@jazzmind/busibox-app 3.0.18

package/dist/lib/authz/auth-state-manager.js

@@ -0,0 +1,594 @@
+/**
+ * Auth State Manager for client-side apps.
+ *
+ * Provides centralized authentication state management including:
+ * - Proactive token refresh before expiration
+ * - Auth state change detection and broadcasting
+ * - Automatic redirect to portal when re-authentication is required
+ * - Event-based architecture for loose coupling
+ *
+ * This acts as a "service worker-like" auth listener that monitors
+ * authentication state and prevents users from discovering expired
+ * tokens only after submitting a request.
+ *
+ * Usage:
+ * ```typescript
+ * const authManager = createAuthStateManager({
+ *   refreshEndpoint: '/api/auth/session',
+ *   sessionEndpoint: '/api/auth/session',
+ *   portalUrl: 'https://portal.example.com',
+ *   appId: 'busibox-agents',
+ * });
+ *
+ * // Start monitoring
+ * authManager.start();
+ *
+ * // Subscribe to auth state changes
+ * authManager.on('authStateChanged', (state) => {
+ *   console.log('Auth state:', state.isAuthenticated);
+ * });
+ *
+ * // Subscribe to re-auth requirements
+ * authManager.on('requiresReauth', () => {
+ *   // Will auto-redirect if autoRedirect is true
+ * });
+ * ```
+ */
+import { parseJWTPayload } from './auth-helper';
+function getTokenExpiry(token) {
+    const payload = parseJWTPayload(token);
+    if (!payload || typeof payload.exp !== 'number')
+        return null;
+    return payload.exp * 1000; // Convert to ms
+}
+/**
+ * Create an auth state manager instance.
+ */
+export function createAuthStateManager(config) {
+    const { refreshEndpoint, sessionEndpoint, portalUrl, appId, checkIntervalMs = 30000, refreshBufferMs = 5 * 60 * 1000, // 5 minutes
+    autoRedirect = true, getToken, setToken, basePath = '', exchangeEndpoint = '/api/auth/session', tokenExpiresOverrideMs, } = config;
+    // Derive the silent refresh URL from portalUrl if not explicitly provided.
+    // portalUrl typically ends with '/home' (e.g., 'https://localhost/portal/home'),
+    // so strip that to get the portal base, then append the refresh API path.
+    const portalBase = portalUrl.replace(/\/home\/?$/, '');
+    const silentRefreshUrl = config.silentRefreshUrl || (portalBase ? `${portalBase}/api/auth/sso/refresh` : '');
+    // Track when the token was first observed (for tokenExpiresOverrideMs)
+    let tokenFirstSeen = null;
+    // State
+    let state = {
+        isAuthenticated: false,
+        user: null,
+        tokenExpiresAt: null,
+        lastChecked: 0,
+    };
+    let intervalId = null;
+    let isRefreshing = false;
+    let pendingRefresh = null;
+    let isRedirecting = false; // Once set, all further auth activity is suppressed
+    let consecutive401AfterRefresh = 0; // Track when refresh "succeeds" but APIs still fail
+    const MAX_401_AFTER_REFRESH = 2; // After this many, redirect to portal
+    // Event listeners
+    const listeners = new Map();
+    function emit(event, data) {
+        const eventListeners = listeners.get(event);
+        if (eventListeners) {
+            eventListeners.forEach((callback) => {
+                try {
+                    callback(data);
+                }
+                catch (error) {
+                    console.error(`[AuthStateManager] Error in ${event} listener:`, error);
+                }
+            });
+        }
+    }
+    function on(event, callback) {
+        if (!listeners.has(event)) {
+            listeners.set(event, new Set());
+        }
+        listeners.get(event).add(callback);
+        return () => off(event, callback);
+    }
+    function off(event, callback) {
+        const eventListeners = listeners.get(event);
+        if (eventListeners) {
+            eventListeners.delete(callback);
+        }
+    }
+    function redirectToPortal(reason) {
+        if (typeof window === 'undefined')
+            return;
+        if (isRedirecting)
+            return; // Prevent duplicate redirects
+        isRedirecting = true;
+        // Stop all monitoring immediately so no more checks/retries fire
+        stop();
+        const currentUrl = new URL(window.location.href);
+        currentUrl.searchParams.delete('token');
+        currentUrl.searchParams.delete('returnUrl');
+        currentUrl.searchParams.delete('reason');
+        currentUrl.searchParams.delete('appId');
+        const cleanReturnUrl = currentUrl.toString();
+        const encodedReturn = encodeURIComponent(cleanReturnUrl);
+        let redirectUrl = `${portalUrl}?returnUrl=${encodedReturn}`;
+        if (reason) {
+            redirectUrl += `&reason=${encodeURIComponent(reason)}`;
+        }
+        if (appId) {
+            redirectUrl += `&appId=${encodeURIComponent(appId)}`;
+        }
+        console.log('[AuthStateManager] Redirecting to portal:', redirectUrl);
+        window.location.href = redirectUrl;
+    }
+    async function checkSession() {
+        if (isRedirecting)
+            return;
+        try {
+            const response = await fetch(sessionEndpoint, {
+                method: 'GET',
+                credentials: 'include',
+            });
+            if (!response.ok) {
+                throw new Error(`Session check failed: ${response.status}`);
+            }
+            const data = await response.json();
+            // Support both flat format { isAuthenticated, user } and
+            // apiSuccess wrapper format { success, data: { user } }
+            const userData = data.data?.user ?? data.user ?? null;
+            const isAuthenticated = data.isAuthenticated ?? (data.success && !!userData) ?? false;
+            const newState = {
+                isAuthenticated,
+                user: userData,
+                tokenExpiresAt: state.tokenExpiresAt,
+                lastChecked: Date.now(),
+            };
+            // Check if token expiry from client-side token
+            if (getToken) {
+                const token = getToken();
+                if (token) {
+                    const expiry = getTokenExpiry(token);
+                    if (expiry) {
+                        // Apply testing override if configured
+                        if (tokenExpiresOverrideMs) {
+                            if (!tokenFirstSeen) {
+                                tokenFirstSeen = Date.now();
+                                console.log(`[AuthStateManager] Testing: token override active, will expire in ${tokenExpiresOverrideMs}ms`);
+                            }
+                            newState.tokenExpiresAt = tokenFirstSeen + tokenExpiresOverrideMs;
+                        }
+                        else {
+                            newState.tokenExpiresAt = expiry;
+                        }
+                    }
+                }
+            }
+            const stateChanged = state.isAuthenticated !== newState.isAuthenticated ||
+                state.user?.id !== newState.user?.id;
+            state = newState;
+            // Session check succeeded - reset 401 counter since things are working
+            if (state.isAuthenticated) {
+                consecutive401AfterRefresh = 0;
+            }
+            if (stateChanged) {
+                emit('authStateChanged', state);
+            }
+            // If not authenticated, try silent SSO refresh before redirecting
+            if (!state.isAuthenticated) {
+                console.log('[AuthStateManager] Session check shows not authenticated, attempting silent SSO refresh...');
+                const silentRefreshed = await silentRefreshSSO();
+                if (silentRefreshed) {
+                    console.log('[AuthStateManager] Silent SSO refresh succeeded after session loss, rechecking...');
+                    // Re-check session after silent refresh
+                    const recheckResponse = await fetch(sessionEndpoint, {
+                        method: 'GET',
+                        credentials: 'include',
+                    });
+                    if (recheckResponse.ok) {
+                        const recheckData = await recheckResponse.json();
+                        const recheckUser = recheckData.data?.user ?? recheckData.user ?? null;
+                        const recheckAuth = recheckData.isAuthenticated ?? (recheckData.success && !!recheckUser) ?? false;
+                        if (recheckAuth) {
+                            state = {
+                                isAuthenticated: true,
+                                user: recheckUser,
+                                tokenExpiresAt: state.tokenExpiresAt,
+                                lastChecked: Date.now(),
+                            };
+                            emit('authStateChanged', state);
+                            console.log('[AuthStateManager] Session restored after silent refresh');
+                            return;
+                        }
+                    }
+                }
+                // Silent refresh failed or didn't help - redirect
+                if (autoRedirect) {
+                    emit('sessionExpired', { reason: 'Session not authenticated' });
+                    redirectToPortal('session_expired');
+                }
+            }
+        }
+        catch (error) {
+            console.error('[AuthStateManager] Session check failed:', error);
+            // Don't immediately redirect on network errors
+        }
+    }
+    /**
+     * Try to silently refresh the SSO token via the portal.
+     *
+     * This calls the portal's /api/auth/sso/refresh endpoint. Since the portal and
+     * sub-apps are on the same origin, the browser automatically sends the
+     * portal's session cookie. If the portal session is still valid, it returns
+     * a fresh SSO token which we exchange locally for new cookies.
+     *
+     * Returns true if a fresh SSO token was obtained and exchanged.
+     */
+    async function silentRefreshSSO() {
+        if (!silentRefreshUrl || !appId) {
+            console.log('[AuthStateManager] Silent refresh not available (no silentRefreshUrl or appId)');
+            return false;
+        }
+        try {
+            console.log('[AuthStateManager] Attempting silent SSO refresh via portal...');
+            // Call the portal's refresh endpoint - browser sends portal cookies automatically
+            const response = await fetch(silentRefreshUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ appId: appId }),
+                credentials: 'include',
+            });
+            if (!response.ok) {
+                const errorData = await response.json().catch(() => ({}));
+                console.log('[AuthStateManager] Silent refresh failed:', response.status, errorData);
+                return false;
+            }
+            const data = await response.json();
+            const freshToken = data?.data?.token || data?.token;
+            if (!freshToken) {
+                console.log('[AuthStateManager] Silent refresh returned no token');
+                return false;
+            }
+            console.log('[AuthStateManager] Got fresh SSO token from portal, exchanging locally...');
+            // Exchange the fresh SSO token for local session cookies
+            const exchangeResponse = await fetch(exchangeEndpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token: freshToken }),
+                credentials: 'include',
+            });
+            if (!exchangeResponse.ok) {
+                console.log('[AuthStateManager] Local token exchange failed:', exchangeResponse.status);
+                return false;
+            }
+            // Update local token storage
+            if (setToken) {
+                setToken(freshToken);
+            }
+            // Update expiry from the fresh token
+            const expiry = getTokenExpiry(freshToken);
+            if (expiry) {
+                state = {
+                    ...state,
+                    tokenExpiresAt: expiry,
+                };
+            }
+            // Reset the testing override timer so the new token gets a fresh window
+            if (tokenExpiresOverrideMs) {
+                tokenFirstSeen = Date.now();
+                console.log(`[AuthStateManager] Testing: reset token expiry override, next expire in ${tokenExpiresOverrideMs}ms`);
+            }
+            console.log('[AuthStateManager] Silent SSO refresh successful');
+            return true;
+        }
+        catch (error) {
+            console.error('[AuthStateManager] Silent SSO refresh error:', error);
+            return false;
+        }
+    }
+    async function refreshToken() {
+        if (isRedirecting)
+            return false;
+        // Prevent concurrent refresh attempts
+        if (isRefreshing && pendingRefresh) {
+            return pendingRefresh;
+        }
+        isRefreshing = true;
+        pendingRefresh = (async () => {
+            try {
+                const currentToken = getToken?.() ?? '';
+                const response = await fetch(refreshEndpoint, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        ...(currentToken ? { Authorization: `Bearer ${currentToken}` } : {}),
+                    },
+                    credentials: 'include',
+                });
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                let data;
+                try {
+                    data = await response.json();
+                }
+                catch {
+                    console.error(`[AuthStateManager] Refresh endpoint returned non-JSON response (status ${response.status})`);
+                    emit('tokenRefreshFailed', { error: new Error(`Non-JSON response: ${response.status}`) });
+                    return false;
+                }
+                if (!response.ok) {
+                    // Check if re-authentication is required (SSO token expired)
+                    if (data.requiresReauth || data.requireLogout) {
+                        console.log('[AuthStateManager] Local refresh says re-auth needed, trying silent SSO refresh...');
+                        // Try silent refresh via portal before giving up
+                        const silentRefreshed = await silentRefreshSSO();
+                        if (silentRefreshed) {
+                            // SSO token was refreshed - now retry the local refresh
+                            console.log('[AuthStateManager] Silent refresh succeeded, retrying local refresh...');
+                            const retryResponse = await fetch(refreshEndpoint, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                credentials: 'include',
+                            });
+                            const retryData = await retryResponse.json();
+                            if (retryResponse.ok) {
+                                // Update token if we have a setter
+                                if (retryData.token && setToken) {
+                                    setToken(retryData.token);
+                                }
+                                const expiresIn = retryData.expiresIn ?? 900;
+                                state = {
+                                    ...state,
+                                    tokenExpiresAt: Date.now() + expiresIn * 1000,
+                                };
+                                emit('tokenRefreshed', { expiresIn });
+                                console.log('[AuthStateManager] Token refreshed successfully after silent SSO refresh');
+                                return true;
+                            }
+                            console.log('[AuthStateManager] Retry after silent refresh still failed:', retryData);
+                        }
+                        // Silent refresh failed too - redirect to portal
+                        emit('requiresReauth', { reason: data.message || 'Token refresh failed' });
+                        if (autoRedirect) {
+                            redirectToPortal('token_expired');
+                        }
+                        return false;
+                    }
+                    emit('tokenRefreshFailed', { error: data.error || 'Unknown error' });
+                    return false;
+                }
+                // Update token if we have a setter
+                if (data.token && setToken) {
+                    setToken(data.token);
+                }
+                // Update expiry
+                const expiresIn = data.expiresIn ?? 900; // Default 15 minutes
+                state = {
+                    ...state,
+                    tokenExpiresAt: Date.now() + expiresIn * 1000,
+                };
+                // Reset the testing override timer so the refreshed token gets a fresh window
+                if (tokenExpiresOverrideMs) {
+                    tokenFirstSeen = Date.now();
+                    console.log(`[AuthStateManager] Testing: reset token expiry override after refresh, next expire in ${tokenExpiresOverrideMs}ms`);
+                }
+                emit('tokenRefreshed', { expiresIn });
+                console.log('[AuthStateManager] Token refreshed successfully');
+                return true;
+            }
+            catch (error) {
+                console.error('[AuthStateManager] Token refresh failed:', error);
+                emit('tokenRefreshFailed', { error });
+                return false;
+            }
+            finally {
+                isRefreshing = false;
+                pendingRefresh = null;
+            }
+        })();
+        return pendingRefresh;
+    }
+    async function checkAndRefresh() {
+        if (isRedirecting)
+            return;
+        // First, check if we need to refresh the token proactively
+        if (state.tokenExpiresAt) {
+            const timeUntilExpiry = state.tokenExpiresAt - Date.now();
+            if (timeUntilExpiry <= 0) {
+                // Token already expired
+                console.log('[AuthStateManager] Token expired, attempting refresh');
+                const refreshed = await refreshToken();
+                if (!refreshed) {
+                    // Refresh failed - still check session so the auth state can transition
+                    await checkSession();
+                    return;
+                }
+            }
+            else if (timeUntilExpiry <= refreshBufferMs) {
+                // Token expiring soon, refresh proactively
+                console.log('[AuthStateManager] Token expiring soon, refreshing proactively');
+                await refreshToken();
+            }
+        }
+        // Then check session state
+        await checkSession();
+    }
+    async function handle401Response() {
+        if (isRedirecting)
+            return false;
+        console.log('[AuthStateManager] Handling 401 response');
+        // If refresh keeps "succeeding" but APIs still return 401,
+        // the underlying SSO token is expired and refresh can't fix it.
+        consecutive401AfterRefresh++;
+        if (consecutive401AfterRefresh > MAX_401_AFTER_REFRESH) {
+            console.log('[AuthStateManager] Multiple 401s after refresh - trying silent SSO refresh before redirect');
+            // Last resort: try silent SSO refresh before giving up
+            const silentRefreshed = await silentRefreshSSO();
+            if (silentRefreshed) {
+                console.log('[AuthStateManager] Silent SSO refresh succeeded, resetting 401 counter');
+                consecutive401AfterRefresh = 0;
+                // Now try the local refresh with the new SSO token
+                return refreshToken();
+            }
+            emit('requiresReauth', { reason: 'SSO token expired - refresh cannot fix' });
+            if (autoRedirect) {
+                redirectToPortal('token_expired');
+            }
+            return false;
+        }
+        // Try to refresh the token (refreshToken now includes silent SSO refresh fallback)
+        const refreshed = await refreshToken();
+        if (!refreshed) {
+            // refreshToken() already handles redirect after trying silent refresh
+        }
+        return refreshed;
+    }
+    function start() {
+        if (intervalId) {
+            console.warn('[AuthStateManager] Already started');
+            return;
+        }
+        console.log('[AuthStateManager] Starting auth state monitoring');
+        // Initial check
+        checkAndRefresh();
+        // Set up interval
+        intervalId = setInterval(checkAndRefresh, checkIntervalMs);
+    }
+    function stop() {
+        if (intervalId) {
+            clearInterval(intervalId);
+            intervalId = null;
+            console.log('[AuthStateManager] Stopped auth state monitoring');
+        }
+    }
+    function getState() {
+        return { ...state };
+    }
+    async function checkNow() {
+        await checkAndRefresh();
+    }
+    async function refreshNow() {
+        return refreshToken();
+    }
+    function isAuthenticated() {
+        return state.isAuthenticated;
+    }
+    async function logout() {
+        console.log('[AuthStateManager] Performing system-wide logout');
+        // Stop monitoring
+        stop();
+        // Clear local token
+        if (setToken) {
+            setToken(null);
+        }
+        // Clear localStorage
+        if (typeof window !== 'undefined') {
+            try {
+                localStorage.removeItem('auth_token');
+                // Clear any other auth-related items
+                const keysToRemove = Object.keys(localStorage).filter(key => key.includes('auth') || key.includes('token') || key.includes('session'));
+                keysToRemove.forEach(key => localStorage.removeItem(key));
+            }
+            catch {
+                // Ignore localStorage errors
+            }
+            // Clear sessionStorage auth items
+            try {
+                const sessionKeysToRemove = Object.keys(sessionStorage).filter(key => key.includes('auth') || key.includes('token') || key.includes('busibox'));
+                sessionKeysToRemove.forEach(key => sessionStorage.removeItem(key));
+            }
+            catch {
+                // Ignore sessionStorage errors
+            }
+        }
+        // Call the local app's logout endpoint to clear cookies
+        try {
+            await fetch('/api/logout', {
+                method: 'POST',
+                credentials: 'include',
+            });
+        }
+        catch (error) {
+            console.warn('[AuthStateManager] Local logout failed:', error);
+        }
+        // Call the portal's logout endpoint to invalidate the session system-wide
+        try {
+            await fetch(`${portalBase}/api/auth/logout`, {
+                method: 'POST',
+                credentials: 'include',
+            });
+        }
+        catch (error) {
+            console.warn('[AuthStateManager] Portal logout failed:', error);
+            // This might fail due to CORS, which is okay - we'll redirect anyway
+        }
+        // Update state
+        state = {
+            isAuthenticated: false,
+            user: null,
+            tokenExpiresAt: null,
+            lastChecked: Date.now(),
+        };
+        emit('authStateChanged', state);
+        // Redirect to portal login page (use portalBase - portalUrl may include /home)
+        if (typeof window !== 'undefined') {
+            window.location.href = `${portalBase}/login`;
+        }
+    }
+    return {
+        start,
+        stop,
+        getState,
+        checkNow,
+        refreshNow,
+        on,
+        off,
+        redirectToPortal,
+        handle401Response,
+        isAuthenticated,
+        logout,
+    };
+}
+// Singleton instance for global access
+let globalAuthManager = null;
+// Flag to indicate auth is initializing (token exchange in progress)
+// When true, FetchWrapper should NOT trigger redirects on 401
+let authInitializing = false;
+/**
+ * Get or create the global auth state manager.
+ * Use this when you need app-wide auth state monitoring.
+ */
+export function getGlobalAuthManager(config) {
+    if (!globalAuthManager && config) {
+        globalAuthManager = createAuthStateManager(config);
+    }
+    return globalAuthManager;
+}
+/**
+ * Set the global auth state manager.
+ */
+export function setGlobalAuthManager(manager) {
+    globalAuthManager = manager;
+}
+/**
+ * Clear the global auth state manager.
+ */
+export function clearGlobalAuthManager() {
+    if (globalAuthManager) {
+        globalAuthManager.stop();
+        globalAuthManager = null;
+    }
+}
+/**
+ * Check if auth is currently initializing (token exchange in progress).
+ * When true, 401 responses should NOT trigger redirects - just return them as-is.
+ */
+export function isAuthInitializing() {
+    return authInitializing;
+}
+/**
+ * Set the auth initializing flag.
+ * Call with `true` before token exchange, `false` after.
+ */
+export function setAuthInitializing(initializing) {
+    authInitializing = initializing;
+    console.log('[AuthStateManager] Auth initializing:', initializing);
+}
+//# sourceMappingURL=auth-state-manager.js.map

package/dist/lib/authz/auth-state-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state-manager.js","sourceRoot":"","sources":["../../../src/lib/authz/auth-state-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AA8KhD,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,gBAAgB;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IACnE,MAAM,EACJ,eAAe,EACf,eAAe,EACf,SAAS,EACT,KAAK,EACL,eAAe,GAAG,KAAM,EACxB,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,YAAY;IAC7C,YAAY,GAAG,IAAI,EACnB,QAAQ,EACR,QAAQ,EACR,QAAQ,GAAG,EAAE,EACb,gBAAgB,GAAG,mBAAmB,EACtC,sBAAsB,GACvB,GAAG,MAAM,CAAC;IAEX,2EAA2E;IAC3E,iFAAiF;IACjF,0EAA0E;IAC1E,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE7G,uEAAuE;IACvE,IAAI,cAAc,GAAkB,IAAI,CAAC;IAEzC,QAAQ;IACR,IAAI,KAAK,GAAc;QACrB,eAAe,EAAE,KAAK;QACtB,IAAI,EAAE,IAAI;QACV,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,CAAC;KACf,CAAC;IAEF,IAAI,UAAU,GAA0C,IAAI,CAAC;IAC7D,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,cAAc,GAA4B,IAAI,CAAC;IACnD,IAAI,aAAa,GAAG,KAAK,CAAC,CAAC,oDAAoD;IAC/E,IAAI,0BAA0B,GAAG,CAAC,CAAC,CAAC,oDAAoD;IACxF,MAAM,qBAAqB,GAAG,CAAC,CAAC,CAAC,sCAAsC;IAEvE,kBAAkB;IAClB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyC,CAAC;IAEnE,SAAS,IAAI,CAAI,KAAoB,EAAE,IAAQ;QAC7C,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;gBAClC,IAAI,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,KAAK,YAAY,EAAE,KAAK,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS,EAAE,CAAc,KAAoB,EAAE,QAA8B;QAC3E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,QAA6B,CAAC,CAAC;QACzD,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,QAA6B,CAAC,CAAC;IACzD,CAAC;IAED,SAAS,GAAG,CAAC,KAAoB,EAAE,QAA2B;QAC5D,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,cAAc,EAAE,CAAC;YACnB,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,SAAS,gBAAgB,CAAC,MAAe;QACvC,IAAI,OAAO,MAAM,KAAK,WAAW;YAAE,OAAO;QAC1C,IAAI,aAAa;YAAE,OAAO,CAAC,8BAA8B;QACzD,aAAa,GAAG,IAAI,CAAC;QAErB,iEAAiE;QACjE,IAAI,EAAE,CAAC;QAEP,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAEzD,IAAI,WAAW,GAAG,GAAG,SAAS,cAAc,aAAa,EAAE,CAAC;QAC5D,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,IAAI,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,IAAI,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,2CAA2C,EAAE,WAAW,CAAC,CAAC;QACtE,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,aAAa;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;gBAC5C,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,yDAAyD;YACzD,wDAAwD;YACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YACtD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;YACtF,MAAM,QAAQ,GAAc;gBAC1B,eAAe;gBACf,IAAI,EAAE,QAAQ;gBACd,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC;YAEF,+CAA+C;YAC/C,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBACrC,IAAI,MAAM,EAAE,CAAC;wBACX,uCAAuC;wBACvC,IAAI,sBAAsB,EAAE,CAAC;4BAC3B,IAAI,CAAC,cAAc,EAAE,CAAC;gCACpB,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gCAC5B,OAAO,CAAC,GAAG,CAAC,qEAAqE,sBAAsB,IAAI,CAAC,CAAC;4BAC/G,CAAC;4BACD,QAAQ,CAAC,cAAc,GAAG,cAAc,GAAG,sBAAsB,CAAC;wBACpE,CAAC;6BAAM,CAAC;4BACN,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC;wBACnC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAChB,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;gBAClD,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAEvC,KAAK,GAAG,QAAQ,CAAC;YAEjB,uEAAuE;YACvE,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC1B,0BAA0B,GAAG,CAAC,CAAC;YACjC,CAAC;YAED,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YAED,kEAAkE;YAClE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;gBAC1G,MAAM,eAAe,GAAG,MAAM,gBAAgB,EAAE,CAAC;gBAEjD,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;oBACjG,wCAAwC;oBACxC,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;wBACnD,MAAM,EAAE,KAAK;wBACb,WAAW,EAAE,SAAS;qBACvB,CAAC,CAAC;oBACH,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC;wBACvB,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC;wBACjD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC;wBACvE,MAAM,WAAW,GAAG,WAAW,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;wBACnG,IAAI,WAAW,EAAE,CAAC;4BAChB,KAAK,GAAG;gCACN,eAAe,EAAE,IAAI;gCACrB,IAAI,EAAE,WAAW;gCACjB,cAAc,EAAE,KAAK,CAAC,cAAc;gCACpC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;6BACxB,CAAC;4BACF,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;4BAChC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;4BACxE,OAAO;wBACT,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,kDAAkD;gBAClD,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;oBAChE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;YACjE,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,gBAAgB;QAC7B,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;YAC9F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;YAE9E,kFAAkF;YAClF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBACtC,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,GAAG,CAAC,2CAA2C,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACrF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,CAAC;YAEpD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;gBACnE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;YAEzF,yDAAyD;YACzD,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;gBACrD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;gBAC3C,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;YAEH,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,iDAAiD,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACxF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6BAA6B;YAC7B,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvB,CAAC;YAED,qCAAqC;YACrC,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,GAAG;oBACN,GAAG,KAAK;oBACR,cAAc,EAAE,MAAM;iBACvB,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,2EAA2E,sBAAsB,IAAI,CAAC,CAAC;YACrH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,aAAa;YAAE,OAAO,KAAK,CAAC;QAChC,sCAAsC;QACtC,IAAI,YAAY,IAAI,cAAc,EAAE,CAAC;YACnC,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,YAAY,GAAG,IAAI,CAAC;QACpB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;gBAExC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;oBAC5C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrE;oBACD,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;gBAEH,8DAA8D;gBAC9D,IAAI,IAAS,CAAC;gBACd,IAAI,CAAC;oBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,KAAK,CAAC,0EAA0E,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;oBAC5G,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC1F,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,6DAA6D;oBAC7D,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBAC9C,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;wBAElG,iDAAiD;wBACjD,MAAM,eAAe,GAAG,MAAM,gBAAgB,EAAE,CAAC;wBAEjD,IAAI,eAAe,EAAE,CAAC;4BACpB,wDAAwD;4BACxD,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;4BACtF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;gCACjD,MAAM,EAAE,MAAM;gCACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gCAC/C,WAAW,EAAE,SAAS;6BACvB,CAAC,CAAC;4BAEH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;4BAE7C,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;gCACrB,mCAAmC;gCACnC,IAAI,SAAS,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;oCAChC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gCAC5B,CAAC;gCACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC;gCAC7C,KAAK,GAAG;oCACN,GAAG,KAAK;oCACR,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;iCAC9C,CAAC;gCACF,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;gCACtC,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;gCACxF,OAAO,IAAI,CAAC;4BACd,CAAC;4BAED,OAAO,CAAC,GAAG,CAAC,6DAA6D,EAAE,SAAS,CAAC,CAAC;wBACxF,CAAC;wBAED,iDAAiD;wBACjD,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,sBAAsB,EAAE,CAAC,CAAC;wBAE3E,IAAI,YAAY,EAAE,CAAC;4BACjB,gBAAgB,CAAC,eAAe,CAAC,CAAC;wBACpC,CAAC;wBAED,OAAO,KAAK,CAAC;oBACf,CAAC;oBAED,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC,CAAC;oBACrE,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,mCAAmC;gBACnC,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;gBAED,gBAAgB;gBAChB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,qBAAqB;gBAC9D,KAAK,GAAG;oBACN,GAAG,KAAK;oBACR,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI;iBAC9C,CAAC;gBAEF,8EAA8E;gBAC9E,IAAI,sBAAsB,EAAE,CAAC;oBAC3B,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC5B,OAAO,CAAC,GAAG,CAAC,yFAAyF,sBAAsB,IAAI,CAAC,CAAC;gBACnI,CAAC;gBAED,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;gBACjE,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACtC,OAAO,KAAK,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,YAAY,GAAG,KAAK,CAAC;gBACrB,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,IAAI,aAAa;YAAE,OAAO;QAC1B,2DAA2D;QAC3D,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,eAAe,GAAG,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE1D,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;gBACzB,wBAAwB;gBACxB,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;gBACpE,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,wEAAwE;oBACxE,MAAM,YAAY,EAAE,CAAC;oBACrB,OAAO;gBACT,CAAC;YACH,CAAC;iBAAM,IAAI,eAAe,IAAI,eAAe,EAAE,CAAC;gBAC9C,2CAA2C;gBAC3C,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;gBAC9E,MAAM,YAAY,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,UAAU,iBAAiB;QAC9B,IAAI,aAAa;YAAE,OAAO,KAAK,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAExD,2DAA2D;QAC3D,gEAAgE;QAChE,0BAA0B,EAAE,CAAC;QAC7B,IAAI,0BAA0B,GAAG,qBAAqB,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;YAE1G,uDAAuD;YACvD,MAAM,eAAe,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACjD,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;gBACtF,0BAA0B,GAAG,CAAC,CAAC;gBAC/B,mDAAmD;gBACnD,OAAO,YAAY,EAAE,CAAC;YACxB,CAAC;YAED,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC7E,IAAI,YAAY,EAAE,CAAC;gBACjB,gBAAgB,CAAC,eAAe,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mFAAmF;QACnF,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;QAEvC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,sEAAsE;QACxE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,SAAS,KAAK;QACZ,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QAEjE,gBAAgB;QAChB,eAAe,EAAE,CAAC;QAElB,kBAAkB;QAClB,UAAU,GAAG,WAAW,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC7D,CAAC;IAED,SAAS,IAAI;QACX,IAAI,UAAU,EAAE,CAAC;YACf,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1B,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,SAAS,QAAQ;QACf,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,UAAU,QAAQ;QACrB,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,UAAU,UAAU;QACvB,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IAED,SAAS,eAAe;QACtB,OAAO,KAAK,CAAC,eAAe,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAEhE,kBAAkB;QAClB,IAAI,EAAE,CAAC;QAEP,oBAAoB;QACpB,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBACtC,qCAAqC;gBACrC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CACzE,CAAC;gBACF,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;YAED,kCAAkC;YAClC,IAAI,CAAC;gBACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CACzE,CAAC;gBACF,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,aAAa,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,UAAU,kBAAkB,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;YAChE,qEAAqE;QACvE,CAAC;QAED,eAAe;QACf,KAAK,GAAG;YACN,eAAe,EAAE,KAAK;YACtB,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,IAAI;YACpB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC;QAEF,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAEhC,+EAA+E;QAC/E,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,UAAU,QAAQ,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,QAAQ;QACR,UAAU;QACV,EAAE;QACF,GAAG;QACH,gBAAgB;QAChB,iBAAiB;QACjB,eAAe;QACf,MAAM;KACP,CAAC;AACJ,CAAC;AAED,uCAAuC;AACvC,IAAI,iBAAiB,GAA4B,IAAI,CAAC;AAEtD,qEAAqE;AACrE,8DAA8D;AAC9D,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAClE,IAAI,CAAC,iBAAiB,IAAI,MAAM,EAAE,CAAC;QACjC,iBAAiB,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAyB;IAC5D,iBAAiB,GAAG,OAAO,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,iBAAiB,EAAE,CAAC;QACtB,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACzB,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAqB;IACvD,gBAAgB,GAAG,YAAY,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,uCAAuC,EAAE,YAAY,CAAC,CAAC;AACrE,CAAC"}

package/dist/lib/authz/authz-url.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared authz service URL resolution.
+ *
+ * Extracted into its own module to avoid circular dependencies between
+ * next-client.ts (which re-exports delegation.ts) and delegation.ts.
+ */
+/**
+ * Get the authz service base URL.
+ * Uses AUTHZ_BASE_URL env var or defaults to Docker service name.
+ */
+export declare function getAuthzBaseUrl(): string;
+//# sourceMappingURL=authz-url.d.ts.map

package/dist/lib/authz/authz-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-url.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/authz-url.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC"}

package/dist/lib/authz/authz-url.js

@@ -0,0 +1,14 @@
+/**
+ * Shared authz service URL resolution.
+ *
+ * Extracted into its own module to avoid circular dependencies between
+ * next-client.ts (which re-exports delegation.ts) and delegation.ts.
+ */
+/**
+ * Get the authz service base URL.
+ * Uses AUTHZ_BASE_URL env var or defaults to Docker service name.
+ */
+export function getAuthzBaseUrl() {
+    return process.env.AUTHZ_BASE_URL || process.env.AUTHZ_URL || 'http://authz-api:8010';
+}
+//# sourceMappingURL=authz-url.js.map

package/dist/lib/authz/authz-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-url.js","sourceRoot":"","sources":["../../../src/lib/authz/authz-url.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,uBAAuB,CAAC;AACxF,CAAC"}