA,MAAMb,QAAAA,GAAW,MAAM,IAAA,CAAKvM,MAAAA,CAAOqM,MAEhCe,QAAAA,EAAU;MAAEjG,EAAAA,EAAIgG,MAAAA;AAAQuD,MAAAA;AAAiB,KAAA,EAAG/D,oBAAAA,CAAAA;AAE/CpL,IAAAA,MAAAA,CAAOc,KAAK,qBAAA,EAAuB;AAAE8K,MAAAA,MAAAA;AAAQwD,MAAAA,OAAAA,EAASpE,QAAAA,CAASkE;KAAW,CAAA;AAE1E,IAAA,OAAOlE,QAAAA,CAASkE,UAAAA;AAClB,EAAA;;;;;;;;EASA,MAAaG,SAAAA,CACXhI,aACAmD,OAAAA,EAKiB;AACjBxK,IAAAA,MAAAA,CAAOC,MAAM,sBAAA,EAAwB;AAAEoH,MAAAA,WAAAA;AAAamD,MAAAA;KAAQ,CAAA;AAE5D,IAAA,MAAMY,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAEA,IAAA,MAAMyD,KAAAA,GAAQ;;;;;;;;;;;;;;;AAgBd,IAAA,MAAMC,SAAAA,GAAY;MAChBnL,OAAAA,EAASyH,WAAAA;MACTiI,MAAAA,EAAQ9E,OAAAA,EAAS+E,kBAAkB/R,MAAAA,GAAY;AAAE+R,QAAAA,aAAAA,EAAe/E,OAAAA,CAAQ+E;OAAc,GAAI/R,MAAAA;MAC1FgS,UAAAA,EAAY;AACVC,QAAAA,KAAAA,EAAOjF,SAASiF,KAAAA,IAAS,EAAA;AACzBC,QAAAA,MAAAA,EAAQlF,SAASkF,MAAAA,IAAU;AAC7B;AACF,KAAA;AAEA,IAAA,MAAM1E,WAAW,MAAM,IAAA,CAAKvM,OAAOqM,KAAAA,CAShCA,KAAAA,EAAOC,WAAWK,oBAAAA,CAAAA;AAErBpL,IAAAA,MAAAA,CAAOC,MAAM,qBAAA,EAAuB;AAAEoH,MAAAA,WAAAA;AAAa/I,MAAAA,KAAAA,EAAO0M,SAAS2E,KAAAA,CAAMvD;KAAO,CAAA;AAEhF,IAAA,OAAOpB,QAAAA,CAAS2E,KAAAA,CAAMrE,GAAAA,CAAI,CAACE,IAAAA,MAAU;AACnC5F,MAAAA,EAAAA,EAAI4F,IAAAA,CAAK5F,EAAAA;AACTlE,MAAAA,IAAAA,EAAM8J,IAAAA,CAAK9J,IAAAA;AACX+J,MAAAA,WAAAA,EAAaD,IAAAA,CAAKC,WAAAA;AAClBC,MAAAA,kBAAAA,EAAoBF,IAAAA,CAAKE;KAC3B,CAAA,CAAA;AACF,EAAA;;;;;;;;EASA,MAAakE,OAAAA,CAAQhE,QAAgBvE,WAAAA,EAA2C;AAC9ErH,IAAAA,MAAAA,CAAOC,MAAM,qBAAA,EAAuB;AAAE2L,MAAAA,MAAAA;AAAQvE,MAAAA;KAAY,CAAA;AAE1D,IAAA,MAAM+D,oBAAAA,GAAuB;AAC3B,MAAA,GAAG,IAAA,CAAK/H,OAAAA;AACRgE,MAAAA;AACF,KAAA;AAEA,IAAA,MAAMyD,KAAAA,GAAQ;;;;;;;;;;;;;;;AAgBd,IAAA,MAAME,QAAAA,GAAW,MAAM,IAAA,CAAKvM,MAAAA,CAAOqM,MAShCA,KAAAA,EAAO;MAAElF,EAAAA,EAAIgG;AAAO,KAAA,EAAGR,oBAAAA,CAAAA;AAE1B,IAAA,IAAI,CAACJ,SAASQ,IAAAA,EAAM;AAClBxL,MAAAA,MAAAA,CAAOC,MAAM,uBAAA,EAAyB;AAAE2L,QAAAA;OAAO,CAAA;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLhG,MAAAA,EAAAA,EAAIoF,SAASQ,IAAAA,CAAK5F,EAAAA;AAClBlE,MAAAA,IAAAA,EAAMsJ,SAASQ,IAAAA,CAAK9J,IAAAA;AACpB+J,MAAAA,WAAAA,EAAaT,SAASQ,IAAAA,CAAKC,WAAAA;AAC3BC,MAAAA,kBAAAA,EAAoBV,SAASQ,IAAAA,CAAKE;AACpC,KAAA;AACF,EAAA;AACF","file":"chunk-O2MEBPDT.js","sourcesContent":["/**\n * RBAC Directive Plugin\n *\n * Centralized GraphQL directive enforcement for @requiresPermission\n * This plugin is shared across all microservices for consistent RBAC implementation.\n *\n * @module rbac/directive\n * @example\n * ```typescript\n * import { createRBACDirective } from '@burdenoff/be-sdk/rbac/directive';\n *\n * const server = await createServer({\n *   yogaPlugins: [\n *     createRBACDirective({\n *       // Use Workspaces Gateway (RBAC is part of workspaces supergraph)\n *       rbacServiceUrl: process.env.RBAC_GATEWAY_URL || 'http://localhost:4001/graphql',\n *       enableCaching: true,\n *     }),\n *   ],\n * });\n * ```\n */\n\nimport type { Plugin } from '@envelop/core';\nimport {\n  GraphQLError,\n  type OperationDefinitionNode,\n  type FieldNode,\n  type ArgumentNode,\n  type ObjectValueNode,\n  type DirectiveNode,\n  type DefinitionNode,\n} from 'graphql';\nimport { GraphQLClient } from 'graphql-request';\nimport { logger } from '../logger/index.js';\nimport type { ServiceLayer } from '../types/layer.js';\nimport { DEFAULT_GATEWAY_ROUTING } from '../types/layer.js';\n\n/**\n * User from context\n */\ninterface ContextUser {\n  id: string;\n  email?: string;\n  workspace_id?: string;\n}\n\n/**\n * Actor type for PBAC\n */\ntype ActorType = 'USER' | 'BOT' | 'INTEGRATION' | 'DELEGATED_AGENT';\n\n/**\n * Expected context shape\n */\ninterface RBACContext {\n  user?: ContextUser;\n  actor?: { id?: string; email?: string } | null;\n  actorId?: string;\n  workspace?: { id: string };\n  tenant?: { id: string };\n  request?: {\n    headers?: {\n      get?: (name: string) => string | undefined;\n      authorization?: string;\n      'x-rbac-bypass'?: string;\n      'x-bypass-source'?: string;\n      'x-bypass-timestamp'?: string;\n      'x-actor-id'?: string;\n      'x-actor-type'?: string;\n      'x-workspace-id'?: string;\n      'x-tenant-id'?: string;\n    };\n  };\n  headers?: {\n    authorization?: string;\n    'x-rbac-bypass'?: string;\n    'x-bypass-source'?: string;\n    'x-bypass-timestamp'?: string;\n    'x-actor-id'?: string;\n    'x-actor-type'?: string;\n    'x-workspace-id'?: string;\n    'x-tenant-id'?: string;\n  };\n}\n\n/**\n * RBAC layer - determines which RBAC service to use\n */\nexport type RBACLayer = 'wspace' | 'global';\n\n/**\n * Configuration for RBAC directive plugin\n */\nexport interface RBACDirectiveConfig {\n  /**\n   * URL of the RBAC microservice GraphQL endpoint via Gateway\n   * - wspace layer: Workspaces Gateway (wspace-rbac-svc)\n   * - global layer: Global Gateway (global-rbac-svc)\n   * @example 'http://localhost:4001/graphql' (Workspaces Gateway)\n   * @example 'http://localhost:4000/graphql' (Global Gateway)\n   */\n  rbacServiceUrl: string;\n\n  /**\n   * RBAC layer - determines scope handling\n   * - 'wspace': Uses workspaceId as scopeId (workspace-scoped permissions)\n   * - 'global': Uses tenantId or 'global' as scopeId (global/billing-scoped permissions)\n   * @default 'wspace'\n   */\n  layer?: RBACLayer;\n\n  /**\n   * Enable in-memory caching of permission checks\n   * Caching reduces latency and load on RBAC service\n   * @default true\n   */\n  enableCaching?: boolean;\n\n  /**\n   * Cache TTL in milliseconds\n   * @default 60000 (1 minute)\n   */\n  cacheTTL?: number;\n\n  /**\n   * Maximum cache size (number of entries)\n   * @default 10000\n   */\n  cacheMaxSize?: number;\n\n  /**\n   * Timeout for RBAC service requests in milliseconds\n   * @default 5000 (5 seconds)\n   */\n  timeout?: number;\n\n  /**\n   * Fail-closed security: deny access on errors\n   * When true, any error checking permissions results in denial\n   * When false, errors are logged but access is allowed (NOT RECOMMENDED)\n   * @default true\n   */\n  failClosed?: boolean;\n\n  /**\n   * Custom resource resolver function\n   * Converts resource identifiers to RBAC resource UUIDs\n   * If not provided, uses resource ID directly\n   */\n  resourceResolver?: (identifier: string, resourceType?: string) => Promise<string | null>;\n\n  /**\n   * Skip RBAC checks entirely (DEVELOPMENT ONLY)\n   * When true, all RBAC checks are bypassed and requests are allowed.\n   * ⚠️ WARNING: This should NEVER be enabled in production!\n   *\n   * Can also be set via SKIP_RBAC=true environment variable.\n   * Environment variable takes precedence if set.\n   *\n   * Use cases:\n   * - Local development before RBAC is fully configured\n   * - Testing without RBAC service running\n   * - Debugging permission issues\n   *\n   * @default false\n   */\n  skipRbac?: boolean;\n}\n\n/**\n * Permission check result from RBAC service\n */\ninterface CheckPermissionResult {\n  hasPermission: boolean;\n  reason?: string;\n}\n\n/**\n * Simple LRU cache for permission checks\n */\nclass LRUCache<K, V> {\n  private cache = new Map<K, { value: V; expiry: number }>();\n  private maxSize: number;\n  private ttl: number;\n\n  constructor(maxSize: number, ttl: number) {\n    this.maxSize = maxSize;\n    this.ttl = ttl;\n  }\n\n  get(key: K): V | undefined {\n    const entry = this.cache.get(key);\n    if (!entry) return undefined;\n\n    if (Date.now() > entry.expiry) {\n      this.cache.delete(key);\n      return undefined;\n    }\n\n    // Move to end (LRU)\n    this.cache.delete(key);\n    this.cache.set(key, entry);\n\n    return entry.value;\n  }\n\n  set(key: K, value: V): void {\n    // Remove oldest if at capacity\n    if (this.cache.size >= this.maxSize) {\n      const firstKey = this.cache.keys().next().value;\n      if (firstKey !== undefined) {\n        this.cache.delete(firstKey);\n      }\n    }\n\n    this.cache.set(key, {\n      value,\n      expiry: Date.now() + this.ttl,\n    });\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  /**\n   * Invalidate all entries whose key starts with the given prefix.\n   * Used to evict all cached permissions for a specific actor.\n   */\n  invalidateByPrefix(prefix: string): number {\n    let count = 0;\n    for (const key of [...this.cache.keys()]) {\n      if (typeof key === 'string' && key.startsWith(prefix)) {\n        this.cache.delete(key);\n        count++;\n      }\n    }\n    return count;\n  }\n}\n\n/**\n * Input for PBAC permission check\n */\ninterface PermissionCheckInput {\n  actorId: string;\n  actorType: ActorType;\n  scopeId: string;\n  resourceType: string;\n  action: string;\n  resourceId?: string;\n}\n\n/**\n * RBAC service client for permission checks\n */\nclass RBACClient {\n  private client: GraphQLClient;\n  private cache?: LRUCache<string, boolean>;\n  private config: Required<Pick<RBACDirectiveConfig, 'failClosed'>> & { layer: RBACLayer };\n\n  constructor(config: RBACDirectiveConfig) {\n    this.client = new GraphQLClient(config.rbacServiceUrl);\n\n    this.config = {\n      failClosed: config.failClosed !== false,\n      layer: config.layer || 'wspace',\n    };\n\n    if (config.enableCaching !== false) {\n      this.cache = new LRUCache<string, boolean>(\n        config.cacheMaxSize || 10000,\n        config.cacheTTL || 60000 // 1 minute\n      );\n    }\n  }\n\n  /**\n   * Parse permission string into resourceType and action\n   * @example \"project:read\" => { resourceType: \"project\", action: \"read\" }\n   * @example \"rbac:role:create\" => { resourceType: \"rbac\", action: \"role:create\" }\n   */\n  private parsePermission(permission: string): { resourceType: string; action: string } {\n    const colonIndex = permission.indexOf(':');\n    if (colonIndex === -1) {\n      // No colon - treat entire string as resourceType with \"read\" action\n      return { resourceType: permission, action: 'read' };\n    }\n    return {\n      resourceType: permission.substring(0, colonIndex),\n      action: permission.substring(colonIndex + 1),\n    };\n  }\n\n  /**\n   * Check if actor has permission using the new PBAC checkPermission query\n   */\n  async checkPermission(\n    actorId: string,\n    actorType: ActorType,\n    scopeId: string,\n    permission: string,\n    resourceId?: string\n  ): Promise<CheckPermissionResult> {\n    const { resourceType, action } = this.parsePermission(permission);\n    const cacheKey = `${actorId}:${actorType}:${scopeId}:${resourceType}:${action}:${resourceId || ''}`;\n\n    // Check cache\n    if (this.cache) {\n      const cached = this.cache.get(cacheKey);\n      if (cached !== undefined) {\n        logger.debug('[RBAC Directive] Cache hit', {\n          actorId,\n          actorType,\n          scopeId,\n          resourceType,\n          action,\n          resourceId,\n          hasPermission: cached,\n        });\n        return {\n          hasPermission: cached,\n          reason: cached ? 'Cached: Permission granted' : 'Cached: Permission denied',\n        };\n      }\n    }\n\n    // Query RBAC service using new PBAC format\n    const CHECK_PERMISSION_QUERY = `\n      query CheckPermission($input: PermissionCheckInput!) {\n        checkPermission(input: $input) {\n          allowed\n          decisionPath\n          roleName\n          roleLevel\n          overrideType\n        }\n      }\n    `;\n\n    const input: PermissionCheckInput = {\n      actorId,\n      actorType,\n      scopeId,\n      resourceType,\n      action,\n      resourceId,\n    };\n\n    try {\n      logger.debug('[RBAC Directive] Checking permission via RBAC service (PBAC)', {\n        input,\n        layer: this.config.layer,\n      });\n\n      const result = await this.client.request<{\n        checkPermission: {\n          allowed: boolean;\n          decisionPath: string;\n          roleName?: string;\n          roleLevel?: string;\n          overrideType?: string;\n        };\n      }>(CHECK_PERMISSION_QUERY, { input });\n\n      const hasPermission = result.checkPermission.allowed;\n      const decisionPath = result.checkPermission.decisionPath;\n\n      // Cache result\n      if (this.cache) {\n        this.cache.set(cacheKey, hasPermission);\n      }\n\n      logger.debug('[RBAC Directive] Permission check result', {\n        actorId,\n        resourceType,\n        action,\n        hasPermission,\n        decisionPath,\n      });\n\n      return {\n        hasPermission,\n        reason: decisionPath,\n      };\n    } catch (error) {\n      logger.error('[RBAC Directive] RBAC service error', {\n        error,\n        input,\n        layer: this.config.layer,\n      });\n\n      // Fail closed or open based on config\n      if (this.config.failClosed) {\n        return {\n          hasPermission: false,\n          reason: 'RBAC service unavailable - access denied (fail-closed)',\n        };\n      } else {\n        logger.warn('[RBAC Directive] Fail-open mode: allowing access despite RBAC error');\n        return {\n          hasPermission: true,\n          reason: 'RBAC service unavailable - access allowed (fail-open)',\n        };\n      }\n    }\n  }\n\n  /**\n   * Clear permission cache (useful for testing or when permissions change)\n   */\n  clearCache(): void {\n    this.cache?.clear();\n  }\n\n  /**\n   * Invalidate cached permissions for a specific actor.\n   * Call this when an actor's roles or permissions change to avoid stale cache hits.\n   *\n   * @param actorId - The actor whose cached permissions should be evicted\n   * @returns Number of cache entries invalidated\n   */\n  invalidateForActor(actorId: string): number {\n    if (!this.cache) return 0;\n    const count = this.cache.invalidateByPrefix(`${actorId}:`);\n    if (count > 0) {\n      logger.info('[RBAC Directive] Invalidated cached permissions for actor', { actorId, entriesRemoved: count });\n    }\n    return count;\n  }\n\n  /**\n   * Get the configured layer\n   */\n  getLayer(): RBACLayer {\n    return this.config.layer;\n  }\n}\n\n/**\n * Extract value from nested object path\n * @example getValueAtPath({ input: { id: '123' } }, 'input.id') => '123'\n */\nfunction getValueAtPath(obj: Record<string, unknown>, path: string): string | undefined {\n  const parts = path.split('.');\n  let current: unknown = obj;\n\n  for (const part of parts) {\n    if (current === null || current === undefined) {\n      return undefined;\n    }\n    // Type guard: ensure current is an object before property access\n    if (typeof current !== 'object') {\n      return undefined;\n    }\n    current = (current as Record<string, unknown>)[part];\n  }\n\n  return typeof current === 'string' ? current : undefined;\n}\n\n/**\n * Extract directive argument value\n */\nfunction getDirectiveArgument(directive: { arguments?: readonly ArgumentNode[] }, name: string): string | undefined {\n  const arg = directive.arguments?.find((a: ArgumentNode) => a.name.value === name);\n  if (arg && arg.value.kind === 'StringValue') {\n    return arg.value.value;\n  }\n  return undefined;\n}\n\n/**\n * Parse GraphQL arguments to plain object\n */\nfunction parseFieldArguments(field: FieldNode, variableValues: Record<string, unknown>): Record<string, unknown> {\n  const args: Record<string, unknown> = {};\n\n  for (const arg of field.arguments || []) {\n    const argName = arg.name.value;\n    const argValue = arg.value;\n\n    if (argValue.kind === 'Variable') {\n      args[argName] = variableValues[argValue.name.value];\n    } else if (argValue.kind === 'ObjectValue') {\n      args[argName] = parseObjectValue(argValue, variableValues);\n    } else if ('value' in argValue) {\n      args[argName] = argValue.value;\n    }\n  }\n\n  return args;\n}\n\n/**\n * Parse GraphQL object value to plain object\n */\nfunction parseObjectValue(obj: ObjectValueNode, variableValues: Record<string, unknown>): Record<string, unknown> {\n  const result: Record<string, unknown> = {};\n\n  for (const field of obj.fields || []) {\n    const fieldName = field.name.value;\n    const fieldValue = field.value;\n\n    if (fieldValue.kind === 'Variable') {\n      result[fieldName] = variableValues[fieldValue.name.value];\n    } else if (fieldValue.kind === 'ObjectValue') {\n      result[fieldName] = parseObjectValue(fieldValue, variableValues);\n    } else if ('value' in fieldValue) {\n      result[fieldName] = fieldValue.value;\n    }\n  }\n\n  return result;\n}\n\n/**\n * Convert user ID to actor ID format\n *\n * NOTE: This function currently performs no transformation (identity function).\n * It was added as an extension point for future actor ID transformations if needed.\n *\n * Historically, actor IDs used a different format (e.g., \"actor:user-123\"),\n * but this was simplified to use user IDs directly for consistency.\n *\n * Keep this function in place to:\n * 1. Maintain API compatibility with existing code\n * 2. Provide a centralized point for future ID transformations\n * 3. Make the ID transformation intent explicit in the code\n *\n * @param userId - User ID from context\n * @returns Actor ID (currently identical to user ID)\n * @example abc-123 => abc-123\n */\nfunction toActorId(userId: string): string {\n  return userId;\n}\n\n/**\n * Sanitize headers for logging (redact sensitive values)\n * @param headers - Headers object to sanitize\n * @returns Sanitized headers with sensitive values redacted\n */\nfunction sanitizeHeadersForLogging(headers: Record<string, string>): Record<string, string> {\n  const sanitized: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(headers)) {\n    const lowerKey = key.toLowerCase();\n\n    // Redact sensitive headers\n    if (\n      lowerKey.includes('auth') ||\n      lowerKey.includes('token') ||\n      lowerKey.includes('password') ||\n      lowerKey.includes('secret') ||\n      lowerKey.includes('key') ||\n      lowerKey.includes('credential')\n    ) {\n      sanitized[key] = '***REDACTED***';\n    } else {\n      sanitized[key] = value;\n    }\n  }\n\n  return sanitized;\n}\n\n/**\n * Get header value from context (checks both request.headers and headers)\n */\nfunction getHeader(context: RBACContext, key: string): string | undefined {\n  // Try request.headers first (if available)\n  if (context.request?.headers) {\n    // If it has a get method, use it\n    if (typeof context.request.headers.get === 'function') {\n      const value = context.request.headers.get(key);\n      if (value) return value;\n    }\n    // Otherwise treat as object\n    const requestHeaders = context.request.headers as Record<string, string | undefined>;\n    const value = requestHeaders[key];\n    if (value) return value;\n  }\n\n  // Fallback to context.headers\n  if (context.headers) {\n    const contextHeaders = context.headers as Record<string, string | undefined>;\n    const value = contextHeaders[key];\n    if (value) return value;\n  }\n\n  return undefined;\n}\n\n/**\n * Validate bypass timestamp to prevent replay attacks\n * @param timestamp - Timestamp string in milliseconds\n * @returns true if timestamp is fresh (< 1 minute old)\n */\nfunction validateBypassTimestamp(timestamp: string): boolean {\n  try {\n    const timestampMs = parseInt(timestamp, 10);\n    if (isNaN(timestampMs)) {\n      return false;\n    }\n\n    const now = Date.now();\n    const age = now - timestampMs;\n    const MAX_AGE = 60 * 1000; // 1 minute (sufficient for network latency, reduces replay attack window)\n\n    if (age > MAX_AGE || age < 0) {\n      logger.warn('[RBAC Directive] Stale bypass timestamp', {\n        age,\n        timestamp: timestampMs,\n        now,\n      });\n      return false;\n    }\n\n    return true;\n  } catch (error: unknown) {\n    const errorMessage = error instanceof Error ? error.message : 'Unknown error';\n    logger.warn('[RBAC Directive] Invalid bypass timestamp format', {\n      timestamp,\n      error: errorMessage,\n    });\n    return false;\n  }\n}\n\n/**\n * Bypass check result with context information\n */\ninterface BypassCheckResult {\n  shouldBypass: boolean;\n  bypassContext?: {\n    bypassAttempted: boolean;\n    bypassSource?: string;\n    bypassTimestamp?: string;\n    bypassFailureReason?: string;\n  };\n}\n\n/**\n * Check if request should bypass RBAC based on headers\n * This is used for internal service-to-service communication\n *\n * ⚠️ ARCHITECTURE NOTE: Header Transformation Flow\n * ================================================\n * These headers are TRANSFORMED by the Internal API Gateway before reaching this directive.\n *\n * Flow:\n * 1. Service A (internal-client.ts) → Internal API Gateway\n *    Headers sent: x-bypass-permission, x-service-identity, x-call-type\n *\n * 2. Internal API Gateway → Service B (this RBAC directive)\n *    Headers transformed to: x-rbac-bypass, x-bypass-source, x-bypass-timestamp\n *\n * This directive validates the TRANSFORMED headers from the gateway, not the original\n * headers from the internal client. The mismatch between internal-client.ts:101-106\n * and this function is INTENTIONAL and part of the security architecture.\n *\n * DO NOT \"fix\" internal-client.ts to send these headers - the gateway handles transformation.\n *\n * Headers required (after gateway transformation):\n * - x-rbac-bypass: \"true\"\n * - x-bypass-source: Service identity (e.g., \"scheduler-service\")\n * - x-bypass-timestamp: Unix timestamp in milliseconds\n *\n * @param context - GraphQL context containing headers\n * @returns Bypass check result with context for error reporting\n */\nfunction checkBypassHeaders(context: RBACContext): BypassCheckResult {\n  // First check for actor type bypass (service or super_admin bypasses RBAC)\n  const actorType = getHeader(context, 'x-actor-type');\n  const actorId = getHeader(context, 'x-actor-id');\n\n  if (actorType === 'service' || actorType === 'super_admin') {\n    logger.debug('[RBAC Directive] Actor type bypass - service/super_admin', {\n      actorType,\n      actorId,\n    });\n    return { shouldBypass: true };\n  }\n\n  // Debug: Log all available headers\n  logger.debug('[RBAC Directive] Checking bypass headers - context structure', {\n    hasRequest: !!context.request,\n    hasRequestHeaders: !!context.request?.headers,\n    hasContextHeaders: !!context.headers,\n    requestHeadersType: context.request?.headers ? typeof context.request.headers : 'undefined',\n    contextHeadersType: context.headers ? typeof context.headers : 'undefined',\n    actorType,\n    actorId,\n  });\n\n  // Debug: Try to extract and log all headers (sanitized)\n  const allHeaders: Record<string, string> = {};\n  if (context.request?.headers) {\n    if (typeof context.request.headers.get === 'function') {\n      // Headers object with get method\n      logger.debug('[RBAC Directive] Headers object has get method');\n    } else {\n      // Plain object\n      const headers = context.request.headers as Record<string, string | undefined>;\n      Object.keys(headers).forEach((key) => {\n        const value = headers[key];\n        if (value) allHeaders[key] = value;\n      });\n      const sanitizedHeaders = sanitizeHeadersForLogging(allHeaders);\n      logger.debug('[RBAC Directive] Request headers (plain object)', { headers: sanitizedHeaders });\n    }\n  }\n  if (context.headers) {\n    const headers = context.headers as Record<string, string | undefined>;\n    const contextHeadersObj: Record<string, string> = {};\n    Object.keys(headers).forEach((key) => {\n      const value = headers[key];\n      if (value) contextHeadersObj[key] = value;\n    });\n    const sanitizedHeaders = sanitizeHeadersForLogging(contextHeadersObj);\n    logger.debug('[RBAC Directive] Context headers', { headers: sanitizedHeaders });\n  }\n\n  const bypassHeader = getHeader(context, 'x-rbac-bypass');\n  const bypassSource = getHeader(context, 'x-bypass-source');\n  const bypassTimestamp = getHeader(context, 'x-bypass-timestamp');\n\n  logger.debug('[RBAC Directive] Extracted bypass headers', {\n    bypassHeader,\n    bypassSource,\n    bypassTimestamp,\n  });\n\n  // Check if bypass headers are present\n  const bypassAttempted = !!(bypassHeader || bypassSource || bypassTimestamp);\n\n  // Must have all three headers\n  if (!bypassHeader || !bypassSource || !bypassTimestamp) {\n    logger.debug('[RBAC Directive] Missing bypass headers - bypass NOT granted', {\n      hasRbacBypass: !!bypassHeader,\n      hasBypassSource: !!bypassSource,\n      hasBypassTimestamp: !!bypassTimestamp,\n    });\n\n    if (bypassAttempted) {\n      return {\n        shouldBypass: false,\n        bypassContext: {\n          bypassAttempted: true,\n          bypassSource,\n          bypassTimestamp,\n          bypassFailureReason: 'Missing required bypass headers',\n        },\n      };\n    }\n\n    return { shouldBypass: false };\n  }\n\n  // Verify bypass is 'true'\n  if (bypassHeader !== 'true') {\n    logger.warn('[RBAC Directive] Invalid bypass header value', { value: bypassHeader });\n    return {\n      shouldBypass: false,\n      bypassContext: {\n        bypassAttempted: true,\n        bypassSource,\n        bypassTimestamp,\n        bypassFailureReason: `Invalid bypass header value: ${bypassHeader}`,\n      },\n    };\n  }\n\n  // Validate timestamp freshness (prevent replay attacks)\n  if (!validateBypassTimestamp(bypassTimestamp)) {\n    logger.warn('[RBAC Directive] Bypass rejected: stale timestamp', {\n      source: bypassSource,\n      timestamp: bypassTimestamp,\n    });\n    return {\n      shouldBypass: false,\n      bypassContext: {\n        bypassAttempted: true,\n        bypassSource,\n        bypassTimestamp,\n        bypassFailureReason: 'Stale or invalid timestamp (replay attack prevention)',\n      },\n    };\n  }\n\n  // All checks passed\n  logger.debug('[RBAC Directive] Valid bypass headers detected', {\n    source: bypassSource,\n    timestamp: bypassTimestamp,\n  });\n\n  return { shouldBypass: true };\n}\n\n/**\n * Verify user authentication from context\n */\nfunction verifyAuthentication(contextValue: unknown, fieldName: string, permission: string): ContextUser {\n  const ctx = contextValue as RBACContext;\n  const user =\n    ctx.user ??\n    (ctx.actor?.id\n      ? {\n          id: ctx.actor.id,\n          email: ctx.actor.email,\n          workspace_id: ctx.workspace?.id,\n        }\n      : ctx.actorId\n        ? {\n            id: ctx.actorId,\n            workspace_id: ctx.workspace?.id,\n          }\n        : undefined);\n\n  logger.debug('[RBAC Directive] Checking authentication', {\n    hasUser: !!user,\n    userId: user?.id,\n    fieldName,\n  });\n\n  if (!user?.id) {\n    logger.warn('[RBAC Directive] Authentication required but user not found', {\n      fieldName,\n      permission,\n    });\n    throw new GraphQLError('Authentication required', {\n      extensions: {\n        code: 'UNAUTHENTICATED',\n        field: fieldName,\n        permission,\n      },\n    });\n  }\n\n  return user;\n}\n\n/**\n * Resolve resource ID from field arguments and configuration\n */\nasync function resolveResourceId(\n  resourceIdField: string | undefined,\n  selection: FieldNode,\n  variableValues: Record<string, unknown> | null | undefined,\n  config: RBACDirectiveConfig,\n  _rbacClient: RBACClient,\n  _ctx: RBACContext,\n  permission: string,\n  fieldName: string\n): Promise<string> {\n  let resourceId: string | undefined;\n\n  // Parse GraphQL arguments\n  const fieldArgs = parseFieldArguments(selection, variableValues || {});\n\n  if (resourceIdField) {\n    // Explicit resourceIdField specified - use that path\n    resourceId = getValueAtPath(fieldArgs, resourceIdField);\n\n    if (!resourceId) {\n      logger.error('[RBAC Directive] Resource ID not found at specified path', {\n        resourceIdField,\n        fieldName,\n        permission,\n        availableArgs: Object.keys(fieldArgs),\n      });\n\n      throw new GraphQLError(\n        `Resource ID not found at specified path \"${resourceIdField}\" for permission \"${permission}\"`,\n        {\n          extensions: {\n            code: 'INVALID_RESOURCE_CONFIGURATION',\n            field: fieldName,\n            permission,\n            resourceIdField,\n            hint: `Check that the field path \"${resourceIdField}\" exists in your arguments`,\n          },\n        }\n      );\n    }\n\n    logger.debug('[RBAC Directive] Using explicit resourceIdField', {\n      resourceIdField,\n      resourceId,\n      fieldName,\n    });\n  } else {\n    // No resourceIdField specified - try common conventions\n    const defaultPaths = ['id', 'input.id'];\n\n    for (const path of defaultPaths) {\n      resourceId = getValueAtPath(fieldArgs, path);\n      if (resourceId) {\n        logger.debug('[RBAC Directive] Auto-resolved resource ID from convention', {\n          path,\n          resourceId,\n          fieldName,\n          permission,\n        });\n        break;\n      }\n    }\n\n    if (!resourceId) {\n      // Fall back to context-based resource ID from headers\n      // This is useful for list operations where the resource isn't in arguments\n      const contextWorkspaceId = _ctx.workspace?.id;\n\n      if (contextWorkspaceId) {\n        resourceId = contextWorkspaceId;\n        logger.debug('[RBAC Directive] Using workspace ID from context headers', {\n          resourceId,\n          fieldName,\n          permission,\n        });\n      } else {\n        logger.error('[RBAC Directive] No resource ID available for permission check', {\n          permission,\n          fieldName,\n          triedPaths: defaultPaths,\n          availableArgs: Object.keys(fieldArgs),\n        });\n\n        throw new GraphQLError(\n          `Cannot check permission \"${permission}\": No resource ID available. ` +\n            `Tried default paths: ${defaultPaths.join(', ')}. ` +\n            `Either provide one of these fields in your arguments, specify resourceIdField in the directive, or pass x-workspace-id header.`,\n          {\n            extensions: {\n              code: 'INVALID_RESOURCE_CONFIGURATION',\n              field: fieldName,\n              permission,\n              triedPaths: defaultPaths,\n              hint: 'Add resourceIdField parameter to @requiresPermission directive (e.g., resourceIdField: \"input.workspaceId\") or pass x-workspace-id header',\n            },\n          }\n        );\n      }\n    }\n  }\n\n  // Apply custom resource resolver if configured\n  if (resourceId && config.resourceResolver) {\n    const resolved = await config.resourceResolver(resourceId, permission.split(':')[0]);\n\n    if (!resolved) {\n      logger.warn('[RBAC Directive] Custom resource resolver returned null', {\n        originalResourceId: resourceId,\n        permission,\n        fieldName,\n      });\n\n      throw new GraphQLError('Resource not found or invalid', {\n        extensions: {\n          code: 'FORBIDDEN',\n          field: fieldName,\n          permission,\n          resourceId,\n          hint: 'Resource resolver could not resolve the resource ID',\n        },\n      });\n    }\n\n    logger.debug('[RBAC Directive] Custom resource resolver applied', {\n      originalResourceId: resourceId,\n      resolvedResourceId: resolved,\n      fieldName,\n    });\n\n    return resolved;\n  }\n\n  // Return the resource ID as-is (assume it's already a valid UUID/identifier)\n  return resourceId;\n}\n\n/**\n * Extract scope ID from context based on layer\n */\nfunction extractScopeId(ctx: RBACContext, layer: RBACLayer): string {\n  if (layer === 'wspace') {\n    // Workspace layer: use workspaceId\n    const workspaceId = getHeader(ctx, 'x-workspace-id') || ctx.workspace?.id;\n\n    if (!workspaceId) {\n      throw new GraphQLError('Workspace ID required for workspace-layer RBAC', {\n        extensions: { code: 'BAD_REQUEST', hint: 'Pass x-workspace-id header or ensure workspace context is set' },\n      });\n    }\n    return workspaceId;\n  } else {\n    // Global layer: use tenantId or 'global' for superadmin\n    const tenantId = getHeader(ctx, 'x-tenant-id') || ctx.tenant?.id || 'global'; // Default to global scope for superadmin operations\n\n    return tenantId;\n  }\n}\n\n/**\n * Extract actor type from context\n */\nfunction extractActorType(ctx: RBACContext): ActorType {\n  const actorTypeHeader = getHeader(ctx, 'x-actor-type');\n\n  if (actorTypeHeader) {\n    const upperType = actorTypeHeader.toUpperCase();\n    if (['USER', 'BOT', 'INTEGRATION', 'DELEGATED_AGENT'].includes(upperType)) {\n      return upperType as ActorType;\n    }\n  }\n\n  // Default to USER\n  return 'USER';\n}\n\n/**\n * Check permission and throw error if denied\n */\nasync function checkAndEnforcePermission(\n  rbacClient: RBACClient,\n  ctx: RBACContext,\n  actorId: string,\n  permission: string,\n  resolvedResourceId: string | undefined,\n  userId: string,\n  fieldName: string,\n  bypassContext?: {\n    bypassAttempted: boolean;\n    bypassSource?: string;\n    bypassTimestamp?: string;\n    bypassFailureReason?: string;\n  }\n): Promise<void> {\n  const layer = rbacClient.getLayer();\n  const actorType = extractActorType(ctx);\n  const scopeId = extractScopeId(ctx, layer);\n\n  logger.info('[RBAC Directive] Checking permission', {\n    userId,\n    actorId,\n    actorType,\n    scopeId,\n    permission,\n    resourceId: resolvedResourceId,\n    fieldName,\n    layer,\n    bypassAttempted: bypassContext?.bypassAttempted ?? false,\n  });\n\n  const { hasPermission, reason } = await rbacClient.checkPermission(\n    actorId,\n    actorType,\n    scopeId,\n    permission,\n    resolvedResourceId\n  );\n\n  if (!hasPermission) {\n    logger.warn('[RBAC Directive] Permission denied', {\n      userId,\n      actorType,\n      scopeId,\n      permission,\n      reason,\n      fieldName,\n      bypassContext,\n    });\n\n    const reasonSuffix = reason ? ` - ${reason}` : '';\n    const errorMessage = `Forbidden: Missing permission \"${permission}\"${reasonSuffix}`;\n\n    // Include bypass context in error extensions for debugging\n    const extensions: Record<string, unknown> = {\n      code: 'FORBIDDEN',\n      permission,\n      reason,\n      field: fieldName,\n      resourceId: resolvedResourceId,\n      scopeId,\n      layer,\n    };\n\n    // Add bypass context if a bypass was attempted but failed\n    if (bypassContext?.bypassAttempted) {\n      extensions['bypassAttempted'] = true;\n      extensions['bypassSource'] = bypassContext.bypassSource;\n      extensions['bypassTimestamp'] = bypassContext.bypassTimestamp;\n      extensions['bypassFailureReason'] = bypassContext.bypassFailureReason;\n    }\n\n    throw new GraphQLError(errorMessage, { extensions });\n  }\n\n  logger.info('[RBAC Directive] Permission granted', {\n    userId,\n    permission,\n    fieldName,\n    reason,\n  });\n}\n\n/**\n * Create RBAC directive enforcement plugin\n *\n * This plugin:\n * 1. Intercepts GraphQL operations BEFORE execution\n * 2. Checks for @requiresPermission directive on fields\n * 3. Validates user authentication\n * 4. Extracts resource ID from field arguments\n * 5. Calls RBAC service to check permissions\n * 6. Allows or denies operation based on permission check\n *\n * @param config - RBAC directive configuration\n * @returns Envelop plugin instance\n *\n * @example\n * ```typescript\n * // In microservice server initialization\n * const server = await createServer({\n *   yogaPlugins: [\n *     createRBACDirective({\n *       // Use Workspaces Gateway (RBAC is part of workspaces supergraph)\n *       rbacServiceUrl: process.env.RBAC_GATEWAY_URL || 'http://localhost:4001/graphql',\n *       enableCaching: true,\n *       cacheTTL: 300000, // 5 minutes\n *       failClosed: true, // Deny access on errors\n *     }),\n *     useGraphQLModules(application),\n *   ],\n * });\n * ```\n */\nexport function createRBACDirective(config: RBACDirectiveConfig): Plugin {\n  // Check for SKIP_RBAC - environment variable takes precedence over config\n  const skipRbac = process.env['SKIP_RBAC'] === 'true' || config.skipRbac === true;\n\n  if (skipRbac) {\n    const isProduction = process.env['NODE_ENV'] === 'production';\n\n    // CRITICAL: Prevent SKIP_RBAC in production environments\n    if (isProduction) {\n      throw new Error(\n        '[RBAC Directive] FATAL: SKIP_RBAC cannot be enabled in production environments. ' +\n          'This would bypass all authorization checks and is a critical security vulnerability. ' +\n          'Remove SKIP_RBAC=true from your environment configuration.'\n      );\n    }\n\n    logger.warn('[RBAC Directive] ⚠️ RBAC CHECKS ARE DISABLED (SKIP_RBAC=true) - DO NOT USE IN PRODUCTION!');\n    return {\n      async onExecute({ args }): Promise<void> {\n        // Log which operation is being executed without RBAC checks for audit trail\n        const { document } = args;\n        const operation = document.definitions.find(\n          (def: DefinitionNode): def is OperationDefinitionNode => def.kind === 'OperationDefinition'\n        );\n        const operationName = operation?.name?.value || 'anonymous';\n        logger.warn('[RBAC Directive] RBAC check skipped for operation', { operationName });\n      },\n    };\n  }\n\n  const rbacClient = new RBACClient(config);\n\n  return {\n    // 🔒 CRITICAL: Use onExecute (not onExecuteDone) to block BEFORE execution\n    async onExecute({ args }): Promise<void> {\n      logger.debug('[RBAC Directive] onExecute called');\n      const { schema, document, contextValue, variableValues } = args;\n\n      // Find the operation definition\n      const operation = document.definitions.find(\n        (def: DefinitionNode): def is OperationDefinitionNode => def.kind === 'OperationDefinition'\n      );\n\n      if (!operation) {\n        logger.debug('[RBAC Directive] No operation definition found, skipping');\n        return;\n      }\n\n      // Get the type based on operation (Query or Mutation)\n      const typeName = operation.operation === 'mutation' ? 'Mutation' : 'Query';\n      const type = schema.getType(typeName);\n\n      if (!type || !('getFields' in type)) {\n        logger.debug(`[RBAC Directive] Type ${typeName} not found, skipping`);\n        return;\n      }\n\n      const fields = type.getFields();\n\n      // Check each selected field for @requiresPermission directive\n      for (const selection of operation.selectionSet.selections) {\n        if (selection.kind !== 'Field') {\n          continue;\n        }\n\n        const fieldName = selection.name.value;\n        const fieldDef = fields[fieldName];\n\n        if (!fieldDef?.astNode) {\n          continue;\n        }\n\n        // Find @requiresPermission directive\n        const directive = fieldDef.astNode.directives?.find(\n          (d: DirectiveNode) => d.name.value === 'requiresPermission'\n        );\n\n        if (!directive) {\n          // No directive on this field, continue\n          continue;\n        }\n\n        // Extract directive arguments\n        const permission = getDirectiveArgument(directive, 'permission');\n        const resourceIdField = getDirectiveArgument(directive, 'resourceIdField');\n\n        if (!permission) {\n          throw new GraphQLError(\n            'Invalid @requiresPermission directive: permission argument is required and must be a string',\n            {\n              extensions: { code: 'INTERNAL_SERVER_ERROR', field: fieldName },\n            }\n          );\n        }\n\n        // CHECK FOR BYPASS HEADERS FIRST (internal service-to-service calls)\n        const ctx = contextValue as RBACContext;\n        const bypassCheckResult = checkBypassHeaders(ctx);\n\n        if (bypassCheckResult.shouldBypass) {\n          // Log bypass for audit trail\n          const bypassSource = getHeader(ctx, 'x-bypass-source');\n          const bypassTimestamp = getHeader(ctx, 'x-bypass-timestamp');\n\n          logger.info('[RBAC Directive] RBAC bypassed for internal service call', {\n            field: fieldName,\n            permission,\n            resource: resourceIdField,\n            bypassSource,\n            bypassTimestamp,\n            operationType: operation.operation,\n          });\n\n          // Skip RBAC check, continue to next field\n          continue;\n        }\n\n        // REGULAR RBAC FLOW (user requests)\n        // Check authentication\n        // SECURITY: This directive REQUIRES authenticated context to be set by upstream middleware\n        // We do NOT decode/verify JWT tokens here - that must be done by auth middleware\n        const user = verifyAuthentication(contextValue, fieldName, permission);\n\n        // Resolve resource ID (optional - not all permissions need a specific resource)\n        let resolvedResourceId: string | undefined;\n        try {\n          resolvedResourceId = await resolveResourceId(\n            resourceIdField,\n            selection as FieldNode,\n            variableValues,\n            config,\n            rbacClient,\n            ctx,\n            permission,\n            fieldName\n          );\n        } catch (error) {\n          // If resourceIdField was not specified and we couldn't resolve it,\n          // that's OK for permission checks that don't need a specific resource\n          if (!resourceIdField) {\n            logger.debug('[RBAC Directive] No resource ID resolved, checking permission at scope level', {\n              fieldName,\n              permission,\n            });\n          } else {\n            // If resourceIdField WAS specified but we couldn't resolve, that's an error\n            throw error;\n          }\n        }\n\n        // Convert user ID to actor ID and check permission\n        const actorId = toActorId(user.id);\n        await checkAndEnforcePermission(\n          rbacClient,\n          ctx,\n          actorId,\n          permission,\n          resolvedResourceId,\n          user.id,\n          fieldName,\n          bypassCheckResult.bypassContext\n        );\n      }\n\n      // All checks passed - allow execution\n    },\n  };\n}\n\n/**\n * Export RBACClient for direct use if needed\n */\nexport { RBACClient };\n\n// ========================================================================\n// Layer-Aware Factory Functions\n// ========================================================================\n\n/**\n * Layer-aware RBAC configuration\n */\nexport interface LayerAwareRBACConfig extends Omit<RBACDirectiveConfig, 'rbacServiceUrl' | 'layer'> {\n  /**\n   * Override RBAC service URL (optional)\n   * If not provided, will be resolved from layer defaults\n   */\n  rbacServiceUrl?: string;\n}\n\n/**\n * Build RBAC service URL for a layer\n *\n * @param layer - Service layer ('wspace' or 'global')\n * @returns RBAC service URL\n */\nfunction buildRBACServiceUrl(layer: ServiceLayer): string {\n  const routing = DEFAULT_GATEWAY_ROUTING[layer];\n\n  // RBAC is accessed via the internal gateway for the current layer\n  // wspace layer → wspace-int-gateway (RBAC is part of workspaces supergraph)\n  // global layer → global-int-gateway (needs to call wspace layer for RBAC)\n  const gateway = layer === 'wspace' ? routing.internalGateway : routing.crossLayerGateway;\n\n  return `http://${gateway.host}:${gateway.port}${gateway.graphqlPath}`;\n}\n\n/**\n * Create RBAC directive plugin for a specific layer\n *\n * This factory function automatically configures the RBAC directive with\n * the correct internal gateway URL based on the service layer.\n *\n * @param layer - Service layer ('wspace' or 'global')\n * @param config - Optional configuration overrides\n * @returns RBAC directive plugin configured for the layer\n *\n * @example\n * ```typescript\n * // In a workspace layer service\n * const rbacPlugin = createRBACDirectiveForLayer('wspace', {\n *   enableCaching: true,\n *   cacheTTL: 300000,\n * });\n *\n * // In a global layer service\n * const rbacPlugin = createRBACDirectiveForLayer('global', {\n *   enableCaching: true,\n * });\n * ```\n */\nexport function createRBACDirectiveForLayer(layer: ServiceLayer, config?: LayerAwareRBACConfig): Plugin {\n  const envPrefix = layer.toUpperCase();\n\n  // Resolve RBAC service URL with priority:\n  // 1. Explicit config.rbacServiceUrl\n  // 2. Layer-specific env var (WSPACE_RBAC_GATEWAY_URL or GLOBAL_RBAC_GATEWAY_URL)\n  // 3. Generic env var (RBAC_GATEWAY_URL)\n  // 4. Layer defaults\n  const rbacServiceUrl =\n    config?.rbacServiceUrl ||\n    process.env[`${envPrefix}_RBAC_GATEWAY_URL`] ||\n    process.env['RBAC_GATEWAY_URL'] ||\n    buildRBACServiceUrl(layer);\n\n  // Map ServiceLayer to RBACLayer (they're compatible but different types)\n  const rbacLayer: RBACLayer = layer as RBACLayer;\n\n  logger.info('[RBAC Directive] Creating layer-aware RBAC directive', {\n    layer: rbacLayer,\n    rbacServiceUrl,\n    enableCaching: config?.enableCaching ?? true,\n  });\n\n  return createRBACDirective({\n    rbacServiceUrl,\n    layer: rbacLayer,\n    enableCaching: config?.enableCaching ?? true,\n    cacheTTL: config?.cacheTTL,\n    cacheMaxSize: config?.cacheMaxSize,\n    timeout: config?.timeout,\n    failClosed: config?.failClosed,\n    resourceResolver: config?.resourceResolver,\n    skipRbac: config?.skipRbac,\n  });\n}\n\n/**\n * Create RBAC directive from environment with automatic layer detection\n *\n * @param serviceName - Service name for layer detection\n * @param config - Optional configuration overrides\n * @returns RBAC directive plugin\n */\nexport function createRBACDirectiveFromEnv(serviceName: string, config?: LayerAwareRBACConfig): Plugin {\n  // Detect layer from service name or environment\n  const layer =\n    (process.env['SERVICE_LAYER'] as ServiceLayer) || (serviceName.startsWith('global-') ? 'global' : 'wspace');\n\n  return createRBACDirectiveForLayer(layer, config);\n}\n","/**\n * RBAC Module\n * Role-Based Access Control - Permission checking and resource management\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { PermissionDeniedError, ValidationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\n\n// Export centralized RBAC directive plugin\nexport {\n  createRBACDirective,\n  createRBACDirectiveForLayer,\n  createRBACDirectiveFromEnv,\n  type RBACDirectiveConfig,\n  type LayerAwareRBACConfig,\n  RBACClient,\n} from './directive.js';\n\nimport { RBACClient } from './directive.js';\nimport type { ServiceLayer } from '../types/layer.js';\nimport { DEFAULT_LAYER_RESOURCES } from '../types/layer.js';\n\n/**\n * Build an `RBACClient` from env vars (mirrors `createRBACDirectiveFromEnv`).\n *\n * Resolution order for the gateway URL:\n *  1. explicit `rbacServiceUrl` option\n *  2. `<LAYER>_RBAC_GATEWAY_URL`\n *  3. `RBAC_GATEWAY_URL`\n *  4. layer default\n */\nexport function createRBACClientFromEnv(\n  options: { rbacServiceUrl?: string; layer?: ServiceLayer; failClosed?: boolean } = {}\n): RBACClient {\n  const layer: ServiceLayer =\n    options.layer ?? ((process.env['SERVICE_LAYER'] as ServiceLayer) || 'wspace');\n  const envPrefix = layer.toUpperCase();\n  const rbacServiceUrl =\n    options.rbacServiceUrl ||\n    process.env[`${envPrefix}_RBAC_GATEWAY_URL`] ||\n    process.env['RBAC_GATEWAY_URL'] ||\n    DEFAULT_LAYER_RESOURCES[layer].rbacGatewayUrl;\n  return new RBACClient({\n    rbacServiceUrl,\n    layer,\n    failClosed: options.failClosed,\n  });\n}\n\nexport type PBACActorType = 'USER' | 'BOT' | 'INTEGRATION' | 'DELEGATED_AGENT';\n\nexport type PBACPermissionLevel = 'ADMIN' | 'EDITOR' | 'VIEWER' | 'NONE';\n\nexport interface CheckPermissionOptions {\n  userId: string;\n  action: string;\n  resourceType: string;\n  resourceId?: string;\n  workspaceId?: string;\n  /** Actor type for the PBAC system. Defaults to 'USER' */\n  actorType?: PBACActorType;\n}\n\nexport interface EffectivePermissionEntry {\n  resourceType: string;\n  level: PBACPermissionLevel;\n  allowedActions: string[];\n  source: string;\n}\n\nexport interface RoleDefaultPermission {\n  resourceType: string;\n  level: PBACPermissionLevel;\n}\n\nexport interface Role {\n  id: string;\n  name: string;\n  description?: string;\n  /** Default permission levels per resource type (PBAC) */\n  defaultPermissions?: RoleDefaultPermission[];\n}\n\nexport interface Permission {\n  id: string;\n  action: string;\n  resourceType: string;\n  description?: string;\n}\n\n/**\n * RBAC Module\n */\nexport class RBACModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Check if user has permission (returns boolean)\n   */\n  public async checkPermission(options: CheckPermissionOptions): Promise<boolean> {\n    try {\n      await this.requirePermission(options);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  /**\n   * Require permission (throws if denied)\n   */\n  public async requirePermission(options: CheckPermissionOptions): Promise<void> {\n    if (!options.userId) {\n      throw new ValidationError('User ID is required');\n    }\n\n    if (!options.action) {\n      throw new ValidationError('Action is required');\n    }\n\n    if (!options.resourceType) {\n      throw new ValidationError('Resource type is required');\n    }\n\n    logger.debug('[RBAC] Checking permission', options as unknown as Record<string, unknown>);\n\n    // Use the new PBAC PermissionCheckInput format\n    // Note: The new unified RBAC uses actorId + actorType + scopeId instead of userId + workspaceId\n    const query = `\n      query CheckPermission($input: PermissionCheckInput!) {\n        checkPermission(input: $input) {\n          allowed\n          decisionPath\n        }\n      }\n    `;\n\n    const variables = {\n      input: {\n        actorId: options.userId,\n        actorType: options.actorType || 'USER',\n        scopeId: options.workspaceId || this.context.workspaceId || this.context.tenantId || '',\n        resourceType: options.resourceType,\n        action: options.action,\n        resourceId: options.resourceId,\n      },\n    };\n\n    // RBAC operations should go to the workspace supergraph if we have a workspaceId,\n    // otherwise fall back to tenant supergraph\n    const response =\n      options.workspaceId || this.context.workspaceId\n        ? await this.client.query<{\n            checkPermission: { allowed: boolean; decisionPath: string };\n          }>(query, variables, this.context)\n        : await this.client.tenantQuery<{\n            checkPermission: { allowed: boolean; decisionPath: string };\n          }>(query, variables, this.context);\n\n    if (!response.checkPermission.allowed) {\n      throw new PermissionDeniedError(`Permission denied: ${response.checkPermission.decisionPath}`, {\n        action: options.action,\n        resourceType: options.resourceType,\n        resourceId: options.resourceId,\n        userId: options.userId,\n      });\n    }\n\n    logger.debug('[RBAC] Permission granted', {\n      ...options,\n      decisionPath: response.checkPermission.decisionPath,\n    } as unknown as Record<string, unknown>);\n  }\n\n  /**\n   * Get user roles in workspace\n   * Uses the new PBAC actorRoleAssignments query\n   */\n  public async getUserRoles(userId: string, workspaceId: string): Promise<Role[]> {\n    logger.debug('[RBAC] Getting user roles', { userId, workspaceId });\n\n    // Use the new PBAC actorRoleAssignments query\n    const query = `\n      query GetActorRoleAssignments($actorId: String!, $scopeId: String!) {\n        actorRoleAssignments(actorId: $actorId, scopeId: $scopeId) {\n          id\n          role {\n            id\n            name\n            description\n            defaultPermissions {\n              resourceType\n              level\n            }\n          }\n        }\n      }\n    `;\n\n    const variables = {\n      actorId: userId,\n      scopeId: workspaceId,\n    };\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    // Use workspace supergraph for workspace-scoped RBAC\n    const response = await this.client.query<{\n      actorRoleAssignments: Array<{\n        id: string;\n        role: {\n          id: string;\n          name: string;\n          description?: string;\n          defaultPermissions: RoleDefaultPermission[];\n        };\n      }>;\n    }>(query, variables, contextWithWorkspace);\n\n    // Map the roles to the expected format\n    return response.actorRoleAssignments.map((assignment) => ({\n      id: assignment.role.id,\n      name: assignment.role.name,\n      description: assignment.role.description,\n      defaultPermissions: assignment.role.defaultPermissions,\n    }));\n  }\n\n  /**\n   * Assign role to user\n   * Uses the new PBAC assignRoleToActor mutation\n   */\n  public async assignRoleToUser(\n    userId: string,\n    roleId: string,\n    workspaceId: string,\n    actorType: 'USER' | 'BOT' | 'INTEGRATION' | 'DELEGATED_AGENT' = 'USER'\n  ): Promise<boolean> {\n    logger.debug('[RBAC] Assigning role to user', { userId, roleId, workspaceId, actorType });\n\n    // Use the new PBAC assignRoleToActor mutation\n    const mutation = `\n      mutation AssignRoleToActor($input: AssignRoleInput!) {\n        assignRoleToActor(input: $input) {\n          id\n          actorId\n          roleId\n          scopeId\n        }\n      }\n    `;\n\n    const variables = {\n      input: {\n        actorId: userId,\n        actorType,\n        roleId,\n        scopeId: workspaceId,\n      },\n    };\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    // Use workspace supergraph for workspace-scoped RBAC\n    await this.client.query(mutation, variables, contextWithWorkspace);\n\n    logger.info('[RBAC] Role assigned to actor', { userId, roleId, workspaceId });\n\n    return true;\n  }\n\n  /**\n   * Remove role from user\n   * Uses the new PBAC removeRoleFromActor mutation\n   * Note: This first finds the assignment ID, then removes it\n   */\n  public async removeRoleFromUser(userId: string, roleId: string, workspaceId: string): Promise<boolean> {\n    logger.debug('[RBAC] Removing role from user', { userId, roleId, workspaceId });\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    // First, find the assignment to get its ID\n    const findQuery = `\n      query FindAssignment($actorId: String!, $scopeId: String!) {\n        actorRoleAssignments(actorId: $actorId, scopeId: $scopeId) {\n          id\n          roleId\n        }\n      }\n    `;\n\n    const findResponse = await this.client.query<{\n      actorRoleAssignments: Array<{ id: string; roleId: string }>;\n    }>(findQuery, { actorId: userId, scopeId: workspaceId }, contextWithWorkspace);\n\n    const assignment = findResponse.actorRoleAssignments.find((a) => a.roleId === roleId);\n\n    if (!assignment) {\n      logger.warn('[RBAC] No role assignment found to remove', { userId, roleId, workspaceId });\n      return false;\n    }\n\n    // Use the new PBAC removeRoleFromActor mutation\n    const mutation = `\n      mutation RemoveRoleFromActor($assignmentId: ID!) {\n        removeRoleFromActor(assignmentId: $assignmentId)\n      }\n    `;\n\n    await this.client.query(mutation, { assignmentId: assignment.id }, contextWithWorkspace);\n\n    logger.info('[RBAC] Role removed from actor', { userId, roleId, workspaceId, assignmentId: assignment.id });\n\n    return true;\n  }\n\n  /**\n   * Create custom role with default permissions\n   *\n   * Uses the new PBAC createRole mutation and setRoleDefaultPermission for permissions.\n   *\n   * @param name - Role name\n   * @param description - Role description\n   * @param defaultPermissions - Array of default permission configurations\n   *                            (e.g., [{ resourceType: 'project', level: 'ADMIN' }])\n   *                            OR legacy permission strings (converted to ADMIN level)\n   * @param workspaceId - Workspace ID (scopeId)\n   */\n  public async createRole(\n    name: string,\n    description: string,\n    defaultPermissions: RoleDefaultPermission[] | string[],\n    workspaceId: string\n  ): Promise<Role> {\n    logger.debug('[RBAC] Creating role', { name, workspaceId, permissionCount: defaultPermissions.length });\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    // Step 1: Create the role using new PBAC mutation\n    const createRoleMutation = `\n      mutation CreateRole($input: CreateRoleInput!) {\n        createRole(input: $input) {\n          id\n          name\n          description\n          defaultPermissions {\n            resourceType\n            level\n          }\n        }\n      }\n    `;\n\n    const createRoleVariables = {\n      input: {\n        name,\n        description,\n        scopeId: workspaceId,\n        scopeType: 'workspace',\n      },\n    };\n\n    // Use workspace supergraph for workspace-scoped RBAC\n    const createResponse = await this.client.query<{\n      createRole: {\n        id: string;\n        name: string;\n        description?: string;\n        defaultPermissions: Array<{ resourceType: string; level: string }>;\n      };\n    }>(createRoleMutation, createRoleVariables, contextWithWorkspace);\n\n    const roleId = createResponse.createRole.id;\n    logger.info('[RBAC] Role created', { name, roleId });\n\n    // Step 2: Set default permissions if provided\n    if (defaultPermissions.length > 0) {\n      logger.debug('[RBAC] Setting default permissions for role', { roleId, count: defaultPermissions.length });\n\n      // Convert legacy string permissions to new format\n      const normalizedPermissions: RoleDefaultPermission[] = defaultPermissions.map((perm) => {\n        if (typeof perm === 'string') {\n          // Legacy format: \"resourceType:action\" - convert to ADMIN level\n          const resourceType = perm.split(':')[0] || perm;\n          return { resourceType, level: 'ADMIN' as PBACPermissionLevel };\n        }\n        return perm;\n      });\n\n      // Deduplicate by resourceType (keep the highest level)\n      const permMap = new Map<string, PBACPermissionLevel>();\n      const levelPriority: Record<PBACPermissionLevel, number> = { ADMIN: 4, EDITOR: 3, VIEWER: 2, NONE: 1 };\n\n      for (const perm of normalizedPermissions) {\n        const existing = permMap.get(perm.resourceType);\n        if (!existing || levelPriority[perm.level] > levelPriority[existing]) {\n          permMap.set(perm.resourceType, perm.level);\n        }\n      }\n\n      // Set each default permission\n      const setPermissionMutation = `\n        mutation SetRoleDefaultPermission($input: SetRoleDefaultPermissionInput!) {\n          setRoleDefaultPermission(input: $input) {\n            id\n            defaultPermissions {\n              resourceType\n              level\n            }\n          }\n        }\n      `;\n\n      // Track failed permissions to report at the end\n      const failedPermissions: Array<{ resourceType: string; level: string; error: string }> = [];\n\n      for (const [resourceType, level] of permMap) {\n        try {\n          await this.client.query(\n            setPermissionMutation,\n            {\n              input: {\n                roleId,\n                resourceType,\n                level,\n              },\n            },\n            contextWithWorkspace\n          );\n          logger.debug('[RBAC] Set default permission', { roleId, resourceType, level });\n        } catch (error) {\n          const errorMsg = error instanceof Error ? error.message : String(error);\n          logger.error('[RBAC] Failed to set default permission', {\n            roleId,\n            resourceType,\n            level,\n            error: errorMsg,\n          });\n          failedPermissions.push({ resourceType, level, error: errorMsg });\n        }\n      }\n\n      // If any permissions failed, throw an error with details\n      if (failedPermissions.length > 0) {\n        const failedTypes = failedPermissions.map((p) => p.resourceType).join(', ');\n        throw new ValidationError(\n          `Role created but failed to set ${failedPermissions.length} default permission(s): ${failedTypes}. ` +\n            `Role ID: ${roleId}. Check logs for details.`\n        );\n      }\n\n      logger.info('[RBAC] Default permissions set for role', { roleId, count: permMap.size });\n    }\n\n    // Fetch the updated role\n    const roleQuery = `\n      query GetRole($id: ID!) {\n        role(id: $id) {\n          id\n          name\n          description\n          defaultPermissions {\n            resourceType\n            level\n          }\n        }\n      }\n    `;\n\n    const roleResponse = await this.client.query<{\n      role: {\n        id: string;\n        name: string;\n        description?: string;\n        defaultPermissions: RoleDefaultPermission[];\n      } | null;\n    }>(roleQuery, { id: roleId }, contextWithWorkspace);\n\n    const role = roleResponse.role || createResponse.createRole;\n\n    // Return the role with mapped permissions (backward compatible format)\n    return {\n      id: role.id,\n      name: role.name,\n      description: role.description,\n      defaultPermissions: role.defaultPermissions as RoleDefaultPermission[],\n    };\n  }\n\n  /**\n   * Get all available action definitions (replaces getAvailablePermissions)\n   * Returns actions organized by resource type\n   */\n  public async getAvailablePermissions(): Promise<Permission[]> {\n    logger.debug('[RBAC] Getting available action definitions');\n\n    // Use the new PBAC resourceTypes and actionDefinitions queries\n    const resourceTypesQuery = `\n      query GetResourceTypes {\n        resourceTypes\n      }\n    `;\n\n    // Get from workspace supergraph if we have workspace context\n    const hasWorkspace = !!this.context.workspaceId;\n\n    const resourceTypesResponse = hasWorkspace\n      ? await this.client.query<{ resourceTypes: string[] }>(resourceTypesQuery, {}, this.context)\n      : await this.client.tenantQuery<{ resourceTypes: string[] }>(resourceTypesQuery, {}, this.context);\n\n    const permissions: Permission[] = [];\n\n    // Get action definitions for each resource type\n    const actionsQuery = `\n      query GetActionDefinitions($resourceType: String!) {\n        actionDefinitions(resourceType: $resourceType) {\n          id\n          action\n          resourceType\n          description\n        }\n      }\n    `;\n\n    for (const resourceType of resourceTypesResponse.resourceTypes) {\n      const actionsResponse = hasWorkspace\n        ? await this.client.query<{\n            actionDefinitions: Array<{ id: string; action: string; resourceType: string; description?: string }>;\n          }>(actionsQuery, { resourceType }, this.context)\n        : await this.client.tenantQuery<{\n            actionDefinitions: Array<{ id: string; action: string; resourceType: string; description?: string }>;\n          }>(actionsQuery, { resourceType }, this.context);\n\n      for (const action of actionsResponse.actionDefinitions) {\n        permissions.push({\n          id: action.id,\n          action: action.action,\n          resourceType: action.resourceType,\n          description: action.description,\n        });\n      }\n    }\n\n    return permissions;\n  }\n\n  /**\n   * Check multiple permissions at once\n   * Uses the new PBAC checkPermissions query\n   */\n  public async checkMultiplePermissions(\n    checks: CheckPermissionOptions[]\n  ): Promise<Array<{ allowed: boolean; reason?: string }>> {\n    logger.debug('[RBAC] Checking multiple permissions', { count: checks.length });\n\n    // Use the new PBAC checkPermissions query\n    const query = `\n      query CheckPermissions($inputs: [PermissionCheckInput!]!) {\n        checkPermissions(inputs: $inputs) {\n          allowed\n          decisionPath\n        }\n      }\n    `;\n\n    // Convert to new PBAC input format\n    const inputs = checks.map((check) => ({\n      actorId: check.userId,\n      actorType: check.actorType || 'USER',\n      scopeId: check.workspaceId || this.context.workspaceId || this.context.tenantId || '',\n      resourceType: check.resourceType,\n      action: check.action,\n      resourceId: check.resourceId,\n    }));\n\n    // Use workspace supergraph if any check has workspaceId\n    const hasWorkspace = checks.some((c) => c.workspaceId) || !!this.context.workspaceId;\n\n    const response = hasWorkspace\n      ? await this.client.query<{\n          checkPermissions: Array<{ allowed: boolean; decisionPath: string }>;\n        }>(query, { inputs }, this.context)\n      : await this.client.tenantQuery<{\n          checkPermissions: Array<{ allowed: boolean; decisionPath: string }>;\n        }>(query, { inputs }, this.context);\n\n    // Map to backward-compatible format\n    return response.checkPermissions.map((result) => ({\n      allowed: result.allowed,\n      reason: result.decisionPath,\n    }));\n  }\n\n  /**\n   * Get effective permissions for a user in a workspace\n   * New method that uses the PBAC effectivePermissions query\n   */\n  public async getEffectivePermissions(\n    userId: string,\n    workspaceId: string,\n    actorType: 'USER' | 'BOT' | 'INTEGRATION' | 'DELEGATED_AGENT' = 'USER'\n  ): Promise<{\n    actorId: string;\n    scopeId: string;\n    permissions: EffectivePermissionEntry[];\n  }> {\n    logger.debug('[RBAC] Getting effective permissions', { userId, workspaceId, actorType });\n\n    const query = `\n      query EffectivePermissions($actorId: String!, $actorType: ActorType!, $scopeId: String!) {\n        effectivePermissions(actorId: $actorId, actorType: $actorType, scopeId: $scopeId) {\n          actorId\n          scopeId\n          permissions {\n            resourceType\n            level\n            allowedActions\n            source\n          }\n        }\n      }\n    `;\n\n    const variables = {\n      actorId: userId,\n      actorType,\n      scopeId: workspaceId,\n    };\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    const response = await this.client.query<{\n      effectivePermissions: {\n        actorId: string;\n        scopeId: string;\n        permissions: EffectivePermissionEntry[];\n      };\n    }>(query, variables, contextWithWorkspace);\n\n    return response.effectivePermissions;\n  }\n\n  /**\n   * Initialize workspace roles by cloning system roles\n   * New method for workspace initialization\n   */\n  public async initializeWorkspaceRoles(\n    workspaceId: string,\n    ownerId: string\n  ): Promise<{\n    success: boolean;\n    rolesCreated: number;\n    roleNames: string[];\n    ownerAssigned: boolean;\n    message: string;\n  }> {\n    logger.debug('[RBAC] Initializing workspace roles', { workspaceId, ownerId });\n\n    const mutation = `\n      mutation InitializeWorkspaceRoles($workspaceId: String!, $ownerId: String!) {\n        initializeWorkspaceRoles(workspaceId: $workspaceId, ownerId: $ownerId) {\n          success\n          rolesCreated\n          roleNames\n          ownerAssigned\n          message\n        }\n      }\n    `;\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    const response = await this.client.query<{\n      initializeWorkspaceRoles: {\n        success: boolean;\n        rolesCreated: number;\n        roleNames: string[];\n        ownerAssigned: boolean;\n        message: string;\n      };\n    }>(mutation, { workspaceId, ownerId }, contextWithWorkspace);\n\n    logger.info('[RBAC] Workspace roles initialized', response.initializeWorkspaceRoles);\n\n    return response.initializeWorkspaceRoles;\n  }\n\n  /**\n   * Update an existing role\n   * Uses the new PBAC updateRole mutation\n   *\n   * @param roleId - Role ID to update\n   * @param updates - Fields to update (name, description, priority)\n   * @param workspaceId - Workspace ID (scopeId)\n   */\n  public async updateRole(\n    roleId: string,\n    updates: {\n      name?: string;\n      description?: string;\n      priority?: number;\n    },\n    workspaceId: string\n  ): Promise<Role> {\n    logger.debug('[RBAC] Updating role', { roleId, updates, workspaceId });\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    const mutation = `\n      mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {\n        updateRole(id: $id, input: $input) {\n          id\n          name\n          description\n          priority\n          defaultPermissions {\n            resourceType\n            level\n          }\n        }\n      }\n    `;\n\n    const response = await this.client.query<{\n      updateRole: {\n        id: string;\n        name: string;\n        description?: string;\n        priority: number;\n        defaultPermissions: RoleDefaultPermission[];\n      };\n    }>(mutation, { id: roleId, input: updates }, contextWithWorkspace);\n\n    logger.info('[RBAC] Role updated', { roleId, name: response.updateRole.name });\n\n    // Return in backward-compatible format\n    return {\n      id: response.updateRole.id,\n      name: response.updateRole.name,\n      description: response.updateRole.description,\n      defaultPermissions: response.updateRole.defaultPermissions,\n    };\n  }\n\n  /**\n   * Delete a role\n   * Uses the new PBAC deleteRole mutation\n   *\n   * @param roleId - Role ID to delete\n   * @param workspaceId - Workspace ID (scopeId)\n   * @param reassignToRoleId - Optional role ID to reassign existing actors to\n   */\n  public async deleteRole(roleId: string, workspaceId: string, reassignToRoleId?: string): Promise<boolean> {\n    logger.debug('[RBAC] Deleting role', { roleId, workspaceId, reassignToRoleId });\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    const mutation = `\n      mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {\n        deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)\n      }\n    `;\n\n    const response = await this.client.query<{\n      deleteRole: boolean;\n    }>(mutation, { id: roleId, reassignToRoleId }, contextWithWorkspace);\n\n    logger.info('[RBAC] Role deleted', { roleId, success: response.deleteRole });\n\n    return response.deleteRole;\n  }\n\n  /**\n   * List roles in a workspace\n   * Uses the new PBAC roles query\n   *\n   * @param workspaceId - Workspace ID (scopeId)\n   * @param options - Filter and pagination options\n   */\n  public async listRoles(\n    workspaceId: string,\n    options?: {\n      includeSystem?: boolean;\n      limit?: number;\n      offset?: number;\n    }\n  ): Promise<Role[]> {\n    logger.debug('[RBAC] Listing roles', { workspaceId, options });\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    const query = `\n      query ListRoles($scopeId: String!, $filter: RoleFilterInput, $pagination: PaginationInput) {\n        roles(scopeId: $scopeId, filter: $filter, pagination: $pagination) {\n          id\n          name\n          description\n          isSystem\n          priority\n          defaultPermissions {\n            resourceType\n            level\n          }\n        }\n      }\n    `;\n\n    const variables = {\n      scopeId: workspaceId,\n      filter: options?.includeSystem !== undefined ? { includeSystem: options.includeSystem } : undefined,\n      pagination: {\n        limit: options?.limit ?? 50,\n        offset: options?.offset ?? 0,\n      },\n    };\n\n    const response = await this.client.query<{\n      roles: Array<{\n        id: string;\n        name: string;\n        description?: string;\n        isSystem: boolean;\n        priority: number;\n        defaultPermissions: RoleDefaultPermission[];\n      }>;\n    }>(query, variables, contextWithWorkspace);\n\n    logger.debug('[RBAC] Roles listed', { workspaceId, count: response.roles.length });\n\n    return response.roles.map((role) => ({\n      id: role.id,\n      name: role.name,\n      description: role.description,\n      defaultPermissions: role.defaultPermissions,\n    }));\n  }\n\n  /**\n   * Get a specific role by ID\n   * Uses the new PBAC role query\n   *\n   * @param roleId - Role ID\n   * @param workspaceId - Workspace ID (scopeId)\n   */\n  public async getRole(roleId: string, workspaceId: string): Promise<Role | null> {\n    logger.debug('[RBAC] Getting role', { roleId, workspaceId });\n\n    const contextWithWorkspace = {\n      ...this.context,\n      workspaceId,\n    };\n\n    const query = `\n      query GetRole($id: ID!) {\n        role(id: $id) {\n          id\n          name\n          description\n          isSystem\n          priority\n          defaultPermissions {\n            resourceType\n            level\n          }\n        }\n      }\n    `;\n\n    const response = await this.client.query<{\n      role: {\n        id: string;\n        name: string;\n        description?: string;\n        isSystem: boolean;\n        priority: number;\n        defaultPermissions: RoleDefaultPermission[];\n      } | null;\n    }>(query, { id: roleId }, contextWithWorkspace);\n\n    if (!response.role) {\n      logger.debug('[RBAC] Role not found', { roleId });\n      return null;\n    }\n\n    // Return in backward-compatible format\n    return {\n      id: response.role.id,\n      name: response.role.name,\n      description: response.role.description,\n      defaultPermissions: response.role.defaultPermissions,\n    };\n  }\n}\n"]}

package/dist/chunk-OJDXWHRJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/gateway/security/index.ts","../src/gateway/security/actor.ts","../src/gateway/security/cost-map.ts","../src/gateway/security/tiers.ts","../src/gateway/security/defaults.ts","../src/gateway/security/valkey.ts","../src/gateway/security/metrics.ts","../src/gateway/security/plugins/armor.ts","../src/gateway/security/plugins/operation-timeout.ts","../src/gateway/security/plugins/otel.ts","../src/gateway/security/plugins/query-complexity.ts","../src/gateway/security/plugins/rate-limit.ts","../src/gateway/security/plugins/index.ts"],"names":["firstIp","header","undefined","split","trim","classify","actorType","actorRole","resolveActor","getHeader","actorId","workspaceId","tenantId","orgId","appId","ip","tier","identity","headers","DEFAULT_COST_MAP","mergeCostMap","base","override","DEFAULT_TIERS","public","points","duration","burst","user","app","service","super_admin","Number","MAX_SAFE_INTEGER","positiveInt","value","fallback","parsed","parseInt","isFinite","resolveTiersFromEnv","out","Object","keys","forEach","upper","toUpperCase","process","env","boolEnv","key","v","intEnv","strEnv","DEFAULT_ARMOR_CONFIG","maxAliases","maxTokens","maxDirectives","characterLimit","costLimit","observe","resolveSecurityOptionsFromEnv","gatewayName","costMapOverride","enabled","armor","queryComplexity","maxCost","costMap","rateLimit","tiers","keyPrefix","observeOnly","failClosed","operationTimeout","timeoutMs","otel","serviceName","endpoint","environment","version","IoRedisAdapter","client","get","set","options","EX","incrBy","amount","incrby","expire","seconds","result","ttl","ping","buildIoRedisClient","url","spec","mod","Ctor","default","Redis","Error","on","err","e","String","logger","warn","error","message","MemoryValkey","store","Map","prune","expiresAt","Date","now","delete","Promise","resolve","next","Math","max","ceil","singleton","bootPromise","initializeSecurityValkey","required","clientKind","msg","attempts","push","kind","factory","getValkeyClient","lastError","attempt","pong","info","getSecurityValkey","__setSecurityValkeyForTest","metrics","initializing","promMod","noopCounter","inc","noopMetrics","complexityRejected","armorRejected","valkeyFailover","initializeMetrics","Counter","name","help","labelNames","getMetrics","scrapeMetrics","register","body","contentType","__resetMetricsForTest","tryImport","specifier","pickFactory","candidates","fn","createMaxAliasesRule","context","aliases","Field","node","alias","reportError","GraphQLError","nodes","extensions","code","createMaxDirectivesRule","directives","Directive","isLean","loadRules","cfg","lean","aliasesMod","directivesMod","costMod","blockSuggestionsMod","all","loaded","maxAliasesFactory","maxAliasesRule","n","exposeLimits","maxDirectivesFactory","maxDirectivesRule","costLimitFactory","costLimitRule","objectCost","scalarCost","depthCostFactor","ignoreIntrospection","blockSuggestionsFactory","blockSuggestionsPlugin","createArmorPlugins","rules","enabledRules","rule","armorValidationPlugin","onParse","params","source","length","limit","mode","http","status","onValidate","setResult","armorErrors","errs","graphqlValidate","schema","documentAST","wrapped","originalError","plugins","createTimeoutHandle","timerRef","promise","_","reject","setTimeout","timer","createOperationTimeoutPlugin","deps","timeoutError","config","onExecute","executeFn","setExecuteFn","args","handle","race","clearTimeout","shutdownHook","buildResource","resMod","attrs","resourceFromAttributes","Resource","resolveSemanticKeys","semcon","SemanticResourceAttributes","SERVICE_NAME","deploymentEnv","DEPLOYMENT_ENVIRONMENT","serviceVersion","SERVICE_VERSION","ATTR_SERVICE_NAME","ATTR_DEPLOYMENT_ENVIRONMENT_NAME","ATTR_DEPLOYMENT_ENVIRONMENT","ATTR_SERVICE_VERSION","loadOtelPeerDeps","sdkSpec","otlpSpec","resSpec","semSpec","modules","sdkMod","otlpMod","NodeSDK","OTLPTraceExporter","initializeOtel","resourceAttributes","sdk","resource","traceExporter","start","shutdown","shutdownOtel","createOtelPlugin","useOpenTelemetry","spans","execute","parse","validate","subscribe","resolvers","PAGINATION_ARGUMENTS","Set","MAX_LIST_MULTIPLIER","MAX_FAILURE_LOG_VARIANTS","complexityFailureMessages","isRecord","unwrapNamedType","type","current","getSchemaLike","getOperationRootType","operation","schemaLike","getMutationType","getSubscriptionType","getQueryType","getTypeByName","getType","getField","parentType","fieldName","getFields","getCostMapValue","numericValueFromAst","Kind","INT","FLOAT","STRING","listMultiplierFromArgs","arg","has","raw","min","trunc","calculateFieldComplexity","fieldNode","fragments","activeFragments","field","baseCost","namedFieldType","childCost","selectionSet","calculateSelectionSetComplexity","arguments","total","selection","selections","calculateSelectionComplexity","FIELD","INLINE_FRAGMENT","fragmentParent","typeCondition","fragmentName","fragment","add","complexity","calculateDocumentComplexity","operations","definition","definitions","FRAGMENT_DEFINITION","OPERATION_DEFINITION","maxComplexity","rootType","logComplexityFailure","seen","size","suppressedRepeats","debug","createQueryComplexityPlugin","gateway","cost","keyFor","prefix","stamp","checkRateLimit","actor","decision","allowed","remaining","resetAtMs","count","valkey","createRateLimitPlugin","onRequest","request","fetchAPI","endResponse","__rateLimitResult","__rateLimitActor","retryAfterS","JSON","stringify","errors","resetAt","toISOString","response","Response","floor","onResponse","stash","buildSecurityPlugins","otelPlugin","armorPlugins"],"mappings":";;;;;AAAA,IAAA,gBAAA,GAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACgBA,IAAMA,OAAAA,2BAAWC,MAAAA,KAAAA;AACf,EAAA,IAAI,CAACA,QAAQ,OAAOC,MAAAA;AAEpB,EAAA,OAAOD,OAAOE,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,MAAAA,IAAUF,MAAAA;AACzC,CAAA,EAJgB,SAAA,CAAA;AAMhB,IAAMG,QAAAA,mBAAW,MAAA,CAAA,CAACC,SAAAA,EAA+BC,SAAAA,KAAAA;AAC/C,EAAA,IAAIA,SAAAA,KAAc,eAAe,OAAO,aAAA;AACxC,EAAA,QAAQD,SAAAA;IACN,KAAK,MAAA;AACH,MAAA,OAAO,MAAA;IACT,KAAK,KAAA;AACH,MAAA,OAAO,KAAA;IACT,KAAK,SAAA;IACL,KAAK,iBAAA;AACH,MAAA,OAAO,SAAA;IACT,KAAK,aAAA;AACH,MAAA,OAAO,aAAA;AACT,IAAA;AACE,MAAA,OAAO,QAAA;AACX;AACF,CAAA,EAfiB,UAAA,CAAA;AAqBV,IAAME,YAAAA,2BAAgBC,SAAAA,KAAAA;AAC3B,EAAA,MAAMC,OAAAA,GAAUD,SAAAA,CAAU,YAAA,CAAA,IAAiBP,MAAAA;AAC3C,EAAA,MAAMI,SAAAA,GAAYG,SAAAA,CAAU,cAAA,CAAA,IAAmBP,MAAAA;AAC/C,EAAA,MAAMK,SAAAA,GAAYE,SAAAA,CAAU,cAAA,CAAA,IAAmBP,MAAAA;AAC/C,EAAA,MAAMS,WAAAA,GAAcF,SAAAA,CAAU,gBAAA,CAAA,IAAqBP,MAAAA;AACnD,EAAA,MAAMU,QAAAA,GAAWH,SAAAA,CAAU,aAAA,CAAA,IAAkBP,MAAAA;AAC7C,EAAA,MAAMW,KAAAA,GAAQJ,SAAAA,CAAU,UAAA,CAAA,IAAeP,MAAAA;AACvC,EAAA,MAAMY,KAAAA,GAAQL,SAAAA,CAAU,UAAA,CAAA,IAAeP,MAAAA;AACvC,EAAA,MAAMa,EAAAA,GACJf,OAAAA,CAAQS,SAAAA,CAAU,iBAAA,CAAA,CAAA,IAAuBA,SAAAA,CAAU,WAAA,CAAA,IAAgBA,SAAAA,CAAU,kBAAA,CAAA,IAAuBP,MAAAA;AAEtG,EAAA,MAAMc,IAAAA,GAAOX,QAAAA,CAASC,SAAAA,EAAWC,SAAAA,CAAAA;AAEjC,EAAA,IAAIU,QAAAA;AACJ,EAAA,QAAQD,IAAAA;IACN,KAAK,aAAA;AACHC,MAAAA,QAAAA,GAAW,QAAA;AACX,MAAA;IACF,KAAK,SAAA;AACHA,MAAAA,QAAAA,GAAW,CAAA,IAAA,EAAOP,WAAW,SAAA,CAAA,CAAA;AAC7B,MAAA;IACF,KAAK,KAAA;AACHO,MAAAA,QAAAA,GAAW,GAAGL,QAAAA,IAAY,UAAA,CAAA,CAAA,EAAcE,KAAAA,IAASJ,WAAW,SAAA,CAAA,CAAA;AAC5D,MAAA;IACF,KAAK,MAAA;AACHO,MAAAA,QAAAA,GAAW,CAAA,EAAGN,WAAAA,IAAe,MAAA,CAAA,CAAA,EAAUD,WAAW,SAAA,CAAA,CAAA;AAClD,MAAA;IACF,KAAK,QAAA;AACL,IAAA;AACEO,MAAAA,QAAAA,GAAW,CAAA,GAAA,EAAMF,MAAM,SAAA,CAAA,CAAA;AAC3B;AAEA,EAAA,OAAO;AACLC,IAAAA,IAAAA;AACAC,IAAAA,QAAAA;IACAC,OAAAA,EAAS;AACPR,MAAAA,OAAAA;AACAJ,MAAAA,SAAAA;AACAC,MAAAA,SAAAA;AACAI,MAAAA,WAAAA;AACAC,MAAAA,QAAAA;AACAC,MAAAA,KAAAA;AACAC,MAAAA,KAAAA;AACAC,MAAAA;AACF;AACF,GAAA;AACF,CAAA,EA9C4B,cAAA;;;AC1BrB,IAAMI,gBAAAA,GAA4B;;EAEvC,wBAAA,EAA0B,GAAA;EAC1B,wBAAA,EAA0B,GAAA;EAC1B,kBAAA,EAAoB,EAAA;;EAGpB,uBAAA,EAAyB,GAAA;EACzB,mBAAA,EAAqB,GAAA;EACrB,qBAAA,EAAuB,GAAA;EACvB,gBAAA,EAAkB,GAAA;;EAGlB,iBAAA,EAAmB,EAAA;EACnB,sBAAA,EAAwB,EAAA;EACxB,iBAAA,EAAmB,EAAA;EACnB,gBAAA,EAAkB,EAAA;EAClB,gBAAA,EAAkB,EAAA;;EAGlB,mBAAA,EAAqB,CAAA;EACrB,iBAAA,EAAmB,EAAA;EACnB,WAAA,EAAa,CAAA;EACb,eAAA,EAAiB,CAAA;;EAGjB,gBAAA,EAAkB,GAAA;EAClB,cAAA,EAAgB,GAAA;;EAGhB,qBAAA,EAAuB,GAAA;EACvB,yBAAA,EAA2B;AAC7B;AAEO,IAAMC,YAAAA,mBAAe,MAAA,CAAA,CAACC,IAAAA,EAAeC,QAAAA,MAAgC;EAC1E,GAAGD,IAAAA;EACH,GAAGC;AACL,CAAA,CAAA,EAH4B,cAAA;;;ACvCrB,IAAMC,aAAAA,GAA0C;;;;;;;EAOrDC,MAAAA,EAAQ;IACNC,MAAAA,EAAQ,GAAA;IACRC,QAAAA,EAAU,EAAA;IACVC,KAAAA,EAAO;AACT,GAAA;EACAC,IAAAA,EAAM;IACJH,MAAAA,EAAQ,GAAA;IACRC,QAAAA,EAAU,EAAA;IACVC,KAAAA,EAAO;AACT,GAAA;EACAE,GAAAA,EAAK;IACHJ,MAAAA,EAAQ,GAAA;IACRC,QAAAA,EAAU,EAAA;IACVC,KAAAA,EAAO;AACT,GAAA;EACAG,OAAAA,EAAS;IACPL,MAAAA,EAAQ,GAAA;IACRC,QAAAA,EAAU,EAAA;IACVC,KAAAA,EAAO;AACT,GAAA;EACAI,WAAAA,EAAa;AACXN,IAAAA,MAAAA,EAAQO,MAAAA,CAAOC,gBAAAA;IACfP,QAAAA,EAAU,EAAA;AACVC,IAAAA,KAAAA,EAAOK,MAAAA,CAAOC;AAChB;AACF;AAEA,IAAMC,WAAAA,mBAAc,MAAA,CAAA,CAACC,KAAAA,EAA2BC,QAAAA,KAAAA;AAC9C,EAAA,IAAI,CAACD,OAAO,OAAOC,QAAAA;AACnB,EAAA,MAAMC,MAAAA,GAASC,QAAAA,CAASH,KAAAA,EAAO,EAAA,CAAA;AAC/B,EAAA,OAAOH,OAAOO,QAAAA,CAASF,MAAAA,CAAAA,IAAWA,MAAAA,GAAS,IAAIA,MAAAA,GAASD,QAAAA;AAC1D,CAAA,EAJoB,aAAA,CAAA;AAYb,IAAMI,mBAAAA,mBAAsB,MAAA,CAAA,CAACnB,IAAAA,GAAiCE,aAAAA,KAAa;AAChF,EAAA,MAAMkB,GAAAA,GAAgC;IAAE,GAAGpB;AAAK,GAAA;AAC/CqB,EAAAA,MAAAA,CAAOC,IAAAA,CAAKtB,IAAAA,CAAAA,CAAiBuB,OAAAA,CAAQ,CAAC5B,IAAAA,KAAAA;AACrC,IAAA,MAAM6B,KAAAA,GAAQ7B,KAAK8B,WAAAA,EAAW;AAC9BL,IAAAA,GAAAA,CAAIzB,IAAAA,CAAAA,GAAQ;MACVS,MAAAA,EAAQS,WAAAA,CAAYa,OAAAA,CAAQC,GAAAA,CAAI,CAAA,WAAA,EAAcH,KAAAA,SAAc,CAAA,EAAGxB,IAAAA,CAAKL,IAAAA,CAAAA,CAAMS,MAAM,CAAA;MAChFC,QAAAA,EAAUQ,WAAAA,CAAYa,OAAAA,CAAQC,GAAAA,CAAI,CAAA,WAAA,EAAcH,KAAAA,WAAgB,CAAA,EAAGxB,IAAAA,CAAKL,IAAAA,CAAAA,CAAMU,QAAQ,CAAA;MACtFC,KAAAA,EAAOO,WAAAA,CAAYa,OAAAA,CAAQC,GAAAA,CAAI,CAAA,WAAA,EAAcH,KAAAA,QAAa,CAAA,EAAGxB,IAAAA,CAAKL,IAAAA,CAAAA,CAAMW,KAAK;AAC/E,KAAA;EACF,CAAA,CAAA;AACA,EAAA,OAAOc,GAAAA;AACT,CAAA,EAXmC,qBAAA;;;AC1CnC,IAAMQ,OAAAA,mBAAU,MAAA,CAAA,CAACC,GAAAA,EAAad,QAAAA,KAAAA;AAC5B,EAAA,MAAMe,CAAAA,GAAIJ,OAAAA,CAAQC,GAAAA,CAAIE,GAAAA,CAAAA;AACtB,EAAA,IAAIC,CAAAA,KAAMjD,QAAW,OAAOkC,QAAAA;AAC5B,EAAA,OAAOe,CAAAA,KAAM,UAAUA,CAAAA,KAAM,GAAA;AAC/B,CAAA,EAJgB,SAAA,CAAA;AAMhB,IAAMC,MAAAA,mBAAS,MAAA,CAAA,CAACF,GAAAA,EAAad,QAAAA,KAAAA;AAC3B,EAAA,MAAMe,CAAAA,GAAIJ,OAAAA,CAAQC,GAAAA,CAAIE,GAAAA,CAAAA;AACtB,EAAA,IAAI,CAACC,GAAG,OAAOf,QAAAA;AACf,EAAA,MAAMC,MAAAA,GAASC,QAAAA,CAASa,CAAAA,EAAG,EAAA,CAAA;AAC3B,EAAA,OAAOnB,MAAAA,CAAOO,QAAAA,CAASF,MAAAA,CAAAA,GAAUA,MAAAA,GAASD,QAAAA;AAC5C,CAAA,EALe,QAAA,CAAA;AAOf,IAAMiB,MAAAA,2BAAUH,GAAAA,EAAad,QAAAA,KAA6BW,QAAQC,GAAAA,CAAIE,GAAAA,KAAQd,QAAAA,EAA/D,QAAA,CAAA;AAKR,IAAMkB,oBAAAA,GAAoC;EAC/CC,UAAAA,EAAY,EAAA;EACZC,SAAAA,EAAW,GAAA;EACXC,aAAAA,EAAe,EAAA;EACfC,cAAAA,EAAgB,IAAA;EAChBC,SAAAA,EAAW,GAAA;EACXC,OAAAA,EAAS;AACX;AASO,IAAMC,6BAAAA,mBAAgC,MAAA,CAAA,CAC3CC,WAAAA,EACAC,eAAAA,KAAAA;AAEA,EAAA,OAAO;AACLD,IAAAA,WAAAA;IACAE,OAAAA,EAASf,OAAAA,CAAQ,4BAA4B,IAAA,CAAA;IAC7CgB,KAAAA,EAAO;MACLV,UAAAA,EAAYH,MAAAA,CAAO,mBAAA,EAAqBE,oBAAAA,CAAqBC,UAAU,CAAA;MACvEC,SAAAA,EAAWJ,MAAAA,CAAO,kBAAA,EAAoBE,oBAAAA,CAAqBE,SAAS,CAAA;MACpEC,aAAAA,EAAeL,MAAAA,CAAO,sBAAA,EAAwBE,oBAAAA,CAAqBG,aAAa,CAAA;MAChFC,cAAAA,EAAgBN,MAAAA,CAAO,uBAAA,EAAyBE,oBAAAA,CAAqBI,cAAc,CAAA;MACnFC,SAAAA,EAAWP,MAAAA,CAAO,kBAAA,EAAoBE,oBAAAA,CAAqBK,SAAS,CAAA;MACpEC,OAAAA,EAASX,OAAAA,CAAQ,iBAAiB,IAAA;AACpC,KAAA;IACAiB,eAAAA,EAAiB;MACfF,OAAAA,EAASf,OAAAA,CAAQ,4BAA4B,IAAA,CAAA;MAC7CkB,OAAAA,EAASf,MAAAA,CAAO,wBAAwB,GAAA,CAAA;AACxCgB,MAAAA,OAAAA,EAASL,eAAAA,GAAkB3C,YAAAA,CAAaD,gBAAAA,EAAkB4C,eAAAA,CAAAA,GAAmB5C,gBAAAA;MAC7EyC,OAAAA,EAASX,OAAAA,CAAQ,4BAA4B,IAAA;AAC/C,KAAA;IACAoB,SAAAA,EAAW;AACTC,MAAAA,KAAAA,EAAO9B,mBAAAA,EAAAA;MACP+B,SAAAA,EAAWlB,MAAAA,CAAO,qBAAqBS,WAAAA,CAAAA;MACvCU,WAAAA,EAAavB,OAAAA,CAAQ,2BAA2B,IAAA,CAAA;MAChDwB,UAAAA,EAAYxB,OAAAA,CAAQ,0BAA0B,KAAA;AAChD,KAAA;IACAyB,gBAAAA,EAAkB;;;;;;MAMhBC,SAAAA,EAAWvB,MAAAA,CAAO,wBAAwB,IAAA;AAC5C,KAAA;IACAwB,IAAAA,EAAM;MACJZ,OAAAA,EAASf,OAAAA,CAAQ,gBAAgB,IAAA,CAAA;MACjC4B,WAAAA,EAAaxB,MAAAA,CAAO,qBAAqBS,WAAAA,CAAAA;MACzCgB,QAAAA,EAAUzB,MAAAA,CAAO,+BAA+B,6DAAA,CAAA;MAChD0B,WAAAA,EAAa1B,MAAAA,CAAO,YAAY,aAAA,CAAA;MAChC2B,OAAAA,EAASjC,OAAAA,CAAQC,IAAI,aAAA;AACvB;AACF,GAAA;AACF,CAAA,EA3C6C,+BAAA;;;ACV7C,IAAMiC,cAAAA,GAAN,MAAMA,eAAAA,CAAAA;EAxCN;;;;AAyCE,EAAA,WAAA,CAA6BC,MAAAA,EAAyB;SAAzBA,MAAAA,GAAAA,MAAAA;AAA0B,EAAA;AAEvDC,EAAAA,GAAAA,CAAIjC,GAAAA,EAAqC;AACvC,IAAA,OAAO,IAAA,CAAKgC,MAAAA,CAAOC,GAAAA,CAAIjC,GAAAA,CAAAA;AACzB,EAAA;EAEAkC,GAAAA,CAAIlC,GAAAA,EAAaf,OAAekD,OAAAA,EAAmD;AACjF,IAAA,IAAIA,SAASC,EAAAA,EAAI;AACf,MAAA,OAAO,KAAKJ,MAAAA,CAAOE,GAAAA,CAAIlC,KAAKf,KAAAA,EAAO,IAAA,EAAMkD,QAAQC,EAAE,CAAA;AACrD,IAAA;AACA,IAAA,OAAO,IAAA,CAAKJ,MAAAA,CAAOE,GAAAA,CAAIlC,GAAAA,EAAKf,KAAAA,CAAAA;AAC9B,EAAA;AAEAoD,EAAAA,MAAAA,CAAOrC,KAAasC,MAAAA,EAAiC;AACnD,IAAA,OAAO,IAAA,CAAKN,MAAAA,CAAOO,MAAAA,CAAOvC,GAAAA,EAAKsC,MAAAA,CAAAA;AACjC,EAAA;EAEA,MAAME,MAAAA,CAAOxC,KAAayC,OAAAA,EAAmC;AAC3D,IAAA,MAAMC,SAAS,MAAM,IAAA,CAAKV,MAAAA,CAAOQ,MAAAA,CAAOxC,KAAKyC,OAAAA,CAAAA;AAC7C,IAAA,OAAOC,MAAAA,KAAW,CAAA;AACpB,EAAA;AAEAC,EAAAA,GAAAA,CAAI3C,GAAAA,EAA8B;AAChC,IAAA,OAAO,IAAA,CAAKgC,MAAAA,CAAOW,GAAAA,CAAI3C,GAAAA,CAAAA;AACzB,EAAA;EAEA4C,IAAAA,GAAwB;AACtB,IAAA,OAAO,IAAA,CAAKZ,OAAOY,IAAAA,EAAI;AACzB,EAAA;AACF,CAAA;AAEA,IAAMC,kBAAAA,iCAA4BC,GAAAA,KAAAA;AAChC,EAAA,MAAMC,IAAAA,GAAO,SAAA;AACb,EAAA,MAAMC,MAAO,MAAM;;AAA0BD,IAAAA;;AAI7C,EAAA,MAAME,IAAAA,GAAOD,GAAAA,CAAIE,OAAAA,IAAWF,GAAAA,CAAIG,KAAAA;AAChC,EAAA,IAAI,CAACF,IAAAA,EAAM;AACT,IAAA,MAAM,IAAIG,MAAM,yCAAA,CAAA;AAClB,EAAA;AACA,EAAA,MAAMpB,MAAAA,GAAS,IAAIiB,IAAAA,CAAKH,GAAAA,CAAAA;AACxBd,EAAAA,MAAAA,CAAOqB,EAAAA,CAAG,OAAA,EAAS,CAACC,GAAAA,KAAAA;AAClB,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,wCAAA,EAA0C;AAAEC,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KAAQ,CAAA;EAC3E,CAAA,CAAA;AACA,EAAA,OAAO,IAAI7B,eAAeC,MAAAA,CAAAA;AAC5B,CAAA,EAhB2B,oBAAA,CAAA;AA2B3B,IAAM6B,YAAAA,GAAN,MAAMA,aAAAA,CAAAA;EAnGN;;;AAoGUC,EAAAA,KAAAA,uBAAYC,GAAAA,EAAAA;AAEZC,EAAAA,KAAAA,CAAMhE,GAAAA,EAAsC;AAClD,IAAA,MAAMuD,CAAAA,GAAI,IAAA,CAAKO,KAAAA,CAAM7B,GAAAA,CAAIjC,GAAAA,CAAAA;AACzB,IAAA,IAAI,CAACuD,GAAG,OAAOvG,MAAAA;AACf,IAAA,IAAIuG,EAAEU,SAAAA,GAAY,CAAA,IAAKV,EAAEU,SAAAA,IAAaC,IAAAA,CAAKC,KAAG,EAAI;AAChD,MAAA,IAAA,CAAKL,KAAAA,CAAMM,OAAOpE,GAAAA,CAAAA;AAClB,MAAA,OAAOhD,MAAAA;AACT,IAAA;AACA,IAAA,OAAOuG,CAAAA;AACT,EAAA;AAEAtB,EAAAA,GAAAA,CAAIjC,GAAAA,EAAqC;AACvC,IAAA,MAAMuD,CAAAA,GAAI,IAAA,CAAKS,KAAAA,CAAMhE,GAAAA,CAAAA;AACrB,IAAA,OAAOqE,OAAAA,CAAQC,OAAAA,CAAQf,CAAAA,EAAGtE,KAAAA,IAAS,IAAA,CAAA;AACrC,EAAA;EAEAiD,GAAAA,CAAIlC,GAAAA,EAAaf,OAAekD,OAAAA,EAAmD;AACjF,IAAA,IAAA,CAAK2B,KAAAA,CAAM5B,IAAIlC,GAAAA,EAAK;AAClBf,MAAAA,KAAAA;AACAgF,MAAAA,SAAAA,EAAW9B,SAASC,EAAAA,GAAK8B,IAAAA,CAAKC,KAAG,GAAKhC,OAAAA,CAAQC,KAAK,GAAA,GAAO;KAC5D,CAAA;AACA,IAAA,OAAOiC,OAAAA,CAAQC,QAAQ,IAAA,CAAA;AACzB,EAAA;AAEAjC,EAAAA,MAAAA,CAAOrC,KAAasC,MAAAA,EAAiC;AACnD,IAAA,MAAMiB,CAAAA,GAAI,IAAA,CAAKS,KAAAA,CAAMhE,GAAAA,CAAAA;AACrB,IAAA,MAAMuE,IAAAA,GAAAA,CAAQhB,IAAInE,QAAAA,CAASmE,CAAAA,CAAEtE,OAAO,EAAA,CAAA,IAAO,IAAI,CAAA,IAAKqD,MAAAA;AACpD,IAAA,IAAA,CAAKwB,KAAAA,CAAM5B,IAAIlC,GAAAA,EAAK;AAAEf,MAAAA,KAAAA,EAAOuE,OAAOe,IAAAA,CAAAA;AAAON,MAAAA,SAAAA,EAAWV,GAAGU,SAAAA,IAAa;KAAE,CAAA;AACxE,IAAA,OAAOI,OAAAA,CAAQC,QAAQC,IAAAA,CAAAA;AACzB,EAAA;AAEA/B,EAAAA,MAAAA,CAAOxC,KAAayC,OAAAA,EAAmC;AACrD,IAAA,MAAMc,CAAAA,GAAI,IAAA,CAAKO,KAAAA,CAAM7B,GAAAA,CAAIjC,GAAAA,CAAAA;AACzB,IAAA,IAAI,CAACuD,CAAAA,EAAG,OAAOc,OAAAA,CAAQC,QAAQ,KAAA,CAAA;AAC/Bf,IAAAA,CAAAA,CAAEU,SAAAA,GAAYC,IAAAA,CAAKC,GAAAA,EAAG,GAAK1B,OAAAA,GAAU,GAAA;AACrC,IAAA,OAAO4B,OAAAA,CAAQC,QAAQ,IAAA,CAAA;AACzB,EAAA;AAEA3B,EAAAA,GAAAA,CAAI3C,GAAAA,EAA8B;AAChC,IAAA,MAAMuD,CAAAA,GAAI,IAAA,CAAKS,KAAAA,CAAMhE,GAAAA,CAAAA;AACrB,IAAA,IAAI,CAACuD,CAAAA,EAAG,OAAOc,OAAAA,CAAQC,QAAQ,EAAC,CAAA;AAChC,IAAA,IAAIf,EAAEU,SAAAA,KAAc,CAAA,EAAG,OAAOI,OAAAA,CAAQC,QAAQ,EAAC,CAAA;AAC/C,IAAA,OAAOD,OAAAA,CAAQC,OAAAA,CAAQE,IAAAA,CAAKC,GAAAA,CAAI,GAAGD,IAAAA,CAAKE,IAAAA,CAAAA,CAAMnB,CAAAA,CAAEU,SAAAA,GAAYC,IAAAA,CAAKC,GAAAA,EAAG,IAAM,GAAA,CAAA,CAAA,CAAA;AAC5E,EAAA;EAEAvB,IAAAA,GAAwB;AACtB,IAAA,OAAOyB,OAAAA,CAAQC,QAAQ,MAAA,CAAA;AACzB,EAAA;AACF;AAEA,IAAIK,SAAAA,GAAyC,IAAA;AAC7C,IAAIC,WAAAA,GAAoD,IAAA;AAUjD,IAAMC,wBAAAA,iCAAkCjE,WAAAA,KAAAA;AAC7C,EAAA,IAAI+D,WAAW,OAAOA,SAAAA;AACtB,EAAA,IAAIC,aAAa,OAAOA,WAAAA;AAExBA,EAAAA,WAAAA,GAAAA,CAAe,YAAA;AACb,IAAA,MAAM9B,MAAMjD,OAAAA,CAAQC,GAAAA,CAAI,YAAA,CAAA,IAAiBD,OAAAA,CAAQC,IAAI,WAAA,CAAA;AACrD,IAAA,MAAMgF,QAAAA,GAAWjF,OAAAA,CAAQC,GAAAA,CAAI,iBAAA,CAAA,KAAuB,MAAA;AACpD,IAAA,MAAMiF,UAAAA,GAAalF,OAAAA,CAAQC,GAAAA,CAAI,eAAA,CAAA,IAAoB,SAAA;AAEnD,IAAA,IAAI,CAACgD,GAAAA,EAAK;AACR,MAAA,MAAMkC,GAAAA,GAAM,uCAAA;AACZ,MAAA,IAAIF,UAAU,MAAM,IAAI1B,KAAAA,CAAM,CAAA,EAAG4B,GAAAA,CAAAA,yBAAAA,CAA8B,CAAA;AAC/DvB,MAAAA,MAAAA,CAAOC,IAAAA,CAAK,CAAA,EAAGsB,GAAAA,CAAAA,qDAAAA,CAAAA,EAAuD;AACpEpE,QAAAA;OACF,CAAA;AACA+D,MAAAA,SAAAA,GAAY,IAAId,YAAAA,EAAAA;AAChB,MAAA,OAAOc,SAAAA;AACT,IAAA;AAEA,IAAA,MAAMM,WAGD,EAAA;AAEL,IAAA,IAAIF,eAAe,SAAA,EAAW;AAC5BE,MAAAA,QAAAA,CAASC,IAAAA,CAAK;QAAEC,IAAAA,EAAM,SAAA;QAAWC,OAAAA,kBAAS,MAAA,CAAA,MAAMvC,kBAAAA,CAAmBC,GAAAA,CAAAA,EAAzB,SAAA;OAA8B,CAAA;AACxEmC,MAAAA,QAAAA,CAASC,IAAAA,CAAK;QACZC,IAAAA,EAAM,kBAAA;AACNC,QAAAA,OAAAA,kBAAS,MAAA,CAAA,YAAA;AACP,UAAA,MAAM,EAAEC,eAAAA,EAAe,GAAK,MAAM,OAAO,kBAAA,CAAA;AACzC,UAAA,OAAQ,MAAMA,eAAAA,EAAAA;QAChB,CAAA,EAHS,SAAA;OAIX,CAAA;IACF,CAAA,MAAO;AACLJ,MAAAA,QAAAA,CAASC,IAAAA,CAAK;QACZC,IAAAA,EAAM,OAAA;AACNC,QAAAA,OAAAA,kBAAS,MAAA,CAAA,YAAA;AACP,UAAA,MAAM,EAAEC,eAAAA,EAAe,GAAK,MAAM,OAAO,kBAAA,CAAA;AACzC,UAAA,OAAQ,MAAMA,eAAAA,EAAAA;QAChB,CAAA,EAHS,SAAA;OAIX,CAAA;AACAJ,MAAAA,QAAAA,CAASC,IAAAA,CAAK;QAAEC,IAAAA,EAAM,oBAAA;QAAsBC,OAAAA,kBAAS,MAAA,CAAA,MAAMvC,kBAAAA,CAAmBC,GAAAA,CAAAA,EAAzB,SAAA;OAA8B,CAAA;AACrF,IAAA;AAEA,IAAA,IAAIwC,SAAAA,GAA0B,IAAA;AAC9B,IAAA,KAAA,MAAWC,WAAWN,QAAAA,EAAU;AAC9B,MAAA,IAAI;AACF,QAAA,MAAMjD,MAAAA,GAAS,MAAMuD,OAAAA,CAAQH,OAAAA,EAAO;AACpC,QAAA,MAAMI,IAAAA,GAAO,MAAMxD,MAAAA,CAAOY,IAAAA,EAAI;AAC9B,QAAA,IAAI4C,SAAS,MAAA,EAAQ;AACnB,UAAA,MAAM,IAAIpC,KAAAA,CAAM,CAAA,cAAA,EAAiBoC,IAAAA,CAAAA,CAAM,CAAA;AACzC,QAAA;AACA/B,QAAAA,MAAAA,CAAOgC,KAAK,qCAAA,EAAuC;AACjD7E,UAAAA,WAAAA;AACAkC,UAAAA,GAAAA;AACAd,UAAAA,MAAAA,EAAQuD,OAAAA,CAAQJ;SAClB,CAAA;AACAR,QAAAA,SAAAA,GAAY3C,MAAAA;AACZ,QAAA,OAAOA,MAAAA;AACT,MAAA,CAAA,CAAA,OAASsB,GAAAA,EAAK;AACZgC,QAAAA,SAAAA,GAAYhC,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AAC1DG,QAAAA,MAAAA,CAAOC,KAAK,6DAAA,EAA+D;AACzE9C,UAAAA,WAAAA;AACAoB,UAAAA,MAAAA,EAAQuD,OAAAA,CAAQJ,IAAAA;AAChBxB,UAAAA,KAAAA,EAAO2B,SAAAA,CAAU1B;SACnB,CAAA;AACF,MAAA;AACF,IAAA;AAEA,IAAA,IAAIkB,QAAAA,EAAU;AACZrB,MAAAA,MAAAA,CAAOE,MAAM,+DAAA,EAAiE;AAC5E/C,QAAAA,WAAAA;AACA+C,QAAAA,KAAAA,EAAO2B,WAAW1B,OAAAA,IAAW;OAC/B,CAAA;AACA,MAAA,MAAM0B,SAAAA,IAAa,IAAIlC,KAAAA,CAAM,0BAAA,CAAA;AAC/B,IAAA;AACAK,IAAAA,MAAAA,CAAOC,KAAK,8EAAA,EAA2E;AACrF9C,MAAAA,WAAAA;AACA+C,MAAAA,KAAAA,EAAO2B,WAAW1B,OAAAA,IAAW;KAC/B,CAAA;AACAe,IAAAA,SAAAA,GAAY,IAAId,YAAAA,EAAAA;AAChB,IAAA,OAAOc,SAAAA;EACT,CAAA,GAAA;AAEA,EAAA,OAAOC,WAAAA;AACT,CAAA,EArFwC,0BAAA;AA2FjC,IAAMc,oCAAoB,MAAA,CAAA,MAAA;AAC/B,EAAA,IAAI,CAACf,SAAAA,EAAW;AACd,IAAA,MAAM,IAAIvB,MAAM,wFAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOuB,SAAAA;AACT,CAAA,EALiC,mBAAA;AAW1B,IAAMgB,0BAAAA,2BAA8B3D,MAAAA,KAAAA;AACzC2C,EAAAA,SAAAA,GAAY3C,MAAAA;AACZ4C,EAAAA,WAAAA,GAAc5C,MAAAA,GAASqC,OAAAA,CAAQC,OAAAA,CAAQtC,MAAAA,CAAAA,GAAU,IAAA;AACnD,CAAA,EAH0C,4BAAA;;;ACnN1C,IAAI4D,OAAAA,GAA0B,IAAA;AAC9B,IAAIC,YAAAA,GAAe,KAAA;AACnB,IAAIC,OAAAA,GAAmC,IAAA;AAEvC,IAAMC,WAAAA,GAA2B;AAC/BC,EAAAA,GAAAA,+BAAWhJ,MAAAA,EAAN,KAAA;AACP,CAAA;AAEA,IAAMiJ,WAAAA,GAAuB;EAC3B9E,SAAAA,EAAW4E,WAAAA;EACXG,kBAAAA,EAAoBH,WAAAA;EACpBI,aAAAA,EAAeJ,WAAAA;EACfK,cAAAA,EAAgBL,WAAAA;EAChBvE,gBAAAA,EAAkBuE;AACpB,CAAA;AAMO,IAAMM,oCAAoB,MAAA,CAAA,YAAA;AAC/B,EAAA,IAAIT,SAAS,OAAOA,OAAAA;AACpB,EAAA,IAAIC,YAAAA,EAAc;AAEhB,IAAA,OAAOI,WAAAA;AACT,EAAA;AACA,EAAA,IAAIpG,OAAAA,CAAQC,GAAAA,CAAI,4BAAA,CAAA,KAAkC,MAAA,EAAQ;AACxD2D,IAAAA,MAAAA,CAAOgC,KAAK,mFAAA,CAAA;AACZG,IAAAA,OAAAA,GAAUK,WAAAA;AACV,IAAA,OAAOL,OAAAA;AACT,EAAA;AAEAC,EAAAA,YAAAA,GAAe,IAAA;AACf,EAAA,IAAI;AACF,IAAA,MAAM9C,IAAAA,GAAO,aAAA;AACb+C,IAAAA,OAAAA,GAAW,MAAM;;AAA0B/C,MAAAA;;AAC3C,IAAA,IAAI,OAAO+C,OAAAA,CAAQQ,OAAAA,KAAY,UAAA,EAAY;AACzC7C,MAAAA,MAAAA,CAAOC,KAAK,6EAAA,CAAA;AACZkC,MAAAA,OAAAA,GAAUK,WAAAA;AACV,MAAA,OAAOL,OAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEU,SAAO,GAAKR,OAAAA;AACpBF,IAAAA,OAAAA,GAAU;AACRzE,MAAAA,SAAAA,EAAW,IAAImF,OAAAA,CAAQ;QACrBC,IAAAA,EAAM,mCAAA;QACNC,IAAAA,EAAM,+CAAA;QACNC,UAAAA,EAAY;AAAC,UAAA,SAAA;AAAW,UAAA,MAAA;AAAQ,UAAA;;OAClC,CAAA;AACAP,MAAAA,kBAAAA,EAAoB,IAAII,OAAAA,CAAQ;QAC9BC,IAAAA,EAAM,4CAAA;QACNC,IAAAA,EAAM,oCAAA;QACNC,UAAAA,EAAY;AAAC,UAAA,SAAA;AAAW,UAAA;;OAC1B,CAAA;AACAN,MAAAA,aAAAA,EAAe,IAAIG,OAAAA,CAAQ;QACzBC,IAAAA,EAAM,uCAAA;QACNC,IAAAA,EAAM,+BAAA;QACNC,UAAAA,EAAY;AAAC,UAAA,SAAA;AAAW,UAAA,MAAA;AAAQ,UAAA;;OAClC,CAAA;AACAL,MAAAA,cAAAA,EAAgB,IAAIE,OAAAA,CAAQ;QAC1BC,IAAAA,EAAM,wCAAA;QACNC,IAAAA,EAAM,8DAAA;QACNC,UAAAA,EAAY;AAAC,UAAA;;OACf,CAAA;AACAjF,MAAAA,gBAAAA,EAAkB,IAAI8E,OAAAA,CAAQ;QAC5BC,IAAAA,EAAM,0CAAA;QACNC,IAAAA,EAAM,iCAAA;QACNC,UAAAA,EAAY;AAAC,UAAA;;OACf;AACF,KAAA;AACAhD,IAAAA,MAAAA,CAAOgC,KAAK,mDAAA,CAAA;AACZ,IAAA,OAAOG,OAAAA;AACT,EAAA,CAAA,CAAA,OAAStC,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,sEAAA,EAAmE;AAC7EC,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACAgC,IAAAA,OAAAA,GAAUK,WAAAA;AACV,IAAA,OAAOL,OAAAA;EACT,CAAA,SAAA;AACEC,IAAAA,YAAAA,GAAe,KAAA;AACjB,EAAA;AACF,CAAA,EA9DiC,mBAAA;AAqE1B,IAAMa,UAAAA,mBAAa,MAAA,CAAA,MAAed,OAAAA,IAAWK,WAAAA,EAA1B,YAAA;AAMnB,IAAMU,gCAAgB,MAAA,CAAA,YAAA;AAC3B,EAAA,IAAI,CAACb,OAAAA,EAASc,QAAAA,EAAU,OAAO,IAAA;AAC/B,EAAA,MAAMC,IAAAA,GAAO,MAAMf,OAAAA,CAAQc,QAAAA,CAAShB,OAAAA,EAAO;AAC3C,EAAA,OAAO;AAAEiB,IAAAA,IAAAA;AAAMC,IAAAA,WAAAA,EAAahB,QAAQc,QAAAA,CAASE;AAAY,GAAA;AAC3D,CAAA,EAJ6B,eAAA;AAStB,IAAMC,wCAAwB,MAAA,CAAA,MAAA;AACnCnB,EAAAA,OAAAA,GAAU,IAAA;AACVC,EAAAA,YAAAA,GAAe,KAAA;AACfC,EAAAA,OAAAA,GAAU,IAAA;AACZ,CAAA,EAJqC,uBAAA;AC/GrC,IAAMkB,SAAAA,iCAAmBC,SAAAA,KAAAA;AACvB,EAAA,IAAI;AACF,IAAA,OAAQ,MAAM,OAAOA,SAAAA,CAAAA;AACvB,EAAA,CAAA,CAAA,OAAS3D,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,oEAAA,EAAiE;AAC3EuD,MAAAA,SAAAA;AACAtD,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACA,IAAA,OAAO,IAAA;AACT,EAAA;AACF,CAAA,EAXkB,WAAA,CAAA;AAalB,IAAMsD,WAAAA,mBAAc,MAAA,CAAA,CAAClE,GAAAA,EAAyBmE,UAAAA,KAAAA;AAC5C,EAAA,IAAI,CAACnE,KAAK,OAAO,IAAA;AACjB,EAAA,KAAA,MAAWuD,QAAQY,UAAAA,EAAY;AAC7B,IAAA,MAAMC,EAAAA,GAAKpE,IAAIuD,IAAAA,CAAAA;AACf,IAAA,IAAI,OAAOa,EAAAA,KAAO,UAAA,EAAY,OAAOA,EAAAA;AACvC,EAAA;AACA,EAAA,OAAO,IAAA;AACT,CAAA,EAPoB,aAAA,CAAA;AASpB,IAAMC,oBAAAA,2BAAwBhH,UAAAA,KAAAA;AAC5B,EAAA,OAAO,CAACiH,OAAAA,KAAAA;AACN,IAAA,IAAIC,OAAAA,GAAU,CAAA;AAEd,IAAA,OAAO;AACLC,MAAAA,KAAAA,CAAMC,IAAAA,EAAI;AACR,QAAA,IAAI,CAACA,KAAKC,KAAAA,EAAO;AACjBH,QAAAA,OAAAA,IAAW,CAAA;AACX,QAAA,IAAIA,UAAUlH,UAAAA,EAAY;AACxBiH,UAAAA,OAAAA,CAAQK,WAAAA,CACN,IAAIC,YAAAA,CAAa,yBAAA,EAA2B;YAC1CC,KAAAA,EAAOJ,IAAAA;YACPK,UAAAA,EAAY;cAAEC,IAAAA,EAAM;AAAoB;AAC1C,WAAA,CAAA,CAAA;AAEJ,QAAA;AACF,MAAA;AACF,KAAA;AACF,EAAA,CAAA;AACF,CAAA,EAnB6B,sBAAA,CAAA;AAqB7B,IAAMC,uBAAAA,2BAA2BzH,aAAAA,KAAAA;AAC/B,EAAA,OAAO,CAAC+G,OAAAA,KAAAA;AACN,IAAA,IAAIW,UAAAA,GAAa,CAAA;AAEjB,IAAA,OAAO;AACLC,MAAAA,SAAAA,CAAUT,IAAAA,EAAI;AACZQ,QAAAA,UAAAA,IAAc,CAAA;AACd,QAAA,IAAIA,aAAa1H,aAAAA,EAAe;AAC9B+G,UAAAA,OAAAA,CAAQK,WAAAA,CACN,IAAIC,YAAAA,CAAa,sBAAA,EAAwB;YACvCC,KAAAA,EAAOJ,IAAAA;YACPK,UAAAA,EAAY;cAAEC,IAAAA,EAAM;AAAuB;AAC7C,WAAA,CAAA,CAAA;AAEJ,QAAA;AACF,MAAA;AACF,KAAA;AACF,EAAA,CAAA;AACF,CAAA,EAlBgC,yBAAA,CAAA;AAyChC,IAAMI,yBAAS,MAAA,CAAA,MAAA;AACb,EAAA,MAAMlI,CAAAA,GAAIJ,OAAAA,CAAQC,GAAAA,CAAI,YAAA,CAAA;AACtB,EAAA,OAAOG,CAAAA,KAAM,UAAUA,CAAAA,KAAM,GAAA;AAC/B,CAAA,EAHe,QAAA,CAAA;AAKf,IAAMmI,SAAAA,iCAAmBC,GAAAA,KAAAA;AACvB,EAAA,MAAMC,OAAOH,MAAAA,EAAAA;AAEb,EAAA,MAAM,CAACI,YAAYC,aAAAA,EAAeC,OAAAA,EAASC,mBAAAA,CAAAA,GAAuB,MAAMrE,QAAQsE,GAAAA,CAAI;AAClFL,IAAAA,IAAAA,GAAOjE,OAAAA,CAAQC,OAAAA,CAAQ,IAAA,CAAA,GAAQ0C,UAAU,wCAAA,CAAA;AACzCsB,IAAAA,IAAAA,GAAOjE,OAAAA,CAAQC,OAAAA,CAAQ,IAAA,CAAA,GAAQ0C,UAAU,2CAAA,CAAA;AACzCA,IAAAA,SAAAA,CAAU,uCAAA,CAAA;AACVsB,IAAAA,IAAAA,GAAOjE,OAAAA,CAAQC,OAAAA,CAAQ,IAAA,CAAA,GAAQ0C,UAAU,oDAAA;AAC1C,GAAA,CAAA;AAED,EAAA,MAAM4B,SAAsB,EAAC;AAE7B,EAAA,MAAMC,iBAAAA,GAAoB3B,YAAYqB,UAAAA,EAAY;AAAC,IAAA;AAAiB,GAAA,CAAA;AACpEK,EAAAA,MAAAA,CAAOE,cAAAA,GAAiBD,oBACpBA,iBAAAA,CAAkB;AAAEE,IAAAA,CAAAA,EAAGV,GAAAA,CAAIhI,UAAAA;AAAY2I,IAAAA,YAAAA,EAAcX,GAAAA,CAAI3H;GAAQ,CAAA,GACjE2G,oBAAAA,CAAqBgB,GAAAA,CAAIhI,UAAU,CAAA;AAEvC,EAAA,MAAM4I,oBAAAA,GAAuB/B,YAAYsB,aAAAA,EAAe;AAAC,IAAA;AAAoB,GAAA,CAAA;AAC7EI,EAAAA,MAAAA,CAAOM,iBAAAA,GAAoBD,uBACvBA,oBAAAA,CAAqB;AACnBF,IAAAA,CAAAA,EAAGV,GAAAA,CAAI9H,aAAAA;AACPyI,IAAAA,YAAAA,EAAcX,GAAAA,CAAI3H;GACpB,CAAA,GACAsH,uBAAAA,CAAwBK,GAAAA,CAAI9H,aAAa,CAAA;AAE7C,EAAA,MAAM4I,gBAAAA,GAAmBjC,YAAYuB,OAAAA,EAAS;AAAC,IAAA;AAAgB,GAAA,CAAA;AAC/D,EAAA,IAAIU,gBAAAA,EAAkB;AACpBP,IAAAA,MAAAA,CAAOQ,gBAAgBD,gBAAAA,CAAiB;AACtClI,MAAAA,OAAAA,EAASoH,GAAAA,CAAI5H,SAAAA;MACb4I,UAAAA,EAAY,CAAA;MACZC,UAAAA,EAAY,CAAA;MACZC,eAAAA,EAAiB,GAAA;MACjBC,mBAAAA,EAAqB,IAAA;AACrBR,MAAAA,YAAAA,EAAcX,GAAAA,CAAI3H;KACpB,CAAA;AACF,EAAA;AAEA,EAAA,MAAM+I,uBAAAA,GAA0BvC,YAAYwB,mBAAAA,EAAqB;AAAC,IAAA,6BAAA;AAA+B,IAAA;AAAU,GAAA,CAAA;AAC3G,EAAA,IAAIe,uBAAAA,EAAyB;AAC3Bb,IAAAA,MAAAA,CAAOc,sBAAAA,GAAyBD,uBAAAA,CAAwB,EAAC,CAAA;AAC3D,EAAA;AAEA,EAAA,IAAInB,IAAAA,EAAM;AACR7E,IAAAA,MAAAA,CAAOgC,IAAAA,CAAK,wFAAA,EAAqF,EAAC,CAAA;AACpG,EAAA;AAEA,EAAA,OAAOmD,MAAAA;AACT,CAAA,EA/CkB,WAAA,CAAA;AA0DX,IAAMe,kBAAAA,iCAA4BtB,GAAAA,KAAAA;AACvC,EAAA,MAAMuB,KAAAA,GAAQ,MAAMxB,SAAAA,CAAUC,GAAAA,CAAAA;AAE9B,EAAA,MAAMzC,WAAUc,UAAAA,EAAAA;AAMhB,EAAA,MAAMmD,eAA8D,EAAA;AACpE,EAAA,IAAID,MAAMd,cAAAA,EAAgB;AACxBe,IAAAA,YAAAA,CAAa3E,IAAAA,CAAK;MAAEqB,IAAAA,EAAM,aAAA;AAAeuD,MAAAA,IAAAA,EAAMF,KAAAA,CAAMd;KAAe,CAAA;AACtE,EAAA;AACA,EAAA,IAAIc,MAAMV,iBAAAA,EAAmB;AAC3BW,IAAAA,YAAAA,CAAa3E,IAAAA,CAAK;MAAEqB,IAAAA,EAAM,gBAAA;AAAkBuD,MAAAA,IAAAA,EAAMF,KAAAA,CAAMV;KAAkB,CAAA;AAC5E,EAAA;AACA,EAAA,IAAIU,MAAMR,aAAAA,EAAe;AACvBS,IAAAA,YAAAA,CAAa3E,IAAAA,CAAK;MAAEqB,IAAAA,EAAM,YAAA;AAAcuD,MAAAA,IAAAA,EAAMF,KAAAA,CAAMR;KAAc,CAAA;AACpE,EAAA;AAEA,EAAA,MAAMW,qBAAAA,GAAgC;IACpCC,OAAAA,CAAQ,EAAEC,QAAM,EAAE;AAIhB,MAAA,MAAMC,MAAAA,GAAS,OAAOD,MAAAA,CAAOC,MAAAA,KAAW,WAAWD,MAAAA,CAAOC,MAAAA,GAASD,OAAOC,MAAAA,EAAQrD,IAAAA;AAClF,MAAA,IAAI,OAAOqD,MAAAA,KAAW,QAAA,IAAYA,MAAAA,CAAOC,MAAAA,GAAS9B,IAAI7H,cAAAA,EAAgB;AACpE,QAAA,IAAI6H,IAAI3H,OAAAA,EAAS;AACf+C,UAAAA,MAAAA,CAAOC,KAAK,6DAAA,EAA+D;AACzEyG,YAAAA,MAAAA,EAAQD,MAAAA,CAAOC,MAAAA;AACfC,YAAAA,KAAAA,EAAO/B,GAAAA,CAAI7H;WACb,CAAA;AACAoF,UAAAA,QAAAA,CAAQO,cAAcH,GAAAA,CAAI;YAAE8D,IAAAA,EAAM,iBAAA;YAAmBO,IAAAA,EAAM;AAAU,WAAA,EAAG,CAAA,CAAA;AACxE,UAAA;AACF,QAAA;AACAzE,QAAAA,QAAAA,CAAQO,cAAcH,GAAAA,CAAI;UAAE8D,IAAAA,EAAM,iBAAA;UAAmBO,IAAAA,EAAM;AAAU,SAAA,EAAG,CAAA,CAAA;AACxE,QAAA,MAAM,IAAIzC,aAAa,sDAAA,EAAwD;UAC7EE,UAAAA,EAAY;YACVC,IAAAA,EAAM,0BAAA;YACNuC,IAAAA,EAAM;cAAEC,MAAAA,EAAQ;AAAI;AACtB;SACF,CAAA;AACF,MAAA;AACF,IAAA,CAAA;IACAC,UAAAA,CAAW,EAAEP,MAAAA,EAAQQ,SAAAA,EAAS,EAAE;AAC9B,MAAA,IAAIZ,YAAAA,CAAaM,WAAW,CAAA,EAAG;AAe/B,MAAA,MAAMO,cAA8B,EAAA;AACpC,MAAA,KAAA,MAAW,EAAEnE,IAAAA,EAAMuD,IAAAA,EAAI,IAAMD,YAAAA,EAAc;AACzC,QAAA,IAAI;AACF,UAAA,MAAMc,IAAAA,GAAOC,QAAAA,CAAgBX,MAAAA,CAAOY,MAAAA,EAAQZ,OAAOa,WAAAA,EAAa;AAAChB,YAAAA;AAAK,WAAA,CAAA;AACtEY,UAAAA,WAAAA,CAAYxF,IAAAA,CAAI,GAAIyF,IAAAA,CAAAA;AACtB,QAAA,CAAA,CAAA,OAASrH,GAAAA,EAAK;AAUZ,UAAA,MAAMM,UAAUN,GAAAA,YAAeF,KAAAA,GAAQE,GAAAA,CAAIM,OAAAA,GAAUJ,OAAOF,GAAAA,CAAAA;AAC5D,UAAA,MAAMyH,OAAAA,GAAU,IAAInD,YAAAA,CAAahE,OAAAA,EAAS;YACxCoH,aAAAA,EAAe1H,GAAAA,YAAeF,QAAQE,GAAAA,GAAMtG,MAAAA;YAC5C8K,UAAAA,EAAY;cACVC,IAAAA,EAAM,iBAAA;cACN+B,IAAAA,EAAMvD;AACR;WACF,CAAA;AACAmE,UAAAA,WAAAA,CAAYxF,KAAK6F,OAAAA,CAAAA;AACnB,QAAA;AACF,MAAA;AAEA,MAAA,IAAIL,WAAAA,CAAYP,WAAW,CAAA,EAAG;AAE9B,MAAA,KAAA,MAAW7G,OAAOoH,WAAAA,EAAa;AAC7BjH,QAAAA,MAAAA,CAAOC,KAAK,yCAAA,EAA2C;AACrDE,UAAAA,OAAAA,EAASN,GAAAA,CAAIM,OAAAA;AACblD,UAAAA,OAAAA,EAAS2H,GAAAA,CAAI3H;SACf,CAAA;AACF,MAAA;AAEAkF,MAAAA,QAAAA,CAAQO,cAAcH,GAAAA,CACpB;QACE8D,IAAAA,EAAM,OAAA;QACNO,IAAAA,EAAMhC,GAAAA,CAAI3H,UAAU,SAAA,GAAY;AAClC,OAAA,EACAgK,YAAYP,MAAM,CAAA;AAGpB,MAAA,IAAI9B,IAAI3H,OAAAA,EAAS;AAMjB+J,MAAAA,SAAAA,CAAUC,WAAAA,CAAAA;AACZ,IAAA;AACF,GAAA;AAEA,EAAA,MAAMO,OAAAA,GAAoB;AAAClB,IAAAA;;AAC3B,EAAA,IAAIH,MAAMF,sBAAAA,EAAwB;AAChCuB,IAAAA,OAAAA,CAAQ/F,IAAAA,CAAK0E,MAAMF,sBAAsB,CAAA;AAC3C,EAAA;AACA,EAAA,OAAOuB,OAAAA;AACT,CAAA,EAvHkC,oBAAA;AClKlC,IAAMC,mBAAAA,mBAAsB,MAAA,CAAA,CAACzJ,SAAAA,EAAmBkC,KAAAA,KAAAA;AAC9C,EAAA,IAAIwH,QAAAA;AACJ,EAAA,MAAMC,OAAAA,GAAU,IAAI/G,OAAAA,CAAe,CAACgH,GAAGC,MAAAA,KAAAA;AACrCH,IAAAA,QAAAA,GAAWI,UAAAA,CAAW,MAAMD,MAAAA,CAAO3H,KAAAA,GAAQlC,SAAAA,CAAAA;EAC7C,CAAA,CAAA;AACA,EAAA,OAAO;IAAE+J,KAAAA,EAAOL,QAAAA;AAA2CC,IAAAA;AAAQ,GAAA;AACrE,CAAA,EAN4B,qBAAA,CAAA;AAQrB,IAAMK,4BAAAA,2BAAgCC,IAAAA,KAAAA;AAC3C,EAAA,MAAMC,YAAAA,GAAe,IAAI/D,YAAAA,CAAa,mBAAA,EAAqB;IACzDE,UAAAA,EAAY;MAAEC,IAAAA,EAAM,mBAAA;AAAqBtG,MAAAA,SAAAA,EAAWiK,KAAKE,MAAAA,CAAOnK;AAAU;GAC5E,CAAA;AAEA,EAAA,OAAO;AACLoK,IAAAA,SAAAA,kBAAW,MAAA,CAAA,CAAC,EAAEC,SAAAA,EAAWC,YAAAA,EAAY,KAAE;AACrCA,MAAAA,YAAAA,CAAa,OAAOC,IAAAA,KAAAA;AAClB,QAAA,MAAMC,MAAAA,GAASf,mBAAAA,CAAoBQ,IAAAA,CAAKE,MAAAA,CAAOnK,WAAWkK,YAAAA,CAAAA;AAC1D,QAAA,IAAI;AACF,UAAA,OAAO,MAAMtH,QAAQ6H,IAAAA,CAAK;AAACJ,YAAAA,SAAAA,CAAUE,IAAAA,CAAAA;YAAOC,MAAAA,CAAOb;AAAQ,WAAA,CAAA;QAC7D,CAAA,SAAA;AACEe,UAAAA,YAAAA,CAAaF,OAAOT,KAAK,CAAA;AAC3B,QAAA;MACF,CAAA,CAAA;IACF,CAAA,EATW,WAAA;AAUb,GAAA;AACF,CAAA,EAjB4C,8BAAA;;;ACjB5C,IAAIY,YAAAA,GAA6C,IAAA;AAoCjD,IAAMC,aAAAA,mBAAgB,MAAA,CAAA,CAACC,MAAAA,EAAwBC,KAAAA,KAAAA;AAC7C,EAAA,IAAI,OAAOD,MAAAA,CAAOE,sBAAAA,KAA2B,UAAA,EAAY;AACvD,IAAA,OAAOF,MAAAA,CAAOE,uBAAuBD,KAAAA,CAAAA;AACvC,EAAA;AACA,EAAA,IAAI,OAAOD,MAAAA,CAAOG,QAAAA,KAAa,UAAA,EAAY;AACzC,IAAA,OAAO,IAAIH,MAAAA,CAAOG,QAAAA,CAASF,KAAAA,CAAAA;AAC7B,EAAA;AACA,EAAA,MAAM,IAAInJ,MAAM,qFAAA,CAAA;AAClB,CAAA,EARsB,eAAA,CAAA;AAgBtB,IAAMsJ,mBAAAA,2BACJC,MAAAA,KAAAA;AAEA,EAAA,IAAIA,OAAOC,0BAAAA,EAA4B;AACrC,IAAA,OAAO;AACLjL,MAAAA,WAAAA,EAAagL,OAAOC,0BAAAA,CAA2BC,YAAAA;AAC/CC,MAAAA,aAAAA,EAAeH,OAAOC,0BAAAA,CAA2BG,sBAAAA;AACjDC,MAAAA,cAAAA,EAAgBL,OAAOC,0BAAAA,CAA2BK;AACpD,KAAA;AACF,EAAA;AACA,EAAA,OAAO;AACLtL,IAAAA,WAAAA,EAAagL,OAAOO,iBAAAA,IAAqB,cAAA;IACzCJ,aAAAA,EACEH,MAAAA,CAAOQ,gCAAAA,IAAoCR,MAAAA,CAAOS,2BAAAA,IAA+B,wBAAA;AACnFJ,IAAAA,cAAAA,EAAgBL,OAAOU,oBAAAA,IAAwB;AACjD,GAAA;AACF,CAAA,EAhB4B,qBAAA,CAAA;AAkB5B,IAAMC,mCAAmB,MAAA,CAAA,YAAA;AAOvB,EAAA,MAAMC,OAAAA,GAAU,yBAAA;AAChB,EAAA,MAAMC,QAAAA,GAAW,yCAAA;AACjB,EAAA,MAAMC,OAAAA,GAAU,0BAAA;AAChB,EAAA,MAAMC,OAAAA,GAAU,qCAAA;AAChB,EAAA,MAAMC,OAAAA,GAAW,MAAMtJ,OAAAA,CAAQsE,GAAAA,CAAI;AACjC,IAAA;;AAA0B4E,MAAAA;;AAC1B,IAAA;;AAA0BC,MAAAA;;AAC1B,IAAA;;AAA0BC,MAAAA;;AAC1B,IAAA;;AAA0BC,MAAAA;;AAC3B,GAAA,CAAA;AACD,EAAA,MAAM,CAACE,MAAAA,EAAQC,OAAAA,EAASvB,MAAAA,EAAQK,MAAAA,CAAAA,GAAUgB,OAAAA;AAC1C,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASF,MAAAA,CAAOE,OAAAA;AAChBC,IAAAA,iBAAAA,EAAmBF,OAAAA,CAAQE,iBAAAA;AAC3BzB,IAAAA,MAAAA;AACAK,IAAAA;AACF,GAAA;AACF,CAAA,EAxByB,kBAAA,CAAA;AA0BlB,IAAMqB,cAAAA,iCAAwB3F,GAAAA,KAAAA;AACnC,EAAA,IAAI,CAACA,IAAIvH,OAAAA,EAAS;AAChB2C,IAAAA,MAAAA,CAAOgC,KAAK,4CAAA,CAAA;AACZ,IAAA;AACF,EAAA;AACA,EAAA,IAAI2G,YAAAA,EAAc;AAChB,IAAA;AACF,EAAA;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE0B,OAAAA,EAASC,iBAAAA,EAAmBzB,QAAQK,MAAAA,EAAM,GAAK,MAAMW,gBAAAA,EAAAA;AAC7D,IAAA,MAAM7N,IAAAA,GAAOiN,oBAAoBC,MAAAA,CAAAA;AAEjC,IAAA,MAAMsB,kBAAAA,GAA6C;MACjD,CAACxO,IAAAA,CAAKkC,WAAW,GAAG0G,GAAAA,CAAI1G,WAAAA;MACxB,CAAClC,IAAAA,CAAKqN,aAAa,GAAGzE,GAAAA,CAAIxG;AAC5B,KAAA;AACA,IAAA,IAAIwG,IAAIvG,OAAAA,EAAS;AACfmM,MAAAA,kBAAAA,CAAmBxO,IAAAA,CAAKuN,cAAc,CAAA,GAAI3E,GAAAA,CAAIvG,OAAAA;AAChD,IAAA;AAEA,IAAA,MAAMoM,GAAAA,GAAM,IAAIJ,OAAAA,CAAQ;MACtBK,QAAAA,EAAU9B,aAAAA,CAAcC,QAAQ2B,kBAAAA,CAAAA;AAChCG,MAAAA,aAAAA,EAAe,IAAIL,iBAAAA,CAAkB;AAAEjL,QAAAA,GAAAA,EAAKuF,GAAAA,CAAIzG;OAAS;KAC3D,CAAA;AAEAsM,IAAAA,GAAAA,CAAIG,KAAAA,EAAK;AACTjC,IAAAA,YAAAA,mBAAe,MAAA,CAAA,MAAqB8B,GAAAA,CAAII,QAAAA,EAAQ,EAAjC,cAAA,CAAA;AACf7K,IAAAA,MAAAA,CAAOgC,KAAK,qCAAA,EAAuC;AACjD9D,MAAAA,WAAAA,EAAa0G,GAAAA,CAAI1G,WAAAA;AACjBC,MAAAA,QAAAA,EAAUyG,GAAAA,CAAIzG;KAChB,CAAA;AACF,EAAA,CAAA,CAAA,OAAS0B,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,uEAAA,EAAoE;AAC9EC,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACF,EAAA;AACF,CAAA,EAtC8B,gBAAA;AAwCvB,IAAM2K,+BAAe,MAAA,CAAA,YAAA;AAC1B,EAAA,IAAInC,YAAAA,EAAc;AAChB,IAAA,IAAI;AACF,MAAA,MAAMA,YAAAA,EAAAA;AACR,IAAA,CAAA,CAAA,OAAS9I,GAAAA,EAAK;AACZ,MAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,MAAAA,MAAAA,CAAOC,KAAK,wCAAA,EAA0C;AAAEC,QAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;OAAQ,CAAA;AAC3E,IAAA;AACAwI,IAAAA,YAAAA,GAAe,IAAA;AACjB,EAAA;AACF,CAAA,EAV4B,cAAA;AAgBrB,IAAMoC,gBAAAA,iCAA0BnG,GAAAA,KAAAA;AACrC,EAAA,IAAI,CAACA,GAAAA,CAAIvH,OAAAA,EAAS,OAAO,EAAC;AAC1B,EAAA,IAAI;AACF,IAAA,MAAMiC,IAAAA,GAAO,wBAAA;AACb,IAAA,MAAMC,MAAO,MAAM;;AAA0BD,MAAAA;;AAM7C,IAAA,IAAI,OAAOC,GAAAA,CAAIyL,gBAAAA,KAAqB,UAAA,EAAY;AAC9ChL,MAAAA,MAAAA,CAAOC,KAAK,sFAAA,CAAA;AACZ,MAAA,OAAO,EAAC;AACV,IAAA;AACA,IAAA,OAAOV,IAAIyL,gBAAAA,CAAiB;MAC1BC,KAAAA,EAAO;QAAEC,OAAAA,EAAS,IAAA;QAAMC,KAAAA,EAAO,IAAA;QAAMC,QAAAA,EAAU,IAAA;QAAMC,SAAAA,EAAW;AAAK,OAAA;MACrEC,SAAAA,EAAW;KACb,CAAA;AACF,EAAA,CAAA,CAAA,OAASzL,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,+EAAA,EAA4E;AACtFC,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACA,IAAA,OAAO,EAAC;AACV,EAAA;AACF,CAAA,EAzBgC,kBAAA;AChJhC,IAAMoL,oBAAAA,uBAA2BC,GAAAA,CAAI;AAAC,EAAA,OAAA;AAAS,EAAA,OAAA;AAAS,EAAA;AAAW,CAAA,CAAA;AACnE,IAAMC,mBAAAA,GAAsB,GAAA;AAC5B,IAAMC,wBAAAA,GAA2B,CAAA;AACjC,IAAMC,yBAAAA,uBAAgCH,GAAAA,EAAAA;AAmBtC,IAAMI,2BAAW,MAAA,CAAA,CAACpQ,KAAAA,KAAqD,OAAOA,KAAAA,KAAU,QAAA,IAAYA,UAAU,IAAA,EAA7F,UAAA,CAAA;AAEjB,IAAMqQ,eAAAA,2BAAmBC,IAAAA,KAAAA;AACvB,EAAA,IAAIC,OAAAA,GAAUD,IAAAA;AACd,EAAA,OAAOF,SAASG,OAAAA,CAAAA,IAAYA,OAAAA,CAAQ,QAAA,MAAcxS,MAAAA,EAAW;AAC3DwS,IAAAA,OAAAA,GAAUA,QAAQ,QAAA,CAAA;AACpB,EAAA;AACA,EAAA,OAAOH,QAAAA,CAASG,OAAAA,CAAAA,GAAYA,OAAAA,GAAmC,IAAA;AACjE,CAAA,EANwB,iBAAA,CAAA;AAQxB,IAAMC,aAAAA,mBAAgB,MAAA,CAAA,CAAC5E,MAAAA,KAA6CA,MAAAA,EAA9C,eAAA,CAAA;AAEtB,IAAM6E,oBAAAA,mBAAuB,MAAA,CAAA,CAC3B7E,MAAAA,EACA8E,SAAAA,KAAAA;AAEA,EAAA,MAAMC,UAAAA,GAAaH,cAAc5E,MAAAA,CAAAA;AACjC,EAAA,IAAI8E,UAAUA,SAAAA,KAAc,UAAA,EAAY,OAAOC,UAAAA,CAAWC,mBAAe,IAAQ,IAAA;AACjF,EAAA,IAAIF,UAAUA,SAAAA,KAAc,cAAA,EAAgB,OAAOC,UAAAA,CAAWE,uBAAmB,IAAQ,IAAA;AACzF,EAAA,OAAOF,UAAAA,CAAWG,gBAAY,IAAQ,IAAA;AACxC,CAAA,EAR6B,sBAAA,CAAA;AAU7B,IAAMC,aAAAA,mBAAgB,MAAA,CAAA,CAACnF,MAAAA,EAAuBtE,IAAAA,KAAAA;AAC5C,EAAA,OAAOkJ,aAAAA,CAAc5E,MAAAA,CAAAA,CAAQoF,OAAAA,GAAU1J,IAAAA,CAAAA,IAAS,IAAA;AAClD,CAAA,EAFsB,eAAA,CAAA;AAItB,IAAM2J,QAAAA,mBAAW,MAAA,CAAA,CAACC,UAAAA,EAAkCC,SAAAA,KAAAA;AAClD,EAAA,OAAOD,UAAAA,CAAWE,SAAAA,IAAS,CAAKD,SAAAA,CAAAA;AAClC,CAAA,EAFiB,UAAA,CAAA;AAIjB,IAAME,eAAAA,mBAAkB,MAAA,CAAA,CAACpP,OAAAA,EAAkBiP,UAAAA,EAAkCC,SAAAA,KAAAA;AAC3E,EAAA,IAAI,CAACD,UAAAA,CAAW5J,IAAAA,EAAM,OAAO,CAAA;AAC7B,EAAA,OAAOrF,QAAQ,CAAA,EAAGiP,UAAAA,CAAW5J,IAAI,CAAA,CAAA,EAAI6J,SAAAA,EAAW,CAAA,IAAK,CAAA;AACvD,CAAA,EAHwB,iBAAA,CAAA;AAKxB,IAAMG,mBAAAA,2BAAuBtR,KAAAA,KAAAA;AAC3B,EAAA,IAAIA,MAAMkG,IAAAA,KAASqL,IAAAA,CAAKC,OAAOxR,KAAAA,CAAMkG,IAAAA,KAASqL,KAAKE,KAAAA,EAAO;AACxD,IAAA,MAAMvR,MAAAA,GAASL,MAAAA,CAAOG,KAAAA,CAAMA,KAAK,CAAA;AACjC,IAAA,OAAOH,MAAAA,CAAOO,QAAAA,CAASF,MAAAA,CAAAA,GAAUA,MAAAA,GAASnC,MAAAA;AAC5C,EAAA;AACA,EAAA,IAAIiC,KAAAA,CAAMkG,IAAAA,KAASqL,IAAAA,CAAKG,MAAAA,EAAQ;AAC9B,IAAA,MAAMxR,MAAAA,GAASL,MAAAA,CAAOG,KAAAA,CAAMA,KAAK,CAAA;AACjC,IAAA,OAAOH,MAAAA,CAAOO,QAAAA,CAASF,MAAAA,CAAAA,GAAUA,MAAAA,GAASnC,MAAAA;AAC5C,EAAA;AACA,EAAA,OAAOA,MAAAA;AACT,CAAA,EAV4B,qBAAA,CAAA;AAY5B,IAAM4T,sBAAAA,2BAA0B5E,IAAAA,KAAAA;AAC9B,EAAA,IAAI,CAACA,MAAM,OAAO,CAAA;AAClB,EAAA,KAAA,MAAW6E,OAAO7E,IAAAA,EAAM;AACtB,IAAA,IAAI,CAACgD,oBAAAA,CAAqB8B,GAAAA,CAAID,GAAAA,CAAItK,IAAAA,CAAKtH,KAAK,CAAA,EAAG;AAC/C,IAAA,MAAM8R,GAAAA,GAAMR,mBAAAA,CAAoBM,GAAAA,CAAI5R,KAAK,CAAA;AACzC,IAAA,IAAI,OAAO8R,GAAAA,KAAQ,QAAA,EAAU,OAAO,CAAA;AACpC,IAAA,OAAOvM,IAAAA,CAAKwM,GAAAA,CAAIxM,IAAAA,CAAKC,GAAAA,CAAI,CAAA,EAAGD,KAAKyM,KAAAA,CAAMF,GAAAA,CAAAA,CAAAA,EAAO7B,mBAAAA,CAAAA;AAChD,EAAA;AACA,EAAA,OAAO,CAAA;AACT,CAAA,EAT+B,wBAAA,CAAA;AAW/B,IAAMgC,2CAA2B,MAAA,CAAA,CAC/BrG,MAAAA,EACAsG,WACAhB,UAAAA,EACAiB,SAAAA,EACAlQ,SACAmQ,eAAAA,KAAAA;AAEA,EAAA,MAAMjB,SAAAA,GAAYe,UAAU5K,IAAAA,CAAKtH,KAAAA;AACjC,EAAA,MAAMqS,KAAAA,GAAQpB,QAAAA,CAASC,UAAAA,EAAYC,SAAAA,CAAAA;AACnC,EAAA,MAAMmB,QAAAA,GAAWjB,eAAAA,CAAgBpP,OAAAA,EAASiP,UAAAA,EAAYC,SAAAA,CAAAA;AACtD,EAAA,MAAMoB,cAAAA,GAAiBlC,eAAAA,CAAgBgC,KAAAA,EAAO/B,IAAAA,CAAAA;AAC9C,EAAA,MAAMkC,SAAAA,GACJN,SAAAA,CAAUO,YAAAA,IAAgBF,cAAAA,GACtBG,+BAAAA,CACE9G,MAAAA,EACAsG,SAAAA,CAAUO,YAAAA,EACVF,cAAAA,EACAJ,SAAAA,EACAlQ,OAAAA,EACAmQ,eAAAA,CAAAA,GAEF,CAAA;AACN,EAAA,OAAA,CAAQE,QAAAA,GAAWE,SAAAA,IAAab,sBAAAA,CAAuBO,SAAAA,CAAUS,SAAS,CAAA;AAC5E,CAAA,EAxBiC,0BAAA,CAAA;AA0BjC,IAAMD,kDAAkC,MAAA,CAAA,CACtC9G,MAAAA,EACA6G,cACAvB,UAAAA,EACAiB,SAAAA,EACAlQ,SACAmQ,eAAAA,KAAAA;AAEA,EAAA,IAAIQ,KAAAA,GAAQ,CAAA;AAEZ,EAAA,KAAA,MAAWC,SAAAA,IAAaJ,aAAaK,UAAAA,EAAY;AAC/CF,IAAAA,KAAAA,IAASG,6BAA6BnH,MAAAA,EAAQiH,SAAAA,EAAW3B,UAAAA,EAAYiB,SAAAA,EAAWlQ,SAASmQ,eAAAA,CAAAA;AAC3F,EAAA;AAEA,EAAA,OAAOQ,KAAAA;AACT,CAAA,EAfwC,iCAAA,CAAA;AAiBxC,IAAMG,+CAA+B,MAAA,CAAA,CACnCnH,MAAAA,EACAiH,WACA3B,UAAAA,EACAiB,SAAAA,EACAlQ,SACAmQ,eAAAA,KAAAA;AAEA,EAAA,IAAIS,SAAAA,CAAU3M,IAAAA,KAASqL,IAAAA,CAAKyB,KAAAA,EAAO;AACjC,IAAA,OAAOf,yBAAyBrG,MAAAA,EAAQiH,SAAAA,EAAW3B,UAAAA,EAAYiB,SAAAA,EAAWlQ,SAASmQ,eAAAA,CAAAA;AACrF,EAAA;AAEA,EAAA,IAAIS,SAAAA,CAAU3M,IAAAA,KAASqL,IAAAA,CAAK0B,eAAAA,EAAiB;AAC3C,IAAA,MAAMC,eAAAA,GAAiBL,SAAAA,CAAUM,aAAAA,GAC5BpC,aAAAA,CAAcnF,MAAAA,EAAQiH,UAAUM,aAAAA,CAAc7L,IAAAA,CAAKtH,KAAK,CAAA,IAAKkR,UAAAA,GAC9DA,UAAAA;AACJ,IAAA,OAAOwB,gCACL9G,MAAAA,EACAiH,SAAAA,CAAUJ,cACVS,eAAAA,EACAf,SAAAA,EACAlQ,SACAmQ,eAAAA,CAAAA;AAEJ,EAAA;AAEA,EAAA,MAAMgB,YAAAA,GAAeP,UAAUvL,IAAAA,CAAKtH,KAAAA;AACpC,EAAA,IAAIoS,eAAAA,CAAgBP,GAAAA,CAAIuB,YAAAA,CAAAA,EAAe,OAAO,CAAA;AAC9C,EAAA,MAAMC,QAAAA,GAAWlB,SAAAA,CAAUnP,GAAAA,CAAIoQ,YAAAA,CAAAA;AAC/B,EAAA,IAAI,CAACC,UAAU,OAAO,CAAA;AAEtBjB,EAAAA,eAAAA,CAAgBkB,IAAIF,YAAAA,CAAAA;AACpB,EAAA,MAAMF,iBAAiBnC,aAAAA,CAAcnF,MAAAA,EAAQyH,SAASF,aAAAA,CAAc7L,IAAAA,CAAKtH,KAAK,CAAA,IAAKkR,UAAAA;AACnF,EAAA,MAAMqC,UAAAA,GAAab,gCACjB9G,MAAAA,EACAyH,QAAAA,CAASZ,cACTS,cAAAA,EACAf,SAAAA,EACAlQ,SACAmQ,eAAAA,CAAAA;AAEFA,EAAAA,eAAAA,CAAgBjN,OAAOiO,YAAAA,CAAAA;AACvB,EAAA,OAAOG,UAAAA;AACT,CAAA,EA3CqC,8BAAA,CAAA;AA6CrC,IAAMC,2BAAAA,mBAA8B,MAAA,CAAA,CAClC5H,MAAAA,EACAC,WAAAA,EACA5J,OAAAA,KAAAA;AAEA,EAAA,MAAMkQ,SAAAA,uBAAgBrN,GAAAA,EAAAA;AACtB,EAAA,MAAM2O,aAAwC,EAAA;AAE9C,EAAA,KAAA,MAAWC,UAAAA,IAAc7H,YAAY8H,WAAAA,EAAa;AAChD,IAAA,IAAI,CAACvD,SAASsD,UAAAA,CAAAA,IAAe,OAAOA,UAAAA,CAAW,MAAA,MAAY,QAAA,EAAU;AACrE,IAAA,IAAIA,UAAAA,CAAW,MAAA,CAAA,KAAYnC,IAAAA,CAAKqC,mBAAAA,EAAqB;AACnD,MAAA,MAAMP,QAAAA,GAAWK,UAAAA;AACjBvB,MAAAA,SAAAA,CAAUlP,GAAAA,CAAIoQ,QAAAA,CAAS/L,IAAAA,CAAKtH,KAAAA,EAAOqT,QAAAA,CAAAA;AACrC,IAAA,CAAA,MAAA,IAAWK,UAAAA,CAAW,MAAA,CAAA,KAAYnC,IAAAA,CAAKsC,oBAAAA,EAAsB;AAC3DJ,MAAAA,UAAAA,CAAWxN,KAAKyN,UAAAA,CAAAA;AAClB,IAAA;AACF,EAAA;AAEA,EAAA,IAAII,aAAAA,GAAgB,CAAA;AACpB,EAAA,KAAA,MAAWpD,aAAa+C,UAAAA,EAAY;AAClC,IAAA,MAAMM,QAAAA,GAAWtD,oBAAAA,CAAqB7E,MAAAA,EAAQ8E,SAAAA,CAAAA;AAC9C,IAAA,IAAI,CAACqD,QAAAA,EAAU;AACf,IAAA,MAAMR,UAAAA,GAAab,+BAAAA,CACjB9G,MAAAA,EACA8E,SAAAA,CAAU+B,YAAAA,EACVsB,UACA5B,SAAAA,EACAlQ,OAAAA,kBACA,IAAI+N,GAAAA,EAAAA,CAAAA;AAEN8D,IAAAA,aAAAA,GAAgBvO,IAAAA,CAAKC,GAAAA,CAAIsO,aAAAA,EAAeP,UAAAA,CAAAA;AAC1C,EAAA;AAEA,EAAA,OAAOO,aAAAA;AACT,CAAA,EAlCoC,6BAAA,CAAA;AAoCpC,IAAME,oBAAAA,2BAAwBtP,KAAAA,KAAAA;AAC5B,EAAA,MAAMuP,IAAAA,GAAO9D,yBAAAA,CAA0B0B,GAAAA,CAAInN,KAAAA,CAAMC,OAAO,CAAA;AACxD,EAAA,IAAI,CAACsP,IAAAA,IAAQ9D,yBAAAA,CAA0B+D,IAAAA,GAAOhE,wBAAAA,EAA0B;AACtEC,IAAAA,yBAAAA,CAA0BmD,GAAAA,CAAI5O,MAAMC,OAAO,CAAA;AAC3CH,IAAAA,MAAAA,CAAOC,KAAK,+DAAA,EAA4D;AACtEC,MAAAA,KAAAA,EAAOA,KAAAA,CAAMC,OAAAA;MACbwP,iBAAAA,EAAmB;KACrB,CAAA;AACA,IAAA;AACF,EAAA;AAEA3P,EAAAA,MAAAA,CAAO4P,MAAM,mEAAA,EAAqE;AAChF1P,IAAAA,KAAAA,EAAOA,KAAAA,CAAMC;GACf,CAAA;AACF,CAAA,EAd6B,sBAAA,CAAA;AAoBtB,IAAM0P,2BAAAA,2BAA+B5H,IAAAA,KAAAA;AAC1C,EAAA,OAAO;AACLlB,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEP,MAAAA,EAAQQ,SAAAA,EAAS,KAAE;AAChC,MAAA,IAAI;AACF,QAAA,MAAM+H,UAAAA,GAAaC,4BAA4BxI,MAAAA,CAAOY,MAAAA,EAAQZ,OAAOa,WAAAA,EAAaY,IAAAA,CAAKE,OAAO1K,OAAO,CAAA;AAErG,QAAA,IAAIsR,UAAAA,GAAa9G,IAAAA,CAAKE,MAAAA,CAAO3K,OAAAA,EAAS;AACpCyF,UAAAA,UAAAA,EAAAA,CAAaR,mBAAmBF,GAAAA,CAAI;YAClCuN,OAAAA,EAAS,SAAA;YACT7S,OAAAA,EAASgL,IAAAA,CAAKE,MAAAA,CAAOlL,OAAAA,GAAU,MAAA,GAAS;WAC1C,CAAA;AACA,UAAA,IAAIgL,IAAAA,CAAKE,OAAOlL,OAAAA,EAAS;AACvB+C,YAAAA,MAAAA,CAAOgC,KAAK,sDAAA,EAAwD;AAClE+M,cAAAA,UAAAA;AACAvR,cAAAA,OAAAA,EAASyK,KAAKE,MAAAA,CAAO3K;aACvB,CAAA;AACA,YAAA;AACF,UAAA;AACAwJ,UAAAA,SAAAA,CAAU;AACR,YAAA,IAAI7C,aAAa,CAAA,0BAAA,EAA6B4K,UAAAA,YAAsB9G,IAAAA,CAAKE,MAAAA,CAAO3K,OAAO,CAAA,CAAA,CAAA,EAAK;cAC1F6G,UAAAA,EAAY;gBACVC,IAAAA,EAAM,qBAAA;gBACNyL,IAAAA,EAAMhB,UAAAA;AACNvR,gBAAAA,OAAAA,EAASyK,KAAKE,MAAAA,CAAO3K;AACvB;aACF;AACD,WAAA,CAAA;AACH,QAAA;AACF,MAAA,CAAA,CAAA,OAASqC,GAAAA,EAAK;AACZ,QAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxD2P,QAAAA,oBAAAA,CAAqB1P,CAAAA,CAAAA;AACvB,MAAA;IACF,CAAA,EA9BY,YAAA;AA+Bd,GAAA;AACF,CAAA,EAlC2C,6BAAA;;;AChO3C,IAAMkQ,MAAAA,mBAAS,MAAA,CAAA,CAACC,MAAAA,EAAgB5V,IAAAA,EAAcC,QAAAA,KAA6B,CAAA,GAAA,EAAM2V,MAAAA,CAAAA,CAAAA,EAAU5V,IAAAA,CAAAA,CAAAA,EAAQC,QAAAA,CAAAA,CAAAA,EAApF,QAAA,CAAA;AAEf,IAAM4V,KAAAA,mBAAQ,MAAA,CAAA,MAAczP,IAAAA,CAAKC,GAAAA,EAAG,EAAtB,OAAA,CAAA;AAQP,IAAMyP,cAAAA,mBAAiB,MAAA,CAAA,OAAOlI,IAAAA,EAA2BmI,KAAAA,KAAAA;AAC9D,EAAA,MAAM/V,IAAAA,GAAO4N,IAAAA,CAAKE,MAAAA,CAAOxK,KAAAA,CAAMyS,MAAM/V,IAAI,CAAA;AACzC,EAAA,MAAM8H,WAAUc,UAAAA,EAAAA;AAChB,EAAA,MAAM6M,OAAAA,GAAU7H,KAAKE,MAAAA,CAAOvK,SAAAA;AAE5B,EAAA,IAAIvD,IAAAA,CAAKS,MAAAA,KAAWO,MAAAA,CAAOC,gBAAAA,EAAkB;AAC3C6G,IAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AAAEuN,MAAAA,OAAAA;AAASzV,MAAAA,IAAAA,EAAM+V,KAAAA,CAAM/V,IAAAA;MAAMgW,QAAAA,EAAU;KAAU,CAAA;AACvE,IAAA,OAAO;MAAEC,OAAAA,EAAS,IAAA;AAAMC,MAAAA,SAAAA,EAAWlV,MAAAA,CAAOC,gBAAAA;MAAkBkV,SAAAA,EAAW,CAAA;AAAG7J,MAAAA,KAAAA,EAAOtM,IAAAA,CAAKS;AAAO,KAAA;AAC/F,EAAA;AAEA,EAAA,MAAMyB,GAAAA,GAAMyT,OAAO/H,IAAAA,CAAKE,MAAAA,CAAOvK,WAAWwS,KAAAA,CAAM/V,IAAAA,EAAM+V,MAAM9V,QAAQ,CAAA;AACpE,EAAA,MAAMqM,KAAAA,GAAQtM,IAAAA,CAAKS,MAAAA,GAAST,IAAAA,CAAKW,KAAAA;AAEjC,EAAA,IAAI;AACF,IAAA,MAAMyV,QAAQ,MAAMxI,IAAAA,CAAKyI,MAAAA,CAAO9R,MAAAA,CAAOrC,KAAK,CAAA,CAAA;AAC5C,IAAA,IAAIkU,UAAU,CAAA,EAAG;AACf,MAAA,MAAMxI,IAAAA,CAAKyI,MAAAA,CAAO3R,MAAAA,CAAOxC,GAAAA,EAAKlC,KAAKU,QAAQ,CAAA;AAC7C,IAAA;AACA,IAAA,MAAMmE,GAAAA,GAAM,MAAM+I,IAAAA,CAAKyI,MAAAA,CAAOxR,IAAI3C,GAAAA,CAAAA;AAClC,IAAA,MAAMiU,YAAYN,KAAAA,EAAAA,GAAUnP,KAAKC,GAAAA,CAAI,CAAA,EAAG9B,GAAAA,CAAAA,GAAO,GAAA;AAE/C,IAAA,IAAIuR,QAAQ9J,KAAAA,EAAO;AACjBxE,MAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AACpBuN,QAAAA,OAAAA;AACAzV,QAAAA,IAAAA,EAAM+V,KAAAA,CAAM/V,IAAAA;QACZgW,QAAAA,EAAUpI,IAAAA,CAAKE,MAAAA,CAAOtK,WAAAA,GAAc,iBAAA,GAAoB;OAC1D,CAAA;AACA,MAAA,OAAO;QAAEyS,OAAAA,EAAS,KAAA;QAAOC,SAAAA,EAAW,CAAA;AAAGC,QAAAA,SAAAA;AAAW7J,QAAAA;AAAM,OAAA;AAC1D,IAAA;AACAxE,IAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AAAEuN,MAAAA,OAAAA;AAASzV,MAAAA,IAAAA,EAAM+V,KAAAA,CAAM/V,IAAAA;MAAMgW,QAAAA,EAAU;KAAU,CAAA;AACvE,IAAA,OAAO;MAAEC,OAAAA,EAAS,IAAA;AAAMC,MAAAA,SAAAA,EAAWxP,IAAAA,CAAKC,GAAAA,CAAI,CAAA,EAAG2F,KAAAA,GAAQ8J,KAAAA,CAAAA;AAAQD,MAAAA,SAAAA;AAAW7J,MAAAA;AAAM,KAAA;AAClF,EAAA,CAAA,CAAA,OAAS9G,GAAAA,EAAK;AACZ,IAAA,MAAMC,CAAAA,GAAID,eAAeF,KAAAA,GAAQE,GAAAA,GAAM,IAAIF,KAAAA,CAAMI,MAAAA,CAAOF,GAAAA,CAAAA,CAAAA;AACxDG,IAAAA,MAAAA,CAAOC,KAAK,6DAAA,EAA0D;AACpE1D,MAAAA,GAAAA;AACA2D,MAAAA,KAAAA,EAAOJ,CAAAA,CAAEK;KACX,CAAA;AACAgC,IAAAA,QAAAA,CAAQQ,eAAeJ,GAAAA,CAAI;AAAEuN,MAAAA;KAAQ,CAAA;AACrC,IAAA,IAAI7H,IAAAA,CAAKE,OAAOrK,UAAAA,EAAY;AAC1BqE,MAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AAAEuN,QAAAA,OAAAA;AAASzV,QAAAA,IAAAA,EAAM+V,KAAAA,CAAM/V,IAAAA;QAAMgW,QAAAA,EAAU;OAAW,CAAA;AACxE,MAAA,OAAO;QAAEC,OAAAA,EAAS,KAAA;QAAOC,SAAAA,EAAW,CAAA;QAAGC,SAAAA,EAAWN,KAAAA,EAAAA,GAAU7V,IAAAA,CAAKU,QAAAA,GAAW,GAAA;AAAM4L,QAAAA;AAAM,OAAA;AAC1F,IAAA;AACAxE,IAAAA,QAAAA,CAAQzE,UAAU6E,GAAAA,CAAI;AAAEuN,MAAAA,OAAAA;AAASzV,MAAAA,IAAAA,EAAM+V,KAAAA,CAAM/V,IAAAA;MAAMgW,QAAAA,EAAU;KAAU,CAAA;AACvE,IAAA,OAAO;MAAEC,OAAAA,EAAS,IAAA;MAAMC,SAAAA,EAAW,EAAA;MAAIC,SAAAA,EAAW,CAAA;AAAG7J,MAAAA;AAAM,KAAA;AAC7D,EAAA;AACF,CAAA,EA7C8B,gBAAA;AAkDvB,IAAMgK,qBAAAA,2BAAyB1I,IAAAA,KAAAA;AACpC,EAAA,OAAO;AACL2I,IAAAA,SAAAA,kBAAW,MAAA,CAAA,OAAO,EAAEC,OAAAA,EAASC,QAAAA,EAAUC,aAAW,KAAE;AAClD,MAAA,MAAMX,KAAAA,GAAQvW,aAAa,CAACiJ,IAAAA,KAAS+N,QAAQtW,OAAAA,CAAQiE,GAAAA,CAAIsE,IAAAA,CAAAA,CAAAA;AACzD,MAAA,MAAM7D,MAAAA,GAAS,MAAMkR,cAAAA,CAAelI,IAAAA,EAAMmI,KAAAA,CAAAA;AAIzCS,MAAAA,OAAAA,CAA8FG,iBAAAA,GAC7F/R,MAAAA;AACD4R,MAAAA,OAAAA,CAA8FI,gBAAAA,GAC7Fb,KAAAA;AAEF,MAAA,IAAI,CAACnR,OAAOqR,OAAAA,EAAS;AACnB,QAAA,IAAIrI,IAAAA,CAAKE,OAAOtK,WAAAA,EAAa;AAC3BmC,UAAAA,MAAAA,CAAOgC,KAAK,sDAAA,EAAwD;AAClE3H,YAAAA,IAAAA,EAAM+V,KAAAA,CAAM/V,IAAAA;AACZC,YAAAA,QAAAA,EAAU8V,KAAAA,CAAM9V,QAAAA;AAChBqM,YAAAA,KAAAA,EAAO1H,MAAAA,CAAO0H;WAChB,CAAA;AACA,UAAA;AACF,QAAA;AACA,QAAA,MAAMuK,WAAAA,GAAcnQ,IAAAA,CAAKC,GAAAA,CAAI,CAAA,EAAGD,IAAAA,CAAKE,IAAAA,CAAAA,CAAMhC,MAAAA,CAAOuR,SAAAA,GAAYN,KAAAA,EAAAA,IAAW,GAAA,CAAA,CAAA;AACzE,QAAA,MAAM9M,IAAAA,GAAO+N,KAAKC,SAAAA,CAAU;UAC1BC,MAAAA,EAAQ;AACN,YAAA;cACElR,OAAAA,EAAS,qBAAA;cACTkE,UAAAA,EAAY;gBACVC,IAAAA,EAAM,cAAA;AACNgN,gBAAAA,OAAAA,EAAS,IAAI7Q,IAAAA,CAAKxB,MAAAA,CAAOuR,SAAS,EAAEe,WAAAA;AACtC;AACF;;SAEJ,CAAA;AACA,QAAA,MAAMC,QAAAA,GAAW,IAAIV,QAAAA,CAASW,QAAAA,CAASrO,IAAAA,EAAM;UAC3C0D,MAAAA,EAAQ,GAAA;UACRvM,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;AAChB,YAAA,aAAA,EAAewF,OAAOmR,WAAAA,CAAAA;YACtB,mBAAA,EAAqBnR,MAAAA,CAAOd,OAAO0H,KAAK,CAAA;YACxC,uBAAA,EAAyB,GAAA;AACzB,YAAA,mBAAA,EAAqB5G,OAAOgB,IAAAA,CAAK2Q,KAAAA,CAAMzS,MAAAA,CAAOuR,SAAAA,GAAY,GAAA,CAAA;AAC5D;SACF,CAAA;AACAO,QAAAA,WAAAA,CAAYS,QAAAA,CAAAA;AACd,MAAA;IACF,CAAA,EA5CW,WAAA,CAAA;AA6CXG,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEd,OAAAA,EAASW,QAAAA,EAAQ,KAAE;AAChC,MAAA,MAAMI,QAASf,OAAAA,CAA+DG,iBAAAA;AAC9E,MAAA,IAAI,CAACY,KAAAA,EAAO;AACZJ,MAAAA,QAAAA,CAASjX,QAAQkE,GAAAA,CAAI,mBAAA,EAAqBsB,MAAAA,CAAO6R,KAAAA,CAAMjL,KAAK,CAAA,CAAA;AAC5D6K,MAAAA,QAAAA,CAASjX,OAAAA,CAAQkE,GAAAA,CAAI,uBAAA,EAAyBsB,MAAAA,CAAOgB,IAAAA,CAAKC,IAAI,CAAA,EAAG4Q,KAAAA,CAAMrB,SAAS,CAAA,CAAA,CAAA;AAChF,MAAA,IAAIqB,KAAAA,CAAMpB,YAAY,CAAA,EAAG;AACvBgB,QAAAA,QAAAA,CAASjX,OAAAA,CAAQkE,GAAAA,CAAI,mBAAA,EAAqBsB,MAAAA,CAAOgB,IAAAA,CAAK2Q,MAAME,KAAAA,CAAMpB,SAAAA,GAAY,GAAA,CAAA,CAAA,CAAA;AAChF,MAAA;IACF,CAAA,EARY,YAAA;AASd,GAAA;AACF,CAAA,EAzDqC,uBAAA;;;ACzD9B,IAAMqB,oBAAAA,iCAA8BnT,OAAAA,KAAAA;AACzC,EAAA,IAAI,CAACA,QAAQrB,OAAAA,EAAS;AACpB2C,IAAAA,MAAAA,CAAOC,KAAK,2EAAA,EAAwE;AAClF9C,MAAAA,WAAAA,EAAauB,OAAAA,CAAQvB;KACvB,CAAA;AACA,IAAA,OAAO,EAAA;AACT,EAAA;AAIA,EAAA,MAAMyF,iBAAAA,EAAAA;AACN,EAAA,MAAM8N,MAAAA,GAAS,MAAMtP,wBAAAA,CAAyB1C,OAAAA,CAAQvB,WAAW,CAAA;AAEjE,EAAA,MAAMqK,UAAoB,EAAA;AAE1B,EAAA,MAAMsK,UAAAA,GAAa,MAAM/G,gBAAAA,CAAiBrM,OAAAA,CAAQT,IAAI,CAAA;AACtDuJ,EAAAA,OAAAA,CAAQ/F,KAAKqQ,UAAAA,CAAAA;AAEb,EAAA,MAAMC,YAAAA,GAAe,MAAM7L,kBAAAA,CAAmBxH,OAAAA,CAAQpB,KAAK,CAAA;AAC3DkK,EAAAA,OAAAA,CAAQ/F,IAAAA,CAAI,GAAIsQ,YAAAA,CAAAA;AAEhB,EAAA,IAAIrT,OAAAA,CAAQnB,gBAAgBF,OAAAA,EAAS;AACnCmK,IAAAA,OAAAA,CAAQ/F,KAAKoO,2BAAAA,CAA4B;AAAE1H,MAAAA,MAAAA,EAAQzJ,OAAAA,CAAQnB;AAAgB,KAAA,CAAA,CAAA;AAC7E,EAAA;AACAiK,EAAAA,OAAAA,CAAQ/F,KAAKkP,qBAAAA,CAAsB;AAAED,IAAAA,MAAAA;AAAQvI,IAAAA,MAAAA,EAAQzJ,OAAAA,CAAQhB;AAAU,GAAA,CAAA,CAAA;AACvE8J,EAAAA,OAAAA,CAAQ/F,KAAKuG,4BAAAA,CAA6B;AAAEG,IAAAA,MAAAA,EAAQzJ,OAAAA,CAAQX;AAAiB,GAAA,CAAA,CAAA;AAE7EiC,EAAAA,MAAAA,CAAOgC,KAAK,kCAAA,EAAoC;AAC9C7E,IAAAA,WAAAA,EAAauB,OAAAA,CAAQvB,WAAAA;AACrBsT,IAAAA,KAAAA,EAAOjJ,OAAAA,CAAQd,MAAAA;IACfzJ,OAAAA,EAAS;AACPK,MAAAA,KAAAA,EAAOoB,QAAQpB,KAAAA,CAAML,OAAAA;AACrB8R,MAAAA,UAAAA,EAAYrQ,QAAQnB,eAAAA,CAAgBN,OAAAA;AACpCS,MAAAA,SAAAA,EAAWgB,QAAQhB,SAAAA,CAAUG;AAC/B,KAAA;IACAR,OAAAA,EAAS;AACP0R,MAAAA,UAAAA,EAAYrQ,QAAQnB,eAAAA,CAAgBF;AACtC;GACF,CAAA;AAEA,EAAA,OAAOmK,OAAAA;AACT,CAAA,EAzCoC,sBAAA","file":"chunk-OJDXWHRJ.js","sourcesContent":["/**\n * Gateway Security Module — public API\n *\n * Plug-in stack for public GraphQL federation gateways:\n * graphql-armor, per-field query complexity, per-actor rate limiting,\n * operation-level AbortController, OpenTelemetry spans.\n *\n * Consumed by each public gateway via:\n * ```ts\n * import { buildSecurityPlugins, resolveSecurityOptionsFromEnv } from '@burdenoff/be-sdk/gateway/security';\n *\n * const plugins = await buildSecurityPlugins(\n *   resolveSecurityOptionsFromEnv('wspace-public-gateway', { 'Query.customField': 100 })\n * );\n * // pass plugins into createGatewayRuntime({ plugins })\n * ```\n *\n * @module gateway/security\n * @category Gateway\n */\n\nexport { resolveActor } from './actor.js';\nexport { DEFAULT_COST_MAP, mergeCostMap } from './cost-map.js';\nexport { DEFAULT_ARMOR_CONFIG, resolveSecurityOptionsFromEnv } from './defaults.js';\nexport { DEFAULT_TIERS, resolveTiersFromEnv } from './tiers.js';\nexport type {\n  ActorContext,\n  ArmorConfig,\n  CostMap,\n  GatewaySecurityOptions,\n  OperationTimeoutConfig,\n  OtelConfig,\n  QueryComplexityConfig,\n  RateLimitConfig,\n  RateLimitResult,\n  SecurityValkeyClient,\n  Tier,\n  TierLimits,\n} from './types.js';\nexport { __setSecurityValkeyForTest, getSecurityValkey, initializeSecurityValkey, MemoryValkey } from './valkey.js';\nexport { __resetMetricsForTest, getMetrics, initializeMetrics, scrapeMetrics } from './metrics.js';\n\nexport {\n  buildSecurityPlugins,\n  createArmorPlugins,\n  createOperationTimeoutPlugin,\n  createOtelPlugin,\n  createQueryComplexityPlugin,\n  createRateLimitPlugin,\n  checkRateLimit,\n  initializeOtel,\n  shutdownOtel,\n} from './plugins/index.js';\n","/**\n * Actor Resolver\n *\n * Derives an ActorContext from the headers that the gateway's auth middleware\n * already injects (`x-actor-*`, `x-workspace-id`, `x-tenant-id`, `x-org-id`,\n * `x-forwarded-for`). This is the identity used for rate-limit buckets and\n * OTel span enrichment.\n *\n * @module gateway/security/actor\n * @category Gateway\n */\n\nimport type { ActorContext, Tier } from './types.js';\n\ntype HeaderGetter = (name: string) => string | null | undefined;\n\nconst firstIp = (header: string | null | undefined): string | undefined => {\n  if (!header) return undefined;\n  // x-forwarded-for is a comma-separated list; take the left-most (client).\n  return header.split(',')[0]?.trim() || undefined;\n};\n\nconst classify = (actorType: string | undefined, actorRole: string | undefined): Tier => {\n  if (actorRole === 'super_admin') return 'super_admin';\n  switch (actorType) {\n    case 'user':\n      return 'user';\n    case 'app':\n      return 'app';\n    case 'service':\n    case 'service_account':\n      return 'service';\n    case 'super_admin':\n      return 'super_admin';\n    default:\n      return 'public';\n  }\n};\n\n/**\n * Resolve the canonical ActorContext for a request.\n * Accepts a `HeaderGetter` so it is trivially testable with a plain function.\n */\nexport const resolveActor = (getHeader: HeaderGetter): ActorContext => {\n  const actorId = getHeader('x-actor-id') ?? undefined;\n  const actorType = getHeader('x-actor-type') ?? undefined;\n  const actorRole = getHeader('x-actor-role') ?? undefined;\n  const workspaceId = getHeader('x-workspace-id') ?? undefined;\n  const tenantId = getHeader('x-tenant-id') ?? undefined;\n  const orgId = getHeader('x-org-id') ?? undefined;\n  const appId = getHeader('x-app-id') ?? undefined;\n  const ip =\n    firstIp(getHeader('x-forwarded-for')) || getHeader('x-real-ip') || getHeader('cf-connecting-ip') || undefined;\n\n  const tier = classify(actorType, actorRole);\n\n  let identity: string;\n  switch (tier) {\n    case 'super_admin':\n      identity = 'bypass';\n      break;\n    case 'service':\n      identity = `svc:${actorId ?? 'unknown'}`;\n      break;\n    case 'app':\n      identity = `${tenantId ?? 'notenant'}:${appId ?? actorId ?? 'unknown'}`;\n      break;\n    case 'user':\n      identity = `${workspaceId ?? 'nows'}:${actorId ?? 'unknown'}`;\n      break;\n    case 'public':\n    default:\n      identity = `ip:${ip ?? 'unknown'}`;\n  }\n\n  return {\n    tier,\n    identity,\n    headers: {\n      actorId,\n      actorType,\n      actorRole,\n      workspaceId,\n      tenantId,\n      orgId,\n      appId,\n      ip,\n    },\n  };\n};\n","/**\n * Default query complexity cost map.\n *\n * Key format: \"TypeName.fieldName\". Values are base costs. List fields multiply\n * by the requested page size (up to 100) via the plugin's list-multiplier.\n *\n * Seeded from known high-cost queries across the Burdenoff federation:\n * search, analytics, reports, enumerations, introspection.\n *\n * Extend via `mergeCostMap(DEFAULT_COST_MAP, override)` in each gateway.\n *\n * @module gateway/security/cost-map\n * @category Gateway\n */\n\nimport type { CostMap } from './types.js';\n\nexport const DEFAULT_COST_MAP: CostMap = {\n  // Cross-subgraph search — fanout\n  'Query.searchBigConsole': 200,\n  'Query.searchWorkspaces': 100,\n  'Query.searchTags': 80,\n\n  // Aggregations\n  'Query.analyticsReport': 300,\n  'Query.usageReport': 250,\n  'Query.billingReport': 250,\n  'Query.auditLog': 150,\n\n  // Enumeration risk (paginated lists)\n  'Query.listUsers': 50,\n  'Query.listWorkspaces': 50,\n  'Query.listFiles': 40,\n  'Query.listTags': 20,\n  'Query.listApps': 40,\n\n  // Nested lists\n  'Workspace.members': 5,\n  'User.workspaces': 10,\n  'User.apps': 5,\n  'Tag.appliedTo': 5,\n\n  // Introspection — expensive and abuse-prone in prod\n  'Query.__schema': 1000,\n  'Query.__type': 500,\n\n  // Heavy writers\n  'Mutation.bulkImport': 500,\n  'Mutation.webhookTrigger': 100,\n};\n\nexport const mergeCostMap = (base: CostMap, override: CostMap): CostMap => ({\n  ...base,\n  ...override,\n});\n","/**\n * Default rate-limit tiers for public gateways.\n *\n * These defaults target a single pod; cross-pod fairness is provided by the\n * Valkey-backed counter. Tune via `GATEWAY_RATE_LIMIT_*` env vars.\n *\n * @module gateway/security/tiers\n * @category Gateway\n */\n\nimport type { Tier, TierLimits } from './types.js';\n\nexport const DEFAULT_TIERS: Record<Tier, TierLimits> = {\n  // Public (anonymous) traffic is keyed per-IP. The previous 60+20=80/60s\n  // ceiling (1.33 req/s sustained) was tight enough that a single heavy\n  // frontend page load (≈15–30 GraphQL queries) plus a NAT-shared second\n  // user could blow the bucket on benign traffic. Bumping to 120+60=180/60s\n  // (3 req/s sustained) gives 2× headroom while staying ~40× below the\n  // ~130 req/s single-pod compute floor measured under realistic load.\n  public: {\n    points: 120,\n    duration: 60,\n    burst: 60,\n  },\n  user: {\n    points: 600,\n    duration: 60,\n    burst: 120,\n  },\n  app: {\n    points: 3000,\n    duration: 60,\n    burst: 500,\n  },\n  service: {\n    points: 6000,\n    duration: 60,\n    burst: 1000,\n  },\n  super_admin: {\n    points: Number.MAX_SAFE_INTEGER,\n    duration: 60,\n    burst: Number.MAX_SAFE_INTEGER,\n  },\n};\n\nconst positiveInt = (value: string | undefined, fallback: number): number => {\n  if (!value) return fallback;\n  const parsed = parseInt(value, 10);\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n};\n\n/**\n * Read tier overrides from env.\n *\n * Env var pattern: `GATEWAY_RL_{TIER}_{POINTS|DURATION|BURST}`\n * Example: `GATEWAY_RL_USER_POINTS=1200`\n */\nexport const resolveTiersFromEnv = (base: Record<Tier, TierLimits> = DEFAULT_TIERS): Record<Tier, TierLimits> => {\n  const out: Record<Tier, TierLimits> = { ...base };\n  (Object.keys(base) as Tier[]).forEach((tier) => {\n    const upper = tier.toUpperCase();\n    out[tier] = {\n      points: positiveInt(process.env[`GATEWAY_RL_${upper}_POINTS`], base[tier].points),\n      duration: positiveInt(process.env[`GATEWAY_RL_${upper}_DURATION`], base[tier].duration),\n      burst: positiveInt(process.env[`GATEWAY_RL_${upper}_BURST`], base[tier].burst),\n    };\n  });\n  return out;\n};\n","/**\n * Gateway Security Defaults\n *\n * Production-safe defaults for the security plugin stack, and helpers to\n * assemble `GatewaySecurityOptions` from environment variables. Each field\n * honors an `*_OBSERVE*` flag so the hardening pass can soft-launch\n * observe-only before flipping to enforce.\n *\n * @module gateway/security/defaults\n * @category Gateway\n */\n\nimport { DEFAULT_COST_MAP, mergeCostMap } from './cost-map.js';\nimport { resolveTiersFromEnv } from './tiers.js';\nimport type { ArmorConfig, CostMap, GatewaySecurityOptions } from './types.js';\n\nconst boolEnv = (key: string, fallback: boolean): boolean => {\n  const v = process.env[key];\n  if (v === undefined) return fallback;\n  return v === 'true' || v === '1';\n};\n\nconst intEnv = (key: string, fallback: number): number => {\n  const v = process.env[key];\n  if (!v) return fallback;\n  const parsed = parseInt(v, 10);\n  return Number.isFinite(parsed) ? parsed : fallback;\n};\n\nconst strEnv = (key: string, fallback: string): string => process.env[key] ?? fallback;\n\n/**\n * Default armor thresholds for public gateways.\n */\nexport const DEFAULT_ARMOR_CONFIG: ArmorConfig = {\n  maxAliases: 15,\n  maxTokens: 1000,\n  maxDirectives: 50,\n  characterLimit: 15000,\n  costLimit: 5000,\n  observe: true,\n};\n\n/**\n * Build `GatewaySecurityOptions` by reading env vars.\n *\n * All defaults are production-safe but begin in observe-only mode so the\n * first deploy does not reject any traffic. Flip observe flags to `false`\n * after the 48h bake.\n */\nexport const resolveSecurityOptionsFromEnv = (\n  gatewayName: string,\n  costMapOverride?: CostMap\n): GatewaySecurityOptions => {\n  return {\n    gatewayName,\n    enabled: boolEnv('SECURITY_PLUGINS_ENABLED', true),\n    armor: {\n      maxAliases: intEnv('ARMOR_MAX_ALIASES', DEFAULT_ARMOR_CONFIG.maxAliases),\n      maxTokens: intEnv('ARMOR_MAX_TOKENS', DEFAULT_ARMOR_CONFIG.maxTokens),\n      maxDirectives: intEnv('ARMOR_MAX_DIRECTIVES', DEFAULT_ARMOR_CONFIG.maxDirectives),\n      characterLimit: intEnv('ARMOR_CHARACTER_LIMIT', DEFAULT_ARMOR_CONFIG.characterLimit),\n      costLimit: intEnv('ARMOR_COST_LIMIT', DEFAULT_ARMOR_CONFIG.costLimit),\n      observe: boolEnv('ARMOR_OBSERVE', true),\n    },\n    queryComplexity: {\n      enabled: boolEnv('QUERY_COMPLEXITY_ENABLED', true),\n      maxCost: intEnv('QUERY_COMPLEXITY_MAX', 2000),\n      costMap: costMapOverride ? mergeCostMap(DEFAULT_COST_MAP, costMapOverride) : DEFAULT_COST_MAP,\n      observe: boolEnv('QUERY_COMPLEXITY_OBSERVE', true),\n    },\n    rateLimit: {\n      tiers: resolveTiersFromEnv(),\n      keyPrefix: strEnv('VALKEY_KEY_PREFIX', gatewayName),\n      observeOnly: boolEnv('RATE_LIMIT_OBSERVE_ONLY', true),\n      failClosed: boolEnv('RATE_LIMIT_FAIL_CLOSED', false),\n    },\n    operationTimeout: {\n      // Default 15s — shorter than the 30s request-limiter queueTimeout, and\n      // aligned with typical client-side timeouts so load-shedding fires at\n      // the same edge a saturated client would already give up. Mutations\n      // that legitimately take longer can override per-deployment via the\n      // OPERATION_TIMEOUT_MS env var.\n      timeoutMs: intEnv('OPERATION_TIMEOUT_MS', 15000),\n    },\n    otel: {\n      enabled: boolEnv('OTEL_ENABLED', true),\n      serviceName: strEnv('OTEL_SERVICE_NAME', gatewayName),\n      endpoint: strEnv('OTEL_EXPORTER_OTLP_ENDPOINT', 'https://tempo.tooling.internal.burdenoff.com:4318/v1/traces'),\n      environment: strEnv('NODE_ENV', 'development'),\n      version: process.env['APP_VERSION'],\n    },\n  };\n};\n","/**\n * Valkey Client Bootstrap for Gateway Security\n *\n * Wraps the SDK's existing getValkeyClient() (@valkey/valkey-glide) to expose a\n * minimal, stable surface for the rate-limit plugin. Falls back to an\n * in-memory stub so unit tests and local dev without Valkey do not error.\n *\n * @module gateway/security/valkey\n * @category Gateway\n */\n\nimport { logger } from '../../logger/index.js';\nimport type { SecurityValkeyClient } from './types.js';\n\ntype GlideClient = {\n  get(key: string): Promise<string | null>;\n  set(key: string, value: string, options?: { EX?: number }): Promise<string | null>;\n  incrBy(key: string, amount: number): Promise<number>;\n  expire(key: string, seconds: number): Promise<boolean>;\n  ttl(key: string): Promise<number>;\n  ping(): Promise<string>;\n  close?(): Promise<void>;\n};\n\n/**\n * `ioredis` adapter. Used when `VALKEY_CLIENT=ioredis` or as the Bun-compat\n * fallback when `@valkey/valkey-glide` throws at runtime (known issue:\n * `util.Buffer.byteLength` under Bun 1.3.x).\n */\ntype IoRedisInstance = {\n  get(key: string): Promise<string | null>;\n  set(key: string, value: string, mode?: string, duration?: number): Promise<string | null>;\n  incrby(key: string, amount: number): Promise<number>;\n  expire(key: string, seconds: number): Promise<number>;\n  ttl(key: string): Promise<number>;\n  ping(): Promise<string>;\n  quit(): Promise<string>;\n  on(event: string, listener: (...args: unknown[]) => void): void;\n};\n\nclass IoRedisAdapter implements SecurityValkeyClient {\n  constructor(private readonly client: IoRedisInstance) {}\n\n  get(key: string): Promise<string | null> {\n    return this.client.get(key);\n  }\n\n  set(key: string, value: string, options?: { EX?: number }): Promise<string | null> {\n    if (options?.EX) {\n      return this.client.set(key, value, 'EX', options.EX);\n    }\n    return this.client.set(key, value);\n  }\n\n  incrBy(key: string, amount: number): Promise<number> {\n    return this.client.incrby(key, amount);\n  }\n\n  async expire(key: string, seconds: number): Promise<boolean> {\n    const result = await this.client.expire(key, seconds);\n    return result === 1;\n  }\n\n  ttl(key: string): Promise<number> {\n    return this.client.ttl(key);\n  }\n\n  ping(): Promise<string> {\n    return this.client.ping();\n  }\n}\n\nconst buildIoRedisClient = async (url: string): Promise<SecurityValkeyClient> => {\n  const spec = 'ioredis';\n  const mod = (await import(/* @vite-ignore */ spec)) as unknown as {\n    default?: new (url: string) => IoRedisInstance;\n    Redis?: new (url: string) => IoRedisInstance;\n  };\n  const Ctor = mod.default ?? mod.Redis;\n  if (!Ctor) {\n    throw new Error('ioredis module has no Redis constructor');\n  }\n  const client = new Ctor(url);\n  client.on('error', (err) => {\n    const e = err instanceof Error ? err : new Error(String(err));\n    logger.warn('[gateway-security] ioredis error event', { error: e.message });\n  });\n  return new IoRedisAdapter(client);\n};\n\ntype MemoryEntry = {\n  value: string;\n  expiresAt: number;\n};\n\n/**\n * Tiny in-memory fallback. Not cross-pod safe; used only when Valkey is\n * absent (e.g., unit tests, local dev without `docker compose up`).\n */\nclass MemoryValkey implements SecurityValkeyClient {\n  private store = new Map<string, MemoryEntry>();\n\n  private prune(key: string): MemoryEntry | undefined {\n    const e = this.store.get(key);\n    if (!e) return undefined;\n    if (e.expiresAt > 0 && e.expiresAt <= Date.now()) {\n      this.store.delete(key);\n      return undefined;\n    }\n    return e;\n  }\n\n  get(key: string): Promise<string | null> {\n    const e = this.prune(key);\n    return Promise.resolve(e?.value ?? null);\n  }\n\n  set(key: string, value: string, options?: { EX?: number }): Promise<string | null> {\n    this.store.set(key, {\n      value,\n      expiresAt: options?.EX ? Date.now() + options.EX * 1000 : 0,\n    });\n    return Promise.resolve('OK');\n  }\n\n  incrBy(key: string, amount: number): Promise<number> {\n    const e = this.prune(key);\n    const next = (e ? parseInt(e.value, 10) || 0 : 0) + amount;\n    this.store.set(key, { value: String(next), expiresAt: e?.expiresAt ?? 0 });\n    return Promise.resolve(next);\n  }\n\n  expire(key: string, seconds: number): Promise<boolean> {\n    const e = this.store.get(key);\n    if (!e) return Promise.resolve(false);\n    e.expiresAt = Date.now() + seconds * 1000;\n    return Promise.resolve(true);\n  }\n\n  ttl(key: string): Promise<number> {\n    const e = this.prune(key);\n    if (!e) return Promise.resolve(-2);\n    if (e.expiresAt === 0) return Promise.resolve(-1);\n    return Promise.resolve(Math.max(0, Math.ceil((e.expiresAt - Date.now()) / 1000)));\n  }\n\n  ping(): Promise<string> {\n    return Promise.resolve('PONG');\n  }\n}\n\nlet singleton: SecurityValkeyClient | null = null;\nlet bootPromise: Promise<SecurityValkeyClient> | null = null;\n\n/**\n * Initialize the Valkey client for the gateway. Reads `VALKEY_URL` (or\n * `REDIS_URL`) + `VALKEY_PASSWORD` from env. On failure: if `VALKEY_REQUIRED`\n * is set to `\"true\"`, throws; otherwise logs a warning and returns the memory\n * fallback so the gateway still boots.\n *\n * Safe to call multiple times — the result is memoized.\n */\nexport const initializeSecurityValkey = async (gatewayName: string): Promise<SecurityValkeyClient> => {\n  if (singleton) return singleton;\n  if (bootPromise) return bootPromise;\n\n  bootPromise = (async (): Promise<SecurityValkeyClient> => {\n    const url = process.env['VALKEY_URL'] || process.env['REDIS_URL'];\n    const required = process.env['VALKEY_REQUIRED'] === 'true';\n    const clientKind = process.env['VALKEY_CLIENT'] ?? 'ioredis';\n\n    if (!url) {\n      const msg = '[gateway-security] VALKEY_URL not set';\n      if (required) throw new Error(`${msg} and VALKEY_REQUIRED=true`);\n      logger.warn(`${msg} — using in-memory fallback (not cross-pod safe)`, {\n        gatewayName,\n      });\n      singleton = new MemoryValkey();\n      return singleton;\n    }\n\n    const attempts: Array<{\n      kind: string;\n      factory: () => Promise<SecurityValkeyClient>;\n    }> = [];\n\n    if (clientKind === 'ioredis') {\n      attempts.push({ kind: 'ioredis', factory: () => buildIoRedisClient(url) });\n      attempts.push({\n        kind: 'glide (fallback)',\n        factory: async () => {\n          const { getValkeyClient } = await import('../../cache/index.js');\n          return (await getValkeyClient()) as unknown as GlideClient;\n        },\n      });\n    } else {\n      attempts.push({\n        kind: 'glide',\n        factory: async () => {\n          const { getValkeyClient } = await import('../../cache/index.js');\n          return (await getValkeyClient()) as unknown as GlideClient;\n        },\n      });\n      attempts.push({ kind: 'ioredis (fallback)', factory: () => buildIoRedisClient(url) });\n    }\n\n    let lastError: Error | null = null;\n    for (const attempt of attempts) {\n      try {\n        const client = await attempt.factory();\n        const pong = await client.ping();\n        if (pong !== 'PONG') {\n          throw new Error(`ping returned ${pong}`);\n        }\n        logger.info('[gateway-security] Valkey connected', {\n          gatewayName,\n          url,\n          client: attempt.kind,\n        });\n        singleton = client;\n        return client;\n      } catch (err) {\n        lastError = err instanceof Error ? err : new Error(String(err));\n        logger.warn('[gateway-security] Valkey client init failed, will try next', {\n          gatewayName,\n          client: attempt.kind,\n          error: lastError.message,\n        });\n      }\n    }\n\n    if (required) {\n      logger.error('[gateway-security] Valkey connection failed and required=true', {\n        gatewayName,\n        error: lastError?.message ?? 'all attempts failed',\n      });\n      throw lastError ?? new Error('Valkey connection failed');\n    }\n    logger.warn('[gateway-security] All Valkey clients failed — using in-memory fallback', {\n      gatewayName,\n      error: lastError?.message ?? 'unknown',\n    });\n    singleton = new MemoryValkey();\n    return singleton;\n  })();\n\n  return bootPromise;\n};\n\n/**\n * Return the initialized client. Throws if `initializeSecurityValkey` was not\n * called first — keeps the plugin wiring explicit.\n */\nexport const getSecurityValkey = (): SecurityValkeyClient => {\n  if (!singleton) {\n    throw new Error('[gateway-security] Valkey not initialized — call initializeSecurityValkey() first');\n  }\n  return singleton;\n};\n\n/**\n * Test-only seam. Replaces the singleton with a stub.\n * Do NOT use in production code.\n */\nexport const __setSecurityValkeyForTest = (client: SecurityValkeyClient | null): void => {\n  singleton = client;\n  bootPromise = client ? Promise.resolve(client) : null;\n};\n\nexport { MemoryValkey };\n","/**\n * Prometheus Metrics for Gateway Security Plugins\n *\n * Thin wrapper over `prom-client` — optional peer dep. When prom-client is\n * not installed or `PROMETHEUS_METRICS_ENABLED !== 'true'`, every emit is a\n * no-op so the SDK remains consumable without pulling the dependency.\n *\n * Metrics:\n *   - `gateway_security_rate_limit_total{gateway,tier,decision}`\n *     decision ∈ allowed | rejected | observed_reject\n *   - `gateway_security_complexity_rejected_total{gateway,observe}`\n *   - `gateway_security_armor_rejected_total{gateway,rule}` (reserved —\n *     wiring depends on armor plugin emitting hooks)\n *   - `gateway_security_valkey_failover_total{gateway}`\n *   - `gateway_security_operation_timeout_total{gateway}`\n *\n * Labels:\n *   - `gateway` — gateway name (wspace-public-gateway | global-public-gateway)\n *   - `tier` — public | user | app | service | super_admin\n *   - `decision` — allowed | rejected | observed_reject\n *   - `observe` — 'true' | 'false'\n *   - `rule` — armor rule ref (max_aliases, max_tokens, …)\n *\n * All metrics are global singletons across plugin instances. Safe to call\n * `initializeMetrics()` multiple times; subsequent calls are no-ops.\n *\n * @module gateway/security/metrics\n * @category Gateway\n */\n\nimport { logger } from '../../logger/index.js';\n\n// Lightweight type shims for prom-client — keeps this file usable without\n// the peer dep installed.\ntype CounterLike = {\n  inc(labels?: Record<string, string>, value?: number): void;\n};\n\ntype CounterCtor = new (opts: { name: string; help: string; labelNames?: string[] }) => CounterLike;\n\ntype PromClientModule = {\n  Counter?: CounterCtor;\n  register?: { metrics(): Promise<string>; contentType: string };\n};\n\ninterface Metrics {\n  rateLimit: CounterLike;\n  complexityRejected: CounterLike;\n  armorRejected: CounterLike;\n  valkeyFailover: CounterLike;\n  operationTimeout: CounterLike;\n}\n\nlet metrics: Metrics | null = null;\nlet initializing = false;\nlet promMod: PromClientModule | null = null;\n\nconst noopCounter: CounterLike = {\n  inc: () => undefined,\n};\n\nconst noopMetrics: Metrics = {\n  rateLimit: noopCounter,\n  complexityRejected: noopCounter,\n  armorRejected: noopCounter,\n  valkeyFailover: noopCounter,\n  operationTimeout: noopCounter,\n};\n\n/**\n * Initialize the metrics registry. Safe to call multiple times.\n * Returns a no-op metrics object if prom-client is unavailable.\n */\nexport const initializeMetrics = async (): Promise<Metrics> => {\n  if (metrics) return metrics;\n  if (initializing) {\n    // Another caller is mid-init; return noop to avoid races.\n    return noopMetrics;\n  }\n  if (process.env['PROMETHEUS_METRICS_ENABLED'] !== 'true') {\n    logger.info('[gateway-security] Prometheus metrics disabled (PROMETHEUS_METRICS_ENABLED!=true)');\n    metrics = noopMetrics;\n    return metrics;\n  }\n\n  initializing = true;\n  try {\n    const spec = 'prom-client';\n    promMod = (await import(/* @vite-ignore */ spec)) as unknown as PromClientModule;\n    if (typeof promMod.Counter !== 'function') {\n      logger.warn('[gateway-security] prom-client has unexpected shape — metrics disabled');\n      metrics = noopMetrics;\n      return metrics;\n    }\n\n    const { Counter } = promMod;\n    metrics = {\n      rateLimit: new Counter({\n        name: 'gateway_security_rate_limit_total',\n        help: 'Rate-limit plugin decisions by tier + gateway',\n        labelNames: ['gateway', 'tier', 'decision'],\n      }),\n      complexityRejected: new Counter({\n        name: 'gateway_security_complexity_rejected_total',\n        help: 'Query complexity plugin rejections',\n        labelNames: ['gateway', 'observe'],\n      }),\n      armorRejected: new Counter({\n        name: 'gateway_security_armor_rejected_total',\n        help: 'graphql-armor rule rejections',\n        labelNames: ['gateway', 'rule', 'mode'],\n      }),\n      valkeyFailover: new Counter({\n        name: 'gateway_security_valkey_failover_total',\n        help: 'Rate-limit plugin fail-open events due to Valkey unreachable',\n        labelNames: ['gateway'],\n      }),\n      operationTimeout: new Counter({\n        name: 'gateway_security_operation_timeout_total',\n        help: 'Operation timeout plugin aborts',\n        labelNames: ['gateway'],\n      }),\n    };\n    logger.info('[gateway-security] Prometheus metrics initialized');\n    return metrics;\n  } catch (err) {\n    const e = err instanceof Error ? err : new Error(String(err));\n    logger.warn('[gateway-security] prom-client not installed — metrics disabled', {\n      error: e.message,\n    });\n    metrics = noopMetrics;\n    return metrics;\n  } finally {\n    initializing = false;\n  }\n};\n\n/**\n * Get the current metrics handle. Returns a noop object if\n * `initializeMetrics()` has not been called or prom-client is unavailable.\n * Always safe to call.\n */\nexport const getMetrics = (): Metrics => metrics ?? noopMetrics;\n\n/**\n * Return the Prometheus registry's default `/metrics` output. Returns\n * `null` if prom-client is not installed.\n */\nexport const scrapeMetrics = async (): Promise<{ body: string; contentType: string } | null> => {\n  if (!promMod?.register) return null;\n  const body = await promMod.register.metrics();\n  return { body, contentType: promMod.register.contentType };\n};\n\n/**\n * Test-only reset. Drops the initialized counters. Do NOT use in production.\n */\nexport const __resetMetricsForTest = (): void => {\n  metrics = null;\n  initializing = false;\n  promMod = null;\n};\n","/**\n * GraphQL Armor Plugin Bundle\n *\n * Wraps the `@escape.tech/graphql-armor-*` validation rules into a single\n * Envelop plugin that runs them inside `onValidate` and sets rejection via\n * `setResult(errors)` — the same pattern that `query-complexity` uses and\n * that Hive Gateway Runtime is confirmed to honor.\n *\n * Why not just use each armor package's own `plugin` factory (which wraps\n * the rule via `addValidationRule`)? Because Hive Gateway Runtime's plugin\n * system does not honor the `addValidationRule` registration path during\n * query validation — rules registered that way are silently dropped. Nor\n * does Hive honor `afterValidate` hooks returned from `onValidate`, which\n * was the first workaround we tried. Only `setResult(errors)` called\n * synchronously inside `onValidate` actually propagates to the client.\n *\n * Rule coverage:\n *   - max-aliases        (graphql-armor rule)\n *   - max-directives     (graphql-armor rule)\n *   - cost-limit         (graphql-armor rule; heuristic pre-pass)\n *   - character-limit    (implemented inline via `onParse.source.length`\n *                         because the armor package hooks `onParams` which\n *                         is not exposed by Envelop — equivalent protection)\n *   - block-field-suggestions (still uses the armor plugin — hooks onValidate\n *     via `setResult`, which does work)\n *   - max-tokens         (covered by query-complexity, not re-implemented;\n *     token blowup shows up as high cost)\n *\n * In observe mode, rule errors are logged but not attached to the final\n * result — the query proceeds as if nothing happened.\n *\n * @module gateway/security/plugins/armor\n * @category Gateway\n */\n\nimport { GraphQLError, validate as graphqlValidate, type ValidationContext, type ValidationRule } from 'graphql';\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport { getMetrics } from '../metrics.js';\nimport type { ArmorConfig } from '../types.js';\n\ntype RuleFactory = (options: Record<string, unknown>) => ValidationRule;\n\ntype ArmorModule = Record<string, unknown>;\n\nconst tryImport = async (specifier: string): Promise<ArmorModule | null> => {\n  try {\n    return (await import(specifier)) as ArmorModule;\n  } catch (err) {\n    const e = err instanceof Error ? err : new Error(String(err));\n    logger.warn('[gateway-security] armor package not installed — rule skipped', {\n      specifier,\n      error: e.message,\n    });\n    return null;\n  }\n};\n\nconst pickFactory = (mod: ArmorModule | null, candidates: string[]): RuleFactory | null => {\n  if (!mod) return null;\n  for (const name of candidates) {\n    const fn = mod[name];\n    if (typeof fn === 'function') return fn as RuleFactory;\n  }\n  return null;\n};\n\nconst createMaxAliasesRule = (maxAliases: number): ValidationRule => {\n  return (context: ValidationContext) => {\n    let aliases = 0;\n\n    return {\n      Field(node) {\n        if (!node.alias) return;\n        aliases += 1;\n        if (aliases > maxAliases) {\n          context.reportError(\n            new GraphQLError('Too many field aliases.', {\n              nodes: node,\n              extensions: { code: 'ARMOR_MAX_ALIASES' },\n            })\n          );\n        }\n      },\n    };\n  };\n};\n\nconst createMaxDirectivesRule = (maxDirectives: number): ValidationRule => {\n  return (context: ValidationContext) => {\n    let directives = 0;\n\n    return {\n      Directive(node) {\n        directives += 1;\n        if (directives > maxDirectives) {\n          context.reportError(\n            new GraphQLError('Too many directives.', {\n              nodes: node,\n              extensions: { code: 'ARMOR_MAX_DIRECTIVES' },\n            })\n          );\n        }\n      },\n    };\n  };\n};\n\ninterface LoadedRules {\n  maxAliasesRule?: ValidationRule;\n  maxDirectivesRule?: ValidationRule;\n  costLimitRule?: ValidationRule;\n  blockSuggestionsPlugin?: Plugin;\n}\n\n/**\n * When `ARMOR_LEAN=true` (default: false), the gateway loads only the cost-limit\n * rule and skips `max-aliases`, `max-directives`, and `block-field-suggestions`.\n *\n * Rationale: each `@escape.tech/graphql-armor-*` rule runs its own\n * `graphqlValidate(document, [rule])` — a full AST traversal per request. On\n * busy public gateways this shows up as a measurable fraction of total CPU.\n * The cost-limit rule already covers the DoS surface (it rejects expensive\n * aliased-or-deeply-nested queries via the heuristic cost function), and\n * character-limit is handled inline in `onParse`, so the other three rules\n * are refinements rather than load-bearing defences.\n *\n * Opt-in via env so existing services see no behavior change.\n */\nconst isLean = (): boolean => {\n  const v = process.env['ARMOR_LEAN'];\n  return v === 'true' || v === '1';\n};\n\nconst loadRules = async (cfg: ArmorConfig): Promise<LoadedRules> => {\n  const lean = isLean();\n\n  const [aliasesMod, directivesMod, costMod, blockSuggestionsMod] = await Promise.all([\n    lean ? Promise.resolve(null) : tryImport('@escape.tech/graphql-armor-max-aliases'),\n    lean ? Promise.resolve(null) : tryImport('@escape.tech/graphql-armor-max-directives'),\n    tryImport('@escape.tech/graphql-armor-cost-limit'),\n    lean ? Promise.resolve(null) : tryImport('@escape.tech/graphql-armor-block-field-suggestions'),\n  ]);\n\n  const loaded: LoadedRules = {};\n\n  const maxAliasesFactory = pickFactory(aliasesMod, ['maxAliasesRule']);\n  loaded.maxAliasesRule = maxAliasesFactory\n    ? maxAliasesFactory({ n: cfg.maxAliases, exposeLimits: cfg.observe })\n    : createMaxAliasesRule(cfg.maxAliases);\n\n  const maxDirectivesFactory = pickFactory(directivesMod, ['maxDirectivesRule']);\n  loaded.maxDirectivesRule = maxDirectivesFactory\n    ? maxDirectivesFactory({\n        n: cfg.maxDirectives,\n        exposeLimits: cfg.observe,\n      })\n    : createMaxDirectivesRule(cfg.maxDirectives);\n\n  const costLimitFactory = pickFactory(costMod, ['costLimitRule']);\n  if (costLimitFactory) {\n    loaded.costLimitRule = costLimitFactory({\n      maxCost: cfg.costLimit,\n      objectCost: 2,\n      scalarCost: 1,\n      depthCostFactor: 1.5,\n      ignoreIntrospection: true,\n      exposeLimits: cfg.observe,\n    });\n  }\n\n  const blockSuggestionsFactory = pickFactory(blockSuggestionsMod, ['blockFieldSuggestionsPlugin', 'default']);\n  if (blockSuggestionsFactory) {\n    loaded.blockSuggestionsPlugin = blockSuggestionsFactory({}) as unknown as Plugin;\n  }\n\n  if (lean) {\n    logger.info('[gateway-security] ARMOR_LEAN enabled — running only cost-limit + character-limit', {});\n  }\n\n  return loaded;\n};\n\n/**\n * Build the Envelop/Yoga plugin list for graphql-armor. Returns the\n * block-field-suggestions plugin (armor's own — this one actually works via\n * `setResult`) plus a custom `onValidate` plugin that runs the rule-based\n * armor checks (max-aliases, max-directives, cost-limit) manually inside\n * `AfterValidate.setResult`.\n *\n * The custom plugin also handles character-limit inline via `onParse`.\n */\nexport const createArmorPlugins = async (cfg: ArmorConfig): Promise<Plugin[]> => {\n  const rules = await loadRules(cfg);\n\n  const metrics = getMetrics();\n\n  // Collect the ValidationRule array once per plugin creation. Envelop's\n  // `validateFn` takes an array of rules, but we're bypassing that path and\n  // running the rules ourselves inside the afterValidate hook. Each rule is\n  // a factory returning a visitor, so this reuse is safe.\n  const enabledRules: Array<{ name: string; rule: ValidationRule }> = [];\n  if (rules.maxAliasesRule) {\n    enabledRules.push({ name: 'max-aliases', rule: rules.maxAliasesRule });\n  }\n  if (rules.maxDirectivesRule) {\n    enabledRules.push({ name: 'max-directives', rule: rules.maxDirectivesRule });\n  }\n  if (rules.costLimitRule) {\n    enabledRules.push({ name: 'cost-limit', rule: rules.costLimitRule });\n  }\n\n  const armorValidationPlugin: Plugin = {\n    onParse({ params }) {\n      // Character limit — rejects oversized raw queries before parse even\n      // starts. Doing it here is equivalent to graphql-armor-character-limit\n      // hooking `onParams`, which is not exposed by Envelop.\n      const source = typeof params.source === 'string' ? params.source : params.source?.body;\n      if (typeof source === 'string' && source.length > cfg.characterLimit) {\n        if (cfg.observe) {\n          logger.warn('[gateway-security] armor character-limit exceeded (observe)', {\n            length: source.length,\n            limit: cfg.characterLimit,\n          });\n          metrics.armorRejected.inc({ rule: 'character-limit', mode: 'observe' }, 1);\n          return;\n        }\n        metrics.armorRejected.inc({ rule: 'character-limit', mode: 'enforce' }, 1);\n        throw new GraphQLError('Syntax Error: Query exceeds maximum character limit.', {\n          extensions: {\n            code: 'CHARACTER_LIMIT_EXCEEDED',\n            http: { status: 400 },\n          },\n        });\n      }\n    },\n    onValidate({ params, setResult }) {\n      if (enabledRules.length === 0) return;\n      // Run armor rules manually inside `onValidate`. We initially tried\n      // returning an `afterValidate` hook here, but Hive Gateway Runtime\n      // silently drops those callbacks — the same class of bug that causes\n      // `addValidationRule` not to fire. Doing the work in the synchronous\n      // body of `onValidate` + calling `setResult` directly is the pattern\n      // that query-complexity uses and it is confirmed to work end-to-end\n      // against Hive Gateway.\n      //\n      // IMPORTANT: graphql-armor rules throw `GraphQLError` synchronously\n      // when a limit is exceeded, instead of using the conventional\n      // `context.reportError()` path. This propagates as an exception out\n      // of `graphqlValidate`, which is why we wrap each rule in an\n      // isolated try/catch — otherwise the first throwing rule would hide\n      // any subsequent rule failures.\n      const armorErrors: GraphQLError[] = [];\n      for (const { name, rule } of enabledRules) {\n        try {\n          const errs = graphqlValidate(params.schema, params.documentAST, [rule]);\n          armorErrors.push(...errs);\n        } catch (err) {\n          // `err instanceof GraphQLError` is NOT reliable here because\n          // `@escape.tech/graphql-armor-*` bundles its own copy of\n          // `graphql`, so the thrown error's prototype chain does not\n          // match the `GraphQLError` class we imported at the top of this\n          // file even when both resolve to the same package semver range.\n          // We therefore detect armor rule violations by looking at the\n          // error shape (either GraphQLError-like or Error-like with a\n          // message). Any thrown value from a rule is treated as a\n          // violation — rules don't throw for any other reason.\n          const message = err instanceof Error ? err.message : String(err);\n          const wrapped = new GraphQLError(message, {\n            originalError: err instanceof Error ? err : undefined,\n            extensions: {\n              code: 'ARMOR_VIOLATION',\n              rule: name,\n            },\n          });\n          armorErrors.push(wrapped);\n        }\n      }\n\n      if (armorErrors.length === 0) return;\n\n      for (const err of armorErrors) {\n        logger.warn('[gateway-security] armor rule triggered', {\n          message: err.message,\n          observe: cfg.observe,\n        });\n      }\n\n      metrics.armorRejected.inc(\n        {\n          rule: 'armor',\n          mode: cfg.observe ? 'observe' : 'enforce',\n        },\n        armorErrors.length\n      );\n\n      if (cfg.observe) return;\n\n      // Calling `setResult` inside `onValidate` replaces the validation\n      // result and skips envelop's own validate invocation. That is exactly\n      // what we want — armor violations are fatal, no point running the\n      // default graphql-js validation afterwards.\n      setResult(armorErrors);\n    },\n  };\n\n  const plugins: Plugin[] = [armorValidationPlugin];\n  if (rules.blockSuggestionsPlugin) {\n    plugins.push(rules.blockSuggestionsPlugin);\n  }\n  return plugins;\n};\n","/**\n * Operation Timeout Plugin\n *\n * Races each operation against a configurable timer (default 15s, aligned\n * with typical client-side timeouts and shorter than the 30s request-limiter\n * cap). When the timer fires, the execution errors out with a proper\n * GraphQL error (`OPERATION_TIMEOUT`) rather than the client seeing an\n * abrupt TCP drop.\n *\n * This is implemented via `onExecute` with a promise race — the subgraph\n * fetch already honors AbortController from Yoga, so upstream work is\n * cancelled naturally.\n *\n * @module gateway/security/plugins/operation-timeout\n * @category Gateway\n */\n\nimport { GraphQLError } from 'graphql';\nimport type { Plugin } from 'graphql-yoga';\n\nimport type { OperationTimeoutConfig } from '../types.js';\n\nexport interface OperationTimeoutPluginDeps {\n  config: OperationTimeoutConfig;\n}\n\ninterface TimerHandle {\n  timer: ReturnType<typeof setTimeout>;\n  promise: Promise<never>;\n}\n\nconst createTimeoutHandle = (timeoutMs: number, error: GraphQLError): TimerHandle => {\n  let timerRef: ReturnType<typeof setTimeout> | undefined;\n  const promise = new Promise<never>((_, reject) => {\n    timerRef = setTimeout(() => reject(error), timeoutMs);\n  });\n  return { timer: timerRef as ReturnType<typeof setTimeout>, promise };\n};\n\nexport const createOperationTimeoutPlugin = (deps: OperationTimeoutPluginDeps): Plugin => {\n  const timeoutError = new GraphQLError('Operation timeout', {\n    extensions: { code: 'OPERATION_TIMEOUT', timeoutMs: deps.config.timeoutMs },\n  });\n\n  return {\n    onExecute: ({ executeFn, setExecuteFn }) => {\n      setExecuteFn(async (args) => {\n        const handle = createTimeoutHandle(deps.config.timeoutMs, timeoutError);\n        try {\n          return await Promise.race([executeFn(args), handle.promise]);\n        } finally {\n          clearTimeout(handle.timer);\n        }\n      });\n    },\n  };\n};\n","/**\n * OpenTelemetry Plugin\n *\n * Initializes an OTLP HTTP exporter pointed at Tempo (or any OTLP/HTTP\n * endpoint) and installs `@envelop/opentelemetry` spans around `parse`,\n * `validate`, and `execute`. Imports are dynamic so the SDK stays usable\n * when OTel is disabled or the peer packages are absent.\n *\n * Enrichment: spans carry `gateway.name`, `deployment.environment`, and\n * `service.version` resource attrs. Per-request context (actor, workspace)\n * is propagated via headers because the SDK does not yet wire\n * `propagators` — see the gateway handler edits for `traceparent` forwarding.\n *\n * @module gateway/security/plugins/otel\n * @category Gateway\n */\n\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport type { OtelConfig } from '../types.js';\n\nlet shutdownHook: (() => Promise<void>) | null = null;\n\n// Structural types for the optional OTel peer deps. Constructors accept\n// `unknown` opts because we only need the start/shutdown surface here.\ntype ResourceCtor = new (attrs: Record<string, string>) => unknown;\ntype ResourceFactory = (attrs: Record<string, string>) => unknown;\ntype OtlpExporterCtor = new (opts: { url: string }) => unknown;\ntype NodeSdkInstance = { start(): void; shutdown(): Promise<void> };\ntype NodeSdkCtor = new (opts: { resource: unknown; traceExporter: unknown }) => NodeSdkInstance;\n\ntype ResourceModule = {\n  // v1 API\n  Resource?: ResourceCtor;\n  // v2 API\n  resourceFromAttributes?: ResourceFactory;\n};\n\ntype SemanticAttrs = {\n  // v1 API\n  SemanticResourceAttributes?: {\n    SERVICE_NAME: string;\n    DEPLOYMENT_ENVIRONMENT: string;\n    SERVICE_VERSION: string;\n  };\n  // v2 API — string constants directly\n  ATTR_SERVICE_NAME?: string;\n  ATTR_SERVICE_VERSION?: string;\n  ATTR_DEPLOYMENT_ENVIRONMENT?: string;\n  ATTR_DEPLOYMENT_ENVIRONMENT_NAME?: string;\n};\n\n/**\n * Build an OTel Resource across the v1 → v2 API migration.\n * - v1 (`@opentelemetry/resources` 1.x): `new Resource(attrs)`\n * - v2 (`@opentelemetry/resources` 2.x): `resourceFromAttributes(attrs)`\n */\nconst buildResource = (resMod: ResourceModule, attrs: Record<string, string>): unknown => {\n  if (typeof resMod.resourceFromAttributes === 'function') {\n    return resMod.resourceFromAttributes(attrs);\n  }\n  if (typeof resMod.Resource === 'function') {\n    return new resMod.Resource(attrs);\n  }\n  throw new Error('@opentelemetry/resources module exposes neither Resource nor resourceFromAttributes');\n};\n\n/**\n * Resolve semantic attribute keys across the v1 → v2 API migration.\n * - v1: `semcon.SemanticResourceAttributes.SERVICE_NAME` etc.\n * - v2: top-level `ATTR_SERVICE_NAME` string constants. Deployment\n *   environment was renamed to `ATTR_DEPLOYMENT_ENVIRONMENT_NAME`.\n */\nconst resolveSemanticKeys = (\n  semcon: SemanticAttrs\n): { serviceName: string; deploymentEnv: string; serviceVersion: string } => {\n  if (semcon.SemanticResourceAttributes) {\n    return {\n      serviceName: semcon.SemanticResourceAttributes.SERVICE_NAME,\n      deploymentEnv: semcon.SemanticResourceAttributes.DEPLOYMENT_ENVIRONMENT,\n      serviceVersion: semcon.SemanticResourceAttributes.SERVICE_VERSION,\n    };\n  }\n  return {\n    serviceName: semcon.ATTR_SERVICE_NAME ?? 'service.name',\n    deploymentEnv:\n      semcon.ATTR_DEPLOYMENT_ENVIRONMENT_NAME ?? semcon.ATTR_DEPLOYMENT_ENVIRONMENT ?? 'deployment.environment',\n    serviceVersion: semcon.ATTR_SERVICE_VERSION ?? 'service.version',\n  };\n};\n\nconst loadOtelPeerDeps = async (): Promise<{\n  NodeSDK: NodeSdkCtor;\n  OTLPTraceExporter: OtlpExporterCtor;\n  resMod: ResourceModule;\n  semcon: SemanticAttrs;\n}> => {\n  // Optional peer deps — indirect specifiers so TS does not try to resolve.\n  const sdkSpec = '@opentelemetry/sdk-node';\n  const otlpSpec = '@opentelemetry/exporter-trace-otlp-http';\n  const resSpec = '@opentelemetry/resources';\n  const semSpec = '@opentelemetry/semantic-conventions';\n  const modules = (await Promise.all([\n    import(/* @vite-ignore */ sdkSpec),\n    import(/* @vite-ignore */ otlpSpec),\n    import(/* @vite-ignore */ resSpec),\n    import(/* @vite-ignore */ semSpec),\n  ])) as [{ NodeSDK: NodeSdkCtor }, { OTLPTraceExporter: OtlpExporterCtor }, ResourceModule, SemanticAttrs];\n  const [sdkMod, otlpMod, resMod, semcon] = modules;\n  return {\n    NodeSDK: sdkMod.NodeSDK,\n    OTLPTraceExporter: otlpMod.OTLPTraceExporter,\n    resMod,\n    semcon,\n  };\n};\n\nexport const initializeOtel = async (cfg: OtelConfig): Promise<void> => {\n  if (!cfg.enabled) {\n    logger.info('[gateway-security] OTel disabled by config');\n    return;\n  }\n  if (shutdownHook) {\n    return; // already initialized\n  }\n\n  try {\n    const { NodeSDK, OTLPTraceExporter, resMod, semcon } = await loadOtelPeerDeps();\n    const keys = resolveSemanticKeys(semcon);\n\n    const resourceAttributes: Record<string, string> = {\n      [keys.serviceName]: cfg.serviceName,\n      [keys.deploymentEnv]: cfg.environment,\n    };\n    if (cfg.version) {\n      resourceAttributes[keys.serviceVersion] = cfg.version;\n    }\n\n    const sdk = new NodeSDK({\n      resource: buildResource(resMod, resourceAttributes),\n      traceExporter: new OTLPTraceExporter({ url: cfg.endpoint }),\n    });\n\n    sdk.start();\n    shutdownHook = (): Promise<void> => sdk.shutdown();\n    logger.info('[gateway-security] OTel initialized', {\n      serviceName: cfg.serviceName,\n      endpoint: cfg.endpoint,\n    });\n  } catch (err) {\n    const e = err instanceof Error ? err : new Error(String(err));\n    logger.warn('[gateway-security] OTel init failed — continuing without tracing', {\n      error: e.message,\n    });\n  }\n};\n\nexport const shutdownOtel = async (): Promise<void> => {\n  if (shutdownHook) {\n    try {\n      await shutdownHook();\n    } catch (err) {\n      const e = err instanceof Error ? err : new Error(String(err));\n      logger.warn('[gateway-security] OTel shutdown error', { error: e.message });\n    }\n    shutdownHook = null;\n  }\n};\n\n/**\n * Returns an Envelop plugin that adds spans around parse/validate/execute.\n * Returns an empty plugin when @envelop/opentelemetry is absent.\n */\nexport const createOtelPlugin = async (cfg: OtelConfig): Promise<Plugin> => {\n  if (!cfg.enabled) return {};\n  try {\n    const spec = '@envelop/opentelemetry';\n    const mod = (await import(/* @vite-ignore */ spec)) as unknown as {\n      useOpenTelemetry?: (opts: {\n        spans?: { execute?: boolean; parse?: boolean; validate?: boolean; subscribe?: boolean };\n        resolvers?: boolean;\n      }) => Plugin;\n    };\n    if (typeof mod.useOpenTelemetry !== 'function') {\n      logger.warn('[gateway-security] @envelop/opentelemetry has unexpected shape — plugin skipped');\n      return {};\n    }\n    return mod.useOpenTelemetry({\n      spans: { execute: true, parse: true, validate: true, subscribe: true },\n      resolvers: false,\n    });\n  } catch (err) {\n    const e = err instanceof Error ? err : new Error(String(err));\n    logger.warn('[gateway-security] @envelop/opentelemetry not installed — plugin skipped', {\n      error: e.message,\n    });\n    return {};\n  }\n};\n","/**\n * Query Complexity Plugin\n *\n * Scores each incoming query against a per-field cost map. Scoring happens in\n * the validate phase so rejection is cheap and subgraph fanout is prevented.\n *\n * Observe mode logs the computed cost without rejecting — used during the\n * 48h bake of the hardening pass.\n *\n * @module gateway/security/plugins/query-complexity\n * @category Gateway\n */\n\nimport { GraphQLError, Kind } from 'graphql';\nimport type {\n  ArgumentNode,\n  FieldNode,\n  FragmentDefinitionNode,\n  GraphQLSchema,\n  OperationDefinitionNode,\n  SelectionNode,\n  SelectionSetNode,\n  ValueNode,\n} from 'graphql';\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport { getMetrics } from '../metrics.js';\nimport type { CostMap, QueryComplexityConfig } from '../types.js';\n\nconst PAGINATION_ARGUMENTS = new Set(['first', 'limit', 'pageSize']);\nconst MAX_LIST_MULTIPLIER = 100;\nconst MAX_FAILURE_LOG_VARIANTS = 5;\nconst complexityFailureMessages = new Set<string>();\n\ninterface GraphQLNamedTypeLike {\n  name?: string;\n  getFields?: () => Record<string, GraphQLFieldLike | undefined>;\n}\n\ninterface GraphQLFieldLike {\n  name?: string;\n  type?: unknown;\n}\n\ninterface GraphQLSchemaLike {\n  getQueryType?: () => GraphQLNamedTypeLike | null;\n  getMutationType?: () => GraphQLNamedTypeLike | null;\n  getSubscriptionType?: () => GraphQLNamedTypeLike | null;\n  getType?: (name: string) => GraphQLNamedTypeLike | undefined | null;\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null;\n\nconst unwrapNamedType = (type: unknown): GraphQLNamedTypeLike | null => {\n  let current = type;\n  while (isRecord(current) && current['ofType'] !== undefined) {\n    current = current['ofType'];\n  }\n  return isRecord(current) ? (current as GraphQLNamedTypeLike) : null;\n};\n\nconst getSchemaLike = (schema: GraphQLSchema): GraphQLSchemaLike => schema as unknown as GraphQLSchemaLike;\n\nconst getOperationRootType = (\n  schema: GraphQLSchema,\n  operation: OperationDefinitionNode\n): GraphQLNamedTypeLike | null => {\n  const schemaLike = getSchemaLike(schema);\n  if (operation.operation === 'mutation') return schemaLike.getMutationType?.() ?? null;\n  if (operation.operation === 'subscription') return schemaLike.getSubscriptionType?.() ?? null;\n  return schemaLike.getQueryType?.() ?? null;\n};\n\nconst getTypeByName = (schema: GraphQLSchema, name: string): GraphQLNamedTypeLike | null => {\n  return getSchemaLike(schema).getType?.(name) ?? null;\n};\n\nconst getField = (parentType: GraphQLNamedTypeLike, fieldName: string): GraphQLFieldLike | undefined => {\n  return parentType.getFields?.()[fieldName];\n};\n\nconst getCostMapValue = (costMap: CostMap, parentType: GraphQLNamedTypeLike, fieldName: string): number => {\n  if (!parentType.name) return 1;\n  return costMap[`${parentType.name}.${fieldName}`] ?? 1;\n};\n\nconst numericValueFromAst = (value: ValueNode): number | undefined => {\n  if (value.kind === Kind.INT || value.kind === Kind.FLOAT) {\n    const parsed = Number(value.value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n  if (value.kind === Kind.STRING) {\n    const parsed = Number(value.value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n  return undefined;\n};\n\nconst listMultiplierFromArgs = (args: readonly ArgumentNode[] | undefined): number => {\n  if (!args) return 1;\n  for (const arg of args) {\n    if (!PAGINATION_ARGUMENTS.has(arg.name.value)) continue;\n    const raw = numericValueFromAst(arg.value);\n    if (typeof raw !== 'number') return 1;\n    return Math.min(Math.max(1, Math.trunc(raw)), MAX_LIST_MULTIPLIER);\n  }\n  return 1;\n};\n\nconst calculateFieldComplexity = (\n  schema: GraphQLSchema,\n  fieldNode: FieldNode,\n  parentType: GraphQLNamedTypeLike,\n  fragments: ReadonlyMap<string, FragmentDefinitionNode>,\n  costMap: CostMap,\n  activeFragments: Set<string>\n): number => {\n  const fieldName = fieldNode.name.value;\n  const field = getField(parentType, fieldName);\n  const baseCost = getCostMapValue(costMap, parentType, fieldName);\n  const namedFieldType = unwrapNamedType(field?.type);\n  const childCost =\n    fieldNode.selectionSet && namedFieldType\n      ? calculateSelectionSetComplexity(\n          schema,\n          fieldNode.selectionSet,\n          namedFieldType,\n          fragments,\n          costMap,\n          activeFragments\n        )\n      : 0;\n  return (baseCost + childCost) * listMultiplierFromArgs(fieldNode.arguments);\n};\n\nconst calculateSelectionSetComplexity = (\n  schema: GraphQLSchema,\n  selectionSet: SelectionSetNode,\n  parentType: GraphQLNamedTypeLike,\n  fragments: ReadonlyMap<string, FragmentDefinitionNode>,\n  costMap: CostMap,\n  activeFragments: Set<string>\n): number => {\n  let total = 0;\n\n  for (const selection of selectionSet.selections) {\n    total += calculateSelectionComplexity(schema, selection, parentType, fragments, costMap, activeFragments);\n  }\n\n  return total;\n};\n\nconst calculateSelectionComplexity = (\n  schema: GraphQLSchema,\n  selection: SelectionNode,\n  parentType: GraphQLNamedTypeLike,\n  fragments: ReadonlyMap<string, FragmentDefinitionNode>,\n  costMap: CostMap,\n  activeFragments: Set<string>\n): number => {\n  if (selection.kind === Kind.FIELD) {\n    return calculateFieldComplexity(schema, selection, parentType, fragments, costMap, activeFragments);\n  }\n\n  if (selection.kind === Kind.INLINE_FRAGMENT) {\n    const fragmentParent = selection.typeCondition\n      ? (getTypeByName(schema, selection.typeCondition.name.value) ?? parentType)\n      : parentType;\n    return calculateSelectionSetComplexity(\n      schema,\n      selection.selectionSet,\n      fragmentParent,\n      fragments,\n      costMap,\n      activeFragments\n    );\n  }\n\n  const fragmentName = selection.name.value;\n  if (activeFragments.has(fragmentName)) return 0;\n  const fragment = fragments.get(fragmentName);\n  if (!fragment) return 0;\n\n  activeFragments.add(fragmentName);\n  const fragmentParent = getTypeByName(schema, fragment.typeCondition.name.value) ?? parentType;\n  const complexity = calculateSelectionSetComplexity(\n    schema,\n    fragment.selectionSet,\n    fragmentParent,\n    fragments,\n    costMap,\n    activeFragments\n  );\n  activeFragments.delete(fragmentName);\n  return complexity;\n};\n\nconst calculateDocumentComplexity = (\n  schema: GraphQLSchema,\n  documentAST: { definitions: readonly unknown[] },\n  costMap: CostMap\n): number => {\n  const fragments = new Map<string, FragmentDefinitionNode>();\n  const operations: OperationDefinitionNode[] = [];\n\n  for (const definition of documentAST.definitions) {\n    if (!isRecord(definition) || typeof definition['kind'] !== 'string') continue;\n    if (definition['kind'] === Kind.FRAGMENT_DEFINITION) {\n      const fragment = definition as unknown as FragmentDefinitionNode;\n      fragments.set(fragment.name.value, fragment);\n    } else if (definition['kind'] === Kind.OPERATION_DEFINITION) {\n      operations.push(definition as unknown as OperationDefinitionNode);\n    }\n  }\n\n  let maxComplexity = 0;\n  for (const operation of operations) {\n    const rootType = getOperationRootType(schema, operation);\n    if (!rootType) continue;\n    const complexity = calculateSelectionSetComplexity(\n      schema,\n      operation.selectionSet,\n      rootType,\n      fragments,\n      costMap,\n      new Set<string>()\n    );\n    maxComplexity = Math.max(maxComplexity, complexity);\n  }\n\n  return maxComplexity;\n};\n\nconst logComplexityFailure = (error: Error): void => {\n  const seen = complexityFailureMessages.has(error.message);\n  if (!seen && complexityFailureMessages.size < MAX_FAILURE_LOG_VARIANTS) {\n    complexityFailureMessages.add(error.message);\n    logger.warn('[gateway-security] complexity scoring failed — fail-open', {\n      error: error.message,\n      suppressedRepeats: true,\n    });\n    return;\n  }\n\n  logger.debug('[gateway-security] repeated complexity scoring failure suppressed', {\n    error: error.message,\n  });\n};\n\nexport interface QueryComplexityPluginDeps {\n  config: QueryComplexityConfig;\n}\n\nexport const createQueryComplexityPlugin = (deps: QueryComplexityPluginDeps): Plugin => {\n  return {\n    onValidate: ({ params, setResult }) => {\n      try {\n        const complexity = calculateDocumentComplexity(params.schema, params.documentAST, deps.config.costMap);\n\n        if (complexity > deps.config.maxCost) {\n          getMetrics().complexityRejected.inc({\n            gateway: 'unknown',\n            observe: deps.config.observe ? 'true' : 'false',\n          });\n          if (deps.config.observe) {\n            logger.info('[gateway-security] complexity would_reject (observe)', {\n              complexity,\n              maxCost: deps.config.maxCost,\n            });\n            return;\n          }\n          setResult([\n            new GraphQLError(`Query too expensive (cost ${complexity} > limit ${deps.config.maxCost})`, {\n              extensions: {\n                code: 'COMPLEXITY_TOO_HIGH',\n                cost: complexity,\n                maxCost: deps.config.maxCost,\n              },\n            }),\n          ]);\n        }\n      } catch (err) {\n        const e = err instanceof Error ? err : new Error(String(err));\n        logComplexityFailure(e);\n      }\n    },\n  };\n};\n","/**\n * Rate-Limit Plugin\n *\n * Per-actor token-bucket rate limiter backed by Valkey. Tier classification\n * from ActorContext. Increments a counter with a window-scoped TTL and\n * rejects when the bucket is exhausted. Emits rate-limit response headers\n * on every request (X-RateLimit-Limit / Remaining / Reset).\n *\n * Failure policy: **fail open** by default (availability > strictness during\n * Valkey outages). Flip with `failClosed: true`.\n *\n * Observe mode: when `observeOnly: true`, counts and logs but never rejects.\n * Used during the 48h bake of this hardening pass.\n *\n * @module gateway/security/plugins/rate-limit\n * @category Gateway\n */\n\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport { resolveActor } from '../actor.js';\nimport { getMetrics } from '../metrics.js';\nimport type { ActorContext, RateLimitConfig, RateLimitResult, SecurityValkeyClient } from '../types.js';\n\nexport interface RateLimitPluginDeps {\n  valkey: SecurityValkeyClient;\n  config: RateLimitConfig;\n}\n\nconst keyFor = (prefix: string, tier: string, identity: string): string => `rl:${prefix}:${tier}:${identity}`;\n\nconst stamp = (): number => Date.now();\n\n/**\n * Atomic-ish INCR + EXPIRE. Valkey does not guarantee atomicity between the\n * two without a Lua script; the race window here loses at most 1 event per\n * window-start collision, which is acceptable for a limiter and avoids the\n * Lua script registration dance.\n */\nexport const checkRateLimit = async (deps: RateLimitPluginDeps, actor: ActorContext): Promise<RateLimitResult> => {\n  const tier = deps.config.tiers[actor.tier];\n  const metrics = getMetrics();\n  const gateway = deps.config.keyPrefix;\n  // Super admin passes through.\n  if (tier.points === Number.MAX_SAFE_INTEGER) {\n    metrics.rateLimit.inc({ gateway, tier: actor.tier, decision: 'allowed' });\n    return { allowed: true, remaining: Number.MAX_SAFE_INTEGER, resetAtMs: 0, limit: tier.points };\n  }\n\n  const key = keyFor(deps.config.keyPrefix, actor.tier, actor.identity);\n  const limit = tier.points + tier.burst;\n\n  try {\n    const count = await deps.valkey.incrBy(key, 1);\n    if (count === 1) {\n      await deps.valkey.expire(key, tier.duration);\n    }\n    const ttl = await deps.valkey.ttl(key);\n    const resetAtMs = stamp() + Math.max(0, ttl) * 1000;\n\n    if (count > limit) {\n      metrics.rateLimit.inc({\n        gateway,\n        tier: actor.tier,\n        decision: deps.config.observeOnly ? 'observed_reject' : 'rejected',\n      });\n      return { allowed: false, remaining: 0, resetAtMs, limit };\n    }\n    metrics.rateLimit.inc({ gateway, tier: actor.tier, decision: 'allowed' });\n    return { allowed: true, remaining: Math.max(0, limit - count), resetAtMs, limit };\n  } catch (err) {\n    const e = err instanceof Error ? err : new Error(String(err));\n    logger.warn('[gateway-security] rate-limit valkey error — fail-open', {\n      key,\n      error: e.message,\n    });\n    metrics.valkeyFailover.inc({ gateway });\n    if (deps.config.failClosed) {\n      metrics.rateLimit.inc({ gateway, tier: actor.tier, decision: 'rejected' });\n      return { allowed: false, remaining: 0, resetAtMs: stamp() + tier.duration * 1000, limit };\n    }\n    metrics.rateLimit.inc({ gateway, tier: actor.tier, decision: 'allowed' });\n    return { allowed: true, remaining: -1, resetAtMs: 0, limit };\n  }\n};\n\n/**\n * Yoga/Envelop plugin factory.\n */\nexport const createRateLimitPlugin = (deps: RateLimitPluginDeps): Plugin => {\n  return {\n    onRequest: async ({ request, fetchAPI, endResponse }): Promise<void> => {\n      const actor = resolveActor((name) => request.headers.get(name));\n      const result = await checkRateLimit(deps, actor);\n\n      // Headers are set via onResponse (below). Stash the result on the request\n      // so onResponse can read it without re-running the Valkey call.\n      (request as unknown as { __rateLimitResult: RateLimitResult; __rateLimitActor: ActorContext }).__rateLimitResult =\n        result;\n      (request as unknown as { __rateLimitResult: RateLimitResult; __rateLimitActor: ActorContext }).__rateLimitActor =\n        actor;\n\n      if (!result.allowed) {\n        if (deps.config.observeOnly) {\n          logger.info('[gateway-security] rate-limit would_reject (observe)', {\n            tier: actor.tier,\n            identity: actor.identity,\n            limit: result.limit,\n          });\n          return;\n        }\n        const retryAfterS = Math.max(1, Math.ceil((result.resetAtMs - stamp()) / 1000));\n        const body = JSON.stringify({\n          errors: [\n            {\n              message: 'Rate limit exceeded',\n              extensions: {\n                code: 'RATE_LIMITED',\n                resetAt: new Date(result.resetAtMs).toISOString(),\n              },\n            },\n          ],\n        });\n        const response = new fetchAPI.Response(body, {\n          status: 429,\n          headers: {\n            'content-type': 'application/json',\n            'retry-after': String(retryAfterS),\n            'x-ratelimit-limit': String(result.limit),\n            'x-ratelimit-remaining': '0',\n            'x-ratelimit-reset': String(Math.floor(result.resetAtMs / 1000)),\n          },\n        });\n        endResponse(response);\n      }\n    },\n    onResponse: ({ request, response }): void => {\n      const stash = (request as unknown as { __rateLimitResult?: RateLimitResult }).__rateLimitResult;\n      if (!stash) return;\n      response.headers.set('x-ratelimit-limit', String(stash.limit));\n      response.headers.set('x-ratelimit-remaining', String(Math.max(0, stash.remaining)));\n      if (stash.resetAtMs > 0) {\n        response.headers.set('x-ratelimit-reset', String(Math.floor(stash.resetAtMs / 1000)));\n      }\n    },\n  };\n};\n","/**\n * Gateway Security Plugin Orchestrator\n *\n * Builds the ordered Yoga/Envelop plugin array consumed by each public\n * gateway via `createGatewayRuntime({ plugins: [...] })`.\n *\n * Order (cheapest rejection first, span wrapping everything):\n *   otel spans → armor (6 sub-plugins) → query-complexity → rate-limit → timeout\n *\n * @module gateway/security/plugins\n * @category Gateway\n */\n\nimport type { Plugin } from 'graphql-yoga';\n\nimport { logger } from '../../../logger/index.js';\nimport { initializeMetrics } from '../metrics.js';\nimport type { GatewaySecurityOptions } from '../types.js';\nimport { initializeSecurityValkey } from '../valkey.js';\nimport { createArmorPlugins } from './armor.js';\nimport { createOperationTimeoutPlugin } from './operation-timeout.js';\nimport { createOtelPlugin } from './otel.js';\nimport { createQueryComplexityPlugin } from './query-complexity.js';\nimport { createRateLimitPlugin } from './rate-limit.js';\n\n/**\n * Bootstraps Valkey + OTel side effects and returns the ordered plugin list.\n * Safe to call once at gateway boot; subsequent calls reuse the initialized\n * singletons.\n *\n * If `options.enabled === false`, returns an empty array — the master kill\n * switch for instant rollback via env flag.\n */\nexport const buildSecurityPlugins = async (options: GatewaySecurityOptions): Promise<Plugin[]> => {\n  if (!options.enabled) {\n    logger.warn('[gateway-security] SECURITY_PLUGINS_ENABLED=false — plugins disabled', {\n      gatewayName: options.gatewayName,\n    });\n    return [];\n  }\n\n  // Side-effect init (both are idempotent). OTel exporter bootstrap belongs to\n  // `bootstrapTelemetry()`; this stack only wires Envelop span hooks.\n  await initializeMetrics();\n  const valkey = await initializeSecurityValkey(options.gatewayName);\n\n  const plugins: Plugin[] = [];\n\n  const otelPlugin = await createOtelPlugin(options.otel);\n  plugins.push(otelPlugin);\n\n  const armorPlugins = await createArmorPlugins(options.armor);\n  plugins.push(...armorPlugins);\n\n  if (options.queryComplexity.enabled) {\n    plugins.push(createQueryComplexityPlugin({ config: options.queryComplexity }));\n  }\n  plugins.push(createRateLimitPlugin({ valkey, config: options.rateLimit }));\n  plugins.push(createOperationTimeoutPlugin({ config: options.operationTimeout }));\n\n  logger.info('[gateway-security] plugins wired', {\n    gatewayName: options.gatewayName,\n    count: plugins.length,\n    observe: {\n      armor: options.armor.observe,\n      complexity: options.queryComplexity.observe,\n      rateLimit: options.rateLimit.observeOnly,\n    },\n    enabled: {\n      complexity: options.queryComplexity.enabled,\n    },\n  });\n\n  return plugins;\n};\n\nexport { createArmorPlugins } from './armor.js';\nexport { createOperationTimeoutPlugin } from './operation-timeout.js';\nexport { createOtelPlugin, initializeOtel, shutdownOtel } from './otel.js';\nexport { createQueryComplexityPlugin } from './query-complexity.js';\nexport { checkRateLimit, createRateLimitPlugin } from './rate-limit.js';\n"]}