@jazzmind/busibox-app 3.0.18

package/dist/lib/next/service-client.js

@@ -0,0 +1,146 @@
+/**
+ * Service client helpers for calling downstream Busibox services.
+ *
+ * Provides utilities for:
+ * - Obtaining authz-issued access tokens for specific services (Zero Trust)
+ * - Making authenticated requests to data-api, search-api, agent-api
+ * - Handling token caching and refresh
+ *
+ * Zero Trust Architecture:
+ * - Requires session JWT for token exchange (cryptographic proof of identity)
+ * - NO client credentials required for user operations
+ */
+import { getAuthorizationHeaderWithSession } from '../authz/next-client';
+/**
+ * Get the base URL for a service from environment variables.
+ */
+export function getServiceBaseUrl(service) {
+    switch (service) {
+        case 'data-api': {
+            const host = process.env.DATA_API_HOST || '10.96.200.206';
+            const port = process.env.DATA_API_PORT || '8002';
+            return `http://${host}:${port}`;
+        }
+        case 'search-api': {
+            const host = process.env.SEARCH_API_HOST || '10.96.200.204';
+            const port = process.env.SEARCH_API_PORT || '8003';
+            return `http://${host}:${port}`;
+        }
+        case 'agent-api': {
+            const host = process.env.AGENT_API_HOST || '10.96.200.202';
+            const port = process.env.AGENT_API_PORT || '8000';
+            return `http://${host}:${port}`;
+        }
+    }
+}
+/**
+ * Get default scopes for a service.
+ *
+ * Note: Currently returns empty arrays because scopes are not enforced
+ * by the downstream services. Authorization is handled via RBAC and
+ * audience-bound tokens.
+ */
+export function getDefaultScopes(service) {
+    // Scopes are not currently enforced - return empty array
+    // to avoid authz client scope validation errors
+    return [];
+}
+/**
+ * Create authenticated headers for calling a downstream service.
+ *
+ * This obtains an authz-issued access token and returns headers
+ * suitable for fetch() calls.
+ *
+ * @example
+ * ```typescript
+ * const headers = await createServiceHeaders({
+ *   userId: user.id,
+ *   service: 'search-api',
+ *   scopes: ['read'],
+ * });
+ *
+ * const response = await fetch(`${getServiceBaseUrl('search-api')}/search`, {
+ *   method: 'POST',
+ *   headers,
+ *   body: JSON.stringify({ query: 'example' }),
+ * });
+ * ```
+ */
+export async function createServiceHeaders(options) {
+    const { sessionJwt, userId, service, scopes, purpose } = options;
+    // Use Zero Trust token exchange (no client credentials)
+    const authorization = await getAuthorizationHeaderWithSession({
+        sessionJwt,
+        userId,
+        audience: service,
+        scopes: scopes ?? getDefaultScopes(service),
+        purpose: purpose ?? `busibox-portal.${service}`,
+    });
+    return {
+        'Content-Type': 'application/json',
+        Authorization: authorization,
+    };
+}
+/**
+ * Make an authenticated request to a downstream service.
+ *
+ * This is a convenience wrapper around fetch() that:
+ * - Obtains an authz-issued access token
+ * - Constructs the full URL
+ * - Sets appropriate headers
+ * - Returns the response
+ *
+ * @example
+ * ```typescript
+ * const response = await callService({
+ *   userId: user.id,
+ *   service: 'search-api',
+ *   path: '/search',
+ *   method: 'POST',
+ *   body: { query: 'example' },
+ * });
+ *
+ * if (!response.ok) {
+ *   throw new Error(`Search failed: ${response.statusText}`);
+ * }
+ *
+ * const data = await response.json();
+ * ```
+ */
+export async function callService(options) {
+    const { sessionJwt, userId, service, scopes, purpose, path, method = 'GET', body, extraHeaders } = options;
+    const baseUrl = getServiceBaseUrl(service);
+    const url = `${baseUrl}${path}`;
+    const headers = await createServiceHeaders({
+        sessionJwt,
+        userId,
+        service,
+        scopes,
+        purpose,
+    });
+    // Merge extra headers
+    if (extraHeaders) {
+        Object.assign(headers, extraHeaders);
+    }
+    const fetchOptions = {
+        method,
+        headers,
+    };
+    if (body && (method === 'POST' || method === 'PUT' || method === 'PATCH')) {
+        fetchOptions.body = JSON.stringify(body);
+    }
+    return fetch(url, fetchOptions);
+}
+/**
+ * Legacy compatibility: create headers with X-User-Id.
+ *
+ * @deprecated Use createServiceHeaders() instead. This is only for
+ * gradual migration of existing routes.
+ */
+export function createLegacyHeaders(userId) {
+    return {
+        'Content-Type': 'application/json',
+        'X-User-Id': userId,
+    };
+}
+//# sourceMappingURL=service-client.js.map

package/dist/lib/next/service-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-client.js","sourceRoot":"","sources":["../../../src/lib/next/service-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,iCAAiC,EAAsB,MAAM,sBAAsB,CAAC;AAiB7F;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAoB;IACpD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,eAAe,CAAC;YAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC;YACjD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC;YAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC;YACnD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;YAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC;YAClD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoB;IACnD,yDAAyD;IACzD,gDAAgD;IAChD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA6B;IACtE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEjE,wDAAwD;IACxD,MAAM,aAAa,GAAG,MAAM,iCAAiC,CAAC;QAC5D,UAAU;QACV,MAAM;QACN,QAAQ,EAAE,OAAwB;QAClC,MAAM,EAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,OAAO,IAAI,kBAAkB,OAAO,EAAE;KAChD,CAAC,CAAC;IAEH,OAAO;QACL,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,aAAa;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAKC;IAED,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAC9F,OAAO,CAAC;IAEV,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,OAAO,GAAG,IAAI,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,UAAU;QACV,MAAM;QACN,OAAO;QACP,MAAM;QACN,OAAO;KACR,CAAC,CAAC;IAEH,sBAAsB;IACtB,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAgB;QAChC,MAAM;QACN,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;QAC1E,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO;QACL,cAAc,EAAE,kBAAkB;QAClC,WAAW,EAAE,MAAM;KACpB,CAAC;AACJ,CAAC"}

package/dist/lib/next/sso.d.ts

@@ -0,0 +1,51 @@
+/**
+ * SSO Token Generation (Zero Trust)
+ *
+ * Uses authz service OAuth2 token exchange (RFC 8693) to generate app-scoped tokens.
+ *
+ * Flow:
+ * 1. User requests access to an app (e.g., busibox-agents)
+ * 2. busibox-portal exchanges user's session JWT with authz for an app-scoped token
+ * 3. authz verifies user has access to the app via RBAC bindings
+ * 4. authz issues RS256 token with app_id claim and user's roles
+ * 5. External app validates token via authz JWKS: GET /.well-known/jwks.json
+ *
+ * Benefits:
+ * - Standardized OAuth2 flow (RFC 8693)
+ * - Asymmetric signing (RS256) with JWKS
+ * - Service-scoped tokens (audience enforcement)
+ * - App access controlled via authz RBAC bindings
+ * - Centralized audit logging
+ * - No client credentials needed - JWT proves identity
+ */
+/**
+ * User info for SSO token generation
+ */
+export interface SSOUserInfo {
+    id: string;
+    email: string;
+    roles: string[];
+    sessionJwt: string;
+}
+/**
+ * Generate an app-scoped access token for a user to access an external app.
+ *
+ * Zero Trust Flow:
+ * 1. Verify app exists and is active in busibox-portal DB
+ * 2. Exchange user's session JWT for an app-scoped token via authz
+ * 3. Authz verifies user has app access via RBAC bindings
+ * 4. Authz issues RS256 token with app_id claim
+ *
+ * The external app validates this token via authz JWKS endpoint:
+ * GET {authz_url}/.well-known/jwks.json
+ *
+ * @param userInfo - User info including id, email, roles, and sessionJwt
+ * @param appIdentifier - App identifier (UUID, stable audience, path, or name)
+ * @returns JWT token string and expiration date
+ */
+export declare function generateSSOToken(userInfo: SSOUserInfo, appIdentifier: string): Promise<{
+    token: string;
+    expiresAt: Date;
+    appUrl: string | null;
+}>;
+//# sourceMappingURL=sso.d.ts.map

package/dist/lib/next/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","sourceRoot":"","sources":["../../../src/lib/next/sso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAoBH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAsBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5F,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC,CAoHD"}

package/dist/lib/next/sso.js

@@ -0,0 +1,167 @@
+/**
+ * SSO Token Generation (Zero Trust)
+ *
+ * Uses authz service OAuth2 token exchange (RFC 8693) to generate app-scoped tokens.
+ *
+ * Flow:
+ * 1. User requests access to an app (e.g., busibox-agents)
+ * 2. busibox-portal exchanges user's session JWT with authz for an app-scoped token
+ * 3. authz verifies user has access to the app via RBAC bindings
+ * 4. authz issues RS256 token with app_id claim and user's roles
+ * 5. External app validates token via authz JWKS: GET /.well-known/jwks.json
+ *
+ * Benefits:
+ * - Standardized OAuth2 flow (RFC 8693)
+ * - Asymmetric signing (RS256) with JWKS
+ * - Service-scoped tokens (audience enforcement)
+ * - App access controlled via authz RBAC bindings
+ * - Centralized audit logging
+ * - No client credentials needed - JWT proves identity
+ */
+import { logOAuthTokenGenerated } from '../services/audit';
+import { exchangeTokenZeroTrust } from '@jazzmind/busibox-app';
+import { getAuthzBaseUrl } from './authz-client';
+import { getAppByIdFromStore, getAppConfigStoreContextForUser, listAppsFromStore, resolveStableSsoAudience } from '../stores/app-config-store';
+/**
+ * Get audit client options for server-side audit logging.
+ */
+function getAuditOptions() {
+    return {
+        authzUrl: getAuthzBaseUrl(),
+    };
+}
+function normalizeIdentifier(value) {
+    return value.trim().toLowerCase();
+}
+function normalizePath(value) {
+    const trimmed = value.trim();
+    return trimmed.startsWith('/') ? trimmed.toLowerCase() : `/${trimmed.toLowerCase()}`;
+}
+function isPortalInternalBuiltInRoute(_url) {
+    // In the monorepo, all built-in apps (chat, documents, admin, etc.) run as
+    // separate Next.js apps with their own basePath. Nothing is portal-internal
+    // anymore — all apps need SSO token exchange.
+    return false;
+}
+// ============================================================================
+// Token Generation
+// ============================================================================
+/**
+ * Generate an app-scoped access token for a user to access an external app.
+ *
+ * Zero Trust Flow:
+ * 1. Verify app exists and is active in busibox-portal DB
+ * 2. Exchange user's session JWT for an app-scoped token via authz
+ * 3. Authz verifies user has app access via RBAC bindings
+ * 4. Authz issues RS256 token with app_id claim
+ *
+ * The external app validates this token via authz JWKS endpoint:
+ * GET {authz_url}/.well-known/jwks.json
+ *
+ * @param userInfo - User info including id, email, roles, and sessionJwt
+ * @param appIdentifier - App identifier (UUID, stable audience, path, or name)
+ * @returns JWT token string and expiration date
+ */
+export async function generateSSOToken(userInfo, appIdentifier) {
+    // Verify app exists and is active
+    const context = await getAppConfigStoreContextForUser(userInfo.id, userInfo.sessionJwt);
+    const requestedIdentifier = appIdentifier.trim();
+    let app = await getAppByIdFromStore(context.accessToken, requestedIdentifier);
+    if (!app) {
+        const allApps = await listAppsFromStore(context.accessToken);
+        const normalized = normalizeIdentifier(requestedIdentifier);
+        const pathLike = normalizePath(requestedIdentifier);
+        app =
+            allApps.find((candidate) => candidate.ssoAudience?.toLowerCase() === normalized) ||
+                allApps.find((candidate) => candidate.name.toLowerCase() === normalized) ||
+                allApps.find((candidate) => candidate.url?.toLowerCase() === pathLike) ||
+                allApps.find((candidate) => candidate.deployedPath?.toLowerCase() === pathLike) ||
+                null;
+    }
+    if (!app) {
+        throw new Error(`App not found: ${requestedIdentifier}`);
+    }
+    if (!app.isActive) {
+        throw new Error('App is not active');
+    }
+    // In the monorepo, all apps (BUILT_IN, LIBRARY, EXTERNAL) are separate
+    // Next.js apps and need SSO token exchange.
+    const allowSso = app.type === 'EXTERNAL' ||
+        app.type === 'LIBRARY' ||
+        app.type === 'BUILT_IN';
+    if (!allowSso) {
+        throw new Error('App does not support SSO authentication');
+    }
+    console.log('[SSO] Requesting app-scoped token from authz:', {
+        userId: userInfo.id,
+        requestedIdentifier,
+        appId: app.id,
+        appName: app.name,
+        ssoAudience: app.ssoAudience,
+    });
+    const audience = resolveStableSsoAudience(app);
+    // Exchange session JWT for app-scoped token via authz
+    // Authz will verify user has access to this app via RBAC bindings
+    // and issue RS256 token with app_id claim and user's roles
+    try {
+        const result = await exchangeTokenZeroTrust({
+            sessionJwt: userInfo.sessionJwt,
+            audience,
+            resourceId: app.id, // Canonical app UUID for RBAC check
+            purpose: 'sso-app-access',
+        }, {
+            authzBaseUrl: getAuthzBaseUrl(),
+            verbose: process.env.VERBOSE_AUTHZ_LOGGING === 'true',
+        });
+        const expiresAt = new Date(result.expiresAt);
+        console.log('[SSO] App-scoped token issued by authz:', {
+            userId: userInfo.id,
+            requestedIdentifier,
+            appId: app.id,
+            appName: app.name,
+            audience,
+            expiresIn: result.expiresIn,
+        });
+        // Log token generation (audit failure is non-fatal)
+        // Note: authz already logs the token issuance in its audit log
+        try {
+            const auditOptions = getAuditOptions();
+            await logOAuthTokenGenerated(userInfo.id, app.id, auditOptions);
+        }
+        catch (auditError) {
+            console.error('[SSO] Audit logging failed (non-fatal):', auditError);
+        }
+        // For deployed apps, use deployedPath (e.g., /myapp)
+        // For external web apps, use the URL directly
+        // local-dev:// URLs should use deployedPath once deployed
+        let appUrl = app.url;
+        if (app.deployedPath && app.lastDeploymentStatus === 'completed') {
+            appUrl = app.deployedPath;
+        }
+        else if (app.url?.startsWith('local-dev://')) {
+            // local-dev app not yet deployed - use deployedPath if available
+            appUrl = app.deployedPath || null;
+        }
+        return {
+            token: result.accessToken,
+            expiresAt,
+            appUrl,
+        };
+    }
+    catch (error) {
+        // Map authz errors to user-friendly messages
+        const errorMessage = error.message || String(error);
+        if (errorMessage.includes('user_does_not_have_app_access')) {
+            throw new Error('User does not have permission to access this app');
+        }
+        if (errorMessage.includes('403')) {
+            throw new Error('User does not have permission to access this app');
+        }
+        if (errorMessage.includes('session_revoked') || errorMessage.includes('expired')) {
+            throw new Error('Session has expired. Please log in again.');
+        }
+        console.error('[SSO] Token exchange failed:', error);
+        throw new Error(`Failed to generate app token: ${errorMessage}`);
+    }
+}
+//# sourceMappingURL=sso.js.map

package/dist/lib/next/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../../../src/lib/next/sso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAA2B,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE/I;;GAEG;AACH,SAAS,eAAe;IACtB,OAAO;QACL,QAAQ,EAAE,eAAe,EAAE;KAC5B,CAAC;AACJ,CAAC;AAgBD,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAoB;IACxD,2EAA2E;IAC3E,4EAA4E;IAC5E,8CAA8C;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAqB,EAAE,aAAqB;IAKjF,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,+BAA+B,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,mBAAmB,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,GAAG,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;QACpD,GAAG;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC;gBAChF,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC;gBAC/E,IAAI,CAAC;IACT,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,kBAAkB,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,QAAQ,GACZ,GAAG,CAAC,IAAI,KAAK,UAAU;QACvB,GAAG,CAAC,IAAI,KAAK,SAAS;QACtB,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC;IAE1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE;QAC3D,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,mBAAmB;QACnB,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAE/C,sDAAsD;IACtD,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;YACE,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ;YACR,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,oCAAoC;YACxD,OAAO,EAAE,gBAAgB;SAC1B,EACD;YACE,YAAY,EAAE,eAAe,EAAE;YAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;SACtD,CACF,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,yCAAyC,EAAE;YACrD,MAAM,EAAE,QAAQ,CAAC,EAAE;YACnB,mBAAmB;YACnB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,OAAO,EAAE,GAAG,CAAC,IAAI;YACjB,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,oDAAoD;QACpD,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;YACvC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,UAAU,CAAC,CAAC;QACvE,CAAC;QAED,qDAAqD;QACrD,8CAA8C;QAC9C,0DAA0D;QAC1D,IAAI,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;QACrB,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,oBAAoB,KAAK,WAAW,EAAE,CAAC;YACjE,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC;QAC5B,CAAC;aAAM,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/C,iEAAiE;YACjE,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QACpC,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,SAAS;YACT,MAAM;SACP,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,6CAA6C;QAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAEpD,IAAI,YAAY,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}