@burdenoff/be-sdk 2026.803.1 → 2026.803.2

package/dist/index.js

@@ -1,9 +1,9 @@
 import { ActivityModule, UsageModule, TrackerModule } from './chunk-VOJROV6C.js';
 export { ActivityModule, TrackerModule, UsageModule } from './chunk-VOJROV6C.js';
 export { platform_exports as Platform } from './chunk-WCJIZR5Q.js';
+export { prisma_exports as Prisma } from './chunk-MX4AHK3E.js';
 import { RBACModule } from './chunk-S32JOMMW.js';
 export { RBACModule, createRBACDirective, createRBACDirectiveForLayer, createRBACDirectiveFromEnv } from './chunk-S32JOMMW.js';
-export { prisma_exports as Prisma } from './chunk-MX4AHK3E.js';
 import './chunk-KESVEZB2.js';
 export { sharing_exports as Sharing } from './chunk-XD5ZK727.js';
 export { TemporalClient, TemporalClientFactory, TemporalModule, TemporalWorker, TemporalWorkerFactory, TemporalWorkerManager } from './chunk-IC7YDBGE.js';

package/dist/server/index.js

@@ -466,8 +466,49 @@ function canAccessGraphExport(actor) {
 }
 __name(canAccessGraphExport, "canAccessGraphExport");
 
+// src/server/quotaGaugeRefresh.ts
+var QUOTA_GAUGE_TTL_MS = 6e4;
+var QUOTA_GAUGE_REFRESH_TIMEOUT_MS = 5e3;
+function createQuotaGaugeRefresher(opts) {
+  const ttlMs = opts.ttlMs ?? QUOTA_GAUGE_TTL_MS;
+  const timeoutMs = opts.timeoutMs ?? QUOTA_GAUGE_REFRESH_TIMEOUT_MS;
+  const now = opts.now ?? (() => Date.now());
+  let refreshedAt = 0;
+  let inFlight = null;
+  const refresh = /* @__PURE__ */ __name(async () => {
+    if (refreshedAt !== 0 && now() - refreshedAt < ttlMs) return;
+    if (!inFlight) {
+      inFlight = (async () => {
+        let timer;
+        try {
+          await Promise.race([
+            Promise.resolve(opts.collect()).then(() => void 0),
+            new Promise((resolve) => {
+              timer = setTimeout(resolve, timeoutMs);
+            })
+          ]);
+          refreshedAt = now();
+        } catch {
+        } finally {
+          if (timer !== void 0) clearTimeout(timer);
+          inFlight = null;
+        }
+      })();
+    }
+    await inFlight;
+  }, "refresh");
+  return {
+    refresh,
+    lastRefreshedAt: /* @__PURE__ */ __name(() => refreshedAt, "lastRefreshedAt")
+  };
+}
+__name(createQuotaGaugeRefresher, "createQuotaGaugeRefresher");
+
 // src/server/server.ts
 var serverStartTime = null;
+var quotaGaugeRefresher = createQuotaGaugeRefresher({
+  collect: /* @__PURE__ */ __name(() => getWorkspaceQuotaRegistry().collectAll(), "collect")
+});
 async function createServer(definition) {
   const { config, prismaClient, schema, moduleGraph, restEndpoints, yogaPlugins, buildContext: customBuildContext, workspaceExtensionConfig, disableWorkspaceExtension, onShutdown } = definition;
   const { Elysia } = await import('elysia');
@@ -715,10 +756,7 @@ async function createServer(definition) {
         }
         const promBody = await prom.register.metrics();
         let sdkBody = "";
-        try {
-          await getWorkspaceQuotaRegistry().collectAll();
-        } catch {
-        }
+        await quotaGaugeRefresher.refresh();
         try {
           sdkBody = getMetricsRegistry().toPrometheusFormat();
         } catch {

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/auth.ts","../../src/server/context.ts","../../src/server/security.ts","../../src/server/server.ts"],"names":["getDbFn","getDb","prismaModule","joseModule","jwtModule","getJose","getJwt","jwt","default","authConfig","configureAuth","config","logger","debug","fetchWorkspaceSecret","workspaceId","db","workspace","client","findUnique","where","id","jwtSecret","JSON","parse","stringify","error","warn","configureDefaultAuth","generateSymmetricSecret","joseLib","secret","generateSecret","jwk","exportJWK","verifyJWT","token","options","decoded","decode","complete","payload","verifiedJwt","verify","mapPayloadToActor","decodedJwt","decodeJwt","workspace_id","workspaceSecret","keyLikeSecret","importJWK","jwtVerify","err","decodeJWT","sub","type","actor_type","tenant_id","org_id","isAdmin","authCheck","actor","Error","workspaceCheck","context","actorId","requireWorkspace","orgCheck","organization","orgId","tenantCheck","tenant","contextOptions","configureContext","getHeader","request","key","headers","get","toLowerCase","undefined","compareSecret","provided","expected","providedBuffer","Buffer","from","expectedBuffer","length","crypto","timingSafeEqual","shouldTrustActorHeaders","nodeEnv","process","env","expectedGatewayToken","providedGatewayToken","extractTracking","forwardedFor","realIp","ip","split","trim","userAgent","extractActor","actorType","userRole","authHeader","startsWith","substring","extractTenant","tenantId","tenantEndpoint","endpoint","defaultTenant","extractOrganization","extractWorkspace","extractProject","projectId","extractProduct","productId","extractGeography","country","currency","timezone","toUpperCase","extractConsentContext","grantedBy","scopesHeader","grantedAtHeader","expiresAtHeader","scopes","map","s","grantedAt","Date","expiresAt","buildContext","project","product","tracking","consentContext","i18n","createContextFromRequest","geo","locale","language","t","tp","formatNumber","value","String","formatCurrency","formatDate","date","formatRelativeTime","unit","onBehalfOf","wsCtxPayload","organizationId","rawHeader","setWorkspaceContext","ContextManager","setCfAccessContext","responseHeaders","Headers","getContextOptions","LOCALHOST_ORIGINS","normalizeCorsOrigins","origins","environment","normalized","Array","isArray","origin","filter","Boolean","includes","resolveAllowedCorsOrigin","requestOrigin","allowedOrigins","canAccessGraphExport","serverStartTime","createServer","definition","prismaClient","schema","moduleGraph","restEndpoints","yogaPlugins","customBuildContext","workspaceExtensionConfig","disableWorkspaceExtension","onShutdown","Elysia","BunAdapter","cors","createYoga","initializeDatabase","getDatabaseManager","createSecurityPlugin","createMetricsPlugin","createWorkspaceGuardPlugin","info","serviceName","boundary","shouldEnableWorkspaceExtension","workspaceExtension","connect","registerShutdownHandlers","enableWorkspaceExtension","i18nInstance","enabled","localesPath","I18n","defaultLocale","fallbackLocale","supportedLocales","namespace","lazyLoad","logMissing","enableCache","returnKeyOnMissing","initialize","getSupportedLocales","join","isDev","enablePlayground","workspaceGuardEnabled","workspaceGuard","workspaceGuardPlugins","whitelistedOperations","graphqlEndpoint","responseHeadersPlugin","onResponse","response","serverContext","yogaContext","forEach","append","yoga","graphiql","logging","args","plugins","createHumanReadableErrorPlugin","defaultContext","app","adapter","corsOrigins","use","credentials","allowedHeaders","methods","rawBodyEndpoints","ep","rawBody","rawBodyPaths","Map","path","rawBodyMatchers","regexPattern","replace","regex","RegExp","matchRawBodyEndpoint","pathname","exactMatch","isMatch","test","onRequest","url","URL","method","isHealthRoute","buildCorsHeaders","allowedOrigin","rawBodyEndpoint","corsHeaders","Response","status","text","result","handler","Object","entries","set","body","statusText","formatted","formatHttpError","promClientMod","prom","collectDefaultMetrics","register","promBody","metrics","sdkBody","getWorkspaceQuotaRegistry","collectAll","getMetricsRegistry","toPrometheusFormat","combined","contentType","yogaRoutes","shouldHandleByYoga","yogaResponse","normalizeGraphQLResponse","fetch","csrfSkipRoutes","loginEndpoints","enableCSRF","enableSessionSecurity","healthResponse","service","version","serviceVersion","timestamp","toISOString","getSchema","query","exportAll","types","entityTypes","exportEntities","exportRelationships","createHttpErrorResponse","post","put","patch","delete","host","port","serverInstance","server","start","listen","hostname","elysiaApp","stop","shutdown","disconnect","getInfo","uptime","Math","floor","now","getTime","startedAt","gracefulShutdown","signal","exit","on","configureServerAuth"],"mappings":";;;;;;;;;;;;AA4BA,IAAIA,OAAAA,GAAmC,IAAA;AAEvC,eAAeC,KAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,IAAA,MAAME,YAAAA,GAAe,MAAM,OAAO,oBAAA,CAAA;AAElCF,IAAAA,OAAAA,GAAUE,YAAAA,CAAaD,KAAAA;AACzB,EAAA;AACA,EAAA,OAAOD,OAAAA,EAAAA;AACT;AAPeC,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAgBf,IAAIE,UAAAA,GAAiC,IAAA;AACrC,IAAIC,SAAAA,GAA8B,IAAA;AAElC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeE,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOf,eAAeC,MAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,SAAAA,EAAW;AACd,IAAA,MAAMG,GAAAA,GAAM,MAAM,OAAO,cAAA,CAAA;AAEzBH,IAAAA,SAAAA,GAAaG,IAAgCC,OAAAA,IAAWD,GAAAA;AAC1D,EAAA;AACA,EAAA,OAAOH,SAAAA;AACT;AAPeE,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAsBf,IAAIG,UAAAA,GAAgC,IAAA;AAK7B,SAASC,cAAcC,MAAAA,EAAkB;AAC9CF,EAAAA,UAAAA,GAAaE,MAAAA;AACbC,EAAAA,MAAAA,CAAOC,MAAM,8BAAA,CAAA;AACf;AAHgBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAchB,eAAsBI,qBAAqBC,WAAAA,EAAmB;AAC5D,EAAA,IAAI;AACF,IAAA,MAAMC,EAAAA,GAAK,MAAMf,KAAAA,EAAAA;AACjB,IAAA,MAAMgB,SAAAA,GAAY,MAAMD,EAAAA,CAAGE,MAAAA,CAAOD,UAAUE,UAAAA,CAAW;MACrDC,KAAAA,EAAO;QAAEC,EAAAA,EAAIN;AAAY;KAC3B,CAAA;AAEA,IAAA,IAAI,CAACE,WAAWK,SAAAA,EAAW;AACzBV,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;AAAEE,QAAAA;OAAY,CAAA;AAC7E,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOQ,KAAKC,KAAAA,CAAMD,IAAAA,CAAKE,SAAAA,CAAUR,SAAAA,CAAUK,SAAS,CAAA,CAAA;AACtD,EAAA,CAAA,CAAA,OAASI,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,KAAK,8CAAA,EAAgD;AAAEZ,MAAAA,WAAAA;AAAaW,MAAAA;KAAM,CAAA;AACjF,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAjBsBZ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwBf,SAASc,oBAAAA,GAAAA;AACd,EAAA,IAAI,CAACnB,UAAAA,EAAY;AACfC,IAAAA,aAAAA,CAAc;AAAEI,MAAAA;KAAqB,CAAA;AACrCF,IAAAA,MAAAA,CAAOC,MAAM,6EAAA,CAAA;AACf,EAAA;AACF;AALgBe,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWhB,eAAsBC,uBAAAA,GAAAA;AACpB,EAAA,MAAMC,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,EAAA,MAAM0B,MAAAA,GAAS,MAAMD,OAAAA,CAAQE,cAAAA,CAAe,OAAA,CAAA;AAC5C,EAAA,MAAMC,GAAAA,GAAM,MAAMH,OAAAA,CAAQI,SAAAA,CAAUH,MAAAA,CAAAA;AACpC,EAAA,OAAOE,GAAAA;AACT;AALsBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAetB,eAAsBM,SAAAA,CAAUC,KAAAA,EAAeL,MAAAA,EAAiBM,OAAAA,GAAyB,EAAC,EAAC;AACzF,EAAA,IAAI;AACF,IAAA,MAAM9B,GAAAA,GAAM,MAAMD,MAAAA,EAAAA;AAClB,IAAA,MAAMwB,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AAGtB,IAAA,MAAMiC,OAAAA,GAAU/B,GAAAA,CAAIgC,MAAAA,CAAOH,KAAAA,EAAO;MAAEI,QAAAA,EAAU;KAAK,CAAA;AAEnD,IAAA,IAAI,CAACF,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,IAAY,CAACA,OAAAA,CAAQG,OAAAA,IAAW,OAAOH,OAAAA,CAAQG,OAAAA,KAAY,QAAA,EAAU;AACtG7B,MAAAA,MAAAA,CAAOe,KAAK,mCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,IAAII,MAAAA,EAAQ;AAEV,MAAA,MAAMW,YAAAA,GAAcnC,GAAAA,CAAIoC,MAAAA,CAAOP,KAAAA,EAAOL,QAAQM,OAAAA,CAAAA;AAC9C,MAAA,OAAOO,kBAAkBF,YAAAA,CAAAA;AAC3B,IAAA;AAGA,IAAA,MAAMG,UAAAA,GAAaf,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;AACrC,IAAA,IAAI,CAACS,WAAWE,YAAAA,EAAc;AAC5BnC,MAAAA,MAAAA,CAAOe,KAAK,6CAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAAClB,YAAYK,oBAAAA,EAAsB;AACrCF,MAAAA,MAAAA,CAAOc,MAAM,+DAAA,CAAA;AACb,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,eAAAA,GAAkB,MAAMvC,UAAAA,CAAWK,oBAAAA,CAAqB+B,WAAWE,YAAY,CAAA;AACrF,IAAA,IAAI,CAACC,eAAAA,EAAiB;AACpBpC,MAAAA,MAAAA,CAAOe,KAAK,yCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,aAAAA,GAAgB,MAAMnB,OAAAA,CAAQoB,SAAAA,CAAUF,iBAAiB,OAAA,CAAA;AAC/D,IAAA,MAAMN,cAAc,MAAMZ,OAAAA,CAAQqB,SAAAA,CAAUf,KAAAA,EAAOa,eAAeZ,OAAAA,CAAAA;AAClE,IAAA,OAAOO,iBAAAA,CAAkBF,YAAYD,OAAO,CAAA;AAC9C,EAAA,CAAA,CAAA,OAASW,GAAAA,EAAK;AACZxC,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,qCAAqCyB,GAAAA,CAAAA;AACjD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA7CsBjB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkDtB,eAAsBkB,UAAUjB,KAAAA,EAAa;AAC3C,EAAA,IAAI;AACF,IAAA,MAAMN,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,IAAA,OAAO,MAAMyB,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAPsBiB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAYtB,SAAST,kBAAkBH,OAAAA,EAAmB;AAC5C,EAAA,OAAO;AACLpB,IAAAA,EAAAA,EAAIoB,OAAAA,CAAQa,GAAAA;AACZC,IAAAA,IAAAA,EAAMd,QAAQe,UAAAA,IAAc,MAAA;AAC5BT,IAAAA,YAAAA,EAAcN,OAAAA,CAAQM,YAAAA;AACtBU,IAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBC,IAAAA,MAAAA,EAAQjB,OAAAA,CAAQiB,MAAAA;AAChBC,IAAAA,OAAAA,EAASlB,QAAQ,SAAA;AACnB,GAAA;AACF;AATSG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAcF,SAASgB,UAAUC,KAAAA,EAAoB;AAC5C,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,MAAM,IAAIC,MAAM,gBAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOD,KAAAA;AACT;AALgBD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAUT,SAASG,eAAeC,OAAAA,EAAmE;AAIhG,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfN,IAAAA,WAAAA,EAAaiD,QAAQ/C,SAAAA,CAAUI;AACjC,GAAA;AACF;AAdgB0C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,SAASG,iBACdF,OAAAA,EAAU;AAGVJ,EAAAA,SAAAA,CAAUI,QAAQH,KAAK,CAAA;AAEvB,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAGA,EAAA,OAAOE,OAAAA;AACT;AAZgBE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,SAASC,SAASH,OAAAA,EAAsE;AAI7F,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQI,YAAAA,EAAc/C,EAAAA,EAAI;AAC7B,IAAA,MAAM,IAAIyC,MAAM,kCAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfgD,IAAAA,KAAAA,EAAOL,QAAQI,YAAAA,CAAa/C;AAC9B,GAAA;AACF;AAdgB8C,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAmBT,SAASG,YAAYN,OAAAA,EAA0C;AACpE,EAAA,IAAI,CAACA,OAAAA,CAAQO,MAAAA,EAAQlD,EAAAA,EAAI;AACvB,IAAA,MAAM,IAAIyC,MAAM,4BAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOE,QAAQO,MAAAA,CAAOlD,EAAAA;AACxB;AALgBiD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;ACtQhB,IAAIE,cAAAA,GAA+C,IAAA;AAK5C,SAASC,iBAAiBpC,OAAAA,EAA8B;AAC7DmC,EAAAA,cAAAA,GAAiBnC,OAAAA;AACjBzB,EAAAA,MAAAA,CAAOC,MAAM,4CAAA,CAAA;AACf;AAHgB4D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAQhB,SAASC,SAAAA,CAAUC,SAAkBC,GAAAA,EAAW;AAC9C,EAAA,OAAOD,QAAQE,OAAAA,CAAQC,GAAAA,CAAIF,GAAAA,CAAIG,WAAAA,EAAW,CAAA,IAAOC,MAAAA;AACnD;AAFSN,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAIT,SAASO,aAAAA,CAAcC,UAAkBC,QAAAA,EAAgB;AACvD,EAAA,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAAA,CAAKJ,QAAAA,CAAAA;AACnC,EAAA,MAAMK,cAAAA,GAAiBF,MAAAA,CAAOC,IAAAA,CAAKH,QAAAA,CAAAA;AAEnC,EAAA,IAAIC,cAAAA,CAAeI,MAAAA,KAAWD,cAAAA,CAAeC,MAAAA,EAAQ;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOC,MAAAA,CAAOC,eAAAA,CAAgBN,cAAAA,EAAgBG,cAAAA,CAAAA;AAChD;AATSN,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWF,SAASU,uBAAAA,CACdhB,OAAAA,EACAiB,OAAAA,GAA8BC,OAAAA,CAAQC,IAAI,UAAA,CAAA,EAC1CC,oBAAAA,GAA2CF,OAAAA,CAAQC,IAAI,uBAAA,CAAA,IACrDD,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEvC,EAAA,IAAI,CAACpB,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA,EAAe;AACrC,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIiB,YAAY,YAAA,EAAc;AAC5B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMI,uBACJtB,SAAAA,CAAUC,OAAAA,EAAS,0BAAA,CAAA,IAA+BD,SAAAA,CAAUC,SAAS,sBAAA,CAAA;AACvE,EAAA,IAAI,CAACoB,oBAAAA,IAAwB,CAACC,oBAAAA,EAAsB;AAClD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOf,aAAAA,CAAce,sBAAsBD,oBAAAA,CAAAA;AAC7C;AArBgBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA0BhB,SAASM,gBAAgBtB,OAAAA,EAAgB;AAEvC,EAAA,MAAMuB,YAAAA,GAAexB,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMwB,MAAAA,GAASzB,SAAAA,CAAUC,OAAAA,EAAS,WAAA,CAAA;AAClC,EAAA,MAAMyB,EAAAA,GAAKF,cAAcG,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,IAAAA,EAAAA,IAAUH,MAAAA,IAAUnB,MAAAA;AAE5D,EAAA,OAAO;AACLoB,IAAAA,EAAAA;IACAG,SAAAA,EAAW7B,SAAAA,CAAUC,SAAS,YAAA;AAChC,GAAA;AACF;AAVSsB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAwBT,eAAeO,aAAa7B,OAAAA,EAAgB;AAE1C,EAAA,MAAMV,OAAAA,GAAUS,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAIV,OAAAA,IAAW0B,uBAAAA,CAAwBhB,OAAAA,CAAAA,EAAU;AAG/C/D,IAAAA,MAAAA,CAAOC,MAAM,gEAAA,CAAA;AAEb,IAAA,MAAM4F,SAAAA,GAAY/B,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA,IAAmB,MAAA;AACxD,IAAA,MAAM+B,QAAAA,GAAWhC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AAEpC,IAAA,OAAO;MACLtD,EAAAA,EAAI4C,OAAAA;MACJV,IAAAA,EAAMkD,SAAAA;MACN1D,YAAAA,EAAc2B,SAAAA,CAAUC,SAAS,gBAAA,CAAA;MACjClB,SAAAA,EAAWiB,SAAAA,CAAUC,SAAS,aAAA,CAAA;AAC9BjB,MAAAA,MAAAA,EAAQgB,UAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAC7DhB,MAAAA,OAAAA,EACE8C,cAAc,aAAA,IACdC,QAAAA,KAAa,cAAA,IACbA,QAAAA,KAAa,iBACbA,QAAAA,KAAa;AACjB,KAAA;AACF,EAAA;AAEA,EAAA,IAAIzC,OAAAA,EAAS;AACXrD,IAAAA,MAAAA,CAAOe,KAAK,uFAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAMgF,UAAAA,GAAajC,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AAEtC,EAAA,IAAI,CAACgC,UAAAA,EAAYC,UAAAA,CAAW,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMxE,KAAAA,GAAQuE,UAAAA,CAAWE,SAAAA,CAAU,CAAA,CAAA;AAEnC,EAAA,IAAI;AACFjG,IAAAA,MAAAA,CAAOC,MAAM,iFAAA,CAAA;AACb,IAAA,MAAM4B,OAAAA,GAAU,MAAMN,SAAAA,CAAUC,KAAAA,CAAAA;AAEhC,IAAA,IAAI,CAACK,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLpB,MAAAA,EAAAA,EAAIoB,OAAAA,CAAQpB,EAAAA;MACZkC,IAAAA,EAAM,MAAA;AACNR,MAAAA,YAAAA,EAAcN,OAAAA,CAAQM;AACxB,KAAA;AACF,EAAA,CAAA,CAAA,OAASrB,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,sCAAsCD,KAAAA,CAAAA;AAClD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAzDe8E,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA8Df,SAASM,cAAcnC,OAAAA,EAAgB;AAErC,EAAA,MAAMoC,QAAAA,GAAWrC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AACpC,EAAA,MAAMqC,cAAAA,GAAiBtC,SAAAA,CAAUC,OAAAA,EAAS,mBAAA,CAAA;AAE1C,EAAA,IAAIoC,QAAAA,EAAU;AACZ,IAAA,OAAO;MACL1F,EAAAA,EAAI0F,QAAAA;AACJE,MAAAA,QAAAA,EAAUD,cAAAA,IAAkB;AAC9B,KAAA;AACF,EAAA;AAGA,EAAA,OAAOxC,gBAAgB0C,aAAAA,IAAiB,IAAA;AAC1C;AAdSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASK,oBAAoBxC,OAAAA,EAAgB;AAC3C,EAAA,MAAMN,QAAQK,SAAAA,CAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAEnE,EAAA,IAAIN,KAAAA,EAAO;AACT,IAAA,OAAO;MAAEhD,EAAAA,EAAIgD;AAAM,KAAA;AACrB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARS8C,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASC,gBAAAA,CAAiBzC,SAAkBd,KAAAA,EAAoB;AAE9D,EAAA,MAAM9C,WAAAA,GAAc2D,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEvC,EAAA,IAAI5D,WAAAA,EAAa;AACf,IAAA,OAAO;MAAEM,EAAAA,EAAIN;AAAY,KAAA;AAC3B,EAAA;AAGA,EAAA,IAAI8C,OAAOd,YAAAA,EAAc;AACvB,IAAA,OAAO;AAAE1B,MAAAA,EAAAA,EAAIwC,KAAAA,CAAMd;AAAa,KAAA;AAClC,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAdSqE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAmBT,SAASC,eAAe1C,OAAAA,EAAgB;AACtC,EAAA,MAAM2C,SAAAA,GAAY5C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI2C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEjG,EAAAA,EAAIiG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaT,SAASE,eAAe5C,OAAAA,EAAgB;AACtC,EAAA,MAAM6C,SAAAA,GAAY9C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI6C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEnG,EAAAA,EAAImG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASE,iBAAiB9C,OAAAA,EAAgB;AACxC,EAAA,MAAM+C,OAAAA,GAAUhD,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACnC,EAAA,MAAMgD,QAAAA,GAAWjD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AACpC,EAAA,MAAMiD,QAAAA,GAAWlD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEpC,EAAA,OAAO;IACL+C,OAAAA,EAASA,OAAAA,EAASG,aAAAA,IAAiB7C,MAAAA;IACnC2C,QAAAA,EAAUA,QAAAA,EAAUE,aAAAA,IAAiB7C,MAAAA;AACrC4C,IAAAA,QAAAA,EAAUA,QAAAA,IAAY5C;AACxB,GAAA;AACF;AAVSyC,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAwBT,SAASK,sBAAsBnD,OAAAA,EAAgB;AAC7C,EAAA,MAAMoD,SAAAA,GAAYrD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAGrC,EAAA,IAAI,CAACoD,SAAAA,EAAW;AACd,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMC,YAAAA,GAAetD,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMsD,eAAAA,GAAkBvD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAC3C,EAAA,MAAMuD,eAAAA,GAAkBxD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAE3C,EAAA,OAAO;AACLoD,IAAAA,SAAAA;IACAI,MAAAA,EAAQH,YAAAA,GAAeA,YAAAA,CAAa3B,KAAAA,CAAM,GAAA,CAAA,CAAK+B,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAE/B,IAAAA,EAAI,CAAA,GAAMtB,MAAAA;AACtEsD,IAAAA,SAAAA,EAAWL,eAAAA,GAAkB,IAAIM,IAAAA,CAAKN,eAAAA,CAAAA,GAAmBjD,MAAAA;AACzDwD,IAAAA,SAAAA,EAAWN,eAAAA,GAAkB,IAAIK,IAAAA,CAAKL,eAAAA,CAAAA,GAAmBlD;AAC3D,GAAA;AACF;AAlBS8C,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA0BT,eAAsBW,aAAa9D,OAAAA,EAAgB;AACjD,EAAA,IAAI,CAACH,cAAAA,EAAgB;AACnB,IAAA,MAAM,IAAIV,MAAM,wEAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMD,KAAAA,GAAQ,MAAM2C,YAAAA,CAAa7B,OAAAA,CAAAA;AAGjC,EAAA,MAAMJ,MAAAA,GAASuC,cAAcnC,OAAAA,CAAAA;AAC7B,EAAA,MAAMP,YAAAA,GAAe+C,oBAAoBxC,OAAAA,CAAAA;AACzC,EAAA,MAAM1D,SAAAA,GAAYmG,gBAAAA,CAAiBzC,OAAAA,EAASd,KAAAA,CAAAA;AAC5C,EAAA,MAAM6E,OAAAA,GAAUrB,eAAe1C,OAAAA,CAAAA;AAC/B,EAAA,MAAMgE,OAAAA,GAAUpB,eAAe5C,OAAAA,CAAAA;AAC/B,EAAA,MAAMiE,QAAAA,GAAW3C,gBAAgBtB,OAAAA,CAAAA;AACjC,EAAA,MAAMkE,cAAAA,GAAiBf,sBAAsBnD,OAAAA,CAAAA;AAG7C,EAAA,IAAImE,IAAAA;AACJ,EAAA,IAAItE,eAAesE,IAAAA,EAAM;AACvBA,IAAAA,IAAAA,GAAOtE,cAAAA,CAAesE,IAAAA,CAAKC,wBAAAA,CAAyBpE,OAAAA,CAAAA;AACtD,EAAA;AAGA,EAAA,MAAMqE,GAAAA,GAAMvB,iBAAiB9C,OAAAA,CAAAA;AAC7B,EAAA,IAAIqE,GAAAA,CAAItB,OAAAA,IAAWsB,GAAAA,CAAIrB,QAAAA,IAAYqB,IAAIpB,QAAAA,EAAU;AAC/C,IAAA,IAAIkB,IAAAA,EAAM;AAER,MAAA,IAAIE,GAAAA,CAAItB,OAAAA,EAASoB,IAAAA,CAAKpB,OAAAA,GAAUsB,GAAAA,CAAItB,OAAAA;AACpC,MAAA,IAAIsB,GAAAA,CAAIrB,QAAAA,EAAUmB,IAAAA,CAAKnB,QAAAA,GAAWqB,GAAAA,CAAIrB,QAAAA;AACtC,MAAA,IAAIqB,GAAAA,CAAIpB,QAAAA,EAAUkB,IAAAA,CAAKlB,QAAAA,GAAWoB,GAAAA,CAAIpB,QAAAA;IACxC,CAAA,MAAO;AAELkB,MAAAA,IAAAA,GAAO;QACLG,MAAAA,EAAQ,OAAA;QACRC,QAAAA,EAAU,IAAA;AACVxB,QAAAA,OAAAA,EAASsB,GAAAA,CAAItB,OAAAA;AACbC,QAAAA,QAAAA,EAAUqB,GAAAA,CAAIrB,QAAAA;AACdC,QAAAA,QAAAA,EAAUoB,GAAAA,CAAIpB,QAAAA;QACduB,CAAAA,kBAAG,MAAA,CAAA,CAACvE,QAAgBA,GAAAA,EAAjB,GAAA,CAAA;QACHwE,EAAAA,kBAAI,MAAA,CAAA,CAACxE,QAAgBA,GAAAA,EAAjB,IAAA,CAAA;AACJyE,QAAAA,YAAAA,kBAAc,MAAA,CAAA,CAACC,KAAAA,KAAkBC,MAAAA,CAAOD,KAAAA,CAAAA,EAA1B,cAAA,CAAA;AACdE,QAAAA,cAAAA,0BAAiBF,KAAAA,EAAe3B,QAAAA,KAAqB,GAAGA,QAAAA,CAAAA,CAAAA,EAAY2B,KAAAA,CAAAA,CAAAA,EAApD,gBAAA,CAAA;AAChBG,QAAAA,UAAAA,kBAAY,MAAA,CAAA,CAACC,IAAAA,KAAwBH,MAAAA,CAAOG,IAAAA,CAAAA,EAAhC,YAAA,CAAA;AACZC,QAAAA,kBAAAA,0BAAqBL,KAAAA,EAAeM,IAAAA,KAAsC,GAAGN,KAAAA,CAAAA,CAAAA,EAASM,IAAAA,CAAAA,CAAAA,EAAlE,oBAAA;AACtB,OAAA;AACF,IAAA;AACF,EAAA;AAKA,EAAA,MAAMC,UAAAA,GAAAA,CACHhG,KAAAA,EAAON,IAAAA,KAAS,KAAA,IAASM,OAAON,IAAAA,KAAS,SAAA,IAAaM,KAAAA,EAAON,IAAAA,KAAS,iBAAA,KACvEsF,cAAAA,EAAgBd,SAAAA,GACZc,cAAAA,CAAed,YACflE,KAAAA,EAAOxC,EAAAA;AAIb,EAAA,MAAMyI,YAAAA,GAAe;AACnB/I,IAAAA,WAAAA,EAAaE,SAAAA,EAAWI,EAAAA;AACxB0F,IAAAA,QAAAA,EAAUxC,MAAAA,EAAQlD,EAAAA;AAClB4C,IAAAA,OAAAA,EAASJ,KAAAA,EAAOxC,EAAAA;AAChBoF,IAAAA,SAAAA,EAAW5C,KAAAA,EAAON,IAAAA;AAClBwG,IAAAA,cAAAA,EAAgB3F,YAAAA,EAAc/C,EAAAA;AAC9BiG,IAAAA,SAAAA,EAAWoB,OAAAA,EAASrH,EAAAA;AACpBwI,IAAAA;AACF,GAAA;AAEAjJ,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxDE,IAAAA,WAAAA,EAAa+I,aAAa/I,WAAAA,IAAe,MAAA;AACzCkD,IAAAA,OAAAA,EAAS6F,aAAa7F,OAAAA,IAAW,MAAA;IACjC+F,SAAAA,EAAWtF,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA,IAAqB;GACrD,CAAA;AAEAsF,EAAAA,mBAAAA,CAAoBH,YAAAA,CAAAA;AASpBI,EAAAA,cAAAA,CAAeC,kBAAAA,CACbzF,SAAAA,CAAUC,OAAAA,EAAS,qBAAA,CAAA,EACnBD,SAAAA,CAAUC,OAAAA,EAAS,yBAAA,CAAA,EACnBD,SAAAA,CAAUC,OAAAA,EAAS,oBAAA,CAAA,CAAA;AAGrB,EAAA,OAAO;AACLA,IAAAA,OAAAA;AACAd,IAAAA,KAAAA;AACAU,IAAAA,MAAAA;AACAH,IAAAA,YAAAA;AACAnD,IAAAA,SAAAA;AACAyH,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,cAAAA,EAAgBA,cAAAA,IAAkB7D,MAAAA;IAClC6E,UAAAA,EAAYA,UAAAA,IAAchG,OAAOxC,EAAAA,IAAM,EAAA;AACvCL,IAAAA,EAAAA,EAAIwD,eAAevE,KAAAA,EAAK;AACxB6I,IAAAA,IAAAA;AACAsB,IAAAA,eAAAA,EAAiB,IAAIC,OAAAA;AACvB,GAAA;AACF;AA1GsB5B,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA+Gf,SAAS6B,iBAAAA,GAAAA;AACd,EAAA,OAAO9F,cAAAA;AACT;AAFgB8F,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;AC3ahB,IAAMC,iBAAAA,GAAoB;AACxB,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA;;AAGK,SAASC,oBAAAA,CACdC,SACAC,WAAAA,EAAiE;AAEjE,EAAA,MAAMC,UAAAA,GAAAA,CAAcC,MAAMC,OAAAA,CAAQJ,OAAAA,IAAWA,OAAAA,GAAUA,OAAAA,EAASpE,MAAM,GAAA,CAAA,IAAQ,EAAA,EAC3E+B,GAAAA,CAAI,CAAC0C,MAAAA,KAAWA,MAAAA,CAAOxE,MAAI,CAAA,CAC3ByE,OAAOC,OAAAA,CAAAA;AAEV,EAAA,IAAIL,UAAAA,CAAWnF,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAOkF,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,IAAII,UAAAA,CAAWM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAC5B,IAAA,OAAOP,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,OAAOI,UAAAA;AACT;AAjBgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAmBT,SAASU,wBAAAA,CAAyBC,eAA8BC,cAAAA,EAAwB;AAC7F,EAAA,IAAI,CAACD,aAAAA,EAAe;AAClB,IAAA,OAAOC,cAAAA,CAAe,CAAA,CAAA,IAAM,IAAA;AAC9B,EAAA;AAEA,EAAA,OAAOA,cAAAA,CAAeH,QAAAA,CAASE,aAAAA,CAAAA,GAAiBA,aAAAA,GAAgB,IAAA;AAClE;AANgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASG,qBAAqBxH,KAAAA,EAAoB;AACvD,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOA,KAAAA,CAAMF,YAAY,IAAA,IAAQ;AAAC,IAAA,SAAA;AAAW,IAAA;AAAesH,GAAAA,CAAAA,QAAAA,CAASpH,MAAMN,IAAI,CAAA;AACjF;AANgB8H,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;;;ACLhB,IAAIC,eAAAA,GAA+B,IAAA;AAKnC,eAAsBC,aAAaC,UAAAA,EAA4B;AAC7D,EAAA,MAAM,EACJ7K,MAAAA,EACA8K,YAAAA,EACAC,MAAAA,EACAC,WAAAA,EACAC,aAAAA,EACAC,WAAAA,EACApD,YAAAA,EAAcqD,kBAAAA,EACdC,wBAAAA,EACAC,yBAAAA,EACAC,UAAAA,EAAU,GACRT,UAAAA;AAGJ,EAAA,MAAM,EAAEU,MAAAA,EAAM,GAAK,MAAM,OAAO,QAAA,CAAA;AAChC,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,oBAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,IAAAA,EAAI,GAAK,MAAM,OAAO,gBAAA,CAAA;AAC9B,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,cAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,oBAAoBrM,KAAAA,EAAAA,MAAAA,EAAOsM,oBAAkB,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvE,EAAA,MAAM,EAAEC,oBAAAA,EAAoB,GAAK,MAAM,OAAO,wBAAA,CAAA;AAC9C,EAAA,MAAM,EAAEC,mBAAAA,EAAmB,GAAK,MAAM,OAAO,2BAAA,CAAA;AAC7C,EAAA,MAAM,EAAEC,0BAAAA,EAAAA,2BAAAA,EAA0B,GAAK,MAAM,OAAO,gCAAA,CAAA;AAEpD9L,EAAAA,MAAAA,CAAO+L,IAAAA,CAAK,CAAA,sBAAA,EAAyBhM,MAAAA,CAAOiM,WAAW,CAAA,GAAA,CAAK,CAAA;AAG5D,EAAA,MAAMC,QAAAA,GACJlM,MAAAA,CAAOkM,QAAAA,KACNlM,MAAAA,CAAOiM,YAAYhG,UAAAA,CAAW,SAAA,CAAA,GAC3B,QAAA,GACAjG,MAAAA,CAAOiM,WAAAA,CAAYhG,UAAAA,CAAW,SAAA,IAC5B,QAAA,GACA,QAAA,CAAA;AAIR,EAAA,MAAMkG,iCACJd,yBAAAA,KAA8B,IAAA,GAAO,QAAQA,yBAAAA,KAA8B,KAAA,GAAQ,OAAOa,QAAAA,KAAa,QAAA;AAEzGjM,EAAAA,MAAAA,CAAO+L,KAAK,mCAAA,EAAqC;AAC/CE,IAAAA,QAAAA;IACAE,kBAAAA,EAAoBD;GACtB,CAAA;AAEA,EAAA,MAAM,EAAEE,OAAAA,EAAO,GAAKV,kBAAAA,CAAmBb,YAAAA,EAAc9K,OAAOiM,WAAAA,EAAa;IACvEK,wBAAAA,EAA0B,KAAA;IAC1BC,wBAAAA,EAA0BJ,8BAAAA;AAC1B,IAAA,GAAIf,wBAAAA,GAA2B;AAAEA,MAAAA;AAAyB,KAAA,GAAI;GAChE,CAAA;AACA,EAAA,MAAMiB,OAAAA,EAAAA;AAGN,EAAA,IAAIG,YAAAA;AACJ,EAAA,IAAIxM,MAAAA,CAAOmI,IAAAA,EAAMsE,OAAAA,IAAWzM,MAAAA,CAAOmI,KAAKuE,WAAAA,EAAa;AACnDzM,IAAAA,MAAAA,CAAO+L,KAAK,+BAAA,CAAA;AACZQ,IAAAA,YAAAA,GAAe,IAAIG,IAAAA,CAAK;MACtBC,aAAAA,EAAe5M,MAAAA,CAAOmI,KAAKyE,aAAAA,IAAiB,OAAA;MAC5CC,cAAAA,EAAgB7M,MAAAA,CAAOmI,KAAK0E,cAAAA,IAAkB,OAAA;AAC9CH,MAAAA,WAAAA,EAAa1M,OAAOmI,IAAAA,CAAKuE,WAAAA;AACzBI,MAAAA,gBAAAA,EAAkB9M,OAAOmI,IAAAA,CAAK2E,gBAAAA;MAC9BC,SAAAA,EAAW/M,MAAAA,CAAOmI,IAAAA,CAAK4E,SAAAA,IAAa/M,MAAAA,CAAOiM,WAAAA;AAC3Ce,MAAAA,QAAAA,EAAUhN,OAAOmI,IAAAA,CAAK6E,QAAAA;MACtBC,UAAAA,EAAYjN,MAAAA,CAAOmI,KAAK8E,UAAAA,IAAc,IAAA;MACtCC,WAAAA,EAAa,IAAA;MACbC,kBAAAA,EAAoB;KACtB,CAAA;AACA,IAAA,MAAMX,aAAaY,UAAAA,EAAU;AAC7BnN,IAAAA,MAAAA,CAAO+L,IAAAA,CAAK,2CAA2CQ,YAAAA,CAAaa,mBAAAA,GAAsBC,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAO,CAAA;AACxG,EAAA;AAGAxJ,EAAAA,gBAAAA,CAAiB;IACfxE,KAAAA,kBAAO,MAAA,CAAA,MAAMA,QAAAA,EAAN,OAAA,CAAA;IACP6I,IAAAA,EAAMqE;GACR,CAAA;AAGAvL,EAAAA,oBAAAA,EAAAA;AAGA,EAAA,IAAI+J,WAAAA,EAAa;AACf/K,IAAAA,MAAAA,CAAO+L,KAAK,uCAAA,CAAA;AACZ,IAAA,MAAMhB,YAAYoC,UAAAA,EAAU;AAC9B,EAAA;AAGA,EAAA,MAAMG,KAAAA,GAAQvN,OAAO+J,WAAAA,KAAgB,YAAA;AACrC,EAAA,MAAMyD,gBAAAA,GAAmBxN,OAAOwN,gBAAAA,IAAoBD,KAAAA;AAGpD,EAAA,MAAME,qBAAAA,GAAwBzN,MAAAA,CAAO0N,cAAAA,EAAgBjB,OAAAA,IAAWP,QAAAA,KAAa,QAAA;AAC7EjM,EAAAA,MAAAA,CAAO+L,KAAK,CAAA,mBAAA,EAAsBE,QAAAA,sBAA8BuB,qBAAAA,GAAwB,SAAA,GAAY,UAAA,CAAA,CAAY,CAAA;AAEhH,EAAA,MAAME,wBAAwBF,qBAAAA,GAC1B;IACE1B,2BAAAA,CAA2B;MACzBU,OAAAA,EAAS,IAAA;AACTmB,MAAAA,qBAAAA,EAAuB5N,OAAO0N,cAAAA,EAAgBE;KAChD;MAEF,EAAA;AAGJ,EAAA,MAAMC,eAAAA,GAAkB7N,OAAO6N,eAAAA,IAAmB,UAAA;AAClD5N,EAAAA,MAAAA,CAAO+L,KAAK,0DAAA,CAAA;AAEZ,EAAA,MAAM8B,qBAAAA,GAAoC;AACxCC,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEC,QAAAA,EAAUC,aAAAA,EAAa,KAAkD;AACtF,MAAA,MAAMC,WAAAA,GAAcD,aAAAA;AACpB,MAAA,IAAIC,aAAazE,eAAAA,EAAiB;AAChCyE,QAAAA,WAAAA,CAAYzE,eAAAA,CAAgB0E,OAAAA,CAAQ,CAACxF,KAAAA,EAAe1E,GAAAA,KAAAA;AAClD+J,UAAAA,QAAAA,CAAS9J,OAAAA,CAAQkK,MAAAA,CAAOnK,GAAAA,EAAK0E,KAAAA,CAAAA;QAC/B,CAAA,CAAA;AACF,MAAA;IACF,CAAA,EAPY,YAAA;AAQd,GAAA;AAEA,EAAA,MAAM0F,OAAO3C,UAAAA,CAAiC;AAC5CmC,IAAAA,eAAAA;AACA9C,IAAAA,MAAAA;IACAuD,QAAAA,EAAUd,gBAAAA;IACVe,OAAAA,EAAS;AACPrO,MAAAA,KAAAA,6BAAWsO,IAAAA,KAASvO,MAAAA,CAAOC,MAAM,WAAA,EAAA,GAAgBsO,IAAAA,CAAAA,EAA1C,OAAA,CAAA;AACPxC,MAAAA,IAAAA,6BAAUwC,IAAAA,KAASvO,MAAAA,CAAO+L,KAAK,WAAA,EAAA,GAAgBwC,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNxN,MAAAA,IAAAA,6BAAUwN,IAAAA,KAASvO,MAAAA,CAAOe,KAAK,WAAA,EAAA,GAAgBwN,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACNzN,MAAAA,KAAAA,6BAAWyN,IAAAA,KAASvO,MAAAA,CAAOc,MAAM,WAAA,EAAA,GAAgByN,IAAAA,CAAAA,EAA1C,OAAA;AACT,KAAA;IACAC,OAAAA,EAAS;MACPC,8BAAAA,CAA+B;AAAEzC,QAAAA,WAAAA,EAAajM,MAAAA,CAAOiM,WAAAA;AAAalC,QAAAA,WAAAA,EAAa/J,MAAAA,CAAO+J;OAAY,CAAA;AAC/F4D,MAAAA,GAAAA,qBAAAA;AACHG,MAAAA,qBAAAA;AACI5C,MAAAA,GAAAA,WAAAA,IAAe;;IAErB7H,OAAAA,kBAAS,MAAA,CAAA,OAAO,EAAEW,OAAAA,EAAO,KAAE;AAEzB,MAAA,MAAM2K,cAAAA,GAAiB,MAAM7G,YAAAA,CAAa9D,OAAAA,CAAAA;AAG1C,MAAA,IAAImH,kBAAAA,EAAoB;AACtB,QAAA,OAAOA,mBAAmBwD,cAAAA,CAAAA;AAC5B,MAAA;AAEA,MAAA,OAAOA,cAAAA;IACT,CAAA,EAVS,SAAA;GAWX,CAAA;AAGA,EAAA,MAAMC,GAAAA,GAAM,IAAIrD,MAAAA,CAAO;IAAEsD,OAAAA,EAASrD;GAAW,CAAA;AAG7C,EAAA,MAAMsD,WAAAA,GAAcjF,oBAAAA,CAAqB7J,MAAAA,CAAO8O,WAAAA,EAAa9O,OAAO+J,WAAW,CAAA;AAE/E6E,EAAAA,GAAAA,CAAIG,IACFtD,IAAAA,CAAK;IACHtB,MAAAA,EAAQ2E,WAAAA;AACRE,IAAAA,WAAAA,EAAaF,YAAYjK,MAAAA,GAAS,CAAA;IAClCoK,cAAAA,EAAgB;AACd,MAAA,cAAA;AACA,MAAA,eAAA;AACA,MAAA,aAAA;AACA,MAAA,gBAAA;AACA,MAAA,UAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,gBAAA;AACA,MAAA,iBAAA;AACA,MAAA,UAAA;AACA,MAAA,YAAA;AACA,MAAA,eAAA;AACA,MAAA,gBAAA;AACA,MAAA,gBAAA;;AAEA,MAAA,YAAA;AACA,MAAA,cAAA;AACA,MAAA,0BAAA;AACA,MAAA;;IAEFC,OAAAA,EAAS;AAAC,MAAA,KAAA;AAAO,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,OAAA;AAAS,MAAA,QAAA;AAAU,MAAA;;AACrD,GAAA,CAAA,CAAA;AAIF,EAAA,MAAMC,gBAAAA,GAAAA,CAAoBlE,iBAAiB,EAAA,EAAIb,OAAO,CAACgF,EAAAA,KAAOA,GAAGC,OAAO,CAAA;AACxE,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIJ,gBAAAA,CAAiB1H,GAAAA,CAAI,CAAC2H,EAAAA,KAAO;IAACA,EAAAA,CAAGI,IAAAA;AAAMJ,IAAAA;GAAG,CAAA,CAAA;AACvE,EAAA,MAAMK,eAAAA,GAAkBN,gBAAAA,CAAiB1H,GAAAA,CAAI,CAACnB,QAAAA,KAAAA;AAC5C,IAAA,MAAMoJ,YAAAA,GAAepJ,QAAAA,CAASkJ,IAAAA,CAAKG,OAAAA,CAAQ,WAAW,OAAA,CAAA;AACtD,IAAA,OAAO;AACLrJ,MAAAA,QAAAA;AACAoJ,MAAAA,YAAAA;AACAE,MAAAA,KAAAA,EAAO,IAAIC,MAAAA,CAAO,CAAA,CAAA,EAAIH,YAAAA,CAAAA,CAAAA,CAAe;AACvC,KAAA;EACF,CAAA,CAAA;AAGA,EAAA,MAAMI,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAE5B,IAAA,MAAMC,UAAAA,GAAaV,YAAAA,CAAanL,GAAAA,CAAI4L,QAAAA,CAAAA;AACpC,IAAA,IAAIC,YAAY,OAAOA,UAAAA;AAGvB,IAAA,KAAA,MAAW,EAAE1J,QAAAA,EAAUsJ,KAAAA,EAAOF,YAAAA,MAAkBD,eAAAA,EAAiB;AAC/D,MAAA,MAAMQ,OAAAA,GAAUL,KAAAA,CAAMM,IAAAA,CAAKH,QAAAA,CAAAA;AAC3B9P,MAAAA,MAAAA,CAAOC,KAAAA,CACL,CAAA,kBAAA,EAAqB6P,QAAAA,CAAAA,iBAAAA,EAA4BzJ,QAAAA,CAASkJ,IAAI,CAAA,SAAA,EAAYE,YAAAA,CAAAA,UAAAA,EAAyBO,OAAAA,CAAAA,CAAS,CAAA;AAE9G,MAAA,IAAIA,OAAAA,EAAS;AACXhQ,QAAAA,MAAAA,CAAOC,MAAM,CAAA,iBAAA,EAAoB6P,QAAAA,CAAAA,YAAAA,EAAuBzJ,QAAAA,CAASkJ,IAAI,CAAA,CAAE,CAAA;AACvE,QAAA,OAAOlJ,QAAAA;AACT,MAAA;AACF,IAAA;AAEArG,IAAAA,MAAAA,CAAOC,MAAM,CAAA,wCAAA,EAA2C6P,QAAAA,CAAAA,oBAAAA,EAA+BZ,gBAAAA,CAAiBtK,MAAM,CAAA,CAAE,CAAA;AAChH,IAAA,OAAOR,MAAAA;EACT,CAAA,EAnB6B,sBAAA,CAAA;AAyB7BuK,EAAAA,GAAAA,CAAIuB,SAAAA,CAAU,OAAO,EAAEnM,OAAAA,EAAO,KAAE;AAC9B,IAAA,MAAMoM,GAAAA,GAAM,IAAIC,GAAAA,CAAIrM,OAAAA,CAAQoM,GAAG,CAAA;AAC/B,IAAA,MAAML,WAAWK,GAAAA,CAAIL,QAAAA;AACrB9P,IAAAA,MAAAA,CAAOC,MAAM,CAAA,oBAAA,EAAuB8D,OAAAA,CAAQsM,MAAM,CAAA,CAAA,EAAIP,QAAAA,CAAAA,CAAU,CAAA;AAChE,IAAA,MAAMQ,aAAAA,GAAgBR,QAAAA,KAAa,SAAA,IAAaA,QAAAA,CAAS9J,WAAW,UAAA,CAAA;AAGpE,IAAA,MAAMuK,mCAAmB,MAAA,CAAA,MAAA;AACvB,MAAA,MAAMrG,MAAAA,GAASnG,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA,IAAa,GAAA;AAChD,MAAA,MAAMsM,gBAAgBlG,wBAAAA,CAAyBJ,MAAAA,KAAW,GAAA,GAAM,IAAA,GAAOA,QAAQ2E,WAAAA,CAAAA;AAC/E,MAAA,MAAM5K,OAAAA,GAAkC;QACtC,8BAAA,EAAgC,wCAAA;QAChC,8BAAA,EACE;AACJ,OAAA;AAEA,MAAA,IAAIuM,aAAAA,EAAe;AACjBvM,QAAAA,OAAAA,CAAQ,6BAAA,CAAA,GAAiCuM,aAAAA;AACzCvM,QAAAA,OAAAA,CAAQ,kCAAA,CAAA,GAAsC,MAAA;AAChD,MAAA;AAEA,MAAA,OAAOA,OAAAA;IACT,CAAA,EAfyB,kBAAA,CAAA;AAkBzB,IAAA,MAAMwM,eAAAA,GAAkBH,aAAAA,GAAgBlM,MAAAA,GAAYyL,oBAAAA,CAAqBC,QAAAA,CAAAA;AACzE,IAAA,IAAIW,eAAAA,EAAiB;AACnBzQ,MAAAA,MAAAA,CAAOC,MAAM,CAAA,oCAAA,EAAuC6P,QAAAA,CAAAA,IAAAA,EAAeW,eAAAA,CAAgBlB,IAAI,CAAA,CAAE,CAAA;AACzF,MAAA,MAAMmB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIxM,OAAAA,CAAQsM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACR3M,OAAAA,EAASyM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,IAAI3M,OAAAA,CAAQsM,MAAAA,KAAWI,eAAAA,CAAgBJ,MAAAA,EAAQ;AAC7C,QAAA,OAAOjM,MAAAA;AACT,MAAA;AAEA,MAAA,IAAI;AAEF,QAAA,MAAMgL,OAAAA,GAAU,MAAMrL,OAAAA,CAAQ8M,IAAAA,EAAI;AAGlC,QAAA,MAAMzN,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AAGnC,QAAA,MAAM+M,SAAS,MAAML,eAAAA,CAAgBM,OAAAA,CAAQhN,OAAAA,EAASX,SAASgM,OAAAA,CAAAA;AAG/D,QAAA,IAAI0B,kBAAkBH,QAAAA,EAAU;AAE9B,UAAA,MAAM1M,QAAAA,GAAU,IAAIwF,OAAAA,CAAQqH,MAAAA,CAAO7M,OAAO,CAAA;AAC1C,UAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUsI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDzM,YAAAA,QAAAA,CAAQiN,GAAAA,CAAIlN,GAAAA,EAAK0E,KAAAA,CAAAA;AACnB,UAAA;AACA,UAAA,OAAO,IAAIiI,QAAAA,CAASG,MAAAA,CAAOK,IAAAA,EAAM;AAC/BP,YAAAA,MAAAA,EAAQE,MAAAA,CAAOF,MAAAA;AACfQ,YAAAA,UAAAA,EAAYN,MAAAA,CAAOM,UAAAA;YACnBnN,OAAAA,EAAAA;WACF,CAAA;AACF,QAAA;AAGA,QAAA,MAAMA,OAAAA,GAAU,IAAIwF,OAAAA,CAAQ;UAC1B,cAAA,EAAgB,kBAAA;UAChB,GAAGiH;SACL,CAAA;AAEA,QAAA,OAAO,IAAIC,QAAAA,CAAShQ,IAAAA,CAAKE,SAAAA,CAAUiQ,MAAAA,CAAAA,EAAS;UAC1CF,MAAAA,EAAQ,GAAA;AACR3M,UAAAA;SACF,CAAA;AACF,MAAA,CAAA,CAAA,OAASnD,KAAAA,EAAO;AACdd,QAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,kCAAA,EAAqCgP,QAAAA,CAAAA,EAAAA,CAAAA,EAAchP,KAAAA,CAAAA;AAChE,QAAA,MAAM4P,eAAcH,gBAAAA,EAAAA;AACpB,QAAA,MAAMc,SAAAA,GAAYC,gBAAgBxQ,KAAAA,EAAO;AACvCkL,UAAAA,WAAAA,EAAajM,MAAAA,CAAOiM,WAAAA;AACpBlC,UAAAA,WAAAA,EAAa/J,MAAAA,CAAO+J;SACtB,CAAA;AACA,QAAA,OAAO,IAAI6G,QAAAA,CAAShQ,IAAAA,CAAKE,SAAAA,CAAUwQ,SAAAA,CAAUF,IAAI,CAAA,EAAG;AAClDP,UAAAA,MAAAA,EAAQS,SAAAA,CAAUT,MAAAA;UAClB3M,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;YAChB,GAAGyM;AACL;SACF,CAAA;AACF,MAAA;AACF,IAAA;AAUA,IAAA,IAAIZ,QAAAA,KAAa,UAAA,IAAc/L,OAAAA,CAAQsM,MAAAA,KAAW,KAAA,EAAO;AACvD,MAAA,IAAI;AACF,QAAA,MAAMkB,aAAAA,GAAgB,aAAA;AACtB,QAAA,MAAMC,IAAAA,GAAQ,MAAM,OAAOD,aAAAA,CAAAA;AAI3B,QAAA,IAAI;AACFC,UAAAA,IAAAA,CAAKC,qBAAAA,CAAsB;AAAEC,YAAAA,QAAAA,EAAUF,IAAAA,CAAKE;WAAS,CAAA;QACvD,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,MAAMC,QAAAA,GAAW,MAAMH,IAAAA,CAAKE,QAAAA,CAASE,OAAAA,EAAO;AAQ5C,QAAA,IAAIC,OAAAA,GAAU,EAAA;AACd,QAAA,IAAI;AACF,UAAA,MAAMC,yBAAAA,GAA4BC,UAAAA,EAAU;QAC9C,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,IAAI;AACFF,UAAAA,OAAAA,GAAUG,kBAAAA,GAAqBC,kBAAAA,EAAkB;QACnD,CAAA,CAAA,MAAQ;AAER,QAAA;AAEA,QAAA,MAAMC,QAAAA,GAAWL,OAAAA,GAAU,CAAA,EAAGF,QAAAA;AAAaE,EAAAA,OAAAA,CAAAA,CAAAA,GAAYF,QAAAA;AACvD,QAAA,OAAO,IAAIhB,SAASuB,QAAAA,EAAU;UAC5BtB,MAAAA,EAAQ,GAAA;UACR3M,OAAAA,EAAS;YACP,cAAA,EAAgBuN,IAAAA,CAAKE,SAASS,WAAAA,IAAe;AAC/C;SACF,CAAA;MACF,CAAA,CAAA,MAAQ;AAER,MAAA;AACF,IAAA;AAGA,IAAA,MAAMC,UAAAA,GAAa;AAACxE,MAAAA,eAAAA;AAAiB,MAAA,CAAA,EAAGA,eAAAA,CAAAA,CAAAA,CAAAA;AAAoB,MAAA;;AAC5D,IAAA,MAAMyE,kBAAAA,GAAqBD,UAAAA,CAAW/H,QAAAA,CAASyF,QAAAA,CAAAA;AAE/C,IAAA,IAAIuC,kBAAAA,EAAoB;AACtB,MAAA,MAAM3B,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAIxM,OAAAA,CAAQsM,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACR3M,OAAAA,EAASyM;SACX,CAAA;AACF,MAAA;AAGA,MAAA,MAAM4B,eAAe,MAAMC,wBAAAA,CAAyB,MAAMnE,IAAAA,CAAKoE,KAAAA,CAAMzO,OAAAA,CAAAA,EAAU;AAC7EiI,QAAAA,WAAAA,EAAajM,MAAAA,CAAOiM,WAAAA;AACpBlC,QAAAA,WAAAA,EAAa/J,MAAAA,CAAO+J;OACtB,CAAA;AAGA,MAAA,MAAM7F,OAAAA,GAAU,IAAIwF,OAAAA,CAAQ6I,YAAAA,CAAarO,OAAO,CAAA;AAChD,MAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAUsI,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtDzM,QAAAA,OAAAA,CAAQiN,GAAAA,CAAIlN,KAAK0E,KAAAA,CAAAA;AACnB,MAAA;AAGA,MAAA,OAAO,IAAIiI,QAAAA,CAAS2B,YAAAA,CAAanB,IAAAA,EAAM;AACrCP,QAAAA,MAAAA,EAAQ0B,YAAAA,CAAa1B,MAAAA;AACrBQ,QAAAA,UAAAA,EAAYkB,YAAAA,CAAalB,UAAAA;AACzBnN,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,OAAOG,MAAAA;EACT,CAAA,CAAA;AAGAuK,EAAAA,GAAAA,CAAIG,GAAAA,CAAIjD,qBAAAA,CAAAA;AAGR8C,EAAAA,GAAAA,CAAIG,IACFlD,oBAAAA,CAAqB;AACnB6G,IAAAA,cAAAA,EAAgB1S,OAAO0S,cAAAA,IAAkB;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW,MAAA;;IACjEC,cAAAA,EAAgB3S,MAAAA,CAAO2S,kBAAkB,EAAA;AACzCC,IAAAA,UAAAA,EAAY5S,OAAO4S,UAAAA,IAAc,KAAA;AACjCC,IAAAA,qBAAAA,EAAuB7S,OAAO6S,qBAAAA,IAAyB;AACzD,GAAA,CAAA,CAAA;AAQF,EAAA,MAAMC,iCAAiB,MAAA,CAAA,OAAO;IAC5BjC,MAAAA,EAAQ,SAAA;AACRkC,IAAAA,OAAAA,EAAS/S,MAAAA,CAAOiM,WAAAA;AAChB+G,IAAAA,OAAAA,EAAShT,OAAOiT,cAAAA,IAAkB,OAAA;IAClCC,SAAAA,EAAAA,iBAAW,IAAItL,IAAAA,EAAAA,EAAOuL,WAAAA;GACxB,CAAA,EALuB,gBAAA,CAAA;AAOvBvE,EAAAA,GAAAA,CAAIzK,GAAAA,CAAI,WAAW2O,cAAAA,CAAAA;AACnBlE,EAAAA,GAAAA,CAAIzK,GAAAA,CAAI,gBAAgB2O,cAAAA,CAAAA;AACxBlE,EAAAA,GAAAA,CAAIzK,GAAAA,CAAI,iBAAiB2O,cAAAA,CAAAA;AACzBlE,EAAAA,GAAAA,CAAIzK,GAAAA,CAAI,mBAAmB2O,cAAAA,CAAAA;AAG3B,EAAA,IAAI9H,WAAAA,EAAa;AAEf4D,IAAAA,GAAAA,CAAIzK,IAAI,mBAAA,EAAqB,OAAO,EAAEH,OAAAA,EAASmN,KAAG,KAAE;AAClD,MAAA,MAAM9N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0G,oBAAAA,CAAqBrH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCiO,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE9P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,OAAOiK,YAAYoI,SAAAA,EAAS;IAC9B,CAAA,CAAA;AAGAxE,IAAAA,GAAAA,CAAIzK,IAAI,mBAAA,EAAqB,OAAO,EAAEkP,KAAAA,EAAOrP,OAAAA,EAASmN,KAAG,KAAE;AACzD,MAAA,MAAM9N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0G,oBAAAA,CAAqBrH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCiO,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE9P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKiT,KAAAA;AACxC,MAAA,OAAOrI,WAAAA,CAAYsI,SAAAA,CAAUlK,cAAAA,EAAgBhJ,WAAAA,CAAAA;IAC/C,CAAA,CAAA;AAGAwO,IAAAA,GAAAA,CAAIzK,IAAI,qBAAA,EAAuB,OAAO,EAAEkP,KAAAA,EAAOrP,OAAAA,EAASmN,KAAG,KAAE;AAC3D,MAAA,MAAM9N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0G,oBAAAA,CAAqBrH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCiO,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE9P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAamT,KAAAA,EAAK,GAAKF,KAAAA;AAK/C,MAAA,MAAMG,WAAAA,GAAcD,KAAAA,EAAO7N,KAAAA,CAAM,GAAA,CAAA,CAAK+B,IAAI,CAACe,CAAAA,KAAMA,CAAAA,CAAE7C,IAAAA,EAAI,CAAA;AACvD,MAAA,OAAOqF,WAAAA,CAAYyI,cAAAA,CAAerK,cAAAA,EAAgBhJ,WAAAA,EAAaoT,WAAAA,CAAAA;IACjE,CAAA,CAAA;AAGA5E,IAAAA,GAAAA,CAAIzK,IAAI,0BAAA,EAA4B,OAAO,EAAEkP,KAAAA,EAAOrP,OAAAA,EAASmN,KAAG,KAAE;AAChE,MAAA,MAAM9N,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0G,oBAAAA,CAAqBrH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCiO,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAE9P,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKiT,KAAAA;AACxC,MAAA,OAAOrI,WAAAA,CAAY0I,mBAAAA,CAAoBtK,cAAAA,EAAgBhJ,WAAAA,CAAAA;IACzD,CAAA,CAAA;AACF,EAAA;AAGA,EAAA,IAAI6K,aAAAA,IAAiBA,aAAAA,CAAcpG,MAAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,KAAA,MAAWyB,YAAY2E,aAAAA,EAAe;AAEpC,MAAA,IAAI3E,SAAS+I,OAAAA,EAAS;AACpBpP,QAAAA,MAAAA,CAAO+L,KAAK,CAAA,uCAAA,EAA0C1F,QAAAA,CAASgK,MAAM,CAAA,CAAA,EAAIhK,QAAAA,CAASkJ,IAAI,CAAA,CAAE,CAAA;AACxF,QAAA;AACF,MAAA;AAEA,MAAA,MAAMwB,OAAAA,mBAAU,MAAA,CAAA,OAAO,EAAEhN,OAAAA,EAAO,KAAwB;AACtD,QAAA,IAAI;AACF,UAAA,MAAMX,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,UAAA,OAAO,MAAMsC,QAAAA,CAAS0K,OAAAA,CAAQhN,OAAAA,EAASX,OAAAA,CAAAA;AACzC,QAAA,CAAA,CAAA,OAAStC,KAAAA,EAAO;AACdd,UAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,8BAAA,EAAiCuF,QAAAA,CAASkJ,IAAI,MAAMzO,KAAAA,CAAAA;AACjE,UAAA,OAAO4S,wBAAwB5S,KAAAA,EAAO;AACpCkL,YAAAA,WAAAA,EAAajM,MAAAA,CAAOiM,WAAAA;AACpBlC,YAAAA,WAAAA,EAAa/J,MAAAA,CAAO+J;WACtB,CAAA;AACF,QAAA;MACF,CAAA,EAXgB,SAAA,CAAA;AAahB,MAAA,QAAQzD,SAASgK,MAAAA;QACf,KAAK,KAAA;AACH1B,UAAAA,GAAAA,CAAIzK,GAAAA,CAAImC,QAAAA,CAASkJ,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,MAAA;AACHpC,UAAAA,GAAAA,CAAIgF,IAAAA,CAAKtN,QAAAA,CAASkJ,IAAAA,EAAMwB,OAAAA,CAAAA;AACxB,UAAA;QACF,KAAK,KAAA;AACHpC,UAAAA,GAAAA,CAAIiF,GAAAA,CAAIvN,QAAAA,CAASkJ,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,OAAA;AACHpC,UAAAA,GAAAA,CAAIkF,KAAAA,CAAMxN,QAAAA,CAASkJ,IAAAA,EAAMwB,OAAAA,CAAAA;AACzB,UAAA;QACF,KAAK,QAAA;AACHpC,UAAAA,GAAAA,CAAImF,MAAAA,CAAOzN,QAAAA,CAASkJ,IAAAA,EAAMwB,OAAAA,CAAAA;AAC1B,UAAA;AACJ;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAMgD,IAAAA,GAAOhU,OAAOgU,IAAAA,IAAQ,SAAA;AAC5B,EAAA,MAAMC,OAAOjU,MAAAA,CAAOiU,IAAAA;AAGpB,EAAA,MAAMC,cAAAA,GAAiC;AACrCtF,IAAAA,GAAAA;IACAuF,MAAAA,EAAQ,IAAA;AACRC,IAAAA,KAAAA,kBAAO,MAAA,CAAA,YAAA;AACLzJ,MAAAA,eAAAA,uBAAsB/C,IAAAA,EAAAA;AAGtBgH,MAAAA,GAAAA,CAAIyF,MAAAA,CAAO;AACTJ,QAAAA,IAAAA;QACAK,QAAAA,EAAUN;OACZ,CAAA;AAIA,MAAA,MAAMO,SAAAA,GAAY3F,GAAAA;AAClBsF,MAAAA,cAAAA,CAAeC,SAASI,SAAAA,CAAUJ,MAAAA;AAElClU,MAAAA,MAAAA,CAAO+L,IAAAA,CAAK,CAAA,UAAA,EAAMhM,MAAAA,CAAOiM,WAAW,CAAA,sBAAA,EAAyB+H,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,CAAAA,EAAOpG,eAAAA,CAAAA,CAAiB,CAAA;IAC/F,CAAA,EAfO,OAAA,CAAA;AAgBP2G,IAAAA,IAAAA,kBAAM,MAAA,CAAA,YAAA;AACJvU,MAAAA,MAAAA,CAAO+L,IAAAA,CAAK,CAAA,kBAAA,EAAqBhM,MAAAA,CAAOiM,WAAW,CAAA,GAAA,CAAK,CAAA;AAExD,MAAA,IAAIX,UAAAA,EAAY;AACd,QAAA,MAAMA,UAAAA,EAAAA;AACR,MAAA;AAEA,MAAA,IAAIN,WAAAA,EAAa;AACf,QAAA,MAAMA,YAAYyJ,QAAAA,EAAQ;AAC5B,MAAA;AAEA,MAAA,MAAM7I,kBAAAA,GAAqB8I,UAAAA,EAAU;AAErC,MAAA,IAAIR,eAAeC,MAAAA,EAAQ;AACzBD,QAAAA,cAAAA,CAAeC,OAAOK,IAAAA,EAAI;AAC5B,MAAA;AAEAvU,MAAAA,MAAAA,CAAO+L,IAAAA,CAAK,CAAA,SAAA,EAAYhM,MAAAA,CAAOiM,WAAW,CAAA,QAAA,CAAU,CAAA;IACtD,CAAA,EAlBM,MAAA,CAAA;AAmBN0I,IAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAA;AACP,MAAA,MAAMC,MAAAA,GAASjK,eAAAA,GAAkBkK,IAAAA,CAAKC,KAAAA,CAAAA,CAAOlN,IAAAA,CAAKmN,GAAAA,EAAG,GAAKpK,eAAAA,CAAgBqK,OAAAA,EAAO,IAAM,GAAA,CAAA,GAAQ,CAAA;AAE/F,MAAA,OAAO;AACL/I,QAAAA,WAAAA,EAAajM,MAAAA,CAAOiM,WAAAA;AACpBgH,QAAAA,cAAAA,EAAgBjT,OAAOiT,cAAAA,IAAkB,OAAA;AACzClJ,QAAAA,WAAAA,EAAa/J,OAAO+J,WAAAA,IAAe,aAAA;AACnCkK,QAAAA,IAAAA;AACAD,QAAAA,IAAAA;AACAnG,QAAAA,eAAAA;QACAoH,SAAAA,EAAWtK,eAAAA,EAAiBwI,aAAAA,IAAiB,EAAA;AAC7CyB,QAAAA;AACF,OAAA;IACF,CAAA,EAbS,SAAA;AAcX,GAAA;AAGA,EAAA,MAAMM,gBAAAA,iCAA0BC,MAAAA,KAAAA;AAC9BlV,IAAAA,MAAAA,CAAO+L,IAAAA,CAAK,CAAA,SAAA,EAAYmJ,MAAAA,CAAAA,sCAAAA,CAA8C,CAAA;AACtE,IAAA,MAAMjB,eAAeM,IAAAA,EAAI;AACzBtP,IAAAA,OAAAA,CAAQkQ,KAAK,CAAA,CAAA;EACf,CAAA,EAJyB,kBAAA,CAAA;AAMzBlQ,EAAAA,OAAAA,CAAQmQ,EAAAA,CAAG,WAAW,MAAA;AACpB,IAAA,KAAKH,iBAAiB,SAAA,CAAA;EACxB,CAAA,CAAA;AACAhQ,EAAAA,OAAAA,CAAQmQ,EAAAA,CAAG,UAAU,MAAA;AACnB,IAAA,KAAKH,iBAAiB,QAAA,CAAA;EACxB,CAAA,CAAA;AAEA,EAAA,OAAOhB,cAAAA;AACT;AA7lBsBtJ,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAomBf,SAAS0K,oBAAoBnV,qBAAAA,EAA4C;AAC9EJ,EAAAA,aAAAA,CAAc;IAAEI,oBAAAA,EAAAA;GAAqB,CAAA;AACvC;AAFgBmV,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * Server Auth Module\n *\n * JWT verification with workspace secret fetching for microservices.\n * Handles HS256 tokens with secrets stored in workspace database.\n */\n\nimport { logger } from '../logger/index.js';\nimport type { IActor, JWTPayload, WorkspaceSecret } from './types.js';\n\n// Type imports from packages\nimport type * as jose from 'jose';\nimport type { VerifyOptions, Jwt, JwtPayload } from 'jsonwebtoken';\n\n/**\n * Workspace model interface for fetching JWT secrets\n */\ninterface WorkspaceModel {\n  findUnique: (args: { where: { id: string } }) => Promise<{ jwtSecret?: unknown } | null>;\n}\n\ninterface DbClient {\n  client: {\n    workspace: WorkspaceModel;\n  };\n}\n\n// Import getDb dynamically to avoid circular dependencies\nlet getDbFn: (() => DbClient) | null = null;\n\nasync function getDb(): Promise<DbClient> {\n  if (!getDbFn) {\n    const prismaModule = await import('../prisma/index.js');\n    // Use unknown first then cast to avoid type inference issues\n    getDbFn = prismaModule.getDb as unknown as () => DbClient;\n  }\n  return getDbFn();\n}\n\n// Interface for the subset of jsonwebtoken we use\ninterface JwtModule {\n  decode(token: string, options?: { complete?: boolean }): string | Jwt | JwtPayload | null;\n  verify(token: string, secretOrPublicKey: string, options?: VerifyOptions): string | JwtPayload;\n}\n\n// Module cache for dynamic imports\nlet joseModule: typeof jose | null = null;\nlet jwtModule: JwtModule | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\nasync function getJwt(): Promise<JwtModule> {\n  if (!jwtModule) {\n    const jwt = await import('jsonwebtoken');\n    // Handle both ESM and CJS module formats\n    jwtModule = (jwt as { default?: JwtModule }).default ?? jwt;\n  }\n  return jwtModule;\n}\n\n/**\n * Fetch workspace secret callback type\n */\nexport type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig {\n  /** Function to fetch workspace JWT secret from database */\n  fetchWorkspaceSecret: FetchWorkspaceSecretFn;\n}\n\nlet authConfig: AuthConfig | null = null;\n\n/**\n * Configure auth module with workspace secret fetching\n */\nexport function configureAuth(config: AuthConfig): void {\n  authConfig = config;\n  logger.debug('[ServerAuth] Auth configured');\n}\n\n/**\n * Default workspace secret fetcher\n *\n * Fetches JWT secret from workspace database. This is the standard implementation\n * that works with any microservice that has access to the workspace model.\n *\n * @param workspaceId - Workspace ID from JWT\n * @returns WorkspaceSecret or null if not found\n */\nexport async function fetchWorkspaceSecret(workspaceId: string): Promise<WorkspaceSecret | null> {\n  try {\n    const db = await getDb();\n    const workspace = await db.client.workspace.findUnique({\n      where: { id: workspaceId },\n    });\n\n    if (!workspace?.jwtSecret) {\n      logger.debug('[ServerAuth] No JWT secret found for workspace', { workspaceId });\n      return null;\n    }\n\n    return JSON.parse(JSON.stringify(workspace.jwtSecret)) as WorkspaceSecret;\n  } catch (error) {\n    logger.warn('[ServerAuth] Error fetching workspace secret', { workspaceId, error });\n    return null;\n  }\n}\n\n/**\n * Configure auth with default workspace secret fetcher\n *\n * This is automatically called by createServer if no custom auth is configured.\n */\nexport function configureDefaultAuth(): void {\n  if (!authConfig) {\n    configureAuth({ fetchWorkspaceSecret });\n    logger.debug('[ServerAuth] Default auth configured with built-in workspace secret fetcher');\n  }\n}\n\n/**\n * Generate a symmetric secret key for JWT signing\n * @returns JWK object with the generated key\n */\nexport async function generateSymmetricSecret(): Promise<jose.JWK> {\n  const joseLib = await getJose();\n  const secret = await joseLib.generateSecret('HS256');\n  const jwk = await joseLib.exportJWK(secret);\n  return jwk;\n}\n\n/**\n * Verify JWT token for workspace-scoped authentication\n *\n * @param token - JWT token to verify\n * @param secret - Optional secret for verification (if not provided, fetches from workspace)\n * @param options - JWT verification options\n * @returns Verified actor information or null if invalid\n */\nexport async function verifyJWT(token: string, secret?: string, options: VerifyOptions = {}): Promise<IActor | null> {\n  try {\n    const jwt = await getJwt();\n    const joseLib = await getJose();\n\n    // Decode to check algorithm and extract workspace_id\n    const decoded = jwt.decode(token, { complete: true });\n\n    if (!decoded || typeof decoded === 'string' || !decoded.payload || typeof decoded.payload !== 'object') {\n      logger.warn('[ServerAuth] Invalid token format');\n      return null;\n    }\n\n    // For workspace-scoped HS256 tokens\n    if (secret) {\n      // Use provided secret\n      const verifiedJwt = jwt.verify(token, secret, options) as JWTPayload;\n      return mapPayloadToActor(verifiedJwt);\n    }\n\n    // Fetch secret from workspace database\n    const decodedJwt = joseLib.decodeJwt(token) as JWTPayload;\n    if (!decodedJwt.workspace_id) {\n      logger.warn('[ServerAuth] No workspace_id found in token');\n      return null;\n    }\n\n    if (!authConfig?.fetchWorkspaceSecret) {\n      logger.error('[ServerAuth] Auth not configured - call configureAuth() first');\n      return null;\n    }\n\n    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);\n    if (!workspaceSecret) {\n      logger.warn('[ServerAuth] Workspace secret not found');\n      return null;\n    }\n\n    const keyLikeSecret = await joseLib.importJWK(workspaceSecret, 'HS256');\n    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options as jose.JWTVerifyOptions);\n    return mapPayloadToActor(verifiedJwt.payload as unknown as JWTPayload);\n  } catch (err) {\n    logger.warn('[ServerAuth] Error verifying JWT:', err);\n    return null;\n  }\n}\n\n/**\n * Decode JWT without verification (for extracting claims)\n */\nexport async function decodeJWT(token: string): Promise<JWTPayload | null> {\n  try {\n    const joseLib = await getJose();\n    return await joseLib.decodeJwt(token);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Map JWT payload to IActor interface\n */\nfunction mapPayloadToActor(payload: JWTPayload): IActor {\n  return {\n    id: payload.sub,\n    type: payload.actor_type ?? 'user',\n    workspace_id: payload.workspace_id,\n    tenant_id: payload.tenant_id,\n    org_id: payload.org_id,\n    isAdmin: payload['isAdmin'] as boolean | undefined,\n  };\n}\n\n/**\n * Check if actor is authenticated\n */\nexport function authCheck(actor: IActor | null): IActor {\n  if (!actor) {\n    throw new Error('Please sign in');\n  }\n  return actor;\n}\n\n/**\n * Check workspace context and return actor ID and workspace ID\n */\nexport function workspaceCheck(context: { actor: IActor | null; workspace: { id: string } | null }): {\n  actorId: string;\n  workspaceId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  return {\n    actorId: actor.id,\n    workspaceId: context.workspace.id,\n  };\n}\n\n/**\n * Require workspace context - type narrowing guard for wspace layer services\n *\n * Validates that both actor and workspace are present in the context,\n * and returns a type-narrowed context where workspace and actor are guaranteed non-null.\n * Use this at the start of resolvers in wspace services to get typed access\n * to workspace context without optional chaining.\n *\n * @throws Error if actor is not authenticated\n * @throws Error if workspace context is missing\n *\n * @example\n * ```typescript\n * // In a resolver:\n * const ctx = requireWorkspace(context);\n * const workspaceId = ctx.workspace.id;  // no optional chaining needed\n * const actorId = ctx.actor.id;          // no optional chaining needed\n * ```\n */\nexport function requireWorkspace<T extends { actor: IActor | null; workspace: { id: string } | null }>(\n  context: T\n): T & { actor: IActor; workspace: { id: string } } {\n  // Validate actor is authenticated (throws if null)\n  authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  // Return the same context object with narrowed types\n  return context as T & { actor: IActor; workspace: { id: string } };\n}\n\n/**\n * Check organization context and return actor ID and org ID\n */\nexport function orgCheck(context: { actor: IActor | null; organization: { id: string } | null }): {\n  actorId: string;\n  orgId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.organization?.id) {\n    throw new Error('Please switch to an organization');\n  }\n\n  return {\n    actorId: actor.id,\n    orgId: context.organization.id,\n  };\n}\n\n/**\n * Check tenant context and return tenant ID\n */\nexport function tenantCheck(context: { tenant: { id: string } | null }): string {\n  if (!context.tenant?.id) {\n    throw new Error('Tenant context is required');\n  }\n  return context.tenant.id;\n}\n\n/**\n * Get effective actor ID for \"on behalf of\" tracking\n *\n * When an app or service acts with user consent, returns the delegating user's ID.\n * Otherwise returns the direct actor ID.\n *\n * This is used to determine the `onBehalfOf` field in database audit trails:\n * - If actor is user → returns user ID (self-action)\n * - If actor is app/service with consent → returns grantedBy user ID\n * - If actor is app/service without consent → returns actor ID (self-action)\n *\n * @param context - GraphQL context with actor and optional consent context\n * @returns Effective actor ID (the responsible principal)\n *\n * @example\n * ```typescript\n * // User acting directly\n * context.actor = { id: \"user-123\", type: \"user\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"user-123\"\n *\n * // Bot acting on behalf of user\n * context.actor = { id: \"bot-456\", type: \"service\" }\n * context.consentContext = { grantedBy: \"user-789\" }\n * getEffectiveActorId(context) // → \"user-789\"\n *\n * // App acting without consent (self-action)\n * context.actor = { id: \"app-abc\", type: \"app\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"app-abc\"\n * ```\n */\nexport function getEffectiveActorId(context: {\n  actor: IActor | null;\n  consentContext?: { grantedBy: string } | null;\n}): string | null {\n  if (!context.actor) {\n    return null;\n  }\n\n  // If actor is app or service acting with user consent, return the delegating user\n  if (\n    (context.actor.type === 'app' || context.actor.type === 'service' || context.actor.type === 'service_account') &&\n    context.consentContext?.grantedBy\n  ) {\n    return context.consentContext.grantedBy;\n  }\n\n  // Otherwise return the direct actor (user self-action or app/service self-action)\n  return context.actor.id;\n}\n","/**\n * Server Context Module\n *\n * Builds GraphQL context from request headers, JWT, and configuration.\n * Automatically populates actor, tenant, workspace, and tracking information.\n *\n * **Actor-Based Authentication:**\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Services verify JWT directly and build actor from payload\n *\n * Uses standard Web API Request (compatible with Bun/Elysia).\n */\n\nimport { logger } from '../logger/index.js';\nimport crypto from 'node:crypto';\nimport { verifyJWT } from './auth.js';\nimport type {\n  GraphQLContext,\n  IActor,\n  ITenant,\n  IOrganization,\n  IWorkspace,\n  IProject,\n  IProduct,\n  ITracking,\n} from './types.js';\nimport type { I18n, I18nContext } from '../i18n/index.js';\nimport { setWorkspaceContext } from '../prisma/workspace-extension.js';\nimport { ContextManager } from '../context/index.js';\n\n/**\n * Context builder options\n */\nexport interface ContextBuilderOptions {\n  /** Database getter function */\n  getDb: () => unknown;\n  /** Default tenant info (optional) */\n  defaultTenant?: ITenant;\n  /** I18n instance (optional) */\n  i18n?: I18n;\n}\n\nlet contextOptions: ContextBuilderOptions | null = null;\n\n/**\n * Configure context builder\n */\nexport function configureContext(options: ContextBuilderOptions): void {\n  contextOptions = options;\n  logger.debug('[ServerContext] Context builder configured');\n}\n\n/**\n * Extract header value from standard Web API Request\n */\nfunction getHeader(request: Request, key: string): string | undefined {\n  return request.headers.get(key.toLowerCase()) ?? undefined;\n}\n\nfunction compareSecret(provided: string, expected: string): boolean {\n  const providedBuffer = Buffer.from(provided);\n  const expectedBuffer = Buffer.from(expected);\n\n  if (providedBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);\n}\n\nexport function shouldTrustActorHeaders(\n  request: Request,\n  nodeEnv: string | undefined = process.env['NODE_ENV'],\n  expectedGatewayToken: string | undefined = process.env['TRUSTED_GATEWAY_TOKEN'] ??\n    process.env['INTERNAL_SERVICE_TOKEN']\n): boolean {\n  if (!getHeader(request, 'x-actor-id')) {\n    return false;\n  }\n\n  if (nodeEnv === 'production') {\n    return true;\n  }\n\n  const providedGatewayToken =\n    getHeader(request, 'x-internal-service-token') || getHeader(request, 'x-gateway-auth-token');\n  if (!expectedGatewayToken || !providedGatewayToken) {\n    return false;\n  }\n\n  return compareSecret(providedGatewayToken, expectedGatewayToken);\n}\n\n/**\n * Extract tracking information from request\n */\nfunction extractTracking(request: Request): ITracking {\n  // Get IP from various possible headers\n  const forwardedFor = getHeader(request, 'x-forwarded-for');\n  const realIp = getHeader(request, 'x-real-ip');\n  const ip = forwardedFor?.split(',')[0]?.trim() || realIp || undefined;\n\n  return {\n    ip,\n    userAgent: getHeader(request, 'user-agent'),\n  };\n}\n\n/**\n * Extract actor from gateway-injected headers or authorization header\n *\n * **Actor-Based Authentication:**\n * - If x-actor-id header exists, trust it (gateway-authenticated)\n * - Otherwise fall back to JWT verification (direct access in dev)\n *\n * This allows:\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Direct service access with JWT → service verifies JWT itself\n * - Development testing: Direct headers → service trusts headers\n */\nasync function extractActor(request: Request): Promise<IActor | null> {\n  // Check for gateway-injected actor headers first\n  const actorId = getHeader(request, 'x-actor-id');\n\n  if (actorId && shouldTrustActorHeaders(request)) {\n    // Gateway has already verified JWT and populated context headers\n    // Trust the headers (gateway is the security perimeter)\n    logger.debug('[ServerContext] Using gateway-authenticated actor from headers');\n\n    const actorType = getHeader(request, 'x-actor-type') || 'user';\n    const userRole = getHeader(request, 'x-user-role');\n\n    return {\n      id: actorId,\n      type: actorType,\n      workspace_id: getHeader(request, 'x-workspace-id'),\n      tenant_id: getHeader(request, 'x-tenant-id'),\n      org_id: getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id'),\n      isAdmin:\n        actorType === 'super_admin' ||\n        userRole === 'TENANT_ADMIN' ||\n        userRole === 'SUPER_ADMIN' ||\n        userRole === 'PLATFORM_ADMIN',\n    };\n  }\n\n  if (actorId) {\n    logger.warn('[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification');\n  }\n\n  // FALLBACK: No gateway headers, verify JWT directly (dev/testing mode)\n  const authHeader = getHeader(request, 'authorization');\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.substring(7);\n\n  try {\n    logger.debug('[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)');\n    const payload = await verifyJWT(token);\n\n    if (!payload) {\n      return null;\n    }\n\n    // Build actor from JWT payload\n    return {\n      id: payload.id,\n      type: 'user', // Default to 'user' if not specified\n      workspace_id: payload.workspace_id,\n    };\n  } catch (error) {\n    logger.warn('[ServerContext] Invalid JWT token:', error);\n    return null;\n  }\n}\n\n/**\n * Extract tenant from headers\n */\nfunction extractTenant(request: Request): ITenant | null {\n  // Check headers\n  const tenantId = getHeader(request, 'x-tenant-id');\n  const tenantEndpoint = getHeader(request, 'x-tenant-endpoint');\n\n  if (tenantId) {\n    return {\n      id: tenantId,\n      endpoint: tenantEndpoint || '',\n    };\n  }\n\n  // Fall back to default tenant if configured\n  return contextOptions?.defaultTenant || null;\n}\n\n/**\n * Extract organization from headers\n */\nfunction extractOrganization(request: Request): IOrganization | null {\n  const orgId = getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id');\n\n  if (orgId) {\n    return { id: orgId };\n  }\n\n  return null;\n}\n\n/**\n * Extract workspace from headers or actor\n */\nfunction extractWorkspace(request: Request, actor: IActor | null): IWorkspace | null {\n  // Check headers first\n  const workspaceId = getHeader(request, 'x-workspace-id');\n\n  if (workspaceId) {\n    return { id: workspaceId };\n  }\n\n  // Fall back to workspace_id from actor\n  if (actor?.workspace_id) {\n    return { id: actor.workspace_id };\n  }\n\n  return null;\n}\n\n/**\n * Extract project from headers\n */\nfunction extractProject(request: Request): IProject | null {\n  const projectId = getHeader(request, 'x-project-id');\n\n  if (projectId) {\n    return { id: projectId };\n  }\n\n  return null;\n}\n\n/**\n * Extract product from headers\n */\nfunction extractProduct(request: Request): IProduct | null {\n  const productId = getHeader(request, 'x-product-id');\n\n  if (productId) {\n    return { id: productId };\n  }\n\n  return null;\n}\n\n/**\n * Extract geography context from headers\n *\n * Geography headers carry the user's selected location context,\n * used for currency defaults, tax calculations, payment routing,\n * data residency, and regional support.\n *\n * Headers:\n * - x-geo-country: ISO 3166-1 alpha-2 country code (e.g., 'IN', 'US', 'DE')\n * - x-geo-currency: ISO 4217 currency code (e.g., 'INR', 'USD', 'EUR')\n * - x-geo-timezone: IANA timezone (e.g., 'Asia/Kolkata', 'America/New_York')\n */\nfunction extractGeography(request: Request): { country?: string; currency?: string; timezone?: string } {\n  const country = getHeader(request, 'x-geo-country');\n  const currency = getHeader(request, 'x-geo-currency');\n  const timezone = getHeader(request, 'x-geo-timezone');\n\n  return {\n    country: country?.toUpperCase() || undefined,\n    currency: currency?.toUpperCase() || undefined,\n    timezone: timezone || undefined,\n  };\n}\n\n/**\n * Extract consent context from headers\n *\n * When an app or service acts on behalf of a user (with user consent),\n * the gateway forwards consent headers. This function extracts them.\n *\n * Headers:\n * - x-consent-granted-by: Actor ID who granted consent (delegating user)\n * - x-consent-scope: Comma-separated scopes\n * - x-consent-granted-at: ISO timestamp when consent was granted\n * - x-consent-expires-at: ISO timestamp when consent expires\n */\nfunction extractConsentContext(request: Request): import('./types.js').ConsentContext | null {\n  const grantedBy = getHeader(request, 'x-consent-granted-by');\n\n  // If no grantedBy, there's no consent delegation\n  if (!grantedBy) {\n    return null;\n  }\n\n  const scopesHeader = getHeader(request, 'x-consent-scope');\n  const grantedAtHeader = getHeader(request, 'x-consent-granted-at');\n  const expiresAtHeader = getHeader(request, 'x-consent-expires-at');\n\n  return {\n    grantedBy,\n    scopes: scopesHeader ? scopesHeader.split(',').map((s) => s.trim()) : undefined,\n    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : undefined,\n    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : undefined,\n  };\n}\n\n/**\n * Build GraphQL context from standard Web Request\n *\n * Also sets the workspace context in AsyncLocalStorage for automatic\n * Prisma workspaceId injection via the workspace extension.\n */\nexport async function buildContext(request: Request): Promise<GraphQLContext> {\n  if (!contextOptions) {\n    throw new Error('[ServerContext] Context not configured - call configureContext() first');\n  }\n\n  // Extract actor from headers/JWT\n  const actor = await extractActor(request);\n\n  // Extract all context parts\n  const tenant = extractTenant(request);\n  const organization = extractOrganization(request);\n  const workspace = extractWorkspace(request, actor);\n  const project = extractProject(request);\n  const product = extractProduct(request);\n  const tracking = extractTracking(request);\n  const consentContext = extractConsentContext(request);\n\n  // Build i18n context if configured\n  let i18n: I18nContext | undefined;\n  if (contextOptions.i18n) {\n    i18n = contextOptions.i18n.createContextFromRequest(request);\n  }\n\n  // Merge geography context from x-geo-* headers into i18n\n  const geo = extractGeography(request);\n  if (geo.country || geo.currency || geo.timezone) {\n    if (i18n) {\n      // Merge geography fields into existing i18n context\n      if (geo.country) i18n.country = geo.country;\n      if (geo.currency) i18n.currency = geo.currency;\n      if (geo.timezone) i18n.timezone = geo.timezone;\n    } else {\n      // Create minimal i18n context with geography only (when i18n module not configured)\n      i18n = {\n        locale: 'en-US',\n        language: 'en',\n        country: geo.country,\n        currency: geo.currency,\n        timezone: geo.timezone,\n        t: (key: string) => key,\n        tp: (key: string) => key,\n        formatNumber: (value: number) => String(value),\n        formatCurrency: (value: number, currency: string) => `${currency} ${value}`,\n        formatDate: (date: Date | string) => String(date),\n        formatRelativeTime: (value: number, unit: Intl.RelativeTimeFormatUnit) => `${value} ${unit}`,\n      };\n    }\n  }\n\n  // Determine onBehalfOf for audit trails\n  // If actor is app/service with consent → use grantedBy (delegating user)\n  // Otherwise → use actor.id (self-action)\n  const onBehalfOf =\n    (actor?.type === 'app' || actor?.type === 'service' || actor?.type === 'service_account') &&\n    consentContext?.grantedBy\n      ? consentContext.grantedBy\n      : actor?.id;\n\n  // Set workspace context in AsyncLocalStorage for Prisma workspace extension\n  // This enables automatic workspaceId injection on create/update operations\n  const wsCtxPayload = {\n    workspaceId: workspace?.id,\n    tenantId: tenant?.id,\n    actorId: actor?.id,\n    actorType: actor?.type,\n    organizationId: organization?.id,\n    projectId: project?.id,\n    onBehalfOf,\n  };\n\n  logger.debug('[ServerContext] Setting workspace context', {\n    workspaceId: wsCtxPayload.workspaceId ?? 'NONE',\n    actorId: wsCtxPayload.actorId ?? 'NONE',\n    rawHeader: getHeader(request, 'x-workspace-id') ?? 'MISSING',\n  });\n\n  setWorkspaceContext(wsCtxPayload);\n\n  // Capture the Cloudflare Access service token for cross-layer calls.\n  // NOTE: this path populates the Prisma workspace store (above), NOT the\n  // general ContextManager ALS — so cross-layer clients reading\n  // ContextManager.getCfAccessHeaders() would otherwise see nothing here.\n  // Record it explicitly (module-level fallback) so resolver-initiated\n  // cross-layer calls re-present it. No-op unless the gateway forwarded the\n  // headers (alpha only; gated upstream on cf-ray).\n  ContextManager.setCfAccessContext(\n    getHeader(request, 'cf-access-client-id'),\n    getHeader(request, 'cf-access-client-secret'),\n    getHeader(request, 'x-cf-authorization')\n  );\n\n  return {\n    request,\n    actor,\n    tenant,\n    organization,\n    workspace,\n    project,\n    product,\n    tracking,\n    consentContext: consentContext || undefined,\n    onBehalfOf: onBehalfOf || actor?.id || '',\n    db: contextOptions.getDb(),\n    i18n,\n    responseHeaders: new Headers(),\n  };\n}\n\n/**\n * Get context options\n */\nexport function getContextOptions(): ContextBuilderOptions | null {\n  return contextOptions;\n}\n","import type { IActor } from './types.js';\n\nconst LOCALHOST_ORIGINS = [\n  'http://localhost:3000',\n  'http://localhost:4000',\n  'http://localhost:5173',\n  'http://127.0.0.1:3000',\n  'http://127.0.0.1:4000',\n  'http://127.0.0.1:5173',\n];\n\nexport function normalizeCorsOrigins(\n  origins: string | string[] | undefined,\n  environment: 'development' | 'staging' | 'production' | undefined\n): string[] {\n  const normalized = (Array.isArray(origins) ? origins : origins?.split(',') || [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\n  if (normalized.length === 0) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  if (normalized.includes('*')) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  return normalized;\n}\n\nexport function resolveAllowedCorsOrigin(requestOrigin: string | null, allowedOrigins: string[]): string | null {\n  if (!requestOrigin) {\n    return allowedOrigins[0] ?? null;\n  }\n\n  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;\n}\n\nexport function canAccessGraphExport(actor: IActor | null): boolean {\n  if (!actor) {\n    return false;\n  }\n\n  return actor.isAdmin === true || ['service', 'super_admin'].includes(actor.type);\n}\n","/**\n * Server Module\n *\n * Main server bootstrapping with Elysia, GraphQL Yoga, and middleware.\n * Uses Bun runtime for high-performance GraphQL services.\n *\n * Provides a simple API for microservices to start a fully configured server.\n */\n\nimport { logger } from '../logger/index.js';\nimport { configureAuth, configureDefaultAuth, type FetchWorkspaceSecretFn } from './auth.js';\nimport { configureContext, buildContext } from './context.js';\nimport type {\n  ServerDefinition,\n  ServerInstance,\n  ServerInfo,\n  ElysiaApp,\n  BunServerHandle,\n  YogaPlugin,\n  GraphQLContext,\n} from './types.js';\nimport { I18n } from '../i18n/index.js';\nimport { canAccessGraphExport, normalizeCorsOrigins, resolveAllowedCorsOrigin } from './security.js';\nimport { getMetricsRegistry } from '../instrumentation/metrics-collector.js';\nimport { getWorkspaceQuotaRegistry } from '../metrics/index.js';\nimport {\n  createHttpErrorResponse,\n  createHumanReadableErrorPlugin,\n  formatHttpError,\n  normalizeGraphQLResponse,\n} from './errors.js';\n\n// Store startup time for uptime calculation\nlet serverStartTime: Date | null = null;\n\n/**\n * Create and configure a server instance using Elysia + GraphQL Yoga\n */\nexport async function createServer(definition: ServerDefinition): Promise<ServerInstance> {\n  const {\n    config,\n    prismaClient,\n    schema,\n    moduleGraph,\n    restEndpoints,\n    yogaPlugins,\n    buildContext: customBuildContext,\n    workspaceExtensionConfig,\n    disableWorkspaceExtension,\n    onShutdown,\n  } = definition;\n\n  // Dynamic imports to avoid requiring these as hard dependencies\n  const { Elysia } = await import('elysia');\n  const { BunAdapter } = await import('elysia/adapter/bun');\n  const { cors } = await import('@elysiajs/cors');\n  const { createYoga } = await import('graphql-yoga');\n  const { initializeDatabase, getDb, getDatabaseManager } = await import('../prisma/index.js');\n  const { createSecurityPlugin } = await import('../middleware/index.js');\n  const { createMetricsPlugin } = await import('../observability/index.js');\n  const { createWorkspaceGuardPlugin } = await import('./workspace-guard.js');\n\n  logger.info(`[Server] Initializing ${config.serviceName}...`);\n\n  // Detect boundary from config or service name — needed before database and guard setup\n  const boundary =\n    config.boundary ??\n    (config.serviceName.startsWith('wspace-')\n      ? 'wspace'\n      : config.serviceName.startsWith('global-')\n        ? 'global'\n        : 'wspace'); // fail-closed: default to wspace (stricter)\n\n  // Initialize database\n  // Workspace extension is auto-disabled for global boundary services unless explicitly enabled\n  const shouldEnableWorkspaceExtension =\n    disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === 'wspace'; // auto-detect: enabled for wspace, disabled for global\n\n  logger.info('[Server] Initializing database...', {\n    boundary,\n    workspaceExtension: shouldEnableWorkspaceExtension,\n  });\n\n  const { connect } = initializeDatabase(prismaClient, config.serviceName, {\n    registerShutdownHandlers: false, // Server manages shutdown handlers itself\n    enableWorkspaceExtension: shouldEnableWorkspaceExtension,\n    ...(workspaceExtensionConfig ? { workspaceExtensionConfig } : {}),\n  });\n  await connect();\n\n  // Initialize i18n if configured\n  let i18nInstance: I18n | undefined;\n  if (config.i18n?.enabled && config.i18n.localesPath) {\n    logger.info('[Server] Initializing i18n...');\n    i18nInstance = new I18n({\n      defaultLocale: config.i18n.defaultLocale || 'en-US',\n      fallbackLocale: config.i18n.fallbackLocale || 'en-US',\n      localesPath: config.i18n.localesPath,\n      supportedLocales: config.i18n.supportedLocales,\n      namespace: config.i18n.namespace || config.serviceName,\n      lazyLoad: config.i18n.lazyLoad,\n      logMissing: config.i18n.logMissing ?? true,\n      enableCache: true,\n      returnKeyOnMissing: true,\n    });\n    await i18nInstance.initialize();\n    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(', ')}`);\n  }\n\n  // Configure context builder\n  configureContext({\n    getDb: () => getDb(),\n    i18n: i18nInstance,\n  });\n\n  // Auto-configure auth with default workspace secret fetcher if not already configured\n  configureDefaultAuth();\n\n  // Initialize module graph if provided\n  if (moduleGraph) {\n    logger.info('[Server] Initializing module graph...');\n    await moduleGraph.initialize();\n  }\n\n  // Determine if playground/introspection should be enabled\n  const isDev = config.environment !== 'production';\n  const enablePlayground = config.enablePlayground ?? isDev;\n\n  // Build workspace guard plugin — auto-enabled for wspace boundary only\n  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === 'wspace';\n  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? 'enabled' : 'disabled'}`);\n\n  const workspaceGuardPlugins = workspaceGuardEnabled\n    ? [\n        createWorkspaceGuardPlugin({\n          enabled: true,\n          whitelistedOperations: config.workspaceGuard?.whitelistedOperations,\n        }),\n      ]\n    : [];\n\n  // Create GraphQL Yoga instance\n  const graphqlEndpoint = config.graphqlEndpoint || '/graphql';\n  logger.info('[Server] Setting up GraphQL Yoga with provided schema...');\n\n  const responseHeadersPlugin: YogaPlugin = {\n    onResponse: ({ response, serverContext }: { response: Response; serverContext: unknown }) => {\n      const yogaContext = serverContext as GraphQLContext;\n      if (yogaContext?.responseHeaders) {\n        yogaContext.responseHeaders.forEach((value: string, key: string) => {\n          response.headers.append(key, value);\n        });\n      }\n    },\n  };\n\n  const yoga = createYoga<{ request: Request }>({\n    graphqlEndpoint,\n    schema, // Use the schema provided by microservice\n    graphiql: enablePlayground,\n    logging: {\n      debug: (...args) => logger.debug('[GraphQL]', ...args),\n      info: (...args) => logger.info('[GraphQL]', ...args),\n      warn: (...args) => logger.warn('[GraphQL]', ...args),\n      error: (...args) => logger.error('[GraphQL]', ...args),\n    },\n    plugins: [\n      createHumanReadableErrorPlugin({ serviceName: config.serviceName, environment: config.environment }),\n      ...workspaceGuardPlugins,\n      responseHeadersPlugin,\n      ...(yogaPlugins || []),\n    ],\n    context: async ({ request }) => {\n      // Build default context\n      const defaultContext = await buildContext(request);\n\n      // Apply custom context builder if provided\n      if (customBuildContext) {\n        return customBuildContext(defaultContext);\n      }\n\n      return defaultContext;\n    },\n  });\n\n  // Create Elysia instance with Bun adapter\n  const app = new Elysia({ adapter: BunAdapter });\n\n  // Register CORS middleware\n  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);\n\n  app.use(\n    cors({\n      origin: corsOrigins,\n      credentials: corsOrigins.length > 0,\n      allowedHeaders: [\n        'Content-Type',\n        'Authorization',\n        'X-Tenant-ID',\n        'X-Workspace-ID',\n        'X-Org-ID',\n        'X-Project-ID',\n        'X-Product-ID',\n        'X-CSRF-Token',\n        'X-Service-Name',\n        'Accept-Language',\n        'X-Locale',\n        'X-Language',\n        'X-Geo-Country',\n        'X-Geo-Currency',\n        'X-Geo-Timezone',\n        // Actor headers (gateway-injected or dev mode)\n        'X-Actor-ID',\n        'X-Actor-Type',\n        'X-Internal-Service-Token',\n        'X-Gateway-Auth-Token',\n      ],\n      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n    })\n  );\n\n  // Collect raw body endpoints for early interception\n  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);\n  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [ep.path, ep]));\n  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {\n    const regexPattern = endpoint.path.replace(/:[^/]+/g, '[^/]+');\n    return {\n      endpoint,\n      regexPattern,\n      regex: new RegExp(`^${regexPattern}$`),\n    };\n  });\n\n  // Helper to match pathname against endpoint patterns (including :param placeholders)\n  const matchRawBodyEndpoint = (pathname: string): (typeof rawBodyEndpoints)[0] | undefined => {\n    // First try exact match (for non-parameterized paths)\n    const exactMatch = rawBodyPaths.get(pathname);\n    if (exactMatch) return exactMatch;\n\n    // Try pattern matching for parameterized paths like /webhooks/slack/:channelId\n    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {\n      const isMatch = regex.test(pathname);\n      logger.debug(\n        `[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`\n      );\n      if (isMatch) {\n        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);\n        return endpoint;\n      }\n    }\n\n    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);\n    return undefined;\n  };\n\n  // Handle GraphQL, metrics, and raw body requests BEFORE any middleware that consumes the body\n  // This is critical because Yoga needs the raw request body stream\n  // and webhook endpoints need raw body for signature verification\n  // onRequest runs before onParse (body parsing) and onBeforeHandle\n  app.onRequest(async ({ request }) => {\n    const url = new URL(request.url);\n    const pathname = url.pathname;\n    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);\n    const isHealthRoute = pathname === '/health' || pathname.startsWith('/health/');\n\n    // Build CORS headers helper\n    const buildCorsHeaders = (): Record<string, string> => {\n      const origin = request.headers.get('origin') || '*';\n      const allowedOrigin = resolveAllowedCorsOrigin(origin === '*' ? null : origin, corsOrigins);\n      const headers: Record<string, string> = {\n        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n        'Access-Control-Allow-Headers':\n          'Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token',\n      };\n\n      if (allowedOrigin) {\n        headers['Access-Control-Allow-Origin'] = allowedOrigin;\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n\n      return headers;\n    };\n\n    // Check if this is a raw body endpoint (webhooks) - now supports parameterized paths\n    const rawBodyEndpoint = isHealthRoute ? undefined : matchRawBodyEndpoint(pathname);\n    if (rawBodyEndpoint) {\n      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight for raw body endpoints\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Only process if method matches\n      if (request.method !== rawBodyEndpoint.method) {\n        return undefined; // Let other handlers deal with it\n      }\n\n      try {\n        // Read raw body BEFORE any parsing\n        const rawBody = await request.text();\n\n        // Build context without consuming body (body already read)\n        const context = await buildContext(request);\n\n        // Call the handler with raw body\n        const result = await rawBodyEndpoint.handler(request, context, rawBody);\n\n        // If handler returns a Response, use it directly\n        if (result instanceof Response) {\n          // Add CORS headers\n          const headers = new Headers(result.headers);\n          for (const [key, value] of Object.entries(corsHeaders)) {\n            headers.set(key, value);\n          }\n          return new Response(result.body, {\n            status: result.status,\n            statusText: result.statusText,\n            headers,\n          });\n        }\n\n        // Otherwise, serialize as JSON\n        const headers = new Headers({\n          'Content-Type': 'application/json',\n          ...corsHeaders,\n        });\n\n        return new Response(JSON.stringify(result), {\n          status: 200,\n          headers,\n        });\n      } catch (error) {\n        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);\n        const corsHeaders = buildCorsHeaders();\n        const formatted = formatHttpError(error, {\n          serviceName: config.serviceName,\n          environment: config.environment,\n        });\n        return new Response(JSON.stringify(formatted.body), {\n          status: formatted.status,\n          headers: {\n            'Content-Type': 'application/json',\n            ...corsHeaders,\n          },\n        });\n      }\n    }\n\n    // Serve Prometheus metrics via prom-client at /metrics.\n    // The graphql-yoga prometheus plugin populates the same default registry,\n    // so GraphQL-level metrics (operation durations, error counts, etc.) are\n    // included automatically without needing Yoga to handle this route.\n    //\n    // Also includes SDK MetricsRegistry metrics (business counters/histograms\n    // created via @burdenoff/be-sdk/instrumentation factories) so that custom\n    // service metrics are available without a separate /api/metrics endpoint.\n    if (pathname === '/metrics' && request.method === 'GET') {\n      try {\n        const promClientMod = 'prom-client';\n        const prom = (await import(promClientMod)) as unknown as {\n          register: { metrics: () => Promise<string> | string; contentType?: string };\n          collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n        };\n        try {\n          prom.collectDefaultMetrics({ register: prom.register });\n        } catch {\n          /* already called */\n        }\n        const promBody = await prom.register.metrics();\n\n        // Append SDK MetricsRegistry metrics (business counters, histograms,\n        // gauges) that are created via @burdenoff/be-sdk/instrumentation\n        // factories. The toPrometheusFormat() method is deliberately not cached\n        // — each scrape gets a fresh snapshot including dynamic label values.\n        // Also refresh workspace quota gauges (Prisma groupBy queries) so they\n        // appear alongside generic metrics without a separate scrape target.\n        let sdkBody = '';\n        try {\n          await getWorkspaceQuotaRegistry().collectAll();\n        } catch {\n          /* workspace quota registry not configured; skip */\n        }\n        try {\n          sdkBody = getMetricsRegistry().toPrometheusFormat();\n        } catch {\n          /* MetricsRegistry not initialised; serve prom-client output alone */\n        }\n\n        const combined = sdkBody ? `${promBody}\\n${sdkBody}` : promBody;\n        return new Response(combined, {\n          status: 200,\n          headers: {\n            'Content-Type': prom.register.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n          },\n        });\n      } catch {\n        // fall through — prom-client not installed; let Yoga handle as fallback\n      }\n    }\n\n    // Routes that should be handled by Yoga (GraphQL endpoint only)\n    const yogaRoutes = [graphqlEndpoint, `${graphqlEndpoint}/`, '/metrics'];\n    const shouldHandleByYoga = yogaRoutes.includes(pathname);\n\n    if (shouldHandleByYoga) {\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Get response from Yoga\n      const yogaResponse = await normalizeGraphQLResponse(await yoga.fetch(request), {\n        serviceName: config.serviceName,\n        environment: config.environment,\n      });\n\n      // Add CORS headers to Yoga response\n      const headers = new Headers(yogaResponse.headers);\n      for (const [key, value] of Object.entries(corsHeaders)) {\n        headers.set(key, value);\n      }\n\n      // Return response with CORS headers\n      return new Response(yogaResponse.body, {\n        status: yogaResponse.status,\n        statusText: yogaResponse.statusText,\n        headers,\n      });\n    }\n    // Return undefined to continue to next handlers for non-GraphQL requests\n    return undefined;\n  });\n\n  // Register metrics middleware (after GraphQL interception)\n  app.use(createMetricsPlugin());\n\n  // Register security middleware (after GraphQL interception)\n  app.use(\n    createSecurityPlugin({\n      csrfSkipRoutes: config.csrfSkipRoutes || ['/graphql', '/health', '/api/graph/'],\n      loginEndpoints: config.loginEndpoints || [],\n      enableCSRF: config.enableCSRF ?? false, // Disabled by default for GraphQL services\n      enableSessionSecurity: config.enableSessionSecurity ?? false,\n    })\n  );\n\n  // Health check endpoints\n  // /health - General health check\n  // /health/live - Kubernetes liveness probe\n  // /health/ready - Kubernetes readiness probe\n  // /health/startup - Kubernetes startup probe\n  const healthResponse = () => ({\n    status: 'healthy',\n    service: config.serviceName,\n    version: config.serviceVersion || '1.0.0',\n    timestamp: new Date().toISOString(),\n  });\n\n  app.get('/health', healthResponse);\n  app.get('/health/live', healthResponse);\n  app.get('/health/ready', healthResponse);\n  app.get('/health/startup', healthResponse);\n\n  // Graph API endpoints (if moduleGraph provided)\n  if (moduleGraph) {\n    // Get graph configuration schema\n    app.get('/api/graph/schema', async ({ request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      return moduleGraph.getSchema();\n    });\n\n    // Export all graph data\n    app.get('/api/graph/export', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportAll(organizationId, workspaceId);\n    });\n\n    // Export entities only\n    app.get('/api/graph/entities', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId, types } = query as {\n        organizationId?: string;\n        workspaceId?: string;\n        types?: string;\n      };\n      const entityTypes = types?.split(',').map((t) => t.trim());\n      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);\n    });\n\n    // Export relationships only\n    app.get('/api/graph/relationships', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportRelationships(organizationId, workspaceId);\n    });\n  }\n\n  // Register custom REST endpoints (skip rawBody endpoints - they're handled in onRequest)\n  if (restEndpoints && restEndpoints.length > 0) {\n    for (const endpoint of restEndpoints) {\n      // Skip rawBody endpoints - they're intercepted in onRequest before body parsing\n      if (endpoint.rawBody) {\n        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);\n        continue;\n      }\n\n      const handler = async ({ request }: { request: Request }): Promise<unknown> => {\n        try {\n          const context = await buildContext(request);\n          return await endpoint.handler(request, context);\n        } catch (error) {\n          logger.error(`[Server] REST endpoint error (${endpoint.path}):`, error);\n          return createHttpErrorResponse(error, {\n            serviceName: config.serviceName,\n            environment: config.environment,\n          });\n        }\n      };\n\n      switch (endpoint.method) {\n        case 'GET':\n          app.get(endpoint.path, handler);\n          break;\n        case 'POST':\n          app.post(endpoint.path, handler);\n          break;\n        case 'PUT':\n          app.put(endpoint.path, handler);\n          break;\n        case 'PATCH':\n          app.patch(endpoint.path, handler);\n          break;\n        case 'DELETE':\n          app.delete(endpoint.path, handler);\n          break;\n      }\n    }\n  }\n\n  const host = config.host || '0.0.0.0';\n  const port = config.port;\n\n  // Create server instance\n  const serverInstance: ServerInstance = {\n    app: app as unknown as ElysiaApp,\n    server: null,\n    start: async () => {\n      serverStartTime = new Date();\n\n      // Call listen() which starts the server and makes app.server available\n      app.listen({\n        port,\n        hostname: host,\n      });\n\n      // Access the Bun server instance from the app\n      // Cast through unknown to satisfy TypeScript since Elysia's types are complex\n      const elysiaApp = app as unknown as { server: BunServerHandle | null };\n      serverInstance.server = elysiaApp.server;\n\n      logger.info(`🚀 ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);\n    },\n    stop: async () => {\n      logger.info(`[Server] Stopping ${config.serviceName}...`);\n\n      if (onShutdown) {\n        await onShutdown();\n      }\n\n      if (moduleGraph) {\n        await moduleGraph.shutdown();\n      }\n\n      await getDatabaseManager().disconnect();\n\n      if (serverInstance.server) {\n        serverInstance.server.stop();\n      }\n\n      logger.info(`[Server] ${config.serviceName} stopped`);\n    },\n    getInfo: (): ServerInfo => {\n      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1000) : 0;\n\n      return {\n        serviceName: config.serviceName,\n        serviceVersion: config.serviceVersion || '1.0.0',\n        environment: config.environment || 'development',\n        port,\n        host,\n        graphqlEndpoint,\n        startedAt: serverStartTime?.toISOString() || '',\n        uptime,\n      };\n    },\n  };\n\n  // Setup graceful shutdown handlers\n  const gracefulShutdown = async (signal: string): Promise<never> => {\n    logger.info(`[Server] ${signal} received, shutting down gracefully...`);\n    await serverInstance.stop();\n    process.exit(0);\n  };\n\n  process.on('SIGTERM', () => {\n    void gracefulShutdown('SIGTERM');\n  });\n  process.on('SIGINT', () => {\n    void gracefulShutdown('SIGINT');\n  });\n\n  return serverInstance;\n}\n\n/**\n * Configure auth with workspace secret fetcher\n *\n * This should be called before creating the server if using workspace-scoped JWT\n */\nexport function configureServerAuth(fetchWorkspaceSecret: FetchWorkspaceSecretFn): void {\n  configureAuth({ fetchWorkspaceSecret });\n}\n"]}
+{"version":3,"sources":["../../src/server/auth.ts","../../src/server/context.ts","../../src/server/security.ts","../../src/server/quotaGaugeRefresh.ts","../../src/server/server.ts"],"names":["getDbFn","getDb","prismaModule","joseModule","jwtModule","getJose","getJwt","jwt","default","authConfig","configureAuth","config","logger","debug","fetchWorkspaceSecret","workspaceId","db","workspace","client","findUnique","where","id","jwtSecret","JSON","parse","stringify","error","warn","configureDefaultAuth","generateSymmetricSecret","joseLib","secret","generateSecret","jwk","exportJWK","verifyJWT","token","options","decoded","decode","complete","payload","verifiedJwt","verify","mapPayloadToActor","decodedJwt","decodeJwt","workspace_id","workspaceSecret","keyLikeSecret","importJWK","jwtVerify","err","decodeJWT","sub","type","actor_type","tenant_id","org_id","isAdmin","authCheck","actor","Error","workspaceCheck","context","actorId","requireWorkspace","orgCheck","organization","orgId","tenantCheck","tenant","contextOptions","configureContext","getHeader","request","key","headers","get","toLowerCase","undefined","compareSecret","provided","expected","providedBuffer","Buffer","from","expectedBuffer","length","crypto","timingSafeEqual","shouldTrustActorHeaders","nodeEnv","process","env","expectedGatewayToken","providedGatewayToken","extractTracking","forwardedFor","realIp","ip","split","trim","userAgent","extractActor","actorType","userRole","authHeader","startsWith","substring","extractTenant","tenantId","tenantEndpoint","endpoint","defaultTenant","extractOrganization","extractWorkspace","extractProject","projectId","extractProduct","productId","extractGeography","country","currency","timezone","toUpperCase","extractConsentContext","grantedBy","scopesHeader","grantedAtHeader","expiresAtHeader","scopes","map","s","grantedAt","Date","expiresAt","buildContext","project","product","tracking","consentContext","i18n","createContextFromRequest","geo","locale","language","t","tp","formatNumber","value","String","formatCurrency","formatDate","date","formatRelativeTime","unit","onBehalfOf","wsCtxPayload","organizationId","rawHeader","setWorkspaceContext","ContextManager","setCfAccessContext","responseHeaders","Headers","getContextOptions","LOCALHOST_ORIGINS","normalizeCorsOrigins","origins","environment","normalized","Array","isArray","origin","filter","Boolean","includes","resolveAllowedCorsOrigin","requestOrigin","allowedOrigins","canAccessGraphExport","QUOTA_GAUGE_TTL_MS","QUOTA_GAUGE_REFRESH_TIMEOUT_MS","createQuotaGaugeRefresher","opts","ttlMs","timeoutMs","now","refreshedAt","inFlight","refresh","timer","Promise","race","resolve","collect","then","setTimeout","clearTimeout","lastRefreshedAt","serverStartTime","quotaGaugeRefresher","getWorkspaceQuotaRegistry","collectAll","createServer","definition","prismaClient","schema","moduleGraph","restEndpoints","yogaPlugins","customBuildContext","workspaceExtensionConfig","disableWorkspaceExtension","onShutdown","Elysia","BunAdapter","cors","createYoga","initializeDatabase","getDatabaseManager","createSecurityPlugin","createMetricsPlugin","createWorkspaceGuardPlugin","info","serviceName","boundary","shouldEnableWorkspaceExtension","workspaceExtension","connect","registerShutdownHandlers","enableWorkspaceExtension","i18nInstance","enabled","localesPath","I18n","defaultLocale","fallbackLocale","supportedLocales","namespace","lazyLoad","logMissing","enableCache","returnKeyOnMissing","initialize","getSupportedLocales","join","isDev","enablePlayground","workspaceGuardEnabled","workspaceGuard","workspaceGuardPlugins","whitelistedOperations","graphqlEndpoint","responseHeadersPlugin","onResponse","response","serverContext","yogaContext","forEach","append","yoga","graphiql","logging","args","plugins","createHumanReadableErrorPlugin","defaultContext","app","adapter","corsOrigins","use","credentials","allowedHeaders","methods","rawBodyEndpoints","ep","rawBody","rawBodyPaths","Map","path","rawBodyMatchers","regexPattern","replace","regex","RegExp","matchRawBodyEndpoint","pathname","exactMatch","isMatch","test","onRequest","url","URL","method","isHealthRoute","buildCorsHeaders","allowedOrigin","rawBodyEndpoint","corsHeaders","Response","status","text","result","handler","Object","entries","set","body","statusText","formatted","formatHttpError","promClientMod","prom","collectDefaultMetrics","register","promBody","metrics","sdkBody","getMetricsRegistry","toPrometheusFormat","combined","contentType","yogaRoutes","shouldHandleByYoga","yogaResponse","normalizeGraphQLResponse","fetch","csrfSkipRoutes","loginEndpoints","enableCSRF","enableSessionSecurity","healthResponse","service","version","serviceVersion","timestamp","toISOString","getSchema","query","exportAll","types","entityTypes","exportEntities","exportRelationships","createHttpErrorResponse","post","put","patch","delete","host","port","serverInstance","server","start","listen","hostname","elysiaApp","stop","shutdown","disconnect","getInfo","uptime","Math","floor","getTime","startedAt","gracefulShutdown","signal","exit","on","configureServerAuth"],"mappings":";;;;;;;;;;;;AA4BA,IAAIA,OAAAA,GAAmC,IAAA;AAEvC,eAAeC,KAAAA,GAAAA;AACb,EAAA,IAAI,CAACD,OAAAA,EAAS;AACZ,IAAA,MAAME,YAAAA,GAAe,MAAM,OAAO,oBAAA,CAAA;AAElCF,IAAAA,OAAAA,GAAUE,YAAAA,CAAaD,KAAAA;AACzB,EAAA;AACA,EAAA,OAAOD,OAAAA,EAAAA;AACT;AAPeC,MAAAA,CAAAA,KAAAA,EAAAA,OAAAA,CAAAA;AAgBf,IAAIE,UAAAA,GAAiC,IAAA;AACrC,IAAIC,SAAAA,GAA8B,IAAA;AAElC,eAAeC,OAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,UAAAA,EAAY;AACfA,IAAAA,UAAAA,GAAa,MAAM,OAAO,MAAA,CAAA;AAC5B,EAAA;AACA,EAAA,OAAOA,UAAAA;AACT;AALeE,MAAAA,CAAAA,OAAAA,EAAAA,SAAAA,CAAAA;AAOf,eAAeC,MAAAA,GAAAA;AACb,EAAA,IAAI,CAACF,SAAAA,EAAW;AACd,IAAA,MAAMG,GAAAA,GAAM,MAAM,OAAO,cAAA,CAAA;AAEzBH,IAAAA,SAAAA,GAAaG,IAAgCC,OAAAA,IAAWD,GAAAA;AAC1D,EAAA;AACA,EAAA,OAAOH,SAAAA;AACT;AAPeE,MAAAA,CAAAA,MAAAA,EAAAA,QAAAA,CAAAA;AAsBf,IAAIG,UAAAA,GAAgC,IAAA;AAK7B,SAASC,cAAcC,MAAAA,EAAkB;AAC9CF,EAAAA,UAAAA,GAAaE,MAAAA;AACbC,EAAAA,MAAAA,CAAOC,MAAM,8BAAA,CAAA;AACf;AAHgBH,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAchB,eAAsBI,qBAAqBC,WAAAA,EAAmB;AAC5D,EAAA,IAAI;AACF,IAAA,MAAMC,EAAAA,GAAK,MAAMf,KAAAA,EAAAA;AACjB,IAAA,MAAMgB,SAAAA,GAAY,MAAMD,EAAAA,CAAGE,MAAAA,CAAOD,UAAUE,UAAAA,CAAW;MACrDC,KAAAA,EAAO;QAAEC,EAAAA,EAAIN;AAAY;KAC3B,CAAA;AAEA,IAAA,IAAI,CAACE,WAAWK,SAAAA,EAAW;AACzBV,MAAAA,MAAAA,CAAOC,MAAM,gDAAA,EAAkD;AAAEE,QAAAA;OAAY,CAAA;AAC7E,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOQ,KAAKC,KAAAA,CAAMD,IAAAA,CAAKE,SAAAA,CAAUR,SAAAA,CAAUK,SAAS,CAAA,CAAA;AACtD,EAAA,CAAA,CAAA,OAASI,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,KAAK,8CAAA,EAAgD;AAAEZ,MAAAA,WAAAA;AAAaW,MAAAA;KAAM,CAAA;AACjF,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAjBsBZ,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAwBf,SAASc,oBAAAA,GAAAA;AACd,EAAA,IAAI,CAACnB,UAAAA,EAAY;AACfC,IAAAA,aAAAA,CAAc;AAAEI,MAAAA;KAAqB,CAAA;AACrCF,IAAAA,MAAAA,CAAOC,MAAM,6EAAA,CAAA;AACf,EAAA;AACF;AALgBe,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAWhB,eAAsBC,uBAAAA,GAAAA;AACpB,EAAA,MAAMC,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,EAAA,MAAM0B,MAAAA,GAAS,MAAMD,OAAAA,CAAQE,cAAAA,CAAe,OAAA,CAAA;AAC5C,EAAA,MAAMC,GAAAA,GAAM,MAAMH,OAAAA,CAAQI,SAAAA,CAAUH,MAAAA,CAAAA;AACpC,EAAA,OAAOE,GAAAA;AACT;AALsBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AAetB,eAAsBM,SAAAA,CAAUC,KAAAA,EAAeL,MAAAA,EAAiBM,OAAAA,GAAyB,EAAC,EAAC;AACzF,EAAA,IAAI;AACF,IAAA,MAAM9B,GAAAA,GAAM,MAAMD,MAAAA,EAAAA;AAClB,IAAA,MAAMwB,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AAGtB,IAAA,MAAMiC,OAAAA,GAAU/B,GAAAA,CAAIgC,MAAAA,CAAOH,KAAAA,EAAO;MAAEI,QAAAA,EAAU;KAAK,CAAA;AAEnD,IAAA,IAAI,CAACF,OAAAA,IAAW,OAAOA,OAAAA,KAAY,QAAA,IAAY,CAACA,OAAAA,CAAQG,OAAAA,IAAW,OAAOH,OAAAA,CAAQG,OAAAA,KAAY,QAAA,EAAU;AACtG7B,MAAAA,MAAAA,CAAOe,KAAK,mCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,IAAII,MAAAA,EAAQ;AAEV,MAAA,MAAMW,YAAAA,GAAcnC,GAAAA,CAAIoC,MAAAA,CAAOP,KAAAA,EAAOL,QAAQM,OAAAA,CAAAA;AAC9C,MAAA,OAAOO,kBAAkBF,YAAAA,CAAAA;AAC3B,IAAA;AAGA,IAAA,MAAMG,UAAAA,GAAaf,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;AACrC,IAAA,IAAI,CAACS,WAAWE,YAAAA,EAAc;AAC5BnC,MAAAA,MAAAA,CAAOe,KAAK,6CAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAAClB,YAAYK,oBAAAA,EAAsB;AACrCF,MAAAA,MAAAA,CAAOc,MAAM,+DAAA,CAAA;AACb,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,eAAAA,GAAkB,MAAMvC,UAAAA,CAAWK,oBAAAA,CAAqB+B,WAAWE,YAAY,CAAA;AACrF,IAAA,IAAI,CAACC,eAAAA,EAAiB;AACpBpC,MAAAA,MAAAA,CAAOe,KAAK,yCAAA,CAAA;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMsB,aAAAA,GAAgB,MAAMnB,OAAAA,CAAQoB,SAAAA,CAAUF,iBAAiB,OAAA,CAAA;AAC/D,IAAA,MAAMN,cAAc,MAAMZ,OAAAA,CAAQqB,SAAAA,CAAUf,KAAAA,EAAOa,eAAeZ,OAAAA,CAAAA;AAClE,IAAA,OAAOO,iBAAAA,CAAkBF,YAAYD,OAAO,CAAA;AAC9C,EAAA,CAAA,CAAA,OAASW,GAAAA,EAAK;AACZxC,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,qCAAqCyB,GAAAA,CAAAA;AACjD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AA7CsBjB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAkDtB,eAAsBkB,UAAUjB,KAAAA,EAAa;AAC3C,EAAA,IAAI;AACF,IAAA,MAAMN,OAAAA,GAAU,MAAMzB,OAAAA,EAAAA;AACtB,IAAA,OAAO,MAAMyB,OAAAA,CAAQgB,SAAAA,CAAUV,KAAAA,CAAAA;EACjC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAPsBiB,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAYtB,SAAST,kBAAkBH,OAAAA,EAAmB;AAC5C,EAAA,OAAO;AACLpB,IAAAA,EAAAA,EAAIoB,OAAAA,CAAQa,GAAAA;AACZC,IAAAA,IAAAA,EAAMd,QAAQe,UAAAA,IAAc,MAAA;AAC5BT,IAAAA,YAAAA,EAAcN,OAAAA,CAAQM,YAAAA;AACtBU,IAAAA,SAAAA,EAAWhB,OAAAA,CAAQgB,SAAAA;AACnBC,IAAAA,MAAAA,EAAQjB,OAAAA,CAAQiB,MAAAA;AAChBC,IAAAA,OAAAA,EAASlB,QAAQ,SAAA;AACnB,GAAA;AACF;AATSG,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAcF,SAASgB,UAAUC,KAAAA,EAAoB;AAC5C,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,MAAM,IAAIC,MAAM,gBAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOD,KAAAA;AACT;AALgBD,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAUT,SAASG,eAAeC,OAAAA,EAAmE;AAIhG,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfN,IAAAA,WAAAA,EAAaiD,QAAQ/C,SAAAA,CAAUI;AACjC,GAAA;AACF;AAdgB0C,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAmCT,SAASG,iBACdF,OAAAA,EAAU;AAGVJ,EAAAA,SAAAA,CAAUI,QAAQH,KAAK,CAAA;AAEvB,EAAA,IAAI,CAACG,OAAAA,CAAQ/C,SAAAA,EAAWI,EAAAA,EAAI;AAC1B,IAAA,MAAM,IAAIyC,MAAM,8BAAA,CAAA;AAClB,EAAA;AAGA,EAAA,OAAOE,OAAAA;AACT;AAZgBE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAiBT,SAASC,SAASH,OAAAA,EAAsE;AAI7F,EAAA,MAAMH,KAAAA,GAAQD,SAAAA,CAAUI,OAAAA,CAAQH,KAAK,CAAA;AAErC,EAAA,IAAI,CAACG,OAAAA,CAAQI,YAAAA,EAAc/C,EAAAA,EAAI;AAC7B,IAAA,MAAM,IAAIyC,MAAM,kCAAA,CAAA;AAClB,EAAA;AAEA,EAAA,OAAO;AACLG,IAAAA,OAAAA,EAASJ,KAAAA,CAAMxC,EAAAA;AACfgD,IAAAA,KAAAA,EAAOL,QAAQI,YAAAA,CAAa/C;AAC9B,GAAA;AACF;AAdgB8C,MAAAA,CAAAA,QAAAA,EAAAA,UAAAA,CAAAA;AAmBT,SAASG,YAAYN,OAAAA,EAA0C;AACpE,EAAA,IAAI,CAACA,OAAAA,CAAQO,MAAAA,EAAQlD,EAAAA,EAAI;AACvB,IAAA,MAAM,IAAIyC,MAAM,4BAAA,CAAA;AAClB,EAAA;AACA,EAAA,OAAOE,QAAQO,MAAAA,CAAOlD,EAAAA;AACxB;AALgBiD,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;ACtQhB,IAAIE,cAAAA,GAA+C,IAAA;AAK5C,SAASC,iBAAiBpC,OAAAA,EAA8B;AAC7DmC,EAAAA,cAAAA,GAAiBnC,OAAAA;AACjBzB,EAAAA,MAAAA,CAAOC,MAAM,4CAAA,CAAA;AACf;AAHgB4D,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAQhB,SAASC,SAAAA,CAAUC,SAAkBC,GAAAA,EAAW;AAC9C,EAAA,OAAOD,QAAQE,OAAAA,CAAQC,GAAAA,CAAIF,GAAAA,CAAIG,WAAAA,EAAW,CAAA,IAAOC,MAAAA;AACnD;AAFSN,MAAAA,CAAAA,SAAAA,EAAAA,WAAAA,CAAAA;AAIT,SAASO,aAAAA,CAAcC,UAAkBC,QAAAA,EAAgB;AACvD,EAAA,MAAMC,cAAAA,GAAiBC,MAAAA,CAAOC,IAAAA,CAAKJ,QAAAA,CAAAA;AACnC,EAAA,MAAMK,cAAAA,GAAiBF,MAAAA,CAAOC,IAAAA,CAAKH,QAAAA,CAAAA;AAEnC,EAAA,IAAIC,cAAAA,CAAeI,MAAAA,KAAWD,cAAAA,CAAeC,MAAAA,EAAQ;AACnD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOC,MAAAA,CAAOC,eAAAA,CAAgBN,cAAAA,EAAgBG,cAAAA,CAAAA;AAChD;AATSN,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAWF,SAASU,uBAAAA,CACdhB,OAAAA,EACAiB,OAAAA,GAA8BC,OAAAA,CAAQC,IAAI,UAAA,CAAA,EAC1CC,oBAAAA,GAA2CF,OAAAA,CAAQC,IAAI,uBAAA,CAAA,IACrDD,OAAAA,CAAQC,GAAAA,CAAI,wBAAA,CAAA,EAAyB;AAEvC,EAAA,IAAI,CAACpB,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA,EAAe;AACrC,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,IAAIiB,YAAY,YAAA,EAAc;AAC5B,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMI,uBACJtB,SAAAA,CAAUC,OAAAA,EAAS,0BAAA,CAAA,IAA+BD,SAAAA,CAAUC,SAAS,sBAAA,CAAA;AACvE,EAAA,IAAI,CAACoB,oBAAAA,IAAwB,CAACC,oBAAAA,EAAsB;AAClD,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOf,aAAAA,CAAce,sBAAsBD,oBAAAA,CAAAA;AAC7C;AArBgBJ,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA;AA0BhB,SAASM,gBAAgBtB,OAAAA,EAAgB;AAEvC,EAAA,MAAMuB,YAAAA,GAAexB,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMwB,MAAAA,GAASzB,SAAAA,CAAUC,OAAAA,EAAS,WAAA,CAAA;AAClC,EAAA,MAAMyB,EAAAA,GAAKF,cAAcG,KAAAA,CAAM,GAAA,EAAK,CAAA,CAAA,EAAIC,IAAAA,EAAAA,IAAUH,MAAAA,IAAUnB,MAAAA;AAE5D,EAAA,OAAO;AACLoB,IAAAA,EAAAA;IACAG,SAAAA,EAAW7B,SAAAA,CAAUC,SAAS,YAAA;AAChC,GAAA;AACF;AAVSsB,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAwBT,eAAeO,aAAa7B,OAAAA,EAAgB;AAE1C,EAAA,MAAMV,OAAAA,GAAUS,SAAAA,CAAUC,OAAAA,EAAS,YAAA,CAAA;AAEnC,EAAA,IAAIV,OAAAA,IAAW0B,uBAAAA,CAAwBhB,OAAAA,CAAAA,EAAU;AAG/C/D,IAAAA,MAAAA,CAAOC,MAAM,gEAAA,CAAA;AAEb,IAAA,MAAM4F,SAAAA,GAAY/B,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA,IAAmB,MAAA;AACxD,IAAA,MAAM+B,QAAAA,GAAWhC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AAEpC,IAAA,OAAO;MACLtD,EAAAA,EAAI4C,OAAAA;MACJV,IAAAA,EAAMkD,SAAAA;MACN1D,YAAAA,EAAc2B,SAAAA,CAAUC,SAAS,gBAAA,CAAA;MACjClB,SAAAA,EAAWiB,SAAAA,CAAUC,SAAS,aAAA,CAAA;AAC9BjB,MAAAA,MAAAA,EAAQgB,UAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAC7DhB,MAAAA,OAAAA,EACE8C,cAAc,aAAA,IACdC,QAAAA,KAAa,cAAA,IACbA,QAAAA,KAAa,iBACbA,QAAAA,KAAa;AACjB,KAAA;AACF,EAAA;AAEA,EAAA,IAAIzC,OAAAA,EAAS;AACXrD,IAAAA,MAAAA,CAAOe,KAAK,uFAAA,CAAA;AACd,EAAA;AAGA,EAAA,MAAMgF,UAAAA,GAAajC,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AAEtC,EAAA,IAAI,CAACgC,UAAAA,EAAYC,UAAAA,CAAW,SAAA,CAAA,EAAY;AACtC,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMxE,KAAAA,GAAQuE,UAAAA,CAAWE,SAAAA,CAAU,CAAA,CAAA;AAEnC,EAAA,IAAI;AACFjG,IAAAA,MAAAA,CAAOC,MAAM,iFAAA,CAAA;AACb,IAAA,MAAM4B,OAAAA,GAAU,MAAMN,SAAAA,CAAUC,KAAAA,CAAAA;AAEhC,IAAA,IAAI,CAACK,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AAGA,IAAA,OAAO;AACLpB,MAAAA,EAAAA,EAAIoB,OAAAA,CAAQpB,EAAAA;MACZkC,IAAAA,EAAM,MAAA;AACNR,MAAAA,YAAAA,EAAcN,OAAAA,CAAQM;AACxB,KAAA;AACF,EAAA,CAAA,CAAA,OAASrB,KAAAA,EAAO;AACdd,IAAAA,MAAAA,CAAOe,IAAAA,CAAK,sCAAsCD,KAAAA,CAAAA;AAClD,IAAA,OAAO,IAAA;AACT,EAAA;AACF;AAzDe8E,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA8Df,SAASM,cAAcnC,OAAAA,EAAgB;AAErC,EAAA,MAAMoC,QAAAA,GAAWrC,SAAAA,CAAUC,OAAAA,EAAS,aAAA,CAAA;AACpC,EAAA,MAAMqC,cAAAA,GAAiBtC,SAAAA,CAAUC,OAAAA,EAAS,mBAAA,CAAA;AAE1C,EAAA,IAAIoC,QAAAA,EAAU;AACZ,IAAA,OAAO;MACL1F,EAAAA,EAAI0F,QAAAA;AACJE,MAAAA,QAAAA,EAAUD,cAAAA,IAAkB;AAC9B,KAAA;AACF,EAAA;AAGA,EAAA,OAAOxC,gBAAgB0C,aAAAA,IAAiB,IAAA;AAC1C;AAdSJ,MAAAA,CAAAA,aAAAA,EAAAA,eAAAA,CAAAA;AAmBT,SAASK,oBAAoBxC,OAAAA,EAAgB;AAC3C,EAAA,MAAMN,QAAQK,SAAAA,CAAUC,OAAAA,EAAS,UAAA,CAAA,IAAeD,SAAAA,CAAUC,SAAS,mBAAA,CAAA;AAEnE,EAAA,IAAIN,KAAAA,EAAO;AACT,IAAA,OAAO;MAAEhD,EAAAA,EAAIgD;AAAM,KAAA;AACrB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARS8C,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAaT,SAASC,gBAAAA,CAAiBzC,SAAkBd,KAAAA,EAAoB;AAE9D,EAAA,MAAM9C,WAAAA,GAAc2D,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEvC,EAAA,IAAI5D,WAAAA,EAAa;AACf,IAAA,OAAO;MAAEM,EAAAA,EAAIN;AAAY,KAAA;AAC3B,EAAA;AAGA,EAAA,IAAI8C,OAAOd,YAAAA,EAAc;AACvB,IAAA,OAAO;AAAE1B,MAAAA,EAAAA,EAAIwC,KAAAA,CAAMd;AAAa,KAAA;AAClC,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AAdSqE,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAmBT,SAASC,eAAe1C,OAAAA,EAAgB;AACtC,EAAA,MAAM2C,SAAAA,GAAY5C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI2C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEjG,EAAAA,EAAIiG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAaT,SAASE,eAAe5C,OAAAA,EAAgB;AACtC,EAAA,MAAM6C,SAAAA,GAAY9C,SAAAA,CAAUC,OAAAA,EAAS,cAAA,CAAA;AAErC,EAAA,IAAI6C,SAAAA,EAAW;AACb,IAAA,OAAO;MAAEnG,EAAAA,EAAImG;AAAU,KAAA;AACzB,EAAA;AAEA,EAAA,OAAO,IAAA;AACT;AARSD,MAAAA,CAAAA,cAAAA,EAAAA,gBAAAA,CAAAA;AAsBT,SAASE,iBAAiB9C,OAAAA,EAAgB;AACxC,EAAA,MAAM+C,OAAAA,GAAUhD,SAAAA,CAAUC,OAAAA,EAAS,eAAA,CAAA;AACnC,EAAA,MAAMgD,QAAAA,GAAWjD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AACpC,EAAA,MAAMiD,QAAAA,GAAWlD,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA;AAEpC,EAAA,OAAO;IACL+C,OAAAA,EAASA,OAAAA,EAASG,aAAAA,IAAiB7C,MAAAA;IACnC2C,QAAAA,EAAUA,QAAAA,EAAUE,aAAAA,IAAiB7C,MAAAA;AACrC4C,IAAAA,QAAAA,EAAUA,QAAAA,IAAY5C;AACxB,GAAA;AACF;AAVSyC,MAAAA,CAAAA,gBAAAA,EAAAA,kBAAAA,CAAAA;AAwBT,SAASK,sBAAsBnD,OAAAA,EAAgB;AAC7C,EAAA,MAAMoD,SAAAA,GAAYrD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAGrC,EAAA,IAAI,CAACoD,SAAAA,EAAW;AACd,IAAA,OAAO,IAAA;AACT,EAAA;AAEA,EAAA,MAAMC,YAAAA,GAAetD,SAAAA,CAAUC,OAAAA,EAAS,iBAAA,CAAA;AACxC,EAAA,MAAMsD,eAAAA,GAAkBvD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAC3C,EAAA,MAAMuD,eAAAA,GAAkBxD,SAAAA,CAAUC,OAAAA,EAAS,sBAAA,CAAA;AAE3C,EAAA,OAAO;AACLoD,IAAAA,SAAAA;IACAI,MAAAA,EAAQH,YAAAA,GAAeA,YAAAA,CAAa3B,KAAAA,CAAM,GAAA,CAAA,CAAK+B,GAAAA,CAAI,CAACC,CAAAA,KAAMA,CAAAA,CAAE/B,IAAAA,EAAI,CAAA,GAAMtB,MAAAA;AACtEsD,IAAAA,SAAAA,EAAWL,eAAAA,GAAkB,IAAIM,IAAAA,CAAKN,eAAAA,CAAAA,GAAmBjD,MAAAA;AACzDwD,IAAAA,SAAAA,EAAWN,eAAAA,GAAkB,IAAIK,IAAAA,CAAKL,eAAAA,CAAAA,GAAmBlD;AAC3D,GAAA;AACF;AAlBS8C,MAAAA,CAAAA,qBAAAA,EAAAA,uBAAAA,CAAAA;AA0BT,eAAsBW,aAAa9D,OAAAA,EAAgB;AACjD,EAAA,IAAI,CAACH,cAAAA,EAAgB;AACnB,IAAA,MAAM,IAAIV,MAAM,wEAAA,CAAA;AAClB,EAAA;AAGA,EAAA,MAAMD,KAAAA,GAAQ,MAAM2C,YAAAA,CAAa7B,OAAAA,CAAAA;AAGjC,EAAA,MAAMJ,MAAAA,GAASuC,cAAcnC,OAAAA,CAAAA;AAC7B,EAAA,MAAMP,YAAAA,GAAe+C,oBAAoBxC,OAAAA,CAAAA;AACzC,EAAA,MAAM1D,SAAAA,GAAYmG,gBAAAA,CAAiBzC,OAAAA,EAASd,KAAAA,CAAAA;AAC5C,EAAA,MAAM6E,OAAAA,GAAUrB,eAAe1C,OAAAA,CAAAA;AAC/B,EAAA,MAAMgE,OAAAA,GAAUpB,eAAe5C,OAAAA,CAAAA;AAC/B,EAAA,MAAMiE,QAAAA,GAAW3C,gBAAgBtB,OAAAA,CAAAA;AACjC,EAAA,MAAMkE,cAAAA,GAAiBf,sBAAsBnD,OAAAA,CAAAA;AAG7C,EAAA,IAAImE,IAAAA;AACJ,EAAA,IAAItE,eAAesE,IAAAA,EAAM;AACvBA,IAAAA,IAAAA,GAAOtE,cAAAA,CAAesE,IAAAA,CAAKC,wBAAAA,CAAyBpE,OAAAA,CAAAA;AACtD,EAAA;AAGA,EAAA,MAAMqE,GAAAA,GAAMvB,iBAAiB9C,OAAAA,CAAAA;AAC7B,EAAA,IAAIqE,GAAAA,CAAItB,OAAAA,IAAWsB,GAAAA,CAAIrB,QAAAA,IAAYqB,IAAIpB,QAAAA,EAAU;AAC/C,IAAA,IAAIkB,IAAAA,EAAM;AAER,MAAA,IAAIE,GAAAA,CAAItB,OAAAA,EAASoB,IAAAA,CAAKpB,OAAAA,GAAUsB,GAAAA,CAAItB,OAAAA;AACpC,MAAA,IAAIsB,GAAAA,CAAIrB,QAAAA,EAAUmB,IAAAA,CAAKnB,QAAAA,GAAWqB,GAAAA,CAAIrB,QAAAA;AACtC,MAAA,IAAIqB,GAAAA,CAAIpB,QAAAA,EAAUkB,IAAAA,CAAKlB,QAAAA,GAAWoB,GAAAA,CAAIpB,QAAAA;IACxC,CAAA,MAAO;AAELkB,MAAAA,IAAAA,GAAO;QACLG,MAAAA,EAAQ,OAAA;QACRC,QAAAA,EAAU,IAAA;AACVxB,QAAAA,OAAAA,EAASsB,GAAAA,CAAItB,OAAAA;AACbC,QAAAA,QAAAA,EAAUqB,GAAAA,CAAIrB,QAAAA;AACdC,QAAAA,QAAAA,EAAUoB,GAAAA,CAAIpB,QAAAA;QACduB,CAAAA,kBAAG,MAAA,CAAA,CAACvE,QAAgBA,GAAAA,EAAjB,GAAA,CAAA;QACHwE,EAAAA,kBAAI,MAAA,CAAA,CAACxE,QAAgBA,GAAAA,EAAjB,IAAA,CAAA;AACJyE,QAAAA,YAAAA,kBAAc,MAAA,CAAA,CAACC,KAAAA,KAAkBC,MAAAA,CAAOD,KAAAA,CAAAA,EAA1B,cAAA,CAAA;AACdE,QAAAA,cAAAA,0BAAiBF,KAAAA,EAAe3B,QAAAA,KAAqB,GAAGA,QAAAA,CAAAA,CAAAA,EAAY2B,KAAAA,CAAAA,CAAAA,EAApD,gBAAA,CAAA;AAChBG,QAAAA,UAAAA,kBAAY,MAAA,CAAA,CAACC,IAAAA,KAAwBH,MAAAA,CAAOG,IAAAA,CAAAA,EAAhC,YAAA,CAAA;AACZC,QAAAA,kBAAAA,0BAAqBL,KAAAA,EAAeM,IAAAA,KAAsC,GAAGN,KAAAA,CAAAA,CAAAA,EAASM,IAAAA,CAAAA,CAAAA,EAAlE,oBAAA;AACtB,OAAA;AACF,IAAA;AACF,EAAA;AAKA,EAAA,MAAMC,UAAAA,GAAAA,CACHhG,KAAAA,EAAON,IAAAA,KAAS,KAAA,IAASM,OAAON,IAAAA,KAAS,SAAA,IAAaM,KAAAA,EAAON,IAAAA,KAAS,iBAAA,KACvEsF,cAAAA,EAAgBd,SAAAA,GACZc,cAAAA,CAAed,YACflE,KAAAA,EAAOxC,EAAAA;AAIb,EAAA,MAAMyI,YAAAA,GAAe;AACnB/I,IAAAA,WAAAA,EAAaE,SAAAA,EAAWI,EAAAA;AACxB0F,IAAAA,QAAAA,EAAUxC,MAAAA,EAAQlD,EAAAA;AAClB4C,IAAAA,OAAAA,EAASJ,KAAAA,EAAOxC,EAAAA;AAChBoF,IAAAA,SAAAA,EAAW5C,KAAAA,EAAON,IAAAA;AAClBwG,IAAAA,cAAAA,EAAgB3F,YAAAA,EAAc/C,EAAAA;AAC9BiG,IAAAA,SAAAA,EAAWoB,OAAAA,EAASrH,EAAAA;AACpBwI,IAAAA;AACF,GAAA;AAEAjJ,EAAAA,MAAAA,CAAOC,MAAM,2CAAA,EAA6C;AACxDE,IAAAA,WAAAA,EAAa+I,aAAa/I,WAAAA,IAAe,MAAA;AACzCkD,IAAAA,OAAAA,EAAS6F,aAAa7F,OAAAA,IAAW,MAAA;IACjC+F,SAAAA,EAAWtF,SAAAA,CAAUC,OAAAA,EAAS,gBAAA,CAAA,IAAqB;GACrD,CAAA;AAEAsF,EAAAA,mBAAAA,CAAoBH,YAAAA,CAAAA;AASpBI,EAAAA,cAAAA,CAAeC,kBAAAA,CACbzF,SAAAA,CAAUC,OAAAA,EAAS,qBAAA,CAAA,EACnBD,SAAAA,CAAUC,OAAAA,EAAS,yBAAA,CAAA,EACnBD,SAAAA,CAAUC,OAAAA,EAAS,oBAAA,CAAA,CAAA;AAGrB,EAAA,OAAO;AACLA,IAAAA,OAAAA;AACAd,IAAAA,KAAAA;AACAU,IAAAA,MAAAA;AACAH,IAAAA,YAAAA;AACAnD,IAAAA,SAAAA;AACAyH,IAAAA,OAAAA;AACAC,IAAAA,OAAAA;AACAC,IAAAA,QAAAA;AACAC,IAAAA,cAAAA,EAAgBA,cAAAA,IAAkB7D,MAAAA;IAClC6E,UAAAA,EAAYA,UAAAA,IAAchG,OAAOxC,EAAAA,IAAM,EAAA;AACvCL,IAAAA,EAAAA,EAAIwD,eAAevE,KAAAA,EAAK;AACxB6I,IAAAA,IAAAA;AACAsB,IAAAA,eAAAA,EAAiB,IAAIC,OAAAA;AACvB,GAAA;AACF;AA1GsB5B,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AA+Gf,SAAS6B,iBAAAA,GAAAA;AACd,EAAA,OAAO9F,cAAAA;AACT;AAFgB8F,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;;;AC3ahB,IAAMC,iBAAAA,GAAoB;AACxB,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA,uBAAA;AACA,EAAA;;AAGK,SAASC,oBAAAA,CACdC,SACAC,WAAAA,EAAiE;AAEjE,EAAA,MAAMC,UAAAA,GAAAA,CAAcC,MAAMC,OAAAA,CAAQJ,OAAAA,IAAWA,OAAAA,GAAUA,OAAAA,EAASpE,MAAM,GAAA,CAAA,IAAQ,EAAA,EAC3E+B,GAAAA,CAAI,CAAC0C,MAAAA,KAAWA,MAAAA,CAAOxE,MAAI,CAAA,CAC3ByE,OAAOC,OAAAA,CAAAA;AAEV,EAAA,IAAIL,UAAAA,CAAWnF,WAAW,CAAA,EAAG;AAC3B,IAAA,OAAOkF,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,IAAII,UAAAA,CAAWM,QAAAA,CAAS,GAAA,CAAA,EAAM;AAC5B,IAAA,OAAOP,WAAAA,KAAgB,YAAA,GAAe,EAAA,GAAKH,iBAAAA;AAC7C,EAAA;AAEA,EAAA,OAAOI,UAAAA;AACT;AAjBgBH,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAmBT,SAASU,wBAAAA,CAAyBC,eAA8BC,cAAAA,EAAwB;AAC7F,EAAA,IAAI,CAACD,aAAAA,EAAe;AAClB,IAAA,OAAOC,cAAAA,CAAe,CAAA,CAAA,IAAM,IAAA;AAC9B,EAAA;AAEA,EAAA,OAAOA,cAAAA,CAAeH,QAAAA,CAASE,aAAAA,CAAAA,GAAiBA,aAAAA,GAAgB,IAAA;AAClE;AANgBD,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAQT,SAASG,qBAAqBxH,KAAAA,EAAoB;AACvD,EAAA,IAAI,CAACA,KAAAA,EAAO;AACV,IAAA,OAAO,KAAA;AACT,EAAA;AAEA,EAAA,OAAOA,KAAAA,CAAMF,YAAY,IAAA,IAAQ;AAAC,IAAA,SAAA;AAAW,IAAA;AAAesH,GAAAA,CAAAA,QAAAA,CAASpH,MAAMN,IAAI,CAAA;AACjF;AANgB8H,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;;;ACpBT,IAAMC,kBAAAA,GAAqB,GAAA;AAG3B,IAAMC,8BAAAA,GAAiC,GAAA;AAyBvC,SAASC,0BAA0BC,IAAAA,EAAgC;AACxE,EAAA,MAAMC,KAAAA,GAAQD,KAAKC,KAAAA,IAASJ,kBAAAA;AAC5B,EAAA,MAAMK,SAAAA,GAAYF,KAAKE,SAAAA,IAAaJ,8BAAAA;AACpC,EAAA,MAAMK,GAAAA,GAAMH,IAAAA,CAAKG,GAAAA,KAAQ,MAAcrD,KAAKqD,GAAAA,EAAG,CAAA;AAE/C,EAAA,IAAIC,WAAAA,GAAc,CAAA;AAClB,EAAA,IAAIC,QAAAA,GAAiC,IAAA;AAErC,EAAA,MAAMC,0BAAU,MAAA,CAAA,YAAA;AACd,IAAA,IAAIF,WAAAA,KAAgB,CAAA,IAAKD,GAAAA,EAAAA,GAAQC,cAAcH,KAAAA,EAAO;AAEtD,IAAA,IAAI,CAACI,QAAAA,EAAU;AACbA,MAAAA,QAAAA,GAAAA,CAAY,YAAA;AACV,QAAA,IAAIE,KAAAA;AACJ,QAAA,IAAI;AACF,UAAA,MAAMC,QAAQC,IAAAA,CAAK;AACjBD,YAAAA,OAAAA,CAAQE,QAAQV,IAAAA,CAAKW,OAAAA,EAAO,CAAA,CAAIC,IAAAA,CAAK,MAAMrH,KAAAA,CAAAA,CAAAA;YAC3C,IAAIiH,OAAAA,CAAc,CAACE,OAAAA,KAAAA;AACjBH,cAAAA,KAAAA,GAAQM,UAAAA,CAAWH,SAASR,SAAAA,CAAAA;YAC9B,CAAA;AACD,WAAA,CAAA;AAIDE,UAAAA,WAAAA,GAAcD,GAAAA,EAAAA;QAChB,CAAA,CAAA,MAAQ;QAER,CAAA,SAAA;AACE,UAAA,IAAII,KAAAA,KAAUhH,MAAAA,EAAWuH,YAAAA,CAAaP,KAAAA,CAAAA;AACtCF,UAAAA,QAAAA,GAAW,IAAA;AACb,QAAA;MACF,CAAA,GAAA;AACF,IAAA;AAEA,IAAA,MAAMA,QAAAA;EACR,CAAA,EA3BgB,SAAA,CAAA;AA6BhB,EAAA,OAAO;AAAEC,IAAAA,OAAAA;AAASS,IAAAA,eAAAA,+BAA+BX,WAAAA,EAAd,iBAAA;AAA0B,GAAA;AAC/D;AAtCgBL,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;;;ACZhB,IAAIiB,eAAAA,GAA+B,IAAA;AAInC,IAAMC,sBAAsBlB,yBAAAA,CAA0B;AACpDY,EAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAMO,yBAAAA,EAAAA,CAA4BC,UAAAA,EAAU,EAA5C,SAAA;AACX,CAAA,CAAA;AAKA,eAAsBC,aAAaC,UAAAA,EAA4B;AAC7D,EAAA,MAAM,EACJnM,MAAAA,EACAoM,YAAAA,EACAC,MAAAA,EACAC,WAAAA,EACAC,aAAAA,EACAC,WAAAA,EACA1E,YAAAA,EAAc2E,kBAAAA,EACdC,wBAAAA,EACAC,yBAAAA,EACAC,UAAAA,EAAU,GACRT,UAAAA;AAGJ,EAAA,MAAM,EAAEU,MAAAA,EAAM,GAAK,MAAM,OAAO,QAAA,CAAA;AAChC,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,oBAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,IAAAA,EAAI,GAAK,MAAM,OAAO,gBAAA,CAAA;AAC9B,EAAA,MAAM,EAAEC,UAAAA,EAAU,GAAK,MAAM,OAAO,cAAA,CAAA;AACpC,EAAA,MAAM,EAAEC,oBAAoB3N,KAAAA,EAAAA,MAAAA,EAAO4N,oBAAkB,GAAK,MAAM,OAAO,oBAAA,CAAA;AACvE,EAAA,MAAM,EAAEC,oBAAAA,EAAoB,GAAK,MAAM,OAAO,wBAAA,CAAA;AAC9C,EAAA,MAAM,EAAEC,mBAAAA,EAAmB,GAAK,MAAM,OAAO,2BAAA,CAAA;AAC7C,EAAA,MAAM,EAAEC,0BAAAA,EAAAA,2BAAAA,EAA0B,GAAK,MAAM,OAAO,gCAAA,CAAA;AAEpDpN,EAAAA,MAAAA,CAAOqN,IAAAA,CAAK,CAAA,sBAAA,EAAyBtN,MAAAA,CAAOuN,WAAW,CAAA,GAAA,CAAK,CAAA;AAG5D,EAAA,MAAMC,QAAAA,GACJxN,MAAAA,CAAOwN,QAAAA,KACNxN,MAAAA,CAAOuN,YAAYtH,UAAAA,CAAW,SAAA,CAAA,GAC3B,QAAA,GACAjG,MAAAA,CAAOuN,WAAAA,CAAYtH,UAAAA,CAAW,SAAA,IAC5B,QAAA,GACA,QAAA,CAAA;AAIR,EAAA,MAAMwH,iCACJd,yBAAAA,KAA8B,IAAA,GAAO,QAAQA,yBAAAA,KAA8B,KAAA,GAAQ,OAAOa,QAAAA,KAAa,QAAA;AAEzGvN,EAAAA,MAAAA,CAAOqN,KAAK,mCAAA,EAAqC;AAC/CE,IAAAA,QAAAA;IACAE,kBAAAA,EAAoBD;GACtB,CAAA;AAEA,EAAA,MAAM,EAAEE,OAAAA,EAAO,GAAKV,kBAAAA,CAAmBb,YAAAA,EAAcpM,OAAOuN,WAAAA,EAAa;IACvEK,wBAAAA,EAA0B,KAAA;IAC1BC,wBAAAA,EAA0BJ,8BAAAA;AAC1B,IAAA,GAAIf,wBAAAA,GAA2B;AAAEA,MAAAA;AAAyB,KAAA,GAAI;GAChE,CAAA;AACA,EAAA,MAAMiB,OAAAA,EAAAA;AAGN,EAAA,IAAIG,YAAAA;AACJ,EAAA,IAAI9N,MAAAA,CAAOmI,IAAAA,EAAM4F,OAAAA,IAAW/N,MAAAA,CAAOmI,KAAK6F,WAAAA,EAAa;AACnD/N,IAAAA,MAAAA,CAAOqN,KAAK,+BAAA,CAAA;AACZQ,IAAAA,YAAAA,GAAe,IAAIG,IAAAA,CAAK;MACtBC,aAAAA,EAAelO,MAAAA,CAAOmI,KAAK+F,aAAAA,IAAiB,OAAA;MAC5CC,cAAAA,EAAgBnO,MAAAA,CAAOmI,KAAKgG,cAAAA,IAAkB,OAAA;AAC9CH,MAAAA,WAAAA,EAAahO,OAAOmI,IAAAA,CAAK6F,WAAAA;AACzBI,MAAAA,gBAAAA,EAAkBpO,OAAOmI,IAAAA,CAAKiG,gBAAAA;MAC9BC,SAAAA,EAAWrO,MAAAA,CAAOmI,IAAAA,CAAKkG,SAAAA,IAAarO,MAAAA,CAAOuN,WAAAA;AAC3Ce,MAAAA,QAAAA,EAAUtO,OAAOmI,IAAAA,CAAKmG,QAAAA;MACtBC,UAAAA,EAAYvO,MAAAA,CAAOmI,KAAKoG,UAAAA,IAAc,IAAA;MACtCC,WAAAA,EAAa,IAAA;MACbC,kBAAAA,EAAoB;KACtB,CAAA;AACA,IAAA,MAAMX,aAAaY,UAAAA,EAAU;AAC7BzO,IAAAA,MAAAA,CAAOqN,IAAAA,CAAK,2CAA2CQ,YAAAA,CAAaa,mBAAAA,GAAsBC,IAAAA,CAAK,IAAA,CAAA,CAAA,CAAO,CAAA;AACxG,EAAA;AAGA9K,EAAAA,gBAAAA,CAAiB;IACfxE,KAAAA,kBAAO,MAAA,CAAA,MAAMA,QAAAA,EAAN,OAAA,CAAA;IACP6I,IAAAA,EAAM2F;GACR,CAAA;AAGA7M,EAAAA,oBAAAA,EAAAA;AAGA,EAAA,IAAIqL,WAAAA,EAAa;AACfrM,IAAAA,MAAAA,CAAOqN,KAAK,uCAAA,CAAA;AACZ,IAAA,MAAMhB,YAAYoC,UAAAA,EAAU;AAC9B,EAAA;AAGA,EAAA,MAAMG,KAAAA,GAAQ7O,OAAO+J,WAAAA,KAAgB,YAAA;AACrC,EAAA,MAAM+E,gBAAAA,GAAmB9O,OAAO8O,gBAAAA,IAAoBD,KAAAA;AAGpD,EAAA,MAAME,qBAAAA,GAAwB/O,MAAAA,CAAOgP,cAAAA,EAAgBjB,OAAAA,IAAWP,QAAAA,KAAa,QAAA;AAC7EvN,EAAAA,MAAAA,CAAOqN,KAAK,CAAA,mBAAA,EAAsBE,QAAAA,sBAA8BuB,qBAAAA,GAAwB,SAAA,GAAY,UAAA,CAAA,CAAY,CAAA;AAEhH,EAAA,MAAME,wBAAwBF,qBAAAA,GAC1B;IACE1B,2BAAAA,CAA2B;MACzBU,OAAAA,EAAS,IAAA;AACTmB,MAAAA,qBAAAA,EAAuBlP,OAAOgP,cAAAA,EAAgBE;KAChD;MAEF,EAAA;AAGJ,EAAA,MAAMC,eAAAA,GAAkBnP,OAAOmP,eAAAA,IAAmB,UAAA;AAClDlP,EAAAA,MAAAA,CAAOqN,KAAK,0DAAA,CAAA;AAEZ,EAAA,MAAM8B,qBAAAA,GAAoC;AACxCC,IAAAA,UAAAA,kBAAY,MAAA,CAAA,CAAC,EAAEC,QAAAA,EAAUC,aAAAA,EAAa,KAAkD;AACtF,MAAA,MAAMC,WAAAA,GAAcD,aAAAA;AACpB,MAAA,IAAIC,aAAa/F,eAAAA,EAAiB;AAChC+F,QAAAA,WAAAA,CAAY/F,eAAAA,CAAgBgG,OAAAA,CAAQ,CAAC9G,KAAAA,EAAe1E,GAAAA,KAAAA;AAClDqL,UAAAA,QAAAA,CAASpL,OAAAA,CAAQwL,MAAAA,CAAOzL,GAAAA,EAAK0E,KAAAA,CAAAA;QAC/B,CAAA,CAAA;AACF,MAAA;IACF,CAAA,EAPY,YAAA;AAQd,GAAA;AAEA,EAAA,MAAMgH,OAAO3C,UAAAA,CAAiC;AAC5CmC,IAAAA,eAAAA;AACA9C,IAAAA,MAAAA;IACAuD,QAAAA,EAAUd,gBAAAA;IACVe,OAAAA,EAAS;AACP3P,MAAAA,KAAAA,6BAAW4P,IAAAA,KAAS7P,MAAAA,CAAOC,MAAM,WAAA,EAAA,GAAgB4P,IAAAA,CAAAA,EAA1C,OAAA,CAAA;AACPxC,MAAAA,IAAAA,6BAAUwC,IAAAA,KAAS7P,MAAAA,CAAOqN,KAAK,WAAA,EAAA,GAAgBwC,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACN9O,MAAAA,IAAAA,6BAAU8O,IAAAA,KAAS7P,MAAAA,CAAOe,KAAK,WAAA,EAAA,GAAgB8O,IAAAA,CAAAA,EAAzC,MAAA,CAAA;AACN/O,MAAAA,KAAAA,6BAAW+O,IAAAA,KAAS7P,MAAAA,CAAOc,MAAM,WAAA,EAAA,GAAgB+O,IAAAA,CAAAA,EAA1C,OAAA;AACT,KAAA;IACAC,OAAAA,EAAS;MACPC,8BAAAA,CAA+B;AAAEzC,QAAAA,WAAAA,EAAavN,MAAAA,CAAOuN,WAAAA;AAAaxD,QAAAA,WAAAA,EAAa/J,MAAAA,CAAO+J;OAAY,CAAA;AAC/FkF,MAAAA,GAAAA,qBAAAA;AACHG,MAAAA,qBAAAA;AACI5C,MAAAA,GAAAA,WAAAA,IAAe;;IAErBnJ,OAAAA,kBAAS,MAAA,CAAA,OAAO,EAAEW,OAAAA,EAAO,KAAE;AAEzB,MAAA,MAAMiM,cAAAA,GAAiB,MAAMnI,YAAAA,CAAa9D,OAAAA,CAAAA;AAG1C,MAAA,IAAIyI,kBAAAA,EAAoB;AACtB,QAAA,OAAOA,mBAAmBwD,cAAAA,CAAAA;AAC5B,MAAA;AAEA,MAAA,OAAOA,cAAAA;IACT,CAAA,EAVS,SAAA;GAWX,CAAA;AAGA,EAAA,MAAMC,GAAAA,GAAM,IAAIrD,MAAAA,CAAO;IAAEsD,OAAAA,EAASrD;GAAW,CAAA;AAG7C,EAAA,MAAMsD,WAAAA,GAAcvG,oBAAAA,CAAqB7J,MAAAA,CAAOoQ,WAAAA,EAAapQ,OAAO+J,WAAW,CAAA;AAE/EmG,EAAAA,GAAAA,CAAIG,IACFtD,IAAAA,CAAK;IACH5C,MAAAA,EAAQiG,WAAAA;AACRE,IAAAA,WAAAA,EAAaF,YAAYvL,MAAAA,GAAS,CAAA;IAClC0L,cAAAA,EAAgB;AACd,MAAA,cAAA;AACA,MAAA,eAAA;AACA,MAAA,aAAA;AACA,MAAA,gBAAA;AACA,MAAA,UAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,cAAA;AACA,MAAA,gBAAA;AACA,MAAA,iBAAA;AACA,MAAA,UAAA;AACA,MAAA,YAAA;AACA,MAAA,eAAA;AACA,MAAA,gBAAA;AACA,MAAA,gBAAA;;AAEA,MAAA,YAAA;AACA,MAAA,cAAA;AACA,MAAA,0BAAA;AACA,MAAA;;IAEFC,OAAAA,EAAS;AAAC,MAAA,KAAA;AAAO,MAAA,MAAA;AAAQ,MAAA,KAAA;AAAO,MAAA,OAAA;AAAS,MAAA,QAAA;AAAU,MAAA;;AACrD,GAAA,CAAA,CAAA;AAIF,EAAA,MAAMC,gBAAAA,GAAAA,CAAoBlE,iBAAiB,EAAA,EAAInC,OAAO,CAACsG,EAAAA,KAAOA,GAAGC,OAAO,CAAA;AACxE,EAAA,MAAMC,eAAe,IAAIC,GAAAA,CAAIJ,gBAAAA,CAAiBhJ,GAAAA,CAAI,CAACiJ,EAAAA,KAAO;IAACA,EAAAA,CAAGI,IAAAA;AAAMJ,IAAAA;GAAG,CAAA,CAAA;AACvE,EAAA,MAAMK,eAAAA,GAAkBN,gBAAAA,CAAiBhJ,GAAAA,CAAI,CAACnB,QAAAA,KAAAA;AAC5C,IAAA,MAAM0K,YAAAA,GAAe1K,QAAAA,CAASwK,IAAAA,CAAKG,OAAAA,CAAQ,WAAW,OAAA,CAAA;AACtD,IAAA,OAAO;AACL3K,MAAAA,QAAAA;AACA0K,MAAAA,YAAAA;AACAE,MAAAA,KAAAA,EAAO,IAAIC,MAAAA,CAAO,CAAA,CAAA,EAAIH,YAAAA,CAAAA,CAAAA,CAAe;AACvC,KAAA;EACF,CAAA,CAAA;AAGA,EAAA,MAAMI,oBAAAA,2BAAwBC,QAAAA,KAAAA;AAE5B,IAAA,MAAMC,UAAAA,GAAaV,YAAAA,CAAazM,GAAAA,CAAIkN,QAAAA,CAAAA;AACpC,IAAA,IAAIC,YAAY,OAAOA,UAAAA;AAGvB,IAAA,KAAA,MAAW,EAAEhL,QAAAA,EAAU4K,KAAAA,EAAOF,YAAAA,MAAkBD,eAAAA,EAAiB;AAC/D,MAAA,MAAMQ,OAAAA,GAAUL,KAAAA,CAAMM,IAAAA,CAAKH,QAAAA,CAAAA;AAC3BpR,MAAAA,MAAAA,CAAOC,KAAAA,CACL,CAAA,kBAAA,EAAqBmR,QAAAA,CAAAA,iBAAAA,EAA4B/K,QAAAA,CAASwK,IAAI,CAAA,SAAA,EAAYE,YAAAA,CAAAA,UAAAA,EAAyBO,OAAAA,CAAAA,CAAS,CAAA;AAE9G,MAAA,IAAIA,OAAAA,EAAS;AACXtR,QAAAA,MAAAA,CAAOC,MAAM,CAAA,iBAAA,EAAoBmR,QAAAA,CAAAA,YAAAA,EAAuB/K,QAAAA,CAASwK,IAAI,CAAA,CAAE,CAAA;AACvE,QAAA,OAAOxK,QAAAA;AACT,MAAA;AACF,IAAA;AAEArG,IAAAA,MAAAA,CAAOC,MAAM,CAAA,wCAAA,EAA2CmR,QAAAA,CAAAA,oBAAAA,EAA+BZ,gBAAAA,CAAiB5L,MAAM,CAAA,CAAE,CAAA;AAChH,IAAA,OAAOR,MAAAA;EACT,CAAA,EAnB6B,sBAAA,CAAA;AAyB7B6L,EAAAA,GAAAA,CAAIuB,SAAAA,CAAU,OAAO,EAAEzN,OAAAA,EAAO,KAAE;AAC9B,IAAA,MAAM0N,GAAAA,GAAM,IAAIC,GAAAA,CAAI3N,OAAAA,CAAQ0N,GAAG,CAAA;AAC/B,IAAA,MAAML,WAAWK,GAAAA,CAAIL,QAAAA;AACrBpR,IAAAA,MAAAA,CAAOC,MAAM,CAAA,oBAAA,EAAuB8D,OAAAA,CAAQ4N,MAAM,CAAA,CAAA,EAAIP,QAAAA,CAAAA,CAAU,CAAA;AAChE,IAAA,MAAMQ,aAAAA,GAAgBR,QAAAA,KAAa,SAAA,IAAaA,QAAAA,CAASpL,WAAW,UAAA,CAAA;AAGpE,IAAA,MAAM6L,mCAAmB,MAAA,CAAA,MAAA;AACvB,MAAA,MAAM3H,MAAAA,GAASnG,OAAAA,CAAQE,OAAAA,CAAQC,GAAAA,CAAI,QAAA,CAAA,IAAa,GAAA;AAChD,MAAA,MAAM4N,gBAAgBxH,wBAAAA,CAAyBJ,MAAAA,KAAW,GAAA,GAAM,IAAA,GAAOA,QAAQiG,WAAAA,CAAAA;AAC/E,MAAA,MAAMlM,OAAAA,GAAkC;QACtC,8BAAA,EAAgC,wCAAA;QAChC,8BAAA,EACE;AACJ,OAAA;AAEA,MAAA,IAAI6N,aAAAA,EAAe;AACjB7N,QAAAA,OAAAA,CAAQ,6BAAA,CAAA,GAAiC6N,aAAAA;AACzC7N,QAAAA,OAAAA,CAAQ,kCAAA,CAAA,GAAsC,MAAA;AAChD,MAAA;AAEA,MAAA,OAAOA,OAAAA;IACT,CAAA,EAfyB,kBAAA,CAAA;AAkBzB,IAAA,MAAM8N,eAAAA,GAAkBH,aAAAA,GAAgBxN,MAAAA,GAAY+M,oBAAAA,CAAqBC,QAAAA,CAAAA;AACzE,IAAA,IAAIW,eAAAA,EAAiB;AACnB/R,MAAAA,MAAAA,CAAOC,MAAM,CAAA,oCAAA,EAAuCmR,QAAAA,CAAAA,IAAAA,EAAeW,eAAAA,CAAgBlB,IAAI,CAAA,CAAE,CAAA;AACzF,MAAA,MAAMmB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAI9N,OAAAA,CAAQ4N,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRjO,OAAAA,EAAS+N;SACX,CAAA;AACF,MAAA;AAGA,MAAA,IAAIjO,OAAAA,CAAQ4N,MAAAA,KAAWI,eAAAA,CAAgBJ,MAAAA,EAAQ;AAC7C,QAAA,OAAOvN,MAAAA;AACT,MAAA;AAEA,MAAA,IAAI;AAEF,QAAA,MAAMsM,OAAAA,GAAU,MAAM3M,OAAAA,CAAQoO,IAAAA,EAAI;AAGlC,QAAA,MAAM/O,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AAGnC,QAAA,MAAMqO,SAAS,MAAML,eAAAA,CAAgBM,OAAAA,CAAQtO,OAAAA,EAASX,SAASsN,OAAAA,CAAAA;AAG/D,QAAA,IAAI0B,kBAAkBH,QAAAA,EAAU;AAE9B,UAAA,MAAMhO,QAAAA,GAAU,IAAIwF,OAAAA,CAAQ2I,MAAAA,CAAOnO,OAAO,CAAA;AAC1C,UAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAU4J,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtD/N,YAAAA,QAAAA,CAAQuO,GAAAA,CAAIxO,GAAAA,EAAK0E,KAAAA,CAAAA;AACnB,UAAA;AACA,UAAA,OAAO,IAAIuJ,QAAAA,CAASG,MAAAA,CAAOK,IAAAA,EAAM;AAC/BP,YAAAA,MAAAA,EAAQE,MAAAA,CAAOF,MAAAA;AACfQ,YAAAA,UAAAA,EAAYN,MAAAA,CAAOM,UAAAA;YACnBzO,OAAAA,EAAAA;WACF,CAAA;AACF,QAAA;AAGA,QAAA,MAAMA,OAAAA,GAAU,IAAIwF,OAAAA,CAAQ;UAC1B,cAAA,EAAgB,kBAAA;UAChB,GAAGuI;SACL,CAAA;AAEA,QAAA,OAAO,IAAIC,QAAAA,CAAStR,IAAAA,CAAKE,SAAAA,CAAUuR,MAAAA,CAAAA,EAAS;UAC1CF,MAAAA,EAAQ,GAAA;AACRjO,UAAAA;SACF,CAAA;AACF,MAAA,CAAA,CAAA,OAASnD,KAAAA,EAAO;AACdd,QAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,kCAAA,EAAqCsQ,QAAAA,CAAAA,EAAAA,CAAAA,EAActQ,KAAAA,CAAAA;AAChE,QAAA,MAAMkR,eAAcH,gBAAAA,EAAAA;AACpB,QAAA,MAAMc,SAAAA,GAAYC,gBAAgB9R,KAAAA,EAAO;AACvCwM,UAAAA,WAAAA,EAAavN,MAAAA,CAAOuN,WAAAA;AACpBxD,UAAAA,WAAAA,EAAa/J,MAAAA,CAAO+J;SACtB,CAAA;AACA,QAAA,OAAO,IAAImI,QAAAA,CAAStR,IAAAA,CAAKE,SAAAA,CAAU8R,SAAAA,CAAUF,IAAI,CAAA,EAAG;AAClDP,UAAAA,MAAAA,EAAQS,SAAAA,CAAUT,MAAAA;UAClBjO,OAAAA,EAAS;YACP,cAAA,EAAgB,kBAAA;YAChB,GAAG+N;AACL;SACF,CAAA;AACF,MAAA;AACF,IAAA;AAUA,IAAA,IAAIZ,QAAAA,KAAa,UAAA,IAAcrN,OAAAA,CAAQ4N,MAAAA,KAAW,KAAA,EAAO;AACvD,MAAA,IAAI;AACF,QAAA,MAAMkB,aAAAA,GAAgB,aAAA;AACtB,QAAA,MAAMC,IAAAA,GAAQ,MAAM,OAAOD,aAAAA,CAAAA;AAI3B,QAAA,IAAI;AACFC,UAAAA,IAAAA,CAAKC,qBAAAA,CAAsB;AAAEC,YAAAA,QAAAA,EAAUF,IAAAA,CAAKE;WAAS,CAAA;QACvD,CAAA,CAAA,MAAQ;AAER,QAAA;AACA,QAAA,MAAMC,QAAAA,GAAW,MAAMH,IAAAA,CAAKE,QAAAA,CAASE,OAAAA,EAAO;AAa5C,QAAA,IAAIC,OAAAA,GAAU,EAAA;AACd,QAAA,MAAMrH,oBAAoBX,OAAAA,EAAO;AACjC,QAAA,IAAI;AACFgI,UAAAA,OAAAA,GAAUC,kBAAAA,GAAqBC,kBAAAA,EAAkB;QACnD,CAAA,CAAA,MAAQ;AAER,QAAA;AAEA,QAAA,MAAMC,QAAAA,GAAWH,OAAAA,GAAU,CAAA,EAAGF,QAAAA;AAAaE,EAAAA,OAAAA,CAAAA,CAAAA,GAAYF,QAAAA;AACvD,QAAA,OAAO,IAAIhB,SAASqB,QAAAA,EAAU;UAC5BpB,MAAAA,EAAQ,GAAA;UACRjO,OAAAA,EAAS;YACP,cAAA,EAAgB6O,IAAAA,CAAKE,SAASO,WAAAA,IAAe;AAC/C;SACF,CAAA;MACF,CAAA,CAAA,MAAQ;AAER,MAAA;AACF,IAAA;AAGA,IAAA,MAAMC,UAAAA,GAAa;AAACtE,MAAAA,eAAAA;AAAiB,MAAA,CAAA,EAAGA,eAAAA,CAAAA,CAAAA,CAAAA;AAAoB,MAAA;;AAC5D,IAAA,MAAMuE,kBAAAA,GAAqBD,UAAAA,CAAWnJ,QAAAA,CAAS+G,QAAAA,CAAAA;AAE/C,IAAA,IAAIqC,kBAAAA,EAAoB;AACtB,MAAA,MAAMzB,cAAcH,gBAAAA,EAAAA;AAGpB,MAAA,IAAI9N,OAAAA,CAAQ4N,WAAW,SAAA,EAAW;AAChC,QAAA,OAAO,IAAIM,SAAS,IAAA,EAAM;UACxBC,MAAAA,EAAQ,GAAA;UACRjO,OAAAA,EAAS+N;SACX,CAAA;AACF,MAAA;AAGA,MAAA,MAAM0B,eAAe,MAAMC,wBAAAA,CAAyB,MAAMjE,IAAAA,CAAKkE,KAAAA,CAAM7P,OAAAA,CAAAA,EAAU;AAC7EuJ,QAAAA,WAAAA,EAAavN,MAAAA,CAAOuN,WAAAA;AACpBxD,QAAAA,WAAAA,EAAa/J,MAAAA,CAAO+J;OACtB,CAAA;AAGA,MAAA,MAAM7F,OAAAA,GAAU,IAAIwF,OAAAA,CAAQiK,YAAAA,CAAazP,OAAO,CAAA;AAChD,MAAA,KAAA,MAAW,CAACD,GAAAA,EAAK0E,KAAAA,KAAU4J,MAAAA,CAAOC,OAAAA,CAAQP,WAAAA,CAAAA,EAAc;AACtD/N,QAAAA,OAAAA,CAAQuO,GAAAA,CAAIxO,KAAK0E,KAAAA,CAAAA;AACnB,MAAA;AAGA,MAAA,OAAO,IAAIuJ,QAAAA,CAASyB,YAAAA,CAAajB,IAAAA,EAAM;AACrCP,QAAAA,MAAAA,EAAQwB,YAAAA,CAAaxB,MAAAA;AACrBQ,QAAAA,UAAAA,EAAYgB,YAAAA,CAAahB,UAAAA;AACzBzO,QAAAA;OACF,CAAA;AACF,IAAA;AAEA,IAAA,OAAOG,MAAAA;EACT,CAAA,CAAA;AAGA6L,EAAAA,GAAAA,CAAIG,GAAAA,CAAIjD,qBAAAA,CAAAA;AAGR8C,EAAAA,GAAAA,CAAIG,IACFlD,oBAAAA,CAAqB;AACnB2G,IAAAA,cAAAA,EAAgB9T,OAAO8T,cAAAA,IAAkB;AAAC,MAAA,UAAA;AAAY,MAAA,SAAA;AAAW,MAAA;;IACjEC,cAAAA,EAAgB/T,MAAAA,CAAO+T,kBAAkB,EAAA;AACzCC,IAAAA,UAAAA,EAAYhU,OAAOgU,UAAAA,IAAc,KAAA;AACjCC,IAAAA,qBAAAA,EAAuBjU,OAAOiU,qBAAAA,IAAyB;AACzD,GAAA,CAAA,CAAA;AAQF,EAAA,MAAMC,iCAAiB,MAAA,CAAA,OAAO;IAC5B/B,MAAAA,EAAQ,SAAA;AACRgC,IAAAA,OAAAA,EAASnU,MAAAA,CAAOuN,WAAAA;AAChB6G,IAAAA,OAAAA,EAASpU,OAAOqU,cAAAA,IAAkB,OAAA;IAClCC,SAAAA,EAAAA,iBAAW,IAAI1M,IAAAA,EAAAA,EAAO2M,WAAAA;GACxB,CAAA,EALuB,gBAAA,CAAA;AAOvBrE,EAAAA,GAAAA,CAAI/L,GAAAA,CAAI,WAAW+P,cAAAA,CAAAA;AACnBhE,EAAAA,GAAAA,CAAI/L,GAAAA,CAAI,gBAAgB+P,cAAAA,CAAAA;AACxBhE,EAAAA,GAAAA,CAAI/L,GAAAA,CAAI,iBAAiB+P,cAAAA,CAAAA;AACzBhE,EAAAA,GAAAA,CAAI/L,GAAAA,CAAI,mBAAmB+P,cAAAA,CAAAA;AAG3B,EAAA,IAAI5H,WAAAA,EAAa;AAEf4D,IAAAA,GAAAA,CAAI/L,IAAI,mBAAA,EAAqB,OAAO,EAAEH,OAAAA,EAASyO,KAAG,KAAE;AAClD,MAAA,MAAMpP,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0G,oBAAAA,CAAqBrH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCuP,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAEpR,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,OAAOuL,YAAYkI,SAAAA,EAAS;IAC9B,CAAA,CAAA;AAGAtE,IAAAA,GAAAA,CAAI/L,IAAI,mBAAA,EAAqB,OAAO,EAAEsQ,KAAAA,EAAOzQ,OAAAA,EAASyO,KAAG,KAAE;AACzD,MAAA,MAAMpP,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0G,oBAAAA,CAAqBrH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCuP,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAEpR,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKqU,KAAAA;AACxC,MAAA,OAAOnI,WAAAA,CAAYoI,SAAAA,CAAUtL,cAAAA,EAAgBhJ,WAAAA,CAAAA;IAC/C,CAAA,CAAA;AAGA8P,IAAAA,GAAAA,CAAI/L,IAAI,qBAAA,EAAuB,OAAO,EAAEsQ,KAAAA,EAAOzQ,OAAAA,EAASyO,KAAG,KAAE;AAC3D,MAAA,MAAMpP,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0G,oBAAAA,CAAqBrH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCuP,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAEpR,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAauU,KAAAA,EAAK,GAAKF,KAAAA;AAK/C,MAAA,MAAMG,WAAAA,GAAcD,KAAAA,EAAOjP,KAAAA,CAAM,GAAA,CAAA,CAAK+B,IAAI,CAACe,CAAAA,KAAMA,CAAAA,CAAE7C,IAAAA,EAAI,CAAA;AACvD,MAAA,OAAO2G,WAAAA,CAAYuI,cAAAA,CAAezL,cAAAA,EAAgBhJ,WAAAA,EAAawU,WAAAA,CAAAA;IACjE,CAAA,CAAA;AAGA1E,IAAAA,GAAAA,CAAI/L,IAAI,0BAAA,EAA4B,OAAO,EAAEsQ,KAAAA,EAAOzQ,OAAAA,EAASyO,KAAG,KAAE;AAChE,MAAA,MAAMpP,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,MAAA,IAAI,CAAC0G,oBAAAA,CAAqBrH,OAAAA,CAAQH,KAAK,CAAA,EAAG;AACxCuP,QAAAA,GAAAA,CAAIN,MAAAA,GAAS,GAAA;AACb,QAAA,OAAO;UAAEpR,KAAAA,EAAO;AAAY,SAAA;AAC9B,MAAA;AAEA,MAAA,MAAM,EAAEqI,cAAAA,EAAgBhJ,WAAAA,EAAW,GAAKqU,KAAAA;AACxC,MAAA,OAAOnI,WAAAA,CAAYwI,mBAAAA,CAAoB1L,cAAAA,EAAgBhJ,WAAAA,CAAAA;IACzD,CAAA,CAAA;AACF,EAAA;AAGA,EAAA,IAAImM,aAAAA,IAAiBA,aAAAA,CAAc1H,MAAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,KAAA,MAAWyB,YAAYiG,aAAAA,EAAe;AAEpC,MAAA,IAAIjG,SAASqK,OAAAA,EAAS;AACpB1Q,QAAAA,MAAAA,CAAOqN,KAAK,CAAA,uCAAA,EAA0ChH,QAAAA,CAASsL,MAAM,CAAA,CAAA,EAAItL,QAAAA,CAASwK,IAAI,CAAA,CAAE,CAAA;AACxF,QAAA;AACF,MAAA;AAEA,MAAA,MAAMwB,OAAAA,mBAAU,MAAA,CAAA,OAAO,EAAEtO,OAAAA,EAAO,KAAwB;AACtD,QAAA,IAAI;AACF,UAAA,MAAMX,OAAAA,GAAU,MAAMyE,YAAAA,CAAa9D,OAAAA,CAAAA;AACnC,UAAA,OAAO,MAAMsC,QAAAA,CAASgM,OAAAA,CAAQtO,OAAAA,EAASX,OAAAA,CAAAA;AACzC,QAAA,CAAA,CAAA,OAAStC,KAAAA,EAAO;AACdd,UAAAA,MAAAA,CAAOc,KAAAA,CAAM,CAAA,8BAAA,EAAiCuF,QAAAA,CAASwK,IAAI,MAAM/P,KAAAA,CAAAA;AACjE,UAAA,OAAOgU,wBAAwBhU,KAAAA,EAAO;AACpCwM,YAAAA,WAAAA,EAAavN,MAAAA,CAAOuN,WAAAA;AACpBxD,YAAAA,WAAAA,EAAa/J,MAAAA,CAAO+J;WACtB,CAAA;AACF,QAAA;MACF,CAAA,EAXgB,SAAA,CAAA;AAahB,MAAA,QAAQzD,SAASsL,MAAAA;QACf,KAAK,KAAA;AACH1B,UAAAA,GAAAA,CAAI/L,GAAAA,CAAImC,QAAAA,CAASwK,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,MAAA;AACHpC,UAAAA,GAAAA,CAAI8E,IAAAA,CAAK1O,QAAAA,CAASwK,IAAAA,EAAMwB,OAAAA,CAAAA;AACxB,UAAA;QACF,KAAK,KAAA;AACHpC,UAAAA,GAAAA,CAAI+E,GAAAA,CAAI3O,QAAAA,CAASwK,IAAAA,EAAMwB,OAAAA,CAAAA;AACvB,UAAA;QACF,KAAK,OAAA;AACHpC,UAAAA,GAAAA,CAAIgF,KAAAA,CAAM5O,QAAAA,CAASwK,IAAAA,EAAMwB,OAAAA,CAAAA;AACzB,UAAA;QACF,KAAK,QAAA;AACHpC,UAAAA,GAAAA,CAAIiF,MAAAA,CAAO7O,QAAAA,CAASwK,IAAAA,EAAMwB,OAAAA,CAAAA;AAC1B,UAAA;AACJ;AACF,IAAA;AACF,EAAA;AAEA,EAAA,MAAM8C,IAAAA,GAAOpV,OAAOoV,IAAAA,IAAQ,SAAA;AAC5B,EAAA,MAAMC,OAAOrV,MAAAA,CAAOqV,IAAAA;AAGpB,EAAA,MAAMC,cAAAA,GAAiC;AACrCpF,IAAAA,GAAAA;IACAqF,MAAAA,EAAQ,IAAA;AACRC,IAAAA,KAAAA,kBAAO,MAAA,CAAA,YAAA;AACL1J,MAAAA,eAAAA,uBAAsBlE,IAAAA,EAAAA;AAGtBsI,MAAAA,GAAAA,CAAIuF,MAAAA,CAAO;AACTJ,QAAAA,IAAAA;QACAK,QAAAA,EAAUN;OACZ,CAAA;AAIA,MAAA,MAAMO,SAAAA,GAAYzF,GAAAA;AAClBoF,MAAAA,cAAAA,CAAeC,SAASI,SAAAA,CAAUJ,MAAAA;AAElCtV,MAAAA,MAAAA,CAAOqN,IAAAA,CAAK,CAAA,UAAA,EAAMtN,MAAAA,CAAOuN,WAAW,CAAA,sBAAA,EAAyB6H,IAAAA,CAAAA,CAAAA,EAAQC,IAAAA,CAAAA,EAAOlG,eAAAA,CAAAA,CAAiB,CAAA;IAC/F,CAAA,EAfO,OAAA,CAAA;AAgBPyG,IAAAA,IAAAA,kBAAM,MAAA,CAAA,YAAA;AACJ3V,MAAAA,MAAAA,CAAOqN,IAAAA,CAAK,CAAA,kBAAA,EAAqBtN,MAAAA,CAAOuN,WAAW,CAAA,GAAA,CAAK,CAAA;AAExD,MAAA,IAAIX,UAAAA,EAAY;AACd,QAAA,MAAMA,UAAAA,EAAAA;AACR,MAAA;AAEA,MAAA,IAAIN,WAAAA,EAAa;AACf,QAAA,MAAMA,YAAYuJ,QAAAA,EAAQ;AAC5B,MAAA;AAEA,MAAA,MAAM3I,kBAAAA,GAAqB4I,UAAAA,EAAU;AAErC,MAAA,IAAIR,eAAeC,MAAAA,EAAQ;AACzBD,QAAAA,cAAAA,CAAeC,OAAOK,IAAAA,EAAI;AAC5B,MAAA;AAEA3V,MAAAA,MAAAA,CAAOqN,IAAAA,CAAK,CAAA,SAAA,EAAYtN,MAAAA,CAAOuN,WAAW,CAAA,QAAA,CAAU,CAAA;IACtD,CAAA,EAlBM,MAAA,CAAA;AAmBNwI,IAAAA,OAAAA,kBAAS,MAAA,CAAA,MAAA;AACP,MAAA,MAAMC,MAAAA,GAASlK,eAAAA,GAAkBmK,IAAAA,CAAKC,KAAAA,CAAAA,CAAOtO,IAAAA,CAAKqD,GAAAA,EAAG,GAAKa,eAAAA,CAAgBqK,OAAAA,EAAO,IAAM,GAAA,CAAA,GAAQ,CAAA;AAE/F,MAAA,OAAO;AACL5I,QAAAA,WAAAA,EAAavN,MAAAA,CAAOuN,WAAAA;AACpB8G,QAAAA,cAAAA,EAAgBrU,OAAOqU,cAAAA,IAAkB,OAAA;AACzCtK,QAAAA,WAAAA,EAAa/J,OAAO+J,WAAAA,IAAe,aAAA;AACnCsL,QAAAA,IAAAA;AACAD,QAAAA,IAAAA;AACAjG,QAAAA,eAAAA;QACAiH,SAAAA,EAAWtK,eAAAA,EAAiByI,aAAAA,IAAiB,EAAA;AAC7CyB,QAAAA;AACF,OAAA;IACF,CAAA,EAbS,SAAA;AAcX,GAAA;AAGA,EAAA,MAAMK,gBAAAA,iCAA0BC,MAAAA,KAAAA;AAC9BrW,IAAAA,MAAAA,CAAOqN,IAAAA,CAAK,CAAA,SAAA,EAAYgJ,MAAAA,CAAAA,sCAAAA,CAA8C,CAAA;AACtE,IAAA,MAAMhB,eAAeM,IAAAA,EAAI;AACzB1Q,IAAAA,OAAAA,CAAQqR,KAAK,CAAA,CAAA;EACf,CAAA,EAJyB,kBAAA,CAAA;AAMzBrR,EAAAA,OAAAA,CAAQsR,EAAAA,CAAG,WAAW,MAAA;AACpB,IAAA,KAAKH,iBAAiB,SAAA,CAAA;EACxB,CAAA,CAAA;AACAnR,EAAAA,OAAAA,CAAQsR,EAAAA,CAAG,UAAU,MAAA;AACnB,IAAA,KAAKH,iBAAiB,QAAA,CAAA;EACxB,CAAA,CAAA;AAEA,EAAA,OAAOf,cAAAA;AACT;AA9lBsBpJ,MAAAA,CAAAA,YAAAA,EAAAA,cAAAA,CAAAA;AAqmBf,SAASuK,oBAAoBtW,qBAAAA,EAA4C;AAC9EJ,EAAAA,aAAAA,CAAc;IAAEI,oBAAAA,EAAAA;GAAqB,CAAA;AACvC;AAFgBsW,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"index.js","sourcesContent":["/**\n * Server Auth Module\n *\n * JWT verification with workspace secret fetching for microservices.\n * Handles HS256 tokens with secrets stored in workspace database.\n */\n\nimport { logger } from '../logger/index.js';\nimport type { IActor, JWTPayload, WorkspaceSecret } from './types.js';\n\n// Type imports from packages\nimport type * as jose from 'jose';\nimport type { VerifyOptions, Jwt, JwtPayload } from 'jsonwebtoken';\n\n/**\n * Workspace model interface for fetching JWT secrets\n */\ninterface WorkspaceModel {\n  findUnique: (args: { where: { id: string } }) => Promise<{ jwtSecret?: unknown } | null>;\n}\n\ninterface DbClient {\n  client: {\n    workspace: WorkspaceModel;\n  };\n}\n\n// Import getDb dynamically to avoid circular dependencies\nlet getDbFn: (() => DbClient) | null = null;\n\nasync function getDb(): Promise<DbClient> {\n  if (!getDbFn) {\n    const prismaModule = await import('../prisma/index.js');\n    // Use unknown first then cast to avoid type inference issues\n    getDbFn = prismaModule.getDb as unknown as () => DbClient;\n  }\n  return getDbFn();\n}\n\n// Interface for the subset of jsonwebtoken we use\ninterface JwtModule {\n  decode(token: string, options?: { complete?: boolean }): string | Jwt | JwtPayload | null;\n  verify(token: string, secretOrPublicKey: string, options?: VerifyOptions): string | JwtPayload;\n}\n\n// Module cache for dynamic imports\nlet joseModule: typeof jose | null = null;\nlet jwtModule: JwtModule | null = null;\n\nasync function getJose(): Promise<typeof jose> {\n  if (!joseModule) {\n    joseModule = await import('jose');\n  }\n  return joseModule;\n}\n\nasync function getJwt(): Promise<JwtModule> {\n  if (!jwtModule) {\n    const jwt = await import('jsonwebtoken');\n    // Handle both ESM and CJS module formats\n    jwtModule = (jwt as { default?: JwtModule }).default ?? jwt;\n  }\n  return jwtModule;\n}\n\n/**\n * Fetch workspace secret callback type\n */\nexport type FetchWorkspaceSecretFn = (workspaceId: string) => Promise<WorkspaceSecret | null>;\n\n/**\n * Auth configuration\n */\nexport interface AuthConfig {\n  /** Function to fetch workspace JWT secret from database */\n  fetchWorkspaceSecret: FetchWorkspaceSecretFn;\n}\n\nlet authConfig: AuthConfig | null = null;\n\n/**\n * Configure auth module with workspace secret fetching\n */\nexport function configureAuth(config: AuthConfig): void {\n  authConfig = config;\n  logger.debug('[ServerAuth] Auth configured');\n}\n\n/**\n * Default workspace secret fetcher\n *\n * Fetches JWT secret from workspace database. This is the standard implementation\n * that works with any microservice that has access to the workspace model.\n *\n * @param workspaceId - Workspace ID from JWT\n * @returns WorkspaceSecret or null if not found\n */\nexport async function fetchWorkspaceSecret(workspaceId: string): Promise<WorkspaceSecret | null> {\n  try {\n    const db = await getDb();\n    const workspace = await db.client.workspace.findUnique({\n      where: { id: workspaceId },\n    });\n\n    if (!workspace?.jwtSecret) {\n      logger.debug('[ServerAuth] No JWT secret found for workspace', { workspaceId });\n      return null;\n    }\n\n    return JSON.parse(JSON.stringify(workspace.jwtSecret)) as WorkspaceSecret;\n  } catch (error) {\n    logger.warn('[ServerAuth] Error fetching workspace secret', { workspaceId, error });\n    return null;\n  }\n}\n\n/**\n * Configure auth with default workspace secret fetcher\n *\n * This is automatically called by createServer if no custom auth is configured.\n */\nexport function configureDefaultAuth(): void {\n  if (!authConfig) {\n    configureAuth({ fetchWorkspaceSecret });\n    logger.debug('[ServerAuth] Default auth configured with built-in workspace secret fetcher');\n  }\n}\n\n/**\n * Generate a symmetric secret key for JWT signing\n * @returns JWK object with the generated key\n */\nexport async function generateSymmetricSecret(): Promise<jose.JWK> {\n  const joseLib = await getJose();\n  const secret = await joseLib.generateSecret('HS256');\n  const jwk = await joseLib.exportJWK(secret);\n  return jwk;\n}\n\n/**\n * Verify JWT token for workspace-scoped authentication\n *\n * @param token - JWT token to verify\n * @param secret - Optional secret for verification (if not provided, fetches from workspace)\n * @param options - JWT verification options\n * @returns Verified actor information or null if invalid\n */\nexport async function verifyJWT(token: string, secret?: string, options: VerifyOptions = {}): Promise<IActor | null> {\n  try {\n    const jwt = await getJwt();\n    const joseLib = await getJose();\n\n    // Decode to check algorithm and extract workspace_id\n    const decoded = jwt.decode(token, { complete: true });\n\n    if (!decoded || typeof decoded === 'string' || !decoded.payload || typeof decoded.payload !== 'object') {\n      logger.warn('[ServerAuth] Invalid token format');\n      return null;\n    }\n\n    // For workspace-scoped HS256 tokens\n    if (secret) {\n      // Use provided secret\n      const verifiedJwt = jwt.verify(token, secret, options) as JWTPayload;\n      return mapPayloadToActor(verifiedJwt);\n    }\n\n    // Fetch secret from workspace database\n    const decodedJwt = joseLib.decodeJwt(token) as JWTPayload;\n    if (!decodedJwt.workspace_id) {\n      logger.warn('[ServerAuth] No workspace_id found in token');\n      return null;\n    }\n\n    if (!authConfig?.fetchWorkspaceSecret) {\n      logger.error('[ServerAuth] Auth not configured - call configureAuth() first');\n      return null;\n    }\n\n    const workspaceSecret = await authConfig.fetchWorkspaceSecret(decodedJwt.workspace_id);\n    if (!workspaceSecret) {\n      logger.warn('[ServerAuth] Workspace secret not found');\n      return null;\n    }\n\n    const keyLikeSecret = await joseLib.importJWK(workspaceSecret, 'HS256');\n    const verifiedJwt = await joseLib.jwtVerify(token, keyLikeSecret, options as jose.JWTVerifyOptions);\n    return mapPayloadToActor(verifiedJwt.payload as unknown as JWTPayload);\n  } catch (err) {\n    logger.warn('[ServerAuth] Error verifying JWT:', err);\n    return null;\n  }\n}\n\n/**\n * Decode JWT without verification (for extracting claims)\n */\nexport async function decodeJWT(token: string): Promise<JWTPayload | null> {\n  try {\n    const joseLib = await getJose();\n    return await joseLib.decodeJwt(token);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Map JWT payload to IActor interface\n */\nfunction mapPayloadToActor(payload: JWTPayload): IActor {\n  return {\n    id: payload.sub,\n    type: payload.actor_type ?? 'user',\n    workspace_id: payload.workspace_id,\n    tenant_id: payload.tenant_id,\n    org_id: payload.org_id,\n    isAdmin: payload['isAdmin'] as boolean | undefined,\n  };\n}\n\n/**\n * Check if actor is authenticated\n */\nexport function authCheck(actor: IActor | null): IActor {\n  if (!actor) {\n    throw new Error('Please sign in');\n  }\n  return actor;\n}\n\n/**\n * Check workspace context and return actor ID and workspace ID\n */\nexport function workspaceCheck(context: { actor: IActor | null; workspace: { id: string } | null }): {\n  actorId: string;\n  workspaceId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  return {\n    actorId: actor.id,\n    workspaceId: context.workspace.id,\n  };\n}\n\n/**\n * Require workspace context - type narrowing guard for wspace layer services\n *\n * Validates that both actor and workspace are present in the context,\n * and returns a type-narrowed context where workspace and actor are guaranteed non-null.\n * Use this at the start of resolvers in wspace services to get typed access\n * to workspace context without optional chaining.\n *\n * @throws Error if actor is not authenticated\n * @throws Error if workspace context is missing\n *\n * @example\n * ```typescript\n * // In a resolver:\n * const ctx = requireWorkspace(context);\n * const workspaceId = ctx.workspace.id;  // no optional chaining needed\n * const actorId = ctx.actor.id;          // no optional chaining needed\n * ```\n */\nexport function requireWorkspace<T extends { actor: IActor | null; workspace: { id: string } | null }>(\n  context: T\n): T & { actor: IActor; workspace: { id: string } } {\n  // Validate actor is authenticated (throws if null)\n  authCheck(context.actor);\n\n  if (!context.workspace?.id) {\n    throw new Error('Please switch to a workspace');\n  }\n\n  // Return the same context object with narrowed types\n  return context as T & { actor: IActor; workspace: { id: string } };\n}\n\n/**\n * Check organization context and return actor ID and org ID\n */\nexport function orgCheck(context: { actor: IActor | null; organization: { id: string } | null }): {\n  actorId: string;\n  orgId: string;\n} {\n  const actor = authCheck(context.actor);\n\n  if (!context.organization?.id) {\n    throw new Error('Please switch to an organization');\n  }\n\n  return {\n    actorId: actor.id,\n    orgId: context.organization.id,\n  };\n}\n\n/**\n * Check tenant context and return tenant ID\n */\nexport function tenantCheck(context: { tenant: { id: string } | null }): string {\n  if (!context.tenant?.id) {\n    throw new Error('Tenant context is required');\n  }\n  return context.tenant.id;\n}\n\n/**\n * Get effective actor ID for \"on behalf of\" tracking\n *\n * When an app or service acts with user consent, returns the delegating user's ID.\n * Otherwise returns the direct actor ID.\n *\n * This is used to determine the `onBehalfOf` field in database audit trails:\n * - If actor is user → returns user ID (self-action)\n * - If actor is app/service with consent → returns grantedBy user ID\n * - If actor is app/service without consent → returns actor ID (self-action)\n *\n * @param context - GraphQL context with actor and optional consent context\n * @returns Effective actor ID (the responsible principal)\n *\n * @example\n * ```typescript\n * // User acting directly\n * context.actor = { id: \"user-123\", type: \"user\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"user-123\"\n *\n * // Bot acting on behalf of user\n * context.actor = { id: \"bot-456\", type: \"service\" }\n * context.consentContext = { grantedBy: \"user-789\" }\n * getEffectiveActorId(context) // → \"user-789\"\n *\n * // App acting without consent (self-action)\n * context.actor = { id: \"app-abc\", type: \"app\" }\n * context.consentContext = undefined\n * getEffectiveActorId(context) // → \"app-abc\"\n * ```\n */\nexport function getEffectiveActorId(context: {\n  actor: IActor | null;\n  consentContext?: { grantedBy: string } | null;\n}): string | null {\n  if (!context.actor) {\n    return null;\n  }\n\n  // If actor is app or service acting with user consent, return the delegating user\n  if (\n    (context.actor.type === 'app' || context.actor.type === 'service' || context.actor.type === 'service_account') &&\n    context.consentContext?.grantedBy\n  ) {\n    return context.consentContext.grantedBy;\n  }\n\n  // Otherwise return the direct actor (user self-action or app/service self-action)\n  return context.actor.id;\n}\n","/**\n * Server Context Module\n *\n * Builds GraphQL context from request headers, JWT, and configuration.\n * Automatically populates actor, tenant, workspace, and tracking information.\n *\n * **Actor-Based Authentication:**\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Services verify JWT directly and build actor from payload\n *\n * Uses standard Web API Request (compatible with Bun/Elysia).\n */\n\nimport { logger } from '../logger/index.js';\nimport crypto from 'node:crypto';\nimport { verifyJWT } from './auth.js';\nimport type {\n  GraphQLContext,\n  IActor,\n  ITenant,\n  IOrganization,\n  IWorkspace,\n  IProject,\n  IProduct,\n  ITracking,\n} from './types.js';\nimport type { I18n, I18nContext } from '../i18n/index.js';\nimport { setWorkspaceContext } from '../prisma/workspace-extension.js';\nimport { ContextManager } from '../context/index.js';\n\n/**\n * Context builder options\n */\nexport interface ContextBuilderOptions {\n  /** Database getter function */\n  getDb: () => unknown;\n  /** Default tenant info (optional) */\n  defaultTenant?: ITenant;\n  /** I18n instance (optional) */\n  i18n?: I18n;\n}\n\nlet contextOptions: ContextBuilderOptions | null = null;\n\n/**\n * Configure context builder\n */\nexport function configureContext(options: ContextBuilderOptions): void {\n  contextOptions = options;\n  logger.debug('[ServerContext] Context builder configured');\n}\n\n/**\n * Extract header value from standard Web API Request\n */\nfunction getHeader(request: Request, key: string): string | undefined {\n  return request.headers.get(key.toLowerCase()) ?? undefined;\n}\n\nfunction compareSecret(provided: string, expected: string): boolean {\n  const providedBuffer = Buffer.from(provided);\n  const expectedBuffer = Buffer.from(expected);\n\n  if (providedBuffer.length !== expectedBuffer.length) {\n    return false;\n  }\n\n  return crypto.timingSafeEqual(providedBuffer, expectedBuffer);\n}\n\nexport function shouldTrustActorHeaders(\n  request: Request,\n  nodeEnv: string | undefined = process.env['NODE_ENV'],\n  expectedGatewayToken: string | undefined = process.env['TRUSTED_GATEWAY_TOKEN'] ??\n    process.env['INTERNAL_SERVICE_TOKEN']\n): boolean {\n  if (!getHeader(request, 'x-actor-id')) {\n    return false;\n  }\n\n  if (nodeEnv === 'production') {\n    return true;\n  }\n\n  const providedGatewayToken =\n    getHeader(request, 'x-internal-service-token') || getHeader(request, 'x-gateway-auth-token');\n  if (!expectedGatewayToken || !providedGatewayToken) {\n    return false;\n  }\n\n  return compareSecret(providedGatewayToken, expectedGatewayToken);\n}\n\n/**\n * Extract tracking information from request\n */\nfunction extractTracking(request: Request): ITracking {\n  // Get IP from various possible headers\n  const forwardedFor = getHeader(request, 'x-forwarded-for');\n  const realIp = getHeader(request, 'x-real-ip');\n  const ip = forwardedFor?.split(',')[0]?.trim() || realIp || undefined;\n\n  return {\n    ip,\n    userAgent: getHeader(request, 'user-agent'),\n  };\n}\n\n/**\n * Extract actor from gateway-injected headers or authorization header\n *\n * **Actor-Based Authentication:**\n * - If x-actor-id header exists, trust it (gateway-authenticated)\n * - Otherwise fall back to JWT verification (direct access in dev)\n *\n * This allows:\n * - Production: Gateway verifies JWT → populates x-actor-* headers → services trust headers\n * - Development: Direct service access with JWT → service verifies JWT itself\n * - Development testing: Direct headers → service trusts headers\n */\nasync function extractActor(request: Request): Promise<IActor | null> {\n  // Check for gateway-injected actor headers first\n  const actorId = getHeader(request, 'x-actor-id');\n\n  if (actorId && shouldTrustActorHeaders(request)) {\n    // Gateway has already verified JWT and populated context headers\n    // Trust the headers (gateway is the security perimeter)\n    logger.debug('[ServerContext] Using gateway-authenticated actor from headers');\n\n    const actorType = getHeader(request, 'x-actor-type') || 'user';\n    const userRole = getHeader(request, 'x-user-role');\n\n    return {\n      id: actorId,\n      type: actorType,\n      workspace_id: getHeader(request, 'x-workspace-id'),\n      tenant_id: getHeader(request, 'x-tenant-id'),\n      org_id: getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id'),\n      isAdmin:\n        actorType === 'super_admin' ||\n        userRole === 'TENANT_ADMIN' ||\n        userRole === 'SUPER_ADMIN' ||\n        userRole === 'PLATFORM_ADMIN',\n    };\n  }\n\n  if (actorId) {\n    logger.warn('[ServerContext] Ignoring untrusted actor headers and falling back to JWT verification');\n  }\n\n  // FALLBACK: No gateway headers, verify JWT directly (dev/testing mode)\n  const authHeader = getHeader(request, 'authorization');\n\n  if (!authHeader?.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.substring(7);\n\n  try {\n    logger.debug('[ServerContext] No gateway headers, verifying JWT directly for actor (dev mode)');\n    const payload = await verifyJWT(token);\n\n    if (!payload) {\n      return null;\n    }\n\n    // Build actor from JWT payload\n    return {\n      id: payload.id,\n      type: 'user', // Default to 'user' if not specified\n      workspace_id: payload.workspace_id,\n    };\n  } catch (error) {\n    logger.warn('[ServerContext] Invalid JWT token:', error);\n    return null;\n  }\n}\n\n/**\n * Extract tenant from headers\n */\nfunction extractTenant(request: Request): ITenant | null {\n  // Check headers\n  const tenantId = getHeader(request, 'x-tenant-id');\n  const tenantEndpoint = getHeader(request, 'x-tenant-endpoint');\n\n  if (tenantId) {\n    return {\n      id: tenantId,\n      endpoint: tenantEndpoint || '',\n    };\n  }\n\n  // Fall back to default tenant if configured\n  return contextOptions?.defaultTenant || null;\n}\n\n/**\n * Extract organization from headers\n */\nfunction extractOrganization(request: Request): IOrganization | null {\n  const orgId = getHeader(request, 'x-org-id') || getHeader(request, 'x-organization-id');\n\n  if (orgId) {\n    return { id: orgId };\n  }\n\n  return null;\n}\n\n/**\n * Extract workspace from headers or actor\n */\nfunction extractWorkspace(request: Request, actor: IActor | null): IWorkspace | null {\n  // Check headers first\n  const workspaceId = getHeader(request, 'x-workspace-id');\n\n  if (workspaceId) {\n    return { id: workspaceId };\n  }\n\n  // Fall back to workspace_id from actor\n  if (actor?.workspace_id) {\n    return { id: actor.workspace_id };\n  }\n\n  return null;\n}\n\n/**\n * Extract project from headers\n */\nfunction extractProject(request: Request): IProject | null {\n  const projectId = getHeader(request, 'x-project-id');\n\n  if (projectId) {\n    return { id: projectId };\n  }\n\n  return null;\n}\n\n/**\n * Extract product from headers\n */\nfunction extractProduct(request: Request): IProduct | null {\n  const productId = getHeader(request, 'x-product-id');\n\n  if (productId) {\n    return { id: productId };\n  }\n\n  return null;\n}\n\n/**\n * Extract geography context from headers\n *\n * Geography headers carry the user's selected location context,\n * used for currency defaults, tax calculations, payment routing,\n * data residency, and regional support.\n *\n * Headers:\n * - x-geo-country: ISO 3166-1 alpha-2 country code (e.g., 'IN', 'US', 'DE')\n * - x-geo-currency: ISO 4217 currency code (e.g., 'INR', 'USD', 'EUR')\n * - x-geo-timezone: IANA timezone (e.g., 'Asia/Kolkata', 'America/New_York')\n */\nfunction extractGeography(request: Request): { country?: string; currency?: string; timezone?: string } {\n  const country = getHeader(request, 'x-geo-country');\n  const currency = getHeader(request, 'x-geo-currency');\n  const timezone = getHeader(request, 'x-geo-timezone');\n\n  return {\n    country: country?.toUpperCase() || undefined,\n    currency: currency?.toUpperCase() || undefined,\n    timezone: timezone || undefined,\n  };\n}\n\n/**\n * Extract consent context from headers\n *\n * When an app or service acts on behalf of a user (with user consent),\n * the gateway forwards consent headers. This function extracts them.\n *\n * Headers:\n * - x-consent-granted-by: Actor ID who granted consent (delegating user)\n * - x-consent-scope: Comma-separated scopes\n * - x-consent-granted-at: ISO timestamp when consent was granted\n * - x-consent-expires-at: ISO timestamp when consent expires\n */\nfunction extractConsentContext(request: Request): import('./types.js').ConsentContext | null {\n  const grantedBy = getHeader(request, 'x-consent-granted-by');\n\n  // If no grantedBy, there's no consent delegation\n  if (!grantedBy) {\n    return null;\n  }\n\n  const scopesHeader = getHeader(request, 'x-consent-scope');\n  const grantedAtHeader = getHeader(request, 'x-consent-granted-at');\n  const expiresAtHeader = getHeader(request, 'x-consent-expires-at');\n\n  return {\n    grantedBy,\n    scopes: scopesHeader ? scopesHeader.split(',').map((s) => s.trim()) : undefined,\n    grantedAt: grantedAtHeader ? new Date(grantedAtHeader) : undefined,\n    expiresAt: expiresAtHeader ? new Date(expiresAtHeader) : undefined,\n  };\n}\n\n/**\n * Build GraphQL context from standard Web Request\n *\n * Also sets the workspace context in AsyncLocalStorage for automatic\n * Prisma workspaceId injection via the workspace extension.\n */\nexport async function buildContext(request: Request): Promise<GraphQLContext> {\n  if (!contextOptions) {\n    throw new Error('[ServerContext] Context not configured - call configureContext() first');\n  }\n\n  // Extract actor from headers/JWT\n  const actor = await extractActor(request);\n\n  // Extract all context parts\n  const tenant = extractTenant(request);\n  const organization = extractOrganization(request);\n  const workspace = extractWorkspace(request, actor);\n  const project = extractProject(request);\n  const product = extractProduct(request);\n  const tracking = extractTracking(request);\n  const consentContext = extractConsentContext(request);\n\n  // Build i18n context if configured\n  let i18n: I18nContext | undefined;\n  if (contextOptions.i18n) {\n    i18n = contextOptions.i18n.createContextFromRequest(request);\n  }\n\n  // Merge geography context from x-geo-* headers into i18n\n  const geo = extractGeography(request);\n  if (geo.country || geo.currency || geo.timezone) {\n    if (i18n) {\n      // Merge geography fields into existing i18n context\n      if (geo.country) i18n.country = geo.country;\n      if (geo.currency) i18n.currency = geo.currency;\n      if (geo.timezone) i18n.timezone = geo.timezone;\n    } else {\n      // Create minimal i18n context with geography only (when i18n module not configured)\n      i18n = {\n        locale: 'en-US',\n        language: 'en',\n        country: geo.country,\n        currency: geo.currency,\n        timezone: geo.timezone,\n        t: (key: string) => key,\n        tp: (key: string) => key,\n        formatNumber: (value: number) => String(value),\n        formatCurrency: (value: number, currency: string) => `${currency} ${value}`,\n        formatDate: (date: Date | string) => String(date),\n        formatRelativeTime: (value: number, unit: Intl.RelativeTimeFormatUnit) => `${value} ${unit}`,\n      };\n    }\n  }\n\n  // Determine onBehalfOf for audit trails\n  // If actor is app/service with consent → use grantedBy (delegating user)\n  // Otherwise → use actor.id (self-action)\n  const onBehalfOf =\n    (actor?.type === 'app' || actor?.type === 'service' || actor?.type === 'service_account') &&\n    consentContext?.grantedBy\n      ? consentContext.grantedBy\n      : actor?.id;\n\n  // Set workspace context in AsyncLocalStorage for Prisma workspace extension\n  // This enables automatic workspaceId injection on create/update operations\n  const wsCtxPayload = {\n    workspaceId: workspace?.id,\n    tenantId: tenant?.id,\n    actorId: actor?.id,\n    actorType: actor?.type,\n    organizationId: organization?.id,\n    projectId: project?.id,\n    onBehalfOf,\n  };\n\n  logger.debug('[ServerContext] Setting workspace context', {\n    workspaceId: wsCtxPayload.workspaceId ?? 'NONE',\n    actorId: wsCtxPayload.actorId ?? 'NONE',\n    rawHeader: getHeader(request, 'x-workspace-id') ?? 'MISSING',\n  });\n\n  setWorkspaceContext(wsCtxPayload);\n\n  // Capture the Cloudflare Access service token for cross-layer calls.\n  // NOTE: this path populates the Prisma workspace store (above), NOT the\n  // general ContextManager ALS — so cross-layer clients reading\n  // ContextManager.getCfAccessHeaders() would otherwise see nothing here.\n  // Record it explicitly (module-level fallback) so resolver-initiated\n  // cross-layer calls re-present it. No-op unless the gateway forwarded the\n  // headers (alpha only; gated upstream on cf-ray).\n  ContextManager.setCfAccessContext(\n    getHeader(request, 'cf-access-client-id'),\n    getHeader(request, 'cf-access-client-secret'),\n    getHeader(request, 'x-cf-authorization')\n  );\n\n  return {\n    request,\n    actor,\n    tenant,\n    organization,\n    workspace,\n    project,\n    product,\n    tracking,\n    consentContext: consentContext || undefined,\n    onBehalfOf: onBehalfOf || actor?.id || '',\n    db: contextOptions.getDb(),\n    i18n,\n    responseHeaders: new Headers(),\n  };\n}\n\n/**\n * Get context options\n */\nexport function getContextOptions(): ContextBuilderOptions | null {\n  return contextOptions;\n}\n","import type { IActor } from './types.js';\n\nconst LOCALHOST_ORIGINS = [\n  'http://localhost:3000',\n  'http://localhost:4000',\n  'http://localhost:5173',\n  'http://127.0.0.1:3000',\n  'http://127.0.0.1:4000',\n  'http://127.0.0.1:5173',\n];\n\nexport function normalizeCorsOrigins(\n  origins: string | string[] | undefined,\n  environment: 'development' | 'staging' | 'production' | undefined\n): string[] {\n  const normalized = (Array.isArray(origins) ? origins : origins?.split(',') || [])\n    .map((origin) => origin.trim())\n    .filter(Boolean);\n\n  if (normalized.length === 0) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  if (normalized.includes('*')) {\n    return environment === 'production' ? [] : LOCALHOST_ORIGINS;\n  }\n\n  return normalized;\n}\n\nexport function resolveAllowedCorsOrigin(requestOrigin: string | null, allowedOrigins: string[]): string | null {\n  if (!requestOrigin) {\n    return allowedOrigins[0] ?? null;\n  }\n\n  return allowedOrigins.includes(requestOrigin) ? requestOrigin : null;\n}\n\nexport function canAccessGraphExport(actor: IActor | null): boolean {\n  if (!actor) {\n    return false;\n  }\n\n  return actor.isAdmin === true || ['service', 'super_admin'].includes(actor.type);\n}\n","/**\n * Workspace quota gauge refresh throttling for the `/metrics` route.\n *\n * `WorkspaceQuotaRegistry.collectAll()` issues Prisma groupBy queries. Running\n * it inline on every Prometheus scrape made `/metrics` exactly as slow as the\n * database: services that registered quota collectors routinely exceeded a 30s\n * `scrape_timeout` and were recorded as down, even though the endpoint itself\n * was healthy.\n *\n * Scrapes are far more frequent than these values meaningfully change, so\n * refresh on a TTL, bound each refresh, and let concurrent scrapes share one\n * in-flight attempt. A slow or unavailable database then degrades gauge\n * freshness instead of failing the scrape.\n *\n * @module server/quotaGaugeRefresh\n */\n\n/** How long a gauge snapshot is considered fresh. */\nexport const QUOTA_GAUGE_TTL_MS = 60_000;\n\n/** Upper bound on a single refresh, so a slow database cannot stall a scrape. */\nexport const QUOTA_GAUGE_REFRESH_TIMEOUT_MS = 5_000;\n\nexport interface QuotaGaugeRefresherOptions {\n  /** Performs the actual (expensive) collection. */\n  collect: () => Promise<unknown>;\n  ttlMs?: number;\n  timeoutMs?: number;\n  /** Injectable clock, for tests. */\n  now?: () => number;\n}\n\nexport interface QuotaGaugeRefresher {\n  /** Refresh if stale. Never rejects. */\n  refresh: () => Promise<void>;\n  /** Epoch ms of the last completed attempt (0 when never run). */\n  lastRefreshedAt: () => number;\n}\n\n/**\n * Build a TTL-throttled, timeout-bounded, single-flight refresher.\n *\n * `refresh()` never rejects — `/metrics` must keep serving prom-client and SDK\n * registry output even when the quota registry is unconfigured or erroring.\n * A failed attempt does not advance the TTL, so the next scrape retries.\n */\nexport function createQuotaGaugeRefresher(opts: QuotaGaugeRefresherOptions): QuotaGaugeRefresher {\n  const ttlMs = opts.ttlMs ?? QUOTA_GAUGE_TTL_MS;\n  const timeoutMs = opts.timeoutMs ?? QUOTA_GAUGE_REFRESH_TIMEOUT_MS;\n  const now = opts.now ?? ((): number => Date.now());\n\n  let refreshedAt = 0;\n  let inFlight: Promise<void> | null = null;\n\n  const refresh = async (): Promise<void> => {\n    if (refreshedAt !== 0 && now() - refreshedAt < ttlMs) return;\n\n    if (!inFlight) {\n      inFlight = (async (): Promise<void> => {\n        let timer: ReturnType<typeof setTimeout> | undefined;\n        try {\n          await Promise.race([\n            Promise.resolve(opts.collect()).then(() => undefined),\n            new Promise<void>((resolve) => {\n              timer = setTimeout(resolve, timeoutMs);\n            }),\n          ]);\n          // Stamp only on a completed attempt; a throw leaves the TTL expired\n          // so the next scrape retries rather than serving a stale snapshot\n          // forever.\n          refreshedAt = now();\n        } catch {\n          /* unconfigured registry or failed query — keep the previous snapshot */\n        } finally {\n          if (timer !== undefined) clearTimeout(timer);\n          inFlight = null;\n        }\n      })();\n    }\n\n    await inFlight;\n  };\n\n  return { refresh, lastRefreshedAt: (): number => refreshedAt };\n}\n","/**\n * Server Module\n *\n * Main server bootstrapping with Elysia, GraphQL Yoga, and middleware.\n * Uses Bun runtime for high-performance GraphQL services.\n *\n * Provides a simple API for microservices to start a fully configured server.\n */\n\nimport { logger } from '../logger/index.js';\nimport { configureAuth, configureDefaultAuth, type FetchWorkspaceSecretFn } from './auth.js';\nimport { configureContext, buildContext } from './context.js';\nimport type {\n  ServerDefinition,\n  ServerInstance,\n  ServerInfo,\n  ElysiaApp,\n  BunServerHandle,\n  YogaPlugin,\n  GraphQLContext,\n} from './types.js';\nimport { I18n } from '../i18n/index.js';\nimport { canAccessGraphExport, normalizeCorsOrigins, resolveAllowedCorsOrigin } from './security.js';\nimport { getMetricsRegistry } from '../instrumentation/metrics-collector.js';\nimport { getWorkspaceQuotaRegistry } from '../metrics/index.js';\nimport { createQuotaGaugeRefresher } from './quotaGaugeRefresh.js';\nimport {\n  createHttpErrorResponse,\n  createHumanReadableErrorPlugin,\n  formatHttpError,\n  normalizeGraphQLResponse,\n} from './errors.js';\n\n// Store startup time for uptime calculation\nlet serverStartTime: Date | null = null;\n\n// Workspace quota gauges cost Prisma groupBy queries, so /metrics refreshes\n// them on a TTL rather than on every scrape. See ./quotaGaugeRefresh.ts.\nconst quotaGaugeRefresher = createQuotaGaugeRefresher({\n  collect: () => getWorkspaceQuotaRegistry().collectAll(),\n});\n\n/**\n * Create and configure a server instance using Elysia + GraphQL Yoga\n */\nexport async function createServer(definition: ServerDefinition): Promise<ServerInstance> {\n  const {\n    config,\n    prismaClient,\n    schema,\n    moduleGraph,\n    restEndpoints,\n    yogaPlugins,\n    buildContext: customBuildContext,\n    workspaceExtensionConfig,\n    disableWorkspaceExtension,\n    onShutdown,\n  } = definition;\n\n  // Dynamic imports to avoid requiring these as hard dependencies\n  const { Elysia } = await import('elysia');\n  const { BunAdapter } = await import('elysia/adapter/bun');\n  const { cors } = await import('@elysiajs/cors');\n  const { createYoga } = await import('graphql-yoga');\n  const { initializeDatabase, getDb, getDatabaseManager } = await import('../prisma/index.js');\n  const { createSecurityPlugin } = await import('../middleware/index.js');\n  const { createMetricsPlugin } = await import('../observability/index.js');\n  const { createWorkspaceGuardPlugin } = await import('./workspace-guard.js');\n\n  logger.info(`[Server] Initializing ${config.serviceName}...`);\n\n  // Detect boundary from config or service name — needed before database and guard setup\n  const boundary =\n    config.boundary ??\n    (config.serviceName.startsWith('wspace-')\n      ? 'wspace'\n      : config.serviceName.startsWith('global-')\n        ? 'global'\n        : 'wspace'); // fail-closed: default to wspace (stricter)\n\n  // Initialize database\n  // Workspace extension is auto-disabled for global boundary services unless explicitly enabled\n  const shouldEnableWorkspaceExtension =\n    disableWorkspaceExtension === true ? false : disableWorkspaceExtension === false ? true : boundary === 'wspace'; // auto-detect: enabled for wspace, disabled for global\n\n  logger.info('[Server] Initializing database...', {\n    boundary,\n    workspaceExtension: shouldEnableWorkspaceExtension,\n  });\n\n  const { connect } = initializeDatabase(prismaClient, config.serviceName, {\n    registerShutdownHandlers: false, // Server manages shutdown handlers itself\n    enableWorkspaceExtension: shouldEnableWorkspaceExtension,\n    ...(workspaceExtensionConfig ? { workspaceExtensionConfig } : {}),\n  });\n  await connect();\n\n  // Initialize i18n if configured\n  let i18nInstance: I18n | undefined;\n  if (config.i18n?.enabled && config.i18n.localesPath) {\n    logger.info('[Server] Initializing i18n...');\n    i18nInstance = new I18n({\n      defaultLocale: config.i18n.defaultLocale || 'en-US',\n      fallbackLocale: config.i18n.fallbackLocale || 'en-US',\n      localesPath: config.i18n.localesPath,\n      supportedLocales: config.i18n.supportedLocales,\n      namespace: config.i18n.namespace || config.serviceName,\n      lazyLoad: config.i18n.lazyLoad,\n      logMissing: config.i18n.logMissing ?? true,\n      enableCache: true,\n      returnKeyOnMissing: true,\n    });\n    await i18nInstance.initialize();\n    logger.info(`[Server] i18n initialized with locales: ${i18nInstance.getSupportedLocales().join(', ')}`);\n  }\n\n  // Configure context builder\n  configureContext({\n    getDb: () => getDb(),\n    i18n: i18nInstance,\n  });\n\n  // Auto-configure auth with default workspace secret fetcher if not already configured\n  configureDefaultAuth();\n\n  // Initialize module graph if provided\n  if (moduleGraph) {\n    logger.info('[Server] Initializing module graph...');\n    await moduleGraph.initialize();\n  }\n\n  // Determine if playground/introspection should be enabled\n  const isDev = config.environment !== 'production';\n  const enablePlayground = config.enablePlayground ?? isDev;\n\n  // Build workspace guard plugin — auto-enabled for wspace boundary only\n  const workspaceGuardEnabled = config.workspaceGuard?.enabled ?? boundary === 'wspace';\n  logger.info(`[Server] Boundary: ${boundary}, workspace guard: ${workspaceGuardEnabled ? 'enabled' : 'disabled'}`);\n\n  const workspaceGuardPlugins = workspaceGuardEnabled\n    ? [\n        createWorkspaceGuardPlugin({\n          enabled: true,\n          whitelistedOperations: config.workspaceGuard?.whitelistedOperations,\n        }),\n      ]\n    : [];\n\n  // Create GraphQL Yoga instance\n  const graphqlEndpoint = config.graphqlEndpoint || '/graphql';\n  logger.info('[Server] Setting up GraphQL Yoga with provided schema...');\n\n  const responseHeadersPlugin: YogaPlugin = {\n    onResponse: ({ response, serverContext }: { response: Response; serverContext: unknown }) => {\n      const yogaContext = serverContext as GraphQLContext;\n      if (yogaContext?.responseHeaders) {\n        yogaContext.responseHeaders.forEach((value: string, key: string) => {\n          response.headers.append(key, value);\n        });\n      }\n    },\n  };\n\n  const yoga = createYoga<{ request: Request }>({\n    graphqlEndpoint,\n    schema, // Use the schema provided by microservice\n    graphiql: enablePlayground,\n    logging: {\n      debug: (...args) => logger.debug('[GraphQL]', ...args),\n      info: (...args) => logger.info('[GraphQL]', ...args),\n      warn: (...args) => logger.warn('[GraphQL]', ...args),\n      error: (...args) => logger.error('[GraphQL]', ...args),\n    },\n    plugins: [\n      createHumanReadableErrorPlugin({ serviceName: config.serviceName, environment: config.environment }),\n      ...workspaceGuardPlugins,\n      responseHeadersPlugin,\n      ...(yogaPlugins || []),\n    ],\n    context: async ({ request }) => {\n      // Build default context\n      const defaultContext = await buildContext(request);\n\n      // Apply custom context builder if provided\n      if (customBuildContext) {\n        return customBuildContext(defaultContext);\n      }\n\n      return defaultContext;\n    },\n  });\n\n  // Create Elysia instance with Bun adapter\n  const app = new Elysia({ adapter: BunAdapter });\n\n  // Register CORS middleware\n  const corsOrigins = normalizeCorsOrigins(config.corsOrigins, config.environment);\n\n  app.use(\n    cors({\n      origin: corsOrigins,\n      credentials: corsOrigins.length > 0,\n      allowedHeaders: [\n        'Content-Type',\n        'Authorization',\n        'X-Tenant-ID',\n        'X-Workspace-ID',\n        'X-Org-ID',\n        'X-Project-ID',\n        'X-Product-ID',\n        'X-CSRF-Token',\n        'X-Service-Name',\n        'Accept-Language',\n        'X-Locale',\n        'X-Language',\n        'X-Geo-Country',\n        'X-Geo-Currency',\n        'X-Geo-Timezone',\n        // Actor headers (gateway-injected or dev mode)\n        'X-Actor-ID',\n        'X-Actor-Type',\n        'X-Internal-Service-Token',\n        'X-Gateway-Auth-Token',\n      ],\n      methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],\n    })\n  );\n\n  // Collect raw body endpoints for early interception\n  const rawBodyEndpoints = (restEndpoints || []).filter((ep) => ep.rawBody);\n  const rawBodyPaths = new Map(rawBodyEndpoints.map((ep) => [ep.path, ep]));\n  const rawBodyMatchers = rawBodyEndpoints.map((endpoint) => {\n    const regexPattern = endpoint.path.replace(/:[^/]+/g, '[^/]+');\n    return {\n      endpoint,\n      regexPattern,\n      regex: new RegExp(`^${regexPattern}$`),\n    };\n  });\n\n  // Helper to match pathname against endpoint patterns (including :param placeholders)\n  const matchRawBodyEndpoint = (pathname: string): (typeof rawBodyEndpoints)[0] | undefined => {\n    // First try exact match (for non-parameterized paths)\n    const exactMatch = rawBodyPaths.get(pathname);\n    if (exactMatch) return exactMatch;\n\n    // Try pattern matching for parameterized paths like /webhooks/slack/:channelId\n    for (const { endpoint, regex, regexPattern } of rawBodyMatchers) {\n      const isMatch = regex.test(pathname);\n      logger.debug(\n        `[Server] Checking ${pathname} against pattern ${endpoint.path} (regex: ${regexPattern}), match: ${isMatch}`\n      );\n      if (isMatch) {\n        logger.debug(`[Server] Matched ${pathname} to pattern ${endpoint.path}`);\n        return endpoint;\n      }\n    }\n\n    logger.debug(`[Server] No raw body endpoint match for ${pathname}, rawBodyEndpoints: ${rawBodyEndpoints.length}`);\n    return undefined;\n  };\n\n  // Handle GraphQL, metrics, and raw body requests BEFORE any middleware that consumes the body\n  // This is critical because Yoga needs the raw request body stream\n  // and webhook endpoints need raw body for signature verification\n  // onRequest runs before onParse (body parsing) and onBeforeHandle\n  app.onRequest(async ({ request }) => {\n    const url = new URL(request.url);\n    const pathname = url.pathname;\n    logger.debug(`[Server] onRequest: ${request.method} ${pathname}`);\n    const isHealthRoute = pathname === '/health' || pathname.startsWith('/health/');\n\n    // Build CORS headers helper\n    const buildCorsHeaders = (): Record<string, string> => {\n      const origin = request.headers.get('origin') || '*';\n      const allowedOrigin = resolveAllowedCorsOrigin(origin === '*' ? null : origin, corsOrigins);\n      const headers: Record<string, string> = {\n        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',\n        'Access-Control-Allow-Headers':\n          'Content-Type, Authorization, X-Tenant-ID, X-Workspace-ID, X-Org-ID, X-Project-ID, X-Product-ID, X-CSRF-Token, X-Service-Name, Accept-Language, X-Locale, X-Language, X-Geo-Country, X-Geo-Currency, X-Geo-Timezone, X-Actor-ID, X-Actor-Type, X-Internal-Service-Token, X-Gateway-Auth-Token',\n      };\n\n      if (allowedOrigin) {\n        headers['Access-Control-Allow-Origin'] = allowedOrigin;\n        headers['Access-Control-Allow-Credentials'] = 'true';\n      }\n\n      return headers;\n    };\n\n    // Check if this is a raw body endpoint (webhooks) - now supports parameterized paths\n    const rawBodyEndpoint = isHealthRoute ? undefined : matchRawBodyEndpoint(pathname);\n    if (rawBodyEndpoint) {\n      logger.debug(`[Server] Matched raw body endpoint: ${pathname} -> ${rawBodyEndpoint.path}`);\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight for raw body endpoints\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Only process if method matches\n      if (request.method !== rawBodyEndpoint.method) {\n        return undefined; // Let other handlers deal with it\n      }\n\n      try {\n        // Read raw body BEFORE any parsing\n        const rawBody = await request.text();\n\n        // Build context without consuming body (body already read)\n        const context = await buildContext(request);\n\n        // Call the handler with raw body\n        const result = await rawBodyEndpoint.handler(request, context, rawBody);\n\n        // If handler returns a Response, use it directly\n        if (result instanceof Response) {\n          // Add CORS headers\n          const headers = new Headers(result.headers);\n          for (const [key, value] of Object.entries(corsHeaders)) {\n            headers.set(key, value);\n          }\n          return new Response(result.body, {\n            status: result.status,\n            statusText: result.statusText,\n            headers,\n          });\n        }\n\n        // Otherwise, serialize as JSON\n        const headers = new Headers({\n          'Content-Type': 'application/json',\n          ...corsHeaders,\n        });\n\n        return new Response(JSON.stringify(result), {\n          status: 200,\n          headers,\n        });\n      } catch (error) {\n        logger.error(`[Server] Raw body endpoint error (${pathname}):`, error);\n        const corsHeaders = buildCorsHeaders();\n        const formatted = formatHttpError(error, {\n          serviceName: config.serviceName,\n          environment: config.environment,\n        });\n        return new Response(JSON.stringify(formatted.body), {\n          status: formatted.status,\n          headers: {\n            'Content-Type': 'application/json',\n            ...corsHeaders,\n          },\n        });\n      }\n    }\n\n    // Serve Prometheus metrics via prom-client at /metrics.\n    // The graphql-yoga prometheus plugin populates the same default registry,\n    // so GraphQL-level metrics (operation durations, error counts, etc.) are\n    // included automatically without needing Yoga to handle this route.\n    //\n    // Also includes SDK MetricsRegistry metrics (business counters/histograms\n    // created via @burdenoff/be-sdk/instrumentation factories) so that custom\n    // service metrics are available without a separate /api/metrics endpoint.\n    if (pathname === '/metrics' && request.method === 'GET') {\n      try {\n        const promClientMod = 'prom-client';\n        const prom = (await import(promClientMod)) as unknown as {\n          register: { metrics: () => Promise<string> | string; contentType?: string };\n          collectDefaultMetrics: (opts?: Record<string, unknown>) => void;\n        };\n        try {\n          prom.collectDefaultMetrics({ register: prom.register });\n        } catch {\n          /* already called */\n        }\n        const promBody = await prom.register.metrics();\n\n        // Append SDK MetricsRegistry metrics (business counters, histograms,\n        // gauges) that are created via @burdenoff/be-sdk/instrumentation\n        // factories. The toPrometheusFormat() method is deliberately not cached\n        // — each scrape gets a fresh snapshot including dynamic label values.\n        //\n        // Workspace quota gauges are different: collectAll() issues Prisma\n        // groupBy queries, so running it inline on every scrape made /metrics\n        // as slow as the database. Services registering quota collectors\n        // routinely blew a 30s Prometheus scrape_timeout and reported as down.\n        // Refresh on a TTL and bound each refresh, so a slow or unavailable\n        // database degrades gauge freshness instead of failing the scrape.\n        let sdkBody = '';\n        await quotaGaugeRefresher.refresh();\n        try {\n          sdkBody = getMetricsRegistry().toPrometheusFormat();\n        } catch {\n          /* MetricsRegistry not initialised; serve prom-client output alone */\n        }\n\n        const combined = sdkBody ? `${promBody}\\n${sdkBody}` : promBody;\n        return new Response(combined, {\n          status: 200,\n          headers: {\n            'Content-Type': prom.register.contentType ?? 'text/plain; version=0.0.4; charset=utf-8',\n          },\n        });\n      } catch {\n        // fall through — prom-client not installed; let Yoga handle as fallback\n      }\n    }\n\n    // Routes that should be handled by Yoga (GraphQL endpoint only)\n    const yogaRoutes = [graphqlEndpoint, `${graphqlEndpoint}/`, '/metrics'];\n    const shouldHandleByYoga = yogaRoutes.includes(pathname);\n\n    if (shouldHandleByYoga) {\n      const corsHeaders = buildCorsHeaders();\n\n      // Handle CORS preflight\n      if (request.method === 'OPTIONS') {\n        return new Response(null, {\n          status: 204,\n          headers: corsHeaders,\n        });\n      }\n\n      // Get response from Yoga\n      const yogaResponse = await normalizeGraphQLResponse(await yoga.fetch(request), {\n        serviceName: config.serviceName,\n        environment: config.environment,\n      });\n\n      // Add CORS headers to Yoga response\n      const headers = new Headers(yogaResponse.headers);\n      for (const [key, value] of Object.entries(corsHeaders)) {\n        headers.set(key, value);\n      }\n\n      // Return response with CORS headers\n      return new Response(yogaResponse.body, {\n        status: yogaResponse.status,\n        statusText: yogaResponse.statusText,\n        headers,\n      });\n    }\n    // Return undefined to continue to next handlers for non-GraphQL requests\n    return undefined;\n  });\n\n  // Register metrics middleware (after GraphQL interception)\n  app.use(createMetricsPlugin());\n\n  // Register security middleware (after GraphQL interception)\n  app.use(\n    createSecurityPlugin({\n      csrfSkipRoutes: config.csrfSkipRoutes || ['/graphql', '/health', '/api/graph/'],\n      loginEndpoints: config.loginEndpoints || [],\n      enableCSRF: config.enableCSRF ?? false, // Disabled by default for GraphQL services\n      enableSessionSecurity: config.enableSessionSecurity ?? false,\n    })\n  );\n\n  // Health check endpoints\n  // /health - General health check\n  // /health/live - Kubernetes liveness probe\n  // /health/ready - Kubernetes readiness probe\n  // /health/startup - Kubernetes startup probe\n  const healthResponse = () => ({\n    status: 'healthy',\n    service: config.serviceName,\n    version: config.serviceVersion || '1.0.0',\n    timestamp: new Date().toISOString(),\n  });\n\n  app.get('/health', healthResponse);\n  app.get('/health/live', healthResponse);\n  app.get('/health/ready', healthResponse);\n  app.get('/health/startup', healthResponse);\n\n  // Graph API endpoints (if moduleGraph provided)\n  if (moduleGraph) {\n    // Get graph configuration schema\n    app.get('/api/graph/schema', async ({ request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      return moduleGraph.getSchema();\n    });\n\n    // Export all graph data\n    app.get('/api/graph/export', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportAll(organizationId, workspaceId);\n    });\n\n    // Export entities only\n    app.get('/api/graph/entities', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId, types } = query as {\n        organizationId?: string;\n        workspaceId?: string;\n        types?: string;\n      };\n      const entityTypes = types?.split(',').map((t) => t.trim());\n      return moduleGraph.exportEntities(organizationId, workspaceId, entityTypes);\n    });\n\n    // Export relationships only\n    app.get('/api/graph/relationships', async ({ query, request, set }) => {\n      const context = await buildContext(request);\n      if (!canAccessGraphExport(context.actor)) {\n        set.status = 403;\n        return { error: 'Forbidden' };\n      }\n\n      const { organizationId, workspaceId } = query as { organizationId?: string; workspaceId?: string };\n      return moduleGraph.exportRelationships(organizationId, workspaceId);\n    });\n  }\n\n  // Register custom REST endpoints (skip rawBody endpoints - they're handled in onRequest)\n  if (restEndpoints && restEndpoints.length > 0) {\n    for (const endpoint of restEndpoints) {\n      // Skip rawBody endpoints - they're intercepted in onRequest before body parsing\n      if (endpoint.rawBody) {\n        logger.info(`[Server] Raw body endpoint registered: ${endpoint.method} ${endpoint.path}`);\n        continue;\n      }\n\n      const handler = async ({ request }: { request: Request }): Promise<unknown> => {\n        try {\n          const context = await buildContext(request);\n          return await endpoint.handler(request, context);\n        } catch (error) {\n          logger.error(`[Server] REST endpoint error (${endpoint.path}):`, error);\n          return createHttpErrorResponse(error, {\n            serviceName: config.serviceName,\n            environment: config.environment,\n          });\n        }\n      };\n\n      switch (endpoint.method) {\n        case 'GET':\n          app.get(endpoint.path, handler);\n          break;\n        case 'POST':\n          app.post(endpoint.path, handler);\n          break;\n        case 'PUT':\n          app.put(endpoint.path, handler);\n          break;\n        case 'PATCH':\n          app.patch(endpoint.path, handler);\n          break;\n        case 'DELETE':\n          app.delete(endpoint.path, handler);\n          break;\n      }\n    }\n  }\n\n  const host = config.host || '0.0.0.0';\n  const port = config.port;\n\n  // Create server instance\n  const serverInstance: ServerInstance = {\n    app: app as unknown as ElysiaApp,\n    server: null,\n    start: async () => {\n      serverStartTime = new Date();\n\n      // Call listen() which starts the server and makes app.server available\n      app.listen({\n        port,\n        hostname: host,\n      });\n\n      // Access the Bun server instance from the app\n      // Cast through unknown to satisfy TypeScript since Elysia's types are complex\n      const elysiaApp = app as unknown as { server: BunServerHandle | null };\n      serverInstance.server = elysiaApp.server;\n\n      logger.info(`🚀 ${config.serviceName} is running at http://${host}:${port}${graphqlEndpoint}`);\n    },\n    stop: async () => {\n      logger.info(`[Server] Stopping ${config.serviceName}...`);\n\n      if (onShutdown) {\n        await onShutdown();\n      }\n\n      if (moduleGraph) {\n        await moduleGraph.shutdown();\n      }\n\n      await getDatabaseManager().disconnect();\n\n      if (serverInstance.server) {\n        serverInstance.server.stop();\n      }\n\n      logger.info(`[Server] ${config.serviceName} stopped`);\n    },\n    getInfo: (): ServerInfo => {\n      const uptime = serverStartTime ? Math.floor((Date.now() - serverStartTime.getTime()) / 1000) : 0;\n\n      return {\n        serviceName: config.serviceName,\n        serviceVersion: config.serviceVersion || '1.0.0',\n        environment: config.environment || 'development',\n        port,\n        host,\n        graphqlEndpoint,\n        startedAt: serverStartTime?.toISOString() || '',\n        uptime,\n      };\n    },\n  };\n\n  // Setup graceful shutdown handlers\n  const gracefulShutdown = async (signal: string): Promise<never> => {\n    logger.info(`[Server] ${signal} received, shutting down gracefully...`);\n    await serverInstance.stop();\n    process.exit(0);\n  };\n\n  process.on('SIGTERM', () => {\n    void gracefulShutdown('SIGTERM');\n  });\n  process.on('SIGINT', () => {\n    void gracefulShutdown('SIGINT');\n  });\n\n  return serverInstance;\n}\n\n/**\n * Configure auth with workspace secret fetcher\n *\n * This should be called before creating the server if using workspace-scoped JWT\n */\nexport function configureServerAuth(fetchWorkspaceSecret: FetchWorkspaceSecretFn): void {\n  configureAuth({ fetchWorkspaceSecret });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/be-sdk",
-  "version": "2026.803.1",
+  "version": "2026.803.2",
   "description": "Backend SDK for Burdenoff products providing unified access to notifications, RBAC, activity tracking, usage monitoring, and more",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",