@burdenoff/be-sdk 2026.527.3 → 2026.528.2

package/dist/server/index.js

@@ -1,4 +1,5 @@
-export { createWorkspaceGuardPlugin } from '../chunk-BTQREMD4.js';
+import { createHumanReadableErrorPlugin, formatHttpError, createHttpErrorResponse } from '../chunk-XUU5IBVU.js';
+export { UserFacingGraphQLError, createHttpErrorResponse, createHumanReadableErrorPlugin, createWorkspaceGuardPlugin, formatHttpError, normalizeError, normalizeExecutionResultErrors, toUserFacingGraphQLError } from '../chunk-XUU5IBVU.js';
 import { setWorkspaceContext } from '../chunk-GTEMQXCA.js';
 import { I18n } from '../chunk-ULFFX3YE.js';
 import { logger } from '../chunk-CBZNP6RF.js';
@@ -472,7 +473,7 @@ async function createServer(definition) {
   const { initializeDatabase, getDb: getDb2, getDatabaseManager } = await import('../prisma/index.js');
   const { createSecurityPlugin } = await import('../middleware/index.js');
   const { createMetricsPlugin } = await import('../observability/index.js');
-  const { createWorkspaceGuardPlugin: createWorkspaceGuardPlugin2 } = await import('../workspace-guard-524GBJQ6.js');
+  const { createWorkspaceGuardPlugin: createWorkspaceGuardPlugin2 } = await import('../workspace-guard-3TKZULCO.js');
   logger.info(`[Server] Initializing ${config.serviceName}...`);
   const boundary = config.boundary ?? (config.serviceName.startsWith("wspace-") ? "wspace" : config.serviceName.startsWith("global-") ? "global" : "wspace");
   const shouldEnableWorkspaceExtension = disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === "wspace";
@@ -547,6 +548,10 @@ async function createServer(definition) {
       error: /* @__PURE__ */ __name((...args) => logger.error("[GraphQL]", ...args), "error")
     },
     plugins: [
+      createHumanReadableErrorPlugin({
+        serviceName: config.serviceName,
+        environment: config.environment
+      }),
       ...workspaceGuardPlugins,
       responseHeadersPlugin,
       ...yogaPlugins || []
@@ -681,10 +686,12 @@ async function createServer(definition) {
       } catch (error) {
         logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);
         const corsHeaders2 = buildCorsHeaders();
-        return new Response(JSON.stringify({
-          error: error instanceof Error ? error.message : "Internal server error"
-        }), {
-          status: 500,
+        const formatted = formatHttpError(error, {
+          serviceName: config.serviceName,
+          environment: config.environment
+        });
+        return new Response(JSON.stringify(formatted.body), {
+          status: formatted.status,
           headers: {
             "Content-Type": "application/json",
             ...corsHeaders2
@@ -813,8 +820,16 @@ async function createServer(definition) {
         continue;
       }
       const handler = /* @__PURE__ */ __name(async ({ request }) => {
-        const context = await buildContext(request);
-        return endpoint.handler(request, context);
+        try {
+          const context = await buildContext(request);
+          return await endpoint.handler(request, context);
+        } catch (error) {
+          logger.error(`[Server] REST endpoint error (${endpoint.path}):`, error);
+          return createHttpErrorResponse(error, {
+            serviceName: config.serviceName,
+            environment: config.environment
+          });
+        }
       }, "handler");
       switch (endpoint.method) {
         case "GET":

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/auth.ts","../../src/server/context.ts","../../src/server/security.ts","../../src/server/server.ts"],"names":["getDbFn","getDb","prismaModule","joseModule","jwtModule","getJose","getJwt","jwt","default","authConfig","configureAuth","config","logger","debug","fetchWorkspaceSecret","workspaceId","db","workspace","client","findUnique","where","id","jwtSecret","JSON","parse","stringify","error","warn","configureDefaultAuth","generateSymmetricSecret","joseLib","secret","generateSecret","jwk","exportJWK","verifyJWT","token","options","decoded","decode","complete","payload","verifiedJwt","verify","mapPayloadToActor","decodedJwt","decodeJwt","workspace_id","workspaceSecret","keyLikeSecret","importJWK","jwtVerify","err","decodeJWT","sub","type","actor_type","tenant_id","org_id","isAdmin","authCheck","actor","Error","workspaceCheck","context","actorId","requireWorkspace","orgCheck","organization","orgId","tenantCheck","tenant","contextOptions","configureContext","getHeader","request","key","headers","get","toLowerCase","undefined","compareSecret","provided","expected","providedBuffer","Buffer","from","expectedBuffer","length","crypto","timingSafeEqual","shouldTrustActorHeaders","nodeEnv","process","env","expectedGatewayToken","providedGatewayToken","extractTracking","forwardedFor","realIp","ip","split","trim","userAgent","extractActor","actorType","userRole","authHeader","startsWith","substring","extractTenant","tenantId","tenantEndpoint","endpoint","defaultTenant","extractOrganization","extractWorkspace","extractProject","projectId","extractProduct","productId","extractGeography","country","currency","timezone","toUpperCase","extractConsentContext","grantedBy","scopesHeader","grantedAtHeader","expiresAtHeader","scopes","map","s","grantedAt","Date","expiresAt","buildContext","project","product","tracking","consentContext","i18n","createContextFromRequest","geo","locale","language","t","tp","formatNumber","value","String","formatCurrency","formatDate","date","formatRelativeTime","unit","onBehalfOf","wsCtxPayload","organizationId","rawHeader","setWorkspaceContext","responseHeaders","Headers","getContextOptions","LOCALHOST_ORIGINS","normalizeCorsOrigins","origins","environment","normalized","Array","isArray","origin","filter","Boolean","includes","resolveAllowedCorsOrigin","requestOrigin","allowedOrigins","canAccessGraphExport","serverStartTime","createServer","definition","prismaClient","schema","moduleGraph","restEndpoints","yogaPlugins","customBuildContext","workspaceExtensionConfig","disableWorkspaceExtension","onShutdown","Elysia","BunAdapter","cors","createYoga","initializeDatabase","getDatabaseManager","createSecurityPlugin","createMetricsPlugin","createWorkspaceGuardPlugin","info","serviceName","boundary","shouldEnableWorkspaceExtension","workspaceExtension","connect","registerShutdownHandlers","enableWorkspaceExtension","i18nInstance","enabled","localesPath","I18n","defaultLocale","fallbackLocale","supportedLocales","namespace","lazyLoad","logMissing","enableCache","returnKeyOnMissing","initialize","getSupportedLocales","join","isDev","enablePlayground","workspaceGuardEnabled","workspaceGuard","workspaceGuardPlugins","whitelistedOperations","graphqlEndpoint","responseHeadersPlugin","onResponse","response","serverContext","yogaContext","forEach","append","yoga","graphiql","logging","args","plugins","defaultContext","app","adapter","corsOrigins","use","credentials","allowedHeaders","methods","rawBodyEndpoints","ep","rawBody","rawBodyPaths","Map","path","rawBodyMatchers","regexPattern","replace","regex","RegExp","matchRawBodyEndpoint","pathname","exactMatch","isMatch","test","onRequest","url","URL","method","isHealthRoute","buildCorsHeaders","allowedOrigin","rawBodyEndpoint","corsHeaders","Response","status","text","result","handler","Object","entries","set","body","statusText","message","promClientMod","prom","collectDefaultMetrics","register","metrics","contentType","yogaRoutes","shouldHandleByYoga","yogaResponse","fetch","csrfSkipRoutes","loginEndpoints","enableCSRF","enableSessionSecurity","healthResponse","service","version","serviceVersion","timestamp","toISOString","getSchema","query","exportAll","types","entityTypes","exportEntities","exportRelationships","post","put","patch","delete","host","port","serverInstance","server","start","listen","hostname","elysiaApp","stop","shutdown","disconnect","getInfo","uptime","Math","floor","now","getTime","startedAt","gracefulShutdown","signal","exit","on","configureServerAuth"],"mappings":";;;;;;;;AA4BA,IAAIA,OAAAA,GAAmC,IAAA;AAEvC,eAAeC,KAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,IAAA,MAAME,YAAAA,GAAe,MAAM,OAAO,oBAAA,CAAA;AAElCF,IAAAA,OAAAA,GAAUE,YAAAA,CAAaD,KAAAA;AACzB,EAAA;AACA,EAAA,OAAOD,OAAAA,EAAAA;AACT;AAPeC,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAgBf,IAAIE,UAAAA,GAAiC,IAAA;AACrC,IAAIC,SAAAA,GAA8B,IAAA;AAElC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeE,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOf,eAAeC,MAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,SAAAA,EAAW;AACd,IAAA,MAAMG,GAAAA,GAAM,MAAM,OAAO,cAAA,CAAA;AAEzBH,IAAAA,SAAAA,GAAaG,IAAgCC,OAAAA,IAAWD,GAAAA;AAC1D,EAAA;AACA,EAAA,OAAOH,SAAAA;AACT;AAPeE,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAsBf,IAAIG,UAAAA,GAAgC,IAAA;AAK7B,SAASC,cAAcC,MAAAA,EAAkB;AAC9CF,EAAAA,UAAAA,GAAaE,MAAAA;AACbC,EAAAA,MAAAA,CAAOC,MAAM,8BAAA,CAAA;AACf;AAHgBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAchB,eAAsBI,qBAAqBC,WAAAA,EAAmB;AAC5D,EAAA,IAAI;AACF,IAAA,MAAMC,EAAAA,GAAK,MAAMf,KAAAA,EAAAA;AACjB,IAAA,MAAMgB,SAAAA,GAAY,MAAMD,EAAAA,CAAGE,MAAAA,CAAOD,UAAUE,UAAAA,CAAW;MACrDC,KAAAA,EAAO;QAAEC,EAAAA,EAAIN;AAAY;KAC3B,CAAA;AAEA,IAAA,IAAI,CAACE,WAAWK,SAAAA,EAAW;AACzBV,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;AAAEE,QAAAA;OAAY,CAAA;AAC7E,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOQ,KAAKC,KAAAA,CAAMD,IAAAA,CAAKE,SAAAA,CAAUR,SAAAA,CAAUK,SAAS,CAAA,CAAA;AACtD,EAAA,CAAA,CAAA,OAASI,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,KAAK,8CAAA,EAAgD;AAAEZ,MAAAA,WAAAA;AAAaW,MAAAA;KAAM,CAAA;AACjF,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAjBsBZ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwBf,SAASc,oBAAAA,GAAAA;AACd,EAAA,IAAI,CAACnB,UAAAA,EAAY;AACfC,IAAAA,aAAAA,CAAc;AAAEI,MAAAA;KAAqB,CAAA;AACrCF,IAAAA,MAAAA,CAAOC,MAAM,6EAAA,CAAA;AACf,EAAA;AACF;AALgBe,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWhB,eAAsBC,uBAAAA,GAAAA;AACpB,EAAA,MAAMC,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,EAAA,MAAM0B,MAAAA,GAAS,MAAMD,OAAAA,CAAQE,cAAAA,CAAe,OAAA,CAAA;AAC5C,EAAA,MAAMC,GAAAA,GAAM,MAAMH,OAAAA,CAAQI,SAAAA,CAAUH,MAAAA,CAAAA;AACpC,EAAA,OAAOE,GAAAA;AACT;AALsBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAetB,eAAsBM,SAAAA,CAAUC,KAAAA,EAAeL,MAAAA,EAAiBM,OAAAA,GAAyB,EAAC,EAAC;AACzF,EAAA,IAAI;AACF,IAAA,MAAM9B,GAAAA,GAAM,MAAMD,MAAAA,EAAAA;AAClB,IAAA,MAAMwB,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AAGtB,IAAA,MAAMiC,OAAAA,GAAU/B,GAAAA,CAAIgC,MAAAA,CAAOH,KAAAA,EAAO;MAAEI,QAAAA,EAAU;KAAK,CAAA;AAEnD,IAAA,IAAI,CAACF,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,IAAY,CAACA,OAAAA,CAAQG,OAAAA,IAAW,OAAOH,OAAAA,CAAQG,OAAAA,KAAY,QAAA,EAAU;AACtG7B,MAAAA,MAAAA,CAAOe,KAAK,mCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,IAAII,MAAAA,EAAQ;AAEV,MAAA,MAAMW,YAAAA,GAAcnC,GAAAA,CAAIoC,MAAAA,CAAOP,KAAAA,EAAOL,QAAQM,OAAAA,CAAAA;AAC9C,MAAA,OAAOO,kBAAkBF,YAAAA,CAAAA;AAC3B,IAAA;AAGA,IAAA,MAAMG,UAAAA,GAAaf,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;AACrC,IAAA,IAAI,CAACS,WAAWE,YAAAA,EAAc;AAC5BnC,MAAAA,MAAAA,CAAOe,KAAK,6CAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAAClB,YAAYK,oBAAAA,EAAsB;AACrCF,MAAAA,MAAAA,CAAOc,MAAM,+DAAA,CAAA;AACb,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,eAAAA,GAAkB,MAAMvC,UAAAA,CAAWK,oBAAAA,CAAqB+B,WAAWE,YAAY,CAAA;AACrF,IAAA,IAAI,CAACC,eAAAA,EAAiB;AACpBpC,MAAAA,MAAAA,CAAOe,KAAK,yCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,aAAAA,GAAgB,MAAMnB,OAAAA,CAAQoB,SAAAA,CAAUF,iBAAiB,OAAA,CAAA;AAC/D,IAAA,MAAMN,cAAc,MAAMZ,OAAAA,CAAQqB,SAAAA,CAAUf,KAAAA,EAAOa,eAAeZ,OAAAA,CAAAA;AAClE,IAAA,OAAOO,iBAAAA,CAAkBF,YAAYD,OAAO,CAAA;AAC9C,EAAA,CAAA,CAAA,OAASW,GAAAA,EAAK;AACZxC,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,qCAAqCyB,GAAAA,CAAAA;AACjD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA7CsBjB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkDtB,eAAsBkB,UAAUjB,KAAAA,EAAa;AAC3C,EAAA,IAAI;AACF,IAAA,MAAMN,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,IAAA,OAAO,MAAMyB,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAPsBiB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAYtB,SAAST,kBAAkBH,OAAAA,EAAmB;AAC5C,EAAA,OAAO;AACLpB,IAAAA,EAAAA,EAAIoB,OAAAA,CAAQa,GAAAA;AACZC,IAAAA,IAAAA,EAAMd,QAAQe,UAAAA,IAAc,MAAA;AAC5BT,IAAAA,YAAAA,EAAcN,OAAAA,CAAQM,YAAAA;AACtBU,IAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBC,IAAAA,MAAAA,EAAQjB,OAAAA,CAAQiB,MAAAA;AAChBC,IAAAA,OAAAA,EAASlB,QAAQ,SAAA;AACnB,GAAA;AACF;AATSG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAcF,SAASgB,UAAUC,KAAAA,EAAoB;AAC5C,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,MAAM,IAAIC,MAAM,gBAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOD,KAAAA;AACT;AALgBD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAUT,SAASG,eAAeC,OAAAA,EAAmE;AAIhG,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfN,IAAAA,WAAAA,EAAaiD,QAAQ/C,SAAAA,CAAUI;AACjC,GAAA;AACF;AAdgB0C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,SAASG,iBACdF,OAAAA,EAAU;AAGVJ,EAAAA,SAAAA,CAAUI,QAAQH,KAAK,CAAA;AAEvB,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAGA,EAAA,OAAOE,OAAAA;AACT;AAZgBE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,SAASC,SAASH,OAAAA,EAAsE;AAI7F,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQI,YAAAA,EAAc/C,EAAAA,EAAI;AAC7B,IAAA,MAAM,IAAIyC,MAAM,kCAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfgD,IAAAA,KAAAA,EAAOL,QAAQI,YAAAA,CAAa/C;AAC9B,GAAA;AACF;AAdgB8C,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAmBT,SAASG,YAAYN,OAAAA,EAA0C;AACpE,EAAA,IAAI,CAACA,OAAAA,CAAQO,MAAAA,EAAQlD,EAAAA,EAAI;AACvB,IAAA,MAAM,IAAIyC,MAAM,4BAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOE,QAAQO,MAAAA,CAAOlD,EAAAA;AACxB;AALgBiD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;ACvQhB,IAAIE,cAAAA,GAA+C,IAAA;AAK5C,SAASC,iBAAiBpC,OAAAA,EAA8B;AAC7DmC,EAAAA,cAAAA,GAAiBnC,OAAAA;AACjBzB,EAAAA,MAAAA,CAAOC,MAAM,4CAAA,CAAA;AACf;AAHgB4D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAQhB,SAASC,SAAAA,CAAUC,SAAkBC,GAAAA,EAAW;AAC9C,EAAA,OAAOD,QAAQE,OAAAA,CAAQC,GAAAA,CAAIF,GAAAA,CAAIG,WAAAA,EAAW,CAAA,IAAOC,MAAAA;AACnD;AAFSN,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAIT,SAASO,aAAAA,CAAcC,UAAkBC,QAAAA,EAAgB;AACvD,EAAA,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAAA,CAAKJ,QAAAA,CAAAA;AACnC,EAAA,MAAMK,cAAAA,GAAiBF,MAAAA,CAAOC,IAAAA,CAAKH,QAAAA,CAAAA;AAEnC,EAAA,IAAIC,cAAAA,CAAeI,MAAAA,KAAWD,cAAAA,CAAeC,MAAAA,EAAQ;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOC,MAAAA,CAAOC,eAAAA,CAAgBN,cAAAA,EAAgBG,cAAAA,CAAAA;AAChD;AATSN,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWF,SAASU,uBAAAA,CACdhB,OAAAA,EACAiB,OAAAA,GAA8BC,OAAAA,CAAQC,IAAI,UAAA,CAAA,EAC1CC,oBAAAA,GAA2CF,OAAAA,CAAQC,IAAI,uBAAA,CAAA,IACrDD,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEvC,EAAA,IAAI,CAACpB,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA,EAAe;AACrC,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIiB,YAAY,YAAA,EAAc;AAC5B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMI,uBACJtB,SAAAA,CAAUC,OAAAA,EAAS,0BAAA,CAAA,IAA+BD,SAAAA,CAAUC,SAAS,sBAAA,CAAA;AACvE,EAAA,IAAI,CAACoB,oBAAAA,IAAwB,CAACC,oBAAAA,EAAsB;AAClD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOf,aAAAA,CAAce,sBAAsBD,oBAAAA,CAAAA;AAC7C;AArBgBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA0BhB,SAASM,gBAAgBtB,OAAAA,EAAgB;AAEvC,EAAA,MAAMuB,YAAAA,GAAexB,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMwB,MAAAA,GAASzB,SAAAA,CAAUC,OAAAA,EAAS,WAAA,CAAA;AAClC,EAAA,MAAMyB,EAAAA,GAAKF,cAAcG,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,IAAAA,EAAAA,IAAUH,MAAAA,IAAUnB,MAAAA;AAE5D,EAAA,OAAO;AACLoB,IAAAA,EAAAA;IACAG,SAAAA,EAAW7B,SAAAA,CAAUC,SAAS,YAAA;AAChC,GAAA;AACF;AAVSsB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAwBT,eAAeO,aAAa7B,OAAAA,EAAgB;AAE1C,EAAA,MAAMV,OAAAA,GAAUS,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAIV,OAAAA,IAAW0B,uBAAAA,CAAwBhB,OAAAA,CAAAA,EAAU;AAG/C/D,IAAAA,MAAAA,CAAOC,MAAM,gEAAA,CAAA;AAEb,IAAA,MAAM4F,SAAAA,GAAY/B,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA,IAAmB,MAAA;AACxD,IAAA,MAAM+B,QAAAA,GAAWhC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AAEpC,IAAA,OAAO;MACLtD,EAAAA,EAAI4C,OAAAA;MACJV,IAAAA,EAAMkD,SAAAA;MACN1D,YAAAA,EAAc2B,SAAAA,CAAUC,SAAS,gBAAA,CAAA;MACjClB,SAAAA,EAAWiB,SAAAA,CAAUC,SAAS,aAAA,CAAA;AAC9BjB,MAAAA,MAAAA,EAAQgB,UAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAC7DhB,MAAAA,OAAAA,EACE8C,cAAc,aAAA,IACdC,QAAAA,KAAa,cAAA,IACbA,QAAAA,KAAa,iBACbA,QAAAA,KAAa;AACjB,KAAA;AACF,EAAA;AAEA,EAAA,IAAIzC,OAAAA,EAAS;AACXrD,IAAAA,MAAAA,CAAOe,KAAK,uFAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAMgF,UAAAA,GAAajC,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AAEtC,EAAA,IAAI,CAACgC,UAAAA,EAAYC,UAAAA,CAAW,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMxE,KAAAA,GAAQuE,UAAAA,CAAWE,SAAAA,CAAU,CAAA,CAAA;AAEnC,EAAA,IAAI;AACFjG,IAAAA,MAAAA,CAAOC,MAAM,iFAAA,CAAA;AACb,IAAA,MAAM4B,OAAAA,GAAU,MAAMN,SAAAA,CAAUC,KAAAA,CAAAA;AAEhC,IAAA,IAAI,CAACK,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLpB,MAAAA,EAAAA,EAAIoB,OAAAA,CAAQpB,EAAAA;MACZkC,IAAAA,EAAM,MAAA;AACNR,MAAAA,YAAAA,EAAcN,OAAAA,CAAQM;AACxB,KAAA;AACF,EAAA,CAAA,CAAA,OAASrB,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,sCAAsCD,KAAAA,CAAAA;AAClD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAzDe8E,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA8Df,SAASM,cAAcnC,OAAAA,EAAgB;AAErC,EAAA,MAAMoC,QAAAA,GAAWrC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AACpC,EAAA,MAAMqC,cAAAA,GAAiBtC,SAAAA,CAAUC,OAAAA,EAAS,mBAAA,CAAA;AAE1C,EAAA,IAAIoC,QAAAA,EAAU;AACZ,IAAA,OAAO;MACL1F,EAAAA,EAAI0F,QAAAA;AACJE,MAAAA,QAAAA,EAAUD,cAAAA,IAAkB;AAC9B,KAAA;AACF,EAAA;AAGA,EAAA,OAAOxC,gBAAgB0C,aAAAA,IAAiB,IAAA;AAC1C;AAdSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASK,oBAAoBxC,OAAAA,EAAgB;AAC3C,EAAA,MAAMN,QAAQK,SAAAA,CAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAEnE,EAAA,IAAIN,KAAAA,EAAO;AACT,IAAA,OAAO;MAAEhD,EAAAA,EAAIgD;AAAM,KAAA;AACrB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARS8C,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASC,gBAAAA,CAAiBzC,SAAkBd,KAAAA,EAAoB;AAE9D,EAAA,MAAM9C,WAAAA,GAAc2D,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEvC,EAAA,IAAI5D,WAAAA,EAAa;AACf,IAAA,OAAO;MAAEM,EAAAA,EAAIN;AAAY,KAAA;AAC3B,EAAA;AAGA,EAAA,IAAI8C,OAAOd,YAAAA,EAAc;AACvB,IAAA,OAAO;AAAE1B,MAAAA,EAAAA,EAAIwC,KAAAA,CAAMd;AAAa,KAAA;AAClC,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAdSqE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAmBT,SAASC,eAAe1C,OAAAA,EAAgB;AACtC,EAAA,MAAM2C,SAAAA,GAAY5C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI2C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEjG,EAAAA,EAAIiG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaT,SAASE,eAAe5C,OAAAA,EAAgB;AACtC,EAAA,MAAM6C,SAAAA,GAAY9C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI6C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEnG,EAAAA,EAAImG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASE,iBAAiB9C,OAAAA,EAAgB;AACxC,EAAA,MAAM+C,OAAAA,GAAUhD,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACnC,EAAA,MAAMgD,QAAAA,GAAWjD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AACpC,EAAA,MAAMiD,QAAAA,GAAWlD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEpC,EAAA,OAAO;IACL+C,OAAAA,EAASA,OAAAA,EAASG,aAAAA,IAAiB7C,MAAAA;IACnC2C,QAAAA,EAAUA,QAAAA,EAAUE,aAAAA,IAAiB7C,MAAAA;AACrC4C,IAAAA,QAAAA,EAAUA,QAAAA,IAAY5C;AACxB,GAAA;AACF;AAVSyC,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAwBT,SAASK,sBAAsBnD,OAAAA,EAAgB;AAC7C,EAAA,MAAMoD,SAAAA,GAAYrD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAGrC,EAAA,IAAI,CAACoD,SAAAA,EAAW;AACd,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMC,YAAAA,GAAetD,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMsD,eAAAA,GAAkBvD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAC3C,EAAA,MAAMuD,eAAAA,GAAkBxD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAE3C,EAAA,OAAO;AACLoD,IAAAA,SAAAA;IACAI,MAAAA,EAAQH,YAAAA,GAAeA,YAAAA,CAAa3B,KAAAA,CAAM,GAAA,CAAA,CAAK+B,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAE/B,IAAAA,EAAI,CAAA,GAAMtB,MAAAA;AACtEsD,IAAAA,SAAAA,EAAWL,eAAAA,GAAkB,IAAIM,IAAAA,CAAKN,eAAAA,CAAAA,GAAmBjD,MAAAA;AACzDwD,IAAAA,SAAAA,EAAWN,eAAAA,GAAkB,IAAIK,IAAAA,CAAKL,eAAAA,CAAAA,GAAmBlD;AAC3D,GAAA;AACF;AAlBS8C,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA0BT,eAAsBW,aAAa9D,OAAAA,EAAgB;AACjD,EAAA,IAAI,CAACH,cAAAA,EAAgB;AACnB,IAAA,MAAM,IAAIV,MAAM,wEAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMD,KAAAA,GAAQ,MAAM2C,YAAAA,CAAa7B,OAAAA,CAAAA;AAGjC,EAAA,MAAMJ,MAAAA,GAASuC,cAAcnC,OAAAA,CAAAA;AAC7B,EAAA,MAAMP,YAAAA,GAAe+C,oBAAoBxC,OAAAA,CAAAA;AACzC,EAAA,MAAM1D,SAAAA,GAAYmG,gBAAAA,CAAiBzC,OAAAA,EAASd,KAAAA,CAAAA;AAC5C,EAAA,MAAM6E,OAAAA,GAAUrB,eAAe1C,OAAAA,CAAAA;AAC/B,EAAA,MAAMgE,OAAAA,GAAUpB,eAAe5C,OAAAA,CAAAA;AAC/B,EAAA,MAAMiE,QAAAA,GAAW3C,gBAAgBtB,OAAAA,CAAAA;AACjC,EAAA,MAAMkE,cAAAA,GAAiBf,sBAAsBnD,OAAAA,CAAAA;AAG7C,EAAA,IAAImE,IAAAA;AACJ,EAAA,IAAItE,eAAesE,IAAAA,EAAM;AACvBA,IAAAA,IAAAA,GAAOtE,cAAAA,CAAesE,IAAAA,CAAKC,wBAAAA,CAAyBpE,OAAAA,CAAAA;AACtD,EAAA;AAGA,EAAA,MAAMqE,GAAAA,GAAMvB,iBAAiB9C,OAAAA,CAAAA;AAC7B,EAAA,IAAIqE,GAAAA,CAAItB,OAAAA,IAAWsB,GAAAA,CAAIrB,QAAAA,IAAYqB,IAAIpB,QAAAA,EAAU;AAC/C,IAAA,IAAIkB,IAAAA,EAAM;AAER,MAAA,IAAIE,GAAAA,CAAItB,OAAAA,EAASoB,IAAAA,CAAKpB,OAAAA,GAAUsB,GAAAA,CAAItB,OAAAA;AACpC,MAAA,IAAIsB,GAAAA,CAAIrB,QAAAA,EAAUmB,IAAAA,CAAKnB,QAAAA,GAAWqB,GAAAA,CAAIrB,QAAAA;AACtC,MAAA,IAAIqB,GAAAA,CAAIpB,QAAAA,EAAUkB,IAAAA,CAAKlB,QAAAA,GAAWoB,GAAAA,CAAIpB,QAAAA;IACxC,CAAA,MAAO;AAELkB,MAAAA,IAAAA,GAAO;QACLG,MAAAA,EAAQ,OAAA;QACRC,QAAAA,EAAU,IAAA;AACVxB,QAAAA,OAAAA,EAASsB,GAAAA,CAAItB,OAAAA;AACbC,QAAAA,QAAAA,EAAUqB,GAAAA,CAAIrB,QAAAA;AACdC,QAAAA,QAAAA,EAAUoB,GAAAA,CAAIpB,QAAAA;QACduB,CAAAA,kBAAG,MAAA,CAAA,CAACvE,QAAgBA,GAAAA,EAAjB,GAAA,CAAA;QACHwE,EAAAA,kBAAI,MAAA,CAAA,CAACxE,QAAgBA,GAAAA,EAAjB,IAAA,CAAA;AACJyE,QAAAA,YAAAA,kBAAc,MAAA,CAAA,CAACC,KAAAA,KAAkBC,MAAAA,CAAOD,KAAAA,CAAAA,EAA1B,cAAA,CAAA;AACdE,QAAAA,cAAAA,0BAAiBF,KAAAA,EAAe3B,QAAAA,KAAqB,GAAGA,QAAAA,CAAAA,CAAAA,EAAY2B,KAAAA,CAAAA,CAAAA,EAApD,gBAAA,CAAA;AAChBG,QAAAA,UAAAA,kBAAY,MAAA,CAAA,CAACC,IAAAA,KAAwBH,MAAAA,CAAOG,IAAAA,CAAAA,EAAhC,YAAA,CAAA;AACZC,QAAAA,kBAAAA,0BAAqBL,KAAAA,EAAeM,IAAAA,KAAsC,GAAGN,KAAAA,CAAAA,CAAAA,EAASM,IAAAA,CAAAA,CAAAA,EAAlE,oBAAA;AACtB,OAAA;AACF,IAAA;AACF,EAAA;AAKA,EAAA,MAAMC,UAAAA,GAAAA,CACHhG,KAAAA,EAAON,IAAAA,KAAS,KAAA,IAASM,OAAON,IAAAA,KAAS,SAAA,IAAaM,KAAAA,EAAON,IAAAA,KAAS,iBAAA,KACvEsF,cAAAA,EAAgBd,SAAAA,GACZc,cAAAA,CAAed,YACflE,KAAAA,EAAOxC,EAAAA;AAIb,EAAA,MAAMyI,YAAAA,GAAe;AACnB/I,IAAAA,WAAAA,EAAaE,SAAAA,EAAWI,EAAAA;AACxB0F,IAAAA,QAAAA,EAAUxC,MAAAA,EAAQlD,EAAAA;AAClB4C,IAAAA,OAAAA,EAASJ,KAAAA,EAAOxC,EAAAA;AAChBoF,IAAAA,SAAAA,EAAW5C,KAAAA,EAAON,IAAAA;AAClBwG,IAAAA,cAAAA,EAAgB3F,YAAAA,EAAc/C,EAAAA;AAC9BiG,IAAAA,SAAAA,EAAWoB,OAAAA,EAASrH,EAAAA;AACpBwI,IAAAA;AACF,GAAA;AAEAjJ,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxDE,IAAAA,WAAAA,EAAa+I,aAAa/I,WAAAA,IAAe,MAAA;AACzCkD,IAAAA,OAAAA,EAAS6F,aAAa7F,OAAAA,IAAW,MAAA;IACjC+F,SAAAA,EAAWtF,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA,IAAqB;GACrD,CAAA;AAEAsF,EAAAA,mBAAAA,CAAoBH,YAAAA,CAAAA;AAEpB,EAAA,OAAO;AACLnF,IAAAA,OAAAA;AACAd,IAAAA,KAAAA;AACAU,IAAAA,MAAAA;AACAH,IAAAA,YAAAA;AACAnD,IAAAA,SAAAA;AACAyH,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,cAAAA,EAAgBA,cAAAA,IAAkB7D,MAAAA;IAClC6E,UAAAA,EAAYA,UAAAA,IAAchG,OAAOxC,EAAAA,IAAM,EAAA;AACvCL,IAAAA,EAAAA,EAAIwD,eAAevE,KAAAA,EAAK;AACxB6I,IAAAA,IAAAA;AACAoB,IAAAA,eAAAA,EAAiB,IAAIC,OAAAA;AACvB,GAAA;AACF;AA7FsB1B,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAkGf,SAAS2B,iBAAAA,GAAAA;AACd,EAAA,OAAO5F,cAAAA;AACT;AAFgB4F,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;AC7ZhB,IAAMC,iBAAAA,GAAoB;AACxB,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA;;AAGK,SAASC,oBAAAA,CACdC,SACAC,WAAAA,EAAiE;AAEjE,EAAA,MAAMC,UAAAA,GAAAA,CAAcC,MAAMC,OAAAA,CAAQJ,OAAAA,IAAWA,OAAAA,GAAUA,OAAAA,EAASlE,MAAM,GAAA,CAAA,IAAQ,EAAA,EAC3E+B,GAAAA,CAAI,CAACwC,MAAAA,KAAWA,MAAAA,CAAOtE,MAAI,CAAA,CAC3BuE,OAAOC,OAAAA,CAAAA;AAEV,EAAA,IAAIL,UAAAA,CAAWjF,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAOgF,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,IAAII,UAAAA,CAAWM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAC5B,IAAA,OAAOP,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,OAAOI,UAAAA;AACT;AAjBgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAmBT,SAASU,wBAAAA,CAAyBC,eAA8BC,cAAAA,EAAwB;AAC7F,EAAA,IAAI,CAACD,aAAAA,EAAe;AAClB,IAAA,OAAOC,cAAAA,CAAe,CAAA,CAAA,IAAM,IAAA;AAC9B,EAAA;AAEA,EAAA,OAAOA,cAAAA,CAAeH,QAAAA,CAASE,aAAAA,CAAAA,GAAiBA,aAAAA,GAAgB,IAAA;AAClE;AANgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASG,qBAAqBtH,KAAAA,EAAoB;AACvD,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOA,KAAAA,CAAMF,YAAY,IAAA,IAAQ;AAAC,IAAA,SAAA;AAAW,IAAA;AAAeoH,GAAAA,CAAAA,QAAAA,CAASlH,MAAMN,IAAI,CAAA;AACjF;AANgB4H,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;;;ACbhB,IAAIC,eAAAA,GAA+B,IAAA;AAKnC,eAAsBC,aAAaC,UAAAA,EAA4B;AAC7D,EAAA,MAAM,EACJ3K,MAAAA,EACA4K,YAAAA,EACAC,MAAAA,EACAC,WAAAA,EACAC,aAAAA,EACAC,WAAAA,EACAlD,YAAAA,EAAcmD,kBAAAA,EACdC,wBAAAA,EACAC,yBAAAA,EACAC,UAAAA,EAAU,GACRT,UAAAA;AAGJ,EAAA,MAAM,EAAEU,MAAAA,EAAM,GAAK,MAAM,OAAO,QAAA,CAAA;AAChC,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,oBAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,IAAAA,EAAI,GAAK,MAAM,OAAO,gBAAA,CAAA;AAC9B,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,cAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,oBAAoBnM,KAAAA,EAAAA,MAAAA,EAAOoM,oBAAkB,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvE,EAAA,MAAM,EAAEC,oBAAAA,EAAoB,GAAK,MAAM,OAAO,wBAAA,CAAA;AAC9C,EAAA,MAAM,EAAEC,mBAAAA,EAAmB,GAAK,MAAM,OAAO,2BAAA,CAAA;AAC7C,EAAA,MAAM,EAAEC,0BAAAA,EAAAA,2BAAAA,EAA0B,GAAK,MAAM,OAAO,gCAAA,CAAA;AAEpD5L,EAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,sBAAA,EAAyB9L,MAAAA,CAAO+L,WAAW,CAAA,GAAA,CAAK,CAAA;AAG5D,EAAA,MAAMC,QAAAA,GACJhM,MAAAA,CAAOgM,QAAAA,KACNhM,MAAAA,CAAO+L,YAAY9F,UAAAA,CAAW,SAAA,CAAA,GAC3B,QAAA,GACAjG,MAAAA,CAAO+L,WAAAA,CAAY9F,UAAAA,CAAW,SAAA,IAC5B,QAAA,GACA,QAAA,CAAA;AAIR,EAAA,MAAMgG,iCACJd,yBAAAA,KAA8B,IAAA,GAAO,QAAQA,yBAAAA,KAA8B,KAAA,GAAQ,OAAOa,QAAAA,KAAa,QAAA;AAEzG/L,EAAAA,MAAAA,CAAO6L,KAAK,mCAAA,EAAqC;AAC/CE,IAAAA,QAAAA;IACAE,kBAAAA,EAAoBD;GACtB,CAAA;AAEA,EAAA,MAAM,EAAEE,OAAAA,EAAO,GAAKV,kBAAAA,CAAmBb,YAAAA,EAAc5K,OAAO+L,WAAAA,EAAa;IACvEK,wBAAAA,EAA0B,KAAA;IAC1BC,wBAAAA,EAA0BJ,8BAAAA;AAC1B,IAAA,GAAIf,wBAAAA,GAA2B;AAAEA,MAAAA;AAAyB,KAAA,GAAI;GAChE,CAAA;AACA,EAAA,MAAMiB,OAAAA,EAAAA;AAGN,EAAA,IAAIG,YAAAA;AACJ,EAAA,IAAItM,MAAAA,CAAOmI,IAAAA,EAAMoE,OAAAA,IAAWvM,MAAAA,CAAOmI,KAAKqE,WAAAA,EAAa;AACnDvM,IAAAA,MAAAA,CAAO6L,KAAK,+BAAA,CAAA;AACZQ,IAAAA,YAAAA,GAAe,IAAIG,IAAAA,CAAK;MACtBC,aAAAA,EAAe1M,MAAAA,CAAOmI,KAAKuE,aAAAA,IAAiB,OAAA;MAC5CC,cAAAA,EAAgB3M,MAAAA,CAAOmI,KAAKwE,cAAAA,IAAkB,OAAA;AAC9CH,MAAAA,WAAAA,EAAaxM,OAAOmI,IAAAA,CAAKqE,WAAAA;AACzBI,MAAAA,gBAAAA,EAAkB5M,OAAOmI,IAAAA,CAAKyE,gBAAAA;MAC9BC,SAAAA,EAAW7M,MAAAA,CAAOmI,IAAAA,CAAK0E,SAAAA,IAAa7M,MAAAA,CAAO+L,WAAAA;AAC3Ce,MAAAA,QAAAA,EAAU9M,OAAOmI,IAAAA,CAAK2E,QAAAA;MACtBC,UAAAA,EAAY/M,MAAAA,CAAOmI,KAAK4E,UAAAA,IAAc,IAAA;MACtCC,WAAAA,EAAa,IAAA;MACbC,kBAAAA,EAAoB;KACtB,CAAA;AACA,IAAA,MAAMX,aAAaY,UAAAA,EAAU;AAC7BjN,IAAAA,MAAAA,CAAO6L,IAAAA,CAAK,2CAA2CQ,YAAAA,CAAaa,mBAAAA,GAAsBC,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAO,CAAA;AACxG,EAAA;AAGAtJ,EAAAA,gBAAAA,CAAiB;IACfxE,KAAAA,kBAAO,MAAA,CAAA,MAAMA,QAAAA,EAAN,OAAA,CAAA;IACP6I,IAAAA,EAAMmE;GACR,CAAA;AAGArL,EAAAA,oBAAAA,EAAAA;AAGA,EAAA,IAAI6J,WAAAA,EAAa;AACf7K,IAAAA,MAAAA,CAAO6L,KAAK,uCAAA,CAAA;AACZ,IAAA,MAAMhB,YAAYoC,UAAAA,EAAU;AAC9B,EAAA;AAGA,EAAA,MAAMG,KAAAA,GAAQrN,OAAO6J,WAAAA,KAAgB,YAAA;AACrC,EAAA,MAAMyD,gBAAAA,GAAmBtN,OAAOsN,gBAAAA,IAAoBD,KAAAA;AAGpD,EAAA,MAAME,qBAAAA,GAAwBvN,MAAAA,CAAOwN,cAAAA,EAAgBjB,OAAAA,IAAWP,QAAAA,KAAa,QAAA;AAC7E/L,EAAAA,MAAAA,CAAO6L,KAAK,CAAA,mBAAA,EAAsBE,QAAAA,sBAA8BuB,qBAAAA,GAAwB,SAAA,GAAY,UAAA,CAAA,CAAY,CAAA;AAEhH,EAAA,MAAME,wBAAwBF,qBAAAA,GAC1B;IACE1B,2BAAAA,CAA2B;MACzBU,OAAAA,EAAS,IAAA;AACTmB,MAAAA,qBAAAA,EAAuB1N,OAAOwN,cAAAA,EAAgBE;KAChD;MAEF,EAAA;AAGJ,EAAA,MAAMC,eAAAA,GAAkB3N,OAAO2N,eAAAA,IAAmB,UAAA;AAClD1N,EAAAA,MAAAA,CAAO6L,KAAK,0DAAA,CAAA;AAEZ,EAAA,MAAM8B,qBAAAA,GAAoC;AACxCC,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEC,QAAAA,EAAUC,aAAAA,EAAa,KAAkD;AACtF,MAAA,MAAMC,WAAAA,GAAcD,aAAAA;AACpB,MAAA,IAAIC,aAAazE,eAAAA,EAAiB;AAChCyE,QAAAA,WAAAA,CAAYzE,eAAAA,CAAgB0E,OAAAA,CAAQ,CAACtF,KAAAA,EAAe1E,GAAAA,KAAAA;AAClD6J,UAAAA,QAAAA,CAAS5J,OAAAA,CAAQgK,MAAAA,CAAOjK,GAAAA,EAAK0E,KAAAA,CAAAA;QAC/B,CAAA,CAAA;AACF,MAAA;IACF,CAAA,EAPY,YAAA;AAQd,GAAA;AAEA,EAAA,MAAMwF,OAAO3C,UAAAA,CAAiC;AAC5CmC,IAAAA,eAAAA;AACA9C,IAAAA,MAAAA;IACAuD,QAAAA,EAAUd,gBAAAA;IACVe,OAAAA,EAAS;AACPnO,MAAAA,KAAAA,6BAAWoO,IAAAA,KAASrO,MAAAA,CAAOC,MAAM,WAAA,EAAA,GAAgBoO,IAAAA,CAAAA,EAA1C,OAAA,CAAA;AACPxC,MAAAA,IAAAA,6BAAUwC,IAAAA,KAASrO,MAAAA,CAAO6L,KAAK,WAAA,EAAA,GAAgBwC,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNtN,MAAAA,IAAAA,6BAAUsN,IAAAA,KAASrO,MAAAA,CAAOe,KAAK,WAAA,EAAA,GAAgBsN,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNvN,MAAAA,KAAAA,6BAAWuN,IAAAA,KAASrO,MAAAA,CAAOc,MAAM,WAAA,EAAA,GAAgBuN,IAAAA,CAAAA,EAA1C,OAAA;AACT,KAAA;IACAC,OAAAA,EAAS;AAAId,MAAAA,GAAAA,qBAAAA;AAAuBG,MAAAA,qBAAAA;AAA2B5C,MAAAA,GAAAA,WAAAA,IAAe;;IAC9E3H,OAAAA,kBAAS,MAAA,CAAA,OAAO,EAAEW,OAAAA,EAAO,KAAE;AAEzB,MAAA,MAAMwK,cAAAA,GAAiB,MAAM1G,YAAAA,CAAa9D,OAAAA,CAAAA;AAG1C,MAAA,IAAIiH,kBAAAA,EAAoB;AACtB,QAAA,OAAOA,mBAAmBuD,cAAAA,CAAAA;AAC5B,MAAA;AAEA,MAAA,OAAOA,cAAAA;IACT,CAAA,EAVS,SAAA;GAWX,CAAA;AAGA,EAAA,MAAMC,GAAAA,GAAM,IAAIpD,MAAAA,CAAO;IAAEqD,OAAAA,EAASpD;GAAW,CAAA;AAG7C,EAAA,MAAMqD,WAAAA,GAAchF,oBAAAA,CAAqB3J,MAAAA,CAAO2O,WAAAA,EAAa3O,OAAO6J,WAAW,CAAA;AAE/E4E,EAAAA,GAAAA,CAAIG,IACFrD,IAAAA,CAAK;IACHtB,MAAAA,EAAQ0E,WAAAA;AACRE,IAAAA,WAAAA,EAAaF,YAAY9J,MAAAA,GAAS,CAAA;IAClCiK,cAAAA,EAAgB;AACd,MAAA,cAAA;AACA,MAAA,eAAA;AACA,MAAA,aAAA;AACA,MAAA,gBAAA;AACA,MAAA,UAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,gBAAA;AACA,MAAA,iBAAA;AACA,MAAA,UAAA;AACA,MAAA,YAAA;AACA,MAAA,eAAA;AACA,MAAA,gBAAA;AACA,MAAA,gBAAA;;AAEA,MAAA,YAAA;AACA,MAAA,cAAA;AACA,MAAA,0BAAA;AACA,MAAA;;IAEFC,OAAAA,EAAS;AAAC,MAAA,KAAA;AAAO,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,OAAA;AAAS,MAAA,QAAA;AAAU,MAAA;;AACrD,GAAA,CAAA,CAAA;AAIF,EAAA,MAAMC,gBAAAA,GAAAA,CAAoBjE,iBAAiB,EAAA,EAAIb,OAAO,CAAC+E,EAAAA,KAAOA,GAAGC,OAAO,CAAA;AACxE,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIJ,gBAAAA,CAAiBvH,GAAAA,CAAI,CAACwH,EAAAA,KAAO;IAACA,EAAAA,CAAGI,IAAAA;AAAMJ,IAAAA;GAAG,CAAA,CAAA;AACvE,EAAA,MAAMK,eAAAA,GAAkBN,gBAAAA,CAAiBvH,GAAAA,CAAI,CAACnB,QAAAA,KAAAA;AAC5C,IAAA,MAAMiJ,YAAAA,GAAejJ,QAAAA,CAAS+I,IAAAA,CAAKG,OAAAA,CAAQ,WAAW,OAAA,CAAA;AACtD,IAAA,OAAO;AACLlJ,MAAAA,QAAAA;AACAiJ,MAAAA,YAAAA;AACAE,MAAAA,KAAAA,EAAO,IAAIC,MAAAA,CAAO,CAAA,CAAA,EAAIH,YAAAA,CAAAA,CAAAA,CAAe;AACvC,KAAA;EACF,CAAA,CAAA;AAGA,EAAA,MAAMI,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAE5B,IAAA,MAAMC,UAAAA,GAAaV,YAAAA,CAAahL,GAAAA,CAAIyL,QAAAA,CAAAA;AACpC,IAAA,IAAIC,YAAY,OAAOA,UAAAA;AAGvB,IAAA,KAAA,MAAW,EAAEvJ,QAAAA,EAAUmJ,KAAAA,EAAOF,YAAAA,MAAkBD,eAAAA,EAAiB;AAC/D,MAAA,MAAMQ,OAAAA,GAAUL,KAAAA,CAAMM,IAAAA,CAAKH,QAAAA,CAAAA;AAC3B3P,MAAAA,MAAAA,CAAOC,KAAAA,CACL,CAAA,kBAAA,EAAqB0P,QAAAA,CAAAA,iBAAAA,EAA4BtJ,QAAAA,CAAS+I,IAAI,CAAA,SAAA,EAAYE,YAAAA,CAAAA,UAAAA,EAAyBO,OAAAA,CAAAA,CAAS,CAAA;AAE9G,MAAA,IAAIA,OAAAA,EAAS;AACX7P,QAAAA,MAAAA,CAAOC,MAAM,CAAA,iBAAA,EAAoB0P,QAAAA,CAAAA,YAAAA,EAAuBtJ,QAAAA,CAAS+I,IAAI,CAAA,CAAE,CAAA;AACvE,QAAA,OAAO/I,QAAAA;AACT,MAAA;AACF,IAAA;AAEArG,IAAAA,MAAAA,CAAOC,MAAM,CAAA,wCAAA,EAA2C0P,QAAAA,CAAAA,oBAAAA,EAA+BZ,gBAAAA,CAAiBnK,MAAM,CAAA,CAAE,CAAA;AAChH,IAAA,OAAOR,MAAAA;EACT,CAAA,EAnB6B,sBAAA,CAAA;AAyB7BoK,EAAAA,GAAAA,CAAIuB,SAAAA,CAAU,OAAO,EAAEhM,OAAAA,EAAO,KAAE;AAC9B,IAAA,MAAMiM,GAAAA,GAAM,IAAIC,GAAAA,CAAIlM,OAAAA,CAAQiM,GAAG,CAAA;AAC/B,IAAA,MAAML,WAAWK,GAAAA,CAAIL,QAAAA;AACrB3P,IAAAA,MAAAA,CAAOC,MAAM,CAAA,oBAAA,EAAuB8D,OAAAA,CAAQmM,MAAM,CAAA,CAAA,EAAIP,QAAAA,CAAAA,CAAU,CAAA;AAChE,IAAA,MAAMQ,aAAAA,GAAgBR,QAAAA,KAAa,SAAA,IAAaA,QAAAA,CAAS3J,WAAW,UAAA,CAAA;AAGpE,IAAA,MAAMoK,mCAAmB,MAAA,CAAA,MAAA;AACvB,MAAA,MAAMpG,MAAAA,GAASjG,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA,IAAa,GAAA;AAChD,MAAA,MAAMmM,gBAAgBjG,wBAAAA,CAAyBJ,MAAAA,KAAW,GAAA,GAAM,IAAA,GAAOA,QAAQ0E,WAAAA,CAAAA;AAC/E,MAAA,MAAMzK,OAAAA,GAAkC;QACtC,8BAAA,EAAgC,wCAAA;QAChC,8BAAA,EACE;AACJ,OAAA;AAEA,MAAA,IAAIoM,aAAAA,EAAe;AACjBpM,QAAAA,OAAAA,CAAQ,6BAAA,CAAA,GAAiCoM,aAAAA;AACzCpM,QAAAA,OAAAA,CAAQ,kCAAA,CAAA,GAAsC,MAAA;AAChD,MAAA;AAEA,MAAA,OAAOA,OAAAA;IACT,CAAA,EAfyB,kBAAA,CAAA;AAkBzB,IAAA,MAAMqM,eAAAA,GAAkBH,aAAAA,GAAgB/L,MAAAA,GAAYsL,oBAAAA,CAAqBC,QAAAA,CAAAA;AACzE,IAAA,IAAIW,eAAAA,EAAiB;AACnBtQ,MAAAA,MAAAA,CAAOC,MAAM,CAAA,oCAAA,EAAuC0P,QAAAA,CAAAA,IAAAA,EAAeW,eAAAA,CAAgBlB,IAAI,CAAA,CAAE,CAAA;AACzF,MAAA,MAAMmB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIrM,OAAAA,CAAQmM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAASsM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,IAAIxM,OAAAA,CAAQmM,MAAAA,KAAWI,eAAAA,CAAgBJ,MAAAA,EAAQ;AAC7C,QAAA,OAAO9L,MAAAA;AACT,MAAA;AAEA,MAAA,IAAI;AAEF,QAAA,MAAM6K,OAAAA,GAAU,MAAMlL,OAAAA,CAAQ2M,IAAAA,EAAI;AAGlC,QAAA,MAAMtN,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AAGnC,QAAA,MAAM4M,SAAS,MAAML,eAAAA,CAAgBM,OAAAA,CAAQ7M,OAAAA,EAASX,SAAS6L,OAAAA,CAAAA;AAG/D,QAAA,IAAI0B,kBAAkBH,QAAAA,EAAU;AAE9B,UAAA,MAAMvM,QAAAA,GAAU,IAAIsF,OAAAA,CAAQoH,MAAAA,CAAO1M,OAAO,CAAA;AAC1C,UAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUmI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDtM,YAAAA,QAAAA,CAAQ8M,GAAAA,CAAI/M,GAAAA,EAAK0E,KAAAA,CAAAA;AACnB,UAAA;AACA,UAAA,OAAO,IAAI8H,QAAAA,CAASG,MAAAA,CAAOK,IAAAA,EAAM;AAC/BP,YAAAA,MAAAA,EAAQE,MAAAA,CAAOF,MAAAA;AACfQ,YAAAA,UAAAA,EAAYN,MAAAA,CAAOM,UAAAA;YACnBhN,OAAAA,EAAAA;WACF,CAAA;AACF,QAAA;AAGA,QAAA,MAAMA,OAAAA,GAAU,IAAIsF,OAAAA,CAAQ;UAC1B,cAAA,EAAgB,kBAAA;UAChB,GAAGgH;SACL,CAAA;AAEA,QAAA,OAAO,IAAIC,QAAAA,CAAS7P,IAAAA,CAAKE,SAAAA,CAAU8P,MAAAA,CAAAA,EAAS;UAC1CF,MAAAA,EAAQ,GAAA;AACRxM,UAAAA;SACF,CAAA;AACF,MAAA,CAAA,CAAA,OAASnD,KAAAA,EAAO;AACdd,QAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,kCAAA,EAAqC6O,QAAAA,CAAAA,EAAAA,CAAAA,EAAc7O,KAAAA,CAAAA;AAChE,QAAA,MAAMyP,eAAcH,gBAAAA,EAAAA;AACpB,QAAA,OAAO,IAAII,QAAAA,CACT7P,IAAAA,CAAKE,SAAAA,CAAU;UACbC,KAAAA,EAAOA,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMoQ,OAAAA,GAAU;AAClD,SAAA,CAAA,EACA;UACET,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;YAChB,GAAGsM;AACL;SACF,CAAA;AAEJ,MAAA;AACF,IAAA;AAMA,IAAA,IAAIZ,QAAAA,KAAa,UAAA,IAAc5L,OAAAA,CAAQmM,MAAAA,KAAW,KAAA,EAAO;AACvD,MAAA,IAAI;AACF,QAAA,MAAMiB,aAAAA,GAAgB,aAAA;AACtB,QAAA,MAAMC,IAAAA,GAAQ,MAAM,OAAOD,aAAAA,CAAAA;AAI3B,QAAA,IAAI;AACFC,UAAAA,IAAAA,CAAKC,qBAAAA,CAAsB;AAAEC,YAAAA,QAAAA,EAAUF,IAAAA,CAAKE;WAAS,CAAA;QACvD,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,MAAMN,IAAAA,GAAO,MAAMI,IAAAA,CAAKE,QAAAA,CAASC,OAAAA,EAAO;AACxC,QAAA,OAAO,IAAIf,SAASQ,IAAAA,EAAM;UACxBP,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAAS;YACP,cAAA,EAAgBmN,IAAAA,CAAKE,SAASE,WAAAA,IAAe;AAC/C;SACF,CAAA;MACF,CAAA,CAAA,MAAQ;AAER,MAAA;AACF,IAAA;AAGA,IAAA,MAAMC,UAAAA,GAAa;AAAC/D,MAAAA,eAAAA;AAAiB,MAAA,CAAA,EAAGA,eAAAA,CAAAA,CAAAA,CAAAA;AAAoB,MAAA;;AAC5D,IAAA,MAAMgE,kBAAAA,GAAqBD,UAAAA,CAAWtH,QAAAA,CAASwF,QAAAA,CAAAA;AAE/C,IAAA,IAAI+B,kBAAAA,EAAoB;AACtB,MAAA,MAAMnB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIrM,OAAAA,CAAQmM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRxM,OAAAA,EAASsM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,MAAMoB,YAAAA,GAAe,MAAMzD,IAAAA,CAAK0D,KAAAA,CAAM7N,OAAAA,CAAAA;AAGtC,MAAA,MAAME,OAAAA,GAAU,IAAIsF,OAAAA,CAAQoI,YAAAA,CAAa1N,OAAO,CAAA;AAChD,MAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUmI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDtM,QAAAA,OAAAA,CAAQ8M,GAAAA,CAAI/M,KAAK0E,KAAAA,CAAAA;AACnB,MAAA;AAGA,MAAA,OAAO,IAAI8H,QAAAA,CAASmB,YAAAA,CAAaX,IAAAA,EAAM;AACrCP,QAAAA,MAAAA,EAAQkB,YAAAA,CAAalB,MAAAA;AACrBQ,QAAAA,UAAAA,EAAYU,YAAAA,CAAaV,UAAAA;AACzBhN,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,OAAOG,MAAAA;EACT,CAAA,CAAA;AAGAoK,EAAAA,GAAAA,CAAIG,GAAAA,CAAIhD,qBAAAA,CAAAA;AAGR6C,EAAAA,GAAAA,CAAIG,IACFjD,oBAAAA,CAAqB;AACnBmG,IAAAA,cAAAA,EAAgB9R,OAAO8R,cAAAA,IAAkB;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW,MAAA;;IACjEC,cAAAA,EAAgB/R,MAAAA,CAAO+R,kBAAkB,EAAA;AACzCC,IAAAA,UAAAA,EAAYhS,OAAOgS,UAAAA,IAAc,KAAA;AACjCC,IAAAA,qBAAAA,EAAuBjS,OAAOiS,qBAAAA,IAAyB;AACzD,GAAA,CAAA,CAAA;AAQF,EAAA,MAAMC,iCAAiB,MAAA,CAAA,OAAO;IAC5BxB,MAAAA,EAAQ,SAAA;AACRyB,IAAAA,OAAAA,EAASnS,MAAAA,CAAO+L,WAAAA;AAChBqG,IAAAA,OAAAA,EAASpS,OAAOqS,cAAAA,IAAkB,OAAA;IAClCC,SAAAA,EAAAA,iBAAW,IAAI1K,IAAAA,EAAAA,EAAO2K,WAAAA;GACxB,CAAA,EALuB,gBAAA,CAAA;AAOvB9D,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,WAAW+N,cAAAA,CAAAA;AACnBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,gBAAgB+N,cAAAA,CAAAA;AACxBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,iBAAiB+N,cAAAA,CAAAA;AACzBzD,EAAAA,GAAAA,CAAItK,GAAAA,CAAI,mBAAmB+N,cAAAA,CAAAA;AAG3B,EAAA,IAAIpH,WAAAA,EAAa;AAEf2D,IAAAA,GAAAA,CAAItK,IAAI,mBAAA,EAAqB,OAAO,EAAEH,OAAAA,EAASgN,KAAG,KAAE;AAClD,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,OAAO+J,YAAY0H,SAAAA,EAAS;IAC9B,CAAA,CAAA;AAGA/D,IAAAA,GAAAA,CAAItK,IAAI,mBAAA,EAAqB,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AACzD,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKqS,KAAAA;AACxC,MAAA,OAAO3H,WAAAA,CAAY4H,SAAAA,CAAUtJ,cAAAA,EAAgBhJ,WAAAA,CAAAA;IAC/C,CAAA,CAAA;AAGAqO,IAAAA,GAAAA,CAAItK,IAAI,qBAAA,EAAuB,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AAC3D,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAauS,KAAAA,EAAK,GAAKF,KAAAA;AAK/C,MAAA,MAAMG,WAAAA,GAAcD,KAAAA,EAAOjN,KAAAA,CAAM,GAAA,CAAA,CAAK+B,IAAI,CAACe,CAAAA,KAAMA,CAAAA,CAAE7C,IAAAA,EAAI,CAAA;AACvD,MAAA,OAAOmF,WAAAA,CAAY+H,cAAAA,CAAezJ,cAAAA,EAAgBhJ,WAAAA,EAAawS,WAAAA,CAAAA;IACjE,CAAA,CAAA;AAGAnE,IAAAA,GAAAA,CAAItK,IAAI,0BAAA,EAA4B,OAAO,EAAEsO,KAAAA,EAAOzO,OAAAA,EAASgN,KAAG,KAAE;AAChE,MAAA,MAAM3N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC8N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE3P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKqS,KAAAA;AACxC,MAAA,OAAO3H,WAAAA,CAAYgI,mBAAAA,CAAoB1J,cAAAA,EAAgBhJ,WAAAA,CAAAA;IACzD,CAAA,CAAA;AACF,EAAA;AAGA,EAAA,IAAI2K,aAAAA,IAAiBA,aAAAA,CAAclG,MAAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,KAAA,MAAWyB,YAAYyE,aAAAA,EAAe;AAEpC,MAAA,IAAIzE,SAAS4I,OAAAA,EAAS;AACpBjP,QAAAA,MAAAA,CAAO6L,KAAK,CAAA,uCAAA,EAA0CxF,QAAAA,CAAS6J,MAAM,CAAA,CAAA,EAAI7J,QAAAA,CAAS+I,IAAI,CAAA,CAAE,CAAA;AACxF,QAAA;AACF,MAAA;AAEA,MAAA,MAAMwB,OAAAA,mBAAU,MAAA,CAAA,OAAO,EAAE7M,OAAAA,EAAO,KAAwB;AACtD,QAAA,MAAMX,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,QAAA,OAAOsC,QAAAA,CAASuK,OAAAA,CAAQ7M,OAAAA,EAASX,OAAAA,CAAAA;MACnC,CAAA,EAHgB,SAAA,CAAA;AAKhB,MAAA,QAAQiD,SAAS6J,MAAAA;QACf,KAAK,KAAA;AACH1B,UAAAA,GAAAA,CAAItK,GAAAA,CAAImC,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,MAAA;AACHpC,UAAAA,GAAAA,CAAIsE,IAAAA,CAAKzM,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACxB,UAAA;QACF,KAAK,KAAA;AACHpC,UAAAA,GAAAA,CAAIuE,GAAAA,CAAI1M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,OAAA;AACHpC,UAAAA,GAAAA,CAAIwE,KAAAA,CAAM3M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AACzB,UAAA;QACF,KAAK,QAAA;AACHpC,UAAAA,GAAAA,CAAIyE,MAAAA,CAAO5M,QAAAA,CAAS+I,IAAAA,EAAMwB,OAAAA,CAAAA;AAC1B,UAAA;AACJ;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAMsC,IAAAA,GAAOnT,OAAOmT,IAAAA,IAAQ,SAAA;AAC5B,EAAA,MAAMC,OAAOpT,MAAAA,CAAOoT,IAAAA;AAGpB,EAAA,MAAMC,cAAAA,GAAiC;AACrC5E,IAAAA,GAAAA;IACA6E,MAAAA,EAAQ,IAAA;AACRC,IAAAA,KAAAA,kBAAO,MAAA,CAAA,YAAA;AACL9I,MAAAA,eAAAA,uBAAsB7C,IAAAA,EAAAA;AAGtB6G,MAAAA,GAAAA,CAAI+E,MAAAA,CAAO;AACTJ,QAAAA,IAAAA;QACAK,QAAAA,EAAUN;OACZ,CAAA;AAIA,MAAA,MAAMO,SAAAA,GAAYjF,GAAAA;AAClB4E,MAAAA,cAAAA,CAAeC,SAASI,SAAAA,CAAUJ,MAAAA;AAElCrT,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,UAAA,EAAM9L,MAAAA,CAAO+L,WAAW,CAAA,sBAAA,EAAyBoH,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,CAAAA,EAAOzF,eAAAA,CAAAA,CAAiB,CAAA;IAC/F,CAAA,EAfO,OAAA,CAAA;AAgBPgG,IAAAA,IAAAA,kBAAM,MAAA,CAAA,YAAA;AACJ1T,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,kBAAA,EAAqB9L,MAAAA,CAAO+L,WAAW,CAAA,GAAA,CAAK,CAAA;AAExD,MAAA,IAAIX,UAAAA,EAAY;AACd,QAAA,MAAMA,UAAAA,EAAAA;AACR,MAAA;AAEA,MAAA,IAAIN,WAAAA,EAAa;AACf,QAAA,MAAMA,YAAY8I,QAAAA,EAAQ;AAC5B,MAAA;AAEA,MAAA,MAAMlI,kBAAAA,GAAqBmI,UAAAA,EAAU;AAErC,MAAA,IAAIR,eAAeC,MAAAA,EAAQ;AACzBD,QAAAA,cAAAA,CAAeC,OAAOK,IAAAA,EAAI;AAC5B,MAAA;AAEA1T,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,SAAA,EAAY9L,MAAAA,CAAO+L,WAAW,CAAA,QAAA,CAAU,CAAA;IACtD,CAAA,EAlBM,MAAA,CAAA;AAmBN+H,IAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAA;AACP,MAAA,MAAMC,MAAAA,GAAStJ,eAAAA,GAAkBuJ,IAAAA,CAAKC,KAAAA,CAAAA,CAAOrM,IAAAA,CAAKsM,GAAAA,EAAG,GAAKzJ,eAAAA,CAAgB0J,OAAAA,EAAO,IAAM,GAAA,CAAA,GAAQ,CAAA;AAE/F,MAAA,OAAO;AACLpI,QAAAA,WAAAA,EAAa/L,MAAAA,CAAO+L,WAAAA;AACpBsG,QAAAA,cAAAA,EAAgBrS,OAAOqS,cAAAA,IAAkB,OAAA;AACzCxI,QAAAA,WAAAA,EAAa7J,OAAO6J,WAAAA,IAAe,aAAA;AACnCuJ,QAAAA,IAAAA;AACAD,QAAAA,IAAAA;AACAxF,QAAAA,eAAAA;QACAyG,SAAAA,EAAW3J,eAAAA,EAAiB8H,aAAAA,IAAiB,EAAA;AAC7CwB,QAAAA;AACF,OAAA;IACF,CAAA,EAbS,SAAA;AAcX,GAAA;AAGA,EAAA,MAAMM,gBAAAA,iCAA0BC,MAAAA,KAAAA;AAC9BrU,IAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,SAAA,EAAYwI,MAAAA,CAAAA,sCAAAA,CAA8C,CAAA;AACtE,IAAA,MAAMjB,eAAeM,IAAAA,EAAI;AACzBzO,IAAAA,OAAAA,CAAQqP,KAAK,CAAA,CAAA;EACf,CAAA,EAJyB,kBAAA,CAAA;AAMzBrP,EAAAA,OAAAA,CAAQsP,EAAAA,CAAG,WAAW,MAAA;AACpB,IAAA,KAAKH,iBAAiB,SAAA,CAAA;EACxB,CAAA,CAAA;AACAnP,EAAAA,OAAAA,CAAQsP,EAAAA,CAAG,UAAU,MAAA;AACnB,IAAA,KAAKH,iBAAiB,QAAA,CAAA;EACxB,CAAA,CAAA;AAEA,EAAA,OAAOhB,cAAAA;AACT;AAtjBsB3I,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA6jBf,SAAS+J,oBAAoBtU,qBAAAA,EAA4C;AAC9EJ,EAAAA,aAAAA,CAAc;IAAEI,oBAAAA,EAAAA;GAAqB,CAAA;AACvC;AAFgBsU,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * Server Auth Module\n *\n * JWT verification with workspace secret fetching for microservices.\n * Handles HS256 tokens with secrets stored in workspace database.\n */\n\nimport { logger } from '../logger/index.js';\nimport type { IActor, JWTPayload, WorkspaceSecret } from './types.js';\n\n// Type imports from packages\nimport type * as jose from 'jose';\nimport type { VerifyOptions, Jwt, JwtPayload } from 'jsonwebtoken';\n\n/**\n * Workspace model interface for fetching JWT secrets\n */\ninterface WorkspaceModel {\n  findUnique: (args: { where: { id: string } }) => Promise<{ jwtSecret?: unknown } | null>;\n}\n\ninterface DbClient {\n  client: {\n    workspace: WorkspaceModel;\n  };\n}\n\n// Import getDb dynamically to avoid circular dependencies\nlet getDbFn: (() => DbClient) | null = null;\n\nasync function getDb(): Promise<DbClient> {\n  if (!getDbFn) {\n    const prismaModule = await import('../prisma/index.js');\n    // Use unknown first then cast to avoid type inference issues\n    getDbFn = prismaModule.getDb as unknown as () => DbClient;\n  }\n  return getDbFn();\n}\n\n// Interface for the subset of jsonwebtoken we use\ninterface JwtModule {\n  decode(token: string, options?: { complete?: boolean }): string | Jwt | JwtPayload | null;\n  verify(token: string, secretOrPublicKey: string, options?: VerifyOptions): string | JwtPayload;\n}\n\n// Module cache for dynamic imports\nlet joseModule: typeof jose | null = null;\nlet jwtModule: JwtModule | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\nasync function getJwt(): Promise<JwtModule> {\n  if (!jwtModule) {\n    const jwt = await import('jsonwebtoken');\n    // Handle both ESM and CJS module formats\n    jwtModule = (jwt as { default?: JwtModule }).default ?? jwt;\n  }\n  return jwtModule;\n}\n\n/**\n * Fetch workspace secret callback type\n */\nexport type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig {\n  /** Function to fetch workspace JWT secret from database */\n  fetchWorkspaceSecret: FetchWorkspaceSecretFn;\n}\n\nlet authConfig: AuthConfig | null = null;\n\n/**\n * Configure auth module with workspace secret fetching\n */\nexport function configureAuth(config: AuthConfig): void {\n  authConfig = config;\n  logger.debug('[ServerAuth] Auth configured');\n}\n\n/**\n * Default workspace secret fetcher\n *\n * Fetches JWT secret from workspace database. This is the standard implementation\n * that works with any microservice that has access to the workspace model.\n *\n * @param workspaceId - Workspace ID from JWT\n * @returns WorkspaceSecret or null if not found\n */\nexport async function fetchWorkspaceSecret(workspaceId: string): Promise<WorkspaceSecret | null> {\n  try {\n    const db = await getDb();\n    const workspace = await db.client.workspace.findUnique({\n      where: { id: workspaceId },\n    });\n\n    if (!workspace?.jwtSecret) {\n      logger.debug('[ServerAuth] No JWT secret found for workspace', { workspaceId });\n      return null;\n    }\n\n    return JSON.parse(JSON.stringify(workspace.jwtSecret)) as WorkspaceSecret;\n  } catch (error) {\n    logger.warn('[ServerAuth] Error fetching workspace secret', { workspaceId, error });\n    return null;\n  }\n}\n\n/**\n * Configure auth with default workspace secret fetcher\n *\n * This is automatically called by createServer if no custom auth is configured.\n */\nexport function configureDefaultAuth(): void {\n  if (!authConfig) {\n    configureAuth({ fetchWorkspaceSecret });\n    logger.debug('[ServerAuth] Default auth configured with built-in workspace secret fetcher');\n  }\n}\n\n/**\n * Generate a symmetric secret key for JWT signing\n * @returns JWK object with the generated key\n */\nexport async function generateSymmetricSecret(): Promise<jose.JWK> {\n  const joseLib = await getJose();\n  const secret = await joseLib.generateSecret('HS256');\n  const jwk = await joseLib.exportJWK(secret);\n  return jwk;\n}\n\n/**\n * Verify JWT token for workspace-scoped authentication\n *\n * @param token - JWT token to verify\n * @param secret - Optional secret for verification (if not provided, fetches from workspace)\n * @param options - JWT verification options\n * @returns Verified actor information or null if invalid\n */\nexport async function verifyJWT(token: string, secret?: string, options: VerifyOptions = {}): Promise<IActor | null> {\n  try {\n    const jwt = await getJwt();\n    const joseLib = await getJose();\n\n    // Decode to check algorithm and extract workspace_id\n    const decoded = jwt.decode(token, { complete: true });\n\n    if (!decoded || typeof decoded === 'string' || !decoded.payload || typeof decoded.payload !== 'object') {\n      logger.warn('[ServerAuth] Invalid token format');\n      return null;\n    }\n\n    // For workspace-scoped HS256 tokens\n    if (secret) {\n      // Use provided secret\n      const verifiedJwt = jwt.verify(token, secret, options) as JWTPayload;\n      return mapPayloadToActor(verifiedJwt);\n    }\n\n    // Fetch secret from workspace database\n    const decodedJwt = joseLib.decodeJwt(token) as JWTPayload;\n    if (!decodedJwt.workspace_id) {\n      logger.warn('[ServerAuth] No workspace_id found in token');\n      return null;\n    }\n\n    if (!authConfig?.fetchWorkspaceSecret) {\n      logger.error('[ServerAuth] Auth not configured - call configureAuth() first');\n      return null;\n    }\n\n    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);\n    if (!workspaceSecret) {\n      logger.warn('[ServerAuth] Workspace secret not found');\n      return null;\n    }\n\n    const keyLikeSecret = await joseLib.importJWK(workspaceSecret, 'HS256');\n    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options as jose.JWTVerifyOptions);\n    return mapPayloadToActor(verifiedJwt.payload as unknown as JWTPayload);\n  } catch (err) {\n    logger.warn('[ServerAuth] Error verifying JWT:', err);\n    return null;\n  }\n}\n\n/**\n * Decode JWT without verification (for extracting claims)\n */\nexport async function decodeJWT(token: string): Promise<JWTPayload | null> {\n  try {\n    const joseLib = await getJose();\n    return await joseLib.decodeJwt(token);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Map JWT payload to IActor interface\n */\nfunction mapPayloadToActor(payload: JWTPayload): IActor {\n  return {\n    id: payload.sub,\n    type: payload.actor_type ?? 'user',\n    workspace_id: payload.workspace_id,\n    tenant_id: payload.tenant_id,\n    org_id: payload.org_id,\n    isAdmin: payload['isAdmin'] as boolean | undefined,\n  };\n}\n\n/**\n * Check if actor is authenticated\n */\nexport function authCheck(actor: IActor | null): IActor {\n  if (!actor) {\n    throw new Error('Please sign in');\n  }\n  return actor;\n}\n\n/**\n * Check workspace context and return actor ID and workspace ID\n */\nexport function workspaceCheck(context: { actor: IActor | null; workspace: { id: string } | null }): {\n  actorId: string;\n  workspaceId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  return {\n    actorId: actor.id,\n    workspaceId: context.workspace.id,\n  };\n}\n\n/**\n * Require workspace context - type narrowing guard for wspace layer services\n *\n * Validates that both actor and workspace are present in the context,\n * and returns a type-narrowed context where workspace and actor are guaranteed non-null.\n * Use this at the start of resolvers in wspace services to get typed access\n * to workspace context without optional chaining.\n *\n * @throws Error if actor is not authenticated\n * @throws Error if workspace context is missing\n *\n * @example\n * ```typescript\n * // In a resolver:\n * const ctx = requireWorkspace(context);\n * const workspaceId = ctx.workspace.id;  // no optional chaining needed\n * const actorId = ctx.actor.id;          // no optional chaining needed\n * ```\n */\nexport function requireWorkspace<T extends { actor: IActor | null; workspace: { id: string } | null }>(\n  context: T\n): T & { actor: IActor; workspace: { id: string } } {\n  // Validate actor is authenticated (throws if null)\n  authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  // Return the same context object with narrowed types\n  return context as T & { actor: IActor; workspace: { id: string } };\n}\n\n/**\n * Check organization context and return actor ID and org ID\n */\nexport function orgCheck(context: { actor: IActor | null; organization: { id: string } | null }): {\n  actorId: string;\n  orgId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.organization?.id) {\n    throw new Error('Please switch to an organization');\n  }\n\n  return {\n    actorId: actor.id,\n    orgId: context.organization.id,\n  };\n}\n\n/**\n * Check tenant context and return tenant ID\n */\nexport function tenantCheck(context: { tenant: { id: string } | null }): string {\n  if (!context.tenant?.id) {\n    throw new Error('Tenant context is required');\n  }\n  return context.tenant.id;\n}\n\n/**\n * Get effective actor ID for \"on behalf of\" tracking\n *\n * When an app or service acts with user consent, returns the delegating user's ID.\n * Otherwise returns the direct actor ID.\n *\n * This is used to determine the `onBehalfOf` field in database audit trails:\n * - If actor is user → returns user ID (self-action)\n * - If actor is app/service with consent → returns grantedBy user ID\n * - If actor is app/service without consent → returns actor ID (self-action)\n *\n * @param context - GraphQL context with actor and optional consent context\n * @returns Effective actor ID (the responsible principal)\n *\n * @example\n * ```typescript\n * // User acting directly\n * context.actor = { id: \"user-123\", type: \"user\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"user-123\"\n *\n * // Bot acting on behalf of user\n * context.actor = { id: \"bot-456\", type: \"service\" }\n * context.consentContext = { grantedBy: \"user-789\" }\n * getEffectiveActorId(context) // → \"user-789\"\n *\n * // App acting without consent (self-action)\n * context.actor = { id: \"app-abc\", type: \"app\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"app-abc\"\n * ```\n */\nexport function getEffectiveActorId(context: {\n  actor: IActor | null;\n  consentContext?: { grantedBy: string } | null;\n}): string | null {\n  if (!context.actor) {\n    return null;\n  }\n\n  // If actor is app or service acting with user consent, return the delegating user\n  if (\n    (context.actor.type === 'app' || context.actor.type === 'service' || context.actor.type === 'service_account') &&\n    context.consentContext?.grantedBy\n  ) {\n    return context.consentContext.grantedBy;\n  }\n\n  // Otherwise return the direct actor (user self-action or app/service self-action)\n  return context.actor.id;\n}\n","/**\n * Server Context Module\n *\n * Builds GraphQL context from request headers, JWT, and configuration.\n * Automatically populates actor, tenant, workspace, and tracking information.\n *\n * **Actor-Based Authentication:**\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Services verify JWT directly and build actor from payload\n *\n * Uses standard Web API Request (compatible with Bun/Elysia).\n */\n\nimport { logger } from '../logger/index.js';\nimport crypto from 'node:crypto';\nimport { verifyJWT } from './auth.js';\nimport type {\n  GraphQLContext,\n  IActor,\n  ITenant,\n  IOrganization,\n  IWorkspace,\n  IProject,\n  IProduct,\n  ITracking,\n} from './types.js';\nimport type { I18n, I18nContext } from '../i18n/index.js';\nimport { setWorkspaceContext } from '../prisma/workspace-extension.js';\n\n/**\n * Context builder options\n */\nexport interface ContextBuilderOptions {\n  /** Database getter function */\n  getDb: () => unknown;\n  /** Default tenant info (optional) */\n  defaultTenant?: ITenant;\n  /** I18n instance (optional) */\n  i18n?: I18n;\n}\n\nlet contextOptions: ContextBuilderOptions | null = null;\n\n/**\n * Configure context builder\n */\nexport function configureContext(options: ContextBuilderOptions): void {\n  contextOptions = options;\n  logger.debug('[ServerContext] Context builder configured');\n}\n\n/**\n * Extract header value from standard Web API Request\n */\nfunction getHeader(request: Request, key: string): string | undefined {\n  return request.headers.get(key.toLowerCase()) ?? undefined;\n}\n\nfunction compareSecret(provided: string, expected: string): boolean {\n  const providedBuffer = Buffer.from(provided);\n  const expectedBuffer = Buffer.from(expected);\n\n  if (providedBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);\n}\n\nexport function shouldTrustActorHeaders(\n  request: Request,\n  nodeEnv: string | undefined = process.env['NODE_ENV'],\n  expectedGatewayToken: string | undefined = process.env['TRUSTED_GATEWAY_TOKEN'] ??\n    process.env['INTERNAL_SERVICE_TOKEN']\n): boolean {\n  if (!getHeader(request, 'x-actor-id')) {\n    return false;\n  }\n\n  if (nodeEnv === 'production') {\n    return true;\n  }\n\n  const providedGatewayToken =\n    getHeader(request, 'x-internal-service-token') || getHeader(request, 'x-gateway-auth-token');\n  if (!expectedGatewayToken || !providedGatewayToken) {\n    return false;\n  }\n\n  return compareSecret(providedGatewayToken, expectedGatewayToken);\n}\n\n/**\n * Extract tracking information from request\n */\nfunction extractTracking(request: Request): ITracking {\n  // Get IP from various possible headers\n  const forwardedFor = getHeader(request, 'x-forwarded-for');\n  const realIp = getHeader(request, 'x-real-ip');\n  const ip = forwardedFor?.split(',')[0]?.trim() || realIp || undefined;\n\n  return {\n    ip,\n    userAgent: getHeader(request, 'user-agent'),\n  };\n}\n\n/**\n * Extract actor from gateway-injected headers or authorization header\n *\n * **Actor-Based Authentication:**\n * - If x-actor-id header exists, trust it (gateway-authenticated)\n * - Otherwise fall back to JWT verification (direct access in dev)\n *\n * This allows:\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Direct service access with JWT → service verifies JWT itself\n * - Development testing: Direct headers → service trusts headers\n */\nasync function extractActor(request: Request): Promise<IActor | null> {\n  // Check for gateway-injected actor headers first\n  const actorId = getHeader(request, 'x-actor-id');\n\n  if (actorId && shouldTrustActorHeaders(request)) {\n    // Gateway has already verified JWT and populated context headers\n    // Trust the headers (gateway is the security perimeter)\n    logger.debug('[ServerContext] Using gateway-authenticated actor from headers');\n\n    const actorType = getHeader(request, 'x-actor-type') || 'user';\n    const userRole = getHeader(request, 'x-user-role');\n\n    return {\n      id: actorId,\n      type: actorType,\n      workspace_id: getHeader(request, 'x-workspace-id'),\n      tenant_id: getHeader(request, 'x-tenant-id'),\n      org_id: getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id'),\n      isAdmin:\n        actorType === 'super_admin' ||\n        userRole === 'TENANT_ADMIN' ||\n        userRole === 'SUPER_ADMIN' ||\n        userRole === 'PLATFORM_ADMIN',\n    };\n  }\n\n  if (actorId) {\n    logger.warn('[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification');\n  }\n\n  // FALLBACK: No gateway headers, verify JWT directly (dev/testing mode)\n  const authHeader = getHeader(request, 'authorization');\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.substring(7);\n\n  try {\n    logger.debug('[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)');\n    const payload = await verifyJWT(token);\n\n    if (!payload) {\n      return null;\n    }\n\n    // Build actor from JWT payload\n    return {\n      id: payload.id,\n      type: 'user', // Default to 'user' if not specified\n      workspace_id: payload.workspace_id,\n    };\n  } catch (error) {\n    logger.warn('[ServerContext] Invalid JWT token:', error);\n    return null;\n  }\n}\n\n/**\n * Extract tenant from headers\n */\nfunction extractTenant(request: Request): ITenant | null {\n  // Check headers\n  const tenantId = getHeader(request, 'x-tenant-id');\n  const tenantEndpoint = getHeader(request, 'x-tenant-endpoint');\n\n  if (tenantId) {\n    return {\n      id: tenantId,\n      endpoint: tenantEndpoint || '',\n    };\n  }\n\n  // Fall back to default tenant if configured\n  return contextOptions?.defaultTenant || null;\n}\n\n/**\n * Extract organization from headers\n */\nfunction extractOrganization(request: Request): IOrganization | null {\n  const orgId = getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id');\n\n  if (orgId) {\n    return { id: orgId };\n  }\n\n  return null;\n}\n\n/**\n * Extract workspace from headers or actor\n */\nfunction extractWorkspace(request: Request, actor: IActor | null): IWorkspace | null {\n  // Check headers first\n  const workspaceId = getHeader(request, 'x-workspace-id');\n\n  if (workspaceId) {\n    return { id: workspaceId };\n  }\n\n  // Fall back to workspace_id from actor\n  if (actor?.workspace_id) {\n    return { id: actor.workspace_id };\n  }\n\n  return null;\n}\n\n/**\n * Extract project from headers\n */\nfunction extractProject(request: Request): IProject | null {\n  const projectId = getHeader(request, 'x-project-id');\n\n  if (projectId) {\n    return { id: projectId };\n  }\n\n  return null;\n}\n\n/**\n * Extract product from headers\n */\nfunction extractProduct(request: Request): IProduct | null {\n  const productId = getHeader(request, 'x-product-id');\n\n  if (productId) {\n    return { id: productId };\n  }\n\n  return null;\n}\n\n/**\n * Extract geography context from headers\n *\n * Geography headers carry the user's selected location context,\n * used for currency defaults, tax calculations, payment routing,\n * data residency, and regional support.\n *\n * Headers:\n * - x-geo-country: ISO 3166-1 alpha-2 country code (e.g., 'IN', 'US', 'DE')\n * - x-geo-currency: ISO 4217 currency code (e.g., 'INR', 'USD', 'EUR')\n * - x-geo-timezone: IANA timezone (e.g., 'Asia/Kolkata', 'America/New_York')\n */\nfunction extractGeography(request: Request): { country?: string; currency?: string; timezone?: string } {\n  const country = getHeader(request, 'x-geo-country');\n  const currency = getHeader(request, 'x-geo-currency');\n  const timezone = getHeader(request, 'x-geo-timezone');\n\n  return {\n    country: country?.toUpperCase() || undefined,\n    currency: currency?.toUpperCase() || undefined,\n    timezone: timezone || undefined,\n  };\n}\n\n/**\n * Extract consent context from headers\n *\n * When an app or service acts on behalf of a user (with user consent),\n * the gateway forwards consent headers. This function extracts them.\n *\n * Headers:\n * - x-consent-granted-by: Actor ID who granted consent (delegating user)\n * - x-consent-scope: Comma-separated scopes\n * - x-consent-granted-at: ISO timestamp when consent was granted\n * - x-consent-expires-at: ISO timestamp when consent expires\n */\nfunction extractConsentContext(request: Request): import('./types.js').ConsentContext | null {\n  const grantedBy = getHeader(request, 'x-consent-granted-by');\n\n  // If no grantedBy, there's no consent delegation\n  if (!grantedBy) {\n    return null;\n  }\n\n  const scopesHeader = getHeader(request, 'x-consent-scope');\n  const grantedAtHeader = getHeader(request, 'x-consent-granted-at');\n  const expiresAtHeader = getHeader(request, 'x-consent-expires-at');\n\n  return {\n    grantedBy,\n    scopes: scopesHeader ? scopesHeader.split(',').map((s) => s.trim()) : undefined,\n    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : undefined,\n    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : undefined,\n  };\n}\n\n/**\n * Build GraphQL context from standard Web Request\n *\n * Also sets the workspace context in AsyncLocalStorage for automatic\n * Prisma workspaceId injection via the workspace extension.\n */\nexport async function buildContext(request: Request): Promise<GraphQLContext> {\n  if (!contextOptions) {\n    throw new Error('[ServerContext] Context not configured - call configureContext() first');\n  }\n\n  // Extract actor from headers/JWT\n  const actor = await extractActor(request);\n\n  // Extract all context parts\n  const tenant = extractTenant(request);\n  const organization = extractOrganization(request);\n  const workspace = extractWorkspace(request, actor);\n  const project = extractProject(request);\n  const product = extractProduct(request);\n  const tracking = extractTracking(request);\n  const consentContext = extractConsentContext(request);\n\n  // Build i18n context if configured\n  let i18n: I18nContext | undefined;\n  if (contextOptions.i18n) {\n    i18n = contextOptions.i18n.createContextFromRequest(request);\n  }\n\n  // Merge geography context from x-geo-* headers into i18n\n  const geo = extractGeography(request);\n  if (geo.country || geo.currency || geo.timezone) {\n    if (i18n) {\n      // Merge geography fields into existing i18n context\n      if (geo.country) i18n.country = geo.country;\n      if (geo.currency) i18n.currency = geo.currency;\n      if (geo.timezone) i18n.timezone = geo.timezone;\n    } else {\n      // Create minimal i18n context with geography only (when i18n module not configured)\n      i18n = {\n        locale: 'en-US',\n        language: 'en',\n        country: geo.country,\n        currency: geo.currency,\n        timezone: geo.timezone,\n        t: (key: string) => key,\n        tp: (key: string) => key,\n        formatNumber: (value: number) => String(value),\n        formatCurrency: (value: number, currency: string) => `${currency} ${value}`,\n        formatDate: (date: Date | string) => String(date),\n        formatRelativeTime: (value: number, unit: Intl.RelativeTimeFormatUnit) => `${value} ${unit}`,\n      };\n    }\n  }\n\n  // Determine onBehalfOf for audit trails\n  // If actor is app/service with consent → use grantedBy (delegating user)\n  // Otherwise → use actor.id (self-action)\n  const onBehalfOf =\n    (actor?.type === 'app' || actor?.type === 'service' || actor?.type === 'service_account') &&\n    consentContext?.grantedBy\n      ? consentContext.grantedBy\n      : actor?.id;\n\n  // Set workspace context in AsyncLocalStorage for Prisma workspace extension\n  // This enables automatic workspaceId injection on create/update operations\n  const wsCtxPayload = {\n    workspaceId: workspace?.id,\n    tenantId: tenant?.id,\n    actorId: actor?.id,\n    actorType: actor?.type,\n    organizationId: organization?.id,\n    projectId: project?.id,\n    onBehalfOf,\n  };\n\n  logger.debug('[ServerContext] Setting workspace context', {\n    workspaceId: wsCtxPayload.workspaceId ?? 'NONE',\n    actorId: wsCtxPayload.actorId ?? 'NONE',\n    rawHeader: getHeader(request, 'x-workspace-id') ?? 'MISSING',\n  });\n\n  setWorkspaceContext(wsCtxPayload);\n\n  return {\n    request,\n    actor,\n    tenant,\n    organization,\n    workspace,\n    project,\n    product,\n    tracking,\n    consentContext: consentContext || undefined,\n    onBehalfOf: onBehalfOf || actor?.id || '',\n    db: contextOptions.getDb(),\n    i18n,\n    responseHeaders: new Headers(),\n  };\n}\n\n/**\n * Get context options\n */\nexport function getContextOptions(): ContextBuilderOptions | null {\n  return contextOptions;\n}\n","import type { IActor } from './types.js';\n\nconst LOCALHOST_ORIGINS = [\n  'http://localhost:3000',\n  'http://localhost:4000',\n  'http://localhost:5173',\n  'http://127.0.0.1:3000',\n  'http://127.0.0.1:4000',\n  'http://127.0.0.1:5173',\n];\n\nexport function normalizeCorsOrigins(\n  origins: string | string[] | undefined,\n  environment: 'development' | 'staging' | 'production' | undefined\n): string[] {\n  const normalized = (Array.isArray(origins) ? origins : origins?.split(',') || [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\n  if (normalized.length === 0) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  if (normalized.includes('*')) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  return normalized;\n}\n\nexport function resolveAllowedCorsOrigin(requestOrigin: string | null, allowedOrigins: string[]): string | null {\n  if (!requestOrigin) {\n    return allowedOrigins[0] ?? null;\n  }\n\n  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;\n}\n\nexport function canAccessGraphExport(actor: IActor | null): boolean {\n  if (!actor) {\n    return false;\n  }\n\n  return actor.isAdmin === true || ['service', 'super_admin'].includes(actor.type);\n}\n","/**\n * Server Module\n *\n * Main server bootstrapping with Elysia, GraphQL Yoga, and middleware.\n * Uses Bun runtime for high-performance GraphQL services.\n *\n * Provides a simple API for microservices to start a fully configured server.\n */\n\nimport { logger } from '../logger/index.js';\nimport { configureAuth, configureDefaultAuth, type FetchWorkspaceSecretFn } from './auth.js';\nimport { configureContext, buildContext } from './context.js';\nimport type {\n  ServerDefinition,\n  ServerInstance,\n  ServerInfo,\n  ElysiaApp,\n  BunServerHandle,\n  YogaPlugin,\n  GraphQLContext,\n} from './types.js';\nimport { I18n } from '../i18n/index.js';\nimport { canAccessGraphExport, normalizeCorsOrigins, resolveAllowedCorsOrigin } from './security.js';\n\n// Store startup time for uptime calculation\nlet serverStartTime: Date | null = null;\n\n/**\n * Create and configure a server instance using Elysia + GraphQL Yoga\n */\nexport async function createServer(definition: ServerDefinition): Promise<ServerInstance> {\n  const {\n    config,\n    prismaClient,\n    schema,\n    moduleGraph,\n    restEndpoints,\n    yogaPlugins,\n    buildContext: customBuildContext,\n    workspaceExtensionConfig,\n    disableWorkspaceExtension,\n    onShutdown,\n  } = definition;\n\n  // Dynamic imports to avoid requiring these as hard dependencies\n  const { Elysia } = await import('elysia');\n  const { BunAdapter } = await import('elysia/adapter/bun');\n  const { cors } = await import('@elysiajs/cors');\n  const { createYoga } = await import('graphql-yoga');\n  const { initializeDatabase, getDb, getDatabaseManager } = await import('../prisma/index.js');\n  const { createSecurityPlugin } = await import('../middleware/index.js');\n  const { createMetricsPlugin } = await import('../observability/index.js');\n  const { createWorkspaceGuardPlugin } = await import('./workspace-guard.js');\n\n  logger.info(`[Server] Initializing ${config.serviceName}...`);\n\n  // Detect boundary from config or service name — needed before database and guard setup\n  const boundary =\n    config.boundary ??\n    (config.serviceName.startsWith('wspace-')\n      ? 'wspace'\n      : config.serviceName.startsWith('global-')\n        ? 'global'\n        : 'wspace'); // fail-closed: default to wspace (stricter)\n\n  // Initialize database\n  // Workspace extension is auto-disabled for global boundary services unless explicitly enabled\n  const shouldEnableWorkspaceExtension =\n    disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === 'wspace'; // auto-detect: enabled for wspace, disabled for global\n\n  logger.info('[Server] Initializing database...', {\n    boundary,\n    workspaceExtension: shouldEnableWorkspaceExtension,\n  });\n\n  const { connect } = initializeDatabase(prismaClient, config.serviceName, {\n    registerShutdownHandlers: false, // Server manages shutdown handlers itself\n    enableWorkspaceExtension: shouldEnableWorkspaceExtension,\n    ...(workspaceExtensionConfig ? { workspaceExtensionConfig } : {}),\n  });\n  await connect();\n\n  // Initialize i18n if configured\n  let i18nInstance: I18n | undefined;\n  if (config.i18n?.enabled && config.i18n.localesPath) {\n    logger.info('[Server] Initializing i18n...');\n    i18nInstance = new I18n({\n      defaultLocale: config.i18n.defaultLocale || 'en-US',\n      fallbackLocale: config.i18n.fallbackLocale || 'en-US',\n      localesPath: config.i18n.localesPath,\n      supportedLocales: config.i18n.supportedLocales,\n      namespace: config.i18n.namespace || config.serviceName,\n      lazyLoad: config.i18n.lazyLoad,\n      logMissing: config.i18n.logMissing ?? true,\n      enableCache: true,\n      returnKeyOnMissing: true,\n    });\n    await i18nInstance.initialize();\n    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(', ')}`);\n  }\n\n  // Configure context builder\n  configureContext({\n    getDb: () => getDb(),\n    i18n: i18nInstance,\n  });\n\n  // Auto-configure auth with default workspace secret fetcher if not already configured\n  configureDefaultAuth();\n\n  // Initialize module graph if provided\n  if (moduleGraph) {\n    logger.info('[Server] Initializing module graph...');\n    await moduleGraph.initialize();\n  }\n\n  // Determine if playground/introspection should be enabled\n  const isDev = config.environment !== 'production';\n  const enablePlayground = config.enablePlayground ?? isDev;\n\n  // Build workspace guard plugin — auto-enabled for wspace boundary only\n  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === 'wspace';\n  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? 'enabled' : 'disabled'}`);\n\n  const workspaceGuardPlugins = workspaceGuardEnabled\n    ? [\n        createWorkspaceGuardPlugin({\n          enabled: true,\n          whitelistedOperations: config.workspaceGuard?.whitelistedOperations,\n        }),\n      ]\n    : [];\n\n  // Create GraphQL Yoga instance\n  const graphqlEndpoint = config.graphqlEndpoint || '/graphql';\n  logger.info('[Server] Setting up GraphQL Yoga with provided schema...');\n\n  const responseHeadersPlugin: YogaPlugin = {\n    onResponse: ({ response, serverContext }: { response: Response; serverContext: unknown }) => {\n      const yogaContext = serverContext as GraphQLContext;\n      if (yogaContext?.responseHeaders) {\n        yogaContext.responseHeaders.forEach((value: string, key: string) => {\n          response.headers.append(key, value);\n        });\n      }\n    },\n  };\n\n  const yoga = createYoga<{ request: Request }>({\n    graphqlEndpoint,\n    schema, // Use the schema provided by microservice\n    graphiql: enablePlayground,\n    logging: {\n      debug: (...args) => logger.debug('[GraphQL]', ...args),\n      info: (...args) => logger.info('[GraphQL]', ...args),\n      warn: (...args) => logger.warn('[GraphQL]', ...args),\n      error: (...args) => logger.error('[GraphQL]', ...args),\n    },\n    plugins: [...workspaceGuardPlugins, responseHeadersPlugin, ...(yogaPlugins || [])],\n    context: async ({ request }) => {\n      // Build default context\n      const defaultContext = await buildContext(request);\n\n      // Apply custom context builder if provided\n      if (customBuildContext) {\n        return customBuildContext(defaultContext);\n      }\n\n      return defaultContext;\n    },\n  });\n\n  // Create Elysia instance with Bun adapter\n  const app = new Elysia({ adapter: BunAdapter });\n\n  // Register CORS middleware\n  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);\n\n  app.use(\n    cors({\n      origin: corsOrigins,\n      credentials: corsOrigins.length > 0,\n      allowedHeaders: [\n        'Content-Type',\n        'Authorization',\n        'X-Tenant-ID',\n        'X-Workspace-ID',\n        'X-Org-ID',\n        'X-Project-ID',\n        'X-Product-ID',\n        'X-CSRF-Token',\n        'X-Service-Name',\n        'Accept-Language',\n        'X-Locale',\n        'X-Language',\n        'X-Geo-Country',\n        'X-Geo-Currency',\n        'X-Geo-Timezone',\n        // Actor headers (gateway-injected or dev mode)\n        'X-Actor-ID',\n        'X-Actor-Type',\n        'X-Internal-Service-Token',\n        'X-Gateway-Auth-Token',\n      ],\n      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n    })\n  );\n\n  // Collect raw body endpoints for early interception\n  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);\n  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [ep.path, ep]));\n  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {\n    const regexPattern = endpoint.path.replace(/:[^/]+/g, '[^/]+');\n    return {\n      endpoint,\n      regexPattern,\n      regex: new RegExp(`^${regexPattern}$`),\n    };\n  });\n\n  // Helper to match pathname against endpoint patterns (including :param placeholders)\n  const matchRawBodyEndpoint = (pathname: string): (typeof rawBodyEndpoints)[0] | undefined => {\n    // First try exact match (for non-parameterized paths)\n    const exactMatch = rawBodyPaths.get(pathname);\n    if (exactMatch) return exactMatch;\n\n    // Try pattern matching for parameterized paths like /webhooks/slack/:channelId\n    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {\n      const isMatch = regex.test(pathname);\n      logger.debug(\n        `[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`\n      );\n      if (isMatch) {\n        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);\n        return endpoint;\n      }\n    }\n\n    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);\n    return undefined;\n  };\n\n  // Handle GraphQL, metrics, and raw body requests BEFORE any middleware that consumes the body\n  // This is critical because Yoga needs the raw request body stream\n  // and webhook endpoints need raw body for signature verification\n  // onRequest runs before onParse (body parsing) and onBeforeHandle\n  app.onRequest(async ({ request }) => {\n    const url = new URL(request.url);\n    const pathname = url.pathname;\n    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);\n    const isHealthRoute = pathname === '/health' || pathname.startsWith('/health/');\n\n    // Build CORS headers helper\n    const buildCorsHeaders = (): Record<string, string> => {\n      const origin = request.headers.get('origin') || '*';\n      const allowedOrigin = resolveAllowedCorsOrigin(origin === '*' ? null : origin, corsOrigins);\n      const headers: Record<string, string> = {\n        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n        'Access-Control-Allow-Headers':\n          'Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token',\n      };\n\n      if (allowedOrigin) {\n        headers['Access-Control-Allow-Origin'] = allowedOrigin;\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n\n      return headers;\n    };\n\n    // Check if this is a raw body endpoint (webhooks) - now supports parameterized paths\n    const rawBodyEndpoint = isHealthRoute ? undefined : matchRawBodyEndpoint(pathname);\n    if (rawBodyEndpoint) {\n      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight for raw body endpoints\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Only process if method matches\n      if (request.method !== rawBodyEndpoint.method) {\n        return undefined; // Let other handlers deal with it\n      }\n\n      try {\n        // Read raw body BEFORE any parsing\n        const rawBody = await request.text();\n\n        // Build context without consuming body (body already read)\n        const context = await buildContext(request);\n\n        // Call the handler with raw body\n        const result = await rawBodyEndpoint.handler(request, context, rawBody);\n\n        // If handler returns a Response, use it directly\n        if (result instanceof Response) {\n          // Add CORS headers\n          const headers = new Headers(result.headers);\n          for (const [key, value] of Object.entries(corsHeaders)) {\n            headers.set(key, value);\n          }\n          return new Response(result.body, {\n            status: result.status,\n            statusText: result.statusText,\n            headers,\n          });\n        }\n\n        // Otherwise, serialize as JSON\n        const headers = new Headers({\n          'Content-Type': 'application/json',\n          ...corsHeaders,\n        });\n\n        return new Response(JSON.stringify(result), {\n          status: 200,\n          headers,\n        });\n      } catch (error) {\n        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);\n        const corsHeaders = buildCorsHeaders();\n        return new Response(\n          JSON.stringify({\n            error: error instanceof Error ? error.message : 'Internal server error',\n          }),\n          {\n            status: 500,\n            headers: {\n              'Content-Type': 'application/json',\n              ...corsHeaders,\n            },\n          }\n        );\n      }\n    }\n\n    // Serve Prometheus metrics via prom-client at /metrics.\n    // The graphql-yoga prometheus plugin populates the same default registry,\n    // so GraphQL-level metrics (operation durations, error counts, etc.) are\n    // included automatically without needing Yoga to handle this route.\n    if (pathname === '/metrics' && request.method === 'GET') {\n      try {\n        const promClientMod = 'prom-client';\n        const prom = (await import(promClientMod)) as unknown as {\n          register: { metrics: () => Promise<string> | string; contentType?: string };\n          collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n        };\n        try {\n          prom.collectDefaultMetrics({ register: prom.register });\n        } catch {\n          /* already called */\n        }\n        const body = await prom.register.metrics();\n        return new Response(body, {\n          status: 200,\n          headers: {\n            'Content-Type': prom.register.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n          },\n        });\n      } catch {\n        // fall through — prom-client not installed; let Yoga handle as fallback\n      }\n    }\n\n    // Routes that should be handled by Yoga (GraphQL endpoint only)\n    const yogaRoutes = [graphqlEndpoint, `${graphqlEndpoint}/`, '/metrics'];\n    const shouldHandleByYoga = yogaRoutes.includes(pathname);\n\n    if (shouldHandleByYoga) {\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Get response from Yoga\n      const yogaResponse = await yoga.fetch(request);\n\n      // Add CORS headers to Yoga response\n      const headers = new Headers(yogaResponse.headers);\n      for (const [key, value] of Object.entries(corsHeaders)) {\n        headers.set(key, value);\n      }\n\n      // Return response with CORS headers\n      return new Response(yogaResponse.body, {\n        status: yogaResponse.status,\n        statusText: yogaResponse.statusText,\n        headers,\n      });\n    }\n    // Return undefined to continue to next handlers for non-GraphQL requests\n    return undefined;\n  });\n\n  // Register metrics middleware (after GraphQL interception)\n  app.use(createMetricsPlugin());\n\n  // Register security middleware (after GraphQL interception)\n  app.use(\n    createSecurityPlugin({\n      csrfSkipRoutes: config.csrfSkipRoutes || ['/graphql', '/health', '/api/graph/'],\n      loginEndpoints: config.loginEndpoints || [],\n      enableCSRF: config.enableCSRF ?? false, // Disabled by default for GraphQL services\n      enableSessionSecurity: config.enableSessionSecurity ?? false,\n    })\n  );\n\n  // Health check endpoints\n  // /health - General health check\n  // /health/live - Kubernetes liveness probe\n  // /health/ready - Kubernetes readiness probe\n  // /health/startup - Kubernetes startup probe\n  const healthResponse = () => ({\n    status: 'healthy',\n    service: config.serviceName,\n    version: config.serviceVersion || '1.0.0',\n    timestamp: new Date().toISOString(),\n  });\n\n  app.get('/health', healthResponse);\n  app.get('/health/live', healthResponse);\n  app.get('/health/ready', healthResponse);\n  app.get('/health/startup', healthResponse);\n\n  // Graph API endpoints (if moduleGraph provided)\n  if (moduleGraph) {\n    // Get graph configuration schema\n    app.get('/api/graph/schema', async ({ request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      return moduleGraph.getSchema();\n    });\n\n    // Export all graph data\n    app.get('/api/graph/export', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportAll(organizationId, workspaceId);\n    });\n\n    // Export entities only\n    app.get('/api/graph/entities', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId, types } = query as {\n        organizationId?: string;\n        workspaceId?: string;\n        types?: string;\n      };\n      const entityTypes = types?.split(',').map((t) => t.trim());\n      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);\n    });\n\n    // Export relationships only\n    app.get('/api/graph/relationships', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportRelationships(organizationId, workspaceId);\n    });\n  }\n\n  // Register custom REST endpoints (skip rawBody endpoints - they're handled in onRequest)\n  if (restEndpoints && restEndpoints.length > 0) {\n    for (const endpoint of restEndpoints) {\n      // Skip rawBody endpoints - they're intercepted in onRequest before body parsing\n      if (endpoint.rawBody) {\n        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);\n        continue;\n      }\n\n      const handler = async ({ request }: { request: Request }): Promise<unknown> => {\n        const context = await buildContext(request);\n        return endpoint.handler(request, context);\n      };\n\n      switch (endpoint.method) {\n        case 'GET':\n          app.get(endpoint.path, handler);\n          break;\n        case 'POST':\n          app.post(endpoint.path, handler);\n          break;\n        case 'PUT':\n          app.put(endpoint.path, handler);\n          break;\n        case 'PATCH':\n          app.patch(endpoint.path, handler);\n          break;\n        case 'DELETE':\n          app.delete(endpoint.path, handler);\n          break;\n      }\n    }\n  }\n\n  const host = config.host || '0.0.0.0';\n  const port = config.port;\n\n  // Create server instance\n  const serverInstance: ServerInstance = {\n    app: app as unknown as ElysiaApp,\n    server: null,\n    start: async () => {\n      serverStartTime = new Date();\n\n      // Call listen() which starts the server and makes app.server available\n      app.listen({\n        port,\n        hostname: host,\n      });\n\n      // Access the Bun server instance from the app\n      // Cast through unknown to satisfy TypeScript since Elysia's types are complex\n      const elysiaApp = app as unknown as { server: BunServerHandle | null };\n      serverInstance.server = elysiaApp.server;\n\n      logger.info(`🚀 ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);\n    },\n    stop: async () => {\n      logger.info(`[Server] Stopping ${config.serviceName}...`);\n\n      if (onShutdown) {\n        await onShutdown();\n      }\n\n      if (moduleGraph) {\n        await moduleGraph.shutdown();\n      }\n\n      await getDatabaseManager().disconnect();\n\n      if (serverInstance.server) {\n        serverInstance.server.stop();\n      }\n\n      logger.info(`[Server] ${config.serviceName} stopped`);\n    },\n    getInfo: (): ServerInfo => {\n      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1000) : 0;\n\n      return {\n        serviceName: config.serviceName,\n        serviceVersion: config.serviceVersion || '1.0.0',\n        environment: config.environment || 'development',\n        port,\n        host,\n        graphqlEndpoint,\n        startedAt: serverStartTime?.toISOString() || '',\n        uptime,\n      };\n    },\n  };\n\n  // Setup graceful shutdown handlers\n  const gracefulShutdown = async (signal: string): Promise<never> => {\n    logger.info(`[Server] ${signal} received, shutting down gracefully...`);\n    await serverInstance.stop();\n    process.exit(0);\n  };\n\n  process.on('SIGTERM', () => {\n    void gracefulShutdown('SIGTERM');\n  });\n  process.on('SIGINT', () => {\n    void gracefulShutdown('SIGINT');\n  });\n\n  return serverInstance;\n}\n\n/**\n * Configure auth with workspace secret fetcher\n *\n * This should be called before creating the server if using workspace-scoped JWT\n */\nexport function configureServerAuth(fetchWorkspaceSecret: FetchWorkspaceSecretFn): void {\n  configureAuth({ fetchWorkspaceSecret });\n}\n"]}
+{"version":3,"sources":["../../src/server/auth.ts","../../src/server/context.ts","../../src/server/security.ts","../../src/server/server.ts"],"names":["getDbFn","getDb","prismaModule","joseModule","jwtModule","getJose","getJwt","jwt","default","authConfig","configureAuth","config","logger","debug","fetchWorkspaceSecret","workspaceId","db","workspace","client","findUnique","where","id","jwtSecret","JSON","parse","stringify","error","warn","configureDefaultAuth","generateSymmetricSecret","joseLib","secret","generateSecret","jwk","exportJWK","verifyJWT","token","options","decoded","decode","complete","payload","verifiedJwt","verify","mapPayloadToActor","decodedJwt","decodeJwt","workspace_id","workspaceSecret","keyLikeSecret","importJWK","jwtVerify","err","decodeJWT","sub","type","actor_type","tenant_id","org_id","isAdmin","authCheck","actor","Error","workspaceCheck","context","actorId","requireWorkspace","orgCheck","organization","orgId","tenantCheck","tenant","contextOptions","configureContext","getHeader","request","key","headers","get","toLowerCase","undefined","compareSecret","provided","expected","providedBuffer","Buffer","from","expectedBuffer","length","crypto","timingSafeEqual","shouldTrustActorHeaders","nodeEnv","process","env","expectedGatewayToken","providedGatewayToken","extractTracking","forwardedFor","realIp","ip","split","trim","userAgent","extractActor","actorType","userRole","authHeader","startsWith","substring","extractTenant","tenantId","tenantEndpoint","endpoint","defaultTenant","extractOrganization","extractWorkspace","extractProject","projectId","extractProduct","productId","extractGeography","country","currency","timezone","toUpperCase","extractConsentContext","grantedBy","scopesHeader","grantedAtHeader","expiresAtHeader","scopes","map","s","grantedAt","Date","expiresAt","buildContext","project","product","tracking","consentContext","i18n","createContextFromRequest","geo","locale","language","t","tp","formatNumber","value","String","formatCurrency","formatDate","date","formatRelativeTime","unit","onBehalfOf","wsCtxPayload","organizationId","rawHeader","setWorkspaceContext","responseHeaders","Headers","getContextOptions","LOCALHOST_ORIGINS","normalizeCorsOrigins","origins","environment","normalized","Array","isArray","origin","filter","Boolean","includes","resolveAllowedCorsOrigin","requestOrigin","allowedOrigins","canAccessGraphExport","serverStartTime","createServer","definition","prismaClient","schema","moduleGraph","restEndpoints","yogaPlugins","customBuildContext","workspaceExtensionConfig","disableWorkspaceExtension","onShutdown","Elysia","BunAdapter","cors","createYoga","initializeDatabase","getDatabaseManager","createSecurityPlugin","createMetricsPlugin","createWorkspaceGuardPlugin","info","serviceName","boundary","shouldEnableWorkspaceExtension","workspaceExtension","connect","registerShutdownHandlers","enableWorkspaceExtension","i18nInstance","enabled","localesPath","I18n","defaultLocale","fallbackLocale","supportedLocales","namespace","lazyLoad","logMissing","enableCache","returnKeyOnMissing","initialize","getSupportedLocales","join","isDev","enablePlayground","workspaceGuardEnabled","workspaceGuard","workspaceGuardPlugins","whitelistedOperations","graphqlEndpoint","responseHeadersPlugin","onResponse","response","serverContext","yogaContext","forEach","append","yoga","graphiql","logging","args","plugins","createHumanReadableErrorPlugin","defaultContext","app","adapter","corsOrigins","use","credentials","allowedHeaders","methods","rawBodyEndpoints","ep","rawBody","rawBodyPaths","Map","path","rawBodyMatchers","regexPattern","replace","regex","RegExp","matchRawBodyEndpoint","pathname","exactMatch","isMatch","test","onRequest","url","URL","method","isHealthRoute","buildCorsHeaders","allowedOrigin","rawBodyEndpoint","corsHeaders","Response","status","text","result","handler","Object","entries","set","body","statusText","formatted","formatHttpError","promClientMod","prom","collectDefaultMetrics","register","metrics","contentType","yogaRoutes","shouldHandleByYoga","yogaResponse","fetch","csrfSkipRoutes","loginEndpoints","enableCSRF","enableSessionSecurity","healthResponse","service","version","serviceVersion","timestamp","toISOString","getSchema","query","exportAll","types","entityTypes","exportEntities","exportRelationships","createHttpErrorResponse","post","put","patch","delete","host","port","serverInstance","server","start","listen","hostname","elysiaApp","stop","shutdown","disconnect","getInfo","uptime","Math","floor","now","getTime","startedAt","gracefulShutdown","signal","exit","on","configureServerAuth"],"mappings":";;;;;;;;;AA4BA,IAAIA,OAAAA,GAAmC,IAAA;AAEvC,eAAeC,KAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,IAAA,MAAME,YAAAA,GAAe,MAAM,OAAO,oBAAA,CAAA;AAElCF,IAAAA,OAAAA,GAAUE,YAAAA,CAAaD,KAAAA;AACzB,EAAA;AACA,EAAA,OAAOD,OAAAA,EAAAA;AACT;AAPeC,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAgBf,IAAIE,UAAAA,GAAiC,IAAA;AACrC,IAAIC,SAAAA,GAA8B,IAAA;AAElC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeE,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOf,eAAeC,MAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,SAAAA,EAAW;AACd,IAAA,MAAMG,GAAAA,GAAM,MAAM,OAAO,cAAA,CAAA;AAEzBH,IAAAA,SAAAA,GAAaG,IAAgCC,OAAAA,IAAWD,GAAAA;AAC1D,EAAA;AACA,EAAA,OAAOH,SAAAA;AACT;AAPeE,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAsBf,IAAIG,UAAAA,GAAgC,IAAA;AAK7B,SAASC,cAAcC,MAAAA,EAAkB;AAC9CF,EAAAA,UAAAA,GAAaE,MAAAA;AACbC,EAAAA,MAAAA,CAAOC,MAAM,8BAAA,CAAA;AACf;AAHgBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAchB,eAAsBI,qBAAqBC,WAAAA,EAAmB;AAC5D,EAAA,IAAI;AACF,IAAA,MAAMC,EAAAA,GAAK,MAAMf,KAAAA,EAAAA;AACjB,IAAA,MAAMgB,SAAAA,GAAY,MAAMD,EAAAA,CAAGE,MAAAA,CAAOD,UAAUE,UAAAA,CAAW;MACrDC,KAAAA,EAAO;QAAEC,EAAAA,EAAIN;AAAY;KAC3B,CAAA;AAEA,IAAA,IAAI,CAACE,WAAWK,SAAAA,EAAW;AACzBV,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;AAAEE,QAAAA;OAAY,CAAA;AAC7E,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOQ,KAAKC,KAAAA,CAAMD,IAAAA,CAAKE,SAAAA,CAAUR,SAAAA,CAAUK,SAAS,CAAA,CAAA;AACtD,EAAA,CAAA,CAAA,OAASI,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,KAAK,8CAAA,EAAgD;AAAEZ,MAAAA,WAAAA;AAAaW,MAAAA;KAAM,CAAA;AACjF,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAjBsBZ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwBf,SAASc,oBAAAA,GAAAA;AACd,EAAA,IAAI,CAACnB,UAAAA,EAAY;AACfC,IAAAA,aAAAA,CAAc;AAAEI,MAAAA;KAAqB,CAAA;AACrCF,IAAAA,MAAAA,CAAOC,MAAM,6EAAA,CAAA;AACf,EAAA;AACF;AALgBe,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWhB,eAAsBC,uBAAAA,GAAAA;AACpB,EAAA,MAAMC,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,EAAA,MAAM0B,MAAAA,GAAS,MAAMD,OAAAA,CAAQE,cAAAA,CAAe,OAAA,CAAA;AAC5C,EAAA,MAAMC,GAAAA,GAAM,MAAMH,OAAAA,CAAQI,SAAAA,CAAUH,MAAAA,CAAAA;AACpC,EAAA,OAAOE,GAAAA;AACT;AALsBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAetB,eAAsBM,SAAAA,CAAUC,KAAAA,EAAeL,MAAAA,EAAiBM,OAAAA,GAAyB,EAAC,EAAC;AACzF,EAAA,IAAI;AACF,IAAA,MAAM9B,GAAAA,GAAM,MAAMD,MAAAA,EAAAA;AAClB,IAAA,MAAMwB,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AAGtB,IAAA,MAAMiC,OAAAA,GAAU/B,GAAAA,CAAIgC,MAAAA,CAAOH,KAAAA,EAAO;MAAEI,QAAAA,EAAU;KAAK,CAAA;AAEnD,IAAA,IAAI,CAACF,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,IAAY,CAACA,OAAAA,CAAQG,OAAAA,IAAW,OAAOH,OAAAA,CAAQG,OAAAA,KAAY,QAAA,EAAU;AACtG7B,MAAAA,MAAAA,CAAOe,KAAK,mCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,IAAII,MAAAA,EAAQ;AAEV,MAAA,MAAMW,YAAAA,GAAcnC,GAAAA,CAAIoC,MAAAA,CAAOP,KAAAA,EAAOL,QAAQM,OAAAA,CAAAA;AAC9C,MAAA,OAAOO,kBAAkBF,YAAAA,CAAAA;AAC3B,IAAA;AAGA,IAAA,MAAMG,UAAAA,GAAaf,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;AACrC,IAAA,IAAI,CAACS,WAAWE,YAAAA,EAAc;AAC5BnC,MAAAA,MAAAA,CAAOe,KAAK,6CAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAAClB,YAAYK,oBAAAA,EAAsB;AACrCF,MAAAA,MAAAA,CAAOc,MAAM,+DAAA,CAAA;AACb,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,eAAAA,GAAkB,MAAMvC,UAAAA,CAAWK,oBAAAA,CAAqB+B,WAAWE,YAAY,CAAA;AACrF,IAAA,IAAI,CAACC,eAAAA,EAAiB;AACpBpC,MAAAA,MAAAA,CAAOe,KAAK,yCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,aAAAA,GAAgB,MAAMnB,OAAAA,CAAQoB,SAAAA,CAAUF,iBAAiB,OAAA,CAAA;AAC/D,IAAA,MAAMN,cAAc,MAAMZ,OAAAA,CAAQqB,SAAAA,CAAUf,KAAAA,EAAOa,eAAeZ,OAAAA,CAAAA;AAClE,IAAA,OAAOO,iBAAAA,CAAkBF,YAAYD,OAAO,CAAA;AAC9C,EAAA,CAAA,CAAA,OAASW,GAAAA,EAAK;AACZxC,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,qCAAqCyB,GAAAA,CAAAA;AACjD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA7CsBjB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkDtB,eAAsBkB,UAAUjB,KAAAA,EAAa;AAC3C,EAAA,IAAI;AACF,IAAA,MAAMN,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,IAAA,OAAO,MAAMyB,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAPsBiB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAYtB,SAAST,kBAAkBH,OAAAA,EAAmB;AAC5C,EAAA,OAAO;AACLpB,IAAAA,EAAAA,EAAIoB,OAAAA,CAAQa,GAAAA;AACZC,IAAAA,IAAAA,EAAMd,QAAQe,UAAAA,IAAc,MAAA;AAC5BT,IAAAA,YAAAA,EAAcN,OAAAA,CAAQM,YAAAA;AACtBU,IAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBC,IAAAA,MAAAA,EAAQjB,OAAAA,CAAQiB,MAAAA;AAChBC,IAAAA,OAAAA,EAASlB,QAAQ,SAAA;AACnB,GAAA;AACF;AATSG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAcF,SAASgB,UAAUC,KAAAA,EAAoB;AAC5C,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,MAAM,IAAIC,MAAM,gBAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOD,KAAAA;AACT;AALgBD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAUT,SAASG,eAAeC,OAAAA,EAAmE;AAIhG,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfN,IAAAA,WAAAA,EAAaiD,QAAQ/C,SAAAA,CAAUI;AACjC,GAAA;AACF;AAdgB0C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,SAASG,iBACdF,OAAAA,EAAU;AAGVJ,EAAAA,SAAAA,CAAUI,QAAQH,KAAK,CAAA;AAEvB,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAGA,EAAA,OAAOE,OAAAA;AACT;AAZgBE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,SAASC,SAASH,OAAAA,EAAsE;AAI7F,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQI,YAAAA,EAAc/C,EAAAA,EAAI;AAC7B,IAAA,MAAM,IAAIyC,MAAM,kCAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfgD,IAAAA,KAAAA,EAAOL,QAAQI,YAAAA,CAAa/C;AAC9B,GAAA;AACF;AAdgB8C,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAmBT,SAASG,YAAYN,OAAAA,EAA0C;AACpE,EAAA,IAAI,CAACA,OAAAA,CAAQO,MAAAA,EAAQlD,EAAAA,EAAI;AACvB,IAAA,MAAM,IAAIyC,MAAM,4BAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOE,QAAQO,MAAAA,CAAOlD,EAAAA;AACxB;AALgBiD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;ACvQhB,IAAIE,cAAAA,GAA+C,IAAA;AAK5C,SAASC,iBAAiBpC,OAAAA,EAA8B;AAC7DmC,EAAAA,cAAAA,GAAiBnC,OAAAA;AACjBzB,EAAAA,MAAAA,CAAOC,MAAM,4CAAA,CAAA;AACf;AAHgB4D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAQhB,SAASC,SAAAA,CAAUC,SAAkBC,GAAAA,EAAW;AAC9C,EAAA,OAAOD,QAAQE,OAAAA,CAAQC,GAAAA,CAAIF,GAAAA,CAAIG,WAAAA,EAAW,CAAA,IAAOC,MAAAA;AACnD;AAFSN,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAIT,SAASO,aAAAA,CAAcC,UAAkBC,QAAAA,EAAgB;AACvD,EAAA,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAAA,CAAKJ,QAAAA,CAAAA;AACnC,EAAA,MAAMK,cAAAA,GAAiBF,MAAAA,CAAOC,IAAAA,CAAKH,QAAAA,CAAAA;AAEnC,EAAA,IAAIC,cAAAA,CAAeI,MAAAA,KAAWD,cAAAA,CAAeC,MAAAA,EAAQ;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOC,MAAAA,CAAOC,eAAAA,CAAgBN,cAAAA,EAAgBG,cAAAA,CAAAA;AAChD;AATSN,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWF,SAASU,uBAAAA,CACdhB,OAAAA,EACAiB,OAAAA,GAA8BC,OAAAA,CAAQC,IAAI,UAAA,CAAA,EAC1CC,oBAAAA,GAA2CF,OAAAA,CAAQC,IAAI,uBAAA,CAAA,IACrDD,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEvC,EAAA,IAAI,CAACpB,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA,EAAe;AACrC,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIiB,YAAY,YAAA,EAAc;AAC5B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMI,uBACJtB,SAAAA,CAAUC,OAAAA,EAAS,0BAAA,CAAA,IAA+BD,SAAAA,CAAUC,SAAS,sBAAA,CAAA;AACvE,EAAA,IAAI,CAACoB,oBAAAA,IAAwB,CAACC,oBAAAA,EAAsB;AAClD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOf,aAAAA,CAAce,sBAAsBD,oBAAAA,CAAAA;AAC7C;AArBgBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA0BhB,SAASM,gBAAgBtB,OAAAA,EAAgB;AAEvC,EAAA,MAAMuB,YAAAA,GAAexB,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMwB,MAAAA,GAASzB,SAAAA,CAAUC,OAAAA,EAAS,WAAA,CAAA;AAClC,EAAA,MAAMyB,EAAAA,GAAKF,cAAcG,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,IAAAA,EAAAA,IAAUH,MAAAA,IAAUnB,MAAAA;AAE5D,EAAA,OAAO;AACLoB,IAAAA,EAAAA;IACAG,SAAAA,EAAW7B,SAAAA,CAAUC,SAAS,YAAA;AAChC,GAAA;AACF;AAVSsB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAwBT,eAAeO,aAAa7B,OAAAA,EAAgB;AAE1C,EAAA,MAAMV,OAAAA,GAAUS,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAIV,OAAAA,IAAW0B,uBAAAA,CAAwBhB,OAAAA,CAAAA,EAAU;AAG/C/D,IAAAA,MAAAA,CAAOC,MAAM,gEAAA,CAAA;AAEb,IAAA,MAAM4F,SAAAA,GAAY/B,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA,IAAmB,MAAA;AACxD,IAAA,MAAM+B,QAAAA,GAAWhC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AAEpC,IAAA,OAAO;MACLtD,EAAAA,EAAI4C,OAAAA;MACJV,IAAAA,EAAMkD,SAAAA;MACN1D,YAAAA,EAAc2B,SAAAA,CAAUC,SAAS,gBAAA,CAAA;MACjClB,SAAAA,EAAWiB,SAAAA,CAAUC,SAAS,aAAA,CAAA;AAC9BjB,MAAAA,MAAAA,EAAQgB,UAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAC7DhB,MAAAA,OAAAA,EACE8C,cAAc,aAAA,IACdC,QAAAA,KAAa,cAAA,IACbA,QAAAA,KAAa,iBACbA,QAAAA,KAAa;AACjB,KAAA;AACF,EAAA;AAEA,EAAA,IAAIzC,OAAAA,EAAS;AACXrD,IAAAA,MAAAA,CAAOe,KAAK,uFAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAMgF,UAAAA,GAAajC,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AAEtC,EAAA,IAAI,CAACgC,UAAAA,EAAYC,UAAAA,CAAW,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMxE,KAAAA,GAAQuE,UAAAA,CAAWE,SAAAA,CAAU,CAAA,CAAA;AAEnC,EAAA,IAAI;AACFjG,IAAAA,MAAAA,CAAOC,MAAM,iFAAA,CAAA;AACb,IAAA,MAAM4B,OAAAA,GAAU,MAAMN,SAAAA,CAAUC,KAAAA,CAAAA;AAEhC,IAAA,IAAI,CAACK,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLpB,MAAAA,EAAAA,EAAIoB,OAAAA,CAAQpB,EAAAA;MACZkC,IAAAA,EAAM,MAAA;AACNR,MAAAA,YAAAA,EAAcN,OAAAA,CAAQM;AACxB,KAAA;AACF,EAAA,CAAA,CAAA,OAASrB,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,sCAAsCD,KAAAA,CAAAA;AAClD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAzDe8E,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA8Df,SAASM,cAAcnC,OAAAA,EAAgB;AAErC,EAAA,MAAMoC,QAAAA,GAAWrC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AACpC,EAAA,MAAMqC,cAAAA,GAAiBtC,SAAAA,CAAUC,OAAAA,EAAS,mBAAA,CAAA;AAE1C,EAAA,IAAIoC,QAAAA,EAAU;AACZ,IAAA,OAAO;MACL1F,EAAAA,EAAI0F,QAAAA;AACJE,MAAAA,QAAAA,EAAUD,cAAAA,IAAkB;AAC9B,KAAA;AACF,EAAA;AAGA,EAAA,OAAOxC,gBAAgB0C,aAAAA,IAAiB,IAAA;AAC1C;AAdSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASK,oBAAoBxC,OAAAA,EAAgB;AAC3C,EAAA,MAAMN,QAAQK,SAAAA,CAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAEnE,EAAA,IAAIN,KAAAA,EAAO;AACT,IAAA,OAAO;MAAEhD,EAAAA,EAAIgD;AAAM,KAAA;AACrB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARS8C,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASC,gBAAAA,CAAiBzC,SAAkBd,KAAAA,EAAoB;AAE9D,EAAA,MAAM9C,WAAAA,GAAc2D,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEvC,EAAA,IAAI5D,WAAAA,EAAa;AACf,IAAA,OAAO;MAAEM,EAAAA,EAAIN;AAAY,KAAA;AAC3B,EAAA;AAGA,EAAA,IAAI8C,OAAOd,YAAAA,EAAc;AACvB,IAAA,OAAO;AAAE1B,MAAAA,EAAAA,EAAIwC,KAAAA,CAAMd;AAAa,KAAA;AAClC,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAdSqE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAmBT,SAASC,eAAe1C,OAAAA,EAAgB;AACtC,EAAA,MAAM2C,SAAAA,GAAY5C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI2C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEjG,EAAAA,EAAIiG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaT,SAASE,eAAe5C,OAAAA,EAAgB;AACtC,EAAA,MAAM6C,SAAAA,GAAY9C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI6C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEnG,EAAAA,EAAImG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASE,iBAAiB9C,OAAAA,EAAgB;AACxC,EAAA,MAAM+C,OAAAA,GAAUhD,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACnC,EAAA,MAAMgD,QAAAA,GAAWjD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AACpC,EAAA,MAAMiD,QAAAA,GAAWlD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEpC,EAAA,OAAO;IACL+C,OAAAA,EAASA,OAAAA,EAASG,aAAAA,IAAiB7C,MAAAA;IACnC2C,QAAAA,EAAUA,QAAAA,EAAUE,aAAAA,IAAiB7C,MAAAA;AACrC4C,IAAAA,QAAAA,EAAUA,QAAAA,IAAY5C;AACxB,GAAA;AACF;AAVSyC,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAwBT,SAASK,sBAAsBnD,OAAAA,EAAgB;AAC7C,EAAA,MAAMoD,SAAAA,GAAYrD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAGrC,EAAA,IAAI,CAACoD,SAAAA,EAAW;AACd,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMC,YAAAA,GAAetD,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMsD,eAAAA,GAAkBvD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAC3C,EAAA,MAAMuD,eAAAA,GAAkBxD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAE3C,EAAA,OAAO;AACLoD,IAAAA,SAAAA;IACAI,MAAAA,EAAQH,YAAAA,GAAeA,YAAAA,CAAa3B,KAAAA,CAAM,GAAA,CAAA,CAAK+B,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAE/B,IAAAA,EAAI,CAAA,GAAMtB,MAAAA;AACtEsD,IAAAA,SAAAA,EAAWL,eAAAA,GAAkB,IAAIM,IAAAA,CAAKN,eAAAA,CAAAA,GAAmBjD,MAAAA;AACzDwD,IAAAA,SAAAA,EAAWN,eAAAA,GAAkB,IAAIK,IAAAA,CAAKL,eAAAA,CAAAA,GAAmBlD;AAC3D,GAAA;AACF;AAlBS8C,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA0BT,eAAsBW,aAAa9D,OAAAA,EAAgB;AACjD,EAAA,IAAI,CAACH,cAAAA,EAAgB;AACnB,IAAA,MAAM,IAAIV,MAAM,wEAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMD,KAAAA,GAAQ,MAAM2C,YAAAA,CAAa7B,OAAAA,CAAAA;AAGjC,EAAA,MAAMJ,MAAAA,GAASuC,cAAcnC,OAAAA,CAAAA;AAC7B,EAAA,MAAMP,YAAAA,GAAe+C,oBAAoBxC,OAAAA,CAAAA;AACzC,EAAA,MAAM1D,SAAAA,GAAYmG,gBAAAA,CAAiBzC,OAAAA,EAASd,KAAAA,CAAAA;AAC5C,EAAA,MAAM6E,OAAAA,GAAUrB,eAAe1C,OAAAA,CAAAA;AAC/B,EAAA,MAAMgE,OAAAA,GAAUpB,eAAe5C,OAAAA,CAAAA;AAC/B,EAAA,MAAMiE,QAAAA,GAAW3C,gBAAgBtB,OAAAA,CAAAA;AACjC,EAAA,MAAMkE,cAAAA,GAAiBf,sBAAsBnD,OAAAA,CAAAA;AAG7C,EAAA,IAAImE,IAAAA;AACJ,EAAA,IAAItE,eAAesE,IAAAA,EAAM;AACvBA,IAAAA,IAAAA,GAAOtE,cAAAA,CAAesE,IAAAA,CAAKC,wBAAAA,CAAyBpE,OAAAA,CAAAA;AACtD,EAAA;AAGA,EAAA,MAAMqE,GAAAA,GAAMvB,iBAAiB9C,OAAAA,CAAAA;AAC7B,EAAA,IAAIqE,GAAAA,CAAItB,OAAAA,IAAWsB,GAAAA,CAAIrB,QAAAA,IAAYqB,IAAIpB,QAAAA,EAAU;AAC/C,IAAA,IAAIkB,IAAAA,EAAM;AAER,MAAA,IAAIE,GAAAA,CAAItB,OAAAA,EAASoB,IAAAA,CAAKpB,OAAAA,GAAUsB,GAAAA,CAAItB,OAAAA;AACpC,MAAA,IAAIsB,GAAAA,CAAIrB,QAAAA,EAAUmB,IAAAA,CAAKnB,QAAAA,GAAWqB,GAAAA,CAAIrB,QAAAA;AACtC,MAAA,IAAIqB,GAAAA,CAAIpB,QAAAA,EAAUkB,IAAAA,CAAKlB,QAAAA,GAAWoB,GAAAA,CAAIpB,QAAAA;IACxC,CAAA,MAAO;AAELkB,MAAAA,IAAAA,GAAO;QACLG,MAAAA,EAAQ,OAAA;QACRC,QAAAA,EAAU,IAAA;AACVxB,QAAAA,OAAAA,EAASsB,GAAAA,CAAItB,OAAAA;AACbC,QAAAA,QAAAA,EAAUqB,GAAAA,CAAIrB,QAAAA;AACdC,QAAAA,QAAAA,EAAUoB,GAAAA,CAAIpB,QAAAA;QACduB,CAAAA,kBAAG,MAAA,CAAA,CAACvE,QAAgBA,GAAAA,EAAjB,GAAA,CAAA;QACHwE,EAAAA,kBAAI,MAAA,CAAA,CAACxE,QAAgBA,GAAAA,EAAjB,IAAA,CAAA;AACJyE,QAAAA,YAAAA,kBAAc,MAAA,CAAA,CAACC,KAAAA,KAAkBC,MAAAA,CAAOD,KAAAA,CAAAA,EAA1B,cAAA,CAAA;AACdE,QAAAA,cAAAA,0BAAiBF,KAAAA,EAAe3B,QAAAA,KAAqB,GAAGA,QAAAA,CAAAA,CAAAA,EAAY2B,KAAAA,CAAAA,CAAAA,EAApD,gBAAA,CAAA;AAChBG,QAAAA,UAAAA,kBAAY,MAAA,CAAA,CAACC,IAAAA,KAAwBH,MAAAA,CAAOG,IAAAA,CAAAA,EAAhC,YAAA,CAAA;AACZC,QAAAA,kBAAAA,0BAAqBL,KAAAA,EAAeM,IAAAA,KAAsC,GAAGN,KAAAA,CAAAA,CAAAA,EAASM,IAAAA,CAAAA,CAAAA,EAAlE,oBAAA;AACtB,OAAA;AACF,IAAA;AACF,EAAA;AAKA,EAAA,MAAMC,UAAAA,GAAAA,CACHhG,KAAAA,EAAON,IAAAA,KAAS,KAAA,IAASM,OAAON,IAAAA,KAAS,SAAA,IAAaM,KAAAA,EAAON,IAAAA,KAAS,iBAAA,KACvEsF,cAAAA,EAAgBd,SAAAA,GACZc,cAAAA,CAAed,YACflE,KAAAA,EAAOxC,EAAAA;AAIb,EAAA,MAAMyI,YAAAA,GAAe;AACnB/I,IAAAA,WAAAA,EAAaE,SAAAA,EAAWI,EAAAA;AACxB0F,IAAAA,QAAAA,EAAUxC,MAAAA,EAAQlD,EAAAA;AAClB4C,IAAAA,OAAAA,EAASJ,KAAAA,EAAOxC,EAAAA;AAChBoF,IAAAA,SAAAA,EAAW5C,KAAAA,EAAON,IAAAA;AAClBwG,IAAAA,cAAAA,EAAgB3F,YAAAA,EAAc/C,EAAAA;AAC9BiG,IAAAA,SAAAA,EAAWoB,OAAAA,EAASrH,EAAAA;AACpBwI,IAAAA;AACF,GAAA;AAEAjJ,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxDE,IAAAA,WAAAA,EAAa+I,aAAa/I,WAAAA,IAAe,MAAA;AACzCkD,IAAAA,OAAAA,EAAS6F,aAAa7F,OAAAA,IAAW,MAAA;IACjC+F,SAAAA,EAAWtF,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA,IAAqB;GACrD,CAAA;AAEAsF,EAAAA,mBAAAA,CAAoBH,YAAAA,CAAAA;AAEpB,EAAA,OAAO;AACLnF,IAAAA,OAAAA;AACAd,IAAAA,KAAAA;AACAU,IAAAA,MAAAA;AACAH,IAAAA,YAAAA;AACAnD,IAAAA,SAAAA;AACAyH,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,cAAAA,EAAgBA,cAAAA,IAAkB7D,MAAAA;IAClC6E,UAAAA,EAAYA,UAAAA,IAAchG,OAAOxC,EAAAA,IAAM,EAAA;AACvCL,IAAAA,EAAAA,EAAIwD,eAAevE,KAAAA,EAAK;AACxB6I,IAAAA,IAAAA;AACAoB,IAAAA,eAAAA,EAAiB,IAAIC,OAAAA;AACvB,GAAA;AACF;AA7FsB1B,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAkGf,SAAS2B,iBAAAA,GAAAA;AACd,EAAA,OAAO5F,cAAAA;AACT;AAFgB4F,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;AC7ZhB,IAAMC,iBAAAA,GAAoB;AACxB,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA;;AAGK,SAASC,oBAAAA,CACdC,SACAC,WAAAA,EAAiE;AAEjE,EAAA,MAAMC,UAAAA,GAAAA,CAAcC,MAAMC,OAAAA,CAAQJ,OAAAA,IAAWA,OAAAA,GAAUA,OAAAA,EAASlE,MAAM,GAAA,CAAA,IAAQ,EAAA,EAC3E+B,GAAAA,CAAI,CAACwC,MAAAA,KAAWA,MAAAA,CAAOtE,MAAI,CAAA,CAC3BuE,OAAOC,OAAAA,CAAAA;AAEV,EAAA,IAAIL,UAAAA,CAAWjF,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAOgF,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,IAAII,UAAAA,CAAWM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAC5B,IAAA,OAAOP,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,OAAOI,UAAAA;AACT;AAjBgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAmBT,SAASU,wBAAAA,CAAyBC,eAA8BC,cAAAA,EAAwB;AAC7F,EAAA,IAAI,CAACD,aAAAA,EAAe;AAClB,IAAA,OAAOC,cAAAA,CAAe,CAAA,CAAA,IAAM,IAAA;AAC9B,EAAA;AAEA,EAAA,OAAOA,cAAAA,CAAeH,QAAAA,CAASE,aAAAA,CAAAA,GAAiBA,aAAAA,GAAgB,IAAA;AAClE;AANgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASG,qBAAqBtH,KAAAA,EAAoB;AACvD,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOA,KAAAA,CAAMF,YAAY,IAAA,IAAQ;AAAC,IAAA,SAAA;AAAW,IAAA;AAAeoH,GAAAA,CAAAA,QAAAA,CAASlH,MAAMN,IAAI,CAAA;AACjF;AANgB4H,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;;;ACZhB,IAAIC,eAAAA,GAA+B,IAAA;AAKnC,eAAsBC,aAAaC,UAAAA,EAA4B;AAC7D,EAAA,MAAM,EACJ3K,MAAAA,EACA4K,YAAAA,EACAC,MAAAA,EACAC,WAAAA,EACAC,aAAAA,EACAC,WAAAA,EACAlD,YAAAA,EAAcmD,kBAAAA,EACdC,wBAAAA,EACAC,yBAAAA,EACAC,UAAAA,EAAU,GACRT,UAAAA;AAGJ,EAAA,MAAM,EAAEU,MAAAA,EAAM,GAAK,MAAM,OAAO,QAAA,CAAA;AAChC,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,oBAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,IAAAA,EAAI,GAAK,MAAM,OAAO,gBAAA,CAAA;AAC9B,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,cAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,oBAAoBnM,KAAAA,EAAAA,MAAAA,EAAOoM,oBAAkB,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvE,EAAA,MAAM,EAAEC,oBAAAA,EAAoB,GAAK,MAAM,OAAO,wBAAA,CAAA;AAC9C,EAAA,MAAM,EAAEC,mBAAAA,EAAmB,GAAK,MAAM,OAAO,2BAAA,CAAA;AAC7C,EAAA,MAAM,EAAEC,0BAAAA,EAAAA,2BAAAA,EAA0B,GAAK,MAAM,OAAO,gCAAA,CAAA;AAEpD5L,EAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,sBAAA,EAAyB9L,MAAAA,CAAO+L,WAAW,CAAA,GAAA,CAAK,CAAA;AAG5D,EAAA,MAAMC,QAAAA,GACJhM,MAAAA,CAAOgM,QAAAA,KACNhM,MAAAA,CAAO+L,YAAY9F,UAAAA,CAAW,SAAA,CAAA,GAC3B,QAAA,GACAjG,MAAAA,CAAO+L,WAAAA,CAAY9F,UAAAA,CAAW,SAAA,IAC5B,QAAA,GACA,QAAA,CAAA;AAIR,EAAA,MAAMgG,iCACJd,yBAAAA,KAA8B,IAAA,GAAO,QAAQA,yBAAAA,KAA8B,KAAA,GAAQ,OAAOa,QAAAA,KAAa,QAAA;AAEzG/L,EAAAA,MAAAA,CAAO6L,KAAK,mCAAA,EAAqC;AAC/CE,IAAAA,QAAAA;IACAE,kBAAAA,EAAoBD;GACtB,CAAA;AAEA,EAAA,MAAM,EAAEE,OAAAA,EAAO,GAAKV,kBAAAA,CAAmBb,YAAAA,EAAc5K,OAAO+L,WAAAA,EAAa;IACvEK,wBAAAA,EAA0B,KAAA;IAC1BC,wBAAAA,EAA0BJ,8BAAAA;AAC1B,IAAA,GAAIf,wBAAAA,GAA2B;AAAEA,MAAAA;AAAyB,KAAA,GAAI;GAChE,CAAA;AACA,EAAA,MAAMiB,OAAAA,EAAAA;AAGN,EAAA,IAAIG,YAAAA;AACJ,EAAA,IAAItM,MAAAA,CAAOmI,IAAAA,EAAMoE,OAAAA,IAAWvM,MAAAA,CAAOmI,KAAKqE,WAAAA,EAAa;AACnDvM,IAAAA,MAAAA,CAAO6L,KAAK,+BAAA,CAAA;AACZQ,IAAAA,YAAAA,GAAe,IAAIG,IAAAA,CAAK;MACtBC,aAAAA,EAAe1M,MAAAA,CAAOmI,KAAKuE,aAAAA,IAAiB,OAAA;MAC5CC,cAAAA,EAAgB3M,MAAAA,CAAOmI,KAAKwE,cAAAA,IAAkB,OAAA;AAC9CH,MAAAA,WAAAA,EAAaxM,OAAOmI,IAAAA,CAAKqE,WAAAA;AACzBI,MAAAA,gBAAAA,EAAkB5M,OAAOmI,IAAAA,CAAKyE,gBAAAA;MAC9BC,SAAAA,EAAW7M,MAAAA,CAAOmI,IAAAA,CAAK0E,SAAAA,IAAa7M,MAAAA,CAAO+L,WAAAA;AAC3Ce,MAAAA,QAAAA,EAAU9M,OAAOmI,IAAAA,CAAK2E,QAAAA;MACtBC,UAAAA,EAAY/M,MAAAA,CAAOmI,KAAK4E,UAAAA,IAAc,IAAA;MACtCC,WAAAA,EAAa,IAAA;MACbC,kBAAAA,EAAoB;KACtB,CAAA;AACA,IAAA,MAAMX,aAAaY,UAAAA,EAAU;AAC7BjN,IAAAA,MAAAA,CAAO6L,IAAAA,CAAK,2CAA2CQ,YAAAA,CAAaa,mBAAAA,GAAsBC,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAO,CAAA;AACxG,EAAA;AAGAtJ,EAAAA,gBAAAA,CAAiB;IACfxE,KAAAA,kBAAO,MAAA,CAAA,MAAMA,QAAAA,EAAN,OAAA,CAAA;IACP6I,IAAAA,EAAMmE;GACR,CAAA;AAGArL,EAAAA,oBAAAA,EAAAA;AAGA,EAAA,IAAI6J,WAAAA,EAAa;AACf7K,IAAAA,MAAAA,CAAO6L,KAAK,uCAAA,CAAA;AACZ,IAAA,MAAMhB,YAAYoC,UAAAA,EAAU;AAC9B,EAAA;AAGA,EAAA,MAAMG,KAAAA,GAAQrN,OAAO6J,WAAAA,KAAgB,YAAA;AACrC,EAAA,MAAMyD,gBAAAA,GAAmBtN,OAAOsN,gBAAAA,IAAoBD,KAAAA;AAGpD,EAAA,MAAME,qBAAAA,GAAwBvN,MAAAA,CAAOwN,cAAAA,EAAgBjB,OAAAA,IAAWP,QAAAA,KAAa,QAAA;AAC7E/L,EAAAA,MAAAA,CAAO6L,KAAK,CAAA,mBAAA,EAAsBE,QAAAA,sBAA8BuB,qBAAAA,GAAwB,SAAA,GAAY,UAAA,CAAA,CAAY,CAAA;AAEhH,EAAA,MAAME,wBAAwBF,qBAAAA,GAC1B;IACE1B,2BAAAA,CAA2B;MACzBU,OAAAA,EAAS,IAAA;AACTmB,MAAAA,qBAAAA,EAAuB1N,OAAOwN,cAAAA,EAAgBE;KAChD;MAEF,EAAA;AAGJ,EAAA,MAAMC,eAAAA,GAAkB3N,OAAO2N,eAAAA,IAAmB,UAAA;AAClD1N,EAAAA,MAAAA,CAAO6L,KAAK,0DAAA,CAAA;AAEZ,EAAA,MAAM8B,qBAAAA,GAAoC;AACxCC,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEC,QAAAA,EAAUC,aAAAA,EAAa,KAAkD;AACtF,MAAA,MAAMC,WAAAA,GAAcD,aAAAA;AACpB,MAAA,IAAIC,aAAazE,eAAAA,EAAiB;AAChCyE,QAAAA,WAAAA,CAAYzE,eAAAA,CAAgB0E,OAAAA,CAAQ,CAACtF,KAAAA,EAAe1E,GAAAA,KAAAA;AAClD6J,UAAAA,QAAAA,CAAS5J,OAAAA,CAAQgK,MAAAA,CAAOjK,GAAAA,EAAK0E,KAAAA,CAAAA;QAC/B,CAAA,CAAA;AACF,MAAA;IACF,CAAA,EAPY,YAAA;AAQd,GAAA;AAEA,EAAA,MAAMwF,OAAO3C,UAAAA,CAAiC;AAC5CmC,IAAAA,eAAAA;AACA9C,IAAAA,MAAAA;IACAuD,QAAAA,EAAUd,gBAAAA;IACVe,OAAAA,EAAS;AACPnO,MAAAA,KAAAA,6BAAWoO,IAAAA,KAASrO,MAAAA,CAAOC,MAAM,WAAA,EAAA,GAAgBoO,IAAAA,CAAAA,EAA1C,OAAA,CAAA;AACPxC,MAAAA,IAAAA,6BAAUwC,IAAAA,KAASrO,MAAAA,CAAO6L,KAAK,WAAA,EAAA,GAAgBwC,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNtN,MAAAA,IAAAA,6BAAUsN,IAAAA,KAASrO,MAAAA,CAAOe,KAAK,WAAA,EAAA,GAAgBsN,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNvN,MAAAA,KAAAA,6BAAWuN,IAAAA,KAASrO,MAAAA,CAAOc,MAAM,WAAA,EAAA,GAAgBuN,IAAAA,CAAAA,EAA1C,OAAA;AACT,KAAA;IACAC,OAAAA,EAAS;MACPC,8BAAAA,CAA+B;AAAEzC,QAAAA,WAAAA,EAAa/L,MAAAA,CAAO+L,WAAAA;AAAalC,QAAAA,WAAAA,EAAa7J,MAAAA,CAAO6J;OAAY,CAAA;AAC/F4D,MAAAA,GAAAA,qBAAAA;AACHG,MAAAA,qBAAAA;AACI5C,MAAAA,GAAAA,WAAAA,IAAe;;IAErB3H,OAAAA,kBAAS,MAAA,CAAA,OAAO,EAAEW,OAAAA,EAAO,KAAE;AAEzB,MAAA,MAAMyK,cAAAA,GAAiB,MAAM3G,YAAAA,CAAa9D,OAAAA,CAAAA;AAG1C,MAAA,IAAIiH,kBAAAA,EAAoB;AACtB,QAAA,OAAOA,mBAAmBwD,cAAAA,CAAAA;AAC5B,MAAA;AAEA,MAAA,OAAOA,cAAAA;IACT,CAAA,EAVS,SAAA;GAWX,CAAA;AAGA,EAAA,MAAMC,GAAAA,GAAM,IAAIrD,MAAAA,CAAO;IAAEsD,OAAAA,EAASrD;GAAW,CAAA;AAG7C,EAAA,MAAMsD,WAAAA,GAAcjF,oBAAAA,CAAqB3J,MAAAA,CAAO4O,WAAAA,EAAa5O,OAAO6J,WAAW,CAAA;AAE/E6E,EAAAA,GAAAA,CAAIG,IACFtD,IAAAA,CAAK;IACHtB,MAAAA,EAAQ2E,WAAAA;AACRE,IAAAA,WAAAA,EAAaF,YAAY/J,MAAAA,GAAS,CAAA;IAClCkK,cAAAA,EAAgB;AACd,MAAA,cAAA;AACA,MAAA,eAAA;AACA,MAAA,aAAA;AACA,MAAA,gBAAA;AACA,MAAA,UAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,gBAAA;AACA,MAAA,iBAAA;AACA,MAAA,UAAA;AACA,MAAA,YAAA;AACA,MAAA,eAAA;AACA,MAAA,gBAAA;AACA,MAAA,gBAAA;;AAEA,MAAA,YAAA;AACA,MAAA,cAAA;AACA,MAAA,0BAAA;AACA,MAAA;;IAEFC,OAAAA,EAAS;AAAC,MAAA,KAAA;AAAO,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,OAAA;AAAS,MAAA,QAAA;AAAU,MAAA;;AACrD,GAAA,CAAA,CAAA;AAIF,EAAA,MAAMC,gBAAAA,GAAAA,CAAoBlE,iBAAiB,EAAA,EAAIb,OAAO,CAACgF,EAAAA,KAAOA,GAAGC,OAAO,CAAA;AACxE,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIJ,gBAAAA,CAAiBxH,GAAAA,CAAI,CAACyH,EAAAA,KAAO;IAACA,EAAAA,CAAGI,IAAAA;AAAMJ,IAAAA;GAAG,CAAA,CAAA;AACvE,EAAA,MAAMK,eAAAA,GAAkBN,gBAAAA,CAAiBxH,GAAAA,CAAI,CAACnB,QAAAA,KAAAA;AAC5C,IAAA,MAAMkJ,YAAAA,GAAelJ,QAAAA,CAASgJ,IAAAA,CAAKG,OAAAA,CAAQ,WAAW,OAAA,CAAA;AACtD,IAAA,OAAO;AACLnJ,MAAAA,QAAAA;AACAkJ,MAAAA,YAAAA;AACAE,MAAAA,KAAAA,EAAO,IAAIC,MAAAA,CAAO,CAAA,CAAA,EAAIH,YAAAA,CAAAA,CAAAA,CAAe;AACvC,KAAA;EACF,CAAA,CAAA;AAGA,EAAA,MAAMI,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAE5B,IAAA,MAAMC,UAAAA,GAAaV,YAAAA,CAAajL,GAAAA,CAAI0L,QAAAA,CAAAA;AACpC,IAAA,IAAIC,YAAY,OAAOA,UAAAA;AAGvB,IAAA,KAAA,MAAW,EAAExJ,QAAAA,EAAUoJ,KAAAA,EAAOF,YAAAA,MAAkBD,eAAAA,EAAiB;AAC/D,MAAA,MAAMQ,OAAAA,GAAUL,KAAAA,CAAMM,IAAAA,CAAKH,QAAAA,CAAAA;AAC3B5P,MAAAA,MAAAA,CAAOC,KAAAA,CACL,CAAA,kBAAA,EAAqB2P,QAAAA,CAAAA,iBAAAA,EAA4BvJ,QAAAA,CAASgJ,IAAI,CAAA,SAAA,EAAYE,YAAAA,CAAAA,UAAAA,EAAyBO,OAAAA,CAAAA,CAAS,CAAA;AAE9G,MAAA,IAAIA,OAAAA,EAAS;AACX9P,QAAAA,MAAAA,CAAOC,MAAM,CAAA,iBAAA,EAAoB2P,QAAAA,CAAAA,YAAAA,EAAuBvJ,QAAAA,CAASgJ,IAAI,CAAA,CAAE,CAAA;AACvE,QAAA,OAAOhJ,QAAAA;AACT,MAAA;AACF,IAAA;AAEArG,IAAAA,MAAAA,CAAOC,MAAM,CAAA,wCAAA,EAA2C2P,QAAAA,CAAAA,oBAAAA,EAA+BZ,gBAAAA,CAAiBpK,MAAM,CAAA,CAAE,CAAA;AAChH,IAAA,OAAOR,MAAAA;EACT,CAAA,EAnB6B,sBAAA,CAAA;AAyB7BqK,EAAAA,GAAAA,CAAIuB,SAAAA,CAAU,OAAO,EAAEjM,OAAAA,EAAO,KAAE;AAC9B,IAAA,MAAMkM,GAAAA,GAAM,IAAIC,GAAAA,CAAInM,OAAAA,CAAQkM,GAAG,CAAA;AAC/B,IAAA,MAAML,WAAWK,GAAAA,CAAIL,QAAAA;AACrB5P,IAAAA,MAAAA,CAAOC,MAAM,CAAA,oBAAA,EAAuB8D,OAAAA,CAAQoM,MAAM,CAAA,CAAA,EAAIP,QAAAA,CAAAA,CAAU,CAAA;AAChE,IAAA,MAAMQ,aAAAA,GAAgBR,QAAAA,KAAa,SAAA,IAAaA,QAAAA,CAAS5J,WAAW,UAAA,CAAA;AAGpE,IAAA,MAAMqK,mCAAmB,MAAA,CAAA,MAAA;AACvB,MAAA,MAAMrG,MAAAA,GAASjG,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA,IAAa,GAAA;AAChD,MAAA,MAAMoM,gBAAgBlG,wBAAAA,CAAyBJ,MAAAA,KAAW,GAAA,GAAM,IAAA,GAAOA,QAAQ2E,WAAAA,CAAAA;AAC/E,MAAA,MAAM1K,OAAAA,GAAkC;QACtC,8BAAA,EAAgC,wCAAA;QAChC,8BAAA,EACE;AACJ,OAAA;AAEA,MAAA,IAAIqM,aAAAA,EAAe;AACjBrM,QAAAA,OAAAA,CAAQ,6BAAA,CAAA,GAAiCqM,aAAAA;AACzCrM,QAAAA,OAAAA,CAAQ,kCAAA,CAAA,GAAsC,MAAA;AAChD,MAAA;AAEA,MAAA,OAAOA,OAAAA;IACT,CAAA,EAfyB,kBAAA,CAAA;AAkBzB,IAAA,MAAMsM,eAAAA,GAAkBH,aAAAA,GAAgBhM,MAAAA,GAAYuL,oBAAAA,CAAqBC,QAAAA,CAAAA;AACzE,IAAA,IAAIW,eAAAA,EAAiB;AACnBvQ,MAAAA,MAAAA,CAAOC,MAAM,CAAA,oCAAA,EAAuC2P,QAAAA,CAAAA,IAAAA,EAAeW,eAAAA,CAAgBlB,IAAI,CAAA,CAAE,CAAA;AACzF,MAAA,MAAMmB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAItM,OAAAA,CAAQoM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRzM,OAAAA,EAASuM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,IAAIzM,OAAAA,CAAQoM,MAAAA,KAAWI,eAAAA,CAAgBJ,MAAAA,EAAQ;AAC7C,QAAA,OAAO/L,MAAAA;AACT,MAAA;AAEA,MAAA,IAAI;AAEF,QAAA,MAAM8K,OAAAA,GAAU,MAAMnL,OAAAA,CAAQ4M,IAAAA,EAAI;AAGlC,QAAA,MAAMvN,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AAGnC,QAAA,MAAM6M,SAAS,MAAML,eAAAA,CAAgBM,OAAAA,CAAQ9M,OAAAA,EAASX,SAAS8L,OAAAA,CAAAA;AAG/D,QAAA,IAAI0B,kBAAkBH,QAAAA,EAAU;AAE9B,UAAA,MAAMxM,QAAAA,GAAU,IAAIsF,OAAAA,CAAQqH,MAAAA,CAAO3M,OAAO,CAAA;AAC1C,UAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUoI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDvM,YAAAA,QAAAA,CAAQ+M,GAAAA,CAAIhN,GAAAA,EAAK0E,KAAAA,CAAAA;AACnB,UAAA;AACA,UAAA,OAAO,IAAI+H,QAAAA,CAASG,MAAAA,CAAOK,IAAAA,EAAM;AAC/BP,YAAAA,MAAAA,EAAQE,MAAAA,CAAOF,MAAAA;AACfQ,YAAAA,UAAAA,EAAYN,MAAAA,CAAOM,UAAAA;YACnBjN,OAAAA,EAAAA;WACF,CAAA;AACF,QAAA;AAGA,QAAA,MAAMA,OAAAA,GAAU,IAAIsF,OAAAA,CAAQ;UAC1B,cAAA,EAAgB,kBAAA;UAChB,GAAGiH;SACL,CAAA;AAEA,QAAA,OAAO,IAAIC,QAAAA,CAAS9P,IAAAA,CAAKE,SAAAA,CAAU+P,MAAAA,CAAAA,EAAS;UAC1CF,MAAAA,EAAQ,GAAA;AACRzM,UAAAA;SACF,CAAA;AACF,MAAA,CAAA,CAAA,OAASnD,KAAAA,EAAO;AACdd,QAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,kCAAA,EAAqC8O,QAAAA,CAAAA,EAAAA,CAAAA,EAAc9O,KAAAA,CAAAA;AAChE,QAAA,MAAM0P,eAAcH,gBAAAA,EAAAA;AACpB,QAAA,MAAMc,SAAAA,GAAYC,gBAAgBtQ,KAAAA,EAAO;AACvCgL,UAAAA,WAAAA,EAAa/L,MAAAA,CAAO+L,WAAAA;AACpBlC,UAAAA,WAAAA,EAAa7J,MAAAA,CAAO6J;SACtB,CAAA;AACA,QAAA,OAAO,IAAI6G,QAAAA,CAAS9P,IAAAA,CAAKE,SAAAA,CAAUsQ,SAAAA,CAAUF,IAAI,CAAA,EAAG;AAClDP,UAAAA,MAAAA,EAAQS,SAAAA,CAAUT,MAAAA;UAClBzM,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;YAChB,GAAGuM;AACL;SACF,CAAA;AACF,MAAA;AACF,IAAA;AAMA,IAAA,IAAIZ,QAAAA,KAAa,UAAA,IAAc7L,OAAAA,CAAQoM,MAAAA,KAAW,KAAA,EAAO;AACvD,MAAA,IAAI;AACF,QAAA,MAAMkB,aAAAA,GAAgB,aAAA;AACtB,QAAA,MAAMC,IAAAA,GAAQ,MAAM,OAAOD,aAAAA,CAAAA;AAI3B,QAAA,IAAI;AACFC,UAAAA,IAAAA,CAAKC,qBAAAA,CAAsB;AAAEC,YAAAA,QAAAA,EAAUF,IAAAA,CAAKE;WAAS,CAAA;QACvD,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,MAAMP,IAAAA,GAAO,MAAMK,IAAAA,CAAKE,QAAAA,CAASC,OAAAA,EAAO;AACxC,QAAA,OAAO,IAAIhB,SAASQ,IAAAA,EAAM;UACxBP,MAAAA,EAAQ,GAAA;UACRzM,OAAAA,EAAS;YACP,cAAA,EAAgBqN,IAAAA,CAAKE,SAASE,WAAAA,IAAe;AAC/C;SACF,CAAA;MACF,CAAA,CAAA,MAAQ;AAER,MAAA;AACF,IAAA;AAGA,IAAA,MAAMC,UAAAA,GAAa;AAACjE,MAAAA,eAAAA;AAAiB,MAAA,CAAA,EAAGA,eAAAA,CAAAA,CAAAA,CAAAA;AAAoB,MAAA;;AAC5D,IAAA,MAAMkE,kBAAAA,GAAqBD,UAAAA,CAAWxH,QAAAA,CAASyF,QAAAA,CAAAA;AAE/C,IAAA,IAAIgC,kBAAAA,EAAoB;AACtB,MAAA,MAAMpB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAItM,OAAAA,CAAQoM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRzM,OAAAA,EAASuM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,MAAMqB,YAAAA,GAAe,MAAM3D,IAAAA,CAAK4D,KAAAA,CAAM/N,OAAAA,CAAAA;AAGtC,MAAA,MAAME,OAAAA,GAAU,IAAIsF,OAAAA,CAAQsI,YAAAA,CAAa5N,OAAO,CAAA;AAChD,MAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUoI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDvM,QAAAA,OAAAA,CAAQ+M,GAAAA,CAAIhN,KAAK0E,KAAAA,CAAAA;AACnB,MAAA;AAGA,MAAA,OAAO,IAAI+H,QAAAA,CAASoB,YAAAA,CAAaZ,IAAAA,EAAM;AACrCP,QAAAA,MAAAA,EAAQmB,YAAAA,CAAanB,MAAAA;AACrBQ,QAAAA,UAAAA,EAAYW,YAAAA,CAAaX,UAAAA;AACzBjN,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,OAAOG,MAAAA;EACT,CAAA,CAAA;AAGAqK,EAAAA,GAAAA,CAAIG,GAAAA,CAAIjD,qBAAAA,CAAAA;AAGR8C,EAAAA,GAAAA,CAAIG,IACFlD,oBAAAA,CAAqB;AACnBqG,IAAAA,cAAAA,EAAgBhS,OAAOgS,cAAAA,IAAkB;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW,MAAA;;IACjEC,cAAAA,EAAgBjS,MAAAA,CAAOiS,kBAAkB,EAAA;AACzCC,IAAAA,UAAAA,EAAYlS,OAAOkS,UAAAA,IAAc,KAAA;AACjCC,IAAAA,qBAAAA,EAAuBnS,OAAOmS,qBAAAA,IAAyB;AACzD,GAAA,CAAA,CAAA;AAQF,EAAA,MAAMC,iCAAiB,MAAA,CAAA,OAAO;IAC5BzB,MAAAA,EAAQ,SAAA;AACR0B,IAAAA,OAAAA,EAASrS,MAAAA,CAAO+L,WAAAA;AAChBuG,IAAAA,OAAAA,EAAStS,OAAOuS,cAAAA,IAAkB,OAAA;IAClCC,SAAAA,EAAAA,iBAAW,IAAI5K,IAAAA,EAAAA,EAAO6K,WAAAA;GACxB,CAAA,EALuB,gBAAA,CAAA;AAOvB/D,EAAAA,GAAAA,CAAIvK,GAAAA,CAAI,WAAWiO,cAAAA,CAAAA;AACnB1D,EAAAA,GAAAA,CAAIvK,GAAAA,CAAI,gBAAgBiO,cAAAA,CAAAA;AACxB1D,EAAAA,GAAAA,CAAIvK,GAAAA,CAAI,iBAAiBiO,cAAAA,CAAAA;AACzB1D,EAAAA,GAAAA,CAAIvK,GAAAA,CAAI,mBAAmBiO,cAAAA,CAAAA;AAG3B,EAAA,IAAItH,WAAAA,EAAa;AAEf4D,IAAAA,GAAAA,CAAIvK,IAAI,mBAAA,EAAqB,OAAO,EAAEH,OAAAA,EAASiN,KAAG,KAAE;AAClD,MAAA,MAAM5N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC+N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE5P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,OAAO+J,YAAY4H,SAAAA,EAAS;IAC9B,CAAA,CAAA;AAGAhE,IAAAA,GAAAA,CAAIvK,IAAI,mBAAA,EAAqB,OAAO,EAAEwO,KAAAA,EAAO3O,OAAAA,EAASiN,KAAG,KAAE;AACzD,MAAA,MAAM5N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC+N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE5P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKuS,KAAAA;AACxC,MAAA,OAAO7H,WAAAA,CAAY8H,SAAAA,CAAUxJ,cAAAA,EAAgBhJ,WAAAA,CAAAA;IAC/C,CAAA,CAAA;AAGAsO,IAAAA,GAAAA,CAAIvK,IAAI,qBAAA,EAAuB,OAAO,EAAEwO,KAAAA,EAAO3O,OAAAA,EAASiN,KAAG,KAAE;AAC3D,MAAA,MAAM5N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC+N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE5P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAayS,KAAAA,EAAK,GAAKF,KAAAA;AAK/C,MAAA,MAAMG,WAAAA,GAAcD,KAAAA,EAAOnN,KAAAA,CAAM,GAAA,CAAA,CAAK+B,IAAI,CAACe,CAAAA,KAAMA,CAAAA,CAAE7C,IAAAA,EAAI,CAAA;AACvD,MAAA,OAAOmF,WAAAA,CAAYiI,cAAAA,CAAe3J,cAAAA,EAAgBhJ,WAAAA,EAAa0S,WAAAA,CAAAA;IACjE,CAAA,CAAA;AAGApE,IAAAA,GAAAA,CAAIvK,IAAI,0BAAA,EAA4B,OAAO,EAAEwO,KAAAA,EAAO3O,OAAAA,EAASiN,KAAG,KAAE;AAChE,MAAA,MAAM5N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAACwG,oBAAAA,CAAqBnH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxC+N,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE5P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKuS,KAAAA;AACxC,MAAA,OAAO7H,WAAAA,CAAYkI,mBAAAA,CAAoB5J,cAAAA,EAAgBhJ,WAAAA,CAAAA;IACzD,CAAA,CAAA;AACF,EAAA;AAGA,EAAA,IAAI2K,aAAAA,IAAiBA,aAAAA,CAAclG,MAAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,KAAA,MAAWyB,YAAYyE,aAAAA,EAAe;AAEpC,MAAA,IAAIzE,SAAS6I,OAAAA,EAAS;AACpBlP,QAAAA,MAAAA,CAAO6L,KAAK,CAAA,uCAAA,EAA0CxF,QAAAA,CAAS8J,MAAM,CAAA,CAAA,EAAI9J,QAAAA,CAASgJ,IAAI,CAAA,CAAE,CAAA;AACxF,QAAA;AACF,MAAA;AAEA,MAAA,MAAMwB,OAAAA,mBAAU,MAAA,CAAA,OAAO,EAAE9M,OAAAA,EAAO,KAAwB;AACtD,QAAA,IAAI;AACF,UAAA,MAAMX,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,UAAA,OAAO,MAAMsC,QAAAA,CAASwK,OAAAA,CAAQ9M,OAAAA,EAASX,OAAAA,CAAAA;AACzC,QAAA,CAAA,CAAA,OAAStC,KAAAA,EAAO;AACdd,UAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,8BAAA,EAAiCuF,QAAAA,CAASgJ,IAAI,MAAMvO,KAAAA,CAAAA;AACjE,UAAA,OAAOkS,wBAAwBlS,KAAAA,EAAO;AACpCgL,YAAAA,WAAAA,EAAa/L,MAAAA,CAAO+L,WAAAA;AACpBlC,YAAAA,WAAAA,EAAa7J,MAAAA,CAAO6J;WACtB,CAAA;AACF,QAAA;MACF,CAAA,EAXgB,SAAA,CAAA;AAahB,MAAA,QAAQvD,SAAS8J,MAAAA;QACf,KAAK,KAAA;AACH1B,UAAAA,GAAAA,CAAIvK,GAAAA,CAAImC,QAAAA,CAASgJ,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,MAAA;AACHpC,UAAAA,GAAAA,CAAIwE,IAAAA,CAAK5M,QAAAA,CAASgJ,IAAAA,EAAMwB,OAAAA,CAAAA;AACxB,UAAA;QACF,KAAK,KAAA;AACHpC,UAAAA,GAAAA,CAAIyE,GAAAA,CAAI7M,QAAAA,CAASgJ,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,OAAA;AACHpC,UAAAA,GAAAA,CAAI0E,KAAAA,CAAM9M,QAAAA,CAASgJ,IAAAA,EAAMwB,OAAAA,CAAAA;AACzB,UAAA;QACF,KAAK,QAAA;AACHpC,UAAAA,GAAAA,CAAI2E,MAAAA,CAAO/M,QAAAA,CAASgJ,IAAAA,EAAMwB,OAAAA,CAAAA;AAC1B,UAAA;AACJ;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAMwC,IAAAA,GAAOtT,OAAOsT,IAAAA,IAAQ,SAAA;AAC5B,EAAA,MAAMC,OAAOvT,MAAAA,CAAOuT,IAAAA;AAGpB,EAAA,MAAMC,cAAAA,GAAiC;AACrC9E,IAAAA,GAAAA;IACA+E,MAAAA,EAAQ,IAAA;AACRC,IAAAA,KAAAA,kBAAO,MAAA,CAAA,YAAA;AACLjJ,MAAAA,eAAAA,uBAAsB7C,IAAAA,EAAAA;AAGtB8G,MAAAA,GAAAA,CAAIiF,MAAAA,CAAO;AACTJ,QAAAA,IAAAA;QACAK,QAAAA,EAAUN;OACZ,CAAA;AAIA,MAAA,MAAMO,SAAAA,GAAYnF,GAAAA;AAClB8E,MAAAA,cAAAA,CAAeC,SAASI,SAAAA,CAAUJ,MAAAA;AAElCxT,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,UAAA,EAAM9L,MAAAA,CAAO+L,WAAW,CAAA,sBAAA,EAAyBuH,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,CAAAA,EAAO5F,eAAAA,CAAAA,CAAiB,CAAA;IAC/F,CAAA,EAfO,OAAA,CAAA;AAgBPmG,IAAAA,IAAAA,kBAAM,MAAA,CAAA,YAAA;AACJ7T,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,kBAAA,EAAqB9L,MAAAA,CAAO+L,WAAW,CAAA,GAAA,CAAK,CAAA;AAExD,MAAA,IAAIX,UAAAA,EAAY;AACd,QAAA,MAAMA,UAAAA,EAAAA;AACR,MAAA;AAEA,MAAA,IAAIN,WAAAA,EAAa;AACf,QAAA,MAAMA,YAAYiJ,QAAAA,EAAQ;AAC5B,MAAA;AAEA,MAAA,MAAMrI,kBAAAA,GAAqBsI,UAAAA,EAAU;AAErC,MAAA,IAAIR,eAAeC,MAAAA,EAAQ;AACzBD,QAAAA,cAAAA,CAAeC,OAAOK,IAAAA,EAAI;AAC5B,MAAA;AAEA7T,MAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,SAAA,EAAY9L,MAAAA,CAAO+L,WAAW,CAAA,QAAA,CAAU,CAAA;IACtD,CAAA,EAlBM,MAAA,CAAA;AAmBNkI,IAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAA;AACP,MAAA,MAAMC,MAAAA,GAASzJ,eAAAA,GAAkB0J,IAAAA,CAAKC,KAAAA,CAAAA,CAAOxM,IAAAA,CAAKyM,GAAAA,EAAG,GAAK5J,eAAAA,CAAgB6J,OAAAA,EAAO,IAAM,GAAA,CAAA,GAAQ,CAAA;AAE/F,MAAA,OAAO;AACLvI,QAAAA,WAAAA,EAAa/L,MAAAA,CAAO+L,WAAAA;AACpBwG,QAAAA,cAAAA,EAAgBvS,OAAOuS,cAAAA,IAAkB,OAAA;AACzC1I,QAAAA,WAAAA,EAAa7J,OAAO6J,WAAAA,IAAe,aAAA;AACnC0J,QAAAA,IAAAA;AACAD,QAAAA,IAAAA;AACA3F,QAAAA,eAAAA;QACA4G,SAAAA,EAAW9J,eAAAA,EAAiBgI,aAAAA,IAAiB,EAAA;AAC7CyB,QAAAA;AACF,OAAA;IACF,CAAA,EAbS,SAAA;AAcX,GAAA;AAGA,EAAA,MAAMM,gBAAAA,iCAA0BC,MAAAA,KAAAA;AAC9BxU,IAAAA,MAAAA,CAAO6L,IAAAA,CAAK,CAAA,SAAA,EAAY2I,MAAAA,CAAAA,sCAAAA,CAA8C,CAAA;AACtE,IAAA,MAAMjB,eAAeM,IAAAA,EAAI;AACzB5O,IAAAA,OAAAA,CAAQwP,KAAK,CAAA,CAAA;EACf,CAAA,EAJyB,kBAAA,CAAA;AAMzBxP,EAAAA,OAAAA,CAAQyP,EAAAA,CAAG,WAAW,MAAA;AACpB,IAAA,KAAKH,iBAAiB,SAAA,CAAA;EACxB,CAAA,CAAA;AACAtP,EAAAA,OAAAA,CAAQyP,EAAAA,CAAG,UAAU,MAAA;AACnB,IAAA,KAAKH,iBAAiB,QAAA,CAAA;EACxB,CAAA,CAAA;AAEA,EAAA,OAAOhB,cAAAA;AACT;AAlkBsB9I,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAykBf,SAASkK,oBAAoBzU,qBAAAA,EAA4C;AAC9EJ,EAAAA,aAAAA,CAAc;IAAEI,oBAAAA,EAAAA;GAAqB,CAAA;AACvC;AAFgByU,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * Server Auth Module\n *\n * JWT verification with workspace secret fetching for microservices.\n * Handles HS256 tokens with secrets stored in workspace database.\n */\n\nimport { logger } from '../logger/index.js';\nimport type { IActor, JWTPayload, WorkspaceSecret } from './types.js';\n\n// Type imports from packages\nimport type * as jose from 'jose';\nimport type { VerifyOptions, Jwt, JwtPayload } from 'jsonwebtoken';\n\n/**\n * Workspace model interface for fetching JWT secrets\n */\ninterface WorkspaceModel {\n  findUnique: (args: { where: { id: string } }) => Promise<{ jwtSecret?: unknown } | null>;\n}\n\ninterface DbClient {\n  client: {\n    workspace: WorkspaceModel;\n  };\n}\n\n// Import getDb dynamically to avoid circular dependencies\nlet getDbFn: (() => DbClient) | null = null;\n\nasync function getDb(): Promise<DbClient> {\n  if (!getDbFn) {\n    const prismaModule = await import('../prisma/index.js');\n    // Use unknown first then cast to avoid type inference issues\n    getDbFn = prismaModule.getDb as unknown as () => DbClient;\n  }\n  return getDbFn();\n}\n\n// Interface for the subset of jsonwebtoken we use\ninterface JwtModule {\n  decode(token: string, options?: { complete?: boolean }): string | Jwt | JwtPayload | null;\n  verify(token: string, secretOrPublicKey: string, options?: VerifyOptions): string | JwtPayload;\n}\n\n// Module cache for dynamic imports\nlet joseModule: typeof jose | null = null;\nlet jwtModule: JwtModule | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\nasync function getJwt(): Promise<JwtModule> {\n  if (!jwtModule) {\n    const jwt = await import('jsonwebtoken');\n    // Handle both ESM and CJS module formats\n    jwtModule = (jwt as { default?: JwtModule }).default ?? jwt;\n  }\n  return jwtModule;\n}\n\n/**\n * Fetch workspace secret callback type\n */\nexport type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig {\n  /** Function to fetch workspace JWT secret from database */\n  fetchWorkspaceSecret: FetchWorkspaceSecretFn;\n}\n\nlet authConfig: AuthConfig | null = null;\n\n/**\n * Configure auth module with workspace secret fetching\n */\nexport function configureAuth(config: AuthConfig): void {\n  authConfig = config;\n  logger.debug('[ServerAuth] Auth configured');\n}\n\n/**\n * Default workspace secret fetcher\n *\n * Fetches JWT secret from workspace database. This is the standard implementation\n * that works with any microservice that has access to the workspace model.\n *\n * @param workspaceId - Workspace ID from JWT\n * @returns WorkspaceSecret or null if not found\n */\nexport async function fetchWorkspaceSecret(workspaceId: string): Promise<WorkspaceSecret | null> {\n  try {\n    const db = await getDb();\n    const workspace = await db.client.workspace.findUnique({\n      where: { id: workspaceId },\n    });\n\n    if (!workspace?.jwtSecret) {\n      logger.debug('[ServerAuth] No JWT secret found for workspace', { workspaceId });\n      return null;\n    }\n\n    return JSON.parse(JSON.stringify(workspace.jwtSecret)) as WorkspaceSecret;\n  } catch (error) {\n    logger.warn('[ServerAuth] Error fetching workspace secret', { workspaceId, error });\n    return null;\n  }\n}\n\n/**\n * Configure auth with default workspace secret fetcher\n *\n * This is automatically called by createServer if no custom auth is configured.\n */\nexport function configureDefaultAuth(): void {\n  if (!authConfig) {\n    configureAuth({ fetchWorkspaceSecret });\n    logger.debug('[ServerAuth] Default auth configured with built-in workspace secret fetcher');\n  }\n}\n\n/**\n * Generate a symmetric secret key for JWT signing\n * @returns JWK object with the generated key\n */\nexport async function generateSymmetricSecret(): Promise<jose.JWK> {\n  const joseLib = await getJose();\n  const secret = await joseLib.generateSecret('HS256');\n  const jwk = await joseLib.exportJWK(secret);\n  return jwk;\n}\n\n/**\n * Verify JWT token for workspace-scoped authentication\n *\n * @param token - JWT token to verify\n * @param secret - Optional secret for verification (if not provided, fetches from workspace)\n * @param options - JWT verification options\n * @returns Verified actor information or null if invalid\n */\nexport async function verifyJWT(token: string, secret?: string, options: VerifyOptions = {}): Promise<IActor | null> {\n  try {\n    const jwt = await getJwt();\n    const joseLib = await getJose();\n\n    // Decode to check algorithm and extract workspace_id\n    const decoded = jwt.decode(token, { complete: true });\n\n    if (!decoded || typeof decoded === 'string' || !decoded.payload || typeof decoded.payload !== 'object') {\n      logger.warn('[ServerAuth] Invalid token format');\n      return null;\n    }\n\n    // For workspace-scoped HS256 tokens\n    if (secret) {\n      // Use provided secret\n      const verifiedJwt = jwt.verify(token, secret, options) as JWTPayload;\n      return mapPayloadToActor(verifiedJwt);\n    }\n\n    // Fetch secret from workspace database\n    const decodedJwt = joseLib.decodeJwt(token) as JWTPayload;\n    if (!decodedJwt.workspace_id) {\n      logger.warn('[ServerAuth] No workspace_id found in token');\n      return null;\n    }\n\n    if (!authConfig?.fetchWorkspaceSecret) {\n      logger.error('[ServerAuth] Auth not configured - call configureAuth() first');\n      return null;\n    }\n\n    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);\n    if (!workspaceSecret) {\n      logger.warn('[ServerAuth] Workspace secret not found');\n      return null;\n    }\n\n    const keyLikeSecret = await joseLib.importJWK(workspaceSecret, 'HS256');\n    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options as jose.JWTVerifyOptions);\n    return mapPayloadToActor(verifiedJwt.payload as unknown as JWTPayload);\n  } catch (err) {\n    logger.warn('[ServerAuth] Error verifying JWT:', err);\n    return null;\n  }\n}\n\n/**\n * Decode JWT without verification (for extracting claims)\n */\nexport async function decodeJWT(token: string): Promise<JWTPayload | null> {\n  try {\n    const joseLib = await getJose();\n    return await joseLib.decodeJwt(token);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Map JWT payload to IActor interface\n */\nfunction mapPayloadToActor(payload: JWTPayload): IActor {\n  return {\n    id: payload.sub,\n    type: payload.actor_type ?? 'user',\n    workspace_id: payload.workspace_id,\n    tenant_id: payload.tenant_id,\n    org_id: payload.org_id,\n    isAdmin: payload['isAdmin'] as boolean | undefined,\n  };\n}\n\n/**\n * Check if actor is authenticated\n */\nexport function authCheck(actor: IActor | null): IActor {\n  if (!actor) {\n    throw new Error('Please sign in');\n  }\n  return actor;\n}\n\n/**\n * Check workspace context and return actor ID and workspace ID\n */\nexport function workspaceCheck(context: { actor: IActor | null; workspace: { id: string } | null }): {\n  actorId: string;\n  workspaceId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  return {\n    actorId: actor.id,\n    workspaceId: context.workspace.id,\n  };\n}\n\n/**\n * Require workspace context - type narrowing guard for wspace layer services\n *\n * Validates that both actor and workspace are present in the context,\n * and returns a type-narrowed context where workspace and actor are guaranteed non-null.\n * Use this at the start of resolvers in wspace services to get typed access\n * to workspace context without optional chaining.\n *\n * @throws Error if actor is not authenticated\n * @throws Error if workspace context is missing\n *\n * @example\n * ```typescript\n * // In a resolver:\n * const ctx = requireWorkspace(context);\n * const workspaceId = ctx.workspace.id;  // no optional chaining needed\n * const actorId = ctx.actor.id;          // no optional chaining needed\n * ```\n */\nexport function requireWorkspace<T extends { actor: IActor | null; workspace: { id: string } | null }>(\n  context: T\n): T & { actor: IActor; workspace: { id: string } } {\n  // Validate actor is authenticated (throws if null)\n  authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  // Return the same context object with narrowed types\n  return context as T & { actor: IActor; workspace: { id: string } };\n}\n\n/**\n * Check organization context and return actor ID and org ID\n */\nexport function orgCheck(context: { actor: IActor | null; organization: { id: string } | null }): {\n  actorId: string;\n  orgId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.organization?.id) {\n    throw new Error('Please switch to an organization');\n  }\n\n  return {\n    actorId: actor.id,\n    orgId: context.organization.id,\n  };\n}\n\n/**\n * Check tenant context and return tenant ID\n */\nexport function tenantCheck(context: { tenant: { id: string } | null }): string {\n  if (!context.tenant?.id) {\n    throw new Error('Tenant context is required');\n  }\n  return context.tenant.id;\n}\n\n/**\n * Get effective actor ID for \"on behalf of\" tracking\n *\n * When an app or service acts with user consent, returns the delegating user's ID.\n * Otherwise returns the direct actor ID.\n *\n * This is used to determine the `onBehalfOf` field in database audit trails:\n * - If actor is user → returns user ID (self-action)\n * - If actor is app/service with consent → returns grantedBy user ID\n * - If actor is app/service without consent → returns actor ID (self-action)\n *\n * @param context - GraphQL context with actor and optional consent context\n * @returns Effective actor ID (the responsible principal)\n *\n * @example\n * ```typescript\n * // User acting directly\n * context.actor = { id: \"user-123\", type: \"user\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"user-123\"\n *\n * // Bot acting on behalf of user\n * context.actor = { id: \"bot-456\", type: \"service\" }\n * context.consentContext = { grantedBy: \"user-789\" }\n * getEffectiveActorId(context) // → \"user-789\"\n *\n * // App acting without consent (self-action)\n * context.actor = { id: \"app-abc\", type: \"app\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"app-abc\"\n * ```\n */\nexport function getEffectiveActorId(context: {\n  actor: IActor | null;\n  consentContext?: { grantedBy: string } | null;\n}): string | null {\n  if (!context.actor) {\n    return null;\n  }\n\n  // If actor is app or service acting with user consent, return the delegating user\n  if (\n    (context.actor.type === 'app' || context.actor.type === 'service' || context.actor.type === 'service_account') &&\n    context.consentContext?.grantedBy\n  ) {\n    return context.consentContext.grantedBy;\n  }\n\n  // Otherwise return the direct actor (user self-action or app/service self-action)\n  return context.actor.id;\n}\n","/**\n * Server Context Module\n *\n * Builds GraphQL context from request headers, JWT, and configuration.\n * Automatically populates actor, tenant, workspace, and tracking information.\n *\n * **Actor-Based Authentication:**\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Services verify JWT directly and build actor from payload\n *\n * Uses standard Web API Request (compatible with Bun/Elysia).\n */\n\nimport { logger } from '../logger/index.js';\nimport crypto from 'node:crypto';\nimport { verifyJWT } from './auth.js';\nimport type {\n  GraphQLContext,\n  IActor,\n  ITenant,\n  IOrganization,\n  IWorkspace,\n  IProject,\n  IProduct,\n  ITracking,\n} from './types.js';\nimport type { I18n, I18nContext } from '../i18n/index.js';\nimport { setWorkspaceContext } from '../prisma/workspace-extension.js';\n\n/**\n * Context builder options\n */\nexport interface ContextBuilderOptions {\n  /** Database getter function */\n  getDb: () => unknown;\n  /** Default tenant info (optional) */\n  defaultTenant?: ITenant;\n  /** I18n instance (optional) */\n  i18n?: I18n;\n}\n\nlet contextOptions: ContextBuilderOptions | null = null;\n\n/**\n * Configure context builder\n */\nexport function configureContext(options: ContextBuilderOptions): void {\n  contextOptions = options;\n  logger.debug('[ServerContext] Context builder configured');\n}\n\n/**\n * Extract header value from standard Web API Request\n */\nfunction getHeader(request: Request, key: string): string | undefined {\n  return request.headers.get(key.toLowerCase()) ?? undefined;\n}\n\nfunction compareSecret(provided: string, expected: string): boolean {\n  const providedBuffer = Buffer.from(provided);\n  const expectedBuffer = Buffer.from(expected);\n\n  if (providedBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);\n}\n\nexport function shouldTrustActorHeaders(\n  request: Request,\n  nodeEnv: string | undefined = process.env['NODE_ENV'],\n  expectedGatewayToken: string | undefined = process.env['TRUSTED_GATEWAY_TOKEN'] ??\n    process.env['INTERNAL_SERVICE_TOKEN']\n): boolean {\n  if (!getHeader(request, 'x-actor-id')) {\n    return false;\n  }\n\n  if (nodeEnv === 'production') {\n    return true;\n  }\n\n  const providedGatewayToken =\n    getHeader(request, 'x-internal-service-token') || getHeader(request, 'x-gateway-auth-token');\n  if (!expectedGatewayToken || !providedGatewayToken) {\n    return false;\n  }\n\n  return compareSecret(providedGatewayToken, expectedGatewayToken);\n}\n\n/**\n * Extract tracking information from request\n */\nfunction extractTracking(request: Request): ITracking {\n  // Get IP from various possible headers\n  const forwardedFor = getHeader(request, 'x-forwarded-for');\n  const realIp = getHeader(request, 'x-real-ip');\n  const ip = forwardedFor?.split(',')[0]?.trim() || realIp || undefined;\n\n  return {\n    ip,\n    userAgent: getHeader(request, 'user-agent'),\n  };\n}\n\n/**\n * Extract actor from gateway-injected headers or authorization header\n *\n * **Actor-Based Authentication:**\n * - If x-actor-id header exists, trust it (gateway-authenticated)\n * - Otherwise fall back to JWT verification (direct access in dev)\n *\n * This allows:\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Direct service access with JWT → service verifies JWT itself\n * - Development testing: Direct headers → service trusts headers\n */\nasync function extractActor(request: Request): Promise<IActor | null> {\n  // Check for gateway-injected actor headers first\n  const actorId = getHeader(request, 'x-actor-id');\n\n  if (actorId && shouldTrustActorHeaders(request)) {\n    // Gateway has already verified JWT and populated context headers\n    // Trust the headers (gateway is the security perimeter)\n    logger.debug('[ServerContext] Using gateway-authenticated actor from headers');\n\n    const actorType = getHeader(request, 'x-actor-type') || 'user';\n    const userRole = getHeader(request, 'x-user-role');\n\n    return {\n      id: actorId,\n      type: actorType,\n      workspace_id: getHeader(request, 'x-workspace-id'),\n      tenant_id: getHeader(request, 'x-tenant-id'),\n      org_id: getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id'),\n      isAdmin:\n        actorType === 'super_admin' ||\n        userRole === 'TENANT_ADMIN' ||\n        userRole === 'SUPER_ADMIN' ||\n        userRole === 'PLATFORM_ADMIN',\n    };\n  }\n\n  if (actorId) {\n    logger.warn('[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification');\n  }\n\n  // FALLBACK: No gateway headers, verify JWT directly (dev/testing mode)\n  const authHeader = getHeader(request, 'authorization');\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.substring(7);\n\n  try {\n    logger.debug('[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)');\n    const payload = await verifyJWT(token);\n\n    if (!payload) {\n      return null;\n    }\n\n    // Build actor from JWT payload\n    return {\n      id: payload.id,\n      type: 'user', // Default to 'user' if not specified\n      workspace_id: payload.workspace_id,\n    };\n  } catch (error) {\n    logger.warn('[ServerContext] Invalid JWT token:', error);\n    return null;\n  }\n}\n\n/**\n * Extract tenant from headers\n */\nfunction extractTenant(request: Request): ITenant | null {\n  // Check headers\n  const tenantId = getHeader(request, 'x-tenant-id');\n  const tenantEndpoint = getHeader(request, 'x-tenant-endpoint');\n\n  if (tenantId) {\n    return {\n      id: tenantId,\n      endpoint: tenantEndpoint || '',\n    };\n  }\n\n  // Fall back to default tenant if configured\n  return contextOptions?.defaultTenant || null;\n}\n\n/**\n * Extract organization from headers\n */\nfunction extractOrganization(request: Request): IOrganization | null {\n  const orgId = getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id');\n\n  if (orgId) {\n    return { id: orgId };\n  }\n\n  return null;\n}\n\n/**\n * Extract workspace from headers or actor\n */\nfunction extractWorkspace(request: Request, actor: IActor | null): IWorkspace | null {\n  // Check headers first\n  const workspaceId = getHeader(request, 'x-workspace-id');\n\n  if (workspaceId) {\n    return { id: workspaceId };\n  }\n\n  // Fall back to workspace_id from actor\n  if (actor?.workspace_id) {\n    return { id: actor.workspace_id };\n  }\n\n  return null;\n}\n\n/**\n * Extract project from headers\n */\nfunction extractProject(request: Request): IProject | null {\n  const projectId = getHeader(request, 'x-project-id');\n\n  if (projectId) {\n    return { id: projectId };\n  }\n\n  return null;\n}\n\n/**\n * Extract product from headers\n */\nfunction extractProduct(request: Request): IProduct | null {\n  const productId = getHeader(request, 'x-product-id');\n\n  if (productId) {\n    return { id: productId };\n  }\n\n  return null;\n}\n\n/**\n * Extract geography context from headers\n *\n * Geography headers carry the user's selected location context,\n * used for currency defaults, tax calculations, payment routing,\n * data residency, and regional support.\n *\n * Headers:\n * - x-geo-country: ISO 3166-1 alpha-2 country code (e.g., 'IN', 'US', 'DE')\n * - x-geo-currency: ISO 4217 currency code (e.g., 'INR', 'USD', 'EUR')\n * - x-geo-timezone: IANA timezone (e.g., 'Asia/Kolkata', 'America/New_York')\n */\nfunction extractGeography(request: Request): { country?: string; currency?: string; timezone?: string } {\n  const country = getHeader(request, 'x-geo-country');\n  const currency = getHeader(request, 'x-geo-currency');\n  const timezone = getHeader(request, 'x-geo-timezone');\n\n  return {\n    country: country?.toUpperCase() || undefined,\n    currency: currency?.toUpperCase() || undefined,\n    timezone: timezone || undefined,\n  };\n}\n\n/**\n * Extract consent context from headers\n *\n * When an app or service acts on behalf of a user (with user consent),\n * the gateway forwards consent headers. This function extracts them.\n *\n * Headers:\n * - x-consent-granted-by: Actor ID who granted consent (delegating user)\n * - x-consent-scope: Comma-separated scopes\n * - x-consent-granted-at: ISO timestamp when consent was granted\n * - x-consent-expires-at: ISO timestamp when consent expires\n */\nfunction extractConsentContext(request: Request): import('./types.js').ConsentContext | null {\n  const grantedBy = getHeader(request, 'x-consent-granted-by');\n\n  // If no grantedBy, there's no consent delegation\n  if (!grantedBy) {\n    return null;\n  }\n\n  const scopesHeader = getHeader(request, 'x-consent-scope');\n  const grantedAtHeader = getHeader(request, 'x-consent-granted-at');\n  const expiresAtHeader = getHeader(request, 'x-consent-expires-at');\n\n  return {\n    grantedBy,\n    scopes: scopesHeader ? scopesHeader.split(',').map((s) => s.trim()) : undefined,\n    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : undefined,\n    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : undefined,\n  };\n}\n\n/**\n * Build GraphQL context from standard Web Request\n *\n * Also sets the workspace context in AsyncLocalStorage for automatic\n * Prisma workspaceId injection via the workspace extension.\n */\nexport async function buildContext(request: Request): Promise<GraphQLContext> {\n  if (!contextOptions) {\n    throw new Error('[ServerContext] Context not configured - call configureContext() first');\n  }\n\n  // Extract actor from headers/JWT\n  const actor = await extractActor(request);\n\n  // Extract all context parts\n  const tenant = extractTenant(request);\n  const organization = extractOrganization(request);\n  const workspace = extractWorkspace(request, actor);\n  const project = extractProject(request);\n  const product = extractProduct(request);\n  const tracking = extractTracking(request);\n  const consentContext = extractConsentContext(request);\n\n  // Build i18n context if configured\n  let i18n: I18nContext | undefined;\n  if (contextOptions.i18n) {\n    i18n = contextOptions.i18n.createContextFromRequest(request);\n  }\n\n  // Merge geography context from x-geo-* headers into i18n\n  const geo = extractGeography(request);\n  if (geo.country || geo.currency || geo.timezone) {\n    if (i18n) {\n      // Merge geography fields into existing i18n context\n      if (geo.country) i18n.country = geo.country;\n      if (geo.currency) i18n.currency = geo.currency;\n      if (geo.timezone) i18n.timezone = geo.timezone;\n    } else {\n      // Create minimal i18n context with geography only (when i18n module not configured)\n      i18n = {\n        locale: 'en-US',\n        language: 'en',\n        country: geo.country,\n        currency: geo.currency,\n        timezone: geo.timezone,\n        t: (key: string) => key,\n        tp: (key: string) => key,\n        formatNumber: (value: number) => String(value),\n        formatCurrency: (value: number, currency: string) => `${currency} ${value}`,\n        formatDate: (date: Date | string) => String(date),\n        formatRelativeTime: (value: number, unit: Intl.RelativeTimeFormatUnit) => `${value} ${unit}`,\n      };\n    }\n  }\n\n  // Determine onBehalfOf for audit trails\n  // If actor is app/service with consent → use grantedBy (delegating user)\n  // Otherwise → use actor.id (self-action)\n  const onBehalfOf =\n    (actor?.type === 'app' || actor?.type === 'service' || actor?.type === 'service_account') &&\n    consentContext?.grantedBy\n      ? consentContext.grantedBy\n      : actor?.id;\n\n  // Set workspace context in AsyncLocalStorage for Prisma workspace extension\n  // This enables automatic workspaceId injection on create/update operations\n  const wsCtxPayload = {\n    workspaceId: workspace?.id,\n    tenantId: tenant?.id,\n    actorId: actor?.id,\n    actorType: actor?.type,\n    organizationId: organization?.id,\n    projectId: project?.id,\n    onBehalfOf,\n  };\n\n  logger.debug('[ServerContext] Setting workspace context', {\n    workspaceId: wsCtxPayload.workspaceId ?? 'NONE',\n    actorId: wsCtxPayload.actorId ?? 'NONE',\n    rawHeader: getHeader(request, 'x-workspace-id') ?? 'MISSING',\n  });\n\n  setWorkspaceContext(wsCtxPayload);\n\n  return {\n    request,\n    actor,\n    tenant,\n    organization,\n    workspace,\n    project,\n    product,\n    tracking,\n    consentContext: consentContext || undefined,\n    onBehalfOf: onBehalfOf || actor?.id || '',\n    db: contextOptions.getDb(),\n    i18n,\n    responseHeaders: new Headers(),\n  };\n}\n\n/**\n * Get context options\n */\nexport function getContextOptions(): ContextBuilderOptions | null {\n  return contextOptions;\n}\n","import type { IActor } from './types.js';\n\nconst LOCALHOST_ORIGINS = [\n  'http://localhost:3000',\n  'http://localhost:4000',\n  'http://localhost:5173',\n  'http://127.0.0.1:3000',\n  'http://127.0.0.1:4000',\n  'http://127.0.0.1:5173',\n];\n\nexport function normalizeCorsOrigins(\n  origins: string | string[] | undefined,\n  environment: 'development' | 'staging' | 'production' | undefined\n): string[] {\n  const normalized = (Array.isArray(origins) ? origins : origins?.split(',') || [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\n  if (normalized.length === 0) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  if (normalized.includes('*')) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  return normalized;\n}\n\nexport function resolveAllowedCorsOrigin(requestOrigin: string | null, allowedOrigins: string[]): string | null {\n  if (!requestOrigin) {\n    return allowedOrigins[0] ?? null;\n  }\n\n  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;\n}\n\nexport function canAccessGraphExport(actor: IActor | null): boolean {\n  if (!actor) {\n    return false;\n  }\n\n  return actor.isAdmin === true || ['service', 'super_admin'].includes(actor.type);\n}\n","/**\n * Server Module\n *\n * Main server bootstrapping with Elysia, GraphQL Yoga, and middleware.\n * Uses Bun runtime for high-performance GraphQL services.\n *\n * Provides a simple API for microservices to start a fully configured server.\n */\n\nimport { logger } from '../logger/index.js';\nimport { configureAuth, configureDefaultAuth, type FetchWorkspaceSecretFn } from './auth.js';\nimport { configureContext, buildContext } from './context.js';\nimport type {\n  ServerDefinition,\n  ServerInstance,\n  ServerInfo,\n  ElysiaApp,\n  BunServerHandle,\n  YogaPlugin,\n  GraphQLContext,\n} from './types.js';\nimport { I18n } from '../i18n/index.js';\nimport { canAccessGraphExport, normalizeCorsOrigins, resolveAllowedCorsOrigin } from './security.js';\nimport { createHttpErrorResponse, createHumanReadableErrorPlugin, formatHttpError } from './errors.js';\n\n// Store startup time for uptime calculation\nlet serverStartTime: Date | null = null;\n\n/**\n * Create and configure a server instance using Elysia + GraphQL Yoga\n */\nexport async function createServer(definition: ServerDefinition): Promise<ServerInstance> {\n  const {\n    config,\n    prismaClient,\n    schema,\n    moduleGraph,\n    restEndpoints,\n    yogaPlugins,\n    buildContext: customBuildContext,\n    workspaceExtensionConfig,\n    disableWorkspaceExtension,\n    onShutdown,\n  } = definition;\n\n  // Dynamic imports to avoid requiring these as hard dependencies\n  const { Elysia } = await import('elysia');\n  const { BunAdapter } = await import('elysia/adapter/bun');\n  const { cors } = await import('@elysiajs/cors');\n  const { createYoga } = await import('graphql-yoga');\n  const { initializeDatabase, getDb, getDatabaseManager } = await import('../prisma/index.js');\n  const { createSecurityPlugin } = await import('../middleware/index.js');\n  const { createMetricsPlugin } = await import('../observability/index.js');\n  const { createWorkspaceGuardPlugin } = await import('./workspace-guard.js');\n\n  logger.info(`[Server] Initializing ${config.serviceName}...`);\n\n  // Detect boundary from config or service name — needed before database and guard setup\n  const boundary =\n    config.boundary ??\n    (config.serviceName.startsWith('wspace-')\n      ? 'wspace'\n      : config.serviceName.startsWith('global-')\n        ? 'global'\n        : 'wspace'); // fail-closed: default to wspace (stricter)\n\n  // Initialize database\n  // Workspace extension is auto-disabled for global boundary services unless explicitly enabled\n  const shouldEnableWorkspaceExtension =\n    disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === 'wspace'; // auto-detect: enabled for wspace, disabled for global\n\n  logger.info('[Server] Initializing database...', {\n    boundary,\n    workspaceExtension: shouldEnableWorkspaceExtension,\n  });\n\n  const { connect } = initializeDatabase(prismaClient, config.serviceName, {\n    registerShutdownHandlers: false, // Server manages shutdown handlers itself\n    enableWorkspaceExtension: shouldEnableWorkspaceExtension,\n    ...(workspaceExtensionConfig ? { workspaceExtensionConfig } : {}),\n  });\n  await connect();\n\n  // Initialize i18n if configured\n  let i18nInstance: I18n | undefined;\n  if (config.i18n?.enabled && config.i18n.localesPath) {\n    logger.info('[Server] Initializing i18n...');\n    i18nInstance = new I18n({\n      defaultLocale: config.i18n.defaultLocale || 'en-US',\n      fallbackLocale: config.i18n.fallbackLocale || 'en-US',\n      localesPath: config.i18n.localesPath,\n      supportedLocales: config.i18n.supportedLocales,\n      namespace: config.i18n.namespace || config.serviceName,\n      lazyLoad: config.i18n.lazyLoad,\n      logMissing: config.i18n.logMissing ?? true,\n      enableCache: true,\n      returnKeyOnMissing: true,\n    });\n    await i18nInstance.initialize();\n    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(', ')}`);\n  }\n\n  // Configure context builder\n  configureContext({\n    getDb: () => getDb(),\n    i18n: i18nInstance,\n  });\n\n  // Auto-configure auth with default workspace secret fetcher if not already configured\n  configureDefaultAuth();\n\n  // Initialize module graph if provided\n  if (moduleGraph) {\n    logger.info('[Server] Initializing module graph...');\n    await moduleGraph.initialize();\n  }\n\n  // Determine if playground/introspection should be enabled\n  const isDev = config.environment !== 'production';\n  const enablePlayground = config.enablePlayground ?? isDev;\n\n  // Build workspace guard plugin — auto-enabled for wspace boundary only\n  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === 'wspace';\n  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? 'enabled' : 'disabled'}`);\n\n  const workspaceGuardPlugins = workspaceGuardEnabled\n    ? [\n        createWorkspaceGuardPlugin({\n          enabled: true,\n          whitelistedOperations: config.workspaceGuard?.whitelistedOperations,\n        }),\n      ]\n    : [];\n\n  // Create GraphQL Yoga instance\n  const graphqlEndpoint = config.graphqlEndpoint || '/graphql';\n  logger.info('[Server] Setting up GraphQL Yoga with provided schema...');\n\n  const responseHeadersPlugin: YogaPlugin = {\n    onResponse: ({ response, serverContext }: { response: Response; serverContext: unknown }) => {\n      const yogaContext = serverContext as GraphQLContext;\n      if (yogaContext?.responseHeaders) {\n        yogaContext.responseHeaders.forEach((value: string, key: string) => {\n          response.headers.append(key, value);\n        });\n      }\n    },\n  };\n\n  const yoga = createYoga<{ request: Request }>({\n    graphqlEndpoint,\n    schema, // Use the schema provided by microservice\n    graphiql: enablePlayground,\n    logging: {\n      debug: (...args) => logger.debug('[GraphQL]', ...args),\n      info: (...args) => logger.info('[GraphQL]', ...args),\n      warn: (...args) => logger.warn('[GraphQL]', ...args),\n      error: (...args) => logger.error('[GraphQL]', ...args),\n    },\n    plugins: [\n      createHumanReadableErrorPlugin({ serviceName: config.serviceName, environment: config.environment }),\n      ...workspaceGuardPlugins,\n      responseHeadersPlugin,\n      ...(yogaPlugins || []),\n    ],\n    context: async ({ request }) => {\n      // Build default context\n      const defaultContext = await buildContext(request);\n\n      // Apply custom context builder if provided\n      if (customBuildContext) {\n        return customBuildContext(defaultContext);\n      }\n\n      return defaultContext;\n    },\n  });\n\n  // Create Elysia instance with Bun adapter\n  const app = new Elysia({ adapter: BunAdapter });\n\n  // Register CORS middleware\n  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);\n\n  app.use(\n    cors({\n      origin: corsOrigins,\n      credentials: corsOrigins.length > 0,\n      allowedHeaders: [\n        'Content-Type',\n        'Authorization',\n        'X-Tenant-ID',\n        'X-Workspace-ID',\n        'X-Org-ID',\n        'X-Project-ID',\n        'X-Product-ID',\n        'X-CSRF-Token',\n        'X-Service-Name',\n        'Accept-Language',\n        'X-Locale',\n        'X-Language',\n        'X-Geo-Country',\n        'X-Geo-Currency',\n        'X-Geo-Timezone',\n        // Actor headers (gateway-injected or dev mode)\n        'X-Actor-ID',\n        'X-Actor-Type',\n        'X-Internal-Service-Token',\n        'X-Gateway-Auth-Token',\n      ],\n      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n    })\n  );\n\n  // Collect raw body endpoints for early interception\n  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);\n  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [ep.path, ep]));\n  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {\n    const regexPattern = endpoint.path.replace(/:[^/]+/g, '[^/]+');\n    return {\n      endpoint,\n      regexPattern,\n      regex: new RegExp(`^${regexPattern}$`),\n    };\n  });\n\n  // Helper to match pathname against endpoint patterns (including :param placeholders)\n  const matchRawBodyEndpoint = (pathname: string): (typeof rawBodyEndpoints)[0] | undefined => {\n    // First try exact match (for non-parameterized paths)\n    const exactMatch = rawBodyPaths.get(pathname);\n    if (exactMatch) return exactMatch;\n\n    // Try pattern matching for parameterized paths like /webhooks/slack/:channelId\n    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {\n      const isMatch = regex.test(pathname);\n      logger.debug(\n        `[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`\n      );\n      if (isMatch) {\n        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);\n        return endpoint;\n      }\n    }\n\n    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);\n    return undefined;\n  };\n\n  // Handle GraphQL, metrics, and raw body requests BEFORE any middleware that consumes the body\n  // This is critical because Yoga needs the raw request body stream\n  // and webhook endpoints need raw body for signature verification\n  // onRequest runs before onParse (body parsing) and onBeforeHandle\n  app.onRequest(async ({ request }) => {\n    const url = new URL(request.url);\n    const pathname = url.pathname;\n    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);\n    const isHealthRoute = pathname === '/health' || pathname.startsWith('/health/');\n\n    // Build CORS headers helper\n    const buildCorsHeaders = (): Record<string, string> => {\n      const origin = request.headers.get('origin') || '*';\n      const allowedOrigin = resolveAllowedCorsOrigin(origin === '*' ? null : origin, corsOrigins);\n      const headers: Record<string, string> = {\n        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n        'Access-Control-Allow-Headers':\n          'Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token',\n      };\n\n      if (allowedOrigin) {\n        headers['Access-Control-Allow-Origin'] = allowedOrigin;\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n\n      return headers;\n    };\n\n    // Check if this is a raw body endpoint (webhooks) - now supports parameterized paths\n    const rawBodyEndpoint = isHealthRoute ? undefined : matchRawBodyEndpoint(pathname);\n    if (rawBodyEndpoint) {\n      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight for raw body endpoints\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Only process if method matches\n      if (request.method !== rawBodyEndpoint.method) {\n        return undefined; // Let other handlers deal with it\n      }\n\n      try {\n        // Read raw body BEFORE any parsing\n        const rawBody = await request.text();\n\n        // Build context without consuming body (body already read)\n        const context = await buildContext(request);\n\n        // Call the handler with raw body\n        const result = await rawBodyEndpoint.handler(request, context, rawBody);\n\n        // If handler returns a Response, use it directly\n        if (result instanceof Response) {\n          // Add CORS headers\n          const headers = new Headers(result.headers);\n          for (const [key, value] of Object.entries(corsHeaders)) {\n            headers.set(key, value);\n          }\n          return new Response(result.body, {\n            status: result.status,\n            statusText: result.statusText,\n            headers,\n          });\n        }\n\n        // Otherwise, serialize as JSON\n        const headers = new Headers({\n          'Content-Type': 'application/json',\n          ...corsHeaders,\n        });\n\n        return new Response(JSON.stringify(result), {\n          status: 200,\n          headers,\n        });\n      } catch (error) {\n        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);\n        const corsHeaders = buildCorsHeaders();\n        const formatted = formatHttpError(error, {\n          serviceName: config.serviceName,\n          environment: config.environment,\n        });\n        return new Response(JSON.stringify(formatted.body), {\n          status: formatted.status,\n          headers: {\n            'Content-Type': 'application/json',\n            ...corsHeaders,\n          },\n        });\n      }\n    }\n\n    // Serve Prometheus metrics via prom-client at /metrics.\n    // The graphql-yoga prometheus plugin populates the same default registry,\n    // so GraphQL-level metrics (operation durations, error counts, etc.) are\n    // included automatically without needing Yoga to handle this route.\n    if (pathname === '/metrics' && request.method === 'GET') {\n      try {\n        const promClientMod = 'prom-client';\n        const prom = (await import(promClientMod)) as unknown as {\n          register: { metrics: () => Promise<string> | string; contentType?: string };\n          collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n        };\n        try {\n          prom.collectDefaultMetrics({ register: prom.register });\n        } catch {\n          /* already called */\n        }\n        const body = await prom.register.metrics();\n        return new Response(body, {\n          status: 200,\n          headers: {\n            'Content-Type': prom.register.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n          },\n        });\n      } catch {\n        // fall through — prom-client not installed; let Yoga handle as fallback\n      }\n    }\n\n    // Routes that should be handled by Yoga (GraphQL endpoint only)\n    const yogaRoutes = [graphqlEndpoint, `${graphqlEndpoint}/`, '/metrics'];\n    const shouldHandleByYoga = yogaRoutes.includes(pathname);\n\n    if (shouldHandleByYoga) {\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Get response from Yoga\n      const yogaResponse = await yoga.fetch(request);\n\n      // Add CORS headers to Yoga response\n      const headers = new Headers(yogaResponse.headers);\n      for (const [key, value] of Object.entries(corsHeaders)) {\n        headers.set(key, value);\n      }\n\n      // Return response with CORS headers\n      return new Response(yogaResponse.body, {\n        status: yogaResponse.status,\n        statusText: yogaResponse.statusText,\n        headers,\n      });\n    }\n    // Return undefined to continue to next handlers for non-GraphQL requests\n    return undefined;\n  });\n\n  // Register metrics middleware (after GraphQL interception)\n  app.use(createMetricsPlugin());\n\n  // Register security middleware (after GraphQL interception)\n  app.use(\n    createSecurityPlugin({\n      csrfSkipRoutes: config.csrfSkipRoutes || ['/graphql', '/health', '/api/graph/'],\n      loginEndpoints: config.loginEndpoints || [],\n      enableCSRF: config.enableCSRF ?? false, // Disabled by default for GraphQL services\n      enableSessionSecurity: config.enableSessionSecurity ?? false,\n    })\n  );\n\n  // Health check endpoints\n  // /health - General health check\n  // /health/live - Kubernetes liveness probe\n  // /health/ready - Kubernetes readiness probe\n  // /health/startup - Kubernetes startup probe\n  const healthResponse = () => ({\n    status: 'healthy',\n    service: config.serviceName,\n    version: config.serviceVersion || '1.0.0',\n    timestamp: new Date().toISOString(),\n  });\n\n  app.get('/health', healthResponse);\n  app.get('/health/live', healthResponse);\n  app.get('/health/ready', healthResponse);\n  app.get('/health/startup', healthResponse);\n\n  // Graph API endpoints (if moduleGraph provided)\n  if (moduleGraph) {\n    // Get graph configuration schema\n    app.get('/api/graph/schema', async ({ request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      return moduleGraph.getSchema();\n    });\n\n    // Export all graph data\n    app.get('/api/graph/export', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportAll(organizationId, workspaceId);\n    });\n\n    // Export entities only\n    app.get('/api/graph/entities', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId, types } = query as {\n        organizationId?: string;\n        workspaceId?: string;\n        types?: string;\n      };\n      const entityTypes = types?.split(',').map((t) => t.trim());\n      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);\n    });\n\n    // Export relationships only\n    app.get('/api/graph/relationships', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportRelationships(organizationId, workspaceId);\n    });\n  }\n\n  // Register custom REST endpoints (skip rawBody endpoints - they're handled in onRequest)\n  if (restEndpoints && restEndpoints.length > 0) {\n    for (const endpoint of restEndpoints) {\n      // Skip rawBody endpoints - they're intercepted in onRequest before body parsing\n      if (endpoint.rawBody) {\n        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);\n        continue;\n      }\n\n      const handler = async ({ request }: { request: Request }): Promise<unknown> => {\n        try {\n          const context = await buildContext(request);\n          return await endpoint.handler(request, context);\n        } catch (error) {\n          logger.error(`[Server] REST endpoint error (${endpoint.path}):`, error);\n          return createHttpErrorResponse(error, {\n            serviceName: config.serviceName,\n            environment: config.environment,\n          });\n        }\n      };\n\n      switch (endpoint.method) {\n        case 'GET':\n          app.get(endpoint.path, handler);\n          break;\n        case 'POST':\n          app.post(endpoint.path, handler);\n          break;\n        case 'PUT':\n          app.put(endpoint.path, handler);\n          break;\n        case 'PATCH':\n          app.patch(endpoint.path, handler);\n          break;\n        case 'DELETE':\n          app.delete(endpoint.path, handler);\n          break;\n      }\n    }\n  }\n\n  const host = config.host || '0.0.0.0';\n  const port = config.port;\n\n  // Create server instance\n  const serverInstance: ServerInstance = {\n    app: app as unknown as ElysiaApp,\n    server: null,\n    start: async () => {\n      serverStartTime = new Date();\n\n      // Call listen() which starts the server and makes app.server available\n      app.listen({\n        port,\n        hostname: host,\n      });\n\n      // Access the Bun server instance from the app\n      // Cast through unknown to satisfy TypeScript since Elysia's types are complex\n      const elysiaApp = app as unknown as { server: BunServerHandle | null };\n      serverInstance.server = elysiaApp.server;\n\n      logger.info(`🚀 ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);\n    },\n    stop: async () => {\n      logger.info(`[Server] Stopping ${config.serviceName}...`);\n\n      if (onShutdown) {\n        await onShutdown();\n      }\n\n      if (moduleGraph) {\n        await moduleGraph.shutdown();\n      }\n\n      await getDatabaseManager().disconnect();\n\n      if (serverInstance.server) {\n        serverInstance.server.stop();\n      }\n\n      logger.info(`[Server] ${config.serviceName} stopped`);\n    },\n    getInfo: (): ServerInfo => {\n      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1000) : 0;\n\n      return {\n        serviceName: config.serviceName,\n        serviceVersion: config.serviceVersion || '1.0.0',\n        environment: config.environment || 'development',\n        port,\n        host,\n        graphqlEndpoint,\n        startedAt: serverStartTime?.toISOString() || '',\n        uptime,\n      };\n    },\n  };\n\n  // Setup graceful shutdown handlers\n  const gracefulShutdown = async (signal: string): Promise<never> => {\n    logger.info(`[Server] ${signal} received, shutting down gracefully...`);\n    await serverInstance.stop();\n    process.exit(0);\n  };\n\n  process.on('SIGTERM', () => {\n    void gracefulShutdown('SIGTERM');\n  });\n  process.on('SIGINT', () => {\n    void gracefulShutdown('SIGINT');\n  });\n\n  return serverInstance;\n}\n\n/**\n * Configure auth with workspace secret fetcher\n *\n * This should be called before creating the server if using workspace-scoped JWT\n */\nexport function configureServerAuth(fetchWorkspaceSecret: FetchWorkspaceSecretFn): void {\n  configureAuth({ fetchWorkspaceSecret });\n}\n"]}

package/dist/workspace-guard-3TKZULCO.js

@@ -0,0 +1,5 @@
+export { createWorkspaceGuardPlugin } from './chunk-XUU5IBVU.js';
+import './chunk-CBZNP6RF.js';
+import './chunk-XE4OXN2W.js';
+//# sourceMappingURL=workspace-guard-3TKZULCO.js.map
+//# sourceMappingURL=workspace-guard-3TKZULCO.js.map

package/dist/{workspace-guard-524GBJQ6.js.map → workspace-guard-3TKZULCO.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"workspace-guard-524GBJQ6.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"workspace-guard-3TKZULCO.js"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/be-sdk",
-  "version": "2026.527.3",
+  "version": "2026.528.2",
   "description": "Backend SDK for Burdenoff products providing unified access to notifications, RBAC, activity tracking, usage monitoring, and more",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/dist/chunk-7BMKOD7N.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/resource-caps/index.ts"],"names":["RESOURCE_CAP_DEFAULTS","workspace","free","paidDefault","scope","workspaceMember","sandbox","vibe","agent","conversation","message","tag","file","group","calendar","scheduledTask","form","apiKey","webhook","ResourceCapExceededError","GraphQLError","detail","resource","currentCount","limit","planName","extensions","code","name","PLAN_QUERY","ResourceCapsModule","client","cacheTtlMs","defaultTier","planCache","Map","config","getResourceCap","userId","Error","defaults","plan","resolvePlan","override","overrides","planTier","isFallback","enforceResourceCap","cap","invalidate","delete","invalidateAll","clear","cached","get","Date","now","fetchedAt","fetchPlan","set","fallbackPlan","res","query","planNode","userBillingPlan","tier","normaliseTier","sanitizeOverrides","resourceCaps","err","logger","warn","raw","fallback","lc","toLowerCase","out","key","value","Object","entries","Number","isFinite","Math","max","floor","defaultInstance","getResourceCaps","__resetResourceCapsForTests"],"mappings":";;;;AAiEO,IAAMA,qBAAAA,GAAmE;EAC9EC,SAAAA,EAAW;IAAEC,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,EAAA;IAAIC,KAAAA,EAAO;AAAO,GAAA;EACrDC,eAAAA,EAAiB;IAAEH,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAY,GAAA;EACjEE,OAAAA,EAAS;IAAEJ,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,EAAA;IAAIC,KAAAA,EAAO;AAAO,GAAA;EACnDG,IAAAA,EAAM;IAAEL,IAAAA,EAAM,EAAA;IAAIC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAO,GAAA;EAClDI,KAAAA,EAAO;IAAEN,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,EAAA;IAAIC,KAAAA,EAAO;AAAY,GAAA;EACtDK,YAAAA,EAAc;IAAEP,IAAAA,EAAM,EAAA;IAAIC,WAAAA,EAAa,GAAA;IAAMC,KAAAA,EAAO;AAAW,GAAA;EAC/DM,OAAAA,EAAS;IAAER,IAAAA,EAAM,GAAA;IAAKC,WAAAA,EAAa,GAAA;IAAOC,KAAAA,EAAO;AAAW,GAAA;EAC5DO,GAAAA,EAAK;IAAET,IAAAA,EAAM,EAAA;IAAIC,WAAAA,EAAa,GAAA;IAAMC,KAAAA,EAAO;AAAY,GAAA;EACvDQ,IAAAA,EAAM;IAAEV,IAAAA,EAAM,GAAA;IAAKC,WAAAA,EAAa,GAAA;IAAOC,KAAAA,EAAO;AAAO,GAAA;EACrDS,KAAAA,EAAO;IAAEX,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAY,GAAA;EACvDU,QAAAA,EAAU;IAAEZ,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAO,GAAA;EACrDW,aAAAA,EAAe;IAAEb,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAO,GAAA;EAC1DY,IAAAA,EAAM;IAAEd,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAO,GAAA;EACjDa,MAAAA,EAAQ;IAAEf,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,EAAA;IAAIC,KAAAA,EAAO;AAAO,GAAA;EAClDc,OAAAA,EAAS;IAAEhB,IAAAA,EAAM,CAAA;IAAGC,WAAAA,EAAa,GAAA;IAAKC,KAAAA,EAAO;AAAY;AAC3D;AAmCO,IAAMe,wBAAAA,GAAN,cAAuCC,YAAAA,CAAAA;EApH9C;;;AAqHE,EAAA,WAAA,CAAYC,MAAAA,EAA2F;AACrG,IAAA,KAAA,CACE,CAAA,0BAAA,EAA6BA,MAAAA,CAAOC,QAAQ,CAAA,EAAA,EAAKD,MAAAA,CAAOE,YAAY,CAAA,CAAA,EAAIF,MAAAA,CAAOG,KAAK,CAAA,UAAA,EAAaH,MAAAA,CAAOI,QAAQ,CAAA,EAAA,CAAA,EAChH;MACEC,UAAAA,EAAY;QACVC,IAAAA,EAAM,uBAAA;AACNL,QAAAA,QAAAA,EAAUD,MAAAA,CAAOC,QAAAA;AACjBC,QAAAA,YAAAA,EAAcF,MAAAA,CAAOE,YAAAA;AACrBC,QAAAA,KAAAA,EAAOH,MAAAA,CAAOG,KAAAA;AACdC,QAAAA,QAAAA,EAAUJ,MAAAA,CAAOI;AACnB;KACF,CAAA;AAEF,IAAA,IAAA,CAAKG,IAAAA,GAAO,0BAAA;AACd,EAAA;AACF;AAMA,IAAMC,UAAAA;;AAA2B,EAAA;;;;;;;;;;AAkB1B,IAAMC,qBAAN,MAAMA;EA5Jb;;;AA6JmBC,EAAAA,MAAAA;AACAC,EAAAA,UAAAA;AACAC,EAAAA,WAAAA;AACAC,EAAAA,SAAAA,uBAAgBC,GAAAA,EAAAA;EAEjC,WAAA,CAAYC,MAAAA,GAA6B,EAAC,EAAG;AAC3C,IAAA,IAAA,CAAKL,SAASK,MAAAA,CAAOL,MAAAA;AACrB,IAAA,IAAA,CAAKC,UAAAA,GAAaI,OAAOJ,UAAAA,IAAc,GAAA;AACvC,IAAA,IAAA,CAAKC,WAAAA,GAAcG,OAAOH,WAAAA,IAAe,MAAA;AAC3C,EAAA;;;;;EAMA,MAAMI,cAAAA,CAAeC,QAAgBhB,QAAAA,EAA8C;AACjF,IAAA,IAAI,CAACgB,MAAAA,EAAQ;AACX,MAAA,MAAM,IAAIC,MAAM,oCAAA,CAAA;AAClB,IAAA;AACA,IAAA,MAAMC,QAAAA,GAAWxC,sBAAsBsB,QAAAA,CAAAA;AACvC,IAAA,IAAI,CAACkB,QAAAA,EAAU;AACb,MAAA,MAAM,IAAID,KAAAA,CAAM,CAAA,kCAAA,EAAqCjB,QAAAA,CAAAA,CAAAA,CAAW,CAAA;AAClE,IAAA;AAEA,IAAA,MAAMmB,IAAAA,GAAO,MAAM,IAAA,CAAKC,WAAAA,CAAYJ,MAAAA,CAAAA;AACpC,IAAA,MAAMK,QAAAA,GAAWF,IAAAA,CAAKG,SAAAA,CAAUtB,QAAAA,CAAAA;AAChC,IAAA,IAAI,OAAOqB,QAAAA,KAAa,QAAA,IAAYA,QAAAA,IAAY,CAAA,EAAG;AACjD,MAAA,OAAO;AACLrB,QAAAA,QAAAA;QACAE,KAAAA,EAAOmB,QAAAA;AACPlB,QAAAA,QAAAA,EAAUgB,IAAAA,CAAKhB,QAAAA;AACfoB,QAAAA,QAAAA,EAAUJ,IAAAA,CAAKI,QAAAA;QACfC,UAAAA,EAAY;AACd,OAAA;AACF,IAAA;AAEA,IAAA,MAAMtB,QAAQiB,IAAAA,CAAKI,QAAAA,KAAa,MAAA,GAASL,QAAAA,CAASrC,cAAcqC,QAAAA,CAAStC,IAAAA;AACzE,IAAA,OAAO;AACLoB,MAAAA,QAAAA;AACAE,MAAAA,KAAAA;AACAC,MAAAA,QAAAA,EAAUgB,IAAAA,CAAKhB,QAAAA;AACfoB,MAAAA,QAAAA,EAAUJ,IAAAA,CAAKI,QAAAA;AACfC,MAAAA,UAAAA,EAAYL,IAAAA,CAAKhB,QAAAA,KAAa,eAAA,IAAmBgB,IAAAA,CAAKhB,QAAAA,KAAa;AACrE,KAAA;AACF,EAAA;;;;;EAMA,MAAMsB,kBAAAA,CAAmBT,MAAAA,EAAgBhB,QAAAA,EAAwBC,YAAAA,EAA4C;AAC3G,IAAA,MAAMyB,GAAAA,GAAM,MAAM,IAAA,CAAKX,cAAAA,CAAeC,QAAQhB,QAAAA,CAAAA;AAC9C,IAAA,IAAIC,YAAAA,IAAgByB,IAAIxB,KAAAA,EAAO;AAC7B,MAAA,MAAM,IAAIL,wBAAAA,CAAyB;AACjCG,QAAAA,QAAAA;AACAC,QAAAA,YAAAA;AACAC,QAAAA,KAAAA,EAAOwB,GAAAA,CAAIxB,KAAAA;AACXC,QAAAA,QAAAA,EAAUuB,GAAAA,CAAIvB;OAChB,CAAA;AACF,IAAA;AACA,IAAA,OAAOuB,GAAAA;AACT,EAAA;;AAGAC,EAAAA,UAAAA,CAAWX,MAAAA,EAAsB;AAC/B,IAAA,IAAA,CAAKJ,SAAAA,CAAUgB,OAAOZ,MAAAA,CAAAA;AACxB,EAAA;;EAGAa,aAAAA,GAAsB;AACpB,IAAA,IAAA,CAAKjB,UAAUkB,KAAAA,EAAK;AACtB,EAAA;;;;AAMA,EAAA,MAAcV,YAAYJ,MAAAA,EAAqC;AAC7D,IAAA,MAAMe,MAAAA,GAAS,IAAA,CAAKnB,SAAAA,CAAUoB,GAAAA,CAAIhB,MAAAA,CAAAA;AAClC,IAAA,IAAIe,UAAUE,IAAAA,CAAKC,GAAAA,KAAQH,MAAAA,CAAOI,SAAAA,GAAY,KAAKzB,UAAAA,EAAY;AAC7D,MAAA,OAAOqB,MAAAA;AACT,IAAA;AAEA,IAAA,MAAMZ,IAAAA,GAAO,MAAM,IAAA,CAAKiB,SAAAA,CAAUpB,MAAAA,CAAAA;AAClC,IAAA,IAAA,CAAKJ,SAAAA,CAAUyB,GAAAA,CAAIrB,MAAAA,EAAQG,IAAAA,CAAAA;AAC3B,IAAA,OAAOA,IAAAA;AACT,EAAA;AAEA,EAAA,MAAciB,UAAUpB,MAAAA,EAAqC;AAC3D,IAAA,IAAI,CAAC,KAAKP,MAAAA,EAAQ;AAChB,MAAA,OAAO,KAAK6B,YAAAA,EAAY;AAC1B,IAAA;AACA,IAAA,IAAI;AACF,MAAA,MAAMC,GAAAA,GAAM,MAAM,IAAA,CAAK9B,MAAAA,CAAO+B,MAAyBjC,UAAAA,EAAY;AAAES,QAAAA;OAAO,CAAA;AAC5E,MAAA,MAAMyB,WAAWF,GAAAA,EAAKG,eAAAA;AACtB,MAAA,IAAI,CAACD,QAAAA,EAAU;AACb,QAAA,OAAO,KAAKH,YAAAA,EAAY;AAC1B,MAAA;AACA,MAAA,MAAMK,IAAAA,GAAOC,aAAAA,CAAcH,QAAAA,CAASE,IAAAA,EAAM,KAAKhC,WAAW,CAAA;AAC1D,MAAA,MAAMW,SAAAA,GAAYuB,iBAAAA,CAAkBJ,QAAAA,CAASK,YAAY,CAAA;AACzD,MAAA,OAAO;AACL3C,QAAAA,QAAAA,EAAUsC,QAAAA,CAAStC,QAAAA,KAAawC,IAAAA,KAAS,MAAA,GAAS,MAAA,GAAS,MAAA,CAAA;QAC3DpB,QAAAA,EAAUoB,IAAAA;AACVrB,QAAAA,SAAAA;AACAa,QAAAA,SAAAA,EAAWF,KAAKC,GAAAA;AAClB,OAAA;AACF,IAAA,CAAA,CAAA,OAASa,GAAAA,EAAK;AACZC,MAAAA,MAAAA,CAAOC,KAAK,iEAAA,EAAmE;AAC7EF,QAAAA,GAAAA;AACA/B,QAAAA;OACF,CAAA;AACA,MAAA,OAAO,KAAKsB,YAAAA,EAAY;AAC1B,IAAA;AACF,EAAA;EAEQA,YAAAA,GAA2B;AACjC,IAAA,OAAO;MACLnC,QAAAA,EAAU,IAAA,CAAKQ,WAAAA,KAAgB,MAAA,GAAS,eAAA,GAAkB,eAAA;AAC1DY,MAAAA,QAAAA,EAAU,IAAA,CAAKZ,WAAAA;AACfW,MAAAA,SAAAA,EAAW,EAAC;AACZa,MAAAA,SAAAA,EAAWF,KAAKC,GAAAA;AAClB,KAAA;AACF,EAAA;AACF;AAMA,SAASU,aAAAA,CAAcM,KAAgCC,QAAAA,EAAkB;AACvE,EAAA,IAAI,CAACD,KAAK,OAAOC,QAAAA;AACjB,EAAA,MAAMC,EAAAA,GAAKF,IAAIG,WAAAA,EAAW;AAC1B,EAAA,IAAID,EAAAA,KAAO,MAAA,IAAUA,EAAAA,KAAO,MAAA,EAAQ,OAAOA,EAAAA;AAE3C,EAAA,IAAIA,OAAO,YAAA,IAAgBA,EAAAA,KAAO,cAAcA,EAAAA,KAAO,KAAA,IAASA,OAAO,MAAA,EAAQ;AAC7E,IAAA,OAAO,MAAA;AACT,EAAA;AACA,EAAA,OAAOD,QAAAA;AACT;AATSP,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWT,SAASC,kBAAkBK,GAAAA,EAA8C;AACvE,EAAA,IAAI,CAACA,GAAAA,IAAO,OAAOA,GAAAA,KAAQ,QAAA,SAAiB,EAAC;AAC7C,EAAA,MAAMI,MAA6C,EAAC;AACpD,EAAA,KAAA,MAAW,CAACC,GAAAA,EAAKC,KAAAA,KAAUC,MAAAA,CAAOC,OAAAA,CAAQR,GAAAA,CAAAA,EAAM;AAC9C,IAAA,IAAIK,GAAAA,IAAO7E,yBAAyB,OAAO8E,KAAAA,KAAU,YAAYG,MAAAA,CAAOC,QAAAA,CAASJ,KAAAA,CAAAA,EAAQ;AACvFF,MAAAA,GAAAA,CAAIC,GAAAA,IAAuBM,IAAAA,CAAKC,GAAAA,CAAI,GAAGD,IAAAA,CAAKE,KAAAA,CAAMP,KAAAA,CAAAA,CAAAA;AACpD,IAAA;AACF,EAAA;AACA,EAAA,OAAOF,GAAAA;AACT;AATST,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAeT,IAAImB,eAAAA,GAA6C,IAAA;AAM1C,SAASC,gBAAgBnD,MAAAA,EAA2B;AACzD,EAAA,IAAI,CAACkD,eAAAA,EAAiB;AACpBA,IAAAA,eAAAA,GAAkB,IAAIxD,mBAAmBM,MAAAA,CAAAA;AAC3C,EAAA;AACA,EAAA,OAAOkD,eAAAA;AACT;AALgBC,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAQT,SAASC,2BAAAA,GAAAA;AACdF,EAAAA,eAAAA,GAAkB,IAAA;AACpB;AAFgBE,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA","file":"chunk-7BMKOD7N.js","sourcesContent":["/**\n * Resource Caps Module\n *\n * Enforces per-user / per-workspace resource ceilings to prevent unbounded\n * resource use on a multi-tenant SaaS. Caps come from the user's billing plan\n * (resolved via global-billing-svc) and fall back to static defaults defined\n * here when the plan lookup fails or the resource isn't overridden.\n *\n * Two plan tiers exist by default:\n *   - free: tight per-user / per-workspace ceilings\n *   - paid (default): ~100x looser; individual paid plans can override via the\n *     `Plan.resourceCaps` JSON column in global-billing-svc.\n *\n * @example\n * ```ts\n * import { resourceCaps } from '@burdenoff/be-sdk/resource-caps';\n *\n * const { limit } = await resourceCaps.getResourceCap(userId, 'tag');\n * await resourceCaps.enforceResourceCap(userId, 'tag', currentCount);\n * ```\n */\n\nimport { GraphQLError } from 'graphql';\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport { logger } from '../logger/index.js';\n\n// ---------------------------------------------------------------------------\n// Resource registry\n// ---------------------------------------------------------------------------\n\n/**\n * Canonical resource names. Adding a new capped resource? Append it here,\n * extend RESOURCE_CAP_DEFAULTS, and reference it from the relevant svc.\n */\nexport type ResourceName =\n  | 'workspace' // per user\n  | 'workspaceMember' // per workspace\n  | 'sandbox' // per user\n  | 'vibe' // per user\n  | 'agent' // per workspace\n  | 'conversation' // per user/day\n  | 'message' // per user/day\n  | 'tag' // per workspace\n  | 'file' // per user (count only)\n  | 'group' // per workspace\n  | 'calendar' // per user\n  | 'scheduledTask' // per user\n  | 'form' // per user\n  | 'apiKey' // per user\n  | 'webhook'; // per workspace\n\nexport type PlanTier = 'free' | 'paid';\n\nexport interface ResourceCapDefaults {\n  free: number;\n  paidDefault: number;\n  /** Optional scope hint used by callers when wiring guards */\n  scope: 'user' | 'workspace' | 'user/day';\n}\n\n/**\n * Static fallback caps. Real values may be overridden per plan in\n * global-billing-svc Plan.resourceCaps JSON.\n */\nexport const RESOURCE_CAP_DEFAULTS: Record<ResourceName, ResourceCapDefaults> = {\n  workspace: { free: 3, paidDefault: 50, scope: 'user' },\n  workspaceMember: { free: 5, paidDefault: 500, scope: 'workspace' },\n  sandbox: { free: 2, paidDefault: 50, scope: 'user' },\n  vibe: { free: 10, paidDefault: 500, scope: 'user' },\n  agent: { free: 2, paidDefault: 20, scope: 'workspace' },\n  conversation: { free: 20, paidDefault: 2000, scope: 'user/day' },\n  message: { free: 200, paidDefault: 20000, scope: 'user/day' },\n  tag: { free: 50, paidDefault: 5000, scope: 'workspace' },\n  file: { free: 100, paidDefault: 10000, scope: 'user' },\n  group: { free: 5, paidDefault: 500, scope: 'workspace' },\n  calendar: { free: 3, paidDefault: 100, scope: 'user' },\n  scheduledTask: { free: 5, paidDefault: 500, scope: 'user' },\n  form: { free: 5, paidDefault: 500, scope: 'user' },\n  apiKey: { free: 2, paidDefault: 50, scope: 'user' },\n  webhook: { free: 2, paidDefault: 100, scope: 'workspace' },\n};\n\n// ---------------------------------------------------------------------------\n// Types & errors\n// ---------------------------------------------------------------------------\n\nexport interface ResourceCap {\n  resource: ResourceName;\n  limit: number;\n  planName: string;\n  planTier: PlanTier;\n  /** True when the cap came from defaults, not from the billing service */\n  isFallback: boolean;\n}\n\nexport interface ResourceCapsConfig {\n  client?: BurdenoffGraphQLClient;\n  /** Optional in-memory TTL for plan lookups; defaults to 60s */\n  cacheTtlMs?: number;\n  /** Default plan tier when billing lookup fails */\n  defaultTier?: PlanTier;\n}\n\ninterface CachedPlan {\n  planName: string;\n  planTier: PlanTier;\n  overrides: Partial<Record<ResourceName, number>>;\n  fetchedAt: number;\n}\n\n/**\n * Thrown when an entity create operation would push the user past the cap.\n * The matching GraphQL error has extensions.code = RESOURCE_CAP_EXCEEDED\n * so clients can detect and route to an upgrade flow.\n */\nexport class ResourceCapExceededError extends GraphQLError {\n  constructor(detail: { resource: ResourceName; currentCount: number; limit: number; planName: string }) {\n    super(\n      `Resource cap exceeded for ${detail.resource}: ${detail.currentCount}/${detail.limit} on plan '${detail.planName}'.`,\n      {\n        extensions: {\n          code: 'RESOURCE_CAP_EXCEEDED',\n          resource: detail.resource,\n          currentCount: detail.currentCount,\n          limit: detail.limit,\n          planName: detail.planName,\n        },\n      }\n    );\n    this.name = 'ResourceCapExceededError';\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Module\n// ---------------------------------------------------------------------------\n\nconst PLAN_QUERY = /* GraphQL */ `\n  query GetUserPlanForCaps($userId: ID!) {\n    userBillingPlan(userId: $userId) {\n      planName\n      tier\n      resourceCaps\n    }\n  }\n`;\n\ninterface PlanQueryResponse {\n  userBillingPlan?: {\n    planName?: string | null;\n    tier?: string | null;\n    resourceCaps?: Record<string, number> | null;\n  } | null;\n}\n\nexport class ResourceCapsModule {\n  private readonly client?: BurdenoffGraphQLClient;\n  private readonly cacheTtlMs: number;\n  private readonly defaultTier: PlanTier;\n  private readonly planCache = new Map<string, CachedPlan>();\n\n  constructor(config: ResourceCapsConfig = {}) {\n    this.client = config.client;\n    this.cacheTtlMs = config.cacheTtlMs ?? 60_000;\n    this.defaultTier = config.defaultTier ?? 'free';\n  }\n\n  /**\n   * Resolve the cap for a given resource for the supplied user.\n   * Order: plan-override → plan-tier-default → static free default.\n   */\n  async getResourceCap(userId: string, resource: ResourceName): Promise<ResourceCap> {\n    if (!userId) {\n      throw new Error('getResourceCap: userId is required');\n    }\n    const defaults = RESOURCE_CAP_DEFAULTS[resource];\n    if (!defaults) {\n      throw new Error(`getResourceCap: unknown resource '${resource}'`);\n    }\n\n    const plan = await this.resolvePlan(userId);\n    const override = plan.overrides[resource];\n    if (typeof override === 'number' && override >= 0) {\n      return {\n        resource,\n        limit: override,\n        planName: plan.planName,\n        planTier: plan.planTier,\n        isFallback: false,\n      };\n    }\n\n    const limit = plan.planTier === 'paid' ? defaults.paidDefault : defaults.free;\n    return {\n      resource,\n      limit,\n      planName: plan.planName,\n      planTier: plan.planTier,\n      isFallback: plan.planName === 'fallback-free' || plan.planName === 'fallback-paid',\n    };\n  }\n\n  /**\n   * Throws ResourceCapExceededError when currentCount >= limit.\n   * Use BEFORE the create transaction to avoid orphan rows.\n   */\n  async enforceResourceCap(userId: string, resource: ResourceName, currentCount: number): Promise<ResourceCap> {\n    const cap = await this.getResourceCap(userId, resource);\n    if (currentCount >= cap.limit) {\n      throw new ResourceCapExceededError({\n        resource,\n        currentCount,\n        limit: cap.limit,\n        planName: cap.planName,\n      });\n    }\n    return cap;\n  }\n\n  /** Invalidate cache for a user (e.g. after plan upgrade) */\n  invalidate(userId: string): void {\n    this.planCache.delete(userId);\n  }\n\n  /** Clear entire plan cache */\n  invalidateAll(): void {\n    this.planCache.clear();\n  }\n\n  // -------------------------------------------------------------------------\n  // Internals\n  // -------------------------------------------------------------------------\n\n  private async resolvePlan(userId: string): Promise<CachedPlan> {\n    const cached = this.planCache.get(userId);\n    if (cached && Date.now() - cached.fetchedAt < this.cacheTtlMs) {\n      return cached;\n    }\n\n    const plan = await this.fetchPlan(userId);\n    this.planCache.set(userId, plan);\n    return plan;\n  }\n\n  private async fetchPlan(userId: string): Promise<CachedPlan> {\n    if (!this.client) {\n      return this.fallbackPlan();\n    }\n    try {\n      const res = await this.client.query<PlanQueryResponse>(PLAN_QUERY, { userId });\n      const planNode = res?.userBillingPlan;\n      if (!planNode) {\n        return this.fallbackPlan();\n      }\n      const tier = normaliseTier(planNode.tier, this.defaultTier);\n      const overrides = sanitizeOverrides(planNode.resourceCaps);\n      return {\n        planName: planNode.planName ?? (tier === 'paid' ? 'paid' : 'free'),\n        planTier: tier,\n        overrides,\n        fetchedAt: Date.now(),\n      };\n    } catch (err) {\n      logger.warn('resource-caps: plan lookup failed; falling back to default tier', {\n        err,\n        userId,\n      });\n      return this.fallbackPlan();\n    }\n  }\n\n  private fallbackPlan(): CachedPlan {\n    return {\n      planName: this.defaultTier === 'paid' ? 'fallback-paid' : 'fallback-free',\n      planTier: this.defaultTier,\n      overrides: {},\n      fetchedAt: Date.now(),\n    };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction normaliseTier(raw: string | null | undefined, fallback: PlanTier): PlanTier {\n  if (!raw) return fallback;\n  const lc = raw.toLowerCase();\n  if (lc === 'free' || lc === 'paid') return lc;\n  // Treat anything non-free as paid (enterprise, business, pro, etc.)\n  if (lc === 'enterprise' || lc === 'business' || lc === 'pro' || lc === 'team') {\n    return 'paid';\n  }\n  return fallback;\n}\n\nfunction sanitizeOverrides(raw: Record<string, number> | null | undefined): Partial<Record<ResourceName, number>> {\n  if (!raw || typeof raw !== 'object') return {};\n  const out: Partial<Record<ResourceName, number>> = {};\n  for (const [key, value] of Object.entries(raw)) {\n    if (key in RESOURCE_CAP_DEFAULTS && typeof value === 'number' && Number.isFinite(value)) {\n      out[key as ResourceName] = Math.max(0, Math.floor(value));\n    }\n  }\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Convenience singleton\n// ---------------------------------------------------------------------------\n\nlet defaultInstance: ResourceCapsModule | null = null;\n\n/**\n * Obtain a process-wide singleton. The first call binds the GraphQL client\n * (typically the SDK's internal client). Later calls return the same instance.\n */\nexport function getResourceCaps(config?: ResourceCapsConfig): ResourceCapsModule {\n  if (!defaultInstance) {\n    defaultInstance = new ResourceCapsModule(config);\n  }\n  return defaultInstance;\n}\n\n/** Reset the singleton (for tests) */\nexport function __resetResourceCapsForTests(): void {\n  defaultInstance = null;\n}\n"]}