@innvoid/getmarket-sdk 0.2.6 → 0.2.8

package/dist/{chunk-5S2JP7PR.js → chunk-4KD6646F.js}

@@ -39,6 +39,16 @@ function createHttpClient(opts) {
     headers: opts.headers ?? {}
   });
 }
+function withRequestIdConfig(config = {}, requestId) {
+  if (!requestId) return config;
+  return {
+    ...config,
+    headers: {
+      ...config.headers ?? {},
+      "x-request-id": requestId
+    }
+  };
+}
 
 // src/core/internalHttp.ts
 var DEFAULT_RETRY = {
@@ -148,6 +158,7 @@ export {
   UpstreamError,
   mapAxiosToUpstreamError,
   createHttpClient,
+  withRequestIdConfig,
   InternalHttp
 };
-//# sourceMappingURL=chunk-5S2JP7PR.js.map
+//# sourceMappingURL=chunk-4KD6646F.js.map

package/dist/chunk-4KD6646F.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/errors.ts","../src/core/http.ts","../src/core/internalHttp.ts"],"sourcesContent":["export type ClientErrorCode =\n    | \"UPSTREAM_TIMEOUT\"\n    | \"UPSTREAM_UNAVAILABLE\"\n    | \"UPSTREAM_BAD_RESPONSE\"\n    | \"UPSTREAM_NOT_FOUND\"\n    | \"UPSTREAM_UNAUTHORIZED\"\n    | \"UPSTREAM_FORBIDDEN\"\n    | \"UPSTREAM_UNKNOWN\";\n\nexport class UpstreamError extends Error {\n    public code: ClientErrorCode;\n    public status?: number;\n    public details?: any;\n\n    constructor(message: string, code: ClientErrorCode, status?: number, details?: any) {\n        super(message);\n        this.name = \"UpstreamError\";\n        this.code = code;\n        this.status = status;\n        this.details = details;\n    }\n}\n\nexport function mapAxiosToUpstreamError(err: any, svc: string): UpstreamError {\n    const status = err?.response?.status;\n    const data = err?.response?.data;\n    const isTimeout = err?.code === \"ECONNABORTED\" || String(err?.message || \"\").includes(\"timeout\");\n\n    if (isTimeout) {\n        return new UpstreamError(`[${svc}] timeout`, \"UPSTREAM_TIMEOUT\", 504, {cause: err?.message});\n    }\n    if (!err?.response) {\n        return new UpstreamError(`[${svc}] unavailable`, \"UPSTREAM_UNAVAILABLE\", 503, {cause: err?.message});\n    }\n    if (status === 404) return new UpstreamError(`[${svc}] not found`, \"UPSTREAM_NOT_FOUND\", 404, data);\n    if (status === 401) return new UpstreamError(`[${svc}] unauthorized`, \"UPSTREAM_UNAUTHORIZED\", 401, data);\n    if (status === 403) return new UpstreamError(`[${svc}] forbidden`, \"UPSTREAM_FORBIDDEN\", 403, data);\n    if (status >= 400 && status < 600) {\n        return new UpstreamError(`[${svc}] bad response`, \"UPSTREAM_BAD_RESPONSE\", status, data);\n    }\n    return new UpstreamError(`[${svc}] unknown error`, \"UPSTREAM_UNKNOWN\", status, data);\n}\n","import axios, {AxiosInstance, AxiosRequestConfig} from \"axios\";\n\nexport type HttpClient = AxiosInstance;\n\nexport type HttpClientOpts = {\n  baseURL: string;\n  timeoutMs?: number;\n  headers?: Record<string, string>;\n};\n\nexport function createHttpClient(opts: HttpClientOpts): HttpClient {\n  return axios.create({\n    baseURL: opts.baseURL.replace(/\\/+$/, \"\"),\n    timeout: opts.timeoutMs ?? 8000,\n    headers: opts.headers ?? {},\n  } satisfies AxiosRequestConfig);\n}\n\n/**\n * Injects x-request-id into an Axios config while preserving existing headers.\n */\nexport function withRequestIdConfig<T extends AxiosRequestConfig = AxiosRequestConfig>(\n  config: T = {} as T,\n  requestId?: string\n): T {\n  if (!requestId) return config;\n\n  return {\n    ...config,\n    headers: {\n      ...(config.headers ?? {}),\n      \"x-request-id\": requestId,\n    },\n  } as T;\n}\n","// clients/internalHttp.ts\n\ntype RetryPolicy = {\n    retries: number;\n    baseDelayMs: number;\n    retryOnStatuses: number[];\n    retryOnNetworkErrors: boolean;\n};\n\ntype InternalHttpOptions = {\n    baseUrl: string;\n    apiKey?: string; // x-internal-api-key\n    timeoutMs?: number;\n    retry?: Partial<RetryPolicy>;\n};\n\nconst DEFAULT_RETRY: RetryPolicy = {\n    retries: 1,\n    baseDelayMs: 150,\n    retryOnStatuses: [429, 502, 503, 504],\n    retryOnNetworkErrors: true,\n};\n\nfunction sleep(ms: number) {\n    return new Promise((r) => setTimeout(r, ms));\n}\n\nfunction safeJsonStringify(v: any) {\n    try {\n        return JSON.stringify(v);\n    } catch {\n        return String(v);\n    }\n}\n\nfunction toHeaders(init?: HeadersInit): Headers {\n    return new Headers(init || {});\n}\n\nfunction isJsonContentType(contentType: string | null): boolean {\n    if (!contentType) return false;\n    const ct = contentType.toLowerCase();\n    return ct.includes(\"application/json\") || ct.includes(\"+json\");\n}\n\nfunction isAbortError(e: any): boolean {\n    return e?.name === \"AbortError\";\n}\n\nfunction withJitter(ms: number): number {\n    // jitter +-20%\n    const jitter = ms * 0.2;\n    const delta = (Math.random() * 2 - 1) * jitter;\n    return Math.max(0, Math.floor(ms + delta));\n}\n\nexport class InternalHttp {\n    private readonly baseUrl: string;\n    private readonly apiKey: string | undefined;\n    private readonly timeoutMs: number;\n    private retry: RetryPolicy;\n\n    constructor(opts: InternalHttpOptions) {\n        this.baseUrl = opts.baseUrl.replace(/\\/+$/, \"\");\n        this.apiKey = opts.apiKey;\n\n        // ✅ Default más seguro para internas (evita cascadas)\n        this.timeoutMs = opts.timeoutMs ?? 4000;\n\n        this.retry = {...DEFAULT_RETRY, ...(opts.retry || {})};\n    }\n\n    async request<T>(\n        path: string,\n        init: RequestInit & {\n            requestId?: string;\n            idempotencyKey?: string;\n            headers?: HeadersInit;\n        } = {}\n    ): Promise<T> {\n        const url = `${this.baseUrl}${path.startsWith(\"/\") ? \"\" : \"/\"}${path}`;\n\n        const baseHeaders = toHeaders(init.headers);\n\n        if (!baseHeaders.has(\"Content-Type\")) baseHeaders.set(\"Content-Type\", \"application/json\");\n        if (this.apiKey) baseHeaders.set(\"x-internal-api-key\", this.apiKey);\n\n        if (init.requestId) baseHeaders.set(\"x-request-id\", init.requestId);\n        if (init.idempotencyKey) baseHeaders.set(\"Idempotency-Key\", init.idempotencyKey);\n\n        const {headers: _ignored, ...restInit} = init;\n\n        const doFetchOnce = async () => {\n            const controller = new AbortController();\n            const timeout = setTimeout(() => controller.abort(), this.timeoutMs);\n\n            try {\n                const res = await fetch(url, {\n                    ...restInit,\n                    headers: baseHeaders,\n                    signal: controller.signal,\n                });\n\n                if (!res.ok) {\n                    const text = await res.text().catch(() => \"\");\n                    const err: any = new Error(\n                        `HTTP ${res.status} ${res.statusText}${text ? ` - ${text}` : \"\"}`\n                    );\n                    err.status = res.status;\n                    err.body = text;\n                    throw err;\n                }\n\n                if (res.status === 204) return undefined as unknown as T;\n\n                const contentType = res.headers.get(\"content-type\");\n                if (isJsonContentType(contentType)) {\n                    return (await res.json()) as T;\n                }\n\n                const text = await res.text().catch(() => \"\");\n                return text as unknown as T;\n            } finally {\n                clearTimeout(timeout);\n            }\n        };\n\n        let attempt = 0;\n\n        while (true) {\n            try {\n                return await doFetchOnce();\n            } catch (e: any) {\n                attempt++;\n\n                const status = e?.status;\n                const retryableStatus = !!status && this.retry.retryOnStatuses.includes(status);\n\n                const retryableNetwork =\n                    this.retry.retryOnNetworkErrors &&\n                    (isAbortError(e) || !status); // sin status suele ser red/dns/timeout\n\n                const isRetryable = retryableStatus || retryableNetwork;\n\n                if (!isRetryable || attempt > this.retry.retries) {\n                    console.error(\n                        `[InternalHttp] request failed: ${url} attempt=${attempt} status=${status ?? \"n/a\"} err=${e?.message\n                        } body=${safeJsonStringify(e?.body)}`\n                    );\n                    throw e;\n                }\n\n                const backoff = withJitter(this.retry.baseDelayMs * attempt);\n                await sleep(backoff);\n            }\n        }\n    }\n}\n"],"mappings":";AASO,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EAEP,YAAY,SAAiB,MAAuB,QAAiB,SAAe;AAChF,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AAAA,EACnB;AACJ;AAEO,SAAS,wBAAwB,KAAU,KAA4B;AAC1E,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,OAAO,KAAK,UAAU;AAC5B,QAAM,YAAY,KAAK,SAAS,kBAAkB,OAAO,KAAK,WAAW,EAAE,EAAE,SAAS,SAAS;AAE/F,MAAI,WAAW;AACX,WAAO,IAAI,cAAc,IAAI,GAAG,aAAa,oBAAoB,KAAK,EAAC,OAAO,KAAK,QAAO,CAAC;AAAA,EAC/F;AACA,MAAI,CAAC,KAAK,UAAU;AAChB,WAAO,IAAI,cAAc,IAAI,GAAG,iBAAiB,wBAAwB,KAAK,EAAC,OAAO,KAAK,QAAO,CAAC;AAAA,EACvG;AACA,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,eAAe,sBAAsB,KAAK,IAAI;AAClG,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,kBAAkB,yBAAyB,KAAK,IAAI;AACxG,MAAI,WAAW,IAAK,QAAO,IAAI,cAAc,IAAI,GAAG,eAAe,sBAAsB,KAAK,IAAI;AAClG,MAAI,UAAU,OAAO,SAAS,KAAK;AAC/B,WAAO,IAAI,cAAc,IAAI,GAAG,kBAAkB,yBAAyB,QAAQ,IAAI;AAAA,EAC3F;AACA,SAAO,IAAI,cAAc,IAAI,GAAG,mBAAmB,oBAAoB,QAAQ,IAAI;AACvF;;;ACzCA,OAAO,WAAgD;AAUhD,SAAS,iBAAiB,MAAkC;AACjE,SAAO,MAAM,OAAO;AAAA,IAClB,SAAS,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAAA,IACxC,SAAS,KAAK,aAAa;AAAA,IAC3B,SAAS,KAAK,WAAW,CAAC;AAAA,EAC5B,CAA8B;AAChC;AAKO,SAAS,oBACd,SAAY,CAAC,GACb,WACG;AACH,MAAI,CAAC,UAAW,QAAO;AAEvB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS;AAAA,MACP,GAAI,OAAO,WAAW,CAAC;AAAA,MACvB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACF;;;AClBA,IAAM,gBAA6B;AAAA,EAC/B,SAAS;AAAA,EACT,aAAa;AAAA,EACb,iBAAiB,CAAC,KAAK,KAAK,KAAK,GAAG;AAAA,EACpC,sBAAsB;AAC1B;AAEA,SAAS,MAAM,IAAY;AACvB,SAAO,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAC/C;AAEA,SAAS,kBAAkB,GAAQ;AAC/B,MAAI;AACA,WAAO,KAAK,UAAU,CAAC;AAAA,EAC3B,QAAQ;AACJ,WAAO,OAAO,CAAC;AAAA,EACnB;AACJ;AAEA,SAAS,UAAU,MAA6B;AAC5C,SAAO,IAAI,QAAQ,QAAQ,CAAC,CAAC;AACjC;AAEA,SAAS,kBAAkB,aAAqC;AAC5D,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,KAAK,YAAY,YAAY;AACnC,SAAO,GAAG,SAAS,kBAAkB,KAAK,GAAG,SAAS,OAAO;AACjE;AAEA,SAAS,aAAa,GAAiB;AACnC,SAAO,GAAG,SAAS;AACvB;AAEA,SAAS,WAAW,IAAoB;AAEpC,QAAM,SAAS,KAAK;AACpB,QAAM,SAAS,KAAK,OAAO,IAAI,IAAI,KAAK;AACxC,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,KAAK,CAAC;AAC7C;AAEO,IAAM,eAAN,MAAmB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EAER,YAAY,MAA2B;AACnC,SAAK,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC9C,SAAK,SAAS,KAAK;AAGnB,SAAK,YAAY,KAAK,aAAa;AAEnC,SAAK,QAAQ,EAAC,GAAG,eAAe,GAAI,KAAK,SAAS,CAAC,EAAE;AAAA,EACzD;AAAA,EAEA,MAAM,QACF,MACA,OAII,CAAC,GACK;AACV,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,KAAK,WAAW,GAAG,IAAI,KAAK,GAAG,GAAG,IAAI;AAEpE,UAAM,cAAc,UAAU,KAAK,OAAO;AAE1C,QAAI,CAAC,YAAY,IAAI,cAAc,EAAG,aAAY,IAAI,gBAAgB,kBAAkB;AACxF,QAAI,KAAK,OAAQ,aAAY,IAAI,sBAAsB,KAAK,MAAM;AAElE,QAAI,KAAK,UAAW,aAAY,IAAI,gBAAgB,KAAK,SAAS;AAClE,QAAI,KAAK,eAAgB,aAAY,IAAI,mBAAmB,KAAK,cAAc;AAE/E,UAAM,EAAC,SAAS,UAAU,GAAG,SAAQ,IAAI;AAEzC,UAAM,cAAc,YAAY;AAC5B,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AAEnE,UAAI;AACA,cAAM,MAAM,MAAM,MAAM,KAAK;AAAA,UACzB,GAAG;AAAA,UACH,SAAS;AAAA,UACT,QAAQ,WAAW;AAAA,QACvB,CAAC;AAED,YAAI,CAAC,IAAI,IAAI;AACT,gBAAMA,QAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,gBAAM,MAAW,IAAI;AAAA,YACjB,QAAQ,IAAI,MAAM,IAAI,IAAI,UAAU,GAAGA,QAAO,MAAMA,KAAI,KAAK,EAAE;AAAA,UACnE;AACA,cAAI,SAAS,IAAI;AACjB,cAAI,OAAOA;AACX,gBAAM;AAAA,QACV;AAEA,YAAI,IAAI,WAAW,IAAK,QAAO;AAE/B,cAAM,cAAc,IAAI,QAAQ,IAAI,cAAc;AAClD,YAAI,kBAAkB,WAAW,GAAG;AAChC,iBAAQ,MAAM,IAAI,KAAK;AAAA,QAC3B;AAEA,cAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,eAAO;AAAA,MACX,UAAE;AACE,qBAAa,OAAO;AAAA,MACxB;AAAA,IACJ;AAEA,QAAI,UAAU;AAEd,WAAO,MAAM;AACT,UAAI;AACA,eAAO,MAAM,YAAY;AAAA,MAC7B,SAAS,GAAQ;AACb;AAEA,cAAM,SAAS,GAAG;AAClB,cAAM,kBAAkB,CAAC,CAAC,UAAU,KAAK,MAAM,gBAAgB,SAAS,MAAM;AAE9E,cAAM,mBACF,KAAK,MAAM,yBACV,aAAa,CAAC,KAAK,CAAC;AAEzB,cAAM,cAAc,mBAAmB;AAEvC,YAAI,CAAC,eAAe,UAAU,KAAK,MAAM,SAAS;AAC9C,kBAAQ;AAAA,YACJ,kCAAkC,GAAG,YAAY,OAAO,WAAW,UAAU,KAAK,QAAQ,GAAG,OAC7F,SAAS,kBAAkB,GAAG,IAAI,CAAC;AAAA,UACvC;AACA,gBAAM;AAAA,QACV;AAEA,cAAM,UAAU,WAAW,KAAK,MAAM,cAAc,OAAO;AAC3D,cAAM,MAAM,OAAO;AAAA,MACvB;AAAA,IACJ;AAAA,EACJ;AACJ;","names":["text"]}

package/dist/{chunk-WM2QICZQ.js → chunk-DT3AM34L.js}

@@ -236,12 +236,26 @@ function readFileIfExists(path) {
     return null;
   }
 }
+function getBearerToken(req) {
+  const auth = String(req?.headers?.authorization || "");
+  if (!auth.startsWith("Bearer ")) return null;
+  const token = auth.slice(7).trim();
+  return token.length ? token : null;
+}
+function normalizeUid(v) {
+  const s = String(v ?? "").trim();
+  return s.length ? s : null;
+}
 function readRs256PublicKey() {
   const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);
   if (fromFile) return fromFile;
-  const fromEnv = String(process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || "").replace(/\\n/g, "\n").trim();
+  const fromEnv = String(
+    process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || ""
+  ).replace(/\\n/g, "\n").trim();
   if (fromEnv) return fromEnv;
-  throw new Error("Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)");
+  throw new Error(
+    "Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)"
+  );
 }
 function verifyBackendJwtRS256(raw) {
   const publicKey = readRs256PublicKey();
@@ -253,20 +267,31 @@ function verifyBackendJwtRS256(raw) {
     issuer
   });
 }
-
-// src/auth/middleware.ts
-function getBearerToken(req) {
-  const auth = String(req.headers?.authorization || "");
-  if (!auth.startsWith("Bearer ")) return null;
-  const token = auth.slice(7).trim();
-  return token.length ? token : null;
+function extractEmployeeUid(decoded) {
+  const direct = normalizeUid(decoded?.employee_uid) ?? normalizeUid(decoded?.employee?.uid);
+  if (direct) return direct;
+  const sub = normalizeUid(decoded?.sub);
+  if (!sub) return null;
+  const match = /^emp:(.+)$/i.exec(sub);
+  return match?.[1] ? normalizeUid(match[1]) : null;
 }
-function normalizeUid(v) {
-  const s = String(v ?? "").trim();
-  return s.length ? s : null;
+function extractCustomerUid(decoded) {
+  const direct = normalizeUid(decoded?.customer_uid) ?? normalizeUid(decoded?.customer?.uid);
+  if (direct) return direct;
+  const sub = normalizeUid(decoded?.sub);
+  if (!sub) return null;
+  const match = /^cus:(.+)$/i.exec(sub);
+  return match?.[1] ? normalizeUid(match[1]) : null;
 }
+
+// src/auth/middleware.ts
 function createAuthMiddleware(opts) {
-  const { subject, allowFirebaseIdToken = false, requireSubject = true, hydrate } = opts;
+  const {
+    subject,
+    allowFirebaseIdToken = false,
+    requireSubject = true,
+    hydrate
+  } = opts;
   return async (req, res, next) => {
     const token = getBearerToken(req);
     if (!token) {
@@ -295,8 +320,33 @@ function createAuthMiddleware(opts) {
           expires_at: decoded?.exp
         }
       };
-      const hydrated = await hydrate({ decoded, req, subject, company_uid, branch_uid });
+      if (subject === "employee") {
+        baseCtx.employee_uid = extractEmployeeUid(decoded) ?? void 0;
+      } else {
+        baseCtx.customer_uid = extractCustomerUid(decoded) ?? void 0;
+      }
+      const hydrated = await hydrate({
+        decoded,
+        req,
+        subject,
+        company_uid,
+        branch_uid
+      });
       Object.assign(baseCtx, hydrated);
+      if (subject === "employee" && !baseCtx.employee_uid) {
+        return res.status(401).json({
+          ok: false,
+          code: "AUTH_EMPLOYEE_UID_MISSING",
+          message: "employee_uid missing in token/context (expected employee_uid or sub=emp:<uid>)"
+        });
+      }
+      if (subject === "customer" && !baseCtx.customer_uid) {
+        return res.status(401).json({
+          ok: false,
+          code: "AUTH_CUSTOMER_UID_MISSING",
+          message: "customer_uid missing in token/context (expected customer_uid or sub=cus:<uid>)"
+        });
+      }
       if (requireSubject) {
         if (subject === "employee" && !baseCtx.employee) {
           return res.status(401).json({
@@ -324,8 +374,8 @@ function createAuthMiddleware(opts) {
         });
       }
       try {
-        const { default: admin2 } = await import("firebase-admin");
-        const firebaseDecoded = await admin2.auth().verifyIdToken(token);
+        const { default: admin } = await import("firebase-admin");
+        const firebaseDecoded = await admin.auth().verifyIdToken(token);
         if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {
           return res.status(401).json({
             ok: false,
@@ -357,169 +407,112 @@ function createAuthMiddleware(opts) {
 }
 
 // src/auth/authentication.ts
-import admin from "firebase-admin";
-import jwt2 from "jsonwebtoken";
-import fs3 from "fs";
-function getBearerToken2(req) {
-  const auth = String(req.headers?.authorization || "");
-  if (!auth.startsWith("Bearer ")) return null;
-  const token = auth.slice(7).trim();
-  return token.length ? token : null;
-}
-function readPublicKey() {
-  const publicKeyPath = process.env.JWT_PUBLIC_KEY_PATH;
-  const publicKeyEnv = process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || "";
-  if (publicKeyPath) {
-    const v = fs3.readFileSync(publicKeyPath, "utf8").trim();
-    if (v) return v;
-  }
-  const envKey = publicKeyEnv.replace(/\\n/g, "\n").trim();
-  if (envKey) return envKey;
-  throw new Error("Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)");
-}
-function verifyBackendJwtRS2562(raw) {
-  const publicKey = readPublicKey();
-  const audience = process.env.JWT_AUDIENCE || process.env.AUTH_JWT_AUDIENCE || "getmarket.api";
-  const issuer = process.env.JWT_ISSUER || process.env.AUTH_JWT_ISSUER || "getmarket-auth";
-  return jwt2.verify(raw, publicKey, {
-    algorithms: ["RS256"],
-    audience,
-    issuer
-  });
-}
-function normalizeUid2(v) {
-  const s = String(v ?? "").trim();
-  return s.length ? s : null;
-}
 function deriveCompanyBranch(decoded, companyUid, branchUid) {
   const companiesFromToken = Array.isArray(decoded?.companies) ? decoded.companies : [];
   const company = decoded?.company ?? (companyUid ? companiesFromToken.find((c) => c?.uid === companyUid) : null) ?? null;
   const branch = decoded?.branch ?? (branchUid && company?.branches ? (company.branches || []).find((b) => b?.uid === branchUid) : null) ?? null;
-  return { companiesFromToken, company, branch };
-}
-function extractEmployeeUid(decoded) {
-  const direct = normalizeUid2(decoded?.employee_uid);
-  if (direct) return direct;
-  const sub = normalizeUid2(decoded?.sub);
-  if (!sub) return null;
-  const m = /^emp:(.+)$/i.exec(sub);
-  return m?.[1] ? normalizeUid2(m[1]) : null;
-}
-function extractCustomerUid(decoded) {
-  const direct = normalizeUid2(decoded?.customer_uid);
-  if (direct) return direct;
-  const sub = normalizeUid2(decoded?.sub);
-  if (!sub) return null;
-  const m = /^cus:(.+)$/i.exec(sub);
-  return m?.[1] ? normalizeUid2(m[1]) : null;
-}
-function createAuthMiddleware2(opts) {
-  const { subject, allowFirebaseIdToken = false } = opts;
-  return async (req, res, next) => {
-    const token = getBearerToken2(req);
-    if (!token) {
-      return res.status(401).json({
-        ok: false,
-        code: "AUTH_MISSING_TOKEN",
-        message: "Missing Authorization Bearer token"
-      });
-    }
-    try {
-      const decoded = verifyBackendJwtRS2562(token);
-      const headerCtx = req.context || {};
-      const companyUid = normalizeUid2(headerCtx.company_uid);
-      const branchUid = normalizeUid2(headerCtx.branch_uid);
-      const { companiesFromToken, company, branch } = deriveCompanyBranch(decoded, companyUid, branchUid);
-      const ctx = {
-        tokenType: "backend",
-        subject,
-        company_uid: companyUid ?? void 0,
-        branch_uid: branchUid ?? void 0,
-        companies: companiesFromToken,
-        company,
-        branch,
-        roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
-        permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
-        denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : [],
-        session: {
-          jti: decoded?.jti,
-          device_id: decoded?.device_id,
-          expires_at: decoded?.exp
-        }
-      };
-      if (subject === "employee") {
-        const employee_uid = extractEmployeeUid(decoded);
-        if (!employee_uid) {
-          return res.status(401).json({
-            ok: false,
-            code: "AUTH_EMPLOYEE_UID_MISSING",
-            message: "employee_uid missing in token (expected employee_uid or sub=emp:<uid>)"
-          });
-        }
-        ctx.employee_uid = employee_uid;
-        const embedded = decoded?.employee ?? decoded?.user ?? null;
-        ctx.employee = embedded && typeof embedded === "object" ? embedded : { uid: employee_uid, email: decoded?.email ?? null };
-      } else {
-        const customer_uid = extractCustomerUid(decoded);
-        if (!customer_uid) {
-          return res.status(401).json({
-            ok: false,
-            code: "AUTH_CUSTOMER_UID_MISSING",
-            message: "customer_uid missing in token (expected customer_uid or sub=cus:<uid>)"
-          });
-        }
-        ctx.customer_uid = customer_uid;
-        const embedded = decoded?.customer ?? null;
-        ctx.customer = embedded && typeof embedded === "object" ? embedded : { uid: customer_uid };
-      }
-      req.auth = ctx;
-      return next();
-    } catch {
-      if (!allowFirebaseIdToken) {
-        return res.status(401).json({
-          ok: false,
-          code: "AUTH_INVALID_TOKEN",
-          message: "Invalid or expired token"
-        });
-      }
-      try {
-        const firebaseDecoded = await admin.auth().verifyIdToken(token);
-        if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {
-          return res.status(401).json({
-            ok: false,
-            code: "AUTH_EMAIL_NOT_VERIFIED",
-            message: "Email not verified"
-          });
-        }
-        const headerCtx = req.context || {};
-        const companyUid = normalizeUid2(headerCtx.company_uid);
-        const branchUid = normalizeUid2(headerCtx.branch_uid);
-        req.auth = {
-          tokenType: "backend",
-          subject,
-          firebase: firebaseDecoded,
-          company_uid: companyUid ?? void 0,
-          branch_uid: branchUid ?? void 0,
-          companies: [],
-          roles: [],
-          permissions: [],
-          denied_permissions: []
-        };
-        return next();
-      } catch {
-        return res.status(401).json({
-          ok: false,
-          code: "AUTH_INVALID_TOKEN",
-          message: "Invalid or expired token"
-        });
-      }
-    }
+  return {
+    companiesFromToken,
+    company,
+    branch
   };
 }
-var authEmployeeRequired = createAuthMiddleware2({ subject: "employee", allowFirebaseIdToken: false });
-var authCustomerRequired = createAuthMiddleware2({ subject: "customer", allowFirebaseIdToken: false });
-var authEmployeeAllowFirebase = createAuthMiddleware2({ subject: "employee", allowFirebaseIdToken: true });
-var authCustomerAllowFirebase = createAuthMiddleware2({ subject: "customer", allowFirebaseIdToken: true });
+var authEmployeeRequired = createAuthMiddleware({
+  subject: "employee",
+  allowFirebaseIdToken: false,
+  requireSubject: false,
+  hydrate: async ({ decoded, company_uid, branch_uid }) => {
+    const employee_uid = extractEmployeeUid(decoded) ?? normalizeUid(decoded?.employee?.uid);
+    const { companiesFromToken, company, branch } = deriveCompanyBranch(
+      decoded,
+      company_uid,
+      branch_uid
+    );
+    const employee = decoded?.employee && typeof decoded.employee === "object" ? decoded.employee : employee_uid ? { uid: employee_uid, email: decoded?.email ?? null } : void 0;
+    return {
+      employee_uid: employee_uid ?? void 0,
+      employee,
+      companies: companiesFromToken,
+      company,
+      branch,
+      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+      denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : []
+    };
+  }
+});
+var authCustomerRequired = createAuthMiddleware({
+  subject: "customer",
+  allowFirebaseIdToken: false,
+  requireSubject: false,
+  hydrate: async ({ decoded, company_uid, branch_uid }) => {
+    const customer_uid = extractCustomerUid(decoded) ?? normalizeUid(decoded?.customer?.uid);
+    const { companiesFromToken, company, branch } = deriveCompanyBranch(
+      decoded,
+      company_uid,
+      branch_uid
+    );
+    const customer = decoded?.customer && typeof decoded.customer === "object" ? decoded.customer : customer_uid ? { uid: customer_uid } : void 0;
+    return {
+      customer_uid: customer_uid ?? void 0,
+      customer,
+      companies: companiesFromToken,
+      company,
+      branch,
+      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+      denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : []
+    };
+  }
+});
+var authEmployeeAllowFirebase = createAuthMiddleware({
+  subject: "employee",
+  allowFirebaseIdToken: true,
+  requireSubject: false,
+  hydrate: async ({ decoded, company_uid, branch_uid }) => {
+    const employee_uid = extractEmployeeUid(decoded) ?? normalizeUid(decoded?.employee?.uid);
+    const { companiesFromToken, company, branch } = deriveCompanyBranch(
+      decoded,
+      company_uid,
+      branch_uid
+    );
+    const employee = decoded?.employee && typeof decoded.employee === "object" ? decoded.employee : employee_uid ? { uid: employee_uid, email: decoded?.email ?? null } : void 0;
+    return {
+      employee_uid: employee_uid ?? void 0,
+      employee,
+      companies: companiesFromToken,
+      company,
+      branch,
+      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+      denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : []
+    };
+  }
+});
+var authCustomerAllowFirebase = createAuthMiddleware({
+  subject: "customer",
+  allowFirebaseIdToken: true,
+  requireSubject: false,
+  hydrate: async ({ decoded, company_uid, branch_uid }) => {
+    const customer_uid = extractCustomerUid(decoded) ?? normalizeUid(decoded?.customer?.uid);
+    const { companiesFromToken, company, branch } = deriveCompanyBranch(
+      decoded,
+      company_uid,
+      branch_uid
+    );
+    const customer = decoded?.customer && typeof decoded.customer === "object" ? decoded.customer : customer_uid ? { uid: customer_uid } : void 0;
+    return {
+      customer_uid: customer_uid ?? void 0,
+      customer,
+      companies: companiesFromToken,
+      company,
+      branch,
+      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+      denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : []
+    };
+  }
+});
 
 // src/middlewares/guards.ts
 function normalizeRole(r) {
@@ -649,10 +642,13 @@ export {
   requireAnyPermission,
   requireRoles,
   requireRolesOrAnyPermission,
+  getBearerToken,
+  normalizeUid,
   readRs256PublicKey,
   verifyBackendJwtRS256,
+  extractEmployeeUid,
+  extractCustomerUid,
   createAuthMiddleware,
-  createAuthMiddleware2,
   authEmployeeRequired,
   authCustomerRequired,
   authEmployeeAllowFirebase,
@@ -663,4 +659,4 @@ export {
   allowSysAdminOrRolesOrAnyPermission,
   allowAuthAdminOrPerm
 };
-//# sourceMappingURL=chunk-WM2QICZQ.js.map
+//# sourceMappingURL=chunk-DT3AM34L.js.map

package/dist/chunk-DT3AM34L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middlewares/parseHeaders.ts","../src/middlewares/requestId.ts","../src/middlewares/internalAuth.ts","../src/middlewares/respond.ts","../src/middlewares/authorization.ts","../src/auth/jwt.ts","../src/auth/middleware.ts","../src/auth/authentication.ts","../src/middlewares/guards.ts"],"sourcesContent":["// sdk/src/middlewares/parseHeaders.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {getRequestContextFromHeaders} from \"../headers\";\n\n/**\n * ✅ NO-LEGACY / ESTÁNDAR:\n * - Lee SOLO x-company y x-branch (UIDs planos)\n * - Setea req.context = { company_uid, branch_uid }\n * - NO toca req.auth (auth lo setea authentication/requireAuth)\n */\nexport default function parseHeaders(req: Request, _res: Response, next: NextFunction) {\n    (req as any).context = getRequestContextFromHeaders(req.headers as any);\n    next();\n}\n","// middlewares/requestId.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {randomUUID, randomBytes} from \"crypto\";\n\nexport const REQUEST_ID_HEADER = \"x-request-id\";\nexport const REQUEST_ID_HEADER_ALT = \"x-requestid\";\nexport const RESPONSE_REQUEST_ID_HEADER = \"X-Request-Id\";\n\n// Si quieres IDs más cortos (opcional). Por defecto usamos UUID.\nfunction nanoidLike(len = 21) {\n    return randomBytes(16).toString(\"base64url\").slice(0, len);\n}\n\nexport default function requestId(req: Request, res: Response, next: NextFunction) {\n    const headerId = (req.headers[REQUEST_ID_HEADER] || req.headers[REQUEST_ID_HEADER_ALT]) as\n        | string\n        | undefined;\n\n    // ✅ estándar único: usa UUID (o cambia a nanoidLike() si prefieres corto)\n    const id = headerId?.trim() || randomUUID();\n\n    // ✅ estándar único (no legacy)\n    (req as any).requestId = id;\n    res.locals.requestId = id;\n\n    // ✅ respuesta\n    res.setHeader(RESPONSE_REQUEST_ID_HEADER, id);\n\n    next();\n}\n","import type {Request, Response, NextFunction} from \"express\";\nimport fs from \"fs\";\nimport crypto from \"crypto\";\nimport {sendError} from \"./respond\";\nimport {HEADER_INTERNAL_API_KEY} from \"../headers\";\n\nfunction readSecretFile(path?: string): string | null {\n    if (!path) return null;\n    try {\n        const v = fs.readFileSync(path, \"utf8\").trim();\n        return v.length ? v : null;\n    } catch {\n        return null;\n    }\n}\n\nfunction splitKeys(v?: string | null): string[] {\n    if (!v) return [];\n    return v.split(\",\").map((s) => s.trim()).filter(Boolean);\n}\n\nfunction getExpectedKeys(): string[] {\n    const fileKey = readSecretFile(process.env.INTERNAL_API_KEY_FILE);\n    const envKey = (process.env.INTERNAL_API_KEY || \"\").trim();\n    const raw = fileKey || envKey;\n    return splitKeys(raw);\n}\n\nfunction extractToken(req: Request): string | null {\n    const apiKey = (req.header(HEADER_INTERNAL_API_KEY) || \"\").trim();\n    return apiKey || null;\n}\n\nfunction safeEquals(a: string, b: string): boolean {\n    const aa = Buffer.from(a);\n    const bb = Buffer.from(b);\n    if (aa.length !== bb.length) return false;\n    return crypto.timingSafeEqual(aa, bb);\n}\n\nexport default function internalAuth(req: Request, res: Response, next: NextFunction) {\n    const token = extractToken(req);\n\n    if (!token) {\n        return sendError(req, res, 401, \"UNAUTHORIZED\", `Missing internal api key (${HEADER_INTERNAL_API_KEY})`);\n    }\n\n    const expectedKeys = getExpectedKeys();\n    if (expectedKeys.length === 0) {\n        return sendError(\n            req,\n            res,\n            500,\n            \"MISCONFIGURED_INTERNAL_AUTH\",\n            \"Internal api key not configured (INTERNAL_API_KEY or INTERNAL_API_KEY_FILE)\"\n        );\n    }\n\n    const ok = expectedKeys.some((k) => safeEquals(token, k));\n    if (!ok) {\n        return sendError(req, res, 403, \"FORBIDDEN\", \"Invalid internal api key\");\n    }\n\n    return next();\n}\n","// packages/sdk/src/middleware/respond.ts\nimport type {Request, Response} from \"express\";\n\nexport function sendOk<T>(_req: Request, res: Response, data: T, statusCode = 200) {\n    return res.status(statusCode).json({ok: true, data, requestId: res.locals?.requestId ?? null});\n}\n\nexport function sendError(\n    _req: Request,\n    res: Response,\n    statusCode: number,\n    code: string,\n    message: string,\n    details?: any\n) {\n    return res.status(statusCode).json({\n        ok: false,\n        error: {code, message, ...(details !== undefined ? {details} : {})},\n        requestId: res.locals?.requestId ?? null,\n    });\n}\n","// packages/sdk/src/middlewares/authorization.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {sendError} from \"./respond\";\n\ntype AuthRole = string | { code?: string; name?: string };\ntype AuthPermission = string | { code?: string; name?: string };\n\ntype AuthShape = {\n    roles?: AuthRole[];\n    permissions?: AuthPermission[];\n    denied_permissions?: AuthPermission[];\n};\n\nfunction getAuth(req: Request): AuthShape {\n    return ((req as any).auth ?? {}) as AuthShape;\n}\n\nfunction normalizeCode(v: any): string | null {\n    if (!v) return null;\n    if (typeof v === \"string\") return v;\n    if (typeof v === \"object\") return v.code || v.name || null;\n    return null;\n}\n\nfunction rolesSet(auth: AuthShape): Set<string> {\n    const out = new Set<string>();\n    for (const r of auth.roles || []) {\n        const c = normalizeCode(r);\n        if (c) out.add(c);\n    }\n    return out;\n}\n\nfunction permsSet(list?: AuthPermission[]): Set<string> {\n    const out = new Set<string>();\n    for (const p of list || []) {\n        const c = normalizeCode(p);\n        if (c) out.add(c);\n    }\n    return out;\n}\n\n/**\n * 401 si no existe req.auth (contexto auth).\n * Útil para proteger rutas donde SIEMPRE debe existir auth.\n */\nexport function requireAuthContext() {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (!(req as any).auth) {\n            return sendError(req, res, 401, \"UNAUTHORIZED\", \"Missing auth context\");\n        }\n        return next();\n    };\n}\n\n/**\n * Helper: SYS_ADMIN bypass (por defecto activo)\n */\nfunction isSysAdmin(auth: AuthShape, sysAdminRole: string) {\n    const have = rolesSet(auth);\n    return have.has(sysAdminRole);\n}\n\n/**\n * Requiere TODOS los permisos indicados.\n * Regla: denied_permissions siempre gana sobre permissions.\n *\n * options:\n *  - sysAdminBypass: default true\n *  - sysAdminRole: default \"SYS_ADMIN\"\n */\nexport function requirePermissions(\n    perms: string[],\n    options?: { sysAdminBypass?: boolean; sysAdminRole?: string }\n) {\n    const sysAdminBypass = options?.sysAdminBypass !== false;\n    const sysAdminRole = options?.sysAdminRole || \"SYS_ADMIN\";\n\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();\n\n        const allow = permsSet(auth.permissions);\n        const deny = permsSet(auth.denied_permissions);\n\n        // deny gana siempre\n        for (const p of perms) {\n            if (deny.has(p)) {\n                return sendError(req, res, 403, \"FORBIDDEN\", `Denied permission: ${p}`, {\n                    denied: p,\n                });\n            }\n        }\n\n        const missing = perms.filter((p) => !allow.has(p));\n        if (missing.length) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Missing permissions\", {\n                missing,\n                mode: \"ALL\",\n            });\n        }\n\n        return next();\n    };\n}\n\n/**\n * Requiere AL MENOS 1 permiso de la lista (ANY/OR).\n * Regla: denied_permissions siempre gana.\n */\nexport function requireAnyPermission(\n    perms: string[],\n    options?: { sysAdminBypass?: boolean; sysAdminRole?: string }\n) {\n    const sysAdminBypass = options?.sysAdminBypass !== false;\n    const sysAdminRole = options?.sysAdminRole || \"SYS_ADMIN\";\n\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();\n\n        const allow = permsSet(auth.permissions);\n        const deny = permsSet(auth.denied_permissions);\n\n        // deny gana siempre (si alguno requerido está denegado explícitamente)\n        for (const p of perms) {\n            if (deny.has(p)) {\n                return sendError(req, res, 403, \"FORBIDDEN\", `Denied permission: ${p}`, {\n                    denied: p,\n                });\n            }\n        }\n\n        const ok = perms.some((p) => allow.has(p));\n        if (!ok) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Permission denied\", {\n                required: perms,\n                mode: \"ANY\",\n            });\n        }\n\n        return next();\n    };\n}\n\n/**\n * Requiere al menos 1 rol (ANY/OR).\n * options:\n *  - sysAdminBypass: default true\n *  - sysAdminRole: default \"SYS_ADMIN\"\n */\nexport function requireRoles(\n    roles: string[],\n    options?: { sysAdminBypass?: boolean; sysAdminRole?: string }\n) {\n    const sysAdminBypass = options?.sysAdminBypass !== false;\n    const sysAdminRole = options?.sysAdminRole || \"SYS_ADMIN\";\n\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        // SYS_ADMIN bypass aplica también aquí\n        if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();\n\n        const have = rolesSet(auth);\n        if (!roles.some((r) => have.has(r))) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Role not allowed\", {\n                required: roles,\n                mode: \"ANY\",\n            });\n        }\n\n        return next();\n    };\n}\n\n/**\n * Requiere (roles ANY) OR (permissions ANY).\n * deny_permissions siempre gana sobre permissions.\n */\nexport function requireRolesOrAnyPermission(\n    roles: string[],\n    perms: string[],\n    options?: { sysAdminBypass?: boolean; sysAdminRole?: string }\n) {\n    const sysAdminBypass = options?.sysAdminBypass !== false;\n    const sysAdminRole = options?.sysAdminRole || \"SYS_ADMIN\";\n\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();\n\n        const haveRoles = rolesSet(auth);\n        const allow = permsSet(auth.permissions);\n        const deny = permsSet(auth.denied_permissions);\n\n        // deny gana siempre (si cualquiera de los permisos evaluados está denegado explícitamente)\n        for (const p of perms) {\n            if (deny.has(p)) {\n                return sendError(req, res, 403, \"FORBIDDEN\", `Denied permission: ${p}`, {\n                    denied: p,\n                });\n            }\n        }\n\n        const okRole = roles.some((r) => haveRoles.has(r));\n        const okPerm = perms.some((p) => allow.has(p));\n\n        if (!okRole && !okPerm) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Access denied\", {\n                roles,\n                permissions: perms,\n                mode: \"ROLES_OR_PERMS_ANY\",\n            });\n        }\n\n        return next();\n    };\n}\n","import fs from \"fs\";\nimport jwt, {JwtPayload} from \"jsonwebtoken\";\n\nfunction readFileIfExists(path?: string): string | null {\n  if (!path) return null;\n  try {\n    const v = fs.readFileSync(path, \"utf8\").trim();\n    return v.length ? v : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function getBearerToken(req: any): string | null {\n  const auth = String(req?.headers?.authorization || \"\");\n  if (!auth.startsWith(\"Bearer \")) return null;\n  const token = auth.slice(7).trim();\n  return token.length ? token : null;\n}\n\nexport function normalizeUid(v: any): string | null {\n  const s = String(v ?? \"\").trim();\n  return s.length ? s : null;\n}\n\n/**\n * ✅ Keys centralizadas:\n * - JWT_PUBLIC_KEY_PATH=/run/secrets/jwtRS256.key.pub\n * - fallback env AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY\n */\nexport function readRs256PublicKey(): string {\n  const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);\n  if (fromFile) return fromFile;\n\n  const fromEnv = String(\n    process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || \"\"\n  )\n    .replace(/\\\\n/g, \"\\n\")\n    .trim();\n\n  if (fromEnv) return fromEnv;\n\n  throw new Error(\n    \"Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)\"\n  );\n}\n\nexport function verifyBackendJwtRS256(raw: string): JwtPayload {\n  const publicKey = readRs256PublicKey();\n\n  const audience =\n    process.env.JWT_AUDIENCE ||\n    process.env.AUTH_JWT_AUDIENCE ||\n    \"getmarket.api\";\n\n  const issuer =\n    process.env.JWT_ISSUER ||\n    process.env.AUTH_JWT_ISSUER ||\n    \"getmarket-auth\";\n\n  return jwt.verify(raw, publicKey, {\n    algorithms: [\"RS256\"],\n    audience,\n    issuer,\n  }) as JwtPayload;\n}\n\nexport function extractEmployeeUid(decoded: any): string | null {\n  const direct =\n    normalizeUid(decoded?.employee_uid) ??\n    normalizeUid(decoded?.employee?.uid);\n\n  if (direct) return direct;\n\n  const sub = normalizeUid(decoded?.sub);\n  if (!sub) return null;\n\n  const match = /^emp:(.+)$/i.exec(sub);\n  return match?.[1] ? normalizeUid(match[1]) : null;\n}\n\nexport function extractCustomerUid(decoded: any): string | null {\n  const direct =\n    normalizeUid(decoded?.customer_uid) ??\n    normalizeUid(decoded?.customer?.uid);\n\n  if (direct) return direct;\n\n  const sub = normalizeUid(decoded?.sub);\n  if (!sub) return null;\n\n  const match = /^cus:(.+)$/i.exec(sub);\n  return match?.[1] ? normalizeUid(match[1]) : null;\n}\n","import type {NextFunction, Response} from \"express\";\nimport type {AuthContext, AuthMiddlewareOptions} from \"./types\";\nimport {\n  extractCustomerUid,\n  extractEmployeeUid,\n  getBearerToken,\n  normalizeUid,\n  verifyBackendJwtRS256,\n} from \"./jwt\";\n\nexport function createAuthMiddleware(opts: AuthMiddlewareOptions) {\n  const {\n    subject,\n    allowFirebaseIdToken = false,\n    requireSubject = true,\n    hydrate,\n  } = opts;\n\n  return async (req: any, res: Response, next: NextFunction) => {\n    const token = getBearerToken(req);\n\n    if (!token) {\n      return res.status(401).json({\n        ok: false,\n        code: \"AUTH_MISSING_TOKEN\",\n        message: \"Missing Authorization Bearer token\",\n      });\n    }\n\n    const headerCtx = (req as any).context || {};\n    const company_uid = normalizeUid(headerCtx.company_uid);\n    const branch_uid = normalizeUid(headerCtx.branch_uid);\n\n    try {\n      const decoded: any = verifyBackendJwtRS256(token);\n\n      const baseCtx: AuthContext = {\n        tokenType: \"backend\",\n        subject,\n        company_uid: company_uid ?? undefined,\n        branch_uid: branch_uid ?? undefined,\n        roles: Array.isArray(decoded?.roles) ? decoded.roles : [],\n        permissions: Array.isArray(decoded?.permissions)\n          ? decoded.permissions\n          : [],\n        denied_permissions: Array.isArray(decoded?.denied_permissions)\n          ? decoded.denied_permissions\n          : [],\n        session: {\n          jti: decoded?.jti,\n          device_id: decoded?.device_id,\n          expires_at: decoded?.exp,\n        },\n      };\n\n      if (subject === \"employee\") {\n        baseCtx.employee_uid = extractEmployeeUid(decoded) ?? undefined;\n      } else {\n        baseCtx.customer_uid = extractCustomerUid(decoded) ?? undefined;\n      }\n\n      const hydrated = await hydrate({\n        decoded,\n        req,\n        subject,\n        company_uid,\n        branch_uid,\n      });\n\n      Object.assign(baseCtx, hydrated);\n\n      if (subject === \"employee\" && !baseCtx.employee_uid) {\n        return res.status(401).json({\n          ok: false,\n          code: \"AUTH_EMPLOYEE_UID_MISSING\",\n          message:\n            \"employee_uid missing in token/context (expected employee_uid or sub=emp:<uid>)\",\n        });\n      }\n\n      if (subject === \"customer\" && !baseCtx.customer_uid) {\n        return res.status(401).json({\n          ok: false,\n          code: \"AUTH_CUSTOMER_UID_MISSING\",\n          message:\n            \"customer_uid missing in token/context (expected customer_uid or sub=cus:<uid>)\",\n        });\n      }\n\n      if (requireSubject) {\n        if (subject === \"employee\" && !baseCtx.employee) {\n          return res.status(401).json({\n            ok: false,\n            code: \"AUTH_EMPLOYEE_NOT_FOUND\",\n            message: \"Employee not resolved by hydrator\",\n          });\n        }\n\n        if (subject === \"customer\" && !baseCtx.customer) {\n          return res.status(401).json({\n            ok: false,\n            code: \"AUTH_CUSTOMER_NOT_FOUND\",\n            message: \"Customer not resolved by hydrator\",\n          });\n        }\n      }\n\n      (req as any).auth = baseCtx;\n      return next();\n    } catch {\n      if (!allowFirebaseIdToken) {\n        return res.status(401).json({\n          ok: false,\n          code: \"AUTH_INVALID_TOKEN\",\n          message: \"Invalid or expired token\",\n        });\n      }\n\n      try {\n        const {default: admin} = await import(\"firebase-admin\");\n        const firebaseDecoded = await admin.auth().verifyIdToken(token);\n\n        if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {\n          return res.status(401).json({\n            ok: false,\n            code: \"AUTH_EMAIL_NOT_VERIFIED\",\n            message: \"Email not verified\",\n          });\n        }\n\n        (req as any).auth = {\n          tokenType: \"backend\",\n          subject,\n          firebase: firebaseDecoded,\n          company_uid: company_uid ?? undefined,\n          branch_uid: branch_uid ?? undefined,\n          companies: [],\n          roles: [],\n          permissions: [],\n          denied_permissions: [],\n        } satisfies AuthContext;\n\n        return next();\n      } catch {\n        return res.status(401).json({\n          ok: false,\n          code: \"AUTH_INVALID_TOKEN\",\n          message: \"Invalid or expired token\",\n        });\n      }\n    }\n  };\n}\n","import {createAuthMiddleware} from \"./middleware\";\nimport {\n  extractCustomerUid,\n  extractEmployeeUid,\n  normalizeUid,\n} from \"./jwt\";\n\n/**\n * Wrappers simples sobre el middleware oficial.\n * Sirven como fachada reusable en micros que todavía no declaran\n * un hydrator propio más rico.\n */\n\nfunction deriveCompanyBranch(decoded: any, companyUid: string | null, branchUid: string | null) {\n  const companiesFromToken = Array.isArray(decoded?.companies)\n    ? decoded.companies\n    : [];\n\n  const company =\n    decoded?.company ??\n    (companyUid\n      ? companiesFromToken.find((c: any) => c?.uid === companyUid)\n      : null) ??\n    null;\n\n  const branch =\n    decoded?.branch ??\n    (branchUid && company?.branches\n      ? (company.branches || []).find((b: any) => b?.uid === branchUid)\n      : null) ??\n    null;\n\n  return {\n    companiesFromToken,\n    company,\n    branch,\n  };\n}\n\nexport const authEmployeeRequired = createAuthMiddleware({\n  subject: \"employee\",\n  allowFirebaseIdToken: false,\n  requireSubject: false,\n  hydrate: async ({decoded, company_uid, branch_uid}) => {\n    const employee_uid =\n      extractEmployeeUid(decoded) ??\n      normalizeUid(decoded?.employee?.uid);\n\n    const {companiesFromToken, company, branch} = deriveCompanyBranch(\n      decoded,\n      company_uid,\n      branch_uid\n    );\n\n    const employee =\n      decoded?.employee && typeof decoded.employee === \"object\"\n        ? decoded.employee\n        : employee_uid\n          ? {uid: employee_uid, email: decoded?.email ?? null}\n          : undefined;\n\n    return {\n      employee_uid: employee_uid ?? undefined,\n      employee,\n      companies: companiesFromToken,\n      company,\n      branch,\n      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],\n      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],\n      denied_permissions: Array.isArray(decoded?.denied_permissions)\n        ? decoded.denied_permissions\n        : [],\n    };\n  },\n});\n\nexport const authCustomerRequired = createAuthMiddleware({\n  subject: \"customer\",\n  allowFirebaseIdToken: false,\n  requireSubject: false,\n  hydrate: async ({decoded, company_uid, branch_uid}) => {\n    const customer_uid =\n      extractCustomerUid(decoded) ??\n      normalizeUid(decoded?.customer?.uid);\n\n    const {companiesFromToken, company, branch} = deriveCompanyBranch(\n      decoded,\n      company_uid,\n      branch_uid\n    );\n\n    const customer =\n      decoded?.customer && typeof decoded.customer === \"object\"\n        ? decoded.customer\n        : customer_uid\n          ? {uid: customer_uid}\n          : undefined;\n\n    return {\n      customer_uid: customer_uid ?? undefined,\n      customer,\n      companies: companiesFromToken,\n      company,\n      branch,\n      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],\n      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],\n      denied_permissions: Array.isArray(decoded?.denied_permissions)\n        ? decoded.denied_permissions\n        : [],\n    };\n  },\n});\n\nexport const authEmployeeAllowFirebase = createAuthMiddleware({\n  subject: \"employee\",\n  allowFirebaseIdToken: true,\n  requireSubject: false,\n  hydrate: async ({decoded, company_uid, branch_uid}) => {\n    const employee_uid =\n      extractEmployeeUid(decoded) ??\n      normalizeUid(decoded?.employee?.uid);\n\n    const {companiesFromToken, company, branch} = deriveCompanyBranch(\n      decoded,\n      company_uid,\n      branch_uid\n    );\n\n    const employee =\n      decoded?.employee && typeof decoded.employee === \"object\"\n        ? decoded.employee\n        : employee_uid\n          ? {uid: employee_uid, email: decoded?.email ?? null}\n          : undefined;\n\n    return {\n      employee_uid: employee_uid ?? undefined,\n      employee,\n      companies: companiesFromToken,\n      company,\n      branch,\n      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],\n      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],\n      denied_permissions: Array.isArray(decoded?.denied_permissions)\n        ? decoded.denied_permissions\n        : [],\n    };\n  },\n});\n\nexport const authCustomerAllowFirebase = createAuthMiddleware({\n  subject: \"customer\",\n  allowFirebaseIdToken: true,\n  requireSubject: false,\n  hydrate: async ({decoded, company_uid, branch_uid}) => {\n    const customer_uid =\n      extractCustomerUid(decoded) ??\n      normalizeUid(decoded?.customer?.uid);\n\n    const {companiesFromToken, company, branch} = deriveCompanyBranch(\n      decoded,\n      company_uid,\n      branch_uid\n    );\n\n    const customer =\n      decoded?.customer && typeof decoded.customer === \"object\"\n        ? decoded.customer\n        : customer_uid\n          ? {uid: customer_uid}\n          : undefined;\n\n    return {\n      customer_uid: customer_uid ?? undefined,\n      customer,\n      companies: companiesFromToken,\n      company,\n      branch,\n      roles: Array.isArray(decoded?.roles) ? decoded.roles : [],\n      permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],\n      denied_permissions: Array.isArray(decoded?.denied_permissions)\n        ? decoded.denied_permissions\n        : [],\n    };\n  },\n});\n","// packages/sdk/src/middlewares/guards.ts\nimport type {Request, Response, NextFunction, RequestHandler} from \"express\";\nimport parseHeaders from \"./parseHeaders\";\nimport {authEmployeeRequired} from \"../auth\";\nimport {sendError} from \"./respond\";\n\ntype RoleShape = string | { code?: string; name?: string };\ntype PermShape = string | { code?: string; name?: string };\n\nfunction normalizeRole(r: RoleShape): string | null {\n    if (!r) return null;\n    if (typeof r === \"string\") return r;\n    return r.code || r.name || null;\n}\n\nfunction normalizePerm(p: PermShape): string | null {\n    if (!p) return null;\n    if (typeof p === \"string\") return p;\n    return p.code || p.name || null;\n}\n\nfunction isSysAdmin(roles: RoleShape[] | undefined): boolean {\n    if (!Array.isArray(roles)) return false;\n    return roles.some((r) => normalizeRole(r) === \"SYS_ADMIN\");\n}\n\nfunction getAuth(req: Request) {\n    return ((req as any).auth ?? {}) as {\n        roles?: RoleShape[];\n        permissions?: PermShape[];\n        denied_permissions?: PermShape[];\n    };\n}\n\nfunction permissionSets(auth: ReturnType<typeof getAuth>) {\n    const allow = new Set<string>((auth.permissions ?? []).map(normalizePerm).filter(Boolean) as string[]);\n    const deny = new Set<string>((auth.denied_permissions ?? []).map(normalizePerm).filter(Boolean) as string[]);\n    return {allow, deny};\n}\n\nfunction roleSet(auth: ReturnType<typeof getAuth>) {\n    return new Set<string>((auth.roles ?? []).map(normalizeRole).filter(Boolean) as string[]);\n}\n\n/**\n * ✅ SysAdmin bypass OR (ANY) permissions\n * - Si tiene alguno de los permisos => OK\n * - denied_permissions gana siempre\n */\nexport function allowSysAdminOrAnyPermission(...perms: string[]): RequestHandler[] {\n    const required = (perms ?? []).filter(Boolean);\n\n    return [\n        parseHeaders,\n        authEmployeeRequired,\n        (req: Request, res: Response, next: NextFunction) => {\n            const auth = getAuth(req);\n            if (isSysAdmin(auth.roles)) return next();\n\n            const {allow, deny} = permissionSets(auth);\n\n            for (const p of required) {\n                if (deny.has(p)) {\n                    return sendError(req, res, 403, \"FORBIDDEN\", `Denied permission: ${p}`, {denied: p});\n                }\n            }\n\n            const ok = required.some((p) => allow.has(p));\n            if (!ok) {\n                return sendError(req, res, 403, \"FORBIDDEN\", \"Missing permissions (ANY)\", {required});\n            }\n\n            return next();\n        },\n    ];\n}\n\n/**\n * ✅ SysAdmin bypass OR (ALL) permissions (AND)\n */\nexport function allowSysAdminOrPermissionsAll(...perms: string[]): RequestHandler[] {\n    const required = (perms ?? []).filter(Boolean);\n\n    return [\n        parseHeaders,\n        authEmployeeRequired,\n        (req: Request, res: Response, next: NextFunction) => {\n            const auth = getAuth(req);\n            if (isSysAdmin(auth.roles)) return next();\n\n            const {allow, deny} = permissionSets(auth);\n\n            for (const p of required) {\n                if (deny.has(p)) {\n                    return sendError(req, res, 403, \"FORBIDDEN\", `Denied permission: ${p}`, {denied: p});\n                }\n            }\n\n            const missing = required.filter((p) => !allow.has(p));\n            if (missing.length) {\n                return sendError(req, res, 403, \"FORBIDDEN\", \"Missing permissions (ALL)\", {required, missing});\n            }\n\n            return next();\n        },\n    ];\n}\n\n/**\n * ✅ SysAdmin bypass OR roles (ANY)\n */\nexport function allowSysAdminOrRoles(...roles: string[]): RequestHandler[] {\n    const required = (roles ?? []).filter(Boolean);\n\n    return [\n        parseHeaders,\n        authEmployeeRequired,\n        (req: Request, res: Response, next: NextFunction) => {\n            const auth = getAuth(req);\n            if (isSysAdmin(auth.roles)) return next();\n\n            const have = roleSet(auth);\n\n            const ok = required.some((r) => have.has(r));\n            if (!ok) {\n                return sendError(req, res, 403, \"FORBIDDEN\", \"Role not allowed\", {required});\n            }\n\n            return next();\n        },\n    ];\n}\n\n/**\n * ✅ SYS_ADMIN bypass OR (ANY) roles OR (ANY) permissions\n * - denied_permissions siempre gana\n */\nexport function allowSysAdminOrRolesOrAnyPermission(\n    roles: string | string[],\n    permissions: string | string[]\n): RequestHandler[] {\n    const requiredRoles = (Array.isArray(roles) ? roles : [roles]).filter(Boolean);\n    const requiredPerms = (Array.isArray(permissions) ? permissions : [permissions]).filter(Boolean);\n\n    return [\n        parseHeaders,\n        authEmployeeRequired,\n        (req: Request, res: Response, next: NextFunction) => {\n            const auth = getAuth(req);\n            if (isSysAdmin(auth.roles)) return next();\n\n            const {allow, deny} = permissionSets(auth);\n            for (const p of requiredPerms) {\n                if (deny.has(p)) {\n                    return sendError(req, res, 403, \"FORBIDDEN\", `Denied: ${p}`, {permission: p});\n                }\n            }\n\n            const haveRoles = roleSet(auth);\n            if (requiredRoles.some((r) => haveRoles.has(r))) return next();\n\n            if (requiredPerms.some((p) => allow.has(p))) return next();\n\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Permission denied\", {\n                roles: requiredRoles,\n                permissions: requiredPerms,\n                mode: \"ROLES_OR_ANY_PERMISSION\",\n            });\n        },\n    ];\n}\n\n/**\n * ✅ Helper específico Auth:\n * Rol AUTH_ADMIN o permiso fino (y SYS_ADMIN bypass)\n */\nexport function allowAuthAdminOrPerm(permission: string): RequestHandler[] {\n    return allowSysAdminOrRolesOrAnyPermission([\"AUTH_ADMIN\"], [permission]);\n}\n"],"mappings":";;;;;;AAUe,SAAR,aAA8B,KAAc,MAAgB,MAAoB;AACnF,EAAC,IAAY,UAAU,6BAA6B,IAAI,OAAc;AACtE,OAAK;AACT;;;ACXA,SAAQ,YAAY,mBAAkB;AAE/B,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,6BAA6B;AAO3B,SAAR,UAA2B,KAAc,KAAe,MAAoB;AAC/E,QAAM,WAAY,IAAI,QAAQ,iBAAiB,KAAK,IAAI,QAAQ,qBAAqB;AAKrF,QAAM,KAAK,UAAU,KAAK,KAAK,WAAW;AAG1C,EAAC,IAAY,YAAY;AACzB,MAAI,OAAO,YAAY;AAGvB,MAAI,UAAU,4BAA4B,EAAE;AAE5C,OAAK;AACT;;;AC5BA,OAAO,QAAQ;AACf,OAAO,YAAY;;;ACCZ,SAAS,OAAU,MAAe,KAAe,MAAS,aAAa,KAAK;AAC/E,SAAO,IAAI,OAAO,UAAU,EAAE,KAAK,EAAC,IAAI,MAAM,MAAM,WAAW,IAAI,QAAQ,aAAa,KAAI,CAAC;AACjG;AAEO,SAAS,UACZ,MACA,KACA,YACA,MACA,SACA,SACF;AACE,SAAO,IAAI,OAAO,UAAU,EAAE,KAAK;AAAA,IAC/B,IAAI;AAAA,IACJ,OAAO,EAAC,MAAM,SAAS,GAAI,YAAY,SAAY,EAAC,QAAO,IAAI,CAAC,EAAE;AAAA,IAClE,WAAW,IAAI,QAAQ,aAAa;AAAA,EACxC,CAAC;AACL;;;ADdA,SAAS,eAAe,MAA8B;AAClD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACA,UAAM,IAAI,GAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,WAAO,EAAE,SAAS,IAAI;AAAA,EAC1B,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAEA,SAAS,UAAU,GAA6B;AAC5C,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,SAAO,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAC3D;AAEA,SAAS,kBAA4B;AACjC,QAAM,UAAU,eAAe,QAAQ,IAAI,qBAAqB;AAChE,QAAM,UAAU,QAAQ,IAAI,oBAAoB,IAAI,KAAK;AACzD,QAAM,MAAM,WAAW;AACvB,SAAO,UAAU,GAAG;AACxB;AAEA,SAAS,aAAa,KAA6B;AAC/C,QAAM,UAAU,IAAI,OAAO,uBAAuB,KAAK,IAAI,KAAK;AAChE,SAAO,UAAU;AACrB;AAEA,SAAS,WAAW,GAAW,GAAoB;AAC/C,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,MAAI,GAAG,WAAW,GAAG,OAAQ,QAAO;AACpC,SAAO,OAAO,gBAAgB,IAAI,EAAE;AACxC;AAEe,SAAR,aAA8B,KAAc,KAAe,MAAoB;AAClF,QAAM,QAAQ,aAAa,GAAG;AAE9B,MAAI,CAAC,OAAO;AACR,WAAO,UAAU,KAAK,KAAK,KAAK,gBAAgB,6BAA6B,uBAAuB,GAAG;AAAA,EAC3G;AAEA,QAAM,eAAe,gBAAgB;AACrC,MAAI,aAAa,WAAW,GAAG;AAC3B,WAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,KAAK,aAAa,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,CAAC;AACxD,MAAI,CAAC,IAAI;AACL,WAAO,UAAU,KAAK,KAAK,KAAK,aAAa,0BAA0B;AAAA,EAC3E;AAEA,SAAO,KAAK;AAChB;;;AEnDA,SAAS,QAAQ,KAAyB;AACtC,SAAS,IAAY,QAAQ,CAAC;AAClC;AAEA,SAAS,cAAc,GAAuB;AAC1C,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,OAAO,MAAM,SAAU,QAAO,EAAE,QAAQ,EAAE,QAAQ;AACtD,SAAO;AACX;AAEA,SAAS,SAAS,MAA8B;AAC5C,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,KAAK,KAAK,SAAS,CAAC,GAAG;AAC9B,UAAM,IAAI,cAAc,CAAC;AACzB,QAAI,EAAG,KAAI,IAAI,CAAC;AAAA,EACpB;AACA,SAAO;AACX;AAEA,SAAS,SAAS,MAAsC;AACpD,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,KAAK,QAAQ,CAAC,GAAG;AACxB,UAAM,IAAI,cAAc,CAAC;AACzB,QAAI,EAAG,KAAI,IAAI,CAAC;AAAA,EACpB;AACA,SAAO;AACX;AAMO,SAAS,qBAAqB;AACjC,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,CAAE,IAAY,MAAM;AACpB,aAAO,UAAU,KAAK,KAAK,KAAK,gBAAgB,sBAAsB;AAAA,IAC1E;AACA,WAAO,KAAK;AAAA,EAChB;AACJ;AAKA,SAAS,WAAW,MAAiB,cAAsB;AACvD,QAAM,OAAO,SAAS,IAAI;AAC1B,SAAO,KAAK,IAAI,YAAY;AAChC;AAUO,SAAS,mBACZ,OACA,SACF;AACE,QAAM,iBAAiB,SAAS,mBAAmB;AACnD,QAAM,eAAe,SAAS,gBAAgB;AAE9C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAExB,QAAI,kBAAkB,WAAW,MAAM,YAAY,EAAG,QAAO,KAAK;AAElE,UAAM,QAAQ,SAAS,KAAK,WAAW;AACvC,UAAM,OAAO,SAAS,KAAK,kBAAkB;AAG7C,eAAW,KAAK,OAAO;AACnB,UAAI,KAAK,IAAI,CAAC,GAAG;AACb,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,sBAAsB,CAAC,IAAI;AAAA,UACpE,QAAQ;AAAA,QACZ,CAAC;AAAA,MACL;AAAA,IACJ;AAEA,UAAM,UAAU,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AACjD,QAAI,QAAQ,QAAQ;AAChB,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,uBAAuB;AAAA,QAChE;AAAA,QACA,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;AAMO,SAAS,qBACZ,OACA,SACF;AACE,QAAM,iBAAiB,SAAS,mBAAmB;AACnD,QAAM,eAAe,SAAS,gBAAgB;AAE9C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAExB,QAAI,kBAAkB,WAAW,MAAM,YAAY,EAAG,QAAO,KAAK;AAElE,UAAM,QAAQ,SAAS,KAAK,WAAW;AACvC,UAAM,OAAO,SAAS,KAAK,kBAAkB;AAG7C,eAAW,KAAK,OAAO;AACnB,UAAI,KAAK,IAAI,CAAC,GAAG;AACb,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,sBAAsB,CAAC,IAAI;AAAA,UACpE,QAAQ;AAAA,QACZ,CAAC;AAAA,MACL;AAAA,IACJ;AAEA,UAAM,KAAK,MAAM,KAAK,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AACzC,QAAI,CAAC,IAAI;AACL,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,qBAAqB;AAAA,QAC9D,UAAU;AAAA,QACV,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;AAQO,SAAS,aACZ,OACA,SACF;AACE,QAAM,iBAAiB,SAAS,mBAAmB;AACnD,QAAM,eAAe,SAAS,gBAAgB;AAE9C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAGxB,QAAI,kBAAkB,WAAW,MAAM,YAAY,EAAG,QAAO,KAAK;AAElE,UAAM,OAAO,SAAS,IAAI;AAC1B,QAAI,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,GAAG;AACjC,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,oBAAoB;AAAA,QAC7D,UAAU;AAAA,QACV,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;AAMO,SAAS,4BACZ,OACA,OACA,SACF;AACE,QAAM,iBAAiB,SAAS,mBAAmB;AACnD,QAAM,eAAe,SAAS,gBAAgB;AAE9C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAExB,QAAI,kBAAkB,WAAW,MAAM,YAAY,EAAG,QAAO,KAAK;AAElE,UAAM,YAAY,SAAS,IAAI;AAC/B,UAAM,QAAQ,SAAS,KAAK,WAAW;AACvC,UAAM,OAAO,SAAS,KAAK,kBAAkB;AAG7C,eAAW,KAAK,OAAO;AACnB,UAAI,KAAK,IAAI,CAAC,GAAG;AACb,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,sBAAsB,CAAC,IAAI;AAAA,UACpE,QAAQ;AAAA,QACZ,CAAC;AAAA,MACL;AAAA,IACJ;AAEA,UAAM,SAAS,MAAM,KAAK,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC;AACjD,UAAM,SAAS,MAAM,KAAK,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAE7C,QAAI,CAAC,UAAU,CAAC,QAAQ;AACpB,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,iBAAiB;AAAA,QAC1D;AAAA,QACA,aAAa;AAAA,QACb,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;;;AC7NA,OAAOA,SAAQ;AACf,OAAO,SAAuB;AAE9B,SAAS,iBAAiB,MAA8B;AACtD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,IAAIA,IAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,WAAO,EAAE,SAAS,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,eAAe,KAAyB;AACtD,QAAM,OAAO,OAAO,KAAK,SAAS,iBAAiB,EAAE;AACrD,MAAI,CAAC,KAAK,WAAW,SAAS,EAAG,QAAO;AACxC,QAAM,QAAQ,KAAK,MAAM,CAAC,EAAE,KAAK;AACjC,SAAO,MAAM,SAAS,QAAQ;AAChC;AAEO,SAAS,aAAa,GAAuB;AAClD,QAAM,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK;AAC/B,SAAO,EAAE,SAAS,IAAI;AACxB;AAOO,SAAS,qBAA6B;AAC3C,QAAM,WAAW,iBAAiB,QAAQ,IAAI,mBAAmB;AACjE,MAAI,SAAU,QAAO;AAErB,QAAM,UAAU;AAAA,IACd,QAAQ,IAAI,uBAAuB,QAAQ,IAAI,uBAAuB;AAAA,EACxE,EACG,QAAQ,QAAQ,IAAI,EACpB,KAAK;AAER,MAAI,QAAS,QAAO;AAEpB,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,sBAAsB,KAAyB;AAC7D,QAAM,YAAY,mBAAmB;AAErC,QAAM,WACJ,QAAQ,IAAI,gBACZ,QAAQ,IAAI,qBACZ;AAEF,QAAM,SACJ,QAAQ,IAAI,cACZ,QAAQ,IAAI,mBACZ;AAEF,SAAO,IAAI,OAAO,KAAK,WAAW;AAAA,IAChC,YAAY,CAAC,OAAO;AAAA,IACpB;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,mBAAmB,SAA6B;AAC9D,QAAM,SACJ,aAAa,SAAS,YAAY,KAClC,aAAa,SAAS,UAAU,GAAG;AAErC,MAAI,OAAQ,QAAO;AAEnB,QAAM,MAAM,aAAa,SAAS,GAAG;AACrC,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,QAAQ,cAAc,KAAK,GAAG;AACpC,SAAO,QAAQ,CAAC,IAAI,aAAa,MAAM,CAAC,CAAC,IAAI;AAC/C;AAEO,SAAS,mBAAmB,SAA6B;AAC9D,QAAM,SACJ,aAAa,SAAS,YAAY,KAClC,aAAa,SAAS,UAAU,GAAG;AAErC,MAAI,OAAQ,QAAO;AAEnB,QAAM,MAAM,aAAa,SAAS,GAAG;AACrC,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,QAAQ,cAAc,KAAK,GAAG;AACpC,SAAO,QAAQ,CAAC,IAAI,aAAa,MAAM,CAAC,CAAC,IAAI;AAC/C;;;ACnFO,SAAS,qBAAqB,MAA6B;AAChE,QAAM;AAAA,IACJ;AAAA,IACA,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB;AAAA,EACF,IAAI;AAEJ,SAAO,OAAO,KAAU,KAAe,SAAuB;AAC5D,UAAM,QAAQ,eAAe,GAAG;AAEhC,QAAI,CAAC,OAAO;AACV,aAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,QAC1B,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,UAAM,YAAa,IAAY,WAAW,CAAC;AAC3C,UAAM,cAAc,aAAa,UAAU,WAAW;AACtD,UAAM,aAAa,aAAa,UAAU,UAAU;AAEpD,QAAI;AACF,YAAM,UAAe,sBAAsB,KAAK;AAEhD,YAAM,UAAuB;AAAA,QAC3B,WAAW;AAAA,QACX;AAAA,QACA,aAAa,eAAe;AAAA,QAC5B,YAAY,cAAc;AAAA,QAC1B,OAAO,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAAA,QACxD,aAAa,MAAM,QAAQ,SAAS,WAAW,IAC3C,QAAQ,cACR,CAAC;AAAA,QACL,oBAAoB,MAAM,QAAQ,SAAS,kBAAkB,IACzD,QAAQ,qBACR,CAAC;AAAA,QACL,SAAS;AAAA,UACP,KAAK,SAAS;AAAA,UACd,WAAW,SAAS;AAAA,UACpB,YAAY,SAAS;AAAA,QACvB;AAAA,MACF;AAEA,UAAI,YAAY,YAAY;AAC1B,gBAAQ,eAAe,mBAAmB,OAAO,KAAK;AAAA,MACxD,OAAO;AACL,gBAAQ,eAAe,mBAAmB,OAAO,KAAK;AAAA,MACxD;AAEA,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,aAAO,OAAO,SAAS,QAAQ;AAE/B,UAAI,YAAY,cAAc,CAAC,QAAQ,cAAc;AACnD,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAEA,UAAI,YAAY,cAAc,CAAC,QAAQ,cAAc;AACnD,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAEA,UAAI,gBAAgB;AAClB,YAAI,YAAY,cAAc,CAAC,QAAQ,UAAU;AAC/C,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,YAAI,YAAY,cAAc,CAAC,QAAQ,UAAU;AAC/C,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAEA,MAAC,IAAY,OAAO;AACpB,aAAO,KAAK;AAAA,IACd,QAAQ;AACN,UAAI,CAAC,sBAAsB;AACzB,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAEA,UAAI;AACF,cAAM,EAAC,SAAS,MAAK,IAAI,MAAM,OAAO,gBAAgB;AACtD,cAAM,kBAAkB,MAAM,MAAM,KAAK,EAAE,cAAc,KAAK;AAE9D,YAAI,gBAAgB,SAAS,gBAAgB,mBAAmB,OAAO;AACrE,iBAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YAC1B,IAAI;AAAA,YACJ,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,QAAC,IAAY,OAAO;AAAA,UAClB,WAAW;AAAA,UACX;AAAA,UACA,UAAU;AAAA,UACV,aAAa,eAAe;AAAA,UAC5B,YAAY,cAAc;AAAA,UAC1B,WAAW,CAAC;AAAA,UACZ,OAAO,CAAC;AAAA,UACR,aAAa,CAAC;AAAA,UACd,oBAAoB,CAAC;AAAA,QACvB;AAEA,eAAO,KAAK;AAAA,MACd,QAAQ;AACN,eAAO,IAAI,OAAO,GAAG,EAAE,KAAK;AAAA,UAC1B,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;AC3IA,SAAS,oBAAoB,SAAc,YAA2B,WAA0B;AAC9F,QAAM,qBAAqB,MAAM,QAAQ,SAAS,SAAS,IACvD,QAAQ,YACR,CAAC;AAEL,QAAM,UACJ,SAAS,YACR,aACG,mBAAmB,KAAK,CAAC,MAAW,GAAG,QAAQ,UAAU,IACzD,SACJ;AAEF,QAAM,SACJ,SAAS,WACR,aAAa,SAAS,YAClB,QAAQ,YAAY,CAAC,GAAG,KAAK,CAAC,MAAW,GAAG,QAAQ,SAAS,IAC9D,SACJ;AAEF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,IAAM,uBAAuB,qBAAqB;AAAA,EACvD,SAAS;AAAA,EACT,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,SAAS,OAAO,EAAC,SAAS,aAAa,WAAU,MAAM;AACrD,UAAM,eACJ,mBAAmB,OAAO,KAC1B,aAAa,SAAS,UAAU,GAAG;AAErC,UAAM,EAAC,oBAAoB,SAAS,OAAM,IAAI;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,SAAS,YAAY,OAAO,QAAQ,aAAa,WAC7C,QAAQ,WACR,eACE,EAAC,KAAK,cAAc,OAAO,SAAS,SAAS,KAAI,IACjD;AAER,WAAO;AAAA,MACL,cAAc,gBAAgB;AAAA,MAC9B;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,OAAO,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAAA,MACxD,aAAa,MAAM,QAAQ,SAAS,WAAW,IAAI,QAAQ,cAAc,CAAC;AAAA,MAC1E,oBAAoB,MAAM,QAAQ,SAAS,kBAAkB,IACzD,QAAQ,qBACR,CAAC;AAAA,IACP;AAAA,EACF;AACF,CAAC;AAEM,IAAM,uBAAuB,qBAAqB;AAAA,EACvD,SAAS;AAAA,EACT,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,SAAS,OAAO,EAAC,SAAS,aAAa,WAAU,MAAM;AACrD,UAAM,eACJ,mBAAmB,OAAO,KAC1B,aAAa,SAAS,UAAU,GAAG;AAErC,UAAM,EAAC,oBAAoB,SAAS,OAAM,IAAI;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,SAAS,YAAY,OAAO,QAAQ,aAAa,WAC7C,QAAQ,WACR,eACE,EAAC,KAAK,aAAY,IAClB;AAER,WAAO;AAAA,MACL,cAAc,gBAAgB;AAAA,MAC9B;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,OAAO,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAAA,MACxD,aAAa,MAAM,QAAQ,SAAS,WAAW,IAAI,QAAQ,cAAc,CAAC;AAAA,MAC1E,oBAAoB,MAAM,QAAQ,SAAS,kBAAkB,IACzD,QAAQ,qBACR,CAAC;AAAA,IACP;AAAA,EACF;AACF,CAAC;AAEM,IAAM,4BAA4B,qBAAqB;AAAA,EAC5D,SAAS;AAAA,EACT,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,SAAS,OAAO,EAAC,SAAS,aAAa,WAAU,MAAM;AACrD,UAAM,eACJ,mBAAmB,OAAO,KAC1B,aAAa,SAAS,UAAU,GAAG;AAErC,UAAM,EAAC,oBAAoB,SAAS,OAAM,IAAI;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,SAAS,YAAY,OAAO,QAAQ,aAAa,WAC7C,QAAQ,WACR,eACE,EAAC,KAAK,cAAc,OAAO,SAAS,SAAS,KAAI,IACjD;AAER,WAAO;AAAA,MACL,cAAc,gBAAgB;AAAA,MAC9B;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,OAAO,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAAA,MACxD,aAAa,MAAM,QAAQ,SAAS,WAAW,IAAI,QAAQ,cAAc,CAAC;AAAA,MAC1E,oBAAoB,MAAM,QAAQ,SAAS,kBAAkB,IACzD,QAAQ,qBACR,CAAC;AAAA,IACP;AAAA,EACF;AACF,CAAC;AAEM,IAAM,4BAA4B,qBAAqB;AAAA,EAC5D,SAAS;AAAA,EACT,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,SAAS,OAAO,EAAC,SAAS,aAAa,WAAU,MAAM;AACrD,UAAM,eACJ,mBAAmB,OAAO,KAC1B,aAAa,SAAS,UAAU,GAAG;AAErC,UAAM,EAAC,oBAAoB,SAAS,OAAM,IAAI;AAAA,MAC5C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WACJ,SAAS,YAAY,OAAO,QAAQ,aAAa,WAC7C,QAAQ,WACR,eACE,EAAC,KAAK,aAAY,IAClB;AAER,WAAO;AAAA,MACL,cAAc,gBAAgB;AAAA,MAC9B;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA,OAAO,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAAA,MACxD,aAAa,MAAM,QAAQ,SAAS,WAAW,IAAI,QAAQ,cAAc,CAAC;AAAA,MAC1E,oBAAoB,MAAM,QAAQ,SAAS,kBAAkB,IACzD,QAAQ,qBACR,CAAC;AAAA,IACP;AAAA,EACF;AACF,CAAC;;;AChLD,SAAS,cAAc,GAA6B;AAChD,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,SAAO,EAAE,QAAQ,EAAE,QAAQ;AAC/B;AAEA,SAAS,cAAc,GAA6B;AAChD,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,SAAO,EAAE,QAAQ,EAAE,QAAQ;AAC/B;AAEA,SAASC,YAAW,OAAyC;AACzD,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,SAAO,MAAM,KAAK,CAAC,MAAM,cAAc,CAAC,MAAM,WAAW;AAC7D;AAEA,SAASC,SAAQ,KAAc;AAC3B,SAAS,IAAY,QAAQ,CAAC;AAKlC;AAEA,SAAS,eAAe,MAAkC;AACtD,QAAM,QAAQ,IAAI,KAAa,KAAK,eAAe,CAAC,GAAG,IAAI,aAAa,EAAE,OAAO,OAAO,CAAa;AACrG,QAAM,OAAO,IAAI,KAAa,KAAK,sBAAsB,CAAC,GAAG,IAAI,aAAa,EAAE,OAAO,OAAO,CAAa;AAC3G,SAAO,EAAC,OAAO,KAAI;AACvB;AAEA,SAAS,QAAQ,MAAkC;AAC/C,SAAO,IAAI,KAAa,KAAK,SAAS,CAAC,GAAG,IAAI,aAAa,EAAE,OAAO,OAAO,CAAa;AAC5F;AAOO,SAAS,gCAAgC,OAAmC;AAC/E,QAAM,YAAY,SAAS,CAAC,GAAG,OAAO,OAAO;AAE7C,SAAO;AAAA,IACH;AAAA,IACA;AAAA,IACA,CAAC,KAAc,KAAe,SAAuB;AACjD,YAAM,OAAOA,SAAQ,GAAG;AACxB,UAAID,YAAW,KAAK,KAAK,EAAG,QAAO,KAAK;AAExC,YAAM,EAAC,OAAO,KAAI,IAAI,eAAe,IAAI;AAEzC,iBAAW,KAAK,UAAU;AACtB,YAAI,KAAK,IAAI,CAAC,GAAG;AACb,iBAAO,UAAU,KAAK,KAAK,KAAK,aAAa,sBAAsB,CAAC,IAAI,EAAC,QAAQ,EAAC,CAAC;AAAA,QACvF;AAAA,MACJ;AAEA,YAAM,KAAK,SAAS,KAAK,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAC5C,UAAI,CAAC,IAAI;AACL,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,6BAA6B,EAAC,SAAQ,CAAC;AAAA,MACxF;AAEA,aAAO,KAAK;AAAA,IAChB;AAAA,EACJ;AACJ;AAKO,SAAS,iCAAiC,OAAmC;AAChF,QAAM,YAAY,SAAS,CAAC,GAAG,OAAO,OAAO;AAE7C,SAAO;AAAA,IACH;AAAA,IACA;AAAA,IACA,CAAC,KAAc,KAAe,SAAuB;AACjD,YAAM,OAAOC,SAAQ,GAAG;AACxB,UAAID,YAAW,KAAK,KAAK,EAAG,QAAO,KAAK;AAExC,YAAM,EAAC,OAAO,KAAI,IAAI,eAAe,IAAI;AAEzC,iBAAW,KAAK,UAAU;AACtB,YAAI,KAAK,IAAI,CAAC,GAAG;AACb,iBAAO,UAAU,KAAK,KAAK,KAAK,aAAa,sBAAsB,CAAC,IAAI,EAAC,QAAQ,EAAC,CAAC;AAAA,QACvF;AAAA,MACJ;AAEA,YAAM,UAAU,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AACpD,UAAI,QAAQ,QAAQ;AAChB,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,6BAA6B,EAAC,UAAU,QAAO,CAAC;AAAA,MACjG;AAEA,aAAO,KAAK;AAAA,IAChB;AAAA,EACJ;AACJ;AAKO,SAAS,wBAAwB,OAAmC;AACvE,QAAM,YAAY,SAAS,CAAC,GAAG,OAAO,OAAO;AAE7C,SAAO;AAAA,IACH;AAAA,IACA;AAAA,IACA,CAAC,KAAc,KAAe,SAAuB;AACjD,YAAM,OAAOC,SAAQ,GAAG;AACxB,UAAID,YAAW,KAAK,KAAK,EAAG,QAAO,KAAK;AAExC,YAAM,OAAO,QAAQ,IAAI;AAEzB,YAAM,KAAK,SAAS,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC3C,UAAI,CAAC,IAAI;AACL,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,oBAAoB,EAAC,SAAQ,CAAC;AAAA,MAC/E;AAEA,aAAO,KAAK;AAAA,IAChB;AAAA,EACJ;AACJ;AAMO,SAAS,oCACZ,OACA,aACgB;AAChB,QAAM,iBAAiB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK,GAAG,OAAO,OAAO;AAC7E,QAAM,iBAAiB,MAAM,QAAQ,WAAW,IAAI,cAAc,CAAC,WAAW,GAAG,OAAO,OAAO;AAE/F,SAAO;AAAA,IACH;AAAA,IACA;AAAA,IACA,CAAC,KAAc,KAAe,SAAuB;AACjD,YAAM,OAAOC,SAAQ,GAAG;AACxB,UAAID,YAAW,KAAK,KAAK,EAAG,QAAO,KAAK;AAExC,YAAM,EAAC,OAAO,KAAI,IAAI,eAAe,IAAI;AACzC,iBAAW,KAAK,eAAe;AAC3B,YAAI,KAAK,IAAI,CAAC,GAAG;AACb,iBAAO,UAAU,KAAK,KAAK,KAAK,aAAa,WAAW,CAAC,IAAI,EAAC,YAAY,EAAC,CAAC;AAAA,QAChF;AAAA,MACJ;AAEA,YAAM,YAAY,QAAQ,IAAI;AAC9B,UAAI,cAAc,KAAK,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC,EAAG,QAAO,KAAK;AAE7D,UAAI,cAAc,KAAK,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC,EAAG,QAAO,KAAK;AAEzD,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,qBAAqB;AAAA,QAC9D,OAAO;AAAA,QACP,aAAa;AAAA,QACb,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAAA,EACJ;AACJ;AAMO,SAAS,qBAAqB,YAAsC;AACvE,SAAO,oCAAoC,CAAC,YAAY,GAAG,CAAC,UAAU,CAAC;AAC3E;","names":["fs","isSysAdmin","getAuth"]}